Calibration and Risk-Budgeted Decisions with System One Models

Soundouss Messoudi; Youness Mansar

stat.MLOct 14, 2026

Calibration and Risk-Budgeted Decisions with System One Models

Authors: Soundouss Messoudi, Youness Mansar

Organizations: Heudiasyc - UMR CNRS 7253 Université de Technologie de Compiègne · Independent Researcher France

Abstract

LLM workflows and agents rely on a set of binary decisions like allow/block an input, or discard/retain a retrieved document. When human deferral is unavailable, uncertain cases must still receive an action. We study System One decision scores in this setting by defaulting to a conservative fallback when uncertain, and controlling the false omission risk within the subset of inputs assigned the utility-maximizing action. Across six datasets covering moderation, safety, and reranking, we compare general System One models with task baselines and a local open-weights fine-tuned System One model. We show that naive baselines for threshold selection exceed the target risk in roughly half of settings with defined test risk, compared with 7.8% for Learn Then Test (LTT), which leverages finite-sample statistical guarantees. Our results show why relying on a probability-like interface is insufficient for deployment decisions and how risk-budgeted selection trades useful action against observed error.

Figures & tables

Panel of Figure 1 — Figure 1: Binary actions’ illustration. Under calibrated probabilities, scores near $0.5$ indicate uncertain labels: a selective policy can abstain. Our policy instead assigns every input an action via an LTT-selected threshold.

Task	Dataset	Fit	Cal.	Test	Y=1 (%)
Moderation	WildGuardMix ( Han et al., 2024 )	2000	849	850	44.4
Moderation	Aegis ( Ghosh et al., 2024 )	2000	579	579	67.0
Safety	S-Labs ( S-Labs, 2026 )	2000	1051	1050	50.0
Safety	ATBench ( Li et al., 2026b )	500	250	250	47.6
Reranking	SciDocs ( Cohan et al., 2020 )	2000	1000	1000	50.8
Reranking	StackOverflow ( Muennighoff et al., 2023 )	2000	1000	1000	50.1

Table 1: Dataset split details. The last column gives the test positive-event prevalence (base rate).

	Moderation: WildGuardMix				Moderation: Aegis				Safety: S-Labs
Model	ECE $\downarrow$	Brier $\downarrow$	AUC $\uparrow$	AP ${}_{0}\uparrow$	ECE $\downarrow$	Brier $\downarrow$	AUC $\uparrow$	AP ${}_{0}\uparrow$	ECE $\downarrow$	Brier $\downarrow$	AUC $\uparrow$	AP ${}_{0}\uparrow$
Qwen3Guard	0.085	0.090	0.950	0.947	0.277	0.239	0.929	0.866	0.474	0.464	0.968	0.968
PCA-Ridge ∗	0.042	0.091	0.946	0.956	0.037	0.096	0.934	0.892	0.087	0.041	0.996	0.996
Jev	0.034	0.073	0.963	0.969	0.183	0.151	0.936	0.860	0.185	0.158	0.947	0.927
GPT-6-Luna	0.103	0.108	0.925	0.907	0.297	0.277	0.864	0.665	0.262	0.228	0.888	0.841
Span-01	0.189	0.238	0.765	0.746	0.500	0.472	0.565	0.332	0.441	0.437	0.288	0.368

Table 2: Test score diagnostics by dataset. AUC is AUROC and AP 0 is negative-action average precision. Reranker scores are not advertised probabilities. 95% intervals in Appendix C . –: not evaluated. *: supervised adaptation.

$\alpha$	Rule	Eval.	Fail	Exceeds	Mean $e$	Max $e$
5	Naive	34	13 UD	23 (67.6%)	14.00	73.26
	Emp.	23	24 NF	19 (82.6%)	1.73	5.81
	LTT	10	37 ND	0 (0.0%)	0.00	0.00
10	Naive	38	9 UD	22 (57.9%)	11.22	48.87
	Emp.	30	17 NF	18 (60.0%)	1.36	6.45
	LTT	20	27 ND	1 (5.0%)	0.03	0.53

Table 3: Outcomes by risk budget

\alpha

(%) across all 47 model–dataset pairs. Excess risk is

e=\max(\widehat{R}-\alpha,0)

Figure 2: LTT-selected risk–utility operating points on WildGuardMix. Lower test FOR and greater benign acceptance are preferable. Missing policies are omitted.

