System Error Propagation Graph (SEPG)

• System Error Propagation Graph (SEPG) is a graph-based abstraction that models how an initiating error propagates through interconnected system components, leading to downstream failures.
• It employs varied graph structures—such as directed graphs and hypergraphs—to capture error channels in digital circuits, autonomous vehicles, cloud services, and AI systems.
• Empirical findings demonstrate SEPG’s efficacy through metrics like MAE and R², offering actionable insights for improving system reliability and diagnostic processes.

Searching arXiv for recent and foundational papers on System Error Propagation Graphs and closely related error-propagation graph models. System Error Propagation Graph (SEPG) denotes a graph-based abstraction for representing how an initiating error, fault, or attack propagates through an interconnected system and produces downstream error states, functional failures, or physical-world consequences. In the literature, the term is used explicitly for gate-level soft-error analysis in digital circuits, as an abstraction for attack-error-impact reasoning in autonomous vehicles, and as a practical error-propagation graph for code-level root-cause reconstruction in cloud services; closely related directed-graph models also appear in robotic navigation, industrial fault diagnosis, cascading-failure analysis, and staged AI-system reliability modeling (Balakrishnan et al., 2021, Zhang et al., 14 Sep 2025, Pu et al., 30 Sep 2025, Hu et al., 8 Feb 2026, Teruzzi et al., 2023, Guo et al., 12 Mar 2025, Pan et al., 18 Mar 2026).

1. Conceptual scope

At its most general, an SEPG organizes propagation structure rather than isolated error events. The common idea is that an upstream perturbation is rarely terminal at the point of injection: it traverses intermediate components, is filtered or amplified by system structure, and may eventually appear as a downstream functional error, execution error, or safety impact. In circuit reliability, this is expressed as a graph whose nodes are gates and flip-flops and whose edges preserve signal directionality from inputs to outputs (Balakrishnan et al., 2021). In autonomous-vehicle security, the SEPG is a structured demonstration tool for tracing sensor attacks through internal error states to physical-world consequences (Zhang et al., 14 Sep 2025). In cloud service systems, the reconstructed propagation path is a sequence of functions linked by error wrapping, returning, rethrowing, or cross-service transfer (Pu et al., 30 Sep 2025).

The abstraction is useful precisely because propagation is not purely local. In biplanar X-ray-guided robotic navigation, installation-induced structural perturbations introduced at the perception stage are progressively amplified along the perception reconstruction execution chain and dominate execution level error and tail risk behavior (Hu et al., 8 Feb 2026). In AI systems with sequential functional stages, upstream errors may propagate to downstream stages, ultimately affecting overall system reliability (Pan et al., 18 Mar 2026). In industrial plants and power systems, directed graphs are used to capture fault or failure interactions that are not reducible to static physical topology alone (Teruzzi et al., 2023, Guo et al., 12 Mar 2025).

A plausible implication is that SEPG is best understood as a family of graph-based system models rather than a single canonical formalism. The literature preserves the same analytical intent—explicit representation of admissible propagation channels—while varying node semantics, edge semantics, and quantitative annotations according to domain.

2. Graph structures and formal semantics

In gate-level soft-error analysis, the circuit netlist is transformed into a directed graph,

$G = (\nu, \varepsilon),$

where vertices represent gates and flip-flops and edges represent circuit connections between gates or flip-flops, preserving directionality from inputs to outputs (Balakrishnan et al., 2021). The graph-based abstraction inherently captures the SEPG: nodes are potential fault origin or destination points, and edges are channels for error propagation. The same work maps the extracted netlist to a Probabilistic Bayesian Graph in GML format through a custom Verilog Procedural Interface-based extraction pipeline (Balakrishnan et al., 2021).

In autonomous-vehicle sensor-attack analysis, the SEPG is formalized as a directed hypergraph,

$\graph = (\nodes, \transitions),$

with disjoint node sets for Physical Attack Vectors, Errors of System Components, and Physical-World Consequences (Zhang et al., 14 Sep 2025). Transitions are directed hyperedges and are typed as attack-to-error, error-to-error, and error-to-impact. Nodes are further enriched with attributes such as Precision, Continuity, Intensity, DynamicTarget, DynamicImpact, DistanceImpactToTarget, and ScenarioDependence; transitions carry preconditions and postconditions expressed as Boolean conditions over source and target attributes (Zhang et al., 14 Sep 2025). Under this formulation, a path from an attack node to an impact node is feasible only when all transition preconditions are satisfied.

