Unsupervised Symbolic Anomaly Detection

Md Maruf Hossain; Tim Katzke; Simon Klüttermann; Emmanuel Müller

cs.LGMar 18, 2026

Unsupervised Symbolic Anomaly Detection

Authors: Md Maruf Hossain, Tim Katzke, Simon Klüttermann, Emmanuel Müller

Organizations: TU Dortmund University, Dortmund, Germany · Research Center Trustworthy Data Science and Security, UA Ruhr, Germany

Abstract

We propose SYRAN, an unsupervised anomaly detection method based on symbolic regression. Instead of encoding normal patterns in an opaque, high-dimensional model, our method learns an ensemble of human-readable equations that describe symbolic invariants: functions that are approximately constant on normal data. Deviations from these invariants yield anomaly scores, so that the detection logic is interpretable by construction, rather than via post-hoc explanation. Experimental results demonstrate that SYRAN is highly interpretable, providing equations that correspond to known scientific or medical relationships, and maintains strong anomaly detection performance comparable to that of state-of-the-art methods.

Figures & tables

Panel of Figure 1 — Figure 1: Box plots and critical difference diagrams comparing the AUC-ROC performance of the SYRAN ensemble (a,b) and its best-performing ensemble member (a,c) against baseline anomaly detection methods.

Panel of Figure 2 — Figure 2: Symbolic invariants learned by SYRAN on three ADBench datasets. Significant deviations of function values from 1 are indicative of anomalous behavior.

Figure 3: Mean AUC-ROC performance across benchmark datasets for SYRAN and its best ensemble member across different hyperparameterizations compared to LOF as its strongest competitor. The default configuration is highlighted in gray.

Complexity weight $\gamma$	Best Equation	AUC-ROC ( $\%$ )
0.001	$\left(\frac{1.0500}{x_{3}}\right)^{x_{6}\cdot(-0.0526)\cdot 2.2257}$	$99.19$
0.01	$x_{2}^{\cos\left(\frac{-1.6023}{x_{4}}\right)}$	$97.60$
0.10	$x_{2}+\left\|1-x_{2}\right\|$	$97.73$
0.50	$x_{2}$	$97.73$

Table 1: Effect of the complexity weight on symbolic expressions for the breastw dataset [ 32 ] . Here,

x_{i}

represent the

i

-th feature of the dataset (

x_{2}

corresponds to

x_{cs}

in Section 5.2 ). We state the best ensemble member equation for each

\gamma

Explore similar work

RAD: Rule-Augmented Relational Anomaly Detection
Aug 24, 2026Noah Dahle, Anne Tumlin, Ngoc Tran +2Anomaly Detection Interpretable Anomaly Detection
Vanderbilt University Nashville, Tennessee, USA
Witnesses Explain Anomalies
Sep 3, 2026Lamine DiopFeature Attribution Tabular Anomaly Detection
EPITA Research Laboratory, Le Kremlin-Bicˆetre FR-94276, France
Have an LLM Write Your Anomaly Detector: Autonomous Discovery of Compact, Interpretable Detectors for Time Series
Oct 1, 2026David BerghausInterpretable Anomaly Detection LLM-Based Program Synthesis
Lamarr Institute Germany · Fraunhofer IAIS Germany

Aug 24, 2026J/K move · Enter open · S save

RAD: Rule-Augmented Relational Anomaly Detection

Noah Dahle, Anne Tumlin, Ngoc Tran, Xenofon Koutsoukos+1

Vanderbilt University Nashville, Tennessee, USA

Anomaly Detection Interpretable Anomaly Detection Relational Deep Learning

Open paper AskPDF arXiv

Anomaly detection is often applied to data stored in relational databases, yet most existing methods require flattening multiple tables into a single feature matrix. This flattening can obscure entity identity, schema structure, and multi-hop dependencies, limiting the detection of anomalies that depend on relational context rather than isolated feature values. Beyond preserving relational structure, relational anomaly detection raises an additional challenge: how to incorporate symbolic behavioral evidence into learned relational representations. To address these challenges, we study relational anomaly detection, where the goal is to identify anomalous entities or events in a multi-table database. We propose RAD, a rule-augmented relational anomaly detector that combines heterogeneous graph representation learning with refined symbolic rule signals. RAD derives candidate rules from random-forest paths over flattened summaries of the entities or events being scored, refines them into compact interpretable predicates, injects the resulting rule features into the graph model, and learns anomaly scores using reconstruction-based and pairwise-ranking supervision. To evaluate this setting, we introduce a relational anomaly detection benchmark spanning three settings: LANL cybersecurity event detection and two unexpected user-churn anomaly tasks derived from Amazon and H&M relational databases. Experiments show that RAD improves anomaly ranking over flattened tabular detectors and relational baselines under natural class imbalance, achieving the best average rank on AUROC and AUPRC across the benchmark. Ablations show that direct rule injection and ranking-based supervision are key contributors to performance, while edge reconstruction is not uniformly beneficial. Our code and data are available at: https://github.com/noahd15/RAD_RelationalAnomalyDetection.

Abstract

Explore similar work

RAD: Rule-Augmented Relational Anomaly Detection

Witnesses Explain Anomalies

Have an LLM Write Your Anomaly Detector: Autonomous Discovery of Compact, Interpretable Detectors for Time Series