A Computationally Feasible Framework for Causal Probabilistic Explanation

A Computationally Feasible Framework for Causal Probabilistic Explanation∗

arXiv:2609.04177v1 [cs.AI] 3 Sep 2026

Rafal Urbaniak Basis Research Institute

Sam Witty Sorbus AI

Andy Zane Basis Research Institute University of Massachusetts Amherst Emily Bunnapradist Basis Research Institute

Daniel Waxman Basis Research Institute Massachusetts Institute of Technology Poorva Garg University of California, Los Angeles

Sankaran Vaidyanathan University of Massachusetts Amherst

Drew Lehe HouseIQ

Jack Feser Basis Research Institute

Eli Bingham Basis Research Institute

Abstract Explaining why a specific outcome occurred, and which inputs deserve the blame or credit, is central to philosophical, scientific, and policy analysis. Existing tools split into two camps. The theory of actual causality (AC) gives principled verdicts, but only for toy-sized models, because computing them requires enumerating counterfactual scenarios. Scalable attribution methods like SHAP (or even causal SHAP) at least partially ignore the causal structure that generated the data, and can give answers that conflict with a careful causal analysis. We close this gap with Probabilistic Causal Impact (PCI). PCI builds on actual causality and on Pearl’s notions of probability of necessity and sufficiency, but recasts the question of explainability as an estimation problem on a probabilistic causal model that is easily approximated via Monte Carlo. By specifying a distribution over “candidate explanations,” a distribution over counterfactual values, and a scoring function, PCI provides tractable, causally grounded, graded explanations, generalizing AC and Pearl’s probability of causation as degenerate cases. We evaluate PCI in synthetic and real-world examples, spanning consistency checks with AC, scaling experiments, complex continuous-valued dynamical systems, and a real-world deployed causal machine learning model trained on millions of datapoints. Keywords: Probabilistic Causal Models, Explanation, Responsibility, Actual Causality, Probability of Necessity and Sufficiency.

∗

Code at https://github.com/rfl-urbaniak/explainable_paper and companion notebooks at https://rfl-urbaniak.github.io/explainable_paper/. Correspondence to rfl.urbaniak@gmail.com (https://rfl-urbaniak.github.io/). Preprint.

Contents 1

Introduction

3

2

Causal Impact: Motivations 2.1 Actual Causality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 Probability of Necessity and Sufficiency . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3 Path Forward . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

8 9 11 16

3

Causal Impact: Definitions 3.1 Continuous Outcomes and the General Causal Impact Function . . . . . . . . . . . . . . . . 3.2 Back to the Running Example: Verifying the Desiderata . . . . . . . . . . . . . . . . . . . .

17 28 28

4

Empirical and Comparative Evaluation: Overview 4.1 PCI matches actual-causality verdicts on canonical archetypes . . . . . . . . . . . . . . . . . 4.2 SHAP and Causal SHAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3 The Differential Causal Effect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.4 Scaling past exact actual causality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.5 Continuous, dynamical outcomes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.6 A real-world deployed model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

29 30 30 31 31 31 32

5

Examples and Comparison to SHAP and Causal SHAP 5.1 OBCB: SHAP and Causal SHAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.2 Signal with Mediation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.3 Computations and Desiderata Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.4 Summary Across Both Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

33 34 38 39 41

6

Relation with Actual Causality

41

7

Relation with the Probability of Actual Causality 7.1 Pearl’s Worked Example: The Desert Traveller . . . . . . . . . . . . . . . . . . . . . . . . . 7.2 PCI on the Basic Desert Traveller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.3 PCI Expectation vs the AC Machinery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.4 Weak-Poison Variant: Path-Reliability and Cross-Scenario Reliability . . . . . . . . . . . . . 7.5 Further Differences Between Pearl’s Probability of Causation and PCI . . . . . . . . . . . . . 7.6 Other probabilistic extensions of actual causation . . . . . . . . . . . . . . . . . . . . . . . . 7.7 Actual-causality-adjacent quantities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

49 49 50 51 52 54 55 57

8

Discussion and Conclusions

58

A Computations for the OBCB Running Example A.1 Alice’s probability of necessity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A.2 Alice’s probability of sufficiency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A.3 SHAP value function for Option A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

64 64 64 65

B SHAP and Causal SHAP: Definitions and Signal-with-Mediation Computations B.1 SHAP and Causal SHAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B.2 Distributional facts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B.3 Conditional expectations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B.4 Plain SHAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B.5 Causal SHAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B.6 PCI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

65 65 66 66 67 67 67

C Setup for the Desert-Traveller PCI Computation C.1 Structural model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C.2 PCI components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

68 68 68

D Synthetic Evaluation Across Linear, Overdetermined, and Undercutting Archetypes

69

E Comparison to Differential Causal Effect

71

F Scaling Actual-Cause Computation: An Empirical Comparison

73

G Dynamical SIR Benchmark: PCI on Continuous Outcomes

77

H Scaling PCI to a Real-World Automated Valuation Model

81

2

1

Introduction

Causal attribution, figuring out which factors brought about an outcome and to what degree, matters wherever we act on a model’s predictions: in lending, healthcare, or automated decision systems, knowing why something happened is often as important as the prediction itself [Shepherd et al., 2024, Cheshire and Magrini, 2009, Papageorgiou et al., 2022, Heckman and Pinto, 2022]. The tools most machine learning practitioners reach for by default often mistake predictive importance for causal responsibility, which makes their attributions causally uninterpretable. Consider the Old Boys’ Club Bank (OBCB), whose policy is to check an applicant’s credit score only if they are male; everyone else is rejected outright. Alice, a woman with bad credit, applies and is denied. Was she denied for her gender, or her credit? Intuitively the answer is clear: the bank never even looked at her credit score, so it played no role in her denial. SHAP [Lundberg and Lee, 2017] and a range of other feature-attribution tools, however, tend to split responsibility between gender and credit roughly evenly, because they reason from correlation and ignore which causal pathway was actually active for Alice specifically. Even standard “but for” tests fail here: hypothetically, if Alice were male her low score would have been checked, but still rejected; likewise, had Alice’s credit score been higher, she still would have been rejected due to that score not being considered. A naive assessment concludes that, since neither hypothetical changed the outcome, neither gender nor credit score is a cause. Actual causality (AC), a line of work spanning philosophy and AI [Halpern, 2016], gets this case right: it varies candidate causes while holding fixed certain aspects of the causal story, and assesses changes in outcomes. For Alice’s case, it hypothetially varies gender while holding fixed that Alice did not, in fact, fail a credit check (she never received one). Had she been a man who did not fail a credit check, Alice would have received a loan (Examples 1, 3). This correctly names her gender, not her credit, as the actual cause of her denial. Existing formalisations of actual causality, however, involve some combination of the following three limitations: they are all-or-nothing, treating a variable as either a cause or not with no notion of degree; they are computationally intractable beyond toy examples, because verifying that some witness set (a selection of variables held fixed at their actual values, our formal stand-in for a context) satisfies the definition requires an exhaustive search over exponentially many candidates; and they were developed primarily for deterministic models. This paper introduces probabilistic causal impact (PCI), an attribution method that returns a graded score, scales to large stochastic models without exhaustive search, and applies directly to machinelearned causal models (neural, Gaussian-process, or otherwise probabilistic) that practitioners actually build. It still gets Alice’s case right. At a high level, PCI asks two counterfactual questions per candidate cause, echoing Pearl’s probabilities of necessity and sufficiency: a sufficiency question (would the outcome have persisted had we changed nothing about a given feature?) and a necessity question (would it have changed had we intervened on it?). PCI restricts both questions to the causal pathways that were genuinely active, averaging over the reasonable ways of specifying which pathways those are. Because every quantity involved is a standard counterfactual query, the analyst can estimate the score by sampling from the same probabilistic-programming machinery already used to build the underlying model. The rest of this section makes this precise, positions PCI against existing methods, and introduces its central technical move. At minimum, a satisfactory causal attribution method should be (i) causally grounded, attributing responsibility based on whether “intervening on” (manipulating) a candidate cause would change the outcome; (ii) context-sensitive, distinguishing which causal pathways were active in a specific instance,2 (iii) broadly applicable, handling stochastic models, discrete and continuous variables, 2 We use context-sensitive in Halpern’s sense: sensitivity to which endogenous mediators are held fixed at their factual values during a counterfactual evaluation. Section 3 formalises this as the witness mechanism. This differs from sensitivity to the exogenous noise realisation u itself. Halpern’s literature calls u a context only because his models are deterministic: fixing u fixes every endogenous value outright, so “the context” and “the factual world” coincide there. Once mechanisms are stochastic, as throughout this paper, that coincidence breaks. Noise-realisation sensitivity is then a separate axis, on which every counterfactual or actual-cause query, ours included, trivially qualifies, unlike a population-level interventional query. PCI and actual causality differ from interventional measures precisely in the mediator-holding sense of context sensitivity: a “vanilla”

3

(a) PCI matches actual-causality verdicts on all ten archetype checks

(b) Runtime past exact AC's cutoff

(c) Accuracy past exact AC's cutoff

Figure 1: The headline result. (a) On a synthetic model with four causal archetypes (linear necessity/sufficiency, overdetermination, preemption, irrelevance), PCI’s score gaps agree with the actual-causality verdict across all ten checks, shown in green throughout. (b), (c) PCI stays tractable, in runtime and in correctattribution rate, well past the problem size at which exact actual-cause enumeration’s cost grows exponentially and becomes infeasible. Both methods run under a modest 60-minute compute budget on inexpensive hardware, chosen to gauge computational feasibility; the sizes reached scale with the compute and sample budget allotted. Section 4 reads this and the rest of the empirical story at a glance; full protocols are in Appendices D and F.

and counterfactual changes of any size; and (iv) tractable, estimable from samples without exhaustive enumeration over witness sets and alternatives.3 A further, stronger demand is a graded notion of causal explanation; we flag it here but do not treat it as a minimum bar, and develop it in full in Section 3. structural counterfactual, which recomputes every mediator downstream of an intervention instead of holding any fixed, fails this test. 3 This trades enumeration for Monte Carlo sampling: achieving a fixed estimator variance still requires a sample count that scales with the cardinalities of the suspect (candidate-cause) and witness sets, so the asymptotic cost does not improve, and we do not have a general way to know in advance when fewer samples suffice. Section F reports empirical scaling; Section 8 returns to this and other limitations.

4

Existing methods each forfeit at least one of these. Actual causality [Halpern, 2016] gets Alice’s case right but, as noted above, remains intractable beyond toy examples, with no clear approximation [Eiter and Lukasiewicz, 2002]. Methods that scale give up causal grounding or context-sensitivity instead. SHAP [Lundberg and Lee, 2017] attributes by correlation, so a feature can score highly merely for correlating with a true cause [Janzing et al., 2020]. Causal SHAP [Heskes et al., 2020] improves on this, yet still conflicts with the causal structure in some cases, which we return to in Section 5. The Differential Causal Effect [Butler et al., 2022] is causally grounded but local: relying on gradients, it misses non-infinitesimal effects, which are often of interest to a practitioner. The average and conditional treatment effect (ATE/CATE) are grounded and often tractable but not context-sensitive: they let an intervention’s effects propagate downstream through the structural equations regardless of which causal paths were active in the specific instance (Section 2). Table 1 summarises the tradeoffs. Actual causality

SHAP

Causal SHAP

PN/PS /PNS

DCE

ATE/ CATE

PCI

(i) causally grounded

✓

✗

∼

✓

✓

✓

✓

(ii) context-sensitive

✓

✗

✗

✗

–

✗

✓

(iii) broadly applicable

✗

✓

✓

✗

✗

✓

✓

(iv) tractable

✗

✓

✓

✓

✓

✓

✓

Table 1: Which of the four desiderata each attribution method satisfies. ∼ = partial; – = not addressed by design.

Table 1’s row (ii) is Alice’s case: actual causality names her gender as the cause because its witness mechanism holds the untriggered credit check fixed, while Pearl’s probability-ofnecessity/sufficiency family (PN/PS/PNS, three related quantities we define in Section 2), lacking any such mechanism, assigns her credit comparable responsibility despite it never being checked. Section 2 works through this example, and its stochastic counterpart, in full. To overcome these tradeoffs, PCI combines the context-sensitivity of actual causality with the scalability of probability-of-causation methods. PCI generalises Pearl’s probability of necessary and sufficient causation [Pearl, 2022] from binary to arbitrary variable domains.4 It also incorporates the witness mechanism from actual causality [Halpern, 2016], but changes its logical form: Halpern’s account asks whether some witness set, out of exponentially many, reveals the dependency; PCI instead asks how much of a Γ-weighted distribution over candidate-cause and witness sets reveals it, replacing an existential quantifier with an expectation.5 A witness set records which variables stay at their factual values while PCI varies a candidate cause, so causal paths inactive in the factual 4 Kawakami et al. [2024] independently extend PNS to continuous and vector-valued variables by a different route. Their Definition 3.1 fixes two treatment levels x0 , x1 and an outcome threshold y, and reads necessity and sufficiency off the inequality Yx0 < y ≤ Yx1 ; exogeneity and monotonicity then identify these quantities nonparametrically, from observational distributions alone. PCI substitutes an alternative-value distribution ∆ for the fixed contrast and a user-chosen impact kernel ci for the fixed threshold. Monotonicity drops out because PCI evaluates both counterfactual worlds inside a fitted causal model, which supplies the cross-world quantities by simulation. The identification burden moves onto that model (Section 8). The witness mechanism then adds context-sensitivity; Section 7.6 returns to the contrast. 5 That context should be weighted is intuitive. Suppose someone drops a lit match near a gas station and a fire results. In one scenario they are standing right next to the fuel pump when they drop it. In another they are two hundred feet away, far from anything flammable, but as they drop it a squirrel happens to be running past, and the match grazes its tail, setting it alight. Panicked, the squirrel runs toward the gas station, and its burning tail starts the fire there. A purely existential account of actual causality treats both scenarios the same: some witness set makes the match-drop a cause of the fire in each case, so both get an identical verdict. But the second scenario’s causal chain runs through an improbable fluke, and intuitively the match-dropper bears less responsibility for it than in the first. Weighting witness sets gives PCI a natural place to encode this: a Γ is a distribution over how likely some features are to be a cause or a witness - and a Γ distribution that would assign little mass to freak actual contingencies like the squirrel’s detour lets the score track how ordinary the enabling context was (and similarly, weighting alternative values based on how likely they, as encoded in ∆, are can play a role in such considerations too).

5

world stay blocked even under intervention, delivering the context-sensitivity that ATE and CATE lack. The witness mechanism also decides how multiple, simultaneously active candidates rank against each other. A variable that merely correlates with the one that did the work, or is downstream of it, can outscore it. Holding the right variables fixed as witnesses reverses that. Without witnesses, PCI makes the same mistake SHAP does, ranking Alice’s credit above her gender. With them, gender outranks credit, the correct order (Section 5.1). Witnesses turn a 0.034 margin between a mediator and its upstream cause into a 0.133 one (Section 5.2). And they let PCI separate a reliable cause from an unreliable one across forensic scenarios in the desert-traveller example (Section 7.4). This move makes PCI tractable, but it is also the source of its main risk. Existential search over witness sets forces AC’s brute-force enumeration; an expectation admits Monte Carlo sampling from Γ instead, at a cost: Γ-mass on witness sets that do not reveal a dependency can swamp a single witness set that does, or sampling can simply miss it if it is rare enough. In the worst case, rare dependencies can be as expensive to find with sampling as with enumeration (Section 8). Four considerations limit the damage. First, converting the search problem to a sampling problem lets us study statistical estimation efficiency and provides a ”computational effort” knobs (the number of samples, sampling method choice, etc.) that control success. That is, it lets us fix a computational budget and then study whether it will achieve the desired results. The practical aspect of this is that models with structural regularities let sampling run far cheaper than the worst case above suggests. In the actual-cause benchmark (Section F), for instance, any superset of a witness set witnesses the same attribution, so restricting the search to small witness sets costs little accuracy even though it never visits the larger sets a wider search would check. PCI’s definition assumes no such regularity, but when a model has it, the sampling budget can be spent narrowly without losing coverage. The second is formal: switching from existential search to an expectation does not make PCI blind to real actual causes. Section 6 proves, under conditions given there, that a candidate’s PCI score is positive exactly when it is an actual cause in Halpern’s sense. The third is more general. Missing a rare event under finite sampling is a familiar tradeoff, not a weakness specific to PCI; every Monte Carlo procedure faces it. Here, though, the tradeoff is explicit: the sample budget and the witness-cardinality bound are choices the analyst makes, and Section F reports how correct-attribution rate changes as each is loosened or tightened, so increasing either reduces the chance that sampling misses a rare witness set. Prior work anticipates pieces of PCI’s construction. Halpern’s own account already averages over exogenous noise when computing probabilities of causation [Halpern, 2016]. Beckers and Vennekens [2015] weight alternative replacement values by how probable they are. Both aggregate over witness sets in restricted settings [Beckers and Vennekens, 2015, Halpern, 2016]. And Chockler and Halpern [2004] let the size of that set modulate the verdict: their degree of responsibility is 1/(k+1), where k counts the variables that must be shifted off their actual values before the outcome depends counterfactually on the candidate. No prior construction combines all four into a single estimator that scales to arbitrary variable domains. PCI keeps Chockler and Halpern’s intuition that the size of the set doing the work should count, replacing their fixed reciprocal with the cardinality band of the variable selection distribution Γ, which the analyst sets (Section 3); Section 7.7 treats this and the other actual-causality quantities in the same terms. Every quantity entering the PCI definition is a standard interventional or counterfactual quantity, so computing a score asks nothing of a modelling tool beyond what counterfactual reasoning already asks: a way to write down a structural model, intervene on it, and sample under the resulting counterfactual semantics. Any system providing those operations can evaluate PCI’s expectations by Monte Carlo for any model it expresses, with no permodel derivation. We use ChiRho, a causal extension of the probabilistic programming language Pyro,6 though nothing in the construction depends on that choice. That requirement is substantive. PCI presumes access to a trained probabilistic causal model that supports sampling counterfactual outcomes, whereas Causal SHAP and the probability-ofnecessity/sufficiency (PN/PS/PNS) bounds of Mueller et al. [2022] work from observational data and a causal graph alone. The outputs differ accordingly. Those bounds give intervals on the prob6

https://basisresearch.github.io/chirho/explainable_sir.html

6

ability of causation, and PCI, given a fully specified model, gives a full posterior over its score, summarised as a point estimate via the mean. Within that requirement, we place no strong restrictions on the form of the model, its distributions, or its variable types. Such a model can include standard machine learning components, neuralnetwork-parametrized distributions or Gaussian processes among them. A feed-forward probabilistic program of this kind is still a structural causal model, one whose structural equations happen to be parametrized by a neural network rather than specified by hand. Xia et al. [2023] show that such neural causal models, being universal approximators, are expressive enough to represent the same nonparametric counterfactual quantities available to an explicitly specified structural model. This expressiveness does not by itself resolve non-identification, though: many mechanisms can fit the same observed data equally well, and no amount of representational flexibility changes that. Instead, PCI operates in a Bayesian setting: its score averages the counterfactual outcome over the posterior the trained model induces, spanning both mechanisms and their parameters, much as Bayesian model averaging marginalizes over which of several candidate models generated the data.7 The earlier claim of no strong restrictions is about the model’s functional form only. Obtaining a posterior that reflects the data well is a separate, nontrivial problem for complex neural or Gaussianprocess mechanisms, and we do not attempt to solve it here.8 Paper structure. The paper proceeds in five phases, laid out in Figure 2, with the supporting appendix material collected in a separate band. The first phase establishes motivation and formalism. Section 2 works through a running example to draw out what actual causality, the probability of necessity/sufficiency, and average/conditional treatment effects each get right and miss, motivating the design choices behind PCI. Section 3 then defines the method: a kernel built from a sufficiency check at the factual configuration and a necessity check against alternatives, integrated over a distribution of suspect/witness sets, with three components given as user choices: the variable selection distribution Γ, the alternative-value distribution ∆, and the causal impact function. With PCI defined, the second phase previews the payoff before the detailed argument. Section 4 reads each empirical and comparative result at a glance and defers the full protocols to the appendices: PCI recovers the actual-causality literature’s verdicts on overdetermination and undercutting (Appendix D); it diverges from gradient-based Differential Causal Effect attribution where the local gradient misreads the counterfactual contrast (Appendix E); it stays tractable where exact actualcause enumeration times out at 17 variables, continuing to roughly 73–145 variables (where the tests time out after 60 minutes) and holding a 0.85 correct-attribution rate as far as 89 (Appendix F); it delivers a graded comparison on a continuous-outcome dynamical SIR model, assigning lockdown roughly twice the responsibility of masking where but-for reasoning cannot separate them (Appendix G); and it scales to a deployed automated valuation model with machine-learned components trained on millions of points, where SHAP concentrates attribution on a few downstream variables while PCI spreads it across the upstream causal structure (Appendix H). A reader who wants the shape of the argument can stop here; the next two phases develop each comparison in full. The third phase positions PCI against existing attribution methods. Section 5 compares PCI with SHAP, Causal SHAP, ATE, and CATE on two worked examples (OBCB, with two binary features, and a signal-with-mediation model), tabulating which desiderata each satisfies or fails, including cases where SHAP and even Causal SHAP track correlation rather than counterfactual dependence. The fourth phase establishes the formal relationship between PCI and actual causality. Section 6 shows that under specific choices of Γ and ∆ the PCI kernel is positive on a configuration exactly when that configuration is an actual cause in Halpern’s sense, so approximate AC verdicts can be read off the kernel without enumerating witnesses. Section 7 positions PCI against Pearl’s probability of actual causation: on the canonical desert-traveller example PCI recovers Pearl’s within7

PCI, like actual causality, presupposes a causal model. Whether that model is identified from the available data, domain knowledge, or experiments is a prior question, and one this paper inherits rather than settles. 8 Treating non-identification this way is a substantive position, and its merits have been debated at length in general [Poirier, 1998, Gustafson, 2015, Moon and Schorfheide, 2012] and for causal inference specifically [Rubin, 1978, Richardson et al., 2011]. We adopt it here without defending it. A reader who declines it can still read the posterior spread of the score as a sensitivity analysis, reporting its range in place of its mean and recovering an interval of the kind partial-identification methods target [Manski, 2003, Zhang et al., 2022].

7

scenario ranking with graded magnitudes, and a weak-poison variant reveals two further responsibility intuitions (path-reliability and cross-scenario reliability) that PCI’s expectation captures and Pearl’s binary indicator cannot express. Section 8 closes the fifth phase with discussion. We engage related work where it bears on the argument. The broader literature on actual-causality-based attribution and responsibility scores (probabilities of causation, degree of blame and harm, and score-based explanations in databases and machine learning, surveyed by Bertossi [2023]) comes up mainly in Sections 6 and 7 and the discussion.

Inspirations

Definitions & Running Example

Probability of Necessity & Sufficiency

Actual Causality

Variable Selection Dist.

Evaluation

Alternative Value Dist.

Necessity & Sufficiency Measure

Causal Impact

Preview of Empirical & Comparative Results

Preview

Positioning

vs SHAP

vs Prob. of Necessity & Sufficiency

vs Causal SHAP

vs Actual Causality

vs Prob. of Actual Causality

SUPPORTING MATERIAL — APPENDICES (Pointed to in the Overview)

A–C

Appendices Supporting Detail

D

Running-Example Computations F

E

Synthetic Eval, Continuous Variables G

Scaling Up vs Exact AC

vs Differential Causal Effect H

Dynamical SIR Model

Real-World Valuation Model

Figure 2: Roadmap of the paper. PCI builds on two ideas, actual causality and the probability of necessity and sufficiency (top tier). From there the paper develops the motivations (Section 2), defines PCI (Section 3), previews the empirical and comparative payoff (Section 4), positions it against SHAP, Causal SHAP, PNS, actual causality, and the probability of actual causation (Sections 5 to 7), and closes with discussion; we defer the running-example computations and benchmark protocols to the appendices, to which the preview points.

Reproducibility. A set of companion notebooks reproduces every quantitative claim in this paper (the worked-example numbers, the benchmark tables, and the figures), rendered with their full outputs at https://rfl-urbaniak.github.io/explainable_paper/. Throughout, we point to the relevant notebook by name (for example obcb_computations); each name links to its page on that site.

2

Causal Impact: Motivations

The central difficulty in causal attribution is not computing counterfactuals: it is knowing which counterfactuals to compute. Consider two questions: the type question (does X tend to cause Y ?) and the token, or actual-causation, question (was X’s contribution live in the specific situation we are

8

explaining?). Methods built to answer the former routinely miss the latter, as Section 1’s Alice already showed: a cause can be genuine in general yet causally inactive in one particular case, making no difference to what actually happened. The running example below makes this precise. There are principled probabilistic theories of type-level causal strength (Sprenger [2018], for instance, derives a difference-making measure p∗ (E | C) − p∗ (E | ¬C) axiomatically), but they deliberately bracket the token-level question of which cause was live in the case at hand, and amalgamate mediators just where the context-sensitivity we are after requires tracking them. Among the closest predecessors of this approach, none individually achieves all of this: actual causality handles context sensitivity but is computationally intractable and not general enough; the probability of necessity and sufficiency scales well, but lacks context sensitivity. This section builds intuition for both limitations through a running example, setting up the design choices that motivate PCI in Section 3. We first revisit Halpern’s actual-cause construction on a deterministic Old Boys’ Club Bank (OBCB) example to see what witnesses do and why a plain but-for clause misses Alice’s case. Turning to a stochastic OBCB, we then introduce the probabilistic machinery actual causality lacks, Pearl’s PN/PS/PNS, and show that, without witnesses, these measures cannot register Alice’s missing credit check either. A closing “Path forward” subsection distils what PCI must inherit from each predecessor before Section 3 formalises it. 2.1

Actual Causality

Consider the following (deterministic, discrete) model: Example 1 (Bob at Old Boys’ Club Bank). Bob applied for a home mortgage loan with the local branch of OBCB, and his application was denied. The OBCB policy requires applicants to pass a credit score check, but it only performs this check if the applicant is male; all non-male applicants are rejected outright. Thus, the procedure is: check = (gender = male) check -failed = check ∧ (credit = bad) loan = ¬check -failed ∧ (gender = male) An intuitive explanation for Bob’s denial is that his credit was bad: had it been good, the outcome would have been different. In contrast, his gender does not appear to be responsible for the rejection: had it been different, his application still would have been denied (albeit this time due to check = F ). This suggests a counterfactual approach to feature responsibility attribution: identify the features responsible for a particular outcome by asking whether it would have been different had a specific feature taken a different value. This is called the but-for clause: Bob wouldn’t have been denied the loan but for his bad credit. Concretely, consider a model M with exogenous variables U, which are the source of stochasticity, and endogenous variables V, which are influenced by other variables in the model. Let S ⊆ V be the variables we suspect to be causally responsible (call them causal suspects), and Y ∈ V be an outcome of interest. Suppose we consider only one suspect S ∈ S and mark factual values with ⋆ . Under a setting U = u of the exogenous variables, M produces S = s⋆ and Y = y ⋆ , denoted (M, u) ⊨ S = s⋆ , Y = y ⋆ . We read ⊨ as “yields” (the model under noise u makes the stated equalities true), and its crossed form ̸⊨ as “does not yield” (the stated event fails to hold). We call this the factual scenario. An intervened model where a variable S is set to an alternative value s′ is denoted (M, u)[S ← s′ ]. A first attempt at defining a counterfactual notion of causal responsibility, following the counterfactual-dependence tradition [Lewis, 1973, Halpern, 2016], is: Definition 2 (But-for, single). S = s⋆ is causally responsible for Y = y ⋆ in (M, u) if and only if (M, u) ⊨ S = s⋆ , Y = y ⋆ and (M, u)[S ← s′ ] ̸⊨ Y = y ⋆ for some s′ ̸= s⋆ . In a given context, S is causally responsible for an outcome only when intervening on S with some alternative value would change that outcome. Bob’s credit score satisfies this condition: had his credit score been higher, the loan might have been approved. However, this cause test is too coarse. Consider another case:

9

Example 3 (Alice at OBCB). Alice is a woman with bad credit. She applies for a loan with OBCB and is rejected. Yet under the but-for clause for single cause candidates, neither her gender nor her credit score is responsible for Alice’s denial. No matter how high her credit score, her application would still have been denied because the bank does not, effectively, loan to women. Had her gender been different, she would still have been denied for having bad credit. To address this example, we could consider sets of factors as causes: Attempt 4 (But-for, sets). Variables C ⊆ S with factual values C = c⋆ are causally responsible for Y = y ⋆ in (M, u) if and only if (M, u) ⊨ C = c⋆ , Y = y ⋆ and (M, u)[C ← c′ ] ̸⊨ Y = y ⋆ for some c′ everywhere different from c⋆ , where no proper subset of C has this property. The minimality condition reflects our preference for explanations that include only relevant properties. Under this generalization, the set c⋆ = {gender = female, credit = bad} is jointly responsible for Alice’s application being denied because there exists c′ = {gender = male, credit = good} that would change the decision and c⋆ is minimal; neither gender nor credit alone would have changed the decision. On individual features, we could say that the whole set bears responsibility but individual features do not, or that any feature in a cause set is partially and equally accountable. Neither is satisfying: the first denies that any single feature is responsible, and the second spreads responsibility evenly between them regardless of context. This conflicts with our intuition: OBCB did not evaluate Alice’s credit score, so her denial was caused by her gender. This verdict does not rest on counterfactual reasoning alone. Tracing the model on Alice’s inputs, her denial is produced through the gender term of the loan equation, while credit enters only through check -failed , which is false and never propagates to the outcome. So on a production (causal-process) view of causation [Hall, 2004], credit transmits no influence to Alice’s denial at all. Actual causality’s witness-based counterfactual test, developed below, recovers exactly this production-tradition verdict, so the diagnosis that gender alone is responsible is not an artifact of one chosen formalism. The actual-causality literature calls this structural pattern preemption, also called undercutting [Lewis, 1973, Halpern, 2016], the term we use from Section 3 onward, paired with overdetermination as the two archetypes the synthetic evaluation (Appendix D) targets: two distinct causal routes might each have been sufficient to produce the outcome, but only one is actually engaged, with the other prevented from operating. Alice’s gender preempted her credit by preventing the check from happening, so credit had no chance to act. The closely related notion of over-determination [Paul and Hall, 2013, Halpern, 2016] covers cases in which multiple sufficient causes coexist without one preempting the other (e.g., two simultaneous fatal shots). Both phenomena defeat a simple single-cause but-for test, since intervening on any one of the candidate causes leaves the outcome unchanged.9 Halpern’s construction offers a way out of this difficulty: hold some of the context in which counterfactuals are evaluated fixed, calling such fixed variables witnesses. Let us focus on the mediator check -failed between gender and loan. If we fix this variable at the factual value by intervening, then counterfactually, Alice would have been granted the loan if she were male. However, there is no context fixed at the actual value such that, had her credit score been higher, she would have been granted the loan. Enumerating the candidate causes, their counterfactual treatments, the witness held fixed, and the resulting outcome makes the test concrete (Alice’s factual run is gender =female, credit=bad, giving check -failed =0 and loan=denied): Candidate cause C

Treatment c′

Witness T = t⋆

Outcome (loan)

gender =female gender =female credit=bad

→ male → male → good

check -failed =0 none (recomputed) any

denied → granted denied → denied denied → denied

9 The canonical preemption example: Jim is both stabbed and poisoned, and dies. Stabbing works quickly, so it kills Jim before the poison takes effect, and the stabbing caused his death. But-for clauses fail to break the symmetry here as well: removing the stabbing leaves Jim dead by poison, and removing the poison leaves him dead by stab.

10

Fixing the mediator check -failed at its factual value reveals gender as an actual cause (row 1); without the witness the intervention recomputes the mediator and the outcome does not flip (row 2); no witness makes credit a cause (row 3). This motivates the following formalization: Definition 5 (Actual cause (modified Halpern–Pearl)). Let S ⊆ V be a suspect pool and W ⊆ V a witness pool, observed in (M, u) at factual values S = s⋆ and W = w⋆ . A cause set C ⊆ S at its factual setting C = c⋆ is an actual cause of Y = y ⋆ in (M, u) if there is a witness set T ⊆ W disjoint from C such that: • Factivity. The cause, the witness pool, and the outcome are all observed at their factual values: (M, u) ⊨ C = c⋆ , W = w⋆ , Y = y ⋆ . • Witnessed necessity. Holding T at its factual setting t⋆ while intervening on the cause overturns the outcome, for some alternative c′ distinct everywhere from c⋆10 :   (M, u) C ← c′ , T ← t⋆ ̸⊨ Y = y ⋆ . • Minimality. No proper subset of C satisfies the two conditions above. Definition 5 is Halpern’s modified definition of actual causality [Halpern, 2015, 2016], specialized to an explicit suspect pool S and witness pool W. PCI uses Halpern’s modified definition, with witnesses held at their actual values; prior probabilistic extensions of actual causation instead build on the original Halpern–Pearl definition (Section 7.6). This definition extends but-for causality with a witness set T that is fixed to its factual value by an intervention. Under this definition, to determine the cause of an outcome, we need to find a cause set C, alternative values c′ (trivial if the variables are binary and less so if they are categorical or continuous), and a witness set T. C and T are drawn from sets of size at most 2|V| , so a brute-force computation is expensive. The witnessed-necessity template above is the Halpern–Pearl definition, which has been refined considerably since: Beckers and Vennekens [2018] rebuild actual causation from a production/dependence pair, Beckers and Vennekens [2017] chart when it is (in)transitive and asymmetric, and Beckers [2021b,a] ground it in NESS-style sufficient sets, where a cause is a necessary element of a set that suffices for the outcome; and Beckers [2025] most recently extends it to nondeterministic structural models. We build on the same witnessed-necessity core. It has two halves: necessity under intervention, and sufficiency of the held-fixed configuration. We treat both as graded quantities, anticipating the probabilistic turn below. Putting computational difficulties aside, the deeper limitation of the construction so far is that it lives entirely in deterministic models. Real-world attribution problems are typically probabilistic: policies apply with some probability, mechanisms occasionally fail or are overridden, and the analyst usually wants to reason about the unit-level outcome in the presence of this noise. One can, of course, place a distribution over the exogenous noise u and read off the probability of the actualcause verdict; this is the route taken by Pearl’s probability of causation [Pearl, 2009] and by the degree-of-blame and harm constructions of Chockler, Halpern, and Beckers [Chockler and Halpern, 2004, Beckers et al., 2022, 2023]. The result is a probabilistic envelope around the same binary kernel, with the same computational demands. This construction (Pearl’s probability of actual causation [Pearl, 2009, Def. 10.3.5]) is also the closest neighbour of PCI and agrees with it in simple cases, so we defer a precise side-by-side comparison to Section 7. The computational demands it inherits from the underlying binary kernel are one reason we turn next to a different family of attribution tools. 2.2

Probability of Necessity and Sufficiency

To bring probability into the picture, we now consider a stochastic variant of the OBCB example in which the bank’s gendered policies apply only with some probability: women are checked only 10 Halpern’s original clause (restated without this normalization as Definition 23 in Section 6) only requires c′ ̸= c⋆ , not a coordinatewise difference on every variable in C; the two are equivalent given minimality, since if c′ agrees with c⋆ on some coordinate, dropping that coordinate from C yields a smaller set that already witnesses necessity, so a minimal C can always be witnessed by a fully-distinct c′ . We state the fullydistinct version here for a cleaner search procedure; Section 6 uses Halpern’s original statement to keep the correspondence proofs literal.

