Trial-Termination Early-Warning — live risk dashboard

Three tiers of early-termination risk, monitored continuously. The AI detects, aggregates, and triages signals and drafts the alert; the SRC / DSMB / medical monitor, the PM, and the account lead make every call. Rows marked ADV come from the advanced engine — Optimal Transport (Wasserstein drift) and nested Active Inference (free-energy surprise) — which surfaces risk continuously and earlier than a threshold rule. Values below are illustrative.

Early-warning feed

The hybrid architecture

Sensitivity decides the engine. Participant-level safety, PK, and unblinded data never leave the device — they run on a local LLM. Non-sensitive operational and commercial signals run on cloud Claude (API + BAA). A scoring layer rolls signals up to a tier RAG status; humans own every decision.

Participant-level signals

Study-level signals

29 signals: the dose-escalation stopping rules, enrollment/feasibility KRIs, safety QTLs (ICH E6(R3)), data-quality and operational risk. Aggregate, de-identified KRIs run on cloud Claude; any participant-level drill-down stays on-device.

Client / sponsor-level signals

Detection, scoring & escalation

How individual signals become a tier risk level and an alert — and the platform pieces that run it.

Advanced engine — Optimal Transport + nested Active Inference

The rule-based KRIs answer "has a line been crossed?". This layer answers the earlier question: "is this trial drifting toward a line, and where should we look next?" It adds three things on top of the thresholds — a geometry-aware drift signal (Optimal Transport), an anticipatory surprise signal (Active Inference), and a nested, pooled structure that ties the three tiers together.

1 · Optimal Transport — the geometry-aware drift signal

A threshold rule fires when one value crosses a line. Optimal Transport instead measures how far a whole distribution has moved. The Wasserstein distance is the minimum "cost" to transport one distribution onto another:

Why Wasserstein and not KL-divergence? Three reasons that matter for safety:

• It respects the outcome geometry. Severity ordering and exposure magnitude are built into the cost — so a shift toward worse grades or higher exposure registers as a larger distance, in the right direction.
• It counts how far the mass moves. A few participants sliding into a dangerous tail move mass a long way in ground-metric units — W registers that, where a mean/threshold summary misses it and KL (being geometry-blind, and prone to blowing up) tells you the distributions differ but not by how far or in which direction. The dangerous part of a dose-escalation shift is that tail movement.
• It is well-defined on non-overlapping support (where KL → ∞) and gives a smooth distance and a direction — the transport plan tells you which grades/exposures/participants are driving the drift, so the flag is interpretable.

The reference each tier compares against is a Wasserstein barycenter of prior cohorts/studies — the distribution that minimizes the average transport cost to the historical set (this is the pooled prior, below):

On-device feasibility: 1-D Wasserstein is a closed-form sort (cheap), and sliced-Wasserstein reduces the multivariate case (labs + vitals + exposure jointly) to averaged 1-D projections — light enough to run on the local model for participant-level data, zero egress.

Drives, on the dashboard: participant-trajectory drift, cohort dose-escalation drift, site data-distribution anomaly (central monitoring), sponsor-behavior drift.

2 · Active Inference — the anticipatory surprise signal

Treat the monitor as an agent with a generative model of the trial's expected trajectory. Two quantities fall out, and both are exactly what an early-warning system wants.

(a) Variational free energy — a tractable upper bound on surprise — is an early-warning signal. As each observation arrives, the agent updates its beliefs to minimize free energy (variational Bayesian belief-updating); the free energy upper-bounds the surprise (the surprisal −ln p(o)) — how poorly the model explains what it just saw. The same F has two equal forms — one that shows the bound, one that you actually compute:

The trial's safety/quality tolerances (the QTLs, exposure caps, expected enrollment) are encoded as the model's preferred observations (prior preferences C) — which enter the expected free energy below, not the perceptual F above. So there are two distinct early signals worth watching: surprise (F rising — the trial is doing something the model didn't expect) and preference-divergence (outcomes drifting from the preferred QTL state). They usually move together, but not always — a trial can drift toward a fully predicted bad state (low surprise, high preference-divergence), and you want to catch both.

