ReTabAD: A Benchmark for Restoring Semantic Context in Tabular Anomaly Detection
Authors: Sanghyu Yoon
Dongmin Kim
Suhee Yoon
Ye Seul Sim
Seungdong Yoa
Hye-Seung Cho
Soonyoung Lee
Hankook Lee
Woohyung Lim
Venue: ICLR 2026 Poster (2026)
Keywords: Tabular Anomaly Detection
Anomaly Detection Benchmark
Large Language Models
Primary area: datasets and benchmarks
TL;DR: We introduce ReTabAD, the first context-aware tabular anomaly detection benchmark, which provides semantically enriched datasets and a zero-shot LLM framework.

Abstract: In tabular anomaly detection (AD), textual semantic context often carries critical signals, as the definition of an anomaly is closely tied to domain-specific context. However, existing benchmarks provide only raw data points without semantic context, overlooking rich textual metadata such as feature descriptions and domain knowledge that experts rely on in practice. This limitation restricts research flexibility and prevents models from fully leveraging domain knowledge for detection. ReTabAD addresses this gap by Restoring textual semantics to enable context-aware Tabular AD research. We provide (1) 20 carefully curated tabular datasets enriched with structured textual metadata, together with implementations of state-of-the-art AD algorithms—including classical, deep learning, and LLM-based approaches—and (2) a zero-shot LLM framework that leverages semantic context without task-specific training, establishing a strong baseline for future research. Furthermore, this work provides insights into the role and utility of textual metadata in AD through experiments and analysis. Results show that semantic context improves detection performance and enhances interpretability by supporting domain-aware reasoning. These findings establish ReTabAD as a benchmark for systematic exploration of context-aware AD.

Published as a conference paper at ICLR 2026
RETABAD: A BENCHMARK FOR RESTORING SEMAN- TIC CONTEXT IN TABULAR ANOMALY DETECTION
Sanghyu Yoon'; Dongmin Kim ;im';Suhee
Yoon', Ye Seul Sim', Seungdong Yoa! Hye-Seung Cho', Soonyoung Lee', Hankook Lee"; Woohyung Lim't
'LG Al Research, Seoul, South Korea "Sungkyunkwan University, Suwon, South Korea (sanghyu. yoon, dmkim, suhee. yoon, ysl. seungdong yoa, hs. cho, soonyoung. ,lee, w. w.limjelg Lelimmelggeeerreeee ai, hankook. leeêskku. edu "Corresponding author
"Equal contribution
ABSTRACT
In tabular anomaly detection (AD), textual semantic context often carries critical signals, as the definition of an anomaly closely tied domain-speciff context. However, existing benchmarks provide only raw data points without semantic context, overlooking rich textual metadata such as feature descriptions and domain knowledge that experts rely on in practice. This limitation restricts research flexi- bility and prevents models from fully leveraging domain knowledge for detection. ReTabAD addresses this gap by Restoring textual semantics to enable context- aware Tabular Anomaly Detection research. We provide (1) 20 carefully curated tabular datasets enriched with structured textual metadata, together with imple- mentations of state-of-the AD algoritins-including classical, deep learning, and LLM-based approaches- and (2) zero-shot LLM framework that leverages semantic context without task-specific training, establishing a strong baseline for future research. Furthermore, this work provides insights into the role and utility of textual metadata in AD through experiments and analysis. Results show that semantic context improves detection performance and enhances interpretability by supporting domain-awand aware reasoning. These findings establish Re'TabAD as a benchmark for systematic exploration context-aware AD, The resource publicly released at https:///oonsangg
thub. Ro/ReTabAD/.
INTRODUCTION
Anomaly detection (AD), the task of identifying patterns that diverge from the distribution of normal data, represents a fundamental challenge across diverse domains such as finance (Al-Hashedi & Magalingam, 2021), cybersecurity (Landauer et al., 2023), manufacturing (Kharitonov et al., 2022), and healthcare (Fernando et al., 2021). In particular, anomaly detection in tabular data, i.e., tabular AD,, is of critical importance, structured datasets- sensor logs, transaction records, and clinical measurements- form the backbone of real-world operational systems. Despite its practical importance, tabular AD remains a challenging problem due the heterogeneous nature of tabular datasets, which often combine numerical, categorical, and even textual attributes with rich semantic meaning.
DAMI Repository (Campos et al., 2016) and ADBench (Han et al., 2022) have made significant contributions tabular AD by establishing standardized benchmarks that enabled fair and rigorous comparisons across AD algorithms. Despite this contribution, these benchmarks were developed under earlier detection paradigms that prioritized only numerical features with conventional machine learning pipelines-fo for instance, converting categorical values into arbitrary integer codes, or discard- ing non-numerical fields (as shown in Figure/ 1). More critically, they excluded textual metadata that practitioners routinely rely in real-world applications, e.g. feature descriptions, domain context, categorical semantics, measurement units, and operational constraints. This omission is particularly problematic because the definition of an anomaly is inherently "context-dependen" (Chandola et al., 2009; Pang et al., (021)-withour understanding feature semantics and domain constraints, models may misclassify benign deviations as anomalies fail to detect subtle but critical abnormalities.

---

Published as a conference paper at ICLR 2026
Table 1: Comparison of ReTabbD with Existing Resources. Prior work can be categorized into benchmarks that mainly provide datasets for evaluation, and libraries that offer algorithm implementations and pipelines. ReTabaD uniquely combines both: raw tabular values, structured metadata, and ready-to-use pipelines for classical, deep learning, and LLM-based AD models.
Coverage (number)
Data Type
Algorithm Type
Information Used
Resource Type
Datasets
Algorithms
Tabular data
Metadata
ML
DL
LLM
Statistic
Sermantic
Benchmark
DAMI Repository (Campos et al,, 2016)
23
12
/
X
x
x
X
ADBench (Han 2022)
57
14
/
Library
PyOD (Zhao al. 2019)
10+
/
/
DeepOID (Xu et al., 2023a)
x
X
x
X
ReTabAD (ours)
Recent advances in Large language models (LLMs) demonstrate improved capabilities for handling textual representations of numerical data, particularly in contextual reasoning (Kojima al., 2022; Fons et al., 2024). These advances suggest new opportunities for leveraging semantic metadata in tabular AD that has been missing from traditional approaches. In particular, such textual metadata can serve as valuable domain crtors-enablee interpret anomalous behavior, and generalize more effectively small-data settings. Early efforts such as A (Tsai et al., 2025) have begun to explore this direction, revealing the potential of LLL--based approaches tabular settings. However, their application remains constrained to utilizing only column names, due to the lack of richer textual annotations in existing benchmarks. This disconnect underscores the need for a new benchmark that restores semantic context, allowing researchers to meaningfully evaluate and advance context-aware tabular AD.
models to form more plausible decision boundaries, better
Motivated by these considerations, we introduce ReTabAD, the first context-aware tabular AD bench- mark that incorporates rich textual metadata into AD, enabling models to ground their predictions in semantic context rather than purely numerical patterns. As highlighted in Table I, our benchmark prioritizes quality by curating 20 tabular datasets with rich textual metadata and carefully validated anomaly definitions. This design stands in contrast to ADBench (Han et al., 2022), which achieves broader coverage by simply transforming CV/NLP datasets into tabular format-an an approach that increases dataset quantity but lacks the semantic context necessary for context-aware AD. Alongside these curated datasets, ReTabAD enables comprehensive evaluation across 20 algorithms, ranging from classical and deep learning methods to the latest LLM-based approach. Furthermore, we also propose zero-shor shot LLM baseline that leverages the provided metadata without any task-specific training to establish a fair starting point for context-aware AD. Empirically, incorporating textual metadata improves zero-shot L.MM performance by an average of +7.6% AUROC across multiple models (see Table 4). As result, our zero-shot LLM approach achieves performance comparable to state-of-thc-an training-bass bassd methods, despite never being trained on task task-specific data. Together, these contributions position ReTabbD unified and loookig benchmark that enables systematic study of tabular AD both traditional and context-aware paradigms.
To sum up, contributions summarized as follows:
The first context-aware tabular AD benchmark: We present ReTabAD, which provides 20 carefully curated tabular datasets enriched with textual metadata and faithful anomaly definitions, and enables standardized evaluation across 20 unsupervised algorithms, including classical, deep learning, and L-LM-baed approaches.
Zero-shot tabular AD framework leveraging textual metadata: We introduce and evaluate a zero-shot LLM framework that establishes not only a strong and competitive baseline but also a new evaluation paradigm for context-awar tabular AD. By leveraging semantic context without task sask-specific training. ReTabAD provides a standardized reference point for future research.
Insights into context-aware tabular AD: We systematically analyze how incorporating textual metadata affects not only model performance but also reasoning quality. Specifically, we evaluate alignment between predicted key features and supervised attributions, and qualitatively examine model- -enerrtee reasoning texts, providing insights into how context enhances interpretability and anomaly attribution.
2

---

Published as a conference paper at ICLR 2026
1) Semanfically-rich Tabular Data
Anoraay defintion
Hostlate
teatrpa
Femaac
hore
Maie
Whitbite
ReTabAD
0.51
Fertal
Arpinn
EEiitinng Tabular Benchmarkk
<ReTabAD Bendmmars
2) Structured Text Metodata
Original
Source
Scurce: (Dataset sturte)
Datavet: [Bacaset name]
Manual verifeation
(Datlaset dentription)
Columns
keaan rana) Sakore pood Ks reven Doee docrpoar
Detaset
Bomatn knowledge
Decaset deserition
[Colume names]
Label cleaz grians
Collmmn desrription))
[aabll description)
Figure 1: Overall Data Collection and Annotation Process of ReTabAD. We preserve semantically rich tabular values and augment them with structured textual metadata, enabling rigorous evaluation of context-aware AD.
Overall, work emphasizes the importance of semantic information (e.g., textual metadata) in AD for tabular data. We hope that this perspective, together with our new benchmark, will guide future research toward developing context-aware approaches.
2 LIMITATIONS ON PREVIOUS TABULAR AD BENCHMARKS
Benchmarking efforts in tabular AD have primarily aimed to provide reproducible and systematic comparisons of algorithms across diverse datasets. The comparative studies (Goldstein & Uchida, 2016; Campos et al., 2016; Ruff et al., 2021) established the first generation of evaluation resources, offering systematic comparisons of broad range of algorithms real-world datasets. In particular, the DAMI Repository (Campos et al., 2016) introduced semantically meaningful tabular datasets with well-defined anomaly classes, demonstrating the importance of defining anomalies in way that reflects meaningful deviations. With the rise of deep learning, ADBench (Han et al., 2022) further advanced the field by integrating both classical and deep anomaly detection algorithms, collecting datasets from multiple domains, and analyzing them from diverse perspectives. Together with open-source libraries such as PyOD (Zhao et al., 2019) and DeepOD (Xu et al., 2023a), these resources have substantially advanced the field by enabling standardized protocols and large-scale experimental studies.
Despite these contributions, existing benchmarks lack textual metadata that makes semantic context explicit. Although anomaly classes are often well defined, the datasets are typically provided only in numerical form, and the conversion processes sunsssessuuchha one-hot encoding, text embedding, dimensionality reduction- inciintbbyyyybbyyy discard important semantic information. Some benchmarks also incorporate datasets from non-tabular modalities like images and speech, where feature-level semantics cannot be clearly specified. As a result, most prior research has been confined to improving performance within these numeric-only settings, focusing on better modeling given datasets rather than leveraging the rich textual information that practitioners use in real-world anomaly detection.
RETABAD: TABULAR AD BENCHMARK RESTORING SEMANTIC CONTEXT
To overcome these limitations described in Section 2, introduce ReTabAD, next- next-generation benchmark that focuses exclusively on genuinely tabular datasets while systematically integrating rich semantic information. This design enables the systematic evaluation of context-aware AD.
3

---

Published as a conference paper at ICLR 2026
Table 2: Text Metadata Structure. Example from the Cardiotocography (Campos Bernardes, 2000) dataset in ReTaabA.
Cardiolocugraphy
Source: hetps: /aacc/vve. iiss uci saci..edur wet.//aattttteeee. dastttt////////////// 1/193/
Description: Measurements from fetal beart rate (FHR) and uterine contractions (UC) from 2126
cardiotncograns.
Columa
Type
Logical Type
Description
LB
int numerical
FHR baveline (bpm) Accelerations second
AC
Aoat numerical numetical
UC
float
Uterine contractions per sccond
ASTV
numerical
% abnornal short term variabilay
Tendency
string
categorical
Histogam tendency (Leeftskkeedd, Symmetric)
Lubel: Binary label (0: Normal, I: Suxpeci/Pabollggi)
3.1 DATASETS
Data Collection and Annotation. ReTabAD covers 20 tabular datasets drawn from widely used repositories and real-world application domains. Building upon the comprehensive coverage of ADBench (Han et al., 2022), we curate a subset of datasets and enrich them with textual metadata according to the following criteria: (1) datasets must have clearly defined domain and ground-truth anomaly labels, (2) dataset size should be manageable for diverse models while reflecting real- world class imbalance, (3) sufficient documentation should exist to recover reliable semantic descriptions, and (4) datasets that are too easy, where performance is already saturated, should be discarded. In addition, we incorporate ratios, and then annotating anomalies accordingly to construct well-posed AD tasks. A complete list of the datasets and their description is summarized in Table 7 in the Appendix A and an overview of the data collection and annotation process is illustrated in Figure 1.
datasets by inspecting their class label definitions and class- wise sample
Semantically-rich Tabular Data. To incorporate rich semantic information into tabular data, consider the following two principles:
Raw Numerical Preservation: ReTabAD preserves numerical features in their original scales rather than applying unspecified normalization or standardization. Maintaining raw values retains domain- meaningful interpretations that support intuitive reasoning about anomalies. For instance, a resting heart rate of 200 bpm in an adult is directly recognizable as a critical medical anomaly, whereas its normalized counterpart only conveys statistical rarity without clinical significance.
Categorical Text Restoration: Existing benchmarks often provide categorical features in inconsis- tent formats (e.g., integer-encoded, -mxeedddddng or apply inappropriate normalization that discards semantic meaning. Contrary to this practice. ReTabAD restores categorical attributes to their original textual values instead of applying such transformations. This restoration enables models, particularly lanuuage-based approaches, to reason over iumaa-interpretable categories rather than arbitrary numerical surrogates.
We provide each dataset supplemented with a file, containing structured semantic descriptions omitted in previous benchmarks. To ensure reliability, we provide direct links to the original data sources, enabling researchers to verify our interpretations. The metadata is organized into three categories:
Structured Text Metadata.
metadata
Dataset-Level Deseriptions: High-level descriptors, including dataset name, purpose, origin, and collection methodology. Each entry includes links to original publications or repositories to enhance credibility.
Column-Level Descriptions: For each column, ReTabAD provides its name, human- description, logical type (e.g., numerical, categorical, ordinal, binary), measurement units, if available. All descriptions are cross-referenced with the original dataset documentation.
Label-Level Descriptions: For each dataset, ReTabAD clearly specifies which classes consid- ered normal and which are treated as anomalies. These anomaly definitions are derived directly from the original dataset documentation, with full source attribution.
4

