Explainable Adaptive Continuous Authentication for Smart Healthcare: Exact Inline Attribution and a Clinical Safety Valve Under Zero Trust

1. Introduction

Smart healthcare couples electronic health records (EHRs), Internet of Medical Things (IoMT) devices, telemedicine and cloud platforms into a single data-driven care pathway, and in the United Kingdom the NHS sits at the centre of national critical infrastructure on that basis [1]. The same integration widens the attack surface. IBM’s 2025 analysis places healthcare at the top of the breach-cost table for the fourteenth consecutive year, at an average of USD 7.42 million per breach, with a mean of 279 days to identify and contain [2]; credentials remain the dominant entry vector [3].

Two incidents define the problem. In February 2024, attackers entered Change Healthcare through a remote-access portal that did not enforce multi-factor authentication, using valid credentials, and moved laterally for nine days before deploying ransomware; the breach affected an estimated 192.7 million individuals. In June 2024 the Qilin group encrypted systems at Synnovis, the pathology provider for two large London NHS trusts; NHS England recorded delays to over 11,000 outpatient and elective appointments [4], 1,710 operations were postponed, and King’s College Hospital NHS Foundation Trust subsequently confirmed that the disruption contributed to a patient death.

The common structure is that authentication was a gate rather than a process: once the gate was passed, nothing re-verified the identity behind the session while it enumerated records for days. This is the failure the NIST Zero Trust Architecture (ZTA) model is designed to eliminate, by requiring access decisions to be re-evaluated continuously from identity, behaviour and environmental signal [5,6].

Two research directions supply components of such a system, and neither is deployable in a hospital alone. Reinforcement-learning risk engines adapt the challenge to contextual risk — RLAuth reports a G-mean of $92.62\%$ [7], and Bansal and Ouda show keystroke dynamics support continuous verification via a deep Q-network [8] — but both are opaque, and RLAuth’s authors observe that their system cannot detect attacks mounted from known environments, such as a colleague at a familiar workstation [7], which is exactly the insider case that dominates healthcare enforcement action. Explainable authentication combines CTGAN augmentation with LIME for keystroke authentication [9] and applies SHAP and LIME to touch-stroke continuous authentication [10], but explanation is post-hoc and evaluated on a closed corpus, with no adaptive control loop.

A third gap belongs to neither literature. In a clinical environment the cost of a false challenge is neither symmetric with the cost of a missed detection nor constant: interrupting a billing query and interrupting a resuscitation are different events. Koppel et al.’s ethnography documents the consequence when this is ignored — staff share credentials, defeat logout and route around controls, because the controls were designed without reference to clinical tempo [11]. Any policy that treats friction as a scalar nuisance will reproduce that outcome.

1.1. Contributions

We make four contributions, each stated with the evidence that supports it so that a reader can go directly to the experiment that would falsify it.

1.

Exactness through grouping, and a correction to common practice. The explanation disclosed to a clinician need not be an approximation. The sixteen evidence features partition into eight semantic groups, so the group game admits exact Shapley values at $2^8=256$ coalition evaluations, which form a single batched forward pass. Measured at $0.44$ ms, a full decision with an exact justification costs $0.611$ ms end to end — cheaper than the same decision explained by approximate integrated gradients ($1.214$ ms). We prove, and verify numerically, that summing feature-level Shapley values within a block is not the Shapley value of that block in the quotient game once interactions of order three or above straddle groups unevenly, and we measure the disagreement ($\rho =0.928$; the two name a different dominant group in $13\%$ of decisions). The caution applies wherever attributions are aggregated for readability, well beyond authentication. Evidence: Section 4.4, Section 6.4; Table 5.

2.

A clinical safety valve and graded escalation ladder, specified and isolated. We map HEAAF onto the NIST zero-trust policy engine / policy administrator / policy enforcement point decomposition and add a safety valve making patient-safety cost an explicit term in the decision: under declared emergency the engine may escalate but can never deny — a structural guarantee our test suite verifies exhaustively rather than an empirical tendency. Holding detector and friction budget fixed, the valve takes denial under emergency from $1.099\%$ to $0.000\%$ for a G-mean cost of $0.005$, and the graded ladder delivers identical detection at $3.5\times$ lower annual clinician-hour cost, because escalation substitutes an eight-second challenge for a forty-five-second denial. Evidence: Section 4, Section 6.1; Table 3Table 4.

3.

