Real-world multivariate time series anomalies are rare and often unlabeled. Additionally, prevailing methods rely on increasingly complex architectures tuned to benchmarks, detecting only fragments of anomalous segments and overstating performance. In this paper, we introduce OracleAD, a simple and interpretable unsupervised framework for multivariate time series anomaly detection. OracleAD encodes each variable's past sequence into a single causal embedding to jointly predict the present time point and reconstruct the input window, effectively modeling temporal dynamics. These embeddings then undergo a self-attention mechanism to project them into a shared latent space and capture spatial relationships. These relationships are not static, since they are modeled by a property that emerges from each variable's temporal dynamics. The projected embeddings are aligned to a Stable Latent Structure (SLS) representing normal-state relationships. Anomalies are identified using a dual scoring mechanism based on prediction error and deviation from the SLS, enabling fine-grained anomaly diagnosis at each time point and across individual variables. Since any noticeable SLS deviation originates from embeddings that violate the learned temporal causality of normal data, OracleAD directly pinpoints the root-cause variables at the embedding level. OracleAD achieves state-of-the-art results across multiple real-world datasets and evaluation protocols, while remaining interpretable through SLS.
Figures & tables
Figure 1: Overview of the OracleAD pipeline. Each variable’s past window is encoded by an LSTM and pooled via attention. The resulting embeddings are refined through multi-head self-attention to capture inter-variable dependencies. These embeddings are then fed into an LSTM decoder for reconstruction and next-step prediction. Finally, the pairwise distance matrix of the embeddings is compared against the Stable Latent Structure (SLS) to detect anomalies. The decoder uses an all-zero vector z as its initial input.
Dataset
Metric
A.E
Omni
A.T
Patch
TsNet
DLin
NLin
DC
iTrans
Modern
SARAD
CATCH
OracleAD
F1
47.55
45.90
43.45
43.45
43.45
43.45
43.45
43.45
43.45
43.45
45.75
44.33
65.85
R-F1
45.93
40.58
12.17
34.75
37.49
34.74
32.10
21.35
35.91
35.48
13.54
54.19
54.66
Aff-F1
73.70
73.49
69.68
69.43
69.43
69.43
69.43
69.59
69.53
69.43
77.12
79.16
78.07
PSM
A-ROC
66.79
63.95
38.35
58.68
59.09
58.02
58.56
49.86
59.22
59.21
62.86
64.75
84.78
A-PR
47.27
45.00
24.28
37.91
38.95
37.17
37.64
27.78
38.27
38.59
41.67
43.40
68.11
V-ROC
68.20
61.23
50.96
50.62
50.67
50.53
50.69
50.11
51.23
50.68
57.63
57.00
84.24
Table 1: Performance (%) of deep anomaly detection models across seven evaluation metrics on three benchmark datasets (PSM, SMD, SWaT). All results are averaged over five random seeds. Boldface indicates the best score and underline indicates the second-best score.
Figure 2: Raw signals of the identified root-cause variables and anomaly score visualization for selected intervals in the SMD dataset. Shaded red regions indicate ground-truth anomalies.
Figure 3: Visualization for Deviation Matrices Dmatrixt at anomalous time points in SMD dataset. Each matrix corresponds respectively to the subfigures in Figure 2 . The color bar of each heatmap represents the magnitude of pairwise dissimilarity between variables. A bigger row over column value means a higher chance of an anomaly in that variable. For visualization, each matrix is independently min–max normalized and values are clipped to the range [0.3, 0.9] to enhance contrast.
Appendix figures & tables19 assets
Supplementary material from the paper’s appendix.
Appendix
Dataset
Subsets
Features
Avg Set Size
Anomalies
Segment Lengths
Sampling
Train
Test
Count
Ratio
Min
Med
Max
Period
PSM
1
25
132,481
87,841
71
27.73%
1
5
8,861
1 min
SMD
28
38
25,300
25,301
327
4.16%
2
11
3,161
1 min
SWaT
1
51
496,800
449,919
34
12.02%
101
447
35,900
1 sec
Appendix
Table S1 : Statistics of the benchmark datasets used for multivariate time-series anomaly detection.
