Certified AI Triage of ICU Alarms

# Certified AI Triage of ICU Alarms
Source: [https://arxiv.org/html/2609.12365](https://arxiv.org/html/2609.12365)
###### Abstract

In the VTaC benchmark 71% of ventricular\-tachycardia alarms are false, but silencing a real one can delay recognition of a dangerous arrhythmia\. We reframe alarm reduction as three\-way triage \(retain, suppress, or defer\) and bound the decision this analysis treats as harmful: among suppressed alarms, the fraction that were genuine stays below a user\-set budget with 95% confidence, under i\.i\.d\. event sampling\. Alarms sharing a waveform record are dependent, so the clustered analysis is a sensitivity check\. On the official split a 5% budget certifies in all three seeds, suppressing 74\.8% of false alarms while silencing 1\.5% of genuine ones, at AUROC 0\.953 and Challenge Score 83\.33, numerically comparable to the strongest of the eleven published systems\. Our central finding measures what multiplicity costs: the correction charges for every candidate, so a finer grid can certify strictly less\. Under held\-out calibration the 885\-cell grid we declared certifies 1 of 15 fold\-runs, while choosing the grid on a separate selection partition certifies 8\. We project the calibration volume each budget needs, making an uncertifiable budget a design parameter\. Finally, adding a learned reliability dimension to the policy grid did not sharpen the certified frontier\.

††workshop:Machine Learning for Health \(ML4H\) 2026††proceedings:: Preprint###### keywords

false alarm reduction, ventricular tachycardia, selective prediction, risk control, multimodal physiological waveforms, VTaC

## 1Introduction

Bedside monitors in intensive care units generate arrhythmia alarms faster than clinical attention can absorb, and most are false\([Drew et al\., 2014](https://arxiv.org/html/2609.12365#bib.bib3);[Sendelbach and Funk, 2013](https://arxiv.org/html/2609.12365#bib.bib4);[Cvach, 2012](https://arxiv.org/html/2609.12365#bib.bib5)\)\. Ventricular tachycardia \(VT\) is the consequential case: it can be life\-threatening, so silencing a true VT alarm can delay recognition of a dangerous arrhythmia, and VT has been among the harder alarm types to adjudicate automatically\([Clifford et al\., 2016](https://arxiv.org/html/2609.12365#bib.bib7);[Lehman et al\., 2023](https://arxiv.org/html/2609.12365#bib.bib1)\)\. The VTaC benchmark\([Lehman et al\., 2023](https://arxiv.org/html/2609.12365#bib.bib1)\)provides 5,037 expert\-adjudicated VT alarms with multi\-lead ECG and pulsatile waveforms\.

A classifier threshold trades sensitivity against specificity but never states when the evidence is too incomplete or degraded to act on\. In retrospective adjudication the natural output is three\-way \(*retain*,*suppress*, or*defer*for review\); unsafe suppression is the endpoint this analysis controls\. What a deployment needs is a finite\-sample bound on that rate and an account of what the bound costs in labelled data\. This paper makes five contributions on VTaC\.

1. 1\.A safety guarantee for VT\-alarm suppression\.We frame adjudication as choosing a retain/suppress/defer policy from a predeclared grid and certify it with Learn\-then\-Test\([Angelopoulos et al\., 2025](https://arxiv.org/html/2609.12365#bib.bib13)\)under i\.i\.d\. event sampling, with a record\-clustered bootstrap probing the dependence that assumption ignores\. To our knowledge no published VTaC system reports a finite\-sample bound on the harmful error\.
2. 2\.What multiplicity costs on a clinical policy grid\.That Bonferroni charges per candidate is known\([Zecchin et al\., 2025](https://arxiv.org/html/2609.12365#bib.bib30)\); the size of the bill on a real task is not\. A finer grid searches more policies but pays a stricter level for each, so past some point more candidates certify less: choosing the grid on the selection partition rather than by convention takes certified fold\-runs from 1 of 15 to 8 atα=0\.05\\alpha=0\.05, and replicates on the official split\.
3. 3\.Certification without a discrimination penalty\.The base scores are untouched by the policy layer, and on the official split they are comparable to the strongest published baseline on every metric we report\.
4. 4\.Certification cost made computable\.When a budget cannot be certified we report whether the sample or the model appears to be the obstacle, and project how many labelled alarms it would need\.
5. 5\.A negative result the framework can express\.A learned evidence\-reliability scorerrresponds to degradation that barely moves the class probability, yet gating suppression onrrimproved the certified frontier on neither clean nor degraded cohorts, nor anywhere on the grid surface\.

Every experimental number here is regenerated from one stored artifact by code holding no result literals;[M](https://arxiv.org/html/2609.12365#A13)records an earlier audit and the corrections it forced\.

## 2Related Work

##### False alarm reduction\.

The PhysioNet/CinC 2015 challenge\([Clifford et al\., 2015](https://arxiv.org/html/2609.12365#bib.bib6);[Clifford et al\., 2016](https://arxiv.org/html/2609.12365#bib.bib7)\)established multimodal analysis for false arrhythmia alarms, its strongest entries corroborating ECG beats with pulsatile waveforms\([Plesinger et al\., 2016](https://arxiv.org/html/2609.12365#bib.bib9);[Aboukhalil et al\., 2008](https://arxiv.org/html/2609.12365#bib.bib8)\)and weighting channels by signal quality\([Li et al\., 2008](https://arxiv.org/html/2609.12365#bib.bib26)\)\. VTaC\([Lehman et al\., 2023](https://arxiv.org/html/2609.12365#bib.bib1)\)is an order of magnitude larger, independently labelled by at least two experts with adjudication, and reports supervised, contrastive, and generative baselines on a fixed record\-level split; we adopt its real\-time input and scoring protocol, with the deviations named in[C](https://arxiv.org/html/2609.12365#A3)\. A complementary line pretrains quality\-aware waveform encoders: QualityFM\([Guo et al\., 2025](https://arxiv.org/html/2609.12365#bib.bib28)\)self\-distills across paired high\- and low\-quality signals and reports VT false\-alarm detection among its transfer tasks\. We do not compare encoders; a stronger backbone would help where certification is model\-limited, but tab:calreq finds almost every failure here to be sample\-limited instead\.

##### Selective prediction and risk control\.

Abstention with a reject option dates to[Chow \(1970\)](https://arxiv.org/html/2609.12365#bib.bib10);[Geifman and El\-Yaniv \(2017\)](https://arxiv.org/html/2609.12365#bib.bib11)bound selective risk for a given confidence\-rate function, already correcting a confidence budget across the thresholds their search visits\([El\-Yaniv and Wiener, 2010](https://arxiv.org/html/2609.12365#bib.bib12), see also\)\. What differs here is the two\-dimensional family, the action\-specific endpoint, and the size of grid that correction must cover\. Conformal and risk\-controlling methods\([Vovk et al\., 2005](https://arxiv.org/html/2609.12365#bib.bib17);[Bates et al\., 2021](https://arxiv.org/html/2609.12365#bib.bib14);[Angelopoulos et al\., 2024](https://arxiv.org/html/2609.12365#bib.bib15);[Angelopoulos and Bates, 2023](https://arxiv.org/html/2609.12365#bib.bib16)\)supply such guarantees, and Learn\-then\-Test\([Angelopoulos et al\., 2025](https://arxiv.org/html/2609.12365#bib.bib13)\)extends them to non\-monotone losses by treating each candidate as a hypothesis test\. We apply it to a two\-dimensional family and, unlike the common fixed\-sequence variant, correct over the full grid \([4\.3](https://arxiv.org/html/2609.12365#S4.SS3)\)\. That Bonferroni charges for every candidate is known, and adaptive Learn\-then\-Test\([Zecchin et al\., 2025](https://arxiv.org/html/2609.12365#bib.bib30)\)answers it with e\-process sequential testing\([Farzaneh and Simeone, 2026](https://arxiv.org/html/2609.12365#bib.bib31), surveyed by\)\. Its saving is in testing*rounds*, each buying new data; under a non\-adaptive policy evaluated at the horizon it coincides with Learn\-then\-Test, which is our regime, one frozen sample scoring all 885 candidates at once\. We therefore measure the cost rather than remove it\. Closest to the quantity bounded here is selective conformal risk control\([Xu et al\., 2025](https://arxiv.org/html/2609.12365#bib.bib29)\), which bounds a prediction\-set loss conditional on acceptance where we bound the rate of one harmful action among the events acted on; its search over first\-stage thresholds pays the same multiplicity[5\.5](https://arxiv.org/html/2609.12365#S5.SS5)measures\.

