Title: Structured Temporal Causality for Interpretable Multivariate Time Series Anomaly Detection
Venue: NeurIPS 2025
Accepted: yes
Keywords: Multivariate Time Series

Anomaly Detection

Unsupervised learning
Abstract: Real-world multivariate time series anomalies are rare and often unlabeled. Additionally, prevailing methods rely on increasingly complex architectures tuned to benchmarks, detecting only fragments of anomalous segments and overstating performance. In this paper, we introduce OracleAD, a simple and interpretable unsupervised framework for multivariate time series anomaly detection. OracleAD encodes each variable’s past sequence into a single causal embedding to jointly predict the present time point and reconstruct the input window, effectively modeling temporal dynamics. These embeddings then undergo self-attention mechanism to project them into a shared latent space and capture spatial relationships. These relationships are not static, since they are modeled by a property that emerges from each variable's temporal dynamics. The projected embeddings are aligned to a Stable Latent Structure (SLS) representing normal-state relationships. Anomalies are identified using a dual scoring mechanism based on prediction error and deviation from the SLS, enabling fine-grained anomaly diagnosis at each time point and across individual variables. Since any noticeable SLS deviation originates from embeddings that violate the learned temporal causality of normal data, OracleAD directly pinpoints the root-cause variables at the embedding level. OracleAD achieves state-of-the-art results across multiple real-world datasets and evaluation protocols, while remaining interpretable through SLS.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe author proposed OracleAD, a framework for multivariate time series anomaly detection. OracleAD uses an encoder-decoder architecture using a proposed loss. The inner latent vectors will be used to detect the anomalies during inference time.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n- The paper is relatively easy to follow, except for the parts highlighted in the \"questions\" below.\n- The idea introduced are relatively novel and non-trivial.\n- Adequate experiments and baselines are included.\n- Examples and simple ablation studies are included.\n\nWeaknesses:\n- I think there are some justifications are lacking in certain parts of the paper. See \"questions\" below.\n- There are also minor unclear details in Section 3. See \"questions\" below.\n- Limitations and Discussions are slightly lacking.\n\nQUESTIONS:\n1) Label equations. Use `\\begin{equation}\\end{equation}` instead of `\\[ \\]`\n2) Equation after Line 154. My understanding here is $h_i^t \\in R^d$, $w\\in R^d$ and softmax is applied across the t-th dimension. Is this correct? In any case, we should describe it more clearly, especially for the softmax part.\n3) Section 3.2, what is \"normal training window\" k? What is \"M windows\" in SLS computation?\n4) I think Section 3.2 is lacking some justifications. I think there are several \"choices\" made in this section that was not explained or justified. Not to say that this choices are not correct, but some simple justifications or discussions would be helpful. Example of choices are \n- The choice of D and SLS: As we are comparing the latent vectors from the \"baseline\" vs the inference time, why do we opt it to compute the distances. i.e. the choice was to check for \"inter-variable relational stability\" instead of \"variable stability\"? (I noticed that are some almost relevant discussion in section 4.3\n\n  > This score captures anomalies that manifest as disruptions in inter-variable relationships, which often persist beyond the initial signal deviation. Notably, we find that this behavior aligns well with real-world anomaly labeling practices, as seen in the shaded regions of Figure 2, \n\n  but the results showing a spike in the anomaly score does not match the statement.\n\n- Choosing the L2 distances between latent vectors: Is there justification of using both the directional mismatch and the latent enrgy differences?\n- The choice of the baseline being the average of \"k\" dissimilarity matrices. In case that the dissimilarity matrix are fluctuating normally, the deviation matrix may not take account to the \"variances\" of the $D^{(k)}$'s.\n5) Similar to 4), Figure 2 and 3 does not really shows the clear interpretability from the deviation matrix. From Fig 3a), we can see that feature 33 deviates from the baseline by quite a lot, which was shown in Figure 2a). But for Fig 3b), we see feataure 13, say has a high deviation with feature 8 or 12, but not the other features. How do you interpret the difference between case a) and b)?