AgenticTwin: An Agentic LLM Framework Integrated with Digital Twin for Anomaly Detection

AgenticTwin is an agentic LLM framework integrated with a digital twin (DT) for anomaly detection in cyber-physical systems (CPS). The paper states: "We propose AgenticTwin, an agentic framework that integrates LLM-driven reasoning with a digital twin-based anomaly detection pipeline. The framework grounds LLM-generated explanations in outputs from a digital twin-driven anomaly classifier and enables human operators to ask relevant natural-language questions about the system."

The framework addresses limitations of traditional anomaly detection, which provide limited interpretability regarding: (i) why an anomaly occurred, (ii) what underlying mechanisms may have contributed to it, and/or (iii) what corrective actions should be taken to mitigate it. It also tackles challenges of direct LLM deployment in CPS: "First, LLMs suffer from hallucinations when they lack access to reliable domain-specific knowledge or context describing the current system state. Second, monolithic LLM-based reasoning frameworks often struggle to jointly perform anomaly diagnosis, mitigation planning, and user interaction within a single prompt, resulting in inconsistent or incomplete anomaly analysis. Finally, many existing approaches rely on large proprietary models with substantial computational requirements, limiting practical deployment in resource-constrained CPS."

The architecture consists of a digital twin, an anomaly classifier, an anomaly knowledge base, an anomaly repository, and a multi-agent LLM interface. The digital twin serves as a physics-informed virtual representation of a physical entity and estimates expected system state using machine learning regression models and physics-guided rules. The anomaly classifier infers faults by jointly considering observed system values, DT estimates, and the corresponding residual information, where residuals are computed as rt = xt - x̂t. When an anomaly is detected, the framework generates a structured anomaly event: Et = (τt, xt, x̂t, rt, At).

The LLM-powered agentic interface decomposes anomaly reasoning into four specialized agents: DA – Diagnosis Agent: This agent provides reasoning of the underlying cause of the detected anomalies; RA – Retrieval Agent: This agent retrieves and ranks the previous similar anomaly cases from a historical anomaly repository; MA – Mitigation Agent: This agent recommends corrective actions to address the detected anomaly and minimize its impact on the system; and SA – Supervisor Agent: This agent is responsible for coordinating the activities of the specialized agents and ensuring that their outputs are combined into a coherent response.

The anomaly knowledge base contains structured descriptions of anomaly types observed in the benchmark environment with four anomaly types: Spike, Drift, Stuck-at, and Replay. Each entry contains structured semantic information, including the anomaly definition, observable symptoms, possible causes, and recommended mitigation actions.

The paper introduces a benchmark-oriented evaluation pipeline constructed over synthetic anomalies injected into a real-world weather sensor dataset. The dataset contains 34,991 samples collected at 10-minute intervals between January 1 and August 31, 2025 from the Beutenberg weather station in Jena, Germany, with three variables: temperature, dew point temperature, and relative humidity. The benchmark includes 12,000 synthetic operator queries generated from anomaly events using Gemini 2.5 Pro, with 4,000 queries each for diagnosis, retrieval, and mitigation tasks.

Experimental results show that "the inclusion of the knowledge base consistently improves reasoning quality. On average, the DA's scores increase from 0.69 to 0.84, corresponding to an average gain of 22.3%, while the MA's scores increase from 0.66 to 0.84, yielding an average gain of 26.3%. The gains are notable among smaller models, e.g., Qwen 2.5 0.5B Instruct achieves diagnosis and mitigation improvements of 33.3% and 42.9%, respectively."

For retrieval, across all models, the average scores reach 0.83 P@1, 0.76 P@3, and an MRR of 0.85, indicating that the repository consistently returns relevant historical anomaly cases.

The comparison between agentic and monolithic reasoning shows that "AgenticTwin achieves the highest performance across all three tasks, obtaining diagnosis similarity, retrieval MRR, and mitigation similarity scores of 0.93, 0.95, and 0.92, respectively. In comparison, the strongest monolithic baseline, Llama 3.3 70B Instruct, reaches 0.70, 0.74, and 0.78 on the same tasks. AgenticTwin therefore improves over the best-performing baseline by 32.9% in diagnosis, 28.4% in retrieval, and 17.9% in mitigation."

