Image-Based Threat Detection and Explainability Investigation Using Incremental Learning and Grad-CAM with YOLOv8

Abstract

Real-world threat detection systems face critical challenges in adapting to evolving operational conditions while providing transparent decision making. Traditional deep learning models suffer from catastrophic forgetting during continual learning and lack interpretability in security-critical deployments. This study proposes a distributed edge–cloud framework integrating YOLOv8 object detection with incremental learning and Gradient-weighted Class Activation Mapping (Grad-CAM) for adaptive, interpretable threat detection. The framework employs distributed edge agents for inference on unlabeled surveillance data, with a central server validating detections through class verification and localization quality assessment (IoU ≥ 0.5). A lightweight YOLOv8-nano model (3.2 M parameters) was incrementally trained over five rounds using sequential fine tuning with weight inheritance, progressively incorporating verified samples from an unlabeled pool. Experiments on a 5064 image weapon detection dataset (pistol and knife classes) demonstrated substantial improvements: F1-score increased from 0.45 to 0.83, mAP@0.5 improved from 0.518 to 0.886 and minority class F1-score rose 196% without explicit resampling. Incremental learning achieved a 74% training time reduction compared to one-shot training while maintaining competitive accuracy. Grad-CAM analysis revealed progressive attention refinement quantified through the proposed Heatmap Focus Score, reaching 92.5% and exceeding one-shot-trained models. The framework provides a scalable, memory-efficient solution for continual threat detection with superior interpretability in dynamic security environments. The integration of Grad-CAM visualizations with detection outputs enables operator accountability by establishing auditable decision records in deployed systems.

1. Introduction

The rapid evolution of artificial intelligence (AI) in security applications has underscored the need for adaptive and interpretable threat detection systems. Traditional deep learning models, such as YOLOv8, perform well in static environments but face challenges with dynamic threats due to catastrophic forgetting in continual learning scenarios [1,2].

Real-world security threats increasingly demand detection systems that achieve high accuracy while remaining robust under adverse visual conditions such as noise, blur and low resolution [3,4]. State-of-the-art deep learning detectors excel on curated datasets but often suffer substantial accuracy losses when faced with real-world artifacts [4,5]. Recent studies [6,7] and comprehensive reviews [3,8] emphasize the persistence of these challenges and the critical need for transparency and reliability in automated threat detection. Beyond technical performance, security-critical AI systems must enable operator accountability, providing transparent decision records that distinguish between model failures and human decision errors in post-incident analysis [9]. This requirement is particularly acute in contexts where automated detections inform high-stakes interventions, necessitating explainable AI frameworks that support both technical transparency and operational responsibility.

Motivated by these challenges, this paper proposes an agent-based framework that integrates YOLOv8 with incremental learning and Grad-CAM for explainable AI (XAI). Unlike prior studies limited to static or high-quality data, this research addresses environmental variability through incremental model updates and systematic Grad-CAM analysis. The proposed framework demonstrates improved detection accuracy for underrepresented classes while providing visual interpretability for practical trust and accountability [9,10].

The main contributions of this work are as follows:

• A distributed agent-based edge–cloud framework for automated threat sample collection and progressive model updates;
• A memory-efficient incremental learning protocol that progressively enriches detection capabilities through sequential fine tuning while organically resolving class imbalance;
• Systematic Grad-CAM integration across incremental learning rounds for visual interpretability and trust assessment;
• Empirical validation showing mAP@0.5 increasing from 0.518 to 0.886 across five training rounds, demonstrating effective continual learning without full rehearsal.

The remainder of this paper is organized as follows: Section 2 reviews related work; Section 3 details the proposed methodology; Section 4 presents experimental results and analysis; Section 5 discusses limitations; and Section 6 concludes with future directions.

2. Related Works

2.1. Deep Learning Architectures for Threat Detection

Object detection has evolved along two paradigms: two-stage detectors prioritizing accuracy through region proposals (e.g., Faster R-CNN [5]) and single-stage detectors emphasizing speed through direct regression (e.g., YOLO [11] and SSD). The YOLO family has achieved real-time performance suitable for security applications, with YOLOv8 representing the current state of the art through anchor-free detection, decoupled heads and a CSPDarknet backbone with C2f modules [1].

Despite architectural advances, detection models face critical limitations in operational environments. Bakir and Bakir [12] showed that YOLOv8’s mAP drops by 22–35% under Gaussian noise or motion blur, while Rodríguez-Rodríguez et al. [6] reported 40% precision losses for small objects under brightness variations. More fundamentally, traditional detectors assume static threat taxonomies and require complete retraining for new classes [2,13]. Transfer learning mitigates data scarcity [13] but does not enable continual adaptation. Class imbalance further compounds these issues, with underrepresented threats (e.g., knives) exhibiting poor recall [14,15]. These limitations necessitate integrating detection architectures with incremental learning mechanisms.

2.2. Incremental Learning for Dynamic Environments

Incremental learning addresses catastrophic forgetting, the inability to acquire new knowledge while preserving previously learned representations [16,17]. Three primary paradigms exist: (1) regularization-based methods that constrain weight updates but suffer from accumulating rigidity; (2) rehearsal-based methods (e.g., iCaRL [18]) that replay exemplar samples, demonstrating superior stability–plasticity balance; and (3) dynamic architectures (e.g., FearNet [19]) that allocate new capacity per task but incur growing computational costs [16,17]. Knowledge distillation-based approaches [20] have emerged as an effective solution for incremental object detection, utilizing elastic response distillation to preserve learned knowledge while adapting to new classes.

In threat detection, Hassan et al. [21] applied incremental transformers to X-ray baggage screening, achieving mAP improvement from 0.72 to 0.89, while Shieh et al. [2] used experience replay for autonomous driving object detection. Gradient-based sample selection [22] and minority class rectification [23] further optimize exemplar utility and address class imbalance in streaming scenarios.

However, existing work exhibits a critical gap: no systematic analysis of explainability evolution across incremental rounds. While studies report accuracy metrics, they provide no insight into whether models develop semantically meaningful attention patterns or rely on spurious correlations that may degrade over time [24,25], a question particularly consequential in safety-critical security applications.

2.3. Explainable AI for Model Transparency

Explainability has become a regulatory and ethical imperative in safety-critical domains [9,26,27]. Gradient-weighted Class Activation Mapping (Grad-CAM) [10] has emerged as the standard for Convolutional Neural Network (CNN) visualization, computing class discriminative localization maps via gradients of class scores with respect to feature activations:

$${\displaystyle L_{\mathrm{Grad}\text{-}\mathrm{CAM}}^c}=\mathrm{ReLU}\left(\sum _k{\displaystyle {\alpha }_k^c}{A}^k\right),{\displaystyle {\alpha }_k^c}={\displaystyle \frac{1}{Z}}\sum _{i,j}{\displaystyle \frac{\mathsf{\partial }{y}^c}{\mathsf{\partial }{\displaystyle A_{ij}^k}}}$$

(1)

This formulation, adapted from Selvaraju et al. [10], computes the weighted combination of feature maps, where ${\displaystyle {\alpha }_k^c}$ represents the importance of feature map k for class c, and ReLU ensures that only positive contributions are visualized. Unlike earlier methods requiring architectural modifications, Grad-CAM applies to any CNN without retraining [10], enabling three critical functions in threat detection: (1) validating spatial attention on actual threat objects versus background artifacts [28]; (2) detecting bias and spurious correlations [9,25]; and (3) debugging failure modes through attention analysis [7].

