# Mamba Adaptive Anomaly Transformer with association discrepancy for time series

Abdellah Zakaria Sellam, Ilyes Benaissa, Abdelmalik Taleb-Ahmed, Luigi Patrono, Cosimo Distante

<figure><img src="image_1.png" /></figure>

## ► To cite this version:

Abdellah Zakaria Sellam, Ilyes Benaissa, Abdelmalik Taleb-Ahmed, Luigi Patrono, Cosimo Distante. Mamba Adaptive Anomaly Transformer with association discrepancy for time series. Engineering Applications of Artificial Intelligence, 2025, 160, 10.1016/j.engappai.2025.111685. [hal-05215062]

HAL Id: hal-05215062

https://hal.science/hal-05215062v1

Submitted on 19 Aug 2025

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

<figure><img src="image_2.png" /></figure>
<figure><img src="image_3.png" /></figure>

Research paper

# Mamba Adaptive Anomaly Transformer with association discrepancy for time series

Abdellah Zakaria Sellam<sup>a,d ID</sup>, Ilyes Benaissa<sup>b,a ID</sup>, Abdelmalik Taleb-Ahmed<sup>c</sup>, Luigi Patrono<sup>a,d ID</sup>, Cosimo Distante<sup>a,d ID,*</sup>

## ARTICLE INFO

Keywords:

Transformer
Association discrepancy
Gated attention
Mamba state space model
Sparse attention
Anomaly detection
Unsupervised learning

## ABSTRACT

Anomaly detection in time series poses a critical challenge in industrial monitoring, environmental sensing, and infrastructure reliability, where accurately distinguishing anomalies from complex temporal patterns remains an open problem. While existing methods, such as the Anomaly Transformer leveraging multi-layer association discrepancy between prior and series distributions and Dual Attention Contrastive Representation Learning architecture (DCdetector) employing dual-attention contrastive learning, have advanced the field, critical limitations persist. These include sensitivity to short-term context windows, computational inefficiency, and degraded performance under noisy and non-stationary real-world conditions. To address these challenges, we present MAAT (Mamba Adaptive Anomaly Transformer), an enhanced architecture that refines association discrepancy modeling and reconstruction quality for more robust anomaly detection. Our work introduces two key contributions to the existing Anomaly transformer architecture: Sparse Attention, which computes association discrepancy more efficiently by selectively focusing on the most relevant time steps. This reduces computational redundancy while effectively capturing long-range dependencies critical for discerning subtle anomalies. A Mamba-Selective State Space Model (Mamba-SSM) is also integrated into the reconstruction module. A skip connection bridges the original reconstruction and the Mamba-SSM output, while a Gated Attention mechanism adaptively fuses features from both pathways. This design balances fidelity and contextual enhancement dynamically, improving anomaly localization and overall detection performance. Extensive experiments on benchmark datasets demonstrate that MAAT significantly outperforms prior methods, achieving superior anomaly distinguishability and generalization across diverse time series applications. By addressing the limitations of existing approaches, MAAT sets a new standard for unsupervised time series anomaly detection in real-world scenarios. Code available at https://github.com/ilyesbenaissa/MAAT.

## 1. Introduction

Anomaly detection in time series data is critical in finance, healthcare, industrial monitoring, and cybersecurity to prevent failures, detect fraud, and ensure efficiency. Traditionally, methods like ARIMA (Box and Jenkins, 1970) and Gaussian Processes (Rasmussen and Williams, 2006) have been used to identify abnormal events in sequential data. Which relies on the assumption that anomalies can be identified as deviations from predicted values. However, these methods often struggle with real-world time series data of a complex, high-dimensional nature, especially when the underlying patterns are non-linear or when the anomalies are subtle (Box et al., 2015).

Machine learning introduced advanced models like Support Vector Machines (SVMs) (Scholkopf et al., 2000), Random Forests (Rabiner and Juang, 1986), and Hidden Markov Models (HMMs) (Hochreiter and Schmidhuber, 1997) were among the first machine learning methods applied for time series anomaly detection, improving on traditional methods by learning from data. However, they still required extensive feature engineering and often missed complex temporal dependencies. Deep learning models such as Recurrent Neural Networks (RNNs) (Radford et al., 2018), and Long Short-Term Memory (LSTM) (Malhotra et al., 2016) revolutionized time series anomaly

<footnote><sup>a</sup> Department of Innovation Engineering, University of Salento, via Monteroni, Lecce, 73100, Italy</footnote>

<footnote><sup>b</sup> VSC Laboratory, Department of Electrical Engineering, University of Mohamed Khider Biskra, Biskra, 07000, Algeria</footnote>

<footnote><sup>c</sup> Institute d'Electronique de Microelectronique et de Nanotechnologie (IEMN), UMR 8520, Universite Polytechnique Hauts de France, Universite de Lille, CNRS, Valenciennes, 59313, France</footnote>

<footnote><sup>d</sup> Institute of Applied Sciences and Intelligent Systems - CNR, via Monteroni, Lecce, 73100, Italy</footnote>

<footnote>* Corresponding author at: Institute of Applied Sciences and Intelligent Systems - CNR, via Monteroni, Lecce, 73100, Italy.
E-mail address: cosimo.distante@cnr.it (C. Distante).</footnote>
detection by capturing long-term dependencies and complex temporal patterns, ideal for identifying subtle deviations (Hochreiter and Schmidhuber, 1997). Additionally, the use of autoencoders and their variants, such as Variational Autoencoders (VAEs) (Xu et al., 2018) and Adversarial Autoencoders (Somepalli et al., 2021), has further advanced the field by enabling unsupervised anomaly detection through the reconstruction of standard data patterns (Kingma and Welling, 2013). Reconstruction-based methods, like autoencoders (Malhotra et al., 2016), model standard data patterns and detect anomalies through reconstruction errors, leveraging their ability to learn compressed representations (Hinton and Salakhutdinov, 2006). Similarly, recurrent neural networks (RNNs) and long short-term memory (LSTM) networks have been employed to capture temporal dependencies in sequential data during reconstruction tasks (Malhotra et al., 2016). However, reliance on reconstruction loss can cause false positives for anomalies resembling standard data. Transformers (Vaswani et al., 2017), with self-attention mechanisms, address this by modeling complex dependencies in time series (Benali et al., 2024). Enhancements like gated attention (Zhang et al., 2023), for instance, integrate gating structures to dynamically control the flow of information, enabling the model to focus on relevant temporal features and improve performance in time series forecasting tasks. Sparse attention (Guo et al., 2024) mechanisms have also been introduced to improve the efficiency of Transformers when handling long sequences. By limiting the attention computation to a subset of the input sequence, sparse Attention reduces computational complexity while maintaining the ability to capture essential dependencies. This approach is particularly beneficial for long-sequence time-series forecasting, where traditional attention mechanisms may become computationally prohibitive. Recent advancements include the Anomaly Transformer (Xu et al., 2022), which uses association discrepancy learning to differentiate normal from abnormal points without relying solely on reconstruction loss. It employs Gaussian kernels and attention mechanisms to model prior- and series-association discrepancies, improving accuracy while addressing scalability in high-dimensional datasets. Despite achieving state-of-the-art performance through a minimax strategy, it faces limitations: self-attention struggles with long-range dependencies in small windows, and noise or non-stationary patterns can increase false positives during normal fluctuations. While more efficient than traditional methods, these challenges remain. Furthermore, DCdetector (Yang et al., 2023b) simplifies anomaly detection with a dual-attention contrastive structure, eliminating complex components like Gaussian kernels or reconstruction losses. It uses contrastive learning to separate anomalies from expected points, capturing global and local dependencies through a dual-channel architecture. Its channel-independent patching reduces parameter complexity and overfitting risks, while a contrastive loss function based on Kullback-Leibler divergence enhances representation consistency. However, DCdetector faces challenges, including sensitivity to contrastive sample quality, high computational overhead from pairwise comparisons, and dual-branch parallelism. Building upon these foundations, we propose MAAT (Mamba Adaptive Anomaly Transformer with association discrepancy for time series) for anomaly detection in time series. Our approach introduces a novel block architecture that incorporates skip connections and gating mechanisms in association with the mamba block in the skip connection to improve the reconstruction capability of the anomaly transformer architecture. By combining these architectural enhancements with sparse attention mechanisms and anomaly Transformer association modeling principles, MAAT performs better in detecting anomalies across diverse datasets. The Key contributions of this work are summarized as follows:

* integrated sparse attention mechanisms to replace the standard attention mechanism in the original Anomaly Transformer, allowing scalable and efficient processing of long time series data. By enabling dynamic control over block size, MAAT achieves an optimal balance between computational efficiency and precision in anomaly detection.

* Introduced the MAMBA block to the Anomaly Transformer architecture to optimize the reconstruction of signals.
* Incorporated the MAMBA block with skip connections and gating Attention to enhance the reconstruction output and reduce the loss of the Anomaly Transformer architecture.

The subsequent sections of this document are structured as follows: Section 2 presents a comprehensive overview of relevant works, including literature and methodologies, related to time series anomaly detection. Section 3 delves into our proposed MAAT architecture, detailing its unique features and potential benefits. In Section 4, we conduct Experiments, perform data analysis, and provide a thorough evaluation of our model. Lastly, in Section 5, we draw insightful conclusions based on the following: In our experimentation, we compare our approach with prior methodologies and articulate the implications of our findings. This structure ensures a coherent and comprehensive understanding of our innovative methodology for unsupervised anomaly detection in time series data.

## 2. Related works

Time series anomaly detection has evolved from traditional statistical models like ARIMA and Gaussian Processes (Box et al., 2015; Rasmussen and Williams, 2006). Conventional methods like ARIMA and GP struggled with non-linear and high-dimensional data. Machine learning introduced more flexible approaches, such as (SVMs), particularly One-Class SVM (OC-SVM), which excel in novelty detection by defining a boundary around standard data and identifying outliers as anomalies (Scholkopf et al., 2000). Despite this improvement, SVMs could not capture temporal dependencies inherent in sequential data. Random Forests and Isolation Forests handled high-dimensional data better than SVMs, while Isolation Forests identified anomalies by isolating points through recursive partitioning (Liu et al., 2008). However, they focused on anomalies and were not optimized for capturing time dependencies in sequential data. RNNs and LSTMs became popular due to their ability to capture long-term dependencies in time series data. These models excelled in detecting anomalies in healthcare (e.g., ECG data) and finance (Distante et al., 2022). However, RNNs and LSTMs face limitations in scalability and can struggle with vanishing gradient problems when processing long sequences. Variational Autoencoders (VAEs) became central to unsupervised anomaly detection by reconstructing standard data patterns and flagging high-reconstruction errors as anomalies (Kingma and Welling, 2013). Adversarial Autoencoders (AAEs) and Generative Adversarial Networks (GANs) enhanced robustness through adversarial training. GANs use a generator-discriminator framework to detect anomalies based on realistic data generation. However, both GANs and AEs require large datasets and can face instability, limiting their application in some domains (Schlegl et al., 2019; Li et al., 2019). Transformer-based models have recently demonstrated significant potential in time series anomaly detection by leveraging self-attention mechanisms to capture long-range dependencies (Vaswani et al., 2017). Initially developed for NLP, these models eliminate the need for recurrent structures like RNNs or LSTMs, effectively modeling local and global patterns in time series data to detect anomalies. Transformer-based models have revolutionized time series anomaly detection, with innovations like the Anomaly Transformer introducing Association Discrepancy to compare expected and observed associations in data. Using a minimax strategy enhances the distinguishability of anomalies, outperforming prior methods across datasets (Xu et al., 2022). Similarly, AnomalyBERT employs self-supervised learning and data degradation to simulate anomalies, improving generalization without labeled data (Jeong et al., 2023). The Denoising Diffusion Mask Transformer (DDMT) integrates denoising diffusion with masking mechanisms, excelling in noisy multivariate settings (Yang et al., 2023a). Multivariate anomaly detection has also advanced with models like Informer (Zhou et al., 2021) and multi-task Transformers, which
leverage attention mechanisms to model interdependencies among variables (Zhang et al., 2021). Hybrid models combining statistical methods with deep learning enhance interpretability while maintaining flexibility. These developments address the limitations of classical met techniques as ARIMA, which struggled with high-dimensional, non-stationary data. As the field progressed, deep learning frameworks began to emerge. In 2021, the **Anomaly Transformer** (Xu et al., 2022) introduced a novel anomaly-attention mechanism that quantifies the association discrepancy between normal and abnormal points. While this approach effectively leverages self-attention to capture both local and global temporal dependencies in an unsupervised manner, its quadratic complexity poses challenges for scalability, and its underlying assumptions may not hold across all types of anomalies. Building on these advances, the **DC Detector** (Yang et al., 2023b) employs a dual attention contrastive representation learning framework. Integrating local and global Attention with a contrastive loss overcomes some of the pitfalls of reconstruction-based methods. Nonetheless, the additional architectural complexity and the need for extensive hyper-parameter tuning remain nontrivial hurdles. Concurrently, selective state space models have gained traction for their efficiency. Models like **MAMBA** (Gu and Dao, 2023) use a selective scanning mechanism to model long-range dependencies linearly, making them attractive for real-time and large-scale applications. However, the trade-off is a potential flexibility reduction when modeling highly non-linear interactions. Despite these significant advances, several challenges persist. One major issue is **concept drift**, the phenomenon where the underlying distribution of data evolves. This drift renders pre-trained models ineffective and highlights the need for adaptive learning techniques that can update dynamically as new data becomes available. In addition, scalability remains a critical challenge, especially when dealing with high-frequency time series data or real-time anomaly detection in large-scale systems. Recent efforts in developing memory-efficient Transformers and distributed learning approaches (Gupta et al., 2021; Lai et al., 2021) have begun to address these scalability issues, marking promising steps toward more adaptive and robust anomaly detection systems. Overall, the evolution of unsupervised time series anomaly detection reflects a broader trajectory across complex domains. The field is steadily progressing toward more nuanced, robust, and adaptable solutions, from early statistical methods to modern deep learning architectures that harness attention mechanisms, contrastive learning, and efficient state space representations. These advancements enhance our ability to capture intricate temporal dependencies and subtle deviations without relying on labeled data and pave the way for deploying these models in real-world, dynamic environments.

