Simple statistical features and large language models improve anomaly detection
LLM-Generated Feature Pools for Time Series Anomaly Detection
Artificial Intelligence
Summary
Detecting unusual patterns in time series data can be challenging. This paper shows that using a straightforward statistical method combined with features generated by a large language model can improve detection. The authors create small sets of numeric features from data windows and use a robust scoring method to find anomalies. They found that generating feature sets specific to each domain with a language model helps the detection method perform as well as the best existing models. Combining human-crafted and model-generated features gives even better results.
What this means in practice
- •For data engineers: Enhance automated monitoring systems by integrating domain-tailored feature sets from large language models for improved anomaly detection accuracy.
- •For it operations teams: Improve detection of unusual system behavior by using a simple statistical pipeline boosted with language model-generated features specialized for different data domains.
Authors
Youssef Attia El Hili, Malik Tiomoko, Corinne Ancourt
Abstract
We study how far a simple statistical pipeline can go on univariate time series anomaly detection under a strict selection protocol. The method extracts a small pool of statistics over sliding windows, scores each window with a transductive robust (MAD) model, and selects a feature subset per domain on a held-out tuning split. On TSB-AD-U it reaches $0.529$ per-series VUS-PR, above the best neural ($0.45$) and statistical ($0.44$) entries on the public leaderboard and within $0.06$ of the strongest pretrained foundation model, several of which use more supervision than ours. Ablations locate the cause: across three selection strategies and a hindsight oracle the score moves by $0.031$, and across the aggregation grid by $0.096$, while changing the candidate pool moves it by $0.226$. The candidate pool sets the ceiling; the search over it is second-order. We therefore generate a pool per domain by prompting a multimodal LLM with in-context example windows from that domain. The generated pools match the hand-crafted one under matched selection, and the two cover different domains: selecting over their union improves on the generated pool in all twelve generator-seed pairs and lifts the pipeline to $0.588$, matching the performance of the best entry on the leaderboard.