cs.LGMar 10, 2026
SaveTemporal-Conditioned Normalizing Flows for Multivariate Time Series Anomaly Detection
Organizations: Department of Computer Science, Norwegian University of Science and Technology.
Abstract
This paper introduces temporal-conditioned normalizing flows (tcNF), a novel framework that addresses anomaly detection in time series data with accurate modeling of temporal dependencies and uncertainty. By conditioning normalizing flows on previous observations, tcNF effectively captures complex temporal dynamics and generates accurate probability distributions of expected behavior. This autoregressive approach enables robust anomaly detection by identifying low-probability events within the learned distribution. We evaluate tcNF on diverse datasets, demonstrating good accuracy and robustness compared to existing methods. A comprehensive analysis of strengths and limitations and open-source code is provided to facilitate reproducibility and future research.
Figures & tables
Figure 1: Forward propagation of one coupling layer from the base distribution to the data distribution.
Figure 2: Overview of a temporal-conditioned coupling layer, drawn as normalization (reverse process) of the data distribution . We drop the coupling layer index and the time index from and whenever it is clear from the context. The diagram illustrates how the conditioning information (red arrows) is added to the conditioner function expressed as . After one such transformation, it is required to swap the two slices, such as and , to achieve a full coupling of the input as the next of the following layer.
| Dataset | # Datasets | Variables | Train | Test | Anomalies (%) |
|---|---|---|---|---|---|
| FSB Baumgartner et al. (2023) | 70 | ||||
| SRB Baumgartner et al. (2023) | 4 | 4 | |||
| SWaT Goh et al. (2017) | 1 | 51 | 449919 | 449919 | |
| CalIt2 Hutchins (2006) | 1 | 2 | |||
| GHL Filonov et al. (2016) | 48 | 16 | |||
| Metro Hogue (2019) | 1 | 5 | |||
Table 1: Description of the datasets. (%) is the percentage of anomalous data points in the dataset.
| Parameter | RealNVP | tcNF-base | tcNF-mlp | tcNF-cnn | tcNF-stateless | tcNF-stateful |
|---|---|---|---|---|---|---|
| Coupling layers | For all models: | |||||
| multiplier | For all models: | |||||
| layers | For all models: | |||||
| dropout | For all models: | |||||
| funnel factor | For all models: | |||||
| Look-back window | - | FSB: , others: | ||||
Table 2: The listed hyperparameters are optimized per dataset and explored with CMA-ES to find a good parameter set. parameters are for the conditioner function in each coupling layer. Past and parameters are primarily for the encoder outside the normalizing flow. ”-” indicates that this parameter is not part of a given method.
Figure 3: Comparison of anomaly detection performance on the FSB benchmark using AUC (top) and VUS (bottom) sorted by average performance on the AUC metric. The results demonstrate the competitive performance of the proposed tcNF models compared to established baselines, particularly in terms of RealNVP Dinh et al. (2017) as the unchanged baseline method.
| (a) AUC | ||||||
|---|---|---|---|---|---|---|
| Sine (16) | ECG-CBF-RW (20) | Increasing (13) | Saw (2) | Wave (14) | Corr (5) | |
| Method | ||||||
| tcNF-base | 0.85 ± 0.15 | 0.69 ± 0.27 | 0.97 ± 0.04 | 0.97 ± 0.01 | 0.90 ± 0.10 | 0.70 ± 0.18 |
| tcNF-mlp | 0.83 ± 0.14 | 0.59 ± 0.33 | 0.83 ± 0.12 | 0.98 ± 0.02 | 0.62 ± 0.26 | 0.72 ± 0.17 |
| tcNF-cnn | 0.83 ± 0.16 | 0.67 ± 0.31 | 0.89 ± 0.12 | 0.98 ± 0.01 | 0.87 ± 0.15 | 0.68 ± 0.19 |
| tcNF-stateless | 0.78 ± 0.23 | 0.63 ± 0.30 | 0.88 ± 0.11 | 0.98 ± 0.01 | 0.76 ± 0.21 | 0.70 ± 0.15 |
Table 3: Comparing anomaly detection performance on the FSB benchmark from the sequence type using AUC (a) and VUS (b). The results show that our proposed tcNF models can handle most sequences well and shows difficulties on rapidly changing signals, demonstrating overall a competitive performance. Method categories: red : deep learning, blue : classic machine learning, black : outlier detection, : distribution, : reconstruction, : distance, : forecasting and : trees.