Metric
Granularity
Threshold-Free
Temporal-Aware
Partial Credit
Imbalance-Robust
Standard F1
Point-wise
No
No
No
Partial
Range-based F1
Segment-wise
No
Partial
Yes
Partial
Affiliation F1
Segment-wise
No
Yes
Yes
Partial
AUC-ROC
Point-wise
Yes
No
No
No
AUC-PR
Point-wise
Yes
No
No
Yes
VUS-ROC
Point+Time
Yes
Yes
Yes
Yes
Appendix
Table S2 : Comparison of evaluation metrics for time-series anomaly detection. ’Partial’ denotes limited or conditional support depending on implementation details (e.g., decay functions, overlap thresholds).
Figure S1 : Effect of input window length on OracleAD performance. Each subplot shows a different evaluation metric. All results are averaged over five random seeds.
Figure S2 : Effect of training batch size on OracleAD performance. Each subplot shows a different evaluation metric. All results are averaged over five random seeds.
Figure S3 : Effect of the deviation regularization weight λdev on OracleAD performance. Each subplot shows a different evaluation metric. All results are averaged over five random seeds.
Figure S4 : Effect of the encoder and decoder depth on OracleAD performance. Each subplot shows a different evaluation metric. All results are averaged over five random seeds.
Dataset (N)
Batch Size
Memory Usage
Training Speed (it/s)
PSM (25)
64
1.5 GB
12.6
1024
8.5 GB
9.6
SMD (38)
64
1.9 GB
8.0
1024
13.0 GB
6.8
SWaT (51)
64
2.4 GB
6.0
1024
18.5 GB
5.0
Appendix
Table S3 : Training costs across datasets and batch sizes.
Dataset (N)
Inference Speed (time steps/s)
PSM (25)
54.0
SMD (38)
37.0
SWaT (51)
28.0
Syn-PSM (100)
13.5
Syn-PSM (400)
3.15
Appendix
Table S4 : Inference throughput by dataset dimensionality.
Dataset
Metric
PCA
HBOS
IF
A.E
Omni
A.T
Patch
TsNet
DLin
NLin
DC
iTrans
Modern
SARAD
CATCH
OracleAD
F1
46.45
45.98
43.45
47.55
45.90
43.45
43.45
43.45
43.45
43.45
43.45
43.45
43.45
45.75
44.33
65.85
R-F1
46.18
47.74
45.78
45.93
40.58
12.17
34.75
37.49
34.74
32.10
21.35
35.91
35.48
13.54
54.19
54.66
Aff-F1
73.90
72.77
81.98
73.70
73.49
69.68
69.43
69.43
69.43
69.43
69.59
69.53
69.43
77.12
79.16
78.07
PSM
A-ROC
64.82
61.98
54.23
66.79
63.95
38.35
58.68
59.09
58.02
58.56
49.86
59.22
59.21
62.86
64.75
84.78
A-PR
46.75
39.34
33.41
47.27
45.00
24.28
37.91
38.95
37.17
37.64
27.78
38.27
38.59
41.67
43.40
68.11
V-ROC
66.59
63.20
56.47
68.20
61.23
50.96
50.62
50.67
50.53
50.69
50.11
51.23
50.68
57.63
57.00
84.24
Appendix
Table S5 : Performance (%) of anomaly detection models on the PSM, SMD, and SWaT datasets. Boldface indicates the best score and underline indicates the second-best score.
Dataset
Metric
A.E
Omni
A.T
Patch
TsNet
DLin
NLin
DC
iTrans
Modern
SARAD
CATCH
OracleAD
F1
0.44
1.29
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
1.50
1.59
2.98
R-F1
0.48
2.49
7.50
0.44
0.61
0.61
0.11
24.03
1.67
0.38
7.54
5.46
2.93
Aff-F1
0.24
0.65
0.55
0.00
0.00
0.00
0.00
0.36
0.23
0.00
4.30
4.76
0.94
PSM
A-ROC
1.07
1.89
2.10
0.06
0.56
0.07
0.05
0.29
0.11
0.14
1.52
0.78
2.49
A-PR
0.59
2.34
0.88
0.10
0.46
0.05
0.05
0.24
0.11
0.18
1.26
0.75
4.30
V-ROC
0.96
0.56
0.95
0.05
0.03
0.08
0.01
0.56
0.24
0.03
4.98
5.14
2.47
Appendix
Table S7 : Standard deviation (%) of anomaly detection performance across seven evaluation metrics on three benchmark datasets (PSM, SMD, and SWaT). All values are computed over five random seeds for each model. Lower values indicate higher stability and consistency across runs. Metrics include F1, R-F1, Aff-F1, AUC-ROC, AUC-PR, VUS-ROC, and VUS-PR.
