Conditional Multimodal Fusion for Time-Series Anomaly Detection

Abstract

Multivariate time-series anomaly detection is central to modern cyber-physical and cloud monitoring systems. While most detectors rely solely on sensor or telemetry streams, operational anomalies are often accompanied by textual evidence such as logs. This paper presents a conditional multimodal framework for time-series anomaly detection that fuses sensor streams with log text through bidirectional gated cross-attention (Bi+Gate). The mechanism models sensor-to-log and log-to-sensor interactions, weighted via temporal mean pooling and a learnable sigmoid gate. Experiments across five datasets (MSL, SMAP, SWAT, SMD, PSM) show that MOMENT achieves the highest F1 on SMD (0.832) and TimesNet on PSM (0.974) and SWAT (0.924). Under the fusion ablation protocol, Bi+Gate is the best fusion variant on SMD (F1 = 0.818, +4.5 pp over uni-directional cross-attention, +2.5 pp over concatenation) and PSM (0.951), though it does not exceed MOMENT on the main benchmark table. Fusion is not universally beneficial: on MSL with cross-domain index-modulo log pairing, all fusion variants obtain F1 ≈ 0.42. A post-hoc structured reporting layer converts detector evidence into operator-facing summaries without altering F1. The results highlight that fusion effectiveness depends critically on log-sensor alignment quality.