pith. machine review for the scientific record. sign in

arxiv: 2605.00929 · v1 · submitted 2026-04-30 · 💻 cs.LG · cs.AI

Recognition: unknown

PhaseNet++: Phase-Aware Frequency-Domain Anomaly Detection for Industrial Control Systems via Phase Coherence Graphs

Raviteja Bommireddy , Varshith Bandaru , Lohith Pakala , Pradeep Kumar B
Authors on Pith no claims yet

Pith reviewed 2026-05-09 20:50 UTC · model grok-4.3

classification 💻 cs.LG cs.AI
keywords anomaly detectionindustrial control systemsphase coherencefrequency domaingraph attentionSWaT benchmarkmultivariate time series
0
0 comments X

The pith

Phase spectra and coherence graphs provide a complementary signal for spotting anomalies in industrial control systems.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper argues that anomaly detection methods for industrial control systems overlook phase information from frequency transforms of sensor readings. It introduces a model that converts sliding windows of multivariate time series into the frequency domain while preserving both magnitude and phase spectra. A Phase Coherence Index then turns pairwise phase consistency across frequency bins into a graph that directs attention toward synchronized sensors. A Transformer encoder processes system-wide tokens and a dual-head decoder reconstructs both magnitude and phase, flagging reconstruction errors as anomalies. Evaluated on the SWaT water treatment dataset, the approach reaches an F1-score of 90.98 percent while adding only a modest number of parameters.

Core claim

PhaseNet++ is a frequency-domain autoencoder that operates on the Short-Time Fourier Transform of sliding sensor windows, retaining both magnitude and phase spectra. A Phase Coherence Index, inspired by phase locking values, summarizes pairwise phase consistency across frequency bins into a continuous adjacency matrix that guides a graph attention network. A sensor-token Transformer encoder captures system-wide structure, and a dual-head decoder reconstructs magnitude and phase jointly via circular and coherence-aware objectives. On the SWaT benchmark this yields an F1-score of 90.98 percent, ROC-AUC of 95.66 percent, and average precision of 91.51 percent.

What carries the argument

The Phase Coherence Index, which aggregates pairwise phase consistency across frequency bins into an adjacency matrix that steers graph attention propagation among phase-synchronized sensors.

Load-bearing premise

The Phase Coherence Index derived from pairwise phase consistency across frequency bins meaningfully captures inter-sensor relationships relevant to detecting anomalies rather than noise or irrelevant correlations.

What would settle it

Replace all phase values in the input STFT windows with random phases while keeping magnitudes fixed, then measure whether detection F1-score on the SWaT benchmark falls to the level of magnitude-only baselines.

Figures

Figures reproduced from arXiv: 2605.00929 by Lohith Pakala, Pradeep Kumar B, Raviteja Bommireddy, Varshith Bandaru.

Figure 1
Figure 1. Figure 1: Overview of the PhaseNet++ pipeline. A multivariate sensor window [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
read the original abstract

Multivariate time series anomaly detection in ICS has attracted growing attention due to the increasing threat of cyber-physical attacks on critical infrastructure. State-of-the-art methods model inter-sensor relationships from raw time-domain amplitude values, using graph neural networks, Transformers. However, these methods discard the phase spectrum produced by time frequency transformations, We argue that phase information constitutes a complementary and previously overlooked detection modality for ICS anomaly detection. We present PhaseNet++, a frequency-domain autoencoder that operates on the Short-Time Fourier Transform (STFT) of sliding sensor windows, retaining both magnitude and phase spectra. A Phase Coherence Index (PCI), inspired by the Phase Locking Value from neuroscience, summarizes pairwise phase consistency across frequency bins into a continuous adjacency matrix. This matrix guides a graph attention network that propagates information preferentially among phase-synchronized sensors. A sensor-token Transformer encoder captures system-wide structure, and a dual-head decoder reconstructs magnitude and phase jointly via circular and coherence-aware objectives. Evaluated on the Secure Water Treatment (SWaT) benchmark, PhaseNet++ achieves an F1-score of 90.98%, ROC-AUC of 95.66%, and average precision of 91.51%. Ablation studies show that the phase-aware front-end and PCI graph module together add only 264,816 parameters, demonstrating that the phase inductive bias is lightweight. While the absolute F1-score is second best than that of all recent raw-value methods evaluated under different protocols, we position this work as the first systematic study of phase-domain anomaly detection for ICS.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 1 minor

