Tiny but Trusted: Efficient Vision-Language Reasoning for Time-Series Anomaly Detection

Unknown

Conceptio › Archive › arXiv CS

arXiv CSopen access

Tiny but Trusted: Efficient Vision-Language Reasoning for Time-Series Anomaly Detection

Unknown · 2026 · arxiv_cs

arXiv CS · Papers · License: Open Access · 2026

Open Source ↗Direct PDF ↓

artificialintelligence knowledgerepresentation reasoning

artificial intelligence, reasoning, knowledge representation

Tiny but Trusted: Efficient Vision-Language Reasoning for Time-Series Anomaly Detection 1

Xiaona Zhou , Muntasir Wahed , Tianjiao Yu , Constantin Brif , Ismini Lourentzou {xiaonaz2,mwahed2,ty41,lourent2}@illinois.edu, [email protected] 1

University of Illinois Urbana-Champaign 2

arXiv:2605.30344v1 [cs.AI] 28 May 2026

Sandia National Laboratories

Do you see any anomalies on this plot?

<anomaly>True</anomaly> <index> (16970, 17079) </index> Step 1: The plot shows a time-series signal with ... Step 2: Upon closer inspection, there is a noticeable ... Step 3: By examining the x-axis values, the inverted ...

VisAnomBench VLM4TS

Llama 4 Maverick

TSB-AD-U IForest

VisAnomReasoner

Figure 1: Given a time series plot (left top), VisAnomReasoner locates anomalies while providing details grounded in the plot (left bottom). Experimental results on two benchmarks demonstrate VisAnomReasoner outperforms the strongest baselines by large margins across all metrics (right). Abstract. Recent advances in Vision–Language Models (VLMs) have achieved impressive performance across many tasks, yet prior studies report unsatisfactory performance when applying large language or multimodal models to finding abnormal patterns in sequential data. Public anomaly detection benchmarks typically provide interval annotations but not natural-language rationales, making it difficult to fine-tune VLMs to produce grounded, interpretable decisions. To address this gap, we construct VisAnomBench, a curated benchmark built from public time-series datasets and augmented with high-quality anomaly explanations selected from multiple large VLMs using fine-grained, task-specific rewards. Through fine-tuning on this benchmark, we develop VisAnomReasoner, a parameter-efficient VLM for time-series anomaly detection. Experimental results on VisAnomBench show that VisAnomReasoner achieves more accurate anomaly localization and consistently outperforms all baselines, with improvements of at least 21.23 and 23.87 percentage points in precision and F1 , respectively. Additional experiments on the TSB-AD-U benchmark demonstrate strong cross-benchmark generalization, with VisAnomReasoner improving precision and F1 by 9.57 and 13.39 percentage points, respectively.

https://plan-lab.github.io/projects/VisAnom

1. Introduction Detecting abnormal patterns in time-series data is a critical problem in applications such as industrial process monitoring, healthcare diagnostics, and cyber–

physical systems, where timely and interpretable decisions are essential [6, 11, 42, 54]. Beyond identifying when anomalies occur, practitioners often require explanations that justify why a region is anomalous, e.g., to diagnose failure modes and support downstream

1 decision-making. However, existing time-series anomaly detection methods focus exclusively on numeric scores or binary labels [37, 41, 57, 61], offering limited interpretability and little insight into why a particular interval was flagged as anomalous.

INTRODUCTION

level anomaly localization and explanation generation directly from time-series plots. We introduce VisAnomReasoner, a parameterefficient VLM fine-tuned on VisAnomBench for reasoning-based time-series anomaly detection. Experimental results show that explanation-augmented supervision enables VisAnomReasoner to achieve more accurate anomaly localization and improved temporal alignment compared to both large generalpurpose VLMs and specialized large models across multiple evaluation metrics. The contributions are summarized as follows:

Recent advances in Vision–Language Models (VLMs) have demonstrated strong multimodal reasoning capabilities across tasks such as image captioning [26, 46], visual question answering [20, 30], chart understanding [16, 56], and visual instruction following [27, 39]. These models can align visual evidence with natural language explanations and generate step-by-step reasoning in complex visual domains. Despite this progress, applying VLMs to time-series anomaly detection remains challenging. Time-series plots lack explicit object boundaries and spatial structure, requiring models to reason over temporal patterns, periodicity, and deviations rather than discrete visual entities. As a result, general-purpose VLMs applied out of the box often produce coarse, unstable anomaly predictions and ungrounded explanations when faced with time-series data [45, 53, 62].

(1) We formulate time-series anomaly detection as a plot-grounded vision-language reasoning task that jointly requires interval-level localization and structured explanation generation. This formulation moves beyond scalar anomaly scores by evaluating whether models can align visual evidence, temporal boundaries, and naturallanguage reasoning in a single prediction. (2) We introduce VisAnomBench, the first explanation-augmented benchmark for visionlanguage time-series anomaly reasoning spanning diverse domains and anomaly types. Unlike existing benchmarks that provide only pointwise or interval labels, VisAnomBench pairs anomaly intervals with temporally grounded natural-language rationales, enabling models to learn not only where anomalies occur but also why they are visually and temporally abnormal. (3) We introduce VisAnomReasoner, a compact vision-language anomaly reasoning model, and evaluate its performance against 15 baselines. Despite its small scale, VisAnomReasoner consistently outperforms general-purpose VLMs, specialized LLM/VLM anomaly detectors, timeseries foundation models, and classical detectors, improving precision and F1 by at least 21.23 and 23.87 percentage points on VisAnomBench and achieving strong cross-benchmark generalization on TSB-AD-U. Ablation studies show that reasoning supervision improves anomaly localization and explanation quality, with VisAnomReasoner explanations preferred over the base model in 69.6% of cases.

A key obstacle to adapting VLMs for time-series anomaly reasoning is the lack of suitable supervision. Public time-series datasets typically provide only anomaly intervals or point-wise labels [37, 41, 57, 61], without accompanying explanations, which significantly limits the application of supervised finetuning. As a result, existing approaches either adopt task-specific detection pipelines without explicit reasoning supervision [14], or attempt to elicit anomaly reasoning from pretrained models through prompting alone [31, 38, 62], leading to limited anomaly localization accuracy in practice. Most existing approaches operate on textual or short time-series inputs and are limited by context window constraints, while only one method supports long time-series. This work addresses this gap by introducing VisAnomBench, a benchmark for vision–language time-series anomaly reasoning. VisAnomBench is constructed from multiple public benchmarks spanning diverse domains and anomaly types, and augments them with temporally grounded naturallanguage explanations aligned with anomaly intervals. It enables supervised learning for both interval2

VISANOMBENCH TIME-SERIES ANOMALY REASONING BENCHMARK highlight the promise of visual reasoning for timeseries anomaly detection, but existing benchmarks do not support models that jointly perform intervallevel localization and produce plot-consistent explanations. To this end, we introduce VisAnomBench, an explanation-augmented benchmark that enables learning through reasoning traces, allowing models to jointly learn accurate anomaly localization and plot-consistent explanations.

2. Related Work LLMs for Time-Series Reasoning and Modeling. Recent work has explored using large language models for time-series reasoning and question answering by encoding time series as text or symbolic representations. ChatTS [50] and AXIS [23] study conversational analysis and Q&A over time-series data, while Time-MQA [21] introduces a multi-task benchmark that includes anomaly-related questions. TimeRA [55] similarly encodes short time series as text and formulates anomaly detection as a true-or-false reasoning task, without supporting precise anomaly localization in time series.

3. VisAnomBench Time-Series Anomaly Reasoning Benchmark Existing benchmarks for time-series anomaly detection typically provide only anomaly locations, without explanations describing how or why the labeled regions are anomalous [37, 47, 48, 61]. This limits their suitability for task-specific adaptation of vision–language models, which require explanatory supervision for better contextual explanation of anomalies. To address this limitation, we introduce VisAnomBench, which augments four public time-series anomaly detection benchmarks with temporally grounded natural-language explanations aligned with annotated anomaly intervals.