	Moderation: WildGuardMix						Moderation: Aegis
	Naive		Empirical		LTT		Naive		Empirical		LTT
Model	Risk	Util	Risk	Util	Risk	Util	Risk	Util	Risk	Util	Risk	Util
Qwen3Guard	10.8	94.3	12.2	95.8	11.4	95.1	38.4	93.2	18.2	72.8	11.5	60.7
PCA-Ridge ∗	4.2	67.4	13.1	91.3	11.7	87.9	1.4	36.1	17.3	72.8	9.5	64.9
Jev	3.3	68.7	16.2	98.1	12.8	96.8	20.8	83.8	23.1	85.3	11.7	67.0
GPT-6-Luna	12.6	92.6	15.6	96.0	12.9	92.6	43.4	94.8	NF	NF	ND	ND

Table 4: Test risk and utility (%) at

\alpha=0.15

. Risk is FOR; utility is TNR (benign acceptance for safety, irrelevant removal for filtering). Red risk values exceed the budget. ND : no LTT certificate; NF : no feasible empirical policy; UD : undefined test FOR. –: not evaluated. *: supervised adaptation. Bold utility is the largest value per dataset.

Model	Cost	Time	Cost	Time	Cost	Time	Cost	Time	Cost	Time	Cost	Time
	MD: WildGuardMix		MD: Aegis		SF: S-Labs		SF: ATBench		RK: SciDocs		RK: StackOverflow
Qwen3Guard	0.0071	231	0.0077	252	0.0065	213	–	–	–	–	–	–
Reranker-Lite	–	–	–	–	–	–	–	–	0.0013	224	0.0011	183
PCA-Ridge ∗	0.0026	5247	0.0039	1880	0.0013	5422	0.0215	14541	0.0014	5707	0.0012	3765
Jev	0.0216	383	0.0241	248	0.0204	379	0.0757	261	0.0175	364	0.0172	347
GPT-6-Luna	0.0375	320	0.0435	225	0.0347	186	0.1507	294	0.0283	207	0.0278	167

Table 5: Cost (USD/1k) and latency (ms). MD: Moderation. SF: Safety. RK: Reranking. –: not evaluated.

Appendix figures & tables14 assets

Supplementary material from the paper’s appendix.

Appendix

Task / Dataset	Model	ECE $\downarrow$	Brier $\downarrow$	AUROC $\uparrow$	AP 0 $\uparrow$
Moderation	Qwen3Guard	0.085 [0.068, 0.106]	0.090 [0.073, 0.108]	0.950 [0.935, 0.965]	0.947 [0.924, 0.967]
WildGuardMix	PCA-Ridge ∗	0.042 [0.034, 0.067]	0.091 [0.078, 0.103]	0.946 [0.931, 0.959]	0.956 [0.940, 0.968]
	Jev	0.034 [0.028, 0.056]	0.073 [0.063, 0.084]	0.963 [0.951, 0.973]	0.969 [0.957, 0.979]
	GPT-6-Luna	0.103 [0.084, 0.125]	0.108 [0.089, 0.126]	0.925 [0.906, 0.942]	0.907 [0.880, 0.931]
	Span-01	0.189 [0.166, 0.224]	0.238 [0.216, 0.261]	0.765 [0.732, 0.799]	0.746 [0.701, 0.795]
	Solar-Decide	0.104 [0.081, 0.128]	0.130 [0.108, 0.150]	0.893 [0.867, 0.917]	0.855 [0.814, 0.900]

Appendix

Table 6: Test score diagnostics with 95% intervals [lower, upper]. *: supervised adaptation.

		Moderation: WildGuardMix			Moderation: Aegis
Model	Metric	Naive	Empirical	LTT	Naive	Empirical	LTT
Qwen3Guard	Risk	9.2 [6,13]	6.2 [3,9]	3.3 [1,7]	32.4 [26,39]	5.9 [1,11]	ND
	Utility	91.3 [88,94]	72.9 [69,78]	42.7 [38,48]	89.5 [85,94]	50.3 [43,58]	ND
PCA-Ridge ∗	Risk	0.0 [0,0]	5.1 [3,8]	3.2 [1,6]	UD	8.7 [3,14]	ND
	Utility	18.8 [15,23]	70.6 [66,75]	63.0 [58,68]	UD	60.7 [53,68]	ND
Jev	Risk	0.0 [0,0]	6.6 [4,10]	4.4 [2,7]	7.7 [1,16]	7.7 [1,16]	ND

Appendix

Table 7: Test risk and utility at

\alpha=0.05

(%). Shaded Risk rows report FOR; white Utility rows report TNR. Entries are estimates [95% CI], with bounds rounded outward to whole percentage points. Red risk exceeds the budget. ND / NF : no returned policy; UD : undefined FOR (zero TNR). –: not evaluated. *: supervised adaptation.

