Organizations: the College of Computer Science and Technology, Harbin Engineering University, Harbin 150001, China · the Department of Computer Science, University of Exeter, Exeter, U.K. · the Department of Computer Science, City University of Hong Kong, Hong Kong, China · the Department of Computer Science and Engineering, The American University in Cairo, Egypt · the Department of Computer Science and Engineering, University of Bologna, Italy
Multivariate time series anomaly detection (MTSAD) relies on modeling both temporal dynamics and inter-sensor dependencies to identify complex system faults. Although graph-based detectors explicitly model sensor topologies, they train task-specific networks from scratch on limited target-domain data, remaining vulnerable to spurious correlations and unable to reuse transferable priors. While pretrained Graph Foundation Models (GFMs) offer transferable topological priors and anomaly discriminability, directly adapting them to MTSAD is hindered by cross-modal feature-topology mismatch, unreliable pseudo-anomaly supervision, and decision distortion during node-to-window aggregation. To fill these gaps, we propose a novel adaptation framework, Gfm4Mtsad, which unleashes pretrained GFMs for MTSAD. We introduce the Structure-and-Information Contract Alignment (SICA) module to bridge continuous time series and the pretrained GFM space. This module harmonizes principal subspace token projection, normal-prior-guided graph construction, and residual recovery to suppress spurious edges while retaining fine-grained temporal details. We propose a Mechanism-Aligned Pseudo-Anomaly Screening strategy (MAPS) to steer unsupervised learning. It applies localized dependency breaks while preserving empirical residuals, selecting hard negatives near the normal boundary for targeted supervision. We develop a Tail-Gated Evidence Calibration mechanism (TGEC) to eliminate node-to-window aggregation distortion. It calibrates multi-granular graph responses against normal operational references, strictly preserving benign score rankings while selectively refining extreme anomaly candidates in the tail distribution for reliable window detection and interpretable sensor evidence. Extensive evaluations with two GFM backbones demonstrate that Gfm4Mtsad achieves superior detection performance over existing baselines.
Figures & tables
Fig. 1: Left: Three key challenges in adapting pretrained GFMs to MTSAD and their solutions: (C1) Contract mismatch, addressed by SICA through representation alignment and normal prior routing; (C2) Unreliable supervision, addressed by MAPS through dependency disruption and hard-negative selection; and (C3) Node-window distortion, addressed by TGEC through normality-guided tail calibration. Right: AUROC comparison across three benchmarks against nine representative baselines, where G4M-A and G4M-O instantiate Gfm4Mtsad with pretrained AnomalyGFM and OwlEye backbones.
Fig. 2: Overall architecture of Gfm4Mtsad . At a high level, Gfm4Mtsad adapts a frozen GFM to unsupervised MTSAD, outputting both window-level anomaly scores ( st ) and sensor-level localization evidence ( at ). Specifically, (1) MAPS (left, training only) synthesizes mechanism-aligned hard pseudo-anomalies ( Xt− ) via residual-preserving interventions and multi-criteria screening to provide paired and contrastive supervision; (2) SICA (center) bridges the temporal-topological gap through prior-guided structure alignment, a Token Bridge, and orthogonal IPRA residual compensation while keeping the GFM backbone frozen; and (3) TGEC (right) integrates multi-granularity anomaly evidence via normal-calibrated tail re-ranking, strictly preserving central normal rankings. Flame and snowflake icons denote trainable modules and the frozen backbone, respectively.
Entities
Vars.
Train
Test
Windows
Anom.
MSL P-15
55
3,682
2,856
2,797
80
SMAP T-3
25
2,876
8,579
8,520
302
SMD 1-1
38
28,479
28,479
28,420
3,166
TABLE I: Statistics of the Evaluation Datasets.
