{"id":"916d2c768b95a5b6a9dd8859fdd1142bfb00e0de8d3918e58c06732a9c58ffc0","title":"arXiv cs.AI paper: LogCDM aims to make log anomaly detection compact and interpretable","argument":"Suryansh Talukdar, Taha Sarwat and Jin Soung Yoo present LogCDM, a compact system for finding unusual patterns in computer logs without requiring a GPU at inference. It scores each log session using three signals: a small causal Transformer’s next-event surprise, a graph-attention embedding’s distance from a normal reference graph, and a transition-drift statistic. The authors say the drift statistic is a frequency-weighted chi-squared divergence, which supports a length-standardized score and a per-edge explanation of alarms. A sigmoid gate combines the signals; under a shared-covariance Gaussian model, the authors say, this gate is the Bayes posterior. Its learned weights indicate which signal each dataset relies on.\n\nOn HDFS, chronologically split BGL and Thunderbird, the authors report F1 scores of 0.984, 0.870 and 0.850. They say these results are within 0.013–0.12 of an 8.1B-parameter LLM detector evaluated under the same protocol, and that LogCDM scores a session in 5.5–10.5 ms on a CPU. Ablations show the structural signals add 0.025–0.030 F1 on BGL and Thunderbird but almost nothing on HDFS. This difference matters to the paper’s account of interpretability: the signals can contribute differently across datasets, and their learned weights indicate that variation.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The supplied evidence is the paper’s abstract, not its full methods or evaluation details. The reported F1 scores and CPU timings describe the stated evaluations; the abstract does not establish performance in operational monitoring beyond them.","speaker":{"name":"Talukdar, Suryansh, Sarwat, Taha, Yoo, Jin Soung","roleAtSource":"Article author"},"source":{"title":"LogCDM: Interpretable Log Anomaly Detection via Behavioral Graph Drift and Adaptive Signal Fusion","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.12775","publishedAt":"2026-11-09","dateBasis":"Date basis not provided."},"evidence":[{"text":"LogCDM scores log sessions using three signals: next-event surprise, distance from a normal reference graph, and transition drift.","excerpt":"scores each log session using three complementary signals: the next-event surprise of a small causal Transformer, the distance between a graph-attention embedding","url":"https://arxiv.org/abs/2611.12775","relationship":"Source-stated"},{"text":"The authors describe transition drift as a frequency-weighted chi-squared divergence, yielding a length-standardized score and a per-edge explanation of alarms.","excerpt":"a transition-drift statistic that we show is exactly a frequency-weighted chi-squared divergence between transition kernels. The divergence view yields an asymptotic null distribution, a length-standardized score, and a per-edge decomposition","url":"https://arxiv.org/abs/2611.12775","relationship":"Source-stated"},{"text":"Under a shared-covariance Gaussian model, the authors say the sigmoid gate that fuses the signals is the Bayes posterior; its learned weights indicate which signal each dataset relies on.","excerpt":"under a shared-covariance Gaussian model, this gate is the Bayes posterior, and its learned weights indicate which signal each dataset relies on.","url":"https://arxiv.org/abs/2611.12775","relationship":"Source-stated"},{"text":"The authors report F1 scores of 0.984 on HDFS, 0.870 on chronologically split BGL and 0.850 on Thunderbird, within 0.013–0.12 of an 8.1B-parameter LLM detector evaluated under the same protocol.","excerpt":"LogCDM reaches F1 scores of 0.984 on HDFS, 0.870 on chronologically split BGL, and 0.850 on Thunderbird, within 0.013-0.12 of an 8.1B-parameter LLM detector evaluated under the same protocol","url":"https://arxiv.org/abs/2611.12775","relationship":"Source-stated"},{"text":"The authors report CPU session-scoring times of 5.5–10.5 ms and say structural signals add 0.025–0.030 F1 on BGL and Thunderbird but almost nothing on HDFS.","excerpt":"It scores a session in 5.5-10.5 ms on a CPU. Ablations show that the structural signals add 0.025-0.030 F1 on BGL and Thunderbird but almost nothing on HDFS","url":"https://arxiv.org/abs/2611.12775","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.12775","checkedAt":"2026-11-10T18:52:12.419Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How would LogCDM’s reported results and learned signal weights vary on log datasets beyond HDFS, BGL and Thunderbird?