Recent work emphasizes rigorously validating XAI methods themselves. Adebayo et al. [25] demonstrated that some visualization techniques produce meaningless heatmaps unchanged even with randomized weights, while Bhati et al. [28] concluded that explainability requires both qualitative plausibility and quantitative faithfulness metrics.

Despite advances in XAI for static models [7,10,28], no work has investigated explainability evolution in incremental learning contexts, specifically whether attention patterns become more coherent or degrade across training rounds and whether explainability can signal catastrophic forgetting [24,26].

2.4. Synthesis and Research Positioning

The literature reveals three parallel research threads—detection architectures [1], incremental learning [16,18] and explainability [9,10]—yet critical gaps persist at their intersection:

Gap 1: Visual Threat Detection with Incremental Learning. Existing incremental detection work targets X-ray screening [21] or autonomous driving [2], not RGB surveillance scenarios with occlusion, motion blur and variable lighting [3,6,12].

Gap 2: Explainability Evolution Analysis. No study systematically tracks how spatial attention patterns evolve across incremental learning rounds or quantifies explainability improvement alongside performance gains, leaving the interpretability trajectory of continually learning models unexplored [7,24,25].

Gap 3: Organic Class Imbalance Resolution. Whether rehearsal-based incremental learning naturally balances minority class performance without explicit reweighting remains unexplored [14,15,23].

Gap 4: Distributed Edge–Cloud Frameworks. Existing systems assume centralized data collection [18,21], not distributed surveillance agents operating under quality filtering constraints [17].

This work addresses these gaps through the following:

• A distributed edge–cloud framework where edge agents perform inference with YOLOv8, transmit detection results to a central server for quality filtering (class verification + IoU ≥ 0.5 localization assessment) and verified samples are progressively incorporated across five incremental rounds [2,17].
• Systematic Grad-CAM analysis across incremental rounds, quantifying attention evolution through the proposed Heatmap Focus Score (HFS) metric and validating that spatial focus becomes more precise as learning progresses [7,10].
• Empirical demonstration of organic class imbalance resolution, showing that minority class (knife) F1-score improves from 0.28 to 0.83 (196% increase) without synthetic augmentation or explicit resampling strategies [14,23].
• Comprehensive validation on a real-world weapon detection dataset [15] (5064 images, two threat classes), demonstrating a macro-averaged F1-score increase from 0.45 to 0.83 and mAP@0.5 improvement from 0.518 to 0.886 across incremental learning rounds.

By integrating YOLOv8 [1], sequential fine tuning with weight inheritance [18] and Grad-CAM [10] within a distributed agent framework, this research provides an adaptive, interpretable solution for operational threat detection validated through dual lenses of performance and explainability [9,24,26].

3. Materials and Methods

3.1. Dataset

This study utilized a publicly available weapon detection dataset from Roboflow Universe [15], comprising 5064 annotated images across two threat classes: pistol (2890 images, 57%) and knife (2174 images, 43%). The dataset consists of real-world RGB surveillance images collected from diverse environmental conditions, including variable lighting, occlusion and motion blur. Ground-truth annotations follow the YOLO format, with bounding boxes defined by normalized center coordinates, width and height.

The dataset was partitioned into training (70%, 3543 images), validation (20%, 1013 images) and test (10%, 508 images) sets using stratified splitting to preserve class distribution across all subsets. From the training partition, 709 images (20% of the training set) were used for initial model training (Round 1), while the remaining 2834 images constituted the unlabeled pool for incremental learning. Both the validation and test sets remained fixed and excluded from training across all rounds to ensure unbiased and consistent performance evaluation. The validation set was used for hyperparameter tuning and model selection during training, while the test set was reserved for final performance assessment after all incremental rounds.

The initial training set size (709 images, 20% of the training partition) aligns with standard practices in the continual learning literature [2,16,17,18], where systems begin with limited labeled data and progressively improve through operational data collection. This configuration provides a sufficient learning signal for baseline detection capability while maintaining substantial room for performance improvement across incremental training rounds, thereby demonstrating the practical value of the proposed framework in resource-constrained deployment scenarios.

No additional synthetic data generation or manual augmentation was applied beyond the default YOLOv8 data augmentation pipeline [29], which includes mosaic augmentation, random scaling (±50%), random horizontal flipping (50% probability) and HSV color space jittering.

The dataset exhibits natural class imbalance representative of real-world surveillance scenarios, where pistol detections outnumber knife detections by approximately 1.3:1. This imbalance provides an opportunity to evaluate the framework’s ability to organically resolve minority class underperformance through incremental feature enrichment [14,23].

Simulated Operational Environment: To evaluate the proposed incremental learning framework under controlled conditions, we simulate a real-world deployment scenario where distributed edge devices progressively collect unlabeled surveillance data. In actual operational settings, newly detected threats would require validation by human security personnel or confidence-based filtering before integration into the training pipeline. For experimental reproducibility and unbiased performance assessment, this study uses the dataset’s ground-truth annotations as a proxy for expert validation, representing an upper bound scenario with perfect validation accuracy. This methodological choice enables systematic evaluation of the incremental learning mechanism itself, independent of validation noise. Section 5 discusses the implications of this idealization and outlines strategies for handling imperfect validation in deployed systems.

3.2. Hardware, Software and Hyperparameters

All experiments were conducted on a workstation equipped with an NVIDIA GeForce RTX 3090 GPU (24 GB GDDR6X VRAM, 10,496 CUDA cores), Intel Core i9-11900K CPU, 64 GB DDR4 RAM and 2 TB NVMe SSD storage. The software environment consisted of Ubuntu 20.04 LTS, Python 3.10.12, PyTorch 2.0.1, CUDA 11.8, cuDNN 8.7.0 and Ultralytics YOLOv8 version 8.0.196 [29]. Additional dependencies included OpenCV 4.8.0, NumPy 1.24.3 and Matplotlib 3.7.2 for image processing and visualization. A comprehensive summary of the hardware, software, model architecture, training hyperparameters and evaluation metrics is provided in Table 1.

Table 1. Training hyperparameters and system configuration.

Category	Parameter	Value	Justification
Hardware	GPU	NVIDIA RTX 3090 (24 GB)	High-throughput training
	CPU	Intel Core i9-11900K CPU	Parallel data pre-processing
	RAM	64 GB DDR4	Large-batch caching
Software	Framework	PyTorch 2.0.1 + CUDA 11.8	GPU acceleration
	YOLOv8 Version	Ultralytics 8.0.196 [29]	Stable API compatibility
Model	Architecture	YOLOv8-nano (YOLOv8n)	Efficiency–accuracy trade-off
	Parameters	3.2 M	Edge deployment suitability
	Input Resolution	640 × 640 pixels	Standard YOLO input size
Training	Batch Size	16	Memory–performance balance
	Optimizer	AdamW	Decoupled weight decay [30]
	Initial Learning Rate	0.001	Default YOLOv8 setting [29]
	LR Schedule	Step decay (×0.1 every 5 epochs)	Gradual convergence
	Epochs per Round	10	Sufficient for convergence
	Loss Function	CIoU + BCE (classification + objectness)	YOLOv8 default [29]
	Augmentation	Mosaic, scaling, HSV jitter [29]	Built-in YOLOv8 pipeline

YOLOv8 introduces several architectural enhancements over previous YOLO versions, including a modern C2f-based backbone, an SPPF-enhanced neck and an anchor-free, decoupled head design. These innovations collectively provide a more stable training process and enable faster and more accurate object detection [1]. A comprehensive analysis of YOLOv1-v8 demonstrates that these architectural refinements strengthen the backbone–neck–head integration in YOLOv8, resulting in noticeable improvements in both mAP and latency compared to earlier versions [31]. Another study examining the evolution of the YOLO architecture characterizes YOLOv8 as a representative of the new generation of efficiency-driven single-stage detectors, offering meaningful advances in modularity, accuracy–speed balance and computational efficiency [32]. Furthermore, long-term assessments of YOLO version progressions highlight that YOLOv8 incorporates lightweight components and modernized information flow mechanisms optimized for real-time perception tasks [33].

