Conformal Risk Sharing: Certified Cost Allocation with Participation Guarantees
Ieva Kazlauskaite
arXiv:2606.06391v1 [stat.ML] 4 Jun 2026
Department of Statistics, London School of Economics and Political Science, United Kingdom
Abstract Sharing the financial impact of rare adverse events across a group can soften extreme individual burdens, but any participant made worse off by the arrangement has reason to leave. A credible mechanism must therefore provide each agent with a trustworthy cap on their future obligation and should be deployed only if the aggregate harm across participants is bounded. We formalise this as the Certified Allocation Problem: from finite data and without distributional assumptions, find a redistribution rule, produce obligation caps for every participant, and verify that no participant is made materially worse off. We propose Conformal Risk Sharing, which solves this problem by pairing an interpretable sharing policy with split conformal calibration. The sharing intensity is tuned on training data, while held-out calibration data produces distribution-free per-agent guarantees (valid under exchangeability). Experiments on synthetic and real-world data, including precipitation and energycooperative data, confirm that the framework can substantially reduce extreme obligations for highrisk agents while controlling harm to others.
1
INTRODUCTION
A recurring problem in multi-agent systems is the redistribution of realised costs under uncertainty. When a group of agents jointly faces random shocks, an allocation policy determines how the realised burden is shared. Effective pooling can reduce each agent’s exposure to extreme outcomes but it also creates winners and losers, and any agent made worse off has an incentive to defect. The challenge is therefore threefold: learn a policy that improves aggregate tail exposure from finite data, certify that the improvement holds with high confidence for each participant, and verify that
the policy respects explicit participation constraints. This problem arises naturally in several domains. In peer-topeer (P2P) parametric insurance, trigger events (e.g., rainfall exceeding a threshold) induce a vector of payouts across members, and the pooling rule determines how the resulting obligations are shared. Heavy tails, spatial dependence, and climate nonstationarity make parametric tail models unreliable [Grossi et al., 2005], while participation is voluntary: members who perceive that pooling increases their high-confidence obligation cap will leave, and the resulting adverse selection can unravel the pool [Kocherlakota, 1996, Ligon and Thistle, 2005]. Fairness is equally critical: if pooling systematically increases the upper bound on obligations of low-risk members, those members exit first, unravelling the pool (see Appendix A). In cooperative energy communities, households in a local energy cooperative share electricity costs, and each household requires a certified cap on its obligation to plan expenditure. In shared compute infrastructure, multiple tenants redistribute cloud-resource costs after demand is realised, and each tenant needs a certified spending cap for capacity planning. In each case, the essential structure is the same: a random cost vector must be redistributed under conservation, every agent needs an individual tail guarantee, and the mechanism must remain acceptable relative to a baseline option. We call this the Certified Allocation Problem and formalise it in Sec. 3. It sits at the intersection of cooperative cost sharing, distribution-free statistical inference, and mechanism design under uncertainty, none of which alone addresses all three requirements. Cooperative game theory and actuarial risk sharing [Denuit et al., 2022, Charpentier and Ratz, 2025] characterise fair and efficient allocations under known or assumed distributions, but do not produce finitesample tail certificates from data. Conformal prediction and distribution-free risk control [Vovk et al., 2005, Angelopoulos et al., 2024] provide finite-sample guarantees, but address single-agent prediction or decision problems rather than multi-agent redistribution with participation constraints. Distributionally robust and chance-constrained optimisation
[Campi and Garatti, 2011, Delage and Ye, 2010] provide feasibility guarantees for a single decision under uncertainty. The Certified Allocation Problem requires n simultaneous per-agent tail certificates, all depending on the same policy and coupled through a conservation constraint. This multiagent structure does not reduce to n independent chance constraints, since improving one agent’s obligation cap necessarily affects others. Conformal Risk Sharing. We propose Conformal Risk Sharing, a concrete solution framework for the Certified Allocation Problem. An interpretable linear sharing policy is tuned on training data, then certified once on held-out data via split conformal calibration. The result is a certified per-agent obligation cap with finite-sample, distributionfree validity: each participant receives a high-confidence upper bound on future obligation, without relying on parametric tail models. The mechanism may only be deployed if an explicit audit confirms that the certified caps satisfy a participation constraint bounding harm to each agent. Our main contributions are the following: 1. Problem formulation. We identify a gap at the intersection of cooperative cost sharing, conformal inference, and robust optimisation that no existing framework addresses. We formalise the Certified Allocation Problem (Sec. 3): jointly select a redistribution policy, produce per-agent distribution-free obligation caps, and verify participation constraints from finite data. 2. Solution framework. We propose Conformal Risk Sharing (Sec. 4), a train–select–certify pipeline that produces per-agent tail certificates (Theorem 1) and system-level guarantees (Corollary 1) via split conformal calibration, with participation constraints enforced directly in the certified quantities. 3. Empirical validation. On synthetic heavy-tailed data, gridded precipitation losses, and energy cooperative consumption (Sec. 5), the framework delivers certified tail relief while controlling harm and maintaining coverage at or near nominal levels.
2
RELATED WORK
We review related work in cooperative cost sharing, distribution-free inference, and optimisation under uncertainty, and clarify how the Certified Allocation Problem differs from each. Risk sharing, P2P insurance, and participation constraints. The actuarial literature studies risk-sharing rules under known or modelled distributions. Denuit et al. [2022] provide a systematic treatment of allocation rules (conditional mean, quantile) and their axiomatic properties; Charpentier and Ratz [2025] develop a comprehensive frame-
work for linear risk sharing on networks, including the same identity-mixing parameterisation that we adopt; and Feng et al. [2023] derive closed-form variance-minimising allocations. Throughout this literature, distributions are assumed known or estimated separately, and guarantees are expressed in terms of population quantities (means, variances, quantiles) rather than finite-sample certificates. Participation and stability are classical concerns: voluntary pooling can unravel if participants lack individual rationality guarantees [Kocherlakota, 1996, Ligon and Thistle, 2005], and modern P2P designs introduce cashback or side-payment rules to maintain incentives [Clemente et al., 2023]. Cooperative game theory formalises fairness in cost sharing through solution concepts such as the core, Shapley value, and nucleolus, which characterise stable and equitable allocations under known cost structures [see Moulin, 2002, for an overview]. Our participation constraints serve an analogous role but are expressed in certified tail quantities rather than population-level cost shares. Conformal prediction and risk control. Conformal prediction provides finite-sample, distribution-free coverage guarantees under exchangeability [Vovk et al., 2005, Shafer and Vovk, 2008, Angelopoulos and Bates, 2023]. Beyond marginal coverage, Conformal Risk Control [Angelopoulos et al., 2024] and related methods [Bates et al., 2021] extend these guarantees to user-chosen risk functionals. Our use differs from standard supervised prediction: the calibrated quantity is a post-decision random variable (per-agent obligation after applying an allocation rule), not a prediction error. A growing literature treats conformal outputs as inputs to downstream decisions [Vovk and Bendtsen, 2018, Renkema et al., 2024], and several works connect conformal sets to robust optimisation [Johnstone and Cox, 2021, Lekeufack et al., 2024, Patel et al., 2026]. These pipelines address single-agent or single-decision-vector optimisation problems. In the multi-agent setting, Kuipers et al. [2024] derive conformal joint prediction regions for agent trajectories under policy-induced distribution shift using reweighting ideas, which is related in spirit but targets off-policy trajectory forecasting rather than certified cost redistribution. End-to-end conformal risk training [Yeh et al., 2025a,b] differentiates through conformal objectives to shape decisions, but targets single-agent control with expressive uncertainty sets rather than multi-agent redistribution with participation constraints. Our framework embeds conformal calibration inside a decision pipeline, with a train–select–certify separation [Vovk and Bendtsen, 2018, Sarkar and Kuchibhotla, 2023, Hegazy et al., 2025]: all policy selection uses training/validation data, and calibration is used only once for the final certificate. DRO, chance constraints, and scenario optimisation. Chance-constrained optimisation, scenario methods, and distributionally robust optimisation (DRO) study decision-
making under uncertainty by selecting a policy that satisfies probabilistic or worst-case constraints under sampled scenarios or an ambiguity set [Campi and Garatti, 2011, Delage and Ye, 2010, Rahimian and Mehrotra, 2019]. Our setting differs in the object being certified: we require simultaneous per-agent tail certificates for all agents under a shared allocation policy, with agent outcomes coupled by conservation. In addition, participation is enforced by comparing each agent’s certified bound under pooling against their baseline bound, a structure with no standard counterpart in DRO or scenario formulations. Conformal inference under dependence and nonstationarity. In our settings, the data are temporally and/or spatially dependent, so we calibrate on coarse blocks (e.g., years) and assume block exchangeability. There is growing work extending conformal ideas beyond i.i.d. exchangeability [Chernozhukov et al., 2018, Oliveira et al., 2024], and methods that reweight or adapt calibration sets to account for temporal drift have been proposed for financial time series [Fantazzini, 2024, Schmitt, 2026]. We treat certificates as valid for blocks exchangeable with the calibration regime and recommend periodic re-certification under drift.