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI paper: LogCDM aims to make log anomaly detection compact and interpretable","summary":"Suryansh Talukdar, Taha Sarwat and Jin Soung Yoo present LogCDM, a compact system for finding unusual patterns in computer logs without requiring a GPU at inference. It scores each log session using three signals: a small causal Transformer’s next-event surprise, a graph-attention embedding’s distance from a normal reference graph, and a transition-drift statistic. The authors say the drift statistic is a frequency-weighted chi-squared divergence, which supports a length-standardized score and a per-edge explanation of alarms. A sigmoid gate combines the signals; under a shared-covariance Gaussian model, the authors say, this gate is the Bayes posterior. Its learned weights indicate which signal each dataset relies on.\n\nOn HDFS, chronologically split BGL and Thunderbird, the authors report F1 scores of 0.984, 0.870 and 0.850. They say these results are within 0.013–0.12 of an 8.1B-parameter LLM detector evaluated under the same protocol, and that LogCDM scores a session in 5.5–10.5 ms on a CPU. Ablations show the structural signals add 0.025–0.030 F1 on BGL and Thunderbird but almost nothing on HDFS. This difference matters to the paper’s account of interpretability: the signals can contribute differently across datasets, and their learned weights indicate that variation.","question":"How would LogCDM’s reported results and learned signal weights vary on log datasets beyond HDFS, BGL and Thunderbird?","claims":[{"text":"LogCDM scores log sessions using three signals: next-event surprise, distance from a normal reference graph, and transition drift.","excerpt":"scores each log session using three complementary signals: the next-event surprise of a small causal Transformer, the distance between a graph-attention embedding","support":"source-stated"},{"text":"The authors describe transition drift as a frequency-weighted chi-squared divergence, yielding a length-standardized score and a per-edge explanation of alarms.","excerpt":"a transition-drift statistic that we show is exactly a frequency-weighted chi-squared divergence between transition kernels. The divergence view yields an asymptotic null distribution, a length-standardized score, and a per-edge decomposition","support":"source-stated"},{"text":"Under a shared-covariance Gaussian model, the authors say the sigmoid gate that fuses the signals is the Bayes posterior; its learned weights indicate which signal each dataset relies on.","excerpt":"under a shared-covariance Gaussian model, this gate is the Bayes posterior, and its learned weights indicate which signal each dataset relies on.","support":"source-stated"},{"text":"The authors report F1 scores of 0.984 on HDFS, 0.870 on chronologically split BGL and 0.850 on Thunderbird, within 0.013–0.12 of an 8.1B-parameter LLM detector evaluated under the same protocol.","excerpt":"LogCDM reaches F1 scores of 0.984 on HDFS, 0.870 on chronologically split BGL, and 0.850 on Thunderbird, within 0.013-0.12 of an 8.1B-parameter LLM detector evaluated under the same protocol","support":"source-stated"},{"text":"The authors report CPU session-scoring times of 5.5–10.5 ms and say structural signals add 0.025–0.030 F1 on BGL and Thunderbird but almost nothing on HDFS.","excerpt":"It scores a session in 5.5-10.5 ms on a CPU. Ablations show that the structural signals add 0.025-0.030 F1 on BGL and Thunderbird but almost nothing on HDFS","support":"source-stated"}],"limitations":["The supplied evidence is the paper’s abstract, not its full methods or evaluation details.","The reported F1 scores and CPU timings describe the stated evaluations; the abstract does not establish performance in operational monitoring beyond them."],"mediaId":"2d54b3d214d5fe01841d97e4abbb08eba56c31f7d821a98848447e384ba42dae","correctionReason":null,"id":"916d2c768b95a5b6a9dd8859fdd1142bfb00e0de8d3918e58c06732a9c58ffc0","publicationId":"2c81b4d1-c957-40ec-8b5a-1bb0877a5a76","version":1,"sourceUrl":"https://arxiv.org/abs/2611.12775","sourceTitle":"LogCDM: Interpretable Log Anomaly Detection via Behavioral Graph Drift