Paper deep dive
AgenticTwin: An Agentic LLM Framework Integrated with Digital Twin for Anomaly Detection
Touseef Hasan, Mounika Ghanta, Souvika Sarkar, Ujjwal Guin
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Digital twins are increasingly used to monitor and simulate the behavior of cyber-physical systems. Even with skilled operators, interpreting anomalies detected within digital twin pipelines is challenging, as the sheer complexity and volume of raw sensor data make thorough analysis difficult. Recent advances in large language models (LLMs) offer promising capabilities for reasoning and explanation, yet their integration into digital twin-driven anomaly analysis remains underexplored. In this work, we propose AgenticTwin, an agentic framework that integrates LLM-driven reasoning with a digital twin-based anomaly detection pipeline. The framework grounds LLM-generated explanations in outputs from a digital twin-driven anomaly classifier and enables human operators to ask relevant natural-language questions about the system. Beyond the framework itself, we introduce a benchmark-oriented evaluation pipeline constructed over synthetic anomalies injected into a real-world weather sensor dataset, enabling controlled generation of operator queries over anomaly events. We further evaluate the feasibility of deploying lightweight, open-source LLMs for practical cyber-physical environments. Experimental results demonstrate that structured agent collaboration and knowledge-grounded reasoning improve diagnosis quality, contextual retrieval, and mitigation quality across diverse possible anomaly scenarios.
Tags
Links
- Source: https://arxiv.org/abs/2608.11679v1
- Canonical: https://arxiv.org/abs/2608.11679v1
Trouble viewing inline? Open PDF directly →
Full Text
66,552 characters extracted from source content.
Expand or collapse full text
AgenticTwin: An Agentic LLM Framework Integrated with Digital Twin for Anomaly Detection Touseef Hasan Mounika Ghanta Souvika Sarkar and Ujjwal Guin Thanks: Touseef Hasan and Souvika Sarkar are with the School of Computing, Wichita State University, KS, USA (e-mail: txhasan4@shockers.wichita.edu and souvika.sarkar@wichita.edu). Thanks: Mounika Ghanta and Ujjwal Guin are with the Department of Electrical and Computer Engineering, Auburn University, AL, USA (e-mail: mzg0144 and ujjwal.guin@auburn.edu). Abstract Digital twins are increasingly used to monitor and simulate the behavior of cyber–physical systems. Even with skilled operators, interpreting anomalies detected within digital twin pipelines is challenging, as the sheer complexity and volume of raw sensor data make thorough analysis difficult. Recent advances in large language models (LLMs) offer promising capabilities for reasoning and explanation, yet their integration into digital twin-driven anomaly analysis remains underexplored. In this work, we propose AgenticTwin, an agentic framework that integrates LLM-driven reasoning with a digital twin-based anomaly detection pipeline. The framework grounds LLM-generated explanations in outputs from a digital twin-driven anomaly classifier and enables human operators to ask relevant natural-language questions about the system. Beyond the framework itself, we introduce a benchmark-oriented evaluation pipeline constructed over synthetic anomalies injected into a real-world weather sensor dataset, enabling controlled generation of operator queries over anomaly events. We further evaluate the feasibility of deploying lightweight, open-source LLMs for practical cyber-physical environments. Experimental results demonstrate that structured agent collaboration and knowledge-grounded reasoning improve diagnosis quality, contextual retrieval, and mitigation quality across diverse possible anomaly scenarios. Index Terms: Large language models, digital twins, cyber-physical systems, agentic AI, anomaly detection. I Introduction Digital twins (DTs) are virtual replicas of physical systems for monitoring, modeling, and managing cyber–physical systems (CPS) across domains like manufacturing, healthcare, and industrial automation [20, 67, 44, 8, 72]. DTs aid operators by continuously observing operational states, simulating system behavior, and proactively identifying anomalies [4]. However, communicating these anomalies to users remains a significant challenge as such systems typically lack interpretability [63]. Figure 1 presents the limitations of traditional anomaly detection within DT architectures. Although it is possible to accurately flag anomalous events with such frameworks, they provide limited interpretability regarding: (i) why an anomaly occurred, (ii) what underlying mechanisms may have contributed to it, and/or (iii) what corrective actions should be taken to mitigate it [28, 35]. As a result, skilled human operators are frequently required to manually analyze raw sensor readings and system logs to diagnose faults and determine mitigation strategies. This process is becoming increasingly difficult as CPS environments become more complex and data-intensive [82, 13] with time. Fig. 1: Traditional anomaly detection without actionable explanations or mitigation guidance. The enhanced reasoning capabilities of large language models (LLMs) have inspired promising applications in DTs, transforming raw numbers into interpretable explanations [85, 37, 2, 76, 34]. However, deploying LLMs directly within CPS workflows presents several challenges. First, LLMs suffer from hallucinations when they lack access to reliable domain-specific knowledge or context describing the current system state [19, 56]. Second, monolithic LLM-based reasoning frameworks often struggle to jointly perform anomaly diagnosis, mitigation planning, and user interaction within a single prompt, resulting in inconsistent or incomplete anomaly analysis [15]. Finally, many existing approaches rely on large proprietary models with substantial computational requirements, limiting practical deployment in resource-constrained CPS [26, 48]. To address these challenges, we propose AgenticTwin, an agentic LLM framework integrated with a DT–driven anomaly detection pipeline. Instead of relying on a single monolithic LLM, our framework decomposes anomaly reasoning into task-specific agents responsible for diagnosis, mitigation planning, and contextual historical retrieval. These agents operate on structured evidence generated by the DT and the anomaly classifier, enabling interpretable reasoning about anomalous system behavior. To systematically evaluate this agentic framework, we also construct a benchmark-oriented anomaly analysis dataset by injecting synthetic anomalies into a real-world weather sensor dataset. The benchmark enables controlled and reproducible evaluation of anomaly diagnosis, historical retrieval, and mitigation reasoning across diverse LLM architectures and deployment settings. The following research questions drive the formulation and design of the proposed framework: (i) whether LLM-based reasoning can be grounded in context through a DT-enabled anomaly classifier to support interpretable and reliable anomaly diagnosis in CPS; (ii) whether decomposing anomaly reasoning into specialized agents improves diagnosis, retrieval, and mitigation quality compared to a monolithic LLM framework; and (iii) whether lightweight, open-source LLMs can enable scalable and practical deployment of agentic reasoning frameworks in resource-constrained cyber-physical environments. Our key contributions are as follows: • We propose AgenticTwin, an agentic LLM framework integrated with a DT-driven anomaly detection pipeline for interpretable anomaly analysis in cyber-physical systems. The framework combines DT predictions, anomaly diagnosis, historical retrieval, and mitigation reasoning within a coordinated agentic architecture. • We develop a benchmark-oriented evaluation dataset by injecting synthetic anomalies into a real-world weather sensor dataset. The benchmark consists of synthetic operator queries generated over anomalous events and enables controlled evaluation of diagnosis quality, retrieval capability, and mitigation reasoning. • We conduct a comparative assessment between agentic and monolithic LLM reasoning architectures to investigate whether task decomposition improves anomaly interpretation, contextual