A negative result that relocates the value of reinforcement learning. The RL-derived risk score is outperformed on detection by a supervised detector inside the same policy engine, by $0.378$ G-mean with a paired bootstrap interval excluding zero by a wide margin. The same agent’s action-values, routed through the calibrated head, graded ladder and valve, take benign interruption from $41.05\%$ to $1.34\%$. The contribution of the RL formulation therefore lies in the action layer, not in scoring — against our own starting hypothesis and against the framing of much of the adaptive-authentication literature. Evidence: Section 6.1, Table 3.

4.

The explanation channel treated as an attack surface, in a released and mechanically checked artefact. An adversary against a continuous-authentication system controls the features being attributed and can probe repeatedly, so a signed attribution vector paired with a score approaches a gradient oracle. We implement role-scoped disclosure and quantify what each audience receives: the challenged subject is given one group of eight and a three-level band with no score, at most $4.58$ bits per decision, covering $56.9\%$ of the positive attribution mass. The pipeline, simulator, seeds and an invariant test suite checking the axioms and safety properties the argument depends on are released at github.com/riteshmukherjee/heaaf. Evidence: Section 7, Section 1.1.

An earlier revision injected a supervised gradient-boosting score as a seventeenth feature shared by every policy. That configuration is withdrawn: it placed a supervised detector underneath both the RL agent and the supervised baseline it is compared with, making the central comparison uninterpretable, and on held-out data it also degraded the supervised detector (AUROC $0.931$ with the extra feature, $0.949$ without). Every policy reported here consumes the same sixteen interpretable features; removing the stacked feature weakens the RL score, which makes our third contribution harder for us rather than easier.

2. Related Work and Positioning

Table 1 positions this work against sixteen representative studies, ordered by year within theme so the recent trajectory of the field is visible. Three axes matter.

Adaptive authentication. Statistical risk-based authentication in the style of Freeman et al. [12] multiplies per-feature likelihood ratios and is the design measured at scale by Wiefling et al. [15] over 31.3 million logins; the same group finds users perceive it as more usable than blanket two-factor authentication [24], and Gavazzi et al. document how uneven its adoption remains [25]. Reinforcement-learning formulations [7,8,14] replace the hand-tuned score with a learned one, and sensor-based continuous schemes extend the evidence base [13]. None of these systems explains itself, and none carries a cost term that distinguishes clinical urgency.

Attribution. The dominant estimators are KernelSHAP [26] and integrated gradients [27]; the estimator landscape and its error behaviour are surveyed [28], KernelSHAP’s regression formulation improved [29], the theory of integrated gradients tightened [30], and estimation amortised into a learned network [16]. Applied security has adopted these tools quickly, attaching attribution to intrusion detection in cyber-physical systems [17], industrial IoT threat response [18] and multimodal phishing detection [20], alongside deep detectors that remain opaque [19]. All of this literature treats exactness as unattainable in deployment and competes on the approximation frontier. Our observation is narrower and, here, decisive: exactness is unattainable over sixteen features, but the quantity a clinician is shown is defined over eight groups, and there it is affordable. The relationship between a game and its quotient under a partition is classical [31,32]; what appears not to have been noted is that the block-sum shortcut used in practice does not recover the quotient value, and we measure the gap.

Zero trust, clinical cost and explanations as an attack surface. Zero trust is now the reference architecture for clinical estates [5,6], and healthcare-specific reviews and roadmaps argue the case [21,22]; a companion study quantifies how much risk individual controls remove from a simulated hospital estate [23], but at the level of a control portfolio rather than a single access decision. What none of this work supplies is a per-decision policy whose objective distinguishes obstructing a clinician from obstructing an ordinary user. Separately, explanations leak: attributions disclose membership [33], Shapley vectors permit reconstruction of private inputs [34], post-hoc explainers can be actively fooled [35], and the surface is surveyed [36,37]. In authentication the risk is sharper than in classification, because the adversary controls the very features being attributed and can iterate. To our knowledge no authentication paper treats its own explanation output as a channel to be budgeted; Section 7 does.

