Alarm Fatigue

Follow this topic Ask about this topic

Momentum

3 papers in the last four weeks, against 1 the four weeks before. 0.0% of all new papers.

Jul 6Week of Sep 21

Latest papers 23

Sep 14, 2026cs.LG

Certified AI Triage of ICU Alarms

In the VTaC benchmark 71% of ventricular-tachycardia alarms are false, but silencing a real one can delay recognition of a dangerous arrhythmia. We reframe alarm reduction as three-way triage (retain, suppress, or defer) and bound the decision this analysis treats as harmful: among suppressed alarms, the fraction that were genuine stays below a user-set budget with 95% confidence, under i.i.d. event sampling. Alarms sharing a waveform record are dependent, so the clustered analysis is a sensitivity check. On the official split a 5% budget certifies in all three seeds, suppressing 74.8% of false alarms while silencing 1.5% of genuine ones, at AUROC 0.953 and Challenge Score 83.33, numerically comparable to the strongest of the eleven published systems. Our central finding measures what multiplicity costs: the correction charges for every candidate, so a finer grid can certify strictly less. Under held-out calibration the 885-cell grid we declared certifies 1 of 15 fold-runs, while choosing the grid on a separate selection partition certifies 8. We project the calibration volume each budget needs, making an uncertifiable budget a design parameter. Finally, adding a learned reliability dimension to the policy grid did not sharpen the certified frontier.

Mohammed Sameer Syed, Rozhin Yasaei

Roshan AI · University of Arizona

Alarm Fatigue Intensive Care Unit Triage

Sep 8, 2026cs.LG

Physics-Informed Deep Learning for False Ventricular Tachycardia Alarm Reduction in the ICU

False ventricular tachycardia (VT) alarms are a leading contributor to alarm fatigue in intensive care units. We propose a deep learning framework combining a 1D SE-ResNet with ICU-realistic data augmentations and a physics-informed auxiliary reconstruction task based on the three-element Windkessel hemodynamic model, implemented as a differentiable forward simulation. By requiring the network's latent representation to produce physiologically plausible arterial pressure waveforms, artifact-driven ECG patterns are penalized while true VT remains coherent across modalities. Evaluated on the VTaC benchmark under a strict real-time protocol (10-second pre-alarm window), our method achieves a 5-point Challenge Score improvement over prior state-of-the-art. Ablation studies confirm that the physics-informed objective is the primary performance driver, providing gains in accuracy, 2x label efficiency, and more localized and clinically meaningful ECG segments.

Athanasios Papastathopoulos-Katsaros, Alexandra Stavrianidi, Zhandong Liu

Department of Pediatrics, Baylor College of Medicine, Houston, TX, USA · Jan and Dan Duncan Neurological Research Institute, Texas Children’s Hospital, Houston, TX, USA · Institute for Analysis and Numerics, University of Münster, Germany +1

Intensive Care Unit Alarm Fatigue Deep Learning Data Augmentation

Sep 8, 2026cs.CV

Observe Before You Alert: Adaptive Driver Alerting with Vision-Language Models

Driver alerting from dashcam video requires sequential decision-making under partial observability: a system must decide not only whether a scene is risky, but also when the evidence is sufficient to warn. Most existing accident anticipation models output a binary risk score, leaving ambiguous scenes to be handled by thresholding. We propose VLAlert, a vision-language alerting framework that casts warning generation as a tri-action policy over SILENT, OBSERVE, and ALERT. The OBSERVE action acts as an internal evidence-gathering decision that delays uncertain warnings and changes the next observation window, creating a lightweight perception-action loop for adaptive alerting. VLAlert uses Qwen3-VL-4B as a safety-evidence generator and pools hidden states from structured belief spans to form compact representations for danger estimation and policy prediction. We evaluate VLAlert on VLAlert-Bench, a unified per-tick benchmark from four real-world dashcam alert datasets, and further test transfer to held-out naturalistic ADAS takeover clips. On VLAlert-Bench validation, VLAlert achieves the highest deployment-oriented utility among tested baselines, with DAUS 0.4878 compared with 0.4752 for Open-BADAS, and improves AUROC, AP_tick, F1_t, and balanced accuracy from 0.610, 0.176, 0.276, and 0.581 to 0.689, 0.195, 0.297, and 0.648, respectively. On 221 held-out ADAS-TO-Critic clips, VLAlert improves R@5s from 74.2% to 88.7% and F1 from 0.585 to 0.686. These results indicate that adaptive observation and safety-focused VLM representations provide measurable gains for driver-facing alert decisions.

