Structured Frequency-Domain Evidence for LLM-Based Time-Series Anomaly Detection

Jungwook Seo; Sangwon Son; Minjeong Kim; Seungmin Han; Seojin Yoo; Sungyong Baik

cs.LGAug 25, 2026

Structured Frequency-Domain Evidence for LLM-Based Time-Series Anomaly Detection

Authors: Jungwook Seo, Sangwon Son, Minjeong Kim, Seungmin Han, Seojin Yoo, Sungyong Baik

Organizations: Department of Artificial Intelligence, Hanyang University Seoul, Republic of Korea · Department of Data Science, Hanyang University Seoul, Republic of Korea

Abstract

Time-series anomalies can appear not only as pointwise deviations but also as changes in recurring temporal structure, such as shifted periodicity or localized oscillatory fluctuations. However, existing LLM-based time-series anomaly detection methods mainly expose time-domain evidence through indexed values, plots, or de-seasonalized representations, leaving spectral structure implicit. We propose an evidence-augmented zero-shot TSAD framework that preserves indexed de-seasonalized observations while adding compact frequency-domain evidence computed with the Fast Fourier Transform (FFT). The evidence is constructed at two resolutions: global frequency-domain evidence summarizes sequence-level periodic context, while local frequency-domain evidence captures time-localized spectral departures. Experiments on AnomLLM with InternVL2-LLaMA3-76B, Qwen2.5-VL-72B-Instruct, Gemini-2.5-Flash, and GPT-4o, together with evaluation on the TSB-AD-U subset, show that explicit frequency-domain evidence improves LLM-based TSAD baselines. These results suggest that frequency-domain evidence can complement indexed and de-seasonalized time-domain inputs for zero-shot LLM-based TSAD.

Figures & tables

Probe	Metric	Indexed Text	Text + Plot	De-seasonalized	Global Freq.	Local Freq.
Single sinusoid	Top-1 Recovery $(10\%)$	24.5	23.5	14.5	95.5	52.0
Multi sinusoid	Top- $k$ Recovery $(10\%)$	24.7	18.1	34.6	91.9	43.0
Local frequency change	Detection Acc.	11.5	80.5	88.0	8.5	90.5

Table 1: Summary of frequency-reasoning probes. Top-1 and Top-

k

Recovery use a 10% relative-error tolerance. Global Frequency and Local Frequency denote indexed text augmented with global and local frequency summaries, respectively.

Figure 1: Stepwise F1 gains from local (LF) and global (GF) frequency-domain evidence on representative hard anomaly types. The waterfall plot shows incremental gains over the indexed de-seasonalized baseline.

Figure 2: Overview of the proposed framework. Indexed de-seasonalized values, global frequency-domain evidence, and local windowed frequency-domain evidence are combined in a single prompt for interval prediction.

LLMs	Methods	Standard Metrics			Affiliation Metrics
LLMs	Methods	Prec.	Recall	F1	Prec.	Recall	F1
Naïve baseline (Always Normal Predictor)		31.75	31.75	31.75	31.75	31.75	31.75
InternVL2 -1pt	Existing Prompts (AnomLLM)
	0shot-Text	12.94	21.15	13.38	22.12	28.38	24.10
	0shot-Vision	22.33	46.19	23.92	50.93	60.94	55.53
	1shot-Vision-CoT	33.72	36.28	33.67	53.62	55.55	53.93

Table 2: Main anomaly detection performance on AnomLLM across four multimodal LLMs. We report standard and affiliation-based precision, recall, and F1. For each model block and input modality group, the best result is shown in bold , and the second-best result is underlined .

Figure 3: Qualitative comparison between LLM-TSAD and our method using Qwen2.5-VL-72B-Instruct. The examples show frequency-change and trend-shift anomalies from AnomLLM.

Model	Setting	F1	Affi. F1
InternVL2	LLM-TSAD	34.66	62.90
	+ LF	40.31	72.27
	+ LF + GF	42.15	72.41
Qwen-2.5	LLM-TSAD	67.56	81.87
	+ LF	71.62	92.57
	+ LF + GF	73.70	91.39

Table 3: Component-to-final ablation. LF and GF denote local and global frequency-domain evidence, respectively, with LF+GF representing the final frequency-augmented configuration. The best and second-best results within each model are shown in bold and underlined .

