pith. sign in

arxiv: 2606.13486 · v1 · pith:IFXRDB4Wnew · submitted 2026-06-11 · 💻 cs.LG · cs.AI

CRAFTIIF: Cross-Resolution Analytic Four-Type Interpretable Isolation Forest for Multivariate Time Series Anomaly Detection

William Smits This is my paper

Pith reviewed 2026-06-27 07:29 UTC · model grok-4.3

classification 💻 cs.LG cs.AI
keywords anomaly detectionmultivariate time seriesisolation forestwavelet featuresunsupervised learninginterpretabilityanomaly typesfeature attribution
0
0 comments X

The pith

CRAFTIIF assigns analytic wavelet features from four families to separate isolation forests to detect and label four anomaly types in multivariate time series.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper introduces an unsupervised approach for finding anomalies in multivariate time series that covers four structurally different kinds: isolated spikes, level shifts, rhythm changes, and breakdowns in sensor correlations. It builds this by drawing features from four wavelet families, each aimed at one anomaly kind, and trains separate isolation forests on those features. A meta forest catches cases involving more than one kind at once. This matters to a sympathetic reader because it promises both better coverage of anomaly varieties and built-in explanations for why a detection occurred, two things most current methods lack. An adaptive threshold lets the system work across very different anomaly frequencies without manual adjustment.

Core claim

CRAFTIIF generates five hundred random analytic wavelet feature draws from four families and routes them into five isolation forests, one dedicated to each anomaly type plus one for compounds. Because training is type-specific, the identity of the firing forest directly attributes the anomaly type. An adaptive Otsu or MAD threshold sets the decision boundary automatically for anomaly rates spanning three orders of magnitude.

What carries the argument

Five isolation forests each trained only on wavelet features matched to one of the four anomaly types (point, distributional, temporal, collective) with a fifth meta-forest for combinations.

If this is right

  • The framework requires no dataset-specific tuning and adapts to varying anomaly rates.
  • Each anomaly receives a type label from the specific isolation forest that detects it.
  • A meta isolation forest handles cases where multiple anomaly types occur together.
  • The method can flag some datasets as undetectable by unsupervised approaches in general.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Applying similar type-specific feature generation to other base detectors besides isolation forests could improve their performance on mixed anomaly data.
  • The cross-resolution aspect might allow the method to capture anomalies at different scales in longer time series.
  • Diagnostic tools like branch separation ratios could help practitioners decide when to trust unsupervised detections.
  • This structure might reduce the need for post-processing explanations in deployed anomaly systems.

Load-bearing premise

The four wavelet families and their assignment to anomaly types generate features that actually isolate the intended anomaly class.

What would settle it

A labeled dataset in which the isolation forest branches activate in patterns that do not match the known anomaly types would show that the type-specific features do not deliver the claimed attribution.

Figures

Figures reproduced from arXiv: 2606.13486 by William Smits.

Figure 1
Figure 1. Figure 1: The four structural anomaly types targeted by C [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: CRAFTIIF pipeline. Input MTS X passes through data quality prepro￾cessing and auto-configured windowing before random multiresolution feature extraction across four wavelet families (Morlet, DOG, Haar, Coiflet), each generating K=500 random draws of (scale, channel weight, feature group). Four type-specific Isolation Forests and a meta-IF produce branch scores that feed the adaptive Otsu/MAD threshold and … view at source ↗
Figure 3
Figure 3. Figure 3: Adaptive threshold calibration illustrated on two datasets. (a) Daphnet [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Ablation heatmap: ∆F1 per condition per dataset relative to full CRAFTIIF (K=500, adaptive threshold). Red = degradation; blue = neutral or minor improvement. Datasets ordered by full CRAFTIIF F1 (detectable datasets only). Dashed lines separate three row groups: rows 1–3 ablate structural components (global IF, fixed threshold, no meta-branch); rows 4–7 use a single wavelet family; rows 8–9 vary hyperpara… view at source ↗
read the original abstract

