CANDI: Curated Test-Time Adaptation for Multivariate Time-Series Anomaly Detection Under Distribution Shift

Abstract: Multivariate time-series anomaly detection (MTSAD) aims to identify deviations from normality in multivariate time-series and is critical in real-world applications. However, in real-world deployments, distribution shifts are ubiquitous and cause severe performance degradation in pre-trained anomaly detector. Test-time adaptation (TTA) updates a pre-trained model on-the-fly using only unlabeled test data, making it promising for addressing this challenge. In this study, we propose CANDI (Curated test-time adaptation for multivariate time-series ANomaly detection under DIstribution shift), a novel TTA framework that selectively identifies and adapts to potential false positives while preserving pre-trained knowledge. CANDI introduces a False Positive Mining (FPM) strategy to curate adaptation samples based on anomaly scores and latent similarity, and incorporates a plug-and-play Spatiotemporally-Aware Normality Adaptation (SANA) module for structurally informed model updates. Extensive experiments demonstrate that CANDI significantly improves the performance of MTSAD under distribution shift, improving AUROC up to 14% while using fewer adaptation samples.

• The paper introduces CANDI, a novel test-time adaptation framework that curates adaptation samples via false positive mining and employs spatiotemporally-aware SANA modules to reduce false positives under distribution shift.
• It demonstrates significant performance gains with improvements in AUROC, AUPRC, and F1 metrics, including a 59% relative AUROC increase under severe distribution shifts.
• The approach efficiently updates model parameters on a minimal subset of test data while preserving the pre-trained model’s latent structure, ensuring robust and parameter-efficient adaptation.

Curated Test-Time Adaptation for Multivariate Time-Series Anomaly Detection Under Distribution Shift

Introduction and Motivation

Multivariate time-series anomaly detection (MTSAD) is integral to monitoring and maintaining the reliability of complex systems across diverse environments, including industrial automation and healthcare monitoring. The reliability of deployed MTSAD solutions is severely compromised under non-stationary conditions where real-world time-series data undergo distributional shifts—phenomena arising from dynamic system processes, external environmental changes, or sensor drift. These shifts induce frequent, unanticipated changes in normal data characteristics, resulting in substantial increases in false positives by pre-trained anomaly detectors, thereby undermining operational trust and system utility (Figure 1).

Figure 1: Real-world time-series data distribution shift causes pronounced degradation in deployed anomaly detectors due to rampant false positives.

A robust solution to this adaptation problem must not only maintain high sensitivity to true anomalies but also minimize false alarms originating from distribution shifts in the normal data regime.

Framework Overview: The CANDI Approach

The paper introduces CANDI (Curated test-time adaptation for multivariate time-series Anomaly detection under DIstribution shift), comprising two primary innovations: (1) False Positive Mining (FPM) for targeted adaptation sample curation, and (2) the Spatiotemporally-Aware Normality Adaptation (SANA) module for efficient, structure-aware parameter updates. The framework adapts exclusively at test time using only unlabeled test data, while explicitly preserving the knowledge modeled by the pre-trained backbone (Figure 2).

Figure 2: CANDI framework—curated adaptation sample selection using anomaly score and latent proximity, with parameter-efficient SANA module updates.

False Positive Mining (FPM)

CANDI’s FPM explicitly identifies high-anomaly-score test samples whose latent representations are statistically proximal to hard normal samples from a held-out normal validation set. This selection is achieved through percentile-based thresholding on anomaly scores and minimum Mahalanobis distance in the encoder latent space, effectively isolating regions near the normal/anomaly decision boundary. Only test samples with both high scores and sufficiently small latent Mahalanobis distances to known hard normal cases are selected for adaptation. This operationalizes adaptation around underrepresented normal patterns, drastically reducing adaptation sample size (often <2% of the test set) while providing rich adaptation signal.

Additionally, moderately abnormal samples (with intermediate anomaly scores) are incorporated, further augmenting the adaptation set with normal variants that deviate from typical train-time patterns but are not outright anomalous.

Spatiotemporally-Aware Normality Adaptation (SANA)

The SANA module, shown in Figure 3, is a residual, plug-and-play adaptation block flanking the frozen pre-trained autoencoder. Each SANA module consists of temporal convolutions (to model intra-variable shifts) and cross-variable attention layers (to capture shifting inter-variable dependencies), providing expressivity absent from linear adaptation heads.

Figure 3: SANA module: temporal convolutions and variable-wise attention jointly adapt to test-time non-stationarity.

