Paper deep dive
Parser-Free VLM Verification for Federated Weakly Supervised Video Anomaly Detection
Sébastien Thuau, Amira Gran, Siba Haidar, Rachid Chelouah
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 88%
Last extracted: 9/13/2026, 5:22:56 AM
Summary
This paper introduces a lightweight federated Multiple Instance Learning (MIL) and Vision-Language Model (VLM) cascade for weakly supervised video anomaly detection (VAD). The method trains a compact MIL scorer across distributed clients while using a frozen VLM as a selective, post-hoc verifier for high-scoring suspect segments. The authors compare two VLM feedback interfaces: text-generation with parsing and a novel logit-based interface that extracts continuous anomaly scores from next-token Yes/No probabilities. Experiments on the UCF-Crime dataset demonstrate that the logit-based interface improves frame-level AUC and AP over the MIL baseline without requiring temporal post-processing or parsers, offering a robust, segment-local alternative to text-generation verification.
Entities (10)
Relation Signals (9)
Logit-Based Interface → avoids → Text Parsing
confidence 95% · We propose a logit-based VLM interface that... avoids keyword parsing
Logit-Based Interface → improves → Frame-level AUC
confidence 95% · the logit interface provides a fixed parser-free signal that improves both frame-level AUC and frame-level AP over the MIL baseline
Logit-Based Interface → improves → Frame-level AP
confidence 95% · the logit interface provides a fixed parser-free signal that improves both frame-level AUC and frame-level AP over the MIL baseline
Qwen3-VL-2B-Instruct → isusedin → UCF-Crime
confidence 95% · Experiments on UCF-Crime with InternVL3.5-2B and Qwen3-VL-2B-Instruct show that...
InternVL3.5-2B → isusedin → UCF-Crime
confidence 95% · Experiments on UCF-Crime with InternVL3.5-2B and Qwen3-VL-2B-Instruct show that...
Federated MIL-VLM Cascade → solves → Video Anomaly Detection
confidence 95% · We introduce a lightweight federated MIL–VLM cascade... for weakly supervised video anomaly detection
Federated MIL-VLM Cascade → uses → Logit-Based Interface
confidence 95% · We study two VLM feedback interfaces: parsed text-generation decisions and a logit-based interface... the logit interface provides a fixed parser-free signal
Text-Generation Interface → →
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:How can vision-language models help video anomaly detection (VAD) when surveillance data remain distributed, weakly labeled, and resource-constrained? Most weakly supervised VAD methods assume centralized training; recent VLM-based extensions further rely on dense inference, generated explanations, or additional adaptation. We introduce a lightweight federated MIL-VLM cascade in which only a compact MIL scorer is trained across clients, while a frozen VLM verifies high-scoring suspect segments post hoc. We study two VLM feedback interfaces: parsed text-generation decisions and a logit-based interface that extracts a continuous anomaly score from next-token Yes/No probabilities. Experiments on UCF-Crime with InternVL3.5-2B and Qwen3-VL-2B-Instruct show that text-generation verification can improve frame-level AUC after diagnostic temporal post-processing, but remains sensitive to prompts, parsers, model choice, and smoothing. In contrast, the logit interface provides a fixed parser-free signal that improves both frame-level AUC and frame-level AP over the MIL baseline across both VLMs, without temporal post-processing in its main configuration. Since suspect segments are updated independently once available, next-token logit feedback provides a simple segment-local alternative to text-generation verification.
Tags
Links
- Source: https://arxiv.org/abs/2609.07455v1
- Canonical: https://arxiv.org/abs/2609.07455v1
Trouble viewing inline? Open PDF directly →
Full Text
34,177 characters extracted from source content.