11

sometimes, men are skipped only sometimes, and even when the check happens its outcome is occasionally overridden by loan-officer discretion. This is the natural setting for Pearl’s probabilities of necessity, sufficiency, and their conjunction (PN, PS, PNS) [Pearl, 1999, Tian and Pearl, 2000],11 introduced in this subsection. These scale gracefully into the stochastic regime but, without an analogue of the witness mechanism, mis-attribute Alice’s denial. Example 6 (OBCB, stochastic). The bank performs credit checks for a randomly selected 20% of women and skips checks for a randomly selected 10% of men. Unchecked applicants are rejected. Furthermore, if a man’s credit check fails, he is nevertheless accepted 5% of the time and if a woman’s credit check succeeds, she is denied 10% of the time. We assume that the population is evenly divided into male and female and good and bad credit. Formally, the model, using 1 for male and 1 for good credit, is:

loan-prob(gender , check -failed ) = gender =0 gender =1

check -failed =0 0.9 1

check -failed =1 0 0.05

credit ∼ Bern(0.5) gender ∼ Bern(0.5) check | gender ∼ Bern (1 − gender ) · 0.2 + gender · 0.9

check -failed = check · (1 − credit)
loan-if -checked | gender , check -failed ∼ Bern loan-prob(gender , check -failed ) loan = loan-if -checked · check

Ug

gender

Uch

check

credit

check failed

Uc

bottleneck

candidate cause witness / mediator

Uℓ

outcome

loan if checked

intermediate exogenous noise

loan

denied

Figure 3: Causal structure of the OBCB loan model (Example 6). Node shape and colour encode role: the candidate causes gender and credit (teal boxes), the witness check -failed (gold hexagon), and the outcome loan (purple double box); intermediate variables are grey. Dashed circles are the exogenous noise UV feeding each stochastic mechanism; the deterministic nodes check -failed and loan carry none. check reaches loan along two routes: through the check -failed bottleneck and directly as the screening gate (loan = loan-if -checked · check ). PCI holds the bottleneck witness fixed to keep these two routes distinct.

With this stochastic model in hand, we can state seven desiderata that any responsibility attribution for Alice and Bob should satisfy, giving every construction in the rest of the paper an explicit target. 11

Probabilities of causation have also been put to work outside token-level attribution: Wang and Jordan [2021] formalize representation-learning desiderata (non-spuriousness, efficiency, and disentanglement) as computable criteria built from probabilities of causation, paralleling our use of the same primitives for feature attribution.

12

Let R(V ⇝ loan | person) denote the causal responsibility of variable V for the loan outcome at the individual level. R is a placeholder for any attribution score, not a specific formal quantity; PCI interprets R as the PCI score PCIXk of Definition 19. The desiderata themselves are method-agnostic: they encode the graded active/preempted/irrelevant ordering and the cross-individual asymmetry that the actual-causality and preemption literature already distinguishes [Lewis, 1973, Hall, 2004, Halpern, 2016]. PN, PS, PNS, SHAP, and Causal SHAP are held to this same independently motivated standard below and in Section 5. Here V ranges over the candidate variables; in the general development it is the variable of interest Xk . Attribution methods may produce signed values; the desiderata are stated in terms of absolute magnitudes |R(·)|, allowing for directionality: D-A1

|R(gender ⇝ loan | Alice)| > 0

D-A2

|R(credit ⇝ loan | Alice)| > 0

D-A-rank

|R(gender ⇝ loan | Alice)| > |R(credit ⇝ loan | Alice)|

D-B1

|R(gender ⇝ loan | Bob)| > 0

D-B2

|R(credit ⇝ loan | Bob)| > 0

D-B-rank

|R(credit ⇝ loan | Bob)| > |R(gender ⇝ loan | Bob)|

D-comp

|R(gender ⇝ loan | Alice)| > |R(gender ⇝ loan | Bob)|

D-A1 and D-A2 both require non-zero attribution for Alice because two distinct causal routes were available. Gender filtered her out at the checking stage. Credit is not causally inert either: the check is only probabilistic (women are still checked with positive probability, γF = 0.2 in the model above), so conditioning on Alice’s denial leaves nonzero probability that she was in fact checked, in which case her bad credit was the operative cause. The broader principle is a graded ordering of three roles. An active cause, on the path that actually produced the outcome, carries the most responsibility. A preempted cause retains a residual share: strictly positive, yet strictly below the active cause (exactly what D-A-rank demands), governed by the probability that the preemption fails to fire, leaving the credit route live. An irrelevant variable, with no active path to the outcome under any context, receives the least of all, approaching zero. This is a deliberate departure from the binary Halpern–Pearl/Beckers treatment of preemption, which collapses the first two roles by zeroing a fully preempted cause. D-A-rank is the substantive constraint: because Alice never underwent a credit evaluation, gender’s causal role is immediate, whereas credit’s is purely hypothetical. A method that ranks credit above gender for Alice is misattributing the cause of her rejection. For Bob, D-B2 reflects that the credit check occurred and directly produced the rejection: the causal chain credit → check -failed → loan was activated. D-B1 requires strictly positive attribution for gender : being male gave Bob a 90% probability of being checked, so gender opened the evaluation that rejected him. This indirect causal role is non-zero; a method returning exactly zero fails to capture it. D-B-rank corresponds to the intuition that credit is the proximate cause. D-comp captures the cross-individual asymmetry that is hardest for naive methods to express: gender is more causally responsible for Alice’s rejection than for Bob’s. For Alice, gender =female was overwhelmingly likely to produce the rejection on its own (evaluation happens only 20% of the time for women, so credit is rarely the operative factor); for Bob, gender =male reliably opened the evaluation (a 90% chance) that credit=bad then caused. We verify in Section 3 that PCI satisfies all seven desiderata, while PN, PS, PNS, developed next in this section, fail some of them. Later, we will also revisit this example and its desiderata in the context of SHAP and Causal SHAP (Section 5). Returning to the comparison between the two predecessors: the witness mechanism works well for deterministic models, but actual causality in its standard form offers no straightforward way to handle probabilistic ones. Before extending the witness idea to the stochastic setting, it is instructive to examine a probabilistic approach that scales more naturally, Pearl’s probabilities of necessity and sufficiency [Pearl, 2022], and to ask what it would miss without witnesses. This will let us identify what probabilistic machinery is needed, and what context-sensitivity is lost when witnesses are absent, motivating the synthesis that PCI provides. The following definitions allow for probabilistic models, but assume that all variables are Boolean (PCI will relax this assumption, allowing for continuous variables). Pearl considers two ways that a cause may relate to an effect: it may be necessary or sufficient for the effect. A cause is necessary if, counterfactually absent the cause, 13

the effect is unlikely to occur; it is sufficient if the effect is likely when the cause counterfactually occurs. We now formalize these ideas and discuss them in the context of the running example. Definition 7 (Probability of Necessity). Let the probability of necessity [Pearl, 1999] be the probability that the outcome Y = y would not have occurred in the absence of C = c⋆ , given that both occurred: PN (C = c⋆ , Y = y ⋆ ) = P (Yc′ ̸= y ⋆ | C = c⋆ , Y = y ⋆ ) , where Yc′ is the value of Y after intervening on C with c′ ̸= c⋆ .12 Strictly speaking, the probability of necessity is less specific to a particular situation than the actualcause test above: as written, it conditions only on the cause–outcome pair, so it asks whether being male causes someone to be denied, not whether it caused Bob (whose bad credit we already know) to be denied. We therefore report two readings. The population-level value conditions only on the cause and outcome, exactly as the definition prescribes. The individual-level value additionally conditions on the subject’s other observed features (for Bob, on credit = bad), specializing the query to that person. The individual-level reading is the one closer to actual causation; we report both throughout, and the same population/individual split applies to PS and PNS below. We illustrate the computation for Alice’s gender. Alice is factually gender = female, credit = bad, loan = F ; the counterfactual intervenes to set gender = male while leaving credit = bad. Tracing the male-intervention branches through the model (Appendix A, §A.1) gives PN (gender = female, loan = F | Alice) = 0.9 · 0.05 = 0.045. Computing the analogous quantities for the remaining (variable, person) pairs gives the individual-level values shown in Table 2; the table also lists population-level values for comparison. The PN scores partially align with intuition: Bob’s bad credit is high (PN = 0.90), and his gender score is zero, matching the reading that his gender played no role. But Alice’s PN values do not separate gender (0.045) from credit (0.18) particularly well, and Alice’s gender PN is only marginally above Bob’s, not the sharp distinction we would want, given that the bank never even evaluated Alice’s credit. PN cannot register this asymmetry: it asks counterfactually what would happen under intervention without any context about which causal paths were active. For the full picture we need a second quantity, the probability of sufficiency. Definition 8 (Probability of Sufficiency). Let the probability of sufficiency be the probability that the outcome Y = y ⋆ would have occurred in the presence of C = c⋆ , given that neither C = c⋆ nor Y = y ⋆ occurred: PS (C = c⋆ , Y = y ⋆ ) = P(Yc⋆ = y ⋆ | C = c′ , Y ̸= y ⋆ ) where c′ ̸= c⋆ and Yc⋆ is the value of Y after intervening on C with c⋆ . To query whether the factual cause was sufficient, we condition on the counterfactual: we assume the cause did not take its factual value and the outcome did not occur, then intervene to restore the factual cause value and ask whether the outcome now occurs. Intuitively, this asks: if the cause had been absent and things had gone differently, would reinstating the cause have brought the outcome about? We illustrate PS for Alice’s gender. Following the same convention as for PN , the individual-level computation additionally conditions on Alice’s credit (credit = bad): we fix her credit but flip the cause and outcome to their non-factual values (gender = male, loan = T ), then intervene to restore gender = female and ask whether the loan is again denied. Both check branches yield loan = F (Appendix A, §A.2), so PS (gender = female, loan = F | Alice) = 1. The remaining individual values, along with population-level values for comparison, appear in Table 2. Two cases warrant comment: Bob’s gender PS is undefined because the required conditioning event (gender = female, credit = bad, loan = T ) has probability zero in the model; Bob’s credit PS is 0.955 rather than 1 because the model includes a 5% exception rate for males who fail the credit check. To combine the insights of the two scores, we would like to find causes that are both necessary and sufficient. This notion is formalized as follows: 12 Read in twin-network fashion [Balke and Pearl, 1994, Pearl, 2009]: one draws an exogenous noise u ∼ PU , computes the factual Y under the unintervened structural equations and the counterfactual Yc′ under the intervened equations, and conditions on the joint event {C = c⋆ , Y = y ⋆ }. Both Y and Yc′ live on the same probability space and share the same u.

14

Definition 9 (Probability of necessity and sufficiency). Let the probability of necessity and sufficiency be the probability that the outcome Y = y ⋆ would have occurred in the presence of C = c⋆ and that it would not have occurred under the intervention C = c′ : PNS (C = c⋆ , Y = y ⋆ ) = P(Yc⋆ = y ⋆ , Yc′ ̸= y ⋆ ). This quantity factorises into a weighted sum of PN and PS by the consistency rule of counterfactuals [Pearl, 2009, §9.2]: PNS (C = c⋆ , Y = y ⋆ ) = P (C = c⋆ , Y = y ⋆ ) PN (C = c⋆ , Y = y ⋆ ) + P (C = c′ , Y ̸= y ⋆ ) PS (C = c⋆ , Y = y ⋆ ).

Table 2: PN , PS , and PNS for Alice and Bob in Example 6, with loan = F as the outcome. “Population” values condition only on the cause–outcome pair prescribed by the definition; “Individual” values additionally condition on the subject’s other factual variable (e.g. for Alice’s gender, on credit = bad). A dash marks an entry that is undefined because the conditioning premises are inconsistent with the model.

Alice

Bob

Variable

Level

PN

PS

PNS

PN

PS

PNS

gender gender credit credit

Population Individual Population Individual

0.43 0.045 0.53 0.18

0.83 1.00 0.96 1.00

0.39 0.045 0.52 0.18

0.02 0 0.53 0.90

0.10 — 0.96 0.955

0.01 0 0.52 0.86

The population- and individual-level PNS values appear in the rightmost column group of Table 2. These values capture the relative causal impact of gender and credit but are not entirely satisfying. Table 2 reveals the problem directly: for Alice, PNS (gender ) = 0.045 < PNS (credit) = 0.18, so PNS ranks credit as more causally responsible than gender. Yet the bank never evaluated Alice’s credit: the check variable was F throughout. PNS has no mechanism to register this: it asks counterfactually what would happen if credit were different, without fixing check -failed , the mediating variable that blocked credit’s causal path. As an attempt to help us better understand Alice’s particular situation, we might consider a modification of PNS with additional conditioning: PNS c (C = c⋆ , Y = y ⋆ | Z = z ⋆ ) = P (Yc⋆ = y ⋆ , Yc′ ̸= y ⋆ | Z = z ⋆ ) Using this definition, we can compute PNS c (gender = female, loan = F | credit = bad) = 0.045 and PNS c (credit = bad, loan = F | gender = female) = 0.18. Conditioning does not solve the problem described above (Alice’s credit was in reality never evaluated) because the interventions override the mediating variable that tracks whether her credit has been checked. When we compute PNS c (credit = bad, loan = F | gender = female), conditioning on gender being female is consistent with the factual, but when we then intervene to set credit to good, this intervention propagates downstream and changes check -failed , overriding what we learned from conditioning on Alice’s factual outcome. The context we fixed is undone by the very intervention meant to probe it. We will not consider this use of conditioning further. This observation motivates the need to intervene on (as opposed to condition) mediating variables that provide important context, which the witness mechanism supplies. ATE and CATE share the same limitation. The two most familiar causal quantities in the ML and statistics literature are the average treatment effect ATE(T ) = E[Y | do(T =1)] − E[Y | do(T =0)], where do(·) denotes Pearl’s intervention operator [Pearl, 2009], and the conditional version CATE(T | X=x) = E[Y | do(T =1), X=x] − E[Y | do(T =0), X=x]. Computed on our stochastic OBCB, population ATE ranks credit (0.518) above gender (0.383), mirroring the population PN ranking. At the individual level for Alice, CATE(credit | gender =female) = 0.18 and CATE(gender | credit=bad) = 0.045. These are exactly Alice’s individual PNS values: with binary outcomes and PS = 1 in the relevant branches, CATE for a single treatment collapses to PNS c , so the same check -failed propagation that undermined PNS c undermines CATE. A second, sharper failure follows from CATE’s inability to condition on the factual treatment value: 15

CATE(gender | credit=bad) = 0.045 is identical for Alice and Bob even though one’s gender carried her denial outright while the other’s merely opened the credit check that then rejected him. The structural limitation cuts across PNS, ATE, and CATE alike, so the witness mechanism in Section 3 is not just a fix for PNS but a general repair for the family of methods that average counterfactual effects without intervention-based context-sensitivity. 2.3

Path Forward

The two predecessors examined in this section have complementary strengths and blind spots. Halpern’s actual causality is context-sensitive: by holding witnesses fixed at their factual values, it correctly diagnoses Alice’s case, attributing her denial to gender rather than credit. But in its standard form it is restricted to deterministic models, it requires a brute-force search over witness sets, and it has no native treatment of continuous variables. Pearl’s PN/PS/PNS make the converse trade-off. They scale naturally to probabilistic models, because every counterfactual reduces to an expectation under the noise distribution. But they have no analogue of the witness mechanism: every intervention propagates through the structural equations and overrides whatever mediator value the factual context fixed. Table 2 shows the symptom: for Alice, PNS (credit) > PNS (gender ), even though the credit check was never performed. Any replacement therefore needs intervention-based context-sensitivity, holding the relevant mediators fixed by intervention. PCI delivers exactly this, combining three ingredients into a single estimator. From actual causality it takes the witness mechanism: it holds relevant context fixed by intervention, so the structural information about which causal paths were active survives the counterfactual evaluation. From PN/PS/PNS it takes a probabilistic vocabulary: it expresses counterfactuals as expectations under the noise distribution, so the attribution lives on the same probability space as the model and extends naturally to continuous variables. And in place of brute-force enumeration over witness sets, it integrates over a distribution of them, an integral estimable from samples even when the witness pool is large or the variables continuous. Returning to Alice, PCI reverses the ranking PNS produced (Table 2), recovering the intuitive verdict. We revisit the example in full once the method is defined (Section 3, with the complete computation in Appendix A). Two features distinguish PCI from both predecessors. Unlike actual causality, it does not ask whether some witness set validates a counterfactual dependency; it integrates over a distribution of witness sets, weighting each by its probability. This replaces combinatorial enumeration with statistical estimation. The gain is also conceptual. Existential quantification certifies a cause as soon as some witness set validates the dependence, a sensitivity that graded and normality-based accounts were introduced in part to address, by weighting alternatives according to how typical they are instead of treating any single one as decisive. Integration weights each witness set by its probability, so a variable is responsible to the degree that typical witness sets render it efficacious. The witness still does the work of holding context fixed. PCI simply declines to privilege one hand-picked set, letting the structural facts decide which witnesses carry the mass (for Alice, those pinning check -failed favour gender; almost none favour credit). As a by-product, actual causality’s binary verdict becomes a graded magnitude. Unlike PN/PS/PNS, it inherits the context-sensitivity of actual causality through this integration: it downweights causally inert variables automatically, because almost every witness set leaves them disconnected from the outcome, while it upweights variables that drive the outcome, because almost every witness set leaves them connected. The formal definitions in Section 3 make this expectation precise. With the limitations of both predecessors in mind, we turn in Section 3 to the formal development. The next section introduces PCI piece by piece (PSCM scaffolding, the variable selection distribution Γ, the alternative-value distribution ∆, the joint necessity-sufficiency measure, and the user-chosen causal impact function ci) and verifies on the same Alice/Bob example that the resulting attribution satisfies all seven desiderata stated above (p. 13).

16

3

Causal Impact: Definitions

Explanation and causal attribution seek to connect a potentially causal event X = x to an outcome event Y = y.13 We return to Example 6 to ground the formal development that follows, using Alice and Bob as running illustrations throughout this section. Both are rejected for a loan; the question is which of their attributes (gender and credit) was causally responsible for each rejection, and to what degree. While the example is discrete, the machinery applies to continuous and mixed-type variables; a continuous illustration is given in Sections 5.2 and D. Roadmap of this section. Section 2 already stated seven desiderata (p. 13) that any responsibility attribution for Alice and Bob should satisfy; they give the formal construction below an explicit target. We introduce the probabilistic structural causal model (PSCM) and interventions, the substrate on which everything else rests, and then the two distributions PCI offers to the user: the variable selection distribution Γ over suspect/witness pairs and the alternative-value distribution ∆ over counterfactual cause settings. We combine these into the joint necessity-sufficiency measure Pks,n and the user-chosen causal impact function ci whose expectation is the PCI score, showing how the choice of ci generalises the framework from binary to continuous outcomes. Finally we compute the score on the OBCB example, verify that all seven desiderata hold, and contrast PCI’s necessity/sufficiency decomposition with Pearl’s PN/PS/PNS. Recall R(V ⇝ loan | person), the placeholder for the causal responsibility of variable V for the loan outcome at the individual level used to state those desiderata (Section 2, p. 13): PCI interprets R as the PCI score PCIXk of Definition 19, but the desiderata themselves are method-agnostic. Here V ranges over the candidate variables; in the general development it is the variable of interest Xk . We work within the context of probabilistic structural causal models [Pearl, 2009]. Definition 10 (Probabilistic Structural Causal Model (PSCM)). A probabilistic structural causal model is a tuple M = ⟨U, V, F, PU ⟩, where V = {V1 , . . . , Vn } is a finite set of endogenous variables, U = {U1 , . . . , Um } is a set of exogenous variables (not necessarily one per endogenous variable: a deterministic mechanism, fi depending only on Pai , needs no Ui of its own), and F = {f1 , . . . , fn } is a set of structural assignments Vi := fi (Pai , Ui ), i = 1, . . . , n, with Pai ⊆ V \ {Vi } denoting the parents of Vi , and Ui ∈ U ∪ {∅} its own exogenous input, if any (a purely deterministic fi takes Ui = ∅ and depends on Pai alone). The distribution PU is a probability measure on dom (U), and the assignments in F are assumed to be acyclic and to have a unique solution for V given U.14 A PSCM encodes which variables influence which others, through what mechanisms, and subject to what randomness. The structural equations specify each variable as a deterministic function of its causal parents and local noise; the exogenous distribution captures all irreducible uncertainty in the system. Together they make every counterfactual question well-posed and computable. The OBCB model (Example 6) is a PSCM with endogenous variables V = {gender , credit, check , check -failed , loan-if -checked , loan}, and exogenous variables U = {Ugender , Ucredit , Ucheck , Uloan-if -checked } which induce independent Bernoulli noise. 13

This is quite different from type-level causal queries, where one is interested in some group-level attribution, as when one estimates average treatment effect or conditional average treatment effect. 14 Working within the PSCM framework commits the practitioner to fully specified structural assignments F and an exogenous distribution PU , analogous to how Bayesian inference requires a likelihood and a prior. This enables PCI to yield individual-level counterfactual attributions rather than population-level bounds, and once F and PU are specified, sampling from PU is a routine probabilistic inference operation.

17

The structural assignments in the case at hand take the form Vi = fi (Pai , Ui ) promised by the PSCM definition above. Each stochastic node is a Bernoulli draw whose success probability is a primitive parameter of the model (possibly depending on the node’s parents); writing V ∼ Bernoulli(p) for a node equal to 1 with probability p, the mechanisms are gender ∼ Bernoulli(pg ), credit ∼ Bernoulli(pc ),
check | gender ∼ Bernoulli γF (1 − gender ) + γM gender , check -failed = check (1 − credit),
loan-if -checked | gender , check -failed ∼ Bernoulli loan-prob(gender , check -failed ) , loan = loan-if -checked · check . So gender and credit are fair coin flips; check fires with probability γF for women and γM for men; check -failed and loan are deterministic functions of the nodes above them (Figure 3). The Bernoulli draws are coupled across factual and counterfactual worlds, making counterfactuals welldefined. For the running example we take pg = pc = 0.5, γF = 0.2, γM = 0.9, and the values of loan-prob given in Example 6. Definition 11 (Interventions). Given a model M = ⟨U, V, F, PU ⟩, an intervention on variables X = {X1 , . . . , Xk } ⊆ V with values x = (x1 , . . . , xk ) replaces the structural assignments for Xi by Xi := xi , where i = 1, . . . , k. We denote this intervention by either [X ← x] or do(X = x). An intervention surgically replaces a variable’s structural equation with a fixed constant, disconnecting it from its usual causes. The rest of the model propagates downstream as normal under the new assignment; the exogenous noise is unchanged. In the OBCB model, do(gender = 1) replaces Alice’s gender assignment with male, leaving all other structural equations intact. The downstream effect propagates: check now draws from Bern(0.9) instead of Bern(0.2), so Alice would be checked in 90% of noise realizations. This is the counterfactual world in which we ask whether her loan outcome would have differed. Since PCI supports arbitrary variable types, it will be helpful to define a measure-theoretic object corresponding to interventional outcomes; because outcomes are a deterministic function of exogenous noise, this object turns out to be a Dirac measure. Definition 12 (Pointwise Interventional Law). Let M = ⟨U, V, F, PU ⟩ be a probabilistic structural causal model and let Y ∈ V. For an intervention do(X = x), let Y ′ : dom (U) → dom (Y ) denote the measurable map induced by the modified structural assignments. The pointwise interventional law of Y at fixed u ∈ dom (U) is the probability measure on dom (Y ) defined by P (Y ∈ A | u, do(X = x)) := I{Y ′ (u) ∈ A} = δY ′ (u) (A),

A ⊆ dom (Y ).

The pointwise interventional law records the deterministic outcome of Y under do(X = x) for a fixed noise realization u: since the modified structural equations make Y a function of u alone, its distribution collapses to a point mass. Integrating over PU then recovers the full interventional distribution. The suspect and witness apparatus introduced below is built from a single primitive, defined next. Definition 13 (Causal set). Given a model ⟨U, V, F, PU ⟩, a causal set is a set of pairs X = x where X ∈ V and x ∈ dom(X). Informally, a causal set is a list of specific variable-value assignments, a precise statement of which variables are set to which values. It is the basic unit of intervention: from a causal set one can read off exactly what is being manipulated or held fixed. In PCI, causal sets play four distinct roles, two on the cause side and two on the context side: Suspects S. The full set of variables suspected to bear on the outcome. Subsets of S will be sampled and intervened on. Active suspects C ⊆ S. The specific subset intervened on in a given search step, either to alternative values (necessity regime) or to factual values (sufficiency regime). 18

Witnesses W. The full set of context variables that may be held fixed at their factual values. Subsets of W will be sampled and held fixed. Active witnesses T ⊆ W. The specific subset held fixed in a given search step. To avoid contradicting the active intervention, T is pruned so that T ∩ C = ∅. Why prune T and not C? The conflict on T ∩ C has to be resolved in one direction or the other, and pruning the witnesses is the right choice for three reasons. First, C is the object of the test: it encodes the causal claim being evaluated, while T is the auxiliary device that holds context fixed. Pruning C would silently change the claim under test; pruning T leaves the claim intact and merely weakens the context held fixed. Second, the convention extends cleanly to the limit C = V, where every variable is a suspect: the pruned T collapses to ∅ and we recover the unconditional but-for test, the right baseline behaviour. Pruning C instead would leave this limit undefined whenever any witness is sampled. Third, the convention inherits directly from Halpern’s actual-cause definition (Definition 5), which makes T ∩ C = ∅ part of the definition; pruning post-sampling is the operational implementation of that constraint and lets us specify Γ on the unconstrained product 2S × 2W rather than baking disjointness into the prior. To evaluate the causal impact of a variable on an outcome, we consider two interventional regimes: the necessity regime, in which we intervene on the variables C ⊆ S to have an alternative value, and the sufficiency regime, in which we intervene so that C takes on factual values. Moreover, we hold some elements T ⊆ W of the context fixed (i.e., intervened on to retain factual values, despite intervention on C). This is exactly what makes the necessity component context-sensitive in Halpern’s sense [Halpern, 2016]: the alternative cause is evaluated against a held-fixed witness configuration, not in isolation. We will reuse this terminology throughout: “context-sensitive necessity” refers to the necessity regime evaluated under an active witness set T. When looking for an explanation, we perform a search across possible cause sets and possible contexts. Complete model samples in these regimes will be called necessity worlds and sufficiency worlds, respectively. The intuition is that the suspect set S names every variable that could plausibly have caused the outcome; the witness set W names context variables to be selectively held fixed, isolating the causal channels under investigation. Intervening on suspects tests what would have happened under an alternative cause in the necessity worlds and under the factual values in the sufficiency worlds; fixing witnesses blocks confounding paths that would otherwise absorb the effect. Responsibility attribution increases when the outcome is far from the factual value in the necessity world and decreases when it is far from the factual value in the sufficiency world. For both Alice (female, bad credit, loan denied) and Bob (male, bad credit, loan denied) we set S = {gender , credit} and W = {check -failed }. The witness check -failed records whether the applicant was checked and had bad credit; holding it at its factual value isolates the causal path from gender or credit to loan independently of the credit-check bottleneck. Without this witness, intervening on credit for Alice would leave 80% of noise realizations unaffected (those in which she is never checked), making credit’s causal role invisible. The witness makes the bottleneck explicit and manipulable. In the general framework we search for causes by intervening on subsets of suspects and holding fixed subsets of witnesses. To make this search tractable, we need a way to prioritize which subsets to consider. Definition 14 (Variable Selection Distribution). Let X be a finite set of random variables. A variable selection distribution Γ is a probability distribution on 2X . We write Y ∼ Γ to mean Y is a random subset of X drawn from Γ, with pΓ (y) denoting the probability assigned to y ⊆ X. The variable selection distribution Γ encodes prior beliefs about which subsets of suspects are worth examining. A uniform distribution treats all suspect subsets as equally plausible; a cardinalityconstrained choice focuses the search on interactions of a particular order, analogous to choosing which interaction terms to include in a regression. More complex distributions could encode domain knowledge about which variables are more likely to interact, or could be learned from data. In particular, we will be using variable selection distributions for the powerset of causal suspects S and for the powerset of witnesses W. One simple pattern of suspect and witness selection can be derived by setting size limits on the number of activated suspects or witnesses, and sampling uniformly otherwise. 19

Example 15 (Cardinality-Constrained Uniform Selection). Let X be a candidate set of random variables. Sample a target size k ∼ Unif{J, . . . , K} with 1 ≤ J ≤ K ≤ |X|, then sample Y uniformly among subsets of that size, i.e. from the conditional probability mass function pΓ (Y | k) ∝ I[|Y| = k]. Marginalising k out gives the unconditional pmf actually used to define Γ(2X ),  −1 |X| 1 , J ≤ |Y| ≤ K, pΓ (Y) = K − J + 1 |Y| which is not proportional to I[J ≤ |Y| ≤ K]: sizes are weighted uniformly, but within a size, larger coalitions (of which there are more) are individually rarer. The parameters J and K determine the cardinality range of the search; specific choices connect PCI to existing methods and enable efficient Monte Carlo approximation.15 In PCI the variable selection distribution Γ generalises Definition 14 (stated there for a single powerset 2X ) to a joint object: it is a probability mass function on 2S × 2W , governing the joint choice of an active suspect set C ⊆ S and an active witness set T ⊆ W. The recommended construction samples suspects and witnesses separately and then enforces the constraint that no variable plays both roles in the same draw: pick a marginal Γs on 2S and a marginal Γw on 2W , draw C ∼ Γs and T ∼ Γw independently, and reject any draw with T ∩ C ̸= ∅, resampling until the constraint holds. Equivalently, pΓ (C, T) ∝ pΓs (C) pΓw (T) I[T ∩ C = ∅]. Throughout, Γs and Γw are abbreviations for the sampling marginals of this construction; the formal primitive in Definition 18 is the joint Γ. For the OBCB analysis, with |S| = 2, we use a Γ built from Γs uniform over the three non-empty subsets of S ({gender }, {credit}, {gender , credit}, each with probability 1/3) and Γw uniform over {∅, {check -failed }}, each with probability 1/2. Since no element appears in both S and W, the rejection step is vacuous and Γ is exactly the product of marginals pΓs · pΓw . In larger suspect sets the choice of cardinality range becomes substantive: sampling uniformly from the full powerset yields an expected intervention size of |S|/2, which spreads attribution across large coalitions and may make individual feature contributions harder to isolate; we return to this issue in Appendix F, where the cardinality cap is treated as a tunable hyperparameter and a dynamic-set-sizes ablation measures the empirical cost of bounding it. The choice of Γ is a design decision that shapes the search process and the resulting attributions. As a default, a uniform Γ over the full powerset is the least-informative starting point, assigning equal weight to all subset sizes, analogous to including all interaction orders in a regression. There is no universally principled criterion for restricting the cardinality range; we therefore recommend treating J and K as explicit design choices. Two practical considerations bear on this choice, however: with K = 1, attribution scores are based on singleton interventions and straightforward to 15 When J = 1 and K = |X|, this distribution coincides with the Shapley weighting kernel, which samples coalition size uniformly and then selects a coalition uniformly at that size [Shapley, 1953]. The parameters J and K allow the practitioner to restrict the search to cause sets of a specific cardinality range: setting J = K = 1 confines attribution to individual variables, while J = 2, K = 3 focuses on small multivariable interactions. Moreover, whereas exact Shapley computation requires summing over all 2|X| coalitions, PCI treats Γ as a generative model: approximation proceeds by sampling subsets from Γ and outcomes from PU , making Monte Carlo estimation a native feature of the framework. We note that the weighting alone does not distinguish PCI from SHAP at J = 1, K = |X|: the subset weights are identical. The distinction lies in the integrand, and it matters for what is being evaluated and what results follow. SHAP averages marginal contributions using the observational conditional E[f (XS = xS , XS̄ )], marginalising over the empirical distribution of non-suspect features; this means a variable that is merely correlated with a cause, but not itself causally active, can receive positive attribution. Janzing et al. [2020] frame exactly this as a causal problem, arguing that dropping a feature should be interventional rather than observational, since the conditional version lets a feature inherit relevance from its correlates. PCI instead evaluates counterfactual outcomes P (Y ∈ A | u, do(C = c′ , T = t⋆ )) computed via the structural model, so attribution flows only along genuine causal paths. The witness mechanism adds a further distinction: by holding intermediate variables fixed, PCI can resolve overdetermination and undercutting scenarios where SHAP assigns equal or incorrect attribution. A detailed comparison of PCI, SHAP, and Causal SHAP on concrete examples is given in Section 5.

20

communicate to stakeholders; higher K averages over joint interventions on Xk with other suspects simultaneously, which is harder to explain and, in large or structurally complex models, may amplify estimation noise rather than capturing genuine higher-order causal structure. For applications where attribution has serious consequences, we recommend a cardinality sensitivity analysis: if rankings are stable as K increases from 1 to |S|, the simpler choice is supported; if they diverge, higher-order interactions are materially relevant and the full powerset should be used. The advantage of PCI is that this commitment is made transparently rather than absorbed into an implicit default.16 Causal attribution hinges on questions such as “if X had, contrary to fact, been fixed to x′ ̸= x instead of x, what would the outcome have been?” For non-binary causes, this is ambiguous. To resolve this in a way that does not require committing to a single, contrastive causal event [Kawakami et al., 2024], we rely on a distribution over alternative values. Definition 16 (Alternative Value Distribution). Let X be a set of random variables with domain dom (X) and let X = x ∈ dom (X) be a factual event. An alternative value distribution ∆(x) is a probability measure on dom (X) such that x ∈ / supp(∆(x)). Informally, ∆(x) specifies what counts as a genuinely different value for a suspect variable. The support condition ensures no mass falls on the factual value x itself, so every sampled alternative is a real counterfactual departure rather than a noisy copy of what actually happened. Three properties guide the choice of ∆. Plausibility under M : the alternative should be a value the structural model could plausibly produce given the context, so the necessity test interrogates a counterfactual the model has anything to say about. Outcome-independence: the distribution over x′ should not be informed by the outcome whose causes we are explaining, on pain of circularity. Context-sensitivity: x′ should reflect the rest of the factual scenario, so the necessity test is individual-level rather than population-level. The construction we use throughout is the structuralmodel posterior of X conditioned on upstream factual values, optionally excised near the factual value (Example 17 below); this is the natural choice satisfying all three. Upstream-only conditioning operationalises the intuition shared with the descriptive-normality literature [Halpern and Hitchcock, 2015, Icard et al., 2017, Hitchcock and Knobe, 2009]: factual upstream values play the role of the default against which counterfactual alternatives are graded, the same role a stipulated baseline plays in causal analyses of harm [Beckers et al., 2022], where a default contract fixes what counts as a departure from the expected course of events. PCI does not aim to resolve the specific counterexamples motivating that literature; the link is at the level of why a non-uniform ∆ matters at all. Since ∆ is user-pluggable, other constructions are available when domain knowledge motivates them: a uniform distribution over dom (X) trades plausibility for breadth; the empirical marginal p(x′ ) trades context-sensitivity for simplicity; a fully conditional posterior on every observable (including downstream evidence) trades outcome-independence for sharper conditioning. One natural alternative value distribution takes the one already embodied in the model and excises it around the factual setting: “alternative value” then means “a sufficiently different value, following the original distribution otherwise.” In the discrete case, the analogue is simply the probability mass function conditioned on the factual value not holding. Example 17 (ϵ-Excised Distribution). Assume X is Rd -valued with density p. Given a factual event X = x, define the ϵ-excised alternative value distribution ∆ϵ (x) as the probability measure on (Rd , B(Rd )) with density ( 0, x′ ∈ Bϵ (x), ′ p∆ϵ (x | x) ∝ p(x′ ), otherwise, where Bϵ (x) denotes the ϵ-ball centered at x. The support is therefore supp(∆ϵ (x)) = supp(p) \ Bϵ (x): the exclusion covers the entire ϵ-neighbourhood of x. This requires p to place positive mass SHAP faces an analogous decision without flagging it as one: by averaging over all 2|N | feature coalitions, plain SHAP and Causal SHAP commit to the maximum interaction order K = |N | as an unstated default, with no diagnostic offered for whether that level of joint conditioning is right for a given model. Restricting SHAP to K < |N | would break the efficiency axiom, so the choice is hardcoded into the framework rather than treated as a tunable. PCI makes the same decision an explicit choice. 16

21

outside Bϵ (x); if supp(p) ⊆ Bϵ (x) (a sharply concentrated posterior, or an overly generous ϵ), the normalising constant is zero and ∆ϵ (x) is undefined. The same degeneracy affects the discrete case: a variable whose posterior is a point mass admits no alternative-value distribution with the support condition of Definition 16 at all. A practical implementation should detect this case explicitly and either signal an error, shrink ϵ, or fall back to a non-degenerate default such as the unconditional marginal. With plausibility, outcome-independence, and context-sensitivity as design criteria, and ϵ-excision as a concrete construction satisfying them, we return to the OBCB example to see what ∆ looks like when the suspect variables are binary. In the OBCB model both gender and credit are binary, so ∆ is trivial. For Alice, the only alternative to gender = 0 (female) is gender = 1 (male), and the only alternative to credit = 0 (bad) is credit = 1 (good); for Bob, the only alternative to gender = 1 is gender = 0. Accordingly, ∆(gender = 0) is a point mass on gender = 1 and ∆(credit = 0) a point mass on credit = 1: no distributional choice is required. The binary case is exactly where ∆ is unambiguous; it is for continuous suspects such as income or loan amount that the ϵ-excised distribution becomes necessary, forcing an explicit commitment to what counts as a meaningfully different value. Why ϵ-excision? Any method that asks “what would happen if X had been different” must operationalise what different means. The observational marginal p(x′ ) (as in kernel SHAP [Lundberg and Lee, 2017]) places mass near the factual value x, conflating the necessity question (“what if x had genuinely differed?”) with evaluating essentially the same setting. The fully conditional posterior p(x′k | x−k ) conditions on all other observed features, potentially including descendants of Xk , which imposes structural constraints that may rule out otherwise plausible counterfactuals, and still concentrates mass near xk when features are correlated. The ϵ-excised distribution occupies the middle ground: it draws from the marginal informed by upstream variables only, excising the factual neighbourhood to guarantee genuine departure without downstream conditioning. The choice parallels the Region of Practical Equivalence (ROPE) in Bayesian hypothesis testing [Kruschke, 2018]: just as ROPE forces an explicit decision about what difference is large enough to matter, ϵ-excision forces an explicit decision about what counterfactual is sufficiently far from the factual to count as genuinely alternative. The practitioner makes this commitment regardless of method; the only question is whether it is made transparently or absorbed into a default. When X is standardised to N (0, 1) the choice acquires a direct probabilistic interpretation: the excised mass Φ(x⋆ +ϵ)−Φ(x⋆ −ϵ) is the fraction of the distribution ruled out as insufficiently different from x⋆ . At x⋆ = 0, ϵ = 0.2, 0.5, 0.8 excise approximately 16%, 38%, 58% of the distribution, corresponding to small, medium, and large effect thresholds in the sense of Cohen [1988]. Alternatively, ϵ can reflect measurement precision or a decision-relevant threshold; sensitivity analysis across ϵ values is advisable when the appropriate scale is unclear. For concrete examples of how SHAP’s implicit choice leads to problematic attributions, see Section 5. The PSCM and intervention apparatus give us a notion of counterfactual outcome for any fixed noise realisation u; Γ tells us which suspect/witness configurations to ask about; ∆ tells us which nonfactual values to substitute when evaluating necessity. What remains is to plug those distributions into the counterfactual mechanics and read out a number. The next two definitions do exactly that: first the joint necessity-sufficiency measure Pks,n , then its expectation against a user-chosen impact function ci, with the OBCB scores and the desiderata verification immediately after. The core idea behind PCI’s main definitions is to measure two complementary things for a variable of interest Xk : (a) how much Xk ’s factual value contributes to producing y ⋆ , the sufficiency question, and (b) how much replacing Xk ’s value with alternatives would shift the outcome away from y ⋆ , the necessity question. We capture both by constructing two counterfactual outcome distributions conditioned on the same noise realization u, then marginalising their product over PU . Because PCI is not constrained to particular variable types, we work in general measure-theoretic terms supporting combinations of continuous and discrete variables. Definition 18 (Joint Necessity and Sufficiency Measure). Let M = ⟨U, V, F, PU ⟩ be a probabilistic structural causal model and Y an outcome variable with domain dom (Y ). Let pΓ be the mass function of a variable selection distribution on 2S × 2W , and let ∆(s⋆ ) be an alternative value distribution on dom (S). Let (S, W) = (s⋆ , w⋆ ) be a factual event.

