Self-Perturbed Anomaly-Aware Graph Dynamics for Multivariate Time-Series Anomaly Detection

We thank the reviewer for the constructive comments. Please find our responses to your concerns below.

To W1: Thank you for pointing out this issue. We clarify that the self-perturbation module is trained with randomly initialized weights, and we explicitly avoided pre-training because the evolution of the reconstruction model is crucial to our proposed learning paradigm. Specifically:

1. In the early training stage, the randomly initialized reconstruction network is a poor approximator of the normal data. Consequently, the generated samples with significant deviations can serve as easy negative samples for the training of the classifier.
2. As training progresses, the self-perturbation module improves by minimizing the self-perturbation loss ($\mathcal{L}_{sp}$), and the classifier is progressively challenged with hard negative samples that deviate more subtly from the normal data manifold.

We will include these descriptions in our revised paper to improve the clarity and reproducibility of our method.

To W2: To evaluate the statistical significance of the improvements, we performed a Student's t-test analysis (AUC and AUPRC) on SWaT with 5 independent runs. Our SPAGD achieved 85.48%$\pm$1.15% AUC and 75.67%$\pm$1.64% AUPRC, and below are several baseline performance and corresponding results ($p$-value) of the t-Student's t-test:

\begin{matrix} \hline \text{Metric}&\text{AUC}&\text{p-value}&\text{AUPRC}&\text{p-value}\\\\ \hline \text{Deep-SVDD} &82.48\pm0.36&0.0005&72.76\pm0.94&0.0089\\\\ \text{TcnED} &82.18\pm0.90&0.0010&72.33\pm1.14&0.0057\\\\ \text{TranAD} &81.77\pm0.46&0.0002&71.86\pm0.58&0.0012\\\\ \text{Deep lF} &80.63\pm0.12&0.0000&70.24\pm0.78&0.0002\\\\ \text{COUTA} &81.43\pm0.97&0.0003&72.39\pm1.41&0.0095\\\\ \hline \end{matrix}

Generally, the difference is said to be significant if the $p$-value is less than 0.05. As shown in the table, the $p$-values are consistently below the 0.05 threshold, which demonstrates that the performance improvements achieved by SPAGD are statistically significant. We will add this experiment to our paper.

To W3: Our choice of $k$-NN for graph construction was motivated by its widespread use and proven effectiveness in the GNN-based TSAD works, such as GDN [1]. It is a simple and non-parametric approach that robustly captures local data structure while naturally enforcing graph sparsity, which is computationally beneficial.

[1] Ailin Deng and Bryan Hooi. Graph neural network-based anomaly detection in multivariate time series. AAAI, 2021.

To empirically validate this choice, we conducted an additional experiment on SWaT comparing $k$-NN with two other alternatives: (1) a fully-connected strategy using all pairwise similarities as edge weights) and an $\epsilon$-neighborhood strategy connecting nodes with similarity above a threshold $\epsilon$). Below are the performance comparisons between fully-connected, $\epsilon$-neighborhood and $k$-NN, where we set $\epsilon=0.5$:

\begin{matrix} \hline \text{Metric}&\text{AUC}&\text{AUPRC}&\text{F1}\\\\ \hline \text{Full-connected} &82.13&71.79&74.45 \\\\ \text{\epsilon-neighborhood} &81.41&72.53&74.35 \\\\ \text{k-NN} &\bf86.30&\bf77.20&\bf78.77\\\\ \hline \end{matrix}

The results demonstrate that $k$-NN achieves the best performance, because the fully-connected graph likely introduces noise from weak, irrelevant correlations, while the performance of $\epsilon$-neighborhood is highly sensitive to the choice of the threshold $\epsilon$. Overall, the $k$-NN approach provides a more stable and effective balance. We will include this analysis in our paper.

