Normality Constraint Learning: Adapting Foundation Models for Time Series Anomaly Detection

Xiaohui Zhou; Yijie Wang; Hongzuo Xu; Weixuan Liang; Guansong Pang

cs.AIOct 5, 2026

Normality Constraint Learning: Adapting Foundation Models for Time Series Anomaly Detection

Authors: Xiaohui Zhou, Yijie Wang, Hongzuo Xu, Weixuan Liang, Guansong Pang

Organizations: National Key Laboratory of Parallel and Distributed Computing · College of Computer Science and Technology, National University of Defense Technology · Intelligent Game and Decision Lab (IGDL) · School of Computing and Information Systems, Singapore Management University

Abstract

Time Series Foundation Models (TSFMs) achieve strong generalization by learning to reconstruct or forecast broad temporal patterns from large-scale time series during pre-training. Yet this strength can become a weakness for anomaly detection: TSFMs may model rare anomalous patterns as effectively as normal ones, allowing anomalies to be accurately reconstructed or forecasted and thus diminishing their reconstruction/forecasting error-based anomaly scores. This paper proposes $\underline{\textbf{N}}$$\textbf{ormality}$ $\underline{\textbf{C}}$$\textbf{onstraint}$ $\underline{\textbf{L}}$$\textbf{earning}$ ( $\textbf{NCL}$ ), a lightweight plug-and-play framework that adapts pre-trained TSFMs for accurate anomaly detection without modifying their pre-trained parameters. Our key insight is to constrain the broad pattern space of TSFMs to the normal structure of a target time series, preventing their broad modeling capability from obscuring abnormal deviations. Specifically, NCL constructs a compact normality subspace from a few normal patch features and adaptively steers each patch feature toward normality within this subspace, guided by contrastive constraints that form compact and discriminative normality manifolds. The calibrated features are aggregated to reinforce normal components and fused with the original TSFM output, amplifying the discrepancy between normal and abnormal observations for the reconstruction/forecasting error-based anomaly scoring. Extensive experiments across diverse TSFM families and benchmarks show that NCL consistently improves anomaly detection performance, providing a generalizable framework for adapting TSFMs to anomaly detection.

Figures & tables

Panel of Figure 1 — Figure 1: (a) and (b) respectively show the anomaly score distributions of normal and abnormal observations for reconstruction-based and forecasting-based TSFMs and their NCL-augmented counterparts on the PSM dataset ( Abdulaal et al., 2021 ) . NCL enables both types of TSFMs to produce substantially more discriminative anomaly scores.

Figure 2: Overview of NCL. \small{1}⃝ Given few-shot normal training subsequences, a frozen TSFM is used to extract their patch features $\mathbf{Z}$ , upon which NormSpace constructs a normal subspace of $k$ principal directions via SVD. \small{2}⃝ PatchNT is then trained to perform patch-adaptive transformation of each feature onto a learnable normality manifold along each principal direction. \small{3}⃝ ConNC is further leveraged to calibrate the transformed features via constraining their distributions tightly cluster around the normal prototypes $\{\mathbf{c}_{i}\}_{i=1}^{k}$ . Finally, these calibrated features are synthesized with the original TSFM output to amplify the error discrepancy between normal and abnormal data.

Dataset	Aurora			ROSE			Chronos			TMM
Dataset	w/o NCL	w/ NCL	$\bm{\triangle}_{\textbf{imp}}(\textbf{\%})$	w/o NCL	w/ NCL	$\bm{\triangle}_{\textbf{imp}}(\textbf{\%})$	w/o NCL	w/ NCL	$\bm{\triangle}_{\textbf{imp}}(\textbf{\%})$	w/o NCL	w/ NCL	$\bm{\triangle}_{\textbf{imp}}(\textbf{\%})$
IOPS	0.1333	0.2528	+89.65	0.1307	0.1936	+48.13	0.2387	0.3614	+51.40	0.1877	0.3338	+77.84
UCR	0.0216	0.0247	+14.35	0.0242	0.0329	+35.95	0.0566	0.0691	+22.08	0.0400	0.0410	+2.50
NAB	0.3004	0.3401	+13.22	0.3365	0.3754	+11.56	0.2766	0.3756	+35.79	0.2894	0.3368	+16.38
MSL	0.2982	0.3681	+23.44	0.3604	0.4488	+24.53	0.3943	0.4361	+10.60	0.3653	0.4849	+32.74
SMAP	0.1889	0.2823	+49.44	0.2417	0.3484	+44.15	0.3106	0.3741	+20.44	0.2736	0.3686	+34.72

Table 1: VUS-PR results of vanilla and NCL-augmented TSFMs that use forecasting/reconstruction errors to detect anomalies on ten TSAD datasets.

