Refuse, Decompose, Refresh: A Claim-Safe Protocol for Closed-Loop AI Evaluation Peiying Zhu*
Sidi Chang* †
[email protected] Blossom AI San Francisco, CA, USA
[email protected] Blossom AI San Francisco, CA, USA
arXiv:2609.20538v1 [cs.AI] 17 Sep 2026
Abstract An AI evaluation can be perfectly reproducible and still support the wrong claim. This risk is acute in closed-loop systems: the evaluated policy determines which states are visited, which components become observable, and therefore which failures can leave a measurable trace. We propose a claim-safe evaluation protocol built around three actions. Refuse: abstain when a clean reference stream or a matched runtime comparison lacks support. Decompose: report protocol execution, operational false admission, and structural hypotheses as separate decisions rather than one scientific PASS/FAIL label. Refresh: treat distribution-shift alarms as requests to invalidate and recompute a reference map, not as direct fault evidence. We instantiate the protocol in an aggregate-only simulator with 24 policy components, three demand regimes, two fault-mask families, and independently seeded development and heldout data. The preregistered heldout contains 1,440 cases and 21,600 partition rows. Only 55/72 regime-component units were reference-admitted and 54/55 remained runtime-admitted, making abstention part of the result. Stable false admission was 0/20 represented components, with a one-sided exact 95% upper bound of 0.1391 under a frozen 0.20 rule. Within admitted units, affected clean traffic predicted detection substantially better than nominal fault-cell fraction: across 540 unit-arm rows nested in 20 component clusters, the cell-minus-traffic negative-log-likelihood difference was 0.1264 nats per row, with a 95% component-cluster interval of [0.0593, 0.1918]. A separate drift log illustrates why “null” must be reference-relative: clean fault-null streams triggered 15/15, 0/15, and 14/15 alarms across three regimes, while only the middle regime matched the frozen detector reference. The contribution is not a universal threshold. It is an executable contract linking observable support, statistical calibration, and the exact claim each number can justify. Keywords: AI evaluation, construct validity, selective prediction, distribution shift, agent evaluation, abstention
every scheduled case into a scalar score converts absent evidence into apparent performance. This paper argues that a trustworthy closed-loop evaluModern AI evaluation is rich in numbers and poor in claim ation should be organized as a claim contract rather than boundaries. A benchmark score may be computed exactly, a leaderboard row. The contract states: averaged correctly, and reproduced bit-for-bit while measuring a construct different from the one named in the 1. which evidence must exist before a score is defined; conclusion. Measurement theory describes this as a mis2. which sampling unit supports the uncertainty statematch between a theoretical construct and its operationalment; ization [1]. Benchmark critiques make the same point 3. which variable operationalizes exposure to the tested at scale: finite task collections are often treated as meaintervention; sures of general capability far beyond their validated scope 4. which distribution defines the detector null; and [2]. Multi-scenario frameworks such as HELM respond 5. which conclusions are logically independent. by broadening scenarios and metrics [3], while stress-test We operationalize the contract through three verbs. research shows that otherwise equivalent pipelines can diverge on deployment-relevant behavior [4]. • Refuse: if the policy did not generate supported Closed-loop systems add a further complication. The clean evidence, or if clean and current streams are system being evaluated helps generate the evaluation data. not jointly supported on the same partitions, return A policy that never visits a state cannot reveal whether abstention rather than a diagnostic score. the component controlling that state is healthy. A demand • Decompose: keep execution integrity, operational change can rotate occupancy toward another region and false admission, coverage, power, and structural hyinvalidate a reference distribution without planting any potheses in separate result fields. There is no comfault. A large intervention can remain invisible if it affects bined scientific PASS/FAIL. cells the policy does not use. In such settings, forcing • Refresh: when the deployed distribution departs ∗ Both authors contributed equally to this research. from the detector reference, invalidate and recompute † Corresponding author. the map. An alarm is not itself a fault claim.