\n\nLIMITATIONS:\nThe authors should include a section regarding limitations.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-26"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nAn unsupervised multi-variate anomaly detection framework that captures both temporal and structural aspects for improved performance.\n\nSTRENGTHS AND WEAKNESSES:\nThe paper is well-written.\n\nThe discussion around setting up an LSTM+attention scheme for capturing variable-specific temporal dynamics makes sense.\n\nThe discussion around setting up a multi-headed attention scheme to capture inter-variable dynamics makes sense.\n\nThe introduction of Stable Latent Structure that captures the \"normal, stationary\" behaviour of the multi-variate data is new.\n\nThe training objective that consists of prediction loss, reconstruction loss, and deviation loss seems to make sense.\n\nThe model is evaluated on three commonly used multi-variate anomaly detection benchmarks using standard metrics. \n\n# Weaknesses\n\nThe intuition behind how anomaly score is constructed by multiplying P^t_{score} and D^t_{score} isn't clear.  \n\nIt is not explicitly stated anywhere that inference operates over windows of length T and not the data item at time t.  Or am I mistaken?  Is it possible to performance inference on a single data item x^t?  If inference requires an input window, say of size T, how is localization achieved?  \n\nThe claim about interpretability is weak.  How can we confirm it that highlighted regions in Fig. 3 heatmaps actually correspond to offending variables?  Is it possible to setup an experiment to confirm this claim?  What data would we need?\n\nThe results achieved on PSM and SMD datasets improve upon the state-of-the-art; however, the results on SWaT benchmark do not match the state-of-the-art results according to a number of metrics.  Is there a reason why?\n\nQUESTIONS:\n1. Please describe how localization is achieved.\n2. Please detail the assumptions about the inference operation (size of window, etc.).\n3. It would be useful to include the training costs associated with training this model on the three benchmarks?  Just to get a sense of what is needed to deploy this method in the industrial settings.\n4. How can we support the claim that the heatmaps shown in Fig. 3 aids in interpretability.\n5. A discussion around the construction of anomaly score, i.e., why use multiplication there, why not simply add P and D values?\n\nLIMITATIONS:\nThe paper doesn't include a limitations section and no limitations are discussed in Sec. 5.  It would be useful to put some thought into where/why the system might underperform.  See, for example, the performance on SWaT data.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe work proposes a framework for anomaly detection by combining temporal causality modeling and inter-variable structure learning. The framework provides interpretable deviation matrices that highlight which variables are likely responsible for detected anomalies.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\n1. Interpretable method that allows pin-pointing likely root-cause variables through a deviation matrix.\n2. Comprehensive experiments and evaluations are performed, demonstrating improvements over baselines\n3. Transparent discussion on limitations of existing benchmarks and corresponding results\n\nWeaknesses:\n1. Certain writing issues, such as (1) line 204 \"regularication\", and (2) line 182 \"summarices\".\n2. Unclear novelty: Modeling each channel independently (also known as channel independence in several works) is a well explored area [1, 2]. Applying attention across variates is similar to iTransformer [2]. \n\n[1] Nie, Y., Nguyen, N. H., Sinthong, P., & Kalagnanam, J. (2022). A time series is worth 64 words: Long-term forecasting with transformers. arXiv preprint arXiv:2211.14730.\n[2] Nie, Y., Nguyen, N. H., Sinthong, P., & Kalagnanam, J. (2022). A time series is worth 64 words: Long-term forecasting with transformers. arXiv preprint arXiv:2211.14730.\n[3] Liu, Y., Hu, T., Zhang, H., Wu, H., Wang, S., Ma, L., & Long, M. (2023). itransformer: Inverted transformers are effective for time series forecasting. arXiv preprint arXiv:2310.06625.\n\nQUESTIONS:\n1. Could the authors kindly explain the novelty in their method\n2. How does this work compare to foundation models for time-series anomaly detection such as MOMENT [1]\n\n[1] Goswami, M., Szafer, K., Choudhry, A., Cai, Y., Li, S., & Dubrawski, A. (2024, July). MOMENT: A Family of Open Time-series Foundation Models. In International Conference on Machine Learning (pp. 16115-16152). PMLR.