Modeling Normal Is All You Need: Joint Latent Clustering for Anomaly Detection in Multimodal Cyber-Physical Systems

arXiv cs.LG Papers
anomaly-detection cyber-physical-systems latent-clustering gaussian-mixture multimodal fair-protocol

Summary

This paper introduces a joint latent clustering approach for anomaly detection in multimodal cyber-physical systems, modeling normal behavior as a mixture of Gaussians in latent space, and proposes a fair evaluation protocol. It achieves state-of-the-art results on three real-world CPS datasets, particularly on difficult subsets.

arXiv:2607.06094v1 Announce Type: new Abstract: Faults on a cyber-physical system (CPS) are too rare and unrepresentative to characterise, or even to select a model on, so detection must instead model normal behaviour; the standard point-adjusted evaluation, however, rewards detectors that never do. CPS normal behaviour is the union of many imbalanced, curved, thin-fringed operating regimes rather than a single blob; we state this structure as ten assumptions (A1-A10), abbreviated Massive, Implicit, Imbalanced Multimodality (MIIM). We model the normal law with a jointly learned latent representation plus explicit Gaussian-mixture mode clustering, scored in the latent rather than by a global density or a reconstruction residual, and evaluate under a deliberately fair protocol: raw point-wise metrics with no point adjustment, a trivial-detector difficulty split, prevalence-matched F1, and train-normal-only calibration. On three real CPS datasets (WADI, HAI, SKAB), the detector wins both the combined column and the difficult correlation/dynamics-fault column on all three, reaching difficult-subset AUROC 0.831 on HAI, 0.726 on WADI, and 0.610 on SKAB. The margin is largest on the two multimodal datasets the MIIM assumptions target and slimmest on the near-unimodal one, tracking multimodality as the thesis predicts, and it holds against three deep detectors (USAD, TranAD, GDN) re-computed with the same raw metrics, all of which collapse on the difficult subset. The methodological contributions are the MIIM assumption set, the difficulty-stratified fair protocol, and a latent-only score that drops reconstruction because a flexible decoder rebuilds the hard faults faithfully.
Original Article
View Cached Full Text

Cached at: 07/08/26, 04:45 AM 

# Modeling Normal Is All You Need: Joint Latent Clustering for Anomaly Detection in Multimodal Cyber-Physical Systems
Source: [https://arxiv.org/abs/2607.06094](https://arxiv.org/abs/2607.06094)
[View PDF](https://arxiv.org/pdf/2607.06094)

> Abstract:Faults on a cyber\-physical system \(CPS\) are too rare and unrepresentative to characterise, or even to select a model on, so detection must instead model normal behaviour; the standard point\-adjusted evaluation, however, rewards detectors that never do\. CPS normal behaviour is the union of many imbalanced, curved, thin\-fringed operating regimes rather than a single blob; we state this structure as ten assumptions \(A1\-A10\), abbreviated Massive, Implicit, Imbalanced Multimodality \(MIIM\)\. We model the normal law with a jointly learned latent representation plus explicit Gaussian\-mixture mode clustering, scored in the latent rather than by a global density or a reconstruction residual, and evaluate under a deliberately fair protocol: raw point\-wise metrics with no point adjustment, a trivial\-detector difficulty split, prevalence\-matched F1, and train\-normal\-only calibration\. On three real CPS datasets \(WADI, HAI, SKAB\), the detector wins both the combined column and the difficult correlation/dynamics\-fault column on all three, reaching difficult\-subset AUROC 0\.831 on HAI, 0\.726 on WADI, and 0\.610 on SKAB\. The margin is largest on the two multimodal datasets the MIIM assumptions target and slimmest on the near\-unimodal one, tracking multimodality as the thesis predicts, and it holds against three deep detectors \(USAD, TranAD, GDN\) re\-computed with the same raw metrics, all of which collapse on the difficult subset\. The methodological contributions are the MIIM assumption set, the difficulty\-stratified fair protocol, and a latent\-only score that drops reconstruction because a flexible decoder rebuilds the hard faults faithfully\.

## Submission history

From: Yehudit Aperstein \[[view email](https://arxiv.org/show-email/3cd69277/2607.06094)\] **\[v1\]**Tue, 7 Jul 2026 10:10:00 UTC \(604 KB\)

Similar Articles