PaperlayerView exact revision on arXiv

Source-linked AI summary

Too Sure to Be Safe: Model Calibration for Reliable Log Anomaly Detection

Bin Li, Dongdong Wang, Siyang Lu

arXiv:2608.17965v1cs.LGcs.AIcs.SE

TL;DR

Language model-based log anomaly detectors can be highly overconfident on erroneous predictions despite strong conventional calibration scores, undermining confidence reliability. LoRD is a route-aware post-hoc calibration framework that reduces overconfident errors while preserving anomaly detection performance across benchmark datasets and detectors.

  • Problem

    Language model-based log anomaly detectors remain persistently overconfident on erroneous anomaly predictions, while conventional calibration metrics can indicate moderate calibration and obscure this reliability gap.

  • Method

    LoRD learns route-specific reliability models from detector latent representations and uses reconstruction distances to selectively recalibrate high-risk predictions.

  • Results

    Across multiple benchmark datasets and representative detectors, LoRD reduces confidence on misclassified anomalous samples and improves calibration reliability without sacrificing anomaly detection performance.

  • Takeaways & Limitations

    Route-aware post-hoc calibration can improve the operational reliability of log anomaly detection by suppressing overconfident errors while preserving reliable predictions.

  • Takeaways & Limitations

    LoRD requires detector hidden representations and may be less stable when route-specific false positives or false negatives are rare.

Abstract

from arXiv · show

Online log anomaly detection is critical for maintaining the reliability of large-scale computing systems. Although recent language model-based log anomaly detectors achieve strong detection performance, their confidence estimates remain poorly calibrated. We show that these detectors frequently assign excessive confidence to incorrect predictions, particularly for anomalous logs under severe class imbalance. Moreover, confidence on erroneous predictions remains persistently high even when conventional calibration metrics indicate good calibration, creating a critical reliability gap for operational monitoring systems. To address this issue, we propose Log Reconstruction and Distance (LoRD), a lightweight post-hoc calibration framework for reliable log anomaly detection. LoRD learns prediction-route-specific reliability models from latent representations of correctly classified validation samples and estimates prediction reliability through route-wise reconstruction distances. Based on the estimated reliability, LoRD selectively recalibrates high-risk predictions to suppress overconfident errors while preserving reliable predictions. Extensive experiments on four large-scale log benchmark datasets and multiple language model-based detectors demonstrate that LoRD consistently improves confidence reliability and substantially reduces overconfident anomaly-related errors without sacrificing anomaly detection performance.

I. INTRODUCTION

Supervised language model-based log anomaly detectors can be highly accurate yet remain overconfident when wrong, creating a reliability gap for operational monitoring. The paper introduces LoRD, a lightweight post-hoc framework that uses route-specific latent reconstruction distances to suppress risky confidence while preserving reliable predictions.

  • Motivation: Supervised log anomaly detectors can assign confidence comparable to correct samples to both false positives and false negatives.This shows that detector confidence is not consistently aligned with prediction correctness.
  • Problem: State-of-the-art detectors exhibit persistent overconfidence on erroneous anomaly predictions despite strong performance under conventional calibration metrics.The paper identifies this as a systematic reliability issue across analyses of history window length, LoRA rank, model complexity, and class imbalance.
  • Method: LoRD learns prediction-route-specific reconstruction models from correctly classified validation representations and uses reconstruction distances as reliability signals.Separate normal- and anomalous-prediction routes reflect their different error patterns and support asymmetric calibration objectives.
  • Method: LoRD selectively recalibrates high-risk predictions, suppressing overconfident errors while preserving reliable predictions and detection performance.The framework is designed as a lightweight post-hoc calibration method for supervised log anomaly detectors.
  • Results: Experiments on four large-scale log benchmark datasets and diverse language model-based detectors show consistent improvements in reliability and calibration quality.The results support LoRD’s robustness, effectiveness, and generalizability for reliability-aware log anomaly detection.

II. RELATED WORK · A. Log Anomaly Detection · B. Model Calibration

Related work frames log anomaly detection as a sequence-modeling and text-classification problem spanning semi-supervised, supervised, and language-model-based approaches. Model calibration comprises training-time regularization, uncertainty estimation, and post-hoc probability adjustment, each with distinct operational trade-offs.