Expand or collapse full text
Parser-Free VLM Verification for Federated Weakly Supervised Video Anomaly Detection Sébastien Thuau1,2, Amira Gran1, Siba Haidar1, Rachid Chelouah2 Affiliation: 1esieaLab, ESIEA, Paris, France 2ETIS Laboratory, CNRS, UMR8051, CY Cergy Paris University, Paris, France Affiliation: sebastien.thuau@cyu.fr, amira.gran@et.esiea.fr, siba.haidar@esiea.fr, rachid.chelouah@cyu.fr Abstract How can vision-language models help video anomaly detection (VAD) when surveillance data remain distributed, weakly labeled, and resource-constrained? Most weakly supervised VAD methods assume centralized training; recent VLM-based extensions further rely on dense inference, generated explanations, or additional adaptation. We introduce a lightweight federated MIL–VLM cascade in which only a compact MIL scorer is trained across clients, while a frozen VLM verifies high-scoring suspect segments post hoc. We study two VLM feedback interfaces: parsed text-generation decisions and a logit-based interface that extracts a continuous anomaly score from next-token Yes/No probabilities. Experiments on UCF-Crime with InternVL3.5-2B and Qwen3-VL-2B-Instruct show that text-generation verification can improve frame-level AUC after diagnostic temporal post-processing, but remains sensitive to prompts, parsers, model choice, and smoothing. In contrast, the logit interface provides a fixed parser-free signal that improves both frame-level AUC and frame-level AP over the MIL baseline across both VLMs, without temporal post-processing in its main configuration. Since suspect segments are updated independently once available, next-token logit feedback provides a simple segment-local alternative to text-generation verification. Index Terms: Weakly supervised video anomaly detection, federated learning, multiple-instance learning, vision-language models, semantic verification, logit-based scoring, segment-local verification. I Introduction Video anomaly detection (VAD) aims to identify rare and safety-critical events in long surveillance videos. In realistic deployments, surveillance data are distributed across cameras or sites, raw footage is difficult to centralize because of privacy and bandwidth constraints, and client devices may have limited computational power. At the same time, training labels are typically available only at the video level, while evaluation requires frame- or segment-level localization. These constraints motivate federated weakly supervised VAD methods that can operate with compact trainable components. Weakly supervised VAD naturally fits a multiple-instance learning (MIL) setting: a video-level label supervises a bag of temporal segments, and the model must infer which segments explain the label. This formulation is compatible with lightweight federated learning when the trainable component operates on frozen visual features. However, MIL scores are inferred from coarse supervision alone, so high-scoring segments do not always correspond to semantically abnormal events. Visually salient but normal segments can therefore be ranked as anomalous without any explicit semantic verification. Vision-language models (VLMs) offer a natural way to verify whether a suspect segment is semantically abnormal by relating visual evidence to language-level concepts. Existing VLM-based VAD methods, however, often rely on dense inference, learned prompts, generated explanations, or chain-of-thought reasoning, which increases computation and introduces dependencies on prompt wording and text parsing. We instead use frozen off-the-shelf VLMs only as selective verifiers for segments proposed by a lightweight federated MIL scorer. The VLM is not trained, synchronized, or aggregated across clients; in our experiments it is executed offline in a centralized evaluation setting for reproducible comparison, while the same frozen verification step can be deployed locally or on-premise when hardware permits. This raises the central question of this paper: how should feedback from a frozen VLM be represented so that semantic verification remains efficient, parser-free, and compatible with causal segment-level scoring? The contributions of this paper are: • We propose a lightweight federated MIL–VLM cascade in which only a compact MIL head is trained across physical CPU-only clients, while a frozen VLM verifies selected suspect segments post hoc. • We show that text-generation VLM verification is sensitive to prompting, parsing, model choice, and temporal post-processing. • We propose a logit-based VLM interface that extracts a continuous anomaly score from next-token Yes/No probabilities, avoids keyword parsing, preserves ranking information, and remains causal at the segment-scoring level in its main configuration. I