(b) Expected Free Energy = what to monitor next. The agent chooses its next action — here, a monitoring/data-collection action — by minimizing expected free energy over candidate observations:

So the engine doesn't just wait — it recommends an unscheduled LFT/ECG/PK draw, or which site/cohort to monitor next (precision-weighted attention = risk-based monitoring that focuses where information-gain is highest). Every such action is a suggestion for human approval — never an autonomous clinical or dosing action.

Drives, on the dashboard: participant free-energy spike + EFE-recommended monitoring; study-level free-energy drift + EFE-guided RBM; program-level free-energy.

3 · The nested / cross-study pooling structure

This is where the two methods compose. The three tiers are not three separate dashboards — they are one deep (hierarchical) active-inference model that minimizes a single hierarchical free energy by local message-passing. Each tier's beliefs are the top-down priors for the tier below; each tier's prediction errors (surprise) propagate up; and the levels run at different timescales (fast at the bedside, slow at the program). Because the levels are coupled in the model, a participant DLT propagates upward as study- and program-level risk instead of staying siloed.

Cross-study pooling (empirical-Bayes pooling) sets the priors. Each level's generative model — expected AE rates, the dose–toxicity prior, the enrollment curve, the "preferred" QTL states — has hyperparameters estimated by pooling across prior cohorts/studies (an empirical-Bayes / hierarchical prior). In the hierarchy the higher level supplies the prior for the level below; what is pooled from the population is the hyperprior that shapes those priors. Concretely, the Wasserstein barycenter of past cohorts is used as the reference a new cohort is scored against, and it recalibrates as each study completes — so a new study starts population-informed instead of from scratch. That cross-study hyperprior is the "meta".

The tie that binds: a Wasserstein-regularized objective. Using an Optimal-Transport cost in place of (or alongside) the KL term in the variational objective makes the divergence geometry-aware and well-defined on non-overlapping support — the same property that made W the right drift metric now makes the belief-updating robust, and it lets the pooled barycenter prior enter directly. The honest trade-off: once you swap KL for W it is no longer the strict variational free energy, so the clean "upper bound on surprisal" guarantee above relaxes into a geometry-aware regularizer — a deliberate, advanced design choice, not a free lunch. OT supplies the metric; active inference supplies the dynamics; cross-study pooling supplies the priors.

Honesty & validation

• Advanced ≠ validated. These are advanced methods. Treat their outputs as triage and prioritization until the specific implementation is validated and version-locked; the rule-based triggers and the validated safety/dose-escalation tools remain authoritative for any regulated decision.
• Frozen for reproducibility. If a model-derived signal ever feeds a submission or a stopping decision, the model, the reference barycenters, and the thresholds must be frozen and documented (the same model-freeze argument as the rest of the program) so a result is reproducible.
• Participant-level stays on-device. The participant-tier OT and active-inference computation runs on the local model with zero egress; only de-identified aggregates inform the cloud tiers.
• The action is a suggestion. EFE recommends what to observe; a human orders it. Nothing about dosing, escalation, or termination is automated.

Governance — the AI flags, humans decide

• The AI never makes a safety or termination call. It detects, aggregates, triages, explains, and drafts the alert. The medical monitor / SRC / DSMB make DLT & safety determinations; the PM owns the study; the account lead owns the client signal.
• Participant-level safety / PK / unblinded data never leaves the device. The local LLM runs on-prem / on-device with zero egress. Only non-sensitive operational & commercial signals use cloud Claude (under BAA).
• Validated tools own the numbers. Reported safety numbers come from the validated safety database; cohort DLT-rate / stopping-rule math comes from the validated dose-escalation tool — never an LLM.
• Early-warning, not auto-action. A flag triggers a human review and a disposition, logged with a 21 CFR Part 11 audit trail (ALCOA++). Nothing is paused, escalated, or terminated by the system itself.
• The client tier is decision-support for the account team — surfacing commercial signals, never a unilateral judgement about a sponsor.

