An Explainable LLM Agent Layer for Open-World Anomaly Detection in Oil Wells

# An Explainable LLM Agent Layer for Open-World Anomaly Detection in Oil Wells
Source: [https://arxiv.org/html/2608.04041](https://arxiv.org/html/2608.04041)
Thales Miranda de Almeida VieiraEduardo Toledo de Lima JuniorWilliam Wagner Matos Lira

###### Abstract

Open\-World Learning \(OWL\) pipelines for oil well anomaly detection have recently been shown to combine autoencoder\-based detection, multiclass classification, and Mahalanobis\-based novelty detection on the public 3W dataset\(Lopeset al\.,[2025](https://arxiv.org/html/2608.04041#bib.bib2),[2026](https://arxiv.org/html/2608.04041#bib.bib1)\)\. These pipelines answerwhat happened, but they do not explainwhy the model believes itorwhat the operator should do next, and they do not put a human\-readable name on the novelty clusters they discover\.

This paper evaluates a Large Language Model \(LLM\) agent layer placed downstream of the OWL pipeline, designed as acompanionto the published upstream methods rather than a replacement\. Using the Qwen3\.5\-397B\-A17B Mixture\-of\-Experts model served via NVIDIA NIM, the agent receives structured sensor metrics and upstream classification or novelty assertions, and returns natural\-language justifications, confidence\-ranked critiques, and consolidated names for detected novelties\. Across three studies spanning 989 real well\-file segments from the 3W dataset, the agent achieved35\.1%35\.1\\%top\-1 /63\.9%63\.9\\%top\-3 \(95% CI \[56\.9, 70\.4\]\) classification on all nine classes,71\.7%71\.7\\%top\-2 validation \[64\.8, 77\.6\] with precision0\.910\.91\[0\.84, 0\.95\] across 7 probed classes, and89\.7%89\.7\\%novelty detection \[87\.0, 91\.9\] with stable cluster naming on 5 of 7 hidden classes\.

The agent is not a standalone classifier\. Its role is to: \(1\) confirm upstream decisions when sensor evidence supports them, \(2\) justify decisions in sensor\-grounded language operators can audit, \(3\) flag disagreement when upstream labels are implausible, and \(4\) name novelties so that clustered unlabeled events arrive at the engineer with a consolidated human\-readable label\. The goal is to close the explainability gap that currently blocks deployment of OWL pipelines in operational settings\.

###### keywords:

Oil well anomaly detection , Large Language Models , Explainability , Open\-World Learning , Novelty detection , LLM agents

††journal:ARXIV\\affiliation

\[1\]organization=Laboratory of Scientific Computing and Visualization, Federal University of Alagoas, city=Maceio, state=Alagoas, country=Brazil\\affiliation\[2\]organization=Computing Institute, Federal University of Alagoas, city=Maceio, state=Alagoas, country=Brazil

## 1Introduction

The oil and gas industry relies on continuous real\-time monitoring of sensor data—temperature, pressure, and flow rates—to maintain safe and efficient operations\(Vargaset al\.,[2019](https://arxiv.org/html/2608.04041#bib.bib11); Hüffneret al\.,[2019](https://arxiv.org/html/2608.04041#bib.bib18)\)\. Anomalies in oil well production can indicate faults, inefficiencies, or safety risks with potentially severe consequences\(Guilhermeet al\.,[2011](https://arxiv.org/html/2608.04041#bib.bib19)\)\. Detecting, classifying, and responding to these anomalies is therefore critical\.

Machine learning methods have been widely applied to anomaly detection in oil wells\. The 3W dataset, introduced byVargaset al\.\([2019](https://arxiv.org/html/2608.04041#bib.bib11)\)and recently updated to version 2\.0\(Vargas and others,[2025](https://arxiv.org/html/2608.04041#bib.bib12)\), is the largest labeled open dataset of anomalies in oil well production and has supported extensive research in anomaly detection, predictive maintenance, and multivariate time\-series classification\(Marinset al\.,[2021](https://arxiv.org/html/2608.04041#bib.bib16); Carvalhoet al\.,[2021](https://arxiv.org/html/2608.04041#bib.bib15); Aranhaet al\.,[2024](https://arxiv.org/html/2608.04041#bib.bib13)\)\. However, most existing methods focus on what anomaly occurred, without providing explanations ofwhythe model reached its conclusion orwhatthe operator should do in response\.

Lopeset al\.\([2025](https://arxiv.org/html/2608.04041#bib.bib2)\)introduced the first Open\-World Learning \(OWL\) strategy for oil well anomaly detection, integrating autoencoder reconstruction error, binary classifiers, and clustering methods to both classify known anomalies and discover novel ones—achieving 81% global clustering accuracy with up to 99% on updated binary classifiers\.Lopeset al\.\([2026](https://arxiv.org/html/2608.04041#bib.bib1)\)advanced this foundation significantly with a 1D U\-Net segmentation approach and, critically, a hybrid Mahalanobis novelty detector operating on the latent space of a multiclass classifier’s penultimate layer, making novelty detection substantially more reliable\. Together, these works establish a complete pipeline from detection through classification to novelty grouping\.

Despite these advances, both works identify remaining challenges: binary classifiers remain overconfident on unseen events\(Lopeset al\.,[2025](https://arxiv.org/html/2608.04041#bib.bib2)\), the Mahalanobis detector provides only a numerical distance without rationale\(Lopeset al\.,[2026](https://arxiv.org/html/2608.04041#bib.bib1)\), grouped novelty clusters are unlabeled\(Lopeset al\.,[2025](https://arxiv.org/html/2608.04041#bib.bib2),[2026](https://arxiv.org/html/2608.04041#bib.bib1)\), and operator\-driven validation limits scalability\(Lopeset al\.,[2025](https://arxiv.org/html/2608.04041#bib.bib2)\)\. This paper addresses these gaps by evaluating a Large Language Model \(LLM\) agent layer that sits downstream of the upstream OWL pipeline and provides the explainability, validation, and naming functions the pipeline cannot produce on its own\.

