Retrieval Over Training: Similarity search-based Model Selection for Time Series Anomaly Detection

Christos Panourgias; Roberto Stanzione; Adrien Petralia; Themis Palpanas; Paul Boniol

cs.LGOct 14, 2026

Retrieval Over Training: Similarity search-based Model Selection for Time Series Anomaly Detection

Authors: Christos Panourgias, Roberto Stanzione, Adrien Petralia, Themis Palpanas, Paul Boniol

Organizations: Université Paris Cité, LIPADE · École Normale Supérieure, Inria

Abstract

Anomaly detection is a fundamental task for time-series analytics, with important implications for the downstream performance of many applications. Despite the large number of anomaly detection methods proposed in the literature, recent benchmark studies have shown that no single detector performs best across highly heterogeneous time series. Therefore, a practical and scalable solution is to develop a model-selection method that, for a given time series, selects the anomaly detector most likely to perform well. Nevertheless, the model selection approaches proposed in the literature suffer from a significant drop in accuracy when applied in Out-of-Distribution (OOD) settings. In this paper, we tackle the aforementioned limitation and propose RAMSAD, a retrieval-based framework for model selection in time-series anomaly detection. Given a new time series, our method queries a knowledge base of previously observed instances, retrieves the top-k most similar series, and transfers detector recommendations from their performance profiles. The framework can operate with standard similarity measures as well as embedding-based representations. Our results show that RAMSAD outperforms existing baselines in In-Distribution (ID) settings and is the most robust selector in OOD, where, when selecting a small subset of detectors, it matches or exceeds ensembles that run the entire detector pool, at a fraction of their cost. Overall, we demonstrate that similarity-based retrieval constitutes a strong and efficient foundation for model selection in time-series anomaly detection.

Figures & tables

Figure 1: Comparison of RAMSAD with all automatic TSAD approaches (ID and OOD).

Figure 2: Automatic solutions for time series anomaly detection discussed in Section 2.1 .

Figure 4: Segment-to-series aggregation in RAMSAD.

Figure 5: Before alignment (top), TSFM embeddings lack semantic structure; semantic alignment injects dataset-level description information (bottom).

Figure 6: VUS-PR comparison for in-distribution (panel a) and out-of-distribution settings (panel c), with the associated Critical Difference Diagrams (panels b and d, resp. ).

Figure 7: RAMSAD anomaly detection Runtime vs Accuracy by varying $k$ and $N$ .

Figure 8: RAMSAD VUS-PR when randomly reducing the knowledge base (left) and the detector pool (right).

	RAMSAD	ARGOSMART	ISAC	MSAD	SATZilla	UReg	MetaOD	CFact
Features	19.6	37.6 (catch22, shared)
Inference	0.05	1.1	25.6	25.8	39.7	221.8	426.7	453.4
Median	19.6	38.8	63.3	63.6	77.1	258.0	463.4	489.6
Std	0.4	7.8	7.8	8.3	12.2	25.1	28.6	32.2

Table 1: Latency from query series to detector recommendation, for single-detector selectors

Appendix figures & tables15 assets

Supplementary material from the paper’s appendix.

Appendix

Symbol	Description
General Notation
$\mathfrak{D}$	Collection of time series
$T_{i},L_{i}$	The $i$ -th univariate time series and its length
$T_{i}^{(t,\ell)}$	A subsequence of length $\ell$ extracted from $T_{i}$ starting at index $t$
$\mathcal{B}$	Finite pool of candidate anomaly detectors
$D_{j}$	The $j$ -th candidate anomaly detector

Appendix

Table 2: Table of main symbols used in RAMSAD.

Figure 11: Semantic Alignment Architecture

\mathcal{P}=\left\{\left(T_{i}^{(t,\ell)},c_{i}\right)\;:\;T_{i}\in\mathfrak{D},\;T_{i}^{(t,\ell)}\text{ is a segment extracted from }T_{i}\right\}

Appendix

Algorithm 1 Semantic Alignment Training for RAMSAD

Panel of Figure 12 — Figure 12: As training evolves, the true series–description matches are found more effectively in their batch multi-positive similarity matrices.

Metric		Exact	HNSW
Time	Build	—	$\mathcal{O}(nd(\mathrm{ef}_{c}+deg\,L))$
Time	Query	$\mathcal{O}(bnd+bn+bk_{seg}\log k_{seg})$	$\mathcal{O}(b(\mathrm{ef_{s}}\,d+\mathrm{ef_{s}}\log\mathrm{ef_{s}}))$
Space	Persistent	$\mathcal{O}(nd+\|\mathfrak{D}\|\,M)$	$\mathcal{O}(nd+n\ deg\ (L+1)+\|\mathfrak{D}\|\,M)$
Space	Query	$\mathcal{O}(bd+bn+bk_{seg})$	$\mathcal{O}(bd+b\,\mathrm{ef}+bk_{seg})$

Appendix

Table 3: Asymptotic complexity of exact retrieval and HNSW within RAMSAD. Here,

n

is the number of indexed training segments,

|\mathfrak{D}|

the number of indexed training series,

M

the number of candidate detectors,

d

the embedding dimensionality,

b

the number of query segments processed jointly, and

k_{seg}

the segment-level retrieval size.

