Organizations: the College of Computer Science and Technology, Harbin Engineering University, Harbin 150001, China · the Department of Computer Science, University of Exeter, Exeter, U.K. · the Department of Computer Science, City University of Hong Kong, Hong Kong, China · the Department of Computer Science and Engineering, The American University in Cairo, Egypt · the Department of Computer Science and Engineering, University of Bologna, Italy
Multivariate time series anomaly detection (MTSAD) relies on modeling both temporal dynamics and inter-sensor dependencies to identify complex system faults. Although graph-based detectors explicitly model sensor topologies, they train task-specific networks from scratch on limited target-domain data, remaining vulnerable to spurious correlations and unable to reuse transferable priors. While pretrained Graph Foundation Models (GFMs) offer transferable topological priors and anomaly discriminability, directly adapting them to MTSAD is hindered by cross-modal feature-topology mismatch, unreliable pseudo-anomaly supervision, and decision distortion during node-to-window aggregation. To fill these gaps, we propose a novel adaptation framework, Gfm4Mtsad, which unleashes pretrained GFMs for MTSAD. We introduce the Structure-and-Information Contract Alignment (SICA) module to bridge continuous time series and the pretrained GFM space. This module harmonizes principal subspace token projection, normal-prior-guided graph construction, and residual recovery to suppress spurious edges while retaining fine-grained temporal details. We propose a Mechanism-Aligned Pseudo-Anomaly Screening strategy (MAPS) to steer unsupervised learning. It applies localized dependency breaks while preserving empirical residuals, selecting hard negatives near the normal boundary for targeted supervision. We develop a Tail-Gated Evidence Calibration mechanism (TGEC) to eliminate node-to-window aggregation distortion. It calibrates multi-granular graph responses against normal operational references, strictly preserving benign score rankings while selectively refining extreme anomaly candidates in the tail distribution for reliable window detection and interpretable sensor evidence. Extensive evaluations with two GFM backbones demonstrate that Gfm4Mtsad achieves superior detection performance over existing baselines.
Figures & tables
Fig. 1: Left: Three key challenges in adapting pretrained GFMs to MTSAD and their solutions: (C1) Contract mismatch, addressed by SICA through representation alignment and normal prior routing; (C2) Unreliable supervision, addressed by MAPS through dependency disruption and hard-negative selection; and (C3) Node-window distortion, addressed by TGEC through normality-guided tail calibration. Right: AUROC comparison across three benchmarks against nine representative baselines, where G4M-A and G4M-O instantiate Gfm4Mtsad with pretrained AnomalyGFM and OwlEye backbones.
Fig. 2: Overall architecture of Gfm4Mtsad . At a high level, Gfm4Mtsad adapts a frozen GFM to unsupervised MTSAD, outputting both window-level anomaly scores ( st ) and sensor-level localization evidence ( at ). Specifically, (1) MAPS (left, training only) synthesizes mechanism-aligned hard pseudo-anomalies ( Xt− ) via residual-preserving interventions and multi-criteria screening to provide paired and contrastive supervision; (2) SICA (center) bridges the temporal-topological gap through prior-guided structure alignment, a Token Bridge, and orthogonal IPRA residual compensation while keeping the GFM backbone frozen; and (3) TGEC (right) integrates multi-granularity anomaly evidence via normal-calibrated tail re-ranking, strictly preserving central normal rankings. Flame and snowflake icons denote trainable modules and the frozen backbone, respectively.
Entities
Vars.
Train
Test
Windows
Anom.
MSL P-15
55
3,682
2,856
2,797
80
SMAP T-3
25
2,876
8,579
8,520
302
SMD 1-1
38
28,479
28,479
28,420
3,166
TABLE I: Statistics of the Evaluation Datasets.
