LLM as Detector: An In-context Learning Approach for Tabular Anomaly Detection

# An In-context Learning Approach for Tabular Anomaly Detection
Source: [https://arxiv.org/html/2608.19463](https://arxiv.org/html/2608.19463)
Tu Anh Hoang NguyenAffiliation:Applied Artificial Intelligence Initiative \(A2I2\), Deakin University, AustraliaE\-mail[\{joseph\.nguyen,d\.nguyen,sunil\.gupta\}@deakin\.edu\.au](mailto:{joseph.nguyen,d.nguyen,sunil.gupta}@deakin.edu.au)Dang NguyenAffiliation:Applied Artificial Intelligence Initiative \(A2I2\), Deakin University, AustraliaE\-mail[\{joseph\.nguyen,d\.nguyen,sunil\.gupta\}@deakin\.edu\.au](mailto:{joseph.nguyen,d.nguyen,sunil.gupta}@deakin.edu.au)Trung LeSunil GuptaAffiliation:Applied Artificial Intelligence Initiative \(A2I2\), Deakin University, AustraliaE\-mail[\{joseph\.nguyen,d\.nguyen,sunil\.gupta\}@deakin\.edu\.au](mailto:{joseph.nguyen,d.nguyen,sunil.gupta}@deakin.edu.au)

###### Abstract

Anomaly detection in tabular data is challenging because abnormal samples often arise as violations of cross\-feature dependencies rather than simple marginal deviations\. Existing detectors rely on geometric or reconstruction signals, while prior LLM\-based approaches mainly fine\-tune LLMs with normal samples or generate synthetic anomalies\. We proposeLLM\-Detector, a framework that utilizes the in\-context learning capacity of LLMs for structured, prompt\-conditioned scoring synthesis, enabling LLMs to derive anomaly detection logic from structured normal\-state knowledge\. Specifically, normal training data are converted into statistical summaries, causal dependencies, and distilled prototypes that are organized into a prompt for code generation\. The resulting scoring engine evaluates statistical deviation, structural inconsistency, and density\-based abnormality then computes an anomaly score for each test sample\. We evaluate LLM\-Detector on 24 tabular datasets, comparing against 15 SOTA baselines\. Results show consistent improvements across both mixed\-type and continuous\-only settings\. Moreover, this design eliminates the need for LLM fine\-tuning or neural network training, reducing computational cost and enabling practical anomaly detection in real\-world tabular systems\.

###### Keywords:

Tabular Anomaly Detection Large Language Models In\-context Learning

## 1Introduction

Tabular Anomaly Detection\(TAD\) is crucial in domains such as finance, healthcare, and cybersecurity\[[9](https://arxiv.org/html/2608.19463#bib.bib21)\], where detecting abnormal records can prevent costly failures or risks\. In practice, anomaly labels are rare and expensive, leading to highly imbalanced settings where models are typically trained only on normal data asunsupervisedtask\. Tabular data also presents intrinsic challenges due to mixed feature types, heterogeneous scales, and the absence of spatial or sequential inductive structure that many learning methods rely on\[[15](https://arxiv.org/html/2608.19463#bib.bib22)\]\. Moreover, anomalies often appear locally plausible but violate cross\-feature dependencies or domain mechanisms\. As a result, abnormality in tabular data is frequently structural and relational rather than purely numerical, making reliable detection inherently challenging\.

Most existing TAD methods are reconstruction\-based approaches that learn representations of normal data and detect anomalies through reconstruction error\[[24](https://arxiv.org/html/2608.19463#bib.bib29),[12](https://arxiv.org/html/2608.19463#bib.bib13),[25](https://arxiv.org/html/2608.19463#bib.bib17)\]\. While effective at capturing numeric deviation, these methods primarily focus on reconstruction fidelity and rarely enforce explicit consistency across features\. More broadly, many detection paradigms treat anomalies as distant points, relying heavily on density sparsity\. However, anomalies in tabular data often remain numerically plausible while violating relational dependencies between variables\. In addition, common pre\-processing for mixed\-type data such as encoding categorical variables can distort semantic meaning and weaken domain reasoning\. Consequently, effective TAD requires reasoning beyond purely numeric deviation\[[26](https://arxiv.org/html/2608.19463#bib.bib23)\]\.

Motivated by these limitations, recent studies have begun exploring Large Language Models \(LLMs\) for TAD, with AnoLLM\[[30](https://arxiv.org/html/2608.19463#bib.bib19)\]and LLM\-DAS\[[32](https://arxiv.org/html/2608.19463#bib.bib20)\]being the only representative LLM\-based approaches to date\. AnoLLM directly applies LLMs as anomaly classifiers, enabling mixed\-type attributes to be represented through textual context and semantic relations across features\. However, this strategy suffers from high computational cost and inefficient per\-sample inference\. LLM\-DAS mitigates this issue by generating hard anomalous samples for conventional detectors, but its numerical backbones still encode categorical attributes, risking semantic loss\. As shown in Figure[1](https://arxiv.org/html/2608.19463#S1.F1), neither approach simultaneously supports categorical handling, computational efficiency, and causal modeling, motivating a deeper question:Can anomaly detection instead emerge through in\-context reasoning over structured normal\-state knowledge?

![Refer to caption](https://arxiv.org/html/2608.19463v1/AnoDasDetector.png)Figure 1:Comparison of LLM\-based TAD methods across categorical handling, computational efficiency, and causal modeling\.To explore this question, we proposeLLM\-Detector, a framework that leverages in\-context learning without requiring LLM fine\-tuning, to synthesize an executable anomaly detection engine from structured normal\-state knowledge\. LLM\-Detector consists of two phases\. First, statistical profiles, causal relations, and representative prototypes are extracted from normal training data and organized into a structured prompt that induces the scoring logic\. The LLM then generates a deterministic program implementing this detection mechanism\. Second, the synthesized program evaluates unseen samples by aggregating statistical deviation, structural inconsistency, and density\-based abnormality signals to produce anomaly scores\. This design enables anomaly detection through context\-guided code generation rather than model training\.

Our contributionsare summarized as follows:

\(1\) We introduce LLM\-Detector, a framework that treats LLMs as anomaly detectors by inducing executable scoring logic through in\-context learning from structured normal\-state knowledge, without LLM training/fine\-tuning\.

\(2\) We formalize a structured factorization of normal\-state knowledge, demonstrating that injecting statistical profiles, causal relations, and representative prototypes into the prompt enables the generation of causal\-structure\-guided scoring logic\.

\(3\) We perform extensive evaluations on 24 diverse tabular benchmarks, showing that the proposed framework achieves stronger detection performance than SOTA statistical, deep learning, and recent LLM\-based methods\.

