{"id":"2c8bce37-afb2-4146-812a-02f01da9e7b4","arxiv_id":"2412.11800","paper_version":4,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"Temporal causal graphs can be learned from binary alarm flags with 99% data compression and modest accuracy gains using heuristic modifications to PCMCI.","lead":"This paper presents AnomalyCD, a method that learns cause-effect graphs from binary alarm-flag data in large monitoring systems. It compresses sparse flag sequences and prunes edges to cut computation time while modestly improving graph accuracy on CMS and IT monitoring datasets.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Accuracy gain on EasyVista may be an artifact of excluding self-loop edges, which PCMCI outputs and the reference graph penalizes.","rationale":"The paper has genuine strengths: the computational-efficiency claim is supported by concrete measurements (99.76% compression on HCAL, 55% on EasyVista) and public code, and the framework addresses a real practical problem. The reader's verdict of CONDITIONAL is reasonable. My specific concern sharpens the reader's weakest assumption: rather than only worrying about spurious cross-sensor edges from omitted self-lags, the more immediate and testable issue is that the accuracy comparison is confounded because standard PCMCI outputs self-loop edges that the summary reference graph necessarily penalizes, while AnomalyCD removes them by construction. The observed precision/recall trade-off in Table 9 is consistent with this artifact, and the ablation does not isolate it. This is a fixable evaluation issue, not a broken derivation, so the verdict remains CONDITIONAL rather than REJECT. However, if the proposed test shows the F1 gain vanishes, the accuracy half of the central claim would need to be withdrawn, leaving only the efficiency contribution.","tokens_in":31130,"tokens_out":6955,"duration_ms":61901,"concrete_test":"Run AnomalyCD on the EasyVista dataset with self-lag edges allowed, i.e., remove the j != i restriction in Eq. (10) and Algorithm 3 while keeping ANAC, sparse handling, and edge pruning unchanged, then recompute F1, SHD, and SHDU. If the F1 falls from 0.364 to approximately 0.302, the reported accuracy improvement is fully attributable to the self-lag exclusion rather than to the proposed anomaly-aware causal modeling.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central accuracy claim (abstract; Section 5.2, Table 9: F1 0.302 PCMCI vs 0.364 AnomalyCD) is not isolated from the prior link assumption in Section 4.2.2 and Algorithm 3, which excludes self-lag causality (PA_i in X_j(t-s) for all j != i). Standard PCMCI estimates lagged self-dependencies and, when aggregated to the summary graph used for evaluation, these become self-loops. The EasyVista reference graph (Figure 14) is a summary causal graph without self-loops, so any self-loop edge in a competitor's output counts as a false positive. AnomalyCD's precision gain (0.182 to 0.250) at recall cost (0.889 to 0.667) is exactly the pattern expected from deleting self-loops, not from better causal structure. The ablation in Table 9 varies ANAC, sparse handling, and pruning but never allows self-lags back, so it cannot show that the gain survives once both methods are scored on a graph where self-loops are either present in the reference or removed from both outputs. If the gain is only self-loop removal, the moderate enhancement of accuracy part of the central claim collapses; only the computational-efficiency claim remains.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes AnomalyCD, a pipeline for temporal causal discovery on binary anomaly-flag time series. It combines an online univariate anomaly detector, sparse-data compression that retains only the first lm samples of each uniform flag region, a PCMCI-based graph learner using a positive-partial-correlation CI test (ANAC), a prior-link handler that excludes self-lag and non-overlapping edges, and post-hoc pruning of multi-lag and bidirected edges. The method is evaluated on HCAL readout-box sensor data and on the public EasyVista IT monitoring dataset. The authors report that compression reduces the HCAL data by 99.76% and the EasyVista data by 55%, lowers PCMCI skeleton runtime from about 34.6 s at lm=30 to 19.0 s at lm=10, and improves F1 on EasyVista from 0.302 (PCMCI) to 0.364 (AnomalyCD). The central claims are considerable computational savings and a moderate accuracy improvement for causal discovery from binary