STREAM-VAE: Dual-Path Routing for Slow and Fast Dynamics in Vehicle Telemetry Anomaly Detection

AI summary

Overview

Research area: Machine learning for time-series anomaly detection, applied to automotive vehicle telemetry (in-vehicle monitoring and backend fleet analytics).

Technical level: Intermediate. The paper assumes familiarity with variational autoencoders, attention mechanisms, and standard anomaly-detection metrics, but the architectural ideas are explained in accessible terms.

Scope: The paper proposes STREAM-VAE, a variational autoencoder that separates slow drift and fast spike dynamics through dual encoder paths and a decoder that models transient deviations separately from normal operating patterns, evaluated on a proprietary automotive telemetry dataset and the public Server Machine Dataset (SMD).

What This Paper Is About

Vehicle telemetry contains both slow drifts (load, temperature, operating mode shifts) and fast spikes (pedal jabs, brief current surges) within the same signal sequence. Standard reconstruction-based detectors, including sequence VAEs, compress everything into a single latent process, which either over-smooths the spikes or inflates the variance until nominal and anomalous scores blur together. The goal of this paper is to build a VAE that explicitly routes fast and slow content through separate paths so that anomaly scores stay sharply separated and threshold calibration stays stable across operating modes.

Key Contributions

1. A dual-path encoder that routes slow drift features (EMA-smoothed encoder features and latent states) and fast spike features (high-pass residuals formed as encoder features minus their EMA baseline) through two parallel attention branches, then fuses them with a sigmoid gate and a light residual block into a single latent context.

2. A decoder design for transient deviations: a per-feature mixture of experts (MoE) produces a base reconstruction mean over K experts using softmax routing and a low-rank parameterization, while a gated, soft-thresholded event residual driven by the first difference of the latent sequence adds sparse transients to the mean. A shared variance head (linear, softplus, clipped) is used across experts so variance does not absorb spikes.

3. A training objective with KL feedback control and anti-collapse regularizers: a Gaussian reconstruction term, a KL term with an online-updated coefficient β (proportional controller with EMA smoothing), an ℓ1 penalty on the event residual for sparsity, and a weak entropy target on the MoE gates set at half of log K.

4. A calibration-aware model selection and thresholding protocol: thresholds are calibrated once per time series on normal training windows via Peaks-Over-Threshold with a Generalized Pareto Distribution, and hyperparameter search minimizes a label-free objective combining a normalized validation loss, a robust upper-quantile width (q = 0.995), and a positive GPD shape penalty, with (λ, γ) = (0.01, 0.05) fixed across datasets.

Main Findings

• Automotive dataset (Table II): STREAM-VAE achieves the highest Oracle PA-F1 (0.857 ± 0.024), PA-F1 (0.794 ± 0.026), AUC-PR (0.532 ± 0.030), and a competitive AUC-ROC (0.755 ± 0.027). For comparison, the strongest reported baseline on that dataset is TFT-Residual with Oracle PA-F1 0.830 ± 0.004, PA-F1 0.781 ± 0.022, AUC-PR 0.479 ± 0.019, AUC-ROC 0.750 ± 0.014, followed by GDN at 0.825 ± 0.009 / 0.760 ± 0.007 / 0.498 ± 0.011 / 0.744 ± 0.003.

• SMD benchmark: Anomaly Transformer obtains the best AUC-PR (0.462 ± 0.272) and AUC-ROC (0.881 ± 0.107), while STREAM-VAE achieves the highest Oracle PA-F1 (0.935 ± 0.087) and reports PA-F1 of 0.493 ± 0.374, AUC-PR of 0.430 ± 0.260, and AUC-ROC of 0.812 ± 0.132. The paper interprets this as STREAM-VAE scores remaining well ordered even when a single global threshold is not perfectly tuned.

• Interpretation of the automotive gains: the paper attributes the improvement to three effects — separating fast spikes from slow drifts prevents over-smoothing by slow context; per-feature MoE routing absorbs benign operating mode changes instead of inflating variance; and the soft-thresholded event residual sharpens point-adjusted F1 by reducing fragmented detections while keeping nominal tails tight enough for stable POT calibration.