---

Published as a conference paper at ICLR 2026
Normal stotiatic,
Nornal Range 5i peoreendee 118 146 AC Nornal Range (5 percontley. 0.000,00000000 0.000 3.012
ReTobAD
Domain knowledge, Camatt
tabel moust Niemol meass Supecty Huthologic
f FX0M
Fed ture descriptin tion, Creature
Domaia knowledge
busdins
Number
Prompt structure
Output example
Role, Syale
Record ID: 0
Domain knowledge, Camasin
Anomaly acore: 0.5
Key Features DP,. FMM Vartance]
Feature description, Jeuture
Large Language
Reasoring: This merord presente Fygly pathologinai
Normal statistic, Contierie
Model
of prolanged Indicatoo compromion Forther, extreme volues for fotal movements (FM- 394, Blely ortifoct or sever rvent). extremety ligh hätagrom varfonce (Vartance- 136j, low Mattgram
decekrotion (DP-3)
Analysis guideline, guideenee
(Mean- 194), (Min=51) collccivall point severe fical distress and instabiity. accolerations further supports this assesmentt
Analyze the following data bosed on the guidelines:
obaence
Record d:
18 LB-135,AC AC: FM: UC- Tendemcy--tght-
Figure 2: Zero-shot LLM Baseline Overview. We design prompts to evaluate the role of semantic metadata by incorporating domain knowledge (Cdomasn), feature descriptions (Creature). ). and normal statistics (Cstatistic). The LLM generates outputs including anomaly scores, key features, and anomaly reasoning.
3.2 ALGORITHMS
To provide comprehensive comparison, evaluate 20 representative unsupervised AD models, with full algorithmic details provided Appendix B. These models are grouped into three categories: (1) Classical methods: We include diverse range of foundational algorithms that remain widely used. These encompass distance-based (e.g., KNN (Ramaswamy et al., 2000)), density-based (e.g., LOF (Breunig al., 2000)), boundary-based (e.g., OCSVM (Schölkopf et al., 1999)), and ensemble techniques (e.g., Isolation Forest (Liu et al., 2008)). (2) Deep learning methods: We consider representative deep models designed to capture complex, non-linear representations of normality beyond classical heuristics. These include methods based on deep one-class classification (e.g., DeepSVDD (Ruff et al., 2018)), reconstruction (e.g., RCA (Liu et al., 2021), MCM (Yin al., 2024)), and contrastive learning (e.g., GOAD (Bergman & Hoshen, 2020), NeuTral. (Qiu et al., 2021)). (3) LLM-based methods: We include AnoLLM (Tsai et al., 2025), which leverages semantic information but is constrained to using only column names as context. To further leverage rich and structured metadata, we propose a new zero-shot LLM framework that directly utilizes context data as input for AD. This investigation illustrates the potential of applying LLMs to AD tasks when comprehensive semantic cues are available. Implementation details are provided in Section 3.3.
3.3 ZERO-SHOT LLM FRAMEWORK FOR CONTEXT-AWARE AD
Motivation. Despite the importance of textual metadata in real-worke tabular datasets, there has been no systematic attempt to leverage such information. Conventional training- based AD models are designed to process data as numerical or categorical vectors, making structurally difficult to directly integrate textual descriptions that contain the semantic information of features. Although there have been attempts to utilize textual metadata, most have remained limited instance, relying only on column names without capturing the broader context. As consequence, such approaches fail to leverage critical signals for AD conveyed by metadata, including inter-feature relationships and domain-specific contextual cues. To address this limitation, propose zero-shot LLM basedd AD framework that explores the potential of semantic context through context-aware reasoning over tabular data. By enabling the L.M to interpret feature semantics and relationships in natural language,
5

---

Published as a conference paper at ICLR 2026
framework shifts the focus from purely statistical patterns to high-level contextual understanding and points toward a new paradigm for context-awand AD.
Our Design. To utilize LLMs for tabular AD, we propose zero-shot LLM framework strong baseline for context-aware AD, as illustrated in Figure We employ a carefully designed prompt that integrates domain knowledge and structured reasoning guidelines. The prompt for each data instance F; consists of three key components: a System Prompt (S), a Data Input Formatter (T (T(x:), ), and a Structured Output Query (2).
1. System Prompt (S): The system prompt provides the necessary context for the task. It is con- structed by concatenating the following information templates are in the Appendix D.3):
Role and Task Definition (Soot): Assigns the LLM an expert persona for each dataset's domain (e.g., "You are a domain expert finance").
Semantic Context (C): Supplies essential metadata M about the dataset, including:
Domain Knowledge (Cdomain): A brief background of dataset and label information.
Feature Description (Cteature): Descriptions, units, and meanings of each feature.
Normal Statistic (Cstatistie): Normal ranges or distributional context derived from the training normal data.
Analysis Guidelines (Sguideline): Provides general principles for identifying anomalies based
on the given context.
2. Data Input Formatter (T(x;)): Each data instance æ; is serialized into human-readable text format to serve as input. For example, a record formatted as: 1atarre__aaeee_a_alllee
"Record i:
[Feature_name. 2atmee__valle_____
This use of feature names, rather than generic indices, provides essential semantic context. For efficiency, multiple instances are processed in a single batch.
3. Structured Output Query (Q): To ensure consistent and automatically parsable responses, the final part of the prompt queries the LLM to return its analysis structured JSON format. The required format is:
{ "anomaly
score": sasomaal_score:: s, "key_features": F, "reasoning": e
where s is the anomaly score in [0, 1], is a list of key features, and e is the explanation in text.
3.4 EVALUATION
Problem Setup. Conventional tabular anomaly detectors evaluate each data instance X {z1,... }. where K using anomaly scoring function fa) that determines whether the instance is normal or anomalous. ReTabAD extends this traditional setup by incorporating semantic metadata M, which encompasses domain knowledge, feature descriptions, and contextual informa- tion about normal behavior patterns. Concretely, this work considers a metadata-aware anomaly scoring function fxx capturing how well sample aligns with the metadata-informer notion of normality. This work analyzes how such a semantic context M influences anomaly detection performance.
Hyperparameter Optimization. We follow the default model architectures and tune key hyperpa- rameters, including preprocessing settings. Hyperparameters for training-based methods are faithfully searched, and detailed configurations are provided in the Appendix C for reproducibility.
Evaluator LLMs. We evaluate of leading LLMs in zero-shot AD setting to assess their general semantic reasoning capabilities. Specifically, we include state-of-the-an reasoning-oriented oriented models GPT-4.1 (Fachada al., 2025), 1laud-3.7-soonee (Anthropic, 2024a), Qwen3-235B (Yang et al. 2025), and 2e5-pni-2.5-pro (Comanici et al., 2025) well lightweight yet competitive model, GPT-4o-mini (OpenAI, 2024). For consistency and clarity, we report detailed ablation and qualitative analyses with Gemini-2.5-pro.
Evaluation Protocol. ReTabAD follows the one-class classification setting, where the training set consists of 50% of the normal samples, while the test set consists of the remaining normal samples and all anomalous samples, as in previous studies (Bergman & Hoshen, 2020; Livernoche et al., 2024). For performance evaluation, we primarily report the Area Under the Receiver Operating Characteristic Curve (AUROC), a standard metric in AD (Ruff et al., 2018). To mitigate randomness, each experiment is five times with different seeds, and Full results with the Area Under the

---

Published as a conference paper at ICLR 2026
Table 3: AUROC Performance on the ReTabAD. This table compares training-based methods and our zero-shot LLM (Gemini-2.5-pp) Full Desc corresponds to the original prompt setting (Type D), and No Dese reports results without metadata descriptions (Type A).
Training-based Methods
Zero-shot LLM
Dataset
FForest
OCSVM
LOF
DxpSVVD
NeuTral
SLAD
DIF
MCM
DRL
AnoLLM
No Dexc
Full Desc
automobile
0.648
0.645
0.688
0.845
0,810
0.780
0.647
0.801
0.762
0.625
0.806
0.767
backdoor
0.888
0.876
0.702
0,800
0.948
0.935
0.973
0.961
0.902
0.885
0.801
0.827
campaign
0.732
0.700
0.760
0.717
0.761
0.738
cardiotooography
0.830
0.868
0.826
0.813
0.791
0.764
0.740
0.843
0.847
0.735
0.643
0.829
census
0.620
0.647
0.596
0.712
0.686
0.687
0.726
0.729
0.728
0.757
0.662
0.895
0.506
0.651
0.571
0.580
cirthoais
0.849
0.823
0.843
0.807
0.831
0.810
0.820
0.830
0.814
0.850
0.694
0.850
covertype
0.968
0.998
0,980
0.971
0.958
0.999
0.998
0.998
0.995
0.99K
0.861
0.961
credit
0.629
0.717
0.590
0.638
0.690
0.689
0.671
0.680
0.495
0.501
0.681
equip
0.980
0.987
0.987
0.984
0.985
0.981
0.987
0.986
0.986
0.975
gallsion:
0.650
0.671
0.704
0.731
0,780
0.758
0.649
0.757
0.745
0.574
0.615
0.667
glass
0.944
0.959
0.974
0.963
0.968
0.952
0.936
0.966
0,949
0.907
0.832
0.919
glioma
0.722
0.725
0.784
0.886
0.790
quasar
0.915
0.930
0.966
0.804
0.954
0.952
0.793
0.950
0.897
0.957
0.816
0.961
sessmic
0.710
0.710
0.615
0.729
0.716
0.727
0.736
0.716
0.714
0.746
0.646
0.741
stroke
0.679
0.716
0.703
0.753
vertebral
0.500
0.638
0.540
0.581
0.697
0.679
0.340
0.61.5
0.477
0.597
0.461
0.755
wic
0.961
0.969
0.960
0.969
0.785
0.938
0.679
0.957
0.954
0.871
0.861
0.968
0.987
0.957
0.974
0.974
0.988
0.980
0.760
0.979
0.958
0.933
0.663
0.991
yeast
0,838
0.875
0.803
0.820
0.841
0.846
0.815
0.856
0.841
0.809
0.731
0.861
Averuge Rank
7,50
5.35
7.70
6.40
4,30
5,50
7.85
3,95
6.30
7.35
10.80
4.10
Averuge AUROC
0.778
0.803
0.761
0.796
0
0.817
0.742
0.825
0.801
0.769
0.691
0.847
Rreail Curve (AUPRC) (Saito & Rehmsmeier, 2015) and standard deviations are in the
Appendix E, F.
4
EXPERIMENTS ON RETABAD BENCHMARK
This section explores the potential of context-aware approaches in tabular AD. Specifically, we design our experiments to investigate the following research questions:
Does semantic context M improve AD performance? ($4.1)
Which types semantic information contribute most to detection performance? (54.2)
Can LLMs leverage domain-specifie knowledge to identify specialized anomaly patterns? ($4.3)
4.1 CONTEXT-AWARE AD PERFORMANCE
Table 3 presents a detailed comparison across 20 datasets. We report representative AD methods in the main table; the complete per-dataset results for all evaluated models are provided in Appendix F. Despite requiring no training, our zero-shot LLM framework with textual metadata achieves an average rank of 4.08, approaching the state-of-the-art training-based method MCM (Yin et al., 2024), demonstrating that semantic context can serve as a strong signal for AD. Notably, the benefit of semantic context is especially pronounced in datasets such as glioma, where 20 out of 21 features categorical and primarily expressed as binary (yes/no) attributes. In such settings, raw tabular values (e.g., ATRX=1, IDH1=0) carry little meaning without domain-specifer descriptions. By leveraging column- level metadata (e.g., "ATRX mutation present"), , the L.M can better interpret the clinical implications of these attributes, leading substantial performance gain. This highlights how semantic context is crucial when features are categorical or domain-specific, providing not only improved detection accuracy but also guidance for developing future AD models that are semantically grounded.
We quantify the overall effect of incorporating textual metadata on zero-shot LLMs. As sum- marized in Table 4, enriching the tabular in- put with semantic context consistently yields substantial gains across all evaluator models, where No Desc. refers to the setting that pro- vides only normal statistics without metadata and Full Desc. includes all available textual information. On average, we observe a +7.6 per- centage point improvement in AUROC over the No Desc. baseline, indicating that models are
Table 4: Effect of Textual Metadata on Zero- shot LLMs. We report average AUROC across 20 datasets of ReTabAD.
Evaluator LLM
No Desc.
Full Desc.
GPT-4o-mini
0.692
0.726
GPT-4.1
0.696
0.735
Saude-3.7-sonne
0.725
0.777
Qwen3-235B
0.665
0.747
Gemini-2.5-pro
0.691
0.847
7