1
Introduction
1
Refuse, Decompose, Refresh
Zhu & Chang
The empirical case study is a closed-loop target policy observed only through aggregate traces. The simulator contains 24 disjoint policy components, three separately fitted demand regimes, and two families of counterfactual component faults. A preregistered heldout tests the contract after several development analyses were frozen and downgraded where necessary. One withdrawn analysis compared exact minimum hitting set (MHS) with propagation-aware greedy selection; the methods agreed because scoped probes had already collapsed the residual choice. This negative result motivated the support-first contract, and the formal heldout deliberately tests evidence eligibility and calibration rather than MHS superiority or localization accuracy. The results support four conclusions within the audited system. First, evaluation coverage is partial: 17 of 72 regime-component units fail the clean reference gate, and one more represented component fails the runtime gate. Second, independent false-admission calibration supports a bounded operational claim, not a zero-risk claim. Third, affected clean traffic is a better measurement of signal opportunity than nominal intervention size. Fourth, clean data from a shifted regime are fault-null but not necessarily detector-null; pooled alarm counts can therefore be badly misread. We do not propose universal support thresholds, a general distribution-shift test, or a theorem of diagnosability. We provide an executable evaluation design and a worked audit showing why the distinction among “not evaluated,” “evaluated with no signal,” “operationally safe,” and “structural hypothesis supported” must remain visible.
support-first principle to aggregate system traces. The estimand is not a treatment effect or policy value; it is whether a planted component intervention could have produced a stable observable difference under the traffic generated by the policy. Diagnosability research asks a parallel question: whether the observations available to a diagnoser can distinguish the relevant faults [7]. Recent work quantifies distinguishability from data [8] and makes exact versus approximate error claims explicit in probabilistic systems [9]. Our protocol is narrower. It does not prove diagnosability in general; it operationalizes finite-sample support for one aggregate-trace evaluation.
2.2
Abstention before scoring
Selective prediction permits a model to abstain, trading coverage against error [10, 11], including under deployment shift [12]. Split conformal inference illustrates the value of separating model fitting from calibration [13], while riskcontrolling prediction sets attach finite-sample guarantees to a specified loss using heldout data [14]. Our refusal is upstream of these methods. It does not reject a lowconfidence prediction; it declares that the trace comparison lacks the observable support required to construct the prediction.
2
Evaluation claims as measurement contracts
2.1
Construct, operationalization, and support
Evaluation begins with a construct: capability, reliability, safety, diagnosability, or improvement. The construct is then operationalized through tasks, observable variables, interventions, and metrics. Jacobs and Wallach emphasize that operationalization necessarily introduces assumptions and can fail construct validity even when the measurement is reliable [1]. Raji et al. show how benchmark-specific measurements are routinely stretched into claims of general progress [2]. HELM addresses part of this problem by reporting a portfolio of scenarios and desiderata rather than one narrow accuracy measure [3]. Our focus is a prior question: is the requested measurement defined for this case? In causal and off-policy analysis, overlap determines whether a comparison is supported [5, 6]. High-dimensional settings make global overlap summaries especially misleading [5]. We adapt the
This distinction changes the denominator. A benchmark that reports success over all scheduled cases silently treats unsupported cases as failures or excludes them after seeing results. A claim-safe protocol freezes the gate, reports both conditional and operational denominators, and retains abstention as an outcome.
2.3
Reference-relative nulls and lifecycle validity
Dataset-shift tests are designed to make systems “fail loudly” when current data no longer resemble a reference distribution [15]. Conformal test martingales similarly connect detected change to a retraining decision [16]. Neither principle implies that an alarm on clean data is a false alarm unless the clean data are drawn from the detector's null distribution. This is easy to miss in closed-loop evaluation. “No planted fault” describes the simulator intervention. “Matches the frozen reference regime” describes the detector null. These labels can differ. A demand shift can be physically real, fault-free, and correctly detected. 2
Refuse, Decompose, Refresh
Zhu & Chang
3
Case study and observable quan- unit enters the reference map when at least 14 of 15 clean reference partitions support it. Failure returns tities REFERENCE_ABSTAIN.
3.1
Closed-loop policy components
Runtime eligibility is evaluated on matched pairs, not on two marginal totals. Within a partition, both the reference trace and its current counterpart must reach support 12. A unit proceeds only if this paired condition holds in at least 14 of 15 partitions; both directional evaluations must qualify before their result can be combined. Otherwise the state is RUNTIME_ABSTAIN. The joint requirement prevents a common evaluation error. Fourteen supported reference partitions and fourteen supported current partitions do not imply fourteen supported comparisons if the evidence occurs in different partitions.
