Independent R&D Demo · Synthetic Data · Agency-Neutral

Explainable Anomaly Detection under Deception & Missing Data

A public demonstration of anomaly reasoning that separates genuine behavioral change from data-quality problems, explains the evidence behind each alert, calibrates confidence on held-out synthetic data, and explicitly declares when available evidence is insufficient.

Explainable AlertsBehavior vs. Data Integrity Missing-Data AwarenessDeceptive-Source Resilience Confidence CalibrationKnowledge-Limit Abstention
93.6%

reduction in false behavioral-alert rate on the held-out synthetic evaluation

False-alert rate fell from 13.6% for the simple baseline to 0.88% while maintaining comparable anomaly recall.

95.7%held-out behavioral anomaly F1 score
99.8%injected-cause evidence coverage for detected anomalies
0.9%held-out Expected Calibration Error after calibration
99.9%knowledge-limit abstention when only one source remained
Live representative scenario

Do not confuse bad data with bad behavior.

The animation deliberately separates four states that are often collapsed into one anomaly score: normal behavior, insufficient evidence, source-integrity warning, and genuine behavioral anomaly. Watch the decision card and evidence bars as the data conditions change.

Step 1Normal behaviorThree sources agree with the expected corridor.
Step 2Missing observationsEvidence becomes incomplete and confidence falls.
Step 3Deceptive sourceOne source drifts away from the others.
Step 4True behavior changeReliable sources agree the track has changed.
Step 5RecoveryData quality improves while explanation persists.
● Live synthetic scenarioNormal behavior~42 second cycle
Synthetic truth Expected behavior corridor Source A Source B Source C Robust fused estimate
Held-out deterministic synthetic evaluation

Detection quality is only part of the story.

The benchmark evaluates five separate properties: behavioral detection, false behavioral alerts under nuisance conditions, evidence alignment, confidence calibration, and safe abstention when the evidence becomes too sparse.

95.7%

behavioral anomaly F1

Held-out evaluation across normal and anomalous synthetic episodes.

Baseline: 91.4%   →   Demo method: 95.7%
93.6%

fewer false behavioral alerts

Relative reduction in false-alert rate across held-out negative conditions.

13.6%   →   0.88%
99.8%

injected-cause evidence coverage

Expected synthetic cause appeared in the thresholded evidence set when a true anomaly was detected.

Turn: 100% · Speed: 100% · Loiter: 99.7% · Route: 99.6%
0.9%

Expected Calibration Error

Confidence calibration evaluated on episodes disjoint from the calibration set.

Baseline: 11.3%   →   Calibrated: 0.9%
99.9%

single-source abstention

Knowledge-limit response when severe missingness left only one reporting source.

935 held-out single-source evaluation points
Held-out behavioral detection details

Precision improves sharply without sacrificing much recall.

MetricSimple baselineExplainable method
Precision90.1%99.3%
Recall92.7%92.4%
F1 score91.4%95.7%
False behavioral-alert rate13.6%0.88%
Expected Calibration Error11.3%0.9%
Why the false alerts fall

Behavior and evidence quality are separate outputs.

The public method does not treat every disagreement as a behavioral anomaly. It first asks whether the observations are sufficiently complete and mutually consistent.

  • Missing data: lower confidence or abstain when evidence is insufficient.
  • Deceptive / biased source: raise a data-integrity warning when one source disagrees with the others.
  • True behavior change: alert when the robust fused behavior itself departs from learned expectations.
  • Explanation: report which behavioral evidence crossed threshold instead of returning only an opaque anomaly score.
Simple baseline

Average observations, threshold immediate deviations

The comparator is deliberately transparent rather than another complex model.

  • Mean of available source observations.
  • Short-window speed, heading, and route-deviation thresholds.
  • No explicit source-integrity channel.
  • No knowledge-limit abstention.
  • Uncalibrated score-to-confidence mapping.
Explainable public demo method

Robust consensus, separate warnings, calibrated confidence

The demonstration uses a deliberately simplified public-facing method.

  • Median consensus across available sources.
  • Smoothed heading, route, speed, and loiter evidence.
  • Separate source-inconsistency and missingness channels.
  • Knowledge-limit abstention when evidence is too sparse.
  • Monotonic confidence calibration learned only on the calibration split.
350synthetic episodes total
175confidence-calibration episodes
175held-out evaluation episodes
120time steps per episode
3independent observation sources
4true behavior-anomaly types
3negative / nuisance conditions
Exact synthetic benchmark structure

Calibration and evaluation are deliberately separated.

Seven episode classes

  • Normal: expected motion with ordinary measurement noise.
  • Sharp turn: persistent heading change after the event point.
  • Speed change: persistent increase in movement speed.
  • Loiter: reduced net progress with repeated local motion.
  • Route deviation: persistent departure from the learned corridor.
  • Missing data: severe intermittent loss of two observation sources while underlying behavior remains normal.
  • Deceptive source: one source develops a persistent biased observation stream while underlying behavior remains normal.

