Supervision Recovery for Time Series Anomaly Detection via Context-Anchored Pairing

Yifei Gao; Tian Lan; Yimeng Lu; Xuming An; Meng Wang; Wenjun He; Yijie Li; Chen Zhang

cs.AISep 27, 2026

Supervision Recovery for Time Series Anomaly Detection via Context-Anchored Pairing

Authors: Yifei Gao, Tian Lan, Yimeng Lu, Xuming An, Meng Wang, Wenjun He, Yijie Li, Chen Zhang

Organizations: Department of Industrial Engineering, Tsinghua University · Huawei

Abstract

Time series anomaly detection (TSAD) remains challenging not only because anomaly labels are scarce, but also because temporal anomalies are highly context-dependent. Existing methods often rely on unsupervised objectives or surrogate abnormal patterns, providing limited supervision for context-dependent normal--anomalous distinctions. We propose Context-Anchored Pair Supervision (CAPS), a supervision-recovery framework for TSAD. CAPS views ideal anomaly supervision as a matched comparison between normal and anomalous outcomes under the same temporal context, and seeks to recover such supervision without target-domain anomaly labels. Using simulated normal--anomalous pairs, CAPS learns structure and anomaly-semantic representations through reconstruction, background consistency, and within-pair counterfactual recombination. The resulting anomaly representations form a continuous semantic space with coarse modes and induce a sampleable multimodal prior. CAPS conditionally realizes sampled semantics as residual-form effects on target reference trajectories. The resulting context-anchored normal--anomalous counterparts provide temporal supervision for discriminative detector learning. Experiments on nine datasets show that CAPS achieves the strongest aggregate performance across all four evaluation metrics among the compared methods, while complementary ablations and transfer analyses support the roles of context anchoring, semantic disentanglement, and conditional realization.

Figures & tables

Figure 1: Overall illustration of CAPS. Panel (a) illustrates the matched-supervision view of temporal anomalies. Panel (b) presents the CAPS framework: black arrows denote learning from simulated correspondences, while purple arrows denote target-domain counterpart generation.

Method	Aff.-F		$\mathrm{F1}_{\mathrm{T}}$		Std.-F1		VUS-PR		Avg.R	T1	T2
Method	Score $\uparrow$	Rank $\downarrow$	Score $\uparrow$	Rank $\downarrow$	Score $\uparrow$	Rank $\downarrow$	Score $\uparrow$	Rank $\downarrow$	Avg.R	T1	T2
Unsupervised TSAD baselines
LOF	72.26	8.94	28.19	7.44	23.11	8.33	23.19	8.06	8.19	0	2
IForest	47.86	10.67	14.15	10.94	15.65	9.72	18.72	8.67	10.00	0	0
OmniAnomaly	73.48	7.78	28.35	5.56	23.82	6.67	25.04	6.28	6.57	1	6
TranAD	73.39	8.67	21.46	7.67	19.00	8.44	22.54	7.28	8.01	0	0

Table 1: Overall performance across nine TSAD benchmarks. Score and Rank denote the unweighted mean score and average dataset-wise rank, respectively. Avg.R averages the ranks across all four metrics. T1 and T2 count first-place and top-two results across the 36 dataset–metric pairs. Best and second-best aggregate results are bold and underlined. Detailed per-dataset results are reported in Appendix C.5 .

Variant	Affiliation-F	$\mathrm{F1}_{\mathrm{T}}$	Standard-F1	VUS-PR
Shuffled residuals	79.27	41.21	37.78	41.30
w/o residual parameterization	82.76	40.96	38.35	42.27
Direct source-residual injection	81.58	43.16	39.96	42.58
w/o counterfactual loss	83.65	42.76	39.11	43.11
CAPS	85.33	46.53	42.91	46.82

Table 2: Ablations and controlled comparisons across nine datasets. Each entry is the unweighted average of the corresponding dataset-level scores. Higher is better; the best results are bolded. Detailed analyses are provided in Appendix D .

Figure 2: Learned representations and cross-context semantic recombination. (a) Projections of $z_{s}$ and $z_{a}$ . (b) Each column reuses a fixed anomaly-semantic code across different references; colored diagonal cells indicate the original pairings.

Appendix figures & tables22 assets

Supplementary material from the paper’s appendix.

