Causally-Constrained Probabilistic Forecasting for Time-Series Anomaly Detection

The gist The study introduces a causally-constrained probabilistic forecasting framework which is a Causally Guided Transformer (CGT) model for multivariate time-series anomaly detection, integrating an explicit time-lagged causal graph prior with deep sequence modeling.

How it works

1. The CGT model employs a causally constrained probabilistic forecasting framework for anomaly detection in multivariate time series where it integrates an explicit time-lagged causal graph prior with deep sequence modeling.

2. For each target variable, a dedicated forecasting block uses a hard parent mask derived from causal discovery to restrict the main prediction pathway to graph-supported causes.

3. A shadow auxiliary path with stop-gradient isolation and a safetygated blending mechanism is incorporated to suppress non-causal contributions when reliability is low.

4. Anomalies are identified using negative log-likelihood scores with adaptive streaming thresholding, and root-cause variables are determined through perdimension probabilistic attribution and counterfactual clamping.

Problem Formulation

The problem is formulated by modeling the conditional density of each target variable as a Gaussian distribution, where anomalies are detected using the negative log-likelihood (NLL). The predictive distribution is parameterized as a Gaussian with mean and variance outputs. The history length Ht is constructed from a window of past observations across all sensors and multiple time lags up to τmax.

Windowed Input Construction

A windowed lag design matrix is constructed to align the forecasting model with the structure of the time-lagged causal graph. The input matrix Xt consists of a length-W history shifted by τmax steps for each sensor–lag pair.

Causal Graph Prior and Parent Mask

A Time-lagged causal discovery method, based on the PCMCI algorithm, is used to estimate directed, lagged dependencies of the form (j, l) → i. For each target variable i, a binary parent mask is constructed which identifies allowable parent features and is applied as a hard gate to the lagged input.

Target-Specific Forecasting Blocks

Each target variable i is assigned a dedicated forecasting block with its own parameters, including a target-specific parent mask πi derived from the causal graph and a set of learnable auxiliary gate logits. This deterministic routing ensures that all samples in a batch have the same target variable.

Causal Transformer Encoder and Latent Gaussian Head

The lagged input matrix Xt is first restricted to graph-supported parent features using the binary parent mask πi. The projected tokens are processed by a Transformer encoder to produce a causal summary h(i,t,c). A latent variable z is introduced to capture residual uncertainty, and the model defines a conditional Gaussian prior pψ(z ht,c).

Shadow Auxiliary Path and Gradient Isolation

The auxiliary path is designed to exploit additional correlations, including non-parent inputs without modifying the causal trunk through gradient flow. A learnable soft gate is defined as αi = σ(li), and the auxiliary branch uses a stopgrad(·) operator to evaluate the encoder without gradient tracking.

Training Objective and Optimization

The training objective minimizes a weighted sum of NLLs, including regularization terms. The loss function is L = (1 − γt)Lc + γtLo + βtLKL + λresLres + R(α), where R(α) includes terms like Parent-alignment prior.

Inference and Thresholding

For inference, a blended per-target score is subsequently defined as st,i(γ) = (1 − γ)s(c)t,i + γs(o)t,i. The aggregated anomaly score St is produced by an aggregation rule such as the mean. Anomaly decisions are made using SPOT (Streaming Peaks-Over-Threshold) to obtain dynamic thresholds on the test stream.

Root-Cause Variable Attribution

Attribution scores are derived from the model, including Per-dimension blended NLL attribution and Counterfactual clamping attribution. The counterfactual clamp variant consistently outperformed simpler variants, suggesting that intervention-based attribution is more effective at identifying variables that influence the anomaly score.

Experimental Results

Experiments on the ASD and SMD benchmarks indicate that the proposed method achieves state-of-the-art detection performance, with F1-scores of 96.19% on ASD and 95.32% on SMD, and it enhances variable-level attribution quality. The results show that the safety gate mechanism achieves the best results on all metrics, which indicate that the residual information is the most effective when it is applied selectively using the safety gate rather than always being blended in.

Conclusion

The study concludes that causal structure is valuable not only for post hoc explanation but also as an effective inductive bias in the anomaly detector. The framework successfully maintains causal consistency while leveraging reliable correlational structures to yield robust anomaly detection performance and competitive root-cause localization.