Figure 4: The first row shows the training sequences and the latent representation to the right. The second row contains the test sequence with no clearly visible anomaly in the sequence to the human eye. The latent representation to the right clearly shows one out-of-distribution point as indicated by the red triangle. The anomaly in this case is a sudden jump in one timestep, as marked by the anomaly label in the third row, and is based on the standard deviation of the values in the 10 previous timesteps. Both latent space representations indicate that the model captured the sequence behavior, and only noise remains.
Figure 5: The parameter search in this case highlights that a rather extensive access to previous datapoints is important, which correlates with an increased model capacity, such as multiplier and layers in each coupling layer.
| AUC | VUS | |
| Method | ||
| tcNF-base | 0.73 ± 0.17 | 0.70 ± 0.20 |
| tcNF-cnn | 0.72 ± 0.19 | 0.70 ± 0.20 |
| tcNF-mlp | 0.69 ± 0.20 | 0.66 ± 0.22 |
| tcNF-stateless | 0.59 ± 0.13 | 0.54 ± 0.18 |
| IF-LOF Cheng et al. (2019) | 0.90 ± 0.14 | 0.95 ± 0.05 |
Table 4: Comparing anomaly detection performance on the SRB benchmark from the sequence type using AUC and VUS. The results show our proposed tcNF models can outperform the base model, RealNVP, but can not fully outperform all other models on this benchmark suite. See Tab. 3 for method categories.
| (a) AUC | |||||
|---|---|---|---|---|---|
| SWaT | CalIt | GHL | Metro | SMD | |
| Method | |||||
| tcNF-base | 0.88 | 0.25 | 0.88 ± 0.09 | 0.48 | 0.78 ± 0.11 |
| tcNF-mlp | 0.88 | 0.30 | 0.64 ± 0.34 | 0.67 | 0.80 ± 0.14 |
| tcNF-cnn | 0.84 | 0.29 | 0.89 ± 0.04 | 0.49 | 0.80 ± 0.13 |
| tcNF-stateless | 0.88 | 0.23 | 0.58 ± 0.40 | 0.53 | 0.78 ± 0.14 |
Table 5: Comparison of anomaly detection performance on five real-world datasets using AUC (a) and VUS (b). The results demonstrate various performance improvements over the base method. SWaT, CalIt, and Metro consist of rapidly jumping values, which are difficult for our method. GHL and SMD consist of a mix of jumps and smoother channels, which work better for our method. See Tab. 3 for method categories.
Figure 6: Clip-out of the machine-1-5 sequence in the SMD dataset showing the training sequence with some normal and unusual behaviour. The test sequence contains a strong anomaly in two out of the 38 channels, where six distinct channels are shown. This case shows the delay of the tcNF-cnn method, which relies more strongly on historical behavior via the conditioning.
Figure 7: The most significant parameters in this example are the multiplier, layers, funnel, number of coupling layers and look-back size. The parameters indicate a successful regularisation by the optimization search and the other two indicate that a certain amount is needed to be able to learn a good representation.
Figure 8: Clip-out of the machine-2-5 sequence in the SMD dataset showing a normal training set with one exception in the beginning which can also be seen in the latent space as outlier. The test sequence contains two labeled anomalies. A zoom in would reveal an early detection meaning at the beginning of the anomaly, which indicates that, in this case, the near past is important for the detection.
Figure 9: The parameter optimization search reveals exactly that the previous observations is important for this sequence, including some regularisation on the other parameters.