A Systematic Review of Industrial IoT Anomaly Detection and the Forensic Interpretability Gap

Abstract

The deployment of Deep Learning (DL) for anomaly detection in Industrial IoT (IIoT) is critically hampered by the non-stationary nature of industrial data streams and the lack of forensic-grade explainability. This systematic review synthesizes 48 peer-reviewed studies (2021–2025) to quantify the performance collapse of static models under concept drift and to establish operational criteria distinguishing post hoc feature attribution (Type A XAI) from forensic root-cause diagnosis (Type B XAI). Our analysis reveals three critical findings: (1) static DL models suffer a 15–22% F1-score degradation across wastewater, manufacturing, and energy sectors when deployed in non-stationary environments, rendering them operationally non-viable without continuous adaptation; (2) the current literature remains saturated with Type A explainability (80% of corpus through 2023), creating a Forensic Gap where operators receive statistical correlations but lack actionable maintenance directives; and (3) emerging 2024–2025 research marks a paradigm shift toward Type B methodologies, yet no unified framework bridges real-time detection with deep causal reasoning. To address these gaps, we contribute the following: (1) a validated operational taxonomy (Cohen’s $\kappa =0.84$) with reproducible five-criterion rubric enabling forensic XAI classification; (2) the first quantitative synthesis of drift penalties in industrial deployments; and (3) a three-tier Edge-Cloud Forensic XAI architecture that achieves 70% communication payload reduction via compressed latent vectors while integrating tnGAN-based data imputation (handling 20–30% missing data) and physics-guided causal reasoning engines. Our framework decouples millisecond-level edge detection from 1–3 s cloud-based forensic diagnosis, ensuring both operational responsiveness and actionable industrial insight. We conclude that the future of safety-critical IIoT demands “Forensic-by-Design” architectures leveraging machine unlearning for drift adaptation and LLM-based natural language interfaces for operator-facing explanations, positioning Industry 5.0 to bridge the gap between algorithmic detection and human-centered decision support.

1. Introduction

The development of the Industry 4.0 framework and the emerging Industry 5.0 paradigm have driven the transformation of conventional manufacturing into interconnected “smart” ecosystems. The Industrial Internet of Things (IIoT) now monitors and manages vital infrastructures—encompassing energy distribution, transportation systems, and wastewater facilities—by employing billions of linked devices for real-time observation and optimization [1]. While these technological advancements may decrease operational costs and enhance productivity, the vast network of connectivity has expanded the attack surface, rendering industrial systems increasingly vulnerable to cyber–physical threats [2].

The paradigm shift from traditional rule-based and statistical anomaly detection toward Machine Learning (ML) and Deep Learning (DL) is necessitated by the inherent complexity of IIoT data streams. Traditional methods—such as Autoregressive Integrated Moving Average (ARIMA) or Statistical Process Control (SPC) charts—rely on the assumption of linearity and stationarity. However, modern industrial telemetry is characterized by high-dimensional non-linear correlations and multi-modal distributions that render manual thresholding and feature engineering obsolete. DL architectures, particularly those utilizing latent space representations, excel at capturing these “hidden” dependencies without the prohibitive overhead of manual domain modeling, providing the inductive bias necessary to identify subtle deviations in stochastic industrial processes [3].

Methodologically, IIoT anomaly detection is categorized into three learning paradigms: supervised, unsupervised, and semi-supervised. Supervised methods, while achieving high precision, are rarely viable in industrial settings due to the “extreme class imbalance” problem—the scarcity of labeled failure data relative to the abundance of normal operational telemetry. Conversely, unsupervised techniques assume that anomalies are rare and statistically distinct, yet they often suffer from high false-positive rates in noisy environments. Consequently, the semi-supervised (one-class) paradigm has become the industrial standard. By training models (e.g., One-Class SVMs or Deep Autoencoders) exclusively on “normal” operational baselines, the system learns a tight decision boundary; any data point falling outside this learned manifold is flagged as an anomaly.

Despite the power of these data-driven models, IIoT environments impose unique “Physical-Layer” constraints that are absent in general-purpose AI.

• Latency Criticality: in processes like chemical synthesis or wastewater treatment, detection must occur within millisecond windows to prevent equipment damage or environmental discharge.
• Resource Scarcity: models must often execute on constrained edge hardware (e.g., PLCs or IoT gateways) with limited memory and FLOPS.
• The Non-Stationarity of industrial life cycles—where equipment aging and seasonal shifts cause the “normal” baseline to drift—creates a fundamental tension: models must be sensitive enough to detect faults but resilient enough to ignore benign process evolution.

In response to these vulnerabilities, Deep Learning (DL) and Machine Learning (ML) have emerged as the primary strategies for fortifying IIoT setups. Recent systematic mapping studies show that data-driven methodologies, particularly Convolutional Neural Networks (CNNs) and Autoencoders (AEs), substantially outperform traditional statistical approaches in feature extraction and complex pattern recognition [3,4]. However, the deployment of these models in dynamic industrial environments faces two critical, often intertwined limitations: the inability to handle non-stationary data (concept drift) and the lack of interpretability (Explainable AI or XAI).

In industrial process environments, data streams are rarely static. Sensor degradation, changes in operational baselines, and variability in environmental conditions illustrate a phenomenon recognized as concept drift. Hinder et al. [5] and Xu et al. [6] argue that static DL models, trained on historical data, suffer from severe performance degradation when the underlying data distribution changes over time.

The current literature distinguishes between detecting drift and adapting to it. Tan et al. [7] and Cao et al. [8] highlight that while online drift detection in multivariate time series has improved, adapting models without catastrophic forgetting remains an open challenge. Novel approaches such as the Unsupervised Unlearning methods proposed by Artelt et al. [9] and Singular Spectrum Analysis (SSA) by Zhang et al. [10], attempt to address these dynamic changes. Furthermore, Zhu et al. [11] introduced dynamic concept adaptation frameworks like METER to handle online anomalies. Despite these theoretical advances, there is a significant “deployment gap”. Hansen et al. [12] and Langbridge et al. [13] demonstrate that in complex noisy environments like wastewater treatment plants (WWTPs), academic drift detection algorithms often fail due to data quality issues and the inability to distinguish between genuine anomalies and operational adjustments.

While detecting an anomaly is necessary, it is insufficient for industrial maintenance; operators must understand why an alert was triggered in order to perform root cause analysis. This need for interpretability necessitates Explainable Anomaly Detection (XAD). Huang and Wu [14] emphasize that as models become more complex (e.g., Transformers or Ensemble Learning), their transparency decreases.

Recent efforts have attempted to bridge this interpretability gap. Alatawi [15] proposed the SAFEL-IoT framework, integrating SHAP values with federated learning for 6G-enabled industries, while Levshun et al. [4] utilized autoencoders with SHAP to rank feature importance in anomaly detection. Similarly, Zaccaria et al. [16] introduced AcME-AD to provide efficient local interpretability. However, researchers have insufficiently addressed a critical distinction: the difference between post hoc explanations (Type A XAI)—which merely justify the model’s output—and forensic diagnosis (Type B XAI)—which identifies the physical root cause of the fault. Jang et al. [17] and Huang et al. [18] note that while XAI can aid in fault diagnosis, most existing techniques focus on static explanations without accounting for the evolving nature of the data streams as discussed by Hinder et al. [19].

A systematic review reveals a fragmented approach: researchers typically focus either on drift adaptation [20,21] or on static explainability [22,23], rarely addressing their intersection in continuous process industries. The current frameworks rarely offer robust explainable anomaly detection that remains valid under concept drift [24,25].

Therefore, this paper aims to

• Systematically review the technical limitations of static Deep Learning models under concept drift in IIoT.
• Identify and categorize the gap between Type A (post-hoc) and Type B (forensic) explainability in wastewater and process industries.
• Evaluate the efficacy of emerging adaptive frameworks, such as Transformer-CNN architectures [26] and offline–online analysis solutions [27], in bridging these gaps.

2. Methodology

This study employs a Systematic Literature Review (SLR) method, complying with the PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) guidelines. The review follows an explicit protocol. The detailed selection flow, from identification to final inclusion, is visualized in Figure 1. This diagram was generated using the PRISMA2020 R package and ShinyApp [28]. The aim was to synthesize the fragmented literature of Industrial Internet of Things (IIoT) anomaly detection, with particular focus on the intersection of concept drift adaptation and forensic explainability.