---

Published as a conference paper at ICLR 2026
Table Win Rate Comparison across Different Context Types on the ReTabAD. Win rates are computed based on AUROC performance, where each type represents different combinations of contextual information: Domain knowledge, Feature description, and Normal statistics.
Context Information
Win Rate
Type
Cetatiates
Cpentirn
Coomain
GPT-4o-mini
GPT-4.1
Claude-3.7-Sonne
Qwen3-235B
Gemini-2.5-pa
A (No Desc.)
X
0.15
0.20
0.00
0,05
0.05
B
x
0.05
0.15
0.20
0.20
0.00
/
0.25
0.30
0.10
0.10
0.15
D (Full Desc.)
/
0.55
0.35
0.70
0.65
0.80
better able to ground their predictions when provided with feature descriptions and dataset semantics. Interestingly, the performance gap is even more pronounced for reasoning-oricsn -orientoreeeddd LLMs such as Qwen3-235B and Gemini-2.5-pro, which show the largest relative gains among all models. This suggests that these models are particularly capable leveraging structured textual cues to form more contextually grounded anomaly judgments, whereas lighter models still benefit but to lesser extent.
4.2 ABLATION STUDY ON CONTEXTUAL INFORMATION
To evaluate the relative contribution of different information sources, we design an ablation study with four prompt variants (Type A A-D) in our Re TabAD benchmark as follows:
Type A (No Desc.): Normal statistic only (anonymized column names e.g., AA, AA, AB.
Type B: Normal statistic + Feature description
Type C: Feature description Domain knowledge
Type D (Full Desc.): Normal statistic + Feature description Domain knowledge
The ablation results (Table 5) clearly demonstrate that combining all three sources of semantic information yields the highest win rate across all LLMss. Column descriptions generally improve performance when added to normal statistics (Type A - B) (see Table 11 in the Appendix E), while domain descriptions alone (Type C) produce mixed results highlightin the necessity numerical context for stable reasoning. Type D exhibits strong synergistic effects, indicating that LLMs benefit from both statistical grounding and dovain-level priors to accurately detect anomalies. Overall, these findings show that without domain knowledge, the inclusion of feature descriptions already leads to clear performance gains, and that semantic information (both domain and feature) becomes substantially more powerful when coupled with statistical context.
4.3 FEATURE ATTRIBUTION AND REASONING ANALYSIS
Key Feature Alignment with Supervised Attributions. We design quantitative evaluation to measure whether L.LMs iden- tify features that truly drive anomaly clas- sification, focusing exclusively on anoma- lous instances. Normal instances are not evaluated individually, as they are primar- ily used establish the decision boundary and represent expected behavior. Hence, our metric specifically measures whether the model's reasoning highlights features that explain why sample is anomalous. Specifically, train an XGBoost (Chen & Guestrin, 2016) on ground-trutt labels and compute SHAP (Lundberg & Lee, 2017) values for each
Table 6: Impact of Textual Metadata on Reasoning Alignment. We report F1-Score@K K (K 1,3) on anomalous instances for Type A (No Desc.) and Type D (Full Desc.) using Gemini-2.5-Pro.
FI @
FI@3
Dataset
Type A
Type
Type A
Type D
campaign
0.086
0.344
0.159
0.466
churn
0.133
0.288
0.160
0.400
glioma 0.009
0.551
0.044
0.589
instance. For given anomalous instance æ;; we define the reference set r(( the top-K features ranked by absolute SHAP values, and compare with the LLM's predicted top- features {((K) using F1 @ K, which serves proxy metric for domain-informe reasoning. Table 6 illustrates representative datasets where textual metadata provides clear benefits, while full results across all 20 datasets reported in the Appendix E. These examples show that semantic context can help L.LMs
8

---

Published as a conference paper at ICLR 2026
recover the features that drive anomalous behavior. This improvement is especially pronounced in glioma and campaign, where key biomarkers (IDH1, TP53) and key determinants of campaign success (poutcomme (outcome of the previous campaign), duration (length of the last contact) consistently recovered, yielding large Fl gains. These results demonstrate that textual metadata alone enables LLMs account for much of the explanatory signal behind anomalies, allowing them to identify the key features that drive abnormal behavior without any task-specific training.
Qualitative Analysis of Reasoning Text. To quantita- tively explore reasoning quality, we measure detection AUROC improvement when reasoning texts of detected anomalies are provided as contextual examples in the prompt, prioritizing samples with higher anomaly scores. As shown in Figure 3, we observe that performance ini- tially fluctuates with very few examples, improves steadily up to five examples, and then saturates, confirming that our evaluation captures meaningful variations in reason- ing quality. This suggests that the quality of reasoning can meaningfully affect detection outcomes. Importantly, pronounced when comparing against
cirrhosis
AAROO
* ressoning example
Figure 3: Quantitative Evaluation of LLM Reasoning via Performance Gain. Results are reported on the cirrhosis dataset using Gemini-2.5- Pro.
the effect is Type A explanations: higher-quality reasoning (Type D) offers richer, domain-relevant insights and leads to greater performance gains.
To illustrate further, Figure 4 presents an example from the cirrhosis dataset. Type explanation merely states numeric deviation, offering little insight into why the sample is anomalous. In contrast, Type explanation highlights "The elevated Prothrombin time (11.50) indicates compromised liver synthetic function". Importantly, the notion of liver synthetic function is not provided in the metadata itself; rather, it emerges as an intermediate diagnostic step derived from the model's ' prior knowledge. This shows that, when enriched with textual metadata, the I.IM not only grounds its reasoning in the observed feature but also extends beyond the given descriptions to provide domain meaningful interpretation. This contrast demonstrates how textual metadata can elevate shallow observations into domain-aware explanations that incorporate both provided context and external knowledge.
Cirrhosis.json
Type (w/Cmmatinn)
Metadata:
[Anomalyy
Anomaly score:
"dataset name"
Reasoning: above sange.
"description": "The dataset includes clinical al features for predicting survival
states of patients with circhusss..
Type (we Grencer Cauvare)
"numee: "Prulkrumbn""
"dyyee: 'Roat',
label: (Anommlly)
Ingical rype": "numerrccal",
Anomaly score:
"description:: "Pothhommin time in secunds"
Reasoning: elevated Prothrombin time (11 (11.50) ley anomaly, indicating comprumised liver synthetic fincctio While other markers are currently stable, impaired uogullationis direct meusure liver and significant predictor mortaltty warranting an dasssfication.
description": this dataset the normal/abnormal chw.srrccoiaccccsiciciiiinttttt based on survvval status"
Figure 4: Reasoning Text Examples the cirrhosis dataset. Left: JSON example. Right: Comparison of Type A (numeric deviation only) and Type D (domain grounded), generated using Gemini-2.5-Pro.
5 CONCLUSION
We present ReTabAD, benchmark that restores textual semantics for context-aware tabular AD. By pairing raw tabular data with textual metadata, ReTabAD enables models not only to detect anomalies but to reason about why they occur. Our results show that semantie context improves performance and interpretability, allowing zero-shot LLMs to approach state-of-the- training- based detectors. Beyond benchmarking, ReTabAD serve foundation for diverse applications

---

Published as a conference paper at ICLR 2026
including semantic-guider data augmentation and hybrid approaches that combine statistical and semantic cues. We hope this resource accelerates research toward context-aware, interpretable anomaly detection that robust and deployable in real-world systems.
ETHICS STATEMENT
This work utilizes several publicly available healthcare datasets (e.g., Cardiotocography, Cirrhosis, Glioma) that contain sensitive clinical information. We emphasize that all experiments are conducted strictly for research purposes and do not involve direct patient interaction. While our benchmark and methods are designed to advance anomaly detection research, false alarms in healthcare applications may lead to unnecessary interventions, patient anxicty, resource misallocation. Therefore, the models and results reported here should not be interpreted as ready for clinical deployment. Any practical adoption in healthcare settings must be accompanied by rigorous validation, ethical review, and close collaboration with medical professionals.
REFERENCES
Khaled Gubran Al-Hashedi and Pritheega Magalingam. Financial fraud detection applying data mining techniques: A comprehensive review from 2009 2019. Computer Science Review, 40: 100402, 2021.
Anthropic. Claude 3.7 sonnet. 2024a. Accessed: 2024-08-13.
https//www.anttrrpi...cco/meees s-n-sonet,,, August
Liron Bergman and Yedid Hoshen. cussification-basee anomaly detection for general data. In International Conference on Learning Representations, 2020.
Markus M Breunig, Hans-Peter Kriegel, Raymond Ng, and Jörg Sander. Lof: identifying density- based local outliers. In Proceedings of the 2000 ACM SIGMOD international conference Management of data, pp. 93-104, 2000.
D. Campos and J. Bernardes. Cardiotocography. UCI Machine Learning Repository, 2000. DOI: https///cc..og/10244332/5111111
Guilherme O Campos, Arthur Zimek, Jörg Sander, Ricardo JGB Campello, Barbora Micenková, Erich Schubert, Ira Assent, and Michael E Houle. On the evaluation of unsupervised outlier detection: measures, datasets, and an empirical study. Data mining and knowledge discovery. 30 (4):891-927, 2016.
Varun Chandola, Arindam Banerjee, and Vipin Kumar. Anomaly detection: A survey, ACM computing surveys (CSUR), 41 2009.
Tianqi Chen and Carlos Guestrin. Xgboost: A scalable tree boosting system. In Proceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining, pp. 785-794, 2016.
Gheorghe Comanici, Eric Bieber, Mike Schaekermann, Ice Pasupat, Noveen Sachdeva, Inderjit Dhillon, Marcel Blistein, Ori Ram, Dan Zhang, Evan Rosen, et al. Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilitics. arXiv preprint arXiv:2507.06260 2025.
Nuno Fachada, Daniel Fernandes, Carlos M Fernandes, Bruno D Ferreira-Saraiva and João P Matos- Carvalho. Gpt-4.1 sets the standard automated experiment design using novel python libraries. Future Internet, 17(9):412, 2025.
Tharindu Fernando, Harshala Gammulle, Simon Denman, Sridha Sridharan. and Clinton Fookes. Deep learning for medical anomaly detection-a survey. ACM Computing Surveys (CSUR), 54(7): 1-37, 2021.
10

---

Published as a conference paper at ICLR 2026
Elizabeth Fons, Rachneet Kaur, Soham Palande, Zhen Zeng, Tucker Balch, Manuela Veloso, and Svitlana Vyetrenko. Evaluating large language models on time series feature understanding: A comprehensive taxonomy and benchmark. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp- 21598-216344 2024.
Markus Goldstein and Seiihhi Uchida. comparative evaluation of unsupervised anomaly detection algorithms for multivariate data. PloS one, 11((4: 2016.
Songqiao Han, Xiyang Hu, Hailiang Huang, Minqi Jiang, and Yue Zhao. Adbench: Anomaly detection benchmark. Advances in neural information processing systems, 35:32142-32152 2022.
Stefan Hegselmann, Alejandro Buendia, Hunter Lang, Monica Agrawal, Xiaoyi Jiang, and David Sontag. Tabllm: Few-shot classification of tabular data with large language models. In International conference on artificial intelligence and statistics, pp. 3541-5581. PMLR, 2023.
Andrey Kharitonov, Abdulrahman Nahhas, Matthias Pohl, and Klaus Turowski. Comparative analysis of machine learning models for anomaly detection in manufacturing, Procedia Computer Science, 200: 1288-199- 2022.
Takeshi Kojima, Shixiang Shane Gu, Machel Reid, Yutaka Matsuo, and Yusuke Iwasawa. Large language models are zero-shot reasoners. Advances in neural information processing systems, 35: 2022.
Max Landauer, Sebastian Onder, Florian Skopik, and Markus Wurzenberger. Deep learning for anomaly detection in log data: A survey. Machine Learning with Applications, 12: 12:100470, 2023,
Boyang Liu, Ding Wang, Kaixiang Lin, Pang-Ning Tan, and Jiayu Zhou Rea: A deep collaborative autoencoder approach for anomaly detection. In IJCAI: proceedings of the conference, volume 2021, pp. 1505, 2021.
Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. Isolation forest. In 2008 eighth ieee international conference on data mining, pp.
IEEE, 2008
Victor Livernoche, Vineet Jain, Yashar Hezaveh, and Siamak Ravanbakhsh. On diffusson modeling for anomaly detection. In The Twelfth International Conference on Learning Representations. 2024.
Scott M. Lundberg and Su-In Lee. A unified approach to interpreting model predictions. In Proc. the Advances in Neural Information Processing Systems (NeurIPS), 2017.
Matthew McDermott, Haoran Zhang, Lasse Hansen, Giovanni Angelotti, and Jack Gallifant. closer look at auroc and aupre under class imbalance. Advances in Neural Information Processing Systems, 37:44102-44163, 2024.
OpenAL. Gpt-4o mini: Advancing cost-efficient intelligence. https://openai. com/ index/ cost- cost-effficeent intelligencee 2024. Accessed: 2024-08-11 13.
Guansong Pang, Longbing Cao, Ling Chen, and Huan Liu. Learning representations of ultrahigh- dimensional data for random distance-based outlier detection. In Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining, pp. 2041-2050, 201 8.
Guansong Pang, Chunhua Shen, Longbing Cao, and Anton Van Den Hengel. Deep learning for anomaly detection: review. ACM computing surveys (CSUR), 54(2):1-38, 2021.
Chen Qiu, Timo Pfrommer, Marius Kloft, Stephan Mandt, and Maja Rudolph. Neural transformation learning for deep anomaly detection beyond images. In International conference on machine learning, pp. 8703-8714. PMLR, 2021.
Sridhar Ramaswamy, Rajeev Rastogi, and Kyuseok Shim. Efficient algorithms for mining outliers from large data sets. In Proceedings of the 2000 ACM SIGMOD international conference on Management of data, pp. 427-438 2000.
Lukas Ruff, Robert Vandermeulen, Nico Goernitz, Lucas Deecke, Shoaib Ahmed Siddiqui, Alexander Binder, Emmanuel Müller, and Marius Kloft. Deep one-class classification. In International conference on machine learning, pp. 4393 4402. PMLR, 2018.
11

