Abstract—Log anomaly detection is a critical task for system operations and security assurance. However, in networked systems at scale, log data are generated at massive scale while instance-level annotations are prohibitively expensive, posing great difficulties to fine-grained anomaly localization. To address this challenge, we propose LogMILP (Log anomaly localization based on Multi-Instance Learning enhanced by prototypes and Perturbation), a weakly supervised framework that enables both bag-level anomaly detection and instance-level anomaly localization using only bag-level labels. Our method guides the model to pinpoint the critical log entries using prototype-guided structural modeling with counterfactual perturbation consistency regularization, thereby improving localization reliability and interpretability under coarse-grained supervision. Experimental results on three public datasets demonstrate that LogMILP achieves competitive detection performance while yielding significantly more reliable instance-level localization. Our code is open-sourced at <a href=\"https://github.com/YUK1207/LogMILP\" rel=\"nofollow\">https://github.com/YUK1207/LogMILP</a>.</p>\n","updatedAt":"2026-05-26T10:24:32.859Z","author":{"_id":"68f5e19e5cca224f39a88990","avatarUrl":"/avatars/df0f9a1152d1fce570a9055931ede28b.svg","fullname":"yu tsz yuk","name":"YUKKKKKKKKKKKKK","type":"user","isPro":false,"isHf":false,"isHfAdmin":false,"isMod":false,"isUserFollowing":false}},"numEdits":0,"identifiedLanguage":{"language":"en","probability":0.8871579766273499},"editors":["YUKKKKKKKKKKKKK"],"editorAvatarUrls":["/avatars/df0f9a1152d1fce570a9055931ede28b.svg"],"reactions":[],"isReport":false}},{"id":"6a16013e2a0d008c520ecaa9","author":{"_id":"65243980050781c16f234f1f","avatarUrl":"/avatars/743a009681d5d554c27e04300db9f267.svg","fullname":"Avi","name":"avahal","type":"user","isPro":false,"isHf":false,"isHfAdmin":false,"isMod":false,"followerCount":6,"isUserFollowing":false},"createdAt":"2026-05-26T20:23:26.000Z","type":"comment","data":{"edited":false,"hidden":false,"latest":{"raw":"Interesting breakdown of this paper on arXivLens: https://arxivlens.com/PaperView/Details/seeing-the-needle-in-the-haystack-towards-weakly-supervised-log-instance-anomaly-localization-via-counterfactual-perturbation-9073-2d78f75a\nCovers the executive summary, detailed methodology, and practical applications.","html":"<p>Interesting breakdown of this paper on arXivLens: <a href=\"https://arxivlens.com/PaperView/Details/seeing-the-needle-in-the-haystack-towards-weakly-supervised-log-instance-anomaly-localization-via-counterfactual-perturbation-9073-2d78f75a\" rel=\"nofollow\">https://arxivlens.com/PaperView/Details/seeing-the-needle-in-the-haystack-towards-weakly-supervised-log-instance-anomaly-localization-via-counterfactual-perturbation-9073-2d78f75a</a><br>Covers the executive summary, detailed methodology, and practical applications.</p>\n","updatedAt":"2026-05-26T20:23:26.656Z","author":{"_id":"65243980050781c16f234f1f","avatarUrl":"/avatars/743a009681d5d554c27e04300db9f267.svg","fullname":"Avi","name":"avahal","type":"user","isPro":false,"isHf":false,"isHfAdmin":false,"isMod":false,"followerCount":6,"isUserFollowing":false}},"numEdits":0,"identifiedLanguage":{"language":"en","probability":0.7359272837638855},"editors":["avahal"],"editorAvatarUrls":["/avatars/743a009681d5d554c27e04300db9f267.svg"],"reactions":[],"isReport":false}}],"primaryEmailConfirmed":false,"paper":{"id":"2605.10988","authors":[{"_id":"6a149410b57a1823d570892a","user":{"_id":"68f5e19e5cca224f39a88990","avatarUrl":"/avatars/df0f9a1152d1fce570a9055931ede28b.svg","isPro":false,"fullname":"yu tsz yuk","user":"YUKKKKKKKKKKKKK","type":"user","name":"YUKKKKKKKKKKKKK"},"name":"Yutszyuk Wong","status":"claimed_verified","statusLastChangedAt":"2026-05-26T07:48:38.529Z","hidden":false},{"_id":"6a149410b57a1823d570892b","name":"Wentai Wu","hidden":false},{"_id":"6a149410b57a1823d570892c","name":"Yuen-Ying Yeung","hidden":false},{"_id":"6a149410b57a1823d570892d","name":"Weiwei Lin","hidden":false}],"publishedAt":"2026-05-09T00:00:00.000Z","submittedOnDailyAt":"2026-05-26T00:00:00.000Z","title":"Seeing the Needle in the Haystack: Towards Weakly-Supervised Log Instance Anomaly Localization via Counterfactual Perturbation","submittedOnDailyBy":{"_id":"68f5e19e5cca224f39a88990","avatarUrl":"/avatars/df0f9a1152d1fce570a9055931ede28b.svg","isPro":false,"fullname":"yu tsz yuk","user":"YUKKKKKKKKKKKKK","type":"user","name":"YUKKKKKKKKKKKKK"},"summary":"Log anomaly detection is a critical task for system operations and security assurance. However, in networked systems at scale, log data are generated at massive scale while instance-level annotations are prohibitively expensive, posing great difficulties to fine-grained anomaly localization. To address this challenge, we propose LogMILP (Log anomaly localization based on Multi-Instance Learning enhanced by prototypes and Perturbation), a weakly supervised framework that enables both bag-level