Enhancing Tabular Anomaly Detection via Pseudo-Label-Guided Generation

Abstract: Identifying anomalous instances in tabular data is essential for improving data reliability and maintaining system stability. Due to the scarcity of ground-truth anomaly labels, existing methods mainly rely on unsupervised anomaly detection models, or exploit a small number of labeled anomalies to facilitate detection via sample generation or contrastive learning. However, unsupervised methods lack sufficient anomaly awareness, while current generation and contrastive approaches tend to compute anomalies globally, overlooking the localized anomaly patterns of tabular features, resulting in suboptimal detection performance. To address these limitations, we propose PLAG, a pseudo-label-guided anomaly generation method designed to enhance tabular anomaly detection. Specifically, by utilizing pseudo-anomalies as guidance signals and decoupling the overall anomaly quantification of a sample into an accumulation of feature-level abnormalities, PLAG not only effectively obviates the need for scarce ground-truth labels but also provides a novel perspective for the model to comprehend localized anomalous signals at a fine-grained level. Furthermore, a two-stage data selection strategy is proposed, integrating format verification and uncertainty estimation to rigorously filter candidate samples, thereby ensuring the fidelity and diversity of the synthetic anomalies. Ultimately, these filtered synthetic anomalies serve as robust discriminative guidance, empowering the model to better separate normal and anomalous instances. Extensive experiments demonstrate that PLAG achieves state-of-the-art performance against eight representative baselines. Moreover, as a flexible framework, it integrates seamlessly with existing unsupervised detectors, consistently boosting F1-scores by 0.08 to 0.21.

• The paper introduces PLAG, a framework that uses pseudo-labeling and LLM-driven, feature-level anomaly synthesis to generate diverse synthetic anomalies.
• It employs a dual-stage selection mechanism combining ECDF-based rarity assessment and fuzzy rough set theory to ensure high fidelity and diversity in anomaly samples.
• Empirical results show significant improvements in F1 and AUC-PR across heterogeneous tabular datasets, validating PLAG as an effective augmentation for unsupervised detectors.

PLAG: Pseudo-Label-Guided Anomaly Generation for Tabular Anomaly Detection

Introduction

This work addresses the persistent challenge of tabular anomaly detection under extreme scarcity of ground-truth anomalies, which is particularly acute in real-world domains such as finance, healthcare, and cybersecurity. Existing unsupervised approaches typically model normal data distributions and identify deviations as anomalies, but these lack mechanisms for anomaly-aware training, resulting in limited discrimination capability. Conversely, generative and contrastive methods relying on labeled anomalies focus on global representations and overlook local, fine-grained anomaly patterns, while also being impractical under label scarcity. The paper proposes PLAG, a Pseudo-Label-Guided Anomaly Generation framework that leverages pseudo-anomaly signals from unsupervised scoring, decouples anomaly quantification to the feature level, and utilizes LLMs for tabular anomaly synthesis, paired with an explicit fidelity/diversity filtering protocol.

Methodology

PLAG is structured in three stages: pseudo-label mining, feature-wise anomaly generation, and dual-stage data selection.

First, an unsupervised anomaly detector assigns anomaly scores to unlabeled test instances; the top-scoring subset is labeled as pseudo-anomalies. Instead of modeling anomaly likelihood globally, PLAG aggregates per-feature rarity (measured via ECDF-based tail probabilities) across each instance, enabling the LLM to recognize and synthesize local feature-level anomalies.

Figure 1: PLAG framework overview, including pseudo-label mining, anomaly synthesis with feature-level decoupling, and two-stage sample selection.

Corresponding prompt templates, specifically engineered for tabular semantics, guide the LLM to output candidate anomalies whose feature-level rarity profiles align with those of the pseudo-anomalies.

Figure 2: Tabular-specific prompt template design for anomaly synthesis.

A two-stage selection mechanism then ensures the synthetic dataset's quality. The first stage validates format constraints and eliminates duplicates. The second leverages fuzzy rough set theory to compute uncertainty via information granules grounded in kernelized fuzzy relations. This stage discriminates certain from possible anomalous memberships, weighting granule size to account for class imbalance. Data selection thresholds are adaptively set using the $3\sigma$ rule on uncertainty estimates, initially selecting high-fidelity anomalies distinctly separated from normals and gradually incorporating hard boundary cases for diversity.

