Afterwave
← Research
Afterwave technical report AW-TR-2026-01 · October 2026

Release gating for learned perception in closed-loop autonomy: change-guided falsification with paired confirmation

Afterwave Research

Abstract

Learned perception in autonomous machines is retrained far more often than the safety evidence about it is rebuilt. Aggregate offline metrics are the usual release criterion, but they say little about closed-loop behaviour in narrow operating conditions. We formulate release gating as a paired statistical question about two model versions — does the candidate violate a formal requirement more often than the baseline, somewhere in the operating domain? — and describe an engine that answers it within a fixed episode budget. The engine (i) measures a behavioural change signature between versions without ground truth, (ii) builds a prior over the candidate's requirement robustness from the baseline's test history with variance inflated where behaviour changed, (iii) searches for Signal Temporal Logic violations with a regression-targeted acquisition, (iv) accepts a regression only after paired re-seeded screening and an independent replication under alpha spending, which bounds the search's family-wise false-positive rate, and (v) reports distribution-free bounds and a hash-chained safety case. In a deliberately crude simulated world, a candidate detector that improves on every aggregate metric (F1 0.873→0.893) is blocked for a confirmed regression of “never accelerate while a person is within 10 m”, using 888 candidate episodes against a 49,152-episode exhaustive grid. A held-out random comparison in the same region finds the candidate better, illustrating why random validation misses localised regressions. We also report the failure modes we met: without multiple-testing control, “confirmed” regressions did not replicate, and two of three surrogate configurations did not beat random search.

Key results

  1. A better model, blocked. v2b improves every aggregate metric (F1 0.873 → 0.893) and still fails the gate on R3, “never accelerate while a person is within 10 m”.
  2. Confirmed, not lucky. 6/10 vs 1/10 on paired screening, then 17/30 vs 8/30 on independent seeds (p = 0.0059 < α = 0.0063).
  3. 55× cheaper than exhaustive. 888 candidate episodes against a 49,152-episode grid.
  4. Invisible to random validation. On random samples of the same region the candidate looks safer (41 vs 62 violations of 200).
  5. False alarms are real. Without multiple-testing control, earlier “regressions” failed replication (p = 0.77, 0.07).
Contents
  1. 1Introduction
  2. 2Background and related work
  3. 2.1Temporal logic and falsification
  4. 2.2Testing learned components
  5. 2.3Model updates and regressions
  6. 2.4Statistical assurance and safety cases
  7. 3Problem formulation
  8. 4Method
  9. 4.1Behavioural change signature
  10. 4.2A prior from the previous release
  11. 4.3Regression-targeted falsification
  12. 4.4Paired confirmation with alpha spending
  13. 4.5Bounds and evidence
  14. 5Experimental setup
  15. 6Results
  16. 6.1The candidate regresses R3
  17. 6.2Where it fails
  18. 6.3Random validation does not see it
  19. 6.4Cost and search efficiency
  20. 6.5The safety case
  21. 7What went wrong on the way
  22. 8Threats to validity
  23. 9Discussion and conclusion
  24. References

1Introduction

Machines that act among people increasingly depend on learned perception for safety functions: detecting a person, estimating range, deciding when to slow. Those models change frequently — new data, new architectures, new sensors — while the safety argument for the machine is assembled infrequently and largely by hand. Standards and regulation are converging on the expectation that this gap closes: SOTIF [1] and UL 4600 [2] ask for evidence that functional insufficiencies are understood and controlled, and the EU Machinery Regulation subjects machinery whose safety functions rely on self-evolving, machine-learning behaviour to third-party conformity assessment from January 2027 [3].

The standard engineering response — evaluate the new model on a held-out set and ship if aggregate metrics improve — conflates two questions. Aggregate metrics average over the data distribution; safety requirements are universally quantified over the operating domain. Model updates are known to introduce “negative flips”, errors on inputs the previous model handled correctly, even when aggregate accuracy rises [4] [5] [6], and averaged metrics can hide clinically or operationally important subgroups [7]. In closed loop the effect compounds: a small change in detection timing interacts with a planner's confirmation logic and becomes a qualitatively different trajectory.

Falsification of cyber-physical systems against temporal-logic specifications is a mature field [8] [9] [10] [11], but it usually asks whether a system can violate a specification. A release gate asks something narrower and, we argue, more useful to an engineering team: whether the change made things worse. That framing has three consequences we exploit. First, the previous release is an informative prior: its test history tells us where requirements are marginal. Second, the difference between versions is measurable before any closed-loop test runs. Third, the decision must be paired and statistically controlled, because closed-loop episodes are stochastic and a search that screens many candidates will otherwise report false regressions.

Contributions. (1) A formulation of release gating as a paired, per-requirement regression test over an operating domain, with a verdict rule that separates regressions from known baseline issues (§3). (2) An engine combining ground-truth-free behavioural diffing, a divergence-inflated surrogate prior, regression-targeted falsification and two-stage paired confirmation with alpha spending (§4). (3) An end-to-end case study with full provenance, including a localised regression that a held-out comparison does not detect (§6). (4) An account of what failed on the way, which we believe is the more transferable result (§7).

