Thank you for your feedback. We appreciate your recognition of the value of our problem and the applicability of our method. We're glad that you found our comprehensive experimental results, visualizations, and ablation studies insightful. We also value your acknowledgment of the theoretical justification for supervised adversarial training and the robustness enhancement demonstrated across diverse datasets, while maintaining competitive performance.

W1

Thank you for raising this point. As this concern was shared by multiple reviewers, we have addressed it in Common Response 2, which discusses the use of Grad-CAM and possible alternatives in the SRD module.

---

W2

Thank you for raising this concern. The ideal pseudo-anomaly effectively simulates real anomaly data. In latent space, since pseudo-anomalies are generated by distorting real normal data, their distribution should not belong to the normal data distribution (i.e., it shouldn’t be too far, like random noise). At the same time, it should be close to the real anomaly distribution. If the pseudo-anomaly generator achieves this, it can be considered successful.

To address the reviewer’s concern about the quality and interpretability of the generated pseudo-anomalies, we conducted a quantitative evaluation using the Fréchet Inception Distance (FID). This metric compares the distance between the distributions of latent space embeddings, specifically using CLIP-encoded embeddings of video samples. A lower FID indicates that the distributions are more similar, while a higher FID suggests they are farther apart.

We calculated the FID between three sets of embeddings:

• Real Normal vs Real anomalies
• Real anomalies vs Pseudo anomalies
• Real Normal vs Pseudo anomalies

The results, summarized in the table below, reveal that the FID between real anomalies and pseudo anomalies is consistently lower than the FID between real anomalies and real normal. This demonstrates that the pseudo-anomalies generated by our method occupy a region of latent space much closer to real anomalies than to normal data.

Additionally, the FID between pseudo anomalies and real normal is generally lower than the other distances. This is due to the fact that pseudo-anomalies are generated by distorting real normal data. However, they maintain a good distance from real normal data, while still being close enough to the anomaly distribution. This ensures that the pseudo-anomalies are not as far as random noise, which would be unhelpful for guiding the model optimization during the training process.

We extract chunk-level embeddings for each video using a CLIP-based video backbone, resulting in a tensor of shape [num_chunks, embedding_dim]. To obtain a single embedding per video, we compute the mean over the chunk dimension. These averaged embeddings are then grouped and stacked per category (normal, anomaly, pseudo-anomaly) before computing FID.

Thank you for your review. We appreciate your recognition of the different aspects of our work, particularly our focus on adversarial robustness in video anomaly detection (VAD) and the proposed pseudo anomaly detection approach to address it. We're glad you found these directions of interest.

W1 & Q4

Thank you for raising this important point. We acknowledge the trade-off between clean and adversarial performance and have addressed this in detail in Common Response 1, where we provide empirical evidence and theoretical justification for this well-established phenomenon in adversarial training.

---

W2 & Q1

While our primary focus is on evaluating robustness under the white-box setting—due to its stronger and more challenging threat model—we fully acknowledge the importance of black-box scenarios in real-world applications. White-box attacks provide a rigorous benchmark since the adversary has full access to the model's parameters and gradients. Our rationale is that models that perform well under white-box attacks are generally more robust against black-box threats, where the attacker’s capabilities are more limited.

To complement this, we have also conducted black-box attack experiments to assess our method’s practical robustness. As expected, our approach demonstrates strong resilience under black-box conditions as well, further validating its effectiveness across different threat models. These results reinforce our hypothesis that addressing robustness in the white-box setting also strengthens black-box security. Here are the results of our robust model under the NES [1] and Bandit [2] attacks:

Attacks (AUC_O / AUC_A)

References :

[1] Ilyas et al., Black-box Adversarial Attacks with Limited Queries and Information, ICML 2018
[2] Ilyas et al., Adversarial Examples Are Not Bugs, They Are Features, NeurIPS 2019

---

Q2

Thank you for highlighting this connection. We revisited the literature more thoroughly and identified several relevant methods that explore augmentation to mitigate label ambiguity, including:

• [1] A Multi-Head Approach with Shuffled Segments for Weakly-Supervised Video Anomaly Detection , WACV workshop 2024
• [2] Video Anomaly Detection via Spatio-Temporal Pseudo-Anomaly Generation: A Unified Approach , CVPR Workshop 2024
• [3] Dynamic Distinction Learning: Adaptive Pseudo Anomalies for Video Anomaly Detection , CVPR Workshop 2024

Unfortunately, none of these works have released their implementation code. Nevertheless, to address the reviewer's concern, we re-implemented the pseudo-anomaly generation components described in these papers based on the implementation details provided in their manuscripts.

As an ablation study, we integrated each of these pseudo-anomaly generators into the FrameShield framework by replacing our SRD module, and trained the model using the same settings as our original method. As shown in Table below, none of these alternatives outperformed our SRD module, which demonstrates the effectiveness of our simple yet robust Spatiotemporal Region Distortion (SRD) design.

AUC_O (Clean / PGD)

We will include these comparisons, along with a detailed discussion of the implementation of these methods, in the revised manuscript.

Dear Reviewer wNBY,

Thank you for your thoughtful feedback and for raising your rating. We appreciate your recognition of our efforts and are glad that your concerns have been addressed. We assure you that we will carefully incorporate your comments into the final manuscript to improve the paper.

Sincerely, The Authors

We sincerely thank the reviewer for their thoughtful and constructive assessment. We greatly appreciate their recognition of FrameShield's novelty, particularly the innovative SRD module. We're also grateful for their acknowledgment of our thorough experimental evaluation.

