Graph-Spectral Flow Matching for Multivariate Time Series Anomaly Detection

Zepeng Zhang; Jhony H. Giraldo; Wenbin Wang; Olga Fink

cs.LGSep 29, 2026

Graph-Spectral Flow Matching for Multivariate Time Series Anomaly Detection

Authors: Zepeng Zhang, Jhony H. Giraldo, Wenbin Wang, Olga Fink

Organizations: IMOS, EPFL · LTCI, T´el´ecom Paris, IP Paris · Independent Researcher

Abstract

Multivariate time series anomaly detection typically relies on evaluating discrepancies between observations and outputs produced by models trained on normal data. An alternative perspective is to characterize the distribution of normal data through the generative dynamics, i.e., the velocity field, of flow matching models. However, standard flow matching typically adopts linear probability paths that overlook dependencies among variables, leading to a misalignment with the structured data distribution. To address this issue, we propose GRASP, a flow matching framework with a graph-spectral path for multivariate time series anomaly detection. GRASP incorporates graph structure into the probability path by minimizing a fixed-endpoint action that combines kinetic energy with graph Dirichlet energy. This formulation yields a closed-form path based on graph-frequency-dependent hyperbolic interpolation. A velocity predictor trained on normal data then detects anomalies using weighted velocity discrepancies aggregated across source samples, flow times, and graph frequencies. Theoretically, we establish that GRASP is invariant to the choice of Laplacian eigenbasis and decompose its expected oracle anomaly score into bounded endpoint uncertainty and graph-frequency-weighted Fisher discrepancy. Experiments on four benchmarks demonstrate the superior anomaly detection performance of GRASP and validate the effectiveness of its graph-spectral path and weighting mechanism.

Figures & tables

Figure 1: Overview of GRASP for MTS anomaly detection. Left: flow matching with the same linear interpolation for all graph-frequency modes. Middle: GRASP with the graph-spectral path that applies frequency-dependent hyperbolic interpolation. Right: anomaly scoring strategy of GRASP.

Figure 2: Coefficients

\alpha_{k}(t)

(left) and

\beta_{k}(t)

(right) with different

\omega_{k}

Figure 3: Weight schedule of

\eta_{k}(t)

Model	SMAP			SMD			CICIDS			SWAN
Model	PRC	ROC	Best-F1	PRC	ROC	Best-F1	PRC	ROC	Best-F1	PRC	ROC	Best-F1
HBOS	0.1897	0.5650	0.2664	0.2678	0.7378	0.3556	0.2603	0.5586	0.3852	0.2792	0.5000	0.4365
COPOD	0.1927	0.5918	0.2841	0.2139	0.7193	0.2951	0.2214	0.5566	0.3733	0.2792	0.5000	0.4365
Autoencoder	0.2277	0.5859	0.2991	0.3613	0.7297	0.4214	0.3147	0.7276	0.3938	0.3294	0.4944	0.4371
USAD	0.2263	0.5850	0.3850	0.4105	0.8726	0.4810	0.2094	0.4619	0.3525	0.4405	0.5585	0.4365
CNN	0.2136	0.6577	0.3471	0.3730	0.7921	0.4313	0.2371	0.5543	0.3991	0.3760	0.4966	0.4365

Table 1: Anomaly detection performance comparison.

Model	SMAP			SMD
Model	PRC	ROC	Best-F1	PRC	ROC	Best-F1
GRASP-lin	0.2910	0.6879	0.3911	0.4762	0.8366	0.4968
GRASP-ER	0.2907	0.6909	0.3912	0.4797	0.8379	0.4993
GRASP-mean	0.2915	0.6941	0.3920	0.4801	0.8385	0.5005
GRASP	0.3149	0.7015	0.4178	0.4845	0.8567	0.5087

Table 2: Ablation results on SMAP and SMD.

Figure 4: Unweighted (left) and weighted (right) anomaly signal attribution across time and frequency on SMAP.

Appendix figures & tables10 assets

Supplementary material from the paper’s appendix.

