Detect, Explain, Interpret: An End-to-End Benchmark for Time Series Anomaly Detection, Explainability and Interpretability

Roberto Stanzione; Jules Barbe; Magali Parrino; Jérémie Fourmann; Paul Boniol

cs.LGOct 1, 2026

Detect, Explain, Interpret: An End-to-End Benchmark for Time Series Anomaly Detection, Explainability and Interpretability

Authors: Roberto Stanzione, Jules Barbe, Magali Parrino, Jérémie Fourmann, Paul Boniol

Organizations: Inria, ENS, CNRS, PSL Paris, France · Scality Paris, France · Inria, ENS, CNRS, PSL, EDF Paris, France

Abstract

Time Series Anomaly Detection has received increasing attention, driven by the growing availability of complex time series data. This surge has led to the development of numerous detection methods, as well as a variety of benchmarks aimed at thoroughly evaluating their performance. However, most existing detectors remain largely agnostic to domain context, overlooking explainability and interpretability. One of the main reasons for this gap is that current benchmarks primarily focus on detection accuracy, and only few of them evaluate spatial explainability. Moreover, no benchmark currently provides sufficiently rich semantic annotations to support the generation of human-understandable interpretations of anomalies. To address these limitations, we introduce SHAD (Scality High-dimensional Anomaly Detection benchmark), a fully annotated benchmark composed of 215 multivariate, high-dimensional time series collected from real-world distributed cloud storage systems operated by Scality. The proposed dataset includes rich contextual information, covering three families of anomalies with varying degrees of severity. As further contribution, we provide a foundation for future work by evaluating baseline methods for Detection, Explainability, and Interpretability, covering all stages of a TSAD pipeline. For Detection, we benchmark a wide range of existing anomaly detectors, testing their effectiveness on the proposed real-world dataset. Then, we consider explainability by evaluating whether measuring the contribution of each dimension in the generated anomaly score can provide accurate anomaly attributions. Finally, for interpretability, we investigate the effectiveness of frozen LLM baselines in localizing and interpreting anomalies.

Figures & tables

Figure 1 : Example of SHAD’s contextual knowledge (Asynchronous Storage Node Failure).

Figure 2 : Time series anomaly (a) Detection , (b) Explanation , and (c) Interpretation .

Benchmark	Dataset			Evaluation
Benchmark	Multi.	Ann.	Desc.	AD	Expl.	Interp.
NAB [ 48 ]	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{0.0664,0.7266,0.0664}\checkmark}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{1,0,0}\times}$
Exathlon [ 36 ]	${\color[rgb]{0.0664,0.7266,0.0664}\checkmark}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{0.0664,0.7266,0.0664}\checkmark}$	${\color[rgb]{0.0664,0.7266,0.0664}\checkmark}$	${\color[rgb]{1,0,0}\times}$
TODS [ 44 ]	${\color[rgb]{0.0664,0.7266,0.0664}\checkmark}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{0.0664,0.7266,0.0664}\checkmark}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{1,0,0}\times}$
TimeEval [ 74 ]	${\color[rgb]{0.0664,0.7266,0.0664}\checkmark}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{0.0664,0.7266,0.0664}\checkmark}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{1,0,0}\times}$
TSB-UAD [ 66 ]	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{0.0664,0.7266,0.0664}\checkmark}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{1,0,0}\times}$

Table 1 : Comparison of TSAD benchmarks

Figure 3 : Overview of our proposed benchmark SHAD .

Figure 4 : Sample of time series for each of the

3

main anomaly types in SHAD .

Figure 5 : SHAD’s annotations

Figure 6 : Overview of the evaluation for interpretability.

Figure 9 : Results for the interpretability experiment. For Presence , Type , and Criticality we consider the F1-score , while for Dimension and Time Localization we report the accuracy .

Figure 10 : Interpretability results with the same model family (Mistral large/medium/small).

Appendix figures & tables18 assets

Supplementary material from the paper’s appendix.

