Reasoning Language Models for Root Cause Analysis in 5G Wireless Networks

TL;DR

Network engineers spend hours staring at drive-test logs trying to figure out why throughput dropped — was it a bad antenna tilt, interference, a missed handover? This paper turns that diagnostic skill into a fine-tuned LLM. The authors build TeleLogs, a synthetic-but-realistic dataset of 5G troubleshooting cases (8 candidate root causes per case), then show that even strong off-the-shelf reasoning models (DeepSeek-R1-70B, QwQ-32B) score barely 30% on it. Their fix is a two-stage training recipe: supervised fine-tuning on clean reasoning traces produced by a multi-agent pipeline, followed by reinforcement learning (GRPO) that rewards correct final answers. The result is dramatic — a tiny Qwen2.5-1.5B jumps from 11% to 87.5% accuracy, and the 32B version hits 95.9%, while still emitting human-readable step-by-step explanations. The interesting business signal: domain adaptation of a small model crushes raw scale.

Problem & Motivation

Root Cause Analysis (RCA) in mobile networks is the “why did it break” step after monitoring tells you “something broke.” A throughput drop is the symptom; the root cause might be an over-tilted antenna, a co-frequency interfering neighbor, a PCI collision, or a handover that fired too late. Getting this right needs three things at once: domain expertise, causal reasoning, and an explanation an engineer can act on.

The pain with prior approaches is concrete:

• Hand-built fault trees / expert rules. Every new fault scenario needs a new tree. They don’t generalize, they can’t express messy multi-symptom causality, and they’re bottlenecked on scarce expert time.
• Classical ML (decision trees, SVMs, GNNs, Bayesian nets). Better automation, but they’re mostly classifiers — they output a label, not a rationale grounded in system behavior. They also degrade with high-dimensional, multi-symptom inputs and tend to focus on a single base station.
• Off-the-shelf LLMs. They write fluent explanations but “frequently lack the formal rigor, consistency and precision required for decision making.” A model that’s confidently wrong 70% of the time is worse than useless to a network operator.

So the gap is: you want the explanation quality of an LLM plus the correctness of a rule-based system, on a domain (telecom) that base models have never seen enough of. That’s the hole this paper drills into.

What’s New (Core Contribution)

Four things, in increasing order of how much they matter to you as a builder:

1. TeleLogs dataset (before: no public telecom-RCA reasoning benchmark / now: one exists). A synthetic 5G drive-test simulator generates cases with full ground truth: engineering parameters (tilt, azimuth, beam scenario, power, antenna model), user-plane time series (throughput, RSRP, SINR, neighbor cells), one symptom (DL throughput < 600 Mbps), and one of K=8 labeled root causes. Released MIT-licensed on HuggingFace. This is the real reusable asset.

2. Evidence that scale alone fails here (before: “big reasoning model will figure it out” / now: measured 30%). DeepSeek-R1-Distill-70B and Qwen3-32B both land near 30–34%. This justifies domain adaptation rather than just prompting a frontier model — a useful data point when a client asks “can’t we just use GPT?”

3. A multi-agent SFT-data-generation pipeline (before: hand-written CoT traces / now: synthesized + filtered + compressed). Multiple reasoning agents attack each case with different prompting strategies (elimination-based, contradiction-based), an aggregator agent majority-votes the answer and — only if it matches ground truth — rewrites the messy trace into a clean, fixed-format explanation. This is a smart way to bootstrap high-quality training data without armies of annotators.

4. The SFT→GRPO two-stage recipe applied to RCA (before: SFT or RL / now: SFT then RL, measured to compound). Neither stage alone works well for small/medium models; the combination is what unlocks the 7×–8× gains. The recipe itself is borrowed from the broader reasoning-LLM literature, but its application and ablation on a structured-diagnosis task is the contribution.

How It Works (Technically)

The whole system is two pipelines: a data factory (multi-agent generation → SFT data) and a trainer (SFT then GRPO). Let me demystify the math first, then trace one case end to end.

