Seeing the Needle in the Haystack: Towards Weakly-Supervised Log Instance Anomaly Localization via Counterfactual Perturbation

# Seeing the Needle in the Haystack: Towards Weakly-Supervised Log Instance Anomaly Localization via Counterfactual Perturbation
Source: [https://arxiv.org/html/2605.10988](https://arxiv.org/html/2605.10988)
###### Abstract

Log anomaly detection is a critical task for system operations and security assurance\. However, in networked systems at scale, log data are generated at massive scale while instance\-level annotations are prohibitively expensive, posing great difficulties to fine\-grained anomaly localization\. To address this challenge, we propose LogMILP \(Log anomaly localization based on Multi\-Instance Learning enhanced by prototypes and Perturbation\), a weakly supervised framework that enables both bag\-level anomaly detection and instance\-level anomaly localization using only bag\-level labels\. Our method guides the model to pinpoint the critical log entries using prototype\-guided structural modeling with counterfactual perturbation consistency regularization, thereby improving localization reliability and interpretability under coarse\-grained supervision\. Experimental results on three public datasets demonstrate that LogMILP achieves competitive detection performance while yielding significantly more reliable instance\-level localization\. Our code is open\-sourced at[https://github\.com/YUK1207/LogMILP](https://github.com/YUK1207/LogMILP)\.

## IIntroduction

Log data persist as one of the most fundamental sources of operational information in modern networked systems\. With the widespread adoption of cloud computing and distributed architectures, log data have grown substantially in scale and semantic complexity, creating difficulties for efficient anomaly detection and precise localization of critical log entries\.

Existing log anomaly detection methods generally fit in three categories for label conditions\. Supervised methods often achieve strong performance when sufficient annotations are available, but they rely heavily on manual labeling and are therefore difficult to scale to industrial applications\[[7](https://arxiv.org/html/2605.10988#bib.bib16)\]\. Unsupervised methods do not require labeled data, yet they often suffer from high false positive rates when normal and anomalous samples are semantically similar\[[17](https://arxiv.org/html/2605.10988#bib.bib24)\]\. Weakly supervised methods, which use coarse\-grained labels, have great practical value but struggle in instance localization and limited interpretability\[[10](https://arxiv.org/html/2605.10988#bib.bib17)\]\[[12](https://arxiv.org/html/2605.10988#bib.bib18)\]\.

Considering the nature of log systems and how they are managed, Multi\-instance learning \(MIL\) is well\-suited for the scenario: by treating logs in a time window as abag, and each log entry within the window as aninstance, a detection model can be trained using only bag\-level labels\[[23](https://arxiv.org/html/2605.10988#bib.bib1)\]\. This setting closely matches real\-world engineering scenarios,where the system can only afford window\-level alarms rather than precise instance\-level annotations\. Although existing MIL\-based methods have demonstrated promising potential, they still face two major challenges: 1\) instance localization is easily distracted by high\-frequency log patterns, and 2\) the learned representation does not necessarily reveal causal contribution, impeding the localization of critical entries\.

To address these issues, we present a Prototype and Perturbation\-enhanced Multi\-Instance Learning framework \(LogMILP\) that strengthens the detection model’s training with prototype anchors and perturbation sensitivity\. Specifically, we use learnable prototype vectors to characterize the distribution of latent patterns and exploit instance\-prototype similarity statistics to assist both attention allocation and bag\-level prediction\. Most importantly, we apply counterfactual perturbation to the key instances identified in each bag to encourage the model to focus on decisive evidence, thereby improving localization reliability and interpretability\. The overall architecture of the proposed model is illustrated in Fig\.[1](https://arxiv.org/html/2605.10988#S1.F1)\.

In addition to traditional bag\-level evaluation, we also empirically tested our method on instance\-level anomaly localization \(i\.e\., finding the critical log entries\) using two fine\-grained metrics termed Loc@k and Success Rate \(SR\)\[[8](https://arxiv.org/html/2605.10988#bib.bib2)\]\. In summary, our main contributions are as follows:

- •We developed a novel MIL framework tailored for log data mining\. To the best of our knowledge, it is the first MIL\-based solution to fine\-grained log anomaly localization empowered by prototype and perturbation mechanisms\.
- •We implemented a unified model architecture that integrates prototype statistical features with multi\-head attention, enabling the joint modeling of global pattern distributions and local instance contributions\.
- •We introduce a counterfactual perturbation\-based training mechanism that effectively mitigates pseudo\-localization and improves model interpretability\.
- •Extensive experiments on three public datasets, BGL\[[19](https://arxiv.org/html/2605.10988#bib.bib10)\]\[[9](https://arxiv.org/html/2605.10988#bib.bib11)\], Spirit\[[19](https://arxiv.org/html/2605.10988#bib.bib10)\], and ZooKeeper\[[9](https://arxiv.org/html/2605.10988#bib.bib11)\]demonstrate that LogMILP achieves clear advantages in both detection performance and localization reliability\.

![Refer to caption](https://arxiv.org/html/2605.10988v1/x1.png)Figure 1:Overall Architecture of LogMILP
## IIRelated Work

### II\-ALog Anomaly Detection

Early approaches detect anomalies by modeling normal patterns\. A representative example is DeepLog\[[4](https://arxiv.org/html/2605.10988#bib.bib12)\], which employed LSTM to learn the temporal dependencies of log template sequences and regards logs that deviate from the predicted patterns as anomalous\. LogAnomaly\[[18](https://arxiv.org/html/2605.10988#bib.bib13)\]further incorporated semantic and statistical features to improve adaptability in complex scenarios\. These methods perform well in environments with stable structures and limited template variation, but they usually rely on instance\-level labels for supervised training\.

With the development of deep representation learning, an increasing number of studies have leveraged contextual semantics to improve detection performance\. LogBERT\[[5](https://arxiv.org/html/2605.10988#bib.bib14)\]formulates log anomaly detection as a self\-supervised learning task and learns robust representations through masked prediction and sequence relationship modeling\. LogFormer\[[6](https://arxiv.org/html/2605.10988#bib.bib15)\]further refines the Transformer architecture to enhance long\-range modeling\. These approaches are generally more effective for session\-level detection\. However, their primary focus remains on detection accuracy, with limited attention paid to instance\-level localization and interpretability\.

