Zero-shot anomaly detection (ZSAD) aims to identify anomalies in unseen domains (e.g., industrial or medical imagery) by leveraging pre-trained vision-language models like CLIP. However, the direct application of CLIP is impeded by two critical challenges: the feature misalignment arising from the discrepancy between fixed receptive fields and diverse anomaly scales, and the decision ambiguity caused by the inherent conflict between global semantic coherence and local defect sensitivity. To tackle these issues, we propose SSHF-CLIP, a novel framework that unifies Semantic-Guided Scale Selection and Hybrid Fusion. SSHF-CLIP integrates a Semantic-Guided Scale Selection (SGSS) module and a Global-Semantic Fusion Module (GSFM). SGSS first employs a semantic-driven gating mechanism to adaptively reweight multi-scale representations, followed by a learnable projection transformation to align the aggregated features with the textual embedding space. This design effectively suppresses background noise and captures structure-critical anomalies. Furthermore, GSFM implements a discrepancy-aware strategy by dynamically calibrating the global semantic with fine-grained local semantics mined from a Local Anomaly Feature Extractor (LAFE), effectively resolving the trade-off between detection sensitivity and false positive suppression. Extensive experiments on eight benchmarks (including MVTec AD, VisA, and medical datasets) demonstrate that SSHF-CLIP significantly outperforms eight state-of-the-art methods, achieving superior zero-shot generalization across diverse domains.

Vision-language pre-trained models such as CLIP have shown promising cross-scene generalization for visual anomaly detection, but they remain vulnerable to false positives under complex backgrounds and often produce fragmented anomaly regions. In this paper, we study source-supervised zero-shot anomaly detection, where training uses labeled source-domain data and testing is conducted directly on unseen target domains. To address these issues, we propose BSR-CLIP, a background-calibrated and structure-aware vision-language anomaly detection framework that improves the reliability and spatial consistency of anomaly responses. Specifically, we introduce a Structure-Aware Response Correlation Spreading module (RCS), which leverages intermediate-layer self-attention to propagate anomaly responses along structurally related regions, and a Spatial Response Refinement module (SRR), which suppresses noise through intensity-gated adaptive smoothing. Experiments on multiple benchmarks show that BSR-CLIP achieves superior performance under direct source-to-target transfer, including gains of +0.5 I-AP on VisA, +2.5 P-PRO on Kvasir, and +1.0 in both image-level AUROC and AP on Br35H. In addition, BSR-CLIP demonstrates strong robustness in few-shot settings.

Continual learning (CL) aims to enable networks to learn continuously from sequentially arriving task streams while avoiding catastrophic forgetting (CF) of previously learned tasks. In recent years, Orthogonal gradient projection (OGP)-based CL methods have garnered significant attention from the research community due to their remarkable performance. However, existing OGP approaches overlook two critical issues: (1) representation matrices are typically constructed via random sampling, which introduces misclassified and class-imbalanced samples into the projection basis, contaminating important gradient directions and degrading stability; and (2) task-specific output scale variations induce domain drift, resulting in projection bias that weakens orthogonal constraints across tasks. To address these limitations, we propose Stable Gradient Projection for Continual Learning (STEP), a plug-and-play enhancement framework for OGP-based CL that integrates Correctness-aware Balanced Sampling (CBS) to construct purified and class-balanced projection subspaces using only correctly classified samples, and Sigmoid Attention Constraint (SAC) to enforce consistent output scaling via a sigmoid-based gating mechanism, thereby mitigating scale-induced projection bias. Extensive experiments on Split CIFAR-100, CIFAR-100 Superclass, and 5-Datasets demonstrate that STEP consistently improves state-of-the-art OGP methods, achieving up to +1.4% average accuracy (ACC) gains on Split CIFAR-100, improving backward transfer (BWT) from − 0.37 to − 0.09 for GPM and from − 1.06 to − 0.73 for SGP, and attaining 93.28% ACC with positive BWT (0.17) on 5-Datasets. These results validate STEP as a simple yet effective strategy for enhancing stability–plasticity balance in OGP-based CL.

