Time series anomaly detection has long had an annoying gap: the algorithm throws out a score but never tells you “why is it anomalous here?” Without explanation, users can only stare blankly, making trust and diagnosis impossible. ProtoX-AD finally breaks through this barrier — it embeds an interpretable prototype vector layer within a self-supervised classification framework, where each prototype corresponds to a transformation pattern or anomaly characteristic. During training, normal samples are clustered near corresponding prototypes, and abnormal samples are pushed away from all prototypes; during inference, classification error is used for detection, while prototype similarity directly tells you whether the anomaly is a “local abrupt change” or a “trend shift.” Detection accuracy is not sacrificed, and the explanations come with semantics. The limitation is that prototypes need to be predefined, but it fills the key missing piece of explainability for the first time.

ProtoX-AD: Self-Explainable Time Series Anomaly Detection and Characterization

Source: https://arxiv.org/html/2606.13277 Elisabeth Wetzer111These authors contributed equally to this work.Kristoffer Wickstrøm222These authors contributed equally to this work.Michael Kampffmeyer333These authors contributed equally to this work.Robert Jenssen444These authors contributed equally to this work.

Abstract

Recent advances in time series anomaly detection (TSAD) have highlighted the effectiveness of self-supervised classification-based approaches. These methods apply transformations to normal training samples, training a classifier to recognize transformation-specific patterns that help identify anomalies through increased classification errors. Despite their strong performance, a significant challenge is their lack of explainability, as they provide limited insight into the characteristics of flagged anomalies. To address this limitation, we propose ProtoX-AD, a prototype-based self-explainable framework for self-supervised TSAD. ProtoX-AD learns transformation-aware latent representations alongside interpretable prototypes, enabling both accurate anomaly detection and the identification of distinct anomalous profiles through prototype-based explanations. Additionally, it allows for systematic analysis of how transformation design impacts detection performance and explainability. Experimental results on synthetic and real-world datasets demonstrate that ProtoX-AD achieves detection performance comparable to its black-box counterparts while offering more consistent and semantically meaningful explanations than existing explainable baselines. Our code is publicly available athttps://github.com/Aitorzan3/ProtoX-AD

keywords:

Time series anomaly detection , anomaly characterization , self-supervised learning , explainable AI , prototype learning.

\affiliation

[1] organization=Department of Computer Science and Artificial Intelligence, University of the Basque Country UPV/EHU, city=Donostia, country=Spain

\affiliation

[2]organization=Department of Physics and Technology, UiT The Arctic University of Norway, city=Tromsø, country=Norway

1Introduction

Time series anomalies are abnormal events in which the behavior of a system departs from its regular operating patterns[5 (https://arxiv.org/html/2606.13277#bib.bib43)]. Time series anomaly detection (TSAD) is a fundamental problem in many critical application domains, such as finance[15 (https://arxiv.org/html/2606.13277#bib.bib17)], Internet of Things (IoT) systems[8 (https://arxiv.org/html/2606.13277#bib.bib19)], and healthcare[31 (https://arxiv.org/html/2606.13277#bib.bib16)]. Due to the high cost of labeling anomalies, TSAD is typically addressed using unsupervised approaches[2 (https://arxiv.org/html/2606.13277#bib.bib14),34 (https://arxiv.org/html/2606.13277#bib.bib13)]. Within this setting, models learn the patterns of normal data to detect deviations from normality at inference time, typically quantified as anomaly scores[7 (https://arxiv.org/html/2606.13277#bib.bib7)].

Recent advances in the field have focused on self-supervised learning[23 (https://arxiv.org/html/2606.13277#bib.bib18)], with classification-based approaches emerging as a prominent paradigm[27 (https://arxiv.org/html/2606.13277#bib.bib5)]. In this setting, a set of transformations is applied to normal samples to generate one augmented view per transformation, and a classifier is trained to predict the transformation associated with each view[17 (https://arxiv.org/html/2606.13277#bib.bib1)]. As a result, models capture the expected response of normal samples when subjected to each transformation. At inference time, anomalies tend to violate these learned patterns, leading to higher classification errors that are used as anomaly scores. The effectiveness of self-supervised classification-based time series anomaly detection (SSC-TSAD) critically depends on the choice of transformations[32 (https://arxiv.org/html/2606.13277#bib.bib2)].

Despite their strong performance, these approaches lack explainability[19 (https://arxiv.org/html/2606.13277#bib.bib41)], limiting the understanding of both how transformation design influences detection performance and how different anomalous patterns are characterized. In particular, existing methods typically provide anomaly scores without offering insight into the underlying structure of anomalous behavior. Consequently, they do not support the identification and interpretation of distinct anomalous profiles, which is critical in many real-world applications[10 (https://arxiv.org/html/2606.13277#bib.bib15)].

