Multi-View Ensemble for Time Series Anomaly Detection via Coupling Flows

1 Introduction

Time series anomaly detection has become a critical capability across diverse real-world applications, from industrial equipment monitoring and financial fraud detection to fault diagnosis, automotive maintenance, and transportation systems [Huang et al., 2022; von Birgelen and Niggemann, 2018; Guo et al., 2014; Lu et al., 2011; Yang et al., 2023a; Ma et al., 2014]. The ability to automatically identify anomalous patterns in time series data is essential for ensuring system reliability, operational safety, and service continuity [Mathur and Tippenhauer, 2016; Hundman et al., 2018]. The increasing complexity and scale of modern time series data demand advanced detection methods that can capture various anomaly types effectively [Xu et al., 2021; Wu et al., 2022; Zamanzadeh Darban et al., 2024].

Despite significant advances in anomaly detection techniques, a fundamental challenge continues to limit the performance of existing methods, that is, the inherent diversity of anomaly patterns and the inability of single detection mechanisms to handle them comprehensively [Qiu et al., 2025a; Zamanzadeh Darban et al., 2024]. Specifically, the first challenge stems from the diversity of time series anomaly types. Temporal anomalies manifest as either point anomalies affecting individual observations, including global and contextual anomalies [Chandola et al., 2009; Lai et al., 2021], or sequence anomalies spanning continuous segments, such as seasonal, trend, and shapelet anomalies [Qiu et al., 2025a; Yeh et al., 2016]. Researchers have developed various detection approaches, from statistical methods and classical machine learning to deep learning architectures [Breunig et al., 2000; Liu et al., 2008; Xu et al., 2021], demonstrating excellent detection capabilities. However, different anomaly types exhibit vastly different behavioral patterns, and single detection mechanisms, constrained by their theoretical foundations and design biases, struggle to simultaneously capture these diverse characteristics (see Section 4.4). This specialization inevitably limits the applicability of individual methods in complex real-world scenarios.

The second challenge concerns how to combine multiple detection methods effectively. While ensemble approaches offer a natural solution to the diversity problem, traditional score aggregation methods, such as averaging or weighted combination, fail to capture the complex, non-linear dependencies between different detection views [Campos et al., 2022]. For instance, when temporal methods detect anomalies that frequency methods correctly ignore, simple averaging dilutes the detection signal rather than leveraging the complementary information. When multiple views show moderate scores that individually seem unremarkable, their consistent deviation might indicate a true anomaly that a linear combination fails to identify [Campos et al., 2022]. What is needed is a principled approach to model the joint distribution of multi-view scores, understanding when different views agree, disagree, or provide complementary information.

We propose FlowFuse, a framework that addresses the above challenges through principled multi-view ensemble learning with coupling flow-based score fusion. For the diversity challenge, we strategically select four complementary detection perspectives spanning temporal vs. frequency domains, as well as clustering vs. reconstruction paradigms, extracting temporal scores and frequency scores to cover diverse anomaly types comprehensively. The coupling flow architecture learns complex dependencies among these multiview anomaly scores through invertible transformations that alternately update temporal and frequency representations, enabling effective detection across diverse anomaly patterns. An ensemble of coupling flows further enhances robustness through model averaging while naturally quantifying detection uncertainty via score disagreement. When labeled data becomes available, this uncertainty can guide a learned router to selectively refine anomaly scores, though the framework operates effectively with a simple average router in purely unsupervised settings.

We demonstrate FlowFuse's effectiveness through extensive experiments on 10 univariate and 8 multivariate time series datasets, showing consistent superiority over 18 state-ofthe-art baseline methods. FlowFuse achieves strong performance across multiple anomaly types, validating the effectiveness of principled multi-view fusion.

Our main contributions are summarized as follows:

• We propose FlowFuse, a multi-view ensemble framework that extracts complementary anomaly scores from temporal and frequency domains through four parallel detectors, and models their joint distribution using coupling flows to effectively capture different types of anomalies.
• We introduce coupling flow-based score fusion that learns complex inter-view dependencies through invertible transformations with alternating updates between temporal and frequency scores, enabling sophisticated modeling of how different detection methods complement each other beyond simple linear aggregation.
• Extensive experiments on 18 benchmarks demonstrate FlowFuse's consistent superiority over 18 state-of-the-art methods, particularly achieving strong performance across diverse anomaly types through the principled multi-view fusion approach.

