Model monitoring and drift

Data drift (covariate shift) is a change in the distribution of the input features P(X) while the relationship P(Y|X) stays fixed. Concept drift is a change in the underlying relationship P(Y|X) itself, meaning the same inputs now map to different outputs. Concept drift directly degrades predictive accuracy, whereas data drift may or may not, depending on whether the new inputs fall in regions the model learned well.

PSI compares the binned distribution of a variable between a baseline and a current window, summing (current% - base%) * ln(current% / base%) across bins. It is symmetric, easy to compute, and has well-known interpretation thresholds (commonly <0.1 stable, 0.1-0.25 moderate shift, >0.25 significant shift). Its simplicity and threshold conventions make it a standard for credit-scoring and tabular ML monitoring.

def psi(base, cur, bins=10):
    import numpy as np
    edges = np.percentile(base, np.linspace(0,100,bins+1))
    edges[0], edges[-1] = -np.inf, np.inf
    b = np.histogram(base, edges)[0]/len(base)
    c = np.histogram(cur, edges)[0]/len(cur)
    b, c = np.clip(b,1e-6,None), np.clip(c,1e-6,None)
    return np.sum((c-b)*np.log(c/b))

Training-serving skew is a discrepancy between how features are computed during training versus at inference, causing the model to see different inputs than it was trained on. Common causes include different code paths for offline vs online feature computation, time-travel/leakage in training, stale feature values in serving, and inconsistent preprocessing. It is best mitigated with a shared feature pipeline or feature store that guarantees identical transformations.

The two-sample KS test computes the maximum absolute difference (the D statistic) between the empirical CDFs of the baseline and current samples, then yields a p-value for the null hypothesis that both samples come from the same distribution. A small p-value (or large D) indicates the feature distribution has drifted. It is non-parametric and works for any continuous distribution but is sensitive to large sample sizes, where tiny differences become 'significant'.

As sample size grows, the statistical power of these tests increases so much that even practically negligible distribution differences yield very small p-values, producing false alarms. Statistical significance does not imply business-relevant drift. Practitioners therefore pair p-values with effect-size metrics (e.g., KS D statistic, Wasserstein distance, PSI) and threshold on magnitude rather than significance alone.

Ground-truth lag is the delay between making a prediction and observing the actual outcome (e.g., loan default after months), which prevents timely direct accuracy monitoring. Teams cope by monitoring leading proxy signals: input data drift, prediction/score distribution drift, and data-quality metrics, which are available immediately. When labels eventually arrive, delayed performance metrics backfill the picture and validate the proxy alerts.

Prediction drift is a change in the distribution of the model's output scores or predicted classes over time. It is valuable because it is computable immediately (no labels needed) and aggregates the combined effect of all input drifts through the model. A shift in predictions without a corresponding business-justified cause is an early warning that something upstream changed or that the model's behavior is degrading.

Covariate shift: P(X) changes but P(Y|X) is stable. Label shift (prior probability shift): P(Y) changes but P(X|Y) is stable, common in spam or fraud where base rates move. Concept shift: P(Y|X) changes, the actual decision boundary moves. Each requires different handling: covariate shift may use importance weighting, label shift uses prior correction, and concept shift typically requires retraining.

ADWIN maintains a variable-length window of recent values and repeatedly checks whether two sub-windows have significantly different means using a Hoeffding-based bound. When a significant difference is found, it drops the older sub-window, effectively shrinking the window to retain only recent, statistically homogeneous data. The window size thus grows during stable periods and shrinks when drift occurs, signaling change.

DDM monitors the model's online error rate, treating predictions as a Bernoulli process. It tracks the running error probability p and its standard deviation s, recording the minimum of p+s. A warning is raised when p+s exceeds p_min + 2*s_min and drift is declared when it exceeds p_min + 3*s_min, signaling that the error rate has risen significantly beyond its best observed level. DDM assumes labels are available promptly.

KL divergence is asymmetric and unbounded, becoming infinite when the current distribution has support where the baseline has zero probability, which is fragile for empirical bins. Jensen-Shannon divergence is a symmetrized, smoothed version (average KL to the mixture) that is bounded in [0, ln2] nats (or [0,1] in bits) and always finite. JSD is therefore often preferred as a stable, comparable drift score.

