Causally-Constrained Probabilistic Forecasting for Time-Series Anomaly Detection

Abstract: Anomaly detection in multivariate time series is a central challenge in industrial monitoring, as failures frequently arise from complex temporal dynamics and cross-sensor interactions. While recent deep learning models, including graph neural networks and Transformers, have demonstrated strong empirical performance, most approaches remain primarily correlational and offer limited support for causal interpretation and root-cause localization. This study introduces a causally-constrained probabilistic forecasting framework which is a Causally Guided Transformer (CGT) model for multivariate time-series anomaly detection, integrating an explicit time-lagged causal graph prior with deep sequence modeling. For each target variable, a dedicated forecasting block employs a hard parent mask derived from causal discovery to restrict the main prediction pathway to graph-supported causes, while a latent Gaussian head captures predictive uncertainty. To leverage residual correlational information without compromising the causal representation, a shadow auxiliary path with stop-gradient isolation and a safety-gated blending mechanism is incorporated to suppress non-causal contributions when reliability is low. Anomalies are identified using negative log-likelihood scores with adaptive streaming thresholding, and root-cause variables are determined through per-dimension probabilistic attribution and counterfactual clamping. Experiments on the ASD and SMD benchmarks indicate that the proposed method achieves state-of-the-art detection performance, with F1-scores of 96.19% on ASD and 95.32% on SMD, and enhances variable-level attribution quality. These findings suggest that causal structural priors can improve both robustness and interpretability in detecting deep anomalies in multivariate sensor systems.

• The paper introduces a causally-guided Transformer that integrates time-lagged causal priors for improved probabilistic forecasting in anomaly detection.
• It employs dual pathways—causal masking and safety-gated auxiliary blending—to enhance forecasting reliability and enable precise root-cause attribution, achieving state-of-the-art F1 scores.
• Empirical evaluation on ASD and SMD benchmarks confirms the model's robust performance, outperforming correlation-based approaches and enhancing interpretability.

Causally-Constrained Probabilistic Forecasting for Time-Series Anomaly Detection

Introduction and Motivation

The paper "Causally-Constrained Probabilistic Forecasting for Time-Series Anomaly Detection" (2604.17998) presents a formal anomaly detection framework for high-dimensional multivariate sensor time series in industrial monitoring contexts. The core challenge addressed is that existing anomaly detection models—especially those based on deep sequence modeling (RNNs, GNNs, Transformers)—primarily exploit correlation rather than causality, thus limiting interpretability, reliability in root-cause analysis, and robustness under distributional shift. The proposed Causally Guided Transformer (CGT) architecture incorporates explicit causal graph priors, derived from data via time-lagged causal discovery (PCMCI algorithm), and constrains probabilistic forecasting with variable-level causal masks. This design enables more principled anomaly scoring and root-cause attribution by enforcing that predictive learning and detection pathways are informed by actual causal structure, rather than merely statistical dependence.

Model Architecture and Causal Integration

The CGT framework processes lagged, windowed multivariate inputs and leverages a causal graph prior to restrict feature contributions per variable. Each target variable is assigned a forecasting block containing dual branches: a causal pathway gated using a hard parent mask from estimated time-lagged causal relations, and an auxiliary branch capturing residual non-causal information via stop-gradient isolation and safety-gated blending.

Figure 1: The CGT pipeline integrates causal graph priors with windowed, lagged sequence modeling to yield calibrated anomaly scores for each target variable.

The causal branch updates the Transformer encoder and latent variable modules using only parent-supported features, yielding a Gaussian predictive distribution for each variable. The auxiliary branch exploits additional correlations across sensors but is prevented from influencing or degrading causal learning via strict gradient isolation. Its output is blended adaptively using streaming safety diagnostics, ensuring that opportunistic residual inference is suppressed when it diverges from causal graph structure.

Figure 2: Each target-specific block enforces parent-mask gating in the Transformer encoder, while the auxiliary branch provides residual corrections via detached soft gating and no-gradient evaluation.