### 1\.1LLMs in oil and gas and anomaly detection

The application of LLMs to the oil and gas domain is an emerging research area\. Recent work includes LLM\-based agents for natural gas leakage detection\(Weiet al\.,[2024](https://arxiv.org/html/2608.04041#bib.bib3)\), information extraction from historical well records\(Maet al\.,[2024](https://arxiv.org/html/2608.04041#bib.bib4)\), intelligent data analysis for production optimization\(Liuet al\.,[2024](https://arxiv.org/html/2608.04041#bib.bib5)\), and domain\-specialized models such as EnergyGPT\(Chebbi and Kolade,[2025](https://arxiv.org/html/2608.04041#bib.bib6)\)\.

In the broader anomaly detection literature, LLMs have been applied to time\-series anomaly detection with explainability as a primary goal\. Adaptive and explainable AI agents using LLM\-enhanced contextual reasoning have been proposed for critical IoT infrastructure\(Sharma and Mehta,[2025](https://arxiv.org/html/2608.04041#bib.bib7)\)\. Agentic and multi\-agent architectures for multimodal anomaly detection represent a growing research direction\(Belayet al\.,[2026](https://arxiv.org/html/2608.04041#bib.bib8)\)\. LLM\-assisted logic rule learning has been explored for encoding human expertise into interpretable rules\(Zhang and Jain,[2026](https://arxiv.org/html/2608.04041#bib.bib9)\), and human\-in\-the\-loop LLM frameworks have shown effectiveness for industrial time\-series fault diagnosis\(Zhanget al\.,[2025](https://arxiv.org/html/2608.04041#bib.bib10)\)\. The classical novelty\-detection methods these works build on are surveyed byPimentelet al\.\([2014](https://arxiv.org/html/2608.04041#bib.bib17)\)\.

However, the specific application of LLMs ascompanion explainability layersfor existing ML pipelines in oil well monitoring—where the LLM does not replace the upstream classifier but rather justifies, validates, and names its outputs—has not been previously explored\. This work bridges that gap\.

### 1\.2Contributions

The main contributions of this paper are:

1. 1\.A method for computing structured sensor metrics from preprocessed 3W data and building data\-driven class profiles that serve as the LLM’s knowledge base\.
2. 2\.A systematic evaluation across three studies \(classification, validation, and novelty detection\) of a general\-purpose LLM \(Qwen 3\.5 MoE\) as a companion to an established OWL pipeline\.
3. 3\.Evidence that the LLM can provide sensor\-grounded justifications, validate or reject upstream classifications with 91% precision, and generate consolidated names for novelty clusters at 89\.7% detection rate\.
4. 4\.Analysis of the LLM’s failure modes on physically ambiguous classes \(4, 5, 9\), demonstrating that these failures are physics\-driven rather than model\-driven\.

## 2Delimitations

This study evaluates the LLM agent layer using only the public 3W dataset\(Vargaset al\.,[2019](https://arxiv.org/html/2608.04041#bib.bib11)\)\. The proprietary ICV Fault data used inLopeset al\.\([2025](https://arxiv.org/html/2608.04041#bib.bib2)\)is not included in this evaluation; extending to proprietary anomaly types is straightforward but has not been done here\.

The LLM \(Qwen 3\.5 MoE 397B\) is used as a general\-purpose model without fine\-tuning on oil well data\. The agent receives only structured metrics \(not raw time series\) and textual class profiles\. It does not have access to spatial features, well geometry, or operational context beyond the four sensors \(P\-PDG, P\-TPT, T\-PDG, T\-TPT\)\.

The evaluation measures the LLM as a companion to the upstream OWL pipeline, not as a standalone classifier\. The per\-class Study 0 numbers make this delimitation explicit: on classes where the sensor signature is ambiguous \(notably class 9 with only 7% top\-1\), the LLM cannot reliably classify alone\.

## 3Proposed Method

### 3\.1Dataset and preprocessing

The evaluation uses the public 3W dataset\(Vargaset al\.,[2019](https://arxiv.org/html/2608.04041#bib.bib11)\)with the same four sensors and preprocessing as the upstream papers: z\-score normalization followed by min\-max scaling to\[0,1\]\[0,1\], wavelet denoising \(Daubechies db4, level 3, soft thresholding\), and missing\-value handling \(forward fill, backward fill, zero fill for remaining NaN\)\. Segments are drawn primarily from real WELL files\. For classes with fewer than 30 real instances, simulated data from the 3W dataset were used to complement the real data, ensuring a minimum sample size for robust profile building and evaluation\. Hand\-drawn instances are excluded\.

### 3\.2Metric computation

A critical design decision is that the LLM receivesstructured numerical metrics, not raw time series\. For each event segment, a shared metrics module computes per\-sensor and cross\-sensor features from the preprocessed data, ensuring exact numerical parity between knowledge building and evaluation\.

#### 3\.2\.1Per\-sensor metrics

Given a preprocessed event segment with baseline window𝐛\\mathbf\{b\}\(timesteps before event onset\) and event window𝐞\\mathbf\{e\}\(timesteps during the event\), the following metrics are computed for each of the four sensors:

δ=e¯−b¯,pct=δ\|b¯\|×100,z=\|δ\|σb\\delta=\\bar\{e\}\-\\bar\{b\},\\qquad\\text\{pct\}=\\frac\{\\delta\}\{\|\\bar\{b\}\|\}\\times 100,\\qquad z=\\frac\{\|\\delta\|\}\{\\sigma\_\{b\}\}\(1\)
whereσb=max⁡\(std​\(𝐛\),10−6\)\\sigma\_\{b\}=\\max\(\\text\{std\}\(\\mathbf\{b\}\),10^\{\-6\}\)guards against zero\-variance baselines\. The slope is computed via least\-squares linear fit over the event timesteps\.

