LLM as an Algorithmist: Enhancing Anomaly Detectors via Programmatic Synthesis
Authors: Hangting Ye
Jinmeng Li
He Zhao
Mingchen Zhuge
Dandan Guo
Yi Chang
Hongyuan Zha
Venue: ICLR 2026 Poster (2026)
Keywords: Tabular data
Large language models
Anomaly detection
Primary area: unsupervised, self-supervised, semi-supervised, and supervised representation learning
TL;DR: We propose to integrate LLMs into tabular anomaly detection via anomaly synthesis code, without exposing raw tabular data and LLMs fine-tuning.

Abstract: Existing anomaly detection (AD) methods for tabular data usually rely on some assumptions about anomaly patterns, leading to inconsistent performance in real-world scenarios. While Large Language Models (LLMs) show remarkable reasoning capabilities, their direct application to tabular AD is impeded by fundamental challenges, including difficulties in processing heterogeneous data and significant privacy risks. To address these limitations, we propose LLM-DAS, a novel framework that repositions the LLM from a data processor to an algorithmist. Instead of being exposed to raw data, our framework leverages the LLM's ability to reason about algorithms. It analyzes a high-level description of a given detector to understand its intrinsic weaknesses and then generates detector-specific, data-agnostic Python code to synthesize ``hard-to-detect'' anomalies that exploit these vulnerabilities. This generated synthesis program, which is reusable across diverse datasets, is then instantiated to augment training data, systematically enhancing the detector's robustness by transforming the problem into a more discriminative two-class classification task. Extensive experiments on 36 TAD benchmarks show that LLM-DAS consistently boosts the performance of mainstream detectors. By bridging LLM reasoning with classic AD algorithms via programmatic synthesis, LLM-DAS offers a scalable, effective, and privacy-preserving approach to patching the logical blind spots of existing detectors.

Published as a conference paper at ICLR 2026
LLM AS AN ALGORITHMIST: ENHANCING ANOMALY DETECTORS VIA PROGRAMMATIC SYNTHESIS
Hangting Ye! Jinmeng Li', He Zhao Mingchen Zhuge', Dandan Guo Yi Chang' 67+ Hongyuan Zha
School Artificial Intelligence, Jilin University"; "Seek-hhenzeen
CSIRO's Data61 Department of DSAL, Monash University"; KAUST International Center of Future Science, Jilin University
Engineering Research Center of Knowledge-Driie Driven Human- Machine Intelligence, MOE, China? [yeht22, 1i he jm99911 @mails.. euw.edu. edu. en, au, mwwgchen..huueeeeeeeee wwuge@kaust. edw.euustteeeuea.a...eeaeeeeeeae
(guodandan, yichang) edu. en, zhahy@cuhk.ede edw.u.kkkedccc..
ABSTRACT
Existing anomaly detection (AD) methods for tabular data usually rely on some assumptions about anomaly patterns, leading inconsistent performance in real- world scenarios. While Large Language Models (LLMs) show remarkable reason- ing capabilities, their direct application tabular AD is impeded by fundamental challenges, including difficulties in processing heterogeneous data and signifi- cant privacy risks. To address these limitations, we propose LLM-DAS, a novel framework that repositions the LLM from "data processor" to an "algorithmist". Instead of being exposed to raw data, our framework leverages the LLM's s ability reason about algorithms. It analyzes high-level description of given detector to understand its intrinsic weaknesses and then generates detector-specific. data- agnostic Python code to synthesize "hard-to-detect" anomalies that exploit these vulnerabilities. This generated synthesis program, which is reusable across diverse datasets, is then instantiated to augment training data, systematically enhancing the detector's ' robustness by transforming the problem into a more discriminative two-class classification task. Extensive experiments on 36 TAD benchmarks show that LLM-DAS consistently boosts the performance of mainstream detectors. By bridging LLM reasoning with classic AD algorithms via programmatic synthesis, LLM-DAS offers scalable, effective, and privacy-preserving approach to patch- ing the logical blind spots of existing detectors. The source code is available at https::/qiite com/ Http:aannntnnggn LLM DASH
INTRODUCTION
Anomaly detection (AD) a fundamental machine learning task that identifies instances significantly deviating from normal data. Tabular data, typically represented as heterogencous feature vectors (e.g. numerical and categorical features) (Gorishnly et al., 2022 Borisov et al. 2022a Ye et al.)
2024), is crucial modality for AD (Han et 2022 Yin al. (2024). with applications spanning cyber-security (Ahmad et al. 2021). rare disease diagnosis (Fernando et al. [021] Ye et al. (203a)),
and financial fraud detection (Al-Hashedi & Magalingam, 2021). However, labeled anomalies
scarce due to the costly and time-consuming annotation by domain experts (Chandola et al. 2009 Yel
al. 2023b Guo et al. 2023). In tabular anomaly detection, many recent works adopt one-
classification paradigm, where only normal samples are available for training (Schölkopf et al. 1999
Sohn et al. 202 Yin al. 2024 Ye et al. (025). These TAD methods usually model how anomalies differ from normal data (Ahmed et al.) 2016) by making specific assumptions, e.g., reconstruction- based approaches like Principal Component Analysis (PCA) (Shyu al. (003) assume anomalies are harder reconstruct. Despite the success of these methods, it has been shown that assumptions made by a method may not hold when facing to heterogeneous tabular data in real-world scenarios (Wolpert
& Macready 1997, Han et al. 2022)
"Corresponding authors.

---

Published as a conference paper at ICLR 2026
Exlatiy TNO
"Only someal usd for 925nn
Legend:
Detector
"harf
True
Training set
Alggh thrs
Prediction
LUM
Systheric
LUVV Q4S
Avelled::
Enhanced
Youn Minedty
Augmentedd training
Prediction
Figure 1: Comparison between traditional TAD methods and LLM-DAS, By synthesizing "hard" anomalies. LLM-DAS effectively transforms the original one-class classification problem into more discriminative two- class classification problem, thereby strengthening the detector and yiclding a more nuanced decision boundary.
Rather than designing yet another detector with its own new set of fragile assumptions, we ask more fundamental question: can we systematically enhance existing detectors to be more robust against the violation of their own core logic? Our core idea is to strengthen detectors by exposing them their "blind spots" through synthesized "hard" anomalies. Here, "hard" anomalies are synthetic anomalous samples that the detector struggles to tell apart from normal data., i.e. cases where the detector most likely to fail. As illustrated in Fig. [I, this targeted augmentation effectively transforms the learning problem from a limited one-class setting into a more powerful and discriminative two-class setting, allowing model to learn more nuanced and robust decision boundary. The pivotal challenge, however, lies in generating anomalies of sufficient quality to be truly "hard". This requires targeting the detector's core algorithmic logie, demanding a paradigm shift from data-level optimization to logic-level strategic attack. This is a task for which the unique algorithmic reasoning capabilities of Large Language Models (LLMs) are exceptionally well-suited. With their remarkable capabilities in language understanding (Brown et al. 2020), complex planning (Qin et al. 2023), and code generation (Zheng et al.] 2024). LLMs possess an unparalleled ability to reason about abstract algorithmic mechanisms.
In this paper, we introduce LLM-DAS (LLM-Guided) Detector-Aware Anomaly Synthesis), a frame- work that positions the LLM as an "algorithm strategist" rather than a "data processor". In the first stage, LLM-DAS utilizes an LLM's reasoning capabilities to analyze the underlying mechanism of given detector and generate detector-specifer data-agnostic Python code for anomaly synthesis. As no data is input into the LLM, this process elegantly sidesteps challenges related to tabular data processing and privacy concerns. In the second stage, the generated code is instantiated specific dataset to synthesize "hard-to-detect" anomalies. These anomalies are then used to augment the training data, enhancing the detector's robustness against violated assumptions. Crucially, the detector-specifet synthesis code is reusable across different TAD datasets, enabling both scalability and high effectiveness of LLM utilization. In brief, our contributions are summarized as follows: 1) We identify the fragile assumptions of existing TAD methods as a core limitation and propose a novel direction of using LLM- -enerreeed code for targeted anomaly synthesis to enhance detector robustness. This approach simultaneously addresses inherent issues related to data privacy and pro- cessing for LLMs in the tabular domain. 2) We propose the LLM-DAS framework, which leverages an I.I. to reason about detectors and generate reusable, data-agnostic synthesis code. This code then instantiated to create synthetic hard anomalies that enhance detection performance. 3) We conduct extensive experiments on numerous benchmarks, where results demonstrate that LLM-DAS consistently and significantly boosts the performance of mainstream TAD methods.
2 RELATED WORK
Tabular Anomaly Detection. One of the main settings for tabular anomaly detection is one-class
classification, where model learns from only normal samples (Sohn et al., [022]] Yin et al. (024).
The success of existing methods, however, relies on specific and often fragile assumptions. (1) Reconstruction-baat based methods like PCA (Shyu et al. (003)) and autoencoders (Principi et al. 2017]
Kim et al., 2019) assume anomalies yield high reconstruction error (Shyu et a Kim et al. 2019 Ye et al.) 2025). This premise fails for anomalies that lie deceptively close to the learned manifold of normal data. (2) Density estimation methods posit that anomalies occupy low-density regions (Pazzen 1962, Li et al. 2022). This makes them vulnerable to local anomalies hidden within otherwise dense data clusters. (3) Classification based approaches such as OCSVM learn a boundary around normal data (Schölkopf al. 1999 Tax & Duin 2004), assumption that is easily
2

---

Published as a conference paper at ICLR 2026
violated by complex, non-convex data distributions. (4) Isolation- methods like IForest assume anomalies are easily isolated (Liu et al. 20088] Cao et al. 2025). Their effectiveness diminishes when anomalies form small clusters or are adjacent normal ones. In these cases, the isolation paths of anomalies are no longer much shorter than those of normal data, compromising the core principle of isolation. The inherent brittleness of these varied assumptions motivates our work to directly enhance detectors against the violation of their own core logic. For a comprehensive overview, we
refer readers to several surveys (Pang al. 2021: Ruff et al. 202T Chandola et al. 2009).
Large Language Models for Tabular Data Learning, Recent advances in LLMs have sparked growing interest in their application to tabular data tasks, including prediction (Dinh et al. [022] 2023). synthesis (Borisov et al.] [022b] Zhang et al., 2023). and feature engi- Hegselmann et al.)
neering (Han et al. 2024 Nam et al,, 2024). A comprehensive overview can be found in the survey by/ Dy/Fang et al. (2024). However, these approaches mostly treat the LLM as a data procesoo, requiring direct access to raw feature values and treating each row as natural language descriptions. This paradigm faces fundamental challenges: LLMs inherently struggle with heterogencous numerical features (Fang et al. 2024] Yan et al. 2024), and direct data exposure creates significant privacy risks. Even recent attempts (Tai et al. (025) to apply LLMs for tabular anomaly detection- by fine-tuning them on normal samples are still bound by these data- access and cost limitations, hindering their practicality. In this work, we depart from this paradigm by proposing new role for the LLM: an algorithmist. Instead of processing data, the L.M reasons about the high-level, data-agnostic logic of a given anomaly detector. Its task is to understand the detector's intrinsic weaknesses and programmatically generate a synthesis strategy in the form of executable code. This "logic-level" approach inherently preserves data privacy, leverages the LLM's core strengths in reasoning and code generation, and produces a reusable synthesis logic that is both detector- awarr and data-agnostic.
3 METHOD
3.1 PROBLEM FORMULATION AND MOTIVATION
Following previous works Yin et al. 2024 Ye et al. 2025), we formulate tabular anomaly detection (TAD) in a one-class classífication setting, where training set Duain only contains normal samples with x E X' and test set Dre contains both normal and anomalous samples. The goal of TAD is to learn a score function f X + I from Dusin. which assigns an anomaly score fxx) to given test sample, with higher score indicating a higher likelihood of being an anomaly. variety of methods have been developed for this task, such as eccosttruction-baee (e.g., PCA (Shyu et al. 2003),, isolation-based (e.g., Foreest (Liu et al. 2008), and density- (e.g., FCOD (Li et al. 2022 approaches. To make our exposition precise, we denote T ("IForest", "PCA", as the set of algorithm names, where t E 7 is a symbolic label specifying the chosen algorithm type. Each t corresponds to abstract, parameter-free free algorithmic description, A.. Applying the algorithm A, to the training set D Duain yields a concrete score function ft with learned parameters.
The efficacy of these classical TAD algorithms,, however, hinges their underlying assumptions about the nature of anomalies. For instance, IForest (Liu et al.) 2008) assumes anomalies are more easily isolated, while PCA (Shyu et al., 2003) assumes they have large reconstruction errors from learned low-dimensional subspace. Details of these detectors are in Appendix 6.4 These assumptions are often brittle and fail when confronted with heterogeneous, real-world data, leading to degraded performance (Wolpert& & Macready 1997 Han et al.) 2022). It raises critical question: how can we systematically enhance existing detectors be more robust against the violation of their own core logic?
Our core approach is strengthen detectors by exposing them their own blind spots through the synthesis of "hard" anomalies amomalies-samples specifically crafted to challenge the algorithmic assumptions of a given detector. By augmenting the training data with these targeted negative examples, we transform the learning problem from a limited one-class setting into more discriminative two-class setting. The success of this approach, however, hinges on generating anomalies of sufficient quality to be truly "hard". Naive, data-level methods, such as applying small perturbations to input features, often fail to target the core algorithmic logic of a detector. To overcome this, we introduce a paradigm shift from data-level optimization to logic-level strategic attack, leveraging the unique ability of Large Language Models (LLMs) to reason about abstract algorithmic mechanisms. The LLM's s role is not to process data, but to analyze detector's high-level logic, infer its weaknesses, and then
3

---

Published as a conference paper at ICLR 2026
(bata-aguon) aguoata
You are an expect in ancealy detection systezs. The training set containe only nornal axplee. I provide you sdstactoe type descrtption
Pewedpis
Piarztin
types
LIM
The zato steps aze
LIM
Delector description)
Pijeni Jous task is to seile
Pawodo code:
python Functicn
Beep
code of
Step
follow below
Pimpirmet
Tou should strictly
Fronpe Pistal
Replace
Prorpt Pink
Code'
Phase (Dats (Data-spactie
Reusable across different TAD datasets
Ve Tuus Narl
2 Dystn
Eshanced de tetcoo
InterEace
P'ym
Duini Max)
Bihhncedd
Dyy
Training
Dunis
:
InterEace
(r,n Nax)
Anoma lime
Drna
Enhanced
Code'
de battoo
Figure 2: The LLM-DAS framework consists of two phases: data-agnostic reasoning phase, where L.M generates a reusable anomaly synthesis for one type of detector, and (2) data-specific phase, where this code is applied to generate challenging anomalies for detector enhancement.
generate data-agnostic Python code that programmatically synthesizes anomalies tailored to exploit these specific vulnerabilities.
3.2 PROPOSED METHOD: LLM-DAS
This work proposes LLM-DAS (LLM-Guided Detector-Awar Anomaly Synthesis), a two-stage framework. The core of LLM-DAS is to first leverage an LLM'' reasoning to generate a data-agnostic synthesis code tailored for detector algorithm A, (Stage 1), and then execute this code to create the "hard" anomalies needed to enhance ft on a specific dataset (Stage 2). Notably, the detector-specific synthesis code is reusable across different TAD datasets. Fig. 2 illustrates the overall pipeline.
3.2.1 DETECTOR-AWARY CODE GENERATION VIA LLM
This stage aims to translate the LLM's abstract algorithmic knowledge regarding detector type t (represented by its algorithm A₂) into a concrete, executable synthesis code. As the LLM analyzes the detector not the data, this process is entirely data-agnostic preserve privacy and ensure the reusability of the generated code. Specifically, given detector type f, we construct a prompt Plute that guides the LLM capture the underlying assumptions and mechanisms of algorithm Ar, and then produce anomalies synthesis code that captures the kinds of anomalies that are inherently difficult for A₁ to detect. To fully exploit the reasoning capability of LLMs, the prompt Pente is defined as:
P'ods P Pécseription Pobjsctive Prequirements"
Below introduce the three key components (see Appendix 66.5 for details).
p Pdescription a summary and podudo-code of the detector algorithm A,. This information is generated by the LLM itself:
(i) Detector description
Pdescription LLM(pinna))
(2)
where prompt Pinntal the input for LLM with details provided in Appendix 6.5 This step provides structured context to prime the LLM for generating detector-aware synthesis code.
(ii) Objective specification Potjective- which instructs the LLM to generate code that synthesizes "hard" anomalies. A core tenet our framework is the use of symbolic interfaces, which are defined in this prompt section. For example, we state: "... After the Python function is completed, users can provide the function with: A trained PCA model (model) that exposes predi scoorescoeee (), The training samples (X_ trainj." This interaction paradigm crucial: by defining interfaces as symbolic placeholders rather than concrete values, the LLM can write without ever accessing the real data. effectively provides the LLM with a standard API to program against, positioning it as "algorithm strategist" rather than a "data processor." This enables the
ceneral-purpose program
4

---

Published as a conference paper at ICLR 2026
generated code to be both powerful acceessing training set statistics and querying the detector's scoring rchavior-and universally applicable across different datasets.
(iii) Generation requirements Prequirements' which impose constraints on the code format and func- tionality. Notably, we encourage the code to identify "borderline" normal training samples lying near the decision boundary of the detector, and transform them into anomalies leveraging LLM reasoning. This approach is effective for producing informative anomalous samples. Nevertheless, if the LLM discovers a superior strategy, is allowed to adopt it.
The LLM takes the prompt Peode as input and leverages its prior knowledge to understand the mechanism of algorithm A, (summarized as Pdeseription in Eq. 2 Based this understanding, reasons about which types of anomalies most challenging for A, to detect while being most informative for improving detection performance. The output strictly follows a Python code format:
Code' (Fute)
{ polleyy St. program St exxplanatinn } S Code',
policy:
where the code consists of three structured components: the policy Spatiey that specifies how anomalies should be synthesized in detail, the executable program S Sprogram that implements the policy policy in Python, and the explanation Sesplanation with clear comments explaining key steps in program St progrrmm This structured output, comprising not just program but also its underlying policy and explanation, significantly enhances the interpretability and trustworthiness of our approach, allowing users to verify the logic behind the LLM's synthesis strategy. We provide example template the generated code in List. 3.2.1 with detailed generated code provided in Appendix 6.6
The Generated Python Code Template
Crucially, this LLM--riven code generation is data-agnostic. The LLM reasons about detec- tor's 's algorithmic weaknesses based solely on its description-nevee observing raw data or model parameters, thus preserving privacy. This pro- cess yields a reusable, detector-speciff synthe- sis code without requiring any LLM fine-tuning, The resulting structured code instantiated with dataset-specific values in the next stage to syn- thesize anomalies.
def yeneza + barrd snpplee int, model X_train: adarray) np. nd.ndaryyy:
saw Pollcy stazchalder see
anonsly syathosis loric is applied here (detaill ls onitted for brevity!
Program and explanation placenolder (deta is owitted for hrevity! Esplanation for scep
Step xxx
zeturn np ap.arra (tt.araatteaannomllla..
3.2.2 DATASET-WISS HARD ANOMALY INSTANTIATION
Once the detector-aware code is generated, the next step is to instantiate it on a specific dataset. To do so, the generated code, denoted as Code', requires well-defined set of input interfaces to execute. We define this complete set of interfaces as 9, which comprises three core elements presented in their logical order: (1) Training set Dumin- which serves as the foundation for the instantiation process. The code requires this data not only to train the score function in the next step but also to access its distribution and statistical properties (such as the decision boundary) during the synthesis phase to generate more challenging anomalies. (2) A fitted score function fr: Using the training set D described above, we obtain a fitted score function ft by applying algorithm A, to D This score function provides the key standardized interface that maps any given input sample to an anomaly score. (3) The number of anomalies to synthesize Nayn a hyperparameter specifying the desired number of anomaly samples to be generated. Collectively, these three components constitute the complete set of information required for the code's 's execution. The complete interface set I is therefore defined as their union:
J2 = D U fe U Nsyn-
(4)
With this of interfaces I available for a specific dataset, we can execute the LLM--enerated code. The code operates as a function that accepts I as input and returns set of synthesized anomalies,
Code' J, +
D'y D'yn = (xlym))
This formulation makes explicit that the code consumes both the score function and the training set at instantiation time, while the LLM that produced the code itself remained data-agnostic during
5

---

Published as a conference paper at ICLR 2026
generation. The resulting Code', generated in single forward pass for a specific detector type t, can be applied universally across diverse datasets.
Case Study. To make this instantiation process concrete. now present case study for the IForest detector (Liu et al. 2008). The LLM--generte, code, Code operates based on specific synthesis policy designed to exploit the core mechanies of IForest. This policy s Slloeres, which the
ppliicy
LLM articulates as part of its output (Eq. 3 is detailed below in Policy (.2.2
Policy policy contained in Code' (Eq. 3) for Generating Hard Anomalies for IForest
The core weakness of IForest is that relies axis aligned splits isolate points. sample considered anomalous can be isolated in few splits (short path length), Conversely, sample is normal if it "deep" within the data cloud, requiring many splits be isolated (long path length). Our strategy exploits this by creating new points that are conceptually anomalous but are geometrically located in a way that maximizes their puth length, therehy looling the Furestt The policy consists of two main steps:
I. Identify 'Borderline' Normal Samples: These are the normal training samples that lie on the fringe or edge the derse data cloud. The [Forest model already less certain about these points, assigning them the highest anomaly scores among all normal samples. They serve as perfect "sceds' for our hard anomalies because they are already close to the decision boundary. We identify these by finding the training samples
top percentile anomaly scores.
2. Transform Seeds into Hard Anomalies via 'Controlled Extrapolation': We transform these bordertine seeds into anomalics. A naive transformation (e.g.. adding large random noise) would create an obvious outlier with a short path length, which is an "casy* anomaly. To create *hard* anomaly,
the seed point in way that doesn' it significanly shorten its path length.
In practice, the implementation of this policy relies on the interfaces provided to the code. Specifically, to identify "Borderline" Normal Samples (Step 1), the code uses the fitted to compute anomaly scores for all samples in the training set. It then selects a subset of these samples as "seeds" from the top percentile of scores. For Step 2, the code applies targeted modifications to these seed points. The objective is to push them into a sparser region of the feature space, making them factually anomalous, while algorithmically ensuring the transformation does not significantly reduce their path length as computed by the iForest score function ft. This process effectively creates anomalies that are "camouflaged" to appear normal to IForest, thus representing a significant challenge for the detector.
Detector Enhancement with Hard Anomalies. Finally, the synthesized anomalies are integrated with the original training set:
D = Duran U D syn:
and a binary classifier Je (e.g., a decision tree) trained on D to distinguish between normal and anomalous samples. By explicitly framing the task as supervised classification problem and exposing the classifier to these challenging synthetic anomalies, the learning process encourages the ft to capture more discriminative patterns between the two classes, thereby improving its ability to generalize and detect real- world anomalies. We fuse the original (f:) and enhancement (f.) score functions by summing their min-max normalized scores with the following final score:
(x) = Normmin--ax (f) + Normmin-mans (x))
(7)
This approach preserves the original detector's s biases while adding the nuanced patterns learned from synthetic data. A key aspect of our method is its adherence the one-class classification framework since training set Daain only have ground-truth normal data. We leverage L..M-generated code to synthesize anomalies tailored to the detector and the training dataset. This approach allows the detector to adapt to edge cases that it would otherwise fail to recognize, effectively broadening its coverage of the abnormal space while preserving its ability to model the normal distribution (mitigating the challenge of fragile assumptions in TAD). Overall, this straightforward yet principled strategy ensures that the benefits of LLM- -uided anomaly synthesis are fully incorporated into the detector, enhancing both its discriminative power and generalization ability.
3.2.3 SUMMARY AND DISCUSSION
The LLM-DAS framework operates in a two-phase process that decouples data-agnostic reasoning from data-specific synthesis. In Phase 1, an L.M analyzes a high-level description of a detector and generates a universal, reusable Python code that encapsulates a strategy for synthesizing hard anomalies. Crucially, this phase is data-agnostic, preserving privacy. In Phase 2, this code is instantiated on specific training set Dirain and its fitted detector fa to generate challenging anomalies. These anomalies are then used to train enhancement classifier fi, which is fused with fe to form the final detector F,. Please the detailed Algorithm in Appendix The core rationale of this framework is to improve detector robustness. Traditional one-class detectors rely on fragile

