Few-shot Multimodal Anomaly Detection via Dynamic Intra-modal Sparsity Attention and Quality-aware Cross-modal Fusion in Microservice System

The dynamic nature of microservice architectures necessitates robust few-shot anomaly detection (AD) systems to prevent cascading failures. However, current multimodal approaches remain inadequate for cold-start scenarios due to their dependence on extensive training data. The fundamental challenge in few-shot AD lies in two critical aspects: (1) effective feature extraction from intra-modalities, and (2) the alignment of heterogeneous multimodal representations, particularly the distribution discrepancy between discrete token embeddings from logs and continuously evolving representations from traces and metrics. To overcome these challenges, we present FuseGuard, an LLM-enhanced framework that pioneers quality-aware multimodal fusion for few-shot AD. First, our intra-modal feature extraction employs a Dynamic Sparse Correlation Attention mechanism for metrics, Spatio-temporal Encoding for traces, and LLM-enhanced semantic-frequency encoding for logs, enabling adaptive representation of time-evolving patterns. Second, we introduce hierarchical cross-modal alignment via token projection, layer-wise distillation, and consistency learning to preserve modality-specific features while enabling effective knowledge transfer. Finally, a quality-aware fusion mechanism dynamically weights modalities based on uncertainty estimation. Evaluated on three open-source platforms (MSDS, GAIA, TrainTicket) and a production system, FuseGuard's few-shot capability outperforms SOTA by 19.69%-77.07% F1-score across four datasets.