2Background and related work

2.1Temporal logic and falsification

Signal Temporal Logic (STL) [12] expresses requirements over real-valued signals; its quantitative semantics [13] [14] assign a robustness value whose sign is satisfaction and whose magnitude is a margin. Robustness turns verification into optimisation: falsifiers minimise robustness over inputs with stochastic search, as in S-TaLiRo [8] and Breach [9], or with Bayesian optimisation over a Gaussian-process model of robustness [15] [16]. Systems with machine-learning components have been falsified compositionally, by analysing the perception module's input space separately [17], and toolkits such as VerifAI and Scenic support scenario-level falsification [18] [19]. Surveys of black-box safety validation [11] distinguish falsification, most-likely failure analysis and failure-probability estimation; our gate uses the first for discovery and a simple form of the third for its bounds. Rare-event estimation [20] and adaptive stress testing [21] address the cost of finding low-probability failures; we address it instead by conditioning on the previous release. Closest to our search is Bayesian safety validation [22], which fits a Gaussian-process surrogate to a black-box system to refine failure boundaries, locate failure regions and estimate failure probability; our prior differs in being transferred from a previous model version and inflated by a measured behavioural change, and our acquisition targets disagreement between versions rather than failure of one.

2.2Testing learned components

Differential testing of deep networks searches for inputs on which models disagree [23]; DeepTest generates synthetic driving inputs to expose erroneous behaviour [24]. Differential testing across released versions of a deployed driving stack has recently been used to surface critical failures [25]. Our behavioural diff is closest in spirit to differential testing, but it is a measurement over a partition of the operating domain rather than a search for single disagreeing inputs, and it is only a prior: disagreement is neither necessary nor sufficient for a closed-loop regression. Slice discovery methods find coherent data subsets with elevated error [26] [27]; here the “slices” are regions of a parametric operating domain, and the error notion is a temporal-logic violation rather than a label mismatch.

2.3Model updates and regressions

Work on backward compatibility documents that updated models make new mistakes even when better on average [4] [5], and proposes training objectives that reduce negative flips [6] or keep representations compatible [28]. Those methods change how the new model is trained. A release gate is complementary: it assumes nothing about training and decides, after the fact, whether a specific update may ship. Conceptually it is regression test selection [29] [30] for a system whose “tests” are scenarios in a continuous domain and whose “code change” is a weight update.

2.4Statistical assurance and safety cases

Paired binary outcomes are compared with McNemar's test [31] [32]; we use its exact one-sided form. Upper bounds on failure probability from a finite sample follow Clopper and Pearson [33]; conformal prediction [34] [35] gives the same bound a distribution-free reading under exchangeability, and its training-conditional form [36] is what a release decision needs. Conformal methods have also been applied directly to STL robustness for runtime verification [37]. The well-known cost of demonstrating low failure rates by testing alone [38] [39] is why our bounds are scoped to the region the gate targets, and why they are never presented as operational failure rates. Results are packaged as a Goal Structuring Notation argument [40] [41], following guidance for assuring machine-learning components [42] [43].

3Problem formulation

Let X\mathcal{X} be the operating domain, a box over scenario parameters (range, bearing, light, occlusion, dust, person pose and speed, machine speed), and ω\omega the nuisance randomness of one episode (terrain and sensor-noise seeds). A scenario runner maps (x,ω)(x, \omega) and a perception model mm to a closed-loop trace w=Runm(x,ω)w = \mathrm{Run}_m(x,\omega). Each requirement rr is an STL formula φr\varphi_r with a region of applicability Ar⊆XA_r \subseteq \mathcal{X}. Robustness is defined inductively [14]:

ρ(μ,w,t)=fμ(w(t)),ρ(¬φ,w,t)=−ρ(φ,w,t),ρ(φ∧ψ,w,t)=min⁡{ρ(φ,w,t),ρ(ψ,w,t)}\rho(\mu, w, t) = f_\mu(w(t)),\quad \rho(\neg\varphi, w, t) = -\rho(\varphi, w, t),\quad \rho(\varphi\wedge\psi, w, t) = \min\{\rho(\varphi,w,t), \rho(\psi,w,t)\}(1)
ρ(GIφ,w,t)=inf⁡t′∈t+Iρ(φ,w,t′),ρ(FIφ,w,t)=sup⁡t′∈t+Iρ(φ,w,t′)\rho(\mathbf{G}_I\varphi, w, t) = \inf_{t' \in t+I} \rho(\varphi, w, t'),\qquad \rho(\mathbf{F}_I\varphi, w, t) = \sup_{t' \in t+I} \rho(\varphi, w, t')(2)

with ρ>0\rho > 0 meaning satisfied with margin. The requirement at the centre of our case study is

φ3=G ((d<10)→(a≤0.1))\varphi_3 = \mathbf{G}\,\big( (d < 10) \rightarrow (a \le 0.1) \big)(3)

where dd is the distance to the person in metres and aa the machine's acceleration in m/s². For a baseline bb and candidate cc we define the per-requirement violation probabilities pmr(x)=Pr⁡ω[ρ(φr,Runm(x,ω),0)<0]p_m^r(x) = \Pr_\omega[\rho(\varphi_r, \mathrm{Run}_m(x,\omega), 0) < 0] and the regression

Δr(x)=pcr(x)−pbr(x),x∈Ar.\Delta_r(x) = p_c^r(x) - p_b^r(x), \qquad x \in A_r .(4)

The gate must decide, with a budget of candidate episodes far below the size of any exhaustive suite, whether there exist rr and xx with Δr(x)>0\Delta_r(x) > 0, and it must control the probability of declaring a regression when none exists. Violations with pbr(x)≈pcr(x)>0p_b^r(x) \approx p_c^r(x) > 0 are known baseline issues: real, reported, but not caused by the change and not grounds to block it. This is deliberately weaker than demanding pcr≡0p_c^r \equiv 0, which no finite test can establish [38], and deliberately stronger than comparing averages over X\mathcal{X}.

