Structured Temporal Causality for Interpretable Multivariate Time Series Anomaly Detection

Dongchan Cho; Jiho Han; Keumyeong Kang; Minsang Kim; Honggyu Ryu; Namsoon Jung

cs.LGOct 18, 2025

Structured Temporal Causality for Interpretable Multivariate Time Series Anomaly Detection

Authors: Dongchan Cho, Jiho Han, Keumyeong Kang, Minsang Kim, Honggyu Ryu, Namsoon Jung

Organizations: Industrial AI Lab, SimPlatform Co. Ltd. Affiliate Research Institute

Abstract

Real-world multivariate time series anomalies are rare and often unlabeled. Additionally, prevailing methods rely on increasingly complex architectures tuned to benchmarks, detecting only fragments of anomalous segments and overstating performance. In this paper, we introduce OracleAD, a simple and interpretable unsupervised framework for multivariate time series anomaly detection. OracleAD encodes each variable's past sequence into a single causal embedding to jointly predict the present time point and reconstruct the input window, effectively modeling temporal dynamics. These embeddings then undergo a self-attention mechanism to project them into a shared latent space and capture spatial relationships. These relationships are not static, since they are modeled by a property that emerges from each variable's temporal dynamics. The projected embeddings are aligned to a Stable Latent Structure (SLS) representing normal-state relationships. Anomalies are identified using a dual scoring mechanism based on prediction error and deviation from the SLS, enabling fine-grained anomaly diagnosis at each time point and across individual variables. Since any noticeable SLS deviation originates from embeddings that violate the learned temporal causality of normal data, OracleAD directly pinpoints the root-cause variables at the embedding level. OracleAD achieves state-of-the-art results across multiple real-world datasets and evaluation protocols, while remaining interpretable through SLS.

Figures & tables

Figure 1: Overview of the OracleAD pipeline. Each variable’s past window is encoded by an LSTM and pooled via attention. The resulting embeddings are refined through multi-head self-attention to capture inter-variable dependencies. These embeddings are then fed into an LSTM decoder for reconstruction and next-step prediction. Finally, the pairwise distance matrix of the embeddings is compared against the Stable Latent Structure (SLS) to detect anomalies. The decoder uses an all-zero vector $z$ as its initial input.

Dataset	Metric	A.E	Omni	A.T	Patch	TsNet	DLin	NLin	DC	iTrans	Modern	SARAD	CATCH	OracleAD
	F1	47.55	45.90	43.45	43.45	43.45	43.45	43.45	43.45	43.45	43.45	45.75	44.33	65.85
	R-F1	45.93	40.58	12.17	34.75	37.49	34.74	32.10	21.35	35.91	35.48	13.54	54.19	54.66
	Aff-F1	73.70	73.49	69.68	69.43	69.43	69.43	69.43	69.59	69.53	69.43	77.12	79.16	78.07
PSM	A-ROC	66.79	63.95	38.35	58.68	59.09	58.02	58.56	49.86	59.22	59.21	62.86	64.75	84.78
	A-PR	47.27	45.00	24.28	37.91	38.95	37.17	37.64	27.78	38.27	38.59	41.67	43.40	68.11
	V-ROC	68.20	61.23	50.96	50.62	50.67	50.53	50.69	50.11	51.23	50.68	57.63	57.00	84.24

Table 1: Performance (%) of deep anomaly detection models across seven evaluation metrics on three benchmark datasets (PSM, SMD, SWaT). All results are averaged over five random seeds. Boldface indicates the best score and underline indicates the second-best score.

Panel of Figure 2 — Figure 2: Raw signals of the identified root-cause variables and anomaly score visualization for selected intervals in the SMD dataset. Shaded red regions indicate ground-truth anomalies.

Panel of Figure 3 — Figure 3: Visualization for Deviation Matrices $\mathcal{D}^{t}_{\text{matrix}}$ at anomalous time points in SMD dataset. Each matrix corresponds respectively to the subfigures in Figure 2 . The color bar of each heatmap represents the magnitude of pairwise dissimilarity between variables. A bigger row over column value means a higher chance of an anomaly in that variable. For visualization, each matrix is independently min–max normalized and values are clipped to the range [0.3, 0.9] to enhance contrast.