Categorical labels are derived from these quantities using fixed thresholds:

- 1\.Direction:increaseifδ\>0\.5​σb\\delta\>0\.5\\sigma\_\{b\},decreaseifδ<−0\.5​σb\\delta<\-0\.5\\sigma\_\{b\}, elsestable\.
- 2\.Magnitude:smallifz<1z<1,moderateifz<3z<3, elselarge\.
- 3\.Rate:suddenif\|slope\|\>0\.01\|\\text\{slope\}\|\>0\.01,fastif\>0\.002\>0\.002, elsegradual\.
- 4\.Behavior: composite label from oscillation ratio, slope, and step\-change analysis\.

Additional metrics include the oscillation ratio \(fraction of sign changes in the first difference of𝐞\\mathbf\{e\}\) and noise ratio \(σe/σb\\sigma\_\{e\}/\\sigma\_\{b\}\)\. The complete set of 13 per\-sensor metrics is summarized in Table[1](https://arxiv.org/html/2608.04041#S3.T1); cross\-sensor metrics are described in the following subsection\.

Table 1:Per\-sensor metrics computed for each event segment\.
#### 3\.2\.2Cross\-sensor metrics

The pressure relationship between P\-PDG and P\-TPT is classified assame\_direction,diverging, orone\_stable\_or\_both\_stablebased on their individual direction labels\. The strongest sensor \(largest\|δ\|\|\\delta\|\) is also identified\.

### 3\.3Knowledge base \(class profiles\)

For each of the nine known anomaly classes, a knowledge profile is built by aggregating per\-sensor metrics across all available training segments\. The aggregation applies two\-pass IQR\-based outlier removal \(k=3\.0k=3\.0thenk=1\.5k=1\.5\) before computing summary statistics \(mean, std, p25, p75, min, max\) for numeric metrics and mode for categorical labels\.

Each profile additionally includes:

- 1\.Macro behaviorper sensor: change type, noise level, consistency across files, dominant pattern\.
- 2\.Local behaviorper sensor: event shape, onset sharpness, recovery pattern, peak behavior\.
- 3\.General domain knowledge: physical causes, risk factors, detection methods, prevention strategies, severity level, related anomalies, and industry context\.
- 4\.Distinguishing features: auto\-generated discriminative characteristics\.

The full profile is serialized as JSON and rendered as a structured text prompt for the LLM\. A sample profile \(Class 2: Spurious Closure of DHSV\) is shown in Appendix[A](https://arxiv.org/html/2608.04041#A1)\.

### 3\.4LLM agent

- 1\.Model:Qwen3\.5\-397B\-A17B \(Mixture\-of\-Experts;∼\\sim397B total /∼\\sim17B active parameters per token\)\(Qwen Team,[2025](https://arxiv.org/html/2608.04041#bib.bib14)\)with thinking\-mode enabled, served via the public NVIDIA NIM endpointqwen/qwen3\.5\-397b\-a17b\(OpenAI\-compatible API\)\. Inference parameters: temperature0\.20\.2, top\-p0\.70\.7, max output tokens40964096\. Thinking\-mode chain\-of\-thought is consumed internally by the endpoint and is not used by downstream parsing; only the final JSON object is retained\.
- 2\.Input:For each segment, the single\-segment metrics \(Section[3\.2](https://arxiv.org/html/2608.04041#S3.SS2)\) alongside all visible class profiles \(Section[3\.3](https://arxiv.org/html/2608.04041#S3.SS3)\)\.
- 3\.Prompt:The agent receives observed metrics, known class profiles with per\-sensor statistics and distinguishing features, and task\-specific instructions requesting ranked JSON output with justifications\.
- 4\.Output:JSON with top\-3 ranked candidates, per\-candidate justification citing sensor evidence, confidence label \(High/Medium/Low\), and for novelty cases anovel\_nameplusnovel\_description\.

### 3\.5Study design

Three studies evaluate the agent’s capabilities across complementary dimensions:

Table 2:Study design overview\.Classes 1, 2, 3, 6, 7, 8 form the “active” set; class 9 \(Hydrate in Service Line\) is included as the canonical hard case the prior papers flag as a near\-duplicate of class 8\(Lopeset al\.,[2026](https://arxiv.org/html/2608.04041#bib.bib1)\)\. Classes 4 and 5 \(Flow InstabilityandRapid Productivity Loss\) are excluded from Studies 1 and 2 because both prior works identify them as symptomatic rather than causal—their top\-3 ambiguity in Study 0 is the clearest illustration of why\. Study 0 retains all nine classes so the inherited symptomatic ambiguity can be quantified\.

![Refer to caption](https://arxiv.org/html/2608.04041v1/fig5_method_diagram.png)Figure 1:Overview of the LLM agent layer\. The agent receives structured metrics from the preprocessing pipeline and class profiles from the knowledge base, alongside upstream OWL pipeline outputs, and produces ranked candidates, justifications, validity assessments, and novelty names\.

## 4Results and Discussion

### 4\.1Study 0 — Top\-3 classification on all classes

Headline:191 segments, top\-1 =35\.1%, top\-2 =53\.4%, top\-3 =63\.9%\.

Table 3:Study 0 — Top\-k classification accuracy per class with Wilson 95% confidence intervals \(CI\)\. Overall \(all 9 classes,n=191n=191\): top\-135\.1%35\.1\\%\[28\.7, 42\.1\], top\-253\.4%53\.4\\%\[46\.3, 60\.3\], top\-363\.9%63\.9\\%\[56\.9, 70\.4\]\.The wide per\-class CIs \(e\.g\., class 9 top\-1 spans 1\.3–31\.5%\) reflect the small per\-class sample sizes inherent to the public 3W subset; differences across classes should be read as ordinal rather than precise point estimates\.