### II\-BWeakly Supervised Log Anomaly Detection and MIL

In practical engineering scenarios, precise instance\-level annotations are usually difficult to obtain\. This realistic problem has motivated increasing studies on weakly supervised log anomaly detection\[[10](https://arxiv.org/html/2605.10988#bib.bib17)\]\[[12](https://arxiv.org/html/2605.10988#bib.bib18)\]\. Among these approaches, MIL emerged as a practical match with the common practice of large\-scale log systems, where logs are parsed and labeled in batches\. In many cases, the system can detect the time window of an anomaly but not the exact point of time\. MIL targets at this problem setting by using only bag\-level labels, thereby enabling both anomaly detection and instance localization\. In recent years, attention\-based MIL has been widely applied to weakly supervised video anomaly detection and log analysis\. For example, MIDLog\[[7](https://arxiv.org/html/2605.10988#bib.bib16)\]has demonstrated the practical value of this paradigm in reducing annotation costs\.

Nevertheless, prior MIL\-based methods have two major limitations\. First, instance localization is easily affected by noisy logs, high\-frequency templates, or statistical bias\. Second, although attention distributions are often treated as a basis for interpretability, high attention does not inherently imply high contribution in MIL\. Therefore, how to simultaneously improve localization capability and interpretability under weak supervision remains an open problem\.

### II\-CPrototype Learning

Prototype learning explicitly characterizes representative patterns in the data distribution by introducing a set of learnable prototype vectors in the feature space\[[16](https://arxiv.org/html/2605.10988#bib.bib23)\]\. This paradigm has been widely applied to tasks such as image classification\[[15](https://arxiv.org/html/2605.10988#bib.bib3)\], few\-shot learning\[[2](https://arxiv.org/html/2605.10988#bib.bib21)\], temporal modeling\[[13](https://arxiv.org/html/2605.10988#bib.bib4)\], and anomaly detection\[[3](https://arxiv.org/html/2605.10988#bib.bib5)\]\. Compared with deep models that rely solely on implicit representations, prototype\-based mechanisms can construct a more structured feature space, thereby improving both discriminative ability and interpretability\.

In anomaly detection tasks, prototypes can be used to characterize the centers of dominant patterns and help identify anomalous samples that deviate from the mainstream distribution\. In weakly supervised settings, prototype mechanisms provide additional structural constraints in the absence of instance\-level labels, thereby enhancing the separability of different instances in the latent space\. This is particularly beneficial for log data mining, where normal samples have abundant patterns but anomalies are sparsely distributed\.

### II\-DPerturbation Consistency and Interpretability

In recent years, research in interpretable machine learning has increasingly shown that attention weights or saliency scores do not necessarily reflect the true basis of model decisions\[[17](https://arxiv.org/html/2605.10988#bib.bib24)\]\. On this point, counterfactual perturbation\[[20](https://arxiv.org/html/2605.10988#bib.bib6)\]and consistency regularization\[[24](https://arxiv.org/html/2605.10988#bib.bib7)\]have emerged as important mechanisms\. The core idea is to delete, mask, or replace the input segments identified by the model as most critical, and then examine whether the output changes as expected\.

This idea has been validated in weakly supervised video anomaly detection\[[11](https://arxiv.org/html/2605.10988#bib.bib8)\], natural language processing\[[21](https://arxiv.org/html/2605.10988#bib.bib22)\], and interpretable neural network analysis\[[1](https://arxiv.org/html/2605.10988#bib.bib9)\]\. For weakly supervised log anomaly detection, counterfactual perturbation can provide an additional reliability check for instance localization: if removing the instance with the highest attention weight results in almost no change in prediction, the corresponding localization is likely to reflect a spurious correlation rather than true evidence\. Motivated by this observation, we propose to incorporate a tailored perturbation consistency regularization into the MIL framework for log anomaly detection, so as to make our model decisions reliable and interpretable\.

## IIIMethodology

### III\-AOverview

We consider a practical scenario where anomalous event alarms are provided only for time windows, while annotations for individual log entries are absent\. We therefore formulate it as a multi\-instance learning problem\. Accordingly, each time window \(or a block of logs\) is treated as abagand the log entries within it are regarded asinstances, with training conducted using only bag\-level labels\.

LogMILP has three building blocks: instance representation encoding, prototype\-guided multi\-head attention aggregation, and key\-instance perturbation consistency training\. The model first applies linear projection and contextual encoding to the input log embeddings to obtain instance\-level latent representations\. It then leverages learnable prototypes to model representative pattern distributions in the latent space, and uses prototype similarity statistics to assist both attention aggregation and classification\. Finally, perturbation samples are constructed based on the key instances identified by the current model, and a consistency constraint is imposed to improve the reliability of instance localization\.

### III\-BProblem Statement

Consider an original log sequenceS=\{x1,x2,…,xN\}S=\\\{x\_\{1\},x\_\{2\},\\dots,x\_\{N\}\\\}wherexi∈ℝdx\_\{i\}\\in\\mathbb\{R\}^\{d\}denotes the input embedding of theii\-th log entry, the sequence is naturally split with a fixed window sizeWW111For example, logs are parsed and packed every 6 hours\.and stridess, yielding a collection of sub\-sequences \(termedbagsin MIL\):

Bj=\{x\(j−1\)​s\+1,x\(j−1\)​s\+2,…,x\(j−1\)​s\+W\}\.B\_\{j\}=\\\{x\_\{\(j\-1\)s\+1\},x\_\{\(j\-1\)s\+2\},\\dots,x\_\{\(j\-1\)s\+W\}\\\}\.\(1\)
Each bag is associated with a labelYj∈\{0,1\}Y\_\{j\}\\in\\\{0,1\\\}\. Under the MIL setting,

Yj=maxk=1W⁡\{yj,k\},Y\_\{j\}=\\max\_\{k=1\}^\{W\}\\\{y\_\{j,k\}\\\},\(2\)whereyj,k=1y\_\{j,k\}=1implies an anomaly event recorded by thekk\-th log instance but is unavailable in the system\. During training,only the bag\-level labels are available\.

### III\-CInstance Encoding

For each bagBB, the model first projects the input embeddings into a latent space through a linear transformation:𝐇=𝐗𝐖\+𝐛\\mathbf\{H\}=\\mathbf\{X\}\\mathbf\{W\}\+\\mathbf\{b\}, where𝐗∈ℝW×d\\mathbf\{X\}\\in\\mathbb\{R\}^\{W\\times d\}denotes the input sequence,𝐖∈ℝd×dh\\mathbf\{W\}\\in\\mathbb\{R\}^\{d\\times d\_\{h\}\}and𝐛∈ℝdh\\mathbf\{b\}\\in\\mathbb\{R\}^\{d\_\{h\}\}are learnable parameters, anddhd\_\{h\}is the hidden dimension\. The resulting representation𝐇\\mathbf\{H\}is then fed into a two\-layer Transformer Encoder\[[22](https://arxiv.org/html/2605.10988#bib.bib19)\]Ψ\\Psito obtain context\-enhanced representations:𝐙=Ψ​\(𝐇\)\\mathbf\{Z\}=\\Psi\(\\mathbf\{H\}\), where𝐙=\{𝐳1,𝐳2,…,𝐳W\}\\mathbf\{Z\}=\\\{\\mathbf\{z\}\_\{1\},\\mathbf\{z\}\_\{2\},\\dots,\\mathbf\{z\}\_\{W\}\\\}and𝐳i∈ℝdh\\mathbf\{z\}\_\{i\}\\in\\mathbb\{R\}^\{d\_\{h\}\}\.