The simulator evaluates a target policy under demand regimes λ0 ∈ {5, 7, 9}. The policy is refitted separately in each regime. Twenty-four disjoint components are indexed by time quarter, inventory half, and market third, yielding 72 regime-component units. For each unit, the evaluator records 15 partitions of typed aggregate traces. It does not inspect the planted fault identity when determining eligibility or stable signal. Two summaries enter the frozen signal predicate: a regional distribution distance and a mean reference-current action gap.
4.2 3.2
Score only eligible comparisons
Counterfactual fault families
For each matched partition, signal strength is z = max(region_d1/0.20, |mean_action_gap|/0.35). The cutoff z ≥ 1.50 was selected before formal execution from the fixed grid {1.00, 1.25, 1.50, 1.75, 2.00} and was never retuned on the formal null. A direction is stable when at least 14 of 15 matched partitions signal, and a unit-level stable detection requires both directions to be stable. The • uniform selection draws a seeded random order over state machine is cells that can change in the requested direction; • flow-weighted selection uses seeded weighted sampling REFERENCE_ABSTAIN → RUNTIME_ABSTAIN without replacement, so high-occupancy clean cells → SIGNAL_ELIGIBLE tend to appear earlier. → {DETECTED, NOT_DETECTED}. The families separate nominal intervention size from “Not detected” is therefore a statement about a suprealized exposure. At the same selected cell fraction, flowported comparison. It is not a synonym for “the evaluator weighted masks can affect much more policy traffic. saw no evidence.” For direction d, define affected clean traffic Zero-occupancy faults form a separate stratum. They P are not shifted by an arbitrary constant before log transoc τd = Pc∈Sd , formation and are not inserted into the admitted primary c∈C oc modeling frame. where oc is clean occupancy, Sd is the selected fault subset, and C is the component. The bidirectional covariate is τ = (τout + τin )/2. The matched structural 4.3 Calibrate false admission independently covariate, cell_fraction, is the arithmetic mean of the two directional selected-cell fractions. The null schedule uses disjoint seeds and clean-current Traffic is a candidate measurement of the causal opporobservations. The primary safety sampling unit is the tunity for a fault to affect observed behavior. Cell fraction distinct physical component. The frozen statement is: is a geometric description of how much of the component definition was edited. The formal experiment asks which the one-sided exact 95% upper confidence bound better predicts stable aggregate detection. on component-level stable false admission is at most 0.20. Each formal intervention moves selected, directionchangeable target-field cells by one action bucket. Outward and inward versions are evaluated separately and then combined. Selection follows one of two prespecified constructions:
4
The claim-safe protocol
The 0.20 value is an operational tolerance for this experiment, not a universal standard and not a nominal 5% 4.1 Refuse: two observable support gates false-alarm rate. Coverage, runtime rejection, and false A clean partition supports a component when its exist- admission have different denominators and are reported ing support count is at least 12. A regime-component separately. 3
Refuse, Decompose, Refresh
Zhu & Chang
Independent validation recomputes admission, masks, occupancy joins, power counts, calibration bins, detector Table 1 defines the result grammar. The execution label events, refresh invariants, and endpoint formulas from can stop interpretation, but no scientific endpoint can saved rows. It also verifies frozen hashes, schedule comretroactively change whether the protocol executed. Oper- pleteness, seed ranges, and the absence of a combined ational safety has its own label. Each structural hypothesis scientific label. receives its own PASS, FAIL, or NOT ESTIMABLE. Descriptive coverage never becomes a thresholded population 5.1 Reproduction package and compute claim. This separation is a safeguard against result-driven The reproducibility artifact is available at https://anon redesign. A disappointing power result cannot justify ymous.4open.science/r/artifact-9f37d2/tae_2026 changing the safety denominator; a high admission rate /README.md. It contains the frozen protocol, configuration, cannot compensate for false admission; a valid execution trajectory generator, independent validator, imported simdoes not force structural hypotheses to pass. ulator source, all reference/mask/case/partition rows, and an anonymization hash map. From its unpacked root, 4.5 Refresh: treat shift as reference inval- python3 verify.py checks the content manifest and independently regenerates all 56 validation checks, exact idation bounds, model fits, 2,000 deterministic component-cluster A frozen detector monitors clean-null partitions. An alarm bootstrap draws, and decision labels; it does not trust requests map