## 3. Methodology

Consider a system that records a sequence of $d$-dimensional measurements at uniform time intervals. The time series data is represented by the set $\{x_1, x_2, ..., x_N\}$, where each $x_i \in \mathbb{R}^d$. The goal is to determine whether an observation $x_i$ is anomalous in an unsupervised manner. Effective unsupervised time series anomaly detection relies on learning informative representations and establishing a clear discriminative criterion. The original Anomaly Transformer framework distinguishes standard patterns from anomalies by learning an association discrepancy via anomaly attention and a minimax optimization strategy. Building on this, the Mamba Adaptive Anomaly Transformer (MAAT) introduces Anomaly Sparse Attention, Mamba Blocks, and Gated Skip Connections, enhancing short-range dependency modeling and long-range temporal learning while reducing computational cost. As illustrated in Fig. 1(A), Anomaly Sparse Attention replaces dense self-attention with a two-branch mechanism. The Prior-Association Branch encodes expected dependencies using a learnable Gaussian kernel, while the Series-Association Branch applies block-wise sparse Attention to capture time series patterns adaptively. These associations guide discrepancy learning, enhancing anomaly detection

performance. The Reconstruction Block, shown in Fig. 1(B), refines extracted features by stacking MAAT Blocks with LayerNorm and Feed-forward Networks (FFN). This layered design supports hierarchical feature learning, making the model more robust to diverse time series behaviors. Finally, the MAAT Block, depicted in Fig. 1(C), integrates Mamba Blocks within a Gated Attention mechanism, selectively amplifying meaningful signals while filtering out noise, and the skip connection preserves critical information while adapting the model focus. MAAT provides a scalable and expressive framework for detecting complex anomalies across various time series datasets by combining sparse Attention, state-space modeling, and gated learning mechanisms with the association discrepancy.

### 3.1. Background knowledge

#### 3.1.1. Association discrepancy

The Anomaly Transformer framework employs a minimax optimization strategy that alternates between two phases to balance the learning of two complementary feature sets, $P$ and $S$. This alternating approach prevents collapse in the representation of $P$ while ensuring that $S$ captures non-local dependencies.

Minimize phase.. As introduced in the Anomaly Transformer framework, this minimax strategy ensures that both feature sets capture complementary aspects of the input data, enhancing the overall quality of the learned representations. The hyperparameter $\lambda$ is critical in balancing the network's ability to reconstruct the input with the need for diverse and informative feature learning.

#### 3.1.2. Association-based anomaly criterion

The Anomaly Transformer framework integrates temporal pattern analysis with reconstruction fidelity through a dual-mechanism scoring system. The final anomaly score for an input $X \in \mathbb{R}^{N \times d}$ is computed as:

$$ \text{AnomalyScore}(X) = \underset{i=1, \dots, N}{\text{Softmax}} \left( -\text{AssDis}(P, S; X) \right) \odot \|X_{i,:} - \hat{X}_{i,:}\|_2^2, \quad (1) $$

Where:

* $\text{AssDis}(P, S; X)$ measures the association discrepancy between prior-association ($P$) and series-association ($S$), which is formulated as:

$$ \text{AssDis}(P, S; X) = \frac{1}{L} \sum_{i=1}^{L} \left[ \sum_{i=1}^{N} \text{KL}(P_{i,:}^{I} \| S_{i,:}^{I}) + \text{KL}(S_{i,:}^{I} \| P_{i,:}^{I}) \right], \quad (2) $$

- Where $KL(\text{Kullback-Leibler})$ divergence, compares probability distributions of the Prior and the Series associations

* $\text{Softmax}(\cdot)$ normalizes the negative association discrepancy across time steps,

* $\odot$ represents element-wise multiplication,

* $\|X_{i,:} - \hat{X}_{i,:}\|_2^2$ quantifies the reconstruction error at each time step $i$.

This formulation combines temporal patterns and reconstruction accuracy for anomaly detection. While improved reconstructions reduce discrepancy, anomalies with significant deviations in reconstruction or temporal patterns still yield high scores. Probabilistic weighting highlights time steps with poor reconstruction and abnormal dependencies, enhancing robustness.
<figure><img src="image_4.png" /><figcaption>Fig. 1. The figure illustrates the MAAT framework for time series anomaly detection. Block A (Anomaly Sparse Attention Module) computes prior and series associations using sparse Attention and a learnable Gaussian kernel to model temporal dependencies. Block B (Reconstruction Module) refines the feature representations using layer normalization, feedforward processing, and MAAT blocks to reconstruct input signals effectively. Block C represents the MAAT Block that integrates the Mamba state-space model to capture long-range dependencies, followed by a gated attention mechanism that adaptively fuses the reconstructed output.</figcaption></figure>

## 3.2. Sparse attention for efficient sequence attention

Sparse Attention restricts token interactions by applying a sparsity pattern $S$ that selects only a subset of pairs for attention computation (Child et al., 2019; Zaheer et al., 2020; Kitaev et al., 2020). Sparse attention introduces a sparsity mask $S$ to limit interactions:

$$ \text{SparseAttention}(Q, K, V) = \text{softmax} \left( \frac{(QK^T) \odot S}{\sqrt{d_k}} \right) V, \quad (3) $$

Where:

* $Q, K, V \in \mathbb{R}^{N \times d}$ are the query, key, and value matrices,

* $d_k$ denotes the dimensionality of the key vectors,

* The softmax function normalizes the attention scores.

where $\odot$ represents element-wise multiplication. This ensures that only selected token pairs contribute to the attention mechanism. Approaches for defining the sparsity pattern $S$ include:

* **Fixed Patterns:** Predefined structures, such as strided or block-wise masks (Child et al., 2019).

* **Learned Masks:** Patterns that are dynamically optimized during training (Zaheer et al., 2020).

* **Memory-Efficient Methods:** Techniques like locality-sensitive hashing (LSH) that enable content-based token selection (Kitaev et al., 2020).

The Gated Attention Mechanism enhances standard attention by using a learnable gating process to dynamically adjust the importance of input features. It evaluates the relevance of features to optimize attention weight distribution, represented mathematically as:

$$ \text{GatedAttention}(x) = \sigma(G(x)) \odot A(x) $$

Key components include xinput data, $G(x)$gating vector from a neural network, $\sigma$: sigmoid function mapping to $[0, 1]$, $A(x)$ standard attention weights, $\odot$element-wise multiplication. This mechanism allows the model to focus on task-critical features while suppressing noise, improving robustness in contexts like anomaly detection.

## 3.3. Mamba state space model

State Space Models (SSMs) are a class of architectures that model time series by positing a latent state evolving according to linear

dynamics and observed through a readout, capturing long-term dependencies and latent structures with provable efficiency and stability (Gu et al., 2022). The Mamba State Space Model (Mamba SSM) builds on the Structured State Space (S4) lineage by introducing selective state spaces i.e., SSM parameters that vary as functions of the input—thereby enabling content-based propagation or forgetting of information along the sequence. Unlike standard subquadratic architectures, Mamba achieves $O(N)$ compute and memory complexity in the sequence length $N$, supporting training and inference on sequences of up to $2^{20} \approx 1.05 \times 10^6$ time steps ($N = 1.05 \times 10^6$) without performance degradation. This linear scaling stems from its input-dependent parameterization and hardware-aware parallel scan algorithm, which eliminates the quadratic overhead of attention-based models. The latter also delivers up to five-fold higher throughput than same-sized Transformers in inference, making Mamba both fast and resource efficient. As a universal sequence modeling backbone, Mamba achieves state-of-the-art results across diverse modalities (language, audio, genomics)—outperforming or matching Transformers of equal or larger size in both pretraining and downstream tasks (Gu and Dao, 2023), while maintaining $O(N)$ time and memory complexity for sequences of arbitrary length $N$.

## 3.4. Mamba Adaptive Anomaly Transformer Architecture

Fig. 1 illustrates the overall structure of the Mamba Adaptive Anomaly Transformer (MAAT), an architecture inspired by the Anomaly Transformer. MAAT integrates a sparse attention mechanism, a selective state-space model known as the Mamba block, and an adaptive reconstruction framework. The sparse attention mechanism processes the input time series data, capturing local dependencies efficiently. The Mamba block is designed to capture long-range dependencies, enhancing the model's ability to understand complex temporal patterns. An adaptive gating mechanism then fuses the output Attention sparse attention and Mamba block, enabling the model to reconstruct the input signal effectively. This combination allows MAAT to detect anomalies by comparing the reconstructed signal with the original input, identifying deviations that may indicate anomalous behavior.

### 3.4.1. Anomaly sparse attention

Our anomaly sparse attention module, shown in Fig. 1(A), refines the conventional anomaly attention used in the Anomaly Transformer, which relies on self-attention and sparse Attention. While the prior-association remains unchanged, modeled using a learnable Gaussian kernel the series-association is now computed through sparse self-attention, capturing observed dependencies more efficiently.
In this module, the prior association continues to be represented by a learnable Gaussian kernel, while the series association is computed using a sparse softmax operation over local attention windows.

For each query vector $Q_i$, normalization is performed only over keys in the local window defined by

$$ \Omega_i = \{j | j - i \leq \text{block\_size}/2\}, \quad (4) $$

so that the series association is computed as

$$ S_{i,j}^l = \frac{\exp\left(\frac{Q_i K_i^T}{\sqrt{d_{\text{model}}}}\right)}{\sum_{k \in \Omega_i} \exp\left(\frac{Q_i K_k^T}{\sqrt{d_{\text{model}}}}\right)}, \quad \forall j \in \Omega_i, \quad (5) $$

with

$$ S_{i,j}^l = 0 \quad \text{for } j \notin \Omega_i. \quad (6) $$

This sparse softmax formulation ensures that only locally relevant keys are considered during normalization, reducing computational redundancy while preserving essential dependencies.

### 3.4.2. MAAT adaptive block

The adaptive block shown in Fig. 1(C) integrates a state-space model (Mamba block) with a skip connection that retains the original input. The Mamba block is specifically designed to capture long-range dependencies, while the skip connection ensures the preservation of fine details. We achieve a robust intermediate representation by combining these elements and applying layer normalization. This Adaptive Block merges long-range dependencies and local features through a state-space (Mamba) skip path and an adaptive gating mechanism. After performing sparse attention processing, we proceed with the following steps: The Mamba block generates a transformed representation $x_{Mambamamba}$, which is then combined with the reconstructed input from sparse attention $x_{\text{orig}}$ via a residual connection. This output is normalized as follows:

$$ x_{\text{skip}} = \text{LayerNorm}(x_{\text{mamba}} + x_{\text{orig}}), \quad (7) $$

**Adaptive gating and reconstruction.** In the context of adaptive gating and reconstruction, a gating factor $g$ is computed from the concatenation of the output from the central processing path $x$ and the corresponding skip connection $x_{\text{skip}}$. Formally, the gating factor can be expressed as follows:

$$ g = \sigma(\text{Linear}([x; x_{\text{skip}}])) = \sigma(W[x; x_{\text{skip}}] + b), \quad (8) $$

Where $[x; x_{\text{skip}}]$ denotes the concatenation of the feature maps along the channel dimension, $W$ and $b$ represent the learnable parameters of the linear transformation (precisely, the weight matrix and bias term), and $\sigma(\cdot)$ is the sigmoid activation function that maps the output to the range $(0, 1)$.

The gating factor $g$ is critical in modulating the relative importance of the skip and main paths. Specifically, for each element:

* When $g$ approaches 1, the output is predominantly influenced by the skip connection $x_{\text{skip}}$, which encapsulates long-range contextual information along with a residual signal from the original input.

* Conversely, when $g$ approaches 0, the reconstruction is primarily derived from the main path output $x$, which reflects the locally processed features.

The final output, denoted as $X^{\text{adapt}}$, is computed as an element-wise weighted combination of these two representations:

$$ X^{\text{adapt}} = g \odot x_{\text{skip}} + (1 - g) \odot x, \quad (9) $$

where $\odot$ signifies element-wise multiplication. This formulation enables the network to dynamically calibrate the contributions from the skip connection and the main processing branch, thereby facilitating a

harmonious integration of local details and global context. The process of adaptive fusion is paramount in ensuring that the reconstructed output $X^{\text{adapt}}$ accurately embodies normal patterns. In contrast, anomalies disrupt local consistency and global structure, increasing reconstruction errors. This enhanced reconstruction capability, in turn, fosters improved performance in anomaly detection.

Consequently, $X^{\text{adapt}}$ represents a sophisticated integrated reconstruction, merging information from both the skip path and the central processing branch, ultimately enhancing the overall representational capacity of the model.

The anomaly score now leverages the adaptively fused reconstruction $X^{\text{adapt}}$ by balancing the association discrepancy from Eq. (10) and the reconstruction error. Specifically, the anomaly score for each time step $i$ is defined as

$$ \text{AnomalyScore}(X) = \text{Softmax}(-\text{AssDis}(P, S; X)) \odot \|X_{i,:} - X_{i,:}^{\text{adapt}}\|_{2}^{2}, \quad i = 1, \dots, N. \quad (10) $$

Here, $\odot$ represents element-wise multiplication, and:

* AnomalyScore($X$) $\in \mathbb{R}^{N \times 1}$ provides the point-wise anomaly criterion.

* AssDis($P$, $S$; $X$) is the association discrepancy, as defined in Eq. (10).

* $\|X_{i,:} - X_{i,:}^{\text{adapt}}\|_{2}^{2}$ is the reconstruction error between the input $X$ and its adaptively reconstructed counterpart $X^{\text{adapt}}$.

This updated formulation clearly distinguishes the adaptively reconstructed output $X^{\text{adapt}}$, which utilizes the gating for reconstruction from the input $X$, emphasizing the role of adaptive fusion in our anomaly detection criterion.

## 4. Experiments

### 4.1. Benchmark datasets

In this study, we evaluate the performance of our model using seven representative benchmarks derived from real-world applications. The first dataset, MSL, is the Mars Science Laboratory dataset collected by NASA, which reflects the condition of sensors and actuator data from the Mars rover (NASA, 2018a). Similarly, the SMAP dataset, provided by NASA, presents soil samples and telemetry information from the Mars rover; notably, SMAP contains more point anomalies than MSL (NASA, 2018b). The PSM dataset, a public resource from eBay Server Machines, includes 25 dimensions and is widely used for research in anomaly detection (Huang et al., 2021). Additionally, the SMD dataset consists of a five-week-long record of resource utilization traces collected from an internet company compute cluster, monitoring 28 machines (Su et al., 2019). Another critical benchmark is the SWaT dataset, which comprises 51-dimensional sensor data from a secure water treatment system that operates continuously (Mathur and Tippenhauer, 2016). Furthermore, the NIPS-TS-SWAN dataset provides a comprehensive multivariate time series benchmark extracted from solar photospheric vector magnetograms in the Spaceweather HMI Active Region Patch series (NASA, 20000). Lastly, the NIPS-TS-GECCO dataset is a drinking water quality dataset for the Internet of Things, published in the 2018 Genetic and Evolutionary Computation Conference (Miller et al., 2018). These datasets validate MAAT's ability to handle heterogeneous temporal dependencies (short-term sequences, long-term sequences, and mixed sequences) and anomaly types (point, contextual, collective) across domains ranging from aerospace to critical infrastructure. Their adoption in prior work (Xu et al., 2022; Yang et al., 2023b) ensures reproducibility and fair comparison. Table A.7 includes more details about the datasets.
## 4.2. Implementation

Our study follows the Anomaly Transformer model's protocol to evaluate our approach. We generate a sub-series using a non-overlapping sliding window. Anomaly detection involves scoring time points and setting a threshold based on the Anomaly Ratio detailed in the table. Other parameters, including batch size and model dimensionality, are also specified in Table B.8, ensuring robust evaluation and reproducibility of our improvements.

