When Model Meets New Normals: Test-time Adaptation for Unsupervised Time-series Anomaly Detection

TL;DR

The paper addresses the challenge of evolving normal behavior in unsupervised time-series anomaly detection by introducing a test-time adaptation framework that combines trend-based input normalization with online model updates to learn new normals during inference. The approach segments into problem formulation, EMA-based trend normalization, and online updates of the detector using a reconstruction-based loss, enabling adaptation without labels. Empirical results on diverse real-world datasets, including AnoShift, show robust improvements in AUROC and AUPRC across distribution shifts, with notable gains on heavily shifted benchmarks. This method enhances reliability of real-time monitoring systems by reducing false positives while maintaining anomaly sensitivity under nonstationary conditions.

Abstract

Time-series anomaly detection deals with the problem of detecting anomalous timesteps by learning normality from the sequence of observations. However, the concept of normality evolves over time, leading to a "new normal problem", where the distribution of normality can be changed due to the distribution shifts between training and test data. This paper highlights the prevalence of the new normal problem in unsupervised time-series anomaly detection studies. To tackle this issue, we propose a simple yet effective test-time adaptation strategy based on trend estimation and a self-supervised approach to learning new normalities during inference. Extensive experiments on real-world benchmarks demonstrate that incorporating the proposed strategy into the anomaly detector consistently improves the model's performance compared to the baselines, leading to robustness to the distribution shifts.

Figures (10)

• Figure 1: Motivation for learning new normals. (a) T-SNE visualization of the SWaT benchmark SWaT reveals distinct behavior between the training (red) and test data (blue). (b) Our test-time adaptation strategy surpasses previous state-of-the-art time-series anomaly detection models in terms of F1 score, even with simple baselines such as MLP-based autoencoders. (c) This improvement arises from effectively handling significant distribution shifts in the time-series data. Over time, off-the-shelf models fail to adapt to these new normals, while our approach exhibits robustness to such distribution shifts. Consequently, previous approaches USADTHOC produce false positive cases due to the model's inability to keep pace with changing dynamics, thereby "the model is staying in the past while the world is changing."
• Figure 2: Illustration of the necessity for estimating trends and test-time adaptation. (a) NeurIPS-TS-UNI shows synthetic data generated based on the previous work NTS, revealing an abrupt trend shift while preserving underlying dynamics. The objective of the trend estimation module is to adapt to such trend shifts successfully. (b) Solely relying on trend estimation may not be adequate to fully capture the dynamics, as demonstrated by the Yahoo-A1-R20 series. The shaded purple and yellow areas represent the standard deviations of the train and test data, respectively. To model this shift in dynamics, which cannot be fully captured alone with trend estimates, it is necessary to learn distribution shifts through test-time model updates outlined directly.
• Figure 3: Illustration on detrend module.
• Figure 4: Kullback–Leibler Divergence (KLD) of various datasets. $D_{KL}(\mathcal{D}_{test} || \mathcal{D}_{train})$ is given, which implies how much additional information is needed to fully describe $\mathcal{D}_{test}$, given $\mathcal{D}_{train}$. The measure quantifies the distribution shift problem of the datasets.
• Figure 5: ROC curves (left) Precision-Recall curves (right) visualizations of baselines and MLP+Ours.