## 2Related Works

### 2\.1Unsupervised Anomaly Detection for Tabular Data

Tabular anomaly detection \(TAD\) identifies atypical records inunlabeleddatasets arising in many real\-world domains\. Since anomaly labels are scarce and often unreliable, most practical approaches operate in theunsupervisedsetting\. Existing methods typically detect anomalies by modeling the distribution of normal data and identifying samples that deviate from it\. Classical approaches include proximity\-based methods such as KNN\[[21](https://arxiv.org/html/2608.19463#bib.bib9)\], Isolation Forest\[[13](https://arxiv.org/html/2608.19463#bib.bib1)\], PCA\[[27](https://arxiv.org/html/2608.19463#bib.bib8)\]and ECOD\[[11](https://arxiv.org/html/2608.19463#bib.bib10)\]\. More recent work leverages representation learning and deep models, including DeepSVDD\[[23](https://arxiv.org/html/2608.19463#bib.bib11)\]and GOAD\[[2](https://arxiv.org/html/2608.19463#bib.bib15)\], as well as reconstruction or generation\-based methods as REPEN\[[18](https://arxiv.org/html/2608.19463#bib.bib12)\], NeuTraL\[[19](https://arxiv.org/html/2608.19463#bib.bib16)\], SLAD\[[31](https://arxiv.org/html/2608.19463#bib.bib14)\], and AnoGAN\[[24](https://arxiv.org/html/2608.19463#bib.bib29)\]\. More recently, CausalAno\[[17](https://arxiv.org/html/2608.19463#bib.bib6)\]models causal dependencies to detect anomalies arising from mechanism violations\. Despite their differences, these approaches largely rely on marginal deviation or density sparsity, which limits their ability to capture relational inconsistencies among features\.

### 2\.2Large Language Models for Tabular Data Learning

Recent studies have explored LLMs for learning from tabular data by converting structured rows into textual representations and leveraging contextual reasoning\[[3](https://arxiv.org/html/2608.19463#bib.bib30)\]\. Beyond analysis tasks, LLMs have also been applied to tabular data synthesis\[[3](https://arxiv.org/html/2608.19463#bib.bib30),[16](https://arxiv.org/html/2608.19463#bib.bib24)\]\. More recently, AnoLLM\[[30](https://arxiv.org/html/2608.19463#bib.bib19)\]applies LLMs to detect anomalies in tabular data through model fine\-tuning on normal samples\. Similarly, LLM\-DAS\[[32](https://arxiv.org/html/2608.19463#bib.bib20)\]leverages LLMs to synthesize hard anomalous samples to improve conventional detectors\. However, these approaches mainly use LLMs as predictors or data generators, leaving the role of LLMs in constructing executable detection mechanisms largely unexplored\.

## 3Framework

### 3\.1Problem Formulation

Following previous works\[[24](https://arxiv.org/html/2608.19463#bib.bib29),[14](https://arxiv.org/html/2608.19463#bib.bib18),[30](https://arxiv.org/html/2608.19463#bib.bib19)\], we investigate the problem ofunsupervisedTAD, utilizing a normal training setDnormal=\{xi\}i=1ND\_\{\\text\{normal\}\}=\\\{x\_\{i\}\\\}\_\{i=1\}^\{N\}composed entirely ofNNnormal samples wherexi∈ℝdx\_\{i\}\\in\\mathbb\{R\}^\{d\}consists of numerical or categorical features\. The task involves evaluating a test setDtest=\{\(xj′,yj′\)\}j=1MD\_\{\\text\{test\}\}=\\\{\(x^\{\\prime\}\_\{j\},y^\{\\prime\}\_\{j\}\)\\\}\_\{j=1\}^\{M\}, where the labelyj′∈\{0,1\}y^\{\\prime\}\_\{j\}\\in\\\{0,1\\\}identifies a normal sample ifyj′=0y^\{\\prime\}\_\{j\}=0and an anomaly ifyj′=1y^\{\\prime\}\_\{j\}=1\. Our goal is to induce \(without backpropagation or model fine\-tuning\) an executable scoring functions:ℝd→ℝs:\\mathbb\{R\}^\{d\}\\rightarrow\\mathbb\{R\}from structured normal\-state knowledge extracted fromDnormalD\_\{\\text\{normal\}\}, which assigns higher scores to anomalous instances inDtestD\_\{\\text\{test\}\}\.

### 3\.2Proposed Method: LLM\-Detector

We propose LLM\-Detector, a framework that harnesses the in\-context learningcapabilities of LLMs to automate the synthesis of domain\-specific anomaly detection engines\. In our framework, in\-context learning is treated as a code synthesis mechanism\. The LLM is not fine\-tuned; instead, it is conditioned on a compact prompt composed of normal\-state knowledge and scoring instructions\. Specifically, the prompt injectspstatsp\_\{\\text\{stats\}\},pcausalp\_\{\\text\{causal\}\}, andpdistillp\_\{\\text\{distill\}\}, together with explicit component\-wise scoring rules, into the LLM context\. The LLM then transforms these four prompt elements into an executable Python scoring engine that computesSoutlierS\_\{\\text\{outlier\}\},ScausalS\_\{\\text\{causal\}\}, andSdensityS\_\{\\text\{density\}\}for each test sample\. The model output is not a label prediction, but a deterministic algorithm for calculating anomaly scores\.

![Refer to caption](https://arxiv.org/html/2608.19463v1/framework_ECML_v2.png)Figure 2:Our frameworkLLM\-Detector\. It has two phases: \(1\)Knowledge\-to\-Codeextracts statistical profiles, causal structure, and distilled prototypes from normal data to construct a structured prompt, and \(2\)Code\-to\-Scoregenerates a scoring engine executed on test samples to compute anomaly scores\.As illustrated in Figure[2](https://arxiv.org/html/2608.19463#S3.F2), our method operates via a two\-phase pipeline that cleanly decouples the construction of a knowledge\-dense prompt from the execution of a standalone scoring engine\. This design provides several practical advantages\. Since the LLM operates entirely through prompt\-conditioned synthesis, LLM\-Detector does not require model training or fine\-tuning\. It also avoids heavy pre\-processing pipelines and allows the generated scoring engine to be applied directly toDtestD\_\{\\text\{test\}\}\. Moreover, the prompt incorporates structured knowledge derived from the normal state rather than directly transmitting the full normal\-sample dataset, thereby reducing data\-leakage risks\. As a result, our method remains lightweight, privacy\-aware, and generalizable across domains\.