---

Published as a conference paper at ICLR 2026
Lukas Ruff, Jacob R Kauffmann, Robert A Vandermeulen, Grégoire Montavon, Wojeiech Samek, Marius Kloft, Thomas G Dietterich, and Glaus-Robert Müller. A unifying review of deep and shallow anomaly detection. Proceedings of the IEEE, 109(5):756-795. 2021.
Takaya Saito and Mare Rehmsmeier. The precision-recall plot is more informative than the plot when evaluating binary classifiers on imbalanced datasets. PloS one, 10(3) (18))2011833, 2015.
Bernhard Schölkopf, Robert C Williamson, Alex Smola, John Shawe- Taylor, and John Platt. Support vector method for novelty detection. Advances in neural information processing systems, 12, 1999.
Bernhard Schölkopf, John C Platt, John Shawe-Taylor, Alex J Smola, and Robert C Williamssn. Estimating the support of high-dimensional distribution. Neural computation, 13(7):1443-1471, 2001.
Tom Shenkar and Lior Wolf. Anomaly detection for tabular data with internal contrastive learning. In International conference on learning representations, 2022.
Mei-Ling Shyu, Shu-Ching Chen, Kanoksri Sarinnapakorn, and LiWu Chang. A novel anomaly detection scheme based on principal component classifier. Technical report, University of Miami, Department of Electrical and Computer Engineering, 2003.
Hugo Thimonier, Fabrice Popineau, Arpad Rimmel, and Bich-Liên Doan. Beyond individual input for deep anomaly detection on tabular data. In International Conference on Machine Learning, pp- 48097-48122 123. PMLR, 2024.
Che-Ping Tsai, Ganyu Teng, Phillip Wallis, and Wei Ding. AnoLLM: Large language models for tab- ular anomaly detection. In The Thirteenth International Conference on Learning Representations, 2025. URL htttt::://operevvieee /tt////ereeeeeeee/eeoreeeeeee meet/forumid=77VNffFTT
Hu Wang, Guansong Pang, Chunhua Shen, and Congbo Ma. Unsupervised representation learning by predicting random distances. In Proceedings of the 29th International Joint Conference on Artificial Intelligence, IJCAI 2020, pp. 2950-2956 International Joint Conferences on Artificial Intelligence, 2020.
Hongzuo Xu, Guansong Pang, Yijie Wang, and Yongjun Wang. Deep isolation forest for anomaly detection. IEEE Transactions on Knowledge and Data Engineering, doi: 1ALLL//TKDEE222233230000
2023a.
Hongzuo Xu, Yijie Wang. Juhui Wei, Songlei Jian, Yizhou Li, and Ning Liu. Fascinating supervisory signals and where to find them: Deep anomaly detection with scale learning. In International Conference on Machine Learning, pp. 38655-38673. PMLR, 2023b.
An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, et al. Qwen3 technical report. arXiv preprint arXiv:2505.09388 2025.
Hangting Ye, He Zhao, Wei Fan, Mingyuan Zhou, Dan dan Guo, and Yi Chang, Drl: Decomposed representation learning for tabular anomaly detection. The Thirteenth International Conference on Learning Representations, 2025a.
Jianan Yc, Zhaorui Tan, Yijie Hu, Xi Yang, Guangliang Cheng, and Kaizhu Huang. Disentangling tabular data towards better one-class anomaly detection. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pp.
2025b.
Jiaxin Yin, Yuanyuan Qiao. Zitang Zhou, Xiangchao Wang, and Jie Yang. Mem: Masked cell modeling for anomaly detection in tabular data. In The Twelfth International Conference on Learning Representations, 2024.
Yue Zhao, Zain Nasrullah, and Zheng Li. Pyod: A python toolbox for scalable outlier detection. Journal of machine leurning research, 20(96):1-7, 2019.
Bo Zong, Qi Song, Martin Renqiang Min, Wei Cheng, Cristian Lumezanu, Daeki Cho, and Haifeng Chen. Deep autoencoding gaussian mixture model for unsupervised anomaly detection. In International conference on learning representations, 2018
12

---

Published as a conference paper at ICLR 2026
A RETABAD DATASET DETAILS
ReTabAD benchmark consists of 20 datasets, each accompanied by a JSON text metadata file. This comprehensive collection encompasses wide range of domains and data characteristics, as summarized in Table 7. Our benchmark covers a broad set of application domains, including healthcare (7 datasets: cardiotocography, cirrhosis, gallstone, glioma, stroke, vertebral, wbc), finance (2 datasets: campaign, credit), cybersecurity/eetoorf security (backdoor), and diverse scientific and real-world domains such as biology (yeast), astronomy (quasar), geophysics (seismic), chemistry (wine), forensics (glass), environment (covertype), demographics (census), telecommunications (churn), and manufacturing (automobile, equip). This broad domain representation particularly valuable for evaluating context-aware tabular anomaly detection, as it enables assessment of whether algorithms can leverage domain-specifie knowledge to improve detection performance. The diversity allows researchers to investigate how contextual understanding of different application areas-such as medical diagnostic patterns in healthcare datasets versus fraud detection patterns financial datasets enhance anomaly detection capabilities beyond traditional domain- approaches.
A.1 DATA COLLECTION
The datasets were carefully curated by selecting genuine tabular datasets from ADBench (Han et al., 2022) and tracing back to their original sources, with the majority sourced from the UCI Machine Learning Repository'. By accessing the original data sources, we identified and corrected erroneous preprocessing steps present in ADBench and verified the appropriate definitions of anomalies for each dataset. This rigorous validation process resulted in datasets that differ from their ADBench counterparts, ensuring higher quality and more reliable anomaly labels. We additionally filtered out datasets lacking sufficient metadata, with performance saturation across methods (defined as AUROC/AUPRC 2 0.99 for most models), or having small sample sizes (< 100 samples) to maintain benchmark discriminative power. We further enriched our collection by incorporating additional high-quality datasets from Kaggle² to ensure broader domain coverage. We provide both raw data and preprocessing code to ensure reproducibility and transparency. Complete source information, dataset access links, and preprocessing scripts are available in our benchmark repository, and all datasets publicly accessible.
Table 7: Dataset Statistics with Domain Information
Dataset Name
Domain
Datapoints
Columns
Normal Count
Anomaly Count
Anemaly Ratio (%)
automobile
Manufacturing
159
25
26.42
backdoor
Network
50,000
42
48,779
1,221
2.44
campaign
Finance
7,842
16
6,056
1,786
22.77
curdiotoooraphy
Healthcare
2,126
1,655
471
22.15
census
Demographics
50,000
47,121
2,879
5.76
churn
Telecomunications
7,032
19
5,163
1,869
26.6
cimtosis
Healthcare
247
17
165
33.20
covertype
Environment
50,000
12
49,520
480
0.96
credit
Finance
30,000
23
23,364
6,636
22.12
equip
Manufacturing
7,672
6.905
767
10.00
gallstone
Healthcare
241
161
33.20
glass
Forensics
214
9
163
51
23.83
glioma
Healthcare
730
23
487
243
33.29
quasar
Astronomy
50,000
40,520
9,480
scismic
Geophysics
2,584
18
2.414
170
6,58
stroke
Healthcare
4,909
10
4,700
209
4.26
vertebral
Healthcare
32.26
whe
Healthcare
535
30
357
178
33,27
wine
Chemistry
178
13
130
26.97
yeast
Biology
1,484
1,389
6.40
A.2 TABULAR DATA PREPROCESSING
To ensure fair and consistent evaluation across models, we apply a standardized preprocessing pipeline to all datasets. We provide both raw data and comprehensive preprocessing code for each dataset to
https//arrchive.ies.c...t https//www.kaggle.co
13

---

Published as a conference paper at ICLR 2026
guarantee reproducibility and transparency in benchmark. This systematic approach addresses common inconsistencies found in existing benchmarks and ensures that all datasets maintain their inherent characteristics while providing a unified foundation for algorithm comparison. The main preprocessing steps are as follows:
Dataset Size Standardization:
Datasets exceeding 50,000 samples randomly downsampled 50,000 instances using random. choice with seed 42 for reproducibility and also provide csv file.
Anomaly Definition Verification:
For datasets previously available in processed benchmarks (e.g. ADBench), anomaly defi- nitions verified against the original dataset documentation to ensure correct semantic interpretation. Ambiguous or incorrectly defined anomaly classes are corrected based on domain knowledge and the specifications provided by the dataset creators.
For newly incorporated datasets, authoritative repositories such as the UCI Machine Learning Repository or Kaggle. Anomaly labels are deterministically derived by remapping minority or domain-defined abnormal classes to the anomaly category according to the original ground-truth class taxonomy, without introducing any subjective annotation.
exclusively use public classification datasets from
Complete anomaly label definitions for all datasets included in our henchmark are provided in Table 8 ensure full transparency and reproducibility.
Anomaly Ratio Balancing:
Anomaly class proportions are capped at maximum of 1/3 of the total dataset.
Missing Value Handling:
Any instance containing missing values input features or target labels completely removed.
No imputation is applied avoid introducing artificial patterns or bias.
Feature Value Restoration:
Categorical features are strictly identified and restored based on original metadata from the UCI Machine Learning Repository and other data sources.
Original categorical values are recovered from encoded representations to preserve semantic meaning.
Numerical features restored their original scales by referencing source documentation. as normalization criteria applied in existing benchmarks were often unclear or undocumented.
Each column is assigned column names based original dataset documentation.
14

---

Published as a conference paper at ICLR 2026
Clients who subscnibed term deposits are comsidereed anvenalies, while those who didl not sabscribe are normal
High-incoom aadividhals (XS50K) are considered monsiless while low- iew-inocme indivadunls (<=550K) are normal
Paieens who died are considered anomalies while censored patients or those who survived are nurmal.
Cottom Wood///llel forests (low elevation duciduous riguri (aurria) are considered anomalies, white Lodgepole Pine forests (mid to high slevation conifermos) are normall.
Customers who defunited on their credit card payment are consideres anomalies, while customers who did
Putienss with gallstonss present are considered anomalies. while patients without gallss ones are normal.
Architectuall window glass (classes 1-3) is treated normal. while containerr tableware. and headlsmmp glass (c (classes 5-7) 77-7are are treated as anomalies.
Glinb Multifomee (GBM) cases are considered unomalies, while Lower Grade Giiiona (LGG) coses are normal.
Quasun (QSO) are considered snomalies as rare astronomical objectss while stars and galaxies are normal
Hazardous states with high eaeryy scismii bumps are considered anomalics, while non- con--hazzdoous states noemal.
Puieess who had stroke are considered unomalless while patients nott have a normal.
Original 'Normaa' cluss samples are considered anomalics while patto aoltologiial classes (Hemia and Spondy- Iolisthesis) normal.
Proteins localized to emdoplasmic reticulum membrane (ME) (ME2) are considered anomalies due nare localization.
High-risk with symboling are considered anumalies. while normal with symiholing values are normal.
Suspoct Pathologic fotal cons dered anomaliss while Nornal stores are normal.
Customers churned are considerel anomalies, while customers who stayod are normal.
Faulty equipeneut states are considered anomatiess while normal operatiin states are nornal
Wine cultivar is considered an anamaly os it differs from the other rwn typical cultivars.
Ma Malignant breast cunver cases are considered anomalies, while benign eases are normal.
Backdeor attac consideee amooaales, while network traffic normal
Table 8: Dataset Information Summary
Label Delinitinn
common objects.
Cur specifications and insurancce ratings from the 1985 Impurts Dulabasee.
Forensie glass datesct with exids content messuremant for type identiiicaiion
Tolco customer datu with demographiic service usage, and detaills.
Bank marketing data with client demographiss and outcomes.
Fotal cate and uterine contraction massur sements CTGs.
U.S. Census data with demographiic and sociossonomic attributes.
Forest cover type data with coological and cartographic variables.
Clinical data data of patients with gullstone discase inc huclding lab results.
Clinical and genetic data of glama patients with tumoo grades.
SDSS dataset with spectral features of stars, galuxies, and quasars.
Mining dataset seismic bomps for hazardous eveut pesdiction.
Patzent datu demograpthis heallh risks, and stroke outcomes..
Biomechunical features from spinal X rays of vertebal conditions.
Protein fentures for predicting subeellula Ihoeelluurr localization yeast.
Mayo Clinic study data un primury Iiliary cirlhssi patients.
Credit card datuset with demographics and payment history.
Breast cancer dataset from diggttzed cell nucll features.
Chemical amiyssi of Italian wines from three cultivas.
Industrial equipment sensor data for fault desection.
Network traffic detecttng hackdooo
Descriptin
cardoooogappyy
Dataset Name
autommbble
back backdnor
compaign
census
chum
cirriosis
covenyye
credit
oquip
gallstone
glass
glioma
quasar
soismii
strake
vertehral
whe
wine
yeast
15

