Calibration and Risk-Budgeted Decisions with System One Models

• System One models expose bounded decision scores for fast structured decisions, addressing the latency bottlenecks of autoregressive generation.Source: §1 · p. 1
• When abstention is unavailable, uncertainty triggers a conservative fallback—blocking an input or retaining a document—while always using that fallback can cause over-refusal or context bloat.Source: §1 · p. 1
• The proposed policy uses Learn Then Test (LTT) to certify threshold regions within a False Omission Rate constraint, replacing selective abstention with a conservative fallback.Source: §1 · p. 2
• The study asks whether scores represent positive-event probabilities and separate classes, how threshold policies trade risk against utility, and how outcomes vary across System One models and baselines.Source: §1 · p. 2
• Across six datasets, safe deployment requires task-specific validation and rigorous risk budgeting rather than assuming universal System One calibration.Source: §1 · p. 2

• Selective classification trades coverage for accuracy by delegating uncertain inputs, while this work fixes two actions and measures error within the negative-action subset.Source: §2 · p. 2
• This work applies LTT’s conditional-risk formulation to binary action policies rather than restricting it to abstention.Source: §2 · p. 2
• Prior calibration research includes neural-network metrics and proper scores [Guo et al., 2017; Nixon et al., 2019; Ferrer and Ramos, 2025], alongside LLM confidence studies [Jiang et al., 2021; Kadavath et al., 2022; Tian et al., 2023; Xiong et al., 2024].Source: §2 · p. 2
• Typed-decision studies examine calibration and error ranking [Hu, 2026] or probability coherence [Li et al., 2026a], but do not certify a selected policy’s error rate.Source: §2 · p. 2

3.1 Actions and Asymmetric Risk

• The high-stakes target is Y = 1, while Y = 0 denotes benign or irrelevant cases; predicting 0 when Y = 1 is the critical error.Source: §3.1 · p. 2
• A frozen scorer assigns larger scores as evidence for Y = 1, and threshold τ maps scores below τ to Action 0 and scores at or above τ to Action 1.Source: §3.1 · p. 2
• Action 0 is the utility-maximizing choice for safe inputs or irrelevant documents; Action 1 is the conservative fallback, including when predictions are uncertain.Source: §3.1 · p. 2
• False negatives are critical failures, whereas false positives are lower-priority utility losses through over-refusal or irrelevant-document inclusion.Source: §3.1 · p. 2

3.2 The Optimization Trade-Off

• Always choosing Action 1 avoids the targeted error but leaves an empty negative-action subset and a practically useless system.Source: §3.2 · p. 3
• The objective is to maximize the negative-action subset under a population risk budget, reducing false positives while statistically controlling False Omission Rate.Source: §3.2 · p. 3

4.1 Certifying the False Omission Rate

• LTT specializes statistical testing to binary conditional risk, selecting among an ordered, independently fixed threshold family or returning non-deployment.Source: §4.1 · pp. 3–4
• The procedure uses separate scorer-fitting and calibration data; under i.i.d. calibration sampling, it tests whether each candidate’s False Omission Rate exceeds α.Source: §4.1 · pp. 3–4
• A small lower-tail binomial p-value supplies evidence for certification, while an empty Action-0 calibration subset receives p_j = 1.Source: §4.1 · p. 4
• Returning non-deployment means no useful negative-action subset was certified, so every deployment input receives the conservative Action 1 fallback rather than individual deferral.Source: §4.1 · p. 4

4.2 Why Naive Thresholding Is Not Enough

• Under exact calibration, threshold τ has risk at most τ, so setting τ = α bounds risk; uncalibrated scores can instead permit excessive risk.Source: §4.2 · p. 4
• LTT tests the population-risk constraint using finite-sample data without requiring calibrated scores; its guarantee concerns calibration sampling, not every finite test estimate.Source: §4.2 · p. 4

5.1 Evaluated Models

• Evaluated systems include probability-interface System One models, task-specific moderation, safety, and reranking baselines, PCA-Ridge, and base and fine-tuned Kev models.Kev-ft was fine-tuned on approximately 10k examples for 37 minutes.Source: §5.1 · p. 4