Group	Method	Standard Metrics			Affiliation Metrics
Group	Method	Prec.	Recall	F1	Prec.	Recall	F1
Non-LLM baseline	ML: SR Ren et al. (2019)	32.61	40.77	30.57	66.80	95.11	75.94
	DL: USAD Audibert et al. (2020)	23.92	34.54	24.46	59.84	61.60	55.24
	FM: Chronos Ansari et al. (2024)	23.58	55.65	25.08	64.87	96.33	75.90
LLM baseline	AnomLLM (Gemini-2.5-Flash)	12.28	16.93	6.82	40.37	33.75	30.97
LLM baseline	LLM-TSAD (Gemini-2.5-Flash)	43.05	43.49	36.85	73.08	93.88	80.15

Table 4: Overall performance on the eight-category TSB-AD-U subset used by LLM-TSAD. We compare our method with representative non-LLM and Gemini-based LLM baselines.

Config.	Freq.	Point	Range	Trend	Overall
Indexed	23.99	88.13	86.39	60.28	64.70
+D.S. †	33.98	77.51	85.58	71.51	67.15
+D.S.+LF	39.24	81.55	82.85	82.83	71.62
+D.S.+LF+GF	40.89	83.30	83.94	86.67	73.70

Table 5: Type-wise standard F1 across evidence configurations. We report standard F1 by anomaly type using Qwen2.5-VL-72B-Instruct. D.S., LF, and GF denote de-seasonalization, local frequency-domain evidence, and global frequency-domain evidence, respectively. The best and second-best results for each anomaly type are shown in bold and underlined , respectively.

\dagger

denotes our reproduced result.

Appendix figures & tables13 assets

Supplementary material from the paper’s appendix.

Appendix

Provider	Model	Endpoint identifier
OpenAI	GPT-4o	openai/gpt-4o
Google	Gemini 2.5 Flash	google/gemini-2.5-flash
Qwen	Qwen 2.5 VL	qwen/qwen2.5-vl-72b-instruct

Appendix

Table 6: API-based model endpoints for our experiments.

Model	Configuration	F1	Affi. F1
Qwen2.5-VL-72B	Baseline, no frequency descriptors	68.33	82.78
Qwen2.5-VL-72B	Naive descriptor serialization	67.24	85.62
Qwen2.5-VL-72B	Structured GF/LF evidence	73.97	92.53
Gemini-2.5-Flash	Baseline, no frequency descriptors	75.84	86.76
Gemini-2.5-Flash	Naive descriptor serialization	66.24	83.99
Gemini-2.5-Flash	Structured GF/LF evidence	77.27	92.09

Appendix

Table 7: Same-LLM prompt-schema ablation on the balanced 1/4-scale diagnostic subset. All conditions keep the LLM, instances, image, indexed history, output format, descriptor values and order, and block position fixed; only the representation schema changes.

Method	LLM	Same desc.	F1	Affi. F1
FFT-ZScore	No	Yes	34.63	75.19
FFT-ZScore top 5%	No	Yes	21.28	52.61
FFT-IsolationForest	No	Yes	23.09	55.86
FFT-CUSUM	No	Yes	41.04	78.64
LLM-TSAD, paired run	Yes	No	67.14	82.57
Ours LF+GF	Yes	Yes	73.70	91.39

Appendix

Table 8: Label-free non-LLM controls that use the same FFT-derived descriptors, preprocessing, and evaluation protocol. Thresholds are fixed a priori. The LLM-TSAD row is the reproduced paired diagnostic run used for these controls.

Added evidence	F1	Affi. F1
LLM-TSAD baseline	68.33	82.78
Global dominant frequency	74.01	89.45
Global top- $k$ spectral peaks	72.52	87.50
Global spectral entropy	71.91	86.61
Global low/high energy ratio	72.54	87.03
Local dominant frequency	72.70	87.91

Appendix

Table 9: Component-level descriptor ablation on the balanced 1/4-scale diagnostic subset with Qwen2.5-VL-72B-Instruct. Each condition adds one descriptor type to the same baseline prompt; the final row uses the full structured LF+GF evidence.

