EvoCause: LLM-Guided Evolution of Causal Graphs for Root Cause Analysis

# EvoCause: LLM-Guided Evolution of Causal Graphs for Root Cause Analysis
Source: [https://arxiv.org/html/2607.27290](https://arxiv.org/html/2607.27290)
Lei Zan1, Keli Zhang1, Shifeng Xie1, Jiale Zheng1, Zehao Xiao1, Zhiwei Dong1, Ke Zhang1, Ruichu Cai2, Malik Tiomoko1, Lujia Pan1

###### Abstract

Modern telecommunication, cloud, and microservice systems emit correlated alarm cascades when components fail\. Root cause analysis \(RCA\) aims to identify the small set of alarms that initiate each cascade\. A common approach learns a causal graph from observational logs and predicts all zero\-in\-degree alarms in each incident\-induced subgraph\. However, the learned graph remains fixed and cannot benefit from expert diagnoses of historical incidents\. We close this loop withEvoCause\. Expert labels constrain which alarms should be source nodes but do not specify the edge edits needed to satisfy those constraints\. EvoCause uses a large language model \(LLM\) to propose semantically plausible graph edits, while deterministic code validates node identities and acyclicity and retains the best graph on a labeled alignment set\. At test time, the refined graph alone produces transparent predictions without an LLM call\. We also release TeleRCA, an expert\-annotated benchmark from a production telecommunication network containing485,681485\{,\}681alarm events spanning194194alarm types over5,6215\{,\}621resources\. On synthetic data, EvoCause initialized with the PC causal discovery algorithm outperforms the unrefined PC baseline, raising Node F1, Case EM, and Graph F1 by11\.5911\.59,9\.409\.40, and4\.594\.59percentage points, respectively, while reducing nSHD by0\.23790\.2379\. On TeleRCA, replacing human\-readable alarm titles with anonymous identifiers lowers Node F1 and Case EM by6\.126\.12and8\.048\.04percentage points, respectively, indicating that alarm\-name information contributes to graph refinement\.

## 1Introduction

Modern telecommunication, cloud, and microservice systems comprise many tightly coupled components, so a single fault can trigger a cascade of correlated alarms, known as an “alert storm”\(Zhaoet al\.[2020](https://arxiv.org/html/2607.27290#bib.bib27)\)\. In this context, root cause analysis \(RCA\) is the task of identifying, among these alarms, the smallest set of actionable events whose remediation actually resolves the incident\(Assaadet al\.[2023](https://arxiv.org/html/2607.27290#bib.bib34)\)\. Rapid diagnosis is critical because major outages can disrupt many dependent services\(O’Brien and Bajak[2021](https://arxiv.org/html/2607.27290#bib.bib19)\)\.

A common causal approach represents alarm types and their triggering relations as a directed acyclic graph \(DAG\) and predicts all zero\-in\-degree alarms in the subgraph induced by each incident\. This framing provides traceable predictions and generalizes across incidents by encoding triggering relations rather than memorized cases\.

Constructing such a graph manually is impractical at scale, so causal discovery algorithms learn it from observational data\(Assaadet al\.[2022](https://arxiv.org/html/2607.27290#bib.bib23); Spirteset al\.[2000](https://arxiv.org/html/2607.27290#bib.bib22)\)\. However, their assumptions and dependence on clean data can produce spurious or missing edges in production alarm streams\(Aït\-Bachiret al\.[2023](https://arxiv.org/html/2607.27290#bib.bib26)\)\.

Crucially, existing methods ignore a complementary source of information that could correct these structural errors, namely the historical incident logs curated by Site Reliability Engineering \(SRE\) teams, which pair observed alarm sequences with expert\-labeled root causes\. These diagnostic labels are sparse and expensive to obtain\. More importantly, they provide task\-level constraints rather than direct edge supervision: they can rule out graphs whose incident\-induced source nodes disagree with expert diagnoses, but they generally do not identify a unique ground\-truth DAG\.

This feedback is indirect and underdetermined because expert labels specify which alarms should be sources but not which edge additions, removals, or reversals should enforce them without degrading predictions for overlapping incidents\. Language models are useful because they can jointly interpret constraints from multiple incidents, the current graph, optimization history, and, when available, information from alarm titles\. We therefore proposeEvoCause\(Evolve Causal Graph\), which uses an LLM to rank a small set of semantically plausible edits from this combinatorial space rather than to predict the root cause directly\. Deterministic procedures validate every edit, reject cyclic candidates, and retain the graph with the best alignment\-set performance\. The graph is the only optimized state, whereas its derived topological order is used only as prompt context rather than as a prediction rule\. We evaluate the contribution of alarm\-title information on TeleRCA by replacing only the titles supplied to the LLM with fixed anonymous identifiers while preserving the graph structure and incident data\. Our contributions are summarized as follows:

- •On the methodological side, we formulate incident\-level expert feedback as*source\-node constraints*on incident\-induced subgraphs and characterize the corresponding set of root\-cause\-consistent causal graphs\. Based on this formulation, we proposeEvoCause, a discovery\-agnostic causal graph refinement framework that integrates LLM\-guided semantic graph editing with deterministic structural validation and supervision\-driven graph selection\. EvoCause can refine graphs produced by different causal discovery algorithms without modifying their internal learning procedures, while ensuring that the resulting graphs remain structurally valid and consistent with expert RCA annotations\.
- •On the data side, we releaseTeleRCA, a large\-scale, expert\-labeled RCA benchmark derived from a real\-world production telecommunication network\. The dataset comprises10,92210\{,\}922incidents,485,681485\{,\}681alarm events, and194194alarm types across thousands of network resources\. Its combination of production alarm sequences and incident\-level expert root\-cause annotations provides a complementary testbed for advancing and evaluating event\-sequence\-based RCA methods\.
- •On the experimental side, we evaluate both RCA \(Node F1 and Case EM\) and graph reconstruction \(Graph F1 and nSHD\) on ten synthetic DAGs, together with RCA performance on TeleRCA\. EvoCause improves all three discovery backbones\. A controlled name\-anonymization ablation on TeleRCA evaluates the contribution of human\-readable alarm\-title information, while additional backbone comparisons on synthetic data assess sensitivity to the choice of LLM\.

## 2Related Work

#### Causal graphs and expert feedback\.

Observational data generally identify a causal DAG only up to a Markov equivalence class under some standard assumptions\. A completed partially directed acyclic graph \(CPDAG\) represents this class\. Directed edges are shared by all compatible DAGs, while undirected edges remain ambiguous\(Chickering[2002](https://arxiv.org/html/2607.27290#bib.bib35)\)\. Consistent edge\-orientation background knowledge can orient some ambiguous edges and narrow the class\(Fanget al\.[2025](https://arxiv.org/html/2607.27290#bib.bib29)\)\. Propagating all implied orientations yields a maximally oriented partially directed acyclic graph \(MPDAG\), which represents the DAGs consistent with both the data and the background knowledge\(Perković[2020](https://arxiv.org/html/2607.27290#bib.bib36); Guo and Perković[2022](https://arxiv.org/html/2607.27290#bib.bib28)\)\. Expert root\-cause labels instead constrain source sets in incident\-induced subgraphs and may require skeleton changes, so EvoCause searches a root\-cause\-consistent graph set that can span multiple equivalence classes\. Interventional equivalence would apply only if incidents were known interventions\(Hauser and Bühlmann[2012](https://arxiv.org/html/2607.27290#bib.bib30)\)\. In telecommunication RCA,Zhanget al\.\([2021](https://arxiv.org/html/2607.27290#bib.bib2)\)combine Hawkes\-process discovery, conditional\-independence tests, propagation embeddings, and influence maximization\. CCCM\(Zhanget al\.[2024](https://arxiv.org/html/2607.27290#bib.bib3)\)introduces cluster\-aware discovery for base\-station alarms, while TTCTH\(Liet al\.[2025](https://arxiv.org/html/2607.27290#bib.bib6)\)combines topological–temporal representation learning with a Hawkes\-process objective\. For microservices, CIRCA\(Ikramet al\.[2022](https://arxiv.org/html/2607.27290#bib.bib7)\)treats failures as interventions, RUN\(Linet al\.[2024](https://arxiv.org/html/2607.27290#bib.bib8)\)combines neural Granger causality with contrastive learning, and CausIL\(Chakrabortyet al\.[2023](https://arxiv.org/html/2607.27290#bib.bib9)\)incorporates domain knowledge into instance\-level causal graphs\. For threshold\-based IT systems,Zanet al\.\([2024](https://arxiv.org/html/2607.27290#bib.bib33)\)combine offline causal discovery with online subgraph traversal\. APGNN\(Jiang and Bai[2023](https://arxiv.org/html/2607.27290#bib.bib4)\), Chain\-of\-Event\(Yaoet al\.[2024](https://arxiv.org/html/2607.27290#bib.bib11)\), and Groot\(Wanget al\.[2021](https://arxiv.org/html/2607.27290#bib.bib12)\)construct event or alarm graphs for diagnosis using learned associations, interpretable edge parameters, or operator rules\. These methods provide graph\-learning and localization mechanisms but generally do not repeatedly revise an alarm\-type DAG using accumulated expert root sets\. HRLHF\(Wanget al\.[2023](https://arxiv.org/html/2607.27290#bib.bib25)\)does query engineers during dependency\-graph discovery, whereas EvoCause uses previously labeled incidents as an offline task signal for refining a graph produced by any discovery backbone\.