and Adaptive Signal Fusion","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-09","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-10T08:39:43.674Z","createdAt":"2026-11-10T17:49:04.411Z","historical":false,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"2d54b3d214d5fe01841d97e4abbb08eba56c31f7d821a98848447e384ba42dae","kind":"article","url":"https://arxiv.org/abs/2611.12775","sourceUrl":"https://arxiv.org/abs/2611.12775","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-10T17:47:52.302Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.12775","checkedAt":"2026-11-10T18:52:12.419Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"2d54b3d214d5fe01841d97e4abbb08eba56c31f7d821a98848447e384ba42dae","confidence":0.91,"provider":"typesafe","model":"jev-1.13.0","inputHash":"7ba83030070a6c485ea9a96a480f9657076ddab8f7babd0d182c216e1fc67d31","decidedAt":"2026-11-10T17:47:52.779Z"},"provenance":{"textHash":"43c15b827fcbbedefc15beeba7b1c55ff412a98e555259cc81ac3c58d30e4035","observationId":"9e898e70d33d822b871a09ca5a880a43f93efd3ea3824caa265f3f435af143e8","retrievedAt":"2026-11-10T17:47:52.245Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"50b99e11-5020-4878-83ac-72bbe4dce60c"},"reviewer":{"model":"gpt-6-luna","runId":"5cdb1f4c-1397-4dc7-8235-2669d9aa20c7"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-10T17:49:04.411Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Talukdar, Suryansh","url":null,"kind":"unknown"},{"name":"Sarwat, Taha","url":null,"kind":"unknown"},{"name":"Yoo, Jin Soung","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Talukdar, Suryansh","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Talukdar, Suryansh","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.12775","locator":"head/meta[name=author|citation_author]"},"assertionId":"9a35380cb00c6b863bf522a4bbaa95b59fe84d6cf98468e76c2db362b0367fd5:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T18:52:12.419Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9a35380cb00c6b863bf522a4bbaa95b59fe84d6cf98468e76c2db362b0367fd5","sourceUrl":"https://arxiv.org/abs/2611.12775","contentSha256":"9e66370ea0762d0573d46f05a4315afd81c0f416d343ba32c8e9754e72696f1d","textHash":"43c15b827fcbbedefc15beeba7b1c55ff412a98e555259cc81ac3c58d30e4035","observedAt":"2026-11-10T18:52:12.419Z"}},{"actor":{"name":"Sarwat, Taha","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Sarwat, Taha","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.12775","locator":"head/meta[name=author|citation_author]"},"assertionId":"9a35380cb00c6b863bf522a4bbaa95b59fe84d6cf98468e76c2db362b0367fd5:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T18:52:12.419Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9a35380cb00c6b863bf522a4bbaa95b59fe84d6cf98468e76c2db362b0367fd5","sourceUrl":"https://arxiv.org/abs/2611.12775","contentSha256":"9e66370ea0762d0573d46f05a4315afd81c0f416d343ba32c8e9754e72696f1d","textHash":"43c15b827fcbbedefc15beeba7b1c55ff412a98e555259cc81ac3c58d30e4035","observedAt":"2026-11-10T18:52:12.419Z"}},{"actor":{"name":"Yoo, Jin Soung","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Yoo, Jin Soung","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.12775","locator":"head/meta[name=author|citation_author]"},"assertionId":"9a35380cb00c6b863bf522a4bbaa95b59fe84d6cf98468e76c2db362b0367fd5:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T18:52:12.419Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9a35380cb00c6b863bf522a4bbaa95b59fe84d6cf98468e76c2db362b0367fd5","sourceUrl":"https://arxiv.org/abs/2611.12775","contentSha256":"9e66370ea0762d0573d46f05a4315afd81c0f416d343ba32c8e9754e72696f1d","textHash":"43c15b827fcbbedefc15beeba7b1c55ff412a98e555259cc81ac3c58d30e4035","observedAt":"2026-11-10T18:52:12.419Z"}}],"participationCoverage":{"total":3,"returned":3,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.12775","snapshotId":"9a35380cb00c6b863bf522a4bbaa95b59fe84d6cf98468e76c2db362b0367fd5","contentSha256":"9e66370ea0762d0573d46f05a4315afd81c0f416d343ba32c8e9754e72696f1d","textHash":"43c15b827fcbbedefc15beeba7b1c55ff412a98e555259cc81ac3c58d30e4035","observedAt":"2026-11-10T18:52:12.419Z","basis":"publisher-page-metadata","sourceLinks":41,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/916d2c768b95a5b6a9dd8859fdd1142bfb00e0de8d3918e58c06732a9c58ffc0/source"}},"canonicalUrl":"https://escapemeridian.com/readings/arxiv-cs-ai-paper-logcdm-aims-to-make-log-anomaly-detection-916d2c76","formats":{"html":"/readings/arxiv-cs-ai-paper-logcdm-aims-to-make-log-anomaly-detection-916d2c76","markdown":"/readings/arxiv-cs-ai-paper-logcdm-aims-to-make-log-anomaly-detection-916d2c76.md","json":"/readings/arxiv-cs-ai-paper-logcdm-aims-to-make-log-anomaly-detection-916d2c76.