In cloud service systems, propagation is represented over a function call graph,

$\mathcal{G} = (\mathcal{F}, \mathcal{E}),$

where an edge indicates that one function calls another (Pu et al., 30 Sep 2025). The error path is defined as a sequence

$\langle f_n, f_{n-1}, \ldots, f_1 \rangle,$

where $f_n$ is the function that logs the error and $f_1$ is the originator. The recovered path is a subgraph through the SEPG from error source to the log emission point (Pu et al., 30 Sep 2025).

In staged AI-system reliability modeling, the graph is stage-wise rather than code- or topology-centric: nodes denote modules at different stages, and edges represent potential error propagation paths from upstream modules to downstream modules (Pan et al., 18 Mar 2026). This suggests that the defining property of an SEPG is not any specific graph class, but the explicit encoding of propagation admissibility across system structure.

3. Propagation mechanisms and quantitative models

A central quantitative formulation appears in single-event-upset analysis of digital circuits. For flip-flop $i$, the Functional Failure Rate per SEU is modeled as

$$FFR_{i,seu} = FIT_{i,seu} \cdot \prod_{j \in T,L,F}DR_{ij},$$

with aggregate circuit-level rate

$FFR_{seu} = \sum_{i \in FF} FFR_{i,seu}.$

The derating factors quantify Temporal, Logical, and Functional masking, so the product captures compounded masking effects in various domains (Balakrishnan et al., 2021). The SEPG interpretation here is probabilistic: propagation along graph structure is filtered by masking before a fault becomes an observable functional failure.

In robotic navigation, error propagation is modeled analytically across projection matrix estimation, triangulation, and coordinate mapping. For first-order uncertainty propagation, the covariance of an output parameter vector is approximated by

$\Sigma_f \approx J_f \, \Sigma_a \, J_f^T,$

and analogous Jacobian-based forms are used for projection matrices and triangulated targets (Hu et al., 8 Feb 2026). Because the pipeline is strongly nonlinear and exhibits error coupling, Monte Carlo simulation is used to characterize tail-risk such as 95th percentile and higher worst-case errors (Hu et al., 8 Feb 2026). The paper states that system-level error is not a simple superposition of installation error and perception noise.

In AI-system reliability, propagation is modeled by a multivariate point process. For module $\graph = (\nodes, \transitions),$0 at stage $\graph = (\nodes, \transitions),$1, the total conditional intensity is decomposed into primary and propagated components:

$\graph = (\nodes, \transitions),$2

with propagated intensity parameterized as

$\graph = (\nodes, \transitions),$3

Here $\graph = (\nodes, \transitions),$4 is the EP strength and $\graph = (\nodes, \transitions),$5 is the decay rate of the propagation effect in time (Pan et al., 18 Mar 2026). This formulation separates intrinsic stage-specific failures from downstream failures triggered by upstream events.

A related but more combinatorial perspective appears in zero forcing. There, any error in the sampled entries $\graph = (\nodes, \transitions),$6 affects the error of $\graph = (\nodes, \transitions),$7 exponentially in the propagation time, with worst-case amplification bounded by

$\graph = (\nodes, \transitions),$8

where $\graph = (\nodes, \transitions),$9 is the propagation time (Kenter et al., 2017). The same work introduces the error polynomial vector and variance polynomial vector as finer measures of vertex-wise error amplification (Kenter et al., 2017). This is not presented as the canonical SEPG formalism, but it supplies a precise graph-theoretic vocabulary for propagation depth and amplification.