anomaly flags.","tokens_in":31496,"tokens_out":7073,"duration_ms":65299,"significance":"If the accuracy comparison is made fair, this would be a useful practical contribution to root-cause analysis on alarm-flag data: the compression idea is simple, the runtime measurements are concrete, the EasyVista comparison covers 16 baseline methods, and the authors provide code. The computational-efficiency claim is well supported. However, the accuracy claim is currently entangled with a modeling assumption that excludes self-lag causality, and the HCAL accuracy table has missing entries at the main operating point. Because the accuracy improvement is the weaker and less established half of the contribution, the paper should be revised before the accuracy claim is accepted.","major_comments":[{"comment":"The reported F1 gain over PCMCI is confounded by the prior link assumption that excludes self-lag causality. The EasyVista reference graph in Figure 14 is a summary graph with no self-loops, whereas the PCMCI baseline can output lagged self-dependencies; after temporal-to-summary aggregation, those self-loops count as false positives. AnomalyCD's change relative to PCMCI (precision 0.182 to 0.250, recall 0.889 to 0.667) is exactly the pattern expected from deleting self-loops. The ablation in Table 9 never scores a variant that keeps self-lags and removes them symmetrically from both outputs, so the reader cannot tell how much of the 0.302 to 0.364 F1 gain is a scoring artifact. Since binary anomaly flags are persistent by construction, excluding self-lags can also attribute a variable's own persistence to other sensors and create spurious cross-sensor edges. Please add an experiment in which self-loops are treated symmetrically in all methods, or the reference graph includes self-loops, so the accuracy gain can be evaluated independently of this assumption.","section":"§4.2.2 (Algorithm 3), §5.2 (Table 9, Figure 14)"},{"comment":"The HCAL experiment does not support the accuracy half of the computational-accuracy tradeoff at the main operating point. Table 4 reports APRC and SHD for lm=10, the setting used for the 99.76% compression claim, as dashes, and it does not state what reference graph the APRC and SHD scores are computed against. Without a specified reference, these scores only measure agreement among the algorithm's own outputs at different compression lengths. Please specify the reference graph and provide the missing lm=10 accuracy values, or explicitly limit the HCAL claim to computational savings plus qualitative graph plausibility.","section":"§5.1.2, Table 4"},{"comment":"The accuracy evaluation uses a normal-operation causal graph (Figure 14) as the reference, while the method learns an anomaly-regime graph from binary flags whose anomalies are all collective with the same appearance time and duration (Section 3.2). The authors acknowledge this mismatch in the discussion, but it still weakens the accuracy claim: agreement with a normal-operation graph is not the same as accuracy on the anomaly-regime graph. A synthetic experiment with known ground-truth anomaly-regime edges, persistence, and lags would substantially strengthen the claim; without it, the accuracy improvement should be described as agreement with a normal-operation reference rather than as causal graph accuracy per se.","section":"§3.2, §5.2"}],"minor_comments":[{"comment":"The running header contains the typo 'A CHIEVING'; the title should read 'Achieving Computational Efficiency'.","section":"Title and running header"},{"comment":"The text says the joint distribution is the sum of all CPDs in the network, but Eq. (4) is a product; please correct the wording.","section":"§2.3, Eq. (4)"},{"comment":"The symbol ατ is used for the trend-drift threshold in Table 3 and for the overlap-strength threshold in Algorithm 3; please use distinct symbols to avoid confusion.","section":"Table 3 and Algorithm 3"},{"comment":"The function name 'CompressBinayData' should be 'CompressBinaryData'.","section":"Algorithm 2"},{"comment":"The SHD definition is informal; please define the binary adjacency matrices G and H explicitly so that N(i,j) is a clear count of mismatched edges.","section":"Eq. (12)"}],"recommendation":"major_revision","confidential_remarks":"The main risk to the paper's central accuracy claim is the self-loop scoring artifact described in the major comments. If the additional symmetric-scoring experiment shows the F1 gain persists, the paper would be suitable for publication. The computational-efficiency contribution is solid on its own. The heavy citation of the authors' own AD models is understandable because those models are inputs to the framework, not part of the reported comparison."