JAPE: Joint Anomaly Prediction and Intrinsic Explanation in Multivariate Time Series

JAPE: Joint Anomaly Prediction and Intrinsic Explanation in Multivariate Time Series

Abstract

Multivariate time-series anomaly prediction aims to identify whether and when anomalies will occur over a future horizon from historical observations. Existing methods primarily characterize anomalies as deviations in future numerical values, which may overlook subtle dependency changes induced by weak anomaly precursors and provide no native variable-level explanation together with the alert. To bridge these gaps, we propose JAPE, a Joint Anomaly Prediction and Explanation framework that lifts anomaly prediction from numerical-deviation modeling to dependency-structure modeling. JAPE is the first anomaly prediction framework to explicitly model evolving dependency structures for both point-wise alerting and native variable-level explanation. Specifically, JAPE (i) proposes a Decoupled Spatio-Temporal Representation (DSTR) backbone that decouples temporal and spatial modeling and captures lag-aware dependencies via learnable lag aggregation, thereby perceiving structural precursors before numerical deviations emerge; (ii) designs a dual-view alerting mechanism that fuses numerical forecasts with evolving dependency graphs for point-wise anomaly prediction, capturing structural evidence even under subtle numerical deviations; and (iii) presents Native Predictive Explanation (NPE), which directly reuses the predicted dependency graphs to rank variables by structural deviations without additional models or training. Extensive experiments on five real-world benchmarks across three prediction horizons demonstrate that JAPE improves average F1 and AUC-PR by 19.7% and 41.3%, respectively, while improving explainability with 26.6% gain in MRR.

Introduction

In modern cloud-native architectures and large-scale distributed systems, continuous monitoring of multivariate time series (MTS) is essential for maintaining system reliability and service availability. Traditional anomaly detection methods identify abnormal behaviors only after faults have already occurred, providing reactive alerts that are often too late to prevent service degradation or operational losses. As system downtime becomes increasingly costly, there is a growing demand for proactive monitoring capabilities. This has led to a shift from post-hoc anomaly detection toward anomaly prediction, which aims to anticipate future anomalies before their occurrence by leveraging historical observations and temporal patterns.

Existing approaches can be broadly divided into two paradigms. The first paradigm adopts an unsupervised formulation that combines a forecasting model with reconstruction-based anomaly detection to anticipate future anomalies. For example, TranAP first learns forecasting and reconstruction models from entirely normal data; it then forecasts future series from historical observations, reconstructs the predicted series with the learned model, and flags time steps whose reconstruction error exceeds a predefined threshold as potential future anomalies. Going a step further along this line, FCM leverages the forecasted future context to amplify weak anomaly precursors within the observation window. While effective for pronounced numerical deviations, such methods are fundamentally optimized to model normal dynamics, so weak anomaly precursors are often overwhelmed by dominant normal patterns and remain unnoticed until the numerical deviation becomes pronounced. The second paradigm adopts a self-supervised formulation that injects synthetic pseudo-anomalies into normal data to construct auxiliary prediction objectives. For example, A2P injects multi-form pseudo-anomalies through a learnable prompt pool, enabling the model to learn anomaly-related patterns during training. Recent work has also explored supervised anomaly prediction using a limited number of real anomaly labels. F2A, for example, adapts a pretrained model with a joint forecast–anomaly loss and fuses retrieved relevant horizons through retrieval augmentation to improve cross-system generalization. Yet whether the training signal comes from clean normal data, injected pseudo-anomalies, or a pretrained model, these methods are highly consistent in their modeling perspective: they all characterize anomalies essentially as deviations on the future numerical series, and raise alerts accordingly.