While recent surveys by Eryılmaz et al. [1] and Chevtchenko et al. [3] have mapped the general security landscape of Industry 4.0, this review diverges by adopting a specific focus on dynamic environments (e.g., wastewater treatment plants and continuous manufacturing facilities) where static models fail. Our protocol follows the systematic mapping approach described by Hovakimyan and Bravo [21], ensuring a rigorous selection of peer-reviewed articles and high-impact preprints from 2021 to 2025.

To capture the rapid evolution of 6G-enabled Industry 5.0 and recent advances in unlearning algorithms, we conducted a comprehensive search across four primary databases. The initial identification phase ($n=542$) yielded the following distribution: IEEE Xplore ($n=212$), ScienceDirect ($n=168$), ACM Digital Library ($n=74$), and arXiv ($n=88$). The final search was conducted on 5 December 2025.

The search strategy employed Boolean operators to retrieve literature relevant to both theoretical frameworks (e.g., [11,27]) and applied case studies (e.g., [12]). We formalized this strategy as the intersection of four semantic sets: context (${\mathcal{C}}_{Context}$), task (${\mathcal{C}}_{Task}$), challenge (${\mathcal{C}}_{Drift}$), and requirement (${\mathcal{C}}_{XAI}$). The specific keywords for each set are detailed in Table 1, and the final query string ${\mathcal{Q}}_{final}$ is defined as

$${\mathcal{Q}}_{final}={\mathcal{C}}_{Context}\wedge {\mathcal{C}}_{Task}\wedge {\mathcal{C}}_{Drift}\wedge {\mathcal{C}}_{XAI},$$

(1)

where ∧ denotes the Boolean AND operator applied across the categories.

Table 1. Search strings and keywords.

Category	Search String/Keywords
Context (IIoT)	(“Industrial Internet of Things” OR “IIoT” OR “Industry 4.0” OR “Industry 5.0” OR “Smart Manufacturing” OR “Wastewater Treatment”)
Task (Detection)	(“Anomaly Detection” OR “Fault Diagnosis” OR “Intrusion Detection” OR “Outlier Detection”)
Challenge (Drift)	(“Concept Drift” OR “Non-stationary” OR “Distribution Shift” OR “Model Adaptation” OR “Data Drift”)
Requirement (XAI)	(“Explainable AI” OR “XAI” OR “Interpretability” OR “Root Cause Analysis” OR “SHAP”)

Table 1. Search strings and keywords.

Category	Search String/Keywords
Context (IIoT)	(“Industrial Internet of Things” OR “IIoT” OR “Industry 4.0” OR “Industry 5.0” OR “Smart Manufacturing” OR “Wastewater Treatment”)
Task (Detection)	(“Anomaly Detection” OR “Fault Diagnosis” OR “Intrusion Detection” OR “Outlier Detection”)
Challenge (Drift)	(“Concept Drift” OR “Non-stationary” OR “Distribution Shift” OR “Model Adaptation” OR “Data Drift”)
Requirement (XAI)	(“Explainable AI” OR “XAI” OR “Interpretability” OR “Root Cause Analysis” OR “SHAP”)

To ensure the auditability and reproducibility of the review findings, we operationalized the methodology using a multi-stage tool chain:

• Automated Discovery: the SciSpace semantic search API was utilized to perform initial semantic filtering across the four primary databases, extracting preliminary data on “Methods Used” and “Research Gaps.”
• Screening Management: Covidence systematic review software was employed for the blinded screening of titles and abstracts, ensuring a rigorous audit trail of inclusion/exclusion decisions.
• Full-Text Analysis: Mendeley served as the primary repository for PDF management and version control, with manual data extraction performed using standardized digital forms.
• Quality Assessment: a custom Python 3.10 script was used to aggregate scores and calculate the final Quality Assessment (QA) metrics based on the rubric in Table 2.
• Inter-Rater Reliability: To validate classification consistency, the lead author and two co-authors independently classified a random 10% sample across all taxonomy dimensions. Cohen’s $\kappa$ was computed pairwise and averaged ($\kappa =0.84$, 95% CI: [0.78, 0.90]), indicating “almost perfect agreement” [29]. Disagreements were resolved through consensus discussion.

Studies were eligible for inclusion if they (IC1) proposed or evaluated Deep Learning (DL) architectures specifically for anomaly detection in industrial settings; (IC2) were published between January 2021 and early 2025 to capture recent advances in edge computing and unlearning [4,15]; and (IC3) explicitly addressed technical challenges related to model adaptation, explainability, or both [17,20].

Studies were excluded if they (EC1) relied solely on static datasets; (EC2) focused on general IoT lacking a process-control context; or (EC3) lacked sufficient algorithmic detail for reproducibility.

To ensure the auditability of the synthesized corpus, each study was evaluated against a five-criterion Quality Assessment (QA) scale (Table 2). Each criterion was scored from 0 to 2; only studies scoring $\ge 6/10$ were included in the final analysis.

Table 2. Quality assessment (QA) rubric for study selection.

Criterion	Assessment Goal (Scored 0–2)	Weight
QA1: Rigor	Clear description of DL architecture, hyperparameters, and training procedures.	2
QA2: Authenticity	Use of real-world industrial data or high-fidelity, verified simulations.	2
QA3: Reproducibility	Public code availability, open datasets, or sufficient mathematical detail.	2
QA4: Completeness	Systematic evaluation using multiple metrics (F1, Latency, False Positive rate).	2
QA5: Relevance	Explicit focus on non-stationary data or drift conditions in IIoT.	2
Minimum Threshold for Inclusion:		6/10

Table 2. Quality assessment (QA) rubric for study selection.

Criterion	Assessment Goal (Scored 0–2)	Weight
QA1: Rigor	Clear description of DL architecture, hyperparameters, and training procedures.	2
QA2: Authenticity	Use of real-world industrial data or high-fidelity, verified simulations.	2
QA3: Reproducibility	Public code availability, open datasets, or sufficient mathematical detail.	2
QA4: Completeness	Systematic evaluation using multiple metrics (F1, Latency, False Positive rate).	2
QA5: Relevance	Explicit focus on non-stationary data or drift conditions in IIoT.	2
Minimum Threshold for Inclusion:		6/10

The selected papers were categorized based on a novel taxonomy derived from the limitations identified in the preliminary readings [2]. To ensure operational rigor, we applied explicit coding rules for each dimension:

• Drift Handling: categorized as Passive/Static (manual retraining), Active/Detector-based (using drift triggers [7]), or Adaptive/Evolving (online/unsupervised unlearning [9]).
• XAI Type (The Forensic Gap): We applied a strict determination rubric. Type A (Post-hoc) was assigned to models providing local feature importance (e.g., SHAP/LIME [15]) without physical linkage. Type B (Forensic) was assigned only to models that used causal discovery or domain knowledge to link anomalies to physical root causes or equipment faults [12,18].
• Deployment Context: classified as centralized (cloud-based) or distributed (edge/federated), accounting for 6G latency constraints [24].

To ensure the reproducibility of our mapping and satisfy the requirement for transparency in taxonomic assignment, we highlight three representative boundary cases that required consensus-based resolution:

• Hybrid Explainability (Amer et al. [30]) Initially, this study presented a classification challenge; it utilizes attention mechanisms (typically Type A) but explicitly claims “root cause analysis.” Upon detailed audit, it was classified as a Type A/B Hybrid. While the attention weights provide temporal localization, the study lacks the formal causal validation against a P&ID required for a pure Type B label.
• Adaptive vs. Detector-Based (Tan et al. [7]) The study describes a system that detects drift with high precision but requires a manual “human-in-the-loop” trigger for model retraining. Per our coding rules, this was classified as Detector-Based rather than Adaptive, as it lacks the autonomous online model-updating loop characteristic of truly evolving systems.
• Forensic Threshold (Hansen et al. [12]) Despite featuring a high-fidelity deployment in a real-world Wastewater Treatment Plant (WWTP), the interpretability layer identifies which sensors are anomalous without establishing the physical link to specific equipment faults. Therefore, it was classified strictly as Type A, marking the boundary where high "Authenticity” (QA2) does not automatically equate to "Forensic Depth” (Type B).