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the computational claim is real and well supported; the accuracy claim is not yet convincing because the EasyVista evaluation penalizes self-loops that PCMCI outputs and AnomalyCD excludes by design.\n\nWhat's genuinely new: the sparse compression trick (keep first lm samples in each uniform state region) is simple, effective, and takes the HCAL dataset from ~400K to ~900 samples while cutting PCMCI runtime roughly in half. The positive-association CI test, prior-link compression, and pruning are incremental but sensible for binary alarm flags. The comparison against 16 methods with an ablation is more thorough than most applied causal-discovery papers, and the code is public.\n\nThe soft spot is the accuracy evaluation. The reference graph (Figure 14) is a summary causal graph from normal operation with no self-loops. PCMCI outputs lagged self-dependencies; when the authors aggregate temporal edges to a summary graph for scoring, those become self-loops, which are counted as false positives. AnomalyCD's prior-link assumption (Section 4.2.2, Algorithm 3) explicitly excludes self-lags, so it gets a free precision boost (P from 0.182 to 0.250) at a recall cost (0.889 to 0.667). The ablation in Table 9 never re-enables self-lags, so it cannot separate this artifact from genuine gains from pruning or the CI test. This is fixable: either drop self-loops from all methods' outputs before scoring, or include them in the reference if the reference should have them. Until then, the 'moderate enhancement of accuracy' part of the central claim is not established. Note that the paper itself says the reference graph is from normal operation, which may differ from anomaly graphs, and indeed the overall F1 scores are low across all methods.\n\nMinor points: no error bars, HCAL has no ground truth, and the EasyVista AD threshold is set post hoc to include noise outliers. None of these undermine the computational contribution.\n\nVerdict: worth a serious referee. The authors have an engineering result that can be useful in practice, but the accuracy comparison needs revision. I'd ask them to rerun the comparison with a consistent self-loop policy and report summary-graph scores both with and without self-loops.","headline":"Solid computational-efficiency result for causal discovery on sparse binary flags, but the accuracy comparison is likely biased by treating PCMCI's self-loops as false positives.","tokens_in":31956,"tokens_out":5320,"would_cite":false,"duration_ms":48452,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that temporal causal graphs can be learned from sparse binary anomaly flags by compressing uniform regions, excluding self-lag and non-overlapping links, and testing only anomaly-triggering positive associations.","keywords":["causal discovery","binary anomaly flags","time series","sparse data compression","PCMCI","Bayesian network inference","root cause analysis","HCAL monitoring"],"falsifier":"Generate a synthetic binary time series from a known graph in which each sensor's flag at time $t$ depends on its own flag at $t-1$ and on one cross-sensor cause, then run AnomalyCD with self-lags excluded; if the learned graph contains spurious cross-sensor edges that are absent from the generating DAG, the self-lag exclusion is the cause and the central accuracy claim does not transfer to self-persistent alarm streams.","tokens_in":30965,"feed_emoji":"🔍","tokens_out":7707,"duration_ms":68810,"temperature":0.7,"pith_summary":"Binary alarm flags are what large monitoring systems actually emit, yet causal discovery methods treat them poorly: the flags are sparse, the 0-to-1 transition is the meaningful event, and long uniform regions make standard tests slow. This paper proposes AnomalyCD, which compresses uniform flag regions, prunes self-lag and non-overlapping links, uses a transition-aware conditional independence test, and adjusts spurious cyclic edges. The central claim is that this pipeline makes temporal causal discovery on binary anomaly data considerably cheaper and modestly more accurate: on the Hadron Calorimeter readout-box stream the compression cuts roughly 400K samples to about 900, and on the public IT dataset the