Appendix

Component	Setting
Input shape	$[B,1,256]$
Default mode organization	$K=3$ (trend / periodic / point)
Latent dimensions	$\dim(z_{s})=128$ , $\dim(z_{a})=48$
Encoder	hidden dims $[64,128,256]$ , dropout $0.1$
Multi-scale extractor	4 branches; kernels $(3,5,7,9)$ ; dilations $(1,2,3,4)$
Residual experts	$K$ hard-routed experts ( $K=3$ by default)

Appendix

Table 3: Main architectural and optimization configurations of CAPS.

Name	Domain	#TS	Avg. Length	AR (%)
UCR	Misc.	228	67818.7	0.6
NAB	Web	28	5099.7	10.6
YAHOO	Web	259	1560.2	0.6
IOPS	Operations	17	72792.3	1.3
MGAB	Sensor	9	97777.8	0.2
SED	Energy	3	23332.3	4.1

Appendix

Table 4: Benchmark datasets used in the main experiments.

Metric	Method	IOPS	MGAB	NAB	Power	SED	UCR	NEK	TODS	YAHOO
Affiliation-F	LOF	81.06	68.44	75.75	66.76	63.85	73.53	84.74	60.58	75.63
	IForest	52.81	68.82	39.84	0.00	70.09	50.56	71.15	44.17	33.30
	OmniAnomaly	80.32	67.35	92.35	78.16	61.26	73.53	86.30	50.73	71.31
	TranAD	83.19	67.28	90.28	71.56	61.03	73.31	85.02	52.76	76.08
	USAD	71.08	67.81	91.54	76.48	55.60	76.00	71.13	47.90	53.05
	AnomTrans.	70.79	67.65	79.03	71.57	68.21	80.03	75.32	44.57	64.75

Appendix

Table 5: Performance on nine datasets under four metrics (higher is better). CAPS variants are averaged over five runs. Best and second-best results excluding CAPS(Diagnosis) are shown in bold and underline, respectively; a star marks the better result between CAPS and CAPS(Diagnosis) for each dataset–metric pair.

Metric	Method	IOPS	MGAB	NAB	Power	SED	UCR	NEK	TODS	YAHOO
Affiliation-F	CAPS	89.24	69.22	93.25	85.98	74.09	88.41	86.30	86.85	94.63
	Shuffled residuals	83.41	68.04	86.84	78.81	70.16	81.99	81.11	75.03	88.06
$\mathrm{F1}_{\mathrm{T}}$	CAPS	60.62	7.58	57.90	29.20	24.27	41.53	80.15	46.17	71.35
	Shuffled residuals	53.32	1.76	52.75	20.38	22.88	37.18	74.98	38.15	69.50
Standard-F1	CAPS	51.63	4.54	51.78	29.37	24.11	37.70	76.23	41.24	69.58
	Shuffled residuals	46.85	1.62	46.31	20.38	22.81	32.29	68.40	34.12	67.26

Appendix

Table 6: Effect of disrupting context–effect matching in CAPS. Higher is better. The better result for each dataset–metric pair is bolded.

Metric	Method	IOPS	MGAB	NAB	Power	SED	UCR	NEK	TODS	YAHOO
Affiliation-F	CAPS	89.24	69.22	93.25	85.98	74.09	88.41	86.30	86.85	94.63
	w/o residual parameterization	84.91	68.07	90.61	85.11	77.54	87.26	81.16	77.92	92.27
$\mathrm{F1}_{\mathrm{T}}$	CAPS	60.62	7.58	57.90	29.20	24.27	41.53	80.15	46.17	71.35
	w/o residual parameterization	44.06	1.26	54.96	24.03	19.96	39.59	76.53	39.91	68.37
Standard-F1	CAPS	51.63	4.54	51.78	29.37	24.11	37.70	76.23	41.24	69.58
	w/o residual parameterization	37.98	1.15	48.91	24.02	19.87	35.67	72.43	35.78	69.34

Appendix

Table 7: Effect of removing residual-form counterpart construction in CAPS. Higher is better. The better result for each dataset–metric pair is bolded.

Method	Affiliation-F	$\mathrm{F1}_{\mathrm{T}}$	Standard-F1	VUS-PR
Direct source-residual injection	81.58	43.16	39.96	42.58
CAPS	85.33	46.53	42.91	46.82

Appendix

Table 8: Comparison with synthetic supervision constructed from the same simulated anomaly source. Results are averaged over the nine benchmark datasets. Higher is better.