3
THE CERTIFIED ALLOCATION PROBLEM
We formalise the Certified Allocation Problem class introduced in Sec. 1. The setup requires guarantees derived directly from finite data without parametric assumptions, for a multi-agent redistribution policy subject to conservation and participation constraints. 3.1
SETUP
Consider n agents who collectively face a random nonnegative cost vector X̃ ∈ Rn+ drawn from an unknown distribution P . We observe B exchangeable realisations (“blocks”) of this vector, x̃1 , . . . , x̃B , where each block aggregates costs over a natural period (e.g., a year of parametric insurance payouts, a billing cycle of shared compute costs, or a settlement period in a cooperative energy community). Allocation policies. An allocation policy A maps a realised cost vector to a vector of obligations: xb (A) = x̃b A,
(1)
where A ∈ Rn×n acts P on the right so that agent i’s obligation is xb,i (A) = j x̃b,j Aji . We restrict attention to the feasible set of row-stochastic matrices, n o Pn A = A ∈ Rn×n : Aji ≥ 0 ∀ j, i, A = 1 ∀ j , i=1 ji (2)
which enforces nonnegativity of obligations and P conservaP tion of total cost within each block: i xb,i (A) = j x̃b,j .1 The baseline is the identity A0 = I, under which each agent bears their own realised cost. Per-agent risk quantities. Each agent cares about the severity of extreme obligations they may face under a given policy. For a given policy A, let Xi (A) denote agent i’s random obligation, and define ρi (A) as the (1−δ)-quantile of Xi (A), i.e. the smallest threshold exceeded with probability at most δ (sometimes called Value-at-Risk in the actuarial literature). The formulation extends to other tail risk measures (e.g., Conditional Value-at-Risk, expectiles), though certifying other choices requires different calibration procedures. The quantity ρi (A) is a population-level summary estimated from data, and the quality of the estimate depends on A since the policy transforms the underlying loss distribution. 3.2
REQUIREMENTS
Given a finite sample of B blocks, the mechanism seeks a policy A⋆ ∈ A together with per-agent caps ĉi (A⋆ ) satisfying the following requirements. (R1) Per-agent tail validity. Each certificate is a finitesample high-probability upper bound on the agent’s postallocation obligation: P Xi (A⋆ ) ≤ ĉi (A⋆ ) ≥ 1 − δ, i = 1, . . . , n, (3) without parametric assumptions on P . This provides every participant a legible guarantee: “with 1−δ confidence, your obligation will not exceed ĉi .” In P2P insurance this is a contribution cap, in energy communities it is a billing guarantee. (R2) Aggregate efficiency. The policy reduces an aggregate welfare objective relative to the baseline: Pn Φ(A⋆ ) < Φ(A0 ), Φ(A) := i=1 wi ĉi (A), (4) P where wi > 0 are weights (normalised to i wi = 1) that allow the mechanism to prioritise certain agents, e.g., uniformly (wi = 1/n) or proportional to baseline exposure. (R3) Participation (bounded harm). The total certified harm imposed on agents relative to the baseline is bounded. 1
P Row-stochasticity ( i Aji = 1 ∀j) ensures that each agent’s loss is fully distributed but it does not constrain how much total exposure each P agent receives. The stronger requirement of a doubly P stochastic A ( i Aji = 1 ∀j and j Aji = 1 ∀i) additionally preserves each agent’s expected cost [Abdikerimova and Feng, 2022]. Our framework accommodates either constraint; we use row-stochasticity as the default to allow heterogeneous pooling structures.
We require a budgeted harm constraint: Harm(A⋆ ) =
Table 1: Requirements addressed by existing frameworks. ✓ = addressed; × = not; ∼ = partially.
Pn
ĉi (A⋆ ) − ĉi (A0 ) − η + ≤ H, (5) with per-agent tolerance η ≥ 0 and total budget H = ε Φ(A0 ), a fraction ε ∈ [0, 1) of the baseline aggregate certified cost (the special case ε = 0 requires that no agent’s certified cap increases, which is typically infeasible with finite calibration samples). These are governance parameters, not statistical hyperparameters: η is a materiality threshold below which cap increases are ignored and ε controls how much redistribution the community tolerates. i=1 wi
R1 Tail R2 Effic. R3 Partic. a
Coop. games / actuarial Conformal decision-makingb DRO / scenario approachc This work a
3.3
CHALLENGES
✓ ✓ ✓ ✓
✓ × × ✓
Denuit et al. [2022], Charpentier and Ratz [2025], Feng et al. [2023], Kocherlakota [1996]. b Vovk et al. [2005], Johnstone and Cox [2021], Lekeufack et al. [2024]. c
3.4 (R4) Conservation. Total obligations equal total realised costs in every block, ensuring the mechanism neither creates nor destroys value. This is enforced by construction through the row-stochasticity constraint (2).
× ✓ ∼ ✓
Campi and Garatti [2011], Delage and Ye [2010].
POSITIONING RELATIVE TO EXISTING FRAMEWORKS
Table 1 summarises which requirements are addressed by existing frameworks. Conservation (R4) is enforced structurally and is therefore omitted from the comparison. Among the remaining requirements, no single framework covers all three; the Certified Allocation Problem requires their integration.
Three features distinguish the Certified Allocation Problem from related formulations.
4
Selection–certification coupling. The policy A⋆ determines the distribution of obligations, so the data used to select A⋆ also informs the certificates. In distribution-free approaches, adaptively choosing a decision based on calibration data can invalidate coverage guarantees [Vovk and Bendtsen, 2018, Hegazy et al., 2025], requiring careful separation of learning and certification. Parametric and Bayesian approaches avoid this issue but introduce dependence on model assumptions.
We now present a concrete solution to the Certified Allocation Problem based on split conformal prediction. Our approach combines an interpretable one-parameter linear policy class with distribution-free order-statistic certificates. The base pooling rule Ā encodes the structure of sharing and can itself be learned from data (Sec. 4.3); the scalar α controls the intensity of mutualisation and is selected by grid search subject to certified participation constraints. Alternative solution approaches (Bayesian, parametric) are discussed in Sec. 6.
Multi-agent coupling The conservaP through conservation. P tion constraint i xb,i (A) = x̃ means that in any j b,j given block, reducing one agent’s obligation necessarily increases another’s. When losses are largely independent, diversification can reduce tail exposure for all agents simultaneously; but under dependence, the gains are limited and improving one agent’s certified cap often comes at the cost of worsening another’s. This coupling between agents distinguishes the problem from single-agent robust optimisation, where the decision-maker can reduce their own uncertainty without affecting others. Heavy tails and small samples. In the motivating applications, block losses are heavy-tailed and the number of observed blocks B is small (tens to low hundreds). Parametric tail models are difficult to validate in this regime making distribution-free guarantees attractive, but at the cost of conservatism as distribution-free certificates from small B can be coarse. Moreover, the quality of these certificates depends on the chosen policy A (since A transforms the loss distribution), creating an interaction between policy selection and certificate tightness.
4.1
CONFORMAL RISK SHARING
POLICY CLASS
We parameterise the allocation as a convex combination of the identity (no pooling) and a base pooling rule Ā ∈ A, controlled by a single scalar mutualisation level α ∈ [0, 1]: A(α) = (1 − α) I + α Ā.
