CLOSURE: Cross-Channel Closure for Multivariate Time Series Anomaly Detection
Authors: Fan Xu, Hao Wu, Zhi Song, Hanbo Huang, Wenzhuo Ma, Nan Wang, Wei Gong, Xibin Zhao
Organizations: University of Science and Technology of China, Hefei, Anhui, China · Tsinghua University, Beijing, China · City University of Hong Kong, Hongkong, China · Shanghai Jiao Tong University, Shanghai, China · Tianjin University, Tianjin, China · Beijing Jiaotong University, Beijing, China
Multivariate time series produced by industrial installations and server clusters are under continuous monitoring, and anomaly detection is the first line of defense before a local fault escalates into a system-wide failure. In the absence of labels, the dominant paradigm trains a reconstruction model on normal data and scores the residual to reach a verdict. Recent work has steadily enriched the expressiveness of the recovery map through Transformers, diffusion models, and cross-scale associations. A residual, however, only certifies that an observation can be recovered; it does not certify that the variables still explain one another as they do under normal operation. A coordinated yet unfamiliar operating transition inflates the residual without breaking any relationship, whereas a sensor drifting away from its peers may leave the residual silent. Methods that fold inter-variable dependencies into the reconstruction objective inherit this ambiguity, because their relational evidence is ultimately supervised by the same recovery loss. We therefore propose CLOSURE, which evaluates recoverability and cross-channel consistency as two normal-data prediction tasks learned in separation. The recoverability task is solved by a diffusion reconstructor conditioned on a discrete memory of normal temporal bases. The consistency task is solved by a relation-closure operator that predicts every channel exclusively from the others, where the target's own trajectory is withheld and sparse signed gates decide which peers are actually used. The two scores are reconciled only through calibration on normal data. Extensive experiments show that CLOSURE consistently outperforms recent reconstruction-, frequency-, and topology-based detectors on public benchmark streams, confirming the value of examining consistency alongside recoverability.
Figures & tables
Figure 1. Reconstructable does not necessarily mean consistent. (a) A coordinated transition can be hard to reconstruct while every relationship stays intact, whereas a smooth relation break can remain easy to reconstruct. (b) Reconstruction-only scoring compares an observation with its recovery. (c) CLOSURE additionally compares the same observation with predictions issued by its peer channels. The depicted W⋆ denotes frozen connectivity.
Figure 2. Overview of CLOSURE . Paired codebooks store normal temporal bases as code indices; decoded bases condition both corruption and attention. Learned signed coefficients, per-edge gates, and source-only messages predict each target from its peers, never from itself. Independently calibrated scores are combined for detection.
Dataset
SMD
MSL
SMAP
SWaT
PSM
Metric
P
R
F1
P
R
F1
P
R
F1
P
R
F1
P
R
F1
LOF
57.69
99.10
72.93
49.89
72.18
59.00
47.92
82.86
60.72
53.20
96.73
68.65
53.90
99.91
70.02
iForest
100.00
9.37
17.13
53.87
94.58
68.64
41.12
68.91
51.51
53.03
62.80
57.50
100.00
3.35
6.48
CL-MPPCA
58.29
88.43
70.26
50.10
76.30
60.48
48.50
80.20
60.45
54.32
90.16
67.79
55.27
93.46
69.46
TimesNet
58.50
82.32
68.40
52.10
88.47
65.58
42.40
88.10
57.25
48.37
84.23
61.45
65.16
94.23
77.04
MTAD-GAT
85.90
67.69
75.72
54.96
94.93
69.62
39.05
93.99
55.18
65.90
77.51
71.24
79.90
60.14
68.63
Table 1. Anomaly detection performance on five benchmarks. P, R, and F1 denote affiliation metrics (%). F1 is computed as the harmonic mean of the reported P and R. Bold and underlined F1 scores indicate the best and second-best performance.
Figure 3. Complementary scoring responses. (a) Observation and reconstruction; (b) window-standardized observation and peer prediction; (c) scores and alarm strips. Black denotes observations; blue (R), reconstruction; gold (P), relation; and teal (F), equal-weight fusion. Pink shading marks the annotated anomalous interval. Scores are divided by their respective normal-calibrated thresholds, with the gray dashed line at one indicating the alarm boundary.
Creditcard
GECCO
P
R
F1
P
R
F1
iForest
1.57
88.16
3.09
2.55
97.35
4.97
BeatGAN
51.76
60.48
55.78
62.71
58.94
60.77
AnoTran
55.86
57.55
56.69
54.77
57.21
55.96
DCdetector
49.86
67.67
57.42
38.30
59.70
46.66
D3R
56.90
69.61
62.62
59.00
36.61
45.18
Table 2. Performance on the Creditcard and GECCO scenarios of NeurIPS-TS. P, R, and F1 denote affiliation metrics (%). Bold and underlined F1 scores indicate the best and second-best.
Figure 4. Sensitivity to the relation reference. Normalized closure RMSE (mean ± SD, 12 paired trials). Blue: rewiring q of the support; gold: flipping q/2 of edge signs; gray dashed: unperturbed baseline.