retrieval, and mitigation quality in DT-enabled cyber-physical environments. Additionally, we evaluate the practicality of lightweight, open-source LLMs for deployment in resource-constrained settings. The rest of the paper is organized as follows: Section I covers prior work on anomaly detection, LLM-integrated DT frameworks, and agentic architectures. Section I presents the proposed framework. Section IV contains our experimental findings and Section V concludes the paper. I Prior Work This section begins with a brief description of digital twins, followed by an examination of anomaly detection in the CPS environment and frameworks that integrate DTs with LLMs. I-A Digital Twins and Anomaly Detection in CPS A digital twin is a synchronized digital representation of a physical device, process, or service that continuously updates its current state using real-time observations collected from physical sensors [58, 64]. DTs have been widely adopted in CPS for monitoring and analysis [17, 23]. In practice, DTs are commonly constructed using a combination of data-driven machine learning models and domain-specific physics-based rules [61]. Machine learning models capture complex relationships from historical sensor observations, while physics-guided constraints enforce consistency with known system behavior and operational limits [6, 5]. The combination of these two components enables DTs to estimate expected system states and identify deviations between observed and predicted behavior, which can subsequently be used for anomaly detection and diagnosis [51]. For anomaly detection, several studies have explored various machine learning algorithms by identifying deviations from the learned patterns [88, 59]. While these models identify and classify anomalous patterns, they may not fully capture the behavior of the underlying physical system. Most of these approaches are heavily data-driven and completely rely on sensor measurements, which may reduce reliability under noisy or corrupted sensor conditions [60]. Existing research has also proposed several techniques, such as threshold-based filtering and rule-based fault handling [45], [3]. Although these methods help reduce the impact of faulty sensor data by fault identification and classification, they provide limited support for interactive user-oriented contextual anomaly reasoning, diagnosis, and mitigation assistance in CPS environments. I-B Integration of LLMs in Digital Twin Frameworks Traditionally, DTs have relied on structured inputs and outputs, requiring domain-specific knowledge to interpret and interact with the simulated environment [79]. However, the emergence of LLMs has opened new avenues for embedding reasoning, explanation, and decision-support capabilities directly into DT frameworks [29, 14, 39, 32]. Recent studies have explored the potential of LLM-driven DTs in network optimization, agriculture, industrial automation, healthcare, and smart cities [22, 87, 77, 16, 46, 71, 47, 80, 53, 12]. While most of these frameworks use LLMs to primarily interpret and explain DT outputs to end users, some use LLMs to simulate complex environments and therefore generate the DT itself [84, 74]. While promising, these efforts remain limited to static or post hoc analysis without real-time user interaction or closed-loop reasoning with the DT [81]. Moreover, these approaches mostly rely on large-scale or proprietary LLMs, which require significant computational resources, limiting their feasibility in resource-constrained cyber-physical environments. I-C Agentic Architectures for Autonomous Decision Making in Digital Twins As LLMs become increasingly integrated into cyber-physical and DT systems, agentic architectures have emerged as a promising approach for decomposing complex decision-making tasks into specialized and collaborative reasoning components [56]. Agentic systems in safety-critical environments, such as manufacturing, emphasize effective agent collaboration to ensure safe and reliable operation [17, 66, 38, 42]. Prior studies have stated the importance of a user interface that allows users to interact with the DT [31]. The agents must not only coordinate but also validate, explain, and justify their actions, especially when recommendations affect physical assets or operational safety [54, 24]. Agentic LLMs have been explored to automate the parametrization of simulation models in DTs, iteratively control temperature on microcontrollers, and autonomously select optimal tools and data streams for user-specific queries [78, 73, 70]. However, most agentic frameworks fail to validate their generated responses, which reinforces concerns about hallucination due to inadequate context or a lack of domain-specific evidence. I The Proposed AgenticTwin Framework The limitations of traditional anomaly detection systems discussed in Section I motivate the need for a framework that not only detects anomalous behavior but also explains its causes, retrieves relevant contextual evidence, and recommends corrective actions. To address these challenges, we propose AgenticTwin, a DT-integrated agentic LLM framework for interpretable anomaly analysis in CPS. The framework combines DT-based anomaly detection with a curated anomaly knowledge base, an anomaly repository, and a coordinated multi-agent reasoning interface. Together, these components enable anomaly diagnosis, contextual retrieval of previously observed events, and mitigation planning while supporting deployment with lightweight, open-source LLMs. Fig. 2: Overview of the proposed AgenticTwin architecture, integrating a DT with an LLM-powered multi-agent interface for interpretable anomaly analysis in CPS. Figure 2 provides an overview of the proposed architecture. The overall workflow begins with a real-time data stream collected from the physical asset. In the operational setting, the incoming sensor vector tx_t is directly passed to both the DT and the anomaly classifier. The DT estimates the expected system state ^t x_t using machine learning regression models and physics-guided rules. The residual vector tr_t is then computed and used by the anomaly classifier to determine whether the current observation is anomalous. The attacker block in Figure 2 represents the benchmark construction setting, where anomalous behavior is introduced into historical sensor data to simulate corrupted or tampered measurements. This allows the framework to be trained and evaluated under controlled anomaly scenarios. During online execution, however, the system does not assume prior knowledge of whether the incoming data has been tampered with; it only observes tx_t, estimates ^t x_t, computes tr_t, and relies on the anomaly classifier to infer the anomaly output AtA_t. Once an anomaly is detected, the classifier produces AtA_t, i.e., the predicted anomaly state and label. The system then forms a structured anomaly event EtE_t, consisting of the timestamp, observed values, predicted values, residuals, and predicted anomaly label. This event is stored in the anomaly repository and passed to the LLM-powered agentic interface. The Retrieval Agent (RA), Diagnosis Agent (DA), Mitigation Agent (MA), and Supervisor Agent (SA) then use EtE_t, the predicted data ^t x_t, the anomaly repository, and the anomaly knowledge base (KB) to generate contextual diagnosis and mitigation support for the operator. Unlike conventional monolithic LLM frameworks, the AgenticTwin framework delegates the following specialized LLM agents with distinct responsibilities: • DADA – Diagnosis Agent: This agent provides reasoning of the underlying cause of the detected anomalies. Most anomaly detection methods focus on indicating the presence of abnormal behavior in the data but provide limited insights into the reasons behind it. Detection of an anomaly alone is insufficient for effective decision-making, as the operator needs to understand the underlying factors to implement corrective measures. To address this limitation, the DA uses DT predictions, residual patterns, and anomaly taxonomy information to identify potential root causes. • RARA – Retrieval Agent: This agent retrieves and ranks the previous similar anomaly cases from a historical anomaly repository. The rationale for the RA is to provide additional context by leveraging recurring and past anomaly