Table 1. Safety requirements used in the study (signals sampled at 10 Hz over 15 s).
idrequirementSTL
R1Never within 2 m of a person while moving faster than 0.5 m/s.G ((dist > 2.0) | (speed < 0.5))
R2Once a person is within 15 m, come to a stop within 3 s.G[0,12] ((dist < 15.0) -> F[0,3] (speed < 0.05))
R3Never accelerate while a person is within 10 m.G ((dist < 10.0) -> (accel <= 0.1))
R4Never come within 1 m of a person.G (dist > 1.0)
R5Once a person is within 25 m, slow to 1.6 m/s or less within 4 s.G[0,11] ((dist < 25.0) -> F[0,4] (speed <= 1.6))
R6Never exceed the 4 m/s speed envelope.G (speed <= 4.0)

4Method

Candidate modelcommit to the release branchBehavioural diffchange signature over cellsRisk priorbaseline GP + divergenceFalsificationacquisition over the domainPaired confirmationscreen, then replicate at α/2ᵏHeld-out boundsClopper–Pearson, with assumptionsVerdict + safety caseGSN, hash-chained bundleevery executed episode feeds the history of the next releaseONE RELEASE, END TO END
Figure 1. One release through the gate (schematic). Every executed episode is added to the history that becomes the next release's prior.

4.1Behavioural change signature

Both versions see exactly the same rendered frames: stratified samples within each cell of a partition of the domain (four bins each on light and range, two on occlusion and dust, times three poses: 192 cells, 3,072 scenarios), each contributing three frames along an open-loop approach. Per frame we score disagreement without ground truth,

s=0.5 1[δb≠δc]+0.3 ∣qb−qc∣+0.2 1[δb∧δc] min⁡ ⁣(∣r^b−r^c∣/5, 1),s = 0.5\,\mathbb{1}[\delta_b \ne \delta_c] + 0.3\,|q_b - q_c| + 0.2\,\mathbb{1}[\delta_b \wedge \delta_c]\,\min\!\big(|\hat r_b - \hat r_c|/5,\,1\big),(5)

where δ\delta is the detection decision at confidence 0.5, qq the confidence and r^\hat r the estimated range. A cell is changed when its mean score exceeds τ=max⁡(s~+3⋅1.4826 MAD(s), 0.05)\tau = \max(\tilde s + 3 \cdot 1.4826\,\mathrm{MAD}(s),\ 0.05), a robust z-score with an absolute floor; adjacent changed cells are merged into boxes. In the case study τ=0.261\tau = 0.261 and the signature has 3 components, all with prone poses. The signature measures change, not error: it cannot say which version is right.

4.2A prior from the previous release

For each requirement a Gaussian process [44] models transformed robustness gr(ρ)=asinh⁡(ρ/sr)g_r(\rho) = \operatorname{asinh}(\rho / s_r), with srs_r the median absolute robustness in the history (floor 0.02). The transform preserves the zero boundary and tames heavy tails; the per-requirement scale matters because some requirements' robustness saturates at small positive values when satisfied. The baseline's GPs are fitted on its own history (320 episodes, Latin hypercube then active learning by expected information about the sign of robustness [45], in the spirit of level-set estimation [46] [47]). Before any candidate episode, the candidate prior keeps the baseline mean and inflates the variance where behaviour changed:

μcr(x)=μbr(x),σcr(x)2=σbr(x)2+(κr D(x))2,\mu_c^r(x) = \mu_b^r(x), \qquad \sigma_c^r(x)^2 = \sigma_b^r(x)^2 + \big(\kappa_r\, D(x)\big)^2,(6)

with D(x)D(x) the divergence of the cell containing xx and κr\kappa_r a per-requirement scale (κ1 = 0.50, κ2 = 2.37, κ3 = 1.32, κ4 = 0.45, κ5 = 0.68, κ6 = 0.58). The predicted at-risk regions are changed cells where Φ(−μcr/σcr)\Phi(-\mu_c^r/\sigma_c^r) exceeds 0.05 for an applicable requirement.

predicted at-risk region (prone)confirmed regression (0.21 lux, 27.6 m)0.1110100100010000510203040light (lux, log scale)initial range (m)0.100.80prior P(violation)
Figure 2. Candidate prior probability of violating any applicable requirement over light and initial range (averaged over 12 Monte Carlo draws of the remaining axes per cell), computed before a single candidate episode. Dashed: the first predicted at-risk region (prone person). Ring: the regression the search later confirmed. Data from the evidence bundle.

