Structured Temporal Causality for Interpretable Multivariate Time Series Anomaly Detection

The gist OracleAD introduces a simple and interpretable unsupervised framework for multivariate time series anomaly detection by encoding each variable’s past sequence into a single causal embedding to jointly predict the present time point and reconstruct the input window, effectively modeling temporal dynamics.

OracleAD Framework

(Page 1)

OracleAD processes the time series data with a sliding window of length L. For each variable i, a per-variable LSTM encoder processes its past L − 1 observations to produce hidden states which are then applied to yield a single causal embedding ci, which summarizes the temporal information necessary to predict the final timepoint xL in the window

(Page 2)

To instill temporal causality in the encoder, OracleAD jointly trains it with two objectives: one-step point prediction of xLi and reconstruction of the window

(Page 3)

The resulting vector ci in R d, termed the causal embedding of variable i, aggregates its past hidden states weighted by their relevance in predicting xL i, thereby encoding the temporal causality inherent in that variable’s history

(Page 4)

To incorporate inter-variable interactions, OracleAD applies Multi-Head Self-Attention MHSA to the stacked embeddings C = [c1,..., cN] T in R N x d, yielding the attention-refined output C∗ = [c∗1,..., c∗N] in R N x d

(Page 4)

Each c∗i is computed as c∗i = X H h=1 WO h softmax (W Q h ci)(W K h C) T sqrt(dh)WV h C, where H denotes the number of attention heads, and W Qh, W Kh, WV h, WO h are learnable projection matrices for query Q, key K, value V, and output in head h

(Page 4)

The resulting vector ci in R d, termed the causal embedding of variable i, aggregates its past hidden states weighted by their relevance in predicting xL i, thereby encoding the temporal causality inherent in that variable’s history

(Page 4)

These context-aware embeddings c∗i are then passed into their corresponding LSTM decoders Deci, each trained to both reconstruct the past window and predict the next value: xˆ L i = Deci(c∗ i)

Stable Latent Structure (SLS)

(Page 6)

OracleAD maintains a reference structure called the Stable Latent Structure SLS. The SLS summarizes stable intervariable relationships observed in the latent space during normal behavior

(Page 6)

For each training window k, we form a pairwise dissimilarity matrix D(k)ij = (c∗(k)i - c∗(k)j) squared, D(k) in R N x N

(Page 6)

Aggregating over the M windows that appear in one training epoch yields the stable template SLS = 1/M sum k=1 X M k=1 D(k), which provides a compact baseline of canonical inter-variable structure

(Page 6)

At inference time, OracleAD computes the deviation matrix Dt matrix = Dt - SLS, which measures element-wise deviations from the normal inter-variable structure

Anomaly Scoring Mechanism

(Page 7)

The prediction score is defined as P t score = 1/N sum i x t i - xˆ t i, which measures the average absolute error between the observed variables and their reconstructions

(Page 7)

The deviation score is defined as D t score = Dt - SLSF, where Dt is the pairwise dissimilarity matrix of the causal–context embeddings at time t, and SLS is the stable relational template from Eq. 12

(Page 7)

The final anomaly score is then defined as A t score = P t score · Dt score, which jointly captures both temporal and spatial anomalies in multivariate time series

Evaluation and Results

(Page 8)

OracleAD achieves state-of-the-art anomaly detection performance across multiple real-world datasets. Experimental results show consistent improvements in detection accuracy, anomaly localization, and robustness under diverse evaluation protocols

(Page 8)

In contrast, the deviation score compares the current latent dissimilarity matrix to the SLS and captures structural inconsistencies by measuring the deviation between the current latent dissimilarity matrix and the SLS, flagging shifts in inter-variable relationships that deviate from learned causal structures

(Page 8)

The multiplicative combination of these two scores enables OracleAD to balance their respective strengths and mitigate their individual weaknesses

Interpretability and Diagnosis

(Page 9)

The deviation matrix Dt matrix = Dt −SLS, which highlights each variable’s disruption of the learned structure

(Page 9)

A distinctive strength of OracleAD lies in its ability to localize root-cause variables through the deviation matrix Dt matrix = Dt - SLS, where row-wise aggregation highlights which variables most strongly disrupt normal interactions

(Page 9)

The top-3 ranked variables coincide with the ground-truth causal set, and even for multivariable anomalies, OracleAD reliably recovers the majority of causal variables

Limitations

(Page 38)

