PaperlayerView exact revision on arXiv

Source-linked AI summary

Structured Frequency-Domain Evidence for LLM-Based Time-Series Anomaly Detection

Jungwook Seo, Sangwon Son, Minjeong Kim, Seungmin Han, Seojin Yoo, Sungyong Baik

arXiv:2608.24113v1cs.LGcs.AI

TL;DR

LLM-based TSAD often leaves spectral structure implicit, although anomalies may arise through changes in periodic or oscillatory behavior. The paper adds compact global and local FFT-based evidence to indexed de-seasonalized inputs in a zero-shot framework. Experiments report improved LLM-based TSAD baselines, with global and local evidence serving complementary roles.

  • Problem

    LLM-based TSAD methods mainly expose indexed, visual, or de-seasonalized time-domain evidence, leaving frequency-relevant anomaly structure implicit.

  • Method

    The framework augments indexed de-seasonalized observations with compact global and local FFT-based frequency-domain summaries as auxiliary evidence.

  • Results

    Experiments on AnomLLM and TSB-AD-U show that explicit frequency-domain evidence improves strong LLM-based TSAD baselines.

  • Takeaways & Limitations

    Global evidence provides sequence-level periodic context, while local evidence exposes time-localized spectral departures that complement indexed and de-seasonalized inputs.

  • Takeaways & Limitations

    The study does not directly analyze which evidence components LLMs rely on when producing interval predictions, leaving their internal reasoning unexplained.

Abstract

from arXiv · show

Time-series anomalies can appear not only as pointwise deviations but also as changes in recurring temporal structure, such as shifted periodicity or localized oscillatory fluctuations. However, existing LLM-based time-series anomaly detection methods mainly expose time-domain evidence through indexed values, plots, or de-seasonalized representations, leaving spectral structure implicit. We propose an evidence-augmented zero-shot TSAD framework that preserves indexed de-seasonalized observations while adding compact frequency-domain evidence computed with the Fast Fourier Transform (FFT). The evidence is constructed at two resolutions: global frequency-domain evidence summarizes sequence-level periodic context, while local frequency-domain evidence captures time-localized spectral departures. Experiments on AnomLLM with InternVL2-LLaMA3-76B, Qwen2.5-VL-72B-Instruct, Gemini-2.5-Flash, and GPT-4o, together with evaluation on the TSB-AD-U subset, show that explicit frequency-domain evidence improves LLM-based TSAD baselines. These results suggest that frequency-domain evidence can complement indexed and de-seasonalized time-domain inputs for zero-shot LLM-based TSAD.

1 Introduction

The section identifies a gap in LLM-based TSAD: frequency-relevant structure is often implicit, despite anomalies involving changes in periodic behavior. It proposes explicit global and local FFT-based evidence alongside indexed de-seasonalized inputs and reports improvements over LLM-based baselines.

  • Anomalies can involve altered cycles, shifted periodic components, or unstable local fluctuations that require evidence about changing periodic structure.
  • Zero-shot TSAD must localize anomalous intervals without benchmark-specific taxonomies, historical examples, or auxiliary supervision.
  • The framework augments indexed de-seasonalized observations with compact global and local FFT-based evidence computed directly from the input sequence.
  • Global evidence summarizes sequence-level periodic context, whereas local evidence captures time-localized spectral behavior without predefined anomaly categories or task-specific training.
  • Existing LLM-based TSAD methods expose numerical, visual, or de-seasonalized inputs, while frequency-aware methods rarely expose spectral information directly to general-purpose LLMs.
  • Experiments on AnomLLM with multiple multimodal LLMs and the TSB-AD-U protocol show improvements over strong LLM-based TSAD baselines.

2 Can LLMs Infer Frequency Structure from Time-Domain Inputs?

The probing experiments test whether LLMs recover frequency structure from time-domain inputs and examine the complementary roles of global and local spectral evidence. Global summaries aid sequence-level recovery, while local summaries support localized frequency-change detection and TSAD performance.

  • Synthetic probes isolate frequency reasoning from dataset-specific anomaly patterns across single-sinusoid, multi-sinusoid, and local-frequency-change tasks.
  • Global frequency-domain evidence achieves the best results on both single- and multi-sinusoid frequency-recovery probes.
  • Global summaries make the dominant periodic regime explicit, which indexed values, plots, or de-seasonalized inputs do not reliably reveal alone.
  • Full-sequence spectra perform poorly on localized frequency-change detection because they aggregate spectral content over time without indicating where changes occur.
  • Local frequency-domain evidence exposes window-level changes in dominant frequency and spectral entropy, producing the highest detection accuracy on the localized probe.
  • In TSAD performance, local evidence improves frequency-relevant anomaly types while global evidence adds sequence-level context over the indexed de-seasonalized baseline.