Method
F1
R-F1
Aff-F1
A-ROC
A-PR
V-ROC
V-PR
Cosine Sim.
46.81
43.68
78.18
66.46
48.59
65.83
48.82
L1
57.72
51.54
75.87
76.33
54.29
73.33
53.52
L2
65.85
54.66
78.07
84.78
68.11
84.24
68.17
Appendix
Table S8 : Performance comparison of cosine similarity, L1, and L2 distances for latent vector dissimilarity on the PSM dataset. All results are averaged over five random seeds. Boldface indicates the best score.
Figure S5 : Variance of dissimilarity matrices across epochs on the PSM dataset. All results are averaged over five random seeds.
Dataset
Anomaly Score
F1
R - F1
Aff - F1
A - ROC
A - PR
V - ROC
V - PR
PSM
Pscoret⋅Dscoret
65.85
54.66
78.07
84.78
68.11
84.24
68.17
Pscoret+Dscoret
68.36
55.48
78.52
85.03
67.19
84.82
67.43
SWaT
Pscoret⋅Dscoret
76.50
28.15
71.97
82.71
72.39
82.42
74.16
Pscoret+Dscoret
76.91
37.75
73.43
81.73
71.73
81.42
71.07
Appendix
Table S9 : Performance comparison between multiplicative and additive anomaly score fusion on PSM and SWaT datasets. Results are averaged over five random seeds.
Figure S6 : Raw signals of the identified root-cause variables and anomaly score visualization for selected intervals in the PSM dataset. Shaded red regions indicate ground-truth anomalies.
Figure S7 : Visualization for Deviation Matrices Dmatrixt at anomalous time points in PSM dataset. Each matrix corresponds respectively to the subfigures in Figure S6 . Each matrix is independently min–max normalized and values are clipped to the range [0.3, 0.9] to enhance contrast.
Figure S8 : Raw signals of the identified root-cause variables and anomaly score visualization for selected intervals in the SWaT dataset. Shaded red regions indicate ground-truth anomalies.
Figure S9 : Visualization for Deviation Matrices Dmatrixt at anomalous time points in SWaT dataset. Each matrix corresponds respectively to the subfigures in Figure S8 . Each matrix is independently min–max normalized and values are clipped to the range [0.3, 0.9] to enhance contrast.
t=2106
t=4986
t=6032
t=7667
t=14936
t=15065
t=16536
t=18641
Top-3 Predicted
Var.
Score
Var.
Score
Var.
Score
Var.
Score
Var.
Score
Var.
Score
Var.
Score
Var.
Score
13
9.00
13
9.49
32
15.00
29
15.99
33
12.84
13
9.39
13
13.55
15
55.97
12
5.46
8
7.36
33
10.16
33
4.48
32
6.11
8
7.50
12
6.62
10
49.98
8
3.91
12
5.79
31
3.49
34
2.95
35
3.42
12
5.57
8
5.56
18
45.22
Ground Truth
12, 13
8, 12, 13
32, 33
29
32, 33
8, 12, 13, 14
8, 12, 13, 14
10, 15, 18
Appendix
Table S10 : Top-3 predicted variables ranked by aggregate deviation scores compared with ground-truth causal variables across representative anomaly timestamps in the SMD dataset. Each case is drawn from a distinct anomaly segment.
Figure S10 : Deviation matrices correspond to a deviation matrix visualization in Table S10 . Row and column activations highlight the variables most responsible for abnormal behavior, and red boxes mark the ground-truth root-cause variables. For visualization, each matrix is independently min–max normalized and values are clipped to the range [0.3, 0.9] to enhance contrast.
Time-Series Anomaly Detection identifies unusual patterns or events in sequential data, from sensor readings and network traffic to health and industrial telemetry.
