The vision · Design intent, not inventory
Five models exist today.
The design asks for a hundred.
This page is the production design: a whole covered population screened continuously in the background, an ensemble refreshed one model per day, flags that arrive carrying an explanation, and a method meant to be published and shared rather than kept as a black box. None of it is built. It is written down here — targets and rationales together — so it can be checked against what actually gets built.
How to read this page
One thing on this site is demonstrated: the 2026 synthetic proof of concept — five pools, five models, five inference nodes, run once, against a fabricated condition. Everything on this page carries the vision tag. Where a measured prototype result appears below, it is labelled as demonstrated and keeps its synthetic-data caveat.
The honest contrast
What exists, next to what is intended.
Exists today
- Five disjoint pools → five independent models → five inference nodes, run end to end, once — on synthetic data with a fabricated condition
- Consensus measured as a noise filter: false flags collapse as the required agreement rises
- One full-context model served from a single 16 GB consumer GPU — measured, not estimated
- Candidate models judged on what they generate, never on training metrics — a lesson the prototype forced
- An entire condition defined purely as code sets and carried from definition to consensus vote, with no condition-specific component anywhere
Intended
- On the order of one hundred pools, models, and voters — a count to be settled by the real-data phase, not doctrine
- The whole covered population screened on a rolling background cycle that nobody has to trigger
- One model retrained per day, each refreshed roughly quarterly — the ensemble changing by one voice at a time
- A separate explanation model that turns a consensus flag into a short physician-facing narrative
- A network that shares trained models — never patient data — and publishes its findings, negative results included
Production scale
More voters, not bigger models.
The prototype demonstrated the two properties production depends on. Disjoint pools produce genuinely independent models — no data, weights, or adapters ever cross pools, so agreement is independent convergence, not echo. And that independence makes agreement a powerful noise filter. Production changes nothing about that unit.
One pool, one model, one vote — the design simply asks for more of them.
Five was the smallest ensemble that could demonstrate cross-pool consensus meaningfully; on the order of one hundred is the working target for a real member population. The exact count is not doctrine: it depends on population size, per-pool data volume, and retraining cadence, and it will be settled by the real-data phase — not by this page.
Measured at five: why agreement is the instrument
In the prototype, every timely-tested carrier of the fabricated condition drew a unanimous 5-of-5 fire — while false flags on control patients collapsed as the required agreement rose. Individual models are deliberately noisy; the vote is the instrument, and adding independent perspectives is what sharpens it.
False flags on control patients, by required agreement
2026 synthetic prototype — patients with no injected condition. The single-model figure is the rate per model run; the consensus figures are patients flagged (2 and 1 of 1,500). The shape of the consensus filter, not a clinical performance claim.
View the data
| Required agreement | False-fire rate on controls |
|---|---|
| Any single model (per model run) | ~1.4% |
| At least 4 of 5 models (per patient) | 0.13% · 2 of 1,500 |
| All 5 models (per patient) | 0.07% · 1 of 1,500 |
Honest limits
These rates were measured on deliberately clean synthetic data, against a fabricated condition injected to be learnable. They demonstrate the noise-filtering shape of consensus under ideal conditions — an upper bound for the method, not a forecast of real-world sensitivity or specificity. The full results, and what they do not prove →
With a hundred voters, agreement becomes genuinely graded: five models yield six agreement levels, a hundred yield a hundred and one, and thresholds could be set per condition — weighing how invasive the test is against the cost of a missed early window. The read remains what it was in the prototype — a flag, never a probability — but the flag carries far more shading.
Assignment by the last two digits
Patients are assigned to pools by the trailing digits of a stable, hash-derived identifier — for one hundred pools, the last two. Because the identifier is hash-derived, pool membership requires no identity knowledge at all — the same anonymous-by-architecture posture the rest of the pipeline keeps. Trailing digits of a large ID space distribute uniformly, so each pool holds about 1% of the population with no balancing step.
Deterministic
No sampler, no assignment service, no state to maintain — the ID is the assignment.
Permanent
A patient stays in one pool for life; their growing history never leaks into another pool's training data.
Even
Each pool holds ~1% of the population, for free, with no balancing step.
Coordination-free
A hundred training datasets can be prepared independently, by the same rule, with no communication between them.
The rule's blindness is its virtue. Family members scatter across pools despite shared risks; neighbors scatter despite shared providers; patients with the same condition scatter despite similar histories. Every pool becomes a representative cross-section, and no pool can become "the pool that saw the unusual cases."