---

Published as a conference paper at ICLR 2026
A.3 METADATA FORMAT
We newly establish structured metadata to provide comprehensive dataset information for evaluating context-aware tabular AD. The metadata follows standardized format designed for extensibility to accommodate future datasets and evolving research needs. This structured approach enables seamless integration of new datasets while maintaining consistency across the benchmark. Table 2 illustrates the metadata structure using the Cardiotocography dataset an example from the ReTabbAD benchmark.
Dataset Description: The metadata begins with essential dataset identifiers including the dataset name, original source URL, and a concise description of the data collection context. This information provides the foundational context necessary for domain information.
Feature Description: Each feature is systematically documented with four key attributes: (1) Feature name the original column identifier, (2) Type the raw data type (int, float, string), (3) Logical type the semantic classification (numerical, categorical, ordinal, binary), and (4) Description a detailed explanation of the feature's 's meaning and measurement units. This multi- layered typing system enables our prompt generator apply appropriate analysis strategies for different feature characteristics.
Label Description: The metadata explicitly defines the anomaly detection target, specifying the label column name, data type, and semantic interpretation. For binary classification tasks, the mapping between numeric values (0/1) and semantic labels (Normal/Anomaly) is clearly established to ensure consistent interpretation across different prompt types.
This structured metadata format enables our system to automatically generate contextually appropriate prompts while maintaining consistency across diverse datasets. The standardized schema supports both domain-spenn -spuciif-peeiicc analysis (using feature descriptions and dataset context) and domain- -again-agnostic analysis (using only statistical properties and logical types), facilitating comprehensive evaluation of contextual information impact on anomaly detection performance. Additionally, our metadata- driven approach automatically recommend appropriate data preprocessing strategies based on logical types-for for instance, suggesting standardization for numerical features, one-hot encoding for categorical features, and ordinal encoding for ordinal features- even when provided with only raw tabular data, as demonstrated in Table 9.
Table 9: Recommended preprocessing methods for each logical_type.
logicul_type type
Details
Meaning:
Continuous or discrete numeric values
nunerical
Recommended Preprocessing: StandardScaler (x-soore), MinMMxxccaler, log transform skewed), clipping winsorization
Notes: Improves stability in statistical and deep models
Meaning: Unordered categorics Recommended Preprocessing One-hot encoding (low cardinality), learned embedding (high cardinality). label encoding (for trees)
categorical
Notes: Prefer emheikling for many categaries
Meaning: Ordered categories
ordinal
Recommended Preprocessing: Ordinal encoding (e.g., Lowef) Medium=1, High=2)
Notes: Numeric mapping should preserve order
Meaning: Two distinct values
binary
Recomumended Preprocessin: encoding
Nates: Single colurn usually sufficient
B RETABAD ALGORITHM DETAILS
Our benchmark covers comprehensive set of unsupervised anomaly detection algorithms. For methods that are not available in existing libraries, we directly implemented them based on the original sources ensure their faithful integration into our benchmark. In addition, we include all implementations available in widely used libraries (PyODa and DeepOD*). To ensure consistency, standardize every algorithm to follow a unified fit/predict interface in the scikit-learn style,
hhtpss//pooddrrattthooosssss http:s//ddeeoo..ccaaateeeeessses
16

---

Published as a conference paper at ICLR 2026
enabling seamless comparison across methods. Furthermore, expose the core hyperparameters of each algorithm, making them tunable within our framework so that hyperparameter optimization (HPO) can be conducted fairly and reproducibly across all categories of models.
B.1 CLASSICAL METHODS
Forestt. Isolation Forest (IForest) (Liu et al., 2008) detects anomalies by recursively partitioning the feature space using random decision trees. Since anomalies are typically easier isolate than normal instances, they yield shorter average path lengths in the trees. This property enables efficient detection with linear time complexity, making [Forest suitable for high-dimensional datasets.
KNN. The k- k-Nearest Neighbors (KNN) method (Ramaswamy et al., 2000) identifies anomalies based on the distance between a data point and its neighbors. Anomalous points tend to reside far from dense clusters of normal samples, leading to larger distance-based scores. Variants such as average or median distance to the h neighbors are commonly used to improve robustness.
OCSVM. One-Class Support Vector Machine (OCSVM) (Schölkopf et al., 2001) Iearns decision boundary that encloses the majority the data while maximizing the margin a high-dimensional feature space. Samples falling outside this boundary are flagged anomalies. Despite its sensitivity to kernel and parameter choices, OCSVM remains a widely adopted baseline for one-class anomaly detection.
LOF. The Local Outlier Factor (LOF) (Breunig et al., 2000) algorithm measures the local deviation of a point's density relative to its neighbors. Instances with significantly lower local density considered anomalous. LOF is effective in detecting context-dependen anomalies but can be sensitive neighborhood size and parameter selection.
PCA. Principal Component Analysis (PCA) for anomaly detection (Shyu et al., 2003) projects data into a lower-dimensional subspace that captures the majority of variance. Reconstruction error the residual in the discarded components is then used as the anomaly score. This approach is effective when anomalies do not conform to the dominant low-dimensional structure normal data.
B.2 DEEP LEARNING METHOSS
DVDDSVDD. Deep Support Vector Data Description (DeepSVDD) (Ruff et al., 2018) extends the classic one-class classification paradigm to deep neural networks. learns a feature representation that maps normal samples into compact hypersphere in the latent space, while anomalies lie farther away. This method is widely used baseline for deep one-class anomaly detection.
REPEN. REPEN (Pang al., 2018) proposes a random distance-based framework for anomaly data. By learning representations that preserve relative distances between randomly sampled triplets, the method improves the effectiveness of distance-based outlier detectors applied on the learned embedding space.
detection in ultrahigh-dimeniione
RDP. Random Distance Prediction (RDP) (Wang al., 2020) trains Siamese neural network predict distances in randomly projected space, learning representations that preserve data proximity, These learned embeddings significantly improve anomaly detection and clustering performance without using any labels.
RCA. The RCA method (Liu al., 2021) introduces a collaborative autoencoder framework where multiple autoencoders jointly learn reconstructions. Anomalous samples tend to disrupt collaboration, yielding higher reconstruction errors. This collaborative structure enhances robustness against complex anomaly patterns.
GOAD. GOAD (Bergman Hoshen, 2020) frames anomaly detection as a self-supervised classifi- cation task. By applying diverse geometric transformations to data and predicting transformation labels, the model learns discriminative representations of normality. Anomalies fail to conform to the leamned classification boundaries, enabling detection.
Neu TraL. NeuTraL (Qiu et al., 2021) introduces neural transformation learning, where input samples transformed via trainable mappings. The model learns to distinguish normality based consis- tency across multiple transformations, making it applicable to non-image domains such as tabular data.
17

---

Published as a conference paper at ICLR 2026
ICL. Internal Contrastive Learning (ICL) (Shenkar & Wolf, 2022) proposes contrastive framework specifically designed for tabular anomaly detection. By constructing positive and negative pairs from within each sample's feature space, ICL lears discriminative feature representations that enhance anomaly separability.
DIF. Deep Isolation Forest (DIF) (Xu al., 2023a) integrates the principles of Isolation Forest with deep representation learning. The method first learns embeddings that capture salient data characteristics, followed by isolation-based partitioning detect anomalies more effectively in high-dimensional settings.
SLAD. Scale Learning for Anomaly Detection (SLAD) (Xu et al., 2023b) introduces auxiliary supervisory signals derived from scale consistency. By enforcing scale-invariant representations. SLAD enhances the generalization capability of deep anomaly detection models, especially for complex tabular datasets.
MCM. Masked Cell Modeling (MCM) (Yin et al., 2024) learns feature correlations by reconstructing randomly masked cells with a trainable mask generator. Anomalies are detected via high reconstruc- tion errors, and diversity loss ensures complementary masks.
NPT-AD. NPT-AD (Thimonier et al., 2024) applies both feature and sample-sample dependencies. By reconstructing masked features normal samples, anomalies are detected via higher reconstruction errors, achieving strong performance on tabular benchmarks.
Transformers (NPT) to model
DRL. Decomposed Representation Learning (DRL) (Ye et al., 2025a) remaps tabular data into a constrained latent space by decomposing each normal sample into weighted combination of randomly generated orthogonal basis vectors. A novel discrepancy constraint further amplifies the separation between normal and anomalous patterns, resulting in strong detection performance across diverse tabular benchmarks.
Disent-AD. Disent-AD (Ye et al., 2025b) disentangles tabular attributes into two distinct but correlated subsets using two-head self-attention module. The model reconstructs the original sample from each subset to capture intrinsic correlations of normal data, enabling robust one-class anomaly detection.
B.3
LLM BASED METHODS
AnoLLM. AnoLLM (Tsai et al., 2025) employs large language models for unsupervised tabular anomaly detection by serializing mixed-type rows into text and fine-tuning an LLM to model the data distribution. Anomaly scores are derived from negative log-liked bigllikelssoods, offering strong performance on mixed-feature benchmarks and competitive results on predominantly numerical datasets.
Zero-shot LLM. We additionally introduce zero-shot bascline that leverages large language models for tabular anomaly detection. Each data row serialized into textual prompt together with semantic metadata, and the LLM assigns anomaly scores based its contextual reasoning without any fine- tuning. This setting highlights the potential of LLMs as strong baselines for context- context-aware --warre tabular anomaly detection.
18

---

Published as a conference paper at ICLR 2026
C EXPERIMENTAL DETAILS OF BASELINE METHODS
C.I HYPERPARAMETER SETTINGS
Table 10 summarizes the hyperparameter search ranges for each model. By default, each configuration searches over scaling typeeng_typeat E (standard, minmor) and cat_encoding E {int, onehot).
Model
Default Paramelers
Hyperpurameter Search Range
OCSVM
kernel: dbf
10.1. 0. 0,3,04, 0.5] cxstamination: (0.1. 0.2,
contamiratiin:
LOF
novelty:
n_ncighhers:
metric: euclidean 2
contaminazio:: [0.01, 0.1]
leaf_sive sine: [10, 30, 50)
KNN
Ieaf size:
n. niighhhons:: (10, 20, 30, 30] contamination: (0.01, 0.11
metric: minkowski
FForst
features:
estimators: (50, 100, 200, 300, 500)
hootsing False
contaminution: (0.05,
0.3)
PCA
avd
n_companents: [sull, 2,
20, 25, 30)
weighted: True
contamination: [0.1, 0.2.0.3)
selectad componests: mill
whiten: (TTue, False]
DespSVDD
his: False
Ir: [0.005, 0.001, 0.0005, 0.0001)
rep_dim: [32, 64, 128] hiddon (100,50,
256,128 512,256128)
REPEN
ast: ReLU
Ir. [0.00], 0.0001)
inor_ www.mmcccesssseeee size: init wwwre_subssuptteee size: 8
rop_dim: [128, 256]
hidden, dims: (100,50;
RDP
p0p dim: 128
Ir: [0.001, 0.000]
hidden. dims: 100.50
hidden diins: (100,50: 256.128)
rep_sim:
RCA
act: LeakyReLL alpha: D.5 inference, cnsemble:
Ir: (0.005, 0.001, 0.0055, 0.0001]
hidden dims:: (100,50, 128.64; 256,128 512,256,128)
GOAD
act: LeakyReLU nLlayers: n_tman: 256 hidden_dimi
Ir: [0.001, 0.0001
trans, trans_dim: (32, 128)
trans: [256, 512)
NeuTral.
act: LeakyReLU trans, type: trans, hiddennddmss 50
Ir: [0.001, 0.0001]
rop_ rep_dim:
hidden_ dims: (100,50, 256,128)
T.trans: 11
SLAD
aut: LeokyRoLU
In: [0.001, 0.0001]
shal ensemble: 20
hidden dims: (100, 200
magnify_factur factorr 200
n_ ununified_ Feoture: (128,
subspuce, size 50
dist, size: 10
ICI.
act: LeakyRel.
In: (0.001, 0.8001) dim: (32, 128]
bia:: Falls (emperotuue:0000
hidden (100,50, 256,118)))
DesplaolltiioFoosss
Filse
dim:
256)
0:001
hidden, [100,50, 256,
act: Rel.I.
n ensemble: (50, 200)
sumples: 256
n.csttmattos::
MCM
enc. Jay_rsy des Jayers:
Ir: (0.005, 0.001, 0,0055, 0.0011] number: [10,
hidden_dim: 256
2_dim: 128
lanidda: 11.5, 10)
mask mask_layen:: 3
NPT-AD
nam meadheeds: 4
Ir: [0.01, 0.001, 0.005, 0.0011] marking prtobbbiittbbtttyy.ooooo (0.15, 0.2 0.25)
atL stL_s norm: softmas
DRL
enc. Jayers, dee layers:
In: [0.005, 0.001, 0.0005, 0.0001)
hidlen dim: 128 input cepuu__nno__rtte ratio:
input info ratire 10,05 0.155.
contrastvv Jeaming maaii [0.03, 0.09)
contrastive learning ratio: 0.06
n basis vec:
DiseAAD
glvy bins: True
In: [0.0001, 0.00001
18
bidden dim: (128, 256)
heads:
AntLLMM
10000005 training_stee n. penmuuaaiio::: 21
modal: (SmolL.M-135M, M-360M
Table 10: Default parameters and hyperparameter search ranges for baselines.
19