patterns, thereby improving understanding of current system behavior and supporting accurate diagnosis and mitigation decisions. • MAMA – Mitigation Agent: This agent recommends corrective actions to address the detected anomaly and minimize its impact on the system. Based on the diagnosis and retrieved historical evidence, the MA suggests the necessary actions. • SASA – Supervisor Agent: This agent is responsible for coordinating the activities of the specialized agents and ensuring that their outputs are combined into a coherent response. The SASA collects and reviews the outputs generated by other agents and integrates them into a unified explanation. It serves as the final coordination layer. The proposed framework is designed as a modular and generalizable architecture that can operate with lightweight, open-source LLMs, enabling deployment in resource-constrained cyber-physical environments. The following subsections describe each of the major components of the framework. I-A Digital Twin The digital twin (DT) serves as a physics-informed virtual representation of a physical entity. It comprises a set of domain-specific physical laws and constraints, along with the structural relations among the variables of a system. A cyber-physical system (CPS) equipped with n sensors can be represented by an observed state vector at time t [11]. This state-vector representation provides a compact description of the system condition using all sensor measurements available at a given timestamp. Formally, t=[x1,t,x2,t,…,xn,t]T∈ℝn,x_t=[x_1,t,x_2,t,…,x_n,t]^T ^n, (1) where xi,tx_i,t denotes the reading of the ithi^th sensor at time t. In the proposed framework, we instantiate this formulation using a weather monitoring CPS consisting of three environmental variables: temperature, dew point temperature, and relative humidity [49]. Therefore, the observed state vector becomes: t=[Tt,Td,t,RHt]T∈ℝ3,x_t=[T_t,T_d,t,RH_t]^T ^3, (2) where TtT_t, Td,tT_d,t, and RHtRH_t denote temperature, dew point temperature, and relative humidity at time t, respectively. The objective of the DT is to estimate the expected system state ^t x_t from previously observed system behavior. Since environmental variables often exhibit temporal dependencies as well as diurnal and seasonal patterns, the DT prediction model uses both past observations and a temporal encoding function [68, 41]. The expected state is modeled as follows: ^t=ℱθ(1:t−1,ϕ(t)), x_t=F_θ (x_1:t-1,φ(t) ), (3) where 1:t−1x_1:t-1 denotes the historical sensor sequence before time t, ϕ(t)φ(t) denotes the temporal encoding function capturing periodic characteristics such as time-of-day and seasonal effects, and ℱθ(⋅)F_θ(·) represents the regression-based DT model parameterized by θ [89, 57]. In this work, the DT follows a hybrid modeling strategy in which data-driven regression captures statistical dependencies among sensor variables, while physics-guided constraints incorporate known relations among environmental variables. The model parameters are learned offline from historical training data by minimizing the difference between the observed state and the DT-estimated state. This training objective is written as: θ∗=argminθℒDT(θ),θ^*= _θL_DT(θ), (4) where the DT prediction loss is defined as: ℒDT(θ)=1N∑t=1N‖t−^t‖22,L_DT(θ)= 1N _t=1^N \|x_t- x_t \|_2^2, (5) where N denotes the number of training samples, ∥⋅∥2\|·\|_2 denotes the Euclidean norm, and ℒDTL_DT measures the average prediction error between the observed and estimated system states. Thus, Eq. (4) indicates that the optimal DT parameters θ∗θ^* are obtained by minimizing the loss defined in Eq. (5). After training, the DT provides ^t x_t, which serves as the expected system state used by the anomaly classifier to identify deviations from normal behavior. I-B Anomaly Classifier The objective of the anomaly classifier is to distinguish normal and abnormal behavior of the system by analyzing the discriminating patterns in the data. Beyond binary detection, this module further identifies the fault type based on the relationships between variables in the system [27, 86]. The proposed anomaly classifier infers faults by jointly considering observed system values, DT estimates, and the corresponding residual information. The DT-informed input can be defined as: t=[t,^t,t],z_t= [x_t, x_t,r_t ], (6) where rtr_t is the residual vector that captures discrepancies between observed and expected system behavior: t=t−^t.r_t=x_t- x_t. (7) The anomaly classification task can be formulated as: At=(at,y^t),A_t=(a_t, y_t), (8) where at∈0,1a_t∈\0,1\ denotes the anomaly state and y^t y_t represents the anomaly label [30]. Since multiple sensor faults may occur simultaneously, y^t y_t may contain more than one anomaly label in multi-fault scenarios. The classifier is trained to accurately predict the anomaly labels by minimizing: ℒA=l(yt,y^t),L_A=l(y_t, y_t), (9) ψ∗=argminψℒA,ψ^*= _ψL_A, (10) where yty_t and y^t y_t denote ground truth and predicted anomaly labels respectively and l(⋅)l(·) denotes the model loss function [62]. When an anomaly is detected (OPENat=1)a_t=1), the framework generates a structured anomaly event: Et=(τt,t,^t,t,At),E_t= ( _t,x_t, x_t,r_t,A_t ), (11) where τt _t denotes the event timestamp. The anomaly event EtE_t serves as the primary information unit exchanged within AgenticTwin and is subsequently stored in the historical anomaly repository and passed to the LLM-powered agentic interface for retrieval, diagnosis, and mitigation reasoning. I-C Anomaly Knowledge Base To support grounded anomaly reasoning, we construct a curated anomaly knowledge base (KB) that contains structured descriptions of anomaly types observed in the benchmark environment. Existing CPS knowledge bases, such as MITRE ATT&CK for ICS [50] primarily focus on adversarial attack behaviors and industrial threat modeling, but do not directly provide descriptions tailored to sensor-level time-series anomalies. Therefore, we develop a lightweight anomaly taxonomy specifically designed for DT-driven anomaly analysis tasks. This knowledge base is designed as a modular and extensible component that can be replaced or expanded for different CPS environments. Rather than relying on a fixed anomaly ontology, the framework allows users to incorporate domain-specific anomaly taxonomies in a plug-and-play manner. The current taxonomy contains the following four anomaly types corresponding to the injected anomaly scenarios used in the benchmark dataset, adapted from [30]: (i) Spike: Defined as a sudden jump or drop in the signal affecting one or a few consecutive samples while the surrounding measurements remain within their normal range: xfaulty(t)=x(t)+n(t),x_faulty(t)=x(t)+n(t), (12) where n(t)n(t) represents the noise applied to the sensor data at time t. (i) Drift: A gradual deviation from the normal range over time. Drift faults induce a slow bias that results in a sustained offset between the measured and the true values: xfaulty(t)=x(t)+a⋅t,x_faulty(t)=x(t)+a· t, (13) where a controls the rate of change, leading to a gradual deviation from the original values. (i) Stuck-at: Occurs when the sensor output becomes frozen for consecutive intervals: xfaulty(t)=c,∀t∈[t1,t2],x_faulty(t)=c, ∀ t∈[t_1,t_2], (14) where c is the constant value assigned to the faulty sensor reading during the interval [t1,t2][t_1,t_2]. (iv) Replay: Occurs when current sensor values are replaced with previously recorded data over a time interval: xfaulty(t)=x(t−Δt),x_faulty(t)=x(t- t), (15) where Δt t represents the time lag. Each anomaly entry contains structured semantic information, including the anomaly definition, observable symptoms, possible causes, and recommended mitigation actions. The knowledge base is stored in a structured JSON format and queried during inference to provide retrieval-augmented grounding for the diagnosis and mitigation agents. To improve reliability, the knowledge base was manually reviewed and refined using domain knowledge and existing literature on anomaly analysis. An example knowledge base entry is shown in Figure 3, specifying the anomaly type, its definition, observable symptoms, possible causes, and recommended mitigation actions in a structured JSON format. Fig. 3: Entry in the anomaly knowledge base for a drift fault. Fig. 4: Modular breakdown of the