## 4.3. Evaluation metrics

The evaluation of anomaly detection in time series data employs various metrics to assess performance and capture the temporal continuity of anomalies. Point-based metrics, including Precision, Recall, and F1 Score, utilize true positives (TP), false positives (FP), and false negatives (FN) for evaluation Chandola et al. (2009). Affiliation metrics, such as Affiliation Precision (Aff-P) and Affiliation Recall (Aff-R), measure the fraction of predicted anomalies within true ranges and the fraction of true anomalies detected, respectively. Range-based metrics like Range-based Anomaly Recall (R_A_R) and Range-based Anomaly Precision (R_A_P) evaluate detection based on the overlap between true and predicted anomaly ranges. Additionally, volume-based metrics, including Volume-based ROC (V_ROC) and Volume-based Precision-Recall (V_PR), adjust true positive rate (TPR) and false positive rate (FPR) by incorporating the volume of anomalies and provide volume-weighted precision and recall. In summary, while point-based metrics offer basic performance insights, affiliation, range-based, and volume-based metrics deliver a more comprehensive evaluation by factoring in the temporal structure and duration of anomalies. In summary, while point-based metrics offer a basic assessment, affiliation, range-based, and volume-based metrics ((C.1), (C.2), (C.3), (C.4)) provide a comprehensive evaluation by accounting for temporal structure and anomaly duration (Hundman et al., 2018; Blazquez-Garcia et al., 2019).

# 5. Results

In this section, we introduce the results comparison in different test setups to showcase the effectiveness of the MAAT model.

## 5.1. Baseline results

After conducting various experiments, we present our results evaluated on precision Recall and F1 score metrics in Table 1: Our model Achieves remarkable improvements over existing methods, particularly when compared to the DCdetector and Anomaly Transformer, two leading approaches in the field. For instance,

On the SMD dataset, MAAT achieves a +2.18% F1-score and +3.84% Recall improvement over the Anomaly Transformer, attributable to its Sparse Attention mechanism, which prioritizes localized dependencies over redundant global interactions, refining anomaly localization. The +8.64% F1-score and +13.93% Recall gains over DCdetector stem from MAAT's Mamba-SSM, which preserves transient anomalies via skip connections while modeling long-term trends, circumventing DCdetector's contrastive loss limitations in retaining short-term deviations. Precision improvements (+0.63% and +3.74%) reflect Gated Attention Fusion's adaptive suppression of false positives through context-aware reconstruction weighting. Compared to LGAT, MAAT's +5.22% F1, +9.91% Recall, and +0.76% Precision gains highlight its efficacy in isolating localized anomalies from periodic noise, where LGAT's graph attention struggles to resolve short-term signals amid relational smoothing.

On the MSL dataset, MAAT achieves a +1.19% F1-score and +2.40% Recall improvement over the Anomaly Transformer, attributable to its Sparse Attention mechanism, which prioritizes localized temporal dependencies (e.g., rapid actuator spikes) while suppressing ambient

sensor noise. The +0.32% F1-score and +0.95% Recall gains over DCdetector arise from MAAT's Mamba-SSM, which models long-term degradation patterns while retaining short-term anomalies (e.g., actuator jitters) via skip connections, addressing DCdetector's limitations in preserving fine-grained deviations during contrastive learning. The marginal -0.21% Precision trade-off reflects MAAT's emphasis on recall for safety-critical aerospace applications, where missing anomalies poses greater risks than false alarms. Compared to LGAT, MAAT's +4.19% F1, +8.20% Recall, and +0.08% Precision improvements highlight its efficacy in detecting gradual wear-and-tear anomalies (e.g., actuator fatigue), where LGAT's graph attention over-smooths low-frequency signals through relational aggregation. These advancements are enabled by Gated Attention Fusion, which contextually balances abrupt fault detection against mission-phase baselines, ensuring robust anomaly discrimination in dynamic aerospace environments.

On the SMAP dataset, MAAT achieves a +0.60% F1-score and +1.24% Precision improvement over the Anomaly Transformer, driven by its block-wise Sparse Attention, which isolates abrupt anomalies (e.g., sensor spikes) while attenuating gradual seasonal trends, enhancing discrimination between transient faults and benign cycles. The +0.93% F1-score and +1.39% Recall gains over DCdetector stem from MAAT's Mamba-SSM, which models long-term cyclical patterns while preserving subtle anomalies (e.g., conductivity lags) via skip connections, addressing DCdetector's tendency to over-smooth short-term deviations during contrastive learning. The marginal -0.08% Recall trade-off against the Anomaly Transformer reflects MAAT's emphasis on precision for high-stakes telemetry validation, where false alarms are costlier than missed detections. Compared to LGAT, MAAT's +3.69% F1, +7.30% Recall, and +0.14% Precision improvements highlight its efficacy in detecting low-amplitude anomalies (e.g., soil moisture lags) within noisy seasonal data, where LGAT's graph attention over-smooths localized signals through relational aggregation. These advancements are enabled by Gated Attention Fusion, which balances sensitivity to rapid sensor anomalies and slow environmental shifts, leveraging context-aware reconstruction to minimize false positives—a critical capability for planetary science applications. On the SWaT dataset, MAAT achieves a +0.09% F1-score improvement over the Anomaly Transformer and +0.08% over DCdetector, with its Sparse Attention mechanism isolating transient cyber-physical attack signatures (e.g., valve tampering bursts) while attenuating high-frequency sensor noise, enhancing discrimination between malicious and benign industrial patterns. The -0.28% Precision trade-off against the Anomaly Transformer reflects MAAT's prioritization of recall (+0.59%) for safety-critical systems, where undetected attacks pose severe risks. The +0.23% Precision and +0.04% Recall gains over DCdetector highlight MAAT's skip-connected Mamba-SSM, which preserves transient anomalies (e.g., pump pressure drops) during long-term state-space denoising, addressing DCdetector's tendency to over-smooth short-lived deviations in contrastive learning. Against LGAT, MAAT's -0.11% F1 (offset by +0.72% Recall) underscores its focus on stealthy attack detection in 1-second industrial sequences, where LGAT's graph attention over-smooths temporal granularity through relational aggregation. These trade-offs are governed by Gated Attention Fusion, which balances anomaly sensitivity and noise suppression via context-aware reconstruction, ensuring robust detection in high-velocity, noisy cyber-physical environments.

On the PSM dataset, MAAT achieves a +0.87% F1-score and +1.39% Recall improvement over the Anomaly Transformer, driven by its block-wise Sparse Attention, which prioritizes localized temporal anomalies (e.g., CPU/memory spikes) while attenuating periodic workload noise, enhancing discrimination between transient anomalies and routine traffic patterns. The +0.50% F1-score and +0.73% Recall gains over DCdetector arise from MAAT's Mamba-SSM, which models long-term server metric consistency while retaining short-term disruptions (e.g., memory leaks) via skip connections, addressing DCdetector's over-smoothing of volatile sequences during contrastive learning.
<table><caption>**Table 1**
Comparison of various anomaly detection metrics across different datasets.</caption><thead><tr><th rowspan="2">Dataset<br>Metric</th><th colspan="3">SMD</th><th colspan="3">MSL</th><th colspan="3">SMAP</th><th colspan="3">SWaT</th><th colspan="3">PSM</th></tr><tr><th>P</th><th>R</th><th>F1</th><th>P</th><th>R</th><th>F1</th><th>P</th><th>R</th><th>F1</th><th>P</th><th>R</th><th>F1</th><th>P</th><th>R</th><th>F1</th></tr></thead><tbody><tr><td>LOF</td><td>56.34</td><td>39.86</td><td>46.68</td><td>47.72</td><td>85.25</td><td>61.18</td><td>58.93</td><td>56.33</td><td>57.60</td><td>72.15</td><td>65.43</td><td>68.62</td><td>57.89</td><td>90.49</td><td>70.61</td></tr><tr><td>OCSVM</td><td>44.34</td><td>76.72</td><td>56.19</td><td>59.78</td><td>86.87</td><td>70.82</td><td>53.85</td><td>59.07</td><td>56.34</td><td>45.39</td><td>49.22</td><td>47.23</td><td>62.75</td><td>80.89</td><td>70.67</td></tr><tr><td>U-Time</td><td>65.95</td><td>74.75</td><td>70.07</td><td>57.20</td><td>71.66</td><td>63.62</td><td>49.71</td><td>56.18</td><td>52.75</td><td>46.20</td><td>87.94</td><td>60.58</td><td>82.85</td><td>79.34</td><td>81.06</td></tr><tr><td>Forrest</td><td>42.31</td><td>73.29</td><td>53.75</td><td>53.94</td><td>82.98</td><td>65.42</td><td>52.39</td><td>55.53</td><td>53.89</td><td>49.22</td><td>44.95</td><td>47.02</td><td>76.09</td><td>92.45</td><td>83.46</td></tr><tr><td>DAGMM</td><td>67.30</td><td>49.89</td><td>57.30</td><td>89.60</td><td>63.93</td><td>74.62</td><td>86.45</td><td>56.73</td><td>68.51</td><td>89.92</td><td>57.84</td><td>70.40</td><td>93.49</td><td>70.03</td><td>80.08</td></tr><tr><td>ITAD</td><td>86.22</td><td>73.71</td><td>79.48</td><td>69.44</td><td>84.09</td><td>76.07</td><td>82.42</td><td>66.89</td><td>73.85</td><td>63.13</td><td>52.08</td><td>57.08</td><td>72.80</td><td>64.02</td><td>68.13</td></tr><tr><td>VAR</td><td>78.35</td><td>70.26</td><td>74.08</td><td>71.68</td><td>81.42</td><td>77.90</td><td>81.38</td><td>53.88</td><td>64.83</td><td>81.59</td><td>60.29</td><td>69.34</td><td>90.71</td><td>83.82</td><td>87.13</td></tr><tr><td>MMPCACD</td><td>71.20</td><td>79.28</td><td>75.02</td><td>81.42</td><td>61.31</td><td>69.95</td><td>83.22</td><td>68.23</td><td>74.72</td><td>82.52</td><td>68.23</td><td>74.73</td><td>76.26</td><td>78.35</td><td>77.29</td></tr><tr><td>CL-MPPCA</td><td>82.36</td><td>76.07</td><td>79.09</td><td>73.71</td><td>88.54</td><td>80.44</td><td>63.16</td><td>72.88</td><td>67.72</td><td>76.78</td><td>81.50</td><td>79.07</td><td>56.02</td><td><b>99.93</b></td><td>71.80</td></tr><tr><td>TS-CP2</td><td>87.42</td><td>66.25</td><td>75.38</td><td>68.45</td><td>68.48</td><td>68.42</td><td>86.75</td><td>83.18</td><td>84.95</td><td>81.23</td><td>74.10</td><td>77.50</td><td>82.67</td><td>78.16</td><td>80.35</td></tr><tr><td>Deep-SVDD</td><td>78.54</td><td>79.67</td><td>79.10</td><td><b>92.25</b></td><td>76.63</td><td>83.26</td><td>56.02</td><td>69.04</td><td>62.40</td><td>80.42</td><td>84.45</td><td>82.39</td><td>95.41</td><td>86.79</td><td>90.73</td></tr><tr><td>BOCPD</td><td>70.90</td><td>82.04</td><td>76.07</td><td>80.32</td><td>87.60</td><td>83.62</td><td>86.45</td><td>85.85</td><td>86.14</td><td>84.96</td><td>70.75</td><td>79.01</td><td>82.72</td><td>87.46</td><td>77.70</td></tr><tr><td>LSTM-VAE</td><td>75.76</td><td>90.08</td><td>82.30</td><td>85.49</td><td>79.94</td><td>82.62</td><td>92.20</td><td>67.75</td><td>78.10</td><td>76.00</td><td>89.50</td><td>82.20</td><td>73.62</td><td>89.92</td><td>80.94</td></tr><tr><td>BeatGAN</td><td>78.55</td><td>88.92</td><td>83.42</td><td>85.42</td><td>87.88</td><td>86.64</td><td>92.38</td><td>55.85</td><td>69.61</td><td>76.04</td><td>87.46</td><td>81.32</td><td>90.30</td><td>93.84</td><td>92.04</td></tr><tr><td>LSTM</td><td>78.55</td><td>88.25</td><td>83.08</td><td>85.98</td><td>85.42</td><td>85.70</td><td>91.00</td><td>81.89</td><td>86.21</td><td>78.13</td><td>83.39</td><td>80.69</td><td>76.93</td><td>89.64</td><td>82.64</td></tr><tr><td>OmniAnomaly</td><td>83.68</td><td>88.52</td><td>85.22</td><td>90.14</td><td>89.50</td><td>89.82</td><td>81.42</td><td>84.30</td><td>82.83</td><td>81.42</td><td>84.30</td><td>82.83</td><td>83.38</td><td>74.46</td><td>78.64</td></tr><tr><td>THOC</td><td>79.65</td><td>91.10</td><td>85.02</td><td>88.45</td><td>90.97</td><td>89.69</td><td>92.06</td><td>89.34</td><td>90.68</td><td>92.48</td><td>98.32</td><td>95.33</td><td>97.14</td><td>98.74</td><td>97.94</td></tr><tr><td>AnomalyTrans</td><td><u>88.47</u></td><td><u>92.28</u></td><td><u>90.33</u></td><td>91.02</td><td>96.03</td><td>93.93</td><td>93.59</td><td><u>99.41</u></td><td><u>96.41</u></td><td><u>93.59</u></td><td><u>99.41</u></td><td><u>96.41</u></td><td><u>97.14</u></td><td><u>97.81</u></td><td><u>97.47</u></td></tr><tr><td>DCdetector</td><td>85.82</td><td>84.10</td><td>84.95</td><td>91.25</td><td><u>97.40</u></td><td><u>94.75</u></td><td>94.29</td><td>97.97</td><td>96.10</td><td>93.12</td><td><u>99.96</u></td><td>96.42</td><td>97.22</td><td><u>98.45</u></td><td>97.83</td></tr><tr><td>LGAT</td><td>88.27</td><td>85.91</td><td>87.08</td><td><u>91.38</u></td><td>90.13</td><td>90.86</td><td><u>94.61</u></td><td>92.03</td><td>93.30</td><td>93.28</td><td><u>99.91</u></td><td><u>96.48</u></td><td><u>98.41</u></td><td>98.25</td><td><u>98.33</u></td></tr><tr><td>Ours</td><td><u>89.03</u></td><td><u>95.82</u></td><td><u>92.30</u></td><td><u>92.06</u></td><td><u>98.33</u></td><td><u>95.05</u></td><td><u>94.75</u></td><td><u>99.33</u></td><td><u>96.99</u></td><td><u>93.33</u></td><td><u>100.00</u></td><td><u>96.50</u></td><td><u>97.48</u></td><td><u>99.17</u></td><td><u>98.32</u></td></tr></tbody></table>

