Segmented Confidence Sequences for Anomaly Detection

• Segmented Confidence Sequences (SCS) is an online, unsupervised framework that uses data-driven segmentation to construct statistically principled confidence intervals in locally stationary segments.
• It applies both Hoeffding-style and empirical standard deviation methods to adaptively set thresholds for anomaly detection while controlling for time-uniform Type I errors.
• The framework improves reliability over fixed thresholds, as demonstrated by enhanced true positive rates in scenarios such as sensor monitoring and manufacturing process control.

Segmented Confidence Sequences (SCS) is an online, unsupervised framework devised for robust anomaly detection in nonstationary time series. SCS employs statistically principled confidence sequences within locally stationary segments, where the segmentation is data-driven and adapts to evolving regimes. The construction yields locally adaptive thresholds maintaining time-uniform Type I error control, thereby improving reliability over fixed or globally adaptive thresholds in the presence of regime shifts, concept drift, or multi-scale distributional changes (Li et al., 8 Aug 2025).

1. Definitions and Mathematical Framework

Let $\{x_1,x_2,\ldots\}$ denote a stream of real-valued anomaly-scores (such as reconstruction errors), indexed by $t=1,2,\ldots$. Each $x_t$ is assumed bounded: $a \leq x_t \leq b$. The timeline is partitioned into $K$ non-overlapping segments with breakpoints $$0 = \tau_0 < \tau_1 < \tau_2 < \dots < \tau_K = \infty$$, so segment $k$ covers $t\in(\tau_{k-1},\tau_k]$. Within each segment $k$, define the local sample mean $\bar{x}_t^{(k)} = S_t^{(k)}/n_t^{(k)}$ where $t=1,2,\ldots$0 and $t=1,2,\ldots$1.

A confidence sequence (CS) for the (unknown) segment mean $t=1,2,\ldots$2 is a sequence of intervals $t=1,2,\ldots$3 constructed so that

$t=1,2,\ldots$4

where $t=1,2,\ldots$5 is the error allocated to segment $t=1,2,\ldots$6, with $t=1,2,\ldots$7. An anomaly at time $t=1,2,\ldots$8 is flagged if $t=1,2,\ldots$9 lies outside $x_t$0 for its current segment and, optionally, also fails a global percentile filter.

2. Construction of Confidence Sequences and Segmentation

2.1. Confidence Sequence Formulas

For $x_t$1 and error $x_t$2 per segment, the nonparametric Hoeffding-style confidence sequence for $x_t$3 at time $x_t$4 is

$x_t$5

Alternatively, use empirical standard deviation $x_t$6 and a scaling coefficient $x_t$7:

$x_t$8

with $x_t$9 chosen by threshold-dependent rules. Then set $a \leq x_t \leq b$0, $a \leq x_t \leq b$1.

2.2. Segmentation Algorithms

Two segmentation strategies are provided:

• APCA (Adaptive Piecewise Constant Approximation):
  • For a window $a \leq x_t \leq b$2, candidate splits at $a \leq x_t \leq b$3 minimize $a \leq x_t \leq b$4.
  • Splits accepted if $a \leq x_t \leq b$5.
  • Segmentation halts at minimal segment length or if improvement is insufficient. For flat regions (coefficient of variation $a \leq x_t \leq b$6), segments default to size $a \leq x_t \leq b$7.
• K-means Clustering on Sliding-Window Features:
  • Feature extraction: mean, std, median, and skewness per window.
  • Features normalized and clustered into $a \leq x_t \leq b$8 via K-means; failures result in single-segment treatment.

2.3. Composite Anomaly Detection Rule

Anomaly at $a \leq x_t \leq b$9 in segment $K$0 is triggered if $K$1 or $K$2. Optionally, a global percentile filter requires $K$3 where $K$4 is the $K$5-th percentile (e.g., $K$6) of training residuals.

3. Statistical Guarantees

SCS inherits its statistical accuracy from nonparametric confidence-sequence theory [Howard et al., 2021]. For independently sampled $K$7 in a segment, the constructed confidence sequence intervals $K$8 satisfy

$K$9

and by a union bound or error allocation,

$$0 = \tau_0 < \tau_1 < \tau_2 < \dots < \tau_K = \infty$$0

Because segmentation depends only on past data, coverage properties are preserved via optional-stopping arguments, even if segmentation is adaptive.