\bm{\triangle}_{\textbf{imp}}

indicates improvement ratios gained by NCL.

Figure 3: Performance changes relative to vanilla TSFMs for three different TSFMs.

Dataset				IOPS			PSM
Variant	NormSpace	PatchNT	ConNC	ROSE	TMM	UniTS	ROSE	TMM	UniTS
Vanilla	✘	✘	✘	0.1307	0.1877	0.1530	0.3672	0.3611	0.4203
$\text{NCL}_{\text{N}}$	✔	✘	✘	0.1728	0.2821	0.1545	0.3829	0.4549	0.4479
$\text{NCL}_{\text{P}}$	✘	✔	✘	0.1429	0.2356	0.1589	0.3761	0.4409	0.4375
$\text{NCL}_{\text{C}}$	✘	✘	✔	0.1796	0.2874	0.1584	0.3789	0.4413	0.4358
$\text{NCL}_{\text{NP}}$	✔	✔	✘	0.1811	0.3092	0.1623	0.3912	0.4655	0.4507

Table 2: Ablation study results of NCL and its variants.

Figure 4: Effectiveness vs. efficiency trade-off.

Appendix figures & tables17 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	Domain	Dim	Avg Train Length	Avg Test Length	Avg Anomaly Ratio (%)	Series Count
IOPS	Web	1	10,142.4	91,288.3	2.15	11
UCR	Multiple	1	18,608.6	47,294	0.58	243
NAB	Multiple	1	3,557.8	3,557	9.84	45
MSL	Spacecraft	1	2,269.8	2,896.8	3.85	22
SMAP	Spacecraft	1	2,608.8	7,929.7	2.20	35
PSM	Server Machine	25	132,481	87,841	11.07	1

Appendix

Table 3: Statistics of ten datasets (Dim: dimensionality).

Figure 5: Efficiency comparison of NCL and other TSFM adaptation methods w.r.t. different TSFMs.

Dataset	Metric	CroAD	ConAD	TsNet	Dlinear	LOF	Last-1	Last-3	Var-100	TMM	+NCL	UniTS	+NCL
IOPS	A-P	0.3019	0.0226	0.1486	0.2188	0.0574	0.2147	0.2320	0.2331	0.2093	0.3393	0.1810	0.3133
	R-A-P	0.2855	0.0285	0.1447	0.2261	0.0617	0.1764	0.2334	0.1715	0.1886	0.3349	0.1524	0.1874
	V-PR	0.2827	0.0285	0.1437	0.2231	0.0634	0.1763	0.2282	0.1722	0.1877	0.3338	0.1530	0.1861
UCR	A-P	0.0269	0.0089	0.0404	0.0452	0.0586	0.0727	0.0530	0.0777	0.0446	0.0443	0.0735	0.0766
	R-A-P	0.0268	0.0198	0.0433	0.0430	0.0587	0.0635	0.0412	0.0846	0.0348	0.0356	0.0827	0.0843
	V-PR	0.0272	0.0198	0.0481	0.0468	0.0586	0.0654	0.0457	0.0817	0.0400	0.0410	0.0808	0.0832

Appendix

Table 4: PR comparison with deep TSAD methods and one-liner baselines. The best ones are boldfaced and the second best are

\underline{\text{underlined}}

Dataset	Metric	CroAD	ConAD	TsNet	Dlinear	LOF	Last-1	Last-3	Var-100	TMM	+NCL	UniTS	+NCL
IOPS	A-R	0.7448	0.4979	0.6825	0.6935	0.5474	0.6084	0.6393	0.7727	0.6868	0.8292	0.7446	0.8155
	R-A-R	0.7589	0.5396	0.7291	0.7435	0.5585	0.6431	0.6891	0.7417	0.7158	0.8437	0.7388	0.7453
	V-ROC	0.7582	0.5335	0.7237	0.7390	0.5534	0.6400	0.6835	0.7426	0.7117	0.8426	0.7375	0.7439
UCR	A-R	0.5251	0.5008	0.5262	0.5753	0.5827	0.5291	0.5314	0.5387	0.5484	0.5851	0.5506	0.5566
	R-A-R	0.6025	0.6078	0.6030	0.6633	0.6424	0.6177	0.6245	0.5941	0.6379	0.6442	0.6055	0.6116
	V-ROC	0.5984	0.5968	0.5960	0.6356	0.6371	0.6112	0.6179	0.5915	0.6295	0.6403	0.6021	0.6083

