LLM-Generated Feature Pools for Time Series Anomaly Detection

Youssef Attia El Hili; Malik Tiomoko; Corinne Ancourt

cs.AISep 18, 2026

LLM-Generated Feature Pools for Time Series Anomaly Detection

Authors: Youssef Attia El Hili, Malik Tiomoko, Corinne Ancourt

Organizations: Huawei Noah’s Ark Lab, Paris, France · Centre de Recherche en Informatique, Mines Paris, PSL University

Abstract

We study how far a simple statistical pipeline can go on univariate time series anomaly detection under a strict selection protocol. The method extracts a small pool of statistics over sliding windows, scores each window with a transductive robust (MAD) model, and selects a feature subset per domain on a held-out tuning split. On TSB-AD-U it reaches $0.529$ per-series VUS-PR, above the best neural ( $0.45$ ) and statistical ( $0.44$ ) entries on the public leaderboard and within $0.06$ of the strongest pretrained foundation model, several of which use more supervision than ours. Ablations locate the cause: across three selection strategies and a hindsight oracle the score moves by $0.031$ , and across the aggregation grid by $0.096$ , while changing the candidate pool moves it by $0.226$ . The candidate pool sets the ceiling; the search over it is second-order. We therefore generate a pool per domain by prompting a multimodal LLM with in-context example windows from that domain. The generated pools match the hand-crafted one under matched selection, and the two cover different domains: selecting over their union improves on the generated pool in all twelve generator-seed pairs and lifts the pipeline to $0.588$ , matching the performance of the best entry on the leaderboard.

Figures & tables

Figure 1: Per-series VUS-PR on TSB-AD-U. Our pipeline scores each series with a transductive median/MAD model over a small pool of window statistics. With hand-crafted features it already clears the best neural (StreamVAE) and statistical (MMPAD) entries; with a pool discovered per domain by a language model and unioned with the hand-crafted one, it reaches the level of the best pretrained entry on the leaderboard. Red marks our two variants, dark grey the pretrained foundation models, and light grey the methods without pretraining. Leaderboard values are as published.

Panel of Figure 2 — Figure 2: The pipeline. Steps 1–5 are transductive and label-free; labels enter only in the per-domain feature selection that fixes which columns of $X$ are used (Section 3.4 ).

Panel of Figure 3 — Figure 3: Automatic pool generation (Section 3.5 ). The model sees only rendered tuning windows and a fixed instruction; it never sees the evaluation split, the detector, or any score. Everything downstream of the pool is identical to the hand-crafted pipeline, so the candidate pool is the only variable that changes.

Pretrained on time series
Method	Family	Pretrain.	VUS-PR
Time-RCD + MAFT †	foundation	✓	0.59
TSPulse_FT †	foundation	✓	0.55
Time-RCD †	foundation	✓	0.52
CHARM †	foundation	✓	0.50
MOMENT_FT †	foundation	✓	0.39

Table 1: TSB-AD-U, per-series mean VUS-PR over the 350 evaluation series. † as published on the leaderboard; ✓marks pretraining on time series. ‡ The union pool’s candidate features are written offline by a general-purpose language model, not a time-series foundation model, while its detector is untrained and transductive. Our two rows are the hand-crafted pool (Section 5.2 ) and the union with the generated pool (Table 4 , best generator, seed-averaged); the hand-crafted pipeline leads the non-pretrained baselines by

8

points and the union by

14

, and the union comes close to the leaderboard’s best entry.

	point aggregation
feature aggregation	mean	max
mean	0.435	0.389
$q_{75}$	0.433	0.389
top-3	0.430	0.384
$q_{90}$	0.428	0.384
top-2	0.424	0.380

Table 2: Score-aggregation ablation (per-series VUS-PR), full hand-crafted pool with no feature selection, so the absolute level is below the selected pipeline (

0.529

) throughout. Rows are ordered by the mean point-aggregation column. Mean point aggregation dominates max at every one of the nine feature aggregations, and mean/mean is best overall; it is the setting used for every other result in the paper.

Feature pool	#feat.	VUS-PR
Union (generated $\cup$ hand)	20	0.588 $\pm$ 0.016
Generated ( gemini-3.5 )	10	0.569 $\pm$ 0.025
Hand-crafted statistics	10	0.529
catch22 (generic library)	22	0.362

Table 3: The pool is the ceiling (per-series VUS-PR). Same detector, window, aggregation, and per-domain selection; only the candidate pool changes. The generic catch22 library is the weakest despite being the largest; the adaptively generated pool beats the hand-crafted one; their union is best. The generated and union rows are the mean

\pm

standard deviation over four generation seeds.