Condition	F1	$\Delta$ F1	Affi. F1	$\Delta$ Affi.
Correct GF/LF evidence	73.70	–	91.39	–
Local evidence shuffled	71.50	-2.20	87.84	-3.55
Global+local mismatched donor	70.57	-3.13	86.87	-4.52
Remove frequency evidence	67.14	-6.56	82.57	-8.82

Appendix

Table 10: Evidence-level perturbation with Qwen2.5-VL-72B-Instruct. The prompt remains matched except for the frequency-evidence blocks. The removal condition corresponds to the paired LLM-TSAD diagnostic run.

Window $L$	Stride $S$	F1	Affi. F1
32	16	73.31	91.36
64	32	73.70	91.39
128	64	72.77	90.49

Appendix

Table 11: Full-scale sensitivity to local-window length with stride fixed to half of the window length.

Type	Indexed	LLM-TSAD (+D.S.)	Ours LF+GF	$\Delta$ vs. LLM-TSAD
Frequency	23.99	33.98	40.89	+6.91
Point	88.13	77.51	83.30	+5.79
Range	86.39	85.58	83.94	-1.64
Trend	60.28	71.51	86.67	+15.16
Overall	64.70	67.15	73.70	+6.55

Appendix

Table 12: Type-wise standard F1 with the de-seasonalized LLM-TSAD configuration as the direct reference for the frequency-evidence setting.

Analysis subset	Metric	LLM-TSAD	Ours LF+GF
Fully normal sequences	Any-prediction false alarm rate	0.20	2.17
Non-frequency-dominant categories	Raw precision	74.63	82.22
Non-frequency-dominant categories	Spurious interval ratio	3.85	2.81
Non-frequency-dominant categories	Sequences with spurious interval	7.28	5.86

Appendix

Table 13: False-positive audit reported under the same evaluation protocol. Values follow the scale used by the evaluation audit.

Backbone	Metric	LLM-TSAD	Ours	$\Delta$ 95% CI
Qwen2.5-VL-72B	Std. F1	67.14	73.70	+6.56 [5.29, 7.72]
Qwen2.5-VL-72B	Affi. F1	82.57	91.39	+8.82 [7.47, 10.09]
GPT-4o	Std. F1	69.03	70.20	+1.17 [-0.19, 2.45]
GPT-4o	Affi. F1	79.98	87.35	+7.37 [5.97, 8.69]
Gemini-2.5-Flash	Std. F1	76.62	77.97	+1.35 [0.04, 2.60]
Gemini-2.5-Flash	Affi. F1	87.12	92.48	+5.36 [4.28, 6.46]

Appendix

Table 14: Paired bootstrap 95% confidence intervals over evaluation instances. The LLM-TSAD values in this table are reproduced paired diagnostics for the confidence-interval analysis and do not replace the main-paper baseline values.

Model	Baseline F1 / Affi.	Ours F1 / Affi.	$\Delta$ F1	$\Delta$ Affi.
GLM-4.6V	51.58 / 75.10	57.78 / 76.87	+6.20	+1.77
Gemini-3-Flash	73.85 / 80.51	75.10 / 82.64	+1.25	+2.13
GPT-5.1	75.77 / 85.64	76.80 / 88.79	+1.03	+3.15
Average	–	–	+2.83	+2.35

Appendix

Table 15: Paired robustness check on three newer backbones using the same balanced 1/4-scale diagnostic subset. This check complements rather than replaces the full-scale main evaluation.

Setting	Groups	Method	Std.	Affi.	$\Delta$ Std.	$\Delta$ Affi.
Original	8	LLM-TSAD	36.85	80.15	–	–
Original	8	Ours	40.26	80.35	+3.41	+0.20
Additional	8	LLM-TSAD	13.51	68.46	–	–
Additional	8	Ours	16.14	70.00	+2.63	+1.54
Combined	16	LLM-TSAD	25.18	74.31	–	–
Combined	16	Ours	28.20	75.18	+3.02	+0.87

Appendix

Table 16: Expanded TSB-AD-U text+vision evaluation. The original eight-group subset follows the submission protocol, and the additional subset contains eight further groups. The combined row averages all 16 groups.

