Self-Perturbed Anomaly-Aware Graph Dynamics for Multivariate Time-Series Anomaly Detection
Authors: Jinyu Cai
Yuan Xie
Glynnis Lim
Yifang Yin
Roger Zimmermann
See-Kiong Ng
Venue: NeurIPS 2025 spotlight ()
Keywords: Anomaly Detection
Time-Series Analysis
Graph Neural Networks
Spatio-Temporal Graph
Primary area: general_machine_learning

Abstract: Detecting anomalies in multivariate time-series data is an essential task across various domains, yet there are unresolved challenges such as (1) severe class imbalance between normal and anomalous data due to rare anomaly availability in the real world; (2) limited adaptability of the static graph-based methods to dynamically changing inter-variable correlations; and (3) neglect of subtle anomalies due to overfitting to normal patterns in reconstruction-based methods. To tackle these issues, we propose Self-Perturbed Anomaly-Aware Graph Dynamics (SPAGD), a framework for time-series anomaly detection. SPAGD employs a self-perturbation module that generates self-perturbed time series from the reconstruction process of normal ones, which provide auxiliary signals to alleviate class imbalance during training. Concurrently, an anomaly-aware graph construction module is proposed to dynamically adjust the graph structure by leveraging the reconstruction residuals of self-perturbed time series, thereby emphasizing the inter-variable disruptions induced by anomalous candidates. A unified spatio-temporal anomaly detection module then integrates both spatial and temporal convolutions to train a classifier that distinguishes normal time series from the auxiliary self-perturbed samples. Extensive experiments across multiple benchmark datasets demonstrate the effectiveness of SPAGD compared to state-of-the-art baselines.

Self-Perturbed Anomaly-Aware Graph Dynamics for Multivariate Time-Series Anomaly Detection
Jinyu Cai Institute of Data Science National University Singapore j jinyucai Cnus. edu sg
Yuan Xie School of Computing National University of Singapore sesyuannsss@outlook com
Glymnis Lim
Yifang Yin
Institute of Data Science National University of Singapore Mlynnis@nus edu.sg
Institute for Infocomm Research
A *STTAR, Singapore
yin yinangfan.. a-sstarsrr.... edu. sg
Roger Zimmermann
See-Kiong Ng
School of Computing
Institute of Data Science National University of Singapore seekiong@nus. eduu
National University of Singapore dcsrzõnus. edu. ag
Abstract
Detecting anomalies in multivariate time-series data essential task across vari- ous domains, yet there are unresolved challenges such as (1) severe class imbalance between normal and anomalous data due to anomaly availability in the real world; (2) limited adaptability of the static graph-based methods to dynamically changing variibve correlations; and (3) neglect of subtle anomalies due overfitting to normal patterns in peconstructionn-asse methods. To tackle these issues, we propose Self-Perturber Anomaly-Aware Graph Dynamics (SPAGD), a framework for time-series anomaly detection. SPAGD employs self- eeff-perturbtiion module that generates self- heffupertureed time series from the reconstruction process of normal ones, which provide auxiliary signals to alleviate class imbalance during training. Concurrently, an anomaly-aware graph construction module is proposed to dynamically adjust the graph structure by leveraging the reconstruction residuals self- helffperturbed time series, thereby emphasizing the inter-variable disruptions induced by anomalous candidates. A unified spatio-temporal anomaly detection module then integrates both spatial and temporal convolutions to train a classifier that distinguishes normal time series from the auxiliary self-perturbed samples. Extensive experiments across multiple benchmark datasets demonstrate the effec- tiveness of SPAGD compared to state-of-ther of-the-art baselines.
Introduction
Time-series anomaly detection (TSAD) Blazquez-García al. 202
Zamanzadeh Darban al.
2024] is an essential machine learning task with significant influence in various domains, such as cybersecurity, industrial systems, healthcare, and finance /Veeavallli al, [007]] Cook al. 2019) Schmidl et al., (2022] Zhang et al. 2024b] Qi et al.) [025 Fang et al. [025]. It aims to identify
patterns that deviate from expected behavior over a period time, to alert to potential faults,
"Corresponding Author
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

mwm m
m
Encoder
Decoder
M
Time-Serles Data
Reconstructed Time-Serios
Reconstruction Residuals
Graph Construction
Anomaly
Aware Module
Relation Graph
Adjusted Relation Graph
Mammal Jnnnn
Seif toop >
Predictor
Normal Time-series
Neighbor Augregation
Comporal Chonks
Mustill
Anomaly Prediction
Perturbed
Spatial Convolution
Temporal Convolution
Figure I: An illustration the proposed SPAGD framework, which contains three main components: (1) Self-perturbation time-series generation; (2) Anomaly-aware graph construction; and (3) Spatio- temporal modeling for anomaly detection.
intrusions, critical events. Multivariate time-series anomaly detection, in particular, presents significant challenge due to the complex spatial and temporal inter-variable dependencies among multiple time-series data.
Over the past decades, TSAD has witnessed significant progress. Early methods are mainly based on
proximity [Breunig et al. 22000 Qi and Chen 20222. linear model [Wold er al. 1987 Schölkopf er
al.[2000 clustering [Chen et al. 2022b Liu et al. 2022; Chen et al. [022a Liang et al. 2022 Fu
al 2025 or outlier ensembles Liu al. 22008] These methods rely on strong assumptions and
often struggle with large-scale or high-dimensional data. In recent years, deep learning has emerged
as powerful alternative (Zamanzadeh Darban et al. [024), with various types of approaches being
proposed. For example, the reconstruction--ant based methods [Audibert er al. 2020: Yang er al. 2023
Wang et al. 2023) employ deep neural network architectures [Baldi] 2012 Goodfellow et al. 2020
to learn latent representations of normal behavior. Anomalies are detected as instances exhibiting significant reconstruction errors, reflecting their deviation from learned norms. Concurrently, forecast- based methods (Tuli et al.) [2022] Xu et al. [2022] Wu et al. 2023a] have leveraged sequence modeling techniques [Mdssker et al.) 2001| Vaswani et al. 2017 7 Fang et al. 2023) to capture temporal dependencies and predict future values, where anomalies
flagged when observed values diverge from predictions. Although these approaches exhibited effectiveness, they generally treat each variable time stamp independently, neglecting the rich variable dependencies in multivariate time series. Therefore, recent endeavors [Zhao er al.) 2020 Deng and Hooi 2021 have explored the potential of graph neural networks (GNNs) [Kipf and Welling 2017; et al. 2023 Wu et al.) 20236; Cai et al. 2024a] 20236) Liu et al., (025b) to explicitly model variable dependencies, where variables (e.g., sensors) are represented
nodes in a graph, with edges encoding spatial relationships. Advanced methods [Zheng et al. 2023 Chen el al. 2024) further incorporate GNNs with temporal convolution capture temporal dynamics for detecting anomalies.
Although these advanced methods provide a promising solution for detecting anomalies multivariate time-series data, several key challenges still persist:
Time-series anomalies are rare or even unavailable in real-world scenarios. The severe imbalance between normal and anomalous time series (Zamanzadeh Darban et af.) [024] could bias the model towards normal patterns during training, thus significantly weakening its generalizability.
2. Existing graph-based methods [Dngg and Hooi, 2021 Zheng et al. 2023 typically rely on static graph construction strategy to model spatial dependencies time-series data, yet these dependencies may significantly alter due to dynamic noomlly-inuuced distortion.

---

3. The "anomaly reconstruction" problem [Audibert et al. 2020; Song et al. [023] indicates that certain anomalies may inadvertently be well-reconstruucted in reconstruction- based methods due to the overfit towards normal patterns, thereby overlooking anomalies with low reconstruction error.
To address these challenges, we propose new TSAD framework named Self-Perturbed Anomaly- aware Graph Dynamics (SPAGD). SPAGD introduces self-perturbation module that leverages inherent deviations during the process of reconstructing normal time series to generate self-perturbed time series. These generated time-series data subsequently serve as the auxiliary signal for training the anomaly detection model, where the model exposed to diverse potential anomalous patterns for alleviating the imbalance problem. Simultaneously, an anomaly-aware graph construction scheme is introduced to learn dynamic inter-variable correlations derived from the evolving reconstruction residuals of self-perturbed time series. Then, we developed a spatio-temporal anomaly detection module to distinguish the self self-perturbed time series from normal ones, which effectively integrates both spatial dependencies and temporal dynamics to yield holistic representations for TSAD. SPAGD is trained in an end-to-end manner for the mutual improvement of all components during training. Extensive experiments compared to state-of-the art TSAD baselines demonstrate the superiority of the proposed SPAGD method. We summarize the main contributions of this paper as follows:
We introduce self- seff-perturbaion module that generates diverse auxiliary anomalous time series through the evolving reconstruction process of the normal time-series data, which alleviates the severe imbalance problem without relying on any external anomalous data.
We propose an anomaly-awar graph construction module that dynamically adjusts the graph structure based on the reconstruction residuals of the self-perturbed time series, thus reflecting the changing anter-variable correlations that traditional static strategies fail to capture.
We build an anomaly detection framework that trains a classifier by exploiting both spatial and temporal dependencies to distinguish normal time series from auxiliary self- reffupert ones, which jumps out of the reconstruction- basod framework and mitigates the anomaly reconstruction problem.
2 Related Works
Multivariate TSAD Blázquez-Garcte et al. 2021 Zamanzadch Darban et al., 2024 Zhang et at. [024a] is a complex and challenging research area, with a variety of methods emerging in recent years. The sequence-centrie models primarily leverage the temporal dynamics of time series,
such as Anomaly Transformer [Xu et al.) 2022] and TranAD (Tuli er al. 2022], which utilize a Transformer architecture capture long- term dependencies, while TimesNet [Wu et al. 2023a enhances detection accuracy through multi-scale temporal decomposition. These methods excel at modeling temporal patterns within individual channels, however, they typically process each variable channel independently, overlooking inter-variable correlations. In recent years, graph- based models have been widely explored address this limitation, where graph constructed represent the relationships between multiple variables, with GNNs [Cai et al. Liu et al. 20244 Cai et al. 2025a] employed for anomaly detection. For instance. GDN [Deng and Hooi |021] pre-constructs a similarity graph to help predict anomalies, and GRELEN Zhang et al. 2022] integrates graph relational learning to improve feature extraction. Moreover, recent approaches [Zheng et al. 2023 Ding et al. 2023] have proposed learning comprehensive representations by incorporating both spatial and temporal dependencies. However, their reliance on fixed graph structures renders them less effective in scenarios where time-series relationships evolve dynamically. Although few studies have investigated dynamic graph learning [Jin el af. [2024), , the graph construction in them is generally decoupled from the anomaly detection optimization process.
The proposed SPAGD method exhibits differences from existing TSAD methods in the following aspects: (1) Rather than relying on random imposed noise [Wang et al. 2023) or traditional augmen- tation techniques (Yang et al. 2023]. SPAGD employs a self- rell-perturbation mechanism to generate auxiliary self- perturbed time- series data, where the perturbations are adaptive and closely tied to anomaly detection. (2) Unlike static graph-based methods (Deng and Hooi 2021]. SPAGD adapts to dynamic changes in inter- variible correlations caused by evolving anomalous candidates. (3) SPAGD leverages the generated auxiliary time series data to train a classifier, which is more flexible and does not require a hand-crafted anomaly-scoring function in reconstruction-based approaches (Song et al. 2023]. (4) SPAGD unifies all components an end-to-end framework, so that auxiliary time series generation and anomaly detection mutually improve each other.
3

