Conditional Attribution for Root Cause Analysis in Time-Series Anomaly Detection

Abstract: Root cause analysis (RCA) for time-series anomaly detection is critical for the reliable operation of complex real-world systems. Existing explanation methods often rely on unrealistic feature perturbations and ignore temporal and cross-feature dependencies, leading to unreliable attributions. We propose a conditional attribution framework that explains anomalies relative to contextually similar normal system states. Instead of using marginal or randomly sampled baselines, our method retrieves representative normal instances conditioned on the anomalous observation, enabling dependency-preserving and operationally meaningful explanations. To support high-dimensional time-series data, contextual retrieval is performed in learned low-dimensional representations using both variational autoencoder latent spaces and UMAP manifold embeddings. By grounding the retrieval process in the system's learned manifold, this strategy avoids out-of-distribution artifacts and ensures attribution fidelity while maintaining computational efficiency. We further introduce confidence-aware and temporal evaluation metrics for assessing explanation reliability and responsiveness. Experiments on the SWaT and MSDS benchmarks demonstrate that the proposed approach consistently improves root-cause identification accuracy, temporal localization, and robustness across multiple anomaly detection models. These results highlight the practical utility of conditional attribution for explainable anomaly diagnosis in complex time-series systems. Code and models will be publicly released.

• The paper introduces a conditional attribution framework that improves RCA by comparing anomalies with contextually similar normal states using learned manifolds such as VAE and UMAP.
• It mitigates attribution bias from traditional methods by ensuring counterfactuals remain on-manifold and quantifies explanation fidelity with metrics like CW-RCS and TemporalHM.
• Empirical validation on industrial benchmarks demonstrates significant gains in accuracy, attribution confidence, and temporal resolution across diverse anomaly scenarios.

Conditional Attribution for Root Cause Analysis in Time-Series Anomaly Detection

Introduction

Root cause analysis (RCA) is a central requirement for deploying anomaly detection systems in multivariate, safety-critical time-series scenarios where actionable diagnosis depends on reliable identification of sources underlying detected anomalies. Standard feature attribution methods for RCA, such as SHAP and LIME, are largely unsuitable for industrial time-series due to their marginal, independence-based perturbations, leading to out-of-distribution explanations and implausible causal claims. The presented work advances the field by formalizing and operationalizing a conditional attribution paradigm, which generates explanations by conditioning on contextually similar normal system states in a learned manifold. This framework addresses both the curse of dimensionality and the necessity for physically realistic counterfactuals, introducing new metrics for attribution reliability and responsiveness and validating the approach on established industrial benchmarks and an extensive real-world case study.

Conditional Attribution Framework

The central methodological innovation is to explain detected anomalies by comparing them against contextually relevant, normal system states, rather than arbitrary marginal samples. This is accomplished through an architecture consisting of three main stages:

1. Latent-Space Neighborhood Construction: System windows are embedded into a learned low-dimensional representation using either a VAE encoder or a UMAP manifold (Figure 1).
2. Conditional Attribution Computation: Given an anomalous window, its conditional neighborhood is retrieved by finding the $K$ nearest (contextually similar) normal windows, and counterfactual replacements are performed conditioning on the current context.
3. Temporal Root Cause Localization: Attribution is computed not only at the sensor level but also temporally, identifying both which sensors and when deviations emerge.

   Figure 1: Overview of the proposed model-agnostic RCA pipeline. Steps include latent-space neighborhood construction, conditional attribution computation, and temporal root cause localization for multivariate industrial sensors.

This design directly mitigates the attribution bias inherent to marginal perturbations by bounding the resulting error in terms of the Wasserstein-1 distance between marginal and conditional distributions, ensuring that explanation fidelity is tightly coupled to the system's true dependency structure.

Representation-Guided Contextual Retrieval

Direct nearest neighbor retrieval in raw input space is infeasible in high-dimensional settings due to noise and irrelevant features disrupting similarity structure. Instead, conditional neighborhoods are constructed in learned latent spaces:

• VAE Latent Representation: The VAE encoder projects windows into a Gaussian latent space, capturing nonlinear system dependencies while facilitating scalable (low-dimensional) neighborhood retrieval.
• UMAP Manifold Representation: UMAP preserves local topology, ensuring that neighborhoods reflect intrinsic geometric relations in the data rather than mere Euclidean proximity.

The topology analysis (Figure 2) demonstrates that normal and anomalous states can overlap significantly in the manifold, underscoring the necessity for localized contextual baselines.

Figure 2: SWaT Manifold Topology ($d \in \{4,8,16,32\}$). Normal (green) and anomalous (red) regions exhibit significant overlap, justifying conditional, context-dependent attribution.

This approach ensures counterfactuals remain on-manifold, eliminating OOD artifacts common in featurewise or marginal perturbations.

Attribution Computation and Temporal Localization

By selectively replacing the target sensor’s trajectory in an anomaly window with those from the conditional neighborhood—while fixing the context—the conditional effect of that sensor can be isolated. Attribution aggregation across sensors and across temporal slices within a window yields both sensor-level and temporally-localized explanations. This structured attribution map supports fine-grained diagnosis of both which sensor and when anomalous influence emerges.