5.2 Tasks and Datasets

• Six datasets cover moderation, prompt-injection and trajectory safety, and binary filtering of SciDocs and StackOverflow query–document pairs.Moderation uses WildGuardMix and Aegis; safety uses S-Labs and ATBench.Source: §5.2 · p. 4
• Data are divided into label-stratified fit, calibration, and test splits; the dataset table reports split details and test positive-event prevalence.Calibration data select thresholds, while test data evaluate the fixed policies.Source: Table 1 · p. 5, §5.2 · p. 5

5.3 Threshold Selection Policies

• Three threshold policies are compared: Naive sets τ = α, Empirical selects the lowest-FOR calibration-feasible threshold, and LTT returns the largest certified threshold.LTT uses a statistical error level of δ = 0.10.Source: §5.3 · p. 5

5.4 Evaluation Metrics

• Evaluation measures score separation and probability alignment, then assesses deployment utility, test FOR, excess risk, policy availability, inference cost, and latency.Score diagnostics include AUROC, negative-action AP, 10-bin ECE, and Brier score; utility is measured by TNR.Source: §5.4 · p. 5

6.1 Q1: Calibration is Task-Dependent and Insufficient for Policy Viability

• Jev’s ECE ranges from 0.034 on WildGuardMix to 0.29 on SciDocs, and lower ECE need not indicate better class separation or policy viability.On StackOverflow, Kev-base has ECE 0.051 versus 0.16 for Kev-ft, but AUROC 0.599 versus 0.81.Source: §6.1 · pp. 5–6, Table 2 · p. 6

6.2 Q2: LTT Prioritizes Safety While Naive Thresholds Frequently Exceed Budgets

• On Aegis at α = 0.15, Span-01’s Naive policy reaches 95.3% utility at 60.9% empirical risk; on WildGuardMix, Jev’s utility rises from 68.7% to 96.8% under LTT at 12.8% risk.The WildGuardMix comparison is at α = 0.15.Source: §6.2 · p. 6
• 7.8% LTT exceedance frequency compares with 42% for Naive and 51.7% for Empirical across settings with defined test risk.LTT mean excess is 0.1%; Empirical mean excess is 1.17%, and Naive mean excess is 7.09%.Source: §6.2 · p. 6, Table 3 · p. 7

6.3 Q3: Adaptation Expands Availability, Though General System One Models Remain Highly Competitive

• At α = 0.15, Kev-ft returns LTT policies on all six datasets versus one for Kev-base; across budgets, adaptation expands availability from 13/36 to 31/36 settings.On WildGuardMix, Jev reaches 96.8% utility, while Kev-ft reaches 82.5%; Span-01 and Solar-Decide fail entirely in the reported comparison.Source: §6.3 · pp. 6–7, Figure 2 · p. 7

6.4 Local Open-Weights Models Provide the Most Efficient Cost-Latency Balance

• Kev-ft provides a cost-latency balance of $0.0030 per 1,000 examples and 98 ms/example, while PCA-Ridge costs $0.0026 and takes 5,247 ms/example.PCA-Ridge’s delay comes from embedding extraction through Qwen3-8B before logistic regression.Source: §6.4 · p. 7

• Favorable global diagnostics do not guarantee utility, and naive or empirical thresholding often causes severe, silent risk violations.Source: §7 · p. 7
• LTT controls risk in the useful action region without trusting raw scores as true probabilities, but its conservative certification can reduce policy availability.Source: §7 · p. 7
• At α = 0.15, Table 4 reports test FOR risk and TNR utility, with red risk values marking budget exceedances.Source: Table 4 · p. 8
• The deployment comparison also reports inference cost in USD per 1,000 and latency in milliseconds.Source: Table 5 · p. 8
• When zero-shot interfaces fail to certify, adapting a local open-weights model can recover certified utility, but requires labeled training data.Source: §7 · p. 8
• Future work should extend LTT certification to multi-model cascades and investigate whether larger calibration samples tighten risk bounds and improve policy availability.Source: §7 · p. 8

• The finite-sample guarantee assumes calibration and deployment examples are i.i.d. from the same distribution; the six English-language benchmarks do not establish performance under deployment or adversarial shift.Source: Limitations · p. 9
• Exact binomial certification requires enough selected calibration examples, so small calibration sets or strict budgets can make LTT default to non-deployment.Source: Limitations · p. 9
• Recovering certified utility with a fine-tuned open-weights model requires labeled training data and local compute, which may be unavailable in cold-start deployments.Source: Limitations · p. 9

