用大模型生成漏洞利用代码,自动增强异常检测器的鲁棒性。
LLM as an Algorithmist: Enhancing Anomaly Detectors via Programmatic Synthesis
- 让大模型扮演算法设计师,分析检测器缺陷并生成通用合成代码。
- 在36个表格数据集上,显著提升主流异常检测器性能。
- 不接触原始数据,兼顾隐私与可复用性,适合工业级部署。
现有表格数据异常检测方法通常依赖对异常模式的假设,导致在真实场景中表现不一。尽管大语言模型(LLM)具备出色推理能力,但其直接应用于表格异常检测仍面临异构数据处理难和隐私风险高等挑战。为此,我们提出 LLM-DAS 框架,将 LLM 从“数据处理者”重新定位为“算法设计师”。该框架不直接接触原始数据,而是利用 LLM 分析检测器的高层描述,识别其内在弱点,并生成针对特定检测器、数据无关的 Python 合成代码,用于生成“难以检测”的异常样本以利用这些漏洞。该合成程序可跨多种数据集复用,通过将其实例化以扩充训练数据,将原问题转化为更具区分性的二分类任务,系统性提升检测器鲁棒性。在 36 个 TAD 基准上的大量实验表明,LLM-DAS 一致提升了主流检测器的性能。通过程序化合成,该框架实现了基于大模型推理与经典异常检测算法之间的桥梁,提供了一种可扩展、高效且隐私保护的检测器逻辑盲点修补方案。
原文摘要 · Abstract (English)
Existing anomaly detection (AD) methods for tabular data usually rely on some assumptions about anomaly patterns, leading to inconsistent performance in real-world scenarios. While Large Language Models (LLMs) show remarkable reasoning capabilities, their direct application to tabular AD is impeded by fundamental challenges, including difficulties in processing heterogeneous data and significant privacy risks. To address these limitations, we propose LLM-DAS, a novel framework that repositions the LLM from a ``data processor'' to an ``algorithmist''. Instead of being exposed to raw data, our framework leverages the LLM's ability to reason about algorithms. It analyzes a high-level description of a given detector to understand its intrinsic weaknesses and then generates detector-specific, data-agnostic Python code to synthesize ``hard-to-detect'' anomalies that exploit these vulnerabilities. This generated synthesis program, which is reusable across diverse datasets, is then instantiated to augment training data, systematically enhancing the detector's robustness by transforming the problem into a more discriminative two-class classification task. Extensive experiments on 36 TAD benchmarks show that LLM-DAS consistently boosts the performance of mainstream detectors. By bridging LLM reasoning with classic AD algorithms via programmatic synthesis, LLM-DAS offers a scalable, effective, and privacy-preserving approach to patching the logical blind spots of existing detectors.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。