Detection of unknown unknowns in autonomous systems
Authors: Ayan Banerjee
Sandeep Gupta
Venue: ICLR 2026 Poster (2026)
Keywords: unknown unknowns
autonomous systems
conformal bounds
Primary area: probabilistic methods (Bayesian methods, variational inference, sampling, UQ, etc.)
TL;DR: We formalize U2 (non-OOD dynamic changes without distribution shift), release 8 U2 benchmarks, and propose SPIE-AD—a zero-shot U2 detection method.

Abstract: Unknown unknowns (U2s) are deployment-time scenarios absent from development/testing. Unlike conventional anomalies, U2s are not out-of-distribution (OOD); they stem from changes in underlying system dynamics without a distribution shift from normal data. Thus, existing multi-variate time series anomaly detection (MTAD) methods—which rely on distribution-shift cues—are ill-suited for U2 detection. Specifically: (i) we show most anomaly datasets exhibit distribution shift between normal and anomalous data and therefore are not representative of U2s; (ii) we introduce eight U2 benchmarks where training data contain OOD anomalies but no U2s, while test sets contain both OOD anomalies and U2s; (iii) we demonstrate that state-of-the-art (SOTA) MTAD results often depend on impractical enhancements: point adjustment (PA) (uses ground truth to flip false negatives to true positives, inflating precision) and threshold learning with data leakage (TL) (tuning thresholds on test data and labels); (iv) with PA+TL, even untrained deterministic methods can match or surpass MTAD baselines; (v) without PA/TL, existing MTAD methods degrade sharply on U2 benchmarks. Finally, we present sparse model identification–enhanced anomaly detection (SPIE-AD), a model-recovery-and-conformance, zero-shot MTAD approach that outperforms baselines on all eight U2 benchmarks and on six additional real-world MTAD datasets—without PA or TL. Code and data available in https://github.com/ImpactLabASU/U2Recognition.

Published as a conference paper at ICLR 2026
DETECTION OF UNKNOWN UNKNOWNS TONOMOUS SYSTEMS
IN AU-
Ayan Banerjee & Sandeep K.S. Gupta
IMPACT Lab, School of Computing and Augmented Intelligence Arizona State University, Tempe, Az
[abanerja, sandeep. gupt Samppaaaaauus easu. edu
ABSTRACT
Unknown unknowns (U2s) are deployment-time scenarios absent from devel- opment/testing. Unlike conventional anomalies, U2s are not out-of-distribution (OOD); they stem from changes in underlying system dynamics without distri- bution shift from normal data. Thus, existing multi-variate time series anomaly detection (MTAD) methods- -whch rely on distribution-shift cues-are ill-suited for U2 detection. Specifically: (i) we show most anomaly datasets exhibit dis- tribution shift between normal and anomalous data and therefore are not rep- resentative of U2s; (ii) introduce eight U2 benchmarks where training data contain OOD anomalies but no U2s, while test sets contain both OOD anoma- lies and U2s; (iii) demonstrate that state-of-the-art (SOTA) MTAD results often depend on impractical enhancements: point adjustment (PA) (uses ground truth to flip false negatives true positives, inflating precision) and threshold learning with data leakage (TL) (tuning thresholds on test data and labels); (iv) with PA+TL, even untrained deterministic methods can match or surpass MTAD baselines; (v) without PA/TL, existing MTAD methods degrade sharply on U2 benchmarks. Finally, we present sparse model identification-enn enhanced anomaly detection (SPIE-AD), a proach that outperforms baselines on all eight U2 benchmarks and on six addi- tional real-world MTAD datasets without PA TL. Code and data available in https:://github http:///ttt...cooommmccaaaaaaaaa
zero-shot MTAD ap-
INTRODUCTION
Autonomous systems such as unmanned aerial vehicles (UAV), autonomous cars (AC), and au- tonomous drug delivery (ADD) systems utilize complex amalgamation of interacting perception, decision making and actuation. Such complexity makes practically infeasible to test for "all possi- ble" operational scenarios. Test cases ignored during pre-deploy evaluation but that occur rarely during deployment, called "unknown unknowns" " (U2), are a major cause of accidents (Maity et al.] 2025). U2 detection is significant problem with very few application specific solutions (Liu et al. 2020 Lakkaraju et af. (2077) ) in the image domain. In this paper, we present SPIE-AD, SParse model Identification Enhanced Anomaly Detection which detects U2 by continually mining the un- derlying dynamical model of variate inter-relationships and checking its conformance with the most likely model of normal operation.
2023
The occurrence of U2 induces an effective violation of stationary property, as the underlying gen- erating process experiences unmodeled changes that alter variate dependency structure over time (Fig. 1). U2s can potentially occur due to: a) hardware failures. which may not be monitored, e.g. mechanical failure in an aircraft resulting in an elevator getting stuck (P8Stuck) or moving slow (F8Slow)) b) unwanted software executions: which may not immediately affect the input/output behaviour in anomalous ways, e.g. change in the gravity parameter quadcoptor's altitude con- trol software (LAVSimG)) and c) untested usage scenarios manifested as external inputs to the system, which may not have a deviant measurement distribution parameter, e.g. an electromagnetic attack sensor decreasing its fidelity (UA (UAVEMA) or a phantom meal, where an user of insulin delivery ADD announces a meal without ingesting any to trick it for high insulin dose. A natural question is that can existing anomaly delection techniques be repurposed detect U2s?

---

Published as a conference paper at ICLR 2026
The distinction between U2s and anomalies is subtle but critical. While anomalies result in marginal distribution shift (Fig. 2 Panel A), U2s cause non stationary changes in the dependency structure
among variables, often without altering marginal distributions (Fig. D and Panel B). Hence to
detect U2, we need recovery and monitoring of underlying process model.
tfate-of- (SOTA) variitv time se- ries anomaly detection (MTAD) operate un- der the assumption of marginal distribution shift in other words out of distribution (OOD), and may use statistical regression methods e.g
marginal
anvellpe
Eflect of U2 Elavstor Stack
Variables
ARIMA (Schmidt et al. 2018). Kalman fil- ter (Huang al., 2023). principal compo- nent analysis based techniques (Shyu et al. 2003). autoencoders (Borghesi et al.] 2019). long short term memory (LSTM) based deep learning (DL) techniques, transformers (Tuli et al. 2022 and most recently foundational models (Alnegheimish et al. [2024] (hou et al.
Model
1.00
C.77
Costrics
8:00
8.30
-150
Nosso offected stationory pr00206
change
Coainsamtaatt
0.15
Ihrestrold from trannng 0.08
USAD anomaly spore
Start
model contiiterns
conrecuttion
2023 However, as conceded by recent re-
01
from
search AAlnehhiiishh et al.] 2024), existing
0.06
0.029
Anomaly scord nom USAD
MTAD techniques may fail detect non- stationary changes in the underlying process. As such, it remains to be seen whether existing MTAD pipelines can be used for U2 detection or not. We evaluate this question in this paper.
40.00
Figure 1: F8 elevator stuck U2 example. USAD (Audibert et al.] 2020b) anomaly score threshold from training data does not detect U2. Threshold update using data leakage introduces significant false positives. Underlying model shows non-stationary change affected by U2
The SOTA anomaly detection pipeline (Fig. 6 Panel in Appendix) has three steps: a) train- ing: that creates a high dimensional latent space representation of the normal operation using data that may or may not have anomalies but do not have anomaly labels, b) validation, that uses data with anomalies but without anomaly labels to learn a anomaly score threshold such that two fairly separated clusters are found in the validation set us- ing the peaks over threshold method guided by the extreme value theory (Siffer al., 2017). and c) evaluation, where anomaly score of successive windows of test data are computed and compared with the threshold to determine anomalous data. SOTA MTAD approaches have several assumptions that result in unrealistic performance and makes them unsuitable for U2 detection:
AO: U2 detection problem does not conform to existing MTAD problem definitions SOTA MTAD problem can be of three types: i) supervised MTAD, where OOD anomaly data and labels available during training are used develop models and classify the same anomalies seen during testing, ii) unsupervised MTAD, where training data with normal and OOD anomalous data with- out labels is used to learn the most likely model of normal operation and classify same types of anomalies in the testing phase, and iii) semi-supervised MTAD, where anomaly free training data used to develop a model of normal operation and OOD anomalies are deviations from the normal. U2 detection problem assumes that training data with normal and OOD anomalous data without labels is available to learn the model of normal operation but test data consists of normal, OOD anomalous data and novel U2 scenario data with non-stationary dependency structures.
Can we use existing few/zero-shot anomaly detection? Recent LLM-guided few-shot anomaly de- tection techniques (Gao et al.) 2024) are fundamentally unsuitable for U2 detection, as they require at least one prior U2 example. Existing zero-shot methods based on LLMs are limited to univariate time series (Alnegheimish et al. 2024) and thus do not extend to U2 settings. Zero-shot MTAD approaches convert time series into images and leverage vasion-language models (VLMs) (He et al.) 2025 Namura & Ichikawa 2024). While promising, they assume the availability of hignal-to-image pipelines and large-scale compute resources, which are often unavailable in resource-constree autonomous and defense deployments. We therefore focus exclusively on U2 detection methods that operate directly on time-series signals without requiring image transformation.
A1: Sensor data distribution shift due to anomaly: For U2 scenario data there may not be a difference in the distribution parameters of the sensor outputs. Consider the example U2 scenario of wrongful Maneuvering characteristics augmentation system (MCAS) trigger in the fateful flight
2

---

Published as a conference paper at ICLR 2026
of Lion Air (Curran et al., 2024). MCAS was designed to mask the flight characteristics changes that would have occurred on newer Boeing Max 8 aircrafts (Herkert et al.) 2020). This implies that if MCAS is wrongfully triggered then by design it attempts to make the distribution parameters of the flight characteristics similar to a normal flight. Fig. 2 shows the data distribution of all sensors for anomalies and normal data in benchmark MTAD datasets in Panel A and for U2 and normal scenarios in Panel B. The Bolmogorov-Smiroo (KS) hypothesis test (SS 2008) is used to compute the normalized maximum difference in cumulative distribution function (CDF) between normal and anomalous/U2 data (H 1 implies the two distributions are statistically different with (1-P) P) probability. Higher value of the CDF difference implies more deviant distribution). While benchmark datasets exhibit distribution shift between anomalous and normal data, in U2 datasets, there is no statistically significant distribution shift between U2 and normal data.
Technical difficulty in U2 detection violat- ing A1: Al's violation implies the raw sen- sor data may not have latent information to discriminate between normal and U2 classes, So, any data-driven feature based method e.g. existing MTAD methods may not be useful. While the sensor data distributions may not be discriminative, there maybe a change in func- tional relationship among the sensors. Panel C shows the underlying nonlinear dynamical model mined from U2 and normal data using SINDY-MPC (Kaiser et al., 2018) has signifi- cantly different distribution parameters. U2 de- tection could utilize modeling and monitoring of variations such inter-relationshiis.
Deadty
Pypeediy Eervity Furetee porr
Prpuuliiyy Dembly Fanedon pon
SND
SMAP
NSL
He
P-0
PSF
PSP
PDF
UNIINA
A2: Use of data leakage to learn anomaly score threshold - In SOTA MTAD techniques the validation set is often same as the test data (Appendix Section B. This leads to potential data leakage and overfitting of the model. It is standard machine learning practice to keep val- idation set separate from test data. By defini- tion, no validation dataset with anomalies are available for U2 detection.
Produce Duisitty Flancioo P00)
YEP
SAPTORING WHALIEE WITHR COMP
Technical difficulty in U2 detection violating A2: Violation of A2 entails zero shot U2 de- tection. To the best of our knowledge, there is only one solution for zero-shot MTAD (Audib- ert et al. 2020a). However, as identified by Kim let al. (2022), it has poor realistic performance. Solutions for univariate zero-shot anomaly de- tection including techniques with LLMs (Al- negheimish et al.) (024) are available, which, as admitted by the authors, are very difficult to adapt MTAD. The technical challenge is to detect anomalies with knowledge about anomalous data distribution, which preempts any data driven discriminative feature learning. Note that a line of work, TimeseriesBench (Si et al. 2024), claims zero shot as the case where train and test data are disjoint. The definition of zero shot (Jayaraman & Grauman 2014) used in this paper is different and requires identification of U2 from a description of its attributes without using any training data.
Data volure 100
Dtt miluet Boc
Erg
Figure 2: Panel A: Normal versus anomalous data distribution difference in benchmark datasets, (more evidence in supplement Table S3) Panel B: U2 datasets have negligible distribution difference with normal. Panel C: significant distribution dif- ference in parameters of U2 versus normal data in the underlying sparse model space.
A3: Unrealistic evaluation method- According to Kim et al. (2022), the reported results in nearly all SOTA MTAD techniques have point adjustment (PA) (Su et al. 2019). This technique assumes anomalies to be contiguous segments, and it is sufficient for MTAD method to detect only one point in this segment as anomaly. The PA method inflates the precision by significant amount (Wu & Keogh 2023) in nearly all MTAD methods as seen in Fig. 7 in Appendix, which shows two most recent MTAD technique on benchmark datasets (SMAP, SMD, MSL) with/without PA (Liu et al.)
2024). These results are also supported by Kim et al. (2022).
3

