CANDI: Curated Test-Time Adaptation for Multivariate Time-Series Anomaly Detection Under Distribution Shift

HyunGi Kim; Jisoo Mok; Hyungyu Lee; Juhyeon Shin; Sungroh Yoon

cs.LGApr 2, 2026

CANDI: Curated Test-Time Adaptation for Multivariate Time-Series Anomaly Detection Under Distribution Shift

Authors: HyunGi Kim, Jisoo Mok, Hyungyu Lee, Juhyeon Shin, Sungroh Yoon

Organizations: Department of ECE, Seoul National University · DGIST · IPAI, Seoul National University · AIIS, ASRI, and INMC, Seoul National University

Abstract

Multivariate time-series anomaly detection (MTSAD) aims to identify deviations from normality in multivariate time-series and is critical in real-world applications. However, in real-world deployments, distribution shifts are ubiquitous and cause severe performance degradation in pre-trained anomaly detector. Test-time adaptation (TTA) updates a pre-trained model on-the-fly using only unlabeled test data, making it promising for addressing this challenge. In this study, we propose CANDI (Curated test-time adaptation for multivariate time-series ANomaly detection under DIstribution shift), a novel TTA framework that selectively identifies and adapts to potential false positives while preserving pre-trained knowledge. CANDI introduces a False Positive Mining (FPM) strategy to curate adaptation samples based on anomaly scores and latent similarity, and incorporates a plug-and-play Spatiotemporally-Aware Normality Adaptation (SANA) module for structurally informed model updates. Extensive experiments demonstrate that CANDI significantly improves the performance of MTSAD under distribution shift, improving AUROC up to 14% while using fewer adaptation samples.

Figures & tables

Figure 1: [Top] Real-world time-series data often exhibit non-stationarity, leading to continuous distribution shifts between training and test data. [Bottom] As shown in the later part of the anomaly scores, under distribution shift, pre-trained anomaly detectors can provide excessive false positives, undermining reliability under deployment.

Figure 2: Overall framework of CANDI. [Left] Anomaly scores are first computed on a normal validation set, and latent representations of samples falling within the top $\alpha$ -percentile ( e.g. , 5th percentile) are extracted and stored in a reference false positive set $\bm{\mathcal{R}}_{fp}$ . [Right] For arriving test data, if the anomaly score is above the threshold, its latent representation is compared to those in $\bm{\mathcal{R}}_{fp}$ . If the distance is sufficiently small, the sample is identified as a potential false positive and used for adaptation. Adaptation is performed via the plug-and-play Spatiotemporally-Aware Normality Adaptation (SANA) module, which updates only a lightweight residual component while preserving the knowledge and latent space of the pre-trained anomaly detector.

Dataset	Metric	$\alpha=0.5\%$			$\alpha=1.0\%$			$\alpha=5.0\%$
Dataset	Metric	Pretrained	M2N2	CANDI	Pretrained	M2N2	CANDI	Pretrained	M2N2	CANDI
SWaT	AUROC	0.827	0.891	0.889	0.827	0.891	0.890	0.827	0.891	0.888
	AUPRC	0.719	0.771	0.779	0.719	0.771	0.780	0.719	0.772	0.781
	F1	0.291	0.711	0.752	0.287	0.700	0.738	0.291	0.636	0.624
SMD_1-7	AUROC	0.883	0.901	0.922	0.883	0.864	0.923	0.883	0.886	0.922
	AUPRC	0.703	0.728	0.736	0.703	0.734	0.737	0.703	0.718	0.737

Table 1: Performance of test-time adaptation methods for multivariate time-series anomaly detection under test-time distribution shift. Bold denotes the best result for each metric and threshold level. Each threshold is determined by the

\alpha

-percentile of validation anomaly scores.

Figure 3: Architecture of the Spatiotemporally-Aware Normality Adaptation (SANA) module.