To W4: To address this concern, we analyze the time complexity of SPAGD, which contains three main components:

1. Self-Perturbation module: This module employs a Transformer-based model, where the computational bottleneck is the self-attention mechanism, which has a complexity of $\mathcal{O}(T^2 d)$ for an input sequence of length $T$ and dimension $d$. As the number of layers is a fixed hyperparameter, the complexity for this module is $\mathcal{O}(T^2 d)$.
2. AAGC module: The complexity of this module is dominated by the initial graph construction, which involves computing pairwise cosine similarity between all $d$ variables over $T$ timesteps. This results in a time complexity of $\mathcal{O}(d^2 T)$. The subsequent dynamic adjustment steps involve calculating node-wise reconstruction residuals ($\mathcal{O}(dT)$) and adjusting the structure of the sparse graph ($\mathcal{O}(d^{2})$), which are less complex.
3. Predictor module: This module consists of spatial convolution and temporal convolution. The spatial convolution operates on a sparse graph with $|E|=dK$ edges (due to top-$k$ neighbor selection). In our model, the spatial convolution is applied across the temporal dimension $T$ and $L$ layers of GNN with $d_{\text{lat}}$ latent dimensions, resulting in complexity of $\mathcal{O}(LT \cdot dk \cdot d_{\text{lat}})$. Since $L$, $k$, and $d_{\text{lat}}$ are fixed, this simplifies to $\mathcal{O}(Td)$. The temporal convolution complexity is also linear in sequence length and channels, which is approximate $\mathcal{O}(Td)$.

Thus, the overall time complexity of SPAGD for processing a single time-series window is approximately $\mathcal{O}(T^2 d + d^2 T)$, as $T$ and $d$ are dominating factors in the model. For practical deployment, the complexity of SPAGD is comparable to other transformer-based and GNN-based TSAD methods, such as TranAD, AnomalyTrans, and TimesNet. Moreover, we also analyzed the model parameter size of SPAGD (refer to the response of the reviewer cXmT's W4), which showed that SPAGD is also highly competitive in terms of model parameter sizes and is feasible for application in a wide range of real-world scenarios.

To W5: We are grateful that the reviewer encourages discussions on the broader social impacts of our work. We will add a "Broader Impact Statement" to the paper discussing the following points:

1. Positive social impacts: Our work has significant potential to enhance the safety and reliability of critical cyber-physical systems. For example, early anomaly detection can prevent catastrophic equipment failures, ensuring worker safety and preventing environmental damage. In aerospace applications, it can improve mission success and safety by flagging potential faults in spacecraft telemetry.
2. Potential negative risks: (1) Over-reliance on the system could lead operators to dismiss their own expertise. Mitigation: We advocate for deploying SPAGD as a decision-support tool that provides interpretable outputs (e.g., highlighting anomalous sensors and their correlations) rather than as a fully autonomous system. (2) A sophisticated adversary could potentially craft inputs to either evade detection or trigger false alarms. Mitigation: This is a critical area for future work, where we need to focus on improving the adversarial robustness of the model.

We thank the reviewer for the constructive comments. Please find our responses to your concerns below.

To W1: Below are our clarifications to address your concern:

• TSAD is inherently an imbalanced task, and TSAD datasets are mostly highly imbalanced due to the natural scarcity of anomalies in real-world scenarios. Our method attempts to mitigate this problem by progressively generating easy-to-hard auxiliary signals (can be viewed as a curriculum learning [1]) to learn a more robust decision boundary. The effectiveness of our solution was verified through Table 2 in the main text and our response to W4.

Yoshua Bengio, et al. Curriculum Learning, ICML, 2009.

• We agree that an ideal model that perfectly learns normal patterns without overgeneralizing would be sufficient. However, the "anomaly reconstruction" problem identified in our paper prevents the model from reaching this ideal state, where the learning capacity of reconstruction-based models is powerful enough to accurately reconstruct simple anomalies, leading to low reconstruction errors (refer to Figure 3). Our work is motivated by mitigating this specific failure mode.
• The goal of our SP module is not to explicitly generate unseen anomalies. Instead, it aims to refine the decision boundary with the self-perturbed samples, which act as hard negatives that lie close to the manifold of normal data. By training a classifier to distinguish normal samples from these subtle, model-induced deviations, we forced it to learn a tighter decision boundary around the normal data distribution.