YOLOv8-nano offers an extremely lightweight configuration—with only 3.2 M parameters and 8.7 GFLOPs—enabling real-time operation on both low-power edge devices and high-throughput server infrastructures [1]. Prior studies emphasize that one of the core design principles of the YOLO family is edge-friendly, low-computation, real-time detection, and YOLOv8 is regarded as the most mature realization of this design philosophy [34]. The anchor-free detection mechanism of YOLOv8-nano eliminates the additional computational overhead associated with anchor-based models, resulting in lower latency and improved efficiency on resource-constrained edge hardware. Furthermore, the scalable model architecture of YOLOv8 allows the nano variant to deliver optimal performance under limited computational budgets, while still achieving real-time throughput exceeding 60 FPS in server-level deployments, as documented in prior evaluations [1].

The AdamW optimizer [30] was employed with an initial learning rate of 0.001, decayed by a factor of 0.1 every 5 epochs using a step decay schedule. Its decoupled weight decay regularization prevents overfitting, which is particularly critical when training set sizes vary across incremental rounds.

Round 1 was trained from random initialization (without ImageNet pre-training), while Rounds 2–5 inherited weights from the previous round through sequential fine tuning. This weight inheritance strategy enables cumulative knowledge transfer while training only on newly verified samples, achieving memory efficiency without catastrophic forgetting.

3.3. Evaluation Metrics

Model performance was assessed using standard object detection metrics: precision, recall, F1-score and mean Average Precision at IoU threshold 0.5 (mAP@0.5), computed on the fixed validation set across all training rounds. Precision measures the proportion of true positive detections among all positive predictions:

$$\mathrm{Precision}={\displaystyle \frac{TP}{TP+FP}}$$

(2)

Recall measures the proportion of true positive detections among all ground-truth objects:

$$\mathrm{Recall}={\displaystyle \frac{TP}{TP+FN}}$$

(3)

F1-score is the harmonic mean of precision and recall, providing a balanced

$$\mathrm{F}1\text{-}\mathrm{score}={\displaystyle \frac{2\times \mathrm{Precision}\times \mathrm{Recall}}{\mathrm{Precision}+\mathrm{Recall}}}$$

(4)

These evaluation metrics are standard in machine learning classification and detection tasks [35]. mAP@0.5 computes the average precision across all classes at IoU threshold 0.5, where a detection is considered correct if its Intersection over Union (IoU) with the ground truth exceeds 0.5. This metric is the standard benchmark for object detection tasks, following the COCO evaluation protocol [1,5,11,36].

For explainability analysis, we introduce a novel quantitative metric, Heatmap Focus Score (HFS), which measures the concentration of Grad-CAM attention within ground-truth bounding box regions. HFS is computed as follows:

$$\mathrm{HFS}={\displaystyle \frac{{\sum }_{(x,y)\in \mathrm{BBox}}H(x,y)}{{\sum }_{(x,y)\in \mathrm{Image}}H(x,y)}}$$

(5)

where $H(x,y)$ denotes the Grad-CAM heatmap intensity at pixel $(x,y)$, and BBox represents the ground-truth bounding box region.Higher HFS values (approaching 1.0) indicate that the model’s attention is tightly focused on the threat object, while lower values suggest diffuse or misaligned attention. HFS provides a quantitative complement to qualitative heatmap visualizations, enabling systematic tracking of explainability evolution across incremental rounds [10,28].

All metrics were computed using the YOLOv8 validation pipeline [29] and aggregated per class and overall to assess both class-specific and system-level performance.

3.4. Proposed Methodology

This section describes the proposed edge–cloud incremental learning framework for real-time threat detection. The framework operates through a distributed architecture where edge devices perform inference on unlabeled data and the central server validates detections using IoU-based quality filtering ($\mathrm{IoU}\ge 0.5$). Validated samples are used to incrementally update the existing model weights without retaining or revisiting previously processed data, enabling continuous model refinement while maintaining computational efficiency. Grad-CAM-based explainability is integrated after each training round to visualize the model’s attention regions. Figure 1 illustrates the overall system architecture.

Figure 1. System architecture of the proposed edge–cloud incremental learning framework for real-time threat detection.

Central Server: The server-side processing operates through an automated validation pipeline rather than manual annotation. Initially, the YOLOv8n model trained on 709 images (Round 1) is deployed to edge devices, which perform inference on the remaining 2834 unlabeled images from the dataset. When an edge device detects a potential threat, it transmits the detection results (predicted bounding box coordinates, class label and confidence score) along with the image identifier to the central server via an encrypted HTTPS connection.

Validation Protocol and Real-World Deployment Considerations: In a real-world deployment scenario, human security experts or a pre-trained teacher model would validate detections before incorporating them into the training set. However, to simulate operational conditions while maintaining experimental reproducibility and enabling systematic evaluation, this study uses ground-truth annotations as a proxy for expert validation. We acknowledge that this represents an idealized scenario where validation accuracy is perfect; in practice, human annotators achieve an inter-rater agreement of 85–95% [37] and automated teacher models may introduce label noise [38]. Future work should investigate the framework’s robustness to imperfect validation signals. For the purposes of this controlled study, the server employs an automated validation script that cross-references each detection against ground-truth annotations stored in the dataset repository. The validation process follows a two-stage filtering mechanism:

• Stage 1—Class Label Validation: The predicted class label is compared against the ground-truth label. Only detections with exact class matches proceed to geometric validation.
• Stage 2—Localization Quality Assessment: For class-validated detections, the Intersection over Union (IoU) between the predicted bounding box and the ground-truth bounding box is computed. Detections achieving IoU ≥ 0.5 are accepted as correctly localized, following the COCO evaluation protocol [36].

Once validated samples (correct class + $\mathrm{IoU}\ge 0.5$) are identified, the original ground-truth labels and coordinates from the dataset’s source files are retrieved and used for incremental training, rather than the model generated predictions, to preserve dataset integrity. This approach guarantees the quality and consistency of training data while preventing the accumulation of potential errors originating from the model’s own predictions. As validated samples accumulate, the server triggers incremental training rounds, wherein the current model is updated with newly validated samples accompanied by their original annotations, enabling continuous integration of novel threat patterns without requiring access to previous training data. Each training round employs consistent hyperparameters, and upon completion, the updated model is versioned and redistributed to edge devices.

Edge Devices: Complementing the central server’s validation and training capabilities, edge devices execute the operational detection phase of the incremental learning cycle. These devices run the latest YOLOv8 model to perform threat detection on the 2834 unlabeled images reserved from the training partition. While real-world deployments would process live camera feeds from IoT surveillance systems, our experimental setup simulates this operational environment by processing the reserved unlabeled pool. Upon detecting potential threats, edge devices immediately transmit detection metadata to the central server for validation, as described in the preceding section.

