Probabilistic Graph Neural Inference for satellite anomaly response operations with ethical auditability baked in

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

Introduction: When a Telemetry Spike Taught Me to Stop Trusting Point Estimates Two years ago, I was deep into a personal research project on multi-agent anomaly triage for satellite constellations. I had built what I thought was a clean, elegant pipeline: a temporal autoencoder flagged deviations in telemetry streams, and a rule engine routed alerts to operators. It worked beautifully in simulation — until I fed it a real anomaly trace from a friend’s ground-station testbed. A reaction wheel bearing degradation manifested as a subtle, correlated drift across three subsystems simultaneously: power draw, thermal profile, and attitude error. My autoencoder saw three independent, individually sub-threshold deviations and stayed silent. The rule engine, keyed on single-sensor thresholds, never fired. The anomaly was real, it was relational, and my architecture was blind to structure.

引言：当遥测峰值教会我不再盲目信任点估计两年前，我深入研究了一个关于卫星星座多智能体异常分类的个人项目。我构建了一个自认为简洁优雅的流程：一个时间自编码器标记遥测流中的偏差，一个规则引擎将警报路由给操作员。它在模拟中运行良好——直到我输入了一个来自朋友地面站测试平台的真实异常轨迹。一个反作用轮轴承的退化表现为三个子系统同时出现的细微相关漂移：功耗、热分布和姿态误差。我的自编码器看到了三个独立的、均未达到阈值的偏差，因此保持沉默。基于单传感器阈值的规则引擎从未触发。异常是真实的，它是关联性的，而我的架构对这种结构视而不见。

While exploring how to fix this, I stumbled into graph neural networks and, more importantly, into probabilistic graph inference. The insight that reshaped my thinking was simple but profound: in orbital operations, you almost never want a point estimate of “anomaly / no anomaly.” You want a calibrated posterior over failure modes, propagated through a graph of subsystem dependencies, with a decision trail you can defend to a review board six months later. That last part — ethical auditability — is what turns a clever model into an operational system. During my investigation of how human operators actually make go/no-go decisions on anomalies, I found that the reasoning trace mattered as much as the verdict. A model that says “82% probability of reaction wheel degradation” without explaining which evidence paths drove that number is unusable in a safety-critical loop.

在探索如何修复这个问题时，我偶然发现了图神经网络，更重要的是，发现了概率图推理。重塑我思维的洞察力简单而深刻：在轨道运行中，你几乎从不需要“异常/无异常”的点估计。你需要的是针对故障模式的校准后验概率，通过子系统依赖图进行传播，并附带一个能在六个月后向审查委员会辩护的决策轨迹。最后一点——伦理可审计性——是将一个巧妙的模型转化为操作系统的关键。在调查人类操作员如何对异常做出“执行/不执行”决策时，我发现推理轨迹与结论本身同样重要。一个只说“反作用轮退化概率为 82%”却无法解释哪些证据路径导致该数字的模型，在安全关键回路中是不可用的。

Technical Background: Why Graphs, Why Probabilities, Why Audit Trails The structural reality of spacecraft anomalies A satellite is not a bag of independent sensors. It’s a tightly coupled system where a thermal control fault cascades into power anomalies, which cascade into attitude control degradation. In my experimentation with telemetry from a simulated LEO platform, I catalogued roughly 40% of injected fault scenarios as multi-subsystem — meaning no single-sensor detector, however well-tuned, would catch them reliably. Graph neural networks are a natural fit: nodes are subsystems (power, thermal, attitude, comms, payload), edges encode physical and functional dependencies, and node features are windowed telemetry statistics. Message passing lets each subsystem’s anomaly score be informed by its neighbors’ states — exactly the relational reasoning my autoencoder lacked.

