An 8M-Parameter Log Anomaly Detector That Nearly Matches an 8-Billion-Parameter LLM — on CPU

LogCDM fuses three interpretable signals into a compact detector that scores log sessions in 5-10ms on CPU, coming within 0.013 F1 of a model 1000× its size.

Imagine you're a building inspector checking whether a house is structurally sound. You could hire three specialists — one who listens for creaky floorboards (surprise at unexpected events), one who compares the blueprint to the actual layout (structural graph drift), and one who checks whether doors get used at the expected frequency (transition statistics). Any one of them might miss something, but a calibrated vote among the three catches nearly everything. That's LogCDM: three lightweight, complementary anomaly signals fused by a learned gate that the authors prove is equivalent to a Bayes-optimal posterior under Gaussian assumptions. The committed claim: a detector with 8.1–8.8M parameters and zero GPU requirement at inference can reach F1 within 0.013–0.12 of an 8.1B-parameter LLM on the same evaluation protocol, while explaining each alarm via per-edge chi-squared decomposition. The three signals are (1) next-event surprise from a small causal Transformer, (2) graph-attention distance between the session's transition graph and a learned normal-reference graph, and (3) a transition-drift statistic the authors formally prove is a frequency-weighted chi-squared divergence. That last piece is the mathematical anchor — it gives you an asymptotic null distribution, a length-standardized score, and per-edge decomposition for free. On the ladder, LogCDM posts F1 of 0.984 on HDFS, 0.870 on chronologically-split BGL, and 0.850 on Thunderbird. The big comparison point is an 8.1B-parameter LLM detector evaluated under the same protocol — LogCDM trails it by only 0.013 on BGL and 0.12 on Thunderbird. It beats all compact baselines on BGL. HDFS is essentially solved by everyone, which the authors acknowledge — their ablations show structural signals add almost nothing there, consistent with HDFS being a sequence-dominated dataset. The architectural family is hybrid: a small causal Transformer for sequential surprise, a graph-attention network (GAT) for structural embedding, plus a classical chi-squared statistic for transition drift. The fusion mechanism is a sigmoid gate that the authors derive from a shared-covariance Gaussian model — so it's not just a learned interpolation, it's the Bayes posterior under stated assumptions. The whole thing runs on CPU in 5.5–10.5 ms per session. This is the key hardware bet: log anomaly detection needs to happen at the edge, on monitoring nodes, not on GPU clusters running inference on 8B-parameter models. Integrity is solid but not exceptional. HDFS, BGL, and Thunderbird are standard community benchmarks — not cherry-picked. The chronological split on BGL is the honest evaluation protocol (many prior papers use random splits that leak future information). The ablation study is well-structured: removing structural signals drops F1 by 0.025–0.030 on BGL and Thunderbird but not on HDFS, and the learned gate weights confirm the same story independently. The main gap: this is self-evaluated against three benchmarks, with no independent replication yet. Code availability is not stated. The milestone question is about deployment scale. Today you have a CPU-only detector at 8M parameters matching LLM-grade accuracy on three benchmarks. The next unlock is demonstrating this on production-scale systems — millions of sessions per hour, diverse log formats, concept drift over months. The gap between benchmark and production is where most log anomaly detectors die. The successor experiment the authors didn't run: testing on proprietary production logs with real concept drift. Most likely reason is access — academic groups rarely have access to production telemetry at scale, and the companies that do have little incentive to share. The deeper contribution here is the interpretability story. The per-edge chi-squared decomposition means every alarm comes with an explanation: which specific transitions deviated from normal, and by how much. In production, an alarm you can't explain is an alarm you ignore. LogCDM's formal grounding in chi-squared divergence makes its explanations auditable — not just saliency maps, but statistical decompositions with known null distributions.