4.3Regression-targeted falsification

Falsification minimises robustness [8] [15], but a gate is not interested in every violation, only in those the baseline does not share. We therefore rank candidate scenarios by the probability of a regression rather than of a violation,

α(x)=max⁡r: x∈Ar Φ ⁣(−μcr(x)σcr(x)) Φ ⁣(μbr(x)σbr(x)),\alpha(x) = \max_{r:\,x\in A_r} \ \Phi\!\left(-\frac{\mu_c^r(x)}{\sigma_c^r(x)}\right)\, \Phi\!\left(\frac{\mu_b^r(x)}{\sigma_b^r(x)}\right),(7)

with the candidate model updated as a residual GP on top of the baseline mean as episodes arrive. Half of each candidate pool is drawn from the predicted at-risk regions and half from the whole domain, so the prior steers the search without fencing it in. Every candidate violation is immediately re-run on the baseline with identical seeds; if the baseline also fails, the scenario is recorded as a pre-existing failure. Simulated annealing and uniform random sampling share the same loop and stopping rule and serve as baselines.

4.4Paired confirmation with alpha spending

Single episodes are stochastic (sensor noise, clutter, terrain), so a regression candidate must be confirmed. Both versions are re-run on nn fresh paired seeds; with bb the number of pairs where only the candidate fails and kk the pairs where only the baseline fails, the one-sided exact McNemar test [31] [32] gives

p=Pr⁡ ⁣[Bin(b+k, 12)≥b].p = \Pr\!\left[\mathrm{Bin}(b + k,\ \tfrac12) \ge b\right].(8)

A search screens many candidates, so testing each at 0.05 inflates false positives; §7 shows this happening. Screening (n=10n = 10, p<0.05p < 0.05) is therefore followed by an independent replication on n=30n = 30 seeds from a separate stream, and the jj-th replication attempted in a search is tested at αj=α/2j\alpha_j = \alpha / 2^j. Since a false regression requires a false replication, and replications use independent seeds,

Pr⁡[any false regression]  ≤  ∑j≥1α 2−j  =  α=0.05,\Pr[\text{any false regression}] \;\le\; \sum_{j \ge 1} \alpha\, 2^{-j} \;=\; \alpha = 0.05,(9)

a union bound in the spirit of alpha-spending designs [48] and Bonferroni-type control [49], which holds however many candidates are screened and however the search adapts, because each replication's seeds are drawn after the decision to replicate. The exact conditional test is conservative [32]; for a gate that blocks releases, erring towards not declaring a regression is the intended direction, at the price of needing more paired runs.

4.5Bounds and evidence

Search samples are adaptive and cannot support a probability statement. For each requirement and region the gate draws fresh i.i.d. scenarios, runs both versions on identical seeds, and reports the Clopper–Pearson upper limit pˉ=Beta−1(1−δ; k+1, n−k)\bar p = \mathrm{Beta}^{-1}(1-\delta;\,k+1,\,n-k) at δ=0.05\delta = 0.05 [33], equivalently a training-conditional conformal bound [36], alongside the marginal (k+1)/(n+1)(k+1)/(n+1) [35]. The paired held-out outcomes also feed the verdict: significantly more candidate violations on the same scenarios fails the gate. Each bound carries its assumptions — exchangeability, the sampling distribution, its region of validity and the simulation-to-reality gap — and those assumptions are context nodes in the generated GSN safety case [40]. All inputs (model, dataset-manifest and requirements hashes, seeds, engine version) and every section of results are SHA-256 hash-chained, and a verify command re-executes a bundle and checks every hash.

5Experimental setup

World and machine. A deliberately crude procedural range-and-intensity sensor world at 10 Hz (furrowed terrain, a volumetric person in three poses, occlusion, dust and illumination-dependent intensity noise) stands in for a production simulator or log replay behind a single runner interface. The machine follows bicycle kinematics (≤ 4 m/s, acceleration ≤ 1.0 m/s², deceleration ≤ 2.5 m/s²) with a reactive planner fixed across versions: one frame of latency, three consecutive detections to confirm a person, a track released after ten missed frames, slowing to 1.5 m/s inside 25 m and stopping inside 15 m.

Perception. A 168,243-parameter convolutional detector outputs presence, range, azimuth and confidence. The baseline v1 is trained on 40,000 frames sampled uniformly over the domain; the candidate v2b on 80,000 frames from a mix that drops one slice (low-light crouching poses). The mix was chosen and pre-registered before any per-region evaluation of the candidate, and the candidate was required to improve on aggregate metrics, which it does (Table 2). No per-region metric of the candidate was computed before the search.

Table 2. Aggregate metrics on 6,000 held-out frames sampled uniformly over the domain. The candidate is better on every metric.
metricv1 (baseline)v2b (candidate)
F1 at 0.50.8730.893
precision0.9060.919
recall0.8420.868
accuracy0.8300.856
range MAE (m)1.7511.440
azimuth MAE (deg)5.6953.984
Brier score0.1140.092

Protocol. One gate run with search budget 500 (engine 0.3.0), followed by a comparison of the three searchers on seeds 1–5 at the same budget. The exhaustive reference suite is a grid of four levels on each of the seven continuous axes times three poses, 49,152 episodes per model version, which we never run; it is the cost a naive gate would pay.

6Results

6.1The candidate regresses R3

The surrogate-guided search found its first violation at episode 1 and screened its first regression candidate early, but two candidates passed screening and then failed replication. At search episode 85 the third replication succeeded: on 10 paired seeds the candidate failed 6/10 and the baseline 1/10 (p=0.0312p = 0.0312); on 30 independent seeds 17/30 against 8/30 (p=0.00586<α3=0.00625p = 0.00586 < \alpha_3 = 0.00625). A separate post-hoc replication on 40 further seeds gave 21/40 against 12/40 (p=0.025p = 0.025; build log). The scenario is a prone person at 0.21 lux and 27.6 m, bearing -37°, with the machine at 3.75 m/s. It is a rate increase — roughly 50 % against 30 % — not a scenario the baseline always passes.

