Enforcing Graph‐Relative Structural Compliance in LLM ‐Based Industrial Anomaly Explanation via Causal Graph Grounding

ABSTRACT We study when large language model (LLM) root‐cause reports can be trusted, and find compliance and correctness to be separable properties. We ground the LLM with a directed dependency graph discovered from the data: PCMCI learns the structure from the normal regime, and the report may cite only its edges—compliance with the discovered structure, not proof that mechanisms are true. Compliance is measured by a deterministic, mechanically computable edge‐set violation rate (EVR): the share of cited edges outside the allowed set. EVR is graph‐relative by construction; it verifies membership in the discovered graph, never the truth of any relation. An enum constraint with client‐side validation keeps EVR at zero by construction —a deployment guarantee, not a finding; a soft instruction alone reaches zero at small scale (5%–6% residual at 30 seeds). Correctness is another matter: on degree‐matched random graphs (30 seeds) soft‐mode EVR stays near zero while chain precision halves (0.540.28) and recall falls 0.910.55—on this synthetic protocol, only genuinely causal structure restores correctness. A true‐statistic table roughly halves numeric fabrication, and enum‐constrained structured numeric fields eliminate fabrication in the constrained channel only (validity 5/5). The grounded system may probabilistically abstain at its retrieval boundary. On real plants (SWaT, WADI) compliance transfers, but root identification remains open (SWaT 3/27; WADI, assessable after a tag‐matching correction, exploratory: grounded hit@1 1/3 under the redesigned unit‐invariant selection, 0/3 legacy), and discovered dependencies only partially persist across attack windows. Graph‐relative compliance is enforceable; causal correctness is bounded by discovery quality.