---

Published as a conference paper at ICLR 2026
Technical difficulty in U2 detection violating A3: As highlighted in Kim et al. (2022). in many real-world datasets, anomalous or U2 events are often not abrupt and may result in an initial and final phase that have similar data distribution to normal data. So, if MTAD method focuses only on purely data driven techniques for learning discriminative latent features, they may label the initial and final phases as normal. Without PA the performance may be unfairly under-reported.
Main Technical Contribution: We present SPIE-AD, that detects U2 by solving the general prob- lem of zero-shot MTAD while violating the SOTA assumptions A1, A2 and A3. The backbone of SPIE-AD are the two fundamenial theoretical contributions of this paper: a) robust sparse non- linear dynamical model recovery (MR) from real- woaldw multi-variate data using neural architec- tures with automated differentiation (AD) and b) statistical conformance based model robustness interval extraction (CRIE) method that can identify statistically relevant difference
recovered
models. Utilizing these, SPIE-AD implements the following U2 detection pipeline (Panel B in Fig. 6 in Appendix): a) training phase: where SPIE-AD mines several models from training data snippets and defines model robustness metric quantify difference between models, b) validation phase: uses part of the training data in the CRIE algorithm to determine a robustness metric interval for the most likely model of normal operation, and c) evaluation phase: it continually mines models from test data, computes robustness and compares with robustness interval to determine anomalies.
Benchmark Contribution: We introduce six synthetic benchmarks derived from U2 scenarios curring in three different real-world systems including quadcoptor, F8 cruiser, and automated insulin delivery (AID) and two novel real-world benchmarks from clinical study data. The hallmark of these benchmarks is that there is statistically insignificant distribution shift between the anomalous and normal data in each time series.
Evaluation Contribution: We first show that if we use PA (K= 0) and allow for data leakage in TL, then it is possible develop an untrained simpleton machine (AnomalySimpletor that can beat SOTA MTAD techniques. While this was also argued in Kim et al. (2022), we propose deterministic algorithm that gives consistent performance across benchmark datasets. We evaluate recently proposed MTAD techniques along with SPIE-AD under realistic scenarios where the pre- cision is not augmented with PA (i.e. K 100) and anomaly signatures in the form of validation set is not available for TL.
Fig. 7
2 METHODOLOGY AND THEORETICAL FOUNDATIONS
We consider n sensors each with time series X for sensor i forming a vector X() over time where I E O... N/P, where is the sampling frequency. The input / output time-series data from au- tonomous systems satisfies system. Such properties are typically expressed using sparse non- non-linear dynamical systems:
properties of the real world
(()) (()(),,.t)
where w is the set of p model coefficients that defines the sparse model. An n-dimensional model with Mh order non-line mineariyyy can utilize (*11")) non-linear terms. A sparse model only includes few non-linear terms p << (M++.).
Let X()) have global marginal distribution P(x). A window W is U2 event if: a) Marginal distributions remain unchanged: Px(x) Re P(x), VI E W: but b) Process becomes non-stationary: wtt # w(t r). for some Thus, a U2 event preserves marginal statistics but reflects a structural change in the system's 's underlying dynamics.
U2 Definition:
Anomaly Definition: A window W is an anomaly if: a) Window marginal drift occurs: Px()) ø P(x), for some t E W, as determined by a statistical test (Fig. []: but b) Underlying process remains stationary: wt) w(t + r), Vt, Thus, an anomaly induces local marginal deviation without altering the long-term distribution.
2.1 ROBUST SPARSE DYNAMICAL MODEL RECOVERY
Given N time sequenced measurement of X(), sparse model recovery (SMR) aims to recover the coefficient w such that the reconstructed measurements ((t) by solving the ordinary differential
equation (ODE) in Eqn. satisfies an error threshold i.c., [|Y X <...
SMR is well-researched problem with solutions ranging from L2 minimization techniques with sparse regression (SINDY-MPC) (Kaiser al. 2018) to physics informed neural networks
4

---

Published as a conference paper at ICLR 2026
2021). It is generally acknowledged that SOTA MR techniques suffer signifi- (PINN) (Chen et al.
cant performance degradation on data from real world systems (O Brien et al. 2023). This implies that with low sampling frequency and high noise, the model coefficients wi and w, derived from two consecutive segments [ ė + W and [j.j + W] of (t), with window size W has significant variance. This is problematic for SPIE-AD since it will be difficult to distinguish between noise and real U2 scenarios and will hamper the false positives. SPIE-AD needs MR that is robust to measurement noise under low sampling rates.
To address robustness, SPIE-AD uses a novel neural network architecture with continuous time latent variable nodes, specifically liquid time constant neural networks (LTC-NN) as shown in Fig. 8 in Appendix (Hasani et al.] 2201;; [annereee & Guptal 2024b al Xu et al.] [026] (002)). Given a segment with W samples, the SINDY-MPC technique is used to first recover a sparse model coefficient estimate (0). The data segment is passed through fully connected network of V LTC- NN cells in batches of Sp- The output of the LTC-NN nodes are fed to a dense linear layer with (M**") nodes with RELU activation function. The sparsity of (0). i.e. which elements of (**+)) are "0" is used to dropout nodes of the dense layer. The output of the jth dense layer node are constrained within a range [(1 ).),,, L+,w,, & is syyper-prrameter The weighted dense layer output is the refined estimate West of the model coefficients and is fed to an ODE45 solver (Shampine et al. (2003) that reconstructs the signal Y. The loss is the mean square error between X and Y summed over dimensions and time steps. We show the effect of using this robust MR method on U2 detection. In Appendix Table S1, we show an ablation study with LTC-NN refinement removed on standard SMR benchmarks (Kaiser et al. 2018).
2.2 CONFORMAL INFERENCE FOR MODEL DEVIATION
Conformal inference Tibshiirani et al. 2019) distribution free method to identify whether a model, w", learned from validation data i 2 + W] is in the distribution of the set of models ?
learned from training data. To compute model difference we use a robustness metric p in Eqn. 2
p(w" 0)
of (/)1)/
(2)
where [ is the number of elements in the set Ω and 22. denotes transpose of an element in Ω.
Let us consider that the training data has k windows of size W each, X1 X2( Xs(...x(1.. W) where data is iid in R" x RW drawn from distribution Dx. The SMR mechanism L is used to derive coefficients wi E R2 from each X; such that reconstruction error is less than c. [(...) is used to derive w for Xm+1. Y in validation data with no assumption on the Dxy. hence no anomaly is required in validation set. Given the robustness function p(.,.) in Eqn. [ conformal inference creates a prediction band
C' C R2 based on (X1, Yi), (X2, Y2),... (X,...(m,,, (Xm Xm, Ym) that P(p(w>++) E C) 2
) for a given miscoverage level a E {0, 1}. so a. The prediction process can be encoded in Algorithm [ CRIE (Appendix), which takes the i.i.d training data (X1, Yi)..... (Xm. Ym),, miscoverage level a and the SMR method L to provide the prediction interval.
The basic method is to divide the training set into two mutually exclusive subsets Ir and Ty. The SMR method L is used to derive w; for the segments (X,, E Iy and form the set Q. For each Wi E 22, p(w;, /2,,,) is computed, where 2/w,, denotes the set Q with W; removed. Let o (pg.(p(w;, 3) be the mean value of the robustness metric in the training set. From the validation set, wif is derived for (X,, Y,)= E Tv. The residual p(w).0) - a is derived for every element in Iv, the residual is arranged in ascending order. The residual at the position [[/vr/2++ + 1)(1 a)] is used the prediction range d. Theorem 2.1 in Lei et al. (2018) proves that the prediction interval at a new point (Xm+1. Ym+1) is given by L and satisfies Theorem I
Theorem 1. If is such that [[(,,,,,,) 122 < e, Vw: E Q. for error margin e, then for new WHtT (Xm++1, + Xm+1) Algorithm 7 (Appendix) ensures, P(plwin+1: Ω) E la d, a + d)) 2 1 a.
2.3 U2 DETECTION ALGORITHM
Utilizing Theorem I and the CRIE algorithm, we derived a robustness range that encodes the normal behavior without using the knowledge of U2. Our U2 detection mechanism in Algorithm 2 in Appendix takes windows of test data, uses the SMR technique to learn the model coefficients W;, computes the robustness using Eqn. 2 and compares with the range obtained from CRIE.
5

---

Published as a conference paper at ICLR 2026
2.4 SPIE-AD AND AUTOENCODER COMPARISON
How SPIE-AD addresses A2? The robust MR mechanism captures sensor inter-relationships un- like autoencoders that derive latent featurs of individual sensors. The CRIE algorithm learns a tight robustness range characterizing most likely normal operation in a distribution agnostic manner unlike autoencoders that need point estimation based EVT that assumes underlying distribution.
How SPIE-AD addresses A3? Unlike SOTA MTAD, SPIE-AD extracts low dimensional represen- tation of the data which reduces entropy, making it easier to model normal scenarios. U2 scenario lead to exaggerated model deviation since the inter-relationship between variables become inconsis- tent. Hence, as seen in Table 3 & SPIE-AD can achieve better overall precision without PA.
How SPIE-AD addresses A1? By learning an underlying model, SPIE-AD can exploit significant distribution differences in model space of U2 scenarios (Figure 2).
Computational complexity: Comprehensive analysis is provided in Section G in appendix.
RELATED WORK
Table 1: Related works. Bold text- baselines. assumption violation.
Anomaly detection
Works
MTAD
Zero shot
A2
- A3
AT
(AD) (Table 1 has
Extended Kalman Filter (Huang et al. 2023
No
Yes
Yes
Yes
No
rich history starting
Principle Component Analysis (Shyu at 2003)
Yes
No
Na
No
No
from univariate AD
Time frequency anomaly delection
Zhang et aL.
Yes
Na
Na
No
No
2022
with initial works
Frequency Interpolation Time Series Xu 2024
Yes
No
No
No
employing Kalman
K nearest neighbor (Wang et all (0200)
Yes
No
No
No
No
Filter (Huang et al. 2023) and principle component analysis (PCA) (Shyu et al.
Isolation Forest (Liu et al. 22008)
Yes
No
No
No
No
Light weight online anomaly detection (Pevny 2016
Yes
No
No
OmniANomaly (Su et al. 2019)
Yes
No
No
No
No
Anomaly transformers (X (022)
Yes
No
No
No
Graph utlention networks (Zhou al 2020
Yes
Na
LSTM (Hundman al. (2018]
Yes
No
No
No
No
2003). PCA has been used for MTAD but not zero shot. The next generation MTAD techniques used statistical learn-
Gruph augmented normalized flows (Zhuo et al.
2022
Yes
No
No
No
No
One size lits all /hhou et al. 2003]
Yes
No
No
Usupervised anomaly defection (Audihert
2020
Yes
Yes
Yes
No
No
CLIP zero shot image recognition (Prall el 2023
No
Yes
Yes
Yes
No
LLM Anomaly detection (AInegheimish el.
2024
No
Yes
Yes
Yes
No
SPIE-DD
Yes
Yea
ing methods such as nearest neighbors (Wang et al., 2020) or Isolation Forest (iForest) (Liu iet al., (008) mechanisms or light weight online anomaly detector (LODA) (Pevný) 2016). Such techniques are not tested for zero shot MTAD and also had poorer overall performance on real world data (Liu et al.) 2024). Time series analysis methods have also been used for MTAD such as time frequency domain approaches (Zhang et al., 2022) or frequency interpolation methods (Xu) let al. 2024). The current generation of MTAD techniques uses DL such as LSTM (Hundman al.) 2018), variational autoencoders (OmniAnooaly) (Su et al. 2019), anomaly transformers (AT) (Xu ct al. 2022), graph augmented nonmalized flows (GNAF) (Zhao et al. 2022), and Graph Attention Networks (GAT) (Zhou et al., (200)) or even foundational models such as one size fits all (OFA) approach (Zhou et al. 2023). These MTAD techniques however use the workflow described in Fig. 6 and do not achieve zero shot MTAD. While U2 has been explored in the image domain using large vision models such CLIP (Pratt al.] 2023) such methods are not directly applicable to MTAD. We are aware of two works, i) unsupervised anomaly detection (USAD) that performs zero shot MTAD (Audibert al. 2020a) using autoencoders, and ii) and use of large language models (LLMs) to perform U2 in univariate timeseries (Alnegheimish et al. 2024). The USAD technique still reports anomaly detection accuracy with PA (A3) and TL (A2), and relies on difference in distribution shift between normal and anomalous class (A1).
4 EVALUATION
We perform three types of evaluation: A) effects of using test set as validation set (A2) and PA (A3) on MTAD performance. We show that an untrained statistical method can beat SOTA learning based systems with A2 and A3. B) performance comparison of SPIE-AD and SOTA baselines under violation of A2 and A3 on U2 benchmarks that have no distribution shift between anomaly and normal data (violates A1). C) performance comparison of SPIE-AD and SOTA baselines on real world univariate and multivariate datasets. Using the large univariate UCR dataset we perform statistically robust evaluation of sensitivity of SPIE-AD window size W in appendix Section FF