#### Knowledge\-to\-Code: Prompt Construction and Code Generation

The primary objective of this phase is to convert the normal dataDnormalD\_\{\\text\{normal\}\}into a compact “normal\-state knowledge package”\. By utilizing the LLM in azero\-shot capacity, we drive the synthesis of an executable scoring engine without altering any model weights or requiring specialized GPU clusters for training\. To formalize this zero\-shot synthesis process, we structure the code\-generation request into three functional components:

pcode=pdescription\+pobjective\+prequirementsp\_\{\\text\{code\}\}=p\_\{\\text\{description\}\}\+p\_\{\\text\{objective\}\}\+p\_\{\\text\{requirements\}\}\(1\)
##### Descriptionpdescriptionp\_\{\\text\{description\}\}

The description component encodes dataset\-derived normal\-state knowledge that the generated scoring engine must operationalize\. It encodes dataset\-derived normal\-state knowledge extracted fromDnormalD\_\{\\text\{normal\}\}, defining the informational foundation upon which the scoring logic is constructed\.

The description component is further decomposed as:

pdescription=pstats\+pcausal\+pdistillp\_\{\\text\{description\}\}=p\_\{\\text\{stats\}\}\+p\_\{\\text\{causal\}\}\+p\_\{\\text\{distill\}\}\(2\)
This factorization makes explicit how each score term is grounded in a corresponding knowledge source extracted fromDnormalD\_\{\\text\{normal\}\}\.

\(i\) Statistical profilepstatsp\_\{\\text\{stats\}\}

We summarize the marginal behavior of each feature into a statistical profilepstatsp\_\{\\text\{stats\}\}, fixing the expected feature identities and dimensionality for the scoring engine\. For each featureXiX\_\{i\}, we define a per\-feature profileϕi\\phi\_\{i\}and store either numerical statistics with empirical bounds or categorical empirical probabilities, as specified in Equation[3](https://arxiv.org/html/2608.19463#S3.E3)\.

ϕi=\{\(μi,σi2,\[m​i​ni,m​a​xi\]\)if​Xi​is numerical\{πc\}c∈𝒞iif​Xi​is categorical,\\phi\_\{i\}=\\left\\\{\\begin\{array\}\[\]\{ll\}\(\\mu\_\{i\},\\sigma\_\{i\}^\{2\},\[min\_\{i\},max\_\{i\}\]\)&\\text\{if \}X\_\{i\}\\text\{ is numerical\}\\\\\[4\.0pt\] \\\{\\pi\_\{c\}\\\}\_\{c\\in\\mathcal\{C\}\_\{i\}\}&\\text\{if \}X\_\{i\}\\text\{ is categorical\}\\end\{array\}\\right\.,\(3\)whereμi\\mu\_\{i\},σi2\\sigma\_\{i\}^\{2\},m​i​nimin\_\{i\}, andm​a​ximax\_\{i\}are mean, variance, minimum value, and maximum value of the continuous featureXiX\_\{i\}whileπc\\pi\_\{c\}is a proportion of a categoryccin the domainCiC\_\{i\}of a categorical featureXiX\_\{i\}\.

\(ii\) Causal knowledgepcausalp\_\{\\text\{causal\}\}

We represent the feature dependency in the normal dataDnormalD\_\{\\text\{normal\}\}by a causal graph \(DAG\)𝒢\\mathcal\{G\}over featuresX=\{X1,…,Xd\}X=\\\{X\_\{1\},\\ldots,X\_\{d\}\\\}, where each nodeXiX\_\{i\}is associated with a parent setPA⁡\(Xi\)\\mathrm\{PA\}\(X\_\{i\}\)capturing its conditional relations\. We apply the Peter\-Clark \(PC\) algorithm\[[28](https://arxiv.org/html/2608.19463#bib.bib28)\]to an encoded and normalized representation ofDnormalD\_\{\\text\{normal\}\}to estimate𝒢\\mathcal\{G\}, using an adaptive independence\-testing strategy to avoid degenerate outputs\. These parent\-child relations expose cross\-feature constraints, helping the LLM induce implicit rules for code\-based scoring\.

\(iii\) Distilled samplespdistillp\_\{\\text\{distill\}\}

![Refer to caption](https://arxiv.org/html/2608.19463v1/p_distill_v2.png)Figure 3:Prototype distillation via K\-Means and nearest\-neighbor \(NN\) mapping\.Since in\-context learning is constrained by the finite context window of LLMs, which limits the number of demonstrations that can be included in a prompt\[[4](https://arxiv.org/html/2608.19463#bib.bib7)\], we distillDnormalD\_\{\\text\{normal\}\}intoNdistillN\_\{\\text\{distill\}\}representative prototypes to provide a compact yet informative summary of the normal data distribution\. As illustrated in Figure[3](https://arxiv.org/html/2608.19463#S3.F3), we first encode and normalize the normal set into a consistent continuous spaceDnormalencD\_\{\\text\{normal\}\}^\{\\text\{enc\}\}, perform K\-Means clustering to obtainNdistillN\_\{\\text\{distill\}\}centroids, then map each centroid to its nearest normal instance via the nearest\-neighbor \(NN\) operator\. We perform the mapping step to make sure each prototype is a valid real normal sample\. The resulting subsetpdistillp\_\{\\text\{distill\}\}serves as geometry anchors for covariance estimation and low\-density assessment, enabling Mahalanobis\-style multivariate deviation checks in the scoring engine\. Formally, we derivepdistillp\_\{\\text\{distill\}\}via:

pdistill=NN⁡\(K​\-​Means​\(Dnormalenc,Ndistill\),Dnormalenc\)p\_\{\\text\{distill\}\}=\\mathrm\{NN\}\\\!\\big\(\\mathrm\{K\\text\{\-\}Means\}\(D\_\{\\text\{normal\}\}^\{\\text\{enc\}\},N\_\{\\text\{distill\}\}\),\\,D\_\{\\text\{normal\}\}^\{\\text\{enc\}\}\\big\)\(4\)

##### Objectivepobjectivep\_\{\\text\{objective\}\}

Building upon the injected structured normal\-state knowledge, the LLM is instructed to generate an end\-to\-end Python scoring engine rather than labels or narrative analysis\. The output must translate the provided knowledge into explicit computations\. The engine maps eachunseentest samplexxto a continuous anomaly score in\[0,100\]\[0,100\], where00denotes perfectly normal behavior and100100denotes extreme abnormality\. The output score is calibrated and comparable across samples to keep the logic deterministic and grounded in the injected normal\-state knowledge\.

##### Requirementsprequirementsp\_\{\\text\{requirements\}\}

To ensure faithful use of the injected normal\-state knowledge, we constrain both score computation and program structure:

- •Score decomposition\.The engine shall compute a single continuous anomaly score by aggregating scores of three prescribed terms, as specified inpdescriptionp\_\{\\text\{description\}\}\.
- •Budgeted components\.Each term shall be allocated a fixed score budget to control its contribution and prevent dominance by any single component\.
- •Bounded output\.The aggregated score shall be properly bounded within\[0,100\]\[0,100\]to preserve calibration and comparability across samples\.
- •Callable interface\.The code shall defineevaluate\_anomalies\(new\_samples\)that takes a pandas DataFrame and returns ananomaly\_score\.
- •Embedded knowledge\.All injected normal\-state knowledge shall be embedded directly to ensure deterministic test\-time execution\.

