Pith. sign in

REVIEW 2 major objections 5 minor 49 references

LLM tool-call safety should be certified argument by argument: whole-action risk control dilutes rare high-risk fields in proportion to their rarity, while role-stratified calibration certifies each sufficiently sampled role with a finite-s

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 01:19 UTC pith:MLA5OCAE

load-bearing objection Worth engaging: role-stratified calibration is a real granularity fix, but the headline simultaneous certificate rests on a disclosed field-independence condition that the main protocol doesn't guarantee. the 2 major comments →

arxiv 2607.24343 v2 pith:MLA5OCAE submitted 2026-07-27 cs.LG cs.AIcs.CL

Beyond Aggregate Risk: Role-Stratified Conformal Risk Control for LLM Tool Calls

Md Ashikur Rahman , Md Arifur Rahman , Niamul Hassan Samin , Khandaker Rifah Tasnia , Md Hasibul Amin , Sifat Rahman Ahona , Juena Ahmed Noshin This is my paper
classification cs.LG cs.AIcs.CL
keywords conformal risk controlrole-stratified calibrationper-field certificationprompt injection defensetool-calling LLM agentsfinite-sample guaranteesdistribution shiftrare-role pooling
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper contends that existing conformal risk control for language-model agents certifies an entire tool call, so a violation in a rare high-risk argument—a payment account, a recipient, a credential—can be masked by the many harmless fields around it. It introduces role-stratified per-field conformal risk control, which assigns each semantic argument role its own allow-threshold and risk budget, and pools roles that are too rare to certify alone. The central formal claim is that aggregate control pays a price of coarseness: it inflates a rare role's violation rate by 1/p_r and shrinks that role's effective budget to alpha times p_r, whereas role-level calibration certifies each sufficiently sampled role directly, with a finite-sample guarantee under exchangeability. On two prompt-injection benchmarks across six models, the role-level method stays within its per-role budget under attack transfer, detector noise, gradual drift, unseen tool suites, and adaptive attacks. If the claim holds, safety guarantees for agentic tool use should be stated at the semantic-role level, not the whole-action level.

Core claim

Structured tool calls carry a granularity mismatch: the unit being certified (the action) differs from the unit that causes harm (the argument). The paper proves that any controller observing only aggregate action-level loss can certify a rare role r at budget alpha only by enforcing aggregate risk at alpha p_r, where p_r is the role's field prevalence; with target fields at roughly 12% of the field stream, a 1% aggregate budget can permit about 8% target violations. Role-stratified per-field conformal risk control fixes the target unit: for each role it chooses the largest threshold whose inflated empirical count of allowed-and-violated fields stays within the role's own budget, giving E[lo

What carries the argument

The central object is role-stratified per-field conformal risk control: a calibration layer that wraps any per-field influence detector and applies the conformal risk-control rule separately to each semantic argument role, where a role is the named argument position of a tool call (target, credential, command, content). Its decision rule selects, per role, the largest allow-threshold whose inflated empirical risk—(number of allowed-and-violated calibration fields plus one) divided by (n_r+1)—does not exceed the role's budget, which yields E[loss] <= alpha(r) by the standard conformal argument. A simultaneous high-probability certificate is built from exact one-sided binomial upper confidence

Load-bearing premise

The load-bearing premise is field-level independence of the calibration observations within each role stratum: the paper's main simultaneous certificate treats each emitted field as an independent Bernoulli draw, and if one episode emits several correlated same-role fields the all-field interval can become anti-conservative (the paper notes a one-per-episode alternative but does not use it in the main results).