---

3 Methodology
3.1 Problem Formulation
In multivariate time-series anomaly detection, we consider a time series X [x1, X2,.. XT] collected across T discrete time steps. Each feature vector X E TR denotes multidimensional observations at timestamp f, where d > 1 denotes the feature dimensions of the multivariate time- series data. Typically, a time-series dataset = (X,, X N with N samples is constructed by applying a sliding window of length T to sample long time series collected from different sources, e.g., industrial sensors. The dataset DD serves as the training foundation for building an anomaly detection model that generalizes to an unknown test dataset Dess. Our goal is to train an anomaly detection model Fe IR Rd - {0, 1 parameterized by θ based on D, where the model is able to predict the anomaly state ý E {0, }} for each test time sequence X; E Diest Here, y = 1 and 2 denote anomalous and normal states, respectively.
Despite the abundance of normal time-series data in the real world, current TSAD methods still face several fundamental challenges, such as the severe data imbalance, static spatio-temporal correlation modeling, and anomaly reconstruction problem (refer to Section []. To tackle these challenges, propose SPAGD, an end-to-end TSAD framework composed of: (i) self-perturbation time-series generation to alleviate data imbalance; (ii) graph construction to model dynamical inter- variable correlations; and (iii) spatio-temporal anomaly detection module mitigate the anomaly reconstruction problem. We will detail each component of SPAGD in the following subsections.
3.2 Time-Series Generation via Self-Perturbation
To alleviate the severe data imbalance inherent in multivariate time-series anomaly detection, we propose self- seffurerturbtiion mechanism that harnesses the intrinsic imperfections of reconstruction models to generate pseudo-anomalous samples. Our approach is motivated by two key observations. First, during early training stages, the reconstruction model tends to produce systematic errors when replicating the input X E IRdXT due to its limited representational capacity. We argue that these reconstruction errors, which manifest as deviations from the normal data, can serve as effective proxies for genuine anomalies. Second, the reconstruction model is progressively trained, the magnitude of these errors diminishes, exposing the anomaly detection model to a continuum of deviations, i.e., from large, obvious discrepancies to subtle differences. By incorporating these generated auxiliary samples into the training process as supervised signals, the anomaly detection model is able to progressively refine its decision boundary by identifying broader spectrum of potential anomalous patterns.
Formally, given an input time series X, we employ Transformer- based model for reconstruction:
X -Tanaa
0,);
(1)
where X E RdxT denotes the reconstructed time series, and Tran. (-) and Trana(-) are the encoder and decoder networks parameterized by O, and Ou, respectively. The reconstruction model is trained on the dataset D [ by minimizing:
Cap = Σ X: Trana (Tran, (X,; Go);
Initially, X deviates substantially from X, and these deviations are treated as auxiliary anomalous patterns for training the subsequent anomaly detection model. As training progresses and reconstruc- tion quality improves, X will gradually converge towards X, providing the anomaly detection model with increasingly subtle deviation signals. Particularly, this progressive refinement can dynamically update the quality pseudo-anomalous samples throughout the training process, which ensures that the anomaly detection model does not overfit to specific types of anomalies but instead generalizes to a broader range of potential anomalies.
3.3 Anomaly-Aware Graph Construction
Existing graph-based TSAD approaches [Deng and Hooi| 202T Zheng el al.) 2023) encode each variable (e.g., sensor) node (V) and pairwise affinities edges (E), allowing GNNs to exploit

---

cross-variable dependencies via graph G = (V, E), which is unavailable to purely sequence- centric models. However, these methods typically rely on static similarity measures (e.g., cosine similarity) to construct the graph, and keep it fixed throughout training and inference. A static topology can accurately reflect normal correlations, yet fails to capture dynamic disruptions induced by self-perturbed time-series data. To overcome this limitation, we propose anomaly-aware graph construction (AAGC) mechanism, which can dynamically adjust the graph structure based on the reconstruction residuals of the self-perturbed time series, thereby ensuring that the influence of potential anomalies on the spatial relationships can be emphasized.
Initial Graph Construction Given a normal time-series X
E Rx from dataset D = (X,, X2, ....... x. we first construct an adjacency matrix A to capture baseline inter-variable correlations. For variables and j. we compute pairwise cosine similarity as follows:
(X..,X,,)
Sij
Sigmoid
|X,,IIIXX;:1111
where X., E RD represents the time-series for variable i, and Sigmoid(.) is the Sigmoid function mapping similarity scores to [0, 1], indicating connection strength. To ensure sparsity and focus on the most informative relationships, we retain only the top-K neighbors for each variable:
Sij. j E top-K neighbors of 0, otherwise.
A.
(4)
This step ensures the graph remains sparse, reducing computational complexity while preserving the most relevant vater-variable correlations. The initial graph A serves static representation of interactions between normal multivariate time series.
Dynamic Adjustment with Reconstruction Residuals While static graphs are suitable for cap- turing vnter-variable correlations between normal time-series pairs, they cannot reflect the transient changes (e.g., sensor failures or external disturbances) in dynamic time series. To adapt to dynamic anomalous patterns introduced via generated self-perturbed time series, we construct a dynamically adjusted graph Á to reflect the influence of anomalous candidates on the learned graph structure. To achieve this, we first compute the node-specific reconstruction residual score r; for each variable:
1
T4
X Xx,
(5)
where X., and X are the input and reconstructed values for time series at time I, respectively. The reconstruction residual quantifies the anomalous degree of the i-th variable within the self- perturbed samples, with higher values indicating greater deviation from normal behavior. Next, we identify the top-m% variables ranked by their residual scores r as anomalous candidates. The affinity matrix for the self- self-perturbed time-series is then dynamically adjusted to emphasize these variables:
S. S., T(i E M))(rr)) + T(j E M))(r;),
(6)
where o(r;) = Ite by normalizes the anomaly score to bounded interval [0, 1]. and II-) is the indicator function. Particularly, for i j. we add Φ(r:) only once. Following similar procedure in Eq. (4), we can obtain the adjusted adjacency Áij- Note that we symmetrize the dynamically enhanced similarity before sparsification to ensure numerical stability and a well-posed enhanced structure. This adjustment adaptively boosts the connection strength between any two nodes where least one an anomalous candidate. Essentially, compared to static graph construction, the proposed AAGC strategy leverages the node-specific reconstruction residuals r to dynamically emphasize connections involving anomalous candidates (M), thereby adapting the graph structure to reflect anomaly-induced changes in inter-variable correlations.
3.4
Opatio-Tempors Modeling for TSAD
With the auxiliary time-series dataset D =
Xv generated via self-perturbation (Section 3.2) and learned graph structures A and Á (Section 3.3, we propose a spatio- temporal anomaly detection module designed to effectively capture both instantaneous variable interactions and their temporal dynamics for TSAD. Specifically, the module leverages unified spatio-temporal representation learning framework and trains classifier that distinguishes between normal and self- reffupertured (auxiliary anomalous) time-series data.
5

---

Dual-Graph Spatial Message Propagation To effectively model spatial inter-variabl variable dependen- cies, we employ graph attention network (GAT) layer. Let H and H be the matrices containing node representations for normal and aelf-perturbed time series at layer I. The GAT updates these representations based on learned attention weights. For each node i, the attention coefficient ojj regarding neighbor is computed by:
(!)
exp(LcakyReLU(a [ Woll L WT))))
Σ UEN exp(LeakyRel.U(a0) W h w(())))
where W()) and @ are shared learnable parameters for layer I, denotes concatenation, and (i) the neighborhood node based on graph A. Similarly, āij is computed using h h (rows of H()) and the neighborhood (i) derived from A, using the same parameters W and (() The GAT layer then aggregates neighbor information using these attention weights to produce the output matrices H(++) and H(++1) for the next layer. This operation, applied node-wist wise for all nodes i, can be represented as:
H = E
w
H (++1) =o
Σ JEN(U
a H W.)
(8)
JENGUUA
where H denotes the i-th row of (1+1), and similarly for H (-) is the activation function, such as ReLU. Particularly, ( = X and H = X. This mechanism ensures the model learns stable normal spatial relationships via A while adapting to dynamically changing inter-variable correlations through Á.
Chunk- Wise Temporal Dependency Aggregation Following the spatial convolution process, we adopt a chunk-wit temporal graph convolution strategy. For the learned spatial feature H derived from the final spatial convolutional layer, we partition the temporal axis T into C chunks, i.e., (( = (H(4)
H()). Similarly, we can apply the same operation to partition the spatial representation (L) (H) ( HD) } for the self-perturbed time series. Subsequently, these spatial features are separately processed via a temporal convolution network T-)) to capture the temporal dependencies:
(b) H!!
Z. T(H! TTm)) = T(H OTom),
where e denotes the e-th chunk of spatial features, Orem denotes the parameters the temporal convolution network. 2. and ž. are the learned temporal representations for the e-th chunk normal time series and self-perturbed time series, respectively. We then horizontally concatenate the features learned from each chunk to form comprehensive chunk- temporal representations:
2, = Z1, Z2, ..... Zcl, 2 = Z2. Zcl.
(10)
End-to-End Anomaly Detection The final spatio-temporal features Zy and 2, are then vertically stacked as Zanc = [2r; 2r) and passed through predictor P(-), which outputs the final prediction for both normal and self- perturbed time series:
p - P(Zst Op),
(11)
where [0, 1 denotes the predicted anomaly probability for the normal and self self-perturbed time series, and Op comprises the network parameters of the predictor. Finally, we train the entire model in an end-to-end manner by jointly optimizing the self-perturbation loss Lxp (Eq. (2 and the following anomaly detection loss:
2N
Lad
Σ
y log(;)) + (1 y:) log(1 p.) (1))))-))
(12)
2N
For training the model, we simply set the label for the normal and self-perturbed time series to 0 and 1, respectively. We summarize the overall objective function of the proposed SPAGD framework as:
L Cap + B Lad.
(13)

