1 Introduction↩︎

Detecting abnormal patterns in time-series data is a critical problem in applications such as industrial process monitoring, healthcare diagnostics, and cyber–physical systems, where timely and interpretable decisions are essential [1]–[4]. Beyond identifying when anomalies occur, practitioners often require explanations that justify why a region is anomalous, e.g., to diagnose failure modes and support downstream decision-making. However, existing time-series anomaly detection methods focus exclusively on numeric scores or binary labels [5]–[8], offering limited interpretability and little insight into why a particular interval was flagged as anomalous.

Recent advances in Vision–Language Models (VLMs) have demonstrated strong multimodal reasoning capabilities across tasks such as image captioning [9], [10], visual question answering [11], [12], chart understanding [13], [14], and visual instruction following [15], [16]. These models can align visual evidence with natural language explanations and generate step-by-step reasoning in complex visual domains. Despite this progress, applying VLMs to time-series anomaly detection remains challenging. Time-series plots lack explicit object boundaries and spatial structure, requiring models to reason over temporal patterns, periodicity, and deviations rather than discrete visual entities. As a result, general-purpose VLMs applied out of the box often produce coarse, unstable anomaly predictions and ungrounded explanations when faced with time-series data [17]–[19].

A key obstacle to adapting VLMs for time-series anomaly reasoning is the lack of suitable supervision. Public time-series datasets typically provide only anomaly intervals or point-wise labels [5]–[8], without accompanying explanations, which significantly limits the application of supervised fine-tuning. As a result, existing approaches either adopt task-specific detection pipelines without explicit reasoning supervision [20], or attempt to elicit anomaly reasoning from pretrained models through prompting alone [18], [21], [22], leading to limited anomaly localization accuracy in practice. Most existing approaches operate on textual or short time-series inputs and are limited by context window constraints, while only one method supports long time-series.

This work addresses this gap by introducing ****VisAnomBench****, a benchmark for vision–language time-series anomaly reasoning. VisAnomBench is constructed from multiple public benchmarks spanning diverse domains and anomaly types, and augments them with temporally grounded natural-language explanations aligned with anomaly intervals. It enables supervised learning for both interval-level anomaly localization and explanation generation directly from time-series plots.

We introduce VisAnomReasoner, a parameter-efficient VLM fine-tuned on VisAnomBench for reasoning-based time-series anomaly detection. Experimental results show that explanation-augmented supervision enables VisAnomReasoner to achieve more accurate anomaly localization and improved temporal alignment compared to both large general-purpose VLMs and specialized large models across multiple evaluation metrics. The contributions are summarized as follows:

• We formulate time-series anomaly detection as a plot-grounded vision-language reasoning task that jointly requires interval-level localization and structured explanation generation. This formulation moves beyond scalar anomaly scores by evaluating whether models can align visual evidence, temporal boundaries, and natural-language reasoning in a single prediction.

• We introduce VisAnomBench, the first explanation-augmented benchmark for vision-language time-series anomaly reasoning spanning diverse domains and anomaly types. Unlike existing benchmarks that provide only point-wise or interval labels, VisAnomBench pairs anomaly intervals with temporally grounded natural-language rationales, enabling models to learn not only where anomalies occur but also why they are visually and temporally abnormal.

• We introduce VisAnomReasoner, a compact vision-language anomaly reasoning model, and evaluate its performance against 15 baselines. Despite its small scale, VisAnomReasoner consistently outperforms general-purpose VLMs, specialized LLM/VLM anomaly detectors, time-series foundation models, and classical detectors, improving precision and F₁ by at least 21.23 and 23.87 percentage points on VisAnomBench and achieving strong cross-benchmark generalization on TSB-AD-U. Ablation studies show that reasoning supervision improves anomaly localization and explanation quality, with VisAnomReasoner explanations preferred over the base model in 69.6% of cases.

2 Related Work↩︎

LLMs for Time-Series Reasoning and Modeling. Recent work has explored using large language models for time-series reasoning and question answering by encoding time series as text or symbolic representations. ChatTS [23] and AXIS [24] study conversational analysis and Q&A over time-series data, while Time-MQA [25] introduces a multi-task benchmark that includes anomaly-related questions. Time-RA [26] similarly encodes short time series as text and formulates anomaly detection as a true-or-false reasoning task, without supporting precise anomaly localization in time series.

A parallel line of work adapts LLMs for time-series forecasting and classification by modeling sequences as text or tokens [19], [27]–[31]. These approaches are constrained by context window limits and cannot scale to long time series with thousands of observations without preprocessing, which introduces additional challenges such as information loss and fragmented temporal context. Consequently, existing LLM-based time-series methods offer limited support for real-world anomaly detection settings that demand long-horizon analysis, accurate localization of anomaly intervals, and interpretable, visually grounded explanations for detected anomalies.

VLMs and Multimodal Models for Anomaly Detection. An emerging direction addresses the limitations of text-based time-series input by operating directly on visual representations, where plots expose trends, periodicity, and deviations that naturally support anomaly detection via visual reasoning. Early work in this direction encodes short time-series windows with a vision encoder and relies on large VLMs, such as GPT-4o, to identify anomalous regions [20]. Complementary studies benchmark open-source and proprietary multimodal models on time-series anomaly detection tasks, showing that out-of-the-box performance remains inconsistent and often unstable [17].