(6)
If both I and Ā are row-stochastic, so is A(α) for all α, and feasibility (2) is satisfied by construction. The policy has a contract-like interpretation: each agent retains a (1−α) fraction of their own cost and routes an α fraction through the pooling mechanism. This interpretability is deliberate: in insurance and cost-sharing agreements, policies must be auditable and comprehensible. The base rule Ā encodes the structure of sharing (who pools with whom) and may be either fixed by design or learned from data. Fixed choices include a uniform pool (Āji = 1/n), a locality kernel on a spatial grid, or a sparse
neighbourhood rule. Alternatively, Ā can be estimated from training data; for example, the variance-optimal doublystochastic baseline (VO-DS) selects Ā by minimising a quadratic variance proxy under fairness constraints (Appendix B.2). When Ā is data-driven it is fitted in Stage 1 of Algorithm 1 before α selection. The scalar α then controls the intensity of sharing: this separation allows domain experts or data-driven methods to design Ā while the certification layer tunes α subject to participation constraints. VO-DS targets variance rather than tail risk; within our framework it inherits a distribution-free certification layer. 4.2
CONFORMAL CERTIFICATES
We partition the B observed blocks into training T , validation V, and calibration C (with |C| = m). When nonstationarity is a concern, blocks are partitioned in temporal order so that C is as close as possible to the deployment period (Appendix B.1). For any fixed policy A, we construct the per-agent certificates ĉi (A) required by R1 as order statistics of the calibration obligations: ĉi (A) = k-th order statistic of {xb,i (A)}b∈C , k = ⌈(m + 1)(1 − δ)⌉.
(7)
Under block exchangeability between C and a fresh block, P (Xi (A) ≤ ĉi (A)) ≥ 1 − δ for each agent i (Theorem 1). The selection procedure P(Sec. 4.3) minimises the aggregate certified cost Φ(A) = i wi ĉi (A) to target efficiency (R2), while the participation constraints R3 are enforced by comparing ĉ(A⋆ ) to the baseline ĉ(A0 ) via (5). If no feasible policy improves on the baseline, the method transparently reverts to A0 = I. 4.3
TRAIN–SELECT–CERTIFY PROTOCOL
The non-differentiability of the conformal map A 7→ c(A) and the need to preserve calibration validity motivate a threestage protocol (Algorithm 1). Stage 1: Policy-class fitting (T ). If the base rule Ā is datadriven (e.g., the variance-optimal doubly-stochastic baseline of Appendix B.2), it is estimated on T . When Ā is fixed by design (e.g., uniform pooling or a predetermined locality kernel), this stage is skipped and T may be merged into V. Stage 2: Mutualisation selection (V). For each α on a grid over [0, 1], we estimate the per-agent risk quantity ρi (A(α)) by its empirical counterpart on V, hence ρ̂V i (α) is the empirical (1−δ)-quantile of agent i’s post-sharing obligations {xb,i (α)}b∈V . We then compute proxy harm: Harmproxy (α) =
n X i=1
V wi ρ̂V i (α) − ρ̂i (0) − η + .
(8)
Algorithm 1: Conformal Risk Sharing: Train–Select– Certify Input: Blocks {x̃b }B b=1 ; base rule Ā (or specification to learn it); miscoverage δ; weights w; tolerance η; budget fraction ε. Output: Deployed policy Aop and certificates c(Aop ). Partition blocks into T , V, C; // Stage 1: Fit policy class on T (skip if Ā is fixed)
// Stage 2: Select α on V for α in grid over [0, 1] do Compute proxy risk ρ̂V i (α) and proxy harm (8); P α⋆ ← best feasible α (lowest i wi ρ̂V i (α), proxy harm ≤ budget); A⋆ ← (1 − α⋆ )I + α⋆ Ā; // Stage 3: Certify on C ĉ0 ← ConfCaps(C, I, δ); ĉ⋆ ← ConfCaps(C, A⋆ , δ); P Harm ← i wi (ĉ⋆i − ĉ0,i − η)+ ; // Operational audit if Harm ≤ ε⟨w, ĉ0 ⟩ then return (A⋆ , ĉ⋆ ) ; // Deploy candidate else return (I, ĉ0 ) ; // Revert to baseline
Here ρ̂V i (0) denotes the baseline empirical risk evaluated at α = 0 (the identity policy A0 = I, under which each agent their own cost). We retain the α⋆ minimising P bears V i wi ρ̂i (α) subject to Harmproxy (α) ≤ Hproxy , where Hproxy = ε ΦV (A0 ) is the proxy analogue of the harm budget (5) with Φ(·) as in (4). No certification claims are made at this stage. Stage 3: One-shot certification (C). We fix A⋆ = A(α⋆ ), compute conformal caps c(A⋆ ) and c(A0 ) on the untouched calibration set via (7), and evaluate the certified harm constraint (5). If the constraint holds, A⋆ is deployed; otherwise the operator reverts to A0 = I. This is an operational audit, not a statistical selection step: the certificate remains valid regardless of the deployment decision. What is (and is not) guaranteed. The certificate (7) provides a marginal, per-agent guarantee: each ĉi (A⋆ ) controls agent i’s obligation with probability at least 1−δ over a fresh exchangeable block. It does not imply the joint statement P (∀i : Xi (A⋆ ) ≤ ĉi (A⋆ )) ≥ 1−δ; for system-level solvency we provide a separate certificate (Corollary 1). The calibration set C is used exactly once for a pre-specified A⋆ ; the subsequent deployment decision does not invalidate the certificate.
4.4
RARE-EVENT DEGENERACY
In zero-inflated data (where many peers have no triggers in the calibration window), the baseline cap ĉ0,i can be zero, causing the harm budget H = ε⟨w, ĉ0 ⟩ to vanish and the acceptability gate to reject any pooling. To prevent this, we impose a minimum capital floor cmin > 0, replacing both candidate and baseline by max{ĉi (A), cmin } componentwise. Since the floor only increases caps, coverage validity is preserved. In all experiments we set cmin to a small fraction (1%) of the median nonzero loss, treating it as an operational minimum capital requirement: no agent should plan with zero reserves against tail events. 4.5
GUARANTEES
Theorem 1 (Per-agent tail certificate). Fix i ∈ {1, . . . , n} and δ ∈ (0, 1). Let T , V, C partition the observed blocks with |C| = m, and let A⋆ be any allocation constructed from the training and validation blocks {X̃b }b∈T ∪V (and, optionally, algorithmic randomness independent of the data), using no information from C. Assume that the calibration blocks {X̃b }b∈C together with a fresh block X̃new are exchangeable, conditional on A⋆ .2 Define ĉi (A⋆ ) as the k-th order statistic of {Xb,i (A⋆ )}b∈C with k = ⌈(m+1)(1−δ)⌉. Then P Xnew,i (A⋆ ) ≤ ĉi (A⋆ ) ≥ 1 − δ. (9) Proof. Conditioning on A⋆ , the m + 1 values {Xb,i (A⋆ )}b∈C ∪ {Xnew,i (A⋆ )} are exchangeable by assumption and the rank of Xnew,i (A⋆ ) among all m + 1 values is uniform on {1, . . . , m + 1}.3 Since ĉi (A⋆ ) is the k-th smallest of the m calibration values, at most m − k of the m + 1 exchangeable values can exceed it. Hence Xnew,i (A⋆ ) exceeds ĉi (A⋆ ) with probability at most (m − k + 1)/(m + 1) ≤ δ, giving P (Xnew,i (A⋆ ) ≤ ĉi (A⋆ ) | A⋆ ) ≥ 1 − δ for any fixed A⋆ , implying (9). Theorem 1 provides R1 of the Certified Allocation Problem. Two remarks clarify the scope: (i) Marginal, not joint. The guarantee (9) is per-agent and does not imply the simultaneous statement P (∀i : Xi (A⋆ ) ≤ ĉi (A⋆ )) ≥ 1 − δ. For system-level solvency, Corollary 1 provides a separate certificate. (ii) Operational audit. The subsequent decision to deploy A⋆ or revert to A0 based on the harm budget does not invalidate the certificate, since A⋆ was fixed before observing C. The deploy/revert step is a governance decision informed by a valid statistical audit. 2 This holds if (X̃1 , . . . , X̃B , X̃new ) are exchangeable at the block level and A⋆ uses no information from C. 3 When ties occur, the rank is defined by uniform random tiebreaking; without tie-breaking the bound still holds since ties increase ĉi (A⋆ ).
Corollary 1 (System-level certificate). Under the assumpn tions of Theorem P 1, let g : R+ → R be any scalar functional (e.g., g(x) = i xi for aggregate cost or g(x) = maxi xi for the largest realised obligation across agents) fixed prior to observing C. Let Γ(A⋆ ) be the k-th order statistic of {g(Xb (A⋆ ))}b∈C with k = ⌈(m + 1)(1 − δ)⌉. Then P g(Xnew (A⋆ )) ≤ Γ(A⋆ ) ≥ 1 − δ. (10) The proof is identical to Theorem 1, applied to the scalar scores Sb = g(Xb (A⋆ )).
