Retrieval Augmented Anomaly Detection (RAAD): Nimble Model Adjustment Without Retraining

TL;DR

This paper introduces Retrieval Augmented Anomaly Detection (RAAD), a real-time, human-in-the-loop method that improves anomaly detection accuracy without retraining by leveraging a vector store for model output adjustment.

Contribution

The paper presents a novel retrieval-augmented approach for anomaly detection that enables model adjustment in real-time without retraining, applicable across various data types.

Findings

Effective false positive reduction in real-time scenarios

Applicable to multiple data modalities including images, text, and graphs

Maintains high throughput with improved precision

Abstract

We propose a novel mechanism for real-time (human-in-the-loop) feedback focused on false positive reduction to enhance anomaly detection models. It was designed for the lightweight deployment of a behavioral network anomaly detection model. This methodology is easily integrable to similar domains that require a premium on throughput while maintaining high precision. In this paper, we introduce Retrieval Augmented Anomaly Detection, a novel method taking inspiration from Retrieval Augmented Generation. Human annotated examples are sent to a vector store, which can modify model outputs on the very next processed batch for model inference. To demonstrate the generalization of this technique, we benchmarked several different model architectures and multiple data modalities, including images, text, and graph-based data.