22

⋆ For a variable of interest Xk , let 2S k := {C ⊆ S : Xk ∈ C}, and for each C ⊆ S let ∆C (s ) ⋆ ′ ′ 17 denote the pushforward of ∆(s ) under the restriction map s 7→ s |C . For any measurable A ⊆ dom (Y ) and exogenous realization u, define three sub-probability measures on dom (Y ) (the first two) and dom (Y ) × dom (Y ) (the third).

(i) Sufficiency measure. Pks (· | u) intervenes on each active suspect set C to its factual values s⋆ |C , holds the active witnesses T fixed, and takes the Γ-weighted sum of P (Y ∈ A | u, do(·)) under factual cause restoration: X Pks (A | u) = P (Y ∈ A | u, do(C = s⋆ |C , T = w⋆ |T )) pΓ (C, T). (1) (C,T) Xk ∈C

(ii) Necessity measure. Pkn (· | u) instead integrates over alternative values c′ for C (with T still pinned at factual values), and takes the Γ-weighted average over alternative cause values: X Z Pkn (A | u) = P (Y ∈ A | u, do(C = c′ , T = w⋆ |T )) ∆C (s⋆ )(dc′ ) pΓ (C, T). (2) (C,T) Xk ∈C

(iii) Joint necessity-sufficiency measure. On product rectangles A × B ⊆ dom (Y ) × dom (Y ), set Z X s,n Pk (A × B) := P (Y ∈ A | u, do(C = s⋆ |C , T = w⋆ |T )) (C,T) Xk ∈C

Z ·

 P (Y ∈ B | u, do(C = c , T = w |T )) ∆C (s )(dc ) pΓ (C, T) PU (du). ′

⋆

⋆

′

(3) Both terms are evaluated at the same drawn (C, T): one suspect/witness configuration is selected per noise realisation, and both the sufficiency and necessity worlds are built from it. This rectangle-by-rectangle specification extends uniquely (by Carathéodory’s extension theorem) to a sub-probability measure on the product σ-algebra of dom (Y ) × dom (Y ), with total mass PrΓ [Xk ∈ C] ≤ 1: integrating out B or A collapses the bracketed term to 1, leaving exactly the single Γ-inclusion probability, not its square. Informally: Pks (· | u) is the distribution of Y in the sufficiency world: restore the factual value of a candidate cause set C containing Xk , hold the witness set T at its factual values, and observe where the outcome lands. Pkn (· | u) is the distribution of Y in the necessity world: replace C’s values with alternatives drawn from ∆, hold T fixed, and ask how the outcome shifts. Because only the joint alternative is guaranteed to depart from s⋆ , a drawn c′ can coincide with C’s own factual restriction s⋆ |C even though the full s′ it came from does not; such a draw intervenes on C without changing it, contributing a sufficiency-like term to the necessity integral rather than a genuine test of necessity. This can only dilute the necessity signal, never invalidate it: a ∆ constructed to depart from s⋆ coordinate-wise, not just jointly, avoids the degeneracy entirely. The sum over suspect-containing pairs {(C, T) : Xk ∈ C} weights each configuration by its Γ-mass: more focused interventions receive whatever weight the practitioner assigns them; configurations with Xk ∈ / C would contribute 0 to the attribution and are absent from the sum, so Pks and Pkn are sub-probability measures with total mass PrΓ [Xk ∈ C] ≤ 1 rather than renormalized expectations. A consequence worth flagging: because this total mass scales with how often Γ includes Xk at all, comparing raw (unnormalised) scores across suspects is Γ-invariant only when Γ assigns every compared suspect the same inclusion probability PrΓ [Xk ∈ C], as it does under the uniform and cardinality-constrained Γ’s used throughout this paper’s examples, since those treat all suspects symmetrically. A nonuniform, asymmetric Γ (e.g. one preferring some suspects over others, as when Γ is learned from data) can make a suspect’s score larger purely because Γ visits it more often, not because it is a 17

For an assignment x to a collection of variables X and any subset Y ⊆ X, the restriction x |Y denotes the sub-assignment of x to the variables in Y. The restricted marginal ∆C (s⋆ ) may place positive mass on s⋆ |C even though ∆(s⋆ ) excludes the joint factual s⋆ ; the genuine-departure guarantee is on the joint alternative, not on each restricted coordinate.

23

stronger cause; cross-suspect rankings under such a Γ should instead compare each suspect’s score after dividing by its own PrΓ [Xk ∈ C]. In the OBCB example, for Xk = gender under a noise realization in which Alice is credit-checked: the sufficiency world restores gender = female while holding check -failed fixed; the necessity world substitutes gender = male under the same noise. For a fixed (C, T) and u, the bracketed product inside Pks,n is legitimate because the sufficiency and necessity interventions operate in separate counterfactual regimes with no causal connection: do(C = c⋆ ) and do(C = c′ ) act on the same noise and the same held witnesses but in distinct hypothetical worlds, so Y s and Y n are conditionally independent given u and the shared (C, T): P (Y s ∈ A, Y n ∈ B | u, C, T) = P (Y s ∈ A | u, C, T) P (Y n ∈ B | u, C, T). This conditional independence is exploited configuration-by-configuration, before summing over (C, T), rather than after each side has already been marginalised over its own copy of Γ. A more general family. Nothing forces the configuration (C, T) underlying Y s to coincide with the one underlying Y n ; Definition 18 is one instance of a broader construction: replace the single Γ with a joint variable-selection distribution Γs,n on pairs ((Cs , Ts ), (Cn , Tn )) ∈ (2S × 2W )2 s,n (each marginal recovering Γ), and weight the product of world-outcomes by pΓ before integrating over u. Definition 18 is the diagonal case, Γs,n supported on {((C, T), (C, T))}: both worlds share one drawn configuration. This is the reading illustrated in Figure 4 and realised exactly by the per-configuration kernel Φ of Section 6. The independent-product case, Γs,n = Γ ⊗ Γ, instead marginalises each world’s configuration separately before taking the product; the two cases coincide whenever ci is additively separable in y s and y n , as in the Absolute Difference score (Example 21): linearity of expectation then lets each world’s marginal be computed on its own, independent of any coupling. They can differ when ci is not separable, as in the PNS binary score (Example 20), where the score depends on the covariance, under Γs,n , between sufficiency-favouring and necessityfavouring configurations. PCI adopts the diagonal case as its default: it needs only one Γ-draw per Monte Carlo sample, and every estimator in this paper (Algorithm 1 and its specialisations) implements it. A user who wants the two worlds explained independently can instantiate the independentproduct case instead. A second, orthogonal relaxation is available within a single world’s own Γ: nothing in Definition 18 requires pΓ (C, T) to factor as pΓs (C)pΓw (T), as we do from Section 6 onward for tractability of those results. A user who wants witnesses selected structurally instead, e.g. pruned to the graphtheoretic mediators lying on active paths from the sampled C to Y , can substitute a T | C-dependent Γ directly into Definition 18 and Definition 19 unchanged, since both are stated for a general joint mass function pΓ on 2S × 2W ; only the later results that specifically assume Γw -uniformity (Theorem 29 and Corollary 30) would need re-derivation for such a Γ. With the necessity-sufficiency measure fully defined, we are ready to characterize the causal impact of an event Xk . We do so by defining an arbitrary causal impact function ci, the impact kernel, whose expectation over the necessity-sufficiency measure determines the causal impact. Below we first give the formal definition, then several intuitive candidates for the impact kernel. Definition 19 (Causal Impact Function and Its Expectation). Let y ⋆ ∈ dom (Y ) denote the factual outcome value, and let (Y s , Y n ) be distributed according to the sub-probability law Pks,n (not a proper probability measure in general; see below). For any measurable function ci : dom (Y )3 → R, the (expected) causal impact of Xk , written PCIXk , is defined as ZZ E[ ci(Y s , Y n , y ⋆ )] := ci(y s , y n , y ⋆ ) Pks,n (dy s , dy n ). (4) The integral is taken against the sub-probability Pks,n directly, not against its renormalisation; the symbol E[·] is shorthand for this sub-probability integral throughout. We call PCIXk the PCI score of Xk ; it is the concrete instance of the placeholder R used in the desiderata (p. 13). Suspect configurations with Xk ∈ / C contribute zero mass to Pks and Pkn (and hence to Pks,n ), correctly capturing that those configurations make no claim on Xk ’s attribution. PCI in pseudocode. Definitions 18 and 19 are stated measure-theoretically because PCI must cover continuous, discrete, and mixed-type variables uniformly, and because Theorem 26 needs that generality. Operationally, under the diagonal default of the remark above, the score they define reduces to a short Monte Carlo loop:

24

Algorithm 1 Monte Carlo estimator for E[ci] (diagonal default) Require: PSCM M ; variable of interest Xk ; factual event (s⋆ , w⋆ , y ⋆ ); Γ on suspect/witness pairs; alternative-value distribution ∆; impact function ci; sample budget N Ensure: Monte Carlo estimate of E[ci(Y s , Y n , y ⋆ )] 1: for j = 1, . . . , N do 2: draw uj ∼ PU 3: draw (Cj , Tj ) ∼ Γ, conditioned on Xk being in the drawn suspect set ▷ one shared configuration for both worlds, as in the remark after Def. 18 4: draw c′j ∼ ∆Cj (s⋆ )
5: yjs ← M.run uj , do(Cj = s⋆ |Cj , Tj = w⋆ |Tj ) ▷ sufficiency world
6: yjn ← M.run uj , do(Cj = c′j , Tj = w⋆ |Tj ) ▷ necessity world, same uj and (Cj , Tj ) 7: cij ← ci(yjs , yjn , y ⋆ ) 8: end for P 1 9: return PrΓ [Xk ∈ C] · N ▷ rescales the conditional mean back to E[ci]’s j cij sub-probability normalisation (b) The impact kernel on the signed deviation plane

(a) Necessity and sufficiency on a shared draw ci ∈ [0.12, 0.19] despite four different directions

-0

0.6

exogenous noise u

0.4

Ys

T

C = c⋆

4

0.

0.2

0.0

0.0 2

0.

4

Yn

factual y ⋆ (both worlds)

0.2

0.

T

−0.2 −0.4

.2

-0

ci(Y s, Y n, y ⋆ )

−0.4 −0.6 -0

.4

Γ ⊗ Δ ⊗ PU [ ci ] = PCI score for Xk OBCB instance

−0.2

0

sufficiency deviation Y s − y ⋆

do(C = c ⋆ ), hold T does restoring it sustain Y?

0.4

.2

do(C = c0), hold T

-0

sufficiency world

does removing it change Y?

C = c0

2

necessity world

0.

shared u: Yn ⟂ Ys ∣ u

0.

exogenous-noise law

.4

witness T (held) outcome Y

u

alternative-value dist.

0

0.6

candidate cause C

0.

node shapes

variable-selection dist.

ci = |Y n−y ⋆ | − |Y s−y ⋆ |

one shared draw u ∼ PU

Γ Δ PU

−0.6

Xk = gender, T = {check-failed} held at factual, c ⋆ = female (restore), c0 = male (alternative)

all sampled draws one draw per quadrant, magnitude-matched

−0.6

−0.4

−0.2

0.0

0.2

0.4

0.6

necessity deviation Y n − y ⋆

Figure 4: The PCI mechanism. (a) For a variable of interest Xk , a single exogenous draw u ∼ PU together with a candidate cause set C ∋ Xk and witness set T from Γ and an alternative value c′ from ∆ defines two counterfactual worlds on the same noise and the same (C, T): a necessity world (do(C = c′ ), witnesses held) giving Y n , and a sufficiency world (do(C = c⋆ ), witnesses held) giving Y s . Conditional on u and (C, T) the two worlds are independent (Definition 18); the impact kernel ci scores the pair, and its expectation over Γ ⊗ ∆ ⊗ PU (Definition 19) is PCI’s realised score. The strip grounds the schematic in the OBCB running example. (b) The impact kernel on the signed plane (Y n − y ⋆ , Y s − y ⋆ ), shown for the Absolute Difference score ci = |y n − y ⋆ | − |y s − y ⋆ |, one admissible choice of kernel (the PNS binary score and necessity-only variants are others), before either deviation is folded by | · |. Because ci depends only on the two absolute deviations, the field is symmetric under an independent sign flip of either axis: four qualitatively different outcomes, necessity and sufficiency each landing above or below the factual value, collapse onto the same score whenever the magnitudes match. The faint cloud is a sample of (Y n , Y s ) draws; the four gold points are actual draws, one per quadrant, with closely matched |Y n − y ⋆ |, |Y s − y ⋆ |, so their nearly equal ci values arise from the sampled data itself.

In words: draw noise u; draw one suspect/witness configuration containing Xk , shared by both worlds; run the model twice under the same u and the same configuration, once restoring the suspects to factual (sufficiency) and once setting them to a fresh alternative (necessity); score the pair with ci; average. Appendix F (Algorithm 2) specialises this to the necessity-only, per-suspect estimator used in the actual-causality benchmark. Informally, ci is a user-defined scoring rule that translates the joint sufficiency–necessity measure into a single scalar (Figure 4 summarises the construction: the two counterfactual worlds in panel (a), 25

the kernel that scores them in panel (b)). The choice is not arbitrary: the Absolute Difference example below is an instance of L1 distance between outcomes, the same metric underlying Average Treatment Effect, Conditional Average Treatment Effect, and SHAP. The binary indicator score recovers this as a special case when outcomes are binary: indicators are L1 on {0, 1}. Practitioners with reasons to prefer L2 or another distance measure may substitute it freely; the framework places no restriction on ci beyond measurability. For the OBCB analysis we instantiate ci as the PNS binary score defined in the following example, with y ⋆ = loan = 0. This is the choice that produces the values in Table 3. Example 20 (PNS for Binary Outcomes). Assume the outcome Y is binary with dom (Y ) = {0, 1}, and let y ⋆ = 1 denote the factual outcome. Let Y s and Y n denote the sufficiency and necessity outcome variables. Define the causal impact score ci(y s , y n , y ⋆ ) = I{y n ̸= y ⋆ } I{y s = y ⋆ }. Then the expected causal impact reduces to E[ci(Y s , Y n , 1)] = P(Y n = 0, Y s = 1), which conceptually coincides with Pearl’s probability of necessity and sufficiency (PNS). The alignment is exact when S = {Xk }, W = ∅, and dom (Xk ) = {0, 1} where, factually, x⋆k = 1. We now illustrate the full computation for Alice’s gender attribution using this ci. With S = {gender , credit}, W = {check -failed }, Γs and Γw uniform, ∆ a point mass on the alternative binary value, and y ⋆ = loan = 0, the exogenous noise Ucheck falls into three regions. (Definition 12 makes the interventional law a point mass given the full noise vector u; below we coarsen u to these three Ucheck regions and marginalise the remaining noise, in particular Uloan-if-checked , inside each region; by iterated expectation this equals the full integral over PU , and lets a value like “P (loan = 1) = 0.05” appear below despite Definition 12’s pointwise law being deterministic.) The three regions are: • u1 (prob. 0.2): Alice is checked regardless of gender; check -failed = 1 factually. • u2 (prob. 0.7): Alice is not checked as female but would be as male; check -failed = 0 factually. • u3 (prob. 0.1): Alice is not checked regardless of gender. In all regions, restoring Alice’s factual values always yields a denial, so Pks ({0} | u) = 32 everywhere (four suspect-containing (C, T) combinations each with pΓ (C, T) = 31 · 12 = 61 , since S ∩ W = ∅ here, rejection is vacuous and Γ is just the product of marginals, each contributing probability 1). The necessity measure varies. In u1 , the witness holds check -failed = 1. The four (C, T) contributions, each weighted 61 , are: ◦ C = {gender }, T = ∅: male, check -failed = 1 propagates structurally ⇒ P (loan = 1) = 0.05. ◦ C = {gender }, T = {check -failed }: male, witness holds failure ⇒ P (loan = 1) = 0.05. ◦ C = {gender , credit}, T = ∅: male and good credit, check passes ⇒ P (loan = 1) = 1.0. ◦ C = {gender , credit}, T = {check -failed }: male and good credit, but witness holds failure ⇒ P (loan = 1) = 0.05. Pkn ({1} | u1 ) = 16 (0.05 + 0.05 + 1.0 + 0.05) ≈ 0.192. In u2 , the witness holds check -failed = 0. The four contributions: ◦ C = {gender }, T = ∅: male would be checked; check -failed = 1 propagates structurally ⇒ P (loan = 1) = 0.05. ◦ C = {gender }, T = {check -failed }: male, witness holds check -failed = 0, check passes ⇒ P (loan = 1) = 1.0. ◦ C = {gender , credit}, T = ∅: male and good credit, check passes ⇒ P (loan = 1) = 1.0.

26

◦ C = {gender , credit}, T = {check -failed }: male and good credit, witness holds 0 ⇒ P (loan = 1) = 1.0. Pkn ({1} | u2 ) = 16 (0.05 + 1.0 + 1.0 + 1.0) ≈ 0.508. In u3 , male Alice is also not checked (check = 0 regardless of gender), so all necessity worlds yield denial: Pkn ({1} | u3 ) = 0. Combining, with ci(y s , y n , y ⋆ ) = I{y n ̸= y ⋆ } I{y s = y ⋆ } and y ⋆ = loan = 0: PCIgender (Alice) = E[ci(Y s , Y n , y ⋆ )] = P(Y n = 1, Y s = 0) X = p(u) Pks ({0} | u) Pkn ({1} | u) u

= 0.2 × 32 × 0.192 + 0.7 × 23 × 0.508 + 0.1 × 0 ≈ 0.026 + 0.237 = 0.263. Table 3 gives the full results for Alice and Bob under these parameter choices: Pearl’s PN/PS/PNS, PCI without witnesses (W = ∅), and PCI with the check -failed witness active, with the latter further decomposed into its necessity and sufficiency marginals. Pearl PS

PCI

Person, Variable

PN

PNS

Alice (gender ) Alice (credit) Bob (gender ) Bob (credit)

0.045 1.000 0.045 0.180 1.000 0.180 0.000 — 0.000 0.900 0.955 0.860

PCI (W = {check -failed })

(W = ∅) Necessity Sufficiency 0.210 0.240 0.038 0.228

0.394 0.298 0.030 0.188

0.667 0.667 0.637 0.637

Total 0.263 0.199 0.019 0.119

Table 3: Per-individual responsibility scores for gender and credit on loan = 0 in the stochastic OBCB model. Pearl’s PN/PS/PNS, PCI without witnesses (W = ∅), and PCI with the check -failed witness shown side by side; the rightmost three columns decompose PCI(W = {check -failed }) into its necessity and sufficiency marginals (their joint expectation is the bold total). Here the total happens to equal the product of the two marginals because the sufficiency measure Pks (· | u) is constant in u for both individuals; in general the joint Pks,n does not factor into the product of its marginals. Bob’s PS for gender is undefined because the conditioning event (female, bad, loan = 1) has probability zero in the OBCB model; the PCI marginals are well-defined throughout, since they integrate over PU rather than conditioning on the factual outcome.

For Alice, PNS and PCI without witnesses both fail D-A-rank (p. 13): they rank credit above gender (0.180 vs. 0.045; 0.240 vs. 0.210). PCI with witnesses reverses this (0.263 vs. 0.199), satisfying D-A-rank as well as D-A1 and D-A2 (both values positive). Holding check -failed at its factual value blocks the credit-check bottleneck in noise realizations where Alice was checked, isolating gender’s structural role. The check -failed witness is the decisive ingredient. For Bob, D-B2 and D-B-rank hold under all three methods: credit is ranked above gender throughout. D-B1 requires strictly positive attribution for gender : PNS returns exactly 0.000 and therefore fails, because P (loan = 1 | gender = female, credit = bad) = 0 makes the counterfactual necessity calculation zero, missing gender’s indirect role in opening the credit evaluation. PCI with witnesses returns 0.019, correctly capturing this indirect contribution. The cross-individual desideratum D-comp holds under both PCI (0.263 > 0.019) and PNS (0.045 > 0.000). A full verification of all seven desiderata is given at the end of this section. The PNS and PCI (no witnesses) columns differ even though neither uses witnesses, because PCI still Γ-averages over candidate suspect sets. With |S| = 2 PCI averages over {gender }, {credit}, and {gender , credit} (each weighted 31 ), whereas PNS evaluates a single counterfactual on one variable at a time. Property (i) below establishes that the two agree exactly when |S| = 1 (single suspect, no witnesses, binary outcome); the OBCB setup here instead uses |S| = 2 deliberately, to demonstrate joint-subset attribution.

27

3.1

Continuous Outcomes and the General Causal Impact Function

The causal impact function ci is a user-defined component of PCI, and different choices encode different causal questions. In the benchmarking experiments of Appendix F, we instantiate ci using only the necessity component, since Halpern’s actual causality has no sufficiency counterpart: necessity-only attribution allows a direct parallel comparison. The full framework incorporating both Y s and Y n is instantiated in the PNS binary example above and in the Absolute Difference example below; the OBCB analysis of this section (Tables 3–4) provides a concrete validation, since the PNS binary ci jointly conditions on Y s = y ⋆ and Y n ̸= y ⋆ and it is this combination that produces the correct D-A-rank ordering. Further experiments using the full ci on continuous outcomes are presented in the signal-with-mediation example (Section 5.2), the synthetic evaluation (Appendix D), and the SIR benchmark (Appendix G). When the outcome variable Y is continuous rather than binary, indicators are replaced by a distancebased score that measures how far the necessity and sufficiency worlds land from the factual value y ⋆ . The natural choice, paralleling L1 -based scores such as ATE and SHAP, is the absolute difference. Example 21 (Absolute Difference Impact Score). We can develop an analogous measure for continuous outcomes where we increase attribution with distance from the factual value y ⋆ in the necessity world and decrease impact with distance to the factual value in the sufficiency world. ci(y s , y n , y ⋆ ) = |y n − y ⋆ | − |y s − y ⋆ |. Two one-sided instances of this score recur in the experiments: a necessity-only ciN and a sufficiency-only ciS (Appendix D), whose sum returns the absolute-difference ci above. Each is a choice of ci in the sense of Definition 19. With the full machinery in place (structural model, variable selection, alternative value distribution, joint necessity-sufficiency measure, and causal impact function), PCI delivers the following properties. (i) Generalisation of PN/PS/PNS. When S = {Xk }, W = ∅, and dom (Xk ) = {0, 1}, the PNS binary ci recovers Pearl’s probability of necessity and sufficiency exactly; PN and PS are recovered by the corresponding one-sided ci choices. (ii) Connection to actual causality. For suitable Γ and ∆, PCI recovers Halpern’s actual causality judgements (Section 6). (iii) Necessity–sufficiency decomposition. Pks and Pkn are defined and interpretable independently; practitioners may choose a ci that uses either alone or both, depending on whether the causal question concerns necessity, sufficiency, or both. (iv) Witness-mediated symmetry breaking. Holding intermediate variables fixed via W disambiguates overdetermination and undercutting scenarios where necessity-only methods assign equal or zero attribution, as demonstrated above for Alice and Bob, and further developed in Section 5 (SHAP and Causal SHAP comparison), Appendix D (synthetic overdetermination and undercutting archetypes), and Appendix F (witness ablation on the scaled throwing problem). (v) Composability. Γ and ∆ are probability distributions and ci is a measurable function, so all three compose directly with the probabilistic-programming machinery discussed in Section 1; Section 4’s benchmarks estimate them by Monte Carlo throughout, without modification to the core formalism. 3.2

Back to the Running Example: Verifying the Desiderata

Table 4 verifies the seven desiderata introduced in Section 2 (p. 13) against the values in Table 3. PCI with witnesses satisfies all seven; PCI without witnesses fails D-A-rank; PNS fails D-A-rank and D-B1. (The table uses the shorthand |R(V | person)| for |R(V ⇝ loan | person)|.) PNS fails D-A-rank and D-B1. The D-A-rank failure reflects that without a check -failed witness, necessity-based attribution cannot distinguish Alice’s gender (which blocked the evaluation entirely) from her credit (which would only have mattered had she been evaluated). The D-B1 failure reflects 28

Desideratum D-A1: |R(gender | Alice)| > 0 D-A2: |R(credit | Alice)| > 0 D-A-rank: |R(gender | Alice)| > |R(credit | Alice)| D-B1: |R(gender | Bob)| > 0 D-B2: |R(credit | Bob)| > 0 D-B-rank: |R(credit | Bob)| > |R(gender | Bob)| D-comp: |R(gender | Alice)| > |R(gender | Bob)|

PNS

PCI (no wit.)

PCI (with wit.)

✓ 0.045 ✓ 0.180 × 0.045<0.180 × 0.000 ✓ 0.860 ✓ 0.860>0.000 ✓ 0.045>0.000

✓ 0.210 ✓ 0.240 × 0.210<0.240 ✓ 0.038 ✓ 0.228 ✓ 0.228>0.038 ✓ 0.210>0.038

✓ 0.263 ✓ 0.199 ✓ 0.263>0.199 ✓ 0.019 ✓ 0.119 ✓ 0.119>0.019 ✓ 0.263>0.019

Table 4: Verification of the seven desiderata (p. 13) against the values in Table 3. PCI with witnesses satisfies all seven; PCI without witnesses fails D-A-rank; PNS fails D-A-rank and D-B1.

that PNS assigns Bob’s gender exactly zero: because P (loan = 1 | female, bad) = 0, the counterfactual necessity calculation returns zero, missing gender’s indirect role in opening the credit evaluation. The check -failed witness resolves both. To close this section, we compare PCI’s decomposition with the one already present in Pearl’s framework. Pearl’s framework defines three related but distinct binary scores: the probability of necessity PN = P (Yx′ = y ′ | X = x⋆ , Y = y ⋆ ), the probability of sufficiency PS = P (Yx⋆ = y ⋆ | X = x′ , Y = y ′ ), and their joint PNS = P (Yx⋆ = y ⋆ , Yx′ = y ′ ). The first two are conditional probabilities; PNS is unconditional, and, when the cause variable X is exogenous (as for the root variables gender and credit in OBCB, so that P (Yx⋆ = y ⋆ ) = P (X = x⋆ , Y = y ⋆ )), the three satisfy PNS = PN · P (Yx⋆ = y ⋆ ) = PS · P (Yx′ = y ′ ) rather than PNS = PN · PS (which would additionally require Yx⋆ ⊥ Yx′ , an assumption typically violated since the two potential outcomes share exogenous noise). Without exogeneity, P (Yx⋆ = y ⋆ ) and P (X = x⋆ , Y = y ⋆ ) can differ and the displayed identity need not hold; the fully general relation between PNS, PN, and PS is Pearl’s weighted-sum decomposition (Pearl, 2009, Lemma 9.2.6), PNS = P (x⋆ , y ⋆ ) PN + P (x′ , y ̸= y ⋆ ) PS. PCI admits a related split: with ci = I{y n ̸= y ⋆ } I{y s = y ⋆ }, Z E[ci(Y s , Y n , y ⋆ )] = Pks ({y ⋆ } | u) Pkn ({1−y ⋆ } | u) dPU , giving a sufficiency marginal and a necessity marginal that record how often, on average, restoring the factual values of a suspect set containing Xk reproduces the factual outcome, and how often substituting alternatives overturns it. The two marginals are independent given u. The components are not identical to Pearl’s: PN and PS condition on the factual outcome and consider a single counterfactual flip; PCI’s marginals integrate over PU , average over suspect sets weighted by Γ, and hold the witness configurations fixed when active. Table 3 (presented earlier) places both decompositions side by side for gender and credit. For Alice’s gender, PN = 0.045 is the bare probability that a male with bad credit would have been approved; PCI’s necessity marginal is 0.394, nearly an order of magnitude higher, because the check -failed witness keeps the credit-check bottleneck active when the male counterfactual would otherwise have been checked and might still have failed, structural information that the unconditional PN cannot register. For Bob’s gender, PN is exactly 0 (a female with bad credit cannot be approved in this model) and PS is undefined; PCI’s marginals remain well-defined at 0.030 and 0.637, recovering the indirect role of gender in opening the evaluation. The next section turns from comparing PCI with Pearl’s family of counterfactual scores to comparing it with the SHAP family, methods grounded in cooperative game theory rather than in structural counterfactual reasoning. Section 5 re-runs the OBCB analysis under plain and Causal SHAP, then introduces a continuous mediation example where the two SHAP variants diverge from each other and from PCI, with explicit desiderata recorded throughout.

4

Empirical and Comparative Evaluation: Overview

With PCI now defined, we preview how it performs against the dominant feature-attribution baselines, actual causality and Pearl’s probability of causation, a causal-effect attribution method, and problem sizes ranging from textbook examples to a deployed system. Each subsection states one 29

comparative claim and points to the full treatment: the formal comparisons in Sections 5–7, and the complete protocols in the appendices. 4.1

PCI matches actual-causality verdicts on canonical archetypes

On the discrete structural models where actual-causality verdicts are available, PCI should reproduce its verdicts; on the canonical overdetermination and undercutting patterns it should separate a genuine cause from a preempted one. We test this on a synthetic structural model that carries three archetypes at once, linear necessary-and-sufficient, overdetermined, and preempted (gated), plus an irrelevance control, all with an analytic ground truth (Appendix D). Across two contrasting factual cases, all ten archetype desiderata hold: PCI scores the active cause above the preempted one, keeps the irrelevant control at the noise floor, and, unlike the binary actual-cause verdict, does so with graded magnitudes that extend to continuous variables. The pass threshold is a Monte Carlo noise floor: clearing it means the gap is distinguishable from sampling variance at the chosen budget; the gap need not be large in absolute terms (Appendix D). The same agreement holds on Pearl’s desert-traveller, where PCI reproduces his within-scenario ranking (Section 7, Appendix C).

Figure 5: PCI recovers the actual-causality verdicts on a synthetic model with three archetypes and an irrelevance control. Each row is one archetype desideratum (linear necessity/sufficiency, overdetermination, preemption, irrelevance control); the dot is the bootstrap point estimate of the relevant ∆ score, the bar its 95% CI, and the green band the pass region given the data-derived threshold ϵ ≈ 0.151. All ten dots fall inside their bands. Full model, estimator, and per-row analysis in Appendix D.

4.2

SHAP and Causal SHAP

PCI separates direct and indirect causal contributions; SHAP-based attribution collapses them into one number. Both plain and Causal SHAP decompose a prediction’s departure from a population mean. Because that mean is not the realized outcome, this choice produces two failures at once. First, they assign attribution backward, against the arrows of the causal graph; Causal SHAP’s interventional correction fixes only part of this. Second, they tie together the direct and indirect causes of an outcome that a context-sensitive method should keep separate. PCI’s realized-outcome reference and witness mechanism fix both problems, separating the direct cause from the indirect one at every instance, as Table 5 summarizes on the signal-with-mediation example (X → M → Y ). Section 5 states these failures as formal desiderata and works through both in full on two worked examples (OBCB and the signal-with-mediation chain), with the formal SHAP and Causal SHAP definitions in Appendix B.

30

Desideratum

Plain SHAP

Causal SHAP

PCI

✓ ✓ ✓ × × × ×

✓ ✓ ✓ ✓ × × ×

✓ ✓ ✓ ✓ ✓ ✓ ✓

D-XY: X genuinely causes Y D-MY: M genuinely causes Y D-XM: X genuinely causes M D-YX: no backward attribution from Y to X D-YM: no backward attribution from Y to M D-MX: no backward attribution from M to X D-MXY: the direct cause M outranks the indirect cause X

Table 5: Desiderata satisfied (✓) or violated (×) by plain SHAP, Causal SHAP, and PCI on the signal-withmediation example. Causal SHAP’s interventional correction repairs only D-YX. Full numeric values and witness-set variants in Table 9.

4.3

The Differential Causal Effect

The next comparison targets a causal-effect attribution method: the Differential Causal Effect (DCE) attributes an outcome change to features via local derivatives of the structural map. On a model with a non-monotone internal response, DCE and PCI can disagree on sign and magnitude where the local gradient is unrepresentative of the counterfactual contrast PCI integrates over: tracking the realized-outcome contrast keeps PCI’s attribution aligned with each feature’s structural role, without depending on a single local derivative. PCI ranks age above time everywhere; DCE's ranking flips and depends on units

8

(a) PCI: age minus time score

8

(b) DCE: age minus time gradient (time in hours)

8

(c) DCE: age minus time gradient (time in minutes)

30

4

0

3

−10

2

−20

1

5

5 4

0

3 −5

2

10

clipped: gradient spikes to ±103 here (sigmoid inflection)

6 gradient difference

10

5

7

10

clipped: gradient spikes to ±103 here (sigmoid inflection)

6

5

5 4

0

3 −5

gradient difference

7 20

6

score difference

Time of application (hours)

7

2 −10

1

−10

1

−30

0

0 20

30

40

50

60

70

0 20

30

Age of applicant

40

50

60

Age of applicant

70

20

30

40

50

60

70

Age of applicant

Figure 6: PCI stays consistent where DCE does not. (a) PCI ranks age above time of application everywhere on the credit-limit grid; the gap is somewhat denser around the age of rapid change (the sigmoid’s steep region) but stays positive throughout. (b), (c) The same contrast for DCE, on the hours and minutes time scales: DCE favours time of application over most of the grid (the opposite of PCI’s verdict), except in a narrow band where its gradient spikes at the sigmoid’s inflection point, and that pattern itself depends on which time unit is used. Full discussion in Appendix E.

