PaperlayerView exact revision on arXiv

Source-linked AI summary

CUBICS: Situation-aware performance estimation for safety-relevant ML components

Benjamin Herd, Jessica Kelly, Mario Trapp

arXiv:2608.16564v1cs.AI

TL;DR

Global Bernoulli models inadequately capture context-dependent ML performance and situation coverage. CUBICS estimates per-component, situation-specific guarantees with Subjective Logic and combines them with context beliefs, exposing localized deficits and data gaps that pooled models can mask.

  • Problem

    Global Bernoulli or binomial models with i.i.d. trials inadequately represent ML components whose performance varies across operational situations.

  • Method

    CUBICS partitions the operational design domain into situations and updates per-component, situation-conditional assumptions and probabilistic guarantees as Subjective Logic opinions.

  • Results

    CUBICS exposes localized performance deficits and data gaps that global Bernoulli models hide, while its marginal guarantee provides a more accurate component-level assessment.

  • Takeaways & Limitations

    Situation-aware, context-modular estimates can provide component-level building blocks for broader field-data-based safety assurance arguments.

  • Takeaways & Limitations

    The current instantiation focuses on binomial failure modes for a single component, with situation combinatorial growth and within-cell stationarity remaining challenges.

Abstract

from arXiv · show

Machine learning (ML) is a key technology driving innovation today, but ensuring ML safety remains a major challenge for safety-related applications. A promising idea is to build proven-in-use arguments from field data, e.g. by running ML components (MLCs) in shadow mode or within safety envelopes so that their outputs can be monitored as 'safe probes' without affecting safety. These probes can then be used to build a statistical argument about field performance in a Bayesian way. However, many Bayesian field-data approaches in safety engineering model failures as a simple Bernoulli (or binomial) process with a single global failure probability and i.i.d. trials, which is rarely adequate for MLCs whose performance depends strongly on context. Statistical evidence is also about coverage of relevant situations, including edge cases, and building a single integrated statistical model for the entire system is usually not feasible. To address these challenges, this paper introduces CUBICS, a context-modular framework for per-component, situation-aware performance estimation of safety-relevant ML components. CUBICS partitions the operational design domain into situations and, for each safety-relevant component, defines a set of situation-specific assumptions and probabilistic guarantees that are represented and updated in a Bayesian manner using Subjective Logic (SL). By combining these guarantees with beliefs about how often each situation occurs, CUBICS derives an overall risk estimate for each component without requiring a monolithic system-level statistical model, and thus provides a building block for modular, field-data based safety assurance.

I. INTRODUCTION

CUBICS addresses the inadequacy of global i.i.d. failure models for context-dependent ML components by estimating situation-specific performance and combining it into modular, context-weighted safety evidence. It uses Subjective Logic contracts and runtime evidence updates to support per-component assurance without requiring a monolithic system-level statistical model.

  • Motivation: ML safety assurance can use shadow-mode components to collect field data without safety-relevant impact and build statistical evidence.Bayesian updating can estimate failure probability and uncertainty from probe outcomes.
  • Problem: A single global Beta-Bernoulli failure probability can mask situation-specific insufficiencies when ML performance depends strongly on context.The introduction illustrates this problem with vision-system failures being more likely in heavy rain than clear conditions.
  • CUBICS methodology: CUBICS partitions the operational design domain into discrete situations and defines situation-specific assumptions and probabilistic guarantees for each safety-relevant component.Situations can be defined by context dimensions such as weather or lighting conditions.
  • CUBICS methodology: CUBICS represents context assumptions and situation-conditional failure behaviour as Subjective Logic opinions, deriving per-situation guarantees and a marginal context-weighted risk contribution.Its context-aware update mechanism distributes positive and negative runtime evidence across situations under context uncertainty.
  • Evaluation: The evaluation tests whether CUBICS recovers known situation-specific reliability patterns, improves informativeness over pooled Bernoulli models, and remains sensitive to priors, context errors, and data scarcity.A synthetic case study and a YOLOv12 detector trained on BDD100K are used to assess these questions.

II. BACKGROUND · A. Subjective Logic · 1) Constructing Multinomial opinions:

Subjective Logic represents uncertainty through opinions over binary or n-ary domains, combining belief, disbelief, and uncertainty with probability- and evidence-theoretic reasoning. Multinomial opinions are constructed from evidence counts, base rates, and prior weight, and correspond to Dirichlet distributions over categorical probabilities.