Train / test discipline

  • 50 deterministic episodes are generated per class.
  • The first 25 episodes per class form the confidence-calibration split.
  • The remaining 25 episodes per class form a disjoint held-out evaluation split.
  • Behavioral detection thresholds are fixed before held-out scoring.
  • Confidence calibration uses a simple monotonic mapping fit only to the calibration split.
  • Headline performance values are reported only from the held-out split.
High-level public architecture

Separate what happened from how much the evidence should be trusted.

01 · Observe

Multi-source evidence

Ingest time-stamped observations, source availability, and recent track history.

02 · Assess

Data integrity & completeness

Measure missingness and disagreement before interpreting the behavior itself.

03 · Compare

Behavior vs. expectation

Evaluate heading, route, speed, and loiter evidence against a learned normal pattern.

04 · Calibrate

Confidence & knowledge limits

Calibrate confidence and abstain when available evidence does not support a reliable decision.

05 · Explain

Reason + evidence + warning

Return the decision type, supporting evidence, data-quality context, confidence, and declared limitations.

Research questions

Designed to answer questions a technical evaluator can falsify.

1

Can false behavioral alerts be suppressed?

Measure whether data-quality failures are separated from genuine behavior changes rather than treated as the same event.

2

Does confidence mean what it says?

Evaluate whether predicted confidence matches observed correctness on held-out synthetic conditions.

3

Does the explanation identify relevant evidence?

Compare reported evidence against the known synthetic cause injected into each anomaly episode.

4

Does the system know when not to decide?

Measure abstention behavior when missing observations push the system beyond its evidence limits.

5

Can one deceptive source be isolated?

Test whether cross-source inconsistency triggers a data-integrity warning without automatically creating a behavioral alert.

6

Can the evaluation be reproduced?

Use deterministic seeds, fixed class definitions, explicit metrics, and a held-out split so the synthetic benchmark can be rerun.

Multi-domain relevance

Explainable anomaly reasoning is useful wherever data can be incomplete or misleading.

Maritime & Mobility Monitoring

Distinguish abnormal movement from missing reports, sensor disagreement, or temporary coverage gaps.

Autonomous Systems

Provide confidence-aware anomaly reasoning when robotic perception sources disagree or become unavailable.

Industrial Operations

Explain abnormal process or asset behavior while separating equipment faults from telemetry-quality problems.

Infrastructure Monitoring

Reduce nuisance alerts by distinguishing actual behavioral changes from sensor outages and inconsistent readings.

Transportation & Logistics

Explain unusual routing, dwell, speed, or custody behavior while accounting for incomplete tracking data.

Multi-Source Decision Support

Expose reasons, uncertainty, evidence quality, and knowledge limits before a downstream user acts on an alert.

Research leadership

Systems evaluation and explainable AI in one integrated team.

SD

Dr. Sajib Datta

Principal Investigator · Systems & Evaluation Lead

Technical direction, multi-source data architecture, evaluation-harness design, data-quality instrumentation, reproducibility, performance analysis, integration, and end-to-end research execution.

TD

Dr. Tonmoay Deb

Co-Investigator · Explainable AI & Anomaly Lead

Anomaly modeling, robust AI, confidence calibration, predictive behavior analysis, explanation design, adversarial/deceptive-data analysis, and AI/ML evaluation.

Public technical context

Grounded in explainability, knowledge limits, resilience, and transparent evaluation.

NIST · Four Principles of Explainable Artificial Intelligence

NIST identifies explanation, meaningfulness, explanation accuracy, and knowledge limits as core principles for explainable AI systems.

Public reference ↗
NIST · AI Risk Management Framework Core

The AI RMF calls for evaluation of validity, reliability, resilience, safety, explanation, documentation, and behavior beyond knowledge limits.

Public reference ↗
NIST · Adversarial Machine Learning Taxonomy

NIST's 2025 report provides a current taxonomy for adversarial ML risks and mitigations across predictive and generative AI systems.

Public reference ↗
Independent, nonproprietary research disclaimer.
This page is an independent Omniscient Innovations LLC research demonstration using deterministic synthetic, non-sensitive data. It is agency-neutral and is not sponsored, funded, endorsed, certified, selected, or validated by any government entity or other organization. The animation and benchmark intentionally use simplified public-facing anomaly, evidence, and confidence logic to demonstrate technical behavior without disclosing proprietary algorithms, operational interfaces, controlled technical information, CUI, classified information, export-controlled data, or Government-furnished information. All performance values on this page are synthetic experimental results from the described benchmark and must not be interpreted as fielded, operational, mission-certified, or independently validated performance.