Madumita Karthikeyan, Umang Rajnikant Bid, Rong Pan
Real-world forecasting often requires integrating heterogeneous evidence whose predictive value varies across horizons, operating regimes, and domains. We introduce FACTS-MAS, a domain-agnostic multi-agent forecasting framework that decomposes evidence into specialized channels for temporal dynamics, exogenous context, seasonality, structural information, and discrete events. Each agent generates an independently testable forecast through a common interface, while leakage-safe historical validation measures its predictive skill relative to a naive reference. These skill estimates are used to weight and combine agent forecasts, so that uninformative evidence is either removed or downweighted rather than forced to participate. A calibration procedure selects domain-specific constant means based on historical validation folds. We evaluate FACTS-MAS on weekly for-sale housing inventory from Zillow and weekly unemployment insurance claims from FRED, for 15 U.S. metropolitan areas at 4-, 8-, and 13-week forecasting horizons. Our method outperforms both a naive last-value forecast method and the TimesFM foundation model. However, a factor-adjusted exponential smoothing model performs as well as the fused forecast. The evidence therefore supports FACTS-MAS as a systematic protocol for testing, calibrating, and recomposing evidence channels before assembling them into the strongest single model for a specific application domain. Code, data, and results are available at https://github.com/Madumita24/FACTS-MAS.
Kazi Amit Hasan, Enrong Pan, Yuan Tian, Mariam Guizani, Steven H. H. Ding
Open-source vulnerability mitigation spans upstream libraries and the downstream projects that depend on them. Upstream, a vulnerability progresses through a public report when one exists, a fix, a fixed release, and NVD disclosure. Downstream, a project mitigates it by adopting the fixed release, and the timeliness of this adoption is measured relative to these events. Prior work studies the two sides separately, so it is unclear whether downstream exposure stems from delayed upstream release, delayed downstream adoption, or both. We address this gap by following 832 CVEs in the Maven ecosystem from the upstream fix to its adoption by each exposed downstream project. We classify upstream fixes as \textit{silent} or \textit{transparent}, recover the order of report, fix, release, and NVD disclosure, and link vulnerable artifacts to their downstream dependents. We then compare this order with downstream adoption and dependabot usage. We find that delay arises on both sides. Upstream, the fixed release comes before NVD disclosure for about 82\% of CVEs, for both silent and transparent fixes. For the other 17.9\%, downstream projects have no fix to adopt for days to more than four months after disclosure. Downstream, exposure is concentrated, with the top 10\% of CVEs accounting for 72.1\% of it. Of 1,677 observed adoptions, 85.3\% happen after NVD disclosure, rising to 88.3\% for silent fixes released before disclosure. Most adoptions come through routine dependency updates. Adoptions with dependabot version updates have a median release-to-adoption delay of 10.4 days, compared with 110.6 days without dependabot. Yet version updates were configured at adoption time for only 8.5\% of total adoptions. We translate these findings into implications for upstream maintainers, downstream developers, and dependency-automation tools.