Graph-Spectral Flow Matching for Multivariate Time Series Anomaly Detection

Zepeng Zhang; Jhony H. Giraldo; Wenbin Wang; Olga Fink

cs.LGSep 29, 2026

Graph-Spectral Flow Matching for Multivariate Time Series Anomaly Detection

Authors: Zepeng Zhang, Jhony H. Giraldo, Wenbin Wang, Olga Fink

Organizations: IMOS, EPFL · LTCI, T´el´ecom Paris, IP Paris · Independent Researcher

Abstract

Multivariate time series anomaly detection typically relies on evaluating discrepancies between observations and outputs produced by models trained on normal data. An alternative perspective is to characterize the distribution of normal data through the generative dynamics, i.e., the velocity field, of flow matching models. However, standard flow matching typically adopts linear probability paths that overlook dependencies among variables, leading to a misalignment with the structured data distribution. To address this issue, we propose GRASP, a flow matching framework with a graph-spectral path for multivariate time series anomaly detection. GRASP incorporates graph structure into the probability path by minimizing a fixed-endpoint action that combines kinetic energy with graph Dirichlet energy. This formulation yields a closed-form path based on graph-frequency-dependent hyperbolic interpolation. A velocity predictor trained on normal data then detects anomalies using weighted velocity discrepancies aggregated across source samples, flow times, and graph frequencies. Theoretically, we establish that GRASP is invariant to the choice of Laplacian eigenbasis and decompose its expected oracle anomaly score into bounded endpoint uncertainty and graph-frequency-weighted Fisher discrepancy. Experiments on four benchmarks demonstrate the superior anomaly detection performance of GRASP and validate the effectiveness of its graph-spectral path and weighting mechanism.

Figures & tables

Figure 1: Overview of GRASP for MTS anomaly detection. Left: flow matching with the same linear interpolation for all graph-frequency modes. Middle: GRASP with the graph-spectral path that applies frequency-dependent hyperbolic interpolation. Right: anomaly scoring strategy of GRASP.

Figure 2: Coefficients

\alpha_{k}(t)

(left) and

\beta_{k}(t)

(right) with different

\omega_{k}

Figure 3: Weight schedule of

\eta_{k}(t)

Model	SMAP			SMD			CICIDS			SWAN
Model	PRC	ROC	Best-F1	PRC	ROC	Best-F1	PRC	ROC	Best-F1	PRC	ROC	Best-F1
HBOS	0.1897	0.5650	0.2664	0.2678	0.7378	0.3556	0.2603	0.5586	0.3852	0.2792	0.5000	0.4365
COPOD	0.1927	0.5918	0.2841	0.2139	0.7193	0.2951	0.2214	0.5566	0.3733	0.2792	0.5000	0.4365
Autoencoder	0.2277	0.5859	0.2991	0.3613	0.7297	0.4214	0.3147	0.7276	0.3938	0.3294	0.4944	0.4371
USAD	0.2263	0.5850	0.3850	0.4105	0.8726	0.4810	0.2094	0.4619	0.3525	0.4405	0.5585	0.4365
CNN	0.2136	0.6577	0.3471	0.3730	0.7921	0.4313	0.2371	0.5543	0.3991	0.3760	0.4966	0.4365

Table 1: Anomaly detection performance comparison.

Model	SMAP			SMD
Model	PRC	ROC	Best-F1	PRC	ROC	Best-F1
GRASP-lin	0.2910	0.6879	0.3911	0.4762	0.8366	0.4968
GRASP-ER	0.2907	0.6909	0.3912	0.4797	0.8379	0.4993
GRASP-mean	0.2915	0.6941	0.3920	0.4801	0.8385	0.5005
GRASP	0.3149	0.7015	0.4178	0.4845	0.8567	0.5087

Table 2: Ablation results on SMAP and SMD.

Figure 4: Unweighted (left) and weighted (right) anomaly signal attribution across time and frequency on SMAP.

Appendix figures & tables10 assets

Supplementary material from the paper’s appendix.

Appendix

Symbol	Description
$N,\ R$	Number of variables and length of a time-series window.
$\mathcal{G}=(\mathcal{N},\mathcal{E})$	Sensor graph with node set $\mathcal{N}$ and edge set $\mathcal{E}$ .
$\mathbf{X}\in\mathbb{R}^{N\times R}$	Multivariate time-series window.
$\mathbf{L}$	Symmetric normalized graph Laplacian.
$\bm{\Psi},\bm{\Lambda}$	Laplacian eigenvector and eigenvalue matrices satisfying $\mathbf{L}=\bm{\Psi}\bm{\Lambda}\bm{\Psi}^{\top}$ .
$\lambda_{k},\bm{\psi}_{k}$	Laplacian eigenvalue and eigenvector associated with graph-frequency mode $k$ .