<table><caption>**Table 2**
Comparison of Different Methods on NIPS-TS-GECCO and NIPS-TS-SWAN Datasets.</caption><thead><tr><th rowspan="2">Dataset<br>Metric</th><th colspan="3">NIPS-TS-GECCO</th><th colspan="3">NIPS-TS-SWAN</th></tr><tr><th>P</th><th>R</th><th>F1</th><th>P</th><th>R</th><th>F1</th></tr></thead><tbody><tr><td>MatrixProfile (Benschoten et al., 2020)</td><td>4.6</td><td>18.5</td><td>7.4</td><td>17.1</td><td>17.1</td><td>17.1</td></tr><tr><td>GBRT (Taieb et al., 2012)</td><td>17.5</td><td>14.0</td><td>15.6</td><td>44.7</td><td>37.5</td><td>40.8</td></tr><tr><td>LSTM-RNN</td><td>17.0</td><td>22.6</td><td>19.3</td><td>45.2</td><td>35.8</td><td>40.0</td></tr><tr><td>Autoregression (Box et al., 2015)</td><td>39.2</td><td>31.4</td><td>34.9</td><td>42.1</td><td>35.4</td><td>38.5</td></tr><tr><td>OCSVM</td><td>18.5</td><td><b>74.3</b></td><td>29.6</td><td>47.4</td><td>49.8</td><td>48.5</td></tr><tr><td>IForest (Liu et al., 2008)</td><td><b>43.9</b></td><td>35.3</td><td>39.1</td><td>56.9</td><td><b>59.8</b></td><td>58.3</td></tr><tr><td>AutoEncoder</td><td>42.4</td><td>34.0</td><td>37.7</td><td>47.0</td><td>52.2</td><td>50.9</td></tr><tr><td>AnomalyTrans</td><td>25.7</td><td>28.5</td><td>27.0</td><td>90.7</td><td>47.4</td><td>62.3</td></tr><tr><td>DCdetector</td><td>38.3</td><td>59.7</td><td><u>46.6</u></td><td><u>95.5</u></td><td>59.6</td><td><u>73.4</u></td></tr><tr><td>Ours</td><td><u>42.4</u></td><td><u>70.0</u></td><td><b>52.8</b></td><td><u>95.9</u></td><td><u>59.9</u></td><td><b>73.8</b></td></tr></tbody></table>

The +0.35% Precision improvement over Anomaly Transformer and +0.27% over DCdetector reflects Gated Attention Fusion's context-aware suppression of false alarms in high-density anomaly environments. Compared to LGAT, MAAT's near-parity F1-score (-0.01%) with a +0.20% Recall gain—despite a -0.24% Precision trade-off—demonstrates its focus on anomaly detection completeness in ambiguous scenarios (e.g., intermittent API failures), where LGAT's graph attention over-smooths short-term deviations through relational aggregation. This balance is enabled by MAAT's adaptive weighting of localized anomalies against reconstructed operational baselines, ensuring reliability in server monitoring without inflating false positives.

The slight variations we observe likely stem from DCdetector's dual-attention contrastive learning method, which works particularly well with highly variable datasets. For other datasets, however, we see somewhat reduced precision. These performance trade-offs highlight areas where MAAT could be improved, especially in contexts where avoiding false positives takes precedence over capturing all anomalies.

In Table 2, Our model establishes a new benchmark for anomaly detection on the NIPS-TS-GECCO and NIPS-TS-SWAN datasets, surpassing the best-performing methods in most metrics while demonstrating exceptional robustness across diverse challenges.

On the NIPS-TS-GECCO dataset, MAAT achieves a 6.2% F1-score improvement over DCdetector, alongside 13.7% and 23.2% gains against IForest and OCSVM, respectively. These advancements stem from MAAT's Sparse Attention mechanism, which isolates transient water quality anomalies (e.g., pH spikes) from IoT sensor noise, addressing DCdetector's contrastive learning limitations in low-signal environments. The 16.7% precision improvement over the Anomaly

Transformer and 4.1% over DCdetector reflects MAAT's Mambasssm, which suppresses false alarms by modeling long-term contamination trends while retaining abrupt deviations via skip connections. Though IForest achieves marginally higher precision (-1.5%), MAAT's recall-centric design prioritizes detection completeness in safety-critical water quality monitoring, where missed anomalies risk public health. On the NIPS-TS-SWAN dataset, MAAT delivers exceptional performance, surpassing the Anomaly Transformer by 5.2% precision, 12.5% recall, and 11.5% F1-score through its ability to detect subtle solar magnetic anomalies (e.g., polarity misalignments) often obscured by spatially correlated noise. Against DCdetector, MAAT's 0.4% precision, 0.3% recall, and 0.4% F1-score gains highlight its superior handling of long-term solar cycles (e.g., 11-year sunspot trends) via Mambasssm's state-space modeling, which avoids DCdetector's over-smoothing during contrastive alignment. Traditional methods like IForest and OCSVM lag significantly, with MAAT achieving 39.0% higher precision and 15.5% F1-score over IForest, and 48.5% precision, 25.3% F1-score, and 10.1% recall improvements over OCSVM. These results underscore MAAT's Sparse Attention efficacy in filtering solar noise while preserving localized magnetic flux cues, paired with Mambasssm's capacity to model gradual solar phenomena without signal dilution. While minor trade-offs exist — such as a -0.24% precision reduction on NIPS-TS-GECCO and a marginal -0.08% recall dip on NIPS-TS-SWAN — MAAT's architecture prioritizes domain-specific robustness. For solar weather monitoring (SWAN), recall-driven anomaly detection mitigates catastrophic risks of undetected solar flares, whereas water quality applications (GECCO) balance precision to reduce false alarms. This adaptability, rooted in Gated Attention
Fusion's context-aware scoring, ensures MAAT excels in both high-dimensional IoT sensor streams and spatially correlated solar data, solidifying its versatility across diverse real-world anomaly detection.

## 5.2. In-depth performance analysis of MAAT vs. State-of-the-art models

Analysis of Performance Across Datasets Refer to Table 3 The performance of our model is comprehensively evaluated against Anomaly-Trans and DCdetector, two state-of-the-art methods, across five benchmark datasets: MSL, SMAP, SWaT, PSM, and SMD. The results in Table 3 demonstrate that our model consistently outperforms or closely matches the best-performing methods across most metrics, establishing its superiority in anomaly detection tasks.

On the MSL dataset, our model surpasses AnomalyTrans in several metrics, including Accuracy Acc, where it achieves 98.92%, compared to AnomalyTrans's 98.69%. While DCdetector excels in precision-related metrics such as Aff-P 51.84% and R_A_P 91.64%, our model demonstrates robust recall metrics, achieving Aff-R 96.49% and R_A_R 90.97%, which are critical for detecting subtle anomalies in noisy environments.

On the SMAP dataset, MAAT exhibits marginally lower performance in volume-based metrics (V_ROC: 92.06%, V_PR: 90.70%) compared to AnomalyTrans (V_ROC: 95.52%, V_PR: 93.77%), reflecting inherent architectural trade-offs tailored for noisy, high-dimensional datasets. The fixed block-wise sparse attention mechanism, designed to suppress spurious correlations in noisy environments, prioritizes localized anomaly detection—enhancing robustness but limiting sensitivity to SMAP's weak long-range telemetry dependencies critical for volume-based aggregation. Concurrently, the gating mechanism optimizes denoising by favoring Mamba-SSM's state-space modeling on low-noise signals, improving global consistency at the cost of reduced contrast in fine-grained residuals. Furthermore, the association-discrepancy scoring emphasizes alignment between reconstruction errors and contextual associations, which prioritizes clear anomalies over subtle deviations in SMAP's gradually varying signals. While these design choices explain the modest gaps in V_ROC/V_PR, MAAT maintains strong recall (Aff-R: 94.27%), underscoring its reliability in detecting anomalies even in smooth telemetry. The trade-offs highlight MAAT's specialization: its architecture excels in bursty, noisy domains (e.g., industrial sensors, server clusters) but requires targeted adaptations for applications dominated by long-range, low-noise signals like SMAP.

On the SWaT dataset, our model achieves the highest Aff-P 56.26%, surpassing both AnomalyTrans 53.03% and DCdetector 52.40%. Additionally, our model demonstrates superior recall metrics, achieving Aff-R 97.79% and R_A_R 98.14%, which are marginally higher than DCdetector 97.67% and 98.43%, respectively. Our V_ROC 98.17% and V_PR 95.02% also outperform both competitors, highlighting its robustness in handling multivariate interactions and complex temporal patterns.

Our model achieves the best performance across nearly all metrics on the PSM dataset, a 1.5% increase in Aff-P vs. DCdetector, our model excels in recall-related metrics, achieving Aff-R 85.06%, R_A_R 94.15%, and R_A_P 95.09%, outperforming AnomalyTrans and DCdetector. These results underscore our model's ability to handle high-dimensional sensor data with significant noise.

On the SMD dataset, our model achieves the highest scores across all metrics, setting a new benchmark for performance. It surpasses AnomalyTrans in 5.8% and 8.9% increase in F1-score and Aff-P respectively. Additionally, our model demonstrates superior recall metrics, achieving Aff-R 93.51%, R_A_R 79.11%, and R_A_P 75.41%, significantly outperforming both competitors. These gains highlight our model's effectiveness in capturing intricate temporal patterns in highly non-stationary multivariate time series.

In this section, we analyze MAAT's performance on the NIPS-TS-SWAN and NIPS-TS-GECCO datasets, as detailed in Table 4. On NIPS-TS-SWAN, MAAT achieves 95.9% precision, 59.9% recall, and 73.8%

F1-score, surpassing the **Anomaly Transformer** by +5.2% precision, +12.5% recall, and +11.5% F1, while outperforming **DCdetector** by +0.4% precision, +0.3% recall, and +0.4% F1. These gains stem from MAAT's **Sparse Attention** mechanism, which isolates subtle solar magnetic anomalies (e.g., polarity misalignments) from spatially correlated noise, and **Mamba-SSM**, which models long-term solar cycles (e.g., 11-year sunspot trends) without diluting transient flare precursors. Against traditional methods, MAAT dominates with +39.0% precision and +15.5% F1 over **IForest**, and +48.5% precision and +25.3% F1 over **OCSVM**, resolving their inability to handle high-dimensional, temporally complex solar data. On **NIPS-TS-GECCO**, MAAT achieves 42.4% precision, 70.0% recall, and 52.8% F1, exceeding **DCdetector** by +4.1% precision, +10.3% recall, and +6.2% F1, and **Anomaly Transformer** by +16.7% precision, +41.5% recall, and +23.7% F1. The **Sparse Attention** mechanism excels here by filtering IoT sensor noise to detect transient water quality anomalies (e.g., pH spikes), while **Mamba-SSM** suppresses false alarms by modeling long-term contamination trends. Despite a marginal -1.5% precision trade-off against **IForest**, MAAT's +10.3% recall gain ensures comprehensive detection in safety-critical water quality monitoring, where missed anomalies risk public health. The affinity metrics further validate MAAT's robustness: on **NIPS-TS-GECCO**, Aff-P improves by +7.88% and Aff-R by +11.89% over **Anomaly Transformer**, demonstrating its ability to detect anomalies within true event ranges. The validation ROC corroborates this, with gains of +1.55% (SWAN) and +11.42% (GECCO), reflecting MAAT's balanced sensitivity-specificity trade-offs. These results underscore MAAT's architectural superiority: **Gated Attention Fusion** dynamically prioritizes recall for solar flare detection (SWAN) and precision for water quality (GECCO), while its **association discrepancy mechanism** aligns anomaly scores with contextual fidelity. By integrating localized anomaly isolation, long-term dependency modeling, and context-aware scoring, MAAT sets a new standard for time-series anomaly detection, delivering state-of-the-art performance across domains with divergent requirements—from solar magnetic analysis to IoT-driven environmental monitoring.

# 6. Discussion

## 6.1. Ablation study analysis

This section, presents the results of the ablation study of our model, emphasizing the significance of each component within MAAT and their effects on the baseline Anomaly Transformer model. The findings from the ablation study are summarized in Tables 5 and 6. Across five datasets SMD, MSL, SMAP, SWaT, and PSM the incorporation of Sparse Attention (SA), Mamba-SSM, and Gated Attention consistently shows enhancements over the baseline.

The baseline Anomaly Transformer demonstrates strong recall and moderate precision on SMD dataset. However, its dense self-attention mechanism makes it vulnerable to false positives due to noise. The addition of a Gating mechanism to the baseline (AnomalyTrans+Gating) improves both precision to 89.11% and recall to 93.09%, resulting in an F1-score increase to 91.05% - demonstrating that adaptive feature fusion alone provides substantial benefits. The integration of Sparse Attention (AnomTr+SA) maintains baseline precision but leads to a recall decrease of approximately 2.4%, resulting in an F1-score reduction of about 1.15%. This suggests that the block-wise formulation may oversimplify inter-variable dependencies and overlook subtle anomalies. The standalone Mamba model shows promising capabilities, maintaining a reasonable precision of 88.33% while improving recall to 93.53% (an increase of approximately 1.25% over the baseline), resulting in a modest F1-score gain to 90.86%. However, when combining Mamba with Sparse Attention without gating (Mamba+SA), we observe performance degradation with precision dropping to 87.28% and recall falling significantly to 86.76%, resulting in the lowest F1-score of 87.02%. This indicates that naively combining these approaches
<table><caption>**Table 3**
Performance comparison of AnomalyTrans, DCdetector, and our method across different datasets. Best results in **bold**, second-best **underlined**.</caption><thead><tr><th>Dataset</th><th>Method</th><th>Acc</th><th>F1</th><th>Aff-P</th><th>Aff-R</th><th>R_A_R</th><th>R_A_P</th><th>V_ROC</th><th>V_PR</th></tr></thead><tbody><tr><td rowspan="3">MSL</td><td>AnomalyTrans</td><td>98.69</td><td>93.93</td><td><u>51.76</u></td><td>95.98</td><td>90.04</td><td>87.87</td><td>88.20</td><td>86.26</td></tr><tr><td>DCdetector</td><td><u>99.06</u></td><td><u>96.60</u></td><td><u>51.84</u></td><td><u>97.39</u></td><td><u>93.17</u></td><td><u>91.64</u></td><td><u>95.15</u></td><td><u>91.66</u></td></tr><tr><td>Ours</td><td><u>98.92</u></td><td><u>95.05</u></td><td>51.58</td><td><u>96.49</u></td><td><u>90.97</u></td><td><u>88.72</u></td><td><u>90.66</u></td><td><u>88.49</u></td></tr><tr><td rowspan="3">SMAP</td><td>AnomalyTrans</td><td><u>99.05</u></td><td><u>96.41</u></td><td><u>51.39</u></td><td><u>98.68</u></td><td><u>96.32</u></td><td><u>94.07</u></td><td><u>95.52</u></td><td><u>93.77</u></td></tr><tr><td>DCdetector</td><td><u>99.21</u></td><td><u>97.02</u></td><td><u>51.46</u></td><td><u>98.64</u></td><td><u>96.03</u></td><td><u>94.18</u></td><td><u>95.13</u></td><td><u>93.46</u></td></tr><tr><td>Ours</td><td>99.03</td><td>96.29</td><td>49.34</td><td>94.27</td><td>93.59</td><td>92.02</td><td>92.06</td><td>90.70</td></tr><tr><td rowspan="3">SWaT</td><td>AnomalyTrans</td><td>98.51</td><td>94.22</td><td><u>53.03</u></td><td>90.88</td><td>97.73</td><td><u>96.32</u></td><td>97.99</td><td><u>94.39</u></td></tr><tr><td>DCdetector</td><td><u>99.09</u></td><td><u>96.33</u></td><td>52.40</td><td><u>97.67</u></td><td><u>98.43</u></td><td><u>96.96</u></td><td>96.95</td><td>94.34</td></tr><tr><td>Ours</td><td><u>98.97</u></td><td><u>95.93</u></td><td><u>56.26</u></td><td><u>97.79</u></td><td><u>98.14</u></td><td>95.00</td><td><u>98.17</u></td><td><u>95.02</u></td></tr><tr><td rowspan="3">PSM</td><td>AnomalyTrans</td><td>98.68</td><td>97.37</td><td><u>55.35</u></td><td>80.85</td><td><u>91.68</u></td><td><u>93.00</u></td><td>88.71</td><td><u>90.71</u></td></tr><tr><td>DCdetector</td><td>98.95</td><td>97.94</td><td>54.71</td><td>82.93</td><td>91.55</td><td>92.93</td><td>88.41</td><td>90.58</td></tr><tr><td>Ours</td><td><u>99.06</u></td><td><u>98.32</u></td><td><u>55.53</u></td><td><u>85.06</u></td><td><u>94.15</u></td><td><u>95.09</u></td><td><u>90.77</u></td><td><u>92.67</u></td></tr><tr><td rowspan="3">SMD</td><td>AnomalyTrans</td><td>98.75</td><td>87.18</td><td><u>54.36</u></td><td>90.12</td><td>74.95</td><td><u>73.00</u></td><td>78.71</td><td><u>70.71</u></td></tr><tr><td>DCdetector</td><td><u>98.75</u></td><td><u>84.95</u></td><td>51.36</td><td>88.92</td><td>70.19</td><td>65.49</td><td>68.19</td><td>63.57</td></tr><tr><td>Ours</td><td><u>99.34</u></td><td><u>92.30</u></td><td><u>59.19</u></td><td><u>93.51</u></td><td><u>79.11</u></td><td><u>75.41</u></td><td><u>79.09</u></td><td><u>75.41</u></td></tr></tbody></table>

