EvoCause Uses LLMs to Refine Causal Graphs for Root Cause Analysis

Lei Zan, Keli Zhang, Shifeng Xie, Jiale Zheng, Zehao Xiao, Zhiwei Dong, Ke Zhang, Ruichu Cai, Malik Tiomoko, Lujia Pan· July 31, 2026 View original

Key takeaways

  • EvoCause uses LLMs to refine causal graphs for improved RCA.
  • Expert labels guide LLM-proposed graph edits.
  • The refined graph operates independently for predictions.
  • This approach significantly boosts RCA accuracy in complex systems.

Who benefits

TelecommunicationsCloud ComputingIT OperationsManufacturingUtilities

Summary

EvoCause is a new method that leverages large language models (LLMs) to evolve and refine causal graphs for root cause analysis (RCA) in complex systems. By incorporating expert diagnoses of historical incidents, it proposes semantically plausible graph edits, significantly improving RCA accuracy without needing LLM calls at prediction time.

A new research paper introduces EvoCause, a system designed to improve Root Cause Analysis (RCA) in complex IT and telecommunication systems by using large language models (LLMs) to refine causal graphs. Traditional RCA methods often rely on fixed causal graphs learned from observational data, which cannot adapt to expert insights from past incidents. EvoCause closes this gap by allowing expert labels to constrain which alarms should be source nodes. While experts define the constraints, an LLM proposes semantically plausible edits to the causal graph. Deterministic code then validates these edits for node identity and acyclicity, retaining the best graph based on a labeled alignment set. Crucially, once refined, the graph operates independently, making predictions without further LLM intervention. The researchers also released TeleRCA, a new expert-annotated benchmark. On both synthetic data and TeleRCA, EvoCause significantly outperforms unrefined baselines, demonstrating improved F1 scores and reduced structural Hamming distance.

Why it matters

Enhancing root cause analysis with LLM-guided graph refinement can drastically reduce system downtime and operational costs by more accurately identifying the initial causes of complex system failures.

How to implement this in your domain

  1. 1Explore integrating LLM-guided graph refinement techniques like EvoCause into existing RCA workflows for IT operations or network management.
  2. 2Curate and annotate historical incident data with expert diagnoses to create a valuable dataset for refining causal models.
  3. 3Develop a validation framework for LLM-proposed graph edits to ensure accuracy and maintain system integrity.
  4. 4Assess the potential of using LLMs to interpret alarm titles and system logs for better semantic understanding in RCA.

Original post by Lei Zan, Keli Zhang, Shifeng Xie, Jiale Zheng, Zehao Xiao, Zhiwei Dong, Ke Zhang, Ruichu Cai, Malik Tiomoko, Lujia Pan

"arXiv:2607.27290v1 Announce Type: new Abstract: Modern telecommunication, cloud, and microservice systems emit correlated alarm cascades when components fail. Root cause analysis (RCA) aims to identify the small set of alarms that initiate each cascade. A common approach learns a…"

View on X

Originally posted by Lei Zan, Keli Zhang, Shifeng Xie, Jiale Zheng, Zehao Xiao, Zhiwei Dong, Ke Zhang, Ruichu Cai, Malik Tiomoko, Lujia Pan on X · view source

Want to go deeper?

Turn these trends into skills with Learnijoy's hands-on AI & tech courses.

Explore courses