Anomaly detection in multivariate time series is challenged by four structurally distinct anomaly types -- point (isolated spikes), distributional (level shifts), temporal (rhythm changes), and collective (inter-sensor correlation breakdowns) -- each requiring different feature representations. Most unsupervised methods target only one or two types and provide limited interpretability. We present CRAFTIIF (Cross-Resolution Analytic Four-Type Interpretable Isolation Forest), a fully unsupervised framework targeting all four types without dataset-specific tuning. CRAFTIIF generates K=500 random analytic wavelet feature draws across four families (Morlet, DOG, Haar, Coiflet), each targeting a specific anomaly type, feeding five structured Isolation Forests -- one per type plus a meta-IF for compound anomalies. An adaptive Otsu/MAD threshold calibrates detection automatically across anomaly rates from 0.1% to 69.2%. Because each IF is trained exclusively on type-specific features, branch firing provides direct anomaly-type attribution by construction, without post-hoc explanation. Evaluated on all 19 datasets of the mTSBench benchmark (Zhou et al., TMLR 2026), CRAFTIIF achieves mean F1=0.228 (all 19 datasets) and F1=0.322 (13 detectable datasets), ranking first among all 25 evaluated methods on VUS-PR (0.463 vs. previous best 0.329, +40.7%). A diagnostic framework -- oracle F1, detectability limits, and branch separation ratios -- identifies 6 of 19 datasets as fundamentally undetectable by any unsupervised method. Ablation over 11 conditions confirms adaptive thresholding (+38% F1), four-branch structure (+20%), and meta-IF (+23%) are each essential. Code: https://github.com/smitswil/craftiif

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 2 minor

Summary. The paper introduces CRAFTIIF, a fully unsupervised framework for multivariate time series anomaly detection that generates K=500 random analytic wavelet features across four families (Morlet, DOG, Haar, Coiflet) each mapped to one of four anomaly types (point, distributional, temporal, collective). These features feed four type-specific Isolation Forests plus a meta-IF for compound anomalies, with an adaptive Otsu/MAD threshold for automatic calibration. The method claims built-in type attribution by construction via branch firing, reports mean F1=0.228 (all 19 mTSBench datasets) and 0.322 (13 detectable datasets), and ranks first on VUS-PR (0.463 vs. prior best 0.329). Ablations confirm contributions from adaptive thresholding (+38%), four-branch structure (+20%), and meta-IF (+23%), alongside a diagnostic framework identifying undetectable datasets.

Significance. If the central premise holds, CRAFTIIF would advance the field by providing a principled, tuning-free approach to multi-type anomaly detection with native interpretability, outperforming 24 other methods on a standard benchmark. The supplied code repository enables reproducibility, the diagnostic framework for detectability limits is a constructive addition, and the reported VUS-PR gain of +40.7% is substantial if attributable to the type-specific design rather than ensemble effects alone.

major comments (2)
  1. [Feature Generation] Feature-generation section: The mapping of wavelet families to anomaly types (Morlet to point, DOG to distributional, Haar to temporal, Coiflet to collective) is asserted to produce features that isolate the intended class, enabling the four-branch structure and 'by construction' attribution. However, no independent verification is provided (e.g., per-type precision-recall curves on synthetic data with known anomaly classes, or family-specific feature importance), making it impossible to confirm that performance gains derive from this mapping rather than the aggregate 500-wavelet ensemble and meta-IF.
  2. [Ablation Study] Ablation study (11 conditions): While the four-branch structure is shown to contribute +20% F1, the ablation does not include controls such as random wavelet-to-type assignments or single-family baselines. This leaves the specific mapping untested as a load-bearing design choice for the interpretability claim.
minor comments (2)
  1. [Methods] The abstract and methods should explicitly state the parameter ranges and sampling distribution used for the K=500 random wavelet draws (scale, translation, etc.) to allow full reproduction.
  2. [Diagnostic Framework] Table or figure presenting branch separation ratios should include confidence intervals or statistical tests to support the claim that the four IFs are meaningfully distinct.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the detailed and constructive review. The comments correctly identify areas where additional justification and controls would strengthen the claims regarding the wavelet-to-type mapping. We address each point below and indicate planned revisions.

read point-by-point responses

  1. Referee: [Feature Generation] Feature-generation section: The mapping of wavelet families to anomaly types (Morlet to point, DOG to distributional, Haar to temporal, Coiflet to collective) is asserted to produce features that isolate the intended class, enabling the four-branch structure and 'by construction' attribution. However, no independent verification is provided (e.g., per-type precision-recall curves on synthetic data with known anomaly classes, or family-specific feature importance), making it impossible to confirm that performance gains derive from this mapping rather than the aggregate 500-wavelet ensemble and meta-IF.