Appendix

Table 5: ROC comparison with deep TSAD methods and one-liner baselines. The best ones are boldfaced and the second best are

\underline{\text{underlined}}

Model	Dataset
Model	IOPS	UCR	NAB	MSL	SMAP	PSM	SMD	SWAT	PUMP	NYC
DADA ${}_{\text{zero}}$	0.1837	0.0511	0.4574	0.4395	0.4165	0.4732	0.1239	0.5988	0.2097	0.0553
DADA ${}_{\text{five}}$	0.1453	0.0783	0.4692	0.4671	0.3656	0.4549	0.1197	0.4262	0.2541	0.3744
TimeRCD ${}_{\text{zero}}$	0.0691	0.0819	0.3410	0.3328	0.3324	0.3126	0.0691	0.5721	0.1960	0.0690
TimeRCD ${}_{\text{five}}$	0.0584	0.0786	0.3033	0.2996	0.3056	0.3117	0.0670	0.5356	0.1916	0.0650
TimeRadar ${}_{\text{zero}}$	0.1111	0.0467	0.3221	0.4617	0.3207	0.4231	0.0968	0.5802	0.2263	0.0985

Appendix

Table 6: VUS-PR comparison with TSAD-specific foundation models. The best ones are boldfaced and the second best are

\underline{\text{underlined}}

Panel of Figure 6 — Figure 6: One-to-one comparison between Chronos (without and with NCL) and three squared-difference baselines across 361 time series from ten TSAD datasets.

Panel of Figure 7 — Figure 7: One-to-one comparison between MOMENT (without and with NCL) and three moving-window variances across 361 time series from ten TSAD datasets.

Panel of Figure 8 — Figure 8: Anomaly score distributions for different TSFMs and datasets.

Panel of Figure 9 — Figure 9: The t-SNE visualization of internal features from vanilla and NCL-augmented TSFMs.

Panel of Figure 10 — Figure 10: VUS-PR scores with various forecasting horizons and reconstruction window sizes, evaluated on four datasets for different TSFMs without and with using NCL.

Panel of Figure 11 — Figure 11: Visualization of anomaly scores in comparison with vanilla and NCL-augmented TSFMs on the univariate and multivariate datasets. Red regions highlight the ground truth anomaly intervals.

Panel of Figure 12 — Figure 12: VUS-PR performance of three NCL-augmented TSFMs w.r.t. different number of normal samples.

Panel of Figure 13 — Figure 13: VUS-PR performance of three NCL-augmented TSFMs w.r.t. different number of singular vectors.

Dataset	Metric	Aurora	+NCL	ROSE	+NCL	Chronos	+NCL	TMM	+NCL	TimeMoE	+NCL
IOPS	A-P	0.1433	$\text{0.2646}_{\pm\text{0.0148}}$	0.1712	$\text{0.2396}_{\pm\text{0.0118}}$	0.2649	$\text{0.3654}_{\pm\text{0.0019}}$	0.2093	$\text{0.3393}_{\pm\text{0.0144}}$	0.2535	$\text{0.3367}_{\pm\text{0.0094}}$
	R-A-P	0.1331	$\text{0.2540}_{\pm\text{0.0247}}$	0.1300	$\text{0.1935}_{\pm\text{0.0137}}$	0.2390	$\text{0.3619}_{\pm\text{0.0017}}$	0.1886	$\text{0.3349}_{\pm\text{0.0130}}$	0.2171	$\text{0.3360}_{\pm\text{0.0074}}$
	V-PR	0.1333	$\text{0.2528}_{\pm\text{0.0244}}$	0.1307	$\text{0.1936}_{\pm\text{0.0138}}$	0.2387	$\text{0.3614}_{\pm\text{0.0017}}$	0.1877	$\text{0.3338}_{\pm\text{0.0130}}$	0.2163	$\text{0.3358}_{\pm\text{0.0077}}$
UCR	A-P	0.0162	$\text{0.0214}_{\pm\text{0.0012}}$	0.0200	$\text{0.0332}_{\pm\text{0.0013}}$	0.0636	$\text{0.0754}_{\pm\text{0.0041}}$	0.0446	$\text{0.0443}_{\pm\text{0.0008}}$	0.0661	$\text{0.0830}_{\pm\text{0.0082}}$
	R-A-P	0.0215	$\text{0.0246}_{\pm\text{0.0025}}$	0.0238	$\text{0.0323}_{\pm\text{0.0008}}$	0.0531	$\text{0.0665}_{\pm\text{0.0032}}$	0.0348	$\text{0.0356}_{\pm\text{0.0007}}$	0.0512	$\text{0.0740}_{\pm\text{0.0074}}$
	V-PR	0.0216	$\text{0.0247}_{\pm\text{0.0025}}$	0.0242	$\text{0.0329}_{\pm\text{0.0007}}$	0.0566	$\text{0.0691}_{\pm\text{0.0032}}$	0.0400	$\text{0.0410}_{\pm\text{0.0007}}$	0.0568	$\text{0.0780}_{\pm\text{0.0069}}$