### III\-DPrototype\-guided Representation Learning

To enhance the structured modeling of typical log patterns, we defineNNlearnable prototype vectors, denoted byP=\{p1,p2,…,pN\}P=\\\{p\_\{1\},p\_\{2\},\\dots,p\_\{N\}\\\}, wherepj∈ℝdhp\_\{j\}\\in\\mathbb\{R\}^\{d\_\{h\}\}\. After applyingL2L\_\{2\}normalization to both the instance representations and the prototypes, the Euclidean distance is computed asdi,j=∥z^i−p^j∥2d\_\{i,j\}=\\lVert\\hat\{z\}\_\{i\}\-\\hat\{p\}\_\{j\}\\rVert\_\{2\}, which is then mapped into a similarity scoresi,j=11\+di,js\_\{i,j\}=\\frac\{1\}\{1\+d\_\{i,j\}\}, wheresi,j∈\(0,1\]s\_\{i,j\}\\in\(0,1\]\. The maximum prototype similarity for each instance is defined asmi=maxj⁡si,jm\_\{i\}=\\max\_\{j\}s\_\{i,j\}, based on which an anomaly\-candidate bias is introduced asbi=1−mib\_\{i\}=1\-m\_\{i\}\.

At the bag level, we construct prototype statistical features, including the maximum instance similarityMb​a​g=maxi⁡miM\_\{bag\}=\\max\_\{i\}m\_\{i\}, the prototype assignment entropyEb​a​gE\_\{bag\}, and the average prototype activationVb​a​gV\_\{bag\}, which are concatenated asFp=\(Mb​a​g,Eb​a​g,Vb​a​g\)F\_\{p\}=\(M\_\{bag\},E\_\{bag\},V\_\{bag\}\)\. It should be emphasized thatFpF\_\{p\}serves as an auxiliary statistical descriptor rather than a direct anomaly score\.Finally, the model outputs the bag\-level predictiony^\\hat\{y\}based onFpF\_\{p\}andZc​a​tZ\_\{cat\}, together with the attention weightsAAand intermediate statisticsℰ\\mathcal\{E\}\.

### III\-EEnforcing Perturbation Consistency in Training

Relying solely on attention weights can easily lead to pseudo\-localization, where instances receive high attention but contribute little causally to the prediction\. To address this issue, we introduce a training\-time perturbation mechanism: For each bag, we first locate the key indexi∗i^\{\*\}that has the maximum attention score, and then the corresponding embedding is zeroed out to construct a perturbed bag\. The prediction \(as a probability distribution\) before and after perturbation, denoted byPorigP\_\{\\text\{orig\}\}andPpertP\_\{\\text\{pert\}\}, are then computed\. Therefore, given a positive bagℬp​o​s\\mathcal\{B\}\_\{pos\}, the consistency loss is defined as:

ℒc​o​n=1\|ℬp​o​s\|​∑B∈ℬp​o​smax⁡\(0,Δc−\(Po​r​i​g−Pp​e​r​t\)\),\\mathcal\{L\}\_\{con\}=\\frac\{1\}\{\|\\mathcal\{B\}\_\{pos\}\|\}\\sum\_\{B\\in\\mathcal\{B\}\_\{pos\}\}\\max\\big\(0,\\ \\Delta\_\{c\}\-\(P\_\{orig\}\-P\_\{pert\}\)\\big\),\(3\)whereΔc\\Delta\_\{c\}denotes the consistency margin\.If the prediction confidence does not drop sufficiently after removing the key instance, a penalty is imposed, thereby encouraging the model to focus on truly critical anomalous evidence\.

Focal Loss\[[14](https://arxiv.org/html/2605.10988#bib.bib20)\]is adopted as the primary classification objective, and is jointly optimized with prototype regularization, attention entropy regularization, and consistency loss:

ℒt​o​t​a​l=ℒc​l​s\+λ1​ℒp​r​o​t​o\+λ2​ℒa​t​t​n\+λ3​ℒc​o​n,\\mathcal\{L\}\_\{total\}=\\mathcal\{L\}\_\{cls\}\+\\lambda\_\{1\}\\mathcal\{L\}\_\{proto\}\+\\lambda\_\{2\}\\mathcal\{L\}\_\{attn\}\+\\lambda\_\{3\}\\mathcal\{L\}\_\{con\},\(4\)whereλ1,λ2,λ3\\lambda\_\{1\},\\lambda\_\{2\},\\lambda\_\{3\}denote the corresponding loss weights, the formulation ofℒproto\\mathcal\{L\}\_\{\\text\{proto\}\},ℒattn\\mathcal\{L\}\_\{\\text\{attn\}\}, andℒattn\\mathcal\{L\}\_\{\\text\{attn\}\}are detailed in Algorithm[1](https://arxiv.org/html/2605.10988#alg1)\. Training is conducted using only bag\-level labels, while instance\-level labels are not involved in parameter optimization\.

Algorithm 1Training Logic with Perturbation Consistency0:Model

θ\\theta, loader, optimizer, loss weights

λp,λa,λc\\lambda\_\{p\},\\lambda\_\{a\},\\lambda\_\{c\}, prototype margins

Δp,Δe\\Delta\_\{p\},\\Delta\_\{e\}, entropy weight

wentw\_\{\\text\{ent\}\}, consistency margin

Δc\\Delta\_\{c\},

ϵ\\epsilon,

use\_consistency∈\{T,F\}\\text\{use\\\_consistency\}\\in\\\{\\text\{T\},\\text\{F\}\\\}
0:Updated model parameters

θ\\theta
1:foreach mini\-batch

\(X,Y\)\(X,Y\)do

2:

\(Porig,𝒜,ℰ\)←model​\(X\)\(P\_\{\\text\{orig\}\},\\mathcal\{A\},\\mathcal\{E\}\)\\leftarrow\\text\{model\}\(X\)
3:

