Dual-Score Association-Discrepancy Enhancement for Early-Warning Multivariate Time-Series Anomaly Detection

Abstract

Multivariate time-series anomaly detection is important for server monitoring, industrial systems, and intelligent operation and maintenance. Existing point-wise and point-adjusted metrics often fail to show whether an anomalous segment is detected early enough for intervention. This paper proposes a lightweight dual-score enhancement for Anomaly Transformer. The method retains the original multiplicative anomaly score and adds window-normalized reconstruction error and association discrepancy terms, so weak deviations near anomaly onsets become more visible without changing the backbone network or using additional labels. Experiments are conducted on four public multivariate benchmarks, namely, SMD, PSM, SMAP, and MSL, under three random seeds. Compared with the original Anomaly Transformer score, the proposed early-warning union mode improves Raw Event Recall by 0.3435, 0.2408, 0.0995, and 0.0278 on SMD, PSM, SMAP, and MSL, respectively, and reduces mean detection delay by 53.66%, 49.97%, 52.69%, and 39.74%. Event precision, event F1, and false positive rate are also reported in order to make explicit the trade-off between recall and false alarms. Further range- and proximity-aware metrics additionally show that the score-level enhancement improves segment coverage and early warning behavior, while AUPRC remains dataset-dependent. The results indicate that association-discrepancy score enhancement is a practical complement to existing transformer-based anomaly detectors when early warning is more important than point-wise matching alone.

1. Introduction

Multivariate time-series anomaly detection is a key task in server monitoring, cyber–physical systems, industrial safety, and intelligent operation and maintenance [1,2,3,4]. Modern monitoring platforms collect correlated variables such as CPU utilization, network traffic, memory usage, disk input/output, and status indicators. Faults, attacks, or performance degradation often appear as continuous abnormal segments or association changes rather than isolated points.

Deep models have improved anomaly detection by learning nonlinear temporal and cross-variable patterns [5,6,7,8,9,10,11,12,13,14]. Among them, Anomaly Transformer is relevant because it uses association discrepancy between learned series associations and prior associations as an anomaly-related signal [15]. This mechanism can reflect not only large reconstruction errors but also disruptions in temporal association.

Despite these advances, evaluation remains a practical challenge. Point-wise precision, recall, and F1 require exact alignment between predictions and labels. Point adjustment, which is widely used in time-series anomaly detection, marks an anomalous segment as correctly detected once at least one point inside the segment is hit [15,16]. This protocol improves comparability with prior work, but may hide late alarms. In early warning applications, a method that detects an anomaly near the end of its segment is less useful than one that fires near the beginning.

This paper addresses the above issue from the perspective of score construction. Instead of redesigning the backbone, we propose an enhanced lightweight association-discrepancy dual-score module for Anomaly Transformer. The module keeps the original multiplicative score and adds two window-normalized terms, namely, the reconstruction error and association discrepancy. The reconstruction error reflects numerical deviation, while the association discrepancy reflects structural mismatch; combining them at the score level strengthens early responses to weak abnormal signals.

The main contributions are as follows:

• A dual-score enhancement module is proposed for Anomaly Transformer. It combines the original score, reconstruction deviation, and association discrepancy without extra supervision.
• An early-warning-oriented evaluation is used, including PA-P, PA-R, PA-F1, event-level precision, event-level recall, mean detection delay, partial hit score, AUPRC, Affiliation-F1, PATE-style F1, Range-AUC, and VUS-style metrics.
• Experiments on SMD, PSM, SMAP, and MSL show that the proposed method consistently improves event recall and reduces detection delay, while AUPRC and point-adjusted scores reveal the expected trade-off between early warning and point-wise precision.

2. Related Work

2.1. Multivariate Time Series Anomaly Detection

Anomaly detection has been extensively studied in data mining and machine learning [1,4]. Time-series anomaly detection is more difficult because observations are temporally dependent and anomalies often cover intervals rather than individual samples [2,3]. Classical one-class or density-based methods such as One-Class SVM, support vector data description, local outlier factor, and Isolation Forest provide useful baselines, but are limited in high-dimensional temporal dependency modeling [17,18,19,20].

Deep learning methods learn temporal representations directly from data. LSTM encoder–decoder models, dynamic thresholding, prediction models, stochastic models, signature matrix methods, adversarial models, mixture models, and memory-augmented autoencoders have been used for anomaly detection [5,6,7,8,9,10,11,21,22,23]. Graph-based methods further emphasize cross-variable dependency modeling [12,13,24]. A related but distinct direction is anomaly prediction, which uses pre-anomaly temporal evidence to forecast future anomalous behavior; for example, Zhao et al. used importance-based generative contrastive learning for unsupervised time-series anomaly prediction [25]. In contrast, the present work remains an unsupervised detection study; it does not predict a future horizon, but instead modifies the score used to trigger an earlier alarm within an observed anomalous interval.