3. Threat Landscape and Requirements

We ground the design in five threat classes, each instantiated by a documented incident, and derive a requirement from each. Ransomware: Synnovis degraded blood-transfusion capability across south-east London and produced nearly 600 recorded patient-safety incidents [4], so R1: containment must occur within the session, not at the next audit cycle. IoMT device vulnerabilities: connected monitors and infusion pumps run aged firmware and often cannot present certificates, placing them outside a conventional zero-trust boundary [38], so R2: the control must operate on session evidence rather than device-side attestation. Credential-based attacks: Change Healthcare exposed one portal without MFA, and HHS OCR’s proposed rulemaking would remove the “addressable” designation for MFA [39], so R3: possession of valid credentials must not confer an unchallenged session. Supply-chain compromise: Synnovis was a supplier rather than a trust, and MCNA Dental exposed roughly 8.9 million records through a single vendor, so R4: third-party sessions require scope enforcement, not merely authentication. Insider misuse is where behavioural biometrics are weakest, because the genuine user is at the keyboard, so R5: detection must fuse access-pattern with behavioural evidence. Finally, from the clinical-workaround literature [11], R6: the policy must distinguish emergency from routine context and price obstruction accordingly.

4. The HEAAF Framework

4.1. Architecture

HEAAF comprises four layers, shown in Figure 1. The Behavioural and Contextual Data Layer continuously assembles evidence across eight semantic groups: keystroke dynamics (kd_dist, kd_speed_dev, kd_flight_var), device posture (dev_unknown, dev_risk), network and location (net_zone_risk, geo_novel, impossible_travel), temporal context (time_dev), access pattern (vol_z, no_care_rel), peer-group behaviour (peer_dev), session assurance (auth_age, fail_recent) and clinical context (res_sens, emergency). The partition is mutually exclusive and jointly exhaustive — asserted at import time and unit-tested, because the exactness and completeness guarantees of Section 4.4 depend on it — and is the unit at which the clinician-facing disclosure is made. The Adaptive Risk Evaluation Layer maps that evidence to a calibrated risk score. The Explainable Decision Layer (EDL) attributes the score across the eight groups in the same decision cycle. The Adaptive MFA Trigger converts score and attribution into one of four enforcement actions.

In ZTA terms [5], the risk layer and EDL constitute the policy engine, the MFA trigger is the policy administrator, and the EHR or IoMT gateway is the policy enforcement point.

4.2. Decision Problem

A session is a sequence of decision epochs. At epoch t the engine observes $x_t\in {\mathbb{R}}^d$, $d=16$, and selects $a_t\in \{allow,otp,strong,deny\}$. The episode terminates when the session ends, when a challenge contains an adversary, or on denial. Actions change the state the next request is judged in — a step-up resets the strong-authentication clock — so the problem is sequential rather than a sequence of independent classifications.

Writing $Q(x,a)$ for the action-value function learned by a Double DQN [40,41], the risk score is the calibrated advantage of challenging over allowing,

$$g\left(x\right)=\underset{a\ne allow}{max}Q(x,a)-Q(x,allow),$$

(1)

$$r\left(x\right)=\sigma \left(w·{\displaystyle \frac{g\left(x\right)-\mu }{s}}+b\right),$$

(2)

where $\sigma$ is the logistic function and $(w,b)$ are fitted by Platt scaling [42] on the validation split so that the number the policy thresholds — and the EDL attributes — is calibrated rather than an arbitrary margin [43].

The reward encodes the clinical asymmetry that motivates the design. A missed compromise costs $-(\mathrm{breach}\_\mathrm{base}+\mathrm{gain}\times s(x\left)\right)$, scaling with data sensitivity; a frictionless allow on benign traffic earns a small positive reward, so the agent is not rewarded for blanket suspicion; challenges carry a friction penalty graded by clinician time plus an additional penalty under declared emergency, with denial penalised far more heavily than a one-time code; and correctly challenging a compromised session earns a reward graded by how much of the session remains to be contained. The complete reward, hyperparameter and cost configuration is released as a single file rather than tabulated here, so it cannot diverge from the code that consumed it.

4.3. Policy Engine and Clinical Safety Valve

Let $s\left(x\right)$ denote data sensitivity and $E\left(x\right)$ flag a declared emergency context. With ${\tau }_{\mathrm{low}}<{\tau }_{\mathrm{high}}$, a sensitivity floor $\varphi$ and an emergency relief term $\rho$, and writing $\tilde{r}\left(x\right)=r\left(x\right)-\rho \mathbb{1}\left[E\left(x\right)\right]$:

$$a\left(x\right)=\left\{\begin{array}{cc}strong\hfill & \tilde{r}\ge {\tau }_{\mathrm{high}}\wedge E\left(x\right)\hfill \\ deny\hfill & \tilde{r}\ge {\tau }_{\mathrm{high}}\wedge \neg E\left(x\right)\hfill \\ strong\hfill & \frac{1}{2}({\tau }_{\mathrm{low}}+{\tau }_{\mathrm{high}})\le \tilde{r}<{\tau }_{\mathrm{high}}\hfill \\ otp\hfill & {\tau }_{\mathrm{low}}\le \tilde{r}<\frac{1}{2}({\tau }_{\mathrm{low}}+{\tau }_{\mathrm{high}})\hfill \\ otp\hfill & \tilde{r}<{\tau }_{\mathrm{low}}\wedge s\left(x\right)\ge \varphi \hfill \\ allow\hfill & \mathrm{otherwise}.\hfill \end{array}\right.$$

(3)

The valve has a specific semantics: under emergency context the system may escalate but may never deny. A clinician is never locked out of a resuscitation by an automated risk score; the worst case is a second factor. This is a structural guarantee, not an empirical tendency, and our test suite verifies it exhaustively over the whole risk range (Section 1.1). It implements R6 directly, and Section 6.1 isolates its effect.

4.4. Explainable Decision Layer

The EDL attributes the risk logit rather than the probability, so contributions combine on an additive scale, and uses a fixed clinical reference $\overline{x}$ — the median benign ward access — so every explanation is contrastive against stated routine activity rather than an uninterpretable zero vector [44].

Two games, not one

Let N be the sixteen features and $v\left(S\right)=f(x_S;{\overline{x}}_{-S})$ the characteristic function that switches a subset on against the reference. Exact Shapley values over N require $2^{16}=65,536$ evaluations. Let $\mathcal{B}=\{B_1,\dots ,B_8\}$ be the semantic partition (Section 4) and define the quotient game $\overline{v}\left(T\right)=v\left({\bigcup }_{k\in T}{B}_k\right)$ on eight players. Exact Shapley values of $\overline{v}$ require $2^8=256$ evaluations.

Algorithm 1:HEAAF decision cycle at one epoch

Require:  request $x\in {\mathbb{R}}^{16}$; agent Q; head $(w,b,\mu ,s)$; reference $\overline{x}$; thresholds ${\tau }_{\mathrm{low}},{\tau }_{\mathrm{high}},\varphi ,\rho$ 1: $Q_{\mathrm{vec}}\leftarrow Q\left(x\right)$▹ one forward pass 2: $r\leftarrow \sigma \left(w({max}_{a\ne allow}{Q}_{\mathrm{vec}}\left[a\right]-Q_{\mathrm{vec}}\left[allow\right]-\mu )/s+b\right)$ 3: $\Phi \leftarrow ExactGroupShapley(x,\overline{x})$▹$2^8$ states, one batched pass 4: $a\leftarrow PolicyEngine(r,x)$▹ Eq. (3) 5: if$E\left(x\right)$and$a=deny$then$a\leftarrow strong$▹ safety valve 6: end if 7: $u\leftarrow SubjectView(\Phi ,a)$▹ one group, 3 bands, no score 8: $v\leftarrow AnalystView(\Phi ,r,a)$▹ full signed vector 9: log$\langle x_{\mathrm{id}},a,r,\Phi ,u\rangle$▹ audit record 10: returna, u

It is tempting — and common — to compute feature attributions and sum them within blocks. That is not the same object. Writing v in the unanimity basis $v={\sum }_T{c}_T{u}_T$, block B receives ${\sum }_T{c}_T|T\cap B|/\left|T\right|$ by summation but ${\sum }_{T:T\cap B\ne \varnothing }{c}_T/\left|\overline{T}\right|$ in the quotient game, where $\overline{T}$ is the set of blocks T touches. For $\left|T\right|\le 2$ these coincide for every partition; they first diverge at $\left|T\right|=3$ when a term splits unevenly, for instance $2c/3$ against $c/2$ for a two-one split. Both remain complete, so the disagreement is purely in how credit is apportioned. Since a ReLU Q-network carries interactions of order above two, the divergence is real here, and Section 6.4 measures it. We report the exact quotient value as the disclosed quantity.

Cost and rendering

The 256 coalition states of one request form a single $256\times 16$ matrix, so the whole exact group attribution is one batched forward pass — which is why exactness is affordable inline, and why it is measured (Section 6.5) to be cheaper than a sixteen-step integrated-gradients approximation needing sixteen sequential backward passes. Attributions are rendered through templates into one line of clinical English, for example: “A one-time code was requested: the connection is coming from an unusual place. This was the main factor in the decision.” Section 7 explains why the subject sees one group and a band rather than a vector and a score.