After assemblingpcodep\_\{\\text\{code\}\}, the complete prompt \(containing description, objective, and requirements\) is submitted to the LLM as a code\-generation request\. The LLM returns executable Python code that directly implements the scoring logic based on the provided statistics, causal graph, and representative samples\. The generated program contains explicit mathematical operations rather than placeholders or learned parameters\. As no fine\-tuning is performed, the LLM serves purely as a deterministic code synthesizer\. The full prompt template is provided inAppendix 4\.

#### Code\-to\-Score: Test\-Time Inference and Anomaly Scoring

At test time, the synthesized Python scoring engine is executed on an unlabeled feature matrixXtestX\_\{\\text\{test\}\}that follows the same feature schema and types defined in the injected normal\-state knowledge\. Note that no information fromDtestD\_\{\\text\{test\}\}is used to modify the scoring logic\.

For each test samplex∈Dtestx\\in D\_\{\\text\{test\}\}, the final anomaly score is computed as the aggregation of three score\-components:

S⁡\(x\)=Soutlier​\(x\)\+Scausal​\(x\)\+Sdensity​\(x\)\.S\(x\)=S\_\{\\text\{outlier\}\}\(x\)\+S\_\{\\text\{causal\}\}\(x\)\+S\_\{\\text\{density\}\}\(x\)\.\(5\)
Outlier score\-componentSoutlierS\_\{\\text\{outlier\}\}:Guided by the statistical profile in Equation[3](https://arxiv.org/html/2608.19463#S3.E3), this component measures marginal outlierness\. For a continuous featureXiX\_\{i\}, the engine first computes a standardized deviation scorezi=\|xi−μi\|σiz\_\{i\}=\\frac\{\|x\_\{i\}\-\\mu\_\{i\}\|\}\{\\sigma\_\{i\}\}, whereμi\\mu\_\{i\}andσi\\sigma\_\{i\}are obtained from the normal\-state profile\. Larger deviations receive progressively higher penalties, while values outside the empirical range\[m​i​ni,m​a​xi\]\[min\_\{i\},max\_\{i\}\]are strongly penalized as out\-of\-support observations\. For a categorical feature, the penalty is determined by its empirical normal probabilityπc\\pi\_\{c\}, with rare or unseen categories receiving high risk scores\. The resulting per\-feature penalties are aggregated and rescaled to a fixedSoutlierS\_\{\\text\{outlier\}\}budget, yielding a bounded marginal\-outlierness score\.

Causal violation score\-componentScausalS\_\{\\text\{causal\}\}:This component checks whether a test sample breaks the dependency structure encoded by the discovered DAG\. For each child featureXiX\_\{i\}, the engine first derives an abnormality indicatorai​\(xi\)a\_\{i\}\(x\_\{i\}\)from its feature\-level deviation, where larger values indicate stronger evidence thatXiX\_\{i\}is abnormal\. The parent condition is summarized asaPA⁡\(i\)​\(x\)=maxXj∈PA⁡\(Xi\)⁡aj​\(xj\)a\_\{\\mathrm\{PA\}\(i\)\}\(x\)=\\max\_\{X\_\{j\}\\in\\mathrm\{PA\}\(X\_\{i\}\)\}a\_\{j\}\(x\_\{j\}\)\. A causal violation is detected whenai​\(xi\)\>τca\_\{i\}\(x\_\{i\}\)\>\\tau\_\{c\}andaPA⁡\(i\)​\(x\)≤τpa\_\{\\mathrm\{PA\}\(i\)\}\(x\)\\leq\\tau\_\{p\}, whereτc\\tau\_\{c\}andτp\\tau\_\{p\}denote the child\-abnormality and parent\-normality thresholds, respectively\. This means that the child enters an abnormal state while its causal parents remain normal, indicating a broken conditional dependency\. Such violations receive structural penalties, which are aggregated and rescaled to the fixed Scausal\{\}\_\{\\text\{causal\}\}budget\.

Density score\-componentSdensityS\_\{\\text\{density\}\}: This component checks whether a test sample lies in a low\-density region of the normal\-state distribution\. Using the representative normal samples, the engine estimates the empirical mean vectorμ\\muand covariance matrixΣ\\Sigmaover continuous features, then computes the Mahalanobis distancedM​\(x\)=\(x−μ\)⊤​Σ−1​\(x−μ\)d\_\{M\}\(x\)=\\sqrt\{\(x\-\\mu\)^\{\\top\}\\Sigma^\{\-1\}\(x\-\\mu\)\}\. This distance captures correlation\-aware multivariate deviation from the normal manifold\. Larger distances receive higher penalties, which are scaled and bounded within the fixedSdensityS\_\{\\text\{density\}\}budget\.

Each score\-componentSoutlierS\_\{\\text\{outlier\}\},ScausalS\_\{\\text\{causal\}\}, andSdensityS\_\{\\text\{density\}\}operates within a predefined score allocation, ensuring that statistical deviation, causal inconsistency, and density\-based abnormality contribute in a controlled and interpretable manner\. The aggregated scoreS⁡\(x\)S\(x\)is subsequently bounded to a fixed range to guarantee comparability across samples, datasets, and experimental runs\.

The engine outputs a continuous anomaly scoreS⁡\(x\)S\(x\)between 0 and 100 for each test sample, where larger scores indicate stronger abnormality\. The labels \(0 for normal and 1 for anomalous\) are used only for evaluation \(e\.g\., computing AUC\-ROC\) and never used for score construction, hyper\-parameter tuning, or rule design, preserving the unsupervised, in\-context learning setting\.

A critical advantage of LLM\-Detector is that the LLM is not merely instantiating a static template\. Unlike manually engineered detectors with fixed, universally applied scoring logic, the LLM dynamically synthesizes dataset\-specific anomaly programs conditioned on the provided statistical, structural, and prototype knowledge\. By processing mixed\-type attributes and causal graphs through textual context, the LLM adapts categorical handling, feature interactions, and component calibration to the semantic characteristics of each unique dataset–bridging the gap between raw statistical data and executable, causal\-aware detection rules without requiring handcrafted algorithm design\.

## 4Experiments

### 4\.1Experimental Setups

#### Datasets

We evaluate our method on 24 anomaly detection datasets, following standard protocols in prior works\[[14](https://arxiv.org/html/2608.19463#bib.bib18),[30](https://arxiv.org/html/2608.19463#bib.bib19),[32](https://arxiv.org/html/2608.19463#bib.bib20)\]\. The benchmark combines datasets from Outlier Detection DataSets \(ODDS\)\[[22](https://arxiv.org/html/2608.19463#bib.bib25)\], Anomaly Detection Benchmark \(ADBench\)\[[8](https://arxiv.org/html/2608.19463#bib.bib26)\], and Kaggle\.