Existing value-centric approaches overlook the structural evidence carried by inter-variable relationships. In distributed systems, anomalies may manifest not only as changes in monitored signal values but also as structural changes in variable dependencies. Figure 1 illustrates this phenomenon using an anomalous interval from the SMD dataset. Figure 1a shows the temporal behaviors of an anomalous variable, v4, and several related variables around the anomaly interval. As shown in Figure 1b, the observed change is not merely a fluctuation in correlation strength but a clear structural reorganization: variables that are predominantly positively correlated with v4 under normal conditions become mostly negatively correlated during the anomaly, resulting in a substantial shift in the overall dependency pattern. This observation suggests that inter-variable relationships provide meaningful structural evidence for anomaly-related system changes. Therefore, explicitly modeling evolving dependency structures is essential for both anomaly prediction and variable-level explanation. Consequently, existing value-centric approaches suffer from the following three fundamental limitations: L1: Delayed detection. Under numerical forecasting objectives, weak dependency changes are often absorbed as normal fluctuations and overwhelmed by dominant normal patterns, causing anomaly precursors to remain under-emphasized and alerts to lag behind the progression of faults. L2: Limited anomaly discriminability. During anomaly propagation, anomaly-source variable and other variables often exhibit similar numerical deviations. This challenge is exacerbated when source changes are subtle, making it difficult for value-centric methods to distinguish anomaly sources from propagated responses and reducing prediction accuracy. L3: Lack of intrinsic explainability. Without explicitly modeling dependency-structure evolution, existing methods detect anomalies but cannot directly identify the variables involved, requiring separate post-hoc analysis for interpretation.

To address these three limitations, we propose JAPE, a Joint Anomaly Prediction and Explanation framework that lifts anomaly prediction from numerical-deviation modeling to dependency-structure modeling, trained under a practical setting where a small number of anomaly labels are available.

Decoupled Spatio-Temporal Representation (DSTR)

To address L1, we propose the DSTR backbone that explicitly separates temporal evolution from inter-variable dependency modeling. Instead of jointly learning temporal dynamics and structural dependencies in a single coupled operation, DSTR models them along two dedicated axes: a temporal axis for modeling the evolution of individual variables and a spatial axis for modeling inter-variable dependencies. Along the spatial axis, JAPE employs a lag-aware directional contrast function together with a learnable lag aggregation mechanism to capture evolving lead–lag dependency patterns. By modeling dependency evolution independently of temporal dynamics, DSTR preserves weak structural precursors before they manifest as observable numerical deviations.

Dual-View Alerting Mechanism

To address L2, JAPE complements the numerical view provided by the predicted series X̂ with the structural view provided by the evolving dependency graph A. The numerical view captures the observable responses of individual variables, whereas the structural view explicitly characterizes source-related changes in their pairwise relative influence. The two views are adaptively fused through cross-attention, enabling JAPE to exploit source-aware structural evidence even when the source variable exhibits only a subtle numerical deviation, thereby improving anomaly discrimination.

Native Predictive Explanation (NPE)

To mitigate L3, we reuse the dependency graph generated during prediction to provide native explanations for anomaly alerts. When an anomaly is detected, JAPE ranks variables according to their structural deviations from the normal dependency pattern, thereby identifying those most associated with the predicted anomaly. Because the dependency graph is already constructed during inference, NPE requires neither additional training nor another model forward pass, eliminating the need for a separate post-hoc diagnostic pipeline.

To the best of our knowledge, JAPE is the first anomaly prediction framework that explicitly models evolving dependency structures to jointly achieve early point-wise alerting and native predictive explanation. The contributions are summarized as follows:

• We develop the Decoupled Spatio-Temporal Representation (DSTR) backbone, which disentangles temporal evolution from dependency modeling to preserve weak structural precursors via dynamic directed dependency graphs.

• We propose a Dual-View Alerting Mechanism that fuses numerical forecasts with dynamic dependency structures, enabling JAPE to exploit source-aware structural evidence when numerical responses remain subtle and thereby improving point-wise anomaly discrimination.

• We propose Native Predictive Explanation (NPE), which reuses the graph already produced during prediction and ranks variables via a Graph Deviation Score (GDS) against a normal baseline, yielding explanation at zero additional cost.

• We conduct extensive experiments on five datasets across three forecasting horizons to demonstrate the effectiveness of our proposed framework. Compared with strong baselines, JAPE achieves 19.7% and 41.3% average gains in F1 and AUC-PR under strict point-wise evaluation, alongside a 26.6% MRR improvement for variable-level explanation.

Preliminaries

A multivariate time series with V variables is represented as a sequence of observations over consecutive timestamps. Given a historical window of length L, the time-series segment is defined as X = [xt−L+1,..., xt] ∈ RL×V, where xt ∈ RV denotes the observation vector at timestamp t, and each dimension corresponds to one variable.