  • A. Log Anomaly Detection: Log anomaly detection has become a critical system-log analysis task, with deep neural text-classification models improving detection accuracy and robustness.Sequence modeling techniques are widely used for system log analysis.
  • A. Log Anomaly Detection: Semi-supervised detectors learn normal log patterns and flag deviations, whereas supervised detectors learn discriminative patterns from labeled normal and anomalous sequences.The related work identifies these as the two main methodological lines.
  • A. Log Anomaly Detection: Supervised approaches include convolutional models that capture local patterns at multiple granularities and attention-based recurrent models using semantic log-template representations.These methods are presented as strong supervised log anomaly detection approaches.
  • A. Log Anomaly Detection: Recent work adapts pretrained language models, including BERT and LLaMA-based frameworks with projectors and LoRA, for semantic log encoding and anomaly classification.The passage describes LogLLM as one representative language-model-based framework.
  • B. Model Calibration: Model calibration seeks to align predictive confidence with empirical correctness and broadly includes regularization-based training, uncertainty estimation, and post-hoc calibration.These three categories organize existing calibration methods.
  • B. Model Calibration: Regularization methods such as label smoothing, confidence penalty, mixup, focal loss, and class-balanced loss reduce overconfidence but require retraining and may alter detection behavior.Their calibration benefits come with changes to the original detector training process.
  • B. Model Calibration: Uncertainty estimation uses Monte Carlo dropout, deep ensembles, or Bayesian neural networks, but often incurs extra computation or multiple forward passes.These requirements make such methods less suitable for lightweight post-hoc calibration.
  • B. Model Calibration: Post-hoc methods adjust probabilities without changing trained parameters; Temperature Scaling, Logistic Scaling, Beta Scaling, and Selective Scaling provide strong calibration baselines.These methods use probability-level mappings or auxiliary calibration models.

III. PRELIMINARIES · A. Problem Formulation · B. Calibration Metrics

The paper formulates supervised log anomaly detection as binary confidence calibration, where anomaly scores become predictions through thresholding. It evaluates reliability with aggregate calibration metrics and the targeted Confidence on Error diagnostic for misclassified samples.

  • A. Problem Formulation: Supervised log anomaly detection is formulated as binary confidence calibration over log instances xi with labels yi ∈{0, 1}.Here, yi = 0 denotes normal samples and yi = 1 denotes anomalous samples.
  • A. Problem Formulation: A detector fθ produces a scalar anomaly confidence score, converted into a predicted label by applying decision threshold τ.The sigmoid function σ(·) maps detector outputs to predicted anomaly confidence pi.
  • A. Problem Formulation: Predictions are categorized as true negatives, false positives, true positives, or false negatives using predicted and ground-truth labels.This categorization supports systematic analysis of confidence and calibration across correct and incorrect anomaly predictions.
  • B. Calibration Metrics: NLL evaluates probabilistic prediction quality through likelihood assigned to ground-truth labels, with lower NLL indicating better calibrated confidence estimates.Accuracy and F1 score are also evaluated alongside confidence calibration metrics.
  • B. Calibration Metrics: ECE measures the discrepancy between prediction confidence and empirical accuracy by partitioning predictions into M fixed-width confidence bins.For each bin, empirical accuracy and average confidence are compared.
  • B. Calibration Metrics: BS measures mean squared error between predicted probabilities and ground-truth labels, reflecting both calibration and class discrimination.Unlike ECE, BS directly penalizes probability estimation errors, but aggregation over all predictions can overlook rare critical mispredictions.
  • B. Calibration Metrics: CoE measures average confidence on misclassified samples and isolates overconfidence on failure cases.A high CoE signals systematic overconfidence on mistakes, including missed abnormal cases with high operational cost.

IV. EMPIRICAL ANALYSIS OF CONFIDENCE CALIBRATION IN LOG ANOMALY DETECTION · A. History Length

With stride fixed at 1, history length has little effect on predictive performance but noticeably changes conventional calibration metrics. CoE remains high across settings, ranging from 0.90 to 0.98.

  • A. History Length: A. History Length: Acc stays above 98% and F1 above 0.84 across all history-length settings.The sliding-window stride is fixed to 1.
  • A. History Length: A. History Length: ECE and Brier score vary noticeably as context length changes.These changes occur despite only modest variations in predictive performance.
  • A. History Length: A. History Length: CoE remains consistently high, ranging from 0.90 to 0.98.The analysis varies sliding-window history size while fixing the stride to 1.

B. LoRA Rank … F. Characterizing Error Confidence

Across adaptation capacity, model complexity, imbalance strategies, and detector classes, predictive performance or conventional calibration metrics can improve while confidence on erroneous predictions remains high. The strongest disparities occur for anomaly-related mistakes, motivating error-confidence-focused calibration analysis.