#### LLM\-based RCA and graph refinement\.

LLM\-based RCA systems have been studied for recommending root causes and mitigations from cloud\-incident text\(Ahmedet al\.[2023](https://arxiv.org/html/2607.27290#bib.bib13)\)\. RCACopilot\(Chenet al\.[2024](https://arxiv.org/html/2607.27290#bib.bib14)\)combines incident\-specific diagnostic collection with classification and explanation\. RCAgent\(Wanget al\.[2024](https://arxiv.org/html/2607.27290#bib.bib15)\)and ReAct\-based systems\(Royet al\.[2024](https://arxiv.org/html/2607.27290#bib.bib16)\)use tools and retrieval, while OpenRCA\(Xuet al\.[2025](https://arxiv.org/html/2607.27290#bib.bib5)\)and Flow\-of\-Action\(Peiet al\.[2025](https://arxiv.org/html/2607.27290#bib.bib17)\)provide agent\-oriented evaluation or procedure\-constrained diagnosis\. These approaches mainly predict, explain, or plan actions for an individual incident, so their outputs need not update a shared causal model\. Cloud Atlas\(Xieet al\.[2024](https://arxiv.org/html/2607.27290#bib.bib18)\)is closer to reusable graph construction because it synthesizes causal graphs from documentation, telemetry, and deployment feedback and then validates them with data\. Outside RCA, CAMA refines a mathematical causal graph using question\-answer feedback\(Zanet al\.[2026](https://arxiv.org/html/2607.27290#bib.bib21)\)\. EvoCause instead refines an externally discovered alarm graph using expert root\-cause labels and performs test\-time inference with the refined graph alone\. The LLM proposes semantic candidates, while deterministic procedures validate node identities and acyclicity, select the best graph, and perform all test\-time inference\.

#### Datasets\.

The telecom data used byZhanget al\.\([2021](https://arxiv.org/html/2607.27290#bib.bib2)\)provide root\-cause labels for 6,000 sampled alarm transactions, with causal\-edge annotations covering 15 of 78 alarm types\. THPs\(Caiet al\.[2024](https://arxiv.org/html/2607.27290#bib.bib24)\)evaluates event\-sequence structure learning rather than incident\-level root localization\. OpenRCA contains 335 software failures and more than 68 GB of logs, metrics, and traces\(Xuet al\.[2025](https://arxiv.org/html/2607.27290#bib.bib5)\)\. In comparison, TeleRCA targets alarm\-sequence RCA and provides expert root\-cause annotations for 10,922 production incidents\. It does not provide a ground\-truth propagation graph, so we use it to evaluate RCA rather than exact graph reconstruction\.

## 3EvoCause

This section formulates RCA on alarm cascades and presents EvoCause, which has learning and inference stages\. Section[3\.1](https://arxiv.org/html/2607.27290#S3.SS1)defines the problem and assumptions, Section[3\.2](https://arxiv.org/html/2607.27290#S3.SS2)analyzes identifiability under root\-cause feedback, Section[3\.3](https://arxiv.org/html/2607.27290#S3.SS3)summarizes the framework, Section[3\.4](https://arxiv.org/html/2607.27290#S3.SS4)describes graph construction and label\-feedback alignment, and Section[3\.5](https://arxiv.org/html/2607.27290#S3.SS5)explains root cause inference\.

### 3\.1Problem Setup

#### Dataset Description\.

We consider a telecommunication network that generates alarms from a finite set of alarm types, denoted by𝐀\\mathbf\{A\}\. The dataset containsmmincident sequences,𝒮=\{𝐬i\}i=1m\\mathcal\{S\}=\\\{\\mathbf\{s\}\_\{i\}\\\}\_\{i=1\}^\{m\}, collected over a global observation window𝐓\\mathbf\{T\}\. Each incident sequence𝐬i\\mathbf\{s\}\_\{i\}corresponds to a single incident and is represented as

𝐬i=\{\(aj,tj,lj\)\}j=1ni\.\\mathbf\{s\}\_\{i\}=\\left\\\{\(a\_\{j\},t\_\{j\},l\_\{j\}\)\\right\\\}\_\{j=1\}^\{n\_\{i\}\}\.\(1\)wherenin\_\{i\}denotes the number of alarm events in incident𝐬i\\mathbf\{s\}\_\{i\}\. Each triplet represents one alarm event:aj∈𝐀a\_\{j\}\\in\\mathbf\{A\}represents the alarm type,tj∈𝐓it\_\{j\}\\in\\mathbf\{T\}\_\{i\}represents its timestamp, andlj∈\{0,1\}l\_\{j\}\\in\\\{0,1\\\}is an expert\-provided annotation indicating whether the event is a root cause of the corresponding incident\. Specifically,lj=1l\_\{j\}=1indicates a root\-cause event, whereaslj=0l\_\{j\}=0indicates a non\-root\-cause event\. The corresponding incident\-level expert root set isyi=\{aj:\(aj,tj,lj\)∈𝐬i,lj=1\}y\_\{i\}=\\\{a\_\{j\}:\(a\_\{j\},t\_\{j\},l\_\{j\}\)\\in\\mathbf\{s\}\_\{i\},\\ l\_\{j\}=1\\\}, where repeated occurrences of the same alarm type are included only once\. We further assume that the triggering relations among alarm types in𝐀\\mathbf\{A\}remain invariant throughout the observation window\.

#### Alarm propagation graph\.

We represent the triggering relations among the alarm types𝐀\\mathbf\{A\}with a directed acyclic graph𝒢=\(𝐀,𝐄\)\\mathcal\{G\}=\(\\mathbf\{A\},\\mathbf\{E\}\), which we call an*alarm propagation graph*\(APG\)\. Its nodes are alarm types, and an edge\(ai,aj\)∈𝐄\(a\_\{i\},a\_\{j\}\)\\in\\mathbf\{E\}means that an occurrence ofaia\_\{i\}may triggeraja\_\{j\}\. For an incident, RCA restricts𝒢\\mathcal\{G\}to the observed alarm types and predicts every zero\-in\-degree node in the induced subgraph as a root cause\. The graph is the only persistent structural state\. When a linear representation is useful for prompting, we deterministically derive a topological orderO​\(𝒢\)=TopologicalOrder​\(𝒢\)O\(\\mathcal\{G\}\)=\\textsc\{TopologicalOrder\}\(\\mathcal\{G\}\), in whichaia\_\{i\}precedesaja\_\{j\}for every edge\(ai,aj\)∈𝐄\(a\_\{i\},a\_\{j\}\)\\in\\mathbf\{E\}\. This order provides a compact linear view of the graph for the LLM\. It is derived from𝒢\\mathcal\{G\}and is neither optimized nor used for root\-cause prediction\.

#### Incident\-level source operator\.

LetVi⊆𝐀V\_\{i\}\\subseteq\\mathbf\{A\}denote the distinct alarm types observed in incident𝐬i\\mathbf\{s\}\_\{i\}\. For a candidate APG𝒢\\mathcal\{G\}, define

Src𝒢⁡\(Vi\)=\{v∈Vi:Pa𝒢⁡\(v\)∩Vi=∅\}\.\\operatorname\{Src\}\_\{\\mathcal\{G\}\}\(V\_\{i\}\)=\\left\\\{v\\in V\_\{i\}:\\operatorname\{Pa\}\_\{\\mathcal\{G\}\}\(v\)\\cap V\_\{i\}=\\varnothing\\right\\\}\.\(2\)
EvoCause predicts the complete setSrc𝒢⁡\(Vi\)\\operatorname\{Src\}\_\{\\mathcal\{G\}\}\(V\_\{i\}\)and neither ranks these nodes nor uses the ground\-truth number of roots\.

#### Learning Objective\.

A conventional causal approach obtains such a graph from the statistical regularities of the observed alarm events alone, without using the expert labels\. A causal discovery algorithmCausalDiscovery​\(⋅\)\\textsc\{CausalDiscovery\}\(\\cdot\)maps the alarm types and their timestamps to a DAG,

𝒢^=CausalDiscovery​\(\{\(aj,tj\)\}\),\\hat\{\\mathcal\{G\}\}=\\textsc\{CausalDiscovery\}\\big\(\\\{\(a\_\{j\},t\_\{j\}\)\\\}\\big\),\(3\)and root causes are then localized by a procedureh​\(⋅\)h\(\\cdot\)that assigns a binary label to every event,

\[l^1,…,l^ni\]=h​\(𝒢^,\{\(aj,tj\)\}j=1ni\)\.\\big\[\\hat\{l\}\_\{1\},\\dots,\\hat\{l\}\_\{n\_\{i\}\}\\big\]\\;=\\;h\\\!\\left\(\\hat\{\\mathcal\{G\}\},\\,\\\{\(a\_\{j\},t\_\{j\}\)\\\}\_\{j=1\}^\{n\_\{i\}\}\\right\)\.\(4\)In this pipeline, the expert labelsljl\_\{j\}never enter the construction of𝒢^\\hat\{\\mathcal\{G\}\}, because the graph is recovered from event statistics alone\.

The core objective is to use expert\-annotated incidents to refine the graph so that it recovers complete root sets more accurately\. We split the incidents into an offline training set𝒮off\\mathcal\{S\}\_\{\\mathrm\{off\}\}and a held\-out test set𝒮on\\mathcal\{S\}\_\{\\mathrm\{on\}\}\. For causal discovery, letπobs​\(𝐬i\)=\{\(aj,tj\)\}j=1ni\\pi\_\{\\mathrm\{obs\}\}\(\\mathbf\{s\}\_\{i\}\)=\\\{\(a\_\{j\},t\_\{j\}\)\\\}\_\{j=1\}^\{n\_\{i\}\}denote the label\-free projection of incident𝐬i\\mathbf\{s\}\_\{i\}, and define𝒟hist=\{πobs​\(𝐬i\):𝐬i∈𝒮off\}\\mathcal\{D\}\_\{\\mathrm\{hist\}\}=\\\{\\pi\_\{\\mathrm\{obs\}\}\(\\mathbf\{s\}\_\{i\}\):\\mathbf\{s\}\_\{i\}\\in\\mathcal\{S\}\_\{\\mathrm\{off\}\}\\\}\. The initial graph is learned from𝒟hist\\mathcal\{D\}\_\{\\mathrm\{hist\}\}, while the labeled alignment set𝒟align\\mathcal\{D\}\_\{\\mathrm\{align\}\}is used for graph refinement and model selection\. All candidate\-graph decisions use𝒟align\\mathcal\{D\}\_\{\\mathrm\{align\}\}, and𝒮on\\mathcal\{S\}\_\{\\mathrm\{on\}\}is evaluated only once after selection\. We select

𝒢∗=arg⁡max𝒢⁡𝔼\(𝐬i,yi\)∼𝒟align​\[𝟏​\{RCAEngine​\(𝐬i,𝒢\)=yi\}\],\\mathcal\{G\}^\{\*\}=\\arg\\max\_\{\\mathcal\{G\}\}\\mathbb\{E\}\_\{\(\\mathbf\{s\}\_\{i\},y\_\{i\}\)\\sim\\mathcal\{D\}\_\{\\mathrm\{align\}\}\}\\left\[\\mathbf\{1\}\\\{\\textsc\{RCAEngine\}\(\\mathbf\{s\}\_\{i\},\\mathcal\{G\}\)=y\_\{i\}\\\}\\right\],\(5\)whereyiy\_\{i\}is the complete expert root set and𝟏​\{⋅\}\\mathbf\{1\}\\\{\\cdot\\\}is the indicator function\.

