Have an LLM Write Your Anomaly Detector: Autonomous Discovery of Compact, Interpretable Detectors for Time Series

David Berghaus

cs.LGOct 1, 2026

Have an LLM Write Your Anomaly Detector: Autonomous Discovery of Compact, Interpretable Detectors for Time Series

Authors: David Berghaus

Organizations: Lamarr Institute Germany · Fraunhofer IAIS Germany

Abstract

Time-series anomaly detection trades off predictive accuracy, computational efficiency, and interpretability. We use a large language model not as the detector but as the author of one: an autonomous research loop in which the model repeatedly edits a single short NumPy program under a leakage-free objective, keeping the best-scoring detector it finds. The loop discovers two compact detectors, one for univariate and one for multivariate series, that describe short windows by their local spectral features and compare them with the training-region distribution through a covariance-aware distance. On the TSB-AD benchmark these detectors lead the field across metrics, ahead of the strongest classical, deep, and foundation-model baselines including Time-RCD, yet they train no network and use no GPU, and the multivariate detector is faster than every similarly performing baseline. LLM-driven program search is thus a practical route to accurate, efficient, and transparent detectors.

Figures & tables

Figure 1. Autonomous discovery of an unsupervised anomaly detector. Synthetic anomalies are injected and labeled only in a held-out slice of the training region, and these labels are used only for validation; no real labels or official-test-suffix data enter the search. Starting from a simple seed detector, the agent repeatedly proposes program edits and evaluates it with the fixed harness. The best iteration yields a multi-scale spectral-organization detector: each window is compared with a full-covariance Gaussian fit to normal training windows, and its per-scale novelty scores are fused.

Search	Univariate method	Multivariate method
Opus 4.8 Loop	Multi-scale spectral-organization signature scored by Gaussian novelty	Joint per-channel band-powers scored by Gaussian novelty
GPT 5.6 Terra Loop	Local total variation in training-percentile coordinates	Local distribution-shape field
MiniMax-2.5 Loop	Local derivative and higher-moment feature fusion	Z-score, interpolation-error, and local-variance fusion
MiniMax-2.5 ShinkaEvolve	Ensemble of autocorrelation, entropy, divergence, rank, and z-score signals	Ensemble of Mahalanobis, autoregressive-residual, z-score, and derivative signals

Table 1. Methods selected by each search. Entries summarize the final program in each regime; full accuracy results appear in Section 6 .

Figure 2. Qualitative score comparison on four representative TAB univariate held-out test suffixes: two point anomalies (left) and two contextual anomalies (right). Each column shows the observed signal and the scores from the Opus Loop’s discovered detector, Time-RCD ( Lan et al., 2026 ) , HBOS ( Goldstein and Dengel, 2012 ) , and Isolation Forest ( Liu et al., 2008 ) ; orange bands mark the labeled anomaly range. The Opus Loop produces a sustained high score over each labeled event, while the comparators either miss the event or also respond strongly to normal cycles. For display, each score trace is independently normalized to

[0,1]

, preserving its within-series ordering.

Panel of Table 2 — Table 2. Evaluation on TSB-AD ( Liu and Paparrizos, 2024 ) using the setup of Time-RCD ( Lan et al., 2026 ) . The Opus 4.8 Loop row combines its two separately discovered, regime-specific algorithms: the univariate algorithm in the univariate columns and the multivariate algorithm in the multivariate columns. Gold, silver, and bronze markers denote first, second, and third place; the final three columns report their respective counts.

Method	Aff-F $\uparrow$	F1-T $\uparrow$	Std-F1 $\uparrow$	VUS-PR $\uparrow$
Opus 4.8 Loop (ours)	84.89	47.89	45.77	53.86
FFT detector ( Rasheed et al., 2009 )	78.34	27.01	26.95	35.00
Spectral Residual ( Ren et al., 2019 )	83.52	41.01	36.44	34.75
C22MP ( Tafazoli et al., 2023 )	77.88	26.32	24.32	32.01
catch22 + Mahalanobis ( Lubba et al., 2019 )	75.40	22.96	21.34	28.36

Table 3. Comparison with the closest published methods on the TSB-AD univariate families (Time-RCD protocol; dataset-mean, higher is better

\uparrow

). Each baseline is run from its released implementation and rows are ordered by VUS-PR; “catch22 + Mahalanobis” keeps our novelty framework and only substitutes the catch22 feature set for the discovered spectral signature. Best per column in bold .

Method	s/series $\downarrow$	$\mu$ s/step $\downarrow$
Univariate (44 series)
Time-RCD ( Lan et al., 2026 ) ∗	0.011	0.9
Opus 4.8 Loop (ours)	0.059	5.1
LOF ( Breunig et al., 2000 )	0.068	5.9
PCA (subseq.) ( Shyu et al., 2003 )	0.183	16.0
Isolation Forest ( Liu et al., 2008 )	0.575	50.2

Table 4. Efficiency on TSB-AD (Time-RCD protocol). Prediction-only wall-clock (lower is better,

\downarrow

), timing only each detector’s scoring call over a representative subset of series (up to five per family,

\leq

50k steps); s/series is the per-series mean,

\mu

s/step normalizes by series length. Rows marked ∗ run on a V100 GPU; all others use a single CPU core and train no network.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Table 5 — Table 5. Full TAB univariate field (all baselines). Metrics higher is better ( $\uparrow$ ); dataset-mean; our discovered detectors first, then baselines ordered by VUS-PR. Best in each column is bold ; podium medals ( 1 2 3 ) mark the top three values per column.