Datasets
Metrics
SimCLR
CSI
SSD
AT
DCdetector
CTAD
CARLA
CAROTS
PaAno
G4M -A
G4M -O
(ICML20)
(NIPS20)
(ICLR21)
(ICLR22)
(KDD23)
(TKDE24)
(PR25)
(ICML25)
(ICLR26)
(Ours)
(Ours)
MSL P-15
AUROC
0.5246
0.4659
0.4621
0.3072
0.3909
0.5420
0.6956
0.6592
0.5104
0.8747
0.9246
AUPRC
0.0280
0.0252
0.0255
0.0186
0.0215
0.0293
0.4208
0.0378
0.0271
0.1731
0.6916
F1
0.0947
0.0805
0.0712
0.0569
0.0562
0.1029
0.5405
0.0950
0.0856
0.3318
0.8138
SMAP T-3
AUROC
0.4956
0.5997
0.4543
0.5230
0.4717
0.5439
0.6654
0.4931
0.7923
0.7233
0.7209
AUPRC
0.0650
0.0456
0.0691
0.2267
0.0382
0.0377
0.2841
0.0440
0.3908
0.4120
0.4169
TABLE II: Performance Comparison of MTSAD on Three Benchmark Datasets. The Best and Second-Best Results are Highlighted in Bold and Underlined Text. AT Denotes AnomalyTransformer, G4M-A and G4M-O Denote Gfm4Mtsad Based on AnomalyGFM and OwlEye, Respectively.
Ablation Category and Variant
MSL-O
SMAP-O
SMD-O
AUPRC
F1
AUPRC
F1
AUPRC
F1
Full Model (SICA + MAPS)
0.8131
0.9182
0.4519
0.5283
0.6932
0.6849
SICA
w/ Minimal SICA + MAPS
0.6998
0.8439
0.3408
0.4215
0.2483
0.3232
w/o PCA Bridge Initialization
0.4203
0.6854
0.3928
0.4784
0.6642
0.6344
w/o Normal Graph Prior ( λA=0 )
0.6131
0.7526
—
—
—
—
w/o IPRA Residual Bypass
0.5723
0.8066
0.3410
0.4621
0.4756
0.5506
TABLE III: SICA and MAPS Ablations with the OwlEye Backbone (Native Window AUPRC and F1). Best and Second-Best Results Are Bold and Underlined , Respectively.
Config.
Native
ECDF
Global
Direct-only
TGEC
Act.
SMD-A
0.6275
0.6274
0.5210
0.5198
0.5217
24.07%
SMAP-A
0.4942
0.3835
0.4096
0.3483
0.4112
22.58%
MSL-A
0.4775
0.4795
0.7070
0.5709
0.5709
1.11%
SMD-O
0.6932
0.6894
0.6970
0.6947
0.7015
14.45%
SMAP-O
0.4519
0.4211
0.4424
0.3440
0.4504
9.28%
MSL-O
0.8131
0.8366
0.1230
0.8366
0.8366
0.00%
TABLE IV: Ablation Study of TGEC Scoring Variants Across Six Configurations (AUPRC), where Act. Denotes the Test Tail Activation Rate.
Fig. 4: TGEC on SMD ( Gfm4Mtsad -O): (a) normal distributions and tail gate; (b) evidence medians and IQRs (D/L/R/C: direct/local/relation/context); (c) score mapping; (d) rank changes with the upper tail enlarged (both axes: 0.85–1). Normal/anomalous tail windows: 2,010/2,097. At the normal-q99 threshold, false positives decrease from 918 to 599 (34.7%).
Fig. 5: Tail-mass sensitivity: top, AUPRC; bottom, test-window tail activation. A/O denote Gfm4Mtsad -A/O. The fusion weight is fixed at 0.5. Dashed lines mark the default tail mass of 0.05. Horizontal axes are logarithmic; vertical ranges vary by panel.
Fig. 6: Fusion-weight sensitivity: top, AUPRC; bottom, test-window tail activation. A/O denote Gfm4Mtsad -A/O. The tail mass is fixed at 0.05; dashed lines mark the default fusion weight of 0.5. Vertical ranges vary by panel.
Fig. 7: IPRA rank sensitivity: native AUPRC at validation-selected (top) and final (bottom, epoch 30) checkpoints. Left/right: Gfm4Mtsad -A/O. Dashed lines mark the default rank of 16. All panels share the vertical scale; ranks are spaced logarithmically.
Time-Series Anomaly Detection identifies unusual patterns or events in sequential data, from sensor readings and network traffic to health and industrial telemetry.
Josef Ressel Centre for Intelligent and Secure Industrial Automation, Salzburg University of Applied Sciences, Austria · Department of Artificial Intelligence and Human Interfaces, Paris Lodron University of Salzburg, Austria