Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

AD-AGENT: A Multi-agent Framework for End-to-end Anomaly Detection

Tiankai Yang, Junjun Liu, Wingchun Siu, Jiahang Wang, Zhuangzhuang Qian, Chanjuan Song, Cheng Cheng, Xiyang Hu, Yue Zhao

TL;DR

Non-experts face barriers to building anomaly-detection pipelines due to modality diversity and library fragmentation. AD-Agent introduces an LLM-driven multi-agent framework that converts natural-language intents into executable pipelines across PyOD, PyGOD, and TSLib, guided by short-term and long-term memory. The approach provides unified automation across modalities, a modular design, and open-source availability, with experiments showing high pipeline-generation reliability, AUROC-based selection effectiveness, and substantial gains from memory caching. This work lowers the barrier to deploying robust anomaly detection in practice and paves the way for broader, community-driven AD tooling.

Abstract

Anomaly detection (AD) is essential in areas such as fraud detection, network monitoring, and scientific research. However, the diversity of data modalities and the increasing number of specialized AD libraries pose challenges for non-expert users who lack in-depth library-specific knowledge and advanced programming skills. To tackle this, we present AD-AGENT, an LLM-driven multi-agent framework that turns natural-language instructions into fully executable AD pipelines. AD-AGENT coordinates specialized agents for intent parsing, data preparation, library and model selection, documentation mining, and iterative code generation and debugging. Using a shared short-term workspace and a long-term cache, the agents integrate popular AD libraries like PyOD, PyGOD, and TSLib into a unified workflow. Experiments demonstrate that AD-AGENT produces reliable scripts and recommends competitive models across libraries. The system is open-sourced to support further research and practical applications in AD.

AD-AGENT: A Multi-agent Framework for End-to-end Anomaly Detection

TL;DR

Non-experts face barriers to building anomaly-detection pipelines due to modality diversity and library fragmentation. AD-Agent introduces an LLM-driven multi-agent framework that converts natural-language intents into executable pipelines across PyOD, PyGOD, and TSLib, guided by short-term and long-term memory. The approach provides unified automation across modalities, a modular design, and open-source availability, with experiments showing high pipeline-generation reliability, AUROC-based selection effectiveness, and substantial gains from memory caching. This work lowers the barrier to deploying robust anomaly detection in practice and paves the way for broader, community-driven AD tooling.

Abstract

Anomaly detection (AD) is essential in areas such as fraud detection, network monitoring, and scientific research. However, the diversity of data modalities and the increasing number of specialized AD libraries pose challenges for non-expert users who lack in-depth library-specific knowledge and advanced programming skills. To tackle this, we present AD-AGENT, an LLM-driven multi-agent framework that turns natural-language instructions into fully executable AD pipelines. AD-AGENT coordinates specialized agents for intent parsing, data preparation, library and model selection, documentation mining, and iterative code generation and debugging. Using a shared short-term workspace and a long-term cache, the agents integrate popular AD libraries like PyOD, PyGOD, and TSLib into a unified workflow. Experiments demonstrate that AD-AGENT produces reliable scripts and recommends competitive models across libraries. The system is open-sourced to support further research and practical applications in AD.
Paper Structure (19 sections, 4 figures, 4 tables)

This paper contains 19 sections, 4 figures, 4 tables.

Table of Contents

  1. Introduction and Related Work
  2. Methodology
  3. Agents
  4. Agent Collaboration and Workflow
  5. Experiments
  6. Pipeline Generation
  7. Model Selection
  8. Long-term Memory Efficiency
  9. Conclusion
  10. Related Works
  11. Experiments Details
  12. Datasets and Models
  13. PyOD
  14. PyGOD
  15. TSLib
  16. ...and 4 more sections

Figures (4)

  • Figure 1: Illustration of AD-Agent: given a user request, the multi-agent system coordinates each stage to generate a runnable pipeline.
  • Figure 2: Flowchart of AD-Agent. Users input natural language instructions and data from various modalities. AD-Agent coordinates multiple LLM-powered agents via short-term and long-term memory to construct anomaly detection pipelines. Solid arrows represent the default workflow; dashed arrows indicate an optional path that bypasses web searches when algorithm information is stored in long-term memory.
  • Figure 3: Model selection results for PyOD and PyGOD. We display the average AUROC of models recommended by querying the reasoning LLM three times (duplicates allowed). "Best Performance" marks the highest performance achieved by any available model for each dataset, while "Average Baseline" denotes the mean performance across all available models.
  • Figure 4: Model selection results for TSLib. We display the average F1-score of models recommended by querying the reasoning LLM three times (duplicates allowed). "Best Performance" marks the highest performance achieved by any available model for each dataset, while "Average Baseline" denotes the mean performance across all available models.