How it works (Ablation)

The ablation studies show that the residual branch provides useful extra information when added in setting A1, and the proposed safety gate mechanism achieves the best results on all metrics. The safety diagnostics show that the gate acts as intended by being more conservative when the residual branch appears less reliable, leading to a lower γused and a higher fallback rate.

How it works (Attribution)

The counterfactual clamp variant consistently outperformed the simpler blended NLL z-score variant, suggesting that intervention-based attribution is more effective at identifying variables that influence the anomaly score. The counterfactual clamp score drop indicates that clamping sensor s substantially reduces the anomaly score, thereby suggesting s as a root cause.

How it works (Efficiency)

Table VII reports the sensitivity of CGT to several key design choices, showing that the default configuration of W = 30, τmax = 7, and S = 4 provides an effective balance between detection accuracy and robustness. The mean aggregation rule demonstrates the greatest robustness. The method's effectiveness relies on the quality of the estimated causal graph, which may be compromised by noise, limited samples, latent confounding, or nonstationary system behavior.

Limitations and Future Work

The paper notes that the learned graph should be regarded as a structural prior rather than an exact representation of ground truth. Future research will explore "joint learning of causal structure and anomaly detection, adaptive updating of the causal graph under distribution shifts to enhance structural uncertainty modeling, and more accurate intervention-based root-cause analysis in partially observed systems".

1. Bold header: Causal structural prior integration in forecasting blocks

This improvement involves using a hard parent mask derived from causal discovery to restrict the main prediction pathway to graph-supported causes. This ensures that only the graph-supported parent features can contribute to the causal computation path, leading to more interpretable and causally consistent learning.

2. Bold header: Safety-gated auxiliary path for residual correlation

The system incorporates a shadow auxiliary path with stop-gradient isolation and a safetygated blending mechanism to suppress non-causal contributions when reliability is low. This allows the model to capture useful residual dependencies beyond the causal graph without compromising the primary causal representation.

3. Bold header: Unified probabilistic framework for detection and diagnosis

The framework formulates anomaly detection and root-cause analysis within a unified probabilistic structure, using Gaussian predictive likelihoods for detection and both standardized likelihood attribution and counterfactual clamping for diagnosis. This allows researchers to determine root-cause variables through perdimension probabilistic attribution and counterfactual clamping.

4. Bold header: Adaptive streaming thresholding via SPOT

Anomaly detection is performed by applying adaptive streaming thresholding using the SPOT (Streaming Peaks-OverThreshold) procedure, which uses an EVT-based streaming thresholding procedure [27] to produce a time-varying threshold sequence. This enables robust detection in non-stationary streams.

5. Bold header: Intervention-inspired root cause attribution

Root causes are determined using counterfactual clamping attribution, where the score is recomputed when inputs are replaced by nominal reference values, indicating that A large negative ∆s(t) indicates that clamping sensor s substantially reduces the anomaly score, thereby suggesting s as a root cause.

Anomaly detection in multivariate time series is a central challenge in industrial monitoring, as failures frequently arise from complex temporal dynamics and cross-sensor interactions. While recent deep learning models, including graph neural networks and Transformers, have demonstrated strong empirical performance, most approaches remain primarily correlational and offer limited support for causal interpretation and root-cause localization. This study introduces a causally-constrained probabilistic forecasting framework which is a Causally Guided Transformer (CGT) model for multivariate time-series anomaly detection, integrating an explicit time-lagged causal graph prior with deep sequence modeling. For each target variable, a dedicated forecasting block employs a hard parent mask derived from causal discovery to restrict the main prediction pathway to graph-supported causes, while a latent Gaussian head captures predictive uncertainty. To leverage residual correlational information without compromising the causal representation, a shadow auxiliary path with stop-gradient isolation and a safety-gated blending mechanism is incorporated to suppress non-causal contributions when reliability is low. Anomalies are identified using negative log-likelihood scores with adaptive streaming thresholding, and root-cause variables are determined through per-dimension probabilistic attribution and counterfactual clamping. Experiments on the ASD and SMD benchmarks indicate that the proposed method achieves state-of-the-art detection performance, with F1-scores of 96.19% on ASD and 95.32% on SMD, and enhances variable-level attribution quality. These findings suggest that causal structural priors can improve both robustness and interpretability in detecting deep anomalies in multivariate sensor systems.