2 RelatedWork

2.1 Anomaly Detection Paradigms

Statistical Distribution-based Methods

Statistical methods detect anomalies by finding data that differs from normal patterns [Chandola et al., 2009]. Classic approaches include distance-based methods [Breunig et al., 2000; Yeh et al., 2016; Liu et al., 2008] that identify outliers based on their proximity to normal data groups, density estimation [Goldstein and Dengel, 2012; Zong et al., 2018] that spots samples in low-density regions, and clustering-based methods [Yairi et al., 2001; He et al., 2003; Qiu et al., 2025b] that group normal patterns and identify deviations. Tests from the TAB benchmark [Qiu et al., 2025a] show these traditional methods often beat deep learning at finding pattern anomalies, likely because they directly measure geometry and are sensitive to local structures.

Reconstruction-based Methods

Reconstruction methods work on a simple idea: models trained on normal data make larger errors when they see abnormal patterns [Sakurada and Yairi, 2014; Kingma and Welling, 2013]. These methods have evolved with deep learning, starting with basic autoencoders [Niu et al., 2020; Sakurada and Yairi, 2014], then recurrent networks [Niu et al., 2020; Su et al., 2019; Bhatnagar et al., 2021], and now attention-based models [Xu et al., 2021; Shentu et al., 2025]. Deep learning methods, especially Transformers [Xu et al., 2021; Yang et al., 2023b; Wu et al., 2022; Nie et al., 2023; Liu et al., 2024], have succeeded greatly due to their powerful representation advantages and are good at finding point anomalies. They learn complex features that catch singlepoint errors and local context problems [Qiu et al., 2025a; Shentu et al., 2025]. However, these complex models can fail with simple outliers [Zeng et al., 2023] and struggle with pattern anomalies because they focus too much on local quality and miss long-term shifts.

Discriminative Learning Methods

Discriminative methods learn boundaries between normal and abnormal regions directly. One-class classification [Sch¨olkopf et al., 1999] builds tight boundaries around normal data in feature spaces. Contrastive learning [Yang et al., 2023b; Yue et al., 2022; Zhuang et al., 2025; Ruff et al., 2019] creates useful features by checking consistency across different views without needing anomaly labels. But these methods have problems: without real anomalies for training, they must create fake ones that might not match real patterns. The learned boundaries might only work for specific anomaly types seen during training, making new anomaly patterns hard to handle.

2.2 Joint Temporal-Frequency Domain Analysis

Frequency analysis finds anomalies that time-based methods miss, including broken cycles, warped harmonics, and spectral problems [Ren et al., 2019; Thill et al., 2017]. Different anomalies show up better in different domains: seasonal anomalies appear clearly in the frequency domain as broken patterns, while trend anomalies show better in the temporal domain as long-term shifts [Qiu et al., 2025a].

Early work focused on single-variable spectral analysis [Feng et al., 2021; Ren et al., 2019] using frequency maps and partial Fourier transforms to find anomalies. Modern methods [Wu et al., 2022; Yang et al., 2023b; Nam et al., 2024; Wu et al., 2024; Wang et al., 2025] try to combine temporal and frequency analysis but face several challenges: temporal and frequency details do not always match, highfrequency information gets lost during processing, and crosschannel relationships are hard to model [Wu et al., 2024]. Current fusion methods just combine features or merge them late, failing to model the complex links between temporal and frequency scores.

3 Methodology

3.1 ProblemFormulation

Consider a time series X = ⟨x1, x2, . . . , xT ⟩, where each point xt ∈ Rd represents a d-dimensional measurement at time t. The training data X is assumed to contain only normal behavior patterns [Chandola et al., 2009; Lai et al.,

2021]. Our goal is to build a detector that identifies anomalies in test sequences Xtest, producing binary labels Ytest = ⟨y1, y2, . . . , yT ′⟩ where yt ∈ {0, 1} indicates normal (0) or abnormal (1) behavior.