What would settle it

Record a stream of episodes in which a single episode frequently emits multiple same-role fields driven by the same untrusted token, calibrate the all-field construction at a 1% budget with delta=0.05, and repeat over many splits; if the frequency with which the simultaneous exact binomial interval misses the true role violation rate exceeds about 5%, the all-field certificate is overstating coverage. The paper's own episode-level construction should then be run on the same data: it should restore coverage at the cost of a larger effective n_r.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • A 1% aggregate budget does not protect rare high-risk fields: on the paper's data it can permit up to about 8% target violations, whereas role-level calibration keeps observed target violation at 0.0–0.3%.
  • The calibration layer is detector-agnostic: any per-field detector can be plugged in; stronger detectors directly reduce over-intervention and utility loss, while safety is fixed by calibration.
  • Rare roles cannot be certified individually with the available data; credential fields number roughly 91 total, far fewer than the approximately 300 needed for a 1% certificate, so they must be pooled or blocked.
  • With frozen thresholds, role stratification is the main source of robustness; conformal recalibration additionally restores finite-sample validity and bounds frozen-threshold degradation by the total variation between source and target distributions.
  • At a zero budget, the method degenerates to a deterministic detector-relative noninterference monitor, linking statistical calibration to hard information-flow guarantees.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same dilution argument likely applies beyond tool calls to any structured AI output where a rare field carries authority (database rows, config files, multi-field generation); per-role stratification is a testable extension there.
  • Because the main certificates use every field of a role, deployments that emit several same-role fields per episode should pre-aggregate to one observation per episode; a sensitivity analysis on such data would reveal how much the all-field certificate overstates coverage.
  • In low-attack-prevalence deployments, the unconditional rate V(r) can look compliant while attack-conditional leakage is high; the paper's label-conditional variant should be preferred when attack prevalence is a deployment variable.
  • A natural next step is to extend certification from field-value integrity to tool selection, omitted actions, and call ordering, where the current guarantee does not apply; the paper names this as future work.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. This paper proposes role-stratified per-field conformal risk control (CRC) for LLM tool calls. Instead of certifying an entire action at one aggregate risk level, the method assigns each semantic argument role its own risk budget and threshold, pools roles that are too rare to certify individually, and uses split CRC (Eq. 5) together with a simultaneous Clopper-Pearson-based certificate (Theorem 2). The authors prove a price-of-coarseness result (Propositions 1 and 2, Theorem 1): an aggregate-only controller can allow a rare high-risk role to exceed its budget by a factor of about 1/p_r. They evaluate on AgentDojo and InjecAgent with six models and 20-seed trace-replay, reporting better role-specific budget compliance than action-level baselines under shift, transfer, unseen tool suites, detector noise, and adaptive attacks.

Significance. If the claims hold, the paper makes a useful contribution: it identifies a real granularity mismatch in current conformal defenses for LLM agents, gives a clean impossibility result and a constructive calibration method with standard theoretical underpinnings, and ships reproducible trace-replay experiments (20 seeds, cached traces, explicit limitation statements). The central Eq. (5) expectation guarantee is standard and sound under field-level exchangeability. The empirical evaluation is careful and the disclosures are exemplary. However, the high-probability simultaneous certificate (Theorem 2) rests on a field-level independence assumption that the authors themselves concede may fail in the main implementation, so the headline "formal per-role guarantees" overstates the support for the reported high-probability claims. This is fixable by using the episode-level construction or by carefully separating the two guarantee types.

major comments (2)
  1. [Simultaneous high-probability certification / Supplement A] Theorem 2's simultaneous certificate requires field-level independence within each stratum, not merely exchangeability. The manuscript's own Supplement A states that when an episode emits several same-role fields, "those fields may be correlated, and counting all of them can make n_r overstate the effective sample size," so the all-field interval can be anti-conservative; the episode-level construction restoring exactness is "not used for the main results." Since Algorithm 1 and the main experiments calibrate on every emitted field, the abstract's "formal per-role guarantees under exchangeability" and the conclusion's "certifies risk at the semantic-role level" are too strong for the reported main-result certificates. Please either apply the episode-level construction when reporting certificates (and report the one-per-episode sensitivity in the main text) or rephrase the claims so that
  2. [Abstract and Conclusion] The phrase "formal per-role guarantees under exchangeability" is ambiguous between the expectation guarantee of Eq. (5) and the simultaneous high-probability certificate of Theorem 2. The latter is not an exchangeability-only guarantee; it additionally needs field-level independence. The paper already distinguishes "certificate" from "empirical budget compliance" under shift, and the abstract should make the same distinction. Otherwise a reader cannot tell whether the reported numbers are certified or empirical. Please specify which form of guarantee is claimed in each headline statement.
minor comments (5)
  1. [Abstract] "Across AgentDojo and InjecAgent with six language models" is misleading because the InjecAgent replication in Supplement B is reported only for GPT-4o-mini. Please clarify the model coverage per benchmark.
  2. [Table 1 / Table B.1] The relationship between Table 1 and the per-model panel in Table B.1 is confusing despite the note. Consider moving the "separate protocol" explanation into the main text or the table caption.
  3. [Table 2] The 'Tun./Cert.' column mixes a tunable-budget indicator with a certificate level ('agg.' vs 'role'). Please define these terms explicitly in the caption.
  4. [Supplement A] The sentence "the residual within-episode dependence therefore affects only the benign denominator n_r" is a useful clarification, but it appears only in the supplement. A one-sentence version in the main text near Algorithm 1 would help readers assess the practical impact of the assumption.
  5. [Reproducibility] The paper refers to a "code archive" but gives no URL or repository identifier. Please add a link or explicit availability statement.