Summary. The paper proposes PhaseNet++, a frequency-domain autoencoder for multivariate time-series anomaly detection in industrial control systems. It processes sliding windows via STFT to retain both magnitude and phase spectra, introduces a Phase Coherence Index (PCI) derived from pairwise phase consistency to form a graph adjacency matrix, applies a graph attention network to propagate information among phase-synchronized sensors, uses a sensor-token Transformer encoder, and employs a dual-head decoder with circular and coherence-aware reconstruction losses. On the SWaT benchmark it reports F1=90.98%, ROC-AUC=95.66%, and AP=91.51%, with the phase-aware front-end and PCI module adding only 264k parameters; the work positions itself as the first systematic study of phase-domain anomaly detection for ICS.

Significance. If the phase spectra and PCI-derived graph indeed supply a complementary signal, the approach would establish a new lightweight inductive bias for ICS anomaly detection that exploits information routinely discarded by amplitude-only models. The empirical evaluation on an external benchmark (SWaT) and the explicit parameter-count reporting for the added modules are positive features that could be built upon.

major comments (2)
  1. [Abstract] Abstract and ablation studies: the central claim that phase information constitutes a 'complementary and previously overlooked detection modality' is not supported by any reported performance numbers for a magnitude-only ablation of the same architecture. Only the parameter overhead (264,816) is quantified; without F1/AUC/AP deltas when the phase front-end and PCI are removed, gains cannot be attributed to phase coherence rather than the STFT autoencoder, GAT, or Transformer components.
  2. [Abstract] Abstract: the statement that the absolute F1-score 'is second best than that of all recent raw-value methods evaluated under different protocols' introduces ambiguity about comparability. No table or section details the exact baselines, evaluation protocols, data splits, or statistical significance tests used by those prior methods, preventing assessment of whether the reported 90.98% F1 is directly competitive.
minor comments (1)
  1. [Abstract] The abstract refers to 'circular and coherence-aware objectives' for the dual-head decoder without providing the corresponding loss equations or implementation details; these should be stated explicitly (e.g., in §3.4 or the supplementary material) to allow reproduction.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive and detailed comments. We address each major point below and will revise the manuscript to strengthen the empirical support for our claims and improve the clarity of the comparisons.

read point-by-point responses

  1. Referee: [Abstract] Abstract and ablation studies: the central claim that phase information constitutes a 'complementary and previously overlooked detection modality' is not supported by any reported performance numbers for a magnitude-only ablation of the same architecture. Only the parameter overhead (264,816) is quantified; without F1/AUC/AP deltas when the phase front-end and PCI are removed, gains cannot be attributed to phase coherence rather than the STFT autoencoder, GAT, or Transformer components.

    Authors: We agree that the current ablation studies report only the parameter count (264,816) for the phase-aware front-end and PCI module without providing the corresponding F1/AUC/AP performance numbers for an otherwise identical magnitude-only architecture. This limits the ability to isolate the contribution of phase coherence. In the revised manuscript we will add a dedicated ablation table that includes a magnitude-only baseline (removing the phase spectrum input and PCI graph construction while retaining the STFT magnitude path, GAT, and Transformer), reporting the exact deltas in F1, ROC-AUC, and AP on SWaT. This will directly support or qualify the claim that phase supplies complementary signal. revision: yes

  2. Referee: [Abstract] Abstract: the statement that the absolute F1-score 'is second best than that of all recent raw-value methods evaluated under different protocols' introduces ambiguity about comparability. No table or section details the exact baselines, evaluation protocols, data splits, or statistical significance tests used by those prior methods, preventing assessment of whether the reported 90.98% F1 is directly competitive.