anomaly detection and instance-level anomaly localization using only bag-level labels. Our method guides the model to pinpoint the critical log entries using prototype-guided structural modeling with counterfactual perturbation consistency regularization, thereby improving localization reliability and interpretability under coarse-grained supervision. Experimental results on three public datasets demonstrate that LogMILP achieves competitive detection performance while yielding significantly more reliable instance-level localization. Our code is open-sourced at https://github.com/YUK1207/LogMILP.","upvotes":0,"discussionId":"6a149411b57a1823d570892e","githubRepo":"https://github.com/YUK1207/LogMILP","githubRepoAddedBy":"user","ai_summary":"LogMILP is a weakly supervised framework for log anomaly detection that enables both bag-level detection and instance-level localization using prototype-guided structural modeling with counterfactual perturbation consistency regularization.","ai_keywords":["multi-instance learning","weakly supervised learning","anomaly detection","instance-level localization","prototype-guided structural modeling","counterfactual perturbation consistency regularization"],"githubStars":1,"organization":{"_id":"5e67bd5b1009063689407478","name":"huggingface","fullname":"Hugging Face","avatar":"https://cdn-avatars.huggingface.co/v1/production/uploads/1583856921041-5dd96eb166059660ed1ee413.png"}},"canReadDatabase":false,"canManagePapers":false,"canSubmit":false,"hasHfLevelAccess":false,"upvoted":false,"upvoters":[],"acceptLanguages":["en"],"organization":{"_id":"5e67bd5b1009063689407478","name":"huggingface","fullname":"Hugging Face","avatar":"https://cdn-avatars.huggingface.co/v1/production/uploads/1583856921041-5dd96eb166059660ed1ee413.png"},"markdownContentUrl":"https://huggingface.co/buckets/huggingchat/papers-content/resolve/2605/2605.10988.md"}">
Seeing the Needle in the Haystack: Towards Weakly-Supervised Log Instance Anomaly Localization via Counterfactual Perturbation
Abstract
LogMILP is a weakly supervised framework for log anomaly detection that enables both bag-level detection and instance-level localization using prototype-guided structural modeling with counterfactual perturbation consistency regularization.
AI-generated summary
Log anomaly detection is a critical task for system operations and security assurance. However, in networked systems at scale, log data are generated at massive scale while instance-level annotations are prohibitively expensive, posing great difficulties to fine-grained anomaly localization. To address this challenge, we propose LogMILP (Log anomaly localization based on Multi-Instance Learning enhanced by prototypes and Perturbation), a weakly supervised framework that enables both bag-level anomaly detection and instance-level anomaly localization using only bag-level labels. Our method guides the model to pinpoint the critical log entries using prototype-guided structural modeling with counterfactual perturbation consistency regularization, thereby improving localization reliability and interpretability under coarse-grained supervision. Experimental results on three public datasets demonstrate that LogMILP achieves competitive detection performance while yielding significantly more reliable instance-level localization. Our code is open-sourced at https://github.com/YUK1207/LogMILP.
Community
Abstract—Log anomaly detection is a critical task for system operations and security assurance. However, in networked systems at scale, log data are generated at massive scale while instance-level annotations are prohibitively expensive, posing great difficulties to fine-grained anomaly localization. To address this challenge, we propose LogMILP (Log anomaly localization based on Multi-Instance Learning enhanced by prototypes and Perturbation), a weakly supervised framework that enables both bag-level anomaly detection and instance-level anomaly localization using only bag-level labels. Our method guides the model to pinpoint the critical log entries using prototype-guided structural modeling with counterfactual perturbation consistency regularization, thereby improving localization reliability and interpretability under coarse-grained supervision. Experimental results on three public datasets demonstrate that LogMILP achieves competitive detection performance while yielding significantly more reliable instance-level localization. Our code is open-sourced at https://github.com/YUK1207/LogMILP.
Upload images, audio, and videos by dragging in the text input, pasting, or clicking here.
Tap or paste here to upload images
Cite arxiv.org/abs/2605.10988 in a model README.md to link it from this page.
Cite arxiv.org/abs/2605.10988 in a dataset README.md to link it from this page.
Cite arxiv.org/abs/2605.10988 in a Space README.md to link it from this page.
Discussion (0)
Sign in to join the discussion. Free account, 30 seconds — email code or GitHub.
Sign in →No comments yet. Sign in and be the first to say something.