• Efficiency (Table III, automotive dataset, full dataset runtimes measured on a single Apple MacBook Pro M3 Max): STREAM-VAE records the joint-best Recall@1% (0.110 ± 0.000, matching TFT-Residual at 0.110 ± 0.000), with a training time of 262.3 ± 18.0 s and inference time of 97.9 ± 5.4 s. That training time is heavier than TFT-Residual (169.1 ± 4.4 s) but lighter than MA-VAE (320.3 ± 13.8 s), GDN (456.0 ± 4.9 s), OmniAnomaly (605.5 ± 0.8 s), and SIS-VAE (1081.8 ± 3.3 s). The paper reports that STREAM-VAE processes about 408 windows/s in Python (2.45 ms per window at T = 100), corresponding to real-time operation up to roughly 400 Hz, above the 10–100 Hz update rates of typical automotive signals.

• Ablation results (Table IV, automotive dataset): The full model leads on Oracle PA-F1 (0.792 ± 0.028), PA-F1 (0.631 ± 0.018), and AUC-PR (0.309 ± 0.024). Removing attention produces the largest drop in PA-F1 (0.601 ± 0.013). Drift-only attention (0.770 ± 0.034 Oracle PA-F1), spike-only attention (0.774 ± 0.016), no event residuals (0.774 ± 0.032), and ungated concatenation merges (0.780 ± 0.034) all degrade relative to the full model. Reduced-capacity variants — Small Latent (32D) at 0.784 ± 0.019, Small MoE (k=4) at 0.783 ± 0.016, and Simple FFN (×1) at 0.781 ± 0.021 — track the full model closely, which the authors read as evidence that gains come from the architecture rather than parameter count. Note that the "full" ablation configuration reports different numbers than Table II (0.792 Oracle PA-F1 versus 0.857), so the two tables reflect different experimental configurations.

• Component contributions by anomaly type (Fig. 4): spikes are handled mainly by the spike path; drifts benefit from all components, with the spike and drift paths providing most of the gain and the residual contributing only slightly; level shifts are led by the residual and the drift path; variance jumps are drift-path-led with moderate spike-path support; flatlines rely mainly on the drift path with a moderate spike-path contribution; correlation breaks show strong shared improvement from both paths, with the drift path slightly ahead. On normal windows, contributions are small and distributed.

• Qualitative attention behavior (Fig. 3): the drift path shows bright vertical bands at consistent key indices, producing a few global reference anchors and low-rank anchor-based alignment, while the spike path shows dense oscillatory checkerboard patterns and narrow query-centric stripes indicating short-lag, high-frequency coupling.

• Design context for baselines: the paper notes TFT-Residual performs well when anomalies are departures from locally predictable trends but is sensitive to unmodeled operating mode switches; GDN is strong on correlation anomalies but degrades when couplings change with context; SIS-VAE helps on drifts but attenuates sharp spikes; MA-VAE adds long-range context without separating time scales, so variance can grow to cover fast deviations; VASP's sparsity promotes salient spikes but can under-represent slow trends; Anomaly Transformer excels on SMD where periodic anchors repeat but underperforms on the automotive data; and Isolation Forest remains competitive at high recall for gross outliers but lacks multivariate temporal modeling.

Methodology in Plain English

The researchers process standardized windows of length T = 100 with F features (F = 8 for the automotive dataset; SMD varies per entity), z-scored using statistics from nominal training data only. Each feature is encoded by a lightweight two-layer bidirectional LSTM trunk into per-timestep contextual features and a latent sequence Z of D = 64 dimensions with per-timestep means and variance logits. To keep the latent informative even with an expressive decoder, a small learnable linear projection of the raw input is injected into the posterior heads, initialized to zero and gated by a sigmoid so it only matters if training finds it useful.

From the encoder features, the model builds a slow baseline with an exponential moving average (EMA) and a high-pass residual by subtracting that baseline. The slow baseline's first difference supplies queries and keys for the drift attention branch, with values drawn from the smoothed latent sequence; the high-pass residual supplies queries and keys for the spike attention branch, with values from the latent deviation. Queries and keys are ℓ2-normalized for scale-invariant matching, and grouped or multi-query attention (GQA) reduces key–value memory cost. A sigmoid gate blends the two branch outputs and a light residual block refines the mixture into the decoder context Z_ctx, while the first difference of the latent sequence, ΔZ, is kept aside for the event residual.