3 Preliminaries

The framework formulates LLM-based TSAD as indexed interval prediction and uses de-seasonalization before prompting. It then derives explicit FFT-based descriptors to expose periodic structure that time-domain inputs may leave implicit.

  • LLM-based TSAD: TSAD is formulated as predicting a set of anomalous intervals with start and end indices from a univariate sequence.
  • LLM-based TSAD: Indexed observations pair each value with its time index, while plots can provide an auxiliary multimodal representation.
  • De-seasonalization-Based Prompting: De-seasonalization constructs values that remove dominant recurring patterns before the sequence is provided to the LLM.
  • De-seasonalization-Based Prompting: De-seasonalized inputs do not explicitly describe where local oscillatory behavior changes or how those changes relate to sequence-level periodic structure.
  • Frequency-Domain Representation: FFT descriptors are computed from the mean-centered de-seasonalized sequence, excluding the zero-frequency component to focus on oscillatory structure.
  • Frequency-Domain Representation: The descriptors include dominant frequency and period, spectral entropy, spectral peaks, and the lower-to-higher-frequency energy ratio.The energy ratio summarizes whether slower or faster oscillations dominate.

4 Proposed Method

The proposed method augments indexed de-seasonalized observations with global and local FFT-derived evidence. Global summaries provide sequence-level periodic context, while overlapping local summaries provide time-localized spectral cues for interval prediction.

  • Proposed Framework: The framework adds explicit frequency-domain evidence because indexed de-seasonalized inputs leave frequency-relevant cues largely implicit.
  • Proposed Framework: All frequency-domain components are computed from the same indexed de-seasonalized sequence used for interval prediction.
  • Global Frequency-Domain Summary: Global frequency-domain evidence summarizes the sequence-level periodic regime and provides a reference for interpreting local spectral departures.
  • Global Frequency-Domain Summary: The global summary contains the dominant period, strongest spectral peaks, global spectral entropy, and the low/high-frequency energy ratio.
  • Local Windowed Frequency-Domain Summary: Local evidence is computed from overlapping windows to represent frequency behavior at a time-localized resolution.
  • Local Windowed Frequency-Domain Summary: Each local tuple combines an index range with dominant local frequency and local spectral entropy, providing auxiliary evidence rather than anomaly boundaries.
  • Interval Prediction: The final prompt combines indexed de-seasonalized values with global and local frequency evidence, optionally including a time-series plot.

5 Experiment

The experiments evaluate the framework across multimodal LLMs and benchmark settings, finding that explicit global and local frequency-domain evidence improves anomaly detection, especially for rhythm- and trend-related anomalies.

  • Experiment Setup: The evaluation covers AnomLLM across four multimodal LLMs and the eight-category TSB-AD-U subset, using standard and affiliation metrics alongside multiple baselines.AnomLLM comparisons include representative prompting variants and LLM-TSAD; TSB-AD-U follows the prior subset-level protocol.
  • Main Results: Frequency-domain evidence consistently improves both standard F1 and affiliation F1 over LLM-TSAD across four evaluated models and both input settings on AnomLLM.The result indicates gains in strict interval overlap and distance-aware temporal agreement.
  • Main Results: Qualitative examples show better alignment with ground-truth regions for localized rhythm changes and gradual temporal-structure shifts than LLM-TSAD.These examples are qualitative support for the quantitative results rather than standalone proof of overall superiority.
  • Ablation Studies: Adding global evidence to local evidence improves standard F1 for all models and restores or further improves affiliation F1 in several cases.The ablation suggests that global periodic context helps calibrate local spectral departures, while local evidence alone can be insufficient for stable interval localization in the Gemini-2.5 result.
  • Ablation Studies: The largest type-wise gains occur for frequency changes and trend shifts, whereas point and range anomalies receive less additional information from frequency-domain summaries.Indexed de-seasonalized sequences already expose strong amplitude- and boundary-level cues for point and range anomalies.
  • Ablation Studies: On TSB-AD-U, the method improves standard F1 over Gemini-based LLM-TSAD with the same backbone while maintaining comparable affiliation-based performance.This provides a cross-benchmark robustness check within the scope of the subset-level evaluation, not an exhaustive full-benchmark evaluation.