5
EXPERIMENTS
We evaluate Conformal Risk Sharing on synthetic heavytailed data (Sec. 5.1), gridded precipitation losses (Sec. 5.2), and electricity consumption of an energy cooperative (Sec. 5.3)4 . In each case we ask whether: (i) the conformal certificates maintain valid coverage (R1)? (ii) the learned policy reduces aggregate certified tail exposure (R2)? (iii) the certified harm is controlled within the participation budget (R3)? 5.1
SYNTHETIC DATA
We generate B i.i.d. blocks (years) with n peers on a grid. Each block is an event year with probability pevent ; on event years, peer losses are products of a heavy-tailed (Pareto) year severity, peer-specific lognormal exposures, and spatially correlated hit indicators drawn from a logistic model. The resulting loss vectors are nonnegative, heavy-tailed, and strongly zero-inflated (Appendix C.1). We compare three base rules: global-uniform pooling (Ā = 11⊤ /n), local pooling (neighbourhood averaging on the grid), and a datadriven variance-optimal doubly-stochastic baseline (VODS; Appendix B.2). All experiments use δ = 0.10 (nominal 90%), η = 0, and ε = 0.20. We report: (a) the empirical per-agent marginal coverage aggregated across all test blocks and splits (mean and 5th percentile across peers); (b) AggCapRatio = ⟨w, cop ⟩/⟨w, c0 ⟩, measuring aggregate certified-cap reduction (lower is better); (c) Top10 cap, the cap ratio restricted to the top decile of agents by baseline cap (targeting relief for the highestrisk agents); and (d) PASS rate, the fraction of splits where the candidate survives the certified acceptability audit. All coverage and cap metrics are reported for the operational policy Aop , which equals the candidate A⋆ on PASS splits and reverts to identity on FAIL splits. Metrics are defined in Appendix C.2. Table 2 reports results under random splits. Empirical peragent coverage is near nominal across pooling families and 4
Code available at https://github.com/ IevaKazlauskaite/conformal-risk-sharing
Global Local VO-DS Identity
PASS
αop
0.77 0.77 0.77 –
0.14±0.29 0.10±0.24 0.14±0.29 0
Cov (p05)
AggCap
Top10
0.910 (0.900) 0.970±0.070 0.907±0.198 0.909 (0.897) 0.984±0.044 0.939±0.148 0.910 (0.900) 0.970±0.070 0.907±0.198 0.910 (0.899) – –
Table 2: Synthetic, random splits (δ = 0.1, η = 0, ε = 0.2, nC = 100, 100 splits). Cov: mean per-agent marginal coverage (5th percentile). AggCap/Top10: certified-cap ratios vs. identity (lower = better).
Global Local VO-DS Identity
PASS
αop
1.00 1.00 1.00 –
0.08±0.26 0.05±0.17 0.08±0.26 0
Cov (p05)
AggCap
Top10
0.910 (0.884) 0.978±0.073 0.946±0.179 0.910 (0.883) 0.988±0.039 0.968±0.107 0.910 (0.884) 0.978±0.073 0.946±0.179 0.911 (0.884) – –
Table 3: Synthetic, time-ordered splits (δ = 0.1, η = 0, ε = 0.2, nC = 100, 12 splits).
identity (mean ≈ 0.91; 5th percentiles at or above 0.90), consistent with the intended conformal validity guarantee (R1). Global pooling achieves the largest certified relief for high-risk agents (Top10 ratio 0.907, i.e., ≈9% tail capital reduction), while local pooling delivers more modest gains (Top10 0.939) (R2). The PASS rate of 0.77 for both families indicates that the certification gate rejects roughly one quarter of candidate policies, confirming that the participation constraint is active (R3). The relatively large standard deviations on the cap ratios reflect split-level variability: on FAIL splits the method reverts to identity (ratio = 1), while on PASS splits the candidate delivers meaningful relief. Table 3 repeats the analysis under time-ordered splits. Coverage degrades slightly (p05 drops to 0.884), but identity degrades identically, confirming a nonstationarity effect rather than a method failure. The PASS rate increases to 1.00 because the method selects conservative mutualisation levels under temporal ordering, easily fitting within the harm budget. Certified relief is correspondingly modest.
5.2
E-OBS PRECIPITATION
We use E-OBS daily gridded rainfall over a Central European region (lat 40–50◦ , lon 5–12◦ ), with n = 1120 grid cells observed over B = 75 annual blocks (1950 2024) [C3S, 2025, Cornes et al., 2018]. To mirror a parametric insurance design, we define a binary cold-season trigger: a unit payout is recorded whenever the Oct–Mar rainfall total exceeds a threshold u = 40 (chosen to yield a median per-cell annual trigger rate of ≈ 11%, with substantial crosscell heterogeneity). The resulting block losses are heavytailed and highly zero-inflated (zero fraction ≈ 0.78), with substantial spatial dependence. We use δ = 0.10, η = 0, ε = 0.20 and report results under 50 random splits with nC = 35 calibration and ntest = 5 test blocks per split.
Global Local VO-DS Identity
PASS
αop
0.98 1.00 0.98 –
0.56±0.10 1.00±0.00 0.57±0.10 0
Cov (p05)
AggCap
Top10
0.919 (0.896) 0.726±0.047 0.506±0.087 0.946 (0.904) 0.895±0.012 0.695±0.022 0.920 (0.900) 0.718±0.047 0.493±0.088 0.972 (0.932) – –
Table 4: E-OBS precipitation, random splits (n = 1120 peers, B = 75 years, δ = 0.1, ε = 0.2, nC = 35, 50 splits). Table 4 reports coverage and utility for global-uniform and local pooling. Both families pass the certified audit in nearly all splits (PASS ≥ 0.98), confirming that the harm budget is not overly restrictive. Global pooling delivers substantial certified relief: a 27% reduction in aggregate certified caps (AggCap 0.726) and nearly 50% reduction for the highest-risk decile (Top10 0.506), demonstrating strong performance on R2. Coverage remains near-nominal (mean 0.919, p05 0.896), though closer to the boundary than identity, reflecting the cost of redistributing tail exposure. Local pooling is more conservative: it achieves moderate relief (AggCap 0.895, Top10 0.695) with higher empirical coverage (mean 0.946, p05 0.904), illustrating the safety-utility trade-off inherent in the Certified Allocation Problem. Broader pooling extracts more diversification but pushes coverage closer to nominal for some agents; local pooling sacrifices efficiency for empirical conservatism under spatial dependence. To stress-test robustness to temporal drift, we repeat the analysis with time-ordered splits and vary the calibration length nC ∈ {10, 20, 30, 40, 50} (Table 5). Blocks are partitioned temporally (Appendix B.1). For global pooling, increasing nC worsens out-of-window coverage (mean drops from 0.868 to 0.742; p05 from 0.745 to 0.564), consistent with a bias-variance trade-off under drift: larger calibration windows reduce quantile variance but incorporate data from earlier, less representative periods. Local pooling is more robust, maintaining higher coverage across all nC . Importantly, identity caps also degrade under time splits (Appendix C.4), confirming that this is a genuine nonstationarity effect rather than a method failure: over 1950–2024, both trigger rates and conditional severity exhibit statistically significant upward trends, with aggregate losses increasing by roughly 50% between the first and second halves of the record (Appendix C.5). Hence, conformal certificates may require periodic re-certification. 5.3
ENERGY COOPERATIVE
To demonstrate generality beyond climate insurance, we apply the framework to an electricity consumption dataset from a Portuguese energy cooperative (CEL Loureiro) comprising n = 153 households observed over B = 69 weekly blocks (May 2022–September 2023) [Monteiro et al., 2024]. We define each household’s weekly loss as the excess consumption above a rolling seasonal baseline (9-week centered median), removing seasonal effects so that blocks are ap-
nC PASS Mean
p05
Min
Fr<.9
Global
10 20 30 40 50
0.91 0.91 1.00 1.00 1.00
0.868 0.800 0.756 0.762 0.742
0.745 0.709 0.600 0.600 0.564
0.600 0.509 0.491 0.400 0.345
0.836 0.796 0.874 0.820 0.854
Global (ε = 0.05) Global (ε = 0.20) VO-DS (ε = 0.05) VO-DS (ε = 0.20) Identity
Local
10 20 30 40 50
1.00 1.00 1.00 1.00 1.00
0.919 0.908 0.893 0.882 0.868
0.782 0.727 0.691 0.618 0.600
0.545 0.545 0.527 0.473 0.382
0.333 0.383 0.411 0.429 0.466
Table 6: Energy cooperative, random splits (n = 153 households, B = 69 weeks, δ = 0.1, η = 0, nC = 35, 50 splits). Participation budgets ε illustrate efficiency-harm trade-off.