Related Work I-A Weakly Supervised Video Anomaly Detection Weakly supervised VAD uses only video-level labels for training while requiring frame- or segment-level localization at evaluation. Sultani et al. [1] introduced the MIL formulation for WSVAD on the UCF-Crime benchmark, treating videos as bags of temporal segments with sparsity and smoothness constraints. Subsequent methods improved weakly supervised VAD through stronger temporal modeling, feature magnitude learning, memory mechanisms, and bias reduction [2, 3, 4, 5]. Recent work also incorporates vision-language priors into weakly supervised VAD. VadCLIP [6] adapts CLIP [7] to anomaly detection with visual and language-alignment branches, while prompt-enhanced MIL approaches such as PE-MIL [8] use textual semantics to improve anomaly localization. These methods improve weakly supervised VAD but assume centralized training and do not address client heterogeneity or edge-oriented constraints. In contrast, our work focuses on a lightweight federated MIL scorer that queries a frozen VLM selectively, rather than treating the VLM as a dense detector. I-B Federated Video Anomaly Detection Federated learning [9] trains a shared model across clients without centralizing data, but client data are often non-IID and heterogeneous in practical surveillance settings. Recent VAD-specific federated approaches have begun to address these issues. FedVAD introduces a federated VAD framework that distills knowledge from GPT-generated semantic descriptions to improve learning under data heterogeneity [10]. FedWSAD extends weakly supervised VAD to a federated setting through multimodal prompt learning with global and local contexts [11]. Su et al. propose a mixture of local-to-global experts for federated weakly supervised VAD to handle non-IID client distributions [12]. These works federate either the detector itself or auxiliary mechanisms such as prompt learning, semantic distillation, or expert aggregation. Our work differs in keeping the VLM frozen and using it as a post-hoc selective verifier; the federated component is only the lightweight MIL scorer. Our main question concerns the interface between the federated scorer and the frozen VLM. I-C Vision-Language Models for Video Anomaly Detection Recent work leverages vision-language models to improve the semantic interpretability of VAD. LAVAD [13] uses large language models for training-free anomaly detection from video descriptions, while AnomalyRuler [14] introduces rule-based LLM reasoning from few normal references. VERA [15] learns guiding questions that elicit anomaly reasoning in frozen VLMs without modifying model parameters, and Vad-R1 [16] studies anomaly reasoning through perception-to-cognition chain-of-thought prompting. These methods show the promise of VLMs for semantic anomaly understanding, but they mainly rely on generated text, prompt design, or reasoning traces. A second line of work improves efficiency by focusing VLM computation on informative regions. Holmes-VAU [17] concentrates VLM reasoning on anomaly-rich regions through anomaly-focused temporal sampling, but does not address weakly supervised federated settings. SlowFastVAD [18] routes selected ambiguous segments from a fast detector to a slower RAG-enhanced VLM before fusing scores, making it closest in spirit to our selective verification approach. It differs from our work in being centralized, in using retrieval-augmented reasoning rather than logit-based verification, and in not analyzing causal segment-level scoring. Next-token likelihoods are standard in language model evaluation, but their use as a continuous verification interface for weakly supervised VAD remains, to our knowledge, unexplored. I Methodology I-A Problem Setting and Pipeline Overview We address weakly supervised VAD: each video is divided into T temporal segments, training supervision is available only at the video level, and segment scores are expanded to frame-level scores for evaluation. Our method follows the two-stage pipeline shown in Fig. 1. Stage 1 trains a lightweight federated multiple-instance learning (MIL) scorer on frozen visual features. For each segment i, it outputs an anomaly score mim_i, producing a dense temporal anomaly profile. Stage 2 uses a frozen vision-language model (VLM) only on suspect segments selected from this MIL profile, making the VLM a selective semantic verifier rather than a dense detector. Federated learning is used only to train the MIL scorer. The VLM is never trained, updated, or aggregated across clients; it is used post hoc to rescore selected suspect segments. Thus, verification can be run centrally for offline evaluation, as in our experiments, or locally/on-premise when client hardware permits. Fig. 1: Two-stage