PaperlayerView exact revision on arXiv

Source-linked AI summary

Beyond Conditional Independence: Root Cause Analysis with Deep Causal Models

Md Musfiqur Rahman, Kenneth Lee, Ziwei Jiang, Padmaja Jonnalagedda, Ruocheng Guo, Murat Kocaoglu

arXiv:2609.36771v1cs.LGcs.AIstat.ML

TL;DR

Root cause analysis must distinguish faulty mechanisms from downstream variables whose distributions also shift, a challenge made harder by unobserved confounders. RCA-DCM searches for causal models consistent with normal and anomalous data and identifies mechanisms that must change. It ranks first on both evaluated microservice benchmarks, while the paper also identifies a boundary on recovery under graph misspecification.

  • Problem

    RCA methods based on heuristics, marginal shifts, or conditional-independence tests have difficulty identifying root causes when changes propagate through dependencies and latent confounders are present.

    Source: §1 · p. 2

  • Method

    RCA-DCM uses deep causal models to search for structural causal models consistent with normal and anomalous data and identify mechanisms that must shift to explain the anomaly.

    Source: §1 · p. 3

  • Results

    RCA-DCM ranks first on both microservice benchmarks: SockShop top-1 accuracy is 0.88 versus NSigma’s 0.75, and Online Boutique top-1 accuracy is 0.78 versus RCG’s 0.71.

    Source: §5.3 · p. 10

  • Takeaways & Limitations

    When root causes are not uniquely identifiable, the paper characterizes how multiple root-cause sets can explain the distributional shift.

    Source: §1 · p. 3

    Recovery under a mis-specified graph is possible only when that graph can realize the normal and anomalous distributions; exploring arbitrary alternative graphs is outside the paper’s scope.

    Source: §4.3 · p. 7

Abstract

from arXiv · show

Root cause analysis (RCA) is a critical problem in many real-world scenarios. RCA enables the identification of faulty or failing mechanisms in a system by comparing anomalous observations with corresponding reference (i.e., regular) observations. However, existing approaches rely either on heuristic methods or on conditional independence tests with a strong unconfoundedness assumption, and thus fail to exploit other complicated distributional constraints in the presence of latent variables. To relax these assumptions, we model the underlying system as a causal model and the anomalous system as a change in the structural functions of the same causal model. Specifically, to handle unobserved confounders, we establish an implicit connection between distributional constraint testing and root cause analysis. To adapt our approach to data generated from arbitrary causal models, we employ the deep causal model (DCM) framework, in which we design the causal model using neural networks. Finally, we illustrate how our method, RCA-DCM, can utilize different levels of partial graphical knowledge to perform RCA. We evaluate RCA-DCM against state-of-the-art baselines on simulated datasets, a physics-based causal chamber and two micro-service applications. RCA-DCM improves top-1 accuracy over the strongest baseline on both Sock Shop (0.880 vs. 0.752) and Online Boutique (0.776 vs. 0.712), and when the true root cause in the causal chamber is unobserved and acts as a latent confounder, it recovers the exact root-cause set more often than any competing method (perfect recovery rate (PRR) 0.846 vs. 0.731).

1 INTRODUCTION

RCA seeks the mechanisms responsible for anomalies, but distribution shifts can propagate and make downstream variables look more anomalous than root causes. RCA-DCM uses deep causal models and distributional constraints to address unobserved confounding, while characterizing non-identifiability and evaluating the method on simulated, physical, and microservice settings.