Datasets
Metrics
SimCLR
CSI
SSD
AT
DCdetector
CTAD
CARLA
CAROTS
PaAno
G4M -A
G4M -O
(ICML20)
(NIPS20)
(ICLR21)
(ICLR22)
(KDD23)
(TKDE24)
(PR25)
(ICML25)
(ICLR26)
(Ours)
(Ours)
MSL P-15
AUROC
0.5246
0.4659
0.4621
0.3072
0.3909
0.5420
0.6956
0.6592
0.5104
0.8747
0.9246
AUPRC
0.0280
0.0252
0.0255
0.0186
0.0215
0.0293
0.4208
0.0378
0.0271
0.1731
0.6916
F1
0.0947
0.0805
0.0712
0.0569
0.0562
0.1029
0.5405
0.0950
0.0856
0.3318
0.8138
SMAP T-3
AUROC
0.4956
0.5997
0.4543
0.5230
0.4717
0.5439
0.6654
0.4931
0.7923
0.7233
0.7209
AUPRC
0.0650
0.0456
0.0691
0.2267
0.0382
0.0377
0.2841
0.0440
0.3908
0.4120
0.4169
TABLE II: Performance Comparison of MTSAD on Three Benchmark Datasets. The Best and Second-Best Results are Highlighted in Bold and Underlined Text. AT Denotes AnomalyTransformer, G4M-A and G4M-O Denote Gfm4Mtsad Based on AnomalyGFM and OwlEye, Respectively.
Ablation Category and Variant
MSL-O
SMAP-O
SMD-O
AUPRC
F1
AUPRC
F1
AUPRC
F1
Full Model (SICA + MAPS)
0.8131
0.9182
0.4519
0.5283
0.6932
0.6849
SICA
w/ Minimal SICA + MAPS
0.6998
0.8439
0.3408
0.4215
0.2483
0.3232
w/o PCA Bridge Initialization
0.4203
0.6854
0.3928
0.4784
0.6642
0.6344
w/o Normal Graph Prior ( λA=0 )
0.6131
0.7526
—
—
—
—
w/o IPRA Residual Bypass
0.5723
0.8066
0.3410
0.4621
0.4756
0.5506
TABLE III: SICA and MAPS Ablations with the OwlEye Backbone (Native Window AUPRC and F1). Best and Second-Best Results Are Bold and Underlined , Respectively.
Config.
Native
ECDF
Global
Direct-only
TGEC
Act.
SMD-A
0.6275
0.6274
0.5210
0.5198
0.5217
24.07%
SMAP-A
0.4942
0.3835
0.4096
0.3483
0.4112
22.58%
MSL-A
0.4775
0.4795
0.7070
0.5709
0.5709
1.11%
SMD-O
0.6932
0.6894
0.6970
0.6947
0.7015
14.45%
SMAP-O
0.4519
0.4211
0.4424
0.3440
0.4504
9.28%
MSL-O
0.8131
0.8366
0.1230
0.8366
0.8366
0.00%
TABLE IV: Ablation Study of TGEC Scoring Variants Across Six Configurations (AUPRC), where Act. Denotes the Test Tail Activation Rate.
Fig. 4: TGEC on SMD ( Gfm4Mtsad -O): (a) normal distributions and tail gate; (b) evidence medians and IQRs (D/L/R/C: direct/local/relation/context); (c) score mapping; (d) rank changes with the upper tail enlarged (both axes: 0.85–1). Normal/anomalous tail windows: 2,010/2,097. At the normal-q99 threshold, false positives decrease from 918 to 599 (34.7%).
Fig. 5: Tail-mass sensitivity: top, AUPRC; bottom, test-window tail activation. A/O denote Gfm4Mtsad -A/O. The fusion weight is fixed at 0.5. Dashed lines mark the default tail mass of 0.05. Horizontal axes are logarithmic; vertical ranges vary by panel.
Fig. 6: Fusion-weight sensitivity: top, AUPRC; bottom, test-window tail activation. A/O denote Gfm4Mtsad -A/O. The tail mass is fixed at 0.05; dashed lines mark the default fusion weight of 0.5. Vertical ranges vary by panel.
Fig. 7: IPRA rank sensitivity: native AUPRC at validation-selected (top) and final (bottom, epoch 30) checkpoints. Left/right: Gfm4Mtsad -A/O. Dashed lines mark the default rank of 16. All panels share the vertical scale; ranks are spaced logarithmically.
Time-Series Anomaly Detection identifies unusual patterns or events in sequential data, from sensor readings and network traffic to health and industrial telemetry.
