# EvoCause: LLM-Guided Evolution of Causal Graphs for Root Cause Analysis

arXiv: https://arxiv.org/abs/2607.27290 · HTML: https://mlsanity.com/paper/2607.27290/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 14 of its 31 references that are in the map.
- First posted on arXiv 29 Jul 2026.

## Builds on (most cited first, 14 of 14)

- [DAGs with NO TEARS: Continuous Optimization for Structure Learning](https://mlsanity.com/paper/1803.01422/) (2018)
- [Automatic Root Cause Analysis via Large Language Models for Cloud Incidents](https://mlsanity.com/paper/2305.15778/) (2023)
- [Learning Equivalence Classes of Bayesian Networks Structures](https://mlsanity.com/paper/1302.3566/) (2013)
- [Root Cause Analysis In Microservice Using Neural Granger Causal Discovery](https://mlsanity.com/paper/2402.01140/) (2024)
- [Root Cause Identification for Collective Anomalies in Time Series given an Acyclic Summary Causal Graph with Loops](https://mlsanity.com/paper/2303.04038/) (2023)
- [THP: Topological Hawkes Processes for Learning Causal Structure on Event Sequences](https://mlsanity.com/paper/2105.10884/) (2021)
- [Groot: An Event-graph-based Approach for Root Cause Analysis in Industrial Settings](https://mlsanity.com/paper/2108.00344/) (2021)
- [Case Studies of Causal Discovery from IT Monitoring Time Series](https://mlsanity.com/paper/2307.15678/) (2023)
- [Cloud Atlas: Efficient Fault Localization for Cloud Systems using Language Models and Causal Insight](https://mlsanity.com/paper/2407.08694/) (2024)
- [An Influence-based Approach for Root Cause Alarm Discovery in Telecom Networks](https://mlsanity.com/paper/2105.03092/) (2021)
- [CausIL: Causal Graph for Instance Level Microservice Data](https://mlsanity.com/paper/2303.00554/) (2023)
- [On the Representation of Pairwise Causal Background Knowledge and Its Applications in Causal Inference](https://mlsanity.com/paper/2207.05067/) (2022)
- [On the Fly Detection of Root Causes from Observed Data with Application to IT Systems](https://mlsanity.com/paper/2402.06500/) (2024)
- [CAMA: Enhancing Mathematical Reasoning in Large Language Models with Causal Knowledge](https://mlsanity.com/paper/2508.02583/) (2025)

## Abstract (arXiv)

Modern telecommunication, cloud, and microservice systems emit correlated alarm cascades when components fail. Root cause analysis (RCA) aims to identify the small set of alarms that initiate each cascade. A common approach learns a causal graph from observational logs and predicts all zero-in-degree alarms in each incident-induced subgraph. However, the learned graph remains fixed and cannot benefit from expert diagnoses of historical incidents. We close this loop with EvoCause. Expert labels constrain which alarms should be source nodes but do not specify the edge edits needed to satisfy those constraints. EvoCause uses a large language model (LLM) to propose semantically plausible graph edits, while deterministic code validates node identities and acyclicity and retains the best graph on a labeled alignment set. At test time, the refined graph alone produces transparent predictions without an LLM call. We also release TeleRCA, an expert-annotated benchmark from a production telecommunication network containing 485,681 alarm events spanning 194 alarm types over 5,621 resources. On synthetic data, EvoCause initialized with the PC causal discovery algorithm outperforms the unrefined PC baseline, raising Node F1, Case EM, and Graph F1 by 11.59, 9.40, and 4.59 percentage points, respectively, while reducing nSHD by 0.2379. On TeleRCA, replacing human-readable alarm titles with anonymous identifiers lowers Node F1 and Case EM by 6.12 and 8.04 percentage points, respectively, indicating that alarm-name information contributes to graph refinement.