1 INTRODUCTION

  • Heuristic, statistical, and correlation-based RCA methods can miss root causes when structural dependencies propagate changes to downstream distributions.Causal knowledge helps distinguish root causes from other variables.Source: §1 · p. 1
  • Conditional-independence methods can misrank causes under latent confounding, while marginal-shift methods can rank a downstream non-cause above a root cause.The paper connects testing whether Y is also a root cause, given F → T, to testing whether F is a valid instrument for T’s effect on Y.Source: §1 · p. 2, Figure 1 · p. 2
  • RCA-DCM searches for structural causal models consistent with normal and anomalous data and identifies mechanisms that must shift to explain the anomaly.The framework is designed to handle an arbitrary number of unobserved confounders.Source: §1 · p. 3
  • The paper characterizes cases where root causes are not uniquely identifiable and examines how a mis-specified graph changes the solution set.A different variable set may also explain the observed distributional shift.Source: §1 · p. 3
  • RCA-DCM outperforms state-of-the-art baselines in almost all evaluated cases, spanning synthetic setups, the Causal Chamber, and two microservice datasets.The evaluations include Sock Shop and Online Boutique.Source: §1 · p. 3

2 RELATED WORK

Prior RCA methods variously use causal graphs, intervention recognition, invariances, or distribution-shift scores, but the paper identifies a gap in handling nonlinear mechanisms with latent confounders.

2 RELATED WORK

  • Earlier microservice RCA methods build service-level causal graphs and localize causes by traversing or ranking nodes with anomaly scores.The passage cites constraint-based discovery and several graph-based methods.Source: §2 · p. 3
  • Later approaches model failures as interventions, but use local discovery, partial structural knowledge, Bayesian-network recognition, or gradient-based graph learning.Other approaches rely on restricted graph classes or linear-SCM invariances, while BARO scores shifts without causal structure.Source: §2 · p. 3
  • The paper positions RCA-DCM as addressing the gap in explicitly modeling nonlinear mechanisms with latent confounders through deep causal models.The passage says prior methods ignore causal structure, rely on conditional-independence or invariance tests, or depend on linearity or potentially inaccurate graphs.Source: §2 · p. 3

3 BACKGROUND

The background formalizes causal models with observed and latent variables, represents latent confounding in an acyclic directed mixed graph, and adds an environment indicator to encode intervention targets.

3 BACKGROUND

  • An SCM is a four-part model of observed variables, latent variables, structural functions, and a joint distribution over latent variables.Each observed variable is evaluated from a structural function of selected observed parents and a latent variable.Source: §3 · p. 3
  • An ADMG represents the observed causal structure after latent projection, using directed edges for direct parent relations and bidirected edges for latent confounding.Under the stated semi-Markovian assumption, each latent confounder appears in the equations of exactly two observed variables.Source: §3 · p. 3
  • The augmented graph adds a visible root F with an edge to each root-cause variable, whose mechanism may depend on F or ignore it.This uses unrestricted soft-intervention semantics.Source: §3 · p. 3

4 IDENTIFYING ROOT CAUSES UNDER UNOBSERVED CONFOUNDING

The paper frames root cause analysis as identifying which mechanisms changed between normal and anomalous environments, including when latent confounders are present. RCA-DCM searches for causal models consistent with both datasets and uses graph structure and distributional constraints to narrow root-cause solutions.

4 IDENTIFYING ROOT CAUSES UNDER UNOBSERVED CONFOUNDING

  • The framework represents normal and anomalous environments with SCMs over shared variables; root causes are the variables whose mechanisms shift between environments.A binary indicator F marks the two environments and has outgoing edges to the shifted variables.Source: §4 · p. 4

4.1 ROOT-CAUSE SOLUTION SETS WITH A KNOWN GRAPH

  • With an unobserved confounder between X and Y, conditional-independence tests cannot distinguish {X} from {X, Y}; an instrumental-inequality violation can rule out {X} alone.The violation implies an edge from the fault indicator F to Y under the stated construction.Source: §4.1 · p. 4, Figure 2 · p. 4

4.1.1 THE ROOT-CAUSE SOLUTION SET

  • Root-cause solution sets are upward closed: if a set explains the data, its supersets also explain them, so inclusion-minimal members are reported as candidates.Structural dominance allows an augmented graph with additional fault edges to realize a larger distribution set.Source: §4.1.1 · p. 5

