Online Conditional KAN-Based Forecasting for Practical Time-Series Anomaly Detection

Introduction:
Time-series anomaly detection in operational environments requires models that generate timely alerts while adapting to contextual changes and evolving normal behaviour. However, many forecasting-based detectors are evaluated offline, ignore side information, and remain vulnerable to concept drift and unstable thresholds. We propose an online conditional forecasting framework based on Kolmogorov–Arnold Networks (KANs) for streaming anomaly detection. Its central innovation is a lightweight KAN architecture that represents normal temporal dynamics through smooth Fourier-parameterized univariate functions and efficiently adapts their coefficients online.

Methods:
At each time step, the framework forecasts the expected observation using only past data and derives an anomaly score from the residual. A conditioning module incorporates calendar variables and operational side information, enabling the model to distinguish genuine anomalies from expected context-dependent changes. Gradual concept drift is addressed through exponential moving-average updates and periodic fine-tuning on high-confidence normal windows. Adaptive thresholding and population-level score aggregation stabilize alerts, while residual and KAN-component contributions provide interpretable evidence. The framework is evaluated on univariate and multivariate benchmarks and controlled concept-drift and conditional-anomaly scenarios.

Results:
The framework preserves the computational efficiency of lightweight KAN-based forecasting while improving operational performance relative to batch baselines. It produces fewer false alerts under expected contextual variation, detects anomalies faster after onset, and maintains more stable performance under gradual distribution shifts. Ablation studies quantify the contributions of conditional information, online updating, and adaptive thresholding.

Conclusions:
The results demonstrate that smooth, coefficient-adaptive KAN forecasting provides an effective foundation for practical anomaly-detection systems. Combining online learning, contextual conditioning, adaptive thresholding, and interpretable component-level evidence supports anomaly detection that is streaming, context-aware, adaptive, computationally efficient, and interpretable.