Time series anomaly detection (TSAD) has been an important area of research for decades, with reconstruction-based methods, mostly based on generative models, gaining popularity and demonstrating success. Diffusion models have recently attracted attention due to their advanced generative capabilities. Existing diffusion-based methods for TSAD rely on a conditional strategy, which reconstructs input instances from white noise with the aid of the conditioner. However, this poses challenges in accurately reconstructing the normal parts, resulting in suboptimal detection performance. In response, we propose a novel diffusion-based method, named AnomalyFilter, which acts as a selective filter that only denoises anomaly parts in the instance while retaining normal parts. To build such a filter, we mask Gaussian noise during the training phase and conduct the denoising process without adding noise to the instances. The synergy of the two simple components greatly enhances the performance of naive diffusion models. Extensive experiments on five datasets demonstrate that AnomalyFilter achieves notably low reconstruction error on normal parts, providing empirical support for its effectiveness in anomaly detection. AnomalyFilter represents a pioneering approach that focuses on the noise design of diffusion models specifically tailored for TSAD.
Figures & tables
Figure 1: Reconstruction examples of encoder-decoder models (i.e., BeatGAN and Anomaly-Transformer), conditional diffusion models (i.e., IMDiffusion), and proposed AnomalyFilter.
Figure 2: An overview of AnomalyFilter framework. The model is trained to predict masked Gaussian noise, with the aim of learning to denoise the anomaly parts (i.e., nonmasked parts) and retaining the normal parts (i.e., masked parts). Noiseless inference operates without noise at the beginning and during the denoising steps. Thus, when given a normal instance, it outputs an instance with no change. When given an anomaly instance, only anomalous parts are removed. AnomalyFilter captures temporal and inter-variable dependencies by temporal and feature transformer layers and predicts noise added to the input.
UCR
AIOps
Yahoo real
Yahoo bench
SMD
V-R
V-P
RF
Acc.
V-R
V-P
RF
V-R
V-P
RF
V-R
V-P
RF
V-R
V-P
RF
IsolationForest
0.641
0.106
0.041
0.236
0.798
0.169
0.061
0.699
0.358
0.000
0.611
0.295
0.000
0.735
0.245
0.093
OCSVM
0.645
0.167
0.092
0.300
0.848
0.336
0.152
0.715
0.443
0.000
0.608
0.289
0.000
0.698
0.239
0.156
BeatGAN
0.746
0.205
0.137
0.351
0.889
0.487
0.239
0.751
0.503
0.060
0.720
0.373
0.004
0.819
0.356
0.232
LSTM-VAE
0.739
0.141
0.113
0.217
0.864
0.359
0.185
0.899
0.612
0.076
0.709
0.329
0.003
0.711
0.223
0.190
USAD
0.674
0.156
0.129
0.272
0.889
0.445
0.227
0.830
0.571
0.075
0.612
0.305
0.000
0.508
0.145
0.088
Table 1: Anomaly detection performance. V-R and V-P are VUS-ROC and VUS-PR ( Paparrizos et al. 2022 ) . RF is Range F-score ( Tatbul et al. 2018 ) . Best results are in bold , and second-best results are underlined (higher is better).
UCR
AIOps
Yahoo real
Yahoo bench
SMD
V-R
V-P
RF
Acc
V-R
V-P
RF
V-R
V-P
RF
V-R
V-P
RF
V-R
V-P
RF
DAE
0.760
0.252
0.190
0.386
0.900
0.501
0.266
0.888
0.614
0.083
0.694
0.310
0.003
0.866
0.435
0.238
DAE w/ M
0.685
0.149
0.125
0.266
0.890
0.495
0.243
0.894
0.606
0.080
0.688
0.286
0.001
0.878
0.452
0.257
DAE w/ N
0.758
0.234
0.173
0.382
0.884
0.448
0.257
0.887
0.593
0.073
0.687
0.284
0.001
0.875
0.456
0.255
DAE w/ M&N
0.693
0.172
0.144
0.291
0.915
0.519
0.242
0.905
0.624
0.081
0.696
0.316
0.004
0.876
0.439
0.265
DDPM
0.660
0.071
0.054
0.110
0.761
0.183
0.100
0.865
0.550
0.064
0.714
0.280
0.001
0.786
0.337
0.267
Table 2: Ablation study with different components. M and N refer to Bernoulli mask and Noiseless inference, respectively.