##### Missing modalities\.

Modality dropout\([Neverova et al\., 2016](https://arxiv.org/html/2609.12365#bib.bib24)\)improves robustness to absent channels, and[Ma et al\. \(2022\)](https://arxiv.org/html/2609.12365#bib.bib25)show transformers degrade sharply under missing modalities unless fusion is designed for it; 6% of VTaC events have no usable pulsatile channel, so every model here carries a mask\.

## 3Data and Evaluation Protocol

##### Dataset\.

VTaC v1\.0\([Lehman et al\., 2024](https://arxiv.org/html/2609.12365#bib.bib2)\)contains 5,037 VT alarm events from ICU monitors of three manufacturers in three US hospitals at 250 Hz, five minutes before and one after alarm onset\. Modality coverage is not uniform: every event carries at least one ECG lead, but some lack a second and some carry no pulsatile channel \(PLETH or ABP\), so the benchmark is variable\-modality by construction rather than by accident\.111The v1\.0 release contains 90,000 samples per event at 250 Hz, i\.e\. six minutes with onset at 300 s, where the benchmark paper’s text describes ten; all windows here are measured backwards from onset, so no input is affected\.Each event has a final adjudicated labely∈\{0,1\}y\\in\\\{0,1\\\}, withy=1y\{=\}1denoting a true alarm: 1,441 true alarms \(28\.6%\) and 3,596 false\. Events belong to 2,260 waveform records \(2\.23 events per record\)\. The release exposes no patient identifier, so record\-disjoint separation is the strongest achievable; we describe it as*record\-safe*, never patient\-safe\.

##### Two arms\.

Both arms share architecture, objectives, optimizer, and policy family, differing only in the input contract the published benchmark fixes and the one architectural consequence it forces, the token stride \([4\.1](https://arxiv.org/html/2609.12365#S4.SS1)\)\. Thedevelopment armpools all 5,037 events into five record\-disjoint outer folds, each split record\-disjointly into training, checkpoint\-selection, policy\-selection and policy\-certification roles with the outer fold as evaluation, on a 60 s pre\-alarm window in three slots \(two ECG, one pulsatile\); three seeds \(317, 911, 2718\) give 15 fold\-runs\. Because the official test partition is dissolved into the pool,*no number from this arm is comparable to a published VTaC result*\. Theofficial\-split armhonours the published partition exactly \(test: 482 events across 226 records, 137 true\) and follows the published real\-time protocol\([Lehman et al\., 2023](https://arxiv.org/html/2609.12365#bib.bib1)\): a 10 s window, four channels with zero imputation, per\-segment z\-normalization, and the Challenge Score\(TP\+TN\)/\(TP\+TN\+FP\+5​FN\)\(\\mathrm\{TP\}\+\\mathrm\{TN\}\)/\(\\mathrm\{TP\}\+\\mathrm\{TN\}\+\\mathrm\{FP\}\+5\\,\\mathrm\{FN\}\)at the validation\-maximizing threshold, with the deviations of[C](https://arxiv.org/html/2609.12365#A3)\. Its calibration partitions \(819 \+ 842 events\) are cut from official*train*only, so the test set is never used for selection or certification\. Split assignments are committed, hash\-verified artifacts checked for disjointness at every stage\.

##### Preprocessing\.

ECG channels receive a 60 Hz notch and a 1–30 Hz Butterworth band\-pass, PLETH a 0\.5–5 Hz band\-pass, ABP none; each is z\-scored per event\. A slot is*available*if a matching header channel exists and holds at least one finite sample in the window; unavailable slots are zero\-filled and flagged in the mask𝐦∈\{0,1\}C\\mathbf\{m\}\\in\\\{0,1\\\}^\{C\}\. A slot named in the header can still fail this test, so the development cache has 45 events with a single usable ECG slot and 304 with no usable pulsatile slot, against 44 and 292 by header alone\. All remain in the evaluation population\.

## 4Method

### 4\.1Sentry: availability\-aware multimodal encoder

fig:arch summarizes the model\. Each event provides waveforms𝐱∈ℝC×L\\mathbf\{x\}\\in\\mathbb\{R\}^\{C\\times L\}overCCmodality slots ofLLsamples, and an availability mask𝐦\\mathbf\{m\}\. A trunk shared across slots producesTTtokens per slot at widthd=512d=512; tokens of unavailable slots are zeroed throughout, and attention pooling gives one vector per slot, unavailable slots pooling to zero rather than to a value derived from imputed zeros\. Fusion is four self\-attention layers over the concatenated tokens, masked so a pulsatile token can attend to nearby ECG tokens but never globally over raw samples\. The fused evidence vectorz∈ℝdz\\in\\mathbb\{R\}^\{d\}is the availability\-weighted mean of the slot\-pooled outputs, and a classifier head maps it to the true\-alarm probabilityp=σ⁡\(⋅\)p=\\sigma\(\\cdot\), withσ\\sigmathe logistic function\. The token stride iss=40s=40in the development arm ands=8s=8in the official\-split arm: the shorter window forces the change, since ats=40s=40a 10 s window yields 62 tokens, fewer than the±64\\pm 64\-token fusion radius, so local attention would degenerate to global\.

Thereliability headconsumeszz, the mask𝐦\\mathbf\{m\}, per\-slot reliability scoresq∈ℝCq\\in\\mathbb\{R\}^\{C\}from a channel head, and a shift\-compatibility confidence: the maximum softmax over cosine agreement between the first ECG slot and each other slot across 17 token shifts \(±8\\pm 8tokens,±1\.3\\pm 1\.3s at stride 40 and±0\.26\\pm 0\.26s at stride 8\)\. Itsd\+3​C−1d\+3C\-1inputs \(520 development, 523 official\) are dominated byzz\. Compatibility is a learned agreement feature, not a pulse\-transit\-time estimate, andr=σ⁡\(⋅\)r=\\sigma\(\\cdot\)describes the evidence, not physiology\.

##### Objectives\.

Training minimizes unweighted binary cross\-entropy under modality dropout, plus three auxiliary losses on a separately intervened view of the same batch: masked cross\-modal reconstruction for dropped slots, per\-slot identification of a declared acquisition intervention, and an*evidence\-quality*target, the fraction of source\-available slots left unmasked and unintervened in that view, regressed by the reliability logit\. Every target is an observable consequence of an intervention the training loop applied; none uses the VT label\.[B](https://arxiv.org/html/2609.12365#A2)gives the trunk, loss weights and optimizer settings\.

### 4\.2Triage policy family

A policy is a triple\(τsup,τrel,τret\)\(\\tau\_\{\\mathrm\{sup\}\},\\tau\_\{\\mathrm\{rel\}\},\\tau\_\{\\mathrm\{ret\}\}\)\. An event is*suppressed*ifp≤τsupp\\leq\\tau\_\{\\mathrm\{sup\}\}andr≥τrelr\\geq\\tau\_\{\\mathrm\{rel\}\},*retained*ifp≥τretp\\geq\\tau\_\{\\mathrm\{ret\}\}\(retain wins any overlap\), and*deferred*otherwise\. The harmful event is a true alarm assigned*suppress*; theunsafe\-suppression riskisPr⁡\(y=1∣suppress\)\\Pr\(y=1\\mid\\text\{suppress\}\)\. Retention takes precedence, so the suppressed set is\{p≤τsup,r≥τrel,p<τret\}\\\{p\\leq\\tau\_\{\\mathrm\{sup\}\},\\,r\\geq\\tau\_\{\\mathrm\{rel\}\},\\,p<\\tau\_\{\\mathrm\{ret\}\}\\\}, independent ofτret\\tau\_\{\\mathrm\{ret\}\}exactly whenτret\>τsup\\tau\_\{\\mathrm\{ret\}\}\>\\tau\_\{\\mathrm\{sup\}\}makes the overlap empty\. It holds in all 172 policies selected across the 216 pooled arm\-by\-budget\-by\-criterion\-by\-family cells, so the certified set is the deployed set there; we verify this rather than assume it\. Split runs record no thresholds, so we do not claim it for them\. The retain threshold is fixed afterwards as the largest value on a 91\-point grid retaining at least 95% of true alarms on the policy\-selection partition\. The predeclared suppression grid crosses 59 probability thresholds \(20 in\[0\.0005,0\.01\]\[0\.0005,0\.01\]and 40 in\[0\.01,0\.40\]\[0\.01,0\.40\], the shared 0\.01 endpoint counted once\) with 15 reliability thresholds in\[0\.20,0\.90\]\[0\.20,0\.90\]: 885 candidates\. We call this full two\-dimensional familyRC, for reliability\-conditioned\. The*probability\-only comparator*\(P\-only\) pinsτrel\\tau\_\{\\mathrm\{rel\}\}to 0 and is otherwise identical, isolating the contribution ofrr; its 59 candidates receive a correspondingly milder correction\.