FPM	SANA	SWaT			SMD_1-8			SMD_2-1			SMD_2-4			SMD_3-2
FPM	SANA	ROC	PRC	F1	ROC	PRC	F1	ROC	PRC	F1	ROC	PRC	F1	ROC	PRC	F1
w/o TTA		0.83	0.72	0.29	0.72	0.33	0.10	0.65	0.28	0.27	0.82	0.46	0.32	0.45	0.16	0.25
✗	✗	0.89	0.77	0.64	0.77	0.35	0.12	0.68	0.30	0.31	0.83	0.46	0.31	0.64	0.19	0.19
✓	✗	0.80	0.71	0.22	0.69	0.32	0.01	0.71	0.34	0.20	0.93	0.66	0.25	0.74	0.22	0.21
✗	✓	0.89	0.78	0.64	0.83	0.36	0.15	0.71	0.32	0.33	0.83	0.46	0.37	0.68	0.19	0.25
✓	✓	0.89	0.78	0.62	0.87	0.42	0.21	0.78	0.35	0.33	0.90	0.60	0.51	0.72	0.20	0.26

Table 2: Ablation study of CANDI across five datasets at

\alpha=5.0\%

. FPM and SANA denote False Positive Mining and Spatiotemporally-Aware Normality Adaptation, respectively. ROC and PRC denote AUROC and AUPRC, respectively.

Dataset	Method	Mod. Samples	Ano. in Mod.	Hard Samples	Ano. in Hard	Total Adapt	Total Test	Total Ano.	ROC	PRC	F1
SMD_1-8	M2N2	N/A	N/A	N/A	N/A	11,760	23,690	943	0.772	0.354	0.115
	CANDI Hard	N/A	N/A	5,437	527	5,437			0.861	0.416	0.166
	CANDI Mod.	11,038	114	N/A	N/A	11,038			0.826	0.362	0.142
	CANDI (Hard + Mod.)	14,924	178	4,332	497	19,256			0.867	0.423	0.213
SMD_2-1	M2N2	N/A	N/A	N/A	N/A	22,573	23,685	1,287	0.683	0.296	0.309
	CANDI Hard	N/A	N/A	353	78	353			0.735	0.323	0.262

Table 3: Comparison of different adaptation sample configurations on SMD_1-8 and SMD_2-1. “Mod.” and “Hard” refer to the difficulty levels of the samples used. “Ano.” refers to anomaly. “Total Adapt” denotes the number of adaptation samples.

Panel of Figure 4 — Figure 4: Receiver Operating Characteristic (ROC) and Precision-Recall (PR) curves for anomaly detection. The value in parentheses indicates the area under each curve.

Method	SMD_1-8			SMD_2-1
Method	ROC	PRC	F1	ROC	PRC	F1
Linear	0.840	0.415	0.115	0.673	0.294	0.275
SANA	0.867	0.423	0.213	0.780	0.348	0.327

Table 4: Comparison between Linear and SANA adaptation modules on SMD_1-8 and SMD_2-1. ROC and PRC denote AUROC and AUPRC, respectively.

Dataset	Variables	Train Steps	Test Steps	Anomaly Ratio	ADF Statistics	$p$ -value
SWaT	51	495,000	449,919	0.121	-0.780	0.83
SMD_1-7	38	23,697	23,697	0.101	-2.474	0.12
SMD_1-8	38	23,698	23,699	0.032	-3.305	0.01
SMD_2-1	38	23,693	23,694	0.049	-3.211	0.02
SMD_2-4	38	23,689	23,689	0.072	-3.650	0.00
SMD_3-2	38	23,702	23,703	0.047	-1.430	0.56

Table 5: Summary of the statistical characteristics of MTSAD datasets: the number of variables, the total time steps of train and test data, the ratio of anomalous time steps in test data, and the degree of stationarity measured using Augmented Dickey-Fuller (ADF) test statistics and the corresponding

p

-value.

Panel of Figure 5 — Figure 5: Examples of distribution shifts in test data, with red shaded areas indicating true anomalies.