---

where the hyperparameter 3 controls the trade-off between the reconstruction and anomaly detection losses. Particularly, the pertuurbetbb module is trained with randomly initialized weights, and we explicitly avoid pre-training because the evolution of the reconstruction model is crucial to our proposed learning paradigm. This end-to-end design framework ensures mutual enhancement across the auxiliary time-series generation and spatio-temporal anomaly detection. In the inference stage, we use the output of the trained anomaly detector as the anomaly scores for evaluation. We also provide detailed algorithm description in the Appendix C.
4
Experiment
4.1 Experimental Configuration
Datasets In this paper, we evaluate the proposed SPAGD method on three public time-series datasets
collected from different real-world scenarios, including (1) Secure Water Treatment (SWaT) Maahhrr and Tippenhauer 2016). (2) Soil Moisture Active Passive (SMAP) (Hundman et al.) 2018). and (3) Mars Science Laboratory (MSL) [Hundman al. 2018). Table [abble[[smmarzzee the main attributes of these datasets, and we also detail the information of each dataset in the Appendix A.
Table 1: Statistics of the three time-series datasets. "AR" denotes anomaly-poing ratio in the test split.
# Channels (Dimensions)
# Train samples (Normal)
Test samples (Mixed)
Dataset
Domain
AR (%)
SWaT
Water treatment ICS
51
496,800 135,183
449,919
11.98
SMAP
Spacecraft telemetry
25
427,617
13.13
MSL
Spacecraft telemetry
55
58,317
73,729
10.72
Experimental Settings For fair evaluation, all baseline methods were trained and tested using identical data splits for each dataset. For SPAGD, we employed Transformer-base reconstruction model comprising attention heads and 3 encoder layers for seffuuerturbation learning. During the spatio-temporal modeling stage, each time series sample first undergoes spatial graph convolution that contains 2 graph attention network (GAT) [Veličković et al. [0088] layers with a latent dimension of 256. The learned spatial features were subsequently partitioned into 5 equal-length segments for temporal convolution processing. Aggregated spatio-temporal features were then passed through predictor consisting of two fully-connected layers to produce final anomaly scores. For other experimental settings and training details, please refer to the Appendix B.
Baselines We compared SPAGD with extensive state-of-the-art baselines, including: k-NN [Ra-
maswamy et al. 2200)] OCSVM [Schölkopf et al. 2001], LOF [He et al. 2003). [Forest [Liu et al.
2008), Deep-SVDD Ruff et al.
2018). COPOD Li et al. 2020), USAD [Audibert et al. 2020
GDN [Deng and Hooi| 2021]. TenED Garg et al. [202]] TranAD (Tuli et al. 2022]. Anomaly-
Trans Xu al. 2022] NCAD [Carmona al. 2022]. Deep IF (Xu al. 2023) TimesNet [Wu]
el al. 2023a]. J. DCdetector (Yang el [l.32023) COUTA [Xu et al.) 2024]. Note that we ensured
fair comparison by reproducing the performance of each baseline using the publicly available codes
under the same experiment setting and following the default settings provided in the related papers.
Evaluation Metrics To comprehensively evaluate the anomaly detection performance of SPAGD and other baselines. we employ three widely recognized evaluation metrics, including Area Under the ROC Curve (AUC), Area Under the EiciisionnRecall Curve (AUPRC), and F1 Fi-score (F1). We want specifically highlight that we did not the point-adjustment strategy in our evaluation due to its overestimation of model performance Kim el al. 2022 Liu and Paparrizos) 2024
4.2 Comparison with State-of-the-Art TSAD methods
We comprehensively evaluated SPAGD against extensive state-of-the-art TSAD baselines. Table 2 summarizes the experimental results across multiple benchmark datasets. The key insights are: (1) We can observe that SPAGD showed competitive performance in all three metrics across all datasets. As shown in Table 2, SPAGD achieved AUCs of 86.30% (SWaT), 62.38% (SMAP), and
7

---

Table 2: Anomaly detection performance of SPAGD and baseline methods in terms of AUC, AUPRC, and (in %). Note that the best two results are marked bold and underline, respectively.
SWaT
SMAP
MSL
Model
Avg.
AUC
AUPRC
F1
AUC
AUPRC
F1
AUC
AUPRC
F1
K-NN Ramaswamy al. 2000
77.30
68.28
71.95
39.73
11.48
25.08
59.32
17.55
32.46
44.79
OCSV Schokkopl el al. 2001
76.06
67.27
71.79
39.87
11.46
25.08
59.33
17.58
32.61
44.56
LOF [He ar. 2003
73.33
45.23
53.18
42.94
12.35
25.40
56.37
20.06
27.61
39.61
[Forest LLu 2l al. 2008
78.74
66.87
66.24
39.78
11.21
25.08
56.91
16.85
29.59
43.47
Decp-S VDD [Nui or
2018
82.55
73,49
74.88
52.00
13.87
25.06
56.65
12.23
21.36
45.78
COPOD eL 2020
81.66
71.57
70.85
40.04
12.02
25.08
60.56
18.17
32.77
45.85
USAD Audiben ai.
2020
79.67
70.24
72.60
39.51
11.41
22.69
61.77
12.86
27.12
44.19
GDN [Deag and Hool
81.55
71.33
75.23
$8.09
16.97
19.24
49.73
12.13
22.68
45.22
TenED
82.38
72.38
76.26
53.57
12.03
19.65
48.54
12.80
23.23
44.53
TranAD Tull al. 2022
81.85
71.62
76.45
56.44
15.24
26.51
42.97
10.03
19.35
44.49
Anomaly
20222
79.77
62,28
73.03
40.03
11.39
22.78
$2.19
11.33
19.25
41.33
NCAD Carmolia
19.00
8.77
21.76
39.67
11.69
22.68
59.40
14.13
21.98
24.34
Deep IF
Xu Xu
2016
80.77
70.67
72.97
60.89
17.33
28.48
55.97
10.98
23.09
46.79
TimesNer [Wu ai 20260
32.45
14.21
21.80
39.90
11.36
22.69
55.06
11.79
21.26
25.61
DCdetector
2023
49.68
12.20
21.97
49.79
12.76
22.70
50.10
10.55
19.09
27.64
COUTA Xu of at. 2024
82,95
74.78
78.68
47.20
12,56
22.69
52.17
11.84
19.08
44.66
SPAGI
77.20
78.77
18.15
27.32
66.50
21.45
30.89
52.11
66.50% (MSL), outperforming the runner-up baselines, ie., COUTA, DeeplF, and USAD by 3.35%, 1.49%, and 4.83% respectively. This observation suggests that the auxiliary signals provided by the generated self-perturbed time series during training ensure the stable performance of SPAGD achieved on different datasets. (2) SPAGD also outperformed reconstruction-base approaches, such as TranAD and moomalyTrans This significant performance improvement can be attributed to the designed spatio-temporal anomaly detection module, which leverages the self-perturbed samples to train classifier instead of reconstruction-basse strategies, which helped address the "anomaay reconstruction" problem. (3) Compared to graph- methods such as GDN, SPAGD demonstrated superior performance. This comparison highlights the significance of the AAGC strategy in SPAGD, which leverages reconstruction residuals induced by self self-perturbed time series to dynamically adjust the graph structure, thereby enabling the model to adapt to changing inter-variable correlations that static graph- methods cannot.
4.3 Parameter Analysis
We perform a parameter sensi- tivity amalysis evaluate the in- fluence of several critical hyper-
parameters the performance
Performance (%)
Perf Performance (%)
80
of SPAGD. Figure illustrates the impact of window size and trade-off parameter 3 on the
70
60
performance. The experimen- tal results shown in Figure ([(a) revealed that smaller exces- sively large window sizes de- grade performance to a certain extent, whereas window sizes in the range of (80, 100) consis- tently yield optimal performance. This due to the fact that too short window is not conducive to capturing temporal dependencies, while too long window leads difficulties in long-term dependencies learning. Additionally, Vigure[]h presents the performance under different & values, which control the contributions of self-perturbation and anomaly detection losses during training. We can observe a steady performance improvement as 3 increases from 3 = 10-3 towards 3 10 Though beyond this point, all metrics slightly decrease, the model maintains relatively stable performance under varying 3 in general. This suggests that overempha- sizing anomaly detection loss can lead to overlooking the learning of informative self self-perturbed samples for training, which highlights the importance of balancing informative reconstruction and discriminative anomaly detection in practice.
40
50
20
40
60
80
100
120
160 140
180:200
200
10"
30
10
10
10
10'
10"
(a)
Window Size
(b)
Figure Anomaly detection performance under different window sizes and B values on SWaT. Note that we vary the window size and 3 value wide range of [20, 200) and [10 -10-4. 100], respec- tively.
8

---

10
Value
01-
0.0004
-05
Netple
-101
8.00
0.000
433
(a) Ground Truth
(b) TranAD
(c) Anomally Trans
(d) SPAGD
Figure 3: Anomaly score visualization on the MSL dataset. We randomly sampled data of length 500 and compared SPAGD with several baselines. The red area indicates the ground truth anomaly.
Table 3: Ablation study results on the three datasets. The best results marked in bold.
Datasct
SWaT
SMAP
MSL
Avg.
Metric
AUC
AUPRC
F1
AUC
AUPRC
F1
AUC
AUPRC
F1
w/o SP
80.30
70.34
74.04
51.31
12.49
13.25
61.37
18.75
10.54
43.60
SP w/ Recon
76.82
61.95
62.11
46.19
11.35
22.68
51.38
14.39
19.07
40.66
w/o AAGC (Spatial)
81.51
70.07
74.20
57.86
15.72
15.79
62.63
18.95
15.68
45.82
w/o AAGC (Temporal)
83.16
72.18
75.11
60.60
17.12
16.33
59.19
13.08
14.04
45.65
w/o AAGC (Both)
80.54
70.59
74.28
55.34
16.01
23.84
54.74
12.27
19.78
45.27
w/o JT
82.97
72.01
73.83
38.60
9.98
12.79
52.09
11.45
11.21
40.55
SPAGD
86,30
77.20
78.77
62.38
18.15
27.32
66.50
21.45
30.89
52.11
4.4 Anomaly Score Visualization
We provide visualization of anomaly scores for intuitive detection capability comparison. Figure presents the visualization results on MSL, where we compare SPAGD with several baseline methods such TranAD and AnomalyTramm We can observe that the anomaly scores of SPAGD are more distinguishable, and the predictions are closely aligned with the ground truth anomaly in Figure a)). Other baseline methods exhibit higher detection uncertainty, characterized by frequent false alarms or overlooked anomalies. In particular, we can observe that reconstruction -aassbrectio- methods, such TranAD, exhibit low reconstruction errors in anomalous events, which further validates the aforementioned "anomaly reconstruction" problem. In contrast, SPAGD is capable of detecting anomalies at these locations. These comparisons visually demonstrate the superior practical detection capability and reliability of SPAGD in real-world scenarios.
4.5 Ablation Study
We conducted ablation experiments to evaluate the contribution of each component in the proposed SPAGD method by comparing the SPAGD model against the following variants that shared the same backbones and hyperparameter settings:
1. w/o Self-Perturbed Generation (SP): This variant removes the self-perturbation module so that no auxiliary signals are available during training. In this case, the model detects anomalies by solely relying reconstruction errors.
2. SP w/ Recon: This variant retains the eeff-perturbation module, and uses traditional reconstruc- tion model to reconstruct both the input and generate auxiliary time series. the testing stage, the anomaly score is defined by the reconstruction error of test sample.
w/o Anomaly-Aware Strategy (AAGC): This variant preserves the self perturbattrnnn module but disables the anomaly-aware strategy in graph construction. Note that we build three variants using a static graph instead of the AAGC strategy for (1) spatial, (2) temporal, and (3) both spatial and temporal modeling, respectively.
4. w/o Joint Training (JT): This variant employs two-stage pipeline where the reconstruction model is pre-trained and then generates the self- celf-perturbed time series once to train the spatio- temporal anomaly detector.
Table shows the experimental results, with the following observations. (1) Removing the self- perturbation module generally leads a performance drop across all datasets, such as AUCs dropping by 6.00% (SWaT), 11.07% (SMAP), and 5.13% (MSL). This is because the self pelfurerturnation module