Yuhang Wang, Lingyao Li, Hao Zhou

Department of Civil Engineering University of South Florida United States · School of Information University of South Florida United States

Accident Source Term Evaluation Code Alarm Fatigue Video Surveillance Perception Pipeline

Aug 4, 2026cs.SD

Smartphone Audio Based Distress Detection

We investigate an unobtrusive and

24\times7

human distress detection and signaling system, Always Alert, that requires the smartphone, and not its human owner, to be on alert. The system leverages the microphone sensor, at least one of which is available on every phone, and assumes the availability of a data network. We propose a novel two-stage supervised learning framework, using support vector machines (SVMs), that executes on a user's smartphone and monitors natural vocal expressions of fear---screaming and crying in our study---when a human being is in harm's way. The challenge is to achieve a high distress detection rate while ensuring that the false alarm rate is a manageable overhead, while a typical smartphone user goes about living life as usual. We train the learning framework with carefully selected audio fingerprints of distress and of varied environmental contexts. The audio is used to tune the learning framework to obtain a desirable distress detection rate and false alarm rate (FAR). The ability of the proposed framework to detect distress in rather challenging audio environments is demonstrated. Exploiting the time contiguous nature of false alarms further allows us to reduce the FAR. We show the feasibility of using our framework anytime and anywhere by testing it over many hours of audio fingerprints recorded by volunteers on their smartphones, as they went about their daily routines. We are able to achieve high distress detection rates at an average overhead that is equivalent to about 1 facebook post every 3 to 4 hours.

Anil Sharma, Sarthak Ahuja, Mayank Gautam +1

IIIT-Delhi, India

Alarm Fatigue Sound Event Detection Distress Microphone Array Audio Understanding Device

Jul 29, 2026cs.LG

EvoCause: LLM-Guided Evolution of Causal Graphs for Root Cause Analysis

Modern telecommunication, cloud, and microservice systems emit correlated alarm cascades when components fail. Root cause analysis (RCA) aims to identify the small set of alarms that initiate each cascade. A common approach learns a causal graph from observational logs and predicts all zero-in-degree alarms in each incident-induced subgraph. However, the learned graph remains fixed and cannot benefit from expert diagnoses of historical incidents. We close this loop with EvoCause. Expert labels constrain which alarms should be source nodes but do not specify the edge edits needed to satisfy those constraints. EvoCause uses a large language model (LLM) to propose semantically plausible graph edits, while deterministic code validates node identities and acyclicity and retains the best graph on a labeled alignment set. At test time, the refined graph alone produces transparent predictions without an LLM call. We also release TeleRCA, an expert-annotated benchmark from a production telecommunication network containing

485{,}681

alarm events spanning

194

alarm types over

5{,}621

resources. On synthetic data, EvoCause initialized with the PC causal discovery algorithm outperforms the unrefined PC baseline, raising Node F1, Case EM, and Graph F1 by

11.59

,

9.40

, and

4.59

percentage points, respectively, while reducing nSHD by

0.2379

. On TeleRCA, replacing human-readable alarm titles with anonymous identifiers lowers Node F1 and Case EM by

6.12

and

8.04

percentage points, respectively, indicating that alarm-name information contributes to graph refinement.