Appendix E shows the full contrast over a credit-limit grid. 4.4

Scaling past exact actual causality

Actual-cause computation requires enumerating counterfactual subsets, which is exponential; PCI replaces enumeration with a Monte Carlo thin search. On a controlled family of problems (Appendix F), exact subset enumeration times out at about 17 variables, whereas the necessity-only PCI estimator continues to roughly 73–145 variables under an undemanding sample budget and a per-size compute cap of 60 minutes. It sustains a correct-attribution rate above 0.85 up to about 60 variables while visiting several orders of magnitude fewer cause–witness configurations. 4.5

Continuous, dynamical outcomes

Actual causality has a second limit besides scale: it offers no verdict when the outcome is continuous and the causes interact through a dynamical system. On a Bayesian SIR (susceptible–infected– recovered) model with two non-pharmaceutical policies and a threshold (peak-overshoot) outcome (Appendix G), but-for analysis cannot separate the two policies; PCI assigns lockdown roughly twice 31

Figure 7: PCI’s estimator continues to work well past the point where exact actual-cause enumeration gives out. Left, wall-clock vs. problem size: exact subset enumeration times out near 17 variables, while the PCI estimator continues to roughly 73–145. Right, correct-attribution rate: witness-enabled configurations stay above 0.85 well past the exact cut-off, degrading gradually with problem size. Full benchmark protocol in Appendix F.

the responsibility of masking, with the gap driven by the necessity term under witness pinning. The verdict holds across 20 factual worlds drawn from the prior, with lockdown ahead in 18 of them and a mean gap of +0.701 (standard error 0.111).

Figure 8: PCI separates interacting policies on a continuous dynamical outcome. Joint necessitysufficiency over the two policies for the peak-overshoot event; lockdown carries roughly twice the responsibility of masking where but-for analysis ties them. Full model and query in Appendix G.

4.6

A real-world deployed model

Finally, PCI runs on a deployed automated valuation model (AVM) with machine-learned components trained on millions of points, a regime where actual causality is intractable and SHAP is the practical default (Appendix H). PCI returns a structured, context-sensitive attribution across the model’s internal variables; SHAP, by contrast, concentrates almost all responsibility on a few downstream variables and places little weight on the rest. This deployed model has no independently known ground truth. PCI and SHAP disagree here in the same qualitative direction already validated by the synthetic benchmark’s ground truth, but on its own the AVM case demonstrates feasibility; it does not independently confirm correctness (Section 8). Across these settings PCI matches actual-causality verdicts on canonical archetypes and extends past them where they do not apply, at a cost that remains tractable; the full protocols, derivations, and additional figures are collected in Appendices A–H. Sections 5–7 develop these comparative claims in full before Section 8 draws out the implications.

32

Figure 9: PCI vs. SHAP on a deployed automated valuation model. Both panels show a selection of the model’s internal variables; real variable names are withheld under an NDA with the model’s operator, and the two panels rank their own top variables independently, so a given position in one panel does not correspond to the same variable in the other. Left: PCI’s context-sensitive attribution across the AVM’s internal variables. Right: SHAP concentrates responsibility on a few downstream variables. Full pipeline and anonymized structure in Appendix H.

5

Examples and Comparison to SHAP and Causal SHAP

Section 3 defined PCI and verified, on Alice and Bob, that the resulting attribution satisfies all seven desiderata of Section 2 (p. 13), where PN/PS/PNS fail at least two. The natural next question is how PCI compares to SHAP and Causal SHAP, the dominant practical alternatives for feature attribution that practitioners typically reach for. This section runs that comparison on two examples, recording where each method passes or fails an explicit desideratum. Formal definitions of SHAP and Causal SHAP are in Appendix B.1; we re-run OBCB (Section 5.1), where the two SHAP variants coincide because the feature set is exogenous, so the divergence between PCI and SHAP is the only contrast to draw. We then introduce a continuous mediation example (Section 5.2) where plain and Causal SHAP do diverge (one desideratum, D-YX, is fixed by the interventional correction; others, D-YM, D-MX, D-MXY, are not), and tabulate the desiderata in Section 5.3. Section 5.4 traces every failure to one of three structural gaps in the SHAP framework that PCI’s witness mechanism, suspect-set distribution Γs , and realised-outcome reference jointly close. Shapley values, grounded in cooperative game theory, decompose a model’s prediction into additive contributions from individual features and have become one of the most widely used attribution tools in the ML literature. Janzing et al. [2020] argued that the conditional expectation in plain SHAP is the conceptually wrong way to model feature removal: a dropped feature should be marginalised under a do-intervention, not under conditioning. Heskes et al. [2020] propose Causal SHAP, which implements this prescription by replacing the observational marginal used for features outside the active coalition with an interventional distribution: when a dropped feature is causally downstream of a coalition member, its distribution under the intervention differs from its marginal, and Causal SHAP corrects for this using Pearl’s do-calculus.18 18 A different counterfactual line is taken by Sharma et al. [2022], whose CF-Shapley values use a structural causal model to attribute the change in a metric from a single fixed reference xref to the observed x: ϕj ∝ P ref S⊆N \{j} [f (xS , xj ) − f (xS , xj )]. This is the closest neighbour to PCI in spirit (single contrastive scenario, do-style intervention) and differs in three ways. (i) CF-Shapley commits to one reference xref , while PCI integrates over an alternative-value distribution ∆(x) and need not pick a single contrast. (ii) CF-Shapley s n returns a one-axis contrast f (·, xref j ) − f (·, xj ), while PCI reports a joint (Y , Y ) measure and applies a userchosen ci, decomposing necessity and sufficiency separately. (iii) CF-Shapley has no witness mechanism, so it cannot break the overdetermination and undercutting symmetries that PCI’s witness set W resolves on the OBCB and signal walkthroughs of this section.

33

Despite this repair, both methods share deeper limitations. First, both plain and Causal SHAP can assign non-zero responsibility to variables that play no causal role with respect to the target: attribution can run against the direction of the causal graph, a failure the interventional correction does not address. Second, both methods explain a model’s prediction as a departure from that model’s population-average output, not from the factual outcome an individual actually experienced. When the goal is causal responsibility attribution rather than prediction explanation, this mismatch in target produces further divergences, which we make explicit below. The first limitation will surface in our signal example as violations of D-YX, D-YM, and D-MX; the second will surface in OBCB as the D-A-rank overdetermination effect, and in the signal example as Instance 2’s budget collapse when the prediction equals its baseline. With these general limitations in view, we trace them through the same two examples, comparing plain SHAP, Causal SHAP, and PCI against the desiderata of Section 3 together with the desiderata specific to each example. At the level of subset weighting alone, PCI (with J = 1, K = |S|) and SHAP are not distinguishable: Γ’s subset weights match the Shapley kernel. The distinction lies in the integrand. Plain SHAP (in the conditional reading of Eq. (19), which we use throughout except where noted) averages marginal contributions using the observational conditional E[f (X) | XS = xS ], drawing the non-coalition features from their distribution given the coalition; a feature merely correlated with a true cause can therefore receive positive attribution. PCI evaluates counterfactual outcomes P (Y ∈ A | u, do(C = c′ , T = t⋆ )) computed via the structural model, so attribution flows only along genuine causal paths. The witness mechanism adds a further distinction: by holding intermediate variables fixed, PCI can resolve overdetermination and undercutting scenarios where SHAP assigns equal or incorrect attribution. The remainder of this section makes both points concrete on two examples. 5.1

OBCB: SHAP and Causal SHAP

To apply the SHAP and Causal SHAP definitions of Appendix B.1 to OBCB we must specify both a feature set N and a function f on the joint feature space; the value functions and Shapley sums are derived from these. The natural choice for f is the conditional expectation of the outcome, f (xN ) = E[loan | XN = xN ]. But the OBCB PSCM has five variables (gender , credit, check , check -failed , loan if checked ), so the choice of N is non-trivial. Two options are natural: • Option A: two upstream roots. N = {gender , credit}. Both features are exogenous; the three internal variables (check , check -failed , loan if checked ) are integrated out inside f . This is the smallest sufficient feature set and matches the way the model is normally described: predict approval from gender and credit. • Option B: two roots plus the mediator. N ′ = {gender , credit, check -failed }. The mediator becomes an observable model input, the same status it has in the signal-with-mediation example (§5.2). This is the comparison PCI’s witness mechanism naturally invites: PCI accesses check -failed as a witness, so allowing SHAP to access it as a feature is the fair foil. We work through both. Option A is simpler and exposes the qualitative failures of plain SHAP. Option B then asks whether admitting the mediator rescues Causal SHAP. Option A: two upstream roots. Here f (g, c) = P (loan = 1 | g, c) takes values f (F, bad) = 0.000, f (F, good) = 0.180, f (M, bad) = 0.045, f (M, good) = 0.900, with the three internal variables integrated out. We apply SHAP to the rejection probability g(x) = 1 − f (x) for Alice and Bob from Example 6, attributing responsibility for the denial outcome.19 By the SHAP definition (and equivalently by Definition 36 once we note that no dropped feature is a descendant of any coalition member), the value function on the 2-feature game and its closed-form specialisation under independent uniform marginals are derived in Appendix A (§A.3). Plugging in the four values of f listed at the start of Option A yields Table 6; pushing those through the closed-form Shapley gives the magnitudes in Table 7, which compares against PNS and PCI. Because g = 1 − f , the characteristic functions satisfy vg (S) = 1 − vf (S) and ϕgi = −ϕfi ; we compute ϕ and flip signs. With |N | = 2 and uniform marginals P (gender ) = P (credit) = 21 , equation (18) reduces to ϕi = 21 [v({i}) − v(∅)] + 21 [v(N ) − v(N \{i})]. 19

f

34

S

v(S) for Alice

v(S) for Bob

0.281 0.090 0.023 0.000

0.281 0.473 0.023 0.045

∅ {gender } {credit} {gender , credit}

Table 6: Coalition values v(S) = E[f (X) | XS = x⋆S ] for the 2-feature game (N = {gender , credit}). v(∅) = E[f (X)] = 0.281 is the population baseline; v(N ) is the factual prediction f (x⋆ ). Plain SHAP and Causal SHAP coincide on this game (neither feature is downstream of the other), so a single column suffices per individual.

Person Feature PNS Alice Alice Bob Bob

gender credit gender credit

SHAP

ATE CATE

0.045 0.107 0.383 0.180 0.174 0.518 0.000 −0.107 0.383 0.860 0.343 0.518

0.045 0.180 0.045 0.855

ITE 0.045 0.180 0.000 0.895

PCI (no wit.) PCI (with wit.) 0.210 0.240 0.038 0.228

0.263 0.199 0.019 0.119

Table 7: Responsibility attributions for Alice and Bob. SHAP values are signed (ϕgi for P (loan = 0 | x)); desiderata compare magnitudes | · |. ATE is a population quantity (identical across the two persons by feature); CATE conditions on the other covariate (credit for the gender rows; the person’s gender for the credit rows); ITE abducts the individual’s exogenous noise from the full factual record (covariates and the observed denial) and takes the counterfactual contrast on that pinned noise. PNS and PCI values from Table 3; ATE/CATE/ITE computed by direct PSCM evaluation in obcb_computations.

ATE and CATE fail the same two individual-level desiderata that PNS fails, and for related reasons. ATE attributes responsibility at the population level only, so its values are identical across Alice and Bob, immediately violating D-comp (|R(gender | Alice)| = |R(gender | Bob)| = 0.383). CATE conditions on observable covariates but inherits PNS’s blind spot via the check -failed propagation discussed in Section 2: for Alice it returns 0.045 for gender and 0.180 for credit, the same ranking as PNS c and the same D-A-rank failure. CATE also fails D-comp, since CATE(gender | credit=bad) = 0.045 is the same number for Alice and Bob. The individual treatment effect (ITE) is the natural endpoint of this ladder: where ATE marginalises all exogenous noise and CATE conditions only on observed covariates, the ITE abducts the unit’s noise from its full factual record (covariates and the observed denial) and then takes the counterfactual contrast holding that abducted noise fixed, the abduction–action–prediction reading already used for PN in Section 2. This buys back exactly the information CATE discards. The ITE separates the two applicants on D-comp where CATE cannot: ITE(gender | Alice) = 0.045 but ITE(gender | Bob) = 0, because abduction places Bob in the checked-and-failed branch, where being male is not what blocked him: flipping him to female (still bad credit) leaves him denied with certainty. The ITE is also a genuine counterfactual rather than an intervention: because it conditions on the outcome, ITE(credit | Bob) = 0.895 rather than the interventional P (loan=1 | do(credit=good), gender =male) = 0.90, as conditioning on Bob’s denial shifts posterior mass toward the unchecked branch. But the ITE does not fix D-A-rank: for Alice it still returns 0.180 for credit against 0.045 for gender, the same inversion as PNS c and CATE. Abduction pins the noise but not the mechanism: the counterfactual still routes through a hypothetical credit check in the 20% of Alice’s posterior in which she was checked, so credit retains spurious responsibility. Recovering the correct ranking requires PCI’s witness mechanism, which pins check -failed at its factual value (dominantly the unchecked branch for Alice, where credit is causally disconnected from the loan) instead of integrating over its noise. In this sense PCI is the ITE plus the structural machinery needed to see the mediated path: it inherits the ITE’s individual-level, counterfactual character and adds the context-fixing the ITE alone lacks. SHAP fails two desiderata. The primary failure is D-A-rank: Alice’s credit outranks her gender (0.174 > 0.107). This is an overdetermination effect: credit=bad correlates with the check -failed mechanism that blocked Alice’s credit evaluation, so SHAP’s observational marginalization inflates

35

credit attribution above gender’s. PCI includes the factual check -failed value directly, isolating gender’s upstream causal role and recovering the correct ranking. PNS fails D-A-rank for the same reason; it also fails D-B1 by returning exactly zero for Bob’s gender (see Table 4). The second SHAP failure is D-comp: |ϕggender | = 0.107 for both Alice and Bob. But gender played a strictly larger causal role in Alice’s rejection than in Bob’s. For Alice, gender =female was sufficient on its own to produce rejection: it blocked the credit evaluation entirely, so her credit was never a factor. For Bob, gender =male was a facilitating condition: it triggered the credit check, but credit=bad was the actual driver of the denial. SHAP cannot distinguish these because it measures how far each feature value deviates from the population prediction mean: female and male are equidistant deviations in opposite directions, so they receive equal magnitude regardless of their individual causal weight. This is an instance of a deeper limitation: SHAP explains predicted outputs, not individual factual outcomes, which we examine further in Section 5.2. Causal SHAP coincides exactly with plain SHAP under Option A: both features are exogenous roots, so P (credit | do(gender = g)) = P (credit) and vice versa, no dropped feature is a descendant of any coalition member, and vcausal (S) = vplain (S) for every coalition. Option A therefore reduces to a single SHAP analysis, and the failures above belong to both methods. Option B: two roots plus the mediator. Throughout this subsection we abbreviate gender , credit, and check -failed as g, c, and cf in mathematical expressions and table cells; running prose retains the full names. Now we admit check -failed as a third model input and apply both methods to the 3feature game N ′ = {gender , credit, check -failed }. This requires defining f on {0, 1}3 rather than on {0, 1}2 . The natural observational extension is again the conditional expectation f˜(g, c, cf ) = E[loan | gender = g, credit = c, check -failed = cf ]. This is well defined for three of the four (c, cf ) combinations, but not the fourth: a failed check requires that a check happened and the credit was bad, so check -failed = 1 together with credit = good is impossible under the PSCM and has no observational data to condition on. We leave f˜ undefined on this cell. Both methods need a value function v(S): the expected value of f˜ when the features in S are held at their factual values x⋆S and the remaining features are averaged out. The methods differ in how that average is taken. Here plain SHAP switches to the marginal-independent reading flagged after Eq. (19) (rather than the conditional reading used elsewhere in this section), because it is this reading, not the conditional one, that produces the impossible-cell pathology below: it averages over each dropped feature using its own observational marginal P (Xi ), with the dropped features treated as independent of one another. Causal SHAP averages over the joint distribution the PSCM produces under the intervention do(XS = x⋆S ), so the dropped features keep whatever joint dependencies the PSCM imposes on them. Whether either average ever lands on the impossible cell (c=1, cf =1) (and so whether v(S) is finite) depends on both the method and on which features are held fixed at which factual values. Table 8 works out all eight coalition values for both individuals. Alice (g, c, cf )=(0, 0, 0)

Bob (g, c, cf )=(1, 0, 1)

S

vplain

vcausal

vplain

vcausal

∅ {g} {c} {cf } {g, c} {g, cf } {c, cf } N′

NaN NaN 0.007 0.270 0.000 0.090 0.000 0.000

0.281 0.090 0.023 0.270 0.000 0.090 0.000 0.000

NaN NaN 0.007 NaN 0.014 NaN 0.025 0.050

0.281 0.473 0.023 NaN 0.045 NaN 0.025 0.050

Table 8: Coalition values for the 3-feature game N ′ = {gender , credit, check -failed }. Bold NaN entries flag coalitions whose value function evaluates f˜ at the impossible cell (c=1, cf =1) with positive weight. Plain SHAP and Causal SHAP coincide whenever neither credit nor check -failed is dropped, since the only structural coupling in the model is between these two; they diverge whenever one is in S and the other is not.

Plain SHAP treats credit and check -failed as independent, so whenever both are dropped from the coalition the average runs over all four (c, cf ) combinations, with the impossible (c=1, cf =1) 36

combination receiving weight P (c=1) · P (cf =1) = 0.5 · 0.275 ≈ 0.140, the same nonzero weight as any other corner. For Alice, both credit and check -failed are dropped at S ∈ {∅, {gender }}, the first two NaN entries in Table 8. For Bob the same two coalitions fail, and two more break for an additional reason: at S = {check -failed } and S = {gender , check -failed } the value cf ⋆ = 1 is held fixed while credit is sampled from its marginal, so the c=1 branch enters with weight 0.5 and again hits the impossible cell. Plain SHAP gives undefined Shapley values for both individuals.20 Causal SHAP samples cf following its structural equation cf = check · (1 − c), with check ∼ Bern(pcheck [g]), given whatever (g, c) values appear in the integrand. When c = 1 the equation forces cf = 0 regardless of check , so the (c=1, cf =1) combination is never produced. Every Alice entry in the vcausal column of Table 8 is therefore finite. Plugging Alice’s column into the Shapley formula gives magnitudes |ϕgender | = 0.097, |ϕcredit | = 0.176, |ϕcheck -failed | = 0.007, so |ϕcredit | > |ϕgender | and D-A-rank fails: credit outranks gender, exactly the same pathology plain SHAP exhibited on the 2-feature game. Two coalitions break for Bob: S = {check -failed } and S = {gender , check -failed }. Both hold check -failed at Bob’s factual value cf ⋆ = 1 and average credit over its marginal. To see why this is fatal, apply Definition 36 to the first: h i X X vcausal ({cf }) = E f˜(X) do(cf = 1) = 14 f˜(g, c, 1). g∈{0,1} c∈{0,1}

The uniform 14 weights come from gender and credit sitting upstream of check -failed in the causal graph: intervening on check -failed overrides the structural equation that would normally determine it from credit and check, but does not alter the marginal distributions of the upstream features. Two of the four summands evaluate f˜ at (g, c=1, cf =1) (the impossible cell) with weight 41 each. So vcausal ({cf }) is undefined, and so is vcausal ({g, cf }) for the same reason. These two coalitions appear in the Shapley sum for every feature, so all three of Bob’s Causal SHAP values are NaN (Bob’s columns in Table 8). The same two coalitions arise for Alice; the difference is the value of cf ⋆ being held fixed. With Alice’s cf ⋆ = 0, the c=1 summand in the formula above evaluates f˜(g, 1, 0) = pcheck [g] · loan prob[g, 0], which is defined because the PSCM does allow (c=1, cf =0): when credit is good, cf is forced to 0 deterministically, so the conditional expectation has a value. With Bob’s cf ⋆ = 1, the c=1 summand evaluates f˜(g, 1, 1), the impossible cell, “good credit and a failed check”, which the PSCM rules out, since failing the credit check requires bad credit by the structural equation cf = check · (1 − c). When the PSCM runs forward, credit and check -failed are linked by cf = check · (1 − c), which keeps c=1 and cf =1 from co-occurring. When Causal SHAP intervenes via do(cf = cf ⋆ ), this link is overridden: check -failed is fixed externally and credit is sampled freely. The override always produces a (c=1, cf ⋆ ) combination with positive weight; whether f˜ has a value for that combination depends on which cf ⋆ value Causal SHAP is intervening on. Promoting the mediator to a feature therefore does not recover the desideratum: Causal SHAP still misses it for Alice and is left undefined for Bob. The OBCB analysis exposed two structural failure modes: SHAP’s overdetermination effect on the 2-feature game, and Causal SHAP’s breakdown once the mediator is admitted as a feature under Option B. The second of these depends on a structural feature of the OBCB PSCM: the equation cf = check · (1 − c) ties credit and check -failed together, so Option B’s natural feature set contains one combination of input values (“good credit and a failed check”) that the model is not defined on. To see whether the same families of failure appear without this complication, we now turn to the signal-with-mediation chain X → M → Y , where the mediator is naturally an observable input, f˜ is defined everywhere, and no impossible-cell issue arises. Causal SHAP’s failures there are not artifacts of an undefined f˜ but properties of the method itself. 20

The underlying issue is that plain SHAP does not see that credit and check -failed are linked by the structural equation cf = check · (1 − c), and so places weight on a combination the PSCM rules out.

37

5.2

Signal with Mediation

Example 22 (Signal with mediation). We work with the following generative model: X sends a signal, M mediates it with some noise, and Y is the noisy final outcome: X ∼ N (0.5, 0.25) (5) M = X + εM , εM ∼ N (0, 0.1) (6) Y = M + εY , εY ∼ N (0, 0.1) (7) The causal graph is X → M → Y , a simple mediation chain (Figure 10). All noise terms are independent of each other and of X. Since everything is jointly Gaussian, all conditional expectations are linear functions of the conditioning variables, and no approximations are required.

UX

UM

UY

X

M

Y

candidate cause witness / mediator

signal

prediction

mediator

outcome intermediate exogenous noise

no direct path (X reaches Y only through M)

Figure 10: The signal-with-mediation model. X (teal) reaches the outcome Y (purple double box) only through the mediator M (gold hexagon); the faded, crossed-out arc marks the absent direct path X → Y . Dashed circles are the independent Gaussian noises UX , UM , UY of Eqs. (5) to (7). Desideratum D-MXY asks an attribution to register that one missing edge: M acts on Y directly, whereas X acts only at one remove.

Let R(X ⇝ Y ) denote the causal responsibility of X for Y . Following the convention of Section 3, the desiderata are stated in terms of absolute magnitudes |R(·)|, allowing for directionality. The qualitative causal responsibility desiderata for this example are: D-XY |R(X ⇝ Y )| > 0 D-MY |R(M ⇝ Y )| > 0 D-XM

|R(X ⇝ M )| > 0

D-YX |R(Y ⇝ X)| = 0 D-YM |R(Y ⇝ M )| = 0 D-MX

|R(M ⇝ X)| = 0

A more subtle desideratum concerns telling apart the roles of the two genuine causes. X reaches Y only through the mediator M , whereas M acts on Y directly; a good attribution method should be able to distinguish these two roles rather than collapse them into the same number. One systematic way to register the distinction is to require that the two causes receive different, rankable scores, and we adopt the convention of assigning the larger score to the cause closer to the outcome: D-MXY |R(M ⇝ Y )| > |R(X ⇝ Y )| The direction of the inequality is a convention rather than a law of responsibility; what matters is that the method separates the direct from the indirect path at all. A method that assigns the larger score to the more distal cause would be equally principled; we adopt the direction stated here for consistency. The distributional facts we will use are: E[X] = E[M ] = E[Y ] = 0.5,
Var(X), Var(M ), Var(Y ) = (0.25, 0.35, 0.45),
Cov(X, M ), Cov(X, Y ), Cov(M, Y ) = (0.25, 0.25, 0.35). 38

(8) (9) (10)

For each target variable, the optimal predictor under squared loss is the conditional expectation, computable exactly in this Gaussian model: fY (X, M ) = E[Y | X, M ] = M ({X, M } ⇒ Y ) fM (X, Y ) = E[M | X, Y ] = 0.5X + 0.5Y ({X, Y } ⇒ M ) 5 fX (M, Y ) = E[X | M, Y ] = 0.5 + (M − 0.5) ({M, Y } ⇒ X) 7

(11) (12) (13)

The distributional facts and the three conditional expectations above are derived in Appendix B (§B.2–§B.3). 5.3

Computations and Desiderata Analysis

We analyze two instances. Instance 1 sets X ⋆ = M ⋆ = Y ⋆ = 1: every variable lies above its mean, the prediction is non-trivial at every target, and SHAP, Causal SHAP, and PCI all return non-zero values. Instance 2 sets X ⋆ = M ⋆ = Y ⋆ = 0.5: every variable sits at its mean, the prediction equals its baseline, and SHAP’s attribution budget f (x⋆ ) − E[f (X)] collapses to zero. We work through Instance 1 first, then return to Instance 2 to isolate what each method is really tracking. Computing the three methods. At Instance 1 (X ⋆ = M ⋆ = Y ⋆ = 1) all three methods admit closed-form evaluation in this Gaussian model. We defer the full per-target coalition-value and Shapley computations for plain and Causal SHAP, and the per-(C, T) PCI derivation, to Appendix B (§B.4–§B.6); the resulting attributions populate Table 9. One computed fact drives the D-YX discussion below and is worth stating here. Plain SHAP assigns ϕY = 0.139 > 0 for target X, even though Y does not cause X. This arises because v({Y }) = 0.778 > 0.5: observing Y =1 is statistically informative about X=1 through the chain X → M → Y . SHAP cannot distinguish “Y is informative about X” from “Y causes X” because the value function is grounded in observational conditionals, which are symmetric under reversal of causal direction. Desiderata analysis. Following the convention of Section 3, we use R(A ⇝ B) for the methodagnostic responsibility and ϕB A exclusively for SHAP/Causal SHAP values; prose statements about desiderata refer to magnitudes |R(A ⇝ B)|. Here A denotes the candidate cause and B the target outcome (the generic Y of Section 3); for the PCI columns B n , B s are its necessity/sufficiency worlds, B ⋆ its factual value, and c̄ = E[ |B n − B ⋆ | − |B s − B ⋆ | ] the expected absolute-difference impact of Example 21 (equivalently E[|B n − B ⋆ |] − E[|B s − B ⋆ |], as in the caption of Table 9). Table 9 maps the desiderata from Section 5.2 to the values computed above. Desideratum Condition D-XY D-MY D-XM D-YX D-YM D-MX D-MXY

Plain SHAP

Causal SHAP

|R(X ⇝ Y )| > 0 0.250 ✓ |R(M ⇝ Y )| > 0 0.250 ✓ |R(X ⇝ M )| > 0 0.306 ✓ |R(Y ⇝ X)| = 0 0.139 × |R(Y ⇝ M )| = 0 0.194 × |R(M ⇝ X)| = 0 0.219 × |R(M ⇝ Y )| > |R(X ⇝ Y )| 0.25=0.25 ×

0.250 ✓ 0.250 ✓ 0.375 ✓ 0.000 ✓ 0.125 × 0.357 × 0.25=0.25 ×

PCI (W=∅)

PCI (W=3rd)

0.249 ✓ 0.186 ✓† 0.283 ✓ 0.319 ✓ 0.253 ✓ 0.284 ✓ 0.000 ✓ 0.000 ✓ 0.000 ✓ 0.000 ✓ 0.000 ✓ 0.000 ✓ 0.283>0.249 ✓ 0.319>0.186 ✓‡

Table 9: Desiderata satisfied (✓) and violated (×) by plain SHAP, Causal SHAP, and PCI on the signal-withmediation example (X → M → Y ), instance X = M = Y = 1. PCI uses c̄ = E[|B n − B ⋆ |] − E[|B s − B ⋆ |] with Γs , Γw uniform over non-empty subsets and rejection on C ∩ T ̸= ∅. W=3rd sets the third variable (neither A nor B) as the witness when not in C. † 0.186 weights three suspect-containing (C, T) configurations at 1/4 each (the rejection-sampling filter keeps 2/3 of Γs × Γw draws, including a fourth valid pair ({M }, ∅) that does not contain X): one pins M as witness (contribution 0, necessity and sufficiency coincide) and two let M propagate freely (contributions 0.320 and 0.425). ‡ The two values use different witness sets (W={M } for D-XY, W={X} for D-MY); this column reports the amplified verdict under an asymmetric witness rule. The W=∅ column above is the corresponding single-game ranking and already passes D-MXY.

Positive results (D-XY, D-MY, D-XM). Both methods correctly assign positive attribution to every direct or upstream cause of the target. Causal prediction models are built from observational condi39

tionals, which do preserve correlation from cause to effect, so these desiderata pose no challenge to either method. Causal SHAP fixes D-YX, not D-YM. For target X, the interventional value vcausal ({Y }) = 0.5 equals the baseline because M is not downstream of Y : P (M | do(Y =1)) = P (M ), so fixing Y = 1 provides no interventional leverage over fX , and Causal SHAP correctly yields ϕX Y = 0. For target M , however, ϕM = 0.125 > 0 persists. The prediction model f (X, Y ) = 0.5X + 0.5Y M Y contains Y as an input because Y is observationally predictive of M ; setting Y = 1 raises the model output even under the interventional regime. Causal SHAP replaces the conditioning distribution but cannot remove a feature that the prediction model itself uses. D-MX: the interventional correction reallocates the spurious attribution. Plain SHAP assigns ϕX M = 0.219; Causal SHAP assigns 0.357. Fixing D-YX reduces vcausal ({Y }) from 0.778 to 0.5, driving ϕX Y to zero, but reallocates the freed attribution to M . Since the structural noise that actually drives X is unobserved, all attribution concentrates on the only visible predictor, M , even though M does not cause X. D-MXY fails for both. Since fY = M , the singleton values v({X}) = E[M | X=1] = 1 and v({M }) = 1 are identical, giving ϕYM = ϕYX = 0.25 for both methods. The Shapley formula cannot distinguish that X reaches Y only through M : when X = 1, the expected prediction is already 1 regardless of whether M is observed or not, so both features receive the same marginal contribution. PCI: structural intervention separates the paths; witnesses sharpen the gap. Table 9 reports PCI in two configurations: without witnesses (W = ∅) and with the third variable as witness. Without witnesses, PCI satisfies all six single-variable desiderata. D-YX, D-YM, and D-MX are zero exactly: intervening on a variable that does not structurally affect the target leaves both the necessity and sufficiency worlds with identical distributions, so ci = 0 identically. D-XY, D-MY, and D-XM are positive. D-MXY also passes at PCI(M → Y ) ≈ 0.283 > PCI(X → Y ) ≈ 0.249, but only by a margin of 0.034. The asymmetry comes from the sufficiency world: at C={X}, X’s path to Y accumulates εM +εY in |Y s −Y ⋆ |, while at C={M }, M ’s path accumulates only εY . The necessity expectations match across paths (Var(X) + Var(εM ) + Var(εY ) = Var(M ) + Var(εY ) = 0.45), so the gap is carried entirely by the sufficiency variance asymmetry Var(εM ). A small structural margin like this is fragile: under any perturbation of the noise variances or the contrast function the W = ∅ ordering could flip. Admitting the third variable as a witness amplifies the gap by roughly fourfold. PCI(X → Y | W={M }) ≈ 0.186 weights three suspect-containing (C, T) configurations at 1/4 each: in two cases M propagates freely (contributing 0.320 and 0.425) and in one case M is pinned as witness in both worlds, equalizing them and contributing 0. PCI(M → Y | W={X}) ≈ 0.319 weights three cases in which M takes an alternative value; since X does not appear in Y ’s structural equation, pinning X has no effect on Y n or Y s , and all three cases contribute the same 0.425. The gap widens from 0.034 at W = ∅ to 0.319 − 0.186 = 0.133 at W = {third}: the ordering is now robust. The comparison relies on different witness sets for the two cells, so it remains illustrative rather than a single-game ranking. Instance 2 (baseline). We now return to Instance 2: every variable sits at its mean, X ⋆ = M ⋆ = Y ⋆ = 0.5, and the model predicts the baseline at every target: fY (0.5, 0.5) = 0.5, fM (0.5, 0.5) = 0.5, fX (0.5, 0.5) = 0.5. At this instance, SHAP’s attribution budget f (x⋆ ) − E[f (X)] vanishes, while PCI’s machinery is unaffected. The pattern in Table 10 reflects the object each method is decomposing. SHAP attributes the quantity f (x⋆ ) − E[f (X)] across features. At the baseline this gap is zero on every target, so every cell collapses to zero, uniformly, regardless of how the realized outcome was produced. The non-causal triples (D-YX, D-YM, D-MX) are satisfied only by this collapse: SHAP is not isolating the absence of a causal path; it is reporting that there is nothing to attribute. The same collapse turns D-XY, D-MY, and D-XM into violations. PCI never invokes a population expectation. With S and W defined relative to a fixed factual instance, the question is whether varying the suspect would move the realized outcome y ⋆ away from itself, not whether f (x⋆ ) deviates from E[f (X)]. The structural mechanism is unchanged at the baseline, so the three causal pairs continue to register positive values; the three non-causal pairs continue to register zero exactly, because intervening on a variable that does not structurally affect 40

Plain / Causal SHAP

PCI (W = ∅)

PCI (W = {third})

desideratum

value

status

value

status

value

status

D-XY D-MY D-XM D-YX D-YM D-MX

0.000 0.000 0.000 0.000 0.000 0.000

× × × ✓ ✓ ✓

0.154 0.189 0.146 0.000 0.000 0.000

✓ ✓ ✓ ✓ ✓ ✓

0.115 0.212 0.165 0.000 0.000 0.000

✓ ✓ ✓ ✓ ✓ ✓

D-MXY

0.000 = 0.000 ×

0.189 > 0.154 ✓

0.212 > 0.115 ✓

Table 10: Desiderata at the baseline instance X ⋆ = M ⋆ = Y ⋆ = 0.5. SHAP collapses to zero on every cell, assigning zero to the non-causal triples (though here that zero reflects the vanishing attribution budget rather than a detected absence of a causal path) while offering no signal on the causal ones. PCI reports the same structural verdicts as at X ⋆ = M ⋆ = Y ⋆ = 1.

the target leaves both worlds with identical distributions. SHAP is not wrong at the baseline: it correctly reports that the factual prediction does not deviate from its mean. But that is a different question from causal responsibility for y ⋆ , and when the prediction equals its baseline SHAP has no budget to distribute even though the PSCM’s causal mechanism remains intact. PCI asks the responsibility question directly, and answers it whether or not the prediction happens to coincide with its population mean. 5.4

Summary Across Both Examples

The ranking failures above are not artifacts of a particular feature set or parameter choice: each traces to a structural limitation of the SHAP/Causal SHAP framework. Causal SHAP strictly improves on plain SHAP for one desideratum (D-YX), by replacing observational conditioning with interventional distributions; the remaining failures share two sources: prediction models include non-causal features that the conditioning distribution cannot exclude (D-YM, D-MX), and Shapley averaging cannot distinguish direct from indirect causal paths (D-MXY). The OBCB analysis of Section 5.1 exhibits the same family in different surface form: plain SHAP fails D-A-rank on the 2-feature game, and once the mediator is admitted as a feature, Causal SHAP inherits that same ranking failure for Alice. For Bob it instead becomes undefined outright, which Section 5.1 traces to this particular PSCM’s impossible-cell structure rather than the ranking failure itself; the signalmediation example, which has no such cell, shows the same family of genuine failures recur regardless. Across both examples, neither SHAP variant reliably satisfies the desiderata that motivated PCI in Section 3. Section 2 grounds D-A-rank, D-B-rank, and D-comp in distinctions the preemption and actual-causality literature established well before this paper: active versus preempted versus irrelevant causes, and direct versus indirect causal paths. PCI addresses these gaps through three ingredients the SHAP framework lacks: the witness mechanism, the suspect-set distribution Γs , and the use of the realized outcome rather than the prediction baseline. On top of these, the path-noise asymmetry in the sufficiency world produces a structural gap on D-MXY, which appears already in the witness-free single game and widens further under a witness rule. The two examples here are small enough to inspect every desideratum individually; the broader empirical comparison (a synthetic archetype catalogue and a contrast with gradient-based Differential Causal Effect attribution) was already summarised in Section 4 and is detailed in Appendices D and E. We turn first, in Section 6, to the formal relationship between PCI and actual causality.