### 4\.3Certification by Learn\-then\-Test

For budgetα\\alphaand confidence1−δ=0\.951\-\\delta=0\.95, each candidateλ\\lambdain the gridΛ\\Lambdais tested on the calibration sample: withnλn\_\{\\lambda\}suppressions andkλk\_\{\\lambda\}of them true alarms, the exact one\-sided Clopper–Pearson upper bound\([Clopper and Pearson, 1934](https://arxiv.org/html/2609.12365#bib.bib18)\)CP\+⁡\(kλ,nλ,δ/\|Λ\|\)\\CP^\{\+\}\(k\_\{\\lambda\},n\_\{\\lambda\};\\,\\delta/\|\\Lambda\|\)must satisfyCP\+≤α\\CP^\{\+\}\\leq\\alpha\. Among admitted candidates the one with most false\-alarm suppressions is selected; by Bonferroni\([Bonferroni, 1936](https://arxiv.org/html/2609.12365#bib.bib19)\)overΛ\\Lambdaits true risk is at mostα\\alphawith probability≥1−δ\\geq 1\-\\deltaunder i\.i\.d\. sampling\([Angelopoulos et al\., 2025](https://arxiv.org/html/2609.12365#bib.bib13)\)\. If no candidate is admitted the fold is*infeasible*and contributes a null \(suppress\-nothing\) policy to averages\. Throughout, a run is*certified*atα\\alphawhen this test admits a candidate: the term refers to the corrected bound being met on the calibration sample under the stated assumptions, not to the risk observed later on evaluation data\.

##### Why not fixed\-sequence testing\.

Suppression sets are nested inτsup\\tau\_\{\\mathrm\{sup\}\}, which invites the fixed\-sequence variant that walks thresholds in a predeclared order and stops at the first failure, spending no correction at all\. It would be valid under any predeclared order, but has no power here\. Even if the population conditional risk were non\-decreasing inτ\\tau, the Clopper–Pearson acceptance region is not, because the bound depends on the suppression\-set sizenτn\_\{\\tau\}as well as the unsafe countkτk\_\{\\tau\}: at smallτ\\tauthe set is tiny and the bound wide for want of data, not because risk is high\. The region is an*interval*interior to the ordering rather than a prefix, so an ascending walk halts at its first step in 15 of the 18 runs atα=0\.05\\alpha\{=\}0\.05, and for a reason that does not depend on the level at which the step is tested: the smallest threshold suppresses*zero*events, which forces a Clopper–Pearson upper bound of 1\.0 before risk is consulted at all \([L](https://arxiv.org/html/2609.12365#A12)\)\. We did not run the descending order at the uncorrected level, so we claim no result for it\. Bonferroni assumes no ordering and pays in level rather than reachability\.

##### Calibration mode\.

Learn\-then\-Test derives its guarantee from the sample it selects on, so we pool the policy\-selection and policy\-certification partitions into one calibration sample \(1,555 events, development; 1,661, official\)\. The “Cert\.” counts in tab:triage are therefore a feasibility record rather than an independent check\. We also run a held\-out variant \(splitcalibration\), selecting on one partition and bounding on the disjoint other; Learn\-then\-Test does not require this and splitting halves the calibration data, so that column is the stricter of the two rather than the correct one\.

##### Record clustering\.

The Clopper–Pearson step needs the suppressed outcomes to be independent Bernoulli draws\. Events from one record share patient, device, and acquisition conditions, and record\-disjoint partitions keep a record out of two roles without making the events inside one record independent, so that assumption does not hold exactly on VTaC\. We therefore compute a record\-clustered bootstrap \(2,000 record resamples\)\([Field and Welsh, 2007](https://arxiv.org/html/2609.12365#bib.bib21)\)and report it as a*sensitivity analysis*, not a second certificate\. Three limits are worth stating\. A percentile bootstrap is an approximate uncertainty assessment rather than an exact distribution\-free bound; 2,000 resamples cannot resolve a tail at the corrected level, sinceδ/885\\delta/885leaves 0\.11 expected draws in it; and when no suppressed alarm is genuine the resampled risk is identically zero, so its upper percentile is zero however few events were seen\. That it changes no admission decision is agreement between two procedures, not evidence of coverage\. A second, distinct bootstrap produces the benchmark intervals in tab:base;[C](https://arxiv.org/html/2609.12365#A3)defines both\. No patient identifier is released, so a patient\-level bound is not computable and record independence is itself an assumption\.

##### Sample\-limited versus model\-limited\.

For each budget we compute, from frozen evaluation predictions, the smallest calibration size admitting some grid cell at the corrected level in*every*run\. A budget looks*model\-limited*if observed risk there already exceeds it, and*sample\-limited*if the point estimate meets it but the bound does not\.

## 5Results

All values are read from one generated input artifact built from stored run outputs; fold spreads are descriptive SDs, since folds share one dataset\([Roberts et al\., 2017](https://arxiv.org/html/2609.12365#bib.bib22)\)\.

### 5\.1Base prediction

tab:base reports discrimination\. The supportable claim on the official split is parity with the best published baseline, not superiority: FCN\([Wang et al\., 2017](https://arxiv.org/html/2609.12365#bib.bib27)\)lies inside our 95% record\-clustered interval on AUROC, Score, and F1, and no per\-event predictions exist for a paired test\. Of the ten other published systems \(tab:basefull\), only CNN\+CL’s Score sits inside that interval, just above its lower edge; the other nine fall below it\. The seed SD is an order of magnitude smaller than the clustered interval and is not uncertainty about the estimate\.[C](https://arxiv.org/html/2609.12365#A3)adds calibration and operating\-point metrics\.

### 5\.2Certified triage

tab:triage gives the primary result\. We takeα=0\.05\\alpha=0\.05as the reference operating point: it is the tightest budget this calibration sample certifies, and the only one whose unconditional cost to true alarms is small\. The fourRCfailures there are infeasible folds, no grid cell admitted rather than a violated bound\. A 2% budget certifies in no development fold\-run and in one pooled official seed only, and the record\-clustered sensitivity analysis changes no admission\.

Two safety quantities must be read separately, and the distinction is why we headlineα=0\.05\\alpha=0\.05\. The conditional riskPr⁡\(y=1∣suppress\)\\Pr\(y\{=\}1\\mid\\text\{suppress\}\)is what is certified; the unconditional fraction of true alarms suppressed is what a clinician would ask about, and the two diverge sharply\. Atα=0\.05\\alpha=0\.05in the development arm 105 of the 4,323 pooled true alarms are silenced; atα=0\.10\\alpha=0\.10it is 690, because that policy suppresses 10,138 alarms in all\. A 10% conditional budget therefore carries a much larger unconditional cost even though it certifies everywhere; every claim here should be read atα=0\.05\\alpha=0\.05\.

The official split is best stated in counts: on its 482\-event test set theP\-onlypolicy suppresses 265, 259, and 256 alarms across the three seeds, of which 2, 3, and 1 were genuine VT out of the 137 present\. The worst seed silences three real arrhythmia alarms and 256 of 345 false ones\. That arm survives the held\-out check better, certifying two of three seeds against 6 of 15 development fold\-runs\.

### 5\.3Reliability gating does not help

At every certified budget in both arms,P\-onlycertifies in at least as many folds and suppresses at least as many false alarms asRC\(fig:frontier\)\. The 885\-candidate family pays a stricter level and is infeasible in four folds atα=0\.05\\alpha=0\.05againstP\-only’s one, but where both certify the selectedRCpolicies are no better either\. Atα=0\.10\\alpha=0\.10on the official split every selectedτsup\\tau\_\{\\mathrm\{sup\}\}sits at the top of the probability grid \(0\.39–0\.40\), so that frontier is grid\- rather than risk\-limited; atα=0\.05\\alpha=0\.05they lie between 0\.01 and 0\.08\.

