Identifying the root cause of an anomaly among hundreds of sensors is critical for preventing safety incidents and costly downtime in complex monitored systems. Existing studies evaluate root cause analysis (RCA) methods using top@k accuracy. We show that this metric has a fundamental blind spot: it conflates two failure modes, retrieval failure, where the true cause is never considered, and reranking failure, where it is considered but ranked too low. In this work, we introduce a retrieval-reranking decomposition and audit four well-known benchmarks to expose this blind spot. Our experiments show that, on benchmarks with complex faults, statistical baselines mis-rank the true cause 79-100% of the time, and graph-based methods never clearly beat the best statistical baseline, whether their causal graphs are learned on short fault windows, on retrieved candidate pools guaranteed to contain the cause, or on multi-day normal-operation data. Meanwhile, on simple benchmarks where faults manifest significantly at their origin, retrieval is nearly solved (98-100%). Guided by the decomposition, we build a two-stage pipeline combining a multi-signal retriever with an LLM reranker that, as one fixed configuration, matches or exceeds the best baseline's top@1 accuracy on all six benchmark suites (by up to +12 points), with no causal graph or labeled data required. When all methods rank the same retrieved candidates with the true cause guaranteed present, adding a short system-description document lets the reranker lead the best baseline by +7 to +18 points on every benchmark. Code is available at https://github.com/cruiseresearchgroup/DecompRCA.
Figures & tables
Figure 1: Our retrieval–reranking decomposition for RCA. Left: prior methods fail via propagation amplification (statistical) or graph quality bottlenecks (graph-based). Stage 1 retrieves a candidate set C using three complementary signals. Stage 2 reranks C with an LLM reasoner conditioned on per-candidate evidence and optional domain knowledge D , outputting permutation π .
K=5
K=10
K=15
Dataset
mag
+ons
+stc
mag
+ons
+stc
mag
+ons
+stc
Industrial CPS benchmarks
WADI ( n=14 )
0.36
0.36
0.50
0.43
0.50
0.57
0.64
0.57
0.64
SWaT ( n=36 )
0.33
0.25
0.31
0.44
0.44
0.61
0.53
0.61
0.67
HVAC ( n=48 )
0.21
0.06
0.25
0.27
0.56
0.54
0.35
0.65
0.63
Microservice benchmarks (RCAEval)
Table 1: Cumulative-budget Retrieval@ K . At each K , the candidate pool is split across signals while the total pool size is held fixed: mag uses K magnitude items; +ons splits K between magnitude and onset; +stc splits it across magnitude, onset, and state-change (Appendix A ). Best per (dataset, K ) in bold .
BARO
Retrieval@15
LLM (no DK)
Retrieval
Reranking
Dataset
top@1
(+stc, K=15 )
top@1
failure
failure
Rerank@1
Industrial CPS benchmarks
WADI ( n=14 )
0.214
0.64
0.333 ± 0.082
0.36
0.31
0.52
SWaT ( n=36 )
0.194
0.67
0.213 ± 0.016
0.33
0.45
0.32
HVAC ( n=48 )
0.000
0.63
0.153 ± 0.043
0.38
0.47
0.24
Microservice benchmarks (RCAEval)
Table 2: Headroom decomposition for the multi-evidence LLM reranker without the domain document (no-DK; with-DK results in Table 3 ). Retrieval failure =1− Retrieval@15; reranking failure = Retrieval@15 − top@1; Rerank@1 = top@1 / Retrieval@15, best per group in bold .
Industrial CPS
Microservices (RCAEval)
Method
WADI
SWaT
HVAC
RE1-OB
RE1-SS
RE1-TT
BARO
0.214
0.194
0.000
0.784
0.856
0.560
RCD
0.071
0.083
0.083
0.304
0.248
0.144
ϵ -Diagnosis
0.000
0.028
0.146
0.072
0.232
0.008
CIRCA (PC)
0.214
0.083
0.062
0.536
0.632
0.320
CIRCA (FCI)
0.214
0.111
0.104
0.576
0.624
0.328
Table 3: End-to-end main results (top@1). LLM rows: mean ± std over n=3 runs at T=1.0 , without and with the domain document; other rows single runs. HVAC LLM rows count the causes the retriever misses as misses (Appendix F ). Full top@1/3/5/Avg@5 grids in Appendix E .
Retriever pool ( K=15 )
All candidates
Group
BB
LLM (no DK)
LLM (with DK)
Δ
BB
LLM (no DK)
Δ
WADI
0.308
0.410 ± 0.044
0.436 ± 0.089
+ 12.8
0.231
0.385 ± 0.077
+ 15.4
SWaT
0.200
0.229 ± 0.029
0.267 ± 0.017
+ 6.7
0.200
0.210 ± 0.017
+ 1.0
HVAC
0.188
0.188 ± 0.055
0.326 ± 0.012
+ 13.9
0.146
0.299 ± 0.032
+ 15.3
RE1-OB
0.784
0.883 ± 0.005
0.891 ± 0.012
+ 10.7
0.784
0.896 ± 0.014
+ 11.2
RE1-SS
0.856
0.859 ± 0.009
0.928 ± 0.000
+ 7.2
0.856
0.877 ± 0.005
+ 2.1
Table 4: Retrieval-controlled top@1 (true cause present in every pool). BB = best of nine baselines on identical pools; Δ= best LLM column minus BB, in pp. WADI/SWaT n=13/35 (causes outside the evaluated sensor set cannot be pinned). Full grids in Appendix G .