W1 & Q1

The explanation regarding the drop in clean accuracy is provided in Common Response 1, where we discuss the widely recognized trade-off between clean and robust performance.

TRADES

Thank you for your thoughtful comment. We have explored the TRADES loss in our experiments. Specifically, we assessed FrameShield with TRADES loss by incorporating both natural loss and boundary loss, aiming to align the model's predictions on adversarially perturbed frames with those on the original frames using cross-entropy. The table below shows the results of training with TRADES loss. Based on our findings, while TRADES loss improved clean accuracy in terms of adversarial robustness for video anomaly detection, it resulted in a decrease in robust performance.

AUC_O (Clean / PGD)

AUC_A (Clean / PGD)

---

W2 & Q2

Thank you for raising this point. As this concern was shared by multiple reviewers, we have addressed it in Common Response 2, which discusses the use of Grad-CAM and possible alternatives in the SRD module.

---

W3 & Formatting Concerns

Thank you for bringing this to our attention. We will revise the manuscript to replace the placeholder “Table X” in Section 6 with the correct reference to Table 3 on page 8. Additionally, we will update the inaccurate citation of Table 3 to correctly point to Table 13 in the Appendix. We appreciate your careful reading and will ensure these issues are resolved to improve the clarity and accuracy of the manuscript.

We sincerely thank the reviewer for their thoughtful and constructive assessment. We greatly appreciate their recognition of the real-world importance of our work and the innovative SRD module, which combines strong local perturbations and motion simulation to effectively address pseudo-label noise in adversarial settings.

W1

As correctly noted, UCSD-Ped2 is traditionally used for unsupervised video anomaly detection (VAD) since its training set contains only normal samples. However, for evaluating weakly-supervised models such as VAD-CLIP, we adopted a modified evaluation protocol inspired by recent literature[1].

Specifically:

• We restructure the Ped2 dataset by selecting:
  • 6 anomalous and 4 normal videos for training,
  • the remaining 18 videos (12 normal, 6 anomalous) for testing.
• This procedure is repeated 10 times, and the average results are reported to ensure robust and unbiased evaluation.

The complete implementation details are provided in Appendix A.5 (line 365). We will also revise the main implementation section to clarify this procedure and ensure transparency.

References :

[1] Advancing Video Anomaly Detection: A Concise Review and a New Dataset, NeurIPS 2024

---

W2

Thank you for your insightful and important comment. We agree that recent methods like LAVAD and Holmes-VAU, which leverage multimodal large language models (LLMs) for video understanding, may offer better robustness to low-level perturbations. To address your suggestion, we have conducted adversarial attacks on both methods to evaluate their susceptibility under similar conditions.

Both Holmes-VAU [1] and LAVAD [2] rely on captioning pipelines that use visual encoders followed by LLMs to generate video-level descriptions. Specifically, Holmes-VAU employs InternVL2-2B, which uses InternViT-300M as the image encoder and InternLM2-Chat-1.8B as the language model. LAVAD uses BLIP-2, consisting of a pretrained CLIP image encoder, a Q-former module, and OPT-6.7B as the LLM to generate captions based on visual and textual inputs.

In our experiments, we treated each captioning model as an end-to-end system and applied PGD-1000 attacks to craft adversarial examples that manipulate the generated captions. For example, Holmes-VAU samples 12 frames uniformly from a video and inputs them into the model with a prompt such as: “Could you specify the anomaly events present in the video?” Under adversarial attack, we enforced predefined misleading outputs. For normal videos, we guided the model to generate the caption: “There is an anomaly in the video; two cars have an accident.” Conversely, for anomalous videos, we enforced: “There is no abnormal event; everything goes normal.”

To adapt the attack to the autoregressive nature of LLMs, we injected our target captions into the decoding process as prior context, rather than allowing the model to condition on its own previous predictions. A similar approach was applied to LAVAD, where adversarial frames were fed to the BLIP-2 model to generate misleading captions, which were then used for downstream video anomaly detection.

We evaluated the robustness of both methods under PGD-1000 attack on the UCF-Crime and Shanghai datasets and compared the results with our proposed method, FrameShield. The results are summarized in the table below, which presents the AUC (Area Under Curve) for the complete test sets of these benchmarks, denoted as AUC<sub>O:

AUC_O (Clean / PGD)

It is also worth noting that Holmes-VAU, which processes 12 frames jointly, is more vulnerable to adversarial perturbations due to the higher input dimensionality, compared to LAVAD which generates captions frame-by-frame.

These results demonstrate that while multimodal LLM-based methods exhibit stronger general robustness, they are still susceptible to carefully crafted adversarial attacks. Our method outperforms both LAVAD and Holmes-VAU under attack scenarios, confirming the effectiveness of FrameShield in preserving robustness.

We will revise the manuscript to incorporate these comparisons as well as clarify the details of the adversarial attack on these approaches.

Reference:

[1] Holmes-VAU, CVPR 2025

[2] Harnessing Large Language Models, CVPR 2024

---

W3

Thank you for raising this important point. We acknowledge the trade-off between clean and adversarial performance and have addressed this in detail in Common Response 1, where we provide empirical evidence and theoretical justification for this well-established phenomenon in adversarial training.

Dear Reviewer AMcA,

We sincerely thank you for your constructive feedback, careful evaluation, and recognition of our efforts. We are pleased that our clarifications and additional experiments have addressed your concerns regarding the method’s applicability and experimental thoroughness.

We also appreciate your valuable suggestions for future improvements. In subsequent work, we will focus on mitigating clean-performance drops while maintaining robustness, aiming to enhance the real-world applicability of our approach and further extend this line of research.

Sincerely, The Authors