Ethical Considerations

• The study analyzes harmful, offensive, and adversarial text through labels and model scores, without distributing raw harmful examples.Source: Ethical Considerations · p. 9
• Low measured FOR is not a blanket safety endorsement, aggregate metrics do not establish equitable error rates, and benchmark annotations are not universal definitions.Source: Ethical Considerations · p. 9

A Calibration–Policy Identity Supporting Proof

• Under exact calibration, the calibration–policy identity gives the bound R(τ) ≤ τ.Source: A Calibration–Policy Identity… · p. 11

B.1 Model Configurations and Supervision

• The evaluated interfaces include proprietary System One models and a reranking specialist; the local model is a LoRA-adapted Qwen backbone, while PCA-Ridge and Qwen3Guard have specified scoring setups.Source: §B.1 · p. 11

B.2 Data Splitting and Evaluation Roles

• Fit, calibration, and test pools are separated by role, with calibration used for threshold selection and test data reserved for evaluating fixed policies.Source: §B.2 · p. 11
• Reranking pairs are balanced and separated by query ID, with one candidate selected per query to avoid treating multiple candidates as independent rows.Source: §B.2 · p. 12

B.3 Input Formatting Specifications

• Safety evaluation formats serialized agent trajectories and bounds their length with per-component limits and truncation markers where needed.Source: §B.3 · p. 12

B.4 LTT Implementation Details

• LTT tests thresholds built from up to 200 sorted fit-score midpoints plus endpoints, and screens out low-support candidates to avoid premature termination of fixed-sequence testing.At δ = 0.10, the stated minimum support is 45 for α = 0.05 and 22 for α = 0.10; the implementation applies a floor of 25.Source: §B.4 · p. 12

B.5 Metrics and Uncertainty Quantification

• False Omission Rate is the target risk, while utility is Benign Acceptance for safety and Irrelevant Removal for filtering; positive excess risk is max(estimated risk − α, 0).Calibration is measured with Brier Score and Expected Calibration Error using 10 equal-width bins.Source: §B.5 · p. 12
• Uncertainty is quantified using 1,000 unstratified bootstrap resamples (seed 42) of test rows, evaluating fixed thresholds and models; confidence intervals use linearly interpolated 2.5th and 97.5th percentiles.Source: §B.5 · p. 12

B.6 Resource Accounting

• Resource accounting reports costs per 1,000 workload examples and latency in milliseconds per example, as descriptive historical overheads rather than controlled hardware-synchronized benchmarks.Experiments and cost calculations were conducted between late September and early October 2026.Source: §B.6 · p. 13

B.7 Artifact Access and Terms

• Artifact terms vary: listed dataset cards include explicit licenses, while SciDocs and StackOverflow derivative cards lack an explicit license declaration.The open-weights models are Apache-2.0; proprietary endpoints were accessed under providers’ standard commercial terms, and evaluations were offline.Source: §B.7 · p. 13

C.1 Score Diagnostics with 95% Intervals

• Table 6 reports test score diagnostics with 95% intervals and marks supervised adaptation with an asterisk.Source: Table 6 · p. 14

C.2 Risk and Utility at Every Budget, with 95% Intervals

• Tables 7–12 report test risk and utility at α values 0.05, 0.10, 0.15, 0.20, 0.40, and 0.50, with 95% confidence intervals.The captions define ND/NF as no returned policy, UD as undefined FOR, and distinguish risk-budget exceedances.Source: Table 7 · p. 15, Table 8 · p. 16, Table 9 · p. 17

C.3 Risk Versus Budget: All Models and Datasets

• Figures 3–8 plot test False Omission Rate against risk budget for WildGuardMix, Aegis, S-Labs, ATBench, SciDocs, and StackOverflow.Status grids show α columns and Naive, Empirical, and LTT rows.Source: Figure 3 · p. 21, Figure 4 · p. 21, Figure 5 · p. 22

C.4 LTT Risk–Utility Across Datasets

• Figure 9 plots LTT-selected operating points for all six datasets, using benign acceptance for moderation and safety and irrelevant removal for reranking as utility.Source: §C.4 · p. 24, Figure 9 · p. 24
• Missing certificates are not plotted as zero-risk points.Source: §C.4 · p. 24
• At α = 0.15, large outlined markers identify selected points, smaller markers show other budgets, and counts report defined policies and ND outcomes.The dotted line marks 15%; an asterisk denotes supervised adaptation.Source: Figure 9 · p. 24