ablation improves F1 over plain PCMCI from 0.302 to 0.364. If the claim holds, root-cause analysis on alarm streams in large physics and industrial systems becomes practical at scale.","feed_headline":"Alarm-stream causal graphs get ~400x cheaper via compression","feed_subtitle":"A transition-aware pipeline lifts F1 over the PCMCI baseline from 0.302 to 0.364 and prunes spurious edges.","key_machinery":"The load-bearing mechanism is the sparse-data handler in Algorithm 2: it detects stretches where every sensor's anomaly flag is unchanged (all 0 or all 1), keeps only the first $l_m$ samples of each stretch, with $l_m$ set slightly larger than the causal search horizon $\\tau_{\\max}$, and discards the rest. This shrinks the Hadron Calorimeter stream from roughly 400K to about 900 samples and the public IT stream by 55%. Around this sit three further mechanisms: the prior-link assumption that drops self-lag edges and non-overlapping links, reducing the PCMCI conditional-independence load from $O(n'(N\\tau_{\\max})^2)$ to $O(n'\\sum_i N_i' \\tau_{\\max}^2)$; the anomaly-aware CI test (ANAC), which uses partial correlation on residuals and keeps only positive associations so that causality is read from 0 to 1 flag transitions rather than from lingering one-runs; and a pruning step that keeps the strongest or earliest lag for cyclic links and orients residual undirected edges with a chi-square test so the final object is a DAG suitable for Bayesian-network inference.","core_discovery":"The paper claims that causal structure can be recovered from binary anomaly flags by treating flag transitions, not raw associations, as the signal, and by aggressively compressing long runs of unchanged flags. AnomalyCD combines an anomaly-aware conditional independence test called ANAC, which uses partial correlation on residuals and keeps only positive associations corresponding to anomaly occurrence; a sparse data handler that compresses uniform 0/0 or 1/1 regions while preserving a short prefix of each region so time-lag structure survives; a prior-link assumption that excludes self-lag edges and non-overlapping edges, cutting the PCMCI link-search space; and a post-processing pruning step that removes cyclic and bidirected edges and orients remaining undirected edges with a chi-square test. On the public IT dataset the full pipeline improves F1 over plain PCMCI from 0.302 to 0.364, and with directed edge orientation precision rises from 0.182 to 0.333. On the Hadron Calorimeter data, the learned graph links temperature anomalies to Peltier regulator responses in a way that matches the physical circuit.","pith_inferences":["Beyond the paper, the self-lag exclusion deserves a direct test: because anomaly flags persist by construction, a sensor's own past flag is a strong predictor of its current flag, and removing that edge may push explained variance onto overlapping sensors; a synthetic experiment with known self-causal flags would isolate this effect.","Beyond the paper, the 99.76% compression suggests event-based causal discovery, which treats 0-to-1 transitions as point events, as a complementary route; AnomalyCD keeps a short prefix of uniform regions, but a point-process formulation could drop the prefix altogether and reduce the data even further.","Beyond the paper, the accuracy numbers on the public dataset may understate real performance: the reference graph describes normal operation, while anomaly-induced graphs can differ, so a larger fraction of the recovered edges may be true anomaly-specific causality than the F1 reflects."],"forward_implications":["Operators can run graph learning on alarm streams that were previously too large: the Hadron Calorimeter stream's roughly 400K samples compress to about 900, and PCMCI skeleton learning completes in under 19 seconds on a laptop-class CPU.","Root-cause queries become quantitative: the Bayesian network built on the pruned graph computes conditional anomaly probabilities, such as $P(\\text{Q1T}=1 \\mid \\text{Q2T}=1)$ rising from 0.05 to 0.90 at lag zero, giving operators ranked suspects.","The compression step is a general preprocessing layer: most of the 12 comparison methods improve on compressed data, with an average relative F1 gain of 18.31% when two underperforming methods are excluded, so compressed binary flags help other causal learners, not only AnomalyCD.","Anomaly-induced graphs can differ from normal-operation graphs: on the public IT dataset AnomalyCD ranks near the