Figure 13: Average VUS-PR achieved by RAMSAD when randomly reducing the size of the training set (left) and detector pool (right) in ID (top) and OOD (bottom) scenarios.

Method	Stat	k=1	k=2	k=3	k=4	k=5	k=6	k=7	k=8	k=9	k=10
Chronos2	Mean	0.7112	0.7117	0.7182	0.7329	0.7350	0.7463	0.7422	0.7253	0.7216	0.7147
	Median	0.8565	0.8552	0.8599	0.8854	0.8780	0.8925	0.8925	0.8891	0.8768	0.8565
	Std	0.3315	0.3329	0.3291	0.3198	0.3188	0.3105	0.3177	0.3295	0.3274	0.3270
Chronos2_aligned	Mean	0.7234	0.7233	0.7431	0.7457	0.7338	0.7384	0.7374	0.7260	0.7200	0.7285
	Median	0.8854	0.8959	0.9024	0.8925	0.8750	0.8854	0.8947	0.8867	0.8750	0.8867
	Std	0.3300	0.3324	0.3178	0.3126	0.3199	0.3173	0.3206	0.3278	0.3294	0.3269

Appendix

Table 4: In-distribution. Bold per

k

within each raw/aligned pair: higher mean and median, lower std. Underline marks the best value in the full table for each stat (max mean, max median, min std) across all methods and

k

Method	Stat	k=1	k=2	k=3	k=4	k=5	k=6	k=7	k=8	k=9	k=10
Chronos2	Mean	0.4819	0.4847	0.4900	0.5178	0.5427	0.5568	0.5721	0.5695	0.5917	0.5927
	Median	0.4453	0.4477	0.4583	0.5837	0.6434	0.6435	0.6764	0.6764	0.7220	0.6852
	Std	0.3844	0.3702	0.3834	0.3884	0.3809	0.3756	0.3683	0.3721	0.3704	0.3655
Chronos2_aligned	Mean	0.5390	0.5162	0.5745	0.5768	0.5649	0.5822	0.5792	0.5899	0.5934	0.5906
	Median	0.6073	0.5291	0.6794	0.6578	0.6578	0.7220	0.6852	0.7124	0.7220	0.6932
	Std	0.3819	0.3771	0.3817	0.3784	0.3844	0.3805	0.3803	0.3764	0.3750	0.3757

Appendix

Table 5: Out-of-distribution. Bold per

k

within each raw/aligned pair: higher mean and median, lower std. Underline marks the best value in the full table for each stat (max mean, max median, min std) across all methods and

k

Method	Load	Proj.	Search	Agg.	Total
Mantis	10.0	–	44.6	56.2	110.8
Tirex	12.3	–	47.4	40.2	99.9
Flowstate	14.1	–	44.8	60.8	119.7
Moirai	14.6	–	56.0	53.0	123.6
Toto	14.8	–	61.0	50.7	126.5
Moment	17.7	–	53.9	54.1	125.7

Appendix

Table 6: Retrieval-pipeline wall-clock time (ms) across TSFM-based similarity spaces. All methods are evaluated on the same query and database pool (

N_{\text{test}}=1383

N_{\text{train}}=3264

N_{\text{pairs}}=4{,}514{,}112

). Aligned variants apply the learned 768-dimensional semantic projection before retrieval.

Method	Total time
Segment Euclidean + aggregation	549.2 ms
Full-series Euclidean (truncated)	1.20 s
DTW via MESSI ( $w=10\%$ )	11 h 43 m

Appendix

Table 7: Retrieval-pipeline wall-clock time of original similarity spaces on the same query and database pool.

Domain	Seg. Eucl.	Full-series Eucl.	DTW (MESSI)
Environment	189.1 ms	106.0 ms	30 m 46 s
Facility	575.0 ms	1.19 s	14 h 42 m
Finance	189.2 ms	126.3 ms	37 m 18 s
Human Activity	292.0 ms	557.0 ms	5 h 29 m
Medical	616.6 ms	1.24 s	12 h 29 m
Sensor	211.9 ms	235.2 ms	2 h 20 m

Appendix

Table 8: OOD retrieval wall-clock time per domain for the three raw-distance similarity spaces.

