Deployed machine learning systems face distribution drift, yet most monitoring pipelines stop at alarms and leave the response underspecified under labeling, compute, and latency constraints. We introduce Drift2Act, a drift-to-action controller that treats monitoring as constrained decision-making with explicit safety. Drift2Act combines a sensing layer that maps unlabeled monitoring signals to a belief over drift types with an active risk certificate that queries a small set of delayed labels from a recent window to produce an anytime-valid upper bound Ut(δ) on current risk. The certificate gates operation: if Ut(δ)≤τ, the controller selects low-cost actions (e.g., recalibration or test-time adaptation); if Ut(δ)>τ, it activates abstain/handoff and escalates to rollback or retraining under cooldowns. In a realistic streaming protocol with label delay and explicit intervention costs, Drift2Act achieves near-zero safety violations and fast recovery at moderate cost on WILDS Camelyon17, DomainNet, and a controlled synthetic drift stream, outperforming alarm-only monitoring, adapt-always adaptation, schedule-based retraining, selective prediction alone, and an ablation without certification. Overall, online risk certification enables reliable drift response and reframes monitoring as decision-making with safety.
Figures & tables
Figure 1: Belief evolution over drift types. Posterior bt(d)=P(Dt=d∣z1:t) over {none,covariate,concept,subgroup} across time; dashed lines mark drift events that shift belief and guide intervention choice.
Method
Ctot
V
Tdet
Trec
minAccwg
Camelyon17 stream
Alarm-only
3.2
46
22
210
0.71
Adapt-always (TTA)
58.0
3
18
74
0.79
Retrain-on-schedule
41.5
9
35
96
0.77
Selective prediction only
9.8
14
24
160
0.74
Controller (no certificate)
18.7
7
19
98
0.78
Table 1: Main streaming results under operational constraints. We report total cost Ctot , safety violations V , detection delay Tdet , recovery time Trec , and minimum worst-group accuracy minAccwg across Camelyon17, DomainNet, and SyntheticDrift-CIFAR using τ=0.20 , δ=0.05 , and label delay d=50 .
Figure 2: Certified controller performance under cost–safety trade-offs and drift. (Left) Safety–cost Pareto frontier on Camelyon17. (Right) Recovery dynamics around a drift event relative to threshold τ , with intervention times marked.
Appendix figures & tables13 assets
Supplementary material from the paper’s appendix.
Appendix
Action
Name
Operational effect
Cost (units)
A0
No-op
Continue inference with current parameters θ and current output policy.
0.0
A1
Recalibrate
Update a lightweight calibrator using St ; logits unchanged.
0.2
A2
Test-time adapt
Apply a small number of adaptation steps on Bt ; update θ←θ′ .
1.0
A3
Query labels
Request kt labels from recent inputs; add to St′ when they arrive.
0.05kt
A4
Retrain
Trigger retraining using St plus logged data; deploy updated θ .
12.0
A5
Rollback
Revert to a previously validated checkpoint θsafe .
1.5
Appendix
Table 2: Action space and normalized operational costs used by the controller.
Act.
Name
Prereq./Effect
Cooldown
Cost
A0
No-op
Keep θ .
–
0.0
A1
Recalib.
Update from St .
–
0.2
A2
TTA
Adapt on Bt .
–
1.0
A3
Query
Request kt ; delay d .
–
0.05kt
A4
Retrain
Retrain + deploy.
Δrt
12.0
A5
Rollback
Restore θsafe .
Δrb
1.5
Appendix
Table 3: Streaming protocol action costs and prerequisites. Normalized costs and cooldowns.
Baseline
Configuration
Alarm-only
Alarm when ∥zt∥2>θalarm with θalarm=2.5 ; no actions beyond logging.
Adapt-always
Apply A2 every step; 1 gradient step per batch; learning rate 10−4 .
Retrain-on-schedule
Trigger A4 every Prt=1200 steps, respecting cooldown Δrt .
Selective prediction only
Predict if maxypθ(y∣x)≥θsel with θsel=0.6 ; otherwise abstain ( A6 ).
Controller (no cert.)
Same as ours but remove gating: replace Ut(δ)>τ branch by normal utility maximization.
Appendix
Table 4: Baseline configurations used in all streaming experiments. We report the fixed hyperparameters that fully specify each baseline policy under the common action set and costs.
Drift type d
A0
A1 (recalib.)