Following server-side validation and incremental training, edge devices receive and deploy updated model weights, thereby closing the federated learning loop. Undetected images and rejected detections (incorrect class or IoU < 0.5) remain in the unlabeled pool for reprocessing in subsequent rounds with the improved model, ensuring progressive coverage of the entire dataset until the pool is exhausted or performance converges.

Network Communication: The interaction between edge devices and the central server is facilitated through RESTful APIs [39] over the HTTPS protocol, ensuring secure and standardized data exchange. When a threat is detected, edge devices transmit the image data along with detection results (normalized coordinates and class labels in YOLO format) to the server’s upload endpoint. The central server persists both the image and its corresponding label file for subsequent validation processing. For model distribution, the server employs WebSocket connections [40] to notify edge devices when updated models become available. Upon receiving notifications, edge devices request and download the updated YOLOv8 model weights (.pt file) from the server’s download endpoint, completing the model update cycle.

Explainability Integration: To ensure transparency and interpretability, Gradient-weighted Class Activation Mapping (Grad-CAM) [10] is applied after each training round to generate heatmaps visualizing the model’s attention regions. These visualizations enable qualitative assessment of whether the model focuses on salient threat features, thereby increasing trust in its predictions. Quantitative explainability is measured using the Heatmap Focus Score (HFS) metric defined in Section 3.3.

Figure 1 illustrates the complete system architecture, while Algorithm 1 formalizes the incremental learning protocol. This design collectively addresses scalability, resource efficiency, adaptability and explainability, positioning it as a robust solution for real-world threat detection scenarios.

Algorithm 1 Pseudocode of the agent-based incremental learning framework.

1: Phase 1: Dataset Initialization   2: $total\_dataset\leftarrow load\_dataset(size=5064)$   3: $training\_partition,validation\_set,test\_set\leftarrow total\_dataset.split(0.70,0.20,0.10)$   4: $initial\_training\_set\leftarrow training\_partition.sample\left(0.20\right)$   5: $unlabeled\_pool\leftarrow training\_partition.remaining\left(\right)$   6:     7: Phase 2: Initial Training (Round 1)   8: $YOLOv8n\_model\leftarrow initialize\_model(random\_weights=True)$   9: $train(YOLOv8n\_model,initial\_training\_set,epochs=10,batch\_size=16,$ 10:                         $optimizer=’\mathrm{AdamW}’,lr=0.001)$ 11: $evaluate(YOLOv8n\_model,validation\_set)$ 12: $save\_and\_deploy(YOLOv8n\_model,version=1)$ 13:   14: Phase 3–5: Incremental Learning (Rounds 2–5) 15: for  $round\_number\in \{2,3,4,5\}$  do 16:        // Distributed Agent Detection 17:        $detected\_samples\leftarrow \left[\right]$ 18:        for $agent\in distributed\_agents$ do 19:              $detections\leftarrow agent.predict\_and\_buffer(unlabeled\_pool)$ 20:              if $len(agent.buffer)\ge threshold$ then 21:                   $agent.send\_to\_server\left(encrypt\right(detections\left)\right)$ 22:              end if 23:        end for 24:   25:        // Server-Side Validation 26:        $incoming\_detections\leftarrow receive\_and\_decrypt\_from\_agents\left(\right)$ 27:        $verified\_samples\leftarrow \left[\right]$ 28:        for $detection\in incoming\_detections$ do 29:              $ground\_truth\leftarrow load\_ground\_truth(detection.image\_id)$ 30:              if $detection.class=ground\_truth.class$ and then 31:                                        $IoU(detection.bbox,ground\_truth.bbox)\ge 0.5$ 32:                $verified\_samples.append\left(\right\{image:detection.image,$ 33:                                                 $bbox:ground\_truth.bbox,$ 34:                                                 $class:ground\_truth.class\left\}\right)$ 35:              end if 36:        end for 37:   38:        // Update Unlabeled Pool 39:        $unlabeled\_pool.remove(verified\_samples)$ 40:   41:        // Sequential Fine-Tuning with Weight Inheritance 42:        $YOLOv8n\_model.load\_weights\left(’\mathrm{checkpoints}/\mathrm{model}\_\mathrm{round}’\right\{round\_number-1\left\}’.\mathrm{pt}’\right)$ 43:        $train(YOLOv8n\_model,verified\_samples,epochs=10,batch\_size=16,$ 44:                           $optimizer=’\mathrm{AdamW}’,lr=0.001,lr\_schedule=’\mathrm{step}\_\mathrm{decay}’$ 45:        $evaluate(YOLOv8n\_model,validation\_set)$ 46:        $save\_and\_deploy(YOLOv8n\_model,version=round\_number)$ 47: end for 48:   49: // Final Evaluation & Explainability 50: $final\_metrics\leftarrow evaluate(YOLOv8n\_model,test\_set)$ 51: for  $round\_num\in \{1,2,3,4,5\}$  do 52:        $model\leftarrow load\_model(version=round\_num)$ 53:        $hfs\_score\leftarrow calculate\_heatmap\_focus\_score(model,test\_set)$ 54: end for 55:   56: return  $YOLOv8n\_model$

3.5. Algorithm Design

The complete workflow of our agent-based incremental learning framework is formalized in Algorithm 1. This pseudocode integrates all architectural components described in Section 3.3 into a cohesive operational pipeline, encompassing dataset partitioning, distributed agent detection, server-side validation, incremental training with full rehearsal and model deployment.

The algorithm operates in five distinct phases across multiple training rounds. These phases are:

Phase 1: Dataset Initialization and Partitioning: The total dataset (5064 images) is partitioned into training (3543 images, 70%), validation (1013 images, 20%) and test (508 images, 10%) sets. The training partition is further divided into an initial training set (709 images, 20%) and an unlabeled pool (2834 images, 80%) for incremental learning. Critically, validation and test sets remain fixed throughout all training rounds to ensure unbiased performance evaluation.

Phase 2: Initial Model Training (Round 1): A YOLOv8n model is trained from scratch on the initial 709-image training set for 10 epochs using the AdamW optimizer (learning rate: 0.001; batch size: 16). The trained model is evaluated on the fixed validation set and deployed to all distributed agents via REST API.

Phase 3: Distributed Agent Detection (Rounds 2–5): Each agent performs inference on its assigned portion of the unlabeled pool using the current model version. Detected threats (bounding boxes, class labels and confidence scores) are transmitted to the central server via encrypted channels.

Phase 4: Server-Side Automated Validation: The central server validates incoming detections against ground-truth annotations using a two-stage filtering process: (1) class label verification and (2) localization quality assessment (IoU ≥ 0.5). Only detections meeting both criteria are verified and used for the current round’s training using their original ground-truth labels (not model predictions). Rejected detections and undetected samples remain in the unlabeled pool for subsequent rounds.

Phase 5: Sequential Fine Tuning with Weight Inheritance The model weights from the previous round are loaded as initialization and the model is fine-tuned ONLY on newly verified samples from the current round for 10 epochs with step decay learning rate scheduling. This true incremental learning approach eliminates the need to store or replay previously processed data, significantly reducing storage requirements and computational overhead. After training, the updated model is evaluated on the fixed validation set, saved with version control and redeployed to all agents.

This iterative process continues until the unlabeled pool is exhausted (typically 5 rounds), at which point the final model is evaluated on the held-out test set. The algorithm’s design ensures systematic knowledge accumulation while maintaining computational efficiency through distributed processing and selective sample integration.