4.1.2 EXPLOITING DISTRIBUTIONAL CONSTRAINTS FOR SOLUTION-SET REDUCTION

  • Testing each candidate set against the augmented graph’s distributional constraints defines the solution set; searching for a consistent SCM pair avoids enumerating those constraints individually.A candidate’s population root-cause loss is the least distributional mismatch attainable by its SCM pairset.Source: §4.1.2 · p. 5

4.2 RCA-DCM: ROOT-CAUSE DETECTION VIA SCM SEARCH

  • RCA-DCM searches over SCM pairs by freezing each candidate variable’s mechanism while allowing the others to shift, then scores distributional fit using deep causal models.The procedure can test variables independently in parallel.Source: §4.2 · pp. 6–7
  • Under an expressive DCM, positive loss when Y’s mechanism is held fixed certifies Y as a root cause, reducing candidate checks from 2^|V| to |V|.The ranking also places all root causes above non-root causes under a stated mild condition.Source: §4.2 · p. 7

4.3 THEORETICAL GUARANTEES UNDER GRAPH MIS-SPECIFICATION

  • With a misspecified graph, exact root-cause recovery is possible only when it can realize both observed distributions; sparse graphs can require larger sets, while dense graphs can admit smaller ones.In the example, the sparse graph returns {W, X, Z}, while the dense graph can return {W}.Source: §4.3 · pp. 7–8, Figure 4 · p. 8

5 EXPERIMENTAL RESULTS

RCA-DCM is evaluated on simulated data, a physical causal chamber, and two microservice benchmarks. Its results are strongest in settings with hidden confounding or heterogeneous shifts, and it leads on both microservice benchmarks.

5 EXPERIMENTAL RESULTS

  • The study compares five statistical and causal baselines across synthetic, semi-synthetic, and real-world datasets, varying graph properties and latent confounding in generated data.The simulated experiments include nonlinear models with unobserved confounders and heterogeneous anomalies.Source: §5 · p. 8, §5.1 · p. 8

5.1 SIMULATED DATASETS

  • 99% and 84% PRR at confounding strengths λ = 3 and 10 lead all baselines, although RCA-DCM drops 15 points as confounding strengthens.The simulated setting has 6 observed and 4 latent variables, with three observed root causes.Source: §5.1 · p. 8, Figure 5 · p. 9
  • 98% PRR at n = 5 and 54% at n = 10 lead all five baselines under heterogeneous shifts that make a non-cause out-shift a true cause in roughly 60% of p = 10 trials.At n = 10, BARO and NSigma fall to 14%.Source: §5.1 · p. 9, Figure 5 · p. 9
  • With 50% spurious directed and bidirected edges, PRR is 84% (p = 0.39); deleting 50% of bidirected edges gives 87% (p = 1.00), while deleting both edge types gives 76% (p = 0.019).Even after deleting both edge types, RCA-DCM remains above the best baseline at λ = 10, BARO at 65%.Source: §5.1 · p. 9

5.2 CAUSAL CHAMBER (REAL-WORLD PHYSICAL TESTBED)

  • 87% PRR with the true root cause hidden beats the best baseline’s 73%, while RCA-DCM falls only 2 points between observed and hidden conditions.With the cause observed, RCA-DCM reaches 88%, below RCG at 100% and RCD at 90%.Source: §5.2 · p. 9, Figure 5 · p. 9

5.3 MICROSERVICE DATASETS

  • 0.88 top-1 accuracy on SockShop and 0.78 on Online Boutique put RCA-DCM ahead of every listed baseline on both benchmarks.The microservice tests give RCA-DCM only a confounded sink, while CIRCA and RCG receive the true call graph.Source: §5.3 · p. 10, Table 1 · p. 10

6 CONCLUSION

The conclusion frames RCA-DCM as a feasible-SCM search for root causes under unobserved confounding, while identifying partial-order relaxation and high-dimensional variables as future work.