---

Published as a conference paper at ICLR 2026
AnomalySimpllton: We propose an untrained deterministic thresholding algorithm that exploits PA and test data distribution i.c. data leakage to provide anomaly detection performance on par with state-of-the-are learning techniques. In this method, specific window W of data is selected from the train data. Statistical properties of the train data window W such as mean itrain, standard deviation Atrain, and skewness Kerrin is computed. For each test data window of length W, the same statistics are computed. If the deviation of the test statistics is more than P% of the train statistics, then the test data window is classified as anomalous else it is not anomalous. The window W and the test statistics P is used to obtain two maximally separated clusters in the test data. This is done through brute force search over several W and P options. For each benchmark real world data this window and threshold seach is performed from scratch.
We used 14 datasets (Table 2 to evaluate SPIE-AD, out of which 6 are synthetic and 2 real world U2 datasets, while 3 are real world MTAD datasets and another 3 are popular large scale univariate real world datasets taken from Bine (Si et al. 2024).
Benchmarks:
We utilize both synthetic and real world U2 datasets. De- tailed description of synthetic U2 datasets are provided in the appendix while real world data is described below. While the synthetics datasets high- lights the efficacy of SPIE-AD in U2 detection while violating A2, A3, and A1, the real world anomaly datasets show the gen- erality of SPIE-AD.
Table 2: Datasets. Train, T, Test, Te, Real world, R. Synthetic, S
Datasel
Samples (T/Te)
Anomaly /22
Type
Electromagnetic attack (LAVEMA)
3
240K/242K
29.75%
S
Simulated g chunge (UAVSimi))
3
240K/274K
11.7%
8
F8 cruiser stuck elovator (FBStuck)
4
87/K//37K
9.2%
F8 cruiser slow elevator (P8Slow)
4
877K/833 K
1.4%
5
AID phantom meal (AIDPhantom) AID cantridge error (AIDCartridge)
4
260K//40K
12%
8
4
260K//02K
11.5%
8
Medironic Cartridge emoor
3
256K/518 K
EEG Seizure data Server Machine Dataset (SMD)
15
512K/675 K
7%
R
708K/708K
4.16%
R
Soil Moisture (SMAP)
135K/427K
13.13%
Mars Science Lab Rover (MSL)
58K/73K
10.7%
R
250 UCR anomaly dataset
SM/13M
0.4%
R
Yahoo dataset
400K/780K
12%
NAB
54K/T04K
Real world datasets: A)
Benchmark MTAD datasets available in Su et al. (201)) y. and large univariate datasets UCR, Yahoo and NAB database available in Wu & Keogh (2022) Si et al. (2024).
Table 3: Comparison of SPIE-AD against baselines for synthetic U2 benchmarks (S = synthetic).
SPIE-ADS uses SINDY-MPC, SPIE-ADL uses LTC-NN." + denotes with point adjustment (PA).
Approach
P8Stuck
FSSlow
UAVSimG
UAVEMA S
AIDPhantom
AlDCarttidge
Pt
Rc
Fl
Pr
Rc
Fl
Pr
Rc
Fl
Pr
Re
Fi
Pr
Rs
FI
Pr
Re
Fl
Omni
91.2
72.7
80.9
88.4
71.1
78.8
92
77.1
83.9
90
67.3
77.0
94
76.1
84.1
97
59.7
74
Ommi
41
26.8
32.4
65
28.1
39.2
32
19.7
24.4
29
16.8
21.3
19.1
16.5
17.7
65
31.9
43
AT
100
78.6
88
100
58.7
74.1
100
59.2
74.2
90
56.1
69.1
91
56,3
69.7
100
59.2
74
AT'
85,5
75.8
80.3
34,2
32.8
33.5
35
33.5
34,2
33.9
32.4
33
34
32
33
34,3
33.8
34
iForest
100
78.6
88
100
47.5
64.4
100
50.8
67.6
88.5
46.2
60.7
98.6
45.9
62.6
91.2
42,1
57.6
Forest
14
33
19.6
9.8
8.2
8.9
10.6
8.5
9.4
8.6
7.6
8.1
9.5
8.1
8.7
9.5
7.9
8.6
LODA
100
72.6
84
100
20.7
34.3
96.9
18.5
31
88.5
14.9
25.5
95.8
16.8
28.6
99.2
17.2
29.4
LODA
88
70
78
60.7
13.7
22.4
50.7
35
8.6
13.8
35,8
9.4
14.9
36.4
9.7
15.3
LSTM
100
88
93
100
47.8
64.7
91.8
20.2
33.2
100
21.2
35
99.9
20.3
33.8
96
18.6
31
LSTM
77
85
80
61
35.8
45.2
59.4
13.2
21.6
60.8
14.2
23
58.6
12.6
20.7
54.7
12.1
19.9
USAD
100
72.1
83.8
100
23
37.4
92.6
21.8
35.3
90.3
21.6
34,9
94.6
25,2
39.8
97.1
28.6
44
USAD
81
67.7
74
55.3
14.2
22.6
51.2
12.3
19.8
49.2
12.1
19.4
$2.6
12.1
19.7
58
8.8
1.5.2
GANE-
100
86
92.5
100
58
73
100
92.2
96
100
97
98.5
96.7
61.5
75
92.8
56.1
70
GANE
61
79
68.8
3.2
4.3
3.7
$1.4
85
64.3
0.9
24.7
1.8
3.2
4.5
3.8
2.1
2.7
2.4
GAT+
100
85.2
92
100
47.2
64.
99.2
48.3
65
86.4
44.6
58.8
92.8
48.1
63.4
99
49
65.6
GAT
71.4
80.5
75.7
58.9
34.5
43.5
32.3
41.8
50.4
28
36
54.5
28.9
37.8
57.2
30.3
39.7
OFA+
82.1
87.5
84,7
65.9
43.2
52.2
66.2
72.3
69.1
70.4
68
69.2
74.5
77.1
75.8
81.3
87.4
84.2
OFA
21.4
4.5
7.4
21.9
9.7
13.4
37.5
22.1
27.2
20.3
8.5
12
31.3
18.3
23.1
21.7
10.1
13.8
FITS*
91.4
70.5
79.6
81.3
74.2
77.6
81.9
82.3
82.1
80.1
76
78
74.3
88.1
80.6
97.2
70.1
81.5
FITS
21.4
8.6
12.3
14.3
22.05
21.9
80.4
24.5
18.4
21.0
14.7
40.1
21.5
TEAD
82.1
77.4
79.7
78.2
84.3
81.1
91.9
82.3
86.8
80.4
84.0
71.5
78.9
75.0
87.2
80.3
83.6
TFAD
11.2
30.4
16.4
9.8
21.7
13.5
29.5
12.4
17.5
21.9
8.7
12.4
14.7
31.8
19.9
17.7
21.4
19.4
SPIE-ADS
87.3
100
93.2
54.8
100
71
82
100
90.1
91.1
100
95.4
94
98,1
96
95.3
93
94.1
SPIE-ADS
86.7
99.9
90.1
91.1
100
95.4
91
96
93.4
92
85
88.4
SPIE-ADL
88.9
100
55,1
100
100
95.3
93.2
100
96.5
94,1
99
96
95
94
94.1
SPIE-ADL
88.7
95.1
92
58
93
70
89
99.9
94.2
93.2
100
96.5
92.1
99
95.4
91
92
91.5
B) Real world U2 data, for cartridge occlusion in Medtronic 670 G obtained from JAEB cen-
ter (JAEB center 2023) and clinical electroencephalography (EEG) data capturing sudden onset of epileptic seizure (Ghorbanian et al., 2015).
Baseline Techniques: We compare SPIE-AD with a combination of time series, deep learning, autoencoder, and foundational model based techniques highlighted in italics in Table T In addition,
7

---

Published as a conference paper at ICLR 2026
also compare with some table topper univariate AD methods reported in Wu & Keogh (2023)
Lee et al. (224b); Si et al. (2024) (Table and in Appendix).
SPIE-AD implementation: We implemented two variations of SPIE-AD: a) SPIE-ADS, where the model recovery part is solely SINDY-MPC, and b) SPIE-ADL, where the model recovery part is SINDY-MPC augmented with the LTC-NN neural architecture with AD. For the SINDY-MPC implementation we used the code from Kaiser et al. (2018). For the LTC-NN neural architecture, updated the base code available in Hasani (2024). The CRIE and U2 detection algorithms were implemented using Matlab 2022b.
Table 4: Comparison of SPIE-AD
Hyper-parametter optimizatiin: As highlighted in Fig. there is a haphh--ppaaaee parameter optimization step in SPIE-AD during the training process. The hyper- peeemeereeeters include: a) miscover- age level a that determines the robustness interval width d, b) the polynomial order of SMR technique, c) the sparsity level of the model, and the window size k. These parameters were de- termined only using the training data with the objective to in- clude atleast r >> 80% points of the training dataset within the robustness interval while minimizing d. The hyper parameter optimization approach was frute-force and performed for each application (Section B.4).
against baselines for real- U2 benchmarks (R = real world).
Appreach
Medtronic R
Epilepsy R
Re Fl
Pr
Re
Fl
Omni+ Omni
41.1
623
49.5
25
17
20.2
2.1
52
3
14.2
AT
51.3
59.9
43.4
61
50.7
AT
30
20
24
40
50
44.4
iorrst
61.3
57.4
66.4
71.2
68.7
iForest
33.1
LODA
45.1
65.3
53.3
55
54
LODA
3.4
91
6.6
4.1
15.4
6.5
LSTM
69
64.2
15.1
18
16.4
LSTM
2.7
USAD
37.4
Baseline Implementation: We used the MTAD tools and pipeline established in Liu et al. (2024) for baseline imple- mentations. In all baseline implementations except USAD, we observed that removing labels from validation set reduced the precision and recall to near zero. Indicating that a pure zero-shot MTAD implementation with baselines is not possi- ble without significantly altering the methods. Hence, in our comparison all baselines were non zero-shot MTAD except for USAD and SPIE-AD. For all implemented techniques we show two cases with and without PA.
USAD
31
43
36
12
65
20.2
GANE
43
84
56.9
63
75
68.5
GANF
GAT
GAT
13.2
29.1
18.2
12
65
20.2
OFA
69
71
70
43
57
49
OFA
FITS
28.5
FITS
55
37.5
44.6
10.1
17.5
12.8
TEAD
65.2
60
62.5
43
30
35.3
TEAD
SPIE-ADS
70.7
SPIE-ADS
67
70
68.5
60
77
67.4
We use standard metrics: Precision (Pr), Recall (Re), and Fl score (Liu et al. 2024). For the univariate real-world UCR database, the event-based AD accuracy is used as in Timeseriesbench (Si et al,, 2024). If the detected anomaly sample is in + 100 samples of the anomaly start point, accuracy is I, else O. Plus we show execution times of all methods for real world datasets. For MTAD methods that depend on TL, threshold independent metric, volume under the surface (VUS) of the area under the precision recall curve (AUC-PR) is reported Paparriizo et al. (2022). SPIE-AD is not dependent on an anomaly threshold. One way incorporate this is compute VUS by changing the coverage level a. We report VUS and AUC-PR in appendix Table S4.
Evaluation metrics:
SPIE-ADL
69
72
70.5
65
79
71.3
SPIE-ADI.
RESULTS
We first show the inefficacy of the evaluation strategy used in state of the art MTAD techniques. We then evaluate the performance of SPIE-AD and compare with baseline on U2 benchmarks. We then compare SPIE-AD performance on real datasets. Here we also perform two ablation studies: a) removing point adjustment, and b) removing acess to validation datasets with anomalies. Our lessons learned from AnomalySimpleton experiment is available in Scction D in Appendix.
5.1 U2 DETECTION PERFORMANCE EVALUATION
Table 3 and 4 show that SPIE-ADS outperforms SOTA on the Fl score for the case without PA implying it has better precision and recall and does not need PA. Methods such as anomaly trans- formers (AT) do outperform SPIE-AD in Fl metric with PA implying SPIE-AD does miss some legitimate events as evidenced by the slightly higher recall.
Interestingly, among the DL methods, AT has the highest difference between Fl scores with and without PA. However, AT has the highest Fl score for F8Slow. This entails that while anomaly trasnformer is good at detecting U2 albeit very late. Further, SPIE-AD also outperforms the only other zero-shot MTAD methods USAD. USAD also has a significant difference in metrics with/without PA (A3). SPIE-AD requires no such assumptions.
8

