LLM as Detector: An In-context Learning Approach for Tabular Anomaly Detection

Researchers propose LLM-Detector, a framework that uses in-context learning of large language models to detect anomalies in tabular data without fine-tuning or neural network training. Evaluated on 24 tabular datasets against 15 state-of-the-art baselines, it shows consistent improvements in both mixed-type and continuous-only settings. The method converts normal training data into statistical summaries, causal dependencies, and prototypes to generate a scoring engine that computes anomaly scores.

arXiv:2608.19463v1 Announce Type: new Abstract: Anomaly detection in tabular data is challenging because abnormal samples often arise as violations of cross-feature dependencies rather than simple marginal deviations. Existing detectors rely on geometric or reconstruction signals, while prior LLM-based approaches mainly fine-tune LLMs with normal samples or generate synthetic anomalies. We propose LLM-Detector, a framework that utilizes the in-context learning capacity of LLMs for structured, prompt-conditioned scoring synthesis, enabling LLMs to derive anomaly detection logic from structured normal-state knowledge. Specifically, normal training data are converted into statistical summaries, causal dependencies, and distilled prototypes that are organized into a prompt for code generation. The resulting scoring engine evaluates statistical deviation, structural inconsistency, and density-based abnormality then computes an anomaly score for each test sample. We evaluate LLM-Detector on 24 tabular datasets, comparing against 15 SOTA baselines. Results show consistent improvements across both mixed-type and continuous-only settings. Moreover, this design eliminates the need for LLM fine-tuning or neural network training, reducing computational cost and enabling practical anomaly detection in real-world tabular systems.