6 Conclusion

The paper presents a zero-shot TSAD framework that augments indexed and de-seasonalized inputs with compact global and local frequency-domain evidence. Experiments indicate improvements over strong LLM-based baselines, particularly for anomalies involving rhythm, periodicity, or gradual temporal changes.

  • Conclusion: The framework preserves indexed and de-seasonalized time-domain inputs while adding compact global and local frequency-domain evidence.Global evidence supplies sequence-level periodic context, while local evidence exposes time-localized spectral departures; both serve as auxiliary evidence.
  • Conclusion: Experiments on AnomLLM with multiple multimodal LLMs and on the TSB-AD-U evaluation subset show that explicit frequency-domain evidence can improve strong LLM-based baselines.The reported gains are especially associated with anomalies involving rhythm, periodicity, or gradual temporal changes.
  • Conclusion: The findings motivate adaptive frequency-evidence construction for longer or multivariate time series.This is presented as a direction motivated by the reported findings rather than as an evaluated result.

7 Limitations

The framework improves TSAD while leaving unresolved how LLMs use different evidence sources during zero-shot interval localization. Its evaluation also relies on benchmark data and documented inference interfaces.

  • Zero-shot anomaly localization remains challenging despite improvements from frequency-domain evidence.The authors report that the framework supports usefulness of structured frequency evidence but does not fully explain model reasoning.
  • The study does not directly analyze which evidence components the LLM uses for interval predictions.Future work is proposed around attribution or intervention-based analyses involving time-domain, visual, and frequency-domain evidence.
  • The method addresses a limitation of de-seasonalization, which does not explicitly describe local oscillatory changes or their relation to sequence-level periodic structure.The framework therefore adds explicit frequency-domain evidence to the LLM input.
  • The evaluation uses AnomLLM and the TSB-AD-U subset only for research evaluation, without redistributing derived preprocessing outputs.The authors state that API-based and open-source models are accessed only through documented inference interfaces.
  • The benchmark inputs contain numerical time-series values and anomaly interval annotations rather than natural-language user content or newly collected personal data.The authors report no re-identification or linkage to external sources.

B.5 Data Statistics

The study uses zero-shot evaluation and synthetic diagnostic probes to test whether input representations expose frequency-relevant information to LLMs. Probes cover sequence-level recovery and localized frequency changes.

  • The synthetic probes are diagnostic representation tests rather than full TSAD benchmarks.They isolate frequency reasoning from dataset-specific anomaly patterns.
  • Each probe uses 200 synthetic samples evaluated with Qwen2.5-VL-72B-Instruct across five input representations.The representations include indexed text, plots, de-seasonalized text, and global or local frequency evidence.
  • The single- and multi-sinusoid probes evaluate sequence-level recovery of dominant frequencies or dominant frequency components.Top-1 and Top-k recovery use a 10% relative-error tolerance, with Top-k recovery macro-averaged over samples.
  • The local frequency-change probe contains one contiguous segment whose frequency differs from the background while amplitude remains comparable.The changed segment is sampled with varied periods, lengths, amplitudes, and noise levels.
  • The de-seasonalized probe representation uses an oracle period only in synthetic experiments, not in AnomLLM or TSB-AD-U evaluation.The seasonal template is tiled and subtracted from the original sequence.

E Implementation Details

Implementation analyses examine local-window settings, matched evidence representations, descriptor-based controls, and diagnostic subsets. The results distinguish structured evidence effects from raw descriptor values alone.

  • Implementation Details: Local frequency evidence uses window lengths of 64 for AnomLLM and 128 for TSB-AD-U, with stride set to half the window length.The longer TSB-AD-U window preserves comparable relative temporal scale because its sequences are approximately twice as long.
  • Implementation Details: The controlled analyses use a balanced 1/4-scale AnomLLM subset with matched instances and anomaly-type balance.This setting makes repeated diagnostic LLM calls tractable without replacing the full-scale main results.
  • Implementation Details: Structured global/local evidence outperforms neutral descriptor serialization under matched prompt conditions for both standard and affiliation F1.Only the representation schema changes; the LLM, instances, image, indexed history, descriptor values, order, and block position remain fixed.
  • Implementation Details: FFT-CUSUM reaches standard F1 41.04 and affiliation F1 78.64, while LF+GF reaches 73.70 and 91.39 under the same protocol.These label-free controls do not reproduce the LF+GF result, but they do not establish that an LLM is necessary for every frequency anomaly.

F.4 Component-Level Descriptor Ablation

Component and perturbation analyses support complementary global and local evidence roles, targeted gains across anomaly types, and generally stable but backbone-dependent improvements.

