Anomaly Detection

Why SNNs for anomaly detection

Anomaly detection on edge devices has a hard constraint: the device runs continuously, on battery, without offloading data. An SNN has a key operational property: in normal conditions, the input is nominal, the membrane potentials stay near baseline, and the network fires sparsely. Power consumption is proportional to spike count — which is low. When a fault occurs, the signal deviates, more spikes are generated, and the anomaly is detected. This is the inverse of the problem on a GPU, where “computing nothing” costs the same as computing something.

Problem setup

A 128-channel sensor array monitors an industrial system (motor drive, airframe, reactor coolant loop). Normal operation is a compact, approximately Gaussian region of the state space. Three fault modes perturb disjoint sensor clusters in characteristic patterns.

Class	Label	Channels	Signal
Normal	0	all	Gaussian (σ ≈ 0.8)
Fault A — bearing wear	1	0–31	elevated +3σ
Fault B — overheating	1	48–79	elevated +5σ
Fault C — supply fault	1	96–127	suppressed −5σ → near-silent

Training uses a 50/50 balance between normal and anomaly samples — standard practice for learning discriminative fault features without majority-class collapse. Testing uses a 15% anomaly rate, matching a realistic operational distribution.

Architecture

Sensor readings are normalised with tanh(x) and rate-encoded over T = 100 timesteps. The SNN classifies the encoded spike train:

Dense(128 → 256) → LIF(τ_mem=10ms, threshold=1.0)
Dense(256 →  64) → LIF(τ_mem=10ms, threshold=1.0)
Dense( 64 →   2) → LIF(τ_mem=10ms, threshold=1.0)

Two output neurons: class 0 (normal) and class 1 (anomaly). The anomaly score used for AUROC is the mean firing rate of the anomaly output neuron over T timesteps.

import thrindex.snn as snn

model = snn.Sequential(
    snn.Dense(128, 256),
    snn.LIF(tau_mem=10.0, threshold=1.0),
    snn.Dense(256, 64),
    snn.LIF(tau_mem=10.0, threshold=1.0),
    snn.Dense(64, 2),
    snn.LIF(tau_mem=10.0, threshold=1.0),
)

Why τ_mem = 10 ms? Sensor readings are largely non-periodic — a short time constant keeps each timestep’s contribution independent, preventing the membrane from integrating irrelevant temporal context across T = 100 steps.

Encoding

Sensor values are normalised to [0, 1] using tanh, then rate-encoded:

import torch
import thrindex.encoders as encoders

# x: [batch, 128] — raw sensor readings
x_norm = (x.tanh() + 1.0) / 2.0       # squash to [0, 1]

gen = torch.Generator()
gen.manual_seed(0)
spikes = encoders.rate(x_norm, T=100, generator=gen)  # [100, batch, 128]

The tanh squash is critical: Fault C suppresses channels to −5σ, which maps to near-zero firing rate (≈ 0.00003) — clearly distinct from the normal-class mean of ≈ 0.50. Plain clamp-to-zero would map to 0.50 and be undetectable.

Training

import torch
import torch.nn.functional as F

optimizer = torch.optim.Adam(model.parameters(), lr=1e-3)
scheduler = torch.optim.lr_scheduler.CosineAnnealingLR(optimizer, T_max=50)

for x, y in train_loader:                       # x: [batch, 128], y: {0, 1}
    x_norm = (x.tanh() + 1.0) / 2.0
    spikes = encoders.rate(x_norm, T=100, generator=gen)  # [100, batch, 128]
    out = model(spikes)                          # [100, batch, 2]
    rates = out.mean(dim=0)                      # [batch, 2]
    loss = F.cross_entropy(rates, y)
    loss.backward()
    torch.nn.utils.clip_grad_norm_(model.parameters(), 5.0)
    optimizer.step()
    optimizer.zero_grad()
scheduler.step()

No class weighting is needed when training on balanced data. The cosine LR schedule stabilises convergence in the final epochs.

Running the template

pip install thrindex
python templates/anomaly-detection/train.py --epochs 50

No external dataset download required. Training for 50 epochs on CPU takes roughly 5–8 minutes.

Results

Committed floor: AUROC ≥ 0.90

Run	Epochs	Best AUROC
thrindex M5 (seed 0, measured)	30	0.9999

The floor is cleared by epoch 2. The model achieves near-perfect separation on the synthetic distribution — each fault mode shifts distinct sensor clusters far enough from the normal mean that the Dense weights quickly learn to isolate them. For real industrial datasets (CWRU bearing, MIMII, SKAB), expect AUROC in the 0.90–0.99 range depending on fault severity and class balance.

Compile and run

import thrindex as thx

thx.compile(model, "templates/anomaly-detection/model.thx")

thrindex run templates/anomaly-detection/model.thx

Three labelled samples are bundled in templates/anomaly-detection/samples/: one normal, one Fault A, one Fault B.

Adapting to real datasets

Replace the data generator with your data loader. Ensure sensor values are passed through tanh normalisation before encoders.rate.

Class imbalance > 90/10: balance the training set (oversample anomaly) or add class weights:

n_normal = (labels == 0).float().sum()
n_anom = (labels == 1).float().sum()
weight = torch.tensor([1.0, float(n_normal / n_anom)])
loss = F.cross_entropy(rates, labels, weight=weight.to(device))

Tune τ_mem to sensor periodicity — for vibration data at 12 kHz, T should cover at least one full period.
Real-world references:

Why this is a canonical neuromorphic use case

Always-on, low power: the SNN is quiet when the system is healthy — only faults generate elevated spike activity
Event-driven: the model can be clocked at sensor rate rather than a fixed compute cycle
On-device decision: no telemetry or cloud round-trip needed
Calibratable: the decision threshold is a scalar, adjustable in production without retraining

At ~50% normal-class firing rate and Dense(128 → 256) as the dominant cost layer, the SNN consumes roughly 2× fewer synaptic operations than an equivalent frame-based model when the system is in a healthy state.

Getting Started

Tutorials

Concepts

Systems

API Reference

Errors

Benchmarks

Conformance

Anomaly Detection

Why SNNs for anomaly detection

Problem setup

Architecture

Encoding

Training

Running the template

Results

Compile and run

Adapting to real datasets

Why this is a canonical neuromorphic use case

​Why SNNs for anomaly detection

​Problem setup

​Architecture

​Encoding

​Training

​Running the template

​Results

​Compile and run

​Adapting to real datasets

​Why this is a canonical neuromorphic use case

Why SNNs for anomaly detection

Problem setup

Architecture

Encoding

Training

Running the template

Results

Compile and run

Adapting to real datasets

Why this is a canonical neuromorphic use case