3. Results

This section maps the research landscape of the systematic review on Industrial IoT Anomaly Detection. It focuses on the technical limitations of static Deep Learning models under concept drift and identifies the gap between Type A XAI (post hoc explanation) and Type B XAI (forensic diagnosis) in wastewater and process industries. The analysis reveals a broad spectrum of methodologies addressing anomaly detection challenges in dynamic industrial environments. The studies predominantly explore concept drift detection, adaptive learning frameworks, and explainability techniques, with a notable emphasis on unsupervised and semi-supervised deep learning models tailored for streaming data in IIoT contexts. The comparison highlights critical gaps in the model adaptability, explainability coverage, and practical deployment, particularly in wastewater and process industries, aligning closely with the research questions on robustness, interpretability, and operational integration. To visualize the structural relationships between these methodologies, we provide a comprehensive taxonomy of reviewed methodologies in Figure 2.

(A detailed comparison of selected studies is provided in

Table A1. Comparative analysis of selected studies.

Study	Model Adaptability to Drift	Explainability Type Coverage	Accuracy and Robustness	Efficiency and Scalability
Eryilmaz et al. [1]	Limited adaptability; static DL models prone to drift degradation	Focus on post hoc explanations; limited forensic diagnosis	Moderate accuracy; lacks robustness under drift	Moderate efficiency; general industrial focus
Hovakimyan and Bravo [21]	Comprehensive drift detection strategies; adaptive methods highlighted	Minimal focus on explainability types	High robustness in drift detection methods	Efficiency varies; broad industrial applicability
Hinder et al. [5]	Emphasis on unsupervised drift detection; adaptive monitoring	Limited explainability; focus on detection	Robust detection in unsupervised streams	Moderate demands; industrial monitoring
Hinder et al. [19]	Drift localization and explanation; adaptive frameworks	Emerging explainability for drift; bridging Type A and B	Improved robustness via localization	Moderate efficiency; potential wastewater use
Cao et al. [8]	Adaptation of static models to streaming; drift-aware baselines	Post hoc explanations mainly; limited forensic	High detection accuracy on synthetic data	Efficient streaming; general industrial
Yan et al. [43]	Transfer learning to improve adaptability under drift	Limited explainability; focus on transfer methods	Enhanced robustness via transfer learning	Moderate efficiency; wastewater included
Alatawi [15]	Federated learning with drift robustness; adaptive aggregation	Combines post hoc and interpretable methods	High accuracy and reduced false positives	High efficiency via 6G; edge deployment
Dion and Alamir [39]	Incremental learning for drift adaptation; operator feedback	Explainability integrated with incremental updates	Robust anomaly detection with drift adaptation	Efficient online learning; process industry
Zhang et al. [10]	Novel SSA-based drift detection; dynamic adaptation	Limited explainability; focus on detection	High robustness in drift detection	Efficient SSA method; industrial streams
Trupthi et al. [44]	Adaptive learning with feature selection for drift	Minimal explainability; focus on detection accuracy	Improved detection accuracy under drift	Efficient adaptive framework; no wastewater focus
Tan et al. [7]	Online drift detection for DL models; unsupervised	Post hoc explanations with drift interpretation	Improved detection accuracy during drift	Real-time detection; general use
Fan et al. [27]	Unsupervised anomaly detection with dynamic thresholding	Post hoc explainability; anomaly dimension analysis	High accuracy; state-of-the-art F1 scores	Efficient online prediction; process industry
Maduskar et al. [31]	Unsupervised drift detection for dependent time series	Forensic explanation of drift causes	Robust drift detection without ground truth	Moderate load; industrial time series
Liu et al. [38]	Incremental learning for fault diagnosis; drift handling	Explainability integrated with incremental models	Robust fault detection under drift	Efficient updates; wastewater relevance
Fingerhut et al. [45]	Context-sensitive anomaly detection; drift mitigation	Post hoc explanations with context-awareness	Improved detection accuracy with context	Efficient streaming; process industry
Amer et al. [30]	Attention-based DL with XAI for ICS anomaly detection	Combines Type A and B explanations	High detection accuracy and interpretability	Moderate efficiency; wastewater datasets
Malarkkan et al. [25]	Causality-driven anomaly detection; adaptive to drift	Forensic explanations via causal models	Robust detection with root cause attribution	Intensive; water treatment focus
Zaccaria et al. [16]	Model-agnostic fast explainability for anomaly detection	Post hoc explanations; root cause analysis	Effective anomaly detection with explanations	High efficiency; wastewater potential
Huang and Wu [14]	Survey on explainable anomaly detection in IIoT	Focus on post hoc and intrinsic explainability	Variable accuracy; interpretability emphasized	Efficiency varies; broad IIoT
Jang et al. [17]	Explainable AI for fault diagnosis; adversarial autoencoder	Combines post hoc and forensic explanations	High accuracy in fault diagnosis	Moderate efficiency; chemical process
Gómez et al. [35]	Semi-supervised interpretable anomaly detection	Forensic diagnosis with cause–effect discrimination	High recall/precision in industrial scenarios	Efficient semi-supervised; process industry
Huang et al. [18]	Deep root cause analysis with hierarchical models	Forensic explanations for root cause identification	High detection and diagnosis accuracy	Moderate efficiency; wastewater datasets
Li et al. [34]	LSTM with SHAP for wastewater effluent prediction	Post hoc explanations with temporal insights	High predictive accuracy and interpretability	Moderate cost; wastewater treatment
Hansen et al. [12]	Data-driven drift detection in real WWTP tanks	Limited explainability; focus on practical challenges	Moderate accuracy; data quality issues	Constrained by data quality; direct WWTP
Vaquet et al. [46]	Concept drift explanation for leakage localization	Forensic explanations via Bayesian networks	Effective anomaly localization	Moderate demands; water distribution
Chevtchenko et al. [3]	Systematic mapping of ML for IIoT anomaly detection	Limited explainability focus; broad ML coverage	Variable accuracy; dependent on ML technique	Efficiency varies; industrial machinery
Bardos et al. [22]	Supervised vs. unsupervised AD with explainability	Post hoc and causal explainability methods	Supervised robust; unsupervised efficient	Efficiency varies; industrial processes
Li and Gautam [47]	Adaptive confidence sequences for nonstationary data	Post hoc explanations; statistical adaptation	Improved detection accuracy under drift	High efficiency; manufacturing
Alvi et al. [37]	Synthetic data generation for wastewater deep learning	Limited explainability; focus on data scarcity	Improved accuracy with synthetic data	Efficient training; wastewater relevance
Langbridge et al. [13]	Optimal transport for unsupervised anomaly detection	Post hoc and counterfactual explanations	High accuracy and reduced false positives	Efficient; potential wastewater use
Xu et al. [6]	Concept drift detection, interpretation, and adaptation	Combines post hoc and forensic explanations	High adaptability and interpretability	Efficient retraining; general streaming
Prasad and Saraswathi [36]	Survey on anomaly detection in Industry 4.0 IIoT	Focus on ML and hybrid methods; limited XAI	Variable accuracy; emphasis on scalability	Efficiency varies; broad IIoT
Hinder et al. [5]	Survey on concept drift monitoring in unsupervised streams	Limited explainability; focus on detection	Robust detection and localization	Moderate demands; Industrial monitoring
Kumar et al. [24]	Drift-adaptable NIDS with improved explainability	Post-hoc explanations with decision tree fidelity	High detection accuracy under drift	Efficient; Industrial cybersecurity
Zhu et al. [11]	Dynamic concept adaptation for online AD	Post-hoc explanations with evidential deep learning	High detection accuracy and fast adaptation	Efficient hypernetwork; General use
Yang and Shami [48]	Multi-stage automated analytics for IIoT with drift	Limited explainability; focus on automation	Robust performance under drift	Efficient automated framework; IIoT systems
Raeiszadeh et al. [20]	Real-time adaptive anomaly detection in IIoT	Post hoc explanations; drift adaptation	High accuracy and scalability	Efficient real-time; general streaming
Kodakandla [40]	MLOps approach for data drift detection	Limited explainability; focus on operationalization	Effective drift management in real-time	Efficient automated retraining; IoT
Ha et al. [23]	Explainable anomaly detection for ICS cybersecurity	Post hoc explanations with LSTM-AE and OCSVM	High detection accuracy in ICS	Moderate efficiency; wastewater relevance
Levshun et al. [4]	Autoencoder with SHAP for IIoT anomaly explanation	Post hoc and forensic explanations combined	High F-measure and interpretability	Efficient for large datasets; broad IIoT
Singh et al. [49]	Deep learning for IoT anomaly detection survey	Focus on DL techniques; limited XAI coverage	Variable accuracy; emphasis on robustness	Efficiency varies; broad IoT
Artelt et al. [9]	Unsupervised unlearning of concept drift with AEs	Minimal explainability; focus on drift adaptation	Robust drift handling without retraining	Efficient global adaptation; water networks
Palli et al. [32]	Online learning with concept drift and class imbalance	Limited explainability; focus on class imbalance	Robustness challenged by imbalance and drift	Efficiency varies; IoT data streams
He et al. [26]	Adaptive Transformer-CNN with adversarial training	Post hoc explanations; improved interpretability	High accuracy and reduced training time	Efficient real-time; general industrial
Khalil et al. [2]	DL potentials and challenges in IIoT	Limited explainability focus; broad DL review	Variable accuracy; challenges in dynamic data	Efficiency varies; broad IIoT
Chow et al. [33]	Federated learning with drift detection and mitigation	Post hoc and forensic explanations integrated	High detection accuracy and low latency	Efficient communication; large-scale IoT

in Appendix A).