---

Published as a conference paper at ICLR 2026
Table I: The statistical information of detection performance improvement achieved by LLM-DAS (FF) over trained source detectors (f() on 36 datasets. "Baseline" means the average performance achieved by cor- responding source detector (f+) on all datasets. "Improv. (A)" indicates the average absolute performance improvement by the LLM-DAS (Fe) over ft, "Improv. (%)" indicates the average relative performance improve- ment in percentage. "Win Count" represents the number of datasets that LLM-DAS (Ft) made improvements over fa. p-value measures the improvement significance across the 36 datasets 5% significant).
AUC-PR
AUC-ROC
Detector
Baseline
Improv. (A)
Improw.
Count
p-valuc
Baseline
Improv. (A)
Improw.
Win Count
p-valuc
.9755
30/
.0271
.7349
.0325
7.64
.0155
IForest
.5224
0617
23.60
26/ 36
.0010
.7555
0385
10.90
28 36
.0034
OCSVM
5295
0723
84.49
/6/
.0239
.7141
.0377
10.02
25/36
.0170
ECOD
5376
0512
23.05
28//36
.0144
7056
.3988
8.20
26/36
.0183
DRL
.437
.4122
15.81
25/
.0338
8509
0272
3.79
21/36
.0035
assumptions that are often violated by real-world anomalies. By leveraging LLM's unique capability for algorithmic reasoning, our method programmatically generates samples that specifically target these assumptions, exposing the detector to edge cases it would otherwise miss. This targeted augmentation leads to a more nuanced decision boundary and better generalization(a theoretical intuition is in Appendix 6.14). Overall, our method offers three key advantages: (i) Data privacy, as the LLM never observes the data; (ii) Model-specificity, leading to highly effective synthesis; and (iii) Generalizability, as the framework is plug-and and-play module for various detectors.
4 EXPERIMENTS
4.1 EXPERIMENTAL SETUP
Datasets. We adopt an extensive benchmark with 36 datasets selected from Outlier Detection DataSets (ODDS) (Rayana 2016) and Anomaly Detection Benchmark (ADBench) (Han et al. 2022) following previous works (Yin et al., 2024 Ye et al. 2025). These datasets span diverse domains, including healthcare, science, and social sciences. The dataset properties are summarized in Appendix 6.2 Per the literature (Zong et al. 2018 Bergman & Hoshen 2020: Yin et al., 2024] Thimonier et al., 2024; Ye al.] 2025). we construct the training set by subsampling 50% of the normal samples. The remaining 50% of the normal samples are then combined with the entire set of anomalies to form the test set. We employ Area Under the Frecision-Recat Curve (AUC-PR) and Area Under the Receiver Operating Characteristic Curve (AUC-ROC) our evaluation criteria.
Implementation and Baselines Details. For the code generation phase, we utilized the Gemini- 2.5-Pro API. This represents a modest, two-time cost per detector type (Eq, 2 and Eq. B). as the resulting synthesis Code' is reusable across any dataset. The subsequent anomaly instantiation and binary Je classifier training phases were performed locally and incurred no further monetary cost. The number of synthesized samples is set to 10% of the training set size by default. Following recent studies (Yin et al. 2024. Thimonier et al. 2024] Ye et al. 2025), we implement the hyperparameters of all detector models according their original papers. In our experiments.
use PCA (Shyul et al. 2003), IForest (Liu et al. 2008), OCSVM VM (Schölkopf et al. 1999). ECOD (Li et al.] (022]. and DRL Ye et al.) 2025) five source detectors (based different assumptions) evaluate the effectiveness of LLM-DAS. In addition to these detector-based integrations, we also conduct direct comparisons against conventional and advanced TAD baselines further evaluate benchmark performance, Details of these detectors are provided in Appendix 6.4
4.2 MAIN RESULTS
Improvement over Source Detectors. We first evaluate the effectiveness of LLM-DAS by measuring its improvements over the original source detectors across 36 benchmark datasets. As summarized in Table overall, LLM-DAS consistently enhances all source detectors across both AUC-PR and AUC-ROC metrics. For instance, when enhancing OCSVM, LLM-DAS improves the AUC-PR by an average of 0.0723, corresponding to 84.49% relative improvement, and achieves gains on 25 out of 36 datasets. Similar trends can be observed for PCA, IForest, ECOD, and DRL, confirming that the ours is broadly effective across diverse detection algorithms. To assess whether the observed
7

---

Published as a conference paper at ICLR 2026
improvements are statistically significant, conduct a paired one-tailed t-test across the 36 datasets. The results show that most improvements achieve p- v-vuuu below 0.05, indicating that the performance gains statistically significant rather than random fluctuations. These results demonstrate that LLM-DAS can reliably enhance existing detectors by leveraging synthesized anomalies. Complete results can be found in Table and Table located in the Appendix 6.7
Comparison with Other Baseline Methods. We further compare the performance of baselines. Since LLM-DAS and
LLM-DAS with conventional and advanced TAD al.
the recent finetune-based AnoLLM (Tsai we cite the results of AnoLLM due to its high compu- tational cost, and perform other methods on the shared subsets. As shown in Fig. LLM-DAS, when coupled with DRL, achieves the highest average performance across these datasets. Notably, although both AnoLLM and ours leverage LLMs, the ways they are used differ fundamentally: AnoLLM fine-tunes small LLM with open-weights on each target dataset, learning a specific model for each dataset. In contrast, view the LLM with the reasoning ability as an algorithmic analyst: ex- amines the logic of detection methods and generates responding code, making our approach dataset-agnostic and independent of further LLM fine-tuning, Even with a significantly lower computational cost than AnoLLM, our method still outperforms Full results are provided in Table@lan 7a Appendix 6.8
2025) have some shared datasets,
OCSVM
KNN
PCA
iFarest
ECO0
DespSVDD
AutoEncoder
[CL
DTE
MCM
NPTAD
DRL
AnGLLM(360M
(urs(PCA)
(uLL
AUC-PR Performance (-)
Figure 3: Comparison of all models' perfor- across different datasets (in AUC-PR). The red triangles represent the average value. ADoLLM has two versions (135M and 360M parameters).
4.3 FURTHER ANALYSIS
Comparison with Other Anomaly Synthesis Methods. We compare LLM-DAS with several representative anomaly synthesis strategies, including Gaussian noise injection, random outliers, and SMoTE-based (Chawla al. 2002) sample generation. Fig. (a) reports the average AUC-PR across datasets (detailed results and base synthesis strategy details in Appendix 13.I). We can find that, naive methods usually yield inconsistent results. While methods like random outlier generation may offer marginal gains for simple detectors like IForest, they are not universally effective and can be detrimental. For instance, random synthesis severely degrades the performance of sophisticated models like DRL, highlighting the risk of a generic policy conflicting with a detector's 's intrinsic logic. In contrast, LLM-DAS DAS delivers consistent and substantial improvements across all models. Its detector-aware strategy generates hard anomalies tailored to each model's specific vulnerabilities, ensuring the augmented data is always informative and leads more robust decision boundary.
Ablation Studies on LLM-DAS Design. Our ablation studies (Fig, 4 (b)) validate the critical role of each core component in LLM-DAS by changing our designed prompt. First, to test our core detector-aware premise, Generic variant was created by removing the detector's principles from prompt. Second, to confirm the necessity of generating hard anomalies, Simple variant was prompted without access to the model.rredict (ccoic(tsssoe( function, preventing the LLM from assessing anomaly difficulty. Finally, to evaluate our borderline heuristic, a Random variant was instructed to transform randomly selected normal samples rather than borderline normal samples into anomalies. The inferior performance of each variant confirms that detector- the capability to generate
Different Anomaly Synthesis
Different Designs
CJRS
Average AUCAR
6.2
6-64
5X%
SYV 6M
4B
IForest
PCA
DRL
iForest
DRL
Base
Gauss
Random
Smete
LLM DWS
Base
Generic
Simple
Random
LLM DAS
Figure Performance comparison of anomaly synthesis methods (left) and LLM-DAS designs across different datasets (right) terms of AUC-PR.
8

---

Published as a conference paper at ICLR 2026
Table 2: Performance comparison in AUC-PR when enhancing OCSVM with the anomaly generation code
designed for IForest, PCA, OCSVM, respectively. The average relative improvement provided (t %).
Baseline
Synthesis code
Vertebral
Glass
Imgseg
Shuttle
Speech
Cardio
Vowels
Average
Forest
+0.1025
+000115
+0.0546
+0,0414
-0,0015
+0.1148
-0.9005
+0.0076(1 1.8%)
OCSVM
PCA
0.0037
+0.1108
+0,0378
+0,0457
00.025
00.176
0.1899
0.0213 4.72%)
OCSVM
+0.1216
+0.111
+0.0709
+0.0418
+0,0015
0.0531
-0.0711
+0.0295(1 6.53%)
(a) Visue lzation on thyroid
(b) Original Anomaly Scores
(c) Enhanced Anomaly Scores
Normal
4.0
Normol Anomaly
Normal
Thue Anomaly
True Anoma y
Synthetic Anomay y
Synthetic Anomaly
synthetic Anomaty
30-
Dersity
15-
1.-
0.0
0.6
1.0
1-2
0.0
3.5 2.0
Anomaly
Figure 5: Visualization synthetic hard anomalies and score distributions on Thyroid test dataset. (a) T-SNE plots of normal, real anomaly, and LLM-DAS generraed anomaly samples. (b) Kernel density estimation (KDE) of anomaly scores from the source detector ft. (c) KDE of anomaly scores from the enhanced detector F..
challenging anomalies, and focus on borderline samples are all critical to the success of LLM-DAS.
Please find details in Appendix 6.13.2
Cross-Detector Synthesis Results. To validate the critical role of our detector- aware design, we conducted a cross cross-detector experiment to test if a synthesis strategy for one detector could enhance another. We set the base detector ft as OCSVM and applied synthesis codes generated specifically for IForest, PCA, and OCSVM itself. The results in Table which report the absolute AUC-PR change, are revealing. The "mismatched" scenarios (e-g.. using PCA-specific code to enhance OCSVM) yielded inconsistent outcomes. While gains were observed on some datasets, this approach introduced a sigmificant risk of performance degradation, evidenced by a substantial drop of 0. 0.1899 on the Vowels dataset. In contrast, the "matched" synthesis (using OCSVM-specific code for the OCSVM detector) provided the most stable and significant average improvement. This experiment strongly demonstrates that the success of LLM-DAS stems not from a generic augmentation effect, but from the LLM's ability to programmatically exploit the unique mechanics of the target detector. It confirms that detector-awaad awwreness is the critical factor for achieving robust performance enhancement.
Visualization and KDE Analysis of Synthetic Anomalies. To further examine the quality of anomalies synthesized by LLM-DAS, we utilize T-SNE and Kernel Density Estimation (KDE) plots of anomaly scores on the Thyroid. Fig. (a) shows that the Synthetic Anomalies (green stars) are strategically placed near the boundary of the True Normal manifold, confirming they are hard anomalies that intentionally avoid the sparse, obvious outlier regions. This "hardness" is quantitatively proven by the KDE plots of the original score distribution Fig. (b). The synthetic anomaly distribution severely overlaps with both true normal and anomaly distribution. This indicates the base detector struggles to distinguish the synthetic samples from normal data. Crucially, after training with LLM-DAS, the enhanced detector's KDE in Fig. 5 (c) shows a significant rightward shift in the synthetic anomaly scores. This boundary refinement not only elevates the synthetic anomaly scores but also pushes the true anomaly score distribution further away from the normal score distribution. This confirms that exposure to LLM-DAS generated hard samples results in a significantly tighter and more robust decision boundary, improving overall generalization.
Additional Analysis. We incorporate Appendix 6.15 to demonstrate how LLM-DAS inherently targets detector-specific weaknesses across diverse anomaly types. We introduce a controllable hardness-level prompting interface and a comprehensive moder analysis in Appendix 6.16
CONCLUSION
This paper introduces LLM-DAS, a novel framework that reimagines the role of LLMs in tabular anomaly detection. Instead of treating LLMs direct data processors, we have successfully reposi- tioned them as "algorithmists" that reason about the intrinsic logic of detectors. This paradigm shift address two challenges: the L.LM's inherent difficulty with raw tabular data and the fragile assump-

---

Published as a conference paper at ICLR 2026
tions of conventional detectors. Our core contribution is fully programmatic, privacy-presery approach where the LLM generates detector-specifer specciic, data-agnostic, and reusable synthesis code to produce "hard" anomalies, enhancing model robustness. Extensive experiments on 36 benchmarks demonstrate that LLM-DAS significantly enhances a wide array of detectors. looking forward, the "LLLM an algorithmist" paradigm opens up exciting avenues, such enhancing algorithms in other domains or even automating algorithmic discovery. Our work paves the way for more adaptive and robust machine learning systems by integrating the algorithmic reasoning of LLMs.
Ethics Statement We confirm that this research complies with all applicable ethical guidelines and does not present any ethical issues.
Reproducibility Statement To ensure reproducibility. we provide source code through the link the abstract. Complete details regarding datasets, experimental settings, and implementation are documented in Appendix 6.2 Appendix 6.3 Jnndd Appendix 6.4
ACKNOWLEDGMENTS
The authors would like to thank the anonymous referees for their valuable comments. In this work, Hangting Ye. Jinmeng Li, Dandan Guo and Yi Chang are supported by the National Key R&D Program of China under Grant (No. 4023YFF0005400), the National Natural Science Foundation of China (No. 623B2043, No. U2341229, No. 623061 25), the Fundamental and Interdisciplinary Disciplines Breakthrough Plan of the Ministry of Education of China (No. XY2025XDXM903) and the New Cornerstone Science Foundation through the XPLORER PRIZE. Hongyuan Zha's 's research is supported in part by Shenzhen Stability Science Program 2023, and National Natural Science Foundation of China (No. 72495131).
Part of this work was carried out during Dandan Guo's visit to King Abdullah University of Science and Technology (KAUST).
REFERENCES
Zeeshan Ahmad, Adnan Shahid Khan, Cheah Wai Shiang, Johari Abdullah, and Farhan Ahmad.
Network intrusion detection system: A systematic study of machine learning and deep learning approaches. Transactions on Emerging Telecommunication Technologies, 32(1)e,,150, 2021.
Mohiuddin Ahmed, Abdun Naser Mahmood, and Md Rafiqul Islam. A survey of anomaly detection techniques in financial domain. Future Generation Computer Systems, 55:278-2888 2016.
Khaled Gubran Al-Hashedi and Pritheega Magalingam. Financial fraud detection applying data mining techniques: A comprehensive review from 2009 2019. Computer Science Review, 40: 100402, 2021.
Liron Bergman and Yedid Hoshen. Classification-based anomaly detection for general data, arXiv preprint Sttt::20000023555 2020.
Vadim Borisov, Tobias Leemann, Kathrin SeBler, Johannes Haug, Martin Pawelczyk, and Gjergji Kasneci. Deep neural networks and tabular data: A survey. IEEE transactions neural networks and learning systems, 2022a.
Vadim Borisov, Kathrin Seßler, Tobias Leemann, Martin Pawelczyk, and Gjergji Kasneci. Language models are realistic tabular data generators. arXiv preprint arXiv:2210.00 00.22200..620 06280, 2022b.
Markus M Breunig, Hans-Peter Kriegel, Raymond T Ng, and Jörg Sander. Lof: identifying density- based local outliers. In Proceedings of the 2000 ACM SIGMOD international conference on Management of data, pp. 93-104, 2000.
Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models few-shot learners. Advances in neural information processing systems, 33:1877-1901, 2020.
Yang Cao, Haolong Xiang, Hang Zhang, Ye Zhu, and Kai Ming Ting. Anomaly detection based on isolation mechanisms: survey. Machine Intelligence Research, 22(5):849 865,, 2025.
10

---

Published as a conference paper at ICLR 2026
Varun Chandola, Arindam Banerjee, and Vipin Kumar. Anomaly detection: A ACM computing surveys 41(3:), 41(3):1-58, 2009.
Nitesh V Chawla, Kevin W Bowyer, Lawrence Hall, and W Philip Kegelmeyer. Smote: synthetic minority over-sampling technique. Journal of artificial intelligence research, 16:321-335 3577, 2002.
Zhaomin Chen, Chai Kiat Yeo, Bu Sung Lee, and Chiew Tong Lau. Autoencoder-based network anomaly detection. In 2018 Wireless telecommunications symposium (WTS), pp. 1-5. IEEE, 2018.
Tuan Dinh, Yuchen Zeng, Ruisu Zhang, Ziqian Lin, Michael Gira, Shashank Rajput, Jy-yong
Sohn, Dimitris Papailiopoulos, and Kangwook Lee. Lift: sanguage-interfaced fine-tuning for non-language machine learning tasks. Advances in Neural Information Processing Systems, 35: 11763-11784, 2022.
Xi Fang, Weijie Xu, Fiona Anting Tan, Jiani Zhang, Ziqing Hu, Yanjun Qi, Scott Nickleach, Diego Socolinsky, Srinivasan Sengamedu, and Christos Faloutsos. Large language models (Ilms) on tabular data: Prediction, generation, and understanding- survey. arXiv preprint arXiv:2402. /7944, 2024.
Tharindu Fernando, Harshala Gammulle, Simon Denman, Sridha Sridharan, and Clinton Fookes. Deep learning for medical anomaly detection-a survey. ACM Computing Surveys (CSUR), 54(7): 1-37, 2021.
Yury Gorishniy. Ivan Rubachev, Valentin Khrulkov, and Artem Babenko. Revisiting deep learning models for tabular data. Advances in neural information processing systems, 34: 18922-88933, 2021.
Dandan Guo, Long Tian, Chuan Du, Pengfei Xie, Bo Chen, and Lei Zhang, Suspicious object detection for millimeter-wave images with multi-view fusion siamese network. IEEE Transactions on Image Processing, 32:4088 4102, 2023. doi: 10.1099/1P.202332277766.
Songqiao Han, Xiyang Hu, Hailiang Huang, Minqi Jiang, and Yue Zhao. Adbench: Anomaly
detection benchmark. Advances in Neural Information Processing Systems, 35:32142-32159) 2022.
Sungwon Han, Jinsung Yoon, Sercan Arik, and Tomas Pfister. Large language models can automatically engineer features for few-shot tabular learning. arXiv preprint arXiv:2404.09491, 2024.
Stefan Hegselmann, Alejandro Buendia, Hunter Lang, Monica Agrawal, Xiaoyi Jiang, and David Sontag. Tabllm: Few-shot classification of tabular data with large language models. In International conference on artificial intelligence and statistics, pp. 5549-5581. PMLR, 2023.
Ki Hyun Kim, Sangwoo Shim, Yongsub Lim, Jongseob Jeon, Jeongwoo Choi, Byungchan Kim, and Andre S Yoon. Rapp: Novelty detection with reconstruction along projection pathway. In International Conference on Learning Representations, 2019.
Zheng Li, Yue Zhao, Xiyang Hu, Nicola Botta, Cezar Ionescu, and George H Chen. Ecod: Unsuper- vised outlier detection using empirical cumulative distribution functions. IEEE Transactions on Knowledge and Data Engineering, 35(12):11811-2213 2022.
Fei Tony Liu, Kai Ming Ting, and Hua Zhou. Isolation forest. In 2008 eighth ieee international conference on data mining, pp. 413 422. IEEE, 2008
Victor Livernoche, Vineet Jain, Yashar Hezaveh, and Siamak Ravanbakhsh. On diffusion modeling for anomaly detection. In The Twelfth International Conference Learning Representations, 2024. URL http:ttt///peeeee...e.e. net/
Jachyun Nam, Kyuyoung Kim, Seunghyuk Oh, Jihoon Tack. Jachyung Kim, and Jinwoo Shin. Optimized feature generation for tabular data via Ilms with decision tree reasoning, Advances in Neural Information Processing Systems, 01:92352-923882 2024.
Guansong Pang, Chunhua Shen, Longbing Cao, and Anton Van Den Hengel. Deep learning for anomaly detection: A review. ACM computing surveys (CSUR), 54(2):1-38, 20...
11

---

Published as a conference paper at ICLR 2026
Emanuel Parzen. On estimation of probability density function and mode. The annals of mathemat- ical statistics, 33(3):0055-1076, 1962.
Emanuele Principi, Fabio Vesperini, Stefano Squartini, and Francesco Piazza Acoustic novelty detection with adversarial autoencoders. In 2017 International Joint Conference Neural Networks (IJCNN), pp. 3324-3330, IEEE, 2017.
Yujia Qin, Shihao Liang, Yining Ye, Kunlun Zhu, Lan Yan, Yaxi Lu, Yankai Lin, Xin Cong, Xiangru Tang, Bill Qian, et al. Toolllm: Facilitating large language models to master 16000+ real-worls apis. arXiv preprint 1117:23377.66799 2023.
Sridhar Ramaswamy, Rajeev Rastogi, and Kyuseok Shim. Efficient algorithms for mining outliers from large data sets. In Proceedings of the 2000 ACM SIGMOD international conference on Management of data, pp. 427-433, 2000.
Shebuti Rayana. Odds library. Stony Brook University, Department of Computer Sciences, 2016.
Lukas Ruff, Robert Vandermeulen, Nico Goemnitz, Lucas Deecke, Shoaib Ahmed Siddiqui, Alexander Binder, Emmanuel Müller, and Marius Kloft. Deep one-class classification. In International conference on machine learning. pp. 4393-4402. PMLR, 2018.
Lukas Ruff, Jacob R Kauffmann, Robert A Vandermeulen, Grégoire Montavon, Wojeiech Samek, Marius Kloft, Thomas G Dietterich, and Klaus-Robert Müller. A unifying review of deep and shallow anomaly detection. Proceedings of the IEEE, 109(5):75--795, 2021.
Bernhard Schölkopf, Robert C Williamson, Alex Smola, John Shawe-Taylor, and John Platt. Support vector method for novelty detection. Advances in neural information processing systems, 12, 1999.
Tom Shenkar and Lior Wolf. Anomaly detection for tabular data with internal contrastive learning. In International conference learning representations, 2022.
Mei-Ling Shyu, Shu-Ching Chen, Kanoksri Sarinnapakorn, and LiWu Chang. A novel anomaly detection scheme based on principal component classifier. In Proceedings of the IEEE foundations and new directions of data mining workshop, pp. 172-179. IEEE Press Piscataway, NJ, USA, 2003.
Kihyuk Sohn, Chun-Liang Li, Jinsung Yoon, Minho Jin, and Tomas Pfister. Learning and evaluat- ing representations for deep one-class classification. International Conference on Learning Representations, 2021. Utthttts:: htttttps:///peeeeviieee net forum htt.uummiid-CSSSySPSeeeee
David MJ Tax and Robert PW Duin. Support vector data description. Machine learning, 54:45 2004.
Hugo Thimonier, Fabrice Popineau, Arpad Rimmel, and Bich-Lièn DOAN, Beyond individual input for deep anomaly detection on tabular data. In Forty-first International Conference on Machine Learning, 2024. URL https: http///pppeeeeeeeeeeeeeeeeee /
net / forum? dd=chpp
Che-Ping Tsai, Ganyu Teng, Phillip Wallis, and Wei Ding. AnoLLM: Large language models for tab- ular anomaly detection. In The Thirteenth International Conference on Learning Representations, 2025. (tLtattss://ppeeeeeee
net forum 7VKHffT5X2
David H Wolpert and William G Macready. No free lunch theorems for optimization. IEEE Iransactions on evolutionary computation, 1(1):67-82, 1997.
Hongzuo Xu, Guansong Pang, Yijie Wang, and Yongjun Wang. Deep isolation forest for anomaly detection. IEEE Transactions Knowledge and Data Engineering, 1251244125,,1 2023. doi: 10.11099KDDEE22233270222
Jiahuan Yan, Bo Zheng, Hongxia Xu, Yiheng Zhu, Danny Z Chen, Jimeng Sun, Jian Wu, and Jintai Chen. Making pre-trained language models great tabular prediction. arXiv preprint arXiv:2403.0188/ 2024.
Hangting Ye, Zhining Liu, Wei Cao, Amir M Amiri, Jiang Bian, Yi Chang, Jon D Lurie, Jim Weinstein, and Tie- Yan Liu. Web-based long-term spine treatment outcome forecasting. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 3082-3092, 2023a.
12