Figure 5. Sensitivity to the fusion weight. Unadjusted point F1 for Processes A and B, with a separately normal-calibrated 99 th-percentile threshold per weight. Endpoints represent individual branches; the dashed line and enlarged markers indicate equal-weight fusion.
Figure 6. Event retrieval and within-event coverage. Percentage of 36 events meeting each coverage requirement. Blue/gold/teal: reconstruction/relation/equal fusion.
SWaT
SMD
Variant
P
R
F1
P
R
F1
Rec. only
60.42
83.15
69.99
72.60
84.50
78.10
Rel. only
58.76
80.93
68.08
70.60
81.80
75.79
Raw bases
61.85
84.92
71.57
74.80
87.20
80.53
Full model
63.14
86.71
73.07
81.65
95.73
88.13
Table 3. Component ablations. P, R, and F1 are affiliation metrics. The bold denotes the highest.
Time-Series Anomaly Detection identifies unusual patterns or events in sequential data, from sensor readings and network traffic to health and industrial telemetry.
Reconstruction-based detectors for multivariate time series anomaly detection typically learn a single entangled representation of normal behavior and flag anomalies based on reconstruction error. However, real-world anomalies are not only isolated spikes in a single channel but also disruptions in the relationships between channels, where each sensor individually appears normal, but their joint behavior deviates from the norm. Because these models compress both temporal evolution and inter-channel structure into this single space, they lack an explicit mechanism to isolate such inter-channel dependencies from normal temporal dependencies, leading to lower detection rates for cross-channel anomalies. We propose CARMA (Correlation-Aware Reconstruction for Multivariate Time Series Anomaly Detection), which is a reconstruction-based variational autoencoder with two complementary latent spaces: a temporal latent that captures sequential dynamics, and a correlation latent that is trained to reconstruct the window's pairwise Pearson correlations. Both representations are fused in the signal decoder, and anomalies are detected from the reconstruction error. We evaluate CARMA on the TSB-AD-M benchmark suite (17 datasets, 180 series) against 29 baseline methods, and show that it significantly outperforms all of them across multiple threshold-free and range-aware metrics, achieving a VUS-PR of 0.4929. Ablations show that removing the correlation branch degrades performance, that adding a second latent without supervision recovers only part of the gain, and that supervising the correlation latent with an explicit correlation target accounts for the rest and produces a sharper error response at anomalies.
Md. Johir Raihan, Zahra Zamanzadeh Darban, Yueyang Liu +3
Monash University, Melbourne, Victoria, Australia · University of New South Wales, Sydney, New South Wales, Australia
Reconstruction errors in multivariate time-series anomaly detection may not reliably distinguish abnormal behavior from benign deviations. Language-derived semantics offer complementary context, but existing multimodal approaches may rely on time-associated paired textual information that is difficult to obtain consistently and is not provided by standard multivariate time-series anomaly detection benchmarks. This setting poses two challenges: (1) conditioning masked reconstruction on window-specific semantics without exposing exact numerical targets or anomaly-specific cues, and (2) using a window-independent concept of normality as a complementary semantic reference rather than an independent anomaly detector. We propose LLM-Enhanced Alignment and Reconstruction with Normality Guidance for Time Series (LEARN-TS), which uses a frozen language model to construct two role-separated semantic representations without requiring temporally paired external text. Window-specific observation semantics encode temporal and cross-variable context without exact numerical values to guide channel-shared patch-masked reconstruction. A fixed, dataset-agnostic normality prompt provides a window-independent semantic reference for aligning normal representations and estimating normality discrepancy. At inference, masking each temporal patch once yields timestamp-level reconstruction evidence, conditionally modulated by discrepancy from a separate unmasked view. Across four benchmarks, LEARN-TS achieves the highest mean performance in 13 of 16 dataset-metric comparisons. Controlled ablations examine observation conditioning, joint normality alignment and scoring, and reference content, showing dataset-dependent ranking benefits and modest average gains from semantic over random references.
Jahyeob Koo, Kio Yun, Byoungmo Koo +1
Department of Industrial and Management Engineering, Korea University Seoul, Republic of Korea
Multivariate Time Series Anomaly Detection (MTSAD) is critical for real-world monitoring scenarios such as industrial control and aerospace systems. Mainstream reconstruction-based anomaly detection methods suffer from two key limitations: first, overfitting to spurious correlations induced by an overemphasis on cross-variable modeling; second, the generation of misleading anomaly scores by simply summing up multivariable reconstruction errors, which makes it difficult to distinguish between hard-to-reconstruct samples and genuine anomalies. To address these issues, we propose DBR-AF, a novel framework that integrates a dual-branch reconstruction (DBR) encoder and an autoregressive flow (AF) module. The DBR encoder decouples cross-variable correlation learning and intra-variable statistical property modeling to mitigate spurious correlations, while the AF module employs multiple stacked reversible transformations to model the complex multivariate residual distribution and further leverages density estimation to accurately identify normal samples with large reconstruction errors. Extensive experiments on seven benchmark datasets demonstrate that DBR-AF achieves state-of-the-art performance, with ablation studies validating the indispensability of its core components.
Jun Liu, Ying Chen, Ziqian Lu +2
Zhejiang University, Hangzhou, China · Zhejiang Sci-Tech University, Hangzhou, China