Retrieval Over Training: Similarity search-based Model Selection for Time Series Anomaly Detection

Christos Panourgias; Roberto Stanzione; Adrien Petralia; Themis Palpanas; Paul Boniol

cs.LGOct 14, 2026

Retrieval Over Training: Similarity search-based Model Selection for Time Series Anomaly Detection

Authors: Christos Panourgias, Roberto Stanzione, Adrien Petralia, Themis Palpanas, Paul Boniol

Organizations: Université Paris Cité, LIPADE · École Normale Supérieure, Inria

Abstract

Anomaly detection is a fundamental task for time-series analytics, with important implications for the downstream performance of many applications. Despite the large number of anomaly detection methods proposed in the literature, recent benchmark studies have shown that no single detector performs best across highly heterogeneous time series. Therefore, a practical and scalable solution is to develop a model-selection method that, for a given time series, selects the anomaly detector most likely to perform well. Nevertheless, the model selection approaches proposed in the literature suffer from a significant drop in accuracy when applied in Out-of-Distribution (OOD) settings. In this paper, we tackle the aforementioned limitation and propose RAMSAD, a retrieval-based framework for model selection in time-series anomaly detection. Given a new time series, our method queries a knowledge base of previously observed instances, retrieves the top-k most similar series, and transfers detector recommendations from their performance profiles. The framework can operate with standard similarity measures as well as embedding-based representations. Our results show that RAMSAD outperforms existing baselines in In-Distribution (ID) settings and is the most robust selector in OOD, where, when selecting a small subset of detectors, it matches or exceeds ensembles that run the entire detector pool, at a fraction of their cost. Overall, we demonstrate that similarity-based retrieval constitutes a strong and efficient foundation for model selection in time-series anomaly detection.

Figures & tables

Figure 1: Comparison of RAMSAD with all automatic TSAD approaches (ID and OOD).

Figure 2: Automatic solutions for time series anomaly detection discussed in Section 2.1 .

Figure 4: Segment-to-series aggregation in RAMSAD.

Figure 5: Before alignment (top), TSFM embeddings lack semantic structure; semantic alignment injects dataset-level description information (bottom).

Figure 6: VUS-PR comparison for in-distribution (panel a) and out-of-distribution settings (panel c), with the associated Critical Difference Diagrams (panels b and d, resp. ).

Figure 7: RAMSAD anomaly detection Runtime vs Accuracy by varying $k$ and $N$ .

Figure 8: RAMSAD VUS-PR when randomly reducing the knowledge base (left) and the detector pool (right).

	RAMSAD	ARGOSMART	ISAC	MSAD	SATZilla	UReg	MetaOD	CFact
Features	19.6	37.6 (catch22, shared)
Inference	0.05	1.1	25.6	25.8	39.7	221.8	426.7	453.4
Median	19.6	38.8	63.3	63.6	77.1	258.0	463.4	489.6
Std	0.4	7.8	7.8	8.3	12.2	25.1	28.6	32.2

Table 1: Latency from query series to detector recommendation, for single-detector selectors

Appendix figures & tables15 assets

Supplementary material from the paper’s appendix.

Appendix

Symbol	Description
General Notation
$\mathfrak{D}$	Collection of time series
$T_{i},L_{i}$	The $i$ -th univariate time series and its length
$T_{i}^{(t,\ell)}$	A subsequence of length $\ell$ extracted from $T_{i}$ starting at index $t$
$\mathcal{B}$	Finite pool of candidate anomaly detectors
$D_{j}$	The $j$ -th candidate anomaly detector

Appendix

Table 2: Table of main symbols used in RAMSAD.

Figure 11: Semantic Alignment Architecture

\mathcal{P}=\left\{\left(T_{i}^{(t,\ell)},c_{i}\right)\;:\;T_{i}\in\mathfrak{D},\;T_{i}^{(t,\ell)}\text{ is a segment extracted from }T_{i}\right\}

Appendix

Algorithm 1 Semantic Alignment Training for RAMSAD

Panel of Figure 12 — Figure 12: As training evolves, the true series–description matches are found more effectively in their batch multi-positive similarity matrices.