  • B. LoRA Rank: F1 rises from 0.61 at LoRA rank 4 to 0.94 at rank 32, while calibration-related metrics remain largely unchanged.Increasing LoRA rank improves predictive performance but provides limited benefit for mitigating overconfident errors.
  • B. LoRA Rank: Larger adaptation capacity improves task-specific predictive accuracy, yet highly accurate models still assign near-maximal confidence to misclassified samples.The result shows that improving predictive performance alone is insufficient for reliable confidence estimation.
  • C. Model Complexity: Acc and F1 consistently exceed 0.999 across MLP sizes, while ECE and Brier score remain extremely small.Conventional metrics therefore suggest excellent calibration across model sizes.
  • C. Model Complexity: CoE increases monotonically with model size, rising from 0.90 to nearly 0.99 despite nearly identical performance and conventional calibration metrics.Larger model complexity is associated with higher confidence on errors.
  • D. Solutions for Imbalances: Class-weighted loss reduces CoE from 0.996 to 0.718, outperforming over-sampling, under-sampling, and balanced sampling.The sampling-based methods produce only modest calibration improvements, and error confidence remains consistently high.
  • E. Class-wise Calibration: Abnormal logs have substantially larger ECE, NLL, and Brier scores than normal logs across detectors, indicating less reliable anomaly confidence estimates.The disparity is particularly pronounced for LightLog, NeuralLog, and GPT2.
  • E. Class-wise Calibration: Incorrectly classified abnormal samples often receive confidence exceeding 0.9, whereas incorrectly classified normal samples have substantially lower confidence.This class-wise asymmetry indicates overconfidence in anomaly-related mistakes, especially false negatives.
  • F. Characterizing Error Confidence: Confidence on erroneous predictions frequently exceeds 0.9 even when ECE and Brier score indicate moderate calibration performance.The discrepancy shows that average calibration metrics can mask near-maximal confidence on incorrect predictions.

V. LORD SCALING · A. Representation Learning

LoRD is a lightweight post-hoc calibration framework that estimates prediction reliability from detector latent representations and recalibrates confidence for high-risk predictions while preserving original labels. Its representation-learning module models reliable normal and anomaly predictions separately through route-specific latent manifolds and reconstruction distances.

  • V. LORD SCALING: LoRD improves log anomaly-detection reliability by estimating prediction reliability from latent representations and using reliability scores to recalibrate confidence.The framework is designed to suppress confidence in high-risk predictions while preserving reliable predictions.
  • V. LORD SCALING: High-risk predictions, especially anomalous samples incorrectly predicted as normal, receive lower confidence without changing the detector’s original prediction labels.This objective targets overconfident errors while maintaining the detector’s decisions.
  • A. Representation Learning: Reliable normal and anomaly predictions follow distinct conditional latent distributions, so a single reliability model may obscure route-specific structures.LoRD therefore conditions representation learning on the prediction route and correctness of reliable samples.
  • A. Representation Learning: LoRD learns route-specific reliability models M_r from the conditional latent distributions of correctly predicted samples for routes r ∈ {0, 1}.Each M_r represents the reliable latent manifold associated with prediction route r.
  • A. Representation Learning: For a sample assigned to route y-hat_i, route-specific representation and reconstruction functions generate a reconstructed latent representation.The functions f_r(·) and g_r(·) are implemented as encoder–decoder networks, while alternative architectures remain possible.
  • A. Representation Learning: The reliability distance d_i is defined by reconstruction error and measures deviation from the reliable manifold M_y-hat_i.Small distances indicate alignment with the route’s reliable conditional distribution, whereas large distances indicate atypical latent behavior.
  • A. Representation Learning: False negatives tend to deviate from the reliable normal manifold, while false positives tend to deviate from the reliable anomaly manifold.These route-aware deviations provide a unified measure of prediction reliability.

B. Route-Aware Reliability Partitioning

LoRD partitions predictions into route-specific reliability regions using distances from reliable manifolds and thresholds selected for operational risk. The resulting regions distinguish likely reliable predictions, unreliable errors, and uncertain cases differently for normal and abnormal routes.

  • Route-specific calibration regions: LoRD constructs route-specific calibration regions from reliability distance to the corresponding reliable manifold.It learns route-specific thresholds to capture route-dependent error patterns.
  • Distance-based partitioning: Each prediction route is partitioned into low-, mid-, and high-distance regions using two learned thresholds.The thresholds are selected on the validation set for each route.
  • Operational risk controls: Operational risk tolerance determines route-specific target recall R_r and flagged rate ρ_r: larger R_r increases unreliable-prediction coverage, while smaller ρ_r limits unnecessary calibration.These parameters control the trade-off between identifying unreliable predictions and preserving reliable samples.
  • Route-specific priorities: The normal route prioritizes false-negative coverage, whereas the abnormal route prioritizes preserving reliable anomaly alarms.Route-specific priorities reflect different operational risks for normal and abnormal predictions.
  • Distance-based reliability interpretation: Small distances indicate likely reliable true negatives or true positives, while large distances indicate likely false negatives or false positives on normal or abnormal routes, respectively.Mid-distance samples are treated as uncertain.