3.2 Framework Overview

FlowFuse is a multi-view time series anomaly detection framework comprising three core stages:

1. Multi-Perspective Scores Learning: The input time series is processed simultaneously in temporal and frequency domains through FFT transformation. Four parallel detectors (Temporal Clustering, Temporal Reconstruction, Frequency Clustering, and Frequency Reconstruction) extract complementary anomaly scores, yielding temporal scores T and frequency scores F.
2. Coupling Flow Fusion: An ensemble of E coupling flows models the joint distribution of multi-view scores. Each coupling flow learns complex dependencies between temporal and frequency scores through alternating coupling layers with scale and translation transformations.
3. Anomaly Scoring: In unsupervised settings, an average router performs ensemble averaging across all flows. When labeled data is available, a learned router adaptively weights ensemble members based on score uncertainty. The final anomaly decision is made by comparing scores against a threshold.

Figure 1 illustrates the overall architecture. The framework first extracts anomaly scores from four complementary perspectives-clustering and reconstruction methods in both temporal and frequency domains-to capture diverse anomaly characteristics. These multi-view scores are then processed by an ensemble of coupling flows that learn their joint distribution through invertible transformations, producing fused anomaly scores.

The key advantage of using multiple flows is that their score disagreement (variance) naturally quantifies detection uncertainty. High disagreement indicates samples near decision boundaries where the model has low confidence. This uncertainty measure serves dual purposes: it identifies the most informative samples for selective supervision, and it provides practitioners with confidence estimates for detection results. The design ensures the framework operates effectively in purely unsupervised settings while seamlessly incorporating supervision when available to enhance detection performance.

3.3 Multi-Perspective Scores Learning

The framework begins with standardization to ensure comparability across dimensions, followed by adaptive windowing that segments data using a sliding window approach with window length W and stride s, producing overlapping windows Wi ∈ RW×d . The window size W can be automatically determined through FFT-based periodicity detection to align with natural data cycles, or set manually based on domain knowledge. Each window is also transformed via FFT to obtain its frequency representation for parallel processing in both temporal and frequency domains. By default, we set W = 50 and s = 1 across all experiments.

The choice of four detection perspectives is guided by two orthogonal design dimensions:

Domain Dimension (Temporal vs. Frequency). Different anomaly types manifest distinctively across domains. Point anomalies and local contextual anomalies are more apparent in the temporal domain, while seasonal anomalies and harmonic distortions are more naturally captured in the frequency domain.

Paradigm Dimension (Clustering vs. Reconstruction). Clustering-based methods excel at detecting global outliers and novel patterns far from learned clusters. Reconstructionbased methods excel at detecting subtle local deviations through high reconstruction errors.

For each window, we compute anomaly scores from four complementary perspectives:

• Temporal Clustering: We apply K-means clustering to identify C = 24 typical temporal patterns (see Section 4.4) in the training data [Yairi et al., 2001; He et al., 2003]. For each test window, we compute its Euclidean distance to the nearest cluster center. Windows that fall far from all learned clusters likely represent anomalous patterns not seen during training.
• Temporal Reconstruction: We employ a Transformer model with inverted tokenization [Liu et al., 2024; Nie et al., 2023], where each variable's time series serves as a token rather than each time point. The model learns to reconstruct normal temporal patterns through self-attention mechanisms [Xu et al., 2021]. High reconstruction errors indicate deviations from learned normal dependencies.
• Frequency Clustering: After applying FFT to convert windows to the frequency domain, we perform K-means clustering on the magnitude spectra with the same number of clusters C. This captures typical frequency patterns and identifies anomalies with unusual spectral characteristics that temporal analysis might miss [Ren et al., 2019].
• Frequency Reconstruction: A specialized Transformer operates directly on frequency representations (both mag-

nitude and phase), learning to reconstruct normal spectral patterns. This method excels at detecting subtle frequency anomalies like broken periodicities, harmonic distortions, or abnormal frequency components [Thill et al., 2017; Nam et al., 2024; Wu et al., 2024].