2.2. Transformer Models and Evaluation Protocols

Transformer models have become important in sequence and time-series modeling since the introduction of self-attention [26]. Informer, Autoformer, TimesNet, Temporal Fusion Transformer, PatchTST, and DeepAR-related forecasting models show the effectiveness of attention and temporal representation learning [27,28,29,30,31,32,33]. For anomaly detection, TranAD applies transformer networks to multivariate sequences [14], while Anomaly Transformer introduces association discrepancy for anomaly scoring [15].

Evaluation protocols are equally important. Point-adjusted F1 is useful for segment-level hit assessment, but does not directly measure how early the first alarm occurs [15,16]. Recent studies further point out that range-aware, proximity-aware, and volume-based criteria are needed for continuous time-series anomalies [34,35,36,37]. For monitoring systems, event precision and recall, false positive rate, detection delay, partial hit score, AUPRC, Affiliation-style F1, PATE-style F1, Range-AUC, and VUS-style scores provide a more informative view of early warning performance. Therefore, this paper reports both conventional PA metrics and early warning-oriented metrics.

3. Materials and Methods

3.1. Problem Definition

Let a multivariate time series be

$$X={\left\{x_t\right\}}_{t=1}^T,x_t\in {\mathbb{R}}^C,$$

(1)

where T is the sequence length and C is the number of variables. In unsupervised anomaly detection, only normal training data are used to learn the model. During testing, each time point receives an anomaly score $S\left(t\right)$ and a binary prediction is obtained by

$${\hat{y}}_t=\left\{\begin{array}{cc}1,\hfill & S\left(t\right)>\tau ,\hfill \\ 0,\hfill & S\left(t\right)\le \tau ,\hfill \end{array}\right.$$

(2)

where $\tau$ is the threshold.

The model uses sliding windows. For window length w, the input ending at time t is

$$X_t^{\left(w\right)}=[x_{t-w+1},x_{t-w+2},\dots ,x_t]\in {\mathbb{R}}^{w\times C}.$$

(3)

In the SMD experiments, $w=100$ and $C=38$, so each batch has the shape $B\times 100\times 38$.

3.2. Base Score and Enhanced Dual Score

Anomaly Transformer reconstructs the input window and produces attention association matrices. Let ${\hat{x}}_t$ be the reconstruction of $x_t$. The reconstruction error is

$$E_t={\displaystyle \frac{1}{C}}{\displaystyle \sum _{c=1}^C}{(x_{t,c}-{\hat{x}}_{t,c})}^2.$$

(4)

Let $Q_t^{(\ell )}$ and $P_t^{(\ell )}$ denote the learned series association and the normalized prior association at layer ℓ. The association discrepancy is computed by a symmetric KL form:

$$D_t={\displaystyle \sum _{\ell =1}^L}\left[\mathrm{KL}(Q_t^{(\ell )}\parallel P_t^{(\ell )})+\mathrm{KL}(P_t^{(\ell )}\parallel Q_t^{(\ell )})\right].$$

(5)

The original multiplicative score is

$$S_{\mathrm{base}}\left(t\right)={\left[\mathrm{softmax}(-D)\right]}_t{E}_t.$$

(6)

Here, a larger $D_t$ indicates a larger mismatch between the learned and prior associations. In Equation (6), $\mathrm{softmax}(-D)$ is a relative decreasing weight within the window rather than a direct anomaly-evidence term: a larger discrepancy receives a smaller multiplicative weight, while the final score still depends on its interaction with reconstruction error $E_t$. This is the original Anomaly Transformer scoring mechanism.

To strengthen early abnormal responses, the proposed method normalizes both $E_t$ and $D_t$ inside the current window. For a quantity $u_t$, window normalization is

$$z_W\left(u_t\right)={\displaystyle \frac{u_t-{\mu }_W\left(u\right)}{{\sigma }_W\left(u\right)+ϵ}},$$

(7)

where ${\mu }_W\left(u\right)$ and ${\sigma }_W\left(u\right)$ are the window mean and standard deviation, and $ϵ$ prevents numerical instability. The enhanced score is

$$S_{\mathrm{enh}}\left(t\right)=S_{\mathrm{base}}\left(t\right)+z_W\left(E_t\right)+\lambda z_W\left(D_t\right),$$

(8)

where $\lambda$ controls the contribution of association discrepancy. Thus, the apparent sign difference between Equations (6) and (8) is intentional: the base score uses discrepancy as a decreasing attention-derived weight, whereas the added $z_W\left(D_t\right)$ term treats an unusually high discrepancy as direct evidence of association disruption. This explicit decomposition is not algebraically equivalent to the original product because the standardized reconstruction and discrepancy residuals are retained as separate additive evidence. The main experiments use $\lambda =0.3$.

