PaperlayerView exact revision on arXiv

Source-linked AI summary

TENET: Time-point Encoding Network for Multivariate Time Series Anomaly Detection

Dongchan Cho, Juwon Hwang, Keumyeong Kang, Jiho Han, Namsoon Jung

arXiv:2610.32337v1cs.LGcs.AI

TL;DR

Local variation can make observation-space reconstruction and forecasting errors unreliable indicators of abnormal behavior, and generic latent summaries may not align with point-wise decisions. TENET constructs a current-point system state from variable-level temporal context and scores its compatibility with normality. It achieves state-of-the-art benchmark performance, with results indicating that representation construction contributes to its gains.

  • Problem

    Local variation can inflate reconstruction and forecasting errors, while generic latent representations may not align with the current-point target of point-wise MTSAD.

    Source: §1 · pp. 1–2

  • Method

    TENET constructs a current-point system state by retrieving relevant variable-level history, modeling inter-variable dependencies, and assessing compatibility with a fixed standard-normal NLL score.

    Source: §1 · p. 2, §3.2 · pp. 4–5

  • Results

    TENET achieves state-of-the-art performance across standard MTSAD benchmarks, and diagnostics indicate gains from current-point-centric state construction rather than the scoring objective alone.

    Source: §1 · p. 2, §5 · p. 10

  • Takeaways & Limitations

    The findings suggest that one-class MTSAD benefits from treating the decision target as a time point and designing its latent state around that target.

    Source: §5 · p. 10

    Inter-variable self-attention costs grow with variable count, so larger industrial systems may require more scalable composition modules.

    Source: N Limitations and Future Work · p. 30

Abstract

from arXiv · show

In unsupervised multivariate time series anomaly detection (MTSAD), local variation can inflate reconstruction and forecasting errors, making observation-space discrepancy an unreliable indicator of abnormal system behavior. Since latent-space scoring can mitigate this limitation, we reframe one-class MTSAD as current-point system-state compatibility estimation and propose TENET, the Time-point Encoding Network for Multivariate Time Series Anomaly Detection. We define the current-point system state as a latent representation of the target time point, constructed from variable-level temporal context in the input window. TENET constructs this state through a temporal layer that retrieves window context relative to the current point, encodes time with current-point-centered embeddings, and adaptively mixes the retrieved context with the current representation. With this design, TENET treats the input window not as the object to reconstruct, forecast, summarize, or score, but as context for constructing a latent representation evaluated with a fixed standard-normal negative log-likelihood score. Across benchmark datasets, TENET achieves state-of-the-art performance. Additional experiments further show that TENET remains effective under alternative one-class objectives and outperforms substitutions based on generic sequence encoders, suggesting that its advantage comes from decision-aligned representation construction rather than from a specialized scoring rule. These results indicate that one-class MTSAD can be strong when the latent representation is designed around the current time point.

1 Introduction

Observation-space errors can reflect normal local variation rather than abnormal behavior, while generic latent representations may not align with point-wise detection. TENET instead constructs a current-point system state for compatibility scoring and reports state-of-the-art benchmark results.

1 Introduction

  • Normal local variation, high-frequency fluctuations, or discontinuities can inflate reconstruction and forecasting errors even when the system remains normal.Such mismatch may reflect modeling error rather than an abnormal state, motivating latent one-class scoring.Source: §1 · pp. 1–2
  • One-class objectives evaluate the representation they receive, but generic sequence compression or window-level summaries may misalign that representation with the current-point decision target.The window should provide context for constructing a state that retains history relevant to the current point.Source: §1 · p. 2
  • TENET reformulates one-class MTSAD as compatibility estimation for a current-point system state, retrieving relevant history per variable before modeling inter-variable dependencies and aggregation.Its compatibility is assessed during training and inference using a fixed standard-normal NLL score.Source: §1 · p. 2
  • The paper identifies decision-aligned state construction, rather than increasingly complex raw-space discrepancy modeling, as the central challenge of one-class MTSAD.TENET addresses this by retrieving temporally relevant history relative to the present and composing inter-variable dependencies before compatibility assessment.Source: §1 · p. 2
  • TENET achieves state-of-the-art results across standard MTSAD benchmarks, with diagnostics pointing to current-point-centric state construction rather than the scoring objective alone.The benchmark findings support pairing one-class scoring with decision-aligned representation modeling.Source: §1 · p. 2

2 Related Work

Latent-space anomaly detectors mainly differ in how they shape or score a learned normal state space, while sequence encoders commonly represent sequences or patches. TENET instead uses the current point to query variable-level history before scoring its representation.