5. Experimental Methodology and Simulation Design

5.1. Why Simulation, and What It Can and Cannot Support

The evaluation instrument is a simulation: a hybrid environment in which the behavioural channel is a real biometric corpus and the clinical context around it is generated by a documented stochastic model. We are explicit about this because the choice determines which claims are admissible. It is not a physical testbed, and no production hospital traffic, patient data or partner telemetry is involved.

Simulation is the necessary instrument here for three reasons, none of which a production access log satisfies. First, the central attribution claim requires ground truth about causation: every malicious event must carry the set of features the adversary actually perturbed, so an explanation can be scored against the causal mechanism rather than against another explainer. A real access log records what happened, not which signals an attacker moved. Second, the study requires control of the base rate and of confounding benign behaviour, so friction is measured against legitimate-but-unusual activity rather than an easy baseline. Third, evaluating denial under declared emergency requires generating emergencies deliberately, which cannot ethically be arranged in a live clinical setting.

The environment therefore supports relative comparison of policies under identical conditions, the form of every claim in Section 6: each policy sees the same events, at the same matched budget, over the same seeds. Absolute rates are properties of the generator, not estimates of hospital reality (Section 8). Two independent checks constrain the simulator rather than leaving it unfalsifiable: the behavioural channel must reproduce the published error rate of its verifier (Section 6.7), and the malicious base rate is fixed to the operational order of magnitude reported for clinical estates.

5.2. Behavioural Channel: Real Keystroke Dynamics

The behavioural channel is real. We use the CMU keystroke-dynamics benchmark [45]: 51 subjects typing the password .tie5Roanl 400 times across 8 sessions separated by at least 24 hours. Sessions 1–4 enrol the per-subject template, sessions 5–6 supply training and validation behaviour, and sessions 7–8 — the most template-aged — supply test behaviour. The split therefore contains genuine template ageing rather than a random shuffle, which is a stricter test than the shuffled evaluations common in the keystroke literature. The verifier is the scaled-Manhattan detector, the strongest of the fourteen algorithms in the original study; we reproduce its error rate as a sanity check and enforce it as a unit test (Section 6.7).

5.3. Clinical Context Simulator

No public corpus couples keystroke biometrics to clinical role, shift pattern, resource sensitivity and labelled insider compromise. The contextual, access-pattern and clinical channels are therefore generated around each real keystroke sample by a documented generator with an explicit parameter table, covering roles, three-shift rotas, device estates, ward geography and resource sensitivity. Each simulated access event draws a role and shift, samples a device and network location conditional on that role, derives temporal and peer-group deviation features against the role’s rolling profile, and attaches a sensitivity level and emergency flag to the requested resource; the real keystroke sample supplies the behavioural features unchanged.

Three properties of the simulation are load-bearing. Every malicious event carries a ground-truth driver set — the features the generator perturbed — which is what makes the attribution-grounding results of Section 6.4 possible. Adversaries carry a per-session stealth parameter and trip only a random subset of their scenario’s drivers, so the corpus contains both loud and quiet intrusions. And the benign class contains hard negatives — unrostered night cover, replacement workstations, locum first shifts, code-blue access, cross-ward cover, remote on-call — which are unusual and legitimate, so a false-positive rate measured here reflects clinical friction rather than an easy separation. Six attack scenarios are labelled and anchored to documented incident classes: stolen-credential remote login ($30\%$ of malicious events; Change Healthcare 2024), insider privilege misuse ($20\%$; NHS ICO enforcement cases), post-intrusion lateral movement ($17\%$; HSHS 2023), third-party account abuse ($13\%$; MCNA Dental 2023), IoMT gateway impersonation ($10\%$; Philips patient-monitor advisories [38]) and mid-session takeover ($10\%$; adversary-in-the-middle MFA bypass). Each declares a ground-truth driver set of three or four of the sixteen features, and complete driver sets are in the released configuration.

Table 2 summarises the resulting corpus. The malicious rate is deliberately near $1\%$ to reflect operational base rates; accuracy is therefore uninformative and we report G-mean, AUROC and operational friction instead.