![Refer to caption](https://arxiv.org/html/2608.04041v1/fig2_topk_accuracy.png)Figure 2:Top\-k classification accuracy per class in Study 0\. Classes with clean sensor signatures \(2, 6, 7\) show strong performance; symptomatic classes \(4, 5\) and heterogeneous class 9 are weakest\.![Refer to caption](https://arxiv.org/html/2608.04041v1/fig1_confusion_matrix.png)Figure 3:Top\-3 confusion matrix for Study 0\. Each cell shows how many times a class appeared anywhere in the top\-3 predictions and the percentage of top\-3 slots it occupies per true class\. Off\-diagonal patterns reveal physically\-motivated confusions—e\.g\., class 5 \(Productivity Loss\) absorbs predictions from class 3 \(Slugging\) and class 4 \(Flow Instability\) scatters across multiple classes\.![Refer to caption](https://arxiv.org/html/2608.04041v1/fig7_class45_top3_distribution.png)Figure 4:Top\-3 prediction distribution for symptomatic classes 4 and 5\. Each bar shows how many segments placed a given class at rank 1, 2, or 3\. The green\-highlighted column marks the correct class\. For class 4 \(Flow Instability\), predictions scatter across classes 2 \(DHSV\), 5 \(Productivity Loss\), 6 \(PCK\), and 7 \(Scaling\)—all plausible root causes\. For class 5 \(Rapid Productivity Loss\), the agent frequently selects class 4 \(Flow Instability\) and class 3 \(Severe Slugging\) as alternatives, reflecting the physical overlap between symptom and cause\.#### 4\.1\.1Why classes 4 and 5 drag the metric down

Classes 4 \(Flow Instability\) and 5 \(Rapid Productivity Loss\) are the two worst\-behaved classes in both upstream papers—Lopeset al\.\([2025](https://arxiv.org/html/2608.04041#bib.bib2)\)reports near\-zero novelty detection accuracy on class 5, a problem only partially rescued by the Mahalanobis latent\-layer detector introduced inLopeset al\.\([2026](https://arxiv.org/html/2608.04041#bib.bib1)\)\. The agent inherits the same fundamental problem: these two classes aresymptoms, not root causes\.

Rapid Productivity Lossis whatever emerges when the well stops producing\. A DHSV closure \(class 2\), a hydrate plug \(class 8 or 9\), severe slugging \(class 3\), or a scaling event \(class 7\)—all eventually manifest as productivity loss\. The sensor signature therefore overlaps with every one of them\.Flow Instabilityhas the same problem: oscillations can be caused by slugging, partial PCK restriction, incipient scaling, or spurious valve operation\.

The confusion matrix \(Figure[3](https://arxiv.org/html/2608.04041#S4.F3)\) and the per\-rank breakdown \(Figure[4](https://arxiv.org/html/2608.04041#S4.F4)\) show this plainly\. For class 4, predictions scatter almost uniformly across classes 2, 5, 6, and 7; for class 5, classes 3 and 4 dominate the alternatives\. In both cases the LLM is identifying the symptomatic layer correctly while the ground\-truth labels point at the causal layer\. This is why the upstream papers required dedicated Mahalanobis\-latent rescue for class 5, and why this work excludes classes 4, 5, and 9 from the validation studies\.

Operational implication\.When a segment is classified as class 4 or 5, the agent should always be prompted for its top\-3 root\-cause candidates, which should be treated as a differential diagnosis rather than a definitive label\.

### 4\.2Study 1 — Top\-2 validation on classes 1–3, 6–9

Headline:187 cases \(149 correct \+ 38 wrong proposals\) across 7 probed classes\. The 38 wrong proposals were generated by, for each segment, sampling uniformly at random one of the remaining six probed classes \(i\.e\., any class different from the ground\-truth label\)\. This sampling protocol guarantees that the validity flag is exercised against arbitrary plausible\-but\-incorrect siblings rather than only the most confusable neighbour, providing a conservative estimate of rejection capability\.

Table 4:Study 1 — Overall validation metrics with Wilson 95% confidence intervals\.Precision is computed over the validity flag:TP=100\\text\{TP\}=100correct proposals judged VALID,FP=10\\text\{FP\}=10wrong proposals erroneously judged VALID \(i\.e\.,38−2838\-28\)\. The previously reported F1 of0\.800\.80used a rounded precision of0\.910\.91; the recomputed F1 with the exact0\.9090\.909precision is0\.7720\.772\.

The agent produces two independent judgments in a single call: \(1\) top\-2 ranking and \(2\) validity flag\. The validity column prevents discarding a correct upstream classification when the LLM happens to rank a sibling higher\. In deployment:IN TOP\-2 \+ VALID = high confidence confirmation; OUT OF TOP\-2 \+ INVALID = high confidence rejection; any other combination requires the engineer to read the justification\.

Table 5:Study 1 — Per\-class validation performance\.![Refer to caption](https://arxiv.org/html/2608.04041v1/fig3_study1_validation.png)Figure 5:Study 1 per\-class validation\. Clean\-signature classes \(2, 7\) show near\-perfect rates\. Class 9 shows asymmetric behavior: low retention but excellent rejection\.#### 4\.2\.1Class 9: a skeptic, not an affirmer

Class 9 is the most informative row\. Two patterns stand out:

- 1\.Low retention of correct proposals \(43%\)\.Real class\-9 segments are extremely heterogeneous—including sensor\-offline traces, P\-PDG increases \(plug above gauge\), T\-TPT spikes of \+246% \(Joule–Thomson heating\)\. The profile captures only the canonical “all\-sensors decrease” archetype\.
- 2\.Excellent rejection of wrong proposals \(88%\)\.When a non\-class\-9 anomaly is proposed as class 9, the agent rejects it cleanly, including clean rejection of the near\-duplicate class 8 case flagged byLopeset al\.\([2026](https://arxiv.org/html/2608.04041#bib.bib1)\)\.