Config.	Prompts	Avg. tokens	P95	Max	Local windows / $\Delta$
LLM-TSAD	1,600	8,137	8,137	8,137	0 / –
Ours-LF	1,600	8,854	8,854	8,854	30 / +717 (+8.8%)
Ours-LF+GF	1,600	8,970	8,971	8,973	30 / +834 (+10.2%)

Appendix

Table 17: Prompt-length audit over all 4,800 prompts. Each configuration contains the same 1,000-point indexed history; LF and GF add the structured frequency-evidence text.

Item	Value
Decoding	temperature=0 , max output tokens = 512, request seed = 0
Retry	At most 4 attempts; 30 s wait on HTTP 503; otherwise exponential backoff
Parsing	JSON array between the first [ and the last ] , with start and end fields
Invalid output	Retry; if all retries fail, assign all-zero metrics
Standard F1	Point-wise scikit-learn precision, recall, and F1
Affiliation F1	affiliation package

Appendix

Table 18: Evaluation and response-processing details used for the reproducibility analysis.

LLM-Based Time Series Anomaly Detection

See all 11 papers

LLM-Generated Feature Pools for Time Series Anomaly Detection
Sep 18, 2026Youssef Attia El Hili, Malik Tiomoko, Corinne AncourtLarge Language Model-Based Feature Engineering Time-Series Anomaly Detection
Huawei Noah’s Ark Lab, Paris, France · Centre de Recherche en Informatique, Mines Paris, PSL University
Detecting Time Series Anomalies Like an Expert: A Multi-Agent LLM Framework with Specialized Analyzers
May 7, 2026Hyeongwon Kang, Jeongseob Kim, Jinwoo Park +1LLM-Based Time Series Anomaly Detection Interpretable Anomaly Detection
Department of Industrial and Management Engineering Korea University · Mirae Asset Securities · Department of Industrial Engineering Seoul National University
Have an LLM Write Your Anomaly Detector: Autonomous Discovery of Compact, Interpretable Detectors for Time Series
Oct 1, 2026David BerghausInterpretable Anomaly Detection LLM-Based Program Synthesis
Lamarr Institute Germany · Fraunhofer IAIS Germany

Sep 18, 2026J/K move · Enter open · S save

LLM-Generated Feature Pools for Time Series Anomaly Detection

Youssef Attia El Hili, Malik Tiomoko, Corinne Ancourt

Huawei Noah’s Ark Lab, Paris, France · Centre de Recherche en Informatique, Mines Paris, PSL University

Large Language Model-Based Feature Engineering Time-Series Anomaly Detection Anomaly Detection Automated Feature Engineering

Open paper AskPDF arXiv

We study how far a simple statistical pipeline can go on univariate time series anomaly detection under a strict selection protocol. The method extracts a small pool of statistics over sliding windows, scores each window with a transductive robust (MAD) model, and selects a feature subset per domain on a held-out tuning split. On TSB-AD-U it reaches

0.529

per-series VUS-PR, above the best neural (

0.45

) and statistical (

0.44

) entries on the public leaderboard and within

0.06

of the strongest pretrained foundation model, several of which use more supervision than ours. Ablations locate the cause: across three selection strategies and a hindsight oracle the score moves by

0.031

, and across the aggregation grid by

0.096

, while changing the candidate pool moves it by

0.226

. The candidate pool sets the ceiling; the search over it is second-order. We therefore generate a pool per domain by prompting a multimodal LLM with in-context example windows from that domain. The generated pools match the hand-crafted one under matched selection, and the two cover different domains: selecting over their union improves on the generated pool in all twelve generator-seed pairs and lifts the pipeline to

0.588

, matching the performance of the best entry on the leaderboard.

Abstract

LLM-Based Time Series Anomaly Detection

Explore similar work

LLM-Generated Feature Pools for Time Series Anomaly Detection

Detecting Time Series Anomalies Like an Expert: A Multi-Agent LLM Framework with Specialized Analyzers

Have an LLM Write Your Anomaly Detector: Autonomous Discovery of Compact, Interpretable Detectors for Time Series