Shadow Mode and Canary Enforcement¶
Staged rollout — instantiates Self-Targeting Defense Guardrail
Runs a new or changed defense in observe-only shadow, then on a small canary slice, measuring would-be self-engagements before it is trusted to act at full scale.
The most expensive way to learn a defense misfires on protected self is to deploy it and watch it happen. Shadow Mode and Canary Enforcement buys that knowledge cheaply and in advance: a new or retrained classifier first runs in shadow — scoring live traffic and logging what it would have done, while a trusted incumbent (or nothing) actually acts — and only after its would-be false self-engagements are measured and acceptable does it graduate to canary, enforcing for real on a small, bounded slice before any fleet-wide rollout. Its defining move is to separate evaluation of the enforcer from its authority to act, so the rate at which it would wrongly harm self is known before it can. It is a deployment-lifecycle mechanism about pre-production measurement and staged trust; it does not run continuously against a live harm budget, and it does not itself tally or cap production false positives once fully deployed.
Example¶
An advertising platform retrains the classifier that suspends accounts for policy violations, aiming to catch a new scam pattern. Suspending a legitimate advertiser cuts off their revenue — a serious self-engagement. Rather than ship it, the team runs the new model in shadow for two weeks: it scores every account and logs each suspension it would have issued, while the current model stays in charge. Comparing the shadow log against known-good advertisers surfaces that the retrained model would have wrongly suspended a cluster of legitimate small businesses whose ad copy resembled the scam's. They also probe it adversarially, replaying known evasion attempts to see whether the new model's gains hold against spoofing. Only after tuning does it move to canary — enforcing on ~1% of accounts with tight monitoring — before any full rollout.
Setup to outcome: a wave of wrongful suspensions is caught in a log instead of in production. The distinction that matters is that the classifier's would-be harm was measured while it had no authority to act.
How it works¶
- Score without acting. In shadow, the candidate defense processes real inputs and records its intended actions, but a separate incumbent holds actuator authority — evaluation is fully decoupled from harm.
- Measure would-be self-engagements. The shadow log is compared against known-legitimate populations to estimate the false self-engagement rate before anyone is harmed, surfacing the classifier's uncertainty and error profile.
- Probe against evasion. The candidate is replayed against known spoofing and evasion attempts, so its behavior under adversarial pressure is characterized before it earns authority.
- Graduate on a canary. Only after shadow metrics pass does the defense enforce for real on a small, monitored slice, expanding only as the canary's real-world false-engagement rate stays within bounds.
Tuning parameters¶
- Shadow duration — how long the candidate observes before any enforcement. Longer shadows accumulate rarer error cases but delay protection and let the candidate's insight go stale against a drifting threat.
- Canary slice size — what fraction enforces first. Smaller slices cap exposure if the candidate is wrong but gather evidence slowly; larger slices decide faster at more risk.
- Promotion criteria — the measured false-self-engagement rate that gates each expansion. Strict criteria block harmful rollouts but can stall a genuinely better model; loose criteria ship fast and risk autoimmune surprises.
- Adversarial replay coverage — how broad the evasion test set is. Broader coverage catches more spoofing regressions but costs curation and can never be exhaustive.
When it helps, and when it misleads¶
Its strength is that it converts a blind deployment into a measured one, catching the autoimmune failure while it is still just a log entry. Running the enforcer as a champion-challenger[n1] against the incumbent is what makes the comparison honest: the candidate must demonstrably do less wrongful self-harm before it inherits authority, and the canary bounds the damage of anything the shadow missed.
Its failure mode is that shadow and canary only reveal what the observation window contains. A rare-but-catastrophic self-engagement pattern that never appears in the shadow traffic — or a distribution shift after promotion — passes every gate and then fires at full scale; shadow measures the past, not the future. The classic misuse is treating a clean shadow run as a guarantee rather than a bounded estimate, promoting to full enforcement and dismantling the monitoring that would catch the case the shadow missed. The guarding discipline is to keep canary monitoring live well past promotion and to treat the shadow's error estimate as a floor on risk, not a certificate of safety.
How it implements the components¶
threat_classifier_with_uncertainty_state— shadow running exists to characterize the candidate classifier's error profile and confidence calibration before it acts, exposing its uncertainty on real traffic.adversarial_spoofing_and_evasion_model— adversarial replay probes how the candidate behaves under known spoofing and evasion, testing its robustness before it earns authority.
It does not track and cap actual false self-engagements against a running allowance in production — that live harm_budget_for_false_positives accounting belongs to False-Positive Harm Budget Dashboard; shadow-and-canary decides whether a defense may go live, the dashboard governs one that already is.
Related¶
- Instantiates: Self-Targeting Defense Guardrail — supplies the pre-deployment, staged-trust evaluation that measures a defense's self-harm before it acts.
- Sibling mechanisms: Appeal and Rapid Restoration Workflow · Engagement Kill Switch · False-Positive Harm Budget Dashboard · Graduated Response Matrix · Post-Incident Autoimmune Review · Protected-Self Allowlist with Expiry · Quarantine-Before-Destroy Rule · Self-Status Cross-Check · Two-Key High-Harm Engagement
Editorial Notes¶
Form Classification¶
Form family: Experiment, Test & Rehearsal
Rationale: Shadow Mode and Canary Enforcement operates as an active test, trial, simulation, drill, or rehearsal that generates evidence through a deliberate attempt or perturbation because it runs a new or changed defense in observe-only shadow, then on a small canary slice, measuring would-be self-engagements before it is trusted to act at full scale.
Independent corroboration: The frozen evidence defines Shadow Mode and Canary Enforcement as 'Runs a new or changed defense in observe-only shadow, then on a small canary slice, measuring would-be self-engagements before it is trusted to act at full scale', so its operative form is Experiment, Test & Rehearsal.
Nearest alternative: Assessment, Review & Assurance — Shadow Mode and Canary Enforcement includes features of a bounded evaluation of existing evidence or work that produces a finding or disposition, but its defining operation is an active test, trial, simulation, drill, or rehearsal that generates evidence through a deliberate attempt or perturbation.
Review outcome: Independent reviewer agreement; medium confidence.
Origin Attribution¶
Primary origin: Security Studies & Intelligence Analysis
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Specialized
Rationale: Observe-only detection followed by limited enforcement and measurement of self-engagement is staged security-control deployment.
Related originating lineages:
- Computer Science & Software Engineering — Shadow mode and canary rollout are established software release patterns.
- Engineering & Design — Progressive commissioning limits the consequence of an incorrectly tuned protective system.
- Statistics & Experimental Design — A small controlled slice estimates false-positive and harm rates before scale.
Review resolution: The blind reviewers agree that security_intelligence is the primary origin and differ only on alternate origin disagreement, origin mode disagreement, encyclopedia synthesis disagreement. I preserve every independently explained alternate from both records rather than imposing a numeric cap. I retain cross_disciplinary_synthesis because the combined record shows material contributions from several lineages. The broader reach of specialized records portability separately from historical provenance, and encyclopedia_synthesis=true preserves the affirmative synthesis judgment where either reviewer identified one.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
[n1] Champion-challenger testing runs a candidate model (the challenger) alongside the deployed one (the champion) on the same live inputs, promoting the challenger only if it measurably outperforms. It is the standard way to compare a new decision system against the incumbent without granting it authority prematurely — the pattern shadow mode applies to defensive enforcers. ↩