$h$ Dimension	Additional Params (MB)	SMD_1-8			SMD_2-4
$h$ Dimension	Additional Params (MB)	AUROC	AUPRC	F1	AUROC	AUPRC	F1
Pre-trained	0.00	0.719	0.332	0.092	0.821	0.457	0.316
512	7.07	0.867	0.423	0.213	0.899	0.600	0.512
256	2.03	0.878	0.423	0.195	0.883	0.564	0.426
128	0.64	0.853	0.400	0.156	0.861	0.537	0.348
64	0.23	0.851	0.389	0.129	0.849	0.522	0.312

Table 6: Performance comparison across different hidden dimensions

h

. As

h

decreases, the number of additional parameters is reduced, with a moderate trade-off in performance for SMD_1-8 and SMD_2-4. The first row shows the performance of the frozen pre-trained anomaly detector without TTA.

Dataset	Metric (Std)	$\alpha=0.5\%$			$\alpha=1.0\%$			$\alpha=5.0\%$
Dataset	Metric (Std)	Pre.	M2N2	CANDI (p)	Pre.	M2N2	CANDI (p)	Pre.	M2N2	CANDI (p)
SWaT	AUROC	0.000	0.000	0.005 (0.35)	0.000	0.000	0.002 (0.12)	0.000	0.000	0.002 (0.09)
	AUPRC	0.000	0.000	0.004 (0.03)	0.000	0.000	0.001 (0.00)	0.000	0.000	0.002 (0.01)
	F1	0.000	0.000	0.002 (0.00)	0.000	0.000	0.000 (0.00)	0.000	0.000	0.001 (0.00)
SMD_1-7	AUROC	0.000	0.000	0.018 (0.96)	0.000	0.000	0.018 (0.07)	0.000	0.000	0.018 (0.25)
	AUPRC	0.000	0.000	0.019 (0.35)	0.000	0.000	0.019 (0.23)	0.000	0.000	0.019 (0.81)

Table 7: Standard deviation and p-values of test-time adaptation performance across three random seeds. Pre. denotes a pretrained model without test-time adaptation. Pretrained and M2N2 are deterministic (std = 0.000). p-values indicate the statistical significance of CANDI’s performance over M2N2.

lr	gating_init	AUROC	AUPRC	F1
0.03	0.5	0.871	0.424	0.223
	0.1	0.860	0.403	0.254
	0.0	0.862	0.398	0.227
0.01	0.5	0.878	0.411	0.177
	0.1	0.852	0.400	0.205
	0.0	0.827	0.390	0.155

Table 8: Robustness of CANDI to learning rate and gating parameter initialization on SMD_1-8.

Batch Size	AUROC	AUPRC	F1
64	0.91	0.72	0.73
128	0.92	0.73	0.73
256	0.93	0.74	0.73
512	0.92	0.74	0.73

Table 9: Sensitivity of CANDI to different test-time batch sizes on the SMD_1-7 dataset.

Model	Metric	SMD_1-8			SMD_2-4			SMD_3-2
		Pretrained	M2N2	CANDI	Pretrained	M2N2	CANDI	Pretrained	M2N2	CANDI
MLP	AUROC	0.719	0.772	0.867	0.821	0.828	0.899	0.451	0.640	0.717
	AUPRC	0.332	0.354	0.423	0.457	0.461	0.600	0.159	0.188	0.199
	F1	0.092	0.115	0.213	0.316	0.311	0.512	0.247	0.194	0.262
TimesNet	AUROC	0.606	0.683	0.910	0.762	0.818	0.762	0.712	0.740	0.769
	AUPRC	0.256	0.305	0.375	0.388	0.523	0.388	0.145	0.162	0.162

Table 10: Performance comparison of test-time adaptation methods across three SMD benchmarks for different model architectures.

Model	AUPRC	AUROC	VUS-PR	VUS-ROC	F1
CNN	0.32	0.73	0.31	0.76	0.37
OmniAnomaly	0.27	0.65	0.31	0.69	0.32
TranAD	0.14	0.59	0.18	0.65	0.21
TimesNet	0.13	0.56	0.19	0.64	0.20
M2N2	0.32	0.74	0.32	0.78	0.38
CANDI	0.35	0.75	0.42	0.80	0.43

Table 11: Performance on the multivariate subset of the TSB-AD benchmark, which comprises 200 carefully curated multivariate time-series datasets. Alongside standard metrics (AUPRC, AUROC, F1), we also report VUS-PR and VUS-ROC, which offer boundary-tolerance–aware, parameter-free evaluation of anomaly detection performance.

