---
title: "过于自信难言安全：面向可靠日志异常检测的模型校准"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2608.17965v1"
permalink: "https://feed.astralor.com/items/itm_37fd465ba2bba1a50d771097"
published: "2026-08-18T16:19:45.000Z"
score: 77
channel: "ai"
tags: ["LoRD","日志异常检测","置信度校准","过度自信"]
---

# 过于自信难言安全：面向可靠日志异常检测的模型校准

## AI 点评

> 作为运维场景的“吹哨人”，日志异常检测模型宁可保守也不要盲目自信。LoRD的价值在于不改变原有模型，只对高风险预测做二次校验，这种“事后兜底”思路对生产系统尤其友好。关注可观测性或AIOps的工程师值得第一时间跟进复现。

## 速览

在线日志异常检测对保障大型计算系统可靠性至关重要。基于语言模型的检测器虽然性能出色，但其置信度估计存在严重校准问题，尤其在类别极不平衡时，对异常日志频繁给出过度自信的错误预测。本文提出轻量级后处理校准框架LoRD，利用正确分类样本的潜在表示学习特定预测路径的可靠性模型，并通过路径重建距离估计预测可信度，再选择性地重新校准高风险结果。在四个大规模日志基准和多个语言模型检测器上，LoRD持续提升置信度可靠性，显著减少过度自信的异常相关错误，同时保持原有检测性能。

## 关键点

- 研究揭示基于语言模型的日志异常检测器普遍存在置信度校准缺陷，对异常样本过度自信。
- 提出LoRD轻量级后处理框架，通过重建距离估计预测可靠性，并选择性重校准高风险预测。
- 在四个大型日志基准和多种检测器上验证，能减少过度自信错误而不牺牲检测性能。

## 全文

Online log anomaly detection is critical for maintaining the reliability of large-scale computing systems. Although recent language model-based log anomaly detectors achieve strong detection performance, their confidence estimates remain poorly calibrated. We show that these detectors frequently assign excessive confidence to incorrect predictions, particularly for anomalous logs under severe class imbalance. Moreover, confidence on erroneous predictions remains persistently high even when conventional calibration metrics indicate good calibration, creating a critical reliability gap for operational monitoring systems. To address this issue, we propose Log Reconstruction and Distance (LoRD), a lightweight post-hoc calibration framework for reliable log anomaly detection. LoRD learns prediction-route-specific reliability models from latent representations of correctly classified validation samples and estimates prediction reliability through route-wise reconstruction distances. Based on the estimated reliability, LoRD selectively recalibrates high-risk predictions to suppress overconfident errors while preserving reliable predictions. Extensive experiments on four large-scale log benchmark datasets and multiple language model-based detectors demonstrate that LoRD consistently improves confidence reliability and substantially reduces overconfident anomaly-related errors without sacrificing anomaly detection performance.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_37fd465ba2bba1a50d771097