---

Published as a conference paper at ICLR 2026
D DETAILED DESCRIPTION OF ZERO-SHOT LLM FRAMEWORK
D.1 EVALUATOR LLMS
GPT-4o-mini (OpenAI). A lightweight variant of OpenAl's GPT-4o, designed for cost-efficient inference while retaining strong reasoning capabilities. It is optimized for practical deploy- ment scenarios where efficiency is prioritized over maximum performance. (target_model 8pt-44-mmin1-2822-97-11
GPT-4.1 (OpenAI), The successor to GPT-4, providing enhanced reasoning ability, improved tool- use integration, and stronger multimodal alignment. It represents OpenAl's flagship model as of late 2024. (target_model gpt-4.1)
Claude-3.7-sonne (Anthropic). A mid-sized model in Anthropic's Claude family, optimized for balanced reasoning and efficiency. The "sonnet" variant is designed to offer strong performance on structured tasks while maintaining lower inference cost compared to larger Claude models. (target_model -eaude-3---sonne--2233
Gemini-2.5-pro (Google Deep.indd). Google's flagship multimodal model, capable of processing text, images, and structured inputs. The "pro" version provides stronger reasoning than lighter variants, and is designed for research and production-scale applications. (target_model gemini 1omini-2.5-ppae 5-po-)
Qwen3-235B (Alibaba). A large-scale autoregressive language model trained on multilingual and multimodal data. With 235 billion parameters, Qwen3 represents Alibaba's third serd-aeeneatioon LLM, aiming to provide competitive performance on both English and Chinese benchmarks. (target_model qwen3-235b-ad
D.2 IMPLEMENTATION DETAILS OF ZERO-SHOT LLM FRAMEWORK
Data Parameters. By default, tabular inputs are serialized in raw form without normalization or discretization. However, both normalization perrialzzennrmaaaa aime lerllliieeeeehoheeee and discretization into user-defined number of buckets statistics, we provide 5th/95th percentiles derived from the training data (only normal), which serve representative ranges for contextual grounding.
available options. For normal
Model Parameters. We use large language models (LLMs) in a zero-shot setting, where the backbone LLM can be selected flexibly (e.g., GPT-44).. The inference batch size is set to 15, with maximum of 5 retries per query to ensure instruction following and prevent output format errors.
D.3 PROMPT TEMPLATE
To systematically assess the role of semantic context anomaly detection, we design a dedicated PromptGenerator that produces four distinct prompt types (A-D). Each type selectively incorporates different levels of contextual cnormationnrangiinn descriptions-alloviiii controlled ablations of the information available to the LLM. All numerical attributes are consistently formatted by rounding to three decimal places, ensuring clarity and reproducibility in prompt construction.
from raw numerical inputs to full metadata
Type A (No Desc.): Normal statistic only (anonymized column names egg. AA, AB, ...)
Type B: Normal statistic + Feature Description
Type C: Feature description + Domain knowledge
Type D (Full Desc.): Normal statistic Feature description Domain knowledge
20

---

Published as a conference paper at ICLR 2026
Type Prompt
Analyze
anoealy
Statistical Contect
dex Numerical features- Nomma Ranges:
AA: Noreal Bange (5 percent ile): A 4B: Nornal, Range 15th-559 percentile):
Categorical reatures
Analyze the fol lowingg data Record 8: Mel festure_1 value), (fstfrru value)
B: Me(festure_1 value), Mf(ftsturre_ value)
Return valid "anosally score":8.0 "reasenning :"Mnllyyss resutt", [[""ecord_id"""" Id":""", "key rewuureesses's ( ["*eeature"", "festure2"1>,
[e"recond_ iatt"1t, "wsonaly score":a. "resonning (Analysss result", "eatureet ("feature"", "festure2"))
Figure Type Prompt Example
Type B Prompt
Analyze the data for anoraly detection.
Testures:
features:
[reature (feature_) description) 2 nanels [feature]] description)
Categorical, features:
description)
#4 Statistical Context
een Numerical festures- Nornal Ranges:
(feature_] 1 narels Norral Range (511-35h percentatel: [fewture naee]: Bange (5tt-00m percentile):
Categorical
(reature name
ee analysis Suidelines:
Use Teature descriations to understand data context.
for values seen unusual given reature reanings.
veERETICAl consider relationships berveen categorical and festures.
Check cateporicat-nuerrt
lopical
feature descriptions.
categorical
Analyze the following data based the guidelines provided aboves
Record 8: (feature_ mone)stresture_ va valuel, steature_k k mane)s(reature_ value)
Record B: (feature_ none)e[fenture_] valuel, m. (feature mene)e[reature_j vslue)
[K"resord_id" "0"" "anoaally "reasoniin"""""naae" resuit", "aay. features": ("fatture"", "fasture""],,
it"record_idt"tt "annotttaaaa score":8.0 "agooniin"""nnayystii result", "estarret:""fssurreee" l"festurel", "festurez"]]
restureesss""
Figure Type Prompt Example
21

---

Published as a conference paper at ICLR 2026
Type Prompt
are sentor (dstaset naze) expert anslyring data for anozaly detect
(dataset, (dataset, description)
Label: (erget__essrigstion)
** Teatures:
a9d husericat featurest
(teature_ nare)s (reature_) description) (feature_2 narel2 [feature_] description)
a5d Categorical features: [feature_k care) (feature_ description]
Analysis Guidelines:
dataset
descriptions to quide analysis.
torats-spectfic
categprical-muersa festure combinations for Look for anomalies els where categorical values narral but nuserccal patterns don't align with domain expectations,
**CRITICALA::
Use dorain knouledge identify laplausible festure corbinations.
Analyze following
the guidelines provised above:
[teature_] nane)[(festure_] veluel, m. (feature_k nene)[fretture_.
Record [feature nom]e(feesture_ value), (feature (rees[ffettune value]
Beturn in 1506 array: [("record, "i" sxonslly "r"""rrroninn"""""""a" result", "key_ featureatsss"t ("featuret", "feature2"1),
[e"record, 1"""""", score "er.".......rroniiii "reasoning" "Waalysis resutt", "key, festures" ["festuree", "festure2"]3]
Figure 7: Type C Prompt Example
Type D Prompt
You are a sentor (sstaset_rave) expert analyzing data for anonsly detection.
description)
Label: descrripption
#? Features:
498 Nuserical features:
(teature_ namels (feature_1 description) [feature name]; [feature_] descriptt ion)
#28 Categorical features:
(festure_ neme) [feature K description)
Statistical
Numerical features-
Rangess
percentile):
[testure_2 nomels Nomal 157-55 percentile):
**e Categorical festures Norral Values: (feature K namel:,, E,
Analysis Analysis:
Isentsfy values 55th percentile distribution baselises
5th percentile (Likely stnorral).
Consider cumulative effect of wiltiple Line values.
exindividual nomal values do not guarantee norral overall patterns evaluste holistic combinations.
Categorical Pattern Analysis:
"in-distributione"
contextual Identify contradictary categorical conbinations risalignnent with nusricaal severity indicators.
Look individial categorical validity
festures.
#26 Donain Analysis:
Use astaset contect and feature descriptions to guide analysts.
meaningful gatterns across sultiple features.
and Assess whether feature ioebinat lons sake doeain-speci lffe logical sense.
Leverage target label definition
Ana byze the following data based on the puidelines provided above: (featurec) nase feature_] value), (feature_k (foaturre value)
Record (feature_) faneje[festure_]
(feature_k nane)e(festure.k value)
Return valid 350N array: [("record, ld"s "an"ealll "ecore""l.,,"// "rr.ssiii.".ararrggaaaeeee "Aaalyss resultt, "esturrst "esturee":""festuree ["festurel", "feature2"),,
it"record 10";""" anorall_score"" "reasoning" "Analyyii resutst, "key festurest ("feturre"" "ersttree"""esstuuree
"featurez"1))
Figure 8: Type D Prompt Example
22

---

Published as a conference paper at ICLR 2026
E COMPARISON OF THE LLMS
Table 11: Comparison of the LLMs' AUROC performance across four context types (Type A-D). Each column represents a different LLM evaluated under four prompt conditions: Type A, Type B, Type C, and Type D.
SPE-13
Typ.
Spel
Tye
Typ-A
Spec
0.114
1358
02317
0.54
BALE
07%
Edft
Ed0
315
4515
100412
12033
(2003)
12001
Lo30t
12c00
C-300
LoaD
1JC304
GONG
3179
0.14
030
E70
306
GTT
048
6%6
EXT
303
330
0300
C70
664
ATM
045
180822
Langin
140000
10036
dum
GAMB
1.300
11000
120000
(200))
1000
14000
0330
Loois
L2000
10300
1200%
1300)
12054
1.3m
11000
1100
(2026
000
050
1511
350
0200
10000
12000
15000
10000
1500
13300
150000
110000
962
033000
03000
10066
1000
ghos
1988
150th
19500
1908
1000
190855
010
IRHEDY
198000
(4500)
1940
1903
14:01
18060)
LIGENN
160 BE
1965
163K
347
033
031
3IM
040
065
655
344
621
CS1
340
635
(9800)
19:8
(9E0m)
18100)
1918
(5100)
190000
(4500)
(8007)
1988
(9900)
191816
16
19800
(H910))
196816
140861
14590)
160016
(9810))
(80215
19083)
140300
330
0.55
0.56
196
852
6772
E.41
A77
366
0315
0:01
036
3751
087
030
Table 12: Comparison of the LLMs' AUPRC performance across four context types (Type A-D). Each column represents a different LLM evaluated under four prompt conditions: Type A, Type B, Type C, and Type D.
GPF-
GPF-1
Trps
Type
Type
Tyee
Trpeh
Type
Typ:
Type
TrpeT
TrpeTT
Typ-A
Tyr:
Tyer
TreeF
Typ.A
Typ:
Type
T
0.01
1.410
$111
E.00
8721
125.251
18115C
194020
140-01
(450m)
(4810)
(80110
(46.7)1
145.70)
(9:100
0.66
(4510)
(RSE30
140.2X
1900
19:00
14:00
(4400)
184600
186812
14038
14000)
(6:08)
165
(9508)
(80E3)
1918E0
16080
0./6
3413
0.69
0.6
3413
041
043
641
1-06
6461
654
345
630
1911/
(919))
19500)
(4115)
(8001)
190
1912
1998
11910
14200
14500)
(9308)
19:30
14000
31M
11900
(25000
LA0RES
(2000)
10050
1000
(1000
12000
10000
(-3000
(1300)
125
1000
1036
325
1300
1100
(120)
330
020
T11
1007%
13500
1500
10000
(23006
15055
150 1E3
22000
(000))
1000
14300
19005
380
312
(900)
1030
SADE
33H
030
600
110000
300
620
(3300
2412
100
650
BA1
3807
083
1.000
12 10N
100 10
(1300)
00066
(0066
1003%
144
038
0.04
340
0514
0314
1.00
116
340
030
6.65
34M
0.0
665
23

---

Published as a conference paper at ICLR 2026
F FULL BASELINE RESULTS
Table 13: AUROC Performance across all baselines.
1120
15.5
Flac
1019
00050
5-30
1104
1981
043230
14300)
14:-3)
18:-0)
12:101
043000
(4547)
(40/0)
14200)
16:304
145-471
14:231
188.0)
14:021
6.300
3354
31/4
6.000
6:22
-45000
A332
6:51
9472
$407
5.50
6390
4007
-MME
03000
6380
01:00
GAVES
23053
10000
0800
1834
6030
06310
52437
61011
0.65
3315
13N
6.50
1413
6460
1001
5344
(340)
(4033)
GARI
(3000
JAM00
4803
608
10:00
(001)
11:00
00011
06633
18800
0.31
0.50
100
104
1961
030
100
1000
1200
300
50
0M0
CHC
01180)
(1500)
110000
(9000
(000
11900
(1900)
19:0
1190
1411
1754
1255
10.0
300
10e
03111
11560
11390
11000
00:00
00m
(200
1770
11500
11800
6TP
1900:
m50m
S1A
HELED
H6-80
HE-00
14-E0
16:80
1E000
196
596
5445
165
5901
E/1
CF11
1300)
1800
630m
0330
18:00
0080
(66.3
(6814
09%
9403
523
Table 14: AUPRC Performance across all baselines.
6.71
0441
0.534
3.50
8413
6.33
0.865
04.33
0,515
14:33
6:18
14455
0.13
0.544
8.25
0.53
1.05
0.01
07180
(3000)
(1000)
(50.0)
(3807)
(1800)
118.0h
12.801
(1800)
18:300
(1034)
15:155
03155
(1600)
(2027)
330
175
$150
6.30
6117
173
6991
1100
1754
03380
11:00)
(6000
165.0
GAMRA
18000
080M0
(1000
06000
0155)
0391
196
1961
15000
9011
134
1101
141111
14510
14640
11:00
11531
19100
H6.04
19111
19000
(910))
13.00
1904
1.256
1911
1000
1200
1888
JARS
(4500)
1328
500m
1960
1430
1400
16000
14077
1940
1906
196
H49H
2301
1950
(6108)
1996
130
HETED
130
250
60h
18:80
19150
122
0400)
1400
19940
190m
H905
1986
(6060
679
190
100
204
134
EM
190
16:0
6085
1800
300
550
5m
60N
16.0
(200)
DEC
151
04855
(480))
16:00
(40
9485
4800
(810)
8E-00
16000
16:04
(MED
63825
14080
MADA
18:00
60:80
00000
(2083
24

