Live demo
14 series in. 4 alerts out.
Four LLM-backed routes, 60 days of usage, 14 series. On day 44 someone edited the prompt for document-summarize. That route is 3% of spend, so the bill moved about as much as a normal week of growth. Find the regression.
Every number on this page is computed in your browser right now, by the same CUSUM and Bayesian changepoint code that runs in production. Nothing here is a screenshot.
The comparison that matters
Against the rule most teams actually ship
The standard configuration is a percentage or sigma threshold against a trailing mean, evaluated per metric. Run it over the exact same 14 series and count what lands in the channel.
The false-alarm count is not a judgement call. The incident was injected at a known index, so every naive alert before that index is wrong by construction.
What the engine found
Detection run
| Metric | Trend | Baseline | Now | Change | Confidence | Method |
|---|---|---|---|---|---|---|
Cost per request route=document-summarize | $0.02 | $0.05 | +155% | 99.9% | CUSUM | |
Input tokens per request route=document-summarize | 1839.27 | 4094.44 | +123% | 99.9% | CUSUM | |
Retry rate route=document-summarize | 1.94% | 6.63% | +241% | 99.9% | CUSUM | |
Prompt cache hit rate route=document-summarize | 47.6% | 19.9% | −58.1% | 99.9% | CUSUM |
Show your work
Cost per request · route=document-summarize
Baseline mean μ = 0.0036 and σ = 0.0651, both computed from the first two thirds of the day-over-day percentage changes. The slack k = 0.0325 is half a sigma, and the decision boundary h = 0.2604 is four. The accumulator runs on percentage changes rather than raw levels so a healthy growing series cannot drift across the boundary on its own.
alert if |Δ| > 3σ vs 7-day mean fired 2 times across this one metric. The statistical pipeline sent one message, on the day the regime actually changed.
What lands in Slack
One message, with the work already done
- 1.Diff prompt v31 against v32 on document-summarize, specifically the few-shot block and the early-exit condition.
- 2.Move the static preamble back to the front of the prompt so the provider prefix cache hits again.
- 3.Take the unit numbers to the prompt review, not the invoice: 2.6x cost per request, 2.2x input tokens, cache hit rate 47% down to 20%.
The written cause is generated only after the statistics confirm the change. The model never decides whether something is an anomaly — it explains one that has already been established. Getting that order backwards is how these products hallucinate.