Conditional Attribution for Root Cause Analysis in Time-Series Anomaly Detection

• URL: http://arxiv.org/abs/2604.17616v1
• Date: Sun, 19 Apr 2026 21:01:52 GMT
• Title: Conditional Attribution for Root Cause Analysis in Time-Series Anomaly Detection
• Abstract summary: We propose a conditional attribution framework that explains anomalies relative to contextually similar normal system states.<n>Our method retrieves representative normal instances conditioned on the anomalous observation, enabling dependency-preserving and operationally meaningful explanations.<n> Experiments on the SWaT and benchmarks demonstrate that the proposed approach consistently improves root-cause identification accuracy, temporal localization, and robustness across multiple anomaly detection models.
• Score: 13.555771273974697
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Root cause analysis (RCA) for time-series anomaly detection is critical for the reliable operation of complex real-world systems. Existing explanation methods often rely on unrealistic feature perturbations and ignore temporal and cross-feature dependencies, leading to unreliable attributions. We propose a conditional attribution framework that explains anomalies relative to contextually similar normal system states. Instead of using marginal or randomly sampled baselines, our method retrieves representative normal instances conditioned on the anomalous observation, enabling dependency-preserving and operationally meaningful explanations. To support high-dimensional time-series data, contextual retrieval is performed in learned low-dimensional representations using both variational autoencoder latent spaces and UMAP manifold embeddings. By grounding the retrieval process in the system's learned manifold, this strategy avoids out-of-distribution artifacts and ensures attribution fidelity while maintaining computational efficiency. We further introduce confidence-aware and temporal evaluation metrics for assessing explanation reliability and responsiveness. Experiments on the SWaT and MSDS benchmarks demonstrate that the proposed approach consistently improves root-cause identification accuracy, temporal localization, and robustness across multiple anomaly detection models. These results highlight the practical utility of conditional attribution for explainable anomaly diagnosis in complex time-series systems. Code and models will be publicly released.

