Technical Summary: SAGE – A Multi-Agent LLM Framework for Structured Time Series Anomaly Diagnosis

1. Problem Statement

Time-series anomaly detection (TSAD) is critical for applications in industrial monitoring, finance, and network security. While existing methods range from classical statistics to deep learning, they predominantly focus on generating anomaly scores rather than providing structured explanations of anomaly types or decision evidence. Human experts typically diagnose anomalies by jointly considering statistics, trends, seasonality, and pattern changes, yet current automated methods often fail to decompose these perspectives.

Recent attempts to leverage Large Language Models (LLMs) for TSAD face significant limitations. Single general-purpose LLMs struggle with long numerical inputs, precise statistical operations (e.g., change-point analysis), and simultaneous reasoning across multiple temporal perspectives. Furthermore, existing multi-agent approaches often lack explicit organization around distinct anomaly families (point, structural, seasonal, pattern), and many rely on real anomalous examples for in-context learning (ICL), which is often unavailable in zero-shot or unsupervised settings.

2. Methodology: The SAGE Framework

The authors propose SAGE (Specialized Analyzer Group for Expert-like Detection), a multi-agent LLM framework designed for structured anomaly diagnosis in univariate time series. Rather than treating TSAD as a single scoring problem, SAGE decomposes the analysis into specialized perspectives and aggregates evidence into a unified diagnostic decision.

2.1 Overall Architecture

SAGE operates as a hierarchical pipeline with five stages:

1. Input Stage: Receives a univariate time series.
2. Representation Stage: Implements a Dual Representation Strategy. The original time series is preserved for precise numerical computation by dedicated tools, while a compressed summary (containing key statistics and rounded representative samples) is used for token-efficient LLM prompting. This reduces token usage by approximately 75% for 400-point inputs without sacrificing numerical fidelity.
3. Multi-Analyzer Stage: Four specialized Analyzers operate in parallel, each targeting a specific anomaly family:
   • Point Analyzer: Detects global and contextual point anomalies using outlier detection (Z-score, IQR) and rolling statistics.
   • Struct Analyzer: Identifies trend, mean, and variance changes using decomposition (STL), change-point tests (CUSUM), and segment comparisons.
   • Season Analyzer: Detects amplitude and seasonality anomalies via autocorrelation, spectral analysis (FFT), and time-frequency representations (Wavelet, STFT).
   • Pattern Analyzer: Identifies pattern shifts and waveform distortions using symbolic representations (SAX) and recurrence-based methods (Recurrence Plots, GAF, MTF).
     Each analyzer generates family-specific quantitative outputs and diagnostic visualizations.
4. Detector Stage: An Evidence-Grounded Detector aggregates the heterogeneous outputs from the four Analyzers. It produces anomaly intervals, candidate types, and confidence scores. The Detector uses a rubric-guided scoring protocol (0–100 scale) that prioritizes candidates supported by strong tool outputs and cross-analyzer agreement.
5. Diagnosis Stage: A Supervisor agent converts the structured detection records into an analyst-facing report, including alert levels, alarm rationales, time-series characteristics, and recommended actions.

2.2 Synthetic In-Context Learning (ICL)

A key innovation is the construction of Synthetic ICL references. Instead of using real anomalous segments or anomaly-type labels as in-context examples (which are often unavailable), SAGE constructs a database from normal-reference training segments.

• Representative normal subsequences are extracted via k-medoids clustering.
• Rule-based perturbations are applied to these normal prototypes to generate synthetic contrastive pairs for nine specific anomaly types.
• At inference, the system retrieves the top-k most similar normal prototypes using Dynamic Time Warping (DTW) and selects synthetic contrastive references based on the anomaly type candidates proposed by the Analyzers.
• This approach allows the Detector to perform confidence scoring and type ranking without relying on real anomalous demonstrations or test-set labels.

3. Key Contributions

1. Reformulation of TSAD: The paper reframes time-series anomaly detection as a structured diagnosis task, decomposing analysis by evidence patterns to produce intervals, confidence scores, anomaly types, and diagnostic outputs.
2. Specialized Multi-Agent Architecture: SAGE introduces four specialized Analyzers for point, structural, seasonal, and pattern anomalies, coupled with an evidence-grounded Detector that aggregates heterogeneous tool evidence.
3. Synthetic ICL Strategy: The framework builds synthetic in-context examples from normal-reference training segments, avoiding the need for real anomalous segments or anomaly-type labels as in-context examples.
4. Comprehensive Evaluation: The authors demonstrate improved detection performance and diagnostic usefulness across three benchmarks, ablation studies, synthetic type evaluations, and human evaluations.

4. Experimental Results

The authors evaluated SAGE on three representative TSAD benchmark datasets: Yahoo S5 (web traffic), KPI (IT infrastructure), and WSD (web service metrics).

• Performance: SAGE achieved the best average performance across all metrics (Point-F1, PA-F1, Affiliation-F1, Delayed-F1) compared to strong ML/DL baselines (e.g., Isolation Forest, LSTM-AE, Anomaly Transformer) and recent LLM/VLM-based methods (e.g., LLMAD, TAMA, TSAD-Agents).
  • On average, SAGE improved Point-F1 by 43.8% over the best deep learning baseline (LSTM-VAE) and 44.1% over the best LLM baseline (LLMAD).
  • SAGE showed particularly strong gains on operational datasets (KPI and WSD), indicating the effectiveness of decomposing analysis into specialized evidence generation.
• Type-Level Analysis: Using a synthetic evaluation set with controlled anomaly injections, SAGE demonstrated high type agreement for structural changes (93%) and high detection recall for pattern anomalies (97%). While seasonal detection recall was lower (54%), the framework provided useful diagnostic cues.
• Ablation Studies: Removing tool augmentation or multi-analyzer specialization significantly degraded performance on the diverse Yahoo dataset, confirming that gains are driven by quantitative tools and specialized analysis rather than LLM prompting alone. On operational datasets, visual evidence and synthetic ICL played larger roles.
• Human Evaluation: In a blind evaluation by 10 technically experienced experts, SAGE ranked highest across all four criteria: Accuracy, Validity, Clarity, and Usefulness. It was particularly praised for providing coherent, interpretable diagnoses with actionable recommendations, outperforming baselines like LLMAD and TSAD-Agents.

5. Significance and Claims

The paper claims that structured evidence generation is a promising direction for making LLM-based time-series anomaly detection more controllable and interpretable. By separating diagnostic perspectives into specialized analyses and integrating their evidence, SAGE addresses the limitations of single-model inference and coarse multi-agent decomposition.

The authors emphasize that SAGE shifts the paradigm from direct anomaly inference toward structured diagnosis, providing not just "where" an anomaly is, but "what" it is and "why" it was detected. The use of synthetic ICL derived from normal data reduces reliance on scarce or unavailable real anomalous examples, making the framework more applicable to zero-shot scenarios.

Limitations and Future Work:
The authors acknowledge that the current framework is limited to univariate time series and incurs high computational costs due to multiple LLM calls per window. Additionally, rule-based synthetic perturbations may not cover all real-world failure modes, particularly subtle system-specific anomalies. Future work is proposed to explore adaptive filtering, extend the framework to multivariate time series, and improve fine-grained localization. The authors frame SAGE as a decision support tool for human analysts rather than an autonomous control system, noting the need for domain validation and human oversight in safety-critical applications.