MIL–VLM cascade. The federated MIL scorer routes suspect segments to a frozen VLM; non-suspect segments keep their MIL scores. I-B Federated MIL Anomaly Scorer Stage 1 learns a compact MIL anomaly scorer from video-level labels. Each segment is represented by a frozen CLIP ViT-B/16 feature i∈ℝ512x_i ^512 [7]. The CLIP encoder is fixed; only the MIL head is trained in a federated manner. The anomaly head is an MLP with layer widths 512→128→32→1512→ 128→ 32→ 1, ReLU activations, high dropout (p=0.6p=0.6), and a final sigmoid. It outputs a segment-level anomaly score mi∈[0,1]m_i∈[0,1] and contains 69.8K trainable parameters. The video-level prediction is obtained by averaging the top-k segment scores, with k=3k=3 for all experiments. The model is trained with video-level binary cross-entropy plus sparsity and temporal smoothness regularization [1]. The MIL head is trained with FedAvg [9]; to emulate client heterogeneity, training videos are partitioned across clients with a Dirichlet-based label allocation over video-level classes. I-C Selective VLM Verification Given MIL scores mii=1T\m_i\_i=1^T, a segment i is selected for VLM verification when mi>τm_i>τ, where τ is fixed in Sec. IV-A. For each suspect segment, we sample frames and pair them with a textual prompt. Non-suspect segments are not sent to the VLM and keep their MIL scores. In the reported experiments, VLM calls are run offline after federated training; no VLM parameters, gradients, generated labels, or generated descriptions are exchanged during federated optimization. The design question is how to convert frozen VLM output into an anomaly signal. We study two interfaces: generated text followed by parsing, and direct next-token Yes/No logit extraction. I-C1 Text-Generation Interface In the text-generation regime, the VLM response is parsed using case-insensitive keyword matching. Responses containing “anomalous” or “abnormal” confirm the MIL score; responses containing “normal” but not “abnormal” or “anomalous” are parsed as normal and attenuate the score according to Sec. I-D. Unparsed responses leave the segment unchanged. This rule does not handle negations and may misclassify some chain-of-thought outputs, as discussed in Sec. IV-C. We also evaluate a diagnostic score-output prompt, R13, which asks for a 0–10 anomaly score. When valid, we convert it to qi=scorei/10q_i=score_i/10; when outputs collapse to a few discrete values, we treat the mapping as model-specific parser adaptation, reported only as diagnostic. I-C2 Logit-Based Interface Text generation requires decoding and keyword parsing. To avoid this dependency, we use the fixed normality prompt: “Is this surveillance scene normal? Answer only Yes or No.” We extract next-token logits for Yes and No; since the prompt asks about normality, No corresponds to an anomaly. Candidate token IDs are fixed before evaluation for each VLM tokenizer. We verify under each model’s inference template that these candidates are single-token continuations and use the restricted two-token softmax as a ranking signal rather than as a calibrated probability. Let ℓyes,i _yes,i and ℓno,i _no,i denote the logits for suspect segment i. We apply a softmax restricted to these two logits and use the probability assigned to No: piVLM=exp(ℓno,i)exp(ℓyes,i)+exp(ℓno,i).p^VLM_i= ( _no,i) ( _yes,i)+ ( _no,i). This gives a continuous, parser-free anomaly score. In the main λ=1λ=1 configuration without temporal smoothing, each suspect segment is updated independently and the verifier is causal at the segment-scoring level. I-D Score Substitution, Fusion, and Temporal Post-Processing After VLM verification, non-suspect segments keep their MIL score mim_i and only suspect segments can be updated. For text generation, the default rule attenuates segments parsed as normal, si=0.1mis_i=0.1m_i, while confirmed anomalies and unparsed responses remain unchanged. In the exploratory post-processing sweep, we also test linear fusion si=λqi+(1−λ)mi,s_i=λ q_i+(1-λ)m_i, where qi=0q_i=0 for normal-corrected segments, qi=1q_i=1 for anomaly-confirmed segments, and qi=scorei/10q_i=score_i/10 for valid score-output prompts. For logit verification, the VLM directly provides piVLMp_i^VLM and suspect segments are updated as si=λpiVLM+(1−λ)mi.s_i=λ p_i^VLM+(1-λ)m_i. The main logit configuration uses λ=1λ=1, substituting suspect MIL scores with VLM anomaly probabilities. For text-generation post-processing, we smooth correction signals with EMA and local majority voting, either on the full T=32T=32 timeline or on the compressed suspect sequence. Offline smoothing uses bidirectional EMA or centered neighborhoods; causal smoothing uses forward-only EMA and past-only neighborhoods. The sweep covers attenuation, linear fusion with