A parallel line of work adapts LLMs for time-series forecasting and classification by modeling sequences as text or tokens [13, 33, 44, 45, 58, 59]. These approaches are constrained by context window limits and cannot scale to long time series with thousands of observations without preprocessing, which introduces additional challenges such as information loss and fragmented temporal context. Consequently, existing LLM-based time-series methods offer limited support for real-world anomaly detection settings that demand long-horizon analysis, accurate localization of anomaly intervals, and interpretable, visually grounded explanations for detected anomalies.

For each input pair (I(x), C), where I(x) is a timeseries plot and C denotes optional contextual information, a VLM produces a structured output consisting of: (1) a set of predicted anomaly intervals, A, enclosed by an <anomaly> tag, and (2) a step-by-step K explanation, E = {ϵk }k=1 , where each ϵk is a numbered reasoning statement (e.g., Step 1: ...), enclosed by a <think> tag.

VLMs and Multimodal Models for Anomaly Detection. An emerging direction addresses the limitations of text-based time-series input by operating directly on visual representations, where plots expose trends, periodicity, and deviations that naturally support anomaly detection via visual reasoning. Early work in this direction encodes short time-series windows with a vision encoder and relies on large VLMs, such as GPT-4o, to identify anomalous regions [14]. Complementary studies benchmark open-source and proprietary multimodal models on time-series anomaly detection tasks, showing that out-of-the-box performance remains inconsistent and often unstable [53].

What constitutes an anomaly varies across domains and application contexts. For instance, brief spikes may be expected in noisy telemetry data, while gradual trend deviations or prolonged level shifts are of primary interest. To account for this variability, ground-truth anomaly intervals are provided during explanation elicitation, guiding models to produce explanations that are temporally grounded in the visualization and aligned with the intended semantic definition of abnormality. Further details on dataset construction are provided in Appendix A.

Other approaches explore prompt-based strategies to guide anomaly detection, for example by injecting explicit time-index information [31, 38, 62], but these methods are typically constrained to short sequences due to context window limitations. These works

VisAnomBench is constructed in four stages: (i) 3

visual observations to the final anomaly decision in a coherent and interpretable manner.

Table 1: Time-series statistics in VisAnomBench. #TS: number of time series; #Dom: number of domains; AvgLen: average length; AR(%): anomaly ratio; #Expl: number of anomaly explanations; Expl. Len.: average number of words in an explanation. Benchmark

#TS

#Dom

AvgLen

AR(%)

#Expl

Expl. Len.

KPI [51] GutenTAG [47] UCR-EGI [9] UCR-TSAD [48]

160 810 2,097 249

1 10 5 8

1,777 5,000 8,268 2,755

4.3 2.2 5.8 6.9

640 3240 8388 996

170 114 112 112

VISANOMREASONER MODEL

For each time series, we retain only the candidate with the highest reward as the supervision target for supervised fine-tuning of VisAnomReasoner. Additional details are provided in Appendix A.1.1. 3.2. Dataset Composition and Statistics Time series in VisAnomBench are drawn from four public anomaly detection benchmarks: KPI [51], GutenTAG [47], UCR-EGI [9], and UCRTSAD [48]. The collection comprises both real-world and synthetic time series, covering diverse domains, anomaly types, and temporal characteristics. Overall dataset statistics are summarized in Table 1. In total, VisAnomBench contains 2,576 training time series and 740 held-out test time series, with a strictly disjoint test set used exclusively for evaluation.

segment public time series into plot-renderable windows with valid anomaly intervals; (ii) render each segment as an image with axis labels and optional context; (iii) elicit structured anomaly decisions and reasoning traces from multiple large VLMs; and (iv) select the highest-quality candidate using a reward that combines interval accuracy, visual groundedness, axis awareness, and clarity. 3.1. Reward-Guided Explanation Selection

4. VisAnomReasoner Model

For each time series, we construct a pool of candidate structured outputs using four general-purpose VLMs. Each generated output (A, E) is evaluated using a composite reward function ℛ(A, E) = λano 𝒮ano (A, 𝒜 ) + λvis 𝒮vis (E)

VisAnomReasoner is a parameter-efficient VLM designed for reasoning-based time-series anomaly detection from plots. Unlike prior approaches that rely on prompt engineering to detect anomalies, VisAnomReasoner directly predicts anomaly intervals and generates grounded explanations. Prior approaches [31, 38, 62] often depend on extensive prompt engineering and external proprietary models to infer anomalies from visual inputs. In contrast, VisAnomReasoner leverages explanation-augmented supervision from VisAnomBench, where each training example specifies both target anomaly intervals and a preferred reasoning trace aligned with visual evidence.

⋆

+ λaxi 𝒮axi (E) + λcla 𝒮cla (E),

(1)

where {λα } are weighting coefficients. ¢ Anomaly Accuracy. 𝒮ano (A, 𝒜 ) is a lengthweighted, range-based F1 score that measures temporal overlap between predicted and ground-truth anomaly intervals. It rewards coverage of true anomaly ranges while penalizing missed anomalies and overextended predictions. ⋆

Consider a univariate time series x = {x1 , . . . , x T } ∈ T R , where xt denotes the observed value at timestamp t. Let the ground-truth anomalies be a set of ⋆ ⋆ ⋆ m ⋆ m temporal intervals 𝒜 = {(si , ei )}i=1 , 1 ≤ si < ⋆ ei ≤ T. The objective of time-series anomaly detection is to localize anomalous intervals by predictm̂ ing a set A = {(si , ei )}i=1 . We formulate time-series anomaly detection as a vision–language reasoning task that jointly localizes anomalies and explains them from a plotted rendering of the series. Given a time-series plot I(x) and optional contextual infor-

¢ Visual Groundedness. 𝒮vis (E) measures how well the reasoning explicitly references temporal patterns that are directly observable in the plot (e.g., spikes, drops, or level shifts), as judged from the same input. ¢ Axis Awareness. 𝒮axi (E) evaluates whether timestamps, indices, and value ranges in the reasoning are consistent with the plot axes, penalizing hallucinated or unsupported numerical claims. ¢ Clarity. 𝒮cla (E) assesses whether the reasoning is logically ordered, non-redundant, and clearly links 4

5 mation C, a vision–language model ℳθ outputs predicted anomaly intervals A and a natural-language explanation E: ℳθ

(I(x), C) −−−→ (A, E),

EXPERIMENTS

Foundation Models. This group contains foundation models proposed for time-series anomaly detection or time-series analysis more broadly, such as TimesFM [8] and Chronos [2].

(2)

Specialized Large Models. This baseline set comprises models developed or adapted for time-series anomaly detection, which are AnomLLM [62], LLMTSAD [38], LLMAD [31], and VLM4TS [14].

where E is grounded in visual evidence, such as spikes, level shifts, or periodic deviations. Unlike conventional methods that output anomaly scores or point-wise labels [41], and prior LLM- and VLM-based approaches that cast anomaly detection as classification or question answering [23, 50, 58], our formulation explicitly couples interval-level localization with an interpretable explanation E grounded in observable visual patterns. We optimize ℳθ using supervised fine-tuning of the Qwen2.5-VL-3B and Qwen2.5-VL-7B base models [4] on our curated VisAnomBench training set, resulting in the 3B and 7B variants of VisAnomReasoner, respectively. During training, the model is supervised to generate structured outputs containing <anomaly> tags for anomaly decisions, <index> tags for interval localization, and <think> tags for reasoning traces.

Classical Detectors. This category comprises established anomaly detection methods from the timeseries literature, such as Sub-PCA [1], Matrix Profile [28], and Isolation Forest (IForest) [29]. Evaluation Metrics. For VisAnomBench, anomaly detection performance is evaluated at the interval level using Precision, Recall, and F1 score metrics [5]. A predicted interval is counted as a true positive (TP) if it overlaps with a ground-truth interval (if multiple predicted intervals overlap with the same groundtruth interval, only one TP is counted); a predicted interval is counted as a false positive (FP) if it does not overlap with any ground-truth interval; a groundtruth interval is counted as a false negative (FN) if it does not overlap with any predicted interval. The Overlap score quantifies the temporal alignment between predicted and ground-truth anomaly intervals. It penalizes both under-coverage and over-extension of predicted intervals relative to the ground truth.

5. Experiments We evaluate VisAnomReasoner’s ability to localize anomalies in time-series plots and generate interpretable explanations against baseline models.