ℐpos←\{b∣Y\(b\)=1\},ℐneg←\{b∣Y\(b\)=0\}\\mathcal\{I\}\_\{\\text\{pos\}\}\\leftarrow\\\{\\,b\\mid Y^\{\(b\)\}=1\\,\\\},\\quad\\mathcal\{I\}\_\{\\text\{neg\}\}\\leftarrow\\\{\\,b\\mid Y^\{\(b\)\}=0\\,\\\}
4:

ℒcls←FocalLoss​\(Porig,Y\)\\mathcal\{L\}\_\{\\text\{cls\}\}\\leftarrow\\text\{FocalLoss\}\(P\_\{\\text\{orig\}\},Y\)
5:

ℒprotopos←meanb∈ℐpos⁡\(max⁡\(0,Δp−Mb​a​g\(b\)\)\)\\mathcal\{L\}\_\{\\text\{proto\}\}^\{\\text\{pos\}\}\\leftarrow\\operatorname\{mean\}\_\{b\\in\\mathcal\{I\}\_\{\\text\{pos\}\}\}\\bigl\(\\max\(0,\\Delta\_\{p\}\-M\_\{bag\}^\{\(b\)\}\)\\bigr\)
6:

ℒprotoneg←meanb∈ℐneg⁡\(max⁡\(0,Δe−Eb​a​g\(b\)\)\)\\mathcal\{L\}\_\{\\text\{proto\}\}^\{\\text\{neg\}\}\\leftarrow\\operatorname\{mean\}\_\{b\\in\\mathcal\{I\}\_\{\\text\{neg\}\}\}\\bigl\(\\max\(0,\\Delta\_\{e\}\-E\_\{bag\}^\{\(b\)\}\)\\bigr\)
7:

ℒproto←ℒprotopos\+went​ℒprotoneg\\mathcal\{L\}\_\{\\text\{proto\}\}\\leftarrow\\mathcal\{L\}\_\{\\text\{proto\}\}^\{\\text\{pos\}\}\+w\_\{\\text\{ent\}\}\\,\\mathcal\{L\}\_\{\\text\{proto\}\}^\{\\text\{neg\}\}
8:

ℒattn←mean⁡\(−∑t𝒜:,:,t​log⁡\(𝒜:,:,t\+ϵ\)/log⁡\(W\)\)\\mathcal\{L\}\_\{\\text\{attn\}\}\\leftarrow\\operatorname\{mean\}\\\!\\Bigl\(\-\\sum\_\{t\}\\mathcal\{A\}\_\{:,:,t\}\\log\(\\mathcal\{A\}\_\{:,:,t\}\+\\epsilon\)\\big/\\log\(W\)\\Bigr\)
9:

kb∗←arg⁡mink⁡Entropy⁡\(𝒜​\[b,k,:\]\),∀bk\_\{b\}^\{\*\}\\leftarrow\\arg\\min\_\{k\}\\operatorname\{Entropy\}\(\\mathcal\{A\}\[b,k,:\]\),\\ \\forall b
10:

ib∗←arg⁡maxt⁡𝒜​\[b,kb∗,t\],∀bi\_\{b\}^\{\*\}\\leftarrow\\arg\\max\_\{t\}\\mathcal\{A\}\[b,k\_\{b\}^\{\*\},t\],\\ \\forall b
11:

X~←X\\tilde\{X\}\\leftarrow X
12:

X~​\[b,ib∗,:\]←0,∀b\\tilde\{X\}\[b,i\_\{b\}^\{\*\},:\]\\leftarrow 0,\\ \\forall b
13:

\(Ppert,−,−\)←model​\(X~\)\(P\_\{\\text\{pert\}\},\-,\-\)\\leftarrow\\text\{model\}\(\\tilde\{X\}\)
14:

ℒcon←meanb∈ℐpos⁡\(max⁡\(0,Δc−\(Porig\(b\)−Ppert\(b\)\)\)\)\\mathcal\{L\}\_\{\\text\{con\}\}\\leftarrow\\operatorname\{mean\}\_\{b\\in\\mathcal\{I\}\_\{\\text\{pos\}\}\}\\bigl\(\\max\(0,\\Delta\_\{c\}\-\(P\_\{\\text\{orig\}\}^\{\(b\)\}\-P\_\{\\text\{pert\}\}^\{\(b\)\}\)\)\\bigr\)
15:

ℒtotal←ℒcls\+λp​ℒproto\+λa​ℒattn\+λc​ℒcon\\mathcal\{L\}\_\{\\text\{total\}\}\\leftarrow\\mathcal\{L\}\_\{\\text\{cls\}\}\+\\lambda\_\{p\}\\mathcal\{L\}\_\{\\text\{proto\}\}\+\\lambda\_\{a\}\\mathcal\{L\}\_\{\\text\{attn\}\}\+\\lambda\_\{c\}\\mathcal\{L\}\_\{\\text\{con\}\}
16:Compute gradients

∇θℒcls\\nabla\_\{\\theta\}\\mathcal\{L\}\_\{\\text\{cls\}\}and do back\-propagation

17:endfor

18:return

θ\\theta

### III\-FLocalizing Instance\-level Anomalies

For each bagBBof logs labeled positive, we examine the backbone model’s attention head with the minimum attention entropy, and thenidentify the anomaly candidates as the top\-k instances with the highest attention weightsin that head, denoted asSBt​o​pS^\{top\}\_\{B\}\.

Empirically, we evaluate instance\-level anomaly localization accuracy by two metrics:

#### III\-F1Loc@k

Let the set of ground\-truth anomalous instances beSBaS\_\{B\}^\{a\}, we define the localization hit rateL​o​c​@​kLoc@kby:

L​o​c​@​k=∑B∈ℬp​o​s\|SBt​o​p∩SBa\|∑B∈ℬp​o​smin⁡\(k,\|SBa\|\),Loc@k=\\frac\{\\sum\_\{B\\in\\mathcal\{B\}\_\{pos\}\}\|S^\{top\}\_\{B\}\\cap S^\{a\}\_\{B\}\|\}\{\\sum\_\{B\\in\\mathcal\{B\}\_\{pos\}\}\\min\(k,\\ \|S^\{a\}\_\{B\}\|\)\},\(5\)

#### III\-F2Success Rate

Again, we use the perturbation mechanism to test whether the localization is reliable\. For each positive bag, indexed bybb, we compare the model\-predicted bag\-level anomaly probabilities before and after removing the key instance, denoted byPorig\(b\)P\_\{\\text\{orig\}\}^\{\(b\)\}andPpert\(b\)P\_\{\\text\{pert\}\}^\{\(b\)\}, respectively\. On this basis, we define the Success Rate \(SR\) as

SR=1\|ℬp​o​s\|​∑b=1\|ℬp​o​s\|𝟙​\(Porig\(b\)−Ppert\(b\)\>δs​r\),\\mathrm\{SR\}=\\frac\{1\}\{\|\\mathcal\{B\}\_\{pos\}\|\}\\sum\_\{b=1\}^\{\|\\mathcal\{B\}\_\{pos\}\|\}\\mathbbm\{1\}\\\!\\left\(P\_\{\\text\{orig\}\}^\{\(b\)\}\-P\_\{\\text\{pert\}\}^\{\(b\)\}\>\\delta\_\{sr\}\\right\),\(6\)where𝟙​\(⋅\)\\mathbbm\{1\}\(\\cdot\)is the indicator function\. A higher SR indicates that the model relies more on truly decision\-critical instances rather than incidental correlated patterns\.