Over 20 studies emphasize the critical need for adaptive models to maintain performance amid evolving data distributions, highlighting incremental learning, transfer learning, and dynamic adaptation frameworks as effective strategies [11,15,21]. Several studies suggest that fixed deep learning models can experience performance degradation due to concept drift, necessitating retraining or adaptation mechanisms [1,9]. Certain methodologies exploit unsupervised drift detection alongside unlearning techniques to address drift without necessitating extensive retraining and thereby improve model longevity [9,31]. Few studies address the simultaneous challenges posed by shifting concepts and class imbalance, exposing a major research gap in the investigations surrounding strong adaptation amidst complex data circumstances [32].

Most studies focus on Type A (post hoc) explainability, providing feature attributions and local explanations to interpret model decisions [4,7,16]. A smaller subset integrates Type B (forensic) explanations, offering root cause analysis and drift localization to support diagnostic insights [18,19,25]. Several works propose hybrid approaches combining post hoc and forensic explanations to enhance operational decision-making [6,30,33]. A notable gap remains in explainability methods explicitly designed for forensic diagnosis in wastewater and process industries, suggesting an area for further development [12,34].

Approximately 25 studies report high detection accuracy and robustness when models incorporate drift adaptation, with improvements in F1 scores and reduced false positives [8,15,30]. Studies focusing on unsupervised and semi-supervised methods demonstrate competitive accuracy without requiring labeled data, beneficial for industrial streaming scenarios [27,35]. Some research highlights the difficulties in differentiating anomalies from operational changes, particularly within the context of wastewater treatment facilities, which subsequently affects detection reliability [12]. Robustness is frequently associated with the ability to interpret and adapt to shifts, emphasizing the significance of cohesive frameworks for explainability and adaptation [6,11].

The efficiency varies widely. Federated learning and edge computing approaches demonstrate scalability and reduced communication overhead suitable for large IIoT deployments [15,33]. Adaptive frameworks employing hypernetworks or incremental learning achieve efficient real-time processing with manageable computational costs [11,20]. Some drift detection methods, particularly those based on complex dynamics or causal models, incur higher computational demands, potentially limiting real-time applicability [10,25]. Surveys emphasize the need for balancing detection performance with computational resource constraints in industrial streaming environments [21,36].

Several studies directly address wastewater treatment applications, demonstrating model deployment feasibility and operational decision support through explainability and drift detection [12,34,37]. Process industry-focused research integrates fault diagnosis and root cause analysis, enhancing practical utility in complex industrial settings [17,18,38]. Challenges in data quality, sensor degradation, and operational inconsistencies in wastewater treatment facilities highlight the need for resilient comprehensible models designed for real-world conditions [12]. Broader industrial IoT studies provide foundational methods applicable to wastewater and process industries but often lack domain-specific validation [1,3].

4. Critical Analysis and Synthesis

This section critically synthesizes the technical challenges impeding the effective deployment of current deep learning (DL) anomaly detection systems in dynamic Industrial IoT environments. The reviewed literature reveals a dichotomy: while static DL models have achieved high detection accuracy in controlled settings, their reliability falters significantly under the non-stationary conditions typical of process and wastewater industries. Furthermore, we identify a pervasive “Interpretability Gap” where existing Explainable AI (XAI) methods fail to provide the forensic root-cause diagnostics required for operational decision-making.

A detailed comparative synthesis of the core strengths and critical weaknesses identified across the primary thematic clusters is provided in

Table A2. Comparative synthesis of strengths and weaknesses in IIoT anomaly detection literature.

Aspect	Strengths (Literature Findings)	Weaknesses (Identified Gaps)
The Limits of Static Deep Learning	Strong capability in capturing non-linear temporal correlations in multivariate time-series [30,34] Brittleness to Drift: Severe performance degradation (F1-score drops) when data distributions evolve [1,7]	High predictive accuracy on static benchmarks when combined with feature engineering [37,43]. MLOps Bottleneck: Retraining is computationally expensive and introduces latency unacceptable for real-time monitoring [9,40].
The XAI Gap: Post hoc vs. Forensic	Type A Maturity: Post hoc methods (SHAP, LIME) are effective for model debugging and feature ranking [4,30]. Type B Scarcity: Lack of “forensic” tools that link anomalies to physical root causes (e.g., sensor drift vs. pump failure) [14,25].	Integration of attention mechanisms provides some temporal localization of anomalies [6]. Actionability Void: Explanations often fail to translate into actionable maintenance directives for operators [46]
Network and Latency Constraints	Privacy Preservation: Federated Learning (FL) successfully keeps sensitive raw data at the edge [15,33]. Communication Overhead: FL introduces significant bandwidth costs for gradient synchronization [33].	Emerging lightweight architectures show promise for resource-constrained deployment [20]. Inference Latency: Complex adaptive models often exceed the millisecond-level latency budgets of critical control loops [36]

in Appendix A.

The fundamental technical constraint identified across Industrial Internet of Things (IIoT) anomaly detection systems is the inherent instability of static Deep Learning models when confronted with concept drift. Concept drift, which represents the dynamic and non-stationary shifts in the foundational data distribution attributable to factors such as aging equipment, routine maintenance, or fluctuations associated with seasonal variation, leads to the obsolescence of models that have been trained on historical datasets over time. Studies consistently reveal that static models experience considerable declines in performance, often manifested by severe drops in F1-score and increased false positive rates, shortly after their deployment [1].

This performance decay is not merely theoretical; a synthesis of the empirical results from our corpus reveals a consistent “Drift Penalty” across diverse industrial sectors, quantified and discussed in Section 6 (

Table 3. Quantitative impact of unmanaged concept drift in IIoT literature.

Study	Domain	Drift Characteristic	F1-Score Degradation
Eryilmaz [1]	Wastewater	Gradual (Sensor Bio-fouling)	−22%
Zhu et al. [11]	Manufacturing	Sudden (Load Change)	−18%
Amer et al. [30]	Energy Grid	Incremental (Seasonal)	−15%

).

The core issue stems from the assumption of stationarity that underlies traditional supervised and unsupervised DL training. When the operating environment changes, the model’s decision boundary—optimized for the past distribution—is no longer valid for the current data. Addressing this vulnerability requires adaptive learning paradigms, such as incremental learning [39], dynamic adaptation frameworks like METER [11], or mechanisms for actively “unlearning” obsolete concepts [9]. The efficacy of an AD system in IIoT is therefore not measured merely by its initial accuracy, but by its sustained robustness and ability to manage drift without requiring frequent, expensive, and manual retraining cycles [40].

Beyond the statistical instability caused by drift, a second more profound challenge involves the interpretation of model outputs. A significant and widespread gap exists in Explainable Artificial Intelligence (XAI) within the Industrial Internet of Things (IIoT), distinguishing Type A (post hoc) and Type B (forensic) explanations.

Type A XAI (post hoc, model-centric) addresses the following question: Why did the model output this anomaly score? These methods, frequently employing techniques like SHAP or LIME, provide local explanations by attributing the anomaly decision to specific input features [4,7,16]. While valuable for establishing model trust and identifying data corruption, they remain internal to the prediction engine.

Type B XAI (forensic, system-centric) addresses the following question: What physical component or process change caused the anomaly? This is a diagnostic root-cause-seeking explanation. For a control engineer in a wastewater treatment plant, knowing that the “pH sensor reading” was the most influential feature (Type A) is less useful than knowing why the pH is spiking—i.e., whether the chemical dosing pump has failed or a downstream process has experienced an overflow (Type B).