Appendix figures & tables19 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	Subsets	Features	Avg Set Size		Anomalies		Segment Lengths			Sampling
			Train	Test	Count	Ratio	Min	Med	Max	Period
PSM	1	25	132,481	87,841	71	27.73%	1	5	8,861	1 min
SMD	28	38	25,300	25,301	327	4.16%	2	11	3,161	1 min
SWaT	1	51	496,800	449,919	34	12.02%	101	447	35,900	1 sec

Appendix

Table S1 : Statistics of the benchmark datasets used for multivariate time-series anomaly detection.

Metric	Granularity	Threshold-Free	Temporal-Aware	Partial Credit	Imbalance-Robust
Standard F1	Point-wise	No	No	No	Partial
Range-based F1	Segment-wise	No	Partial	Yes	Partial
Affiliation F1	Segment-wise	No	Yes	Yes	Partial
AUC-ROC	Point-wise	Yes	No	No	No
AUC-PR	Point-wise	Yes	No	No	Yes
VUS-ROC	Point+Time	Yes	Yes	Yes	Yes

Appendix

Table S2 : Comparison of evaluation metrics for time-series anomaly detection. ’Partial’ denotes limited or conditional support depending on implementation details (e.g., decay functions, overlap thresholds).

Figure S1 : Effect of input window length on OracleAD performance. Each subplot shows a different evaluation metric. All results are averaged over five random seeds.

Figure S2 : Effect of training batch size on OracleAD performance. Each subplot shows a different evaluation metric. All results are averaged over five random seeds.

Figure S3 : Effect of the deviation regularization weight

\lambda_{\text{dev}}

on OracleAD performance. Each subplot shows a different evaluation metric. All results are averaged over five random seeds.

Figure S4 : Effect of the encoder and decoder depth on OracleAD performance. Each subplot shows a different evaluation metric. All results are averaged over five random seeds.

Dataset (N)	Batch Size	Memory Usage	Training Speed (it/s)
PSM (25)	64	1.5 GB	12.6
	1024	8.5 GB	9.6
SMD (38)	64	1.9 GB	8.0
	1024	13.0 GB	6.8
SWaT (51)	64	2.4 GB	6.0
	1024	18.5 GB	5.0

Appendix

Table S3 : Training costs across datasets and batch sizes.

Dataset (N)	Inference Speed (time steps/s)
PSM (25)	54.0
SMD (38)	37.0
SWaT (51)	28.0
Syn-PSM (100)	13.5
Syn-PSM (400)	3.15

Appendix

Table S4 : Inference throughput by dataset dimensionality.

Dataset	Metric	PCA	HBOS	IF	A.E	Omni	A.T	Patch	TsNet	DLin	NLin	DC	iTrans	Modern	SARAD	CATCH	OracleAD
	F1	46.45	45.98	43.45	47.55	45.90	43.45	43.45	43.45	43.45	43.45	43.45	43.45	43.45	45.75	44.33	65.85
	R-F1	46.18	47.74	45.78	45.93	40.58	12.17	34.75	37.49	34.74	32.10	21.35	35.91	35.48	13.54	54.19	54.66
	Aff-F1	73.90	72.77	81.98	73.70	73.49	69.68	69.43	69.43	69.43	69.43	69.59	69.53	69.43	77.12	79.16	78.07
PSM	A-ROC	64.82	61.98	54.23	66.79	63.95	38.35	58.68	59.09	58.02	58.56	49.86	59.22	59.21	62.86	64.75	84.78
	A-PR	46.75	39.34	33.41	47.27	45.00	24.28	37.91	38.95	37.17	37.64	27.78	38.27	38.59	41.67	43.40	68.11
	V-ROC	66.59	63.20	56.47	68.20	61.23	50.96	50.62	50.67	50.53	50.69	50.11	51.23	50.68	57.63	57.00	84.24

Appendix

Table S5 : Performance (%) of anomaly detection models on the PSM, SMD, and SWaT datasets. Boldface indicates the best score and underline indicates the second-best score.