For the TSB-AD-U benchmark, following established practice [62], we report both standard metrics (including Precision, Recall, and F1 ) and respective affiliation metrics [17]. Standard metrics emphasize point-wise correctness and impose strict penalties for boundary misalignment. In contrast, affiliation metrics operate at the event level and emphasize temporal association between predicted and ground-truth anomaly intervals, allowing tolerance to boundary imprecision. Additional details about the evaluation metrics are provided in Appendix C.

Datasets. We conduct experiments on (1) the test portion of VisAnomBench and (2) TSB-AD-U [32], a widely used benchmark for anomaly detection with time series from various domains. Baselines. We benchmark VisAnomReasoner against five categories of baseline models. For both general large VLMs and small VLMs, we use the same prompting setup as in VisAnomReasoner to ensure a fair comparison. Detailed descriptions of all baseline models are provided in Appendix B. General Large VLMs. This category includes powerful frontier general-purpose VLMs, such as Grok-4Fast [49] and LLaMA 4 Maverick [35].

5.1. Experimental Results 5.1.1. Results on VisAnomBench

Small VLMs. These are lightweight open-source models such as Qwen2.5-VL-7B [4], Idefics3-8B [25], SmolVLM-7B [34], and LLaVA-7B [30].

Table 2 reports interval-level anomaly detection performance on VisAnomBench. Across all evaluation metrics, VisAnomReasoner consistently outperforms 5

EXPERIMENTS

Table 2: Anomaly Detection Performance on VisAnomBench. are General Large VLMs, are Small VLMs, are Foundation Models, are Specialized Large models, are Classical Anomaly Detectors, are VisAnomReasoner variants. Best performance is bold, and second best is underlined. Green arrows (↑) indicate absolute improvement relative to the second best. TP

Precision (%)

Recall (%)

F1 (%)

Overlap (%)

Grok-4-Fast (314B) [49] LLaMA-4-Maverick (17B) [35]

242 442

837 1128

517 317

22.43 28.15

31.88 58.23

26.33 37.96

3.26 12.92

Qwen2.5-VL-7B [4] Idefics3-8B [25] SmolVLM-7B [34], LLaVA-7B [30]

517 123 49 9

1784 2057 1416 523

242 636 710 750

22.47 5.64 3.34 1.69

68.12 16.21 6.46 1.19

33.79 8.37 4.41 1.39

14.04 2.25 1.29 0.23

TimesFM (200M) [8] Chronos (120M) [2]

196 200

543 538

563 559

26.52 27.10

25.82 26.35

26.17 26.72

2.03 2.27

AnomLLM (GPT-4o) [62] LLM-TSAD (GPT-4o) [38] LLMAD (GPT-4o) [31] VLM4TS (GPT-4o) [14]

149 477 349 435

862 5621 402 642

610 282 410 324

14.74 7.82 46.47 40.39

19.63 66.53 45.98 57.31

16.84 14.00 46.23 47.39

4.04 20.81 17.31 17.94

Sub-PCA [1] Matrix Profile [28] IForest [29]

329 290 362

411 450 378

430 469 397

44.46 39.19 48.92

43.35 38.21 47.69

43.90 38.69 48.30

17.41 8.33 20.53

VisAnomReasoner (3B) VisAnomReasoner (7B)

564 ↑ 47 576 ↑ 59

240 ↓ 138 223 ↓ 155

195 ↓ 47 183 ↓ 59

70.15 ↑ 21.23 72.09 ↑ 23.17

74.30 ↑ 6.18 75.88 ↑ 7.76

72.17 ↑ 23.87 73.94 ↑ 25.64

27.07 ↑ 6.26 25.35 ↑ 4.54

general large VLMs, small VLMs, specialized large models, foundation models, and classical anomaly detectors. Both the 3B and 7B variants achieve the highest Precision, Recall, F1 , and Overlap scores, indicating strong performance in both anomaly identification and temporal localization.

long or weakly aligned with true anomaly boundaries. Small VLMs, including Qwen2.5-VL-7B [4], Idefics38B [25], and SmolVLM-7B [34], further exacerbate this issue. They all suffer from low precision and overlap due to aggressive over-flagging and limited reasoning capacity. For example, Qwen2.5-VL-7B, the strongest baseline in this category, correctly identifies 517 anomaly intervals but also produces 1,784 FPs. This over-detection substantially degrades precision and boundary quality, yielding precision, F1 , and overlap scores that are 49.62 pp, 40.15 pp, and 11.31 pp lower than those achieved by VisAnomReasoner (7B) across the three metrics, respectively.

Precision–Recall Trade-offs. Many baseline methods achieve higher recall by flagging large portions of the time series as anomalous, leading to substantially inflated FP counts. In particular, large generalpurpose VLMs such as Grok-4-Fast [49] and LLaMA4-Maverick [35] recover a sizable fraction of true anomalies, with recall values of 31.88% and 58.23%. However, this recall is achieved at the cost of excessive FPs: these models produce at least 837 FPs, which is more than twice the number of true anomalies they correctly identify. As a result, precision remains below 28.15%, and F1 scores do not exceed 37.96%. This over-flagging behavior is further reflected in low overlap scores of 3.26% and 12.92%, which are at least 14.15 percentage points (pp) lower than those achieved by the VisAnomReasoner 3B variant, indicating that predicted anomaly intervals are often overly

Foundation models such as TimesFM [8] and Chronos [2], which adapt forecasting error for anomaly detection, exhibit fewer FPs (approximately 500). However, this behavior is largely driven by the evaluation protocol, which flags only the top 5% of points with the highest anomaly scores. Even under this favorable constraint, their precision remains roughly 20 pp lower than that of classical anomaly detectors such as Sub-PCA [1], Matrix Profile [28], and 6

5 Table 3: Anomaly Detection Performance on TSB-AD-U Benchmark. Small VLMs, are Foundation Models, are Specialized Large models, are VisAnomReasoner variants. Standard Metrics

EXPERIMENTS

are General Large VLMs, are are Classical Anomaly Detectors, Affiliation Metrics

Method

Precision (%)

Recall (%)

F1 (%)

Precision (%)

Recall (%)

F1 (%)

Grok-4-Fast (314B) [49] LLaMA-4-Maverick (17B) [35]

27.95 63.35

15.53 46.49

16.78 48.89

32.43 76.07

33.24 79.18

32.20 76.75

Qwen2.5-VL-7B [4] Idefics3-8B [25] SmolVLM-7B [34] LLaVA-7B [30]

66.18 45.12 35.07 14.06

48.85 35.11 12.48 0.72

49.52 34.64 15.80 1.35

75.90 50.83 37.57 14.06

74.93 59.02 35.84 8.16

74.36 53.03 35.75 10.15

TimesFM (200M) [8] Chronos (120M) [2]

32.32 47.18

43.21 55.37

32.19 47.23

71.09 74.36

57.23 75.61

60.08 73.31

AnomLLM (GPT-4o) [62] LLM-TSAD (GPT-4o) [38] LLMAD (GPT-4o) [31] VLM4TS (GPT-4o) [14]

12.97 31.74 32.96 29.78

10.54 28.40 37.54 40.10

11.63 29.98 22.91 19.84

13.05 66.69 67.50 72.52

7.08 52.76 73.37 51.38

8.42 53.69 64.16 54.06

Sub-PCA [1] Matrix Profile [28] IForest [29]

11.80 9.40 12.44

16.82 15.84 17.89

12.28 9.91 13.05

48.22 44.90 50.44

31.71 41.44 41.51

34.99 41.90 42.67

VisAnomReasoner (3B) VisAnomReasoner (7B)

77.93 ↑ 11.75 75.75 ↑ 9.57

40.46 ↓ 14.91 60.91 ↑ 5.54

49.59 ↑ 0.07 62.91 ↑ 13.39

95.05 ↑ 18.98 95.27 ↑ 19.2

71.69 ↓ 7.49 81.51 ↑ 2.33

78.36 ↑ 1.61 85.58 ↑ 8.83

IForest [29], which are evaluated under the same protocol. Among classical methods, IForest stands out as the strongest traditional baseline, achieving the second-best result on three of the seven reported evaluation metrics overall.

