Retrieval Augmented Anomaly Detection (RAAD): Nimble Model Adjustment Without Retraining
This addresses the need for lightweight, real-time anomaly detection with improved precision in domains like network security, though it is an incremental adaptation of retrieval-augmented techniques.
The paper tackles the problem of reducing false positives in anomaly detection models by proposing Retrieval Augmented Anomaly Detection (RAAD), a method that uses human-in-the-loop feedback to adjust model outputs in real-time without retraining, achieving high precision across various data modalities.
We propose a novel mechanism for real-time (human-in-the-loop) feedback focused on false positive reduction to enhance anomaly detection models. It was designed for the lightweight deployment of a behavioral network anomaly detection model. This methodology is easily integrable to similar domains that require a premium on throughput while maintaining high precision. In this paper, we introduce Retrieval Augmented Anomaly Detection, a novel method taking inspiration from Retrieval Augmented Generation. Human annotated examples are sent to a vector store, which can modify model outputs on the very next processed batch for model inference. To demonstrate the generalization of this technique, we benchmarked several different model architectures and multiple data modalities, including images, text, and graph-based data.