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-gpu","name":"Graphics processing unit","explanation":"A chip that performs many calculations at once; the main hardware used to train and run AI models.","referenceUrl":"https://en.wikipedia.org/wiki/Graphics_processing_unit"},{"id":"term-llm","name":"Large language model","explanation":"A language model with many learned numerical settings, used to process and generate language.","referenceUrl":"https://developers.google.com/machine-learning/glossary#large-language-model"},{"id":"term-cpu","name":"CPU","explanation":"The central processing unit: a general-purpose processor that carries out a computer's instructions.","referenceUrl":"https://aws.amazon.com/what-is/cpu/"},{"id":"term-interpretability","name":"Interpretability","explanation":"Research into how a model reaches its outputs, often by examining its internal workings.","referenceUrl":"https://developers.google.com/machine-learning/glossary#interpretability"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"916d2c768b95a5b6a9dd8859fdd1142bfb00e0de8d3918e58c06732a9c58ffc0","revision":"2c81b4d1-c957-40ec-8b5a-1bb0877a5a76","revisionKind":"publication-id","title":"arXiv cs.AI paper: LogCDM aims to make log anomaly detection compact and interpretable","url":"https://escapemeridian.com/readings/arxiv-cs-ai-paper-logcdm-aims-to-make-log-anomaly-detection-916d2c76"},"source":{"type":"source","id":"https://arxiv.org/abs/2611.12775","revision":"43c15b827fcbbedefc15beeba7b1c55ff412a98e555259cc81ac3c58d30e4035","revisionKind":"sha256-source-text","title":"LogCDM: Interpretable Log Anomaly Detection via Behavioral Graph Drift and Adaptive Signal Fusion","url":"https://arxiv.org/abs/2611.12775"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"916d2c768b95a5b6a9dd8859fdd1142bfb00e0de8d3918e58c06732a9c58ffc0","title":"arXiv cs.AI paper: LogCDM aims to make log anomaly detection compact and interpretable","argument":"Suryansh Talukdar, Taha Sarwat and Jin Soung Yoo present LogCDM, a compact system for finding unusual patterns in computer logs without requiring a GPU at inference. It scores each log session using three signals: a small causal Transformer’s next-event surprise, a graph-attention embedding’s distance from a normal reference graph, and a transition-drift statistic. The authors say the drift statistic is a frequency-weighted chi-squared divergence, which supports a length-standardized score and a per-edge explanation of alarms. A sigmoid gate combines the signals; under a shared-covariance Gaussian model, the authors say, this gate is the Bayes posterior. Its learned weights indicate which signal each dataset relies on.\n\nOn HDFS, chronologically split BGL and Thunderbird, the authors report F1 scores of 0.984, 0.870 and 0.850. They say these results are within 0.013–0.12 of an 8.1B-parameter LLM detector evaluated under the same protocol, and that LogCDM scores a session in 5.5–10.5 ms on a CPU. Ablations show the structural signals add 0.025–0.030 F1 on BGL and Thunderbird but almost nothing on HDFS. This difference matters to the paper’s account of interpretability: the signals can contribute differently across datasets, and their learned weights indicate that variation.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The supplied evidence is the paper’s abstract, not its full methods or evaluation details. The reported F1 scores and CPU timings describe the stated evaluations; the abstract does not establish performance in operational monitoring beyond them.","speaker":{"name":"Talukdar, Suryansh, Sarwat, Taha, Yoo, Jin Soung","roleAtSource":"Article author"},"source":{"title":"LogCDM: Interpretable Log Anomaly Detection via Behavioral Graph Drift and Adaptive Signal Fusion","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.12775","publishedAt":"2026-11-09","dateBasis":"Date basis not provided."