<table><caption>**Table 4**
Multi-metric results on NIPS-TS datasets. All results in %. Best results in **bold**, second-best **underlined**.</caption><thead><tr><th>Dataset</th><th>Method</th><th>Acc</th><th>P</th><th>R</th><th>F1</th><th>Aff-P</th><th>Aff-R</th><th>R_A_R</th><th>R_A_P</th><th>V_ROC</th></tr></thead><tbody><tr><td rowspan="3">NIPS-TS-SWAN</td><td>AnomalyTrans</td><td>84.57</td><td>90.71</td><td>47.43</td><td>62.29</td><td><strong>58.45</strong></td><td><strong>9.49</strong></td><td>86.42</td><td>93.26</td><td>84.81</td></tr><tr><td>DCdetector</td><td><u>85.94</u></td><td><u>95.48</u></td><td><u>59.55</u></td><td><u>73.35</u></td><td><u>50.48</u></td><td><u>5.63</u></td><td><u>88.06</u></td><td><u>94.71</u></td><td><u>86.25</u></td></tr><tr><td>Ours</td><td><u>86.10</u></td><td><u>95.93</u></td><td><u>59.91</u></td><td><u>73.76</u></td><td><u>58.22</u></td><td><u>6.72</u></td><td><u>88.15</u></td><td><u>94.85</u></td><td><u>86.36</u></td></tr><tr><td rowspan="3">NIPS-TS-GECCO</td><td>AnomalyTrans</td><td>98.03</td><td>25.65</td><td>28.48</td><td>29.09</td><td>49.23</td><td>81.20</td><td>56.35</td><td>22.53</td><td>55.45</td></tr><tr><td>DCdetector</td><td><u>98.56</u></td><td><u>38.25</u></td><td><u>59.73</u></td><td><u>46.63</u></td><td><u>50.05</u></td><td><u>88.55</u></td><td><u>62.95</u></td><td><u>34.17</u></td><td><u>62.41</u></td></tr><tr><td>Ours</td><td><u>98.68</u></td><td><u>42.41</u></td><td><u>70.00</u></td><td><u>52.82</u></td><td><u>57.11</u></td><td><u>93.09</u></td><td><u>64.96</u></td><td><u>38.01</u></td><td><u>66.87</u></td></tr></tbody></table>

without proper integration mechanisms is suboptimal. Remarkably, the complete MAAT model, which combines Sparse Attention and Mamba-SSM through a dynamic Gated Attention mechanism (Eqs. (8)–(9)), achieves a net F1 improvement of nearly 2% over the baseline, fueled by a modest precision gain of around 0.6% and a significant recall enhancement of roughly 3.5%. This adaptive gating effectively balances the contributions of precision and long-term pattern refinement, robustly mitigating noise while preserving critical anomaly signals within the complex SMD environment.

For the **MSL** dataset, which comprises sensor and actuator data characterized by high variability and transient noise, the baseline Anomaly Transformer demonstrates strong recall but moderate precision, resulting in an F1-score of approximately 93.93%. However, it encounters challenges with false positives induced by noise. The addition of Gating alone (AnomalyTrans+Gating) yields notable improvements, with precision increasing to 91.81% and recall to 97.59%, resulting in an F1-score of 94.61% - a significant 0.68% improvement over the baseline. The introduction of Sparse Attention (AnomTr+SA) alleviates noise issues, yielding a precision improvement of around 0.7%, albeit at the expense of a 2% reduction in recall, which ultimately lowers the F1-score by about 1.1%. This trade-off occurs because Sparse Attention effectively filters out noise but inadvertently excludes crucial short-term patterns. The standalone Mamba model demonstrates strong capabilities with a precision of 92.06% and recall of 97.59%, achieving an F1-score of 94.74%. When combined with Sparse Attention (Mamba+SA), we observe further improvement in recall to 98.07% while maintaining the same precision, resulting in an enhanced F1-score of 94.97%. This suggests that Mamba effectively captures long-range dependencies while Sparse Attention helps focus on locally relevant patterns. The integration of Mamba-SSM with the Anomaly Transformer (AnomTr+mamba) enhances precision to 92.17% while maintaining competitive recall at 96.00%, resulting in a solid F1 improvement to 94.05%. The comprehensive MAAT model synthesizes these advancements through Gated Attention, achieving the highest F1-score of 95.05% - a gain of 1.12% over the baseline, driven by maintaining strong precision at 92.06% and achieving the highest recall of 98.33%. During instances of transient noise, the adaptive gating mechanism (Eq. (8)) emphasizes the denoised outputs of Mamba

while preserving the localized anomaly signals from Sparse Attention. This balanced integration strengthens MAAT's robustness against short-lived disturbances, significantly enhancing anomaly detection in highly dynamic environments.

The **SMAP** dataset, which comprises satellite telemetry data characterized by long-range dependencies and subtle anomalies, underscores MAAT's ability to balance global context with localized anomaly detection. The Anomaly Transformer achieves an almost perfect recall of 99.41% but suffers from overfitting, which limits its precision to 93.59%, resulting in an F1-score of 96.41%. The addition of Gating alone (AnomalyTrans+Gating) maintains similar performance with precision at 93.60%, recall at 99.35%, and F1-score at 96.39%, suggesting that adaptive feature fusion provides limited benefits on this dataset. To mitigate overfitting, Sparse Attention addresses redundant global interactions (see Eq. (3)), although this leads to slightly weaker recall of 99.14% and a minor decrease in F1-score to 96.26%. The standalone Mamba model achieves comparable results to the baseline with precision of 93.57%, recall of 99.30%, and F1-score of 96.35%. When combined with Sparse Attention (Mamba+SA), performance remains stable with precision at 93.58%, recall at 99.36%, and F1-score at 96.39%. Notably, the combination of Anomaly Transformer with Mamba (AnomTr+mamba) yields the most significant improvement, with precision substantially increasing to 95.59% while maintaining a competitive recall of 98.62%, resulting in the highest F1-score of 97.08%. This suggests that incorporating state space modeling into the Transformer architecture effectively balances precision and recall for this dataset. The complete MAAT model harmonizes these strengths through Gated Attention (refer to Eqs. (8)–(9)), achieving a final precision of 94.75%, a recall of 99.33%, and an F1-score of 96.99%, exceeding the baseline by 0.58% but slightly underperforming compared to AnomTr+mamba. This enhancement is propelled by the gating mechanism, which prioritizes Mamba's global context for slow-evolving anomalies while leveraging Sparse Attention's local focus for abrupt changes. This adaptability enables MAAT to effectively capture both transient and long-term anomalies, making it well-suited to address the unique challenges presented by the SMAP dataset, though further optimization of the Mamba integration could potentially yield even better results.
The SWaT dataset, which includes 51-dimensional sensor data from a complex water treatment system, highlights the importance of capturing inter-sensor dependencies for effective anomaly detection. The baseline Anomaly Transformer achieves an impressive recall of 99.41%; however, it faces challenges with false positives, resulting in a precision of 93.59% and an F1-score of 96.41%. The addition of Gating alone (AnomalyTrans+Gating) significantly improves recall to a perfect 100% but substantially reduces precision to 83.53%, causing the F1-score to drop to 91.03%. This suggests that while gating helps capture more anomalies, it struggles with discrimination in this complex multi-sensor environment. The introduction of Sparse Attention (AnomTr+SA) also reduces precision to 89.53% and slightly decreases recall to 98.86%, resulting in an F1-score drop to 93.96%, as this approach fails to model critical cross-sensor relationships adequately. The standalone Mamba model demonstrates remarkable capabilities, maintaining a strong precision of 92.77% while achieving perfect recall of 100%, resulting in an impressive F1-score of 95.98%. When combined with Sparse Attention (Mamba+SA), performance further improves with precision increasing to 93.26% while maintaining perfect recall, yielding an enhanced F1-score of 96.51% that surpasses the baseline. This suggests that the state space model effectively captures the complex temporal dependencies in the water treatment system while sparse attention helps focus on locally relevant patterns. The integration of Mamba-SSM with the Anomaly Transformer (AnomTr+mamba) achieves the best performance with precision at 93.33%, perfect recall at 100%, and the highest F1-score of 96.55%, by effectively capturing complex interdependencies while filtering out redundant sensor noise. The complete MAAT model strategically combines these mechanisms through Gated Attention, achieving identical precision and recall values, with a marginally lower F1-score of 96.50%. This development underscores Mamba's ability to recognize the limitations of sparse attention, ensuring that MAAT maintains a balanced approach to precision and recall in a multivariate anomaly detection context, though the simpler AnomTr+mamba variant performs slightly better on this specific dataset.

The PSM dataset, consists of 25-dimensional sensor data characterized by substantial noise, underscores the importance of reducing false positives while ensuring effective anomaly detection. The baseline Anomaly Transformer exhibits commendable performance, attaining an F1-score of 97.47% with precision of 97.14% and recall of 97.81%. However, it suffers from noise-induced misclassifications in this high-dimensional environment. The addition of Gating alone (AnomalyTrans+Gating) maintains similar performance with minimal changes, achieving precision of 97.10%, recall of 97.61%, and an F1-score of 97.35%, suggesting that adaptive feature fusion provides limited benefits for this dataset. In contrast, Sparse Attention (AnomTr+SA) maintains competitive precision at 97.27% while significantly improving recall to 99.37%, consequently elevating the F1-score to 98.31%. This enhancement is due to its localized attention windows (Eq. (3)), which effectively focus on critical time steps in this noisy environment. The standalone Mamba model demonstrates strong performance with precision of 97.10% and substantially improved recall of 98.72%, resulting in an F1-score of 97.90%. When combined with Sparse Attention (Mamba+SA), precision increases to 97.41% with a slight reduction in recall to 98.37%, maintaining a similar F1-score of 97.89%. The integration of Mamba-SSM with the Anomaly Transformer (AnomTr+mamba) maintains competitive precision at 97.41% and recall at 98.37%, resulting in an F1-score of 97.89%. The comprehensive MAAT model combines these strengths through Gated Attention (Eqs. (8)–(9)), resulting in a balanced precision of 97.48%, an excellent recall of 99.17%, and the highest F1-score of 98.32%. This adaptability is essential in the noisy, high-dimensional context of PSM, where traditional attention mechanisms often struggle to identify true anomalies. Additionally, the Association Discrepancy metric (Eq. (10)) refines anomaly detection by penalizing deviations from expected sensor dependencies, thereby reducing false positives. These findings reinforce the effectiveness of MAAT in dynamically

balancing precision, recall, and robustness across a range of time-series anomaly detection tasks, with the full model outperforming all individual components on this challenging dataset.

The NIPS-TS-GECCO dataset is a benchmark for drinking water quality, characterized by sporadic, high-frequency anomalies and noise from IoT sensors. This dataset highlights the limitations of the baseline Anomaly Transformer, which attains an F1-score of only 29.09%. The addition of Gating alone (AnomTr+Gating) dramatically reduces precision to just 14.01% while substantially improving recall to 54.25%, resulting in a decreased F1-score of 22.27%. This suggests that simple gating mechanisms struggle with discriminating true anomalies from noise in this challenging environment. The standalone Mamba model performs poorly on this dataset, with precision plummeting to 5.29% despite achieving the highest recall of 62.19%, resulting in the lowest F1-score of just 9.75%. However, when Mamba is combined with Sparse Attention (Mamba+SA), performance dramatically improves with precision rising to 37.06% and recall maintained at 51.78%, yielding a competitive F1-score of 43.20%. This demonstrates that Mamba requires focused attention mechanisms to be effective on datasets with sporadic anomalies. Implementing Sparse Attention alone (AnomTr+SA) yields the most significant improvements, with precision reaching 45.19% and an exceptional recall of 84.25%, resulting in the highest F1-score of 58.82%. These enhancements are achieved by focusing on critical time steps using $\Omega_t$ (Eq. (3)), effectively reducing the conflation of transient anomalies with sensor noise. Conversely, incorporating Mamba-SSM with the Anomaly Transformer (AnomTr+mamba) results in more modest gains, with precision of 36.00% and recall of 51.78%, yielding an F1-score of 42.47%. The linear dependency modeling is less effective in addressing abrupt, short-term anomalies that characterize this dataset. The comprehensive MAAT model balances these approaches, achieving a precision of 42.41% and recall of 70.00%, resulting in an F1-score of 52.82% - lower than AnomTr+SA but significantly higher than most other variants. The gating mechanism prioritizes Sparse Attention during sudden events ($g \to 0$) while leveraging Mamba's contextual modeling during stable periods ($g \to 1$). In this context, the full MAAT architecture may be overparameterized for the specific characteristics of the GECCO dataset, where the simpler AnomTr+SA approach proves more effective for detecting the sporadic, short-lived anomalies in drinking water quality data.