Dataset	Method	Affiliation-F	$\mathrm{F1}_{\mathrm{T}}$	Standard-F1	VUS-PR
YAHOO	TCN-Supervised (BCE)	83.11	59.52	51.24	44.28
	Weighted BCE	85.10	59.90	56.90	45.70
	Balanced Window Sampling	83.10	37.30	34.50	39.30
	Focal Loss	83.70	38.50	35.70	40.30
	CAPS	94.63	71.35	69.58	83.70
NEK	TCN-Supervised (BCE)	85.24	72.93	62.58	67.52

Appendix

Table 9: Comparison with label-supervised TCN training under different class-imbalance treatments. All methods use the same TCN detector backbone. Higher is better.

Contamination	Affiliation-F	$\mathrm{F1}_{\mathrm{T}}$	Standard-F1	VUS-PR
0%	85.74	34.17	37.54	34.05
1%	84.29	33.08	34.98	31.19
2%	83.94	33.05	35.48	30.77
5%	84.48	31.06	32.69	29.44
10%	84.53	30.83	31.65	29.46
20%	84.20	30.61	29.22	26.52

Appendix

Table 10: Robustness of CAPS to controlled target-reference contamination on IOPS using 100 reference windows per file. Results are averaged over 17 time-series files and five runs. Higher is better.

Variant	Affiliation-F	$\mathrm{F1}_{\mathrm{T}}$	Standard-F1	VUS-PR
w/o $\mathcal{L}_{\mathrm{cf}}$	83.65	42.76	39.11	43.11
CAPS	85.33	46.53	42.91	46.82

Appendix

Table 11: Effect of within-pair counterfactual recomposition. Results are averaged over the nine benchmark datasets. Higher is better.

Figure 3: Learned representation spaces. Left : structure codes

z_{s}

colored by normal/anomalous status. Right : anomaly-semantic codes

z_{a}

colored by simulated anomaly family.

Figure 4: Cross-context semantic recombination. Rows use different references, and each column reuses a fixed anomaly-semantic code $z_{a}$ . Colored diagonal cells mark the original pairings. Dashed curves denote references, solid curves denote generated counterparts, and shaded regions indicate anomaly supports.

Method	Affiliation-F	$\mathrm{F1}_{\mathrm{T}}$	Standard-F1	VUS-PR
CAPS w/o highest-associated mode	79.31	38.42	37.81	39.87
CAPS	85.33	46.53	42.91	46.82

Appendix

Table 12: Semantic-coverage stress test. The source-side mode with the highest target association is excluded during counterpart generation while the total number of counterparts is preserved. Results are averaged over the nine benchmark datasets. Higher is better.

Organization	$K$	Affiliation-F	$\mathrm{F1}_{\mathrm{T}}$	Standard-F1	VUS-PR
Data-driven	1	82.34	39.92	37.23	41.36
Data-driven	3	84.98	43.75	40.12	45.76
Data-driven	5	83.10	44.04	40.43	44.76
Data-driven	7	81.61	42.38	38.78	43.38
Knowledge-based	3	85.33	46.53	42.91	46.82

Appendix

Table 13: Comparison of semantic-mode organization and granularity. Results are averaged over the nine benchmark datasets. Higher is better.

Figure 5: Router associations on simulated samples. Rows denote source-side modes and columns denote router-associated modes. Values are row-normalized percentages, with sample counts in parentheses.

Strategy	Affiliation-F	$\mathrm{F1}_{\mathrm{T}}$	Standard-F1	VUS-PR
Direct source-residual injection	81.58	43.16	39.96	42.58
VAE residual generator	83.28	42.32	38.82	42.63
CAPS (diffusion)	85.33	46.53	42.91	46.82

Appendix

Table 14: Comparison of anomaly-effect construction strategies. Results are averaged over the nine benchmark datasets. Higher is better.

Positive source	Score $\downarrow$	Feature $\downarrow$
Rule-based injection	0.4531	0.6218
Direct source-residual injection	0.4783	0.6712
CAPS	0.3990	0.6123

Appendix

Table 15: Detector-oriented diagnostics against real target anomalies, averaged over the nine benchmark datasets. Score measures Wasserstein distance between anomaly-score distributions; Feature measures average generated-to-real

5

-NN distance in the penultimate-layer feature space. Lower is better.