Standing it up

Phase 1 — the safe wins (cloud)

• Study & client tiers first: wire enrollment / KRI / QTL feeds and the finance-AR / CRM / sponsor-comms signals into cloud Claude; build the Study and Client RAG panels behind a human-review queue. De-identified / non-sensitive only.

Phase 2 — the on-device participant tier

• Stand up the on-device local LLM in the validated environment; connect the safety DB / central-lab / ECG feeds; encode the DLT criteria, Hy's-Law / eDISH logic, QTcF and PK-exposure thresholds; route every participant-level signal on-device with zero egress.
• Wire the alerting to the medical monitor / SRC and the disposition log.

Phase 3 — scoring, escalation & audit

• The weighted roll-up to tier RAG, the escalation routing, the Part-11 audit trail and human-acknowledgement, and the cross-study safety view for the same compound.

Worked example — a DLT early-warning fires

Day 9, cohort 4 (dose escalation)

Participant S-1042's central-lab feed posts: ALT 3.4× ULN, total bilirubin 2.1× ULN, ALP 1.3× ULN. The on-device local LLM evaluates the eDISH logic, recognizes a Hy's-Law pattern, and — because it's inside the DLT window for this dose — flags a candidate DLT. Nothing left the device.

Within minutes

The model pre-assembles the case: the LFT trajectory, the eDISH context, the participant's dose & exposure, concomitant meds, and the running cohort DLT tally vs the 3+3 rule. It drafts the alert and routes it to the medical monitor and the SRC chair — ahead of the scheduled cohort review — and logs the flag with a Part-11 audit entry.

The humans decide

The medical monitor orders a confirmatory repeat LFT; the SRC convenes. Per protocol, further dosing/escalation pauses pending adjudication. The validated safety database holds the authoritative numbers; the SRC makes the DLT determination. The dashboard's Participant panel goes red, the Study panel flags the cohort, and a cross-study check runs for the same compound.

The payoff

The signal surfaced on day 9, not at the cohort meeting on day 21 — with the SRC packet already built, the data never leaving the device, and a human making every call.

FAQ

Does the AI stop a study or a dose? No. It is an early-warning system — it flags, aggregates, and drafts; the SRC / DSMB / medical monitor and the PM make every decision.

Why on-device for the participant tier? It's participant-level safety / PK / unblinded data. On-device with zero egress is the only way to use AI on it without a data-residency problem.

Where do the numbers come from? Validated systems — the safety database and the validated dose-escalation tool. The LLM never produces a reported safety number or a DLT-rate verdict.

Is the client tier appropriate? It's commercial decision-support for the account team — surfacing AR, communication, scope, and sponsor-health signals — not a judgement the system makes on its own.

How does it relate to the rest of the program? It's the risk-monitoring layer of the hybrid AI strategy: on-device local for sensitive data, cloud Claude (API + BAA) for non-sensitive — the same routing principle, pointed at early-termination risk.

What are the "ADV" / Optimal-Transport / Active-Inference signals? An advanced analytics layer on top of the thresholds: Optimal Transport (Wasserstein) measures how far a distribution has drifted from a pooled reference (earlier and more tail-sensitive than a single value crossing a line), and nested Active Inference treats the monitor as a generative model whose surprise is an early-warning and whose expected free energy recommends the most informative next assessment. They are decision-support — advanced, not yet validated — and never override the rule-based triggers or the humans.

Walkthrough transcript

The complete narration of the walkthrough video, as readable text.

1. Part 1

This is a short walkthrough of the trial-risk early-warning dashboard. The idea is simple: catch the risk that a trial might have to stop — early, and across three levels: the individual participant, the study as a whole, and the client relationship. It runs on a hybrid of cloud Claude (under a BAA) and on-device local models. And throughout, the AI only detects, aggregates, and triages. It never makes the safety or termination call. Let me show you how it works.

2. Part 2

Early-phase trials can stop for reasons that build up quietly. A participant's safety signal. A cohort's toxicity creeping toward the stopping rule. Or a sponsor going cold on the program. The trouble is that the first formal look is often the cohort review or a governance meeting — and by then we are days or weeks behind. The dashboard watches all three of these continuously, so the earliest mover is visible long before that meeting.

