LLM-Generated Feature Pools for Time Series Anomaly... | AI Research

This paper explores how far a simple, statistical approach can go in detecting anomalies in time series data. While many modern methods rely on complex neural networks or large-scale pretraining, the authors demonstrate that a straightforward pipeline—using sliding windows, basic statistical features, and a robust scoring model—can be highly competitive. The study reveals that the primary bottleneck for these systems is not the complexity of the detector, but the "vocabulary" of features they are given to work with.

The Power of a Better Vocabulary

The authors argue that a feature-based detector is only as good as the features it uses. If a specific anomaly (such as a subtle shift in variance or a change in periodicity) is not captured by any of the features in the pool, the detector will remain blind to it. Rather than simply enlarging a static library of features, which often leads to diminishing returns, the researchers propose a shift toward adaptive, task-conditioned feature discovery. By using a multimodal language model to generate custom features based on visual examples of a specific domain, the system can "learn" what to look for in a way that static, hand-crafted libraries cannot.

How the Pipeline Works

The pipeline operates in a fully transductive manner, meaning it computes everything from the series being analyzed without needing external training data. It follows five steps: 1. Windowing: The series is broken into sliding windows based on its dominant period. 2. Feature Extraction: A set of statistical features is calculated for each window. 3. Robust Scoring: A median/MAD (Median Absolute Deviation) model is applied to identify anomalies. 4. Feature Aggregation: Individual feature scores are combined into a single window score. 5. Point Aggregation: Overlapping window scores are averaged to produce a final anomaly score for each point in the series. The same large language models question is explored in Kernel-Managed Shared Memory for System-Wide Personalization, which adds a research perspective.
The key innovation is the use of a multimodal language model to generate the feature pool. The model is shown plots of normal and anomalous windows from a specific domain and is prompted to write Python code for features that would help distinguish between them. These generated features are then combined with expert-curated features to create a "union pool."

Key Findings and Performance

The results show that this approach is remarkably effective. The hand-crafted version of the pipeline already outperforms the best existing neural and statistical entries on the TSB-AD-U benchmark. When the pipeline uses the "union pool" of both expert-designed and LLM-generated features, it reaches a performance level that matches the strongest pretrained foundation models on the leaderboard. The same large language models question is explored in Making Alternative Data Work, which adds a research perspective.
The authors also performed "ablations"—systematic tests to see which parts of the pipeline matter most. They found that changing the feature pool has a much larger impact on performance than changing the selection strategy or the way scores are aggregated. This confirms that the "ceiling" of the detector's performance is set by the quality and relevance of the feature vocabulary, rather than the sophistication of the search process.

Important Considerations

While the results are strong, the study highlights that the effectiveness of this method depends on the quality of the generated features. A language model alone is not always perfectly reliable, which is why the "union" approach—combining LLM-generated features with human-expert features—consistently provides the best results. The study suggests that for future anomaly detection, the most productive path is to focus on generating task-specific features rather than simply building larger, static libraries or increasingly complex neural architectures. The same large language models question is explored in FlashVector, which adds a research perspective. as detailed in the full paper on Arxiv