Detect, Explain, Interpret: An End-to-End Benchmark for Time Series Anomaly Detection, Explainability and Interpretability

Roberto Stanzione; Jules Barbe; Magali Parrino; Jérémie Fourmann; Paul Boniol

cs.LGOct 1, 2026

Detect, Explain, Interpret: An End-to-End Benchmark for Time Series Anomaly Detection, Explainability and Interpretability

Authors: Roberto Stanzione, Jules Barbe, Magali Parrino, Jérémie Fourmann, Paul Boniol

Organizations: Inria, ENS, CNRS, PSL Paris, France · Scality Paris, France · Inria, ENS, CNRS, PSL, EDF Paris, France

Abstract

Time Series Anomaly Detection has received increasing attention, driven by the growing availability of complex time series data. This surge has led to the development of numerous detection methods, as well as a variety of benchmarks aimed at thoroughly evaluating their performance. However, most existing detectors remain largely agnostic to domain context, overlooking explainability and interpretability. One of the main reasons for this gap is that current benchmarks primarily focus on detection accuracy, and only few of them evaluate spatial explainability. Moreover, no benchmark currently provides sufficiently rich semantic annotations to support the generation of human-understandable interpretations of anomalies. To address these limitations, we introduce SHAD (Scality High-dimensional Anomaly Detection benchmark), a fully annotated benchmark composed of 215 multivariate, high-dimensional time series collected from real-world distributed cloud storage systems operated by Scality. The proposed dataset includes rich contextual information, covering three families of anomalies with varying degrees of severity. As further contribution, we provide a foundation for future work by evaluating baseline methods for Detection, Explainability, and Interpretability, covering all stages of a TSAD pipeline. For Detection, we benchmark a wide range of existing anomaly detectors, testing their effectiveness on the proposed real-world dataset. Then, we consider explainability by evaluating whether measuring the contribution of each dimension in the generated anomaly score can provide accurate anomaly attributions. Finally, for interpretability, we investigate the effectiveness of frozen LLM baselines in localizing and interpreting anomalies.

Figures & tables

Figure 1 : Example of SHAD’s contextual knowledge (Asynchronous Storage Node Failure).

Figure 2 : Time series anomaly (a) Detection , (b) Explanation , and (c) Interpretation .

Benchmark	Dataset			Evaluation
Benchmark	Multi.	Ann.	Desc.	AD	Expl.	Interp.
NAB [ 48 ]	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{0.0664,0.7266,0.0664}\checkmark}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{1,0,0}\times}$
Exathlon [ 36 ]	${\color[rgb]{0.0664,0.7266,0.0664}\checkmark}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{0.0664,0.7266,0.0664}\checkmark}$	${\color[rgb]{0.0664,0.7266,0.0664}\checkmark}$	${\color[rgb]{1,0,0}\times}$
TODS [ 44 ]	${\color[rgb]{0.0664,0.7266,0.0664}\checkmark}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{0.0664,0.7266,0.0664}\checkmark}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{1,0,0}\times}$
TimeEval [ 74 ]	${\color[rgb]{0.0664,0.7266,0.0664}\checkmark}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{0.0664,0.7266,0.0664}\checkmark}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{1,0,0}\times}$
TSB-UAD [ 66 ]	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{0.0664,0.7266,0.0664}\checkmark}$	${\color[rgb]{1,0,0}\times}$	${\color[rgb]{1,0,0}\times}$

Table 1 : Comparison of TSAD benchmarks

Figure 3 : Overview of our proposed benchmark SHAD .

Figure 4 : Sample of time series for each of the

3

main anomaly types in SHAD .

Figure 5 : SHAD’s annotations

Figure 6 : Overview of the evaluation for interpretability.

Figure 9 : Results for the interpretability experiment. For Presence , Type , and Criticality we consider the F1-score , while for Dimension and Time Localization we report the accuracy .

Figure 10 : Interpretability results with the same model family (Mistral large/medium/small).

Appendix figures & tables18 assets

Supplementary material from the paper’s appendix.