The decoder is a two-layer bidirectional LSTM. Per-feature MoE heads produce softmax weights over K experts and K expert means (via low-rank factorization) from the same hidden state, forming a base reconstruction mean; the paper reports that only a few experts (e.g., K = 2–4) are sufficient. An event residual driven by ΔZ is added to the mean after soft-thresholding with per-feature shrinkage, a global gate, per-feature gains, and RMS-based scaling. Variance comes from one shared head across experts. EMA memory factors are learned and initialized at 0.9, and all smoothing and differencing are applied to the specific signal used in each branch.

Training minimizes the Gaussian reconstruction term plus a KL term whose coefficient β is maintained near a target by a proportional controller with EMA smoothing, plus an ℓ1 penalty on the event residual and the entropy target on the MoE gates. Optimization uses Adam with gradient-norm clipping. Anomaly scores are the Gaussian negative log-likelihood per window, with labels aligned to the window end.

Evaluation uses AUC-PR, AUC-ROC, Point-Adjusted F1 at the fixed POT threshold, and Oracle PA-F1 as a diagnostic upper bound. Thresholds are calibrated once per entity on nominal train scores with (q, p) = (10⁻³, 10⁻⁴) for the automotive dataset and group-specific q values for SMD (machine-1: 10⁻³; machine-2: 2.5×10⁻³; machine-3: 5×10⁻³, all with p = 10⁻⁴), falling back to the empirical (1−α) upper quantile when exceedances are too sparse. Hyperparameter search uses 20 Optuna trials (Tree-structured Parzen Estimator with MedianPruner); the selected configuration is retrained with early stopping (up to 30 epochs, batch size 50), and results are reported as mean ± standard deviation over 5 seeds. For SMD, a two-phase protocol searches on machine-1-1, machine-2-1, and machine-3-1, then retrains and evaluates on all 28 entities.

The automotive dataset is described as clean in-vehicle test-drive telemetry from a test vehicle fleet, acquired in different locations and scenarios over several days, augmented with expert-designed synthetic anomalies that remain physically consistent. A controlled injection simulator introduces short, contiguous perturbations affecting one or more correlated features within their valid operating ranges, with each anomaly following one of six canonical fault types: spikes, drifts, level shifts, variance jumps, flatlines, and correlation breaks, with magnitudes and durations sampled from type-specific calibrated ranges. The dataset contains 40,000 total records, 36,426 normal instances, 3,574 anomalous instances (an 8.94% anomaly rate), 14.46% outlier percentage, and 100.00% completeness and range coverage. During training, 30% of the nominal data are held out for validation.

Why This Matters

Impact on research. The paper argues that a single latent process cannot cleanly represent both fast and slow dynamics, and demonstrates that explicit time-scale separation in the encoder — combined with mode-aware expert routing and a sparse event path in the decoder — improves robustness over strong forecasting, attention, graph, and VAE baselines. It also contributes a calibration-oriented evaluation recipe (label-free model selection objective plus POT thresholding) that addresses the practical problem of unstable nominal score tails, which the paper identifies as a recurring friction for fleet-wide deployment.

Real-world applications:

• In-vehicle monitors that must trigger rarely (the paper evaluates at a fixed 1% false-positive rate) while still catching meaningful faults.
• Backend fleet analytics, where stable tail behavior enables consistent thresholding across many vehicles.
• Early fault identification for emerging issues in powertrain, chassis, ECU, and body controller streams.
• Diagnostics

Authors’ abstract

Automotive telemetry data exhibits slow drifts and fast spikes, often within the same sequence, making reliable anomaly detection challenging. Standard reconstruction-based methods, including sequence variational autoencoders (VAEs), use a single latent process and therefore mix heterogeneous time scales, which can smooth out spikes or inflate variances and weaken anomaly separation. In this paper, we present STREAM-VAE, a variational autoencoder for anomaly detection in automotive telemetry time-series data. Our model uses a dual-path encoder to separate slow drift and fast spike signal dynamics, and a decoder that represents transient deviations separately from the normal operating pattern. STREAM-VAE is designed for deployment, producing stable anomaly scores across operating modes for both in-vehicle monitors and backend fleet analytics. Experiments on an automotive telemetry dataset and the public SMD benchmark show that explicitly separating drift and spike dynamics improves robustness compared to strong forecasting, attention, graph, and VAE baselines.