To W2: We would like to highlight that our framework is not adversarial. In GAN, the generator and discriminator have competing objectives, while in SPAGD, the components are cooperative. The reconstruction network is not trained to fool the classifier. Instead, as the reconstruction improves, it naturally generates more subtle perturbations, which create a form of curriculum learning that progressively refines the decision boundary.

• We acknowledge that the AAGC module requires additional computational cost. However, we consider it a crucial component, as a static graph built on normal data hardly captures the dynamic changes of inter-variable correlations caused by anomalies. Our ablation study (Table 3) provides direct evidence of its effectiveness, where the "w/o AAGC" variant shows a significant performance drop. Furthermore, we analyze the computational cost of each module in SPAGD (refer to response to Q2), and show that the computational cost of SPAGD is still taken up by the transformer-based SP module. Therefore, we consider the slight increase in computational cost to be tolerable given the significant performance improvement (Table 2).

To W3: We agree that connecting theory to practice is important. Below we discuss the practical significance of our theorems.

• Theorem 1: This theorem provides a formal justification for why our self-perturbation strategy is effective. It demonstrates that as the reconstruction model improves during training, the distribution discrepancy between the generated self-perturbed samples and true anomalies decreases. In practice, this means that our training curriculum is not arbitrary but progressively generates more meaningful and challenging samples for the classifier to learn from. This ensures that the auxiliary signals are relevant to our task.
• Theorem 2: This theorem addresses the potential concern that our dynamic graph adjustments could lead to unstable behavior. It provides a formal guarantee that the representations learned by the GNN model remain stable and change reasonably in response to the perturbations introduced by the AAGC module. In practice, this means our model is reliable as the dynamic mechanism will not cause exploding gradients or unstable outputs, which is a critical guarantee for any dynamic system.

In summary, Theorem 1 validates the relevance of our generative auxiliary data, and Theorem 2 validates the reliability of our dynamic architecture.

To W4: We conducted an additional experiment to supplement more datasets and also analyzed the model complexity. We specifically supplemented with the SMD dataset and made a comparison to SPAGD, together with several other baseline methods:

$\begin{matrix} \hline \text{SMD}&\text{AUC}&\text{AUPRC}&\text{F1}\\\\ \hline \text{Deep-SVDD}&57.10&9.43&14.54\\\\ \text{USAD}&69.44&25.52&28.19\\\\ \text{TcnED}&61.43&11.22&18.38\\\\ \text{TranAD}&71.43&22.19&24.42\\\\ \text{AnomalyTrans}&69.56&12.72&22.7\\\\ \text{TimesNet}&70.41&14.48&19.61\\\\ \text{DCdetector}&49.98&4.15&07.98\\\\ \text{COUTA}&65.98&11.71&18.03\\\\ \hline \text{SPAGD}&\bf76.92 &\bf38.48 &\bf36.72&\\\\ \hline \end{matrix}$

The experimental results show that SPAGD significantly outperforms the latest baselines, which further justifies its effectiveness.

Regarding the model complexity analysis, we analyzed the parameter size of SPAGD and several baseline methods on SWaT:

\begin{matrix} \hline &\text{Network Parameter Size (\times 10^{6})}\\\\ \hline \text{USAD}&84.40\\\\ \text{AnomalyTrans}&4.85\\\\ \text{TimesNet}&4.70\\\\ \text{DCdetector}&0.90\\\\ \hline \text{SPAGD}&2.51\\\\ \hline \end{matrix}

We observed that the network parameter size of SPAGD is comparable to other state-of-the-art baselines, especially transformer-based ones. These results demonstrate that the performance improvements are not due to a larger model size but are tied to our architectural innovations. We hope our responses are helpful in addressing your concerns.