To address this limitation, in this paper we propose a self-explainable framework for SSC-TSAD555In this work, we focus on detecting entire anomalous time series as opposed to detecting anomalous points or subsequences.. We draw inspiration from prototypical self-explainable models (SEMs) in the field of eXplainable AI (XAI)[1 (https://arxiv.org/html/2606.13277#bib.bib40)], which learn representative concepts in the latent space that can be visualized in the input space to explain model decisions[6 (https://arxiv.org/html/2606.13277#bib.bib31),13 (https://arxiv.org/html/2606.13277#bib.bib24)]. By structuring the latent space around transformation-induced concepts and reconstructing prototypes in the input domain, our method enables both accurate anomaly detection and the characterization of distinct anomalous profiles. Moreover, it enables a systematic analysis of the impact of transformation design on SSC-TSAD. We call our method ProtoX-AD.

In summary, the main contributions of this work are as follows:

• 1.We propose ProtoX-AD, a prototype-based self-explainable framework for self-supervised classification-based time series anomaly detection.
• 2.Our method achieves anomaly detection performance comparable to its black-box self-supervised counterpart, while providing interpretable prototype-based explanations that enable anomaly characterization.
• 3.We provide an analysis of the impact of transformation design on SSC-TSAD in terms of detection performance, explainability, and anomaly characterization.

2Related Work on SSC-TSAD

Self-supervised classification-based TSAD methods rely on the application of a set of transformations to normal samples, generating augmented views that define a surrogate classification task[14 (https://arxiv.org/html/2606.13277#bib.bib23)]. The effectiveness of these approaches depends strongly on the choice of transformations, as they determine the structure of the learned representations and the types of deviations that can be detected. Specifically, recent work states that they should generate corrupted views of normal samples that reflect the properties of the targeted anomalies[32 (https://arxiv.org/html/2606.13277#bib.bib2)].

Following this perspective, most existing approaches rely on manually designed transformations tailored to specific anomaly detection problems based on domain knowledge[32 (https://arxiv.org/html/2606.13277#bib.bib2)]. For instance, transformations such as upscaling have been used in water leak detection to mimic increased consumption patterns caused by leaks[3 (https://arxiv.org/html/2606.13277#bib.bib3)]. Similarly, various works propose transformations that alter the amplitude and frequency of sequences to mirror the properties of seizures for epilepsy detection[35 (https://arxiv.org/html/2606.13277#bib.bib4),30 (https://arxiv.org/html/2606.13277#bib.bib22)]. Although effective, relying on hand-crafted transformations limits the general applicability and transferability of these methods across TSAD problems[27 (https://arxiv.org/html/2606.13277#bib.bib5)].

To alleviate this limitation, recent works have explored learnable neural transformations[26 (https://arxiv.org/html/2606.13277#bib.bib9),28 (https://arxiv.org/html/2606.13277#bib.bib8)], implemented as neural networks that are learned directly from normal training data. By leveraging contrastive learning[18 (https://arxiv.org/html/2606.13277#bib.bib6)], these transformations are enforced to generate diverse and non-redundant augmented views while preserving the semantic content of the original samples and disrupting data normality in a controlled manner, prioritizing general applicability over domain-specific assumptions[28 (https://arxiv.org/html/2606.13277#bib.bib8)].

The choice between manual and neural transformations often depends on the availability of domain knowledge: manually designed transformations can target specific anomalous patterns, whereas neural transformations aim to provide greater generality[27 (https://arxiv.org/html/2606.13277#bib.bib5)]. Existing work typically compares these approaches in terms of anomaly detection performance, highlighting the trade-off between domain specificity and generality. However, this perspective does not capture how different transformation choices influence the characterization of anomalous behavior. In particular, understanding how transformed views relate to distinct anomalous patterns requires insight beyond a single anomaly score. Existing methods lack explicit mechanisms to support such analysis[19 (https://arxiv.org/html/2606.13277#bib.bib41)].

3Method

ProtoX-AD learns a latent space in which augmented views are well suited for SSC-TSAD alongside prototypes that allow the distinction and characterization of different anomalous profiles through prototypical explainability.

3.1Model Architecture

Our model’s pipeline consists of five key components: (i) a transformation module, (ii) a feature extraction module, (iii) a dual reconstruction module, (iv) a prototype module, and (v) a classification module. Figure1 (https://arxiv.org/html/2606.13277#S3.F1)illustrates the overall architecture of ProtoX-AD.

Refer to captionFigure 1:Pipeline of ProtoX-AD. The input time seriesxi\mathbf{x}_{i}is transformed into augmented viewsxik\mathbf{x}_{i}^{k}, encoded into latent representationszik\mathbf{z}_{i}^{k}, and compared with class-specific prototypesφmk\boldsymbol{\phi}_{m}^{k}to compute similarity matricesSik\mathbf{S}_{i}^{k}. The classification module performs self-supervised classification based on these similarities. In addition, the dual reconstruction module reconstructs both transformed views and the original sample from the latent representations.##### Transformation module

