Can LLM s Find a Needle in a Haystack? A Look at Anomaly Detection Language Modeling (2025)

Abstract: Anomaly detection (AD), also known as Outlier Detection, is a longstanding problem in machine learning, which has recently been applied to text data. In these datasets, a textual anomaly is a part of the text that does not fit the overall topic of the text. Some recent approaches to textual AD have used transformer models, achieving positive results but with trade-offs in pre-training time and inflexibility with respect to new domains. Others have used linear models which are fast and more flexible but not always competitive on certain datasets. We introduce a new approach based on Large Pre-trained Language Models in three modalities. Our findings indicate that LLMs beat baselines when AD is presented as an imbalanced classification problem regardless of the concentration of anomalous samples. However, their performance is markedly worse on unsupervised AD, suggesting that the concept of “anomaly” may somehow elude the LLM reasoning process.

## introduction traditional machine learning approaches to anomaly detection (ad) include proximity-based models where outliers are points that are separated from the rest of the data by a certain distance. high dimensional data was a challenge for traditional models and ad applied to textual data has gotten attention only fairly recently, with non-negative matrix factorization (nmf) approaches performing best (see @xcite , @xcite , @xcite ). most recently, transformer models @xcite and word embeddings with multi-head selfattention @xcite have been applied in textual ad models, surpassing previously top-performing reconstruction-based approaches using non-negative matrix factorization, although certain updated nmfbased approaches remain competitive @xcite . llms have recently been used in ad applied to anomalous tabular values @xcite , and anomalies in log file data @xcite but so far not to detect topically anomalous text segments consistent with the present research on ad in text. we propose a new large language model (llm)based approach to detecting these types of anomalies using three testing modalities with three different prompting techniques without fine-tuning. we show results for three llm models on three datasets. our best llm model surpasses current best-performing non-llm models on two of the three modalities. we address the following research questions: r1. how do llms compare with the current leading (non-llm) models on textual anomaly detection? r2. do llms perform better when the task is framed as highly imbalanced classification, or unlabeled general textual anomaly detection? this paper is organized as follows: previous approaches are discussed in section 2, data and methods are discussed in section 3, our results are in section 4 and the conclusion and plans for future work in section 5. ## past approaches the majority of recent textual ad studies @xcite , @xcite , @xcite , @xcite , @xcite ), treat textual anomalies as topical intrusions, where the texts from one topic constitute the "inliers" and a smaller set of intrusion texts constitute the "outliers". we use this data definition for our anomaly detection task. among such models, the currently best-performing is the transformer approach in @xcite , a discriminator-generator model that outperformed the previously top-performing ocsvm approach in @xcite . nmf-based models used in @xcite were also found to be competitive with the transformer approach on certain datasets. both approaches have consistently outperformed traditional ad models like isolation forests @xcite ) on text and at this point represent the state of the art. a similar approach to the distribution-based approaches using gaussian mixture models @xcite outperformed the transformer approach on french shorttext corpora. llms have been used for text classification with mixed results. recent studies have improved results with cot prompting @xcite , progressivereasoning-based prompting @xcite and llm ensembles @xcite . in @xcite performance on out-of-distribution detection for near-ood samples improves greatly with model size but falls short of far-ood samples, where results are state of the art. however, strong baselines for traditional models, especially on multiclass text classification, remain hard to beat. on ag news for example @xcite xlnet results reported there remain competitive. also, in @xcite the authors note that imbalanced datasets tend to be associated with worse performance, even with their boosting approach which performs well overall. this tends to suggest that llms may have difficulty with ad, especially in some of the lower outlier concentrations. a recent study on textual ad, @xcite ) provides results in a zero-shot setting with task descriptions including anomalous and baseline examples. this model showed promising results but did not compare directly with non-llm models or test fully unlabeled ad. further details on previous approaches can be found in the appendix. our study focuses on how well llms are able to find text that "does not belong", contrasting scenarios where information on the inlier and outlier classes is provided with scenarios where it is not. we compare with traditional baselines. ## proposed methods llms should in theory be well suited to the task of detecting topically anomalous sentences in a text. autoregressive models such as gpt @xcite , since they are trained to recognize likely text sequences, should assign low probabilities to unlikely ones. despite an intuitive fit, llms have been used on ad only in limited contexts and, as noted in previous research, may have difficulty with imbalanced data. for an llm approach, the problem can be treated as a classification problem with highly imbalanced data. it is unclear that the likelihoods of the outlier classes need to be taken into account as in traditional approaches to such problems. on the other hand, traditional approaches don't have the risk of hallucinated labels. we therefore use three experimental modalities in our tests in order to learn whether the concept of "textual anomaly" is something that a large language model can "understand" or whether ad in text is best handled with llms as a simple classification problem. we further try an unlabeled test to see if the llm can identify text samples that seem "unusual" in a large context of samples. ## experimental results below we describe the datasets and preparation. all models were run on three public datasets representing distinct genres (listserv, news, and wiki). we used three outlier-inlier concentrations for each. ## conclusion and future work we have run ad experiments in three modalities, on three datasets in multiple anomaly concentrations. we found that both experimental models, gpt-4o and claude-3.5-sonnet beat baselines when in binary outlier detection and multi-class topic detection modes, but all three llms performed quite poorly in unlabeled outlier discovery mode. this unexpected result suggests that llms might be a poor choice for ad in contexts where anomalous text genres may vary and where prompting may not be able to include typical inlier and outlier samples. we did not find the sensitivity to the concentrations of anomalous texts that previous studies suggested. instead we found that both experimental models are highly robust text classifiers even without fine tuning and despite the extreme imbalance characteristic of ad datasets. overall, we would continue future research on larger datasets, perhaps including real-world ad scenarios. we would also conduct further experiments with additional prompting techniques to gain a better understanding of why these models seem unable to identify text that "does not belong".