2.1 Latent-Space One-Class MTSAD

  • Latent one-class methods vary in their objectives, including compactness, density estimation, and probabilistic modeling, while TENET focuses on constructing the latent state scored for current-point decisions.Examples include Deep SVDD, THOC, DAGMM, and OmniAnomaly.Source: §2.1 · p. 2

2.2 Sequence Encoders for MTSAD

  • Common sequence encoders and recent TSAD models encode sequences or patches, whereas TENET uses the current point to query variable-level history as context for its state.Figure 1 depicts temporal, inter-variable, and aggregation layers, with anchored cross-attention in the temporal block.Source: §2.2 · p. 3, Figure 1 · p. 3

3 Method

TENET treats each window as context for constructing a latent state of its current point, then assesses that state’s compatibility with normal behavior. Its staged encoder retrieves variable-level history, models dependencies across variables, and aggregates the resulting states before applying a fixed one-class score.

3.1 Problem Setup

  • TENET assigns each current point an anomaly score based on its latent state’s compatibility with normal operation, using the window as context rather than as the decision object.Training windows contain normal operation, while test windows may contain unknown anomalies.Source: §3.1 · p. 3

3.2 Model Architecture

  • Variable-specific temporal encoders construct current-point tokens by retrieving history relative to the target, with lag embeddings encoding each position’s distance from it.The current point initializes the evolving anchor, which queries the full window for context.Source: §3.2 · p. 4
  • A gating mechanism adaptively mixes retrieved context with the anchor state before a Transformer-style feed-forward block refines each variable’s token.The gate controls reliance on the anchor versus retrieved history.Source: §3.2 · p. 4
  • Self-attention along the variable dimension contextualizes the current-point token for each variable using information from the other variables.The resulting structured state set preserves one contextualized token per variable and is still intermediate, not the final decision state.Source: §3.2 · p. 5
  • Summation pooling maps contextualized variable-level states into the current-point system state used for anomaly scoring.The design allows variable-level contributions to accumulate so weak deviations distributed across variables can remain visible after pooling.Source: §3.2 · p. 5

3.3 Training and Inference

  • TENET trains on normal windows with a fixed standard-normal reference and uses the same negative log-likelihood compatibility score at inference.Training encourages normal current-point states to lie near the origin; the fixed score has a constant-map global optimum, so the experiments check for ranking preservation without collapse over their finite training duration.Source: §3.3 · p. 5

4 Experiments

Experiments evaluate TENET on four MTSAD benchmarks and compare it with broad baselines, alternative one-class objectives, and component variants. The results favor TENET’s current-point state construction, while geometry, ablation, scalability, and sensitivity analyses characterize its behavior.

4.1 Experimental Setup

  • Experiments use PSM, SMD, SWaT, and SWAN, report A-ROC, A-PR, V-ROC, and V-PR, and average Table 1 metrics over five seeds.Table 1 results are reruns under a shared TAB-based pipeline, while baselines retain recommended hyperparameters and schedules.Source: §4.1 · pp. 5–6, Table 1 · p. 6

4.3 Representation Geometry Analysis

  • On PSM, TENET stabilizes near effective rank ∼69, reaches 31% cumulative EVR in the top 10 components, and achieves 68.6% V-PR using directional information alone.TENET also remains strongest under a norm-only score; broader subspaces alone do not ensure stronger detection.Source: Figure 2 · p. 7, §4.3 · pp. 7–8

4.2 Main Results

  • TENET surpasses reconstruction-, forecasting-, and latent one-class baselines; its V-PR gains include +21.72%pt over OmniAnomaly and +42.16%pt over DAGMM on PSM.It also improves V-PR by +30.02%pt over THOC on PSM and +52.33%pt on SWaT.Source: §4.2 · pp. 6–7, Table 1 · p. 6