---

Published as a conference paper at ICLR 2026
G PERFORMANCE DETAILS OF KEY FEATURE ESTIMATION
To support the results in Table 6, this section details the procedure used to measure the key feature alignment metric. Building on the insight from TabLLM (Hegselmann et al., 2023), which emphasized the importance of feature attribution analysis for interpreting model reasoning, we adopt a similar perspective for evaluating LLM explanations. Concretely, we assess whether the key features predicted by an LLM align with attribution scores derived from a supervised reference model. To this end, we train an XGBoost classifier using ground -ruth labels and compute SHAP (Lundberg & Lee, 2017) values for each test instance. For a given anomalous instance J;, the top-K features ranked by absolute SHAP values define the reference set:
R (K) Topk (16(z))),
where (xx)) denotes the SHAP value vector for instance zy. In parallel, the LLM outputs a set of key features for 24, which we denote as F,. We then measure alignment between the two sets using the Fl score at K:
((@)(x;)) = 2. 2.1R
(K) n P.l.
|R( + |FA
The final metric is averaged over all anomalous instances:
FI@K = A
FIIK((T)).
ZgEA
where A denotes the set of anomalous samples. Overall, providing textual metadata (Type D) leads to clear improvements in F1 alignment compared to the no-description setting (Type A) across all LLMs (see Table 15). The effect is particularly pronounced in domain-specific datasets such as glioma, wine, equip, and glass, where feature semantics are well-defined and textual descriptions provide crucial contextual grounding that helps the LLM better aligm its reasoning with -eiiederived ground truth. Moderate but stable improvements are also observed in datasets like campaign, churn, gallstone, wbc, and vertebral, indicating that even mid-level semantic cues can meaningfully guide feature-level interpretation. In contrast, limited or negative effects arise in datasets such as backdoor, covertype, quasar, and stroke. These cases are largely explained by factors such as ceiling effects from already high baseline alignment (e.g., quasar), structural complexity that weakens the usefulness of textual cues (e.g., covertype), or anomaly definitions that are too simple for additional metadata to provide substantial benefit (e.g., stroke). Despite such exceptions, textual metadata generally serves as strong semantic signal that enhances the LLM's reasoning alignment, with the most substantial gains appearing in settings where domain-specific context plays a central role. However, this aasoonng--alignmen metric is not full measure of explanation quality. Thus, the improvements from textual metadata should be seen as enhanced semantic grounding rather than definitive gains in explanation quality.
Table 15: Impact of Textual Metadata on Reasoning Alignment across 20 Datasets. We report F1-Score @K K (K = 1, on anomalous instances for Type A (No Description) and Type D (Full Description) across five LLMs.
GPE-4a-ni
GPE-4
Qreak288B
Gesne-15.PP
Datuel
$1005
F1:01
F101
F113
3301
F183
F1803
Typo
Tyyc
Typs D
A Trp:
Typs A. Tyyc
Type
Typz
Typc D
Typc
Tyys
Sypc
Topc
Typc
Tops
Oppc
Tepu D
0.000
0.000
(U00)
01003
0.500
0.000
5.167
(U353
(100)
0.800
0.500
(100)
(U80)
(1033
0.500
0.500
0100)
(003)
01200
0.942
3000
0.167
(459)
(.23)
0.500
0.106
5160
(L275
(U913
0.154
0.185
6.174
0.275
11237
0.361
0.19
0,85
0335
0L337
0443
campaies
0.199
0.185
0.345
0.800
01:66
011
0.955
8.000
0868
5110
6167
0054
0085
01583
0.1%
0035
0136
creas
0.085
0.108
0180
0086
035
1100
510
[198
0151
0187
0115
6.17
6172
0071
0133
6.191
6177
0196
01:55
0357
chare
617
0:31
0755
03365
0134
5.50
0/511
0334
0736
0311
6330
6750
07.6
0363
5.15
0766
01:61
conctope
0.22
0.677
B135
0.403
0.445
0.106
D-44
0445
0.72)
0.550
0.65
0.33
0967
0442
0.400
0.336
CA66
03322
0.542
0350
croda
0.305
2300
B.75
0.31
0.500
0.07
5.18
0256
0023
0.37
0102
0.66
0626
0.236
0.38
0236
0.111
0120
01233
0349
0431
0518
6410
0.585
6621
0311
2161
0/3
01395
0300
0100
0001
0335
0150
0630
0300
6367
0/00
030
0000
036
glana
0111
C157
0790
8300
0131
0.11
0000
0365
3.18
6.90
0000
0338
0.31
8551
651
0.6
quor
0311
0.67
0.115
0265
0341
5326
0.23
R13)
0356
0336
6.24
0152
0331
0410
0.56
1301
01334
0312
0.353
0.66
8435
0485
033
0,60
5312
020
0552
0.55
0500
0383
0906
0357
0.82
0A40
5479
0.%
0.43
0442
0335
0235
0171
6413
0330
6212
0336
0.00
5.133
0/8
0120
0.34
0.312
0.7%
0756
0.400
0337
0.460
67555
6000
0357
0.66
6.50
6367
0775
0.36
0.13
0363
CX11
6636
0.37
0166
5:61
0.755
0.54
0.50
0395
6719
6567
0231
0160
0/60
8634
6631
0705
0.00
8.33
0.59
(1361
0335
0333
0.357
0335
0335
0330
6.36
6.34
0317
0.6
8333
0317
639
03355
0.188
25

---

Published as a conference paper at ICLR 2026
H EXPERIMENTAL DETAILS FOR REASONING TEXT ANALYSIS
To assess the impact of reasoning quality on AD performance, we conduct a controlled experiment using test-time prompting. For each dataset, we split the test set in half: one half used extract reasoning texts from detected anomalies (based on high anomaly scores), and the other half is used evaluate the effect of injecting these reasoning examples. Specifically, we vary the number of reasoning examples {1, 3, 5, 10} included in the prompt in descending order of anomaly score.
As metric, we compute the AUROC difference between the baseline (zero-shot prompt without examples) and the model performance after injecting reasoning examples. We further compare the impact of different reasoning types (e.g.. Type A vs. Type D) and anomaly score levels (e.g.. top-scoring vs. uncertain cases). We observe that high-quality reasoning (Type D) leads to more consistent and larger performance gains, particularly in semantically rich domains like cirrhosis.
I MORE GRANULAR METADATA ABLATION STUDIES
Beyond the primary metadata variants (Types A-D), we conduct fine-grained analysis to disentangle the individual contribution of each semantic component. We introduce three additional variants:
Type E: Feature description only.
Type F: Domain knowledge only.
Type G: Normal statistic + Domain knowledge.
These granular ablations reveal several notable patterns across the evaluated LLMs (see Table 16). (i) Domain knowledge provides strong semantic foundation, and adding feature descriptions yields consistent further improvements (Type G vs. Type D). (ii) Feature descriptions alone are insufficient for anomaly reasoning, as models cannot infer appropriate normal ranges without domain cues-making statistical or domain information essential. For instance, in cardiotocography, fetal heart-rate ranges differ substantially from adult ranges (Type vs. Types B/C), (iii) When only one semantic component is available, domain knowledge is considerably more informative than feature descriptions (Type E vs. Type F).
The metadata in benchmark follows natural hierarchy: domain-level descriptions meaningful only when grounded in feature-level semantics. If feature descriptions are entirely removed, this hierarchy collapses the model can no longer interpret what each column represents, and the domain information cannot be mapped to the observed values, making anomaly reasoning ill-defined. For this reason, even in our "domain w/o feature description" variants (Type F, G), we retain the feature names as minimal anchor. Removing feature names would make the domain information unusable, as the model would have no interpretable linkage between domain concepts and table attributes. Although this is not strictly pure domain-oni setting, it is a necessary relaxation that preserves coherence and enables meaningful measurement of domain-level effects.
Building on this fine-gr ine-grained quantitative analysis, we provide the complete results for Types E-G across all 20 datasets and all evaluated LLMs. The AUROC and AUPRC tables (shown in Tables 17 and 18) allow detailed comparison at both dataset- and model-level granularity.
Table 16: Granular metadata ablations (Types A-G) and average AUROC across 20 datasets.
Type
Connmnaa
Cpener
Cavaaa
GPT-4o-mini
GPT-4.1
Claude-3.7
Qwen3-235B
Gemini-2.5-pro
(No Desc.)
0.696
0.725
0.691
X
0.703
0.712
0.735
0.716
0.721
x
/
0,705
0.632
0.741
0.631
0.673
(Full Desc.)
0.726
0.735
0.777
0.747
0.847
x
0.584
0.581
0.648
0.562
0.571
0.608
0.639
0.809
0.679
0.720
/
0.671
0.721
0.792
0.726
0.823
26

---

Published as a conference paper at ICLR 2026
J. FULL GRANULAR RESULTS
Table 17: Comparison of the LLMs' AUROC performance across three granular context types (Type E, Type F. Type G). Each column represents different LLM evaluated under the three metadata- ablation variants.
GPT-4p-minl
GPT-41
Clunde-3.7 3.7amnct
Qwend-2358
Gemini-2.Sppro
Dataset
Tyge E
Type F
Typs
Type E
Type
Type G
Type
Tyze
Type
Type E
TypeF
Type
Type
Type
Type G
autemmbble
0.533
0.531
0.663
0.628
0.307
0.574
0.532
0.726
backdoor
0.804
0.724
0,800
0.885
0.726
0.368
0.720
0.067
0.209
0.886
0.787
0.000
0:211
0.831
compign
0.543
0.501
0.657
0.63
0.497
0.778
0.618
0.481
0.63
0.501
0.810
0.786
ceviotoengmppyy
0.565
0.665
0.740
0.776
0/44
0.751
0.545
0.745
0.708
0.570
0.711
0.666
0.765
0.856
0.819
0.741
0.02
0.854
cluen
0.525
0.487
0.507
0.57
0.17
0.771
0.611
0.09
0.809
cimbosis
0.212
0.772
0.582
0.571
0.730
0.710
0.827
0.836
0.641
0.243
0.578
0.821
0816
covertype
0.704
0.865
0.400
0.985
0.673
0.922
0.59%
0810
0.489
0.975
0.979
credi
0.366
0.586
0.470
0.900
0.516
0.589
0.644
0.647
0.543
0.514
0.526
0.678
eqpip
0.844
0.845
0.990
0.901
0.925
0:971
0.866
0.088
0.974
gallstone
0.595
0.664
0.543
0.623
0.580
0.611
0.591
0.595
0.615
0.566
0.51
0.554
0.583
0,67
glass
0.769
0.269
0.811
0,810
0.810
0.908
0.826
0.557
0.874
0.667
0.522
0,748
0.585
0910
gloma
0.459
0,626
0.492
0.656
0631
0.454
0.778
0.877
0.788
0.009
0.492
0:005
0887
quaeo
0.400
0.699
0,468
0,80
0.544
0.556
0.918
0.59
0.466
0.91
aciomic
0.681
0.706
0.908
0LAKK
0.594
0.991
0.654
0.513
0.666
0.551
0,672
strkk
0.517
0.538
0.544
0,516
0,509
0.587
0,605
0.70
0.734
0.599
0624
0616
0.692
0.598
0
venebral
0.324
0.287
0.446
0.359
0.549
0.424
0.250
D818
0.352
0.304
0114
0317
0.645
0.825
0614
wbe
0.58%
0,50
0.714
0.9%
0.701
0.57
0.964
0.293
0.525
0.614
0,900
wine
0.525
0.759
0.85
0.540
0.594
0.990
0.700
0.5ER
0.995
0.933
ycael
0.630
0.528
0.787
0.512
0.808
0.673
0.509
0.847
0.557
0.527
0.551
0.517
0.832
Table 18: Comparison of the LLMs' AUPRC performance across three granular context types (Type E, Type F, Type G). Each column represents different LLM evaluated under the three metadata-ablation variants.
Dataset
GPT-44-miii
GPT-41
Cluude-3.7-sunnn
Qwend-2358
Gemini-2.S-pro
Type E
Type F
Type
Type
Type
Type G
Type
Type F
Type
Type E
Type
Type
Type
Type
Type G
autemobble
0.434
0.446
0.445
0.562
0.565
0.458
0.433
0.671
backdore
0.15%
0.084
0.310
0.543
0.108
0.388
0.163
0.140
0.271
0.144
0.000
0.083
0.167
compaign
0.301
0.406
0.373
0.455
0.320
0.60
0:482
0.54
0.371
0.691
0.661
cxciotocngmpply
0.420
0.479
0,516
0.548
0.623
0.495
0.588
0.447
0.544
0.651
0.153
0.150
0.173
0.170
0.232
0.455
0.377
0.566
0.167
0.346
0.427
churn
0.413
0.432
0.449
0,415
0.420
0411
0,400
0.720
0.669
0.453
0.51
0.495
0.488
0.874
0.204
cimtosis
0.627
0.655
0.701
0.606
0.559
0.644
0.699
0.828
0.831
0.629
0.799
0.009
0.504
0.816
0,922
cnvertype
0.99%
0,018
0.350
0.49
0.091
0.180
0.744
0.87
0.018
0:307
0.33
medi
0.633
0.359
0.358
0.997
0.504
0.407
0.311
0.368
0,933
equip
0.694
0.680
0.795
0.761
0.788
0.001
0.704
0.751
0887
galisione
0.573
0.597
0.525
0.593
0.587
0,60
0
0.565
0.576
0.522
0.599
0.551
0.567
0,99
glass
0.065
0.664
0,866
0.739
0.877
0851
0.714
0.585
0.789
0.779
0.672
0847
pliom
0.487
0.604
0.499
0613
0.473
0.833
0.839
0.738
0.4%4
088
quaece
0.497
0.506
0,310
0.360
0.694
0.324
0.913
0:903
0.756
0.322
0,85
seismic
0.155
0.217
0.233
0,125
0,192
0.173
0.164
0.209
0,195
0.130
0232
0.224
0.148
0.187
0.2%
stoke
0.085
0,083
0.060
0.066
0.064
0.095
0.111
0:222
0.185
0.84
0115
0.117
0.008
0.176
0,35
venebral
0.452
0.461
0.462
0,431
0,412
0.41
0:326
0,60
0.400
0411
0.383
04414
0.64
0:722
0.92
whe
0.587
0,905
0.007
0916
0.690
0.47
0:956
0.799
0.527
0.68
0.916
wine
0.416
0.431
0.465
0.687
0.919
0,204
0.767
0,987
0:983
0.546
0.465
0.988
0.957
yeast
0.215
0.134
0.307
0.120
0,129
0.398
0,220
0.355
0,403
0.154
0.139
0.394
0.138
0.129
0,616
27