6

Relation with Actual Causality

Section 5 positioned PCI against feature-attribution baselines. We now turn to PCI’s relation to the causal-attribution tradition it inherits the witness mechanism from: Halpern’s actual causality. This section establishes the formal connection (Theorems 26–27 and Proposition 32); Section 7 adds the side-by-side comparison with Pearl’s probability of actual causation; Section 4 already previewed the empirical comparison (runtime and verdict recovery as model size grows), with the full protocol

41

in Appendix F. Exact AC-predicate evaluation enumerates suspect and witness subsets, a cost that grows exponentially with model size; the theorems below show that the expectation PCI estimates via Monte Carlo sampling recovers AC verdicts under the stated conditions, so the guarantee carries over to models too large for exact enumeration. PCI is not meant to explicate Halpern’s notion of actual causality; the goal is to combine the intuitions underlying Halpern’s notion with those motivating Pearl’s probabilities of necessity and sufficiency to provide a more general tool for causal attribution. Nevertheless, to show that we preserve the spirit of Halpern’s definition, we now record the connection between actual causality and the joint necessity-sufficiency machinery of Section 3. Concretely, we exhibit a natural choice of variable selection distribution Γ and alternative-value distribution ∆ under which PCI verdicts agree with actual-causality verdicts. With one caveat: probability-of-causation maximisation will not identify subset-minimal causes that are not cardinality-minimal, a misalignment we characterise and remedy below. Throughout this section φ denotes the outcome event whose causes we attribute, {Y = y ⋆ } in the binary case, or a threshold event such as {Y > y0 } for continuous outcomes (as in Appendix G), and ¬φ its complement. This is the event written as the measurable set A ⊆ dom (Y ) in Definition 18. Scope: a necessity-only correspondence. Halpern’s definition involves factivity, context-sensitive necessity, and minimality, but no sufficiency clause analogous to Pearl’s PS or PNS: a gap Beckers [2021b] addresses directly, building on the counterfactual NESS account [Beckers, 2021a]: a cause must be a necessary element of a set that is sufficient for the outcome. The correspondence we establish in this section is therefore necessity-only: the sufficiency component of the kernel Φ defined below, the Y s factor of Definition 18, acts here as a factivity check (restoring factual values must preserve φ under fixed noise). More generally, Y s implements the graded, probabilistic analogue of Beckers’ NESS test: it restores a candidate set C to factual values, holds the witnesses T fixed, and checks that the outcome persists, so that where NESS returns set membership, the joint measure returns a Γ-weighted degree, with the witness set supplying the held-fixed context that NESS sufficient sets leave implicit. That substantive sufficiency component, together with the ciS term in Appendix D, appears in the synthetic overdetermination and undercutting evaluation (Appendix D), the differential causal effect comparison (Appendix E), and the SIR benchmark (Appendix G), settings where AC cannot adjudicate. The correspondence below is thus the AC-facing (necessity) half of a construction whose sufficiency half answers to Beckers’ program rather than Halpern’s. The narrowness of this section’s correspondence reflects what AC itself permits. We first recall Halpern’s definition. Definition 23 (Actual Cause, after Halpern, 2016). C = c is an actual cause of φ in the causal setting (M, u) if the following three conditions hold: • Factivity: (M, u) ⊨ (C = c ) and (M, u) ⊨ φ, • Context-sensitive Necessity: There is a set of variables T ⊆ V and an alternative setting c′ of variables in C such that, writing t⋆ for the factual value of T in (M, u), (M, u) ⊨ [C ← c′ , T ← t⋆ ]¬φ, • Minimality: C is minimal; there is no strict subset Csub ⊂ C such that Csub = csub satisfies the above two conditions where csub is the restriction of c to the variables in Csub . To connect this to PCI, we instantiate the joint necessity-sufficiency machinery (Definition 18) at a single configuration (C, T) and a fixed noise realisation u, and read off the configuration-level contribution. The resulting kernel combines the same three ingredients as Halpern’s definition: a sufficiency check at factual values, a necessity check against alternatives, and a Γ-weight that records how much attention Γ gives the configuration. Throughout the kernel and its proofs we write the restored factual values as the restrictions s⋆ |C and w⋆ |T ; these are the c⋆ and t⋆ of Halpern’s definition above. Definition 24 (AC-aligned PCI kernel). Fix a PSCM M = ⟨U, V, F, PU ⟩,21 a noise realisation u, suspect and witness sets S, W ⊆ V with factual values s⋆ , w⋆ , a variable selection distribution Γ 21

The kernel and the theorems below take the full PSCM (structural equations F plus noise distribution PU ) as given, since both the sufficiency and the necessity factors require sampling counterfactual outcomes

42

on 2S × 2W with mass function pΓ , and an alternative-value distribution ∆(s⋆ ). For an outcome event φ, active suspect set C ⊆ S and active witness set T ⊆ W with T ∩ C = ∅, define Φu (C, T) := pΓ (C, T) · I[(M, u) ⊨ [C ← s⋆ |C , T ← w⋆ |T ] φ] | {z } | {z } selection weight

sufficiency indicator

Z

·

I[(M, u) ⊨ [C ← c′ , T ← w⋆ |T ] ¬φ] ∆C (s⋆ )(dc′ ) . {z } |

(14)

necessity integral

The kernel depends on the fixed noise realisation u through its two indicators; we write Φu when that dependence is in play (as in the noise-integrated score P (C ⇝ φ) below) and abbreviate it to Φ when u is fixed and clear from context. Concretely, Φu (C, T) is the per-configuration term inside the joint necessity-sufficiency measure Pks,n from Definition 18: it replaces integration over PU with point evaluation at u, and the sum over (C, T) with evaluation at a single pair, mirroring AC’s structure of testing factivity and the alternative against a single suspect/witness pair. The kernel is positive exactly when three conditions hold simultaneously: (C, T) has positive Γ-mass; restoring C to its factual values while holding T fixed preserves φ under u (the factivity-as-sufficiency component); and there exists a ∆-positive-density alternative c′ for which the corresponding intervention overturns φ under u (the necessity component). The regularity condition we introduce next ensures that the first of these three, the Γ-selection weight, never vanishes on a legal configuration. Definition 25 (Regular Γ). Γ is regular when pΓ (C′ , T′ ) > 0 for every (C′ , T′ ) with C′ ⊆ S, T′ ⊆ W, C′ ∩ T′ = ∅. We can now record the forward direction, under the conditions stated below: whenever C is an actual cause in Halpern’s sense, the matching kernel value is strictly positive, so PCI never scores an AC-certified cause as zero. Theorem 26. Suppose that C is an actual cause of φ with witness set T in (M, u). Take any potential cause set S ⊇ C with factual values S = s, subject to the constraint that no element of S is a deterministic function (under M ) of any subset of the remaining elements of S,22 and any W ⊇ T as the potential witness set. Assume Γ is regular and that ∆(s) assigns positive density to every s′ ∈ dom (S) \ {s} (positive PMF in the discrete case, positive Lebesgue density in the continuous case). In the continuous case, assume additionally: (i) the structural equations of M downstream of C are continuous in c′ under fixed u; (ii) either ¬φ is open in dom (Y ), or, more weakly, the boundary of ¬φ has measure zero under the pushforward of Y and the witnessing alternative c′ from context-sensitive necessity satisfies Y (c′ ) ∈ int(¬φ) (i.e. the witnessed outcome lies strictly inside ¬φ, not exactly on its boundary). under u. As discussed in Section 1, this is a stronger commitment than approaches that bound PN/PS/PNS from observational data and a causal graph alone, but is the price of pointwise (not just bound) verdicts at the configuration level. 22 Equivalently, S is closed under no nontrivial structural equation of M . The constraint excludes admitting both S and a deterministic descendant H = f (S, . . .) as candidates in the same suspect set, but covers all candidate sets standardly considered in the AC literature, where structural descendants of one candidate are not admitted as separate candidates: their contribution is mediated by the equation, and AC’s minimality clause already prefers the ancestor alone. The same closure condition discharges a joint-support concern: the next assumption requires ∆(s) to place positive density on every joint alternative configuration s′ ∈ dom (S) \ {s}, not merely positive marginal density on each component. In a chain S → H with H = f (S), joint assignments such as (S=0, H=1) are impossible under the structural equations, so any ∆ that placed mass on them would be incompatible with M . Closure rules out exactly this case: when no element of S is a deterministic function of the remaining elements, the joint domain dom (S) contains no rectangles forced to zero measure by M , and a ∆ with positive PMF or Lebesgue density on every s′ ̸= s is consistent with M on the suspect set. In the stone-throwing benchmark of Appendix F, the suspect set is {Ai , Bi }i and the deterministic mediators {Wia , Wib }i live in the witness set, not the suspect set, exactly to keep the suspect set closure-respecting. The kernel pins witnesses at their factual values, so they are not subject to a joint-support requirement on alternatives and need no analogous condition.

43

Then Φ(C, T) > 0,

(15)

Hypotheses (i)–(ii) are a proof device for the necessity integral inside Φ; Halpern’s Definition 23 is a qualitative ⊨-condition with no continuous/discrete distinction of its own, so they play no further role once (15) is established. In particular, every other term Φ(C, T′ ) in the sum below is nonnegative by Definition 24 regardless of them, and therefore X Φ(C, T′ ) > 0. T′ ⊆W

Proof. Fix u, c′ , and T as witnesses to the satisfaction of the conditions in Definition 23. The context-sensitive-necessity clause forces T ∩ C = ∅, since otherwise the joint intervention [C ← c′ , T ← w⋆ |T ] would be ill-defined. It remains to show that each of the three factors in Φ(C, T) is strictly positive. • Selection weight. By regularity of Γ, pΓ (C, T) > 0. • Sufficiency indicator. With exogenous noise u held constant, factivity gives (M, u) ⊨ φ. Restoring C to s⋆ |C and T to w⋆ |T leaves the model agreeing with (M, u) on every variable, so the indicator evaluates to 1. • Necessity integral. Context-sensitive necessity provides a specific c′ witnessing (M, u) ⊨ [C ← c′ , T ← w⋆ |T ]¬φ. The closure condition on S and the positive-density assumption on ∆(s) imply that c′ lies in the support of ∆C (s⋆ ). We treat the two cases separately. Discrete case: the singleton {c′ } has positive PMF ∆C ({c′ }) > 0 by hypothesis, so the integral is at least ∆C ({c′ }) > 0. Continuous case: hypothesis (i) gives continuity of the intervention map c′ 7→ Y at fixed u; hypothesis (ii) places Y (c′ ) in the interior of ¬φ, directly if ¬φ is open (every point of an open set is interior), and by the added clause otherwise. Pulling back an open neighbourhood within ¬φ yields an open neighbourhood of c′ on which the indicator equals 1, and this neighbourhood has positive Lebesgue measure and hence positive ∆C -mass by the positive-density hypothesis. In either case the integral is strictly positive. The product of three strictly positive factors is strictly positive, giving Φ(C, T) > 0. By Definition 24, every Φ(C, T′ ) is itself a product of a nonnegative selection weight, a {0, 1}-valued indicator, and an integral of a {0, 1}-valued indicator against the nonnegative measure ∆C , hence Φ(C, T′ ) ≥ 0 for every T′ ⊆ W; summing over T′ therefore adds non-negative terms to the positive term Φ(C, T), preserving positivity. The proof uses factivity and context-sensitive necessity but not minimality: the same conclusion holds whenever C satisfies factivity and context-sensitive necessity in (M, u), a fact we will use in Proposition 32. In settings with continuous outcomes and a threshold event such as φ = {Y > y0 } (for instance the SIR overshoot benchmark of Appendix G), both hypotheses are typically satisfied via the weaker clause of (ii): ¬φ = {Y ≤ y0 } is closed rather than open, but its boundary is the single point y0 , which has measure zero under any continuous pushforward of Y ; the surviving requirement is that the specific witnessing alternative satisfies Y (c′ ) < y0 strictly rather than Y (c′ ) = y0 exactly, generic under a continuous pushforward, but not automatic, so a witness that lands exactly on the threshold needs a separate (measure-zero, hence non-generic) argument. (Literal openness of ¬φ instead requires the strict inequality on the ¬φ side, i.e. φ = {Y ≥ y0 }, ¬φ = {Y < y0 }.) Binary-output models, where Y takes values in {0, 1}, satisfy (ii) automatically (every subset of a discrete codomain is open) but may not satisfy (i) when the binary output comes from thresholding a continuous score. In such cases the proof falls back to the discrete branch, which only requires positive PMF on the witnessing c′ . The converse also holds: a strictly positive summed kernel value forces both factivity and contextsensitive necessity, the two qualitative AC conditions the kernel is built to detect (we treat minimality separately below). The proof reads the argument for Theorem 26 in reverse on the necessity factor.

44

Theorem 27. Under the same hypotheses on S, Γ, and ∆ as in Theorem 26, if X Φ(C, T′ ) > 0, T′ ⊆W

then both factivity ((M, u) ⊨ φ) and the context-sensitive-necessity condition in Definition 23 hold for C in (M, u). Proof. Since Φ is non-negative, the assumption forces Φ(C, T′ ) > 0 for at least one T′ ⊆ W. By Definition 24, each factor of Φ(C, T′ ) is strictly positive. The sufficiency indicator equals 1, i.e. (M, u) ⊨ [C ← s⋆ |C , T′ ← w⋆ |T′ ]φ; since pinning variables to their factual values under fixed u leaves every variable unchanged, this is equivalent to (M, u) ⊨ φ, giving factivity. The necessity integral being positive provides a ∆C -positive-density set of values c′ for which (M, u) ⊨ [C ← c′ , T′ ← w⋆ |T′ ]¬φ; any such c′ , together with T′ , witnesses the existential in the context-sensitivenecessity clause of Definition 23. Remark (deterministic intermediates and joint support). The hypothesis on S rules out the following obstruction. Suppose the suspect set were closed under the structural equations of M , e.g., both Sally’s throw S and the bottle’s hit H = f (S, . . .) admitted as candidates. Then the joint assignment (S=0, H=1) is structurally impossible, and any alternative-value distribution consistent with M assigns it density zero, so the joint full-support condition required to recover the witnessing c′ from Φ > 0 fails. Restricting suspects to variables that are not deterministic functions of the others under M removes this obstruction. The constraint is also conservative with respect to the AC literature: in the canonical stone-throwing setup, the candidate set is {SSally , SBill }, with H as the outcome, and AC’s own minimality clause already prefers ancestor candidates over their deterministic descendants when both are admitted. Sections D and F adopt the same convention experimentally (the continuous synthetic benchmark uses the six roots as suspects and the discrete scaled-throwing benchmark uses {Ai , Bi }i as suspects with the deterministic mediators {Wia , Wib }i as witnesses); in both cases deterministic intermediates are excluded from the suspect set. Cases where a user genuinely wants to attribute responsibility separately to a deterministic intermediate (rather than to its structural ancestors) lie outside the scope of these theorems and require an alternative reading of intervention semantics; we treat that as a separate problem. With minimality, the situation is somewhat more complicated. Our choice of Γ affects which configurations maximise Φ. Moreover, Φ compares configurations by Γ-weight, and Definition 23 formulates minimality strictly in terms of subsets, so some misalignment is to be expected. A few structural conditions salvage much of the correspondence nonetheless, starting with the following monotonicity property. Enlarging the candidate cause set typically makes the necessity check harder to satisfy: flipping the outcome now requires a joint alternative across more coordinates, which is generally a rarer draw under ∆. Necessity dilution names the monotonicity condition under which this intuition always holds: growing C never increases the necessity mass, so that Γ’s preference for smaller sets is not fighting an opposing pull from N . Definition 28 (Necessity dilution). A pair (M, ∆) satisfies necessity dilution on S if, writing N (C, T) for the necessity integral in Equation (14), N (C♯ , T♯ ) ≥ N (C† , T† ) for every C♯ ⊊ C† ⊆ S and witnesses T♯ , T† disjoint from the corresponding suspect set. First, there is a simplified setting in which a positive value of Φ, under factivity, entails minimality with respect to the same parameters. Three conditions suffice: • Γw is uniform over 2W ; • Γs is strictly cardinality-decreasing, i.e. pΓs (C1 ) > pΓs (C2 ) whenever C1 ⊊ C2 (this offsets larger suspect sets’ structural advantage: with more variables to draw on, they are easier to certify as necessary, so without a compensating weight they would be spuriously preferred over the true minimal cause);

45

• the pair (M, ∆) satisfies necessity dilution on S (Definition 28). Section 3’s default recommendation and its OBCB illustration both use a uniform Γs . The correspondence below needs the cardinality-decreasing weighting above; a practitioner obtains this guarantee by choosing that weighting explicitly. The same proof strategy, extended below, shows that we can safely marginalise over witnesses as well. Theorem 29. Consider the set of optimisers O⋆ = arg maxC⊆S, T⊆W Φ(C, T). Assume (C† , T† ) ∈ O⋆ with Φ(C† , T† ) > 0, that factivity is satisfied for C† (as in Definition 23), and that no element of S is a deterministic function under M of the others. Let Γw be uniform on 2W and let Γs be strictly cardinality-decreasing, assume that (M, ∆) satisfies necessity dilution on S, and assume ∆ satisfies the positive-density hypothesis of Theorem 26 (together with hypotheses (i)– (ii) there, in the continuous case); this lets the proof below invoke Theorem 26 on C♯ . Then C† is an actual cause of φ according to Definition 23. Proof. Factivity is assumed; by Theorem 27 the context-sensitive-necessity condition holds for C† in (M, u). So the only way C† can fail to be an actual cause is by failing minimality. Suppose for contradiction that minimality fails: there is C♯ ⊊ C† satisfying factivity and context-sensitive necessity for φ with some witness T♯ . By Theorem 26 (its proof requires only factivity and necessity, not minimality), Φ(C♯ , T♯ ) > 0 as well, with the sufficiency indicator and the necessity integral both equal to 1 and a strictly positive value, respectively. Both pairs therefore satisfy Φ(C, T) = pΓ (C, T) · N (C, T). By the construction of Γ from independent marginals (Section 3), pΓ (C, T) ∝ pΓs (C) pΓw (T) I[T ∩ C = ∅]. The I[·] factor is 1 for both pairs (otherwise the contradiction would have been immediate). Uniformity of Γw on 2W makes pΓw (T) = 2−|W| identically, so the witness factor cancels. Strict cardinality-decrease of Γs together with C♯ ⊊ C† gives pΓs (C♯ ) > pΓs (C† ), and necessity dilution gives N (C♯ , T♯ ) ≥ N (C† , T† ). Multiplying these (and noting N (C♯ , T♯ ) > 0 to convert weak into strict in the composite) gives Φ(C♯ , T♯ ) > Φ(C† , T† ), contradicting (C† , T† ) ∈ O⋆ . Corollary 30. Keep P the notation and hypotheses of Theorem 29.PConsider the set of optimisers OΣ = arg maxC⊆S T⊆W Φ(C, T). Assume C† ∈ OΣ with T⊆W Φ(C† , T) > 0 and that factivity is satisfied for C† . Then C† is an actual cause of φ according to Definition 23. Proof. The summation hypothesis entails the existence of some T† ⊆ W with Φ(C† , T† ) > 0; by Theorem 27, factivity and context-sensitive necessity hold for C† . It remains to rule out a failure of minimality. We cannot simply invoke Theorem 29: C† ∈ OΣ does not place any single pair (C† , T) in the joint optimiser set O⋆ , since a candidate whose Γ-mass is spread thinly across many good witnesses can beat, in sum, a competitor that concentrates all its mass on one witness pair with strictly higher pointwise Φ. We instead adapt the argument of Theorem 29 directly to the summed objective. Since factivity is global, (M, u) |= φ, restoring any disjoint pair (C, T) to its own factual values is the identity intervention, so the sufficiency indicator in Definition 24 equals 1 for every such pair; hence Φ(C, T) = pΓs (C) pΓw (T) N (C, T) whenever T ∩ C = ∅. Suppose for contradiction that minimality fails for C† : there is C♯ ⊊ C† satisfying factivity and context-sensitive necessity with some witness T♯ (not necessarily minimality itself). By Theorem 26, whose proof requires only factivity and necessity, not minimality (as already noted in the proof of Theorem 29), Φ(C♯ , T♯ ) > 0. For every T with T ∩ C† = ∅ (hence also T ∩ C♯ = ∅, since C♯ ⊊ C† ), necessity dilution gives N (C♯ , T) ≥ N (C† , T) for that same T, while strict cardinality-decrease gives pΓs (C♯ ) > pΓs (C† ) and uniformity of Γw makes pΓw (T) a common positive constant; together these give Φ(C♯ , T) ≥ Φ(C† , T) pointwise, with strict inequality at T = T† since N (C† , T† ) > 0 there. Summing over T ⊆ W disjoint from C† , then using nonnegativity of Φ to extend the left-hand sum to all T disjoint from C♯ (a superset of the domain on the

46

right, since disjointness from the smaller set C♯ is the weaker condition), X X Φ(C♯ , T) > Φ(C† , T), T⊆W †

T⊆W

contradicting C ∈ O . So minimality holds, and C† is an actual cause of φ. Σ

Necessity dilution is a property of (M, ∆) alone, not of Γ. Definition 28 is deliberately strong: it compares N across every pair of independently-chosen witness sets T♯ , T† , not merely at a shared witness set. That strength is exactly what licenses comparing T♯ against the optimal T† directly in the proof of Theorem 29 above (Corollary 30’s proof needs only the weaker same-T special case, N (C♯ , T) ≥ N (C† , T) for each shared T, which the strong version implies). We write N (C) for N (C, T) where this does not depend on T at all; i.e. pinning any admissible witness set at its factual values leaves the necessity integral for C unchanged, which is a structural property of (M, ∆, C) that should be checked case by case, not assumed from the notation. The condition requires that the ∆-mass of alternatives that flip the outcome does not grow as the candidate cause expands. Three settings make it automatic, and satisfy the witness-independence just described. (i) Singlepivot models: one variable X ⋆ ∈ S is pivotal under (M, u) and the others are structurally idle, so N peaks at {X ⋆ } and falls off as more suspects N are added. (ii) Factored ∆ without Boolean-OR redundancy: ∆C is a product of marginals X∈C νX with νX (dom (X)) ≤ 1, and the flip event factorises coordinate-wise; N (C) is then a product of factors each at most 1, decreasing in |C|. (iii) Conjunctive outcome events: if ¬φ requires flipping every variable in a required set R ⊆ S, the flip region’s ∆C -mass decreases as C grows beyond R. The hypothesis fails in disjunctive overdetermination (e.g. φ : A ∨ B = 1 with both A, B factual): no proper subset of S flips φ, so N is zero on subsets and positive on the full set: the opposite of dilution. In such cases no proper subset of S is an actual cause anyway, so Theorem 29 is not the appropriate tool; Proposition 32 is. We can now return to the misalignment mentioned earlier. Consider a reasoning mode that Rlooks P for causes of an outcome by inspecting the integrated probability P (C ⇝ φ) := T Φu (C, T) PU (du), without knowing the values of u but knowing that φ occurred. As the next observation shows, arg maxC⊆S P (C ⇝ φ) can fail to include some C that is an actual cause of φ for some setting u. Observation 31. Define Ξmax = arg maxC⊆S P (C ⇝ φ). It is not the case that if C† is an actual cause in (M, u) for some u, C† ∈ Ξmax . Proof. Consider a model with two binary parents A, B uniformly distributed and a binary child Y = A ∨ B. Take φ : Y = 1 and the suspect set S = {A, B} with W = ∅, and take ∆ to be the deterministic bit-flip distribution on {0, 1} (the single-point alternative used throughout the binary examples of this paper, e.g. Algorithm 2): for active suspect set C, ∆C (s⋆ ) places all its mass on the coordinatewise complement of s⋆ |C . Compare C† = {A, B} at noise u11 (A = B = 1) and C♯ = {A} at noise u10 (A = 1, B = 0). • In u11 , C† is an actual cause: setting both parents to 0 yields Y = 0, no proper subset achieves this, and the indicators in Φ are 1. With Γw uniform on 2∅ (a single configuration of weight 1) and a strictly cardinality-decreasing Γs , Φu11 (C† , ∅) ∝ pΓs ({A, B}). At the other two noise settings with Y = 1, the bit-flip alternative for C† does not flip Y : at u10 it sends (A, B) to (0, 1), and at u01 to (1, 0), both of which keep Y = 1. So only u11 contributes to C† . • In u10 , C♯ is an actual cause: intervening to A = 0 (with B left at its factual value 0, since B ∈ / C) flips Y to 0, the singleton is minimal, and again the indicators are 1. So Φu10 (C♯ , ∅) ∝ pΓs ({A}). At u11 , by contrast, the bit-flip alternative for C♯ sends A to 0 while B remains at its factual value 1 (again B ∈ / C is not intervened), so Y = 0 ∨ 1 = 1 does not flip: the necessity integral, and hence Φu11 (C♯ , ∅), is 0. At u01 the same computation with A flipped to 1 also leaves Y = 1. So only u10 contributes to C♯ . Integrating uniformly over the four noise realisations {uij }, P (C† ⇝ φ) ∝ pΓs ({A, B}) and P (C♯ ⇝ φ) ∝ pΓs ({A}), each with exactly one contributing noise realisation. Since Γs is 47

cardinality-decreasing, pΓs ({A}) > pΓs ({A, B}) for every such Γs , so C♯ strictly outscores C† regardless of the precise shape of Γs : C† ∈ / Ξmax even though it is an actual cause at u11 , so some actual causes are dropped. (Under a different ∆ that spreads positive density over every joint alternative rather than concentrating it on the bit flip, both A’s and B’s complements would separately admit nonzero necessity mass at u10 and u01 , changing the counts above; the conclusion that some actual cause is excluded from Ξmax is not sensitive to this choice, but the specific proportionality constants are.) The reason is structural: actual cause sets may be subset-minimal without being cardinalityminimal, while integrated-probability maximisation is governed by Γs , which (under the cardinalitydecreasing parameterisation that aligns with AC’s minimality) penalises larger sets. The misalignment is therefore a mismatch between AC’s notion of minimality (subset relation) and Γ-weighted scoring. The fix is to drop the maximisation step and use Φ directly to enumerate candidate causes, then filter for subset-minimality. The filter recovers exactly the actual causes in S. Proposition 32. Under the hypotheses of Theorem 26, define n o X X Ξ := C† ⊆ S : Φ(C† , T) > 0, ∄ C′ ⊊ C† with Φ(C′ , T) > 0 . T⊆W

T⊆W

Then Ξ contains exactly the actual causes of φ in (M, u) that are subsets of S. P Proof. Ξ-membership ⇒ actual cause. Let C† ∈ Ξ. Theorem 27 applied to T Φ(C† , T) > 0 gives both factivity and context-sensitive necessity. For minimality, suppose Csub ⊊ C† satisfied factivity and context-sensitive necessity. By the P proof of Theorem 26 (which uses only factivity and necessity, not minimality), we would have T Φ(Csub , T) > 0, contradicting the no-positiveproper-subset clause of Ξ. ActualP cause ⇒ Ξ-membership. Let C† ⊆ S be an actual cause of φ in (M, u). Theorem 26 † ′ † gives T Φ(C , T) > 0. For the no-positive-proper-subset clause: suppose C ⊊ C had P ′ T Φ(C , T) > 0. Then by Theorem 27, both factivity and context-sensitive necessity would hold for C′ . So C′ would witness a violation of C† ’s minimality, contradicting the assumption that C† is an actual cause. Proposition 32 converts the cardinality–subset misalignment into a procedure: enumerate {C ⊆ S : P T Φ(C, T) > 0} (which by Theorem 27 are exactly the cause sets satisfying context-sensitive necessity), filter for factivity and subset-minimality, and read off the actual causes. Certain features of the AC notion (in particular, the subset-minimality clause, which does not align cleanly with Γweighted scoring) are part of what motivated the more scalable PCI formulation of Section 3 in the first place; the filter procedure here is the right tool when a user wants AC verdicts specifically, but expectation-based PCI attributions are what scale to ML-grade models. Summary of guarantees. The section delivers, under explicit hypotheses on S, Γ, and ∆: (i) a forward P direction (Theorem 26) “actual cause ⇒ Φ > 0”; (ii) a backward direction (Theorem 27) “ T′ Φ > 0 ⇒ context-sensitive necessity”; (iii) minimality preservation under cardinalitydecreasing Γs (Theorem 29, Corollary 30); (iv) a counterexample (Observation 31) showing that integration over noise misaligns with subset-minimality; and (v) a corrective filter procedure (Proposition 32) that recovers AC verdicts exactly. The empirical counterpart of the correspondence, a benchmark of the necessity-only PCI estimator against exact subset enumeration on a scaled stonethrowing problem, is reported in Appendix F. The next section locates PCI against the construction in the literature closest to its expectation form: Pearl’s probability of actual causation. The two share the same surface idea, “how often, under the noise, does the actual-cause verdict fire?”, and they coincide on standard examples, but they disagree on graded responsibility patterns that PCI registers and Pearl’s binary AC verdict discards. Section 7 walks through Pearl’s canonical desert-traveller illustration and a weak-poison variant to make the distinction concrete.

48

7

Relation with the Probability of Actual Causality

We now discuss the relation between PCI and Pearl’s probability of actual causation. On Pearl’s Definition 10.3.5 [Pearl, 2009, Ch. 10], P (caused(x, y | e)) =

P (Uxy ∩ Ue ) , P (Ue )

Uxy = {u : AC(x, y; M, u)},

(16)

is the posterior probability, given the evidence, that we are in a noise state for which the actual-cause verdict holds, with AC(x, y; M, u) a chosen actual-causation predicate: the causal-beam definition of [Pearl, 2009, Ch. 10] or the Halpern–Pearl AC1–AC3 [Halpern, 2016].23 The same construction underwrites Chockler and Halpern’s degree of blame [Chockler and Halpern, 2004], which substitutes a graded responsibility share inside the expectation; and, more directly, Halpern and Kleiman-Weiner’s degree of blameworthiness [Halpern and Kleiman-Weiner, 2018], which takes the expectation of an actual-causation quantity over an epistemic state (a probability distribution over causal models). PCI’s expectation over noise states in Definition 18 has exactly this shape. In multi-agent settings, Friedenberg and Halpern [Friedenberg and Halpern, 2019] apportion group blameworthiness to individual agents via the Shapley value (see also Alechina et al., 2017, who compute causality, responsibility, and blame for multi-agent team plans); this is a causal use of the same game-theoretic averaging that, applied associationally to a predictive model, underlies SHAP (though we raise our own concerns about SHAP-style attribution in Section 5). Because (16) is the closest construction in the literature to PCI’s expectation, we examine in detail how it differs from PCI and where PCI improves on it. We replay Pearl’s desert-traveller illustration and his binary actual-cause verdicts, then compute PCI on the same example and show it recovers Pearl’s ranking with graded magnitudes. We then introduce a weak-poison variant that exhibits three intuitive responsibility patterns: two that Pearl’s binary verdict cannot capture but PCI’s graded reading does, and one (within-scenario ranking) that Pearl preserves. We close with other differences between PCI and Pearl’s probability of causation that make the former more general and more scalable. 7.1

Pearl’s Worked Example: The Desert Traveller

We start with the canonical illustration used by Pearl [Pearl, 2009, §10.3.3]. Example 33 (Desert traveller). A traveller has two enemies. The shooter (enemy 2) shoots and empties the canteen (X=1); the poisoner (enemy 1), unaware, puts cyanide in the water (P =1). The traveller dies (Y =1). Who is the actual cause of death? The example involves one source of uncertainty packed into a binary noise u: • u = 0: traveller drank the poisoned water before the canteen was emptied; cyanide killed him. • u = 1: canteen was empty before he could drink; dehydration killed him. There are at least two intuitions here that we would like to recover. One, in any particular case, we want to be able to identify the actual cause. The other, slightly weaker, is that we should not call the dormant cause completely blameless. Actual causality gives us the first half of the story, assigning full responsibility to one source here. Pearl’s beam analysis [Pearl, 2009, Ch. 10] (equivalently Halpern–Pearl AC1–AC3 of Halpern, 2016) gives the actual-cause verdicts at each deterministic state: • In u = 0: P =1 is the actual cause; X=1 is not. • In u = 1: X=1 is the actual cause; P =1 is not. So Ux,y = {u = 1} and Up,y = {u = 0}. Two natural forensic reports each push Pearl’s posterior to certainty (Table 11): toxicology finding cyanide in the body is incompatible with u = 1, so 23

All computations behind the comparison in this section, Pearl’s original desert-traveller and the weakpoison variant, are collected in the companion notebook desert_traveler, which runs the PCI Monte Carlo search of Section 3 on a scenario-specific structural model for each forensic posterior alongside a parallel hand-rolled enumeration; the two agree within Monte Carlo noise on every value reported below.

49

UX

UP order coin

empties canteen

u

X

P

poisons water

candidate cause cyanide path

c

thirst path

d

witness / mediator outcome intermediate exogenous noise

y death

Figure 11: Pearl’s desert traveller as a graph. The two candidate causes (teal: X, who empties the canteen, and P , who poisons the water) feed two competing mechanisms (gold hexagons), the cyanide path c and the thirst path d, whose disjunction is death y (purple double box). The exogenous noise comprises the order coin u (a named exogenous variable that enters c and d directly) and the coins UX , UP realising the two enemies’ actions; the mechanisms c, d, y are deterministic and carry none. It is u, deciding which path operates first, that creates the preemption making this case hard for theories of actual causation.

P (caused poisoner | eA ) = 1; a forensic report of no cyanide is incompatible with u = 0, so P (caused shooter | eB ) = 1. Forensic posterior

P (caused shooter)

P (caused poisoner)

0 1

1 0

eA : cyanide detected (u = 0) eB : no cyanide (u = 1)

Table 11: Pearl’s probability of actual causality P (caused | e) on the basic desert traveller. The verdict saturates at 1 for the cause whose path operated in the forensically identified scenario, and at 0 for the dormant one.

7.2

PCI on the Basic Desert Traveller

To compare directly with Pearl, we run PCI under the same forensic conditioning: one structural model per scenario (endogenous variables X, P, c, d, Y ∈ {0, 1}, with c the cyanide path operating and d the dehydration path), with u pinned at the scenario’s forensic realisation. Suspects are S = {X, P } with singleton candidate causes; the witness pool is the mediators {c, d} under a cardinalityuniform Γ; ∆ deterministically flips 1 → 0; PCI leaves the non-cause suspect to the SCM rather than intervening on it; and the noise distribution PU is the forensic posterior, a point mass at the scenario’s u (we do not condition on the outcome Y itself). Appendix C gives the full structural model and component specification. For each candidate cause C we report three quantities, all in [0, 1],24 higher meaning more responsibility, jointly averaged over the four sources of randomness (Γ, ∆, PU , and the SCM-driven non-cause suspect):   NC = E 1{Y n ̸= y ⋆ } (necessity: removal flips Y ),   s ⋆ SC = E 1{Y = y } (sufficiency: holding at factual sustains Y ), (17)   n ⋆ s ⋆ JC = E 1{Y ̸= y } 1{Y = y } (joint PNS-style). Thus JC is the PCI score PCIC of Definition 19 under the PNS-binary ci, and NC , SC are its necessity and sufficiency marginals. 24

We evaluate these for a fixed candidate cause C, hence normalise them to [0, 1]; this differs from the subprobability E[ci] of Definition 19, whose total mass is PrΓ [Xk ∈ C] ≤ 1 because it sums only over suspect sets that contain Xk .

50

Under the spec above (computation in the companion notebook), the results are: N

S

J

Pearl P (caused)

Forensic posterior

Cause

eA : u = 0 (cyanide)

shooter 1/4 11/12 5/24 poisoner 1/3 1 1/3

0 1

eB : u = 1 (dehydration) shooter 1/3 1 1/3 poisoner 1/4 11/12 5/24

1 0

Table 12: PCI and Pearl on the basic desert traveller, under the scenario’s forensic posterior. PCI’s joint score J ranks the same cause Pearl’s P (caused) does in each scenario; PCI returns a graded reading where Pearl returns the binary {0, 1}. The cells use the diagonal coupling of Definition 18 (Figure 4): Y s and Y n share both the noise realisation u and the non-cause suspect’s value, and are otherwise independent.