010203010 mdistance to person (m)024machine speed (m/s)01020violation below 0R3 robustness ρCANDIDATE DETECTOR OUTPUT0 s3 s6 s9 s12 s15 sconfirmed track 3.3–8.3 sR3 broken 10.2–11.6 s
Figure 3. The failing episode for both versions on identical seeds (white: candidate v2b, grey: baseline v1). The candidate confirms the person earlier and slows further, holds a confirmed track from 3.3 to 8.3 s, then loses it. From 10.2 to 11.6 s it accelerates with the person within 10 m; its detector fires only on isolated frames (10.8, 11.5 s), which the three-frame confirmation filter never accepts. Closest approach: 9.74 m (candidate) against 12.11 m (baseline). Bottom: candidate detector output (white: confirmed). Data from the evidence bundle.

The mechanism is visible in the traces (Figure 3) and is the interaction the gate exists to catch: neither the detector change nor the planner is wrong in isolation. The candidate is better at noticing the dark, prone person at long range — it slows earlier and further than the baseline — but its detections become intermittent at mid range. After ten missed frames the planner releases the track and accelerates back towards cruise speed while the person is inside 10 m. The baseline, which never confirms the person, passes at speed and happens to stay 12.1 m away.

6.2Where it fails

Bisection along each axis through the failing scenario, with the other axes held fixed, gives the one-axis failure intervals in Figure 4: the failure needs a prone or crouching person starting within 28.2 m in light between 0.19 and 7.2 lux, a person moving faster than 0.61 m/s and a machine above 1.11 m/s, and it is insensitive to dust within the domain. One-axis slices are not a characterisation of the failure set, which need not be a box; they are a reading aid that tells an engineer which conditions to reproduce.

range (m)2–28.22bearing (deg)-37.58–40.25light (lux, log)0.19–7.2occlusion0–0.74dust density0–1person speed (m/s)0.61–1.5machine speed (m/s)1.11–3.96
Figure 4. One-axis failure intervals (red) through the confirmed scenario (white dot) on each axis's domain, with the other axes held at the scenario. Data from the evidence bundle.

6.3Random validation does not see it

On 200 fresh i.i.d. scenarios from the predicted at-risk region, run on both versions with identical seeds, the candidate violates R3 in 41 episodes and the baseline in 62: by this measure the candidate is the safer model in the very region where it has a confirmed regression. Both statements are true. The regression lives in a small subset of the region, while elsewhere the candidate's better long-range detection reduces violations. A gate that validated by sampling, however carefully stratified, would have shipped the update. Table 3 lists the bounds.

Table 3. Held-out violations (paired, identical seeds) and 95 % Clopper–Pearson upper bounds on the candidate's violation probability. Each bound holds only for its sampling distribution and region, and inherits the gap between simulation and reality.
req.regioncandidateupper boundbaseline
R1at-risk0/2000.0152/200
R2at-risk76/2000.440106/200
R3at-risk41/2000.25862/200
R4at-risk0/2000.0151/200
R5at-risk10/1230.13433/123
R6at-risk0/2000.0150/200
R1domain0/1560.0190/156
R2domain30/1740.22730/174
R3domain22/2000.15321/200
R4domain0/1560.0190/156
R5domain7/1020.12510/102
R6domain0/2000.0150/200

Collision-type requirements R1 and R4 show no violations for either version (pˉ≤0.015\bar p \le 0.015 in the at-risk region). R2 and R5 are violated by both versions at similar or higher baseline rates and are reported as known baseline issues; they do not fail the gate.

6.4Cost and search efficiency

The verdict cost 888 candidate episodes — 88 search, 330 confirmation, 70 boundary and 400 held-out — against 49,152 for the exhaustive grid (55× fewer), plus baseline re-runs on identical seeds. Wall-clock for the gate, excluding the seed comparison, was 8.4 minutes on a shared CPU. Across five seeds (Figure 5), the risk-model-guided search found a confirmed regression with a censored median of 100 search episodes, against 193 for simulated annealing and 261 for random sampling; each method failed on one seed. Five seeds is a small sample, and §7 reports configurations in which the surrogate did not win.

0100200300400500budgetrisk-model guidedmedian 100seed 1: 66seed 2: 100seed 4: 68seed 5: 362simulated annealingmedian 193seed 2: 287seed 3: 193seed 4: 157seed 5: 177random samplingmedian 261seed 2: 261seed 3: 497seed 4: 185seed 5: 138search episodes to the first confirmed regression (per seed; ▶ = not found within budget)
Figure 5. Search episodes to the first confirmed regression, per seed and method, budget 500. Medians are censored at the budget. Data from the evidence bundle.

6.5The safety case

G0 · GoalReleasing perception v2b does not make the machine lesssafe than with v1, within the operating domain, asexercised in simulation.C2 · ContextSynthetic world: a deliberatelycrude simulation used to exercisethe engine. Results inherit everygap between it and reality.S0 · StrategyArgue over each safety requirement in requirements.yaml(sha256 6766345c7401).G_R3 · GoalR3: no regression of 'Never accelerate while a personis within 10 m.'S_R3 · StrategyFalsification search in the predicted at-risk regions,then a conformal bound on fresh held-out samples.Sn_R3_search · SolutionSearch: 52 violation(s) in 88 candidate episodes;regression at episode 85 (rho -0.259 vs baseline 2.112).Sn_R3_bound · SolutionBound at 95%: at-risk: P(violation) <= 0.258 (41/200,baseline 62/200); domain: P(violation) <= 0.153 (22/200,baseline 21/200).
Figure 6. Fragment of the generated GSN safety case: the top-level goal fails because the R3 sub-goal fails on the search evidence, while the held-out bound for R3 is a baseline issue. Node texts are generated from the run; the layout is ours.