4. Construction and inference methodologies

SEPG construction is domain-dependent and often hybrid. In circuit analysis, the pipeline begins from gate-level abstractions extracted from the netlist. A custom Verilog Procedural Interface maps the netlist to graph form, and GraphSAGE is then used as a scalable and inductive type representation learning algorithm on graphs for extracting structural features of the gate-level netlist (Balakrishnan et al., 2021). The method samples $\mathcal{G} = (\mathcal{F}, \mathcal{E}),$0-hop neighborhoods with $\mathcal{G} = (\mathcal{F}, \mathcal{E}),$1, aggregates local neighborhood information, and outputs a feature matrix $\mathcal{G} = (\mathcal{F}, \mathcal{E}),$2 used by a downstream fully-connected DNN to predict $\mathcal{G} = (\mathcal{F}, \mathcal{E}),$3 (Balakrishnan et al., 2021). The pooling aggregator is written as

$\mathcal{G} = (\mathcal{F}, \mathcal{E}),$4

In cloud services, ErrorPrism combines static analysis with an LLM agent. Its pipeline comprises code repository static analysis, log template extraction, and error propagation tracking (Pu et al., 30 Sep 2025). Static analysis builds the function call graph, extracts error-related string constants from SSA, and constructs a constant transitive closure

$\mathcal{G} = (\mathcal{F}, \mathcal{E}),$5

with $\mathcal{G} = (\mathcal{F}, \mathcal{E}),$6 typically used as the call depth limit (Pu et al., 30 Sep 2025). The LLM agent then performs an iterative backward search in a BFS manner, starting from the log-generating function and using tools such as view_callee_closure(function), check_function_code(function), and fuzzy_search_in_closure(keyword) (Pu et al., 30 Sep 2025).

In autonomous-vehicle security analysis, SEPG construction may be manual, automated, or hybrid. Experts identify the attack entry, internal error states, and physical-world consequences, annotate node attributes and transition conditions, and then compare or refine these graphs with LLM-generated candidates (Zhang et al., 14 Sep 2025). The workflow described is: input attack scenario and pipeline architecture to the LLM with prompts introducing the SEPG schema; obtain a structured graph; perform expert review and refinement; and use an automated checker to parse the graph for unmet conditions, feasibility bottlenecks, and underexplored attack paths (Zhang et al., 14 Sep 2025). The paper reports that LLM outputs generally satisfied the SEPG schema, surfaced additional error nodes or scenario factors missed by humans in about 60% of cases, and were used as a baseline for expert review (Zhang et al., 14 Sep 2025).

In AI-system reliability, inference centers on latent source attribution rather than graph extraction. Each observed error event is assigned a latent indicator specifying whether it is primary or triggered by an upstream event, and parameters are estimated by a composite likelihood expectation-maximization algorithm (Pan et al., 18 Mar 2026). The method is described as computationally efficient, theoretically guaranteed, and capable of reducing computational complexity from quadratic to linear in number of events (Pan et al., 18 Mar 2026).

5. Representative applications and empirical findings

The literature uses SEPGs and SEPG-like models in several distinct technical settings.

Setting	Graph semantics	Reported result
Digital circuit soft errors	Gates and flip-flops as vertices; circuit connections as directed edges	MAE $\mathcal{G} = (\mathcal{F}, \mathcal{E}),$7, $\mathcal{G} = (\mathcal{F}, \mathcal{E}),$8, test/training time $\mathcal{G} = (\mathcal{F}, \mathcal{E}),$9 minutes (Balakrishnan et al., 2021)
Biplanar robotic navigation	Multi-stage geometric chain from reference structure to TCP error	Rot. $\langle f_n, f_{n-1}, \ldots, f_1 \rangle,$0: mean $\langle f_n, f_{n-1}, \ldots, f_1 \rangle,$1 mm, P95 $\langle f_n, f_{n-1}, \ldots, f_1 \rangle,$2 mm; Rot. $\langle f_n, f_{n-1}, \ldots, f_1 \rangle,$3: mean $\langle f_n, f_{n-1}, \ldots, f_1 \rangle,$4 mm, P95 $\langle f_n, f_{n-1}, \ldots, f_1 \rangle,$5 mm (Hu et al., 8 Feb 2026)
Cloud microservices	Functions as nodes; wrapping/returning/cross-service transfer as propagation relations	97.0% accuracy on 102 real-world errors across 67 production microservices (Pu et al., 30 Sep 2025)
Autonomous-vehicle sensor attacks	Directed hypergraph from attack nodes through error nodes to impact nodes	Seven key findings and eleven previously overlooked attack vectors (Zhang et al., 14 Sep 2025)

In the 10-Gigabit Ethernet MAC (IEEE 802.3) circuit with 1100 flip-flops across multiple functional blocks, the GraphSAGE + DNN framework was trained using about 40% of the data and evaluated on a 60% hold-out set (Balakrishnan et al., 2021). The reported Mean Absolute Error is 0.0186 and the Coefficient of Determination is 0.96. The same framework predicts Functional Failure Rate in less than 10 minutes of test or training time and requires 1 Modelsim instance versus up to 7 for exhaustive fault injection (Balakrishnan et al., 2021).