5.4. Baselines

• B1-AlwaysMFA — challenge every access; the maximal reading of a mandatory-MFA rule.
• B2-StaticLogin — authenticate at the gate only; the Change Healthcare configuration.
• B3-RBA — a Freeman-style multiplicative risk-based engine [12], the design measured at scale by Wiefling et al. [15].
• B4-XAI-Static — a supervised random forest with post-hoc explanations, standing for the XAI-authentication literature [9,10].
• B5-RLAuth-style — a binary, bandit-formulated deep RL detector without a graded policy engine and without clinical cost terms [7].

Each baseline is evaluated with its own native decision rule. Running a baseline through HEAAF’s policy engine would transplant the contribution under test into the baseline and make the comparison vacuous. We additionally report budget-matched variants (suffix @budget) in which the threshold is moved so the baseline spends the same clinical friction budget, but the baseline keeps its own action mapping.

5.5. Operating Point and Metrics

Policies produce scores on incomparable scales, so comparing them at a shared numeric threshold is meaningless. A hospital does not buy a threshold; it buys an interruption rate. We therefore fix a clinical friction budget — the fraction of benign accesses that may be interrupted, set to $1\%$ — read each policy’s threshold off the validation split at that budget, and report detection at matched cost.

Beyond AUROC and G-mean we report: interrupt rate on benign traffic, interrupt rate on hard negatives, denial rate under emergency context (the patient-safety failure mode), session containment rate, median epochs to containment, expected calibration error, and an operational translation — department clinician-hours lost per year to authentication friction, obtained by weighting each action by its measured clinician-facing latency (8 s for a one-time code, 25 s for strong re-authentication, 45 s for a denial including the recovery path).

5.6. Statistical Protocol

Two distinct sources of variability matter and are reported separately.

Training variability is handled by repeating the entire pipeline over 8 independent seeds and reporting mean ± standard deviation; ablations use 5 seeds and the drift study 3, for compute reasons stated in each caption. Paired Wilcoxon signed-rank tests across seeds are released with the artefact; we note candidly that with 8 seeds the smallest attainable two-sided p is $0.0078$, so after Holm correction over twelve policies that test cannot reach significance for any effect, however large. No claim rests on it.

Test-sampling variability is the binding constraint: at a $1.07\%$ base rate a $70,000$-event split contains 749 malicious events. We use a stratified paired bootstrap [46] over test events, resampling positives and negatives separately so every replicate preserves the base rate, and pooling replicates across seeds so the interval carries both sources of variation. Because each metric is the mean of a $0/1$ indicator over a fixed stratum and both policies see the same events, a resample is described completely by a multinomial draw over the four joint outcome cells; sampling those counts is exactly equivalent to resampling indices and reduces cost from $O\left(n_{\mathrm{boot}}n\right)$ to $O\left(n_{\mathrm{boot}}\right)$. Multiplicity across the eight pre-specified contrasts is controlled with Holm–Bonferroni [47], valid under arbitrary dependence.

6. Results and Discussion

All numbers are produced by the released pipeline and written directly into this manuscript by a generation script, so no value here is transcribed by hand (Section 1.1). Results are reported in Section 6.1, Section 6.2, Section 6.3, Section 6.4, Section 6.5, Section 6.6 and Section 6.7 and discussed together in Section 6.8.

6.1. Main Comparison

Table 3 reports every policy at the $1\%$ clinical friction budget over 8 seeds. Any single row is one point on a curve; the full security–friction frontier, over which the supervised detector dominates and the RL score does not, is released with the artefact.

Table 3. Main comparison at a $1\%$ clinical friction budget, mean ± s.d. over 8 seeds. Bold marks the best value among policies that actually operate at the matched budget. B1/B2 are degenerate references, not competitors. Note that annual clinician-hours is not monotone in interruption rate, because the graded ladder substitutes short challenges for long denials.

Table 3. Main comparison at a $1\%$ clinical friction budget, mean ± s.d. over 8 seeds. Bold marks the best value among policies that actually operate at the matched budget. B1/B2 are degenerate references, not competitors. Note that annual clinician-hours is not monotone in interruption rate, because the graded ladder substitutes short challenges for long denials.

Four findings follow, and the first is a refutation of our own hypothesis.

The RL risk score is not the strongest detector

Our starting position was that an agent trained with clinically weighted rewards would learn a better risk ordering than a supervised detector. It does not. HEAAF’s RL score reaches AUROC $0.724\pm 0.046$ against $0.960\pm 0.001$ for the same architecture driven by a supervised random forest; the paired bootstrap puts the G-mean gap at $+0.378$, $[0.283,0.469]$, $p_{\mathrm{Holm}}=0.002$, and the TPR gap at $+0.493$$[0.397,0.582]$ (Table 4). The RL score is not even reliably better than a Freeman-style baseline at the same budget ($-0.080$, $[-0.170,0.015]$, not significant).