Overall, our benchmark datasets include 12 mixed\-type datasets \(with categorical and continuous features\) and 12 continuous\-only datasets\. These datasets span diverse domains–such as healthcare, finance, cybersecurity, and social sciences–and vary in both dimensionality and scale, covering settings from small, low\-dimensional data to larger, high\-dimensional scenarios\. Table[1](https://arxiv.org/html/2608.19463#S4.T1)shows details of 12 mixed\-type datasets while the characteristics of 12 continuous\-only datasets are reported inAppendix 1\.

Table 1:Statistics for 12 mixed\-type datasets\.dc​a​td\_\{cat\},dc​o​nd\_\{con\}, andNaN\_\{a\}denote the numbers of categorical features, continuous features, and anomalies\.Lymp\(Lymphography\),ACD\(Cybersecurity\), andFraud\(Fraud ecommerce\) are from\[[22](https://arxiv.org/html/2608.19463#bib.bib25),[5](https://arxiv.org/html/2608.19463#bib.bib27),[7](https://arxiv.org/html/2608.19463#bib.bib31)\]whileSPD\(Spyware\-Attacks\),DAMRE\(Damage\-Report\),OS\(OS\-Kernel\),SMD\(Smart\-Meter\), andVifd\(Vehicle insurance\) are from Kaggle\.
#### Evaluation Metrics

To maintain consistency with other TAD papers, we adopt the same data partitioning strategy commonly used in the literature\[[2](https://arxiv.org/html/2608.19463#bib.bib15),[14](https://arxiv.org/html/2608.19463#bib.bib18),[30](https://arxiv.org/html/2608.19463#bib.bib19)\]\. Specifically, 50% of the normal samples are randomly selected to form the normal setDnormalD\_\{\\text\{normal\}\}, while the remaining 50% of normal samples are merged with all available anomalies to construct the test setDtestD\_\{\\text\{test\}\}\.

For evaluation, we use the AUC\-ROC metric, following the standard reporting practices\[[8](https://arxiv.org/html/2608.19463#bib.bib26),[14](https://arxiv.org/html/2608.19463#bib.bib18),[30](https://arxiv.org/html/2608.19463#bib.bib19)\]\. This metric assesses the model’s ability to distinguish between normal and anomalous samples by measuring ranking performance across all possible decision thresholds\. We also report the F1\-score inAppendix 3\.

#### Baseline Methods

We compare our approach LLM\-Detector against 15 SOTA methods spanning classical algorithms, deep representation learning, self\-supervised techniques, generative models, and recent LLM\-based detectors\. The compared methods include IForest\[[13](https://arxiv.org/html/2608.19463#bib.bib1)\], KNN\[[21](https://arxiv.org/html/2608.19463#bib.bib9)\], PCA\[[27](https://arxiv.org/html/2608.19463#bib.bib8)\], ECOD\[[11](https://arxiv.org/html/2608.19463#bib.bib10)\], DeepSVDD\[[23](https://arxiv.org/html/2608.19463#bib.bib11)\], REPEN\[[18](https://arxiv.org/html/2608.19463#bib.bib12)\], RCA\[[12](https://arxiv.org/html/2608.19463#bib.bib13)\], SLAD\[[31](https://arxiv.org/html/2608.19463#bib.bib14)\], GOAD\[[2](https://arxiv.org/html/2608.19463#bib.bib15)\], NeuTraL\[[19](https://arxiv.org/html/2608.19463#bib.bib16)\], ICL\[[25](https://arxiv.org/html/2608.19463#bib.bib17)\], DTE\[[14](https://arxiv.org/html/2608.19463#bib.bib18)\], AnoGAN\[[24](https://arxiv.org/html/2608.19463#bib.bib29)\], AnoLLM\[[30](https://arxiv.org/html/2608.19463#bib.bib19)\], and LLM\-DAS\[[32](https://arxiv.org/html/2608.19463#bib.bib20)\]\.

For fairness and reproducibility, we rely on their widely used public implementations\. Thirteen baselines \(from IForest to AnoGAN\) are executed through the PyOD library, while AnoLLM and LLM\-DAS are evaluated using their released source codes\. All methods are trained and tested under identical data splits, pre\-processing steps, and evaluation metrics\.

#### Implement Details

For the code generation phase, we utilize Gemini\-3\.0 to synthesize the executable Python scoring engine\. To ensure a representative yet compact knowledge package, the number of distilled samples is fixed atNdistill=min​\(100,N\)N\_\{\\text\{distill\}\}=\\text\{min\}\(100,N\)\. This distillation strategy captures the multivariate geometry while maintaining prompt efficiency\. To mitigate the inherent stochasticity of the LLM and ensure performance stability, each experiment is repeated three times using different random seeds\. We report the average performance result along with its standard deviation\.

### 4\.2Results and Analysis

#### Results on Mixed\-type Datasets

Table[2](https://arxiv.org/html/2608.19463#S4.T2)reports AUC\-ROC on 12 mixed\-type datasets\. Overall, LLM\-based methods consistently outperform classical statistical and deep representation\-based approaches, achieving consistently higher average AUC\-ROC scores\. This trend highlights the advantage of textual representation for modeling heterogeneous mixed\-type tabular data, where capturing interactions between continuous and categorical variables is critical\.

LLM\-based methods such as AnoLLM \(0\.6972\) and LLM\-DAS \(0\.6900\) demonstrate clear improvements over non\-LLM baselines\. However, our method LLM\-Detector further advances this line of work, achieving the highest average AUC\-ROC of 0\.7407 \(5% better than the second\-best method AnoLLM\)\. This margin confirms that explicitly structuring statistical, causal, and representative normal\-state knowledge within the prompt leads to more robust and stable performance across mixed\-type datasets\. Notably, our LLM\-Detector does not fine\-tune/train LLMs, running much faster than AnoLLM as shown in a later ablation study\.

Table 2:AUC\-ROC scores for all methods on 12 mixed\-type datasets\.Boldandunderlineindicate the best and second\-best methods\. Standard deviations are reported inAppendix 2\.
#### Results on Continuous Datasets

Figure[4](https://arxiv.org/html/2608.19463#S4.F4)shows that on continuous datasets, the overall performance gap is narrower than in mixed\-type settings, with several classical and deep methods achieving strong AUC\-ROC scores around 0\.85\-0\.91\. Nevertheless, LLM\-based methods remain competitive, and our LLM\-Detector attains the top\-tier performance \(0\.91\)\. Compared with AnoLLM and LLM\-DAS, LLM\-Detector is slightly better, demonstrating that the structured Knowledge\-to\-Code design generalizes effectively to fully continuous feature spaces\.