The NIPS-TS-SWAN dataset, derived from solar photospheric vector magnetograms, focuses on detecting subtle anomalies within high-dimensional and temporally complex patterns of solar activity. The baseline Anomaly Transformer (AnomalyTrans) demonstrates moderate performance, achieving a precision of 90.71%, recall of 47.43%, and an F1-score of 62.29%. However, its dense self-attention mechanism has difficulty distinguishing rare solar anomalies from noisy, non-stationary signals. The addition of Gating alone (AnomTr+Gating) substantially improves model performance, increasing precision to 96.73% and recall to 59.04%, resulting in a significant F1-score improvement to 73.33% - an 11.04% absolute gain over the baseline. This demonstrates that adaptive feature fusion is particularly effective for solar magnetogram analysis. The standalone Mamba model shows similar impressive performance with precision of 96.78%, recall of 59.30%, and an F1-score of 73.54%, highlighting the effectiveness of state space modeling for capturing complex solar dynamics. When combined with Sparse Attention (Mamba+SA), performance marginally improves with precision rising to 96.89% and recall to 59.37%, yielding an F1-score of 73.63%. By utilizing Sparse Attention alone (AnomTr+SA), the model achieves excellent precision of 97.03% and recall of 59.28%, resulting in an F1-score of 73.60% - representing a 6.32% absolute improvement in precision and 11.85% in recall compared to the baseline. This variant effectively focuses on localized time windows critical for transient solar events. The AnomTr+mamba combination yields the highest precision of 97.06% with competitive recall of 59.34%, resulting in an F1-score of 73.65% - demonstrating how Mamba enhances global context for solar
<caption>**Table 5**</caption>

Ablation study of Precision, Recall, and F-Score over five datasets. “SA” stands for Sparse Attention; the best metrics in each column are in **bold** and the second-best are **underlined**.

<table><thead><tr><th rowspan="2">Dataset</th><th colspan="3">SMD</th><th colspan="3">MSL</th><th colspan="3">SMAP</th><th colspan="3">SWaT</th><th colspan="3">PSM</th></tr><tr><th>P</th><th>R</th><th>F</th><th>P</th><th>R</th><th>F</th><th>P</th><th>R</th><th>F</th><th>P</th><th>R</th><th>F</th><th>P</th><th>R</th><th>F</th></tr></thead><tbody><tr><td>AnomalyTrans</td><td>88.47</td><td>92.28</td><td>90.33</td><td>91.02</td><td>96.03</td><td>93.93</td><td>93.59</td><td><strong>99.41</strong></td><td>96.41</td><td><strong>93.59</strong></td><td><strong>99.41</strong></td><td>96.41</td><td>97.14</td><td>97.81</td><td>97.47</td></tr><tr><td>AnomalyTrans+Gating</td><td><strong>89.11</strong></td><td>93.09</td><td><strong>91.05</strong></td><td>91.81</td><td>97.59</td><td>94.61</td><td>93.60</td><td>99.35</td><td>96.39</td><td><strong>83.53</strong></td><td><strong>100.00</strong></td><td>91.03</td><td>97.10</td><td>97.61</td><td>97.35</td></tr><tr><td>Mamba</td><td>88.33</td><td>93.53</td><td>90.86</td><td><strong>92.06</strong></td><td>97.59</td><td>94.74</td><td>93.57</td><td>99.30</td><td>96.35</td><td>92.77</td><td><strong>100.00</strong></td><td>95.98</td><td>97.10</td><td>98.72</td><td>97.90</td></tr><tr><td>Mamba + SA</td><td>87.28</td><td>86.76</td><td>87.02</td><td><strong>92.06</strong></td><td><strong>98.07</strong></td><td><strong>94.97</strong></td><td>93.58</td><td><strong>99.36</strong></td><td>96.39</td><td>93.26</td><td><strong>100.00</strong></td><td><strong>96.51</strong></td><td><strong>97.41</strong></td><td>98.37</td><td>97.89</td></tr><tr><td>AnomTr+SA</td><td>88.47</td><td>89.89</td><td>89.18</td><td>91.67</td><td>94.05</td><td>92.84</td><td>93.55</td><td>99.14</td><td>96.26</td><td>89.53</td><td>98.86</td><td>93.96</td><td>97.27</td><td><strong>99.37</strong></td><td><strong>98.31</strong></td></tr><tr><td>AnomTr+mamba</td><td>87.52</td><td>90.04</td><td>88.76</td><td><strong>92.17</strong></td><td>96.00</td><td>94.05</td><td><strong>95.59</strong></td><td>98.62</td><td><strong>97.08</strong></td><td><strong>93.33</strong></td><td><strong>100.00</strong></td><td><strong>96.55</strong></td><td>97.41</td><td>98.37</td><td>97.89</td></tr><tr><td>Ours</td><td><strong>89.03</strong></td><td><strong>95.82</strong></td><td><strong>92.30</strong></td><td>92.06</td><td><strong>98.33</strong></td><td><strong>95.05</strong></td><td><strong>94.75</strong></td><td>99.33</td><td><strong>96.99</strong></td><td><strong>93.33</strong></td><td><strong>100.00</strong></td><td>96.50</td><td><strong>97.48</strong></td><td>99.17</td><td><strong>98.32</strong></td></tr></tbody></table>

pattern recognition. The full MAAT model integrates these components through Gated Attention, achieving a slightly lower precision of 95.93% but the highest recall of 59.91%, resulting in the best overall F1-score of 73.76%. This represents a 5.22% precision gain, 12.48% recall improvement, and 11.47% F1-score increase over the baseline. The gating mechanism adaptively balances attention, prioritizing Mamba's long-term dynamics during stable periods (when $g \to 1$) and emphasizing Sparse Attention's localized responses during rapid anomalies (when $g \to 0$). While the performance differences between the top-performing variants are small on this dataset, MAAT's balanced approach results in the most robust overall performance for detecting the complex patterns in solar activity data. The Association Discrepancy metric enhances anomaly detection by penalizing the differences between expected solar magnetic correlations and the observed sparse dependencies. This effectively identifies inconsistencies in the alignments of magnetic flux tubes. However, despite these improvements, MAAT's recall rate is still slightly lower than IForest's. This demonstrates a precision-recall trade-off, in which the model focuses on high-confidence anomalies rather than weaker signals. This is a critical consideration for real-world solar monitoring, where it is essential to minimize false positives.

### Impact of block-wise sparse attention on anomaly transformer performance

To isolate the effect of replacing dense self-attention with block-wise sparse attention (SA), we compare the vanilla Anomaly Transformer (AT) against AT+SA across eight benchmark datasets. Table 5 reports Precision (P), Recall (R) and F1 for each variant; here we analyze the qualitative behavior by dataset:

**SMD (Server-Machine Dataset).** SMD comprises multivariate resource-usage traces from dozens of machines, where anomalies manifest as slow, coordinated degradations spanning hundreds of timesteps. AT+SA's strict locality truncates cross-series dependencies, dropping recall by 2.4 percent (92.28 to 89.89%) and net F1 by 1.15 percent. This decline underscores that purely local windows cannot capture the subtle, multi-stream fault signatures that emerge only in longer-range correlations.

**MSL (Mars Science Laboratory).** MSL anomalies arise from slow drifts in rover instrumentation, often correlated across sensor arrays. With SA, AT loses visibility into these distributed trends, reducing recall by 2.0 percent and F1 by 1.09 percent. The marginal precision gain (91.02 to 91.67%) reflects cleaner local reconstructions, but at the expense of missing larger drift patterns.

**SMAP (Soil Moisture Active Passive).** SMAP features mixed-scale anomalies: isolated spikes superimposed on seasonal drifts. AT+SA yields only a slight F1 drop -0.15 percent because AT's dense attention already excels at spike detection, and the residual drift component can still be partially captured via local context when drifts are slow relative to block size.

**SWaT (Secure Water Treatment).** SWaT events involve coordinated valve and sensor behavior over extended intervals. AT+SA severs these long-term dependencies, causing recall to fall from 99.41 to 98.86% and F1 to drop by 2.45 percent. The loss of cross-component context highlights the importance of global modeling for industrial control anomalies.

**PSM (Pump Sensor Monitoring).** PSM records a single-pump vibration signal with sharp, transient pressure spikes. Here, AT+SA's strict locality is an advantage: recall increases from 97.81 to 99.37% and F1 by +0.84 percent. The model can focus exclusively on immediate neighbors, yielding crisper detection of short-lived anomalies without dilution by distant noise.

**SWAN and GECCO.** These synthetic tasks combine periodic bursts with long-range dependencies up to 64 K steps. AT+SA produces modest F1 gains (+1.0 to +1.5 pts) by capturing the periodic components, but its inability to model the power-law drift components limits overall improvement.

**Hybrid drift+noise (controlled synthetic series).** In mixed scenarios of periodic spikes plus gradual drift, AT+SA reduces reconstruction error on the spike component, improving local recall by 1.2 pts, but fails to track the drift—manifesting as elevated reconstruction residuals during slow trend shifts.

**Key Insight:** Block-wise sparse attention sharpened local anomaly detection (e.g. PSM, synthetic bursts) by concentrating model capacity on immediate neighbors, but invariably degrades performance on multi-series or long-term drift anomalies (SMD, MSL, SWaT). This differential effect motivates the subsequent integration of a global, linear-time Mamba-SSM branch and adaptive gating to recover lost context while retaining SA's local precision.

## 6.2. Reconstruction loss

To rigorously evaluate the reconstruction performance of our method against the Anomaly Transformer baseline, we conducted a comparative analysis of their respective reconstruction losses, as illustrated in Fig. D.2. We computed the logarithmic difference between the two losses for each batch, defined as:

$$ \Delta L_i = \log(L_i^{AT}) - \log(L_i^{MAAT}) \qquad (11) $$

where $L_i^{AT}$ and $L_i^{MAAT}$ represent losses for each batch $i$. The results are visualized in Fig. D.2, with green columns indicating lower loss for our method ($\Delta L_i > 0$) and red columns showing a superior performance by AT ($\Delta L_i < 0$). This illustration highlights the advantages of our approach during training.

MAAT outperforms AT on the SMD dataset with an F1 score of 92.30%, benefiting from effective reconstruction loss minimization (Fig. D.2(a)). The differential analysis mainly shows positive $\Delta L_i$, underscoring the effectiveness of Sparse Attention and Mamba-SSM in capturing critical time steps and long-range dependencies. Minor precision fluctuations do not compromise robustness, as evidenced by an Affiliation Recall of 93.51% and a Range-based Recall of 79%.

On the MSL dataset, MAAT also achieves lower reconstruction loss (Fig. D.2(a)), with a predominance of green bars in the $\Delta L_i$ plot, indicating its capacity to manage noisy patterns from Mars rover sensors. Despite slight precision trade-offs, MAAT shows significantly higher recall (96.03%) and robust Affiliation Recall (96.49%).

In the SMAP dataset, MAAT excels with an F1 score of 96.99%, consistently maintaining lower reconstruction loss (Fig. D.2(f)). The logarithmic difference reveals a dominance of green bars, highlighting
<table><caption>**Table 6**
Ablation study Precision, Recall, and F1-Score on NIPS datasets. “SA” stands for Sparse Attention; the best metrics are in **bold**.</caption><thead><tr><th rowspan="2">Dataset<br>Metric</th><th colspan="3">NIPS SWaN</th><th colspan="3">NIPS GECCO</th></tr><tr><th>P</th><th>R</th><th>F</th><th>P</th><th>R</th><th>F</th></tr></thead><tbody><tr><td>AnomalyTrans</td><td>90.71</td><td>47.43</td><td>62.29</td><td>25.65</td><td>28.48</td><td>29.09</td></tr><tr><td>AnomTr+Gating</td><td>96.73</td><td>59.04</td><td>73.33</td><td>14.01</td><td>54.25</td><td>22.27</td></tr><tr><td>Mamba</td><td>96.78</td><td>59.30</td><td>73.54</td><td>05.29</td><td>62.19</td><td>09.75</td></tr><tr><td>Mamba + SA</td><td>96.89</td><td>59.37</td><td>73.63</td><td>37.06</td><td>51.78</td><td>43.20</td></tr><tr><td>AnomTr+SA</td><td>97.03</td><td>59.28</td><td>73.60</td><td>45.19</td><td>84.25</td><td>58.82</td></tr><tr><td>AnomTr+mamba</td><td>97.06</td><td>59.34</td><td>73.65</td><td>36.00</td><td>51.78</td><td>42.47</td></tr><tr><td>Ours</td><td>95.93</td><td>59.91</td><td>73.76</td><td>42.41</td><td>70.00</td><td>52.82</td></tr></tbody></table>

MAAT's proficiency in identifying subtle anomalies in satellite teleme-try. Although there is a minor recall trade-off, precision gains enhance Affiliation Precision (49.34%).

Lastly, on the PSM dataset, MAAT achieves an F1 score of 98.32%, demonstrating its effectiveness with high-dimensional sensor data (Fig. D.2(c)). While facing occasional red bars in the $\Delta L_i$ plot, MAAT maintains superior Affiliation Recall (85.06%) and Range-based Precision (95.09%), ensuring accurate anomaly localization in noisy sequences.

## 7. Conclusions and future works

In this work, we introduced the Mamba Adaptive Anomaly Transform-er (MAAT), which enhances unsupervised time series anomaly detection for practical applications like industrial monitoring and en-vironmental sensing. MAAT effectively captures short- and long-term temporal dependencies by improving association discrepancy modeling with a new Sparse Attention mechanism and integrating a Mamba-Selective State Space Model (Mamba-SSM). Gated Attention mecha-nisms allow for a flexible combination of features from the original reconstruction and the Mamba-SSM output, striking a balance be-tween accuracy and complexity. Moreover, MAAT trains efficiently, making it suitable for resource-limited settings. Evaluation of bench-mark datasets has revealed that MAAT significantly surpasses alter-native methods, including the Anomaly Transformer and DCdetector, in both anomaly detection accuracy and generalization across various time series. It mitigates challenges such as sensitivity to short context windows and computational inefficiencies that have been prevalent in prior methodologies. Despite its efficiency in training, MAAT still has limitations. It is susceptible to hyperparameters, especially when balancing the reconstruction module with the Mamba-SSM pathway. Tuning these parameters is essential for optimizing performance across various datasets. Additionally, although we have designed our method to reduce the effects of noise and non-stationary conditions, its per-formance may decline in situations with very high noise or when abnormal patterns closely mimic normal ones. Finally, while MAAT shows reduced computational demands compared to some deep learn-ing options, further enhancement of its inference speed is necessary for real-time applications. There is potential for future research in several areas. We could explore adaptive, data-driven hyperparameter tuning to stabilize the model and boost its performance in various conditions. Incorporating online learning or incremental updates could enhance MAAT functionality in dynamic environments where quick anomaly detection is crucial. Additionally, exploring hybrid models that combine the strengths of reconstruction-based approaches with contrastive learning may yield better results, especially in challenging situations characterized by significant non-stationarity or noise. By pursuing these avenues, future work can build on MAAT and advance unsupervised time series anomaly detection in real-world applications.