This comprises a set ofKKtransformationsT={T1,…,TK}\mathcal{T}=\{T_{1},...,T_{K}\}, which can be manual or learnable neural transformations representing parameterized functions. When applied to an input samplexi\mathbf{x}_{i}, these transformations generate a set of augmented views associated with the original sampleT(xi)={T1(xi),…,TK(xi)}={xi1,…,xiK}\mathcal{T}(\mathbf{x}_{i})=\{T_{1}(\mathbf{x}_{i}),...,T_{K}(\mathbf{x}_{i})\}=\{\mathbf{x}_{i}^{1},...,\mathbf{x}_{i}^{K}\}, wherexik\mathbf{x}_{i}^{k}denotes the augmented view that is generated by applying thekk-th transformationTk(⋅)T_{k}(\cdot)to that sample. Following the existing literature on self-supervised classification for anomaly detection[27 (https://arxiv.org/html/2606.13277#bib.bib5)], the first transformationT1(⋅)T_{1}(\cdot)in the transformation module is set to the identity function, i.e.,T1(xi)=xiT_{1}(\mathbf{x}_{i})=\mathbf{x}_{i}.

Feature extraction module

This consists of an encoderf(⋅)f(\cdot)that maps the augmented views into a new representation that is suitable for the self-supervised anomaly detection task. Following the variational autoencoder paradigm and inspired by ProtoVAE[11 (https://arxiv.org/html/2606.13277#bib.bib11)], ProtoX-AD models the latent space probabilistically to encourage smooth and structured latent representations. Specifically, each augmented viewxik\mathbf{x}_{i}^{k}is transformed byf(⋅)f(\cdot)into a tuple (μik\boldsymbol{\mu}_{i}^{k},σik\boldsymbol{\sigma}_{i}^{k}), which are the parameters of the posterior normal distributionN\mathcal{N}(μik\boldsymbol{\mu}_{i}^{k},σik\boldsymbol{\sigma}_{i}^{k}), from where its corresponding latent representationzik\mathbf{z}_{i}^{k}is sampled.

Dual reconstruction module

It consists of an explainere(⋅)e(\cdot)and a semantic preservation decoderg(⋅)g(\cdot), which are designed to be symmetric to the encoderf(⋅)f(\cdot). The explainere(⋅)e(\cdot)reconstructs the augmented views of each samplexik\mathbf{x}_{i}^{k}from their corresponding latent representationszik\mathbf{z}_{i}^{k}, while the semantic preservation decoderg(⋅)g(\cdot)reconstructs the original samplexi\mathbf{x}_{i}from each latent viewzik\mathbf{z}_{i}^{k}. That is, ideallye(zik)=xike(\mathbf{z}_{i}^{k})=\mathbf{x}_{i}^{k}andg(zik)=xig(\mathbf{z}_{i}^{k})=\mathbf{x}_{i}, fork∈{1,2,…,K}k\in\{1,2,\dots,K\}.

At a high level, the explainere(⋅)e(\cdot)enables the visualization and interpretation of latent prototypes in the input space, while the semantic preservation decoderg(⋅)g(\cdot)acts as a regularizer that preserves semantic consistency across transformations and prevents representation collapse.

Prototype module

Our network incorporates a set of prototypes that are learned to capture representative concepts associated with each class and to enable the self-supervised classification task. Specifically, we considerMMprototypes for each class, resulting in a set of prototypesΦ={φmk}m=1..Mk=1..K\boldsymbol{\Phi}=\{\boldsymbol{\phi}_{m}^{k}\}_{m=1..M}^{k=1..K}, whereφmk\boldsymbol{\phi}_{m}^{k}is themm-th prototype associated with classkk. For each augmented view in the latent spacezik\mathbf{z}_{i}^{k}, we define a matrix of distancesDik∈RK×M\mathbf{D}_{i}^{k}\in\mathbb{R}^{K\times M}, whose entrydik(c,m)d_{i}^{k}(c,m)corresponds to the squared Euclidean distance betweenzik\mathbf{z}_{i}^{k}and themm-th prototype of classcc:

dik(c,m)=∥zik−φmc∥22.d_{i}^{k}(c,m)=\lVert\mathbf{z}_{i}^{k}-\boldsymbol{\phi}_{m}^{c}\rVert_{2}^{2}.(1) The prototype vectors are initialized using K-means clustering in the latent space. Specifically, prior to training, an initial forward pass of the training data through the transformation module and encoder is performed. Then, K-means withMMclusters is applied independently per transformation class to the resulting latent representations to obtain an initial set of latent prototypes.

Classification module

To ensure transparency, the self-supervised classification task is performed by directly leveraging the concepts learned in the model’s latent space. For each augmented view with latent representationzik\mathbf{z}_{i}^{k}, we convert its associated distance matrixDik\mathbf{D}_{i}^{k}into a similarity matrixSik\mathbf{S}_{i}^{k}by taking its negative, i.e.,Sik=−Dik\mathbf{S}_{i}^{k}=-\mathbf{D}_{i}^{k}. Accordingly, the entries of the similarity matrix are defined as

sik(c,m)=−dik(c,m),s_{i}^{k}(c,m)=-d_{i}^{k}(c,m),(2) wheresik(c,m)s_{i}^{k}(c,m)quantifies the similarity between the latent representa