FreqSpaNet: Frequency and Spatial Learning of SFPF for Physical Layer Hardware Integrity Detection

Zero-shot anomaly detection (ZSAD) aims to detect anomalies and localize defective regions in unseen target domains without target training data. Recent ZSAD methods build on pretrained vision models, particularly CLIP, and construct normal and anomaly references from textual prompts or learnable visual representations. These methods perform anomaly discrimination primarily in spatial feature spaces, where subtle changes in texture, boundaries, and local structures can be confused with normal appearance variations. Although inconspicuous spatially, such defects can disrupt local texture regularity or boundary continuity, inducing response deviations across frequency bands. However, existing ZSAD methods do not explicitly model these frequency-dependent characteristics. Our image-domain analysis reveals that local defects exhibit spatial-frequency deviations from normal references across low-, middle-, and high-frequency bands, indicating that anomaly evidence is not universally dominated by high-frequency responses. Motivated by this observation, we propose FreqAnchorAD, a frequency-aware framework that organizes frequency-enhanced responses for anchor-relative anomaly discrimination. Specifically, the Local Frequency Compensation Module (LFCM) enhances intermediate patch tokens with local spatial-frequency cues. The Frequency-Deviation Anchor Projector (FDAP), our core discrimination module, organizes enhanced responses along a source-derived channel coordinate and measures anomaly evidence through relative similarity to normal and anomaly anchors. Finally, Asymmetric Anchor Supervision (AAS) stabilizes normal-anchor alignment while preserving diverse anomaly patterns. Experiments on thirteen industrial and medical benchmarks show that FreqAnchorAD achieves state-of-the-art mean performance in image-level anomaly recognition and pixel-level defect localization.

Network traffic anomaly detection represents a critical cybersecurity task, yet widespread encryption makes this task increasingly challenging. In response, image-based methods that model traffic as visual patterns have emerged as the dominant approach. However, this work pioneers the identification of a pervasive full-frequency'' characteristic and an associated limitation termed spectral mismatch'' within this paradigm. Specifically, while encrypted traffic exhibits prominent high-frequency components, mainstream reconstruction methods demonstrate an inherent bias toward learning low-frequency information. This fundamental mismatch results in incomplete representations that consequently degrade anomaly detection performance. To address this challenge, we propose FreeUp, a novel frequency-decoupled framework designed explicitly for encrypted traffic analysis. FreeUp decomposes traffic data into distinct low- and high-frequency bands, processing them through separate, dedicated branches along with a customized training strategy that ensures stable and independent frequency-specific learning. Furthermore, recognizing that simple reconstruction error proves inadequate for evaluating dual-branch architectures, we introduce an uncertainty-inspired fusion scoring mechanism. This mechanism quantifies the reconstruction uncertainty of the frequency-specific branches and dynamically integrates their outputs, yielding a more comprehensive and reliable anomaly score. Extensive experiments across multiple benchmarks demonstrate that FreeUp consistently outperforms state-of-the-art baselines. The code is available at https://github.com/ikun0124/FreeUp.

Multivariate time series anomaly detection in ICS has attracted growing attention due to the increasing threat of cyber-physical attacks on critical infrastructure. State-of-the-art methods model inter-sensor relationships from raw time-domain amplitude values, using graph neural networks, Transformers. However, these methods discard the phase spectrum produced by time frequency transformations, We argue that phase information constitutes a complementary and previously overlooked detection modality for ICS anomaly detection. We present PhaseNet++, a frequency-domain autoencoder that operates on the Short-Time Fourier Transform (STFT) of sliding sensor windows, retaining both magnitude and phase spectra. A Phase Coherence Index (PCI), inspired by the Phase Locking Value from neuroscience, summarizes pairwise phase consistency across frequency bins into a continuous adjacency matrix. This matrix guides a graph attention network that propagates information preferentially among phase-synchronized sensors. A sensor-token Transformer encoder captures system-wide structure, and a dual-head decoder reconstructs magnitude and phase jointly via circular and coherence-aware objectives. Evaluated on the Secure Water Treatment (SWaT) benchmark, PhaseNet++ achieves an F1-score of 90.98%, ROC-AUC of 95.66%, and average precision of 91.51%. Ablation studies show that the phase-aware front-end and PCI graph module together add only 264,816 parameters, demonstrating that the phase inductive bias is lightweight. While the absolute F1-score is second best than that of all recent raw-value methods evaluated under different protocols, we position this work as the first systematic study of phase-domain anomaly detection for ICS.