Lei Zan, Keli Zhang, Shifeng Xie +7

Huawei Noah’s Ark Lab · Guangdong University of Technology, Peng Cheng Laboratory

Root Cause Analysis Causal Graph Causal Discovery Methods Reasoning Graphs Alarm Fatigue Subgraphs+1

Jul 19, 2026cs.LG

When Drift Detectors cry Wolf: False Alarm Rates in continuous ML Monitoring

Drift detection is a core component of production machine learning monitoring systems, where detectors are used to compare incoming data with a reference distribution and trigger alerts when changes occur. However, these detectors are often evaluated in research settings that emphasize detection accuracy under synthetic shifts, while overlooking false alarms under continuous monitoring. In production environments, models are monitored repeatedly over time and across many features, and even small false positive rates can accumulate into frequent alerts, leading to alarm fatigue. We empirically analyze false positive behavior across five commonly used drift detectors: PSI, KS, MMD, LSDD, and adversarial validation. Consistent with existing literature, PSI exhibits strong sensitivity to batch size, producing frequent false alarms at small sample sizes; however, we further observe that its behavior stabilizes and improves substantially once batch sizes exceed approximately 200 samples. In contrast, KS, MMD, and LSDD display persistent fluctuations across batch sizes, while remaining comparatively more reliable than PSI in low-data regimes. Applying a Bonferroni correction reduces false positive rates, but often at the cost of reduced true positive sensitivity, reinforcing the well-known stability - sensitivity trade-off in drift detection. This work provides a systematic comparison of false positive behavior across multiple drift detectors under continuous monitoring conditions. We identify tradeoffs across detector families and provide practical guidelines for selecting and calibrating drift detectors in production ML systems.

Raj Shekhar Singh

Indian Institute of Technology, Roorkee Roorkee, Uttarakhand, India

False-Negative Rate Alarm Fatigue

Jul 14, 2026cs.CR

Silent Alarm: A J-Space Protocol for Comparing Danger Recognition Across Models and Quantization Levels

Jailbreak-robustness research typically evaluates safety through generated responses using an LLM-as-judge approach. Such evaluations, however, are sensitive to the benchmark's grading procedure and capture only observed behavior on a given set of attacks, without directly revealing the hidden fragility of the underlying safety mechanisms. This work proposes JADR (Jacobian Assessment of Danger Recognition), a protocol that measures a model's internal representation through Jacobian space (J-space, a recently proposed workspace of verbalizable concepts) before the first response token is generated. For every prompt and layer we record the top-k J-space tokens; these are grouped into six behavioral scenario axes and compared between a danger sample based on StrongREJECT and a safe control drawn from XSTest and OKTest. The method does not call on an external judge model: the computation runs entirely locally, on the activations of the model under evaluation, which lets us compare both different models against each other and modifications of a single model -- quantization and fine-tuning in particular -- on the same terms. The final comparison rests on the proposed SafetyAUC metric, complemented with bootstrap confidence intervals. The protocol is applied to six models (Qwen3-1.7B, Qwen3-4B, Qwen3-8B, Qwen3-Uncensored-4B, Qwen3-SafeRL-4B, Gemma 2 9B) across three weight-representation regimes -- BF16, INT8, and INT4 -- and checked against an independent behavioral evaluation with the StrongREJECT grader. The metric separates models with a strong versus a weak internal safety mechanism with statistical significance and captures substantively different effects across quantization regimes.

Roman Prosvirnin, Victor Minchenkov, Alexey Soldatov +1

HSE University

Adversarial Evaluation Security Signals Alarm Fatigue Jacobian Qwen3 Protocol

Jul 2, 2026cs.AI

Online Safety Monitoring for LLMs

Despite alignment training, LLMs remain prone to generating unsafe outputs at deployment time. Monitoring outputs online and raising an alarm when safety can no longer be assumed is therefore critical. We study a simple real-time monitor that turns a verifier signal from an external model into an alarm decision by thresholding, with the threshold calibrated via risk control. In experiments on mathematical reasoning and red teaming datasets, we show that this simple design is competitive with more advanced monitors based on sequential hypothesis testing.