Circularity Check

0 steps flagged

No circularity: the derivation is self-contained; the acknowledged field-independence caveat is a correctness limitation, not a circular reduction.

full rationale

The paper's derivation chain is self-contained and does not reduce its conclusions to its inputs. Proposition 1 is an immediate arithmetic consequence of the definitions V = sum_r p_r V(r) and V(r) <= alpha_agg/p_r; it is not fitted to data. Proposition 2 is a minimax construction: it defines aggregate-measurable controllers as those seeing only (Phi, Lagg), then exhibits P0 and P1 with identical observables and different role-level risk. This is a valid indistinguishability argument and, while close to formalizing the definition, it is not circular -- it establishes tightness rather than assuming the conclusion. Theorem 1 invokes Blackwell's comparison of experiments as an external result and contributes the closed-form price-of-coarseness bound and the constructive conformal method. Theorem 2 relies on Clopper-Pearson validity, an external statistical result, with the field-level independence assumption stated explicitly; Supplement A's concession that correlated same-role fields make all-field intervals anti-conservative is an honest correctness limitation, not a circular step. The empirical sections report comparisons with baselines under a common detector; no parameter is fitted to the target conclusion and then renamed as a prediction. There are no self-citations carrying the argument. The zero-budget limit (Proposition 3) is explicitly labeled a conceptual limit. Overall score 0.

Axiom & Free-Parameter Ledger

3 free parameters · 5 axioms · 0 invented entities

Central claim rests on exchangeability and field-level independence; the paper states both. The remaining assumptions are standard monotonicity and correct violation labels. No invented physical entities are introduced; semantic roles are a conceptual taxonomy adopted from prior work.

free parameters (3)
  • Role-specific risk budgets alpha(r) = 1% in-distribution, 2% under shift; 10% for aggregate baselines
    Hand-chosen evaluation budgets; the method certifies to these budgets and the central claim is stated relative to them.
  • Total failure probability delta = 0.10 in allocation experiment; 0.05 in credential sample-size calculation
    User-chosen confidence level for simultaneous certificate; affects width and the number of required fields.
  • Pooling policy for rare roles = credential pooled with {target, command, credential}
    Chosen because per-role credential floors (6.7%-63.6%) exceed the 1% budget; the certificate then applies to the pooled stratum, not to credential alone.
axioms (5)
  • domain assumption Field-level exchangeability within each role stratum between calibration and test
    Needed for Eq (5) and the standard CRC guarantee; stated explicitly in Supplement A 'Field-level exchangeability.'
  • domain assumption Field-level independence within each stratum for Clopper-Pearson validity
    Theorem 2 treats stratum-g calibration fields as independent Bernoulli draws; the authors acknowledge this can fail when episodes emit several correlated same-role fields, making the all-field interval potentially anti-conservative.
  • domain assumption Violation labels are correct and complete; unattacked fields cannot be labeled violated
    Defines V(r) and V_att(r) and the decomposition V(r)=pi(r)V_att(r); if labels are noisy, the certified quantity changes.
  • standard math Monotonicity and right-continuity of the role loss in the threshold
    Used to define the CRC selector in Eq (5) and in the proof of Theorem 2 via the deterministic population boundary tau*_g.
  • domain assumption Semantic role assignment is meaningful and (mostly) stable at deployment
    The method's strata are semantic roles; role-label noise is tested in Supplement E and degrades but does not break control.

pith-pipeline@v1.3.0-alltime-deepseek · 22460 in / 16797 out tokens · 187862 ms · 2026-08-03T01:19:01.557475+00:00 · methodology