Multivariate Time Series Anomaly Detection (MTSAD) is essential for reliability and safety in domains such as industrial process monitoring and financial risk management, yet conventional approaches rely on application-specific models that are costly to train and hard to scale. Foundation Models (FMs), pre-trained on broad data with strong zero-shot generalization, have recently become available for univariate time series forecasting, raising the question of whether they can address MTSAD without task-specific training. We investigate the zero-shot application of a univariate forecasting FM, TimesFM, to industrial MTSAD on the Secure Water Treatment (SWaT) benchmark, evaluating two strategies: treating the FM as a per-feature forecaster with thresholded prediction errors, and as an embedder whose intermediate representations feed standard outlier detectors. Neither of our proposed setups is competitive with established baselines; embeddings reveal only partial separation between normal and anomalous segments, insufficient for reliable detection. The cause is that the FM is too effective at capturing temporal dynamics, yielding low error even within fully anomalous windows, so persistent anomalies become indistinguishable from normal behavior. However, these observations yield valuable insights: the error peaks at anomaly boundaries, indicating FMs reliably detect distribution changes. We conclude that the proposed naive zero-shot FMs are unsuitable for MTSAD but promising for change-point detection.
Martin Uray, Saverio Messineo, Roland Kwitt +1
Josef Ressel Centre for Intelligent and Secure Industrial Automation, Salzburg University of Applied Sciences, Austria · Department of Artificial Intelligence and Human Interfaces, Paris Lodron University of Salzburg, Austria
Multivariate time-series anomaly detection is essential for reliable industrial control, telemetry, and service monitoring. However, the evolving inter-variable dependencies and inevitable noise render it challenging. Existing methods often use single-scale graphs or instance-level contrast. Moreover, learned dynamic graphs can overfit noise without a stable anchor, causing false alarms or misses. To address these challenges, we propose the CGSTA framework with two key innovations. First, Dynamic Layered Graph Construction (DLGC) forms local, regional, and global views of variable relations for each sliding window; rather than contrasting whole windows, Contrastive Discrimination across Scales (CDS) contrasts graph representations within each view and aligns the same window across views to make learning structure-aware. Second, Stability-Aware Alignment (SAA) maintains a per-scale stable reference learned from normal data and guides the current window's fast-changing graphs toward it to suppress noise. We fuse the multi-scale and temporal features and use a conditional density estimator to produce per-time-step anomaly scores. Across four benchmarks, CGSTA delivers optimal performance on PSM and WADI, and is comparable to the baseline methods on SWaT and SMAP.
Zhongpeng Qi, Jun Zhang, Wei Li +1
Dalian Maritime University, Dalian, China · Harbin Engineering University, Harbin, China
Anomaly detection in multivariate time series (MTS) is hindered by dynamic inter-variable dependencies and feature entanglement under spectral noise, and in practice, is further complicated by the absence of anomaly labels. Existing reconstruction-based detectors tend to recover anomalies as faithfully as normal patterns, while prevailing graph contrastive methods enforce invariance across views and thus assume a stationary relational structure, an assumption that breaks under structural drift in real systems. We propose ContrastAD, an unsupervised framework that turns structural evolution itself into a learning signal rather than suppressing it. A Multi-Perspective Embedder encodes inputs from temporal, attribute, and structural perspectives. A Frequency-Aware Attention Mixer then performs spectral top-K filtering before attention, preventing noise from leaking into query-key similarities. The core component, a Dynamic Graph Contrastive Learner, builds power-law-inspired sparse graph snapshots from batch-level DTW distances and contrasts the most divergent pair against a stable anchor, regularizing the latent space without imposing rigid invariance. Across five real-world benchmarks, ContrastAD attains the highest mean F1 on all five datasets and the highest AUC on three (SWaT 93.60, SMD 98.66, PSM 97.79), with statistically significant F1 and AUC margins over the strongest baseline on SWaT and PSM. On MSL and SMAP, it trails the AUC leader by under 0.7 points while still leading on F1. Ablation and sensitivity studies further confirm that the contrastive objective works best as a soft regularizer, supporting our claim that strict invariance is suboptimal under non-stationary dynamics.
Yunhua Pei, Zixing Song, Jin Zheng +1
School of Computer Science, University of Bristol, Bristol, UK · School of Engineering Mathematics, University of Bristol, Bristol, UK