3.3. Relation to Anomaly Transformer

The proposed method uses the same trained backbone, reconstruction output, and association matrices as Anomaly Transformer; the difference lies in the construction and use of the anomaly score. The original Anomaly Transformer score multiplies reconstruction error by a softmax-transformed association-discrepancy term. While this is effective for point-wise scoring, weak onset deviations may still be suppressed when the multiplicative term is small. The proposed dual-score module explicitly re-injects the local standardized reconstruction error and association discrepancy into the final score. Therefore, the contribution is a post-training early warning enhancement at the score level rather than a new network architecture. This design is useful in deployment scenarios where retraining or changing the backbone is costly but where the alarm policy can be adjusted.

3.4. Union Early Warning Mode and Thresholding

For high-recall warning scenarios, this paper also uses a union mode:

$${\hat{y}}_t^{\mathrm{union}}=\mathbb{I}(S_{\mathrm{base}}\left(t\right)>{\tau }_{\mathrm{base}})\vee \mathbb{I}(S_{\mathrm{enh}}\left(t\right)>{\tau }_{\mathrm{enh}}).$$

(9)

This mode usually improves anomalous segment coverage and reduces delay, but may reduce precision.

For comparison with the original Anomaly Transformer protocol, the primary benchmark setting uses the following transductive anomaly ratio rule:

$$\tau =\mathrm{Percentile}(\{S_{\mathrm{train}},S_{\mathrm{test}}\},100-r).$$

(10)

This setting uses score distributions from both the normal training sequence and the unlabeled test sequence, but never uses test labels. It is useful for controlled benchmark comparison, yet is not a fully online deployment protocol because the test score distribution is available at threshold selection time. The SMD experiments use $r=0.5$. In union mode, the base and enhanced scores are thresholded separately.

For deployment-oriented analysis, the implementation also supports a training-only threshold:

$${\tau }_{\mathrm{train}}=\mathrm{Percentile}(S_{\mathrm{train}},q)$$

(11)

where q is fixed before test-time inference (99.5 in the training-only threshold protocol). This inductive option avoids test score leakage, and is appropriate when a normal training reference is available. The manuscript distinguishes the transductive benchmark protocol from this training-only protocol.

3.5. Workflow

Figure 1 summarizes the method. The input series is segmented into sliding windows and passed into Anomaly Transformer. Reconstruction output and association matrices are then used to compute $E_t$, $D_t$, $S_{\mathrm{base}}\left(t\right)$, and $S_{\mathrm{enh}}\left(t\right)$. The final prediction is obtained by thresholding the selected score or by using union mode.

Figure 1. Workflow of the proposed dual-score anomaly detection method.

4. Experiments

4.1. Dataset and Settings

The experiments use four public multivariate time-series anomaly detection benchmarks: SMD, PSM, SMAP, and MSL. SMD is a server monitoring benchmark released with OmniAnomaly [8]. SMAP and MSL are spacecraft telemetry benchmarks [6]. PSM is a server machine monitoring benchmark commonly used in the Anomaly Transformer protocol [15]. Table 1 summarizes these datasets. They cover different domains and variable dimensions, which helps evaluate whether the score-level enhancement generalizes beyond a single benchmark.

Table 1. Datasets used in the revised experiments.

Dataset	Domain	Variables	Anomaly Ratio Used for Thresholding
SMD	Server monitoring	38	0.5
PSM	Server monitoring	25	1.0
SMAP	Spacecraft telemetry	25	1.0
MSL	Spacecraft telemetry	55	1.0

The compared methods are the original Anomaly Transformer score, the proposed dual-score module, and the union early warning mode. All methods use the same Anomaly Transformer backbone. The batch size is 256, the learning rate is $1\times {10}^{-4}$, the maximum number of epochs is 10, early stopping patience is 3, and the score temperature is 50.0. The input length and local normalization length are both $W=w=100$ in the main experiments. When W is varied in the sensitivity study, a model is retrained for each value so that the input representation and the score normalization context remain matched. The main results are averaged over seeds 2025, 2026, and 2027. For SMD, the sampling interval is approximately one minute, so one delay step corresponds to about one minute; for the other datasets, the delay is reported in benchmark time steps.

