Why we do not publish the model's probability
A survival model emits a number between zero and one. Publishing it as confidence would be a promise the system cannot keep.
The survival ensemble produces S_P(t), the probability that a pool retains its liquidity through time t. It is already a number between zero and one. The obvious thing to do is print it next to the horizon and call it confidence.
That would be wrong, and specifically wrong in a way that matters for a bonded claim.
A model probability is conditional on the model
S_P(t) is a probability under the model. It inherits every misspecification the model carries. If the proportional hazards assumption fails, or if the feature distribution shifts because a new chain behaves unlike anything in the training set, the model’s stated 0.9 may correspond to an empirical frequency of 0.6.
For a dashboard that is a quality issue. For a claim someone posts a bond against and a vault gates capital on, it is a false statement with a number attached.
Split conformal instead
Conformal prediction gives distribution-free, finite-sample coverage under exchangeability — the guarantee holds regardless of whether the underlying model is correctly specified.
Partition historical attestations into a training set and a calibration set of size n. Fit the ensemble on the training set. For each calibration example with realised breach time Y and predicted horizon Ĥ, compute a nonconformity score:
sᵢ = ( Ĥᵢ − Yᵢ ) / ς̂ᵢThe score is signed, and that is deliberate. Over-prediction of the horizon is the error that matters, because it is the error that gets a user liquidated. Under-predicting a horizon costs someone some yield. Over-predicting one costs them the exit.
For target coverage 1 − α, take the empirical quantile of those scores and publish the conformalised lower bound rather than the point estimate:
H_pub = Ĥ_P − q₍₁₋α₎ · ς̂_PSo a published confidence of 0.7 means something checkable: across the calibration distribution, at least 70% of attestations at this level have horizons that were not exceeded by an actual breach. It is a statement about long-run frequency, verifiable against the public record, and it survives model misspecification.
signed
over-prediction is the error that gets someone liquidated
1 − α
coverage holds without assuming the model is right
lower bound
what gets published, not the point estimate
Where the guarantee stops
Conformal coverage requires exchangeability, and market regimes are emphatically not exchangeable. A calibration set drawn from a period of expanding liquidity will not cover a contraction. Pretending otherwise would reintroduce exactly the problem we started with, one level up.
Three mitigations, none of them complete:
Regime-stratified calibration. Separate calibration sets per market regime, classified by aggregate stablecoin supply direction, cross-chain flow direction and realised volatility. An attestation is conformalised against the stratum matching current conditions.
Weighted conformal. Under covariate shift with estimable likelihood ratios, weighted conformal prediction restores coverage. The shift weights come from a discriminative classifier trained to tell the calibration distribution from the current one.
Explicit degradation. When the current feature distribution lies outside the support of every available stratum — a new chain, a novel incentive structure, an unprecedented rate — the system does not extrapolate. It publishes a reduced-confidence attestation flagged OUT_OF_SUPPORT, and the bond terms for such attestations differ.
The uncomfortable corollary
Conformal guarantees hold under exchangeability, which means the guarantee lapses precisely during stress — the moment anyone most wants it. That is a real limitation, it is listed as one, and the honest response is the degradation flag rather than a confident number produced from a calibration set that does not apply.
It also constrains what can be launched and when. Phase 0 is silent: the ensemble runs daily against a covered universe with attestations logged privately, and nothing is published. Conformal calibration needs a calibration set with realised outcomes, and publishing uncalibrated confidence would poison the record permanently. The phase ends at several hundred resolved attestations across enough regimes — not several dozen.