A Time-Series Foundation Model Just Learned to Say "No" to a Hallucinating LLM

Five out of fifteen simulated cyberattacks on a water treatment testbed were stopped cold by a control system that pairs a large language model with a physics-aware forecasting model, and just as importantly, it never once executed an action that violated the physical laws governing the plant.

That result comes from a paper submitted to arXiv on July 10, 2026, describing a neuro-agentic framework built for industrial IoT security. The architecture couples an LLM-based planner, Gemini 2.5 Flash-Lite in the paper's implementation, with TimesFM, Google's pre-trained Time-Series Foundation Model, to detect and counter attacks on operational technology systems like the ones running water utilities, refineries, and power grids.

Why Letting an LLM Touch Industrial Controls Is Risky

LLMs are increasingly proposed as reasoning engines for autonomous defense, capable of interpreting sensor anomalies and proposing corrective actions faster than a human operator could. The catch is reliability: an LLM can hallucinate a plausible-sounding but physically impossible intervention, such as commanding a valve to a state that would rupture a pipe or overflow a tank. In a live industrial environment, executing that kind of suggestion isn't a minor bug, it's a safety incident.

The paper's answer is a mechanism it calls Counterfactual Physics Injection. Before any LLM-proposed action reaches an actuator, the system runs it through a simulation grounded in TimesFM's forecasts of how the physical process would actually respond. If the projected outcome breaks physical constraints or looks unsafe, the action gets vetoed before it ever reaches a valve, pump, or controller. The LLM proposes; the physics model disposes.

Testing Against a Real Industrial Dataset

The researchers evaluated the framework on the Secure Water Treatment (SWaT) dataset, a widely used industrial control benchmark built from an actual scaled-down water treatment plant, under a series of stochastic (randomized, unpredictable) attack scenarios. Against that backdrop, the neuro-agentic system prevented five of the modeled breaches, a 33.3% success rate. Two baseline comparisons fared worse: an LSTM-based detector caught 26.7%, and a temporal convolutional network (TCN) managed only 13.3%.

The more striking figure may be the zero: no hallucinated action from the LLM planner made it past the physics-injection safeguard to actually reach the simulated plant. That distinction matters more than the raw breach-prevention rate for anyone evaluating whether LLM-driven agents are safe to deploy in operational technology at all, since a system that occasionally stops attacks but sometimes issues dangerous commands of its own isn't a net win.

The work sits at the intersection of two trends gaining traction in critical infrastructure research: using foundation models trained on time-series sensor data for anomaly detection, and wrapping generative reasoning agents in verification layers before they're allowed to act. Whether Counterfactual Physics Injection generalizes beyond a water treatment simulation to more complex industrial environments remains an open question the paper doesn't fully resolve, but the approach offers a concrete template for constraining agentic AI in domains where a wrong answer isn't just incorrect, it's dangerous.