Using the same number of clusters C across both temporal and frequency domains ensures balanced representational capacity and consistent granularity, enabling fair integration of clustering-based scores from different perspectives. This multi-view approach leverages the observation that different anomaly types manifest distinctively across domains and detection paradigms. Point anomalies typically show high reconstruction errors, while pattern anomalies are better captured by clustering distances [Liu et al., 2008].

Since we use overlapping sliding windows with stride s, each timestamp may appear in multiple windows. We aggregate these window-level scores to point-level through averaging:

where Wt denotes all windows containing timestamp t [Yeh et al., 2016; Tatbul et al., 2018], and v ∈ {1, 2, 3, 4} indexes the four views. The resulting score matrix St ∈ Rd×4 for each timestamp provides a comprehensive characterization of potential anomalies from multiple perspectives, where each row corresponds to one dimension and each column represents one of the four detection views.

Given the score matrix St ∈ Rd×4 , we partition it along the column dimension into:

• Temporal scores: Tt = St[:, 1:2] ∈ Rd×2 (clustering + reconstruction)
• Frequency scores: Ft = St[:, 3:4] ∈ Rd×2 (clustering + reconstruction)

3.4 Coupling Flow Fusion

Traditional score aggregation methods fail to capture the complex dependencies between different detection methods. Table 1 summarizes the limitations of common approaches.

Linear methods (averaging, maximum, learned weights) treat views independently, ignoring their correlations. While MLP-based fusion can model non-linear interactions, it lacks principled density estimation and cannot determine whether a score pattern is normal or anomalous based on the learned distribution. Consider two scenarios: (1) A sample with high temporal but low frequency scores might indicate a temporal anomaly that frequency methods correctly ignore, and averaging dilutes this signal. (2) Moderate scores across all views might indicate a true anomaly through consistent deviation; maximum selection misses this pattern.

Coupling flows address these limitations by modeling the joint distribution p(S) of multi-view scores through invertible transformations with tractable likelihood computation. Samples with low likelihood under the learned normal distribution are identified as anomalies. Since the entire process operates without anomaly labels, this approach performs unsupervised modeling of the complete joint distribution.

Before fusion, all scores are standardized within each variable to zero mean and unit variance, ensuring comparability across different detection methods. Each coupling flow fe : Rd×4 → Rd×4 consists of Lc coupling layers that progressively transform the complex score distribution to a standard Gaussian distribution in latent space.

Coupling Layer Architecture. Each coupling layer applies conditional affine transformations through an alternating scheme. Given the temporal and frequency partitions [T(ℓ) t ,F(ℓ) t ] at layer ℓ, a single coupling block performs:

Step 1: Update frequency scores conditioned on temporal scores:

where sθ, tθ : Rd×2 → Rd×2 are scale and translation networks parameterized by θ, and ⊙ denotes element-wise multiplication.

Step 2: Update temporal scores conditioned on updated frequency scores:

where sϕ, tϕ : Rd×2 → Rd×2 are parameterized by ϕ.

This alternating structure enables bidirectional modeling of dependencies between temporal and frequency domains. The key insight is that by using the updated values from the previous half-step (e.g., F(ℓ+ 12 ) t instead of F(ℓ) t ), the flow can learn complex interactions-how temporal scores relate to frequency scores that have already been contextualized by temporal information.

The complete coupling flow consists of Lc such blocks stacked sequentially:

where zt ∈ Rd×4 is the latent representation. Each layer progressively refines the representation, with later layers capturing higher-order dependencies between views.

Ensemble Strategy. We train an ensemble of E coupling flows {f1, . . . , fE} with different random initializations and data subsets to create diversity. Each flow independently optimizes the negative log-likelihood of observed score patterns:

where z(e) t = fe(St) is the latent representation, ∥ · ∥F denotes the Frobenius norm, and Jfe is the Jacobian matrix of the flow transformation. The first term encourages latent representations to follow a standard Gaussian distribution, while the Jacobian determinant ensures invertibility.