#### Root\-cause\-consistent graph set\.

Let𝒟L=\{\(Vi,yi\)\}i=1m\\mathcal\{D\}\_\{L\}=\\\{\(V\_\{i\},y\_\{i\}\)\\\}\_\{i=1\}^\{m\}denote a set of labeled incidents, whereyi⊆Viy\_\{i\}\\subseteq V\_\{i\}is the expert\-provided root set for incidentii\. We define the*root\-cause\-consistent*\(RCC\) graph set as

𝒞RCC​\(𝒟L\)=\{𝒢∈DAG⁡\(𝐀\):Src𝒢⁡\(Vi\)=yi,∀i\}\.\\mathcal\{C\}\_\{\\mathrm\{RCC\}\}\(\\mathcal\{D\}\_\{L\}\)=\\left\\\{\\mathcal\{G\}\\in\\operatorname\{DAG\}\(\\mathbf\{A\}\):\\operatorname\{Src\}\_\{\\mathcal\{G\}\}\(V\_\{i\}\)=y\_\{i\},\\ \\forall i\\right\\\}\.\(6\)More generally, two graphs are RCA\-equivalent on𝒟L\\mathcal\{D\}\_\{L\}if they produce the same source set for every labeled incident\. Unlike a Markov equivalence class, the RCC set may contain graphs with different skeletons and conditional\-independence structures\. When exact consistency cannot be achieved because of label noise, a restricted search space, or optimization limitations, we quantify inconsistency using the empirical disagreement

ℒRCA​\(𝒢,𝒟L\)=1m​∑i=1m𝟏​\{Src𝒢⁡\(Vi\)≠yi\}\.\\mathcal\{L\}\_\{\\mathrm\{RCA\}\}\(\\mathcal\{G\},\\mathcal\{D\}\_\{L\}\)=\\frac\{1\}\{m\}\\sum\_\{i=1\}^\{m\}\\mathbf\{1\}\\\!\\left\\\{\\operatorname\{Src\}\_\{\\mathcal\{G\}\}\(V\_\{i\}\)\\neq y\_\{i\}\\right\\\}\.\(7\)The objective in \([5](https://arxiv.org/html/2607.27290#S3.E5)\) then selects the visited graph with the smallest empirical disagreement, using Node F1 to break ties\.

#### Assumptions\.

Let𝒦\\mathcal\{K\}denote the resource–time contexts and let𝒢\(c\)\\mathcal\{G\}^\{\(c\)\}be the alarm\-type causal graph in contextcc\.

###### Assumption 1\(Causal consistency\)

A shared DAG𝒢†\\mathcal\{G\}^\{\\dagger\}satisfies𝒢\(c\)=𝒢†\\mathcal\{G\}^\{\(c\)\}=\\mathcal\{G\}^\{\\dagger\}for everyc∈𝒦c\\in\\mathcal\{K\}, corresponding to causal stationarity across contexts\(Assaadet al\.[2022](https://arxiv.org/html/2607.27290#bib.bib23)\)\.

###### Assumption 2\(Causal sufficiency\)

No latent alarm event is a common cause of two observed alarm types\(Spirteset al\.[2000](https://arxiv.org/html/2607.27290#bib.bib22); Assaadet al\.[2022](https://arxiv.org/html/2607.27290#bib.bib23)\)\.

###### Assumption 3\(Expert\-label consistency\)

Every alignment label satisfiesyi=Src𝒢†⁡\(Vi\)y\_\{i\}=\\operatorname\{Src\}\_\{\\mathcal\{G\}^\{\\dagger\}\}\(V\_\{i\}\)\.

These assumptions make the feedback well defined but do not make the RCC set unique\. Violations of Assumptions 1 or 2 make the APG a task\-effective summary rather than the unique data\-generating graph\. Let𝒟~L=\{\(Vi,y~i\)\}i=1m\\widetilde\{\\mathcal\{D\}\}\_\{L\}=\\\{\(V\_\{i\},\\widetilde\{y\}\_\{i\}\)\\\}\_\{i=1\}^\{m\}denote a corrupted version of𝒟L=\{\(Vi,yi\)\}i=1m\\mathcal\{D\}\_\{L\}=\\\{\(V\_\{i\},y\_\{i\}\)\\\}\_\{i=1\}^\{m\}, wherey~i≠yi\\widetilde\{y\}\_\{i\}\\neq y\_\{i\}for at mostqqincidents\. Then, for any fixed graph,

\|ℒRCA​\(𝒢,𝒟~L\)−ℒRCA​\(𝒢,𝒟L\)\|≤qm\.\\left\|\\mathcal\{L\}\_\{\\mathrm\{RCA\}\}\(\\mathcal\{G\},\\widetilde\{\\mathcal\{D\}\}\_\{L\}\)\-\\mathcal\{L\}\_\{\\mathrm\{RCA\}\}\(\\mathcal\{G\},\\mathcal\{D\}\_\{L\}\)\\right\|\\leq\\frac\{q\}\{m\}\.\(8\)
Each proposal considers a batch of incidents, and candidate graphs are scored on the full alignment set\. A few isolated errors therefore have bounded direct influence, although systematic errors can still alter the proposal path and selected graph\. EvoCause consequently targets an RCA\-effective graph with low empirical disagreement rather than unique DAG recovery\.

### 3\.2Identifiability under Root\-Cause Feedback

#### Why root labels do not generally identify one DAG\.

For every labeled rootr∈yir\\in y\_\{i\}, consistency requiresPa𝒢⁡\(r\)∩Vi=∅\\operatorname\{Pa\}\_\{\\mathcal\{G\}\}\(r\)\\cap V\_\{i\}=\\varnothing\. For every labeled non\-rootv∈Vi∖yiv\\in V\_\{i\}\\setminus y\_\{i\}, however, it only requiresPa𝒢⁡\(v\)∩Vi≠∅\\operatorname\{Pa\}\_\{\\mathcal\{G\}\}\(v\)\\cap V\_\{i\}\\neq\\varnothing\. The latter is a disjunctive constraint: at least one observed parent must exist, but the label does not identify which parent is responsible\. Root\-cause feedback therefore generally leaves multiple admissible DAGs\.

#### Proposition 1 \(Monotone refinement\)\.

Let𝒞m\\mathcal\{C\}\_\{m\}be the RCC set induced by the firstmmlabeled incidents\. Then

𝒞m\+1⊆𝒞m\.\\mathcal\{C\}\_\{m\+1\}\\subseteq\\mathcal\{C\}\_\{m\}\.\(9\)Indeed, the\(m\+1\)\(m\+1\)\-st label adds one source\-set constraint, giving𝒞m\+1=𝒞m∩\{𝒢:Src𝒢⁡\(Vm\+1\)=ym\+1\}\\mathcal\{C\}\_\{m\+1\}=\\mathcal\{C\}\_\{m\}\\cap\\\{\\mathcal\{G\}:\\operatorname\{Src\}\_\{\\mathcal\{G\}\}\(V\_\{m\+1\}\)=y\_\{m\+1\}\\\}\. Thus additional consistent feedback can only eliminate candidate graphs\.

#### Proposition 2 \(Training\-set RCA invariance\)\.

All graphs in𝒞RCC​\(𝒟L\)\\mathcal\{C\}\_\{\\mathrm\{RCC\}\}\(\\mathcal\{D\}\_\{L\}\)return the same expert root set on every incident in𝒟L\\mathcal\{D\}\_\{L\}, although they may disagree on unseen incidents and may contain different edge sets\. Consequently, training\-label consistency alone does not determine which admissible graph will generalize best\.

#### A sufficient condition for uniqueness\.

Suppose that the true APG is a DAG, its undirected skeleton is known, expert labels are noiseless, and*root\-separating coverage*holds: for every adjacency\{u,v\}\\\{u,v\\\}in the skeleton, the labeled set contains an edge\-isolating incident whose relevant alarm\-type set isVi=\{u,v\}V\_\{i\}=\\\{u,v\\\}\. For such an incident, the root set is\{u\}\\\{u\\\}if and only if the edge isu→vu\\rightarrow v, and it is\{v\}\\\{v\\\}if and only if the edge isv→uv\\rightarrow u\. Every skeleton edge is therefore uniquely oriented, so the RCC set restricted to the known skeleton is a singleton\. This condition is sufficient but intentionally strong and need not hold in TeleRCA\. Without it, EvoCause targets task\-level identification by selecting an RCA\-effective representative rather than claiming recovery of the unique data\-generating DAG\.

### 3\.3Overview of EvoCause

EvoCause comprises a*learning stage*and an*inference stage*\(Figure[1](https://arxiv.org/html/2607.27290#S3.F1)\)\. In the learning stage, EvoCause first builds an initial alarm propagation graph𝒢0\\mathcal\{G\}\_\{0\}from historical alarm sequences using off\-the\-shelf causal discovery, and then refines it by aligning it with the downstream RCA task through LLM\-based label feedback\. In the inference stage, a new incident is resolved by running a transparent graph\-based procedure on the refined graph𝒢∗\\mathcal\{G\}^\{\*\}\.