Appendix figures & tables13 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 2: Retrieval saturation per signal. Each signal is allocated its own full K . Grey dotted: K=15 reference. The panels show three distinct saturation regimes (HVAC: onset-dominant amplitude-suppressed cause; WADI/SWaT: lag-dominated propagation; microservices: magnitude-dominant direct fault).
Table 5: Full end-to-end grid, industrial CPS benchmarks (expands Table 3 ). LLM rows: mean ± std over n=3 runs at T=1.0 ; other rows single runs (RCD and ϵ -Diagnosis seeded on HVAC, unseeded elsewhere). HVAC LLM rows are scored as in Appendix F .
Table 6: Full end-to-end grid, RCAEval microservice suites (expands Table 3 ). LLM rows report mean ± std across n=3 independent runs at temperature 1.0 . Other rows are single runs (RCD and ϵ -Diagnosis unseeded).
Ranker (same candidate set C )
WADI
SWaT
mag-on- C ( ≈ BARO)
0.286 / 0.357 / 0.357 / 0.329
0.167 / 0.222 / 0.333 / 0.244
ons-on- C
0.214 / 0.286 / 0.500 / 0.329
0.194 / 0.278 / 0.417 / 0.311
stc-on- C
0.286 / 0.357 / 0.429 / 0.357
0.139 / 0.389 / 0.389 / 0.339
fusion-on- C (Borda)
0.286 / 0.500 / 0.571 / 0.443
0.194 / 0.306 / 0.361 / 0.294
LLM (no DK, n=3 )
0.333 / 0.381 / 0.381 / 0.362
0.213 / 0.472 / 0.481 / 0.402
Appendix
Table 7: Same-candidate controls, industrial CPS (the candidate lists the LLM was shown; top@1 / top@3 / top@5 / Avg@5). LLM rows are the n=3 runs on the identical lists.
Table 9: Same-candidate controls on HVAC (retrieval-controlled retriever pools, top@1). State-change wins at no-DK and domain knowledge flips the comparison; the rule that wins HVAC scores 0.000 on RE1-TT, so no fixed rule deploys uniformly.
Method
WADI
SWaT
RE1-OB
RE1-SS
RE1-TT
HVAC
BARO
0.308
0.200
0.784
0.856
0.560
0.000
RCD
0.154
0.114
0.440
0.384
0.280
0.188
ϵ -Diagnosis
0.077
0.057
0.176
0.368
0.104
0.146
PageRank (PC)
0.077
0.086
0.304
0.472
0.192
0.062
PageRank (FCI)
0.154
0.114
0.296
0.352
0.176
0.083
RandomWalk (PC)
0.077
0.114
0.264
0.480
0.208
0.042
Appendix
Table 10: Retrieval-controlled grid, retriever pool ( K=15 , reserved ground-truth spot): top@1 for every baseline on the identical pools. LLM row: no-DK, n=3 .
Method
WADI
SWaT
RE1-OB
RE1-SS
RE1-TT
HVAC
BARO
0.231
0.200
0.784
0.856
0.560
0.000
RCD
0.231
0.086
0.304
0.248
0.144
0.083
ϵ -Diagnosis
0.000
0.029
0.072
0.232
0.008
0.146
PageRank (PC)
0.000
0.029
0.112
0.136
0.008
0.021
PageRank (FCI)
0.077
0.000
0.096
0.184
0.048
0.000
RandomWalk (PC)
0.077
0.000
0.080
0.112
0.064
0.000
Appendix
Table 11: Retrieval-controlled grid, all candidates (every sensor in the pool): top@1 for every baseline. LLM row: no-DK, n=3 .
Table 13: Decoding-temperature control (WADI, retrieval-controlled retriever pool, no-DK, n=3 per temperature).
Group
real / no-DK
anon / no-DK
real / with-DK
anon / anon-DK
WADI
0.410
0.410
0.436
0.487
SWaT
0.229
0.286
0.267
0.286
HVAC
0.188
0.139
0.326
0.375
RE1-OB
0.883
0.848
0.891
0.880
RE1-SS
0.859
0.877
0.928
0.933
RE1-TT
0.688
0.645
0.741
0.731
Appendix
Table 14: De-identification control: top@1 on retriever pools ( n=3 means) with real vs. anonymized sensor names and DK documents.