4.2. Evaluation Metrics

Point-level precision, recall, and F1 are

$$P={\displaystyle \frac{TP}{TP+FP}},R={\displaystyle \frac{TP}{TP+FN}},F1={\displaystyle \frac{2PR}{P+R}}.$$

(12)

The point-level false positive rate is

$$\mathrm{FPR}={\displaystyle \frac{FP}{FP+TN}},$$

(13)

which reports the fraction of normal time points that are incorrectly alarmed. PA-P, PA-R, and PA-F1 are computed after point adjustment. For event-level evaluation, let $\mathcal{G}$ be the set of ground-truth anomalous segments and $\mathcal{P}$ the set of predicted anomalous segments:

$$P_{\mathrm{event}}={\displaystyle \frac{\left|\right\{P_i:\exists G_j,P_i\cap G_j\ne ⌀\left\}\right|}{\left|\mathcal{P}\right|}},$$

(14)

$$R_{\mathrm{event}}={\displaystyle \frac{\left|\right\{G_j:\exists t\in G_j,{\hat{y}}_t=1\left\}\right|}{\left|\mathcal{G}\right|}},F{1}_{\mathrm{event}}={\displaystyle \frac{2P_{\mathrm{event}}{R}_{\mathrm{event}}}{P_{\mathrm{event}}+R_{\mathrm{event}}}}.$$

(15)

For a detected anomalous segment $G_j=[a_j,b_j)$, the delay is ${\delta }_j=\min \{t-a_j:t\in [a_j,b_j),{\hat{y}}_t=1\}$. The mean delay and partial hit score are

$${\mathrm{Delay}}_{\mathrm{mean}}={\displaystyle \frac{1}{\left|\mathcal{D}\right|}}\sum _{j\in \mathcal{D}}{\delta }_j,$$

(16)

$$\mathrm{PartialHit}={\displaystyle \frac{1}{\left|\mathcal{G}\right|}}{\displaystyle \sum _{j=1}^{\left|\mathcal{G}\right|}}\left\{\begin{array}{cc}\exp (-{\delta }_j/|G_j\left|\right),\hfill & G_j\mathrm{is}\mathrm{detected},\hfill \\ 0,\hfill & G_j\mathrm{is}\mathrm{not}\mathrm{detected}.\hfill \end{array}\right.$$

(17)

AUPRC measures the area under the precision–recall curve for the anomaly scores.

We additionally report Affiliation-style F1, PATE-style F1, Range-AUC, and VUS-style metrics [34,35,36,37]. Affiliation-style precision and recall evaluate the overlap between predicted ranges and ground-truth ranges rather than isolated points. PATE-style F1 gives partial credit to predictions close to an anomalous range, so near-boundary early alarms are not treated the same as distant false alarms. Range-PR-AUC and Range-ROC-AUC integrate range-aware precision–recall and ROC behavior over thresholds. VUS-style scores further average range-AUC values over different tolerance buffer sizes. Because the main goal of this paper is early warning rather than point-wise matching, these metrics are reported only as supplementary evidence.

4.3. Main Results

Table 2 reports the main results. The proposed method improves early warning behavior on all four datasets. Compared with the baseline, the union mode increases Raw Event Recall by 0.3435, 0.2408, 0.0995, and 0.0278 on SMD, PSM, SMAP, and MSL, respectively. The corresponding mean-delay reductions are 53.66%, 49.97%, 52.69%, and 39.74%. The dual-score module improves Event-F1 on SMD, PSM, SMAP, and MSL while maintaining a comparable or lower point-wise FPR on SMD, PSM, and SMAP. Union mode further improves event coverage and delay, but also raises FPR because it accepts alarms from either score. For example, on SMD the union FPR rises from 0.50% to 0.88%, whereas Event-R rises from 0.5372 to 0.8807 and mean delay falls from 27.55 to 12.77 steps. This makes union mode appropriate for risk-sensitive monitoring, while the single dual score is the more conservative choice. AUPRC is dataset-dependent: while it improves clearly on SMD, but it does not improve on every dataset. Therefore, the main advantage of the proposed method should be interpreted as early warning improvement rather than universal point-wise ranking improvement.

Table 2. Main results over three random seeds. PA-F1 is computed after point adjustment; Event-P/R/F1, FPR, Delay, Partial-hit, and AUPRC are computed from raw predictions and scores. FPR is reported as a percentage. Bold values indicate the best results within each dataset.