6 CONCLUSION

  • RCA-DCM addresses root cause analysis with any number of unobserved confounders.The paper reports performance on synthetic data and a real-world physical testbed.Source: §6 · p. 10
  • The approach searches for feasible structural causal models to detect root causes in parallel.Source: §6 · p. 10
  • Future work aims to relax the partial-order assumption and extend the method to high-dimensional variables.Source: §6 · p. 10

A.1 LIMITATIONS AND FUTURE WORKS

The paper states constraints on available causal structure, data separation, computation, and graph misspecification, alongside broader-impact cautions. It positions RCA-DCM among causal and statistical RCA methods and lists assumptions underlying its analysis.

A.1 LIMITATIONS AND FUTURE WORKS

  • The method assumes access to a causal structure or its total order, and the paper leaves arbitrarily different misspecified graphs unexplored.It also notes training time and resource demands, the need to separate normal from anomalous data, and possible nonzero loss from neural-network convergence error.Source: §A.1 · p. 15

A.2 BROADER IMPACT

  • Incorrect causal assumptions or misspecified graphs may mislead root-cause conclusions, so the paper recommends domain knowledge, uncertainty assessment, and validation before deployment.Source: §A.2 · p. 15

B EXTENDED RELATED WORK

  • Graph-based RCA often traverses or ranks service-metric graphs, while MicroDiag remains limited to observed metrics and does not address unobserved confounding.A large-scale evaluation cited in the paper finds no existing causal-discovery RCA method robust across datasets and failure types.Source: B EXTENDED RELATED WORK · p. 15
  • RCD, RCG, CIRCA, and CausalRCA use intervention recognition or causal discovery, but rely on graphs or tests whose reliability can degrade under noise, hidden confounding, continuous variables, or large conditioning sets.Source: B EXTENDED RELATED WORK · p. 15
  • Other limited-structure approaches include methods restricted to single-target interventions or linear SCM invariances; neither cited approach explicitly models nonlinear mechanisms with latent confounding.Source: B EXTENDED RELATED WORK · p. 15
  • Counterfactual RCA requires a full SCM with invertible functional relations, while another cited score-based RCA method requires no causal knowledge.Source: B EXTENDED RELATED WORK · pp. 15–16
  • BARO assumes root causes exhibit the largest distributional shifts, while cited multimodal approaches combine logs, metrics, traces, or event graphs for causal structure learning and interpretation.Source: B EXTENDED RELATED WORK · p. 16

C ASSUMPTIONS

  • RCA-DCM assumes a semi-Markovian SCM, mechanism shifts with shared graph and latent distribution, graph knowledge consistent with the true partial order, an expressive DCM, and stated identifiability conditions.The assumptions also require the normal and anomalous models to share the exogenous distribution, with root-cause mechanisms differing.Source: C ASSUMPTIONS · p. 16

D POSSIBLE ROOT CAUSE SET

The possible-root-cause-set results characterize feasible mechanism-shift sets and use distributional discrepancies to identify variables that must be root causes. Under additional assumptions, their intersection gives a subset of the true root-cause set.

D POSSIBLE ROOT CAUSE SET

E ERROR ANALYSIS IN RCA-DCM RANKING

Finite-sample error can make every observed loss positive, but under a uniform concentration condition, RCA-DCM can still rank all true root causes above non-causes. When each true cause’s population loss exceeds twice the statistical error bound, the root causes occupy the top k positions.

