Detect, Explain, Interpret.

Beyond detection accuracy

Existing anomaly detection benchmarks only tell when something went wrong. SHAD also records where (which of the 171 sensors are directly affected) and what (type, target component, severity, textual explanation), so that a complete pipeline can be evaluated.

215 series, 10 scenarios, 3 anomaly families

Every experiment runs the same GET-heavy S3 workload for ~18 hours (1-minute sampling). Anomalies are injected on top of it and annotated by Scality experts. All statistics below are computed from the released files.

A real distributed object store under controlled failures

Each cluster runs Scality RING with one supervisor and three storage servers. Data placement follows a Chord distributed hash table over 18 software storage nodes; S3 traffic enters through one connector per server. All components expose telemetry, organised into 171 metrics on four levels.

Realistic failures across architectural layers

Failures are injected at a chosen time, for a chosen duration, on chosen components. Multi-event scenarios are simultaneous or asynchronous (cascading, rolling or independent); server failures can also be progressive degradations.

Examples of disk, server and storage node failures (from the paper).

Labels you can reason about

Two label layers ship in every CSV (top-level and per-dimension), and every series has an XML file describing the anomaly and each of the 171 dimensions: what it measures, which event affected it, and which other dimensions were affected by the same event.

<dataset>
  <id>1773343796</id>
  <anomaly_presence>true</anomaly_presence>
  <category>Single</category>
  <type>Disk</type>
  <criticality>Low</criticality>
  <textual_explanation>ran on quarry4 starting at 2026-03-12 19:29,
    with a failure on store 1 g2disk01 at time 3h30m for 1h30m</textual_explanation>
  <dimensions>
    <dimension>
      <name>store1-g2disk01-disk_read_bytes</name>
      <description>(bytes/s) Disk read throughput.</description>
      <anomalies>
        <anomaly>
          <offset_minutes>210</offset_minutes>
          <duration_minutes>90</duration_minutes>
          <store>1</store>
          <disk>g2disk01</disk>
          <degradation></degradation>
          <related_dimensions>
            <dimension>store1-g2disk01-disk_io_time_seconds</dimension>
            <dimension>store1-g2disk01-disk_read_bytes</dimension>
            ...

SHAD is far from solved

We evaluate every stage of the pipeline. Detection is accurate but not uniformly so, native attributions are no better than random, and zero-shot LLMs cannot interpret the anomalies.

18 detectors (10 semi-supervised trained on the 83 nominal series, 8 unsupervised), VUS-PR with a 25-point buffer. Reconstruction-based models (OmniAnomaly, USAD, AE) and the unsupervised KMeansAD form the top clique, but no method is accurate on every anomaly type: deep models catch faint disk / storage-node signals, while KMeansAD is more robust to system-wide server events.

Per-dimension contributions of the best detectors (OA, CNN, KMAD) rank the true root-cause dimensions no better than a random baseline (NDCG). Good detection does not translate into diagnostic utility, especially for disk failures that affect only 4–16 dimensions.

Five frozen LLMs answer a questionnaire (presence, type, criticality, affected dimension, time location) from Catch22 features, multi-panel images, or image descriptions. Scores stay very low (e.g. ≤ 23% F1 on type, ≤ 4% on dimension localisation); providing detection and explanation outputs helps but does not solve the task.

Three lines to your first series

git clone https://github.com/scality/shad.git
cd shad
pip install -e .          # numpy + pandas (add [plot] for matplotlib)
python -m shad            # prints a summary of the dataset

from shad import SHAD

ds = SHAD()                          # finds the repository
s = ds.load("1773343796")            # a single disk failure
s.data     # (1039, 171) telemetry, UTC DatetimeIndex
s.labels   # (1039, 171) per-dimension labels
s.label    # (1039,)     top-level label
s.events   # annotated events: store1/g2disk01, 210 min, 90 min

train_ids, test_ids = ds.split()     # 83 nominal / 132 anomalous

Cite SHAD

If you use SHAD in your research, please cite:

@inproceedings{stanzione2026shad,
  title     = {Detect, Explain, Interpret: An End-to-End Benchmark for Time Series
               Anomaly Detection, Explainability and Interpretability},
  author    = {Stanzione, Roberto and Barbe, Jules and Parrino, Magali and
               Fourmann, J{\'e}r{\'e}mie and Boniol, Paul},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS),
               Evaluations and Datasets Track},
  year      = {2026}
}