NOVA: Normal-Side Modeling for Training-Free Zero-Shot Video Anomaly Detection

1. Introduction

• VAD targets rare, diverse abnormalities, while supervised and weakly supervised methods require annotated target-domain anomalies and are less reliable in new scenes.Source: §1 · p. 1
• Normal prompts directly shape the anomaly decision boundary, yet normality semantics remain underexplored in training-free ZS-VAD.Source: §1 · p. 1
• Normal descriptions can retain ambiguous verbs such as running or chasing, while text-derived normal anchors may not align with visual frames or video-specific appearance.Source: §1 · pp. 1–2
• NOVA addresses these limitations with Normality-Aware Prompt Construction, a per-video Visual Normality Anchor, and lightweight Motion-Aware Stabilization in a fully training-free framework.Source: §1 · p. 2
• 95.07% AUC on XD-Violence and 89.86% AUC on UCF-Crime give NOVA state-of-the-art performance among comparable training-free ZS-VAD methods.Source: §1 · p. 2

2.1. Video Anomaly Detection

• Earlier VAD methods rely on task-specific data and learn dataset-specific normality; training-free ZS-VAD instead targets unseen anomalies with frozen models and no target-domain training data.Source: §2.1 · p. 2, §2.2 · p. 2

2.2. Zero-Shot Video Anomaly Detection

• Training-free ZS-VAD includes prompt-contrastive scoring against normal and abnormal descriptions and reasoning-based scoring from frozen VLMs or MLLMs; NOVA retains the former.Source: §2.2 · p. 2

2.3. Normality Modeling

• Prior ZS-VAD specifies normality through pre-inference text or text-only memories; NOVA instead constructs test-video visual anchors without normal training videos or task-specific training.Source: §2.3 · p. 3

2.4. Prompt Design and Modality Gap

• Prompt wording matters because anomaly scores contrast normal and abnormal descriptions, but semantically appropriate prompts may still be distant from normal video features due to the text–visual modality gap.Source: §2.4 · p. 3

3.1. Problem Definition and Framework

• NOVA estimates frame-level anomaly scores from a test video without task-specific training or target-domain adaptation, using a frozen encoder and four components.The components are Normality-Aware Prompt Construction, prompt-contrastive scoring, a per-video Visual Normality Anchor, and Motion-Aware Stabilization.Source: §3.1 · p. 3

3.2. Normality-Aware Prompt Construction (NA)

• NA mines category-specific confusing normal actions, generates shared calm-scene anchors, and prohibits confusing terms in normal descriptions.It can geometrically flag and revise residual normal descriptions that remain close to the anomaly side, retaining a revision only when ambiguity is reduced.Source: §3.2 · pp. 3–4

3.3. Prompt-Contrastive Anomaly Scoring

• Prompt-contrastive scoring compares each frame’s visual embedding with category-conditioned anomaly and normal prompt pools, then takes the maximum category score.It uses Top-50% mean aggregation to reduce noise from individual prompts and downweights anomaly similarity with α < 1 to compensate for prompt asymmetry.Source: §3.3 · pp. 4–5

3.4. Visual Normality Anchor (VNA)

• VNA estimates a video-specific visual normal reference from the first Nwarm sampled embeddings, weighting lower-scoring warm-up frames more heavily.The resulting anchor is added to the normal embedding pool and shared across anomaly categories; when MAS is enabled, windowed aggregation precedes VNA estimation.Source: §3.4 · p. 5

3.5. Motion-Aware Stabilization (MAS)

• MAS stabilizes frame-level anomaly scoring with windowed embeddings and a soft motion gate that down-weights low-motion frames without setting their scores to zero.The gated scores are then Gaussian-smoothed; the motion threshold and gate slope are fixed across datasets without target-specific tuning.Source: §3.5 · pp. 5–6

4.1. Experimental Setup

• Evaluation uses official test sets with frame-level annotations: UCF-Crime reports frame-level AUC-ROC, while XD-Violence reports frame-level AUC-ROC and AP.NOVA’s results average five independently generated prompt banks; competing-method results are taken from their respective papers.Source: §4.1 · p. 6, §4.2 · p. 6

4.3. Ablation Study

• NA gives the largest and most consistent module gains: relative to baseline, it improves UCF AUC by 3.17 pp, XD AUC by 0.78 pp, and XD AP by 3.97 pp without added inference-time computation.The ablation uses a controlled setup with the same backbone, scoring hyperparameters, and SAP rule across configurations.Source: §4.3 · pp. 6–7, Table 2 · p. 7