Metric		Exact	HNSW
Time	Build	—	$\mathcal{O}(nd(\mathrm{ef}_{c}+deg\,L))$
Time	Query	$\mathcal{O}(bnd+bn+bk_{seg}\log k_{seg})$	$\mathcal{O}(b(\mathrm{ef_{s}}\,d+\mathrm{ef_{s}}\log\mathrm{ef_{s}}))$
Space	Persistent	$\mathcal{O}(nd+\|\mathfrak{D}\|\,M)$	$\mathcal{O}(nd+n\ deg\ (L+1)+\|\mathfrak{D}\|\,M)$
Space	Query	$\mathcal{O}(bd+bn+bk_{seg})$	$\mathcal{O}(bd+b\,\mathrm{ef}+bk_{seg})$

Appendix

Table 3: Asymptotic complexity of exact retrieval and HNSW within RAMSAD. Here,

n

is the number of indexed training segments,

|\mathfrak{D}|

the number of indexed training series,

M

the number of candidate detectors,

d

the embedding dimensionality,

b

the number of query segments processed jointly, and

k_{seg}

the segment-level retrieval size.

Figure 13: Average VUS-PR achieved by RAMSAD when randomly reducing the size of the training set (left) and detector pool (right) in ID (top) and OOD (bottom) scenarios.

Method	Stat	k=1	k=2	k=3	k=4	k=5	k=6	k=7	k=8	k=9	k=10
Chronos2	Mean	0.7112	0.7117	0.7182	0.7329	0.7350	0.7463	0.7422	0.7253	0.7216	0.7147
	Median	0.8565	0.8552	0.8599	0.8854	0.8780	0.8925	0.8925	0.8891	0.8768	0.8565
	Std	0.3315	0.3329	0.3291	0.3198	0.3188	0.3105	0.3177	0.3295	0.3274	0.3270
Chronos2_aligned	Mean	0.7234	0.7233	0.7431	0.7457	0.7338	0.7384	0.7374	0.7260	0.7200	0.7285
	Median	0.8854	0.8959	0.9024	0.8925	0.8750	0.8854	0.8947	0.8867	0.8750	0.8867
	Std	0.3300	0.3324	0.3178	0.3126	0.3199	0.3173	0.3206	0.3278	0.3294	0.3269

Appendix

Table 4: In-distribution. Bold per

k

within each raw/aligned pair: higher mean and median, lower std. Underline marks the best value in the full table for each stat (max mean, max median, min std) across all methods and

k

Method	Stat	k=1	k=2	k=3	k=4	k=5	k=6	k=7	k=8	k=9	k=10
Chronos2	Mean	0.4819	0.4847	0.4900	0.5178	0.5427	0.5568	0.5721	0.5695	0.5917	0.5927
	Median	0.4453	0.4477	0.4583	0.5837	0.6434	0.6435	0.6764	0.6764	0.7220	0.6852
	Std	0.3844	0.3702	0.3834	0.3884	0.3809	0.3756	0.3683	0.3721	0.3704	0.3655
Chronos2_aligned	Mean	0.5390	0.5162	0.5745	0.5768	0.5649	0.5822	0.5792	0.5899	0.5934	0.5906
	Median	0.6073	0.5291	0.6794	0.6578	0.6578	0.7220	0.6852	0.7124	0.7220	0.6932
	Std	0.3819	0.3771	0.3817	0.3784	0.3844	0.3805	0.3803	0.3764	0.3750	0.3757

Appendix

Table 5: Out-of-distribution. Bold per

k

within each raw/aligned pair: higher mean and median, lower std. Underline marks the best value in the full table for each stat (max mean, max median, min std) across all methods and

k

Method	Load	Proj.	Search	Agg.	Total
Mantis	10.0	–	44.6	56.2	110.8
Tirex	12.3	–	47.4	40.2	99.9
Flowstate	14.1	–	44.8	60.8	119.7
Moirai	14.6	–	56.0	53.0	123.6
Toto	14.8	–	61.0	50.7	126.5
Moment	17.7	–	53.9	54.1	125.7

Appendix

Table 6: Retrieval-pipeline wall-clock time (ms) across TSFM-based similarity spaces. All methods are evaluated on the same query and database pool (

N_{\text{test}}=1383

N_{\text{train}}=3264

N_{\text{pairs}}=4{,}514{,}112

). Aligned variants apply the learned 768-dimensional semantic projection before retrieval.

