- 29 Apr 2025
- 5 Minutes to read
- Print
- DarkLight
- PDF
Anomaly Detection
- Updated on 29 Apr 2025
- 5 Minutes to read
- Print
- DarkLight
- PDF
This article applies to these versions of LandingLens:
LandingLens | LandingLens on Snowflake |
✓ | ✓ |
The Anomaly Detection project type is used to identify deviations from the norm, especially when you have few images of "abnormal" cases. These projects have two built-in classes: Normal and Abnormal, which you assign to images.
Anomaly Detection models train on Normal images to learn their patterns. The model then flags any deviations as potential anomalies.
When to Use Anomaly Detection
Use Anomaly Detection when detecting any deviation from the norm is the primary goal, or when you have few images of "abnormal" cases.
Anomaly Detection is useful in scenarios such as:
- Manufacturing: You’re manufacturing hoses and need to stop the production line if a defect—such as a tear, puncture, or streak—is detected. The presence of a defect matters more than its specific type.
- Medical imaging: You’ve automated chest X-ray reviews and want to alert a clinician whenever an anomaly—such as an infection, tumor, or fracture—is detected. This allows the clinician to investigate further.
- Fire and smoke detection: You’re analyzing security camera footage and need to detect the presence of smoke or flames.
- Agriculture and food sorting: You’re sorting produce on a production line and need to identify items that deviates from the expected quality—such as bruised apples, misshapen tomatoes, or contaminated grains.
- Retail and packaging: You’re inspecting product packaging at fulfillment centers or warehouses before shipping, or before placing on shelves in retail stores. You want to ensure that products and packaging are intact.
Unsupervised Learning: Training and Splits for Anomaly Detection
Anomaly Detection models in LandingLens use unsupervised learning, meaning they learn patterns in data without predefined classes like those used in supervised learning. However, in LandingLens, you still label images as Normal or Abnormal—this is important for how the data is split during model training.
When training an Anomaly Detection model, only images labeled as "Normal" are included in the Train set. The model learns the patterns and characteristics of normal images without being explicitly told what an anomaly looks like. Once trained, the model is evaluated using both Normal images and Abnormal images in the Dev and Test sets to assess its ability to detect anomalies.
For more information about how and why LandingLens splits data, go to Splits.
Model Architecture
The LandingLens Anomaly Detection architecture uses a reverse distillation (RD) paradigm with 160 million parameters.
How Many "Normal" and "Abnormal" Images Should I Include?
The optimal number of images depends on the complexity of your use case. In general, the more complex the use case, the more images you should use for model training.
Use the guidelines below as a starting point and adjust if needed.
Normal: Start with 50 Normal images. These should include a mix of:
- Ideal conditions (10+ images): Images that represent the best-case scenario—clean, well-lit, perfectly positioned, etc.
- Natural variation (10+ images): Images that still meet your definition of Normal but include acceptable variations like lighting changes, minor cosmetic differences, or slight differences in positioning.
Abnormal: Use at least 1, but ideally 10+:
- Include at least 1 Abnormal image in the Dev set to help the model set a threshold for detecting anomalies and to generate more meaningful evaluation metrics.
- However, using 10 or more Abnormal images will further improve threshold tuning and lead to more meaninful model metrics.
For more best practices, go to Curate High-Quality Datasets. Anomaly Detection models can be trained with a maximum of 1,000 labeled images.
Best Practice: Use a Consistent Background
Anomaly Detection analyzes the entire image, so use a consistent background across your training and inference images. Otherwise, the model might flag different backgrounds as anomalies.
This is an example of images with consistent backgrounds:
This is an example of images with inconsistent backgrounds:
Label Images at Upload
- Open the Anomaly Detection project you want to upload images to.
- Perform one of the following actions:
- If you do not have any images already uploaded to your project, click the Drop to Upload area.Click the Area to Start the Upload Process
- If you already have images uploaded to your project, click the Upload icon.
Click the "Upload" Icon if You Already Have Images
- If you do not have any images already uploaded to your project, click the Drop to Upload area.
- Select or drag-and-drop "normal" images to the Upload Normal Imagestile. LandingLens displays a preview of the images and their respective classes.
Drag and Drop Images
- If you have any "abnormal" images, select or drag-and-drop them to the Upload Abnormal Images tile. LandingLens displays a preview of the images and their respective classes.
- Click Upload. LandingLens uploads the images and classifies them according to their folder titles.
Upload Images
Add Labels to Images After Upload
To add or change a label for an image, select "Normal" or "Abnormal" from the drop-down menu at the bottom left corner of the image.

Anomaly Detection Workflows
An Anomaly Detection model identifies defects or deviations from the norm. You can use this model on its own, or as part of a model chain. Model chaining is the processs of using the output of one model as the input for another. Chaining models allows you to combine the strengths of different models to meet the specific needs of your use case.
The right workflow depends on your use case and goals. This section gives an overview of three common worfklows.
Workflow 1: Run Anomaly Detection On Its Own
Use Anomaly Detection on its own when you don’t have examples of defects. This approach works well in these use cases:
- New product lines where defects haven't occurred yet.
- Stable, mature production lines with good quality control, where defects are rare or previously unseen.
Workflow 2: Run Anomaly Detection Before Another Model
Run the Anomaly Detection model first when you want to quickly filter out Normal images and focus further analysis on potential defects. This workflow speeds up processing by eliminating Normal images early, reducing the workload on the second model.
- Run the Anomaly Detection model to classify images as Normal or Abnormal.
- Send only the Abnormal images to an Object Detection or Segmentation model.
- The second model predicts the defect type and location.

Workflow 3: Run Anomaly Detection After Another Model
Run the Anomaly Detection model second when you want to catch issues that the first model might miss. This workflow helps reduce the overall rate of False Negatives and improves the Recall score. This approach is especially useful for unknown or rare defects that aren't well-represented in your training data.
- Run an Object Detection or Segmentation model to identify known defect types.
- Send images with no detected defects to the Anomaly Detection model.
- The Anomaly Detection model flags any unusual patterns that weren’t covered by the first model.