Given a historical observation window X of a multivariate time series and a prediction horizon H, anomaly prediction aims to estimate the future anomaly states over the horizon. The corresponding anomaly labels are defined as Y = [yt+1,..., yt+H] ∈ 0, 1 H, where yt+h = 1 indicates that an anomaly occurs at timestamp t + h. The objective is to learn a mapping f: X → P, where P ∈ [0, 1]H denotes the predicted probabilities of the corresponding anomaly labels in Y. In addition to future anomaly prediction, we further consider variable-level explanation of the predicted anomalies. Given an anomalous prediction, the goal is to identify variables that are most relevant to the anomaly occurrence. The explanation result is represented as a ranking over the V variables.

Method

The proposed JAPE framework consists of three key components: 1) Decoupled Spatio-Temporal Representation (DSTR): It jointly models temporal dynamics and evolving inter-variable dependencies to produce both future numerical forecasts and dynamic directed dependency graphs; 2) Dual-View Alerting Mechanism: It integrates the numerical forecasting view and the structural dependency view to estimate point-wise anomaly probabilities; and 3) Native Predictive Explanation (NPE): Once an anomaly is detected, this component reuses the dependency graphs generated during forecasting and computes Graph Deviation Scores (GDS) to identify the variables most associated with the predicted anomaly.

Anomalies in multivariate time series are often preceded by subtle changes in inter-variable dependencies rather than apparent numerical deviations. A natural solution is to jointly model temporal evolution and cross-variable interactions with spatio-temporal attention. However, relations derived from current-token similarities mainly capture synchronous associations and fail to characterize lagged directional effects. Furthermore, jointly encoding temporal and variable interactions allows dominant temporal patterns to mask weak structural changes, which are easily overlooked under MSE optimization before numerical anomalies arise. To address this issue, DSTR decouples spatio-temporal modeling into two separate axes. After patch embedding, the spatial axis explicitly learns dynamic directed dependencies among variables through lag-aware asymmetric graph construction, while the temporal axis models the evolution of each variable independently. These two axes are applied alternately within each encoder layer. Furthermore, a future-oriented branch extends spatial dependency modeling into the prediction horizon, enabling DSTR to preserve evolving dependency structures for future anomaly prediction.

Patch Embedding

Given an input window X ∈ RL×V, where L is the historical length and V is the number of variables, each univariate series X:,v ∈ RL is divided into overlapping patches. Let Lp denote the patch length and Sp the stride. The patching process produces a patch sequence Xpv ∈ RP×Lp for variable v, where P = (L − Lp)/Sp + 1 is the number of patches. Each patch is mapped to a D-dimensional token through a shared linear projection followed by positional encoding. Thus, each variable is represented by P patch tokens of dimension D, forming Z(0) ∈ RV×P×D, which is passed through N dual-axis encoder layers.

Spatial Axis: Lag-Aware Directed Graph Learning

The spatial axis aims to characterize directed influences among variables and to preserve them explicitly as a graph, independently of numerical magnitude. At patch position i in encoder layer l, let Zi(l−1) = Z:,i,:(l−1) ∈ RV×D denote the input tokens of all variables. Three learnable linear projections produce Qi(l), Ki(l), and Ui(l) ∈ RV×D, which are used to measure pairwise influences across variables.

A score computed solely from the current patch captures only instantaneous association and fails to represent delayed influences. To model such lagged effects, we aggregate the preceding Kmax patch representations via exponentially decayed weighting to construct a lagged representation for the current patch. Specifically, the lag weight is defined as ak = exp[−delta(k − 1)] / Σr=1..Kmax exp[−delta(r − 1)], where delta = exp(theta) > 0, and theta is a learnable parameter and a larger delta assigns higher weight to more recent patches. For any projection Mi(l) ∈ Qi(l), Ki(l), Ui(l), its lagged counterpart is defined as the weighted aggregation of the corresponding projections from preceding patches: M̃i(l) = Σk=1..Kmax ak Mmax(1,i−k)(l), where max(1, i − k) handles sequence boundaries by truncating indices below 1 to the first valid patch.

