A Systematic Review of Industrial IoT Anomaly Detection and the Forensic Interpretability Gap

The deployment of Deep Learning (DL) for anomaly detection in Industrial IoT (IIoT) is critically hampered by the non-stationary nature of industrial data streams and the lack of forensic-grade explainability. This systematic review synthesizes 48 peer-reviewed studies (2021–2025) to quantify the performance collapse of static models under concept drift and to establish operational criteria distinguishing post hoc feature attribution (Type A XAI) from forensic root-cause diagnosis (Type B XAI). Our analysis reveals three critical findings: (1) static DL models suffer a 15–22% F1-score degradation across wastewater, manufacturing, and energy sectors when deployed in non-stationary environments, rendering them operationally non-viable without continuous adaptation; (2) the current literature remains saturated with Type A explainability (80% of corpus through 2023), creating a Forensic Gap where operators receive statistical correlations but lack actionable maintenance directives; and (3) emerging 2024–2025 research marks a paradigm shift toward Type B methodologies, yet no unified framework bridges real-time detection with deep causal reasoning. To address these gaps, we contribute the following: (1) a validated operational taxonomy (Cohen’s κ=0.84) with reproducible five-criterion rubric enabling forensic XAI classification; (2) the first quantitative synthesis of drift penalties in industrial deployments; and (3) a three-tier Edge-Cloud Forensic XAI architecture that achieves 70% communication payload reduction via compressed latent vectors while integrating tnGAN-based data imputation (handling 20–30% missing data) and physics-guided causal reasoning engines. Our framework decouples millisecond-level edge detection from 1–3 s cloud-based forensic diagnosis, ensuring both operational responsiveness and actionable industrial insight. We conclude that the future of safety-critical IIoT demands “Forensic-by-Design” architectures leveraging machine unlearning for drift adaptation and LLM-based natural language interfaces for operator-facing explanations, positioning Industry 5.0 to bridge the gap between algorithmic detection and human-centered decision support.