OneShot: Label-Efficient Detector Weighting for Time Series Anomaly Detection

Seunghan Lee; Jun Seo; Jaehoon Lee; Junhyeok Kang; Sangjun Han; Sungdong Yoo; Minjae Kim; Tae Yoon Lim

cs.AIOct 12, 2026

OneShot: Label-Efficient Detector Weighting for Time Series Anomaly Detection

Authors: Seunghan Lee, Jun Seo, Jaehoon Lee, Junhyeok Kang, Sangjun Han, Sungdong Yoo, Minjae Kim, Tae Yoon Lim, +4 more

Organizations: LG AI Research

Abstract

Time series (TS) anomaly detection (AD) lacks a universal detector, with the best choice determined by the series rather than by the algorithm. Existing methods therefore either select one detector for each series or average a pool of them. However, both assume that no label ever arrives, while a deployed monitor does receive them, since an operator confirms the alarms it raises. In this paper, we propose ONESHOT, which uses a single confirmed anomaly to weight the pool rather than to choose one detector from it. Specifically, we score each detector on the confirmed anomaly, and those scores become the weights of a soft mixture over the whole pool. We show that a single confirmed anomaly is enough to come close to the best detector for the series. Across 152 univariate and 73 multivariate series, ONESHOT outperforms the strongest single detector, averaging the whole pool, and even picking the best detector on the confirmed event. Code is available at: https://github.com/seunghan96/one_shot.

Figures & tables

Figure 1: No universal detector. How often each detector wins.

Figure 2: Prior works vs. OneShot . Only OneShot weights every detector by how well it did on the confirmed event.

Single detector (w/o labels)
Family	What it needs			What it returns
Family	Frozen	No corpus	Label	Mixture	Threshold
One fixed detector ( Liu & Paparrizos, 2024 )	✓	✓	✗	✗	✗
Internal measures ( Ma et al., 2023 )	✓	✓	✗	✗	✗
Local selection ( Zhao et al., 2019 )	✓	✓	✗	✗	✗
Meta-learned selection ( Zhao et al., 2021 )	✓	✗	✗	✗	✗

Table 1: Comparison of AD detector families. Frozen means no training loop, No corpus no pool of past evaluations, and Label ground truth from the monitored series. Mixture means every detector keeps a share of the weight, and Threshold that the row also says where to raise the alarm.

Figure 3: Notation for the four sets.

Figure 4: Overall framework of OneShot . Each detector is scored on the confirmed event alone, while red events stay hidden, and a softmax over those accuracies gives the weight $w_{i}$ that the mix follows. The boxes list what the pipeline never does, and $k$ - Shot runs it unchanged on more events.

Method	Wins	AUC-PR	AUC-ROC	VUS-PR	VUS-ROC	$\rho$
Sub_KNN ( Ramaswamy et al., 2000 )	17.1	0.521	0.854	0.623	0.875	60.5%
PCA ( Shyu et al., 2003 )	23.7	0.494	0.786	0.537	0.815	38.9%
Sub_PCA ( Shyu et al., 2003 )	8.6	0.504	0.786	0.531	0.819	37.2%
IForest ( Liu et al., 2008 )	9.2	0.468	0.785	0.501	0.829	29.8%
Sub_IForest ( Liu et al., 2008 )	0.0	0.460	0.787	0.491	0.833	27.1%
POLY ( Liu & Paparrizos, 2024 )	5.3	0.406	0.762	0.482	0.797	24.8%

Table 2: Comparison with single detector. Each of the first rows fixes one detector for every series, which is what a practitioner does without a way to choose. Wins is how often a row scores best and

\rho

is the share of the oracle gap it closes, both read under VUS-PR. OneShot outperforms every single detector under all four measures, even the best detector on the confirmed window.

Figure 5: Sensitivity to

\tau

Figure 6: Effect of detector count

Table 9

Table 10

		Event
Label	Confirmed window	covered
Exact	$[s,\;e)$	100%
Half of it	$[s,\;s+L/2)$	50%
Quarter of it	$[s,\;s+L/4)$	25%
Shifted by half	$[s\pm L/2,\;e\pm L/2)$	50%
Shifted by its length	$[s\pm L,\;e\pm L)$	0%

Table 8: Types of imperfect labels. The event spans

[s,e)

and

L=e-s

is its length.

