Order Without Memory: Why a Vocabulary-Only Frequency Baseline Outperforms Every Sequential Model in Log Anomaly Detection

The first controlled ablation to separate vocabulary access, true chronological order, and learned memory in log anomaly detection, demonstrating that a vocabulary-only frequency baseline outperforms every order-sensitive architecture on HDFS.

A central dissociation where the true-order LSTM achieves lower next-token prediction loss yet yields substantially worse detection F1 than a fixed non-semantic shuffled-order LSTM, contradicting the assumption that better sequential learning improves anomaly detection.

A disclosed chronological split and pre-registered Bonferroni-corrected statistical protocol, with the performance gap driven entirely by false positives in the most common session-length band rather than by missed anomalies.