Governance & independence

MedEval-1 — Governance

Version 0.1 · draft for discussion

The technical work in this repository is the easy half. A benchmark's value is entirely a function of whether people believe it, and belief is produced by governance, not by code.

This document exists because of a specific historical lesson. LIBOR was a benchmark with self-reported inputs, no independent oversight and no audit trail. It was manipulated for years, it collapsed, and the regulatory response was to require that benchmarks be governed, transparent and auditable. The firms positioned to supply governed benchmarks captured the market that followed.

Medical-AI evaluation today has LIBOR's structure: the party reporting the number is the party being measured.

1. The central problem: operator independence

An operator owning the standard that grades its own model is the first objection anyone serious will raise. It is the correct objection and it must be answered structurally, before the first score is published, because independence cannot be retrofitted.

It is also a solved problem in other industries. Index providers run indices that their own products track. Ratings agencies are paid by issuers. Both survive on the same mechanism: the methodology is public, the governance is separated from the commercial line, and the process is externally auditable.

Four mechanisms, all required:

1. Separation of the operator from the oversight board. The board sets and approves methodology. The operator implements it and runs evaluations. Board members are not appointed by, and a majority do not report to, the operator's commercial organisation.

2. Published methodology and a comment period. Every major version is published in draft, opened for comment for a fixed window, and the responses answered in public before the version is frozen. Scores are never produced under an unpublished methodology.

3. External audit rights. An independent auditor may inspect the pipeline, re-run evaluations from manifests, and verify that published scores match what the code produces. Findings are published.

4. Change control. A change to a scoring definition takes effect only in a subsequent version, never retroactively, and never after results under that version have been seen. The prohibition on tuning weights after seeing the leaderboard is absolute — it is the single rule whose violation would end the standard's usefulness.

2. The oversight board

Composition (target). Seven to nine members:

• 2–3 clinical academics in the relevant imaging and diagnostic specialties
• 1–2 biostatisticians or measurement scientists
• 1 regulatory-affairs specialist with device or SaMD experience
• 1 patient or public representative
• 1–2 industry representatives from outside the operator
• The operator holds a minority of seats

Mandate. Approve each spec version; approve dimension definitions, normalisation transforms and composite weights; approve task admission and retirement; review the conflict-of-interest register; receive and publish audit findings; adjudicate disputes.

What the board does not do. It does not see results before publication, and it does not approve individual scores. A board that can adjust a specific model's result is a board that will be lobbied.

Publication. Membership, affiliations, terms and meeting minutes are public.

3. Conflicts of interest

A public register records, for every board member and every member of the operator's evaluation team: employment, consulting relationships, equity holdings in evaluated entities, and research funding from evaluated entities.

Recusal is required for any decision materially affecting a declared interest. The operator's own submissions are subject to the same rules as everyone else's, plus one additional constraint: the operator's evaluation team may not include anyone with responsibility for the operator's own model development. That separation is the concrete, checkable form of "we don't grade our own homework" — and it is verifiable from the personnel register without anyone taking anyone's word for it.

4. Submission, appeal and correction

Submission. Open, on published terms, at published prices. Terms are identical for all submitters including the operator. Refusing a submission requires a published reason.

Publication. A score is published with its report card, its protocol labels, its contamination status and its manifest reference.

Appeal. A submitter may appeal on grounds of process error — wrong version scored, pipeline defect, mislabelled protocol. Appeals are heard by the board, not the operator. A submitter may not appeal on the grounds that the result is unflattering.

Correction. Errors are corrected in public, with the original result retained and marked superseded. A benchmark that quietly edits history is not auditable. The correction log is part of the published record.

Withdrawal. A submitter may withdraw a model from future evaluation. Already-published results remain published — otherwise the standard becomes a ratchet that only ever shows good news.

5. Independence of the private track

The private held-out track (HELDOUT-PROTOCOL.md) concentrates power: the operator holds data nobody else can see and produces scores nobody else can reproduce from first principles. That is precisely the structure that requires the strongest controls.

• Set hashes are published at sealing, before any scoring.
• The external auditor has access to sealed sets and full prediction logs under confidentiality, and can re-derive any published score.
• Stratification targets are published; the cases are not.
• The one-scored-run-per-model-version rule (protocol §3) is enforced by the operator and verified by the auditor.
• Retired set generations may be published in full, which makes historical scoring externally checkable after the fact.

The design principle: the operator should be unable to change a published number without the auditor being able to detect it.

6. Standing up the board

Governance credibility is the long-lead item — longer than any engineering work — which is why it starts before the standard is public rather than after.

Phase 1 (weeks 0–8). Recruit an interim advisory group of 3–4 respected independent figures. Publish the v0.1 spec as a draft for comment. An advisory group with the right names on it converts the project from "a vendor's benchmark" to "a proposed standard" on day one.

Phase 2 (weeks 8–26). Constitute the full board with published terms of reference. Appoint the external auditor. Freeze v1.0 after the comment period.

Phase 3 (26 weeks+). First audit cycle and published findings. Engagement with standards and regulatory bodies so that MedEval-1-shaped evidence is recognised in submissions.

Candidate constituencies for phase 1 — a MICCAI-adjacent academic group; a clinical imaging biostatistician; a former regulator with CDRH or MHRA device experience; a patient-advocacy representative. Named targets and outreach drafts are in OUTREACH.md.

7. Failure modes this is designed to prevent

Each row is a specific thing that would kill the business, and a specific structural answer. That is the level at which this has to be argued: the governance is not a compliance chore bolted onto a product — it is the moat, and it is the reason the second entrant into this market will not be able to displace the first.

8. The Evidence Passport issuing key

Every Evidence Passport is signed with an Ed25519 key held by the operator. The published public key below is what makes a passport checkable by someone who does not trust us: it is the only thing a verifier needs, it is the same key compiled into src/verify_passport.py and into the browser check on /passport, and a passport that carries a different key under this key id is rejected rather than accepted. A document that supplies its own trust anchor certifies itself and proves nothing.

Check any passport against it:

python src/verify_passport.py ../site-data/passports/cnn_scratch.json ; echo $?

Exit 0 means valid. The non-zero codes are stable and are the interface a buyer's CI depends on: 2 bad signature, 3 expired, 4 unknown or substituted key, 5 spec-version mismatch, 6 schema violation, 7 unreadable file.

Custody, stated plainly so it can be held against us. The private key is a single file at ~/.nakedsignal/passport-signing.key, mode 600, outside the repository and outside version control. That is adequate for a demonstration and it is not adequate for a production standard. Before any passport is issued to a counterparty, three things change, and they are governance decisions rather than engineering ones:

1. The key moves into an HSM or a managed KMS, so that no individual can sign a passport alone and every signing operation is logged where the operator cannot edit the log.
2. Signing becomes an approved act, not a side effect of running a script — the same separation §1.1 requires between the operator and the oversight board.
3. A revocation and rotation path is published before it is needed: which key id was live over which dates, how a compromised key is retired, and what happens to passports already issued under it. Doc 02 defers the revocation list on purpose — there is no point registering passports before any exist — but the rule has to exist first, because a rotation policy invented after a compromise is not a policy.

Until those three are done, the correct description of the signature is: it proves the document has not been edited since we issued it, and it does not yet prove anything about who inside the operator caused it to be issued.