		Moderation: WildGuardMix			Moderation: Aegis
Model	Metric	Naive	Empirical	LTT	Naive	Empirical	LTT
Qwen3Guard	Risk	9.7 [7,13]	9.4 [7,13]	7.8 [5,11]	36.4 [30,42]	11.5 [6,17]	5.9 [1,11]
	Utility	94.1 [91,97]	93.2 [90,96]	87.9 [85,91]	91.6 [87,96]	60.7 [53,68]	50.3 [43,58]
PCA-Ridge ∗	Risk	2.0 [0,4]	9.8 [7,13]	8.3 [5,12]	0.0 [0,0]	9.5 [4,15]	ND
	Utility	51.6 [46,57]	83.7 [80,88]	79.7 [76,84]	14.7 [9,20]	64.9 [58,72]	ND
Jev	Risk	3.3 [1,6]	11.9 [9,15]	10.5 [7,14]	11.7 [6,18]	11.5 [6,18]	ND

Appendix

Table 8: Test risk and utility at

\alpha=0.10

		Moderation: WildGuardMix			Moderation: Aegis
Model	Metric	Naive	Empirical	LTT	Naive	Empirical	LTT
Qwen3Guard	Risk	10.8 [8,14]	12.2 [9,16]	11.4 [8,15]	38.4 [32,44]	18.2 [12,24]	11.5 [6,17]
	Utility	94.3 [92,97]	95.8 [93,98]	95.1 [93,98]	93.2 [89,97]	72.8 [66,79]	60.7 [53,68]
PCA-Ridge ∗	Risk	4.2 [2,7]	13.1 [9,16]	11.7 [8,15]	1.4 [0,5]	17.3 [11,24]	9.5 [4,15]
	Utility	67.4 [63,72]	91.3 [88,94]	87.9 [84,91]	36.1 [29,43]	72.8 [66,80]	64.9 [58,72]
Jev	Risk	3.3 [1,6]	16.2 [13,20]	12.8 [9,16]	20.8 [15,27]	23.1 [17,30]	11.7 [6,18]

Appendix

Table 9: Test risk and utility at

\alpha=0.15

		Moderation: WildGuardMix			Moderation: Aegis
Model	Metric	Naive	Empirical	LTT	Naive	Empirical	LTT
Qwen3Guard	Risk	11.3 [8,15]	16.7 [13,20]	14.0 [11,17]	40.5 [34,47]	28.6 [22,35]	19.4 [13,26]
	Utility	94.9 [92,97]	97.0 [95,99]	96.4 [94,99]	93.7 [90,98]	86.4 [81,91]	73.8 [67,80]
PCA-Ridge ∗	Risk	5.6 [3,9]	17.9 [14,21]	15.7 [12,19]	5.6 [1,11]	23.8 [17,30]	17.4 [11,24]
	Utility	74.6 [70,79]	96.2 [94,98]	93.9 [91,97]	52.9 [45,61]	80.6 [74,87]	74.3 [68,81]
Jev	Risk	3.8 [2,6]	18.4 [15,22]	17.8 [14,22]	25.6 [19,32]	25.8 [20,32]	23.5 [18,30]

Appendix

Table 10: Test risk and utility at

\alpha=0.20

		Moderation: WildGuardMix			Moderation: Aegis
Model	Metric	Naive	Empirical	LTT	Naive	Empirical	LTT
Qwen3Guard	Risk	12.4 [9,16]	40.9 [37,45]	39.0 [35,43]	44.7 [38,51]	44.2 [38,50]	40.3 [34,46]
	Utility	96.0 [94,98]	99.8 [99,100]	99.8 [99,100]	96.3 [93,99]	95.8 [92,99]	93.2 [89,97]
PCA-Ridge ∗	Risk	10.8 [7,14]	40.1 [36,44]	37.7 [34,41]	13.7 [8,20]	42.0 [36,48]	39.5 [33,45]
	Utility	87.3 [84,91]	99.6 [98,100]	99.4 [98,100]	69.1 [62,76]	94.8 [91,98]	94.8 [91,98]
Jev	Risk	7.1 [4,10]	40.4 [36,45]	36.4 [32,41]	35.0 [29,41]	44.0 [38,50]	40.4 [34,46]