---

Published as a conference paper at ICLR 2026
K SUPPLEMENTARY METRIC: FI-SCORE
In addition to the AUROC and AUPRC metrics, we also include supplementary comparison using the threshold-based Fl-score. While these metries are widely used anomaly detection for their threshold-free nature, recent work (McDermott et al., 2024) has pointed out that these metrics may not fully capture model differences under severe class imbalance.
Concretely, following the standard protocol adopted in tabular anomaly detection, including DAGMM (Zong et al., 2018) and GOAD (Bergman & Hoshen, 2020), we select the decision threshold such that the number of predicted anomalies matches the true anomaly count in the test set. This procedure aligns with common practice in the field and enables a consistent and fair comparison across baselines.
Table 19: Fi-score Performance on the ReTabAD. This table compares taining-baseee methods and our zero-shot LLM (Gemini-2.5-pryy Full Desc corresponds to the original prompt setting (Type D), and No Dese reports results without metadata descriptions (Type A).
Training- Methods
Zero-shot
Dataset
Worest
OCSVM
L.P
DeepSVDD
NeuTral.
SLAD
DIF
MCM
DRI.
Anol.I.
No Desc
Full Desc
automobile
0.476
0.548
0.571
0.714
0.571
0.595
0.524
0.643
0.619
0.524
0.762
0.667
hackdoor
0.022
0.016
0.870
0.872
0.880
0.858
0.165
0.651
0.877
0.395
0.083
0. 0.146
campaign
0.564
0.508
0.560
0.562
cardioooographyy
0.660
0.711
0.684
0.660
0.628
0.590
0.590
0.677
0.633
0.537
0.527
0.706
census
0.144
0.376
0.176
0.267
0.280
0.292
0.354
0.322
0.391
0.236
0.348
0.504
0.401
0,465
0.434
cinthosi
0,780
0.768
0.793
0.732
0.756
0.744
0.780
0.744
0.780
0.756
0.622
0.768
coverlype
0.323
0.833
0.771
0.779
0.850
0.848
0.871
0.838
0.796
0.698
0.158
0.368
credit
0.494
0.568
0.429
0.456
0.517
0,536
0.529
0.525
0.536
0.356
0.360
0.543
equip
0.879
0.918
0.920
0.914
0.919
0.915
0.909
0.920
gallstone
0,588
0.613
0.650
0.637
0.675
0.650
0.575
0.675
0.650
0.537
0.550
0.600
glass
0.804
0.824
0,852
0.804
0.863
0.804
0.784
0.824
0.725
0.783
0.647
0.784
glioma
0.671
0.708
0.679
0.374
0.666
quasar
0.805
0.830
0.874
0.886
0.854
0.840
0.634
0.850
0.766
0.888
0.6:9
0.884
seismic
0,306
0.300
0. 188
0.2944
0.212
0.288
0.318
0.229
0.341
0.306
0.255
0.253
stroke
0.273
0.244
vertebral
0.490
0,500
0,500
0.410
0.610
0.590
0.410
0.650
0.380
0.510
0.460
0.700
whe
0.893
0.899
0.893
0.921
0.669
0.848
0.663
0.893
0.904
0.798
0.787
0.910
yeast
0.463
0.516
0.411
0.411
0.453
0.453
0.389
0.463
0.368
0,400
0.347
0.684
Average
0.549
0.607
0.612
0.629
0.637
0.641
0.551
0.642
0.618
0,572
0.473
0.642
L LIMITATION OF ZERO-SHOT LLM FRAMEWORK
While semantic metadata generally improves zero-shot LLM scoring, its effectiveness can vary depending on the model's domain familiarity. For example, in cases where domain prior knowledge may be limited, we observe tendency for the model to rely more on numerical extremeness rather than interpreting the metadata as intended. We also note that metadata may contain sensitive information, so practical deployments may benefit from on-premise or private model setups to ensure that neither raw data nor metadata leaves the organization. This brief discussion intended to clarify typical considerations when applying metadata driven LLM scoring in practice.
M FURTHER DISCUSSION OF FUTURE WORK
While our benchmark primarily investigates zero-shot LLMs as the simplest architecture capable of directly consuming feature-level textual metadata, we view this as only the starting point for context-aware tabular anomaly detection. An important future direction is to extend traditional tabular AD methods- such as tree models, representation learners, or consity-based approaches- with mechanisms for integrating semantic metadata. Potential research avenues include (i) feature-text alignment modules, (ii) hybrid LLM-ML architectures that combine numerical pattern detectors with semantic reasoning, and (iii) multimodal tabular encoders that jointly embed values, schema information, and domain descriptions. We hope Re ReTabDD catalyzes these developments by providing a unified benchmark and standardized metadata resources.
28


Reviews:
[{"review_id": "7jHqDgs59d", "reviewer": "Reviewer_jF5m", "summary": "This paper focuses on providing a tabular anomaly detection benchmark, which contains more textual metadata compared to existing benchmarks. In addition, it provides a new zero-shot LLM baseline for this domain.", "questions": "Please see the weaknesses above.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "S1: The studied problem of constructing a textual tabular anomaly detection benchmark is important, and it is useful for the future research.\n\nS2: This benchmark incorporates extensive advanced and classical tabular anomaly detection baseline methods.\n\nS3: The new baseline is simple and effective. \n\nS4: The paper is clear and easy to follow.", "weaknesses": "**Datasets perspective:** \n\nW1: The benchmark comprises only 20 datasets, which is significantly fewer than established benchmarks such as ADBench (84 datasets). This limited scale may restrict the comprehensiveness and statistical power of the evaluation.\n \nW2: The decision to exclude datasets where performance is already saturated (Line 181) may be overly restrictive. While such datasets may offer limited room for performance improvement, they remain valuable for evaluating other aspects such as model interpretability, robustness, and consistency. Their exclusion could narrow the scope of the benchmark and limit its utility for holistic model assessment.\n\n\nW3: The authors will annotate anomalies for new datasets as illustrated in Line 183. However, the process for ensuring annotation accuracy and consistency is not clearly described. Is it trustable? Inaccurate anomaly labels can significantly mislead model evaluation and subsequent research.\n\nW4: It is unclear how categorical features are processed for classical and deep learning baselines. \n\n**Proposed new method perspective:**\n\nW5: Why the Gemini-2.5-pro performs such significantly better than other LLMs according to Table 4? Is there any reasonable explanations? It remains unclear whether the observed gains are due to the proposed framework or inherent model superiority. Moreover, when the LLM is set to GPT, the performance of this method is the worst among all the baseline methods.\n\n\nW6: Based on W5, it seems that the zero-shot LLM method heavily depends on the model’s pre-existing knowledge, which may limit its applicability in privacy-sensitive or domain-specific scenarios where such prior knowledge is unavailable or unreliable. In contrast, traditional methods rely solely on the data’s intrinsic distribution, offering better generalization in such settings. The authors should discuss the limitations of their approach in real-world deployments where LLM knowledge alignment cannot be assumed.\n \n\nW7: The proposed method would query LLM to output the anomaly score for each sample. This is much different from other baseline methods, which rely on training to compute the anomaly score. How to ensure the anomaly score is reliable?\n\nW8: Table 6 and Figure 4 present feature attribution results, but it is unclear whether these are based solely on Gemini-2.5-pro or averaged across multiple LLMs. To ensure the generalizability of the findings, the authors should report attribution performance across all evaluated LLMs and discuss whether the observed improvements hold consistently.\n\n\nW9: Why the reported performance is not consistent with that in their original papers? For example, MCM achieves the AUC-ROC of 0.8902 on Campaign, but the reported performance in this paper is 0.761.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "FKMl3CfrfL", "reviewer": "Reviewer_jhCt", "summary": "ReTabAD makes a significant contribution by pushing tabular anomaly detection towards a more semantic-aware paradigm, excelling particularly in benchmark construction and the design of a zero-shot LLM framework.", "questions": "The author is requested to respond to all the points mentioned under the \"Weaknesses\".", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "Provide a high-quality, resource-rich Benchmark. Innovative introduction and validation of a zero-shot LLM framework, establishing a baseline for semantic utilisation.", "weaknesses": "1. While the lack of semantic context in existing benchmarks is clearly highlighted, the paper does not sufficiently explain why traditional methods cannot be easily extended (e.g., by incorporating text embeddings) to address this gap. \n\n2. The proposed concept of the conditional distribution p(x∣M) is somewhat vague and lacks a rigorous mathematical definition or a concrete modelling framework. It serves more as a high-level conceptual goal than a formally grounded theory.\n\n3. Could the limited number of anomaly samples in certain datasets result in unstable evaluation outcomes and reduced statistical reliability?\n\n4. The reliability of the LLM-generated reasoning texts is not assessed through human evaluation or detailed error analysis. It's unclear how often the explanations are factually correct or truly insightful.\n\n5. Perform more granular ablation studies to disentangle the individual contribution of each metadata component (domain, feature description, statistics).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "96rzPNc7YU", "reviewer": "Reviewer_NrBy", "summary": "The submission makes two main contributions:\n\n - It provides augmented versions of 20 tabular anomaly detection datasets by adding detailed information around the columns, in particular, their full names and unnormalized values, textual descriptions of the meanings of the dataset and the columns, and the definitions of normality in terms of the ranges/sets of the values. This has the advantage of making evaluation textually-interpretable, enabling the use of LLMs.\n\n - A subsequent method for using an LLM in a zero-shot manner for identifying anomalies, given the textual context around a dataset.\n\nExperiments showcase the advantages of using this semantic information when prompting an LLM to identify anomalies in the proposed dataset.", "questions": "* in the prompts, it says 5th - 9th percentile for normal ranges, confirming if this is accurate? (or should it have been 5th - 95th?)", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "The augmented datasets appear thoroughly upgraded with detailed semantic information around the tabular data. The overall motivation of aligning the problem of certain anomaly detection tasks with the underlying semantics is intuitive and sensible.\n\nThe LLM-based setup is a reasonable first attempt at such zero-shot anomaly detection, when prompting LLMs for the task. The ablations are a clear demonstration of LLMs being able to use additional semantic information to improve performance at the task.", "weaknesses": "1. Perhaps the precise advantages of using LLMs in such a setting could be made clearer. \n - For instance, if we take the time to explicitly \"hardcode\" the meaning of anomalies through specifying normal ranges and detailed textual descriptions, why not equivalently write out computational filters encoding this meaning? E.g. instead of saying \"LB: Normal Range (5-95 percentile) = [118, 146]\", we could equivalently encode this with a probabilistic function that could reflect the severity of lying outside the normal range, likely with greater calibration to the semantics of the task if we use further domain knowledge to specify the normality model.  It would be truly interesting if it turned out that LLMs are aware of the gold normality model given the task specification, and internally use such a computation, but this feels very unlikely given contemporary LLM capabilities.\n - Another advantage of explicit encoding might be the interpretability of the anomaly scores; to my knowledge, LLMs are not well-recognized to output meaningfully-calibrated probabilistic scores.\n - The comparisons between the different types of prompts seems hard to disentangle, since only Type D explicitly specifies how to use the normal ranges to identify anomalies in `### Numerical Analysis`, which I'd naively expect to be very helpful.\n\n2. Anomaly detection problems aren't universally ones where the nature of the anomaly is pre-specifiable. In settings such as scientific discovery, for example, one can look for new patterns in data that weren't identified as an interesting axis of variation previously. It would be interesting if such things can be done zero-shot as well.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "lqiJxUF46o", "reviewer": "Reviewer_7nvM", "summary": "This paper proposes a novel benchmark for tabular anomaly detection, comprising 20 datasets from diverse fields, including healthcare, finance, and biology. Those datasets are provided with:\n- as little processing as possible of numerical features to preserve their semantic information, \n- categorical text restoration and, \n- useful metadata including (i) dataset-level descriptions, e.g., dataset name, purpose, description; (ii) human-readable column (feature) descriptions; (iii) label description.\n\nTo motivate these modifications and additions to the datasets, the authors test in a One-Class Classification setting, a zero-shot LLM model with and without the added metadata. Their experiments demonstrate that including this metadata significantly enhances the anomaly detection performance of different LLM models (e.g., GPT-4.1, Claude-3.7-sonnet). Additionally, the experiments conducted also emphasize how adding meta-information regarding features and the overall dataset significantly enhances the ability of the LLMs to provide interpretable results.", "questions": "**Q1**: As mentioned in **W2**, these additions to existing datasets can be relevant but are mostly targeted for LLM-based approaches that could appear as overkill when it comes to anomaly detection on tabular data. Do you have other approaches in mind, apart from LLMs, that could benefit from such augmented datasets (apart from feature engineering)?\n\n**Q2**: A core contribution of the present work also lies in **removing too easy** datasets as mentioned in **S2**. Those datasets often bias the benchmark's overall results.\nNevertheless, the proposed datasets in your benchmark still display a high average AUROC (>0.75 for all models listed in Table 3), which seems quite high. Real-life settings where OCC AD methods apply often include severely imbalanced datasets, where such metrics are rarely obtained (e.g., fraud detection). Have you considered including more severely imbalanced datasets? As shown in Table 7, very few datasets have an anomaly share of less than 10%.\n\n**Q3**: An interesting addition to Table 3, in particular for overall rank comparison, would be your vanilla LLM-based method without the metadata (Type A in Table 5).", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 4, "strengths": "**S1**: The paper is easy to follow, well-written, and properly structured.\n\n**S2**: The proposed work **addresses a relevant caveat** of existing benchmarks for tabular anomaly detection. In particular, authors emphasize the importance of favoring the quality of datasets over their quantity. As mentioned in section 3.1, the authors select datasets so that *too-easy* datasets that have previously been used in the literature are discarded.\n\n**S3**: Their extensive experiments and ablation demonstrate the relevance of including metadata in the case of LLMs.", "weaknesses": "**W1**: Some relevant and recent approaches have not been included in the benchmarks, e.g. [1, 2, 3]. It might be worth including them in the benchmark. All three models are open source, and [1,2] have been applied to the ADBench benchmark in [4].\n\n**W2**: While metadata and other additions proposed in the present work appear relevant for LLM-based AD approaches, they appear limited for pure ML-based methods.\n\n\n[1] Anomaly Detection for Tabular Data with Internal Contrastive Learning. *Tom Shenkar, Lior Wolf*. ICLR 2022\n\n[2] Beyond Individual Input for Deep Anomaly Detection on Tabular Data. *Hugo Thimonier, Fabrice Popineau, Arpad Rimmel, Bich-Liên Doan*. ICML 2024.\n\n[3] Disentangling Tabular Data Towards Better One-Class Anomaly Detection. *Jianan Ye, Zhaorui Tan, Yijie Hu, Xi Yang, Guangliang Cheng, Kaizhu Huang*. AAAI 2025\n\n[4]  DRL: Decomposed Representation Learning for Tabular Anomaly Detection. *Hangting Ye, He Zhao, Wei Fan, Mingyuan Zhou, Dan dan Guo, Yi Chang*. ICLR 2025.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)