PaperlayerView exact revision on arXiv

Source-linked AI summary

MORA: Modeling Observed Changes for Drift-Robust Time-Series Anomaly Detection

Xudong Mou, Tiejun Wang, Rui Wang, Hui Wang, Pin Liu, Tianyu Wo, Xudong Liu, Renyu Yang

arXiv:2610.09473v1cs.LGcs.AI

TL;DR

In non-stationary time series, drift and genuine anomalies can both appear as deviations from learned normality, making their interpretation difficult. MORA compares reconstructions of the same local target from short- and long-term views and uses contextual reconstruction advantage to adjust the local score. Experiments on four TSAD benchmarks show strong and consistent performance.

  • Problem

    Drift and genuine anomalies can both appear as deviations from learned normality, making it difficult to determine whether a local change reflects abnormality or evolving context.

    Source: §1 · p. 1, §3.1 · p. 2

  • Method

    MORA reconstructs the same local target from short- and long-term views and uses a data-dependent, one-sided correction to reduce the local score only when context improves reconstruction.

    Source: §1 · p. 2, §3.2.4 · p. 4, Conclusion · p. 7

  • Results

    Experiments on four TSAD benchmarks demonstrate strong and consistent performance, with MORA achieving the best average rank and placing first or second on RPA-F1 across all datasets.

    Source: §4.2 · p. 5, Conclusion · p. 7

  • Takeaways & Limitations

    MORA uses temporal context as corrective evidence while retaining local anomaly evidence when broader context provides no reconstruction improvement.

    Source: §1 · p. 2, Conclusion · p. 7

    Long-term windows may contain irrelevant history, mixed regimes, or abrupt shifts weakly related to the current observation, so contextual reconstruction improvement can still be unreliable.

    Source: §3.2.4 · p. 3

Abstract

from arXiv · show

Time-series anomaly detection (TSAD) identifies deviations from patterns learned from historical data. In non-stationary settings, distribution drift and true anomalies can cause similar local changes, making it difficult to tell whether a deviation reflects abnormality or evolving context. Existing methods typically adapt to detected shifts or learn drift-insensitive representations, but do not resolve this ambiguity. We define this problem as \emph{temporal change disambiguation}: determining whether a local deviation is explained by broader temporal evolution. We introduce MORA, a drift-robust TSAD framework that reconstructs the same local target from paired short- and long-term views. The reconstruction gap measures contextual support for a local deviation, and a data-dependent correction mechanism conservatively adjusts the primary local anomaly score. Context can only reduce the score when it improves reconstruction of the same target. MORA needs neither drift annotations nor online adaptation. Experiments on four TSAD benchmarks show strong robustness to non-stationarity while preserving sensitivity to genuine anomalies.

1. Introduction

Under non-stationarity, normal drift and genuine anomalies can both appear as deviations from learned normality, leaving their meaning ambiguous. MORA uses broader temporal context to interpret local changes while retaining local anomaly evidence.

1. Introduction

  • Normal drift can receive high anomaly scores, while reacting to every change risks false alarms or treating regime shifts as anomalies.Seasonality, workload fluctuations, sensor aging, maintenance, and upgrades can change both observation marginals and temporal dependencies.Source: §1 · p. 1
  • Existing methods detect and adapt to shifts or learn drift-robust representations, but leave drift–anomaly ambiguity implicit.Detect-and-adapt approaches depend on accurate shift detection and may absorb anomalies into normality; drift-insensitive representations risk suppressing changes that resemble anomalies.Source: §1 · pp. 1–2
  • The paper frames temporal change disambiguation as interpreting a local change using its broader trajectory rather than treating it as anomalous by default.A change may be ambiguous in isolation but meaningful in context, much as linguistic context resolves an ambiguous word.Source: §1 · p. 2
  • MORA reconstructs the same local target from short- and long-term views and uses their error gap as contextual evidence to adjust the local anomaly score.A heterogeneous cross-view router sets correction strength, and a one-sided rule permits reduction only when context improves reconstruction.Source: §1 · p. 2
  • MORA treats local observations as primary anomaly evidence and temporal context as corrective evidence, suppressing only context-explainable deviations.The correction otherwise preserves the local anomaly evidence.Source: §1 · p. 2

2. Related Work

The related work spans methods for modeling normality and approaches to non-stationarity. MORA differs by using broader temporal context to judge whether a local deviation is explainable.