Confirmed event	VUS-PR			Retention ∗			$p$
Confirmed event	Best on window	OneShot	Imp (%)	Best on window	OneShot	Imp (%)	$p$
Exact	0.568	0.699	+23.0	100%	100%	+0.0	$<$ 0.001
Half of it	0.519	0.692	+33.3	91%	99%	+8.4	$<$ 0.001
Quarter of it	0.476	0.672	+41.0	84%	96%	+14.7	$<$ 0.001
Shifted by half	0.543	0.668	+22.9	96%	96%	+0.0	$<$ 0.001
Shifted by its length	0.419	0.554	+32.1	74%	79%	+7.5	$<$ 0.001

Table 9: Robustness to imperfect labels: Performance under each corruption. Each row corrupts the confirmed event in the way Table 8 gives. Retention ∗ divides a row by the exact-label row of the same column, which reads how much a rule keeps as the label degrades.

Table 14

Figure 9: Rank of the window winner.

Appendix figures & tables26 assets

Supplementary material from the paper’s appendix.

Appendix

Chosen on the other series
Choice of $\tau$	Values picked	VUS-PR	$\rho$
2-fold	0.01, 0.035	0.701	80.5%
5-fold	0.01, 0.02, 0.035	0.702	80.6%
10-fold	0.01, 0.02	0.707	81.9%
Leave-one-out (Ours)	0.02	0.710	82.8%
Fixed in advance

Appendix

Table 12: How the temperature is chosen. Every row reads the same runs and differs only in how much of the rest is used to choose

\tau

. No series ever takes part in the choice that scores it.

Block	Pool	Detectors added
Statistical	18	CBLOF ( He et al., 2003 ) , COPOD ( Li et al., 2020 ) , EIF ( Hariri et al., 2021 ) , FFT ( Liu & Paparrizos, 2024 ) , HBOS ( Goldstein & Dengel, 2012 ) , IForest ( Liu et al., 2008 ) , KMeansAD_U ( Liu & Paparrizos, 2024 ) , KNN ( Ramaswamy et al., 2000 ) , LOF ( Breunig et al., 2000 ) , MatrixProfile ( Yeh et al., 2016 ) , PCA ( Shyu et al., 2003 ) , POLY ( Liu & Paparrizos, 2024 ) , SR ( Ren et al., 2019 ) , Sub_HBOS ( Liu & Paparrizos, 2024 ) , Sub_IForest ( Liu & Paparrizos, 2024 ) , Sub_KNN ( Liu & Paparrizos, 2024 ) , Sub_LOF ( Liu & Paparrizos, 2024 ) , Sub_PCA ( Liu & Paparrizos, 2024 )
Deep and foundation (DL)	29	AnomalyTransformer ( Xu et al., 2022 ) , CNN ( Liu & Paparrizos, 2024 ) , FITS ( Xu et al., 2024 ) , LSTMAD ( Malhotra et al., 2015 ) , MOMENT_ZS ( Goswami et al., 2024 ) , OFA ( Zhou et al., 2023 ) , OmniAnomaly ( Su et al., 2019 ) , PatchTST ( Nie et al., 2023 ) , TimesNet ( Wu et al., 2023 ) , TranAD ( Tuli et al., 2022 ) , USAD ( Audibert et al., 2020 )
Window lengths	77	HSF ( Liu & Paparrizos, 2024 ) (9 window lengths), HSF_Causal ( Liu & Paparrizos, 2024 ) (9 window lengths), HSF_U ( Liu & Paparrizos, 2024 ) (9 window lengths), PaAno_PAI ( Liu & Paparrizos, 2024 ) (9 window lengths), Left_STAMPi ( Liu & Paparrizos, 2024 ) , M2N2 ( Liu & Paparrizos, 2024 ) , MCD ( Rousseeuw & Driessen, 1999 ) , MMPAD ( Liu & Paparrizos, 2024 ) , RobustPCA ( Candès et al., 2011 ) , StreamVAE ( Liu & Paparrizos, 2024 ) , Sub_MCD ( Liu & Paparrizos, 2024 ) , Time_RCD ( Liu & Paparrizos, 2024 )

Appendix

Table 13: Univariate AD methods.

