LogVAMS: Physics-Inspired Anomaly Detection Through Information Geometry and Critical Phenomena

LogVAMS: Physics-Inspired Anomaly Detection Through Information Geometry and Critical Phenomena Wayne A. Satz, MD * 1 Ryan M. Gow 2 1 Temple University Health System, Philadelphia, PA, USA 2 Independent Researcher, USA November 2025 Abstract We present LogVAMS (Log-based Variance and Anomaly Monitoring System), a comprehensive suite of physics-inspired anomaly detection methods for software systems. The framework applies mathematical structures from statistical physics, information geometry, and thermodynamics to predict system failures before they occur. LogVAMS implements four complementary detection methods: (1) PhaseMonitor, detecting critical slowing down via AR(1) coecient and variance dynamics; (2) Fisher Information Geometry, measuring novelty through geodesic distances on statistical manifolds; (3) Holographic Projection, exploiting boundary-bulk duality for dimensional reduction; and (4) Free Energy Alerting, using predictive coding principles from Helmholtz free energy minimization. On synthetic log data with 162 injected failure events, PhaseMonitor achieves mean lead time of 35.9±12.3 observations (95% CI: [11.7, 60.1]) with recall of 1.00 and AUROC of 0.847, signicantly outperforming baseline methods (Isolation Forest, One-Class SVM) which achieve lead time ≈0 . Ablation studies conrm that the AR(1) coecientthe critical slowing down indicatorcontributes most to predictive power. The success of physics-inspired methods in software systems suggests universal mathematical structures governing systems approaching capacity limits. The framework operates at zero marginal cost using local embeddings, requires no training data, and achieves 98.3% test coverage across the complete suite. Keywords: anomaly detection, critical slowing down, information geometry, Fisher information, free energy principle, log analysis, failure prediction 1 Introduction Complex systems approaching critical transitionswhether physical, biological, or computational exhibit universal statistical signatures [1]. These early warning signals include critical * Corresponding author. ORCID: 0000-0003-3090-3852. Email: [email protected] 1 slowing down (weakening restoring forces), rising variance, increasing autocorrelation, and changes in information-geometric structure. While extensively studied in climate science, ecology, and nance, these principles have seen limited systematic application to software system monitoring. This paper presents LogVAMS, a suite of anomaly detection methods that apply physics-inspired mathematics to software log analysis. Our central hypothesis is that capacity-constrained systems exhibit universal dynamics regardless of substrate , and therefore mathematical structures from statistical physics should predict failures in computational systems. 1.1 Motivation: Universal Capacity Dynamics The theoretical foundation draws on the entropic capacity framework [2], which proposes that systems approaching processing limits exhibit characteristic behaviors:  Critical slowing down: As a system approaches capacity, its ability to recover from perturbations decreases, manifesting as increased relaxation time  Rising uctuations: Reduced stability leads to larger deviations from equilibrium  Information-geometric divergence: States near critical boundaries become increasingly distinguishable in the Fisher-Rao metric  Free energy accumulation: Prediction errors increase as the system deviates from its generative model These signatures are mathematically identical whether the system is a gravitational eld approaching horizon formation, an ecosystem approaching collapse, or a software service approaching resource exhaustion. 1.2 Contributions 1. Theoretical unication: We demonstrate that four distinct physics-based detection methods share a common foundation in information geometry 2. Practical implementation: LogVAMS provides production-ready implementations achieving signicant lead time over baselines 3. Zero-cost operation: All methods use cached local embeddings with no API calls or per-request charges 4. Comprehensive evaluation: We provide ablation studies, baseline comparisons, and honest assessment of limitations 1.3 Scope and Limitations LogVAMS demonstrates that physics-inspired mathematics produces measurable predictions in engineered systems. This establishes universality of the mathematical structures across domains. We do not claim this validates any particular theory of fundamental physicsthe success of critical phenomena mathematics in software systems is interesting but does not adjudicate questions about the nature of spacetime or gravity. 2 2 Theoretical Foundation 2.1 Critical Slowing Down Near a critical point, the dynamics of a system can be approximated by the Langevin equation: dx dt =−α(t)x+σξ(t) (1) where α(t) is the restoring force coecient and ξ(t) is white noise. As α→0 (approaching criticality): Variance: σ2 x=σ2 2α→ ∞ (2) AR(1): ρ1=e−α∆t→1 (3) This is the mathematical signature of critical slowing down: variance increases and autocorrelation approaches unity as the system loses stability. 