    Authors: We agree that the manuscript lacks independent verification such as synthetic experiments with labeled anomaly types or family-specific feature importance analysis. The mapping is motivated by established signal-processing properties of the wavelets (Morlet for time-localized oscillations suited to point anomalies, DOG for multi-scale distributional shifts, Haar for abrupt temporal discontinuities, and Coiflets for smoother collective patterns), but this remains a design rationale rather than empirically validated isolation on controlled data. The reported gains are supported by the overall benchmark results and the four-branch ablation, yet we acknowledge the referee's point that these do not isolate the mapping's specific contribution versus the ensemble effect. We will revise the feature-generation section to expand the theoretical justification and add an explicit limitations paragraph noting the absence of synthetic per-type validation. revision: partial

  2. Referee: [Ablation Study] Ablation study (11 conditions): While the four-branch structure is shown to contribute +20% F1, the ablation does not include controls such as random wavelet-to-type assignments or single-family baselines. This leaves the specific mapping untested as a load-bearing design choice for the interpretability claim.

    Authors: The referee is correct that the existing ablation does not test random wavelet-to-type assignments or single-family baselines, so it does not directly demonstrate that the chosen mapping (as opposed to any four-way partition) is responsible for the gains or the interpretability. The interpretability claim rests on the fact that each Isolation Forest is trained exclusively on features from one wavelet family, making branch activation a direct indicator of type; a random mapping would break this correspondence by construction. We will revise the ablation discussion to clarify this distinction, note that single-family performance is implicitly reflected in the per-branch contributions, and acknowledge that a random-assignment control would provide stronger evidence for the specific mapping's utility. revision: partial

Circularity Check

0 steps flagged

No significant circularity in derivation chain

full rationale

The paper's central claims are empirical performance metrics (F1 and VUS-PR) measured on the external mTSBench benchmark with 19 datasets and supplied code. The 'by construction' type attribution is an explicit design choice in the feature-generation and IF training steps, but no equation or result reduces the reported scores to a fitted constant or self-referential input. No load-bearing self-citations appear; the derivation chain remains self-contained against external benchmarks.

Axiom & Free-Parameter Ledger

2 free parameters · 2 axioms · 0 invented entities

The method rests on the hand-chosen number of feature draws, the fixed mapping of wavelet families to anomaly types, and the assumption that the mTSBench datasets are representative; no new physical entities are postulated.

free parameters (2)
  • K = 500
    Number of random analytic wavelet feature draws set to 500
  • number_of_forests = 5
    Five forests (four type-specific plus one meta) chosen by design
axioms (2)
  • domain assumption The four wavelet families (Morlet, DOG, Haar, Coiflet) each preferentially highlight one of the four anomaly types
    Invoked in the feature-generation paragraph of the abstract
  • domain assumption An adaptive Otsu/MAD threshold can be applied uniformly across anomaly rates 0.1%–69.2% without dataset-specific retuning
    Stated as part of the automatic calibration claim

pith-pipeline@v0.9.1-grok · 5867 in / 1557 out tokens · 17378 ms · 2026-06-27T07:29:43.852438+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

25 extracted references · 14 canonical work pages

  1. [1]

    Isolation forest,

    F. T. Liu, K. M. Ting, and Z.-H. Zhou, “Isolation forest,” inProc. IEEE Int. Conf. Data Mining (ICDM), 2008, pp. 413–422. DOI: 10.1109/ICDM.2008.17

    work page doi:10.1109/icdm.2008.17 2008

  2. [2]

    Extended isolation forest,

    S. Hariri, M. C. Kind, and R. J. Brunner, “Extended isolation forest,” IEEE Trans. Knowledge Data Eng., vol. 33, no. 4, pp. 1479–1489, 2021. DOI: 10.1109/TKDE.2019.2947676

    work page doi:10.1109/tkde.2019.2947676 2021

  3. [3]

    Robust random cut forest based anomaly detection on streams,

    S. Guha, N. Mishra, G. Roy, and O. Schrijvers, “Robust random cut forest based anomaly detection on streams,” inProc. Int. Conf. Machine Learning (ICML), 2016, pp. 2712–2721

    2016

  4. [4]