Block	Pool	Detectors added
Statistical	11	CBLOF ( He et al., 2003 ) , COPOD ( Li et al., 2020 ) , EIF ( Hariri et al., 2021 ) , HBOS ( Goldstein & Dengel, 2012 ) , IForest ( Liu et al., 2008 ) , KMeansAD ( Liu & Paparrizos, 2024 ) , KNN ( Ramaswamy et al., 2000 ) , LOF ( Breunig et al., 2000 ) , OCSVM ( Schölkopf et al., 2001 ) , PCA ( Shyu et al., 2003 ) , RobustPCA ( Candès et al., 2011 )
Deep and foundation (DL)	22	AnomalyTransformer ( Xu et al., 2022 ) , CNN ( Liu & Paparrizos, 2024 ) , FITS ( Xu et al., 2024 ) , LSTMAD ( Malhotra et al., 2015 ) , MOMENT_ZS ( Goswami et al., 2024 ) , OFA ( Zhou et al., 2023 ) , OmniAnomaly ( Su et al., 2019 ) , PatchTST ( Nie et al., 2023 ) , TimesNet ( Wu et al., 2023 ) , TranAD ( Tuli et al., 2022 ) , USAD ( Audibert et al., 2020 )
Window lengths	31	PaAno_PAI ( Liu & Paparrizos, 2024 ) (3 window lengths), Left_STAMPi ( Liu & Paparrizos, 2024 ) , M2N2 ( Liu & Paparrizos, 2024 ) , MCD ( Rousseeuw & Driessen, 1999 ) , MMPAD ( Liu & Paparrizos, 2024 ) , StreamVAE ( Liu & Paparrizos, 2024 )

Appendix

Table 14: Multivariate AD methods.

Table 19

			Rank
Detector	Wins (%)	Mean VUS-PR	Median	Best	Worst
PCA	23.7	0.537	4	1	13
Sub_KNN	17.1	0.623	3	1	12
Sub_LOF	13.2	0.352	8	1	13
IForest	9.2	0.501	6	1	13
Sub_PCA	8.6	0.531	5	1	13

Appendix

Table 17: Results by detector. Every detector of the first pool on the 152 series the main tables read. Wins is how often it reaches the best VUS-PR, and the rank columns say where it lands otherwise.

Figure 10: Win rate against each row, under each measure. Each cell is the share of the 152 series where OneShot beats that row under that measure. Every cell is above 50% , i.e., OneShot wins the series-by-series comparison against every rule under every measure.

No labels
Method	Median $\Delta$	Series won	$p$
Random detector	+0.334	95.4%	$<$ 0.001
Score average	+0.076	84.9%	$<$ 0.001
Rank average	+0.258	91.4%	$<$ 0.001
One confirmed event
Best on labeled window	+0.009	53.9%	$<$ 0.001

Appendix

Table 18: Signed-rank tests against OneShot . Each row is the paired difference OneShot minus that row over the 152 series, under VUS-PR.

Figure 11: The number of detectors that carry weight varies from series to series. The histogram counts series by

N_{\text{eff}}

of Equation 10 , and the dashed lines mark a single detector and the whole pool.

Figure 12: Effective detector count by temperature.

N_{\text{eff}}

on the same series at three temperatures.

Confirmed events	Series	Median $N_{\text{eff}}$
1	153	6.1
2	117	6.5
3	72	6.3
4	63	6.4
5	51	6.9
6	48	7.0

Appendix

Table 19: The effective count as the budget grows. Each row reads the series that carry more events than it reveals, with

N_{\text{eff}}

the perplexity of Equation 10 at the temperature of Appendix A.2 .

Rule	Series it is best on	Mean VUS-PR
Top-2 average	36.2%	0.702
Top-3 average	21.7%	0.704
Top-5 average	23.7%	0.703
Top-10 average	18.4%	0.649
OneShot	–	0.710
$K$ chosen for each series	–	0.747

Appendix

Table 20: Which fixed

K

is best, series by series. The middle column counts the series where that rule reaches the highest VUS-PR, and the last row chooses

K

on the hidden part, which no deployment can do and which therefore bounds the top-

K

family rather than joining it.

Source	Threshold rule	F1	Event recall
Practice	Top 1% of points	0.243	0.598
	Top 5% of points	0.385	0.763
	Estimated contamination	0.140	0.961
One confirmed event	Highest recall at a precision floor	0.450	0.794
One confirmed event	Highest F1 on the window	0.454	0.790
Oracle	Highest F1 on the hidden part	0.546	0.830

Appendix

Table 21: Choice of the alarm threshold. Every row thresholds the same combined score.

Pool	Series	Detectors	Score average	Best on window	OneShot
Statistical	73	9	0.272	0.368	0.382
+ DL	73	19	0.453	0.489	0.503
+ Window lengths	73	28	0.482	0.511	0.539

Appendix

Table 22: Pool size on multivariate series. The same comparison as Table 5 , with the pool grown beyond the detectors the benchmark runs by default.

