AD-LLM: Benchmarking Large Language Models for Anomaly Detection

TL;DR

This paper introduces AD-LLM, a benchmark for evaluating large language models in NLP anomaly detection, exploring zero-shot detection, data augmentation, and model selection, and providing insights into their effectiveness and challenges.

Contribution

It is the first benchmark to systematically evaluate LLMs for NLP anomaly detection across multiple tasks and datasets, highlighting their potential and limitations.

Findings

LLMs perform well in zero-shot anomaly detection

Data augmentation with synthetic data improves detection accuracy

Explaining model selection remains a significant challenge

Abstract

Anomaly detection (AD) is an important machine learning task with many real-world uses, including fraud detection, medical diagnosis, and industrial monitoring. Within natural language processing (NLP), AD helps detect issues like spam, misinformation, and unusual user activity. Although large language models (LLMs) have had a strong impact on tasks such as text generation and summarization, their potential in AD has not been studied enough. This paper introduces AD-LLM, the first benchmark that evaluates how LLMs can help with NLP anomaly detection. We examine three key tasks: (i) zero-shot detection, using LLMs' pre-trained knowledge to perform AD without tasks-specific training; (ii) data augmentation, generating synthetic data and category descriptions to improve AD models; and (iii) model selection, using LLMs to suggest unsupervised AD models. Through experiments with different datasets, we find that LLMs can work well in zero-shot AD, that carefully designed augmentation methods are useful, and that explaining model selection for specific datasets remains challenging. Based on these results, we outline six future research directions on LLMs for AD.