CoAD — Zhe Zhang

CoAD finds anomalies without labels by training two detectors, each watching a different slice of a system's data, to agree with each other. How often they disagree estimates the false-positive rate, which turns an unsupervised problem into one you can optimise, early-stop and tune. Published in Machine Learning: Science and Technology (2024); I was second of five authors and owned the benchmarks and the LCLS and MNIST applications.

F1 0.86LCLS RF faults, no labels (expert model: 0.90)
96–100%MNIST anomalies recalled, ≤0.5% false alarms
4datasets, synthetic to accelerator

Why

When an RF station at LCLS glitches, the question is whether it hurt the beam. The station's telemetry and downstream beam-position-monitor energy readings fluctuate independently in normal running and only move together in a real fault, but nobody labels those events. A hand-designed detector per subsystem (PRAB 2022) does not scale to thousands of sources, and density- or reconstruction-based unsupervised methods struggle with noisy features and clustered anomalies.

How

One model per input outputs an anomaly probability; a joint event is one both flag. If the inputs are independent given the true label, the models' disagreement rate bounds the false-positive fraction, D = E[ps | not pq] · E[pq | not ps]. Substituting D into the F-beta formula gives an unsupervised score that lower-bounds the true one; it picks thresholds for existing detectors, is the loss for training two small networks end-to-end, and drives early stopping and model selection. The only knob is β: small β keeps the cleanest anomalies, large β collects all of them; the anomaly fraction α enters only as αβ².

Two scatter plots of data value against event index, one for input s and one for input q, each with a dashed threshold line. Points over threshold in only one plot are black stars; points over threshold in both plots at the same event index are red stars. — Figure 1. Two inputs, a threshold on each. Events over threshold in one input only (black stars) are ignored; coincident events (red) count, and the disagreement rate estimates how many are false alarms. Figure adapted from Humble et al., MLST 2024 (arXiv:2301.11368).

Results

On LCLS the subsystem input is one RF station's time series (a sample every ~5 s, 0.5% change trigger); the quality input is seven dispersive-region BPMs at 120 Hz over the 8 s before each event. Two small 1-D CNNs trained without labels reach F1 0.86 against hand labels, near the supervised expert detector and ahead of every unsupervised baseline.

Method	Needs labels	F1
Expert-designed detectors	yes	0.90
Supervised neural network	yes	0.88
OCSVM	no	0.66
DGHL	no	0.64
OmniAnomaly	no	0.80
CoAD	no	0.86

Six pairs of time-series panels from LCLS. Three pairs on the left are examples classified as normal, three on the right as anomalous. In each pair the left panel is the RF station signal over 50 seconds and the right panel is seven beam-position-monitor traces over 8 seconds; the anomalous pairs show a step in the RF signal followed by large excursions in the BPM traces. — Figure 2. LCLS examples classified as normal (left) and anomalous (right): RF station signal, then seven BPM traces. In the last normal case the energy deviation arrives too early to be the station's fault, and the model leaves it alone. Figure adapted from Humble et al., MLST 2024 (arXiv:2301.11368).

Milling (167 cuts, six sensors split acoustic/vibration versus current): F1 0.86 against 0.79–0.80 for VAE, DGHL and OmniAnomaly. Paired MNIST: β = ∞ recalls 99–100% of three anomalous digit classes at 0.5% false alarms; β = 0.05 keeps only the cleanest class (96.3%) with none.

What I did. Second of five authors. The method and theory were led by first author Ryan Humble (Stanford ICME) with corresponding author Daniel Ratner. I benchmarked CoAD against OCSVM, DGHL, OmniAnomaly and VAE, including the adaptations that let single-input methods compete, applied it to the LCLS RF/BPM data and the MNIST task, and polished the API. The LCLS dataset was assembled by the earlier PRAB 2022 team. No public code.

R. Humble, Z. Zhang, F. O'Shea, E. Darve, D. Ratner, "Coincident learning for unsupervised anomaly detection", Machine Learning: Science and Technology 5, 035036 (2024). The group later extended it to RF phase data at LCLS (Liang et al., PRAB 2025), where I am a co-author.