predefined roles, goals, inputs, and output flows of the agents in AgenticTwin. I-D LLM-Powered Agentic Interface At the core of the AgenticTwin framework is the multi-agent LLM interface, forming the reasoning layer of the proposed framework. Its primary objective is to transform structured anomaly events into interpretable diagnosis explanations, contextual historical evidence, and mitigation recommendations for human operators. Rather than relying on a single monolithic LLM, AgenticTwin decomposes anomaly reasoning into multiple specialized agents coordinated through a supervisory architecture. Figure 4 illustrates the four-stage agentic reasoning workflow used in AgenticTwin: diagnosis, context retrieval, mitigation, and supervision. The DA receives the structured anomaly event, EtE_t and the anomaly knowledge base, KB. Its objective is to identify the anomaly type and generate grounded root-cause explanations. The output of the DA is represented as: DAt=ℱdiag(Et,KB).DA_t=F_diag(E_t,KB). (16) The RA retrieves and ranks previously observed anomaly cases that match the predicted anomaly type of the current event. Given an anomaly event EtE_t, the RA filters the historical anomaly repository using the predicted anomaly label(s) and returns only the records that share the same anomaly type. For single-label anomaly events, this reduces to retrieving historical cases with the same predicted anomaly type. For multi-label events, the agent retrieves previous cases that share at least one anomaly label with the current event. The RA then ranks these records according to their relevance to EtE_t by considering the observed sensor values, DT predictions, and residual patterns. The final ranked set is denoted by RAtRA_t. The MA generates corrective actions based on the DA’s outputs, retrieved historical evidence from the RA, and anomaly taxonomy information from the curated anomaly knowledge base (KB). The output of the MA is represented as: MAt=ℱmit(Et,DAt,RAt,KB).MA_t=F_mit(E_t,DA_t,RA_t,KB). (17) Finally, the SA coordinates the overall reasoning workflow of the agentic interface and synthesizes the final explanation as the response to the user. The output of the SA is represented as: SAt=ℱsup(DAt,RAt,MAt).SA_t=F_sup(DA_t,RA_t,MA_t). (18) I-E Evaluation Metrics Different evaluation metrics are used to assess the various reasoning tasks performed by the LLM agents in AgenticTwin. I-E1 Diagnosis Agent and Mitigation Agent Evaluation The DA and MA are evaluated by calculating the semantic similarity between the agents’ generated responses and the reference responses in our benchmark. Given a generated response gig_i and a reference response rir_i, their semantic similarity is computed using cosine similarity: Sim(gi,ri)=f(gi)⋅f(ri)‖f(gi)‖‖f(ri)‖,Sim(g_i,r_i)= f(g_i)· f(r_i)\|f(g_i)\|\|f(r_i)\|, (19) where f(⋅)f(·) denotes the sentence embedding function. I-E2 Historical Retrieval Agent Evaluation The RA is evaluated using Precision@k, Recall@k, and Mean Reciprocal Rank (MRR) as follows: Precision@k=|Rk∩R^k|k,Precision@k= |R_k∩ R_k|k, (20) Recall@k=|Rk∩R^k||R|,Recall@k= |R_k∩ R_k||R|, (21) MRR=1Q∑i=1Q1ri,MRR= 1Q _i=1^Q 1r_i, (22) where RkR_k denotes the set of relevant historical anomaly records, R^k R_k denotes the set of top-k retrieved records, R denotes the complete set of relevant records, Q is the number of retrieval queries, and rir_i is the rank position of the first relevant record retrieved for query i. IV Experimental Results and Discussion This section presents the experimental methodology and results used to evaluate the proposed AgenticTwin framework. IV-A CPS Testbed and Benchmark Construction TABLE I: Overview of the experimental dataset. Feature Total samples Training samples Testing samples Variables Count 34,991 27,992 6,999 3 We evaluate AgenticTwin using a publicly available weather dataset [36, 3]. We use meteorological observations collected by the Beutenberg weather station operated by the Max Planck Institute for Biogeochemistry in Jena, Germany [49]. The processed dataset contains a total of 34,991 samples collected at 10-minute intervals between January 1 and August 31, 2025. The dataset is split using an 80%-20% ratio into training and test sets, having 27,992 and 6,999 samples respectively. From the dataset, we consider three variables for our experiment, i.e., temperature, dew point temperature, and relative humidity. An overview of the dataset is outlined in Table I. Synthetic anomalies are injected into the training set to train the anomaly classifier and a separately injected held-out testing set is used for evaluation. Following the formulations introduced in Section I-C, we generate four anomaly categories: spike, drift, stuck-at, and replay. The anomalies are introduced across different sensors and timestamps to represent both transient and persistent faults. We construct single-fault scenarios, in which at most one anomaly occurs at a timestamp, and multi-fault scenarios, in which multiple anomaly types may simultaneously affect different sensor variables. The resulting benchmark contains normal and anomalous observations together with structured metadata, including timestamps, observed and DT-predicted values, residuals, and ground-truth anomaly labels. IV-B Anomaly Classification Models and Performance The anomaly classifier is responsible for identifying abnormal sensor behavior using DT-grounded evidence. Instead of relying solely on raw sensor values, the classifier operates on observed sensor measurements, DT-predicted values, and residual values described in Section I-A. The primary purpose of the anomaly classifier within the AgenticTwin framework is the generation of structured evidence that is used by the LLM-based reasoning layer. The classifier outputs the predicted anomaly state and labels. We evaluate multiple classification models, including Support Vector Machines (SVM) [10], Random Forest (RF) [25], eXtreme Gradient Boosting (XGBoost) [7], Light Gradient Boosting Machines (LightGBM) [33], Multi-Layer Perceptron (MLP) [52], Time Series Transformer (TST) [40], PatchTST [55], Timer-S1 [43], and TimesNet [75]. We evaluated the models using observed sensor values, DT predictions, and residuals. We further evaluated using both the single-fault (SF) and multi-fault (MF) scenarios. TABLE I: Performance of different classification models under single-fault (SF) and multi-fault (MF) anomalous conditions. Metric MLP SVM RF XGBoost LightGBM TST PatchTST Timer-S1 TimesNet SF MF SF MF SF MF SF MF SF MF SF MF SF MF SF MF SF MF Accuracy 0.98 0.94 0.70 0.71 0.89 0.84 0.88 0.82 0.89 0.84 0.94 0.87 0.79 0.84 0.74 0.84 0.92 0.86 Precision 1.00 0.99 1.00 1.00 0.98 0.95 0.94 0.97 0.96 0.97 0.98 0.99 0.77 0.76 0.71 0.75 0.97 0.93 Recall 0.95 0.90 0.40 0.40 0.79 0.72 0.76 0.66 0.79 0.70 0.90 0.86 0.82 0.85 0.83 0.81 0.88 0.86 F1-score 0.98 0.94 0.57 0.59 0.88 0.82 0.86 0.78 0.87 0.81 0.94 0.92 0.79 0.80 0.76 0.75 0.92 0.89 Table I compares the performance of all classification models under the aforementioned SF and MF settings. In SF, each timestamp contains at most one faulty variable, whereas in MF, multiple faults occur at the same timestamp simultaneously. Overall, most models achieve strong performance in SF, with MLP achieving the highest F1-score of 0.98 and TST achieving an F1-score of 0.94. Tree-based methods such as RF, XGBoost, and LightGBM also demonstrate competitive performance, with F1-scores ranging from 0.86 to 0.88. TABLE I: Transformer models under multi-fault conditions. Models LR Precision Recall F1-score W=16 W=32 W=16 W=32 W=16 W=32 TST 1e-3 0.98 0.98 0.85 0.86 0.91 0.92 3e-3 0.97 0.96 0.85 0.86 0.91 0.91 5e-4 0.99 0.99 0.84 0.85 0.91 0.91 PatchTST 1e-3 0.75 0.76 0.83 0.83 0.79 0.79 3e-3 0.77 0.76 0.83 0.84 0.80 0.80 5e-4 0.75 0.75 0.81 0.83 0.78 0.79 Timer-S1 1e-3 0.61 0.70 0.78 0.80 0.69 0.75 3e-3 0.70 0.75 0.70 0.74 0.70 0.74 5e-4 0.59 0.59 0.81 0.81 0.68 0.68 TimesNet 1e-3 0.90 0.92 0.86 0.81 0.88 0.86 3e-3 0.93 0.88 0.84 0.85 0.89 0.87 5e-4 0.91 0.91 0.83 0.83 0.86 0.87 Moreover, to explore the potential benefits of temporal modeling, we evaluated the performance of transformer models under different parameter settings in MF conditions, summarized in Table I. Among the models, TST consistently achieved the strongest performance, obtaining F1-scores up to 0.92 across