Method	Total time
Segment Euclidean + aggregation	549.2 ms
Full-series Euclidean (truncated)	1.20 s
DTW via MESSI ( $w=10\%$ )	11 h 43 m

Appendix

Table 7: Retrieval-pipeline wall-clock time of original similarity spaces on the same query and database pool.

Domain	Seg. Eucl.	Full-series Eucl.	DTW (MESSI)
Environment	189.1 ms	106.0 ms	30 m 46 s
Facility	575.0 ms	1.19 s	14 h 42 m
Finance	189.2 ms	126.3 ms	37 m 18 s
Human Activity	292.0 ms	557.0 ms	5 h 29 m
Medical	616.6 ms	1.24 s	12 h 29 m
Sensor	211.9 ms	235.2 ms	2 h 20 m

Appendix

Table 8: OOD retrieval wall-clock time per domain for the three raw-distance similarity spaces.

Panel of Figure 14 — Figure 14: Sensitivity analysis with respect to parameter $k$ across eight forecasting models. Each panel reports the model-specific response under identical evaluation conditions, allowing direct visual comparison of trend, variability, and stability.

Domain	Total	Training	Test
Environment	20	14	6
Facility	143	102	41
Finance	20	14	6
Human Activity	58	41	17
Medical	147	105	42
Sensor	44	32	12

Appendix

Table 9: Dataset Domains.

Approach	Category	Description
Sub-LOF [ 13 ]	Distance-based	Identifies density-based local outliers.
LOF [ 13 ]	Distance-based
MatrixProfile [ 72 ]	Distance-based	Computes the distance between all subsequences.
KShapeAD [ 45 ]	Distance-based	Identifies the normal pattern based on the k-Shape clustering algorithm and computes distance-based anomaly scores.
SAND [ 12 ]	Distance-based	Incrementally updates a summary of normal patterns using subsequences from batches and evaluates anomaly scores based on distance.
Series2Graph [ 11 ]	Density-based	Transforms subsequences into nodes and their transition patterns into edges. Anomalies are identified based on irregular transition patterns.

Appendix

Table 10: List of anomaly detection approaches included in our experimental evaluation.

Approach	Category	Description
Oracle	Theoretical baseline	Selects the single best anomaly detector for each series
Supervised Selection (SS)	Theoretical baseline	Oracle-style upper bound: selects the best detector using labels of a portion of the target series, unavailable to the other methods
Global Best (GB)	Baseline	Global best: selects the detector with the best overall accuracy on the entire benchmark.
Random	Baseline	Randomly selects one of the detectors for each series.
Foundation model (FM) [ 18 ]	Baseline	Foundation model pre-trained on large scale datasets.
SATZilla [ 68 ]	Model Selection	Builds per-instance algorithm portfolios using empirical hardness models to predict performance and select the best SAT solver for each instance.

Appendix

Table 11: List of automated solutions compared with RAMSAD.

Explore similar work

Feb 25, 2026

RAMSeS: Robust and Adaptive Model Selection for Time-Series Anomaly Detection Algorithms

Time-series data vary widely across domains, making a universal anomaly detector impractical. Methods that perform well on one dataset often fail to transfer because what counts as an anomaly is context dependent. The key challenge is to design a method that performs well in specific contexts while remaining adaptable across domains with varying data complexities. We present the Robust and Adaptive Model Selection for Time-Series Anomaly Detection RAMSeS framework. RAMSeS comprises two branches: (i) a stacking ensemble optimized with a genetic algorithm to leverage complementary detectors. (ii) An adaptive model-selection branch identifies the best single detector using techniques including Thompson sampling, robustness testing with generative adversarial networks, and Monte Carlo simulations. This dual strategy exploits the collective strength of multiple models and adapts to dataset-specific characteristics. We evaluate RAMSeS and show that it outperforms prior methods on F1.