Root cause analysis (RCA) for time-series anomaly detection is critical for the reliable operation of complex real-world systems. Existing explanation methods often rely on unrealistic feature perturbations and ignore temporal and cross-feature dependencies, leading to unreliable attributions. We propose a conditional attribution framework that explains anomalies relative to contextually similar normal system states. Instead of using marginal or randomly sampled baselines, our method retrieves representative normal instances conditioned on the anomalous observation, enabling dependency-preserving and operationally meaningful explanations. To support high-dimensional time-series data, contextual retrieval is performed in learned low-dimensional representations using both variational autoencoder latent spaces and UMAP manifold embeddings. By grounding the retrieval process in the system's learned manifold, this strategy avoids out-of-distribution artifacts and ensures attribution fidelity while maintaining computational efficiency. We further introduce confidence-aware and temporal evaluation metrics for assessing explanation reliability and responsiveness. Experiments on the SWaT and MSDS benchmarks demonstrate that the proposed approach consistently improves root-cause identification accuracy, temporal localization, and robustness across multiple anomaly detection models. These results highlight the practical utility of conditional attribution for explainable anomaly diagnosis in complex time-series systems. Code and models are available at: https://github.com/dfki-av/Conditional-Attribution-for-Root-Cause-Analysis-in-Time-Series-Anomaly-Detection.
German Research Center for Artificial Intelligence (DFKI), Kaiserslautern, Germany · Rheinland-Pfälzische Technische Universität Kaiserslautern-Landau, Germany · Paul Wurth S.A, Luxembourg
Anomaly detection in multivariate time series is a central challenge in industrial monitoring, as failures frequently arise from complex temporal dynamics and cross-sensor interactions. While recent deep learning models, including graph neural networks and Transformers, have demonstrated strong empirical performance, most approaches remain primarily correlational and offer limited support for causal interpretation and root-cause localization. This study introduces a causally-constrained probabilistic forecasting framework which is a Causally Guided Transformer (CGT) model for multivariate time-series anomaly detection, integrating an explicit time-lagged causal graph prior with deep sequence modeling. For each target variable, a dedicated forecasting block employs a hard parent mask derived from causal discovery to restrict the main prediction pathway to graph-supported causes, while a latent Gaussian head captures predictive uncertainty. To leverage residual correlational information without compromising the causal representation, a shadow auxiliary path with stop-gradient isolation and a safety-gated blending mechanism is incorporated to suppress non-causal contributions when reliability is low. Anomalies are identified using negative log-likelihood scores with adaptive streaming thresholding, and root-cause variables are determined through per-dimension probabilistic attribution and counterfactual clamping. Experiments on the ASD and SMD benchmarks indicate that the proposed method achieves state-of-the-art detection performance, with F1-scores of 96.19% on ASD and 95.32% on SMD, and enhances variable-level attribution quality. These findings suggest that causal structural priors can improve both robustness and interpretability in detecting deep anomalies in multivariate sensor systems.
Recent studies have explored large language models for time-series anomaly detection, yet existing approaches often rely on a single general-purpose model to directly infer anomaly indices or intervals, limiting controllability, interpretability, and reliability for complex anomaly patterns. We propose SAGE (Specialized Analyzer Group for Expert-like Detection), a multi-agent framework for structured anomaly diagnosis in univariate time series. It decomposes anomaly analysis into four specialized Analyzers for point, structural, seasonal, and pattern anomalies. Each Analyzer applies family-specific numerical tools and diagnostic visualizations to generate evidence, while an evidence-grounded Detector consolidates the evidence into confidence-scored anomaly records with intervals and candidate types. A Supervisor then converts these structured records into analyst-facing diagnostic reports. SAGE further constructs synthetic in-context examples from normal-reference training segments, without using real anomalous segments or anomaly-type labels as in-context examples. Across three benchmarks, SAGE achieves the best average performance among strong ML/DL and language-model-based baselines. Ablation studies and human evaluation further show that the proposed framework improves detection reliability and the practical usefulness of diagnostic outputs.
Hyeongwon Kang, Jeongseob Kim, Jinwoo Park +1
Department of Industrial and Management Engineering Korea University · Mirae Asset Securities · Department of Industrial Engineering Seoul National University