A new method makes anomaly detection explain itself for free

Anomaly detectors are good at telling you something is wrong and bad at telling you why. A model flags a transaction or a sensor reading as an outlier, and the score alone doesn't say which feature drove that call. Teams that need a reason bolt on SHAP or LIME after the fact, and both work by re-running the detector thousands of times per flagged point to approximate an explanation.

A new paper on arXiv proposes skipping that step. WAND scores a point by measuring how far its projection strays from a sub-Gaussian extreme-value baseline. Because that measurement already happens in feature space, the same directions that produced the anomaly score double as the per-feature explanation. No extra detector queries, no approximation step.

The paper tested this across 47 datasets from ADBench, a standard benchmark suite for anomaly detection, and WAND posted the best mean Friedman rank on ROC among the methods compared.

That's a real result on accuracy, but it's a different claim than "the explanation is good." ROC rank tells you the anomaly score works. It says nothing about whether the projection direction attached to that score matches what a human investigator would call the cause. SHAP and LIME are slow and approximate, but they're built around a specific, debated definition of feature attribution. WAND's attribution comes from the geometry of the detector itself, and the paper's benchmark doesn't test whether that geometry lines up with human judgment about causes.

Fraud and intrusion detection systems get the clearest benefit: the same accuracy, zero added cost for explanations. Whether an auditor accepts "this point's projection deviated most strongly along these three axes" as a reason is a separate question the paper doesn't answer.