The ensemble improves robustness through model averaging, provides more accurate density estimation with lower variance, and naturally quantifies detection uncertainty through score disagreement ut = VarEe=1 [re(St)]. High variance indicates samples near decision boundaries where individual flows disagree. We adopt E = 4 and Lc = 2 as default across all experiments.

To obtain interpretable anomaly scores, we convert likelihoods to percentile ranks. During training, we store the likelihood distribution for each flow. At test time, for sample St:

where I[·] is the indicator function and re(St) ∈ [0, 1].

3.5 Anomaly Scoring

The final anomaly score adapts to the availability of supervision through two routing strategies. In the unsupervised setting, we use an average router that performs ensemble averaging:

When labeled data becomes available, FlowFuse can optionally employ a learned router that leverages the ensemble's uncertainty measure. We select the top-K highest-uncertainty samples where K = ⌈ptrain · Ntrain⌉, and train a lightweight routing network gψ : Rd×4 → RE that assigns weights to ensemble members:

The router is trained using ranking loss on anomaly-normal pairs from the high-uncertainty subset:

where ϕ(St) = ∑Ee=1 we(St) · re(St) is the router-weighted score. This focuses limited labels on ambiguous regions where supervision has maximum impact.

The ensemble average ¯ r(St) provides robust anomaly scores by aggregating anomaly scores from diverse coupling flows. The weighted score ϕ(St) adaptively combines ensemble members based on the input score pattern, improving detection in previously ambiguous regions. This design ensures FlowFuse operates effectively across the full spectrum from purely unsupervised to semi-supervised settings.

4 Experiment

4.1 Experimental Settings

Datasets

We evaluate FlowFuse on 18 diverse benchmarks covering 10 univariate and 8 multivariate datasets across multiple domains including spacecraft telemetry, server monitoring, healthcare, movement analysis, and industrial systems. These datasets exhibit varied characteristics in dimensionality (155 channels), sequence lengths (785-1,416,825 points), and anomaly ratios (0.20%-15.57%), ensuring robust validation across different operational contexts. Table 2 summarizes all dataset statistics with original sources.

Dataset types distinguished by row color: Cyan = 10 Univariate (GAIA-YAHOO); Yellow = 8 Multivariate (LTDB-SVDB).

Table 2: Summary of evaluation datasets. AR denotes anomaly ratio.

Baselines

We compare against 18 state-of-the-art methods spanning three major anomaly detection paradigms: statistical distribution-based approaches (6 methods), reconstructionbased methods (10 methods), and discriminative learning approaches (2 methods), as detailed in Table 4. The baselines encompass non-learning statistical methods, traditional machine learning algorithms, and modern deep learning architectures.

Setup

We utilize TAB [Qiu et al., 2025a] for unified evaluation, with all baseline results derived from the same framework. To ensure fair comparison and demonstrate robustness, we employ a single set of hyperparameters for all univariate datasets and another for all multivariate datasets, without dataset-specific tuning. We adopt two evaluation metrics: Affiliated F1score [Huet et al., 2022] for label-based evaluation and AUROC for score-based evaluation. Hyperparameter configurations are detailed in Section 4.4.

4.2 Main Results

Table 3 presents evaluation results on both univariate and multivariate datasets, distinguished by background color (cyan for univariate, yellow for multivariate). FlowFuse achieves the best performance on the majority of benchmarks, demonstrating strong generalization across diverse anomaly detection scenarios.

For univariate time series, FlowFuse obtains impressive results on challenging datasets with complex temporal patterns (e.g., GHL, SMAP, YAHOO), while maintaining consistent superiority in ranking quality as measured by AUC-ROC. On multivariate benchmarks, our method delivers robust performance by effectively capturing cross-dimensional dependen-

Dataset types distinguished by row color: Cyan = 10 Univariate (GAIA-YAHOO); Yellow = 8 Multivariate (LTDB-SVDB).

Table 5: Ablation studies for FlowFuse in terms of Aff-F1.

cies through the coupling flow mechanism, achieving top results on LTDB, MITDB, NYC, and SVDB.