TABLE I:Comparison of bag\-level anomaly detection performance across datasetsModelBGLSpiritZooKeeperAUCPrec\.Rec\.F1AUCPrec\.Rec\.F1AUCPrec\.Rec\.F1DeepLog\[[4](https://arxiv.org/html/2605.10988#bib.bib12)\]0\.92330\.70040\.84090\.76430\.89290\.79010\.91910\.84970\.99910\.99990\.98980\.9948LogAnomaly\[[18](https://arxiv.org/html/2605.10988#bib.bib13)\]0\.94380\.75120\.71090\.73050\.80670\.68380\.92040\.78460\.99930\.99990\.98820\.9940LogBERT\[[5](https://arxiv.org/html/2605.10988#bib.bib14)\]0\.94080\.88940\.75940\.81930\.96330\.94390\.90080\.92180\.99941\.00000\.98120\.9905LogFormer\[[6](https://arxiv.org/html/2605.10988#bib.bib15)\]0\.92160\.70850\.71540\.71190\.50350\.58550\.75070\.65790\.99891\.00000\.99230\.9961MIDLog\[[7](https://arxiv.org/html/2605.10988#bib.bib16)\]0\.97520\.94940\.82540\.88300\.96680\.91950\.92430\.92190\.98701\.00000\.96840\.9840OURS0\.94640\.92640\.94210\.93420\.96520\.91940\.94040\.92950\.99640\.99640\.99700\.9967\(std\)±\\pm0\.0158±\\pm0\.0118±\\pm0\.0096±0\.0101\\bm\{\\pm\}\{0\.0101\}±\\pm0\.0068±\\pm0\.0230±\\pm0\.0183±0\.0089\\bm\{\\pm\}\{0\.0089\}±\\pm0\.0026±\\pm0\.0026±\\pm0\.0015±0\.0011\\bm\{\\pm\}\{0\.0011\}

![Refer to caption](https://arxiv.org/html/2605.10988v1/x2.png)Figure 2:Geometric distribution of baseline models in the precision\-recall space

## IVExperimental evaluation

### IV\-AExperimental Setup

#### IV\-A1Datasets

We evaluated the proposed method on three public datasets for log anomaly detection: BGL\[[19](https://arxiv.org/html/2605.10988#bib.bib10),[9](https://arxiv.org/html/2605.10988#bib.bib11)\], Spirit\[[19](https://arxiv.org/html/2605.10988#bib.bib10)\], and ZooKeeper\[[9](https://arxiv.org/html/2605.10988#bib.bib11)\]\. All raw logs were processed through a unified pre\-processing pipeline and subsequently organized into multi\-instance bags according to their temporal or logical structure\. Specifically, BGL and ZooKeeper logs were bagged using sliding time windows, whereas Spirit used non\-overlapping blocks that are further aggregated into bags with a fixed number of instances\.

#### IV\-A2Baselines

We drew comparison with DeepLog\[[4](https://arxiv.org/html/2605.10988#bib.bib12)\], LogAnomaly\[[18](https://arxiv.org/html/2605.10988#bib.bib13)\], LogBERT\[[5](https://arxiv.org/html/2605.10988#bib.bib14)\], LogFormer\[[6](https://arxiv.org/html/2605.10988#bib.bib15)\], and MIDLog\[[7](https://arxiv.org/html/2605.10988#bib.bib16)\]\. DeepLog and LogAnomaly represent classical sequence modeling approaches, while LogBERT and LogFormer represent advanced methods based on pretrained semantics and Transformer architectures\. MIDLog serves as the weakly supervised MIL baseline most closely related to our method\.

All baseline models are evaluated under a unified data pre\-processing pipeline and bag\-level evaluation protocol\. It should be noted that the original designs of LogBERT and LogFormer are not directly intended for instance\-level localization or perturbation\-consistency evaluation\. In this work, we introduce only offline instance scoring and perturbation\-based evaluation adaptations to compute Loc@3 and SR, without modifying their core modeling logic for the bag\-level detection task\. Accordingly, these results are interpreted as supplementary instance\-level comparisons rather than evidence that such capabilities are natively supported by the original models\.

#### IV\-A3Evaluation Protocols

All experiments were conducted on a Linux platform equipped with an Intel\(R\) Xeon\(R\) Platinum 8470Q CPU and an NVIDIA GeForce RTX 5090 GPU\. All experiments were repeated with three random seeds\. To address the class imbalance issue in weakly supervised settings, aWeightedRandomSamplerwas employed during training\.

For any method applicable, we include both bag\-level detection metrics and instance\-level reliability metrics\. For the bag\-level detection task, F1 score is used as the primary metric\. Given the output probabilityPP, the optimal thresholdτ\\tauis first selected on the validation set and then applied to the test set to compute the final Precision, Recall, and F1 scores\.

At the instance level, we use Loc@3 and SR, defined in Sec\.[III\-F](https://arxiv.org/html/2605.10988#S3.SS6), to measure localization accuracy and causal reliability, respectively\. During training, the model is optimized using only bag\-level labels\. The computation of Loc@3 and SR is performed only during testing, using the instance\-level ground truth already available in the datasets for offline evaluation, and does not participate in training or threshold selection\.

### IV\-BMain Results

We first report bag\-level results in conventional metrics, and then demonstrate the effectiveness of LogMILP with instance\-level metrics\.

#### IV\-B1Performance on Bag\-level Anomaly Detection

Overall, LogMILP achieved the best F1 scores \(0\.9342, 0\.9295 and 0\.9967\) across all three datasets \(Table[I](https://arxiv.org/html/2605.10988#S3.T1)\)\. Especially, a significant boost in recall was observed on BGL \(\>\>10% gap over the 2nd best\)\. To further compare the operating characteristics of different methods in the precision\-recall space, Fig\.[2](https://arxiv.org/html/2605.10988#S3.F2)visualizes the results with iso\-F1 curves\.