Appendix

Table 3: Summary of notation used throughout the paper.

Model	SMAP			SMD
Model	PRC	ROC	Best-F1	PRC	ROC	Best-F1
A-Transformer	0.1340 $\pm$ 0.0072	0.5065 $\pm$ 0.0071	0.2060 $\pm$ 0.0110	0.0720 $\pm$ 0.0046	0.5013 $\pm$ 0.0049	0.1260 $\pm$ 0.0071
FITS	0.1455 $\pm$ 0.0047	0.5147 $\pm$ 0.0068	0.2798 $\pm$ 0.0063	0.2863 $\pm$ 0.0026	0.8299 $\pm$ 0.0022	0.4025 $\pm$ 0.0026
TimesNet	0.1792 $\pm$ 0.0071	0.5336 $\pm$ 0.0058	0.3161 $\pm$ 0.0089	0.2839 $\pm$ 0.0053	0.8087 $\pm$ 0.0021	0.3713 $\pm$ 0.0049
COPOD	0.1927 $\pm$ 0.0000	0.5918 $\pm$ 0.0000	0.2841 $\pm$ 0.0000	0.2139 $\pm$ 0.0000	0.7193 $\pm$ 0.0000	0.2951 $\pm$ 0.0000
HBOS	0.1897 $\pm$ 0.0000	0.5650 $\pm$ 0.0000	0.2664 $\pm$ 0.0000	0.2678 $\pm$ 0.0000	0.7378 $\pm$ 0.0000	0.3556 $\pm$ 0.0000

Appendix

Table 4: Anomaly detection performance comparison on SMAP and SMD.

Model	CICIDS			SWAN
Model	PRC	ROC	Best-F1	PRC	ROC	Best-F1
A-Transformer	0.2396 $\pm$ 0.0007	0.4972 $\pm$ 0.0025	0.3060 $\pm$ 0.0000	0.2817 $\pm$ 0.0018	0.5021 $\pm$ 0.0014	0.4365 $\pm$ 0.0000
FITS	0.1849 $\pm$ 0.0013	0.4106 $\pm$ 0.0039	0.3126 $\pm$ 0.0013	0.3189 $\pm$ 0.0120	0.4607 $\pm$ 0.0120	0.4365 $\pm$ 0.0000
TimesNet	0.1905 $\pm$ 0.0021	0.4657 $\pm$ 0.0052	0.3121 $\pm$ 0.0015	0.3068 $\pm$ 0.0080	0.4505 $\pm$ 0.0137	0.4365 $\pm$ 0.0000
COPOD	0.2214 $\pm$ 0.0000	0.5566 $\pm$ 0.0000	0.3733 $\pm$ 0.0000	0.2792 $\pm$ 0.0000	0.5000 $\pm$ 0.0000	0.4365 $\pm$ 0.0000
HBOS	0.2603 $\pm$ 0.0000	0.5586 $\pm$ 0.0000	0.3852 $\pm$ 0.0000	0.2792 $\pm$ 0.0000	0.5000 $\pm$ 0.0000	0.4365 $\pm$ 0.0000

Appendix

Table 5: Anomaly detection performance comparison on CICIDS and SWAN.

Variant	CICIDS			SWAN
Variant	PRC	ROC	Best-F1	PRC	ROC	Best-F1
GRASP	0.3996	0.8108	0.4615	0.7556	0.8758	0.6886
GRASP-mean	0.3764	0.7593	0.4499	0.7552	0.8753	0.6881
GRASP-ER	0.3734	0.7546	0.4497	0.7534	0.8723	0.6857
GRASP-lin	0.3740	0.7543	0.4493	0.7486	0.8714	0.6841

Appendix

Table 6: Ablation results on CICIDS and SWAN.

Variant	SMAP			SMD			CICIDS			SWAN
Variant	PRC	ROC	Best-F1	PRC	ROC	Best-F1	PRC	ROC	Best-F1	PRC	ROC	Best-F1
TSMixer	0.3149	0.7015	0.4178	0.4845	0.8567	0.5087	0.3996	0.8108	0.4615	0.7556	0.8758	0.6886
GNN	0.2773	0.6758	0.3881	0.4659	0.8542	0.4926	0.3551	0.7232	0.4459	0.5306	0.6570	0.5188
Transformer	0.2639	0.6347	0.3795	0.4475	0.8272	0.4674	0.3283	0.6407	0.4331	0.5594	0.6758	0.5122

Appendix

Table 7: Ablation study of velocity-field architectures.

Figure 5: Anomaly score contributions across flow times and graph-frequency quantiles on SMD, CICIDS, and SWAN. Up: unweighted anomaly signal. Below: weighted anomaly signal.