The paper concludes: "Experimental results show that access to the anomaly knowledge base improves diagnosis and mitigation performance across the evaluated LLMs, with the largest relative gains observed for lightweight, open-source models. Furthermore, the lightweight AgenticTwin architecture outperforms all evaluated monolithic baselines, indicating that task specialization can potentially compensate for limited model scale. Overall, the findings demonstrate the potential of combining DT-based system modeling with lightweight LLMs for interpretable CPS decision support."

Improvements to AI systems:

1. Ground LLM reasoning in physics-informed digital twin outputs – Instead of letting LLMs reason from raw sensor data alone, feed them structured residuals (rt = xt − x̂t) and anomaly event tuples (Et = (τt, xt, x̂t, rt, At)) generated by a digital twin. This reduces hallucination by anchoring explanations to verifiable system-state deviations.

2. Decompose complex reasoning into specialized, coordinated agents – Replace monolithic single-prompt LLM reasoning with a multi-agent pipeline: Diagnosis Agent (cause inference), Retrieval Agent (historical case matching), Mitigation Agent (corrective actions), and Supervisor Agent (coordination and response synthesis). This prevents incomplete or inconsistent outputs when handling diagnosis, planning, and user interaction simultaneously.

3. Integrate a structured anomaly knowledge base as a retrieval-augmented memory – Provide LLMs with a semantic knowledge base containing anomaly definitions, symptoms, causes, and mitigations (e.g., Spike, Drift, Stuck-at, Replay). This improves reasoning quality by 22–26% on average, with the largest gains (33–43%) for small models, enabling lightweight LLMs to perform near-par with much larger models.

4. Enable task-specific retrieval ranking for historical anomaly cases – Use the Retrieval Agent to rank past similar anomalies from a repository, achieving 0.83 P@1 and 0.85 MRR. This allows the AI to leverage past experiences for faster, more accurate diagnosis and mitigation recommendations.

5. Support natural-language operator interaction grounded in system state – Allow human operators to ask free-form questions about anomalies, with the AI generating responses that are explicitly tied to digital twin estimates, residuals, and knowledge base entries—not just statistical outputs.

What the improved AI system can do:

• Detect and explain why an anomaly occurred (e.g., sensor spike vs. drift) using physics-informed residuals, not just black-box classification.

• Recommend specific corrective actions (e.g., recalibrate sensor, switch to redundant channel) grounded in a structured knowledge base.

• Retrieve and rank the most relevant past anomaly cases for the current situation, enabling faster root-cause analysis.

• Operate effectively on resource-constrained edge devices using small open-source LLMs (e.g., 0.5B parameters) without sacrificing diagnostic accuracy.

• Answer operator questions like What caused the temperature drift? or What should I do about the stuck-at fault? with coherent, multi-step reasoning that combines diagnosis, history, and mitigation.

• Achieve 32.9% better diagnosis, 28.4% better retrieval, and 17.9% better mitigation than the strongest monolithic LLM baseline, while using far fewer computational resources.

Digital twins are increasingly used to monitor and simulate the behavior of cyber-physical systems. Even with skilled operators, interpreting anomalies detected within digital twin pipelines is challenging, as the sheer complexity and volume of raw sensor data make thorough analysis difficult. Recent advances in large language models (LLMs) offer promising capabilities for reasoning and explanation, yet their integration into digital twin-driven anomaly analysis remains underexplored. In this work, we propose AgenticTwin, an agentic framework that integrates LLM-driven reasoning with a digital twin-based anomaly detection pipeline. The framework grounds LLM-generated explanations in outputs from a digital twin-driven anomaly classifier and enables human operators to ask relevant natural-language questions about the system. Beyond the framework itself, we introduce a benchmark-oriented evaluation pipeline constructed over synthetic anomalies injected into a real-world weather sensor dataset, enabling controlled generation of operator queries over anomaly events. We further evaluate the feasibility of deploying lightweight, open-source LLMs for practical cyber-physical environments. Experimental results demonstrate that structured agent collaboration and knowledge-grounded reasoning improve diagnosis quality, contextual retrieval, and mitigation quality across diverse possible anomaly scenarios.