Physiological time series such as electrocardiograms (ECG) and electroencephalograms (EEG) exhibit complex temporal structure, substantial acquisition variability, and a strong need for transparent decision-making. Although deep models can achieve high detection performance, they often provide limited insight into why a segment is anomalous, how local anomalies relate over time, and whether a detection belongs to a broader recurring pattern. We propose Signal2Symbol, a neuro-symbolic framework for explainable biosignal anomaly detection. The method first converts ECG/EEG signals into symbolic sequences using either a learned VQ-VAE (Vector Quantized Variational Autoencoder) codebook or a SAX (Symbolic Aggregate approXimation) baseline. It then constructs bigram enriched token-window transactions and scores anomalies through rare itemset evidence derived from minimal rare itemset mining. Detected anomalous windows are merged into intervals and related using Allen interval algebra, enabling composite temporal explanations such as escalation chains, artifact overlap, and cross-channel synchrony. Finally, we introduce a rare temporal concept lattice based on Formal Concept Analysis (FCA), which groups anomalous intervals by shared rare symbolic evidence, Allen temporal relations, channel context, and robustness attributes. The resulting Galois lattice compresses many local detections into interpretable families of temporal-symbolic anomalies. We evaluate on three public benchmarks: MIT-BIH Arrhythmia (beat-level ECG), PTB-XL (record-level ECG), and the Bonn EEG dataset (segment-level EEG). We stress-test robustness under additive noise and baseline-wander perturbations. The results highlight the value of neuro-symbolic tokenization for temporal anomaly analysis and show that Allen/FCA reasoning provides compact, interpretable summaries of local detections.
Figures & tables
Fig. 1 : Signal2Symbol pipeline. Raw ECG/EEG signals are tokenized using SAX or VQ-VAE, transformed into bigram-enriched symbolic transactions, scored by rare-pattern evidence, merged into intervals, related through Allen algebra, and organized into FCA/Galois lattices for visual explanation.
Fig. 2 : VQ-VAE tokenization. Each ECG beat or EEG window is encoded, assigned to the nearest codebook prototype, reconstructed through a decoder, and represented as a symbolic token aligned with timestamps.
Interval
R1
R2
long-duration
escalation
overlap-artifact
A1
×
×
A2
×
×
×
A3
×
×
A4
×
×
×
A5
×
×
×
×
TABLE I : Toy Formal Context mapping anomaly intervals to attributes.
Fig. 3 : Concept lattice of the toy formal context in Table I .
Dataset
Method
AUROC ↑
AUPRC ↑
MIT-BIH
IF (200 trees)
0.790
0.405
LOF ( k=20 )
0.737
0.423
USAD
0.750
0.341
SAX+Rare
0.605
0.198
Signal2Symbol (VQ-VAE+Rare)
0.818
0.547
PTB-XL
IF (200 trees)
0.546
0.615
TABLE II : Detection results across ECG and EEG datasets. MIT-BIH is evaluated at beat-level, PTB-XL at record-level (lead II only), and Bonn at segment-level.
Setting
AUROC ↑
AUPRC ↑
Notes
Tokenizer
SAX ( ∣Σ∣=5,P=16 )
0.579
0.911
fixed discretization
SAX ( ∣Σ∣=6,P=16 )
0.536
0.898
larger alphabet
SAX ( ∣Σ∣=6,P=20 )
0.512
0.891
more segments
VQ-VAE ( K=128 )
0.710
0.959
learned codebook
VQ-VAE ( K=256 )
0.710
0.959
saturates at K=128
TABLE III : Ablation study: effect of tokenizer, alphabet size, and PAA resolution on Bonn EEG.
Fig. 4 : Sensitivity of AUROC and AUPRC to the support threshold τ on the Bonn EEG dataset. The VQ-VAE model exhibits remarkable stability across lower thresholds.
Dataset
Intervals
Concepts
Compression ↑
Intent ↓
Bonn EEG
2061
40
51.5 ×
3.2
MIT-BIH
2154
32
67.3 ×
4.1
PTB-XL
585
144
4.1 ×
4.0
TABLE IV : Explanation quality across datasets. Compression is the ratio of detected anomaly intervals to retained iceberg-lattice concepts; Intent is the mean number of attributes per retained concept.