Dataset	Method	PA-F1	Event-P	Event-R	Event-F1	FPR (%)	Delay	Partial-Hit	AUPRC
SMD	Anomaly Transformer	0.9054 ± 0.0074	0.0968 ± 0.0046	0.5372 ± 0.0463	0.1640 ± 0.0087	0.50 ± 0.00	27.5537 ± 4.7035	0.4046 ± 0.0417	0.0377 ± 0.0027
SMD	Dual-score	0.8980 ± 0.0004	0.1211 ± 0.0024	0.8063 ± 0.0047	0.2106 ± 0.0037	0.48 ± 0.00	17.8413 ± 0.7491	0.6776 ± 0.0044	0.0493 ± 0.0010
SMD	Union	0.8919 ± 0.0050	0.1078 ± 0.0022	0.8807 ± 0.0053	0.1921 ± 0.0036	0.88 ± 0.05	12.7672 ± 1.6362	0.7472 ± 0.0033	0.0493 ± 0.0010
PSM	Anomaly Transformer	0.9768 ± 0.0016	0.2879 ± 0.0071	0.4120 ± 0.0289	0.3388 ± 0.0135	1.05 ± 0.01	38.4931 ± 6.0384	0.3428 ± 0.0276	0.3022 ± 0.0262
PSM	Dual-score	0.9865 ± 0.0006	0.3255 ± 0.0279	0.6157 ± 0.0212	0.4253 ± 0.0240	0.72 ± 0.09	44.1442 ± 14.2018	0.4912 ± 0.0153	0.2852 ± 0.0015
PSM	Union	0.9750 ± 0.0003	0.3039 ± 0.0141	0.6528 ± 0.0139	0.4147 ± 0.0155	1.72 ± 0.09	19.2584 ± 3.9200	0.5485 ± 0.0187	0.2852 ± 0.0015
SMAP	Anomaly Transformer	0.9625 ± 0.0013	0.1173 ± 0.0172	0.8557 ± 0.0173	0.2059 ± 0.0268	0.98 ± 0.01	62.5876 ± 38.3737	0.6973 ± 0.0072	0.1714 ± 0.0040
SMAP	Dual-score	0.9616 ± 0.0021	0.1242 ± 0.0056	0.8060 ± 0.0448	0.2152 ± 0.0083	0.92 ± 0.04	61.0551 ± 15.8508	0.6593 ± 0.0355	0.1333 ± 0.0023
SMAP	Union	0.9384 ± 0.0013	0.1219 ± 0.0060	0.9552 ± 0.0149	0.2162 ± 0.0093	1.88 ± 0.05	29.6113 ± 3.3213	0.7967 ± 0.0112	0.1333 ± 0.0023
MSL	Anomaly Transformer	0.9420 ± 0.0059	0.1139 ± 0.0040	0.7963 ± 0.0320	0.1992 ± 0.0055	0.99 ± 0.02	44.1198 ± 8.6378	0.6231 ± 0.0114	0.1287 ± 0.0135
MSL	Dual-score	0.9192 ± 0.0141	0.1180 ± 0.0084	0.7407 ± 0.0425	0.2036 ± 0.0140	1.04 ± 0.03	36.0215 ± 7.8508	0.5976 ± 0.0407	0.1050 ± 0.0011
MSL	Union	0.9091 ± 0.0048	0.1134 ± 0.0033	0.8241 ± 0.0320	0.1992 ± 0.0047	1.95 ± 0.02	26.5858 ± 2.5587	0.6931 ± 0.0122	0.1050 ± 0.0011

4.4. Training-Only Threshold Analysis

Table 3 reports the deployment-oriented training-only threshold results. Compared with the benchmark transductive threshold in Table 2, the training-only protocol selects thresholds only from normal training scores, making it closer to an online deployment setting with a fixed reference distribution. The early warning pattern remains visible; on SMD, union mode reaches an Event-R of 0.8889 and reduces the mean delay to 11.6335 steps, while on PSM it improves Event-R from 0.4074 to 0.5833 and reduces the mean delay from 46.9989 to 24.8594 steps. This result also shows the expected trade-off: union mode generally raises FPR because it accepts either base-score or enhanced-score alarms, while the single dual score is more conservative. On SMAP and MSL, the training-only threshold is less favorable to the single dual score than the transductive benchmark threshold, which suggests that threshold calibration remains important for deployment.

Table 3. Training-only threshold results. FPR is reported as a percentage.