The probabilistic forecasting is implemented with Gaussian mean and variance outputs and regularization terms that penalize large residual overrides in the auxiliary branch. The safety gate (blend weight $\gamma$) is chosen online using calibration statistics measuring sensitivity to non-parent features ($R$) and gate separation margin ($M$), reducing auxiliary influence whenever causal alignment degrades.

Anomaly Scoring, Thresholding, and Attribution

Anomaly scores for each variable and timestep are computed as negative log-likelihood (NLL) values from the causal and opportunistic forecast distributions, blended with the dynamically chosen safety parameter ($\gamma$). Aggregation across variables yields a scalar anomaly score per timepoint, which is thresholded to produce binary anomaly detection using SPOT (Streaming Peaks-Over-Threshold), an extreme value theory adaptive thresholding algorithm.

Root-cause attribution is performed by two principled methods:

• Per-dimension standardized blended NLL ("$z$-score") attribution ranks variables by relative contribution to the anomaly score.
• Counterfactual clamping replaces historical values for a candidate sensor with its nominal median and measures the resultant drop in the overall anomaly score, providing intervention-inspired ranking of causal influence.

This attribution leverages the same causal forecasting model, enabling model-based diagnosis of anomalous events under realistic causal assumptions.

Experimental Evaluation

Extensive empirical evaluation is conducted on two established benchmarks: ASD and SMD, both with variable-level anomaly annotations. The CGT achieves state-of-the-art F1 scores: 96.19% (ASD) and 95.32% (SMD), outperforming correlation-driven baselines such as OmniAnomaly, MSCRED, MAD-GAN, USAD, MTAD-GAT, CAE-M, GDN, and TranAD in detection precision, recall, and AUROC.

Ablation studies demonstrate that:

• The auxiliary branch improves performance when used selectively via safety gating, but degrades reliability if naively blended.
• The safety mechanism suppresses non-parent reliance in periods of causal misalignment, as measured by $R$ and $M$ statistics.
• Attribution performance (root-cause localization) is superior with CGT, especially using counterfactual intervention-based ranking, confirming that causal structure enhances diagnostic interpretability.

Sensitivity analysis shows that detection accuracy is robust to reasonable variations in window length, lag horizon, latent samples, and aggregation rules, with mean aggregation being the most stable.

Strong Numerical Results and Claims

• CGT achieves F1 scores of 96.19% (ASD) and 95.32% (SMD), surpassing all evaluated baselines.
• Counterfactual clamp-based attribution outperforms score-based attribution in root-cause localization metrics.
• Ablation confirms that safety-gated auxiliary blending delivers stepwise improvements over causal-only and fixed-blend variants in both F1 and AUROC.

Implications and Future Developments

The integration of explicit causal structure into deep anomaly detection confers both robustness and interpretability, moving beyond black-box correlational models. Causal priors serve as effective inductive biases, directing attention and learning towards stable, actionable structure. Practically, this enables more reliable fault localization and actionable diagnosis in sensor-rich industrial monitoring systems.

Theoretically, the methodology demonstrates that causality can be embedded within sequence modeling architectures for unsupervised detection, supporting the broader thesis that structural causal modeling is not just useful for post hoc explanation but for improving the quality and reliability of anomaly detection itself.

Future research directions include:

• Joint estimation of causal graph and anomaly detection model, allowing adaptive updating of structure under nonstationarity and distribution shift.
• More accurate intervention-based root-cause analysis in partially observed systems.
• Expanded application and testing in larger-scale sensor networks, healthcare monitoring, and cyber-physical system diagnostics, where causal robustness is critical.

Conclusion

This paper introduces a causally-constrained probabilistic forecasting paradigm for time-series anomaly detection that enforces parent-restricted, causal consistency while adaptively leveraging reliable correlational structure in the data. Empirical results validate both the practical efficacy and theoretical value of integrating causal priors into anomaly detection pipelines. The approach sets a precedent for future work in joint causal discovery, anomaly detection, and root-cause analysis within industrial and scientific sensor networks.