Skip to content

TopoEvo: A Topology-Aware Self-Evolving Multi-Agent Framework for Root Cause Analysis in Microservices

🕒 Published (v1): 2026-05-15 04:45 UTC · Source: Arxiv · link

Why this paper was selected

TopoEvo: topology-aware self-evolving multi-agent framework for root cause analysis

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

TopoEvo is a multi-agent framework for microservice root cause analysis (RCA) that couples graph-based representation learning with topology-constrained LLM reasoning to counter symptom-amplification bias—the tendency of topology-agnostic agents to blame the most visibly broken downstream service rather than the upstream initiator. It introduces discrete "symptom tokens" via vector quantization to ground LLM reasoning in auditable, propagation-consistent evidence, and adds a self-evolving mechanism for robustness under topology drift.

Problem

LLM-based RCA agents operating on microservice telemetry (metrics, logs, traces) are topology-agnostic: they over-trust the most salient downstream symptoms produced by failure propagation, causing systematic misattribution (symptom-amplification bias). Simultaneously, autoscaling and rolling updates induce non-stationary topology drift that breaks static models and fixed reasoning heuristics. Existing approaches also fuse heterogeneous modalities naively, yielding unstable representations from mismatched sparsity/frequency/noise profiles.

Method

TopoEvo chains five components:

  1. Multimodal preprocessing: Metrics → TCN+MLP patches (\(x^{\text{metric}}_v \in \mathbb{R}^{E_m}\)); traces → dilated CNN+MLP; logs → Drain3 templates + PF-IDF projector.

  2. Metric-Orthogonal Multimodal Alignment (MOMA): Metric embeddings are decomposed into two orthogonal components \(u_v = W_u x^{\text{metric}}_v\) and \(v_v = W_v x^{\text{metric}}_v\), regularized by \(\mathcal{L}_\perp = \sum_{v \in B} \frac{u_v^\top v_v}{\|u_v\|_2 \|v_v\|_2 + \epsilon}\). Logs and traces are contrastively aligned (InfoNCE) to these complementary subspaces to prevent modal collapse and reduce redundancy.

  3. GAT topology encoder: A Graph Attention Network encodes the homogeneous directed service-dependency graph (nodes, services, pods flattened) with fused modality embeddings, producing topology-aware node representations \(h_v^{(L)}\).

  4. VQ-based Symptom Vocabulary: \(h_v\) are vector-quantized against a learnable codebook \(\mathcal{C} = \{c_k\}_{k=1}^K\) via \(q_v = \arg\min_k \|h_v - c_k\|_2^2\); each code \(k\) is mapped to a structured SYMPTOM_TOKEN(k) = {ID, SUMMARY, EVIDENCE_SIGNATURE} aggregating dominant KPI bands, log template burst scores, trace interaction patterns, and neighbor topology context. The VQ loss uses stop-gradient: \(\mathcal{L}_\text{vq} = \sum_v \|\text{sg}[h_v]-\hat{h}_v\|_2^2 + \beta\|h_v - \text{sg}[\hat{h}_v]\|_2^2\).

  5. Hypothesis–Evidence–Test (HET) multi-agent workflow: A Hypothesis Planner generates a small set (\(\leq H_\text{max}\)) of topology-consistent, verifiable hypotheses from top-\(K\) candidates and their \(H\)-hop candidate-centric subgraph. Three modality-specific agents (metric, log, trace) return structured evidence tied to subgraph entities. A Judge Agent verifies each hypothesis against three constraints: temporal precedence, path consistency, and template consistency; it explicitly eliminates strong alternatives and reports the top-4 rejected hypotheses with reasons.

  6. Self-Evolving Mechanism: Maintains a hierarchical incident memory (compact fingerprints, validated hypotheses, mitigations) with similarity-aware forgetting. High-confidence pseudo-labels from new incidents drive conservative test-time adaptation of the graph encoder and alignment objectives under distribution shift.

Key Contributions

  • MOMA: Orthogonal decomposition of metric embeddings into log-aligned and trace-aligned subspaces, combined with InfoNCE contrastive loss, reducing modality redundancy and sparsity.
  • Topology-aware symptom tokenization: VQ discretization of GAT states into an auditable symptom vocabulary enabling compact, retrievable, topology-scoped evidence for LLM reasoning.
  • HET multi-agent workflow: Explicit hypothesis generation under topology constraints → tool-grounded structured evidence collection → constraint-based verification (temporal precedence, path consistency, template consistency) with explicit alternative elimination.
  • Self-evolving adaptation: Hierarchical incident memory with similarity-aware forgetting + conservative test-time adaptation via high-confidence pseudo-labels for OOD robustness under topology drift.

Results

  • Evaluated on a public AIOps benchmark and a real-world production incident dataset.
  • Root cause localization accuracy: up to +3.44% absolute improvement over state-of-the-art baselines.
  • Fault-type classification: +4.39% to +16.81% absolute improvement across diverse datasets.
  • Specific baseline names and per-dataset breakdowns are not fully reproduced in the provided text excerpt.

Limitations

  • The paper text is truncated; the full ablation and self-evolving mechanism details are not available for evaluation.
  • The 3.44% localization gain is modest in absolute terms; fault-type gains vary widely (4.39%–16.81%), suggesting dataset-dependent performance.
  • Symptom vocabulary construction relies on training-time clustering; effectiveness of cold-start tokens for genuinely novel fault types is not addressed in the visible text.
  • The homogeneous graph flattening of multi-level entities (node/service/pod) discards explicit inter-level structural hierarchy, relying on categorical type features instead.
  • Test-time adaptation with pseudo-labels introduces risk of label noise propagation under severe drift, but the "conservative" regularization mechanism is not fully detailed.

Relevance to Harnesses / Meta-Harnesses

TopoEvo is a concrete instance of a structured multi-agent harness: it decomposes a complex diagnostic pipeline into typed specialist agents (planner, modality collectors, judge) coordinated by a well-defined artifact protocol (structured JSON hypotheses, evidence signatures, VQ tokens), directly instantiating the harness pattern of staged fan-out with a verification/aggregation pass. The Hypothesis Planner + Judge pair functions as a meta-level controller that governs which sub-agents query what, in what order, and how their outputs are adjudicated — analogous to an orchestrator/worker split in general meta-harnesses. The self-evolving mechanism further adds a persistent memory layer that refreshes the harness's knowledge base and adapts its encoder between runs, demonstrating how a harness can maintain long-run coherence across distributional shifts without requiring full retraining.