C. Calibration Policies · D. Algorithm

LoRD defines a route- and reliability-region-specific, label-preserving calibration policy that selectively adjusts confidence without changing predicted labels. Its algorithm models trustworthy latent representations separately for normal and abnormal prediction routes to support route-specific reliability calibration.

  • C. Calibration Policies: LoRD assigns each route-region combination a calibration action, leaving uncertain predictions unchanged while adjusting confidence in reliable and high-risk regions.The policy increases confidence for samples likely to be safe logs and suppresses confidence for samples likely to be anomalous.
  • C. Calibration Policies: LoRD defines π(r, z) using prediction route r and reliability-distance region z, recalibrating confidence while preserving the detector’s original predicted label.Calibration changes the confidence score but does not recompute the predicted label.
  • C. Calibration Policies: The Identity policy leaves confidence unchanged, whereas HardAssign directly assigns and SoftPull gradually moves confidence toward a route-region target.The target confidence is 1 in the normal low-distance region, approaches 0.5 + ϵ in the normal high-distance region, approaches 1 in the abnormal low-distance region, and equals 0.5 + ϵ in the abnormal high-distance region.
  • C. Calibration Policies: SoftPull determines adjustment strength using distance to the nearest calibration boundary.The boundary distance is denoted by ∆i, and s is a scale parameter determined by the corresponding margin.
  • C. Calibration Policies: Samples near a calibration boundary receive milder adjustments, whereas farther samples are pulled more strongly toward the selected target confidence.HardAssign instead directly sets the recalibrated confidence.
  • D. Algorithm: Algorithm 1 summarizes LoRD’s route-specific confidence calibration framework, which models reliable latent representations separately for normal and abnormal routes.The algorithm treats the two prediction routes separately when learning reliability information.
  • D. Algorithm: The base detector produces predicted labels, confidence scores, and hidden representations on a validation set before route-specific reliability modeling begins.For each route r ∈ {0, 1}, correctly classified samples are route-reliable instances, while misclassified samples form the route-error set.
  • D. Algorithm: LoRD trains a separate autoencoder for each route on reliable samples’ latent representations to learn the characteristic feature distribution of trustworthy predictions.The supplied algorithm passage describes route-specific autoencoder training on correctly classified validation representations.

VI. EXPERIMENTS … C. Baseline Calibration Methods

The experiments evaluate LoRD across four large-scale log datasets and five supervised anomaly detectors, comparing it with five post-hoc calibration baselines. The baselines use temperature, affine, probability-level, selective, or ensemble-based calibration, with parameters optimized on validation data.

  • A. Datasets: Experiments use BGL, Spirit, Liberty, and Thunderbird, whose anomaly ratios range from 0.49% to 32.01%.The evaluation uses 4.7M BGL messages, 5M each from Spirit and Liberty, and 10M from Thunderbird.
  • A. Datasets: Chronological splits separately support detector training, validation, calibrator training, threshold selection, and final test evaluation.Detector-validation data can serve as a fallback when route-specific validation errors are unavailable in selector-validation data.
  • B. Log Anomaly Detectors: The study evaluates five supervised log anomaly detectors spanning conventional deep learning and language model-based approaches, including TextCNN, LogRobust, LightLog, and NeuralLog.The supplied passage identifies TextCNN’s multi-scale convolutions, LogRobust’s attention-enhanced bidirectional recurrent network, and LightLog’s compressed semantic representations with temporal convolution.
  • C. Baseline Calibration Methods: Temperature Scaling calibrates confidence with pTS_i = softmax(z_i/T), where T is optimized on a validation set.This is one of the five representative post-hoc calibration methods compared with LoRD.
  • C. Baseline Calibration Methods: Logistic Scaling generalizes temperature scaling through a learnable affine transformation, pLS_i = softmax(w⊙z_i + b).Its calibration parameters are optimized using validation data.
  • C. Baseline Calibration Methods: Beta Scaling performs probability-level calibration using pBS_i = σ(a log p_i + b log(1 − p_i) + c).It is included among the representative post-hoc calibration baselines compared with LoRD.
  • C. Baseline Calibration Methods: Selective Scaling applies separate temperatures to high-risk and low-risk predictions using confidence, entropy, or logit-margin signals.This method calibrates selected prediction groups according to output-level risk indicators.
  • C. Baseline Calibration Methods: Ensembling averages predictions from multiple independently trained detectors as a representative post-hoc calibration method.All calibration parameters across the evaluated methods are optimized using the validation set.

