TLDR: A new benchmark, Text-ADBench, comprehensively evaluates text anomaly detection using embeddings from various large language models (LLMs) and diverse anomaly detection algorithms. The study reveals that LLM embeddings significantly boost detection performance, and surprisingly, conventional shallow algorithms often perform as well as or better than complex deep learning methods when utilizing these high-quality LLM-derived embeddings. The benchmark also identifies a low-rank property in performance matrices, enabling efficient prediction of model effectiveness.
Text anomaly detection is a crucial area within natural language processing (NLP), with wide-ranging applications from identifying fraudulent activities and misinformation to moderating online content and detecting spam. Despite significant advancements in large language models (LLMs) and anomaly detection algorithms, a major challenge has been the absence of a standardized and comprehensive benchmark to rigorously compare and develop new methods for text data.
Addressing this critical gap, a new research paper introduces Text-ADBench, a comprehensive benchmark designed specifically for text anomaly detection. This work provides a systematic evaluation of embedding-based text anomaly detection by leveraging embeddings from a diverse array of pre-trained language models across various text datasets.
How Text-ADBench Works
The benchmark operates in two main stages. First, it generates text embeddings using a wide range of language models. These include earlier models like GloVe and BERT, as well as multiple modern LLMs such as LLaMA-2, LLaMA-3, Mistral, and OpenAI’s text-embedding models (small, ada, large). To convert sequential token embeddings into a single vector representation, three pooling strategies are employed: “mean,” “end-of-sequence (EOS) token,” and “weighted mean.” This process results in 33 distinct text representations for each dataset.
In the second stage, these embeddings are applied to a variety of anomaly detection methods. The benchmark incorporates both conventional shallow machine learning algorithms (like One-Class SVM, Isolation Forest, Local Outlier Factor, PCA, K-Nearest Neighbors, Kernel Density Estimation, and ECOD) and deep learning-based approaches (AutoEncoder, Deep SVDD, Dense Projection for Anomaly Detection). Additionally, two specialized text anomaly detection methods, CVDD and DATE, are included in the comparative analysis. The experiments were conducted across eight real-world text datasets spanning news, social media, and scientific publications.
Key Findings and Insights
The empirical study conducted using Text-ADBench reveals several important insights. Firstly, the top-performing results consistently come from detectors utilizing LLM-derived embeddings, demonstrating their significant advantage over traditional embedding methods for text anomaly detection tasks. However, no single LLM-derived embedding universally outperforms others, suggesting that the optimal choice may depend on the specific dataset or task.
Interestingly, the results indicate that the “EOS” pooling strategy generally exhibits significant advantages over “Mean” and “Weighted Mean” pooling for LLM embeddings. Furthermore, embeddings fine-tuned using the “mntp-supervised” approach consistently achieve superior performance rankings.
Perhaps the most surprising finding is that deep learning-based anomaly detectors (such as AutoEncoder and Deep SVDD) show no performance advantage over conventional shallow algorithms (like KNN and Isolation Forest) when leveraging LLM-derived embeddings. This suggests that the high-quality representations produced by LLMs are so effective that simpler algorithms can achieve competitive, or even better, detection performance directly in the input space, making the added complexity of deep anomaly detectors potentially unnecessary.
Among all methods, K-Nearest Neighbors (KNN) consistently shows strong average performance across all datasets, often outperforming other methods. The research also identifies a “low-rank” characteristic in the performance matrices, meaning that the detection performance of new text datasets or anomaly detection methods can be reliably predicted using only a subset of performance measurements. This property enables a highly efficient strategy for rapid model and embedding evaluation and selection in practical applications.
Also Read:
- LogTinyLLM: Making Log Anomaly Detection Efficient with Small Language Models
- Bridging Text and Time: How Large Language Models Enhance Time Series Analysis
A Foundation for Future Research
By open-sourcing their benchmark toolkit, including all embeddings from different models and code, the authors provide a valuable resource for the research community. This work serves as a foundational resource for both researchers and practitioners, aiming to accelerate future research in robust and scalable text anomaly detection systems. You can find more details about this research in the full paper available at arXiv.
