# arXiv cs.AI paper: LogCDM aims to make log anomaly detection compact and interpretable [Canonical reading](https://escapemeridian.com/readings/arxiv-cs-ai-paper-logcdm-aims-to-make-log-anomaly-detection-916d2c76) Suryansh Talukdar, Taha Sarwat and Jin Soung Yoo present LogCDM, a compact system for finding unusual patterns in computer logs without requiring a GPU at inference. It scores each log session using three signals: a small causal Transformer’s next-event surprise, a graph-attention embedding’s distance from a normal reference graph, and a transition-drift statistic. The authors say the drift statistic is a frequency-weighted chi-squared divergence, which supports a length-standardized score and a per-edge explanation of alarms. A sigmoid gate combines the signals; under a shared-covariance Gaussian model, the authors say, this gate is the Bayes posterior. Its learned weights indicate which signal each dataset relies on. On HDFS, chronologically split BGL and Thunderbird, the authors report F1 scores of 0.984, 0.870 and 0.850. They say these results are within 0.013–0.12 of an 8.1B-parameter LLM detector evaluated under the same protocol, and that LogCDM scores a session in 5.5–10.5 ms on a CPU. Ablations show the structural signals add 0.025–0.030 F1 on BGL and Thunderbird but almost nothing on HDFS. This difference matters to the paper’s account of interpretability: the signals can contribute differently across datasets, and their learned weights indicate that variation. Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source arXiv cs.AI · Article Original source date: Nov 9, 2026 (2026-11-09). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-10T17:49:04.411Z. First observed: 2026-11-10T08:39:43.674Z. Retrieved: 2026-11-10T17:47:52.245Z. - [LogCDM: Interpretable Log Anomaly Detection via Behavioral Graph Drift and Adaptive Signal Fusion](https://arxiv.org/abs/2611.12775) ## Limits The supplied evidence is the paper’s abstract, not its full methods or evaluation details. The reported F1 scores and CPU timings describe the stated evaluations; the abstract does not establish performance in operational monitoring beyond them. ## Open question How would LogCDM’s reported results and learned signal weights vary on log datasets beyond HDFS, BGL and Thunderbird? ## Source-stated LogCDM scores log sessions using three signals: next-event surprise, distance from a normal reference graph, and transition drift. > scores each log session using three complementary signals: the next-event surprise of a small causal Transformer, the distance between a graph-attention embedding - [Supporting source](https://arxiv.org/abs/2611.12775) ## Source-stated The authors describe transition drift as a frequency-weighted chi-squared divergence, yielding a length-standardized score and a per-edge explanation of alarms. > a transition-drift statistic that we show is exactly a frequency-weighted chi-squared divergence between transition kernels. The divergence view yields an asymptotic null distribution, a length-standardized score, and a per-edge decomposition - [Supporting source](https://arxiv.org/abs/2611.12775) ## Source-stated Under a shared-covariance Gaussian model, the authors say the sigmoid gate that fuses the signals is the Bayes posterior; its learned weights indicate which signal each dataset relies on. > under a shared-covariance Gaussian model, this gate is the Bayes posterior, and its learned weights indicate which signal each dataset relies on. - [Supporting source](https://arxiv.org/abs/2611.12775) ## Source-stated The authors report F1 scores of 0.984 on HDFS, 0.870 on chronologically split BGL and 0.850 on Thunderbird, within 0.013–0.12 of an 8.1B-parameter LLM detector evaluated under the same protocol. > LogCDM reaches F1 scores of 0.984 on HDFS, 0.870 on chronologically split BGL, and 0.850 on Thunderbird, within 0.013-0.12 of an 8.1B-parameter LLM detector evaluated under the same protocol - [Supporting source](https://arxiv.org/abs/2611.12775) ## Source-stated The authors report CPU session-scoring times of 5.5–10.5 ms and say structural signals add 0.025–0.030 F1 on BGL and Thunderbird but almost nothing on HDFS. > It scores a session in 5.5-10.5 ms on a CPU. Ablations show that the structural signals add 0.025-0.030 F1 on BGL and Thunderbird but almost nothing on HDFS - [Supporting source](https://arxiv.org/abs/2611.12775) ## Source and contributor context Talukdar, Suryansh, Sarwat, Taha, Yoo, Jin Soung · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Graphics processing unit A chip that performs many calculations at once; the main hardware used to train and run AI models. - [Definition reference](https://en.wikipedia.org/wiki/Graphics_processing_unit) ## Large language model A language model with many learned numerical settings, used to process and generate language. - [Definition reference](https://developers.google.com/machine-learning/glossary#large-language-model) ## CPU The central processing unit: a general-purpose processor that carries out a computer's instructions. - [Definition reference](https://aws.amazon.com/what-is/cpu/) ## Interpretability Research into how a model reaches its outputs, often by examining its internal workings. - [Definition reference](https://developers.google.com/machine-learning/glossary#interpretability) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: 2c81b4d1-c957-40ec-8b5a-1bb0877a5a76. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-10T17:49:04.411Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 9e898e70d33d822b871a09ca5a880a43f93efd3ea3824caa265f3f435af143e8. Source text hash: 43c15b827fcbbedefc15beeba7b1c55ff412a98e555259cc81ac3c58d30e4035. ## Revision and source-check history ### Version 1 — 2026-11-10T17:49:04.411Z Suryansh Talukdar, Taha Sarwat and Jin Soung Yoo present LogCDM, a compact system for finding unusual patterns in computer logs without requiring a GPU at inference. It scores each log session using three signals: a small causal Transformer’s next-event surprise, a graph-attention embedding’s distance from a normal reference graph, and a transition-drift statistic. The authors say the drift statistic is a frequency-weighted chi-squared divergence, which supports a length-standardized score and a per-edge explanation of alarms. A sigmoid gate combines the signals; under a shared-covariance Gaussian model, the authors say, this gate is the Bayes posterior. Its learned weights indicate which signal each dataset relies on. On HDFS, chronologically split BGL and Thunderbird, the authors report F1 scores of 0.984, 0.870 and 0.850. They say these results are within 0.013–0.12 of an 8.1B-parameter LLM detector evaluated under the same protocol, and that LogCDM scores a session in 5.5–10.5 ms on a CPU. Ablations show the structural signals add 0.025–0.030 F1 on BGL and Thunderbird but almost nothing on HDFS. This difference matters to the paper’s account of interpretability: the signals can contribute differently across datasets, and their learned weights indicate that variation. ## Original source arXiv cs.AI · Article Original source date: Nov 9, 2026 (2026-11-09). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-10T17:49:04.411Z. First observed: 2026-11-10T08:39:43.674Z. Retrieved: 2026-11-10T17:47:52.245Z. - [LogCDM: Interpretable Log Anomaly Detection via Behavioral Graph Drift and Adaptive Signal Fusion](https://arxiv.org/abs/2611.12775) ## Limits The supplied evidence is the paper’s abstract, not its full methods or evaluation details. The reported F1 scores and CPU timings describe the stated evaluations; the abstract does not establish performance in operational monitoring beyond them. ## Open question How would LogCDM’s reported results and learned signal weights vary on log datasets beyond HDFS, BGL and Thunderbird? ## Source-stated LogCDM scores log sessions using three signals: next-event surprise, distance from a normal reference graph, and transition drift. > scores each log session using three complementary signals: the next-event surprise of a small causal Transformer, the distance between a graph-attention embedding - [Supporting source](https://arxiv.org/abs/2611.12775) ## Source-stated The authors describe transition drift as a frequency-weighted chi-squared divergence, yielding a length-standardized score and a per-edge explanation of alarms. > a transition-drift statistic that we show is exactly a frequency-weighted chi-squared divergence between transition kernels. The divergence view yields an asymptotic null distribution, a length-standardized score, and a per-edge decomposition - [Supporting source](https://arxiv.org/abs/2611.12775) ## Source-stated Under a shared-covariance Gaussian model, the authors say the sigmoid gate that fuses the signals is the Bayes posterior; its learned weights indicate which signal each dataset relies on. > under a shared-covariance Gaussian model, this gate is the Bayes posterior, and its learned