LLM-Detector is proposed, a framework that utilizes the in-context learning capacity of LLMs for structured, prompt-conditioned scoring synthesis, enabling LLMs to derive anomaly detection logic from structured normal-state knowledge.
Abstract
Anomaly detection in tabular data is challenging because abnormal samples often arise as violations of cross-feature dependencies rather than simple marginal deviations. Existing detectors rely on geometric or reconstruction signals, while prior LLM-based approaches mainly fine-tune LLMs with normal samples or generate synthetic anomalies. We propose LLM-Detector, a framework that utilizes the in-context learning capacity of LLMs for structured, prompt-conditioned scoring synthesis, enabling LLMs to derive anomaly detection logic from structured normal-state knowledge. Specifically, normal training data are converted into statistical summaries, causal dependencies, and distilled prototypes that are organized into a prompt for code generation. The resulting scoring engine evaluates statistical deviation, structural inconsistency, and density-based abnormality then computes an anomaly score for each test sample. We evaluate LLM-Detector on 24 tabular datasets, comparing against 15 SOTA baselines. Results show consistent improvements across both mixed-type and continuous-only settings. Moreover, this design eliminates the need for LLM fine-tuning or neural network training, reducing computational cost and enabling practical anomaly detection in real-world tabular systems.
Tabular anomaly detection (TAD), which focuses on identifying abnormal samples that deviate from the majority in tabular data, has received growing attention. Recently, there has been an emerging trend towards unified TAD, which seeks to detect anomalies across different datasets using a single generalizable model. In unified TAD, aligning heterogeneous data remains challenging. While existing methods often rely on distance-based unified feature construction, they may obscure the semantics of the original features. Moreover, existing approaches typically formulate anomaly detection as a binary classification task, which may overlook diverse anomaly patterns from various datasets and be misled by unrepresentative synthetic anomalies. To address these challenges, we propose an in-COntext REconstruction approach for unified TAD (CORE for short). It introduces a decorrelated feature alignment module to directly align heterogeneous features into a unified representation space, which retains their semantic information. Meanwhile, CORE formulates unified TAD as an in-context reconstruction problem, eliminating the need for labeled or synthesized anomalies. Specifically, the in-context reconstruction module reconstructs each sample by leveraging contextual normal samples to capture dataset-specific distributions, such that reconstruction errors reflect its deviation from normality, facilitating unified TAD on arbitrary unseen datasets.
Yunfeng Zhao, Qingfeng Chen, Yue Tan et al.· 0 citations
While deep learning models have achieved state-of-the-art performance in time series anomaly detection, their complex architectures incur substantial inference overhead. Existing methods typically apply a uniform inference strategy across all data points, which is inefficient given that anomalies are inherently scarce and the vast majority of temporal data consists of predictable normal patterns. To mitigate this bottleneck, we propose CARE, a model-agnostic cascaded inference framework that integrates a Lightweight Pre-filter Model (LPM) with an existing high-capacity Complex Detection Model (CDM). The LPM rapidly filters high-confidence normal samples using a Residual MLP AutoEncoder and a Normality-Conditioned Gating mechanism. Crucially, we introduce a Structure Attention module to explicitly capture channel-wise anomaly contributions, and optimize the gating network via a confidence-guided selective routing objective that learns reliable routing decisions to reduce unnecessary CDM invocations. Extensive experiments across eight real-world benchmarks demonstrate that CARE effectively isolates high-confidence normal samples. By routing only uncertain samples to the CDM, our framework achieves $2.7\times$ to $4.8\times$ inference speedup compared to the most accurate SOTA approaches, while still maintaining competitive detection quality.
Zemin Chao, Qian Xu, Jianhe Cen et al.· 0 citations
System logs are widely used for monitoring system reliability and detecting abnormal behaviors in large-scale computing infrastructures. While deep learning has significantly advanced log anomaly detection, most existing methods are confined to in-domain scenarios, relying heavily on abundant system-specific historical data. Consequently, they struggle to monitor newly deployed systems where log data and anomaly labels are severely scarce. Achieving robust cross-system log anomaly detection remains a challenge due to inherent domain gaps, including completely different logging structures, continuously evolving templates and severe Out-Of-Vocabulary issues. To bridge these gaps, we propose MeCoLog, a Meta-Contrastive learning method for cross-system log anomaly detection. First, a Hybrid Parameter Embedding is introduced to encode type, value, and key information to handle diverse vocabularies. These embeddings are integrated into the model via a Gated Key Injection mechanism and Rotary Position Embedding. These allow the model to capture both event relevance and execution flow. Second, we design an Asymmetric Prototype Contrastive Learning objective. This method aligns normal behaviors across different systems while strictly isolating anomalies. Together, this design enables MeCoLog to achieve robust performance in few-shot scenarios. Extensive experiments on multiple public log datasets (HDFS, BGL, Thunderbird, Hadoop and AIT-LDS v2.0) demonstrate that MeCoLog consistently outperforms state-of-the-art baselines under few-shot cross-system settings, offering a robust and highly transferable solution for real-world log anomaly detection.
