# Detecting Undesired Process Behavior by Means of Retrieval Augmented Generation

arXiv: https://arxiv.org/abs/2505.22041 · HTML: https://mlsanity.com/paper/2505.22041/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in RAG for code, one of 15 directions in Retrieval-augmented generation.
- Builds on 8 of its 26 references that are in the map.
- First posted on arXiv 28 May 2025.

## Placed in

- Retrieval-augmented generation / [RAG for code](https://mlsanity.com/rag/rag-for-code/)

## Builds on (most cited first, 8 of 8)

- [Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks](https://mlsanity.com/paper/2005.11401/) (2020)
- [Nomic Embed: Training a Reproducible Long Context Text Embedder](https://mlsanity.com/paper/2402.01613/) (2024)
- [Evaluating the Ability of LLMs to Solve Semantics-Aware Process Mining Tasks](https://mlsanity.com/paper/2407.02310/) (2024)
- [BINet: Multi-perspective Business Process Anomaly Classification](https://mlsanity.com/paper/1902.03155/) (2019)
- [SAP Signavio Academic Models: A Large Process Model Dataset](https://mlsanity.com/paper/2208.12223/) (2022)
- [Conformance checking: A state-of-the-art literature review](https://mlsanity.com/paper/2007.10903/) (2020)
- [DABL: Detecting Semantic Anomalies in Business Processes Using Large Language Models](https://mlsanity.com/paper/2406.15781/) (2024)
- [xSemAD: Explainable Semantic Anomaly Detection in Event Logs Using Sequence-to-Sequence Models](https://mlsanity.com/paper/2406.19763/) (2024)

## Abstract (arXiv)

Conformance checking techniques detect undesired process behavior by comparing process executions that are recorded in event logs to desired behavior that is captured in a dedicated process model. If such models are not available, conformance checking techniques are not applicable, but organizations might still be interested in detecting undesired behavior in their processes. To enable this, existing approaches use Large Language Models (LLMs), assuming that they can learn to distinguish desired from undesired behavior through fine-tuning. However, fine-tuning is highly resource-intensive and the fine-tuned LLMs often do not generalize well. To address these limitations, we propose an approach that requires neither a dedicated process model nor resource-intensive fine-tuning to detect undesired process behavior. Instead, we use Retrieval Augmented Generation (RAG) to provide an LLM with direct access to a knowledge base that contains both desired and undesired process behavior from other processes, assuming that the LLM can transfer this knowledge to the process at hand. Our evaluation shows that our approach outperforms fine-tuned LLMs in detecting undesired behavior, demonstrating that RAG is a viable alternative to resource-intensive fine-tuning, particularly when enriched with relevant context from the event log, such as frequent traces and activities.