---

Published as a conference paper at ICLR 2026
Hangting Ye, Zhining Liu, Xinyi Shen, Wei Cao, Shun Zheng, Xiaofan Gui, Huishuai Zhang, Yi Chang, and Jiang Bian. Uadb: Unsupervised anomaly detection booster. In 2023 JEEE 39th International Conference Data Engineering (ICDE), pp. 2593-2606. IEEE, 2023b.
Hangting Ye, Wei Fan, Xiaozhuang Song, Shun Zheng, He Zhao, Dan dan Guo, and Yi Chang. PTaRL: Prototype-based tabular representation learning via space calibration. In The Twelfth International Conference on Learning Representations, 2024. /RRLattts///ppeeeeiee
net Net//orrumP1d-G3222220
Hangting Ye, He Zhao, Wei Fan, Mingyuan Zhou, Dan dan Guo, and Yi Chang. Drl: Decomposed representation learning for tabular anomaly detection. The Thirleenth International Conference on Learning Representations, 2025.
Jiaxin Yin, Yuanyuan Qiao, Zitang Zhou, Xiangchao Wang, and Jie Yang. Mem: Masked cell modeling for anomaly detection in tabular data. In The Twelfth International Conference on Learning Representations, 2024.
Tianping Zhang, Shaowen Wang, Shuicheng Yan, Jian Li, and Qian Liu. Generative table pre-training empowers models for tabular prediction. arXiv preprint vrXiv:2305.0969. 2023.
Yue Zhao, Zain Nasrullah, and Zheng Li. Pyod: A python toolbox for scalable outlier detection. Journal of machine learning research, 20(96):1-7,20) 2019.
Tianyu Zheng, Ge Zhang, Tianhao Shen, Xueling Liu, Bill Yuchen Lin, Jie Fu, Wenhu Chen, and Xiang Yue. Opencodeinterpreeee:: Integrating code generation with execution and refinement. arXiv preprint 4:Xi::2402.146588, 2024.
Bo Zong, Qi Song. Martin Renqiang Min, Wei Cheng, Cristian Lumezanu, Dacki Cho, and Haifeng Chen. Deep autoencoding gaussian mixture model for unsupervised anomaly detection. In International conference on learning representations, 2018.
13

---

APPENDIX
TABLE OF CONTENTS
Introduction
2
Related Work
Method
3.1
Problem Formulation and Motivation
3.2
Proposed Method: LLM-DAS
3,2.1
Detector-Awand Code Generation via LLM
3.2.2
Dataset- Wise Hard Anomaly Instantiation
3.2.3
Summary and Discussion
Experiments
4.1
Experimental Setup
Main Results
Further Analysis
5
Conclusion
Appendix
14
6.1
Use of LLMS
15
6.2
Datasets details
15
6.3
LLM-DAS details
15
6.4
Baseline details
15
6.4.1
Base Detectors Coupled with LLM-DAS
15
6.4.2
Additional Conventional and Advanced TAD Baselines.
18
6.4.3
Implementation Details.
18
6.5
Example Prompt Used in LLM-DAS
19
6.6
Example Generated Code by LLM
20
6.7
Full Results of Improvement Over Source Detectors
23
6.8
Full Results of Comparison with Other Baseline Methods
23
6.9
Varying LLM backbones)
28
6.10
Computational Efficiency.
28
6.11
Visualization and KDE Analysis Synthetic Anomalies
28
6.12
Sensitivity Analysis
30
Additional results
33
6.13.1
Comparison with Alternative Anomaly Synthesis Methods
33
6.13.2
Ablation Studies on LLM-DAS Design
37
6.14
A Simple Theeoeeiicl Illustration of Boundary Refinement
41
6.144.1
Motivation and Theoretical Abstraction
41
6..2
Margin Transfer from Synthetic Hard Anomalies
41
6.14.3
Remarks Applicability and Model Classes
42
6.14.4
Convergence and Stability of the Fused Detector
42
6.14.5
Justification for Local Boundary Refinement Mechanism LLM-DAS
6..4
Summary
43
6.15
Petector-Award Anomaly Synthesis Across Different Anomaly Types
44
6.15.1
Motivation and Experimental Philosophy,
6.15.2
Experimental Setup: Constructing Type-Specific Testbeds
44
6.15.3
Analysis Procedure for LLM-DAS)
44
6.15.4
Original detectors' priori different types of anomalies.
45
6.15.5
Key findings: LLM-DAS automatically targets the anomaly y types that each
detector performs worst
45
14

---

Published as a conference paper at ICLR 2026
6.16
Hardness-Contree Synthetic Anomalies and Side-Effect Analysis
48
6.17
Analysis of Generating Detector-Specifte Specitic Binary Classifiers
51
6.18
Analysis of Generating Synthetic Samples Targeting Multiple Weaknesses of Base
Detector
52
6.19
How we ensure the rohustness of LLM-DAS?
57
6.20
On Isolating the Contribution of LLM Reasoning
58
6.1
USE OF LLMS
Large Language Models were used as assistive tools the preparation this manuscript. We employed L.LMs for grammar checking, LaTeX formatting, and improving the clarity of technical descriptions. The core scientific contributions and conclusions presented in this paper originate from the authors' work.
6.2 DATASETS DETAILS
We adopt an extensive benchmark with 36 datasets selected from Outlier Detection DataSets (ODDS) [Rayana] 20T6) and Anomaly Detection Benchmark (ADBench) (Han al. 2022) following previous works (Yin et al. 2024 Ye et al. 2025). These datasets span diverse domains, including healthcare, science, and social sciences. The dataset properties are summarized Table 3
6.3 LLM-DAS DETAILS
For the code generation phase, we utilized the Semini-2.5-PPra API. This represents modest, two- time cost per detector type (Eq. 2 and Eq. 3). as the resulting synthesis Code is reusable across any dataset. The subsequent anomaly instantiation and binary fo classifier training phases were performed locally and incurred no further monetary cost. The number of synthesized samples is set to 10% of the training set size by default. The detailed algorithm is as follows.
Algorithm LLM-DAS training and inference workflow.
1: Input: Normal-only training set Drain test set Dies (labels not accessed), LLM API, detector type;
2: Obtaining Páescription that summarizes the algorithm A, of t and provides its pseudo code describ-
ing the concrete steps (Eq.2):
3: Formulate prompt Prode describing the detector mechanism, synthesis objectives and require-
ments (Eq.II: [T;
4: Query LLM with prompt P'ode generate detector-aware anomaly synthesis code Code (Eq.3): 33:
5: Train the initial score function fe on Derain;
6: Extract interfaces J, Dunin U fe U Neyn (Eq. 4
7: Instantiate the LLM-generated code Code' using the interfaces U, to synthesize hard anomalies
D'yn (Eq. 5):
aug 8: Augment the training set: Dt = Duain U D (Eq,6)
9: Train binary classifier D to obtain the enhanced score function fz:
10: Integrate the source function ft with fr to form the final function F3 (Eq. 7
Output: Final anomaly scores (x(x) Dwa).
6.4
BASELINE DETAILS
6.4.1
BASE DETECTORS COUPLED WITH LLM-DAS
Following recent studies (Yin et al. 2024 Thimonier et al. 2024 ct al. 2025). we implement the hyperparameters of all detector models according their original papers. In our experiments,
15

---

Published as a conference paper at ICLR 2026
Table 3: Dataset properties, We use 36 commonly used tabular anomaly detection datasets this paper.
Samples
Dims
Anomalies
Abalone
4177
7
2081
Amazon
10000
768
500
Annthyroid
7200
534
Arrbythmia
452
274
66
Breastw
683
239
Campaign
41188
62
4640
Cardio
1831
21
176
Cardiotocography
2114
21
466
Comm.and crime
1994
101
993
Fault
1941
27
673
Glass
214
Hepatitis
80
19
13
Imgseg
2310
990
Ionosphere
351
33
126
Lympho
148
Mammography
11183
260
Mnist
7603
100
700
Musk
3062
166
97
Optdigits
5216
64
150
Parkinson
195
22
147
Pendigits
6870
16
156
Pima
768
268
Satellite
6435
36
2036
Satimage-2
5803
Shuttle
49097
9
3511
SpamBase
4207
57
1679
Speech
3686
400
61
Thyroid
3772
93
Vertebral
240
30
Vowels
1456
12
50
WDBC
367
30
10
WPBC
198
33
47
Wbe
378
30
Wilt
4819
5
257
Wine
129
10
Yeast
1484
8
507
use PCA (Shu 2003). IForest (Liu 2008), OCSVM (Schölkopf al. 1999), ECOD Li et al. 2022), and DRL (Ye et al. 2025) as five source detectors (based on different assumptions) to wate the effectiveness LLM-DAS. The details of these detectors and LLM's s opinion towards their weakness (included in the generated code Code') are as follows.
PCA. Principal Component Analysis (PCA) is commonly used method for dimensionality reduction and anomaly detection. It identifies directions in the data (called principal components) along which the variance is maximized. In anomaly detection, PCA can be used reconstruct each sample from the top principal components and compute the reconstruction error the anomaly score. Samples with higher reconstruction error are considered more anomalous.
Forest. Isolation Forest (IForest) is ensemble-based anomaly detection method that isolates anomalies instead of profiling normal data points. The key intuition is that anomalies are few and different, they easier to isolate using random partitions. IForest builds multiple random binary trees (isolation trees) by recursively splitting data based on randomly chosen features and split values. Data points that require fewer splits to be isolated are more likely be anomalies, while normal
16

---

Published as a conference paper at ICLR 2026
points typically require more splits. The average path length across trees is used to compute an anomaly score, where shorter paths indicate higher anomaly likelihood.
OCSVM. One-Class Support Vector Machine (OCSVM) is kernel-based anomaly detection method that learns a decision boundary around normal data. It maps the input data into a high-dimensional feature space using a kernel function, then finds the smallest region (a hyperplane that encloses most of the normal samples. The assumption is that normal data lies in a dense region, while anomalies fall outside this boundary. OCSVM is particularly effective when the training set contains only normal samples, as it explicitly models the support of the normal data distribution.
hypersphere)
ECOD. ECOD (Empirical Cumulative Distribution--ased Outlier Detection) is lightweight, univari- ate anomaly detection method that leverages the empirical cumulative distribution (ECDF) of each feature independently. It computes how extreme a value is relative to the distribution of that feature by evaluating its position in the ECDF. The core idea is that anomalous values often lie in the tails of the distribution. ECOD combines the tail probabilities across all features to produce an overall anomaly score, without assuming any parametric distribution. This makes it simple, interpretable, and effective for high-dimensional tabular data with only normal samples for training.
DRL. DRL (Decomposed Representation Learning) is an anomaly detection method designed for tabular data that learns only from normal samples. Instead of relying purely on reconstruction, DRL enforces structured latent space where each normal representation is expressed combination of fixed, orthogonal basis vectors. This decomposition constraint encourages normal samples occupy a well-defined subspace, while anomalies naturally fall outside of it. By amplifying discrepancies in this constrained representation space, DRL improves separation between normal and anomalous patterns. The anomaly score is derived from how poorly a test sample aligns with the decomposed latent space, optionally combined with reconstruction error.
linear
LLM's opinion PCA's weakness. PCA's Blind Spot: PCA-based anomaly detectors learn low-dimensional subspace (the "principal subspace") that captures the maximum variance of the normal training data. The anomaly score is the reconstruction error, which is the distance of a sample to this subspace. Consequently, PCA is good at detecting samples that lie far from this subspace. Its primary weakness detecting anomalies that lie *within* * this learned subspace but are far from the cluster of normal data. Such points are "anomalous" because they are in an unobserved region, but have a low reconstruction error, fooling the detector.
LLM's opinion on Iooeest's weakness. The core weakness of the Isolation Forest (IForest) lies in its reliance on axis-aligned splits to isolate data points. A sample is deemed anomalous if it can be isolated with just few splits (resulting in short path length). Conversely, sample is considered normal it is "deep" within the data cluster and requires numerous splits for isolation (leading to a long path length). Therefore, it exhibits insufficient sensitivity to samples that reside in the principal component subspace and are far from the data center, to synthetic anomalies within dense regions, and to samples where all feature values normal yet their combinations are novel. This is because these anomalous samples all result in longer split paths, thereby receiving lower anomaly scores in IForest.
LLM's opinion on OCSVM's weakness. The core mechanism of One-Class SVM (OCSVM) is to learn decision boundary that encloses normal data, and determine whether a sample anomalous based on the sample's 's relative position to this boundary (quantified by an anomaly score). The decision boundary of OCSVM is entirely defined by support vectors, while "borderline normal samples" themselves are the group "closest to anomalies" among normal data they have the highest anomaly scores among all normal samples. When such samples are slightly pushed across the decision boundary and converted into anomalous samples, OCSVM becomes even less able to effectively distinguish between "normal samples inside the boundary" and "neighboring anomalous samples outside the boundary"; the two groups are extremely close in the feature space, and the difference in their anomaly scores is negligible. This ultimately leads to the formation of an ambiguous zone for anomaly determination near the decision boundary of OCSVM, resulting in obvious detection blind spots.
LLM's opinion ECOD's weakness. ECOD assesses the anomaly of a sample by evaluating how extreme each feature value is in its univariate distribution, distributtion,ndeeeeddee independently of other features. A hard anomaly for ECOD is therefore sample whose feature values individually common (i.e., not in the tails of their distributions) but whose *combination of feature values is novel or unseen.
17

---

Published as a conference paper at ICLR 2026
LLM's opinion on DRL's weakness. DRL first learns structured latent space spanned by orthogonal basis vectors, and then uses the degree of deviation samples from the "structured latent subspace defined by the decomposition process" the basis for anomaly scoring. Under this mechanism, normal samples form a tight alignment with this latent subspace; once a sample's latent space representation deviates, the model will classify it anomaly. DRL. often struggles effectively detect samples that are inherently anomalous yet maintain a high degree of alignment with the learned latent subspace.
6.4.2 ADDITIONAL. CONVENTIONAL AND ADVANCED TAD BASELINES.
In addition to these detector- baaec integrations, also conduct direct comparisons against con- ventional and advanced TAD baselines to further evaluate benchmark performance. Specifically, KNN (Ramaswamy al. 2000), LOF (Breunig et al. 2000) represent classic AD approaches that continue to maintain populai Aapularity..oo In addition, we compare our method to recent deep learning based methods, namely Deep SVDD (Ruff et al. 2018), AutoEncoder (Chen al. 2018). ICL (Shenkar & Wolf 2022). DTE (Livernoche et al.]|2024) MCM (Yin et al. (022)) and NPT-AD (Thimonier al., 2024). recent attempt A (aai al., 2025) has been made to apply LLMs to tabular anomaly detection by fine-tuning them on normal samples via next-token prediction, enabling model to act as a generative learner of the normal distribution. However, this approach still requires direct access to raw feature values and incurs the additional cost of fine-tuning, limiting its practicality.
6.4.3 IMPLEMENTATION DETAILS.
We use the popular PyOD python package (Zhao et al., 2019) implement OCSVM, LOF, PCA, IForest, ECOD, Deep SVDD and AutoEncoder. We use the DeepOD python library (Xu et al. 2023 to implement ICL. The implementation of the other methods based on their official open- source code releases. Following latest works (Yin et al. 2024 Ye et al. 2025). We implement all baseline models' hyperparameters following their original papers. All the methods are implemented with identical dataset partitioning and preprocessing procedures, following previous works YYe al. 2025).
18

---

Published as a conference paper at ICLR 2026
6.5 EXAMPLE PROMPT USED IN LLM-DAS
Here, we take the IForest as an example, i.e., = =IFoorest"
Example Prompt Pinitial (the input Eq. 2) for Generating Detector Description.
You are an expert anomaly detection systems. The training set contains only normal samples. I will provide you the <lForest>, Please return description of this detector, and the pseudo code of the algorithm (stepl, step2....). ). The answer format for another detector is: Here you should provide one paragraph for description The main steps of <detector type> for anomaly detection are: Here you should provide the main steps for this algorithm xxx.
XXX.
XXX.
Example Prompt P Pleseription (the output of Eq. Serving One Part of P'ode
Isolation Forest (IForest) is an ensemble-based anomaly detection method that isolates anomalies instead of profiling normal data points. The key intuition is that anomalies are few and different, so they are easier to isolate using random partitions. IForest builds multiple random binary trees (isolation trees) by recursively splitting data based on randomly chosen features and split values. Data points that require fewer splits to be isolated are more likely to be anomalies, while normal points typically require more splits. The average path length across trees is used to compute an anomaly score, where shorter paths indicate higher anomaly likelihood.
The main steps of Isolation Forest (IForest) for anomaly detection & Randomly select a subsample of the training data to build each tree.
* For each tree, recursively split the data by choosing random feature and random split value within its range, until the data isolated or the maximum tree depth is reached. & For each sample, compute its path length (the number of splits required for isolation) in every tree.
Average the path lengths across all trees and normalize them compute the anomaly score. Classify samples as anomalies if their score exceeds chosen threshold (higher score + more anomalous).
19

---

(the input of Eq. for Published as a conference paper at ICLR 2026
Example Prompt Péode Pdeseription + Ponjective Generating Synthesis Code
Prequirements
You are an expert in anomaly detection systems. The training set contains only normal samples. We use Forrst detector, where the anomaly score is computed using model.ppreicct predicc_sooct))))((. scoree)_ The higher the score, the more anomalous the sample. The description of IForest.
Isolation Forest (IForest) is an ensemble-base anomaly detection method that isolates anoma- lies instead of profiling normal data points. The key intuition is that anomalies are few and different, so they are easier to isolate using random partitions. IForest builds multiple random binary trees (isolation trees) by recursively splitting data based on randomly chosen features and split values. Data points that require fewer splits to be isolated anomalies, while normal points typically require more splits. The average path length across trees is used to compute anomaly score, where shorter paths indicate higher anomaly likelihood.
more likely to be
The main steps of Isolation Forest (IForest) for anomaly detection are: Randomly select a subsample of the training data to build each tree.
For each tree, recursively split the data by choosing a random feature and random split value within its range, until the data is isolated or the maximum tree depth is reached. * For each sample, compute path length (the number of splits required for isolation) every tree.
* Average the path lengths across all trees and normalize them compute the anomaly score. Classify samples anomalies if their score exceeds chosen threshold (higher score + more anomalous).
Your task is to write Python function generate harr__ard__aa sair___nomalie((..) that generates anomalies which are the most difficult for the IForest detector to detect. This means that you the generated anomalies should have relatively low anomaly score, thus they are hard to be detected. But these anomalies are helpful to build more robust detector. After the Python function is completed, users can provide the function with: A trained IForest model (model) that exposes predict_score(). training samples (X train).
Requirements: Your should strictly follow below requirements:
1. You must use your expertise to give anomalies generation policies that are specific designed for IForest, not model-agnostic policy.
2. Generated samples should have as low a score as possible from model. prediet__cooreeeeeeeeeeeeeeeeeee To achieve it, you first find the set of 'borderline' normal training samples based on your unique and professional understanding to IForest, not only based on the anomaly score. Then transform them to anomalies that is tailor-designed for IForest. Please note that the transformation function should be specific for IForest, which means that it is not general transformation for other detectors.
3. For the model, you can only use the function predictteeeic_sgg sccore.
4. Use NumPy generate the samples, and output an array of shape (n_samples, d). And it should generate anomalies much as want.
5. The function should allow setting:
the number of samples (n_ (n_saslles).
the trained IForest model (model),
training samples (X train).
Return only the complete Python function generate hard anomalics(...), with policy you used for genenrating anomalies and clear comments explaining key steps.
6.6 EXAMPLE GENERATED CODE BY LLM
Code 1: Generated Code (the output of Eq. 3) for IForest-Specifee Hard Anomaly Generation
import numpy as np def generate_haree saatte_hrr___anae i ies (n_samples) fnt, model, X_train: np. ndarray):
20

---

Published as a conference paper at ICLR 2026
Generates anomalies that are difficult for a trained Isolation Forest (IForest) model to detect.
These "hard" anomalies are designed to have relatively low anomaly scores, making them resemble normal data from the perspective of the IForest, thus challenging the detector.
7
Policy for Generating IForest Hard Anomalies:
The core weakness IForest that it relies on axis-a igned splits to isolate points.
11
A sample is considered anomalous if it can be isolated in few splits (short path length).
Conversely, a sample is normal if it is "deep" within the data cloud, requiring many splits to isolated (long path longth).
13
Our strategy exploits this by creating points that are conceptually anomalous but are geometrically located in way that maximizes their path length, thereby fooling the IForest.
The policy consists of two main steps:
17
18
1. Identify 'Borderline' Normal samples:
These are the normal training samples that lie on the fringe edge of the dense data cloud.
The IForest model is already less certain about these points, assigning them the highest anomaly scores among all normal samples.
21
They serve as perfect "seeds" for our hard anomalies because they are already close to the decisien boundary
22
We identify these by finding the training samples in the top percentile of anomaly acores.
2. Transform Seeds into Hard Anomal via 'Controlled
Extrapolation's
25
We transform these borderline seeds into ancmalies.
A naive transformation (e.g., adding large random noise) would create an obvious outlier with short path length, which is an*easy* anomaly.
27
To create a *hard* anomaly, we must move the seed point in a way that doesn't significantly shorten its path length.
29
The chosen transformation
a controlled extrapolation along the vector pointing from the center of the training data to the berderline seed point. 'nex_anomaly seed magnitude (seed data_center) This pushes the borderline point slightly further away from the data's core, making it a true anomaly.
32
However, because it's moved along an existing axis of the data's distribution, it remains "camouflaged", The new point is not in completely isolated region of the feature space but rather just outside the densest part of the manifold.
34
An :Forest will still require a zolatively high number of splits to isolate it compared to a random, distant outlier, resulting
deceptively low anomaly score.
36
This tailored approach ensures the generated ancmalies specifically target the operational logic of the Isolation Forest, making then truly "hard" to detect.
21

---

Published as a conference paper at ICLR 2026
Args:
39
R_samples ( The number of hard anomaly samples to gencrate.
model: A trained Isolation Forest model with
predict_score () method. The method should return higher scores for more anomalous samples. X_train (np, adarray) The training data (normal samples)
41
used to train the model, with shape (n_train_samples n_features).
43
Returns:
44
np. ndaraay:y:: An array of generated hard anomalies with shape (n_samples, n f_features).
unn
46
# 1. All package imports must be done inside the function.
47
import numpy as пp
48
if not hasattr (model, 'predict_scoro');
raise AttributeRrror ("The provided model must have predict_score method.")
51
if not SxinttancexXttra raise ("X_ must be 2D NumPy array.") if n s_samples <- 0:
np-ndarray) or X_train.ndi 1= 2:
52
54
raise ValueError ("n_ samples must be positive integer.")
55
56
V 2. Identify 'borderline' normal training samples.
V These are the normal samples that the model already finds most ancmalous.
58
$ We define them as the top 208 of training samples with the highest anomaly scores.
F This percentile is a tunable parameter but 80 (for top 208) is robust choice.
("Step 1: Identifying borderline normal samples from the training set...")
61
train_scores = ciaeel..redict_eee (X_train))
Find the score threshold for the 80th percentile. # Samples with scores above this are our "borderline" seeds. score thoeshthreehold ap.percentile Strain_scoress 80)
66
borderline_ indices np. where (train_scores score_threshold) [0]
68
69
# If no samples are above the threshold (e.g., all scores are identical),
# fall back to using the entire training set as potential seeds.
71
if len (orrdertiiineeendnieeee indices) == 0: inverlinn_iidiceer = ap. arange LLn (X_((aaaa
72
X_train [brrde/borrrriiii ine
75
print (f" {len (borderline (amprreeese_smpess borderline samples to use as seeds.")
F 3. Transform borderline samples into hard anomalies. $ We will gencrate each hard anomaly from randomly chosen borderline seed.
print 2: Goncrating (n_samples) hard anomalics via controlled extrapolation...
81
$ Calculate the georetric center (mean) the normal data distribution.
data_center = men (X_ _rairin axis-0)
22

