FORGE: An Interpretable Framework for LLM-Assisted Log Anomaly Detection

Abstract

System log anomaly detection (LogAD) requires balancing detection quality, interpretability, and deployment efficiency. While deep learning approaches achieve strong performance, they often rely on large labeled datasets and lack transparency. Recent large language model (LLM)-based methods improve reasoning but introduce high inference cost and nondeterministic behavior, limiting their practicality for real-time monitoring. We present FORGE, a framework that uses LLMs strictly in an offline stage to refine an interpretable statistical baseline. Instead of replacing the detector, FORGE uses LLMs to generate structured suppression and detection rules that correct the baseline’s false positives and false negatives. The rules are compiled into a directed acyclic graph, enabling deterministic, auditable, and LLM-free runtime inference with predictable latency and zero per-query model cost. Across four benchmark datasets spanning distributed system and supercomputer logs, FORGE matches or improves baseline F1 scores while preserving interpretability and low inference overhead.