In reference-based robotic navigation, rotational installation error is identified as a primary driver of system-level error amplification, while translational misalignment of comparable magnitude plays a secondary role under typical biplanar geometries (Hu et al., 8 Feb 2026). Real bench-top experiments are reported to confirm that the predicted amplification trends persist under realistic imaging conditions (Hu et al., 8 Feb 2026). The reported summary table gives mean and P95 execution errors for Rot. $\langle f_n, f_{n-1}, \ldots, f_1 \rangle,$6, Rot. $\langle f_n, f_{n-1}, \ldots, f_1 \rangle,$7, and Trans. 1–5 mm (Hu et al., 8 Feb 2026).

In production microservices at ByteDance, ErrorPrism achieves 97.0% accuracy in reconstructing paths for 102 real-world errors across 67 production microservices (Pu et al., 30 Sep 2025). The detailed summary also reports average inference time per error of about 5.93 seconds and notes that the method outperformed existing static analysis and LLM-based approaches (Pu et al., 30 Sep 2025). Here the SEPG is not a hardware or physical-system graph; it is a code-level causal path that converts a flattened wrapped error log into an end-to-end diagnostic chain.

In the autonomous-vehicle security survey, the SEPG is used to expose the conditions and dependencies that determine attack feasibility (Zhang et al., 14 Sep 2025). The study reports seven key findings, identifies eleven previously overlooked attack vectors exploiting inter-module interactions, validates several of these through proof-of-concept experiments, and demonstrates that LLMs can automate aspects of SEPG construction and cross-validate expert analysis (Zhang et al., 14 Sep 2025).

6. Related models, misconceptions, and analytical boundaries

Several recurrent misconceptions are directly challenged by the literature. One is that local mean-error control is sufficient for system reliability. The robotic navigation study states that traditional component-wise error models are inadequate because they focus on local mean errors and ignore system-level coupling and amplification; it further argues for moving from mean error metrics to tail-risk evaluation (Hu et al., 8 Feb 2026). Another is that propagation is additive. The same work states that system-level error is not a simple superposition of installation error and perception noise (Hu et al., 8 Feb 2026).

A third misconception is that comparable graph-theoretic solutions are interchangeable once they have the same size or nominal depth. In zero forcing, different zero forcing sets can have the same size and propagation time yet produce different error and variance growth, and the optimal set depends on whether the criterion is worst-case absolute error or variance (Kenter et al., 2017). This suggests that, for SEPG-informed design, minimizing graph size or propagation depth alone need not minimize amplification.

SEPG also sits within a broader ecosystem of directed propagation graphs that are not identical to the term but are methodologically adjacent. Industrial fault-diagnosis work uses weighted, directed graphs with SOURCE, USER, HUB, and SWITCH nodes, logical edge relations SINGLE, AND, OR, and a recursive fault-propagation procedure based on predecessors and redundancy (Teruzzi et al., 2023). Cascading-failure analysis in power systems constructs a left stochastic interaction matrix $\langle f_n, f_{n-1}, \ldots, f_1 \rangle,$8 over failure states, with directed edges weighted by empirical conditional probabilities and eigen-analysis used to identify persistent, trivial, and transient modes of failure propagation (Guo et al., 12 Mar 2025). These frameworks do not define SEPG in the same way as the autonomous-vehicle hypergraph or the gate-level circuit graph, but they demonstrate that the essential analytical problem—capturing directionality, conditioning, and amplification of downstream failures—extends across application domains.

A plausible implication is that SEPG should be treated as a systems-analysis viewpoint rather than a single mature standard. The literature already supports multiple instantiations: deterministic or probabilistic edges, ordinary directed graphs or directed hypergraphs, symbolic path reconstruction or continuous-time intensities, and manual or AI-assisted graph construction. What remains consistent is the insistence that reliability, diagnosis, and safety analysis require explicit modeling of how upstream errors traverse structure, interact with masking or conditioning, and become downstream failures.