Figure 12: Basic desert traveller. Left: Pearl’s binary actual-cause verdict beside PCI’s joint score J, per scenario and cause. Right: the necessity and sufficiency components behind each J. Both methods name the same enemy in each scenario; PCI also keeps the dormant enemy on the hook at 5/24.

Reading off Table 12: (1) PCI and Pearl agree on the ranking. In each scenario, J is strictly larger for the cause Pearl identifies, and strictly smaller for the other. PCI’s ordering matches the actual-cause verdict at each forensic posterior. (2) PCI is graded; Pearl is binary. Pearl’s P (caused) saturates at 0 or 1. PCI’s J never reaches 1 here because the Γ-averaging over witness subsets dilutes each cause’s score: the “best” witness subset for the operative cause does flip the outcome deterministically and gives J = 1 at that single configuration, but the cardinality-uniform average over the witness subsets (weights 13 , 16 , 16 , 13 over ∅, {c}, {d}, {c, d}) brings the average down to 1/3; the per-subset breakdown is in the companion notebook. (3) The dormant cause is not at zero. PCI assigns 5/24 ≈ 0.21 to the dormant cause. This is not noise: in some witness configurations the dormant cause’s removal does flip Y , because averaging marginalises the non-cause suspect and PCI does not artificially pin the model to “this scenario” beyond the noise realisation itself. Pearl’s binary indicator throws this graded information away. 7.3

PCI Expectation vs the AC Machinery

The agreement is reassuring; the substantive change is in how the verdict is computed. AC’s necessity clause is an existential: there exists a witness set T and an alternative value c′ such that the intervention flips Y . To verify the existential one in principle enumerates the candidate (T, c′ ) pairs: this is the main source of AC’s combinatorial hardness. Pearl’s definition then averages the indicator of that already-enumerated predicate over noise states, inheriting the enumeration unchanged. PCI collapses both moves into one expectation, averaging Φ over the joint (C, T, u) under Γ ⊗ PU . The existential “does some witness work?” becomes a Γ-weighted measure of how much witnesses collectively support causation: a graded score that a user estimates by sampling, built from the full quantity that AC collapses to a yes/no verdict. 51

In the desert traveller this difference is minor: a user can trivially enumerate the four candidate witness sets by hand. The large-n gap is an analytic fact about AC’s existential check, not something this example demonstrates: for a model with n candidate witness variables, that existential requires checking up to 2n subsets per noise state by construction, and Pearl’s posterior over the AC indicator inherits that cost at every evaluation. A user estimates PCI’s expectation by Monte Carlo at a budget they set, with variance independent of that combinatorial size. Appendix F reports this gap directly as n grows; the desert traveller only fixes the small-n case, where the cost difference is negligible. So far we have two conceptual differences: PCI’s graded reading and its Monte Carlo scaling. We have already seen that this helps recover the intuition introduced above: the shooter, in the scenario where poison killed the traveller, is less blameworthy than the poisoner but not completely blameless. Now we turn to another example, exploiting the fact that actual causality lacks a sufficiency component, where a small change to the model makes Pearl’s binary indicator structurally unable to track the responsibility patterns we think a responsibility attribution method should capture. 7.4

Weak-Poison Variant: Path-Reliability and Cross-Scenario Reliability

We modify the desert traveller so the cyanide path is unreliable while the dehydration path stays deterministic. The change is small, but it brings out three intuitions that a graded responsibility metric should capture and a binary actual-cause indicator structurally cannot. Section 7.6 shows this graded sensitivity is structurally distinct from the probability-raising accounts of Fenton-Glynn and Fang, which lack PCI’s continuous kernel and sufficiency component.25 Example 34 (Desert traveller, weak poison). Same enemies as in Example 33. The cyanide is a small dose that turns out fatal only with probability α = 0.1, governed by an independent exogenous coin ξ ∼ Bern(α). The structural equations are c = p (u′ ∨ x′ ),

d = x (u ∨ p′ ),

vC = c · ξ,

y = vC ∨ d,

′

where primes here denote Boolean complement (x = 1 − x, and likewise u′ , p′ ), not the alternativevalue c′ of the necessity intervention, and vC is the new “cyanide-was-fatal” mediator: drinking the poison (c = 1) only kills when the fatality coin also operates (ξ = 1). α = 1 recovers Pearl’s original. Three responsibility intuitions for an attribution method. Before any computation, the three intuitions that we expect an attribution method to recover in this case are: 1. Adding noise to a path should lower its own cause’s responsibility. The cyanide path is now unreliable. In the scenario where cyanide killed (Scenario A, u = 0, ξ = 1), the poisoner is still the actual cause, but less responsible than in the basic deterministic version, because the killing depended on a coin landing favourably. 2. Within a scenario, the operative cause should still win. In Scenario A, even after softening, the poisoner should rank above the shooter. In Scenario B, the shooter should rank above the poisoner. 3. A reliable cause in its own scenario should beat an unreliable cause in its own scenario. Comparing across scenarios: the shooter in Scenario B (dehydration deterministic) should outrank the poisoner in Scenario A (cyanide stochastic). Their respective paths are operative in their own scenarios, but one is reliable and the other is not. Pearl’s P (caused) captures (2) (the within-scenario ranking), but misses (1) and (3). The AC predicate fires deterministically once we condition on the forensic posterior: in Scenario A, u = 0 and ξ = 1 jointly imply the cyanide path was the operative chain, so P (caused poisoner | eA ) = 1; in Scenario B, u = 1 implies the dehydration chain operated, so P (caused shooter | eB ) = 1. Both scenarios saturate at 1 for their respective operative cause, identical to the basic version (Table 13). Pearl’s binary indicator is structurally indifferent to whether the cyanide path is deterministic or stochastic, and blind to any cross-scenario comparison. 25 That human responsibility judgments are in fact graded, and sensitive to the structure by which individual contributions combine into a group outcome, has empirical support: Gerstenberg and Lagnado [2010] found that across experimental conditions the structural-model account of Chockler and Halpern [2004] predicted participants’ responsibility allocations better than competing cognitive models.

52

Forensic posterior

P (caused shooter)

P (caused poisoner)

0 1

1 0

eA : cyanide killed (u = 0, ξ = 1) eB : dehydration killed (u = 1)

Table 13: Pearl’s P (caused) on the weak-poison variant. Identical to the basic version (Table 11); the binary AC indicator is insensitive to α.

PCI on the weak-poison model. We run PCI exactly as in Section 7.2, with one mechanical change: the witness pool becomes W = {c, d, vC } (the new mediator vC is included), and the forensic posterior in Scenario A pins both u = 0 and ξ = 1 (cyanide-was-fatal is directly forensically observable). Scenario B’s posterior pins u = 1; ξ is structurally irrelevant since the cyanide path is dormant. Table 14 reports PCI’s three quantities alongside Pearl’s verdict. The companion notebook computes the values, and a hand-rolled enumeration matching the framework verifies them. Forensic posterior

Cause

N

S

J

Pearl P (caused)

eA : u = 0, ξ = 1 (cyanide killed) shooter 1/6 23/24 7/48 poisoner 5/24 1 5/24

0 1

eB : u = 1 (dehydration killed)

1 0

shooter poisoner

1/2 1/4

1 3/4

1/2 1/8

Table 14: PCI and Pearl on the weak-poison desert traveller, under the scenario’s forensic posterior. PCI’s J ranks the same cause Pearl’s binary verdict does in each scenario; the magnitudes also reflect the asymmetry between the deterministic dehydration path and the stochastic cyanide path. As in Table 12, cells use the diagonal coupling of Definition 18: Y s and Y n share both the noise realisation and the non-cause suspect’s value.

Figure 13: Weak-poison variant, laid out as Figure 12. Pearl scores both operative enemies at 1 and cannot separate the scenarios; PCI separates them, ranking the shooter in Scenario B (1/2) above the poisoner in Scenario A (5/24).

The three intuitions are all captured by J. (1) Adding noise lowers the noisy cause’s responsibility. The poisoner in Scenario A drops from J = 1/3 in the basic version (Table 12) to J = 5/24 in the weak version (Table 14). The drop is a Γ re-weighting, not a loss of sufficiency: the poisoner’s sufficiency factor is exactly 1 in both versions. Adding the fatality coin adds vC to the witness pool, so the eight subsets of {c, vC , d} replace the four subsets of {c, d}, and the single configuration that scores 1 for the poisoner now carries a twelfth of the averaging weight where it carried a sixth. The empty witness set still contributes 1/2 1 at weight 1/4, and 41 · 12 + 12 · 1 = 5/24. (2) Within a scenario, the operative cause still wins. In Scenario A, Jpoisoner = 5/24 > Jshooter = 7/48. Cyanide was the operative path, and PCI tracks that. In Scenario B the margin is fourfold, 53

Jshooter = 1/2 against Jpoisoner = 1/8. At u = 1 with ξ = 0 the cyanide path is dead, so nothing the poisoner did could have killed this traveller, and his 1/8 records no responsibility for the death. It is the residue of marginalising over the shooter’s action, which credits the poisoner in those drawn worlds where the shooter did not act either. PCI grades him as dormant: above a variable with no path to the outcome, and well below the cause that did the work. (3) Reliable beats unreliable, across scenarios. The shooter in Scenario B (J = 1/2) outranks the poisoner in Scenario A (J = 5/24). Neither ceiling differs: both operative causes reach J = 1 at their best witness configuration, so the coin does not lower what the poisoner can attain. What differs is how many configurations attain it. Conditional on u = 1 the cyanide path is dead, so removing the shooter leaves nothing that can kill and four of the eight witness subsets score a full 1. Conditional on u = 0, ξ = 1 the shooter is still standing with a working dehydration path, so removing the poisoner lets the shooter cover the death half the time, and only one subset reaches 1. Pearl’s P (caused) misses intuitions (1) and (3) for related reasons: (1) requires sensitivity to mechanism noise, which the AC indicator does not have once the forensic posterior is applied; (3) requires cross-scenario comparison of strength of responsibility, which Pearl’s P (caused) does not produce because each posterior independently saturates at 0 or 1. 7.5

Further Differences Between Pearl’s Probability of Causation and PCI

Breadth of aggregation. Def. 10.3.5 aggregates over one dimension: the noise u, conditional on evidence e, for a claim (X = x, Y = y) already fixed. PCI aggregates over four: the suspect set C and witness set T via Γ, the alternative value c′ via ∆, and the noise via PU . This supports perfeature comparison: the same PCI expectation, evaluated over varying C inside a fixed S, returns the relative responsibility of each candidate cause. Def. 10.3.5 does not itself provide that comparison as a single expectation: obtaining it requires a separate evaluation per candidate cause, each inheriting the AC-predicate cost discussed above, tabulated by hand as in Table 11 above. Continuous variables. The AC predicates inside Def. 10.3.5 are event-shaped: they read off AC(x, y; M, u) for propositional x, y, and extensions to continuous variables require discretising the relevant event before the predicate applies. PCI’s ci function is continuous-native (the absolutedifference impact score of Section 3), and the synthetic benchmark of Appendix D exercises that continuity directly. Lineage in Pearl’s PN/PS. Def. 10.3.5 takes a binary actual-causation predicate (itself a structuralequation construction that does not appeal to PN/PS at all) and lifts it to a probability through P (u | e); PN, PS, and PNS appear nowhere in the construction. PCI generalises PN and PS directly: the necessity factor Y n is the counterfactual operation underlying PN, the sufficiency factor Y s is the counterfactual operation underlying PS, both indexed by the cause–witness–alternative–noise tuple, with Γ and ∆ exposing the design choices PN/PS makes implicitly. So Pearl’s Def. 10.3.5 and PCI are not competing implementations of the same idea: they inherit from different parts of Pearl’s own toolkit, with PCI playing the role of a context-sensitive, multi-variable extension of the PN/PS machinery rather than a probabilistic wrapper around AC. Pearl’s Def. 10.3.5 and PCI share the same explanatory target, probabilistic responsibility built on top of structural information, but instantiate it through different mechanisms. Pearl’s definition averages a binary AC indicator against a posterior over noise; PCI integrates a continuous necessity– sufficiency kernel against a joint distribution over suspect sets, witness sets, alternative values, and noise. The basic desert traveller shows the two agree on ranking with PCI providing graded magnitudes; the weak-poison variant shows three intuitions that PCI’s graded reading captures and Pearl’s binary indicator structurally cannot. That actual causation admits of degrees is not itself new: Halpern and Hitchcock [2015] already make it graded and context-sensitive through defaults and normality. That account delivers an ordinal, comparative verdict, whereas PCI supplies a cardinal probabilistic magnitude on the same structural information. The cases where sufficiency does even more graded work (the continuous signal-mediation walkthrough of Section 5.2, the synthetic archetypes of Appendix D, and the SIR benchmark of Appendix G) are where these constructions answer recognisably different questions; for the high-dimensional, continuous, machine-learned models this paper targets, PCI’s is the question that remains tractable and well-defined.

54

7.6

Other probabilistic extensions of actual causation

Pearl’s probability of causation is not the only probabilistic reading of the Halpern–Pearl definition. Fenton-Glynn [2017] proposes a probabilistic extension that keeps HP’s witness/contingency machinery intact but replaces the deterministic counterfactual-dependence clause with a probabilityraising condition: with the off-path variables W pinned at their actual values w⋆ , the cause C = c qualifies when intervening to set it raises the probability of the outcome relative to an alternative c′ , P (φ | do(C = c), W = w⋆ ) > P (φ | do(C = c′ ), W = w⋆ ), required to hold for every subset of the on-path mediators held at their factual values. Fang [2022] modifies this in turn, replacing the interventional probability-raising with a counterfactual one (conditioning on the actual situation rather than intervening afresh) which repairs the verdicts Fenton-Glynn’s account returns on voting, trumping, and overdetermination cases. Both are close neighbours of PCI, and the contrast is worth drawing precisely. First, each probabilifies only the necessity side of HP: it raises or conditions a probability of the witnessed-necessity test, with no analogue of PCI’s sufficiency component, the Y s factor of Definition 18, which asks whether restoring the factual cause sustains the outcome. Second, the contingency enters differently. Fenton-Glynn fixes the witness W deterministically at its actual values and quantifies universally over the mediator subsets (picking the alternative c′ existentially); PCI replaces those quantifiers with distributions (a Γ-weighted expectation over which suspects and witnesses to activate, and an alternative-value distribution ∆), both presented as user-facing knobs and approximated by Monte Carlo rather than enumerated. Third, PCI integrates a continuous necessity–sufficiency kernel where those accounts threshold a binary actual-cause indicator. PCI is therefore not a third probabilistic-HP variant but a PN/PS-style necessity-and-sufficiency measure that contains the witnessed-necessity test they probabilify as one regime: the actual-causality analogue of the contrast drawn just above with Pearl. These accounts have begun to see applied use. Maldonado et al. [2025] instantiate Fenton-Glynn’s definition in a robot-pouring task, learning the causal graph by discovery and the conditional distributions with neural networks, and use it to identify the cause of spillage and to select a corrective action, searching by hand over contrastive values and a probability threshold for an alternative that would avert the outcome. That search is precisely the alternative-value reasoning PCI packages into ∆ and a causal-impact threshold, and it inherits the differences just drawn: it remains necessity-only, with no sufficiency check, and it fixes the contingency rather than averaging over it. The application is nonetheless evidence that tractable probabilistic actual causation is in demand in exactly the ML-driven settings PCI targets. Necessity and sufficiency as an XAI method. Closer to the ML audience’s likely prior exposure, Watson et al. [2021] adapt Pearl’s PN/PS directly into a local explanation method for black-box classifiers: given a specified causal structure over input features, they define probabilistic necessity and sufficiency scores for a feature (or feature subset) with respect to a model’s prediction, and use them to generate minimal sufficient explanations and necessary-feature rankings, benchmarked against LIME, Anchors, and SHAP-style attributions. The relation to PCI is close in spirit to the relation with Fenton-Glynn and Fang drawn above: both build directly on Pearl’s PN/PS rather than Halpern–Pearl’s witnessed-necessity machinery, and neither packages the witness set as a userfacing, Γ-sampled search dimension the way PCI does; unlike PCI, Watson et al.’s method targets model explanation specifically (attributing a classifier’s prediction) rather than causal responsibility attribution for a realized outcome in a structural model, the distinction drawn in Section 3’s discussion of SHAP and Causal SHAP. Continuous and vector-valued PNS. Kawakami et al. [2024] extend Tian and Pearl’s binary PNS, PN, and PS to continuous and vector-valued treatments and outcomes, defining necessity and sufficiency via an order relation on the outcome space (Yx0 < y ≤ Yx1 for a threshold y) rather than a fixed binary event. Under exogeneity together with a monotonicity assumption, they identify PNS, PN, and PS nonparametrically from observational distributions alone, with no need for a fitted causal model. They offer several monotonicity variants and identify under one stated on the potential outcomes themselves. That is a genuine extension to continuous domains, but it inherits Tian and Pearl’s population-level framing: their PNS asks how often a random individual’s outcome crosses an externally chosen threshold under two treatment levels, not whether this instance’s already-realized outcome depended on this instance’s cause, which is the single-case reading of PN/PS [Pearl, 2022]

55

that PCI builds on. Like ATE and CATE, it also has no analogue of the witness mechanism, so it cannot hold mediators fixed at their factual values and register preemption. PCI reaches the same domains by a different route, and the difference starts in the definition. Definition 3.1 fixes a contrast pair (x0 , x1 ) and a threshold y, so a single inequality settles necessity and sufficiency. PCI puts an alternative-value distribution ∆ where the fixed contrast was, and a user-chosen impact kernel ci where the threshold was. One construction then yields a continuous necessity–sufficiency pair rather than a binarised event. Monotonicity drops out too: PCI evaluates both counterfactual worlds inside a fitted model, which supplies the cross-world quantities by simulation and asks nothing of the observational distribution. The burden moves onto that model. Kawakami et al. buy identification with restrictions on the true system; PCI buys it by assuming the fitted model is that system, which for flexible structural equations such as neural networks is the harder warrant (Section 8). The witness mechanism then supplies the context-sensitivity their population-level framing forfeits. FANS and LEWIS. Two recent attribution methods also build on Pearl’s probabilities of necessity and sufficiency, bringing them closer still to PCI. FANS [Chen et al., 2024] explains a prediction by searching a small region around the input for the largest PNS attainable there, estimating counterfactual probabilities by resampling. LEWIS [Galhotra et al., 2021] works from a causal graph and input–output data, computing necessity, sufficiency, and combined scores for a black-box decision at the population or subgroup level, and turns them into recourse. Both are well suited to their stated aims and share our starting point that attribution is a probability of causation. They differ from PCI on four design choices, each reflecting our narrower focus on token-level, context-sensitive attribution when a full model is available. First, we keep necessity and sufficiency apart. FANS combines them into a single PNS number and LEWIS reports them as separate population averages, whereas PCI carries both as a joint pair (Y s , Y n ) and applies the user’s impact function ci only afterwards. As the synthetic models of Appendix D illustrate, a cause can be necessary without being sufficient, or the reverse, and keeping the two components together lets a single sweep tell these archetypes apart. Second, we average rather than optimise for a best case. FANS reports the maximum PNS over the local regions it searches and uses gradient-based optimisation to extract the single feature subset with the highest PNS; LEWIS scores individual attributes or a user-specified set. PCI averages instead: the selection distribution Γ samples suspect sets within a chosen cardinality band, so a feature’s responsibility reflects its participation across many sets rather than its most favourable one, with the Shapley kernel arising as a special case. Third, we use witnesses where FANS uses a local region and LEWIS a population average. When two causes overdetermine an outcome, or one acts only through a mediator, recovering the intended verdict means holding the inactive path fixed at its factual value, which a ball around the input cannot express and a population average smooths over. PCI holds witness variables W fixed and averages over which variables serve as witnesses, as the OBCB and signal walkthroughs of Section 5 illustrate. Fourth, we compare against a distribution of alternatives. FANS measures change from one baseline input and LEWIS from one contrast value; PCI averages over an alternative-value distribution ∆, removing the dependence on a chosen reference at the cost of assuming more of the model. That cost is a deliberate trade: LEWIS recovers its scores from a graph and observational data at the population level; PCI assumes a fully specified model and returns a value for the individual case. Probabilistic versus nondeterministic models. PCI lives in a probabilistic world: we push all the indeterminism into the exogenous noise U, so that once a noise value u is fixed the mechanisms are ordinary functions, each necessity or sufficiency question becomes a plain interventional expectation, and we average those over PU . Beckers [2025] takes a different route out of determinism. His nondeterministic causal models let a mechanism return a set of admissible values rather than a single one, with no probabilities attached, and he reads actual causation off two modalities: a cause must make a difference if it does so in every admissible resolution, and might make one if it does so in some. He notes in passing that this brings the logical and probabilistic pictures of causation closer together than they are in the deterministic case, since the order-of-operations distinction that matters for Pearl’s probabilities of counterfactuals resurfaces here as a distinction between these two modalities.

56

It is tempting to read the two pictures as lining up, though we do not try to make this precise. If one were to turn a nondeterministic mechanism into a probabilistic one, by placing some full-support distribution over its admissible values, then might would seem to answer to “the outcome changes with positive probability” and must to “the outcome changes with probability one.” On that reading the modal verdict would depend only on which alternatives are possible and not on how they are weighted, so any full-support choice (the uniform one being the most agnostic) would give the same yes-or-no answer, with a graded score like PCI’s filling in the range between. Where genuine probabilities are not on hand, the modal account is the natural tool and PCI has nothing to add; where they are, PCI trades the bare list of possibilities for a plausibility-weighted magnitude. We mention this only to locate the two frameworks relative to one another, not to claim a correspondence. 7.7

Actual-causality-adjacent quantities

The actual-causality tradition has accumulated a family of named quantities beyond causation itself. Chockler and Halpern [2004] introduce degree of responsibility and degree of blame; Halpern [2016] develops causal explanation and explanatory power at book length, and Beckers [2022] recasts both for explainable AI; Beckers [2021b] and Beckers [2021a] reconstruct causation through causal sufficiency and a counterfactual NESS condition; and Beckers et al. [2022] define harm, with Beckers et al. [2023] adding its graded refinement and Beckers [2023] an allied account of moral responsibility. Each comes with its own definitional apparatus (a counterfactual test, a minimisation over contingencies, an averaging over an agent’s epistemic state, or a stipulated baseline), and the relations among them remain largely implicit. We conjecture that most of these are not independent primitives but reparametrisations of the single counterfactual contrast that PCI already makes explicit; or, where a control is missing, notions that fold into the same framework by an appropriate generalisation, mutatis mutandis. The construction of Section 3 carries a small number of user-facing knobs: the variable selection distribution Γ (which and how many suspects enter a candidate cause set C), the witness set T (which context a user holds fixed, in the contingency sense of Halpern, 2016), the alternative value distribution ∆ (what counts as a counterfactual departure, equivalently the default against which PCI grades alternatives), the causal impact function ci (how PCI scores a sufficiency–necessity pair, Definition 19), and the exogenous law PU (what PCI averages the attribution over). Read against these knobs, the named quantities look like settings rather than rivals. Actual causation in the sense of Halpern [2016] is the necessity component at a single-suspect Γ with witnesses admitted; the causal explanation of Halpern [2016] (a context that, given what the agent already takes for granted, makes the cause necessary) is recovered in intent by the held-fixed witness configuration T together with the marginalisation over PU that stands in for the agent’s epistemic state; the sufficient and counterfactual explanations of Beckers [2022] are organised around a held-fixed witness that coincides with PCI’s witness set T; both descend from Halpern’s modified definition. His additional safeguarded network (variables protected from intervention, as opposed to held at their factual values) is not among the present knobs, and would enter only as a natural generalisation, a set safeguarded from intervention alongside the witnesses held at factual values. Where he rates an explanation only as good or not (non-domination, i.e. minimality), a ci on the necessity–sufficiency differential of Definition 18 would supply a graded refinement rather than recover an existing measure; the degree of blame of Chockler and Halpern [2004] is the same attribution marginalised over a prior on models alongside PU , with their degree of responsibility its single-model special case; the harm of Beckers et al. [2022] and Beckers et al. [2023] is PCI under a ∆ pinned to a default contract together with a utility-valued ci; and the causal sufficiency of Beckers [2021b] is the sufficiency regime itself, the necessity of Xk within a sufficient set C. The limits of the reframing. Each notion’s specific convention, the 1/(N +1) responsibility weight of Chockler and Halpern [2004],26 the all-or-nothing causation threshold, the non-domination criterion that rates an explanation only good or not [Halpern, 2016, Beckers, 2022], or the stipulated default in the harm contrast of Beckers et al. [2022], encodes a deliberate modelling commitment suited to that work’s aims, summarising a graded, model-relative phenomenon under a single label. PCI retains the underlying graded probability and relocates each of these to an explicit downstream 26

That this particular weight reflects a modelling choice rather than a necessity has precedent: Salimi et al. [2016], applying Chockler–Halpern responsibility to database query answering, found the 1/(N +1) measure gave unintuitive rankings in their setting and replaced it with a graded causal-effect measure that, they argue, recovers the intended results.

57

choice: a cardinality band in Γ, a threshold on ci, a prior over models, a particular ∆. On this view the named quantities are complementary readings of one underlying measure, a vantage point on the original constructions rather than a shortcoming in them. We state this only as a conjecture and do not develop it here. We raise it because the knobs we introduced to separate necessity from sufficiency appear, prima facie, to be the degrees of freedom along which the quantities of Chockler and Halpern [2004], Halpern [2016], and Beckers [2021b], Beckers et al. [2022] themselves vary. We leave a full accounting to future work. Sections 6–7 have laid out the formal relation between PCI and actual causality and its Pearlian probabilistic wrapper, completing the comparative story previewed in Section 4: a claim-by-claim comparison against feature-attribution baselines, the Differential Causal Effect, exact actual-cause enumeration, a continuous dynamical model, and a deployed valuation system, with the full protocols collected in the appendices. Section 8 closes the paper.

8

Discussion and Conclusions

We can now state the main differences between PCI and the two approaches that inspired it, against the background of what the rest of the paper has shown. The main lesson from the literature on actual causality is that intuitive causal attribution often requires holding some endogenous variables, members of a “witness set”, fixed at their factual values. This ensures context sensitivity by controlling complicating causal paths. We treat witnesses differently: instead of looking for a single witness set that reveals a causal relationship, we use a distribution over witness sets and integrate the causal impact score across them, which lets PCI account for the number of witness sets and the strength of within-witness-set effects. The construction also admits off-the-shelf probabilistic inference, avoiding worst-case subset enumeration. The relationship between the two views P is now formal where it was once gestural: under matching choices of Γ and ∆, the support of T Φ coincides with factivity and context-sensitive necessity (Theorems 26–27), and a subset-minimality filter over that support recovers AC verdicts exactly (Proposition 32); the empirical companion in Appendix F confirms this at scales where AC enumeration is intractable. The main concept borrowed from Pearl’s probability of necessity and sufficiency is the joint distribution over outcomes from two interventional regimes, pushed forward through a user-chosen causal impact function. The difference is that we use witness sets to allow for context-sensitivity and to break symmetries present in otherwise pathological cases like overdetermination and undercutting. Section 5 works through the binary instantiation in which the necessity and sufficiency components coincide with PN and PS, and Appendix D reads the two components apart on a continuous synthetic model where each is needed to bring out a different causal archetype. The further generalisations are mostly bookkeeping in the same spirit: a single alternative value for a potential cause becomes a factual-excised alternative-value distribution we integrate over, which generalises immediately to continuous variables; asking whether a particular set is an actual cause becomes sampling suspect sets and gauging a feature’s responsibility by its participation in sets with causal impact; and asking whether the outcome differs becomes measuring how much, via a customisable causal impact function ci that reads differences across counterfactual worlds, including between continuous variables. The variable-selection distribution Γ, the alternative-value distribution ∆, and the impact function ci become explicit, user-facing components of the framework, no longer implicit defaults. Against SHAP-family attributions, the framework’s central commitment is to intervention with witnesses over observational marginalisation. The controlled comparisons of Section 5 show that this commitment does real work on canonical overdetermination and continuous-mediation examples, where SHAP and Causal SHAP fail in characteristic ways that PCI avoids. The synthetic benchmark of Appendix D confirms this on a model with known ground truth, and the case study of Appendix H reports the same qualitative pattern on a production-grade trained model with millions of data points. A separate comparison to gradient-based attribution, where the difference is one of differentiability and locality, as distinct from the causal/non-causal axis, is reported in Appendix E. The thread connecting these results is structural: the witness mechanism that satisfies D-A-rank for Alice in the binary OBCB walkthrough of Section 5 is the same machinery driving the upstreamversus-downstream attribution split on the AVM in Appendix H.

58

A broader test is how PCI fares against the desiderata that the XAI literature typically asks counterfactual-explanation methods to meet, of which Verma et al. [2024] list five. Sparsity, the requirement that explanations change as few features as possible, follows directly from the cardinality cap on suspect sets in Γ, which biases the search toward small C. Multiple counterfactuals, the ability to return several alternative explanations, falls out of the Monte Carlo construction: a single sweep over Γ and ∆ produces a population of (C, c′ , T) triples. Causal-constraint satisfaction, the demand that explanations respect downstream propagation rather than treat features as independently editable, is automatic once suspect interventions are routed through the causal model: changing C propagates to descendants by construction. Model-agnosticism (applicability to arbitrary predictors), PCI satisfies only partially: it can wrap a black-box predictor, but at the cost of the causal sensitivity that motivates the framework in the first place. We part company with the literature on actionability, the requirement that explanations not recommend changes to features users cannot in practice change. The standard recommendation is to fold ease-of-change into the cause-identification procedure itself, weighting features by mutability so that immutable ones are never returned as causes (Verma et al. [2024]; cf. Karimi et al. [2021], who shift the focus from explanations altogether to interventions). We think this conflates two distinct questions. A procedure that suppresses gender as a possible cause whenever a loan decision is at stake will help applicants satisfy the existing system without surfacing the kind of structural problem that responsibility attribution can in principle reveal. Cost-of-action layers can sit downstream of PCI for users who need actionable recommendations, but they should compose with responsibility attribution instead of replacing it. Set against that favourable comparison, several limitations temper the picture. PCI presumes access to a trained probabilistic causal model from which it can sample counterfactual outcomes, a stronger requirement than methods that work from observational data and a causal graph alone. It also inherits whatever error is in that model: a misspecified structural equation or noise distribution yields systematically wrong attributions, with nothing in the construction to flag this from the scores alone, since PCI evaluates counterfactuals under the model the user supplies, without checking that model against data. The Monte Carlo variance of the estimator grows with model size and with the cardinalities of suspect and witness sets; Appendix F reports empirical scaling and an ablation that isolates the contribution of witness pinning. In the worst case, a single revealing witness set among 2|W| candidates under uniform Γw costs as many samples in expectation as exhaustive enumeration would. The escape is that pinning a variable that is causally inert under the tested intervention is a no-op, so revealing witness sets come in neighbourhoods of size 2m for m such inert candidates, giving revealing mass at least 2m−|W| rather than 2−|W| . Whether this rescues sampling generically, or only in graphs sparse relative to the tested intervention, is a sharper open question than we have characterised here. A Γ built from the graph, weighting witness candidates by their relevance to the tested intervention, would exploit exactly this sparsity, but building it requires the graph’s relevance structure to be legible in the first place, which trades away desideratum (iii)’s reach into grey-box models where structural facts are not cheaply available. Exposing Γ, ∆, and ci as userfacing choices is also a burden: a practitioner with no strong prior view on which suspect sets or alternative values are plausible has nothing principled to fall back on, and a bad choice can silently shift which variables the score favours, with no signal in the output that anything went wrong. Choosing S and W in practice. Every worked example in this paper hand-picks the suspect and witness pools with full knowledge of the model’s structure, which is not available to a practitioner starting from a large learned PSCM. Our default recommendation: take S to be whichever variables are under live consideration as candidate causes for the question at hand (the same choice a practitioner would have to make for but-for testing or SHAP alike), and take W to be all remaining endogenous non-outcome variables not already in S, i.e. every variable Definition 5’s witness pool could legally contain. This costs the most sampling (Appendix F quantifies the resulting variance), but it never silently suppresses a genuine cause by omitting a witness that would have revealed it, since the joint Γ marginalises over which subset of W is actually pinned on each draw rather than committing to one witness set up front. The failure mode to watch for is the opposite direction: if S itself omits a variable that mediates between two included suspects, PCI cannot detect that mediation (it can only witness against it), so a practitioner who suspects an omitted mediator should move it into S, not W, and compare the two runs directly, exactly as Section 5.1’s Option B does for check -failed . When sampling cost makes the full-W default impractical, restricting W to variables structurally downstream of S and upstream of Y (candidate mediators and confounding paths) is the 59

next-cheapest defensible choice, since variables off every S → Y path are causally inert witnesses whose pinning or freeing cannot change any counterfactual outcome (Section 8’s sampling-cost discussion above formalises why inert witnesses are cheap to average over rather than enumerate). Finally, we deliberately limited what the AVM case study discloses: the apples-to-apples SHAP-vsPCI comparison rests on the synthetic benchmark of Appendix D, with the production model serving as a feasibility witness, not as quantitative evidence. PCI provides a context-sensitive causal explanation method for causal probabilistic machinelearning models that stays tractable, at the sampling cost discussed above, past the point where exact actual-causality enumeration does not (Appendix F). It arrives at this as a natural probabilistic generalisation of ideas already in the literature, yielding an estimator that pairs with standard inference algorithms. We benchmarked it against exact actual-causality computations, characterised its qualitative behaviour on synthetic models with known ground truth and on canonical SHAP failure cases, and demonstrated computational feasibility on a production-grade model. This estimator also sits within a longer line of efforts to mechanise actual-causality reasoning in software: the Actual Causality Canvas of Ibrahim et al. [2020] and the SAT- and optimizationbased computations of Ibrahim and Pretschner [2020] operationalise the Halpern–Pearl definition for forensic investigation, fault diagnosis, and explainable AI; those tools are built for discrete (typically binary) structural models, where the actual cause is recovered by combinatorial search over candidate sets. The complementary regime of large, continuous-valued models has received less attention, and it is there that the exact notions become harder to apply directly. PCI targets exactly that regime, turning approximate causal attribution into something workable for users of models of non-trivial size, with Γ, ∆, and ci exposed as knobs for the user to set rather than defaults buried in the implementation. The same mechanisation goal motivates a parallel literature in databases, where responsibility and causal-effect measures explain query answers over relational data rather than outcomes of a structural causal model (surveyed by Bertossi, 2023; Salimi et al., 2016, already noted in Section 7, is one instance). In that vocabulary, PCI’s witness-integrated score is a graded, model-relative responsibility measure of the same family, specialised to probabilistic structural causal models.