Figure 4: Effect size of the three design choices on one axis. Each bar spans the configurations we ran for that choice, dots are individual configurations, and only the two endpoints are named; the number at the right is the range. Selection strategy moves per-series VUS-PR by

0.031

even when a hindsight oracle is allowed, and score aggregation by

0.096

, while the candidate feature pool moves it by

0.226

. The aggregation sweep runs on the full pool without selection, so that row sits at a lower absolute level than the other two.

Generator	llm	union
gemini-3.5-flash	0.569 $\pm$ 0.025	0.588 $\pm$ 0.016
gemini-3.1-flash-lite	0.540 $\pm$ 0.018	0.564 $\pm$ 0.025
claude-sonnet-5	0.497 $\pm$ 0.024	0.551 $\pm$ 0.028

Table 4: Generated pools (per-series VUS-PR), mean

\pm

standard deviation over four generation seeds. llm selects over the generated pool alone; union over the generated and hand-crafted pools jointly. union beats llm for every generator, and the best union beats the hand-crafted pipeline (

0.529

Domain	$n$	Hand	llm	union
environment	18	0.360	0.348	0.408
facility	87	0.603	0.673	0.656
finance	8	0.768	0.745	0.743
human activity	43	0.238	0.513	0.528
medical	47	0.593	0.540	0.590
sensor	39	0.686	0.643	0.756

Table 5: Per-domain VUS-PR for the best generator ( gemini-3.5-flash , seed-averaged). “Hand” is the hand-crafted pipeline, llm the generated pool, union the two pools selected over jointly; best per row in bold. Neither source wins everywhere, and the union exceeds both on four domains, which is why it leads overall.

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Domain	Tuning	Eval
environment	2	18
facility	9	87
finance	2	8
human activity	3	43
medical	7	47
sensor	5	39

Appendix

Table 6: TSB-AD-U series counts per domain, as distributed by the benchmark.

Hyperparameter	Values tried	Final
Windowing — fixed a priori, not searched
window length $w$	—	per-series dominant period
stride $s$	—	$\lfloor w/2\rfloor$
period floor / cap	—	4 / series length
Detector
location / scale	—	median / MAD

Appendix

Table 7: Pipeline hyperparameters. A dash under Values tried means the setting was fixed a priori and never varied; only the two aggregation choices and the feature subset are searched at all, both on the tuning split. The detector has no learned parameters.

Setting	Value
Generators	gemini-3.5-flash [ 7 ] ,
	gemini-3.1-flash-lite [ 4 ] ,
	claude-sonnet-5 [ 2 ]
Features requested	10 per domain
Accepted pool size	10 (a run yielding fewer is retried)
Example windows	5 normal $+$ 5 anomalous per domain

Appendix

Table 8: Generation settings. Only the attached plots change between domains and seeds; the instruction is byte-identical throughout.

Generator	Input	Output	Total	USD	s
gemini-3.5-flash	11,180	546	17,075	0.070	34.9
gemini-3.1-flash-lite	11,180	512	11,692	0.004	2.7
claude-sonnet-5	1,767	1,744	3,511	0.031	14.0

Appendix

Table 9: Average tokens, list-price cost and latency for one generation call, which produces one domain’s pool, measured from the providers’ usage telemetry. Prices are the providers’ published current rates per million input/output tokens:

1.50

9.00

0.25

1.50

and

3.00

15.00

respectively.

Generator	Pool	greedy	top- $k$	mRMR
gemini-3.5-flash	llm	0.572	0.576	0.573
	union	—	0.571	0.588
gemini-3.1-	llm	0.541	0.543	0.540
flash-lite	union	—	0.538	0.564
claude-sonnet-5	llm	0.491	0.496	0.495
	union	—	0.526	0.551

Appendix

Table 10: Per-series VUS-PR by selection strategy. Generated and union entries are seed-averaged over four generation seeds; the hand-crafted entry is a single deterministic run.

