Towards automated data analysis: A guided framework for LLM-based risk estimation

This paper proposes a human-guided framework that leverages Large Language Models to automate dataset risk estimation by identifying schema properties, generating clustering code, and interpreting results, thereby addressing the limitations of manual auditing and fully automated AI approaches.

The Gist

Imagine you are the captain of a massive ship (a huge database) trying to find a few hidden treasure chests (risky data points, like electricity theft) buried under tons of sand.

In the past, you had to hire a team of divers to manually sift through every grain of sand. It was slow, expensive, and exhausting.

Recently, people discovered a super-smart robot assistant (a Large Language Model, or LLM) that can read maps and understand language incredibly well. But there's a catch: this robot is a bit like a brilliant but scatterbrained genius. It can hallucinate (make things up), get confused by messy handwriting, or accidentally steer the ship off course if you aren't watching.

This paper proposes a new way to use this robot: The "Human-in-the-Loop" Captain's Framework.

Here is how the framework works, broken down into four simple steps using a Detective Agency analogy:

The Goal

Instead of letting the robot do everything alone (which is risky) or doing everything manually (which is too slow), the authors created a guided system where a Human Supervisor acts as the Chief Detective, and the LLM acts as the brilliant but junior investigator.

The 4-Step Process

1. The Briefing (Understanding the Crime Scene)

• What happens: The Human gives the robot a messy pile of clues (the database schema and metadata).
• The Robot's Job: The robot reads the clues and tries to figure out how they connect. It says, "Hey, this column looks like a 'customer ID' and that one looks like 'electricity usage'." It draws a map of the relationships.
• The Human's Role: The Chief Detective checks the map. "Good job, but make sure you didn't mix up the 'phone numbers' with the 'addresses'." This ensures the robot understands the meaning of the data, not just the letters.

2. The Strategy Session (Choosing the Tools)

• What happens: Now that the robot knows the map, the Human asks, "How should we find the thieves?"
• The Robot's Job: The robot acts like a library of every detective movie ever made. It suggests different strategies: "We could group people by where they live (Geospatial), by when they use power (Time Series), or by how often they call customer service (Behavioral)."
• The Human's Role: The Chief picks the best strategies and says, "Yes, let's try those four."

3. The Execution (Writing the Code)

• What happens: The robot needs to build the actual tools to catch the thieves. It writes computer code (scripts) to run the strategies.
• The Problem: Sometimes the robot writes code that is too slow or crashes the computer (like a detective trying to run a marathon in high heels).
• The Human's Role: The Chief runs the code. If it breaks or is too slow, the Chief says, "Hey, fix this part to use the graphics card faster," or "This memory usage is too high, simplify it." The robot fixes it, and they try again. This back-and-forth ensures the tools actually work.

4. The Verdict (Analyzing the Results)

• What happens: The tools run and produce a massive list of suspects. The robot needs to read this list and write a final report.
• The Robot's Job: It looks at the results and tries to summarize them.
• The Human's Role: The Chief realizes the robot's first summary is too vague. "I don't just want a list; I want a 'Risk Score' for every single house." The Chief asks the robot to write a new script that combines all the different strategies into one final "Consensus Score."
  • The Magic Trick: The robot creates a voting system. If 3 out of 4 different strategies say "This house is suspicious," it gets a high risk score. If only 1 says it, it's probably a false alarm.

The Real-World Test

The authors tested this on a real problem: Electricity Theft in Greece.
They had data from over 1.2 million households. The data was messy, incomplete, and hard to read.

• The Result: The system successfully identified that about 39% of the households were high-risk.
• The Win: Out of all the confirmed theft cases the humans knew about, the system caught 87% of them in that top 39% group.

Why This Matters

The paper concludes that we aren't ready to let AI run the show completely alone yet. AI is too prone to "hallucinations" (making things up) and "misalignment" (doing what it thinks you want, not what you actually want).

The Takeaway:
Think of this framework as a co-pilot system. The AI is the powerful engine that does the heavy lifting, but the Human is the pilot holding the controls, checking the instruments, and steering the plane to safety. This allows us to get the speed of AI without crashing the plane.

Technical Summary

1. Problem Statement

The integration of Large Language Models (LLMs) into critical decision-making pipelines has created a demand for automated data analysis. However, current approaches face significant limitations:

• Manual Auditing: Traditional risk analysis relies on time-consuming, complex manual auditing.
• Fully Automated AI Risks: Fully autonomous AI analysis suffers from hallucinations (generating inconsistent or false outputs) and alignment issues (failing to meet specific task objectives).
• Data Complexity: Real-world datasets, particularly in domains like power grid non-technical loss (theft) detection, are often unstructured, sparse, irregular, and contain non-standard naming conventions, making them difficult for traditional heuristic algorithms to process effectively.