  • A. Subjective Logic: Subjective Logic combines probability theory and Dempster–Shafer evidence theory to reason under uncertainty.
  • A. Subjective Logic: A subjective opinion records an agent’s belief, disbelief, and uncertainty about a proposition.
  • A. Subjective Logic: For a finite mutually exclusive and collectively exhaustive domain X, a multinomial opinion is ωX = (bX, uX, aX).
  • A. Subjective Logic: The belief vector bX distributes belief mass across states, while uX is the remaining uncommitted mass and complement of confidence.The belief masses support individual states as the true state.
  • A. Subjective Logic: The base-rate vector aX is an a priori probability distribution used when no committed belief is present.Each belief mass, uncertainty value, and base rate lies in [0, 1], with belief masses plus uncertainty summing to 1.
  • A. Subjective Logic: Vacuous opinions encode full uncertainty, whereas absolute opinions place all belief on one state.An absolute opinion has zero uncertainty and belief mass 1 on the focused state.
  • 1) Constructing Multinomial opinions:: They correspond to Dirichlet distributions, with parameters αxi = rxi + axiW for i = 1, . . . , K.The paper then defines the expectation value of xi from these parameters.

2) Combining opinions:

Subjective Logic combines opinions through operators that manipulate underlying distributions more simply than direct distribution calculations. This section uses multinomial multiplication for independent variables and multinomial deduction for conditional relationships.

  • Combining opinions:: Subjective Logic offers combination operators that provide an intuitive alternative to directly manipulating underlying distributions.The paper uses selected operators defined in prior work.
  • Combining opinions:: For independent opinions on variables with distinct domains, multinomial multiplication computes a joint opinion over their Cartesian product.The resulting joint opinion is denoted ωX∧Y = ωX ·ωY, with corresponding belief, uncertainty, and product base rate.
  • Combining opinions:: For a conditional relationship in which Y depends on X, multinomial deduction derives Y’s marginal opinion from X’s opinion and conditional opinions on Y.The deduction operator combines ωX with the conditional-opinion set ωY |X to produce ωY ∥X.

III. THE CUBICS METHODOLOGY · A. Situation-based decomposition of the ODD · B. Contracts for safety-relevant components

CUBICS decomposes the operational design domain into discrete situations and assigns each safety-relevant ML component situation-specific contracts. Subjective Logic combines context beliefs and conditional safety guarantees into modular, context-aware safety assessments.

  • III. THE CUBICS METHODOLOGY: CUBICS structures safety assurance around situation-based ODD decomposition, modular per-component contracts, and Subjective Logic updates of situation and component-safety beliefs.These elements support conditional and marginal safety guarantees from operation-time evidence.
  • A. Situation-based decomposition of the ODD: The ODD is represented by finite context dimensions whose Cartesian product defines situations, each corresponding to a specific combination of context values.Examples include Rain = Yes and Wind = High.
  • A. Situation-based decomposition of the ODD: Within each situation, CUBICS assumes the relevant failure outcomes are approximately stationary and exchangeable Bernoulli trials with a constant failure probability.This makes a situation-specific Bernoulli model more representative than a single global model.
  • B. Contracts for safety-relevant components: For each component and situation, a safety contract combines assumptions about the current context with guarantees about conditional component safety.Assumptions may come from perception, operational profiles, or scenario analyses; guarantees rely on analyses, field or shadow-mode data, and expert judgment.
  • III. THE CUBICS METHODOLOGY: The methodology aggregates situation-specific contracts into an overarching global guarantee while embedding component-level, context-aware assessments in a broader safety case.The simplified example contains eight situations, each with a unique safety contract.
  • B. Contracts for safety-relevant components: Incoming field observations are weighted by situational opinions and accumulated fractionally into Dirichlet parameters, refining conditional guarantees as evidence increases.The mechanism uses the situational assessment as a probabilistic weighting signal for binary observations.
  • B. Contracts for safety-relevant components: Subjective Logic represents context assumptions as multinomial opinions combined into a joint situational opinion, while guarantees form a set of conditional opinions indexed by situations.A joint belief about context values links directly to the corresponding situation-specific guarantee.
  • B. Contracts for safety-relevant components: CUBICS assigns each interacting component its own context-dependent contract, allowing upstream guarantees to serve as evidence for downstream assumptions.This component-level composition connects contracts without recomputing guarantees in one monolithic probabilistic model.

C. Conditional and marginal contract guarantees · 1) Conditional view (one guarantee per situation):

CUBICS distinguishes conditional and marginal contract guarantees: the conditional view keeps one guarantee for each situation, while the marginal view aggregates them into an overall guarantee under the operational profile. For each situation, the conditional view represents a binary guarantee opinion, enabling context-specific component reasoning.