What scale buys
Finer consensus gradations
Five models yield six agreement levels; a hundred yield a hundred and one. Still a flag, never a probability — but a flag with far more shading.
Rolling refresh, no downtime
Retrain one model per day and the whole ensemble refreshes on a ~100-day cycle. A failed training run degrades one voter out of a hundred, not the system.
Rare-pattern coverage
A genuine pattern recurs across many disjoint pools; a pool-local artifact appears in one. More independent voters sharpen that distinction.
One more thing real scale supplies for free: heterogeneity. The prototype had to manufacture cross-pool diversity deliberately, generating each pool with a different upstream configuration. Real populations bring it on their own.
The rack it runs on
A production installation is a rack of consumer graphics cards, each serving exactly one ensemble model, coordinated by a single management server. The per-card sizing is measured, not estimated: the prototype proved that a single 16 GB consumer card serves one full-context 9B-class model as a complete node. The nodes recognize patterns; the management server does everything that makes the recognition operational.
Consumer cards on purpose
The workload is one model per card, batch throughput, no concurrent-user serving. A failed card is a commodity part swapped as routine maintenance — no vendor lock-in, no enterprise hardware.
Isolated by construction
Inference nodes connect to the management server and to nothing else — not the insurer's systems, not the internet. The installation runs inside the insurer's own data center; patient data never leaves the building.
Fails soft, by design
Models are files: a failed card's model is reassigned, so hardware failure costs time, never votes. No redundancy theater — if the rack loses power, suggestions simply arrive later, because silence is never a recommendation.
Patient evaluation is embarrassingly parallel: doubling the cards doubles daily throughput, with no redesign and no diminishing returns. The piece of this that exists is the prototype's five-node fleet — the small-scale instance of the same pattern. The orchestration layer around it is not yet built.
The continuous loop
Screening that nobody has to order.
In production, PRISM screens the entire covered population on a rolling background cycle. Nobody orders an evaluation, because the patients who most need screening are often the ones not sitting in front of a doctor. A patient whose claims record is quietly accumulating a precursor pattern may go years between visits — and any screening tool that waits to be asked inherits that blind spot exactly. The 2026 prototype already ran exactly this shape of workload, every patient fired at every model, in batch, across a small fleet. Production turns that experiment into a permanent cycle.
Select
Choose which patients enter this cycle, in the order set by the prioritization below. Every covered patient cycles through eventually.
Infer
Every ensemble model produces a forced continuation of each selected timeline, in parallel across the fleet — no model is ever allowed to answer by stopping.
Aggregate
Count the independent models whose continuation contains the diagnostic TEST code. Consensus at or above threshold becomes a candidate suggestion; silence becomes nothing at all.
Explain
A separate explanation model drafts the physician-facing narrative from the consensus result alone.
Deliver
The suggestion and narrative go to the insurer, who routes them to the patient's primary-care physician through existing channels — no new workflow, no new system.
No stage records a negative
A patient whose continuation contains no TEST code produces no output, no score, and no entry anywhere that could later be read as "screened and cleared." Silence is never a recommendation.
Order, never eligibility
Prioritization decides only when a patient is evaluated, never whether. A suggestion that lands a week before a scheduled visit can be acted on in that visit; the same suggestion a week after may wait months. Three inputs set the queue:
Temporal alignment
Patients with upcoming encounters are evaluated ahead of them, so an actionable suggestion can reach the physician in time for the visit.
Similarity to confirmed successes
Patients whose recent histories most resemble past confirmed early detections are evaluated sooner — a scheduling heuristic and nothing more.
Baseline randomization
A fixed fraction of every cycle is selected uniformly at random, and periodic sweeps cover the full population regardless of priority.
The fence around the similarity mechanism matters: it never fires a suggestion, never contributes to consensus, and never gates whether a patient is screened — only when. The evidence remains, always, the count of independent models firing. And the randomization floor guards against the heuristic's own bias — patients with fragmented or episodic care, often exactly the patients the system exists for, would otherwise be down-ranked by their own data sparsity.
Background operation is also an equity property. It applies identical analysis to every record, so whether a patient is evaluated depends only on their history — never on who their doctor is or how often they show up. The core mechanics — forced continuation, binary firing, consensus counting, batch execution across a fleet — are demonstrated; every scheduling question — cadence, thresholds, prioritization weights, the size of the random floor — is an open operational question for the real-data phase, to be set with medical oversight.