D. Results · 1) Performance: · 2) Ablation study:

LoRD improves calibration reliability for log anomaly detection by suppressing overconfident errors while preserving confidence in correctly classified anomalies. Ablations show that route-specific modeling, the reject region, and distance-aware soft calibration each contribute to its overall calibration quality.

  • 1) Performance:: LoRD consistently improves calibration reliability across datasets and base detectors, achieving the lowest CoE in nearly every dataset–model combination.It suppresses overconfident misclassifications without degrading overall discrimination ability.
  • 1) Performance:: LoRD maintains high confidence on correctly classified anomalous samples, as reflected by robust CoC values.This preserves confidence in trustworthy anomaly detections while recalibrating risky predictions.
  • 1) Performance:: Route-wise reconstruction selectively lowers confidence on risky predictions while retaining trustworthy anomaly detections.The resulting calibration trade-off is task-driven and suited to supervised log anomaly detection.
  • 2) Ablation study:: Replacing route-specific autoencoders with a shared SingleAE consistently degrades abnormal calibration across datasets and detectors.With LogRobust on Spirit, Abn. CoE increases from 0.508 to 0.516; with NeuralLog on Liberty, it increases from 0.680 to 0.788.
  • 2) Ablation study:: The ablation evaluates the reject region and distance-aware soft calibration using aggregate measures that summarize multiple calibration objectives.These objectives include preserving confidence on correctly classified samples and suppressing confidence on misclassified samples.
  • 2) Ablation study:: Smaller D and larger C indicate better overall calibration quality.C is defined as a normalized relative score based on the deviation vector and worst achievable deviation vector.
  • 2) Ablation study:: On Spirit with LogRobust, LoRD achieves D = 0.405 and C = 0.783, outperforming w/o Reject with D = 0.468 and C = 0.754.It also outperforms w/o Soft, which obtains D = 0.415 and C = 0.776.
  • 2) Ablation study:: Removing either the reject region or soft calibration consistently degrades overall calibration quality, indicating complementary benefits across datasets and detectors.Similar trends are observed on Liberty and with NeuralLog.

VII. CONCLUSION · VIII. LIMITATIONS

The conclusion presents LoRD as a lightweight, route-aware post-hoc calibration framework that improves log anomaly detection reliability while preserving original detection labels. The limitations concern validation-dependent stability, task-oriented metric trade-offs, whitebox or gray-box requirements, and future extensions to distribution shifts and multi-class diagnosis.

  • VII. CONCLUSION: LoRD’s calibration performance is evaluated with mean COE across benchmark datasets and representative detectors, where lower values indicate better performance.The reported values include standard deviations over multiple runs.
  • VII. CONCLUSION: Ablation studies examine LoRD using LogRobust and NeuralLog base detectors, including average confidence on correctly and incorrectly classified abnormal samples.Additional ablations evaluate the effects of removing the reject region and SoftPull calibration, with lower D and higher C indicating better calibration.
  • VII. CONCLUSION: LoRD trains separate autoencoders for predicted-normal and predicted-anomalous routes to learn reliability signals from detector latent representations.It selectively recalibrates high-risk predictions while preserving the original detection labels.
  • VII. CONCLUSION: Experiments across multiple benchmark datasets and representative detectors demonstrate LoRD’s effectiveness for improving the reliability of real-world log anomaly detection.The framework is characterized as task-oriented and route-aware.
  • VIII. LIMITATIONS: Threshold and margin selection depend on route-specific validation errors, making the calibration boundary potentially less stable when false negatives or false positives are rare.LoRD prioritizes reducing confidence in high-risk errors rather than improving every aggregate calibration metric.
  • VIII. LIMITATIONS: Because LoRD is task-oriented, it may trade off aggregate metrics such as ECE, NLL, or Brier score while targeting overconfident errors.The method requires access to detector hidden representations, making it more suitable for whitebox or gray-box detectors.
  • VIII. LIMITATIONS: Future work will extend LoRD to stronger distribution shifts and multi-class diagnosis.Its current reliance on detector hidden representations limits applicability to detectors without such access.
Loading 2608.17965v1…