0 comments
read the original abstract

Language-model agents act through structured tool calls whose arguments carry very different risks: untrusted content may legitimately shape an email body but should never set a recipient, account, command, or credential. Existing conformal risk control methods certify a tool call as a whole, so a failure in one rare high-risk field can be averaged away by the many benign arguments around it, leaving the argument that causes harm uncertified. We introduce role-stratified per-field conformal risk control, a calibration layer that wraps any per-field detector and assigns a separate threshold and risk budget to each semantic argument role. We show that aggregate certification pays a price of coarseness, tightening a rare role's effective budget in proportion to how often that role appears, whereas role-stratified calibration certifies each sufficiently sampled role directly with a finite-sample guarantee and pools the rarest roles. Across AgentDojo and InjecAgent with six language models, our method achieves the most consistent role-specific budget compliance among the methods we evaluate under model and attack transfer, detector noise, gradual drift, unseen tool suites, and adaptive attacks, providing formal per-role guarantees under exchangeability or after recalibration. These results suggest that structured tool calls should be certified at the semantic-role level, not the whole action.

Figures

Figures reproduced from arXiv: 2607.24343 by Juena Ahmed Noshin, Khandaker Rifah Tasnia, Md Arifur Rahman, Md Ashikur Rahman, Md Hasibul Amin, Niamul Hassan Samin, Sifat Rahman Ahona.

Figure 1
Figure 1. Figure 1: (a) Utility versus target violation on GPT-4o at a 2% budget using the deployable score over 20 seeds. (b) Empirical compliance across eight shifted conditions: per-field CRC 100% ± 0%, PACT-inspired threshold 61% ± 33%, and FIDES￾inspired labels 48% ± 48%. Results in panel (b) report empirical compliance under shift. Attacker. The attacker controls untrusted text from web￾pages, emails, or retrieved docum… view at source ↗

Review history (2 revisions) →

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

49 extracted references · 8 linked inside Pith

  1. [1]

    The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the

    Fan, Linfeng and Li, Ziwei and Tian, Yuan and Wang, Yichen and Li, Rongsheng and Wang, Xiong , journal =. The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the. 2026 , url =

    2026

  2. [2]

    arXiv preprint arXiv:2505.23643 , year =

    Securing AI Agents with Information-Flow Control , author =. arXiv preprint arXiv:2505.23643 , year =

    Pith/arXiv arXiv

  3. [3]

    arXiv preprint arXiv:2503.18813 , year =

    Defeating Prompt Injections by Design , author =. arXiv preprint arXiv:2503.18813 , year =

    Pith/arXiv arXiv

  4. [4]

    arXiv preprint arXiv:2606.23277 , year =

    Pith/arXiv arXiv

  5. [5]

    Causality Laundering: Denial-Feedback Leakage in Tool-Calling

    Chinaei, Mohammad Hossein , journal =. Causality Laundering: Denial-Feedback Leakage in Tool-Calling. 2026 , url =

    2026

  6. [6]

    2026 , url =

    Ying, Zonghao and Wang, Haozheng and Liu, Jiangfan and Zou, Quanchen and Liu, Aishan and Yang, Jian and Yang, Yaodong and Liu, Xianglong , journal =. 2026 , url =

    2026

  7. [7]

    arXiv preprint arXiv:2603.30016 , year =

    Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attacks , author =. arXiv preprint arXiv:2603.30016 , year =

    arXiv

  8. [8]

    Taxonomy, Evaluation and Exploitation of

    Ji, Zimo and Wang, Xunguang and Li, Zongjie and Ma, Pingchuan and Gao, Yudong and Wu, Daoyuan and Yan, Xincheng and Tian, Tian and Wang, Shuai , journal =. Taxonomy, Evaluation and Exploitation of. 2025 , url =

    2025

  9. [9]

    2025 , url =

    Chen, Sizhe and Piet, Julien and Sitawarin, Chawin and Wagner, David , booktitle =. 2025 , url =

    2025

  10. [10]

    2025 , doi =

    Chen, Sizhe and Zharmagambetov, Arman and Mahloujifar, Saeed and Chaudhuri, Kamalika and Wagner, David and Guo, Chuan , booktitle =. 2025 , doi =

    2025

  11. [11]

    Proceedings of the Conference on Applied Machine Learning in Information Security (CAMLIS 2024) , series =

    Defending Against Indirect Prompt Injection Attacks With Spotlighting , author =. Proceedings of the Conference on Applied Machine Learning in Information Security (CAMLIS 2024) , series =. 2024 , publisher =