A2 (TTA)
A3 (query)
A4 (retrain)
A5 (rollback)
A6 (abstain)
none
0.00
0.10
0.05
0.08
0.12
0.10
0.15
covariate
0.00
0.35
0.70
0.25
0.85
0.40
0.55
concept
0.00
0.20
0.30
0.75
1.05
0.60
0.65
subgroup
0.00
0.25
0.35
0.85
0.95
0.55
0.80
Appendix
Table 5: Gain table G(d,a) used by the controller. Gains are computed by offline synthetic-drift calibration as normalized windowed risk reduction (Eqs. equation 146 –equation 147 ) at horizon H=150 with normalization σR=0.10 . Rows correspond to drift types d∈{none,covariate,concept,subgroup} and columns correspond to actions a∈{A0,…,A6} .
Method variant
Ctot
V
Tdet
Trec
minAccwg
FIR
Camelyon17 stream
Alarm-only
3.2(±0.3)
46(±4)
22(±2)
210(±18)
0.71(±0.02)
0.05(±0.01)
Adapt-always (TTA)
58.0(±2.1)
3(±1)
18(±2)
74(±6)
0.79(±0.01)
0.82(±0.03)
Retrain-on-schedule
41.5(±1.8)
9(±2)
35(±3)
96(±9)
0.77(±0.01)
0.21(±0.03)
Selective prediction only
9.8(±0.6)
14(±3)
24(±2)
160(±14)
0.74(±0.02)
0.14(±0.02)
Controller (no certificate)
18.7(±1.1)
7(±2)
19(±2)
98(±8)
0.78(±0.01)
0.16(±0.02)
Appendix
Table 6: Ablations on the full streaming protocol. Metrics match the main paper: cumulative cost Ctot , safety violations V , detection delay Tdet , recovery time Trec , and minimum worst-group accuracy minAccwg . The last column reports the false-intervention rate (FIR): the fraction of time steps in which the method intervenes ( at=A0 ) while the deployed risk is already below the safety target.
Variant
Ctot
V
Tdet
Trec
minAccwg
FIR
Camelyon17 stream
Drift2Act (full)
24.6(±1.4)
0(±0)
20(±2)
62(±5)
0.81(±0.01)
0.10(±0.02)
No belief (single score)
23.3(±1.3)
4(±2)
21(±2)
90(±8)
0.78(±0.01)
0.17(±0.02)
No active labeling (fixed rate)
24.1(±1.3)
2(±1)
20(±2)
76(±7)
0.80(±0.01)
0.21(±0.03)
No certificate gating
23.7(±1.2)
6(±2)
20(±2)
88(±8)
0.79(±0.01)
0.12(±0.02)
MMD-only monitors
25.0(±1.4)
3(±2)
24(±3)
83(±8)
0.79(±0.01)
0.16(±0.02)
Appendix
Table 7: Internal component ablations of Drift2Act (same controller interface). Each row removes one internal module: belief (replace with single drift-score thresholds), active labeling (replace with fixed label rate), certificate gating (do not force fallback when risk may be unsafe), and monitor stack (use MMD-only rather than multi-monitor).
Camelyon17
DomainNet
SyntheticDrift-CIFAR
Method
FIR
Heavy-FIR
FIR
Heavy-FIR
FIR
Heavy-FIR
Alarm-only
0.05(±0.01)
0.00(±0.00)
0.06(±0.01)
0.00(±0.00)
0.04(±0.01)
0.00(±0.00)
Adapt-always (TTA)
0.82(±0.03)
0.00(±0.00)
0.85(±0.03)
0.00(±0.00)
0.80(±0.03)
0.00(±0.00)
Retrain-on-schedule
0.21(±0.03)
0.05(±0.01)
0.23(±0.03)
0.06(±0.01)
0.20(±0.03)
0.05(±0.01)
Selective prediction only
0.14(±0.02)
0.00(±0.00)
0.18(±0.02)
0.00(±0.00)
0.15(±0.02)
0.00(±0.00)
Controller (no certificate)
0.16(±0.02)
0.02(±0.01)
0.19(±0.02)
0.03(±0.01)
0.17(±0.02)
0.02(±0.01)
Appendix
Table 8: False-intervention diagnostics. FIR measures unnecessary interventions during already-safe operation; Heavy-FIR counts unnecessary retrain/rollback events. The certified controller remains selective, while adapt-always exhibits high unnecessary intervention by design.