Mona Schirmer, Metod Jazbec, Alexander Timans +3

UvA Bosch-Delta Lab, University of Amsterdam · University of Wisconsin Madison · Johns Hopkins University

Large Language Model Safety Red-Teaming Alarm Fatigue

Jun 21, 2026cs.ET

Enhancing Road Safety: An IoT-Based Accident Detection and Prevention Mechanism

Road traffic accidents remain a critical global crisis, consistently serving as a primary driver of preventable mortality and severe injury. These incidents are frequently precipitated by human error, including overspeeding, driving under the influence of alcohol, and cognitive fatigue. To address this urgent public safety challenge, this paper presents an intelligent, Internet of Things (IoT)-based Accident Prevention and Detection System (APDS) designed to systematically mitigate driver risk and optimize post-collision emergency responses. The proposed framework features a multi-tiered architecture capable of executing continuous real-time telemetry monitoring, proactive local alarm triggering, and automated situational intervention. Furthermore, the system integrates automated emergency communication protocols that aggregate immediate spatial coordinates via GPS and dispatch targeted alerts to medical facilities in close proximity, thereby optimizing response times and reducing accident-related fatalities.

Prabhu Pugalenthi, Pramod Krishnaa Dhanbalan

MS Computer Science, University of Southern California, Los Angeles, CA · M.Sc. Software Systems, Coimbatore Institute of Technology, Tamil Nadu, India.

Jun 16, 2026cs.SE

All Smoke, No Alarm: Oracle Signals in Agent-Authored Test Code

Software practitioners increasingly use AI coding agents that generate test code alongside production code in open source pull requests (PRs). Recent studies report more than 932,000 agent-authored PRs across more than 116,000 repositories, yet whether their test files contain meaningful verification logic remains underexplored. Test files lacking explicit assertions execute code without verifying behavior, so quality gates based on test-file presence overestimate verification strength. The goal of this paper is to help practitioners assess the verification strength of agent-authored patches by characterizing oracle signals and their link to merge outcomes and review effort. We conduct an empirical study of 86,156 test-file patches from 33,596 agent-authored PRs across 2,807 GitHub repositories produced by five coding agents: OpenAI Codex, GitHub Copilot, Devin, Cursor, and Claude Code. A qualitative analysis of 384 stratified patches informs a syntactic taxonomy of eight oracle signal categories. Applied at scale, 80.2% of test patches contain weak or no explicit oracle signals. While raw merge rates are lower for strong-oracle PRs, a regression analysis adjusting for agent, PR size, repository popularity, task type, and language shows strong oracles significantly improve merge likelihood (OR = 1.28, p < 0.001). Our findings suggest that test file counts substantially overestimate verification strength and that practitioners can adopt oracle-aware quality checks to more accurately evaluate agent-authored contributions.

Dipayan Banik, Kowshik Chowdhury, Shazibul Islam Shamim

Danovo Energy Solutions · Raleigh, North Carolina, USA · Kennesaw State University +1

Code Quality Test Generation Coding Agents Oracles Alarm Fatigue

Jun 3, 2026cs.LG

LMT: A Bayesian Framework for Causal Discovery from Textual Alarm Records in Manufacturing Systems

Textual event records, such as alarm logs, have become an increasingly common data source in engineering and manufacturing systems. Beyond identifying correlations or recurring patterns, engineers are often interested in understanding which types of events causally trigger or influence other events during system operation. Textual event descriptions may contain semantic clues about such causal relationships, and recent large language models (LLMs) provide a promising tool for extracting these signals. However, relying solely on LLM-encoded textual information is insufficient for accurate causal discovery, since semantic patterns do not directly reveal causal mechanisms and may confuse causation with correlation or frequent sequential patterns. To address these challenges, we propose \textbf{LMT}, a Bayesian causal discovery framework for engineering event data that jointly leverages textual descriptions and timestamps. Specifically, LMT first uses LLMs to extract semantic causal signals from event descriptions and constructs a prior distribution over causal graphs among event types or event clusters. It then incorporates temporal evidence through a Poisson-process-based likelihood, allowing the LLM-informed prior to be refined by timestamp-based statistical evidence. By integrating the textual and temporal information, LMT produces a causal graph that is both interpretable and data-supported. Simulation studies show that the proposed framework is effective across different settings and is especially advantageous in small-sample alarm-event scenarios.