Confirmed event	Best	OneShot	Imp (%)
Exact	0.433	0.459	+5.9
Half of it	0.417	0.449	+7.5
Quarter of it	0.392	0.437	+11.6
Shifted by half	0.395	0.420	+6.3
Shifted by its length	0.317	0.345	+9.0
Normal window	0.296	0.326	+10.2

Appendix

Table 23: Imperfect labels on multivariate series. The same corruptions as Table 9 , measured on the multivariate collection.

Threshold	F1	Events caught
Top 1% of points	0.194	59.1%
Top 5% of points	0.324	77.9%
From the confirmed window	0.360	87.3%
Best on the hidden part	0.448	88.5%

Appendix

Table 24: Alarm threshold on multivariate series. The same comparison as Table 21 , measured on the multivariate collection.

Agreement on the window	Series	Best on window	OneShot
Below the median	36	0.225	0.261
Above the median	37	0.507	0.510

Appendix

Table 25: Rank agreement and gain on multivariate series. Series are split by how well the ranking on the confirmed window agrees with the ranking on the hidden part, as in Table 11 .

No labels
Method	AUC-PR	AUC-ROC	VUS-PR	VUS-ROC	$\rho$	$p$
Random detector	0.211	0.680	0.211	0.712	0.0%	$<$ 0.001
Score average	0.262	0.783	0.272	0.812	25.0%	$<$ 0.001
Rank average	0.217	0.749	0.220	0.779	3.6%	$<$ 0.001
One confirmed event
Best on labeled window	0.356	0.804	0.368	0.832	64.7%	0.209

Appendix

Table 26: Multivariate series under four ranking measures. The same reading as Table 3 on the multivariate collection of TSB-AD, where the pool is smaller and the series are harder.

Block	Share of the pool	Share of the weight	Ratio
Statistical	37.7%	24.1%	0.64
Deep and foundation	37.2%	42.7%	1.15
Window-length variants	25.1%	33.2%	1.32

Appendix

Table 27: Where the weight goes on multivariate series. The blocks are those of Table 14 , and the ratio divides the share of the weight by the share of the pool, i.e., one means a block receives exactly its size.

Where $O_{-}$ is drawn from	Series	Best on window	OneShot	$\rho$
The whole series (ours)	150	0.675	0.712	84.3%
The normal points (needs labels)	150	0.653	0.710	83.6%
Difference		-0.022	-0.003	-0.7%
$p$ vs. the first row		0.030	0.432

Appendix

Table 28: What the noise in the drawn normal half costs. Every series is read twice from the same confirmed event and the same hidden part, and only the source of

O_{-}

changes: the whole series, as a deployment must, against the truly normal points, which needs the labels we avoid.

Size of $O_{-}$	Anomalous in it	Best on window	OneShot	$\rho$	$p$ vs. $1\times$
$\|O_{+}\|$ (ours)	6.38%	0.667	0.713	83.5%	–
$2\times\|O_{+}\|$	6.41%	0.684	0.716	84.4%	0.233
$5\times\|O_{+}\|$	6.42%	0.707	0.729	87.7%	$<$ 0.001

Appendix

Table 29: What a larger normal half buys. Every series is read three times from the same confirmed event and the same hidden part, and only the number of drawn normal points changes. The last column is a signed-rank test against the first row over 150 series.

Method	Drawn from the whole series	Drawn from the past	$\Delta$
Best on labeled window	0.672	0.656	-0.016
OneShot	0.710	0.704	-0.006
Oracle (Best detector for each)	0.779	0.779	+0.000

Appendix

Table 30: Where the normal half is drawn from. The right column draws it only from the points before the confirmed event ends, i.e., from what a deployment has already seen.

Confirmed events	Series	Score average	Best on window	$k$ - Shot	$\rho$	$p$
Every series that carries $k$
1	154	0.599	0.674	0.711	82.5%	$<$ 0.001
2	122	0.584	0.667	0.700	85.9%	$<$ 0.001
3	75	0.476	0.568	0.620	86.2%	$<$ 0.001
4	67	0.499	0.582	0.622	82.6%	$<$ 0.001
5	54	0.520	0.590	0.647	88.9%	$<$ 0.001

Appendix

Table 31: Confirming more than one event. Each row reveals

k

events and hides the rest, and

\rho

is the fraction of the gap to the best detector that

k

- Shot closes. The upper block uses every series that carries

k

events, and the lower block repeats the sweep on the series that carry all of them.