recomputation. The formal refresh endpoint the saved endpoint summaries. Formal seeds are 200000– checks only that the state machine executes and repro- 202399 for reference, 202400–204799 for current/fault, and duces the expected map hash when given the same frozen 204800–204999 reserved and unused. The artifact docureference buffer. By construction, it cannot show that ments every field and the exact Python environment. refresh repairs a genuinely stale map; it is a smoke test, Execution used one local, single-process CPU worker not evidence of adaptation. on an Apple M5 Pro host (18 CPU cores, 48 GB system memory); no GPU was used. The formal reference phase took 20.5 seconds and the current/fault phase 10,824.5 5 Frozen experiment and validation seconds (3.01 hours). Fifteen development executions with persisted timers total 9,099.1 seconds (2.53 hours), giving Development data selected hypotheses and thresholds. a minimum directly auditable project total of 19,944.1 secThe formal heldout uses disjoint seeds, fixed traffic tar- onds (5.54 CPU-hours). This excludes editing, literature gets {0.15, 0.30, 0.50, 0.75, 0.95}, two mask families, three work, plotting, hash-only checks, and untimed exploratory regimes, both directions, and 15 partitions per case. The commands. Peak resident memory was not instrumented; schedule contains 1,440 cases, 21,600 partition rows, and 48 GB is the recorded host capacity. Formal saved artifacts 3,456,000 episodes. An episode is a Monte Carlo trajec- occupy approximately 24 MB. tory, not an independent statistical unit. Coverage begins with 72 regime-component units; safety and bootstrap inference use 20 represented physical-component clusters; 6 Results and the structural fit contains 540 unit-arm rows nested within those clusters. 6.1 Execution and refusal The primary model comparison is evaluated over 540 rows: 54 runtime-admitted units × 5 traffic targets × 2 All 56 independent validation checks passed, with all 1,440 families. Component-cluster bootstrap intervals use phys- cases and 21,600 partition rows present. The execution ical component as the resampling cluster. The structural label is EXECUTED. The reference gate admitted 55/72 regime-component endpoints are: units (76.4%), representing 20/24 physical components. 1. traffic over cell fraction: lower endpoint of the two- Reference-map invalidation on independent reference evsided 95% interval for cell-model minus traffic-model idence was 0/20, with a two-sided exact 95% interval of [0.0%, 16.8%]. Runtime two-stream rejection was 1/20 negative log likelihood must exceed zero; 2. practical family sufficiency: the one-sided 95% represented components, or 5.0%, with interval [0.1%, upper bound on the log-loss gain from adding family 24.9%]. At the unit level, 54/55 reference-admitted units and family-by-traffic interaction must be below 0.01 remained admitted. nats per unit-arm row; and The 17 clean reference abstentions and one runtime 3. aggregate monotonicity: total stable detections abstention are evaluation results. Had the protocol forced must be nondecreasing across the five traffic targets scores on those cases, their interpretation would depend in both families. on unverified extrapolation.
4.4
Decompose the decision ledger
4
Refuse, Decompose, Refresh
Zhu & Chang
Table 1: Frozen claim ledger. Layer
Question
execution
Did the locked protocol run and validate? operational safety Did the false-admission upper bound meet 0.20? descriptive coverage Where was evaluation supported? structural Which operationalization hypotheses predicts signal? maintenance Did the detector request refresh?
6.2
Allowed output
Forbidden inference
EXECUTED / NOT EXECUTED
execution is not scientific success
SAFETY CONFIRMED / NOT CONFIRMED
not a 5% false-alarm guarantee
counts, rates, exact intervals
no post hoc population pass threshold
separate PASS / FAIL / NOT ESTIMABLE alarm and refresh state
no combined scientific label alarm is not a fault diagnosis
Safety is an upper bound, not a zero 0.0034 nats, and the percentile cluster bootstrap uses 20 represented components; undercoverage could favor this count
conclusion. No represented physical component crossed the stableAggregate bidirectional detection counts were nondesignal gate in the independent null arm: 0 events over creasing across traffic targets: 20 components. Exact binomial inversion yields a onesided 95% upper limit of 0.1391, which lies below the prespecified 0.20 tolerance and therefore produces SAFETY CONFIRMED. A finer, descriptive regime-component view • uniform: 0, 17, 37, 52, 54; likewise records 0/54, with upper limit 0.0540. • flow-weighted: 0, 13, 35, 49, 54. The claim is bounded false admission under this sampling frame. It is not “the evaluator has no false positives,” and it is not a guarantee for unseen component classes or This is not a universal causal law. It is a frozen strucshifted nulls. tural result within admitted units, three regimes, two mask families, and the tested fault construction.
