Anomaly detection¶
This section is about spotting readings that look strange. Each tool learns from the recent readings what is usual, and gives every new reading a score: the higher the score, the less it looks like the recent past.
An anomaly detector gives every sample a score: high means the sample does not look like the recent past. These detectors work one sample at a time, so they run inside a control loop.
- Streaming — per-sample deviation scores, single and multi-channel, plus causal Hampel, Tukey, Chauvenet, sigma clipping and online robust Mahalanobis.
- Robust filters — the four classic detectors on whole series, and the pressure-valve orchestrator.
- Curvature — a bounded proximity-to-reference score in [0, 1).
Multivariate detectors¶
When several channels move together — the residual of a joint on a robot, the reading of a sensor bank — a per-channel detector is blind to faults that show only in the combination. These detectors look at the joint vector, one sample at a time.
| Detector | Bias | Cost | Arm ROC-AUC | Drift ROC-AUC |
|---|---|---|---|---|
| OnlineRobustMahalanobis | distance from a robust median under the MCM | 0.036 ms | 1.000 | 0.993 |
| LODA | rare bins in random 1D projections | 0.571 ms | 1.000 | 0.989 |
| Half-Space Trees | few reference samples in the region | 1.105 ms | 1.000 | 0.982 |
| OnlineIsolationForest | depth to isolate a point | 0.701 ms | 0.337 | 0.724 |
| OneClassSGD | distance from a learned kernel boundary | 0.131 ms | 0.856 | 0.987 |
The two benchmark streams are SyntheticArm (payload fault, 200 samples, 100 healthy) and
DriftStream (one sudden drift at half, 2000 samples). The table reports the
learn-on-healthy protocol: each detector learns only from the healthy part of the
stream and is scored on the whole stream. The other protocol the benchmark computes
(learn-on-all) and the full table with false alarms are in
benchmarks/anomaly_streaming.py.
Each detector has its own bias and its own cost. On a stream whose fault is a shift of the
mean (the arm benchmark), OnlineRobustMahalanobis is the strongest. On a stream whose
fault is a change of the distribution's shape, Half-Space Trees and LODA see things the
mean-shift detector misses. On a stream whose fault proportion is well above the paper's
"anomalies are few" assumption, OnlineIsolationForest needs a longer healthy run to
converge — its own page documents the assumption. OneClassSGD reaches 0.978 on
DriftStream and 0.856 on the arm (200 samples, 100 healthy). The default
step=1.0 gives the eta_t = 1 / t of Suk and Kpotufe (2025, Lemma 5).
All five detectors go through AnomalyGate and Protected unchanged: each exposes a
threshold, and any of them can drive the protection of an estimator that learns online.