Panel of Figure 6 — Figure 6: Comparison of test scores with and without CANDI ( $\alpha=5.0$ ); red shaded regions indicate true anomalies. CANDI lowers scores for normal samples, reducing false positives.

Time-Series Anomaly Detection

Time-Series Anomaly Detection identifies unusual patterns or events in sequential data, from sensor readings and network traffic to health and industrial telemetry.

See all 203 papers

POST: Prior-Observation Adversarial Learning of Spatio-Temporal Associations for Multivariate Time Series Anomaly Detection
May 18, 2026Suofei Zhang, Yaxuan Zheng, Haifeng HuAnomaly Localization Time-Series Anomaly Detection
School of Internet of Things, Nanjing University of Posts and Telecommunications, Nanjing 210003, China · National Engineering Research Center of Communications and Networking, Nanjing University of Posts and Telecommunications, Nanjing 210003, China
MORA: Modeling Observed Changes for Drift-Robust Time-Series Anomaly Detection
Oct 7, 2026Xudong Mou, Tiejun Wang, Rui Wang +5Time-Series Anomaly Detection Non-Stationary Time Series
Beihang University, Beijing, China · Beihang Hangzhou Innovation Institute, Hangzhou, China · China University of Geosciences (Beijing), Beijing, China
ARTA: Adversarial-Robust Multivariate Time--Series Anomaly Detection via Sparsity-Constrained Perturbations
Mar 26, 2026Hadi Hojjati, Narges ArmanfardTime-Series Anomaly Detection Adversarial Robustness
McGill University, MILA - Quebec AI Institute, Montreal, Quebec, Canada

May 18, 2026J/K move · Enter open · S save

POST: Prior-Observation Adversarial Learning of Spatio-Temporal Associations for Multivariate Time Series Anomaly Detection

Suofei Zhang, Yaxuan Zheng, Haifeng Hu

School of Internet of Things, Nanjing University of Posts and Telecommunications, Nanjing 210003, China · National Engineering Research Center of Communications and Networking, Nanjing University of Posts and Telecommunications, Nanjing 210003, China

Anomaly Localization Time-Series Anomaly Detection Spatiotemporal GNNs

Open paper AskPDF arXiv

Existing Multivariate Time Series Anomaly Detection (MTSAD) frameworks increasingly rely on integrating Graph Neural Networks (GNNs) with sequence models to capture complex spatio-temporal dependencies. However, less attention is paid to the spatial over-generalization problem, where unconstrained structural modeling indiscriminately reconstructs anomalies, inevitably degrading detection recall. To tackle this problem, we propose a novel framework that unifies spatio-temporal modeling through a joint prior-observation adversarial learning paradigm. In the spatial dimension, the model alternately learns adjacency matrices as structural prior and models the association discrepancy between prior and data-driven observation in a minimax manner during training. Such adversarial optimization not only improves the model sensitivity for time-wise detection, but also enables the model to localize anomalies to specific channels. To systematically evaluate this anomaly localization capability, we further construct a synthetic benchmark equipped with precise channel-wise annotations. Extensive experiments across public datasets and our dedicated benchmark demonstrate that the proposed framework establishes a new state-of-the-art in both time-wise detection and spatial localization tasks. Our code, pre-trained models, and benchmark are publicly available at https://github.com/anocodetest1/POST.

Abstract

Time-Series Anomaly Detection

Explore similar work

POST: Prior-Observation Adversarial Learning of Spatio-Temporal Associations for Multivariate Time Series Anomaly Detection

MORA: Modeling Observed Changes for Drift-Robust Time-Series Anomaly Detection

ARTA: Adversarial-Robust Multivariate Time--Series Anomaly Detection via Sparsity-Constrained Perturbations