Towards Understanding LLM-Based Log Anomaly Detection: An Empirical Study of Performance, Efficiency, and Robustness
Study finds LLM adaptation strategy, not scale alone, drives log-anomaly detection gaps, cost, and noise robustness.
The authors empirically compare LLM-based log anomaly detection on three public datasets, varying adaptation strategy, architecture, parameter scale, and quantization. Adaptation strategy drives the largest accuracy gaps, while scaling gains differ by dataset. Models with similar detection accuracy can have very different compute cost, and low-bit quantization largely preserves performance in the tested configurations. They also measure robustness under structural, semantic, and label noise at multiple perturbation levels.
- Adaptation strategy produces the largest detection-performance differences.
- Model scaling gains vary across the three public log datasets.
- Similar accuracy can correspond to very different computational cost.
- Low-bit quantization largely preserves detection in the tested setups.
- Robustness is measured under structural, semantic, and label noise.
From the original article
1 min read at arxiv.orgLarge language models (LLMs) have demonstrated promising performance in log anomaly detection, yet how their adaptation strategies, architectures, and deployment configurations affect detection effectiveness remains insufficiently understood.
By Bin Li · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.