top among the compared methods even though the scoring reference graph describes normal operation, not the anomaly regime."],"supporting_citations":[{"why":"Supplies the PCMCI algorithm that AnomalyCD builds on; the baseline whose runtime and accuracy the ablations compare against.","marker":"[24]"},{"why":"Provides the complexity model for constraint-based time-series causal discovery that motivates the sparse-data and prior-link compression.","marker":"[22]"},{"why":"Supplies the collective-anomaly setup and the reference causal graph used to score all methods on the public IT dataset.","marker":"[31]"},{"why":"Provides the public IT monitoring dataset on which the benchmark and ablation results are computed.","marker":"[64]"},{"why":"Spectral-residual saliency method adopted by the online anomaly detector that produces the binary flags fed into causal discovery.","marker":"[70]"},{"why":"Seasonal-trend decomposition used to separate trend and residual components for temporal outlier and drift detection.","marker":"[66]"}],"fun_headline_variants":["Binary alarm flags: compressed to reveal causes 400x faster","Causal discovery from alarm flags: 400x speedup, better F1","Flag-transition causality: compression cuts compute 400x","AnomalyCD: binary flags to causal graphs, 400x cheaper","Flag-transition signals cut causal discovery cost 400x"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The framework assumes that a sensor's own past anomaly flag is not a cause of its current flag and that only temporally overlapping sensor flags can be causally related; if flag persistence is self-generated, the graph may misattribute that persistence to other sensors.","fun_headline_variants_meta":{"raw":{"variants":["Binary alarm flags: compressed to reveal causes 400x faster","Causal discovery from alarm flags: 400x speedup, better F1","Flag-transition causality: compression cuts compute 400x","AnomalyCD: binary flags to causal graphs, 400x cheaper","Flag-transition signals cut causal discovery cost 400x"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001126,"raw_usage":{"total_tokens":4712,"prompt_tokens":1006,"completion_tokens":3706,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":622,"completion_tokens_details":{"reasoning_tokens":3615}},"tokens_in":622,"tokens_out":3706,"duration_ms":22557,"temperature":1.0,"reasoning_tokens":3615,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T14:33:46.207680+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Generate a synthetic binary time series from a known graph in which each sensor's flag at time $t$ depends on its own flag at $t-1$ and on one cross-sensor cause, then run AnomalyCD with self-lags excluded; if the learned graph contains spurious cross-sensor edges that are absent from the generating DAG, the self-lag exclusion is the cause and the central accuracy claim does not transfer to self-persistent alarm streams.","supporting_citations":[{"cited_title":"Discovering contemporaneous and lagged causal relations in autocorrelated nonlinear time series datasets,","cited_arxiv_id":null,"evidence_quote":"Supplies the PCMCI algorithm that AnomalyCD builds on; the baseline whose runtime and accuracy the ablations compare against."},{"cited_title":"Causal network reconstruction from time series: from theoretical assumptions to practical estimation,","cited_arxiv_id":null,"evidence_quote":"Provides the complexity model for constraint-based time-series causal discovery that motivates the sparse-data and prior-link compression."},{"cited_title":"Root cause identification for collective anomalies in time series given an acyclic summary causal graph with loops,","cited_arxiv_id":null,"evidence_quote":"Supplies the collective-anomaly setup and the reference causal graph used to score all methods on the public IT dataset."},{"cited_title":"EasyRCA IT monitoring dataset,","cited_arxiv_id":null,"evidence_quote":"Provides the public IT monitoring dataset on which the benchmark and ablation results are computed."},{"cited_title":"Time-series anomaly detection service at Microsoft,","cited_arxiv_id":null,"evidence_quote":"Spectral-residual saliency method adopted by the online anomaly detector that produces the binary flags fed into causal discovery."},{"cited_title":"STL: a seasonal-trend decomposition,","cited_arxiv_id":null,"evidence_quote":"Seasonal-trend decomposition used to separate trend and residual components for temporal outlier and drift detection."}],"review_version":1}