SANA leverages dual adaptation: at the model input (to align incoming windows to the train-time space) and at the reconstruction output (to compensate for new normality emerging post-reconstruction). The backbone’s parameters remain entirely frozen. Only the parameters of the lightweight SANA blocks are updated via minimization of the reconstruction loss on the curated adaptation set.

This design maintains latent space consistency, which is vital for FPM’s validity. In contrast, naïvely adapting the full model risks catastrophic forgetting, undermining the test-time efficiency and robustness required in MTSAD deployments.

Experimental Results

CANDI is evaluated across five SMD server datasets and the SWaT industrial control system dataset, each exhibiting annotated ground-truth anomalies and varying degrees of distributional non-stationarity (Figure 4).

Figure 4: Diverse distribution shifts under test conditions in benchmark datasets.

Comparative Performance

CANDI achieves pronounced gains in Area Under ROC (AUROC), Area Under Precision-Recall Curve (AUPRC), and F1 metrics over both static pre-trained models and the existing TTA baseline M2N2. The improvements are most evident in settings with severe distribution shift, e.g., a +14% AUROC on SMD_1-8 and a 59% relative AUROC improvement on SMD_3-2. The increase in F1 on SMD_2-4 (0.316 → 0.512) exemplifies reduced false positive rates, validated visually in test anomaly score traces (Figure 5).

Figure 5: CANDI attenuates anomaly scores for normal regions, substantially suppressing false positives in post-shift settings.

ROC and PR curves (Figure 6) quantitatively substantiate CANDI’s superior trade-off between sensitivity and specificity compared to existing TTA and static approaches.

Figure 6: ROC and PR curves illustrating CANDI’s elevated true positive rate with reduced false alarms under distribution shift.

Ablation Study

The ablation analysis demonstrates the necessity of joint FPM and SANA integration. FPM without SANA leads to collapsed latent spaces and degraded detection reliability; conversely, SANA without FPM forgoes critical adaptation signal available in ambiguous, high-anomaly-score normals. Only their combination achieves robust, efficient adaptation that balances plasticity and stability.

Adaptation Sample Efficiency

The CANDI framework restricts adaptation to a minor test-time subset: as shown in detailed adaptation sample analyses, even variants using only hard-to-classify normal samples maintain performance gains over full-set adaptation schemes while reducing contamination with actual anomalies. The inclusion of both hard and moderate samples yields maximal detection performance with minimal adaptation data.

Robustness Across Architectures and Benchmarks

CANDI’s design demonstrates generality. It consistently improves performance on both simple MLP and modern Transformer-based detectors (TimesNet), as well as on the large-scale TSB-AD meta-benchmark, outperforming state-of-the-art models across all five core metrics, including boundary-tolerance–aware VUS-PR and VUS-ROC.

Parameter-Efficient Adaptation

SANA’s parameter efficiency enables substantial accuracy improvement even with a sub-megabyte footprint, making CANDI amenable to deployment on constrained edge or embedded devices. The model maintains low variance across random seeds and is robust to hyperparameter selection and batch sizes.

Theoretical and Practical Implications

CANDI isolates the essential properties for robust test-time adaptation in MTSAD: adaptation must be judiciously focused (curated adaptation set) and enacted through parameter-efficient, structure-preserving modules. Critically, adaptation must leverage the statistical landscape near the decision boundary—a principle operationalized by FPM’s use of latent Mahalanobis proximity—rather than naïve low-confidence normality or indiscriminate model updates.

This work articulates a concrete pathway to scalable, continual adaptation in deployed time-series anomaly detectors. Inference-latency impacts are minimized by SANA’s lightweight design and the sharp reduction in adaptation set size. Further, the approach is compatible with a diverse array of backbone representations, provided a well-structured latent space and access to normal validation data.

Future Directions

Open questions include: extending CANDI to settings with contaminated training data, joint adaptation of detection thresholds, and incorporation of continual learning and calibration mechanisms for recovery from massive, highly non-stationary shifts. Expanding robust adaptation strategies for high-frequency, low-latency streaming settings, and incorporation with active anomaly exploration for adversarial environments, also present promising directions.

Conclusion

CANDI establishes a new standard for test-time adaptation in multivariate time-series anomaly detection under distribution shift. Through the integration of principled false positive mining and spatiotemporally-aware, parameter-efficient adaptation modules, CANDI substantially improves robustness, efficiency, and stability with minimal test-time data, outperforming existing baselines and laying the groundwork for resilient, deployable anomaly detection in continuously evolving real-world environments (2604.01845).