What happens when time series models run inside the data stream?

The models live where the data moves

A pump caught drifting today becomes a work order. The same pump next week becomes an outage. That decay in signal value is why IBM and Confluent moved the models into the stream. Confluent Cloud now hosts IBM Granite Time Series models natively inside Apache Flink. No separate ML platform. No data warehouse extract. No GPU fleet to provision. The inference call is a Flink SQL function. The model reads the window, returns the forecast or the anomaly score, and writes the result to a Kafka topic. Downstream systems — alerting, dashboards, lakehouses, agents — consume it immediately.

Confluent manages serving, scaling, and runtime operations. There is no provider credential to rotate. No glue code between pipeline and model. The platform supplies fresh context continuously: sensor telemetry, payment activity, application metrics. Governance travels with the data. Topics are durable and replayable, which supports auditing, troubleshooting, and rerunning inference against history. Cloud ingress and egress fees disappear because data never leaves Confluent Cloud. RBAC and privacy policies apply end to end.

Four models for four questions

One model does not serve a shampoo line, a card network, and a retail catalogue alike. The portfolio contains four complementary time series foundation models. All four are in Early Access. All four are called through the existing AI_FORECAST and AI_DETECT_ANOMALIES Flink SQL functions. Switching models means changing one SQL parameter. No pipeline redesign.

PatchTST-FM reads a series the way a language model reads text, patch by patch. Each variable stays in its own channel so one noisy signal cannot drag the rest down. It returns a full distribution. A planner can set reorder points off the 90th percentile.

FlowState keeps a running summary updated with every point. Its dynamics are continuous in time. It reads seconds-level SCADA data and hourly market data with equal ease.

TTM drops attention for tiny mixing networks along time and across variables. A million-parameter model covers a hundred thousand series nightly on CPU.

TSPulse pairs time and frequency views in one small multi-task model. It handles anomaly detection, classification, gap-filling, and the question every operator asks: have we seen this before.

Small was a decision, not a compromise. Inference runs natively inside Confluent Cloud or on your own CPUs with open weights from the Hugging Face Hub. The models carry 44 million downloads behind them. IBM's enterprise AI governance framework adds model provenance and licensing transparency.

What the SQL call looks like

The whole project is one call. A demand planner writes:

SELECT AI_FORECAST(
  load_kw,
  event_time,
  JSON_OBJECT(
    'model' VALUE 'ttm',
    'horizon' VALUE 12
  )
) OVER (
  ORDER BY event_time
  RANGE BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW
) AS forecast
FROM meter_readings;

Change the model value and the same call runs any of the four. No separate ML stack to build or operate. Flink manages state keyed per series, fault tolerant. Each model gets the history it needs without a separate data store or a database hit per call. Teams move from streaming data to a working forecast and anomaly-detection pipeline in minutes using familiar SQL syntax.

Where the value shows up

Forecasting and planning. Most forecasting is still a statistical model and gut feel dressed up as a decision. Bespoke ML has not closed the gap — one model per series, refit by hand, drifting with the horizon. Planning covers the handful of series worth the effort. The rest runs on safety stock. A shared model pointed at the whole catalogue works on an unseen series immediately. It takes drivers like weather and promotions. It hands back a distribution rather than a single line. Nothing is built per SKU. One model becomes a model factory: a two-year SKU and a three-month one in the same job. A launch with no history starts from the SKUs it resembles. One hundred thousand SKUs nightly on CPU. The distribution turns service level into a policy the planner can state out loud. Each forecast lands on a topic. It becomes a trigger rather than a report. Replenishment fires from it. Allocation and pricing read the same numbers. A markdown lands before stock ages. A reorder fires before the shelf empties.

Anomaly detection. One missed anomaly is rarely small. In fraud it is a customer's money. In security a breach. In IT operations an outage customers meet first. Rule-based detection is enumerable, so adversaries enumerate it. Tightening a rule declines more honest customers. Bespoke ML wants labels that are scarce and stale. The model keeps a sense of normal per card and scores every payment through the same AI_DETECT_ANOMALIES call while it is still in flight. Because it also forecasts, it flags the drift toward trouble before the event. A card that bought groceries in the same three postcodes for two years funds a wallet abroad at 3 a.m. The alarm fires before the money moves. The same customer on an honest holiday sails through. Protection starts on day one because what the model learned elsewhere transfers to new products, corridors, and asset types with no labelled case. The model is customized on the bank's own stream, refit as cases are confirmed, improved continuously rather than rebuilt yearly.

Production optimization. Every plant runs on a model of itself. Keeping it honest is hard. Statistical models drift. Rule-based control holds a setpoint but never improves it. Bespoke ML explains nothing, so optimization stays in pilots. A process engineer at a shampoo plant puts a foundation model on the mixing line stream. Temperature, agitator speed, dosing rate, viscosity flow into Confluent. Months of bespoke modelling become days. Productivity gains of up to 10×. Conditioned on what the engineer controls, the forecast becomes a simulator. Energy at this mixing speed. Throughput at this temperature and dosing rate. Viscosity in spec or not. An optimizer searches that space against a named KPI, respects constraints, and explains what it recommends. The person who knows the line steers it. Optimization does not freeze at go-live. It re-optimizes as inputs change. A surfactant supplier switches. A fragrance batch behaves differently. Demand shifts from the 400 ml bottle to the travel size. This quarter the objective is throughput rather than energy. Restate the objective and constraints, and the line runs on the next best setpoint rather than last year's.

Semantic intelligence. Every lane above ends on the same question: have we seen this before? The models answer with embeddings — compact vectors that capture the shape of a window in time and frequency. Two episodes that look alike land close together whatever their scale or offset. In the stream, each window is embedded as it arrives and matched against past episodes and their outcomes. What comes back is a precedent, not a score: the runs that drifted this way and what fixed them, the demand curves a new SKU most resembles, the confirmed fraud cases this session rhymes with. The same embeddings drive classification and gap-filling. They index the context an agent retrieves before it acts.

What Early Access means for you

Early Access is open now on Confluent Cloud on AWS. Confluent Platform follows, bringing the same models and capabilities to on-premises and hybrid environments. There is no charge during Early Access. Enrollment puts you in direct contact with the IBM and Confluent teams. What you find on your own streams teaches the models what to become next. Documentation for AI_FORECAST and AI_DETECT_ANOMALIES on Confluent Cloud for Apache Flink is available, plus a guide to real-time forecasting and anomaly detection models from the people who built them. The feedback loop is the point.