Model updates certified to avoid hidden user harm when evaluated slice-wise
Certifying Model Upgrades with Slice-Wise Non-Regression and Incumbent Fallback
Machine Learning
Summary
Sometimes updating a machine learning model can make things look better overall but actually cause problems in smaller parts that matter to users. The authors study how to pick a safe model update that does not harm important slices of data compared to the current model. They present a method that checks updates carefully and only replaces the current model if there is strong evidence it is not worse. Their approach reduces the risk of releasing harmful updates even when testing is noisy or uncertain. While the method works well in controlled settings, it may be underpowered in real-world complex tasks.
What this means in practice
- •For machine learning engineers: Select reliable model checkpoints that avoid degrading important user data slices under noisy evaluation conditions.
- •For quality assurance teams: Implement an auditable protocol to rigorously certify that new model versions do not harm specific data slices compared to retained incumbents.
Tested on simulated data.
Authors
Shengwei Zhang, Tao Wu, Fei Qian
Abstract
An updated model can improve an aggregate metric while degrading a slice that matters to a downstream user. We study checkpoint selection subject to non-regression tolerances relative to a retained incumbent. The central distinction is between failing to detect harm and certifying non-inferiority: the former can release harmful updates with high probability when evaluation is noisy. We give a reproducible release procedure that separates candidate search from independent, paired evaluation and returns the exact incumbent when certification fails. Applying established intersection-union and Learn-then-Test principles, we state finite-sample guarantees for one frozen candidate, a finite candidate library, and a prespecified testing order. A joint release decision does not require a slice-count Bonferroni penalty, although certification power can still decrease with the number of slices. In bounded-score simulations, a no-detected-harm gate releases a harmful candidate in 99.7% of trials in one 32-slice setting, compared with 2.6% for an exact non-inferiority gate at a 5% target. A constructed two-block family yields larger certified utility than a scalar path under matched candidate counts. Public digits experiments, including a subsequent continuation that improves average aggregate accuracy, return the incumbent in every run because certification is underpowered. These results establish an auditable protocol and its limitations; they do not establish benefits on foundation-model or multilingual translation upgrades.