3. Part 3

Here is the dashboard itself. Three panels — participant, study, and client — each with a simple red, amber, green status, the top signals underneath, and the engine that powers it. Below the panels is a live early-warning feed. Right now everything is amber: a candidate liver signal on one participant, an enrollment limit breached at the study level, and a payment-aging flag on the client side. Each panel rolls its signals up to a status — but that status is a prompt for a human, not a verdict the system reaches on its own.

4. Part 4

The participant tier is the most sensitive, so it runs entirely on-device, with zero egress. It flags candidate dose-limiting toxicities inside the evaluation window: Hy's-Law liver signals, QTc prolongation, PK exposures beyond the safety margin, and escalating adverse-event clusters. The key word is early. It surfaces the pattern and pre-assembles the safety-committee packet before the formal cohort review. What it does not do is adjudicate the toxicity. That is the medical monitor and the Safety Review Committee.

5. Part 5

The study tier watches the trial's trajectory against its own rules: the cohort toxicity rate against the stopping rule, enrollment and screen-failure limits, the safety quality-tolerance limits from ICH, and central data-quality signals. These are de-identified, aggregate numbers, so they run on cloud Claude — with any participant-level drill-down dropping back to the on-device model. The project manager owns these calls, with the safety committee on anything safety-related.

6. Part 6

The third tier is the commercial one — the early warning that a sponsor might cancel, de-scope, or not renew. Payment aging, a drop in communication, scope-reduction change orders, and the sponsor's own financial and pipeline health. This is non-sensitive business data, so it sits on cloud Claude. And I want to be clear about what this tier is. It is decision-support for the account team, surfacing signals. It is never a judgment the system makes about a sponsor.

7. Part 7

Underneath, one rule decides where everything runs: sensitivity. Participant-level safety and unblinded data go to the on-device model, and never leave the validated environment. Non-sensitive, aggregate operational and commercial data go to cloud Claude, under a business-associate agreement. And here is the rule that governs the whole thing. The AI flags, aggregates, triages, and drafts the alert — it never makes the safety or termination call. The reported numbers come from the validated safety database, never the model. Every flag triggers a human review and a logged disposition, and nothing is paused or terminated by the system itself.

8. Part 8

There is an optional advanced layer for teams that want it. Instead of waiting for a threshold to be crossed, it watches for drift and surprise. Optimal transport measures how far a distribution has moved from a learned reference, in a way that respects clinical severity. Active inference treats the monitor as a model of the expected trajectory, so rising surprise is itself an early warning — and it can even recommend the most informative next test to run. It is decision-support only: the threshold rules stay authoritative, the methods were independently checked, and it is validated and frozen before it ever informs a regulated decision.

9. Part 9

Here is how it comes together. Day nine of cohort four: a participant's labs post a Hy's-Law pattern. The on-device model recognizes it, and because it is inside the evaluation window, flags a candidate toxicity — without any data leaving the device. Within minutes it assembles the case and routes it to the medical monitor and the committee chair, ahead of the scheduled review. The humans take it from there: a confirmatory test, the committee convenes, dosing pauses per protocol. The payoff is the timing. This surfaced on day nine, not at the cohort meeting on day twenty-one — with the packet already built, and a human making every call.

10. Part 10

Building it is staged. First, the safe wins: wire the study and client tiers from existing operational and commercial feeds into cloud Claude, behind a human-review queue, with de-identified data only. Second, the on-device participant tier in the validated environment, with the safety logic encoded and alerting wired to the medical monitor. Third, the scoring, escalation, and audit trail — and, optionally, the advanced engine, validated and frozen before it informs anything. Each phase delivers value on its own.

11. Part 11

So, in one line: catch termination risk before the meeting, and let humans make every call. It is earlier — a liver signal on day nine, not day twenty-one. It is three tiers on one screen. It is governed by design — sensitive data on-device, validated tools owning the numbers, and the committees and project managers deciding. And it fits the program: a phase-one pilot deliverable on the same hybrid stack — no new principle, just a new target. Thanks for watching.