Stress tests, and what they license

There is nothing clever in the machinery. A stress test is a second evaluation set, built so that one named thing about the world is different, and scored with the same metric on the same trained model. No retraining, no new features, no change to the model at all. At Thornbury the named thing is the ward arrangement, and the difference between the held-out set and the shifted set is a single argument in the generator moving from 0.90 to 0.50.

What makes it hard is not the code, it is the argument for why that shift and not another. Anyone can perturb a column and produce a drop. A drop only means something if the perturbation corresponds to a change the world can actually make, which is why the design rules in Part 2 are about justification rather than about method.

• Stress test. Scoring a trained model on data built so one named aspect of the world differs from the collection conditions.
• Named shift. A change you can describe in a sentence about the world, with a mechanism, before you write the code that produces it.
• Input shift. The relationship between the features and the outcome changes. The outcome itself is still generated the same way.
• Label shift. The outcome changes. A drop measured after moving labels is not a fact about the model.
• The licensed claim. The one sentence a passed stress test supports, which always names the shift it was run under.
• The unenumerable remainder. Every shift you did not think of. It does not shrink when you pass the ones you did.

Licensed: "scored on patients from a year in which the ward no longer agrees with the outcome, this model falls from 0.949 to 0.765, and its measured reliance on the ward is the figure printed beside it." Every clause names something that was done. A reader can disagree with the design of the shift, and that disagreement is productive because the design is on the page.

Not licensed: "the model is robust to distribution shift." That sentence is about a category, and the test was about one member of it. It is also the sentence that gets written, because it is shorter and because the robustness section of a document is usually read as a verdict rather than as a list of what was tried.

D'Amour et al. (2020) is a forty-author paper, and the author list is doing work. Their stress tests span computer vision, medical imaging, natural language processing, clinical risk prediction from electronic health records, and medical genomics. Different data types, different teams, different pipelines, and the same finding: many predictors with equally strong held-out performance, behaving differently once they were scored somewhere else.

That breadth is the answer to the most common deflection, which is that the effect is an artefact of one field's data or one team's habits. Thornbury is a small simulation built to make the mechanism visible and checkable. The evidence that the mechanism is general is theirs, not this bench's.

Corrupting labels in the stress set produces a drop reliably, which is what makes it tempting. It measures nothing about the model. Flip one outcome in five and a perfect model is now scored wrong on one row in five, because the thing predictions are compared against has been made wrong. Every model in the pool loses ground together, and the number that comes out is a property of the corruption.

The Thornbury shift keeps the outcome mechanism untouched and moves an input's relationship to it. A patient with a given vitals drift and lab trend deteriorates with exactly the same probability in the deployment year as in the collection year. What changed is which ward that patient is in, which is a fact about hospital administration and not about physiology. A model that never used the ward scores the same in both worlds, and that is the property the test is built to expose.

The rules above take one side of a live argument, and the other side is not foolish. The named-shift position says a perturbation with no mechanism behind it produces a number nobody can act on: if you cannot say what in the world would do that to your data, a drop tells you nothing about deployment and an absence of a drop tells you less.

The battery position says that the shifts which break models are, almost by definition, the ones nobody anticipated, so restricting yourself to shifts you can justify guarantees you only ever test the failures you already feared. On this view a wide sweep of arbitrary perturbations is a detector for underspecification rather than a forecast of deployment, and a pipeline whose outputs scatter under nonsense perturbations is telling you something real even though the perturbations are not.

Both positions are held by people who have shipped models that failed. They disagree about what the number is for: evidence about a deployment, or evidence about a pipeline. The practical reconciliation, which neither camp fully accepts, is that they are different measurements and should be reported under different headings rather than averaged into a robustness score.

Thornbury can regenerate its deployment year because the world is a function. Real projects usually cannot, and the substitutes are ordinary: hold out a later time period rather than a random slice, hold out one site or region entirely, score on the subgroup whose intake process changed last year, or use data collected before and after a known policy change as two worlds.

Each of those is a named shift with a mechanism, which is the only property that matters. A held-out year is a stress test if you say what you expect to have changed in it, and it is just another random split if you do not. Generalisation of an experiment to a new population is a different subject and belongs to learn-experimentation-with-phoebe; the question here is a fitted model scored somewhere else.