---

Published as a conference paper at ICLR 2026
For nearly all cases SPIE-ADL consistently outperforms SPIE-ADS, showing the robustness im- provement property of the LTC-NN approach in Fig. 8 in Appendix. However, the difference is much lower and given that LTC-NN architecture is much more complex than SINDY-MPC, one may wonder why it's necessary. A point that all these benchmarks are synthetic; hence are much less noisy reducing its need. The need for LTC-NN is illustrated in real data.
5.2 REAL WORLD ANOMALY DETECTION PERFORMANCE
Multi-variate: Table 6 in supplement shows the performance of SPIE-AD real datasets and com- pares it to recent DL based MTADs and unsupervised methods. real data, SPIE-AD outperforms SOTA F1 score without PA. On real data, see the largest benefit of using the LTC-NN.
Univariate: Maximum
event-wise AD accuracy of SPIE-ADS was 75.6% on UCR database. Compared to the leaderboard in Lee al.] (2024a). SPIE-ADS
Arx Droetrr bate tmaphee
0.82
beats the SOTA by 4.8%.
Ablation Studies: For
Saepding Enqunacy (80)
40
TTREwwAY (1K)
120
Surplag, POREBREY (86]
100
each real dataset we created three configurations: with point adjustment and vali- dation set (PA + V), with- out PA (- PA), and without validation set i.e. zero shot (- V). It is observed that as expected the F1 score of SOTA DL techniques reduce drastically without PA. The USAD has lesser effect, while the SPIE-AD methods have the least ef- fect of PA. Moreover, removal of validation set reduces the FI score to near zero for anomaly transformer and GNAF approaches. Both USAD and SPIE-AD have higher F1 score for zero-shot MTAD, with SPIE-AD outperforming USAD.
Dae: Arepaasnn Diie
Saspling Enrgueary (89c
SenipRog THIDARAY (8K)
Sexpping Prrqerec (Bs)
Figure 3: Performance with respect to sampling frequency, and library size (higher polynomial order results combinatorially larger library) Low noise case. High noise case in Appendix Fig. T0
5.3 SPIE-AD ANALYSIS
Averee Coseecta Dioa (eorSio
In this section, we per- form the following analy- sis: a) Evaluate the sensi- livity of SPIE-AD U2 de- tection performance to li- brary size, sampling rate, and noise: For this exper- iment, we consider all the U2 benchmarks synthetic and real world combined and report averaged results. We resampled all the mutlivariate data 100 Hz and then varied the sampling rate from 20 Hz to 12 Hz in steps of 20 Hz. For each frequency level, we varied the maxi- mum polynomial order from 2 to in steps of 1. We considered two noise conditions: 20 dB signal to noise ratio (SNR), achieved by adding Gaussian noise to each signal dimension, this represents low noise scenario, and ii) high noise scenario with 5dB SNR. In Figures aandd (in Appendix) we report additional performance metrics: 1) false acceptance rate (FAR), 2) event coverage, 3) time delay in terms of samples to detect U2, 4) accuracy, 5) precision, and 6) Fl scores. The figures show that sampling frequency reduces all performance metrics become poorer, with polynomial order 3 providing the best overall results for SPIE-ADL. Moreover as noise increases accuracy, precision, FAR, Fl reduce but time delay has more variance and sometimes is better for higher noise scenario. This happens when noisy data immediately precedes U2 event and SPIE-AD classifies noise as U2, but the detection delay results in false U2 detection right after actual U2 occurrence.
(Pactirn FAR
Figure 4: Effect of changing coverage level - a and sparstiy of SINDY-MPC SPIE-AD performance.

---

Published as a conference paper at ICLR 2026
b) Evaluate the effect of different SINDY backbones on SPIE-AD, U2 detection performance: There are several SINDY variants as summarized in Table IT in Appendix. In Fig. I1 in Appendix we compare the effect of using W-SINDY specifically designed for high noise scenarios, and SINDY without control on SPIE-AD. It shows that SINDY-MPC: is the best SINDY variant in terms of all performance metrics. W-SINDY and SINDY without control suffers because they do not handle exogenous inputs. We also observed the effect of adding a non-polynomial (sine) term in the library, which resulted in significant drop in performance metries. This heavily depends on the stability of the STRIDGE algorithm in evaluating regression on non-polynomial functions.
c) Evaluate the effect of different continuous depth neural networks execution speed and U2 detection performance: SINDY variants are the fastest as shown in columns 4, 5, and 6 on real world data in Table supplement. We further valuated the use of continuous time recurrent neural networks (CT-RNN) and NODE replacements of LTC-NN. These variants improved execution time (1.2 for NODE, and 1.7 for CT-RNNN but resulted in poorer performance (Fig. in Appendix). d) Evaluate the effect of miscoverage level, and sparsity settings on U2 detection performance: We varied the coverage level 1 a (or miscov- erage level a)) from 0.95 to 0.2 for SPIE-ADL and performed experiments for the F8 exam- ple (most complex model). In SINDY-MPC the sparsity threshold controls sparsity such that if values are less than the threshold they are ig- nored and the representation becomes sparser. We introduce a sparsity level from 0.001 to 5.0, which is multiplicative factor to this thresh- old. As sparsity level increases the underly- ing model becomes sparser. Fig. 4 shows that SPIE-AD is sensitive to both miscoverage level and sparsity. As miscoverage level increases all performance metrics monotonically become worse However, sparsity dependency is more interesting. From Fig. 4 we see that there is an optimal sparsity level for which the model performs best. Additional experiments show that this optimal sparsity level varies for different underlying systems.
600
Teterioo Delay (sangle)
Denacion Dabay (marphe)
FAR 15
FAR S 233 -d- 7AB 5 5%
PAR 735 FAR 10%
Figure 5: Precision Recall v.s. detection delay for fixed FAR budgets (trend lines only).
e) Evaluating the trade-off between Precision, Recall and U2 detection latency under fixed false acceptance rale budget: In this experiment, across all the U2 synthetic and real world datasets, fixed the average FAR 0.01, 0.025, 0.05, and 0.1 and plotted the precision recall against detection delay. Fig. 5 shows that for a fixed FAR budget, when the delay in detection increases both precision and recall increase. This means that larger number of samples result in better U2 detection accuracy. However, this is not true if we allow for higher FAR. At FAR budget of 10%, the precision decreases with increased delay. SPIE-AD performance is poorer with smaller U2 events. If U2 length is small then the delay increases and SPIE-AD identifies data points after the U2 event as U2 and hence results in higher false positives reducing precision.
CONCLUSIONS
In this paper, we introduced SPIE-AD methodology for identifying 'unknown-unknowni (U2) er- rors in Al-enabled autonomous systems. U2 can arise due to unpredictable human interactions and complex real-world usage scenarios, potentially leading critical safety incidents through unsafe shifts in the distribution of the inter-relationships among the variables in operational data. SPIE-AD performs zero shot anomaly detection and hence does not require signature of the U2 scenario or detection. Validation across diverse contexts such as zero-day vulnerabilities in unmanned aerial vehicles, hardware failures in autonomous insulin delivery systems, and design deficiencies in air- craft pitch control systems such as Maneuvering Characteristics Augmentation Systems (MCAS), demonstrates our framework's 's efficacy in preempting unsafe data distribution shifts due to unknown- unknowns. This methodology not only advances unknown-unknown error detection in AAS but also sets a new benchmark for integrating physics-guided models and machine learning to ensure sys- tem safety. Mining the underlying model of a dynamical system has several applications including detection of stealth cheating scenarios in AI systems much like the Volkswagon emission cheat- ing case, or also biometric liveness detection. We have not only shown efficacy of SPIE-AD on U2 datasets but also demonstrated its generality in detecting any anomalous scenarios through the usage of standard real world datasets.
10

---

Published as a conference paper at ICLR 2026
7 ACKNOWLEDGMENTS
This work was partially funded by DARPA (AMP, N6600120C4020; FIRE, P000050426), the NSF (FDT-Biotech, 2436801), NIH R21 grant (IR21HLI75632) and the Helmsley Charitable Trust (2- SRA-2017-503-M-BB
REFERENCES
Polmogorov-Smiran Test, pp. 283-287. Springer New York, New York, NY, 2008. ISBN 978-0- 387-32833-1, doi: 10. 10010077978-00337--283------
URL httpt:///ooii. wrw.:/....rg0.... 10077
978-0-387-32633
214
Ahmed Abdulaal and Tomer Lancewicki. Real-time synchronization in neural networks for multi- variate time series anomaly detection. ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 3570-3574. IEEE, 2021.
Subutai Ahmad, Alexander Lavin, Scott Purdy, and Zuha Agha. Unsupervised real-time anomaly detection for streaming data. Neurocomputing. 262: 137-147,, 2017.
Chuadhry Mujeeb Ahmed, Venkata Reddy Palleti, and Aditya P Mathur. Wadi: a water distribution testhed for research in the design of secure cyber physical systems. In Proceedings of the 3rd international workshop on cyber-physical systems for smart water networks, pp. 25-28, 2017.
Sarah Alnegheimish, Linh Nguyen, Laure Berti-Equille, and Kalyan Veeramachaneni. Large language models can be zero-shot anomaly detectors for time series? arXiv preprint arXiv:2405.14755. 2024.
Jean-Yves Audibert, Michal Michiardi, and Younès Boujemaa. Usad: Unsupervised anomaly de- tection on multivariate time series. Proceedings of the 26th ACM SIGKDD International Con- ference Knowledge Discovery & Duta Mining (KDD), pp. 3395-3404. ACM, 2020a. doi:
10.1145/3394486.34033
Julien Audibert, Pietro Michiardi, Frédéric Guyard, Sébastien Marti, and Maria A. Zuluaga. Usad: Unsupervised anomaly detection multivariate time series. In Proceedings the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, KDD '20, pp. 3395-3404, New York, NY, USA, 2020b. Association for Computing Machinery. ISBN 9781450379984. doi: 10.1145/3394466.343333
URL
3394486. 3403399
Ayan Banerjee and Sandeep Gupta. Emily: Extracting sparse model from implicit dynamics. In Cecilia Coelho, Bernd Zimmering, M. Fernanda P. Costa, Luis L.. Ferras, and Oliver Nigge- mann (eds.), Proceedings of the 1st ECAI Workshop on "Machine Learning Meets Differential Equations: From Theory Applications", volume 255 of Proceedings of Machine Learning Research, pp. 1-11. PMLR, 20 Oct 2024a. URL https: http:::://pooceednngs.. mllr v255 7255/banerjeee2a..o html
htt.eeeddiin..m...rsssssssssss/s press/
Ayan Banerjee and Sandeep K.S. Gupta. Recovering implicit physics model under real-world straints. In Proceedings of the 26th European Conference on Artificial Intelligence (ECAI 2024), volume 392 of Frontiers in Artificial Intelligence and Applications, pp. 737-744, Hague, Nether- lands, 2024b. IOS Press. doi: 10.3233/FAIA2405556
Andrea Borghesi, Andrea Bartolini, Michele Lombardi. Michela Milano, and Luca Benini. Anomaly detection using autoencoders in high performance computing systems. In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), pp- 9428 9433. AAAI Press, 2019. URL https:://jjs.aast org/ index.nixx. http://aa/attccceeeeeeeaaaaeeeee
Zhao Chen, Yang Liu, and Hao Sun. Physics-ifformed learning of governing equations from scarce data. Nature communications, 12(1):6136, 2021.
Noah T Curran, Thomas W Kennings, and Kang G Shin. Analysis and prevention of meas-induced crashes. IEEE Transactions on Computer-Aice Aided Design of Integrated Circuits and Systems, 43 (1) (11):3322-3394, 2024.
11