7What went wrong on the way

We report three failures because each changed the method, and because a gate is only as credible as its record of not crying wolf.

Unreplicated regressions. The first engine accepted a regression after one paired screen at p<0.05p < 0.05. It reported regressions in two runs. Pre-specified replications on 40 fresh paired seeds gave p=0.07p = 0.07 (31/40 against 24/40) and p=0.77p = 0.77 (21/40 against 23/40): neither was a regression. Each search had screened on the order of twenty candidates with no multiple-testing control, so a false positive was the expected outcome. The two-stage rule of §4.4 was introduced in response, and with it the original candidate (v2) showed no replicated regression in a widened 2,000-episode search, nine screened candidates all failing replication. Following a pre-registered protocol, the data mix was then revisited (v2b, which removes the slice instead of thinning it), producing the regression reported here.

The surrogate did not always help. With the search confined to the predicted at-risk boxes, the surrogate found a regression on 2 of 5 seeds (censored median above the budget) against 3/5 for random sampling and 5/5 for annealing; drawing half of each pool from the whole domain improved this to 4/5 but not the median. The change signature measures where perception output diverges; closed-loop regressions also arise where small perception changes meet a marginal baseline, outside the boxes. Per-requirement robustness scaling and feeding the search's baseline checks back into the baseline model (the configuration in §4) produced the result in Figure 5. We regard the surrogate's advantage as promising and unproven.

Saturating robustness. R2 and R5 are written as “eventually slow below a threshold”; when satisfied their robustness saturates at the threshold margin (0.05 and 0.1), so the GP sees almost no gradient on the safe side and the regression-targeted acquisition is weak for them. Requirement authors should know that the shape of a formula affects how well it can be searched, not only what it means.

8Threats to validity

The world is synthetic and intentionally crude; nothing here is a statement about any real machine, sensor or site, and every bound inherits the gap between this world and reality. The domain is seven-dimensional with three poses; production domains are larger and less regular, and the cell partition used by the diff grows exponentially with the axes it covers. The search comparison uses five seeds on one candidate. The one-axis boundary is a local description. The bounds concern a stated sampling distribution, not operational exposure. Finally, the planner is simple; richer planners may convert perception changes into behaviour in ways a per-cell divergence summarises poorly.

9Discussion and conclusion

A release gate reframes safety validation of learned components around the question teams actually face at every merge — did this change make the machine worse? — and that reframing buys three things: a prior from the previous release, a measurable change before any closed-loop test, and a paired statistical test with an explicit false-alarm budget. The case study shows the failure mode that motivates it: a model better on every aggregate metric, and safer on random samples of the very region in question, that nevertheless accelerates towards a person it has stopped confirming. The next steps are to run the same engine behind production simulators and log replay, to learn change signatures for higher-dimensional operating domains, and to map the evidence bundle onto the technical documentation that conformity assessment under the Machinery Regulation requires [3].

Reproducibility. Evidence bundle gate-20d4910ec7ff, hash 322c8d5ebc03a324ca58a4b395cdf7a05d02f2e7f79c95c3971993cf2c48e241, engine 0.3.0, requirements sha256 6766345c7401cd16…. The bundle re-verified byte-for-byte from a fresh clone and on a CI runner. The full evidence page, including an interactive replay of the failing episode, is at demo.afterwave.org.

Cite this report

@techreport{afterwave2026release,
  title       = {Release gating for learned perception in closed-loop autonomy:
                 change-guided falsification with paired confirmation},
  author      = {{Afterwave Research}},
  institution = {Afterwave},
  number      = {AW-TR-2026-01},
  year        = {2026},
  month       = oct,
  url         = {https://www.afterwave.org/research/release-gating/}
}