Appendix

Name	Category	Dimension	Avg Dim	# of time series	Avg Length	Domain
UCR [ 94 ]	P&S	I	1	250	67818.7	Multiple
Yahoo [ 47 ]	P&S	I	1	367	1560.2	Web Service
IOPS [ 35 ]	S	I	1	58	72792.3	IT/Web Services
MGAB [ 84 ]	S	I	1	10	97777.8	Synthetic
WSD [ 106 ]	S	I	1	210	17444.5	IT/Web Services
SED [ 14 ]	S	I	1	6	23332.3	Sensor

Appendix

Table 2 : Summary characteristics of 30 datasets

Metric	Unit	Description
cpu_usage_ratio	ratio [0,1]	Fraction of CPU time not idle, averaged across all servers.
cpu_load_ratio	ratio [ $\geq$ 0]	CPU load average normalized by CPU count across all servers. Can exceed 1.0 when the run queue exceeds CPU count.
memory_usage_ratio	ratio [0,1]	Fraction of total used memory, averaged across all servers.
network_in_bytes	bytes/s	Total incoming network throughput across all interfaces on all servers.
network_out_bytes	bytes/s	Total outgoing network throughput across all interfaces on all servers.
objects_count	count	Number of objects stored on the RING, including replicas.

Appendix

Table 3 : Platform-level metrics (17 dimensions, cluster-wide aggregates).

Metric	Unit	Description
s3_errors_5xx	errors/s	Rate of HTTP 5xx server errors across all S3 services.
s3_request_get_operations	ops/s	GET request rate.
s3_request_post_operations	ops/s	POST request rate. Near-constant (no multipart uploads in the nominal workload).
s3_request_put_operations	ops/s	PUT request rate.
s3_request_delete_operations	ops/s	DELETE request rate.
s3_request_head_operations	ops/s	HEAD (metadata lookup) request rate.

Appendix

Table 4 : S3-level metrics (13 dimensions, aggregated across storage servers).

Metric	Unit	Description
cpu_usage_ratio	ratio [0,1]	Fraction of CPU time not idle for this server.
cpu_load_ratio	ratio [ $\geq$ 0]	CPU load average normalized by CPU count. Can exceed 1.0.
memory_usage_ratio	ratio [0,1]	Fraction of total used memory.
network_in_bytes	bytes/s	All incoming network throughput (S3, RING inter-node, monitoring).
network_out_bytes	bytes/s	All outgoing network throughput.
operations_sent	ops/s	Rate of internal RING operations sent to other servers.

Appendix

Table 5 : Server-level metrics (19 unique metrics

\times

3 servers = 57 dimensions). Column names follow the pattern store{1,2,3}-{metric} .

Metric	Unit	Description
disk_read_bytes	bytes/s	Disk read throughput.
disk_write_bytes	bytes/s	Disk write throughput.
disk_io_time_seconds	s/s [0,1]	Fraction of time spent on I/O. Approaching 1.0 implies saturation.
disk_usage_ratio	ratio [0,1]	Disk space utilization.

Appendix

Table 6 : Device-level metrics (4 metrics

\times

7 devices

\times

3 servers = 84 dimensions). Column names follow store{1,2,3}-{device}-{metric} . Each server has 4 NVMe data disks ( g1disk01 , g1disk02 , g2disk01 , g2disk02 ), 2 metadata SSDs ( ssd01 , ssd02 ), and 1 OS root disk ( root ). Data disks are the targets of disk failure anomalies.

Figure 11 : Full 171 dimensions of an asynchronous, cascading disk failure experiment. Red vertical lines denote the full anomalous event, from the first disk failure onset to the last completed fix.

ID	Details	Notes
1773251393	18h, 16 workers, 15k objects $\leq$ 100KiB, GET 95% / PUT 0.8% / STAT 4% / DEL 0.4%
1773251399	— ibid —
1773343560	— ibid —
1773343565	— ibid —
1773343568	— ibid —
1773521107	— ibid —

Appendix

Table 7 : Nominal workload experiments (83 runs, no injected anomalies).

