Observability model reveals some hidden metric patterns better than raw data
What Does an Observability Foundation Model Know?
Machine LearningArtificial Intelligence
Summary
This paper explores what an observability foundation model called Toto really learns from system data. While simple tests can show if certain labels can be found in the model’s internal states, the authors dig deeper to see if the model actually uses new information beyond the raw input. They find that some labels like timing and metric type are easier to recover from Toto’s internal states than from the raw input alone, but others like series count are better from raw data. Changing internal signals affects predictions but doesn’t always improve forecasts, suggesting what the model knows is not always what it uses.
What this means in practice
- •For system reliability engineers: Use observability foundation models like Toto to identify hidden metric patterns that improve monitoring beyond raw data analysis.
- •For site reliability teams: Incorporate foundation model internal signals in forecasting tools to enhance detection of timing and metric-type anomalies in system performance.
Authors
Dhyey Dharmendrakumar Mavani, Rian Atri, Tairan Ji
Abstract
A linear probe can show that a label is recoverable from a model's hidden states, but not whether that goes beyond what the input already reveals, or whether the model uses it. We audit Toto, an observability forecasting foundation model, on the Benchmark of Observability Metrics (BOOM) across five series-disjoint resplits, comparing linear probes on its frozen residual stream with models that read the raw input window and with Toto's architecture stripped of its trained configuration. Short-vs-medium cadence and metric type are more linearly recoverable from Toto's residuals than from the strongest raw-window model in every resplit (macro-F1 0.766 vs. 0.633 and 0.545 vs. 0.498). Domain is nearly tied, and series cardinality is recovered far better from the raw window. MOMENT-base shows related cadence, metric-type, and domain readouts. Recoverability is not use: exchanging Toto's residuals with those of high-burst donors moves a future-burstiness readout as intended but does not make forecasts consistently burstier than a randomized donor. A BOOM-trained coordination probe has negative zero-shot R^2 on the tested external benchmarks. We report each label against its strongest baseline.