FAME: Failure-Aware Mixture-of-Experts for Message-Level Log Anomaly Detection

• URL: http://arxiv.org/abs/2605.22779v1
• Date: Thu, 21 May 2026 17:34:53 GMT
• Title: FAME: Failure-Aware Mixture-of-Experts for Message-Level Log Anomaly Detection
• Abstract summary: We present FAME (Failure-Aware Mixture-of-Experts), a label-efficient message-level mixture-of-experts framework.<n>FAME trains a lightweight router and domain experts that run on-premise and output anomaly predictions.<n>On BGL, FAME achieves F1 = 98.16 at K = 100 reducing annotation effort by 76x and detects 86.3% of anomalies from unseen EventIDs.
• Score: 6.975728318257755
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Production systems generate millions of log lines daily, yet most anomaly detectors operate at the session or window-level, flagging groups of lines rather than identifying the specific message responsible. This coarse granularity forces operators to inspect many routine lines per alert. Message-level detection offers finer granularity, but remains challenging. A single event template may correspond to both normal and anomalous messages, failures arise from heterogeneous subsystems, and line-level labeling at scale is impractical. Although large language models (LLMs) can reason over log semantics, applying them to every line is too costly for continuous monitoring. We present FAME (Failure-Aware Mixture-of-Experts), a label-efficient message-level mixture-of-experts framework that uses an LLM only once offline. We annotate at most K labeled lines per template to derive binary normal/anomaly indicators and representative examples. The LLM proposes a partition of templates into failure domains, and a certification step validates the proposal before training. FAME trains a lightweight router and domain experts that run on-premise and output anomaly predictions and failure-domain labels. On BGL, FAME achieves F1 = 98.16 at K = 100 reducing annotation effort by 76x and detects 86.3% of anomalies from unseen EventIDs. On Thunderbird, FAME reaches F1 = 99.95 with perfect recall.