The explanation is structural rather than a tuning failure. The supervised detector receives a dense, per-event signal; the agent receives a sparse, delayed, heavily imbalanced reward at roughly a $1\%$ positive rate and must learn a ranking and a policy simultaneously. What it does learn is visible in the last row of Table 3: acting greedily on its own action-values it attains the highest containment in the table ($0.966$) at an interruption rate of $41.05\%$. It has learned that challenging is usually worth it, which is a statement about action value, not ranking. This is the asymmetry Bansal and Ouda observe when placing a supervised verifier ahead of an RL controller [8], and is consistent with RLAuth’s reported blind spot for attacks from known environments [7]. We therefore relocate the contribution of RL to the action layer and report the detector-agnostic variants as first-class results.

The policy engine is where the value is

Comparing rows RL agent, no policy engine and HEAAF isolates the engine: the same action-values, routed through the calibrated head, graded ladder and valve, move benign interruption from $41.05\%$ to $1.34\%$ and annual friction from $191.8$ to $6.4$ clinician-hours, converting an unusable controller into a deployable one.

The safety valve removes emergency denials outright

The cleanest test holds detector and budget fixed and varies only policy shape. HEAAF-SupervisedRisk and B4-XAI-Static@budget share the same random forest, budget and AUROC ($0.960$), differing only in what the policy does with the score. Denial under declared emergency falls from $1.099\%$ to $0.000\%$ — $-0.0109$, $[-0.0149,-0.0072]$, $p_{\mathrm{Holm}}=0.002$ — for a G-mean cost of $0.0050$$[0.0017,0.0095]$. Roughly one in a hundred emergency accesses is no longer blocked by an automated risk score, at half a percentage point of G-mean.

HEAAF’s own emergency denial rate is $0.000\%$ by construction: Eq. (3) cannot emit deny when $E\left(x\right)$ holds, and the test suite verifies this exhaustively across the risk range. The empirical comparison quantifies what the guarantee prevents; it does not establish it.

The graded ladder is cheaper than it looks

Annual clinician-hours are not monotone in interruption rate. HEAAF-SupervisedRisk interrupts more benign traffic than B4-XAI-Static@budget ($1.53\%$ versus $1.32\%$) and reaches the same detection ($0.707$ versus $0.714$ TPR, same containment $0.904$), yet costs $7.6$ rather than $26.5$ clinician-hours per year — a $3.5\times$ reduction — because the binary baseline can only deny, at 45 measured seconds, whereas the graded ladder answers most elevated-risk events with an eight-second code.

Table 4. Pre-specified contrasts, stratified paired bootstrap over test events with replicates pooled across seeds; Holm–Bonferroni over the eight rows. Negative differences favour the first policy for emergency denials.

Table 4. Pre-specified contrasts, stratified paired bootstrap over test events with replicates pooled across seeds; Holm–Bonferroni over the eight rows. Negative differences favour the first policy for emergency denials.

Where the effect is not significant, we say so

Contrasting HEAAF against its own no-valve ablation gives $-0.0012$, $[-0.0052,0.0000]$, not significant. This is not a failure of the valve but a consequence of the weak RL score: a valve forbidding denial matters only when the detector reaches the denial band, and the RL score rarely does. The valve’s value is conditional on detector strength, which the B4 contrast demonstrates directly.

6.2. Calibration

Platt scaling on the validation split keeps expected calibration error at $0.0018$ for the RL score and $0.0110$ for the supervised detector; reliability diagrams are released with the artefact. Calibration matters operationally because the friction budget is expressed as a threshold on the score: an uncalibrated score makes the budget unenforceable, which is exactly what the w/o risk calibration ablation shows once thresholds are re-derived (Section 6.6).

6.3. Per-Scenario Detection

Detection broken down by attack scenario gives an ordering that is informative and consistent across policies: noisy remote credential theft is easiest ($0.972$ for the supervised detector) and mid-session takeover hardest ($0.352$); the full per-policy breakdown is released with the artefact. That ranking is a property of the evidence, not of the classifier — a token-theft adversary who inherits an authenticated session on a known device from a known network perturbs few contextual features, and the residual signal is behavioural. It also matches the blind spot RLAuth reports for attacks from known environments [7], and is the case where our behavioural channel matters most.