4.2. Comparison with State-of-the-Art

• NOVA achieves the best performance among training-free zero-shot methods on all three metrics, including XD-Violence AP gains of 9.69 pp over Flashback [7] and AUC gains of 4.52 pp over VADTree [9].It also obtains the highest frame-level AUC on UCF-Crime and remains competitive with several weakly supervised methods without target-domain training, fine-tuning, or calibration.Source: §4.2 · p. 6, Table 1 · p. 7

4.3. Ablation Study

• MAS improves UCF AUC by 1.11 pp but decreases XD AUC and AP by 1.97 and 7.48 pp; with VNA, XD AP variability falls from 1.35–1.60 to 0.56–0.91.With NA enabled, MAS without VNA lowers XD AP from 84.33 to 72.96, whereas VNA+MAS reaches 84.82; after VNA, MAS adds only 0.32, 0.22, and 0.17 pp on UCF AUC, XD AUC, and XD AP.Source: §4.3 · p. 7
• NA and VNA together improve over either alone, with partially overlapping gains on UCF-Crime (3.92 pp versus 4.54 pp summed) but nearly additive gains on XD-Violence.On XD-Violence, their joint gains are 1.34 pp AUC and 4.29 pp AP, versus summed individual gains of 1.35 and 4.08 pp.Source: §4.3 · p. 7

4.4. Analysis

• Adding normal descriptions and jointly scoring normal and anomaly prompts improves performance, while NA further removes ambiguous descriptions; their centroid cosine similarity decreases from 0.904 to 0.844.Figure 2 visualizes prompt embeddings with and without NA, showing clearer separation and less overlap between normal and anomaly prompts.Source: §4.4 · pp. 7–8, Figure 2 · p. 8
• For the representative video, VNA’s cosine similarity to the normal-frame centroid is 0.989 ± 0.002, versus 0.186 ± 0.017 for textual normal centroids; across videos, the means are 0.969 and 0.167.In 94.29% of videos, the textual anomaly centroid is closer to the normal-frame centroid than the textual normal centroid.Source: §4.4 · p. 8, Figure 3 · p. 8

5. Conclusions

• NOVA achieves 89.86% AUC on UCF-Crime and 95.07% AUC / 84.82% AP on XD-Violence without training, fine-tuning, or target-data calibration.Ablation and embedding-space analyses further demonstrate the importance of explicit normal-side modeling and the complementary roles of linguistic and visual normality.Source: §5 · p. 8
• NOVA models normality linguistically and visually, and the findings suggest a better normality–anomaly boundary can provide a stronger basis for anomaly discrimination.The conclusion notes that increasingly elaborate anomaly representations are not necessarily required.Source: §5 · p. 8
• The fixed visual anchor is estimated from an early-video warm-up prefix and applied throughout the video, limiting applicability to long-term, open-world detection where normality may evolve.The authors identify online, scene-adaptive normality modeling as a future direction.Source: §5 · p. 8

Detection

• Table S1 examines sensitivity to the prompt-generation LLM.Each model generates M = 20 positive and 20 negative descriptions per anomaly category.Source: Table S1 · p. 11
• The reported results are percentages from one prompt-generation seed.Source: Table S1 · p. 11
• Downstream settings are fixed across the Table S1 comparison.Source: Table S1 · p. 11

A. Sensitivity to the Prompt-Generation LLM

• The prompt-generation sensitivity test uses GPT-5.4-mini, Gemini 3.5 Flash Lite, and Qwen-2.5-72B-Instruct with the same generation seed and fixed downstream settings.Both NA-only and full NOVA are evaluated for each prompt bank.Source: A. Sensitivity to the… · p. 11
• Across all three evaluated generators, full NOVA consistently improves over the corresponding NA-only configuration.The prompt banks use M = 20 descriptions per side, with downstream evaluation settings fixed.Source: A. Sensitivity to the… · p. 11
• UCF-Crime AUC ranges from 89.21–90.33% across the evaluated prompt-generation LLMs.Source: A. Sensitivity to the… · p. 11
• XD-Violence results range from 94.69–95.48% AUC and 83.21–85.40% AP across the evaluated prompt-generation LLMs.Source: A. Sensitivity to the… · p. 11