The objective being optimized. The model is a policy π_θ — a fancy name for “the LLM with weights θ, viewed as something that acts by emitting tokens.” Given a prompt q (the troubleshooting case), it generates a reasoning trajectory τ (the chain of thought plus a final boxed answer). A parser σ(τ) pulls the answer out of \boxed{}. The reward is brutally simple:

Eq. 3 — R(τ, c) = 1(σ(τ) = c). In English: reward = 1 if the model’s boxed root cause equals the ground-truth cause, else 0. No partial credit, no reward shaping. The explanation quality is not directly rewarded — it’s induced by the SFT stage.

The training goal (Eq. 4) is to maximize expected reward minus a penalty:

J(θ) = E[R(τ,c)] − β·R(θ), where R(θ) = KL(π_θ ‖ π_ref). Plain English: “get answers right, but don’t drift too far from your starting behavior.” That KL term is a leash — without it, RL can wreck a model’s general fluency to chase reward (reward hacking / mode collapse). β sets the leash length.

Stage 1 — Supervised Fine-Tuning (SFT). You can’t run RL productively from a base model that’s right 11% of the time — the reward signal is too sparse to learn from. SFT fixes that. The loss is ordinary next-token cross-entropy:

Eq. 5 — J_SFT(θ) = −E[ (1/|τ'|) Σ_j log π_θ(τ'_j | q, τ'_{<j}) ]. This says: “for each token τ'_j in the good trace, maximize the probability the model would have generated it given everything before it.” It’s just teaching the model to imitate clean traces token by token. The 1/|τ'| averages over trace length so long traces don’t dominate.

Where do the clean traces τ' come from? The multi-agent factory (Fig. 3):

• M=2 reasoning agents (Qwen3-32B and QwQ-32B) each solve the case with a different strategy — one rules causes out (elimination), one assumes each cause true and looks for contradictions.
• An aggregator does majority voting to pick a trajectory, checks it against ground truth, and if correct, reformats it into the fixed 4-part template F (Data analysis → Root cause analysis → Identification → Summary). This both standardizes the output and strips redundant backtracking, so |τ'| ≪ |τ| — far fewer tokens, which makes SFT more sample-efficient.
• Only correct, reformatted traces enter the SFT set D'. Quality gate built in.

Stage 2 — RL with GRPO. GRPO (Group Relative Policy Optimization) is a cheaper cousin of PPO. The trick that makes it “group relative”: instead of training a separate value network to estimate how good a state is (PPO does this, doubling your model memory), GRPO samples N answers for the same question and uses the group’s own mean/std as the baseline.

Eq. 7 — Â_{i,j} = (r_{i,j} − mean(r_j)) / std(r_j). The advantage of trajectory i is “how much better than the average sibling answer was it.” If you sampled 8 answers and 3 were right, the right ones get positive advantage, the wrong ones negative — normalized by the spread. No value network needed; the group is the baseline.

Eq. 6 — the clipped objective ρ_{i,j}(θ) = min(η·Â, clip(η, 1−ε, 1+ε)·Â) where η = π_θ / π_old is the probability ratio between the updated and pre-update policy. This is the PPO clip: it caps how far one update can push a token’s probability (ε=0.2, so ±20%), preventing a single batch from blowing up the policy. Tokens with positive advantage get reinforced (but not too hard); negative-advantage tokens get suppressed (but not too hard).

In this setup every token in a trajectory gets the same reward (the trajectory-level 0/1), so the model learns “produce reasoning that lands on the right box,” with the KL term keeping the prose coherent.