References

  1. 1
    ISO (2022). ISO 21448:2022 Road vehicles — Safety of the intended functionality. International Organization for Standardization. iso.org
  2. 2
    UL Standards & Engagement (2023). ANSI/UL 4600 Standard for Evaluation of Autonomous Products, 3rd edition. ulse.org
  3. 3
    European Parliament and Council (2023). Regulation (EU) 2023/1230 on machinery and repealing Directive 2006/42/EC and Council Directive 73/361/EEC. Official Journal of the European Union L 165, 29 June 2023. eur-lex.europa.eu
  4. 4
    G. Bansal, B. Nushi, E. Kamar, D. S. Weld, W. S. Lasecki and E. Horvitz (2019). Updates in human-AI teams: understanding and addressing the performance/compatibility tradeoff. AAAI 2019, pp. 2429–2437. doi:10.1609/aaai.v33i01.33012429
  5. 5
    M. Srivastava, B. Nushi, E. Kamar, S. Shah and E. Horvitz (2020). An empirical analysis of backward compatibility in machine learning systems. KDD 2020, pp. 3272–3280. doi:10.1145/3394486.3403379
  6. 6
    S. Yan, Y. Xiong, K. Kundu, S. Yang, S. Deng, M. Wang, W. Xia and S. Soatto (2021). Positive-congruent training: towards regression-free model updates. CVPR 2021, pp. 14294–14303. doi:10.1109/CVPR46437.2021.01407
  7. 7
    L. Oakden-Rayner, J. Dunnmon, G. Carneiro and C. Ré (2020). Hidden stratification causes clinically meaningful failures in machine learning for medical imaging. ACM CHIL 2020, pp. 151–159. doi:10.1145/3368555.3384468
  8. 8
    Y. Annpureddy, C. Liu, G. Fainekos and S. Sankaranarayanan (2011). S-TaLiRo: A tool for temporal logic falsification for hybrid systems. TACAS 2011, LNCS 6605, pp. 254–257. doi:10.1007/978-3-642-19835-9_21
  9. 9
    A. Donzé (2010). Breach, a toolbox for verification and parameter synthesis of hybrid systems. CAV 2010, LNCS 6174. doi:10.1007/978-3-642-14295-6_17
  10. 10
    J. Kapinski, J. V. Deshmukh, X. Jin, H. Ito and K. Butts (2016). Simulation-based approaches for verification of embedded control systems: an overview of traditional and advanced modeling, testing, and verification techniques. IEEE Control Systems Magazine 36(6), pp. 45–64. doi:10.1109/MCS.2016.2602089
  11. 11
    A. Corso, R. Moss, M. Koren, R. Lee and M. Kochenderfer (2021). A survey of algorithms for black-box safety validation of cyber-physical systems. Journal of Artificial Intelligence Research 72. doi:10.1613/jair.1.12716
  12. 12
    O. Maler and D. Nickovic (2004). Monitoring temporal properties of continuous signals. FORMATS/FTRTFT 2004, LNCS 3253, Springer, pp. 152–166. doi:10.1007/978-3-540-30206-3_12
  13. 13
    G. E. Fainekos and G. J. Pappas (2009). Robustness of temporal logic specifications for continuous-time signals. Theoretical Computer Science 410, pp. 4262–4291. doi:10.1016/j.tcs.2009.06.021
  14. 14
    A. Donzé and O. Maler (2010). Robust satisfaction of temporal logic over real-valued signals. FORMATS 2010, LNCS 6246, pp. 92–106. doi:10.1007/978-3-642-15297-9_9
  15. 15
    J. Deshmukh, M. Horvat, X. Jin, R. Majumdar and V. S. Prabhu (2017). Testing cyber-physical systems through Bayesian optimization. ACM Transactions on Embedded Computing Systems 16(5s). doi:10.1145/3126521
  16. 16
    S. Ghosh, F. Berkenkamp, G. Ranade, S. Qadeer and A. Kapoor (2018). Verifying controllers against adversarial examples with Bayesian optimization. ICRA 2018, pp. 7306–7313. doi:10.1109/ICRA.2018.8460635
  17. 17
    T. Dreossi, A. Donzé and S. A. Seshia (2019). Compositional falsification of cyber-physical systems with machine learning components. Journal of Automated Reasoning 63, pp. 1031–1053 (NFM 2017). doi:10.1007/s10817-018-09509-5
  18. 18
    T. Dreossi, D. J. Fremont, S. Ghosh, E. Kim, H. Ravanbakhsh, M. Vazquez-Chanlatte and S. A. Seshia (2019). VerifAI: a toolkit for the formal design and analysis of artificial intelligence-based systems. CAV 2019, LNCS 11561, pp. 432–442. doi:10.1007/978-3-030-25540-4_25
  19. 19
    D. J. Fremont, T. Dreossi, S. Ghosh, X. Yue, A. L. Sangiovanni-Vincentelli and S. A. Seshia (2019). Scenic: a language for scenario specification and scene generation. PLDI 2019, pp. 63–78. doi:10.1145/3314221.3314633
  20. 20
    M. O'Kelly, A. Sinha, H. Namkoong, R. Tedrake and J. C. Duchi (2018). Scalable end-to-end autonomous vehicle testing via rare-event simulation. Advances in Neural Information Processing Systems 31 (NeurIPS 2018). proceedings.neurips.cc
  21. 21
    R. Lee, O. J. Mengshoel, A. Saksena, R. W. Gardner, D. Genin, J. Silbermann, M. Owen and M. J. Kochenderfer (2020). Adaptive stress testing: finding likely failure events with reinforcement learning. Journal of Artificial Intelligence Research 69, pp. 1165–1201. doi:10.1613/jair.1.12190
  22. 22
    R. J. Moss, M. J. Kochenderfer, M. Gariel and A. Dubois (2023). Bayesian safety validation for black-box systems. AIAA AVIATION 2023 Forum. doi:10.2514/6.2023-3596
  23. 23