Method
Clean AUROC
Noise Δ
Wander Δ
SAX+Rare ( ∣Σ∣=5 )
0.579
− 0.002
− 0.024
VQ-VAE+Rare ( K=128 )
0.710
0.000
0.000
TABLE V : Robustness ( Δ AUROC vs. clean) on Bonn EEG. Noise column reports worst-case Δ across SNR ∈{5,10,20} dB; Wander column across amplitudes ∈{0.1,0.3,0.5} .
Fig. 5 : Rare Temporal Concept Lattice generated from 30 anomaly intervals on Bonn EEG (Set E, Seizure). The FCA lattice compresses individual detections into a hierarchy of concepts based on shared temporal attributes (e.g., long-duration ) and rare symbolic patterns ( Ri ). Deeper nodes represent more specific anomaly signatures.
Time-Series Anomaly Detection identifies unusual patterns or events in sequential data, from sensor readings and network traffic to health and industrial telemetry.
Recent studies have explored large language models for time-series anomaly detection, yet existing approaches often rely on a single general-purpose model to directly infer anomaly indices or intervals, limiting controllability, interpretability, and reliability for complex anomaly patterns. We propose SAGE (Specialized Analyzer Group for Expert-like Detection), a multi-agent framework for structured anomaly diagnosis in univariate time series. It decomposes anomaly analysis into four specialized Analyzers for point, structural, seasonal, and pattern anomalies. Each Analyzer applies family-specific numerical tools and diagnostic visualizations to generate evidence, while an evidence-grounded Detector consolidates the evidence into confidence-scored anomaly records with intervals and candidate types. A Supervisor then converts these structured records into analyst-facing diagnostic reports. SAGE further constructs synthetic in-context examples from normal-reference training segments, without using real anomalous segments or anomaly-type labels as in-context examples. Across three benchmarks, SAGE achieves the best average performance among strong ML/DL and language-model-based baselines. Ablation studies and human evaluation further show that the proposed framework improves detection reliability and the practical usefulness of diagnostic outputs.
Hyeongwon Kang, Jeongseob Kim, Jinwoo Park +1
Department of Industrial and Management Engineering Korea University · Mirae Asset Securities · Department of Industrial Engineering Seoul National University
We propose SYRAN, an unsupervised anomaly detection method based on symbolic regression. Instead of encoding normal patterns in an opaque, high-dimensional model, our method learns an ensemble of human-readable equations that describe symbolic invariants: functions that are approximately constant on normal data. Deviations from these invariants yield anomaly scores, so that the detection logic is interpretable by construction, rather than via post-hoc explanation. Experimental results demonstrate that SYRAN is highly interpretable, providing equations that correspond to known scientific or medical relationships, and maintains strong anomaly detection performance comparable to that of state-of-the-art methods.
Md Maruf Hossain, Tim Katzke, Simon Klüttermann +1
TU Dortmund University, Dortmund, Germany · Research Center Trustworthy Data Science and Security, UA Ruhr, Germany
Root cause analysis (RCA) for time-series anomaly detection is critical for the reliable operation of complex real-world systems. Existing explanation methods often rely on unrealistic feature perturbations and ignore temporal and cross-feature dependencies, leading to unreliable attributions. We propose a conditional attribution framework that explains anomalies relative to contextually similar normal system states. Instead of using marginal or randomly sampled baselines, our method retrieves representative normal instances conditioned on the anomalous observation, enabling dependency-preserving and operationally meaningful explanations. To support high-dimensional time-series data, contextual retrieval is performed in learned low-dimensional representations using both variational autoencoder latent spaces and UMAP manifold embeddings. By grounding the retrieval process in the system's learned manifold, this strategy avoids out-of-distribution artifacts and ensures attribution fidelity while maintaining computational efficiency. We further introduce confidence-aware and temporal evaluation metrics for assessing explanation reliability and responsiveness. Experiments on the SWaT and MSDS benchmarks demonstrate that the proposed approach consistently improves root-cause identification accuracy, temporal localization, and robustness across multiple anomaly detection models. These results highlight the practical utility of conditional attribution for explainable anomaly diagnosis in complex time-series systems. Code and models are available at: https://github.com/dfki-av/Conditional-Attribution-for-Root-Cause-Analysis-in-Time-Series-Anomaly-Detection.
German Research Center for Artificial Intelligence (DFKI), Kaiserslautern, Germany · Rheinland-Pfälzische Technische Universität Kaiserslautern-Landau, Germany · Paul Wurth S.A, Luxembourg