4.5 Component Ablation

  • Removing the temporal gate reduces V-PR by −7.3%pt on PSM and −2.9%pt on SWaT; replacing independent variable encoders with one shared encoder lowers PSM V-PR by 41.7%pt.Anchor-centered lag embeddings also outperform standard sinusoidal positions, while cross-variable attention provides more modest refinement.Source: Table 4 · p. 8, §4.5 · pp. 8–9

4.4 Temporal Layer Variation

  • Across four datasets, TENET outperforms LSTM, Dilated RNN, and Mamba temporal-layer substitutions, with Mamba generally the strongest replacement.The comparison supports retrieving temporal context relative to the current point rather than passively compressing it into a generic sequence summary.Source: §4.4 · p. 8, Table 3 · p. 8

4.7 Hyperparameter Sensitivity

  • On SWAN, performance remains stable across a broad range of settings, including window lengths from L = 20 to L = 400 and batch-size changes.Embedding and pooling dimensions have clearer effects, with performance stabilizing at moderate capacity.Source: Figure 3 · p. 9, §4.7 · p. 9

4.6 Computational Scalability

  • For fixed hidden dimension, per-window computation includes O(NL) temporal and O(N^2) inter-variable terms; measured inference latency is more sensitive to variable count than window length.With N = L = 200, parameter storage is 1,394.36 MB and inference adds 5.27 MB over the pre-forward baseline.Source: §4.6 · p. 9, Table 5 · p. 9

5 Conclusion

TENET treats the input window as context for constructing a current-point system state, rather than as an object to reconstruct, forecast, summarize, or score. Its design rationale links detection performance to how that state is constructed before compatibility scoring.

5 Conclusion

  • Across benchmark datasets, TENET performs strongly with a fixed NLL-based compatibility score, and controlled comparisons suggest its advantage comes from decision-aligned state construction rather than a particular scoring rule.The conclusion frames one-class MTSAD around the time-point decision target and designing encoders to construct the state to be scored.Source: §5 · p. 10

A Design Rationale for TENET

  • The fixed standard-normal NLL serves as a simple compatibility interface for isolating the state constructor’s empirical effect, though its loss can admit degenerate constant solutions in principle.The paper evaluates score ordering of abnormal versus normal current-point states rather than requiring recovery of the full normal-state density.Source: A Design Rationale for TENET · p. 14
  • Variable-specific temporal encoders preserve each variable’s patterns before cross-variable composition, though the shared-encoder ablation also changes model capacity.The paper presents the ablation as evidence for, but not complete isolation of, variable-specific specialization.Source: A Design Rationale for TENET · p. 14
  • TENET retrieves history relative to an evolving current-point anchor, uses anchor-centered lag embeddings, and gates retrieved history against the current-anchor path.The components are intended to retain history that helps explain the current point without uniformly accumulating past observations.Source: A Design Rationale for TENET · p. 14
  • After variable-wise temporal construction, cross-variable attention contextualizes the tokens and aggregation maps them to the single state scored by fixed NLL.This staged order means the score is applied to a state built from variable-level retrieval, cross-variable context, and nonlinear set aggregation.Source: A Design Rationale for TENET · p. 14
  • TENET’s state space is less spectrally concentrated than several alternatives and retains anomaly-discriminative information under radial and directional probes.The deployed NLL uses radial magnitude; the directional probe is diagnostic, not part of the detector.Source: A Design Rationale for TENET · p. 14

B Extended-Training Stability

Extended training makes TENET’s pooled states more compact, but the reported diagnostics retain anomaly-ranking information and do not indicate simple low-rank collapse. The appendix also gives implementation pseudocode and summarizes benchmark dataset statistics.

B Extended-Training Stability

  • All four detection metrics improve beyond epoch 10, reach their highest values later, and remain strong during 100-epoch PSM training as pooled states become more compact.The mean state norm and RMS pairwise distance decrease, while the normal–anomalous norm gap remains visible.Source: B Extended-Training Stability · p. 15, Figure S1 · p. 15
  • Effective rank continues to grow and variance remains distributed across many directions, so extended NLL training does not show simple low-rank collapse.The reported changes are mainly compactness-driven scale reduction and latent-state drift while anomaly ranking remains informative.Source: B Extended-Training Stability · p. 15, Figure S1 · p. 15

