{"id":"aeadbfcd-cf97-449c-97c5-79d205672da6","arxiv_id":"2504.13478","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"An adaptive-conformal-plus-incremental-learning safety monitor predicts STL robustness violations with long-run coverage guarantees under arbitrary distribution shift, outperforming conformal and robust-conformal baselines in simulated driving.","lead":"Researchers built a safety monitor for neural-network-controlled cars that predicts future crashes by checking temporal-logic safety rules, using adaptive conformal prediction to keep probabilistic guarantees even when sensor inputs shift out of distribution. A generalist might read it to see how online uncertainty quantification and incremental retraining can turn a crash predictor into a certified early-warning system.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Algorithm 2 computes the ACP threshold after inserting the current residual, so C_t is an in-sample quantile; Lemma 1 is not established and Theorem 1's lower safety bound is unsupported for the implemented algorithm.","rationale":"The reader's weakest assumption identifies the same load-bearing issue: Algorithm 2's online calibration is not shown to satisfy the ACP guarantee because C_t is evaluated in-sample. My reading agrees and sharpens the point by noting that the faulty e_t is used to adapt delta_t, so the entire ACP update loop in Algorithm 2 is not the update for which Proposition 1 provides coverage control. In addition, Lemma 1 converts ACP's empirical miscoverage-frequency guarantee into an average-probability bound without proof, so even a correctly ordered ACP update would need an extra argument for Theorem 1. These issues are addressable: reorder the quantile computation, define e_t against the threshold used for the lagged prediction, and either prove the probability statement or restate the guarantee as a long-run frequency bound. The empirical results, reproducibility package, and ablations are valuable and support the engineering claim that ACP plus incremental learning improves monitoring performance. The theoretical guarantee, however, is the paper's central differentiator, and it is not currently established. A conditional verdict is appropriate: the work is publishable if the proof is repaired or the claim is weakened to the frequency guarantee that ACP actually provides.","tokens_in":19030,"tokens_out":9419,"duration_ms":97849,"concrete_test":"Modify Algorithm 2 so that C_t in line 14 is computed from NCS scores observed strictly before time t (i.e., compute the quantile before appending R_t), and define e_t by comparing R_t to the threshold C_{t-H} that was in force when the corresponding t-H prediction was made. Re-run both case studies and regenerate Figure 4 and the coverage tables. If empirical coverage then leaves the Lemma 1 envelope in the OOD scenarios, the in-sample quantile is the cause and the theorem as stated fails for the implemented algorithm; if coverage remains inside the envelope, the concern is refuted for these experiments.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central guarantee flows through Lemma 1, and Lemma 1 is not connected to Algorithm 2. In Algorithm 2, line 11 appends the current time-lagged residual R_t to the NCS set R, and line 14 then computes C_t as a quantile of the updated set. Line 15 evaluates e_t = 1{R_t > C_t} against this same in-sample quantile. In Gibbs-Candes ACP, the prediction region for the current step must be constructed before the current score is observed and added; otherwise e_t measures whether the current score lies above the quantile of a set that already contains it, which is a rank check, not a statement about out-of-sample coverage. The relevant future error for the alarm decision made at time t, namely R_{t+H} = rho_hat_t - rho_t, is not in R when C_t is formed, so the ACP update does not control its coverage. Lemma 1 also silently converts Proposition 1's empirical-frequency bound into a bound on average probabilities, which is a further unproven step. Because Theorem 1 is a direct corollary of Lemma 1, the paper's safety guarantee is not established for the algorithm as written. The empirical check in Figure 4 uses the same implementation, so it cannot independently validate the theorem.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a safety-monitoring framework for learning-enabled cyber-physical systems (LE-CPS) in out-of-distribution (OOD) settings. Rather than detecting OOD inputs, the monitor predicts violations of a signal temporal logic (STL) safety specification from predicted future states, and raises an alarm when the predicted robustness is below an adaptive conformal prediction (ACP) threshold. The authors combine ACP with an incremental learning (IL) scheme that fine-tunes and dynamically selects from a set of trajectory predictors in order to reduce the conservatism introduced by ACP. The central theoretical claim is Theorem 1: if the ACP threshold C_t is always below the predicted robustness, then the average probability that the system satisfies the STL specification is at least 1-delta-p1, with p1 tending to zero, under no assumptions on the data distribution. The empirical evaluation uses two driving case studies (an F1Tenth car with static obstacles and a race car with dynamic obstacles), comparing ACP+IL against