技术背景：为什么选择图、概率和审计追踪航天器异常的结构现实卫星不是一袋独立的传感器。它是一个紧密耦合的系统，热控制故障会级联导致电力异常，进而级联导致姿态控制退化。在对模拟低地球轨道（LEO）平台的遥测实验中，我将大约 40% 的注入故障场景归类为多子系统故障——这意味着没有任何单一传感器检测器（无论调优多好）能可靠地捕捉到它们。图神经网络是天然的适配方案：节点是子系统（电力、热控、姿态、通信、载荷），边编码物理和功能依赖关系，节点特征是窗口化的遥测统计数据。消息传递机制使每个子系统的异常评分能够参考其邻居的状态——这正是我的自编码器所缺乏的关联推理。

Why probabilistic, not deterministic In my research of operational anomaly response, I kept encountering the same failure mode: deterministic classifiers produce confident wrong answers under distribution shift. A satellite in a new orbital regime, or after a component swap, drifts out of the training distribution. A deterministic GNN will still emit a hard label. A probabilistic model emits a distribution, and crucially, an elevated epistemic uncertainty that can itself trigger a human-review workflow. I settled on a Bayesian treatment via Monte Carlo dropout and a variational latent layer over node embeddings, combined with a structured output head that produces a categorical posterior over fault classes plus a “novel/unknown” mass. This gives me three things: a calibrated class posterior, an uncertainty estimate, and — through attention weights — a traceable evidence path.

为什么选择概率模型而非确定性模型在操作异常响应的研究中，我不断遇到同样的故障模式：确定性分类器在分布偏移下会产生自信的错误答案。处于新轨道状态或更换组件后的卫星会偏离训练分布。确定性 GNN 仍会输出一个硬标签。而概率模型会输出一个分布，更关键的是，它会输出一个升高的认知不确定性，这本身就可以触发人工审查工作流。我最终采用了通过蒙特卡洛 Dropout 和节点嵌入上的变分潜在层进行的贝叶斯处理，结合一个结构化输出头，产生故障类别的分类后验概率以及“新颖/未知”的概率质量。这为我提供了三样东西：校准后的类别后验概率、不确定性估计，以及通过注意力权重实现的、可追溯的证据路径。

Auditability as a first-class citizen The phrase “ethical auditability baked in” is not marketing. In safety-critical operations, decisions must be reconstructable. Through studying regulatory frameworks around autonomous space operations, I learned that auditors ask three questions: What did the system see? What did it infer? Why did it act? My design answers all three by logging: (1) the input graph snapshot with a content hash, (2) the full posterior distribution and uncertainty decomposition, (3) the top-k message-passing paths (attention-weighted edges) that drove the decision, and (4) the model version and calibration parameters. Every inference produces an immutable audit record.

将可审计性作为核心要素 “内置伦理可审计性”这一说法并非营销辞令。在安全关键的操作中，决策必须是可重构的。通过研究围绕自主空间操作的监管框架，我了解到审计员会问三个问题：系统看到了什么？它推断出了什么？它为什么采取行动？我的设计通过记录以下内容来回答这三个问题：(1) 带有内容哈希的输入图快照，(2) 完整的后验分布和不确定性分解，(3) 驱动决策的前 K 个消息传递路径（注意力加权边），以及 (4) 模型版本和校准参数。每一次推理都会产生一个不可篡改的审计记录。

Implementation Details Building the telemetry graph The first thing I built was a graph constructor that turns windowed telemetry into a typed, attributed graph. Node features are z-scored statistics (mean, variance, slope, spectral energy) over a sliding window; edges carry a dependency type embedding.

实现细节构建遥测图我构建的第一件事是一个图构造器，它将窗口化的遥测数据转换为带类型、带属性的图。节点特征是滑动窗口上的 Z 分数统计量（均值、方差、斜率、谱能量）；边携带依赖类型嵌入。

While exploring graph construction, I discovered that edge typing matters enormously. Treating all dependencies as identical edges collapsed the model’s ability to distinguish “thermal drives power” from “comms is independent of attitude,” and validation accuracy dropped by over 12 points. Typed edges with relational message functions fixed this. The probabilistic GNN core The model is a relational graph convol

在探索图构建的过程中，我发现边类型至关重要。将所有依赖关系视为相同的边，会使模型无法区分“热控驱动电力”与“通信独立于姿态”，导致验证准确率下降超过 12 个百分点。带有关系消息函数的类型化边解决了这个问题。概率 GNN 核心该模型是一个关系图卷积