Xiaofeng Xiao, Jianhong Chen, Qiuzhuang Sun +2

Department of Mechanical & Industrial Engineering, Northeastern University, Boston, MA, USA · College of Integrative Studies, Singapore Management University, Singapore · Department of Industrial Engineering and Management Sciences, Department of Mechanical Engineering, Northwestern University, IL, USA

Causal Discovery Methods Alarm Fatigue Manufacturing

May 30, 2026cs.AI

Medication-Aware Financial Exploitation Detection for Alzheimer's Patients Using Edge-Aware Interaction Risk Modeling

Financial exploitation is a growing concern for people with Alzheimer's disease, especially during periods of reduced cognitive stability. Conventional fraud detection systems usually rely on financial behavior alone and ignore clinically relevant factors that may alter vulnerability. This paper proposes a medication-aware framework that synchronizes medication adherence with transaction-level monitoring to improve detection of cognitively risky financial events. A hybrid simulation dataset was constructed for 180 patients across 45 days, producing 8,100 medication records and 30,855 transactions. The framework evaluates amount anomaly, vendor novelty, transaction frequency, time deviation, and medication adherence through financial-only, additive medication-aware, and interaction-aware logistic models. Results show that the financial-only baseline obtained the highest global F1-score of 0.5000, but the interaction-aware model improved recall during medication-induced vulnerability windows from 0.7442 to 0.9070 and achieved the highest average precision for ranked high-risk cases. The findings suggest that medication adherence is most useful as a contextual modifier of financial risk rather than as an isolated predictor.

Farzana Akter, Lisan Al Amin, Rakib Hossain +2

Cognitive Links LLC, Maryland, USA · University of Maryland, College Park, USA

Alzheimer Medication Leaflet Fraud Detection Alarm Fatigue Exploitation Cognitive Science+1

May 28, 2026cs.CV

On-Device Generative AI for GDPR-Compliant Visual Monitoring: Natural Language Alerts from Local Object Detection

Visual monitoring systems that rely on cloud-based AI inference expose raw image data to external services, creating fundamental tensions with the data-minimisation principle of the General Data Protection Regulation (GDPR). This paper presents a proof-of-concept privacy-by-design pipeline that resolves this tension by confining all inference entirely to the edge device. A YOLOv5n-seg model compiled for a Hailo-8L AI accelerator delivers real-time object detection on a Raspberry Pi 5, from which raw pixel buffers are immediately discarded after inference. A stateful trigger engine forwards minimal JSON event payloads to a locally hosted instance of Phi-3 Mini (3.8B parameters, Q4_0 quantisation), which synthesises one-to-two sentence natural-language alerts for a human operator. No image data crosses the network boundary at any point; only the generated text alert is transmitted. We describe the full system architecture and implementation, report measured inference latency and resource utilisation on the target hardware, and present representative generated alerts. The results demonstrate that combining a dedicated neural-network accelerator with an on-device large language model on a single-board computer is not only feasible but produces practically deployable, human-readable monitoring output while aligning with GDPR Art. 5(1)(c) by design.

Gudrun Schappacher-Tilp, Nicoletta Kaehling, Jan Kornberger +1

Electronic Engineering FH JOANNEUM - University of Applied Sciences Graz, Austria

Edge Devices Streaming Inference Artificial Intelligence Deployment Object Detection Alarm Fatigue

May 28, 2026cs.LG

SigmaMedStat: Temporal Signal Modeling for ICU False Alarm Reduction

Alarm fatigue in intensive care units (ICUs) is a well documented patient safety crisis. Clinical monitors generate 350 or more alarms per patient per day, out of which 72-99% are clinically irrelevant. Staff desensitization to non-actionable alarms increases the risk of missed true emergencies. This paper presents SigmaMedStat, a machine learning system that evaluates the trustworthiness of physiological alarm signals before clinical action is taken. Four approaches were evaluated on the PhysioNet/Computing in Cardiology Challenge 2015 dataset of 498 four-channel ICU alarm recordings. Primary contribution is a temporal modeling framework that splits each 60 second recording into six consecutive 10-second chunks, and this in turn generates Continuous Wavelet Transform (CWT) scalograms per chunk, encodes each chunk with a shared EfficientNet-B0 encoder, and passes the resulting feature sequence to a two-layer Long Short-Term Memory (LSTM) network. Five-fold stratified cross-validation yields a mean AUC of 0.822 +/- 0.016 (95% CI: [0.790,0.853]), compared to 0.641 for a static EfficientNet baseline trained on the full 60-second window. Ablation studies confirm that temporal chunking and multi-channel signal fusion both contribute independently to classification performance. Per-alarm type analysis reveals that Ventricular Flutter is the most accurately classified alarm type (AUC 0.820) while Asystole remains the hardest (AUC 0.722). Error analysis identifies 65 false negatives and 85 high-confidence misclassifications as the primary failure modes. All code and results are publicly available at https://github.com/Arun-K-Ram/sigmamedstat.