E ERROR ANALYSIS IN RCA-DCM RANKING

  • Finite samples can make the observed loss positive for every variable, even with perfect model training.The empirical loss may fall either below or above its population value.Source: E ERROR ANALYSIS IN RCA-DCM RANKING · p. 18
  • The ranking analysis assumes empirical loss concentrates uniformly across candidates with probability at least 1 − δ, using an error bound that decreases with sample size.Under this event, the statistical error is bounded by ε_stat for every candidate.Source: E ERROR ANALYSIS IN RCA-DCM RANKING · p. 18
  • If each true cause’s population loss exceeds 2ε_stat, RCA-DCM ranks all k root causes above non-causes and places them in the top k positions.This ranking result is stated for perfect model training.Source: E ERROR ANALYSIS IN RCA-DCM RANKING · p. 18

F GRAPH MIS-SPECIFICATION

Graph misspecification changes the feasible root-cause sets and their size, with sparse and dense graphs yielding different guarantees. The section also reports RCA-DCM’s training setup, graph-input settings, sample sizes, and runtime trade-off.

F GRAPH MIS-SPECIFICATION

  • For an over-specified graph, the minimum feasible root-cause number cannot exceed the true graph’s minimum, and every feasible set is at least that large.The latter size guarantee applies when the misspecified graph has a finite root-cause number.Source: F GRAPH MIS-SPECIFICATION · p. 19
  • Under Assumption C.7, every inclusion-minimal root-cause set from a sparse graph contains the true root causes.This faithful-inclusion guarantee applies when the sparse graph can represent both observed distributions.Source: F GRAPH MIS-SPECIFICATION · p. 19
  • Under Assumption C.7, a dense graph has at least one inclusion-minimal reported set that is a subset of the true root-cause set.The guarantee is existential, not a claim about every minimal set.Source: F GRAPH MIS-SPECIFICATION · p. 19
  • A denser misspecified graph can yield a predicted root-cause set that is a subset of the original set, while a sparser graph can yield a superset.This describes how predictions change relative to the true graph.Source: F GRAPH MIS-SPECIFICATION · p. 20

G.1 TRAINING DETAILS

  • Continuous experiments use flow-based DCMs trained by maximum likelihood, with separate normal and anomalous models for each candidate and shared candidate mechanisms across regimes.Candidates are ranked by sample-to-data discrepancy, primarily Wasserstein distance for continuous experiments.Source: §G.1 · p. 20
  • Causal graph structure remains an input requirement; evaluations use true or dense graphs in synthetic experiments and a sink graph for microservices with no known graph.The authors report outperforming baselines in those graph settings.Source: §G.1 · p. 20
  • The reported sample sizes are N = 5k for synthetic experiments, N = 1k for the Causal Chamber, and N ∼700 for microservices.The authors report consistent performance across these sample sizes.Source: §G.1 · p. 20
  • A single root-cause test takes 41 s for RCA-DCM versus 0.4 s for RCD, so the method targets settings that prioritize reliability under latent confounding over faster runtime.Source: §G.1 · p. 20

G.2 SIMULATED DATASETS

Across simulations, sample-imbalance tests, and the Causal Chamber, RCA-DCM’s recovery depends on confounding, graph structure, and the available anomalous samples. It leads in the chamber’s hidden-cause condition and in the reported simulated settings, while severe anomalous-sample shortages reduce its performance.

G.2 SIMULATED DATASETS

  • 99% and 84% PRR: RCA-DCM leads every baseline at confounding strengths λ = 3 and λ = 10, respectively.Its PRR drops by 15 percentage points as confounding strengthens; the other methods drop by 24–46 points.Source: §G.2 · p. 21
  • 98% and 54% PRR: RCA-DCM leads all five baselines at n = 5 and n = 10 in the heterogeneous-anomaly simulation.At n = 10, BARO and NSigma fall to 14%; the construction makes a non-root descendant’s marginal shift exceed a true root cause’s in roughly 60% of trials.Source: §G.2 · pp. 21–22
  • 76% PRR: deleting 50% of both directed and bidirected edges degrades recovery, while adding 50% of such edges or deleting 50% of bidirected edges does not significantly change accuracy.The comparison uses a true-graph control with PRR 88% and 84% in two independent runs; the authors relate robustness to whether the misspecified graph can represent both distributions.Source: §G.2 · p. 22

