FirstDiff: One-Step Diffusion-Based Anomaly Detection for Multivariate Time Series via Initial Noise Prediction

Ali Boudaghi; Alireza Nemati; Hadi Zare

cs.LGAug 16, 2026

FirstDiff: One-Step Diffusion-Based Anomaly Detection for Multivariate Time Series via Initial Noise Prediction

Authors: Ali Boudaghi, Alireza Nemati, Hadi Zare

Abstract

Diffusion models have recently shown strong potential for multivariate time-series anomaly detection by learning the distribution of normal data through iterative denoising. Existing diffusion-based approaches, however, typically perform anomaly detection after completing the reverse diffusion process, relying primarily on the final reconstructed signal and overlooking informative representations produced during denoising. This design incurs substantial computational cost and limits the use of intermediate diffusion information for anomaly detection. In this paper, we propose FirstDiff, a diffusion-based anomaly detection framework based on the observation that the predicted diffusion noise at the initial reverse-diffusion evaluation already contains sufficient information for accurate anomaly detection. FirstDiff models the statistical distribution of predicted diffusion noise under normal behavior using validation data, enabling anomaly inference from a single denoising-network evaluation rather than completing the reverse diffusion trajectory. To model complex temporal and inter-sensor dependencies, FirstDiff employs a Diffusion Transformer as the denoising backbone. Extensive experiments on five public benchmark datasets demonstrate that FirstDiff achieves state-of-the-art performance while reducing diffusion inference from the full reverse trajectory to a single denoising-network evaluation.

Figures & tables

Fig. 1: Overview of the proposed FirstDiff framework and its contrast with conventional diffusion-based anomaly detection. In conventional reconstruction-based inference, the noisy sample $\mathbf{X}_{T}$ is iteratively denoised through $T$ reverse diffusion steps to obtain the final reconstruction $\hat{\mathbf{X}}_{0}$ , from which an anomaly score is derived. In contrast, FirstDiff uses the predicted diffusion noise $\boldsymbol{\epsilon}_{\theta}(\mathbf{X}_{T},T)$ generated at the first reverse diffusion step and measures its deviation from a reference distribution estimated using normal validation data. This enables anomaly inference after a single denoising step without completing the remaining reverse diffusion trajectory.

Fig. 2: Architecture of the Diffusion Transforme denoising network used in FirstDiff. A noisy multivariate time-series window is first projected into a latent embedding space and combined with positional embeddings. The embedded sequence is then processed by a stack of timestep-conditioned DiT blocks, each consisting of multi-head self-attention and an MLP with Adaptive Layer Normalization (AdaLN). Finally, a linear prediction head estimates the injected Gaussian noise, which serves as the latent representation exploited by FirstDiff for one-step anomaly detection and is also used during the reverse diffusion process for conventional reconstruction.

Fig. 3: Visualization of the reconstructed samples and predicted diffusion noise using t-SNE and UMAP. The first row shows the reconstructed samples $\hat{\mathbf{X}}$ obtained after the complete reverse diffusion process, while the second row shows the predicted noise $\hat{\boldsymbol{\epsilon}}$ obtained at the first reverse diffusion step. The visible separation between normal and anomalous samples in the projected spaces is provided for illustrative purposes only, as the underlying anomaly-related discrepancy arises from complex dependencies across temporal and sensor dimensions that cannot be fully represented in a two-dimensional visualization. Nevertheless, both representations exhibit distributional differences between normal and anomalous samples, indicating that the first-step predicted noise contains discriminative information that can be exploited for anomaly detection.

Dataset	Variables	Training Samples	Test Samples	Anomaly Ratio
SWaT	51	495,000	449,919	12.14%
PSM	25	132,481	87,481	27.76%
SMAP	25	135,183	427,617	12.79%
SMD	38	708,405	708,420	4.16%
MSL	55	58,317	73,729	10.53%

TABLE I: Statistics of the benchmark datasets used in the experiments.

