---
title: Zero-Label Cross-System Anomaly Detection
url: https://www.emergentmind.com/topics/zero-label-cross-system-log-based-anomaly-detection
type: topic
---

# Zero-Label Cross-System Anomaly Detection

Zero-label cross-system log-based anomaly detection refers to the family of methodologies enabling the detection of anomalous events in the logs of a “target” software system using no labeled (ground-truth) anomalies from that system, but instead leveraging labeled logs and/or generalizable knowledge from one or more distinct “source” systems. The fundamental problem arises from domain-specific variability in log syntax and semantics, proprietary operational patterns, and the extremely high cost or infeasibility of manual annotation on new systems. Recent work has established this setting as both a theoretical and practical benchmark for transfer learning, representation meta-learning, and knowledge fusion in machine log analytics.

## 1. Problem Statement and Motivation

Formally, the task provides (i) a labeled source log dataset $\mathcal{D}_S = \{ (x_i, y_i) \}$ from one or more mature systems, where $y_i \in \{0,1\}$ indicate normal vs. anomalous, and (ii) a target domain log stream $\mathcal{D}_T = \{ x_j \}$, fully unlabeled. The objective is to construct a function $f_T(\cdot)$ that predicts anomaly status for entries in $\mathcal{D}_T$ without ever consulting target system supervision. This “zero-label” constraint is strictly more difficult than classical transfer or domain adaptation settings.

The central challenge is that many log-based anomalies are system-specific (“proprietary” with respect to formats, codes, or event sequences), while others follow cross-system operational patterns. Existing few-label learning and transfer techniques are vulnerable to the “cold start” problem: lacking any target-labeled anomalies, they fail to adapt to proprietary behaviors and often exhibit low recall [2507.19806, 2511.05862]. Unsupervised approaches must avoid overfitting to the idiosyncrasies of the source domain and generalize across possibly disjoint template spaces [2511.05878, 2511.05882].

## 2. Representation Learning and Domain Alignment

Zero-label generalization mandates learning log representations that are both discriminative of anomalies and agnostic to system-specific noise. A common workflow initiates from log preprocessing—parsing raw lines via Drain or similar, substituting system-dependent fields with “<*>” placeholders, and extracting event templates [2409.11890, 2511.05862, 2511.05878]. These templates are then embedded in a global or shared vector space via pretrained language models (e.g., BERT, GloVe), which allows semantic comparisons across domains [2511.05862, 2409.11890].

Adversarial domain alignment is employed to enforce system invariance: a domain discriminator $D$ is jointly trained with a feature extractor $E$ to maximize the indistinguishability of source vs. target representations. The latter is adversarially updated to minimize this distinction, typically via gradients from a small MLP domain classifier [2511.05862, 2507.19806]. This process is typically combined with supervised anomaly classification heads trained on source data—mathematically:

$$
\min_{\theta_e, \theta_\omega} \max_{\theta_d} \sum_{MT_i} \left( \gamma \mathcal{L}_c^{MT_i} + \beta \mathcal{L}_{ad}^{MT_i} \right)
$$

where $\mathcal{L}_c$ is supervised cross-entropy on source labels and $\mathcal{L}_{ad}$ is adversarial loss distinguishing source/target. Meta-learning over cross-system “tasks” (splits of source and unlabeled target) produces a parameter initialization that supports rapid domain adaptation in one or few gradient steps [2511.05862, 2507.19806].

## 3. Knowledge Fusion and Routing Architectures

Recent advances center on the explicit fusion of general (cross-system) and proprietary (target-specific) anomaly knowledge. Seminal works such as FusionLog [2511.05878] and GeneralLog [2511.05882] introduce a “knowledge-level” semantic router: for each target log sequence, event embeddings are computed and sequence-level similarity $S(x) = \min_i \max_j~\mathrm{cosine}(v_i, u_j)$ is measured against source event prototypes. A threshold $\tau$ partitions sequences into:

- “General logs”: sufficiently similar to source prototypes, predicted by a fast, meta-learned small model.
- “Proprietary logs”: insufficiently similar; handled via more computationally intensive mechanisms.

FusionLog subsequently applies multi-round collaborative pseudo-labeling in the proprietary bucket, generating pseudo-labels by combining outputs from a large language model (LLM, e.g., Qwen3) with the small model (SM); matching cases with high SM confidence constitute a “clean” set for iterative SM fine-tuning. This distillation sharpens the small model’s ability to recognize proprietary anomalies, reducing reliance on LLM inference [2511.05878]. GeneralLog uses an LLM+retrieval-augmented generation (RAG) architecture only for proprietary logs, further reducing inference cost by offloading high-throughput detection to the small model [2511.05882].