References Natasha Alechina, Joseph Y. Halpern, and Brian Logan. Causality, responsibility and blame in team plans. In Proceedings of the 16th International Conference on Autonomous Agents and Multiagent Systems (AAMAS), pages 1091–1099, 2017. Alexander Balke and Judea Pearl. Probabilistic evaluation of counterfactual queries. In Proceedings of the Twelfth AAAI National Conference on Artificial Intelligence (AAAI), pages 230–237, 1994. Sander Beckers. The counterfactual NESS definition of causation. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 6210–6217, 2021a. doi: 10.1609/aaai. v35i7.16772. Sander Beckers. Causal sufficiency and actual causation. Journal of Philosophical Logic, 50:1341– 1374, 2021b. doi: 10.1007/s10992-021-09601-z. Sander Beckers. Causal explanations and XAI. In Proceedings of the First Conference on Causal Learning and Reasoning (CLeaR), volume 177 of PMLR, pages 90–109, 2022. Sander Beckers. Moral responsibility for AI systems. In Advances in Neural Information Processing Systems (NeurIPS), volume 36, 2023. Sander Beckers. Actual causation and nondeterministic causal models. In Proceedings of the Fourth Conference on Causal Learning and Reasoning (CLeaR), volume 275 of PMLR, pages 514–532, 2025. Sander Beckers and Joost Vennekens. Combining probabilistic, causal, and normative reasoning in CP-logic. ArXiv, abs/1503.01051, 2015. Sander Beckers and Joost Vennekens. The transitivity and asymmetry of actual causation. Ergo, 4 (1):1–27, 2017. doi: 10.3998/ergo.12405314.0004.001. 60

Sander Beckers and Joost Vennekens. A principled approach to defining actual causation. Synthese, 195(2):835–862, 2018. doi: 10.1007/s11229-016-1247-1. Sander Beckers, Hana Chockler, and Joseph Y. Halpern. A causal analysis of harm. In Advances in Neural Information Processing Systems (NeurIPS), volume 35, 2022. Sander Beckers, Hana Chockler, and Joseph Y. Halpern. Quantifying harm. In Proceedings of the Thirty-Second International Joint Conference on Artificial Intelligence (IJCAI), pages 363–371, 2023. doi: 10.24963/ijcai.2023/41. Leopoldo Bertossi. Attribution-scores in data management and explainable machine learning, 2023. Paper associated with a tutorial at ADBIS 2023. K. Butler, G. Feng, and P. M. Djurić. A differential measure of the strength of causation. IEEE Signal Processing Letters, 29:2208–2212, 2022. Xuexin Chen, Ruichu Cai, Zhengting Huang, Yuxuan Zhu, Julien Horwood, Zhifeng Hao, Zijian Li, and José Miguel Hernández-Lobato. Feature attribution with necessity and sufficiency via dualstage perturbation test for causal explanation. In Proceedings of the 41st International Conference on Machine Learning (ICML), volume 235 of Proceedings of Machine Learning Research. PMLR, 2024. Paul Cheshire and Stefano Magrini. Growing urban gdp or attracting people? different causes, different consequences. In Charlie Karlsson, Aåke E. Andersson, Paul C. Cheshire, and Roger R. Stough, editors, New Directions in Regional Economic Development, Advances in Spatial Science, pages 291–315. Springer, Berlin, Heidelberg, 2009. ISBN 978-3-642-01016-3, 978-3-64201017-0. doi: 10.1007/978-3-642-01017-0 16. H. Chockler and J. Y. Halpern. Responsibility and Blame: A Structural-Model Approach. Journal of Artificial Intelligence Research, 22:93–115, October 2004. ISSN 1076-9757. doi: 10.1613/ jair.1391. Jacob Cohen. Statistical Power Analysis for the Behavioral Sciences. Lawrence Erlbaum Associates, Hillsdale, NJ, 2nd edition, 1988. Thomas Eiter and Thomas Lukasiewicz. Complexity results for structure-based causality. Artificial Intelligence, 142(1):53–89, November 2002. ISSN 00043702. doi: 10.1016/S0004-3702(02) 00271-0. Jingzhi Fang. On probabilistic reasoning of actual causation. Doctoral thesis, Lingnan University, Hong Kong, 2022. Retrieved from https://commons.ln.edu.hk/otd/155/. Luke Fenton-Glynn. A proposed probabilistic extension of the halpern and pearl definition of ?actual cause? British Journal for the Philosophy of Science, 68(4):1061–1124, 2017. doi: 10.1093/bjps/ axv056. Meir Friedenberg and Joseph Y. Halpern. Blameworthiness in multi-agent settings. In Proceedings of the Thirty-Third AAAI Conference on Artificial Intelligence (AAAI), 2019. Sainyam Galhotra, Romila Pradhan, and Babak Salimi. Explaining black-box algorithms using probabilistic contrastive counterfactuals. In Proceedings of the 2021 ACM SIGMOD International Conference on Management of Data, 2021. Tobias Gerstenberg and David A. Lagnado. Spreading the blame: The allocation of responsibility amongst multiple agents. Cognition, 115(1):166–171, 2010. doi: 10.1016/j.cognition.2009.12. 011. Paul Gustafson. Bayesian Inference for Partially Identified Models: Exploring the Limits of Limited Data. Monographs on Statistics and Applied Probability. Chapman and Hall/CRC, 2015. Ned Hall. Two concepts of causation. In John Collins, Ned Hall, and L. A. Paul, editors, Causation and Counterfactuals, pages 225–276. MIT Press, 2004.

61

Joseph Y. Halpern. A modification of the Halpern–Pearl definition of causality. In Proceedings of the 24th International Joint Conference on Artificial Intelligence (IJCAI), pages 3022–3033, 2015. Joseph Y. Halpern. Actual Causality. The MIT Press, 2016. ISBN 9780262035026. URL http: //www.jstor.org/stable/j.ctt1f5g5p9. Joseph Y. Halpern and Christopher Hitchcock. Graded causation and defaults. British Journal for the Philosophy of Science, 66(2):413–457, 2015. doi: 10.1093/bjps/axt050. Joseph Y. Halpern and Max Kleiman-Weiner. Towards formal definitions of blameworthiness, intention, and moral responsibility. In Proceedings of the Thirty-Second AAAI Conference on Artificial Intelligence (AAAI), 2018. James J. Heckman and Rodrigo Pinto. The econometric model for causal policy analysis. Annual Review of Economics, 14(1):893–923, 2022. doi: 10.1146/annurev-economics-051520-015456. URL https://doi.org/10.1146/annurev-economics-051520-015456. James Hensman, Nicolò Fusi, and Neil D Lawrence. Gaussian processes for big data. In Proceedings of the Twenty-Ninth Conference on Uncertainty in Artificial Intelligence, pages 282–290, 2013. Tom Heskes, Evi Sijben, Ioan Gabriel Bucur, and Tom Claassen. Causal Shapley values: Exploiting causal knowledge to explain individual predictions of complex models. In Advances in Neural Information Processing Systems, volume 33, pages 4778–4789, 2020. Christopher Hitchcock and Joshua Knobe. Cause and norm. The Journal of Philosophy, 106(11): 587–612, 2009. doi: 10.5840/jphil20091061128. Amjad Ibrahim and Alexander Pretschner. From checking to inference: Actual causality computations as optimization problems. In Automated Technology for Verification and Analysis (ATVA), volume 12302 of Lecture Notes in Computer Science. Springer, 2020. Amjad Ibrahim, Tobias Klesel, Ehsan Zibaei, Severin Kacianka, and Alexander Pretschner. Actual causality canvas: A general framework for explanation-based socio-technical constructs. In Proceedings of the 24th European Conference on Artificial Intelligence (ECAI), volume 325 of Frontiers in Artificial Intelligence and Applications, pages 2978–2985. IOS Press, 2020. doi: 10.3233/FAIA200472. Thomas F. Icard, Jonathan F. Kominsky, and Joshua Knobe. Normality and actual causal strength. Cognition, 161:80–93, April 2017. ISSN 00100277. doi: 10.1016/j.cognition.2017.01.010. Dominik Janzing, Lenon Minorics, and Patrick Blöbaum. Feature relevance quantification in explainable AI: A causal problem. In International Conference on Artificial Intelligence and Statistics (AISTATS), volume 108 of PMLR, pages 2907–2916, 2020. Amir-Hossein Karimi, Bernhard Schölkopf, and Isabel Valera. Algorithmic recourse: from counterfactual explanations to interventions. In Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency, FAccT ’21, page 353–362. ACM, March 2021. doi: 10.1145/3442188.3445899. URL http://dx.doi.org/10.1145/3442188.3445899. Yuta Kawakami, Manabu Kuroki, and Jin Tian. Probabilities of Causation for Continuous and Vector Variables. In Negar Kiyavash and Joris M. Mooij, editors, Proceedings of the Fortieth Conference on Uncertainty in Artificial Intelligence, volume 244 of Proceedings of Machine Learning Research, pages 1901–1921. PMLR, July 2024. John K. Kruschke. Rejecting or accepting parameter values in Bayesian estimation. Advances in Methods and Practices in Psychological Science, 1(2):270–280, 2018. doi: 10.1177/ 2515245918771304. David Lewis. Causation. The Journal of Philosophy, 70(17):556–567, 1973. Scott M Lundberg and Su-In Lee. A unified approach to interpreting model predictions. In Advances in Neural Information Processing Systems, volume 30, pages 4765–4774, 2017.

62

Jaime Maldonado, Jonas Krumme, Christoph Zetzsche, Vanessa Didelez, and Kerstin Schill. Robot pouring: Identifying causes of spillage and selecting alternative action parameters using probabilistic actual causation. Frontiers in Cognition, 4:1565059, 2025. doi: 10.3389/fcogn.2025. 1565059. Charles F. Manski. Partial Identification of Probability Distributions. Springer Series in Statistics. Springer, 2003. Hyungsik Roger Moon and Frank Schorfheide. Bayesian and frequentist inference in partially identified models. Econometrica, 80(2):755–782, 2012. doi: 10.3982/ECTA8360. Scott Mueller, Ang Li, and Judea Pearl. Causes of effects: Learning individual responses from population data. In Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence (IJCAI), pages 2712–2718, 2022. doi: 10.24963/ijcai.2022/376. Robert Osazuwa Ness. Causal AI. Manning Publications, 2025. Konstantinos Papageorgiou, Theodosios Theodosiou, Aikaterini Rapti, Elpiniki I. Papageorgiou, Nikolaos Dimitriou, Dimitrios Tzovaras, and George Margetis. A systematic review on machine learning methods for root cause analysis towards zero-defect manufacturing. Frontiers in Manufacturing Technology, Volume 2 - 2022, 2022. ISSN 2813-0359. doi: 10.3389/fmtec.2022. 972712. URL https://www.frontiersin.org/journals/manufacturing-technology/ articles/10.3389/fmtec.2022.972712. L. A. Paul and Ned Hall. Causation: A User’s Guide. Oxford University Press, 2013. Judea Pearl. Probabilities of causation: Three counterfactual interpretations and their identification. Synthese, 121(1–2):93–149, 1999. doi: 10.1023/A:1005233831499. Judea Pearl. Causality: Models, Reasoning and Inference. Cambridge University Press, USA, 2nd edition, 2009. ISBN 052189560X. Judea Pearl. Probabilities of causation: three counterfactual interpretations and their identification. In Probabilistic and Causal Inference: The Works of Judea Pearl, pages 317–372. 2022. Dale J. Poirier. Revising beliefs in nonidentified models. Econometric Theory, 14(4):483–509, 1998. doi: 10.1017/S0266466698144043. Thomas S. Richardson, Robin J. Evans, and James M. Robins. Transparent parametrizations of models for potential outcomes. In Bayesian Statistics 9, pages 569–610. Oxford University Press, 2011. Donald B. Rubin. Bayesian inference for causal effects: The role of randomization. The Annals of Statistics, 6(1):34–58, 1978. doi: 10.1214/aos/1176344064. Babak Salimi, Leopoldo Bertossi, Dan Suciu, and Guy Van den Broeck. Quantifying causal effects on query answering in databases. In Proceedings of the 8th USENIX Workshop on the Theory and Practice of Provenance (TaPP), 2016. Lloyd S. Shapley. A value for n-person games. In Harold W. Kuhn and Albert W. Tucker, editors, Contributions to the Theory of Games, Volume II, volume 28 of Annals of Mathematics Studies, pages 307–317. Princeton University Press, Princeton, 1953. Amit Sharma, Hua Li, and Jian Jiao. The counterfactual-Shapley value: Attributing change in system metrics. arXiv preprint arXiv:2208.08399, 2022. Daisy A. Shepherd, David J. Amor, and Margarita Moreno-Betancur. Statistical analysis of observational studies in disability research. Developmental Medicine & Child Neurology, 66(11): 1408–1418, 2024. doi: 10.1111/dmcn.15948. Jan Sprenger. Foundations of a probabilistic theory of causal strength. The Philosophical Review, 127(3):371–398, 2018. doi: 10.1215/00318108-6718797. Jin Tian and Judea Pearl. Probabilities of causation: Bounds and identification. Annals of Mathematics and Artificial Intelligence, 28(1–4):287–313, 2000. doi: 10.1023/A:1018912507879. 63

Michalis Titsias. Variational learning of inducing variables in sparse Gaussian processes. In Artificial Intelligence and Statistics, pages 567–574. PMLR, 2009. Sahil Verma, Varich Boonsanong, Minh Hoang, Keegan Hines, John Dickerson, and Chirag Shah. Counterfactual explanations and algorithmic recourses for machine learning: A review. ACM Computing Surveys, 56(12):1–42, 2024. Yixin Wang and Michael I. Jordan. Desiderata for representation learning: A causal perspective, 2021. David S. Watson, Limor Gultchin, Ankur Taly, and Luciano Floridi. Local explanations via necessity and sufficiency: unifying theory and practice. In Proceedings of the Thirty-Seventh Conference on Uncertainty in Artificial Intelligence, volume 161 of Proceedings of Machine Learning Research, pages 1382–1392. PMLR, 2021. Kevin Xia, Yushu Pan, and Elias Bareinboim. Neural causal models for counterfactual identification and estimation. In International Conference on Learning Representations (ICLR), 2023. arXiv:2210.00035. Junzhe Zhang, Jin Tian, and Elias Bareinboim. Partial counterfactual identification from observational and experimental data. In Proceedings of the 39th International Conference on Machine Learning, volume 162 of Proceedings of Machine Learning Research, pages 26548–26558. PMLR, 2022.

A

Computations for the OBCB Running Example

This appendix collects the worked computations for the stochastic OBCB model of Example 6 that the main text summarises: the per-branch traces behind Alice’s individual PN and PS values in Table 2 (Section 2), and the closed-form SHAP value function behind Tables 6–7 (Section 5.1). We obtain the remaining individual and population entries of Table 2 analogously; the notebook obcb_computations reproduces all values. A.1

Alice’s probability of necessity

Alice is factually gender = female, credit = bad, loan = F ; the counterfactual intervenes to set gender = male while leaving credit = bad. Tracing through the model: • Under the intervention, check ∼ Bern(0.9): men are checked 90% of the time. • If checked, check -failed = 1 (Alice’s credit is bad), and from the loan-probability table P (loan-if -checked = 1 | gender = male, check -failed = 1) = 0.05. • If not checked, loan = 0 deterministically since loan = loan-if -checked · check . Combining the two branches: PN (gender = female, loan = F | Alice) = P (loan gender =male = T | gender = female, credit = bad) = 0.9 · 0.05 = 0.045. A.2

Alice’s probability of sufficiency

Following the same convention as for PN , the individual-level computation additionally conditions on Alice’s credit (credit = bad). The PS conditional then has Alice’s credit fixed but the cause and outcome flipped to their non-factual values (gender = male, loan = T ); we intervene to restore gender = female and ask whether the loan is again denied: • With gender = female and credit = bad, check ∼ Bern(0.2) unconditionally; but PS conditions on gender = male, loan = T , which (since loan = T forces check = 1) restricts Ucheck to the region compatible with check = 1 under gender = male, measure 0.9. Under the twin-network coupling of Footnote 12 (both worlds share Ucheck , 64

so check = 1 iff Ucheck < γM = 0.9 for men and Ucheck < γF = 0.2 for women), restoring gender = female on this restricted Ucheck gives check = 1 with probability 0.2/0.9 = 2/9, not the unconditional 0.2; this does not change the answer below, since both branches deny the loan regardless of the exact branch probability. • If checked, check -failed = 1, and from the loan-probability table P (loan-if -checked = 1 | gender = female, check -failed = 1) = 0. • If not checked, loan = 0 deterministically. Either branch gives loan = F , so PS (gender = female, loan = F | Alice) = P (loan gender =female = F | gender = male, loan = T, credit = bad) = 1. A.3

SHAP value function for Option A

For the 2-feature game N = {gender , credit} with f (g, c) = P (loan = 1 | g, c), by the SHAP definition (and equivalently by Definition 36 once we note that no dropped feature is a descendant of any coalition member), the value function is X   v(S) = E f (X) XS = x⋆S = P (XN \S = xN \S ) f (x⋆S , xN \S ). xN \S ∈{0,1}|N \S|

Under independent uniform marginals P (gender ) = P (credit) = 21 this specialises to X v(∅) = 14 f (g, c), [both dropped: weight 21 · 21 ] g,c∈{0,1}

v({gender }) = 12 [f (g ⋆ , 0) + f (g ⋆ , 1)] ,

[only credit dropped: weight P (c) = 12 ]

v({credit}) = 12 [f (0, c⋆ ) + f (1, c⋆ )] ,

[only gender dropped: weight P (g) = 12 ]

v({gender , credit}) = f (g ⋆ , c⋆ ).

[nothing dropped: no average]

Plugging in the four values f (F, bad) = 0.000, f (F, good) = 0.180, f (M, bad) = 0.045, f (M, good) = 0.900 yields the coalition values of Table 6; pushing those through the closed-form Shapley ϕi = 12 [v({i}) − v(∅)] + 21 [v(N ) − v(N \ {i})] (and flipping signs, since we attribute rejection g = 1 − f ) gives the magnitudes in Table 7.

B

SHAP and Causal SHAP: Definitions and Signal-with-Mediation Computations

This appendix collects the closed-form derivations for the signal-with-mediation example of Section 5.2: the Gaussian chain X → M → Y of Eqs. (5)–(7), with X ∼ N (0.5, 0.25), M = X + εM , Y = M + εY , and independent noise εM , εY ∼ N (0, 0.1). The distributional facts and conditional expectations stated in Example 22, and the per-target SHAP and per-pair PCI computations summarised in Table 9, are derived here. Unless noted otherwise the factual instance is Instance 1, X ⋆ = M ⋆ = Y ⋆ = 1. B.1

SHAP and Causal SHAP

In this section S ⊆ N denotes a SHAP coalition (a subset of features held to their factual values during evaluation), playing the same role here that C ⊆ S played in Section 3. We use the calligraphic S to keep the SHAP coalition typographically distinct from PCI’s suspect set S on the printed page; the SHAP literature’s plain S is the same object. Definition 35 (SHAP). A cooperative game is a pair (N, v), where N = {1, . . . , n} is the set of players and v : 2N → R is the characteristic function mapping each subset (coalition) S ⊆ N to the value that coalition can produce. The Shapley value [Shapley, 1953] assigns each player i a payoff ϕi , its share of the total value v(N ) − v(∅), and is the unique attribution satisfying four axioms: P 1. Efficiency: i ϕi = v(N ) − v(∅) 65

2. Symmetry: If v(S ∪ {i}) = v(S ∪ {j}) for all S ⊆ N \ {i, j}, then ϕi = ϕj 3. Dummy: If v(S ∪ {i}) = v(S) for all S, then ϕi = 0 4. Linearity: For two games v1 , v2 : ϕi (α1 v1 + α2 v2 ) = α1 ϕi (v1 ) + α2 ϕi (v2 ) The unique solution is: ϕi =

X S⊆N \{i}

 |S|! (|N | − |S| − 1)!  v(S ∪ {i}) − v(S) |N |!

(18)

|−|S|−1)! equals the probability that, in a uniformly random ordering of all playThe weight |S|!(|N|N |! ers, exactly the members of S precede i. Equivalently, ϕi is the average marginal contribution of i across all orderings. Lundberg and Lee [2017] apply Shapley values to explain model predictions by taking players to be input features, and the characteristic function to be the expected model output given a subset of features held at their factual values:   v(S) = E f (X) XS = xS (19)

where S̄ = N \ S and the missing features XS̄ are drawn from their distribution conditional on XS = xS , as in Lundberg and Lee’s original formulation. This is not the only reading in use: Janzing et al. [2020] single out exactly this choice as contested, and a common alternative (also called “plain” or “interventional” SHAP in parts of the literature) instead averages each dropped feature over its own marginal distribution P (Xi ), treating the dropped features as mutually independent and independent of XS . The two coincide whenever XS and XS̄ are independent, but differ in general. Throughout this paper, “plain SHAP” denotes the conditional form of Eq. (19) unless stated otherwise; the one exception is §5.1’s Option B analysis, which switches explicitly to the marginalindependent form to expose a separate failure mode (undefined values on coalitions whose marginal average places positive weight on a structurally impossible combination of feature values), and says so at the point of use. Definition 36 (Causal SHAP). Causal SHAP replaces the characteristic function with an interventional expectation [Heskes et al., 2020]: Z   vcausal (S) = E f (X) | do(XS = xS ) = P (XS̄ | do(XS = xS )) f (XS̄ , xS ) dXS̄ (20) By the rules of do-calculus, intervening on XS only affects the distribution of descendants of XS . For non-descendants, P (Xj | do(XS = xS )) = P (Xj ). Writing XS̄, nd for the features in S̄ that are not descendants of any member of S, and XS̄, d for those that are, equation (20) is equivalent to:   (21) vcausal (S) = EXS̄, nd ∼P (·), XS̄, d ∼P (·|do(XS =xS )) f (XS̄ , xS ) The Shapley formula (18) is otherwise unchanged. The method retains all four Shapley axioms. B.2

Distributional facts

From the structural equations, Var(M ) = Var(X) + Var(εM ) = 0.25 + 0.1 = 0.35 and Var(Y ) = Var(M ) + Var(εY ) = 0.35 + 0.1 = 0.45. For the covariances, Cov(X, M ) = Cov(X, X + εM ) = Var(X) = 0.25; Cov(X, Y ) = Cov(X, M + εY ) = Cov(X, M ) = 0.25; and Cov(M, Y ) = Cov(M, M + εY ) = Var(M ) = 0.35. B.3

Conditional expectations

E[Y | X, M ] = M since Y = M + εY
with εY ⊥ (X, M ). For E[M | X, Y ], the covariance
−1 0.45 −0.25 0.25 0.25 with det(Σ matrix of (X, Y ) is ΣXY = 0.25 XY ) = 0.05, so ΣXY = 20 −0.25 0.25 ; 0.45
0.45 −0.25 the regression coefficients are [Cov(M, X), Cov(M, Y )] Σ−1 = XY = [0.25, 0.35] · 20 −0.25 0.25 [0.5, 0.5], giving E[M | X, Y ] = 0.5 + 0.5(X − 0.5) + 0.5(Y − 0.5) = 0.5X + 0.5Y . For E[X | M, Y ], by d-separation, X ⊥ Y | M in the chain X → M → Y , so E[X | M, Y ] = E[X | ) 0.25 5 M ] = 0.5 + Cov(X,M Var(M ) (M − 0.5) = 0.5 + 0.35 (M − 0.5) = 0.5 + 7 (M − 0.5).

66

B.4

Plain SHAP

Target Y , features {X, M }. First, compute the coalition values: v(∅) = E[M ] = 0.5 v({X}) = E[M | X = 1] = 1 v({M }) = E[M | M = 1] = 1 v({X, M }) = fY (1, 1) = 1

(22) (23) (24) (25)

Next, apply equation (18) with |N | = 2: ϕX = 21 (1 − 0.5) + 12 (1 − 1) = 0.25

ϕM = 12 (1 − 0.5) + 12 (1 − 1) = 0.25

(26)

Target M , features {X, Y }. v(∅) = 0.5; v({X}) = 1; v({Y }) = 0.5 E[X | Y =1] + 0.5 = 0.889 (using E[X | Y =1] = 0.5 + 0.25 0.45 (0.5) = 0.778); v({X, Y }) = 1. ϕX = 21 (1 − 0.5) + 12 (1 − 0.889) = 0.306,

(27)

ϕY = 12 (0.889 − 0.5) + 21 (1 − 1) = 0.194.

(28)

Target X, features {M, Y }. v(∅) = 0.5; v({M }) = 0.5 + 57 (0.5) = 0.857; v({Y }) = E[X | Y =1] = 0.778 (as above); v({M, Y }) = E[X | M =1] = 0.857 (since X ⊥ Y | M ).

B.5

ϕM = 21 (0.857 − 0.5) + 12 (0.857 − 0.778) = 0.219,

(29)

ϕY = 12 (0.778 − 0.5) + 12 (0.857 − 0.857) = 0.139.

(30)

Causal SHAP

We apply Causal SHAP (Definition 36) and compare against plain SHAP. Target Y , features {X, M }. vcausal (∅) = 0.5; vcausal ({X}) = E[M | do(X=1)] = 1 (M is downstream of X: P (M | do(X=1)) = N (1, 0.1)); vcausal ({M }) = 1 (do(M =1) sets fY = M = 1 directly, P (X | do(M =1)) = P (X) since X has no causal parents); vcausal ({X, M }) = 1. All values match plain SHAP, so ϕX = ϕM = 0.25. Target M , features {X, Y }. vcausal (∅) = 0.5; vcausal ({X}) = 1 (Y is downstream of X, same as plain SHAP); vcausal ({Y }) = EX∼P (X) [0.5X + 0.5·1] = 0.75 (Y does not cause X, so P (X | do(Y =1)) = P (X); differs from plain SHAP’s 0.889); vcausal ({X, Y }) = 1. ϕX = 21 (1 − 0.5) + 12 (1 − 0.75) = 0.375,

(31)

ϕY = 12 (0.75 − 0.5) + 12 (1 − 1) = 0.125.

(32)

Target X, features {M, Y }. vcausal (∅) = 0.5; vcausal ({M }) = 0.857 (Y is downstream of M but fX does not depend on Y since X ⊥ Y | M , so EY ∼P (Y |do(M =1)) [fX (1, Y )] = fX (1, ·) = 0.857; same as plain SHAP); vcausal ({Y }) = EM ∼P (M ) [fX (M, 1)] = 0.5 (M is not a descendant of Y , so P (M | do(Y =1)) = P (M ) and E[fX (M, 1)] = 0.5 + 57 (E[M ] − 0.5) = 0.5; differs from plain SHAP’s 0.778); vcausal ({M, Y }) = 0.857.

B.6

ϕM = 12 (0.857 − 0.5) + 12 (0.857 − 0.5) = 0.357,

(33)

ϕY = 12 (0.5 − 0.5) + 21 (0.857 − 0.857) = 0.

(34)

PCI

We work at the factual instance X ⋆ = M ⋆ = Y ⋆ = 1 with the absolute-difference score (Example 21): ci(y s , y n , y ⋆ ) = |y n − y ⋆ | − |y s − y ⋆ |. Both worlds run the PSCM with fresh exogenous noise drawn from PU : the necessity world replaces the suspect A with A′ ∼ P (A) and propagates; the sufficiency world restores it to a⋆ and propagates. For target B, S is the two input features of B and W the remaining input; Γs is uniform over the three non-empty subsets of S and Γw uniform over 2W .

67

R(X ⇝ Y ). S = {X, M }, W = {M }, w⋆ = m⋆ = 1, and X ′ ∼ N (0.5, 0.25). Three of the four accepted (C, T) pairs intervene on X, each with weight 41 ; the fourth, (C={M }, T=∅), does not touch X and contributes nothing. The witness pair (C={X}, T={M }) pins M at m⋆ in both worlds, which equalizes their distributions and zeros out c̄; the other two pairs let M propagate freely. Computing E[|Y n − 1|] and E[|Y s − 1|] in closed form via the folded-normal formula gives: (C, T)

E[|Y n − 1|]

E[|Y s − 1|]

c̄

0.677 0.252 0.677

0.357 0.252 0.252

0.320 0.000 0.425

({X}, ∅) ({X}, {M }) [witness] ({X, M }, ∅) Combining at weight 14 each,

R(X ⇝ Y | W={M }) = 14 (0.320 + 0 + 0.425) ≈ 0.186. R(Y ⇝ X). X is exogenous: no do-intervention on {M, Y } alters its structural equation, so necessity and sufficiency distributions coincide and R(Y ⇝ X | W={M }) = 0. Other cells. The remaining entries of Table 9 (D-MY, D-XM, D-YM, D-MX, D-MXY, and the W = ∅ column) follow the same closed-form machinery; full per-pair computations are in the companion notebook signal_mediation_computations.

C

Setup for the Desert-Traveller PCI Computation

This appendix records the structural model and the full PCI specification behind the desert-traveller comparison of Section 7. The basic-variant results (Table 12) and the weak-poison results (Table 14) are produced by running the PCI Monte Carlo search of Section 3 on the scenario-specific model below, with the component choices listed here; a parallel hand-rolled enumeration matches every value within Monte Carlo noise (companion notebook desert_traveler). C.1

Structural model

To compare directly with Pearl, we run PCI under the same forensic conditioning: one structural model per scenario, with u pinned at the scenario’s forensic realisation. The endogenous variables are X, P, c, d, Y ∈ {0, 1} with c = P (u′ ∨ X ′ ), d = X (u ∨ P ′ ), y = c ∨ d, ′ where primes denote Boolean complement (u = 1 − u, etc.), c indicates the cyanide path operating (poisoned water drunk) and d the dehydration path operating (drank from empty canteen). C.2

PCI components

The PCI components, all specified in advance: • Suspects S = {X, P }; candidate causes are the singletons {X} and {P }. • Witness pool W = {c, d} (the mediators); four subsets T ⊆ W, weighted by Γ cardinality-uniform (uniform on |T|, then uniform within each cardinality class). • We do not intervene on or hard-code the non-cause suspect (the one not in C); it follows the SCM under the noise prior on its own coin, consistent with the formal definition’s requirement that we intervene only on C and T (Definition 18). • Alternative-value distribution ∆ deterministically flips 1 → 0. • Noise distribution PU is the forensic posterior, a point mass at the scenario’s u. We do not condition on the outcome Y itself; the forensic evidence sits above Y in the SCM, so conditioning on it is not the “fully conditional” anti-pattern of Section 3. For the weak-poison variant (Section 7.4) the only mechanical changes are that the witness pool becomes W = {c, d, vC } (the new “cyanide-was-fatal” mediator vC is included) and that the Scenario A forensic posterior pins both u = 0 and ξ = 1; Scenario B’s posterior pins u = 1, with ξ structurally irrelevant since the cyanide path is dormant. 68

D

Synthetic Evaluation Across Linear, Overdetermined, and Undercutting Archetypes

This appendix gives the full model, estimator, and per-row analysis behind the synthetic-archetype result summarised in Section 4. Section 5 has compared PCI with SHAP and Causal SHAP on two small examples and shown where the SHAP framework’s desiderata fail. Those examples cover only two causal patterns: overdetermination through a gating mediator (OBCB) and correlated mediation (signal). This appendix stresstests PCI across a wider catalogue of patterns, with an analytic ground truth available throughout: the question is whether PCI correctly separates linear, overdetermined, and preempted contributions on a single structural model, and stays at the noise floor on a variable that plays no role. To evaluate PCI in a setting that exhibits multiple distinct causal patterns simultaneously, we construct a synthetic structural causal model carrying three archetypes, linear necessary-and-sufficient, overdetermined-not-necessary, and preempted (the undercutting archetype named in the section title, implemented here via a gate), together with an irrelevance control.27 The model has six independent root variables and three deterministic branches feeding the outcome E (the generic outcome Y of Section 3, written E here to match the model diagram; its factual value is y ⋆ and its necessity/sufficiency worlds Y n , Y s ): L1 , L2 ∼ N (0, 1), O1 , O2 ∼ N (1, 1), lin = 5L1 + 10L2 , od = max(5O1 , 5O2 ), gate = 1{|L2 | ≤ τ }, p branch = 5P · gate, E = lin + od + p branch.

P, D ∼ N (0, 1),

We pick τ = 0.674 so the gate is on / off about half the time (Pr(|L2 | ≤ 0.674) ≈ 0.5 for L2 ∼ N (0, 1)). The DAG is shown in Figure 14. The variable D is sampled but never enters E, serving as an irrelevance control, so any non-zero score for D is the noise floor of the procedure. The PCI evaluation treats the six roots as the suspect set; deterministic mediators are not suspects. Restricting suspects to roots loses no causal information here since downstream values are determined by the roots (formal statement deferred to Section 3). Causal impact, decomposed. We follow the impact function ci(y s , y n , y ⋆ ) = |y n −y ⋆ |−|y s −y ⋆ | defined in Section 3, but report its two components separately as ciN and ciS :   ciN (V ) = E |Y n − y ⋆ | V intervened (necessity),   s ⋆ ciS (V ) = − E |Y − y | V pinned at factual (sufficiency), with ci(V ) = ciN (V ) + ciS (V ). Higher ciN means more necessary; higher ciS (closer to zero) means more sufficient. The raw scores carry a co-intervention baseline that does not vanish for D, so we report excess over D within each case: ∆N (V ) = ciN (V ) − ciN (D),

∆S (V ) = ciS (V ) − ciS (D).

D is the noise floor; any other variable’s ∆ is its causal signal above it. Two factual cases. We instantiate the model with one batch of 500 events and select two factual observations to read all archetypes off. Case 1 (preempted, contestable O pair). Filter: |L2 | > τ (gate off, so p branch = 0 regardless of P ) and |O1 − O2 | < κ with κ = 1 (the two overdetermined contributors are close: the winner is barely the winner; we call such a pair contestable, since a small perturbation to either contributor 27 The classical motivating example is Sally and Billy throwing stones at a bottle: Sally’s stone arrives first and shatters it; Billy’s would have done the same had Sally’s not preempted it. The case is canonical in the actual-causality literature [Halpern, 2016] and motivates the preempted archetype below; we use generic letters rather than personal names to keep variable labelling tight.

69

D

L1

5L1 + 10L2

O1 max(5O 1 , 5O 2 )

O2

E

L2 P

5P · gate

gate = 𝟙{|L2 | ≤ τ}

Figure 14: Synthetic archetype model. Roots (circles) are independent draws: L1 , L2 ∼ N (0, 1) (linear, purple); O1 , O2 ∼ N (1, 1) (overdetermined via max, blue); P ∼ N (0, 1) (gated by |L2 | ≤ τ , green); D ∼ N (0, 1) (irrelevance control, grey). Mediators (white ellipses) carry the deterministic functions of their parents. Outcome E (orange double-circle) is the sum lin + od + p branch. The variable D has no outgoing edges by construction.

could flip which one wins max(5O1 , 5O2 )). Linear N+S on the Ls, between-variable sufficiency asymmetry on a contestable O pair, and noise floor for both P and D should all be readable from this single observation. Case 2 (unpreempted, dominant O winner). Filter: |L2 | ≤ τ (gate on, P branch active) and |O1 − O2 | > κ. The dominant winner makes the within-variable S-not-N gap visible: the winner is large enough that alternatives rarely beat it (high ∆S ), and the loser provides a partial floor when the winner is intervened (reduced ∆N ). A contestable pair cannot show this within-variable gap, since pinning either one still lets the partner flip the max. The two cases together test the structural-role-not-identity claim: the same variable P should sit at the noise floor in Case 1 and mirror L1 in Case 2. Desiderata and measurements. Table 15 pairs each archetype expectation with the formal inequality on the excess scores ∆N , ∆S , the measured value at the production sample budget (N = 20 000 Monte Carlo draws per intervention), and a bootstrap 95% confidence interval (4 000 resamples, joint across V and D so per-sample correlations are preserved). The noise-floor variable D itself drifts across the two cases: co-intervention variance is structurally larger in the gate-on regime than in the gate-off regime, so ciN (D) shifts between regimes by a non-negligible amount. This is exactly why every archetype claim is stated on the excess scores ∆N , ∆S rather than raw ci values: subtracting D within each case normalises out the regime-dependent floor, so the archetype patterns can be read off stably regardless of D’s absolute drift. The threshold comes from the data. The directional desiderata of the form ∆ > ϵ or |∆| < ϵ all depend on a single tolerance ϵ. We do not hand-pick it; we derive it from the Monte Carlo budget. For every ∆ score appearing in any desideratum we bootstrap a standard error σV and take ϵ = 1.645 · σmax ,

σmax = max σV , V,case

the one-sided 95% Z-quantile times the largest standard error across all measured ∆s. Under the null hypothesis ∆ = 0, fewer than 5% of measurements would exceed ϵ; a ∆ that clears ϵ is therefore not Monte Carlo chatter at the chosen budget. At N = 20 000 samples we measure σmax ≈ 0.092, giving ϵ ≈ 0.151. Smaller budgets give a noisier ϵ that defeats the point (e.g. at N = 5 000, σmax ≈ 0.18 would push ϵ into the signal range); this fixes the production sample size for the section. Ten of the twelve desiderata we considered survive this threshold; the two that do not (cross-regime P flip, and quantitative match of ∆N (P ) to ∆N (L1 ) in Case 2) are discussed below as diagnostics. 70

# Formal desideratum 1 2 3 4 5 6 7 8 9 10

Measured

∆N (L2 ) is the largest excess necessity, Case 1 ∆N (L2 ) is the largest excess necessity, Case 2 ∆S (Ow ) − ∆S (Ol ) > ϵ, Case 1 (contestable) ∆S (Ow ) − ∆S (Ol ) > ϵ, Case 2 (dominant) |∆N (Ow ) − ∆N (Ol )| < ϵ, Case 1 ∆S (Ow ) − ∆N (Ow ) > ϵ, Case 2 (within-variable S-notN signature) ∆N (L2 ) − ∆N (Ow ) > ϵ, Case 2 |∆N (P )| < ϵ, Case 1 (gate off) ∆N (L1 ) − ∆N (P ) > ϵ, Case 1 ∆N (P ) > ϵ, Case 2 (gate on)

95% CI Result

+2.129 +0.642 +0.347 +0.529 −0.093 +0.487

[+1.953, +2.300] [+0.476, +0.813] [+0.216, +0.473] [+0.387, +0.667] [−0.266, +0.081] [+0.256, +0.712]

✓ ✓ ✓ ✓ ✓ ✓

+1.082 +0.112 +0.670 +0.250

[+0.915, +1.251] [−0.058, +0.280] [+0.499, +0.843] [+0.079, +0.422]

✓ ✓ ✓ ✓

Table 15: Desiderata satisfaction on the synthetic archetype model. Threshold ϵ = 1.645 · σmax ≈ 0.151 is the smallest ∆ gap that, at N = 20 000 samples, exceeds Monte Carlo noise at one-sided 95% confidence. Subscripts w/l denote the winner / loser of the max(5O1 , 5O2 ) branch in the given case. Per-row check identifiers and the underlying numerical computations are listed in the companion notebook responsibility_archetypes.