Series that carry 2 events
Confirmed events	Series	Best on window	$k$ - Shot	$\rho$	$p$ vs. one event
1	105	0.715	0.781	86.4%	–
2	105	0.727	0.789	88.4%	0.615
Series that carry 3 events
1	57	0.620	0.709	80.4%	–
2	57	0.633	0.735	86.9%	$<$ 0.001

Appendix

Table 32: Does a second label help? (full version) Every row reads the same hidden part, which is fixed before any event is revealed, which means every

k

is measured on one scoring set.

\rho

is the fraction of the gap to the best detector that

k

- Shot closes, and the last column tests each

k

against a single confirmed event on the same series. Table 7 reads the same numbers in the main text.

Quarter	Anomaly rate	OneShot	Best on window	Gain
1Q (Sparse)	0.53%	0.536	0.419	+0.116
2Q	3.69%	0.779	0.740	+0.040
3Q	7.80%	0.692	0.676	+0.016
4Q (Dense)	12.62%	0.835	0.853	-0.018

Appendix

Table 33: Gain against the anomaly rate. Series are sorted into quarters by the share of points that are anomalous, where the gain shrinks as the series grow denser.

Figure 13: OneShot and $k$ - Shot on one series. The top row confirms one event and the bottom row three, while the events in red stay hidden. Both rows run the same pipeline, and only the confirmed part grows.

The method
Concern	Where it is answered
A softmax over accuracies is a standard idea	Appendix N , Propositions 1 and 2
The margin over the top- $K$ averages is small	Table 3 , Table 20
The temperature needs labeled series	Appendix A.2
The label
A real operator confirms imperfectly	Table 9 , Table 23

Appendix

Table 34: Where each concern is answered. Each row names a question a reader may raise and the result that answers it, without adding any claim of its own.

Explore similar work

Have an LLM Write Your Anomaly Detector: Autonomous Discovery of Compact, Interpretable Detectors for Time Series
Oct 1, 2026David BerghausInterpretable Anomaly Detection LLM-Based Program Synthesis
Lamarr Institute Germany · Fraunhofer IAIS Germany
RAMSeS: Robust and Adaptive Model Selection for Time-Series Anomaly Detection Algorithms
Feb 25, 2026Mohamed Abdelmaksoud, Sheng Ding, Andrey Morozov +1Time-Series Anomaly Detection
BIFOLD & TU Berlin Berlin, Germany · University of Stuttgart Stuttgart, Germany
PaAno: Patch-Based Representation Learning for Time-Series Anomaly Detection
Feb 1, 2026Jinju Park, Seokho KangSelf-Supervised Time Series Representation Learning Time Series Representation Learning
Department of Industrial Engineering, Sungkyunkwan University

Oct 1, 2026J/K move · Enter open · S save

Have an LLM Write Your Anomaly Detector: Autonomous Discovery of Compact, Interpretable Detectors for Time Series

David Berghaus

Lamarr Institute Germany · Fraunhofer IAIS Germany

Interpretable Anomaly Detection LLM-Based Program Synthesis Unsupervised Anomaly Detection Time-Series Anomaly Detection Anomaly Detection

Open paper AskPDF arXiv

Time-series anomaly detection trades off predictive accuracy, computational efficiency, and interpretability. We use a large language model not as the detector but as the author of one: an autonomous research loop in which the model repeatedly edits a single short NumPy program under a leakage-free objective, keeping the best-scoring detector it finds. The loop discovers two compact detectors, one for univariate and one for multivariate series, that describe short windows by their local spectral features and compare them with the training-region distribution through a covariance-aware distance. On the TSB-AD benchmark these detectors lead the field across metrics, ahead of the strongest classical, deep, and foundation-model baselines including Time-RCD, yet they train no network and use no GPU, and the multivariate detector is faster than every similarly performing baseline. LLM-driven program search is thus a practical route to accurate, efficient, and transparent detectors.

Abstract

Explore similar work

Have an LLM Write Your Anomaly Detector: Autonomous Discovery of Compact, Interpretable Detectors for Time Series

RAMSeS: Robust and Adaptive Model Selection for Time-Series Anomaly Detection Algorithms

PaAno: Patch-Based Representation Learning for Time-Series Anomaly Detection