Dataset	Metric	A.E	Omni	A.T	Patch	TsNet	DLin	NLin	DC	iTrans	Modern	SARAD	CATCH	OracleAD
	F1	0.44	1.29	0.00	0.00	0.00	0.00	0.00	0.00	0.00	0.00	1.50	1.59	2.98
	R-F1	0.48	2.49	7.50	0.44	0.61	0.61	0.11	24.03	1.67	0.38	7.54	5.46	2.93
	Aff-F1	0.24	0.65	0.55	0.00	0.00	0.00	0.00	0.36	0.23	0.00	4.30	4.76	0.94
PSM	A-ROC	1.07	1.89	2.10	0.06	0.56	0.07	0.05	0.29	0.11	0.14	1.52	0.78	2.49
	A-PR	0.59	2.34	0.88	0.10	0.46	0.05	0.05	0.24	0.11	0.18	1.26	0.75	4.30
	V-ROC	0.96	0.56	0.95	0.05	0.03	0.08	0.01	0.56	0.24	0.03	4.98	5.14	2.47

Appendix

Table S7 : Standard deviation (%) of anomaly detection performance across seven evaluation metrics on three benchmark datasets (PSM, SMD, and SWaT). All values are computed over five random seeds for each model. Lower values indicate higher stability and consistency across runs. Metrics include F1, R-F1, Aff-F1, AUC-ROC, AUC-PR, VUS-ROC, and VUS-PR.

Method	F1	R-F1	Aff-F1	A-ROC	A-PR	V-ROC	V-PR
Cosine Sim.	46.81	43.68	78.18	66.46	48.59	65.83	48.82
L1	57.72	51.54	75.87	76.33	54.29	73.33	53.52
L2	65.85	54.66	78.07	84.78	68.11	84.24	68.17

Appendix

Table S8 : Performance comparison of cosine similarity, L1, and L2 distances for latent vector dissimilarity on the PSM dataset. All results are averaged over five random seeds. Boldface indicates the best score.

Figure S5 : Variance of dissimilarity matrices across epochs on the PSM dataset. All results are averaged over five random seeds.

Dataset	Anomaly Score	F1	R - F1	Aff - F1	A - ROC	A - PR	V - ROC	V - PR
PSM	$\mathcal{P}^{t}_{\text{score}}\cdot\mathcal{D}^{t}_{\text{score}}$	65.85	54.66	78.07	84.78	68.11	84.24	68.17
PSM	$\mathcal{P}^{t}_{\text{score}}+\mathcal{D}^{t}_{\text{score}}$	68.36	55.48	78.52	85.03	67.19	84.82	67.43
SWaT	$\mathcal{P}^{t}_{\text{score}}\cdot\mathcal{D}^{t}_{\text{score}}$	76.50	28.15	71.97	82.71	72.39	82.42	74.16
SWaT	$\mathcal{P}^{t}_{\text{score}}+\mathcal{D}^{t}_{\text{score}}$	76.91	37.75	73.43	81.73	71.73	81.42	71.07

Appendix

Table S9 : Performance comparison between multiplicative and additive anomaly score fusion on PSM and SWaT datasets. Results are averaged over five random seeds.

Figure S6 : Raw signals of the identified root-cause variables and anomaly score visualization for selected intervals in the PSM dataset. Shaded red regions indicate ground-truth anomalies.

Figure S7 : Visualization for Deviation Matrices $\mathcal{D}^{t}_{\text{matrix}}$ at anomalous time points in PSM dataset. Each matrix corresponds respectively to the subfigures in Figure S6 . Each matrix is independently min–max normalized and values are clipped to the range [0.3, 0.9] to enhance contrast.

Figure S8 : Raw signals of the identified root-cause variables and anomaly score visualization for selected intervals in the SWaT dataset. Shaded red regions indicate ground-truth anomalies.

Figure S9 : Visualization for Deviation Matrices $\mathcal{D}^{t}_{\text{matrix}}$ at anomalous time points in SWaT dataset. Each matrix corresponds respectively to the subfigures in Figure S8 . Each matrix is independently min–max normalized and values are clipped to the range [0.3, 0.9] to enhance contrast.

	$t{=}2106$		$t{=}4986$		$t{=}6032$		$t{=}7667$		$t{=}14936$		$t{=}15065$		$t{=}16536$		$t{=}18641$
Top-3 Predicted	Var.	Score	Var.	Score	Var.	Score	Var.	Score	Var.	Score	Var.	Score	Var.	Score	Var.	Score
	13	9.00	13	9.49	32	15.00	29	15.99	33	12.84	13	9.39	13	13.55	15	55.97
	12	5.46	8	7.36	33	10.16	33	4.48	32	6.11	8	7.50	12	6.62	10	49.98
	8	3.91	12	5.79	31	3.49	34	2.95	35	3.42	12	5.57	8	5.56	18	45.22
Ground Truth	12, 13		8, 12, 13		32, 33		29		32, 33		8, 12, 13, 14		8, 12, 13, 14		10, 15, 18

Appendix

Table S10 : Top-3 predicted variables ranked by aggregate deviation scores compared with ground-truth causal variables across representative anomaly timestamps in the SMD dataset. Each case is drawn from a distinct anomaly segment.

