SPARCE: Sparse Counterfactual Attribution via Gradient-Guided Diffusion for Time-Series Root Cause Analysis

We introduce a novel approach to root cause analysis (RCA) in multivariate time-series anomaly detection, the task of identifying which features are responsible for a fault, not merely that one occurred. Our key observation is that identifying the sensors responsible for an anomaly can be framed as finding the minimal sparse edit to an anomalous window that restores it to the normal data manifold. Existing attribution methods rely on marginal feature perturbations or finite nearest-neighbor retrieval. Both produce out-of-distribution counterfactuals that violate the conditional dependencies inherent in real monitoring systems. We propose SPARCE (SParse Attribution via Reverse diffusion Counterfactual Explanation), which approximates this minimal-edit problem by injecting gradient-based guidance into the reverse process of a conditional score-based diffusion model trained exclusively on normal system behaviour. At each denoising step, the guidance jointly optimizes a denoising-consistency regularizer that steers the restoration toward normal behaviour and L1 sparsity penalty that encourages concentrated sensor edits. The root-cause attribution map emerges as the pointwise difference between the anomalous input and the diffusion-restored output, providing a jointly coherent explanation without per-sensor inference passes. SPARCE attributes observable deviations, which under propagation include downstream sensors, and is model-agnostic with respect to the anomaly detection backbone. We give sufficient conditions under which the attribution readout separates the deviating sensors. Experiments on SWaT, WADI, MSDS, and SMD demonstrate that SPARCE achieves state-of-the-art performance across Top-K Recall, CW-RCS, and TemporalHM metrics, improving Top-3 Recall by 13.2% over the strongest baseline on SWaT.