Appendix

Name	Category	Dimension	Avg Dim	# of time series	Avg Length	Domain
UCR [ 94 ]	P&S	I	1	250	67818.7	Multiple
Yahoo [ 47 ]	P&S	I	1	367	1560.2	Web Service
IOPS [ 35 ]	S	I	1	58	72792.3	IT/Web Services
MGAB [ 84 ]	S	I	1	10	97777.8	Synthetic
WSD [ 106 ]	S	I	1	210	17444.5	IT/Web Services
SED [ 14 ]	S	I	1	6	23332.3	Sensor

Appendix

Table 2 : Summary characteristics of 30 datasets

Metric	Unit	Description
cpu_usage_ratio	ratio [0,1]	Fraction of CPU time not idle, averaged across all servers.
cpu_load_ratio	ratio [ $\geq$ 0]	CPU load average normalized by CPU count across all servers. Can exceed 1.0 when the run queue exceeds CPU count.
memory_usage_ratio	ratio [0,1]	Fraction of total used memory, averaged across all servers.
network_in_bytes	bytes/s	Total incoming network throughput across all interfaces on all servers.
network_out_bytes	bytes/s	Total outgoing network throughput across all interfaces on all servers.
objects_count	count	Number of objects stored on the RING, including replicas.

Appendix

Table 3 : Platform-level metrics (17 dimensions, cluster-wide aggregates).

Metric	Unit	Description
s3_errors_5xx	errors/s	Rate of HTTP 5xx server errors across all S3 services.
s3_request_get_operations	ops/s	GET request rate.
s3_request_post_operations	ops/s	POST request rate. Near-constant (no multipart uploads in the nominal workload).
s3_request_put_operations	ops/s	PUT request rate.
s3_request_delete_operations	ops/s	DELETE request rate.
s3_request_head_operations	ops/s	HEAD (metadata lookup) request rate.

Appendix

Table 4 : S3-level metrics (13 dimensions, aggregated across storage servers).

Metric	Unit	Description
cpu_usage_ratio	ratio [0,1]	Fraction of CPU time not idle for this server.
cpu_load_ratio	ratio [ $\geq$ 0]	CPU load average normalized by CPU count. Can exceed 1.0.
memory_usage_ratio	ratio [0,1]	Fraction of total used memory.
network_in_bytes	bytes/s	All incoming network throughput (S3, RING inter-node, monitoring).
network_out_bytes	bytes/s	All outgoing network throughput.
operations_sent	ops/s	Rate of internal RING operations sent to other servers.

Appendix

Table 5 : Server-level metrics (19 unique metrics

\times

3 servers = 57 dimensions). Column names follow the pattern store{1,2,3}-{metric} .

Metric	Unit	Description
disk_read_bytes	bytes/s	Disk read throughput.
disk_write_bytes	bytes/s	Disk write throughput.
disk_io_time_seconds	s/s [0,1]	Fraction of time spent on I/O. Approaching 1.0 implies saturation.
disk_usage_ratio	ratio [0,1]	Disk space utilization.

Appendix

Table 6 : Device-level metrics (4 metrics

\times

7 devices

\times

3 servers = 84 dimensions). Column names follow store{1,2,3}-{device}-{metric} . Each server has 4 NVMe data disks ( g1disk01 , g1disk02 , g2disk01 , g2disk02 ), 2 metadata SSDs ( ssd01 , ssd02 ), and 1 OS root disk ( root ). Data disks are the targets of disk failure anomalies.

Figure 11 : Full 171 dimensions of an asynchronous, cascading disk failure experiment. Red vertical lines denote the full anomalous event, from the first disk failure onset to the last completed fix.

ID	Details	Notes
1773251393	18h, 16 workers, 15k objects $\leq$ 100KiB, GET 95% / PUT 0.8% / STAT 4% / DEL 0.4%
1773251399	— ibid —
1773343560	— ibid —
1773343565	— ibid —
1773343568	— ibid —
1773521107	— ibid —

Appendix

Table 7 : Nominal workload experiments (83 runs, no injected anomalies).

ID	Details	Notes
Single Disk Failures
1773343796	s1/g2disk01, onset 3h30m, dur 1h30m
1773343802	s3/g2disk02, onset 6h, dur 35m
1773343833	s3/g1disk02, onset 7h15m, dur 2h30m
1773343804	s1/g2disk01, onset 10h, dur 10m
1773343837	s1/g2disk02, onset 8h45m, dur 3h15m

Appendix

Table 8 : Disk failure experiments (38 runs).

ID	Details	Notes
Single Server Failures
1773946658	store 1, onset 6h, dur 9h45m	unplanned crash
1774026192	store 1, onset 6h, dur 20m	rerun of 1773946658
1774026217	store 2, onset 10h, dur 15m
1774132105	store 3, onset 3h, dur 5m
1774132113	store 2, onset 14h, dur 1m

Appendix

Table 9 : Server failure experiments (48 runs).

