Synergizing Large Language Models and Task-specific Models for Time Series Anomaly Detection

In anomaly detection, methods based on large language models (LLMs) can incorporate expert knowledge by reading professional document, while task-specific small models excel at extracting normal data patterns and detecting value fluctuations from training data of target applications. Inspired by the human nervous system, where the brain stores expert knowledge and the peripheral nervous system and spinal cord handle specific tasks like withdrawal and knee-jerk reflexes, we propose CoLLaTe, a framework designed to facilitate collaboration between LLMs and task-specific models, leveraging the strengths of both models for anomaly detection. In particular, we first formulate the collaboration process and identify two key challenges in the collaboration: (1) the misalignment between the expression domains of the LLMs and task-specific small models, and (2) error accumulation arising from the predictions of both models. To address these challenges, we then introduce two key components in CoLLaTe: a model alignment module and a collaborative loss function. Through theoretical analysis and experimental validation, we demonstrate that these components effectively mitigate the identified challenges and achieve better performance than both LLM-based and task-specific models.

💡 Research Summary

The paper introduces CoLLaTe, a novel framework that synergizes large language models (LLMs) with task‑specific small anomaly detection models (TSADMs) for time‑series anomaly detection. The authors observe that LLMs excel at ingesting expert knowledge from professional documents but are insensitive to fine‑grained value fluctuations in raw time‑series data, whereas TSADMs are designed to learn normal patterns from the data itself but lack the ability to incorporate domain expertise. Inspired by the human nervous system—where the brain stores abstract knowledge and the peripheral nervous system handles reflexive tasks—the framework treats the LLM as a “brain” and the TSADM as a “spinal cord,” aiming to combine their complementary strengths.

Two fundamental challenges arise when attempting such collaboration: (1) Expression‑domain misalignment – LLMs and TSADMs produce anomaly scores that live in different ranges and follow different statistical distributions, causing the same numeric score to convey different severity levels; (2) Error accumulation – when conventional loss functions such as mean‑squared error (MSE) are used to fuse the two predictions, the individual prediction errors tend to add up rather than cancel, degrading overall performance.

To address (1), the authors propose an Alignment Module. They model the LLM’s score distribution with a parametric density (f(S)) (e.g., a half‑Gaussian) and learn a mapping function (M(s)) that transforms the TSADM’s raw scores (s) into a new set whose distribution matches (f(S)). The mapping is learned by discretizing the