CAESAR: Causal Anomalies - Exploring Synergies of Anomaly Detection and Causal Inference

Detecting an anomaly is only the first step; the harder question is identifying its cause. This presentation explores how causal reasoning can support root cause analysis in multivariate time-series systems by combining observational data with background knowledge encoded in a summary causal graph. We characterize which root causes are directly detectable using causal inference and which remain ambiguous because parts of the causal structure are unknown. We then show how the summary causal graph can provide guarantees about which undetected root causes may become detectable after applying causal discovery, under additional assumptions such as faithfulness. The presentation highlights the complementary roles of background knowledge, causal inference, and causal discovery in building more reliable and interpretable methods for anomaly diagnosis.

Root cause analysis aims to identify the mechanisms responsible for anomalies in complex dynamical systems. In this paper, we study root cause analysis in linear time-series through the lens of difference graph discovery. We focus on effect-defying root causes, corresponding to variables whose causal coefficients change between a normal and an anomalous regime. We formalize this problem using linear discrete-time dynamic structural causal models and adapt several methods originally introduced for discovering difference graphs between two populations to the time-series setting, where the two populations are replaced by a normal and an anomalous regime. We first evaluate the proposed approaches on simulated data, and then demonstrate their practical relevance on real-world datasets from IT monitoring and intensive care monitoring. Our results show how difference graph discovery can help localize causal mechanisms responsible for anomalous behavior.

Root cause analysis (RCA) in complex systems is challenging due to error propagation across multiple variables, the need for structural causal knowledge, and the computational cost of inference at test time. We introduce PRIM (Prior-fitted Root cause Identification with Meta-learning), a causal meta-learning approach that frames RCA as a Bayesian inference task over a synthetic prior of causal models. By marginalising out structural uncertainty, PRIM implicitly identifies changes in the data-generating mechanism between baseline and anomalous periods. In doing so, PRIM infers distributional differences without explicit statistical testing, and implicitly learns causal structure without model fitting at test time. Following the simulation-based meta-learning paradigm of prior-fitted networks, PRIM uses a Model-Averaged Causal Estimation (MACE) transformer neural process that jointly attends over observational and anomalous samples and the causal structure of nodes, enabling zero-shot inference in 17,ms for systems with up to 100 variables. Across synthetic benchmarks and two realistic benchmark datasets, PetShop and CausRCA, PRIM is competitive with methods that are aware of the system's causal graphical structure a priori while outperforming graph-unaware methods on several tasks. Lightweight fine-tuning to specific domains and data dynamics improves performance further.

Root cause analysis of anomalies aims to identify how and why a sample deviates from the normal process. Existing methods primarily focus on telling which features are responsible, ignoring that anomalies can arise through two fundamentally different processes: measurement errors, where the sample is generated normally but one or more values is recorded incorrectly, and mechanism shifts, where the causal process that generated the sample was changed. While measurement errors can often be safely corrected, mechanistic anomalies require careful consideration. In this extended abstract, we formally define a causal model that explicitly captures both types by treating outliers as latent interventions on latent ("true") and observed ("measured"). Based on this model, we develop an efficient inference procedure for localizing root causes and distinguishing anomaly types. Experiments on synthetic and real-world data show that our method provides state-of-the-art performance in root cause localization, while enabling the novel task of classification of anomaly types.

Cyber-physical systems rely on anomaly detection to maintain safe and reliable operation. However, the notion that one model fits all rarely holds in practice, as industrial systems operate across multiple domains with varying system dynamics that can alter the relationships observed in the data. Graph-based approaches offer a natural way to model relationships among process variables, but most existing methods capture training-data correlations that are often tied to domain-specific dynamics and may fail to generalise in out-of-domain. In this work, we investigate whether causally informed graphs improve domain generalisation compared to data-driven graph construction using the Causal Chambers dataset and evaluate both approaches across multiple unseen domains. The results show that incorporating causally informed graph structures with graph learning achieves more robust performance across unseen domains and stronger out-of-domain anomaly detection than purely data-driven graph construction. These findings suggest that causal knowledge helps graph-based anomaly detection models capture stable relationships that transfer across domains with different system dynamics.