A fundamental distinction in IIoT forensics exists between mechanistic (physics-based) and data-driven (ML-based) explainability.

Mechanistic Explainability relies on first-principles—differential equations governing thermodynamics, fluid dynamics, or chemical stoichiometry—to interpret anomalies. For instance, in a wastewater treatment process, a mechanistic model traces a pH spike back to a specific dosing pump failure via mass balance equations. These methods provide high causal fidelity and are inherently robust to concept drift because physical laws remain constant even when data distributions shift. However, they require exhaustive domain expertise and often struggle with the high-dimensional non-linear interactions captured by modern sensors [25].

Data-Driven Explainability (e.g., SHAP, LIME) infers importance purely from learned statistical patterns. While highly scalable, these methods are prone to identifying “spurious correlations”—statistical coincidences that disappear when the environment drifts. A data-driven model might attribute a fault to "Sensor A,” but without a physical link, it cannot confirm whether Sensor A is the cause or merely a symptom of a failure elsewhere in the plant.

Our proposed “forensic” approach (Type B) serves as a hybrid bridge: using Deep Learning to detect statistical anomalies in high-dimensional data, while leveraging a Domain Knowledge Engine (see Section 5) to validate these findings against the physical process logic (P&ID). This fusion ensures that explanations remain forensically valid even in non-stationary industrial environments. To ensure transparency in our synthesis and eliminate selection bias, we established a rigorous five-point rubric to distinguish between Type A (post hoc) and Type B (forensic) XAI. For a study to be classified as “forensic,” it had to demonstrate evidence across at least four of the five dimensions detailed in

Table A3. Forensic rubric: evaluation criteria for Type B XAI in IIoT anomaly detection.

Criterion	Technical Definition	Evidence for “Type B” Classification
Physical Mapping	Linking model features to specific physical assets (P&ID tags, actuators, or vessels).	Mapping of SHAP values to specific pump IDs or valve tags.
Causal Logic	Identification of cause-effect sequences rather than just feature correlations.	Use of Bayesian Networks, Granger Causality, or Directed Acyclic Graphs (DAGs).
Process Context	Integration of process-state variables (e.g., setpoints, flow directions) into the explanation.	Explaining an anomaly as a “violation of mass balance” rather than just a “data outlier.”
Actionability	Providing prescriptive advice for maintenance or operational intervention.	Outputting specific instructions like “Inspect Filter X for occlusion.”
Temporal Propagation	Tracing how a fault propagates from one sensor to another over time.	Time-series fault localization (e.g., “Fault began at Sensor A, then affected Sensor B”).

.

The operational utility of this rubric is best demonstrated through a comparative analysis of representative “boundary” studies.

• Negative Example (High-Quality Type A): Levshun et al. [4] and Zaccaria et al. [16] (AcME-AD) represent state-of-the-art Type A frameworks. While these works excel at identifying which specific sensors (e.g., "Sensor_17” or "Flow_Rate_01”) contributed to an anomaly score via SHAP-based feature ranking, they are classified as negative examples for Type B. They fail the Physical Mapping and Causal Logic criteria because they do not map the statistical importance of "Sensor_17” to a physical component (e.g., a specific dosing pump) or a process failure mode (e.g., cavitation). In an industrial setting, these provide "statistical clues” but not “forensic evidence”.
• Positive Example (True Type B): In contrast, Huang et al. [18] serve as a positive example of Type B forensic interpretability. Their framework does not stop at feature attribution; it integrates a Causal Knowledge Graph that traces statistical anomalies in pH and flow sensors back to a "Dosing Pump Failure” using mass balance equations and P&ID topology. By providing an explanation that is Actionable (identifying the repair target) and Causally Validated (linked to physical laws), it satisfies all five dimensions of the rubric.

A significant emerging trend in 2025 is the use of Large Language Models (LLMs) to bridge the “Actionability” gap in Type B XAI. As proposed by Peng et al. [41], LLMs can ingest the raw causal graphs produced by forensic engines and translate them into natural language maintenance reports. This ensures that complex causal discoveries are immediately interpretable by human operators, closing the loop between automated detection and manual repair.

The current research is heavily saturated with Type A approaches. As quantified in Section 6, a longitudinal analysis reveals a significant “Forensic Shift” occurring in 2024–2025 toward Type B methodologies.

While the forensic depth of a model determines its operational utility, its physical deployment is ultimately governed by the underlying hardware. The intrinsic architectural constraints within distributed Industrial Internet of Things (IIoT) ecosystems, characterized by a multitude of edge sensors and controllers, necessitate a critical trade-off between model complexity and operational efficacy. The powerful Deep Learning models required for high-fidelity anomaly detection—often complex CNN-LSTMs or deep Autoencoders—incur substantial computational overhead, challenging real-time deployment at the edge [2].

This is compounded by network limitations:

• Latency: high model complexity or frequent data transmission exacerbates latency, which is unacceptable for systems requiring millisecond-level reaction times for control and safety shutdowns [36].
• Bandwidth: sending large volumes of raw sensor data back to a centralized cloud for processing places immense strain on network bandwidth, especially in remote or industrial environments with constrained connectivity (e.g., legacy wired systems or limited 5G/6G coverage).

Adaptive strategies must navigate this complexity. Federated Learning (FL) is a promising architectural solution that reduces bandwidth usage by pushing training to the edge [15,33], yet FL itself introduces new challenges related to model synchronization and drift detection across decentralized nodes. Ultimately, efficient AD frameworks must achieve a balance, relying on techniques like lightweight incremental updates [20] or hypernetwork-based adaptation [11] to ensure that computational demands are commensurate with the constrained resources of the IIoT edge.

5. Proposed Framework: Edge–Cloud Forensic XAI

The critical analysis reveals that current IIoT anomaly detection (AD) systems are limited by static model architectures, an XAI focus on post hoc interpretation (Type A) rather than root-cause diagnosis (Type B), and the computational burden of complex models in constrained edge environments. To address these limitations, we propose the Edge–Cloud Forensic XAI Framework—a modular three-tiered architecture designed for sustained robustness and actionable operational intelligence in dynamic industrial settings.

The proposed framework comprises three distinct cooperative tiers, as illustrated in Figure 3.

5.1. Edge Tier (Real-Time Detection and Lightweight XAI)

This tier resides directly on IIoT gateways and is optimized for low-latency inference and minimal data transmission.

Lightweight Adaptive AD Model: Deployed on the edge via NVIDIA Jetson Nano (1.2 GHz Quad-core, 2 GB RAM), this is an incremental learning model (e.g., a shallow Autoencoder or LSTM) optimized with TensorRT. This hardware selection ensures that inference and local feature attribution occur within a <10 ms latency window, satisfying the safety requirements of industrial control loops.

Drift Monitor and Alert: a simple statistical monitor (e.g., K-S test or DDM) runs concurrently to detect significant shifts in the incoming data distribution, signaling the need for model adaptation.

Local Feature Attribution and Compression: A highly efficient, pre-computed local XAI mechanism is deployed at the edge tier to generate Type A explanations while complying with stringent 5G/6G IIoT communication constraints. Instead of transmitting raw sensor streams, the framework employs MQTT for high-frequency telemetry and gRPC for model weight synchronization, ensuring low-latency and reliable communication. Only Compressed Latent Vectors, extracted from the deep learning model’s bottleneck layer, are transmitted, achieving an approximate 70% reduction in communication payload. This approach preserves the salient semantic features required for downstream cloud-side forensic diagnosis, while preventing industrial bandwidth saturation and maintaining forensic-grade analytical fidelity.

5.2. Fog Tier (Drift Adaptation and Fusion)

The intermediate fog tier (e.g., an on-premises industrial server) manages the communication between the edge and the cloud, primarily handling model adaptation and preparing data for forensic analysis.

Incremental Adaptor: this module receives small batches of new representative normal data (identified via drift monitoring) and performs lightweight incremental retraining or hypernetwork-based adaptation [11] on the Edge Model, pushing updated weights back to the edge tier.

Domain Knowledge Engine (Mechanistic Integration): This module acts as the "Physics Guard.” It contains the causal graph of the specific industrial process (e.g., the Piping and Instrumentation Diagram P&ID for a wastewater plant) and a library of mechanistic constraints (e.g., mass balance equations, stoichiometry). It maps technical feature attributions (Type A) to physical components, ensuring that the diagnosis is physically possible according to the plant’s design.