Compared to recent deep learning methods such as ModernTCN, DualTF, and Anomaly Transformer, FlowFuse demonstrates more stable performance across different data characteristics. While these baseline methods often excel on specific datasets but struggle on others, our approach maintains competitive results throughout all 18 benchmarks, validating the effectiveness of multi-view ensemble fusion.

4.3 Ablation Studies

To validate the contribution of each component in FlowFuse, we conduct comprehensive ablation studies on four representative datasets. Table 5 presents the results.

The results demonstrate that: (1) coupling flow fusion significantly outperforms simple averaging (+8.0% on average), validating the importance of modeling non-linear score dependencies; (2) each multi-view component contributes to overall performance, with temporal views showing larger impact than frequency views on most datasets; (3) the full model achieves the best results, confirming the complementary nature of all four detection perspectives.

4.4 Further Analysis

Method-Specific Detection Bias

To illustrate multi-view fusion rationale, we analyze 35 methods spanning three detection paradigms (listed in our repository) on datasets grouped by anomaly types. Figure 2 presents VUS-PR performance distributions across six anomaly categories, each subfigure visualizing method performance variation for a specific type.

Notably, we observe distinct paradigm tendencies: deep learning methods (e.g., iTransformer [Liu et al., 2024], DLinear [Zeng et al., 2023]) work effectively for point anomalies (global, contextual; Figure 2(a)(b)), while statistical approaches (e.g., KMeans, DWT [Thill et al., 2017], HBOS) are more suitable for subsequence anomalies (seasonal, shapelet; Figure 2(c)(e)). Additionally, even top-performing methods achieve only moderate performance on mixed anomalies (Figure 2(f)), lower than their performance on single-type anomalies.

This observation supports FlowFuse's multi-view fusion design. Integrating complementary perspectives via coupling flows, FlowFuse maintains stable performance across all six categories, alleviating constraints of type-specialized detection methods. The complete list of 35 methods and their implementations is available in our repository.

Optional Supervised Enhancement

When labeled data is available, FlowFuse can optionally refine detection through uncertainty-guided supervision. Table 6 shows performance with varying label ratios.

The results reveal that: (1) unsupervised FlowFuse already achieves strong baseline performance; (2) small amounts of labeled data (1-5%) yield substantial improvements, with diminishing returns at higher ratios; (3) performance saturates quickly, validating the uncertainty-guided sample selection strategy that focuses supervision on the most informative samples.

Parameter Sensitivity

We investigate the sensitivity of FlowFuse to two key hyperparameters: the number of clusters C and the number of coupling flows E. Figure 3 presents the results on four benchmark datasets.

For the number of clusters C, FlowFuse maintains stable performance across the range of 8 to 32, with less than 3% variation for most datasets. For the number of flows E, performance improves from E = 2 to E = 4 then saturates, indicating diminishing returns from additional ensemble members. We adopt E = 4 as the default. Overall, FlowFuse exhibits robust performance across its hyperparameter space without requiring precise tuning.

5 Conclusion

In this paper, we proposed FlowFuse, a multi-view ensemble framework that addresses anomaly diversity through coupling flow-based score fusion. By modeling the joint distribution of four complementary detection perspectives spanning temporal and frequency domains, as well as clustering and reconstruction paradigms, FlowFuse captures complex inter-view dependencies that linear aggregation cannot express. An ensemble of coupling flows provides robustness and natural uncertainty quantification, which enables targeted supervision when labels are available. Experiments on 18 benchmarks demonstrate state-of-the-art performance across diverse anomaly types, validating that principled multi-view fusion enables more comprehensive anomaly detection.

Ethical Statement

Our work uses only publicly available benchmark datasets without personally identifiable information. The proposed anomaly detection framework is for beneficial system reliability and safety monitoring applications, and no human subjects were involved in this research.

Acknowledgments

This work was partially supported by the National Natural Science Foundation of China (62372179) and the InnoHK funding.

Contribution Statement

Wanghui Qiu and Chenxi Liu contributed equally to this work as co-first authors. Bin Yang is the corresponding author.