---

Published as a conference paper at ICLR 2026
Urban Fasel, J Nathan Kutz, Bingni W Brunton, and Steven L Brunton. Ensemble-sindy: Robust sparse model discovery in the low-data, high-noise limit, with active learning and control. Pro- ceedings of the Royal Society A, 478(2260):202109044 2022.
Shanghua Gao, Teddy Koker, Owen Queen, Thomas Hartvigsen, Theodoros Tsiligkaridis, and Marinka Zitmik. UniTS: A unified multi-task time series model. In The Thirty-eigtth Anmual Conference on Neural Information Processing Systems, 2024. URL htt.:tttt///ppeeeeteee net fttt//oorummiid=BBooo0
Parham Ghorbanian, Subramanian Ramakrishnan, and Hashem Ashrafiuon. Stochastic non-linear oscillator models of eeg: the alzheimer's s disease case. Frontiers in Computational Neuroscience, 9:48, 2015.
Jonathan Goh, Sridhar Adepu, Khurum Nazir Junejo, and Aditya Mathur. dataset to support research in the design of secure water treatment systems. In Critical Information Infrastructures Security: 11th International Conference, CRITIS 2016, Paris, France, October 10-12, 2016, Revised Selected Papers 11, pp. 88-99. Springer, 2017.
Ramin Hasani. Liquid Time Constant Networks. httpp/////gttttt.ccooo////////// tite__oosttat__ntteeee
2024.
Ramin Hasani, Mathias Lechner, Alexander Amini, Daniela Rus, and Radu Grosu. Liquid time- constant networks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pp. 7657-7666, 2021.
Zelin He, Sarah Alnegheimish, and Matthew Reimherr Harnessing visoonllage models for time series anomaly detection, 2025. BtL/htts::// wttp:/i..rgg/bb//25502 06336
Joseph Herkert, Jason Borenstein, and Keith Miller. The boeing 737 max: Lessons for engineering ethics. Science and engineering ethics, 26:2957-2974, 2020.
Xunhua Huang, Fenghin Zhang, Ruidong Wang, Xiaohui Lin, Han Liu, and Haoyi Fan. Kalmanae: Deep embedding optimized kalman filter for time series anomaly detection. IEEE Transactions on Instrumentation and Measurement, 2023.
Kyle Hundman, Valentino Constantinou, Christopher Laporte, Ian Colwell, and Tom Söderström. Detecting spacecraft anomalies using Istms and nonparametric dynamic thresholding. In Pro- ceedings of the 24th ACM SIGKDD International Conference Knowledge Discovery & Data Mining (KDD), pp. 387-395, ACM, 2018. doi: 10.11455321981193219655
JAEB center. JAEB center dataset. https://public. http::/ah.......bb..o.oo/ttttaaa 2023.
Dinesh Jayaraman and Kristen Grauman. Zero-shot recognition with unreliable attributes. Advances in neural information processing systems, 27, 2014.
Eurika Kaiser, Nathan Kutz, and Steven L Brunton. Sparse identification of nonlinear dynamics for model predictive control in the low-data limit. Proceedings of the Royal Society A, 474(2219): 20180335, 2018.
Siwon Kim, Kukjin Choi, Hyun-Soo Choi, Byunghan Lee, and Sungroh Yoon. Towards a rigorous evaluation of time-series anomaly detection, 2022. URL
05257
Himabindu Lakkaraju, Ece Kamar, Rich Caruana, and Eric Horvitz. Identifying unknown unknowns in the open world: representations and policies for guided exploration. In Proceedings of the Thirty-Firss AAAI Conference on Artificial Intelligence, AAAI'1 17, pp. 2124-1121111111 2132. AAAI Press, 2017.
Daesoo Lee, Sara Malacarne, and Erlend Aune. Explainable time series anomaly detection using masked latent generative modeling. Pattern Recognition, 156:110826, 2024a. ISSN 0031-3203. doi: http:://bbbogggll..oooo.oogooggo
URL httpp:: www. wtt..eiiiiincd..ett.
12

---

Published as a conference paper at ICLR 2026
Daesoo Lee, Sara Malacarne, and Erlend Aune. Explainable time series anomaly detection using masked latent generative modeling. Pattern Recognition, 156:110826, 2024b.
Jing Lei, Max G'Sell, Alessandro Rinaldo, Ryan J Tibshirani, and Larry Wasserman. Distribution- free predictive inference for regression. Journal of the American Statistical Association, 113 (523):1094-1111, 2018.
Anthony Liu, Santiago Guerra, Isaac Fung, Gabriel Matute, Ece Kamar, and Walter Lasecki. To- wards hybrid human-ai workflows for unknown unknown detection. Proceedings of The Web Conference 2020, WWW '20, pp. 2432-2442, New York, NY. USA, 2020. Association for Computing Machinery, ISBN 978 9781450370233 doi: 22.145/336642333380333 URL
https::/doi.org// 10......11113366. 3380603
Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. Isolation forest. In Proceedings of the 2008 Eighth IEEE International Conference on Data Mining (ICDM), pp. 413-422. IEEE Computer Society, 2008. doi: 10.1 00.119//CDM22008..1.
Jinyang Liu, Wenwei Gu, Zhuangbin Chen, Yichen Li, Yuxin Su, and Michael R. Lyu. Mtad: Tools and benchmarks for multivariate time series anomaly detection, 2024. URL https://arxxx
org/abs/ 2401 06175
Qinghua Liu and John Paparrizos. The elephant in the room: Towards reliable time- series anomaly detection benchmark. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomezak, and C. Zhang (eds.), Advances in Neural Information Process- ing Systems, volume 37, pp. 108231-108261. Curran Associates, Inc.. 2024. URL www.nnuuip.... wttp:c/ccccpaeee /ttpee/eeeeee//ppp//////////// (e51590077..hnaalooefrrssseeeeep Track.pdf
and Benchmarks B
Aranyak Maity, Ayan Banerjee, and Sandeep Gupta. Detection of unknown-unknownss in cyber- physical systems using statistical conformance with physics guided process models. Asilomar Conference Signals, Systems, and Computers, 2023.
Aranyak Maity, Ayan Banerjee, and Sandeep K. S. Gupta. Detection of unknown-unknowns in human-in-loop human-in-plant safety critical systems. IEEE Transactions on Artificial Intelli- gence, 6(9):2526-2544) 2541, 2025. doi: 10.1 10.1000911222253555000..
Daniel A Messenger and David M Bortz. Weak sindy: Galerkin- bbased data-driven model selection. Multiscale Modeling & Simulation, 19(3):1474-1497, 2021.
Nobuo Namura and Yuma Ichikawa. Training-fre free time-series anomaly detection: Leveraging image foundation models. arXiv preprint arXiv:2408. /4756, 2024.
Andrew O' O'Brien, Rosina Weber, and Edward Kim. Investigating sindy as tool for causal discovery in time series signals. In ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 1 1-5. IEEE, 2023.
John Paparrizos, Paul Boniol, Themis Palpanas, Ruey Tsay, Aaron Elmore, and Michael accuracy evaluation measure for time-series anomaly detection. Proceedings of the VLDB Endowment, 15(11))277427787 2022.
Franklin. Volume under the surface:
Tomáš Pevný. Loda: Lightweight on-line detector of anomalies. Machine Learning, 102(2):275- 304, 2016. ISSN 1573-0565, doi: 10. 10.1007/ss09944-015555211
Sarah Pratt, lan Covert, Rosanne Liu, and Ali Farhadi. What does platypus look like? gener- ating customized prompts for zero-shot image classification. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 15691-15701, 2023.
Markus Quade, Markus Abel, J Nathan Kutz, and Steven L Brunton. Sparse identification of non- linear dynamics for rapid model recovery. Chaos: An Interdisciplinary Journal of Nonlinear Science, 28(6). 2018.
13

---

Published as a conference paper at ICLR 2026
Florian Schmidt, Florian Suri- Suri-Payer, Anton Gulenko, Marcel Wallschläger, Alexander Acker, and Odej Kao. Unsupervised amomaly event detection for vnf service monitoring using multivariate online arima. In 2018 IEEE International conference on cloud computing technology and science (CloudCom), pp. 278-283. IEEE, 2018.
L. F. Shampine, I. Gladwell, and S. Thompson. Solving ODEs with MATLAB. Cambridge University Press, Cambridge, UK, 1st edition, 2003. ISBN 9780521530941.
Mei-Ling Shyu, Shu-Ching Chen, Kanoksri Sarinnapakom, and LiWu Chang, A novel anomaly detection scheme based on principal component classifier. Proceedings of the IEEE foundations and new directions of data mining workshop, pp. 172-179. IEEE Press Piscataway, NJ, USA, 2003.
Haotian Si, Jianhui Li, Changhua Pei, Hang Cui, Jingwen Yang, Yonggian Sun, Shenglin Zhang, Jingjing Li, Haiming Zhang, Jing Han, et al. Timeseriesbench: An industrial grade benchmark for time series anomaly detection models. arXiv preprint arXiv:2402. 10802, 2024.
Alban Siffer, Pierre-Alain Fouque, Alexandre Termier, and Christine Largouet. Anomaly detection in streams with extreme value theory. In Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, KDD '17, pp. 1067-1075 New York, NY. USA, 2017. Association for Computing Machinery. ISBN 978 9781450348874. 3097983.30999 3098 144. URL htt.:httt:////t ort. 11451 http://..1111999999999 3098144
doi: 10.1145/
Ya Su, Youjian Zhao, Chenhao Niu, Rong Liu, Wei Sun, and Dan Pei. Robust anomaly detec- tion for multivariate time series through stochastic recurrent neural network. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, KDD '19, pp. 2828 2837, New York, NY, USA, 2019. Association for Computing Machin- ery. ISBN 9781450362016, doi: 10.1145/3292500.333077. URL httpss::/:oioooo///// 3330672
Ryan J Tibshirani, Rina Foygel Barber, Emmanuel Candes, and Aaditya Ramdas. Conformal pre- diction under covariate shift. Advances in neural information processing systems, 32, 2019.
Shreshth Tuli, Giuliano Casale, and Nicholas R. Jennings. Tranad: deep transformer networks for anomaly detection in multivariate time series data. Proc. VLDB Endow., 15(6):1201-1214, feb doi: 10. 10.14477//514461.355114
2022. ISSN 2090.
URL hattps:///bi..zgg///
14778/351 01778/3514661.1 3514067
Bingming Wang. Shi Ying, Guoli Cheng, Rui Wang, Zhe Yang, and Bo Dong. Log-based anomaly detection with the improved k-nearest neighbor. International Journal of Software Engineering and Knowledge Engineering. 30(02):239 200022222222 2020.
Yifei Wang and Mert Pilanci. Sketching the krylov subspace: faster computation of the entire ridge regularization path. The Journal of Supercomputing 19441171878 2023.
Renjie Wu and Eamonn J. Keogh. Current time series anomaly detection benchmarks are flawed and are creating the illusion of progress (extended abstract). 2022 IEEE 38th International Conference on Data Engineering (ICDE), pp. 1479-1480, 2022. 001
doi: 10.1 10.110//CDD53375..2222
Renjie Wu and Eamonn J. Keogh. Current time series anomaly detection benchmarks are flawed and creating the illusion of progress. IEEE Transactions on Knowledge and Data Engineering, 35 (3):2421-2429, 2023. doi: 10. 10.109//KDEE.201331122
Bin Xu, Ayan Banerjee, and Sandeep K.S. Gupta. Model Recovery at the Edge Under Resource Constraints for Physical AI. IOS Press, October 2025. ISBN 978 14436863188 doi: 10.3233/
faia251275. httttt/://dd doi wrw. 3233 2233//AAA251275
Bin Xu, Ayan Banerjee, and Sandeep Gupta. Merinda: Model recovery in fpga-based dynamic architecture for edge and physical ai. ACM Trans. Des. Autom. Electron. Syst., January 2026.
ISSN 1084-4309. doi: 10.1145/3793545. URL Just Accepted.
14

---

Published as a conference paper at ICLR 2026
Xuefeng Xu, Jingcheng Xu, Zhaoxi Chen, Bo Sun, Hongtu Zhu, Chaochao Chen, and Jianwei Yin. Anomaly transformer: Time series anomaly detection with association discrepancy. Interna- tional Conference on Learning Representations (ICLR), 2022. htth:tt: /ttp://vi///ppeeveee.. net htt.:/oorrummi1110000803
Zhijian Xu, Ailing Zeng, and Qiang Xu. Fits: Modeling time series with 10k parameters. ICLR Spotlight, 2024.
Keisuke Yoshihara and Kei Takahashi. A simple method for unsupervised anomaly detection: An application to web time series data. PloS one, 17(1)=e0262463, 2022.
Chaoli Zhang. Tian Zhou, Qingsong Wen, and Liang Sun. Tfad: decomposition time series anomaly detection architecture with time-frequency analysis. In Proceedings of the 3 ACM International Conference on Information & Knowledge Management, CIKM '22, pp. 2497-2507, New York, NY, USA, 2022. Association for Computing Machinery. ISBN 978 450399236.. doi: 00.144//511808.3557777
URL httph:tt/s/ooo http://dio.rgg....
www/o0.g/....... 1ttp://0..111/511111
3557470
Ziwei Zhao, Yuhang Lu, Quanming Yao. and Yong Li. Graph-augmented normalizing flows for anomaly detection of multiple time series. In International Conference on Learning Representa-
tions (ICLR), 2022. / http://wwww.../.tmt//emmmammm
Tian Zhou, Peisong Niu, Liang Sun, Rong Jin, et al. One fits all: Power general time series analysis by pretrained Im. Advances in neural information processing systems, 36:43322-43355, 2023.
Yujing Zhou, Cao Xiao, and Yan Liu. Multivariate time-series anomaly detection via graph attention networks. In Proceedings of the 20th IEEE International Conference on Data Mining (ICDM), pp. 841-850. IEFE, 2020. doi: 10. RAA10//CCDM5500022220000000
REPRODUCIBILITY
We will make our dataset public through the MTAD tools and techniques github page (Liu et al., 2024 for the general research community to develop novel U2 detection schemes. We have also shared our code in Abstract.
ETHICAL CONSIDERATIONS
One of the components of SPIE-AD is recovering underlying model. One of the applications of SPIE-AD is digital twins. An unethical usage is impersonation. Thus, careful ethical evaluation required when integrating such systems in medical practice. Another issue is that SPIE-AD is only U2 detection mechanism. In its current form it cannot be used to explain the reasons behind U2 occurrence. Such black box models can become problematic false positives lead to usage of critical intervention. Hence proper safeguards should be placed to vet the U2 decisions from SPIE-AD.
10 LIMITATIONS
SPIE-AD faces challenges in determining point anomalies that last very few samples. In the SMD SMAP and MSL datasets, anomalies that last < samples are missed consistently. Moreover, seen in Fig. 9 SPIE-ADS performance is sensitive to the window size chosen for the CRIE algorithm. Hence, an important future work is to formally evaluate the sensitivity of SPIE-AD to window length.
15