2.1. Time Series Anomaly Detection

  • Unsupervised TSAD methods model normality through reconstruction or forecasting, one-class or calibrated scoring, and stronger temporal modeling.Other approaches combine multiple normality hypotheses or explicitly model normal and anomalous data; multi-scale designs also inform MORA’s motivation.Source: §2.1 · p. 2
  • MORA retains original temporal resolution and reconstructs an identical local target under nested temporal contexts, using error reduction to correct the primary anomaly score.This differs from CrossAD, which reconstructs fine-grained series from downsampled coarse scales to model cross-scale associations.Source: §2.1 · p. 2

2.2. Drift-Robust Anomaly Detection

  • Drift-robust methods adapt detectors after shift detection or seek robust scoring and representations, but often do not explicitly disambiguate drift-like changes from anomalies.Other approaches calibrate scores with reference windows or robust statistics, or suppress drift through decomposition.Source: §2.2 · p. 2

3.1. Problem Definition

Under non-stationarity, a normal drifting observation and a genuine anomaly can both deviate from learned normality. The problem definition distinguishes them by whether broader temporal context makes the local observation plausible.

3.1. Problem Definition

  • A normal observation under drift may appear unlikely under a time-invariant reference distribution and receive a high anomaly score.The problem definition identifies this shared appearance as a fundamental ambiguity between drift and genuine anomalies.Source: §3.1 · p. 2
  • A drifting observation may remain plausible given broader temporal context, whereas a genuine anomaly remains implausible even with that context.The objective is to suppress contextually explainable distributional changes while preserving high responses to contextually unexplained deviations.Source: §3.1 · p. 2

3.2. MORA’s Approach

MORA treats a local deviation as ambiguous and uses broader temporal context to assess whether it is explainable. It compares reconstructions of the same local target and applies a conservative, learned score correction.

3.2.1 Overview.

  • MORA treats local changes as potentially abnormal or coherent transitions, using the local view for primary anomaly evidence and context as corrective evidence.A shared encoder feeds two reconstruction experts that score the same local target; cross-view probes then guide one-sided score correction.Source: §3.2.1 · p. 3

3.2.2 Encoding.

  • The shared encoder maps paired short and longer windows into a common latent space, with the short view emphasizing immediate behavior and localized deviations.The windows share an endpoint, and the same local target is evaluated under short-view and context-augmented conditions.Source: §3.2.2 · p. 3

3.2.3 Context-Contrasted

  • The contextual reconstruction error measures how well longer history explains the same short-window target relative to the local reconstruction.A large local error with a lower contextual error indicates contextual explainability; high errors under both views indicate difficulty explaining the observation under either view.Source: §3.2.3 · p. 3

3.2.4 Cross-View Probe.

  • Four probes predict local reconstruction difficulty from different views, and their cross-view discrepancies plus the local score inform the correction router.The views represent contextual evidence, local evidence, signed change, and change magnitude; the data-dependent weight controls subtraction of the positive reconstruction gap.Source: §3.2.4 · p. 4

3.2.5 Conservative Scoring.

  • The positive reconstruction gap is treated as potentially explainable, so context can reduce the local score only when it improves reconstruction of the same target.If contextual reconstruction is not better, the local score is unchanged; otherwise, an adaptively weighted fraction of the gap is subtracted.Source: §3.2.5 · p. 4

3.2.6 Learning Objective.

  • MORA trains without point-wise anomaly or drift supervision, combining a reference-data score objective, reconstruction regularization, and probe supervision.The four heads predict the same local reconstruction difficulty from different latent views, aligning their output scales while retaining cross-view differences for routing.Source: §3.2.6 · p. 4

4. Experiments

Experiments evaluate MORA on four multivariate benchmarks, where it achieves the best average rank and remains strong across ablations, temporal scales, and shift conditions. The analyses show how local and contextual views contribute to conservative score correction and how that correction behaves around events.