6.3
The nominal fault-size metric measures the wrong construct
The traffic model outperformed the cell-fraction model by 0.1264 nats per unit-arm row in negative log likelihood. The component-cluster 95% interval was [0.0593, 0.1918], entirely above zero. The frozen traffic-over-cell hypothesis therefore passed. The result has a direct measurement interpretation. Cell fraction asks how much of the component definition was changed. Affected clean traffic asks how much behavior flowed through the changed region before the fault. Only the latter measures the opportunity for the counterfactual to alter an aggregate trace. The two mask families provide a useful stress test because they decouple these quantities. At the same traffic target, flow-weighted masks often use fewer cells. After conditioning on traffic, adding family and family-by-traffic interaction improved log loss by 0.0015 nats per unit-arm row, with a one-sided 95% upper bound of 0.0066. This met the frozen 0.01-nat practical-sufficiency rule within these two families. However, the secondary descriptive traffic-plus-family coefficient was -0.3618 with interval [0.8617, 0.0367], corresponding to an odds-ratio interval [0.42, 1.04]. Because that interval extends below the frozen practical-equivalence range [0.5, 2.0], it does not establish coefficient-scale equivalence; the PASS applies only to the log-loss sufficiency endpoint. The log-loss margin is only
6.4
A clean stream is not automatically a detector null
The drift log scored 45 clean-current partitions, 15 per demand regime. Pooled, the detector alarmed on 29/45 partitions. Read without the reference definition, this looks like a 64% false-alarm rate. It is not. The detector's frozen reference statistics came from development data with λ0 = 7. Stratifying the 45 faultnull partitions gives Table 3. The middle row is the clean reference-matched null. The outer rows are physically fault-free but distributionally shifted. Their alarms are consistent with the detector's intended role: request map refresh when the current regime no longer resembles the frozen reference. The experiment did not preregister a detector-sensitivity threshold, so this stratified pattern is descriptive rather than a confirmatory power claim. The preregistered false-admission endpoint in Section 6.2 is the relevant operational false-positive measurement. Detector alarms and stable fault admissions answer different questions. 5
Refuse, Decompose, Refresh
Zhu & Chang
Table 2: Formal results retain separate meanings. Item
Result
Claim supported
protocol execution reference admission runtime rejection stable false admission traffic vs cell fraction family gain beyond traffic traffic-target counts
56/56 validation checks 55/72 units; 20/24 components 1/20 components 0/20; upper 0.1391 0.1264 [0.0593, 0.1918] nats/row 0.0015; upper 0.0066
frozen run is interpretable descriptive evaluation coverage one supported component became incomparable frozen operational safety criterion met traffic is better within admitted units practical sufficiency within two families
nondecreasing in both families
aggregate monotonicity hypothesis passed
Current regime
Relation to frozen detector reference
Alarms
λ0 = 5 λ0 = 7 λ0 = 9
demand-shifted reference-matched demand-shifted
15/15 0/15 14/15
Table 3: Detector alarms are reference-relative.
7
What this changes about AI eval- mance answers “how well did the evaluator work where it declared evidence sufficient?” Operational performance uation practice answers “how often did the full system return a correct usable result among scheduled opportunities?” Both are
7.1
Publish the denominator-generating needed. mechanism Evaluation papers routinely report the denominator after 7.5 Replace global verdicts with a claim filtering without explaining how the system's own behavior ledger
caused inclusion. In closed-loop systems, admission is endogenous to the policy. A trustworthy report should A single PASS/FAIL creates logical coupling among unrepublish scheduled, reference-admitted, runtime-admitted, lated endpoints. The alternative is small and mechanical: and scored denominators, plus the rule connecting them. one execution state, one operational-safety decision, descriptive coverage, and one label per structural hypothesis. Each headline claim should be paired with its nearest 7.2 Validate the exposure variable, not unsupported case.
only the score
Metrics often inherit convenient proxies: number of edited tokens, tool calls, cells, steps, or changed parameters. These are structural sizes, not necessarily causal exposures. Competing operationalizations should be compared on heldout predictive or decision relevance. Here, the nominal fault-size metric loses decisively to traffic despite appearing natural.