Appendix

Table 7: PR results of ten vanilla and NCL-augmented TSFMs that use forecasting/reconstruction errors to detect anomalies on ten TSAD datasets. Meanwhile, we perform the paired t-tests, and

p

- values are reported.

Dataset	Metric	Aurora	NCL	ROSE	NCL	Chronos	NCL	TMM	NCL	TimeMoE	NCL
IOPS	A-R	0.6676	$\text{0.7848}_{\pm\text{0.0237}}$	0.6770	$\text{0.7845}_{\pm\text{0.0185}}$	0.7006	$\text{0.8398}_{\pm\text{0.0005}}$	0.6868	$\text{0.8292}_{\pm\text{0.0085}}$	0.6908	$\text{0.8301}_{\pm\text{0.0237}}$
	R-A-R	0.6943	$\text{0.8016}_{\pm\text{0.0219}}$	0.6866	$\text{0.7770}_{\pm\text{0.0125}}$	0.7359	$\text{0.8636}_{\pm\text{0.0004}}$	0.7158	$\text{0.8437}_{\pm\text{0.0080}}$	0.7262	$\text{0.8628}_{\pm\text{0.0202}}$
	V-ROC	0.6922	$\text{0.8006}_{\pm\text{0.0221}}$	0.6850	$\text{0.7740}_{\pm\text{0.0132}}$	0.7318	$\text{0.8621}_{\pm\text{0.0003}}$	0.7117	$\text{0.8426}_{\pm\text{0.0080}}$	0.7224	$\text{0.8603}_{\pm\text{0.0209}}$
UCR	A-R	0.5738	$\text{0.5849}_{\pm\text{0.0056}}$	0.5394	$\text{0.5485}_{\pm\text{0.0079}}$	0.5567	$\text{0.5916}_{\pm\text{0.0042}}$	0.5484	$\text{0.5851}_{\pm\text{0.0018}}$	0.5453	$\text{0.5799}_{\pm\text{0.0143}}$
	R-A-R	0.6610	$\text{0.6486}_{\pm\text{0.0067}}$	0.6317	$\text{0.6244}_{\pm\text{0.0081}}$	0.6471	$\text{0.6569}_{\pm\text{0.0037}}$	0.6379	$\text{0.6442}_{\pm\text{0.0013}}$	0.6405	$\text{0.6568}_{\pm\text{0.0096}}$
	V-ROC	0.6530	$\text{0.6445}_{\pm\text{0.0070}}$	0.6236	$\text{0.6186}_{\pm\text{0.0080}}$	0.6389	$\text{0.6530}_{\pm\text{0.0037}}$	0.6295	$\text{0.6403}_{\pm\text{0.0012}}$	0.6316	$\text{0.6499}_{\pm\text{0.0105}}$

Appendix

Table 8: ROC results of ten vanilla and NCL-augmented TSFMs that use forecasting/reconstruction errors to detect anomalies on ten TSAD datasets. Meanwhile, we perform the paired t-tests, and

p

- values are reported.

Figure 14: Pairwise correlation in PR metrics.

Figure 15: Pairwise correlation in ROC metrics.