Architecture & data flow

flowchart TB
  subgraph Factory["SFT Data Factory (offline)"]
    Q[Troubleshooting case q] --> A1[Agent 1: elimination prompting]
    Q --> A2[Agent 2: contradiction prompting]
    A1 --> AGG[Aggregator: majority vote]
    A2 --> AGG
    AGG -->|matches ground truth?| GATE{correct?}
    GATE -->|yes| REF[Reformat to template F<br/>compress tokens]
    GATE -->|no| DROP[discard]
    REF --> DSET[(SFT set D')]
  end

  subgraph Train["Two-Stage Training"]
    BASE[Base policy θ0<br/>Qwen2.5-Instruct] --> SFT[SFT on D'<br/>cross-entropy, Eq.5]
    DSET --> SFT
    SFT --> P1[Policy θ1]
    P1 --> GRPO[GRPO RL<br/>sample N=8, reward 0/1, Eq.6-7]
    GRPO --> P2[Final policy θ2<br/>Qwen2.5-RCA]
  end

  P2 --> OUT[Structured RCA trace<br/>+ boxed root cause]

Interactive GRPO: sample N answers for one question, mark each right/wrong, and watch how the group mean/std turns raw 0/1 rewards into per-trajectory advantages. This is the core trick that lets GRPO skip the value network. Drag the slider to change how many of the samples are correct.

The algorithm, simplified

The heart of the paper is the two-stage loop. Here’s a faithful toy version — the RL stage is where the novelty-vs-PPO lives:

# Stage 1: SFT — imitate clean traces from the multi-agent factory
def build_sft_data(cases, agents, ground_truth):
    D = []
    for q in cases:
        trajs = [agent.solve(q) for agent in agents]      # diverse strategies
        traj  = majority_vote(trajs)                        # aggregator picks one
        if parse_answer(traj) == ground_truth[q]:           # quality gate: keep only correct
            clean = reformat_to_template(traj)              # compress: |clean| << |traj|
            D.append((q, clean))
    return D

def sft(policy, D):
    for q, trace in D:
        loss = -mean(log policy.token_logprob(trace, given=q))  # Eq.5 cross-entropy
        policy.update(loss)
    return policy

# Stage 2: GRPO — reward correct boxed answers, group-relative baseline
def grpo_step(policy, old_policy, q, c_true, N=8, eps=0.2, beta=0.01):
    group = [old_policy.sample(q) for _ in range(N)]          # N trajectories, same question
    rewards = [1.0 if parse_answer(t) == c_true else 0.0      # Eq.3 binary reward
               for t in group]
    mu, sd = mean(rewards), std(rewards) + 1e-6
    for t, r in zip(group, rewards):
        adv = (r - mu) / sd                                  # Eq.7 group-relative advantage
        for tok in t.tokens:
            ratio = policy.prob(tok) / old_policy.prob(tok)  # η, the importance ratio
            clipped = clip(ratio, 1-eps, 1+eps)
            loss = -min(ratio*adv, clipped*adv)              # Eq.6 PPO-style clip
            loss += beta * kl(policy, ref_policy, tok)       # leash to reference
            policy.update(loss)
    return policy

The genuinely hard parts in practice are: (a) the aggregator’s reformat step (turning verbose CoT into a clean, faithful template without dropping the load-bearing logic), and (b) GRPO stability — reward is sparse early, so SFT must lift you off the floor first.

Built on Prior Work

This paper is mostly assembly of recent reasoning-LLM machinery onto a new domain + dataset. The lineage:

The honest read: the training method is standard 2025 reasoning-LLM practice. The novelty that survives scrutiny is (1) the dataset/benchmark, (2) the multi-agent data-distillation-with-quality-gate trick, and (3) the demonstration that a 1.5B domain-tuned model beats a 70B generalist on this task.

Results & Evidence

Models: Qwen2.5-Instruct at 1.5B / 7B / 32B, 10 epochs / 1500 steps, batch 128, lr 1e-6, GRPO with N=8 samples, ε=0.2, VERL framework. Evaluated with pass@1 (single-attempt accuracy, averaged over 4 samples) and maj@4 (majority vote of 4 samples).

Headline numbers (pass@1 on the standard test set):

Ablation (the most convincing part): for the 7B model, SFT-only = 48%, RL-only = 39%, SFT+RL = 87% — the combination roughly doubles either single stage. For the 32B, RL-only is already strong (91%) because the bigger model can bootstrap from sparse reward; SFT+RL still wins (95.9%).