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 2, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a multivariate time series anomaly detection framework named OracleAD. Its core contribution lies in proposing a novel perspective on anomaly evolution: an anomaly first manifests as a disruption in a single variable's \"temporal causality,\" which then propagates to cause a \"structural\" anomaly in the relationships between variables. Overall, the paper presents a novel concept, demonstrates excellent model performance, and possesses a degree of interpretability. However, OracleAD relies on a specific model architecture (LSTM) and a key assumption (a stable latent structure), and the generalizability of these components warrants further investigation.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n1. The research proposes a novel conceptual framework where anomalies originate from a loss of \"temporal causality\" and subsequently propagate into \"structural\" deviations. This viewpoint offers a new perspective for anomaly detection.\n2. The paper evaluates the proposed method on widely used benchmark datasets, and the experimental results demonstrate its effectiveness.\n3. The separation of prediction and deviation scores enables the model to distinguish between transient temporal spikes and persistent structural anomalies. Furthermore, analysis of the deviation matrix allows for the direct identification of root-cause variables that disrupt the stable inter-variable relationships. This fine-grained diagnostic capability holds practical value for real-world applications.\n\nWeaknesses\n1. Although the central concept is novel, the individual technical components of OracleAD are established technologies. This factor diminishes the work's originality from a foundational model perspective.\n2. SLS is aggregated over the entire training set and remains static during inference. This stability assumption may not hold in real-world scenarios, particularly for systems exhibiting concept drift. The paper does not discuss how the model adapts to such dynamically changing normal patterns.\n3. The model employs a separate LSTM encoder-decoder for each of the N variables. This design incurs significant computational and memory overhead as the number of variables increases. The paper does not discuss the model's computational complexity or its scalability for high-dimensional time series.\n\nQUESTIONS:\n1. The window length used in the experiments is notably short. Can you elaborate on the rationale for this choice? Does this imply that OracleAD's performance is insensitive to long-range dependencies, or that the studied anomalies are primarily local in nature? Can you provide a sensitivity analysis on the window length T to show its impact on model performance?\n2. The static assumption for the SLS may limit the model's applicability in scenarios with concept drift. Do you consider a mechanism for dynamically updating the SLS, for instance, by using a moving average window or by introducing an online update step during inference?\n3. The model employs a separate LSTM encoder-decoder for each variable, and its computational complexity appears to scale linearly or super-linearly with the number of variables, N. Can you provide a computational complexity analysis with respect to N and the window length T? Is the model feasible for large-scale datasets with hundreds or thousands of variables?\n4. Does the SLS, obtained via \"aggregation at the end of an epoch,\" converge to a consistent structure across different initialization conditions? Furthermore, can you justify why this specific aggregation method is preferable to alternatives, such as per-batch aggregation?\n5. When the deviation score of a variable A is high, how does OracleAD distinguish between the scenario where \"A itself is the source of the anomaly\" and the scenario where \"neighboring variables are anomalous and affect A through the self-attention mechanism\"?\n\nLIMITATIONS:\nYes. While the authors indicate that limitations are discussed in the appendix, it is recommended that the following points be addressed more explicitly:\n1. Explicitly state that the static nature of the SLS is a core model assumption and discuss scenarios where this assumption may not hold (e.g., in systems with concept drift).\n2. Explicitly discuss the computational and memory overhead of the model when the number of variables, N, is large.\n3. The current model appears to be designed for continuous-valued time series. Its applicability to mixed-type time series that include discrete or categorical variables warrants discussion.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-07-05"}