Other approaches explore prompt-based strategies to guide anomaly detection, for example by injecting explicit time-index information [18], [21], [22], but these methods are typically constrained to short sequences due to context window limitations. These works highlight the promise of visual reasoning for time-series anomaly detection, but existing benchmarks do not support models that jointly perform interval-level localization and produce plot-consistent explanations. To this end, we introduce VisAnomBench, an explanation-augmented benchmark that enables learning through reasoning traces, allowing models to jointly learn accurate anomaly localization and plot-consistent explanations.

3 VisAnomBench Time-Series Anomaly Reasoning Benchmark↩︎

Existing benchmarks for time-series anomaly detection typically provide only anomaly locations, without explanations describing how or why the labeled regions are anomalous [5], [8], [32], [33]. This limits their suitability for task-specific adaptation of vision–language models, which require explanatory supervision for better contextual explanation of anomalies. To address this limitation, we introduce VisAnomBench, which augments four public time-series anomaly detection benchmarks with temporally grounded natural-language explanations aligned with annotated anomaly intervals.

For each input pair \((I(x), C)\), where \(I(x)\) is a time-series plot and \(C\) denotes optional contextual information, a VLM produces a structured output consisting of: (1) a set of predicted anomaly intervals, \(A\), enclosed by an <anomaly> tag, and (2) a step-by-step explanation, \(E\!=\!\{\epsilon_k\}_{k=1}^{K},\) where each \(\epsilon_k\) is a numbered reasoning statement (e.g.,Step 1: ...), enclosed by a <think> tag.

What constitutes an anomaly varies across domains and application contexts. For instance, brief spikes may be expected in noisy telemetry data, while gradual trend deviations or prolonged level shifts are of primary interest. To account for this variability, ground-truth anomaly intervals are provided during explanation elicitation, guiding models to produce explanations that are temporally grounded in the visualization and aligned with the intended semantic definition of abnormality. Further details on dataset construction are provided in Appendix 9.

VisAnomBench is constructed in four stages: (i) segment public time series into plot-renderable windows with valid anomaly intervals; (ii) render each segment as an image with axis labels and optional context; (iii) elicit structured anomaly decisions and reasoning traces from multiple large VLMs; and (iv) select the highest-quality candidate using a reward that combines interval accuracy, visual groundedness, axis awareness, and clarity.

3.1 Reward-Guided Explanation Selection↩︎

For each time series, we construct a pool of candidate structured outputs using four general-purpose VLMs. Each generated output \((A, E)\) is evaluated using a composite reward function \[\setlength{\abovedisplayskip}{6pt} \setlength{\belowdisplayskip}{6pt} \begin{align} \mathcal{R}(A, E) =\;& \lambda_{\text{ano}} \mathcal{S}_{\text{ano}}(A, \mathcal{A}^\star) + \lambda_{\text{vis}} \mathcal{S}_{\text{vis}}(E) \\ &+ \lambda_{\text{axi}} \mathcal{S}_{\text{axi}}(E) + \lambda_{\text{cla}} \mathcal{S}_{\text{cla}}(E), \end{align}\] where \(\{\lambda_{\alpha}\}\) are weighting coefficients.

 Anomaly Accuracy. \(\mathcal{S}_{\text{ano}}(A, \mathcal{A}^\star)\) is a length-weighted, range-based F₁ score that measures temporal overlap between predicted and ground-truth anomaly intervals. It rewards coverage of true anomaly ranges while penalizing missed anomalies and overextended predictions.

 Visual Groundedness. \(\mathcal{S}_{\text{vis}}(E)\) measures how well the reasoning explicitly references temporal patterns that are directly observable in the plot (e.g., spikes, drops, or level shifts), as judged from the same input.

 Axis Awareness. \(\mathcal{S}_{\text{axi}}(E)\) evaluates whether timestamps, indices, and value ranges in the reasoning are consistent with the plot axes, penalizing hallucinated or unsupported numerical claims.

 Clarity. \(\mathcal{S}_{\text{cla}}(E)\) assesses whether the reasoning is logically ordered, non-redundant, and clearly links visual observations to the final anomaly decision in a coherent and interpretable manner.

For each time series, we retain only the candidate with the highest reward as the supervision target for supervised fine-tuning of VisAnomReasoner. Additional details are provided in Appendix 9.1.1.

3.2 Dataset Composition and Statistics↩︎

Time series in VisAnomBench are drawn from four public anomaly detection benchmarks: KPI [34], GutenTAG [32], UCR-EGI [35], and UCR-TSAD [33]. The collection comprises both real-world and synthetic time series, covering diverse domains, anomaly types, and temporal characteristics. Overall dataset statistics are summarized in Table [tab:dataset95stats]. In total, VisAnomBench contains 2,576 training time series and 740 held-out test time series, with a strictly disjoint test set used exclusively for evaluation.

4 VisAnomReasoner Model↩︎

VisAnomReasoner is a parameter-efficient VLM designed for reasoning-based time-series anomaly detection from plots. Unlike prior approaches that rely on prompt engineering to detect anomalies, VisAnomReasoner directly predicts anomaly intervals and generates grounded explanations. Prior approaches [18], [21], [22] often depend on extensive prompt engineering and external proprietary models to infer anomalies from visual inputs. In contrast, VisAnomReasoner leverages explanation-augmented supervision from VisAnomBench, where each training example specifies both target anomaly intervals and a preferred reasoning trace aligned with visual evidence.