Figure 4:AUC\-ROC comparison on 12 continuous datasets across all 15 methods\. The color scheme is:yellow\(proximity\-based\),green\(distribution\-based\),blue\(boundary\-based\),purple\(reconstruction/generation\-based\),navy\(LLM\-based\),red\(ours\)\.Across both mixed\-type and continuous datasets, our LLM\-Detector achieves the highest average AUC\-ROC with a deterministic scoring engine designed from structured statistical, causal, and distilled knowledge, enabling robust anomaly detection through principled in\-context learning code generation \(without detector parameter training or LLM fine\-tuning\)\.

### 4\.3Ablation Study

#### Knowledge in the Description Componentpdescriptionp\_\{\\text\{description\}\}

We study the impact of three types of knowledge inpdescriptionp\_\{\\text\{description\}\}over the 12 mixed\-type datasets \(Figure[5](https://arxiv.org/html/2608.19463#S4.F5)\)\. Using causal knowledge only yields the lowest performance \(0\.5902\), which is expected since the LLM receives only structural relations without sufficient information about feature distributions or even feature types \(continuous vs\. categorical\)\. Without marginal context, the model cannot reliably quantify abnormality\. In contrast, statistics achieves the best single\-component result \(0\.7112\), as marginal deviation provides a direct and stable anomaly signal\.

Figure 5:Ablation study of three types of knowledge in the description component on 12 mixed\-type datasets\.Combining statistics information with causal knowledge improves AUC\-ROC to 0\.7245, suggesting that anomalies are not only distant from marginal norms but can also violate the dependency mechanisms\. Adding distilled samples further captures sample\-level multivariate structure beyond feature\-wise summaries, enabling covariance estimation and Mahalanobis\-distance geometry checks\. Together, these three knowledge achieve the highest average AUC\-ROC of 0\.7407\.

#### LLM Backbones

To examine the impact of different LLM foundation models, we evaluate LLM\-Detector using DeepSeek V3\.2, GPT\-5\.2, and our default backbone Gemini\-3\.0\. Figure[6](https://arxiv.org/html/2608.19463#S4.F6)reports the average AUC\-ROC across 12 mixed\-type datasets\. All backbones yield competitive results, confirming that the proposed Knowledge\-to\-Code framework is model\-agnostic\. Namely, DeepSeek V3\.2 achieves 0\.7069, GPT\-5\.2 improves to 0\.7217, and Gemini\-3\.0 attains the highest performance at 0\.7407\. We attribute the Gemini\-3\.0’s superior results to its stronger long\-context reasoning and more reliable code synthesis\[[20](https://arxiv.org/html/2608.19463#bib.bib32)\], which better preserve the structured statistical, causal, and distilled knowledge embedded in the prompt\. Overall, stronger backbone reasoning improves detection accuracy, while the stable performance across models shows that the main gains come from the Knowledge\-to\-Code design rather than backbone\-specific selection\.

Figure 6:Sensitivity to three LLM backbones \(DeepSeek, GPT, and Gemini\) over 12 mixed\-type datasets\.
#### The Number of Distilled Samples

We analyze the effect of varying the number of distilled normal prototypesNdistillN\_\{\\text\{distill\}\}on the 12 mixed\-type datasets\. Figure[7](https://arxiv.org/html/2608.19463#S4.F7)reports the average AUC\-ROC asNdistillN\_\{\\text\{distill\}\}increases from 5 to 200\. With fewer than 100 distilled samples, performance remains noticeably lower, indicating that insufficient prototypes fail to adequately capture the multivariate geometry of the normal state\. Performance improves steadily asNdistillN\_\{\\text\{distill\}\}increases to 100, after which the gains stabilize\. Using 150 or 200 distilled samples yields nearly identical AUC\-ROC to 100, suggesting diminishing returns\. More importantly, our method LLM\-Detector consistently outperforms AnoLLM and LLM\-DAS acrossNdistillN\_\{\\text\{distill\}\}values\.

Figure 7:Sensitivity to the number of distilled samples over 12 mixed\-type datasets\.
#### Effect of Causal Discovery Methods

To further examine the role of causal discovery method in our framework, we compare PC with four alternative methods: BOSS\[[1](https://arxiv.org/html/2608.19463#bib.bib2)\], FCI\[[29](https://arxiv.org/html/2608.19463#bib.bib3)\], GES\[[6](https://arxiv.org/html/2608.19463#bib.bib4)\], and GRaSP\[[10](https://arxiv.org/html/2608.19463#bib.bib5)\]\. In real\-world anomaly detection scenarios, the ground\-truth causal graph is typically unavailable; therefore, causal structures must be estimated directly from data\. Although these estimated graphs may not perfectly recover the true causal relationships, the results in Figure[8](https://arxiv.org/html/2608.19463#S4.F8)show that they still provide useful structural information for constructing causal\-aware scoring logic\. While the performance varies slightly across different causal discovery methods, all variants consistently outperform the strongest baseline, AnoLLM\. This suggests that the performance gain does not rely on a single causal discovery algorithm, but rather on the broader benefit of incorporating data\-driven causal structure into the detection process\.

Figure 8:Sensitivity to causal discovery methods over 12 mixed\-type datasets\.
#### Computational Efficiency

Figure[9](https://arxiv.org/html/2608.19463#S4.F9)presents the average runtimes \(in minutes\) across all 24 datasets on a single GPU: NVIDIA RTX 4070 Super\. LLM\-Detector is fast in practice because its test\-time inference reduces to executing a lightweight, deterministic scoring program\. Other methods based on training/fine\-tuning e\.g\., AnoGAN and AnoLLM require much higher computation\.

Figure 9:Computational efficiency comparison across all 24 datasets\.

## 5Conclusion

We studyunsupervisedanomaly detection in tabular data, where anomalies often arise from violations of feature dependencies rather than simple marginal deviations\. Unlike other detectors that rely on reconstruction signals or costly training, our method LLM\-Detector instead treats in\-context learning as a structured code synthesis process, synthesizing an executable anomaly detection engine from structured normal\-state knowledge\. The framework first transforms normal training data into statistical profiles, causal relations, and distilled prototypes to construct a knowledge\-dense prompt\. It then instructs a pre\-trained LLM to generate a deterministic scoring engine that evaluates statistical deviation, structural inconsistency, and density\-based abnormality\. Extensive experiments on 24 tabular datasets demonstrate strong and stable performance, with particularly clear advantages on mixed\-type datasets\.