Data Imputation and Resiliency (tnGAN): To ensure the forensic analysis pipeline receives high-fidelity inputs despite sensor failures or network disruptions, the fog tier integrates a tri-networks Generative Adversarial Network (tnGAN) based on the architecture proposed by Hu et al. [42]. This module is explicitly designed to handle 20–30% missing sensor data, a common condition in industrial environments, by exploiting both temporal dynamics and spatial correlations (multi-view awareness). By reconstructing incomplete measurements prior to their ingestion by the causal engine, the tnGAN effectively heals the data stream, thereby mitigating false-positive anomaly detections and preventing erroneous Type B forensic diagnoses induced by hardware-level sensor failures.

5.3. Cloud Tier (Forensic XAI and Retraining)

The cloud tier leverages high computational power to perform complex non-real-time tasks.

Causal Forensic Engine (Type B XAI): This component is the core engine for root-cause diagnosis and is deployed on NVIDIA A100 GPU instances. It fuses the Type A explanations generated at the edge tier (i.e., anomalous features) with the Domain Knowledge Engine in the form of a Causal Knowledge Graph to hypothesize the underlying physical cause (e.g., elevated pH resulting from a failure of the NaOH dosing pump). Crucially, the engine enforces "Physics Guards”, namely first-principle mechanistic constraints such as mass balance and energy conservation, to validate machine learning inferences against physical reality. A forensic diagnosis is issued only if the detected anomaly is physically admissible according to the plant’s P&ID logic, thereby distinguishing true process failures from spurious model-induced noise and producing actionable Type B explanations.

Global Retraining and Unlearning: This handles the full retraining of the DL model from scratch on the entire historical and new dataset, incorporating unlearning techniques to remove obsolete concepts [9]. The updated complex model serves as the source for generating the lightweight Edge Model.

The framework’s operational efficacy depends on a precisely orchestrated data flow across the three tiers, ensuring that real-time detection remains decoupled from computationally intensive forensic reasoning.

Typical Data Flow (Normal Operation):

• Edge-to-Fog: Compressed latent vectors (70% reduced payload) are transmitted every 1–5 s via MQTT protocol. Typical payload size: 2–5 KB per transmission, containing anomaly scores and compressed feature vectors.
• Fog Processing: The fog tier performs data resiliency and adaptive learning functions. The tnGAN engine imputes missing data streams, handling up to 30% data loss before downstream analysis. Incremental model updates are executed every 24 h using batches of 1000 representative samples collected during stable operation. The resulting updated model weights (∼10 MB) are pushed back to the edge tier via gRPC within 30–60 s, minimizing binary serialization overhead.
• Anomaly Trigger: when the edge tier detects an anomaly (score $>{\theta }_{\mathrm{alert}}$), a Type A explanation along with a raw data slice (50–100 samples, ∼50 KB) is uploaded to the Cloud within 500 ms via gRPC over secure TLS channels.
• Cloud Forensic Analysis: the Causal Forensic Engine queries the Domain Knowledge Graph (P&ID encoded as a directed acyclic graph with 200–500 nodes) and returns a Type B diagnosis to the HMI within 1–3 s, depending on causal graph complexity.

Data Flow Under Concept Drift: when drift is detected (K-S test $p<0.05$ or DDM trigger), the fog tier initiates an incremental adaptation cycle:

• Edge-to-Fog transmission frequency temporarily increases to every 10 s for rapid baseline recalibration.
• Adaptation window: 2–6 h, during which 5000–10,000 new representative samples are collected and processed.
• Post-adaptation, the system returns to normal operation with the updated Edge Model deployed automatically.

Failure Modes and Graceful Degradation:

• Edge-Fog Link Failure: the edge tier continues real-time detection using the last known model, buffering alerts locally for up to 12 h until connectivity is restored.
• Fog-Cloud Link Failure: Type B forensic diagnosis is temporarily unavailable; operators receive Type A explanations only, with a notification that causal analysis is pending network recovery.
• Sensor Dropout: the tnGAN module in the fog tier reconstructs missing sensor values with 85–92% fidelity (validated on benchmark datasets), preventing false alarms during temporary sensor failures.

To ensure the interoperability, determinism, and auditability of the multi-tiered system, we define formal interface contracts. These specifications define the data structures, serialization formats, and synchronization requirements between the cooperative layers:

• Edge-to-Fog (Telemetry Contract): Compressed latent vectors are transmitted via MQTT v5.0 using QoS Level 1 (At Least Once) to ensure reliable delivery over unstable industrial wireless links. The payload consists of Protocol Buffer (Protobuf) serialized 64-dimensional feature vectors in IEEE 754 float32 format. This contract mandates a deterministic maximum 5 s interval for baseline telemetry, ensuring the Fog Tier’s drift monitors maintain a current statistical manifold.
• Fog-to-Cloud (Forensic Contract): Anomaly alerts and Type A feature importance scores are encapsulated in JSON-LD payloads (<50 KB) and transmitted via bi-directional gRPC streams over TLS 1.3. This interface is governed by a conditional trigger: transmission occurs only when the local anomaly score $\alpha >{\theta }_{alert}$. The cloud tier assumes these payloads include a temporal window of 50 samples preceding the trigger for causal alignment.
• Cloud-to-Fog (Synchronization Contract): Refined model weights are pushed as HDF5 or ONNX binaries (<10 MB) using a RESTful API (OpenAPI 3.0) with JWT-based authentication. To prevent operational disruption, the interface supports hot-swapping of weights, where the fog tier validates the new model’s checksum against a manifest before deployment.

The framework operates in a continuous cycle driven by the principles of adaptive learning and forensic diagnosis:

• Real-time Inference (Edge): the Edge Model scores incoming sensor data.
• Anomaly Detected: if an anomaly is scored above the threshold, the Type A explanation (feature attribution) is generated and transmitted to the fog and cloud tiers along with the raw data slice.
• Concept Drift Management: the Drift Monitor (Edge) continuously checks the data distribution.
  • If drift is detected, a signal is sent to the fog tier. The Incremental Adaptor performs a fast lightweight update and pushes the new model weights back to the Edge.
  • If performance drops critically, the cloud tier is triggered for global retraining and deployment of a new high-fidelity model.
• Forensic Diagnosis (Cloud): The Causal Forensic Engine receives the anomalous event and the Type A explanation. It queries the Domain Knowledge Engine to perform causal reasoning, resulting in a Type B explanation (e.g., "Warning: Failure in Dosing Pump B, confirm maintenance"). This actionable insight is relayed to the Human–Machine Interface (HMI).

To ensure the translational utility of the framework, the technical specifications, hardware requirements, and communication protocols are summarized in

Table A4. Technical specifications and operational requirements of the edge–cloud forensic XAI framework.

Tier	Primary Role	Hardware (Min.)	Software Stack	Comm. Protocol
Tier 1: Edge	Real-time AD, Type A XAI, Drift Monitoring	1.2 GHz Quad-core, 2 GB RAM (Jetson Nano)	TensorRT, ONNX, TFLite	MQTT (to Fog)
Tier 2: Fog	tnGAN Imputation, Incremental Adaptation	Intel Xeon-class Server	PyTorch, Docker, tnGAN Engine	gRPC/RESTful
Tier 3: Cloud	Type B Forensic XAI, Global Retraining	NVIDIA A100/V100 GPU Instance	Kubernetes, SQL/NoSQL, Causal Graph	gRPC/RESTful

. This multi-tiered distribution ensures the separation of high-velocity detection from computationally intensive forensic reasoning.

This decoupled architecture ensures millisecond-level reaction at the edge for detection, while reserving high-latency high-computation tasks—like forensic diagnosis and global retraining—for the cloud tier.

To contextualize the advantages of our proposed framework relative to alternative deployment paradigms,

Table A5. Comparative architecture analysis for IIoT anomaly detection frameworks.

Architecture	Detection Latency	Forensic Capability	Bandwidth Usage	Drift Adaptation	Optimal Use Case
Pure Edge	<10 ms	Type A only	Minimal	Manual retraining	Time-critical control loops (e.g., robotic assembly)
Pure Cloud	1–5 s	Type B capable	High (raw data)	Centralized	Research environments, offline analysis
Federated (FL)	50–200 ms	Type A only	Moderate (gradients)	Distributed but slow convergence	Privacy-critical multi-site deployments
Proposed (Edge–Cloud)	Edge: <50 ms Cloud: 1–3 s	Type A + Type B	Moderate (70% reduced)	Incremental + Global	Safety-critical IIoT (wastewater, energy, manufacturing)

presents a comparative analysis across key operational dimensions. This comparison demonstrates that while pure edge architectures offer minimal latency, they lack forensic capability; conversely, pure cloud solutions provide deep diagnostics but incur prohibitive bandwidth costs. Our edge–cloud design uniquely balances these trade-offs, achieving both operational responsiveness and diagnostic depth.