![Refer to caption](https://arxiv.org/html/2607.27290v1/x1.png)Figure 1:Overview of EvoCause\. Stage I learns an initial alarm propagation graph𝒢0\\mathcal\{G\}\_\{0\}from historical alarm sequences\. In Stage II, the current graph predicts the complete zero\-in\-degree source set for each expert\-labeled incident in a batch\. Prediction–label mismatches guide the LLM to propose edge additions, removals, or reversals\. Deterministic code validates node identities and acyclicity, applies valid edits, and retains the graph with the best performance on the alignment set\. Test\-time RCA uses only the selected graph\.
### 3\.4Learning Stage

The learning stage has two components, namely \(1\) constructing an initial alarm propagation graph from historical sequences, and \(2\) aligning it with the RCA task through LLM\-based label feedback\.

#### Stage I: Initial APG construction\.

The first stage constructs an initial graph from the label\-free historical alarm sequences𝒟hist\\mathcal\{D\}\_\{\\mathrm\{hist\}\}:

𝒢0=CausalDiscovery​\(𝒟hist\)\.\\mathcal\{G\}\_\{0\}=\\textsc\{CausalDiscovery\}\(\\mathcal\{D\}\_\{\\mathrm\{hist\}\}\)\.\(10\)HereCausalDiscovery​\(⋅\)\\textsc\{CausalDiscovery\}\(\\cdot\)is any algorithm that returns a DAG over alarm types\. We instantiate it with PC\(Spirteset al\.[2000](https://arxiv.org/html/2607.27290#bib.bib22)\), NOTEARS\(Zhenget al\.[2018](https://arxiv.org/html/2607.27290#bib.bib37)\), and THPs\(Caiet al\.[2024](https://arxiv.org/html/2607.27290#bib.bib24)\), which have different inductive biases\. EvoCause treats discovery as a black box\. At each refinement round, a deterministic topological orderO​\(𝒢\)=TopologicalOrder​\(𝒢\)O\(\\mathcal\{G\}\)=\\textsc\{TopologicalOrder\}\(\\mathcal\{G\}\)is derived from the current DAG solely to give the LLM a compact linearization of causal flow\. It is not a second model state, and root\-cause prediction depends only on zero in\-degree in the incident\-induced subgraph\.

#### Stage II: APG alignment via label feedback\.

The second stage refines𝒢0\\mathcal\{G\}\_\{0\}into𝒢∗\\mathcal\{G\}^\{\*\}using labeled alignment cases𝒟align=\{\(𝐬i,yi\)\}i=1N\\mathcal\{D\}\_\{\\mathrm\{align\}\}=\\\{\(\\mathbf\{s\}\_\{i\},y\_\{i\}\)\\\}\_\{i=1\}^\{N\}, where𝐬i\\mathbf\{s\}\_\{i\}is an incident sequence andyi⊆Viy\_\{i\}\\subseteq V\_\{i\}is its complete expert root set\. Following the objective in \([5](https://arxiv.org/html/2607.27290#S3.E5)\), EvoCause searches for a graph that maximizes Case EM on the alignment set\.

To optimize \([5](https://arxiv.org/html/2607.27290#S3.E5)\), we adopt a batch\-based iterative optimization procedure overNeN\_\{e\}epochs\. At the start of epochee,𝒟align\\mathcal\{D\}\_\{\\mathrm\{align\}\}is randomly permuted to obtain𝒟align\(e\)\\mathcal\{D\}\_\{\\mathrm\{align\}\}^\{\(e\)\}and then partitioned into batches of sizeNbN\_\{b\}\. Each batch triggers one refinement round with four steps\.

*Step 1: Batch processing\.*A batch𝐁k\\mathbf\{B\}\_\{k\}ofNbN\_\{b\}labeled cases is drawn from the current epoch’s partition\. Batching amortizes the cost of LLM invocation and allows each refinement round to aggregate feedback across multiple incidents, reducing sensitivity to any single case\.

*Step 2: Predict with the current graph\.*For every case\(𝐬i,yi\)∈𝐁k\(\\mathbf\{s\}\_\{i\},y\_\{i\}\)\\in\\mathbf\{B\}\_\{k\}we run a graph\-based RCA procedure on the current graph,

y^i=RCAEngine​\(𝐬i,𝒢\),\\hat\{y\}\_\{i\}=\\textsc\{RCAEngine\}\(\\mathbf\{s\}\_\{i\},\\mathcal\{G\}\),\(11\)which restricts𝒢\\mathcal\{G\}to the alarm types observed in𝐬i\\mathbf\{s\}\_\{i\}and returns all zero\-in\-degree nodes of the incident\-induced subgraph\. The complete set of such source alarm types is predicted, and the ground\-truth number of roots is never provided to the procedure\. This yields a per\-case triple\(𝐬i,y^i,yi\)\(\\mathbf\{s\}\_\{i\},\\hat\{y\}\_\{i\},y\_\{i\}\)whose mismatches are the discrepancies that the next step must explain\.

*Step 3: LLM proposes graph edits\.*We aggregate the per\-case triples into a batch\-level evidence set

𝐄=\{\(𝐬i,y^i,yi\)\}i∈𝐁k,\\mathbf\{E\}=\\\{\(\\mathbf\{s\}\_\{i\},\\hat\{y\}\_\{i\},y\_\{i\}\)\\\}\_\{i\\in\\mathbf\{B\}\_\{k\}\},\(12\)and present𝐄\\mathbf\{E\}, together with the current graph𝒢\\mathcal\{G\}, its derived orderO​\(𝒢\)O\(\\mathcal\{G\}\), and an optimization history𝐇\\mathbf\{H\}\(defined below\), to a large language modelℳ\\mathcal\{M\}through an update promptpup\_\{u\}\. The LLM proposes only targeted graph edits

Δ​𝒢=ℳ​\(𝒢,O​\(𝒢\),𝐄,𝐇,pu\),\\Delta\\mathcal\{G\}\\;=\\;\\mathcal\{M\}\\\!\\left\(\\mathcal\{G\},O\(\\mathcal\{G\}\),\\mathbf\{E\},\\mathbf\{H\},p\_\{u\}\\right\),\(13\)whereΔ​𝒢\\Delta\\mathcal\{G\}is a set of directed\-edge edits using the operations\{*add*,*remove*,*reverse*\}\\\{\\emph\{add\},\\emph\{remove\},\\emph\{reverse\}\\\}\. The LLM response contains only graph updates\. The derived topological orderO​\(𝒢\)O\(\\mathcal\{G\}\)can neither be edited nor returned\.

The LLM is a proposal model, not a causal oracle or a constraint solver\. A labeled source\-set error creates a disjunctive constraint: several edits may repair the current incident, yet those edits can have different effects on other incidents that share alarm types\. Exhaustively testing all directed additions, removals, and reversals is quadratic in the number of alarm types per round before multi\-edit combinations are considered, while a purely random proposer ignores both alarm semantics and cross\-incident evidence\. EvoCause uses the LLM to compress this search into a small set of proposals by jointly interpreting human\-readable alarm identities, source\-set mismatches, the current graph, its derived order, and prior outcomes\. Structural validity and empirical utility remain determined by code and labeled data\. Meaningful node names are not required because EvoCause can operate on arbitrary identifiers by interpreting source\-set mismatches, graph structure, derived order, and prior outcomes\. Human\-readable alarm titles provide an additional signal when available\.

The optimization history retains the lastKℋK\_\{\\mathcal\{H\}\}rounds,

𝐇=\{\(𝒢o−1,So−1\),…,\(𝒢o−Kℋ,So−Kℋ\)\}\.\\mathbf\{H\}=\\big\\\{\(\\mathcal\{G\}\_\{o\-1\},S\_\{o\-1\}\),\\ldots,\(\\mathcal\{G\}\_\{o\-K\_\{\\mathcal\{H\}\}\},S\_\{o\-K\_\{\\mathcal\{H\}\}\}\)\\big\\\}\.\(14\)
whereSo−1=\(Lo−1,Fo−1\)S\_\{o\-1\}=\(L\_\{o\-1\},F\_\{o\-1\}\)is the lexicographic score of graph𝒢o−1\\mathcal\{G\}\_\{o\-1\}on the full alignment set𝒟align\\mathcal\{D\}\_\{\\mathrm\{align\}\}\. Here,Lo−1L\_\{o\-1\}is Case EM andFo−1F\_\{o\-1\}is Node F1, which is used only to break ties\. Specifically,

Lo−1=1N​∑i=1N𝟏​\{RCAEngine​\(𝐬i,𝒢o−1\)=yi\}\.L\_\{o\-1\}=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\mathbf\{1\}\\\!\\left\\\{\\textsc\{RCAEngine\}\(\\mathbf\{s\}\_\{i\},\\mathcal\{G\}\_\{o\-1\}\)=y\_\{i\}\\right\\\}\.\(15\)Thus, model selection first maximizes exact root\-set recovery over the full alignment set and uses partial node\-level recovery only when two candidate graphs have equal Case EM\.

*Step 4: Validate and apply edits\.*The parser first checks that every operation is in\{*add*,*remove*,*reverse*\}\\\{\\emph\{add\},\\emph\{remove\},\\emph\{reverse\}\\\}and that both endpoints belong to𝐀\\mathbf\{A\}\. Valid edits are applied to obtain a tentative graph

𝒢′=ApplyGraphUpdates​\(𝒢,Δ​𝒢\)\.\\mathcal\{G\}^\{\\prime\}=\\textsc\{ApplyGraphUpdates\}\(\\mathcal\{G\},\\Delta\\mathcal\{G\}\)\.\(16\)The tentative graph is accepted if and only if𝒢′\\mathcal\{G\}^\{\\prime\}remains a DAG\. Otherwise, the complete proposed update is rejected and the current graph is retained\. Any topological order needed by the next prompt is then recomputed deterministically from the accepted graph, so no graph order synchronization state or compatibility check is required\.

These checks guarantee structural feasibility, not causal correctness\. The refinement loop may visit several structurally valid candidate graphs\. Following each round, EvoCause evaluates the current graph on the labeled alignment set and stores the graph with the highest Case EM, using Node F1 only as a tie\-breaker\.

*Termination\.*The four steps repeat across batches and epochs until either allNeN\_\{e\}epochs are processed or the round counter reaches the budgetNrN\_\{r\}\. To improve efficiency, the procedure also terminates early if the graph remains unchanged forcstopc\_\{\\mathrm\{stop\}\}consecutive batches\. The graph with the highest Case EM on the alignment set is returned as𝒢∗\\mathcal\{G\}^\{\*\}and used for all downstream RCA\. The full procedure is summarized in Appendix[A\.1](https://arxiv.org/html/2607.27290#A1.SS1)\.

