Zero-Shot Anomaly Detection in Healthcare: A Systematic Review

Abstract

Healthcare organizations need to detect anomalies that nobody has labeled in advance, such as new billing-fraud schemes, irregular activity in electronic health records (EHRs), and unexpected physiological or device behavior in Internet of Things (IoT) monitoring. Zero-shot anomaly detection (ZSAD) is designed for this setting, but it is unclear how much of the healthcare literature actually tests zero-shot generalization. Following PRISMA 2020, we searched PubMed/MEDLINE, IEEE Xplore, Scopus, Google Scholar and the ACM Digital Library (last search January 2026) for studies published from 2022 to 2025. Of 832 records, 295 full-text reports were assessed and 49 met the eligibility and risk-of-bias threshold: 40 primary studies and 9 reviews used only for context. Every primary study was coded on an operational zero-shot scale (Z0, supervised, to Z3, strict zero-shot), a validation scale (V0 to V4) and three machine-learning-adapted risk-of-bias domains, and the results were synthesized without meta-analysis following the SWiM guideline. One study evaluated strict zero-shot detection (leave-one-dataset-out medical imaging; mean AUROC 0.80, which rose to 0.89 with four labeled shots), and one more combined foundation-model priors with normal-only training. Nineteen studies were anomaly-label-free, 14 were supervised and 5 did not report the learning regime. Two studies used external validation and none was prospective. Reported AUROC ranged from 0.70 to 0.998 (median 0.92; 14 studies), and the highest values came from supervised classification of known attacks on IoT testbed data. Fraud detection contributed two studies. Seven studies applied explainability methods, and none measured their effect on false alarms. One study was at low overall risk of bias, and the certainty of evidence was low or very low for every main finding. ZSAD in healthcare is therefore at an early, imaging-led stage. The proposed zero-shot scale, evidence map, governance indicators and composite generalization index provide testable criteria for designing and reporting future studies.