To Q2: The AUC and AUPRC metrics are threshold-independent. For the F1-score, we follow the standard method of selecting the optimal threshold on the test set. Localization is achieved by comparing the anomaly scores output by the model for each time window to the selected threshold.

To Q3: We would like to answer your question from two perspectives:

• In our ablation study (Table 3), the variants "w/o AAGC (Spatial)" and "w/o AAGC (Temporal)" share the same static graph $A$ for the normal and the self-perturbed time series in spatial convolution and temporal convolution, respectively. For these two variants, a clear performance degradation was observed across all datasets. Here, we further added another variant "w/o AAGC", which shares the same static graph during both spatial and temporal convolution. Below are the experimental results:

$\begin{matrix} \hline &\text{AUC}&\text{AUPRC}&\text{F1}\\\\ \hline \text{w/o AAGC}&80.54&70.59&74.28\\\\ \text{w/o AAGC (Spatial)} &81.51&70.07&74.20\\\\ \text{w/o AAGC (Temporal)} &83.16&72.18 &75.11\\\\ \hline \text{SPAGD} & \bf86.30&\bf77.20&\bf78.77\\\\ \hline \end{matrix}$

The performance of the "w/o AAGC" variant further decreases compared to the other two variants and SPAGD. This empirically justifies the effectiveness of using the dynamical anomaly-aware graph for the perturbed sequence, as the static graph learned from normal data is not equipped to model the altered correlations. We will add this additional ablation study in our paper.

• Regarding efficiency concerns, we supplement an experiment to compare the computation time cost of (1) the transformer-based SP module, (2) the AAGC module (including the initial graph construction and dynamic graph adjustment), and (3) the predictor (classifier) module over 10 epochs on SWaT:

$\begin{matrix} \hline &\text{SP module}&\text{Initial graph construction}&\text{Dynamic graph adjustment}&\text{Predictor}\\\\ \hline \text{Time cost in second(s)}&2.03&0.85&0.22&0.01\\\\ \hline \end{matrix}$

The time cost of dynamic graph adjustment is actually small compared to the SP module, as we impose sparsity during the graph construction, and the initial graph construction is performed only once during model training. In view of the positive performance improvement (Table 2), we consider that the slight increase in time cost is tolerable.

To Q4: This is a very insightful question about the current state of research. Our view is that the utility of explicitly modeling inter-variable dependencies is highly task-dependent.

• The goal of forecasting is to predict the continuation of normal behavior. In scenarios where channels are not strongly correlated or where learning these correlations introduces more noise than signal, channel-independent models can excel.
• However, the goal of TSAD is to identify deviations from normal behavior, which often manifest as disruptions in the relationships between variables. For example, a sensor failing might not produce an anomalous value in isolation, but its readings will no longer correlate with its neighbors. A channel-independent model would be difficult to detect such correlation-based anomalies. For the TSAD task, like SWaT in physical systems, inter-variable dependencies are not noise but an important source of information for detecting system faults. Therefore, while channel-independence is a powerful paradigm for certain forecasting tasks, we believe that explicitly modeling spatial relationships is also essential for advancing multivariate time-series anomaly detection. The success of numerous graph-based TSAD methods (such as GDN) has provided evidence for this position.

We thank the reviewer for the constructive comments. Please find our responses to your concerns below.

To W1: We would like to address this concern by clarifying the role of our self-perturbation module and providing empirical evidence against this potential risk:

• The objective of the self-perturbation module is not to generate samples that perfectly mimic the real anomalies. Instead, it aims to leverage a set of generated auxiliary signals to refine the decision boundary. By distinguishing normal data from these model-induced hard negatives (self-perturbed samples), the model is trained to become more sensitive to the deviation from the learned normal data distribution, thereby enhancing the ability to generalize to unseen anomalies.

