Anomaly Detection

The most fundamental approach, using lightweight statistical models to establish a normal operating baseline. Anomalies are flagged when sensor readings exceed pre-defined static or adaptive thresholds.

• Key Techniques: Z-score analysis, moving average, percentile-based bounds.
• Advantages: Extremely low computational cost, deterministic execution, and minimal memory footprint (often just a few bytes for thresholds).
• Use Case: Ideal for detecting simple, rule-based failures like temperature spikes or pressure drops in industrial monitoring.

A machine learning approach that trains solely on normal data to learn a tight boundary around it. Any new data point falling outside this boundary is classified as an anomaly.

• Common Algorithms: One-Class Support Vector Machine (OC-SVM), Support Vector Data Description (SVDD).
• TinyML Adaptation: Requires significant optimization via quantization and pruning. The inference involves computing a distance or similarity metric to the learned boundary.
• Use Case: Detecting novel fault patterns in vibration data from motors where only healthy operation data is available for training.

Uses a compressed neural network (autoencoder) trained to reconstruct normal input data with minimal error. The model's reconstruction error serves as the anomaly score; high error indicates an outlier.

• Mechanism: The encoder compresses input to a latent-space bottleneck; the decoder reconstructs it. Anomalous patterns are poorly reconstructed.
• TinyML Challenge: The autoencoder architecture must be extremely small. Techniques like depthwise separable convolutions and 8-bit integer quantization are critical.
• Use Case: Identifying subtle, multi-sensor anomalies in complex time-series data from smart bearings or pumps.

An ensemble method efficient for TinyML because it builds binary trees based on random feature splitting rather than distance measures. Anomalies are isolated in fewer splits, resulting in shorter path lengths in the tree.

• Efficiency: Training is non-parametric and can be done offline. Inference involves traversing a few short trees, making it fast and memory-efficient.
• Deployment: The trained forest (a set of split rules) can be implemented as a simple decision function in C, requiring only comparisons and counters.
• Use Case: Effective for high-dimensional sensor data in condition monitoring where anomalies are few and distinct.

Captures time-dependent patterns in sensor streams using micro-optimized recurrent or convolutional networks. These models learn the sequential nature of normal operation and flag deviations.

• Architectures: Tiny GRU/LSTM cells or 1D Convolutional Neural Networks (CNNs).
• Optimization: Weight pruning and projection layers drastically reduce parameters. Fixed-point arithmetic is essential for RNN cells.
• Use Case: Predictive maintenance on sequential data, such as detecting irregular pressure cycles in a hydraulic system or anomalous sound patterns over time.

A memory-based approach where anomaly detection is performed by comparing a new sample to a stored dictionary of normal exemplars in an embedded space. The distance to the k-nearest neighbors determines the anomaly score.

• TinyML Implementation: The exemplar dictionary is stored in Flash memory. The embedding model (e.g., a tiny CNN) and distance metric (e.g., L2) are heavily quantized.
• Trade-off: Accuracy scales with dictionary size, which conflicts with memory limits. Advanced vector quantization techniques are used to compress the dictionary.
• Use Case: Visual anomaly detection on low-resolution camera feeds for security or quality inspection.

A core compression technique for TinyML anomaly detection models. It reduces the numerical precision of weights and activations from 32-bit floating-point to lower bit-width integers (e.g., 8-bit). This drastically shrinks the memory footprint and enables the use of efficient integer arithmetic on microcontrollers, which often lack Floating-Point Units (FPUs). For anomaly detection, careful quantization is required to preserve the sensitivity needed to distinguish subtle deviations from normal patterns.

The critical time delay between sensor input and anomaly prediction output on the device. For real-time fault detection (e.g., in industrial machinery), latency must be reliably low—often measured in milliseconds. This metric is directly impacted by model complexity, hardware speed, and compiler optimizations. Deterministic execution is key; unpredictable latency spikes can cause missed critical events.

The total amount of RAM (for runtime activations) and Flash/ROM (for model weights and code) required by the anomaly detection system. TinyML devices may have only tens to hundreds of kilobytes. The footprint includes:

• The quantized model itself.
• Static buffers for input data and intermediate tensors.
• The runtime inference engine (e.g., TensorFlow Lite Micro). Efficient memory use enables more complex models or leaves room for other application functions.

The primary energy-efficiency metric for battery-powered anomaly detectors. It measures how many predictions the system can make per joule of energy consumed. A high IPJ is essential for long-lived deployments. Optimization involves:

• Selecting ultra-low-power microcontrollers (MCUs).
• Using model compression to reduce compute.
• Leveraging sleep modes and wake-on-event triggers, where the anomaly model itself acts as a sophisticated wake-up circuit.

The capability to adapt a pre-trained anomaly detection model using new data collected on the edge device. This allows the model to personalize to a specific machine's normal behavior or drift over time without sending sensitive sensor data to the cloud. Techniques must be extremely memory- and compute-efficient, often involving lightweight algorithms like few-step gradient descent on a subset of parameters.

The process of combining data from multiple sensors (e.g., accelerometer, temperature, acoustic) using a TinyML model to detect complex anomalies. A fused feature space often provides a more robust representation of "normal" operation than any single sensor. Implementing this on an MCU requires efficient handling of multi-modal, time-synchronized data streams and may use models like multi-input neural networks or classical algorithms like vector concatenation followed by a small neural network.