Temporal Boundary Localization. The Overlap score quantifies temporal boundary localization by penalizing both missed coverage and excessive extension of predicted anomaly intervals. As shown in the last column of Table 2, this criterion is challenging: 10 methods score below 15%, and seven fall below 5%, indicating widespread difficulty in localizing anomaly boundaries. In contrast, the VisAnomReasoner variants achieve the highest overlap scores, exceeding all baselines by at least 6.26 pp and 4.54 pp for the 3B and 7B variants, respectively. In particular, VisAnomReasoner (7B) attains an overlap improvement of 11 pp compared to Qwen2.5-VL-7B [4], and at least 12.42 pp over the large general-purpose VLMs [35, 49], demonstrating substantially tighter temporal alignment with ground-truth anomaly.

Among specialized large models, most approaches rely on different prompting strategies with GPT-4o and consistently exhibit oversensitivity to temporal fluctuations [31, 38, 62]. LLM-TSAD is particularly affected, producing over 5,000 FPs, indicating severe over-flagging and resulting in precision as low as 7.82%. VLM4TS, the strongest specialized model for time-series anomaly detection, detects 129 fewer true anomaly intervals and misclassifies 402 more normal intervals as anomalous compared to the VisAnomReasoner 3B variant, resulting in over 20 pp lower precision and F1 score. In summary, VisAnomReasoner variants detect the largest number of anomaly intervals while producing the fewest FP predictions, with the 7B variant achieving at least 23.17 pp and 25.64 pp higher precision and F1 score, respectively, than any of the baseline methods.

Comparing LLM-TSAD [38] and IForest [29] clearly shows that overlap measures boundary quality rather than anomaly volume. IForest detects only 362 true anomaly intervals yet achieves an overlap score just 0.28 pp lower than LLM-TSAD, which identifies 477 true anomaly along with 5621 FPs. Since the eval7

6 uation set contains 740 time series, LLM-TSAD predicts more than seven anomaly intervals per series on average. These excessive predictions are heavily penalized by the overlap metric, yielding boundary alignment comparable to a far more conservative anomaly detector overall.

QUALITATIVE ANALYSIS

LLM typically being the the worst one among these baselines. Still, all of them underperform relative to VisAnomReasoner across all six metrics. Notably, they mostly lag behind large general-purpose VLMs such as LLaMA-4-Maverick [35], which are evaluated under the same prompting strategy as VisAnomReasoner. This observation raises questions about the effectiveness of task-specific prompting strategies proposed by these methods [31, 38, 62].

5.1.2. Results on TSB-AD-U Results in Table 3 compare VisAnomReasoner with existing methods across six evaluation metrics on the public benchmark TSB-AD-U, which contains time series with unseen characteristics and anomaly definitions. Compared to large VLMs, such as LLaMA4-Maverick [35], VisAnomReasoner (7B) performs best on all six metrics, with precision and F1 improving by about 10 pp or more. This result indicates that fine-tuning on VisAnomBench enables VisAnomReasoner to learn transferable anomaly detection capabilities that generalize to novel time-series patterns, reaching performance better than or comparable to a large model despite its substantially smaller scale.

Classical anomaly detectors perform worst overall, highlighting their limited robustness to the diverse time-series characteristics present in TSB-AD-U, a limitation widely observed in prior work [41]. VisAnomReasoner delivers strong and well-balanced performance across both standard and affiliation metrics, providing empirical evidence that explanationaugmented supervision yields improved generalization and more reliable event-level anomaly detection compared to existing approaches.

6. Qualitative Analysis

Qwen2.5-VL-7B [4] attains the highest standard precision (66.18%) and standard F1 (49.52%) among all baselines, as well as the highest standard recall (48.85%) among the small VLM baselines. Nevertheless, VisAnomReasoner (7B) improves all three metrics by 9.57 pp, 12.06 pp, and 13.39 pp for standard precision, recall, and F1 , respectively. The advantage of VisAnomReasoner (7B) over Qwen2.5-VL-7B in affiliation precision, recall, and F1 is also substantial, with gains of 19.37 pp, 6.58 pp, and 11.22 pp, respectively. The largest improvement is in affiliation precision, indicating that VisAnomReasoner avoids excessive anomaly flagging and thereby reduces FPs.

Figure 2 presents a qualitative comparison of anomaly detection and reasoning across models on a representative time-series example. VLM4TS [14], a ViT+GPT-4o model designed for time-series anomaly detection, identifies two short intervals and one point as anomalous but provides limited justification and fails to align with the true anomaly region. The predicted intervals correspond to normal variations within the underlying periodic structure, indicating sensitivity to local fluctuations rather than meaningful pattern deviations in the overall temporal behavior. LLMAD [31], the only existing prompting-based method that supports anomaly explanations, predicts as many as 18 anomaly intervals, but only one overlaps with the ground-truth interval. Moreover, the predicted interval covers only about 3% of the true anomalous region, and the accompanying explanation is not aligned with the actual temporal trend in the time-series plot. LLaMA 4 Maverick [35] exhibits similar behavior, predicting eight anomalous points, none of which intersect the ground-truth anomaly region; its explanation remains largely generic and does not reference the observed trend in the time series.

A similar pattern is observed for the foundation models TimesFM [8] and Chronos [2]. While both models obtain high standard and affiliation recall, the best of them (Chronos) has standard and affiliation precision approximately 30 pp and 20 pp lower than those of VisAnomReasoner, respectively. This large precision gap indicates systematic over-flagging, which can overwhelm users with false alarms and limit practical usefulness despite strong recall performance. Performance of specialized large models that rely on GPT-4o for decision making varies widely, with Anom8

ABLATION STUDIES

Q: Can you determine whether anomalies are present, and if so, where they occur? Ground Truth

Response from Llama 4 Maverick

Response from VLM4TS

<index>(146800, 146800)</index>, <index>(147800, 147800)</index>, <index>(148600, 148600)</index>, <index>(149600, 149600)</index>, <index>(150600, 150600)</index>, <index>(151800, 151800)</index>, <index>(152300, 152300)</index>, <index>(152800, 152800)</index> Step 1: Identify the axes and the general pattern of the data. Step 2: Locate the abnormal regions which are the sharp spikes. Step 3: Map these spikes to their xaxis values and format them as required.

Anomaly interval: (150720, 151370) (150136, 150191); (151804, 151804); (152635, 152685) The detected intervals exhibit sharp spikes that deviate significantly from the overall pattern, indicating potential anomalies. These spikes are characterized by abrupt increases in signal value, suggesting strong statistical and contextual irregularities.

Response from VisAnomReasoner <anomaly>True</anomaly> <index>(150800, 151200)</index>

Response from LLMAD (146776, 146835), (147602, 147736), (148915, 148919), (149138, 149300), (149589, 149589), (149639, 149639), (149689, 149689), (149739, 149739), (150126, 150150), (150961, 150981), (151645, 151741), (151786, 152124), (152142, 152142), (152501, 152501), (152535, 152535), (152621, 152639), (152949, 152949), (153154, 153154) step1_global: The overall trend shows a significant rise starting from data point 20, leading to a peak around data point 40, followed by a sharp decline. step2_local: There is a persistent level shift up starting from data point 20 and sustaining beyond data point 40, deviating significantly from the historical normal data sequence. step3_reassess: The anomaly is confirmed as it demonstrates a clear deviation from the norm, with a sustained high level that does not return to the baseline.

Step 1: The x-axis represents the index, ranging from approximately 146000 to 153000. The y-axis represents the value, ranging from -500 to 2000. The series has a clear periodic pattern with peaks and troughs. Step 2: Upon closer inspection, most of the series follows a consistent pattern, but there are regions where the amplitude of the peaks is notably higher than others. One such region is around index 150800 to 151200, where the peak is significantly larger than the surrounding peaks. Step 3: This region is identified as an anomaly because it deviates from the expected pattern. The interval (150800, 151200) is consolidated from visually contiguous anomalous points and mapped to the x-axis values. No other overlapping intervals are present.

