ImDiffusion: Imputed Diffusion Models for Multivariate Time Series Anomaly Detection

1 INTRODUCTION

• MTS detection must model heterogeneous, multidimensional, interrelated temporal signals while distinguishing stochastic anomalies from ordinary variability.Data variability can increase uncertainty and lead to erroneous anomaly identification.Source: §1 · pp. 1–2
• Forecasting errors face future uncertainty, while reconstruction depends on modeling the entire sequence and may struggle with heterogeneity and interdependencies.The introduction identifies these limitations as reasons to improve existing approaches.Source: §1 · p. 2
• ImDiffusion uses grating masking to create values for diffusion-based imputation, then treats imputation error as an anomaly indicator.Neighboring values provide conditional information that supports modeling temporal and inter-correlated dependencies and reduces uncertainty.Source: §1 · p. 2
• Step-by-step diffusion denoising outputs provide additional signals for ensemble anomaly prediction, which the authors say improves accuracy and robustness.The approach ensembles signals generated during the imputation inference process.Source: §1 · p. 2
• On 6 datasets, ImDiffusion significantly outperforms 10 state-of-the-art baselines in detection accuracy and timeliness; production detection accuracy is 11.4% higher than the legacy online approach.The production evaluation was in Microsoft's email delivery microservice system.Source: §1 · p. 3
• The authors describe ImDiffusion as a pioneering combination of imputation-based MTS anomaly detection and diffusion models.They present it as the first application of diffusion models to this field.Source: §1 · p. 3

2 RELATED WORK

• The section frames its review around prior research on time-series anomaly detection and diffusion models.Source: §2 · p. 3

2.1 Time Series Anomaly Detection

• Time-series anomaly detection includes forecasting, reconstruction, encoding, distance, distribution, and isolation-tree approaches; ImDiffusion instead uses imputation to improve modeling and detection.Examples of popular forecasting and reconstruction approaches include Omnianomaly, MTAD-GAT, MAD-GAN, and TranAD.Source: §2.1 · p. 3

2.2 Diffusion Model

• Prior diffusion work covers time-series imputation, forecasting, and generation, as well as image anomaly detection; the authors position ImDiffusion as the first diffusion approach tailored to MTS anomaly detection.The cited image applications include medical-image anomaly maps, CT anomaly segmentation, and a one-step reverse-process method.Source: §2.2 · p. 3

3.1 Multivariate Time Series Anomaly Detection

• MTS anomaly detection predicts a binary anomaly label for each timestamp in a sequence of multivariate observations.Each observation is a K-dimensional vector, and the output is a sequence of labels.Source: §3.1 · p. 3

3.2 Time Series Imputation

• Imputation estimates masked, missing values from observed entries in the partially observed time series.The mask has the same dimensionality as the series; interpolation and forecasting are presented as imputation tasks.Source: §3.2 · pp. 3–4

3.3 Denoising Diffusion Model

• Diffusion incrementally adds Gaussian noise to data in a forward process, then uses a learned denoiser to reverse the corruption and reconstruct samples.The denoising function estimates noise added to the corrupted input.Source: §3.3 · p. 4
• The forward process is a Markov chain whose final step is fully corrupted random noise.The transition depends on the preceding step, and the final distribution is expressed in closed form.Source: §3.3 · p. 4

4 THE DESIGN OF IMDIFFUSION

• ImDiffusion self-supervises anomaly detection by masking time-series values, imputing them with a diffusion model, and using intermediate denoising outputs to help determine anomaly labels.The imputed error provides an anomaly signal, and the stepwise outputs are combined during inference.Source: §4 · p. 4

4.1 Imputed Diffusion Models

• Unconditional imputed diffusion uses forward noise, rather than exact unmasked values, as a reference; this preserves a gap between normal and abnormal imputation errors for thresholding.Conditional models can reduce errors around unmasked anomalies, blurring the distinction needed for anomaly detection.Source: §4.1 · p. 5

4.2 Design of Data Masking

• Grating masking creates staggered, complementary masks so every value is imputed, while providing partially reconstructed context and a glimpse of future values.The two mask policies are applied to the same series, and their imputation results are concatenated.Source: §4.2 · pp. 5–6

4.3 Training Process of ImDiffusion

• Training corrupts masked samples with Gaussian noise and trains a denoiser to impute them, using corrupted masked values and forward noise from unmasked regions as input.The model also receives the masking index; its noise predictor is optimized with a DDPM-style loss.Source: §4.3 · p. 6

4.4 Imputation with ImTransformer

• ImTransformer processes feature and temporal dimensions separately with spatial and temporal transformer layers, using attention to model cross-variable and temporal dependencies.Its stacked residual blocks include a residual structure to facilitate gradient propagation.Source: §4.4 · p. 6

4.5 Ensemble Anomaly Inference

• ImDiffusion thresholds imputed errors at each denoising step and votes across stepwise anomaly labels; inference samples every third step among the final 30 steps.The threshold is adjusted using an error-based ratio, and timestamps exceeding the vote threshold are marked anomalous.Source: §4.5 · p. 7

• The evaluation is organized around comparative performance, design effectiveness, and insights from ImDiffusion’s mechanisms.The authors identify these as RQ1, RQ2, and RQ3, respectively.Source: §5 · p. 8