---

Published as a conference paper at ICLR 2026
hard anomalies
for range (n_samples);
36
Randomly select a borderline sample to serve as the base for our new anomaly.
We sample with replacement, allowing us to generate more ancmalies than seeds.
seed_idx - np. na.dom randint (0, len phorderline_samples) semd_sample werderline_sampleee h ssed__idx]
89
Calculate the direction vector pointing from the data center the seed sample.
92
This vector represents direction of natural variation in the data. cirection_vector
data_center
95
Define a small, random magnitude for the extrapolation. & small magnitude ensures the now point is not an ebvious outlier but just
96
beyond the boundary of the normal data cloud.
Values between 58 and 258 of the vector length work well
99
magnitude = np. randon uni form (0.05, 0.25)
100
Create the hard anomaly by pushing the seed sample along the direction vector.
102
perturbation direction_vectorr * magnitude
103
new_anomaly = seed_sample + perturbation
hard_anoma lieeeiieees liss append (new mnw__anmmlly)
106
107
print (" ("Generation complete.")
108
# 4. Return the generated samples as a NumPy array.
return np.array (hard_anomalies)
6.7
FULL RESULTS OF IMPROVEMENT OVER SOURCE DETECTORS
We evaluate the effectiveness of LLM-DAS by measuring its improvements over the original source detectors across 36 benchmark datasets. The full results are provided in Table and Table
6.8 FULL RESULTS COMPARISON WITH OTHER BASELINE METHODS
We further compare the performance of LLM-DAS with conventional and advanced TAD baselines. The full results are detailed in Table G and Table 7 Since LLM-DAS and the recent mased A (Tsai et al. 2025) have some shared datasets, we cite the results of AnoL.M due to its high computational cost, and perform other methods on the shared subsets.
23

---

Published as a conference paper at ICLR 2026
Table 4: The performance improvement achieved by LLM-DAS (F,) trained source detectors (fr) on 36 datasets in terms of AUC-PR (1).
PCA
+LLM-DAS
IForest
+LLM-DAS OCSVM +LLM-DAS
BOOD
+LLM-DAS
DRL
+LLM-DAS
Abslone
0.841a
0.848
0.855uams
0,846ac
0.849
0.65529
0.64520002
0.885an
0.902.amm
Amazon
0,107s:
0.108et401
0,109
0.109
0.105et
0.106so
0.104gb
0.104ga00c
0.121
0.12e0.00
Annthyroi
0.566e:
0.66
0.615
0.62-aess
0.185
0.248
0.4
0,304
0.676
0.762-aux
Arrhydhmia
0,534
0.55118013
0.51.0m44
0.602.amm
0,534ac
0.609
0.446.n00
0.466.eam
0.627uamm
0.73A0014
Breastw
0,993
0.996:0am
0.945-0
0.995-umm
0.993
0.995un
0.95240
0.977.ea
0.99744.05
0.997-amm
Campaign
0.488ac
0.488ac
0.461
0.452.0007
0.475ae
0.435an
0.471ao
0,503ue
0,501a0.006
0.495
Cardio
0.863el
0.824gh014
0.702et029
0 0.622anme2
0.861
0.808
0,364
0.716
0.833et.024
0.886
Cudietoooorrpphy
0.697as
0.734s8.06
0.604asu02
0.638
0.662a0
0.703auer
0.697a9
0.66-aacco
0.754
0.805
Comm and crime
0.889et
0.881
0,894a0.009
0.896
0.837ad
0.843
0.685eb
0.702
0,916st.04
0.947=mm
Fault
0.604
0.603:o.c
0.595
0.577
0.606
0.542-no
0.517ko
0.573keam
0.665
0.705
Glass
0.128sea16
0.095aau0s
0.12sa.2
0.09-m
0.201
0.111a0
0.125:ea45
0.167ao
0.493.0115
Hepatitis
0.583uc
0.62610888
0.418ucmm2
0.566.ame
0.282
0.3
0.405
0.477
0.663ue.100
0.696.m.07
Imgseg
0.772s
0.824
0.756xt.012
0.859
0.788
0.859
0.737
0.844aamz
0,924st.007
0,94
Tonosphere
0.897at
0,926s842
0.977
869
0.897
0.838
0,97
0.99-a013
0
0.985-mm
Lympha
1:0
0.989
0.979.eaz
0.811
0.934.as
0.897
0.97
1m002
0.87
Mammography
0.417
0.579kaam
0.333
1.57
0.418
0.536
0.5384o
0,543+aa
0.841-ume
0.529tams
Maist
0.65.
0.65.a
0.535
0.601.aa1
0.169I
0.181
0.302:n00
0.322xx.04
0.887
0.911aums
Musk
0.997aac06
0.528
0.061a:
0.868aum5
0,982eb
120
Optdigits
0.06-n
0.06.s
0,157eun
0.179mum4
0.069
0.928a0
0.067-000
0,087
0.936
0.957=am7
Parkinson
0.93em
0,944ana0
0.96
0.95
0.889
0.92auu
0,891
0. 0.863
0.921
0,966
Pendigits
0.38640
0.485
0.513-0m
0.602-mao9
0.518
0.415
0.498.aa2
0.936.0.13
0.885-mm
Pina
0.701
0.751.0.66
0.666x8.007
0.74.n017
0.701
0.65 1a65
0.588
0.5692001=
0.745me.:2
0.791
Satellite
0,778es
0.792ah.01
0.858st.06
0.808
0.778mt
0.832
0.833eo
0. 0.803s
0.869at.006
0,894
Satimage-2
0.919
0,931
0.885
0.871
0.919
0.920014
0.778a9
0.934
0.97.n044
0.98:a.0
Shuttle
0.963er
0,991=0a2
0.917
0.995
0.949
0.991
0.982eb
0.992ea
0,982s0006
0.999.
SpamRase
0.818
0.823-ea0
0.89-aax
0.889-ao7
0.814
0.814-0
0.713+6
0.737
0.841
0.933
Speech
0.028Ic
0.0292a00t
0.035
0.032.a00
0.028ao
0.029uuma
0.029
0.031
0.058
0.119:as1
Thynoid
0.815
0.606iems
0.886.am
0.813
0.633
0.681
0.765iam
0.863uem11
0.877
Vertebral
0,138as
0.143:8444
0.134a
0.269
0.152a0
0.273auus
0.192eb
0.403:aa68
0,28525043
0.5662am3
Vowels
0,105
0.109
0.098
0.178
0.297
0.2
0.177eb
0.274
0.451
0.892
0.857
0.823-am
0.839
0.793-00
0.722.6
0.881
0.974
0.934-amx
WDBC
0.983e:
0.98-am
0.975
0.994.amm
0.435
0.874
0.773eo
0.93.am16
140ms
Wilt
0.0644c
0.097.0a1
0.085ura04
0.278.ana
0.225
0.219.nm
0.077uo
0.375tea4s
0.454ue.ss
0.593
Wine
0.133w:
0.8462444
0.2446inu226
0.456zumss
0.142s:
0.334
0,358g0
0.28920008
1an0
1.0
WPBC
0.394
0,408
0,376stm12
0.399
0.397st
0.407
0.353eb
0.393
0,502z0057
0.567=mm4
Yeast
0,468as
0.505
0,465
0.546=am9
0.48an
0.515
0.494e>
0.543
0,542asu006
0.528
Average AUC.PR 0.597
0.638-6a11
0.572-um
0.634.au27
0.53-n
0.6022mu124
0.538-n0m
0.589
0.744
0.785.
24

---

Published as a conference paper at ICLR 2026
Table 5: The performance improvement achieved by LLM-DAS (F,) over trained source detectors (f+) on 36 datasets in terms of AUC-ROC (t).
PCA
+LLM-DAS
IForest
+LLM-DAS OCSVM +LLM-DAS
ECOD
+LLM--AS
DRL
+LLM-DAS
Abalone
0.704.0
0.705-e.01
0.73540006
0.746
0.7244o
0.728
0.487.a
0.475-omm
0.809
0.837
Amazon
0.549ko
0.549
0.559
0.559unces
0.542xo
0.542ao
0.538ko
0.539
0.57.a016
0,553araes
Anathyzoid
0.852so
0.906=3466
0.911s9022
0.925anau
0.555e)
0.667am013
0,785ep
0,745
0,924
0,949
Arrhythmia
0.768co
0.776:e015
0.773
0.795
0.769ca
0.774mmm1
0,72e
0.74.ams
0,774x0.13
0.832
Breustw
0.994.o
0.996uaa01
0.972
0.995.umc
0.994.o
0.996ue
0.9651a
0.985
0.997
0.997.a
Campaign
0.729an.05
0.763e>
0.68920
0.756xa
0.775
0.771a0m0
0.753
Cardio
0.966e9
0.958
0.922sh.017
0.919sn015
0.965ee
0.954
0.637eb
-,931
0,956
0.968
Cardiotocograhhy
0.789
0.804.ea07
0.725
0.768
0.752.o
0.761-uas4
0.789ka
0.778.a.0s
0.84.e
0.853
Comm and.erime
0.787a0
0.804a9214
0.807
0.713.0025
0.525
0.846aa000
0.894
Pault
0.559e0
0.592es.06
0.561
0.558encus
0.568e)
0.56
0.504e)
0,533
0.628
0.698ams
Glass
0,548s0
0.62.xas
0.577am011
0.624mmeer
0.548e0
0.644zam1
0.624ea
0.425
0.697
0.906
Hepatitis
0.812ao
0.835=a012
0.726x0.22
0.778
0,496e)
0.513aum
0.699e
0.707=a052
0.812a0n08
0.869
Imgseg
0.674-o
0.708
0.68640011
0.833
0.741
0.778
0.624.a
0.813
0.909
0.915
lomosphere
0.877a0
0.911.eats
0.968an.0
0.844
0.877a0
0.839amm
0.957a9
0.873
0.984amms
0,978a000
Lympho
1se
0.999
0.995
0.998sn00
0.981e>
0.992amm
0.991e9
0.997
100
0,991
Mammography
0.899.m
0.907-4.02
0.82240006
0.903.
0.9-
0.897-am
0.825+a
0,907
0.946x0m1
0,883
Mnist
0.902.o
0.902.u
0.862xxx
0.876uues
0,5mm
0.508
0.749.m01
0.769
0.971
0.974mmm
Musk
1s0
0.952a0:04
0.5a0
0.986=a.0
1ss
Optdigits
0.582eo
0,582e0
0.824x0006
0.837
0.634e
0.997e.
0.615-mmmm
0.635mumm
0.997
0. 0.99-m00t
Parkinson
0.693.o
0.729.aa15
0.76810016
0,74.cms
0.604.0
0.67.eax
0.515ka
0.472.um
0.673
6.832
Pendigits
0.94420
0.949:a.06
0.967a9000
0.975an.05
0.96420
0.951
0.945.0000
0.998aa.01
0.994
Pima
0.713c0
0.739:a.00
0.674e00006
0.74
0.713e>
0.627
0.583e>
0,552-a.14
0,765
0.782
Satellite
0.666-o
0.678-e.001
0.8034a0rr
0.754-nose
0.66644
0.799kamm
0.788.a
0.788-4.0
0.832x0000
0.873
Satimage-2
0.982.0
0.984as.01
0.994as002
0.989anc02
0.982.>
0.984.am
0.9651a
0.993
0.997am.04
0.998
Shuttle
0.994z0
0.998
0.996e
0.999
0.997s)
0.999
0.998e>
0.998eb
0.999
1.0
SpamBase
0.814.o
0.815+a.40
0.858xacc
0.857-ocr7
0.768.a
0.768.o
0.688.o
0.703
a.829
0.912
Speech
0.364.0
0.402xea14
0.381an014
0.4
0.367aa
0.385.am0
0.394
0.582amm
0.577
Thyroid
0.98629
0.98520000
0.927a00011
0.995
0.986e9
0.956.a.00
0,8832
0.972au00
0.991s0m0
0.987
Vertebral
0.175=a
0.192
0.
144440om
0.423
0.265
0.574mam2
0.412ea
0.65=nas
0.622snu57
0.763
Vawels
0.523.0
0.559
0.59.om1
0.727.n854
0.716.001
0.851amm0 0.766
Whe
0.967-o
0.966-0001
0.97240005
0.9534no1s
0.96740
0.952.mmm
0.875+a
0.968
0.996.0
0.988
WDBC
0.999.o
0.999.0001
0.998uao0a
0.964.o
0,994.umc
0.979Lo
0.993mmm
100m
1.0
0.261a9
0.474:a.m
0.46220223
0.765
0.792>>
0.762am022
0.801
0,936xu007
0.91920011
Wine
0.447:o
0.933-aa15
0.657e0095
0.748
0.485s>
0.669
0.743eo
0.648:am
100
1.0
WPBC
0.469Io
0.471.ea12
0.498maom
0.502.nm
0.47m
0.472.um
0.471.a
0.517
0.62.nao
0.67-aus
Yeast
0.432a0
0.4562sa6
0.41a000
0.526an824
0.44820
0.46420002
0.44629
0.526am001
0.512aams
0.49am002
Average AUC-ROC 0.735eo
0.767
0.755en014
0.794
0.714
0.758
0.706=ntor
0.745
0.85 la0012
0.878
25

---

Published as a conference paper at ICLR 2026
DRL AnoLLM( (35M)) Anol LM(360M) Ours(PCA) Ours(DRL)
0,7618
0.7298
0,9972
0.4934
0.9846
0,8706
0,5288
0.9566
0,8848
0,7912
0.8942
0.9804
0.9991
0.1189
0.877
0.5657
0,8918
0.9341
0.5281
0.7994
2.5
12
0.6602
0.5508
0.9956
0.1278
0.926
0.9889
0.5793
0.9969
0.0602
0.4847
0,7509
0,7921
0.9311
0.9906
0.0293
0.8146
0.1433
0.109
0.84
0.8459
0.5053
0.6249
8.5714
0
0.648
0.642
0
0,234
0.932
0.938
0.364
0.398
0.554
0.674
0.891
0.97
0.996
0.037
0.74
0.181
0.599
0.753
0.529
0.302
0.637
8.1 8.111
Table Comparison of AUC-PRR PP (1) results between other baseline methods and LLM-DAS,
0.631
0.636
0.991
0.247
0.933
0.856
0.592
0.75
0.623
0.677
0.91
0.988
0.997
0.036
0.696
0.289
0.839
0.873
0.522
0.301
0.6851
6.619 3
0,6288 0.3215 0.62 0.6761
0.627
0.9966
0.167
0.9895
0.8406
0.9356
0.4039 0.4844 0.8258 0.9671 0.966
0.7449
0.8479 0.8532 0.8576 0.8692
0.9703
0.9811 0.9403 0.9479 0.9151 0.9819
0.0285 0.038 0.0584 0.0584
0.8167 0.8417 0.8179 0.8626
0,1598 0,2514 191949 0.2279 0.2854
0.4506
0.9742
0.5416
0.7575
3. 3.1667
1
1
7
DTE MCM NPT-AD
0.4345
0,8825 0.9952 0.9813
0.2204
0.9812
0.9929
0.364
0.4203
0.7527
0.8124 0.6821 0.985 0.9862
0.581 0.0977 0.9498
0.3997 0.8887 0.8079
0.9985 0.9335 0.7746
0.4974 0.4631 0.4888
0.6961
6.7619
0.4912 0.6107
0,2573 0.2151 O. 0919
0,9683 0. 0.9802
0.6091 0,8677 0. 0.4204
0.1894 0. 0.3985 0.4755
0.639
0. 0.1696 0.1534 0.8885
0.6965 0.6798 0.7389
0.6348
7. 7.9048
0
0.6006
10
0.4114
0.6155
0.9656
0,9777
0.8799
0.0335
0.6575
0.1574
0,7218
0.5659
0.5097
0.5607
10.0952
JCL
DeepS Auto AncoErr
0.5291
0.3029
0.9896
0.1079
0.7328
0.2709
0,253
0.1418
0.8904
0.7174
0.8218
0.9688
0.9316
0.027
0.8096
0.1476
0.3475
0.8578
0.1605
0.4833
0.5472
11,2381
0.3235
0.6036
0.9924
0.0912
0,867
0.9749
0.419
0.1159
0.0616
0.7168
0.8217
0.9427
0.9818
0.04
0.7282
0.159
0.1717
0.834
0.1476
0.4953
0.547
10.2381
IForest ECOD
0.4002
0.4461
0.9522
0.1113
0.9113
0.8972
0.538
0.982
0.0669
0.4145
0.5877
0.8334
0,7775
0.9815
0,0287
0.6807
0.1917
0.1772
0.7217
0.3578
0.4943
0.5529
11.7619
0.6149
0.5097
0.9499
0.0952
0.9668
0,9993
0,3334
0,5279
0.157
0,5133
0.6662
0,8583
0.8846
0.9172
0.0353
0.6055
0.1342
0.0984
0.8533
0.2458
0.4654
0,5429
12.1 1429
PCA
0.3525 0.4513 0.5657
0.5277 0.5336
0.9712 0.9923 0.9934
0.0923 0.0896
0.8969
04165
0,8889 0.4363 0.0602
0.9692 0,7855 0.3863
0.7098 0.697 0,7008
0,8515 0.8088 0.7778
0.9555 0. 0.9692 0.9192
0.9601 0.9627
0.0197 0.0315 0.0277
0.5903 0.7892 0.8134
0.1239 0.2063 0.1381
0.3146 0.3277 0.1051
0.8022 0.8412 0.8391
0.9917 0.13 0.1325
0.4866 0.4678
0.6129 0.5632
11.6429
LOF
0.9591
0.9401 0.9762
0.4063
9. 9,3810
KNN
0.6008
0.1099
0.9297
0.381
0.9917
0.937
0.4737
0.6607
10.7143
OCSVM
1818
0.5339
0.9934
0.0896
0.8969
0.8107
0.4178
0.0614
0.0692
0.5178
0.7008
0.7778
0.9192
0.9488
0.0279
0.8134
0.1517
0.2969
0.8391
0.1424
0.4803
0,5082
12.1 14.4
Average AUC-PR
Average ranking
Mammography
Annthyroid
Arhythmia
lonosphere
Satimage-2
Breastw
Lympho
Opidiiis
Pendigits
Satelltte
Shutle
Speech
Thyroid
Ventbral
Vowels
Glass
Mosk
Pima
Whe
Wine
Yeast
Win
26

---

Published as a conference paper at ICLR 2026
Durs(PCA Ours( (RL))
0.9492
0.8316
0.9972
0.9061
0.9779
0.9911
0.8834
0.9902
0.9941
0.7818
0.8726
0.9984
0.9999
0.5774
0.9873
0,7629
0,9869
0.9883
0.4905
0,9032
3,4048
7
0.9065
0.7757
0.6196
0.9109
0.9986
0.9074
0.9998
0.5817
0.9487
0.7393
0.6783
0.9837
0.9977
0.4020
0.9849
0.1917
0.5591
0.9656
0.9333
0.4557
0.7674
0,7766
8. 8.6667
DRL AnoL MMLLLM(135M)) ((35MM) AnoL M336M)
0.931
0.822
0.993
0.797
0.924
0.993
U.876
0.939
0.964
0.654
0.877
0.999
0.47
0.983
0.408
0.938
0.952
0.851
0.73
0.8620
7.1905
Comparison of AUC- AUC-ROC RE- (1) results between other baseline methods and LLM-DAS.
0.927
0.825
0.992
0.819
0.909
0.968
0.915
0.983
0.971
0.663
0.902
0.47
0.975
0.565
0.982
0.964
0.909
0,744
0,8801
6.2381
0.909 0.6894 0.8682 0.9239
0.5912 0.8114 0.7185 0.7742
0.9968
0.6969
0.984
0.9455
0.9972
0.9979
0.6927 0.6788 0.7639 0.7553 0.7651
0.806 0.832
0.9968
0. 0.9992
0.3817 0.4409 0.5925 0,5821
0.9911
0.6216
0.8142 0.6529 0.9935 0.8511
0.9963
0.512
0.8792
3.7143
1
DTE MCM NPT-AD
0,9725 0.9278 0.995S 0.9848
0.835 0.6964 0.7225 0.7875
0.971 0.9542 0.9726 0.9735
0.9993
0,8873
0.9317
0.9987
0.9792 0.9967 0.9992 0.9995
0.9935 0.9993 0.9975 0.9931
0,9787
0.2821 0.543 0.3767 0.5347
0.8054 0.9814 0.9619
0.9622
0,4691
0,8665
6.8571
1
0.9899 0.9257.
0.8862 0.9053
1 0,9752
0.8238 0.9947
0.9761 0.9919
0.7661 0.7962
0.9863 0.9804
0.9944 0.9538
0.5076 0,4458 0,4299
0.8174 0.8263
9,3810 7.8571
ICL
0.6997
0,8145
0,9546
0.6548
0.787
0.9142
0.8549
0.4883
0.9518
0.702
0. 0.908
0.915
0.8028
10.4762
DeepS VDD AutoEncoder
0.7295
0,5682
0.9909
0.6088
0.6231
0.7856
0,8472
0.6694
0.9937
0.7163
0.7233
0.9979
0.9944
0.3633
0.978
0.2375
0.7905
0.9737
0.5356
0.4503
0,7418
11.2857
0.5678
0.7941
0.5566
0.8552
0.9977
0.8879
0.7603
0.4563
0.7348
0.7659
0.9881
0.9952
0. 0,5071
0.9887
0. 0.2706
0.5734
0.9633
0.5067
0.479
0.7448
10.
IForest ECOD
0.7216 0.8519 0.9112 0.7845
0.7199
0.9649
0.6235
0.9669
0.9906
0.8251
0.9987
0,8299 0.6145
0.9906 0.9905 0,9437 0.9666 0.9295
0.5834
0.8139 0.7391 0.6663 0,8026 0.7884
0.965
0.9978
0.3596
0.8827
0.4124
0,6147
0,8747
0.7433
0.4464
0.7655
12.7143
0.7688 0.7684 0.7734
0.9719
0.5771
09683
0,9945
0.822
0.5221
0.6923 0.6913 0,7133 0.6737
0.9817 0.9891 0.961 0,9817 0.9938
0.9893 0,9883 0,9936 0.9961
0.3561 0.3759 0,3638 0,3812
0.9525 0.9856 0.9855 0.971
0.1171 0.4317 0,1746 0.1444
0.5902
0.9715
0.6571
0.4095
0,7766
11.2857
Table 7:
PCA
0.9937 0.9938
0.562 0.548
0.9444 0,8765
0.8993
0.9862 0.9665 0.5817
0,8564 0,5229
0.967 0,9667
0.4083 0.4467
0.4571 0.4324
0,7481
5955
1
LOF
0.87 0.9977
0.8922
7974
18.3810 8333
KNN
0.6903
0.7933
0.9714
0.6141
0.1667
0.864
0.9917
0.8174
0.9536
0.9917
0.4366
0.8045
0
OCSVM
0.5551
0.7689
0.9938
0.548
0,8765
0,9812
0.9003
0.6338
0.9636
0.7133
0.6663
0.9969
0,3673
0.9855
0,2654
0,7557
0.9667
0.485
0.4483
0,7311
0.5
Mammography
Annthyroid
Arrhythmi
lonosphere
Satimage-2
Breastw
Lympho
Opedigits
Pendigits
Satellite
Shattle
Speech
Thyroid
Vertebral
Vowels
Average
Glass
Musk
Pima
Whe
Wine
Yeast
Rank
Win
27