Panel of Table 6 — Table 6. Full TAB multivariate field (all baselines). Metrics higher is better ( $\uparrow$ ); dataset-mean; our discovered detectors first, then baselines ordered by VUS-PR. Best in each column is bold ; podium medals ( 1 2 3 ) mark the top three values per column.

Panel of Table 7 — Table 7. Evaluation on TSB-AD ( Liu and Paparrizos, 2024 ) using the setup of Time-RCD ( Lan et al., 2026 ) . The Opus 4.8 Loop row combines its two separately discovered, regime-specific algorithms: the univariate algorithm in the univariate columns and the multivariate algorithm in the multivariate columns. Gold, silver, and bronze markers denote first, second, and third place; the final three columns report their respective counts.

Method	Aff-F $\uparrow$	F1-T $\uparrow$	Std-F1 $\uparrow$	VUS-PR $\uparrow$
Opus 4.8 Loop (ours)	85.79	49.93	46.62	35.16
Spectral Residual ( Ren et al., 2019 )	84.17	36.32	36.12	27.33
C22MP ( Tafazoli et al., 2023 )	75.46	33.18	29.09	18.27
FFT detector ( Rasheed et al., 2009 )	77.24	29.83	28.34	17.05
catch22 + Mahalanobis ( Lubba et al., 2019 )	75.73	31.81	27.15	15.82

Appendix

Table 8. Comparison with the closest published methods on the TSB-AD multivariate families, applying each univariate baseline per channel and averaging (Time-RCD protocol; dataset-mean, higher is better

\uparrow

). Best per column in bold .

Explore similar work

Tiny but Trusted: Efficient Vision-Language Reasoning for Time-Series Anomaly Detection
May 28, 2026Xiaona Zhou, Muntasir Wahed, Tianjiao Yu +2Time-Series Anomaly Detection Recent Vision-Language Models
University of Illinois Urbana-Champaign · Sandia National Laboratories
Detecting Time Series Anomalies Like an Expert: A Multi-Agent LLM Framework with Specialized Analyzers
May 7, 2026Hyeongwon Kang, Jeongseob Kim, Jinwoo Park +1Time-Series Anomaly Detection Interpretable Anomaly Detection
Department of Industrial and Management Engineering Korea University · Mirae Asset Securities · Department of Industrial Engineering Seoul National University
Detect, Explain, Interpret: An End-to-End Benchmark for Time Series Anomaly Detection, Explainability and Interpretability
Oct 1, 2026Roberto Stanzione, Jules Barbe, Magali Parrino +2Time-Series Anomaly Detection Time Series
Inria, ENS, CNRS, PSL Paris, France · Scality Paris, France · Inria, ENS, CNRS, PSL, EDF Paris, France

May 28, 2026, cs.AIJ/K move · Enter open · S save

Tiny but Trusted: Efficient Vision-Language Reasoning for Time-Series Anomaly Detection

Xiaona Zhou, Muntasir Wahed, Tianjiao Yu, Constantin Brif+1

University of Illinois Urbana-Champaign · Sandia National Laboratories

Time-Series Anomaly Detection Recent Vision-Language Models Robust Cross-Domain Generalization

Open paper AskPDF arXiv

Recent advances in Vision-Language Models (VLMs) have achieved impressive performance across many tasks, yet prior studies report unsatisfactory performance when applying large language or multimodal models to finding abnormal patterns in sequential data. Public anomaly detection benchmarks typically provide interval annotations but not natural-language rationales, making it difficult to fine-tune VLMs to produce grounded, interpretable decisions. To address this gap, we construct VisAnomBench, a curated benchmark built from public time-series datasets and augmented with high-quality anomaly explanations selected from multiple large VLMs using fine-grained, task-specific rewards. Through fine-tuning on this benchmark, we develop VisAnomReasoner, a parameter-efficient VLM for time-series anomaly detection. Experimental results on VisAnomBench show that VisAnomReasoner achieves more accurate anomaly localization and consistently outperforms all baselines, with improvements of at least 21.23 and 23.87 percentage points in precision and F1, respectively. Additional experiments on the TSB-AD-U benchmark demonstrate strong cross-benchmark generalization, with VisAnomReasoner improving precision and F1 by 9.57 and 13.39 percentage points, respectively.

Abstract

Explore similar work

Tiny but Trusted: Efficient Vision-Language Reasoning for Time-Series Anomaly Detection

Detecting Time Series Anomalies Like an Expert: A Multi-Agent LLM Framework with Specialized Analyzers

Detect, Explain, Interpret: An End-to-End Benchmark for Time Series Anomaly Detection, Explainability and Interpretability