Metric	CAPS (TCN)	CAPS (Transformer)
Affiliation-F	85.33	81.10
$\mathrm{F1}_{\mathrm{T}}$	46.53	42.12
Standard-F1	42.91	40.37
VUS-PR	46.82	43.28

Appendix

Table 16: Comparison of CAPS under different detector architectures. Results are averaged over the nine benchmark datasets. Higher is better.

Prior	Affiliation-F	$\mathrm{F1}_{\mathrm{T}}$	Standard-F1	VUS-PR
Isotropic Gaussian	84.97	45.88	42.36	46.21
Diagonal Gaussian	85.33	46.53	42.91	46.82
Full-covariance Gaussian	85.40	47.11	42.74	46.70
Student- t	85.21	46.47	42.68	46.95

Appendix

Table 17: Sensitivity to the parametric form of the mode-wise anomaly-semantic prior. Results are averaged over the nine benchmark datasets. Higher is better.

Metric	5,000	10,000	20,000	48,000
Affiliation-F	77.66	78.93	82.15	85.33
$\mathrm{F1}_{\mathrm{T}}$	44.36	47.24	46.21	46.53
Standard-F1	41.05	43.52	42.78	42.91
VUS-PR	39.68	42.40	44.79	46.82

Appendix

Table 18: Performance under different amounts of simulated training data, averaged over the nine benchmark datasets. Higher is better.

Number of simulated pairs	Simulated-domain training	Pair generation	Test-time detection
5,000	23.6 min	50 ms / pair	2 ms / sequence
10,000	48.5 min	50 ms / pair	2 ms / sequence
20,000	95.1 min	50 ms / pair	2 ms / sequence
48,000	180.5 min	50 ms / pair	2 ms / sequence

Appendix

Table 19: Computational cost under different amounts of simulated training data. Pair generation is performed offline; test-time detection uses only the trained TCN.

Name	Domain	#TS	#Dim	Avg. Length	AR (%)
MSL	Space	16	55	3119.4	5.1
PSM	Sensor	1	25	217624.0	11.2
SMAP	Space	27	25	7855.9	2.9
SMD	Server	22	38	25466.4	3.8

Appendix

Table 20: Multivariate datasets used in the supplementary experiments. #TS denotes the number of evaluated multivariate sequences, #Dim the number of input variables per sequence, and AR the anomaly ratio.

Metric	Model	MSL	PSM	SMAP	SMD
Affiliation-F	LOF	84.35	61.98	63.32	64.13
	IForest	63.36	63.78	59.96	69.71
	OmniAnomaly	83.15	58.17	91.38	85.82
	TranAD	79.91	73.83	87.39	92.20
	USAD	81.86	57.86	87.25	85.09
	AnomTrans.	74.38	66.04	74.82	73.44

Appendix

Table 21: Results on multivariate anomaly detection benchmarks. Higher is better. Best and second-best results within each dataset–metric pair are shown in bold and underline , respectively.

Explore similar work

Apr 19, 2026cs.LG

Conditional Attribution for Root Cause Analysis in Time-Series Anomaly Detection

Root cause analysis (RCA) for time-series anomaly detection is critical for the reliable operation of complex real-world systems. Existing explanation methods often rely on unrealistic feature perturbations and ignore temporal and cross-feature dependencies, leading to unreliable attributions. We propose a conditional attribution framework that explains anomalies relative to contextually similar normal system states. Instead of using marginal or randomly sampled baselines, our method retrieves representative normal instances conditioned on the anomalous observation, enabling dependency-preserving and operationally meaningful explanations. To support high-dimensional time-series data, contextual retrieval is performed in learned low-dimensional representations using both variational autoencoder latent spaces and UMAP manifold embeddings. By grounding the retrieval process in the system's learned manifold, this strategy avoids out-of-distribution artifacts and ensures attribution fidelity while maintaining computational efficiency. We further introduce confidence-aware and temporal evaluation metrics for assessing explanation reliability and responsiveness. Experiments on the SWaT and MSDS benchmarks demonstrate that the proposed approach consistently improves root-cause identification accuracy, temporal localization, and robustness across multiple anomaly detection models. These results highlight the practical utility of conditional attribution for explainable anomaly diagnosis in complex time-series systems. Code and models are available at: https://github.com/dfki-av/Conditional-Attribution-for-Root-Cause-Analysis-in-Time-Series-Anomaly-Detection.