### CRediT authorship contribution statement

**Abdellah Zakaria Sellam:** Conceptualization, Writing – original draft, Methodology. **Ilyes Benaissa:** Software, Data curation. **Abdel-malik Taleb-Ahmed:** Writing – review & editing, Validation, Investiga-tion. **Luigi Patrono:** Conceptualization. **Cosimo Distante:** Supervision, Funding acquisition.

### Declaration of competing interest

The authors declare that they have no known competing finan-cial interests or personal relationships that could have appeared to influence the work reported in this paper.

### Acknowledgments

The authors thank Mr. Arturo Argentieri from CNR-ISASI Italy for his technical contribution to the multi-GPU computing facilities. This research was partially funded by the Italian Ministry of Health, Italian Health Opera National Plan (Cohesion and Development Fund 2014–2020), trajectory 2 “eHealth, advanced diagnostics, medical device and mini invasiveness”, project “Sistema di Monitoraggio ed Analisi basato su intelligenza aRTificiale per pazienti affetti da scompenso CARdiaco cronico con dispositivi medici miniinvasivi e indossabili Evoluti – SMART CARE” (CUP F83C22001380006), by the European Union - Next Generation EU, PRIN 2022 PNRR call, under the project "Interactive digital twin solutions for cardiovascular disease Manage-ment, PReventiOn and treatment leVeraging the internet of things and Edge intelligence paradigms - IMPROVE, and funded in part by Future Artificial Intelligence Research—FAIR CUP B53C22003630006 grant number PE0000013.

## Appendix A. Dataset

We evaluate our model on seven benchmark datasets derived from real-world applications, emphasizing diverse temporal dependencies and anomaly types. Each dataset is structured as follows:

We evaluate MAAT across seven real-world telemetry benchmarks. The MSL (Mars Science Laboratory) dataset comprises sensor and actua-tor readings from NASA's rover, featuring mixed temporal dynamics — short-term actuator sequences and temperature spikes alongside long-term wear trends and mission-phase cycles — and includes both point anomalies (sudden sensor failures) and contextual anomalies (unex-pected actuator behavior) (NASA, 2018a). SMAP (Soil Moisture Active Passive) captures soil moisture telemetry from an Earth-observing satel lite, with dominant long-term patterns such as seasonal moisture cycles and orbital shifts; its anomalies split roughly 62% point errors in telemetry and 38% contextual drifts across correlated sensors (NASA, 2018b). PSM (eBay Server Machines) provides 25-dimensional, second-level CPU, memory, and network I/O metrics with daily periodicity, where both point hardware spikes and contextual irregular resource usages occur (Huang et al., 2021). The SMD (Server Machine Dataset) logs minute-level CPU/memory and weekly workload cycles on 28 machines, exhibiting collective failures across nodes and contextual maintenance deviations (Su et al., 2019). SWaT (Secure Water Treat-ment) is a high-resolution industrial control set of 51 sensor streams (flow rates, chemical dosages, pressures) sampled every second, with point anomalies from tampered readings or cyber-attacks and cascad-ing process failures as collective anomalies (Mathur and Tippenhauer, 2016). NIPS-TS-SWAN (Solar Weather) tracks solar magnetic dynamics hourly, plus minute-level flux sequences, revealing subtle contextual misalignments and collective flare precursors (NASA, 0000). Finally, NIPS-TS-GECCO (Drinking Water Quality) records minute-level pH,
<caption>**Table A.7**</caption>

Details of benchmark datasets. AR (anomaly ratio) represents the abnormal proportion of the whole dataset.

<table><caption>**Table B.8**</caption><thead><tr><th>Benchmark</th><th>Temporal Scope</th><th>Dim.</th><th>#Training</th><th>#Test (Labeled)</th><th>AR (%)</th><th>Anomaly Types</th></tr></thead><tbody><tr><td>MSL</td><td>Mixed</td><td>55</td><td>58,317</td><td>73,729</td><td>10.5</td><td>Contextual, Point</td></tr><tr><td>SMAP</td><td>Mixed (with dominant long-term patterns)</td><td>25</td><td>135,183</td><td>427,617</td><td>12.8</td><td>Point (62%), Contextual (38%)</td></tr><tr><td>PSM</td><td>Short-term</td><td>25</td><td>132,481</td><td>87,841</td><td>27.8</td><td>Collective, Point</td></tr><tr><td>SMD</td><td>Mixed</td><td>38</td><td>708,405</td><td>708,420</td><td>4.2</td><td>Contextual, Collective</td></tr><tr><td>SWaT</td><td>Short-term</td><td>51</td><td>495,000</td><td>449,919</td><td>12.1</td><td>Point (cyber-attacks)</td></tr><tr><td>NIPS-TS-GECCO</td><td>Short-term</td><td>9</td><td>69,260</td><td>69,261</td><td>1.1</td><td>Point</td></tr><tr><td>NIPS-TS-SWAN</td><td>Long-term</td><td>38</td><td>60,000</td><td>60,000</td><td>32.6</td><td>Collective, Contextual</td></tr></tbody></table>

Hyperparameters for MAAT model across datasets.

<table><thead><tr><th>Dataset</th><th>Window Size</th><th>Batch Size</th><th>d<sub>model</sub></th><th>Anomaly Ratio (%)</th></tr></thead><tbody><tr><td>SMD</td><td>100</td><td>128</td><td>512</td><td>0.5</td></tr><tr><td>MSL</td><td>100</td><td>256</td><td>512</td><td>0.85</td></tr><tr><td>SMAP</td><td>105</td><td>128</td><td>512</td><td>0.5</td></tr><tr><td>PSM</td><td>100</td><td>128</td><td>512</td><td>1.0</td></tr><tr><td>SWaT</td><td>100</td><td>256</td><td>512</td><td>0.5</td></tr><tr><td>NIPS-TS-GECCO</td><td>100</td><td>32</td><td>512</td><td>0.5</td></tr><tr><td>NIPS-TS-SWAN</td><td>100</td><td>128</td><td>512</td><td>0.9</td></tr></tbody></table>

turbidity, and chlorine readings over days, combining sporadic point malfunctions with longer-term contamination trends (Miller et al., 2018).

Table A.7 shows a summary of each benchmarking dataset.

## Appendix B. Hyperparameters for model training

Table B.8 outlines the hyperparameters utilized for training the MAAT model across various datasets. The dimensions of the window, which set the length of the input sequence processed at each step, is set to 100 for most datasets. However, for SMAP, a slightly larger window of 105 is employed to better capture long-range dependencies. The batch size is tailored to the specific characteristics of each dataset and the computational constraints, with values ranging from 32 (for NIPS-TS-GECCO) to 256 (for MSL and SWaT). This range guarantees effective gradient updates while preserving training stability. The model dimension ($d_{model}$) remains consistently set at 512 for all datasets, defining the size of feature representations and ensuring consistency in learned embeddings. Additionally, the anomaly ratio, representing the proportion of data points identified as anomalies in each dataset, ranges from 0.5% to 1%, which affects the model's responsiveness to infrequent events. These hyperparameters have been carefully chosen to enhance performance across various anomaly detection contexts.

### AR Threshold Selection

The threshold selection process follows these steps:

* We first calculate anomaly scores (Eq. (1)) for all points in the unlabeled validation subset after completing model training.

* Upon analyzing the frequency distribution of these scores, we observed that they naturally separate into two clusters: - A large cluster corresponding to normal data points with lower anomaly scores. - A smaller cluster representing potential anomalies with higher anomaly scores.

* This smaller cluster contains approximately *r* time points, where *r* converges to dataset-specific values: 0.1% for SWaT, 0.5% for SMD, and 1% for other datasets.

* Given that test data remains inaccessible in practical deployments, we establish a fixed threshold value $\delta$ that ensures all validation set points with anomaly scores exceeding $\delta$ (comprising proportion *r* of the data) are flagged as anomalies.

In operational settings, anomaly detection capacity is ultimately bounded by available human resources for investigation. Therefore, controlling the detection rate through ratio parameter *r* provides a more practical approach than absolute thresholds, allowing organizations to align anomaly detection volume with their investigative capabilities.

## Appendix C. Evaluation metrics

Evaluating anomaly detection in time series data requires metrics point-wise performance and capturing anomalies' temporal continuity. This work uses traditional and specialized point-based metrics to evaluate contiguous anomaly segments.

### C.0.1. Point-based metrics

The standard metrics include Precision, Recall, and F1 Score, calculated using the counts of true positives (TP), false positives (FP), and false negatives (FN). The F1 Score is the harmonic mean of Precision and Recall (Chandola et al., 2009).

### C.0.2. Affiliation metrics: Aff-P and Aff-R

These metrics evaluate partial detection within multi-step anomaly segments.

**Affiliation precision (Aff-P):** Measures the fraction of predicted anomalies within true anomaly ranges:

$$ \text{Aff-P} = \frac{\sum_{t \in \mathcal{P}} 1\{t \in \mathcal{T}\}}{|\mathcal{P}|}, \qquad (C.1) $$

where $\mathcal{P}$ is the predicted anomalies, $\mathcal{T}$ is the true anomalies, and $1\{\cdot\}$ is the indicator function.

**Affiliation recall (Aff-R):** Measures the fraction of true anomalies detected:

$$ \text{Aff-R} = \frac{\sum_{t \in \mathcal{T}} 1\{t \in \mathcal{P}\}}{|\mathcal{T}|}. \qquad (C.2) $$

### C.0.3. Range-based metrics

These assess detection over entire anomaly segments.

**Range-based anomaly recall (R_A_R):** A true anomaly range $R_i^{true}$ is detected if overlap with any predicted range exceeds threshold $\tau$:

$$ R_{A_R} = \frac{\sum_{j=1}^{N_{true}} 1\{\max_j \text{Overlap}(R_i^{true}, R_j^{pred}) \ge \tau\}}{N_{true}}. \qquad (C.3) $$

**Range-based anomaly precision (R_A_P):**

$$ R_{A_P} = \frac{\sum_{j=1}^{N_{pred}} 1\{\max_j \text{Overlap}(R_j^{pred}, R_i^{true}) \ge \tau\}}{N_{pred}}. \qquad (C.4) $$

### C.0.4. Volume-based metrics: V_ROC and V_PR

These incorporate anomaly duration into evaluation.
<table><caption>**Table E.9**
Comparison of model complexity across different time series anomaly detection models.</caption><thead><tr><td>Model</td><td>Parameters</td><td>FLOPs</td></tr></thead><tbody><tr><td>AnomalyTransformer</td><td>1.64M</td><td>0.33 GFLOPs</td></tr><tr><td>AnomalyTransformer+Sparse Attention</td><td>1.59M</td><td>0.31 GFLOPs</td></tr><tr><td>DCdetector</td><td>0.91M</td><td>3.58 GFLOPs</td></tr><tr><td>MAAT (Ours)</td><td>2.19M</td><td>0.41 GFLOPs</td></tr></tbody></table>

**Volume-based ROC (V_ROC):** Adjusts TPR and FPR by anomaly volume:

$$ 
\begin{aligned}
TPR_{vol} &= \frac{\text{Volume of Correct Detections}}{\text{Total Volume of True Anomalies}} \\
FPR_{vol} &= \frac{\text{Volume of False Detections}}{\text{Total Volume of Normal Data}}
\end{aligned}
$$

The V_ROC curve plots TPR<sub>vol</sub> vs. FPR<sub>vol</sub>.

**Volume-based precision-recall (V_PR):** Volume-weighted precision and recall are defined as follows:

$$ 
\begin{aligned}
Precision_{vol} &= \frac{\text{Volume of Correct Detections}}{\text{Volume of All Detections}} \\
Recall_{vol} &= \frac{\text{Volume of Correct Detections}}{\text{Total Volume of True Anomalies}}
\end{aligned}
$$

The V_PR curve plots Precision<sub>vol</sub> vs. Recall<sub>vol</sub>.

In summary, while point-based metrics offer a basic assessment, affiliation, range-based, and volume-based metrics ((C.1), (C.2), (C.3), (C.4)) provide a comprehensive evaluation by accounting for temporal structure and anomaly duration (Hundman et al., 2018; Blazquez-Garcia et al., 2019).

## Appendix D. Reconstruction loss

See Fig. D.2.

## Appendix E. Reconstruction loss vs window size

See Fig. E.3.

### E.1. Sparse attention impact for short and long sequences

See Fig. E.4 and Table E.9.

## Appendix F. Sparse attention computational redundancy elimination vs performance penalty

Fig. F.5 contains two different scenarios that illustrate distinct anomaly patterns commonly encountered in time series data.

The **spike anomaly scenario** depicts a sudden, short-duration deviation where signal values abruptly surge beyond normal operational parameters before rapidly returning to baseline behavior. Figs. F.5(a) and F.5(b) demonstrate how Sparse Attention maintains exceptional detection performance despite significantly reduced computational demands compared to Full Attention. This selective attention approach reduces computational complexity by approximately 90% (from 5.12 MFLOPs to 0.52 MFLOPs) while achieving more precise anomaly detection. The visualization reveals that Sparse Attention (solid green line) produces sharper, more responsive anomaly scores precisely aligned with the ground truth anomaly at time steps 65–75 (highlighted in red), while Full Attention (dashed blue line) generates a more erratic response with higher fluctuations throughout the time series. In the anomaly scores comparison, both approaches detect the true anomaly, with Sparse Attention showing a cleaner signal that more clearly rises above its threshold (dotted green line) during the anomaly period and remains below threshold during normal operation. In contrast, Full Attention shows more variability throughout the time series with its

scores frequently approaching its threshold (dotted blue line) even outside the anomaly period.

In contrast, the **trend anomaly** scenario represents a gradual, sustained directional shift where values progressively deviate from expected patterns over an extended period, indicating systematic drift rather than instantaneous disruption. As shown in Figs. F.5(c) and F.5(d), Sparse Attention achieves remarkable efficiency while using fewer computational resources. The time series visualization shows a clear upward trend in the signal (blue line) that begins around time step 65 and persists until approximately time step 115, as highlighted by the red shaded area marking the ground truth anomaly. During this period, the signal shifts from its baseline of approximately –0.5 to a sustained level around 0.3, with an initial spike reaching nearly 1.0 at the onset of the anomaly.

The anomaly scores comparison illustrates that both Sparse Attention (solid green line) and Full Attention (dashed blue line) successfully detect the trend anomaly, with their scores rising above their respective thresholds (dotted green and blue lines) throughout the anomaly period. Notably, both approaches show very similar performance during the actual anomaly, with scores consistently near 1.0 while the trend persists. However, after the anomaly ends (around time step 115), Full Attention shows a lingering elevated score around time step 125, indicating a slight delay in recognizing the return to normal conditions, while Sparse Attention returns more quickly to below-threshold values. The computational complexity comparison illustrates how the sparse mechanism reduces computational requirements from 5.12 MFLOPs to 0.67 MFLOPs (an 87% reduction) while maintaining comparable detection performance. This significant efficiency gain is achieved through the Sparse Attention model's ability to establish selective connections between current observations and key historical reference points, creating an adaptive temporal baseline against which gradual shifts become readily apparent.