},"evidence":[{"text":"LogCDM scores log sessions using three signals: next-event surprise, distance from a normal reference graph, and transition drift.","excerpt":"scores each log session using three complementary signals: the next-event surprise of a small causal Transformer, the distance between a graph-attention embedding","url":"https://arxiv.org/abs/2611.12775","relationship":"Source-stated"},{"text":"The authors describe transition drift as a frequency-weighted chi-squared divergence, yielding a length-standardized score and a per-edge explanation of alarms.","excerpt":"a transition-drift statistic that we show is exactly a frequency-weighted chi-squared divergence between transition kernels. The divergence view yields an asymptotic null distribution, a length-standardized score, and a per-edge decomposition","url":"https://arxiv.org/abs/2611.12775","relationship":"Source-stated"},{"text":"Under a shared-covariance Gaussian model, the authors say the sigmoid gate that fuses the signals is the Bayes posterior; its learned weights indicate which signal each dataset relies on.","excerpt":"under a shared-covariance Gaussian model, this gate is the Bayes posterior, and its learned weights indicate which signal each dataset relies on.","url":"https://arxiv.org/abs/2611.12775","relationship":"Source-stated"},{"text":"The authors report F1 scores of 0.984 on HDFS, 0.870 on chronologically split BGL and 0.850 on Thunderbird, within 0.013–0.12 of an 8.1B-parameter LLM detector evaluated under the same protocol.","excerpt":"LogCDM reaches F1 scores of 0.984 on HDFS, 0.870 on chronologically split BGL, and 0.850 on Thunderbird, within 0.013-0.12 of an 8.1B-parameter LLM detector evaluated under the same protocol","url":"https://arxiv.org/abs/2611.12775","relationship":"Source-stated"},{"text":"The authors report CPU session-scoring times of 5.5–10.5 ms and say structural signals add 0.025–0.030 F1 on BGL and Thunderbird but almost nothing on HDFS.","excerpt":"It scores a session in 5.5-10.5 ms on a CPU. Ablations show that the structural signals add 0.025-0.030 F1 on BGL and Thunderbird but almost nothing on HDFS","url":"https://arxiv.org/abs/2611.12775","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.12775","checkedAt":"2026-11-10T18:52:12.419Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How would LogCDM’s reported results and learned signal weights vary on log datasets beyond HDFS, BGL and Thunderbird?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI paper: LogCDM aims to make log anomaly detection compact and interpretable","summary":"Suryansh Talukdar, Taha Sarwat and Jin Soung Yoo present LogCDM, a compact system for finding unusual patterns in computer logs without requiring a GPU at inference. It scores each log session using three signals: a small causal Transformer’s next-event surprise, a graph-attention embedding’s distance from a normal reference graph, and a transition-drift statistic. The authors say the drift statistic is a frequency-weighted chi-squared divergence, which supports a length-standardized score and a per-edge explanation of alarms. A sigmoid gate combines the signals; under a shared-covariance Gaussian model, the authors say, this gate is the Bayes posterior. Its learned weights indicate which signal each dataset relies on.\n\nOn HDFS, chronologically split BGL and Thunderbird, the authors report F1 scores of 0.984, 0.870 and 0.850. They say these results are within 0.013–0.12 of an 8.1B-parameter LLM detector evaluated under the same protocol, and that LogCDM scores a session in 5.5–10.5 ms on a CPU. Ablations show the structural signals add 0.025–0.030 F1 on BGL and Thunderbird but almost nothing on HDFS. This difference matters to the paper’s account of interpretability: the signals can contribute differently across datasets, and their learned weights indicate that variation.","question":"How would LogCDM’s reported results and learned signal weights vary on log datasets beyond HDFS, BGL and Thunderbird?","claims":[{"text":"LogCDM scores log sessions using three signals: next-event surprise, distance from a normal reference graph, and transition drift.","excerpt":"scores each log session using three complementary signals: the next-event surprise of a small causal Transformer, the distance between a graph-attention embedding","support":"source-stated"},{"text":"The authors describe transition drift as a frequency-weighted chi-squared divergence, yielding a length-standardized score