2.2 Information Geometry The space of probability distributions forms a Riemannian manifold with the Fisher information metric: Gµν =Zp(x|θ)∂µln p(x|θ)∂νln p(x|θ)dx (4) The Fisher-Rao distance between distributions provides a principled measure of statistical distinguishability: dF R(p, q) = arccos Zpp(x)q(x)dx (5) Anomalies correspond to points far from the baseline distribution in this metric geometrically, they are outliers on the statistical manifold. 2.3 Holographic Projection The holographic principle in physics states that information in a volume can be encoded on its boundary. Analogously, high-dimensional embedding spaces can be projected onto lower-dimensional surfaces while preserving essential structure. Points that fall outside the convex hull of baseline projections represent novel states not captured by the learned distribution. 2.4 Free Energy Principle Following Friston's formulation [3], systems maintaining homeostasis minimize variational free energy: F=∥x obs −x pred ∥2−T·S (6) where the rst term measures prediction error and the second represents entropy. High free energy indicates the system has encountered states inconsistent with its internal model. 3 2.5 Unied Principle All four methods share a common foundation: Anomaly ≡ Geometric outlier on information manifold (7)  PhaseMonitor: Detects when system trajectory approaches manifold boundary  Fisher Information: Measures geodesic distance on the Riemannian error manifold  Holographic Projection: Exploits boundary-bulk duality; 2D surface encodes 384D volume  Free Energy: Measures variational distance from learned generative model 3 Methods 3.1 LogVAMS Architecture LogVAMS processes log streams through the following pipeline: 1. Embedding: Log lines are embedded using sentence-transformers (all-MiniLML6-v2, 384 dimensions) 2. Feature extraction: Rolling statistics computed over congurable windows 3. Detection: Four parallel methods evaluate each observation 4. Alerting: Threshold exceedance triggers warnings with congurable severity 3.2 Method 1: PhaseMonitor (Critical Slowing Down) PhaseMonitor tracks three indicators of approaching criticality: Algorithm 1 PhaseMonitor Require: Log stream, window size w , threshold τ 1: buer ← deque(maxlen= w ) 2: for each observation in stream do 3: buer.append(extract_features(observation)) 4: if len(buer) =w then 5: variance ← var(buer) 6: ar1 ← compute_ar1(buer) 7: perm_entropy ← permutation_entropy(buer) 8: if ar1 > τ then 9: yield Warning(ar1, variance, perm_entropy) 10: end if 11: end if 12: end for The AR(1) coecient is computed as: ρ1=Pn−1 t=1 (xt−¯x)(xt+1 −¯x) Pn t=1(xt−¯x)2 (8) 4 Permutation entropy uses embedding dimension m= 3 and delay τ= 1 : H perm =−X π p(π) ln p(π) (9) 3.3 Method 2: Fisher Information Geometry For each incoming log embedding e new , we compute the Fisher-Rao distance to the baseline distribution: dF R = arccos ( cosine_similarity (e new , µ baseline )) (10) Novelty is agged when dF R >0.7 (calibrated threshold). 3.4 Method 3: Holographic Projection High-dimensional embeddings (384D) are projected to 2D using UMAP:  Parameters: n_neighbors=15, min_dist=0.1  Convex hull computed on baseline projections  Anomaly: points outside hull boundary 3.5 Method 4: Free Energy Alerting Maintains a generative model (mean embedding + covariance) and computes: F=∥e obs −µ pred ∥ − T· tr (Σ) (11) with temperature T= 1.0 and threshold F > 1.5 . Online learning via exponential moving average ( α= 0.01 ) allows adaptation. 4 Experimental Setup 4.1 Datasets Primary: Synthetic BGL-style logs, 50,000 lines, 162 injected failure events with known ground truth. Failures include memory exhaustion, disk full, network timeout, and service crash patterns. Validation: Blue Gene/L supercomputer logs from USENIX CFDR repository (qualitative analysis only due to sparse ground truth). 4.2 Baselines  Isolation Forest: scikit-learn 1.3.0, contamination=0.01  One-Class SVM: scikit-learn 1.3.0, nu=0.01, RBF kernel  Prophet: Facebook Prophet 1.1.4, 3 σ anomaly threshold 5 4.3 Evaluation Metrics  Recall: Proportion of true failures detected  AUROC: Area under ROC curve  Lead time: Observations between rst warning and failure occurrence  95% CI: Bootstrap condence intervals (1000 iterations) 4.4 Procedure 5-fold temporal cross-validation with strict temporal ordering (no future leakage). Hyperparameters xed across folds; no per-fold tuning. 5 Results 5.1 Primary Comparison Table 1: LogVAMS performance vs. baselines on synthetic BGL data (N=162 failures). Method Recall AUROC Mean Lead Time 95% CI LogVAMS (PhaseMonitor) 1.00 0.847 35.9 obs [11.7, 60.1] LogVAMS (Fisher Info) 0.94 0.812 18.3 obs [8.2, 28.4] LogVAMS (Holographic) 0.91 0.798 12.7 obs [5.1, 20.3] LogVAMS (Free Energy) 0.88 0.776 9.4 obs [3.8, 15.0] Isolation Forest 0.89 0.721 0.3 obs [0.0, 1.2] One-Class SVM 0.84 0.698 0.1 obs [0.0, 0.8] Prophet (3 σ ) 0.76 0.654 0.0 obs [0.0, 0.2] Key ndings:  PhaseMonitor achieves perfect recall with substantial lead time (35.9 observations on average)  Baseline methods detect failures at or after occurrence (lead time ≈0 )  All four LogVAMS methods outperform baselines on lead time 5.2 Ablation Studies The AR(1) coecient contributes most to predictive power, consistent with critical slowing down theory. 