An Explainable GNN Framework for Component-Level Anomaly Diagnosis

The paper proposes XS2C (eXplainable Sensor-to-Component), an explainable Graph Neural Network (GNN)-based anomaly detection and diagnosis framework that shifts the perspective from sensor-level anomalies to component-level diagnosis. The core hypothesis is that anomalous measurements are symptoms of altered inter-sensor influences rather than faults originating from the sensors themselves. The authors argue that in many industrial systems, anomalies do not arise from faulty sensors but from disruptions in the influences governing the system dynamics, and that functional sensors may then produce anomalous measurements due to perturbations.

The framework is built on two key hypotheses: (1) In normal conditions, sensor measurements are consistent with the underlying system relationships, and (2) Under faulty conditions, sensor functionality remains intact, with abnormal sensor measurements resulting from system faults. An anomaly in a sensor measurement is a symptom.

The methodology consists of three main components:

1. Graph Construction: The framework uses Neural Granger Causality (NGC) to construct a directed causal graph from normal training data. A component-wise MLP (cMLP) models each sensor, and group-lasso penalties are applied to learn causal relationships. The causal scores are converted into a directed graph by retaining source sensors whose causal scores exceed a row-wise quantile threshold.

2. GNN-based Anomaly Detection: The framework adapts the Graph Deviation Network (GDN) architecture for attention-based forecasting. Each sensor is represented with global embedding vectors, and attention coefficients are computed for message passing. Unlike GDN's max-based system-level thresholding, XS2C adopts a sensor-wise thresholding strategy where each sensor gets its own anomaly threshold based on a target positive prediction rate. Symptoms are identified by computing anomaly occurrence for each sensor during the faulty period and finding the largest gap between consecutive occurrence values.

3. Anomaly Diagnosis: This component bridges with consistency-based model-based diagnosis (MBD) theory. The system is defined by (SD, COMPS, OBS) where SD is the causal graph, COMPS are the graph influences (edges), and OBS are symptomatic labels. The framework fine-tunes the normal model on test data containing anomalies to create a fault model that learns abnormal behavior. Attention changes are computed as absolute differences of average attentions between pre- and post-finetuning states. Path search using depth-first search identifies minimal conflict sets, and minimal hitting sets (computed via MaxSAT formulation using the Hitman solver through PySAT) correspond to minimal diagnoses. Diagnoses are ranked by the average attention changes of their constituent influences.

The experiments evaluate XS2C on two benchmarks: the Tennessee Eastman Process (TEP) chemical process dataset and the Secure Water Treatment (SWaT) dataset. For anomaly detection, XS2C achieves the best overall performance on TEP compared to baselines (GDN, MTAD-GAT, CST-GL), with substantially improved performance across most fault scenarios compared with the GDN. On SWaT, it remains competitive with slightly better F1 and MCC scores.

For diagnosis, two TEP case studies are presented. For IDV1 (a step change in A/C feed ratio), the top-ranked diagnoses highlight influences associated with the stream-4 feed mechanism and its downstream propagation, with the A feed flow (x25) appearing in diagnoses through its perturbed influence even though it is not a symptom. For IDV14, the highest-ranked diagnosis e32,9 directly links the reactor cooling water flow x32 to the reactor temperature x9, suggesting the fault originates from the reactor cooling water valve system. For SWaT, the diagnosis of a valve closure attack identifies the influence eP302,DPIT301 between the ultra filtration feed pump and differential pressure transmitter as having the largest attention variation, consistent with hydraulic and backwash dynamics being perturbed.

The authors conclude that XS2C produces physically coherent and interpretable diagnoses that localize the disturbed process components/regions underlying system faults. Future work includes improving anomaly detection performance, validating on real-world systems, weakening Hypothesis 2 to include faulty sensors via self-attention coefficients, and sensitivity analysis regarding numerical non-determinism in training.

Improvement 1: Causality-Aware Root Cause Localization in Complex Systems

The improved AI system can construct dynamic causal graphs from multivariate time-series data using Neural Granger Causality with group-lasso penalties, then diagnose system faults at the component or interaction level rather than sensor level. It can identify which specific inter-sensor influences (edges) are perturbed, even when the affected sensor itself shows no anomaly, by fine-tuning a normal model on anomalous data and measuring attention shifts. This enables root cause localization in chemical plants, water treatment facilities, or power grids, where a single faulty valve or pump can cause cascading sensor anomalies.

Improvement 2: Explainable Anomaly Detection with Per-Sensor Thresholding

The improved system can replace global, system-level anomaly thresholds with sensor-wise thresholds calibrated to a target positive prediction rate. This reduces false positives for sensors with naturally high variance and improves detection of subtle, localized faults. The system can also output a ranked list of symptomatic sensors with their anomaly occurrence gaps, providing interpretable evidence for why a specific time window is flagged as faulty.

Improvement 3: Minimal Diagnosis via Model-Based Reasoning with Attention Weights

The improved AI system can bridge data-driven GNNs with formal model-based diagnosis (MBD). It can compute minimal conflict sets from the causal graph and derive minimal hitting sets using MaxSAT solvers, then rank these diagnoses by the average attention change of their constituent influences. This yields physically coherent, minimal explanations (e.g., the fault is caused by the influence from reactor cooling water flow to reactor temperature) that are directly actionable for maintenance, rather than opaque anomaly scores.

Improvement 4: Transferable Fault Model Learning from Normal Data

The improved system can fine-tune a pre-trained normal-condition GNN on a short window of test data containing anomalies, effectively learning a fault model without needing labeled fault examples. This enables rapid adaptation to novel fault types in real time, making it suitable for online monitoring where fault labels are scarce or unknown. The attention differences between normal and fault models serve as a robust, interpretable signature of the underlying disturbance.

Improvement 5: Robustness to Non-Faulty Sensor Noise

By explicitly modeling that functional sensors may produce anomalous measurements due to system perturbations, the improved system can distinguish between sensor malfunctions and genuine system faults. This reduces maintenance costs by avoiding unnecessary sensor replacements and focuses diagnostics on process components (e.g., valves, pumps, reactors) that actually require intervention.

What the improved AI system can do specifically:

• Given a multivariate time-series from an industrial process, it can output: (a) a causal graph of inter-sensor influences, (b) a per-sensor anomaly timeline with individual thresholds, (c) a ranked list of minimal diagnoses (e.g., edge from sensor A to sensor B is the most likely fault source), and (d) a confidence score based on attention shift magnitude.

• It can operate in both offline (post-incident analysis) and online (streaming) modes, with fine-tuning on the fly.

• It can handle datasets with up to hundreds of sensors, as demonstrated on TEP and SWaT, and scale to larger systems via graph sparsification and quantile-based edge selection.