Consider a univariate time series \(x=\{x_1,\ldots,x_T\}\in\mathbb{R}^T\), where \(x_t\) denotes the observed value at timestamp \(t\). Let the ground-truth anomalies be a set of \(m\) temporal intervals \(\mathcal{A}^\star=\{(s_i^\star,e_i^\star)\}_{i=1}^{m}\), \(1\le s_i^\star<e_i^\star\le T\). The objective of time-series anomaly detection is to localize anomalous intervals by predicting a set \(A=\{(s_i,e_i)\}_{i=1}^{\hat{m}}\). We formulate time-series anomaly detection as a vision–language reasoning task that jointly localizes anomalies and explains them from a plotted rendering of the series. Given a time-series plot \(I(x)\) and optional contextual information \(C\), a vision–language model \(\mathcal{M}_\theta\) outputs predicted anomaly intervals \(A\) and a natural-language explanation \(E\): \[\setlength{\abovedisplayskip}{6pt} \setlength{\belowdisplayskip}{6pt} (I(x),C)\xrightarrow{\;\mathcal{M}_\theta\;}(A,E),\] where \(E\) is grounded in visual evidence, such as spikes, level shifts, or periodic deviations.

Unlike conventional methods that output anomaly scores or point-wise labels [7], and prior LLM- and VLM-based approaches that cast anomaly detection as classification or question answering [23], [24], [28], our formulation explicitly couples interval-level localization with an interpretable explanation \(E\) grounded in observable visual patterns. We optimize \(\mathcal{M}_\theta\) using supervised fine-tuning of the Qwen2.5-VL-3B and Qwen2.5-VL-7B base models [36] on our curated VisAnomBench training set, resulting in the 3B and 7B variants of VisAnomReasoner, respectively. During training, the model is supervised to generate structured outputs containing <anomaly> tags for anomaly decisions, <index> tags for interval localization, and <think> tags for reasoning traces.

5 Experiments↩︎

We evaluate VisAnomReasoner’s ability to localize anomalies in time-series plots and generate interpretable explanations against baseline models.

Datasets. We conduct experiments on (1) the test portion of VisAnomBench and (2) TSB-AD-U [37], a widely used benchmark for anomaly detection with time series from various domains.

Baselines. We benchmark VisAnomReasoner against five categories of baseline models. For both general large VLMs and small VLMs, we use the same prompting setup as in VisAnomReasoner to ensure a fair comparison. Detailed descriptions of all baseline models are provided in Appendix 10.

General Large VLMs. This category includes powerful frontier general-purpose VLMs, such as Grok-4-Fast [38] and LLaMA 4 Maverick [39].

Small VLMs. These are lightweight open-source models such as Qwen2.5-VL-7B [36], Idefics3-8B [40], SmolVLM-7B [41], and LLaVA-7B [11].

Foundation Models. This group contains foundation models proposed for time-series anomaly detection or time-series analysis more broadly, such as TimesFM [42] and Chronos [43].

Specialized Large Models. This baseline set comprises models developed or adapted for time-series anomaly detection, which are AnomLLM [18], LLM-TSAD [21], LLMAD [22], and VLM4TS [20].

Classical Detectors. This category comprises established anomaly detection methods from the time-series literature, such as Sub-PCA [44], Matrix Profile [45], and Isolation Forest (IForest) [46].

Evaluation Metrics. For VisAnomBench, anomaly detection performance is evaluated at the interval level using Precision, Recall, and F₁ score metrics [47]. A predicted interval is counted as a true positive (TP) if it overlaps with a ground-truth interval (if multiple predicted intervals overlap with the same ground-truth interval, only one TP is counted); a predicted interval is counted as a false positive (FP) if it does not overlap with any ground-truth interval; a ground-truth interval is counted as a false negative (FN) if it does not overlap with any predicted interval. The Overlap score quantifies the temporal alignment between predicted and ground-truth anomaly intervals. It penalizes both under-coverage and over-extension of predicted intervals relative to the ground truth.

For the TSB-AD-U benchmark, following established practice [18], we report both standard metrics (including Precision, Recall, and F₁) and respective affiliation metrics [48]. Standard metrics emphasize point-wise correctness and impose strict penalties for boundary misalignment. In contrast, affiliation metrics operate at the event level and emphasize temporal association between predicted and ground-truth anomaly intervals, allowing tolerance to boundary imprecision. Additional details about the evaluation metrics are provided in Appendix 11.

5.1 Experimental Results↩︎

5.1.1 Results on VisAnomBench↩︎

Table [tab:anom95results] reports interval-level anomaly detection performance on VisAnomBench. Across all evaluation metrics, VisAnomReasoner consistently outperforms general large VLMs, small VLMs, specialized large models, foundation models, and classical anomaly detectors. Both the 3B and 7B variants achieve the highest Precision, Recall, F₁, and Overlap scores, indicating strong performance in both anomaly identification and temporal localization.

