🤖 AI

AgenticTwin: An Agentic LLM Framework Integrated with Digital Twin for Anomaly Detection

This paper proposes AgenticTwin, a framework that integrates Large Language Models with digital twin systems to enhance anomaly detection and diagnosis in cyber-physical environments through grounded reasoning and natural language interaction, validated by a new benchmark on synthetic weather sensor data.

Original authors: Touseef Hasan, Mounika Ghanta, Souvika Sarkar, Ujjwal Guin

Published 2026-08-13

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Touseef Hasan, Mounika Ghanta, Souvika Sarkar, Ujjwal Guin

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are the captain of a massive, futuristic spaceship. Your ship is equipped with thousands of sensors that constantly whisper data about the engine temperature, fuel levels, and hull integrity. For years, the ship's computer has been great at shouting, "Alert! Something is wrong!" But it's terrible at explaining why. It's like a smoke alarm that screams but doesn't tell you if the fire is in the kitchen or the engine room. This is the daily struggle for engineers managing "Cyber-Physical Systems"—real-world machines like factories, power grids, or weather stations that are monitored by digital computers. To make sense of these alarms, engineers often rely on "Digital Twins," which are like perfect, virtual clones of the real machine that run simulations to guess what should be happening. When the real machine deviates from the clone, an alarm sounds. But even with these twins, figuring out the root cause of a glitch is still a messy, manual job that requires human experts to stare at endless spreadsheets.

Enter Large Language Models (LLMs), the same kind of AI that can write poems, chat with you, and solve riddles. Scientists have been wondering: "What if we gave the Digital Twin a brain that can actually talk?" Could an AI not just say "Something is broken," but also explain, "The temperature sensor is drifting because it's old, and here's how to fix it"? The challenge is that these AI brains can sometimes make things up (a problem called "hallucination") if they don't have the right facts, and they can be too heavy and slow for small, real-world devices. This paper steps into that gap, asking if we can build a smarter, lighter system that combines the precision of a Digital Twin with the conversational power of AI to help humans fix broken machines faster and more accurately.

The researchers behind this study, Touseef Hasan and his team, propose a new system called AgenticTwin. Think of AgenticTwin not as a single, giant super-brain trying to do everything at once, but as a small, highly organized team of specialized robots working together in a control room. When a Digital Twin detects a weird pattern in the data, it doesn't just dump the raw numbers on a human; it passes the case to this team.

The team is made up of four distinct "agents," each with a specific job:

The Diagnosis Agent: This is the detective. It looks at the strange data and asks, "What caused this?" It uses the Digital Twin's predictions to figure out if a sensor is broken, if the data is being tampered with, or if it's just noise.
The Retrieval Agent: This is the librarian. It digs through a history book of past problems to find similar cases. "Hey, remember last time the temperature sensor started drifting? It was because of a calibration issue."
The Mitigation Agent: This is the mechanic. Based on what the detective and librarian found, it suggests a plan of action. "We should recalibrate the sensor" or "Switch to the backup system."
The Supervisor Agent: This is the team leader. It listens to all the others, checks that their stories match up, and writes the final report for the human operator.

To test if this team approach actually works, the researchers didn't just guess; they built a rigorous testing ground. They took a real-world weather dataset from a station in Germany, which tracks temperature, dew point, and humidity. Then, they played "doctor" with the data, injecting 12,000 fake "sicknesses" into it. These sicknesses included sudden spikes (like a sensor jumping), slow drifts (like a sensor slowly losing accuracy), stuck sensors (frozen on one number), and replay attacks (where old data is pasted over new data). They created a "Knowledge Base"—a structured manual of what these specific faults look like and how to fix them—and fed it to their AI team.

The results were quite revealing. When the researchers tested their "team of specialists" against a single, giant AI model trying to do all the jobs at once (a "monolithic" approach), the team won hands down. Even though the team was made of smaller, lighter AI models (totaling 18 billion parameters), they outperformed a massive 70-billion-parameter model that tried to do everything alone. The team's "Diagnosis" and "Mitigation" scores were significantly higher, suggesting that breaking a complex problem into smaller, specialized tasks helps the AI reason better.

Crucially, the paper shows that giving these AI agents access to the "Knowledge Base" (the manual of facts) made a huge difference. For the smaller, open-source AI models, adding this knowledge boosted their performance by over 30% in some cases. It's like giving a smart student a textbook right before a test; they suddenly become much more accurate. The study suggests that you don't need a massive, expensive, super-computer AI to manage complex systems. Instead, a coordinated team of smaller, lightweight AI agents, grounded in real data and historical facts, can provide clearer, more reliable answers to human operators.

The authors are careful to note that this is a simulation and a controlled experiment using synthetic data injected into real weather records. They haven't deployed this on a nuclear power plant or a live factory floor yet, but the results strongly suggest that this "agentic" approach is a promising path forward. It offers a way to make Digital Twins not just observers, but helpful, talking partners that can explain the "why" and "how" of machine failures, potentially making our complex, automated world safer and easier to manage.

Technical Summary: AgenticTwin

Problem Statement

Digital Twins (DTs) are widely used to monitor and simulate Cyber-Physical Systems (CPS), yet traditional anomaly detection pipelines suffer from a critical lack of interpretability. While these systems can accurately flag anomalous events, they fail to provide actionable explanations regarding why an anomaly occurred, what underlying mechanisms contributed to it, or how to mitigate it. Consequently, skilled human operators must manually analyze raw sensor data and logs, a process that becomes increasingly unmanageable as CPS environments grow more complex and data-intensive.