Generalization test (the real credibility check): they made a randomized dataset — shuffled root-cause IDs, table order, and surface cues — to kill position/memorization heuristics. The 32B holds at 93.2% pass@1; the 1.5B/7B drop more but stay above 75%. That’s solid evidence the models learned causal reasoning, not “the answer is usually C3.”

What the evidence does NOT establish:

• TeleLogs is synthetic. Real drive-test data is messier, noisier, and the 8-cause closed set won’t hold. “Future work: real-world operational data” is the authors admitting this.
• Single root cause, single symptom by construction. Real outages are multi-cause. The paper explicitly scopes to one.
• Closed-set classification dressed as reasoning. It’s “pick 1 of 8 with justification.” Impressive, but it’s a constrained problem; the reward only checks the box, not whether the explanation is correct (only that it’s well-formatted via SFT).
• No human eval of explanation quality. The interpretability claim rests on the format and one cherry-picked appendix trace (Fig. 7), not a rated study.
• No comparison to a frontier closed model (GPT-4-class) or to a simple rules baseline on the same set, which would have framed the “you need to fine-tune” claim more sharply.

How You’d Use It

This maps cleanly onto an AI-services playbook. The transferable pattern is “distill a domain expert’s reasoning into a small, cheap, explainable model you own.”

• Client-facing offering: domain-specific diagnostic copilots. Any client with (a) a closed-ish set of root causes and (b) structured logs/telemetry — IT incident triage, manufacturing defect diagnosis, medical-device fault analysis, fraud-reason classification, support-ticket routing — is a candidate. You’re not selling “an LLM,” you’re selling a model that’s right on their domain and explains itself.
• The multi-agent pipeline is the reusable IP. You probably can’t get a client to hand-label 5,000 reasoning traces. But you can run 2-3 frontier models with different prompting strategies over their historical resolved tickets (which already have the ground-truth resolution), majority-vote, gate on correctness, and reformat. That’s a near-zero-marginal-cost SFT dataset built from data they already have.
• Small model = deployable moat. A fine-tuned 1.5B–7B runs on a single modest GPU, on-prem, no per-token API bill, no data leaving the building. For regulated clients (telecom, healthcare, defense) that on-prem + explainable combo is the actual sale.
• Where it slots into an agentic system: this fine-tuned model becomes the specialist “diagnoser” node in a larger MAS — orchestrator routes a case to it, it returns a structured trace + answer, downstream agents act on the boxed cause. The expensive multi-agent reasoning happens once (training); inference is one cheap forward pass.

Build Your Own (Minimal Recipe)

Smallest thing that captures ~80% of the value, in build order:

1. Define the closed problem. Pick a domain with a finite, enumerable set of root causes (start with 5-10) and structured inputs. Write the prompt template (case data → “pick one of K, box your answer”). This framing decision is 50% of success.
2. Assemble a labeled set. You need (input, correct_cause) pairs. Mine historical resolved cases. A few hundred is enough to start; the paper used synthetic generation to scale.
3. Build the data factory. Run 2 frontier models (e.g. via API) with different prompting strategies over each case → majority vote → keep only traces whose boxed answer matches the label → reformat into a fixed template. Output: your SFT set. This is the hard, high-leverage part.
4. SFT a small open model. Qwen2.5-1.5B/7B-Instruct or similar. Use trl’s SFTTrainer or LLaMA-Factory. Cross-entropy on the clean traces. Cheap — hours on one GPU for small models.
5. GRPO on top. Use trl’s GRPOTrainer or the VERL framework (what the paper used). Reward function is ~5 lines: parse the box, return 1.0 if it matches the label. Sample N=8, ε=0.2, small lr (1e-6), keep a KL leash. Second hard part: RL stability — verify SFT lifted you off the floor first, or GRPO has nothing to amplify.
6. Validate with a randomized/held-out set to prove you didn’t memorize positions.

