Autoregressive Multimodal Anomaly Detection with Large Language Models for Microservice Systems

Yixiang Tang; Fagui Liu; Guoxiang Zhong; Xi Yao; C. L. Philip Chen

cs.LGOct 22, 2026

Autoregressive Multimodal Anomaly Detection with Large Language Models for Microservice Systems

Authors: Yixiang Tang, Fagui Liu, Guoxiang Zhong, Xi Yao, C. L. Philip Chen

Organizations: School of Computer Science and Engineering, South China University of Technology, Guangzhou 510006, China · Department of New Networks, Peng Cheng Laboratory, Shenzhen 518000, China

Abstract

Microservice systems have become a dominant architecture for large-scale cloud applications, enabling rapid deployment and elastic scaling. However, ensuring the reliability and availability of microservice systems critically relies on effective anomaly detection, as failures and performance anomalies can quickly propagate across services and severely impact end-to-end system behavior. Existing multimodal anomaly detection approaches for microservice systems often struggle with two fundamental limitations: (i) the neglect of modality-specific characteristics in favor of cross-modality fusion, and (ii) the "identity-shortcut" problem that affects the feature reconstruction process. To address these issues, we propose LLMMAD, an autoregressive multimodal anomaly detection framework for microservice systems based on Large Language Models (LLMs). Initially, to reconcile cross-modality fusion with modality-specific preservation, LLMMAD embeds and recombines multimodal data into a unified sequence for LLM processing to model inter-modality relationships, while employing modality-wise reconstruction heads to retain modality-specific information. Subsequently, to eliminate the identity-shortcut, we implement a prediction-driven autoregressive objective, under which the model predicts future states rather than copies current inputs. Finally, we conduct extensive experiments on three real-world datasets. The results demonstrate that LLMMAD consistently outperforms state-of-the-art methods, achieving F1-score improvements of 3.1%, 1.4%, and 0.9%, respectively, thereby providing a more reliable solution for microservice monitoring.

Figures & tables

Approach	Modality			Fusion Method	Temporal Extractor	Learning Paradigm
Approach	Metric	Log	Trace	Fusion Method	Temporal Extractor	Learning Paradigm
TraceGra [ 10 ]	$\checkmark$	$\times$	$\checkmark$	GNNs	LSTMs	Unsupervised
DeepTraLog [ 11 ]	$\times$	$\checkmark$	$\checkmark$	GNNs	CNNs	Unsupervised
Hades [ 12 ]	$\checkmark$	$\checkmark$	$\times$	Cross-Attention	CNNs+Transformers	Semi-Supervised
MADMM [ 13 ]	$\checkmark$	$\checkmark$	$\times$	Cross-Attention	GNNs+GRUs	Supervised
MISP [ 14 ]	$\checkmark$	$\checkmark$	$\times$	Cross-Attention	Self-Attention	Supervised

TABLE I: A comprehensive comparison of various multimodal anomaly detection approaches of microservice systems. “

\checkmark

” and “

\times

” denote that the corresponding modality is used and not used, respectively.

Symbols	Definitions
$\mathbf{X}_{\mathrm{metric}}$	The time aligned metric matrix.
$\mathbf{X}_{\mathrm{log}}$	The time aligned log matrix.
$\mathbf{X}_{\mathrm{trace}}$	The time aligned trace matrix.
$\mathbf{x}_{t}^{\mathrm{metric}}$	The time aligned metric vector at timestep $t$ .
$\mathbf{x}_{t}^{\mathrm{log}}$	The time aligned log vector at timestep $t$ .
$\mathbf{x}_{t}^{\mathrm{trace}}$	The time aligned trace vector at timestep $t$ .

TABLE II: The symbols related to multimodal data and their descriptions.

Fig. 2: The time alignment process of multimodal data.

Fig. 3: The model architecture of LLMMAD. The light blue, light yellow, and light red blocks denote the intermediate feature matrices of metrics, logs, and traces, respectively.

Fig. 4: The timestep correspondence of autogressive prediction. During training phase, every time step except the first one is predicted. During detection phase, only a fixed proportion of the latter part of the sliding window is predicted.

Dataset	Duration	Instance	Metric	Log	Span
SN	9,870 s	12	7	94,319	1,438,191
TT	74,340 s	27	7	65,616	158,238
MSDS	11,160 s	5	5	130,326	1,514,358

TABLE III: Statistics of the datasets used in our experiments, including time duration, instance numbers, metric types, log numbers and span numbers.

Dataset	SN			TT			MSDS
Algorithm	P	R	F1	P	R	F1	P	R	F1
LogAnomaly	0.751	0.678	0.713	0.612	0.796	0.692	0.615	0.684	0.648
TraceAnomaly	0.601	0.476	0.531	0.687	0.611	0.647	0.641	0.718	0.677
AnomalyTransformer	0.876	0.640	0.740	0.828	0.621	0.709	0.755	0.725	0.740
DeepTraLog	0.821	0.791	0.806	0.768	0.742	0.755	0.784	0.801	0.792
SCWarn	0.748	0.823	0.784	0.801	0.726	0.762	0.719	0.794	0.755

TABLE IV: Performance comparison between LLMMAD and baselines. The best, second-best, and third-best results in each column are marked by , , and , respectively.