    On detecting clustered anomalies using SCiForest,

    F. T. Liu, K. M. Ting, and Z.-H. Zhou, “On detecting clustered anomalies using SCiForest,” inProc. European Conf. Machine Learning and Knowledge Discovery in Databases (ECML PKDD), ser. LNCS, vol. 6322, Springer, 2010, pp. 274–290. DOI: 10.1007/978-3-642-15883- 4 18

    work page doi:10.1007/978-3-642-15883- 2010

  5. [5]

    USAD: UnSupervised anomaly detection on multivariate time series,

    J. Audibert, P. Michiardi, F. Guyard, S. Marti, and M. A. Zuluaga, “USAD: UnSupervised anomaly detection on multivariate time series,” inProc. ACM SIGKDD Int. Conf. Knowledge Discovery & Data Mining (KDD), 2020, pp. 3395–3404. DOI: 10.1145/3394486.3403392

    work page doi:10.1145/3394486.3403392 2020

  6. [6]

    TranAD: Deep transformer networks for anomaly detection in multivariate time series data,

    S. Tuli, G. Casale, and N. J. Jennings, “TranAD: Deep transformer networks for anomaly detection in multivariate time series data,” Proc. VLDB Endow., vol. 15, no. 6, pp. 1201–1214, 2022. DOI: 10.14778/3514061.3514067

    work page doi:10.14778/3514061.3514067 2022

  7. [7]

    Anomaly transformer: Time series anomaly detection with association discrepancy,

    J. Xu, H. Wu, J. Wang, and M. Long, “Anomaly transformer: Time series anomaly detection with association discrepancy,” inProc. Int. Conf. Learning Representations (ICLR), 2022

    2022

  8. [9]

    Long short term memory networks for anomaly detection in time series,

    P. Malhotra, L. Vig, G. Shroff, and P. Agarwal, “Long short term memory networks for anomaly detection in time series,” inProc. European Symp. Artificial Neural Networks, Computational Intelligence and Machine Learning (ESANN), Bruges, Belgium, 2015, pp. 89–94

    2015

  9. [10]

    mTSBench: Benchmarking multivariate time series anomaly detection and model selection at scale,

    X. Zhou, C. Brif, and I. Lourentzou, “mTSBench: Benchmarking multivariate time series anomaly detection and model selection at scale,” Transactions on Machine Learning Research, 2026. arXiv:2506.21550

    arXiv 2026

  10. [11]

    TimeSeAD: Benchmarking deep multivariate time-series anomaly detection,

    D. Wagner, T. Michels, F. C. F. Schulz, A. Nair, M. Rudolph, and M. Kloft, “TimeSeAD: Benchmarking deep multivariate time-series anomaly detection,”Transactions on Machine Learning Research, 2023

    2023

  11. [12]

    Detecting Spacecraft Anomalies Us- ing LSTMs and Nonparametric Dynamic Thresholding

    K. Hundman, V . Constantinou, C. Laporte, I. Colwell, and T. Soder- strom, “Detecting spacecraft anomalies using LSTMs and nonparametric dynamic thresholding,” inProc. ACM KDD, 2018, pp. 387–395. DOI: 10.1145/3219819.3219845

    work page doi:10.1145/3219819.3219845 2018

  12. [13]

    A review on outlier/anomaly detection in time series data,

    A. Bl ´azquez-Garc´ıa, A. Conde, U. Mori, and J. A. Lozano, “A review on outlier/anomaly detection in time series data,”ACM Comput. Surv., vol. 54, no. 3, art. 56, pp. 1–33, 2021. DOI: 10.1145/3444690

    work page doi:10.1145/3444690 2021

  13. [14]

    Multiresolution dendritic cell algorithm for network anomaly detection,

    D. Limon-Cantu and V . Alarcon-Aquino, “Multiresolution dendritic cell algorithm for network anomaly detection,”PeerJ Comput. Sci., vol. 7, art. e749, 2021. DOI: 10.7717/peerj-cs.749

    work page doi:10.7717/peerj-cs.749 2021

  14. [15]

    A unified approach to interpreting model predictions,

    S. M. Lundberg and S.-I. Lee, “A unified approach to interpreting model predictions,” inProc. Adv. Neural Inf. Process. Syst. (NeurIPS), 2017, pp. 4765–4774

    2017

  15. [16]

    This looks like that: Deep learning for interpretable image recognition,

    C. Chen, O. Li, C. Tao, A. J. Barnett, J. Su, and C. Rudin, “This looks like that: Deep learning for interpretable image recognition,” inProc. Advances in Neural Information Processing Systems (NeurIPS), vol. 32, 2019, pp. 8928–8939