Delay d
Ctot
V
Tdet
Trec
0
23.1(±1.2)
0(±0)
20(±2)
54(±5)
25
23.8(±1.3)
0(±0)
20(±2)
58(±5)
50
24.6(±1.4)
0(±0)
20(±2)
62(±5)
100
26.2(±1.6)
1(±1)
21(±2)
78(±7)
Appendix
Table 9: Sensitivity to label delay d (Camelyon17) Increasing delay slows recovery because verification arrives later, which delays safe exit from fallback and slows escalation decisions.
Budget Blab
Ctot
V
Tdet
Trec
1000
21.4(±1.2)
2(±1)
20(±2)
86(±8)
2000
23.0(±1.3)
1(±1)
20(±2)
72(±7)
3000
24.6(±1.4)
0(±0)
20(±2)
62(±5)
5000
26.8(±1.6)
0(±0)
20(±2)
55(±5)
Appendix
Table 10: Sensitivity to labeling budget Blab (Camelyon17) Larger budgets tighten certificates faster around drift events, reducing recovery time and violations at moderate added cost.
Drift pattern
Ctot
V
Tdet
Trec
FIR
minAccwg
Sudden drift (baseline setting)
21.2(±1.2)
0(±0)
15(±2)
58(±5)
0.09(±0.02)
0.82(±0.01)
Gradual drift (slow ramp)
20.6(±1.2)
0(±0)
19(±2)
72(±6)
0.10(±0.02)
0.81(±0.01)
Gradual drift (fast ramp)
21.5(±1.2)
0(±0)
16(±2)
63(±5)
0.09(±0.02)
0.82(±0.01)
Recurring drift (short period)
22.8(±1.3)
0(±0)
14(±2)
61(±5)
0.11(±0.02)
0.81(±0.01)
Recurring drift (long period)
21.9(±1.2)
0(±0)
15(±2)
60(±5)
0.10(±0.02)
0.82(±0.01)
Appendix
Table 11: Gradual and recurring drift (SyntheticDrift-CIFAR) Gradual drift mainly increases recovery time, while recurring drift mainly tests whether the controller avoids repeated heavy interventions when the stream revisits regimes.
Per-label cost
Ctot
V
Tdet
Trec
FIR
minAccwg
0.01
23.5(±1.3)
0(±0)
20(±2)
58(±5)
0.11(±0.02)
0.81(±0.01)
0.05
24.6(±1.4)
0(±0)
20(±2)
62(±5)
0.10(±0.02)
0.81(±0.01)
0.10
25.2(±1.5)
1(±1)
21(±2)
70(±6)
0.12(±0.02)
0.80(±0.01)
Appendix
Table 12: Effect of per-label cost (Camelyon17) When labels become expensive, the controller shifts toward adaptation and conservative fallback rather than frequent audits, increasing recovery time but preserving safety.
Noise level
Ctot
V
Tdet
Trec
FIR
minAccwg
0.00
24.6(±1.4)
0(±0)
20(±2)
62(±5)
0.10(±0.02)
0.81(±0.01)
0.25
25.1(±1.5)
0(±0)
21(±2)
64(±5)
0.12(±0.02)
0.81(±0.01)
0.50
26.0(±1.6)
1(±1)
22(±2)
70(±6)
0.15(±0.03)
0.80(±0.01)
0.75
27.3(±1.7)
2(±1)
24(±3)
78(±7)
0.18(±0.03)
0.79(±0.01)
Appendix
Table 13: Robustness to monitor noise (Camelyon17) With noisier monitors, drift evidence becomes less reliable and interventions become slightly more frequent; certificate gating prevents large safety regressions by requiring verification before unsafe operation persists.
Method
Ctot
V
Tdet
Trec
minAccwg
FIR
Alarm-only
3.0(±0.3)
41(±5)
20(±2)
180(±15)
0.73(±0.01)
0.05(±0.01)
Adapt-always (TTA)
56.0(±2.5)
4(±2)
16(±2)
70(±7)
0.80(±0.01)
0.79(±0.03)
Retrain-on-schedule
38.0(±2.0)
9(±3)
28(±3)
96(±9)
0.78(±0.01)
0.20(±0.02)
Controller (no certificate)
17.9(±1.2)
6(±2)
18(±2)
88(±9)
0.79(±0.01)
0.15(±0.02)
Controller + certificate (ours)
23.5(±1.4)
0(±0)
19(±2)
60(±6)
0.82(±0.01)
0.11(±0.02)
Appendix
Table 14: Amazon Reviews temporal stream. The certified controller maintains low violations and strong recovery while keeping costs moderate compared to always-adapt and schedule-based retraining.