and a per-edge explanation of alarms.","excerpt":"a transition-drift statistic that we show is exactly a frequency-weighted chi-squared divergence between transition kernels. The divergence view yields an asymptotic null distribution, a length-standardized score, and a per-edge decomposition","support":"source-stated"},{"text":"Under a shared-covariance Gaussian model, the authors say the sigmoid gate that fuses the signals is the Bayes posterior; its learned weights indicate which signal each dataset relies on.","excerpt":"under a shared-covariance Gaussian model, this gate is the Bayes posterior, and its learned weights indicate which signal each dataset relies on.","support":"source-stated"},{"text":"The authors report F1 scores of 0.984 on HDFS, 0.870 on chronologically split BGL and 0.850 on Thunderbird, within 0.013–0.12 of an 8.1B-parameter LLM detector evaluated under the same protocol.","excerpt":"LogCDM reaches F1 scores of 0.984 on HDFS, 0.870 on chronologically split BGL, and 0.850 on Thunderbird, within 0.013-0.12 of an 8.1B-parameter LLM detector evaluated under the same protocol","support":"source-stated"},{"text":"The authors report CPU session-scoring times of 5.5–10.5 ms and say structural signals add 0.025–0.030 F1 on BGL and Thunderbird but almost nothing on HDFS.","excerpt":"It scores a session in 5.5-10.5 ms on a CPU. Ablations show that the structural signals add 0.025-0.030 F1 on BGL and Thunderbird but almost nothing on HDFS","support":"source-stated"}],"limitations":["The supplied evidence is the paper’s abstract, not its full methods or evaluation details.","The reported F1 scores and CPU timings describe the stated evaluations; the abstract does not establish performance in operational monitoring beyond them."],"mediaId":"2d54b3d214d5fe01841d97e4abbb08eba56c31f7d821a98848447e384ba42dae","correctionReason":null,"id":"916d2c768b95a5b6a9dd8859fdd1142bfb00e0de8d3918e58c06732a9c58ffc0","publicationId":"2c81b4d1-c957-40ec-8b5a-1bb0877a5a76","version":1,"sourceUrl":"https://arxiv.org/abs/2611.12775","sourceTitle":"LogCDM: Interpretable Log Anomaly Detection via Behavioral Graph Drift and Adaptive Signal Fusion","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-09","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-10T08:39:43.674Z","createdAt":"2026-11-10T17:49:04.411Z","historical":false,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"2d54b3d214d5fe01841d97e4abbb08eba56c31f7d821a98848447e384ba42dae","kind":"article","url":"https://arxiv.org/abs/2611.12775","sourceUrl":"https://arxiv.org/abs/2611.12775","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-10T17:47:52.302Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.12775","checkedAt":"2026-11-10T18:52:12.419Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"2d54b3d214d5fe01841d97e4abbb08eba56c31f7d821a98848447e384ba42dae","confidence":0.91,"provider":"typesafe","model":"jev-1.13.0","inputHash":"7ba83030070a6c485ea9a96a480f9657076ddab8f7babd0d182c216e1fc67d31","decidedAt":"2026-11-10T17:47:52.779Z"},"provenance":{"textHash":"43c15b827fcbbedefc15beeba7b1c55ff412a98e555259cc81ac3c58d30e4035","observationId":"9e898e70d33d822b871a09ca5a880a43f93efd3ea3824caa265f3f435af143e8","retrievedAt":"2026-11-10T17:47:52.245Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"50b99e11-5020-4878-83ac-72bbe4dce60c"},"reviewer":{"model":"gpt-6-luna","runId":"5cdb1f4c-1397-4dc7-8235-2669d9aa20c7"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-10T17:49:04.411Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Talukdar, Suryansh","url":null,"kind":"unknown"},{"name":"Sarwat, Taha","url":null,"kind":"unknown"},{"name":"Yoo, Jin Soung","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Talukdar, Suryansh","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Talukdar, Suryansh","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.12775","locator":"head/meta[name=author|citation_author]"},"assertionId":"9a35380cb00c6b863bf522a4bbaa95b59fe84d6cf98468e76c2db362b0367fd5:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T18:52:12.419Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9a35380cb00c6b863bf522a4bbaa95b59fe84d6cf98468e76c2db362b0367fd5","sourceUrl":"https://arxiv.org/abs/2611.12775","contentSha256":"9e66370ea0762d0573d46f05a4315afd81c0f416d343ba32c8e9754e72696f1d","textHash":"43c15b827fcbbedefc15beeba7b1c55ff