### 3\.5Inference Stage

At test time, a new incident𝐬new∈𝒮on\\mathbf\{s\}\_\{\\mathrm\{new\}\}\\in\\mathcal\{S\}\_\{\\mathrm\{on\}\}is resolved using the refined graph𝒢∗\\mathcal\{G\}^\{\*\}alone\. The procedure identifies the alarm types present in𝐬new\\mathbf\{s\}\_\{\\mathrm\{new\}\}, restricts𝒢∗\\mathcal\{G\}^\{\*\}to the subgraph they induce, and returns the complete set of nodes whose in\-degree in this induced subgraph is zero\. These source alarm types constitute the predicted root\-cause set\. Formally,

y^new=RCAEngine​\(𝐬new,𝒢∗\)\.\\hat\{y\}\_\{\\mathrm\{new\}\}=\\textsc\{RCAEngine\}\(\\mathbf\{s\}\_\{\\mathrm\{new\}\},\\mathcal\{G\}^\{\*\}\)\.\(17\)This is the same procedure used to score candidate graphs during learning, so the criterion optimized offline is exactly the one applied online\. No LLM call is made at inference time\. Every prediction therefore traces back to specific edges in𝒢∗\\mathcal\{G\}^\{\*\}, and every such edge is attributable either to the initial discovery stage or to a recorded LLM graph edit during refinement, providing an audit trail that operators can inspect\. Expert labels are used only during offline alignment to score candidate graphs and construct mismatch evidence\. Their effect is retained in𝒢∗\\mathcal\{G\}^\{\*\}, so held\-out incidents require neither labels nor LLM calls\.

## 4Experiments

We evaluate EvoCause on synthetic networks with known causal graphs and on TeleRCA, an expert\-labeled production telecommunication dataset\. Synthetic experiments assess RCA, graph reconstruction, and backbone sensitivity using non\-semantic node identifiers, while TeleRCA evaluates RCA, robustness to causal\-discovery initialization, and the contribution of human\-readable alarm titles\.

### 4\.1Experimental Setup

For both datasets, we use non\-overlapping 80% training and 20% test splits\. Each initial graph is learned only from the training split\. Within that split, 10% of the incidents form the labeled alignment set used for graph refinement and model selection\. The held\-out test split is evaluated once after the best alignment\-set graph has been selected\.

#### Evaluation metrics\.

We evaluate root cause analysis on both datasets using Node F1 and Case EM\. Lety^i\\widehat\{y\}\_\{i\}andyiy\_\{i\}denote the predicted and true root cause sets for test incidentii, and letNNbe the number of test incidents\. Node F1 measures micro\-averaged node\-level overlap, while Case EM, where EM denotes exact match, measures incident\-level accuracy:

Node​F1=2​∑i=1N\|y^i∩yi\|∑i=1N\(\|y^i\|\+\|yi\|\),Case​EM=1N​∑i=1N𝟏​\[y^i=yi\]\.\\resizebox\{424\.94574pt\}\{\}\{$\\displaystyle\\mathrm\{Node\\ F1\}=\\frac\{2\\sum\_\{i=1\}^\{N\}\|\\widehat\{y\}\_\{i\}\\cap y\_\{i\}\|\}\{\\sum\_\{i=1\}^\{N\}\\left\(\|\\widehat\{y\}\_\{i\}\|\+\|y\_\{i\}\|\\right\)\},\\qquad\\mathrm\{Case\\ EM\}=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\mathbf\{1\}\\\!\\left\[\\widehat\{y\}\_\{i\}=y\_\{i\}\\right\]$\}\.\(18\)Node F1 gives partial credit for recovering part of the true root set, whereas Case EM counts an incident as correct only when the complete predicted and true sets are identical\. On synthetic data, the known ground\-truth graph also allows evaluation of graph reconstruction\. LetE^\\widehat\{E\}andEEdenote the estimated and true directed edge sets:

Graph​F1=2​\|E^∩E\|\|E^\|\+\|E\|,nSHD=SHD​\(G^,G\)\|E\|\.\\mathrm\{Graph\\ F1\}=\\frac\{2\|\\widehat\{E\}\\cap E\|\}\{\|\\widehat\{E\}\|\+\|E\|\},\\qquad\\mathrm\{nSHD\}=\\frac\{\\mathrm\{SHD\}\(\\widehat\{G\},G\)\}\{\|E\|\}\.\(19\)Graph F1 measures directed\-edge recovery\. Here,SHD​\(G^,G\)=Nadd\+Ndel\+Nrev\\mathrm\{SHD\}\(\\widehat\{G\},G\)=N\_\{\\mathrm\{add\}\}\+N\_\{\\mathrm\{del\}\}\+N\_\{\\mathrm\{rev\}\}, where the three terms are the minimum numbers of unit\-cost edge additions, deletions, and reversals required to transformG^\\widehat\{G\}intoGG\. Higher Node F1, Case EM, and Graph F1 are better, while lower nSHD is better\. Because TeleRCA has no ground\-truth propagation graph, graph\-reconstruction metrics are reported only on synthetic data\.

#### Baselines and controlled variants\.

Across both datasets, we compare unrefined graphs learned by PC, NOTEARS, and THPs with Chain\-of\-Event\(Yaoet al\.[2024](https://arxiv.org/html/2607.27290#bib.bib11)\), CCCM\(Zhanget al\.[2024](https://arxiv.org/html/2607.27290#bib.bib3)\), APGNN\(Jiang and Bai[2023](https://arxiv.org/html/2607.27290#bib.bib4)\), and RUN\(Linet al\.[2024](https://arxiv.org/html/2607.27290#bib.bib8)\), using the released default settings for the latter four methods\. For PC and NOTEARS, we follow the alarm\-transaction representation ofZhanget al\.\([2021](https://arxiv.org/html/2607.27290#bib.bib2)\)\. Random uses a DAG with matched node and edge counts on synthetic data and a random alarm ordering on TeleRCA\. EvoCause uses Qwen3\-32B with alignment fractionρ=0\.1\\rho=0\.1, batch sizeNb=20N\_\{b\}=20, epoch countNe=10N\_\{e\}=10, round budgetNr=500N\_\{r\}=500, history windowKℋ=5K\_\{\\mathcal\{H\}\}=5, and retry budgetNretry=3N\_\{\\mathrm\{retry\}\}=3per batch\. Hyperparameter robustness and label\-feedback efficiency are examined in Appendices[A\.5](https://arxiv.org/html/2607.27290#A1.SS5)and[A\.6](https://arxiv.org/html/2607.27290#A1.SS6), respectively\. On synthetic data, two Qwen3\-4B variants assess backbone sensitivity only\(Yanget al\.[2025](https://arxiv.org/html/2607.27290#bib.bib31)\)\. On TeleRCA, EvoCause\-PC \(Anonymous IDs\) replaces alarm titles with fixed anonymous identifiers while keeping all other settings unchanged to test the contribution of human\-readable titles\.

### 4\.2Synthetic Data

#### Dataset\.

Synthetic data allow evaluation against fully known graphs\. We generate ten independent Erdős–Rényi DAGs, each with 50 alarm\-type nodes and 70 directed edges before transitive reduction\. The reduction preserves all nodes but removes shortcut edges\. We retain 2,000 valid incidents per graph, with one to five root alarms per incident\. Each active edge generates one offspring event after an exponential delay whose edge\-specific mean is sampled once from\[30,300\]\[30,300\]seconds and fixed across incidents\. We report the mean and standard deviation across the ten graphs\. Because alarm types use numeric identifiers, these experiments evaluate structural refinement without alarm\-name semantics\.

Table 1:Synthetic\-data results on ten transitively reduced Erdős–Rényi DAGs\. Values are mean±\\pmstandard deviation across graph instances\. 32B, 4B\-Inst\., and 4B\-Think\. denote Qwen3\-32B, Qwen3\-4B\-Instruct\-2507, and Qwen3\-4B\-Thinking\-2507\. Full component and backbone analyses are reported in Appendices[A\.3](https://arxiv.org/html/2607.27290#A1.SS3)and[A\.4](https://arxiv.org/html/2607.27290#A1.SS4)\.
#### Analysis\.

Table[1](https://arxiv.org/html/2607.27290#S4.T1)shows that label\-feedback refinement improves RCA for all three initial discovery methods, so the benefit is not tied to the inductive bias of PC\. With PC initialization, EvoCause raises Node F1 and Case EM by11\.5911\.59and9\.409\.40percentage points, increases Graph F1 by4\.594\.59percentage points, and reduces nSHD by0\.23790\.2379\. RCA improves more strongly than complete edge recovery for NOTEARS and THPs, which is consistent with expert labels directly constraining incident\-level source sets but only indirectly constraining the complete edge set\. EvoCause\-PC gives the strongest joint RCA and graph\-reconstruction result, showing that refinement preserves the value of a strong initial graph\. Because synthetic nodes use arbitrary numeric identifiers, these improvements also show that EvoCause can exploit source\-set mismatches and graph context without relying on lexical information\. The backbone comparisons evaluate sensitivity to the choice of LLM and demonstrate that the framework can operate with different LLM backbones\.

### 4\.3Real\-World Telecommunication Data

#### Dataset\.

TeleRCA contains10,92210\{,\}922incidents comprising485,681485\{,\}681alarm events across119,039119\{,\}039timestamps,5,6215\{,\}621network resources, and194194alarm types, collected from a production telecommunication network in Jakarta, Indonesia, between March and July 2025\. Potentially sensitive information was anonymized to meet privacy and publication requirements\. The incident\-file structure and field definitions are provided in Appendix[A\.2](https://arxiv.org/html/2607.27290#A1.SS2)\.

Table 2:RCA performance on TeleRCA\. Values are mean±\\pmstandard deviation over five runs where available\. EvoCause\-PC \(Anonymous IDs\) replaces the original alarm titles supplied to the LLM with fixed anonymous identifiers\. All EvoCause variants use Qwen3\-32B, whereas deterministic discovery baselines are single runs\.
#### Analysis\.