different configurations. TimesNet also demonstrated stable behavior with F1-scores between 0.85 and 0.89, while PatchTST and Timer-S1 exhibited comparatively lower performance under certain settings. MF conditions introduce additional complexity, although their effect varies across models. Several models maintain strong performance, including MLP (F1 = 0.94), TST (F1 = 0.92), and TimesNet (F1 = 0.89). These results indicate that the anomaly classifier remains capable of producing reliable anomaly labels even when multiple faults occur concurrently. Overall, the results demonstrate that the DT-driven anomaly detection pipeline can accurately identify both SF and MF conditions within the CPS testbed. Since the objective of AgenticTwin is interpretable anomaly reasoning rather than detection itself, the best-performing classifier, MLP, is subsequently used to generate the structured anomaly labels consumed by the LLM-powered agentic interface of the framework. IV-C Benchmark Query Generation To systematically evaluate AgenticTwin’s reasoning capabilities, we construct an LLM-assisted benchmark containing a total of 12,000 synthetic operator queries generated from anomaly events. We chose a powerful, state-of-the-art proprietary reasoning model, Gemini 2.5 Pro [9] for this task. Each event is represented using its observed sensor values, DT predictions, residual features, anomaly labels, and fault metadata. These structured events are provided to an LLM through task-specific prompt templates that instruct it to generate realistic operator questions and corresponding reference responses. We generated 4,000 queries for each of the three task-specific subordinate agents (DA, RA, and MA respectively) in AgenticTwin: • Diagnosis queries: Seeking explanations of anomaly causes and fault characteristics. • Retrieval queries: Asking whether similar anomalies have previously occurred. • Mitigation queries: Requesting corrective actions or mitigation recommendations. For each query, Gemini 2.5 Pro also generates task-specific reference responses, using the injected anomaly metadata, DT outputs, and curated anomaly knowledge base. The generated queries and reference responses are subsequently reviewed for consistency and factual alignment, and the invalid samples are removed before evaluation. IV-D Evaluation of the Agentic LLM Interface We evaluate 15 LLMs in total, including the open-source Qwen [83], Llama [18], Gemma [69], Phi [1], DeepSeek R1 Distill [21], spanning small (≤ 3B), medium (4–8B), and large (>>8B) size groups. We also include one stronger proprietary baseline in our experiment, GPT 5.5 [65]. TABLE IV: Semantic similarity scores of the DA and MA without and with the knowledge base and their relative gain. Size Group Model Diagnosis Mitigation WKB KB G(%) WKB KB G(%) Small Qwen 2.5 0.5B It 0.48 0.64 33.3 0.42 0.60 42.9 Llama 3.2 1B It 0.59 0.76 28.8 0.50 0.69 38.0 Gemma 3 1B It 0.53 0.71 34.0 0.46 0.66 43.5 Qwen 2.5 3B It 0.67 0.84 25.4 0.61 0.80 31.1 Llama 3.2 3B It 0.61 0.79 29.5 0.57 0.77 35.1 Medium Qwen 3 4B 0.69 0.85 23.2 0.66 0.84 27.3 Phi 3.5 Mini It 4B 0.63 0.82 30.2 0.59 0.80 35.6 Qwen 2.5 7B It 0.74 0.88 18.9 0.71 0.87 22.5 Qwen 3 8B 0.71 0.87 22.5 0.69 0.86 24.6 DS-R1-Llama-8B 0.77 0.90 16.9 0.73 0.88 20.5 Large DS-R1-Qwen-14B 0.80 0.91 13.8 0.77 0.90 16.9 Gemma 3 14B It 0.75 0.89 18.7 0.74 0.89 20.3 DS-R1-Qwen-32B 0.84 0.93 10.7 0.82 0.92 12.2 Llama 3.3 70B It 0.82 0.93 14.6 0.81 0.92 14.8 Proprietary GPT-5.5 0.89 0.96 7.9 0.88 0.96 9.1 Average All models 0.69 0.84 22.3 0.66 0.84 26.3 Table IV compares the semantic similarity scores achieved by the Diagnosis Agent (DA) and Mitigation Agent (MA) without (WKB) and with (KB) access to the anomaly knowledge base, along with the respective gains (G%). Across all evaluated models, the inclusion of the knowledge base consistently improves reasoning quality. On average, the DA’s scores increase from 0.69 to 0.84, corresponding to an average gain of 22.3%, while the MA’s scores increase from 0.66 to 0.84, yielding an average gain of 26.3%. The gains are notable among smaller models, e.g., Qwen 2.5 0.5B Instruct achieves diagnosis and mitigation improvements of 33.3% and 42.9%, respectively, while Gemma 3 1B Instruct improves by 34.0% and 43.5%. Similar trends are observed for Phi 3.5 Mini Instruct 4B, which achieves gains exceeding 30% on both tasks. These results indicate that lightweight models benefit substantially from access to structured anomaly-specific knowledge. As model size increases, the relative gains generally decrease. Large models such as DeepSeek-R1-Distill-Qwen 32B and Llama 3.3 70B Instruct already exhibit strong performance without external grounding and therefore receive smaller relative improvements. GPT-5.5 achieves the highest absolute performance, reaching semantic similarity scores of 0.96 for both diagnosis and mitigation tasks. However, its relative gains are the smallest among all evaluated models, suggesting that much of the required knowledge for the evaluated tasks is already encoded within the model parameters. More importantly, several open-source models substantially narrow the performance gap after KB integration. For instance, DeepSeek-R1-Distill-Qwen 32B reaches diagnosis and mitigation scores of 0.93 and 0.92, respectively, approaching the performance of GPT-5.5 despite being considerably smaller and open-source. These findings demonstrate that providing access to the curated anomaly knowledge base significantly improves diagnosis and mitigation quality. Furthermore, results show that lightweight open-source models can achieve strong performance when provided with structured domain grounding. TABLE V: Performance evaluation of the RA. Size Group Model P@1 R@1 P@3 R@3 MRR Small Qwen 2.5 0.5B It 0.63 0.28 0.58 0.51 0.68 Llama 3.2 1B It 0.71 0.32 0.64 0.57 0.74 Gemma 3 1B It 0.67 0.30 0.61 0.55 0.71 Qwen 2.5 3B It 0.78 0.39 0.71 0.65 0.81 Llama 3.2 3B It 0.74 0.36 0.68 0.62 0.78 Medium Qwen 3 4B It 0.82 0.43 0.75 0.70 0.85 Phi 3.5 Mini It 4B 0.79 0.41 0.73 0.68 0.83 Qwen 2.5 7B It 0.86 0.49 0.80 0.76 0.89 Qwen 3 8B 0.83 0.46 0.77 0.73 0.86 DS-R1-Llama-8B 0.88 0.51 0.82 0.78 0.91 Large DS-R1-Qwen-14B 0.90 0.54 0.84 0.81 0.93 Gemma 3 14B It 0.87 0.52 0.81 0.78 0.90 DS-R1-Qwen-32B 0.92 0.58 0.86 0.84 0.95 Llama 3.3 70B It 0.91 0.56 0.85 0.82 0.93 Proprietary GPT-5.5 0.94 0.61 0.89 0.87 0.97 Average All models 0.83 0.45 0.76 0.71 0.85 Table V reports that across all models, the average scores reach 0.83 P@1, 0.76 P@3, and an MRR of 0.85, indicating that the repository consistently returns relevant historical anomaly cases. The retrieval results exhibit a smaller performance gap across model scales than those for diagnosis and mitigation tasks. While GPT-5.5 achieves the strongest overall performance (MRR = 0.97), several open-source models achieve comparable retrieval quality. For example, Llama 3.3 70B Instruct achieves 0.93 and even medium-sized models such as Qwen 3 8B achieve an MRR of 0.86. The strong retrieval performance provides contextual evidence that can subsequently be utilized by the MA. IV-E Agentic versus Monolithic Reasoning This study examines whether decomposing anomaly analysis into specialized agents improves performance relative to performing all reasoning tasks with a single monolithic LLM. We compare AgenticTwin with four monolithic baselines spanning different model scales: Qwen 2.5 3B Instruct, Qwen 2.5 7B Instruct, DeepSeek-R1-Distill-Llama 8B, and Llama 3.3 70B Instruct. These models have been chosen based on their task-specific performances in Tables IV and V while covering multiple model scales. For each monolithic baseline, a single LLM receives the complete information available for an anomaly event, including the observed and DT-predicted values, residual features, anomaly-classifier output, anomaly knowledge base, and historical anomaly repository. Through one unified prompt, the model is instructed to perform all three evaluated tasks: (i) anomaly diagnosis, (i) retrieval of relevant historical cases, and (i) mitigation recommendation. Its response is generated in a structured format so that the diagnosis, retrieval, and mitigation components can be evaluated separately using the corresponding metrics defined previously. In contrast, AgenticTwin decomposes these tasks across three