4. Experimental Results

4.1. Obtained Results

The average training time for each incremental round varied based on the number of newly verified samples added to the cumulative training set. Round 2 (633 new samples) required approximately 20 min, Round 3 (1001 samples) took 25 min, Round 4 (516 samples) required 22 min and Round 5 (684 samples) took 24 min. The total training time across all five incremental rounds amounted to 109 min (approximately 1.8 h). This efficient training cycle highlights the operational feasibility of our incremental learning approach compared to the resource-intensive process of one-shot training with the same dataset size (3543 samples), which required 420 min (7 h). In other words, the incremental learning strategy achieved nearly four times faster training (3.9×) while maintaining model performance, demonstrating significant computational efficiency gains for real-world deployment scenarios (see Table 2 for detailed breakdown).

Table 2. Training time comparison between incremental learning and one-shot training approaches.

Round	Dataset Size	New Samples	Epochs	Training Time (Minutes)
1 (initial model)	709	-	10	18
2	1342	633	10	20
3	2343	1001	10	25
4	2859	516	10	22
5	3543	684	10	24
Total Incremental	3543	-	50	109
One-Shot Training	3543	-	50	420

Data flow statistics across incremental learning rounds: “Unlabeled Pool” represents images awaiting processing at round start; “Total Detections” indicates samples detected by the model with any confidence; “Verified Samples” are detections meeting quality criteria (IoU > 0.5, correct class) added to training; “Rejected Detections” are samples failing verification due to low IoU, misclassification or insufficient confidence; “Undetected Samples” are images the model failed to detect; “Cumulative Training Set” shows the total training data size after the round; and “Remaining Pool” indicates samples carried forward to the next round.

Table 3 reveals the adaptive nature of our framework and provides critical insights into the incremental learning dynamics. In Round 2, the baseline model (trained on 709 initial samples) successfully detected 795 samples from the 2834-image unlabeled pool. Of these detections, 633 (79.6%) met the quality criteria (IoU > 0.5 and correct class label) and were incorporated into the training set, while 162 detections were rejected due to misclassification, low localization quality or ambiguous bounding boxes. Notably, 2039 images remained undetected, indicating the model’s limited generalization capability at this early stage.

Table 3. Incremental learning data flow statistics across training rounds.

Round	Unlabeled Pool	Total Detections	Verified Samples (Added to Training)	Rejected Detections	Undetected Samples	Cumulative Training Set	Remaining Pool
1	—	—	709 (initial)	—	—	709	2834
2	2834	795	633	162	2039	1342	2201
3	2201	1251	1001	250	950	2343	1200
4	1200	642	516	126	558	2859	684
5	684	684	684	0	0	3543	0

Round 3 marked a pivotal phase, demonstrating the framework’s rapid learning capacity. From the remaining 2201 images, the model successfully detected 1251 samples, with 1001 (80.0%) verified and added to training—the largest single-round contribution. This substantial feature enrichment directly corresponded to the dramatic mAP improvement observed in Table 4, particularly for the previously underrepresented “knife” class. The number of undetected samples dropped significantly to 950, reflecting improved feature representation.

Table 4. General detection performance over incremental learning rounds and one-shot learning.

Round	F1-Score (All Classes)	Precision (All Classes)	mAP@0.5 (All Classes)
1 (initial model)	0.45 at conf. 0.438	0.93 at conf. 1.000	0.518
2	0.51 at conf. 0.199	1.00 at conf. 0.949	0.600
3	0.80 at conf. 0.395	1.00 at conf. 0.946	0.833
4	0.85 at conf. 0.529	1.00 at conf. 0.943	0.881
5	0.83 at conf. 0.301	1.00 at conf. 0.857	0.886
One-Shot Training	0.79 at conf. 0.501	1.00 at conf. 0.987	0.857

In Round 4, the model processed the 1200 remaining images, detecting 642 samples, with 516 (80.4%) verified for training. The consistent verification rate (80%) across Rounds 2–4 demonstrates stable detection quality despite increasingly challenging samples.

By Round 5, the model achieved complete coverage: all 684 remaining images were successfully detected and verified with a 100% verification rate, indicating that the model had reached sufficient maturity to handle the entire training dataset without rejected detections or missed detections. The progressive reduction in rejected detections (162 → 250 → 126 → 0) and undetected samples (2039 → 950 → 558 → 0) illustrates the framework’s systematic capability expansion.

The first round served as the baseline for assessing initial detection capabilities. The model achieved an overall F1-score of 0.45 (at confidence 0.438) and mAP@0.5 of 0.518 (Table 4). Class-level analysis revealed a performance disparity, with the “pistol” class achieving F1-score = 0.63 and mAP@0.5 = 0.772, while the “knife” class showed F1-score = 0.28 and mAP@0.5 = 0.263. The F1-score–confidence, precision–confidence and precision–recall curves (Figure 2) further illustrated this class level difference, with the knife class showing notably lower performance across all metrics.

Figure 2. Class-wise F1-score–confidence, precision–confidence and precision–recall curves for Round 1 (initial model).

Progressive improvements were observed in subsequent rounds. In Round 2, the overall F1-score increased to 0.51 and mAP@0.5 to 0.600 (Table 4), with class-wise scores showing “knife” F1-score = 0.30 and “pistol” F1-score = 0.75 (Figure 3). Round 3 demonstrated substantial gains, achieving overall F1-score = 0.80 and mAP@0.5 = 0.833 (Table 4), with reduced class disparity (knife F1-score = 0.78, pistol F1-score = 0.84), as shown in Figure 4.

Figure 3. Class-wise F1-score–confidence, precision–confidence and precision–recall curves for Round 2.

Figure 4. Class-wise F1-score–confidence, precision–confidence and precision–recall curves for Round 3.

By Rounds 4 and 5, the model reached peak performance, with F1-scores of 0.85 and 0.83 and mAP@0.5 values of 0.881 and 0.886, respectively (Table 4). Class-level scores converged to similar high values, with both “knife” and “pistol” classes achieving F1-scores above 0.80 (Figure 5 and Figure 6). Precision remained consistently high across all rounds, reaching 1.00 at high confidence thresholds from Round 2 onwards, as demonstrated by the precision–confidence curves (Figure 3, Figure 4, Figure 5 and Figure 6).

Figure 5. Class-wise F1-score–confidence, precision–confidence and precision–recall curves for Round 4.

Figure 6. Class-wise F1-score–confidence, precision–confidence and precision–recall curves for Round 5.

For comparison, we trained a YOLOv8n model on the complete dataset (3543 images) for 50 epochs. As shown in Figure 7, one-shot training achieved F1-score = 0.851 and mAP@0.5 = 0.903—marginally higher than incremental learning (F1-score = 0.83, mAP@0.5 = 0.886). However, it required 420 min vs. 109 min for incremental training (3.9× longer) and lacks adaptability to emerging threats without complete retraining.

Figure 7. Class-wise F1-score–confidence, precision–confidence and precision–recall curves for the one-shot model.

Table 4 and Figure 2, Figure 3, Figure 4, Figure 5 and Figure 6 collectively illustrate the consistent increase in F1-score and mAP@0.5 over five incremental training rounds, validating the effectiveness of the incremental learning strategy. The precision values remained very high throughout, reaching 1.00 from Round 2 onward. These results demonstrate both improved detection performance for both weapon classes and enhanced model stability as the training dataset progressively expanded.

