ARTA: Adversarial-Robust Multivariate Time--Series Anomaly Detection via Sparsity-Constrained Perturbations

Hadi Hojjati; Narges Armanfard

cs.LGMar 26, 2026

ARTA: Adversarial-Robust Multivariate Time--Series Anomaly Detection via Sparsity-Constrained Perturbations

Authors: Hadi Hojjati, Narges Armanfard

Organizations: McGill University, MILA - Quebec AI Institute, Montreal, Quebec, Canada

Abstract

Time-series anomaly detection (TSAD) is a critical component in monitoring complex systems, yet modern deep learning-based detectors are often highly sensitive to localized input corruptions and structured noise. We propose ARTA (Adversarially Robust multivariate Time-series Anomaly detection via sparsity-constrained perturbations), a joint training framework that improves detector robustness through a principled min-max optimization objective. ARTA comprises an anomaly detector and a sparsity-constrained mask generator that are trained simultaneously. The generator identifies minimal, task-relevant temporal perturbations that maximally increase the detector's anomaly score, while the detector is optimized to remain stable under these structured perturbations. The resulting masks characterize the detector's sensitivity to adversarial temporal corruptions and can serve as explanatory signals for the detector's decisions. This adversarial training strategy exposes brittle decision pathways and encourages the detector to rely on distributed and stable temporal patterns rather than spurious localized artifacts. We conduct extensive experiments on the TSB-AD benchmark, demonstrating that ARTA consistently improves anomaly detection performance across diverse datasets and exhibits significantly more graceful degradation under increasing noise levels compared to state-of-the-art baselines.

Figures & tables

Figure 1. Overview of the proposed method during training and inference. A block diagram showing the ARTSADIR architecture.

Method	CATSv2	Daphnet	Exathlon	GECCO	LTDB	MITDB	OPP	PSM	SMD	SVDB
PCA ( Jolliffe, 1986 )	0.12	0.13	0.95	0.20	0.24	0.07	0.30	0.16	0.36	0.11
MCD ( Rousseeuw and Driessen, 1999 )	0.13	0.14	0.80	0.03	0.21	0.04	0.17	0.26	0.26	0.07
OCSVM ( Ma and Perkins, 2003 )	0.08	0.06	0.83	0.04	0.20	0.04	0.12	0.19	0.28	0.06
KNN ( Ramaswamy et al., 2000 )	0.07	0.25	0.33	0.11	0.19	0.04	0.06	0.12	0.30	0.06
LOF ( Breunig et al., 2000 )	0.05	0.11	0.16	0.13	0.19	0.04	0.10	0.15	0.16	0.06
KMeansAD ( Yairi et al., 2001 )	0.12	0.30	0.37	0.06	0.41	0.06	0.06	0.21	0.36	0.20

Table 1. Comparison of VUS–PR (

\uparrow

) between ARTA and other baselines on 10 Multivariate Time–Series Anomaly Detection Datasets.

Panel of Figure 2 — Figure 2. Robustness evaluation of anomaly detection methods under input corruption. Top row: Salt–and–pepper noise with varying corruption probability. Bottom row: Colored noise with varying SNR. Results are shown for three datasets and averaged over five runs. A figure showing the results of robustness evaluation of anomaly detection methods under input corruption.

Method	CATSv2	Daphnet	Exathlon	GECCO	LTDB	MITDB	OPP	PSM	SMD	SVDB
Full Model	0.31	0.41	0.95	0.20	0.45	0.21	0.35	0.30	0.37	0.48
w/o Generator	0.08	0.13	0.90	0.06	0.23	0.05	0.17	0.28	0.26	0.11
w/o Adversarial Training	0.13	0.34	0.93	0.13	0.14	0.11	0.26	0.28	0.31	0.27
w/o Sparsity Penalty	0.18	0.28	0.90	0.18	0.26	0.18	0.22	0.18	0.28	0.36
Reconstruction Error	0.31	0.41	0.95	0.20	0.45	0.21	0.35	0.30	0.37	0.48
Mask–Weighted	0.31	0.36	0.88	0.08	0.31	0.12	0.69	0.29	0.30	0.29

Table 2. Ablation study results. The top and bottom rows show the impact of components and anomaly scores, respectively.

Method	CATSv2	Daphnet	Exathlon	GECCO	LTDB	MITDB	OPP	PSM	SMD	SVDB
LSTM	0.31	0.41	0.95	0.20	0.45	0.21	0.35	0.30	0.37	0.48
CNN	0.28	0.38	0.93	0.22	0.41	0.18	0.41	0.28	0.41	0.42
Transformer	0.24	0.38	0.95	0.16	0.45	0.12	0.38	0.22	0.28	0.38
FC	0.23	0.27	0.92	0.20	0.38	0.14	0.32	0.20	0.28	0.33

Table 3. Effect of generator and detector backbone architectures. All results are reported in terms of VUS–PR.

Method	CATSv2	Daphnet	Exathlon	GECCO	LTDB	MITDB	OPP	PSM	SMD	SVDB
Reconstruction	0.31	0.41	0.95	0.20	0.45	0.21	0.35	0.30	0.37	0.48
Prediction	0.28	0.34	0.95	0.20	0.38	0.18	0.37	0.22	0.33	0.40

Table 4. Comparison between reconstruction–based and prediction–based detectors under the same adversarial training setup. Both methods use LSTM as their backbone architecture.