  • C. Conditional and marginal contract guarantees: A component contract defines two closely related guarantee views: conditional and marginal.The conditional view is situation-specific, whereas the marginal view summarizes these guarantees overall.
  • 1) Conditional view (one guarantee per situation):: The conditional view maintains one guarantee per situation si ∈ S.Each guarantee is explicitly conditioned on the corresponding situation.
  • C. Conditional and marginal contract guarantees: The marginal view aggregates per-situation guarantees into a single overall guarantee.This aggregation is performed under the modelled operational profile.
  • 1) Conditional view (one guarantee per situation):: For each situation si ∈ S, CUBICS maintains a conditional opinion ωG|si over a binary guarantee domain G.The domain can, for example, contain Safe and Unsafe outcomes.
  • 1) Conditional view (one guarantee per situation):: The collection ωG|S = { ωG|si | si ∈ S } constitutes the contract’s conditional view.It contains the situation-specific opinions maintained across the situation set.
  • 1) Conditional view (one guarantee per situation):: This conditional representation supports detailed, context-specific reasoning about the component in each situation.Reasoning is performed separately for the situations represented in S.

2) Marginal view (one aggregated guarantee over all situations): · D. Continuous update of situational beliefs and guarantees

CUBICS aggregates situation-specific guarantees into one marginal opinion weighted by the operational likelihood of each situation, while retaining the conditional view for detailed reasoning. Both situational beliefs and guarantees are continuously updated with Bayesian evidence in Subjective Logic, including fractional updates and heterogeneous evidence integration.

  • 2) Marginal view (one aggregated guarantee over all situations):: Marginal analysis produces one overall opinion about guarantee G by accounting for the differing probabilities of situations under the operational profile.This opinion represents the guarantee from the perspective of actual system operation.
  • 2) Marginal view (one aggregated guarantee over all situations):: CUBICS combines opinions over context dimensions with conditional per-situation guarantees through multinomial deduction to derive a single marginal opinion ωG.Context opinions induce beliefs over situations, which weight the corresponding conditional guarantees.
  • 2) Marginal view (one aggregated guarantee over all situations):: Multinomial deduction weights each per-situation guarantee by the belief that its situation occurs and aggregates the results into an overall risk assessment with uncertainty.The joint context opinion is computed through multinomial conjunction.
  • 2) Marginal view (one aggregated guarantee over all situations):: The conditional view retains per-situation guarantees for context-specific reasoning, whereas the marginal view summarizes the component’s overall risk contribution.Both views are derived from the same contract.
  • D. Continuous update of situational beliefs and guarantees: CUBICS updates context-dimension opinions and conditional guarantee opinions as new evidence arrives, thereby changing both the situational joint opinion and inferred marginal risk opinion.The Bayesian design treats neither set of opinions as static.
  • D. Continuous update of situational beliefs and guarantees: Expected situation probabilities weight observed evidence when updating conditional guarantees, using accumulated success and failure counts for each situation.The update uses the expected probability E(si) derived from the situational joint opinion.
  • D. Continuous update of situational beliefs and guarantees: For example, with E(s0) = 0.8, E(s1) = 0.2, and an observed failure, CUBICS increments the corresponding failure counts fractionally by 0.8 and 0.2.The mechanism distributes one observation across situations according to their expected probabilities.
  • D. Continuous update of situational beliefs and guarantees: Operating in Subjective Logic lets CUBICS combine heterogeneous statistical evidence and domain knowledge, incorporate supporting and adverse observations, and update risk assessments without a monolithic system-wide model.These evolving assessments can support higher-level assurance reasoning.

IV. EXPERIMENTAL SET-UP … 3) Model Architecture and Training:

The experimental setup implements CUBICS as a Python framework, evaluates it on the diverse BDD100K driving dataset, and trains a YOLOv12-Large baseline at high resolution for 100 epochs.

  • IV. EXPERIMENTAL SET-UP: The experiments include CUBICS’s Python implementation, architectural decisions, training-pipeline details, and datasets.The source code is available at https://doi.org/10.5281/zenodo.21932463.
  • 1) CUBICS Python implementation:: CUBICS provides executable support for defining context-dependent safety contracts, representing them in Subjective Logic, and continuously updating them with new evidence.The implementation conceptually mirrors the methodology described in Section III.
  • 1) CUBICS Python implementation:: Weather, lighting, and time of day are represented as multinomial Subjective Logic opinions and combined into a joint situational opinion over their Cartesian product.
  • 2) Datasets:: The experiments use the Berkeley DeepDrive (BDD100K) dataset because it offers diverse driving scenarios and frame-level environmental attributes.
  • 2) Datasets:: 100,000 annotated images are divided into 70k/10k/20k training, validation, and testing splits, respectively.The standard 10k validation set was stratified into mutually exclusive sub-datasets based on weather attributes.
  • 3) Model Architecture and Training:: YOLOv12-Large (YOLOv12l) is the primary baseline, initialized with pre-trained COCO weights to accelerate training.
  • 3) Model Architecture and Training:: Input resolution is scaled to 1024 × 1024 pixels to preserve small, distant objects such as pedestrians in low-visibility conditions.
  • 3) Model Architecture and Training:: Training is conducted over 100 epochs.