Related papers

• DCFA: Dual-view Causal-inspired Attribution for Failure Reasoning in LLM-based Multi-agent Systems [61.11435469308521]
  We propose DCFA, a training-free framework for failure attribution in large language model systems.<n> DCFA integrates a global module that constructs structured causal-inspired dependency graphs from system traces.<n>Experiments show that DCFA improves step-level accuracy by up to 8.27% over state-of-the-art baselines.
  arXiv  Detail & Related papers  (2026-09-04T05:29:31Z)
• FailureSpot: Label-Efficient Timestamp-Level Failure Detection for Vision-Language-Action Models [12.030216781017558]
  Vision-language--action (VLA) policies can fail unpredictably during long-horizon execution.<n>We propose a data-efficient framework that first leverages unlabeled VLA action chunks to construct weak supervision signals.<n>We then use active learning to select only the most uncertain trajectories for timestamp-level annotation.
  arXiv  Detail & Related papers  (2026-09-03T00:04:06Z)
• When Agentic Executions Fail: Detecting and Localizing Runtime Faults from Telemetry [12.471487731560643]
  AGENTCHAOSBENCH is a benchmark for detecting and localizing runtime faults in agentic systems from execution telemetry.<n>We run five applications that coordinate agents over the Agent-to-Agent protocol and call tools through the Model Context Protocol.<n>The resulting dataset contains 2759.2% traces: 250 faulty executions spanning ten fault types and 25 no-fault controls.
  arXiv  Detail & Related papers  (2026-08-04T20:47:37Z)
• LogSemFuse: Semantic Evidence Fusion for Explainable Log Anomaly Detection [6.950497660953971]
  LogSemFuse is an evidence-guided plug-in framework that enhances existing backbone detectors without replacing their original pipelines.<n>We evaluate LogSemFuse on HDFS, BGL, and Liberty using DeepLog, LogAnomaly, LogBERT, and NeuralLog as backbones.
  arXiv  Detail & Related papers  (2026-07-03T20:50:07Z)
• Early Diagnosis of Wasted Computation in Multi-Agent LLM Systems via Failure-Aware Observability [8.036549927091286]
  This paper introduces a failure-aware observability framework for diagnosing wasted computation in multi-agent LLM traces.<n>We instantiate the framework in a three- agent question-answering system and evaluate it on 165 GAIA validation traces under identical execution caps.
  arXiv  Detail & Related papers  (2026-05-31T17:50:11Z)
• VerifyMAS: Hypothesis Verification for Failure Attribution in LLM Multi-Agent Systems [79.51005192758262]
  Large language model-driven multi-agent systems excel at complex tasks.<n>However, unreliable agents remain a key bottleneck to system-level reliability.<n>We propose a hypothesis verification framework for agent failure attribution.
  arXiv  Detail & Related papers  (2026-05-17T14:09:35Z)
• Arbiter: Detecting Interference in LLM Agent System Prompts [0.0]
  Arbiter is a framework combining formal evaluation rules with multi-model LLM scouring to detect interference patterns in system prompts.<n> Applied to three major coding agent system prompts: Claude Code (Anthropic), Codex CLI (OpenAI), and Gemini CLI (Google)
  arXiv  Detail & Related papers  (2026-03-09T22:29:47Z)
• DoVer: Intervention-Driven Auto Debugging for LLM Multi-Agent Systems [48.971606069204825]
  DoVer is an intervention-driven debug framework for large language model (LLM)-based multi-agent systems.<n>It augments hypothesis generation with active verification through targeted interventions.<n>DoVer flips 18-28% of failed trials into successes, achieves up to 16% milestone progress, and validates or refutes 30-60% of failure hypotheses.
  arXiv  Detail & Related papers  (2025-12-07T09:23:48Z)
• Causal Intervention Sequence Analysis for Fault Tracking in Radio Access Networks [18.99444800453706]
  We introduce an AI/ML pipeline that does two things most tools miss: (1) finds the likely root-cause indicators and (2) reveals the exact order in which those events unfold.<n>Our model then learns the causal chain that turns normal behavior into a fault.<n>In Monte Carlo tests the approach pinpoints the correct trigger sequence with high precision and scales to millions of data points without loss of speed.
  arXiv  Detail & Related papers  (2025-10-02T14:34:59Z)
• Where LLM Agents Fail and How They can Learn From Failures [62.196870049524364]
  Large Language Model (LLM) agents have shown promise in solving complex, multi-step tasks.<n>They amplify vulnerability to cascading failures, where a single root-cause error propagates through subsequent decisions.<n>Current systems lack a framework that can comprehensively understand agent error in a modular and systemic way.<n>We introduce the AgentErrorTaxonomy, a modular classification of failure modes spanning memory, reflection, planning, action, and system-level operations.
  arXiv  Detail & Related papers  (2025-09-29T18:20:27Z)
• Towards Automated Error Discovery: A Study in Conversational AI [48.735443116662026]
  We introduce Automated Error Discovery, a framework for detecting and defining errors in conversational AI.<n>We also propose SEEED (Soft Clustering Extended-Based Error Detection), as an encoder-based approach to its implementation.
  arXiv  Detail & Related papers  (2025-09-13T14:53:22Z)
• Efficient Detection of Intermittent Job Failures Using Few-Shot Learning [2.8402080392117757]
  We introduce a novel approach to intermittent job failure detection using few-shot learning.<n>Our approach achieves 70-88% F1-score with only 12 shots in all projects, outperforming the state-of-the-art (SOTA) approach.
  arXiv  Detail & Related papers  (2025-07-05T22:04:01Z)
• Lemur: Log Parsing with Entropy Sampling and Chain-of-Thought Merging [18.823038918091207]
  We introduce a cutting-edge texttextbfLog parsing framework with textbfEntropy sampling and chain-of-thought textbfMerging (model)<n>To discard the tedious manual rules, we propose a novel sampling method inspired by information entropy, which efficiently clusters typical logs.<n>We have conducted experiments on large-scale public datasets.
  arXiv  Detail & Related papers  (2024-02-28T09:51:55Z)
• Hard-normal Example-aware Template Mutual Matching for Industrial Anomaly Detection [78.734927709231]
  Anomaly detectors are widely used in industrial manufacturing to detect and localize unknown defects in query images.<n>These detectors are trained on anomaly-free samples and have successfully distinguished anomalies from most normal samples.<n>However, hard-normal examples are scattered and far apart from most normal samples, and thus they are often mistaken for anomalies by existing methods.
  arXiv  Detail & Related papers  (2023-03-28T17:54:56Z)
• Self-Supervised Log Parsing [59.04636530383049]
  Large-scale software systems generate massive volumes of semi-structured log records. Existing approaches rely on log-specifics or manual rule extraction. We propose NuLog that utilizes a self-supervised learning model and formulates the parsing task as masked language modeling.
  arXiv  Detail & Related papers  (2020-03-17T19:25:25Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.