Collaborative Log Anomaly Detection Using LLM With Privacy-Constrained Retrieval

Abstract

Log anomaly detection plays a critical role in maintaining the reliability and security of large-scale distributed systems. However, centralized solutions often pose privacy and scalability concerns, especially when logs are generated and stored across multiple, isolated nodes. In this paper, we propose a distributed framework for collaborative log anomaly detection that integrates privacy-constrained vector retrieval with large language model (LLM) inference. Each node encodes its local logs into embedding vectors and responds to external queries by returning the most relevant entries under a configurable privacy budget. Retrieved samples, which may consist of either raw text or partial embeddings, are aggregated and formatted into prompts, which are then processed by a local LLM to determine whether a new log entry is anomalous. Our system separates the test set from the retrieval pool, supports flexible control over information exposure, and enables LLM-based reasoning without requiring all logs to be centralized. Experiments on three real-world log datasets demonstrate that our approach achieves accurate anomaly detection under configurable privacy constraints in a distributed setting.