Libraries to reach for: transformers + trl (SFTTrainer, GRPOTrainer), or verl for serious RL throughput; vllm for fast sampling during GRPO; Qwen2.5 / Llama-3.x small instruct models as the base.

How to Improve It

Limitations are the roadmap. Concrete, testable pushes past the paper:

1. Reward the explanation, not just the box. Right now correctness is the only RL signal; explanation quality is a side effect of SFT. Add a process/verifier reward: have a judge model score whether each reasoning step is factually consistent with the data (step-level reward, à la process reward models). Testable: does explanation faithfulness improve without hurting pass@1?
2. Move to open-set / multi-cause. Replace the 8-way classifier with multi-label output and a “none of the above / novel cause” escape hatch. Reward becomes set-overlap (e.g. F1) instead of 0/1. This is the single biggest gap to real-world use.
3. Add tool calls back in. The paper uses agents only to make training data, then deploys a single model. A ReAct-style fine-tune that can query live telemetry or run a coverage calc would handle cases where the answer isn’t fully in the prompt.
4. Real-data domain shift. Train on synthetic, then do a small SFT/RL pass on a few hundred real resolved drive-tests and measure the sim-to-real gap. This is the experiment that would make an operator actually trust it.
5. Distill further / quantize. If 1.5B already hits 87%, push for a 0.5B or 4-bit version for true edge deployment at cell sites — measure the accuracy/size frontier explicitly.
6. Curriculum + harder negatives. The randomized set drops small-model accuracy ~10 points. Train with adversarial near-miss cases (two plausible causes) to harden the causal reasoning rather than surface heuristics.

Glossary

• RCA (Root Cause Analysis) — finding the underlying cause of an observed fault, not just the symptom.
• TeleLogs — the paper’s synthetic 5G drive-test dataset, 8 candidate root causes per case, released on HuggingFace.
• Drive test — driving a vehicle with measurement equipment through a network’s coverage area to collect real radio KPIs.
• Symptom vs. root cause — symptom = the observed problem (throughput < 600 Mbps); root cause = the latent reason (e.g. excessive antenna downtilt).
• PCI (Physical Cell ID) — an identifier for a cell; “PCI mod 30 collision” causes reference-signal interference.
• Handover — when a moving device switches its serving cell to a neighbor; late/missed handovers cause throughput drops.
• Policy π_θ — RL term for the model viewed as an actor; given a prompt it emits a token trajectory. θ are its weights.
• Trajectory τ — one generated sequence (the chain of thought + final boxed answer).
• Reward — scalar signal the RL maximizes; here a binary 1/0 for correct/incorrect boxed root cause.
• SFT (Supervised Fine-Tuning) — training on (input, ideal-output) pairs with cross-entropy; pure imitation.
• RL (Reinforcement Learning) — training by trial: sample outputs, score them, push weights toward higher-scoring behavior.
• GRPO (Group Relative Policy Optimization) — RL method that estimates “advantage” from a group of sampled answers’ mean/std, avoiding a separate value/critic network.
• PPO (Proximal Policy Optimization) — the precursor RL algorithm; uses a clipped objective and a learned value network. GRPO drops the value network.
• Advantage Â — how much better one trajectory was than the baseline; positive → reinforce, negative → suppress.
• Clipping (ε) — caps how far one update can change a token’s probability (±ε), keeping training stable.
• KL divergence / reference policy — a penalty keeping the trained model close to its starting behavior, preventing reward-hacking gibberish.
• Cross-entropy loss — the standard “make the correct next token more probable” training loss.
• Chain-of-thought (CoT) — the model’s intermediate reasoning steps written out before the answer.
• Aggregator agent — the pipeline component that majority-votes candidate traces and reformats the winner into a clean template.
• pass@1 / maj@4 — single-attempt accuracy / accuracy of majority vote over 4 samples.
• RSRP / SINR — radio quality KPIs: received signal power / signal-to-interference-plus-noise ratio.