---

provides rich auxiliary potential anomalous signals for model training, which mitigates the class im- balance problem and improves the generalizability. (2) The performance of the "SP Recon" variant significantly decreases, which indicates that purely reconstruction-bant model to fit the self- nefturerturbdd patterns rather than distinguish them. Consequently, true anomalies receive lower reconstruction errors and are more difficult to detect in the testing stage, which is a classic example of the "anomaly reconstruction" problem. (3) The performance also decreases when we remove the spatial/temporal or both of them from the AAGC strategy. For example, on the MSL dataset, the performance of the variant that disables AAGC spatial modeling decreases by 3.87% (AUC), 2.50% (AUPRC), and 15.21% (F1), respectively. This can be attributed to the failure of the model to capture the dynamically changing inter- variable correlations, resulting in the amomaly-induee
objective encourages the
information within self-perturbel time series being modeled inappropriately. (4) We also observed a significant performance decrease in three datasets after replacing the joint training with two-stage training paradigm. Generated samples cannot be optimized for the anomaly detection task without joint training, and they are too similar to normal time-series data, which presents significant challenges for the model to distinguish normal time series from them. All in all, the ablation study results provided clear and strong evidence of the effectiveness of each component in SPAGD.
4.6 More Experimental Analysis
We further provide more experimental analysis in the Appendix, such extra parameter analysis and visualization results, comparison with different backbone networks and different graph construction methods, comparison with the fandom-perturbation strategy, and point-adjusted results and more evaluation metrics (VUS-AUC/PR) for reference.
5 Conclusion
In this paper, we introduced SPAGD, new TSAD framework address several inherent challenges of multivariate time-series anomaly detection. By integrating a self perturrrtrbatoo module, SPAGD generates diverse auxiliary time-series samples, effectively mitigating the class imbalance well as providing rich auxiliary potential anomalous signals for training. An adaptive anomaly-aware graph construction method is proposed to dynamically adjust inter-variable correlations for evolving self- perturbed time series. We then train an anomaly detector to distinguish the normal time series from the self- pefftrerurred ones by modeling both spatial and temporal dependencies. Through comprehensive experiments on several benchmark datasets compared to state-of-the-aa TSAD methods, SPAGD consistently achieved competitive performance. The parameter analysis, visualization, and ablation study further justify the effectiveness of SPAGD. Despite these advances, SPAGD presumes relatively homogeneous sensing landscape, which may not be applicable under highly heterogeneous streams (Shao el al.) [024] Jia et al.) [024;) Liu er al. [2025a] with asynchronous sensors or weak inter-vat variabae dependencies. Future work could explore heterogeneity-awe aware graph learning and domain-adaptive perturbation strategies to extend SPAGD to address heterogeneous problems.
Broader Impact Statement
We provide the broader impact of our work from the following two aspects:
Positive social impacts: Our work has significant potential for enhancing the safety and reliability critical cyber- physicll systems. For instance, carly anomaly detection can prevent catastrophic equipment failures, ensuring worker safety and preventing environmental damage. In aerospace applications, it can improve mission success and safety by flagging potential faults in spacecraft telemetry.
Potential negative risks: (1) Over-reliance on the system could lead operators to dismiss their own expertise. Mitigation: We advocate for deploying SPAGD as a decision
decision-suppoott support tool that provides interpretable outputs (e-g., highlighting anomalous sensors and their correlations) rather than as a fully autonomous system. (2) A sophisticated adversary could potentially craft inputs to either evade detection or trigger false alarms. Mitigation: This is critical area for future work, focusing improving the model's adversarial robustness.
10

---

Acknowledgement
This research is supported by the National University of Singapore, Institute of Data Science. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not reflect the views the National University of Singapore.
References
Julien Audibert, Pietro Michiardi, Frédéric Guyard, Sébastien Marti, and Maria A Zuluaga. Usad: Unsupervised anomaly detection multivariate time series. In Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pages 2395-3404 2020.
Pierre Baldi. Autoencoders, unsupervised learning, and deep architectures. In Proceedings of ICML Workshop on Unsupervised and Transfer Learning, pages 37-49. JMLR Workshop and Conference Proceedings, 2012.
Ane Blázquez- Garcia, Angel Conde, Usue Mori, and Jose A Lozano. A review on outlier/anomaly detection time series data. ACM Computing Surveys (CSUR), 54()) 2021.
Markus M Breunig, Hans-Peter Kriegel, Raymond T Ng, and Jörg Sander. Lof: identifying density- based local outliers. In Proceedings of the ACM SIGMOD International Conference on Manage- ment of Data, pages 93-104, 2000.
Jinyu Cai, Yunhe Zhang, Jicong Fan, and See-Kiong Ng. Lg-fgad: effective federated graph anomaly detection framework. In Proceedings of the International Joint Conference Artificial Intelligence, pages 3760-3769, 2024.
Jinyu Cai, Yunhe Zhang, Zhoumin Lu, Wenzhong Guo, and See-Kiong Ng. Towards effective federated graph anomaly detection via self-boosted knowledge distillation. In Proceedings of the ACM International Conference Multimedia, pages 5537-5546, 2024.
Jinyu Cai, Yunhe Zhang, and Jicong Fan. Self-discriminative modeling for anomalous graph detection. In Proceedings of the International Conference on Machine Learning, 2025.
Jinyu Cai, Yunhe Zhang, Fusheng Liu, and See- Kiong Ng. Leveraging diffusion model as pseudo- anomalous graph generator for graph-level anomaly detection. In Proceedings of the International Conference on Machine Learning, 2025.
Chris U Carmona, François- Xavier Aubet, Valentin Flunkert, and Jan Gasthaus. Neural contextual anomaly detection for time series. In Proceedings of the International Joint Conference on Artificial Intelligence, 2022.
Mansheng Chen, Tuo Liu, Chang-Dong Wang, Dong Huang, and Jian-Huang Lai. Adaptively- weighted integral space for fast multiview clustering. In Proceedings of the ACM International Conference on Multimedia, pages 3774-3782. ACM, 2022.
Mansheng Chen, Chang-Dong Wang, Dong Huang, Jian-Huang Lai, and Philip Yu. Efficient orthogonal multi-view subspace clustering. In Proceedings of the ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pages 127-135. ACM, 2022.
Yutong Chen, Hongzuo Xu, Guansong Pang. Hezhe Qiao, Yuan Zhou, and Mingsheng Shang, Self- supervised spatial-temporal normality learning for time series anomaly detection. In Proceedings of the Joint European Conference on Machine Learning and Knowledge Discovery in Databases, pages 145-162. Springer, 2024.
Andrew A Cook, Göksel Misirh, and Zhong Fan. Anomaly detection for iot time-series data: A survey. IEFE Internet of Things Journal, 777)644816444, 2019.
Ailin Deng and Bryan Hooi. Graph neural network-based anomaly detection in multivariate time series. In Proceedings of the AAAI Conference on Artificial intelligence, volume 35, pages 4027-4035, 2021.
11

---

Chaoyue Ding, Shiliang Sun, and Jing Zhao. Mst-gat: A multimodal Sential--empord graph attention network for time series anomaly detection. Information Fusion, 89:527-536, 2023.
Xiang Fang, Daizong Liu, Pan Zhou, Zichuan Xu, and Ruixuan Li. Hierarchical local-global transformer for temporal sentence grounding. IEEE Transactions on Multimedia, 2023.
Xiang Fang, Arvind Easwaran, and Blaise Genest. Adaptive multi promip contrastive network for few-shot out-of-distribution detection. In Proceedings of the International Conference on Machine Learning, 2025.
Lele Fu, Bowen Deng, Sheng Huang, Tianchi Liao, Chuanfu Zhang, and Chuan Chen. Learn from global rather than local: Consistent context-aware representation learning for multi-view graph clustering. In Proceedings of the International Joint Conference Artificial Intelligence, pages 5145-5153, 2025.
Astha Garg, Wenyu Zhang. Jules Samaran, Ramasamy Savitha, and Chuan- Foo. An evaluation of anomaly detection and diagnosis in multivariate time series. IEEE Transactions on Neural Networks and Learming Systems, 33(6):2508-2511 2021.
Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial networks. Communications of the ACM, 63(1 1):1199:19444 2020.
Zengyou He, Xiaofei Xu, and Shengchun Deng. Discovering cluster-based local outliers. Putlern Recognition Letters, 2409-10)114111165, 2003.
Kyle Hundman, Valentino Constantinou, Christopher Laporte, Ian Colwell, and Tom Soderstrom. De- tecting spacecraft anomalies using Istms and nonparametric dynamic thresholding. In Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pages 387-395. 2018.
Chentao Jia, Ming Hu, Zekai Chen, Yanxin Yang, Xiaofei Xie, Yang Liu, and Mingsong Chen. Adaptivefl: Adaptive heterogeneous federated learning for resource-constrainee aiot systems. In Proceedings of ACM/IEEE Design Automation Conference, pages 1-6, 2024.
Yixuan Jin, Yutao Wei, Zhangtao Cheng, Wenxin Tai, Chunjing Xiao, and Ting Zhong, Multi-scale dynamic graph learning for time series anomaly detection (student abstract). In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 23523-23524, 2024.
Siwon Kim, Kukjin Choi, Hyun-Soo Choi, Byunghan Lee, and Sungroh Yoon. Towards a rigorous evaluation of time-series anomaly detection. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pages 7194-7201, 2022.
Thomas Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. In Proceedings of the International Conference on Learning Representations, 2017.
Zheng Li, Yue Zhao, Nicola Botta, Cezar Ionescu, and Xiyang Hu. Copod:
copula- basela-baedddee outlier detection. In Proceedings of the IEEE International Conference on Data Mining, pages 1118-1122 123. IEEE, 2020.
Ke Liang, Lingyuan Meng, Hao Li, Jun Wang, Long Lan, Miaomiao Li, Xinwang Liu, and Huaimin Wang. From concrete to abstract: Multi-view clustering on relational knowledge. IEEE Transac- fions on Pattern Analysis and Machine Intelligence, 47(10):9043-9060 2025.
Qinghua Liu and John Paparrizos. The elephant in the room: Towards a reliable time-series anomaly detection benchmark. Advances in Neural Information Processing Systems, 37:108231-108261 2024.
Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. Isolation forest. In Proceedings of the IEEE International Conference on Data Mining, pages 413-422 IEEE, 2008
Jiyuan Liu, Xinwang Liu, Yuexiang Yang, Xifeng Guo, Marius Kloft, and Liangzhong He. Multiview subspace clustering via co-training robust data representation. IEFE Transactions on Neural Networks and Learning Systems, 33(10):5177-5188 2022.
12

---

Yixin Liu, Kaize Ding, Qinghua Lu, Fuyi Li, Leo Yu Zhang, and Shirui Pan. Towards self interprtaabeeee graph-level anomaly detection. Advances Neural Information Processing Systems, 36:8975- 2923,2023.
Yixin Liu, Shiyuan Li, Yu Zheng, Qingfeng Chen, Chengqi Zhang, and Shirui Pan. Are: A generalist graph anomaly detector with in-context learning. Advances in Neural Information Processing Systems, 37:50772-50804, 2024.
Ruixuan Liu, Ming Hu, Zeke Xia, Xiaofei Xie, Jun Xia, Pengyu Zhang, Yihao Huang, and Mingsong Chen. Fedgraft: Memory-aware heterogeneous federated learning via model grafting. IEEE Transactions Mobile Computing, 2025.
Yixin Liu, Guibin Zhang, Kun Wang, Shiyuan Li, and Shirui Pan. Graph-augmented large language model agents: Current progress and future prospects. arXiv preprint arXiv:250..21407, 2025.
Aditya P Mathur and Nils Ole Tippenhauer. Swat: A water treatment testbed for research and training on ics security. In Proceedings of the International Workshop on Cyber-Physicn Systems for Smart Water Networks, pages 31 31-36. IEEE, 2016.
Larry R Medsker, Lakhmi Jain, et al. Recurrent neural networks. Design and Applications, 2001.
Zhuang Qi and Xiaming Chen. A novel density-based outlier detection method using key attributes. Intelligent Data Analysis, 26(6):1411-1499; 2022.
Zhuang Qi, Junlin Zhang, Xiaming Chen, and Xin Qi. Comparative study of neighbor-based methods for local outlier detection. Journal of Ambient Intelligence and Smart Environments, page 18761364221159909 2025.
Sridhar Ramaswamy, Rajeev Rastogi, and Kyuseok Shim. Efficient algorithms for mining out- liers from large data sets. In Proceedings of the ACM SIGMOD International Conference on Management of Data, pages 427-438, 2000.
Lukas Ruff, Robert Vandermeulen, Nico Goernitz, Lucas Deecke, Shoaib Ahmed Siddiqui, Alexander Binder, Emmanuel Müller, and Marius Kloft. Deep one-class classification. In Proceedings of the International Conference on Machine Learning, pages 4393-4402. PMLR, 2018
Sebastian Schmidl, Phillip Wenig, and Thorsten Papenbrock. Anomaly detection in time series: a comprehensive evaluation. Proceedings of the VLDB Endowment, 1779911777-197 2022.
Bernhard Schölkopf, John C Platt, John Shawe-Taylon Alex J Smola, and Robert C Williamson. Estimating the support high-dimensional distribution. Neurul Computation, 13(7):1443-1471
2001.
Zezhi Shao, Fei Wang, Yongjun Xu, Wei Wei, Chengqing Yu, Zhao Zhang, Di Yao. Tao Sun, Guangyin Jin, Xin Cao, et al. Exploring progress in multivariate time series forecasting: Comprehensive benchmarking and heterogeneity analysis. IEEE Transactions on Knowledge and Data Engineering 2024.
Junho Song, Keonwoo Kim, Jeonglyul Oh, and Sungzoon Cho. Memto: Memory-guided transformer for multivariate time series anomaly detection. Advances in Neural Information Processing Systems, 36:57947-57963, 2023.
Shreshth Tuli, Giuliano Casale, and Nicholas R Jennings. Tranad: for anomaly detection in multivariate time series data. Proceedings of the VLDB Endowment, 15(6): 2022.
deep transformer networks
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in Neural Information Processing Systems, 30, 2017.
Bharadwaj Veeravalli, Chacko John Deepu, and DuyHoa Ngo. Real-time, personalized anomaly detection in streaming data for wearable healtheare devices. Handbook of Large-Scall Distributed Computing in Smart Healthcare, pages 403-426, 2017.
13

