Controlled reasoning : integration of LLMs into anomaly detection pipelines

Abstract

The growing amount and complexity of organizational data has increased the need of anomaly detection. Traditional methods provide stable and interpretable results but struggle with contextual anomalies in high-cardinality and unstructured data. Large language models provide semantic reasoning but can cause challenges related to non-determinism and reproducibility.

This thesis investigates how LLMs can be integrated into an anomaly detection pipeline so that determinism and reproducibility are not jeopardized. As a result, a proof-of-concept system with hybrid architecture combining deterministic methods and constrained LLMs is developed using a design science approach.

The results show improved detection on context-dependent anomalies while maintaining reliability, demonstrating that LLMs are most effective as controlled components within deterministic systems.