In one embodiment, a device receives data indicative of packet arrival times at a plurality of nodes along a path in a deterministic network. The device compares the packet arrival times to their corresponding scheduled delivery intervals in a deterministic communication schedule used by the nodes along the path. The device detects, using a machine learning-based anomaly detector, a time synchronization anomaly based on the comparisons between the packet arrival times and their scheduled delivery intervals. The device causes performance of a mitigation action in the network based on the detected time synchronization anomaly.