Rigorous Evaluation: Confidence-Aware and Temporal Metrics

The work introduces two metrics addressing deficiencies in extant RCA assessment protocols:

• CW-RCS (Confidence-Weighted Root Cause Score): Quantifies not only whether ground-truth causal sensors appear among the top-$K$ ranking but the concentration of attribution strength allocated to them, penalizing diffuse explanations.
• TemporalHM: A harmonic measure of both the latency (early identification) and consistency (persistence) with which root causes are detected during an anomaly.

These metrics go beyond simple ranking recall, capturing the operational requirements for actionable industrial diagnosis and enabling more rigorous benchmarking.

Empirical Results: Industrial and Synthetic Validation

Experimental analysis reveals several properties:

• RCA Accuracy: On SWaT and MSDS, both conditional variants (CondAttr-VAE and CondAttr-UMAP) significantly outperform model-agnostic and causal baselines (ShaTS, KernelSHAP, CIRCA), yielding substantial improvements in Top-3 recall and CW-RCS (Table values in paper).
• Confidence Concentration: Conditional methods nearly double CW-RCS scores over marginal baselines, indicating less attribution noise and stronger separation between true causes and spurious correlations.
• Model-Agnostic Consistency: Performance remains robust across a spectrum of anomaly detectors (AE, VAE, LSTM, TCN, Transformer), validating the method’s broad applicability.

Empirical results are further corroborated by targeted synthetic perturbation stress tests (Figures 6–12), demonstrating precise recovery across spike, shift, noise, drift, saturation, and dropout anomalies.

Figure 3: Spike anomaly—Feature 58 exhibits a transient perturbation simulating a brief sensor surge; attribution is precisely localized.

Figure 4: Spike anomaly on Feature 58. Sudden large abnormal values are simulated.

Figure 5: Shift anomaly on Feature 26. Synthetic constant offsets shift the baseline, attributed to the correct sensor.

Figure 6: Noise anomaly on Feature 22. Mild random perturbations are accurately differentiated from background.

Figure 7: Drift anomaly on Feature 45. Slow baseline drift is temporally tracked and attributed.

Figure 8: Saturation anomaly on Feature 3. Signal clipping at sensor limits is robustly localized.

Figure 9: Signal dropout anomaly on Feature 11. Complete signal interruption is flagged at onset.

The capability to recover the true root causes under such diverse perturbation conditions confirms the practical diagnostic value of conditional attribution.

Industrial Case Study: Blast Furnace Monitoring

Application to real blast furnace sensor data (Figure 10) under the supervision of domain experts from Paul Wurth demonstrates operational utility. The method enables reliable identification of both real and synthetic anomaly drivers, supporting timely, fine-grained interventions to reduce downtime and resource wastage.

Figure 10: Root cause feature heatmaps for representative Paul Wurth samples. True anomalous sensors are clearly separated from unaffected variables; synthetic anomaly drivers are localized with high precision.

This study further validates the framework’s transferability beyond academic benchmarks to mission-critical, heterogeneous environments.

Comparative Insights: Retrieval and Attribution Strategy

• Retrieval Quality: Latent and manifold space retrieval attains substantially higher CW-RCS than input-space retrieval (Figure 11), confirming that meaningful conditional neighborhoods require learned representation spaces.

  Figure 11: Comparison of retrieval performance across spaces. Latent and manifold retrieval secures higher attribution fidelity than raw input-based methods.

• Conditional vs. Unconditional Retrieval: Conditional attribution yields attributions with higher locality and reduced false positives compared to unconditional methods (Figure 12).

  Figure 12: Unconditional versus conditional retrieval. Conditioning on relevant context suppresses noisy attribution and produces operationally actionable heatmaps.

Theoretical and Practical Implications

The presented conditional attribution framework establishes a new standard for interpretability in high-dimensional, temporally dependent time-series systems. By ensuring explanations are both faithful and physically plausible, the approach aligns anomaly detection outputs with operational needs of industrial practitioners. The framework’s model-agnostic, scalable design ensures portability across diverse monitoring settings and underlying detector architectures. Introduction of CW-RCS and TemporalHM offers benchmarks that are necessary for future explainability research in multivariate monitoring and control systems.

Notable claims and results:

• The method documents consistent, substantial gains in both recall and confidence-aware RCA accuracy compared to existing causal and attribution-based explanations.
• Attribution bias induced by marginal perturbations is theoretically shown to be bounded by the Wasserstein distance between conditional and marginal distributions, which is minimized by the proposed context-based sampling scheme.

Future Directions

Future research may extend the conditional attribution framework toward:

• Online and Incremental Learning: Adapting retrieval and attribution logic to nonstationary environments with evolving normal behavior.
• Causal Inference Integration: Jointly leveraging learned system manifolds and explicit causal graphs for even higher-fidelity diagnosis.
• Real-Time Industrial Deployment: Comprehensive latency and system integration studies in closed-loop operational settings.

Conclusion

The conditional attribution framework represents a principled, scalable, and model-agnostic approach for root cause analysis in complex multivariate time-series anomaly detection. By grounding explanations in contextually similar, on-manifold normal system states, the method overcomes core limitations of prior marginal perturbation baselines. Empirical and industrial validation demonstrates marked improvements in accuracy, attribution confidence, and temporal responsiveness, establishing this paradigm as baseline methodology for physically grounded anomaly interpretability in critical systems.