C Pseudocode

  • The pseudocode transposes minibatches from B×L×N to B×N×L for independent variable encoding and uses raw inference NLL values as anomaly scores without smoothing or point adjustment.Training and inference use the same forward path.Source: C Pseudocode · p. 16

D Datasets

  • Table S1 summarizes benchmark dataset dimensionality, split sizes, anomaly counts, ratios, and segment lengths; its count is the number of contiguous anomalous test-label segments.Segment lengths are computed over those contiguous segments.Source: Table S1 · p. 17

D.1 Dataset Selection

The benchmark selection targets datasets with at least 20 variables and complementary anomaly durations and frequencies, rather than exhaustive domain coverage. The selected datasets vary in dimensionality, anomaly density, and event structure.

D.1 Dataset Selection

  • The benchmark includes real-world datasets with at least 20 variables, selected for complementary anomaly durations and frequencies rather than exhaustive domain coverage.The four datasets are taken from original releases to preserve their train–test splits and sequence boundaries.Source: §D.1 · p. 17

D.2 Dataset Statistics

  • The datasets differ substantially in dimensionality, series length, anomaly density, and temporal structure; Table S1 reports split sizes and test-label segment statistics.Segment lengths are computed over contiguous anomalous segments.Source: §D.2 · p. 17

D.3 Dataset Descriptions

  • PSM combines short spikes and prolonged deviations, SMD machine-1-7 has about 10% anomaly density, and SWaT spans short intervals to extremely long attack segments.SWAN adds thousands of short anomaly segments intermixed with longer events.Source: §D.3 · pp. 17–18, §D.2 · p. 17

D.4 Dataset Sources and Access

  • Dataset access varies: SWaT typically requires a portal request and compliance with access terms, while the listed PSM, SMD, and SWAN sources specify their respective release terms.The source descriptions identify repositories or portals and licensing or attribution conditions.Source: §D.4 · p. 18

E Evaluation Metrics

The evaluation uses raw model scores and threshold-free ranking metrics, reporting both conventional ROC/PR measures and range-aware VUS measures. VUS adds tolerance around anomalous intervals while retaining threshold-free evaluation.

E Evaluation Metrics

  • The evaluation reports AUC-ROC, AUC-PR, VUS-ROC, and VUS-PR as threshold-free measures of anomaly-score ranking.Raw scores are used unless otherwise stated, without post-processing.Source: E Evaluation Metrics · p. 19, Table S2 · p. 19

E.1 AUC-ROC and AUC-PR

  • AUC-ROC and AUC-PR sweep thresholds to measure ranking; both are reported because ROC can be optimistic under rare anomalies, while PR focuses on the positive class.ROC and PR are temporally agnostic, motivating additional range-aware metrics.Source: §E.1 · pp. 19–20

E.2 VUS-ROC and VUS-PR

  • VUS averages ROC or PR surfaces over temporal-tolerance windows, extending anomalous intervals with distance-dependent fractional credit to assess ranking under varying tolerance.The paper reports both VUS-ROC and VUS-PR and keeps implementations fixed across methods.Source: §E.2 · p. 20

F.1 Evaluation Protocol

The evaluation standardizes data handling and metric computation while retaining method-specific settings; results are reported across repeated runs where available. The appendix also specifies the code sources, system configuration, and comparable implementations of four one-class objectives.

F.1 Evaluation Protocol

  • Main benchmark values come from the authors’ reruns, with shared evaluation procedures but original method-specific hyperparameters and scoring rules retained.The protocol differs from TAB’s public configuration in its validation split, sequence handling, train-fitted standardization, and fixed VUS tolerance range.Source: §F.1 · p. 21

F.2 Code Resources

  • Most baselines use the unified TAB codebase, while methods needing dedicated paths use official implementations; the listed OmniAnomaly resource is from KDD 2019.Source: §F.2 · p. 21

G System Configuration

  • TENET experiments use Ubuntu 24.04.3, Python 3.10.19, an NVIDIA RTX PRO 6000 Blackwell GPU, and PyTorch 2.11.0+cu128.The system also includes an AMD Ryzen 9 9950X3D CPU, 91 GiB memory, and CUDA 12.8.Source: G System Configuration · p. 22