Salient object detection in optical remote sensing images (ORSI-SOD) aims to automatically identify the most visually prominent objects or regions in remote sensing images. However, due to the diverse orientations and varying scales of salient objects, as well as cluttered backgrounds, it remains a challenging task. To tackle these issues, we propose a direction-aware attention and semantic guidance network (DASGNet), a novel framework designed to enhance sensitivity to both orientation and multi-scale information while improving the depiction of boundaries in complex scenes. DASGNet integrates two key modules: a multi-scale direction-aware attention module (MDAM) and a semantic-guided edge reconstruction module (SERM). MDAM combines the attention mechanism with orientation information, effectively suppressing redundant information while capturing multi-scale orientation features. SERM employs 3D convolution to construct a stereoscopic receptive field, facilitating the integration of high-level semantic information across scales to guide the reconstruction of low-level texture information and thereby achieving precise edge delineation, particularly in complex scenes. Extensive experiments on three benchmark datasets demonstrate that DASGNet outperforms 14 state-of-the-art methods, achieving significant improvements in both accuracy and precision.

Current RGB-D salient object detection (SOD) methods predominantly rely on simplistic cross-modal fusion strategies that inadequately model intrinsic inter-modal correlations and underutilize hierarchical representations in U-shaped architecture. This often leads to incomplete predictions and boundary ambiguities due to insufficient exploitation of low-level spatial details. To address these limitations, we propose the Cross-Modal Consistency and Aggregative Decoding in enhanced UNet (CMAD-UNet), a novel architecture designed to advance saliency detection through synergistic multi-modal correlation fusion and adaptive feature aggregation. Specifically, this network integrates three core modules: Enhanced Atrous Spatial Pyramid Pooling Module (EnASP) embedded in a dual-branch hybrid Convolutional Neural Networks (CNNs) and Transformer encoder expands the receptive field to capture global contextual information; Correlation-Perceptive Fusion Module (CPFM) constructs learnable affinity matrices through contrastive consistency learning, effectively suppressing cross-modal noise while aligning feature distributions; Selective Aggregation Decoding Module (SADM) dynamically weights multi-level features via channel-spatial attention mechanisms during upsampling, suppressing noise propagation and generating saliency maps with well-defined boundaries. Through extensive experiments on 8 benchmark datasets evaluated with 5 metrics, CMAD-UNet demonstrates superior performance compared to 14 state-of-the-art approaches.

Darknet markets are underground markets for various illicit transactions, including selling or brokering drugs, weapons, and stolen credit cards. To combat these illicit activities in cyberspace, it is critical to understand the activity behaviors of participants in the darknet markets. Currently, many studies focus on studying the activities of vendors. However, there is no much work on analyzing buyers. The key challenge is that the buyers are anonymized in darknet markets. To ensure the anonymity of transactions, we only observe the first a nd last digits of a buyer’s ID, such as "a**b", on most of the darknet markets. To tackle this challenge, we propose a hidden buyer identification model, called UNMIX, which can group transactions from one hidden buyer into one cluster given a transaction sequence from an anonymized ID. UNMIX is able to model the temporal dynamics information as well as the product, comment, and vendor information associated with each transaction. Then, the transactions with similar patterns in terms of time and content are grouped as a subsequence from one hidden buyer. Experiments on the data collected from three real-world darknet markets and one DBLP publication dataset demonstrate the effectiveness of our approach measured by various clustering metrics. Case studies on real transaction sequences explicitly show that our approach can group transactions with similar patterns into the same clusters.

Insiders cause significant cyber-security threats to organizations. Due to a very limited number of insiders, most of the current studies adopt unsupervised learning approaches to detect insiders by analyzing the audit data that record information about employees' activities. However, in practice, we do observe a small number of insiders. How to make full use of these few observed insiders to improve a classifier for insider threat detection is a key challenge. In this work, we propose a novel framework combining the idea of self-supervised pre-training and metric-based few-shot learning to detect insiders. Experimental results on insider threat datasets demonstrate that our model outperforms the existing anomaly detection approaches by only using a few insiders.

Insiders usually cause significant losses to organizations and are hard to detect. Currently, various approaches have been proposed to achieve insider threat detection based on analyzing the audit data that record information of the employee’s activity type and time. However, the existing approaches usually focus on modeling the users’ activity types but do not consider the activity time information. In this paper, we propose a hierarchical neural temporal point process model by combining the temporal point processes and recurrent neural networks for insider threat detection. Our model is capable of capturing a general nonlinear dependency over the history of all activities by the two-level structure that effectively models activity times, activity types, session durations, and session intervals information. Experimental results on two datasets demonstrate that our model outperforms the models that only consider information of the activity types or time alone.