---

Published as a conference paper at ICLR 2026
6.9 VARYING LLM BACKBONES
To investigate the impact of using different LLMs in our framework, given their distinct prior knowl- edge and reasoning abilities from being trained on various text corpora, we measured performance using not only Gemini-2.5-PP but also the GPT-4o and Qwen3 as a backbone for comparison. Though the performance of LLM-DAS on Qwen3 slightly drops compared to Gemini-2.5-pp and GPT-4o, it still surpasses the base detector by a large margin. The results clearly show that LLM-DAS maintains its strong performance across all three LLMs.
Table 8: Effects of various LLM backbones. The AUC-PR results are averaged across all datasets. Here, we use OCSVM as the base detector.
OCSVM
+LLM-DAS (Quen3)
+LL.--AS (GPT-46)
+L..--DS (Gemini-2.544
Abalone
0,8459
0,8460
0,8465
0.8487
Amazon
0.1050
0.1048
0.1058
0.1061
Anniyrooid
0.1831
0.4490
0.4532
0,2483
Arrhythmi
0.5339
0.5898
Breastw
0.9934
0.9966
0.9969
0,9954
Campaign
0.4749
0.4417
0.4409
0.4349
Cardio
0.8614
86255
0,8551
0,8083
Cardiotocorrahy
0.6619
0.6244
0.6773
0,7029
Comm and.adddiiii
0,8371
0.8434
Fault
0.6062
0.5597
0,56.37
0,5417
Glass
0.0896
0.2215
0,2204
0,2006
Hopatitis
0.2815
0.4196
0.4488
0,3002
Impseg
0.7883
0.7970
0. 8056
0.8592
lonosphere
0,8969
0,8212
0.821
0,8384
Lympho
0.8107
0.6816
0.7346
0.9357
Mamunography
0.4178
0,5359
Mnist
0.16
366
0.4573
0,1806
Musk
0.0614
0.9605
0.9561
0.8676
Opedigits
0.0692
0.8242
0.8456
0,9281
Parkinson
0.8892
0.9381
0. 0.9420
0,9200
Pendigits
0.5178
0,5584
0,5563
0,4912
Pina
0.7008
0.6L9I
0.6377
0.6514
Sateliie
0.7778
0.8319
Satimage-2
0.9192
0. 7065
0,82077
0.8996
Shuttle
0.9488
0,9955
0.9958
0,9906
SpamBase
0.8136
0.8351
U.83U5
0,8138
Speech
0.0279
0.0275
0.0278
0.0294
Thyroid
0.8134
0.3506
0.3505
0.6326
Vertehrul
0.1517
0.2292
0,2336
0,2733
Vowels
0.2969
1860
8843
0,2098
Whe
0.8391
0.6796
0.681 I
0,7928
WDBC
0.4348
0.8900
0.8733
0,8740
Wilt
0.2254
0.1914
0.2619
0,2193
Wine
0.1424
0.4390
0.4679
0,3335
WPBC
0.3974
0.4065
Yeast
0.4803
0.4880
0.4872
0,5148
Average
0.5295
0.5899
0.6025
0.6019
6.10 COMPUTATIONAL EFFICIENCY.
As shown in Table 9 LLM-DAS remains computationally efficient in both training and inference stages. This efficiency comes from two key properties: (i) LLM-DAS does not require repeatedly querying or fine-tuning LLMs; instead, the detector-specific synthesis code generated once per anomaly type and reused across datasets, and (ii) inference only involves additional lightweight binary classifier on top of the source detector, introducing negligible overhead.
6.11 VISUALIZATION AND KDE ANALYSIS OF SYNTHETIC ANOMALIES
To further examine the quality of anomalies synthesized by LLM-DAS, we utilize T-SNE and Kernel Density Estimation (KDE) plots of anomaly scores on the Thyroid and Vertebral datasets.
28

---

Published as a conference paper at ICLR 2026
Table 9: Runtime in seconds baseline ft and LLM-DAS F, for the training and inference, averaged over all datasets. The training time of fo is not included in the LLM-DAS training time. LLM-DAS training time includes anomalies synthesis and binary classifier ft training, while excluding the two-time LLM querying cost for code generation, as the resulting synthesis code is reusable across any dataset.
Stage
PCA
FForest
OCSVM
ECOD
DRI.
Baseline Train
0.2891
0.8091
4.4825
0.1313
23.6555
ILM-DAS Train
Baseline Text
0.2402
0.2391
18455
0.2727
0.0777
L.M.-AS Test
0.3389
0.3089
2.5990
0.3207
0.2390
(a) SNE Visualization
(b) Original Normal
(c)
Enhanced Anoma Scores
True Anomely Synthetic
3.5-
Synthwtic Anomaly
Thue Anomaly
Synthetic Anomalyy
True Anomaly
Dercitt
2.0
10-
02
1.0
3.0
(d) T.SME Visualization on vertebral
(e) Origina Anomaly Scores of
(f) Enhaaccd Anomaly Scores of Fi
Normal
Normal
True Normal
Anomaly
Thue Anomaly
Anomaly
Synthetic Anomaly
Syntheic Anomaly
Synthetic Anomaly
Denoity
-0.25
5.00
0.25
0.50
1.00 1.25 150
Anoma y Score
Figure 6: Visualization of synthetic hard anomalies and score distributions on Thyroid and Vertebral test LLM-DAS-generated anomaly samples. (b, e) Kernel
dataset. (a. d) T-SNE plots of normal, real anomaly. and LLM-DAS generated
density estimation (KDE) of anomaly from the source detector ft. (c. f) KDE of anomaly scores from the enhaneed detector Ft.
29

---

Published as a conference paper at ICLR 2026
6.12 SENSITIVITY ANALYSIS
We incorporate the sensitivity analysis for the number of synthetic samples (set to the ratio of training set size), performance robustness across different queries and the type of binary classifiers. We also verify the effectiveness of summing ft and ft.
0.850
0.850
AUC-PR
0.825
AUC-PR
LCA+L
LLMDDSS
0.800
PCA
0.800
IForest
0.775
0.750
0.1
0.2
0.3
0.4
0.1
0.2
0.3
0.4
ratio
ratio
AUC-PR-based performance comparison of different anomalous samples injection ratios the Imgseg dataset, with results for PCA (left) and IForest (right).
Figure 7:
Table 10: AUC-PR performance of PCA and PCA+LLM-DAS under different anomaly synthesis ratios.
HAS various anomaly synihesis ratios
PCA
0.1
0.2
0.3
0.4
0.5
11.6
0.7
0.8
0.9
Abalone
0.839
0.841
0.841
0.841
0.841
0.842
0.841
0.842
0.841
0.841
0.841
Amazon
0.107
0.108
0.108
0.108
0.107
0.108
0.108
0.107
0.108
0.108
0.108
Annthyroid
0.660
0.691
0.688
Arrhythmia
0.514
0.551
0.545
0.551
0.553
0.555
0,551
0.549
0.553
0.554
0.557
Breastw
0.993
0.996
0.996
0.995
0.995
0,995
0,995
0.995
0.996
0.995
0.996
Campaign
0.488
0.488
0.488
0.488
0,488
0.488
0.488
0,488
0.488
0.488
0.489
Cardio
0.863
0.824
0.828
0.850
0.826
0.812
0.826
0.826
0.828
0.830
0.846
Cardistocograhhy
0.697
0.734
0.738
0.726
0.738
0.750
Commnand and.crime
0.889
0.881
0.875
0.872
0.876
0.873
0.872
0.876
0.878
0.875
0.877
Glass
0.090
0.128
0.111
0.114
0.111
1.105
106
0.106
103
0.3
0.101
Hopatitis
0.583
0.626
0.611
0.555
0.584
0.559
0.563
0.615
0.571
0.564
0.564
Imgseg
0.772
0.824
0.823
0.828
0.829
0.825
0,840
0,832
0.838
0.831
0.831
Ionosphere
0.897
0.926
0.919
0.944
0.939
0.902
0,912
0.926
0.922
0.910
0.914
Lympho
Maminography
0.417
0.579
0.580
0.579
0.574
0.578
0.573
0.577
0.571
0.578
0,577
Mnist
Musk
1,000
0.997
1,000
1.000
1.000
1.000
1.000
1.000
1.000
1.000
1.000
Opedigits
0.060
0.060
0.060
0.060
0.060
0.060
0.060
0.060
0.060
0.060
0.060
Parkinson
0.930
0.944
0.946
0,944
0.943
0.944
0,943
0,941
0.942
0.941
0,941
Pendigits
0.386
0.485
0.467
0.485
0.478
0.550
0,544
0,548
0.585
0.558
0,546
Pina
Saellite
0.778
0.792
0.793
0,790
0.789
0.790
0,790
0.789
0.788
0.788
0.787
Satimage-2
0.919
0.929
0.931
0.931
0.933
Shurtle
0.963
0.991
0.991
0.991
0.991
0.991
0.990
0.991
0.991
0.991
0.991
SpamBase
0.818
0.823
0.825
0,824
0.824
0.823
0.823
0.825
0.826
0.826
0.825
Speech
0.028
0.029
0.031
0,033
0.031
0.032
0.035
0.029
0.029
0.030
0,030
Thymod
0.813
0.8155
0.832
0,852
0.863
0.869
0.879
0.875
0.882
0.881
0,877
Vertebral
Vowels
0.105
0.109
0.123
0.132
0.131
0.133
0.137
0.156
0.128
0.137
0,151
Who
0.839
0.840
0.834
0.840
0.827
0.818
0.825
0.826
WDBC
0.983
0.980
0.992
0.989
0.974
0.964
0.977
0,974
0.972
0.972
0.970
Wilt
0.064
0.097
0.108
0.106
0.120
0.141
0.132
0.144
0.123
0.135
0.137
Wine
0.133
0.846
0.801
0,801
0.782
0.741
0.757
0,730
0.714
0.726
0,732
WPBC
0.394
0.408
0.406
0.415
0.398
0.413
0,415
0.416
0.409
0.400
0.404
0.508
Average
0.597
0.638
0.637
0.638
0.637
0.636
0.638
0.641
0.637
0.637
0.638
30

---

Published as a conference paper at ICLR 2026
Table 11: AUC-PR performance of IForest and LLMD under different anomaly synthesis ratios.
LLM-DAS with various anomaly synthesis ratios
IForest
01.7
0.8
0.9
Abalone
0.848
0.855
0.856
0.857
0.859
0.858
0.858
0.858
0.858
0.859
0.858
0.109
Annihyroid
0.615
0.620
0.628
0.628
0.630
0.647
0.634
0.643
0.636
0.633
0.647
Arthythmi
Breastw
0.945
0.995
0.994
0.995
0.586
0.995
0.581
0.996
0.571
0.996
0.566
0.556
0.996
0.996
0.586
0.997
0.562
19977
0.996
0.571
Campaign
0.461
0.452
0.452
0.452
0,452
0,452
0,452
0.452
0,452
0:452
0,452
Cardio
0.702
0.622
0.674
0.634
0.640
0.647
0.675
0.671
0.670
0.676
0,676
Cardiotocograply
0.604
0.638
0.666
0.669
0.667
0.684
0.669
0.682
0.684
0,681
0.681
Comm crd.e
0.894
0.893
0.893
0,894
0,891
Fault
0.595
0.577
0.574
0.568
0,562
0,564
0.563
0.557
0.555
0.557
0.555
0.121
0.119
0.106
0.119
0.098
0.094
0.096
Hoparitis
0.418
0,566
0,587
0.556
0.596
0.673
0.652
0.655
0.619
0.598
0.642
Imgseg
0.756
0.859
0.852
0.846
0.836
0.824
0.829
0.836
0.829
0,829
0,829
Jonosphere
0.977
0.869
0.818
0.763
0.746
0.699
0.675
0.670
0.654
0.641
0.631
Lympho
0.959
0,979
0,973
0.965
0.941
0.924
0.956
0.955
0.932
0.925
0.963
Mammugraphy
0.572
0.567
0.565
0.567
Mnist
0.515
0
0.610
0.610
0.610
0.610
0.610
0.610
0,610
0.610
0.610
Musk
0.528
1.000
1.000
0.999
0.999
0.989
0
0.990
0.962
0.959
0.933
Opidigits
0.157
0,179
0,161
0.161
0.161
0.161
0.161
0.161
0.161
0.161
0.161
Parkinson
0.960
0.951
0.955
0.954
0.958
0,962
0.963
0.963
0.963
0.962
0.964
Pendigits
0.513
0.602
0.604
0.608
0.596
0.626
0,630
0.639
0.652
0.642
0.643
Pima
0.666
0.740
0.738
0.735
0.740
0.736
0.739
0.743
0,741
0.742
0.744
0.804
0.801
0.799
0.795
0.792
0.794
0.794
Satimage-2
0.885
0.871
0.844
0.830
0.823
0.771
0.737
0.783
0.760
0,800
0.787
Shuttle
0.917
0.995
0.995
0.995
0.995
0.994
0,994
0.994
0.994
0.994
0.995
SpumBase
0.890
0,889
0.890
0.890
0.890
0.889
0.890
0.889
0.889
0.889
0,888
Speech
0.035
0.032
0.037
0.037
0.034
0.033
0.036
0.035
0.032
0.039
0,037
Thyroid
0.606
0.886
0.895
0.891
0.945
0.912
0.914
0.914
0.936
0.933
0.935
Vortebral
0.134
0.269
0.304
0.315
0,320
0.335
0.385
0.384
0.373
0.389
0.382
Vowels
0.190
Whe
0.857
0,823
0.844
0.842
0.846
0,840
0.841
0.830
0.832
0.827
0.831
WDBC
0.975
0.994
0.987
0.989
0.976
0.986
0.984
0.972
0.973
0,944
0.962
Will
0,085
0,278
0,263
0.238
0.207
0.187
0.181
0.179
0.165
0.157
0.154
Wine
0.246
0.456
0.307
0.361
0.352
0.414
0.449
0.472
0.483
0,518
0.514
WPRC
0.376
0.399
0.396
0.395
0.390
0.405
0.406
0.400
0,405
0,408
0.412
Yeast
0.465
0,546
0.574
0.600
0.597
0.603
0.603
0.603
0.610
0.604
0.607
Average
0.572
0.634
0.631
0.629
0.628
0.629
0.631
0.632
0.628
0.628
0,631
0.820
0.850
0.950
AUC-PR
AUC-
0.800
LLM+-
0.800
AUC-
0.940
DRL
0.780
PCA
IForest
0.930
DRL
0.750
query times
query times
query times
Figure 8: AUC-PR-based performance comparison of different query times on the Imgseg dataset, with results for PCA (left), |Forest (middle) and DRL(right).
31

---

Published as a conference paper at ICLR 2026
(a) Hepatitis PCA
(b) Hepatitis IForest
(c) Hepatitis OCSVM
0.650
0.6249
0.600
0.5662
0.5571
0.350
0.3217
AUC-P2 CR
0.625
0.550
0.325
0.3002
0.600
0.5828
0.500
0.300
0.2815
0.575
0.450
0.4182
0.275
0.550
0.400
0.250
Random Forest
Base Random Forest
Random Forest
(d) Imgseg PCA
(e) Imgseg IForest
(f) Imgseg OCSVM
0.850
0.8243
0.8589
0.8584
0.8592
0.8577
AUC-PR
0.825
0.8143
0,850
0.850
0.715
0.7724
0.7556
0.800
0.7883
0.750
0.750
Base Random Forest SVM Binary Classifier Type
Base Random Forest SVM Binary Classifier Type
Base Random Forest: SVM Binary Classifier Type
Figure 9: AUC-PR-based performance comparison different binary classifier choices for LLM-DAS the Hepatitis and Imgseg datasets, where PCA (left), IForest (middle), and OCSVM (right) serve as base detectors. "Base" corresponds base detector performance. "Random Forest" and "SVM" correspond to LLM-DAS's performance with different binary classifier types.
(a) Hepatitis PCA
(b) Hepatitis IForest
(c) Hepatitis OCSVM
0.6262
0.600
0.5662
AUC-P PR
0.625
0.6093
0.550
0.5425
0.325
0.3002
0.2959
0.600
0.5828
0.500
0.300
0.2815
0.575
0.450
0.4182
0.275
0.550
0.400
0.250
OriginalOrigina Siniginn++Biaayy +inary Binary
OriginalOrigina- Binary Binary
Original Origine +innrry Binary
(d) Imgseg PCA
(e) Imgseg IForest
(f) Imgseg OCSVM
0.8243
0.8589
0.8592
AUC PR
0.825
0.8040
0.850
0.8400
0.8454
0.800
0.800
0.7556
0.800
0.7883
0.750
0.750
OriginallOggina Binary Binary
OriginalOrigina Binary Binary
Origina Binary Binary
AUC-PR-based performance comparison of ensemble strategics on the Hepatitis and Imgseg datasets, where PCA (left), IForest (middle), and OCSVM (right) serve the base detectors. "Original" denotes the base detector performance. Trrgina+BBiarr ddnotess the performance of LLM-DAS (our proposed method, combining binary classifiers with original detectors). while "Binary" denotes the scheme using binary classifiers directly without integrating original detectors.
Figure 10:
32

---

Published as a conference paper at ICLR 2026
6.13 ADDITIONAL RESULTS
6.13.1 COMPARISON WITH ALTERNATIVE ANOMALY SYNTHESIS METHODS
To further verify the effectiveness of LLM-DAS, we compared several representative anomaly synthesis strategies, including Gaussian noise injection, random outliers, and SMOTE-based sample generation, which are denoted as Gauss, Random, and Smote respectively. The results are in Table 12 Table [4
Three Common Anomalies synthesis strategies:
Gaussian noise injection is a method for generating anomalous samples by introducing noise normal training samples. The The process works as follows: first, randomly select specified number of base samples from the normal training data. Then, generate noise that follows a Gaussian distribution with a predefined mean and standard deviation. This noise is then added to the selected base samples, resulting in new samples that deviate from the original normal data.
Random outliers refer anomalous samples generated by randomly sampling points within an extended feature space derived from the range of normal training samples. This method first expands the boundaries of each feature dimension beyond the minimum and maxi- mum values of normal data, then randomly distributes the generated anomalies within this extended range, thereby ensuring the anomalies deviate from the distribution of normal samples.
SMOTE- -bsse-- sample generation draws on the SMOTE algorithm, which is originally used address data imbalance issues. It can generate boundary anomalous samples near normal training samples. The method first randomly selects base samples from the normal training data and finds nearest neighbors for each base sample. Then, it calculates the difference between each base sample and randomly chosen neighbor, and extrapolates along the line connecting them to generate new samples. create boundary anomalous samples that are closer to or slightly beyond the boundary of the normal data distribution, the interpolation factor is set within the range of 0.5 to 1.5. This ensures that the generated samples either lie near the boundary of the normal data distribution just outside it, thus effectively serving as boundary anomalous samples.
33

---

Published as a conference paper at ICLR 2026
Table 12: AUC-PR (1) performance comparison of PCA under different alternative anomaly synthesis methods across 36 datasets.
PCA
Gauss
Random
Smote
LLM-DAS
Abalone
0.8393
0.8307
0.8418
0.7683
0.8411
Amazon
0.1072
0.1079
0.1077
0.1116
0.1077
Annthyroid
0.5657
0.6143
0.5667
0,2574
0.6602
Arrhythmia
0.5336
0.4718
0.5406
0.5216
0.5508
Breastw
0,9934
0,9881
0.9939
0.9872
0.9956
Campaign
0.4884
0,4860
0.4845
0.3820
0.4884
Cardio
0.8628
0.7322
0.9025
0.7755
0.8243
Cardiotocography
0.6969
0.6646
0.7145
0.5911
0.7337
Comm.and.cring
0.8892
0.8628
0.8829
0.7624
0.8806
Fault
0.6035
0.5131
0.5451
0.5475
0.6034
Glass
0.0896
0.0975
0.1055
0.0937
0.1278
Hepatitis
0.5828
0.4790
0.4874
0,5052
0.6262
Imgseg
0.7724
0.7722
0.7793
0.8002
0.8243
lonosphere
0.8969
0.9480
0.9372
0.9295
0.9260
Lympho
1.0000
0.8056
0.9754
0.9440
0.9889
Mammography
0,4165
0,4184
0.4990
0,4003
0.5793
Mnist
0.6499
0.6584
0.6445
0.5175
0.6499
Musk
1.0000
0.9981
0.9990
1.0000
0.9969
Optdigits
0.0602
0.0601
0.0604
0.0724
0.0602
Parkinson
0.9297
0,9372
0.9442
0.9300
0.9436
Pendigits
0.3863
0.6063
0.4464
0.3828
0.4847
Pima
0.7008
0.6723
0.7054
0.6732
0.7509
Satellite
0.7778
0.8137
0.7897
0.8035
0.7921
Satimage-2
0.9192
0.9163
0.9517
0.8954
0.9311
Shuttle
0.9627
0.9845
0.9891
0.9726
0.9906
SpamBase
0.8184
0.8230
0.8384
0.7829
0.8228
Speech
0.0277
0.0295
0.0250
0.0275
0.0293
Thyroid
0.8134
0.8486
0.8230
0.6885
0.8146
Vertebral
0.1381
0.1933
0.1424
0.1771
0.1433
Vowels
0.10
0.1570
0.1680
0.1958
0.1090
Wbc
0,8391
0,7876
0.8159
0.7477
0.8400
WDBC
0.9833
0.8165
0.9912
0.6980
0.9802
Wilt
0.0641
0.1281
0.0642
0.1334
0.0972
Wine
0. 0.1325
0.1859
0.1772
0.1401
0.8459
WPBC
0.3940
0.3522
0.3871
0,4112
0,4085
Yeast
0.4678
0.5049
0.4825
0.5126
0,5053
Average
0.5975
0.5907
0.6058
0.5594
0.6376
34

---

Published as a conference paper at ICLR 2026
Table 13: AUC-PR (1) performance comparison of IForest under different alternative anomaly synthesis methods across 36 datasets.
Forest
Gauss
Random
Smote
LLM-DAS
Abalone
0.8481
0.8177
0.8523
0.8056
0,8555
Amazon
0.1091
0.1094
0.1093
0.1097
0.1093
Annthyroid
0.6149
0.6642
0.6365
0.1515
0.6200
Arrhythmia
0.5097
0.5044
0.5848
0.5562
0.6021
Breastw
0.9449
0.9817
0.9949
0.9839
0,9947
Campaign
0.4608
0.4396
0.4421
0.3518
0,4517
Cardio
0.7018
0.6447
0.8473
0.6018
0.6220
Cardiotocography
0.6036
0.6355
0.6835
0.5607
0,6382
Comm.and
0.8940
0.8577
0.8503
0.7641
0.8958
Fault
0.5948
0.4997
0.5393
0.5677
0.5774
Glass
0.0952
0.1162
0.1495
0.1218
0,1205
Hepatitis
0.4182
0.5088
0.4368
0.4816
0,5662
Imgseg
0.7556
0.7894
0.7987
0.8346
0.8589
Ionosphere
0.9768
0.9374
0.9237
0.9006
0.8685
Lympho
0.9593
0.6675
0.9642
0.9503
0.9794
Mammography
0,3334
0.3690
0.4970
0.3024
0,5712
Mnist
0.5349
0.6283
0.5880
0.4381
0.6011
Musk
0.5279
0.9168
1.0000
1.0000
1.0000
Optdigits
0.1570
0.1458
0.1417
0.1555
0.1790
Parkinson
0,9595
0.9639
0.9583
0.9175
0,9514
Pendigits
0.5133
0.6070
0.5365
0.4698
0.6020
Pima
0,6662
0.6985
0.7074
0.6792
0.7397
Satellite
0.8583
0.8206
0.8281
0.8118
0,8079
Satimage-2
0.8846
0.9063
0.9495
0.9119
0.8706
Shuttle
0.9172
0.9870
0.9937
0.9813
0,9954
SpamBase
0.8902
0.8707
0.8809
0.8227
0.8892
Speech
0.0353
0.0331
0.0279
0.0301
0.0318
Thyroid
0.6055
0.7906
0.8381
0.5110
0.8856
Vertebral
0. 1342
0.1557
0.1354
0.2320
0.2686
Vowels
0.0984
0.1729
0.1436
0.1676
0.1779
Wbc
0,8573
0.8015
0.8271
0.7239
0.8233
WDBC
0.9749
0.7128
0.9625
0.6298
0,9936
Wilt
0.0848
0.1246
0.0871
0.1531
0,2784
Wine
0.2458
0.3130
0.1687
0.2132
0.4559
WPBC
0.3760
0.3829
0.3998
0.4076
0.3993
Yeast
0.4654
0.4964
0.4717
0.4933
0,5462
Average
0.5724
0.5853
0.6099
0.5498
0.6341
35