---

Petar Veličković, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Lio, and Yoshua Bengio. Graph attention networks. In Proceedings of the International Conference on Learning Representations, 2018.
Chengsen Wang, Zirui Zhuang, Qi Qi. Jingyu Wang, Xingyu Wang, Haifeng Sun, and Jianxin Liao. Drift doesn't matter: dynamic decomposition with diffusion reconstruction for unstable multivariate time series anomaly detection. Advances in Neural Information Processing Systems, 06:10758-10771 2023.
Svante Wold, Kim Esbensen, and Paul Geladi. Principal component analysis. Chemometrics and Intelligent Laboratory Systems, 2(1-3):37-52, 1987.
Haixu Wu, Tengge Hu, Yong Liu, Hang Zhou, Jianmin Wang, and Mingsheng Long, Timesnet: Temporal 2d- variaaaaiion modeling for general time series analysis. In Proceedings of the International Conference on Learning Representations, 2023.
Zhihao Wu, Zhao Zhang, and Jicong Fan. Graph convolutional kernel machine versus graph convolutional networks. Advances in Neural Information Processing Systems, 36:19650-19672, 2023.
Jichui Xu, Haixu Wu, Jianmin Wang, and Mingsheng Long. Anomaly transformer: Time series anomaly detection with association discrepancy. In Proceedings of the International Conference on Learning Representations, 2022.
Hongzuo Xu, Guansong Pang, Yijie Wang, and Yongjun Wang. Deep isolation forest for anomaly detection. IEEE Transactions on Knowledge and Data Engineering, 15(12):12911-1264 2023.
Hongzuo Xu, Yijie Wang. Songlei Jian, Qing Liao, Yongjun Wang, and Guansong Pang. Calibrated one-class classification for unsupervised time series anomaly detection. IEEE Transactions on Knowledge and Data Engineering, 2024.
Yiyuan Yang, Chaoli Zhang, Tian Zhou, Qingsong Wen, and Liang Sun. Dodetector: Dual attention contrastive representation learning for time series anomaly detection. In Proceedings of the ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pages
2023.
Zahra Zamanzadeh Darban, Geoffrey Webb, Shirui Pan, Charu Aggarwal, and Mahsa Salehi. Deep learning for time series anomaly detection: survey, ACM Computing Surveys (CSUR), 1-4 2024.
Weiqi Zhang, Chen Zhang, and Fugee Tsung. Grelen: Multivariate time series anomaly detection from the perspective of graph relational learning. In Proceedings of the International Joint Conference on Artificial Intelligence, pages 2390-2392 2022.
Kexin Zhang, Qingsong Wen, Chaoli Zhang, Rongyao Cai, Ming Jin, Yong Liu, James Y Zhang, Yuxuan Liang. Guansong Pang, Dongjin Song, et al. Self-supervised learning for time series analysis: Taxonomy, progress, and prospects. IEEE Transactions on Pattern Analysis and Machine Intelligence, 46(10):6775-6794 2024.
Yunhe Zhang, Yan Sun, Jinyu Cai, and Jicong Fan. Deep orthogonal hypersphere compression for anomaly detection. In Proceedings of the International Conference Learning Representations, 2024.
Hang Zhao, Yujing Wang, Juanyong Duan, Congrui Huang, Defu Cao, Yunhai Tong, Bixiong Xu, Jing Bai, Jie Tong, and Qi Zhang. Multivariate time-series anomaly detection via graph attention network. In Proceedings of the IEEE International Conference on Data Mining, pages 841-850. IEEE, 2020.
Yu Zheng, Huan Yee Koh, Ming Jin, Lianhua Chi, Khoa T Phan, Shirui Pan, Yi-Ping Phoebe Chen, and Wei Xiang. Correlation-awart spapial-temporal graph learning for multivariate time-series anomaly detection. IEEE Transactions on Neural Networks and Learning Systems, 35(9): 1802- 11816, 2023.
14

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The main claims made in the abstract and introduction have accurately reflected the contributions and scope the paper.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
The limitations of the work have been discussed in the conclusion.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
15

---

We have provided the relevant theoretical analysis of the proposed method in the Appendix.
Justification:
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: The paper has fully disclosed all the information needed to reproduce the main experimental results.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
16

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification:
The paper has provided open access to the data and code.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.co cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
//nips //ips.cc//pill wttpcccpppppppppeeeeeeeeeeeeeeee httaa//gggeeee/eeeuuebiisssssss /Cc////oddiiisssseeeeeee ssiiiiiisiiiiyyyy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Answer: [Yes]
Justification:
The paper has specified all the training and test details.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: This paper has conducted Student's 's t-test to demonstrate the statistical signifi- cance the experiments.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
17

---

The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma enror bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are range (e.g. negative enror rates).
If error bars reported in tables plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification: The paper has provided sufficient information on the computer resources for each experiment.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).
9. Code of ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics htttps://neurriii http://sss.pppbllececccccceeeela
Answer: [Yes]
Justification: The research conducted in the paper conforms, in every respect, with the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We have properly discussed the societal impact of our work.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
18

---

Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), faireess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied partieular applications, let alone deployments. However, if there is direct path any negative applications, the authors should point it out. For example, it is legitimate point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (c.g., gated release models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility MI).
11. Safeguards
Question:
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Answer: [NA]
Justification:
The paper poses no such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
The creators or original owners of assets (e.g., code, data, models), used the paper, are properly credited and the license and terms of use explicitly are mentioned and properly respected.
Justification:
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
19

---

If assets are released, the license, copyright information, and terms of use in the thcode. has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
package should be provided. For popular datasets, paperswi
latasets.paperssi
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: The paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moode as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
20

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: The core method development in this research does involve LLMs as any important, original, or non-standard components.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to our LLM for what should or should not be described.
21