ID	Details	Notes
Single-Server Software Node Failures
1774656169	1 snode on s1, onset 6h, dur 1h	server metric loss
1774656174	1 snode on s2, onset 9h, dur 1h30m	server metric loss
1774656180	2 snodes on s1, onset 5h, dur 45m	server metric loss
1774656183	2 snodes on s3, onset 8h, dur 1h	server metric loss
1774764369	3 snodes on s2, onset 2h, dur 30m	server metric loss

Appendix

Table 10 : Storage node failure experiments (46 runs).

Panel of Figure 12 — Figure 12 : Experiment cluster topology. The metric hierarchy on the right shows all four telemetry levels and their dimension counts, totaling 171 features.

Type ( Subtype )	Onset	Duration	Parameters
Nominal	–	18 h	normal behaviour
Single disk	3.5–14.5 h	10–240 min	3 servers, 4 disk types
Simult. disk	3–15.5 h	30–215 min	2-4 disks, 1-3 servers
Async. disk ( C/R/I )	1.5–15 h	30–180 min	2-4 events per exp.
Single server	0.5–16 h	1–25 min $*$	3 servers
Async. server	1–16 h	3–30 min $*$	2-3 events, same-server

Appendix

Table 11 : Anomaly parameters coverage in SHAD. C/R/I denotes cascading , rolling , and independent subtypes, respectively.

Name	Legend	Supervision	Category	Description
AutoEncoder [ 73 ]	AE	S	Prediction-based	Projects data to the lower-dimensional latent space and then reconstruct it through the encoding-decoding phase, where anomalies are typically characterized by evident reconstruction deviations.
OmniAnomaly [ 79 ]	OA	S	Prediction-based	Stochastic recurrent neural network, which captures the normal patterns of time series by learning their robust representations with key techniques such as stochastic variable connection and planar normalizing flow, reconstructs input data by the representations, and use the reconstruction probabilities to determine anomalies.
USAD [ 5 ]	USAD	S	Prediction-based	based on adversely trained autoencoders, and the anomaly score is the combination of discriminator and reconstruction loss.
CNN [ 60 ]	CNN	S	Prediction-based	Employs Convolutional Neural Network (CNN) to predict the next time stamp on the defined horizon and then compare the difference with the original value.
LSTM [ 56 ]	LSTM	S	Prediction-based	Utilizes Long Short-Term Memory (LSTM) networks to model the relationship between current and preceding time series data, detecting anomalies through discrepancies between predicted and actual values.
OCSVM [ 75 ]	SVM	S	Density-based	Fits the dataset to find the normal data’s boundary by maximizing the margin between the origin and the normal samples.

Appendix

Table 12 : List of anomaly detectors used in the experiments. Legend refers to the name used for detectors in Figure 7 .

Figure 13 : Prompt template overview

Figure 14 : Average Inference and Training Time on a Time Series for Each Method

Anomaly Type	Avg. Anomalous Dim.	CNN	KmeansAD	OmniAnomaly	Rand.
Single Disk	4	0.00	0.00	0.00	0.02
Single Server	47	0.27	0.16	0.17	0.26
Single Node	47	0.24	0.18	0.29	0.26
Simultaneous Disk	12	0.05	0.11	0.00	0.08
Simultaneous Node	100.7	0.57	0.46	0.60	0.57
Asynchronous Disk	11.27	0.02	0.07	0.00	0.05

Appendix

Table 13 : Explainability results of top performing detectors and a random baseline for each anomaly type. The table also reports the average number of dimension affected by each anomaly type.

Task	Model	Performance
Anomaly Criticality	Claude	0.196400
Anomaly Criticality	Gemini	0.158063
Anomaly Criticality	Llama	0.149613
Anomaly Criticality	Mistral	0.147306
Anomaly Criticality	Grok	0.134204
Dimension Localization	Grok	0.047685

Appendix

Table 14 : Model ranking by task. The performance is averaged across the three different representations (i.e., Catch 22, Images, and Descriptions).

Supervision	Task	Mean Gain
Level 1	Anomaly Criticality	0.0128
Level 2	Anomaly Criticality	-0.0078
Level 1	Dimension Localization	0.0719
Level 2	Dimension Localization	N.A. (trivial)
Level 1	Anomaly Presence	N.A. (trivial)
Level 2	Anomaly Presence	N.A. (trivial)

Appendix

Table 15 : Mean gain by supervision level and task.