Dataset	Method	PA-F1	Event-P	Event-R	Event-F1	FPR (%)	Delay	Partial-Hit	AUPRC
MSL	Anomaly Transformer	0.9236 ± 0.0088	0.1329 ± 0.0071	0.6666 ± 0.0393	0.2214 ± 0.0098	0.55 ± 0.01	64.5679 ± 6.3063	0.5103 ± 0.0403	0.1287 ± 0.0110
MSL	Dual-score	0.8873 ± 0.0089	0.1253 ± 0.0073	0.5556 ± 0.0227	0.2045 ± 0.0111	0.51 ± 0.01	70.6365 ± 3.1108	0.4280 ± 0.0186	0.1050 ± 0.0009
MSL	Union	0.9277 ± 0.0038	0.1269 ± 0.0027	0.7500 ± 0.0000	0.2171 ± 0.0040	1.02 ± 0.03	39.5556 ± 8.3097	0.6021 ± 0.0331	0.1050 ± 0.0009
PSM	Anomaly Transformer	0.9806 ± 0.0008	0.3345 ± 0.0021	0.4074 ± 0.0285	0.3669 ± 0.0112	0.75 ± 0.04	46.9989 ± 4.9450	0.3324 ± 0.0254	0.3022 ± 0.0214
PSM	Dual-score	0.9550 ± 0.0115	0.3366 ± 0.0349	0.4907 ± 0.0236	0.3979 ± 0.0249	0.34 ± 0.03	55.0004 ± 22.5010	0.3873 ± 0.0091	0.2852 ± 0.0012
PSM	Union	0.9792 ± 0.0025	0.3335 ± 0.0096	0.5833 ± 0.0300	0.4239 ± 0.0088	1.06 ± 0.02	24.8594 ± 4.6056	0.4875 ± 0.0189	0.2852 ± 0.0012
SMAP	Anomaly Transformer	0.7236 ± 0.0082	0.0913 ± 0.0024	0.5224 ± 0.0122	0.1555 ± 0.0030	0.37 ± 0.01	71.1493 ± 21.9815	0.4312 ± 0.0142	0.1714 ± 0.0032
SMAP	Dual-score	0.9487 ± 0.0091	0.1030 ± 0.0162	0.5970 ± 0.0487	0.1755 ± 0.0255	0.45 ± 0.04	216.2879 ± 31.6208	0.4848 ± 0.0422	0.1333 ± 0.0019
SMAP	Union	0.9552 ± 0.0057	0.0964 ± 0.0088	0.7512 ± 0.0186	0.1707 ± 0.0142	0.82 ± 0.04	178.6766 ± 27.5639	0.6071 ± 0.0238	0.1333 ± 0.0019
SMD	Anomaly Transformer	0.9040 ± 0.0045	0.0943 ± 0.0037	0.5474 ± 0.0368	0.1609 ± 0.0069	0.53 ± 0.00	25.4667 ± 1.9945	0.4110 ± 0.0330	0.0377 ± 0.0022
SMD	Dual-score	0.8982 ± 0.0033	0.1181 ± 0.0019	0.8155 ± 0.0052	0.2063 ± 0.0031	0.51 ± 0.00	17.6047 ± 0.2361	0.6859 ± 0.0050	0.0493 ± 0.0008
SMD	Union	0.8879 ± 0.0043	0.1052 ± 0.0017	0.8889 ± 0.0038	0.1881 ± 0.0028	0.94 ± 0.04	11.6335 ± 0.1293	0.7553 ± 0.0025	0.0493 ± 0.0008

4.5. Range- and Proximity-Aware Metrics

Table 4 reports supplementary range- and proximity-aware metrics. The enhanced scores improve Range-AUC and VUS-style scores on all datasets because the raw score distribution becomes more sensitive to anomalous regions. Union mode changes the binary prediction but uses the same enhanced score for threshold-swept metrics; therefore, its Range-AUC and VUS values are close to those of dual-score mode.

Table 4. Range- and proximity-aware supplementary results over three random seeds. Bold values indicate the best results within each dataset.

Dataset	Method	Aff-F1	PATE-F1	Range-PR-AUC	Range-ROC-AUC	VUS-ROC
SMD	Anomaly Transformer	0.0661 ± 0.0078	0.2032 ± 0.0045	0.0130 ± 0.0006	0.0805 ± 0.0154	0.0574 ± 0.0131
SMD	Dual-score	0.1259 ± 0.0005	0.2207 ± 0.0039	0.0320 ± 0.0007	0.4353 ± 0.0056	0.3358 ± 0.0034
SMD	Union	0.1215 ± 0.0025	0.2154 ± 0.0051	0.0320 ± 0.0007	0.4353 ± 0.0056	0.3358 ± 0.0034
PSM	Anomaly Transformer	0.0797 ± 0.0115	0.4125 ± 0.0063	0.0424 ± 0.0124	0.0144 ± 0.0099	0.0105 ± 0.0083
PSM	Dual-score	0.2108 ± 0.0111	0.4450 ± 0.0268	0.2363 ± 0.0060	0.4706 ± 0.0157	0.3365 ± 0.0064
PSM	Union	0.2151 ± 0.0134	0.4483 ± 0.0156	0.2363 ± 0.0060	0.4705 ± 0.0155	0.3365 ± 0.0064
SMAP	Anomaly Transformer	0.0152 ± 0.0025	0.2678 ± 0.0244	0.0090 ± 0.0066	0.0066 ± 0.0086	0.0042 ± 0.0056
SMAP	Dual-score	0.0119 ± 0.0028	0.2759 ± 0.0085	0.1248 ± 0.0093	0.1960 ± 0.0143	0.1400 ± 0.0112
SMAP	Union	0.0201 ± 0.0016	0.2745 ± 0.0083	0.1248 ± 0.0093	0.1960 ± 0.0143	0.1400 ± 0.0112
MSL	Anomaly Transformer	0.0119 ± 0.0018	0.3619 ± 0.0064	0.0043 ± 0.0006	0.0031 ± 0.0015	0.0026 ± 0.0015
MSL	Dual-score	0.0119 ± 0.0015	0.3715 ± 0.0101	0.0945 ± 0.0106	0.2630 ± 0.0070	0.1910 ± 0.0065
MSL	Union	0.0164 ± 0.0025	0.3655 ± 0.0059	0.0945 ± 0.0106	0.2630 ± 0.0070	0.1910 ± 0.0065

4.6. Parameter Sensitivity

Table 5 reports the sensitivity of $\lambda$ on SMD and PSM. On SMD, a larger value such as $\lambda =0.7$ gives the lowest delay and the highest event recall. On PSM, however, larger values increase delay substantially, while $\lambda =0.1$–0.3 gives a better early warning trade-off. Therefore, $\lambda =0.3$ is used as the main cross-dataset setting, since it is stable across both datasets rather than over-tuned to SMD.