Finally, the retained synthetic anomalies and the training normal set are used to train a classifier (typically MLP) under Focal Loss, optimized for heavily imbalanced data.

Quantitative Analysis

PLAG was benchmarked against classical (Cutout, CutMix, Gaussian noise), label-dependent (NNG-Mix, SOEL), and advanced generative baselines (TabDDPM, GReaT, TabSyn), all adapted to a fully unsupervised scenario by replacing required anomaly labels with pseudo-labels. Five public datasets, spanning heterogeneous tabular domains and class imbalance extremes, were used.

Figure 3: Average performance metrics of baseline and PLAG variants across all benchmark datasets.

PLAG consistently achieves superior F1 and AUC-PR scores across datasets and metrics. For instance, on the Pima and Thyroid datasets, PLAG (with GPT-3.5-turbo) surpasses NNG-Mix by 0.26 and 0.28 in F1, and by 0.12 and 0.09 in AUC-PR, respectively, indicating improved anomaly localization rather than mere ranking. Interestingly, the choice of LLM (from GPT-3.5 to GPT-4 and others) did not strongly determine outcome—all LLMs under the PLAG protocol outperformed standalone generative models, highlighting the efficacy of prompt-based decoupled anomaly synthesis compared to unsupervised generative distribution modeling.

Figure 4: F1 improvement of PLAG over each baseline method.

Integration with Anomaly Detection Pipelines

To evaluate generality, PLAG was systematically integrated with eight unsupervised base detectors covering density estimation, self-supervision, and feature reconstruction paradigms. In all cases, performance improvements were consistent and significant: F1 score improvements ranged from 0.08 to 0.21 across datasets, and gains up to 0.20 in AUC-PR were observed. This demonstrates that PLAG acts as a general anomaly signal amplifier, agnostic to the choice of base detector.

Visualization and Analysis of Synthetic Anomalies

Visual analyses using dimensionality reduction on the WBC dataset revealed that conventional synthetics (Cutout, CutMix, noise injection) caused excessive overlap with normal classes or failed to capture realistic anomaly distributions, with many candidate anomalies remaining either confined to normal regions or scattered arbitrarily. In contrast, anomalies generated via PLAG were distributed to cover both prototypical anomalous clusters and challenging normal-adjacent boundary regions.

Figure 5: (a) NNG-Mix synthetic anomalies exhibit high dispersion and fail to cover true anomaly regions. (b) PLAG-generated anomalies closely match the ground-truth anomaly distribution.

Figure 6: 2D latent space comparison of synthetic anomalies vs. ground-truth labels; PLAG's samples trace the true anomaly manifold including boundary regions.

Ablation Study

A comprehensive ablation separately isolated the effects of anomaly generation and two-stage selection. Omitting candidate generation caused marked degradation in performance for larger datasets, underscoring the critical need for synthetic diversity as dataset scale increases. Removing the selection protocol led to general performance collapse due to noise/outlier propagation, confirming the necessity of filtering for anomaly fidelity and distributional diversity. The complete PLAG protocol thus demonstrates a nontrivial interplay: candidate generation ensures anomaly variety, and selection mechanisms safeguard data discriminativity.

Implications and Future Directions

PLAG introduces a methodology for supervised anomaly training in highly label-scarce tabular settings, where both generative diversity and fidelity are adaptively controlled through feature-aware LLM synthesis and rigorous filtering. The framework generalizes robustly, functioning both as an augmentation protocol and as a modular enhancer for a variety of unsupervised anomaly detectors. The theoretical implications center around the shift from global distribution modeling to localized, feature-wise anomaly reasoning—potentially generalizable to other modalities or tasks with complex, heterogeneous data.

On a practical axis, PLAG's minimal reliance on ground-truth anomaly labels offers immediate utility in real-world, resource-constrained detection pipelines. Future work may target the development of dynamic anomaly diversity control, adaptive prompt engineering, and a broader investigation into LLM-based anomaly detection under explicit zero-shot/few-shot regimes.

Conclusion

This paper formulates and validates PLAG, a pseudo-label-guided, LLM-powered anomaly generation framework designed for robust tabular anomaly detection. Empirical analysis demonstrates consistent state-of-the-art performance across diverse datasets and detectors, attributable to its explicit feature-level anomaly characterization and stringent synthetic sample filtering. The work establishes a new protocol for unsupervised anomaly generation that emphasizes distributional diversity, localized anomaly semantics, and end-to-end compatibility with existing detection algorithms.