This asymmetry makes the agent askepticon class 9: it confirms only canonical\-signature proposals and rejects atypical ones with defensible sensor\-grounded rationale\. In deployment, this is the right failure mode for a companion to an authoritative upstream classifier\.

### 4\.3Study 2 — Novelty detection on classes 1–3, 6–9

Headline:611 segments\. Overall detection =89\.7%\(548/611\)\.

Table 6:Study 2 — Novelty detection rate per hidden class with Wilson 95% confidence intervals\.The class 9 detection rate \(54\.5%\) carries a wide CI of \[28\.0, 78\.7\] due to the small sample \(n=11n=11\) and should be interpreted as suggestive rather than conclusive\.

![Refer to caption](https://arxiv.org/html/2608.04041v1/fig4_novelty_detection.png)Figure 6:Novelty detection rate per hidden class\. Six of seven classes exceed 70%; class 2 reaches 100%\.#### 4\.3\.1Consolidated novelty names

For each hidden class, we examined thenovel\_nameassigned across correct detections\. A consolidated label emerged naturally for five of the seven classes\. For class 1, all 51 names are unique—however, word\-frequency analysis of the name corpus reveals dominant terms \(thermal: 16,pressure: 13,wellhead: 10,surge: 10\), enabling a cloud\-derived consolidated label\. Class 9 produced 6 distinct physically\-grounded names, none dominant\.

Table 7:Consolidated agent\-given names per hidden class\.
#### 4\.3\.2The “telemetry loss” meta\-finding

A single pattern dominates classes 2, 6, 7, and 8: the agent frames the novelty as adownhole telemetry dropout with a wellhead\-side symptom\. This is an artifact of the 3W data—many anomaly onsets coincide with NaN or zeroed downhole sensors as gauges fail during the event\. This is actionable feedback for the grouping layer: novelty clusters converging on “telemetry loss” should be split by their secondary symptom before being shown to the engineer\.

#### 4\.3\.3Class 9: richer naming, weaker detection

Class 9 detection is the lowest \(55%, 6/11\), but every flagged segment receives a distinct, physically\-grounded name:Localized Upstream Restriction with Thermal Signature,Inverse Pressure Divergence with Temperature Anomaly,Downhole Gas Expansion Instability,Total Sensor Signal Loss,Thermal Inversion Restriction Event, andUncommanded Choke Opening\. The agent never maps missed class\-9 segments onto the near\-duplicate class 8, instead distributing them across class 2 \(3 cases\) and class 5 \(2 cases\) with sensor\-reasonable justifications\.

The practical consequence:class\-9\-like novelty clusters may not consolidate under a single labeland should be surfaced as a family of distinct sub\-events\.

## 5Performance Summary

![Refer to caption](https://arxiv.org/html/2608.04041v1/fig6_summary_heatmap.png)Figure 7:Performance summary across all studies\. Green = strong \(\>\>80%\), yellow = moderate \(40–80%\), red = weak \(<<40%\)\. Classes below the dashed line are symptomatic and excluded from Studies 1–2\.Table[8](https://arxiv.org/html/2608.04041#S5.T8)consolidates the key metrics\.

Table 8:Summary of key metrics across all studies\.
## 6Discussion: A Companion to Published Methods

The upstream OWL pipeline answerswhat happened,where\(U\-Net boundaries, 94% IOU\), andhow confident\(classifier probability, Mahalanobis score\)\. The LLM agent layer supplies the missing capabilities:

- 1\.Why does the model believe that?Sensor\-grounded justification citing specific metric deltas and cross\-sensor relationships\.
- 2\.Could the upstream call be wrong?Top\-2 ranking \+ independent validity flag \(73\.7% rejection of wrong proposals\)\.
- 3\.What should I do next?Class\-specific action recommendations keyed to cited evidence\.
- 4\.What is this novelty called?Consolidated cluster names turning unlabeled clusters into engineer\-readable labels\.
- 5\.When should I not trust the label?Explicit flagging of symptomatic classes with prompt to re\-rank\.

Table[9](https://arxiv.org/html/2608.04041#S6.T9)shows how the division of labor plays out\.

Table 9:Division of labor between upstream OWL pipeline and LLM agent\.
## 7Limitations and Threats to Validity