Precision–Recall Trade-offs. Many baseline methods achieve higher recall by flagging large portions of the time series as anomalous, leading to substantially inflated FP counts. In particular, large general-purpose VLMs such as Grok-4-Fast [38] and LLaMA-4-Maverick [39] recover a sizable fraction of true anomalies, with recall values of 31.88% and 58.23%. However, this recall is achieved at the cost of excessive FPs: these models produce at least 837 FPs, which is more than twice the number of true anomalies they correctly identify. As a result, precision remains below 28.15%, and F₁ scores do not exceed 37.96%. This over-flagging behavior is further reflected in low overlap scores of 3.26% and 12.92%, which are at least 14.15 percentage points (pp) lower than those achieved by the VisAnomReasoner 3B variant, indicating that predicted anomaly intervals are often overly long or weakly aligned with true anomaly boundaries.

Small VLMs, including Qwen2.5-VL-7B [36], Idefics3-8B [40], and SmolVLM-7B [41], further exacerbate this issue. They all suffer from low precision and overlap due to aggressive over-flagging and limited reasoning capacity. For example, Qwen2.5-VL-7B, the strongest baseline in this category, correctly identifies 517 anomaly intervals but also produces 1,784 FPs. This over-detection substantially degrades precision and boundary quality, yielding precision, F₁, and overlap scores that are 49.62 pp, 40.15 pp, and 11.31 pp lower than those achieved by VisAnomReasoner (7B) across the three metrics, respectively.

Foundation models such as TimesFM [42] and Chronos [43], which adapt forecasting error for anomaly detection, exhibit fewer FPs (approximately 500). However, this behavior is largely driven by the evaluation protocol, which flags only the top 5% of points with the highest anomaly scores. Even under this favorable constraint, their precision remains roughly 20 pp lower than that of classical anomaly detectors such as Sub-PCA [44], Matrix Profile [45], and IForest [46], which are evaluated under the same protocol. Among classical methods, IForest stands out as the strongest traditional baseline, achieving the second-best result on three of the seven reported evaluation metrics overall.

Among specialized large models, most approaches rely on different prompting strategies with GPT-4o and consistently exhibit oversensitivity to temporal fluctuations [18], [21], [22]. LLM-TSAD is particularly affected, producing over 5,000 FPs, indicating severe over-flagging and resulting in precision as low as 7.82%. VLM4TS, the strongest specialized model for time-series anomaly detection, detects 129 fewer true anomaly intervals and misclassifies 402 more normal intervals as anomalous compared to the VisAnomReasoner 3B variant, resulting in over 20 pp lower precision and F₁ score. In summary, VisAnomReasoner variants detect the largest number of anomaly intervals while producing the fewest FP predictions, with the 7B variant achieving at least 23.17 pp and 25.64 pp higher precision and F₁ score, respectively, than any of the baseline methods.

Temporal Boundary Localization. The Overlap score quantifies temporal boundary localization by penalizing both missed coverage and excessive extension of predicted anomaly intervals. As shown in the last column of [tab:anom95results], this criterion is challenging: 10 methods score below 15%, and seven fall below 5%, indicating widespread difficulty in localizing anomaly boundaries. In contrast, the VisAnomReasoner variants achieve the highest overlap scores, exceeding all baselines by at least 6.26 pp and 4.54 pp for the 3B and 7B variants, respectively. In particular, VisAnomReasoner (7B) attains an overlap improvement of 11 pp compared to Qwen2.5-VL-7B [36], and at least 12.42 pp over the large general-purpose VLMs [38], [39], demonstrating substantially tighter temporal alignment with ground-truth anomaly.

Comparing LLM-TSAD [21] and IForest [46] clearly shows that overlap measures boundary quality rather than anomaly volume. IForest detects only 362 true anomaly intervals yet achieves an overlap score just 0.28 pp lower than LLM-TSAD, which identifies 477 true anomaly along with 5621 FPs. Since the evaluation set contains 740 time series, LLM-TSAD predicts more than seven anomaly intervals per series on average. These excessive predictions are heavily penalized by the overlap metric, yielding boundary alignment comparable to a far more conservative anomaly detector overall.

5.1.2 Results on TSB-AD-U↩︎

Results in [tab:tsbadu] compare VisAnomReasoner with existing methods across six evaluation metrics on the public benchmark TSB-AD-U, which contains time series with unseen characteristics and anomaly definitions. Compared to large VLMs, such as LLaMA-4-Maverick [39], VisAnomReasoner (7B) performs best on all six metrics, with precision and F₁ improving by about 10 pp or more. This result indicates that fine-tuning on VisAnomBench enables VisAnomReasoner to learn transferable anomaly detection capabilities that generalize to novel time-series patterns, reaching performance better than or comparable to a large model despite its substantially smaller scale.

Qwen2.5-VL-7B [36] attains the highest standard precision (66.18%) and standard F₁ (49.52%) among all baselines, as well as the highest standard recall (48.85%) among the small VLM baselines. Nevertheless, VisAnomReasoner (7B) improves all three metrics by 9.57 pp, 12.06 pp, and 13.39 pp for standard precision, recall, and F₁, respectively. The advantage of VisAnomReasoner (7B) over Qwen2.5-VL-7B in affiliation precision, recall, and F₁ is also substantial, with gains of 19.37 pp, 6.58 pp, and 11.22 pp, respectively. The largest improvement is in affiliation precision, indicating that VisAnomReasoner avoids excessive anomaly flagging and thereby reduces FPs.

A similar pattern is observed for the foundation models TimesFM [42] and Chronos [43]. While both models obtain high standard and affiliation recall, the best of them (Chronos) has standard and affiliation precision approximately 30 pp and 20 pp lower than those of VisAnomReasoner, respectively. This large precision gap indicates systematic over-flagging, which can overwhelm users with false alarms and limit practical usefulness despite strong recall performance.