λ∈0.1,0.3,0.5,0.7,0.9λ∈\0.1,0.3,0.5,0.7,0.9\, EMA β∈0.1,0.3,0.5,0.7β∈\0.1,0.3,0.5,0.7\, majority windows w∈1,2,3,5,7w∈\1,2,3,5,7\, and both smoothing domains. The main logit configuration uses no temporal smoothing. IV Experiments and Results IV-A Experimental Setup and Dataset We evaluate our approach on UCF-Crime, a surveillance video anomaly detection benchmark containing normal videos and 13 anomaly categories [1]. Video-level labels are used for training, while frame-level annotations are used only for evaluation. The test set contains 290 videos with frame-level anomaly annotations. Each video is uniformly divided into T=32T=32 temporal segments. Segment scores are expanded to frame-level scores by assigning each frame the score of its corresponding segment. We report frame-level AUC (F-AUC) and frame-level AP (F-AP) over all test frames. For the federated Stage 1 MIL scorer, we use K=4K=4 physical CPU-only client machines. CLIP features are pre-extracted, and each client trains only the MIL head on frozen segment features. Training videos are partitioned across clients using a Dirichlet-based allocation over video-level labels with concentration parameter α=0.5α=0.5. FedAvg is run for R=30R=30 communication rounds with E=1E=1 local epoch per round. For Stage 2, suspect segments are selected with a fixed threshold τ=0.5τ=0.5, shared across all VLMs and prompts. For reproducibility, all VLM verification experiments are performed offline in a centralized evaluation environment after federated MIL training. This choice standardizes hardware and model access across VLMs and prompts. It should not be interpreted as a fully privacy-preserving inference protocol: if frames are sent to a central verifier, privacy depends on the deployment setting. However, because the verifier is frozen and segment-wise, the same procedure can be executed locally or on-premise by clients with sufficient VLM inference capability. With τ=0.5τ=0.5, the pipeline routes 8.09±0.418.09± 0.41 segments per video to the VLM on average, corresponding to 25.3%±1.3%25.3\%± 1.3\% of the 32 segments and a 3.95×3.95× reduction in VLM calls compared with dense verification. Dense zero-shot VLM scoring is reported as a baseline in Table I. Averaged across the five Stage 1 checkpoints used for cascade evaluation, introduced in Sec. IV-B, 51.7%51.7\% of test videos have no suspect segment and skip the VLM stage entirely. For each suspect segment, we uniformly sample two frames resized to 448×448448× 448 as a fixed cost-context tradeoff. We evaluate two frozen VLMs: InternVL3.5-2B [19] and Qwen3-VL-2B-Instruct [20]. Text-generation uses deterministic decoding, while the logit regime extracts the next-token Yes/No logits from a single generated token. The constants k=3k=3, τ=0.5τ=0.5, two-frame VLM input, and attenuation factor 0.10.1 are fixed before the main VLM comparison. The text-generation strategy sweep in Sec. IV-C is diagnostic and should not be interpreted as a validation protocol for prompt selection. IV-B Stage-1 Backbone Screening and Checkpoint Selection We first screen Stage 1 backbones before VLM verification. The goal is to select a practical representation for the MIL–VLM cascade, not to provide an exhaustive backbone benchmark. We compare CLIP+MLP with compact 3D CNN baselines trained from low-resolution clips; 3D CNN-64 and 3D CNN-112 denote the same 3D CNN trained on 64×6464× 64 and 112×112112× 112 clips. Table I also reports dense zero-shot VLM baselines, where the VLM is queried on all 32 segments without MIL routing. Basic uses the minimal binary prompt “Is there an anomaly in this surveillance scene? Answer only Yes or No.” VERA denotes the VERA-style judgment-last prompt later denoted R5. TABLE I: Stage 1 backbone screening and dense zero-shot VLM baselines on UCF-Crime. Results are test-set F-AUC/F-AP percentages; n is the number of runs. Approach Model n F-AUC (%) F-AP (%) Central MIL CLIP+MLP 25 83.8±0.483.8± 0.4 23.5±0.723.5± 0.7 Central MIL 3D CNN-64 2 74.3±0.674.3± 0.6 16.6±1.316.6± 1.3 Central MIL 3D CNN-112 3 75.1±1.575.1± 1.5 17.0±1.017.0± 1.0 Fed MIL CLIP+MLP 75 83.0±0.683.0± 0.6 23.1±1.223.1± 1.2 Fed MIL 3D CNN-64 1 70.670.6 15.215.2 Fed MIL 3D CNN-112 1 74.974.9 17.117.1 Zero-shot basic InternVL 1 74.774.7 18.318.3 Zero-shot basic Qwen3 1 55.155.1 8.48.4 Zero-shot VERA (R5) InternVL 1 65.365.3 10.810.8 Zero-shot VERA (R5) Qwen3 1 49.249.2 7.47.4 CLIP+MLP outperforms the best 3D CNN by 8.78.7 F-AUC points in the centralized setting and 8.18.1 points in the federated setting, with the same trend in F-AP. Because the gap was already substantial, we did not expand the CNN baselines into a full multi-seed benchmark. The federated CLIP+MLP scorer incurs only a modest degradation relative to centralized training, with