| title | Seeing the Needle in the Haystack: Towards Weakly-Supervised Log Instance Anomaly Localization via Counterfactual Perturbation |
|---|---|
| authors | Yutszyuk Wong, Wentai Wu, Yuen-Ying Yeung, Weiwei Lin |
| date | 2026-05-09 |
| venue | arXiv (preprint, not peer reviewed) |
| id | arXiv:2605.10988 |
| affiliation | Hugging Face |
| upvotes | 4 (Hugging Face Daily Papers, 2026-11-01) |
| links | abs pdf hf code |
| abstract | Log anomaly detection is a critical task for system operations and security assurance. However, in networked systems at scale, log data are generated at massive scale while instance-level annotations are prohibitively expensive, posing great difficulties to fine-grained anomaly localization. To address this challenge, we propose LogMILP (Log anomaly localization based on Multi-Instance Learning enhanced by prototypes and Perturbation), a weakly supervised framework that enables both bag-level anomaly detection and instance-level anomaly localization using only bag-level labels. Our method guides the model to pinpoint the critical log entries using prototype-guided structural modeling with counterfactual perturbation consistency regularization, thereby improving localization reliability and interpretability under coarse-grained supervision. Experimental results on three public datasets demonstrate that LogMILP achieves competitive detection performance while yielding significantly more reliable instance-level localization. Our code is open-sourced at https://github.com/YUK1207/LogMILP. |
cite
@misc{wong2026seeing,
title={Seeing the Needle in the Haystack: Towards Weakly-Supervised Log Instance Anomaly Localization via Counterfactual Perturbation},
author={Yutszyuk Wong and Wentai Wu and Yuen-Ying Yeung and Weiwei Lin},
year={2026},
eprint={2605.10988},
archivePrefix={arXiv},
url={https://arxiv.org/abs/2605.10988}
}