Observational causal inference increasingly relies on auxiliary control outcomes—negative controls to detect residual confounding and positive controls to verify recovery of known effects. These literatures have developed independently, and neither specifies how the joint signature of both control types should adjudicate a target estimate. We unify this logic into a single pre-specified decision rule: the JANUS Decision (Joint Adjudication via Negative-and-positive control Unified Signals), which maps the combined pass/fail signature to one of four credibility verdicts—release, recalibrate, redesign, or withhold—each prescribing a distinct action, with severity tiers anchored in existing sensitivity-analysis and calibration machinery. The framework is estimator-agnostic and intended as a teachable diagnostic for researchers entering observational causal inference from applied backgrounds. We illustrate it on a sugar-sweetened-beverage and type-2-diabetes analysis using double machine learning, where the joint signature lands in the recalibrate cell and a literature-anchored bias correction reduces the headline estimate by 7.7% while leaving it significant; three constructed variants populate the remaining cells. Because the verdict is fixed before the target estimate is seen, JANUS replaces post-hoc, selectively reported robustness checks with a transparent rule researchers can commit to in advance.

Vine copulas provide a flexible framework for modeling complex multivariate distributions through a hierarchical decomposition into bivariate pair-copulas. Fitting a D-vine requires selecting a copula family and parameter configuration for each pair-copula from a set of candidates encoding different dependence patterns. As the number of variables and candidate families increases, the number of possible configurations grows combinatorially. Existing fitting procedures address this challenge through sequential greedy decisions, committing to a single locally optimal family at each step and potentially discarding configurations that would yield a better global fit. To overcome this limitation, we propose a novel estimation framework that combines gradient-based maximum likelihood estimation, enabled by our fully differentiable implementation, with a beam-search strategy that maintains multiple competing D-vine configurations throughout the fitting process. This allows a broader exploration of the configuration space while remaining computationally tractable. Building on the fitted D-vine, we introduce a localized anomaly detection framework that exploits the hierarchical decomposition to produce both global anomaly scores and edge-level explanations. Statistical guarantees are provided through Mondrian conformal prediction, while the pair-copula structure enables the localization of anomalies to specific variable relationships. We evaluate the proposed framework on both benchmark and real-world datasets, demonstrating its effectiveness for interpretable anomaly detection with uncertainty quantification.

Anomaly detectors for industrial control systems reliably re- port that something is wrong, but they say little about where the problem began. The operator is left to read a cascade of correlated alarms and guess the source. We treat this second step, root-cause localization, as a separate problem with its own component, and we introduce Feature Zero a model-agnostic framework that addresses it. Given an anomaly window from any upstream detector together with a causal graph of the process, Feature Zero returns a ranked set of candidate root causes and nominates the single variable that most likely initiated the cascade. We call that earliest initiating variable the Feature Zero of the incident; it is a stricter notion than a root cause, since not every root cause started the cascade. We evaluate the framework as a case study on the Secure Water Treatment (SWaT) testbed and its six documented attacks. Using an expert causal graph built from the plant’s piping and instrumentation diagrams, Feature Zero ranks the true root cause first on five of the six attacks outperforming multiple baselines.

The introduction of continuous monitoring sensors in wastewater treatment plants (WWTPs) offers an opportunity for fine-grained understanding and control. However, WWTP data is highly non-linear and non-stationary, with distinct regimes of operation. Sensors are also prone to anomalous readings due to sensor drift, physical anomalies, and hydrodynamics within tanks. To address these issues we segment sensor data by regime. To infer causal relationships among sensors we perform graph decomposition, giving a temporal and a contemporaneous graph for each regime. These graphs are evaluated based on consistency within regime and differences between regimes, confirming the success of our method. They can then be used to communicate sensor relationships to domain experts and confirm expected relationships.