---

Published as a conference paper at ICLR 2026
PANEL A: MULTIVARIATE TIMESERIES ANOMALY DETECTION PIPELINE
DATA LEAKAGE
TRAIN DATA
MODEL TRAINING
ANOMALY SCORE
PEAKS OVER THRESHOLD
THRESHOLD
TRAIN
ANOMALIES LABELS
REPORTED
POINT AD USTMENT METHOP_
ACCURACY
VALIDATION
MODEL
PRECISION
RECALL
VALIDATE
ANOMALIES
ANOMALY SCORE
F1SCORE
EVALUATION
DETECTION LOGIC
REAL WORLD
NO LABELS
REPLICATE MODEL
ACCURACY
PRECISION
EVALUATE
TEST DATA
MODEL EVALUATION
ANOMALY SCORE
RECALL F1 SCORE
LABELS
SPIE-AD UNKNOWN UNKNOWN DETECTION PIPELINE
COEFFI CIENTS
CONFORMAL INFERENCE EVALUATION
SPARSE NON- LINEAR DYNAMICS EXTRACTION
MODEL ROBUSTNESS OPTIMIZATION
ROBUSTNESS INTERVAL [A..22]
TRAIN
ANOMALIES NO LABELS
HYPER- PARAMETER SEARCH
VALIDATION DATA
HYPER-PARAMETERS
EXTRACTION OF SPARSE NON- LINEAR DYNAMICS
VALIDATE
MODEL COEFFICIENTS
ANOMALIES
LABELS
REPLICATE HYPER-PARAMETERS
REAL WORLD ACCURACY PRECISION RECALL F1SCORE
TEST DATA ANOMALIES DATA
EXTRACTION OF SPARSE NON- DYNAMICS
DETECTION LOGIC
Figure 6: Panel A: SOTA MTAD pipeline with the identified issues highlighted by dashed arrows
and boxes. Panel B: SPIE-AD's approach for solving zero-shot MTAD problem.
A ALGORITHMS CRIE AND U2DETECT
Algorithm (X,
1: input Data (Xx) miscoverage level a, robustness function p. SMR
2: output Prodiction range
3: Split {1, 11...... N) into equal sized subsets Ey and Iv.
: 4: or L((X.): : Ir)
5: -y =(()))))
6: Average robustness
eng(p( //2,)))
7: For ench
each w compute residual R2 p(w), (0) -
8: return d the kth smallest value in ( Jv.. where [(1vl/2++ 1)(1 - o)
B EVIDENCE OF DATA LEAKAGE
(refer to line 196 to 200 in the data loader. - code in Anomaly y Tyy--rraa rans f cormer) r. Also it is evident from the code available in the github link for TSB- AD Liu & Paparrizos (2024). The fit function in line 97 in TSB-AD/TSB AD/modelsUSSA. extracts train and validation data and and function using dataloader. main.py line 39 instantiates data and line 44 extracts data_train from which train and validation data are extracted. However, at line 50 data train is passed as train data but the whole data is passed test data.
(line 180) extracts test data ADD/SS.AD//ain..p........ line 39 that loads the data. For supervised methods in
16

---

Published as a conference paper at ICLR 2026
Snippet of Results Anomalyy Transformer, GNAF Graph Augmented Normalizing Flows)
SPIE-AD evaluation on benchmarks SMD, SMAP, MSL [Xu et al. ICLR' 22]
Average scores (F1) and precision (P) three benchmark datasets for MTAD (Exhaustive metrics in Results Section)
Validation with data leak
Validation without data leak
With point adjustment
Without point
With point adjustment
Without point adjustment
adjustment
AT [ICLR'22]
F1:90 +2, +3
F1:25 1:966:
F1:0+0,P:0+:
F1:0 +0,
GNAF [ICLR'22]
F1:7444,P:75 +
F1:33 19,
F1:1.5 + 2, P:
F1:0.1+0,P:0.110
AnomalySimpleton
F1:92114, P:91
F1:441,P:23+
F1:040, P:01
F1:0#0,P: 0::0
SPIE-AD SINDY*
Not applicable
Not applicable
F1:781 8317
SPIE-AD LTCNN*
Not applicable
Not applicable
F1:84111,
F1: 8::4, 85:19
Figure 7: Snippet of SPIE-AD performance for zero-shot MTAD against recent MTAD works benchmark datasets.
Algorithm 2 U2Detect( ( -,L,o,d
1: input Test {Xx) si with robustness set of all coefficients recoverd from training set.
mean robusiness a, algorithm,
2: outpat label
3: I((X)):
W)
4: Compute residual R. plws, Q?)
5: if R.
d, d] then
6:
mark all samples in the window X; (not U2)
7: else
8:
mark all samples in the window X; (U2)
9: end
10:
return U2 label
C PERFORMANCE INFLATION
Point adjustment strategy inflates performance.
D LESSONS LEARNT WITH ANOMALYSIMPLETON
Ti Supplement) and (in Supplement) shows AnomalySimpleton could utilize PA and data leakage to beat GANF Zhao et al. (2022) and USAD Audibert et al. (2020a) baselines on all real benchmark datasets and was on par with Anomaly Transformers Xu et al. (022). However, when PA was eliminated, its Fl score drastically dropped. Moreover, if data leakage was disabled, then its Fl score became This shows a worse case machine with very poor realistic performance can result in very good anomaly detection method through the usage of point adjustment and threshold learning using test data. Through this misadventure, we have learned the following lessons:
Lesson 1: anomaly detection works should show results for both with / without PA or use metrics such as PA% K as proposed in Kim et (002)).
Lesson 2: anomaly detection works should explicitly address data leakage issue by either obtaining validation data from train set or ensuring that validation set and test set are mutually exclusive.
E U2 SYNTHETIC DATASETS
This is aircraft pitch control system using model predictive control for trajec- tory tracking. The U2 scenario is a hardware failure in Introduction section where the elevator gets jammed and maintains constant position overriding the controller (F8Stuck). Another U2 scenario is the elevator responds slower than normal (F8Slow).
F8 Cruiser:
UAV Altitude control: This is quadcoptor, whose altitude is controlled by four proportional inte- grative and derivative (PID) controllers. These controllers provide balanced thrusts in each propeller that the UAV maintains given height. The first U2 is software failure that changes the gravity
17

---

Published as a conference paper at ICLR 2026
parameter g in the controller software SimG), The second U2 scenario is electromagnetic attack on the UAV gyroscope sensor (UAV EMA).
Automated insulin delivery system:: This is hybrid close loop autonomous system that tonomously decides on insulin delivery for the most part, but requires human intervention with extra insulin delivery manage meal intake. The human may trick the system to deliver high dosage of insulin by announcing to the system that a large meal has been ingested without actually consuming the meal. This U2 scenario called phantom meal (haDPhantom). In the second scenario, the human participant poorly installs the insulin cartridge resulting in insulin occlusion or blockage. The block causes insulin build up and finally gives way and injects an overdose of insulin Al DCartridge.
In all the U2 examples, U2 scenarios are generated at random times with random duration of U2 activation sampled from a distribution.
E.1 WHY THESE DATASET ARE U2 AND NOT ANOMALIES?
F8 Cruiser (hardware-induced U2): We simulate the F8 aircraft using the MATLAB SINDY-MPC model from:
FLIGHT CONTROL.F8 CIIGGCITTTTTTTO.L..SSS
F8Stuck The SINDY-MPC F8 cruiser uses a pseudo-random bit stream (PRBS) elevator input for pitch control. After 4000 samples of nominal behavior, we jam the actual elevator actuation within the dynamical solver at its last valid value, while still logging the original PRBS stream. Thus, the recorded actuator signal looks normal, but the actuator entering the dynamics incor- an unmeasured hardware failure. F8Slow Similarly, after 4000 samples, the actuator entering the dynamics is reduced 75% of the nominal PRBS value, but the logged PRBS input remains unchanged.
Why these are U2: In both cases the marginal distribution of recorded data is unchanged (Figure 2B), but the underlying actuation delivered to the system is different, altering the governing dynamics and producing non-stationary process. This satisfies the definition of U2: same marginals, different underlying process.
Quadcopter UAV (software and sensor-induced U2) We use the quadcopter simulator from:
http://gthhbb.ommbbbbxxv/quguggt SSiCCo
UAVSimG stealthy sofwwrre attack At we increase gravitational acceleration gfor The controller, unaware of this manipulation, compensates with slightly larger rotor speeds (still within normal rotor limits), so the recorded sensor traces retain their usual marginal distribution. However, the physical model evolves under a different gravity constant.
UAVEMA barometer interference: We simulate the presence of a strong magnet near the UAV. This subtly corrupts barometer calibration and yields small but persistent elevation errors. Such calibration faults mirror real helicopter crashes where barometer drift caused catastrophic outcomes.
Why these are U2:
The recorded data remains marginally indistinguishable from normal (Figure 2B), but the system evolves under incorrect physics (wrong g) or incorrect altitude sensing, produc- ing non-stationary process with unchanged marginals.
Automated Insulin Delivery (AID) System - human error + hardware fault U2: We use the FDA-accepted Type I Diabetes simulator for glucose-insulin dynamics:
https//ppmc.ncb..lm..nm
AlDPhontom phantom meal declaration: A meal of 15 carbohydrate is reported to the con- troller but not actually ingested. The sensed glucose values remain high but stable (as typical when patients announce meals at high glucose values), the marginal glucose distribution does not shift. However, the controller interprets the phantom meal as a rising-glucose scenario and becomes unnecessarily aggressive in insulin delivery despite the absence of any physiological post-meal rise. This creates a mismatch: the recorded data looks normal, but the controller's 's behavior- and there- fore the closed-loop glucose-insulin dynamics-no longer matches the intended governing model.
18

---

Published as a conference paper at ICLR 2026
AIDCartridgeS - insulin pooling and burst delivery: Here the recorded insulin-delivens request is correct (e.g.. B units over minutes), but the cartridge mechanically fails to deliver at the correct rate. Instead it delivers only O.1B initially, pools insulin internally, and then releases the remaining 0.8Bt in a single burst once a threshold is reached. The logged insulin traces still appear normal because they reflect commanded delivery, not the actuator fault, there no marginal distribution drift. But the true physiological dynamics experienced by the patient model change dramatically because insulin is delivered physiologically incorrect pattern. This behavior is consistent with real-world failures reported in Medtronic case studies.
Why these are U2 (and not anomaly): In both AIDPhantom and AIDCartridgeS, the recorded data shows no distributional shift-glucose values remain within expected ranges and logged insulin traces look nominal. However, the underlying closed-loop governing equation changes:
1) In AIDPhantom, the controller becomes aggressive out of context, producing different in- sulin-glus gllcoolluuouee dynamic model even though the sensed glucose shows no rising- pattern.
2) In AIDCartridgeS, the true insulin delivery pattern diverges substantially from the logged (nomi- nal) delivery, changing the underlying physiological dynamics while the recorded marginals remain stable.
Thus both scenarios satisfy the definition of U2: no marginal distribution shift but a structural change in the underlying process, induced by human error (phantom meal) or actuator failure (insulin pool- ing).
E.2 WIYY REAL WORLD DATA ARE U2?
(a) Real-world U2 datasets: Medtronic R and Epilepsy R
These datasets represent true U2 events, i.e., situations where the underlying governing process changes but the marginal distribution of the sensed data does not.
Medtronic R (AIDCartridge U2): This dataset contains insulin-cartridge delivery failures where the observed (logged) insulin traces remain marginally normal, but the true physiological insulin delivery pattern changes dramatically due to pooling and burst-release. This alters the closed-looy insulin-glucose dynamics (non-stationary underlying process) without producing marginal distribu- tion drift. This is exactly a U2 event.
Epilepsy R: Sudden seizure onset produces an acute transition in brain neuroplasticity and changes the intrinsic neural dynamics. This a structural shift in the governing equation of the EEG process, ie.. a non-stationary change in the underlying generative model. However, scizure onset happens rapidly and may not manifest as marginal distribution shift within a short detection window. This again matches the definition of U2: process-level change, marginal drift. Thus, both Medtronic R and Epilepsy R are genuine U2 datasets, not anomalies.
(b) Real-world anomaly datasets
Because U2 events are rare, high-stakes, and often proprietary, large open datasets exhibiting true U2 behavior extremely scarce. Therefore, we also evaluate standard anomaly- deetetonn datasets, which do exhibit marginal distribution shifts. Our method remains applicable here for the following reason:
i) In anomaly scenarios, marginal drift causes the estimated governing equation to differ from the normal model.
ii) Since our framework evaluates deviations in the recovered underlying model, naturally detects anomalies aell-although this is not the primary focus of the paper.
This provides broader empirical validation and enables comparison against widely used anomaly- detection baselines.
E.3 LTC-NN MODEL RECOVERY ROBUSTNESS RESULTS
Table S1 51 shows the performance LTC-NN architecture described in Fig. of the main pa-
SNUY
SAMRSITY AFFECTING OROPOUT
IFUT DITT
DENGE
OOERS OF PHYSICS COSPHORNNS
MOCE EST MATES
CIFR DAX
19
CEIL
LOSS -1P--11

