## 1 Introduction  
Anomaly Detection (AD) is the process of observing and recognizing deviations in a relatively small number of data points compared to the overall volume of data available [1]. [PERSON] [2] describes an anomaly as a data instance that \"deviates so significantly from other observations as to arouse suspicion that it was generated by a different mechanism\". In a wide variety of contexts, that \"other mechanism\" is a departure from normal processes or operations, which also frequently threatens loss or harm to persons or property. Anomaly detection, under various guises, is thus a high-value industry:  
* _Pipeline leak detection_ identifies losses of product due to a physical leak in a pipeline; the product may be one of many types of liquids or gasses, and the product is sometimes dangerous or toxic. * Water-main pipeline leak-detection equipment revenues were $1.5 billion USD in 2020, expected to grow to $2.5 billion by 2028 ([[https://www.reportlinker.c](https://www.reportlinker.c)]([https://www.reportlinker.c](https://www.reportlinker.c)) om/p0603427/Water-pipeline-Leak-Detection-System-Market-Forecast-to-C OVID-19-Impact-and-Global-Analysis-By-Offering-Equipment-Type-Pipe-Type e-and-End-User-and-Geography.html (accessed on 29 January 2024)). Oil and gas pipeline leak-detection equipment revenues were $2.1 billion USD in 2020, likely growing to over $2.8 billion by 2027 ([[https://www.industryrese](https://www.industryrese)]([https://www.industryrese](https://www.industryrese)) arch.co/enquiry/request-sample/18445354, (accessed on 29 January 2024)). * _Patient-Ventilator Asynchrony (PVA) detection_ involves recognizing a discordance between a mechanical ventilator's operation and the breathing reflex of a patient, one that can exacerbate distress or even cause major injury if not addressed correctly, with the worst case being a life-threatening pneumothorax (collapsed lung) [3; 4]. In all of these cases, earlier recognition of the anomaly affords the chance to avoid or mitigate the associated harm. Hence, improving the effectiveness of anomaly detection is of significant economic and social benefit. The focus of this article is on the intersection of semi-supervised and contextual anomaly detection, specifically contextual anomaly detection in a time series where anomalies are so rare that none appear in the training data. _Semi-supervised contextual anomaly detection_ is often approached via a hybrid model: a \"normal model\" is trained to mimic the normal behaviors of a phenomenon (e.g., via a forecasting model trained on normal data). The running predictions of this normal model are then compared against the actual observations of the phenomenon using a separate algorithm (the Anomaly Detector, AD); when the two deviate substantially, an anomaly is declared. Machine learning, and more recently deep learning, is one common approach to building anomaly detectors [5]. For semi-supervised contextual AD, hybrid designs with a deep normal model and a shallow AD component (e.g., [6]) are often a reasonable approach, since the outputs of the normal model are expected to be substantially lower-dimensional than its inputs. However, as noted in [7], the loss functions for each component of the hybrid design are generic, rather than being designed for the anomaly-detection objective. They also only measure loss for the individual component, rather than the whole hybrid system. As a result, their detection performance may be inferior, particularly for a very complex time series. Our proposed solution is to manipulate the predictions of the normal model via stratified sampling, in order to alter the AD model trained on those predictions. We propose an oversampling technique (based on the creation of synthetic \"normal\" forecasts) to improve the performance of the contextual anomaly detector for a time series with particularly complex behaviors.