B. Sensitivity to the Number of Prompts

• The prompt-count experiment uses M ∈ {10, 20, 40, 100} descriptions per side from the same generation run, with one prompt-generation seed.NA is enabled while VNA and MAS are disabled.Source: B. Sensitivity to the Number of Prompts · p. 11, Table S2 · p. 11
• For each dataset, the prompt-count comparison draws each M-sized set from the same 100 positive and 100 negative descriptions, with NA enabled and VNA and MAS disabled.Source: Table S2 · p. 11

M UCF AUC XD AUC XD AP

• The prompt-count experiment keeps other settings identical to the main evaluation protocol.Source: M UCF AUC XD AUC XD AP · p. 11
• UCF-Crime AUC rises from 87.53% to 89.22%, and XD-Violence AUC rises from 93.86% to 94.58% as M increases.The tested prompt counts are M = 10, 20, 40, and 100.Source: M UCF AUC XD AUC XD AP · p. 11
• XD-Violence AP reaches 84.60% at M = 20, then changes to 83.76% at M = 40 and 84.19% at M = 100.The passage concludes that increasing prompt count can improve AUC without consistently improving AP.Source: M UCF AUC XD AUC XD AP · p. 11

• Across 8 to 64 sampled embeddings, maximum variation is 0.39 pp in UCF-Crime AUC, 0.57 pp in XD-Violence AUC, and 1.67 pp in XD-Violence AP.Source: C. Sensitivity to the Warm-up Length… · p. 11
• On XD-Violence, performance rises gradually with larger Nwarm, but the improvement is not critical.The experiments therefore use Nwarm = 32 throughout, without dataset-specific tuning.Source: C. Sensitivity to the Warm-up Length… · p. 11

• Figure S1 shows six UCF-Crime videos, with the score-weighted aVNA and ground-truth normal-frame centroid marked against frame and prompt embeddings.Blue and red dots denote normal and anomalous frames; triangles denote category-specific normal and anomaly prompts, and gray markers denote prompts from other categories.Source: Figure S1 · p. 12
• Table S3 reports Nwarm sensitivity results as means and standard deviations over five prompt banks, with the default setting marked.Source: Table S3 · p. 12
• In the illustrative videos, the VNA anchor lies substantially closer to the post-hoc visual normal centroid than the category-specific textual normal centroid.Source: D. Additional Geometric Analysis · p. 12

• NA generally lowers anomaly scores on normal segments while preserving clear responses around annotated anomaly intervals.Source: E. Qualitative Analysis · p. 12
• VNA further suppresses false-positive peaks outside anomaly regions, increasing contrast between normal and anomalous frames.Source: E. Qualitative Analysis · p. 12
• MAS mainly smooths temporal score curves by reducing short-lived fluctuations.Source: E. Qualitative Analysis · p. 12

F. Prompt-Generation Templates and Footage Conditioning

• Dataset-level footage descriptions, roles, and examples are fixed and reused across categories, seeds, and runs, without adapting them using target videos, labels, or scores.Source: F. Prompt-Generation Templates and… · p. 12, §F.3 · p. 13

F.1. Category-Conditioned Confusing Action Mining

• The Verb Miner identifies benign actions that visually resemble a given anomaly, so they can be excluded from normal descriptions.The prompt asks for five to eight ambiguous verbs or short action phrases per category.Source: §F.1 · p. 13

F.2. Calm Anchor Generation

• The Anchor Generator produces short, ordinary establishing-scene descriptions with no conflict or weapons and little or no motion.Source: §F.2 · p. 13

F.3. Prompt-Generation Skeleton

• NA's negative rules favor safe, static, or slow behaviors, forbid category-specific confusing actions, and require calm-anchor items.The shared skeleton also asks for positive descriptions of one specific, visually observable atomic action.Source: §F.3 · pp. 13–14
• The unconstrained comparison removes the category-specific confusing-action list, static-action preference, and calm-anchor constraint from normal-prompt instructions.Source: §F.3 · p. 14

F.4. Geometric Critic and Refinement

• The Geometric Critic flags normal descriptions whose cosine similarity to the positive centroid exceeds 0.70; rewrites are accepted only if ambiguity falls, for at most three rounds.Source: §F.4 · p. 14

F.5. Effect of Footage Conditioning

• Shooting-prompt examples use surveillance footage context for UCF-Crime and movie or online video context for XD-Violence.The examples pair category-specific shooting descriptions with domain-specific normal-scene descriptions.Source: §F.5 · pp. 14–15