# xSemAD: Explainable Semantic Anomaly Detection in Event Logs Using Sequence-to-Sequence Models

arXiv: https://arxiv.org/abs/2406.19763 · HTML: https://mlsanity.com/paper/2406.19763/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 37 references that are in the map.
- First posted on arXiv 28 Jun 2024.

## Builds on (most cited first, 7 of 7)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [HuggingFace's Transformers: State-of-the-art Natural Language Processing](https://mlsanity.com/paper/1910.03771/) (2019)
- [SentencePiece: A simple and language independent subword tokenizer and detokenizer for Neural Text Processing](https://mlsanity.com/paper/1808.06226/) (2018)
- [Subword Regularization: Improving Neural Network Translation Models with Multiple Subword Candidates](https://mlsanity.com/paper/1804.10959/) (2018)
- [Process Mining for Python (PM4Py): Bridging the Gap Between Process- and Data Science](https://mlsanity.com/paper/1905.06169/) (2019)
- [SAP Signavio Academic Models: A Large Process Model Dataset](https://mlsanity.com/paper/2208.12223/) (2022)
- [Analyzing Business Process Anomalies Using Autoencoders](https://mlsanity.com/paper/1803.01092/) (2018)

## Built on by (most cited first, 4 of 4)

- [On the Potential of Large Language Models to Solve Semantics-Aware Process Mining Tasks](https://mlsanity.com/paper/2504.21074/) (2025)
- [LLMs that Understand Processes: Instruction-tuning for Semantics-Aware Process Mining](https://mlsanity.com/paper/2508.16270/) (2025)
- [Detecting Undesired Process Behavior by Means of Retrieval Augmented Generation](https://mlsanity.com/paper/2505.22041/) (2025)
- [Enhancing Anomaly-Based Intrusion Detection Systems with Process Mining](https://mlsanity.com/paper/2604.18066/) (2026)

## Abstract (arXiv)

The identification of undesirable behavior in event logs is an important aspect of process mining that is often addressed by anomaly detection methods. Traditional anomaly detection methods tend to focus on statistically rare behavior and neglect the subtle difference between rarity and undesirability. The introduction of semantic anomaly detection has opened a promising avenue by identifying semantically deviant behavior. This work addresses a gap in semantic anomaly detection, which typically indicates the occurrence of an anomaly without explaining the nature of the anomaly. We propose xSemAD, an approach that uses a sequence-to-sequence model to go beyond pure identification and provides extended explanations. In essence, our approach learns constraints from a given process model repository and then checks whether these constraints hold in the considered event log. This approach not only helps understand the specifics of the undesired behavior, but also facilitates targeted corrective actions. Our experiments demonstrate that our approach outperforms existing state-of-the-art semantic anomaly detection methods.