Lion Cipher Lab
Give an alert classifier a coverage guarantee with conformal prediction, then break it with drift
- AI Security
- Advanced
- ~90 min
- Free · no account required
Why it matters
An alert-triage classifier that says 'benign, 0.91' gives you one guess and a number you have to trust. Conformal prediction gives you something you can sign: a SET of labels per alert, built so that the true label is inside it at least 90% of the time (or 95%, or 98% - you choose), with no assumption about what the data looks like beyond one: tomorrow's alerts are drawn the same way as the ones you calibrated on. That makes the output operational. A set with one label can be automated; a set with two or three is the model saying 'I cannot tell these apart' and goes to an analyst, so the…
What you'll learn
- implementing split conformal prediction by hand in numpy: a calibration split, the nonconformity score 1 - p(true class), and the finite-sample quantile at level ceil((n+1)(1-alpha))/n
- turning a classifier's probabilities into prediction SETS and measuring empirical coverage against the 1 - alpha target at alpha 0.20, 0.10, 0.05 and 0.02
- cross-checking the hand-written quantile against numpy's method='inverted_cdf', and knowing why method='higher' is one order statistic more conservative
- reading the guarantee correctly: it is an average over calibration draws, so 49% of 500 re-splits landed below 0.90 and that is not a bug
- pricing set size as analyst workload: at alpha 0.10, 1,301 of 5,000 alerts (26%) had a set that was not a single label and went to a human
- seeing that marginal coverage hides the class you care about (malicious 0.8658 under a 0.90 target) and fixing it with class-conditional (Mondrian) conformal, at a measured cost in set size
- breaking exchangeability on purpose with a mix shift and a new attack variant, and measuring the collapse: malicious coverage 0.4486, 181 of 749 malicious alerts auto-closed as benign
- building a coverage monitor with a binomial alarm floor, and recalibrating on a recent labelled window - and knowing what recalibration cannot fix
Steps in this lab
- The words first: conformal prediction, prediction sets, coverage, alpha, and the one assumption
- Recap of the abstention gate, and why a set is a different tool
- Open a terminal, make a scratch folder, install two packages
- Build a synthetic triage queue and a classifier to put sets on
- Split conformal by hand: the score, the finite-sample quantile, the sets
- Is the 0.9098 luck? Re-split 500 times and read what the guarantee actually says
- Set size is analyst workload: route every alert from its set
- Marginal coverage hides the malicious class: class-conditional (Mondrian) conformal
- Break it: a campaign week and a new attack variant (the honest negative)
- Contain it: a coverage monitor, then recalibrate on recent labelled alerts
- The judgment: when a coverage guarantee is worth it, when it is not, and how a pro does it