Table 5: E-OBS time-ordered splits, varying nC (ntest = 5). Fr<.9: fraction of agents below nominal.
proximately exchangeable. The resulting losses are continuous, heavy-tailed, and moderately zero-inflated (zero fraction 0.58). Unlike the E-OBS precipitation data, pairwise correlations across households are weak and unstructured (Appendix C.8), reflecting largely idiosyncratic demand shocks. The observation window B is too short for meaningful time-ordered splits in our split configuration, and we find no significant nonstationarity in the deseasonalised losses, so random splits are appropriate. We report results under 50 splits with nC = 35, ntest = 5, and global-uniform pooling at two participation budgets. Table 6 reports results for ε = 0.05 (tight budget) and ε = 0.20 (permissive). Coverage is near-nominal in both cases, consistent with the identity baseline (R1). The participation budget ε directly controls the deployed mutualisation level: at ε = 0.05, the method selects αop = 0.31 and delivers a 20% aggregate cap reduction (AggCap 0.795; Top10 ratio 0.719); at ε = 0.20, it selects αop = 0.93 and delivers a 51% aggregate reduction with 82% reduction in certified caps for the highest-demand decile (Top10 0.180) (R2). The PASS rate is 1.00 at both levels, indicating that pooling benefits nearly all households simultaneously: the weak dependence structure means global averaging rarely harms any individual agent, so the harm constraint is slack (R3). This contrasts with the E-OBS setting, where spatially structured correlations cause pooling to harm some agents and the certification gate rejects a fraction of candidates. In all datasets, VO-DS produces a base rule close to global, reflecting the approximately symmetric dependence structure (Appendix B.2). Additional sensitivity analyses over the participation budget ε and target miscoverage level δ are reported in Appendix C.9. The results exhibit the expected monotone efficiency–conservatism tradeoffs while maintaining near-nominal coverage.
6
DISCUSSION AND CONCLUSION
We introduced the Certified Allocation Problem, requiring joint policy selection, per-agent obligation caps, and participation verification from finite data. We proposed Conformal Risk Sharing as the first solution framework, demon-
PASS
αop
Cov (p05)
AggCap
Top10
1.00 1.00 1.00 1.00 –
0.31±0.08 0.93±0.10 0.32±0.08 0.94±0.09 0
0.914 (0.886) 0.914 (0.900) 0.913 (0.882) 0.915 (0.900) 0.914 (0.884)
0.795±0.048 0.492±0.058 0.787±0.048 0.490±0.057 –
0.719±0.070 0.180±0.079 0.708±0.070 0.175±0.075 –
strating on synthetic and real data that it delivers substantial tail relief for high-risk peers, and harm control within explicit participation budgets. The conformal certificate provides marginal, per-agent control of tail exceedance under block exchangeability. This yields finite-sample validity without parametric assumptions, but can be conservative when calibration blocks are few. Additionally, the guarantee is tied to block exchangeability; in practice this motivates periodic re-certification as new blocks arrive. Limitations. The one-parameter policy class is interpretable and auditable but limits expressiveness. The conformal guarantee is marginal per agent and does not imply joint coverage across agents. Corollary 1 provides a separate system-level certificate for user-chosen system-level functionals. Under strong dependence, participation constraints may be infeasible; in such cases the method transparently reports that material improvement is unattainable within the tested policy class at the requested safety level. Finally, nonlinear mechanisms (e.g., deductibles) may be more capitalefficient in some regimes but are not covered by the current linear model. Future work. The Certified Allocation Problem admits solutions beyond conformal prediction. A Bayesian approach could regularise estimation in the small-sample regime through informative priors, but the resulting certificates are credible intervals whose coverage depends on correct prior specification rather than holding distribution-free as in the conformal case. A hierarchical Bayesian model across agents could exploit the spatial/cooperative structure (shared hyperparameters across agents) to produce tighter per-agent certificates. Parametric approaches (e.g., extreme value theory, copula models) could estimate tail quantities under distributional assumptions, providing efficiency when models are well-specified but lacking distribution-free validity. Investigating these alternatives is a direction for future work. Several extensions of the framework merit investigation. Richer policy classes: parameterising the base rule Ā itself (e.g., via a learned kernel bandwidth or sparse graph weights) would move from a scalar to a low-dimensional search while preserving interpretability, and the conformal certificate remains valid for any policy fixed before calibration. Operationally, this may include layered insurance rules
with deductibles, and cashback thresholds parameterised by a small number of tunable parameters. Feature-conditional certificates: replacing unconditional conformal caps with conformalised quantile regression [Romano et al., 2019] could yield tighter, covariate-adaptive certificates when side information (climate indices, exposure features) is available. Dynamic and multiperiod settings: extending the framework to sequential certification, where the calibration window rolls forward and agents may enter or leave the pool, connects to online conformal prediction [Oliveira et al., 2024] and multiperiod P2P insurance models [Abdikerimova et al., 2024]. References Samal Abdikerimova and Runhuan Feng. Peer-to-peer multirisk insurance and mutual aid. European Journal of Operational Research, 299(2):735–749, 2022. Samal Abdikerimova, Tim J Boonen, and Runhuan Feng. Multiperiod peer-to-peer risk sharing. Journal of Risk and Insurance, 91(4):943–982, 2024. Anastasios Angelopoulos, Stephen Bates, Adam Fisch, Lihua Lei, and Tal Schuster. Conformal risk control. In International conference on learning representations, volume 2024, pages 55198–55218, 2024. Anastasios N Angelopoulos and Stephen Bates. Conformal prediction: A gentle introduction. Foundations and Trends in Machine Learning, 16(4):494–591, 2023. Stephen Bates, Anastasios Angelopoulos, Lihua Lei, Jitendra Malik, and Michael Jordan. Distribution-free, risk-controlling prediction sets. Journal of the ACM (JACM), 68(6):1–34, 2021. C3S. Copernicus climate change service, climate data store, (2020): E-obs daily gridded meteorological data for europe from 1950 to present derived from in-situ observations. copernicus climate change service (C3S) climate data store (CDS), 2025. Accessed on 01-12-2025. Marco C Campi and Simone Garatti. A sampling-anddiscarding approach to chance-constrained optimization: feasibility and optimality. Journal of optimization theory and applications, 148(2):257–280, 2011. Arthur Charpentier and Philipp Ratz. Linear risk sharing on networks. arXiv preprint arXiv:2509.21411, 2025. Arthur Charpentier, Lariosse Kouakou, Matthias Löwe, Philipp Ratz, and Franck Vermet. Collaborative insurance sustainability and network structure. arXiv preprint arXiv:2107.02764, 2021. Victor Chernozhukov, Kaspar Wüthrich, and Zhu Yinchu. Exact and robust conformal inference methods for predictive machine learning with dependent data. In Sébastien
Bubeck, Vianney Perchet, and Philippe Rigollet, editors, Proceedings of the 31st Conference On Learning Theory, volume 75 of Proceedings of Machine Learning Research, pages 732–749. PMLR, 2018. Gian Paolo Clemente, Susanna Levantesi, and Gabriella Piscopo. Optimal cashback in a cooperative framework for peer-to-peer insurance coverages. Annals of Operations Research, pages 1–13, 2023. Gian Paolo Clemente, Susanna Levantesi, Gabriella Piscopo, et al. Risk sharing rule and safety loading in a peer to peer cooperative insurance model. Decisions in Economics and Finance, (A):N–A, 2024. Richard C Cornes, Gerard Van Der Schrier, Else JM Van Den Besselaar, and Philip D Jones. An ensemble version of the e-obs temperature and precipitation data sets. Journal of Geophysical Research: Atmospheres, 123(17): 9391–9409, 2018. Erick Delage and Yinyu Ye. Distributionally robust optimization under moment uncertainty with application to data-driven problems. Operations research, 58(3):595– 612, 2010. Michel Denuit and Jan Dhaene. Convex order and comonotonic conditional mean risk sharing. Insurance: Mathematics and Economics, 51(2):265–270, 2012. Michel Denuit, Jan Dhaene, and Christian Y Robert. Risksharing rules and their properties, with applications to peer-to-peer insurance. Journal of Risk and Insurance, 89(3):615–667, 2022. Jan Dhaene, Rodrigue Kazzi, and Emiliano A Valdez. Axiomatic characterizations of certain simple risk-sharing rules. Risk Sciences, page 100027, 2025. Dean Fantazzini. Adaptive conformal inference for computing market risk measures: An analysis with four thousand crypto-assets. Journal of Risk and Financial Management, 17(6):248, 2024. Runhuan Feng. Decentralized insurance. In Decentralized Insurance: Technical Foundation of Business Models, pages 119–139. Springer, 2023. Runhuan Feng, Chongda Liu, and Stephen Taylor. Peer-topeer risk sharing with an application to flood risk pooling. Annals of Operations Research, 321(1):813–842, 2023. Patricia Grossi, Howard Kunreuther, and Chandu C Patel. Catastrophe modeling: a new approach to managing risk, volume 25. Springer Science & Business Media, 2005. Mahmoud Hegazy, Liviu Aolaritei, Michael I. Jordan, and Aymeric Dieuleveut. Valid selection among conformal sets. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025.