Anomaly Score	CATSv2	Daphnet	Exathlon	GECCO	LTDB	MITDB	OPP	PSM	SMD	SVDB
with Baseline	0.31	0.41	0.95	0.20	0.45	0.21	0.35	0.30	0.37	0.48
w/o Baseline	0.29	0.35	0.93	0.14	0.42	0.20	0.37	0.28	0.36	0.45

Table 5. Effect of baseline–aware perturbation

Panel of Figure 3 — Figure 3. Qualitative examples of generator masks on selected samples. Mask values are thresholded and highlighted in red. A figure showing qualitative examples of generator masks on selected samples.

Panel of Figure 4 — Figure 4. Robustness evaluation of anomaly detection methods under additive Gaussian noise with varying signal–to–noise ratios (SNR) across three representative datasets, averaged over five runs. O̱ur method consistently demonstrates slower performance degradation. A figure showing robustness evaluation of anomaly detection methods under additive Gaussian noise with varying signal–to–noise ratios (SNR) across three representative datasets, averaged over five runs.

Hyperparameter	$0.0001$	$0.001$	$0.01$	$0.1$	$1$	$10$	$100$	$1000$	$10000$
Sparsity $\lambda$ ( $\gamma=0.1$ )	0.31	0.34	0.40	0.39	0.33	0.29	0.27	0.26	0.24
Robustness $\gamma$ ( $\lambda=0.01$ )	0.23	0.30	0.37	0.40	0.38	0.36	0.30	0.28	0.27

Table 6. Average performance across all datasets, computed as the mean VUS–PR, for different settings of the hyperparameters

\lambda

and

\gamma

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Method	F1 ( $\uparrow$ )	AUC–PR ( $\uparrow$ )	AUC–ROC ( $\uparrow$ )	VUS–ROC ( $\uparrow$ )
PCA	0.465	0.383	0.798	0781
OmniAnomaly	0.469	0.389	0.798	0.786
TSPulse (ZS)	0.358	0.307	0.698	0.726
TSPulse (FT)	0.406	0.347	0.755	0.769
FOLD	0.432	0.397	0.782	0.772
ARTA	0.507	0.414	0.845	0.860

Appendix

Table 7. Comparison of F1, AUC–PR, AUC–ROC, and VUS–ROC between our proposed method and top–5 baselines. The reported values are averaged over all datasets.

Time-Series Anomaly Detection

Time-Series Anomaly Detection identifies unusual patterns or events in sequential data, from sensor readings and network traffic to health and industrial telemetry.

See all 208 papers

Fortifying Time Series: DTW-Certified Robust Anomaly Detection
May 8, 2026Shijie Liu, Tansu Alpcan, Christopher Leckie +1Adversarial Robustness Certified Robustness
Department of Electrical and Electronic Engineering University of Melbourne, Melbourne, Australia · School of Computing and Information Systems University of Melbourne, Melbourne, Australia
VAN-AD: Visual Masked Autoencoder with Normalizing Flow For Time Series Anomaly Detection
Mar 27, 2026PengYu Chen, Shang Wan, Xiaohou Shi +3Masked Autoencoders Vision Foundation Model Adaptation
School of Computer Science (National Pilot Software Engineering School), Beijing University of Posts and Telecommunications, Beijing 100876, China · China Telecom Research Institute Beijing, China · Department of Computer Science, Missouri University of Science and Technology, Rolla, MO 65409 USA
Back to Repair: A Minimal Denoising Network for Time Series Anomaly Detection
Apr 19, 2026Kadir-Kaan Özer, René Ebeling, Markus EnzweilerReconstruction-Based Anomaly Detection Time-Series Anomaly Detection
Mercedes-Benz AG, Germany · Institute for Intelligent Systems, Esslingen University of Applied Sciences, Germany

May 8, 2026J/K move · Enter open · S save

Fortifying Time Series: DTW-Certified Robust Anomaly Detection

Shijie Liu, Tansu Alpcan, Christopher Leckie, Sarah Erfani

Department of Electrical and Electronic Engineering University of Melbourne, Melbourne, Australia · School of Computing and Information Systems University of Melbourne, Melbourne, Australia

Adversarial Robustness Certified Robustness Time-Series Anomaly Detection

Open paper AskPDF arXiv

Time-series anomaly detection is critical for ensuring safety in high-stakes applications, where robustness is a fundamental requirement rather than a mere performance metric. Addressing the vulnerability of these systems to adversarial manipulation is therefore essential. Existing defenses are largely heuristic or provide certified robustness only under

\ell_p

-norm constraints, which are incompatible with time-series data. In particular,

\ell_p

-norm fails to capture the intrinsic temporal structure in time series, causing small temporal distortions to significantly alter the

\ell_p

-norm measures. Instead, the similarity metric Dynamic Time Warping (DTW) is more suitable and widely adopted in the time-series domain, as DTW accounts for temporal alignment and remains robust to temporal variations. To date, however, there has been no certifiable robustness result in this metric that provides guarantees. In this work, we introduce the first DTW-certified robust defense in time-series anomaly detection by adapting the randomized smoothing paradigm. We develop this certificate by bridging the

\ell_p

-norm to DTW distance through a lower-bound transformation. Extensive experiments across various datasets and models validate the effectiveness and practicality of our theoretical approach. Results demonstrate significantly improved performance, e.g., up to 18.7% in F1-score under DTW-based adversarial attacks compared to traditional certified models.

Abstract

Time-Series Anomaly Detection

Explore similar work

Fortifying Time Series: DTW-Certified Robust Anomaly Detection

VAN-AD: Visual Masked Autoencoder with Normalizing Flow For Time Series Anomaly Detection

Back to Repair: A Minimal Denoising Network for Time Series Anomaly Detection