---

Published as a conference paper at ICLR 2026
per model recovery for different benchmark examples available in Kaiser et al. (2018).
For each evaluation experiment, metries:
two
Root mean square error in model coefficients (RMSEe) and Root mean square error in signal (RMSEy). Given the estimated model coefficients Pest and measured variables Yest for any technique computed them as:
RMSE V / (0'm 8073.
(3)
RMSFY Ei v E ()) v'())..
(4)
Table S1: Comparison LTC-NN architecture with baseline SINDY-MPC only and other RNN
architectures standard benchmarks. L.CC-NNMR represents model recovery with LTC-NN ar-
chitecture shown in Fig. g
The LTC-NN can be replaced by CT-RNN NODE. Value (
standard deviation
Example
RMSE
SINDY-MPC
LTC-NN-MR 0,048 (0.015)
CI-RNN-MR
NODE-MR 0.064 (0.02)
Lotka
RMSF.
0.059 (0.02)
0.054 (0.03)
Volterra
RMSEY
0.03 (0.02)
0.03 (0.018)
0.05 (0.02)
0,088 (0.03)
Chaotic
RMSEe
(0.008)
0.015 (0,006)
0.022 (0.009)
(0.02))
Lorenz
RMSEY
1.7)
1.68 (0.4)
3.66 (1.1)
(3.6)
F8
RMSEe
(.2)
(2.9)
10.3 (4.5 (4.8)
(7.4)
Crusader
RMSEY
3.2
(1.4)
(2.6)
7.22
Pahlggencss
AMSEE
0.5 (0.2)
0.39 (0.23)
0.43 (0.3)
0.42 (0.3)
attack
RMSEY
(9.1)
28.3 (6.2)
28.8 (7.7)
29.5 (9.6)
E.4 DESCRIPTION OF REAL WORLD DATASETS
We used three real datasets:
Server Machine Database: The Server Machine Dataset (SMD) is newly curated dataset that spans a period five weeks, collected from a major Internet company known for its extensive server infrastructure Su et al. (2019). This dataset, which includes detailed logs and metrics related to server machine performance, has been made publicly available on GitHub to support research in anomaly detection and related fields.
The SMD dataset comprises a wide range of features, including CPU utilization, memory usage, disk I/O, and network traffic, collected regular intervals. For practical analysis, we have divided the dataset into two equal-sized subsets: the first subset, which covers the initial period of the data collection, is used the training set. The second subset, covering the remaining period, desig- nated as the testing set.
In the testing subset, domain experts have meticulously identified and labeled anomalies, along with their specific dimensions, based on a thorough examination of incident reports and historical data. These labels provide valuable insights for evaluating anomaly detection algorithms and enhancing their accuracy.
Soil Moisture Active Passive Satellite: The Soil Moisture Active Passive (SMAP) satellite al. (004) is NASA mission designed to measure and monitor soil moisture levels across the globe. SMAP employs combination of active radar and passive radiometer technologies to provide high- resolution measurements of soil moisture, which are crucial for understanding water cycles, weather patterns, and climate change. The satellite records key performance indicators (KPIs) related to its operational status and performance metrics, including data the satellite's health, instrument func- tionality, and environmental conditions. These KPIs are essential for ensuring the proper functioning of the spacecraft and for diagnosing and addressing any issues that may arise during its mission.
Mars Science Laboratory Rover (MSL): The Mars Science Laboratory (MSL) rover Liu et al. 2024). commonly known as Curiosity, is NASA rover mission designed explore the surface of
20

---

Published as a conference paper at ICLR 2026
Table 6: Comparison of MTAD methods real-world datasets (FI; Time in minutes). Left block:
SMD, middle: SMAP, right: MSL.
MTAD Method
SMD
SMAP
MSL
A3
-A3
-A2
Time
A3
-A3
-A2
Time
A3
-A3
-A2
Time
D
175
GANF
78.6
41.2
3.4
361
71.9
32.8
1.1
179
73
24
D
165
OFA
72.9
2.5
1,9
318
86.9
9.4
5.1
171
82.7
22.3
4,4
159
FITS
99.9
32.7
11.2
281
70.74
13.4
2.2
164
78.12
15.3
4.3
141
TEAD
89.3
21.7
4,1
211
96.3
35.4
7.7
135
96.4
40.1
8.8
122
AnomalySimpllton
96.2
2.0
90.5
0
7
89.5
4.8
0
6
SPIE-ADS
SPIE
86
86
86
323
79
73
73
208
83
83
83
178
Table 7: Comparison of AD methods univariate datasets (event- wise accuracy).
AD Method
UCR
Yahoo
NAB
Proti
0,512
0.23
0.2
Time VQVAE
0,708
01.
0.6
TranAD
0.19
0.6
OFA
0.5
0.8
0.92
FITS
0.47
0.8
0,9
TFAD
0.37
0.8
SimmpllySimpltton
0.13
0.2
0.2
SPIE-ADS
SPIE-ADE 0.756
0.8
0.94
Mars. Equipped with a suite of scientific instruments, the MSL rover conducts a variety of experi- ments study Mars' geology, climate, and potential for past habitability. The rover records KPIs related to its operational performance, such as power consumption, temperature readings, and com- munication status. These performance metrics are critical for monitoring the health and functionality of the rover, managing its systems, and troubleshooting any technical challenges that arise during its exploration of the Martian surface. The data collected helps scientists and engineers ensure the rover's iss effective operation and mission success.
E.5 EXTENDED TABLE FOR REAL WORLD DATASET
Table S2 g shows the extended results for Table 0 and in supplement with precision and recall values.
E.6 SPIE-AD HYPER-PARAMERR PARAMETER OPTIMIZATION
Given threshold of r%, the hyper parameters of the SPIE-AD method extracts the hyper-paramiesr of the SPIE-AD method so that atleast r% data from the training set falls within the robustness interval [P1. P2), while minimizing (P2-P1) P1). The algorithm currently is brute force search through all possible prper-parameter combination to find the best hyper- paramters that matched the above- mentioned conditions.
E.7 MORE INFORMATION DISTRIBUTION SHIFT
Although the definition of anomaly does not directly imply distribution shift between anomalous and normal data, analysis of existing anomaly benchmark datasets reveal otherwise (Table Dp. We use the Halmogorov-Smimoe
(KS) hypothesis test (KS 2008) to evaluate difference in distribution parameters between normal and anomalous data. is observed that in almost all real world bench- mark datasets > 90% of test cases have data distribution shift. In Table 9 we report percentage of distribution shift (PDS) the percentage of anomalous data which has a different distribution than normal data given by the KS test.
E.8 THRESHOLD INDEPENDENT METRICS
SPIE-AD is not anomaly thresholding model. The only control knob we have is the converage level in Algorithm CRIE. In all our experiments set to 0.05 which standard most statistical methods. As such is not threshold but it has role in determining the robustness range. To obtain AUC ROC and AUC PR, VUS ROC and VUS PR. we varied this a from 0.05 to 0.2 in steps of 0.025. In this regard I used the code available in https://githb..com wwt.e/ooo///nnnneeee compute all the abovementioned metrics of some of the baselines in Table and In particular we took the top baselines and SPIE-ADS from Table to get the Table 10
to
21

---

Published as a conference paper at ICLR 2026
Table 8: S2: Comparison of SPIE-AD with latest baseline techniques on real world datasets and ablation studies. The datasets all satisfy Al.
Method
SMD
A3
- A3
A2
AT
100
90.7
29
58.6
38.8
GANF
39.5
93
78.6
28
78
41.2
30.6
1.8
3.4
USAD
94
43.1
12.2
80
21.2
12.2
80
21.2
AnomalySimiitoon
98.2
96.2
2.0
SPIE-ADS
64
87.7
74
6.3
86.7
73
63
86.7
73
SPIE-ADL
86
83
389
89
86
A3
-.A5
A2
AT
83.8
100
91.2
12.7
90
22.3
GANP
19.9
0.6
USAD
100
62
15.1
26
AnomalySimpletun
86.4
95.1
90.5
13.6
2.4
4
0
SPIE-ADS
68
52
87
52
65
SPIE-ADL
79
82.
Method
MSL
A3
A3
A2
79.5
GANF
85
73
16
48
USAD
44.5
38
41
14.5
23.8
18
14.5
23.8
18
AnomalySSmplcton
89.4
89.5
20.9
4.8
SPIE-ADS
80.2
86
83
80.2
80.2
86
83
SPIE ADL
80.3
85.8
83
80.3
83.8
83
80.3
85.8
83
Dataset
No. of time
PDS
series
Server Machine Dataset SSu all
38
91%
(2019)
al 2019)
Mars Science Lab Rover Su al.
93%
20119
SWal dataset Goh et al. 20017
51
92%
WADI datasel Almmed
dataselAAmeed el all 2017
123
95%
Pooled Server Metri Abdulaal
100%
Lancewick] 2021)
UCR anomaly
detoction
250
94%
Keogh 2203
Yahooo unoomally detection Yoshihumi
100
91%
2022
NAB datanel Ahmad
(017)
94%
Table 9: S3: Percentage of distribution shift (PDS) in anomaly detection benchmark datasets
Table 10: $4: Threshold independent metrics
Method
SMD
SMD
SMD
SMD
SMAP
SMAP
SMAP
SMAP
MSL
MSL
MSL
MSL
AUC
AUC
VUS
VUS
AUC
AUC
VUS
VUS
AUC
AUC
VUS
VUS
ROC
ROC
ROC
ROC
AT
0.46
0.59
0.56
0.37
0.35
0.44
0.41
0.29
0.25
0.33
0.29
FITS
0.57
0.55
0.62
0.59
0.41
0.37
0.47
0.43
0.42
0.38
0.47
0.44
TFAD
0.60
0.55
0.64
0.58
0.43
0.41
0.47
0.44
0.46
0.44
0.53
0.50
SPIE-
0.58
0.65
0.52
0.51
0.54
0.62
0.58
0.64
0.59
ADS
22

---

single CPU Published as a conference paper at ICLR 2026
200
Event wise anomaly
detection accuracy
Window sizes averaged
150
over 250 datasets
100
50
0
5
10
15
20
Mean window size as a percentage of total data size
Figure 9: Event wise anomaly detection accuracy of SPIE-ADS with varying window size. Results averaged over 250 UCR datasets.
WINDOW SIZE SENSITIVITY
We use the UCR database to evaluate sensitivity to window size for our approach as it has the largest number of real world datasets (n = 250) to ensure statistically stable results. The window size varied as a percentage the total dataset size for each database. Fig. shows that large window sizes reduces the accuracy of detecting small fraction of the window size. When the window size is too small, SINDY-MPC core fails to extract accurate models of the underlying governing dynamics decreasing its accuracy. Hence, there is a optimal window size for each dataset.
anomalous event since the event size maybe
G COMPUTATIONAL COMPLEXITY
There are two MR cores of SPIE-AD: SINDY-MPC and LTC-NN. SINDY-MPC uses the sequential threshold ridge regression (STRidge) Kaiser et al. (2018) strategy. The computational complexity of Ridge regression the worst case O for N samples and dimensions, since for MTAD number of regularization parameters is less than N Wang & Pilanci (023). The sequential threshold runs Ridge regression multiple times until a desired reconstruction accuracy obtained. If we fix maximum Q number of iterations then the overall computational complexity of SINDY-MPC: is o(QNn²). For the LTC-NN architecture, the computation complexity of forward pass OVV + V([0) 4)) + O(]X]N), where, V, O, X are as in Fig. Complexity of backward pass is where PLAC is the number of parameters in the LTC cell, and Paense is the number of parameters in each neuron of the dense layer. SINDY-MP
O(VPLTCNN + +V([]
+) Paenee
thread was 11.3 (+: 2. times faster than LTC-NN on GPU. The overall computational complexity O((N/W)QN'²) for SPIE-ADS and PITT/ V([@) + q) P Paense
23