G.3 SENSITIVITY ANALYSIS OF UNEQUAL SAMPLE SIZES

  • 0.58 vs. 0.63 PRR: under moderate imbalance (Ns = 1000, Na = 500), DCM stays near the balanced setting and matches or exceeds the baselines.With Na = 100 and Ns = 1000, its PRR falls from 0.63 to 0.27; the test assumes enough samples to learn each regime’s SCM.Source: §G.3 · pp. 22–23, Table 2 · p. 23

G.4 CAUSAL CHAMBER (REAL-WORLD PHYSICAL TESTBED)

  • 87% PRR: with the chamber’s true root cause hidden, RCA-DCM exceeds the best baseline’s 73% and is the only method whose PRR barely changes between conditions.The hidden cause acts as a latent confounder, and all its children must be recovered as root causes.Source: §G.4 · p. 23

G.5 MICROSERVICE DATASETS

RCA-DCM ranks first on both microservice benchmarks despite receiving only a confounded sink graph, while graph-based baselines receive the true call graph. Its accuracy comes with substantial runtime cost, making the choice an accuracy–compute trade-off.

G.5 MICROSERVICE DATASETS

  • 0.88 vs. 0.75 top-1 accuracy on SockShop and 0.78 vs. 0.71 on Online Boutique: RCA-DCM exceeds the strongest baseline on each benchmark.The SockShop gap is significant (p < 0.001); on Online Boutique, margins over NSigma and RCG are not significant at this sample size.Source: Table 3 · p. 24, §G.5 · p. 24
  • Packet loss is difficult for RCA-DCM on both datasets, with top-1 accuracy 0.76 on SockShop and 0.44 on Online Boutique.The authors attribute the difficulty to intermittent perturbations producing a small mechanism shift relative to normal traffic variation.Source: §G.5 · p. 24
  • RCA-DCM ranks first on both benchmarks despite receiving only a confounded sink, while CIRCA and RCG receive the true call graph.The sink plus shared latent avoids asserting that the other services are mutually independent.Source: §G.5 · pp. 23–24

G.6 COMPUTATIONAL COMPLEXITY

  • Parallel execution reduces the stated example’s cost from 11,000c sequentially to 2000c, a 5.5× speedup.Candidate-specific models are independent after the normal DCM is trained; practical speedup is subject to parallelization overhead and memory constraints.Source: §G.6 · p. 25
  • 102× and 103–104×: DCM is slower than RCD and BARO, respectively, in the reported synthetic setting.Runtime rises from about 9 s at N = 100 to about 41 s at N = 1000 and 2–3 min at Ns = 2000, Na = 1000; BARO and RCD remain sub-second.Source: §G.6 · p. 25, Table 4 · p. 25
  • The authors frame DCM-RCA as an accuracy–compute trade-off: it improves accuracy under latent confounding, while faster baselines suit cases where raw speed is the priority.They do not provide matching closed-form complexity for BARO, RCD, and CIRCA.Source: §G.6 · p. 25

H REPRODUCIBILITY STATEMENT

The reproducibility statement points readers to the paper’s experimental protocols, implementation details, and code. It also describes the latent-noise and variable-generation steps used by the algorithm.

H REPRODUCIBILITY STATEMENT

  • Experimental protocols and dataset, graph, anomaly, metric, baseline, and training details are identified across the main text and Appendix G.The statement directs readers to Appendix C for assumptions and Appendices D–F for proofs.Source: H REPRODUCIBILITY STATEMENT · p. 25
  • The algorithm samples shared noise for each latent confounder, assigns it to the confounder’s two observed children, then generates observed variables in graph order.Each variable combines exogenous noise, assigned confounding noise, and generated parent values.Source: H REPRODUCIBILITY STATEMENT · p. 26
  • Code and instructions for reproducing the reported experiments are available in the project repository.The reported results use repeated runs or multiple injected anomaly datasets where applicable.Source: H REPRODUCIBILITY STATEMENT · p. 26
Loading 2609.36771v1…