The core challenge is to achieve a high degree of automation in risk analysis while maintaining the reliability and safety required for critical infrastructure, without relying solely on error-prone fully autonomous agents.

2. Methodology: The Guided Framework

The authors propose a Human-in-the-Loop (HITL) framework that integrates Generative AI under human supervision. Instead of a single "zero-shot" prompt to analyze a whole dataset, the process is divided into four sequential stages, each initiated in a new LLM session to prevent context contamination from failed intermediate steps.

Stage 1: Entity and Relationship Identification

• Input: Dataset description, metadata, and schema.
• Process: The LLM acts as a semantic interpreter, mapping abstract schema symbols to real-world concepts (Schema Item Grounding). It identifies entities, relationships (e.g., foreign keys), and suggests appropriate clustering techniques.
• Key Capability: The model handles non-standard nomenclature and obfuscated field names by inferring semantic roles through context and data types, bridging the gap between data structure and human interpretation.

Stage 2: Clustering Technique Suggestion & Code Generation

• Input: Dataset description, data reports, and suggested techniques from Stage 1.
• Process: The LLM generates executable code (e.g., Python) to implement the suggested clustering algorithms.
• Human Role: The supervisor reviews the code. If the code fails (e.g., due to hallucination or lack of optimization like GPU usage), the human refines the prompt to correct the error. This stage leverages the LLM's training on vast academic literature to recommend state-of-the-art algorithms.

Stage 3: Execution

• Process: The generated code is executed (by the human or an agent).
• Output: Clustering results are stored in files containing entity classifications and statistical distributions of labeled samples within clusters.

Stage 4: Results Analysis and Reporting

• Input: Clustering results, dataset description, and code descriptions.
• Process: The LLM analyzes the output files to produce a conclusive risk assessment report.
• Mechanism: If data volume is too large for direct processing, the LLM generates a script to summarize the data, which the human executes. The model synthesizes a final rating report, often using a consensus mechanism to aggregate results from multiple algorithms.

3. Key Contributions

1. Structured HITL Framework: A novel four-stage workflow that balances automation with human oversight, specifically designed to mitigate LLM hallucinations and alignment risks in critical data analysis.
2. Semantic Schema Grounding: Demonstrating that LLMs can effectively reconstruct data topology and identify relationships in databases lacking explicit constraints or using ambiguous naming conventions.
3. Algorithm Selection & Synthesis: Utilizing LLMs not just for analysis, but as an advanced recommendation engine to select and implement complex clustering algorithms (e.g., K-Means, K-Prototypes) tailored to specific data characteristics.
4. Consensus-Based Risk Scoring: A mathematical formulation for aggregating risk scores from multiple models using a rank-based voting system, prioritizing the "breadth of suspicion" (agreement across models) over "depth of suspicion" (high score in a single model).

4. Experimental Results (Proof of Concept)

The framework was validated using a real-world dataset from the Hellenic Electricity Distribution Network Operator (HEDNO) regarding non-technical losses (electricity theft).

• Dataset: 1.23 million consumer accounts, 9.2 million consumption measurements, and 3,842 verified theft cases. The data was highly sparse and irregular.
• Model: Gemini 3.0 Pro.
• Algorithms Tested:
  1. Geospatial Clustering (K-Means on coordinates).
  2. Time Series Clustering (Consumption profiles).
  3. Mixed-Type Clustering (K-Prototypes for numerical/categorical data).
  4. Behavioral/Event Clustering (Frequency of administrative requests).
• Performance:
  • The framework successfully identified risky entities.
  • Precision: The top 4 risk classes (Classes 1–4) contained 38.79% of the total samples but captured 87.66% of the verified theft cases.
  • Recall: The remaining 61.21% of samples (Class 0) were correctly classified as low/no risk.
  • Efficiency: Each process stage ran in under 3 minutes on a standard workstation (15GB RAM, Tesla T4 GPU).
• Refinement: The process required iterative prompt refinement (e.g., requesting GPU acceleration, memory optimization, and specific consensus logic) to handle code errors and large data volumes, validating the necessity of the Human-in-the-Loop approach.

5. Significance and Conclusion

The paper demonstrates that while fully autonomous AI for critical risk analysis is currently unsafe due to hallucination and alignment issues, a guided, multi-stage framework is highly effective.

• Paradigm Shift: It moves beyond simple "chat-based assistants" to a structured pipeline capable of generating full data analysis reports with high automation.
• Safety: By keeping the human in the loop to supervise integrity, debug code, and verify alignment, the framework mitigates the risks associated with stochastic LLM behavior.
• Scalability: The approach is adaptable to various domains where data is unstructured or complex, offering a pathway toward future autonomous agents that can operate safely once LLM reliability matures.

The authors conclude that this framework provides a robust foundation for the future of automated risk analysis, balancing the advanced reasoning capabilities of LLMs with the necessary safeguards of human supervision.