Mohamed Abdelmaksoud, Sheng Ding, Andrey Morozov +1

BIFOLD & TU Berlin Berlin, Germany · University of Stuttgart Stuttgart, Germany

Time-Series Anomaly Detection

Ask PDF

Oct 1, 2026

Generalist Representation, Specialist Detection: TS-Router for Time-Series Anomaly Detection

Time-series anomaly detection (TSAD) is difficult to generalize across datasets because heterogeneous temporal dynamics imply different notions of normality and favor different detection criteria. While time-series foundation models provide transferable representations, coupling them with a fixed anomaly-scoring mechanism can overlook this variation. This motivates a different perspective on foundation-model-based TSAD: using foundation models to coordinate specialized anomaly criteria rather than directly imposing a universal one. Based on this view, we propose TS-Router, a generalist-representation, specialist-detection framework that estimates the relative competence of heterogeneous anomaly detectors from pretrained temporal representations and selects suitable specialists for each target series. To avoid relying on specialist-performance labels from real tasks, we derive soft competence supervision from specialists' relative performance on labeled simulated tasks. At deployment, routing requires no target anomaly labels, and only the selected specialists are fitted unsupervisedly on the target series. We bound Top-

k

set-competence regret under representation coverage and conditional competence stability. Across 16 real-world benchmarks and four complementary evaluation metrics, TS-Router achieves the best overall average rank. Controlled ablations with multiple frozen TSFM encoders further support the use of pretrained representations for competence estimation and adaptive specialist selection. The code is available at https://anonymous.4open.science/r/TS-Router-D8FF.

Tian Lan, Yifei Gao, Yimeng Lu +6

Department of Industrial Engineering Tsinghua University · Huawei · Datadog AI Research Paris, France

Unsupervised Anomaly Detection Time-Series Anomaly Detection Time-Series Foundation Models

Ask PDF

Mar 31, 2026

IMPACT: Influence Modeling for Open-Set Time Series Anomaly Detection

Open-set anomaly detection (OSAD) is an emerging paradigm designed to utilize limited labeled data from anomaly classes seen in training to identify both seen and unseen anomalies during testing. Current approaches rely on simple augmentation methods to generate pseudo anomalies that replicate unseen anomalies. Despite being promising in image data, these methods are found to be ineffective in time series data due to the failure to preserve its sequential nature, resulting in trivial or unrealistic anomaly patterns. They are further plagued when the training data is contaminated with unlabeled anomalies. This work introduces

\textbf{IMPACT}

, a novel framework that leverages

\underline{\textbf{i}}

nfluence

\underline{\textbf{m}}

odeling for o

\underline{\textbf{p}}

en-set time series

\underline{\textbf{a}}

nomaly dete

\underline{\textbf{ct}}

ion, to tackle these challenges. The key insight is to

\textbf{i)}

learn an influence function that can accurately estimate the impact of individual training samples on the modeling, and then

\textbf{ii)}

leverage these influence scores to generate semantically divergent yet realistic unseen anomalies for time series while repurposing high-influential samples as supervised anomalies for anomaly decontamination. Extensive experiments show that IMPACT significantly outperforms existing state-of-the-art methods, showing superior accuracy under varying OSAD settings and contamination rates. Code is available at https://github.com/mala-lab/IMPACT.

Xiaohui Zhou, Yijie Wang, Hongzuo Xu +3

National Key Laboratory of Parallel and Distributed Computing · College of Computer Science and Technology, National University of Defense Technology · Intelligent Game and Decision Lab (IGDL) +2

Time-Series Anomaly Detection Synthetic Anomaly Generation

Ask PDF