Table[2](https://arxiv.org/html/2607.27290#S4.T2)shows that EvoCause reaches nearly identical RCA performance from PC, NOTEARS, and THPs despite substantial differences among their unrefined results\. With PC initialization, EvoCause improves Node F1 from65\.18%65\.18\\%to92\.58%92\.58\\%and Case EM from53\.98%53\.98\\%to89\.61%89\.61\\%, gains of27\.4027\.40and35\.6335\.63percentage points\. This convergence indicates that label\-feedback alignment reduces dependence on the initial discovery bias\. Replacing the original alarm titles with anonymous identifiers lowers Node F1 to86\.46%86\.46\\%and Case EM to81\.57%81\.57\\%, reductions of6\.126\.12and8\.048\.04percentage points\. Because all other settings remain unchanged, this result indicates that human\-readable alarm\-name information provides additional guidance for graph\-edit proposals\. The anonymized variant still exceeds the strongest non\-EvoCause baseline by2\.322\.32percentage points in Node F1 and3\.273\.27percentage points in Case EM, showing that feedback\-guided structural refinement remains effective without lexical information\. Since TeleRCA has no ground\-truth propagation graph, these results demonstrate diagnostic utility and robustness rather than exact structural recovery\.

## 5Conclusion

We release TeleRCA, an expert\-annotated production benchmark, and propose EvoCause, a discovery\-agnostic framework that uses historical expert diagnoses to refine alarm graphs\. Because incident labels specify desired source nodes but not the required edge changes, an LLM proposes semantically plausible graph updates\. Deterministic procedures validate node identities and acyclicity and retain the best graph on a labeled alignment set\. Experiments on synthetic data and TeleRCA show that EvoCause improves root cause analysis over unrefined discovery graphs and other RCA baselines, while synthetic results also show improved graph reconstruction\. The TeleRCA name\-anonymization result further indicates that human\-readable alarm\-title information provides additional guidance for refinement\. At inference, the refined graph alone produces predictions without expert labels or LLM calls\. Since root\-cause labels generally identify a root\-cause\-consistent graph set rather than a unique data\-generating DAG, future work will strengthen identifiability by incorporating intervention records, temporal evidence, and expert edge\-level constraints\. We also plan to model resource\-specific and time\-varying propagation, account for latent common causes, and improve robustness to noisy expert labels through active selection of informative incidents\.

## References

- Recommending root\-cause and mitigation steps for cloud incidents using large language models\.In2023 IEEE/ACM 45th International Conference on Software Engineering \(ICSE\),pp\. 1737–1749\.External Links:[Document](https://dx.doi.org/10.1109/ICSE48619.2023.00149)Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px2.p1.1)\.
- A\. Aït\-Bachir, C\. K\. Assaad, C\. de Bignicourt, E\. Devijver, S\. Ferreira, E\. Gaussier, H\. Mohanna, and L\. Zan \(2023\)Case studies of causal discovery from it monitoring time series\.External Links:2307\.15678,[Link](https://arxiv.org/abs/2307.15678)Cited by:[§1](https://arxiv.org/html/2607.27290#S1.p3.1)\.
- C\. K\. Assaad, E\. Devijver, and E\. Gaussier \(2022\)Survey and evaluation of causal discovery methods for time series\.Journal of Artificial Intelligence Research73,pp\. 767–819\.External Links:[Document](https://dx.doi.org/10.1613/jair.1.13428)Cited by:[§1](https://arxiv.org/html/2607.27290#S1.p3.1),[Assumption 1](https://arxiv.org/html/2607.27290#Thmassumption1.p1.3.3),[Assumption 2](https://arxiv.org/html/2607.27290#Thmassumption2.p1.1.1)\.
- C\. K\. Assaad, I\. Ez\-Zejjari, and L\. Zan \(2023\)Root cause identification for collective anomalies in time series given an acyclic summary causal graph with loops\.InProceedings of The 26th International Conference on Artificial Intelligence and Statistics,F\. Ruiz, J\. Dy, and J\. van de Meent \(Eds\.\),Proceedings of Machine Learning Research, Vol\.206,pp\. 8395–8404\.External Links:[Link](https://proceedings.mlr.press/v206/assaad23a.html)Cited by:[§1](https://arxiv.org/html/2607.27290#S1.p1.1)\.
- R\. Cai, S\. Wu, J\. Qiao, Z\. Hao, K\. Zhang, and X\. Zhang \(2024\)THPs: topological Hawkes processes for learning causal structure on event sequences\.IEEE Transactions on Neural Networks and Learning Systems35\(1\),pp\. 479–493\.External Links:[Document](https://dx.doi.org/10.1109/TNNLS.2022.3175622)Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px3.p1.1),[§3\.4](https://arxiv.org/html/2607.27290#S3.SS4.SSS0.Px1.p1.3)\.
- S\. Chakraborty, S\. Garg, S\. Agarwal, A\. Chauhan, and S\. K\. Saini \(2023\)CausIL: causal graph for instance\-level microservice data\.InProceedings of the ACM Web Conference \(WWW\),pp\. 2905–2915\.External Links:[Document](https://dx.doi.org/10.1145/3543507.3583274)Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px1.p1.1)\.
- Y\. Chen, H\. Xie, M\. Ma, Y\. Kang, X\. Gao, L\. Shi, Y\. Cao, X\. Gao, H\. Fan, M\. Wen, J\. Zeng, S\. Ghosh, X\. Zhang, C\. Zhang, Q\. Lin, S\. Rajmohan, D\. Zhang, and T\. Xu \(2024\)Automatic root cause analysis via large language models for cloud incidents\.InProceedings of the Nineteenth European Conference on Computer Systems \(EuroSys\),pp\. 674–688\.External Links:[Document](https://dx.doi.org/10.1145/3627703.3629553)Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px2.p1.1)\.
- D\. M\. Chickering \(2002\)Learning equivalence classes of bayesian\-network structures\.Journal of Machine Learning Research2,pp\. 445–498\.Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px1.p1.1)\.
- DeepSeek\-AI, D\. Guo, D\. Yang,et al\.\(2025\)DeepSeek\-R1: incentivizing reasoning capability in LLMs via reinforcement learning\.arXiv preprint arXiv:2501\.12948\.External Links:[Link](https://arxiv.org/abs/2501.12948)Cited by:[§A\.4](https://arxiv.org/html/2607.27290#A1.SS4.p1.1)\.
- Z\. Fang, R\. Zhao, Y\. Liu, and Y\. He \(2025\)On the representation of pairwise causal background knowledge and its applications in causal inference\.Journal of Machine Learning Research26\(229\),pp\. 1–73\.External Links:[Link](https://www.jmlr.org/papers/v26/23-0624.html)Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px1.p1.1)\.
- F\. R\. Guo and E\. Perković \(2022\)Efficient least squares for estimating total effects under linearity and causal sufficiency\.Journal of Machine Learning Research23\(104\),pp\. 1–41\.External Links:[Link](https://jmlr.org/papers/v23/21-023.html)Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px1.p1.1)\.
- A\. Hauser and P\. Bühlmann \(2012\)Characterization and greedy learning of interventional markov equivalence classes of directed acyclic graphs\.Journal of Machine Learning Research13\(79\),pp\. 2409–2464\.External Links:[Link](https://jmlr.org/papers/v13/hauser12a.html)Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px1.p1.1)\.
- A\. Ikram, S\. Chakraborty, S\. Mitra, S\. Saini, S\. Bagchi, and M\. Kocaoglu \(2022\)Root cause analysis of failures in microservices through causal discovery\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Vol\.35,pp\. 31158–31170\.Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px1.p1.1)\.
- W\. Jiang and Y\. Bai \(2023\)APGNN: alarm propagation graph neural network for fault detection and alarm root cause analysis\.Computer Networks220,pp\. 109485\.External Links:[Document](https://dx.doi.org/10.1016/j.comnet.2022.109485)Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px1.p1.1),[§4\.1](https://arxiv.org/html/2607.27290#S4.SS1.SSS0.Px2.p1.6),[Table 1](https://arxiv.org/html/2607.27290#S4.T1.32.32.5)\.
- Y\. Li, Y\. Kong, S\. Yin, and J\. Li \(2025\)Topological\-temporal convolution transformer Hawkes process for causal structural learning in telecom networks\.IEEE Internet of Things Journal12\(17\),pp\. 36019–36033\.External Links:[Document](https://dx.doi.org/10.1109/JIOT.2025.3582307)Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px1.p1.1)\.
- C\. Lin, C\. Chang, W\. Wang, K\. Wang, and W\. Peng \(2024\)Root cause analysis in microservice using neural Granger causal discovery\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.38,pp\. 206–213\.External Links:[Document](https://dx.doi.org/10.1609/aaai.v38i1.27772)Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px1.p1.1),[§4\.1](https://arxiv.org/html/2607.27290#S4.SS1.SSS0.Px2.p1.6),[Table 1](https://arxiv.org/html/2607.27290#S4.T1.36.36.5)\.
- M\. O’Brien and F\. Bajak \(2021\)Why did amazon web services crash? here’s what it means\.Note:https://globalnews\.ca/news/8434673/why\-amazon\-web\-services\-crash/Accessed: 2024\-07\-25Cited by:[§1](https://arxiv.org/html/2607.27290#S1.p1.1)\.
- C\. Pei, Z\. Wang, F\. Liu, Z\. Li, Y\. Liu, X\. He, R\. Kang, T\. Zhang, J\. Chen, J\. Li, G\. Xie, and D\. Pei \(2025\)Flow\-of\-Action: SOP\-enhanced LLM\-based multi\-agent system for root cause analysis\.InCompanion Proceedings of the ACM Web Conference \(WWW\),External Links:[Document](https://dx.doi.org/10.1145/3701716.3715225)Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px2.p1.1)\.
- E\. Perković \(2020\)Identifying causal effects in maximally oriented partially directed acyclic graphs\.InProceedings of the 36th Conference on Uncertainty in Artificial Intelligence,Vol\.124,pp\. 530–539\.Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px1.p1.1)\.
- D\. Roy, X\. Zhang, R\. Bhave, C\. Bansal, P\. H\. B\. Las\-Casas, R\. Fonseca, and S\. Rajmohan \(2024\)Exploring LLM\-based agents for root cause analysis\.InCompanion Proceedings of the 32nd ACM International Conference on the Foundations of Software Engineering \(FSE Companion\),pp\. 208–219\.External Links:[Document](https://dx.doi.org/10.1145/3663529.3663841)Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px2.p1.1)\.
- P\. Spirtes, C\. N\. Glymour, and R\. Scheines \(2000\)Causation, prediction, and search\.2nd edition,MIT Press\.Cited by:[§1](https://arxiv.org/html/2607.27290#S1.p3.1),[§3\.4](https://arxiv.org/html/2607.27290#S3.SS4.SSS0.Px1.p1.3),[Assumption 2](https://arxiv.org/html/2607.27290#Thmassumption2.p1.1.1)\.
- H\. Wang, Z\. Wu, H\. Jiang, Y\. Huang, J\. Wang, S\. Köprü, and T\. Xie \(2021\)Groot: an event\-graph\-based approach for root cause analysis in industrial settings\.InProceedings of the 36th IEEE/ACM International Conference on Automated Software Engineering \(ASE\),pp\. 419–429\.External Links:[Document](https://dx.doi.org/10.1109/ASE51524.2021.9678708)Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px1.p1.1)\.
- L\. Wang, C\. Zhang, R\. Ding, Y\. Xu, Q\. Chen, W\. Zou, Q\. Chen, M\. Zhang, X\. Gao, H\. Fan, S\. Rajmohan, Q\. Lin, and D\. Zhang \(2023\)Root cause analysis for microservice systems via hierarchical reinforcement learning from human feedback\.InProceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining \(KDD\),pp\. 5116–5125\.External Links:[Document](https://dx.doi.org/10.1145/3580305.3599934)Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px1.p1.1)\.
- Z\. Wang, Z\. Liu, Y\. Zhang, A\. Zhong, J\. Wang, F\. Yin, L\. Fan, L\. Wu, and Q\. Wen \(2024\)RCAgent: cloud root cause analysis by autonomous agents with tool\-augmented large language models\.InProceedings of the 33rd ACM International Conference on Information and Knowledge Management \(CIKM\),pp\. 4966–4974\.External Links:[Document](https://dx.doi.org/10.1145/3627673.3680016)Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px2.p1.1)\.
- Z\. Xie, Y\. Zheng, L\. Ottens, K\. Zhang, C\. Kozyrakis, and J\. Mace \(2024\)Cloud Atlas: efficient fault localization for cloud systems using language models and causal insight\.arXiv preprint arXiv:2407\.08694\.External Links:2407\.08694,[Link](https://arxiv.org/abs/2407.08694)Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px2.p1.1)\.
- J\. Xu, Q\. Zhang, Z\. Zhong, S\. He, C\. Zhang, Q\. Lin, D\. Pei, P\. He, D\. Zhang, and Q\. Zhang \(2025\)OpenRCA: can large language models locate the root cause of software failures?\.InThe Thirteenth International Conference on Learning Representations,External Links:[Link](https://proceedings.iclr.cc/paper_files/paper/2025/hash/d29b8d53678015079e1d245c023e49d2-Abstract-Conference.html)Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px2.p1.1),[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px3.p1.1)\.
- A\. Yang, A\. Li, B\. Yang,et al\.\(2025\)Qwen3 technical report\.arXiv preprint arXiv:2505\.09388\.External Links:[Link](https://arxiv.org/abs/2505.09388)Cited by:[§A\.4](https://arxiv.org/html/2607.27290#A1.SS4.p1.1),[§4\.1](https://arxiv.org/html/2607.27290#S4.SS1.SSS0.Px2.p1.6)\.
- Z\. Yao, C\. Pei, W\. Chen, H\. Wang, L\. Su, H\. Jiang, Z\. Xie, X\. Nie, and D\. Pei \(2024\)Chain\-of\-Event: interpretable root cause analysis for microservices through automatically learning weighted event causal graph\.InCompanion Proceedings of the 32nd ACM International Conference on the Foundations of Software Engineering \(FSE Companion\),pp\. 50–61\.External Links:[Document](https://dx.doi.org/10.1145/3663529.3663827)Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px1.p1.1),[§4\.1](https://arxiv.org/html/2607.27290#S4.SS1.SSS0.Px2.p1.6),[Table 1](https://arxiv.org/html/2607.27290#S4.T1.24.24.5)\.
- L\. Zan, C\. K\. Assaad, E\. Devijver, E\. Gaussier, and A\. Aït\-Bachir \(2024\)On the fly detection of root causes from observed data with application to IT systems\.InProceedings of the 33rd ACM International Conference on Information and Knowledge Management,pp\. 5062–5069\.External Links:[Document](https://dx.doi.org/10.1145/3627673.3680010)Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px1.p1.1)\.
- L\. Zan, K\. Zhang, R\. Cai, and L\. Pan \(2026\)CAMA: enhancing mathematical reasoning in large language models with causal knowledge\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.40,pp\. 34566–34574\.External Links:[Document](https://dx.doi.org/10.1609/aaai.v40i41.40756),[Link](https://ojs.aaai.org/index.php/AAAI/article/view/40756)Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px2.p1.1)\.
- K\. Zhang, X\. Zhu, J\. Zheng, J\. Cao, K\. Zhang, and L\. Pan \(2024\)Cluster\-aware causal discovery framework for root cause analysis of base station alarms\.In2024 IEEE Globecom Workshops \(GC Wkshps\),pp\. 1–6\.External Links:[Document](https://dx.doi.org/10.1109/GCWkshp64532.2024.11101284)Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px1.p1.1),[§4\.1](https://arxiv.org/html/2607.27290#S4.SS1.SSS0.Px2.p1.6),[Table 1](https://arxiv.org/html/2607.27290#S4.T1.28.28.5)\.
- K\. Zhang, M\. Kalander, M\. Zhou, X\. Zhang, and J\. Ye \(2021\)An influence\-based approach for root cause alarm discovery in telecom networks\.InService\-Oriented Computing – ICSOC 2020 Workshops,pp\. 124–136\.External Links:[Document](https://dx.doi.org/10.1007/978-3-030-76352-7%5F16),[Link](https://arxiv.org/abs/2105.03092)Cited by:[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px1.p1.1),[§2](https://arxiv.org/html/2607.27290#S2.SS0.SSS0.Px3.p1.1),[§4\.1](https://arxiv.org/html/2607.27290#S4.SS1.SSS0.Px2.p1.6)\.
- N\. Zhao, J\. Chen, X\. Peng, H\. Wang, X\. Wu, Y\. Zhang, Z\. Chen, X\. Zheng, X\. Nie, G\. Wang,et al\.\(2020\)Understanding and handling alert storm for online service systems\.InProceedings of the ACM/IEEE 42nd International Conference on Software Engineering: Software Engineering in Practice,pp\. 162–171\.Cited by:[§1](https://arxiv.org/html/2607.27290#S1.p1.1)\.
- X\. Zheng, B\. Aragam, P\. K\. Ravikumar, and E\. P\. Xing \(2018\)DAGs with no tears: continuous optimization for structure learning\.InAdvances in Neural Information Processing Systems,Vol\.31,pp\. 9492–9503\.Cited by:[§3\.4](https://arxiv.org/html/2607.27290#S3.SS4.SSS0.Px1.p1.3)\.