Table 5. Sensitivity of the discrepancy weight $\lambda$. Bold values indicate the best results within each dataset.

Dataset	$\mathit{\lambda }$	Raw F1	Event-R	Event-F1	Delay	Partial-Hit
SMD	0.1	0.0278	0.7920	0.2078	18.1622	0.6679
SMD	0.2	0.0281	0.7951	0.2082	18.2923	0.6680
SMD	0.3	0.0285	0.8073	0.2109	18.3939	0.6759
SMD	0.5	0.0292	0.8073	0.2120	17.3598	0.6758
SMD	0.7	0.0305	0.8165	0.2139	14.4981	0.6870
SMD	1.0	0.0319	0.7982	0.2173	16.2567	0.6697
PSM	0.1	0.0181	0.5694	0.4559	24.5366	0.4659
PSM	0.2	0.0178	0.5694	0.4517	24.4146	0.4631
PSM	0.3	0.0177	0.5694	0.4503	24.7317	0.4610
PSM	0.5	0.0170	0.5833	0.4488	33.3333	0.4694
PSM	0.7	0.0168	0.5694	0.4377	38.9024	0.4500
PSM	1.0	0.0169	0.5694	0.4331	47.8537	0.4490

4.7. Component Ablation

Table 6 separates the contribution of the two added score terms on SMD. Adding the normalized reconstruction term $z_W\left(E\right)$ provides most of the early warning gain, increasing Event-R from 0.5372 to 0.7910 and reducing delay from 27.5537 to 17.5054 steps. Adding only the normalized discrepancy term $z_W\left(D\right)$ is not sufficient and reduces performance, which indicates that association discrepancy should not be used as an isolated replacement for reconstruction evidence. The complete dual-score form combining both terms provides the best Event-F1 among the ablation variants while preserving the reduced delay. This supports the design choice in Equation (8): the discrepancy term is useful as complementary association-disruption evidence when combined with reconstruction deviation rather than being used as a stand-alone detector.

Table 6. Component ablation of the score-level enhancement on SMD. FPR is reported as a percentage. Bold values indicate the best results.

Variant	PA-F1	Event-P	Event-R	Event-F1	FPR (%)	Delay	Partial-Hit	AUPRC
Anomaly Transformer	0.9054 ± 0.0060	0.0968 ± 0.0038	0.5372 ± 0.0378	0.1640 ± 0.0071	0.50 ± 0.00	27.5537 ± 3.8404	0.4046 ± 0.0340	0.0377 ± 0.0022
Base + $z_W\left(E\right)$	0.8934 ± 0.0028	0.1186 ± 0.0022	0.7910 ± 0.0088	0.2063 ± 0.0036	0.48 ± 0.00	17.5054 ± 0.4033	0.6711 ± 0.0073	0.0512 ± 0.0009
Base + $z_W\left(D\right)$	0.7840 ± 0.0359	0.0559 ± 0.0091	0.3180 ± 0.0433	0.0950 ± 0.0150	0.53 ± 0.01	62.7566 ± 9.0651	0.2460 ± 0.0423	0.0436 ± 0.0009
Dual-score	0.8980 ± 0.0003	0.1211 ± 0.0019	0.8063 ± 0.0038	0.2106 ± 0.0030	0.48 ± 0.00	17.8413 ± 0.6116	0.6776 ± 0.0036	0.0493 ± 0.0008

4.8. Sensitivity to Window Length

Table 7 reports the sensitivity to the input and normalization window length W on SMD. For each value, the backbone is retrained with the same window length. The dual-score method improves Event-R and Event-F1 and reduces the mean delay for all tested values of W. Increasing W from 50 to 200 improves the enhanced score’s Event-R from 0.7064 to 0.8563 and raises AUPRC from 0.0464 to 0.0530, while the delay remains at around 18–19 steps. The main experiments use $W=100$ because it follows the common Anomaly Transformer setting and provides a balanced context length without tuning to the best SMD sensitivity result.

Table 7. Sensitivity to the input and normalization window length W on SMD. FPR is reported as a percentage. Bold values indicate the best results.