- 1\.Classes 4/5 ambiguity is physical\.No amount of reasoning over pressure and temperature metrics will separate symptoms from root causes\. The deployment path is to re\-rank to top\-3 and treat the output as a differential diagnosis\.
- 2\.Class 9 cannot be reliably classified alone\.Study 0 top\-1 is7\.1%7\.1\\%\[1\.3, 31\.5\] and Study 1 retains only43%43\\%of correct proposals\. The upstream OWL classifier with spatial features remains authoritative\.
- 3\.Telemetry\-loss confound\.The agent leans on downhole sensor dropouts when naming classes 2, 6, 7, and 8 \(Section[4\.3](https://arxiv.org/html/2608.04041#S4.SS3)\)\. This is a 3W data artefact: many anomaly onsets coincide with NaN or zeroed downhole gauges\. The reported89\.7%89\.7\\%overall detection rate therefore conflates physical anomaly characterisation with detection of telemetry interruptions\. A focused re\-evaluation restricted to segments with continuous downhole telemetry is left to future work, and the operational recommendation is to split novelty clusters by their secondary \(non\-telemetry\) symptom before presenting them to engineers\.
- 4\.Class 1 has no natural name convergence\.Across 51 correctly\-flagged novelties, all names are unique\. A consolidated label \(Wellhead Thermal\-Pressure Surge\) was derived post\-hoc from word\-frequency analysis; the agent itself never converged organically\.
- 5\.Small per\-class samples\.Several classes haven≤15n\\leq 15, yielding wide Wilson 95% CIs \(Tables[3](https://arxiv.org/html/2608.04041#S4.T3),[6](https://arxiv.org/html/2608.04041#S4.T6)\)\. Differences between mid\-performing classes are not statistically distinguishable\. This study should be read as a feasibility evaluation, not a definitive ranking\.
- 6\.No baselines or ablations \(future work\)\.The present work does not compare against \(i\) post\-hoc explainability methods on the upstream classifier \(e\.g\., SHAP, integrated gradients\), \(ii\) alternative LLMs of different scale or family, or \(iii\) ablations of the prompt \(metrics\-only, profile\-only, raw\-window\)\. These comparisons are required to attribute the agent’s contribution to the LLM rather than to the structured\-metrics pipeline that feeds it, and are planned as the immediate next step\. We note, however, that the ceiling against which any such ablation must be measured is itself low:Lopeset al\.\([2025](https://arxiv.org/html/2608.04041#bib.bib2)\)andLopeset al\.\([2026](https://arxiv.org/html/2608.04041#bib.bib1)\)both document that classification and especially novelty detection on the 3W dataset under an open\-world setting are far from trivial—binary classifiers remain overconfident on unseen events, class 5 \(Rapid Productivity Loss\) defeats reconstruction\-error detectors, and only a hybrid Mahalanobis latent\-layer detector with deliberate engineering rescues novelty performance\. A “metrics\-only” or “profile\-only” ablation should therefore be expected to leave several classes essentially undetectable, and we will report those expected failure modes alongside any positive findings\.
- 7\.Single inference run\.All reported numbers come from a single decoding pass per segment; LLM stochasticity is not characterised\. Repeated sampling with majority voting and a temperature sweep are needed to bound run\-to\-run variance\.
- 8\.No proprietary data\.Evaluation used only the public 3W subset; the ICV Fault and other proprietary anomaly classes used inLopeset al\.\([2025](https://arxiv.org/html/2608.04041#bib.bib2)\)are not included\.
- 9\.LLM grounding and hallucination\.The agent is general\-purpose and not fine\-tuned on oil well data\. Although justifications cite sensor metrics provided in the prompt, the recommended\-action and “general knowledge” fields are not independently validated and may contain plausible\-sounding but incorrect domain claims\. An expert audit of a stratified sample of justifications is left as future work\.

## 8Conclusions

This work demonstrated that a general\-purpose LLM \(Qwen 3\.5 MoE 397B\), when provided with structured sensor metrics and data\-driven anomaly profiles, can serve as an effective explainability and validation companion to an established Open\-World Learning pipeline for oil well anomaly detection\. The agent achieves 89\.7% novelty detection with physically\-grounded naming, 91% precision in validating upstream classifications, and generates sensor\-specific justifications that bridge the gap between numerical scores and operator understanding\.

The key contribution is not classification accuracy—the upstream pipeline outperforms the LLM on that dimension—but rather the three capabilities the upstream pipeline cannot provide: natural\-language justification of decisions, independent validation with rejection of implausible labels, and consolidated naming of novelty clusters\. These capabilities directly address the scalability limitation identified inLopeset al\.\([2025](https://arxiv.org/html/2608.04041#bib.bib2)\)regarding operator\-driven validation, and complement the improved novelty detection introduced byLopeset al\.\([2026](https://arxiv.org/html/2608.04041#bib.bib1)\): the LLM agent provides preliminary naming and characterization of novel anomaly clusters flagged by the Mahalanobis latent\-layer detector, reducing the burden on human experts while maintaining interpretability\.

Future work will explore fine\-tuning domain\-specific LLMs on oil well sensor data, extending the evaluation to proprietary anomaly types \(ICV Fault, Valve Operation\), and integrating the agent layer into a real\-time monitoring interface\.

## Acknowledgments

The authors thank PETROBRAS for supporting this research and for providing access to data and domain expertise\.

## CRediT authorship contribution statement

Lucas Gouveia Omena Lopes: Conceptualization, Data curation, Formal analysis, Methodology, Software, Validation, Writing – original draft, Writing – review & editing\.Thales Miranda de Almeida Vieira: Formal analysis, Methodology, Supervision, Writing – review & editing\.Pedro Esteves Aranha: Formal analysis, Methodology, Supervision, Writing – review & editing\.Eduardo Toledo de Lima Junior: Formal analysis, Investigation, Methodology, Supervision, Writing – original draft, Writing – review & editing\.William Wagner Matos Lira: Conceptualization, Formal analysis, Investigation, Supervision, Writing – review & editing\.

## Declaration of competing interest

The authors have no relevant financial or non\-financial interests to disclose\.

## Data availability

The 3W dataset is publicly available\(Vargaset al\.,[2019](https://arxiv.org/html/2608.04041#bib.bib11)\)\. The code that generates the structured metrics, builds the class profiles, runs the agent against the NVIDIA NIM endpoint, and produces all tables and figures in this paper, together with the raw per\-segment JSON outputs of all three studies, will be released in a public GitHub repository with an archived Zenodo DOI upon acceptance\.

## Appendix ASample Knowledge Profile

The following is a condensed version of the structured profile provided to the LLM for Class 2 \(Spurious Closure of DHSV\)\. Each of the nine classes has an analogous profile built from training data\.

```
# Anomaly Profile: Spurious Closure of DHSV (Class 2)
## Built from 38 files (38 segments)

### P-PDG
  Behavior: step_change | Direction: increase
  Magnitude: large (>20%) | Rate: gradual (>60s)
  Typical delta: mean=0.903 [0.856 .. 0.949]
  Macro: highly consistent step_change (rising)
  Local: plateau, gradual onset, no recovery

### P-TPT
  Behavior: step_change | Direction: decrease
  Magnitude: large (>20%) | Rate: gradual (>60s)
  Typical delta: mean=-0.729 [-0.863 .. -0.596]
  Macro: highly consistent step_change (dropping)

### T-PDG
  Behavior: step_change | Direction: decrease
  Magnitude: large (>20%) | Rate: gradual (>60s)
  Typical delta: mean=-0.414 [-0.623 .. -0.195]
  Macro: variable (frequent no_data)

### T-TPT
  Behavior: step_change | Direction: decrease
  Magnitude: large (>20%) | Rate: gradual (>60s)
  Typical delta: mean=-0.835 [-0.921 .. -0.750]

## Distinguishing Features
- P-PDG strongest rise (large, gradual)
- T-TPT strongest drop (large, gradual)
- P-PDG and P-TPT DIVERGE in direction

## General Knowledge
  Causes: control line failure, hydraulic leak
  Severity: critical
  Related: Hydrate in Production Line, Flow Instab.
```