Modality Ablation
Dataset	SN			TT			MSDS
Ablation Setting	P	R	F1	P	R	F1	P	R	F1
LLMMAD	0.921	0.938	0.929	0.887	0.928	0.907	0.871	0.899	0.885
w/o metric	0.790	0.821	0.805	0.776	0.793	0.793	0.812	0.791	0.801
w/o log	0.857	0.871	0.864	0.791	0.856	0.822	0.875	0.821	0.847
w/o trace	0.825	0.812	0.818	0.817	0.751	0.783	0.841	0.865	0.853

TABLE V: Ablation study on LLMMAD across data modalities and components.

Component	Total Params	Trainable Params	Trainable Ratio (%)
Embedding Layers	$\approx 60K$	$\approx 60K$	$100$
LLM Backbone (Frozen)	$\approx 82M$	$0$	$0$
LoRA Adapters	$\approx 150K$	$\approx 150K$	$100$
Linear Output Layer	$\approx 50K$	$\approx 50K$	$100$
Total	$\approx 82.26M$	$\approx 260K$	$\approx 0.3$

TABLE VI: Parameter statistics of LLMMAD, including total and trainable parameters of different model components.

Fig. 5: Average per-sample training time (in milliseconds) across datasets for the compared methods.

Fig. 6: Average per-sample inference time (in milliseconds) across datasets for the compared methods.

Fig. 7: Boxplots of anomaly scores for LLMMAD and LLMMAD w/o prediction on normal and anomalous samples.

LLM			SN			TT			MSDS
Type	Params	Dim	P	R	F1	P	R	F1	P	R	F1
GPT2	117M	768	0.921	0.938	0.929	0.887	0.928	0.907	0.871	0.899	0.885
	355M	1024	0.915	0.937	0.926	0.879	0.931	0.904	0.877	0.910	0.893
	762M	1280	0.910	0.942	0.926	0.889	0.927	0.908	0.861	0.911	0.885
Llama3.2	1B	2048	0.866	0.956	0.909	0.876	0.911	0.893	0.896	0.872	0.884
Llama3.2	3B	3072	0.850	0.960	0.902	0.868	0.926	0.896	0.892	0.879	0.885

TABLE VII: Performance comparison of LLMMAD with different underlying LLM backbones. Params denotes the number of model parameters, and Dim denotes the embedding dimension of the LLM.

Fig. 8: The influence of three experimental setups on the performance of the method.

Multimodal Anomaly Detection

Multimodal anomaly detection identifies unusual patterns by combining complementary signals such as images, depth, video, text, and sensor data.

See all 97 papers

ARMOR: A Robust Self-Supervised Framework for Root Cause Analysis in Microservices under Missing Modality
Mar 26, 2026Wenzhuo Qian, Hailiang Zhao, Ziqi Wang +4Root Cause Analysis Multimodal Anomaly Detection
Zhejiang University, Hangzhou, China
Anomaly Detection and Root Cause Analysis for Microservice Systems
Jun 8, 2026Luan PhamSoftware Engineering Microservice Architecture
Viet Nam National University Ho Chi Minh City - University of Technology (HCMUT) · School of Computing Technologies, College of Science, Technology, Engineering and Maths, Royal Melbourne Institute of Technology (RMIT University), Melbourne, Victoria, Australia
BEACON: Bridging Multimodal Semantics and Asynchronous Propagation for Cloud System Anomaly Detection
Oct 20, 2026Zhe Li, Tengxue Zhang, Yang Shu +4Anomaly Detection Multimodal Anomaly Detection
East China Normal University · Alibaba Cloud Computing · Aalborg University

Mar 26, 2026J/K move · Enter open · S save

ARMOR: A Robust Self-Supervised Framework for Root Cause Analysis in Microservices under Missing Modality

Wenzhuo Qian, Hailiang Zhao, Ziqi Wang, Zhipeng Gao+3

Zhejiang University, Hangzhou, China

Root Cause Analysis Multimodal Anomaly Detection Missing-Modality Learning Anomaly Localization Self-Supervised Learning Microservice Architecture

Open paper AskPDF arXiv

Automated incident management is critical for microservice reliability. While recent unified frameworks leverage multimodal data for joint optimization, they unrealistically assume perfect data completeness. In practice, network fluctuations and agent failures frequently cause missing modalities. Existing approaches relying on static placeholders introduce imputation noise that masks anomalies and degrades performance. To address this, we propose ARMOR, a robust self-supervised framework designed for missing modality scenarios. ARMOR features: (i) a modality-specific asymmetric encoder that isolates distribution disparities among metrics, logs, and traces; and (ii) a missing-aware gated fusion mechanism utilizing learnable placeholders and dynamic bias compensation to prevent cross-modal interference from incomplete inputs. By employing self-supervised auto-regression with mask-guided reconstruction, ARMOR jointly optimizes anomaly detection (AD), failure triage (FT), and root cause localization (RCL). AD and RCL require no fault labels, while FT relies solely on failure-type annotations for the downstream classifier. Extensive experiments demonstrate that ARMOR achieves state-of-the-art performance under complete data conditions and maintains robust diagnostic accuracy even with severe modality loss.

Abstract

Multimodal Anomaly Detection

Explore similar work

ARMOR: A Robust Self-Supervised Framework for Root Cause Analysis in Microservices under Missing Modality

Anomaly Detection and Root Cause Analysis for Microservice Systems

BEACON: Bridging Multimodal Semantics and Asynchronous Propagation for Cloud System Anomaly Detection