Think Locally, Explain Globally: Graph-Guided LLM Investigations via Local Reasoning and Belief Propagation

TL;DR

This paper tackles open-ended operational diagnosis by reframing it as abductive reasoning over an explicit operational graph. It introduces Explanations over Graphs (EoG), a disaggregated architecture where a bounded local LLM performs evidence mining while a deterministic controller, guided by a Context Contract, manages traversal and belief propagation through Semantic Belief Propagation. A core contribution is the separation of concerns and an explicit, mutable belief state that enables non-monotonic revision as new evidence arrives, addressing reliability and order-sensitivity issues observed in ReAct-style agents. Empirical evaluation on ITBench demonstrates substantial gains in accuracy and run-to-run consistency, including large increases in Majority@$k$ across diverse models, while reducing token usage. The work has practical impact for deploying robust, auditable AI-driven diagnostics in production IT environments and offers a general blueprint for graph-guided, abductive reasoning with LLMs.

Abstract

LLM agents excel when environments are mostly static and the needed information fits in a model's context window, but they often fail in open-ended investigations where explanations must be constructed by iteratively mining evidence from massive, heterogeneous operational data. These investigations exhibit hidden dependency structure: entities interact, signals co-vary, and the importance of a fact may only become clear after other evidence is discovered. Because the context window is bounded, agents must summarize intermediate findings before their significance is known, increasing the risk of discarding key evidence. ReAct-style agents are especially brittle in this regime. Their retrieve-summarize-reason loop makes conclusions sensitive to exploration order and introduces run-to-run non-determinism, producing a reliability gap where Pass-at-k may be high but Majority-at-k remains low. Simply sampling more rollouts or generating longer reasoning traces does not reliably stabilize results, since hypotheses cannot be autonomously checked as new evidence arrives and there is no explicit mechanism for belief bookkeeping and revision. In addition, ReAct entangles semantic reasoning with controller duties such as tool orchestration and state tracking, so execution errors and plan drift degrade reasoning while consuming scarce context. We address these issues by formulating investigation as abductive reasoning over a dependency graph and proposing EoG (Explanations over Graphs), a disaggregated framework in which an LLM performs bounded local evidence mining and labeling (cause vs symptom) while a deterministic controller manages traversal, state, and belief propagation to compute a minimal explanatory frontier. On a representative ITBench diagnostics task, EoG improves both accuracy and run-to-run consistency over ReAct baselines, including a 7x average gain in Majority-at-k entity F1.

Figures (8)

• Figure 1: The reliability gap between Pass@$k$ (success in at least one run) and Majority@$k$ (success in the majority of runs). Large gaps indicate stochastic success rather than consistent reasoning.
• Figure 2: Exploration pathology in ReAct agents. (a) Failure to reach the causal entity. (b) Failure to fetch relevant evidence. (c) Correlation between exploration breadth and success. These patterns support modeling diagnosis as iterative graph traversal with bounded context fetching at each hop.
• Figure 3: Controller brittleness in ReAct agents. (a) Plan abandonment rate: frequency with which agents discard stated investigation plans. (b) Tool repetition rate: percentage of tool calls that duplicate previous invocations. (c) Tool failure categories: distribution of syntactic vs. semantic errors.
• Figure 4: Impact of oracle reordering (i.e., presenting relevant entities/evidence earlier in the exploration sequence) on majority@k.
• Figure 5: Semantic Belief Propagation architecture, illustrated with the worked example (§\ref{['sec:example']}). Left: The topology graph $G$ is incomplete---the $S_2 \to S_3$ dependency is not registered; additional services ($S_5$--$S_7$) are uninvolved (healthy). An alert on $S_2$ seeds the ActiveSet. Center: The active inference loop: pop from ActiveSet, fetch context, classify via policy, update state. New discoveries or belief changes add nodes back to ActiveSet. Right: The output explanatory graph $G_S$ with the discovered edge (dashed) and final beliefs. Origin nodes use double circles; symptom nodes use hatched fill. The frontier $\mathcal{F} = \{S_1\}$ identifies the flash sale as the true origin.