Never frozen, never lurching
The prototype trained its five models once and stopped; production cannot. Claims accumulate daily, coding practices drift, and PRISM's own suggestions produce outcomes that should feed back into training. The design answer is a rolling cycle: each day, exactly one pool's model is retrained from that pool's freshest data, validated, and swapped in. At the ~100-pool target, every model refreshes roughly quarterly while the ensemble as a whole changes by only one voice per day.
The deeper reason is failure isolation. A bad training day produces one bad candidate for one pool while its predecessor keeps serving. Since consensus across independent models is PRISM's entire unit of evidence, correlated failure is the one failure mode the architecture cannot absorb — the retraining schedule is shaped to make it structurally unlikely. The stagger also makes time a third axis of independence, alongside disjoint data and separate weights: a pattern only earns consensus if it is visible to models trained at different points in time, so a one-month artifact of claims processing cannot recruit models that never saw that month. The honest cost is bounded staleness — the oldest model always lags by up to one full cycle.
The outcome feedback loop
A tracking code attached to every suggested test makes a followed suggestion identifiable in later claims, so outcomes label themselves.
| What the claims show | What it becomes in the next training set |
|---|---|
| Suggested test taken, condition confirmed, early treatment follows | a new GOOD example |
| Suggested test taken, no diagnosis results | a new NOPE example |
| Suggestion never acted on | no training signal — the outcome is unknown, and unknowns are not labeled |
GOOD and NOPE are construction labels that slice training material — bookkeeping no model ever sees. Feedback volume depends entirely on physician uptake: early in a deployment it will be a trickle, and the design has to work without it before it can improve with it.
No retrained model replaces its predecessor automatically. The QA gate measures one thing — generation behavior: does the candidate still fire on confirmed patterns, stay silent on controls, and vote at rates consistent with its pool's history? Training metrics are not the signal and never gate a deployment. The prototype made that rule concrete: the adapter that actually worked logged inverted training metrics — by loss and margin it looked like the worst candidate, and by generation it was the only one that did the job. A failed gate costs one day of freshness for one pool and nothing else; after deployment, voting rates stay monitored, and a sudden shift in one model's firing behavior flags it for human review.
One slice, three jobs, one day
The daily rhythm folds training, screening, and validation into one loop. Each day the cycle turns to one pool's slice — roughly 1/100 of all members — and that single slice does triple duty: it is the day's training data for the replacement model, the day's screening batch for the standing ensemble, and the new model's first proving ground. Because the slice belongs to one pool, exactly one standing model has ever trained on those members — the other ~99 judge them out of distribution, the same in-vs-out split the prototype measured, now as the daily default.
~100 nodes, one standing model each, screen the day's slice — every member continued by every model for consensus — while the day's single replacement trains alongside.
All nodes host the one fresh model, mass-validating it against its slice and cross-pool chunks in the capacity that frees up the instant screening finishes.
Illustration of a design target — nothing at this scale is built. The prototype's fleet was five nodes.
The day begins spread wide across a hundred different models and ends collapsed onto a hundred copies of one — the fleet pivoting from breadth to depth rather than sitting idle, which is what makes the cadence affordable on one fleet instead of a screening farm plus a training farm. A day closes only on evidence the new model is at least as good as the one it would replace, judged on free-generation behavior; if it does not clear its predecessor, the predecessor stays. The ensemble never ships a regression: it either improves or holds, one model at a time, every day.
The cadence also meters detection on its own. Each member is screened about once every 100 days — roughly 3.65 times a year, an arithmetic consequence of the design cadence, not a measured or promised service level — so suggestions arrive as a steady trickle rather than a flood. The 100-day rhythm is itself the throttle; no separate alert-fatigue limiter is needed to keep physician-facing volume sane.
Honest status
The prototype ran five models, once, and proved the load-bearing pieces — pool independence, consensus as evidence, gating on generation. The hundred-model count, the daily swap, and the everyday train-screen-validate loop are production design, not yet built.
Physician explanations
What a mature flag could carry with it.
When consensus fires, someone has to tell the physician — and a fired billing code is not a message. In the production design, a separate explanation model turns each consensus suggestion into a short physician-facing narrative, and it lives entirely outside the recognition path.
The ensemble models are deliberately broken specialists — trained until continuing a six-column claims table is the only thing they can do. That narrowness is what makes their independent agreement meaningful, and it also means they cannot explain themselves; asking them to would mean un-breaking them, trading recognition quality for eloquence. So the two jobs belong to different models. The explanation model never votes, never trains on a pool, and has no influence on whether a suggestion fires — the decision is complete before it is ever invoked. It is a communication layer, not evidence: a well-written narrative cannot create a suggestion, and a clumsy one cannot suppress it.