412a98e555259cc81ac3c58d30e4035","observedAt":"2026-11-10T18:52:12.419Z"}},{"actor":{"name":"Sarwat, Taha","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Sarwat, Taha","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.12775","locator":"head/meta[name=author|citation_author]"},"assertionId":"9a35380cb00c6b863bf522a4bbaa95b59fe84d6cf98468e76c2db362b0367fd5:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T18:52:12.419Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9a35380cb00c6b863bf522a4bbaa95b59fe84d6cf98468e76c2db362b0367fd5","sourceUrl":"https://arxiv.org/abs/2611.12775","contentSha256":"9e66370ea0762d0573d46f05a4315afd81c0f416d343ba32c8e9754e72696f1d","textHash":"43c15b827fcbbedefc15beeba7b1c55ff412a98e555259cc81ac3c58d30e4035","observedAt":"2026-11-10T18:52:12.419Z"}},{"actor":{"name":"Yoo, Jin Soung","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Yoo, Jin Soung","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.12775","locator":"head/meta[name=author|citation_author]"},"assertionId":"9a35380cb00c6b863bf522a4bbaa95b59fe84d6cf98468e76c2db362b0367fd5:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T18:52:12.419Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9a35380cb00c6b863bf522a4bbaa95b59fe84d6cf98468e76c2db362b0367fd5","sourceUrl":"https://arxiv.org/abs/2611.12775","contentSha256":"9e66370ea0762d0573d46f05a4315afd81c0f416d343ba32c8e9754e72696f1d","textHash":"43c15b827fcbbedefc15beeba7b1c55ff412a98e555259cc81ac3c58d30e4035","observedAt":"2026-11-10T18:52:12.419Z"}}],"participationCoverage":{"total":3,"returned":3,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.12775","snapshotId":"9a35380cb00c6b863bf522a4bbaa95b59fe84d6cf98468e76c2db362b0367fd5","contentSha256":"9e66370ea0762d0573d46f05a4315afd81c0f416d343ba32c8e9754e72696f1d","textHash":"43c15b827fcbbedefc15beeba7b1c55ff412a98e555259cc81ac3c58d30e4035","observedAt":"2026-11-10T18:52:12.419Z","basis":"publisher-page-metadata","sourceLinks":41,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/916d2c768b95a5b6a9dd8859fdd1142bfb00e0de8d3918e58c06732a9c58ffc0/source"}}}],"audits":[{"publicationId":"2c81b4d1-c957-40ec-8b5a-1bb0877a5a76","verdict":"uncertain","findings":[{"dimension":"attribution","status":"pass","explanation":"The draft correctly attributes the paper to Suryansh Talukdar, Taha Sarwat and Jin Soung Yoo on arXiv cs.AI. It frames the technical claims and results as statements by the authors.","excerpt":"Authors:Suryansh Talukdar, Taha Sarwat, Jin Soung Yoo"},{"dimension":"summary","status":"uncertain","explanation":"The draft is faithful but hard to follow for a general reader. It uses causal Transformer, graph-attention embedding, chi-squared divergence, sigmoid gate, Bayes posterior, F1, ablations and the HDFS, BGL and Thunderbird datasets without plain explanation. It also drops the abstract's central motivation: large pretrained models need GPUs and are hard to deploy on the monitoring nodes where logs are produced. Smallest repair: add that motivation in one sentence, gloss F1 and the datasets briefly, and rely on term-library tooltips for the remaining terms.","excerpt":"which require GPUs at inference time and are difficult to deploy on the monitoring nodes where logs are produced"},{"dimension":"date","status":"pass","explanation":"The originalPublished date of 2026-11-09 matches the v1 submission date. The feed date of Nov 10 is correctly not used.","excerpt":"[Submitted on 9 Nov 2026]"},{"dimension":"support","status":"pass","explanation":"The claims, figures and conditions match the abstract, including the same-protocol LLM comparison, CPU timing and ablation results. Linking the ablation differences to interpretability is a modest reading of the abstract's statement that the ablations are consistent with the learned fusion weights. The limitations appropriately note that the evidence is abstract-only and that operational performance is not established.","excerpt":"Ablations show that the structural signals add 0.025-0.030 F1 on BGL and Thunderbird but almost nothing on HDFS, consistent with the learned fusion weights."},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct link to the original arXiv abstract page, which is the most relevant access point for this source.","excerpt":null}],"createdAt":"2026-11-10T17:49:04.411Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}