Univariate tests ignore correlations and joint structure, so they miss multivariate drift where individual marginals look stable but their relationships change, and they suffer multiple-testing explosion across hundreds of dimensions. Better approaches operate on the joint distribution: maximum mean discrepancy (MMD), a domain classifier (classifier two-sample test), or distances over reduced representations (PCA/UMAP) or cluster occupancy of embeddings.

You label baseline samples as class 0 and current samples as class 1, train a classifier to distinguish them, and evaluate its held-out discrimination (e.g., AUC). If the classifier cannot separate them (AUC ~ 0.5), the distributions are similar; an AUC significantly above 0.5 indicates drift, and feature importances reveal which features drifted. It naturally handles high-dimensional, correlated, mixed-type data.

Offline accuracy measures point predictions against historical labels, but the deployed model affects user behavior, downstream decisions, and feedback loops that aggregate accuracy cannot capture; segment-level decay, calibration drift, or shifts in the costly tail can hurt KPIs while average accuracy is unchanged. This implies monitoring must include calibration, per-segment metrics, and direct business-outcome tracking, not just a single global score.

Calibration drift occurs when predicted probabilities no longer match observed frequencies (e.g., scores of 0.8 stop corresponding to an 80% positive rate). Without labels you cannot directly measure it, but you can track the distribution of predicted probabilities and the average predicted probability versus the historical/expected base rate as a proxy. Once labels arrive, reliability diagrams, Expected Calibration Error (ECE), and Brier score quantify it directly.

The Page-Hinkley test is a sequential change-detection method that accumulates the deviation of observed values from their running mean and tracks the cumulative sum's minimum; drift is flagged when the gap between the current cumulative sum and its minimum exceeds a threshold lambda (with a magnitude tolerance delta). It is commonly applied to a streaming error signal or a monitored metric to catch a sustained shift in mean quickly with low memory.

The 1-Wasserstein distance is the minimum 'cost' to transform one distribution into another, equal for 1D to the integral of the absolute difference between their CDFs. Unlike KL/PSI it is a true metric that accounts for how far probability mass moves, so it degrades gracefully and remains meaningful even when distributions have little overlap or when binning is awkward. It is well-suited to continuous features and gives an interpretable magnitude in the feature's units.

Data-quality issues are defects in the pipeline such as nulls, schema changes, broken joins, unit changes, or duplicated/missing records, often producing abrupt, implausible values. Genuine data drift is a real change in the underlying population the data represents. They require different responses: data-quality problems are fixed in engineering, while drift may require model retraining; conflating them leads to needless retraining or missed pipeline bugs.

A feedback loop arises when the model's own predictions influence future inputs or labels, for example a recommender shaping what users see and thus what they click. This biases observed data and labels toward the model's prior behavior, making drift metrics and online accuracy look artificially stable or misleadingly confirm the model. Mitigations include logging propensities, holding out randomized exploration traffic, and using inverse-propensity weighting for unbiased evaluation.

Trigger-based retraining fires when monitored signals (performance drop, significant drift, calibration loss) breach thresholds, making it responsive and cost-efficient when changes are sporadic. Scheduled retraining (e.g., weekly) is simpler, predictable, and good when data evolves steadily or labels arrive in regular batches. Mature systems combine both: a baseline schedule plus emergency trigger-based retrains, always gated by validation to avoid retraining on bad data.

Recent data may be contaminated by a data-quality bug, a transient anomaly, or a feedback loop, and it may carry few labels or biased labels; retraining on it can bake in noise or chase a temporary blip. It can also cause catastrophic forgetting of still-relevant older patterns. Retraining should be gated by data validation, sufficient label volume, and offline/champion-challenger evaluation before promotion.

The champion is the model serving live decisions; one or more challengers run in shadow on the same traffic, producing predictions that are logged but not acted upon. This lets you compare a retrained or new model against production on identical real inputs without user risk, validating drift-response retrains before promotion. A challenger is promoted only when it demonstrably outperforms the champion on the relevant metrics.