The results obtained from these two different scenarios demonstrate how Sparse Attention overcomes Full Attention due to its selective computational approach that delivers both significantly reduced resource requirements and improved detection precision. The Sparse Attention mechanism's ability to focus computation exclusively on relevant patterns makes it particularly effective for various sequence lengths.

## Appendix G. Implementation details

The MAAT model was implemented using Python 3.8 and the PyTorch deep learning framework. PyTorch was chosen for its flexibility in defining custom architectures, efficient tensor operations, and strong support for GPU acceleration. The model was trained and evaluated on an NVIDIA RTX Titan GPU with 24 GB VRAM, enabling efficient parallel computation for high-dimensional time-series data.

To ensure stable and reproducible training, experiments were conducted in a controlled environment with fixed random seeds. The training process leveraged mixed-precision computation to optimize memory usage and speed, particularly beneficial for large-scale datasets such as SMD and SWaT. The implementation also utilized PyTorch's DataLoader for efficient batch processing, automatic differentiation via autograd, and hardware acceleration with `torch.cuda`.

The model was optimized using the Adam optimizer with weight decay regularization, and learning rate scheduling was applied to adapt to convergence dynamics. All experiments were run on a system equipped with Intel Xeon CPUs and 64 GB RAM to handle large dataset preprocessing and training workloads efficiently.

## Appendix H. MAAT algorithm

This appendix contains details about the MAAT block algorithm used in the study.
<figure><img src="image_5.png" /><figcaption>(a) MSL Reconstruction Loss (Ours vs. Anomaly Transformer)</figcaption></figure>

<figure><img src="image_6.png" /><figcaption>(b) MSL Difference in Reconstruction Loss</figcaption></figure>

<figure><img src="image_7.png" /><figcaption>(c) PSM Reconstruction Loss (Ours vs. Anomaly Transformer)</figcaption></figure>

<figure><img src="image_8.png" /><figcaption>(d) PSM Difference in Reconstruction Loss</figcaption></figure>

<figure><img src="image_9.png" /><figcaption>(e) SMAP Reconstruction Loss (Ours vs. Anomaly Transformer)</figcaption></figure>

<figure><img src="image_10.png" /><figcaption>(f) SMAP Difference in Reconstruction Loss</figcaption></figure>

<figure><img src="image_11.png" /><figcaption>(g) SMD Reconstruction Loss (Ours vs Anomaly Transformer)</figcaption></figure>

<figure><img src="image_12.png" /><figcaption>(h) SMD Difference in Reconstruction Loss</figcaption></figure>

<caption>**Fig. D.2.** Comparison of reconstruction loss between our model and the Anomaly Transformer across different datasets. Left column: Reconstruction loss curves for both models. Right column: Difference in reconstruction loss.</caption>
<figure><img src="image_13.png" /><figcaption>Fig. E.3. Reconstruction loss sensitivity across different window sizes comparison between our model and the Anomaly Transformer across different datasets.</figcaption></figure>

<figure><img src="image_14.png" /><figcaption>Fig. E.4. Reconstruction loss comparison on two different datasets; AT and AT+SA refer to Anomaly Transformer and Anomaly Transformer + Sparse Attention respectively.</figcaption></figure>
<figure><img src="image_15.png" /><figcaption>Fig. F.5. Sparse attention Computational Redundancy Elimination vs Performance Penalty.</figcaption></figure>

**Algorithm 1 MAAT: Mamba Adaptive Anomaly Transformer with Sparse Attention.**

**Require:** Time series $x \in \mathbb{R}^{B \times L \times D}$

**Require:** Parameters: block_size, d_model, n heads, e layers, d state, d conv

**Ensure:** Reconstruction $x$, Anomaly scores: series, prior, $\sigma$

1: Initialize series_list $\leftarrow \emptyset$, prior_list $\leftarrow \emptyset$, $\sigma$-list $\leftarrow \emptyset$

2: $x_{orig} \leftarrow x$

▷ Preserve initial input

3: **for** i = 1 to e layers **do**

4: **Sparse Attention Processing:**

5: $x$, series, prior, $\sigma \leftarrow \text{sparse\_attn\_layer}(x, \text{block\_size}, \text{attn\_mask})$

▷ Compute sparse block-wise attention over windows of size block_size

6: **Mamba Skip Path:**

7: $x_{mamba} \leftarrow \text{MambaBlock}(x)$

▷ State-space model capturing long-range dependencies

8: $x_{skip} \leftarrow x_{mamba} + x_{orig}$

▷ Residual connection

9: $x_{skip} \leftarrow \text{LayerNorm}(x_{skip})$

10: **Adaptive Gating:**

11: $g \leftarrow \sigma(\text{Linear}([x; x_{skip}]))$

▷ Gated feature fusion

12: $x \leftarrow g \odot x_{skip} + (1 - g) \odot x$

▷ Learnable blend of skip and main path

13: **State Update:**

14: $x_{orig} \leftarrow x$

▷ Update input for next layer

15: Append series to series_list

16: Append prior to prior_list

17: Append $\sigma$ to $\sigma$-list

18: **end for**

19: **if** norm $\neq$ None **then**

20: $x \leftarrow \text{LayerNorm}(x)$

21: **end if**

22: **return** $x$, series_list, prior_list, $\sigma$-list

## Data availability

Data used are publicly available, and code repository is indicated in cover letter.

## References

Benali, A.A.E., Cafaro, M., Epicoco, I., Pulimeno, M., Schioppa, E.J., 2024. Just in time transformers. IEEE Access 12, 178751–178767. http://dx.doi.org/10.1109/ACCESS. 2024.3504862.

Benschoten, A.V., Ouyang, A., Bischoff, F., Marrs, T., 2020. MPA: a novel cross-language API for time series analysis. J. Open Source Softw. 5 (49), 2179. http://dx.doi.org/10.21105/joss.02179.

Blazquez-Garcia, A., Ruiz, J., Pazos, I., Lozano, J.A., 2019. Multivariate anomaly detection in time series data using causal convolutional networks. IEEE Access 7, 130463–130473.

Box, G.E.P., Jenkins, G.M., 1970. Time Series Analysis: Forecasting and Control. Holden-Day, San Francisco.

Box, G.E., Jenkins, G.M., Reinsel, G.C., Ljung, G.M., 2015. Time series analysis: forecasting and control. John Wiley & Sons.

Chandola, V., Banerjee, A., Kumar, V., 2009. Anomaly detection: A survey. ACM Comput. Surv. 41 (3), 15:1–15:58.

Child, R., Gray, S., Radford, A., Sutskever, I., 2019. Generating long sequences with sparse transformers. URL https://arxiv.org/abs/1904.10509.

Distante, C., Fineo, L., Mainetti, L., Manco, L., Taccardi, B., Vergallo, R., 2022. HF-SCA: Hands-free strong customer authentication based on a memory-guided attention mechanisms. J. Risk Financ. Manag. 15 (8), 342.
Gu, A., Dao, T., 2023. Mamba: Linear-time sequence modeling with selective state spaces. arXiv preprint arXiv:2312.00752.

Gu, A., Dao, T., Suresh, A.T., Ré, C., 2022. Efficiently modeling long sequences with structured state spaces. In: Advances in Neural Information Processing Systems (NeurIPS). URL https://arxiv.org/abs/2111.00396.

Guo, Y., Zhang, H., Liu, X., 2024. Efficient sparse attention for long sequence time-series forecasting. Sci. Rep. 14, 1-10. http://dx.doi.org/10.1038/s41598-024-66886-1.

Gupta, A., Dar, G., Goodman, S., Ciprut, D., Berant, J., 2021. Memory-efficient transformers via top-k attention. In: Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing. pp. 5796-5809.

Hinton, G.E., Salakhutdinov, R.R., 2006. Reducing the dimensionality of data with neural networks. In: Science, 313, (5786), American Association for the Advancement of Science, pp. 504-507.

Hochreiter, S., Schmidhuber, J., 1997. Long short-term memory. Neural Comput. 9 (8), 1735-1780.

Huang, S., Li, X., Hu, W., Liu, S., Peng, W., He, X., 2021. Practical approach to anomaly detection in multivariate time series with missing values. In: Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining. ACM, pp. 2162-2170.

Hundman, K., Constantinou, V., Laporte, C., Colwell, I., Soderstrom, T., 2018. Detecting spacecraft anomalies using LSTMs and nonparametric dynamic thresholding. In: Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining. pp. 387-395.

Jeong, Y., Yang, E., Ryu, J.H., Park, I., Kang, M., 2023. Anomalybert: Self-supervised transformer for time series anomaly detection using data degradation scheme. arXiv preprint arXiv:2305.04468.

Kingma, D.P., Welling, M., 2013. Auto-encoding variational bayes. arXiv preprint arXiv:1312.6114.

Kitaev, N., Kaiser, L., Levskaya, A., 2020. Reformer: The efficient transformer. Int. Conf. Learn. Represent. (ICLR) URL https://arxiv.org/abs/2001.04451.

Lai, G., Chang, W., Yang, Y., Liu, H., 2021. Revisiting deep learning for time series forecasting. In: Proceedings of the AAAI Conference on Artificial Intelligence.

Li, D., Chen, D., Jin, B., Shi, L., Goh, J., Ng, S.-K., 2019. MAD-gan: Multivariate anomaly detection for time series data with generative adversarial networks. In: International Conference on Artificial Neural Networks. Springer, pp. 703-716, URL https://arxiv.org/abs/1901.04997.

Liu, F.T., Ting, K.M., Zhou, Z.-H., 2008. Isolation forest. 2008 Eighth IEEE Int. Conf. Data Min. 413-422.

Malhotra, P., Ramakrishnan, A., Anand, G., Vig, L., Agarwal, P., Shroff, G., 2016. LSTM-based encoder-decoder for multi-sensor anomaly detection. In: Proceedings of the 2016 International Conference on Machine Learning and Applications. ICMLA, IEEE, pp. 409-414.

Mathur, A., Tippenhauer, N.O., 2016. SWaT: A water treatment testbed for research and training on ICS security. In: 2016 International Workshop on Cyber-Physical Systems for Smart Water Networks (CySWater). IEEE, pp. 31-36.

Miller, D.J., Nagaraj, A., Gerdes, R., Rieger, C., 2018. Anomaly detection in drinking water quality data from a real-world water distribution system. In: Proceedings of the Genetic and Evolutionary Computation Conference Companion. ACM, pp. 157-158.

NASA, 0000. Space Weather HMI Active Region Patches (SHARP) dataset, Available at: https://ntrs.nasa.gov/citations/20150003032.

NASA, 2018a. Mars Science Laboratory (MSL) dataset, Available at: https://github.com/nasa/telemanom.

NASA, 2018b. Soil Moisture Active Passive (SMAP) dataset, Available at: https://github.com/nasa/telemanom.

Rabiner, L., Juang, B.-H., 1986. Introduction to hidden Markov models. IEEE ASSP Mag. 3 (1), 4-16.

Radford, B.J., Apolonio, L.M., Trias, A.J., Simpson, J.A., 2018. Network traffic anomaly detection using recurrent neural networks. URL https://arxiv.org/abs/1803.10769.

Rasmussen, C.E., Williams, C.K.I., 2006. Gaussian Processes for Machine Learning. MIT Press, Cambridge, MA.

Schlegl, T., Seeböck, P., Waldstein, S.M., Langs, G., Schmidt-Erfurth, U., 2019. F-anogan: Fast unsupervised anomaly detection with generative adversarial networks. Med. Image Anal. 54, 30-44.

Scholkopf, B., Platt, J.C., Shawe-Taylor, J., Smola, A.J., Williamson, R.C., 2000. Support vector method for novelty detection. In: Advances in Neural Information Processing Systems. pp. 582-588.

Somepalli, G., Wu, Y., Balaji, Y., Vinzamuri, B., Feizi, S., 2021. Unsupervised anomaly detection with adversarial mirrored AutoEncoders. In: Proceedings of the 37th Conference on Uncertainty in Artificial Intelligence. pp. 1610-1619, URL https://arxiv.org/abs/2003.10713.

Su, Y., Zhao, Y., Niu, C., Liu, R., Sun, W., Pei, D., 2019. Robust anomaly detection for multivariate time series through stochastic recurrent neural network. In: Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining. ACM, pp. 2828-2837.

Taieb, S.B., Bontempi, G., Atiya, A.F., Sorjamaa, A., 2012. Machine learning strategies for time series forecasting. Lect. Notes Bus. Inf. Process. 138, 62-77.

Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, Ł., Polosukhin, I., 2017. Attention is all you need. Adv. Neural Inf. Process. Syst. 30.

Xu, H., Chen, Y., Zhao, W., Bu, J., Li, C., Chen, D., Yu, W., 2018. Unsupervised anomaly detection via variational auto-encoder for seasonal KPIs in web applications. URL https://arxiv.org/abs/1802.03903.

Xu, J., Wu, H., Wang, J., Long, M., 2022. Anomaly transformer: Time series anomaly detection with association discrepancy. In: International Conference on Learning Representations. URL https://openreview.net/forum?id=LzQQ89U1qm.

Yang, C., Wang, T., Yan, X., 2023a. DDMT: Denoising diffusion mask transformer models for multivariate time series anomaly detection. arXiv preprint arXiv:2310.08800.

Yang, Y., Zhang, C., Zhou, T., Wen, Q., Sun, L., 2023b. DCdetector: Dual attention contrastive representation learning for time series anomaly detection. arXiv preprint arXiv:2306.10347.

Zaheer, M., Guruganesh, G., Dubey, A., Ainslie, J., Alberti, C., Ontanon, S., Pham, P., Ravula, A., Wang, Q., Yang, L., Ahmed, A., 2020. Big bird: Transformers for longer sequences. Adv. Neural Inf. Process. Syst. (NeurIPS) URL https://arxiv.org/abs/2007.14062.

Zhang, Y., Rangapuram, S.S., Wang, Y., Chen, C., Smola, A., 2021. Multi-task time series forecasting with shared attention. arXiv preprint arXiv:2101.09645.

Zhang, K., Wang, Z., Zhou, J., Wang, C., 2023. Gated attention mechanisms for time series forecasting. IEEE Trans. Neural Networks Learn. Syst. 34 (6), 1234-1245. http://dx.doi.org/10.1109/TNNLS.2023.10637425.

Zhou, H., Zhang, S., Peng, J., Zhang, S., Li, J., Xiong, H., Zhang, W., 2021. Informer: Beyond efficient transformer for long sequence time-series forecasting. In: Proceedings of the AAAI Conference on Artificial Intelligence. 35, (12), pp. 11106-11115.