Figure 2: Qualitative Examples of Anomaly Reasoning. VisAnomReasoner precisely localizes the anomalous interval with visually grounded, structured reasoning; whereas other methods exhibit coarser localization or produce numerous spurious intervals with less grounded explanations. In contrast, VisAnomReasoner produces a tighter anomaly interval that closely matches the ground truth and generates a coherent, step-by-step reasoning trace that links changes in amplitude and pattern to observable deviations in the signal. This illustrates that explanation-augmented supervision enables VisAnomReasoner to achieve more precise localization and better-grounded reasoning than both customized and larger general-purpose VLMs. Additional analysis is in Appendix D.

against their respective Qwen2.5-VL base models [4] on VisAnomBench, with percentage gains annotated above each bar. Supervised fine-tuning improves all metrics, with the largest gains in precision, amounting to 180% for 3B and 220% for 7B, which reflects a significant reduction in FPs. In contrast, recall improves only marginally, indicating that fine-tuning primarily reduces FPs rather than substantially increasing anomaly coverage. This pattern is consistent with explanation-augmented supervision emphasizing context-aware discrimination, helping the model distinguish true anomalies from normal variations. Improvements in overlap indicate more accurate temporal boundary localization. These results demon-

7. Ablation Studies Effect of Supervised Fine-Tuning. Figure 3 compares the VisAnomReasoner 3B and 7B variants 9

8 1.0 0.8

3B Base 180% 220%

7B Base

3B SFT

2% 11%

94% 119%

7B SFT

VisAnomReasoner Win

Tie

29.7% 50

0.7% 100

Figure 4: Explanation win-rate between base model and VisAnomReasoner.

0.4

134% 81%

0.2 0.0

Base Win

69.6%

0.6

CONCLUSION

Precision

Recall

Overlap

Figure 3: Comparison of base Qwen2.5-VL models and their supervised fine-tuned variants (VisAnomReasoner). Arrows denote relative improvements due to supervised fine-tuning. Table 4: Fine-tuning with explanation improves precision and recall over interval-only supervision. Mode

Prec.

Rec.

Base 517 1784 242 22.47 68.12 33.79 No reasoning 516 393 243 56.76 67.98 61.87 With reasoning 576 223 183 72.09 75.88 73.94

strate the effectiveness of explanation-augmented supervision, particularly for smaller models, in improving detection quality and localization accuracy. Effect of Reasoning Supervision. We evaluate whether the gains come specifically from reasoning supervision rather than from task-specific finetuning alone. To this end, we compare three settings: (i) the off-the-shelf pretrained base model, (ii) fine-tuning to predict anomaly intervals only, and (iii) fine-tuning to predict both anomaly intervals and reasoning traces. As shown in Table 4, intervalonly fine-tuning already reduces FPs substantially, but does not recover additional missed anomalies. In contrast, adding reasoning traces improves both precision and recall, indicating that the gains stem not only from task-specific fine-tuning, but specifically from explanation-augmented supervision. Quality of Explanation. We evaluate the explanation quality by conducting a paired comparison on the 740 test time series in VisAnomBench. For each time series, GPT-4o is given the plot and two explanations, one generated by the base model (Qwen2.5-VL7B) and one by VisAnomReasoner (7B), and selects 10

the better explanation based on visual groundedness, axis consistency, and clarity. As shown in Figure 4, VisAnomReasoner is preferred in 69.6% of cases, compared with 29.7% for the base model and 0.7% ties.

8. Conclusion This work introduces vision-language reasoning over time-series data, where models must align temporal evidence, anomaly intervals, and naturallanguage explanations in a single prediction. To address the lack of suitable supervision for VLM-based anomaly detection, we curate VisAnomBench, an explanation-augmented benchmark that enables supervised learning of plot-grounded anomaly reasoning, and VisAnomReasoner, a compact VLM trained to jointly localize anomaly intervals and generate visual-temporal explanations. Across VisAnomBench and TSB-AD-U, VisAnomReasoner consistently outperforms general-purpose VLMs, specialized LLM/VLM anomaly detectors, time-series foundation models, and classical methods, with large gains in precision, F1 , and temporal alignment. Ablation studies further show that reasoning supervision substantially reduces FPs, while adding reasoning traces improves both precision and recall over interval-only supervision. Evaluation of the explanation quality by GPT-4o and qualitative results also show that VisAnomReasoner produces more coherent, visually grounded reasoning traces. These results highlight explanation-driven supervision as a practical path toward interpretable, reasoning-centric time-series anomaly detection. Acknowledgments This work was supported by the U.S. Department of Energy, National Nuclear Security Administration, Office of Defense Nuclear Nonproliferation Research and Development, and by the Laboratory Directed

REFERENCES Research and Development program at Sandia National Laboratories. Sandia National Laboratories is a multi-mission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC (NTESS), a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration (DOE/NNSA) under contract DE-NA0003525. This written work is authored by an employee of NTESS. The employee, not NTESS, owns the right, title and interest in and to the written work and is responsible for its contents. Any subjective views or opinions that might be expressed in the written work do not necessarily represent the views of the U.S. Government. The publisher acknowledges that the U.S. Government retains a non-exclusive, paid-up, irrevocable, world-wide license to publish or reproduce the published form of this written work or allow others to do so, for U.S. Government purposes. The DOE will provide public access to results of federally sponsored research in accordance with the DOE Public Access Plan.

References [1] Charu C Aggarwal. Outlier ensembles. In Outlier Analysis, pages 185–218. Springer, 2016. [2] Abdul Fatir Ansari, Lorenzo Stella, Ali Caner Turkmen, Xiyuan Zhang, Pedro Mercado, Huibin Shen, Oleksandr Shchur, Syama Sundar Rangapuram, Sebastian Pineda Arango, Shubham Kapoor, et al. Chronos: Learning the language of time series. Transactions on Machine Learning Research (TMLR), 2024. [3] Marc Bachlin, Meir Plotnik, Daniel Roggen, Inbal Maidan, Jeffrey M Hausdorff, Nir Giladi, and Gerhard Troster. Wearable assistant for parkinson’s disease patients with the freezing of gait symptom. IEEE Transactions on Information Technology in Biomedicine, 14(2):436–446, 2009. [4] Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, et al. Qwen2.5-VL tech11

nical report. arXiv preprint arXiv:2502.13923, 2025. [5] Sriram Baireddy, Sundip R. Desai, James L. Mathieson, Richard H. Foster, Moses W. Chan, Mary L. Comer, and Edward J. Delp. Spacecraft time-series anomaly detection using transfer learning. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 1951–1960, June 2021. [6] Ane Blázquez-García, Angel Conde, Usue Mori, and Jose A Lozano. A review on outlier/anomaly detection in time series data. ACM Computing Surveys (CSUR), 54(3):1–33, 2021. doi: 10.1145/3444690. [7] Paul Boniol, John Paparrizos, Themis Palpanas, and Michael J Franklin. SAND: Streaming subsequence anomaly detection. Proceedings of the VLDB Endowment, 14(10):1717–1729, 2021. [8] Abhimanyu Das, Weihao Kong, Rajat Sen, and Yichen Zhou. A decoder-only foundation model for time-series forecasting. In International Conference on Machine Learning (ICML), 2024. [9] Yifeng Gao, Jessica Lin, and Constantin Brif. Ensemble grammar induction for detecting anomalies in time series. In International Conference on Extending Database Technology (EDBT), pages 85–96. OpenProceedings.org, 2020. doi: 10.5441/002/edbt.2020.09. [10] Gabriel Rodriguez Garcia, Gabriel Michau, Mélanie Ducoffe, Jayant Sen Gupta, and Olga Fink. Temporal signals to images: Monitoring the condition of industrial assets with deep learning image processing algorithms. The Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability, 236(4):617–627, 2022. [11] Astha Garg, Wenyu Zhang, Jules Samaran, Ramasamy Savitha, and Chuan-Sheng Foo. An evaluation of anomaly detection and diagnosis in multivariate time series. IEEE Transactions on Neural Networks and Learning Systems, 33(6):2508–2517, 2021. doi: https: //doi.org/10.48550/arXiv.2109.11428.

