Most work on improving Time Series Foundation Models (TSFMs) targets the model itself: better pretraining data, architectural changes, or fine-tuning. This paper takes a different angle. Rather than touching model weights, the authors ask whether the input context can be cleaned up at inference time to recover forecast quality that is silently lost to noisy patches. The answer, at least for TimesFM 2.5, is yes, and the mechanism they identify is worth understanding carefully.
The Problem: Context Poisoning in Patch-Based TSFMs
Patch-based TSFMs tokenize a fixed-length context window into non-overlapping segments and forecast via attention over the resulting sequence. This architecture is efficient, but it creates a specific vulnerability. A single patch containing a volatility burst, a level shift, or a spurious seasonal artifact can attract disproportionate attention weight and corrupt the forecast even when the surrounding context is clean. The authors call this context poisoning, and they argue it is not an edge case. Across 53 GIFT-Eval datasets, more than 50% of series show marginal improvability under targeted patch intervention, and 22 datasets benefit meaningfully.
The broader critique here is consistent with known weaknesses of transformer architectures on time series data. What is new is the empirical demonstration that the datasets where intervention helps are predictable from cheap, model-agnostic meta-features computed directly on the input. That predictability is what makes a deployable pipeline possible.
The GITCO Framework
GITCO consists of three components arranged in sequence:
- Gate: Computes meta-features from the raw input context and decides whether intervention is warranted. The gate is precision-biased, meaning it errs toward leaving the context untouched rather than risking degradation on series that do not benefit from cleaning.
- Router: If the gate fires, the router selects among three specialist probe Critics based on the input characteristics. This allows different diagnostic strategies to be applied depending on what kind of structural anomaly is suspected.
- Critic: Scores each patch in the context window and identifies the single most disruptive one. That patch is then soft-denoised via a simple moving average with window size 5, replacing the sharp signal with a smoother approximation.
The denoising operator is deliberately simple. SMA smoothing is not a sophisticated imputation method, and the authors do not claim otherwise. The point is that even a mild structural correction to one patch is often sufficient to reduce the attention distortion it causes. The complexity of the framework lies in knowing when to intervene and which patch to target, not in the intervention itself.
No model weights are updated at any point. The entire pipeline operates on the input context and feeds a frozen TSFM. This is a meaningful practical constraint: it means GITCO is directly applicable in production settings where model access is read-only.
Results and the Learnability Asymmetry
Evaluated on TimesFM 2.5 across 53 GIFT-Eval datasets under 11-fold cross-validation, GITCO achieves:
- Mean MASE reduction of +1.95% across all 53 datasets
- Mean MASE reduction of +4.30% on the 24 datasets where the gate intervenes
- Captured Improvement Ratio of 89.9%, meaning the pipeline recovers nearly 90% of the theoretically achievable gain under the defined probe vocabulary
- Gate precision of 78.0% with recall of 57.6%, consistent with the precision-biased design
The CIR figure is the most informative single number here. It tells you that the gap between what GITCO does and what an oracle with perfect patch identification could do is small. The bottleneck is not the intervention operator or the Critic; it is the gate's recall, which by design leaves some improvable series untouched to protect against false positives.
The Chronos2 results introduce a more conceptually interesting finding. The same meta-feature vocabulary that produces a learnable, deployable gate for TimesFM 2.5 does not produce one for Chronos2. The authors frame this as a learnability asymmetry and introduce the concept of context sensitivity profiles to describe it. A context sensitivity profile maps time series meta-features to expected accuracy improvement under inference-time context intervention. The key claim is that this profile is a joint property of the model architecture and the statistical structure of the data, not just the data alone. Different architectures, even when presented with the same inputs, have different intrinsic susceptibility to context poisoning, and that susceptibility may or may not be learnable from a fixed meta-feature vocabulary.
This is a genuinely useful conceptual contribution. It reframes the question of when inference-time input optimization is worth attempting, and it suggests that architecture-specific profiling should precede deployment of any such pipeline.
Limitations and Open Questions
The authors are candid about the scope of the evaluation. Two frozen architectures and 53 datasets is a reasonable proof of concept, but it is not sufficient to establish how broadly GITCO generalises. The Chronos2 result is a clear reminder that positive results on one architecture should not be assumed to transfer.
The intervention space is also narrow by construction. The Critic selects one patch and the denoising operator is SMA with a fixed window. The oracle and CIR figures are defined relative to this fixed vocabulary, so the reported 89.9% capture rate does not speak to what might be achievable with richer interventions, multi-patch suppression, or learned denoising operators. A more expressive intervention space would likely raise the ceiling, and it is an open question whether the gate's predictive signal is strong enough to remain reliable as the action space grows.
There is also an implicit assumption that the meta-features computed on the input are stable enough to be informative under distribution shift. The paper does not evaluate robustness in non-stationary deployment conditions, which is a meaningful gap given that context poisoning is most likely to occur precisely when the input distribution shifts unexpectedly.
The broader implication for the field is that inference-time input optimization deserves more systematic attention than it currently receives. The analogy to chain-of-thought and self-consistency in language models is apt: both of those techniques improved outputs by refining what the model sees rather than what the model is, and both turned out to be surprisingly effective. Whether time series contexts admit the same degree of structured manipulation remains an open empirical question, but GITCO provides a credible starting point and a useful conceptual vocabulary for exploring it.
Full paper: arXiv:2606.05332