4.1. Experimental Setup

  • Evaluation covers SMD, Exathlon, ESA, and ASD, using Best RPA-F1, VUS-ROC, and VUS-PR; PSI > 0.25 is treated as a large train–test discrepancy.Models are evaluated with five independent random seeds.Source: §4.1 · pp. 4–5

4.2. Main Results

  • MORA achieves the best average rank, placing first or second in RPA-F1 across all four benchmarks and in the top two on 9/12 dataset–metric combinations.It leads all three metrics on SMD and ranks first on RPA-F1 and VUS-ROC on Exathlon.Source: §4.2 · p. 5, Table 2 · p. 5

4.3. Ablation Study

  • 67.99% to 66.32% RPA-F1 and 87.15% to 85.21% VUS-PR: naive weighted fusion underperforms the proposed one-sided correction.The gap is most evident on Exathlon; the results support suppressing only the explainable portion of local abnormality rather than indiscriminately fusing views.Source: §4.3 · p. 6, Table 3 · p. 6
  • Removing the local branch drops average F1 from 67.99% to 59.26%, while removing context causes a smaller but consistent decline.The context-only variant performs best on ESA but is weaker on other datasets, so context alone is insufficient across benchmarks.Source: §4.3 · p. 6, Table 3 · p. 6
  • A single probe lowers average RPA-F1 from 67.99% to 66.49% and VUS-PR from 87.15% to 85.39%; homogeneous heads yield 66.11% and 85.52%, respectively.The complete heterogeneous design achieves the best averaged result on every metric.Source: §4.3 · p. 6, Table 3 · p. 6

4.4. Sensitivity Analysis

  • Best window pairs vary by dataset—(16, 320) on SMD and (32, 128) on ESA—while SMD is more sensitive to λ, η, and ρ than ASD, where ρ is nearly flat.Fine local windows and longer context help capture short-lived deviations and explain gradual changes; auxiliary terms matter most when temporal changes are prominent.Source: §4.4 · pp. 6–7, Figure 3 · p. 6, Figure 4 · p. 7

4.5. Correction Behavior Analysis

  • Correction depends jointly on router response and positive reconstruction gap; performance remains stable or improves in higher-PSI groups on SMD and Exathlon.Corrections can affect normal and anomalous windows, but the one-sided rule bounds corrected scores between contextual and local reconstruction errors; the shift-stratified results are not causal estimates.Source: §4.5 · p. 7, Figure 5 · p. 7, Figure 6 · p. 7

4.6. Visualization and Case Study

  • On SMD, MORA attenuates persistent post-event score responses during signal recovery while leaving dominant anomaly peaks intact, particularly near t ≈160.Within labeled anomaly intervals, corrections remain small relative to the substantially larger local scores.Source: §4.6 · p. 7, Figure 7 · p. 7

Conclusion

MORA treats local deviations as evidence to interpret against broader temporal evolution, using contextual reconstruction advantage to correct the local anomaly score. Across four TSAD benchmarks, it demonstrates strong and consistent performance.

Conclusion

  • Across four TSAD benchmarks, MORA demonstrates strong and consistent performance.The conclusion suggests temporal context is more effective as constrained corrective evidence than as an additional anomaly score to fuse.Source: Conclusion · p. 7
  • MORA reconstructs the same local target from short- and long-term views, using contextual reconstruction advantage for one-sided correction of the primary local score.Heterogeneous cross-view cues adapt correction strength, while local evidence is retained when broader context provides no reconstruction improvement.Source: Conclusion · p. 7
  • The conclusion proposes adaptive longer-range context selection, ambiguity-aware correction routing, cross-variable shift modeling, and integration with broader TSAD backbones as extensions.Source: Conclusion · p. 7

Related papers

Loading 2610.09473v1…