W	Method	PA-F1	Event-R	Event-F1	FPR (%)	Delay	Partial-Hit	AUPRC
50	Anomaly Transformer	0.8713	0.4006	0.1606	0.48	38.3817	0.2986	0.0427
50	Dual-score	0.8656	0.7064	0.1972	0.49	18.8225	0.6055	0.0464
100	Anomaly Transformer	0.8982	0.5046	0.1565	0.50	32.7333	0.3803	0.0375
100	Dual-score	0.8976	0.8073	0.2109	0.48	18.3939	0.6759	0.0483
200	Anomaly Transformer	0.8899	0.5321	0.1345	0.50	34.1494	0.3871	0.0387
200	Dual-score	0.9235	0.8563	0.2301	0.47	18.9679	0.7132	0.0530

4.9. Cross-Dataset Early Warning Summary

Figure 2 provides a compact cross-dataset summary of the early-warning effect. Union mode improves event recall and reduces delay on all four datasets. This visual result is consistent with Table 2: the method sacrifices some point-adjusted precision in several datasets, but detects more anomalous segments and triggers alarms earlier.

Figure 2. Cross-dataset summary of the early warning effect in union mode compared with the original Anomaly Transformer score.

4.10. Representative Temporal Case Study

Figure 3 shows one representative SMD anomaly segment selected from the diagnostic output of the training-only threshold experiment. The ground-truth anomalous interval starts at time step 79,225 and ends at time step 80,062. In this illustrative event, the original Anomaly Transformer score first triggers an alarm at time step 79,463, corresponding to a delay of 238 sampling steps. The enhanced dual-score mode and the union mode both trigger at time step 79,226, corresponding to a delay of one sampling step. This figure is meant to illustrate the onset behavior of a single representative case, and should not be interpreted as an average delay reduction over the full dataset. The aggregate comparisons are reported in Table 2 and Table 3. This case illustrates why event-level recall alone is insufficient: while both methods can eventually hit the anomaly, the enhanced score reacts near the onset, which is more useful for early warning.

Figure 3. Representative SMD temporal case study. The shaded region is the ground-truth anomalous interval, and the dark grey bar in the lower panel shows the binary ground-truth anomaly label. The vertical dashed line marks the anomaly onset. Dotted vertical lines mark the first alarms of the baseline and the proposed enhanced/union score. This is a single illustrative case, not a dataset-wide average; the baseline first alarm appears here at 238 sampling steps after onset, whereas the enhanced/union alarm appears after one sampling step.

5. Discussion

The results show that PA-F1 and early warning metrics can lead to different interpretations. The baseline often obtains strong PA-F1 because point adjustment rewards any hit inside an anomaly range; however, this does not guarantee that the alarm appears early. In contrast, the proposed score-level enhancement is designed to improve raw event coverage and reduce first-hit delay. This explains why union mode improves Event-R and Delay on all four datasets even when PA-F1 or AUPRC does not always improve. Event precision, Event-F1, and FPR make the corresponding operational trade-off explicit: the single dual score is generally conservative, whereas union mode gains coverage by accepting more alarms.

The method is lightweight because it uses reconstruction error and association discrepancy already produced by Anomaly Transformer, changing only the anomaly score. This makes it different from architectural methods that redesign patch encoders, memory modules, graph structures, or online adaptation mechanisms. The benefit is in its deployment simplicity: an existing trained backbone can be reused, and only the score construction and alarm policy need to be modified; more generally, the formula can be used with another detector only when that detector provides both a point-wise numerical residual and a temporally aligned relationship-disruption statistic. Importantly, this is an interface-level generalization rather than evidence that the present experiments establish empirical superiority for every backbone.

There are still a number of limitations. First, the primary benchmark threshold follows a transductive anomaly ratio protocol in order to maintain comparability with Anomaly Transformer. Although the training-only quantile alternative in Equation (11) is more appropriate for deployment, neither alternative replaces online representation adaptation under sustained distribution shift. Second, the range- and proximity-aware metrics used here are dependency-free implementations for supplementary analysis; future work should also integrate official benchmark toolkits when available. Third, union mode increases recall by design, and may introduce more false alarms; in practice, it should be selected for risk-sensitive scenarios where early warning is more valuable than maximum point-wise precision.

6. Conclusions

This paper proposed a dual-score association-discrepancy enhancement for early-warning multivariate time-series anomaly detection. By combining the original Anomaly Transformer score with normalized reconstruction error and association discrepancy, the proposed method improves early abnormal responses without additional supervision or backbone modification. Experiments on SMD, PSM, SMAP, and MSL show that the union early warning mode consistently improves Raw Event Recall and reduces mean detection delay. The improvements are especially clear on SMD and PSM. Range- and proximity-aware metrics further support the early warning benefit. AUPRC shows dataset-dependent behavior, indicating that early warning performance and point-wise ranking performance should be analyzed separately. These results support score-level enhancement as a practical complement to transformer-based anomaly detectors in early warning scenarios.