    2024

  12. [12]

    The Instruction Hierarchy: Training

    Wallace, Eric and Xiao, Kai and Leike, Reimar and Weng, Lilian and Heidecke, Johannes and Beutel, Alex , journal =. The Instruction Hierarchy: Training. 2024 , url =

    2024

  13. [13]

    , booktitle =

    Piet, Julien and Alrashed, Maha and Sitawarin, Chawin and Chen, Sizhe and Wei, Zeming and Sun, Elizabeth and Alomair, Basel and Wagner, David A. , booktitle =. 2024 , publisher =

    2024

  14. [14]

    33rd USENIX Security Symposium (USENIX Security 24) , pages =

    Formalizing and Benchmarking Prompt Injection Attacks and Defenses , author =. 33rd USENIX Security Symposium (USENIX Security 24) , pages =. 2024 , url =

    2024

  15. [15]

    2026 , url =

    Feng, Yushi and Du, Junye and Wang, Qifan and Ma, Zizhan and Niu, Qian and Matsuo, Yutaka and Feng, Long and Yu, Lequan , journal =. 2026 , url =

    2026

  16. [16]

    Mitigating

    Abbasi-Yadkori, Yasin and Kuzborskij, Ilja and Stutz, David and Gy. Mitigating. 2024 , eprint =

    2024

  17. [17]

    , journal =

    Pang, Lingyou and Huang, Lei and Lin, Jianyu and Wang, Tianyu and Aue, Alexander and Priebe, Carey E. , journal =. Taming Variability: Randomized and Bootstrapped Conformal Risk Control for. 2025 , url =

    2025

  18. [18]

    2026 , url =

    Badshah, Sher and Emami, Ali and Sajjad, Hassan , journal =. 2026 , url =

    2026

  19. [19]

    International Conference on Learning Representations (ICLR) , year =

    Conformal Risk Control , author =. International Conference on Learning Representations (ICLR) , year =

  20. [20]

    Foundations and Trends in Machine Learning , volume =

    Conformal Prediction: A Gentle Introduction , author =. Foundations and Trends in Machine Learning , volume =. 2023 , doi =

    2023

  21. [21]

    The Annals of Applied Statistics , volume =

    Learn then Test: Calibrating Predictive Algorithms to Achieve Risk Control , author =. The Annals of Applied Statistics , volume =. 2025 , doi =

    2025

  22. [22]

    Journal of the ACM , volume =

    Distribution-Free, Risk-Controlling Prediction Sets , author =. Journal of the ACM , volume =. 2021 , doi =

    2021

  23. [23]

    2005 , url =

    Algorithmic Learning in a Random World , author =. 2005 , url =

    2005

  24. [24]

    Machine Learning: ECML 2002 , series =

    Inductive Confidence Machines for Regression , author =. Machine Learning: ECML 2002 , series =. 2002 , publisher =

    2002

  25. [25]

    Journal of the American Statistical Association , volume =

    Distribution-Free Predictive Inference for Regression , author =. Journal of the American Statistical Association , volume =. 2018 , doi =

    2018

  26. [26]

    2003 , note =

    Mondrian Confidence Machine , author =. 2003 , note =

    2003

  27. [27]

    Advances in Neural Information Processing Systems (NeurIPS) , year =

    Class-Conditional Conformal Prediction with Many Classes , author =. Advances in Neural Information Processing Systems (NeurIPS) , year =

  28. [28]

    The Annals of Statistics , volume =

    Conformal Prediction Beyond Exchangeability , author =. The Annals of Statistics , volume =. 2023 , doi =

    2023

  29. [29]

    Proceedings of the 42nd International Conference on Machine Learning , volume =

    Kandinsky Conformal Prediction: Beyond Class- and Covariate-Conditional Coverage , author =. Proceedings of the 42nd International Conference on Machine Learning , volume =. 2025 , publisher =

    2025

  30. [30]

    Advances in Neural Information Processing Systems (NeurIPS) Datasets and Benchmarks Track , year =

    Debenedetti, Edoardo and Zhang, Jie and Balunovi. Advances in Neural Information Processing Systems (NeurIPS) Datasets and Benchmarks Track , year =

  31. [31]