7.3
8
The intended benefit is safer evaluation practice. Making support, denominators, reference distributions, and refusal visible can prevent an exact score from being used to justify an unsupported diagnosis. The protocol may be useful in monitoring, auditing, or safety testing closed-loop systems, especially when operators might otherwise mistake distribution shift for a fault or silently score unobservable cases. The same machinery can cause harm if its conditional claims are promoted into deployment guarantees. A frozen threshold may be copied into a new domain without validation; a passed safety gate may create false assurance; and abstention may concentrate on rare, low-traffic components, leaving failures that affect low-volume users or conditions systematically unevaluated. Frequent shift alarms can also impose operational cost or be misused to justify unnecessary intervention. In a real system, releasing de-
Name the null distribution
“Clean,” “benign,” “no fault,” and “in distribution” are not synonyms. Every alarm rate should state the reference distribution and the level at which exchangeability is assumed. Pooling distinct regimes can convert correct shift detection into an apparent false-positive crisis.
7.4
Broader impacts
Make refusal visible
Abstention should be reported alongside accuracy or detection, not buried in preprocessing. Conditional perfor6
Refuse, Decompose, Refresh
Zhu & Chang
tailed occupancy maps or traces could expose sensitive behavior even when the evaluator is statistically sound. Mitigations follow from the claim ledger: report coverage and abstention by deployment-relevant strata, audit who or what is missing, keep alarms separate from fault evidence, require domain-specific recalibration and human review before action, and apply access controls or aggregation to real logs. This release contains only simulator-generated traces, no human-subject or personal data, and no deployable model. Those facts reduce privacy and direct misuse risk but do not establish fairness or safety for any real deployment.
results show both the value and the cost of this discipline: coverage is incomplete, uncertainty remains visible, and one apparently alarming pooled count becomes interpretable only after restoring the reference definition. A trustworthy evaluator should sometimes refuse to score, should never compress independent claims into one verdict, and should refresh its reference when the world moves. Those behaviors are not signs of evaluation weakness. They are evidence that the evaluation knows what its numbers mean.
References 9
Limitations
[1] A. Z. Jacobs and H. Wallach. Measurement and fairness. In Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency, pages 375–385, 2021. https://doi.org/10.1145/344218 8.3445901.
The thresholds were developed for one simulator and should not be transferred mechanically. The study uses 24 components, three demand regimes, two mask families, aggregate traces, and fixed support counts. Systems without clean reference streams need another design. The formal heldout does not establish localization accuracy. It evaluates whether aggregate comparisons are supported and whether planted interventions yield stable signal as traffic increases. It also does not validate the drift detector as a sensitivity-optimized change detector. The family-sufficiency result rests on approximately 20 component clusters and a percentile cluster bootstrap. Its 0.0034-nat margin may be vulnerable to finite-cluster undercoverage. We preserve family-specific calibration rows so readers can judge the aggregation. Refresh was exercised with the original locked buffer, so the map could not change by design. This validates control flow and the map-hash invariant; it provides no empirical evidence that fresh post-shift data would repair an obsolete map. Finally, this case study demonstrates a claim-safe architecture, not universal construct validity. External validity still requires new systems, regimes, fault mechanisms, and deployment conditions.