ID	Details	Notes
Single Disk Failures
1773343796	s1/g2disk01, onset 3h30m, dur 1h30m
1773343802	s3/g2disk02, onset 6h, dur 35m
1773343833	s3/g1disk02, onset 7h15m, dur 2h30m
1773343804	s1/g2disk01, onset 10h, dur 10m
1773343837	s1/g2disk02, onset 8h45m, dur 3h15m

Appendix

Table 8 : Disk failure experiments (38 runs).

ID	Details	Notes
Single Server Failures
1773946658	store 1, onset 6h, dur 9h45m	unplanned crash
1774026192	store 1, onset 6h, dur 20m	rerun of 1773946658
1774026217	store 2, onset 10h, dur 15m
1774132105	store 3, onset 3h, dur 5m
1774132113	store 2, onset 14h, dur 1m

Appendix

Table 9 : Server failure experiments (48 runs).

ID	Details	Notes
Single-Server Software Node Failures
1774656169	1 snode on s1, onset 6h, dur 1h	server metric loss
1774656174	1 snode on s2, onset 9h, dur 1h30m	server metric loss
1774656180	2 snodes on s1, onset 5h, dur 45m	server metric loss
1774656183	2 snodes on s3, onset 8h, dur 1h	server metric loss
1774764369	3 snodes on s2, onset 2h, dur 30m	server metric loss

Appendix

Table 10 : Storage node failure experiments (46 runs).

Panel of Figure 12 — Figure 12 : Experiment cluster topology. The metric hierarchy on the right shows all four telemetry levels and their dimension counts, totaling 171 features.

Type ( Subtype )	Onset	Duration	Parameters
Nominal	–	18 h	normal behaviour
Single disk	3.5–14.5 h	10–240 min	3 servers, 4 disk types
Simult. disk	3–15.5 h	30–215 min	2-4 disks, 1-3 servers
Async. disk ( C/R/I )	1.5–15 h	30–180 min	2-4 events per exp.
Single server	0.5–16 h	1–25 min $*$	3 servers
Async. server	1–16 h	3–30 min $*$	2-3 events, same-server

Appendix

Table 11 : Anomaly parameters coverage in SHAD. C/R/I denotes cascading , rolling , and independent subtypes, respectively.

Name	Legend	Supervision	Category	Description
AutoEncoder [ 73 ]	AE	S	Prediction-based	Projects data to the lower-dimensional latent space and then reconstruct it through the encoding-decoding phase, where anomalies are typically characterized by evident reconstruction deviations.
OmniAnomaly [ 79 ]	OA	S	Prediction-based	Stochastic recurrent neural network, which captures the normal patterns of time series by learning their robust representations with key techniques such as stochastic variable connection and planar normalizing flow, reconstructs input data by the representations, and use the reconstruction probabilities to determine anomalies.
USAD [ 5 ]	USAD	S	Prediction-based	based on adversely trained autoencoders, and the anomaly score is the combination of discriminator and reconstruction loss.
CNN [ 60 ]	CNN	S	Prediction-based	Employs Convolutional Neural Network (CNN) to predict the next time stamp on the defined horizon and then compare the difference with the original value.
LSTM [ 56 ]	LSTM	S	Prediction-based	Utilizes Long Short-Term Memory (LSTM) networks to model the relationship between current and preceding time series data, detecting anomalies through discrepancies between predicted and actual values.
OCSVM [ 75 ]	SVM	S	Density-based	Fits the dataset to find the normal data’s boundary by maximizing the margin between the origin and the normal samples.

Appendix

Table 12 : List of anomaly detectors used in the experiments. Legend refers to the name used for detectors in Figure 7 .

