An AI That Flags the Suspicious Without Knowing Who's Suspicious

When the dangerous thing can show up in a hundred unfamiliar forms, you stop trying to list the dangers and start trying to learn what ordinary looks like in a given place. That inversion is reshaping public-safety AI in 2026. The privacy payoff, and the deployment story, are both consequences of a single category flip that runs on the CCTV already in place.

Most of the field still trains on labeled threat examples. That is brittle by construction: an attacker who wears a cap differently, or shoplifts in a posture the training set never saw, slips past. The pose-baseline track goes the other way. It tokenizes how bodies move, learns what motion sequences are normal on a given camera, and flags the sequences that depart from that learned pattern. The pipeline does not look up "weapon" or "fight" in a database. It does not know what any of those things are. It just notices that the current motion does not fit.

A language model learns what tokens tend to follow what other tokens, then flags when a sequence departs from the pattern. The pose-baseline approach applies the same shape to bodies: each frame's posture stands in for a word, and the model flags when the choreography departs from what the camera has learned is ordinary.

The clearest version of this approach is at UNC Charlotte, where Hamed Tabkhi's TeCSAR lab has been building pose-tokenization systems since NSF's Smart & Connected Communities program funded the work in 2018. Tabkhi told EE Times the team is "building an LLM for movements." The framing is his, and it is an analogy, not a literal claim.

The two pieces of work that put the LLM-for-movement idea into practice are the SPARTA transformer, a 2024 paper from the same group that tokenizes pose information across space and time, and Shopformer, a transformer-based framework that detects shoplifting from pose sequences rather than raw video. SPARTA is the body-language equivalent of breaking a sentence into words: it gives the model discrete units it can actually learn a distribution over. Shopformer is the first product-shaped application: a cashier-side alarm tuned to the choreography of a grab-and-pocket, not to the silhouette of a hooded figure.

The deployment shape matters. The pipeline runs locally on off-the-shelf Nvidia Jetson edge GPU boxes installed behind existing CCTV cameras. No camera replacement, no cloud round-trip, no video leaving the building. The intermediate representation is described in the work as "motion heat maps" or "motion tokens." Faces, clothing, skin color, and other identifying information are not used. "We just look at the motions and movements," Tabkhi said. The system is in city-scale pilot in Charlotte, under NSF Smart & Connected Communities funding that dates back to 2018; Tabkhi was a 2024 keynote speaker at the S&CC PI meeting.

This is where the category flip earns its privacy claim, and where it picks up its own questions. A system that does not look at faces is, in plain terms, doing less. That is a real gain. It is also not the same as doing no harm. The first question is normative: "normal" is learned from the motion that already happens in a place, and the motion that already happens in a place is whatever the people who already go there tend to do. A baseline built on a suburban mall at noon will not fit a night shift on a loading dock, a teen on a skateboard, or an older adult walking with a cane. The model does not see these as exceptions. It sees them as anomalies to be flagged, because the system was trained to flag whatever departs from what it already saw.

The second question is civil-liberties-shaped, and it does not dissolve just because the camera no longer needs to know who you are. An always-on edge box in a public place still records that a person passed through, still timestamps the motion tokens, and still has to be governed: who can query it, how long the logs live, what happens when a flagged anomaly is sent up the chain. The pose-baseline approach is, on the current evidence, surveillance that is less identity-dependent. Whether that is enough, and whether the new questions it surfaces get answered before deployment, is the part the wire coverage has not caught up to.

The watch items for the rest of 2026: the arXiv preprints are now a year old and the deployment has not been independently benchmarked outside Charlotte. The system's bias surface is undocumented in public. The civil-liberties question is being answered in city procurement documents, not in the academic literature. The next signal to look for is a third-party false-positive rate on a non-resembled population: children, people using mobility aids, anyone whose pose grammar the training cameras did not learn. If that number is published, the pose-baseline track is a credible category. If it is not, the privacy pitch is doing the work the evidence is not yet doing.