• The perturbations are indeed related to the model's inductive bias. However, these generated samples are not static. They evolve dynamically throughout the end-to-end training process, creating a natural and diverse curriculum for training. This process exposes the classifier to a wide spectrum of deviations that range from large perturbations to subtle perturbations, which prevents the model from overfitting to a single type of perturbation.

• The most compelling evidence against this risk is that SPAGD consistently outperformed state-of-the-art baselines across multiple benchmark datasets (Table 2 in the main text). If SPAGD were only learning to detect its own internal artifacts, it would fail to generalize effectively across these distinct real-world anomalies. The superior performance of SPAGD strongly suggests that the learned decision boundary is indeed robust and generalizable. Furthermore, our results on segment-based VUS metrics (see the response to W3) further validate this robust generalization.

To W2: We would like to address your concern from two perspectives:

• The intuition behind the additive rule is to treat the graph affinity as a combination of static correlation and dynamic anomaly-awareness. $S_{ij}$ represents the baseline correlation between variables $i$ and $j$ under normal conditions. $\sigma(r_i)$ is a score derived from the reconstruction residual of variable $i$. When a variable is highly perturbed (high $r_i$), we strengthen the connection of all its edges. This effectively highlights the subgraph surrounding a potential anomaly, which enforces the message-passing mechanism to focus on these regions.

• We did consider alternatives, such as the multiplicative scaling suggested by the reviewer (e.g., $\tilde{A}\_{ij} = S_{ij} \cdot (1 + \sigma(r\_i))$). However, we found the additive rule to be more effective, as the additive rule generally outperforms the multiplicative rule by $\geq$2% across all metrics (on SWaT) in our attempts. This is because the effect of the multiplicative rule is conditional on the initial similarity $S_{ij}$. If $S_{ij}$ is near zero, the multiplicative strategy has a very limited effect. This is a significant limitation, as an anomaly could cause a new, strong correlation to emerge between two previously uncorrelated variables. The additive rule can capture this phenomenon by creating emphasis even on connections that were initially weak, making it more flexible for modeling diverse anomalous behaviors.

To W3: We conducted additional experiments to evaluate the performance of SPAGD in terms of VUS-ROC and VUS-PR metrics. Below are the experimental results on SWaT, where we compared the performance with several state-of-the-art baseline methods:

$\begin{matrix} \hline \text{Metric}&\text{VUS-ROC}&\text{VUS-PR}\\\\ \hline \text{USAD}&53.78&32.86\\\\ \text{TcnED}&62.99&44.30\\\\ \text{AnomalyTrans}&57.54&36.02\\\\ \text{Deep IF}&56.48&37.56\\\\ \text{TimesNet}&44.49&21.74\\\\ \text{DCdetector}&52.31&15.01\\\\ \text{COUTA}&77.10&51.86\\\\ \hline \text{SPAGD}&\bf84.93&\bf62.08\\\\ \hline \end{matrix}$

We can observe that SPAGD outperforms the latest baselines on these two metrics, which fully supports the effectiveness of our method. We will include this experiment in our paper.

We thank the reviewer for the constructive comments. Please find our responses to your concerns below.

To W1: We would like to address your concern via the following two perspectives:

1. With regards to motivation:

• Sequential models like LSTMs process data recursively over time, which can be computationally intensive and slow for long time-series windows. Temporal convolution, on the other hand, can process sequences in parallel, leading to better training efficiency.
• The chunk-wise design allows the model to learn fine-grained temporal patterns within each local chunk. The subsequent concatenation and predictor network then learn higher-level relationships between these chunks. This hierarchical approach is effective for capturing both local dynamics and the overall structure of the time window, which has shown success in recent TSAD models such as TimesNet [1].

Haixu Wu, et al. Timesnet: Temporal 2D-variation modeling for general time series analysis. ICLR, 2023.