This architectural principle avoids the pitfalls of uncertainty-based routing—which lacks interpretability in the zero-label setting and may over-defer to LLMs. Instead, semantic similarity operationally aligns knowledge buckets to the actual distributional overlap of event types between source and target.

## 4. Unsupervised and Self-Supervised Approaches

Several frameworks achieve zero-label generalization through self-supervised or fully unsupervised objectives. ADALog [2505.13496] dispenses with log parsing and instead fine-tunes a BERT-based transformer on normal logs only, using a masked language modeling (MLM) objective:

$$
\mathcal{L}_{MLM}(\theta) = -\sum_{l \in \mathcal{D}_{\text{normal}}} \sum_{i \in M} \log P_\theta(w_i | C_i)
$$

At inference, token-level reconstruction probabilities serve as anomaly scores, with event-level scores aggregating via negative log-likelihood. Adaptive thresholding via percentiles on the normal score distribution replaces hand-tuned thresholds. As no labels or event templates are required, this methodology avoids domain-specific overfitting while achieving competitive F1 on benchmarks [2505.13496].

Other variants, including Log2graphs [2409.11890], integrate log content and structural dependencies by constructing per-window log graphs, extracting embeddings via dual graph convolutional autoencoders (content and causal structure GCN modules), and applying spectral clustering over embedding affinities to partition windows into “normal” and “anomalous” in a fully unsupervised fashion—demonstrating strong transfer to unseen target distributions.

## 5. Meta-Learning, Transfer, and Evaluation Protocols

Multiple meta-learning approaches have emerged to address system heterogeneity and the lack of target labels. ZeroLog [2511.05862] and FreeLog [2507.19806] combine domain-adversarial training with meta-task optimization, simulating adaptation to new domains by constructing support/query tasks mixing source-annotated and unlabeled target samples. Mathematically, inner-loop adaptation combines source classification and domain-adversarial gradients, with a meta-objective minimizing new domain generalization loss after adaptation. This enables deployment of a fixed encoder/classifier pair directly to the target, decoupling detection from any domain-specific annotation.

Performance is evaluated under cross-system zero-label transfers (e.g., HDFS→BGL, OpenStack→HDFS). Metrics include precision, recall, F1, and—where applicable—unsupervised clustering indices (silhouette, Davies–Bouldin, Calinski–Harabasz). Strong empirical results are established: FusionLog and GeneralLog exceed 90% F1, surpassing all prior transfer-learning and domain-adversarial baselines by 10–15 percentage points [2511.05878, 2511.05882]. ZeroLog and FreeLog reliably achieve F1 > 80% across all evaluated transfers [2511.05862, 2507.19806]; ADALog matches or outperforms both supervised and unsupervised baselines without requiring any anomaly labels or log parsing [2505.13496].

## 6. Specialized Knowledge Sources and Instruction Mining

An alternative approach leverages external knowledge sources for bootstrapping anomaly representations. ADLILog [2207.03206] mines millions of log instructions (static log messages and developer-annotated severities from 1 000+ public code repositories), then pretrains a transformer encoder to distinguish “normal” (INFO-level) from “abnormal” (ERROR/FATAL/CRITICAL) message templates. The encoder is then transferred unchanged to the target, with only a lightweight head finetuned—using unlabeled target logs as presumed normal and abnormal instructions as positive outliers. Hyperspherical loss encourages normal embeddings near the origin and abnormal ones far away. Inference scores are simple Euclidean distance metrics; optimal thresholds are tuned on a validation set. This results in cross-system F1 up to 0.98 (HDFS), showing that large-scale instruction mining can provide generalizable anomaly patterns when target annotation is unavailable.

## 7. Limitations, Ablation Findings, and Future Directions

Current zero-label cross-system methods still trail—by several F1 points—the performance of fully supervised in-domain models, especially when operational anomalies in the target system are highly proprietary and absent from source anomaly distributions [2511.05862, 2511.05878]. Over- or under-weighting the strength of domain/adversarial gradients degrades either generalization or anomaly separation. Success of knowledge fusion and pseudo-label refinement for proprietary logs is contingent upon sufficient source–target event overlap and effective semantic embedding alignment. Another limitation noted is the computational expense of LLM-based inference, motivating progressive distillation or hybrid expert routing to minimize cost.

Research directions include dynamic, data-driven routing architectures, theoretical generalization bounds for adversarial meta-learning, multi-modal and continual adaptation strategies, and operational integration of human-in-the-loop feedback for anomaly label refinement. Extending these frameworks to fully unseen log formats or systems with extremely sparse unlabeled data remains an open challenge.

Source: https://www.emergentmind.com/topics/zero-label-cross-system-log-based-anomaly-detection