CANDI: Curated Test-Time Adaptation for Multivariate Time-Series Anomaly Detection Under Distribution Shift

TL;DR

CANDI is a novel test-time adaptation framework for multivariate time-series anomaly detection that selectively updates models to handle distribution shifts, significantly improving AUROC with fewer samples.

Contribution

It introduces a False Positive Mining strategy and a Spatiotemporally-Aware Normality Adaptation module for effective, selective model updates under distribution shifts.

Findings

CANDI improves AUROC by up to 14% under distribution shift.

CANDI requires fewer adaptation samples than existing methods.

Extensive experiments validate CANDI's effectiveness in real-world scenarios.

Abstract

Multivariate time-series anomaly detection (MTSAD) aims to identify deviations from normality in multivariate time-series and is critical in real-world applications. However, in real-world deployments, distribution shifts are ubiquitous and cause severe performance degradation in pre-trained anomaly detector. Test-time adaptation (TTA) updates a pre-trained model on-the-fly using only unlabeled test data, making it promising for addressing this challenge. In this study, we propose CANDI (Curated test-time adaptation for multivariate time-series ANomaly detection under DIstribution shift), a novel TTA framework that selectively identifies and adapts to potential false positives while preserving pre-trained knowledge. CANDI introduces a False Positive Mining (FPM) strategy to curate adaptation samples based on anomaly scores and latent similarity, and incorporates a plug-and-play Spatiotemporally-Aware Normality Adaptation (SANA) module for structurally informed model updates. Extensive experiments demonstrate that CANDI significantly improves the performance of MTSAD under distribution shift, improving AUROC up to 14% while using fewer adaptation samples.