Furthermore, while Large Language Models (LLMs) offer promising reasoning capabilities, their direct integration into CPS workflows faces significant hurdles:

Hallucinations: LLMs often generate unreliable outputs when lacking access to specific, real-time system context or domain knowledge.
Monolithic Limitations: Single-model frameworks struggle to simultaneously perform diagnosis, mitigation planning, and user interaction within a single prompt, often leading to inconsistent analysis.
Resource Constraints: Many existing approaches rely on large, proprietary models with high computational demands, making them impractical for resource-constrained edge or CPS environments.

Methodology: The AgenticTwin Framework

The authors propose AgenticTwin, an agentic LLM framework integrated with a DT-driven anomaly detection pipeline. Instead of a monolithic approach, the framework decomposes anomaly reasoning into a coordinated multi-agent architecture that operates on structured evidence generated by the DT.

Core Architecture

The workflow begins with a real-time data stream from a physical asset. A Digital Twin estimates the expected system state ( $\hat{x}_t$ ) using a hybrid model combining data-driven regression and physics-guided rules. An anomaly classifier computes the residual ( $r_t = x_t - \hat{x}_t$ ) to detect deviations and generate a structured anomaly event ( $E_t$ ) containing timestamps, observed values, predictions, residuals, and predicted labels.

This structured event is processed by four specialized LLM agents:

Diagnosis Agent (DA): Analyzes $E_t$ and a curated Anomaly Knowledge Base (KB) to identify root causes and explain the underlying factors of the anomaly.
Retrieval Agent (RA): Queries a historical Anomaly Repository to find and rank past cases with similar anomaly patterns, providing contextual evidence.
Mitigation Agent (MA): Synthesizes the diagnosis, retrieved historical evidence, and KB taxonomy to recommend specific corrective actions.
Supervisor Agent (SA): Coordinates the outputs of the other agents, ensuring consistency and synthesizing a unified, coherent response for the human operator.

Benchmark Construction

To evaluate the framework, the authors constructed a benchmark-oriented dataset by injecting four types of synthetic anomalies (Spike, Drift, Stuck-at, and Replay) into a real-world weather sensor dataset (temperature, dew point, relative humidity) from the Beutenberg weather station. This benchmark includes 12,000 synthetic operator queries and reference responses generated using a state-of-the-art proprietary model (Gemini 2.5 Pro) to facilitate controlled evaluation of diagnosis, retrieval, and mitigation reasoning.

Key Contributions

AgenticTwin Framework: A novel agentic LLM architecture that integrates DT predictions, anomaly diagnosis, historical retrieval, and mitigation reasoning. It enables interpretable anomaly analysis in CPS using lightweight, open-source LLMs.
Specialized Benchmark: A dataset constructed by injecting synthetic anomalies into real-world weather data, featuring structured operator queries and reference responses to evaluate LLM reasoning capabilities in a controlled setting.
Comparative Assessment: An extensive evaluation comparing agentic architectures against monolithic LLM baselines across various model sizes (from 0.5B to 70B parameters) and deployment settings (with and without the Knowledge Base).

Experimental Results

The study evaluated 15 LLMs, including open-source models (Qwen, Llama, Gemma, Phi, DeepSeek) and a proprietary baseline (GPT-5.5).

Impact of Knowledge Grounding: Access to the curated Anomaly Knowledge Base significantly improved reasoning quality. On average, the Diagnosis Agent's semantic similarity score increased by 22.3% and the Mitigation Agent's by 26.3%. Lightweight models (e.g., Qwen 0.5B, Gemma 1B) showed the most substantial relative gains (up to 43.5%), narrowing the performance gap with larger models.
Agentic vs. Monolithic: The AgenticTwin framework, utilizing a total of 18B parameters distributed across three specialized agents (3B, 7B, and 8B), outperformed all monolithic baselines, including the 70B parameter Llama 3.3.
- Diagnosis: AgenticTwin achieved a similarity score of 0.93, compared to 0.70 for the best monolithic baseline (a 32.9% improvement).
- Retrieval: AgenticTwin achieved an MRR of 0.95, compared to 0.74 for the baseline (a 28.4% improvement).
- Mitigation: AgenticTwin achieved a similarity score of 0.92, compared to 0.78 for the baseline (a 17.9% improvement).
Classifier Performance: The underlying anomaly classifier (using an MLP) achieved high accuracy (F1-score of 0.98 for single-fault and 0.94 for multi-fault scenarios), ensuring reliable structured inputs for the LLM agents.

Significance and Claims

The paper claims that AgenticTwin demonstrates that decomposing complex anomaly reasoning into specialized, collaborative agents allows for superior performance compared to monolithic approaches, even when using significantly smaller, open-source models.

The authors assert that:

Task Specialization: Breaking down reasoning into diagnosis, retrieval, and mitigation allows the system to process task-specific evidence more effectively than a single model attempting to handle all tasks simultaneously.
Resource Efficiency: Lightweight, open-source LLMs, when grounded in structured domain knowledge (the KB) and historical data, can achieve high-quality reasoning suitable for resource-constrained CPS environments.
Interpretability: The framework successfully bridges the gap between raw anomaly detection and actionable human understanding, providing operators with grounded explanations and mitigation strategies without relying on computationally expensive proprietary models.

The work concludes that combining DT-based system modeling with lightweight, agentic LLMs offers a practical and scalable path toward interpretable decision support in cyber-physical systems.