2. Regarding the dependencies across chunk boundaries, we agree that this is an important aspect. Our framework mitigates this potential issue in two ways:

• The spatial graph convolution is applied to the representation of the entire time series before the chunking operation (Eq. 7). This ensures that information is propagated across all time steps via the learned graph, thus preserving a holistic view of the window.
• The final predictor module takes the concatenated representations from all chunks as input (Eqs. 9 and 10). This allows the predictor to explicitly model the relationships and dependencies between the learned chunk features, thereby capturing patterns that span across chunk boundaries.

To W2: VUS-ROC and VUS-PR are indeed robust metrics to evaluate TSAD methods. To address your concern, we conducted additional experiments on SWaT to evaluate SPAGD and several key baselines using these two metrics. Below are the experimental results:

$\begin{matrix} \hline \text{Metric}&\text{VUS-ROC}&\text{VUS-PR}\\\\ \hline \text{USAD}&53.78&32.86\\\\ \text{TcnED}&62.99&44.30\\\\ \text{AnomalyTrans}&57.54&36.02\\\\ \text{Deep IF}&56.48&37.56\\\\ \text{TimesNet}&44.49&21.74\\\\ \text{DCdetector}&52.31&15.01\\\\ \text{COUTA}&77.10&51.86\\\\ \hline \text{SPAGD}&\bf84.93&\bf62.08\\\\ \hline \end{matrix}$

As shown in the table, SPAGD demonstrates superior performance across all datasets under these two challenging metrics. This once again strengthens our claim about the effectiveness of SPAGD. We will include these results (with more datasets) and a detailed discussion in our paper.

To W3: We performed a sensitivity analysis of $m$ on the SWaT dataset. Below are the anomaly detection performance under different $m$ in the range of $[10\\%,60\\%]$:

\begin{matrix} \hline m&\text{10\\%}&\text{20\\%}&\text{30\\%}&\text{40\\%}&\text{50\\%}&\text{60\\%}&\\\\ \hline \text{AUC}&80.74&83.22&\bf86.30&83.30&83.32&81.58\\\\ \text{AUPRC}&71.00&72.45&\bf77.20&71.82&73.13&71.39\\\\ \text{F1}&74.07&74.37&\bf78.77&75.76&74.76&75.48\\\\ \hline \end{matrix}

The results showed that the performance of SPAGD is robust within a reasonable range of $m$ (e.g., 20% to 50%). We can observe that the performance degrades when $m$ is too small (e.g., 10%), as the AAGC module lacks a strong enough signal to dynamically adjust the graph structure. Conversely, if $m$ is too large (e.g., 60%), the performance also slightly decreases as an excessive number of normal variables are incorrectly flagged as anomalous candidates, which introduces noise into the graph structure. We will include related experiments and analysis in the paper.

To W4: As per your suggestion, we designed a new variant, i.e., SP w/ Recon: This variant retains the self-perturbation module, and uses a traditional reconstruction model to reconstruct both the input and generate auxiliary time series. In the testing stage, the anomaly score is defined by the reconstruction error of a test sample. The experimental results are shown as follows:

$\begin{matrix} \hline \text{Metric}&\text{AUC}&\text{AUPRC}&\text{F1}\\\\ \hline \text{SP w/ Recon}&76.82&61.95&62.11\\\\ \text{SPAGD} & \bf86.30 & \bf77.20 & \bf78.77\\\\ \hline \end{matrix}$

We can observe that the performance of the "SP w/ Recon" variant significantly decreases, which indicates that a purely reconstruction‑based objective encourages the model to fit the self‑perturbed patterns rather than distinguish them. Consequently, true anomalies receive lower reconstruction errors and are more difficult to detect in the testing stage, which is a classic example of the "anomaly reconstruction" problem. This experiment validates the contribution of our discriminative (classification) objective in mitigating the "anomaly reconstruction" problem. We will include these results in the paper.

To Paper Formatting Concerns: Thank you for this suggestion. We agree that presenting the key theoretical insights in the main text would make the paper more self-contained, and we will revise the paper accordingly.