---

Published as a conference paper at ICLR 2026
Table 14: AUC-PR (1) performance comparison of DRL under different alternative anomaly synthesis methods across 36 datasets.
DRL
Gauss
Random
Smote
LLM-DAS
Abalone
0.8850
0.8394
0.8747
0.8202
0,9021
Amazon
0. 0.1206
0.0972
0.1150
0.1021
0.1197
Annthyroid
0.6761
0.1731
0.6310
0.1727
0.7618
Arrhythmia
0.6270
0.6273
0.6518
0.6992
0.7298
Breastw
0,9966
0,9857
0,9942
0.9639
0.9972
Campaign
0.5013
0,4854
0.4898
0.4625
0.4945
Cardio
0.8325
0.8480
0.9142
0.8427
0.8861
Cardiotocography
0.7540
0.7323
0.7148
0.7252
0.8046
Comm.and crime
0.9164
0,9421
0.9455
0.9386
0.9470
Fault
0.6649
0.5765
0.6417
0.5880
0.7053
Glass
0.1670
0.3107
0.2948
0.2273
0.4934
Hepatitis
0.6627
0.6880
0.6856
0.6870
0.6957
Imgseg
0.9238
0,9239
0.9300
0.9363
0.9436
lonosphere
0,9895
0,9530
0.9636
0.9539
0.9846
Lympho
1.0000
0.6193
0.7607
0.7348
0.8706
Mammography
0.8406
0.3719
0.4496
0.2873
0.5288
Mnist
0.8870
0.9067
0.9049
0.8693
0.9109
Musk
1.0000
0.8481
1.0000
0.9998
1.0000
Optdigits
0.9356
0.2927
0.2713
0.3133
0.9566
Parkinson
0.9210
0,9649
0.9629
0.9636
0.9659
Pendigits
0.9360
0.0688
0.2553
0.2345
0.8848
Pima
0.7449
0.6972
0.7100
0.7083
0.7912
Satellite
0.8692
0.8408
0.8857
0.7997
0,8942
Satimage-2
0.9703
0,9160
0.9666
0.9248
0.9804
Shuttle
0.9819
0.0884
0.9924
0.0875
0.9991
SpamBase
0.8413
0.6783
0.8975
0.8278
0.9335
Speech
0.0584
0.0516
0.0511
0.0476
0.1189
Thyroid
0.8626
0.2007
0.7836
0.1660
0.8770
Vertebral
0,2854
0.2369
0.2592
0.2277
0.5657
Vowels
0.4506
0.8461
0.8216
0.8381
0.8918
Wbc
0,9742
0,8381
0.7973
0.7393
0.9341
WDBC
1.0000
0.9164
0.9363
0.8364
1.0000
Wilt
0.4543
0.6363
0.4872
0.3760
0.5926
Wine
1.0000
0.9564
0,9292
0.9423
1.0000
WPBC
0.5017
0.4507
0.4409
0.4720
0.5671
Yeast
0.5416
0.5263
0.5143
0.6136
0.5281
Average
0.7437
0.6149
0.6923
0.6147
0.7849
36

---

Published as a conference paper at ICLR 2026
6.13.2 ABLATION STUDIES ON LLM- DAS DESIGN
To further validate the effectiveness the key components in LLM-DAS, we conduct an ablation study by systematically removing distinct components of our framework. The results are in Table T6 Table Specifically, we compare the full LLM-DAS model with its variants that:
Remove delectoor-wareenss and use generic prompls (Generic): modify the prompt by removing descriptions of the specific detector's principles, and instruct the LLM to generate a "general-purpose" synthesis code. By comparing its performance with that of L.MM-DAS, can demonstrate that "awareness" the detector's ' underlying principles and designing targeted anomaly sample generation strategies are crucial.
Replace "hard" anomalies with "simple" " ones (Simple): modify the prompt such that the LLM generates only "simple" anomalies that are far from the normal cluster. We remove the availability of cereelppreitt_toooe for evaluating the anomaly degree of generated samples, thereby eliminating the capability to generate more difficult anomalies based on model.predict score() values. By comparing the performance of this setup against that of LLM-DAS, we can verify that the "hard" requirement (for generating hard-to-detect anomalies) is critical.
Replace borderline synthexis with random selection (Random): generates anomalies by first transforming "randomly selected" normal samples into anomalies through prompt modification, unlike LLM-DAS, which emphasizes selecting or transforming "borderline normal samples" from the training set into anomalies. By comparing the performance of this "randomly selected normal sample-based transformation" method against that of LLM-DAS, can verify that the "borderline" heuristic is critical.
Table 15: Ablation Studies on the Different Components of LLM-DAS Design
Variants
Awareness
Hard
Borderline
Generic Simple
Random
/
LLM-DAS
37

---

Published as a conference paper at ICLR 2026
Table 16: AUC-PR (1) performance comparison of PCA under different LLM prompt designs across
36 datasets.
PCA
Generie
Simple
Random
LLM-DAS
Abalone
0.8393
0.8290
0.8252
0.8415
0,8411
Amazon
0.1072
0.1079
0.1055
0.1078
0.1077
Annthyroid
0,5657
0.5614
0.5329
0.5418
0.6602
Arrhythmia
0.5336
0.5497
0.4569
0.5442
0.5508
Breastw
0.9934
0.9944
0.9916
0,9937
0,9956
Campaign
0.4884
0.4784
0.4894
0.4881
0.4884
Cardio
0.8628
0.7465
0.7576
0.7830
0.8243
Cardiotocography
0.6969
0.6627
0.7612
0.6716
0.7337
Comm.and.com crime
0.8892
0.8909
0.8854
0.8312
0.8806
Fault
0.6035
0.5320
0.5045
0.5421
0.6034
Glass
0.0896
0.0968
0.0829
0.0999
0.1278
Hepatitis
0.5828
0.5799
0.5948
0.4836
0.6262
Imgseg
0.7724
0.8150
0.8054
0.8124
0,8243
Ionosphere
0.8969
0.8291
0.9571
0.9246
0.9260
Lympho
1.0000
0.9549
0.8556
0.9718
0.9889
Mammography
0,4165
0.4808
0.3893
0,4725
0.5793
Mnist
0.6499
0.6423
0.6549
0.6543
0.6499
Musk
1.0000
0.9855
0.9981
0.9585
0.9969
Optdigits
0.0602
0.0677
0.0602
0.0602
0.0602
Parkinson
0.9297
0.9341
0.9323
0.9343
0.9436
Pendigits
0.3863
0.5422
0.6302
0.4028
0.4847
Pima
0.7008
0.7064
0.6244
0.7034
0.7509
Satellite
0.7778
0.7923
0.7697
0.7886
0.7921
Satimage-2
0.9192
0.8532
0.2350
0.8704
0.9311
Shuttle
0.9627
0.9862
0.9791
0.9745
0,9906
SpamBase
0.8184
0.8237
0.8289
0.8312
0,8228
Speech
0.0277
0.0279
0.0311
0.0280
0.0293
Thyroid
0.8134
0.8244
0.7363
0.8364
0.8146
Vertebral
0.1381
0.1426
0.1391
0.1426
0.1433
Vowels
0.1051
0.0930
0.2136
0.1203
0.1090
Wbc
0,8391
0.7705
0.7304
0,8249
0,8400
WDBC
0.9833
0.8506
0.9124
0.9226
0.9802
Wilt
0.0641
0.0658
0.0642
0.0641
0.0972
Wine
0.1325
0.2685
0.1809
0.7635
0.8459
WPBC
0.3940
0.3872
0.4341
0.3855
0.4085
Yeast
0.4678
0.4723
0.4789
0.4964
0,5053
Average
0.5975
0.5929
0.5730
0.6076
0.6376
38

---

Published as a conference paper at ICLR 2026
Table 17: AUC-PR (1) performance comparison of IForest under different LLM prompt designs
across 36 datasets.
IForest
Generic
Simple
Random
LLM-DAS
Abalone
0.8481
0.8390
0.8492
0.7452
0.8555
Amazon
0.1091
0.1107
0.1099
0.1102
0.1093
Annthyroid
0.6149
0.5911
0.6243
0.2804
0.6200
Arrhythmia
0.5097
0.5794
0.5951
0.4967
0.6021
Breastw
0.9449
0,9966
0.9921
0.9266
0,9947
Campaign
0.4608
0,4332
0.4517
0.4330
0.4517
Cardio
0.7018
0.6611
0.7771
0.5234
0.6220
Cardiotocography
0.6036
0.6570
0.6513
0.5278
0.6382
Comm.and.cmm crime
0.8940
0.8794
0.7943
0.8661
0.8958
Fault
0.5948
0.5347
0.5894
0.5602
0,5774
Glass
0.0952
0,1004
0.1063
0.0890
0.1205
Hepatitis
0,4182
0.5292
0.4908
0.3799
0,5662
Imgseg
0.7556
0.8238
0.8268
0.6780
0.8589
lonosphere
0,9768
0.7474
0.9119
0.7488
0.8685
Lympho
0.9593
0,9577
0.9213
0.8498
0.9794
Mammography
0,3334
0.4366
0,4321
0.1642
0,5712
Mnist
0.5349
0.5728
0.6154
0.6294
0.6011
Musk
0.5279
0,8382
1,0000
0.8611
1.0000
Optdigits
0.1570
0.1339
0.1579
0.1423
0.1790
Parkinson
0,9595
0,9615
0,9557
0.9156
0.9514
Pendigits
0.5133
0.6743
0.5427
0.5022
0.6020
Pima
0.6662
0.7244
0.7110
0.6084
0.7397
Satellite
0.8583
0,8203
0.8217
0.8158
0,8079
Satimage-2
0.8846
0.5511
0.9515
0.1444
0.8706
Shuttle
0,9172
0,9956
0,9912
0.9978
0,9954
SpamBase
0.8902
0.8832
0.8175
0.8648
0.8892
Speech
0.0353
0.0267
0.0296
0.0351
0.0318
Thyroid
0.6055
0.7622
0.8280
0.1924
0.8856
Vertebral
0.1342
0.1385
0.1339
0.1814
0,2686
Vowels
0.0984
0.1127
0.1054
0.0940
0.1779
Wbe
0,8573
0.7837
0,8531
0.2100
0,8233
WDBC
0.9749
0.8893
0.9687
0.1164
0.9936
Wilt
0.0848
0.0955
0.0871
0.1913
0.2784
Wine
0.2458
0.1551
0.1886
0.5410
0.4559
WPBC
0.3760
0.3752
0.3990
0.4400
0.3993
Yeast
0.4654
0,4798
0.4668
0.4708
0.5462
Average
0.5724
0.5792
0.6041
0.4815
0.6341
39

---

Published as a conference paper at ICLR 2026
Table 18: AUC-PR (1) performance comparison of DRL under different LLM prompt designs across
36 datasets.
DRL
Generic
Simple
Random
LLM-DAS
Abalone
0.8850
0.8813
0.8716
0.8625
0,9021
Amazon
0.1206
0.1023
0.1011
0.0958
0.1197
Annthyroid
0.6761
0.3477
0.5409
0.3578
0.7618
Arrhythmia
0.6270
0.6657
0.6138
0.6380
0.7298
Breastw
0.9966
0.9954
0.9934
0,9879
0.9972
Campaign
0,5013
0.4957
0.4857
0.4852
0.4945
Cardio
0.8325
0.8978
0.9116
0.8597
0.8861
Cardiotocography
0.7540
0.6607
0.7109
0.7084
0.8046
Comm.and.cmm crime
0.9164
0.9460
0.9442
0.9438
0.9470
Fault
0.6649
0.5967
0.6044
0.6537
0.7053
Glass
0.1670
0.3493
0.3166
0.3036
0.4934
Hepatitis
0.6627
0.6876
0.6880
0.6808
0.6957
Imgseg
0.9238
0.9301
0.9308
0.9283
0.9436
lonosphere
0,9895
0.9486
0.9770
0.9514
0.9846
Lympho
1.0000
0.7374
0.7339
0.7490
0.8706
Mammography
0,8406
0.4620
0.4819
0.3158
0.5288
Mnist
0.8870
0.9165
0.9083
0.9106
0.9109
Musk
1,0000
0.9925
1.0000
1.0000
1.0000
Optdigits
0.9356
0.3192
0.2817
0.2909
0.9566
Parkinson
0.9210
0.9643
0.9628
0.9659
0.9659
Pendigits
0.9360
0.0538
0.3199
0.0467
0.8848
Pima
0.7449
0.7499
0.6457
0.6541
0.7912
Satellite
0.8692
0.8659
0.8843
0.8770
0.8942
Satimage-2
0.9703
0.9384
0.9641
0.9353
0.9804
Shuttle
0,9819
0.1962
0.9934
0.8961
0.9991
SpamBase
0.8413
0.8272
0.7837
0.7212
0.9335
Speech
0.0584
0.0478
0.0502
0.0494
0.1189
Thyroid
0.8626
0.2966
0.6301
0.3089
0.8770
Vertebral
0,2854
0.2329
0.2564
0,2389
0,5657
Vowels
0.4506
0.8592
0.8147
0.8985
0.8918
Wbc
0,9742
0.7369
0,8001
0.7317
0.9341
WDBC
1,0000
0.8423
0.9250
0.7377
1,0000
Wilt
0,4543
0.6526
0.4637
0.6250
0.5926
Wine
1.0000
0.9591
0.9577
0.9635
1.0000
WPBC
0.5017
0.4675
0.4550
0.4361
0.5671
Yeast
0.5416
0.5457
0.5195
0.5373
0,5281
Average
0.7437
0.6436
0.6812
0.6485
0.7849
40

---

Published as a conference paper at ICLR 2026
6.14 A SIMPLE THEORETICAL ILLUSTRATION OF BOUNDARY REFINEMENT
This appendix provides stylized theoretical perspective why detector-aware synthetic hard anomalies can improve the detection of true hard anomalies. While the main paper focuses on empirical validation across five detector families, lightweight theoretical model helps clarify the geometric mechanism underlying the improvements observed in Fig. and Tables 1, 4-5.
6.14.1 MOTIVATION AND THEORETICAL ABSTRACTION
Motivation. Empirically, we observe that most detection errors arise from hard anomalies- true anomalies that lie close the decision boundary of the base detector ft. In contrast, easy anomalies that lie far from this boundary are already well-detected by ft without augmentation. LLM-DAS is explicitly designed to larget this wear-boundary region: it identifies borderline normal samples and transforms them into synthetic hard anomalies that reflect the failure modes of ft. These synthetic anomalies provide precisely the type of near-boute bear-boundary supervision that one-class detectors inherently lack. The enhancement classifier ft is trained on these hard synthetic samples, and the final fused detector
(x) Norm(f((z)) Norm(f((x))
combines the strengths of both models.
Theoretical abstraction. To formalize this mechanism, adopt the following stylized model:
The set of true anomalies is conceptually decomposed into easy anomalies (far from the decision boundary of fi) and hard anomalies (near the boundary, where most errors occur).
LLM-DAS generates detector-aware synthetic hard anomalies by transforming normal samples that lie near the decision boundary of ft-
If these synthetic anomalies geometrically cover the true hard anomalies within small neighborhood, then any margin learned by the enhancement classifier f on the synthetic anomalies should transfer the nearby true hard anomalies.
This abstraction leads to the proposition below, which formalizes this margin-transfer intuition under a mild smoothness assumption on
6..4.2 MARGIN TRANSFER FROM SYNTHETIC HARD ANOMALIES
Proposition 1 (Margin transfer via detector-aware synthetic anomalies) Let C Rd be the in- put space and T E IR decision threshold. Let f X - IR be B-Lipschitz scoring function:
- lf(x) < Bl x - r'1l2 Vr
Suppose a set of detector-aware synthetic anomalies Skyn = {Jayn) } satisfes
j(Keyu) 2
7>0
Assume the set of true hard anomalies DA is e-covered by Sayn, i.e., for each Ta E D there exists Tayn Sayn with ||.. Teyulla S Then each true hard anomaly satisfies
f(xa) 2 + Be.
In particular, if Be < y, then f(xx) > t, and va correctly detected under threshold T.
Proof. Fix any DA- By e-covering, choose Jayn E 8syn with I|ara Pssyll2 S 6. By Lipschitzness.
ls( [( S BE.
Thus,
f(x,) f(Fayn Be (T (T+ +)) BE.
If Bs < <,, then ((xa) v, completing the proof.
41

---

Published as a conference paper at ICLR 2026
Interpretation. The proposition states that if synthetic hard anomalies are close (in geometry) to the true hard anomalies ( E), and if the enhancement classifier can enforce a margin (1 ?) on the synthetic samples, then the true hard anomalies inherit a positive margin up to Lipschitz slack (Bs < ?). This formalizes how near-boundary synthetic anomalies help the enhanced classifier learn tighter decision boundary exactly where the base detector is weak.
6.14.3 REMARKS ON APPLICABILITY AND MODEL CLASSES
Smooth vs. non-smooth enhancement classifiers. The margin-transfer proposition relies Lipschitz regularity condition on f. which holds for smooth discriminative models such as linear or kernel SVMs. As shown in Fig. 9 of Appendix 6.12 LLM-DAS yields clear performance improvements when f is instantiated as an SVM, consistent with the proposition.
Although tree ensembles are not Lipschitz in the Euclidean sense, they follow similar qualitative geometry: synthetic anomalies near the boundary tend to fall into similar leaves or partitions as true hard anomalies, providing comparable refinement. Extending the formal analysis non-smooth models an interesting direction for future work.
6..4
CONVERGENCE AND STABILITY OF FUSED DETECTOR
The final fused detector is
F(()) (orm(f( + Norm(f.(x)).
Both components are bounded and monotone, so the enhancement step preserves the stability and asymptotic behavior of the base detector f., while adding bounded corrective term concentrated around the decision boundary. Thus the enhancement procedure behaves as stable additive refine- ment: it reduces bias near hard anomalies while introducing only controlled variance determined by the number and quality of the synthetic samples and the complexity of ft-
6.14.5 JUSTIFICATION FOR LOCAL BOUNDARY REFINEMENT MECHANISM IN LLM-DAS
complex, global decision boundary may not be uniformly "tightened".. The effectiveness of LLM- DAS does not rely on such global coverage but on a targeted, local refinement mechanism. Our conceptual justification is twofold and strongly supported by our anomaly-type analysis.
(1) Local Patching of Algorithmic Weak Spots: The LLM in LLM-DAS acts as an automatic analyst that identifies a detector's structural weaknesses from its algorithm description. It then generates a program to create anomalies that specifically target these weaknesses. The goal is not to resample the entire boundary but to patch critical, high-error regions where the base detector fo is known to fail. The performance improvement stems from precisely this targeted effort.
(2) Empirical Evidence via Anomaly-Type Alignment (Connecting to Appendix 6.15): Our experiments in Appendix 6.15 (Table 19, Fig. 11-13) provide direct, empirical validation of this local-patching principle. They demonstrate that LLM-DAS automatically synthesizes anomalies whose distribution is closest to the specific anomaly types (e.g., dependency and local anomalies) that each base detector (e.g., IForest, OCSVM) struggles with most, as per established benchmarks like ADBench.
This is crucial: Different anomaly types challenge different segments of the decision boundary. By generating anomalies that align with a detector's 's known algorithmic blind spots, LLM-DAS proves it can automatically locate and target the most impactful "weak regions" of the boundary, even if they constitute only a portion of the whole.
The significant performance gains we observe on these specific anomaly types confirm that patching these localized regions is both necessary and sufficient for overall improvement.
(3) Preservation of Existing Strengths via Ensembling: Furthermore, our framework is designed to be robust and non-destructive. As noted in our analysis, for anomaly types where the base detector already performs well (e.g., IForest Cluster anomalies in Table 19), LLM-DAS maintains stable slightly improved results. This indicates that our method enhances robustness without overfitting to the particular anomaly categories it uses for augmentation. This is direct benefit of our ensemble
42

---

Published as a conference paper at ICLR 2026
design F(z) (z))(f((2)) + No)m(f((x)). The original detector ft continues dominate in regions already models accurately, preserving its discriminative ability for "easy" anomalies, while the enhancement classifier ft extends the coverage toward harder cases targeted by the LLM.
Therefore, while single set of synthetic anomalies may not the entire boundary, its coverage is highly strategic. focuses on the regions that matter most for reducing the base detector's 's error, which is why the method delivers consistent and significant gains beyond purely empirical observations.
6.14.6 SUMMARY
Together with Fig- 5 this stylized analysis provides formal illustration of the empirical finding that LLM-DAS tightens the decision boundary around hard anomalics. The proposition explains why detector-aware synthetic anomalies bring improved separation precisely in the near-boundary region, while the ensemble structure ensures that easy anomalies remain correctly handled by the original detector.
43

---

Published as a conference paper at ICLR 2026
6.15
DETECTOR-AWARY ANOMALY SYNTHESIS ACROSS DIFFERENT ANOMALY TYPES
6.15.1 MOTIVATION AND EXPERIMENTAL PHILOSOPHY.
core challenge in tabular anomaly detection (TAD) the diversity of anomaly types. The ground- truth anomaly type is not standardized across datasets, and different datasets may correspond to different or mixed anomaly mechanisms, making real-world anomalies inherently complex and heterogeneous. Different detectors inherently excel at detecting different kinds of anomalies due to their underlying algorithms' assumptions. According to ADBench (Han et al. 2022), many tabular detectors- such as IForest, OCSVM- performing well on "Clustered" types.
to detect "Dependency" and "Local" anomalies, while
The key innovation of LLM-DAS is that it does not require a priori specification of anomaly types. Instead, positions the LLM as an "algorithmist" that reasons about a detector's ' intrinsic logic to generate code Code for synthesizing anomalies that specifically "hard" for that detector. A critical question thus arises: What types of anomalies does this detector-aware code actually produce?
To answer this scientifically, we need controlled experimental setup where ground-truth anomaly types are known. We, therefore, adopt the established synthesis protocol from ADBench (Han et al.) (022) to create benchmark where different, pure anomaly types injected into the same normal data backbone. This allows us to rigorously analyze the relationship between a detector's weaknesses and the characteristies of the anomalies synthesized by its corresponding Code'.
6.15.2 EXPERIMENTAL SETUP: CONSTRUCTING TYPE-SPECIFIC TESTBEDS
To analyze how LLM-DAS adapts to different anomaly mechanisms in a controlled and detector- manner, we follow the official ADBench (Han et al., (022) protocol construct four benchmark variants of the same real-world dataset ("Hepatitis"" ). The core idea is to build generative model (e.g.. Gaussian mixture model GMM) using the normal samples from the real-world dataset ("Hepatitis") and discard its original anomalies we do not know their types. Then, We could generate normal samples and different types of anomalics based on their definitions by tweaking the generative model. The generation of normal samples is the same in all settings if not noted, and provide the generation process of four types of anomalies below.
Unified woomaly-generation protocol. Each anomaly type is created using the following standard- ized procedures from ADBench (Han al. 2022):
Generated by scaling the covariance matrix of Gaussian mixture compo- nents (É aE with 5), producing locally deviant samples within dense regions of the normal manifold.
Local anomalies:
They are more different from the normal data, drawn from uniform distribution (n min Xx), a max Xx)) with a = 1.1, where the boundaries are defined the min and max of an input feature, e.g., k-th feature X
Global anomalies:
Dependency anomalies: Produced by removing feature dependencies modeled by Vine Cop- ula, where the joint density is replaced by independent marginals, breaking the correlation structure among features.
Clustered anomalies: Formed by scaling the mean vector of the normal data (á <- oçu with a = 5), creating compact abnormal clusters separated from the normal distribution.
For each anomaly type т E [Local, Global, Dependency, Clustered), we obtain a dataset consisting of: (D(T) (normal only), cest
(normal anomalies of type r)}. Importantly, the synthesized anomalies produced by LLM-DAS and normal samples are kept the same across all variants, ensuring that the only varying factor is the anomaly type in the test set.
6..3.3 ANALYSIS PROCEDURE FOR LLM-DAS
Given a detector i (e.g., IForest), we examine how the -LMeggnerated synthesis code Code adapts to different anomaly types:
44

