EvoCause: LLM-Guided Evolution of Causal Graphs for Root Cause Analysis

2026-07-29

AI Summary

This work addresses the challenge of alarm cascades triggered by component failures in telecommunication and cloud systems, where traditional root cause analysis struggles to incorporate expert knowledge into static causal graphs. The paper proposes a novel approach that integrates large language models (LLMs) into causal graph evolution, leveraging expert-annotated constraints to iteratively generate semantically plausible graph modifications. Deterministic code enforces node identity and directed acyclic graph (DAG) properties, yielding an interpretable, optimized causal graph that requires no LLM invocation during inference. The authors also introduce TeleRCA, the first large-scale benchmark for telecom root cause analysis. Experiments demonstrate significant improvements on synthetic data, with gains of 11.59, 9.40, and 4.59 percentage points in Node F1, Case EM, and Graph F1 scores, respectively, and a 0.2379 reduction in normalized Structural Hamming Distance (nSHD), validating the critical role of alarm semantics in graph optimization.

Abstract

Modern telecommunication, cloud, and microservice systems emit correlated alarm cascades when components fail. Root cause analysis (RCA) aims to identify the small set of alarms that initiate each cascade. A common approach learns a causal graph from observational logs and predicts all zero-in-degree alarms in each incident-induced subgraph. However, the learned graph remains fixed and cannot benefit from expert diagnoses of historical incidents. We close this loop with EvoCause. Expert labels constrain which alarms should be source nodes but do not specify the edge edits needed to satisfy those constraints. EvoCause uses a large language model (LLM) to propose semantically plausible graph edits, while deterministic code validates node identities and acyclicity and retains the best graph on a labeled alignment set. At test time, the refined graph alone produces transparent predictions without an LLM call. We also release TeleRCA, an expert-annotated benchmark from a production telecommunication network containing $485{,}681$ alarm events spanning $194$ alarm types over $5{,}621$ resources. On synthetic data, EvoCause initialized with the PC causal discovery algorithm outperforms the unrefined PC baseline, raising Node F1, Case EM, and Graph F1 by $11.59$, $9.40$, and $4.59$ percentage points, respectively, while reducing nSHD by $0.2379$. On TeleRCA, replacing human-readable alarm titles with anonymous identifiers lowers Node F1 and Case EM by $6.12$ and $8.04$ percentage points, respectively, indicating that alarm-name information contributes to graph refinement.

Problem

• Root Cause Analysis
• Causal Graph
• Alarm Cascades
• Expert Feedback
• Graph Refinement

Innovation

• LLM-guided graph evolution
• causal graph refinement
• root cause analysis
• expert-in-the-loop learning
• transparent RCA