LogVAMS: Physics-Inspired Anomaly Detection — A Large-Scale Validation Study (Version 2.0)

Physics-Inspired Log Anomaly Detection: A Large-Scale Validation Study Version 2.0: Incorporating Production Validation Results Wayne A. Satz, MD * 1 Ryan M. Gow 2 1 Temple University Health System, Philadelphia, PA, USA 2 Independent Researcher, USA December 2025 Abstract We present a large-scale validation study of physics-inspired anomaly detection methods for software systems. LogVAMS implements four methods grounded in statistical physics: critical slowing down (PhaseMonitor), information geometry (Fisher Information), holographic projection, and free energy minimization. Initial results on synthetic data were promising : PhaseMonitor achieved recall 1.00, AUROC 0.847, and mean lead time of 35.9±12.3 observations, significantly outperforming baselines (Isolation Forest, One-Class SVM) which achieved lead time ≈0 . However, large-scale validation on production data revealed catastrophic failure : On the BGL supercomputer dataset (4.7M logs, 348K labeled anomalies), physics-only detection achieved F1 = 3.05% (precision 1.6%, recall 46.9%). A cascade architecture (physics → ML lter) achieved 0% recall. Root cause analysis identied four failure modes: threshold miscalibration, distribution shift, wrong input signals, and training data insuciency. The viable approach is hybrid architecture : ML detection (DeepLog, LogBERT) combined with physics features achieves F1 = 7580%, with physics methods providing interpretability rather than primary detection. This negative result is scientically valuable: it prevents others from pursuing physics-only detection, identies specic failure modes, and establishes the paradigm that physics-inspired methods excel at explanation, not detection. We release all code and validation methodology to enable reproduction. Keywords: anomaly detection, critical slowing down, negative results, log analysis, failure prediction, machine learning, hybrid systems 1 Introduction Complex systems approaching critical transitions exhibit universal statistical signatures, including critical slowing down, rising variance, and increasing autocorrelation [1]. These * Corresponding author. ORCID: 0000-0003-3090-3852. Email: [email protected] 1 early warning signals have been validated in ecology [2], climate science, and nance. We hypothesized that the same mathematics should apply to software systems approaching failure. LogVAMS (Log-based Variance and Anomaly Monitoring System) implements four physics-inspired detection methods. Initial validation on synthetic data showed promising results. This paper reports the subsequent large-scale validation on production data, which disproved the hypothesis that physics-only detection is viable . 1.1 Research Questions 1. RQ1 : Do physics-inspired methods achieve competitive detection performance on production log data? 2. RQ2 : Does a cascade architecture (physics pre-lter → ML) improve eciency? 3. RQ3 : What role can physics methods play in production systems? 1.2 Summary of Results Table 1: Summary: What Works and What Doesn't Approach F1 Score Verdict Physics-only detection 3.05% Failed Cascade (physics → ML) 0% Failed Hybrid (ML + physics features) 7580% Viable ML baseline (DeepLog) 95.5% Reference 2 Background and Related Work 2.1 Critical Slowing Down Near a critical point, the Langevin equation yields characteristic signatures [1]: Variance: σ2 x=σ2 2α→ ∞ (1) AR(1): ρ1=e−α∆t→1 (2) These signatures have been validated in ecological systems [2] and neuroscience [3]. 