Modeling Normal Is All You Need: Joint Latent Clustering for Anomaly Detection in Multimodal Cyber-Physical Systems
Not on the map. Why?
Abstract (arXiv)
A cyber-physical system (CPS) can enter a faulty state that is individually normal on every sensor and reconstructs accurately, yet is improbable under normal joint operation. This exposes the central weakness of reconstruction-based detection: reconstruction measures whether a state can be reproduced (reachability), not whether normal operation is likely to occupy it (probability). We model CPS normal behavior as a union of many imbalanced operating regimes, ten assumptions we call Massive, Implicit, Imbalanced Multimodality (MIIM). Our detector, LatAD, jointly learns a latent and a Gaussian-mixture clustering of these regimes (VaDE) and scores anomalies by density rather than reconstruction. Because a CPS is an assembly of coupled subsystems, we factorize that density over correlation-community subsystems and combine per-community surprises by a cohesion-weighted, sparsity-adaptive statistic, concentrating a local fault a global density dilutes. Evaluated with raw point-wise metrics and a difficulty split isolating the stealthy faults a per-channel threshold misses, LatAD attains the best AUROC on three real CPS benchmarks (WADI 0.862, HAI 0.949, SWaT 0.993) and leads the difficult subset of all three, notably on HAI (0.849; a significant +0.09 over the next-best baseline, 95% CI [0.046, 0.160]); the reconstruction-based USAD and TranAD fall to 0.30-0.48 on these reconstructable-but-improbable faults.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 15 of its 33 references that are in the map. First posted on arXiv 7 Jul 2026.
Builds on
15 of 33 references.
References · 15
- 2019Memorizing Normality to Detect Anomaly: Memory-augmented Deep Autoencoder for Unsupervised Anomaly Detectioncited by 564
- 2020A Unifying Review of Deep and Shallow Anomaly Detectioncited by 425
- 2021Graph Neural Network-Based Anomaly Detection in Multivariate Time Seriescited by 301
- 2016Variational Deep Embedding: An Unsupervised and Generative Approach to Clusteringcited by 220
- 2022TranAD: Deep Transformer Networks for Anomaly Detection in Multivariate Time Series Datacited by 214
- 2020A review on outlier/anomaly detection in time series datacited by 189
- 2020Current Time Series Anomaly Detection Benchmarks are Flawed and are Creating the Illusion of Progresscited by 151
- 2021Towards a Rigorous Evaluation of Time-series Anomaly Detectioncited by 97
- 2024CATCH: Channel-Aware multivariate Time Series Anomaly Detection via Frequency Patchingcited by 94
- 2021An Evaluation of Anomaly Detection and Diagnosis in Multivariate Time Seriescited by 68
- 2024Position: Quo Vadis, Unsupervised Time Series Anomaly Detection?cited by 17
- 2022TiSAT: Time Series Anomaly Transformercited by 15
3 more
- 2024PATE: Proximity-Aware Time series anomaly Evaluationcited by 13
- 2025Autoencoders for Anomaly Detection are Unreliablecited by 9
- 2026Anomalies in Multivariate Time Series Benchmarks Are Mostly Univariatecited by 3
Built on by
Not cited yet.