# Witnesses Explain Anomalies

arXiv: https://arxiv.org/abs/2609.03826 · HTML: https://mlsanity.com/paper/2609.03826/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 19 of its 50 references that are in the map.
- First posted on arXiv 3 Sep 2026.

## Builds on (most cited first, 19 of 19)

- [A Unified Approach to Interpreting Model Predictions](https://mlsanity.com/paper/1705.07874/) (2017)
- ["Why Should I Trust You?": Explaining the Predictions of Any Classifier](https://mlsanity.com/paper/1602.04938/) (2016)
- [RISE: Randomized Input Sampling for Explanation of Black-box Models](https://mlsanity.com/paper/1806.07421/) (2018)
- [ADBench: Anomaly Detection Benchmark](https://mlsanity.com/paper/2206.09426/) (2022)
- [PyOD: A Python Toolbox for Scalable Outlier Detection](https://mlsanity.com/paper/1901.01588/) (2019)
- [TranAD: Deep Transformer Networks for Anomaly Detection in Multivariate Time Series Data](https://mlsanity.com/paper/2201.07284/) (2022)
- [Fast Differentiable Sorting and Ranking](https://mlsanity.com/paper/2002.08871/) (2020)
- [ECOD: Unsupervised Outlier Detection Using Empirical Cumulative Distribution Functions](https://mlsanity.com/paper/2201.00382/) (2022)
- [COPOD: Copula-Based Outlier Detection](https://mlsanity.com/paper/2009.09463/) (2020)
- [Differentiable Ranks and Sorting using Optimal Transport](https://mlsanity.com/paper/1905.11885/) (2019)
- [On Diffusion Modeling for Anomaly Detection](https://mlsanity.com/paper/2305.18593/) (2023)
- [LUNAR: Unifying Local Outlier Detection Methods via Graph Neural Networks](https://mlsanity.com/paper/2112.05355/) (2021)
- [LSCP: Locally Selective Combination in Parallel Outlier Ensembles](https://mlsanity.com/paper/1812.01528/) (2018)
- [Explaining Anomalies Detected by Autoencoders Using SHAP](https://mlsanity.com/paper/1903.02407/) (2019)
- [Shapley Values of Reconstruction Errors of PCA for Explaining Anomaly Detection](https://mlsanity.com/paper/1909.03495/) (2019)
- [PIDForest: Anomaly Detection via Partial Identification](https://mlsanity.com/paper/1912.03582/) (2019)
- [Interpretable Anomaly Detection with DIFFI: Depth-based Isolation Forest Feature Importance](https://mlsanity.com/paper/2007.11117/) (2020)
- [TabADM: Unsupervised Tabular Anomaly Detection with Diffusion Models](https://mlsanity.com/paper/2307.12336/) (2023)
- [Unsupervised Symbolic Anomaly Detection](https://mlsanity.com/paper/2603.17575/) (2026)

## Abstract (arXiv)

Unsupervised anomaly detection scores each point of an unlabelled, contaminated sample in a single pass, and increasingly must also explain why a point is flagged. Yet the dominant detectors give a score with no account of which features drive it, and explanations are bolted on post-hoc with SHAP or LIME, which re-query the detector thousands of times per point and only approximate it. We introduce WAND, an unsupervised tabular anomaly detector that is explainable by design. WAND organises its computation around directions on the unit sphere, scoring each point by how far its projection escapes a sub-Gaussian extreme-value baseline. The originality of our approach is that the witness directions that flag a point, being vectors in feature space, are its explanation, a per-feature attribution obtained at no cost over scoring and, since the score is differentiable, recoverable by gradients. Scoring is linear in the sample size, and a probe-efficiency bound guarantees every anomaly a witness, hence an explanation. Across 47 ADBench datasets WAND attains the best mean Friedman rank at ROC-AUC parity with 16 unsupervised baselines, so the gain is interpretability at no accuracy cost; its native explanations are more accurate and faithful than post-hoc SHAP/LIME and ECOD at a fraction of the query cost. WAND is thus a practical, interpretable solution for explainable anomaly detection.