Similarity-based attention does not explicitly distinguish the two directions of an ordered variable pair. We therefore introduce a lag-aware directional contrast score at each patch position i. The directional score matrix Si(l) ∈ RV×V is defined as: Si(l) = Qi(l)K̃i(l)⊤ − Ki(l)Q̃i(l)⊤. For an ordered pair (u, v), Si,uv(l) measures the difference between the alignment of u's current state with v's lagged state and that of v's current state with u's lagged state. A positive value indicates directional evidence from v to u: the past of v helps predict the present of u. For each target variable, we retain the Kg source variables with the strongest positive dependency scores: Airaw,(l) = TopKKg(ReLU(tanh(Si(l)))), where TopKKg retains the selected dependency scores and sets the others to zero. The resulting Airaw,(l) ∈ RV×V is normalized …

Improvements to AI Systems Based on JAPE:

1. Structural Precursor Detection: AI systems can now detect anomalies before numerical deviations become apparent by modeling evolving inter-variable dependency graphs. This enables early warning for weak anomaly precursors that value-based methods miss, improving prediction lead time by up to 41.3% in AUC-PR.

2. Dual-View Anomaly Discrimination: Systems can fuse numerical forecasts with structural dependency evidence through cross-attention, distinguishing anomaly sources from propagated responses even when source variables show subtle numerical changes. This improves F1 by 19.7% on average across benchmarks.

3. Native Explainability at Zero Cost: AI systems can provide variable-level explanations directly from the predicted dependency graphs without additional models, training, or inference passes. This yields 26.6% improvement in MRR for root-cause identification, enabling real-time diagnostic insights during alerting.

4. Lag-Aware Dependency Modeling: Systems can capture directional lead-lag relationships between variables using exponentially decayed lag aggregation, identifying which variables influence others over time delays—critical for understanding fault propagation in distributed systems.

5. Decoupled Spatio-Temporal Representation: AI systems can separately model temporal evolution and inter-variable dependencies, preventing dominant temporal patterns from masking weak structural changes. This preserves structural precursors that would otherwise be lost under MSE optimization.

6. Future-Oriented Structural Forecasting: Systems can predict dependency graph evolution into the future horizon, enabling before-and-after structural comparisons at alert time—improving both prediction accuracy and explanation quality.

7. Graph Deviation Scoring for Root Cause: Systems can rank variables by combining direct dependency changes with multi-hop propagation effects, identifying upstream causes versus downstream effects—particularly useful for diagnosing complex system failures.

8. Efficient Training: Systems achieve faster training (up to 70.5% reduction in per-epoch time) by integrating dependency modeling into the forecasting backbone rather than using separate modules, making advanced anomaly prediction feasible for resource-constrained deployments.

9. Zero-Cost Explanation Pipeline: Systems can deliver explanations with less than 0.5% additional runtime overhead, enabling real-time alerting with simultaneous root-cause insights—critical for operational response in cloud-native environments.

10. Robust Cross-Dataset Generalization: Systems maintain strong performance across diverse multivariate time-series benchmarks (SMD, WADI, MSL, PSM, EXATHLON) with varying variable counts and dependency complexities, suggesting applicability to heterogeneous monitoring environments.

Multivariate time-series anomaly prediction aims to identify whether and when anomalies will occur over a future horizon from historical observations. Existing methods primarily characterize anomalies as deviations in future numerical values, which may overlook subtle dependency changes induced by weak anomaly precursors and provide no native variable-level explanation together with the alert. To bridge these gaps, we propose JAPE, a Joint Anomaly Prediction and Explanation framework that lifts anomaly prediction from numerical-deviation modeling to dependency-structure modeling. JAPE is the first anomaly prediction framework to explicitly model evolving dependency structures for both point-wise alerting and native variable-level explanation. Specifically, JAPE (i) proposes a Decoupled Spatio-Temporal Representation (DSTR) backbone that decouples temporal and spatial modeling and captures lag-aware dependencies via learnable lag aggregation, thereby perceiving structural precursors before numerical deviations emerge; (ii) designs a dual-view alerting mechanism that fuses numerical forecasts with evolving dependency graphs for point-wise anomaly prediction, capturing structural evidence even under subtle numerical deviations; and (iii) presents Native Predictive Explanation (NPE), which directly reuses the predicted dependency graphs to rank variables by structural deviations without additional models or training. Extensive experiments on five real-world benchmarks across three prediction horizons demonstrate that JAPE improves average F1 and AUC-PR by 19.7% and 41.3%, respectively, while improving explainability with 26.6% gain in MRR.