Performance of specialized large models that rely on GPT-4o for decision making varies widely, with AnomLLM typically being the the worst one among these baselines. Still, all of them underperform relative to VisAnomReasoner across all six metrics. Notably, they mostly lag behind large general-purpose VLMs such as LLaMA-4-Maverick [39], which are evaluated under the same prompting strategy as VisAnomReasoner. This observation raises questions about the effectiveness of task-specific prompting strategies proposed by these methods [18], [21], [22].

Classical anomaly detectors perform worst overall, highlighting their limited robustness to the diverse time-series characteristics present in TSB-AD-U, a limitation widely observed in prior work [7].

VisAnomReasoner delivers strong and well-balanced performance across both standard and affiliation metrics, providing empirical evidence that explanation-augmented supervision yields improved generalization and more reliable event-level anomaly detection compared to existing approaches.

6 Qualitative Analysis↩︎

1 presents a qualitative comparison of anomaly detection and reasoning across models on a representative time-series example. VLM4TS [20], a ViT+GPT-4o model designed for time-series anomaly detection, identifies two short intervals and one point as anomalous but provides limited justification and fails to align with the true anomaly region. The predicted intervals correspond to normal variations within the underlying periodic structure, indicating sensitivity to local fluctuations rather than meaningful pattern deviations in the overall temporal behavior. LLMAD [22], the only existing prompting-based method that supports anomaly explanations, predicts as many as 18 anomaly intervals, but only one overlaps with the ground-truth interval. Moreover, the predicted interval covers only about 3% of the true anomalous region, and the accompanying explanation is not aligned with the actual temporal trend in the time-series plot. LLaMA 4 Maverick [39] exhibits similar behavior, predicting eight anomalous points, none of which intersect the ground-truth anomaly region; its explanation remains largely generic and does not reference the observed trend in the time series.

In contrast, VisAnomReasoner produces a tighter anomaly interval that closely matches the ground truth and generates a coherent, step-by-step reasoning trace that links changes in amplitude and pattern to observable deviations in the signal. This illustrates that explanation-augmented supervision enables VisAnomReasoner to achieve more precise localization and better-grounded reasoning than both customized and larger general-purpose VLMs. Additional analysis is in Appendix 12.

7 Ablation Studies↩︎

Effect of Supervised Fine-Tuning. 2 compares the VisAnomReasoner 3B and 7B variants against their respective Qwen2.5-VL base models [36] on VisAnomBench, with percentage gains annotated above each bar. Supervised fine-tuning improves all metrics, with the largest gains in precision, amounting to 180% for 3B and 220% for 7B, which reflects a significant reduction in FPs. In contrast, recall improves only marginally, indicating that fine-tuning primarily reduces FPs rather than substantially increasing anomaly coverage. This pattern is consistent with explanation-augmented supervision emphasizing context-aware discrimination, helping the model distinguish true anomalies from normal variations. Improvements in overlap indicate more accurate temporal boundary localization. These results demonstrate the effectiveness of explanation-augmented supervision, particularly for smaller models, in improving detection quality and localization accuracy.

4pt

Effect of Reasoning Supervision. We evaluate whether the gains come specifically from reasoning supervision rather than from task-specific fine-tuning alone. To this end, we compare three settings: (i) the off-the-shelf pretrained base model, (ii) fine-tuning to predict anomaly intervals only, and (iii) fine-tuning to predict both anomaly intervals and reasoning traces. As shown in 1, interval-only fine-tuning already reduces FPs substantially, but does not recover additional missed anomalies. In contrast, adding reasoning traces improves both precision and recall, indicating that the gains stem not only from task-specific fine-tuning, but specifically from explanation-augmented supervision.

Quality of Explanation. We evaluate the explanation quality by conducting a paired comparison on the 740 test time series in VisAnomBench. For each time series, GPT-4o is given the plot and two explanations, one generated by the base model (Qwen2.5-VL-7B) and one by VisAnomReasoner (7B), and selects the better explanation based on visual groundedness, axis consistency, and clarity. As shown in 3, VisAnomReasoner is preferred in 69.6% of cases, compared with 29.7% for the base model and 0.7% ties.

8 Conclusion↩︎

This work introduces vision-language reasoning over time-series data, where models must align temporal evidence, anomaly intervals, and natural-language explanations in a single prediction. To address the lack of suitable supervision for VLM-based anomaly detection, we curate VisAnomBench, an explanation-augmented benchmark that enables supervised learning of plot-grounded anomaly reasoning, and VisAnomReasoner, a compact VLM trained to jointly localize anomaly intervals and generate visual-temporal explanations. Across VisAnomBench and TSB-AD-U, VisAnomReasoner consistently outperforms general-purpose VLMs, specialized LLM/VLM anomaly detectors, time-series foundation models, and classical methods, with large gains in precision, F₁, and temporal alignment. Ablation studies further show that reasoning supervision substantially reduces FPs, while adding reasoning traces improves both precision and recall over interval-only supervision. Evaluation of the explanation quality by GPT-4o and qualitative results also show that VisAnomReasoner produces more coherent, visually grounded reasoning traces. These results highlight explanation-driven supervision as a practical path toward interpretable, reasoning-centric time-series anomaly detection.