Appendix

Symbol	Description
$N,\ R$	Number of variables and length of a time-series window.
$\mathcal{G}=(\mathcal{N},\mathcal{E})$	Sensor graph with node set $\mathcal{N}$ and edge set $\mathcal{E}$ .
$\mathbf{X}\in\mathbb{R}^{N\times R}$	Multivariate time-series window.
$\mathbf{L}$	Symmetric normalized graph Laplacian.
$\bm{\Psi},\bm{\Lambda}$	Laplacian eigenvector and eigenvalue matrices satisfying $\mathbf{L}=\bm{\Psi}\bm{\Lambda}\bm{\Psi}^{\top}$ .
$\lambda_{k},\bm{\psi}_{k}$	Laplacian eigenvalue and eigenvector associated with graph-frequency mode $k$ .

Appendix

Table 3: Summary of notation used throughout the paper.

Model	SMAP			SMD
Model	PRC	ROC	Best-F1	PRC	ROC	Best-F1
A-Transformer	0.1340 $\pm$ 0.0072	0.5065 $\pm$ 0.0071	0.2060 $\pm$ 0.0110	0.0720 $\pm$ 0.0046	0.5013 $\pm$ 0.0049	0.1260 $\pm$ 0.0071
FITS	0.1455 $\pm$ 0.0047	0.5147 $\pm$ 0.0068	0.2798 $\pm$ 0.0063	0.2863 $\pm$ 0.0026	0.8299 $\pm$ 0.0022	0.4025 $\pm$ 0.0026
TimesNet	0.1792 $\pm$ 0.0071	0.5336 $\pm$ 0.0058	0.3161 $\pm$ 0.0089	0.2839 $\pm$ 0.0053	0.8087 $\pm$ 0.0021	0.3713 $\pm$ 0.0049
COPOD	0.1927 $\pm$ 0.0000	0.5918 $\pm$ 0.0000	0.2841 $\pm$ 0.0000	0.2139 $\pm$ 0.0000	0.7193 $\pm$ 0.0000	0.2951 $\pm$ 0.0000
HBOS	0.1897 $\pm$ 0.0000	0.5650 $\pm$ 0.0000	0.2664 $\pm$ 0.0000	0.2678 $\pm$ 0.0000	0.7378 $\pm$ 0.0000	0.3556 $\pm$ 0.0000

Appendix

Table 4: Anomaly detection performance comparison on SMAP and SMD.

Model	CICIDS			SWAN
Model	PRC	ROC	Best-F1	PRC	ROC	Best-F1
A-Transformer	0.2396 $\pm$ 0.0007	0.4972 $\pm$ 0.0025	0.3060 $\pm$ 0.0000	0.2817 $\pm$ 0.0018	0.5021 $\pm$ 0.0014	0.4365 $\pm$ 0.0000
FITS	0.1849 $\pm$ 0.0013	0.4106 $\pm$ 0.0039	0.3126 $\pm$ 0.0013	0.3189 $\pm$ 0.0120	0.4607 $\pm$ 0.0120	0.4365 $\pm$ 0.0000
TimesNet	0.1905 $\pm$ 0.0021	0.4657 $\pm$ 0.0052	0.3121 $\pm$ 0.0015	0.3068 $\pm$ 0.0080	0.4505 $\pm$ 0.0137	0.4365 $\pm$ 0.0000
COPOD	0.2214 $\pm$ 0.0000	0.5566 $\pm$ 0.0000	0.3733 $\pm$ 0.0000	0.2792 $\pm$ 0.0000	0.5000 $\pm$ 0.0000	0.4365 $\pm$ 0.0000
HBOS	0.2603 $\pm$ 0.0000	0.5586 $\pm$ 0.0000	0.3852 $\pm$ 0.0000	0.2792 $\pm$ 0.0000	0.5000 $\pm$ 0.0000	0.4365 $\pm$ 0.0000

Appendix

Table 5: Anomaly detection performance comparison on CICIDS and SWAN.

Variant	CICIDS			SWAN
Variant	PRC	ROC	Best-F1	PRC	ROC	Best-F1
GRASP	0.3996	0.8108	0.4615	0.7556	0.8758	0.6886
GRASP-mean	0.3764	0.7593	0.4499	0.7552	0.8753	0.6881
GRASP-ER	0.3734	0.7546	0.4497	0.7534	0.8723	0.6857
GRASP-lin	0.3740	0.7543	0.4493	0.7486	0.8714	0.6841

Appendix

Table 6: Ablation results on CICIDS and SWAN.