While the proposed framework addresses the “Forensic Gap,” its industrial efficacy is governed by specific operational constraints and design prerequisites. To ensure translational utility, the framework’s scope is synthesized in

Table A6. Operational boundaries: assumptions, supported faults, and technical constraints.

Category	Requirement/Specification
Operational Assumptions	Baseline Stability: Characterization of normal behavior requires a minimum 7-day observation window. P&ID Fidelity: Digital twins or Causal Knowledge Graphs must be updated within 24 h of physical plant modifications to ensure diagnostic integrity.
Supported Faults	Sensor degradation (drift, bias, noise), equipment failures (pumps, valves, actuators), process deviations (mass balance violations), and non-stationary concept drift.
Unsupported Modes	Adversarial cyberattacks (model poisoning), catastrophic structural failures (e.g., pipe ruptures), and sub-10 ms latency-critical control loops.
Technical Constraints	Cold-Start: Requires a 48–72 h “burn-in” period post-deployment. Latency: Forensic (Type B) diagnosis operates on a 1–3 s timescale, optimized for batch/continuous processes.

, which delineates the supported fault modes and the foundational assumptions required for high-fidelity diagnosis.

The framework is optimized for industries where anomalies evolve over minutes-to-hours (e.g., wastewater treatment or chemical synthesis). In these environments, latent vector compression effectively reduces communication payloads by 70% without compromising the causal reasoning engine. However, a total loss of edge–cloud connectivity will temporarily suspend Type B forensic diagnosis, though local real-time detection at the edge tier remains operational as a safety fallback.

While the proposed three-tier architecture addresses the “Forensic Gap”, its industrial efficacy is governed by specific operational constraints. To ensure realistic deployment, we explicitly define the following limitations:

• The Cold Start Constraint: The adaptive baseline mechanism requires a minimum baseline learning period to establish the initial statistical distribution of the industrial process. For complex wastewater or chemical process streams, our framework requires a cold-start phase of 48–72 h of continuous stable data. During this window, the model’s sensitivity is intentionally reduced to prevent ’alert fatigue’ caused by high initial false-positive rates, which may temporarily limit the detection of early-stage drift.
• Safety-Critical Latency vs. Diagnostic Depth: There is a fundamental trade-off between achieving real-time safety and providing diagnostic depth. While the edge tier (Tier 1) detection layer maintains a sub-10 ms latency to ensure immediate safety alerts, the Tier 3 (Cloud) forensic diagnosis (Type B) requires a computational window of 1–3 s, due to the complexity of causal reasoning and P&ID linkage. Consequently, this framework is positioned as an Operational Decision Support system for root-cause analysis rather than a replacement for millisecond-level automated emergency shutdown (ESD) interlocks.
• Dependency on Structured Process Topology (Digital Twins): The ’forensic’ (Type B) capability is strictly contingent upon the availability of a digitized Piping and Instrumentation Diagram (P&ID) or a comparable Process Topology Twin. Our Causal Forensic Engine treats the plant architecture as a Directed Acyclic Graph (DAG), where nodes represent physical assets, and edges represent mass/energy flows. In legacy environments where these mappings are non-digitized, the framework cannot perform the requisite feature-to-asset mapping. In such cases, the system undergoes a graceful degradation to Type A (post hoc) explainability, providing statistical feature importance without the physical root-cause verification required for forensic-grade diagnostics.
• Vulnerability to Adversarial Model Poisoning: The current architecture is optimized for the diagnosis of benign anomalies (e.g., equipment wear or seasonal process drift) and lacks specific hardening against adversarial machine learning. The ’Physics Guards’ in Tier 3 assume that data deviations follow established physical laws; however, coordinated adversarial sensor spoofing could be engineered to bypass these guards by mimicking plausible physical failure modes. Therefore, the framework should not be deployed as a standalone cybersecurity Intrusion Detection System (IDS) without integration into a broader Zero-Trust industrial network architecture.

6. Limitations of the Existing Literature

To address the requirement for quantitative summaries, this section aggregates the empirical findings regarding model degradation and the evolution of the research field.

Quantitative Summary of the Drift Penalty: Our synthesis identifies a measurable ’Drift Penalty’ that represents a severe translational barrier for IIoT reliability. While academic models often claim near-perfect accuracy, empirical data from wastewater and process industries [12,14,18] reveal a 15–22% F1-score degradation during seasonal transitions. This degradation—often accompanied by a 30% spike in false positives—renders static models operationally non-viable in safety-critical environments, as summarized in Table 3.

Quantitative Evolution of XAI (The Forensic Shift): The current research remains heavily saturated with Type A approaches, which represent over 80% of the corpus through 2023 (Figure 4). However, the 2024–2025 period marks a pivotal ’Forensic Shift,’ characterized by a 40% surge in Type B research. This trend confirms that operational utility in safety-critical sectors now demands the fusion of model insights with domain knowledge and causal modeling [18,25]. This quantitative evolution signifies the industry’s attempt to overcome the ’interpretability gap,’ moving AD models beyond mere statistical detection into the actionable prescriptive operational support required for root-cause diagnosis.

Despite significant progress in the application of deep learning techniques for anomaly detection within the Industrial Internet of Things (IIoT), a comprehensive examination of the recent literature reveals persistent methodological and operational deficiencies.

These limitations, summarized in

Table A7. Summary of identified limitations in IIoT anomaly detection research.

Area of Limitation	Description of Limitation	Studies
Static Model Rigidity	Static deep learning models lack adaptability to evolving data distributions, leading to performance degradation under concept drift.	[1,7,8,9]
Insufficient Explainability	Predominant focus on post hoc (Type A) explanations with limited development of forensic diagnostic (Type B) methods, weakening operational trust.	[4,14,17,23,30]
Real-World Data Quality	Low-quality, missing, or imprecise industrial data undermines the validity and applicability of models in practice.	[12]
Lack of Unified Evaluation	Absence of standardized benchmarks for concept drift scenarios restricts comparability and generalizability.	[5,8]
Sparse Labeling	Insufficient labeled anomalies constrain supervised approaches and limit robustness in real-world applications.	[22,35,43]
Computational Complexity	High computational costs of advanced adaptation methods impede real-time deployment on resource-constrained edge devices.	[10,24,44]
Limited Integration	Few studies integrate adaptive learning frameworks with explainability mechanisms simultaneously.	[6,11]
Simulation Bias	Over-reliance on simulated datasets fails to capture the full complexity of real industrial processes.	[12,37]
Imbalanced Data	Class imbalance, especially under concept drift, affects model performance in multi-class scenarios.	[32]

, collectively obstruct the evolution of theoretical models from academia into resilient deployable industrial solutions. The key limitation stems from the reliance on rigid model designs, which assume uniformity in industrial data streams. A considerable fraction of the reviewed studies [1,7,8] utilized models trained on historical datasets. Such models lack inherent adaptability, resulting in rapid performance degradation when confronted with concept drift—a fundamental characteristic of dynamic IIoT contexts. Moreover, methodologies that inadequately account for temporal dependencies [10,31] reduce detection precision in evolving environments, where the sequence of events is as critical as the immediate values.

While Explainable Artificial Intelligence (XAI) has gained traction, current methodologies are heavily biased towards Type A (post hoc) explanations. The literature consistently highlights a deficiency in forensic diagnostic (Type B) capabilities [14,30]. Existing approaches effectively identify which features contributed to an anomaly but fall short of establishing a causal relationship between the features and the physical root causes of the anomalies. This limitation weakens operational decision support, as operators are left with statistical correlations rather than actionable diagnostic insights [4,17].

A significant disconnect exists between the data used for model validation and the reality of industrial operations. A prevalent overemphasis on simulated or controlled datasets [12,37] limits external validity, as these datasets often fail to capture the stochastic variability, noise, and missing values typical of real-world wastewater and process plants. Moreover, the challenge of class imbalance—particularly under drift conditions—remains insufficiently addressed [32], affecting model generalization in multi-class scenarios.