Figure 13 : Prompt template overview

Figure 14 : Average Inference and Training Time on a Time Series for Each Method

Anomaly Type	Avg. Anomalous Dim.	CNN	KmeansAD	OmniAnomaly	Rand.
Single Disk	4	0.00	0.00	0.00	0.02
Single Server	47	0.27	0.16	0.17	0.26
Single Node	47	0.24	0.18	0.29	0.26
Simultaneous Disk	12	0.05	0.11	0.00	0.08
Simultaneous Node	100.7	0.57	0.46	0.60	0.57
Asynchronous Disk	11.27	0.02	0.07	0.00	0.05

Appendix

Table 13 : Explainability results of top performing detectors and a random baseline for each anomaly type. The table also reports the average number of dimension affected by each anomaly type.

Task	Model	Performance
Anomaly Criticality	Claude	0.196400
Anomaly Criticality	Gemini	0.158063
Anomaly Criticality	Llama	0.149613
Anomaly Criticality	Mistral	0.147306
Anomaly Criticality	Grok	0.134204
Dimension Localization	Grok	0.047685

Appendix

Table 14 : Model ranking by task. The performance is averaged across the three different representations (i.e., Catch 22, Images, and Descriptions).

Supervision	Task	Mean Gain
Level 1	Anomaly Criticality	0.0128
Level 2	Anomaly Criticality	-0.0078
Level 1	Dimension Localization	0.0719
Level 2	Dimension Localization	N.A. (trivial)
Level 1	Anomaly Presence	N.A. (trivial)
Level 2	Anomaly Presence	N.A. (trivial)

Appendix

Table 15 : Mean gain by supervision level and task.

Explore similar work

Have an LLM Write Your Anomaly Detector: Autonomous Discovery of Compact, Interpretable Detectors for Time Series
Oct 1, 2026David BerghausTime-Series Anomaly Detection Unsupervised Detection
Lamarr Institute Germany · Fraunhofer IAIS Germany
Conditional Attribution for Root Cause Analysis in Time-Series Anomaly Detection
Apr 19, 2026Shashank Mishra, Karan Patil, Cedric Schockaert +2Time-Series Anomaly Detection Interpretable Anomaly Detection
German Research Center for Artificial Intelligence (DFKI), Kaiserslautern, Germany · Rheinland-Pfälzische Technische Universität Kaiserslautern-Landau, Germany · Paul Wurth S.A, Luxembourg
ProtoX-AD: Self-Explainable Time Series Anomaly Detection and Characterization
Jun 11, 2026Aitor Sánchez-Ferrera, Elisabeth Wetzer, Kristoffer Wickstrøm +2Time-Series Anomaly Detection Transform Concepts
aDepartment of Computer Science and Artificial Intelligence, University of the Basque Country UPV/EHU, Donostia, Spain · bDepartment of Physics and Technology, UiT The Arctic University of Norway, Tromsø, Norway

Oct 1, 2026, cs.LGJ/K move · Enter open · S save

Have an LLM Write Your Anomaly Detector: Autonomous Discovery of Compact, Interpretable Detectors for Time Series

David Berghaus

Lamarr Institute Germany · Fraunhofer IAIS Germany

Time-Series Anomaly Detection Unsupervised Detection

Open paper AskPDF arXiv

Time-series anomaly detection trades off predictive accuracy, computational efficiency, and interpretability. We use a large language model not as the detector but as the author of one: an autonomous research loop in which the model repeatedly edits a single short NumPy program under a leakage-free objective, keeping the best-scoring detector it finds. The loop discovers two compact detectors, one for univariate and one for multivariate series, that describe short windows by their local spectral features and compare them with the training-region distribution through a covariance-aware distance. On the TSB-AD benchmark these detectors lead the field across metrics, ahead of the strongest classical, deep, and foundation-model baselines including Time-RCD, yet they train no network and use no GPU, and the multivariate detector is faster than every similarly performing baseline. LLM-driven program search is thus a practical route to accurate, efficient, and transparent detectors.

Abstract

Explore similar work

Have an LLM Write Your Anomaly Detector: Autonomous Discovery of Compact, Interpretable Detectors for Time Series

Conditional Attribution for Root Cause Analysis in Time-Series Anomaly Detection

ProtoX-AD: Self-Explainable Time Series Anomaly Detection and Characterization