Domain	Selected features	Tun.	Eval
environment	skewness, mean abs. change	0.430	0.360
facility	IQR, skewness	0.751	0.604
finance	std, mean abs. change, skewness	0.212	0.768
human activity	zero crossings, autocorr. lag-2, skewness	0.213	0.238
medical	skewness, std, entropy	0.513	0.593
sensor	std, IQR	0.732	0.686

Appendix

Table 11: Feature subsets selected by greedy forward on the hand-crafted pool. “Tun.” is the tuning objective used to make the choice; “Eval” is the full VUS-PR on that domain’s evaluation series. The per-series mean of the Eval column over all 350 series is

0.529

Generator	Seed	llm	union	$\Delta$
gemini-3.5-flash	0	0.563	0.591	$+0.028$
	1	0.589	0.599	$+0.010$
	2	0.531	0.562	$+0.031$
	3	0.594	0.600	$+0.006$
gemini-3.1-flash-lite	0	0.547	0.583	$+0.036$
	1	0.533	0.545	$+0.012$

Appendix

Table 12: Per-seed per-series VUS-PR over the 350 evaluation series. Within a seed, the union pool is exactly that seed’s generated pool plus the ten hand-crafted features, so

\Delta

is an exact paired difference. All twelve differences are positive.

Domain	$n$	greedy	top- $k$	mRMR	oracle
environment	18	0.360	0.360	0.360	0.360
facility	87	0.604	0.565	0.656	0.656
finance	8	0.768	0.780	0.780	0.780
human activity	43	0.238	0.239	0.239	0.239
medical	47	0.593	0.538	0.538	0.593
sensor	39	0.686	0.758	0.754	0.758

Appendix

Table 13: Selection-strategy ablation on the hand-crafted pool, per domain (VUS-PR on the evaluation split).

Large Language Model-Based Feature Engineering

See all 18 papers

Structured Frequency-Domain Evidence for LLM-Based Time-Series Anomaly Detection
Aug 25, 2026Jungwook Seo, Sangwon Son, Minjeong Kim +3LLM-Based Time Series Anomaly Detection Time-Series Anomaly Detection
Department of Artificial Intelligence, Hanyang University Seoul, Republic of Korea · Department of Data Science, Hanyang University Seoul, Republic of Korea
Have an LLM Write Your Anomaly Detector: Autonomous Discovery of Compact, Interpretable Detectors for Time Series
Oct 1, 2026David BerghausInterpretable Anomaly Detection LLM-Based Program Synthesis
Lamarr Institute Germany · Fraunhofer IAIS Germany
Generalist Representation, Specialist Detection: TS-Router for Time-Series Anomaly Detection
Oct 1, 2026Tian Lan, Yifei Gao, Yimeng Lu +6Unsupervised Anomaly Detection Time-Series Anomaly Detection
Department of Industrial Engineering Tsinghua University · Huawei · Datadog AI Research Paris, France

Aug 25, 2026J/K move · Enter open · S save

Structured Frequency-Domain Evidence for LLM-Based Time-Series Anomaly Detection

Jungwook Seo, Sangwon Son, Minjeong Kim, Seungmin Han+2

Department of Artificial Intelligence, Hanyang University Seoul, Republic of Korea · Department of Data Science, Hanyang University Seoul, Republic of Korea

LLM-Based Time Series Anomaly Detection Time-Series Anomaly Detection Zero-Shot Anomaly Detection

Open paper AskPDF arXiv

Time-series anomalies can appear not only as pointwise deviations but also as changes in recurring temporal structure, such as shifted periodicity or localized oscillatory fluctuations. However, existing LLM-based time-series anomaly detection methods mainly expose time-domain evidence through indexed values, plots, or de-seasonalized representations, leaving spectral structure implicit. We propose an evidence-augmented zero-shot TSAD framework that preserves indexed de-seasonalized observations while adding compact frequency-domain evidence computed with the Fast Fourier Transform (FFT). The evidence is constructed at two resolutions: global frequency-domain evidence summarizes sequence-level periodic context, while local frequency-domain evidence captures time-localized spectral departures. Experiments on AnomLLM with InternVL2-LLaMA3-76B, Qwen2.5-VL-72B-Instruct, Gemini-2.5-Flash, and GPT-4o, together with evaluation on the TSB-AD-U subset, show that explicit frequency-domain evidence improves LLM-based TSAD baselines. These results suggest that frequency-domain evidence can complement indexed and de-seasonalized time-domain inputs for zero-shot LLM-based TSAD.

Abstract

Large Language Model-Based Feature Engineering

Explore similar work

Structured Frequency-Domain Evidence for LLM-Based Time-Series Anomaly Detection

Have an LLM Write Your Anomaly Detector: Autonomous Discovery of Compact, Interpretable Detectors for Time Series

Generalist Representation, Specialist Detection: TS-Router for Time-Series Anomaly Detection