REFERENCES [12] Gemma Team. Gemma 3 technical report. arXiv preprint arXiv:2503.19786, 2025. [13] Nate Gruver, Marc Finzi, Shikai Qiu, and Andrew G Wilson. Large language models are zero-shot time series forecasters. Advances in Neural Information Processing Systems (NeurIPS), 36:19622–19635, 2023. [14] Zelin He, Sarah Alnegheimish, and Matthew Reimherr. Harnessing vision-language models for time series anomaly detection. AAAI Conference on Artificial Intelligence (AAAI), 2025. [15] Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. International Conference on Learning Representations (ICLR), 2022. [16] Muye Huang, Han Lai, Xinyu Zhang, Wenjun Wu, Jie Ma, Lingling Zhang, and Jun Liu. EvoChart: A benchmark and a self-training approach towards real-world chart understanding. In AAAI Conference on Artificial Intelligence (AAAI), volume 39, pages 3680–3688, 2025.

a video: Zero-shot video question answering using a VLM. IEEE Access, 12:193057–193075, 2024. doi: 10.1109/ACCESS.2024.3517625. [21] Yaxuan Kong, Yiyuan Yang, Yoontae Hwang, Wenjie Du, Stefan Zohren, Zhangyang Wang, Ming Jin, and Qingsong Wen. Time-MQA: Time series multi-task question answering with context enhancement. Annual Meeting of the Association for Computational Linguistics, 2025. [22] Kwei-Herng Lai, Daochen Zha, Junjie Xu, Yue Zhao, Guanchu Wang, and Xia Hu. Revisiting time series outlier detection: Definitions and benchmarks. In Advances in Neural Information Processing Systems (NeurIPS), 2021. [23] Tian Lan, Hao Duong Le, Jinbo Li, Wenjun He, Meng Wang, Chenghao Liu, and Chen Zhang. Axis: Explainable time series anomaly detection with large language models. arXiv preprint arXiv:2509.24378, 2025. [24] Nikolay Laptev, Saeed Amizadeh, and Ian Billawala. S5: A Labeled Anomaly Detection Dataset. Version 1.0, March 2015.

[17] Alexis Huet, Jose Manuel Navarro, and Dario Rossi. Local evaluation of time series anomaly detection algorithms. In ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 635–645, 2022.

[25] Hugo Laurençon, Andrés Marafioti, Victor Sanh, and Leo Tronchon. Building and better understanding vision-language models: insights and future directions. In Workshop on Responsibly Building the Next Generation of Multimodal Foundational Models, 2024.

[18] Kyle Hundman, Valentino Constantinou, Christopher Laporte, Ian Colwell, and Tom Soderstrom. Detecting spacecraft anomalies using lstms and nonparametric dynamic thresholding. In ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 387–395, 2018.

[26] Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. Blip-2: Bootstrapping languageimage pre-training with frozen image encoders and large language models. In International Conference on Machine Learning (ICML), pages 19730–19742. Proceedings of Machine Learning Research (PMLR), 2023.

[19] Eamonn Keogh, Jessica Lin, Sang-Hee Lee, and Helga Van Herle. Finding the most unusual time series subsequence: algorithms and applications. Knowledge and Information Systems, 11 (1):1–27, 2007.

[27] Yanbang Li, Ziyang Gong, Haoyang Li, Xiaoqi Huang, Haolan Kang, Guangping Bai, and Xianzheng Ma. Robotic visual instruction. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 12155–12165, 2025.

[20] Wonkyun Kim, Changin Choi, Wonseok Lee, and Wonjong Rhee. An image grid can be worth

[28] Michele Linardi, Yan Zhu, Themis Palpanas, and Eamonn Keogh. Matrix profile goes MAD:

REFERENCES variable-length motif and discord discovery in data series. Data Mining and Knowledge Discovery, 34(4):1022–1071, 2020. [29] Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. Isolation forest. In IEEE International Conference on Data Mining, pages 413–422, 2008. [30] Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. Visual instruction tuning. Advances in Neural Information Processing Systems (NeurIPS), 36:34892–34916, 2023. [31] Jun Liu, Chaoyun Zhang, Jiaxu Qian, Minghua Ma, Si Qin, Chetan Bansal, Qingwei Lin, Saravan Rajmohan, and Dongmei Zhang. Large language models can deliver accurate and interpretable time series anomaly detection. In ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 4623–4634, 2025. [32] Qinghua Liu and John Paparrizos. The elephant in the room: Towards a reliable time-series anomaly detection benchmark. Advances in Neural Information Processing Systems (NeurIPS), 37:108231–108261, 2024. [33] Yucong Luo, Yitong Zhou, Mingyue Cheng, Jiahao Wang, Daoyu Wang, Tingyue Pan, and Jintao Zhang. Time series forecasting as reasoning: A slow-thinking approach with reinforced LLMs. arXiv preprint arXiv:2506.10630, 2025. [34] Andrés Marafioti, Orr Zohar, Miquel Farré, Merve Noyan, Elie Bakouch, Pedro Cuenca, Cyril Zakka, Loubna Ben Allal, Anton Lozhkov, Nouamane Tazi, Vaibhav Srivastav, Joshua Lochner, Hugo Larcher, Mathieu Morlon, Lewis Tunstall, Leandro von Werra, and Thomas Wolf. SmolVLM: Redefining small and efficient multimodal models. Second Conference on Language Modeling, 2025. [35] Meta AI. LLaMA 4: Open foundation and finetuned chat models. https://ai.meta.com/ llama, 2025. [36] NOAA. Pacific Marine Environmental Laboratory Tropical Atmosphere Ocean (TAO) Project. https://www.pmel.noaa.gov, 2025. 13

[37] John Paparrizos, Yuhao Kang, Paul Boniol, Ruey S Tsay, Themis Palpanas, and Michael J Franklin. TSB-UAD: an end-to-end benchmark suite for univariate time-series anomaly detection. Proceedings of the VLDB Endowment, 15 (8):1697–1711, 2022. [38] Junwoo Park, Kyudan Jung, Dohyun Lee, Hyuck Lee, Daehoon Gwak, ChaeHun Park, Jaegul Choo, and Jaewoong Cho. Delving into large language models for effective time-series anomaly detection. In Advances in Neural Information Processing Systems (NeurIPS), 2025. [39] Svyatoslav Pchelintsev, Maxim Patratskiy, Anatoly Onishchenko, Alexandr Korchemnyi, Aleksandr Medvedev, Uliana Vinogradova, Ilya Galuzinsky, Aleksey Postnikov, Alexey K Kovalev, and Aleksandr I Panov. LERa: Replanning with visual feedback in instruction following. In International Conference on Intelligent Robots and Systems (IROS), pages 19218–19225, 2025. [40] Mayu Sakurada and Takehisa Yairi. Anomaly detection using autoencoders with nonlinear dimensionality reduction. In The MLSDA Workshop on Machine Learning for Sensory Data Analysis, pages 4–11, 2014. [41] Sebastian Schmidl, Phillip Wenig, and Thorsten Papenbrock. Anomaly detection in time series: A comprehensive evaluation. Proceedings of the VLDB Endowment, 15(9):1779–1797, 2022. doi: 10.14778/3538598.3538602. [42] Arnaldo Sgueglia, Andrea Di Sorbo, Corrado Aaron Visaggio, and Gerardo Canfora. A systematic literature review of IoT time series anomaly detection solutions. Future Generation Computer Systems, 134:170–186, 2022. doi: https://doi.org/10.1016/j.future.2022.04. 005. [43] Haotian Si, Jianhui Li, Changhua Pei, Hang Cui, Jingwen Yang, Yongqian Sun, Shenglin Zhang, Jingjing Li, Haiming Zhang, Jing Han, et al. Timeseriesbench: An industrial-grade benchmark for time series anomaly detection models. In IEEE International Symposium on