• Experiments cover six public datasets: SMD, PSM, MSL, SMAP, SWaT, and GCP.The authors evaluate all subsets of these datasets rather than selecting only non-trivial sequences.Source: §5.1 · p. 8
• ImDiffusion is benchmarked against ten state-of-the-art detectors spanning isolation, reconstruction, forecasting, graph-based, and other approaches.The listed baselines include IForest, BeatGAN, LSTM-AD, InterFusion, OmniAnomaly, GDN, MAD-GAN, MTAD-GAT, MSCRED, and TranAD.Source: §5.1 · p. 8
• Detection accuracy is measured with precision, recall, and F1, alongside R-AUC-ROC for threshold-independent assessment of range anomalies.R-AUC-ROC uses continuous buffer regions to reduce bias from threshold selection.Source: §5.1 · p. 8
• Average Sequence Detection Delay (ADD) measures the mean delay from each anomalous event’s start to its detection; lower ADD means timelier detection.The evaluation also reports F1 standard deviation across six independent runs to assess stability.Source: §5.1 · p. 8

5.2.1 Accuracy Performance.

• F1 standard deviation is 0.0083 across six runs, ranking second-lowest among approaches and indicating relatively stable performance despite diffusion sampling randomness.The paper attributes this robustness to neighboring-information imputation and ensemble aggregation of step-wise predictions.Source: §5.2.1 · p. 8
• ImDiffusion achieves the highest F1 in five of six datasets and the highest R-AUC-PR in four of six, but TranAD has higher F1 on MSL.The authors attribute MSL’s exception to TranAD’s explicit modeling of inter-metric correlations.Source: §5.2.1 · pp. 8–9
• 92.98% precision, 93.01% recall, 92.84% F1, and 29.86% R-AUC-PR are ImDiffusion’s highest average scores across six datasets.The reported gains over other baselines are at least 2.4% in precision, 4.67% in recall, 3.97% in F1, and 4.85% in R-AUC-PR.Source: §5.2.1 · p. 8, Table 3 · p. 9
• On SWaT and SMAP, ImDiffusion has lower precision than several baselines; the authors link this to overfitting, higher normal-data errors, and false anomalies under a fixed threshold.Dynamic thresholding and reducing ImTransformer complexity are proposed as future-work directions.Source: §5.2.1 · p. 9
• ImDiffusion’s gains are especially large on SMD and PSM, while all approaches perform comparatively worse on SWaT’s intricate, diverse, high-dimensional time series.For SMD and PSM, reported advantages are at least 6.8% and 5.9% in F1, and 6.21% and 2.19% in R-AUC-PR, respectively.Source: §5.2.1 · p. 9

5.2.2 Timeliness Performance.

• ADD averages 104 for ImDiffusion, the lowest average among baselines and at least 39.9% lower than competing approaches.It also outperforms other baselines in four of six datasets on ADD.Source: §5.2.2 · pp. 9–10, Table 4 · p. 10

5.3.1 Imputation vs. Forecasting vs. Reconstruction.

• Imputation outperforms forecasting and reconstruction by at least 3.18% in F1, 1.78% in R-AUC-PR, and 26.2% in ADD on average.It also has the lowest predicted error across datasets; forecasting outperforms reconstruction.Source: §5.3.1 · p. 10, Figure 7 · p. 10, Table 5 · p. 11

5.3.2 Ensembling vs. Non-ensembling.

• Ensembling exceeds non-ensembling by 0.73% in F1 and 6.06% in R-AUC-PR, with 35.8% lower ADD on average.In the SMD example, voting removes false positives that receive fewer than the final eight-vote threshold.Source: Figure 8 · p. 10, §5.3.2 · p. 11, Table 5 · p. 11

5.3.3 Unconditional vs. Conditional Diffusion Models.

• Unconditional diffusion yields 2.1% higher F1 and 21.1% lower ADD than conditional diffusion, while conditional diffusion has a slight R-AUC-PR advantage.The unconditional approach amplifies the predicted-error difference between normal and abnormal data, clarifying the thresholding boundary.Source: §5.3.3 · p. 11, Figure 9 · p. 11, Table 6 · p. 11

5.3.4 Grating Masking vs. Random Masking.

• Grating masking has 8.79% higher R-AUC-PR and an 18.4% ADD gain over random masking, though random masking has 0.4% higher average F1.The authors attribute grating masking’s ADD advantage to envisioning values in windowed masked regions.Source: Table 6 · p. 11, §5.3.4 · p. 12

5.3.5 Components of ImTransformer.

• Removing either ImTransformer component lowers F1 and ADD; removing the spatial transformer hurts more, highlighting the importance of inter-metric correlations, especially in SMAP.Removing the temporal transformer also lowers all metrics, with the largest impact in SMD, where temporal correlations matter.Source: Table 5 · p. 11, Table 6 · p. 11, §5.3.5 · p. 12

6 PRODUCTION IMPACT AND EFFICIENCY

• ImDiffusion operated for four months as a latency monitor in Microsoft’s email-delivery microservices, where latency is sampled every 30 seconds.The system spans more than 600 microservices across 100 datacenters and generates billions of trace data points daily.Source: §6 · p. 12
• 11.4% higher F1 score, 14.4% higher R-AUC-PR, and 30.2% lower ADD than the legacy detector in production.Inference ran at 5.8 data points per second, which the authors say is sufficient for data sampled every 30 seconds.Source: Table 7 · p. 12, §6 · p. 12
• The reported improvements were associated with time savings in incident detection, fewer false alarms, and enhanced system reliability.Source: §6 · p. 12

7 CONCLUSION

• Extensive public-dataset experiments found that ImDiffusion outperformed state-of-the-art baselines in accuracy and timeliness.Source: §7 · p. 12
• In Microsoft’s email-delivery system, ImDiffusion served as a core latency anomaly detector and significantly improved system reliability.Source: §7 · p. 12
• Grating masking supports self-supervised modeling, while multistep diffusion denoising outputs feed an ensemble voting mechanism for anomaly detection.The conclusion describes the framework as the first to apply time-series imputation and diffusion models to anomaly detection.Source: §7 · p. 12
• Absolute values for all metrics are withheld for confidentiality; only relative improvements are reported.Source: §7 · p. 12