    2024 , doi =

    Zhan, Qiusi and Liang, Zhixiang and Ying, Zifan and Kang, Daniel , booktitle =. 2024 , doi =

    2024

  32. [32]

    arXiv preprint arXiv:2312.14197 , year =

    Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models , author =. arXiv preprint arXiv:2312.14197 , year =

    Pith/arXiv arXiv

  33. [33]

    Not What You've Signed Up For: Compromising Real-World

    Greshake, Kai and Abdelnabi, Sahar and Mishra, Shailesh and Endres, Christoph and Holz, Thorsten and Fritz, Mario , booktitle =. Not What You've Signed Up For: Compromising Real-World. 2023 , doi =

    2023

  34. [34]

    and Hashimoto, Tatsunori , booktitle =

    Ruan, Yangjun and Dong, Honghua and Wang, Andrew and Pitis, Silviu and Zhou, Yongchao and Ba, Jimmy and Dubois, Yann and Maddison, Chris J. and Hashimoto, Tatsunori , booktitle =. Identifying the Risks of. 2024 , url =

    2024

  35. [35]

    arXiv preprint arXiv:2307.15043 , year =

    Universal and Transferable Adversarial Attacks on Aligned Language Models , author =. arXiv preprint arXiv:2307.15043 , year =

    Pith/arXiv arXiv

  36. [36]

    arXiv preprint arXiv:2410.21276 , year =

    Pith/arXiv arXiv

  37. [37]

    arXiv preprint arXiv:2507.06261 , year =

    Pith/arXiv arXiv

  38. [38]

    arXiv preprint arXiv:2407.21783 , year =

    The. arXiv preprint arXiv:2407.21783 , year =

    Pith/arXiv arXiv

  39. [39]

    2024 , url =

    Yang, An and Yang, Baosong and Zhang, Beichen and Hui, Binyuan and Zheng, Bo and Yu, Bowen and Li, Chengyuan and Liu, Dayiheng and Huang, Fei and Wei, Haoran and Lin, Huan and Yang, Jian and Tu, Jianhong and Zhang, Jianwei and Yang, Jianxin and Yang, Jiaxi and Zhou, Jingren and Lin, Junyang and Dang, Kai and Lu, Keming and Bao, Keqin and Yang, Kexin and Y...

    2024

  40. [40]

    Communications of the ACM , volume =

    A Lattice Model of Secure Information Flow , author =. Communications of the ACM , volume =. 1976 , doi =

    1976

  41. [41]

    Communications of the ACM , volume =

    Certification of Programs for Secure Information Flow , author =. Communications of the ACM , volume =. 1977 , doi =

    1977

  42. [42]

    Journal of Computer Security , volume =

    A Sound Type System for Secure Flow Analysis , author =. Journal of Computer Security , volume =. 1996 , doi =

    1996

  43. [43]

    Foundations of Software Science and Computational Structures (FoSSaCS) , series =

    On the Foundations of Quantitative Information Flow , author =. Foundations of Software Science and Computational Structures (FoSSaCS) , series =. 2009 , publisher =

    2009

  44. [44]

    The Annals of Mathematical Statistics , volume =

    Equivalent Comparisons of Experiments , author =. The Annals of Mathematical Statistics , volume =. 1953 , doi =

    1953

  45. [45]

    Proceedings of the Thirty-Seventh Conference on Uncertainty in Artificial Intelligence , volume =

    Distribution-Free Uncertainty Quantification for Classification Under Label Shift , author =. Proceedings of the Thirty-Seventh Conference on Uncertainty in Artificial Intelligence , volume =. 2021 , publisher =

    2021

  46. [46]

    Advances in Neural Information Processing Systems (NeurIPS) , year =

    Conformal Prediction Under Covariate Shift , author =. Advances in Neural Information Processing Systems (NeurIPS) , year =

  47. [47]

    2026 , url =

    Opoku, Jeffery and Banahene, David , journal =. 2026 , url =

    2026

  48. [48]

    arXiv preprint arXiv:2602.04364 , year =

    Anytime-Valid Conformal Risk Control , author =. arXiv preprint arXiv:2602.04364 , year =

    arXiv

  49. [49]

    Conformal Selective Acting: Anytime-Valid Risk Control for

    Khosravi, Hassan and Huo, Xiaoming , journal =. Conformal Selective Acting: Anytime-Valid Risk Control for. 2026 , url =

    2026