Variant	SMAP			SMD			CICIDS			SWAN
Variant	PRC	ROC	Best-F1	PRC	ROC	Best-F1	PRC	ROC	Best-F1	PRC	ROC	Best-F1
TSMixer	0.3149	0.7015	0.4178	0.4845	0.8567	0.5087	0.3996	0.8108	0.4615	0.7556	0.8758	0.6886
GNN	0.2773	0.6758	0.3881	0.4659	0.8542	0.4926	0.3551	0.7232	0.4459	0.5306	0.6570	0.5188
Transformer	0.2639	0.6347	0.3795	0.4475	0.8272	0.4674	0.3283	0.6407	0.4331	0.5594	0.6758	0.5122

Appendix

Table 7: Ablation study of velocity-field architectures.

Figure 5: Anomaly score contributions across flow times and graph-frequency quantiles on SMD, CICIDS, and SWAN. Up: unweighted anomaly signal. Below: weighted anomaly signal.

Figure 6: Sensitivity to the number of flow-time evaluation points

|\mathcal{R}_{\mathrm{ad}}|

with

|\mathcal{X}_{\mathrm{ad}}|=5

Figure 7: Sensitivity to the number of source samples

|\mathcal{X}_{\mathrm{ad}}|

with

|\mathcal{R}_{\mathrm{ad}}|=10

Figure 8: Sensitivity to the graph Dirichlet-energy weight

\tau

Figure 9: Inference time comparison on SMAP (left) and SMD (right).

Time-Series Anomaly Detection

Time-Series Anomaly Detection identifies unusual patterns or events in sequential data, from sensor readings and network traffic to health and industrial telemetry.

See all 208 papers

GSLAD: Prototype-Regularized Graph Structure Learning for Multivariate Time Series Anomaly Detection
Sep 14, 2026Zepeng Zhang, Fuad Khuri, Keivan Faghih Niresi +1Graph Structure Learning Industrial Anomaly Detection
Intelligent Maintenance and Operations Systems (IMOS) Lab École Polytechnique Fédérale de Lausanne (EPFL), Lausanne, Switzerland
Temporal-Conditioned Normalizing Flows for Multivariate Time Series Anomaly Detection
Mar 10, 2026David Baumgartner, Helge Langseth, Kenth Engø-Monsen +1Time-Series Anomaly Detection Normalizing Flows
Department of Computer Science, Norwegian University of Science and Technology.
Learning Unified Representations of Normalcy for Time Series Anomaly Detection
May 10, 2026Prithul Sarker, Sushmita Sarker, Nicholas G. Murray +1Reconstruction-Based Anomaly Detection Unsupervised Anomaly Detection
University of Nevada, Reno

Sep 14, 2026J/K move · Enter open · S save

GSLAD: Prototype-Regularized Graph Structure Learning for Multivariate Time Series Anomaly Detection

Zepeng Zhang, Fuad Khuri, Keivan Faghih Niresi, Olga Fink

Intelligent Maintenance and Operations Systems (IMOS) Lab École Polytechnique Fédérale de Lausanne (EPFL), Lausanne, Switzerland

Graph Structure Learning Industrial Anomaly Detection Unsupervised Anomaly Detection Time-Series Anomaly Detection Graph-Based Anomaly Detection

Open paper AskPDF arXiv

Unsupervised multivariate time series anomaly detection methods typically identify anomalies through forecasting, reconstruction, or representation discrepancies. However, industrial faults may first alter inter-variable structural patterns while individual trajectories remain close to normal, resulting in weak anomaly signals. In this paper, we propose GSLAD, a prototype-regularized graph structure learning framework that uses structural deviations for anomaly scoring. GSLAD adopts a two-phase training strategy. First, a condition-aware graph learner and a graph-based forecaster are optimized with predictive supervision. The inferred normal graphs are then clustered into multiple structural prototypes representing different normal operating regimes, with edge-wise variability characterizing structural uncertainty. Deviations from these prototypes regularize the graph learner in the second phase, encouraging stable and regime-specific structural patterns. During inference, uncertainty-normalized structural deviation is combined with predictive deviation for anomaly scoring. Experiments on four industrial benchmarks demonstrate strong overall performance of GSLAD and confirm the effectiveness of structural deviation for anomaly detection and diagnosis.

Abstract

Time-Series Anomaly Detection

Explore similar work

GSLAD: Prototype-Regularized Graph Structure Learning for Multivariate Time Series Anomaly Detection

Temporal-Conditioned Normalizing Flows for Multivariate Time Series Anomaly Detection

Learning Unified Representations of Normalcy for Time Series Anomaly Detection