    Authors: We acknowledge that the abstract phrasing is imprecise and that the manuscript should make the comparison more transparent. The full paper contains a results table comparing against recent raw-value methods, but the abstract does not reference it and does not summarize the differing protocols. In revision we will (1) correct the grammatical error and rephrase the claim for accuracy, (2) add an explicit pointer in the abstract to the comparison table and section, and (3) include a short paragraph in the experimental section that lists the evaluation protocols, data splits, and any significance testing reported by the cited baselines so readers can judge competitiveness under the acknowledged protocol differences. revision: yes

Circularity Check

0 steps flagged

No significant circularity; empirical method evaluated on external benchmark.

full rationale

The paper defines PCI explicitly from pairwise phase consistency in STFT spectra to construct an adjacency matrix for the GAT component, presents the full architecture (STFT front-end, PCI graph, Transformer encoder, dual-head decoder with circular/coherence losses) as a novel combination, and reports performance via direct empirical evaluation on the external SWaT dataset (F1 90.98%, ROC-AUC 95.66%). No derivation step reduces by construction to its own inputs, no fitted parameters are relabeled as predictions, and no load-bearing claims rest on self-citations or imported uniqueness theorems. The method is self-contained against an external benchmark rather than tautological.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 1 invented entities

The central claim rests on the assumption that phase spectra provide complementary information not captured by amplitude; the PCI is an invented summary statistic adapted from neuroscience without independent validation shown in the abstract. No free parameters are explicitly fitted beyond standard model training.

axioms (1)
  • domain assumption Phase information from STFT is complementary to magnitude for anomaly detection in ICS
    Explicitly argued in the abstract as the motivation for retaining phase spectra.
invented entities (1)
  • Phase Coherence Index (PCI) no independent evidence
    purpose: Summarizes pairwise phase consistency across frequency bins into a continuous adjacency matrix for guiding graph attention
    Newly defined here, inspired by Phase Locking Value but adapted for this anomaly detection task; no independent evidence of its general utility provided.

pith-pipeline@v0.9.0 · 5602 in / 1530 out tokens · 36539 ms · 2026-05-09T20:50:01.144120+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

34 extracted references · 4 canonical work pages

  1. [1]

    SWaT: A water treatment testbed for research and training on ICS security,

    A. P. Mathur and N. O. Tippenhauer, “SWaT: A water treatment testbed for research and training on ICS security,” in2016 International Work- shop on Cyber-physical Systems for Smart Water Networks (CySWater). Los Alamitos, CA, USA: IEEE Computer Society, Apr. 2016, pp. 31–36

    2016

  2. [2]

    On the elements of datasets for cyber physical systems security,

    A. Tantawy, “On the elements of datasets for cyber physical systems security,” 2022. [Online]. Available: https://arxiv.org/abs/2208.08255

    work page arXiv 2022

  3. [3]

    A survey on deep learning for cybersecurity: Progress, challenges, and opportunities,

    M. Macas, C. Wu, and W. Fuertes, “A survey on deep learning for cybersecurity: Progress, challenges, and opportunities,”Computer Networks, vol. 212, p. 109032, 2022

    2022

  4. [4]

    Detecting cyber attacks in industrial con- trol systems using convolutional neural networks,

    M. Kravchik and A. Shabtai, “Detecting cyber attacks in industrial con- trol systems using convolutional neural networks,” inProceedings of the 2018 Workshop on Cyber-Physical Systems Security and PrivaCy (CPS- SPC). New York, NY , USA: Association for Computing Machinery, 2018, pp. 72–83

    2018

  5. [5]

    LSTM-based encoder-decoder for multi-sensor anomaly detection.CoRR, abs/1607.00148, 2016

    P. Malhotra, L. Vig, G. Shroff, and P. Agarwal, “LSTM-based encoder-decoder for multi-sensor anomaly detection,”arXiv preprint arXiv:1607.00148, 2016

    work page arXiv 2016

  6. [6]

    DeepAnT: A deep learning approach for unsupervised anomaly detection in time series,

    M. Munir, S. A. Siddiqui, A. Dengel, and S. Ahmed, “DeepAnT: A deep learning approach for unsupervised anomaly detection in time series,” IEEE Access, vol. 7, pp. 1991–2005, 2019

    1991

  7. [7]

    Multivariate industrial time series with cyber-attack simulation: Fault detection using an LSTM- based predictive data model,

    P. Filonov, A. Lavrentyev, and A. V orontsov, “Multivariate industrial time series with cyber-attack simulation: Fault detection using an LSTM- based predictive data model,”arXiv preprint arXiv:1612.06676, 2016

    work page arXiv 2016

  8. [8]