Reviews:
[{"review_id": "KChz2eL1E6", "reviewer": "Reviewer_gEyj", "summary": "This paper proposed SPAGD for time-series anomaly detection. Specifically, SPAGD introduces the self-perturbation time-series generation, anomaly-aware graph construction, and spatio-temporal anomaly detection modules to correspondingly tackle three key challenges in the field: the imbalance between available normal and anomalous data, the limitation of static graph structures in capturing dynamic correlations, and the \"anomaly reconstruction\" problem. The entire framework is trained in an end-to-end way. The authors conducted comparative experiments on various benchmark datasets, showing that SPAGD outperforms a wide range of TSAD baselines.", "questions": "The authors should focus on addressing my concerns raised in Strengths and Weaknesses, which will affect my final assessment of this paper.", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. This paper is well-written and easy to follow. The problem statement is clear, and the technical details are explained logically. The related work section positions SPAGD well within the existing literature.\n2. Leveraging the evolving reconstruction residuals as a source of \"self-perturbation\" to generate training signals is novel and sound. This directly addresses the critical and practical challenge of data scarcity and class imbalance in TSAD without relying on external data or simple noise injections. This paper also identifies the \"anomaly reconstruction\" problem and proposes a promising solution to address it.\n3. The experimental results demonstrated that SPAGD significantly outperforms state-of-the-art TSAD baselines on various benchmark datasets, and the authors also provided the implementation code of SPAGD.\n\nWeaknesses:\n1. The paper adopts a \"chunk-wise\" temporal convolution, which breaks the continuity of the time series. What is the motivation for this design over standard sequential models (like LSTMs) that preserve temporal continuity? Does this approach potentially fail to capture dependencies that span across chunk boundaries?\n2. Although the authors have included several commonly used metrics in their evaluation, the TSAD community is increasingly adopting more robust metrics such as VUS-ROC and VUS-PR [1]. To strengthen empirical validation, I suggest the author supplement the evaluation of the proposed method using these two metrics.\n3. The hyperparameter $m$, which is the percentage of anomalous candidates, appears critical for the AAGC module, yet its impact is not analyzed. How does it affect the model's performance?\n4. The current ablation study is insightful, but the variant \"w/o SP\" removes both the auxiliary data and the classification objective. Would it be possible to conduct a more fine-grained ablation study to better isolate the contribution of individual components? For example, a variant that uses self-perturbation but with a reconstruction-based objective could help quantify the specific benefit of the classification objective.\n\n[1] Paparrizos et al. Volume under the surface: a new accuracy evaluation measure for time-series anomaly detection, Proceedings of the VLDB Endowment, 2022.", "was_revised": true, "final_justification": "The authors provided a thorough rebuttal that addresses my concerns. In particular, the inclusion of evaluations using more robust VUS metrics and additional experimental analysis significantly strengthens the empirical validations of this paper. In light of these clarifications and improvements, I decide to raise my rating to Accept.", "rebuttal": "**We thank the reviewer for the constructive comments. Please find our responses to your concerns below.**\n\n**To W1:**\nWe would like to address your concern via the following two perspectives:\n\n1. **With regards to motivation:** \n- Sequential models like LSTMs process data recursively over time, which can be computationally intensive and slow for long time-series windows. Temporal convolution, on the other hand, can process sequences in parallel, leading to better training efficiency.\n- The chunk-wise design allows the model to learn fine-grained temporal patterns within each local chunk. The subsequent concatenation and predictor network then learn higher-level relationships between these chunks. This hierarchical approach is effective for capturing both local dynamics and the overall structure of the time window, which has shown success in recent TSAD models such as TimesNet [1].\n> Haixu Wu, et al. Timesnet: Temporal 2D-variation modeling for general time series analysis. ICLR, 2023.\n\n2. **Regarding the dependencies across chunk boundaries, we agree that this is an important aspect. Our framework mitigates this potential issue in two ways:**\n- The spatial graph convolution is applied to the representation of the entire time series before the chunking operation (**Eq. 7**). This ensures that information is propagated across all time steps via the learned graph, thus preserving a holistic view of the window.\n- The final predictor module takes the concatenated representations from all chunks as input (**Eqs. 9 and 10**). This allows the predictor to explicitly model the relationships and dependencies between the learned chunk features, thereby capturing patterns that span across chunk boundaries.\n\n**To W2:** VUS-ROC and VUS-PR are indeed robust metrics to evaluate TSAD methods. To address your concern, we conducted additional experiments on SWaT to evaluate SPAGD and several key baselines using these two metrics. Below are the experimental results:\n\n$\\begin{matrix}\n\\hline\n\\text{Metric}&\\text{VUS-ROC}&\\text{VUS-PR}\\\\\\\\\n\\hline\n\\text{USAD}&53.78&32.86\\\\\\\\\n\\text{TcnED}&62.99&44.30\\\\\\\\\n\\text{AnomalyTrans}&57.54&36.02\\\\\\\\\n\\text{Deep IF}&56.48&37.56\\\\\\\\\n\\text{TimesNet}&44.49&21.74\\\\\\\\\n\\text{DCdetector}&52.31&15.01\\\\\\\\\n\\text{COUTA}&77.10&51.86\\\\\\\\\n\\hline\n\\text{SPAGD}&\\bf84.93&\\bf62.08\\\\\\\\\n\\hline\n\\end{matrix}$\n\nAs shown in the table, SPAGD demonstrates superior performance across all datasets under these two challenging metrics. This once again strengthens our claim about the effectiveness of SPAGD. We will include these results (with more datasets) and a detailed discussion in our paper.\n\n**To W3:** We performed a sensitivity analysis of $m$ on the SWaT dataset. Below are the anomaly detection performance under different $m$ in the range of $[10\\\\%,60\\\\%]$:\n\n$\\begin{matrix}\n\\hline\nm&\\text{10\\\\%}&\\text{20\\\\%}&\\text{30\\\\%}&\\text{40\\\\%}&\\text{50\\\\%}&\\text{60\\\\%}&\\\\\\\\\n\\hline\n\\text{AUC}&80.74&83.22&\\bf86.30&83.30&83.32&81.58\\\\\\\\\n\\text{AUPRC}&71.00&72.45&\\bf77.20&71.82&73.13&71.39\\\\\\\\\n\\text{F1}&74.07&74.37&\\bf78.77&75.76&74.76&75.48\\\\\\\\\n\\hline\n\\end{matrix}$\n\nThe results showed that the performance of SPAGD is robust within a reasonable range of $m$ (e.g., 20\\% to 50\\%). We can observe that the performance degrades when $m$ is too small (e.g., 10\\%), as the AAGC module lacks a strong enough signal to dynamically adjust the graph structure. Conversely, if $m$ is too large (e.g., 60\\%), the performance also slightly decreases as an excessive number of normal variables are incorrectly flagged as anomalous candidates, which introduces noise into the graph structure. We will include related experiments and analysis in the paper.\n\n\n**To W4:** As per your suggestion, we designed a new variant, i.e., **SP w/ Recon**: This variant retains the self-perturbation module, and uses a traditional reconstruction model to reconstruct both the input and generate auxiliary time series. In the testing stage, the anomaly score is defined by the reconstruction error of a test sample. The experimental results are shown as follows:\n\n$\\begin{matrix}\n\\hline\n\\text{Metric}&\\text{AUC}&\\text{AUPRC}&\\text{F1}\\\\\\\\\n\\hline\n\\text{SP w/ Recon}&76.82&61.95&62.11\\\\\\\\\n\\text{SPAGD} & \\bf86.30 & \\bf77.20 & \\bf78.77\\\\\\\\\n\\hline\n\\end{matrix}$\n\nWe can observe that the performance of the \"SP w/ Recon\" variant significantly decreases, which indicates that a purely reconstruction‑based objective encourages the model to fit the self‑perturbed patterns rather than distinguish them. Consequently, true anomalies receive lower reconstruction errors and are more difficult to detect in the testing stage, which is a classic example of the \"anomaly reconstruction\" problem. This experiment validates the contribution of our discriminative (classification) objective in mitigating the \"anomaly reconstruction\" problem. We will include these results in the paper.\n\n**To Paper Formatting Concerns:** Thank you for this suggestion. We agree that presenting the key theoretical insights in the main text would make the paper more self-contained, and we will revise the paper accordingly."}, {"review_id": "VVy89kvp2X", "reviewer": "Reviewer_pq7y", "summary": "This paper addresses several challenges in multivariate time-series anomaly detection by proposing a novel approach called self-perturbed anomaly-aware graph dynamics (SPAGD). The core contributions include: (1) a self-perturbation module to generate diverse auxiliary anomalous data, mitigating class imbalance without external anomalous data; (2) an anomaly-aware graph construction to dynamically adapt the learned graph structure based on reconstruction residuals; and (3) a spatio-temporal model integrating both spatial and temporal information between time-series data to identify anomaly.", "questions": "See weaknesses.", "limitations": "Yes, the authors have adequately discussed the limitations of this paper, particularly the assumption of homogeneous sensor data.", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths**\n\n1. The proposed SPAGD framework is novel and well-motivated, which addresses various challenges in time-series anomaly detection, including anomaly scarcity, adaptation to the changing interdependencies between variables, and anomaly reconstruction problems.\n\n2. The paper is well-structured with precise formulation and illustration. Additionally, the theoretical justifications for employing self-perturbations and dynamically adjustable graphs are compelling and insightful.\n\n3. Reproducible code is provided for enhancing both the reproducibility and credibility of this work.\n\n4. Experiments conducted across multiple real-world datasets provide empirical evidence to support the effectiveness of SPAGD. Further experimental analysis in the appendix offers more insights into the proposed framework.\n\n**Weaknesses**\n\n1. While the idea of this work is novel, the quality and diversity of the self-perturbed samples can be further discussed. The core assumption of SPAGD is that reconstruction residuals of a model can serve as ideal proxies for mimicking real anomalies. However, these \"anomalies\" are inherently tied to the model's own inductive biases. There may exist a potential risk that the model primarily learns to detect its own reconstruction artifacts rather than a general set of real-world anomalies. This could limit its generalization to real anomalies, as they may differ structurally from the generated perturbations.\n\n2. The additive update rule ($\\tilde{A}\\_{ij} = S\\_{ij} + \\sigma(r\\_{i})$) in the AAGC module is a key design. Can the authors provide more intuition or explanation for it? Have other alternatives been considered, such as multiplicative scaling? \n\n3. The evaluation relies on traditional point-wise metrics like AUC-ROC and F1-Score, which may not fully reflect the practical time-series anomaly detection performance. The authors should further add segment-based metrics such as the Volume Under the Surface (VUS) to provide a more robust assessment.", "was_revised": true, "final_justification": "This well-written paper, logically structured with sound positioning, presents a novel \"self-perturbation\" method via evolving residuals to tackle TSAD data issues, solves \"anomaly reconstruction,\" shows SOTA-surpassing results.", "rebuttal": "**We thank the reviewer for the constructive comments. Please find our responses to your concerns below.**\n\n**To W1:** We would like to address this concern by clarifying the role of our self-perturbation module and providing empirical evidence against this potential risk:\n\n- The objective of the self-perturbation module is **not** to generate samples that perfectly mimic the real anomalies. Instead, it aims to leverage a set of generated auxiliary signals to refine the decision boundary. By distinguishing normal data from these **model-induced hard negatives** (self-perturbed samples), the model is trained to become more sensitive to the deviation from the learned normal data distribution, thereby enhancing the ability to generalize to unseen anomalies.\n\n- The perturbations are indeed related to the model's inductive bias. However, these generated samples are not static. They evolve dynamically throughout the end-to-end training process, creating a natural and diverse curriculum for training. This process exposes the classifier to a wide spectrum of deviations that range from large perturbations to subtle perturbations, which prevents the model from overfitting to a single type of perturbation.\n\n- The most compelling evidence against this risk is that SPAGD consistently outperformed state-of-the-art baselines across multiple benchmark datasets (**Table 2** in the main text). If SPAGD were only learning to detect its own internal artifacts, it would fail to generalize effectively across these distinct real-world anomalies. The superior performance of SPAGD strongly suggests that the learned decision boundary is indeed robust and generalizable. Furthermore, our results on segment-based VUS metrics (**see the response to W3**) further validate this robust generalization.\n\n**To W2:**  We would like to address your concern from two perspectives:\n\n- The intuition behind the additive rule is to treat the graph affinity as a combination of **static correlation** and **dynamic anomaly-awareness**. $S_{ij}$ represents the baseline correlation between variables $i$ and $j$ under normal conditions. $\\sigma(r_i)$ is a score derived from the reconstruction residual of variable $i$. When a variable is highly perturbed (high $r_i$), we strengthen the connection of all its edges. This effectively highlights the subgraph surrounding a potential anomaly, which enforces the message-passing mechanism to focus on these regions.