First, the Stable Latent Structure (SLS) assumes globally consistent inter-variable relationships learned from continuous-valued inputs. This assumption may not hold in complex or multimodal systems such as SWaT, where heterogeneous subsystems or mixed variable types (e.g., continuous and discrete sensors) coexist

(Page 38)

To address these challenges, future work will focus on developing an anomaly detection framework that is agnostic to variable types, seamlessly handling continuous, categorical, and discrete signals; and (2) a dynamically updated SLS mechanism that adapts over time rather than remaining static during inference

(Page 38)

The paper highlights the importance of grounding anomaly detection in temporal causality and latent relational consistency, establishing a principled foundation for generalizable and interpretable multivariate time series analysis

Experimental Setup

(Page 30)

OracleAD employs a separate LSTM encoder–decoder for each of the N variables, giving a perwindow temporal cost of O(N · T). Multi-head self-attention requires O(N2) pairwise comparisons, leading to an overall per-window complexity of O(N·T+N2)

(Page 30)

The default configuration used across all datasets fixes the window length to 10, the batch size to 1024, the deviation weight to 3, and the number of layers to 2

Conclusion

(Page 38)

OracleAD achieves state-of-the-art performance across multiple real-world datasets and evaluation protocols, demonstrating strong robustness, localization accuracy, and interpretability

(Page 38)

Its dual scoring mechanism captures both prediction errors and structural deviation, enabling precise detection and fine-grained root-cause analysis even without labels

Broader Impacts

(Page 38)

The ability to detect abnormal behavior in a timely and interpretable manner can improve operational safety, prevent financial or physical damage, and assist in early diagnostics

(Page 38)

OracleAD aims to address key limitations of existing models by offering interpretable, structure-aware, and segment-sensitive anomaly detection

Data Sources

(Page 23)

We use three widely adopted, publicly available MTSAD datasets.

1. Improved anomaly detection capability by combining temporal prediction error with structural deviation, as OracleAD jointly captures both temporal and spatial anomalies in multivariate time series through its dual scoring mechanism of P t score and Dt score.

2. Enhanced root cause diagnosis by identifying variables that disrupt normal inter-variable relationships, as the deviation matrix Dt matrix highlights each variable’s disruption of the learned structure, allowing for pinpointing root-cause variables at the embedding level.

3. Improved robustness to anomaly duration by leveraging a stable reference structure, as the deviation score captures longer-term relational disturbances compared to prediction scores, making it effective when anomalies span the full duration of a system disturbance rather than just its initiation.

4. Increased detection precision and stability across thresholds by using the multiplicative anomaly score fusion, as Table S9 shows that multiplicative fusion inherently balances the two by emphasizing co-occurring signals, leading to sharper and more consistent anomaly responses.

5. Better handling of complex, overlapping anomalies by providing a mechanism to distinguish between localized temporal deviations and sustained structural inconsistencies, as Figure S6 illustrates how the deviation score is more effective in representing the internal disorganization of the system during overlapping anomaly signals.

6. Improved applicability to heterogeneous systems by addressing limitations regarding variable types, with future work focusing on developing an anomaly detection framework that is agnostic to variable types, seamlessly handling continuous, categorical, and discrete signals.

Real-world multivariate time series anomalies are rare and often unlabeled. Additionally, prevailing methods rely on increasingly complex architectures tuned to benchmarks, detecting only fragments of anomalous segments and overstating performance. In this paper, we introduce OracleAD, a simple and interpretable unsupervised framework for multivariate time series anomaly detection. OracleAD encodes each variable's past sequence into a single causal embedding to jointly predict the present time point and reconstruct the input window, effectively modeling temporal dynamics. These embeddings then undergo a self-attention mechanism to project them into a shared latent space and capture spatial relationships. These relationships are not static, since they are modeled by a property that emerges from each variable's temporal dynamics. The projected embeddings are aligned to a Stable Latent Structure (SLS) representing normal-state relationships. Anomalies are identified using a dual scoring mechanism based on prediction error and deviation from the SLS, enabling fine-grained anomaly diagnosis at each time point and across individual variables. Since any noticeable SLS deviation originates from embeddings that violate the learned temporal causality of normal data, OracleAD directly pinpoints the root-cause variables at the embedding level. OracleAD achieves state-of-the-art results across multiple real-world datasets and evaluation protocols, while remaining interpretable through SLS.