Shashank Mishra, Karan Patil, Cedric Schockaert +2

German Research Center for Artificial Intelligence (DFKI), Kaiserslautern, Germany · Rheinland-Pfälzische Technische Universität Kaiserslautern-Landau, Germany · Paul Wurth S.A, Luxembourg

Time-Series Anomaly Detection Interpretable Anomaly Detection Root Cause Analysis Time Series

Ask PDF

Sep 30, 2026cs.LG

LEARN-TS: LLM-Enhanced Alignment and Reconstruction with Normality Guidance for Multivariate Time-Series Anomaly Detection

Reconstruction errors in multivariate time-series anomaly detection may not reliably distinguish abnormal behavior from benign deviations. Language-derived semantics offer complementary context, but existing multimodal approaches may rely on time-associated paired textual information that is difficult to obtain consistently and is not provided by standard multivariate time-series anomaly detection benchmarks. This setting poses two challenges: (1) conditioning masked reconstruction on window-specific semantics without exposing exact numerical targets or anomaly-specific cues, and (2) using a window-independent concept of normality as a complementary semantic reference rather than an independent anomaly detector. We propose LLM-Enhanced Alignment and Reconstruction with Normality Guidance for Time Series (LEARN-TS), which uses a frozen language model to construct two role-separated semantic representations without requiring temporally paired external text. Window-specific observation semantics encode temporal and cross-variable context without exact numerical values to guide channel-shared patch-masked reconstruction. A fixed, dataset-agnostic normality prompt provides a window-independent semantic reference for aligning normal representations and estimating normality discrepancy. At inference, masking each temporal patch once yields timestamp-level reconstruction evidence, conditionally modulated by discrepancy from a separate unmasked view. Across four benchmarks, LEARN-TS achieves the highest mean performance in 13 of 16 dataset-metric comparisons. Controlled ablations examine observation conditioning, joint normality alignment and scoring, and reference content, showing dataset-dependent ranking benefits and modest average gains from semantic over random references.

Jahyeob Koo, Kio Yun, Byoungmo Koo +1

Department of Industrial and Management Engineering, Korea University Seoul, Republic of Korea

Time-Series Anomaly Detection Time Series Timestep Embeddings Norm Large Language Model Alignment

Ask PDF

Mar 27, 2026cs.LG

VAN-AD: Visual Masked Autoencoder with Normalizing Flow For Time Series Anomaly Detection

Time series anomaly detection (TSAD) is essential for maintaining the reliability and security of IoT-enabled service systems. Existing methods require training one specific model for each dataset, which exhibits limited generalization capability across different target datasets, hindering anomaly detection performance in various scenarios with scarce training data. To address this limitation, foundation models have emerged as a promising direction. However, existing approaches either repurpose large language models (LLMs) or construct largescale time series datasets to develop general anomaly detection foundation models, and still face challenges caused by severe cross-modal gaps or in-domain heterogeneity. In this paper, we investigate the applicability of large-scale vision models to TSAD. Specifically, we adapt a visual Masked Autoencoder (MAE) pretrained on ImageNet to the TSAD task. However, directly transferring MAE to TSAD introduces two key challenges: overgeneralization and limited local perception. To address these challenges, we propose VAN-AD, a novel MAE-based framework for TSAD. To alleviate the over-generalization issue, we design an Adaptive Distribution Mapping Module (ADMM), which maps the reconstruction results before and after MAE into a unified statistical space to amplify discrepancies caused by abnormal patterns. To overcome the limitation of local perception, we further develop a Normalizing Flow Module (NFM), which combines MAE with normalizing flow to estimate the probability density of the current window under the global distribution. Extensive experiments on nine real-world datasets demonstrate that VAN-AD consistently outperforms existing state-of-the-art methods across multiple evaluation metrics.We make our code and datasets available at https://github.com/PenyChen/VAN-AD.

PengYu Chen, Shang Wan, Xiaohou Shi +3

School of Computer Science (National Pilot Software Engineering School), Beijing University of Posts and Telecommunications, Beijing 100876, China · China Telecom Research Institute Beijing, China · Department of Computer Science, Missouri University of Science and Technology, Rolla, MO 65409 USA

Time-Series Anomaly Detection Unsupervised Detection Autoencoder Architectures Normalizing Flows

Ask PDF