Figure S10 : Deviation matrices correspond to a deviation matrix visualization in Table S10 . Row and column activations highlight the variables most responsible for abnormal behavior, and red boxes mark the ground-truth root-cause variables. For visualization, each matrix is independently min–max normalized and values are clipped to the range [0.3, 0.9] to enhance contrast.

Time-Series Anomaly Detection

Time-Series Anomaly Detection identifies unusual patterns or events in sequential data, from sensor readings and network traffic to health and industrial telemetry.

See all 203 papers

Conditional Attribution for Root Cause Analysis in Time-Series Anomaly Detection
Apr 19, 2026Shashank Mishra, Karan Patil, Cedric Schockaert +2Feature Attribution Interpretable Anomaly Detection
German Research Center for Artificial Intelligence (DFKI), Kaiserslautern, Germany · Rheinland-Pfälzische Technische Universität Kaiserslautern-Landau, Germany · Paul Wurth S.A, Luxembourg
Causally-Constrained Probabilistic Forecasting for Time-Series Anomaly Detection
Apr 20, 2026Pooyan Khosravinia, João Gama, Bruno VelosoAnomaly Localization Time-Series Anomaly Detection
Detecting Time Series Anomalies Like an Expert: A Multi-Agent LLM Framework with Specialized Analyzers
May 7, 2026Hyeongwon Kang, Jeongseob Kim, Jinwoo Park +1LLM-Based Time Series Anomaly Detection Interpretable Anomaly Detection
Department of Industrial and Management Engineering Korea University · Mirae Asset Securities · Department of Industrial Engineering Seoul National University

Apr 19, 2026J/K move · Enter open · S save

Conditional Attribution for Root Cause Analysis in Time-Series Anomaly Detection

Shashank Mishra, Karan Patil, Cedric Schockaert, Didier Stricker+1

German Research Center for Artificial Intelligence (DFKI), Kaiserslautern, Germany · Rheinland-Pfälzische Technische Universität Kaiserslautern-Landau, Germany · Paul Wurth S.A, Luxembourg

Feature Attribution Interpretable Anomaly Detection Anomaly Localization Root Cause Analysis Time-Series Anomaly Detection

Open paper AskPDF arXiv

Root cause analysis (RCA) for time-series anomaly detection is critical for the reliable operation of complex real-world systems. Existing explanation methods often rely on unrealistic feature perturbations and ignore temporal and cross-feature dependencies, leading to unreliable attributions. We propose a conditional attribution framework that explains anomalies relative to contextually similar normal system states. Instead of using marginal or randomly sampled baselines, our method retrieves representative normal instances conditioned on the anomalous observation, enabling dependency-preserving and operationally meaningful explanations. To support high-dimensional time-series data, contextual retrieval is performed in learned low-dimensional representations using both variational autoencoder latent spaces and UMAP manifold embeddings. By grounding the retrieval process in the system's learned manifold, this strategy avoids out-of-distribution artifacts and ensures attribution fidelity while maintaining computational efficiency. We further introduce confidence-aware and temporal evaluation metrics for assessing explanation reliability and responsiveness. Experiments on the SWaT and MSDS benchmarks demonstrate that the proposed approach consistently improves root-cause identification accuracy, temporal localization, and robustness across multiple anomaly detection models. These results highlight the practical utility of conditional attribution for explainable anomaly diagnosis in complex time-series systems. Code and models are available at: https://github.com/dfki-av/Conditional-Attribution-for-Root-Cause-Analysis-in-Time-Series-Anomaly-Detection.

Abstract

Time-Series Anomaly Detection

Explore similar work

Conditional Attribution for Root Cause Analysis in Time-Series Anomaly Detection

Causally-Constrained Probabilistic Forecasting for Time-Series Anomaly Detection

Detecting Time Series Anomalies Like an Expert: A Multi-Agent LLM Framework with Specialized Analyzers