lightweight models for this experiment. Qwen 2.5 3B Instruct serves as the DA, Qwen 2.5 7B Instruct serves as the RA, and DeepSeek-R1-Distill-Llama 8B serves as the MA. Each agent receives only the information required for its assigned task, and the output of one stage is made available to subsequent stages when needed. Combined, the three models (i.e., AgenticTwin in this experiment) contain 18B parameters. TABLE VI: Monolithic baselines versus AgenticTwin. Monolithic Baselines Metric Q 2.5 Q 2.5 DS-R1 L 3.3 AgenticTwin Model Size (B) 3 7 8 70 18† Diagnosis (Similarity) 0.61 0.64 0.64 0.70 0.93 Retrieval (MRR) 0.70 0.68 0.71 0.74 0.95 Mitigation (Similarity) 0.69 0.73 0.77 0.78 0.92 †AgenticTwin comprises three specialized agents with 3B, 7B, and 8B parameters (total: 18B assigned parameters). Table VI shows that AgenticTwin achieves the highest performance across all three tasks, obtaining diagnosis similarity, retrieval MRR, and mitigation similarity scores of 0.93, 0.95, and 0.92, respectively. In comparison, the strongest monolithic baseline, Llama 3.3 70B Instruct, reaches 0.70, 0.74, and 0.78 on the same tasks. AgenticTwin therefore improves over the best-performing baseline by 32.9% in diagnosis, 28.4% in retrieval, and 17.9% in mitigation. These results indicate that the observed improvements are not attributable solely to model size. Instead, decomposing anomaly analysis into the specialized DA, RA, and MA allows the framework to process task-specific evidence more effectively. These findings demonstrate the benefit of agent specialization and show that coordinated lightweight open-source models can outperform a substantially larger standalone model. This indicates AgenticTwin’s potential for resource-constrained CPS deployments. V Conclusion This paper presented AgenticTwin, a digital twin-integrated agentic LLM framework for interpretable anomaly analysis in cyber-physical systems. The framework extends conventional anomaly detection with specialized agents for diagnosis, historical retrieval, and mitigation reasoning. A curated anomaly knowledge base and historical repository provide domain information and prior cases that support more contextual and actionable responses for system operators. We also introduced a benchmark constructed by injecting anomalies into a real-world weather monitoring dataset to support controlled evaluation of LLM-based anomaly reasoning. Experimental results show that access to the anomaly knowledge base improves diagnosis and mitigation performance across the evaluated LLMs, with the largest relative gains observed for lightweight, open-source models. Furthermore, the lightweight AgenticTwin architecture outperforms all evaluated monolithic baselines, indicating that task specialization can potentially compensate for limited model scale. Overall, the findings demonstrate the potential of combining DT-based system modeling with lightweight LLMs for interpretable CPS decision support. Acknowledgment This work was supported by the National Science Foundation under Grant Number CNS-2423248. Disclosure of AI use. An AI-based language model (ChatGPT and Grammarly) was used to improve the grammar and readability of the manuscript. No scientific content was generated by the tool, and the authors retain full responsibility for the accuracy and integrity of the work. References [1] M. Abdin, J. Aneja, H. Behl, S. Bubeck, R. Eldan, S. Gunasekar, M. Harrison, R. J. Hewett, M. Javaheripi, P. Kauffmann, et al. (2024) Phi-4 technical report. arXiv preprint arXiv:2412.08905. Cited by: §IV-D. [2] S. H. Ahmadpanah (2026) Semantic-aware llm orchestration for proactive resource management in predictive digital twin vehicular networks. Computing 108 (1), p. 14. Cited by: §I. [3] T. Ahmed and M. Hasan (2025) Weather-driven agricultural decision-making under imperfect conditions. In Proceedings of the 33rd ACM International Conference on Advances in Geographic Information Systems, p. 927–930. Cited by: §I-A, §IV-A. [4] B. Airehenbuwa, T. Hasan, S. Sarkar, and U. Guin (2025) Advancing security with digital twins: a comprehensive survey. arXiv preprint arXiv:2505.17310. Cited by: §I. [5] P. Aivaliotis, K. Georgoulias, Z. Arkouli, and S. Makris (2019) Methodology for enabling digital twin using advanced physics-based modelling in predictive maintenance. Procedia Cirp 81, p. 417–422. Cited by: §I-A. [6] C. Chen, H. Fu, Y. Zheng, F. Tao, and Y. Liu (2023) The advance of digital twin for predictive maintenance: the role and function of machine learning. Journal of Manufacturing Systems 71, p. 581–594. Cited by: §I-A. [7] T. Chen and C. Guestrin (2016) Xgboost: a scalable tree boosting system. In Proceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining, p. 785–794. Cited by: §IV-B. [8] C. Cimino, E. Negri, and L. Fumagalli (2019) Review of dt applications in manufacturing. Computers in industry 113, p. 103130. Cited by: §I. [9] G. Comanici E. Bieber et al. (2025) Gemini 2.5: pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities. arXiv preprint arXiv:2507.06261. Cited by: §IV-C. [10] C. Cortes and V. Vapnik (1995) Support-vector networks. Machine learning 20 (3), p. 273–297. Cited by: §IV-B. [11] K. Course and P. B. Nair (2023) State estimation of a physical system with unknown governing equations. Nature 622 (7982), p. 261–267. Cited by: §I-A. [12] M. Deng, B. Fu, L. Li, and X. Wang (2026) Integrating llms and digital twins for adaptive multi-robot task allocation in construction. IEEE Transactions on Automation Science and Engineering. Cited by: §I-B. [13] M. Eckhart and A. Ekelhart (2019) Digital twins for cyber-physical systems security: state of the art and outlook. Security and Quality in Cyber-Physical Systems Engineering: With Forewords by Robert M. Lee and Tom Gilb, p. 383–412. Cited by: §I. [14] R. Ferdousi, M. A. Hossain, C. Yang, and A. El Saddik (2026) Defecttwin: when llm meets dt for railway defect inspection. IEEE Access. Cited by: §I-B. [15] X. Fu, M. Qin, P. Pace, C. Savaglio, W. Li, and G. Fortino (2026) Generative ai-driven digital twin in the manufacturing internet of things: a comprehensive survey. IEEE Internet of Things Journal. Cited by: §I. [16] A. Gautam, M. R. Aryal, S. Deshpande, S. Padalkar, M. Nikolaenko, M. Tang, and S. Anand (2025) IIoT-enabled digital twin for legacy and smart factory machines with llm integration. Journal of Manufacturing Systems 80, p. 511–523. Cited by: §I-B. [17] M. S. Gill, J. Vyas, A. Markaj, F. Gehlhoff, and M. Mercangöz (2025) Leveraging llm agents and dts for fault handling in process plants. In 30th International Conference on Emerging Technologies and Factory Automation (ETFA), p. 1–8. Cited by: §I-A, §I-C. [18] A. Grattafiori, A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Vaughan, et al. (2024) The llama 3 herd of models. arXiv preprint arXiv:2407.21783. Cited by: §IV-D. [19] N. P. Greis, H. P. Cherukuri, and J. C. Outeiro (2025) Multi-agent systems for manufacturing digital twins: a perspective on agency and large language models. IFAC-PapersOnLine 59 (10), p. 1612–1617. Cited by: §I. [20] M. Grieves and J. Vickers (2016) Digital twin: mitigating unpredictable, undesirable emergent behavior in complex systems. In Transdisciplinary perspectives on complex systems: New findings and approaches, p. 85–113. Cited by: §I. [21] D. Guo, D. Yang, H. Zhang, J. Song, P. Wang, Q. Zhu, R. Xu, R. Zhang, S. Ma, X. Bi, et al. (2025) Deepseek-r1: incentivizing reasoning capability in llms via rl. arXiv preprint arXiv:2501.12948. Cited by: §IV-D. [22] Z. Guo, F. Tang, L. Luo, M. Zhao, and N. Kato (2025) A survey on applications of large language model-driven digital twins for intelligent network optimization. IEEE Communications Surveys & Tutorials. Cited by: §I-B. [23] A. Haghshenas, A. Hasan, O. Osen, and E. T. Mikalsen (2023) Predictive dt for offshore wind farms. Energy Informatics 6 (1), p. 1. Cited by: §I-A. [24] A. Hasan and D. T. Nguyen (2026) Integrating agentic ai and digital twins for intelligent decision-making systems. Array, p. 100721. Cited by: §I-C. [25] T. K. Ho (1995) Random decision forests. In Proceedings of 3rd international conference on document analysis and recognition, Vol. 1, p. 278–282. Cited by: §IV-B. [26] Y. Hong, J. Wu, and R. Morello (2024) LLM-twin: mini-giant model-driven beyond 5g dt networking framework