Manh Tuan Nguyen, Tuan Phong Tran, Le Dinh Trang Dang et al.· PLoS ONE· 0 citations
Automated anomaly detection methods often report strong performance on curated academic benchmarks, but their behavior under real-world industrial conditions is less clear. In this work, we evaluate 19 unsupervised anomaly detection models on the BowTie dataset, a challenging manufacturing dataset with reflective surfaces, subtle defects, and profile-specific variation. In contrast to benchmark results, we observe that model performance is less stable than typically reported on standard benchmarks such as MVTec AD, highly sensitive to preprocessing, and inconsistent across conditions, with no single approach emerging as uniformly robust; a consensus audit further indicates that nominal-data quality affects deployment. Motivated by these findings, we developed and initially deployed a unified human-in-the-loop framework for manufactured-part inspection that combines image annotation, AI-assisted defect detection, and an integrated validation engine, replacing a prior manual visual inspection and documentation workflow. The system supports heatmap-guided defect review, SAM-refined candidate regions for inspector acceptance, rejection, or boundary adjustment, mask evaluation where annotations exist, and review history for inspector consistency and onboarding. Together, the results highlight the gap between benchmark performance and deployment reality, and provide a practical framework for addressing it.
Mike Szklarzewski, CJ George, Gavin Smithson et al.· 0 citations
Detecting anomalies in time-series data has significant implications in various domains, including the early detection of equipment and facility conditions in industrial settings and the identification of risk factors in financial markets. However, sensor-based time-series data obtained from real-world sites predominantly consist of normal patterns, with anomalies being extremely rare, resulting in insufficient data for model training. In this paper, we present a method that addresses the imbalance between normal and anomaly data by transforming time-series data into a structured sentence format and using a large language model to generate and augment diverse anomaly scenarios. The generated sentences are then converted back into time-series data and subjected to an internal validation process. This approach enables the construction of a broader range of anomaly data than existing techniques.The proposed method is designed for univariate, continuous valued time-series and is anticipated to serve as an effective data augmentation tool, with extension to broader domains left to future work.
Geunho Lee, Jieun Lee, Tae-yong Kim et al.· Applied Sciences· 0 citations
Visual industrial anomaly detection has evolved from one-class modeling to more challenging multi-class settings, where diverse categories and complex visual patterns must be jointly handled. Existing approaches often assume that anomalies lie far from normal samples in feature or spatial space. However, this assumption frequently fails due to two key issues: cross-class semantic confusion, where normal structures of one category are misclassified as anomalies in another, and pixel similarity failure, where anomalous regions visually blend into normal backgrounds. To address these challenges, we propose RPGAD (Region-Prompt Guided Anomaly Detection), an information-theoretic framework that models anomalies as semantic predictive instability, reflected in the joint responses of dual paths. RPGAD integrates two components: 1) DPENet (Dual-Path regional Energy evaluation Network), which compares region-level responses across normal-only and mixed paths through an entropy-guided energy formulation to generate robust region prompts; and 2) RDNet (Reverse Distillation Network), which selectively reconstructs prompted regions and employs a Prototype-Contrastive Optimal Transport (PCOT) loss to enhance inter-class separability and local feature aggregation. Experiments on five anomaly detection benchmarks - MVTecAD, VisA, BTAD, MPDD, and Real-IAD - demonstrate the effectiveness of RPGAD. At $256 \times 256$ resolution, RPGAD achieves strong overall performance, with mAD of 87.8%, 80.3%, 85.2%, 86.2%, and 77.7% on five benchmarks, and pixel-level AP and F1-max gains of up to 12.2 and 10.4 points over strong baselines. These results confirm that RPGAD provides accurate and robust multi-class anomaly detection and localization in complex visual scenarios.