5.3 Detection Specialization 5.4 Computational Performance Zero marginal cost: all methods use cached sentence-transformers (one-time 80 MB download). 6 Table 2: Ablation: contribution of individual features to PhaseMonitor. Conguration ∆ AUROC ∆ Lead Time ∆ Recall Full model    Remove AR(1) −0.089 −18.2 obs −0.06 Remove variance −0.054 −8.7 obs −0.02 Remove perm. entropy −0.031 −4.1 obs −0.01 Table 3: Detection specialization by method. Method Best Detects PhaseMonitor Gradual degradation, memory leaks, resource exhaustion Fisher Information Novel error types, zero-day bugs, unprecedented failures Holographic Projection Cascading failures, emergent states, deadlocks Free Energy Alerting Subtle drift, concept drift, slow parameter changes Table 4: LogVAMS suite computational performance. Method Latency Memory Cost Test Coverage PhaseMonitor 12 ms ∼ 100 KB $0 100% (40/40) Fisher Information 23 ms ∼ 150 KB $0 100% (28/28) Holographic Projection 25 ms ∼ 500 KB $0 100% (25/25) Free Energy Alerting 34 ms ∼ 1 MB $0 90.9% (20/22) Combined Suite 814 ms ∼ 1.8 MB $0 98.3% (113/115) 7 6 Discussion 6.1 Why Physics-Inspired Methods Work The success of critical phenomena mathematics in software systems is not coincidental. Both physical systems approaching phase transitions and computational systems approaching resource limits share fundamental characteristics:  Finite capacity constraints  Feedback dynamics that weaken near limits  Information-theoretic bounds on state distinguishability  Accumulation of unresolved perturbations This suggests universal dynamics governing capacity-constrained systems regardless of substrate. 6.2 Comparison to Deep Learning Approaches LogVAMS deliberately avoids deep learning for several reasons: 1. Interpretability: Physics-based features (AR(1), variance) have clear meaning 2. Zero training: No labeled failure data required 3. Theoretical grounding: Predictions derive from rst principles 4. Cost: No GPU requirements or API charges We acknowledge that transformer-based methods (e.g., LogBERT, UniLog) may achieve higher AUROC on large labeled datasets. LogVAMS is designed for scenarios where training data is scarce or labels are unreliable. 6.3 Limitations 1. Synthetic data: Primary evaluation on synthetic logs with injected failures. Realworld performance may dier. 2. Sample size: 162 failures yields wide condence intervals. 3. No deep learning comparison: Transformer baselines not included. 4. Single embedding model: Results may vary with dierent embeddings. 5. Threshold sensitivity: Performance depends on threshold calibration. 6.4 Implications for Theory The cross-domain applicability of critical phenomena mathematicsfrom physics to software systemssuggests these structures capture something fundamental about informationconstrained dynamics. Whether this reects deep ontological unity (as proposed in [2]) or merely mathematical convenience remains an open question. 8 7 Related Work Critical slowing down in complex systems: Scheer et al. [1] established early warning signals for ecological and climate tipping points. Dakos et al. [4] developed statistical methods for detecting these signals. Information geometry in machine learning: Amari [5] provides foundational treatment. Nielsen [6] surveys applications to anomaly detection. Log-based anomaly detection: Du et al. [7] introduced DeepLog using LSTMs. Meng et al. [8] developed LogAnomaly with semantic embeddings. Le and Zhang [9] surveyed the eld comprehensively. Free energy principle: Friston [3] developed the theoretical framework. Applications to system monitoring remain limited. 8 Conclusion LogVAMS demonstrates that physics-inspired mathematics produces actionable predictions for software system monitoring. The framework achieves:  Perfect recall with 35.9 observation mean lead time (PhaseMonitor)  Zero marginal cost operation  Theoretical grounding in well-established physics  98.3% test coverage across the complete suite The success of critical phenomena, information geometry, and free energy principles across domains suggests universal mathematical structures governing capacity-constrained systems. We release LogVAMS as open source to enable further research and practical application. Code Availability LogVAMS implementation and synthetic data generator available at: https://github. com/deesatzed/logvams Author Contributions W.A.S. conceived the theoretical framework connecting physical and computational capacity limits. R.M.G. designed and implemented LogVAMS, conducted all experiments, and performed statistical analysis. Both authors contributed to manuscript preparation. Acknowledgments W.A.S. thanks colleagues at Temple University Health System for discussions on healthcare system complexity and failure prediction. 9