point prediction, conformal prediction, robust conformal prediction, and ACP alone on recall, timeliness, and precision, with 10 trials for each setting.","tokens_in":19312,"tokens_out":5063,"duration_ms":49360,"significance":"If the theoretical guarantee were established, this would be a valuable contribution: it directly monitors safety rather than OOD presence, and it claims distribution-free, long-run probabilistic guarantees under arbitrary, non-stationary shifts, which is stronger than prior conformal and robust-conformal runtime-verification works. The empirical study is careful in several respects: it reports 10 trials with means and standard deviations, includes ablations, provides an honest appendix on the thin-tailed NCS limitation, and ships a repeatability package with code and Docker instructions. The paper also demonstrates a genuine limitation of robust conformal prediction (RCP) by estimating total-variation distances that exceed the permissible epsilon, which is informative. However, the validity of the headline Theorem 1 depends on a lemma whose proof is a citation to a related but not identical setting, and the implementation in Algorithm 2 does not clearly match the adaptive conformal update used in the cited result. The IL gains, while plausible, are evaluated with hyperparameters tuned on the same OOD sets used for testing, which limits the strength of the empirical comparison.","major_comments":[{"comment":"The ACP update is not the standard Gibbs-Candes update for the algorithm as written. Line 11 appends the current time-lagged residual R_t to the NCS set R, and line 14 computes C_t as a quantile of the updated set. Line 15 then evaluates e_t = 1{R_t > C_t} against this in-sample quantile. In adaptive conformal prediction, the threshold used to evaluate the current score must be constructed before the current score is observed and added to the calibration set; otherwise e_t is a rank check within a set that already contains R_t and does not indicate out-of-sample miscoverage. Lemma 1's proof merely cites Corollary 3 of Dixit et al. [3] without demonstrating that the growing, self-inclusive calibration set of Algorithm 2 satisfies that corollary's conditions. Because Lemma 1 is the foundation of Theorem 1, the paper's central safety guarantee is not established for the implemented algorithm. The empirical coverage check in Figure 4 uses the same implementation and therefore cannot independently validate the theorem.","section":"Section 6.1, Lemma 1, and Problem 2"},{"comment":"Lemma 1 converts the Gibbs-Candes bound on the empirical frequency of e_t into a bound on average probabilities 1/T sum Prob(rho_hat_t - rho_t <= C_t). Proposition 1 (cited from Gibbs and Candes) is an almost-sure statement about the Cesaro average of the binary indicators e_t; it does not, by itself, imply the stated bound on the average of the marginal probabilities under a non-stationary, non-ergodic data-generating process. This is a separate, unproven step in the proof of Lemma 1. The authors should either restate Lemma 1 (and hence Theorem 1) as an empirical-frequency guarantee, or supply a rigorous argument (e.g., a martingale or exchangeability argument) that justifies the probability interpretation. As written, the problem formulation in Problem 2 and the conclusion in Theorem 1 are not directly supported by the cited result.","section":"Section 6.1, Lemma 1"},{"comment":"The empirical comparison for the IL component appears to be tuned on the evaluation data. Section 7.4 reports that for each OOD setting the fine-tuning learning rate, number of epochs, loss weighting beta, and the IL cluster-selection hyperparameters are selected using the same OOD scenarios whose recall, timeliness, and precision are then reported in Tables 1-3. This circularity can inflate the ACP+IL results relative to a deployment scenario in which the IL data would be collected online from the current OOD distribution and the hyperparameters would have to be chosen before evaluation. The claim that ACP+IL \"outperforms alternatives\" in OOD settings should be qualified, or the evaluation should use a protocol that does not tune on the test OOD set, such as a separate validation split or a fixed hyperparameter rule.","section":"Section 7, Experiments"}],"minor_comments":[{"comment":"There is a typo: \"The observation spaces is a continuous four-dimensional vector\" should be \"The observation space is a continuous four-dimensional vector.\"","section":"Section 2"},{"comment":"The expression for C_t is not clearly specified. The notation \"Ceil(t)(1-delta_t)th smallest Ri in R\" is ambiguous: it should state the exact quantile definition and how ties and boundary indices are handled when the effective calibration size changes over time.","section":"Algorithm 2, line 14"},{"comment":"The constants p1 and p2 are printed as \"p1 = delta + gamma / T gamma\" and \"p2 = (1-delta) + gamma / T gamma\", which is mathematically ambiguous. Presumably they mean (delta + gamma)/(T gamma) and ((1-delta) + gamma)/(T gamma); please fix the notation.","section":"Section 6.1, Lemma 1"},{"comment":"The hyperparameter search for the IL cluster-selection threshold is mentioned but not specified. Please provide the search range, the objective used, and the selected values per case study, or state that this is a