## Appendix BMetric Computation Details

Given preprocessed baseline𝐛\\mathbf\{b\}and event𝐞\\mathbf\{e\}windows:

δ\\displaystyle\\delta=e¯−b¯\\displaystyle=\\bar\{e\}\-\\bar\{b\}\(2\)pct=δ\|b¯\|×100\(guarded:​\|b¯\|\>10−12\)\\displaystyle=\\frac\{\\delta\}\{\|\\bar\{b\}\|\}\\times 100\\quad\(\\text\{guarded: \}\|\\bar\{b\}\|\>10^\{\-12\}\)\(3\)z\\displaystyle z=\|δ\|σb\(σb=max⁡\(std​\(𝐛\),10−6\)\)\\displaystyle=\\frac\{\|\\delta\|\}\{\\sigma\_\{b\}\}\\quad\(\\sigma\_\{b\}=\\max\(\\text\{std\}\(\\mathbf\{b\}\),10^\{\-6\}\)\)\(4\)slope=arg⁡mina,c​∑t\(et−a⋅t−c\)2\\displaystyle=\\arg\\min\_\{a,c\}\\sum\_\{t\}\(e\_\{t\}\-a\\cdot t\-c\)^\{2\}\(5\)
Profile aggregation uses two\-pass IQR filtering: first withk=3\.0k=3\.0, thenk=1\.5k=1\.5\. Points outside\[Q1−k⋅IQR,Q3\+k⋅IQR\]\[Q\_\{1\}\-k\\cdot\\text\{IQR\},\\;Q\_\{3\}\+k\\cdot\\text\{IQR\}\]are removed before computing summary statistics\. This guards against near\-zero\-baseline explosions while preserving the core distribution\.