REFERENCES Software Reliability Engineering (ISSRE), pages 61–72. IEEE, 2024. [44] Chengsen Wang, Qi Qi, Jingyu Wang, Haifeng Sun, Zirui Zhuang, Jinming Wu, Lei Zhang, and Jianxin Liao. ChatTime: A unified multimodal time series foundation model bridging numerical and textual data. In AAAI Conference on Artificial Intelligence (AAAI), volume 39, pages 12694–12702, 2025. [45] Jiahao Wang, Mingyue Cheng, and Qi Liu. Can slow-thinking LLMs reason over time? Empirical studies in time series forecasting. ACM International Conference on Web Search and Data Mining, 2025. [46] Peng Wang, An Yang, Rui Men, Junyang Lin, Shuai Bai, Zhikang Li, Jianxin Ma, Chang Zhou, Jingren Zhou, and Hongxia Yang. OFA: Unifying architectures, tasks, and modalities through a simple sequence-to-sequence learning framework. In International Conference on Machine Learning (ICML), pages 23318–23340, 2022. [47] Phillip Wenig, Sebastian Schmidl, and Thorsten Papenbrock. TimeEval: A benchmarking toolkit for time series anomaly detection algorithms. Proceedings of the VLDB Endowment, 15(12): 3678–3681, 2022. doi: 10.14778/3554821. 3554873. [48] Renjie Wu and Eamonn J Keogh. Current time series anomaly detection benchmarks are flawed and are creating the illusion of progress. IEEE Transactions on Knowledge and Data Engineering, 35(3):2421–2429, 2021. [49] xAI. Grok-4-fast. https://x.ai, 2024. Large vision–language model. [50] Zhe Xie, Zeyan Li, Xiao He, Longlong Xu, Xidao Wen, Tieying Zhang, Jianjun Chen, Rui Shi, and Dan Pei. ChatTS: Aligning time series with LLMs via synthetic data for enhanced understanding and reasoning. Proceedings of the VLDB Endowment, 2025. [51] Haowen Xu, Wenxiao Chen, Nengwen Zhao, Zeyan Li, Jiahao Bu, Zhihan Li, Ying Liu, You14

jian Zhao, Dan Pei, Yang Feng, et al. Unsupervised anomaly detection via variational autoencoder for seasonal KPIs in web applications. In World Wide Web Conference, pages 187–196, 2018. [52] Jiehui Xu, Haixu Wu, Jianmin Wang, and Mingsheng Long. Anomaly Transformer: Time series anomaly detection with association discrepancy. In International Conference on Learning Representations (ICLR), 2022. [53] Xiongxiao Xu, Haoran Wang, Yueqing Liang, Philip S Yu, Yue Zhao, and Kai Shu. Can multimodal LLMs perform time series anomaly detection? the ACM Web Conference, 2026. [54] Xue Yang, Xuejun Qi, and Xiaobo Zhou. Deep learning technologies for time series anomaly detection in healthcare: A review. IEEE Access, 2023. doi: 10.1109/ACCESS.2023.3325896. [55] Yiyuan Yang, Zichuan Liu, Lei Song, Kai Ying, Zhiguang Wang, Tom Bamford, Svitlana Vyetrenko, Jiang Bian, and Qingsong Wen. Time-RA: Towards time series reasoning for anomaly diagnosis with LLM feedback. arXiv preprint arXiv:2507.15066, 2026. [56] Yuwei Yang, Zeyu Zhang, Yunzhong Hou, Zhuowan Li, Gaowen Liu, Ali Payani, Yuan-Sen Ting, and Liang Zheng. Effective training data synthesis for improving MLLM chart understanding. In International Conference on Computer Vision (ICCV), pages 2653–2663, 2025. [57] Zahra Zamanzadeh Darban, Geoffrey I Webb, Shirui Pan, Charu Aggarwal, and Mahsa Salehi. Deep Learning for Time Series Anomaly Detection: A survey. ACM Computing Surveys (CSUR), 57(1):1–42, 2024. doi: https://doi.org/10. 1145/3691338. [58] Haochuan Zhang, Chunhua Yang, Jie Han, Liyang Qin, and Xiaoli Wang. TempoGPT: Enhancing time series reasoning via quantizing embedding. arXiv preprint arXiv:2501.07335, 2025.

REFERENCES [59] Junru Zhang, Lang Feng, Xu Guo, Yuhan Wu, Yabo Dong, and Duanqing Xu. Timemaster: Training time-series multimodal LLMs to reason via reinforcement learning. Advances in Neural Information Processing Systems (NeurIPS), 2025. [60] Lingpei Zhang, Qingming Li, Yong Yang, Jiahao Chen, Rui Zeng, Chenyang Lyu, and Shouling Ji. Contextual and seasonal LSTMs for time series anomaly detection. In International Conference on Learning Representations (ICLR), 2026. [61] Xiaona Zhou, Constantin Brif, and Ismini Lourentzou. mTSBench: Benchmarking multivariate time series anomaly detection and model selection at scale. Transactions on Machine Learning Research (TMLR), 2026. doi: 10.48550/arXiv.2506.21550. [62] Zihao Zhou and Rose Yu. Can LLMs understand time series anomalies? In International Conference on Learning Representations (ICLR), 2025.

BENCHMARK DETAILS

A. Benchmark Details A.1. VisAnomBench VisAnomBench is constructed from four public time-series anomaly detection benchmarks: KPI [51], GutenTAG [47], UCR-EGI [9], and the UCR Time Series Anomaly Datasets [48]. These benchmarks span diverse application domains and cover a wide range of anomaly types, sequence lengths, and temporal patterns. To ensure consistency and data quality across sources, a unified preprocessing procedure is applied. Each original time series is segmented to satisfy the following criteria: • The anomaly ratio does not exceed 10%, with a target range of (0.01, 0.10). • The anomaly interval is centered between 30% and 70% of the segment length. • The segment length is at least 200 time steps. To mitigate the impact of known anomaly mislabeling issues in public datasets [48], we apply an additional verification step using multiple general-purpose large VLMs. Specifically, each candidate time-series segment is rendered as a plot and provided to four independent large VLMs together with the ground-truth anomaly interval indices. The prompt template for obtaining anomaly explanations is shown in Figure 5. Segments for which the majority of models either fail to identify any anomaly or consistently predict substantially different anomaly intervals are excluded from VisAnomBench. This filtering step targets poorly labeled or inconsistent examples, rather than visually difficult cases, and preserves diversity across anomaly types. After filtering, VisAnomBench contains 2,576 training time series and 740 test time series, with sequence lengths ranging from 200 points to over 100K points. As summarized in Table 5, the train and test splits have mean lengths of 6,882 and 6,259 points, respectively, with average anomaly lengths of 305 and 261, and average anomaly ratios of 5.0% and 4.5%. Table 5: VisAnomBench Statistics. The train and test splits contain univariate time series with lengths ranging from 200 points to over 100K points. Split

# TS

Min Len.

Max Len.

Mean Len.

Avg. Anom. Len.

Avg. Anom. Ratio

Train Test

2576 740

200 200

105472 102400

6882 6259

305 261

5.0% 4.5%

Table 6: Composition of Reward-Selected Supervision in VisAnomBench. Counts and percentages indicate which generator model produced the selected supervision target for each training series. Count Percent

Grok-4-Fast

LLaMA-4-Maverick

Gemma-3-27B-IT

Qwen2.5-VL-32B

605 23.5%

1007 39.1%

549 21.3%

415 16.1%

A.1.1. Candidate Generation and Reward-Based Selection For each time-series segment, we construct a pool of candidate structured outputs using four general-purpose VLMs: Grok-4-Fast [49], LLaMA-4-Maverick [35], Gemma-3-27B-IT [12], and Qwen2.5-VL-32B [4]. Each candidate includes an anomaly decision, predicted anomaly interval(s), and a natural-language reasoning trace. The candidates are ranked according to the composite reward defined in Eq. (2), and the highestscoring candidate is retained as the supervision target for the corresponding segment. The composite reward consists of an anomaly localization term and three explanation-quality terms. The anomaly localization score is computed from the predicted and ground-truth anomaly intervals. The explanation-quality scores are 16

BENCHMARK DETAILS

Prompt Template for Eliciting Time-Series Anomaly Reasoning Traces You are given a time-series plot image (not raw values) and a short context:

{ts_context} Your task is to (i) decide whether anomalies are present, (ii) localize them as inclusive index/timestamp intervals exactly as shown on the plot axes, and (iii) provide concise, step-by-step reasoning grounded in what is visible. If citing numbers, estimate only from axis ticks or labels. Please follow these steps: • Give a short image description relevant to anomaly detection, focusing on axes type, visible trend or seasonality, and any obvious spikes, drops, or level shifts. • Provide a brief rationale distinguishing normal behavior (baseline, seasonality, variance) from visible deviations. Numeric estimates should be derived only from axis labels or tick spacing and noted approximately. • Generate a simplified step-by-step reasoning process consisting of 3–4 numbered steps. Each step must be specific, non-redundant, and grounded in visual evidence. • Present the final decision using the STRICT schema below. STRICT schema and rules: • Intervals are inclusive of endpoints. • Use x-axis values as shown (timestamps or integer indices); do not invent precision. • Merge visually contiguous anomalous points into a single interval; intervals must be sorted and non-overlapping. • When anomalies exist, wrap each (start, end) pair in its own <index>...</index> tag. • When no anomalies exist, output only <anomaly>False</anomaly> with no <index> tags. Required section headings (use exactly): • Image Description: • (1–3 sentences about the plot relevant to anomalies.) • Rationales: • (Concise bullet 1: expected behavior from context.) • (Concise bullet 2: visible deviations with axis-aware estimates when needed.) • (Optional concise bullet 3.) • Lets think step by step. • Step 1: (Identify axes scale and baseline; note any seasonality.) • Step 2: (Locate candidate abnormal regions and justify deviations.) • Step 3: (Consolidate adjacent points into inclusive intervals; map to x-axis values; ensure sorted, nonoverlapping.) • The anomaly is: • {gt_anomaly_intervals} Final output format (produce exactly two lines, then stop): • <anomaly>True/False</anomaly><index>(start_1,end_1)</index>,

<index>(start_2,end_2)</index> ... Step 2: ...