The obvious rebuttal is that clean VTaC is the wrong place to look, since a reliability score can only help where evidence quality varies\. On three cohorts in which half the*records*carry a declared degradation \(pulsatile dropout, ECG burst artifact, baseline wander\),P\-onlymatches or exceedsRCin 17 of the 18 cohort\-by\-budget\-by\-mode cells\. Calibrating on clean data and evaluating on a degraded cohort,RCdoes attain lower realised risk \(0\.016 against 0\.035 under burst artifact atα=0\.05\\alpha=0\.05\), but at correspondingly lower suppression: it is more conservative, not better\.

The head is not inert, which is what makes this a null result rather than a bug: baseline wander lowersrrby 0\.317 while movingppby\+0\.003\+0\.003, and meanrrseparates availability strata that AUPRC does not \([E](https://arxiv.org/html/2609.12365#A5)\)\. Discrimination and reliability are different quantities, which is whyrris a plausible deferral signal and also why, whereppis already well separated, gating on it did not improve suppression in any comparison we ran \([A](https://arxiv.org/html/2609.12365#A1)\)\.

### 5\.4What Learn\-then\-Test buys

Is the correction unnecessary machinery? tab:proceduresfull says not\. Selecting the largest threshold whose*observed*calibration risk meets the budget admits a policy almost always and then exceeds that budget on held\-out data in two thirds of runs atα=0\.05\\alpha=0\.05; adding an exact bound but no multiplicity correction still overshoots in three of fourteen admitted runs\. Split conformal never overshoots atα≥0\.05\\alpha\\geq 0\.05but controls a different functional, the marginal fraction of genuine alarms falling in the suppression region rather than the conditional risk among suppressed ones\. Learn\-then\-Test is the only procedure whose realised risk stayed inside the advertised budget in every admitted run here, though these are observed test proportions and no calibration\-time bound promises them\. On the official split, with a stronger model and a larger calibration sample, all four stay inside the budget atα≥0\.02\\alpha\\geq 0\.02\.

Nor is the multiplicity price an artifact of Bonferroni’s crudeness\. Holm tests its first hypothesis againstδ/\|Λ\|\\delta/\|\\Lambda\|, exactly the Bonferroni threshold, so the two have identical any\-rejection feasibility; across 432 run\-cells Holm changes no verdict and gains at most 0\.87 percentage points of suppression \([I](https://arxiv.org/html/2609.12365#A9)\)\.

### 5\.5The grid is an expensive hyper\-parameter

TheRCresults above use one 885\-cell grid, declared once and never revisited, and fig:grid shows what that costs: under held\-out calibration atα=0\.05\\alpha=0\.05that grid certifies 1 of 15 fold\-runs at 3\.9% suppression while a 30\-cell grid certifies 7 at 21\.4%\. The correction is charged per candidate, so a grid fine enough to contain a better policy can be too fine to certify any policy at all\. tab:grid gives the ladder and[F](https://arxiv.org/html/2609.12365#A6)the full surface\.

Two structural facts stand out\. At matched candidate counts the one\-dimensional grids dominate:8×18\\times 1certifies 6 runs while3×33\\times 3certifies none, and30×130\\times 1beats12×312\\times 3,59×159\\times 1beats12×512\\times 5\. Spending candidates on the reliability axis buys nothing and costs multiplicity, as[5\.3](https://arxiv.org/html/2609.12365#S5.SS3)finds independently\. And no grid on the ladder certifiesα≤0\.02\\alpha\\leq 0\.02, including the 3\-candidate grid whose correction is nearly free: for this model and ladder, coarsening cannot rescue the tightest budgets, and tab:calreq projects what volume might\.

##### The effect replicates on the official split\.

The same ladder on the official\-split arm, a different model, pipeline, window and calibration sample, reproduces both facts: the 885\-cell grid certifies fewer seeds than a 12\-cell grid, non\-monotonically, and no two\-dimensional grid beats the best one\-dimensional grid of matched size \(tab:gridofficial\)\. The effect is confined to the marginal band: atα=0\.10\\alpha=0\.10every grid certifies every seed and atα≤0\.02\\alpha\\leq 0\.02none does, so grid size matters only where the budget is close to what the sample supports\.

#### 5\.5\.1Choosing the grid on the selection partition

Reading a winning row off tab:grid would select a hyper\-parameter on the evaluation set, so we fix a rule,Adaptive: score every grid by the false\-alarm suppression its best*admissible*candidate reaches on the selection partition, keep the highest\-scoring one, smaller on ties, then select and certify with it as before\. This spends no data selection was not already using, and the bound stays valid: an uncorrected test of one frozen policy on data the rule never read \([G](https://arxiv.org/html/2609.12365#A7)\)\. It certifies 8 of 15 development runs against 1 of 15 for the fixed 885\-cell grid, silencing 1\.4% of genuine alarms, and every official seed where that grid certifies two\. The chosen grids are one\-dimensional throughout, from 3 to 59 candidates; in the 7 runs where nothing certifies the rule falls back to the smallest\. Its margin over the best fixed one\-dimensional grid is one fold \(8/15 against 7/15\), so its value is not that it beats a well\-chosen grid but that it finds one without being told which to declare\.

##### What certification costs\.

tab:calreq projects the pattern from the frozen predictions: with 885 candidates,α=0\.10\\alpha=0\.10needs about 800 calibration events andα=0\.05\\alpha=0\.05about 4,000 before every run certifies, against the 1,555 available\. Development\-arm failures atα=0\.02\\alpha=0\.02look sample\-limited, the point\-estimate risk being below 2% while no binomial bound on 1,555 events certifies it against 885 hypotheses\. These are plug\-in projections conditional on the observed score distribution, not guarantees that a future sample of that size will certify; a grid should be no finer than the calibration sample can support\.

### 5\.6One subgroup pays for the marginal guarantee

The guarantee is marginal, and promises nothing about any subpopulation\. VTaC releases no manufacturer, site, or patient identifier, so the only subgroup axis it supports is which waveform channels were present; we stratify the evaluation partition by that mask, holding the certified policy fixed\.

tab:conditional reports the result\. The stratum without a usable pulsatile channel is 6% of evaluations, and in it the realised risk runs 2\.6 times the modality\-complete risk atα=0\.05\\alpha\{=\}0\.05\(16/213 against 180/6,133\) and 1\.7 times atα=0\.10\\alpha\{=\}0\.10\(53/453 against 684/9,777\)\. We report counts: the same events recur across seeds, so a test treating them as independent would overstate the evidence\. The budget is exceeded there in two of three seeds atα=0\.05\\alpha\{=\}0\.05and in all three atα=0\.10\\alpha\{=\}0\.10, while the marginal risk meets it every time; per\-seed intervals are wide \(\[0\.038,0\.181\]\[0\.038,0\.181\]for the worst seed atα=0\.05\\alpha\{=\}0\.05\) and the ratio exceeds one in all six seed\-by\-budget cells\. The direction repeats on the official split at counts too small to press: the 35 events lacking both pulsatile channels carry risk 0\.080 atα=0\.10\\alpha\{=\}0\.10against 0\.034 to 0\.038 elsewhere, and zero unsafe suppressions atα=0\.05\\alpha\{=\}0\.05\.

This is not a violated guarantee but the guarantee working as specified: a marginal bound does not imply subgroup bounds\. tab:conditional conditions on suppression, so it says that among silenced alarms a larger share was genuine in that stratum, not that a given true alarm there is likelier to be silenced; the latter needs all true alarms in the stratum as the denominator\. Certifying per stratum multiplies the hypothesis count and, on strata this small, cannot pay for itself; refusing to suppress there is cheap, but it is a policy decision rather than a statistical one\. It also sharpens[5\.3](https://arxiv.org/html/2609.12365#S5.SS3): the reliability head detects this exact stratum and still does not improve the frontier\.

## 6Discussion

##### The null result\.

We expected a score trained to detect incomplete or corrupted evidence to remove exactly those low\-ppevents whose low probability is untrustworthy\. It does not\. Three readings fit: the conditionsrrdetects are rare in VTaC;rrmay have learned the self\-generated interventions rather than the conditions under whichppis wrong; and the two\-dimensional grid is expensive under Bonferroni\. Separating them needs a naturally shifted cohort, or a target forrrtied to the error ofpp\.

