# Towards Principled Continual Anomaly Detection: A Systematic Framework and Benchmark Scenarios

arXiv: https://arxiv.org/abs/2607.18289 · HTML: https://mlsanity.com/paper/2607.18289/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 12 of its 25 references that are in the map.
- First posted on arXiv 30 Jun 2026.

## Builds on (most cited first, 12 of 12)

- [Continual Lifelong Learning with Neural Networks: A Review](https://mlsanity.com/paper/1802.07569/) (2018)
- [A Comprehensive Survey of Continual Learning: Theory, Method and Application](https://mlsanity.com/paper/2302.00487/) (2023)
- [ADBench: Anomaly Detection Benchmark](https://mlsanity.com/paper/2206.09426/) (2022)
- [The CLEAR Benchmark: Continual LEArning on Real-World Imagery](https://mlsanity.com/paper/2201.06289/) (2022)
- [Unsupervised Continual Anomaly Detection with Contrastively-learned Prompt](https://mlsanity.com/paper/2401.01010/) (2024)
- [AnoShift: A Distribution Shift Benchmark for Unsupervised Anomaly Detection](https://mlsanity.com/paper/2206.15476/) (2022)
- [ReplayCAD: Generative Diffusion Replay for Continual Anomaly Detection](https://mlsanity.com/paper/2505.06603/) (2025)
- [Lifelong Continual Learning for Anomaly Detection: New Challenges, Perspectives, and Insights](https://mlsanity.com/paper/2303.07557/) (2023)
- [From MNIST to ImageNet and Back: Benchmarking Continual Curriculum Learning](https://mlsanity.com/paper/2303.11076/) (2023)
- [CableInspect-AD: An Expert-Annotated Anomaly Detection Dataset](https://mlsanity.com/paper/2409.20353/) (2024)
- [Continual-MEGA: A Large-scale Benchmark for Generalizable Continual Anomaly Detection](https://mlsanity.com/paper/2506.00956/) (2025)
- [SOUL: A Semi-supervised Open-world continUal Learning method for Network Intrusion Detection](https://mlsanity.com/paper/2412.00911/) (2024)

## Abstract (arXiv)

Continual anomaly detection (CAD) studies how models can adapt to evolving data distributions while retaining performance on previously observed regimes. CAD benchmarks, however, depend critically on how tasks are defined, filtered, ordered, and validated. In tabular domains, task boundaries are rarely given, and arbitrary splits can create unlearnable, redundant, or overly transferable tasks that obscure genuine continual-learning behavior. To this end, we introduce a systematic framework for reproducible benchmark scenario design from existing tabular anomaly-detection datasets. The framework discovers candidate tasks, filters unsuitable tasks, and derives principled orderings that expose diverse dynamics. The framework allows us to deliver five benchmark-ready scenarios from three large-scale cybersecurity anomaly detection datasets, yielding both single-dataset and multi-dataset CAD settings.