Chancellor Johnstone and Bruce Cox. Conformal uncertainty sets for robust optimization. In Conformal and Probabilistic Prediction and Applications, pages 72–90. PMLR, 2021.
Siddhaarth Sarkar and Arun Kumar Kuchibhotla. Postselection inference for conformal prediction: Trading off coverage for precision. arXiv preprint arXiv:2304.06158, 2023.
Narayana R Kocherlakota. Implications of efficient risk sharing without commitment. The Review of Economic Studies, 63(4):595–609, 1996.
Marc Schmitt. Taming tail risk in financial markets: Conformal risk control for nonstationary portfolio var. arXiv preprint arXiv:2602.03903, 2026.
Tom Kuipers, Renukanandan Tumu, Shuo Yang, Milad Kazemi, Rahul Mangharam, and Nicola Paoletti. Conformal off-policy prediction for multi-agent systems. In 2024 IEEE 63rd Conference on Decision and Control (CDC), pages 1067–1074. IEEE, 2024.
Glenn Shafer and Vladimir Vovk. A tutorial on conformal prediction. Journal of Machine Learning Research, 9(3), 2008.
Jordan Lekeufack, Anastasios N Angelopoulos, Andrea Bajcsy, Michael I Jordan, and Jitendra Malik. Conformal decision theory: Safe autonomous decisions from imperfect predictions. In 2024 IEEE International Conference on Robotics and Automation (ICRA), pages 11668–11675. IEEE, 2024. James A Ligon and Paul D Thistle. The formation of mutual insurers in markets with adverse selection. The Journal of Business, 78(2):529–556, 2005.
Emanuel Stoeckli, Christian Dremel, and Falk Uebernickel. Exploring characteristics and transformational capabilities of insurtech innovations to understand insurance value creation in a digital world. Electronic markets, 28: 287–305, 2018. Swiss Re. Parametric insurance – a long history, a bright future. https://corporatesolutions. swissre.com/insights/knowledge/ evolution-of-parametric-insurance. html, 2024. Accessed: 2024-01-07.
Francisco Monteiro, Rafael Oliveira, João Almeida, Pedro Gonçalves, Paulo Bartolomeu, Jorge Neto, and Ricardo Deus. Electricity consumption dataset of a local energy cooperative, 2024.
Vladimir Vovk and Claus Bendtsen. Conformal predictive decision making. In Proceedings of the Seventh Workshop on Conformal and Probabilistic Prediction and Applications, volume 91 of Proceedings of Machine Learning Research, pages 52–62. PMLR, 11–13 Jun 2018.
Hervé Moulin. Chapter 6 axiomatic cost and surplus sharing. In Handbook of Social Choice and Welfare, volume 1 of Handbook of Social Choice and Welfare, pages 289–357. Elsevier, 2002.
Vladimir Vovk, Alexander Gammerman, and Glenn Shafer. Algorithmic learning in a random world, volume 29. Springer, 2005.
Roberto I Oliveira, Paulo Orenstein, Thiago Ramos, and Joao Vitor Romano. Split conformal prediction and nonexchangeable data. Journal of Machine Learning Research, 25(225):1–38, 2024.
Christopher Yeh, Nicolas Christianson, Adam Wierman, and Yisong Yue. Conformal risk training: End-to-end optimization of conformal risk control. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025a.
Yash Patel, Sahana Rayan, and Ambuj Tewari. Conformal robust control of linear systems. In The 29th International Conference on Artificial Intelligence and Statistics, 2026. Hamed Rahimian and Sanjay Mehrotra. Distributionally robust optimization: A review. arXiv preprint arXiv:1908.05659, 2019. Yvet Renkema, Nico Brinkel, and Tarek Alskaif. Conformal prediction for stochastic decision-making of pv power in electricity markets. Electric Power Systems Research, 234:110750, 2024. Yaniv Romano, Evan Patterson, and Emmanuel Candes. Conformalized quantile regression. In H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché-Buc, E. Fox, and R. Garnett, editors, Advances in Neural Information Processing Systems, volume 32. Curran Associates, Inc., 2019.
Christopher Yeh, Nicolas Christianson, Alan Wu, Adam Wierman, and Yisong Yue. End-to-end conformal calibration for optimization under uncertainty. Transactions on Machine Learning Research, 2025b.
Conformal Risk Sharing: Certified Cost Allocation with Participation Guarantees (Supplementary Material)
Ieva Kazlauskaite Department of Statistics, London School of Economics and Political Science, United Kingdom
A
P2P PARAMETRIC INSURANCE: BACKGROUND AND MOTIVATION
This appendix provides additional context on the peer-to-peer parametric insurance application that serves as one of the motivating examples throughout the paper. Parametric insurance. A parametric insurance product triggers a fixed payout when an independently verifiable index crosses a predetermined threshold (e.g., rainfall exceeding a level, wind speed above a limit, a seismic intensity measure, or a commodity price index, all of which can be verified by independent institutions/providers), rather than indemnifying individually assessed losses [Swiss Re, 2024]. This design reduces administrative overhead, eliminates the need for claims adjustment, and enables rapid, transparent settlement. However, sustainability still depends on effective risk pooling, which is challenging when trigger events are correlated across policyholders and when the underlying hazard distribution may shift over time. Peer-to-peer risk sharing. Peer-to-peer (P2P) insurance decentralises risk pooling: participants collectively fund losses within a network rather than transferring risk to a corporate insurer in exchange for premiums [Feng, 2023, Stoeckli et al., 2018]. The model distributes financial responsibility across participants, reducing overhead and aligning incentives (members share surpluses via cashback and bear shortfalls collectively). This structure is particularly relevant in settings where traditional insurers have withdrawn due to high risk or where premiums are prohibitively high, leaving protection gaps that decentralised pools can partially fill. What makes P2P mechanism design hard. Traditional insurance relies on centralised capital: reserves and reinsurance absorb tail outcomes, and the law of large numbers makes per-policy costs predictable at scale. P2P schemes are typically capital-light, with limited central reserves and continued reliance on a heterogeneous membership. This creates a distinct design constraint: the mechanism must not only be balanced in expectation, but must also control extreme contribution outcomes. Three challenges are particularly salient: • Heavy tails and dependence. Trigger events can produce correlated payouts across many members simultaneously (e.g., a regional storm or a market-wide shock), concentrating burden and limiting the diversification benefit of pooling. • Voluntary participation. Members who perceive their worst-case obligation as too high will leave, and selective exit by low-risk members can unravel the pool through adverse selection [Kocherlakota, 1996, Ligon and Thistle, 2005]. • Fairness and transparency. If the mechanism systematically shifts tail burden onto a subset of members to subsidise others, those members exit first, undermining the pool both ethically and practically. These challenges motivate the Certified Allocation Problem formalised in Sec. 3: the mechanism designer needs per-agent tail certificates (R1) to assure participants of bounded exposure, aggregate efficiency (R2) to justify the existence of the pool, and explicit participation constraints (R3) to prevent the adverse selection spiral.