an F-AUC drop of 0.80.8 points, and is therefore used as the Stage 1 backbone. For cascade evaluation, we retain five representative federated CLIP+MLP checkpoints whose F-AUCs range from 83.78%83.78\% to 84.00%84.00\%, with a mean of 83.86±0.0883.86± 0.08. Since cascade results are reported as changes relative to each checkpoint’s MIL baseline, this selection does not bias the comparison between verification regimes. Unless otherwise stated, cascade results are averaged over these five checkpoints. Dense zero-shot VLM scoring falls below the federated CLIP+MLP baseline. The gap is especially large for Qwen3 basic, which drops by nearly 2828 F-AUC points and labels 88.6%88.6\% of segments as anomalous, compared with 23.3%23.3\% for InternVL. VERA also degrades both VLMs in dense zero-shot use, despite later being the strongest cascade prompt for Qwen3 in Table I. This suggests that MIL routing acts as a cost-saving filter and reduces reliance on unstable dense zero-shot VLM behavior. This screening is not intended to claim state-of-the-art VAD performance. Recent federated WSVAD methods report higher or comparable UCF-Crime AUC under richer protocols: FedVAD reports 85.13%85.13\% weakly supervised AUC [10], while FedWSAD reports 84.06%84.06\% federated AUC on its random split [11]. These results are not directly comparable because they use different client splits and train additional semantic distillation, prompt-learning, or context-driven mechanisms; our focus is the interface between a lightweight federated scorer and frozen VLM verification. IV-C Text-Generation Strategy Exploration We first analyze the sensitivity of text-generation verification to the prompt strategy. This diagnostic experiment evaluates 14 strategies with InternVL3.5-2B on one high-performing federated Stage 1 checkpoint, using the raw correction rule without temporal post-processing. The strategies vary along four main axes: direct binary judgment, VERA-style guiding questions, CoT-style reasoning, and score-output prompting. Additional variants inject global context, MIL score context, event-neighborhood context, or a normality prior. Judgment-first and judgment-last variants differ only in whether the final NORMAL/ANOMALOUS decision is requested before or after the explanation. Table I reports raw F-AUC changes before temporal post-processing and is sorted by improvement. TABLE I: Diagnostic prompt-strategy sweep on one federated Stage 1 checkpoint. Results are raw F-AUC changes relative to the MIL baseline. Strategy Δ -AUC (p) R13 Score-based output +0.254+0.254 R5 VERA, judgment last +0.216+0.216 R11 Direct + context +0.156+0.156 R2 VERA, judgment first +0.077+0.077 R3 CoT, judgment first +0.021+0.021 R7 VERA + context −0.018-0.018 R4 CoT, judgment last −0.027-0.027 R9 VERA + MIL scores −0.112-0.112 R1 Direct binary question −0.628-0.628 R8 CoT + context −0.700-0.700 R14 Debiased VERA + context −0.727-0.727 R6 Multi-round CoT −1.046-1.046 R12 Debiased VERA −1.192-1.192 R10 VERA + event context −1.239-1.239 Changing the text-generation strategy provides only limited raw gains. Among binary judgment strategies, only R5 and R11 improve the MIL baseline by more than 0.10.1 p, with most other strategies remaining near or below the baseline. R13 obtains the largest raw gain but is score-based rather than binary. Additional R13 runs show that this numeric output is discretized, with InternVL mostly using scores 3, 5, and 7 rather than the full 0–10 scale. A similar score-collapse behavior appears for Qwen3 in the cross-model study, where R13 collapses to 5,7 and is handled with the diagnostic parser adaptation reported in Table I. Manual inspection suggests that chain-of-thought responses often mix normal and anomalous cues, making keyword parsing unstable. Strategies that separate the final judgment from the explanation, such as R5, are less prone to this issue. More broadly, only 5 of 14 strategies improve over the MIL baseline, and VERA-style prompts do not transfer uniformly to selective verification despite their motivation from VLM-based anomaly reasoning [15]. These findings motivate evaluating cross-model behavior, temporal post-processing, and direct logit extraction. IV-D Cross-Model Text-Generation Verification and Post-Processing We retain five representative strategies from the diagnostic sweep, spanning high-performing binary prompts, contextual variants, debiased variants, and the score-output prompt. We evaluate them across VLM backbones and the five representative Stage 1 checkpoints, with and without temporal post-processing. TABLE I: Cross-model text-generation verification. Results are F-AUC changes over five Stage 1 checkpoints; +P denotes diagnostic F-AUC-selected temporal post-processing. VLM Strategy