Detecting Time Series Anomalies Like an Expert: A Multi-Agent LLM Framework with Specialized Analyzers

TL;DR

SAGE is a multi-agent LLM framework that enhances time series anomaly detection by decomposing analysis into specialized modules, improving interpretability, reliability, and performance across benchmarks.

Contribution

It introduces a novel multi-agent structure with specialized analyzers and synthetic in-context examples, advancing anomaly detection without relying on labeled anomalous data.

Findings

Achieves state-of-the-art performance on three benchmarks.

Improves detection reliability and diagnostic usefulness.

Outperforms strong ML/DL and language-model baselines.

Abstract

Recent studies have explored large language models for time-series anomaly detection, yet existing approaches often rely on a single general-purpose model to directly infer anomaly indices or intervals, limiting controllability, interpretability, and reliability for complex anomaly patterns. We propose SAGE (Specialized Analyzer Group for Expert-like Detection), a multi-agent framework for structured anomaly diagnosis in univariate time series. It decomposes anomaly analysis into four specialized Analyzers for point, structural, seasonal, and pattern anomalies. Each Analyzer applies family-specific numerical tools and diagnostic visualizations to generate evidence, while an evidence-grounded Detector consolidates the evidence into confidence-scored anomaly records with intervals and candidate types. A Supervisor then converts these structured records into analyst-facing diagnostic reports. SAGE further constructs synthetic in-context examples from normal-reference training segments, without using real anomalous segments or anomaly-type labels as in-context examples. Across three benchmarks, SAGE achieves the best average performance among strong ML/DL and language-model-based baselines. Ablation studies and human evaluation further show that the proposed framework improves detection reliability and the practical usefulness of diagnostic outputs.