---

Published as a conference paper at ICLR 2026
Table 11: Related works. Sampling High is Nyquist rate, Low is Nyquist rate. Bold = baselines.
Approach
Sampling
Inputs
Rationale baselime
SINDy Quade al. 8
llgh
Na
Cannot handle inputs
SINDy-MPC Kaiser ot (218))
High
Yes
Widely used
E-SINDy Fascl
Low
SINDY-MPC B-SINDy inputs
Wy Messennerr & Bortz 2021
High
No
Focuses on noise reduction
LTC-NN (This Work)
Yes
Proposed in paper
Accuracy, Detection delay, Precision, Event Coverage, False Acceptance Rate, and F1 score for high noise EcB signal to noise ranio for SPIE-ADL
080
12
Saggan Tragenyy
Sugpag Trepiny
Suggig
004
Figure 10: Performance variance with respect to sampling frequency, and library size (higher poly- nomial order results in combinatorially larger library). High Noise case. Low noise case main paper Fig.
H ADDITIONAL EXPERIMENTS
Table IT shows different SINDY variants.
H.1 DATA AND CODE AVAILABILITY
The data and code for model recovery using SINDY-MPC are available in https://ggtthe com/ ImpactLabASU Taw.AS////RReeoiiiiiioo
To use LTC-NN a manual transfer of model coefficient is required and the pipeline is not en- tirely automated. Hence, the models available in lhtps:: //gittubb.////////// /tttps://github com/ Impaat LTC-NN-ME has to be run first and the saved model coefficients needs to be transferred to the U2Recognition github and then run the files described in the U2Recognition github.
The AnomalySimpleton also known as SMDTrash is available in https: https://qithub. com/ Imgactt.abbS//Anomm///bbrr
24

---

Published as a conference paper at ICLR 2026
Avg Detection Delay (samples)
140
0.7
120
0.6
100
Accuracy
0.8
Procision
0.5
0.4
0.8
0.3
0.4
0.2
Sampling Frequency (Ha)
Sampling Frequency (Ha)
Sampling Frequency (Hz)
0.8
0.1
Fabs Acceptance Rate
0.7
Event Coverage
0.08
0.7
F1 Score
0.6
0.6
0.04
50
100
50
100
50
100
Sampling Frequency (Ha)
Sampling Frequency (Hz)
Sampling Frequency
(Hz)
SINDY
LITNNN SINDy
SINDy-MPC
Figure 11: Effect of different SINDY variants on SPIE-AD.
Avg Detection Dolay (samples)
80
0.9
Accuracy
Precision
60
0.8
0.5
40
0.7
20
0.8
0.4
100
100
Sampling Frequency (Hz)
Sampling Frequency (Hz)
Sampling Frequency (Hz)
0.9
0.8
0.03
False Acceptance Rate
0.8
0.025
Event Coverage
0.7
0.7
F1 Score
0.02
0.6
0.015
0.6
0.01
0.5
0.005
50
100
50
100
50
100
Sampling Frequency (Hz)
Sampling Frequency (Hz)
Sampling Frequency (Hz)
CT-RNN
LTC-NN SINDy
Figure 12: Effect of different continuous time backbones on SPIE-AD,
25


Reviews:
[{"review_id": "PEwS41DiLv", "reviewer": "Reviewer_u3Fj", "summary": "This paper tackles unknown unknowns (U2) in autonomous systems-deployment-time failures that do not show input-distribution shift: learn sparse governing equations for normal operation and flag windows whose recovered parameters deviate from the nominal set. The proposed SPIE-AD pipeline continuously extracts sparse nonlinear dynamics from multivariate time series (via SINDy-MPC), refines them with liquid time-constant neural networks for robustness under low sampling and noise, and applies a conformal-inference robustness score to test whether the window’s model remains consistent with normal; in short, it checks whether \\(x_{t+1}\\!\\approx\\!f_\\theta(x_t)\\) has changed even when \\(p(x)\\) has not. Beyond methodology, the paper builds eight U2 benchmarks, diagnoses common evaluation inflations (point-adjustment and test-set threshold leakage), and reports that SPIE-AD outperforms strong MTAD baselines on all U2 benchmarks and on six additional real-world datasets under leakage-free evaluation.", "questions": "- In settings with hidden states or unmeasured actuations, do you consider SINDy-with-control (or DMDc) and, if not, how would you adapt SPIE-AD to avoid spurious alarms from unmodeled inputs? \n- Beyond window-F1 (no PA), can you report time-to-detect, event detection rate, and false-alarms per hour to reflect operational constraints? \n- What are wall-clock costs per window on your real datasets, and how does the LTC-enhanced variant compare to SINDy-only or light continuous-time alternatives (Neural ODE/CDE) for real-time use?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- Reframes anomaly detection as spotting dynamics/relationship shifts (U2) instead of input-distribution or class shifts, and makes it concrete by learning sparse governing equations and checking their stability over time.\n\n- Uses a principled, modular pipeline, SINDy for sparse model discovery, optional liquid time-constant RNN refinement, and conformal testing, and evaluates without point-adjustment or test-set threshold leakage for fair comparisons.\n\n- Figures crisply contrast the standard MTAD pipeline with the proposed U2 detector and anchor the idea with concrete scenarios; the rule is stated cleanly at the level \\(x_{t+1}\\!\\approx\\!f_\\theta(x_t)\\).\n\n- Targets safety-critical multivariate time series (e.g., UAVs, insulin delivery, EEG) and shows consistent gains on curated U2 benchmarks under strict, leakage-free settings, pointing to a realistic path to deployment.", "weaknesses": "- The detector hinges on recovering a correct sparse dynamics model; errors from derivative estimation, library choice, noise, or unobserved states can flip decisions. Add robust SINDy variants and report sensitivity to library/sampling/noise.\n\n- The LTC refinement (ODE-solved RNN) can be heavy for short windows or high-rate streams. Provide wall-clock profiles vs. SINDy-only baselines and consider lighter continuous-time alternatives (Neural ODE/CDE) or pruning.\n\n- Window-F1 (no PA) is a step forward, but operators care about time-to-detect, event coverage, and false-alarm rate. Include NAB-style timeliness scoring and precision–recall vs. latency curves under fixed alarm budgets.\n\n- Several U2 cases are synthetic or parameter flips that sparse polynomial models capture well. Stress-test partial observability, exogenous inputs (use SINDy-with-control), multi-timescale effects, and non-polynomial terms; document known failure modes.\n\n- Performance is sensitive to window length, library size, sparsity thresholds, and miscoverage level. Provide a compact sensitivity study and rules-of-thumb, plus robustness to mis-specification.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "fMAizI415k", "reviewer": "Reviewer_H3Ew", "summary": "This work discusses the problem of operating in the presence of unknown unknowns (U2) data from multivariate time series, based on the hypothesis that state-of-the-art anomaly detection mechanisms are not well-suited to identify this type of data, when any of three assumptions are violated:\n\n1- There is a shift in the data distribution due to an anomaly \\\n2- Data leakage is used to fine-tune the anomaly threshold hyperparameter \\\n3- The evaluation setup takes place in an unrealistic setup (i.e, anomalies are continuous)\n\nThe paper presents the following contributions:\n1) It introduces SPIE-AD, a methodology to detect U2 when the above mentioned assumptions do not hold. At its core, SPIE-AD consists of a sparse non-linear dynamical model recovery strategy, and model robustness interval extraction through conformal prediction. \\\n2) Six synthetic benchmarks s derived from U2 scenarios occurring in three different real-world system I am running a few minutes late; my previous meeting is running over.\\\n3) Experimental demonstration of the disadvantages of using point adjustment (PA)", "questions": "At the core of the assumptions and hypotheses that drive this work is the definition of what constitutes an unknown unknown. This is not entirely clear from the paper, and in particular from the datasets used. Hence:\n\n1. For the synthetic datasets: how exactly are the abnormal scenarios generated? Following the definitions in the paper, what makes them a U2 and not an anomaly?\n2. For the real-world datasets: From the description, it seems that this work deals simply with anomalies. However, the introduction discusses that an anomaly is not a U2. What is your position here?\n\nOverall, from the paper, it is not clear why the proposed method should be consider as an U2 detector, rather than a \"classical\" MTAD. Please develop.", "limitations": "", "rating": 2, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "- The problem of dealing with unknown unknowns is highly relevant in many applications, still challenging, and actively researched.\n- The paper gathers a good number of baselines and datasets for their experiments", "weaknesses": "- The explanation/definition of U2 is based on a couple of examples illustrated in the paper. A formal (mathematical?) definition is highly desirable to clearly establish when a sample should be denoted as a U2 or an anomaly.\n- Conformal prediction as per [19] is about estimating prediction intervals even when the distribution of the training and test sets deviate, under the condition that the training data is i.i.d.. This, however, does not hold strictly for time series as subsequent points are not independent. The paper does not specify under which circumstances the assumption can be relaxed in this work \n- Some details about the multiple hyperparameters, terms involved, and precise function definitions (i.e., $\\rho$) are not specified.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "u4Eqo93Uob", "reviewer": "Reviewer_16mj", "summary": "This paper tackles the emerging problem of unknown-unknowns (U2s) in time-series anomaly detection—cases where there is no obvious out-of-distribution shift from normal data, making traditional detection methods ineffective. The authors identify three key challenges: the absence of distributional deviation, the impractical enhancement of existing models, and data leakage in threshold calibration. To address these, they propose a sparse model identification–enhanced anomaly detection framework tailored to handle U2 scenarios. Extensive experiments are conducted on synthetic U2 benchmarks and multiple real-world multivariate anomaly detection datasets, showing that the proposed method outperforms a range of baselines.", "questions": "Could the authors provide quantitative or qualitative evidence illustrating how their method distinguishes U2 anomalies?\n\nAs the authors note that SPIE-AD struggles with short-lived anomalies, could the authors elaborate on potential approaches to alleviate it?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "The paper explores an interesting and relatively new direction in anomaly detection by formally framing and tackling the concept of unknown-unknowns. The writing is generally clear, and the empirical section is comprehensive and convincing. The authors provide strong evidence that their method can distinguish subtle anomalies even when there is no visible distribution shift. The experiments are rigorous, covering both synthetic U2 datasets and widely used multivariate benchmarks, with appropriate metrics and detailed comparisons. Overall, the work is solid, timely, and contributes a valuable perspective to the time-series anomaly detection literature.", "weaknesses": "1. While the technical contribution and empirical results are strong, the paper could be significantly improved in presentation and positioning. The current layout is too compact: equations appear small and dense, while several tables (e.g., Tables 1, 3, and 4) occupy disproportionate space, making the interleaved text uneven and hard to read. Improving figure/table sizing, rounding consistency, and overall margin balance would greatly enhance readability. Adding visual highlights or color emphasis in key tables could also help.\n\n2. The related-work discussion is incomplete and occasionally overstated. The statement “To the best of our knowledge, there is only one solution for zero-shot MTAD Audibert et al. (2020)” is inaccurate. Other relevant works, such as ITF-TAD, UniTS, should be properly discussed and contrasted. Also, the paper only mentions SIGLLM but omits relevant methods such as VLM4TS, which also address zero-shot and training-free detection in related settings. A fairer and more complete comparison would strengthen the contribution.\n\n3. Beyond metrics, it would also be valuable to include additional qualitative analyses or visual case studies. For instance, Figure 2 could be expanded to show how different methods (including baselines) behave under normal versus anomalous regimes, visually demonstrating how the proposed model differentiates subtle shifts that are not captured by these metrics.\n\nNamura, Nobuo, and Yuma Ichikawa. \"Training-free time-series anomaly detection: Leveraging image foundation models.\" arXiv preprint arXiv:2408.14756 (2024).\nGao, Shanghua, et al. \"Units: A unified multi-task time series model.\" Advances in Neural Information Processing Systems 37 (2024): 140589-140631.\nAlnegheimish, Sarah, et al. \"Large language models can be zero-shot anomaly detectors for time series?.\" arXiv preprint arXiv:2405.14755 (2024).\nHe, Zelin, Sarah Alnegheimish, and Matthew Reimherr. \"Harnessing Vision-Language Models for Time Series Anomaly Detection.\" arXiv preprint arXiv:2506.06836 (2025).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)