Raw +P InternVL R5 +0.268±0.091+0.268± 0.091 +0.461±0.177+0.461± 0.177 InternVL R7 +0.019±0.105+0.019± 0.105 +1.213±0.260+1.213± 0.260 InternVL R11 +0.120±0.030+0.120± 0.030 +1.553±0.211+1.553± 0.211 InternVL R12 −1.364±0.165-1.364± 0.165 +1.015±0.371+1.015± 0.371 InternVL R13 +0.294±0.118+0.294± 0.118 +0.684±0.261+0.684± 0.261 Qwen3 R5 +0.469±0.093+0.469± 0.093 +1.541±0.257+1.541± 0.257 Qwen3 R7 +0.077±0.061+0.077± 0.061 +0.435±0.226+0.435± 0.226 Qwen3 R11 +0.097±0.111+0.097± 0.111 +0.590±0.202+0.590± 0.202 Qwen3 R12 −1.004±0.119-1.004± 0.119 +0.330±0.204+0.330± 0.204 Qwen3 R13† +0.245±0.097+0.245± 0.097 +0.664±0.211+0.664± 0.211 † Qwen3 R13 collapses to 5,7; 5 is mapped to normal-like and 7 to anomaly-like. Raw text-generation correction gives modest and inconsistent gains, while temporal post-processing substantially improves several configurations when optimizing for F-AUC. We treat +P as a diagnostic upper bound on how much temporal regularization can rescue parsed text-generation outputs, not as a deployment-ready model-selection protocol. The strongest text-generation result for InternVL is R11+P, reaching +1.553±0.211+1.553± 0.211 p; for Qwen3, R5+P reaches +1.541±0.257+1.541± 0.257 p. The results expose two issues. First, text-output parsing is fragile: Qwen3 R13 requires a model-specific parser adaptation. Second, +P rankings conflate VLM signal quality with temporal regularization, as shown by InternVL R12 swinging by +2.4+2.4 p under post-processing, from −1.364-1.364 to +1.015+1.015. Since +P is selected by F-AUC, its effect on F-AP is not necessarily aligned; we report F-AP only for the best configuration per VLM in Table IV. IV-E Text-Generation versus Logit-Based Verification We compare the strongest post-processed text-generation configuration for each VLM from Table I with the main logit configuration, λ=1λ=1, without temporal smoothing. This is the main comparison of the paper. Text-generation results are reported in their most favorable diagnostic setting, including F-AUC-selected post-processing, whereas logit verification uses a fixed rule with no temporal smoothing. TABLE IV: Best text-generation configurations versus logit verification. Results are changes relative to the MIL baseline over five Stage 1 checkpoints. VLM Regime Δ -AUC (p) Δ -AP (p) InternVL Text-gen R11+P +1.553±0.211+1.553± 0.211 +1.051±0.469+1.051± 0.469 InternVL Logit, λ=1λ=1 +1.053±0.086+1.053± 0.086 +4.638±0.375+4.638± 0.375 Qwen3 Text-gen R5+P +1.541±0.257+1.541± 0.257 +1.551±0.435+1.551± 0.435 Qwen3 Logit, λ=1λ=1 +1.522±0.102+1.522± 0.102 +7.721±0.637+7.721± 0.637 Post-processed text generation can be competitive in F-AUC but has higher variance and weaker F-AP gains. Using the mean Stage 1 baseline of 83.86%83.86\%, the main logit configuration corresponds to approximately 84.91%84.91\% F-AUC with InternVL and 85.38%85.38\% with Qwen3. These absolute values should not be read as direct comparisons to FedVAD or FedWSAD because the protocols and client splits differ, but they show that selective VLM verification can lift a lightweight federated scorer into a competitive F-AUC range. More importantly, the logit regime yields substantially larger F-AP improvements: 4.4×4.4× larger for InternVL and 5.0×5.0× larger for Qwen3 than the best text-generation configuration. This is consistent with the continuous logit signal preserving rank information across suspect segments, while parsed text-generation corrections can map normal-corrected segments through the same attenuation rule, si=0.1mis_i=0.1m_i, compressing the score distribution among them. The main advantage of the logit interface is therefore not peak F-AUC under tuned post-processing, but interface robustness. In this selective MIL–VLM cascade, next-token logits avoid parser failures, preserve a continuous ordering among suspect segments, improve F-AP substantially, and remain causal without temporal smoothing. They should be viewed as a more deployable verification signal, not as evidence that VLM logits are universally better calibrated than generated text. IV-F Causal versus Bidirectional Evaluation We finally evaluate causal compatibility for streaming-oriented surveillance (Table V). We use the term causal in the segment-scoring sense: once a suspect segment and its sampled frames are available, its VLM score does not depend on future segments. This does not model all constraints of a fully online streaming system, such as unknown video duration or adaptive segmentation. TABLE V: Causal versus bidirectional F-AUC changes. Logit rows use λ=1λ=1 without temporal smoothing, so bidirectional and causal scores are identical in the segment-scoring sense. Configuration Bidir. Causal InternVL R5+P +0.461±0.177+0.461± 0.177 +0.359±0.078+0.359± 0.078 InternVL