limitation.","section":"Section 7.4"},{"comment":"The caption does not explain the very small magnitude of the log-likelihood values or the scale of the y-axis; the text notes this is a normalization artifact, but the figure would benefit from a note in the caption as well.","section":"Figure 1b"}],"recommendation":"major_revision","confidential_remarks":"The central contribution of the paper is the claimed distribution-free safety guarantee, but the link between Algorithm 2 and the cited ACP result is not adequately demonstrated. The authors should be pushed to either correct Algorithm 2 to match the Gibbs-Candes update or prove the guarantee for their actual in-sample quantile procedure. I would also encourage the editor to ask the authors to clarify the probability-vs-frequency interpretation of Lemma 1. The IL evaluation circularity is a secondary concern, but it should be addressed in the revision to make the empirical claims credible. The paper is within the scope of the journal and the code availability is a clear strength."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a careful, well-documented paper on an important problem—monitoring STL safety properties with distribution-free guarantees under arbitrary shift—and the combination of adaptive conformal prediction with incremental learning is genuinely new. But the main theorem does not apply to the algorithm as written. The ACP update in Algorithm 2 is in-sample.\n\nThe empirical work is strong. The cartpole motivating example is effective, the comparison against PP, CP, RCP, and ACP alone is informative, and they report ten trials, ablations, full appendix results, and a Dockerized reproducibility package. I believe the empirical findings. The problem framing—directly monitor safety rather than detect OOD—is a real contribution.\n\nThe soft spot is the theory. In Algorithm 2, the current residual R_t is appended to the NCS set on line 11, and the threshold C_t is then computed as a quantile of that updated set on line 14. The coverage indicator e_t is evaluated against a set that already contains the current score. That is a rank check, not the Gibbs-Candes ACP construction, where the threshold is fixed before the current score is observed. The proof of Lemma 1 cites Corollary 3 of Dixit et al. without showing the algorithm satisfies the conditions. On top of that, Lemma 1 converts the empirical miscoverage frequency of Proposition 1 into a bound on average probabilities—a separate unproven step. So Theorem 1, the paper's central safety guarantee, is not established for the implemented method. This is fixable—compute C_t from the past NCS only, or prove a different guarantee—but as written it's a load-bearing gap.\n\nSecondary issue: the IL hyperparameters (cluster thresholds, fine-tuning weights) are selected on the evaluation scenarios, so the IL gains are partly in-sample. The authors are honest about this in Appendix C, but it limits the strength of the \"IL recovers precision\" claim.\n\nI'd send this to peer review rather than desk-reject. The problem is important, the evaluation is reproducible, and the theory gap is specific and addressable. A good referee can force the authors to align the algorithm with the theorem. I wouldn't cite the guarantee as it stands, but the empirical framework and the OOD-monitoring framing are worth following.","headline":"A well-engineered empirical paper whose central theorem does not apply to the implemented algorithm: Algorithm 2 evaluates the ACP threshold in-sample, so the safety guarantee is unproven as written.","tokens_in":19879,"tokens_out":3854,"would_cite":false,"duration_ms":33669,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that safety can be monitored directly—by predicting how well future trajectories satisfy a temporal-logic specification—with a long-run probabilistic guarantee that survives arbitrary out-of-distribution shifts.","keywords":["safety monitoring","signal temporal logic","adaptive conformal prediction","out-of-distribution inputs","incremental learning","cyber-physical systems","runtime verification","STL robustness"],"falsifier":"Run Algorithm 2 with its in-sample calibration on a long synthetic non-stationary sequence with known ground-truth robustness, and check whether the empirical frequency of $\\hat{\\rho}_t - \\rho_t \\le C_t$ stays above $1 - \\delta - p_1(T)$ for large $T$ at the claimed rate; if it falls below the bound while a variant that computes $C_t$ from residuals excluding the current one stays inside, the self-inclusive update is the cause and Lemma 1 fails. A simpler check is to instrument the code to record, at each step $t$, whether the residual $R_t$ appended at line 11 is included in the residual set used to compute $C_t$ at line 14, and to test whether coverage is unchanged when that residual is withheld.","tokens_in":18809,"feed_emoji":"🚗","tokens_out":6912,"duration_ms":60642,"temperature":0.7,"pith_summary":"The paper argues that safety of a learning-enabled cyber-physical system should be monitored directly, by predicting how well future trajectories will satisfy a signal temporal logic (STL) safety specification, rather than by flagging out-of-distribution inputs. Its central claim is that adaptive conformal prediction gives this monitor a long-run probabilistic guarantee: if the predicted robustness stays above an