Papers

The studies behind the numbers, the foundation underneath, and the theorems the machines are named for.

The studies (this repository)

Every number on the landing page traces to a harness in benchmarks/, run strictly causally (scores at time t use observations up to t; no whole-series normalisation) with the protocol documented in each file.

• The Rosenblatt front-end: results log — detector lifts (DSPOT 5.2×, RRCF 1.8×), forecaster lifts (ETS, AutoARIMA, GARCH, GARCH-t, Prophet: ~+2 nats, 161/162 series), the calibration panel (144 clean prefixes, empirical vs nominal false-alarm rates), and the losses reported next to the wins.
• Benchmarking streaming anomaly detection: a verified survey — datasets, metrics, and baselines as of mid-2026, with the known critiques (point-adjust inflation, benchmark flaws) and primary-source verification.
• A journal-style writeup of the front-end and calibration studies is in preparation.

The foundation

• Cotton, P. — skaters: fast online distributional time-series prediction. The body this package's heads stand on: the forecaster, the prediction parade, and the calibrated surprise stream that is the API boundary between the two packages.

The lineage

• A history of the probability integral transform: Fisher's implicit uniforms to Los Alamos, Rosenblatt, Sklar, copulas on Wall Street with David Li as a footnote, z-streams, the parade, and PIT conjugation. One idea, a century of work, on a timeline.

The theorems behind the names

Machines are named for the result that makes them work.

• Wald (1947), Sequential Analysis — deciding as data arrives, with pre-declared error rates; the detection-delay/false-alarm tradeoff. The statistic wald computes each tick, z′Σ⁻¹z, is a Wald test, applied sequentially as Wald invented.
• Rosenblatt (1952), Remarks on a multivariate transformation — the causal bijection z_t = Φ⁻¹(F_t(y_t)) that turns any stream into standard-normal surprises under a calibrated forecaster; the front-end results are this theorem at work (live demo).
• Pickands (1975); Balkema & de Haan (1974) — exceedances over a high threshold follow a Generalized Pareto Distribution whatever the law. The wald null's deep tail is a streaming GPD for exactly this reason; a two-moment bulk fit alone ran 39× the nominal false-alarm rate at 10⁻⁴.
• Hosking & Wallis (1987) — probability-weighted-moments GPD estimation, valid to shape < 1; method of moments cannot exceed ½ and the measured excess tails run ~0.7.
• Page (1954) — CUSUM; the run-length changepoint machinery descends from Wald's SPRT through it. Roadmap head.

Baselines

• Siffer, Fouque, Termier, Largouët (KDD 2017) — Anomaly detection in streams with extreme value theory (SPOT/DSPOT). The other calibrated-threshold streaming detector, and the strongest comparison on the panel; its GPD tail layer is the idea wald gratefully adopted.
• Guha, Mishra, Roy, Schrijvers (ICML 2016) — Robust random cut forest based anomaly detection on streams (RRCF).
• Wu & Keogh (IEEE TKDE 2023) — Current time series anomaly detection benchmarks are flawed — the reason the UCR archive and its protocol anchor the evaluations here.