    Graph neural network-based anomaly detection in multivariate time series,

    A. Deng and B. Hooi, “Graph neural network-based anomaly detection in multivariate time series,” inProceedings of the AAAI Conference on Artificial Intelligence, vol. 35, no. 5, 2021, pp. 4027–4035

    2021

  9. [9]

    Anomaly transformer: Time series anomaly detection with association discrepancy,

    J. Xu, H. Wu, J. Wang, and M. Long, “Anomaly transformer: Time series anomaly detection with association discrepancy,” inInternational Conference on Learning Representations (ICLR), 2022

    2022

  10. [10]

    Learning graph structures with transformer for multivariate time series anomaly detection in IoT,

    Z. Chen, D. Chen, Z. Yuan, X. Cheng, and X. Zhang, “Learning graph structures with transformer for multivariate time series anomaly detection in IoT,”arXiv preprint arXiv:2104.03466, 2021

    work page arXiv 2021

  11. [11]

    OmniAnomaly: Robust lstm-vae based anomaly detection for multi-sensor data,

    Y . Su, Y . Zhao, C. Niu, R. Liu, W. Sun, and D. Pei, “OmniAnomaly: Robust lstm-vae based anomaly detection for multi-sensor data,” in Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2019, pp. 2034–2044

    2019

  12. [12]

    Multivariate time series anomaly detection and interpretation using hierarchical inter- metric and temporal embedding,

    Z. Li, Y . Zhao, J. Han, Y . Su, R. Jiao, X. Wen, and D. Pei, “Multivariate time series anomaly detection and interpretation using hierarchical inter- metric and temporal embedding,” inProceedings of the 27th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2021, pp. 3220–3230

    2021

  13. [13]

    Pikovsky, M

    A. Pikovsky, M. Rosenblum, and J. Kurths,Synchronization: A Uni- versal Concept in Nonlinear Sciences. Cambridge University Press, 2001

    2001

  14. [14]

    K. V . Mardia and P. E. Jupp,Directional Statistics. Chichester: Wiley, 2000

    2000

  15. [15]

    Measuring phase synchrony in brain signals,

    J.-P. Lachaux, E. Rodriguez, J. Martinerie, and F. J. Varela, “Measuring phase synchrony in brain signals,”Human Brain Mapping, vol. 8, no. 4, pp. 194–208, 1999

    1999

  16. [16]

    A dataset to support research in the design of secure water treatment systems,

    J. Goh, S. Adepu, K. N. Junejo, and A. P. Mathur, “A dataset to support research in the design of secure water treatment systems,” pp. 88–99, 2016

    2016

  17. [17]

    Cyber- attacks detection in industrial systems using artificial intelligence-driven methods,

    W. Wang, F. Harrou, B. Bouyeddou, S.-M. Senouci, and Y . Sun, “Cyber- attacks detection in industrial systems using artificial intelligence-driven methods,”International Journal of Critical Infrastructure Protection, vol. 38, p. 100542, 2022

    2022

  18. [18]

    Detection of cyber attacks on a water treatment process,

    M. Al-Dhaheri, P. Zhang, and D. Mikhaylenko, “Detection of cyber attacks on a water treatment process,”IFAC-PapersOnLine, vol. 55, no. 6, pp. 667–672, 2022, 11th IFAC Symposium on Fault Detection, Supervision and Safety for Technical Processes SAFEPROCESS 2022

    2022

  19. [19]

    Explainable anomaly detection for industrial control system cybersecurity,

    D. T. Ha, N. X. Hoang, N. V . Hoang, N. H. Du, T. T. Huong, and K. P. Tran, “Explainable anomaly detection for industrial control system cybersecurity,”IFAC-PapersOnLine, vol. 55, no. 10, pp. 1183–1188, 2022, 10th IFAC Conference on Manufacturing Modelling, Management and Control MIM 2022

    2022

  20. [20]

    Con- necting the dots: Multivariate time series forecasting with graph neural networks,

    Z. Wu, S. Pan, G. Long, J. Jiang, X. Chang, and C. Zhang, “Con- necting the dots: Multivariate time series forecasting with graph neural networks,” inProceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2020, pp. 753– 763

    2020

  21. [21]

    Spatio-temporal graph convolutional net- works: A deep learning framework for traffic forecasting,