H Statistical Significance

  • Run-to-run standard deviations of A-ROC, A-PR, V-ROC, and V-PR are computed over five seeds; lower values indicate greater stability.Chronos has no reported standard deviation because repeated runs were not conducted; TTM, Timer, and GPT4TS are finetuned from released pretrained weights.Source: H Statistical Significance · p. 23, Table S3 · p. 23

I One-Class Objective Configurations

  • All four objectives receive the same pooled state: NLL scores against a fixed standard-normal reference, DeepSVDD uses a fixed center, THOC uses multiple hyperspheres, and DAGMM uses a GMM density.Objective-specific modules and losses differ while the pooled-state interface and main training protocol are kept comparable.Source: I One-Class Objective Configurations · p. 24

J Additional Experiments

Additional experiments test TENET across objectives, Gaussian reference choices, and computational costs, while representation diagnostics probe the geometry and anomaly information of its pooled state.

J.1 Additional Encoder–Objective Comparison

  • On SWAN, TENET leads every reported objective–metric pair, with A-PR exceeding the next-best encoder by more than 13 percentage points under both NLL and DeepSVDD.Together with PSM results, the comparison supports effectiveness beyond the default NLL score.Source: Table S4 · p. 25, §J.1 · p. 25

J.2 Fixed Versus Learnable Gaussian References

  • Learnable Gaussian references show small differences relative to run variation and no consistent advantage, so the authors retain the fixed standard-normal reference for simplicity.TENET also supports learning the reference parameters.Source: §J.2 · p. 25, Table S5 · p. 25

J.3 Cross-Model Computational Cost

  • TENET has the largest parameter storage and higher measured latency, but lower peak training memory than CATCH and CrossAD and higher memory than the other listed baselines.The comparison makes the performance–cost trade-off explicit rather than presenting TENET as uniformly more efficient.Source: Table S6 · p. 26, §J.3 · p. 26

K Representation Geometry Diagnostics

  • State diagnostics inspect covariance geometry through spectrum, effective rank, and explained variance, and test anomaly information through directional and radial scores.The directional score removes radial magnitude; the radial score uses distance from the origin under the fixed standard-normal reference.Source: K Representation Geometry Diagnostics · p. 27

L.1 Training Contamination

TENET is tested against perturbed training windows and noisy current observations. Point-wise training noise produces modest changes, while coherent offsets and larger inference noise are more challenging; the discussion also notes deployment and benchmark-scope cautions.

L.1 Training Contamination

  • Performance drops remain within roughly 1.6%pt of the clean baseline at 20% Gaussian or uniform training perturbation, with similar trends across both noise types.Training windows are replaced by perturbed versions at rates from 0% to 20%; evaluation uses the original test split.Source: §L.1 · p. 28, Figure S2 · p. 28, Figure S3 · p. 28
  • At a 20% constant-offset training perturbation rate, V-PR drops by up to roughly 4.9%pt on SMD and SWaT, while SWAN remains comparatively stable.The offset shifts an entire variable trajectory within a selected window.Source: §L.1 · p. 28, Figure S4 · p. 28

L.2 Current-Point Perturbations at Inference

  • Inference performance changes little at σ = 0.1 but degrades substantially at higher current-point noise, indicating tolerance to small perturbations rather than arbitrary corruption.Noise is added after standardization to each variable of the current observation on PSM, with no retraining.Source: §L.2 · p. 29, Figure S5 · p. 29

M Broader Impacts

  • The authors advise human review, domain-specific thresholds, and post-deployment monitoring, noting that public benchmarks and synthetic robustness tests do not cover every deployment scenario.Calibration should be revisited after changes in sensors, operating policies, or system configuration.Source: M Broader Impacts · p. 30

N Limitations and Future Work

The discussion identifies scaling inter-variable composition and explaining TENET’s effectiveness theoretically as open limitations and directions for future work.

N Limitations and Future Work

  • Inter-variable self-attention cost grows with variable count, so larger industrial systems may need sparse, hierarchical, or graph-constrained composition.The current implementation remains practical for tested regimes; reducing long-history costs is also proposed, but its detection effect remains unevaluated.Source: N Limitations and Future Work · p. 30
  • A deep theoretical explanation for why TENET produces effective anomaly rankings remains open despite evidence across multiple one-class objectives.Source: N Limitations and Future Work · p. 30

Related papers

Loading 2610.32337v1…