---

Published as a conference paper at ICLR 2026
1. Train the base detector. Train Sa on the normal-only dataset D D( train
2. Generate detector-specific synthetic anomalies. We instantiate the LLM-generated, detector-specific synthesis code Code' using D and ft. This produces set of synthetic anomalies A(D(F) train t):
3. Measure distributional similarity. (Table 19 Compute the Wasserstein distance between train 1) and each of the four ground-truth anomaly-type distributions in D(7)
A(D(7) (T)
test
4. Evaluate performance improvement. (Table 19 We use ((D(T) train t) to augment ((r)
train
and train binary classifier ft- We then fuse the ft and fa to obtain the final detector Ft, and evaluate performance D(T) to obtain the improvement A.
5. Kernel Density Estimation (KDE). (Fig. IHE We visualize the kernel density estima- tion (KDE) of anomaly scores before and after applying LLM-DAS, illustrating how the synthesized anomalies reshape the decision boundary.
Together, these analyses enable a detailed examination of (i) what types of anomalies LLM-DAS tends generate, and (ii) how such generated samples influence the detector's behavior and decision-space separation under different anomaly mechanisms.
6.15.4 ORIGINAL DETECTORS' PRIORI ON DIFFERENT TYPES OF ANOMALIES.
According to ADBench (Han et al. 2022). many tabular detectors-such as IForest, OCSVM-struggle to detect "Dependency" and "Local" anomalies, while performing well on "Clustered" types. To further broaden our observations, we also evaluate LLM-DAS paired with LOF, since LOF shows the opposite pattern: it performs better "Dependency" and "Local" anomalies but poorly on "Clustered" anomalies. Although LOF was not part of our main benchmark suite, it serves valuable complementary case for examining whether LLM-DAS adaptively targets detector's 's weakest anomaly type.
6.15.5
KEY FINDINGS: LLM-DAS AUTOMATICALLY TARGETS ANOMALY TYPES THAT EACH DETECTOR PERFORMS WORST ON
Table 19 shows that the base detectors exhibit distinct weaknesses across different anomaly types: Forest and OCSVM perform poorly on Dependency- and Local-type anomalies, while LOF struggles on Cluster-type anomalies. These findings consistent with the conclusions of ADBench (Han) ct al. 2022). confirming that each detector has its own characteristic sensitivity to specific anomaly structures.
As shown in Table 19 the anomalies synthesized by LLM-DAS are distributionally closer to the anomaly types which the corresponding detectors underperform- Dependency and Local for IForest and OCSVM, and Cluster for LOF, This observation aligns with our core claim that LLM- DAS is not generating arbitrary or predefined anomaly types, but instead dynamically adapts its synthesis behavior based on the weaknesses of the base detector. In other words, LLM-DAS learns identify and reproduce the challenging regions within each detector's decision space rather than following fixed anomaly taxonomy.
Furthermore, combining the quantitative and visual evidence from Table 19 and Fig. observe that the anomalies synthesized by LLM-DAS significantly improve performance and enhance score separation between normal and abnormal samples on those hard anomaly types where the base detectors originally perform poorly. This confirms that LLM-DAS effectively addresses the intrinsic blind spots of each detector. Meanwhile, for anomaly types that the base detectors already handle well, LLM-DO MDS maintains stable slightly improved performance, demonstrating its robustness and balanced ensemble design.
we
Overall, these results validate that LLM-DAS adaptively captures the detector-specific difficulty patterns across heterogencous anomaly types, thereby inherently accounting for anomaly diversity rather than ignoring it.
Discussion and Future Work. These findings highlight that LLM-DAS does not generate arbitrary anomalies, but adaptively learns emphasize those challenging for the base detector. Meanwhile,
45

---

Published as a conference paper at ICLR 2026
Table 19: Detector-aware anomaly synthesis: Wasserstein distance versus performance improvement. For each detector and each canonical anomaly type (Local, Global, Dependency, Clustered), we report: (i) the Wasserstein distance between the LLM-DAS -LM--AS--eeerrttd anomalies and the corresponding ground-truth anomaly-type distribution, (ii) the base detector performance (ft), (iii) the enhanced performance after applying LLM-DAS (Ft), and (iv) the improvement A of Fr over Jt. Across detectors, the anomaly types with the smallest Wasserstein distances (highlighted in blue) consistently correspond to the largest performance gains, demonstrating that LLM-DAS automatically synthesizes anomalies that resemble each detector's s weakest anomaly mechanism.
Detector type
Anomaly type
Wasserstein distance
Base detector (fe)
LLM DAS (F))
Ingrov. (A) 1
Dependency
0.942
0.419
0.701
0.282
IForest
Local
0.958
0.575
0.717
0.142
Cluster
1.694
0.781
0.797
0.016
Global
1.824
0.701
0.722
0.021
Dependency
0,651
0,246
0.727
0.481
Local
0,560
OCSVM
Cluster
1.630
0.789
0.803
0.014
Global
1.779
0.719
0.722
0.002
Dependency
1.117
0.777
0.791
0.014
Local
0.737
LOF
Cluster
0.897
0.141
0.757
0,616
Global
1.723
0.647
0.676
0.029
our ensemble strategy ensures that the original detector ft continues to dominate detection of easy anomaly types it already handles well, preserving generalization (see Appendix 6.14). In future work, we plan to design controllable synthesis module that allows users to explicitly specify target anomaly types (e.g., dependency clustered) further enhance interpretability and diagnostic use.
Greanoouuh
Ortine fearstyfor ets
Disee feemod Staes of
Nornal Gecmanyy
Gruunroshh
LAMAD Anomaly
22
50
24
25
02
05
06
(a) fe on Dependency vntunued noarady worests
(b) ft on Local
(c) ft on Cluster
(d) ft on Global
vrosed fomnaay sarne
seurced Faweay st
Gourcouss Asomaay
Gra Granconuu Anamay
Greandouut Araaaa
10-
ArstoyNar
Geandy hare
(e) F; Dependency
(f) F: Local
(g) Ft Cluster
(h) Global
Figure 11: Kernel density estimation (KDE) of anomaly scores from the source IForest detector fe and the LLM-DAS-enhanne and the second row (e-h) shows the corresponding results after applying LLM-DAS. Each column corresponds one anomaly type (Dependency, Local, Cluster, Global). The enhanced detector F, exhibits improved boundary separation, especially for the Dependency and Local types, whose characteristics are most similar the synthesized anomalies.
detector F., The first row (subplots a-d) shows the original detector ft-
46

---

Published as a conference paper at ICLR 2026
Greanoossh Nornal WADDGG
Grounoouth Nemel ANNDA
Grou Nomall WUMAN
Gouedrah Noral
Let MM- Anomay
Avdmdyy Score
Ancray Store
Anerdy Scrre
deanch Scar
(a) fr on Dependency
(b) fo Local
(c) ft on Cluster
(d) fr on Global
Oruesindss Nernll
Couumondh Nereel MWG
Grozd dh Nornel
Gruneoshh Norrel
LUMOMG knonay
Ascmaby score
Aaoralyy Score
Jeamaly Score
Jeamuby
(e) Fe on Dependency
(1) F. on Local
(g) F on Cluster
(h) F. on Global
Figure 12: Kernel density estimation (KDE) of anomaly scores from the source OCSVM detector fo and the SAM--DASenhannee detector F,. The first row (subplots a-d) shows the original detector ft. and the second row (c-h) shows the corresponding results after applying LLM-DAS. Each column corresponds to one anomaly type (Dependency, Local, Cluster, Global). The enhanced detector Fr exhibits improved boundary separation, especially for the Dependency and Local types, whose characteristics are most similar to the synthesized anomalies.
Aramab Scars
Orgeill Gessey of
Aremub Scare
Cooudiodd terral
Crondoodth Herral LM-OIC Ansmay
LUMO kromay
(rEAnOOUE Arandy
(a) fr on Dependency
(b) ft Local
(c) ft on Cluster
(d) ft on Global
Brosed mots memll
Broad Nerol LUM Old
Rovedd moth Norool LUMOAC Anomay
Nersl
LUMO knmnay
LUe OA--IG Anomay
Asceaby Score
ABomaly Score
leama Scor
deamab Scan
(e) F, on Dependency
(1) Fi on Local
(g) Fr on Cluster
(h) Fi on Global
Figure 13: Kernel density estimation (KDE) of anomaly scores from the source LOF detector fa and the LLM--DAS-chaaneed detector F,. The first row (subplots a-d) shows the original detector ft- and the second row (c-h) shows the corresponding results after applying LLM-DAS. Each column corresponds to one anomaly type (Dependency, Local, Cluster, Global). The enhanced detector F exhibits improved boundary separation, especially for the Cluster types, whose characteristics most similar to the synthesized anomalies.
47

---

Published as a conference paper at ICLR 2026
6.16 CONTROLLLOD SYNTHETIC ANOMALIES AND LIDE-EFFECTS ANALYSIS
Motivation. An important question is (i) whether LLM-DAS can generate anomalies with dif- ferent levels of hardness, and (ii) whether overly hard synthetic anomalies may negatively impact generalization in some datasets. To systematically study these aspects, we extend the synthesis prompt with an explicit hardness-level interface (prompt is detailed in Prompt(6.16 and introduce quantitative metric for anomaly hardness based on Wasserstein distances. This appendix provides the experimental protocol and detailed results that support our claim.
Hardness- interface and experimental setup. We modify the original LLM-DAS prompt so that the LLM is required to produce synthesis code that accepts a discrete hardness level "High", "Medi um ", " "Low". Intuitively:
High aims to generate anomalies that are close to the normal-data manifold and are therefore hard to detect;
Medium generates anomalies moderately separated from normal data;
Low generates anomalies further away, which are easier detect.
The original LLM-DAS implementation in the main paper corresponds closely to the High-hardness behavior, i.e., synthesized anomalies typically lie near the decision boundary and are thus chal- lenging for the base detector.
instantiate this interface on two representative base detectors: PCA and IForest. For each dataset, we compare:
the base detector alone (PCA/ / IForest),
the original LLM-DAS (denoted "LLM-DAS (Ours)"),
LLM-DAS with hardness levels High Medium Low (denoted "LLM-DAS (Hardness Level)").
Performance effect of hardness control. Table 20 reports the performance of PCA and IForest- based LLM-DAS under different hardness settings. Rows highlighted in blue correspond to datasets where the original LLM-DAS already improves over the base detector. Rows highlighted in red correspond to fail cases where the original LLM-DAS underperforms the base detector.
Several consistent patterns emerge:
Original & High hardness. For most datasets, the original LLM-DAS and the High- hardness variant achieve very similar performance. This confirms that the default policy learned by LLM-DAS indeed focuses on generating hard anomalies.
Robust gains across hardness levels. On the majority of datasets (blue rows), all hardness levels (High/MMdium//Loww Low) outperform the base detector, and the original (High) version is often the best or close to the best. This shows that LLM-DAS is not fragile with respect to the exact hardness level, long synthetic anomalies inhabit reasonably informative region near the boundary.
Failure cases and recovery by lowering hardness. few datasets (red rows), the original LLM-DAS underperforms the base detector. Crucially, these failures are reversible: by lowering the hardness level (Medium or Low), performance recovers to the baseline or even exceeds it. For example, for PCA on lympho, the original LLM-DAS yields 0.989, while Medium/Low hardness both achieve 1.000; for IForest on cardio, the original LLM-DAS yields 0.622, while Low hardness reaches 0.718.
These results empirically validate that (i) LLM-DAS can generate anomalies at different difficulty levels, and (ii) the hardness control interface provides simple and effective knob to mitigate rare side effects.
Quantifying hardness via Wasserstein distance. To make hardness evaluation model-agnostic compute the multivariate Wasserstein distance between the synthetic anomalies and the normal
48

---

Published as a conference paper at ICLR 2026
Table 20: AUC-PR performance of LLM-DAS with different hardness levels of anomaly synthesis. We extend the synthesis prompt (detailed in Prompt 6. 16) so that the LLM LLM-generated code includes discrete hardness parameter (High, Medi um, Low). Rows blue indicate datasets where the original LLM-DAS improves over the base detector. Rows in red indicate cases where the original LLM-DAS underperforms base detector, but performance can be recovered or improved by lowering the hardness.
Basc detoctor PCA
+LLM-DAS (Hardness Level)
Datasets
+LLM-DAS (Ours)
High
Medium
Low
imgseg
0.772
0.796
0.787
lympho
1,000
0.989
0.987
1,000
1,000
satellite
0.778
0.792
0.799
0.796
0.790
satimage-2
0.919
0,931
0,933
0.933
0.927
vertebral
0.138
0.143
0.144
0.143
0.141
WPRC
0.394
0.408
0.411
0,402
0.401
musk
1.000
0.997
0.996
1.000
1,000
cadio
WDBC
0.983
0.980
0.981
0.983
0.989
mammography
0.417
0.579
0.575
0.563
0.561
pima
0.701
0.751
0.749
0.740
0.734
Base detector IFioestt
+LLM-DAS (Hardness Level)
Dalasets
+LLM-DAS
Tlgh
Medium
Low
imgseg
0.756
0.839
0.854
0.843
0.847
lympho
0.959
0.979
0.976
0.976
0.968
satellite
0.862
satimage 2
0.885
0.871
0.870
0.892
0.906
vertebral
0.134
0.269
0.249
0.237
0.231
WPBC
0.376
0.399
0.396
0,386
0.384
musk
0.528
1,000
1,000
1.000
1.000)
cadio
0.702
0.622
0.624
0.687
0.718
WDBC
0.975
0.994
0.997
0.991
0.983
manmography
pima
0.666
0.740
0.747
0.728
0.721
Table 21: Wasserstein distance metrics for quantifying anomaly hardness. d(Al, 71) is the multivariate Wasserstein distance between anomalies A and normal samples 71 via optimal-transper in the feature space. Lower distance indicates higher hardness (more overlap with normal). The ratio syn. mmd 7) is the Relative Hardness Ratio.
Base detector: PCA
Darnsets d(.7 11) diee Tuee:1
d(.7
d(.7sm
A5,751e1s)11 I1)
d( d(Aasnadinn M)
imgseg
1,870
4.963
9.279
9.148
10.534
11.953
lympho
0.540
17.529
9,474
9.504
18.077
58.429
sutellite
1.431
7.828
11.198
11.078
11.386
13.125
satimage-2
0.457
14.716
6.728
6.734
7.194
8.066
vertebral
8.141
1.691
13.765
13.895
14911
16.732
WPBC
0.915
5.407
4.947
4.962
5.237
5,875
musk
0.261
31,207
8.157
8.179
9.249
12.112
cardio
0.724
12.054
8.726
8.736
9.088
9,769
0.322
16.559
5,340
5,724
8.706
9.159
mammography
1.424
5.439
7.743
7,746
7.903
8,813
pima
2.376
Base detoctor: IForest
Datasets
A(n. R) / d(
d(Amm. (I)
d(Aign
d( Asyryn 11)
d(Asyyaaamm' III
d( d(Masyoox
imyseg
1.050
4,963
5.213
5.214
5.678
6.168
lympho
0.224
17.529
3,920
3,919
4.050
4.263
satellite
0.712
7,828
6.042
6.056
6.773
7.922
satimage-2
0.222
14.716
3,262
3,258
4.910
7.228
vertebral
6.440
1.691
10.889
10.768
10.910
11.729
5.407
musk
0.125
31.207
3,906
3,917
4.977
5.196
WDDC
0.174
16,559
2,888
2,919
3.071
4.471
mammography
pima
3,557
2,376
8.453
8.438
8,950
9.052
set using optimal-transport formulation EMD (Farth Mover's Distance), where the two point
49

---

Published as a conference paper at ICLR 2026
clouds treated as empirical distributions in the feature space. Unlike the classical ID Wasserstein distance computed over scalar score distributions, our implementation uses the full multivariate point sets (normal vs. synthetic anomalies) and measures their geometric discrepancy through optimal transport cost.
We denote d(.7, 7) the multivariate Wasserstein distance between anomalies A and normal samples via optimal-transpott in the feature space. A lower value of d(A7, M1 indicates that anomalies lie closer to the normal manifold and are therefore harder detect.
Table 21 reports:
nue N):: the inherent difficulty of the dataset (how far true anomalics are from normal samples),
d(Asyn N): distance for anomalies synthesized by the original LLM-DAS,
d(Asynna 11, d(Asyonacunn 11) d( II): distances under each hardness level,
the ratio d(-asmn))) which we refer to as the Relative Hardness Ratio. Jyy
Two observations are particularly important:
Monotonic trend across hardness levels. For both PCA and IForest, d( d(Asynng 71 is consistently smaller than or comparable to the Medium and Low settings, and the distances increase from High - Medium - Low. This confirms that the hardness control interface is effective: High hardness produces anomalies closer normal data, while Low hardness produces more easily separable anomalies.
Failure cases correspond to "overly hard" synthetic anomalies. In the failure cases highlighted in red in Table 20 the ratio d(AAsm.())
d(. IT) Table 21 tends be comparatively small. This means that the synthesized anomalies are much closer normal samples than the true anomalies, even though the true anomalies are already far from normal (large Twe, 77).. these failure cases, the problem is inherently easy, and generating very hard synthetic anomalies over-complicate the learned boundary and hurt performance.
Practical takeaway. Taken together, Table 20 and Table 21 show that:
LLM-DAS can synthesize anomalies controllable hardness levels;
the original implementation naturally produces hard anomalies (small Wasserstein distance);
rare side effects arise when the dataset is inherently easy but the synthetic anomalies are "too hard";
these side effects can be mitigated in practice by lowering the hardness level, which increases d(Asya, 77) and restores performance to baseline or better.
Prompt used LLM-DAS variant with controlled hardness, To further analyze the impact of anomalous samples with varying difficulty levels, modified the prompt in the "Requirements" section by introducing a variable, the difficulty coefficient "degree", enabling LLMs to generate anomalies with varying degrees of difficulty. The specific prompt is follows.
50

---

Published as a conference paper at ICLR 2026
Example Prompt for Generating Varying Difficulty Synthesis Code
You are an expert anomaly detection systems. The training set contains only normal samples. We IForest detector, where the anomaly score is computed using model. poodel.prdicc_sccoee]] The higher the score, the more anomalous the sample. The description of IForest. *XXX.
*XXX.
*XXX.
... (Same as original prompt)
Your task is
*XXX.
*XXX.
*XXX.
...mm as original prompt)
Requirements: Your should strictly follow below requirements:
Thus the function format is generate_ hata mp.ndarray, degree)
int, model, X_train:
Supplementary explanation: The parameter degree is used generate anomalies with
varying levels of detection difficulty, featuring three optional values:
-low (low difficulty)
med (medium difficulty)
high (high difficulty)
These correspond generating anomalies that are hard, moderately hard, and extremely hard detect, respectively. You need to generate anomalies the corresponding difficulty level based on the specific value of degree.
Return only the complete Python function generate_ _aad__ardd___ (add_aaamomi((..)) with policy you used for genenrating anomalies and clear comments explaining key steps.
6.17 ANALYSIS GENERATING DETECTOR-SPECIRIC BINARY CLASSIFIERS
To further explore the potential of LLMs within the proposed framework, we redesigned the prompts in the "Objective" and "Requirements" sections to enable LLMs to develop detector-specific binary classifiers. These classifiers are then directly integrated with the original ones to enhance the anomaly detection performance of the baseline models. The specifie prompt be found in prompt/.11
51

---

Published as a conference paper at ICLR 2026
Example Prompt for Generating Detector-Specific Binary Classifiers
You are an expert in anomaly detection systems. The training set contains only normal samples. We use IForest detector, where the anomaly score is computed using podde.prredic_sccoee]] The higher the score, the more anomalous the sample. The description of IForest. *XXX.
*XXX.
*XXX.
... .Saam as original prompt)
Your task is to write a Python function detector sepector-ppeifiiccccc binaryy classssffisfiess..)) tailored for PCA detectors. This function must complement PCA by focusing on capturing the aforementioned anomaly types that PCA fails to detect. Once the function is implemented, users will be able to provide with the following inputs: A trained PCA model (model) that exposes predict_scoref) * The training samples (X train)
Requirements: Your should strictly follow below requirements:
1. You must use your expertise to design a binary classifier that is specifically tailored for PCA detectors, not model-agnostic classifier. The design should leverage the inherent characteristics and limitations of PCA to achieve complementarity.
2. The classifier should focus on capturing anomaly types that PCA fails to detect, particularly those that result in low scores from model. www.lppe_ecorreeeeeee (i.e., anomalies with low reconstruc- tion error in PCA). To achieve this, you can first identify "borderline" normal training samples based on professional understanding of PCA's inherent characteristies (not solely relying on anomaly scores), then design the classifier to sensitive to transformations of these samples that PCA cannot detect. The classifier's decision logic must be specific to PCA's weaknesses, making ineffective as a general classifier for other detectors.
3. For the PCA model, you only use the function model. predect (rodict_scoreO to interact with it.
4. The classifier must be trained on the provided training data and should expose standard fit(X, y) and predict score(X) methods.
5. The function should allow setting: the trained PCA model (model). training samples (X (X_train).
Thus the function format is detector spporssseeecccee b classifiers(model, train: np.ndarray)
6. All package imports must be done inside the function.
Return only the complete Python function detector detector_specific specific_biinryy liinar_classifferss.... with the policy used for designing the classifier and clear comments explaining key steps.
6.18 ANALYSIS OF GENERATING SYNTHETIC SAMPLES TARGETING MULTIPLE WEAKNESSES OF BASE DETECTOR
To explore whether LLMs can identify multiple weaknesses of detectors and whether a mixture of synthetic anomalies targeting all these weaknesses enhances robustness, we modified the prompt in the "Objective" and "Requirements" sections by instructing LLMs to first identify several distinct logical weaknesses of the detector and then generate mixture of synthetic anomalies targeting each weakness. The specific prompt can be found in prompt(6.11 And the example of the generation policy generated by the L.MMs is available in Coda The results are provided in Table 22
52