Model	SMD			PSM			MSL			SWaT			SMAP			Avg. F1
Model	P	R	F1	P	R	F1	P	R	F1	P	R	F1	P	R	F1	Avg. F1
CBLOF	21.87	79.93	34.34	59.46	92.25	72.30	16.90	27.96	21.06	15.75	93.32	26.95	46.86	60.65	52.86	41.50
ECOD	18.69	50.16	27.23	86.89	78.72	82.61	20.71	31.59	25.02	21.30	93.02	34.66	44.76	53.58	48.78	43.66
Isolation Forest	15.92	59.21	25.10	91.90	80.96	86.06	20.09	33.28	25.06	37.00	89.47	52.24	44.95	61.99	52.10	48.11
PCA	20.09	78.06	31.96	84.62	82.59	83.59	16.60	27.96	20.83	16.83	93.04	28.50	52.33	48.30	50.24	43.02
OmniAnomaly	65.24	44.09	52.62	99.99	72.71	84.06	87.85	67.23	75.53	50.19	86.36	63.47	91.63	55.24	68.93	68.92

TABLE II: Performance comparison of different models on five anomaly detection benchmarks.

Method	SMD	PSM	MSL	SWaT	SMAP
CBLOF	24.05	85.99	174.47	129.59	419.95
ECOD	51.38	181.60	165.00	153.83	404.00
Isolation Forest	42.96	150.62	162.13	294.50	407.68
PCA	26.06	142.42	174.47	140.20	463.91
OmniAnomaly	61.17	199.72	115.99	392.23	380.10
GDN	71.25	157.40	116.79	397.24	379.23

TABLE III: Comparison of anomaly detection models in terms of Average Detection Delay on five anomaly detection benchmarks.

Method	SMD	SMAP	SWaT	MSL	PSM	Average
Imdiffusion	204.04	202.95	205.44	202.78	207.52	204.55
DiffAD	272.90	269.33	269.02	266.37	264.07	268.34
GAD	370.71	370.89	374.01	370.56	374.39	372.91
FirstDiff (Full-step)	99.05	99.15	101.21	98.95	100.35	99.74
FirstDiff (One-step)	1.16	1.15	1.18	1.60	1.16	1.25

TABLE IV: Inference time (ms) per test window of length 96 across five anomaly detection benchmarks.

Variant	One-step Inference	Hybrid	SMD	PSM	MSL	SWaT	SMAP	Avg. F1
Reconstruction	No	No	90.53	96.36	88.41	89.47	76.85	88.32
$\epsilon$	Yes	No	79.04	97.19	91.41	96.27	96.44	92.07
Residual	Yes	No	88.97	98.14	88.25	90.37	93.16	91.78
Mah( $\epsilon$ )	Yes	No	81.48	97.26	93.01	96.66	96.28	92.94
Mah(Residual)	Yes	No	83.52	95.72	88.77	92.08	93.11	90.64
Cos( $\epsilon$ )	Yes	No	82.17	98.30	89.26	93.79	96.25	91.95

TABLE V: Performance comparison of FirstDiff variants on five anomaly detection benchmarks.

Explore similar work

Feb 27, 2026

Selective Denoising Diffusion Model for Time Series Anomaly Detection

Time series anomaly detection (TSAD) has been an important area of research for decades, with reconstruction-based methods, mostly based on generative models, gaining popularity and demonstrating success. Diffusion models have recently attracted attention due to their advanced generative capabilities. Existing diffusion-based methods for TSAD rely on a conditional strategy, which reconstructs input instances from white noise with the aid of the conditioner. However, this poses challenges in accurately reconstructing the normal parts, resulting in suboptimal detection performance. In response, we propose a novel diffusion-based method, named AnomalyFilter, which acts as a selective filter that only denoises anomaly parts in the instance while retaining normal parts. To build such a filter, we mask Gaussian noise during the training phase and conduct the denoising process without adding noise to the instances. The synergy of the two simple components greatly enhances the performance of naive diffusion models. Extensive experiments on five datasets demonstrate that AnomalyFilter achieves notably low reconstruction error on normal parts, providing empirical support for its effectiveness in anomaly detection. AnomalyFilter represents a pioneering approach that focuses on the noise design of diffusion models specifically tailored for TSAD.