Arunkumar Ramachandran

Intensive Care Unit Alarm Fatigue Physiological Signals Temporal Dynamics

May 26, 2026cs.CR

Risk Averse Alert Prioritization for IDS Using Subnormal Gaussian Fuzzy Models

Modern intrusion detection systems generate thousands of alerts daily, but alert fatigue severely limits security operations effectiveness due to too many false positives or low-impact events. We address this by proposing a principled framework for alert prioritization based on subnormal Gaussian fuzzy numbers, explicitly modeling three sources of uncertainty: threat severity, detection confidence, and organizational risk attitude. Each alert is represented as a fuzzy number with the core indicating severity, spread indicating uncertainty, and height reflecting detection reliability. We apply ranking indices to prioritize alerts, allowing organizations to tune security posture through a risk-attitude parameter. Experimental validation on CIC-IDS2017 and NSL-KDD demonstrates greater robustness than baselines under detector degradation (0.9963 vs 0.8215 NDCGrel@100), with distinct differentiation in mid-confidence alerts and near-parity with baselines under robust detectors. The framework is theoretically grounded, computationally efficient, provides interpretable reasoning, and remains robust across detector families and miscalibration scenarios.

Murat Moran

Department of Computer Engineering, Giresun University, Türkiye

Intrusion Detection Alarm Fatigue Prioritization Detection Performance Fuzzy Gaussian Primitives

May 23, 2026cs.CR

Stream Assembly Is an Uncontrolled Treatment in Streaming Intrusion-Detection Benchmarks

Streaming intrusion-detection studies assemble evaluation streams from network captures by interleaving capture days, pooling captures, or replaying records round robin. We show on two benchmarks that this assembly is an uncontrolled experimental treatment changing what the evaluation measures. On CICIDS2017, reordering an identical record multiset under a fixed positional 70/15/15 split yields held-out samples sharing only 32.5% of their records, at prevalences of 68.235% and 25.2396% (42.9954 points apart), and reverses the measured ordering of the two deterministic scorers. Restricting both arms to the 78000 records both held out removes the reversal, so it is attributable to which records the assembly hands to the test set, not to the order in which the detector saw its history. That attribution assumes that history contributes no more on the records the arms do not share than on those they do. On LITNET-2020, pooling three temporally disjoint captures reports one 6.4982% operating point, the equal-weight mean of per-capture held-out prevalences from 0.176% to 15.7747%, an identity presented as an audit check. The evaluated detector's reset posterior P(r_t=0) equals the hazard rate exactly below the run-length cap, though evaluations spend nearly all their length at or beyond it, and its evaluated score is a function of P(r<=5), not of P(r=0). Its deployed max composition ranks worse than its tail term alone (0.103477 AP, 0.302658 AUC-ROC) because the auxiliary branch is inverted (AUC-ROC 0.281890) and the maximum lets it set the score wherever the tail is small. With evaluated records and fitted model fixed, changing only the accompanying batch moves the ECOD reference implementation's AUC-PR by 0.003063, so published ECOD numbers are not comparable across studies scoring different batches. Every measured value traces to an archived, hash-verified run manifest.