    B. Yu, H. Yin, and Z. Zhu, “Spatio-temporal graph convolutional net- works: A deep learning framework for traffic forecasting,” inProceed- ings of the 27th International Joint Conference on Artificial Intelligence (IJCAI), 2018, pp. 3634–3640

    2018

  22. [22]

    Attention is all you need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,” inAdvances in Neural Information Processing Systems (NeurIPS), vol. 30, 2017

    2017

  23. [23]

    Informer: Beyond efficient transformer for long sequence time-series forecasting,

    H. Zhou, S. Zhang, J. Peng, S. Zhang, J. Li, H. Xiong, and W. Zhang, “Informer: Beyond efficient transformer for long sequence time-series forecasting,” inProceedings of the AAAI Conference on Artificial Intelligence (AAAI), 2021, pp. 11 106–11 115

    2021

  24. [24]

    Time-series anomaly detection service at Microsoft,

    H. Ren, B. Xu, Y . Wang, C. Yi, X. Huang, J. Kou, T. Xing, M. Yang, J. Tong, and Q. Zhang, “Time-series anomaly detection service at Microsoft,” inProceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2019, pp. 3009– 3017

    2019

  25. [25]

    TFANet: Time-frequency awareness network for industrial systems,

    J. Liuet al., “TFANet: Time-frequency awareness network for industrial systems,”Sensors, vol. 24, no. 18, 2024

    2024

  26. [26]

    Estimating and interpreting the instantaneous frequency of a signal,

    B. Boashash, “Estimating and interpreting the instantaneous frequency of a signal,”Proceedings of the IEEE, vol. 80, no. 4, pp. 520–538, 1992

    1992

  27. [27]

    Graph attention networks,

    P. Veli ˇckovi´c, G. Cucurull, A. Casanova, A. Romero, P. Li `o, and Y . Bengio, “Graph attention networks,” inInternational Conference on Learning Representations (ICLR), 2018

    2018

  28. [28]

    MAD-GAN: Multivariate anomaly detection for time series data with generative adversarial networks,

    D. Li, D. Chen, L. Shi, B. Jin, J. Goh, and S.-K. Ng, “MAD-GAN: Multivariate anomaly detection for time series data with generative adversarial networks,” inInternational Conference on Artificial Neural Networks (ICANN). Springer, 2019, pp. 703–716

    2019

  29. [29]

    Deep one-class classification,

    L. Ruff, R. A. Vandermeulen, N. G ¨ornitz, L. Deecke, S. A. Siddiqui, A. Binder, E. M ¨uller, and M. Kloft, “Deep one-class classification,” inInternational Conference on Machine Learning (ICML), 2018, pp. 4393–4402

    2018

  30. [30]

    Deep autoencoding gaussian mixture model for unsu- pervised anomaly detection,

    B. Zong, Q. Song, M. R. Min, W. Cheng, C. Lumezanu, D.-k. Cho, and H. Chen, “Deep autoencoding gaussian mixture model for unsu- pervised anomaly detection,” inInternational Conference on Learning Representations (ICLR), 2018

    2018

  31. [31]

    A multimodal anomaly detector for robot-assisted feeding using an LSTM-based variational autoencoder,

    D. Park, Y . Hoshi, and C. C. Kemp, “A multimodal anomaly detector for robot-assisted feeding using an LSTM-based variational autoencoder,” IEEE Robotics and Automation Letters, vol. 3, no. 3, pp. 1544–1551, 2018

    2018

  32. [32]

    Timeseries anomaly detection using temporal hierarchical one-class network,

    L. Shen, Z. Li, and J. T. Kwok, “Timeseries anomaly detection using temporal hierarchical one-class network,” inAdvances in Neural Infor- mation Processing Systems (NeurIPS), vol. 33, 2020

    2020

  33. [33]

    A novel anomaly detection scheme based on principal component classifier,

    M.-L. Shyu, S.-C. Chen, K. Sarinnapakorn, and L. Chang, “A novel anomaly detection scheme based on principal component classifier,” in Technical Report, University of Miami, Dept. of Electrical and Computer Engineering, 2003

    2003

  34. [34]

    C. C. Aggarwal,Outlier Analysis, 2nd ed. Springer, 2015

    2015