10
[2] I. D. Raji, E. Denton, E. M. Bender, A. Hanna, and A. Paullada. AI and the everything in the whole wide world benchmark. In NeurIPS 2021 Datasets and Benchmarks Track, 2021. https://datasets-bench marks-proceedings.neurips.cc/paper/2021/has h/084b6fbb10729ed4da8c3d3f5a3ae7c9-Abstrac t-round2.html. [3] P. Liang et al. Holistic evaluation of language models. Transactions on Machine Learning Research, 2023. https://openreview.net/forum?id=iO4LZibEqW. [4] A. D'Amour et al. Underspecification presents challenges for credibility in modern machine learning. Journal of Machine Learning Research, 23(226):1–61, 2022. https://jmlr.org/papers/v23/20-1335.ht ml. [5] A. D'Amour, P. Ding, A. Feller, L. Lei, and J. Sekhon. Overlap in observational studies with highdimensional covariates. Journal of Econometrics, 221(2):644–654, 2021. https://doi.org/10.101 6/j.jeconom.2019.10.014.
Conclusion
Trust in AI evaluation does not follow from precise arithmetic alone. The evaluator must show that the case was observable, that the compared streams were supported, that its metric operationalizes the intended mechanism, and that its null matches the reported alarm interpretation. Our closed-loop case study makes these requirements executable. The protocol refuses unsupported cases, independently calibrates stable false admission, compares alternative exposure measurements, distinguishes faultnull from detector-null streams, and reports execution, safety, and structural hypotheses separately. The formal
[6] M. Oberst, F. Johansson, D. Wei, T. Gao, G. Brat, D. Sontag, and K. Varshney. Characterization of overlap in observational studies. In Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics, PMLR 108:788–798, 2020. https:// proceedings.mlr.press/v108/oberst20a.html. [7] D. Wang, F. Fu, W. Li, Y. Tu, C. Liu, and W. Liu. A review of the diagnosability of control systems with applications to spacecraft. Annual Reviews in Control, 49:212–229, 2020. https://doi.org/10.1016/j.ar control.2020.03.004. 7
Refuse, Decompose, Refresh
Zhu & Chang
[8] F. Fu, D. Wang, L. Li, W. Li, and Z. Wu. Datadriven method for the quantitative fault diagnosability analysis of dynamic systems. IET Control Theory & Applications, 13(8):1197–1203, 2019. https: //doi.org/10.1049/iet-cta.2018.5378. [9] N. Bertrand, S. Haddad, and E. Lefaucheux. A tale of two diagnoses in probabilistic systems. Information and Computation, 269:104441, 2019. https://doi. org/10.1016/j.ic.2019.104441. [10] Y. Geifman and R. El-Yaniv. SelectiveNet: A deep neural network with an integrated reject option. In Proceedings of the 36th International Conference on Machine Learning, PMLR 97:2151–2159, 2019. https: //proceedings.mlr.press/v97/geifman19a.htm l. [11] A. Gangrade, A. Kag, and V. Saligrama. Selective classification via one-sided prediction. In Proceedings of the 24th International Conference on Artificial Intelligence and Statistics, PMLR 130:2179–2187, 2021. https://proceedings.mlr.press/v130/gangrad e21a.html. [12] H. Liang, L. Peng, and J. Sun. Selective classification under distribution shifts. Transactions on Machine Learning Research, 2024. https://openreview.net /forum?id=dmxMGW6J7N. [13] J. Lei, M. G'Sell, A. Rinaldo, R. J. Tibshirani, and L. Wasserman. Distribution-free predictive inference for regression. Journal of the American Statistical Association, 113(523):1094–1111, 2018. https://do i.org/10.1080/01621459.2017.1307116. [14] S. Bates, A. N. Angelopoulos, L. Lei, J. Malik, and M. I. Jordan. Distribution-free, risk-controlling prediction sets. Journal of the ACM, 68(6):43:1–43:34, 2021. https://doi.org/10.1145/3478535. [15] S. Rabanser, S. Günnemann, and Z. C. Lipton. Failing loudly: An empirical study of methods for detecting dataset shift. In Advances in Neural Information Processing Systems 32, 2019. https://papers.neurips .cc/paper_files/paper/2019/hash/846c260d71 5e5b854ffad5f70a516c88-Abstract.html. [16] V. Vovk, I. Petej, I. Nouretdinov, E. Ahlberg, L. Carlsson, and A. Gammerman. Retrain or not retrain: Conformal test martingales for change-point detection. In Proceedings of the Tenth Symposium on Conformal and Probabilistic Prediction and Applications, PMLR 152:191–210, 2021. https://proceedi ngs.mlr.press/v152/vovk21b.html.
8