## References

- P\. Aranha, L\. Gouveia Omena Lopes, E\. Paranhos Sobrinho, I\. Oliveira, J\. de Araújo, B\. Santos, E\. Lima Junior, T\. Silva, T\. Vieira, W\. Lira, N\. Policarpo, and M\. A\. Pinto \(2024\)A system to detect oilwell anomalies using deep learning and decision diagram dual approach\.SPE Journal29,pp\. 1540–1553\.External Links:[Document](https://dx.doi.org/10.2118/218017-PA)Cited by:[§1](https://arxiv.org/html/2608.04041#S1.p2.1)\.
- M\. A\. Belay, A\. Haghipour, A\. Rasheed, and P\. Salvo Rossi \(2026\)Agentic and LLM\-based multimodal anomaly detection: architectures, challenges, and prospects\.Sensors26\(8\),pp\. 2330\.External Links:[Document](https://dx.doi.org/10.3390/s26082330)Cited by:[§1\.1](https://arxiv.org/html/2608.04041#S1.SS1.p2.1)\.
- B\. Carvalho, R\. Vargas, R\. Salgado,et al\.\(2021\)Flow instability detection in offshore oil wells with multivariate time series machine learning classifiers\.Sensors21\(2\)\.External Links:[Document](https://dx.doi.org/10.3390/s21020670)Cited by:[§1](https://arxiv.org/html/2608.04041#S1.p2.1)\.
- A\. Chebbi and B\. Kolade \(2025\)Towards EnergyGPT: a large language model specialized for the energy sector\.External Links:2509\.07177,[Document](https://dx.doi.org/10.48550/arXiv.2509.07177)Cited by:[§1\.1](https://arxiv.org/html/2608.04041#S1.SS1.p1.1)\.
- I\. R\. Guilherme, A\. N\. Marana, J\. P\. Papa, G\. Chiachia, L\. C\. Afonso, K\. Miura, M\. V\. Ferreira, and F\. Torres \(2011\)Petroleum well drilling monitoring through cutting image analysis and artificial intelligence techniques\.Engineering Applications of Artificial Intelligence24\(1\),pp\. 201–207\.External Links:[Document](https://dx.doi.org/10.1016/j.engappai.2010.04.002)Cited by:[§1](https://arxiv.org/html/2608.04041#S1.p1.1)\.
- L\. N\. Hüffner, J\. O\. Trierweiler, and M\. Farenzena \(2019\)Are complex black\-box models for permanent downhole gauge pressure estimation necessary?\.Journal of Petroleum Science and Engineering172,pp\. 715–732\.External Links:[Document](https://dx.doi.org/10.1016/j.petrol.2018.10.047)Cited by:[§1](https://arxiv.org/html/2608.04041#S1.p1.1)\.
- H\. Liu, Y\. Ren, X\. Li, Y\. Deng, Y\. Wang, Q\. Cao, J\. Du, Z\. Lin, and W\. Wang \(2024\)Research status and application of artificial intelligence large models in the oil and gas industry\.Petroleum Exploration and Development51\(4\),pp\. 1049–1065\.External Links:[Document](https://dx.doi.org/10.1016/S1876-3804%2824%2960524-0)Cited by:[§1\.1](https://arxiv.org/html/2608.04041#S1.SS1.p1.1)\.
- L\. G\. O\. Lopes, T\. M\. d\. A\. Vieira, P\. E\. Aranha, E\. T\. d\. Lima Junior, and W\. W\. M\. Lira \(2025\)Detection and classification of anomalies in oil well production using Open\-World Learning\.Engineering Applications of Artificial Intelligence159,pp\. 111514\.External Links:[Document](https://dx.doi.org/10.1016/j.engappai.2025.111514)Cited by:[§1](https://arxiv.org/html/2608.04041#S1.p3.1),[§1](https://arxiv.org/html/2608.04041#S1.p4.1),[§2](https://arxiv.org/html/2608.04041#S2.p1.1),[§4\.1\.1](https://arxiv.org/html/2608.04041#S4.SS1.SSS1.p1.1),[item 6](https://arxiv.org/html/2608.04041#S7.I1.i6.p1.1),[item 8](https://arxiv.org/html/2608.04041#S7.I1.i8.p1.1),[§8](https://arxiv.org/html/2608.04041#S8.p2.1)\.
- L\. G\. O\. Lopes, T\. M\. d\. A\. Vieira, P\. E\. Aranha, E\. T\. d\. Lima Junior, and W\. W\. M\. Lira \(2026\)Real\-time recognition of operational events in oil wells using U\-Net segmentation and distance\-based classification\.InOffshore Technology Conference,Note:OTC\-36929\-MSCited by:[§1](https://arxiv.org/html/2608.04041#S1.p3.1),[§1](https://arxiv.org/html/2608.04041#S1.p4.1),[§3\.5](https://arxiv.org/html/2608.04041#S3.SS5.p2.1),[item 2](https://arxiv.org/html/2608.04041#S4.I1.i2.p1.1),[§4\.1\.1](https://arxiv.org/html/2608.04041#S4.SS1.SSS1.p1.1),[item 6](https://arxiv.org/html/2608.04041#S7.I1.i6.p1.1),[§8](https://arxiv.org/html/2608.04041#S8.p2.1)\.
- Z\. Ma, J\. E\. Santos, G\. Lackey, H\. Viswanathan, and D\. O’Malley \(2024\)Information extraction from historical well records using a large language model\.Scientific Reports14,pp\. 31702\.External Links:[Document](https://dx.doi.org/10.1038/s41598-024-81846-5)Cited by:[§1\.1](https://arxiv.org/html/2608.04041#S1.SS1.p1.1)\.
- M\. A\. Marins, B\. D\. Barros, I\. H\. Santos, D\. C\. Barrionuevo, R\. E\. V\. Vargas, T\. M\. Prego, A\. A\. Lima, M\. L\. R\. de Campos, E\. A\. B\. da Silva, and S\. L\. Netto \(2021\)Fault detection and classification in oil wells and production/service lines using random forest\.Journal of Petroleum Exploration and Production Technology11,pp\. 1479–1489\.Cited by:[§1](https://arxiv.org/html/2608.04041#S1.p2.1)\.
- M\. A\. F\. Pimentel, D\. A\. Clifton, L\. Clifton, and L\. Tarassenko \(2014\)A review of novelty detection\.Signal Processing99,pp\. 215–249\.External Links:[Document](https://dx.doi.org/10.1016/j.sigpro.2013.12.026)Cited by:[§1\.1](https://arxiv.org/html/2608.04041#S1.SS1.p2.1)\.
- Qwen Team \(2025\)Qwen3 technical report\.External Links:2505\.09388Cited by:[item 1](https://arxiv.org/html/2608.04041#S3.I3.i1.p1.5)\.
- R\. Sharma and M\. Mehta \(2025\)Adaptive and explainable AI agents for anomaly detection in critical IoT infrastructure using LLM\-enhanced contextual reasoning\.External Links:2510\.03859,[Document](https://dx.doi.org/10.48550/arXiv.2510.03859)Cited by:[§1\.1](https://arxiv.org/html/2608.04041#S1.SS1.p2.1)\.
- R\. E\. V\. Vargas, C\. J\. Munaro, P\. M\. Ciarelli, A\. G\. Medeiros, B\. G\. do Amaral, D\. C\. Baraúna,et al\.\(2019\)A realistic and public dataset with rare undesirable real events in oil wells\.Journal of Petroleum Science and Engineering181,pp\. 106223\.External Links:[Document](https://dx.doi.org/10.1016/j.petrol.2019.106223)Cited by:[§1](https://arxiv.org/html/2608.04041#S1.p1.1),[§1](https://arxiv.org/html/2608.04041#S1.p2.1),[§2](https://arxiv.org/html/2608.04041#S2.p1.1),[§3\.1](https://arxiv.org/html/2608.04041#S3.SS1.p1.1),[Data availability](https://arxiv.org/html/2608.04041#Sx4.p1.1)\.
- R\. E\. V\. Vargaset al\.\(2025\)3W dataset 2\.0\.0: a realistic and public dataset with rare undesirable real events in oil wells\.External Links:2507\.01048Cited by:[§1](https://arxiv.org/html/2608.04041#S1.p2.1)\.
- Q\. Wei, H\. Sun, Y\. Xu, Z\. Pang, and F\. Gao \(2024\)Exploring the application of large language models based AI agents in leakage detection of natural gas valve chambers\.Energies17\(22\),pp\. 5633\.External Links:[Document](https://dx.doi.org/10.3390/en17225633)Cited by:[§1\.1](https://arxiv.org/html/2608.04041#S1.SS1.p1.1)\.
- H\. Zhang and S\. Jain \(2026\)LLM\-assisted logic rule learning: scaling human expertise for time series anomaly detection\.External Links:2601\.19255,[Document](https://dx.doi.org/10.48550/arXiv.2601.19255)Cited by:[§1\.1](https://arxiv.org/html/2608.04041#S1.SS1.p2.1)\.
- Q\. Zhang, C\. Xu, J\. Li, Y\. Sun, J\. Bao, and D\. Zhang \(2025\)LLM\-TSFD: an industrial time series human\-in\-the\-loop fault diagnosis method based on a large language model\.Expert Systems with Applications264,pp\. 125861\.External Links:[Document](https://dx.doi.org/10.1016/j.eswa.2024.125861)Cited by:[§1\.1](https://arxiv.org/html/2608.04041#S1.SS1.p2.1)\.