4) Hardware: · V. EVALUATION · A. RQ1 (Internal validity): Can CUBICS recover known,

The evaluation used a controlled synthetic scenario to test whether CUBICS recovers situation-specific reliability from observed outcomes, while also comparing its situational estimates with global pooling. Results show that CUBICS preserves uncertainty in data-scarce conditions and exposes performance variation that pooled estimates can conceal.

  • 4) Hardware:: All experiments ran on a single NVIDIA GeForce RTX 4090 GPU with 24GB of VRAM.
  • V. EVALUATION: The evaluation addressed three research questions, using a synthetic case study for RQ1 and the Section IV setup for RQ2 and RQ3.
  • A. RQ1 (Internal validity): Can CUBICS recover known,: CUBICS was tested in a controlled perception scenario with known situation-specific failure rates to verify recovery of per-situation reliability and marginal guarantees.
  • situation-specific reliability patterns in a controlled scenario?: The design-time contract modeled Rain, Wind, and ToD as context dimensions, combining their multinomial Subjective Logic opinions into eight joint situations.
  • situation-specific reliability patterns in a controlled scenario?: Operation-time learning began with vacuous priors and simulated N = 5,000 cycles, updating context and conditional performance opinions from sampled situations and binary outcomes.
  • situation-specific reliability patterns in a controlled scenario?: After N = 5,000 cycles, conditional Beta distributions sharpened as epistemic uncertainty decreased, while scarce data continued to limit confidence.The experiment initialized beliefs with vacuous priors and updated guarantees separately for all eight context situations.
  • situation-specific reliability patterns in a controlled scenario?: CUBICS converged toward the predefined situation-specific reliability patterns, recovering per-situation failure rates within their uncertainty bounds when assumptions held.
  • situation-specific reliability patterns in a controlled scenario?: For the person class, the global pooled guarantee concentrated at E = 0.653 with negligible uncertainty, masking adverse Foggy + Dawn/dusk performance of E=0.25, u=0.083.The situational distributions distinguished benign and adverse conditions, whereas pooling produced a narrow estimate near p ≈0.65.

prior choices, misclassification of context, and data scarcity?

CUBICS is largely robust to reasonable prior choices and moderate context misclassification, while data scarcity increases prior influence and uncertainty. Across these variations, numerical guarantees and uncertainty change, but the qualitative risk ordering remains unchanged.

  • Prior Choice: In data-rich Clear Day data (N = 4,242), low uncertainty (u = 0.0005) lets evidence overwhelm the prior and anchor E(Safe | scd) at 0.65.In contrast, prior assumptions visibly influence expected guarantees in data-scarce situations, where uncertainty is higher.
  • Context Misclassifications: Increasing context misclassification makes target situation guarantees more optimistic and less distinct from the source, especially when targets are data-scarce.Misclassified evidence has a moderate effect in data-rich Snowy Night because existing samples dilute it, but even small amounts visibly affect data-scarce Foggy Dawn.
  • Data Scarcity: A foggy-night truck-detection edge case with N = 1 and TP = 0, FN = 1 yields a frequentist recall of exactly 0.0%, illustrating the brittleness of single-sample evaluation.CUBICS explicitly accounts for the severe data scarcity rather than treating the single missed detection as a deterministic, overconfident penalty.
  • Overall Robustness: Across prior, classification, and sample-size variations, E(Safe | sx) and u change numerically but the qualitative risk ordering between situations does not change.Context misclassification gradually weakens situation-specific distinctions, making the model more like a global Bernoulli view.

VI. THREATS TO VALIDITY … B. Assurance confidence and reliability modelling

The paper identifies threats to CUBICS from metadata errors, prior sensitivity, limited outcome modelling, situation-space scalability, stale evidence, and unanticipated conditions. Related work motivates modular Bayesian and Subjective Logic approaches for updating assurance confidence without a monolithic system model.

