Seeing the Needle in the Haystack: Towards Weakly-Supervised Log Instance Anomaly Localization via Counterfactual Perturbation

Researchers introduced LogMILP, a weakly supervised framework for log anomaly detection and fine-grained localization.

It relies only on bag-level labels, avoiding costly instance-level annotation in large-scale systems.

LogMILP combines multi-instance learning, prototype-guided modeling, and counterfactual perturbations to identify suspicious log entries.

The method achieved competitive detection performance and more reliable localization on three public datasets.