UCR
AIOps
Yahoo real
Yahoo bench
SMD
MSEa
MSEn
MSEnMSEa
MSEa
MSEn
MSEnMSEa
MSEa
MSEn
MSEnMSEa
MSEa
MSEn
MSEnMSEa
MSEa
MSEn
MSEnMSEa
BeatGAN
0.0153
0.0030
5.1
0.0251
0.0005
50.6
9.6410
0.3539
27.2
0.0660
0.0296
2.2
0.0257
0.0053
4.8
LSTM-VAE
0.0171
0.0030
5.7
0.0361
0.0014
25.5
10.6639
0.3497
30.5
0.1656
0.1131
1.5
0.0387
0.0130
3.0
USAD
0.0394
0.0152
2.6
0.0715
0.0068
10.5
12.6297
0.7915
16.0
0.1593
0.1265
1.3
0.0036
0.0015
2.3
Anomaly-Transformer
0.0039
0.0004
10.3
0.0091
0.0002
50.7
9.6449
0.2966
32.5
0.0266
0.0133
2.0
0.0239
0.0042
5.6
TranAD
0.0447
0.0328
1.4
0.0892
0.0187
4.8
12.6501
0.8379
15.1
0.2679
0.2464
1.1
0.0183
0.0032
5.8
Table 3: Reconstruction quality performance. MSEa and MSEn are the MSE values of anomalous and normal parts during the inference. Not necessary, but MSEa should be higher, and MSEn should be lower. The higher the ratio MSEnMSEa is, the easier it is to detect anomalies.
Figure 3: Effect of loss weights and noise strength.
UCR
AIOps
Yahoo real
Yahoo bench
SMD
# of Subdatasets
250
29
37
181
28
# of Features
1
1
1
1
38
Domain
Various
Cloud KPIs
Web traffic
Synthetic
Server
Train (Average per subdataset)
Sequence Length
30522
103588
860
1008
25300
# of Anomalies
0.00
42.35
0.84
5.53
-
Table 4: Statistics of the datasets.
Design Parameter
Value
Architecture
Attention heads
8
# of residual blocks N
8
Latent dimension C
64
Diffusion model
Forward diffusion step T
50
Table 5: Key hyperparameters for AnomalyFilter.
UCR
AIOps
Yahoo real
Yahoo bench
SMD
R-R
R-P
A-R
F
R-R
R-P
A-R
F
R-R
R-P
A-R
F
R-R
R-P
A-R
F
R-R
R-P
A-R
F
IsolationForest
0.653
0.114
0.613
0.057
0.825
0.217
0.824
0.187
0.813
0.595
0.601
0.000
0.705
0.487
0.502
0.000
0.764
0.275
0.799
0.171
OCSVM
0.662
0.187
0.618
0.092
0.874
0.463
0.866
0.220
0.841
0.722
0.633
0.000
0.710
0.516
0.523
0.000
0.727
0.274
0.801
0.254
BeatGAN
0.752
0.209
0.729
0.158
0.912
0.594
0.814
0.214
0.852
0.723
0.655
0.063
0.799
0.577
0.624
0.005
0.829
0.383
0.857
0.325
LSTM-VAE
0.745
0.140
0.719
0.117
0.881
0.419
0.830
0.197
0.934
0.782
0.846
0.092
0.781
0.520
0.617
0.003
0.732
0.239
0.798
0.266
USAD
0.684
0.157
0.651
0.138
0.908
0.541
0.862
0.221
0.892
0.758
0.771
0.081
0.695
0.485
0.527
0.000
0.550
0.183
0.583
0.118
Table 6: R-R, R-P, A-R, and F are Range-AUC-ROC, Range-AUC-PR ( Paparrizos et al. 2022 ) , AUC-ROC, and F1.
UCR
AIOps
Yahoo real
Yahoo bench
SMD
V-R
V-P
RF
Acc.
V-R
V-P
RF
V-R
V-P
RF
V-R
V-P
RF
V-R
V-P
RF
IsolationForest
0.262
0.201
0.125
0.425
0.103
0.125
0.077
0.220
0.193
0.000
0.195
0.176
0.000
0.145
0.189
0.104
OCSVM
0.271
0.267
0.203
0.459
0.115
0.201
0.132
0.225
0.218
0.000
0.210
0.173
0.000
0.159
0.202
0.199
BeatGAN
0.232
0.280
0.206
0.478
0.116
0.222
0.129
0.217
0.224
0.114
0.186
0.229
0.019
0.144
0.226
0.189
LSTM-VAE
0.208
0.231
0.186
0.412
0.117
0.207
0.125
0.125
0.269
0.161
0.195
0.223
0.021
0.147
0.181
0.210
USAD
0.235
0.257
0.233
0.446
0.123
0.235
0.145
0.196
0.267
0.148
0.235
0.214
0.000
0.201
0.135
0.123
Table 7: Standard deviation of VUS-ROC, VUS-PR, and Range F-score.