Michel A. Youssef

Independent Researcher, Beirut, Lebanon

Intrusion Detection Alarm Fatigue Conformal Risk Control False-Negative Rate Streaming

May 7, 2026astro-ph.IM

AstroAlertBench: Evaluating the Accuracy, Reasoning, and Honesty of Multimodal LLMs in Astronomical Classification

Modern astronomical observatories generate a massive volume of multimodal data, creating a critical bottleneck for expert human review. While multimodal large language models (LLMs) have shown promise in interpreting complex visual and textual inputs, their ability to perform specialized scientific classification while providing interpretable reasoning remains understudied. We introduce AstroAlertBench, a comprehensive multimodal benchmark designed to evaluate LLM performance in astronomical event review along a three-stage logical chain: metadata grounding, scientific reasoning, and hierarchical classification over five categories. We use a pilot sample of 1,500 real-world alerts from the Zwicky Transient Facility (ZTF), a wide-field survey that scans the northern sky to detect transient astronomical events. On this dataset, we benchmark 13 frontier closed-source and open-weight LLMs that support visual input. Our results reveal that high accuracy does not always align with model ``honesty,'' defined as the ability to self-evaluate its reasoning, which affects its reliability as a real-world assistant. We further initialize a human-in-the-loop evaluation protocol as a precursor to future community-scale participation. Together, AstroAlertBench provides a framework for developing calibrated and interpretable astronomical assistants.

Claire Chen, Jiabao Sean Xiao, Shuze Daniel Liu +7

1California Institute of Technology · 2Massachusetts Institute of Technology · 3Purdue University

Astronomical Images Multimodal Benchmarks Multimodal Classification Multimodal Large Language Models Alarm Fatigue Metadata

May 6, 2026cs.LG

Conditional outlier detection for clinical alerting

We develop and evaluate a data-driven approach for detecting unusual (anomalous) patient-management actions using past patient cases stored in an electronic health record (EHR) system. Our hypothesis is that patient-management actions that are unusual with respect to past patients may be due to a potential error and that it is worthwhile to raise an alert if such a condition is encountered. We evaluate this hypothesis using data obtained from the electronic health records of 4,486 post-cardiac surgical patients. We base the evaluation on the opinions of a panel of experts. The results support that anomaly-based alerting can have reasonably low false alert rates and that stronger anomalies are correlated with higher alert rates.

Milos Hauskrecht, Michal Valko, Shyam Visweswaran +3

Computer Science Department · Department of Biomedical Informatics · Department of Critical Care Medicine

Alarm Fatigue Electronic Health Records Patients Outliers Data-Driven

May 1, 2026cs.LG

From Prediction to Practice: A Task-Aware Evaluation Framework for Blood Glucose Forecasting

Clinical time-series forecasting is increasingly studied for decision support, yet standard aggregate metrics can obscure whether a model is actually useful for the task it is meant to serve. In safety-critical settings, low average error can coexist with dangerous failures in exactly the high-risk regimes that matter most. We present a task-aware evaluation framework for blood glucose forecasting built around two downstream uses: hypoglycemia early warning and insulin dosing decision support. For early warning, we evaluate on real data from three clinical cohorts using event-level recall and false alarms per patient-day, metrics that reflect operational alarm burden rather than aggregate accuracy. We show that models appearing acceptable overall, with recall above 0.9 on the full test set, can fail badly in the post-bolus slice, where insulin-on-board is elevated and missed warnings carry the greatest clinical consequences. Standard forecasting evaluation, however, does not test whether a model can reason about the effects of actions, a requirement for supporting insulin dosing decisions. We therefore add a second, interventional arm using the FDA-accepted UVA/Padova simulator, where we evaluate whether forecasters can predict glucose responses to altered insulin plans in paired factual/counterfactual scenarios. We show that models that look strong on real-data forecasting often fail to predict the direction, magnitude, or ranking of intervention effects, and choose poor insulin doses when evaluated under a clinically motivated cost. Taken together, the two arms reveal a consistent gap between forecasting accuracy and task-relevant usefulness. We release the benchmark, the standardized preprocessing pipeline for public cohorts, and the simulator-based interventional dataset as a reproducible toolkit.