Acknowledgments↩︎

This work was supported by the U.S. Department of Energy, National Nuclear Security Administration, Office of Defense Nuclear Nonproliferation Research and Development, and by the Laboratory Directed Research and Development program at Sandia National Laboratories. Sandia National Laboratories is a multi-mission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC (NTESS), a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration (DOE/NNSA) under contract DE-NA0003525. This written work is authored by an employee of NTESS. The employee, not NTESS, owns the right, title and interest in and to the written work and is responsible for its contents. Any subjective views or opinions that might be expressed in the written work do not necessarily represent the views of the U.S. Government. The publisher acknowledges that the U.S. Government retains a non-exclusive, paid-up, irrevocable, world-wide license to publish or reproduce the published form of this written work or allow others to do so, for U.S. Government purposes. The DOE will provide public access to results of federally sponsored research in accordance with the DOE Public Access Plan.

9 Benchmark Details↩︎

9.1 VisAnomBench↩︎

VisAnomBench is constructed from four public time-series anomaly detection benchmarks: KPI [34], GutenTAG [32], UCR-EGI [35], and the UCR Time Series Anomaly Datasets [33]. These benchmarks span diverse application domains and cover a wide range of anomaly types, sequence lengths, and temporal patterns. To ensure consistency and data quality across sources, a unified preprocessing procedure is applied. Each original time series is segmented to satisfy the following criteria:

• The anomaly ratio does not exceed 10%, with a target range of \((0.01, 0.10)\).

• The anomaly interval is centered between 30% and 70% of the segment length.

• The segment length is at least 200 time steps.

To mitigate the impact of known anomaly mislabeling issues in public datasets [33], we apply an additional verification step using multiple general-purpose large VLMs. Specifically, each candidate time-series segment is rendered as a plot and provided to four independent large VLMs together with the ground-truth anomaly interval indices. The prompt template for obtaining anomaly explanations is shown in 4. Segments for which the majority of models either fail to identify any anomaly or consistently predict substantially different anomaly intervals are excluded from VisAnomBench. This filtering step targets poorly labeled or inconsistent examples, rather than visually difficult cases, and preserves diversity across anomaly types. After filtering, VisAnomBench contains 2,576 training time series and 740 test time series, with sequence lengths ranging from 200 points to over 100K points. As summarized in 2, the train and test splits have mean lengths of 6,882 and 6,259 points, respectively, with average anomaly lengths of 305 and 261, and average anomaly ratios of 5.0% and 4.5%.

7pt

6pt

9.1.1 Candidate Generation and Reward-Based Selection↩︎

For each time-series segment, we construct a pool of candidate structured outputs using four general-purpose VLMs: Grok-4-Fast [38], LLaMA-4-Maverick [39], Gemma-3-27B-IT [49], and Qwen2.5-VL-32B  [36]. Each candidate includes an anomaly decision, predicted anomaly interval(s), and a natural-language reasoning trace. The candidates are ranked according to the composite reward defined in Eq. (2), and the highest-scoring candidate is retained as the supervision target for the corresponding segment. The composite reward consists of an anomaly localization term and three explanation-quality terms. The anomaly localization score is computed from the predicted and ground-truth anomaly intervals. The explanation-quality scores are obtained using Qwen2.5-VL-72B as a judge. Given the plot and generated explanation, the judge assigns scores in \([0,1]\) for visual groundedness, axis awareness, and clarity. The weighting coefficients are set to \(\lambda_{\text{ano}}=0.3\), \(\lambda_{\text{vis}}=0.3\), \(\lambda_{\text{axi}}=0.1\), and \(\lambda_{\text{cla}}=0.3\). This reward-based selection procedure determines the final supervision source for each training series. As shown in 3, the selected supervision comes from all four generator models, with LLaMA-4-Maverick contributing the largest share. The selected outputs are subsequently used for standard supervised fine-tuning of VisAnomReasoner. The judge prompt template for rating time-series anomaly reasoning is presented in 5.

9.1.2 Explanation Quality Evaluation↩︎

Human validation at the full scale of VisAnomBench is impractical because the benchmark contains thousands of time series from multiple domains, which would require domain experts for reliable verification. We manually inspect a random subset of selected and rejected candidates during construction and found that selected explanations were generally more visually grounded, more plot-specific, and more consistent with the labeled anomaly intervals than lower-scoring alternatives. Representative examples are shown in 6.

9.1.3 Effect of Multi-Model Supervision↩︎

Because VisAnomBench is constructed from candidate outputs generated by multiple VLMs, one potential concern is whether synthetic supervision introduces generator-specific bias. To mitigate this, we do not rely on a single generator. Instead, we use four general-purpose VLMs to produce candidate explanations and a separate judge model to rank them with the reward in Eq. (2). As shown in 4, training on VisAnomBench consistently outperforms training on data generated from a single model (specifically, Gemma-3-27B-IT [49]), with fewer false positives and false negatives, resulting in higher precision, recall, and F₁. This suggests that reward-selected supervision from multiple generators provides more diverse and more effective training targets than single-model outputs.

6pt

9.2 TSB-AD-U↩︎

We use the TSB-AD-U benchmark evaluation subset for univariate time-series anomaly detection as in existing works  [18], [21]. The TSB-AD benchmark originally collected 13 univariate and 20 multivariate datasets and, after curation, expanded to 23 univariate and 17 multivariate datasets. Following the TSB-AD evaluation protocol, we select the same eight univariate datasets, listed in 5, for fair comparison with existing models. All experiments on TSB-AD-U in this paper are conducted on this fixed evaluation set.