• <think>Step 1:

Step 3:

...

</think>

Figure 5: Prompt for Time-Series Anomaly Reasoning. The prompt enforces axis-aware localization of predicted anomaly interval(s) and concise, visually grounded step-by-step explanations under a strict, parsable output schema.

obtained using Qwen2.5-VL-72B as a judge. Given the plot and generated explanation, the judge assigns scores in [0, 1] for visual groundedness, axis awareness, and clarity. The weighting coefficients are set to λano = 0.3, λvis = 0.3, λaxi = 0.1, and λcla = 0.3. This reward-based selection procedure determines the final supervision source for each training series. As shown in Table 6, the selected supervision comes from all four generator models, with LLaMA-4-Maverick contributing the largest share. The selected outputs are subsequently used for standard supervised fine-tuning of VisAnomReasoner. The judge prompt template for rating time-series anomaly reasoning is presented in Figure 6. 17

BENCHMARK DETAILS

Prompt Template for Rating Time-Series Anomaly Reasoning Traces You are evaluating a model’s reasoning for time-series anomaly detection. Use the attached image and the inputs below. Inputs: - Context: {context} - Decision (Line 1): {decision} - Reasoning (inside <think>): {reasoning} Evaluate along three dimensions: 1. Visual Groundedness: How well does the reasoning reference visible patterns (spikes, drops, shifts) in the plot? 2. Axis Awareness: Are timestamps/indices and value ranges consistent with the actual axes? Penalize hallucinated precision. 3. Clarity: Is the reasoning logically ordered, non-redundant, and clearly connected from observation to conclusion? Return your scores as three numbers in this exact format:

VISUAL: <number in [0,1]> AXIS: <number in [0,1]> CLARITY: <number in [0,1]> Do NOT add any other text, explanation, or formatting. Only those three lines.

Figure 6: Judge Prompt for Rating Time-Series Anomaly reasoning. The prompt scores model-generated reasoning along visual groundedness, axis awareness, and clarity using the time series plot. A.1.2. Explanation Quality Evaluation Human validation at the full scale of VisAnomBench is impractical because the benchmark contains thousands of time series from multiple domains, which would require domain experts for reliable verification. We manually inspect a random subset of selected and rejected candidates during construction and found that selected explanations were generally more visually grounded, more plot-specific, and more consistent with the labeled anomaly intervals than lower-scoring alternatives. Representative examples are shown in Figure 7. A.1.3. Effect of Multi-Model Supervision Because VisAnomBench is constructed from candidate outputs generated by multiple VLMs, one potential concern is whether synthetic supervision introduces generator-specific bias. To mitigate this, we do not rely on a single generator. Instead, we use four general-purpose VLMs to produce candidate explanations and a separate judge model to rank them with the reward in Eq. (2). As shown in Table 7, training on VisAnomBench consistently outperforms training on data generated from a single model (specifically, Gemma-3-27B-IT [12]), with fewer false positives and false negatives, resulting in higher precision, recall, and F1 . This suggests that reward-selected supervision from multiple generators provides more diverse and more effective training targets than single-model outputs. A.2. TSB-AD-U We use the TSB-AD-U benchmark evaluation subset for univariate time-series anomaly detection as in existing works [38, 62]. The TSB-AD benchmark originally collected 13 univariate and 20 multivariate datasets and, after curation, expanded to 23 univariate and 17 multivariate datasets. Following the TSB-AD 18

BENCHMARK DETAILS

Preferred examples contain more detailed, axis-aware justifications for the selected intervals, including the observed scale of the plot, the surrounding baseline behavior, and the visual deviation that supports the anomaly label. <anomaly>True</anomaly><index>(2017-01-09 05:41:00, 2017-01-09 05:44:00)</index> <think>Step 1: X-axis uses datetime ticks (e.g., 2017-01-09) suggesting minute-level resolution within days; y-axis scales linearly from 0 to 0.25; baseline hovers at 0.05-0.10 with random small oscillations, no clear seasonal cycles. Step 2: Candidate anomalous region is the cluster of high points around 2017-01-09 05:41:00 to 05:44:00, where the line spikes to the top of the y-range ( 0.25), deviating sharply from the surrounding low-variance noise. Step 3: This forms a single contiguous interval (2017-01-09 05:41:00, 2017-01-09 05:44:00); no other clusters qualify; sorted ascending with no overlaps.</think> <anomaly>True</anomaly><index>(2016-07-26 00:55:00, 2016-07-26 01:05:00)</index> <think>Step 1: The x-axis uses datetime scale with ticks at roughly hourly intervals from 2016-07-25 23:00 to 2016-07-26 01:00; y-axis spans 0 to 2. Step 2: A candidate anomaly appears as a sharp upward spike peaking above 1.5 near 2016-07-26 01:00, violating the expected steady behavior by representing a sudden load increase not seen elsewhere in the visible range. ... </think>

Discarded examples provide weaker support for the selected intervals: they tend to describe anomalies only at a high level, give limited evidence for why the intervals are abnormal, or select intervals that are not well aligned with the most clearly described visual deviations. <anomaly>True</anomaly><index>(2017-09-04 21:00:00, 2017-09-04 21:00:00)</index>, <index>(2017-09-06 03:00:00, 2017-09-06 03:00:00)</index>, ... <think>Step 1: Identified the axes scales and baseline value for metric ’g’. Step 2: Located five distinct spikes drastically differing from the baseline. Step 3: Formatted each spike location into an inclusive index pair and sorted them to ensure accuracy.</think> <anomaly>True</anomaly><index>(2016-07-26 01:45:00, 2016-07-26 02:15:00)</index> <think>Step 1: Identify the axes and baseline; the plot shows CPU utilization with a downward trend followed by an upward trend. Step 2: Locate candidate abnormal regions; the dip around 2016-07-25 20:00:00 and the spike around 2016-07-26 02:00:00 are notable. Step 3: Consolidate adjacent points into inclusive intervals; the spike around 2016-07-26 02:00:00 is an anomaly.</think>

Figure 7: Representative Selected and Discarded Explanations. Preferred explanations provide axis-aware and visually grounded support for the predicted anomaly interval, while discarded examples are more generic or weakly supported by the plot.

Table 7: Effect of Multi-Model Supervision. Training on VisAnomBench outperforms training on singlemodel-generated data. Mode

Precision (%)

Recall (%)

F1 (%)

SFT with single-model data SFT with VisAnomBench

535 576

357 223

224 183

59.98 72.09

70.49 75.88

64.81 73.94

evaluation protocol, we select the same eight univariate datasets, listed in Table 8, for fair comparison with existing models. All experiments on TSB-AD-U in this paper are conducted on this fixed evaluation set.

MODEL DETAILS

Table 8: TSB-AD-U Evaluation Benchmark Dataset Statistics. The total length is computed as the product of the average time-series length and the number of time series (Count). Dataset NEK [43] TAO [36] MSL [18] Power [19] Daphnet [3] YAHOO [24] SED [7] TODS [22]

Count

Dim.

Total Len.

Avg. # Anom.

Avg. Anom. Len.

Anom. Ratio