In addition, we observe that sequence matching\-based methods, such as DeepLog and LogAnomaly, suffer a substantial performance degradation under coarse\-grained weak supervision, suggesting that they are highly dependent on precise instance\-level annotations\. We note that the performance of all methods on the ZooKeeper dataset is close to the ceiling, indicating that bag\-level supervision could be sufficient in such systems\. Nonetheless, it does not necessarily mean that existing methods can also work well for instance\-level anomaly localization on the same condition\.

TABLE II:Comparison of instance\-level anomaly localization in terms of Loc@3 and SRModelBGLSpiritZooKeeperLoc@3SRLoc@3SRLoc@3SR\*LogBERT0\.37940\.77550\.65690\.59530\.82610\.8696LogFormer0\.31850\.90400\.19120\.93870\.86040\.9979OURS0\.3488±0\.0312\\bm\{0\.3488\}\\pm 0\.03120\.9730±0\.0147\\bm\{0\.9730\}\\pm 0\.01470\.7786±0\.0255\\bm\{0\.7786\}\\pm 0\.02550\.9658±0\.0148\\bm\{0\.9658\}\\pm 0\.01480\.8917±0\.0346\\bm\{0\.8917\}\\pm 0\.03460\.9962±0\.0066\{0\.9962\}\\pm 0\.0066\* indicates an offline instance\-level evaluation adaptation for Loc@3/SR without changing the core bag\-level logic of the original model\.

#### IV\-B2Performance on Instance\-level Anomaly Localization

In this part, we compared different methods in terms of instance localization quality and reliability\. It should be noted that LogBERT and LogFormer were partially adapted in this section for the comparison of Loc@3 and SR, which follows the attention score\-based approaches\. LogMILP achieved high SR across all three datasets, while logBERT struggled to offer reliable decisions at instance\-level\. Results also show that LogMILP outperformed the baselines in Loc@3 on the Spirit dataset by a large margin, offering strong insight for locating the critical log entries\.

### IV\-CAblation Study

To verify the contribution of our perturbation consistency mechanism, we compare the full model with a variant without consistency loss while keeping all other components unchanged\. The results are reported in Table[III](https://arxiv.org/html/2605.10988#S4.T3)\. It can be observed that consistency regularization significantly improves localization reliability, particularly in terms of the SR metric\. This verifies that counterfactual perturbation effectively forces the model to learn the sources of anomaly without relying on instance\-level labels\.

TABLE III:Consistency loss ablation results\.Δ\\Deltadenotes the performance gap between the full model and the ablated version \(Full \- w/o consistency loss\)\.DatasetMetricw/o consistency lossΔ\\Delta\(Full \- w/o\)BGLPrecision0\.9314±0\.00580\.9314\\pm 0\.0058−0\.0050\-0\.0050Recall0\.8682±0\.01170\.8682\\pm 0\.0117\+0\.0739\+0\.0739F10\.8987±0\.00390\.8987\\pm 0\.0039\+0\.0355\+0\.0355Loc@30\.2485±0\.04220\.2485\\pm 0\.0422\+0\.1003\+0\.1003SR0\.0459±0\.02490\.0459\\pm 0\.0249\+0\.9271\+0\.9271SpiritPrecision0\.8984±0\.01730\.8984\\pm 0\.0173\+0\.0210\+0\.0210Recall0\.9235±0\.01830\.9235\\pm 0\.0183\+0\.0169\+0\.0169F10\.9105±0\.00240\.9105\\pm 0\.0024\+0\.0190\+0\.0190Loc@30\.6039±0\.09560\.6039\\pm 0\.0956\+0\.1747\+0\.1747SR0\.0104±0\.00460\.0104\\pm 0\.0046\+0\.9554\+0\.9554ZooKeeperPrecision0\.9964±0\.00150\.9964\\pm 0\.00150\.00000\.0000Recall0\.9630±0\.01900\.9630\\pm 0\.0190\+0\.0340\+0\.0340F10\.9794±0\.00980\.9794\\pm 0\.0098\+0\.0173\+0\.0173Loc@30\.8722±0\.07200\.8722\\pm 0\.0720\+0\.0195\+0\.0195SR0\.0133±0\.01210\.0133\\pm 0\.0121\+0\.9829\+0\.9829

## VConclusion

Log anomaly detection is a critical problem in AIOps and cybersecurity\. In large\-scale industrial scenarios, fine\-grained instance\-level annotations are often difficult to obtain, making weakly supervised MIL a more practical modeling paradigm\. Existing methods mainly focus on bag\-level detection, with relatively limited systematic attention paid to instance localization capability and the reliability of its interpretation\. In this paper, we propose LogMILP, which unifies learnable prototype guidance, multi\-head attention aggregation, and key\-instance perturbation consistency training within a single MIL framework\. Using only bag\-level labels, the proposed method simultaneously improves detection performance, localization capability, and localization reliability\. Experimental results on three public datasets, BGL, Spirit, and ZooKeeper, demonstrate that the proposed method is highly competitive on bag\-level metrics while showing clear advantages on instance\-level metrics such as Loc@3 and SR\.

Our work offers a practically viable solution but still has limitations such as untested robustness to noisy data\. Future plan of research will include incremental prototype updating for online scenarios, deeper integration with large\-scale pretrained log representations as well as cross\-domain generalization in more complex industrial log streams\.