6pt

10 Model Details↩︎

In this work, we benchmark VisAnomReasoner against a diverse set of baseline models. Details of the foundation models, specialized large models, and classical detectors are described below.

Foundation Models.

• Chronos [43] converts continuous time-series values into discrete tokens via scaling and quantization, then trains a T5-based model with a standard cross-entropy objective for anomaly detection.

• TimesFM [42] pretrains a decoder-only attention model on large-scale time-series data using patch-based inputs, learning general representations applicable to forecasting and anomaly detection.

Specialized Large Models.

• AnomLLM [18] performs anomaly detection by converting time series into textual representations and prompting large language models such as GPT-4 with 21 prompt templates to identify anomalous interval.

• LLM-TSAD [21] extends AnomLLM by explicitly incorporating time-series indices into the prompt and providing trend and residual decompositions of the time series as visual inputs.

• LLMAD [22] relies on carefully structured prompts that encode domain rules, explicit anomaly type definitions, rarity constraints, and step-by-step reasoning instructions, combined with in-context examples to guide LLMs in detecting and explaining anomalies from time-series data.

• VLM4TS [20] segments raw time series into windows and converts them into images for multi-scale feature extraction, producing candidate anomalous intervals; a vision–language model (e.g., GPT-4o) is then prompted to incorporate global temporal context to refine the detections.

Classical Detectors.

• Isolation Forest (IForest) [46] detects anomalies by recursively partitioning the data space using random splits. Samples that can be isolated with fewer splits—corresponding to shorter path lengths in the resulting binary trees—are assigned higher anomaly scores.

• Sub-PCA [44] applies principal component analysis to local subsequences by projecting them into a low-dimensional linear subspace. Subsequences that exhibit large reconstruction errors under this projection are identified as anomalies, reflecting violations of the assumed linear structure.

• Matrix Profile [45], identifies anomalies by measuring the distance between each subsequence and its nearest neighbor within the time series. Subsections with unusually large nearest-neighbor distances are flagged as anomalous, indicating deviation from dominant temporal behavior.

11 Evaluation Metrics↩︎

We evaluate anomaly detection performance using interval-level metrics, including True Positives, False Positives, False Negatives, Precision, Recall, F₁, and the Overlap score. We also report Precision, Recall, and F₁ obtained via the standard point-wise evaluation and the affiliation-based evaluation, where the latter approach accounts for temporal proximity between predicted and ground-truth anomaly intervals.

True Positives, False Positives, and False Negatives. Following [47], let \(\mathcal{A}^\star=\{(s_i^\star,e_i^\star)\}_{i=1}^{m}\), \(1 \le s_i^\star < e_i^\star \le T\) denote the set of ground-truth anomaly intervals, and \(A=\{(s_i,e_i)\}_{i=1}^{\hat{m}}\), \(1 \le s_i < e_i \le T\) denote the set of predicted anomaly intervals.

• True Positives. A predicted interval \((s_j,e_j)\) is counted as a true positive (TP) if it overlaps with a ground-truth interval in \(\mathcal{A}^\star\) (if multiple predicted intervals overlap with the same ground-truth interval, only one TP is counted).

• False Positives. A predicted interval \((s_j,e_j)\) is counted as a false positive (FP) if it does not overlap with any ground-truth interval in \(\mathcal{A}^\star\).

• False Negatives. A ground-truth interval \((s_j^\star,e_j^\star)\) is counted as a false negative (FN) if it does not overlap with any predicted interval in \(A\).

Interval-Based Precision, Recall, and F₁. Using the definitions above for TPs, FPs, and FNs, the Precision, Recall, and F₁ metrics defined at the interval level are: \[\mathrm{Precision} = \frac{N_\mathrm{TP}}{N_\mathrm{TP} + N_\mathrm{FP}} , \quad \mathrm{Recall} = \frac{N_\mathrm{TP}}{N_\mathrm{TP} + N_\mathrm{FN}} , \quad \mathrm{F}_1 = 2\frac{\mathrm{Precision} \cdot \mathrm{Recall}}{\mathrm{Precision} + \mathrm{Recall}} ,\] where \(N_\mathrm{TP}\), \(N_\mathrm{FP}\), and \(N_\mathrm{FN}\) are the counts of all TPs, FPs, and FNs, respectively.

Overlap Score. We report the Overlap score, adapted from the one introduced in [35], which measures temporal alignment between predicted and ground-truth anomalies at the point level. Let \(\mathcal{T}_{\mathcal{A}^\star}\) denote the set of all time points in \(\mathcal{A}^\star\) and \(\mathcal{T}_A\) the set of all time points in \(A\). The Overlap score is defined as \[\label{eq:overlap} \mathrm{Overlap} = \frac{\lvert \mathcal{T}_{\mathcal{A}^\star} \cap \mathcal{T}_A \rvert}{\max\bigl(\lvert \mathcal{T}_{\mathcal{A}^\star} \rvert, \lvert \mathcal{T}_A \rvert\bigr)}.\tag{1}\] The normalization in Eq. 1 discourages trivial solutions that predict excessively long anomaly intervals. The score ranges from \(0\) (no overlap) to \(1\) (perfect temporal alignment).