## References

- \[1\]B\. Andrews, J\. Ramsey, R\. Sanchez Romero, J\. Camchong, and E\. Kummerfeld\(2023\)Fast scalable and accurate discovery of dags using the best order score search and grow shrink trees\.NeurIPS\.Cited by:[§4\.3](https://arxiv.org/html/2608.19463#S4.SS3.SSSx4.p1.1)\.
- \[2\]L\. Bergman and Y\. Hoshen\(2020\)Classification\-based anomaly detection for general data\.InICLR,Cited by:[§2\.1](https://arxiv.org/html/2608.19463#S2.SS1.p1.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx2.p1.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx3.p1.1)\.
- \[3\]V\. Borisov, K\. Seßler, T\. Leemann, M\. Pawelczyk, and G\. Kasneci\(2023\)Language models are realistic tabular data generators\.InICLR,Cited by:[§2\.2](https://arxiv.org/html/2608.19463#S2.SS2.p1.1)\.
- \[4\]T\. Brown, B\. Mann, N\. Ryder, M\. Subbiah, J\. Kaplan, P\. Dhariwal, A\. Neelakantan, P\. Shyam, G\. Sastry, A\. Askell,et al\.\(2020\)Language models are few\-shot learners\.NeurIPS\.Cited by:[§3\.2](https://arxiv.org/html/2608.19463#S3.SS2.SSSx1.Px1.p9.1)\.
- \[5\]F\. Capurso\(2024\)Synthetic cybersecurity logs for anomaly detection\.Kaggle\.External Links:[Link](https://www.kaggle.com/dsv/10211131)Cited by:[Table 1](https://arxiv.org/html/2608.19463#S4.T1)\.
- \[6\]D\. M\. Chickering\(2002\)Optimal structure identification with greedy search\.Journal of Machine Learning Research\.Cited by:[§4\.3](https://arxiv.org/html/2608.19463#S4.SS3.SSSx4.p1.1)\.
- \[7\]P\. Grover, J\. Xu, J\. Tittelfitz, A\. Cheng, Z\. Li, J\. Zablocki, J\. Liu, and H\. Zhou\(2022\)Fraud dataset benchmark and applications\.Cited by:[Table 1](https://arxiv.org/html/2608.19463#S4.T1)\.
- \[8\]S\. Han, X\. Hu, H\. Huang, M\. Jiang, and Y\. Zhao\(2022\)Adbench: anomaly detection benchmark\.NeurIPS\.Cited by:[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx1.p1.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx2.p2.1)\.
- \[9\]H\. Huang, P\. Wang, J\. Pei, J\. Wang, S\. Alexanian, and D\. Niyato\(2025\)Deep learning advancements in anomaly detection: a comprehensive survey\.IEEE Internet of Things\.Cited by:[§1](https://arxiv.org/html/2608.19463#S1.p1.1)\.
- \[10\]W\. Lam, B\. Andrews, and J\. Ramsey\(2022\)Greedy relaxations of the sparsest permutation algorithm\.InUncertainty in Artificial Intelligence,Cited by:[§4\.3](https://arxiv.org/html/2608.19463#S4.SS3.SSSx4.p1.1)\.
- \[11\]Z\. Li, Y\. Zhao, X\. Hu, N\. Botta, C\. Ionescu, and G\. Chen\(2022\)Ecod: unsupervised outlier detection using empirical cumulative distribution functions\.IEEE Transactions on Knowledge and Data Engineering\.Cited by:[§2\.1](https://arxiv.org/html/2608.19463#S2.SS1.p1.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx3.p1.1)\.
- \[12\]B\. Liu, D\. Wang, K\. Lin, P\. Tan, and J\. Zhou\(2021\)RCA: A deep collaborative autoencoder approach for anomaly detection\.InIJCAI,Cited by:[§1](https://arxiv.org/html/2608.19463#S1.p2.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx3.p1.1)\.
- \[13\]F\. T\. Liu, K\. M\. Ting, and Z\. Zhou\(2008\)Isolation forest\.InICDM,Cited by:[§2\.1](https://arxiv.org/html/2608.19463#S2.SS1.p1.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx3.p1.1)\.
- \[14\]V\. Livernoche, V\. Jain, Y\. Hezaveh, and S\. Ravanbakhsh\(2024\)On diffusion modeling for anomaly detection\.InICLR,Cited by:[§3\.1](https://arxiv.org/html/2608.19463#S3.SS1.p1.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx1.p1.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx2.p1.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx2.p2.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx3.p1.1)\.
- \[15\]K\. Mai, T\. Davies, and L\. Griffin\(2024\)Understanding the limitations of self\-supervised learning for tabular anomaly detection\.Pattern Analysis and Applications\.Cited by:[§1](https://arxiv.org/html/2608.19463#S1.p1.1)\.
- \[16\]D\. Nguyen, S\. Gupta, K\. Do, T\. Nguyen, and S\. Venkatesh\(2024\)Generating realistic tabular data with large language models\.InICDM,Cited by:[§2\.2](https://arxiv.org/html/2608.19463#S2.SS2.p1.1)\.
- \[17\]D\. Nguyen, T\. A\. H\. Nguyen, T\. D\. Le, S\. Venkatesh, T\. Le, and S\. Gupta\(2026\)Causal\-aware anomaly detection for tabular data\.InICML,Cited by:[§2\.1](https://arxiv.org/html/2608.19463#S2.SS1.p1.1)\.
- \[18\]G\. Pang, L\. Cao, L\. Chen, and H\. Liu\(2018\)Learning representations of ultrahigh\-dimensional data for random distance\-based outlier detection\.InKDD,Cited by:[§2\.1](https://arxiv.org/html/2608.19463#S2.SS1.p1.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx3.p1.1)\.
- \[19\]C\. Qiu, T\. Pfrommer, M\. Kloft, S\. Mandt, and M\. Rudolph\(2021\)Neural transformation learning for deep anomaly detection beyond images\.InICML,Cited by:[§2\.1](https://arxiv.org/html/2608.19463#S2.SS1.p1.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx3.p1.1)\.
- \[20\]A\. Rahman, H\. Mahir, T\. Tashrif, A\. Karim, A\. Aishi, D\. Kundu, T\. Debnath, A\. Moududi, A\. Eidmum, S\. Miah,et al\.\(2025\)Comparative analysis based on deepseek, chatgpt, and google gemini: features, techniques, performance, future prospects\.Systems and Soft Computing\.Cited by:[§4\.3](https://arxiv.org/html/2608.19463#S4.SS3.SSSx2.p1.1)\.
- \[21\]S\. Ramaswamy, R\. Rastogi, and K\. Shim\(2000\)Efficient algorithms for mining outliers from large data sets\.InInternational Conference on Management of Data,Cited by:[§2\.1](https://arxiv.org/html/2608.19463#S2.SS1.p1.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx3.p1.1)\.
- \[22\]S\. Rayana\(2016\)ODDS library\.Stony Brook University\.Cited by:[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx1.p1.1),[Table 1](https://arxiv.org/html/2608.19463#S4.T1)\.
- \[23\]L\. Ruff, R\. Vandermeulen, N\. Goernitz, L\. Deecke, S\. A\. Siddiqui, A\. Binder, E\. Müller, and M\. Kloft\(2018\)Deep one\-class classification\.InICML,Cited by:[§2\.1](https://arxiv.org/html/2608.19463#S2.SS1.p1.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx3.p1.1)\.
- \[24\]T\. Schlegl, P\. Seeböck, S\. Waldstein, G\. Langs, and U\. Schmidt\-Erfurth\(2019\)f\-AnoGAN: Fast unsupervised anomaly detection with generative adversarial networks\.Medical Image Analysis\.Cited by:[§1](https://arxiv.org/html/2608.19463#S1.p2.1),[§2\.1](https://arxiv.org/html/2608.19463#S2.SS1.p1.1),[§3\.1](https://arxiv.org/html/2608.19463#S3.SS1.p1.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx3.p1.1)\.
- \[25\]T\. Shenkar and L\. Wolf\(2022\)Anomaly detection for tabular data with internal contrastive learning\.InICLR,Cited by:[§1](https://arxiv.org/html/2608.19463#S1.p2.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx3.p1.1)\.
- \[26\]J\. Shi, D\. Wang, G\. Tesei, and B\. Norgeot\(2022\)Generating high\-fidelity privacy\-conscious synthetic patient data for causal effect estimation with multiple treatments\.Frontiers in Artificial Intelligence\.Cited by:[§1](https://arxiv.org/html/2608.19463#S1.p2.1)\.
- \[27\]M\. Shyu, S\. Chen, K\. Sarinnapakorn, and L\. Chang\(2003\)A novel anomaly detection scheme based on principal component classifier\.IEEE Foundations and New Directions of Data Mining\.Cited by:[§2\.1](https://arxiv.org/html/2608.19463#S2.SS1.p1.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx3.p1.1)\.
- \[28\]P\. Spirtes, C\. Glymour, and R\. Scheines\(2000\)Causation, prediction, and search\.MIT Press\.Cited by:[§3\.2](https://arxiv.org/html/2608.19463#S3.SS2.SSSx1.Px1.p7.1)\.
- \[29\]P\. L\. Spirtes, C\. Meek, and T\. S\. Richardson\(2013\)Causal inference in the presence of latent variables and selection bias\.arXiv preprint arXiv:1302\.4983\.Cited by:[§4\.3](https://arxiv.org/html/2608.19463#S4.SS3.SSSx4.p1.1)\.
- \[30\]C\. Tsai, G\. Teng, P\. Wallis, and W\. Ding\(2025\)AnoLLM: Large language models for tabular anomaly detection\.InICLR,Cited by:[§1](https://arxiv.org/html/2608.19463#S1.p3.1),[§2\.2](https://arxiv.org/html/2608.19463#S2.SS2.p1.1),[§3\.1](https://arxiv.org/html/2608.19463#S3.SS1.p1.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx1.p1.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx2.p1.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx2.p2.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx3.p1.1)\.
- \[31\]H\. Xu, Y\. Wang, J\. Wei, S\. Jian, Y\. Li, and N\. Liu\(2023\)Fascinating supervisory signals and where to find them: deep anomaly detection with scale learning\.InICML,Cited by:[§2\.1](https://arxiv.org/html/2608.19463#S2.SS1.p1.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx3.p1.1)\.
- \[32\]H\. Ye, J\. Li, H\. Zhao, M\. Zhuge, D\. Guo, Y\. Chang, and H\. Zha\(2026\)LLM as an Algorithmist: Enhancing Anomaly Detectors via Programmatic Synthesis\.InICLR,Cited by:[§1](https://arxiv.org/html/2608.19463#S1.p3.1),[§2\.2](https://arxiv.org/html/2608.19463#S2.SS2.p1.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx1.p1.1),[§4\.1](https://arxiv.org/html/2608.19463#S4.SS1.SSSx3.p1.1)\.

