# The Abstention Protocol: RCA for Clos Fabrics

arXiv: https://arxiv.org/abs/2608.21412 · HTML: https://mlsanity.com/paper/2608.21412/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 7 of its 45 references that are in the map.
- First posted on arXiv 11 Aug 2026.

## Builds on (most cited first, 7 of 7)

- [007: Democratically Finding The Cause of Packet Drops](https://mlsanity.com/paper/1802.07222/) (2018)
- [When In Doubt, Abstain: The Impact of Abstention on Strategic Classification](https://mlsanity.com/paper/2510.13327/) (2025)
- [Test Coverage for Network Configurations](https://mlsanity.com/paper/2209.12870/) (2022)
- [Flock: Accurate network fault localization at scale](https://mlsanity.com/paper/2305.03348/) (2023)
- [YTrace: End-to-end Performance Diagnosis in Large Cloud and Content Providers](https://mlsanity.com/paper/1602.03273/) (2016)
- [Annual Interruption Rate as a KPI, its measurement and comparison](https://mlsanity.com/paper/1910.12200/) (2019)
- [Data Integrity Error Localization in Networked Systems with Missing Data](https://mlsanity.com/paper/2207.02102/) (2022)

## Abstract (arXiv)

Root cause analysis (RCA) in large datacenter networks is challenging because telemetry is noisy, partial, and asynchronous. Score-based approaches degrade under these conditions, often yielding unstable or incorrect attributions. We present textscCoreSec, a production RCA system that replaces weighted fusion with a PAM-style abstention algebra. Telemetry agents are composed using control flags that yield deterministic decisions and explicit abstention when evidence is ambiguous. CoreSec combines this algebra with topology-aware configurations that capture failure surfaces across Clos fabrics and converge monotonically as evidence accumulates. Deployed at hyperscale, CoreSec provides stable and explainable RCA behavior across diverse environments without retuning. Our experience shows that structured composition with abstention forms a practical foundation for automated RCA in real-world cloud networks.