4. Algorithmic Implementation

The SCS workflow, in high-level pseudocode, is as follows:

1. Offline Segmentation: Segment data via APCA or K-means, as selected.
2. Initialization: For each segment $$0 = \tau_0 < \tau_1 < \tau_2 < \dots < \tau_K = \infty$$1, initialize $$0 = \tau_0 < \tau_1 < \tau_2 < \dots < \tau_K = \infty$$2, $$0 = \tau_0 < \tau_1 < \tau_2 < \dots < \tau_K = \infty$$3, $$0 = \tau_0 < \tau_1 < \tau_2 < \dots < \tau_K = \infty$$4 empirical std of a training window.
3. Online Update: For each $$0 = \tau_0 < \tau_1 < \tau_2 < \dots < \tau_K = \infty$$5:
   • Assign segment $$0 = \tau_0 < \tau_1 < \tau_2 < \dots < \tau_K = \infty$$6 by $$0 = \tau_0 < \tau_1 < \tau_2 < \dots < \tau_K = \infty$$7.
   • Update statistics ($$0 = \tau_0 < \tau_1 < \tau_2 < \dots < \tau_K = \infty$$8, $$0 = \tau_0 < \tau_1 < \tau_2 < \dots < \tau_K = \infty$$9, $k$0).
   • Compute bound width by Hoeffding or empirical std formula.
   • Flag anomaly if $k$1 outside $k$2 and, if enabled, $k$3 percentile threshold.

Computational Complexity:

• Segmentation: APCA is worst-case $k$4, typically $k$5 with pruning; K-means is $k$6 per iteration on windowed features.
• Online update: $k$7 per data point.
• Memory: Requires storing segment boundaries and per-segment aggregates.

5. Parameterization and Operational Considerations

• Confidence Level ($k$8): Common choices are 0.05 or 0.01. Lower $k$9 yields wider bounds, fewer false alarms, and lower sensitivity.
• APCA Improvement Thresholds: Typical values are 0.7 for high variance, 0.5 for moderate variance. Minimum segment length of $t\in(\tau_{k-1},\tau_k]$0 or $t\in(\tau_{k-1},\tau_k]$1.
• Boundedness: Enforce or approximate $t\in(\tau_{k-1},\tau_k]$2 by truncation or winsorization.
• Empirical $t\in(\tau_{k-1},\tau_k]$3 Updates: Can employ Welford’s algorithm for online updates.
• Global Percentile Filter: Values like $t\in(\tau_{k-1},\tau_k]$4 provide robustness against local fluctuations; can be disabled to maximize recall at the expense of precision.
• Assumptions: Within each segment, scores are approximately stationary and independent (or weakly dependent).

6. Empirical Benchmarks and Comparative Results

Evaluation was performed on 151 inline semiconductor sensor traces with approximately 10% defective wafers. The baseline used a fixed 99th-percentile residual threshold. Key SCS results are presented below (Δ relative to baseline):

Method	ΔPrecision	ΔRecall	ΔF1-Score
SCS APCA ($t\in(\tau_{k-1},\tau_k]$5)	–0.3282	+3.9952	+1.9074
SCS KMEANS ($t\in(\tau_{k-1},\tau_k]$6)	–0.3999	+1.6643	+0.9262
SCS APCA ($t\in(\tau_{k-1},\tau_k]$7)	–0.4290	+6.1595	+2.1289
SCS KMEANS ($t\in(\tau_{k-1},\tau_k]$8)	–0.4656	+3.3286	+1.4148

Anomaly counts at $t\in(\tau_{k-1},\tau_k]$9:

Method	TP	TN	FP	FN
Baseline (99th pct)	6	1608	12	137
SCS APCA ($k$0)	30	1516	104	113
SCS KMEANS ($k$1)	16	1556	64	127

Key findings include a fivefold increase in true positives with SCS APCA ($k$2 vs $k$3), raising recall from ~4% to ~30%, and an F1-score roughly doubling relative to the baseline for $k$4 and more than doubling for $k$5. The percentile filter improves precision at the expense of recall, while K-means segmentation produces slightly less aggressive segmentation than APCA and avoids short segments in smooth series (Li et al., 8 Aug 2025).

7. Context, Related Work, and Applications

SCS provides statistically rigorous local adaptation for anomaly detection in nonstationary time series where global or fixed-threshold approaches are rendered inadequate by distributional drift or regime changes. The framework is unsupervised, suitable for settings with scarce labeled anomalies, and is designed for applications such as manufacturing process control, IT infrastructure monitoring, and sensor data streams.

SCS builds conceptually on the theory of confidence sequences for time-uniform, nonparametric inference [Howard et al., 2021], online segmentation methods such as APCA [Keogh et al., 2001], and builds upon work in sequential quantile estimation under concept drift [Wang et al., 2023]. Its guarantee of explicit, interpretable false alarm rates and empirically validated reliability makes it appropriate for high-stakes or automated monitoring scenarios (Li et al., 8 Aug 2025).