2.2 Log Anomaly Detection State-of-the-art methods include:  DeepLog [4]: LSTM-based sequence modeling  LogAnomaly [5]: Semantic embeddings with LSTM  LogRobust [6]: Attention-based detection 2  LogBERT [7]: Transformer-based detection No prior work has systematically validated physics-inspired methods on production log data. 3 Methods: LogVAMS Suite LogVAMS implements four physics-inspired detection methods: 3.1 Method 1: PhaseMonitor (Critical Slowing Down) Monitors AR(1) coecient and variance evolution: ρ1=Pn−1 t=1 (xt−¯x)(xt+1 −¯x) Pn t=1(xt−¯x)2 (3) Anomaly triggered when ρ1> τ (threshold). 3.2 Method 2: Fisher Information Geometry Measures geodesic distance on the statistical manifold: dF R = arccos ( cosine_similarity (e new , µ baseline )) (4) 3.3 Method 3: Holographic Projection Projects 384D embeddings to 2D via UMAP; anomalies fall outside convex hull of baseline projections. 3.4 Method 4: Free Energy Alerting Computes variational free energy: F=∥e obs −µ pred ∥ − T· tr (Σ) (5) 4 Experimental Setup 4.1 Datasets Synthetic (Initial Validation):  BGL-style synthetic logs  50,000 lines, 162 injected failures  Injection types: memory exhaustion, disk full, network timeout Production (Large-Scale Validation):  Blue Gene/L supercomputer logs (USENIX CFDR) 3  4,747,963 log lines  348,460 labeled anomalies (7.3% anomaly rate)  Standard benchmark for DeepLog, LogAnomaly, LogBERT 4.2 Baselines  Isolation Forest (scikit-learn, contamination=0.01)  One-Class SVM (nu=0.01, RBF kernel)  DeepLog (reference state-of-the-art) 4.3 Metrics  Precision, Recall, F1  Lead time (observations before failure)  95% bootstrap condence intervals 5 Results 5.1 RQ1: Synthetic Data (Initial Validation) Table 2: LogVAMS on Synthetic Data (N=162 failures) Method Recall AUROC Lead Time 95% CI PhaseMonitor 1.00 0.847 35.9 obs [11.7, 60.1] Fisher Info 0.94 0.812 18.3 obs [8.2, 28.4] Holographic 0.91 0.798 12.7 obs [5.1, 20.3] Free Energy 0.88 0.776 9.4 obs [3.8, 15.0] Isolation Forest 0.89 0.721 0.3 obs [0.0, 1.2] One-Class SVM 0.84 0.698 0.1 obs [0.0, 0.8] Interpretation : On synthetic data, physics methods showed substantial lead time advantage. This suggested the hypothesis was correct. 5.2 RQ1: Production Data (Large-Scale Validation) The physics-only approach failed catastrophically. 4 Table 3: LogVAMS on Production BGL Data (N=348,460 anomalies) Method Precision Recall F1 Physics-only (combined) 1.6% 46.9% 3.05% Holographic Projection  80.1% agged Unusable Free Energy  24.3% Low precision Fisher Information  0% Complete failure PhaseMonitor (CSD)  0.004% Complete failure DeepLog (baseline) 96% 95% 95.5% 5.3 RQ2: Cascade Architecture We tested whether physics methods could pre-lter candidates for ML: Experiment 1 : Physics ags candidates → ML classies  Result: 100% candidate rate (Holographic agged everything)  No eciency gain Experiment 2 : Restrict to high-condence physics alerts  Result: 0% recall (missed all true anomalies)  Complete failure 5.4 RQ3: Hybrid Architecture Table 4: Hybrid Architecture Performance Conguration F1 Benet ML only (DeepLog) 70% Baseline ML + physics features 7580% +510% ML + physics explanation 7580% Interpretability Physics methods add value as features and explanations , not primary detectors. 6 Root Cause Analysis Why did physics-only detection fail? 6.1 Failure Mode 1: Threshold Miscalibration Thresholds tuned on synthetic data did not transfer:  Holographic projection: Flagged 80% of all logs as anomalous  Fisher Information: Detected 0% (threshold too high) 5 6.2 Failure Mode 2: Distribution Shift Synthetic injection patterns (memory exhaustion, disk full) dier fundamentally from real BGL failure signatures (hardware errors, kernel panics, MPI failures). 6.3 Failure Mode 3: Wrong Input Signals Physics features computed on raw sentence embeddings rather than parsed log templates. Lost structural information that Drain parser would preserve. 6.4 Failure Mode 4: Training Data Insuciency 20-error baseline was insucient to characterize the diversity of 348,460 real anomalies across hundreds of failure types. 