##### Limitations\.

Development\-arm numbers are internal; only the official\-split arm is comparable to the literature, and it rests on three seeds\. Record\-disjoint is not patient\-disjoint, and the release excludes alarms whose label was uncertain or rejected\. The bound is marginal and assumes i\.i\.d\. events:[5\.6](https://arxiv.org/html/2609.12365#S5.SS6)shows one stratum exceeding it, and the clustered bootstrap probing that assumption is approximate, so the bound is conditional on it\. No external cohort was scored, fold SDs are descriptive, and the retain threshold carries no guarantee\. The grid finding is exploratory: the adaptive rule was devised after seeing the fixed grid certify poorly\. Stress interventions act on the preprocessed cache\. This is a retrospective research artifact:*defer*is a need\-for\-review category, not an alert, and nothing here is validated for bedside use\.

## 7Conclusion

Risk\-controlled three\-way triage turns a classifier score into a policy with a finite\-sample bound on the harmful endpoint, and puts a price on it: labelled alarms per budget, and candidates per grid\. The second surprised us\. The correction charges for every policy considered, so a grid fine enough to hold a good policy can be too fine to certify any: choosing it on the selection partition took certified folds from 1 of 15 to 8\. Treat\|Λ\|\|\\Lambda\|as a budgeted quantity\. On VTaC the bound holds at 5% in most development folds and every official seed, silencing 1\.5% of genuine alarms; reliability gating does not sharpen it\.