## Appendix AAppendix

### A\.1EvoCause Optimization Procedure

Algorithm[1](https://arxiv.org/html/2607.27290#alg1)compares candidate graphs using the lexicographic scoreS=\(CaseEM,NodeF1\)S=\(\\mathrm\{CaseEM\},\\mathrm\{NodeF1\}\), prioritizing exact incident resolution and using partial node recovery only to break ties\. At epochee,𝒟align\(e\)\\mathcal\{D\}\_\{\\mathrm\{align\}\}^\{\(e\)\}is a random permutation of𝒟align\\mathcal\{D\}\_\{\\mathrm\{align\}\}used to form the batches\. The graph is the only persistent structural state, while its topological order is recomputed for each prompt\. The LLM returns only graph updates, invalid or cyclic candidates are rejected, and the graph with the best alignment\-set score is retained\.

Algorithm 1EvoCause: LLM\-Guided Evolution of Causal Graphs for RCA0:Historical sequences

𝒟hist\\mathcal\{D\}\_\{\\mathrm\{hist\}\}, labeled alignment cases

𝒟align=\{\(si,yi\)\}i=1N\\mathcal\{D\}\_\{\\mathrm\{align\}\}=\\\{\(s\_\{i\},y\_\{i\}\)\\\}\_\{i=1\}^\{N\}, discovery algorithmCausalDiscovery, LLM

ℳ\\mathcal\{M\}, prompt

pup\_\{u\}, batch size

NbN\_\{b\}, epochs

NeN\_\{e\}, round budget

NrN\_\{r\}, patience

cstopc\_\{\\mathrm\{stop\}\}, seed

ξ\\xi
0:Refined graph

𝒢∗\\mathcal\{G\}^\{\*\}
1:

𝒢←CausalDiscovery​\(𝒟hist\)\\mathcal\{G\}\\leftarrow\\textsc\{CausalDiscovery\}\(\\mathcal\{D\}\_\{\\mathrm\{hist\}\}\)
2:

S∗←Score​\(𝒟align,𝒢\)S^\{\*\}\\leftarrow\\mathrm\{Score\}\(\\mathcal\{D\}\_\{\\mathrm\{align\}\},\\mathcal\{G\}\)𝒢∗←𝒢\\mathcal\{G\}^\{\*\}\\leftarrow\\mathcal\{G\}
3:

r←0r\\leftarrow 0c←0c\\leftarrow 0ℋ←∅\\mathcal\{H\}\\leftarrow\\emptyset
4:for

e=1e=1to

NeN\_\{e\}do

5:

𝒟align\(e\)←Shuffle​\(𝒟align;ξ\+e\)\\mathcal\{D\}\_\{\\mathrm\{align\}\}^\{\(e\)\}\\leftarrow\\mathrm\{Shuffle\}\(\\mathcal\{D\}\_\{\\mathrm\{align\}\};\\xi\+e\)
6:

\{ℬk\}k=1K←Partition​\(𝒟align\(e\),Nb\)\\\{\\mathcal\{B\}\_\{k\}\\\}\_\{k=1\}^\{K\}\\leftarrow\\mathrm\{Partition\}\(\\mathcal\{D\}\_\{\\mathrm\{align\}\}^\{\(e\)\},N\_\{b\}\)
7:for

k=1k=1to

KKdo

8:

𝒢prev←𝒢\\mathcal\{G\}\_\{\\mathrm\{prev\}\}\\leftarrow\\mathcal\{G\}
9:

ℰ←\{\(si,RCAEngine​\(si,𝒢\),yi\):\(si,yi\)∈ℬk\}\\mathcal\{E\}\\leftarrow\\\{\(s\_\{i\},\\textsc\{RCAEngine\}\(s\_\{i\},\\mathcal\{G\}\),y\_\{i\}\):\(s\_\{i\},y\_\{i\}\)\\in\\mathcal\{B\}\_\{k\}\\\}
10:

O​\(𝒢\)←TopologicalOrder​\(𝒢\)O\(\\mathcal\{G\}\)\\leftarrow\\textsc\{TopologicalOrder\}\(\\mathcal\{G\}\)
11:

Δ​𝒢←ℳ​\(𝒢,O​\(𝒢\),ℰ,ℋ,pu\)\\Delta\\mathcal\{G\}\\leftarrow\\mathcal\{M\}\(\\mathcal\{G\},O\(\\mathcal\{G\}\),\\mathcal\{E\},\\mathcal\{H\},p\_\{u\}\)
12:

𝒢′←ApplyGraphUpdates​\(𝒢,Δ​𝒢\)\\mathcal\{G\}^\{\\prime\}\\leftarrow\\textsc\{ApplyGraphUpdates\}\(\\mathcal\{G\},\\Delta\\mathcal\{G\}\)
13:if

ValidUpdates​\(Δ​𝒢,𝐀\)\\mathrm\{ValidUpdates\}\(\\Delta\\mathcal\{G\},\\mathbf\{A\}\)and

IsDAG​\(𝒢′\)\\mathrm\{IsDAG\}\(\\mathcal\{G\}^\{\\prime\}\)then

14:

𝒢←𝒢′\\mathcal\{G\}\\leftarrow\\mathcal\{G\}^\{\\prime\}
15:else

16:Reject the update and keep

𝒢\\mathcal\{G\}unchanged

17:endif

18:

S←Score​\(𝒟align,𝒢\)S\\leftarrow\\mathrm\{Score\}\(\\mathcal\{D\}\_\{\\mathrm\{align\}\},\\mathcal\{G\}\)
19:if

S\>lexS∗S\>\_\{\\mathrm\{lex\}\}S^\{\*\}then

20:

S∗←SS^\{\*\}\\leftarrow S𝒢∗←𝒢\\mathcal\{G\}^\{\*\}\\leftarrow\\mathcal\{G\}
21:endif

22:

c←c\+1c\\leftarrow c\+1if

𝒢=𝒢prev\\mathcal\{G\}=\\mathcal\{G\}\_\{\\mathrm\{prev\}\}, otherwise

c←0c\\leftarrow 0
23:Append

\(𝒢,S\)\(\\mathcal\{G\},S\)to

ℋ\\mathcal\{H\}, then set

r←r\+1r\\leftarrow r\+1
24:if

r≥Nrr\\geq N\_\{r\}or

c≥cstopc\\geq c\_\{\\mathrm\{stop\}\}then

25:return

𝒢∗\\mathcal\{G\}^\{\*\}
26:endif

27:endfor

28:endfor

29:return

𝒢∗\\mathcal\{G\}^\{\*\}

### A\.2TeleRCA Data Structure

Each TeleRCA incident is stored as one JSON file with two main fields:nodescontains the resources and alarms observed during the incident, andcauseNodecontains the expert annotation\. Each alarm record includes an identifier, a human\-readable title, and a UTC timestamp\. The resource identifier is retained in the released record but is not part of the event triplet\(aj,tj,lj\)\(a\_\{j\},t\_\{j\},l\_\{j\}\)used in the method formulation\.

Each key incauseNodeidentifies a root\-cause resource and maps to one or more alarm identifiers\. These identifiers are matched to alarm records under the corresponding entry innodes\. The matched alarm titles define the expert root set, and the remaining alarms are downstream symptoms\. The abbreviated example below contains one labeledPhysical Port Downroot alarm\.

1\{"nodes":\[

2\{"device":"JKT\-GATG\-OPT\-H910D",

3"alarms":\[\{"id":"a1","title":"BFDsessiondown","t":"03:22:15"\}\]\},

4\{"device":"JKT\-RJG\-AN1\-H8X08",

5"alarms":\[\{"id":"a2","title":"PhysicalPortDown","t":"03:22:04"\},

6\{"id":"a3","title":"LinkDown","t":"03:22:04"\}\]\}\],

7"causeNode":\{"JKT\-RJG\-AN1\-H8X08":\["a2"\]\}\}

Table 3:Component ablations and LLM\-backbone sensitivity on the ten synthetic graph instances with PC initialization\. The component study uses Qwen3\-32B except for the stated variant\. Values are mean±\\pmstandard deviation\.
### A\.3Synthetic Component Ablations

Table[3](https://arxiv.org/html/2607.27290#A1.T3)reports the component\-ablation results\. We initialize EvoCause with PC, use Qwen3\-32B as the default proposal model, and change one prompt component at a time\.w/o Historyremoves prior graph–score pairs, whilew/o Orderremoves the topological linearization derived from the current graph\. These variants evaluate the contribution of structural prompt context on synthetic graphs whose nodes have arbitrary numeric identifiers\.

Removing the derived order causes the larger degradation, lowering Node F1, Case EM, and Graph F1 by2\.902\.90,5\.015\.01, and0\.950\.95percentage points, respectively, while increasing nSHD by0\.07510\.0751\. Removing optimization history causes smaller reductions of0\.810\.81,0\.870\.87, and0\.700\.70percentage points in Node F1, Case EM, and Graph F1, respectively, while increasing nSHD by0\.02660\.0266\. These results show that both structural context components improve refinement, with the derived topological order having the larger overall contribution\.

### A\.4LLM Backbone Sensitivity

We fix the initial PC graph, prompt, alignment cases, graph\-edit budget, and deterministic validator, and vary only the LLM backbone\. We compare Qwen3\-4B\-Instruct\-2507, Qwen3\-4B\-Thinking\-2507, DeepSeek\-R1\-Distill\-Llama\-70B, and the default Qwen3\-32B\(Yanget al\.[2025](https://arxiv.org/html/2607.27290#bib.bib31); DeepSeek\-AIet al\.[2025](https://arxiv.org/html/2607.27290#bib.bib32)\)\. Because these models may differ in several respects beyond parameter count, this experiment is treated as a backbone sensitivity analysis rather than an isolation of any specific model capability\.

Among the backbone results in Table[3](https://arxiv.org/html/2607.27290#A1.T3), Qwen3\-32B obtains the best mean result on all four metrics, while performance varies across the remaining backbones\. Because the models differ in multiple respects, this comparison does not isolate the cause of the observed differences\. We therefore use it only to assess the sensitivity of EvoCause to the selected LLM backbone\.

### A\.5Hyperparameter Robustness

Figure[2](https://arxiv.org/html/2607.27290#A1.F2)summarizes the sensitivity of EvoCause to the round budget, epoch count, and batch size\. On TeleRCA, incidents are partitioned 4:1 into non\-overlapping train and test sets\. The default values areNr=500N\_\{r\}=500refinement rounds,Ne=10N\_\{e\}=10epochs, andNb=20N\_\{b\}=20cases per batch\. We vary one parameter at a time, run each setting five times, and report Node F1 and Case EM\.

#### Round budget\.

For this robustness study, we use20%20\\%of the training split as the labeled alignment set, i\.e\.,ρrob=0\.2\\rho\_\{\\mathrm\{rob\}\}=0\.2, and vary the round budget overNr∈\{100,300,500,700,900\}N\_\{r\}\\in\\\{100,300,500,700,900\\\}\. Performance improves up to approximatelyNr=700N\_\{r\}=700and then stabilizes, while variability generally decreases as the budget increases\.

#### Epoch count\.

We varyNe∈\{5,7,10,13,15\}N\_\{e\}\\in\\\{5,7,10,13,15\\\}\. Both metrics remain within a narrow range, with a mild peak near the defaultNe=10N\_\{e\}=10, indicating diminishing returns after a moderate number of shuffled passes through the alignment cases\.

#### Batch size\.

We varyNb∈\{10,20,30,40,50\}N\_\{b\}\\in\\\{10,20,30,40,50\\\}\. The defaultNb=20N\_\{b\}=20gives the best mean performance\. Larger batches slightly degrade both metrics and increase variance, consistent with the greater number of cross\-incident constraints that must be reconciled in one proposal\.

![Refer to caption](https://arxiv.org/html/2607.27290v1/x2.png)Figure 2:Sensitivity to the refinement\-round budget, epoch count, and batch size\. Each point reports mean and standard deviation over five runs\. The left and right columns show Node F1 and Case EM, respectively\.

### A\.6Label\-Feedback Efficiency

![[Uncaptioned image]](https://arxiv.org/html/2607.27290v1/x3.png)

Figure 3:Synthetic\-data performance under PC initialization as the labeled alignment fraction increases from 0% to 20%\. The x\-axis label “training set completeness” denotes the percentage of the training split used for label\-feedback alignment\.
Figure[3](https://arxiv.org/html/2607.27290#A1.F3)varies the percentage of the training split used as the labeled alignment set from 0% to 20% in steps of two percentage points under PC initialization\. The 0% point is the unrefined PC graph\. All four metrics improve sharply once a small labeled subset is introduced\. Node F1, Case EM, and Graph F1 then fluctuate within a comparatively narrow range, whereas nSHD continues to decline as more labels constrain the admissible graph set\. The default 10% setting lies in this stable region and balances annotation cost with refinement quality\.