    2019

  16. [17]

    Robust anomaly detection for multivariate time series through stochastic recurrent neural network,

    Y . Su, Y . Zhao, C. Niu, R. Liu, W. Sun, and D. Pei, “Robust anomaly detection for multivariate time series through stochastic recurrent neural network,” inProc. ACM SIGKDD Int. Conf. Knowledge Discovery & Data Mining (KDD), 2019, pp. 2828–2837

    2019

  17. [18]

    Detecting spacecraft anomalies using LSTMs and nonparametric dynamic thresholding,

    K. Hundman, V . Constantinou, C. Laporte, I. Colwell, and T. Soder- strom, “Detecting spacecraft anomalies using LSTMs and nonparametric dynamic thresholding,” inProc. ACM SIGKDD Int. Conf. Knowledge Discovery & Data Mining (KDD), 2018, pp. 387–395

    2018

  18. [19]

    The impact of the MIT-BIH arrhythmia database,

    G. B. Moody and R. G. Mark, “The impact of the MIT-BIH arrhythmia database,”IEEE Eng. Med. Biol. Mag., vol. 20, no. 3, pp. 45–50, 2001. DOI: 10.1109/51.932724

    work page doi:10.1109/51.932724 2001

  19. [20]

    Toward generating a new intrusion detection dataset and intrusion traffic characterization,

    I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “Toward generating a new intrusion detection dataset and intrusion traffic characterization,” in Proc. 4th Int. Conf. Information Systems Security and Privacy (ICISSP), SciTePress, 2018, pp. 108–116. DOI: 10.5220/0006639801080116

    work page doi:10.5220/0006639801080116 2018

  20. [21]

    CANDI: Curated test- time adaptation for multivariate time-series anomaly detection under distribution shift,

    H. Kim, J. Mok, H. Lee, J. Shin, and S. Yoon, “CANDI: Curated test- time adaptation for multivariate time-series anomaly detection under distribution shift,”arXiv preprint arXiv:2604.01845, 2026

    arXiv 2026

  21. [22]

    Adversarial-robust multivariate time- series anomaly detection via joint information retention (ARTA),

    H. Hojjati and N. Armanfard, “Adversarial-robust multivariate time- series anomaly detection via joint information retention (ARTA),”arXiv preprint arXiv:2603.25956, 2026

    Pith/arXiv arXiv 2026

  22. [23]

    ROCKET: exceptionally fast and accurate time series classification using random convolutional kernels,

    A. Dempster, F. Petitjean, and G. I. Webb, “ROCKET: exceptionally fast and accurate time series classification using random convolutional kernels,”Data Mining and Knowledge Discovery, vol. 34, no. 5, pp. 1454–1495, 2020. DOI: 10.1007/s10618-020-00701-z

    work page doi:10.1007/s10618-020-00701-z 2020

  23. [24]

    MiniRocket: a very fast (almost) deterministic transform for time series classification,

    A. Dempster, D. F. Schmidt, and G. I. Webb, “MiniRocket: a very fast (almost) deterministic transform for time series classification,” inProc. ACM KDD, 2021, pp. 248–257. DOI: 10.1145/3447548.3467231

    work page doi:10.1145/3447548.3467231 2021

  24. [25]

    MultiRocket: multiple pooling operators and transformations for fast and effective time series classification,

    C. W. Tan, A. Dempster, C. Bergmeir, and G. I. Webb, “MultiRocket: multiple pooling operators and transformations for fast and effective time series classification,”Data Mining and Knowledge Discovery, vol. 36, no. 5, pp. 1623–1646, 2022. DOI: 10.1007/s10618-022-00844-1

    work page doi:10.1007/s10618-022-00844-1 2022

  25. [26]

    QUANT: a minimal- ist interval method for time series classification,

    A. Dempster, D. F. Schmidt, and G. I. Webb, “QUANT: a minimal- ist interval method for time series classification,”Data Mining and 12 Knowledge Discovery, vol. 38, no. 4, pp. 2377–2402, 2024. DOI: 10.1007/s10618-024-01036-9. APPENDIX Table VI reports per-dataset branch separation ratiosρ b = ¯sb(anomaly)/¯sb(normal)for all four branches, the auto- configu...

    work page doi:10.1007/s10618-024-01036-9 2024