ARMOR

ARMOR treats missing metrics, logs, and traces as a normal production condition rather than an afterthought. It learns each modality according to its physical structure, explicitly marks absent telemetry, suppresses misleading placeholders during fusion, and trains a shared diagnostic representation through self-supervised reconstruction.

Asymmetric encodingDense metrics and sparse event streams receive different model capacity.

Missing-aware routingPlaceholders identify absence; learned negative biases limit its influence.

Unified diagnosisOne representation supports detection, triage, and root-cause ranking.

1. The hidden failure in AIOps

Microservice diagnosis commonly combines three telemetry modalities: continuous resource and service metrics, semi-structured logs, and distributed traces. Most multimodal systems assume all three are present. In production, the monitoring agent can crash, the network can block exporters, sampling can discard traces, or a configuration error can silence a channel.

Zero filling is not neutral. A missing metric filled with zero can resemble an idle, healthy service. A downstream model may interpret this pseudo-normal signal with high confidence. Early or rigid fusion then lets one missing modality corrupt the useful evidence in the two modalities that survived.

2. Formalizing incomplete observability

For every service instance, ARMOR receives metrics \(X^{M}\), logs \(X^{L}\), and traces \(X^{T}\). An observation mask records which streams are actually available:

Observation state and diagnostic mapping \[ O=[o^{M},o^{L},o^{T}]\in\{0,1\}^{3}, \qquad F_{\theta}:(\widetilde X,O)\mapsto(y,s,P). \] The outputs are anomaly status \(y\), failure type \(s\), and a root-cause probability distribution \(P=[p_1,\ldots,p_N]\) over service instances. Supplying \(O\) explicitly lets the model distinguish missing data from a genuine numerical zero.

ARMOR's end-to-end diagnostic path

Three streamsAlign metrics, log-event counts, and trace statistics in time.

Asymmetric encoderLearn each modality independently with capacity matched to its structure.

Missing-aware gateInsert learned absence tokens and reduce unreliable routing weights.

Topology propagationUse graph attention to exchange evidence along service dependencies.

Three tasksDetect anomalies, classify failure type, and rank root-cause instances.

The diagram is redrawn with web-native elements. The central distinction is between learning within each modality and routing information across modalities.

3. Mechanism I: modality-specific status learning

Metrics are dense, continuous, and often high-dimensional; logs and traces are sparse event summaries. A symmetric encoder can overfit sparse events or underfit volatile metrics. ARMOR therefore assigns deeper, high-capacity temporal blocks to metrics and lightweight blocks to logs and traces.

Within each modality \(m\), feature extraction is hierarchical:

H_{m,\mathrm{temp}}=\operatorname{DepthwiseConv}(X_m), \] \[ H_{m,\mathrm{chan}}=\operatorname{PointwiseConv}_{\mathrm{chan}}(H_{m,\mathrm{temp}}), \] \[ H_m=\operatorname{PointwiseConv}_{\mathrm{inst}}(\operatorname{Permute}(H_{m,\mathrm{chan}})).

Large-kernel depthwise convolution captures long-term temporal effects such as a memory leak. Channel mixing captures relationships such as simultaneous latency and I/O spikes. Instance mixing begins to expose spatial correlations while keeping modality semantics separate.

4. Mechanism II: missing-aware global fusion

Each unimodal representation is projected to a common dimension. If modality \(k\) is absent, ARMOR does not pass a zero vector as if it were observed. It inserts a learned missing token \(E_{\mathrm{miss}}\), then adds a modality identity embedding:

v'_k=o_kv_k+(1-o_k)E_{\mathrm{miss}}+E_{\mathrm{mod},k}.

Multi-head attention first models cross-modal interaction. A second gate decides how much each enriched token should contribute. Crucially, the missing bias is constrained to be negative:

Dynamic suppression of missing modalities \[ s_k=W_sU_k+(1-o_k)b_k^{\mathrm{miss}}, \qquad b_k^{\mathrm{miss}}<0, \] \[ \alpha_k=\operatorname{softmax}(s_k), \qquad E=\sum_{k\in\{M,L,T\}}\alpha_kU_k. \]

The placeholder says what happened: telemetry is absent. The negative bias controls what the network should do: redirect attention toward surviving evidence. The learned penalty is modality-specific, so a missing high-dimensional metric stream can be suppressed more strongly than a missing sparse stream.