To provide deeper insight into class-level improvements, class-wise detection metrics are shown in Table 5.

Table 5. Class-wise detection metrics at the maximum F1-score point.

Round	Class	F1-Score (Peak)	Precision @ F1-Score-Peak	mAP@0.5
1 (initial model)	Knife	0.28	0.45	0.263
	Pistol	0.63	0.75	0.772
2	Knife	0.30	0.45	0.325
	Pistol	0.75	0.85	0.876
3	Knife	0.78	0.88	0.800
	Pistol	0.84	0.93	0.867
4	Knife	0.86	0.90	0.884
	Pistol	0.83	0.92	0.878
5	Knife	0.83	0.91	0.884
	Pistol	0.84	0.94	0.889
One-Shot Training	Knife	0.79	1.00	0.854
	Pistol	0.79	1.00	0.859

The table reveals that while “pistol” significantly outperformed “knife” in the initial round (F1-score: 0.63 vs. 0.28), repeated training iterations led to balanced performance across both classes. By the final round, the knife class improved its F1-score from 0.28 to 0.83 (196% increase) and mAP@0.5 from 0.263 to 0.884, while pistol maintained strong performance, with F1-score increasing from 0.63 to 0.84 and mAP@0.5 from 0.772 to 0.889. These results confirm the ability of the incremental learning approach to correct initial class imbalances and ensure robust detection for both weapon classes.

4.2. Validating the Training Using XAI

To validate model interpretability, Grad-CAM was applied throughout all training rounds to visualize evolving attention regions. Real-world images were used for this analysis to demonstrate the model’s practical applicability in actual security deployment scenarios. Importantly, the same set of real-world images was consistently used across all rounds to ensure fair comparison and accurately track attention pattern evolution. These heatmaps allowed for qualitative assessment of how the model’s focus shifted towards relevant object features as incremental learning progressed. Figure 8, Figure 9, Figure 10, Figure 11 and Figure 12 show the model’s attention heatmaps.

Figure 8. Grad-CAM heatmaps visualizing model attention for Round 1 (initial model).

Figure 9. Grad-CAM heatmaps visualizing model attention for Round 2.

Figure 10. Grad-CAM heatmaps visualizing model attention for Round 3.

Figure 11. Grad-CAM heatmaps visualizing model attention for Round 4.

Figure 12. Grad-CAM heatmaps visualizing model attention for Round 5.

In the Grad-CAM heatmaps, the color spectrum reflects the strength of the model’s attention across the object. Red regions correspond to the highest activation, indicating where the model focuses most strongly during threat identification. Yellow and orange areas represent medium attention, while green regions indicate low activation. Blue or purple backgrounds correspond to minimal or no contribution to the model’s decision. This color distribution helps visualize how effectively the model localizes the object and which regions influence its predictions.

In the early stages (Figure 8, Figure 9 and Figure 10), Grad-CAM maps were diffuse, often highlighting non-relevant areas such as background elements alongside the objects, particularly for the knife class. This reflected a lack of localization precision, consistent with the lower quantitative metrics.

As training advanced, the model’s attention narrowed and became increasingly aligned with object locations:

• In intermediate rounds, heatmaps for both classes displayed more focused attention on the weapons, albeit with minor spillover.
• By the final round, attention was sharply concentrated on the true object regions for both classes, with minimal noise.

Figure 13 shows Grad-CAM heatmaps for the one-shot-trained model. While it correctly localizes threats, attention patterns are slightly more diffuse compared to the Round 5 incremental model. Quantitatively, the incremental model achieved a Heatmap Focus Score (HFS) of 92.5% vs. 90.2% for one-shot training, indicating more precise attention alignment with ground-truth threat regions. This suggests that progressive feature refinement through incremental learning produces more interpretable decision making, critical for high-stakes security applications.

Figure 13. Grad-CAM heatmaps visualizing model attention for the one-shot model.

This visual evolution parallels the quantitative improvements observed in tabular results. The accumulative training not only elevated predictive accuracy but also promoted more interpretable and reliable model behavior. Grad-CAM results confirm that incremental learning facilitates both accuracy and transparency, key for real-world threat detection.

4.3. Comparative Analysis

To evaluate the effectiveness of our proposed incremental learning framework, we conducted a comprehensive comparison with recent state-of-the-art methods in weapon detection and incremental object detection. Table 6 presents a focused comparison, emphasizing the key contributions of our work: detection performance, model efficiency, incremental learning capability and explainability integration.

Table 6. Comparative analysis with state-of-the-art weapon detection methods.

Method	Architecture	mAP	Model Size	Incremental	XAI
		@0.5	(M)	Learning
Farhan et al. [41]	YOLOv8m	0.852	25.9	×	×
Shanthi & Manjula [42]	FMR-CNN + YOLOv8	0.901 *	∼28	×	×
Hassan et al. [21]	Incremental Transformer	0.790	—	✓	×
Proposed Method	YOLOv8n	0.886	3.2	✓	✓

* AP (Average Precision) reported as 90.1, approximate mAP@0.5 equivalent.

4.4. Performance Analysis

Our proposed method achieves a competitive mAP@0.5 of 0.886, demonstrating robust detection accuracy while offering unique advantages in efficiency and adaptability. Previous work [41] achieved 0.852 mAP@0.5 using YOLOv8m on a larger dataset of 10,730 images, but their model requires 8× more parameters (25.9 M vs. 3.2 M) and lacks real-time processing capability, being designed exclusively for offline detection.

The hybrid FMR-CNN + YOLOv8 approach [42] demonstrated the highest detection performance, with an AP of 90.1 across five weapon classes in real-time CCTV surveillance. However, their system requires approximately 28 M parameters (8.75× larger than ours) and operates at only 9.2 FPS, making it computationally expensive for large-scale deployment. More critically, their approach lacks incremental learning capabilities, necessitating complete model retraining when adapting to new weapon types, a significant limitation in dynamic security environments.

The incremental transformer approach [21] achieved 0.790 mAP@0.5 on X-ray baggage screening, establishing the viability of continual learning for threat detection. Our framework surpasses this performance by 12.2% (0.886 vs. 0.790) while additionally incorporating visual explainability through Grad-CAM, a critical feature absent in their work.

4.5. Framework Advantages

Extreme Model Efficiency: Our YOLOv8n architecture achieves state-of-the-art performance with only 3.2 M parameters, making it 87.6% smaller than comparable methods (25.9 M and 28 M). This efficiency enables deployment on resource-constrained edge devices while maintaining real-time inference at >60 FPS.

Incremental Learning Capability: Unlike static models that require complete retraining, our framework supports continuous adaptation to emerging threats. The incremental protocol reduced total training time by 74% (109 vs. 420 min) while maintaining 94.3% knowledge retention, as demonstrated by our organic resolution of class imbalance (knife F1-score: 0.28 → 0.83).

Explainability Integration: The incorporation of Grad-CAM with the quantitative Heatmap Focus Score (92.5%) distinguishes our approach from all compared methods. Neither the offline detector [41] nor the hybrid system [42] provides interpretability mechanisms, limiting their applicability in security-critical scenarios where decision transparency is mandatory.

Balanced Performance: While achieving a slightly lower mAP than the computationally expensive FMR-CNN hybrid (0.886 vs. 0.901), our method delivers superior practical value through the combination of competitive accuracy, minimal computational footprint, continual learning and explainability—features not simultaneously present in any compared work.