weights indicate which signal each dataset relies on. - [Supporting source](https://arxiv.org/abs/2611.12775) ## Source-stated The authors report F1 scores of 0.984 on HDFS, 0.870 on chronologically split BGL and 0.850 on Thunderbird, within 0.013–0.12 of an 8.1B-parameter LLM detector evaluated under the same protocol. > LogCDM reaches F1 scores of 0.984 on HDFS, 0.870 on chronologically split BGL, and 0.850 on Thunderbird, within 0.013-0.12 of an 8.1B-parameter LLM detector evaluated under the same protocol - [Supporting source](https://arxiv.org/abs/2611.12775) ## Source-stated The authors report CPU session-scoring times of 5.5–10.5 ms and say structural signals add 0.025–0.030 F1 on BGL and Thunderbird but almost nothing on HDFS. > It scores a session in 5.5-10.5 ms on a CPU. Ablations show that the structural signals add 0.025-0.030 F1 on BGL and Thunderbird but almost nothing on HDFS - [Supporting source](https://arxiv.org/abs/2611.12775) ## Source and contributor context Talukdar, Suryansh, Sarwat, Taha, Yoo, Jin Soung · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Graphics processing unit A chip that performs many calculations at once; the main hardware used to train and run AI models. - [Definition reference](https://en.wikipedia.org/wiki/Graphics_processing_unit) ## Large language model A language model with many learned numerical settings, used to process and generate language. - [Definition reference](https://developers.google.com/machine-learning/glossary#large-language-model) ## CPU The central processing unit: a general-purpose processor that carries out a computer's instructions. - [Definition reference](https://aws.amazon.com/what-is/cpu/) ## Interpretability Research into how a model reaches its outputs, often by examining its internal workings. - [Definition reference](https://developers.google.com/machine-learning/glossary#interpretability) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: 2c81b4d1-c957-40ec-8b5a-1bb0877a5a76. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-10T17:49:04.411Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 9e898e70d33d822b871a09ca5a880a43f93efd3ea3824caa265f3f435af143e8. Source text hash: 43c15b827fcbbedefc15beeba7b1c55ff412a98e555259cc81ac3c58d30e4035. ### uncertain — 2026-11-10T17:49:04.411Z — anthropic/claude-opus-5.5 Publication: 2c81b4d1-c957-40ec-8b5a-1bb0877a5a76 attribution — pass: The draft correctly attributes the paper to Suryansh Talukdar, Taha Sarwat and Jin Soung Yoo on arXiv cs.AI. It frames the technical claims and results as statements by the authors. > Authors:Suryansh Talukdar, Taha Sarwat, Jin Soung Yoo summary — uncertain: The draft is faithful but hard to follow for a general reader. It uses causal Transformer, graph-attention embedding, chi-squared divergence, sigmoid gate, Bayes posterior, F1, ablations and the HDFS, BGL and Thunderbird datasets without plain explanation. It also drops the abstract's central motivation: large pretrained models need GPUs and are hard to deploy on the monitoring nodes where logs are produced. Smallest repair: add that motivation in one sentence, gloss F1 and the datasets briefly, and rely on term-library tooltips for the remaining terms. > which require GPUs at inference time and are difficult to deploy on the monitoring nodes where logs are produced date — pass: The originalPublished date of 2026-11-09 matches the v1 submission date. The feed date of Nov 10 is correctly not used. > \[Submitted on 9 Nov 2026\] support — pass: The claims, figures and conditions match the abstract, including the same-protocol LLM comparison, CPU timing and ablation results. Linking the ablation differences to interpretability is a modest reading of the abstract's statement that the ablations are consistent with the learned fusion weights. The limitations appropriately note that the evidence is abstract-only and that operational performance is not established. > Ablations show that the structural signals add 0.025-0.030 F1 on BGL and Thunderbird but almost nothing on HDFS, consistent with the learned fusion weights. media — pass: The selected media is the verified direct link to the original arXiv abstract page, which is the most relevant access point for this source. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/916d2c768b95a5b6a9dd8859fdd1142bfb00e0de8d3918e58c06732a9c58ffc0/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/arxiv-cs-ai-paper-logcdm-aims-to-make-log-anomaly-detection-916d2c76.json)