Llm guidance improves time series anomaly detection accuracy
LEARN-TS: LLM-Enhanced Alignment and Reconstruction with Normality Guidance for Multivariate Time-Series Anomaly Detection
Machine Learning
Summary
Detecting unusual patterns in time-based data can be tricky because small normal changes might look like problems. The authors created a method that uses a large language model to give helpful context without needing exact matching text descriptions. Their approach separates general normal behavior from specific time window details to better spot when something is truly abnormal. Tests show this method works well across different datasets, giving more reliable detection than previous techniques.
What this means in practice
- •For industrial monitoring teams: Improve anomaly detection in sensor data streams without requiring exact textual annotations of events.
- •For finance risk analysts: Identify unusual market or portfolio behaviors using time-series data enhanced by semantic normality references from language models.
Authors
Jahyeob Koo, Kio Yun, Byoungmo Koo, Jun-Geol Baek
Abstract
Reconstruction errors in multivariate time-series anomaly detection may not reliably distinguish abnormal behavior from benign deviations. Language-derived semantics offer complementary context, but existing multimodal approaches may rely on time-associated paired textual information that is difficult to obtain consistently and is not provided by standard multivariate time-series anomaly detection benchmarks. This setting poses two challenges: (1) conditioning masked reconstruction on window-specific semantics without exposing exact numerical targets or anomaly-specific cues, and (2) using a window-independent concept of normality as a complementary semantic reference rather than an independent anomaly detector. We propose LLM-Enhanced Alignment and Reconstruction with Normality Guidance for Time Series (LEARN-TS), which uses a frozen language model to construct two role-separated semantic representations without requiring temporally paired external text. Window-specific observation semantics encode temporal and cross-variable context without exact numerical values to guide channel-shared patch-masked reconstruction. A fixed, dataset-agnostic normality prompt provides a window-independent semantic reference for aligning normal representations and estimating normality discrepancy. At inference, masking each temporal patch once yields timestamp-level reconstruction evidence, conditionally modulated by discrepancy from a separate unmasked view. Across four benchmarks, LEARN-TS achieves the highest mean performance in 13 of 16 dataset-metric comparisons. Controlled ablations examine observation conditioning, joint normality alignment and scoring, and reference content, showing dataset-dependent ranking benefits and modest average gains from semantic over random references.