R11+P +1.553±0.211+1.553± 0.211 +1.116±0.189+1.116± 0.189 InternVL R12+P +1.015±0.371+1.015± 0.371 +0.478±0.236+0.478± 0.236 InternVL R13+P +0.684±0.261+0.684± 0.261 +0.348±0.115+0.348± 0.115 Qwen3 R5+P +1.541±0.257+1.541± 0.257 +1.019±0.183+1.019± 0.183 Qwen3 R7+P +0.435±0.226+0.435± 0.226 +0.156±0.082+0.156± 0.082 Qwen3 R11+P +0.590±0.202+0.590± 0.202 +0.304±0.083+0.304± 0.083 Qwen3 R12+P +0.330±0.204+0.330± 0.204 +0.055±0.072+0.055± 0.072 Qwen3 R13†+P +0.664±0.211+0.664± 0.211 +0.359±0.085+0.359± 0.085 InternVL logit, λ=1λ=1 +1.053±0.086+1.053± 0.086 +1.053±0.086+1.053± 0.086 Qwen3 logit, λ=1λ=1 +1.522±0.102+1.522± 0.102 +1.522±0.102+1.522± 0.102 All post-processed text-generation configurations lose F-AUC under the causal constraint, with drops of 0.100.10 to 0.540.54 p. For the logit verifier, the bidirectional and causal columns are identical by construction because λ=1λ=1 substitutes each suspect segment with its own VLM logit score and applies no temporal smoothing. The logit interface is therefore causal-compatible at the segment-scoring level, unlike post-processed text-generation verification. V Conclusion We presented a lightweight federated MIL–VLM cascade for weakly supervised video anomaly detection. Only a compact MIL head is trained federatively on frozen CLIP features, while a frozen VLM is used post hoc to verify selected suspect segments and remains decoupled from federated optimization. Experiments show that text-generation verification is sensitive to prompts, parsing, model choice, and smoothing. In contrast, the parser-free logit interface improves both F-AUC and F-AP over the MIL baseline across both VLMs without temporal smoothing, and is causal at the segment-scoring level when λ=1λ=1. Limitations include centralized offline VLM evaluation, validation only on UCF-Crime, four physical CPU-only clients with Dirichlet-partitioned data rather than naturally occurring deployment silos, pre-extracted CLIP features, and fixed routing/fusion settings. Future work should test ShanghaiTech, XD-Violence, broader VLM families, additional federated partitions, and deployment-specific privacy/latency constraints. References [1] W. Sultani, C. Chen, and M. Shah, “Real-world anomaly detection in surveillance videos,” in Proc. CVPR, 2018. [2] Y. Tian et al., “Weakly-supervised video anomaly detection with robust temporal feature magnitude learning,” in Proc. ICCV, 2021. [3] Y. Chen et al., “MGFN: Magnitude-contrastive glance-and-focus network for weakly-supervised video anomaly detection,” in Proc. AAAI, 2023. [4] H. Zhou, J. Yu, and W. Yang, “Dual memory units with uncertainty regulation for weakly supervised video anomaly detection,” in Proc. AAAI, 2023. [5] H. Lv et al., “Unbiased multiple instance learning for weakly supervised video anomaly detection,” in Proc. CVPR, 2023. [6] P. Wu et al., “VadCLIP: Adapting vision-language models for weakly supervised video anomaly detection,” in Proc. AAAI, 2024. [7] A. Radford et al., “Learning transferable visual models from natural language supervision,” in Proc. ICML, 2021. [8] J. Chen et al., “Prompt-enhanced multiple instance learning for weakly supervised video anomaly detection,” in Proc. CVPR, 2024. [9] H. B. McMahan et al., “Communication-efficient learning of deep networks from decentralized data,” in Proc. AISTATS, 2017. [10] F. Qi et al., “FedVAD: Enhancing federated video anomaly detection with GPT-driven semantic distillation,” in Proc. ECCV, 2024. [11] B. Wang et al., “Federated weakly supervised video anomaly detection with multimodal prompt,” in Proc. AAAI, 2025. [12] Y. Su et al., “Federated weakly-supervised video anomaly detection with mixture of local-to-global experts,” Inf. Fusion, vol. 123, Art. no. 103256, 2025. [13] L. Zanella et al., “Harnessing large language models for training-free video anomaly detection,” in Proc. CVPR, 2024. [14] Y. Yang et al., “Follow the rules: Reasoning for video anomaly detection with large language models,” in Proc. ECCV, 2024. [15] M. Ye, W. Liu, and P. He, “VERA: Explainable video anomaly detection via verbalized learning of vision-language models,” in Proc. CVPR, 2025. [16] C. Huang et al., “Vad-R1: Towards video anomaly reasoning via perception-to-cognition chain-of-thought,” arXiv:2505.19877, 2025. [17] H. Zhang et al., “Holmes-VAU: Towards long-term video anomaly understanding at any granularity,” in Proc. CVPR, 2025. [18] Z. Ding et al., “SlowFastVAD: Video anomaly detection via integrating simple detector and RAG-enhanced vision-language model,” arXiv:2504.10320, 2025. [19] W. Wang et al., “InternVL3.5: Advancing open-source multimodal models in versatility, reasoning, and efficiency,” arXiv:2508.18265, 2025. [20] S. Bai et al., “Qwen3-VL technical report,” arXiv:2511.21631, 2025.