---

Published as a conference paper at ICLR 2026
Table 22: Performance comparison between the original LLM-DAS and the multi-weakness variant LLM-DAS (M-W), which explicitly prompts the LLM to identify and target several challenging anomaly patterns per detector.
PCA
.LLM-DAS (Ours)
-.LM-DAS (M-W)
TFoeest
+LLM--AS (Ouns)
+LLM-DAS (M-W)
ahalone
0.839
0,839
0.848
0.848
0,855
0,850
unnthyroid
0.566
0.660
0.582
0.615
0.620
0.623
imgseg
lympho
1,000
0.989
1.000
0.959
0,979
0.972
mammography
0.417
0,579
0.431
0.333
0.571
0,453
pendigits
0.386
0,485
0.397
0.513
0.602
0.613
pima
0.701
0.751
0.749
0.666
0.740
0.758
satellite
0.778
0.792
0.794
0,858
0.808
0.867
satimage-2
0,919
0.931
0.95
0.885
0.871
0,950
shuttle
vertehral
0,138
0,143
0,141
0.134
0,269
0.138
vowels
0.105
0.109
0.228
0.098
0.178
0.190
wilt
0.064
0,087
0.091
0.085
0,278
0,088
WPBC
0.394
0.408
0.400
0.376
0.399
0.405
breastw
0.993
0.996
0.994
0.945
0.995
0.994
cardio
0.863
0.824
0.873
0,702
0.622
0.834
Average
0.640
0.670
0.662
0.627
0.684
0.678
Example Prompt for Generating Synthetic Samples Targeting Multiple Weaknesses
You are an expert anomaly detection systems. The training set contains only normal samples. We use a IForest detector, where the anomaly score is computed using The higher the score, the more anomalous the sample. The description of IForest. * *XXX.
*XXX.
*XXX.
...(Sme as original prompt)
Your task is to write a Python function which are the most difficult for the IForest detector detect. This means that you the generated anomalies should have relatively low anomaly score, thus they are hard to be detected. But these anomalies are helpful to build more robust detector. Critically, you must first identify multiple distinct logical weaknesses of IForest (not just one), then design targeted anomaly generation policies for each weakness. The final output should be mixture of synthetic anomalies targeting all identified weaknesses to maximize robustness. After the function completed, users can provide with: A trained IForest model (model) that exposes predict_score(. * The training samples (X train)
that generates anomalies
Requirements: Your should strictly follow below requirements:
1. You must first identify more than one distinct, logical weaknesses of IForest, For each weakness, clearly explain the logical basis (how arises from IForest's design) in the function's is comments.
2. For each identified weakness, design a unique, Foorett-specffic anomaly generation policy (not model-agnostic). For each policy, you can first find the set of "borderline" normal training samples based on your unique and professional understanding to IForest, not only based on the anomaly score. Then transform them to anomalies that is tailor-designed for IForest. Please note that the transformation function should be specific for IForest, which means that it is not a general transformation for other detectors.
*XXX.
*XXX.
*XXX.
.Same as original prompt)
Code 2: Generated Code for Synthesizing Anomalies Targeting Multiple Weaknesses of IForest
53

---

Published as a conference paper at ICLR 2026
import numpy as xp
def generate__har_enomalll. (n_samples: int, model, X_train: np. ndarray); unn
Generates anomalies that are difficult for an Isolation Forest (IForest) model to detect.
This function operates by first identifying three distinet logical weaknesses of the IForest
algorithm, then implementing targeted generation policy for each weakness. The final output is a mixture of synthetic anomalies from all policies.
11
Args:
12
n a_samples (int): The total number of hard anomalies to generate.
model: A trained IForest-lkke model object that exposes 'predict_score" method.
14
The method should return a score where a higher value indicates a higher
likelihcod of being an anomaly.
X_train (np (np.ndarray): The training data used train the model, containing only
17
normal samples. Shape {
s_train_samples, n_features).
Returns:
20
np. nd.ndarryy: An array of generated hard anomalies, with shape (n_samples, n features).
21
1. Package Imports import numpy as np
23
24
25
$ 2. Pre-computation and Helper Functions
if n_samples 0:
return np. ap.array (I))
29
n_train, d - x_train.shape if d == 0:
return ap.
(n_samples, 0))
32
33
F The user-provided (nodel.predict_enne return higher scores for
is assumed to $ more anomalous samples. we use these scores to stratify the training data into
35
# topological regions as perceived by the IForest model itself
36
train_scores = model. www.ooottcooooooocccccccocc
38
$ Define quantiles to identify different types of normal points. This is a nuanced
39
# way to select 'borderline' samples based on the model's own perception of the data.
$ Central points: Deep inside the data cloud (Low scores).
41
$ Berderline points: On the fringes dense regions (medium scores).
42
$ - Edge peints: Most isolated of the normal points (high scores for normal sample),
central central_mask mask train_scores <- score_quantiles [25, 75, 9511 borderline_mask - (train_scores > score_quantiles [0]) &
score_quantiles
44
45
train_scores acore ppore_quantiles edge_mask train_scores >= score_quantiless/2
54

---

Published as a conference paper at ICLR 2026
Ensure we have points in each category to draw from.
49
X_central = X_train [centraleeaaa if np. np.any (central_mask) else
X_train
x b_borderline - (brrderibordriinee_eeeek if np.any
borderline_mask) else X_train X_edge
51
np.any (edge_mask) else X_train
52
53
# Global statistics for transformations
data_min ap.min (X_trann axis=0)
data_max np. (X_train, axis=0) data_range = data_max data_min
56
data_std sp.stdix_train, axis=0) data_centron
me.mean (X (X_train, axis-0)
6
# Avoid division by zero for constant features
61
data_range [data_range == 0] 1.0
62
@ata_stdIdata_ss == 0] = 1.0
IForest Weaknesses and Corresponding Anomaly Generation Policies
65
generated I]
$ Allocate samples to each policy
69
n_policyl = n_samples //
70
n_policy2 = n_samples //
n_policy3 n_samples n_policyl n_policy2 policy_allocation. [n_policyl, n_policy2, n_policy3]
73
74
#
75
F Policy 1: Clustered Anomalics
$
77
$ Weakness ID: "Masking" or "Crowding" Effect.
78
t logical Basis: IForest isolates points. If several anoma ies are positioned closely
t together, they form a dense cluster. The algorithm will then require many splits
30
# isolate any single point within this new cluster, making them appear "normal" (i.e.,
# giving them longer path lengths and thus lower anomaly scores) This policy creates
such dense micro-cluster space.
sparse area of the feature
83
if policy_allocations [0] > 0:
i Step 1: Find 'borderline' region by selecting normal point from a sparse area.
We use 'edge' points as seeds because they are already in less dense regions,
# making then good candidates for locating our new anomaly cluster far from the main data. seed_point x_edge randomm randint (0, len (K_edge))]
random.
Step 2: Define the center of the anomaly cluster by pushing the seed point further away from the data's centroid. cluster_center data_controid + 2.0 (sint data_centroid))
91
92
Step 3: Transform by generating very tight cluster around this new center.
94
The small covariance ensures the points are very close, maximizing the crowding effect. cluster_cov np.diag (data_std / 50.0) +*2) # Very small variance
95
55

---

Published as a conference paper at ICLR 2026
anomalies up rp.rammem.oo www.da..iliiiaaiite........ www.mmmitiattteeemmmmm normal (
97
moan=cluster_center, cov=cluster_cov, size= policy_allocations
98
generated__nomaliene append (anomalies_pi)
101
102
$ Policy 2: Diagonal Anomalies
103
$ Weakness ID: Inefficiency Axis-Parallel Splits for Diagonal Patterns.
105
F Logical Basis: IForest builds trees by splitting on a single feature at time, creating
f axis-parallel decision boundaries. It is inefficient at isolating anomalies that only
107
# become apparent through a combination features (e.g.r lying on a diagonal).
108
F Such points require many "stair-step" splits to be isclated, increasing their path
# length and lowering their anomaly score.
110
if anomalies_pl
0:
111
[]
112
# Step 1: Select 'borderline' normal samples. These are points the edge of the main
113
data cloud, making them good candidates to be pushed slightly further out in a non-obvious, diagonal direction to become hard-to-detect ancmalies.
114
base base_points poi_itstiiitieess mp www.rranoo....nntt...e...... (0, len x_borderline), wtteeppolcyyalllcaiiiieee [1])
116
base_points - X_borderline case__ooits_indieeee
117
for point in base_points:
119
anomaly peint.copy
120
Step 2: IPorest-speci fic transformation. Choose two random features and push the point's values along both dimensions simultaneously, creating a diagonal shift.
122
d
123
f1, f2 np. random. choice (d, 2, replace-False)
Perturb by magnitude related to the standard deviation each feature perturbation1 = np. choice ([-1, 1]) * 2.5 data_std
126
perturbation2 random choice ([-1, 1]) 2.5 data_std[f2]
128
129
anomalylfl] +- perturbationi
130
anomalylf2] += perturbation2
e1 elae: # Handle 10 case gracefully
132
anomaly[0] += np. rp..daddm.ccoice 11) 2.5 data_std(0;
133
anomalies p2 append (anomaly) generated_anomale append (np. array (snomalies_pp)
136
137
138
$ Policy 3: Subspace Anomalics
Weakness ID: High-Dimensional Feature Sparsity.
141
# Logical Basis: In high-dimensional spaces, IFcrest randomly selects a feature to split on # at each noge. If point is anomalous only within small subset of features (a subspace),
142
56

---

Published as a conference paper at ICLR 2026
$ the aigorithn is unlikely select these specific features for splitting early on. It will
144
$ waste many splits on irrelevant dimensions where the point looks normal, again increasing
145
# its path length and making it appear less anomalous.
if aatiicyyalocctionss...
147
anomalies_p3 ()
148
# step 1: Select 'central' normal samples. These points have the lowest anomaly scores and
deep within the normal data distribution. Medifying them subtly makes them hard distinguish from their many legitimate neighbors. base Dase_points_indice, = ra.dom..
150
151
(0, len (X_central),
---poolie_aallcctioon [2])
base_points X_central [base (base_points (iiiittsiinices
153
154
Step 2: Define a small subspace (a few features) to perturb.
eun_porturbed_dim (1, int (d 0.11) $ Perturb -108 of features
156
157
for point in base_points: anomaly peint. ()
158
Step 3: Apply the IForest- subspace transformation.
160
perturbed_dims = np. ron.em. mpp.raddm.choiee choice (d,
num_perturbed_dins, replace=ralse) for dim in perturbed_dims:
* Push the value just outside the observed range of normal data for that feature.
163
epsilon - 0.1 * data_range(din if anomaly [dim] data_max [dim) epsilon
164
0.5:
166
else:
167
anomaly[dim] data_min [dim] - epsilon anomalies_p3..am (anomaly)
168
generated leem append (np. array (anoma (es__3))
171
# 4. Final Combination and Output
172
if not generated anomalies:
inneraatedanommliess
# Fallback in case n samples was small and all policies got 0
174
return np. empty (00, d))
135
176
final_anomalies - np. vatack (generated_anoomlllee
Shuffle mix ancmalies from different policies np randem. shuffle (fial
179
180
return tinal_ancmalicn :n__smppes___s $ Ensure exact number is returned
6.19 HOw WE ENSURE THE ROBUSTNESS OF LLM-DAS?
LLM-DAS relics the LLM's ability interpret detector's algorithmic description. However, the framework is not brittle and intentionally designed to remain robust even when the LLM's analysis imperfect.
(1) The LLM analyzes a clean, parameter-free, logical description-not raw tabular data. The LLM's task is restricted to summarizing the detector's high-level mechanism and reasoning about its structural weaknesses. These descriptions (e.g.. PCA steps) are symbolic and algorithmic rather than data-dependent, making them significantly easier and more reliable for LLMS understand.
57

---

Published as a conference paper at ICLR 2026
(2) The prompt imposes strict structural and functional constraints. As detailed in Eq.3 of Section 3.2, the LLM is required to produce: (i) a detector-awand awaree synthesis policy, (ii) an executable, data-agnostic program, (iii) explanation of its reasoning. These constraints substantially reduce the risk of superficial reasoning by enforcing explicit, verifiable logic. For example, in Case Study of Section 3.2.2, the L.M's policy for IForest describes two core steps: (i) selecting borderline normal samples using the detector's own score function, and (ii) performing controlled extrapolation that preserves long path lengths. The accompanying explanation clarifies why these operations align with the algorithmic weakness of IForest (i.e., difficulty isolating deep points), making the LLM's intentions transparent and allowing us verify that the generated code faithfully implements this logic. This level of specificity prevents arbitrary code generation.
(3) The final detector does not rely solely on the L.LM-geerratd component. After generating synthetic anomalies, we train an enhancement classifier fi and combine with the original detector ft using normalized score-level ensemble. This fusion (Eq.7 of Section 3.2.2) ensures that even if the LLM's synthesis is occasionally suboptimal, the original detector's behavior remains preserved. preventing degradation.
(4) Extensive empirical evidence demonstrates robustness across detectors, datasets, and LLMs. The results in Table 1 of manuscript indicate that the improvements over the original source detectors across 36 benchmark datasets are statistically significant. The detailed results in Table 4 and Table of Appendix 6.7 also show that the suboptimal results are occasional. In addition, experiments in Table 8 of Appendix 6.9 further verify that LLM-DAS remains effective across different LLMs, including GPT-4o, Gemini-2.5-Pro, and Qwen3.
(5) Boundary refinement after enhancement. Fig. 5(b) of manuscript shows that the synthetic anomalies lie close to the normal manifold and receive scores similar to borderline normal samples under the original detector ft. This confirms that the generated samples match the detector-aware policy and are indeed "hard" for the original detector. Crucially, Fig. 5(c) of manuscript demonstrates that after training with LLM-DAS, the enhanced detector exhibits clear rightward shift of both synthetic and real anomaly score distributions relative to normal data. This tightening of the decision boundary shows that the synthesized anomalies not only challenge the detector but meaningfully reshape the classifier to produce better separation. This direct evidence that the LLM-ggnerated samples are of sufficiently high quality to improve the detector's generalization.
6.20 ON ISOLATING THE CONTRIBUTION OF LLM REASONING
What knowledge is LLM actually contributed? Our claim is not that the L.M invents entirely new mathematics, but that performs a contextual, detector-specific reasoning and synthesis task that goes far beyond retrieving a single, static rule.
The Ablations Test Specific, Necessary Components: Our ablation studies (Generic/Simple/Ran-
dom in Fig. 4(b) are designed to remove specific, instructed capabilities from the LLM:
"Generic": Removes detector- awwreness.... The LLM cannot perform reasoning conditioned the target detector's algorithm.
"Simple": Removes the capability generate hard anomalies by denying access to the score function.
"Random": Removes the borderline heuristic, a key strategic element.
The significant performance drop in each variant confirms that each of these instructed reasoning components is critical. This shows that the LLM is not just executing a single built-in rule but is dynamically combining these elements based on the prompt.
The Cross-Detector Experiment is the Key Evidence (Connecting to Table 2): The most com- pelling evidence against a "universal rule" hypothesis comes from our cross-detector experiment (Table 2).
If the LLM were simply applying a generic, detector-agnostic heuristic (e.g.. "add small noise" or "extrapolate"). then the synthesis policy 5 Spugram for Detector A should work reasonably well when transferred to Detector B.
58

---

Published as a conference paper at ICLR 2026
The results clearly show the opposite: Transferred strategies often perform poorly. This demonstrates that each L.M-generated policy is highly specialized and its effectiveness is contingent on precise match between the synthesis logic and the target detector's 's internal mechanics. This specialization the hallmark of genuine, detector-specific reasoning.
In summary, the ablations prove the necessity of key reasoning components, and the cross-detector experiment proves the specificity of the resulting strategies. Together, they robustly isolate and validate the contribution of the LLM's contextual reasoning capabilities.
59


Reviews:
[{"review_id": "lCYzKBe1yC", "reviewer": "Reviewer_mvV9", "summary": "This paper proposes LLM-DAS, a novel framework to enhance tabular anomaly detectors (TAD). It addresses the \"fragile assumptions\" of existing detectors and the privacy/usability issues of applying LLMs to tables. The core idea is to reposition the LLM from a \"data processor\" to an \"algorithmist\". In a data-agnostic phase, the LLM reasons about a detector's high-level logic to identify weaknesses and generates reusable Python code to synthesize \"hard-to-detect\" anomalies that exploit these flaws. In a data-specific phase, this code is executed on a dataset to augment the normal-only training data . This converts the one-class problem into a more robust two-class classification task. Extensive experiments on 36 benchmarks show significant performance boosts for mainstream detectors.", "questions": "1. For trainable detectors (like DRL or Autoencoders), did you consider using the augmented data to fine-tune the original detector itself, rather than adding an external binary classifier?\n2. The framework seems to generate one primary synthesis policy per detector. What if a detector has multiple, distinct logical weaknesses? Could the LLM be prompted to find several weaknesses, and would a mixture of synthetic anomalies targeting all of them provide even more robustness?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "1. The central idea of using the LLM for abstract algorithmic reasoning and code generation—rather than data processing—is highly innovative. It leverages the LLM's core strengths and opens a new path for applying LLMs to non-linguistic domains.\n2. The data-agnostic code generation phase fundamentally solves the data privacy issue. The resulting code is reusable, making the approach highly scalable: the LLM is queried only once per detector type, not once per dataset.\n3. The framework's effectiveness is validated across 36 datasets and 5 diverse detectors. Crucially, ablation studies (Fig. 4b) and cross-detector experiments (Table 2) confirm that the \"detector-aware\" strategy is the key to success, significantly outperforming generic synthesis methods .", "weaknesses": "1. The framework's success is entirely contingent on the LLM's ability to correctly understand an algorithm's description and identify its true weaknesses . A superficial or incorrect logical analysis by the LLM would lead to a suboptimal synthesis policy.\n\n2. The enhanced classifier is trained to detect anomalies from the LLM's specific synthesis strategy. It is not guaranteed to generalize to all types of \"hard\" anomalies, but may simply learn to spot the artifacts of those specific generated samples.\n\n\n3. The final detector is an ensemble (a sum) of the original detector and a new classifier (e.g., RandomForest). This adds complexity and inference cost rather than directly \"patching\" or retraining the original model itself.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "8IQ8aRLwVw", "reviewer": "Reviewer_v399", "summary": "This paper introduces LLM-DAS, a framework that leverages Large Language Models to enhance tabular anomaly detection methods by generating detector-specific synthetic anomalies. Rather than using LLMs to directly process data, the approach positions LLMs as \"algorithmists\" that analyze detector mechanisms and generate reusable Python code for synthesizing \"hard-to-detect\" anomalies. These synthetic anomalies are used to augment training data, transforming the one-class classification problem into a more discriminative two-class setting. The method is evaluated on 36 benchmark datasets with five different base detectors.", "questions": "Can you provide examples (such as performing a casae study) where the LLM-generated code discovers non-obvious or counterintuitive synthesis strategies that human experts might not have designed?\n\nHow sensitive is the approach to the choice of LLM and prompt engineering - would the method still work with smaller, open-source models?", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1 - The repositioning of LLMs from data processors to algorithm strategists is novel and well-motivated, effectively addressing both privacy concerns and the inherent difficulties LLMs face with heterogeneous tabular data while leveraging their strengths in code generation and algorithmic reasoning.\n\n2 - The framework demonstrates strong empirical results across 36 diverse datasets, showing consistent improvements over base detectors and outperforming recent LLM-based approaches like AnoLLM while being more computationally efficient.\n\n3 - The approach is practical and scalable - the detector-specific synthesis code is generated only once per detector type and can be reused across multiple datasets, making it cost-effective compared to approaches requiring LLM fine-tuning or repeated querying.", "weaknesses": "1 - The paper lacks theoretical analysis or formal guarantees about why the generated \"hard\" anomalies should improve detector performance, relying primarily on empirical validation without providing theoretical bounds or convergence properties of the enhanced detectors.\n\n2 - The synthesis strategies appear relatively simplistic (e.g., extrapolation along vectors for IForest), and it's unclear whether the LLM genuinely discovers novel algorithmic insights or simply implements predetermined heuristics that could have been hand-coded without LLM involvement.\n\n3 - The evaluation is limited to classical anomaly detectors and doesn't explore integration with modern deep learning-based methods, nor does it investigate failure modes where the synthetic anomalies might degrade performance or introduce unintended biases.\n\n4 - The paper doesn't adequately address the potential for adversarial exploitation - if the synthesis code is reusable and potentially accessible, malicious actors could use knowledge of the augmentation strategy to craft anomalies that evade the enhanced detectors.\n\n5 - The ablation studies, while comprehensive in number, don't sufficiently isolate the contribution of LLM reasoning versus simpler rule-based approaches - a comparison with expert-designed synthesis strategies for each detector would better validate the value of LLM involvement.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "oWc7YmWP5f", "reviewer": "Reviewer_N2i1", "summary": "This paper tackles the task of tabular anomaly detection. The authors propose leveraging a large language model to analyze existing detectors and generate code that synthesizes hard-to-detect anomalies. A binary classification model is then trained and integrated with the existing detectors to perform anomaly detection. Extensive experimental results demonstrate the superiority of the proposed method.", "questions": "1.\tHow does the binary classifier perform if it is used alone for anomaly detection?\n2.\tSince the LLM is used to analyze the characteristics of existing anomaly detectors and generate “hard-to-detect” anomalies, it would be interesting to investigate whether the LLM’s analysis could also be leveraged to design detector-specific binary classifiers. This might further enhance the adaptability and effectiveness of the proposed framework.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1.\tThis paper is well written and easy to read.\n2.\tThe proposed method sounds reasonable.\n3.\tThe authors conduct extensive experiments to demonstrate the effectiveness of the proposed method.", "weaknesses": "1.\tThe paper employs an LLM to generate code for synthesizing pseudo-anomalies. However, it is unclear how the authors ensure the validity and reliability of the LLM’s outputs. The paper should include an explanation or verification procedure for this aspect.\n2.\tThe proposed method utilizes the RandomForest as the binary classification model, the authors are expected to conduct experiments to analysis the robustness of the proposed method to various binary classifiers.\n3.\tThe authors generate pseudo-anomalies for only 10% of the training set. It is unclear why this specific ratio was chosen. Moreover, the imbalance between normal and anomalous samples might affect the training of the binary classifier. Would using a balanced dataset improve the classifier’s performance?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "XHOlXxq74J", "reviewer": "Reviewer_JZ9t", "summary": "This paper introduces the use of large language models (LLMs) to augment training datasets, claiming that LLMs can synthesize additional anomalous samples. However, traditional methods for tabular anomaly detection primarily follow the one-class classification paradigm, where detectors are trained solely on normal data. By training detectors on a combination of normal samples and LLM-generated anomalous samples, the authors report significant performance improvements across various datasets and detection methods.", "questions": "> ...This leads to tabular anomaly detection (TAD) usually being studied under a one-class classification paradigm, where the detector is trained solely on normal samples to distinguish anomalies at test time...\n\nI have great concern about this argument. Other well-defined AD methods in the general domain, such as Self-Inf [1] can be easily applied to the tabular dataset. But Self-Inf is apparently not a one-class classification method. Following this concern, I would doubt whether the challenge of 'one-class classification' can well support your motivation for introducing LLMs to augment the training dataset.", "limitations": "", "rating": 2, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1. The figures, pipelines, and writing are easy to understand.\n2. The paper tackles an interesting direction: using LLMs to augment the training dataset of anomaly detection in the tabular dataset, potentially as a way to alleviate the strong assumption posed by the existing detectors.", "weaknesses": "- The paper only considers general anomaly detection. However, there are multiple types of anomalies—such as point anomalies, contextual anomalies, and others—that differ in nature and characteristics. The proposed method does not take this diversity into account.\n\n- Delegating the anomaly generation process to LLMs raises concerns. How can we ensure that the generated samples are indeed anomalous? More importantly, how is an anomaly formally defined in this context? Although the authors provide some visualizations in Figure 5, a more thorough discussion of what constitutes an anomaly point is necessary.\n\n- It remains unclear how to evaluate the hardness of the generated anomaly samples. Can the LLMs generate anomalies with varying degrees of difficulty?\n\n- The potential side effects of these synthetic samples are not discussed. For instance, could they negatively affect the generalizability of the detector, given that LLMs might exhibit biases toward certain types of anomalies and thus overrepresent them?\n\n- Experiments: The ratio of blended synthetic anomaly samples is insufficiently studied. An ablation study examining the optimal proportion of anomaly samples needed to improve robustness would strengthen the empirical analysis.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)