Temporal Anomaly Attribution

The foundational technique for autoencoder-based anomaly detection. The total anomaly score is the reconstruction error, which is decomposed by computing the per-timestep squared error between the input and the reconstructed output. By summing errors across feature dimensions at each time step, a temporal saliency map is generated, directly showing which moments the model failed to reconstruct. This method is inherently faithful, as the explanation is the error signal itself.

Used when anomaly detection relies on forecasting models. The anomaly score is the deviation between the predicted and actual value. Attribution is performed by backpropagating this forecast error through the model to compute the gradient with respect to each input time step. Techniques like Temporal Integrated Gradients accumulate these gradients along a path from a baseline to the input, satisfying the completeness axiom and ensuring the sum of attributions equals the total anomaly score.

For Transformer-based anomaly detectors, attention weights provide a direct, albeit debated, signal for attribution. The process involves extracting the attention matrices from all heads in the final layer and aggregating them (e.g., via mean or max pooling) across heads. The resulting vector shows the attention paid to each past time step. Attention rollout extends this by propagating attention weights through all layers, accounting for the mixing of information in deeper representations to produce a more faithful attribution.

A model-agnostic perturbation method. To attribute an anomaly, individual time steps or contiguous windows are systematically masked or replaced with a baseline value (e.g., zero, mean, or a forecast). The change in the anomaly score is measured for each perturbation. A large drop in the score indicates a critical time step. Temporal Occlusion Analysis slides a fixed-size window across the sequence to generate a saliency map, identifying the precise temporal interval responsible for the anomaly.

Temporal SHAP adapts game-theoretic Shapley values to the time-series domain. Each time step is treated as a player in a cooperative game where the payout is the anomaly score. The method computes the marginal contribution of each time step by averaging its impact across all possible subsets of other time steps. To handle the exponential complexity, approximations like KernelSHAP or DeepSHAP are used, providing a theoretically sound, additive feature attribution that fairly distributes the anomaly score across the sequence.

Instead of assigning importance scores, this technique generates a minimally perturbed alternative sequence that would have been classified as normal. The difference between the original anomalous sequence and the counterfactual highlights the critical time steps and features. Optimization methods like gradient descent in the input space find the smallest change required to flip the model's decision, providing a highly intuitive explanation: 'If these specific values had been different, no anomaly would have been detected.'

Adapts Shapley value calculations to assign importance scores to individual time steps in a sequence model's prediction. For anomaly detection, it decomposes the anomaly score by fairly distributing credit among all input features across the temporal axis, identifying which specific timestamps contributed most to the flag.

• Based on game-theoretic optimal credit allocation
• Satisfies efficiency, symmetry, and additivity properties
• Computationally intensive for long sequences; often uses KernelSHAP or DeepSHAP approximations

A perturbation-based method that systematically removes or masks individual time steps from a sequence to measure the resulting change in the model's anomaly score. The larger the score drop when a step is removed, the more critical that step was to the detection.

• Simple to implement and model-agnostic
• Can miss interaction effects between time steps
• Often combined with sliding window occlusion for efficiency

A decomposition method that backpropagates the anomaly score through the layers of a recurrent or temporal convolutional network to assign relevance scores to each input time step. LRP conserves the total relevance across layers, ensuring no attribution is lost.

• Uses deep Taylor decomposition or epsilon-rules for stability
• Produces heatmaps showing relevance flow over time
• Particularly effective for LSTM-based anomaly detectors

A gradient-based technique that computes the integral of gradients along a path from a neutral baseline (e.g., zero signal or mean imputation) to the actual anomalous input. This satisfies the completeness axiom, ensuring attributions sum to the difference between the anomaly score and the baseline score.

• Requires careful baseline selection for time-series data
• Identifies both positive and negative contributions to the anomaly score
• Computationally linear in the number of integration steps

Generates a minimally altered version of the anomalous sequence that would have been classified as normal by the model. The difference between the original and counterfactual trajectories pinpoints exactly which time steps and features needed to change to avoid triggering the alert.

• Provides actionable recourse for operators
• Uses optimization techniques like gradient descent in the input space
• Must respect temporal constraints and feature plausibility

Slides a masking window across the time series, occluding contiguous segments to generate a saliency map. The resulting heatmap shows which temporal intervals are most critical for the anomaly prediction, revealing the precise onset and duration of the anomalous event.

• Window size is a critical hyperparameter
• Can be extended to occlude feature subsets simultaneously
• Often visualized as a temporal heatmap overlaid on the raw signal