Appendix

Table 11: Test risk and utility at

\alpha=0.40

		Moderation: WildGuardMix			Moderation: Aegis
Model	Metric	Naive	Empirical	LTT	Naive	Empirical	LTT
Qwen3Guard	Risk	13.3 [10,17]	44.4 [41,48]	44.4 [41,48]	46.6 [41,52]	53.9 [48,59]	49.5 [44,55]
	Utility	96.4 [94,99]	100.0 [100,100]	100.0 [100,100]	97.9 [95,100]	99.5 [98,100]	99.0 [97,100]
PCA-Ridge ∗	Risk	12.1 [9,15]	44.4 [41,48]	44.4 [41,48]	19.7 [13,26]	52.8 [47,58]	48.8 [43,54]
	Utility	90.5 [87,94]	100.0 [100,100]	100.0 [100,100]	74.9 [68,81]	99.0 [97,100]	98.4 [96,100]
Jev	Risk	8.8 [6,12]	44.4 [41,48]	44.4 [41,48]	38.3 [32,44]	53.8 [48,59]	51.8 [46,57]

Appendix

Table 12: Test risk and utility at

\alpha=0.50

Figure 3: WildGuardMix: test FOR versus budget risk.

Figure 4: Aegis: test FOR versus risk budget.

Figure 5: S-Labs: test FOR versus risk budget.

Figure 6: ATBench: test FOR versus risk budget.

Figure 7: SciDocs: test FOR versus risk budget.

Figure 8: StackOverflow: test FOR versus risk budget.

Figure 9: LTT-selected operating points for all datasets. Large outlined markers identify

\alpha=0.15

; small markers show the other budgets. Counts indicate defined policies and ND outcomes at

0.15

. The dotted line is the 15% reference. *: supervised adaptation.

LLM Decision-Making

LLM decision-making studies how language models choose, act, seek information, and allocate resources under goals, uncertainty, constraints, and social pressures.

See all 242 papers

System1-Arena: Which Decisions Can Be Left to System 1?
Oct 15, 2026Tianyu Chen, Xinyang Liu, Ruyi An +2LLM Decision-Making LLM Evaluation
The University of Texas at Austin
Budgeted Act-or-Defer Multi-Agent LLM Deliberation with Local Reliability Bounds
Jun 28, 2026Mengdie Flora Wang, Haochen Xie, Guanghui Wang +2AI Agent Reliability Multi-Agent LLM Systems
1AWS Generative AI Innovation Center, USA · General Motors (GM), USA
Releasing the Inner Jev: A Simple Recipe for Open Decision Models
Oct 12, 2026Jonathan Geuter, Andrew Cheng, David Alvarez-MelisLLM Decision-Making LLM Fine-Tuning
Harvard University · Kempner Institute

Oct 15, 2026J/K move · Enter open · S save

System1-Arena: Which Decisions Can Be Left to System 1?

Tianyu Chen, Xinyang Liu, Ruyi An, Zhendong Wang+1

The University of Texas at Austin

LLM Decision-Making LLM Evaluation Efficient Language Model Inference

Open paper AskPDF arXiv

Large language models (LLMs) often make discrete decisions, such as flagging phishing or escalating to a human. System-1 models, such as Jev and the OpenAI Decisions API, return probabilities over options in a single forward pass, while System-2 approaches generate reasoning steps. Which decisions can System-1 models handle, and which require generative reasoning? We introduce System1-Arena, a benchmark that gives all models the same decision requests and scores their probabilities. It contains 92k questions across 105 tasks from 268 public sources, in four groups: text classification and knowledge, applied decisions, evaluation and control, and agent and action. It also includes 138 closed-loop environments, from web shopping and SWE-bench coding control to robotics, games, and driving; in real-time mode, the world evolves while a model decides. We evaluate 30 models: 7 closed LLMs, 13 open LLMs read at the answer token, and 10 System-1 models. The largest System-1 models match or exceed fast closed LLMs in non-agentic accuracy, with better-calibrated probabilities at one-quarter of the latency. A reasoning LLM is the most accurate, at about 70x the cost of a fast LLM. In closed loops, large open LLMs succeed most often (up to 32.9%); small System-1 models rarely succeed.

Abstract

LLM Decision-Making

Explore similar work

System1-Arena: Which Decisions Can Be Left to System 1?

Budgeted Act-or-Defer Multi-Agent LLM Deliberation with Local Reliability Bounds

Releasing the Inner Jev: A Simple Recipe for Open Decision Models