  • Component-Level Descriptor Ablation: Global dominant frequency performs best among single descriptors on standard F1, while local spectral entropy performs best on affiliation F1.No individual descriptor leads on both metrics, whereas full LF+GF provides a more balanced profile.
  • Evidence Perturbation: Shuffling local evidence lowers F1 from 73.70 to 71.50, mismatched global/local evidence lowers it to 70.57, and removing frequency evidence lowers it to 67.14.The graded degradation is consistent with sensitivity to sequence-specific frequency information rather than simply adding more text.
  • Window Sensitivity: Across local-window lengths of 32, 64, and 128, standard F1 ranges from 72.77 to 73.70 and affiliation F1 from 90.49 to 91.39.Variation remains below one F1 point across the tested window range.
  • Type-Wise Analysis: Frequency evidence gains +6.91 F1 for frequency anomalies, +5.79 for point anomalies, and +15.16 for trend anomalies, but changes -1.64 for range anomalies.The pattern supports targeted rather than uniform improvement relative to the de-seasonalized LLM-TSAD baseline.
  • False-Positive Audit: On fully normal sequences, the any-prediction false alarm rate increases from 0.20 to 2.17, while nonfrequency-dominant categories show higher precision and fewer spurious intervals.The audit characterizes the effect as mixed but bounded.
  • Paired Bootstrap Confidence Intervals: Affiliation-F1 confidence intervals remain above zero for all four backbones, whereas GPT-4o’s standard-F1 interval includes zero.Standard-F1 gains remain above zero for Qwen2.5-VL-72B, Gemini-2.5-Flash, and InternVL2-LLaMA3-76B.

F.9 Newer Backbone Robustness Check

The robustness analysis evaluates structured frequency evidence on newer backbones and across expanded TSB-AD-U groups. Results support usefulness beyond the original evaluation while framing these checks as complementary diagnostics rather than comprehensive leaderboards.

  • F.9 Newer Backbone Robustness Check: Across the evaluated newer backbones, average standard F1 increased by +2.83 and affiliation F1 by +2.35.The check used GLM-4.6V, Gemini-3-Flash, and GPT-5.1 on the same balanced 1/4-scale subset.
  • F.9 Newer Backbone Robustness Check: The newer-backbone analysis is a paired robustness check, not a full-scale model leaderboard.It complements the original backbone set and main evaluation.
  • F.9 Newer Backbone Robustness Check: Across all 16 TSB-AD-U groups, standard F1 changed from 25.18 to 28.20, while affiliation F1 changed from 74.31 to 75.18.The expanded text+vision evaluation combines the original eight-group subset with eight additional groups.
  • F.9 Newer Backbone Robustness Check: The modest affiliation-F1 change makes the expanded TSB-AD-U result a cross-subset robustness check rather than evidence of uniform gains on every group.The method improved reported averages on both the original and additional subsets.

G Prompt Overhead and Evaluation Details

The appendix quantifies the text added by frequency evidence and documents the response-processing settings used for reproducibility. Frequency summaries increase prompt length, while token counts alone do not establish runtime or provider-specific cost.

  • G.1 Prompt-Length Audit: The prompt-length audit covers 4,800 prompts, with every configuration retaining the same 1,000-point indexed history.LF and GF add structured frequency-evidence text to the shared indexed history.
  • G.1 Prompt-Length Audit: LF+GF increases average text length from 8,137 to 8,970 tokens, a +834-token or +10.2% increase.The baseline already contains the same indexed history.
  • G.1 Prompt-Length Audit: LF-only adds +717 tokens, corresponding to +8.8%.This reports representation overhead relative to the shared baseline.
  • G.1 Prompt-Length Audit: These token counts quantify representation overhead rather than runtime overhead.Latency and provider-specific API cost depend on serving conditions and are not inferred from token counts alone.
  • G.2 Decoding, Parsing, and Metric Computation: The reproducibility pipeline decodes with temperature 0, a maximum of 512 output tokens, and request seed 0.Each request receives at most four attempts.
  • G.2 Decoding, Parsing, and Metric Computation: HTTP 503 responses use a 30-second wait, while other retryable failures use exponential backoff.These are the specified retry-handling settings.
  • G.2 Decoding, Parsing, and Metric Computation: Parsing extracts the JSON array between the first opening bracket and last closing bracket and requires start and end fields.The passage also specifies a fallback outcome when all retries fail.
Loading 2608.24113v1…