\n\n- We did consider alternatives, such as the multiplicative scaling suggested by the reviewer (e.g., $\\tilde{A}\\_{ij} = S_{ij} \\cdot (1 + \\sigma(r\\_i))$). However, we found the additive rule to be more effective, as the additive rule generally outperforms the multiplicative rule by $\\geq$2\\% across all metrics (on SWaT) in our attempts. This is because the effect of the multiplicative rule is conditional on the initial similarity $S_{ij}$. If $S_{ij}$ is near zero, the multiplicative strategy has a very limited effect. This is a significant limitation, as an anomaly could cause a new, strong correlation to emerge between two previously uncorrelated variables. The additive rule can capture this phenomenon by creating emphasis even on connections that were initially weak, making it more flexible for modeling diverse anomalous behaviors. \n\n**To W3:** We conducted additional experiments to evaluate the performance of SPAGD in terms of VUS-ROC and VUS-PR metrics. Below are the experimental results on SWaT, where we compared the performance with several state-of-the-art baseline methods:\n\n$\\begin{matrix}\n\\hline\n\\text{Metric}&\\text{VUS-ROC}&\\text{VUS-PR}\\\\\\\\\n\\hline\n\\text{USAD}&53.78&32.86\\\\\\\\\n\\text{TcnED}&62.99&44.30\\\\\\\\\n\\text{AnomalyTrans}&57.54&36.02\\\\\\\\\n\\text{Deep IF}&56.48&37.56\\\\\\\\\n\\text{TimesNet}&44.49&21.74\\\\\\\\\n\\text{DCdetector}&52.31&15.01\\\\\\\\\n\\text{COUTA}&77.10&51.86\\\\\\\\\n\\hline\n\\text{SPAGD}&\\bf84.93&\\bf62.08\\\\\\\\\n\\hline\n\\end{matrix}$\n\nWe can observe that SPAGD outperforms the latest baselines on these two metrics, which fully supports the effectiveness of our method. We will include this experiment in our paper."}, {"review_id": "EHmHWFwsAe", "reviewer": "Reviewer_cXmT", "summary": "This paper presents a for GNN-Transformer-based framework named Self-Perturbed Anomaly- aware Graph Dynamics (SPAGD) for time series anomaly detection problems. The model consists of two components: a Transformer-based autoencoder and a GNN-based spatiotemporal anomaly predictor. The authors first feed the raw sequence into the autoencoder to obtain a reconstructed sequence (referred to as Self-Perturbation in the paper), which is then passed to a GNN that operates on an adjacency matrix constructed from the reconstruction error (referred to as the Anomaly-Aware Graph). Meanwhile, the original sequence is processed by another GNN based on a static adjacency matrix. The outputs of both GNNs are fed into a prediction network to produce the anomaly scores. Notably, all neural networks are trained jointly. A number of experiments were conducted to verify the effectiveness of the method.", "questions": "1.\tSee the \"Weaknesses\" section.  \n2.\tHow are the anomaly detection threshold selection and localization performed by the authors?  \n3.\tWhat would happen to the performance if the dynamic error graph were not used and the reconstructed sequence were processed with the static graph instead (which is more efficient)?  \n4.\tGiven the introduction of GNN to handle spatial relationships, how do the authors view recent time series forecasting works [3] that have found better regression results by not considering the dependencies (using channel-independence)?\n\nReferences:  \n[1] Su, Ya, et al. \"Robust anomaly detection for multivariate time series through stochastic recurrent neural network.\"  \n[2] Abdulaal, Ahmed, Zhuanghua Liu, and Tomer Lancewicki. \"Practical approach to asynchronous multivariate time series anomaly detection and localization.\"  \n[3] Nie, Yuqi, et al. \"A time series is worth 64 words: Long-term forecasting with transformers.\"", "limitations": "N/A", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strength:\n1.\tThe writing is clear and easy to understand.  \n2.\tIn the experimental section of the paper, SPAGD demonstrates superiority over multiple state-of-the-art methods across three datasets and provides ablation study to prove the necessity of each module, showcasing high quality.  \n\nWeaknesses:\n1.\tThe main motivation stated in the Introduction is the anomaly-imbalance problem. However, the proposed method does not clearly explain how this issue is addressed, and there is a lack of corresponding experiments. Moreover, I believe that as long as the model effectively learns the distribution or features of normal data (without overgeneralizing), it should be sufficient to detect any abnormal behavior—especially given that the task focuses solely on determining the presence of anomalies, rather than identifying their specific types. Additionally, it is questionable whether the employed encoder-decoder network is capable of generating or mimicking unseen anomalies.  \n2.\tSetting aside some details (i.e., using a separate dynamic graph for the self-perturbated sequence), the overall approach resembles a standard GAN framework: a Transformer-based reconstruction network serving as the generator, a GNN-based anomaly scorer acting as the discriminator, along with an adversarial loss design. Given that GANs have already been widely applied to time series anomaly detection, this framework is not particularly novel. Moreover, I am skeptical about the effectiveness of the dynamic graph (See the Question 3), especially considering its higher computational cost.\n3.\tThe authors provide some theoretical analysis in the appendix, which is appreciated. However, I find it difficult to assess the practical significance of these results. Specifically, Theorem 1 presents an upper bound on the 1-Wasserstein distance between the distributions of reconstructed and anomalous samples, expressed as the sum of their reconstruction errors relative to normal samples. It is unclear how this bound translates to meaningful insights for anomaly detection, especially given that the reconstruction of anomalous samples is not explicitly considered. A similar concern applies to Theorem 2, where the layer-wise error bounds raise the question of how such perturbations actually affect detection performance in practice.  \n4.\tThe experimental section appears somewhat weak, as comparisons are conducted on only three datasets. I recommend including additional datasets such as SMD [1] and PSM [2] to enhance the comprehensiveness of the evaluation. Furthermore, a model complexity analysis would be beneficial—since the results of the ablation study may be affected by reduced parameter counts, the same concern applies to model comparisons.", "was_revised": true, "final_justification": "After careful consideration of the rebuttal and discussions with authors, other reviewers, and the Area Chair (AC), I have decided to maintain my initial recommendation for borderline acceptance. Here are the key points that support this decision:\n1.What’s Good: The paper propose a new framework for time series anomaly detection, in which each component is carefully designed. Although at a high level, the method looks like a GAN-style discriminator, it is relatively novel to introduce dynamic and static graph neural networks into such tasks. The experimental results are good, and the authors have subsequently supplemented some additional experiments.\n2.What’s Weak: The connection between the theory and the method is not tight, and the authors still have not addressed my concerns. There are logical inconsistencies; for instance, the paper clearly aims to reduce the W-distance between two distributions, yet the authors do not acknowledge this as bringing the two distributions closer. Furthermore, the proposed method is rather weakly connected to the problem it is supposed to solve.\nIn conclusion, while the authors have made some improvements, the core issues identified during the review process persist.", "rebuttal": "**We thank the reviewer for the constructive comments. Please find our responses to your concerns below.**\n\n**To W1:** Below are our clarifications to address your concern:\n- TSAD is inherently an imbalanced task, and TSAD datasets are mostly highly imbalanced due to the natural scarcity of anomalies in real-world scenarios. Our method attempts to mitigate this problem by progressively generating easy-to-hard auxiliary signals (can be viewed as a **curriculum learning** [1]) to learn a more robust decision boundary. The effectiveness of our solution was verified through **Table 2 in the main text and our response to W4**.\n> Yoshua Bengio, et al. Curriculum Learning, ICML, 2009.\n- We agree that an ideal model that perfectly learns normal patterns without overgeneralizing would be sufficient. However, the \"anomaly reconstruction\" problem identified in our paper prevents the model from reaching this ideal state, where the learning capacity of reconstruction-based models is powerful enough to accurately reconstruct simple anomalies, leading to low reconstruction errors (refer to Figure 3). Our work is motivated by mitigating this specific failure mode.\n- The goal of our SP module is not to explicitly generate unseen anomalies. Instead, it aims to refine the decision boundary with the self-perturbed samples, which act as **hard negatives** that lie close to the manifold of normal data. By training a classifier to distinguish normal samples from these subtle, model-induced deviations, we forced it to learn a tighter decision boundary around the normal data distribution.\n\n**To W2:** We would like to highlight that our framework is not adversarial. In GAN, the generator and discriminator have competing objectives, while in SPAGD, the components are cooperative. The reconstruction network is not trained to fool the classifier. Instead, as the reconstruction improves, it naturally generates more subtle perturbations, which create a form of curriculum learning that progressively refines the decision boundary.\n- We acknowledge that the AAGC module requires additional computational cost. However, we consider it a crucial component, as a static graph built on normal data hardly captures the dynamic changes of inter-variable correlations caused by anomalies. Our ablation study (**Table 3**) provides direct evidence of its effectiveness, where the \"w/o AAGC\" variant shows a significant performance drop. Furthermore, we analyze the computational cost of each module in SPAGD (**refer to response to Q2**), and show that the computational cost of SPAGD is still taken up by the transformer-based SP module. Therefore, we consider the slight increase in computational cost to be tolerable given the significant performance improvement (**Table 2**).\n\n**To W3:** We agree that connecting theory to practice is important. Below we discuss the practical significance of our theorems.\n- **Theorem 1:** This theorem provides a formal justification for *why* our self-perturbation strategy is effective. It demonstrates that as the reconstruction model improves during training, the distribution discrepancy between the generated self-perturbed samples and true anomalies decreases. In practice, this means that our training curriculum is not arbitrary but progressively generates more meaningful and challenging samples for the classifier to learn from. This ensures that the auxiliary signals are relevant to our task.\n- **Theorem 2:** This theorem addresses the potential concern that our dynamic graph adjustments could lead to unstable behavior. It provides a formal guarantee that the representations learned by the GNN model remain stable and change reasonably in response to the perturbations introduced by the AAGC module. In practice, this means our model is reliable as the dynamic mechanism will not cause exploding gradients or unstable outputs, which is a critical guarantee for any dynamic system.\n\nIn summary, Theorem 1 validates the **relevance** of our generative auxiliary data, and Theorem 2 validates the **reliability** of our dynamic architecture.\n\n**To W4:** We conducted an additional experiment to supplement more datasets and also analyzed the model complexity. We specifically supplemented with the SMD dataset and made a comparison to SPAGD, together with several other baseline methods:\n\n$\\begin{matrix}\n\\hline\n\\text{SMD}&\\text{AUC}&\\text{AUPRC}&\\text{F1}\\\\\\\\\n\\hline\n\\text{Deep-SVDD}&57.10&9.43&14.54\\\\\\\\\n\\text{USAD}&69.44&25.52&28.19\\\\\\\\\n\\text{TcnED}&61.43&11.22&18.38\\\\\\\\\n\\text{TranAD}&71.43&22.19&24.42\\\\\\\\\n\\text{AnomalyTrans}&69.56&12.72&22.7\\\\\\\\\n\\text{TimesNet}&70.41&14.48&19.61\\\\\\\\\n\\text{DCdetector}&49.98&4.15&07.98\\\\\\\\\n\\text{COUTA}&65.98&11.71&18.03\\\\\\\\\n\\hline\n\\text{SPAGD}&\\bf76.92 &\\bf38.48 &\\bf36.72&\\\\\\\\\n\\hline\n\\end{matrix}$\n\nThe experimental results show that SPAGD significantly outperforms the latest baselines, which further justifies its effectiveness.\n\nRegarding the model complexity analysis, we analyzed the parameter size of SPAGD and several baseline methods on SWaT:\n\n$\\begin{matrix}\n\\hline\n&\\text{Network Parameter Size ($\\times 10^{6}$)}\\\\\\\\\n\\hline\n\\text{USAD}&84.40\\\\\\\\\n\\text{AnomalyTrans}&4.85\\\\\\\\\n\\text{TimesNet}&4.70\\\\\\\\\n\\text{DCdetector}&0.90\\\\\\\\\n\\hline\n\\text{SPAGD}&2.51\\\\\\\\\n\\hline\n\\end{matrix}$\n\nWe observed that the network parameter size of SPAGD is comparable to other state-of-the-art baselines, especially transformer-based ones. These results demonstrate that the performance improvements are not due to a larger model size but are tied to our architectural innovations. We hope our responses are helpful in addressing your concerns.\n\n**To Q2:** The AUC and AUPRC metrics are **threshold-independent**. For the F1-score, we follow the standard method of selecting the optimal threshold on the test set. Localization is achieved by comparing the anomaly scores output by the model for each time window to the selected threshold.