Figure 4: Critical difference diagram of VUS-PR.
Figure 5: Reconstruction examples across DDPM variants of #029 ABP on UCR.
Figure 6: Sensitivity analysis across four hyperparameters.
Figure 7: Computational time for training and inference.
Figure 8: Reconstruction examples across different methods of (a) AIOps, (b) Yahoo real, (c) Yahoo bench, and (d) SMD.
Diffusion models have recently shown strong potential for multivariate time-series anomaly detection by learning the distribution of normal data through iterative denoising. Existing diffusion-based approaches, however, typically perform anomaly detection after completing the reverse diffusion process, relying primarily on the final reconstructed signal and overlooking informative representations produced during denoising. This design incurs substantial computational cost and limits the use of intermediate diffusion information for anomaly detection. In this paper, we propose FirstDiff, a diffusion-based anomaly detection framework based on the observation that the predicted diffusion noise at the initial reverse-diffusion evaluation already contains sufficient information for accurate anomaly detection. FirstDiff models the statistical distribution of predicted diffusion noise under normal behavior using validation data, enabling anomaly inference from a single denoising-network evaluation rather than completing the reverse diffusion trajectory. To model complex temporal and inter-sensor dependencies, FirstDiff employs a Diffusion Transformer as the denoising backbone. Extensive experiments on five public benchmark datasets demonstrate that FirstDiff achieves state-of-the-art performance while reducing diffusion inference from the full reverse trajectory to a single denoising-network evaluation.
Reconstruction-based methods are a dominant paradigm in time series anomaly detection (TSAD), however, their near-universal reliance on Mean Squared Error (MSE) loss results in statistically flawed reconstruction residuals. This fundamental weakness leads to noisy, unstable anomaly scores, hindering reliable detection. To address this, we propose Constrained Gaussian-Noise Optimization and Smoothing (COGNOS), a universal, model-agnostic enhancement framework that tackles this issue at its source. COGNOS introduces a novel Gaussian-White Noise Regularization strategy during training, which directly constrains the model's output residuals to conform to a Gaussian white noise distribution. This engineered statistical property creates the ideal precondition for our second contribution: Adaptive Residual Kalman Smoother that operates as a statistically robust estimator to denoise the raw anomaly scores. Extensive experiments on multiple benchmarks demonstrate that COGNOS consistently enhances the performance of state-of-the-art backbones significantly, validating the efficacy of coupling statistical regularization with adaptive filtering.
Wenlong Shang, Shihao Tian, Xutong Wan +1
School of Information Science and Technology, Beijing University of Technology, China · Beijing Key Laboratory of Computational Intelligence and Intelligent System, Beijing University of Technology, China
We propose NV-Tesseract-AD, a curriculum learning-enhanced conditional diffusion framework for multivariate time-series anomaly detection. Our central hypothesis is that reconstruction difficulty can be explicitly structured along two complementary axes, masking severity and diffusion noise level, and that training from easier to harder tasks along both axes simultaneously stabilizes optimization and improves residual discriminability. We integrate a Transformer-based diffusion backbone with a three-stage dual curriculum over masking ratios and diffusion timesteps, retaining anomalous samples throughout training and relying on structured corruption to drive self-supervised representation learning. We evaluate NV-Tesseract-AD under two regimes: in-distribution training on the TSB-UAD-M corpus and strict zero-shot transfer to ten EasyTSAD benchmark families without per-dataset tuning. The dual-axis curriculum produces masking-invariant reconstruction, confirmed by a near-zero loss gap between complementary masking strategies within the first training stage, and yields an approximately 3.7-fold improvement in F1 and a 56 percent reduction in MSE relative to a non-curriculum baseline. Zero-shot performance reaches F1 = 0.984 on NAB and F1 = 0.948 on NormA. Weaker results on heterogeneous families are traced to unsupervised threshold calibration rather than reconstruction quality, identifying calibration as the dominant remaining detection bottleneck. Accelerated inference via DPM-Solver++ reduces sampling cost by a factor of 3.5 to 5.7 at the dataset level but couples to thresholding behavior, establishing that the sampler and threshold must be validated jointly. Together, these findings demonstrate that aligning diffusion denoising difficulty with curriculum learning principles provides a principled and practical approach for robust anomaly detection in complex multivariate time series.