What Moved the Alarm Score? Causal Attribution with Exact Computation and Scarce-Incident Estimation

Alarms in industrial systems and scientific instruments often demand immediate diagnosis despite scarce incident data. To guide intervention, an explanation must trace how changes in the data-generating process propagate through the causal structure to alter the alarm score, rather than merely flagging shifts that may be downstream effects. Yet exact attribution across interacting causal components appears combinatorial, while existing methods often either assume an unchanged causal model or require enough incident data to estimate the changed system reliably. We address this setting by formulating the alarm-score change as a Shapley game over hybrid structural causal model (SCM) states. Treating structural functions and exogenous laws as distinct players yields a finer-grained, function/law-resolved report of how each type of change propagates to the alarm score. The same framework defines realized-event and population reports, with an event--population coherence identity linking their attributions. For ordered linear SCMs and quadratic scores, a causal first- and second-moment recursion combined with quadrature computes the full Shapley vector exactly in polynomial time, eliminating combinatorial computation. To estimate this target from scarce incident data, we adapt a well-observed reference SCM to the incident regime using cross-fitted estimates of mechanism changes and residual moments, and derive attribution-error bounds and top-k recovery guarantees. Experiments on controlled and measured shifts illustrate the diagnoses and assess scaling to hundreds of variables and estimation from small incident samples.