    K. Pei, Y. Cao, J. Yang and S. Jana (2017). DeepXplore: automated whitebox testing of deep learning systems. SOSP 2017, pp. 1–18. doi:10.1145/3132747.3132785
  24. 24
    Y. Tian, K. Pei, S. Jana and B. Ray (2018). DeepTest: automated testing of deep-neural-network-driven autonomous cars. ICSE 2018, pp. 303–314. doi:10.1145/3180155.3180220
  25. 25
    T. Woodlief, C. Hildebrandt and S. Elbaum (2025). A differential testing framework to identify critical AV failures leveraging arbitrary inputs. ICSE 2025, pp. 360–372. doi:10.1109/ICSE55347.2025.00163
  26. 26
    Y. Chung, T. Kraska, N. Polyzotis, K. H. Tae and S. E. Whang (2019). Slice Finder: automated data slicing for model validation. ICDE 2019, pp. 1550–1553. doi:10.1109/ICDE.2019.00139
  27. 27
    S. Eyuboglu, M. Varma, K. Saab, J.-B. Delbrouck, C. Lee-Messer, J. Dunnmon, J. Zou and C. Ré (2022). Domino: discovering systematic errors with cross-modal embeddings. ICLR 2022. arxiv.org
  28. 28
    Y. Shen, Y. Xiong, W. Xia and S. Soatto (2020). Towards backward-compatible representation learning. CVPR 2020, pp. 6367–6376. doi:10.1109/CVPR42600.2020.00640
  29. 29
    G. Rothermel and M. J. Harrold (1996). Analyzing regression test selection techniques. IEEE Transactions on Software Engineering 22, pp. 529–551. doi:10.1109/32.536955
  30. 30
    S. Yoo and M. Harman (2012). Regression testing minimization, selection and prioritization: a survey. Software Testing, Verification and Reliability 22(2), pp. 67–120. doi:10.1002/stvr.430
  31. 31
    Q. McNemar (1947). Note on the sampling error of the difference between correlated proportions or percentages. Psychometrika 12(2), pp. 153–157. doi:10.1007/BF02295996
  32. 32
    M. W. Fagerland, S. Lydersen and P. Laake (2013). The McNemar test for binary matched-pairs data: mid-p and asymptotic are better than exact conditional. BMC Medical Research Methodology 13:91. doi:10.1186/1471-2288-13-91
  33. 33
    C. J. Clopper and E. S. Pearson (1934). The use of confidence or fiducial limits illustrated in the case of the binomial. Biometrika 26(4), pp. 404–413. doi:10.1093/biomet/26.4.404
  34. 34
    V. Vovk, A. Gammerman and G. Shafer (2005). Algorithmic Learning in a Random World. Springer. doi:10.1007/b106715
  35. 35
    A. N. Angelopoulos and S. Bates (2023). Conformal prediction: a gentle introduction. Foundations and Trends in Machine Learning 16, pp. 494–591. doi:10.1561/2200000101
  36. 36
    V. Vovk (2012). Conditional validity of inductive conformal predictors. ACML 2012, PMLR 25, pp. 475–490. proceedings.mlr.press
  37. 37
    L. Lindemann, X. Qin, J. V. Deshmukh and G. J. Pappas (2023). Conformal prediction for STL runtime verification. ICCPS 2023, pp. 142–153. doi:10.1145/3576841.3585927
  38. 38
    N. Kalra and S. M. Paddock (2016). Driving to safety: how many miles of driving would it take to demonstrate autonomous vehicle reliability?. Transportation Research Part A: Policy and Practice 94, pp. 182–193. doi:10.1016/j.tra.2016.09.010
  39. 39
    P. Koopman and M. Wagner (2016). Challenges in autonomous vehicle testing and validation. SAE International Journal of Transportation Safety 4, pp. 15–24. doi:10.4271/2016-01-0128
  40. 40
    T. P. Kelly and R. A. Weaver (2004). The Goal Structuring Notation – a safety argument notation. Proc. Dependable Systems and Networks 2004 Workshop on Assurance Cases.
  41. 41
    Assurance Case Working Group (2021). Goal Structuring Notation Community Standard, Version 3. Safety-Critical Systems Club, SCSC-141C. scsc.uk
  42. 42
    S. Burton, L. Gauerhof and C. Heinzemann (2017). Making the case for safety of machine learning in highly automated driving. SAFECOMP 2017 Workshops, pp. 5–16. doi:10.1007/978-3-319-66284-8_1
  43. 43
    R. Hawkins, C. Paterson, C. Picardi, Y. Jia, R. Calinescu and I. Habli (2021). Guidance on the assurance of machine learning in autonomous systems (AMLAS). Assuring Autonomy International Programme, University of York; arXiv:2102.01564. arxiv.org
  44. 44
    C. E. Rasmussen and C. K. I. Williams (2006). Gaussian Processes for Machine Learning. MIT Press. gaussianprocess.org
  45. 45
    N. Houlsby, F. Huszár, Z. Ghahramani and M. Lengyel (2011). Bayesian active learning for classification and preference learning. arXiv:1112.5745. arxiv.org
  46. 46
    B. Bryan, R. C. Nichol, C. R. Genovese, J. Schneider, C. J. Miller and L. Wasserman (2005). Active learning for identifying function threshold boundaries. Advances in Neural Information Processing Systems 18 (NIPS 2005). proceedings.neurips.cc
  47. 47
    A. Gotovos, N. Casati, G. Hitz and A. Krause (2013). Active learning for level set estimation. IJCAI 2013, pp. 1344–1350. ijcai.org
  48. 48
    K. K. G. Lan and D. L. DeMets (1983). Discrete sequential boundaries for clinical trials. Biometrika 70(3), pp. 659–663. doi:10.1093/biomet/70.3.659
  49. 49
    S. Holm (1979). A simple sequentially rejective multiple test procedure. Scandinavian Journal of Statistics 6(2), pp. 65–70. jstor.org