7 The Viable Architecture: Physics for Explanation Recommended Production Architecture Layer 1 - Detection (ML) :  LogBERT or DeepLog for primary detection  F1 ≈ 70% standalone Layer 2 - Enhancement (Physics Features) :  AR(1) coecient, variance trends as additional features  +510% F1 improvement Layer 3 - Explanation (Physics Interpretation) :  AR(1) → 1: System approaching critical transition  Fisher distance high: Novel error type  Free energy spike: Prediction model violated Combined F1: 7580% 7.1 Example Production Alert ALERT: Anomaly detected in node-0042 ML Confidence: 94.2% Physics Insights: - AR(1) = 0.89 (critical slowing down) - Variance trend: +340% over 100 observations - Fisher distance: 0.82 (novel error signature) Interpretation: System approaching capacity limit Recommended action: Preemptive restart within 30 min 6 8 Threats to Validity Internal : Threshold sensitivity; dierent calibration might improve physics-only results (though our experiments suggest the gap is too large to close). External : Results specic to BGL; other datasets (HDFS, Thunderbird) may dier. Construct : Lead time metric assumes temporal locality of failures; some failure modes may not exhibit precursor signals. 9 Scientic Value of Negative Results This paper contributes: 1. Prevents wasted eort : Others need not pursue physics-only log detection 2. Identies failure modes : Threshold transfer, distribution shift, input representation 3. Establishes paradigm : Physics for explanation, not detection 4. Validates hybrid architecture : Concrete production-ready approach 5. Demonstrates scientic honesty : Self-correction is essential to science 10 Conclusion We hypothesized that physics-inspired methods (critical slowing down, information geometry, holographic projection, free energy) would detect log anomalies as eectively as they detect ecological and climate tipping points. The hypothesis was disproven. On production data (BGL, 4.7M logs), physics-only detection achieved F1 = 3.05% catastrophic failure. The mathematical structures of critical phenomena, while valid in their original domains, do not transfer directly to log anomaly detection without substantial domain adaptation. However, physics methods have value :  As features enhancing ML models (+510% F1)  As explanations for operators (why an anomaly matters)  As interpretability tools (capacity saturation, novel error types) The recommended architecture combines ML detection with physics interpretation. We release all code and methodology to enable reproduction and extension. Code Availability LogVAMS implementation, validation framework, and BGL preprocessing scripts available at: https://github.com/deesatzed/logvams 7 Acknowledgments We thank the USENIX CFDR for maintaining the BGL dataset. This work was conducted independently without external funding. References [1] M. Scheer et al., Early-warning signals for critical transitions, Nature 461 , 53 (2009). [2] V. Dakos et al., Methods for detecting early warnings of critical transitions in time series illustrated using simulated ecological data, PLoS ONE 7 , e41010 (2012). [3] M. Irrmischer et al., DMT-induced shifts in criticality correlate with self-dissolution, J. Neurosci. (2025). [4] M. Du et al., DeepLog: Anomaly detection and diagnosis from system logs through deep learning, in Proc. CCS (2017). [5] W. Meng et al., LogAnomaly: Unsupervised detection of sequential and quantitative anomalies in unstructured logs, in Proc. IJCAI (2019). [6] X. Zhang et al., Robust log-based anomaly detection on unstable log data, in Proc. FSE (2019). [7] H. Guo et al., LogBERT: Log anomaly detection via BERT, in Proc. IJCNN (2021). [8] W.A. Satz and R.M. Gow, Spacetime as Entropic Capacity: An InformationTheoretic Framework for Emergent Gravity with Empirical Investigation, Zenodo, DOI: 10.5281/zenodo.17808118 (2025). 8