Figure 6: Sensitivity to the number of flow-time evaluation points

|\mathcal{R}_{\mathrm{ad}}|

with

|\mathcal{X}_{\mathrm{ad}}|=5

Figure 7: Sensitivity to the number of source samples

|\mathcal{X}_{\mathrm{ad}}|

with

|\mathcal{R}_{\mathrm{ad}}|=10

Figure 8: Sensitivity to the graph Dirichlet-energy weight

\tau

Figure 9: Inference time comparison on SMAP (left) and SMD (right).

Time-Series Anomaly Detection

Time-Series Anomaly Detection identifies unusual patterns or events in sequential data, from sensor readings and network traffic to health and industrial telemetry.

See all 208 papers

Sep 14, 2026

GSLAD: Prototype-Regularized Graph Structure Learning for Multivariate Time Series Anomaly Detection

Unsupervised multivariate time series anomaly detection methods typically identify anomalies through forecasting, reconstruction, or representation discrepancies. However, industrial faults may first alter inter-variable structural patterns while individual trajectories remain close to normal, resulting in weak anomaly signals. In this paper, we propose GSLAD, a prototype-regularized graph structure learning framework that uses structural deviations for anomaly scoring. GSLAD adopts a two-phase training strategy. First, a condition-aware graph learner and a graph-based forecaster are optimized with predictive supervision. The inferred normal graphs are then clustered into multiple structural prototypes representing different normal operating regimes, with edge-wise variability characterizing structural uncertainty. Deviations from these prototypes regularize the graph learner in the second phase, encouraging stable and regime-specific structural patterns. During inference, uncertainty-normalized structural deviation is combined with predictive deviation for anomaly scoring. Experiments on four industrial benchmarks demonstrate strong overall performance of GSLAD and confirm the effectiveness of structural deviation for anomaly detection and diagnosis.

Zepeng Zhang, Fuad Khuri, Keivan Faghih Niresi +1

Intelligent Maintenance and Operations Systems (IMOS) Lab École Polytechnique Fédérale de Lausanne (EPFL), Lausanne, Switzerland

Graph Structure Learning Industrial Anomaly Detection Unsupervised Anomaly Detection Time-Series Anomaly Detection Graph-Based Anomaly Detection

Ask PDF

Mar 10, 2026

Temporal-Conditioned Normalizing Flows for Multivariate Time Series Anomaly Detection

This paper introduces temporal-conditioned normalizing flows (tcNF), a novel framework that addresses anomaly detection in time series data with accurate modeling of temporal dependencies and uncertainty. By conditioning normalizing flows on previous observations, tcNF effectively captures complex temporal dynamics and generates accurate probability distributions of expected behavior. This autoregressive approach enables robust anomaly detection by identifying low-probability events within the learned distribution. We evaluate tcNF on diverse datasets, demonstrating good accuracy and robustness compared to existing methods. A comprehensive analysis of strengths and limitations and open-source code is provided to facilitate reproducibility and future research.

David Baumgartner, Helge Langseth, Kenth Engø-Monsen +1

Department of Computer Science, Norwegian University of Science and Technology.

Time-Series Anomaly Detection Normalizing Flows

Ask PDF

May 10, 2026

Learning Unified Representations of Normalcy for Time Series Anomaly Detection

The core challenge in unsupervised anomaly detection is identifying abnormal patterns without prior knowledge of their characteristics. While existing methods have addressed aspects of this problem, they often struggle to learn a robust representation of the normal data distribution that is distinct from anomalous patterns. In this paper, we present a novel framework, Unified Unsupervised Anomaly Detection (

\text{U}^2\text{AD}

), that comprehensively addresses anomaly detection in multivariate time series. Our approach learns the underlying data distribution of normal samples by utilizing score-based generative modeling. We introduce a novel time-dependent score network and a unified training objective that together delineate the manifold of normal data while considering both local and global temporal contexts. Reconstruction is then performed via a deterministic sampling process using an ordinary differential equation solver. Our extensive experimental evaluations demonstrate that

\text{U}^2\text{AD}

not only outperforms current state-of-the-art methods in detection accuracy but also identifies anomalies at significantly earlier stages of their occurrence.

Prithul Sarker, Sushmita Sarker, Nicholas G. Murray +1

University of Nevada, Reno

Reconstruction-Based Anomaly Detection Unsupervised Anomaly Detection Score-Based Generative Modeling Time-Series Anomaly Detection

Ask PDF

Abstract

Time-Series Anomaly Detection

Explore similar work

GSLAD: Prototype-Regularized Graph Structure Learning for Multivariate Time Series Anomaly Detection

Temporal-Conditioned Normalizing Flows for Multivariate Time Series Anomaly Detection

Learning Unified Representations of Normalcy for Time Series Anomaly Detection