Standard Precision, Recall, and F₁. For standard point-wise evaluation, the anomaly detection task is cast as a binary classification problem at the timestamp level. Each timestamp is labeled as either anomalous (1) or normal (0), and Precision, Recall, and F₁ are computed using conventional binary classification definitions.

Affiliation Precision, Recall, and F₁. Affiliation metrics compute event-level Precision, Recall, and F₁ based on the temporal distance between predicted and ground-truth anomalies [48], providing robustness to small misalignments while evaluating whether predictions are correctly affiliated with true anomaly events.

12 Additional Qualitative Examples↩︎

7 presents additional qualitative examples. VLM4TS [20] continues to flag normal regions as anomalous; however, its performance on this example improves, as two of the predicted intervals together cover nearly half of the ground-truth anomaly region. The accompanying explanation partially reflects the trend in the plot, but remains shallow and generic. LLMAD [22] is strongly affected by normal fluctuations in the time series, resulting in 147 predicted anomaly intervals. Its explanation remains weakly grounded and does not correspond to the observed temporal behavior. LLaMA 4 Maverick [39] produces a largely correct anomaly prediction and provides a coherent explanation. However, compared to VisAnomReasoner, its localization is less precise, as it predicts the anomaly onset approximately 1,392 time steps earlier than the ground truth.

13 Comparison with Deep-Learning TSAD Baselines↩︎

We additionally compare VisAnomReasoner with representative deep-learning baselines for time-series anomaly detection (TSAD), covering recurrent, convolutional, autoencoder-based, and transformer-based architectures. As shown in 6, these baselines obtain substantially lower interval-level precision, recall, and F₁ than VisAnomReasoner, when evaluated on VisAnomBench. Among the deep-learning baselines, AE [58] achieves the strongest F₁ score, followed by CNN [5] and Image-Embedding-CAE [59]. Recurrent models such as CS-LSTM [60] and LSTM [5] perform worse, while Anomaly-Transformer has the lowest performance in this setting. These results indicate that standard deep sequence modeling architectures do not directly translate to accurate interval-level localization on this benchmark. In contrast, VisAnomReasoner benefits from task-specific fine-tuning with explanation-augmented supervision and achieves significantly better performance across all evaluation metrics.

6pt

14 Training and Inference Efficiency↩︎

Training efficiency. We fine-tune Qwen2.5-VL-3B and Qwen2.5-VL-7B using supervised next-token prediction on the selected structured outputs. We use LoRA, with 95,178,752 trainable parameters, corresponding to 1.13% of the backbone. Vision encoder parameters are tuned via LoRA [62] adapters, and only the targeted projection modules are updated: q_proj, k_proj, v_proj, o_proj, gate_proj, up_proj, and down_proj. This makes VisAnomReasoner substantially smaller and more efficient than frontier VLM baselines while preserving strong anomaly localization performance across diverse time-series domains and anomaly characteristics.

Inference efficiency. We report the inference efficiency of VisAnomReasoner compared with representative vision-language baselines. VisAnomReasoner requires 16.5 \(\pm\) 2.3 seconds per input series on average, and its runtime is largely insensitive to sequence length because it operates on rendered plots rather than raw sequences. In contrast, VLM4TS [20] exhibits substantially higher latency, taking up to 452.6 seconds per series. Prompting-based methods that rely on GPT-4o, including AnomLLM [18], LLM-TSAD [21], and LLMAD [21], are faster on average (3.8 seconds) but show high variance, with worst-case latency up to 69.5 seconds. They also cannot process sequences longer than 14K points.

Computational Resources. Model training and evaluation were performed on a high-performance computing resource using a single node with NVIDIA H100 GPUs, each with 80 GB of memory. Computation was distributed across four GPU processes on the same node.

15 Limitations↩︎

VisAnomReasoner is currently limited to univariate time series, as it operates on single-channel plots and reasons over visual patterns within a single temporal signal. Performance also depends on the quality of the plotted visualization: the plot must expose a clearly observable trend or deviation, while overly zoomed-in or zoomed-out views may obscure relevant anomaly patterns. This limitation stems from reliance on visual reasoning rather than direct access to raw numerical values. In future work, this constraint could be alleviated by automatically generating plots at multiple temporal resolutions and allowing a vision–language model to identify views in which meaningful trends and anomalies are most clearly expressed. This reliance on visual evidence can also lead to weakly grounded or hallucinated explanations when the anomaly is visually ambiguous or compressed at the rendered scale, suggesting the need for more systematic evaluation of explanation faithfulness. Finally, VisAnomReasoner is trained with supervised fine-tuning only. Reinforcement learning or preference optimization may further improve interval localization and reasoning quality, but requires stable training signals for structured interval predictions. We leave the design of such reward-based optimization methods to future work.

16 Broader Impact↩︎

This work contributes a benchmark and modeling framework for interpretable time-series anomaly detection by enabling joint anomaly localization and explanation from visual representations. By emphasizing explanation-grounded supervision, the proposed approach supports more transparent analysis of anomaly detection results, which may benefit research and practical evaluation in time-series monitoring tasks. The method operates on univariate time-series plots and depends on the quality of visualizations and large pre-trained vision–language models, which may limit applicability in certain settings. This work is intended as a research contribution, and its outputs should be interpreted with appropriate domain knowledge. We do not identify any immediate negative impacts.

References↩︎