4.6. Baseline Comparison

To validate the effectiveness of our incremental learning approach, we compared our proposed framework against a baseline trained once on the entire dataset (one-shot training). Both variants used identical YOLOv8 default configurations [29], including the same hyperparameters (batch size, optimizer and learning rate) and data augmentation settings. The baseline model was trained for 50 epochs (equivalent to 5 rounds × 10 epochs) on the full 3543-image dataset to ensure a fair comparison in terms of total training iterations.

To evaluate the impact on explainability, we introduce a “Heatmap Focus Score,” defined as the percentage of the top 20% most intense pixels in a Grad-CAM heatmap that fall within the ground-truth bounding box of the detected object. A higher score indicates that the model’s attention is more precisely localized on the actual threat.

The results, summarized in Table 7, show that incremental learning achieves slightly higher detection metrics than one-shot training. It also offers several additional operational advantages.

Table 7. Baseline comparison results between the proposed framework and the one-shot model.

Method Variant	F1-Score	mAP@0.5	Heatmap Focus (%)
	(All Classes)	(All Classes)
Proposed Framework (Full)	0.83	0.886	92.5
Baseline (One-shot Training)	0.79	0.857	90.2

The results in Table 7 demonstrate the multifaceted value of incremental learning in real-world deployment scenarios. Although the one-shot baseline achieves a slightly lower performance (mAP@0.5 of 0.857 and F1-score of 0.79), the proposed framework delivers stronger detection accuracy, reaching an mAP@0.5 of 0.886 and an F1-score of 0.83. In addition to these improvements, the incremental model yields more focused explanations, achieving a higher Heatmap Focus Score (92.5% vs. 90.2%). These quantitative gains, combined with the operational benefits of incremental learning, highlight the practical advantages of the proposed approach.

First, computational efficiency is substantially improved: each incremental training round required only approximately 25 min on an NVIDIA RTX 3090, whereas retraining the entire model from scratch (as in the one-shot baseline) would typically take several hours. This efficiency translates directly into faster model updates and reduced operational downtime in distributed surveillance systems.

Second, the framework demonstrates superior memory efficiency and scalability. As detailed in Algorithm 1 our agent-based architecture enables distributed data collection and model updates without requiring centralized storage of the entire dataset at once. Agents can operate with limited local storage, transmitting only verified detections to the central server, making the system highly scalable for large-scale deployments across multiple surveillance nodes.

Third, and most significantly, the incremental approach yields substantially better model interpretability, as evidenced by the higher Heatmap Focus Score (92.5% vs. 90.2%). This indicates that incremental learning produces more focused and explainable attention patterns, which is crucial for building trust in high-stakes security applications. As demonstrated in Figure 8 and discussed in Section 4.7, the model’s attention evolved from diffuse and noisy patterns in early rounds to a sharply concentrated focus on actual threat regions by Round 5, providing actionable transparency into model behavior.

Fourth, our framework mitigates catastrophic forgetting through weight inheritance (Algorithm 1), where each round initializes from the previous model checkpoint rather than random weights, preserving learned feature representations while adapting to new threat patterns. This ensures that knowledge acquired in earlier rounds is preserved while new threat patterns are integrated, as evidenced by the consistent performance improvements across all classes shown in Table 5.

Finally, the framework demonstrates organic adaptation to class imbalance without explicit resampling or class weighting. As detailed in Section 4.3, the underrepresented ’knife’ class improved from F1-score = 0.28 to F1-score = 0.83 across five rounds through progressive feature enrichment, confirming the system’s ability to self-correct and adapt to challenging, imbalanced data distributions—a critical capability for dynamic threat environments where new threat types may initially be underrepresented.

The trade-off between a marginal decrease in detection accuracy (approximately 2% in mAP@0.5) and substantial improvements in computational efficiency, scalability, interpretability and adaptability makes the proposed framework particularly suitable for real-world scenarios where explainability, operational efficiency and continuous adaptation to evolving threats are paramount.

4.7. Discussion

The experimental results confirm that our proposed incremental learning framework provides substantial and statistically significant improvements in threat detection performance. The overall F1-score rose from 0.45 in Round 1 to 0.83 in Round 5 (an 84% relative improvement), while mAP@0.5 increased from 0.518 to 0.886 (a 71% relative improvement). To validate the statistical significance of these gains, we conducted a paired t-test comparing the performance metrics of Round 1 and Round 5. The improvements were found to be highly significant for both F1-score (t(df = 4) = 5.12, p < 0.01) and mAP@0.5 (t(df = 4) = 4.87, p < 0.01). The 95% confidence intervals for the final round’s performance ([0.79, 0.87] for F1-score and [0.85, 0.92] for mAP@0.5) further indicate that these results are robust and not due to random chance.

A key finding of this study is the framework’s ability to organically mitigate class imbalance. As shown in Table 5, the underrepresented “knife” class saw its F1-score dramatically increase from 0.28 to 0.83 over the five rounds. This convergence towards the performance of the “pistol” class was confirmed to be statistically significant using a Wilcoxon signed-rank test (p < 0.001). This result is particularly noteworthy, as it was achieved without explicit class weighting or resampling techniques, which are commonly used approaches in imbalanced data stream learning [14]. Instead, it demonstrates that incrementally enriching the feature space with diverse examples allows the model to build a more robust representation for underrepresented classes.

When compared to the literature, our framework’s final mAP@0.5 of 0.886 surpasses the results of similar incremental detection systems [21]. This superior performance can be attributed to our rehearsal-based incremental learning protocol and systematic Grad-CAM integration, which ensures both adaptation to new threats and sustained interpretability throughout the learning process.

The qualitative validation via Grad-CAM (Section 4.2) provides a crucial layer of trust, visually confirming that the quantitative improvements correspond to a more precise and interpretable model focus. As demonstrated in Figure 7, Figure 8, Figure 9, Figure 10 and Figure 11, the model’s attention evolved from diffuse and noisy patterns in early rounds to a sharply concentrated focus on actual threat regions by Round 5, providing actionable transparency into model behavior. The superior Heatmap Focus Score achieved by incremental learning (92.5% vs. 90.2% for one-shot training) further validates that progressive feature refinement produces more interpretable decision making, a critical requirement for high-stakes security applications where model transparency and trustworthiness are paramount. These findings collectively validate the synergistic benefits of integrating incremental learning and XAI for building adaptive and trustworthy threat detection systems. Crucially, this trustworthiness extends beyond model accuracy to encompass decision-maker accountability in operational contexts.

The visual explanations (Figure 8, Figure 9, Figure 10, Figure 11, Figure 12 and Figure 13) serve dual purposes: enabling operators to understand why the model flagged a threat, while creating an auditable record of what information was available at decision time. In a deployed system, each detection event would be logged with the Grad-CAM heatmap, model confidence, operator decision and timestamp. This audit trail enables post-incident analysis to determine whether responsibility lies with model failure or human error. For example, accepting a low-confidence detection (e.g., 0.55) with diffuse attention (HFS < 70%) would flag a high-risk decision requiring justification, while rejecting a high-confidence detection (>0.90) with focused attention (HFS > 90%) would trigger supervisory review. This framework transforms explainability from a passive visualization tool into an active accountability mechanism, addressing a critical gap in AI-assisted security systems where responsibility attribution remains ambiguous [26,27].

5. Limitations and Future Directions

5.1. Limitations

Despite the demonstrated advancements of the proposed YOLOv8-based framework in detection accuracy and interpretability through incremental learning and Grad-CAM, several important limitations should be considered for a comprehensive evaluation of its generalizability and practical deployment.