\n\n**To Q3:** We would like to answer your question from two perspectives:\n- In our ablation study (**Table 3**), the variants \"w/o AAGC (Spatial)\" and \"w/o AAGC (Temporal)\" share the same static graph $A$ for the normal and the self-perturbed time series in spatial convolution and temporal convolution, respectively. For these two variants, a clear performance degradation was observed across all datasets. Here, we further added another variant \"w/o AAGC\", which shares the same static graph during both spatial and temporal convolution. Below are the experimental results:\n\n$\\begin{matrix}\n\\hline\n&\\text{AUC}&\\text{AUPRC}&\\text{F1}\\\\\\\\\n\\hline\n\\text{w/o AAGC}&80.54&70.59&74.28\\\\\\\\\n\\text{w/o AAGC (Spatial)} &81.51&70.07&74.20\\\\\\\\\n\\text{w/o AAGC (Temporal)} &83.16&72.18 &75.11\\\\\\\\\n\\hline\n\\text{SPAGD} & \\bf86.30&\\bf77.20&\\bf78.77\\\\\\\\\n\\hline\n\\end{matrix}$\n\nThe performance of the \"w/o AAGC\" variant further decreases compared to the other two variants and SPAGD. This empirically justifies the effectiveness of using the dynamical anomaly-aware graph for the perturbed sequence, as the static graph learned from normal data is not equipped to model the altered correlations. We will add this additional ablation study in our paper.\n- Regarding efficiency concerns, we supplement an experiment to compare the computation time cost of (1) the transformer-based SP module, (2) the AAGC module (including the initial graph construction and dynamic graph adjustment), and (3) the predictor (classifier) module over 10 epochs on SWaT:\n\n$\\begin{matrix}\n\\hline\n&\\text{SP module}&\\text{Initial graph construction}&\\text{Dynamic graph adjustment}&\\text{Predictor}\\\\\\\\\n\\hline\n\\text{Time cost in second(s)}&2.03&0.85&0.22&0.01\\\\\\\\\n\\hline\n\\end{matrix}$\n\nThe time cost of dynamic graph adjustment is actually small compared to the SP module, as we impose **sparsity** during the graph construction, and the initial graph construction is performed only once during model training. In view of the positive performance improvement (**Table 2**), we consider that the slight increase in time cost is tolerable.\n\n**To Q4:** This is a very insightful question about the current state of research. Our view is that the utility of explicitly modeling inter-variable dependencies is highly **task-dependent**.\n- The goal of forecasting is to predict the *continuation of normal behavior*. In scenarios where channels are not strongly correlated or where learning these correlations introduces more noise than signal, channel-independent models can excel.\n- However, the goal of TSAD is to identify **deviations from normal behavior**, which often manifest as **disruptions in the relationships between variables**. For example, a sensor failing might not produce an anomalous value in isolation, but its readings will no longer correlate with its neighbors. A channel-independent model would be difficult to detect such correlation-based anomalies. For the TSAD task, like SWaT in physical systems, inter-variable dependencies are not noise but an important source of information for detecting system faults.\nTherefore, while channel-independence is a powerful paradigm for certain forecasting tasks, we believe that explicitly modeling spatial relationships is also essential for advancing multivariate time-series anomaly detection. The success of numerous graph-based TSAD methods (such as GDN) has provided evidence for this position."}, {"review_id": "brMMzFuNPF", "reviewer": "Reviewer_8kcc", "summary": "In this paper, the authors proposed self-perturbed anomaly-aware graph dynamics (SPAGD), a novel TSAD framework that addresses several crucial challenges in multivariate time-series anomaly detection. Specifically, SPAGD employs self-perturbations derived from reconstruction errors to generate auxiliary anomalous time-series data to facilitate the training of detection model. An adaptive anomaly-aware graph construction module is proposed to adjust graph structures according to the dynamic disruptions within time-series data, and a spatio-temporal modelling framework is integrated to achieve anomaly detection. Experiments conducted on well-established benchmark datasets validate that SPAGD significantly surpasses multiple state-of-the-art baseline methods.", "questions": "1. Can the authors provide more details on how the Transformer-based reconstruction model was initialized?\n2. What is the rationale for selecting $k$-NN for initial graph construction? How would other alternative graph construction strategies affect the performance?\n3. What is the computational complexity of the proposed method? Is it comparable to other baseline methods?\n4. Are the performance improvements of SPAGD compared to other baselines statistically significant? Can the authors further conduct statistical significance tests to demonstrate this?\n5. Can the authors briefly discuss about the social impact of this work?", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 3, "significance": 3, "originality": 4, "strengths_and_weaknesses": "**Strengths**\n1. The self-perturbation strategy is a novel and promising solution to the scarcity issue of anomalous data in TSAD. By perturbing normal data, the proposed method generates an evolvable set of auxiliary anomalies to enhance the detection capability of the model without requiring labelled anomalies, which is a common bottleneck in the field.\n2. The proposed anomaly-aware dynamic graph construction allows the model to adjust the learned graph structure based on real-time reconstruction residuals. This makes it more adaptable to capture shifting dependencies in real-world applications with complex, evolving systems compared to static graph construction methods.\n3. The theoretical analysis in the appendix well justifies the rationale of the self-perturbation and graph dynamics components modules.\n\n**Weaknesses**\n1. The description of the self-perturbation module lacks sufficient detail on how the Transformer-based reconstruction model is initialized and how the perturbation evolves during training. For instance, the paper does not clarify whether the reconstruction model is pre-trained or trained from scratch alongside other components, which impacts reproducibility.\n2. The claims of performance superiority would be more convincing if supported by statistical significance testing. I suggest the authors conduct appropriate statistical tests (e.g., t-test) to validate that the improvements over key baselines are statistically significant.\n3. This paper does not justify the rationale for selecting $k$-NN for initial graph construction. Can another alternative strategy be used for graph construction, and how could this impact the model performance? The authors need to elaborate on it.\n4. The computational complexity of the proposed methodology is not currently included. It is recommended that the complexity analysis be supplemented with a discussion of its feasibility for practical deployment.\n5. The statement of  \"no societal impact\" in the checklist is oversimplified for a technology with broad potential applications. I encourage the authors to at least give a brief discussion covering both positive societal benefits and potential negative risks.", "was_revised": true, "final_justification": "In the rebuttal, the authors' response has addressed my concerns. I would like to keep my original positive score.", "rebuttal": "**We thank the reviewer for the constructive comments. Please find our responses to your concerns below.**\n\n**To W1:** Thank you for pointing out this issue. We clarify that the self-perturbation module is trained with **randomly initialized weights**, and we **explicitly avoided pre-training** because the evolution of the reconstruction model is crucial to our proposed learning paradigm. Specifically:\n1. In the early training stage, the randomly initialized reconstruction network is a poor approximator of the normal data. Consequently, the generated samples with significant deviations can serve as **easy negative** samples for the training of the classifier.\n2. As training progresses, the self-perturbation module improves by minimizing the self-perturbation loss ($\\mathcal{L}_{sp}$), and the classifier is progressively challenged with **hard negative** samples that deviate more subtly from the normal data manifold.\n\nWe will include these descriptions in our revised paper to improve the clarity and reproducibility of our method.\n\n**To W2:** To evaluate the statistical significance of the improvements, we performed a Student's t-test analysis (AUC and AUPRC) on SWaT with 5 independent runs. Our SPAGD achieved **85.48\\%$\\pm$1.15\\% AUC** and **75.67\\%$\\pm$1.64\\% AUPRC**, and below are several baseline performance and corresponding results ($p$-value) of the t-Student's t-test:\n\n$\\begin{matrix}\n\\hline\n\\text{Metric}&\\text{AUC}&\\text{$p$-value}&\\text{AUPRC}&\\text{$p$-value}\\\\\\\\\n\\hline\n\\text{Deep-SVDD} &82.48\\pm0.36&0.0005&72.76\\pm0.94&0.0089\\\\\\\\\n\\text{TcnED} &82.18\\pm0.90&0.0010&72.33\\pm1.14&0.0057\\\\\\\\\n\\text{TranAD} &81.77\\pm0.46&0.0002&71.86\\pm0.58&0.0012\\\\\\\\\n\\text{Deep lF} &80.63\\pm0.12&0.0000&70.24\\pm0.78&0.0002\\\\\\\\\n\\text{COUTA} &81.43\\pm0.97&0.0003&72.39\\pm1.41&0.0095\\\\\\\\\n\\hline\n\\end{matrix}$\n\nGenerally, **the difference is said to be significant if the $p$-value is less than 0.05**. As shown in the table, the $p$-values are consistently below the 0.05 threshold, which demonstrates that the performance improvements achieved by SPAGD are statistically significant. We will add this experiment to our paper.\n\n**To W3:** Our choice of $k$-NN for graph construction was motivated by its widespread use and proven effectiveness in the GNN-based TSAD works, such as GDN [1]. It is a simple and non-parametric approach that robustly captures local data structure while naturally enforcing graph sparsity, which is computationally beneficial.\n> [1] Ailin Deng and Bryan Hooi. Graph neural network-based anomaly detection in multivariate time series. AAAI, 2021.\n\nTo empirically validate this choice, we conducted an additional experiment on SWaT comparing $k$-NN with two other alternatives: (1) a **fully-connected** strategy using all pairwise similarities as edge weights) and an **$\\epsilon$-neighborhood** strategy connecting nodes with similarity above a threshold $\\epsilon$). Below are the performance comparisons between fully-connected, $\\epsilon$-neighborhood and $k$-NN, where we set $\\epsilon=0.5$:\n\n$\\begin{matrix}\n\\hline\n\\text{Metric}&\\text{AUC}&\\text{AUPRC}&\\text{F1}\\\\\\\\\n\\hline\n\\text{Full-connected} &82.13&71.79&74.45 \\\\\\\\\n\\text{$\\epsilon$-neighborhood} &81.41&72.53&74.35 \\\\\\\\\n\\text{$k$-NN} &\\bf86.30&\\bf77.20&\\bf78.77\\\\\\\\\n\\hline\n\\end{matrix}$\n\nThe results demonstrate that $k$-NN achieves the best performance, because the fully-connected graph likely introduces noise from weak, irrelevant correlations, while the performance of $\\epsilon$-neighborhood is highly sensitive to the choice of the threshold $\\epsilon$. Overall, the $k$-NN approach provides a more stable and effective balance. We will include this analysis in our paper.\n\n**To W4:** To address this concern, we analyze the time complexity of SPAGD, which contains three main components:\n1. **Self-Perturbation module**: This module employs a Transformer-based model, where the computational bottleneck is the self-attention mechanism, which has a complexity of $\\mathcal{O}(T^2 d)$ for an input sequence of length $T$ and dimension $d$. As the number of layers is a fixed hyperparameter, the complexity for this module is $\\mathcal{O}(T^2 d)$.\n2. **AAGC module**: The complexity of this module is dominated by the initial graph construction, which involves computing pairwise cosine similarity between all $d$ variables over $T$ timesteps. This results in a time complexity of $\\mathcal{O}(d^2 T)$. The subsequent dynamic adjustment steps involve calculating node-wise reconstruction residuals ($\\mathcal{O}(dT)$) and adjusting the structure of the sparse graph ($\\mathcal{O}(d^{2})$), which are less complex.\n3. **Predictor module:**\nThis module consists of spatial convolution and temporal convolution. The spatial convolution operates on a sparse graph with $|E|=dK$ edges (due to top-$k$ neighbor selection). In our model, the spatial convolution is applied across the temporal dimension $T$ and $L$ layers of GNN with $d_{\\text{lat}}$ latent dimensions, resulting in complexity of $\\mathcal{O}(LT \\cdot dk \\cdot d_{\\text{lat}})$. Since $L$, $k$, and $d_{\\text{lat}}$ are fixed, this simplifies to $\\mathcal{O}(Td)$. The temporal convolution complexity is also linear in sequence length and channels, which is approximate $\\mathcal{O}(Td)$. \n\nThus, the overall time complexity of SPAGD for processing a single time-series window is approximately $\\mathcal{O}(T^2 d + d^2 T)$, as $T$ and $d$ are dominating factors in the model. For practical deployment, the complexity of SPAGD is comparable to other transformer-based and GNN-based TSAD methods, such as TranAD, AnomalyTrans, and TimesNet. Moreover, we also analyzed the model parameter size of SPAGD (**refer to the response of the reviewer cXmT's W4**), which showed that SPAGD is also highly competitive in terms of model parameter sizes and is feasible for application in a wide range of real-world scenarios.\n\n**To W5:** We are grateful that the reviewer encourages discussions on the broader social impacts of our work. We will add a \"Broader Impact Statement\" to the paper discussing the following points:\n1. **Positive social impacts:** Our work has significant potential to enhance the safety and reliability of critical cyber-physical systems. For example, early anomaly detection can prevent catastrophic equipment failures, ensuring worker safety and preventing environmental damage. In aerospace applications, it can improve mission success and safety by flagging potential faults in spacecraft telemetry.\n2. **Potential negative risks:** (1) Over-reliance on the system could lead operators to dismiss their own expertise. *Mitigation:* We advocate for deploying SPAGD as a decision-support tool that provides interpretable outputs (e.g., highlighting anomalous sensors and their correlations) rather than as a fully autonomous system. (2) A sophisticated adversary could potentially craft inputs to either evade detection or trigger false alarms. *Mitigation:* This is a critical area for future work, where we need to focus on improving the adversarial robustness of the model."}]

Author rebuttal:

Meta-review: There is a clear consensus in the PC that this is a strong paper that should be accepted. Congratulations to the authors! I am requesting the author to carefully incorporate the suggestion provided by the review in camera-ready version.
Decision: Accept (spotlight)