ARMOR then propagates the fused instance representations through a multi-head graph attention network over the microservice invocation topology. Root-cause evidence can therefore move along actual service dependencies instead of being averaged across unrelated instances.

5. Mechanism III: self-supervised operational learning

During offline training, ARMOR uses anomaly-free telemetry and randomly drops entire modalities. From the remaining streams and neighboring services, it predicts the full next time step \(\widehat X^{(T+1)}\). Two reconstruction losses provide distinct supervision:

\mathcal L_{\mathrm{obs}} =\frac{1}{|O|}\left\|\bigl(\widehat X^{(T+1)}-X^{(T+1)}\bigr)\odot O\right\|_F^2, \] \[ \mathcal L_{\mathrm{miss}} =\frac{1}{|1-O|}\left\|\bigl(\widehat X^{(T+1)}-X^{(T+1)}\bigr)\odot(1-O)\right\|_F^2, \] \[ \mathcal L=\mathcal L_{\mathrm{obs}}+\lambda\mathcal L_{\mathrm{miss}}.

The observed loss learns normal dynamics. The masked loss forces cross-modal and cross-instance inference, such as estimating CPU behavior from trace volume and neighboring services. At inference time, ARMOR concatenates reconstruction deviations with latent states to form a unified failure signature. Anomaly detection and root-cause localization remain label-free; failure triage uses failure-type labels for its downstream classifier.

6. What the experiments demonstrate

The paper evaluates two industry-standard microservice datasets and three levels of data failure: entire modalities, feature channels, and individual elements. Complete-data performance establishes that robustness is not obtained by sacrificing the normal operating case.

ARMOR versus the strongest unified self-supervised baseline under complete telemetry
Dataset	Method	AD F1		FT F1		RCL Avg@5
Dataset	Method	Value	Absolute gain	Value	Absolute gain	Value	Absolute gain
\(\mathcal D_1\)	ART	0.942		0.812		0.776
\(\mathcal D_1\)	ARMOR	0.961	+0.019	0.938	+0.126	0.910	+0.134
\(\mathcal D_2\)	ART	0.917		0.802		0.870
\(\mathcal D_2\)	ARMOR	0.997	+0.080	0.869	+0.067	0.893	+0.023

When modalities are removed completely, ARMOR outperforms ART in every tested scenario on both datasets. The largest failure occurs when metrics are absent, because a dense metric placeholder creates the strongest pseudo-normal disturbance. In this setting, ARMOR retains more than 60% higher root-cause localization accuracy than ART across both datasets.

The finer-grained study increases modality, channel, and element missingness from 0% to 40%, repeating every point with ten random masks. ARMOR remains stronger across all three tasks, both datasets, and all three corruption granularities. This shows that the mechanism generalizes beyond the whole-stream failures used for training.

0.961 / 0.997AD F1 on \(\mathcal D_1\) and \(\mathcal D_2\) with complete telemetry.

0.938 / 0.869FT F1 across the two datasets, exceeding ART in both cases.

>60%RCL accuracy advantage over ART when the metric modality is absent.

Ablations provide mechanism-level evidence. Replacing missing-aware gating with mean fusion, replacing the learned placeholder with zeros, or removing modality-dropout training all reduces performance. Removing or replacing graph attention mainly hurts localization, matching the intended role of service topology.

7. Scope and open questions

ARMOR assumes that offline archives are sufficiently complete to provide reconstruction targets for synthetically masked channels. Persistently absent historical modalities would weaken that signal. It also uses a topology constructed from historical traces, so rapid service creation and removal require updates. Cross-instance contrastive objectives and incremental graph learning are natural next steps.

ARMOR is not itself an autonomous agent. It contributes the dependable operational layer that agentic services will need: telemetry-aware representation, diagnosis under infrastructure failure, and explicit uncertainty about missing evidence.