## References

- Aboukhalilet al\.\(2008\)A\. Aboukhalil, L\. Nielsen, M\. Saeed, R\. G\. Mark, and G\. D\. CliffordReducing false alarm rates for critical arrhythmias using the arterial blood pressure waveform\.Journal of Biomedical Informatics41\(3\),pp\. 442–451\.External Links:[Document](https://dx.doi.org/10.1016/j.jbi.2008.03.003)Cited by:[§2](https://arxiv.org/html/2609.12365#S2.SS0.SSS0.Px1.p1.1)\.
- Angelopouloset al\.\(2025\)A\. N\. Angelopoulos, S\. Bates, E\. J\. Candès, M\. I\. Jordan, and L\. LeiLearn then test: calibrating predictive algorithms to achieve risk control\.Annals of Applied Statistics19\(2\),pp\. 1641–1662\.External Links:[Document](https://dx.doi.org/10.1214/24-AOAS1998)Cited by:[item 1](https://arxiv.org/html/2609.12365#S1.I1.i1.p1.1),[§2](https://arxiv.org/html/2609.12365#S2.SS0.SSS0.Px2.p1.1),[§4\.3](https://arxiv.org/html/2609.12365#S4.SS3.p1.1)\.
- Angelopouloset al\.\(2024\)A\. N\. Angelopoulos, S\. Bates, A\. Fisch, L\. Lei, and T\. SchusterConformal risk control\.InInternational Conference on Learning Representations,Cited by:[§2](https://arxiv.org/html/2609.12365#S2.SS0.SSS0.Px2.p1.1)\.
- Angelopoulos and Bates \(2023\)A\. N\. Angelopoulos and S\. BatesConformal prediction: a gentle introduction\.Foundations and Trends in Machine Learning16\(4\),pp\. 494–591\.External Links:[Document](https://dx.doi.org/10.1561/2200000101)Cited by:[§2](https://arxiv.org/html/2609.12365#S2.SS0.SSS0.Px2.p1.1)\.
- Bateset al\.\(2021\)S\. Bates, A\. N\. Angelopoulos, L\. Lei, J\. Malik, and M\. I\. JordanDistribution\-free, risk\-controlling prediction sets\.Journal of the ACM68\(6\),pp\. 1–34\.External Links:[Document](https://dx.doi.org/10.1145/3478535)Cited by:[§2](https://arxiv.org/html/2609.12365#S2.SS0.SSS0.Px2.p1.1)\.
- Bonferroni \(1936\)C\. E\. BonferroniTeoria statistica delle classi e calcolo delle probabilità\.Pubblicazioni del R Istituto Superiore di Scienze Economiche e Commerciali di Firenze8,pp\. 3–62\.Cited by:[§4\.3](https://arxiv.org/html/2609.12365#S4.SS3.p1.1)\.
- Chow \(1970\)C\. K\. ChowOn optimum recognition error and reject tradeoff\.IEEE Transactions on Information Theory16\(1\),pp\. 41–46\.External Links:[Document](https://dx.doi.org/10.1109/TIT.1970.1054406)Cited by:[§2](https://arxiv.org/html/2609.12365#S2.SS0.SSS0.Px2.p1.1)\.
- Cliffordet al\.\(2016\)G\. D\. Clifford, I\. Silva, B\. Moody, Q\. Li, D\. Kella, A\. Chahin, T\. Kooistra, D\. Perry, and R\. G\. MarkFalse alarm reduction in critical care\.Physiological Measurement37\(8\),pp\. E5–E23\.External Links:[Document](https://dx.doi.org/10.1088/0967-3334/37/8/E5)Cited by:[§1](https://arxiv.org/html/2609.12365#S1.p1.1),[§2](https://arxiv.org/html/2609.12365#S2.SS0.SSS0.Px1.p1.1)\.
- Cliffordet al\.\(2015\)G\. D\. Clifford, I\. Silva, B\. Moody, Q\. Li, D\. Kella, A\. Shahin, T\. Kooistra, D\. Perry, and R\. G\. MarkThe PhysioNet/Computing in Cardiology Challenge 2015: reducing false arrhythmia alarms in the ICU\.InComputing in Cardiology,Vol\.42,pp\. 273–276\.Cited by:[§2](https://arxiv.org/html/2609.12365#S2.SS0.SSS0.Px1.p1.1)\.
- Clopper and Pearson \(1934\)C\. J\. Clopper and E\. S\. PearsonThe use of confidence or fiducial limits illustrated in the case of the binomial\.Biometrika26\(4\),pp\. 404–413\.External Links:[Document](https://dx.doi.org/10.1093/biomet/26.4.404)Cited by:[§4\.3](https://arxiv.org/html/2609.12365#S4.SS3.p1.1)\.
- Cvach \(2012\)M\. CvachMonitor alarm fatigue: an integrative review\.Biomedical Instrumentation & Technology46\(4\),pp\. 268–277\.External Links:[Document](https://dx.doi.org/10.2345/0899-8205-46.4.268)Cited by:[§1](https://arxiv.org/html/2609.12365#S1.p1.1)\.
- Drewet al\.\(2014\)B\. J\. Drew, P\. Harris, J\. K\. Zègre\-Hemsey, T\. Mammone, D\. Schindler, R\. Salas\-Boni, Y\. Bai, A\. Tinoco, Q\. Ding, and X\. HuInsights into the problem of alarm fatigue with physiologic monitor devices: a comprehensive observational study of consecutive intensive care unit patients\.PLoS ONE9\(10\),pp\. e110274\.External Links:[Document](https://dx.doi.org/10.1371/journal.pone.0110274)Cited by:[§1](https://arxiv.org/html/2609.12365#S1.p1.1)\.
- Efron \(1987\)B\. EfronBetter bootstrap confidence intervals\.Journal of the American Statistical Association82\(397\),pp\. 171–185\.External Links:[Document](https://dx.doi.org/10.1080/01621459.1987.10478410)Cited by:[Appendix C](https://arxiv.org/html/2609.12365#A3.p2.1)\.
- El\-Yaniv and Wiener \(2010\)R\. El\-Yaniv and Y\. WienerOn the foundations of noise\-free selective classification\.Journal of Machine Learning Research11,pp\. 1605–1641\.Cited by:[§2](https://arxiv.org/html/2609.12365#S2.SS0.SSS0.Px2.p1.1)\.
- Farzaneh and Simeone \(2026\)A\. Farzaneh and O\. SimeoneStatistically valid hyperparameter selection: from tuning to guarantees\.External Links:2606\.25601,[Document](https://dx.doi.org/10.48550/arXiv.2606.25601)Cited by:[§2](https://arxiv.org/html/2609.12365#S2.SS0.SSS0.Px2.p1.1)\.
- Field and Welsh \(2007\)C\. A\. Field and A\. H\. WelshBootstrapping clustered data\.Journal of the Royal Statistical Society: Series B69\(3\),pp\. 369–390\.External Links:[Document](https://dx.doi.org/10.1111/j.1467-9868.2007.00593.x)Cited by:[§4\.3](https://arxiv.org/html/2609.12365#S4.SS3.SSS0.Px3.p1.1)\.
- Geifman and El\-Yaniv \(2017\)Y\. Geifman and R\. El\-YanivSelective classification for deep neural networks\.InAdvances in Neural Information Processing Systems,Vol\.30,pp\. 4878–4887\.Cited by:[§2](https://arxiv.org/html/2609.12365#S2.SS0.SSS0.Px2.p1.1)\.
- Guoet al\.\(2025\)Z\. Guo, T\. Chen, and M\. FerrarioQualityFM: a multimodal physiological signal foundation model with self\-distillation for signal quality challenges in critically ill patients\.External Links:2509\.06516,[Document](https://dx.doi.org/10.48550/arXiv.2509.06516)Cited by:[§2](https://arxiv.org/html/2609.12365#S2.SS0.SSS0.Px1.p1.1)\.
- Lehmanet al\.\(2023\)L\. H\. Lehman, B\. Moody, H\. Deep, F\. Wu, H\. Saeed, L\. McCullum, D\. Perry, T\. Struja, Q\. Li, G\. D\. Clifford, and R\. G\. MarkVTaC: a benchmark dataset of ventricular tachycardia alarms from ICU monitors\.InAdvances in Neural Information Processing Systems, Datasets and Benchmarks Track,Vol\.36\.External Links:[Document](https://dx.doi.org/10.52202/075280-1686)Cited by:[Appendix D](https://arxiv.org/html/2609.12365#A4.p1.1),[§1](https://arxiv.org/html/2609.12365#S1.p1.1),[§2](https://arxiv.org/html/2609.12365#S2.SS0.SSS0.Px1.p1.1),[§3](https://arxiv.org/html/2609.12365#S3.SS0.SSS0.Px2.p1.1)\.
- Lehmanet al\.\(2024\)L\. H\. Lehman, B\. Moody, L\. McCullum, H\. Saeed, H\. Deep, D\. Perry, T\. Struja, Q\. Li, G\. D\. Clifford, and R\. G\. MarkVTaC: a benchmark dataset of ventricular tachycardia alarms from ICU monitors \(version 1\.0\)\.Note:PhysioNetExternal Links:[Document](https://dx.doi.org/10.13026/8td2-g363)Cited by:[§3](https://arxiv.org/html/2609.12365#S3.SS0.SSS0.Px1.p1.1)\.
- Liet al\.\(2008\)Q\. Li, R\. G\. Mark, and G\. D\. CliffordRobust heart rate estimation from multiple asynchronous noisy sources using signal quality indices and a Kalman filter\.Physiological Measurement29\(1\),pp\. 15–32\.External Links:[Document](https://dx.doi.org/10.1088/0967-3334/29/1/002)Cited by:[§2](https://arxiv.org/html/2609.12365#S2.SS0.SSS0.Px1.p1.1)\.
- Maet al\.\(2022\)M\. Ma, J\. Ren, L\. Zhao, D\. Testuggine, and X\. PengAre multimodal transformers robust to missing modality?\.InIEEE/CVF Conference on Computer Vision and Pattern Recognition,pp\. 18177–18186\.Cited by:[§2](https://arxiv.org/html/2609.12365#S2.SS0.SSS0.Px3.p1.1)\.
- Neverovaet al\.\(2016\)N\. Neverova, C\. Wolf, G\. Taylor, and F\. NeboutModDrop: adaptive multi\-modal gesture recognition\.IEEE Transactions on Pattern Analysis and Machine Intelligence38\(8\),pp\. 1692–1706\.External Links:[Document](https://dx.doi.org/10.1109/TPAMI.2015.2461544)Cited by:[§2](https://arxiv.org/html/2609.12365#S2.SS0.SSS0.Px3.p1.1)\.
- Nixonet al\.\(2019\)J\. Nixon, M\. W\. Dusenberry, L\. Zhang, G\. Jerfel, and D\. TranMeasuring calibration in deep learning\.InCVPR Workshops,pp\. 38–41\.Cited by:[Appendix C](https://arxiv.org/html/2609.12365#A3.SS0.SSS0.Px3.p1.1)\.
- Plesingeret al\.\(2016\)F\. Plesinger, P\. Klimes, J\. Halamek, and P\. JurakTaming of the monitors: reducing false alarms in intensive care units\.Physiological Measurement37\(8\),pp\. 1313–1325\.External Links:[Document](https://dx.doi.org/10.1088/0967-3334/37/8/1313)Cited by:[§2](https://arxiv.org/html/2609.12365#S2.SS0.SSS0.Px1.p1.1)\.
- Robertset al\.\(2017\)D\. R\. Roberts, V\. Bahn, S\. Ciuti, M\. S\. Boyce, J\. Elith, G\. Guillera\-Arroita, S\. Hauenstein, J\. J\. Lahoz\-Monfort, B\. Schröder, W\. Thuiller, D\. I\. Warton, B\. A\. Wintle, F\. Hartig, and C\. F\. DormannCross\-validation strategies for data with temporal, spatial, hierarchical, or phylogenetic structure\.Ecography40\(8\),pp\. 913–929\.External Links:[Document](https://dx.doi.org/10.1111/ecog.02881)Cited by:[§5](https://arxiv.org/html/2609.12365#S5.p1.1)\.
- Sendelbach and Funk \(2013\)S\. Sendelbach and M\. FunkAlarm fatigue: a patient safety concern\.AACN Advanced Critical Care24\(4\),pp\. 378–386\.External Links:[Document](https://dx.doi.org/10.4037/NCI.0b013e3182a903f9)Cited by:[§1](https://arxiv.org/html/2609.12365#S1.p1.1)\.
- Vovket al\.\(2005\)V\. Vovk, A\. Gammerman, and G\. ShaferAlgorithmic learning in a random world\.1st edition,Springer\.External Links:[Document](https://dx.doi.org/10.1007/b106715)Cited by:[§2](https://arxiv.org/html/2609.12365#S2.SS0.SSS0.Px2.p1.1)\.
- Wanget al\.\(2017\)Z\. Wang, W\. Yan, and T\. OatesTime series classification from scratch with deep neural networks: a strong baseline\.InInternational Joint Conference on Neural Networks,pp\. 1578–1585\.External Links:[Document](https://dx.doi.org/10.1109/IJCNN.2017.7966039)Cited by:[§5\.1](https://arxiv.org/html/2609.12365#S5.SS1.p1.1)\.
- Xuet al\.\(2025\)Y\. Xu, W\. Guo, and Z\. WeiSelective conformal risk control\.External Links:2512\.12844,[Document](https://dx.doi.org/10.48550/arXiv.2512.12844)Cited by:[§2](https://arxiv.org/html/2609.12365#S2.SS0.SSS0.Px2.p1.1)\.
- Zecchinet al\.\(2025\)M\. Zecchin, S\. Park, and O\. SimeoneAdaptive learn\-then\-test: statistically valid and efficient hyperparameter selection\.InProceedings of the 42nd International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.267,pp\. 74018–74036\.External Links:2409\.15844,[Document](https://dx.doi.org/10.48550/arXiv.2409.15844)Cited by:[item 2](https://arxiv.org/html/2609.12365#S1.I1.i2.p1.1),[§2](https://arxiv.org/html/2609.12365#S2.SS0.SSS0.Px2.p1.1)\.

## Appendix ACertified and Descriptive Frontiers

fig:frontier is the certified frontier of[5](https://arxiv.org/html/2609.12365#S5)at full size: false\-alarm suppression against realised risk on the evaluation partition for both policy families, with the budgets marked\.P\-onlymatches or exceedsRCat every certified budget, which is[5\.3](https://arxiv.org/html/2609.12365#S5.SS3)seen directly\.

tab:descriptive selects each policy on the observed risk of the calibration sample rather than on a corrected bound, so it is the frontier a practitioner would report if they skipped the correction entirely\. It is included to separate two explanations of the certified frontier’s shape: the model, or the selection rule\. Atα=0\.05\\alpha=0\.05they reach 82\.7% againstRC’s 37\.7% andP\-only’s 57\.3% in tab:triage, from the same frozen scores, which places the difference in the rule; atα=0\.10\\alpha=0\.10the gap narrows to a few points\.

