LENS-AD: Organizing LLM Knowledge for Few-Shot Tabular Anomaly Detection

Tabular anomaly detection becomes particularly challenging under extreme label scarcity, where limited observations provide insufficient evidence to reliably characterize abnormal patterns. Such limited evidence motivates the use of Large Language Models (LLMs) to translate task-related domain knowledge into explicit features, revealing latent concepts and feature relationships absent from raw tables. However, this expanded representation also enlarges the learning space: under scarce supervision, detectors may confuse spurious relationships with meaningful anomaly mechanisms. Our key insight is that LLM knowledge should not only expand what the detector can observe, but also constrain how the expanded information is used. Based on this insight, we propose LENS-AD, which organizes original and knowledge-expanded features into overlapping semantic subspaces, each encoding a candidate anomaly mechanism. Because target data are insufficient to reliably determine the relative importance of these subspaces, LENS-AD learns a mapping from subspace descriptors to aggregation weights across source datasets and applies it to combine their predictions without target validation labels. Extensive experiments on 20 real-world tabular anomaly detection benchmarks show that LENS-AD performs competitively under both few-labeled-anomaly and few-sample settings. Further intermediate analyses and ablation studies validate the effectiveness of the proposed framework.