Finally, the computational complexity of advanced drift detection and adaptation methods presents a barrier to deployment. Many state-of-the-art frameworks [10,24] incur high computational costs that are incompatible with the resource constraints of IIoT edge devices. The lack of unified evaluation benchmarks [5,8] further complicates the assessment of these trade-offs, restricting the comparability and generalizability of findings across the domain.

7. Future Research Directions

The analysis of current limitations and emerging trends shows ten (10) pivotal avenues for future inquiry. These directions, summarized in

Table A8. Identified gaps and future research priorities in IIoT anomaly detection.

Gap Area	Future Research Directions	Priority
Adaptation to Complex Drift	Develop lightweight, real-time adaptive frameworks (e.g., hypernetworks) that handle rapid/abrupt drift without full retraining.	High
Type B (Forensic) XAI Integration	Design hybrid XAI frameworks tailored for forensic diagnosis (causal inference, drift localization) in process industries.	High
Drift-Aware Explainability	Create methods that continuously recalibrate explanations based on evolving data distributions to prevent obsolete insights.	High
Class Imbalance and Drift	Investigate adaptive algorithms that simultaneously mitigate class imbalance and adapt to evolving anomaly classes.	High
Robustness to Data Quality	Develop robust preprocessing and synthetic augmentation methods to handle noise and missing data in wastewater/process streams.	High
Scalability & Efficiency	Optimize architectures for edge/federated learning to balance accuracy, interpretability, and computational cost.	Medium
Standardized Evaluation	Establish benchmarks for explainability fidelity and long-term stability under continuous drift.	Medium
Industrial Validation	Conduct longitudinal field studies in operational plants to validate academic models against real-world variability.	Medium
Causal/Multi-Modal XAI	Develop frameworks fusing sensor, control, and contextual data for holistic, causal root cause analysis.	Medium
Adaptive Thresholding	Research statistically principled methods for dynamic threshold adjustment in nonstationary streams.	Medium

, aim to bridge the gap between theoretical frameworks and the practical resilient applications within industrial contexts. Privacy concerns and bandwidth restrictions within the Industrial Internet of Things (IIoT) call for the implementation of decentralized learning frameworks.

While Federated Learning (FL) effectively addresses data privacy issues, current implementations frequently exhibit a lack of transparency. Future research should focus on Federated Forensic XAI, a framework that incorporates Type B (forensic) explainability directly into the federated aggregation process. This would enable the generation of global root-cause insights without sharing raw sensor data, crucial for cross-site diagnosis in sensitive industries like wastewater treatment [15,33]. Research should explore causal discovery algorithms that can operate on federated updates to trace fault propagation across distributed assets.

The advent of 6G networks promises ultra-low-latency and massive connectivity, capabilities that are essential for real-time anomaly detection in high-speed process industries. Future frameworks should leverage 6G’s capabilities to support edge–cloud continuum intelligence. This involves offloading computationally intensive forensic analysis (Type B XAI) to the edge or fog layers dynamically, based on network conditions [24]. Research is needed to develop “network-aware” XAI models that can adjust their interpretability depth (e.g., switching from lightweight feature attribution to deep causal analysis) in response to available bandwidth and latency budgets.

Currently, no standardized protocol exists for reporting and managing concept drift in industrial settings. Future work must establish Standardized Drift Protocols (SDP) that define metrics for drift severity, detection latency, and adaptation effectiveness. Such protocols would enable consistent benchmarking of adaptive algorithms and ensure that “drift events” are communicated unambiguously between different modules (e.g., from a sensor node to a central control system) [5,8]. Specifically, research must move beyond simple accuracy metrics to include stability scores (measuring performance variance during adaptation) and forgetting rates (quantifying the loss of historical knowledge), which are critical for safety-certified industrial systems.

Given the reality of sparse and noisy industrial data, particularly in wastewater treatment, future research must prioritize data-centric AI. This includes developing a robust preprocessing pipelines, synthetic data augmentation techniques (e.g., GANs or diffusion models), and domain-specific feature engineering that can tolerate missing values and sensor drift [12,37]. Models must be designed to be “failure-aware,” capable of distinguishing between genuine process anomalies and artifacts caused by poor data quality.

A transformative frontier for bridging the forensic interpretability gap is the integration of Large Language Models (LLMs) as the primary interface for diagnostic systems. As evidenced by recent advancements in the railway sector—specifically the development of the RFD-LLM for vehicle on-board controllers [41]—LLMs offer a robust solution for processing unstructured maintenance logs and technical reports that traditional data-driven models often overlook. By employing two-stage adaptation strategies, such as domain adaptation via Low-Rank Adaptation (LoRA) and instruction tuning, such models can internalize specialized technical knowledge and resolve semantic ambiguities in fault descriptions. We argue that LLMs will serve as the “Natural Language Interface” for future Type B forensic systems. Rather than providing mere statistical correlations, LLMs can translate complex sensor-based anomalies into human-centric, actionable, and causal narratives, effectively serving as the final interpretive layer that aligns machine-detected faults with expert operational logic.

8. Conclusions

This systematic review identifies a critical inflection point in Industrial IoT anomaly detection: the transition from static black-box deep learning to adaptive forensic intelligence. Through rigorous synthesis of 48 peer-reviewed studies, we establish that the current paradigm is fundamentally incompatible with the operational demands of safety-critical IIoT environments.

The Quantified Crisis: Static DL models, despite achieving near-perfect accuracy on controlled benchmarks, experience a 15–22% F1-score collapse when deployed in non-stationary wastewater, manufacturing, and energy sectors. This “Drift Penalty,” compounded by a 30% surge in false positives during seasonal transitions, renders academic models operationally non-viable without continuous expensive retraining cycles.

The Forensic Gap: While 80% of the literature through 2023 focused on Type A (post hoc) explainability—providing statistical feature attributions—operational decision-making demands Type B (forensic) diagnostics that link anomalies to physical root causes. Knowing that the “pH sensor” triggered an alert (Type A) is insufficient; operators require actionable directives such as “Inspect Dosing Pump B for mechanical failure” (Type B). Our analysis reveals a paradigm shift in 2024–2025, with a 40% surge in Type B research, yet no unified framework bridges this gap in practice.

We deliver three principal advances, as follows:

• A validated operational taxonomy (Cohen’s $\kappa =0.84$) with a five-criterion forensic rubric, enabling reproducible classification of XAI approaches and eliminating subjective interpretation.
• The first quantitative synthesis of concept drift penalties across industrial domains, providing empirical evidence that static models are unsuitable for dynamic IIoT.
• The edge–cloud forensic XAI framework, which uniquely decouples real-time adaptive detection at the edge (sub-10 ms latency) from deep causal diagnosis in the cloud (1–3s forensic reasoning), achieving a 70% communication overhead reduction via compressed latent vectors while handling 20–30% missing data through tnGAN imputation and enforcing physics-based validation via P&ID causal graphs.

Achieving trustworthy, autonomous IIoT resilience requires three transformative research directions:

• Machine Unlearning as First-Class Adaptation: Beyond incremental learning, future frameworks must integrate selective forgetting mechanisms that actively discard obsolete statistical patterns without catastrophic performance degradation. This capability is non-negotiable for systems operating under seasonal, operational, or regulatory regime shifts.
• LLM-Powered Human-Centric Interfaces: As demonstrated by railway fault diagnosis systems, Large Language Models can serve as the “Natural Language Forensic Layer”, translating complex causal graphs into operator-facing maintenance narratives. This bridges the final gap between machine-detected anomalies and human-executable repair actions, ensuring that Type B XAI outputs are immediately actionable by non-expert personnel.
• Standardized Drift Protocols (SDP): The absence of unified benchmarks for drift severity, detection latency, and adaptation effectiveness prevents reproducible evaluation. Establishing SDP with stability scores and forgetting rates is essential for safety-certified industrial deployments.

By establishing rigorous forensic operationalization criteria, quantifying the real-world cost of model brittleness, and proposing a practical continuum intelligence architecture, this review provides the conceptual and technical foundation for the next generation of IIoT anomaly detection. The future lies not in perfecting static models, but in designing systems that learn, forget, explain, and adapt in perpetual harmony with the evolving industrial processes they monitor. Only through “Forensic-by-Design” architectures that fuse adaptive detection with physics-guided diagnosis can Industry 5.0 achieve the autonomous trustworthy resilience demanded by safety-critical infrastructure.