## Appendix BArchitecture and Training Details

The trunk shared across slots is a two\-layer strided stem \(total stride 8\) followed by eight depthwise\-separable residual blocks, kernel 7, GroupNorm and SiLU, at widthd=512d=512, with blockbbtaking dilation2bmod62^\{b\\bmod 6\}\. Adaptive average pooling to⌊L/s⌋\\lfloor L/s\\rfloorpositions forms the tokens: 375 for the 60 s development window ats=40s=40, and 312 for the 10 s official window ats=8s=8\. Tokens carry a learned slot embedding, a per\-slot low\-rank adapter, and a sinusoidal position projection before fusion\.

Modality dropout drops each available slot with probability 0\.2, keeping at least one\. The three auxiliary losses carry weights 0\.25 \(masked cross\-modal reconstruction of a frozen\-teacher pooled embedding for dropped slots\), 0\.15 \(per\-slot identification of a declared intervention: clipping, baseline wander, noise burst, or zero\-padded shift, each applied to an available slot with probability 0\.15\), and 0\.50 \(the evidence\-quality target, regressed with BCE\)\. The model has 14\.83 M parameters in the development arm and 14\.89 M in the four\-channel official arm\. Training uses AdamW \(learning rate2×10−42\\times 10^\{\-4\}, weight decay 0\.05, three warmup epochs, cosine decay to 1%\), effective batch 32, gradient clipping at 1\.0, and at most 80 epochs with early stopping \(patience 12\) on checkpoint\-selection AUPRC\.

## Appendix CPartition and Protocol Details

Within each development outer fold the ten record\-disjoint parts are model training \(5\), checkpoint selection \(1\), policy selection \(2\), and policy certification \(2\)\. For fold 0 this gives 2,069 / 382 / 767 / 788 events with 1,031 held out for evaluation\.

Two distinct bootstraps appear in this paper\. The clustered sensitivity analysis of[4\.3](https://arxiv.org/html/2609.12365#S4.SS3)resamples records and takes the upper quantile of the resampled risk; it is not a second certificate\. The benchmark intervals in tab:base are BCa\([Efron, 1987](https://arxiv.org/html/2609.12365#bib.bib20)\), with the acceleration term from a jackknife over records and 20,000 record resamples; percentile intervals are computed alongside them and recorded in the same artifact, and no endpoint moves by more than 0\.006 on AUROC or 0\.7 on the Challenge Score\. Every comparison drawn in[5](https://arxiv.org/html/2609.12365#S5)holds under either variant\.

##### Development split\.

Protocol: outer stratified groupKK\-fold \(K=5K=5, group = waveform record\) with an inner record\-disjoint holdout; this is not nested cross\-validation, since the inner partition is performed once\. Fold\-0 record counts: training 893, checkpoint selection 181, policy selection 359, policy certification 368, evaluation 459\. Split file SHA\-256 prefix2afbc8ce; assignment SHA\-256 prefix813755fb\.

##### Official split\.

Protocol: official record\-level partition with record\-disjoint calibration cut from official train \(2,399 training / 819 selection / 842 certification events; validation 495 events, 141 true; test 482, 137 true\)\. The split artifact was audited event\-for\-event againstbenchmark\_data\_split\.csvand matches the published Table 3 composition\. Assignment SHA\-256 prefix485f0358\. Where the published protocol leaves a parameter unstated \(notch frequency, ECG high\-pass order, transition bands, choice of two ECG leads when a record carries more\), our choice is recorded as a named deviation in the preprocessing configuration\. The published protocol trains 10 seeds and reports the 5 best on validation; we train 3 and report all 3, so our seed spread is the more conservative\.

##### Calibration and operating point\.

In the development arm the base predictor has Brier score 0\.107 and adaptive \(equal\-mass, 15\-bin\) ECE 0\.084\([Nixon et al\., 2019](https://arxiv.org/html/2609.12365#bib.bib23)\)\. Separately, on the official test split, sensitivity is 0\.971 against specificity 0\.817 at the validation\-selected threshold \(mean 0\.115 across seeds\), which reflects the Challenge Score’s five\-fold penalty on missed true alarms\.

##### Challenge Score implementation\.

Reproduces the published rule\-based row exactly \(67\.32, F1 0\.655\) from its published TPR/TNR/PPV, which independently confirms both the score and the 482/137 test composition; AUROC and AUPRC agree with scikit\-learn to10−910^\{\-9\}on 400 randomized trials with heavily tied scores\.

##### Compute\.

Training ran on a single NVIDIA A100 \(40 GB\) with PyTorch 2\.11 and TF32 matmul; the architecture avoids global attention over raw samples so that it also runs on Apple\-silicon MPS for development\. Best checkpoints by selection\-partition AUPRC fell between epochs 7 and 31 in the development arm and 4 and 14 in the official arm\.

## Appendix DBenchmark Comparison in Full

tab:base carries only FCN, the strongest of the eleven systems[Lehman et al\. \(2023\)](https://arxiv.org/html/2609.12365#bib.bib1)report in the real\-time setting\. tab:basefull restores the other ten, with the published seed spreads, so the whole comparison can be checked\. FCN and CNN\+CL both lie inside our record\-clustered interval on every metric they report; FCN\+CL’s Challenge Score falls just below its lower edge, and the remaining eight fall well below\.

## Appendix EReliability Head Response to Declared Interventions

fig:stress is the full intervention sweep behind[5\.3](https://arxiv.org/html/2609.12365#S5.SS3), and tab:strata the same separation on availability as it occurs naturally in VTaC\.

## Appendix FGrid Surface

tab:grid shows nine of the ladder’s grids\. The ladder declares 28\(np,nr\)\(n\_\{p\},n\_\{r\}\)configurations, but the sweep artifact keys them by candidate count, so5×35\\times 3and20×320\\times 3were overwritten by3×53\\times 5and12×512\\times 5and 26 configurations are reported\. Each surviving row carries its own\(np,nr\)\(n\_\{p\},n\_\{r\}\)and we have checked that every one is labelled with the configuration that produced it, so nothing here is mis\-attributed; but5×35\\times 3and20×320\\times 3are absent, and a5×35\\times 3grid is a different policy family from a3×53\\times 5one\. Recovering them needs a re\-keyed sweep, which we did not run in time for this version\. The two properties below are therefore claims about the 26 configurations measured, not about all 28\. The ladder is a deterministic subsampling of the same probability and reliability grids used throughout, atnp∈\{3,5,8,12,20,30,59\}n\_\{p\}\\in\\\{3,5,8,12,20,30,59\\\}crossed withnr∈\{1,3,5,15\}n\_\{r\}\\in\\\{1,3,5,15\\\}, and the measured surface for every budget and both calibration modes is recorded in the sweep artifacts \(grid\_sweep\_\*\.json\), which we will release with the code\. Two properties hold across all 26 configurations measured\. Certified counts are not monotone in\|Λ\|\|\\Lambda\|, so a search that walks candidate counts upward and stops at the first failure will stop early\. And no grid, down to three candidates, certifiesα≤0\.02\\alpha\\leq 0\.02on the 767\-event selection partition\.

tab:gridofficial gives the corresponding surface for the official\-split arm atα=0\.05\\alpha=0\.05, the only budget at which grid choice changes any decision there\. Both properties recur on a different model and a disjoint sample: certification is non\-monotone in\|Λ\|\|\\Lambda\|, peaking at 12 candidates, and every two\-dimensional grid is matched or beaten by a one\-dimensional grid of comparable size\.