## Appendix 1: Characteristics of 12 continuous\-only datasets

Table[3](https://arxiv.org/html/2608.19463#Pt0.Ax1.T3)summarizes the characteristics of the 12 continuous\-only datasets used in our benchmark\.

Table 3:Statistics for 12 continuous\-only datasets\.
## Appendix 2: Full results for AUC\-ROC

We reported AUC\-ROC as the primary performance metric in the main paper\. Table[4](https://arxiv.org/html/2608.19463#Pt0.Ax2.T4)presents the full results of AUC\-ROC\.

Table 4:AUC\-ROC \(standard deviation\) on each dataset \(higher is better\)\.
## Appendix 3: Full results for F1\-score

We report F1\-score as a complementary performance metric\. Table[5](https://arxiv.org/html/2608.19463#Pt0.Ax3.T5)reports F1\-score and standard deviation for each dataset\. On average, LLM\-Detector achieves the best average performance, outperforming LLM\-DAS and AnoLLM by around 5% and 2%, respectively, across all evaluated datasets\.

Table 5:F1\-score \(standard deviation\) on each dataset \(higher is better\)\.
## Appendix 4: Full code\-generation prompt template

This appendix provides the complete prompt template used in the Knowledge\-to\-Code stage\. As shown in Figure[10](https://arxiv.org/html/2608.19463#Pt0.Ax4.F10), the prompt is designed to contain the essential components needed to guide the LLM toward reliable scoring\-engine generation\. It begins with a role definition, such as “You are an expert in tabular anomaly detection” to frame the LLM as a domain\-specific reasoning agent\. It then provides dataset context, including the dataset name, normal sample size, and feature count, followed by a clear task description, analytical scoring instructions, and the expected output format\. These elements ensure that the LLM produces a structured anomaly scoring mechanism rather than a generic explanation\.

The main design principle is to replace full\-dataset injection with three compact normal\-state knowledge components: feature distributions, causal knowledge, and distilled samples\. The feature distribution block summarizes marginal normal behavior through numerical statistics and categorical probabilities\. The causal knowledge block encodes parent\-child dependencies discovered from normal data\. The distilled sample block provides representative normal prototypes selected by K\-Means centroid matching\. By using these structured summaries instead of the full normal dataset, the prompt reduces information leakage risk, remains independent of the original dataset size, and avoids the token\-limit issue of in\-context learning\. Thus, even for large datasets, the prompt stays compact while preserving the statistical, causal, and geometric information required for final anomaly scoring\.

![Refer to caption](https://arxiv.org/html/2608.19463v1/Prompt.png)Figure 10:Full code\-generation prompt template used in the Knowledge\-to\-Code stage\. The prompt includes role definition, dataset context, task description, analytical instructions, and expected output format, while replacing full\-dataset injection with three compact normal\-state knowledge components: feature distributions, causal knowledge, and distilled samples\. The distilled sample block is truncated for space efficiency; the actual setup uses 100 distilled samples\.