A Hybrid Framework for Time Series Anomaly Detection with LLMs

Abstract

Large Language Models (LLMs) are increasingly explored for time series anomaly detection (TSAD), yet their direct use often remains inferior to methods designed specifically for TSAD. In this work, we study whether this limitation arises primarily from weak forecasting or from insufficient exploitation of forecast residuals. Across LLaMA-3.1-8B-Instruct, Mistral-7B, and DeepSeek-R1-Distill-Qwen-7B, we find that parameter-efficient fine-tuning can improve forecasting accuracy, but does not consistently improve anomaly detection under fixed residual thresholding. The primary driver of detection performance is not forecasting quality, but how the resulting residuals are analyzed and refined in subsequent stages. Motivated by this finding, we propose a Forecaster–Detector–Imputer pipeline that restricts the LLM to forecasting normal temporal behavior, applies classical detectors to the resulting residuals using adaptive windowing and contamination-aware thresholding, and refines candidate detections through imputation via a time-series foundation model followed by a second detection pass. The proposed framework reaches F1 = 0.789 with LLaMA and F1 = 0.785 with Mistral, roughly doubling the zero-shot baselines, with results confirmed on an independent NAB benchmark. These results suggest that LLMs are most effective for TSAD when used as forecasting components within a hybrid residual-analysis pipeline, and that the primary bottleneck lies in post-hoc residual exploitation rather than forecasting quality alone.