用大模型上下文学习实现跨模态异常检测,一次部署通吃多种场景。
ICAD-LLM: One-for-All Anomaly Detection via In-Context Learning with Large Language Models
- 基于上下文学习构建统一框架,直接处理时序、日志、表格等多模态数据。
- 在多个未见任务上表现媲美专用模型,无需重新训练即可快速适配新环境。
- 首个可跨领域、跨模态通用异常检测的模型,适合需要快速部署的工业场景。
异常检测(AD)在众多领域具有关键意义。现代系统常产生多样且相互关联的异构数据(如时间序列、系统日志、表格记录),要求AD方法具备两大能力:(1)在统一框架下处理多种数据格式,实现多模态一致性检测;(2)强泛化能力,无需大量重训即可适应新场景。然而现有方法多聚焦单一模态,缺乏跨域灵活性。为此,我们提出全新范式——上下文异常检测(ICAD),将异常定义为与正常参考样本的差异性。在此范式下,我们设计ICAD-LLM,利用大语言模型的上下文学习能力,在单一模型中处理异构数据。大量实验表明,ICAD-LLM性能媲美专用方法,并展现出对未见任务的强大泛化能力,显著降低部署成本,支持快速环境适配。据我们所知,ICAD-LLM是首个能跨领域、跨模态执行异常检测的模型。
原文摘要 · Abstract (English)
Anomaly detection (AD) is a fundamental task of critical importance across numerous domains. Current systems increasingly operate in rapidly evolving environments that generate diverse yet interconnected data modalities -- such as time series, system logs, and tabular records -- as exemplified by modern IT systems. Effective AD methods in such environments must therefore possess two critical capabilities: (1) the ability to handle heterogeneous data formats within a unified framework, allowing the model to process and detect multiple modalities in a consistent manner during anomalous events; (2) a strong generalization ability to quickly adapt to new scenarios without extensive retraining. However, most existing methods fall short of these requirements, as they typically focus on single modalities and lack the flexibility to generalize across domains. To address this gap, we introduce a novel paradigm: In-Context Anomaly Detection (ICAD), where anomalies are defined by their dissimilarity to a relevant reference set of normal samples. Under this paradigm, we propose ICAD-LLM, a unified AD framework leveraging Large Language Models' in-context learning abilities to process heterogeneous data within a single model. Extensive experiments demonstrate that ICAD-LLM achieves competitive performance with task-specific AD methods and exhibits strong generalization to previously unseen tasks, which substantially reduces deployment costs and enables rapid adaptation to new environments. To the best of our knowledge, ICAD-LLM is the first model capable of handling anomaly detection tasks across diverse domains and modalities.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。