Conformal Recovery-Deadline Certificates Enable Safer AI Controller Failover
A new paper uses conformal prediction to give adapting controllers a safe grace period
Runtime assurance (RTA) systems protect safety-critical AI controllers by switching to a verified safe backup when a monitored condition is violated. The standard approach uses a latching shield that trips on the first breach — which works for diverging controllers but fails with online-adapting ones. These advanced controllers need a bounded recovery transient to excite the plant and correct faults, but the latching shield incorrectly suppresses them during that window, a problem the paper calls 'suppression pathology'.
To solve this, Alireza Shojaei proposes Conformal Recovery-Deadline Certificates — split-conformal, distribution-free, finite-sample upper bounds on the adapting controller's recovery time. The certificate licenses a delayed fallback with a statistical coverage guarantee, backstopped by a verified monitor at a hard limit. The method separates autonomy (statistical) from safety (verified), and proves marginal, weighted, and group-conditional coverage. Validated on two unrelated Simplex testbeds — a 6-DOF spacecraft and an inverted pendulum — the approach eliminates suppression while maintaining safety.
- Standard latching shields trip on the first breach, suppressing capable adapting controllers during their recovery transient — a 'suppression pathology' shown on 6-DOF spacecraft and inverted pendulum testbeds
- The Conformal Recovery-Deadline Certificate uses split-conformal prediction to produce a finite-sample upper bound on recovery time, enabling delayed fallback with a coverage guarantee
- The method separates autonomy (statistical coverage) from safety (verified hard limit), proving marginal, weighted, and group-conditional coverage
Why It Matters
Enables safer deployment of adaptive AI in aircraft, spacecraft, and autonomous systems by eliminating false failsafe activations.