  • VI. THREATS TO VALIDITY — A. Internal: Mislabelled per-image metadata can route evidence to the wrong conditional opinion, distorting both situational and marginal guarantees.CUBICS uses the standard SL non-informative prior weight W=2, but sparse-evidence posteriors remain sensitive because this prior omits domain-specific knowledge.
  • VI. THREATS TO VALIDITY — B. External Validity: The evaluation’s single-class TP/FN counts fit a binomial model, but continuous perception failures would require an appropriate continuous-outcome model.With k context dimensions of cardinality n_i, the number of situations grows multiplicatively, creating scalability concerns.
  • VI. THREATS TO VALIDITY — B. External Validity: A realistic ODD with dozens of dimensions can cause a combinatorial explosion, leaving many situation cells with sparse evidence and guarantees dominated by the prior.Hierarchical or factored situation-space representations are identified as a natural mitigation.
  • VI. THREATS TO VALIDITY — B. External Validity: Cumulative SL fusion weights all historical evidence equally, so outdated observations are never discounted and may produce overconfident guarantees that no longer reflect current behaviour.This limitation concerns evidence evolution as the system or environment changes.
  • VI. THREATS TO VALIDITY — B. External Validity: The marginal guarantee assumes exhaustive situations and is blind to novel or adversarial conditions outside the ODD, so its completeness depends on the underlying situation specification.The marginal aggregates defined situations using observed frequencies.
  • VII. RELATED WORK — A. Continuous safety assurance and runtime monitoring: Continuous safety assurance maintains safety arguments by monitoring operational behaviour, detecting assurance deficits, and updating the safety case as systems or environments change.Runtime monitoring and runtime assurance observe system and environment variables, check safety constraints, and trigger mitigation or enforcement actions when constraints may be violated.
  • VII. RELATED WORK — B. Assurance confidence and reliability modelling: Bayesian assurance methods address impractical mileage requirements for rare catastrophic events by modelling uncertainty and incrementally updating confidence from evidence.Bayesian methods also support assurance-oriented test planning in which sample sizes target specified posterior confidence levels.
  • VII. RELATED WORK — B. Assurance confidence and reliability modelling: Subjective Logic represents uncertainty and base rates, combines probabilistic opinions, and supports modular assurance updates without a single monolithic system-level probabilistic model.Prior reliability work also weights claims by expected use and models reliability across input/context partitions while accounting for operational-profile uncertainty and drift.

C. Context-aware and scenario-based safety analysis · VIII. CONCLUSIONS AND FUTURE WORK

The paper situates CUBICS within context-aware and scenario-based safety analysis, then presents it as a situation-aware, SL-based methodology for modular ML-component assurance. It concludes by identifying extensions for richer metrics, multi-component composition, and scalable situation models.

  • C. Context-aware and scenario-based safety analysis: Context-aware safety analysis represents system behaviour as dependent on operating conditions in an ODD, while scenario-based evaluation structures verification and validation around ODD-derived scenarios.In automated driving, the ODD specifies the conditions under which a driving automation system is intended to function.
  • C. Context-aware and scenario-based safety analysis: Scenario-based safety research addresses SOTIF triggering conditions and argues that evidence should emphasise scenario coverage, environmental conditions, and risk-exposure frequencies rather than pure mileage.Scenario-based approaches also support accelerated tests that expose SOTIF-related hazards.
  • C. Context-aware and scenario-based safety analysis: CUBICS decomposes the ODD into logical-scenario-like situations, assigns each a continuously updated Bayesian safety guarantee, and maintains explicit beliefs about situation occurrence.These situation-specific probabilistic cells can contribute to component-level risk through aggregation using contracts while preserving uncertainty.
  • VIII. CONCLUSIONS AND FUTURE WORK: CUBICS estimates safety-relevant ML-component performance continuously and situation-wise by representing assumptions and guarantees as SL opinions and applying SL deduction.The methodology extends earlier SL-based safety-contract work to ML components whose behaviour depends on an explicit ODD.
  • VIII. CONCLUSIONS AND FUTURE WORK: At the probabilistic level, CUBICS instantiates a context-stratified hierarchical model over situation-specific failure probabilities without claiming a novel underlying theory.Its contribution lies in embedding this structure into situation-specific SL contracts.
  • VIII. CONCLUSIONS AND FUTURE WORK: Contracts are maintained per component and situation, runtime evidence uses context-aware fractional updates under uncertain ODD labelling, and opinions support broader safety-assurance arguments.The synthetic case study examined this structure under its modelling assumptions.
  • VIII. CONCLUSIONS AND FUTURE WORK: Future work targets continuous-valued metrics, small multi-component chains, scalable hierarchical or factored situation models, and SL-compatible temporal discounting.These directions respond to the current focus on binomial failure modes for one component, combinatorial situation growth, and stationarity within each situation cell.
Loading 2608.16564v1…