Panel of Figure 14 — Figure 14: Sensitivity analysis with respect to parameter $k$ across eight forecasting models. Each panel reports the model-specific response under identical evaluation conditions, allowing direct visual comparison of trend, variability, and stability.

Domain	Total	Training	Test
Environment	20	14	6
Facility	143	102	41
Finance	20	14	6
Human Activity	58	41	17
Medical	147	105	42
Sensor	44	32	12

Appendix

Table 9: Dataset Domains.

Approach	Category	Description
Sub-LOF [ 13 ]	Distance-based	Identifies density-based local outliers.
LOF [ 13 ]	Distance-based
MatrixProfile [ 72 ]	Distance-based	Computes the distance between all subsequences.
KShapeAD [ 45 ]	Distance-based	Identifies the normal pattern based on the k-Shape clustering algorithm and computes distance-based anomaly scores.
SAND [ 12 ]	Distance-based	Incrementally updates a summary of normal patterns using subsequences from batches and evaluates anomaly scores based on distance.
Series2Graph [ 11 ]	Density-based	Transforms subsequences into nodes and their transition patterns into edges. Anomalies are identified based on irregular transition patterns.

Appendix

Table 10: List of anomaly detection approaches included in our experimental evaluation.

Approach	Category	Description
Oracle	Theoretical baseline	Selects the single best anomaly detector for each series
Supervised Selection (SS)	Theoretical baseline	Oracle-style upper bound: selects the best detector using labels of a portion of the target series, unavailable to the other methods
Global Best (GB)	Baseline	Global best: selects the detector with the best overall accuracy on the entire benchmark.
Random	Baseline	Randomly selects one of the detectors for each series.
Foundation model (FM) [ 18 ]	Baseline	Foundation model pre-trained on large scale datasets.
SATZilla [ 68 ]	Model Selection	Builds per-instance algorithm portfolios using empirical hardness models to predict performance and select the best SAT solver for each instance.

Appendix

Table 11: List of automated solutions compared with RAMSAD.

Explore similar work

RAMSeS: Robust and Adaptive Model Selection for Time-Series Anomaly Detection Algorithms
Feb 25, 2026Mohamed Abdelmaksoud, Sheng Ding, Andrey Morozov +1Time-Series Anomaly Detection
BIFOLD & TU Berlin Berlin, Germany · University of Stuttgart Stuttgart, Germany
Generalist Representation, Specialist Detection: TS-Router for Time-Series Anomaly Detection
Oct 1, 2026Tian Lan, Yifei Gao, Yimeng Lu +6Unsupervised Anomaly Detection Time-Series Anomaly Detection
Department of Industrial Engineering Tsinghua University · Huawei · Datadog AI Research Paris, France
IMPACT: Influence Modeling for Open-Set Time Series Anomaly Detection
Mar 31, 2026Xiaohui Zhou, Yijie Wang, Hongzuo Xu +3Time-Series Anomaly Detection Synthetic Anomaly Generation
National Key Laboratory of Parallel and Distributed Computing · College of Computer Science and Technology, National University of Defense Technology · Intelligent Game and Decision Lab (IGDL) +2

Feb 25, 2026J/K move · Enter open · S save

RAMSeS: Robust and Adaptive Model Selection for Time-Series Anomaly Detection Algorithms

Mohamed Abdelmaksoud, Sheng Ding, Andrey Morozov, Ziawasch Abedjan

BIFOLD & TU Berlin Berlin, Germany · University of Stuttgart Stuttgart, Germany

Time-Series Anomaly Detection

Open paper AskPDF arXiv

Time-series data vary widely across domains, making a universal anomaly detector impractical. Methods that perform well on one dataset often fail to transfer because what counts as an anomaly is context dependent. The key challenge is to design a method that performs well in specific contexts while remaining adaptable across domains with varying data complexities. We present the Robust and Adaptive Model Selection for Time-Series Anomaly Detection RAMSeS framework. RAMSeS comprises two branches: (i) a stacking ensemble optimized with a genetic algorithm to leverage complementary detectors. (ii) An adaptive model-selection branch identifies the best single detector using techniques including Thompson sampling, robustness testing with generative adversarial networks, and Monte Carlo simulations. This dual strategy exploits the collective strength of multiple models and adapts to dataset-specific characteristics. We evaluate RAMSeS and show that it outperforms prior methods on F1.

Abstract

Explore similar work

RAMSeS: Robust and Adaptive Model Selection for Time-Series Anomaly Detection Algorithms

Generalist Representation, Specialist Detection: TS-Router for Time-Series Anomaly Detection

IMPACT: Influence Modeling for Open-Set Time Series Anomaly Detection