Rely on unsupervised proxies: input feature drift, prediction/score distribution drift, alert/flag rate stability, and data-quality metrics, plus periodic human-in-the-loop audits of sampled outputs to estimate precision. Track operational signals (score volatility, fraction of inputs in low-density regions) and use spot-checked manual labels to build occasional accuracy estimates. The strategy substitutes statistical and human review for continuous ground truth.

The reference defines 'normal' against which the current window is compared; choices include a fixed training-time snapshot, a sliding recent window, or a representative golden set. A fixed baseline detects drift relative to training but may flag legitimate gradual evolution; a sliding baseline adapts and avoids chronic alarms but can silently absorb slow drift (boiling-frog problem). The choice should match whether you care about deviation from training versus sudden recent change.

Drift in a feature only matters to predictions in proportion to how much the model relies on it; a large shift in a near-zero-importance feature is usually harmless, while a small shift in a top driver can move outputs substantially. Weighting or prioritizing drift alerts by feature importance reduces alert fatigue and focuses attention on shifts that actually threaten performance. Importance-weighted drift scores combine magnitude and impact.

LLM apps need monitoring of output quality and safety dimensions that have no single ground-truth label: hallucination/factuality, toxicity, prompt-injection and jailbreak attempts, response relevance, format adherence, latency/cost per token, and drift in input prompt distributions and retrieved-context (RAG) relevance. Because outputs are free text, teams use LLM-as-judge evaluators, embedding-based similarity to references, guardrail classifiers, and sampled human review rather than accuracy alone.

Retrieval drift is degradation or change in the quality and relevance of documents fetched by the retriever, caused by an evolving knowledge base, shifting query patterns, or stale/changed embeddings. Since generation quality is bounded by retrieved context, poor retrieval silently produces wrong or unsupported answers even if the LLM is unchanged. Monitor retrieved-context relevance scores, hit rate, embedding drift of the corpus and queries, and groundedness of answers against retrieved passages.

Sudden (abrupt) drift is an immediate switch to a new concept; gradual drift is a slow probabilistic transition where the new concept increasingly replaces the old; incremental drift moves continuously through intermediate concepts; recurring (seasonal) drift is the reappearance of previously seen concepts on a cycle. Recognizing the type guides response: recurring drift favors keeping/reusing old models, while sudden drift favors fast trigger-based retraining.

Compare the current window against a same-season baseline (e.g., last year's same month) or model the seasonality explicitly and monitor residuals, rather than comparing to an adjacent recent window. Persistent deviation after accounting for known cycles indicates real drift; deviation that aligns with historical seasonal shape is expected. Sufficient historical span and decomposition (trend/seasonal/residual) are needed to tell them apart.

Under covariate shift, you reweight training samples by the density ratio w(x)=p_test(x)/p_train(x) so that the training distribution is matched to the deployment distribution, yielding unbiased risk estimates and adapted models without new labels. The ratio is often estimated directly (e.g., a probabilistic classifier separating train vs test, or kernel mean matching) since estimating two densities separately is unstable. It only corrects P(X) shift, not concept drift.

A single cutoff causes flapping near the boundary and forces a binary react/ignore decision. A two-level scheme (e.g., DDM's warning then drift levels) lets the system enter a cautionary state, start buffering recent data or increasing sampling, and only escalate to retraining/paging if the signal worsens to the alarm level. This reduces false alarms while still preparing resources early, improving both responsiveness and stability.

MMD measures the distance between two distributions as the difference of their mean embeddings in a reproducing-kernel Hilbert space; with a characteristic kernel (e.g., RBF) MMD is zero iff the distributions are equal. It is non-parametric, handles high-dimensional and multivariate data without binning, and supports a permutation-based significance test. This makes it a strong kernel two-sample test for embedding and feature-vector drift.

Aggregate metrics can hide serious degradation concentrated in important subpopulations (e.g., a specific region, device, or demographic) because their volume is diluted by stable segments. Slice-based monitoring tracks drift and performance per cohort, surfacing localized failures, fairness regressions, and emerging segments early. This is essential for catching harm and for satisfying fairness and regulatory requirements that aggregate numbers would mask.