## Appendix GDoes the Grid Rule Read Held\-Out Data?

The adaptive rule of[5\.5\.1](https://arxiv.org/html/2609.12365#S5.SS5.SSS1)was introduced after we observed that the fixed 885\-cell grid certified poorly, so its independence from held\-out data should be demonstrated rather than asserted\. Applying it in the pooled setting would not be legitimate: the grid would be chosen on the same sample the bound is computed on, so the family actually searched is the union of the ladder\. That union is 944 distinct\(τsup,τrel\)\(\\tau\_\{\\mathrm\{sup\}\},\\tau\_\{\\mathrm\{rel\}\}\)pairs, the 885\-cell grid plus the 59 one\-dimensional cells atτrel=0\\tau\_\{\\mathrm\{rel\}\}\{=\}0, and the smaller correction would be invalid\. The pooled sweep artifact records 14/15 and 59\.6% suppression under that rule; we attach no guarantee to those figures and do not report them as results\. For the held\-out rule we recompute the chosen grid for all 15 fold\-runs atα=0\.05\\alpha=0\.05under three perturbations:

- •permuting the*evaluation*labels: every chosen grid is unchanged;
- •permuting the*certification*labels: every chosen grid is unchanged;
- •permuting the*selection*labels: the chosen grids change\.

The first two establish that no held\-out label enters the choice\. The third establishes that the rule is not inert, that is, that it responds to the data it does read \(7 of 15 chosen grids change under each of five selection\-label permutations; 7 of the remaining 8 are runs in which no grid admits any candidate, so the rule falls back to the smallest grid regardless; the eighth chooses the 3\-candidate grid on merit and the permutation leaves it there\)\. The check \(check\_grid\_rule\_leak\.py\) re\-implements the ladder and the rule with numpy and scipy only, without importing the sweep code it audits, asserts that its baseline grid choices equal those recorded in the sweep artifact, and reruns in minutes from the frozen scores; its output is recorded alongside the sweep\. Under pooled calibration the certification perturbation is vacuous because that partition is the selection sample, which is why the rule is reported only undersplitcalibration\.

## Appendix HCalibration Volume Required

tab:calreq is the volume requirement behind[5\.5](https://arxiv.org/html/2609.12365#S5.SS5): for each budget and candidate count, the smallest calibration sample at which some grid cell is admitted at the corrected level in*every*fold\-run\. It is what turns an uncertifiable budget into a design parameter rather than a dead end, since it says how much more labelled data would be needed to reach it, and distinguishes budgets no sample size can reach\.

## Appendix IStep\-Down Correction and the Confidence Level

[5\.4](https://arxiv.org/html/2609.12365#S5.SS4)reports that Holm’s step\-down procedure changes no feasibility verdict\. It is not that Holm is equivalent: across the 432 run\-cells it widens the admissible set in 108 and moves the selected policy in 51\. The widening simply never reaches a policy that is materially better, the largest gain being 0\.87 percentage points of mean false\-alarm suppression\. Hochberg’s procedure is sharper still, but requires a positive\-dependence condition we have not established for this family, so we do not rely on it\.

The confidence level is the lever that does move, and it moves modestly\. Lowering the family\-wise confidence from 95% to 90% buys one to two fold\-runs in five of the twenty\-four arm\-by\-budget cells, concentrated exactly where certification is marginal: the held\-out development arm atα=0\.05\\alpha\{=\}0\.05gains 2 of 15 forRCand 1 of 15 forP\-only, and the held\-out official arm gains its third seed\. That is a trade against the strength of the claim rather than a free improvement, and it does not change the ranking of grids in[5\.5](https://arxiv.org/html/2609.12365#S5.SS5)\.

Both comparisons are produced bycompare\_multiplicity\_corrections\.py, which rebuilds the grid, the exact bound, and the selection rule from numpy and scipy alone without importing the pipeline it audits, and which asserts that its Bonferroni feasibility verdicts reproduce those recorded in the certification artifacts: 216 cells, all matching\.

## Appendix JSelection Procedures at Every Budget

[5\.4](https://arxiv.org/html/2609.12365#S5.SS4)compares Learn\-then\-Test against three simpler selection procedures atα=0\.05\\alpha=0\.05\. tab:proceduresfull gives all three budgets\. Atα=0\.05\\alpha=0\.05the suppression column runs in the expected order, the naive threshold suppressing most and Learn\-then\-Test least, but that ordering does not hold at the other budgets: atα=0\.02\\alpha=0\.02split conformal suppresses more than the naive threshold, and atα=0\.10\\alpha=0\.10Learn\-then\-Test suppresses more than split conformal\. Split conformal controls a different functional in both cases, so neither reversal is a comparison of like with like\. What does change monotonically with the budget is how often the other three exceed the risk they advertise\.

## Appendix KRealised Risk by Modality Stratum

tab:conditional is the per\-seed detail behind[5\.6](https://arxiv.org/html/2609.12365#S5.SS6), which reports the contrast pooled over seeds\. The stratum without a usable pulsatile channel is small enough that a single seed could otherwise be suspected of carrying the effect, so each is shown separately; the direction is the same in all six seed\-by\-budget cells\.

## Appendix LWhere the Admissible Set Sits

[4\.3](https://arxiv.org/html/2609.12365#S4.SS3)declines fixed\-sequence testing on the grounds that it has no power on this family, not that it is invalid\. tab:fixedseq is the measurement behind that claim: for each of the 18 runs across both arms, the first and last accepted index on the 59\-level probability grid atα=0\.05\\alpha\{=\}0\.05, pooled calibration, Bonferroni\-corrected\.

RunFirstLastnnat firstnnat floordev outer0 seed27185191940dev outer0 seed3175192120dev outer0 seed91115221680dev outer1 seed271820225470dev outer1 seed31714201430dev outer1 seed91120203030dev outer2 seed271815203380dev outer2 seed317456090dev outer2 seed911132330dev outer3 seed2718445350dev outer3 seed31700915915dev outer3 seed911464620dev outer4 seed27181737132dev outer4 seed317none accepted–980dev outer4 seed9115212680official seed27184202130official seed31720235780official seed91120263810These regions are computed at the corrected levelδ/59\\delta/59, so they bound what a*corrected*walk can reach; a fixed\-sequence procedure would test each hypothesis it reaches atδ\\delta, and a threshold rejected here could be accepted there\. Only the low\-end result transfers, because it does not depend on the level at all: 15 of the 18 runs suppress*zero*events at the smallest threshold, which forces a Clopper–Pearson upper bound of 1\.0 by construction, before risk is consulted and whatever the level\. An ascending walk therefore stops at its first step in those 15 runs under any correction\. The descending order, and the three non\-empty ascending endpoints, would need directδ\\delta\-level tests we did not run\.

At the corrected level the accepted set is contiguous in all 17 runs where it is non\-empty, it begins at the smallest threshold in only 1 of those 17, and it reaches the largest in none\. An earlier implementation of this work under the ascending fixed\-sequence rule accordingly certified 0 of 45 fold–budget combinations\. The one run that begins at index 0 is also the one whose smallest threshold already suppresses 915 events, which is the exception that states the rule: an ascending walk can only take a second step when the grid floor is coarse enough to have accumulated a usable sample\. Declaring a coarser grid is exactly the remedy[5\.5](https://arxiv.org/html/2609.12365#S5.SS5)arrives at from the other direction, and the two observations are the same fact seen twice\.

## Appendix MCorrection Record

A pre\-submission audit of an earlier draft found: \(i\) three of four figures contained values not traceable to any stored artifact, including a scatter generated from a Beta distribution and an availability\-stratum ordering that was inverted relative to the real values; \(ii\) a “safety guarantee” sentence hard\-coded in a report template that the run log contradicted; \(iii\) selection on the observed risk followed by certification on the upper bound, which does not control risk; \(iv\) a model trained on 20% of the data because of the inner partition allocation; \(v\) the certification script re\-deriving the split at runtime rather than loading the committed artifact; \(vi\) a deferral rate that was a grid\-ordering artifact; \(vii\) a comparator with a different grid and no deferral mechanism; \(viii\) a fixed\-sequence Learn\-then\-Test rule that admitted nothing \([4\.3](https://arxiv.org/html/2609.12365#S4.SS3)\); and \(ix\) an “external validation” script that scored no external data\. All are corrected in the code we will release\. Reporting code now reads only from the generated input artifact and raises on a missing value rather than substituting a placeholder; withdrawn artifacts are retained in a quarantined directory and are not cited here\. A later audit of the compiled PDF found a tenth: a corrected table body written into the wrong float, so one appendix table printed grid\-sweep rows under a policy caption while the grid table kept superseded values\. Both are regenerated here, and the verification script now parses the rendered table bodies back out of the source rather than only checking that each artifact matches a literal\. Known and unaddressed: the engineered\-feature comparator receives unstandardized descriptors, and absolute\-amplitude features could act as a device shortcut; both belong to comparators not reported in this paper\.