Connection to our framework. In our experiments (Sec. 5.2), we instantiate this setting using gridded precipitation data with a parametric seasonal rainfall trigger as a concrete example. Each grid cell corresponds to a peer, each year is a block, and the trigger produces nonnegative, heavy-tailed, zero-inflated loss vectors. The allocation matrix A⋆ determines how realised payouts are redistributed, the conformal certificate ci (A⋆ ) provides each peer with a high-confidence obligation cap, and the participation constraints control the aggregate harm. The framework itself is agnostic to the specific trigger or hazard type. A.1
ADDITIONAL ACTUARIAL REFERENCES
This appendix provides additional context for readers from actuarial science and insurance, complementing the shorter discussion in Sec. 2. The main distinction is that much of the actuarial risk-sharing literature studies population-level allocation rules under known or modelled loss distributions, whereas our focus is finite-sample, distribution-free certification of a selected allocation policy. Distribution-dependent risk-sharing rules. A central class of actuarial mechanisms allocates losses as functions of the aggregate pool loss [Denuit and Dhaene, 2012, Denuit et al., 2022, Dhaene et al., 2025]. These rules have attractive axiomatic and Pareto-efficiency properties, but require knowledge of the joint distribution, conditional expectations, or conditional quantiles. In contrast, the Certified Allocation Problem assumes only finitely many observed cost vectors and asks for data-derived caps with finite-sample validity. Participation, cashback, and incentives. P2P and mutual insurance designs often introduce cashback, side payments, or Shapley-value allocations to maintain participation incentives [Clemente et al., 2023, 2024]. These mechanisms usually express individual rationality in expected-value or surplus-sharing terms. Our participation constraints play a related role, but are enforced in certified tail-cap units: the mechanism is deployed only if the certified harm relative to the identity baseline is below the chosen budget. Strategic behaviour and moral hazard are not modelled here; incorporating them would require an additional incentive-compatibility layer. Dynamic and multiperiod settings. Multiperiod P2P insurance models study reserves, solvency, reinsurance layers, and inter-temporal utility under specified stochastic models [Abdikerimova et al., 2024]. Extending our framework to sequential deployment would require calibration sets that adapt to a moving distribution. This connects naturally to conformal inference under dependence and nonstationarity, and to the recertification questions raised by the E-OBS time-split experiments.
B
METHODOLOGICAL DETAILS
B.1
NONSTATIONARITY AND TIME-SPLIT PROTOCOLS
The conformal guarantee requires that deployment blocks are exchangeable with calibration blocks. When the loss distribution drifts over time (as in climate-driven applications), this is best interpreted as a local stationarity condition: coverage holds for blocks from the same regime as C. To operationalise this, we partition blocks in temporal order such that the calibration window is as close as possible to the deployment period. Under nonstationarity, certificates should be viewed as a rolling operational contract rather than a permanent guarantee: one re-certifies periodically (e.g., annually) as new blocks arrive. In our experiments we report both random splits (theorem-aligned) and time-ordered splits (robustness diagnostic). B.2
VARIANCE-OPTIMAL DOUBLY-STOCHASTIC BASELINE (VO-DS).
To benchmark against classical second-moment risk sharing (not tailored to tail risk), we include a variance-optimal doubly-stochastic baseline. Under our convention in (1), post-sharing obligations are xb (A) = x̃b A, so if Σ = Cov(x̃b ) then Cov(x̃b A) = A⊤ ΣA. Using the training split, we estimate a shrunken covariance b λ = (1 − λ)Σ b + λ diag(Σ) b + ρridge I, Σ and define the VO-DS reference rule as a minimiser of the quadratic proxy b λA , ĀVO ∈ arg min tr A⊤ Σ A∈ADS (M )
(11)
over the set of admissible doubly-stochastic allocation matrices ADS (M ) = A ∈ Rn×n : A ≥ 0, A1 = 1, A⊤ 1 = 1, Aji = 0 whenever Mji = 0 . Here M ∈ {0, 1}n×n encodes admissible sharing links (for the unconstrained VO-DS baseline we take M ≡ 11⊤ ). In our implementation, (11) is solved approximately on the training split using a projected first-order method, and the resulting ĀVO is then treated as a fixed base rule in the train–select–certify pipeline. In all three datasets in this paper, VO-DS produces results that closely match global uniform pooling. This behaviour is consistent with prior linear risk-sharing results for doubly stochastic mixing, where equal sharing emerges as an extremal case on complete graphs [Charpentier et al., 2021]. This suggests that, within the class of doubly-stochastic sharing rules considered here, the overall intensity of redistribution may matter more than its precise structure. We leave a systematic study of richer sharing-rule classes for future work.
C
EXPERIMENTAL DETAILS
C.1
SYNTHETIC DATA GENERATING PROCESS
We generate B exchangeable blocks (years) b = 1, . . . , B with n peers arranged on a grid. Each year is an event year with probability pevent ; on a non-event year all losses are zero. On an event year b, peer i incurs a payout Xb,i = 1{hitb,i = 1} · Sb · Ei , where Ei > 0 is a peer-specific exposure and Sb > 0 is a year level severity. Conditional on being an event year, hits are generated via a logistic model sp sp P (hitb,i = 1 | Zb , Sb,i ) = σ β0 + κ ri + λ Zb + ρ Sb,i , sp with σ(·) the sigmoid, ri an i.i.d. peer risk score (heterogeneity), Zb a year-level common factor (common shocks), and Sb,i an optional spatially smoothed random field (spatial dependence). The intercept β0 is set so that σ(β0 ) ≈ phit|event for a typical peer. Exposures Ei are i.i.d. lognormal normalised to mean 1. Year severities Sb are Pareto distributed.
C.2
EVALUATION METRICS
Let S denote the set of splits and Btest (s) the test blocks for split s. For the deployed policy/certificate pair (Aop , cop ): Per-agent marginal coverage: X 1 s |Btest (s)|
cd ovi = P
X
1{Xb,i (Aop ) ≤ (cop )i }.
s∈S b∈Btest (s)
We report the mean and 5th percentile (p05) of {d covi }ni=1 across agents. Aggregate certified-cap ratio: AggCapRatio = ⟨w, cop ⟩/⟨w, c0 ⟩, where c0 are the identity baseline caps. A value of 1 means pooling offers no improvement over the baseline, values below 1 indicate that pooling reduces the aggregate high-confidence upper bounds on obligations (lower is better) Top-decile cap ratio: the same ratio restricted to the top 10% of agents ranked by baseline cap c0,i (lower values indicate larger certified relief for the highest-risk agents). Fraction below nominal (Fr< .9): the proportion of agents whose empirical marginal coverage falls below the nominal 1 − δ level (lower is better, zero means all agents are at or above nominal). PASS rate: fraction of splits where the candidate passes the certified harm audit and is deployed (higher indicates more splits where pooling is acceptable). C.3
E-OBS: CALIBRATION LENGTH SENSITIVITY UNDER RANDOM SPLITS
Table 7 complements the time-split sensitivity analysis in Table 5 by varying nC under random splits. Random splits remove the explicit temporal extrapolation in the time-ordered protocol, but do not eliminate the nonstationarity and dependence
Min Fr<.9
Global
p05
10 20 30 40 50
0.94 0.98 0.88 1.00 0.96
0.883 0.856 0.824 0.890 0.864 0.848 0.895 0.868 0.840 0.884 0.860 0.832 0.885 0.860 0.840
0.848 0.808 0.797 0.854 0.866
Local
nC PASS Mean
10 20 30 40 50
1.00 1.00 1.00 1.00 1.00
0.929 0.868 0.832 0.929 0.872 0.852 0.926 0.872 0.840 0.926 0.868 0.844 0.925 0.868 0.844
0.322 0.344 0.375 0.404 0.408
Table 7: E-OBS random splits, varying nC (ntest = 5, 50 splits). Fr<.9: fraction of agents below nominal. nC Mean 10 20 30 40 50
p05
Min Fr<.9
0.957 0.836 0.727 0.952 0.818 0.618 0.945 0.782 0.527 0.939 0.764 0.509 0.931 0.727 0.491
0.129 0.182 0.203 0.222 0.252
Table 8: Identity baseline under time-ordered splits on E-OBS. Coverage degrades with nC due to nonstationarity, confirming that drift affects all methods equally.
