← Latest papers
📊 statistics

Distribution-free root cause analysis

This paper introduces Conformal Root Cause Analysis (CROC), a distribution-free framework that constructs finite-sample valid confidence sets for identifying the earliest changing data stream in multi-stream systems under minimal assumptions, while also extending to handle cross-stream dependence and achieving asymptotically sharp localization.

Original authors: Rohan Hore, Aaditya Ramdas

Published 2026-05-22
📖 6 min read🧠 Deep dive

Original authors: Rohan Hore, Aaditya Ramdas

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are the manager of a large, busy restaurant. You have 10 different monitors tracking different parts of the operation: the kitchen temperature, the speed of the waiters, the noise level in the dining room, the number of complaints, and so on.

Suddenly, the customers start complaining. Something is wrong. But which monitor is the root cause? Did the kitchen overheat first, causing the waiters to rush? Or did the waiters get slow first, causing the kitchen to panic?

In the real world, these "monitors" are data streams (like server logs, financial indicators, or customer feedback). The problem is that you don't know exactly when or how the system broke, and you certainly don't know the exact mathematical rules governing the data.

This paper introduces a new tool called CROC (Conformal Root Cause Analysis) to solve this mystery without needing to guess the rules of the game.

The Core Problem: Finding the First Domino

When a system breaks, a change usually starts in one place (the "root") and then ripples out to other places. The authors define the root-cause index as simply the stream that changed first. If you can find the first domino to fall, you've found the source of the problem.

The challenge is that the data is messy. It might be images, text, or numbers. It might change in weird ways. Traditional methods often require you to assume the data follows a specific pattern (like a bell curve), which is often wrong in real life.

The Solution: The "Fair Shuffle" (Conformal P-values)

The authors' method, CROC, relies on a clever trick called conformal p-values. Here is the analogy:

Imagine you suspect the "Kitchen Monitor" was the first to change. To test this, you play a game of "What If?"

  1. You take all the data from the Kitchen Monitor.
  2. You shuffle (permute) the data points within the "before" period and within the "after" period, but you keep the two periods separate.
  3. You ask: "If I shuffle the data randomly, does it look as strange as the actual data I observed?"

If the real data looks much more unusual than the shuffled versions, it's strong evidence that a real change happened at that specific time. If the shuffled data looks just as strange, then the change might just be random noise.

CROC does this mathematically for every possible "first change" scenario across all your monitors.

How CROC Works (The Three Steps)

1. The "Plausibility Score" (The Detective's Intuition)
First, the method needs a way to measure how "suspicious" a specific time looks. The authors call this a CPP score.

  • Analogy: Think of this as a "suspicion meter." You can plug in any detective's intuition here. If you know the data is Gaussian (bell-shaped), you use a Gaussian score. If it's images, you use a score that looks at pixel changes. The beauty of CROC is that it works no matter what score you choose, as long as you follow the rules.

2. The "Fair Shuffle" Test (The Conformal Step)
For every possible time a change could have happened, CROC performs the "Fair Shuffle" described above. It generates a p-value.

  • Simple translation: A p-value is a probability score. A low score (e.g., 0.01) means "It is very unlikely this happened by chance; a real change likely occurred here." A high score (e.g., 0.9) means "This looks like random noise."

3. The "Root Cause" Hunt (Aggregation)
Now, CROC looks at all the monitors. It asks: "For Monitor A, is there any time where the change looks real and happens before the changes in Monitor B, C, and D?"
It aggregates the scores to create a Confidence Set.

  • The Result: Instead of saying "Monitor A is definitely the culprit," it gives you a list of suspects that could be the culprit, with a guarantee: "We are 95% sure the true root cause is in this list."

Why This Paper is Special

1. It Doesn't Need to Know the Rules (Distribution-Free)
Most detective work requires you to know the "laws of physics" for your data (e.g., "the temperature must follow a normal distribution"). CROC doesn't care. It works whether your data is text, images, or weird financial numbers, as long as the data points within a time period are somewhat interchangeable (exchangeable).

2. It's Mathematically Guaranteed (Finite-Sample Validity)
Many statistical methods only work if you have a huge amount of data. CROC works even with small datasets. The paper proves mathematically that if you set your confidence level to 95%, the true root cause will be in your list at least 95% of the time. No guessing.

3. The "Universal" Property
The authors proved a fascinating fact: Any method you could possibly invent to find a root cause without knowing the data distribution can be rewritten as a version of CROC. It's like saying CROC is the "universal translator" for root-cause analysis. If your method works, CROC can do it too.

4. It Handles "Teamwork" (Cross-Stream Dependence)
Sometimes, monitors influence each other (e.g., the kitchen heat affects the waiter speed). The paper shows how to adapt CROC to handle these connections, ensuring the math stays valid even when the streams aren't totally independent.

The Results (The Experiments)

The authors tested CROC on:

  • Simulated Data: Where they knew the answer. CROC correctly identified the first change even when the signal was weak and the other changes were strong.
  • Image Data (MNIST): They simulated a system where images started getting blurry. CROC correctly identified which "stream" of images got blurry first, even when the blurring was subtle.
  • Sentiment Data: They tested it on reviews from different domains (books, electronics, etc.). When the "books" domain started getting negative reviews first, CROC flagged it as the root cause.

The Bottom Line

CROC is a new, robust tool for finding the source of a problem in a complex system. It doesn't require you to make risky assumptions about your data, it works with small amounts of data, and it gives you a mathematically guaranteed list of suspects. It turns the chaotic job of "guessing what broke first" into a rigorous, fair, and reliable process.

Drowning in papers in your field?

Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.

Try Digest →