CUSUM and Sequential Change Detection
Why detecting a small persistent shift needs accumulated evidence rather than a threshold, how the cumulative sum statistic works, and the tradeoff between detection delay and false alarm rate.
A metric shifts by a fraction of its standard deviation and stays there. No individual observation is unusual, so any threshold on the current value either never fires or fires constantly on ordinary variation. Detecting a small persistent change requires accumulating evidence across observations, which is what sequential change detection does.
The statistic
CUSUM tracks a running sum of deviations from the expected value, reset to zero whenever it goes negative:
and signals when \(S_t\) exceeds a threshold \(h\). The parameter \(k\) is the slack, typically half the shift size you want to detect, and it is what makes the statistic drift downward under normal operation and upward only under a genuine shift.
The reset to zero is the key mechanism. Without it, the sum wanders as a random walk and eventually crosses any threshold by chance. With it, evidence accumulates only while the deviation persists, so a run of small positive deviations builds toward the threshold while isolated ones decay away.
The two parameters have clean interpretations. \(k\) sets which shift size the detector is tuned for, and \(h\) trades detection delay against false alarm rate. Their effect is summarised by the average run length: the expected time to a false alarm under normal operation, and the expected delay to detection under a shift. Choosing \(h\) from a target false alarm run length is the principled way to set it.
Why it beats a threshold
For a shift of half a standard deviation, a threshold on the raw value catches it only when noise happens to push an observation far enough, so detection is a matter of luck and false alarms are frequent. CUSUM accumulates the small consistent bias and detects it in a number of observations that scales with the inverse square of the shift size, which is close to the theoretical optimum for this problem.
Related methods
EWMA control charts apply exponential smoothing and threshold the smoothed value, which is simpler and slightly less efficient, and is preferred when a single interpretable smoothed series is wanted.
Bayesian online changepoint detection maintains a distribution over the time since the last change, giving a probability of a change at each step rather than a binary signal, at higher computational cost.
Offline segmentation methods such as PELT find all changepoints in a completed series optimally, which is the right tool for retrospective analysis and cannot be used for monitoring.
When it breaks
It assumes a known baseline. \(\mu_0\) has to come from somewhere, and estimating it from recent data means a slow drift is absorbed into the baseline rather than detected. Separating slow drift from step change requires deciding which you care about.
One-sided detection misses the other direction. A single CUSUM detects increases; decreases need a second statistic. Running both is standard and doubles the false alarm rate unless the threshold is adjusted.
After a signal, the statistic must be reset. A detector that keeps accumulating after signalling re-fires continuously on the same change. Resetting requires deciding what the new baseline is, which is a modelling choice the method does not make for you.
Autocorrelated data breaks the false alarm calculation. The run-length properties assume independent observations, and most real metrics are autocorrelated, so the actual false alarm rate is higher than designed. Modelling the residuals rather than the raw series is the correction.
12 flashcards for this concept
Click a card to reveal the answer.