Explore similar work

Oct 5, 2026cs.LG

Anlu: Enabling In-Context Time Series Anomaly Detection in Foundation Models via Counterfactual Supervision

Whether a time-series pattern is anomalous often depends on the operating regime of the monitored process. A missing event can signal a fault in one regime and be routine in another, and the query alone may not reveal which regime applies. We study in-context learning (ICL) for time series anomaly detection (TSAD) through reference-conditioned detection, where a reference record provides evidence about expected behavior and model parameters remain fixed at inference. Supplying the reference is not enough: when training anomalies are recognizable from the query alone, the detector can fit its targets while ignoring the reference. We therefore introduce counterfactual supervision, which pairs one query with two references that support different normal rules and labels the query under each. At positions where the two labels disagree, no detector that ignores the reference can fit both targets. Anlu learns from this supervision by adding a reference memory and zero-initialized gated adapters to a frozen time-series foundation model (TSFM) pretrained for anomaly detection. On the 350 TSB-AD-U evaluation sequences, Anlu raises the mean VUS-PR of the frozen TSFM from 0.542 to 0.607. Replacing the reference with zeros lowers Anlu's score to 0.499.

Tian Lan, Yifei Gao, Yimeng Lu +5

Department of Industrial Engineering, Tsinghua University · Huawei

Time-Series Anomaly Detection Time Series Foundation Models

Ask PDF

May 31, 2026cs.LG

ChronosAD: Leveraging Time Series Foundation Models for Accurate Anomaly Detection

Time series anomaly detection is a crucial task in various domains, including finance, healthcare, and industry. However, existing methods often struggle to generalize across different datasets, especially when anomalies are subtle or context-dependent. To solve this issue, we introduce ChronosAD, a novel architecture for anomaly detection that uses a time series foundation model as a feature extractor. Specifically, it employs a two-stage pipeline: first, it uses the foundation model to extract embeddings for each time series in a zero-shot manner. Then, a custom-developed Temporal Block, composed of Bidirectional Long Short-Term Memory (BiLSTM) and Multi-Head Attention, refines these embeddings to capture temporal dependencies and highlight salient patterns. Unlike previous approaches, our model requires minimal task-specific tuning and demonstrates robust generalization across a wide range of domains, including industrial, medical, cyber-physical, and automotive systems. Extensive experiments on 11 benchmarks show that ChronosAD outperforms existing methods by 4.72% in AUC and 6.60% in AP on average. The source code is available at https://github.com/intelligolabs/ChronosAD.

Uzair Khan, Luigi Capogrosso, Francesco Biondani +4

University of Verona · Interdisciplinary Transformation University of Austria · ETH Zurich

Time-Series Anomaly Detection Time Series Foundation Models Time Series Chronos Bidirectional Long Short-Term Memory

Ask PDF

Jul 14, 2026cs.LG

Exploring Zero-Shot Foundation Models for Multivariate Time Series Anomaly Detection

Multivariate Time Series Anomaly Detection (MTSAD) is essential for reliability and safety in domains such as industrial process monitoring and financial risk management, yet conventional approaches rely on application-specific models that are costly to train and hard to scale. Foundation Models (FMs), pre-trained on broad data with strong zero-shot generalization, have recently become available for univariate time series forecasting, raising the question of whether they can address MTSAD without task-specific training. We investigate the zero-shot application of a univariate forecasting FM, TimesFM, to industrial MTSAD on the Secure Water Treatment (SWaT) benchmark, evaluating two strategies: treating the FM as a per-feature forecaster with thresholded prediction errors, and as an embedder whose intermediate representations feed standard outlier detectors. Neither of our proposed setups is competitive with established baselines; embeddings reveal only partial separation between normal and anomalous segments, insufficient for reliable detection. The cause is that the FM is too effective at capturing temporal dynamics, yielding low error even within fully anomalous windows, so persistent anomalies become indistinguishable from normal behavior. However, these observations yield valuable insights: the error peaks at anomaly boundaries, indicating FMs reliably detect distribution changes. We conclude that the proposed naive zero-shot FMs are unsuitable for MTSAD but promising for change-point detection.

Martin Uray, Saverio Messineo, Roland Kwitt +1

Josef Ressel Centre for Intelligent and Secure Industrial Automation, Salzburg University of Applied Sciences, Austria · Department of Artificial Intelligence and Human Interfaces, Paris Lodron University of Salzburg, Austria

Time-Series Anomaly Detection Time Series Foundation Models

Ask PDF