## References

- \[1\]T\. Antamis, A\. Drosou, T\. Vafeiadis, A\. Nizamis, D\. Ioannidis, and D\. Tzovaras\(2024\)Interpretability of deep neural networks: a review of methods, classification and hardware\.Neurocomputing601,pp\. 128204\.External Links:ISSN 0925\-2312,[Document](https://dx.doi.org/https%3A//doi.org/10.1016/j.neucom.2024.128204),[Link](https://www.sciencedirect.com/science/article/pii/S0925231224009755)Cited by:[§II\-D](https://arxiv.org/html/2605.10988#S2.SS4.p2.1)\.
- \[2\]H\. Cai, Y\. Liu, S\. Huang, and J\. Lv\(2024\-08\)With a little help from language: semantic enhanced visual prototype framework for few\-shot learning\.InProceedings of the Thirty\-Third International Joint Conference on Artificial Intelligence, IJCAI\-24,K\. Larson \(Ed\.\),pp\. 3751–3759\.Note:Main TrackExternal Links:[Document](https://dx.doi.org/10.24963/ijcai.2024/415),[Link](https://doi.org/10.24963/ijcai.2024/415)Cited by:[§II\-C](https://arxiv.org/html/2605.10988#S2.SS3.p1.1)\.
- \[3\]Z\. Dong, H\. Liu, B\. Ren, W\. Xiong, and Z\. Wu\(2024\)Reconstruction\-based multi\-normal prototypes learning for weakly supervised anomaly detection\.CoRRabs/2408\.14498\.External Links:[Link](https://doi.org/10.48550/arXiv.2408.14498)Cited by:[§II\-C](https://arxiv.org/html/2605.10988#S2.SS3.p1.1)\.
- \[4\]M\. Du, F\. Li, G\. Zheng, and V\. Srikumar\(2017\)DeepLog: anomaly detection and diagnosis from system logs through deep learning\.InACM Conference on Computer and Communications Security \(CCS\),Cited by:[§II\-A](https://arxiv.org/html/2605.10988#S2.SS1.p1.1),[TABLE I](https://arxiv.org/html/2605.10988#S3.T1.12.12.12.12.12.12.12.15.1),[§IV\-A2](https://arxiv.org/html/2605.10988#S4.SS1.SSS2.p1.1)\.
- \[5\]H\. Guo, S\. Yuan, and X\. Wu\(2021\)LogBERT: log anomaly detection via BERT\.CoRRabs/2103\.04475\.External Links:[Link](https://arxiv.org/abs/2103.04475),2103\.04475Cited by:[§II\-A](https://arxiv.org/html/2605.10988#S2.SS1.p2.1),[TABLE I](https://arxiv.org/html/2605.10988#S3.T1.12.12.12.12.12.12.12.17.1),[§IV\-A2](https://arxiv.org/html/2605.10988#S4.SS1.SSS2.p1.1)\.
- \[6\]F\. Hang, W\. Guo, H\. Chen, L\. Xie, C\. Zhou, and Y\. Liu\(2023\)Logformer: cascaded transformer for system log anomaly detection\.Computer Modeling in Engineering & Sciences136\(1\),pp\. 517–529\.External Links:[Link](http://www.techscience.com/CMES/v136n1/51217),ISSN 1526\-1506,[Document](https://dx.doi.org/10.32604/cmes.2023.025774)Cited by:[§II\-A](https://arxiv.org/html/2605.10988#S2.SS1.p2.1),[TABLE I](https://arxiv.org/html/2605.10988#S3.T1.12.12.12.12.12.12.12.18.1),[§IV\-A2](https://arxiv.org/html/2605.10988#S4.SS1.SSS2.p1.1)\.
- \[7\]M\. He, T\. Jia, C\. Duan, H\. Cai, Y\. Li, and G\. Huang\(2025\)Weakly\-supervised log\-based anomaly detection with inexact labels via multi\-instance learning\.In2025 IEEE/ACM 47th International Conference on Software Engineering \(ICSE\),pp\. 2918–2930\.External Links:[Document](https://dx.doi.org/10.1109/ICSE55347.2025.00189)Cited by:[§I](https://arxiv.org/html/2605.10988#S1.p2.1),[§II\-B](https://arxiv.org/html/2605.10988#S2.SS2.p1.1),[TABLE I](https://arxiv.org/html/2605.10988#S3.T1.12.12.12.12.12.12.12.19.1),[§IV\-A2](https://arxiv.org/html/2605.10988#S4.SS1.SSS2.p1.1)\.
- \[8\]M\. He, T\. Jia, C\. Duan, P\. Xiao, L\. Zhang, K\. Wang, Y\. Wu, Y\. Li, and G\. Huang\(2025\)Walk the talk: is your log\-based software reliability maintenance system really reliable?\.2025 40th IEEE/ACM International Conference on Automated Software Engineering \(ASE\),pp\. 3784–3788\.External Links:[Link](https://api.semanticscholar.org/CorpusID:281675075)Cited by:[§I](https://arxiv.org/html/2605.10988#S1.p5.1)\.
- \[9\]S\. He, J\. Zhu, P\. He, and M\. R\. Lyu\(2020\)Loghub: A large collection of system log datasets towards automated log analytics\.CoRRabs/2008\.06448\.External Links:[Link](https://arxiv.org/abs/2008.06448),2008\.06448Cited by:[4th item](https://arxiv.org/html/2605.10988#S1.I1.i4.p1.1),[§IV\-A1](https://arxiv.org/html/2605.10988#S4.SS1.SSS1.p1.1)\.
- \[10\]M\. Jiang, C\. Hou, A\. Zheng, X\. Hu, S\. Han, H\. Huang, X\. He, P\. S\. Yu, and Y\. Zhao\(2023\)Weakly supervised anomaly detection: a survey\.External Links:2302\.04549,[Link](https://arxiv.org/abs/2302.04549)Cited by:[§I](https://arxiv.org/html/2605.10988#S1.p2.1),[§II\-B](https://arxiv.org/html/2605.10988#S2.SS2.p1.1)\.
- \[11\]J\. Lee, H\. Koo, S\. Kim, and H\. Ko\(2024\)Cognitive refined augmentation for video anomaly detection in weak supervision\.Sensors24\(1\)\.External Links:[Link](https://www.mdpi.com/1424-8220/24/1/58),ISSN 1424\-8220,[Document](https://dx.doi.org/10.3390/s24010058)Cited by:[§II\-D](https://arxiv.org/html/2605.10988#S2.SS4.p2.1)\.
- \[12\]H\. Li, J\. Wu, D\. Liu, L\. Wu, H\. Chen, M\. Wang, and C\. Shen\(2025\)Industrial anomaly detection and localization using weakly\-supervised residual transformers\.External Links:2306\.03492,[Link](https://arxiv.org/abs/2306.03492)Cited by:[§I](https://arxiv.org/html/2605.10988#S1.p2.1),[§II\-B](https://arxiv.org/html/2605.10988#S2.SS2.p1.1)\.