Strictly limited inputs
The explanation model receives exactly four things — and never sees laboratory values, test results, clinical notes, imaging, or anything from a medical record.
| Input | What it contributes |
|---|---|
| The suggested test | what the narrative is recommending the physician consider |
| The patient timeline that led to consensus | the same anonymized six-column claims history the ensemble saw — the pattern it must describe |
| The vote count | how many independent models agreed, stated plainly as a flag |
| General knowledge of the target condition | enough clinical framing to say why the pattern and the test belong together |
No part of PRISM — including the part that writes prose — ever handles clinical data.
The intended register
Pattern-based, never probabilistic: no confidence percentages, no risk scores, no diagnosis — consensus is a flag, and the narrative must not dress it up as anything more. An example of the intended register, from the design documents:
This patient's recent history shows a recurring pattern: repeated visits for symptoms that have not resolved, escalating medication adjustments without a settled answer, and laboratory work circling the same system more than once. Four of five independent models, each trained on a different patient population, continued this history toward the same screening test. Patterns like this one have preceded conditions this test can detect early. It may be worth considering; whether it is appropriate for this patient is, as always, your judgment.
Note what is absent: no percentage, no urgency, no instruction. The narrative names a pattern, states the vote count plainly, and hands the decision to the person who can actually see the patient. The vote strip mirrors the example's "four of five."
Honest limits
None of this exists yet. The 2026 synthetic prototype reported raw fires and vote counts; no narrative layer was built or needed. And fluent prose implying more certainty than the evidence carries is a known hazard — guarded here by the strictly limited inputs above, and by the structural fact that the narrative carries no evidential weight: the suggestion is identical whether the explanation is graceful or not.
Platform expansion
A selection problem, not an engineering problem.
The machinery that extracts training material, trains the ensemble, and counts votes never knows what condition it is screening for. The prototype demonstrated that end to end: an entire condition was defined purely as code sets and carried from definitions to consensus votes with no condition-specific component anywhere. Expanding PRISM is therefore a matter of choosing conditions well — and the choice has four hard criteria. It is a conjunctive filter, not a scorecard: a condition that is common, devastating, and treatable but has no simple test is out.
The four criteria
Established non-invasive test
A routine blood or urine test with defined reference ranges, orderable by any physician. The suggestion must be trivially actionable — physicians must know exactly what to order and how to read it.
Early-vs-late outcome difference
Catching it early must lead to meaningfully better outcomes than catching it late. Screening that does not change the patient's trajectory is cost without benefit.
Sufficient prevalence
Enough diagnosed patients in claims data to yield training examples. The extraction learns from real utilization patterns; a one-in-a-million condition cannot supply them.
Clear early-treatment pathway
A specific, accessible intervention that follows a positive test. Detection without a next step helps no one — and generates no documented early detection to be paid on.
That last clause is not incidental: PRISM is paid only when a suggestion leads to a documented early detection followed by early treatment, so a condition failing the outcome-difference or treatment-pathway criteria could never generate a payable event. The business model and the selection criteria enforce each other.
The non-invasive constraint reads like a limitation and functions as discipline. A suggested test can be drawn alongside the labs a patient was getting anyway — adding a line to a requisition rather than a task to a life. It also underwrites the error tolerance: the consensus approach accepts noisy individual models only because the worst case of a wrong suggestion is a cheap, essentially risk-free blood draw. Non-invasiveness is what keeps a false flag nearly free.
A worked illustration: hypothyroidism
Hypothyroidism shows what a passing condition looks like against the criteria. Naming it here illustrates the filter, not an announcement — whether its precursor pattern is actually learnable from claims data is an empirical question, per condition, that only the real-data phase can answer.
| Criterion | Hypothyroidism |
|---|---|
| Established test | Thyroid function panel (TSH and related assays) — a standard blood draw with well-defined reference ranges |
| Outcome difference | Untreated, it drifts for years through fatigue, weight and lipid changes, and cardiovascular strain; treated, it is a managed condition |
| Prevalence | Common in any insured population, and substantially underdiagnosed |
| Treatment pathway | Daily oral levothyroxine — inexpensive, well-understood, monitored with the same blood test |
The shape should look familiar: a slow prodrome of vague, scattered complaints, one simple test, and a managed life on an ordinary refill. That is deliberately the shape of the fabricated prototype condition's timely-tested arc — it was designed as a clean instance of exactly this class.