Kohei Obata, Zheng Chen, Yasuko Matsubara +2

SANKEN, The University of Osaka, Osaka, Japan · Great Bay University, Dongguan, China

Time-Series Anomaly Detection Reconstruction-Based Anomaly Detection Diffusion Models Masked Diffusion Models

Ask PDF

Oct 8, 2026

NV-Tesseract-AD: Curriculum-Enhanced Conditional Diffusion for Multivariate Time-Series Anomaly Detection

We propose NV-Tesseract-AD, a curriculum learning-enhanced conditional diffusion framework for multivariate time-series anomaly detection. Our central hypothesis is that reconstruction difficulty can be explicitly structured along two complementary axes, masking severity and diffusion noise level, and that training from easier to harder tasks along both axes simultaneously stabilizes optimization and improves residual discriminability. We integrate a Transformer-based diffusion backbone with a three-stage dual curriculum over masking ratios and diffusion timesteps, retaining anomalous samples throughout training and relying on structured corruption to drive self-supervised representation learning. We evaluate NV-Tesseract-AD under two regimes: in-distribution training on the TSB-UAD-M corpus and strict zero-shot transfer to ten EasyTSAD benchmark families without per-dataset tuning. The dual-axis curriculum produces masking-invariant reconstruction, confirmed by a near-zero loss gap between complementary masking strategies within the first training stage, and yields an approximately 3.7-fold improvement in F1 and a 56 percent reduction in MSE relative to a non-curriculum baseline. Zero-shot performance reaches F1 = 0.984 on NAB and F1 = 0.948 on NormA. Weaker results on heterogeneous families are traced to unsupervised threshold calibration rather than reconstruction quality, identifying calibration as the dominant remaining detection bottleneck. Accelerated inference via DPM-Solver++ reduces sampling cost by a factor of 3.5 to 5.7 at the dataset level but couples to thresholding behavior, establishing that the sampler and threshold must be validated jointly. Together, these findings demonstrate that aligning diffusion denoising difficulty with curriculum learning principles provides a principled and practical approach for robust anomaly detection in complex multivariate time series.

Aditi Gautam, Manikandan Ravikiran, Saira Qureshi +4

NVIDIA

Time-Series Anomaly Detection Reconstruction-Based Anomaly Detection Curriculum Learning Zero-Shot Anomaly Detection Diffusion Transformer

Ask PDF

May 28, 2026

Masked Diffusion Modeling for Anomaly Detection

Anomaly detection aims to identify samples that deviate from the nominal data distribution and is central to many safety-critical applications. However, developing effective anomaly detection methods for categorical, mixed-type, and discrete sequence data remains challenging and relatively underexplored. Masked diffusion models provide a natural way to model such data by learning to recover masked values from the remaining visible context. In this paper, we propose Masked Diffusion for Anomaly Detection (MaskDiff-AD), a forward-only method based on masked diffusion models trained only on nominal data. Given a test sample, MaskDiff-AD constructs anomaly scores from the difficulty of reconstructing randomly masked coordinates, yielding a content-sensitive score that operates directly on discrete state spaces while avoiding reverse-time sampling. We also develop a non-parametric variant of MaskDiff-AD and provide theoretical guarantees by characterizing Type-I and Type-II errors under a fixed detection threshold. Experiments on fourteen categorical and mixed-type tabular datasets from ADBench and UADAD, as well as four text anomaly detection datasets from NLP-ADBench, show that MaskDiff-AD achieves competitive performance against classical, diffusion-based, and recent tabular/text anomaly detection baselines. Notably, MaskDiff-AD achieves the best overall average rank, outperforming all twelve tabular baseline methods.

Lixing Zhang, Yuchen Liang, Liyan Xie

University of Minnesota · Ohio State University

Masked Diffusion Models Tabular Anomaly Detection Unsupervised Anomaly Detection Diffusion Models Anomaly Detection

Ask PDF