- \[13\]Y\. Li, W\. Chen, B\. Chen, D\. Wang, L\. Tian, and M\. Zhou\(2023\-23–29 Jul\)Prototype\-oriented unsupervised anomaly detection for multivariate time series\.InProceedings of the 40th International Conference on Machine Learning,A\. Krause, E\. Brunskill, K\. Cho, B\. Engelhardt, S\. Sabato, and J\. Scarlett \(Eds\.\),Proceedings of Machine Learning Research, Vol\.202,pp\. 19407–19424\.External Links:[Link](https://proceedings.mlr.press/v202/li23d.html)Cited by:[§II\-C](https://arxiv.org/html/2605.10988#S2.SS3.p1.1)\.
- \[14\]T\. Lin, P\. Goyal, R\. Girshick, K\. He, and P\. Dollár\(2017\)Focal loss for dense object detection\.InProceedings of the IEEE International Conference on Computer Vision \(ICCV\),pp\. 2980–2988\.External Links:[Document](https://dx.doi.org/10.1109/ICCV.2017.324),[Link](https://arxiv.org/abs/1708.02002)Cited by:[§III\-E](https://arxiv.org/html/2605.10988#S3.SS5.p3.5)\.
- \[15\]Y\. Liu, F\. Yin, and C\. Liu\(2026\)Confident classification via template representation learning\.Neurocomputing682,pp\. 133411\.External Links:ISSN 0925\-2312,[Document](https://dx.doi.org/https%3A//doi.org/10.1016/j.neucom.2026.133411),[Link](https://www.sciencedirect.com/science/article/pii/S0925231226008088)Cited by:[§II\-C](https://arxiv.org/html/2605.10988#S2.SS3.p1.1)\.
- \[16\]C\. F\. Luo, R\. Bhambhoria, S\. Dahan, and X\. Zhu\(2023\-07\)Prototype\-based interpretability for legal citation prediction\.InFindings of the Association for Computational Linguistics: ACL 2023,A\. Rogers, J\. Boyd\-Graber, and N\. Okazaki \(Eds\.\),Toronto, Canada,pp\. 4883–4898\.External Links:[Link](https://aclanthology.org/2023.findings-acl.301/),[Document](https://dx.doi.org/10.18653/v1/2023.findings-acl.301)Cited by:[§II\-C](https://arxiv.org/html/2605.10988#S2.SS3.p1.1)\.
- \[17\]Q\. Lyu, M\. Apidianaki, and C\. Callison\-Burch\(2024\-06\)Towards faithful model explanation in NLP: a survey\.Computational Linguistics50\(2\),pp\. 657–723\.External Links:[Link](https://aclanthology.org/2024.cl-2.6/),[Document](https://dx.doi.org/10.1162/coli%5Fa%5F00511)Cited by:[§I](https://arxiv.org/html/2605.10988#S1.p2.1),[§II\-D](https://arxiv.org/html/2605.10988#S2.SS4.p1.1)\.
- \[18\]W\. Meng, Y\. Liu, Y\. Zhu, S\. Zhang, D\. Pei, Y\. Liu, Y\. Chen, R\. Zhang, S\. Tao, P\. Sun, and R\. Zhou\(2019\-07\)LogAnomaly: unsupervised detection of sequential and quantitative anomalies in unstructured logs\.InProceedings of the Twenty\-Eighth International Joint Conference on Artificial Intelligence, IJCAI\-19,pp\. 4739–4745\.External Links:[Document](https://dx.doi.org/10.24963/ijcai.2019/658),[Link](https://doi.org/10.24963/ijcai.2019/658)Cited by:[§II\-A](https://arxiv.org/html/2605.10988#S2.SS1.p1.1),[TABLE I](https://arxiv.org/html/2605.10988#S3.T1.12.12.12.12.12.12.12.16.1),[§IV\-A2](https://arxiv.org/html/2605.10988#S4.SS1.SSS2.p1.1)\.
- \[19\]A\. Oliner and J\. Stearley\(2007\)What supercomputers say: a study of five system logs\.In37th Annual IEEE/IFIP International Conference on Dependable Systems and Networks \(DSN’07\),Vol\.,pp\. 575–584\.External Links:[Document](https://dx.doi.org/10.1109/DSN.2007.103)Cited by:[4th item](https://arxiv.org/html/2605.10988#S1.I1.i4.p1.1),[§IV\-A1](https://arxiv.org/html/2605.10988#S4.SS1.SSS1.p1.1)\.
- \[20\]Y\. Qiang, C\. Li, M\. Brocanelli, and D\. Zhu\(2022\-07\)Counterfactual interpolation augmentation \(cia\): a unified approach to enhance fairness and explainability of dnn\.InProceedings of the Thirty\-First International Joint Conference on Artificial Intelligence, IJCAI\-22,L\. D\. Raedt \(Ed\.\),pp\. 732–739\.Note:Main TrackExternal Links:[Document](https://dx.doi.org/10.24963/ijcai.2022/103),[Link](https://doi.org/10.24963/ijcai.2022/103)Cited by:[§II\-D](https://arxiv.org/html/2605.10988#S2.SS4.p1.1)\.
- \[21\]Y\. Qiang, S\. Nandi, N\. Mehrabi, G\. Ver Steeg, A\. Kumar, A\. Rumshisky, and A\. Galstyan\(2024\-03\)Prompt perturbation consistency learning for robust language models\.InFindings of the Association for Computational Linguistics: EACL 2024,Y\. Graham and M\. Purver \(Eds\.\),St\. Julian’s, Malta,pp\. 1357–1370\.External Links:[Link](https://aclanthology.org/2024.findings-eacl.91/),[Document](https://dx.doi.org/10.18653/v1/2024.findings-eacl.91)Cited by:[§II\-D](https://arxiv.org/html/2605.10988#S2.SS4.p2.1)\.
- \[22\]A\. Vaswani, N\. Shazeer, N\. Parmar, J\. Uszkoreit, L\. Jones, A\. N\. Gomez, Ł\. Kaiser, and I\. Polosukhin\(2017\)Attention is all you need\.InAdvances in Neural Information Processing Systems,Vol\.30\.External Links:[Link](https://arxiv.org/abs/1706.03762)Cited by:[§III\-C](https://arxiv.org/html/2605.10988#S3.SS3.p1.11)\.
- \[23\]M\. Waqas, S\. U\. Ahmed, M\. A\. Tahir, J\. Wu, and R\. Qureshi\(2024\)Exploring multiple instance learning \(mil\): a brief survey\.Expert Systems with Applications250,pp\. 123893\.External Links:ISSN 0957\-4174,[Document](https://dx.doi.org/https%3A//doi.org/10.1016/j.eswa.2024.123893),[Link](https://www.sciencedirect.com/science/article/pii/S0957417424007590)Cited by:[§I](https://arxiv.org/html/2605.10988#S1.p3.1)\.
- \[24\]Q\. Xie, Z\. Dai, E\. Hovy, T\. Luong, and Q\. Le\(2020\)Unsupervised data augmentation for consistency training\.InAdvances in Neural Information Processing Systems,H\. Larochelle, M\. Ranzato, R\. Hadsell, M\.F\. Balcan, and H\. Lin \(Eds\.\),Vol\.33,pp\. 6256–6268\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2020/file/44feb0096faa8326192570788b38c1d1-Paper.pdf)Cited by:[§II\-D](https://arxiv.org/html/2605.10988#S2.SS4.p1.1)\.