Real-world datasets often exhibit evolving distributions, known as concept drift. Ignoring drift degrades predictive performance, while reliance on fixed hyperparameters further limits model adaptability under changing conditions. Adaptive learning addresses this challenge by continuously updating models online, allowing them to incrementally adjust and remain effective as data distributions evolve. This paper presents the Stream Cruise Control Method (SCCM), a comprehensive framework for drift detection and adaptation in online regression. SCCM enables automated adaptation through early-response, pre-update drift detection, drift magnitude quantification, KPI-window-based thresholding for local false-alarm mitigation, dynamic hyperparameter tuning, and model recalibration. SCCM also adopts an in-memory design for real-time adaptability, unlike purely reactive methods that typically activate adaptation only after performance degradation is observed. By using dynamic thresholding and remaining agnostic to data distributions, SCCM supports KPI-based monitoring across varying data streams, including high-dimensional and large-scale settings. SCCM is integrated with four online regression models and evaluated on 18 synthetic datasets covering abrupt, incremental, and alternating gradual drift, together with eight real-world datasets. The evaluation uses both R2 and MSE and compares against eight detector--adaptation baselines. Results show improved predictive performance and effective drift handling across the evaluated online regression settings.
Mohammad Abu-Shaira, Weishi Shi
Department of Computer Science and Engineering, University of North Texas, 1155 Union Circle #311366, Denton, 76203, Texas, USA
When an LLM agent reads a confidential file, then writes a summary, then emails it externally, no single step is unsafe, but the sequence is a data leak. We call this safety drift: individually safe actions compounding into violations. Prior work has measured this problem; we predict it. SafetyDrift models agent safety trajectories as absorbing Markov chains, computing the probability that a trajectory will reach a violation within a given number of steps via closed form absorption analysis. A consequence of the monotonic state design is that every agent will eventually violate safety if left unsupervised (absorption probability 1.0 from all states), making the practical question not if but when, and motivating our focus on finite horizon prediction. Across 357 traces spanning 40 realistic tasks in four categories, we discover that "points of no return" are sharply task dependent: in communication tasks, agents that reach even a mild risk state have an 85% chance of violating safety within five steps, while in technical tasks the probability stays below 5% from any state. A lightweight monitor built on these models detects 94.7% of violations with 3.7 steps of advance warning at negligible computational cost, outperforming both keyword matching (44.7% detection, 55.9% false positive rate) and per step LLM judges (52.6% detection, 38.2% false positive rate) while running over 60,000x faster.
Aditya Dhodapkar, Farhaan Pishori
Rensselaer Polytechnic Institute Department of Computer Science · Santa Clara University Department of Engineering
Automated toxicity moderation systems operate in dynamic online environments where harmful behavior evolves through coded language, shifting targets, and strategic adaptation to enforcement. Existing drift detection methods often focus on global distributional change, but such signals may miss safety-relevant shifts that emerge in localized harm subspaces or high-risk model-error regions. This paper introduces DriftGuard, a safety-aware adaptive moderation framework that combines multi-monitor drift detection with selective model updating. The framework tracks global text drift, identity-harm drift, model uncertainty, toxic-risk drift, and false-negative-risk drift. When safety-relevant change is detected, the model is updated using a hard-mix adaptation set that prioritizes likely false negatives, identity-related high-risk examples, false-positive-risk examples, and uncertain boundary cases. Experiments on Civil Comments temporal shift and Jigsaw-to-DynaHate cross-dataset shift show that safety-aware monitors detect risks missed by global drift alone. Hard-mix adaptation improves toxic recall and accuracy over no-update and random-balanced baselines, raising toxic recall to 0.8777 on Civil Comments and from 0.7107 to 0.8523 on DynaHate. Bootstrap analysis further shows stable DynaHate safety gains, with toxic recall increasing by 0.1418 and false-negative prevalence decreasing by 0.0781. Overall, DriftGuard links safety-aware drift detection to targeted, lightweight model updating for more robust adaptive toxicity moderation.
Yuting Xin, Hanyu Cai, Binqi Shen +2
Department of Information and Decision Sciences University of Minnesota Minneapolis, USA · Department of Industrial Engineering and Management Sciences Northwestern University Evanston, USA · Fuqua School of Business Duke University Durham, USA +1