Benchmark
−15 min
−5 min
+5 min
+15 min
WADI
−14.3 pp
0.0 pp
−12.5 pp
0.0 pp
SWaT
−22.2 pp
−22.2 pp
−16.7 pp
−25.0 pp
HVAC
−25.0 pp
−27.1 pp
−12.5 pp
−16.7 pp
RCAEval ×3 ( ±1 / ±2 min)
≤3.2 pp at every tested offset
Appendix
Table 15: Detection-timestamp sensitivity: change in Retrieval@15 of the +stc candidate pool under tdet perturbation, matched scenario subsets on WADI/SWaT. RCAEval suites are perturbed at ±1 and ±2 minutes (windows of about 6 minutes per side); the entry reports the maximum absolute change across the three suites. No HVAC scenarios are skipped at any offset.
Method
WADI
SWaT
HVAC
RE1-OB
RE1-SS
PageRank (global PC)
0.071
0.000
0.000
0.104
0.184
RandomWalk (global PC)
0.000
0.000
0.000
0.176
0.208
CIRCA (global PC)
0.214
0.083
0.083
0.568
0.632
PageRank (global FCI)
0.071
0.000
0.000
0.000
0.216
RandomWalk (global FCI)
0.000
0.000
0.000
0.000
0.192
CIRCA (global FCI)
0.214
0.028
0.083
0.632
0.648
Appendix
Table 16: Ranking heads on global PC/FCI graphs learned from multi-day normal-operation corpora (top@1).
Root-Cause Analysis (RCA) seeks to identify the variables responsible for abnormal system behavior in complex domains such as manufacturing, cloud computing, and healthcare. Existing approaches face a critical bottleneck: graph-based causal methods can identify intervention targets but typically require a known or accurately estimated causal graph, while graph-free statistical methods either localize marginal anomalies rather than structural causes, or rely on restrictive assumptions about graph structure or functional form. We propose StableRCA, a local mechanism-level RCA framework that avoids global graph discovery by estimating local Markov boundaries and detecting conditional distribution shifts within them. Leveraging the Independent Causal Mechanism principle, we show that intervention targets can be identified with probability converging exponentially in sample size under faithful Markov boundary recovery and non-degenerate mechanism shifts. Experiments on synthetic benchmarks and five real-world datasets demonstrate that StableRCA is robust to graph misspecification, effective under multiple intervention targets, scalable to large systems, and reliable across diverse application domains. Code is available at: https://anonymous.4open.science/r/StableRCA-E362
Finding the source of failures, known as Root Cause Analysis (RCA), is essential for identifying the root causes of anomalies and maintaining the reliability of complex systems. While causal theory has advanced data-driven RCA, existing frameworks assume causal sufficiency, failing to account for the unobserved latent variables prevalent in real-world environments. To address this gap, we propose PAG-RCA. This framework models system failures as parametric interventions over Partial Ancestral Graphs (PAGs) to perform RCA in the presence of latent variables. We use standard causal identification algorithms to find the source of failures by quantifying causal effects over the PAG. When an effect is identifiable, candidate root causes are ranked based on their exact intervention effects. When effects are structurally unidentifiable, our framework (for the first time in the RCA literature) integrates partial identification to evaluate and score candidates using analytical causal bounds. By integrating latent variables and partial identification at once our framework ensures robust RCA even under data scarcity and latent-variable scenarios where traditional methods degrade. Evaluations on synthetic data, microservice anomaly benchmarks and power-grid cascading failures demonstrate that PAG-RCA consistently outperforms state-of-the-art data-driven baselines. By improving data-driven RCA performance under data scarcity, this methodology advances reliable automated diagnostics in partially observable complex networks.
Henrique O. Caetano, Rafael Arone, Carlos Dias Maciel
Signal Processing Laboratory, São Carlos School of Engineering, University of São Paulo, São Paulo, Brazil · Guaratinguetá School of Engineering, São Paulo State University, Guaratinguetá, Brazil
Root cause analysis (RCA) is a critical problem in many real-world scenarios. RCA enables the identification of faulty or failing mechanisms in a system by comparing anomalous observations with corresponding reference (i.e., regular) observations. However, existing approaches rely either on heuristic methods or on conditional independence tests with a strong unconfoundedness assumption, and thus fail to exploit other complicated distributional constraints in the presence of latent variables. To relax these assumptions, we model the underlying system as a causal model and the anomalous system as a change in the structural functions of the same causal model. Specifically, to handle unobserved confounders, we establish an implicit connection between distributional constraint testing and root cause analysis. To adapt our approach to data generated from arbitrary causal models, we employ the deep causal model (DCM) framework, in which we design the causal model using neural networks. Finally, we illustrate how our method, RCA-DCM, can utilize different levels of partial graphical knowledge to perform RCA. We evaluate RCA-DCM against state-of-the-art baselines on simulated datasets, a physics-based causal chamber and two micro-service applications. RCA-DCM improves top-1 accuracy over the strongest baseline on both Sock Shop (0.880 vs. 0.752) and Online Boutique (0.776 vs. 0.712), and when the true root cause in the causal chamber is unobserved and acts as a latent confounder, it recovers the exact root-cause set more often than any competing method (perfect recovery rate (PRR) 0.846 vs. 0.731).
Md Musfiqur Rahman, Kenneth Lee, Ziwei Jiang +3
Electrical and Computer Engineering, Purdue University · Computer Science, Johns Hopkins University · Intuit AI Research +1