Aalborg Researchers Argue Anomaly Detectors Are Blind to Operating Context

Most anomaly detectors are trained on one big pile of normal data and told to flag anything that looks unlike it. That works in a lab, but it breaks the moment a system runs somewhere the operating conditions actually change. A new position paper from a team spanning Aalborg University, the University of Surrey and the University of Bucharest argues this is a formulation problem rather than a tuning problem, and proposes reframing multimodal anomaly detection around contextual inference.

The core claim is simple: abnormality is a property of an observation given a context, not of the observation itself. A machine running hot at full load is fine. The same reading at idle is a red flag. Current systems mostly refuse to make that distinction.

The single-distribution trap

Because anomalous events are inherently sparse, most frameworks train exclusively on normal data to learn a single reference model of normality, implicitly assuming that behavior can be captured by one unconditional distribution. The authors call the resulting failure mode structural ambiguity: the model cannot tell whether a strange-looking sample is a genuine anomaly or a normal sample from a different operating regime it happened to see less often during training.

Multimodality makes this worse in a subtle way. Modern sensing systems collect complementary streams capturing both system behavior and operating conditions, yet existing methods treat those streams equally, without distinguishing contextual information from anomaly-relevant signals. Abnormality then gets evaluated without explicitly conditioning on operating conditions. Feed a fusion model an accelerometer stream plus a control signal, and it will happily blend them into one embedding, discarding the fact that one describes what the machine is doing and the other describes what mode it is in.