Alireza Namazi, Heman Shakeri

Department of Computer Science University of Virginia Charlottesville, VA, USA · School of Data Science University of Virginia Charlottesville, VA, USA

Continuous Glucose Monitoring Alarm Fatigue Cohort Multi-Dimensional Evaluation

Apr 28, 2026cs.CR

Towards Agentic Investigation of Security Alerts

Security analysts are overwhelmed by the volume of alerts and the low context provided by many detection systems. Early-stage investigations typically require manual correlation across multiple log sources, a task that is usually time-consuming. In this paper, we present an experimental, agentic workflow that leverages large language models (LLMs) augmented with predefined queries and constrained tool access (structured SQL over Suricata logs and grep-based text search) to automate the first stages of alert investigation. The proposed workflow integrates queries to provide an overview of the available data, and LLM components that selects which queries to use based on the overview results, extracts raw evidence from the query results, and delivers a final verdict of the alert. Our results demonstrate that the LLM-powered workflow can investigate log sources, plan an investigation, and produce a final verdict that has a significantly higher accuracy than a verdict produced by the same LLM without the proposed workflow. By recognizing the inherent limitations of directly applying LLMs to high-volume and unstructured data, we propose combining existing investigation practices of real-world analysts with a structured approach to leverage LLMs as virtual security analysts, thereby assisting and reducing the manual workload.

Even Eilertsen, Vasileios Mavroeidis, Gudmund Grov

University of Oslo · Norwegian Defence Research Establishment (FFI) · & University of Oslo

Security Evaluation Cybersecurity Alarm Fatigue Agentic Workflows Agentic Discovery Systematic Study+1

Apr 23, 2026cs.LG

Conditional anomaly detection using soft harmonic functions: An application to clinical alerting

Timely detection of concerning events is an important problem in clinical practice. In this paper, we consider the problem of conditional anomaly detection that aims to identify data instances with an unusual response, such as the omission of an important lab test. We develop a new non-parametric approach for conditional anomaly detection based on the soft harmonic solution, with which we estimate the confidence of the label to detect anomalous mislabeling. We further regularize the solution to avoid the detection of isolated examples and examples on the boundary of the distribution support. We demonstrate the efficacy of the proposed method in detecting unusual labels on a real-world electronic health record dataset and compare it to several baseline approaches.

Michal Valko, Hamed Valizadegan, Branislav Kveton +2

Computer Science Department, University of Pittsburgh, PA · Technicolor, Palo Alto, PA · Department of Biomedical Informatics, University of Pittsburgh, PA

Graph Anomaly Detection Alarm Fatigue Laboratory

Apr 22, 2026cs.CR

AgentSOC: A Multi-Layer Agentic AI Framework for Security Operations Automation

Security Operations Centers (SOCs) increasingly encounter difficulties in correlating heterogeneous alerts, interpreting multi-stage attack progressions, and selecting safe and effective response actions. This study introduces AgentSOC, a multi-layered agentic AI framework that enhances SOC automation by integrating perception, anticipatory reasoning, and risk-based action planning. The proposed architecture consolidates several layers of abstraction to provide a single operational loop to support normalizing alerts, enriching context, generating hypotheses, validating structural feasibility, and executing policy-compliant responses. Conceptually evaluated within a large enterprise environment, AgentSOC improves triage consistency, anticipates attackers' intentions, and provides recommended containment options that are both operationally feasible and well-balanced between security efficacy and operational impact. The results suggest that hybrid agentic reasoning has the potential to serve as a foundation for developing adaptive, safer SOC automation in large enterprises. Additionally, a minimal Proof-Of-Concept (POC) demonstration using LANL authentication data demonstrated the feasibility of the proposed architecture.

Joyjit Roy, Samaresh Kumar Singh

Austin, Texas, USA · Leander, Texas, USA

Cybersecurity Agentic Framework Security Automated Alarm Fatigue

Apr 17, 2026cs.CL

Detecting Alarming Student Verbal Responses using Text and Audio Classifier

This paper addresses a critical safety gap in the use Automated Verbal Response Scoring (AVRS). We present a novel hybrid framework for troubled student detection that combines a text classifier, trained to detect responses based on their content, and an audio classifier, trained to detect responses using prosodic markers. This approach overcomes key limitations of traditional AVRS systems by considering both content and prosody of responses, achieving enhanced performance in identifying potentially concerning responses. This system can expedite the review process by humans, which can be life-saving particularly when timely intervention may be crucial.

Christopher Ormerod, Gitit Kehat

Prosody Alarm Fatigue Audio Understanding Responses Text Analysis and Detection