DiFA: Dual Evidence Fusion and Aggregation for Token-Level Text Anomaly Detection

Abstract:Text anomaly detection, the task of identifying text instances that deviate from normal language patterns, is crucial for language-driven applications. However, most existing methods can only perform document-level anomaly detection, making it hard to locate harmful phrases or support targeted prevention. Recently, there has been an emerging trend toward token-level text anomaly detection, which aims to address the above limitation by identifying anomalous words or fragments within a document. Nevertheless, one representative method mainly relies on representation-space distance measurement, neglecting the complementary roles of different anomaly cues in capturing diverse abnormal patterns. To bridge the gaps, we propose a Dual-evidence framework with adaptive Fusion and Aggregation (DiFA) for token-level anomaly detection. DiFA derives anomaly scores from form-structural and semantic views to capture visible structural abnormality and contextual inconsistency, respectively, thereby providing complementary evidence for identifying diverse anomalies. To combine these two scores with varying numerical scales, DiFA incorporates a calibration and fusion mechanism to adaptively balance the two views. Moreover, to obtain a discriminative document-level score, a multivariate aggregation method is designed to summarize token-level anomaly scores from multiple perspectives, preventing rare anomalous tokens from being diluted. Extensive experiments across various text anomaly detection benchmarks demonstrate that DiFA consistently achieves top performance while maintaining strong efficiency, robustness, and interpretability. The code and scripts are available at: this https URL.

Accepted by ICDM 2026. 10 pages, 4 figures, 2 tables

Computation and Language (cs.CL); Machine Learning (cs.LG)

arXiv:2609.22136 [cs.CL]

(or arXiv:2609.22136v1 [cs.CL] for this version)

https://doi.org/10.48550/arXiv.2609.22136 Focus to learn more arXiv-issued DOI via DataCite

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.