Related papers

• OOD-RL-Bench: A Benchmark Framework for Out-of-Distribution Detection in Reinforcement Learning [4.173831365316023]
  We present OOD-RL-Bench, a framework designed to evaluate OOD detectors against categories of anomalies injected into trajectories.<n> Detectors and anomaly injectors are integrated through shared interfaces and configuration.<n>We assess the performance of each detector across a suite of anomaly types using matched-time AUROC, matched-time AUPRC, matched-time false-positive rate, detection delay, and segmented-onset metrics.
  arXiv  Detail & Related papers  (2026-07-14T08:57:04Z)
• Causally-Constrained Probabilistic Forecasting for Time-Series Anomaly Detection [1.8995711908407733]
  This study introduces a causally-constrained probabilistic forecasting framework for anomaly detection.<n>It integrates an explicit time-lagged causal graph prior with deep sequence modeling.<n>Experiments indicate that the proposed method achieves state-of-the-art detection performance.
  arXiv  Detail & Related papers  (2026-04-20T09:24:28Z)
• Out of Context: Reliability in Multimodal Anomaly Detection Requires Contextual Inference [54.774686416991386]
  We argue that multimodal anomaly detection should be reframed as a cross-modal contextual inference problem.<n>This perspective has implications for model design, evaluation protocols, and benchmark construction.
  arXiv  Detail & Related papers  (2026-04-14T19:32:55Z)
• Temporal-Conditioned Normalizing Flows for Multivariate Time Series Anomaly Detection [0.6399763005153404]
  temporal-conditioned flows (tcNF) is a novel framework that addresses anomaly detection in time series data.<n>tcNF effectively captures complex temporal dynamics and generates accurate probability of expected behavior.<n>We evaluate tcNF on diverse datasets, demonstrating good accuracy and robustness compared to existing methods.
  arXiv  Detail & Related papers  (2026-03-10T10:49:48Z)
• Counterfactual Explanation for Auto-Encoder Based Time-Series Anomaly Detection [0.3199881502576702]
  Auto-Encoders exhibit inherent opaqueness in their decision-making processes, hindering their practical implementation at scale.<n>In this work, we employ a feature selector to select features and counterfactual explanations to give a context to the model output.<n>Our experimental findings illustrate that our proposed counterfactual approach can offer meaningful and valuable insights into the model decision-making process.
  arXiv  Detail & Related papers  (2025-01-03T19:30:11Z)
• Pattern-Based Time-Series Risk Scoring for Anomaly Detection and Alert Filtering -- A Predictive Maintenance Case Study [3.508168174653255]
  We propose a fast and efficient approach to anomaly detection and alert filtering based on sequential pattern similarities. We show how this approach can be leveraged for a variety of purposes involving anomaly detection on a large scale real-world industrial system.
  arXiv  Detail & Related papers  (2024-05-24T20:27:45Z)
• Revisiting VAE for Unsupervised Time Series Anomaly Detection: A Frequency Perspective [40.21603048003118]
  Variational Autoencoders (VAEs) have gained popularity in recent decades due to their superior de-noising capabilities. FCVAE exploits an innovative approach to concurrently integrate both the global and local frequency features into the condition of Conditional Variational Autoencoder (CVAE) Our approach has been evaluated on public datasets and a large-scale cloud system, and the results demonstrate that it outperforms state-of-the-art methods.
  arXiv  Detail & Related papers  (2024-02-05T09:06:57Z)
• Video Anomaly Detection via Spatio-Temporal Pseudo-Anomaly Generation : A Unified Approach [49.995833831087175]
  This work proposes a novel method for generating generic Video-temporal PAs by inpainting a masked out region of an image. In addition, we present a simple unified framework to detect real-world anomalies under the OCC setting. Our method performs on par with other existing state-of-the-art PAs generation and reconstruction based methods under the OCC setting.
  arXiv  Detail & Related papers  (2023-11-27T13:14:06Z)
• Causality-Based Multivariate Time Series Anomaly Detection [63.799474860969156]
  We formulate the anomaly detection problem from a causal perspective and view anomalies as instances that do not follow the regular causal mechanism to generate the multivariate data. We then propose a causality-based anomaly detection approach, which first learns the causal structure from data and then infers whether an instance is an anomaly relative to the local causal mechanism. We evaluate our approach with both simulated and public datasets as well as a case study on real-world AIOps applications.
  arXiv  Detail & Related papers  (2022-06-30T06:00:13Z)
• Consistency of mechanistic causal discovery in continuous-time using Neural ODEs [85.7910042199734]
  We consider causal discovery in continuous-time for the study of dynamical systems. We propose a causal discovery algorithm based on penalized Neural ODEs.
  arXiv  Detail & Related papers  (2021-05-06T08:48:02Z)
• Learning Dependencies in Distributed Cloud Applications to Identify and Localize Anomalies [58.88325379746632]
  We present Arvalus and its variant D-Arvalus, a neural graph transformation method that models system components as nodes and their dependencies as edges to improve the identification and localization of anomalies. Given a series of metric, our method predicts the most likely system state - either normal or an anomaly class - and performs localization when an anomaly is detected. The evaluation shows the generally good prediction performance of Arvalus and reveals the advantage of D-Arvalus which incorporates information about system component dependencies.
  arXiv  Detail & Related papers  (2021-03-09T06:34:05Z)
• TadGAN: Time Series Anomaly Detection Using Generative Adversarial Networks [73.01104041298031]
  TadGAN is an unsupervised anomaly detection approach built on Generative Adversarial Networks (GANs) To capture the temporal correlations of time series, we use LSTM Recurrent Neural Networks as base models for Generators and Critics. To demonstrate the performance and generalizability of our approach, we test several anomaly scoring techniques and report the best-suited one.
  arXiv  Detail & Related papers  (2020-09-16T15:52:04Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.