Figure 5 visualises the same ten claims as a forest plot: each row carries a plain-language statement of the structural expectation; the dot is the point estimate of the relevant ∆ score (or difference of ∆ scores); the horizontal bar is its bootstrap 95% CI; and the green band is the row’s pass region, i.e. the set of ∆ values that would confirm that row’s claim given ϵ. The pass region depends on the claim type: ∆ > ϵ claims pass to the right of ϵ; |∆| < ϵ closeness claims pass inside the strip (−ϵ, +ϵ); rank claims (#1 and #2) pass to the right of 0, since they compare ∆N (L2 ) against the largest competing suspect. We count a row as confirmed when the point estimate lies in its green band; we show the CI separately so the reader can see when a measurement is statistically tight and when its CI crosses the pass boundary. All ten dots fall inside their pass bands. The tightest row is #10 (∆N (P ) > ϵ in Case 2, gate on): the point estimate +0.250 clears ϵ ≈ 0.151 by roughly one σ, with its CI lower edge at +0.079 still inside the band on the right side of zero. Diagnostics that do not survive the bootstrap-derived threshold. Two further claims about the preempted variable P fail at this threshold; we report them as diagnostics rather than as numbered desiderata. (D1) The cross-regime flip ∆N (P, Case 2) − ∆N (P, Case 1) measures +0.139 with CI [−0.081, +0.365]: the CI straddles zero, so we cannot statistically resolve P ’s rise across regimes on its own at the production budget. The qualitative content of this claim is already carried by desiderata #8 (P at the noise floor in Case 1) and #10 (P above ϵ in Case 2): if both pass, the regime flip is a corollary, not an independent claim. (D2) The quantitative match |∆N (P ) − ∆N (L1 )| < ϵ in Case 2: the signed gap ∆N (P ) − ∆N (L1 ) measures −0.267 with CI [−0.441, −0.106]; the point estimate’s magnitude 0.267 lies above ϵ, though the interval’s near edge (0.106) dips below it. At this sample budget, gated P does not quantitatively mirror ungated L1 ; what we can claim is the weaker, qualitative statement that both clear the noise floor in Case 2, which is exactly desideratum #10 for P and built into Case 2 by construction for L1 . The archetype evaluation establishes that PCI recovers the right qualitative pattern on every standard causal motif against an analytic ground truth. Appendix E now turns to a complementary continuous-input comparison: how does PCI behave next to gradient-based attribution (Differential Causal Effect of Butler et al., 2022) when the same continuous cause is rescaled or moved out of the steep region of the response surface, where the gradient itself collapses but causal responsibility arguably should not?

E

Comparison to Differential Causal Effect

This appendix details the Differential Causal Effect comparison summarised in Section 4. Having tested PCI against ground truth in Appendix D, we now compare it with gradient-based attribution on a continuous-input credit-limit example. A natural baseline for continuous-input attribution is to read causal influence  off the gradient of an interventional mean function. The motivation is direct: E Y | do(X=1) − E Y | do(X=0) 71

Figure 15: Deterministic component of the credit-limit model (Example 37), on the hours scale: limit vs. age at several times of day (left) and limit vs. time of day at several ages (right). Age dominates the limit, with a small sinusoidal modulation from time of day; the minute scale is identical modulo a linear reparameterisation (verified in the notebook).

is the binary ATE, and for a continuous cause one calculus” [Ness, 2025,  “arrives at derivative  Section 7.4.3] by letting the contrast shrink: ∂xE Y | do(X=x) . Generalised to a vector x = (x1 , . . . , xd ) with interventional mean m(x) = E YX=x , the causal gradient is      ∇x m(x) = ∂x1 E YX=x , . . . , ∂xd E YX=x , and each partial is the differential causal effect (DCE) of a single variable at x. Butler et al. [2022] introduced this quantity in the Gaussian Process regression setting, where, with the posterior expected P P mean expressible as n k(x, x(n) )αn , the DCE has the closed form ∂xi F̂ = n ∂xi k(x, x(n) )αn . PCI and DCE are not direct competitors (DCE estimates a rate of change, PCI estimates individuallevel responsibility), but PCI inherits the territory of continuous attribution, so a contrast on a single example is informative. We highlight the differences: 1. DCE requires y = F (X, ϵ) with F differentiable; PCI requires only that the causal model be sampleable, and the inference algorithm for the expanded model is the user’s choice (we use Monte Carlo throughout). 2. DCE inherits the units of both X and Y , so cross-feature comparison is unit-sensitive. The PCI score integrates over the necessity- and sufficiency-world densities, so changes to input scale leave the score essentially unchanged.28 3. DCE varies abruptly with the local geometry of F . The PCI score depends on where the factual value sits relative to the necessity/sufficiency densities and is therefore non-zero in flat regions while remaining locally informative. Example 37 (credit-limit assignment). We model an applicant’s approved credit limit as a function of age and the time of application. The deterministic component is a sigmoidal rise in age with a small sinusoidal modulation in time-of-day; intuitively, age should dominate. We consider four settings on two axes: time measured in hours vs. minutes (a units rescaling that should not affect attribution), and an age prior centred at 30 vs. 40 (a genuine change in what counts as unusual). The deterministic component is shown in Figure 15. Computational details and code are in docs/source/gradient_based_attribution.ipynb. PCI scores. We instantiate ci as the absolute-difference score from Example 21, ci(y s , y n , y ⋆ ) = |y n − y ⋆ | − |y s − y ⋆ |, and run the search of Section 3 on each setting, conditioning on age and on time of application as singleton suspects. Figure 16 shows the mechanism for the canonical setting (age-30 prior, hours): when age is the active suspect the necessity-world outcome tracks the 28 This unit-invariance is contingent on how the alternative-value distribution ∆ is specified. The ϵ-excised ∆ of Section 3 is invariant to a reparameterisation of the input scale precisely when ϵ is fixed by the probability mass excised around the factual value (equivalently, in standardised units), as in the ROPE/effect-size reading given there, rather than as an absolute distance in the raw units of X: an absolute-distance ϵ held fixed across a rescaling would itself become unit-dependent and reintroduce the very sensitivity PCI otherwise avoids.

72

Figure 16: PCI search for the canonical setting (age-30 prior, hours), with age (left) and time of application (right) as the active suspect. Necessity-world (green) and sufficiency-world (orange) limit samples and the total score (purple) are plotted against the necessity-world value of the suspect; the dashed line marks the factual. The necessity world departs from factual along the deterministic response while the sufficiency world stays near it; each panel title gives the mean total score. Table 16: Mean PCI total scores for age and time of application across the four settings (time unit × age prior), at the factual instance. Age outscores time in every setting; the hours and minutes columns agree (unitinvariance), while the age-40 prior raises all scores relative to age-30 (a more unusual factual age).

age-30 prior

age-40 prior

Suspect

hours

minutes

hours

minutes

Age Time of application

100.45 68.61

97.95 66.51

177.87 117.97

176.56 118.42

deterministic curve while the sufficiency-world outcome stays near factual, and the same picture, with a smaller displacement, holds for time of application. Table 16 reports the mean total scores across all four settings. Two patterns stand out. First, age outscores time of application in every setting, by roughly a factor of 3/2, matching the intuition that the age sigmoid moves the outcome by a much larger absolute amount than the daily modulation does. Second, the scores are essentially unchanged between the hours and minutes columns, confirming the unit-invariance discussed above, whereas the shift from the age-30 to the age-40 prior raises every score, since a more unusual factual age means a larger search-space displacement. PCI vs. DCE across the input grid. Figure 6 (Section 4) contrasts the two methods on the same grid of factual values (age-30 prior); the other three settings give qualitatively the same picture. Panel (a) plots the difference between the PCI scores for age and for time of application: it is positive everywhere, so age is consistently the more responsible variable. Panels (b) and (c) plot the corresponding difference in DCE magnitudes, on the hours and minutes scales respectively, and two differences with PCI stand out. First, on the hour scale the DCE for time of application exceeds the DCE for age over most of the grid, the opposite of PCI’s verdict; only a narrow band near the sigmoid’s inflection point favours age, and only because the gradient spikes sharply at that single point. Second, switching the time unit from hours to minutes flattens the time DCE by roughly a factor of 60, collapsing almost all of panel (b)’s time-favouring region to near zero in panel (c) and making the unit sensitivity explicit. Both are direct consequences of DCE’s role as a rate-of-change estimator rather than a responsibility score, and both make it harder to compare across features and across reparameterisations.

F

Scaling Actual-Cause Computation: An Empirical Comparison

This appendix details the actual-cause scaling benchmark summarised in Section 4.

73

The correspondence in Theorems 26–27 and Proposition 32 is a statement about verdicts: under P the stated hypotheses, AC actual causes coincide with the support of T Φ. This appendix reports an empirical companion to the correspondence. We ask whether the necessity-only PCI kernel of Definition 24, instantiated with a finite Monte Carlo estimator, recovers AC verdicts at problem sizes where exact subset enumeration is no longer tractable. The full implementation, raw outputs and plotting code are in the companion notebook actual_causality_benchmark. Generalised throwing problem. For a size parameter n we replicate the canonical Sally/Billy structure n times in parallel. Binary suspects A1 , . . . , An , B1 , . . . , Bn ∈ {0, 1} feed deterministic mediators Wia = Ai , Wib = Bi ∧ ¬Ai that capture overdetermination via preemption: Bi contributes Vn only if Ai does not. The outcome is the conjunction Y = i=1 (Wia ∨ Wib ), and the model size grows as 4n + 1 variables. Ground-truth responsibility at site i is read off during the forward pass: Ai is responsible if Wia = 1, Bi is responsible if Wib = 1. The structure scales the canonical example without softening it: overdetermination, undercutting, and witness-mediated symmetry-breaking are present at every site, while keeping a closed-form ground truth available for evaluation. The variable partition takes the roots {Ai , Bi }i as suspects and the deterministic mediators {Wia , Wib }i as witnesses, with no suspect a deterministic function of the others. This partition satisfies the closure condition required by Theorem 26 (see the Remark on deterministic intermediates and joint support, which addresses precisely the scenario in which both a root and its structural descendant are admitted as suspects). The benchmark is therefore within the scope of the formal correspondence; in particular, joint full support of the alternative-value distribution holds on the admissible suspect set {Ai , Bi }i even though the model itself is deterministic, because witnesses are not themselves part of the alternative-value distribution. Exact subset enumeration (AC reference). The exact procedure mechanises Definition 23: for each non-empty cause subset C ⊆ {Ai , Bi }i and each non-empty witness subset T ⊆ {Wia , Wib }i , we intervene [C ← 1 − c⋆ , T ← w⋆ ], record whether the outcome flips, and accept C as actual cause if
2 some witness T achieves a flip and no proper subset of C does. The search space has 22n − 1 cause-witness pairs (9, 225, 3969, 65025 for n = 1, 2, 3, 4), which already determines the ceiling reached by the exact method. Approximate PCI estimator. The PCI estimator instantiates the kernel of Definition 24 via the Monte Carlo search procedure of Section 3. Algorithm 2 is the explicit procedure we use to produce the curves in Figure 7 and Figure 17. In words: for each of N draws it picks a random small set of suspects to flip and a random set of witnesses to pin at their factual values, then runs the model twice under the same noise, once with the suspects restored to factual (the sufficiency world) and once with them flipped to their alternatives (the necessity world), and records whether the flip changed the outcome. Each suspect’s score is the fraction of its draws in which flipping it changed the outcome, and at each site the procedure returns the higher-scoring of the two rivals Ai , Bi as the cause. The procedure transcribes the ThinSearchSampler used in the companion notebook actual_causality_benchmark. The algorithm draws N intervention configurations under shared noise. Line 10 draws the active suspect set Cj at uniformly chosen cardinality ks ∈ {1, . . . , ns }; line 11 draws the dropped witness set Dj the same way at kw ∈ {0, . . . , nw }, and the active witnesses on line 12 are the complement W\Dj , so nw bounds the number of witnesses dropped, not the number kept, and the active witness set has size |W|−nw or larger. Line 2 handles the witness ablation flag wit = off once, by emptying W; this collapses the witness machinery on lines 11–12 and 14–15 to no-ops, producing the dotted accuracy curves of Figure 7. Alternative values on line 13 are bit flips: on {0, 1} the ϵ-excised alternative-value distribution has a single support point and ϵ plays no role; we preserve the explicit sampling form so that the same routine runs on continuous benchmarks. The two interventional worlds on lines 14–15 share the noise realisation uj drawn on line 8, the standard counterfactual coupling, which lets us read the per-suspect score on lines 16–18 off as the nan-mean of |yjn − y ⋆ | over the draws in which X ∈ Cj . The algorithm computes the sufficiency outcome yjs but does not consume it: the AC verdict against which we benchmark has no sufficiency clause, so we read only the necessity world. We exercise the joint estimator with sufficiency active in Appendices D, E, and G, where AC has no comparable verdict to benchmark against. At each site i = 1, . . . , n, line 24 returns the suspect, Ai or Bi , with the higher mean. 74

Algorithm 2 Approximate PCI estimator on the scaled throwing problem. Require: PSCM M ; factual world (s⋆ , w⋆ , y ⋆ ); cardinality bounds ns , nw ; sample budget N ; witness flag wit ∈ {on, off} Ensure: per-site verdicts vi ∈ {Ai , Bi } for i = 1, . . . , n 1: if wit = off then 2: W←∅ ▷ no witness candidates 3: end if 4: for each X ∈ S do 5: L[X] ← [ ] ▷ per-suspect score list 6: end for 7: for j = 1, . . . , N do 8: draw uj ∼ PU 9: sample ks ∼ Unif{1, . . . , ns }, kw ∼ Unif{0, . . . , nw } 10: sample Cj ⊆ S uniformly with |Cj | = ks 11: sample Dj ⊆ W uniformly with |Dj | = kw ▷ witnesses dropped 12: Tj ← W \ Dj ▷ active witnesses 13: c′j ← 1 − s⋆ |Cj ▷ bit-flip on {0, 1}
14: yjs ← M.run uj , do(Cj = s⋆ |Cj , Tj = w⋆ |Tj ) ▷ sufficiency
n ′ ⋆ 15: yj ← M.run uj , do(Cj = cj , Tj = w |Tj ) ▷ necessity, shared uj 16: for each X ∈ Cj do 17: append |yjn − y ⋆ | to L[X] 18: end for 19: end for 20: for each X ∈ S do 21: score[X] ← nanmean(L[X]) 22: end for 23: for i = 1, . . . , n do
24: vi ← arg max score[Ai ], score[Bi ] 25: end for 26: return (v1 , . . . , vn )

Benchmark protocol. For each problem size n we sample up to ten distinct factive worlds (with Y = 1), instantiate the model, run both methods to verdicts, and compare to the analytic ground truth. We grant each method a 60-minute global budget per run; if the budget runs out mid-loop, the largest completed n caps the curve. We exercise the approximate estimator in five configurations that vary along three axes identified in Section 3: (i) initial sample budget N0 ∈ {250, 500}, scaled linearly with n by a factor α ∈ {0.5, 1} so that the total sample at size n is α · N0 · n; (ii) presence of witness interventions (wit ∈ {on, off}), ablating T ← w⋆ to test whether witness pinning is decisive; (iii) cardinality bounds ns , nw , fixed at 4 in the default runs (answering “does some witness set of size ≥ |W| − 4 work?”) and grown linearly as 4n in the dynamic-set-size configuration (recovering the unrestricted subset search at the cost of higher variance). The cardinality bound is a tunable approximation knob, not a hidden assumption: the dynamic-set-size run measures the empirical cost of bounding ns , nw at 4 on this problem, and the ablation measures the gap between the two configurations. Section 3 gives the conceptual case for constraining cardinality at all: uniform sampling over the full powerset biases attributions toward large-coalition interventions, analogous to declining to enumerate all n-way regression interaction terms. Results. The results cover runtime, search-space size, and accuracy. First, runtime (Figure 7): the exact procedure times out at 4n + 1 = 17 variables (n = 4) once the cause-witness search space crosses sixty-five thousand pairs, while the approximate methods continue to roughly 73– 145 variables depending on sample budget, with the frugal α=0.5 run reaching the largest sizes. Second, search-space size (Figure 17, log scale): the exact method visits the full powerset, while the approximate methods visit at most a few hundred unique configurations per problem size: the gap is several orders of magnitude and widens with n. Third, accuracy (Figure 7): the exact method is correct by construction up to its early demise; the witness-using approximate methods stay above 0.85 correct-attribution rate up to 73–89 variables and degrade gracefully beyond that, with the dynamic-set-size run sustaining among the highest accuracies at moderate problem sizes. Witness75

free runs (dotted) underperform at nearly every problem size, starting near 0.67 already at n = 1; at matched budget (250 samples, α=1) the witness runs average 0.941 against 0.861 and lead at 22 of the 26 shared sizes. The ablation confirms a structural claim of Section 3: pinning factual witness values is doing real work.

Figure 17: Number of cause-witness configurations explored per problem size, log scale. The exact method visits the full powerset; the approximate methods visit a few hundred unique configurations per problem size regardless of n, a gap of several orders of magnitude that grows with n.

Scope of the conclusion. The benchmark establishes that the necessity-only PCI estimator tracks AC verdicts on a faithful scaling of the canonical example with several orders of magnitude fewer evaluated configurations. The problem itself, however, is structured: responsibility attribution is independent across sites, exactly one of Ai , Bi is responsible at each site given C=1, supersets of any witness set witness the same attribution (so a small witness-cardinality bound costs little), and all variables are binary. These regularities account for some of the favourable scaling: in particular, the cardinality-bounded sampling losing little to dynamic-set-sizes sampling on this problem. Two extensions are natural follow-ups. First, we defer a comparison against SHAP and causal SHAP on the same scaled-throwing problem to a companion benchmark (Section 5 gives the SHAP-vs-PCI comparison on the smaller overdetermination and continuous-mediation examples); the sufficiency component of PCI distinguishes it from those baselines, and a clean head-to-head requires the joint kernel rather than the necessity-only restriction used here. Second, benchmarks that break each of the structural regularities above, particularly continuous-variable extensions where AC’s mechanical enumeration is no longer even well-defined, would test the estimator outside its current favourable regime. As a sanity check that the correspondence in Theorems 26–27 is empirically operational at scale, the present comparison is sufficient. The AC benchmark exercises the necessity-only specialisation of PCI on a discrete-outcome problem with a closed-form ground truth. Appendix G shifts to the regime where AC has no verdict to compare against: a Bayesian dynamical SIR model with a continuous outcome and asymmetrically interacting policies. The point is to exercise the joint necessity-sufficiency machinery on threshold events that the actual-causality machinery cannot adjudicate, and to show that PCI separates lockdown and masking where but-for analysis collapses them.

76

G

Dynamical SIR Benchmark: PCI on Continuous Outcomes

This appendix details the continuous-outcome SIR benchmark summarised in Section 4. The actual-causality benchmark of Appendix F exercises the necessity-only specialisation of PCI on a discrete outcome with a closed-form ground truth. This appendix shifts to the regime where AC has no verdict to compare against: a Bayesian dynamical model with a continuous outcome and asymmetrically interacting causes. The benchmark mirrors a public ChiRho tutorial29 in setup and query. We keep the same model and the same query but replace the explanatory machinery with the PCI thin-search sampler. The full implementation, raw outputs and plotting code are in the companion notebook sir_benchmark. Model. The dynamics are the standard SIR system Ṡ = −βSI, I˙ = βSI − γI, Ṙ = γI, with Bayesian priors β ∼ Beta(18, 600) and γ ∼ Beta(1600, 1600). Two non-pharmaceutical policies, each enacted with prior probability 1/2, modulate the transmission rate via an intervention strength l ∈ [0, 1] that scales β0 to (1−l)β0 . Lockdown alone has efficiency 0.6; masking efficiency depends on lockdown (0.1 under lockdown, 0.45 on its own); the joint efficiency is the clamped sum, capped at 0.95. Lockdown is enacted at t = 1, masking at t = 1.5. The outcome is the overshoot, the peak-to-final S gap of the simulated trajectory, and the undesirable event is os too high = 1[overshoot > 24] on a 100-person population. A policy can raise this probability relative to no intervention at all: suppressing or flattening the infectious peak leaves more susceptibles unspent at the peak, so they are drawn down more slowly afterward, which can widen the peak-to-final gap that overshoot measures even though the intervention is clearly the safer outcome in absolute infection terms. A high Pr(overshoot > 24) under intervention is therefore not a sign error; it is a property of this particular summary statistic. But-for analysis gives a symmetric verdict. Conditioning on each pair of policy decisions and drawing 100 predictives yields Pr(overshoot > 24) ≈ 0.07 with no intervention, 0.76 with both policies, 0.84 with lockdown only, and 0.81 with mask only; the two single-policy regimes are statistically indistinguishable by but-for probability alone at this sample budget (a 0.03 gap on 100 predictive draws is well within Monte Carlo noise), which is exactly the symmetry PCI is designed to break. The mechanism is the asymmetric joint efficiency: lockdown and mask together reach a transmission reduction of only 0.7, well short of the model’s 0.95 clamp, and mask’s efficiency itself depends on whether lockdown is also active (falling from 0.45 alone to 0.1 under lockdown). But-for cannot disentangle this context dependence: it treats each policy as a binary cause and reports an aggregate effect, with no way to express that lockdown’s causal contribution depends on whether masking is in force. Figure 18 visualises the four interventional regimes: slowing transmission delays the infectious peak and leaves more susceptibles unspent when it arrives, so all three intervention regimes show a similarly elevated overshoot relative to no intervention, mirroring the near-equal but-for overshoot probabilities. The qualitative reading the model supports. The but-for numbers are symmetric, but the model is not, and the asymmetry points to a clear qualitative reading that any responsibility method ought to recover. First, lockdown is the proximate cause of excessive overshoot: it is the policy that does the real work of suppressing the infectious peak, and the joint regime clears the 24-overshoot threshold only because lockdown is in force. Second, masking is at most a context-sensitive cause: its contribution depends on whether lockdown is also active. Masking is comparatively effective only when lockdown is absent (efficiency 0.45 versus 0.1 under lockdown), so once lockdown is present masking adds little. A good attribution method should therefore rank lockdown above mask and, more finely, flag mask’s causal status as contingent on context rather than robust. These two intuitions are the target of the analysis below; they follow from the model’s asymmetric joint efficiency, not from any particular tool, and they coincide with the verdict the ChiRho tutorial reaches via classical actual-cause probabilities. We state them here so the comparison that follows does not depend on consulting that tutorial. PCI thin-search procedure. The suspects are {lockdown, mask}. The witnesses are drawn from the policy efficiencies {lockdown efficiency, mask efficiency, joint efficiency}, with the suspect itself excluded from the witness set on each draw. The factual world fixes both policies on (lockdown = 29

https://basisresearch.github.io/chirho/explainable_sir.html

77

Figure 18: SIR trajectories and overshoot distributions under the four interventional regimes (no interventions, both policies, lockdown only, mask only). Left: posterior bands for susceptible (blue), infectious (red) and recovered (green) over time, with the lockdown enacted at t = 1 and the mask mandate at t = 1.5. Right: per-regime histograms of the overshoot, with the 24-overshoot threshold marked. Delaying the infectious peak raises the overshoot in every intervention regime, and the lockdown-only and mask-only overshoot probabilities are near-indistinguishable: the asymmetric joint efficiency that PCI disentangles.

1, mask = 1), so the factual outcome y ⋆ = overshoot is read from the same trajectory. For each suspect the sampler draws 2,500 regimes, scoring each with the |y ⋆ − ynec | − |y ⋆ − ysuff | statistic and averaging across regimes. The nec term rewards regimes where removing the suspect moves the outcome away from y ⋆ ; the suff term rewards regimes where fixing the suspect at factual keeps the outcome close to y ⋆ . The joint necessity–sufficiency plane. Before turning to numbers, it helps to see what the search produces. For each suspect the sampler returns, per regime, a pair of outcomes: the necessityworld overshoot ynec (the focal suspect set to its alternative, any other active suspects in C \ {X} intervened, witnesses pinned at factual) and the sufficiency-world overshoot ysuff (the focal suspect held at factual, other active suspects intervened, witnesses at factual). These are the necessity- and sufficiency-world outcomes y n , y s of Section 3; we write ynec , ysuff here to match the figure axes. Plotting one point per regime in the (ynec , ysuff ) plane gives a per-suspect cloud (Figure 8) that exposes the score geometry before any averaging. Three reference lines orient the plane: the dotted red cross-hair marks the factual outcome y ⋆ at the both-policies-on world (lockdown = mask = 1); because that world is the high-overshoot scenario, y ⋆ sits near the upper-right of the cloud rather than at its centre. The dash-dot blue line marks the 24-overshoot threshold, and the dashed black diagonal is ynec = ysuff . The per-regime score |y ⋆ − ynec | − |y ⋆ − ysuff | is positive exactly when a point lies further from the cross-hair along the necessity axis than along the sufficiency axis: necessity pulls the outcome away from factual (evidence the suspect was needed), while sufficiency keeps it close (evidence the suspect alone sustains the outcome). A cause therefore shows up as a cloud displaced toward smaller ynec at fixed ysuff (the cause signature on this geometry), whereas a non-cause hugs the diagonal. Reading the two panels this way, the lockdown cloud is clearly displaced above the 78

diagonal toward smaller ynec , while the mask cloud sits closer to it: the visual form of the verdict the next paragraph quantifies. Single-world results. PCI ranks lockdown well above mask, a gap well outside Monte Carlo noise: suspect

|y ⋆ −ynec |

−|y ⋆ −ysuff |

ci

q

PCI = q 2 ci

lockdown mask

8.276 7.536

−6.578 −6.673

1.698 0.863

0.754 0.754

0.965 ± 0.091 0.491 ± 0.079

Here q = PrΓ [Xk ∈ C] = 0.754 is the sub-probability mass of the suspect-containing regimes, so the reported score is the q 2 -scaled expectation of Definition 19 rather than a renormalised conditional mean; the quarter of draws that leave the suspect out contribute zero and stay in the average. The gap is driven mostly by the necessity term: removing lockdown moves the overshoot further from y ⋆ than removing mask does (8.276 vs 7.536 in mean absolute distance, 0.740 of the 0.835 total gap), while the sufficiency terms differ by only 0.095. This is consistent with the but-for finding that either policy alone is roughly equally bad. What distinguishes the suspects is that lockdown’s removal under context (with witnesses pinned to factual) pulls the world further from y ⋆ than mask’s removal does: the lockdown cloud’s displacement above the diagonal toward smaller ynec in Figure 8, against the mask cloud’s near-diagonal position.

Figure 19: Impact-kernel densities per suspect. Left: the necessity world (suspect removed) spreads the overshoot away from y ⋆ , while the sufficiency world (suspect held at factual) keeps it near y ⋆ ; the printed means are the two columns of the table above. Right: the resulting per-draw impact kernel |y ⋆ − ynec | − |y ⋆ − ysuff |, whose q 2 -scaled mean is the PCI score. The quarter of draws whose candidate set omits the suspect contribute zero and are excluded from the density.

Robustness across factual worlds. We replicate the analysis across 20 factual worlds drawn from the prior (rather than the single hand-set world above), running thin search on each with 200 regimes per suspect. The draws span β ∈ [0.0160, 0.0398] and γ ∈ [0.481, 0.525], giving factual overshoots from 9.86 to 33.80 people, 12 of the 20 above the threshold. Lockdown averages +0.819 against mask’s +0.118, a mean gap of +0.701 with a standard error of 0.111, and lockdown leads in 18 of the 20 worlds. The verdict is not an artifact of the chosen factual. Effect of context. The ChiRho tutorial isolates one downstream variable at a time, asking whether the verdict survives when that variable is held fixed at factual versus left free. We replicate the experiment by partitioning the PCI regimes by whether the partner-policy efficiency variable was sampled into the witness set (Figure 21). For lockdown, with mask efficiency fixed as a witness the score is 0.494; free, it rises to 1.684. For mask, with lockdown efficiency fixed the score is −0.161 (mask fails to register as a cause at all under that context regime) and free it rises to 1.497. 79

Figure 20: The single-world verdict across 20 factual worlds drawn from the prior. Left: PCI score against the world’s factual overshoot, for each suspect. Right: the per-world scores in draw order. Lockdown leads in 18 of the 20 worlds, with a mean gap of +0.701 (standard error 0.111).

This experiment partitions the regimes differently from the single hand-set world reported earlier, so the fixed/free scores are not expected to average to that world’s scores (lockdown 0.965, mask 0.491). Lockdown therefore registers as a cause in both context regimes, while mask’s status as a cause is contingent on its partner being allowed to adapt. PCI thus expresses both which policy is the dominant cause and how robustly that causal claim holds across counterfactual contexts: a finer-grained verdict than the binary “actual cause / not” that classical AC produces.

Figure 21: Different-contexts experiment. Bars compare PCI total score (left) and Pr(overshoot > 24 | necessity) (right) when the partner-policy efficiency variable is fixed as a witness versus left free. Lockdown’s score is positive in both regimes; mask’s score flips sign across regimes, indicating that mask is a contextsensitive rather than a robust cause.

Takeaway. On the dynamical SIR setting, PCI recovers both intuitions set out at the start of this appendix (lockdown is the proximate cause of excessive overshoot and masking only a contextsensitive one, despite both policies appearing similar under but-for analysis), and expresses them on a continuous, decomposable scale. The necessity-vs-sufficiency decomposition distinguishes suspects whose isolation effects are similar but whose removal-under-context effects diverge; the contexts experiment further distinguishes robust from context-sensitive causes. The same machinery applies to any ChiRho probabilistic program with a continuous outcome and a tractable enumeration over interventional regimes. The SIR benchmark scales PCI to a research-grade Bayesian dynamical model and demonstrates that the joint kernel captures patterns that AC cannot adjudicate. Appendix H pushes the demonstration one step further: a deployed automated valuation model trained on millions of points, with deep neural-network components and a sparse variational GP outcome head. The question there is no longer whether PCI agrees with a known ground truth (on a proprietary production model none is available), but whether the computation is feasible at all, and whether the qualitative SHAP-vs-PCI divergences observed on the synthetic side persist on a real trained system.

80

H

Scaling PCI to a Real-World Automated Valuation Model

This appendix details the deployed-AVM study summarised in Section 4. The synthetic archetypes of Appendix D, the AC benchmark of Appendix F, and the SIR benchmark of Appendix G all controlled the model and the ground truth, so that PCI could be judged against an analytic verdict or a competing AC enumeration. Here we drop both, applying PCI to a deployed valuation model for residential housing on which neither ground truth nor exact AC enumeration is available. Disclosure constraints on the trained model and its training data prevent a quantitative accuracy comparison on this system, so the quantitative validation of PCI lives entirely in the controlled synthetic benchmark of Appendix D. The role of this appendix is correspondingly narrow: to report (i) that PCI is computationally feasible at production scale on a model with millions of training points, and (ii) that the qualitative SHAP-vs-PCI divergence observed in Section 5 persists when the model is a real trained one: the shape of the two attribution distributions and where attribution mass lands, not the substantive content of the features they assign to. Setting. The unit of analysis is a residential property transaction. PCI is run against the full country-level production AVM; what we show here is an illustrative prototype based on the state of New York rather than the full national model structure, which we cannot disclose in detail. The NY prototype shares the architecture and the causal-kernel construction described below with the full system but is smaller in scope and DAG complexity. The computational-feasibility claim refers to the full national system; the qualitative SHAP-vs-PCI behaviour we illustrate is a property of the shared architecture and carries over from the prototype. The outcome variable y is the (log-epsilon-standardized) sale price. Transactions are described by a set of categorical variables xcat = x1 , . . . , xk and continuous (transformed) variables30 xcon = xk+1 , . . . , xn . Causal model. A causal DAG G expresses our causal assumptions about the relationships between variables. We wrote it manually in collaboration with domain experts, then refined it by adding edges to break implied conditional independencies not upheld by the data. The simplified NY-prototype DAG has 25 nodes and 99 edges; topology with anonymised node labels is shown in Figure 22; the full national DAG is larger and is not shown. As demonstrated in Appendix F, even the prototype is already large enough that exact actual-causality enumeration is computationally infeasible, and the same conclusion applies a fortiori to the national system. Variables xi are drawn from distributions Disti parameterized by functions fi (pai , φi ) of the parent variables pai 31 : xi ∼ Disti (fi (pai , φi )). We call these distributions causal kernels. The distributions are either (truncated) normal or categorical; we choose the family based on the domain of the variable it models. The functions fi are deep neural networks with parameters φi , which we optimize using cross-entropy loss for categorical distributions and average negative log likelihood for continuous distributions. The outcome is modeled by a sparse variational Gaussian Process (SVGP; Titsias, 2009, Hensman et al., 2013), xgp = (xcon , η(xcat , φcat )), y ∼ SVGP(µ(xgp , φµ ), κ(xgp , φκ )), where η is a linear embedding of the categorical variables into the continuous space, jointly optimized with the GP. Feasibility at production scale. To apply PCI we transform the model as described in Section 3 and evaluate the impact of features from a list of potential causal suspects, using the absolute difference impact score of Example 21. We draw Monte Carlo samples from the expanded model. Conditioning on a given suspect Xi being active gives us a sample of the scores corresponding to that feature, which we use to estimate the expected value thereof. The estimation converges at around 25,000 samples; for a batch of 50 data points this takes around 60 minutes on commodity hardware. We need to sample only once; we can then reuse the samples to compute the attribution score of any suspect. This establishes that the method is computationally tractable at production scale, not a foregone conclusion, since the expanded-model construction in Section 3 introduces additional latent dimensions per suspect and per witness. Qualitative comparison to SHAP. We compare PCI attributions to SHAP scores [Lundberg and Lee, 2017] on the same trained model. SHAP heavily weights variables that are downstream of 30 31

Usually log-epsilon-standardized, standardized-truncated, or standardized. For root nodes, pai is empty.

81

Figure 22: Topology of the AVM causal DAG (NY-prototype version), with node labels anonymised. The graph has 25 nodes and 99 edges; the full national DAG is larger and is not shown. Several variables sit deep in the DAG with high in-degree; these are the nodes towards which SHAP allocates disproportionate attribution mass (see Figure 9).

82

many other variables in the causal graph, effectively assigning attribution to what amount to summary statistics of the outcome. PCI distributes attribution more evenly across the upstream causal structure. The pattern is consistent with what Section 5 establishes on controlled examples: SHAP’s observational marginalisation allocates weight differently from intervention-and-witness-based PCI scores, and on a deep DAG this difference manifests as concentration on summary-statistic-like nodes. Figure 9 shows the two attribution distributions with real feature identities withheld under NDA; the two panels rank their own top variables independently, so only the shape of each distribution is comparable, not which specific features receive attribution in one panel versus the other.

83

Related documents

• Causation without the causal theory of action#96455
• Causation as Constraints in Causal Set Theory#83676
• Aleatory Explanations Expanded#741202
• Causal Inference as Inference to the Best Explanation#728559
• Contrastive Causal Explanation and the Explanatoriness of Deterministic and Probabilistic Hypotheses Theories#769340