adaptively chosen threshold at every step, the average probability that the system actually satisfies the specification is at least $1-\\delta-p_1$, with $p_1 \\to 0$, and this holds without any assumption on the runtime input distribution. The paper further claims that combining adaptive conformal prediction with incremental learning offsets the conservatism that uncertainty quantification introduces, yielding high recall and timeliness while limiting precision loss in two simulated driving case studies. The point of the result is that safety assurance for learning-enabled systems need not break down exactly when distribution shifts are worst, which is when assurance is most needed.","feed_headline":"A safety monitor that stays reliable under data shift","feed_subtitle":"Adaptive conformal prediction on predicted robustness keeps a long-run safety bound with no distribution assumptions.","key_machinery":"The load-bearing object is the online threshold $C_t$ computed by adaptive conformal prediction from a growing set of non-conformity scores $R_t = \\hat{\\rho}_{t-H} - \\rho_{t-H}$, the time-lagged residual between the robustness predicted $H$ steps earlier and the actual robustness now observed (Algorithm 2, lines 9–16). $C_t$ is the $\\lceil t(1-\\delta_t)\\rceil$-th smallest element of the residual set, with the significance level updated as $\\delta_{t+1} = \\delta_t + \\gamma(\\delta - e_t)$, so the threshold tracks a shifting data distribution without any exchangeability assumption. Around this sits a trajectory predictor selected from a distribution-predictor set maintained by incremental learning: when a residual exceeds a threshold $\\tau$, the history–horizon pair is saved, K-means clustering forms new distribution prototypes, and new predictors are fine-tuned and appended; at runtime the predictor associated with the most likely distribution is used. The STL robustness value $\\rho_{\\varphi}(s,t) = \\min_{t' \\in [t,t+H]} \\min_i d((s_{t',0}, s_{t',1}), (x_i^o, y_i^o)) - c$ converts a temporal safety specification into a real number whose sign determines satisfaction, and it is this value that the monitor predicts.","core_discovery":"The paper's central discovery is that safety violations can be predicted from predicted future trajectories with a distribution-free long-run coverage guarantee. Concretely, Theorem 1 states: if the adaptive conformal threshold $C_t$ is chosen as in Algorithm 2 and the predicted STL robustness satisfies $\\hat{\\rho}_t > C_t$ for every $t \\in [t_0, T]$, then the long-run average probability that the system satisfies the safety specification $\\varphi$ is at least $1 - \\delta - p_1$, where $p_1 = (\\delta+\\gamma)/(T\\gamma) \\to 0$. The mechanism is adaptive conformal prediction on the residuals between predicted and actual robustness over an $H$-step horizon, using a time-lagged non-conformity score so the monitor only relies on states already observed. Empirically, the paper shows that among point prediction, conformal prediction, robust conformal prediction, and adaptive conformal prediction, only adaptive conformal prediction keeps empirical coverage inside its theoretical envelope in their out-of-distribution scenarios, and that adding incremental learning recovers recall, timeliness, and part of the lost precision; for example, in the F1Tenth case with five missing LIDAR rays, recall rises from $0.56$ with adaptive conformal prediction alone to $0.94$ with adaptive conformal prediction plus incremental learning.","pith_inferences":["A minimal repair to the in-sample calibration concern would be to lag the threshold: compute $C_t$ from residuals up to time $t-1$ and evaluate $R_t$ against that threshold; the paper does not do this, and it would cost one time step of responsiveness.","The same adaptive-conformal-prediction-on-robustness machinery should transfer to any STL formula, such as goal-reaching or until patterns, because only the robustness computation changes; testing on until-formulas would directly exercise the generality of the claim.","If the guarantee is confirmed, out-of-distribution detection and safety monitoring should be evaluated jointly: methods that raise alarms only on out-of-distribution inputs will be systematically over-conservative exactly where this monitor stays precise, so benchmarks built on out-of-distribution-only metrics will mis-rank approaches.","The bound $p_1 = (\\delta+\\gamma)/(T\\gamma)$ is weak for short deployments, so the practical safe regime is long-horizon monitoring; short-horizon deployments may still need hybrid per-run certification."],"forward_implications":["Safety monitors can keep a formal long-run guarantee under arbitrary, possibly adversarial distribution shift, because adaptive conformal prediction needs neither exchangeability nor a bounded shift; in the paper's settings, conformal prediction and robust conformal prediction have empirical coverage below the target and their validity assumptions are violated.","Monitoring safety directly means out-of-distribution detection is not a prerequisite for assurance: a controller can generalize to novel inputs without violating the specification, and a well-calibrated monitor can stay silent when the specification actually holds.","Incremental learning converts the extra conservatism of adaptive conformal prediction into precision: adding it raises recall and timeliness in the out-of-distribution cases where adaptive conformal prediction alone dips, while recovering some lost precision in most settings.","The guarantee is a long-run average, so the monitor is calibrated over time rather than per alarm; safety architectures that require per-step or per-episode bounds would need to add another layer of assurance.","Conformal and robust conformal prediction, applied to STL robustness residuals, are not viable substitutes in these scenarios because the estimated total variation distance between calibration and online non-conformity scores exceeds any permissible $ε$."],"supporting_citations":[{"why":"Supplies the adaptive conformal prediction guarantee on long-run coverage under distribution shift that Lemma 1 invokes.","marker":"[7]"},{"why":"Provides the corollary on one-step-ahead prediction error with time-lagged non-conformity scores that Lemma 1 is stated to follow from.","marker":"[3]"},{"why":"The robust conformal prediction baseline for STL runtime verification, with bounded-shift assumptions that the paper argues do not hold in its out-of-distribution settings.","marker":"[49]"},{"why":"Prior conformal prediction for STL runtime verification whose exchangeability assumption adaptive conformal prediction removes.","marker":"[22]"},{"why":"Supplies the F1Tenth car platform and controller used in Case Study I, including the state trajectories and safety property.","marker":"[12]"},{"why":"Provides the trajectory predictor architecture used in the race car case study for multi-agent future-state forecasting.","marker":"[48]"},{"why":"Source of the incremental learning method, with fine-tuned predictors and memory, that Algorithm 1 adapts.","marker":"[46]"},{"why":"The highway-env race car environment used to generate Case Study II trajectories.","marker":"[21]"}],"fun_headline_variants":["Safety monitoring that defies data shift","Direct safety prediction with distribution-free guarantees","Adaptive conformal safety monitor for OOD scenarios","Monitor safety, not just detect OOD inputs","Predicting safety violations without distribution assumptions"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"Every guarantee rests on one premise: the online calibration loop in the monitoring algorithm is a valid instance of the adaptive conformal prediction method it cites, even though the same data point is used both to update the threshold and to test against it; if that premise fails, the coverage lemma and the safety theorem do not follow.","fun_headline_variants_meta":{"raw":{"variants":["Safety monitoring that defies data shift","Direct safety prediction with distribution-free guarantees","Adaptive conformal safety monitor for OOD scenarios","Monitor safety, not just detect OOD inputs","Predicting safety violations without distribution assumptions"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000277,"raw_usage":{"total_tokens":1703,"prompt_tokens":1052,"completion_tokens":651,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":668,"completion_tokens_details":{"reasoning_tokens":585}},"tokens_in":668,"tokens_out":651,"duration_ms":6310,"temperature":1.0,"reasoning_tokens":585,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T12:08:20.274052+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run Algorithm 2 with its in-sample calibration on a long synthetic non-stationary sequence with known ground-truth robustness, and check whether the empirical frequency of $\\hat{\\rho}_t - \\rho_t \\le C_t$ stays above $1 - \\delta - p_1(T)$ for large $T$ at the claimed rate; if it falls below the bound while a variant that computes $C_t$ from residuals excluding the current one stays inside, the self-inclusive update is the cause and Lemma 1 fails. A simpler check is to instrument the code to record, at each step $t$, whether the residual $R_t$ appended at line 11 is included in the residual set used to compute $C_t$ at line 14, and to test whether coverage is unchanged when that residual is withheld.","supporting_citations":[{"cited_title":"Robust conformal prediction for stl runtime verification under distribution shift","cited_arxiv_id":null,"evidence_quote":"The robust conformal prediction baseline for STL runtime verification, with bounded-shift assumptions that the paper argues do not hold in its out-of-distribution settings."},{"cited_title":"Conformal prediction for stl runtime verification","cited_arxiv_id":null,"evidence_quote":"Prior conformal prediction for STL runtime verification whose exchangeability assumption adaptive conformal prediction removes."},{"cited_title":"Case study: verifying the safety of an autonomous racing car with a neural network controller","cited_arxiv_id":null,"evidence_quote":"Supplies the F1Tenth car platform and controller used in Case Study I, including the state trajectories and safety property."},{"cited_title":"Incremental learning with memory regressors for motion prediction in autonomous racing","cited_arxiv_id":null,"evidence_quote":"Source of the incremental learning method, with fine-tuned predictors and memory, that Algorithm 1 adapts."},{"cited_title":"An environment for autonomous driving decision-making","cited_arxiv_id":null,"evidence_quote":"The highway-env race car environment used to generate Case Study II trajectories."}],"review_version":1}