present in the E-OBS record. They should therefore be interpreted as a diagnostic for finite-sample and post-pooling effects rather than as evidence that the climate blocks are truly exchangeable. For local pooling, coverage is stable across all nC (mean ≈ 0.93, p05 ≈ 0.87) and the identity baseline achieves mean ≈ 0.96 with p05 at or above 0.90 throughout, confirming that the conformal procedure itself is valid and conservative. Global pooling, however, exhibits systematic marginal undercoverage (mean 0.88–0.90, p05 0.86, Fr< 0.9 around 80–87%) even under random splits. This does not reflect a failure of the conformal certificate itself: the identity caps are valid, and the certificate for the fixed deployed policy is correct by Theorem 1. Rather, global pooling with α ≈ 0.5 applies an aggressive transformation that concentrates post-pooling obligations (each agent’s obligation becomes roughly half their own loss plus half the group mean), thinning the effective tail from which conformal caps are estimated. With only B = 75 total blocks and correspondingly small calibration sets, the order-statistic caps for this transformed distribution sit closer to the true quantile, leaving less margin and resulting in empirical coverage slightly below nominal for a substantial fraction of agents. Local pooling avoids this issue because it applies a milder transformation (neighbourhood averaging preserves more of the original per-agent distribution shape), and the resulting caps retain a conservative margin even at small nC . This highlights a practical trade-off: more aggressive redistribution delivers greater certified tail relief (Table 4) but requires larger calibration sets for conformal caps to remain conservative. Feature-conditional approaches such as conformalised quantile regression [Romano et al., 2019] could help tighten caps for the transformed distribution, reducing this sensitivity. C.4
E-OBS: IDENTITY BASELINE UNDER TIME SPLITS
Table 8 shows that the identity baseline also degrades under time-ordered splits, even though it involves no pooling. As nC increases from 10 to 50, mean coverage drops from 0.957 to 0.931 and the lower tail worsens substantially (p05: 0.836 → 0.727; min: 0.727 → 0.491), while the fraction of agents below nominal rises from 0.129 to 0.252. This confirms that the coverage deterioration observed in Table 5 is a genuine nonstationarity effect rather than an artifact of the learned policy or pooling choice. Table 9 reports the same analysis under random splits. Identity coverage is stable across all nC (mean 0.960–0.962, p05 0.900–0.904), with fewer than 5.1% of agents below nominal in all cases. This confirms that the conformal procedure is valid under exchangeability, and that the undercoverage observed for global pooling under random splits (Appendix C.3) is attributable to the aggressive post-pooling transformation rather than a failure of the calibration procedure.
nC Mean 10 20 30 40 50
p05
Min Fr<.9
0.962 0.904 0.856 0.962 0.904 0.876 0.961 0.904 0.876 0.961 0.904 0.856 0.960 0.900 0.860
0.047 0.043 0.049 0.047 0.051
Table 9: Identity baseline under random splits on E-OBS. Empirical coverage remains above nominal across all nC .
C.5
E-OBS: NONSTATIONARITY DIAGNOSTICS
The E-OBS precipitation record exhibits clear nonstationarity over 1950–2024. Aggregate trigger count trends upward at +4.76/year, with mean losses increasing by 53% between the first and second halves of the record (from 378 to 576). Both trigger rate (+37%, p < 10−4 ) and conditional severity (+11%, p = 0.013) contribute. Aggregate lag-1 autocorrelation is moderate (r = 0.23) but per-peer autocorrelation is weak (median 0.039), indicating that the aggregate persistence is largely driven by trend rather than short-range temporal dependence. This confirms that nonstationarity is the dominant source of exchangeability violation in time-ordered splits. C.6
E-OBS: SENSITIVITY TO CALIBRATION SAMPLE SIZE
The observed undercoverage in some of the E-OBS experiments is partly attributable to the limited number of available calibration blocks (B = 75). To better understand the undercoverage observed in the E-OBS stress test, we performed an additional diagnostic in which the training, validation, and test blocks were held fixed, and α⋆ was selected once. We then restricted calibration to a temporally localised pool of years (using calibration blocks from the same half of the record as the test period) and varied the number m of calibration blocks used for certification; see Table 10. Increasing m from 5 to 17 led to a monotonic improvement in empirical coverage (mean coverage increasing from 0.85 to 0.97) and a substantial reduction in the fraction of agents below nominal coverage (from 0.77 to 0.14). This suggests that part of the observed undercoverage is driven by limited availability of calibration data that are representative of the test period. However, even with the largest feasible localised calibration sets, some agents remained below nominal coverage, indicating that calibration size alone does not fully explain the effect. m
Cov Mean
Cov p05
Fr<.9
5 8 10 12 14 17
0.851 0.901 0.915 0.934 0.946 0.968
0.666 0.740 0.773 0.787 0.800 0.800
0.767 0.243 0.192 0.160 0.151 0.142
Table 10: E-OBS calibration-size diagnostic under global pooling. Training, validation, and test blocks are fixed, α⋆ is selected once, and certification is repeated using m calibration blocks from a temporally localised pool.
C.7
ENERGY COOPERATIVE: DATA AND PREPROCESSING
The CEL Loureiro dataset [Monteiro et al., 2024] provides 15-minute smart meter readings for 172 buildings in a Portuguese energy cooperative (Loureiro, Portugal) from May 2022 to September 2023. We aggregate to weekly total consumption per building, discard buildings with > 50% missing weeks (retaining n = 153), and drop partial weeks at the start and end of the record, yielding B = 69 full weekly blocks. Deseasonalisation. Electricity consumption exhibits strong seasonality (most likely due to winter heating demand). To produce approximately exchangeable blocks, we define each household’s weekly loss as the excess above a rolling seasonal baseline: for each building, we compute a 9-week centered rolling median and subtract it, clipping at zero:
x̃b,i = max(0, xraw b,i − median9 (x·,i )). This removes the seasonal level while preserving genuine demand shocks. The resulting losses have zero fraction 0.58, mean 9.2, median 3.7, and max 543. C.8
ENERGY COOPERATIVE AND E-OBS: DEPENDENCE STRUCTURE
Table 11 compares the dependence structure of the energy cooperative and E-OBS datasets. The energy cooperative exhibits weak, unstructured pairwise correlations (mean r = 0.064, no spatial block structure), while E-OBS shows spatially structured correlations (visible block diagonal in the correlation matrix) with a heavier right tail (95th percentile r = 0.45 vs. 0.35). This difference explains why global pooling benefits nearly all households in the energy cooperative (idiosyncratic shocks diversify effectively) but creates harmed agents in the E-OBS setting (correlated shocks limit diversification and shift burden onto low-trigger-rate cells).
n (agents) B (blocks) Mean pairwise r Median pairwise r 95th percentile pairwise r Spatial structure
Energy coop.
E-OBS
153 69 weeks 0.064 0.034 0.350 None
1120 75 years 0.080 0.041 0.446 Block diagonal
Table 11: Dependence structure comparison. The energy cooperative has weaker, unstructured correlations, explaining why pooling is nearly Pareto-improving while E-OBS pooling creates harmed agents.
C.9 ENERGY COOPERATIVE: SENSITIVITY TO PARTICIPATION BUDGET AND MISCOVERAGE LEVEL We investigate the sensitivity of the Energy Cooperative experiment to the participation budget ε and the target miscoverage level δ. Throughout, we fix η = 0 and report results averaged over 50 random splits. Participation budget ε. The participation budget controls the maximum allowable increase in expected cost for any participant. As ε increases, the feasible set expands, allowing more aggressive redistribution. Table 12 shows that the selected pooling intensity αop increases monotonically from 0.05 to 0.93 as ε increases from 0.01 to 0.20. At the same time, certified-cap efficiency improves and the empirical coverage remains essentially unchanged across the sweep. Overall, increasing ε enables stronger redistribution and larger certified-cap reductions, while increasing δ relaxes the coverage requirement and yields less conservative allocations. ε
αop
Cov Mean
Cov p05
PASS
AggCap
Top10
0.01 0.05 0.10 0.20
0.05 0.31 0.57 0.93
0.914 0.914 0.913 0.914
0.884 0.886 0.884 0.900
1.00 1.00 1.00 1.00
0.965 0.795 0.641 0.492
0.953 0.719 0.484 0.180
Table 12: Sensitivity to the participation budget ε in the Energy Cooperative experiment. Miscoverage level δ. We also vary the target miscoverage level δ as shown in Table 13. Larger values of δ permit less conservative certification and therefore smaller pooling intensities. The selected αop decreases monotonically from 1.00 at δ = 0.05 to 0.36 at δ = 0.20. Empirical coverage tracks the nominal target coverage level 1 − δ throughout the sweep.
δ
Nominal
αop
Cov Mean
Cov p05
PASS
AggCap
Top10
0.05 0.10 0.15 0.20
0.95 0.90 0.85 0.80
1.00 0.93 0.70 0.36
0.976 0.914 0.858 0.804
0.976 0.900 0.828 0.764
1.00 1.00 1.00 0.98
0.281 0.492 0.692 0.904
0.070 0.180 0.398 0.700
Table 13: Sensitivity to the target miscoverage level δ in the Energy Cooperative experiment.