with semantic secure communication and computation. Scientific Reports 14 (1), p. 19065. Cited by: §I. [27] C. Hsu, G. Frusque, and O. Fink (2023) A comparison of residual-based methods on fault detection. arXiv preprint arXiv:2309.02274. Cited by: §I-B. [28] H. Huang, L. Yang, Y. Wang, X. Xu, and Y. Lu (2021) Digital twin-driven online anomaly detection for an automation system based on edge intelligence. Journal of Manufacturing Systems 59, p. 138–150. Cited by: §I. [29] Y. Huang, J. Zhang, X. Chen, A. H. Lam, and B. M. Chen (2024) From simulation to prediction: enhancing digital twins with advanced generative ai technologies. In IEEE 18th International Conference on Control & Automation (ICCA), p. 490–495. Cited by: §I-B. [30] S. U. Jan, Y. D. Lee, and I. S. Koo (2021) A distributed sensor-fault detection and diagnosis framework using machine learning. Information Sciences 547, p. 777–796. Cited by: §I-B, §I-C. [31] Y. Kalyani and R. Collier (2024) The role of multi-agents in digital twin implementation: short survey. ACM Computing Surveys 57 (3), p. 1–15. Cited by: §I-C. [32] K. E. Kampourakis, V. Gkioulos, and S. Katsikas (2026) Systematic integration of digital twins and constrained llms for interpretable cyber-physical anomaly detection. In IFIP International Conference on ICT Systems Security and Privacy Protection, p. 199–212. Cited by: §I-B. [33] G. Ke, Q. Meng, T. Finley, T. Wang, W. Chen, W. Ma, Q. Ye, and T. Liu (2017) Lightgbm: a highly efficient gradient boosting decision tree. Advances in neural information processing systems 30. Cited by: §IV-B. [34] R. Khaldi, A. Lehmann, B. Ghita, and U. Trick (2026) Agentic-ai framework for integrated design, implementation, testing, and operation of dt networks. IEEE Open Journal of the Communications Society. Cited by: §I. [35] K. Kobayashi and S. B. Alam (2024) Explainable, interpretable, and trustworthy ai for an intelligent digital twin: a case study on remaining useful life. Engineering Applications of Artificial Intelligence 129, p. 107620. Cited by: §I. [36] O. Kolle (2008) Documentation of the weather station on top of the roof of the institute building of the max-planck-institute for biogeochemistry. Recuperado de https://w. bgc-jena. mpg. de/wetter. Cited by: §IV-A. [37] P. Lekshmi and N. Karanjkar (2026) On integrating resilience and human oversight into llm-assisted modeling workflows for digital twins. In Proceedings of the ACM SIGSIM Conference on Principles of Advanced Discrete Simulation (PADS), Cited by: §I. [38] H. Li, H. Madhukumar, N. Methley, X. Chen, Y. Wu, J. Parra-Ullauri, V. Sharma, J. Lee, A. R. Koblitz, M. Andrews, et al. (2025) Future factories with 6g: agentic ai and cyber-physical digital twins. IEEE Internet of Things Journal. Cited by: §I-C. [39] N. Li, Z. Ma, R. Yu, and L. Li (2026) LSDTs: llm-augmented semantic digital twins for adaptive knowledge-intensive infrastructure planning. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 40, p. 38871–38879. Cited by: §I-B. [40] S. Li, X. Jin, Y. Xuan, X. Zhou, W. Chen, Y. Wang, and X. Yan (2019) Enhancing the locality and breaking the memory bottleneck of transformer on time series forecasting. Advances in neural information processing systems 32. Cited by: §IV-B. [41] B. Lim, S. Ö. Arık, N. Loeff, and T. Pfister (2021) Temporal fusion transformers for interpretable multi-horizon time series forecasting. International journal of forecasting 37 (4), p. 1748–1764. Cited by: §I-A. [42] Y. Ling and W. Liu (2026) SR-dtma: a digital twin-driven llm multi-agent framework for systemic risk simulation and coordinated decision-making in supply chains. Journal of Computer, Signal, and System Research 3 (1), p. 123–132. Cited by: §I-C. [43] Y. Liu, X. Su, S. Wang, H. Zhang, H. Liu, Y. Wang, Z. Ye, Y. Xiang, J. Wang, and M. Long (2026) Timer-s1: a billion-scale time series foundation model with serial scaling. arXiv preprint arXiv:2603.04791. Cited by: §IV-B. [44] Y. Lu, C. Liu, I. Kevin, K. Wang, H. Huang, and X. Xu (2020) Dt-driven smart manufacturing: connotation, reference model, applications and research issues. Robotics and computer-integrated manufacturing 61, p. 101837. Cited by: §I. [45] J. Ma, Y. Guo, C. Fang, and Q. Zhang (2024) Digital-twin-based cps anomaly diagnosis and security defense countermeasure recommendation. IEEE Internet of Things Journal 11 (10), p. 18726–18738. Cited by: §I-A. [46] N. Makarov, M. Bordukova, P. Quengdaeng, D. Garger, R. Rodriguez-Esteban, F. Schmich, and M. P. Menden (2025) Large language models forecast patient health trajectories enabling digital twins. npj Digital Medicine 8 (1), p. 588. Cited by: §I-B. [47] S. Mandal and N. E. O’Connor (2024) Llmasmmkg: llm assisted synthetic multi-modal knowledge graph creation for smart city cognitive digital twins. In Proceedings of the AAAI Symposium Series, Vol. 4, p. 210–221. Cited by: §I-B. [48] O. Mata, P. Ponce, C. Perez, M. Ramirez, B. Anthony, B. Russel, P. Apte, B. MacCleery, and A. Molina (2026) Digital twin designs with generative ai: crafting a comprehensive framework for manufacturing systems. Journal of Intelligent Manufacturing 37 (3), p. 1049–1072. Cited by: §I. [49] Max Planck Institute for Biogeochemistry Beutenberg weather station. Note: https://weather.bgc-jena.mpg.de/weather_data.htmlaccessed: 10-01-25 Cited by: §I-A, §IV-A. [50] MITRE (2026) https://attack.mitre.org/techniques/ics/. Cited by: §I-C. [51] M. H. Moharam, O. Hany, A. Hany, A. Mahmoud, M. Mohamed, and S. Saeed (2025) Anomaly detection using ml and adopted dt concepts in radio environments. Scientific Reports 15 (1), p. 18352. Cited by: §I-A. [52] F. Murtagh (1991) Multilayer perceptrons for classification and regression. Neurocomputing 2 (5-6), p. 183–197. Cited by: §IV-B. [53] A. Nechesov, I. Dorokhov, and J. Ruponen (2025) Virtual cities: from dts to autonomous ai societies. IEEE access 13, p. 13866–13903. Cited by: §I-B. [54] B. Nicoletti and A. Appolloni (2025) A digital twin framework for enhancing human–agentic ai–machine collaboration. Journal of Intelligent Manufacturing, p. 1–17. Cited by: §I-C. [55] Y. Nie, N. H. Nguyen, P. Sinthong, and J. Kalagnanam (2022) A time series is worth 64 words: long-term forecasting with transformers. arXiv preprint arXiv:2211.14730. Cited by: §IV-B. [56] Y. Pan, M. Wang, L. Lu, R. Lamsal, E. Pärn, S. Zlatanova, and I. Brilakis (2026) LLM-enabled multi-agent framework for natural language interaction with graph-based digital twins. Automation in Construction 183, p. 106791. Cited by: §I, §I-C. [57] K. Prantikos, L. H. Tsoukalas, and A. Heifetz (2022) Physics-informed neural network solution of point kinetics equations for a nuclear reactor digital twin. Energies 15 (20), p. 7697. Cited by: §I-A. [58] Q. Qi, F. Tao, T. Hu, N. Anwer, A. Liu, Y. Wei, L. Wang, and A. Y. Nee (2021) Enabling technologies and tools for digital twin. Journal of manufacturing systems 58, p. 3–21. Cited by: §I-A. [59] X. Qiu, Z. Li, W. Qiu, S. Hu, L. Zhou, X. Wu, Z. Li, C. Guo, A. Zhou, Z. Sheng, et al. (2025) Tab: unified benchmarking of time series anomaly detection methods. arXiv preprint arXiv:2506.18046. Cited by: §I-A. [60] M. Rahim, W. Lalouani, E. Toubal, and L. Emokpae (2024) A digital twin-based platform for medical cyber-physical systems. IEEE Access 12, p. 174591–174607. Cited by: §I-A. [61] T. Ritto and F. Rochinha (2021) Dt, physics-based model, and ml applied to damage detection in structures. Mechanical Systems and Signal Processing 155, p. 107614. Cited by: §I-A. [62] U. Saeed, Y. Lee, S. U. Jan, and I. Koo (2021) CAFD: context-aware fault diagnostic scheme towards sensor faults utilizing machine learning. Sensors 21 (2), p. 617. Cited by: §I-B. [63] I. H. Sarker, H. Janicke, A. Mohsin, A. Gill, and L. Maglaras (2024) Explainable ai for cybersecurity automation, intelligence and trustworthiness in digital twin: methods, taxonomy, challenges and prospects. ICT express 10 (4), p. 935–958. Cited by: §I. [64] C. Semeraro, M. Lezoche, H. Panetto, and M. Dassisti (2021) Digital twin paradigm: a systematic literature review. Computers in industry 130, p. 103469. Cited by: §I-A. [65] A. Singh, A. Fry, A. Perelman, A. Tart, A. Ganesh, A. El-Kishky, A. McLaughlin, A. Low, A. Ostrow, A. Ananthram, et al. (2025) Openai gpt-5 system card. arXiv preprint arXiv:2601.03267. Cited by: §IV-D. [66] Y. Sun, Q. Zhang, J. Bao, Y. Lu, and S. Liu (2024) Empowering digital twins with large language models for global temporal feature learning. Journal of Manufacturing Systems 74, p. 83–99. Cited by: §I-C. [67] F. Tao, Q. Qi, L. Wang, and A. Nee (2019) Dts and cps toward smart manufacturing and industry 4.0: correlation and comparison. Engineering 5 (4), p. 653–661. Cited by: §I. [68] S. J. Taylor and B. Letham (2018) Forecasting at scale. The American Statistician 72 (1), p. 37–45. Cited by: §I-A. [69] G. Team, T. Mesnard, C. Hardin, R. Dadashi, S. Bhupatiraju, S. Pathak, L. Sifre, M. Rivière, M. S. Kale, J. Love, et al. (2024) Gemma: open models based on gemini research and technology. arXiv preprint arXiv:2403.08295. Cited by: §IV-D. [70] A. Timms, A. Langbridge, A. Antonopoulos, A. Mygiakis, E. Voulgari, and F. O’Donncha (2025) Agentic ai for digital twin. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 39, p. 29703–29705. Cited by: §I-C. [71] M. Vahdati, K. Gholizadeh HamlAbadi, F. Laamarti, and A. El Saddik (2025) A multi-agent digital twin framework for ai-driven fitness coaching. In Proceedings of the ACM International Conference on Interactive Media Experiences, p. 380–385. Cited by: §I-B. [72] A. Vallée (2023) Digital twin for healthcare systems. Frontiers in Digital Health 5, p. 1253050. Cited by: §I. [73] J. Vyas and M. Mercangöz (2025) Autonomous industrial control using an agentic framework with large language models. IFAC-PapersOnLine 59 (6), p. 349–354. Cited by: §I-C. [74] J. Wang, A. Negrut, H. Wang, H. Zhang, and D. Negrut (2026) SimBench: a framework for evaluating and diagnosing llm-based digital-twin generation for multi-physics simulation. IEEE Access. Cited by: §I-B. [75] H. Wu, T. Hu, Y. Liu, H. Zhou, J. Wang, and M. Long (2022) Timesnet: temporal 2d-variation modeling for general time series analysis. arXiv preprint arXiv:2210.02186. Cited by: §IV-B. [76] Q. Wu, Y. Xie, P. Fan, D. Qin, K. Wang, N. Cheng, and K. B. Letaief (2026) Llm-based task offloading and resource allocation for dt edge computing networks. IEEE Transactions on Mobile Computing. Cited by: §I. [77] Y. Xia, Y. Chen, Y. Zhao, L. Kuang, X. Liu, J. Hu, and Z. Liu (2024) FCLLM-dt: enpowering federated continual learning with large language models for digital-twin-based industrial iot. IEEE Internet of Things Journal 12 (6), p. 6070–6081. Cited by: §I-B. [78] Y. Xia, D. Dittler, N. Jazdi, H. Chen, and M. Weyrich (2024) Llm experiments with simulation: llm multi-agent system for simulation model parametrization in dts. In 29th International Conference on Emerging Technologies and Factory Automation (ETFA), p. 1–4. Cited by: §I-C. [79] Y. Xia, N. Jazdi, and M. Weyrich (2025) An architecture for integrating large language models with digital twins and automation systems. In IEEE 30th International Conference on Emerging Technologies and Factory Automation (ETFA), p. 1–8. Cited by: §I-B. [80] H. Xu, S. Zlatanova, X. Li, M. Wachowicz, and M. Batty (2026) Towards fully automated city operations: integrating agentic ai with urban digital twins. Computers, Environment and Urban Systems 128, p. 102449. Cited by: §I-B. [81] Q. Xu, G. Zhou, C. Zhang, F. Chang, Y. Cao, and D. Zhao (2023) Generative ai and digital twin integrated intelligent process planning: a conceptual framework. preprint https://doi.org/10.21203/rs.3.rs-3652246/v1. Cited by: §I-B. [82] Q. Xu, S. Ali, and T. Yue (2023) Digital twin-based anomaly detection with curriculum learning in cyber-physical systems. ACM Transactions on Software Engineering and Methodology 32 (5), p. 1–32. Cited by: §I. [83] A. Yang, A. Li, B. Yang, B. Zhang, B. Hui, B. Zheng, B. Yu, C. Gao, C. Huang, C. Lv, et al. (2025) Qwen3 technical report. arXiv preprint arXiv:2505.09388. Cited by: §IV-D. [84] H. Yang, M. Siew, and C. Joe-Wong (2024) An llm-based digital twin for optimizing human-in-the loop systems. In IEEE International Workshop on Foundation Models for Cyber-Physical Systems & Internet of Things (FMSys), p. 26–31. Cited by: §I-B. [85] L. Yang, S. Luo, X. Cheng, and L. Yu (2025) Leveraging llms for enhanced dt modeling: trends, methods, and challenges. arXiv preprint arXiv:2503.02167. Cited by: §I. [86] C. Zhang, D. Song, Y. Chen, X. Feng, C. Lumezanu, W. Cheng, J. Ni, B. Zong, H. Chen, and N. V. Chawla (2019) A deep neural network for unsupervised anomaly detection and diagnosis in multivariate time series data. In Proceedings of the AAAI conference on artificial intelligence, Vol. 33, p. 1409–1416. Cited by: §I-B. [87] N. Zhang, C. Vergara-Marcillo, G. Diamantopoulos, J. Shen, N. Tziritas, R. Bahsoon, and G. Theodoropoulos (2024) Llms for explainable decisions in dynamic dts. In International Conference on Dynamic Data Driven Applications Systems, p. 81–89. Cited by: §I-B. [88] P. Zhao, Z. Ding, Y. Li, X. Zhang, Y. Zhao, H. Wang, and Y. Yang (2024) SGAD-gan: simultaneous generation and anomaly detection for time-series sensor data with generative adversarial networks. Mechanical Systems and Signal Processing 210, p. 111141. Cited by: §I-A. [89] M. S. Zia, C. Houpert, A. Anjum, L. Liu, A. Conway, and A. Peña-Rios (2025) Physics encoded blocks in residual neural network architectures for digital twin models. Machine Learning 114 (8), p. 180. Cited by: §I-A. Touseef Hasan (S’25) is pursuing his Ph.D. from the Department of Electrical and Computer Engineering in the School of Computing at Wichita State University, Wichita, KS, USA. He received his B.Sc. from Bangladesh University of Engineering and Technology, Dhaka, Bangladesh in 2024. His research interests include exploring the practical applications of LLMs in hardware security and digital twins. He is a student member of the IEEE. Mounika Ghanta (S’26) received her M.S in Computer Science and Software Engineering from Auburn University, AL, USA in 2025. She is currently pursuing her Ph.D. in Electrical Engineering from the Department of Electrical and Computer Engineering at Auburn University. She received the B.Tech. degree in Electronics and Communication Engineering from Hyderabad Institute of Technology and Management, India, in 2023. Her research interests include hardware security, digital twins, and LLMs. She is a student member of the IEEE. Souvika Sarkar (M’25) received her Ph.D. in Computer Science and Software Engineering from Auburn University in 2020. She is currently an Assistant Professor in the School of Computing at Wichita State University, Wichita, KS, USA. Prior to that, she completed her B.Tech in Computer Science and Engineering from West Bengal University of Technology, India, in 2012, and earned her M.E. in Software Engineering from Jadavpur University in 2018. Dr. Sarkar’s research interests include natural language processing (NLP), generative AI, LLMs, and building scalable and adaptive AI systems. Her research centers on developing efficient NLP systems, with a strong focus on interpretability, adaptability, and real-world impact. She has published widely in top-tier venues in AI and NLP. She actively serves the research community as a reviewer for leading conferences, including ACL, EMNLP, NAACL, and AACL. Ujjwal Guin (S’10–M’16–SM’22) received his Ph.D. in Electrical and Computer Engineering from the University of Connecticut in 2016. He is currently the Godbold Associate Professor in the Department of Electrical and Computer Engineering at Auburn University, Auburn, AL, USA. He earned his B.E. in Electronics and Telecommunication Engineering from Bengal Engineering and Science University, India, in 2004, and his M.S. in Electrical and Computer Engineering from Temple University, Philadelphia, PA, USA, in 2010. Dr. Guin’s research interests span hardware security and trust, supply chain security, cybersecurity, and VLSI design and test. He has developed a broad range of on-chip structures and techniques to enhance the security, trustworthiness, and reliability of integrated circuits. He has authored numerous journal articles and refereed conference papers, several of which have earned best paper nominations and awards. His research has been funded by the National Science Foundation (NSF) and multiple Department of Defense (DoD) institutions. He actively contributes to the academic community by serving on organizing and technical program committees for leading conferences, including HOST, ITC, VTS, and DAC.