Adding a condition
Onboarding a new condition means defining three code sets: its TEST (the diagnostic that fires), its EARLY (what managed treatment looks like in claims), and its LATE (what the missed case costs). From those definitions the extraction machinery derives the training examples — and constructs the earlier-shifted ones — automatically; the training rounds and the consensus vote are unchanged. Clinical expertise concentrates at exactly one point: choosing the codes.
The claim, with its stamp
The marginal cost of a condition is a code-definition exercise and a training round, not a new system. It has been proven on a manufactured condition and remains untested on a real one.
What PRISM will not target
PRISM will not suggest colonoscopies, biopsies, MRI or CT studies, or anything requiring preparation, sedation, or specialist scheduling. It will not target conditions where earlier detection does not change the outcome, conditions without an established treatment response, or conditions too rare to supply training examples. The refusal list is a design feature, not an apology — a system that is explicit about what it will not do is easier to hold accountable for what it will.
Open collaboration & publication
Meant to be shared and scrutinized, not sealed.
Share models, never data
The long-term ambition is a network in which many organizations improve a shared screening ensemble by exchanging trained models — and never, under any circumstances, patient data. Model weights are an abstraction of what the data taught, not a copy of it, and the protection stacks with anonymity by architecture: a model trained on nameless, locationless, identifier-free timelines carries no direct identifiers in its weights. The privacy of shared or merged weights — questions like model inversion and membership inference — is itself an open research area, not a solved procedure; the point is that sharing weights is far more defensible than sharing data ever would be.
Merging is strictly pool-wise — a pool-N model from one organization merges only with pool-N models from others — so no patient's data ever influences more than one pool's model, anywhere in the network, and a merged model voting on another pool's patient is still genuine out-of-distribution recognition. An honest note travels with this: merging independently trained model weights is an active research area, not a solved procedure. Which techniques preserve what this architecture needs is an open question only the production phase can answer.
| Layer | Terms | Rationale |
|---|---|---|
| The codebase | open — inspect, modify, self-host | there are no secret algorithms; verifiability is the point |
| Trained model weights | licensed — access requires active participation | access to everyone's learned patterns is earned by continuously contributing your own |
| Patient data | never shared, never requested, never leaves the organization | the foundation everything above depends on |
Each new participant brings populations, provider networks, and coding habits the rest of the network has never seen — exactly the heterogeneity that makes independent agreement stronger evidence. The proposed reframe for insurers: collaborate on pattern recognition, compete on implementation — how well suggestions reach physicians, how reliably patients follow through, how efficiently the screening-to-diagnosis pipeline runs.
The honest distance
Nothing in this part of the vision exists: no repository, no merging pipeline, no license text, and no second organization. PRISM must first work on real claims data, then scale past five pools, then persuade at least two organizations. This is the last part of the vision to be built because it is the part that must be earned.
Published — both disciplines, negative results included
When PRISM runs on real claims data, its findings — successes and failures alike — are committed to peer review in both computational venues (the method: pools, consensus, the two training rounds, evaluation without a hold-out set) and medical venues (the claim that matters: whether flagged patients are actually detected earlier, and whether that changes outcomes). Neither review alone is sufficient — a sound method with no clinical benefit is a curiosity, and a clinical result from an unexaminable method is not evidence.
The commitment explicitly includes the failures. The synthetic prototype proved the method works given a learnable precursor pattern; whether real conditions carry such patterns is the open question of the real-data phase, and for some conditions the honest answer will be no. A condition that resists this approach is a publishable finding, not a quiet omission — it maps the method's boundary and saves others the same detour.
The deeper research value is what PRISM surfaces. When independently trained models sharing no data or weights keep converging on the same precursor pattern, that agreement is evidence the condition leaves a consistent utilization phenotype — a recognizable trail in billing data before diagnosis — offered as a hypothesis for medical research to test, never announced as a discovery. The caveat is structural: a utilization phenotype is a pattern in billing behavior, not in biology. It can reflect coding habits, referral customs, or benefit design as easily as pathology, and distinguishing signal from artifact requires clinical collaborators. What crosses to those collaborators is learned patterns, aggregate firing statistics, and model behavior under controlled prompts — no researcher ever sees a row of any patient's timeline.
The order of operations
The real-data phase comes first.
Scale comes after it earns the right to.
Every target on this page — the hundred pools, the two-digit assignment, the daily cadence, the explanation model, the network — was chosen for a clean rationale, and any of them may move when real claims data pushes back. What will not move are the invariants they scale: independence between pools, consensus as the only unit of evidence, silence never read as an answer, and a flag that is never a probability.