LogICL: Demonstration Retrieval to Bridge the Semantic Gap in Cross-Domain Log Anomaly Detection
Effective log anomaly detection is critical to sustaining reliability in large-scale IT infrastructures. Transformer-based language models have advanced the field but require substantial computational resources and labeled data, exacerbating the cold-start problem in target domains with scarce logs. Cross-domain methods alleviate data scarcity by leveraging source-domain logs, but their reliance on surface lexical similarity limits generalization when structural and terminological differences obscure semantic equivalence. We propose LogICL, a demonstration-retrieval framework for cross-domain log anomaly detection. During training, LogICL constructs a sparse delta matrix by measuring the signed change in a frozen LLM's prediction error between zero-shot and one-shot inference for selected query-demonstration pairs. This outcome-level feedback supervises a lightweight encoder through a demonstration-utility loss, while maximum mean discrepancy and supervised contrastive losses promote domain alignment and anomaly discrimination. At inference, the encoder retrieves similarity-based anchors and expands them with candidates having the highest scores aggregated over precomputed positive delta relations. Thus, LogICL retrieves high-utility demonstrations without candidate-wise LLM evaluation and provides them to a frozen LLM for in-context anomaly prediction. Experiments on few-shot and target-domain zero-shot transfer benchmarks demonstrate strong performance across heterogeneous log systems. In the few-shot setting, LogICL outperforms Random-ICL and kNN-ICL in three of four transfers under the fixed split, while the benefit remains setting-dependent. Further analysis shows that LogICL can identify demonstrations with positive predictive utility despite low surface lexical similarity, helping bridge the semantic gap across logging systems.