Explore similar work

Oct 1, 2026cs.LG

Have an LLM Write Your Anomaly Detector: Autonomous Discovery of Compact, Interpretable Detectors for Time Series

Time-series anomaly detection trades off predictive accuracy, computational efficiency, and interpretability. We use a large language model not as the detector but as the author of one: an autonomous research loop in which the model repeatedly edits a single short NumPy program under a leakage-free objective, keeping the best-scoring detector it finds. The loop discovers two compact detectors, one for univariate and one for multivariate series, that describe short windows by their local spectral features and compare them with the training-region distribution through a covariance-aware distance. On the TSB-AD benchmark these detectors lead the field across metrics, ahead of the strongest classical, deep, and foundation-model baselines including Time-RCD, yet they train no network and use no GPU, and the multivariate detector is faster than every similarly performing baseline. LLM-driven program search is thus a practical route to accurate, efficient, and transparent detectors.

David Berghaus

Lamarr Institute Germany · Fraunhofer IAIS Germany

Time-Series Anomaly Detection Unsupervised Detection

Ask PDF

Apr 19, 2026cs.LG

Conditional Attribution for Root Cause Analysis in Time-Series Anomaly Detection

Root cause analysis (RCA) for time-series anomaly detection is critical for the reliable operation of complex real-world systems. Existing explanation methods often rely on unrealistic feature perturbations and ignore temporal and cross-feature dependencies, leading to unreliable attributions. We propose a conditional attribution framework that explains anomalies relative to contextually similar normal system states. Instead of using marginal or randomly sampled baselines, our method retrieves representative normal instances conditioned on the anomalous observation, enabling dependency-preserving and operationally meaningful explanations. To support high-dimensional time-series data, contextual retrieval is performed in learned low-dimensional representations using both variational autoencoder latent spaces and UMAP manifold embeddings. By grounding the retrieval process in the system's learned manifold, this strategy avoids out-of-distribution artifacts and ensures attribution fidelity while maintaining computational efficiency. We further introduce confidence-aware and temporal evaluation metrics for assessing explanation reliability and responsiveness. Experiments on the SWaT and MSDS benchmarks demonstrate that the proposed approach consistently improves root-cause identification accuracy, temporal localization, and robustness across multiple anomaly detection models. These results highlight the practical utility of conditional attribution for explainable anomaly diagnosis in complex time-series systems. Code and models are available at: https://github.com/dfki-av/Conditional-Attribution-for-Root-Cause-Analysis-in-Time-Series-Anomaly-Detection.

Shashank Mishra, Karan Patil, Cedric Schockaert +2

German Research Center for Artificial Intelligence (DFKI), Kaiserslautern, Germany · Rheinland-Pfälzische Technische Universität Kaiserslautern-Landau, Germany · Paul Wurth S.A, Luxembourg

Time-Series Anomaly Detection Interpretable Anomaly Detection Root Cause Analysis Time Series

Ask PDF

Jun 11, 2026stat.ML

ProtoX-AD: Self-Explainable Time Series Anomaly Detection and Characterization

Recent advances in time series anomaly detection (TSAD) have highlighted the effectiveness of self-supervised classification-based approaches. These methods apply transformations to normal training samples, training a classifier to recognize transformation-specific patterns that help identify anomalies through increased classification errors. Despite their strong performance, a significant challenge is their lack of explainability, as they provide limited insight into the characteristics of flagged anomalies. To address this limitation, we propose ProtoX-AD, a prototype-based self-explainable framework for self-supervised TSAD. ProtoX-AD learns transformation-aware latent representations alongside interpretable prototypes, enabling both accurate anomaly detection and the identification of distinct anomalous profiles through prototype-based explanations. Additionally, it allows for systematic analysis of how transformation design impacts detection performance and explainability. Experimental results on synthetic and real-world datasets demonstrate that ProtoX-AD achieves detection performance comparable to its black-box counterparts while offering more consistent and semantically meaningful explanations than existing explainable baselines. Our code is publicly available at https://github.com/Aitorzan3/ProtoX-AD.

Aitor Sánchez-Ferrera, Elisabeth Wetzer, Kristoffer Wickstrøm +2

aDepartment of Computer Science and Artificial Intelligence, University of the Basque Country UPV/EHU, Donostia, Spain · bDepartment of Physics and Technology, UiT The Arctic University of Norway, Tromsø, Norway

Time-Series Anomaly Detection Transform Concepts

Ask PDF