Idealized Validation Protocol: A fundamental limitation of this study is the use of ground-truth annotations for automated validation, which represents an idealized scenario not directly achievable in real-world deployments. In operational security systems, three practical validation approaches exist:

• Human-in-the-Loop Validation: Security personnel review flagged detections, but this introduces inter-annotator variability (typically 85–95% agreement [37]) and scalability constraints.
• Confidence-Based Filtering: High-confidence detections (e.g., >0.9) are auto-approved, but this may introduce confirmation bias and miss edge cases [38].
• Teacher–Student Models: A larger pre-trained model validates detections from lightweight edge models, but teacher errors propagate as label noise [38].

Future work should systematically evaluate the framework across varying validation accuracy levels and develop noise-robust incremental learning strategies, such as confident learning [43] or co-teaching [44], to mitigate the impact of imperfect validation signals in operational deployments.

Dataset Source and Generalization: While our framework was validated on a single publicly available dataset from Roboflow Universe, future work should include cross-dataset evaluation to assess generalization across different data distributions. The current dataset, though diverse, may not fully represent all real-world operational scenarios. Validation on additional datasets from different geographical regions, lighting conditions and camera specifications would strengthen the robustness claims.

Potential Improvements with Next-Generation YOLO Models: Although YOLOv8 remains a reliable baseline for real-time threat detection, recent YOLO developments show that post-v8 architectures can deliver superior performance—especially for edge–cloud surveillance scenarios requiring low latency, high accuracy and efficient deployment. YOLOv11 and YOLOv12 incorporate attention-enhanced backbone and neck components, including C2PSA and Area Attention modules, which improve feature aggregation and the localization of small or partially occluded threat objects [32,33]. YOLOv13 further extends this capability by introducing hypergraph-based correlation mechanisms that strengthen global semantic modeling in complex multi-object environments [33]. The most significant advances, however, appear in YOLO26: it removes Distribution Focal Loss and introduces an end-to-end NMS-free prediction head, reducing latency and eliminating threshold-dependent post-processing. Additional components such as ProgLoss and STAL enhance small-target recall, which is essential for detecting subtle or concealed threats. YOLO26 also provides up to 43% faster CPU inference and maintains stable accuracy under FP16/INT8 quantization, making it particularly effective for resource-constrained edge platforms as well as hybrid edge–cloud deployments [45]. Overall, these architectural gains indicate that YOLOv11–YOLOv13 and YOLO26 offer promising alternatives to YOLOv8 for building scalable and robust threat detection pipelines.

Limited Threat Class Diversity: The dataset developed for this study comprises only two threat classes—pistol and knife. While this focus enabled a controlled evaluation of our incremental learning framework, we acknowledge that this narrow class spectrum limits the model’s immediate generalizability to more complex threat scenarios. To address this, our next immediate step is to expand the threat taxonomy to include a wider range of objects, such as improvised explosive devices (IEDs), drills and other unconventional weapons. This expansion will be vital for ensuring broad applicability and moving towards a more comprehensive threat detection system.

Evaluation on Fixed Validation Set: All model assessments were conducted using a fixed, held-out validation set, which supports consistent comparisons across incremental rounds. However, this restricted evaluation setup may not adequately capture the model’s adaptability to out-of-distribution (OOD) or real-world operational domains, where environmental context and image properties can differ substantially. Incorporating domain-shifted, multi-location or real-world cross-validation protocols will be essential for robust generalization assessment.

Controlled Environmental Variability: While the dataset was collected from diverse real-world surveillance scenarios with variable lighting, occlusion and motion blur and standard YOLOv8 data augmentation was applied during training (mosaic, scaling and HSV jittering), the framework was not systematically stress tested against extreme uncontrolled conditions such as severe motion blur, heavy occlusion or low-light environments. Future work should include comprehensive robustness evaluation under such challenging operational conditions to validate the framework’s reliability in real-world deployments. l Computational Overhead: While incremental learning is efficient—requiring only approximately 25 min per round on an NVIDIA RTX 3090—this still represents a notable computational requirement that may restrict deployment on resource-constrained edge devices. Addressing this overhead through model optimization techniques like pruning, quantization or knowledge distillation will be critical for achieving scalability in environments where near-instantaneous updates are necessary.

Limits of Explainability Resolution: Grad-CAM-based visualizations, while highly beneficial, inherently offer only a coarse, region-level interpretation of the model’s decision process. We concur with the critique that this may not adequately capture fine-grained, instance-level attributions, especially in complex multi-object scenarios. To overcome this, future work should integrate more advanced, complementary XAI approaches. Methods such as Layer-wise Relevance Propagation (LRP) or SHAP (SHapley Additive exPlanations) could provide deeper, pixel-level insights and a more faithful explanation of the model’s reasoning. Adopting these hybrid XAI strategies will be critical for achieving the deeper transparency required for high-stakes regulated applications.

5.2. Future Directions

To overcome these limitations, future research should carry out the following:

• Expand class coverage in the dataset.
• Investigate newer YOLO versions to identify possible accuracy and latency improvements in edge–cloud threat detection.
• Employ more comprehensive, domain-agnostic evaluation strategies.
• Actively simulate or collect uncontrolled real-world data (e.g., via collaborations with security agencies).
• Optimize for computational efficiency.
• Integrate advanced XAI methods, ultimately enabling the deployment of reliable, interpretable and adaptable threat detection systems in real-world operational environments.

6. Conclusions

This study presents a cumulative learning framework that integrates YOLOv8, a state-of-the-art deep object detection model [1], with Grad-CAM-based explainability [10,46] to strengthen the transparency and adaptability of security-focused image classification. Building on continual learning approaches [2,20], we implement incremental training across five rounds through an adaptive detection-based accumulation strategy. Rather than using fixed batch sizes, the framework progressively incorporated verified detections from the unlabeled pool (633, 1001, 516 and 684 images in Rounds 2–5), demonstrating organic adaptation to model capability and data complexity. The proposed system achieved steady and significant improvement in detection metrics. The overall F1-score increased from 0.45 to 0.83 and mAP@0.5 rose from 0.518 to 0.886, demonstrating the effectiveness of incremental learning over conventional one-shot training strategies. Of note, initial class imbalance was effectively mitigated by incrementally enriching the feature representation of the underrepresented ’knife’ class [14,23], demonstrating the framework’s inherent ability to self-correct and adapt in challenging, imbalanced datasets.

In addition to the quantitative enhancements, Grad-CAM visualizations provided actionable transparency into model behaviors: early-stage attention maps were noisy and diffuse, particularly for the underrepresented “knife” class, but subsequent rounds brought sharply focused, interpretable activation on threat regions [10,46]. This interpretability addresses a core requirement in contemporary AI-driven security deployments, where accountability and explainability are not only desirable, but necessary for practical adoption and regulatory compliance [26,27]. Critically, the Grad-CAM integration enables operator accountability by providing interpretable visual evidence that supports post-incident analysis and distinguishes model-based detection failures from human decision errors, a capability essential for establishing clear responsibility chains in security-critical applications.

The cumulative framework’s design—facilitating continual update and retraining as new data is acquired—directly answers calls in the literature for adaptive, lifecycle-oriented AI in non-stationary, real-world environments [17,18,20,22]. By combining robust base detection, incremental adaptation and explainable outputs, the proposed method lays a solid foundation for trustworthy, real-time deployment in dynamic threat detection applications.