Insider misuse ($0.558$) and IoMT impersonation ($0.702$) sit between these extremes. All three RL-driven policies degrade sharply on the quieter scenarios: the RL score detects $0.441$ of credential theft but only $0.031$ of IoMT spoofing.

6.4. The Explanation Need Not Be Approximate

This is the result we consider most transferable beyond authentication.

Table 5(a) is the conventional picture over sixteen features: exact Shapley costs $57.2$ ms and every practical method is an approximation on a cost–fidelity frontier. KernelSHAP-512 reaches $\rho =0.820$ at $4.86$ ms; integrated gradients reach $\rho \approx 0.62$ at $0.016$–$0.058$ ms. Grad×Input is fastest, least faithful ($\rho =0.544$), and has a completeness gap of $4.75$ — it does not decompose the score it claims to explain. Table 5(b) is the picture at the level a clinician actually reads, and it is qualitatively different: exact Shapley over the eight semantic groups costs $1.87$ ms per explanation in this benchmark and $0.44$ ms at the median when batched on the decision path (Section 6.5). Exactness is not a reference point here; it is the cheapest faithful option, and it is what HEAAF discloses.

Table 5. Attribution cost and fidelity. (a) Feature level, measured against exact Shapley over $2^{16}$ coalitions (300 instances, seed 0). (b) Group level — the quantity actually disclosed — measured against exact group Shapley over $2^8$ coalitions (500 instances, seed 0). Exactness is a reference point in (a) and the cheapest faithful option in (b).

Table 5. Attribution cost and fidelity. (a) Feature level, measured against exact Shapley over $2^{16}$ coalitions (300 instances, seed 0). (b) Group level — the quantity actually disclosed — measured against exact group Shapley over $2^8$ coalitions (500 instances, seed 0). Exactness is a reference point in (a) and the cheapest faithful option in (b).

Figure 2. Cost against fidelity. (a) At the feature level exactness is a 57 ms reference point and every method is an approximation. (b) At the group level — the disclosed quantity — exactness costs $1.9$ ms in this benchmark and dominates every approximation. Block-summed exact feature Shapley is $28\times$ more expensive and disagrees with the group value it is meant to stand in for.

Figure 2. Cost against fidelity. (a) At the feature level exactness is a 57 ms reference point and every method is an approximation. (b) At the group level — the disclosed quantity — exactness costs $1.9$ ms in this benchmark and dominates every approximation. Block-summed exact feature Shapley is $28\times$ more expensive and disagrees with the group value it is meant to stand in for.

Block sums are not group Shapley values

Summing exact feature-level Shapley values into blocks — the standard shortcut — attains Spearman $\rho =0.928$ against the exact group value, recovers the dominant group in only $87.0\%$ of cases, and carries relative $L_1$ error $0.203$, while costing $53.3$ ms against $1.87$ ms. Both quantities are complete, so this is not an approximation error in the usual sense but a genuine disagreement about how credit is apportioned, exactly as Section 4.4 predicts. Practitioners who aggregate SHAP values into groups for readability are reporting a different quantity from the group Shapley value, and here the two disagree on the headline factor roughly one time in eight.

Approximation degrades faster at the group level

Integrated gradients transfer poorly under aggregation: IG-32 reaches only $\rho =0.629$ against the group ground truth with top-1 agreement of $0.604$, and its completeness gap ($0.252$) is now visible against a target that has none. Since the disclosed statement names one group, top-1 agreement is the operationally relevant figure, and $0.604$ means a cheap explainer would name the wrong dominant factor in two cases out of five.

Do the explanations point at the true cause?

Because the simulator records which features each attack perturbs, attribution can be scored against the causal mechanism rather than against another explainer. The exact group attribution names a true driver group as the single dominant factor in $69.7\%$ of malicious events and places one in its top two in $84.7\%$. At the feature level, the top-3 attribution recovers at least one declared driver for $91.1\%$ of malicious events, ranging from $85.7\%$ (insider misuse) to $100\%$ (mid-session takeover) The mean attribution signature also differs per scenario in the direction the generator intends — session assurance dominates IoMT spoofing, peer-group deviation mid-session takeover, access pattern insider misuse — which is the property an investigator needs when triaging an alert; per-scenario signature heat maps are released with the artefact.

6.5. Decision-Path Latency

Measured over 200 repetitions on a single CPU core with no GPU, risk scoring costs $0.0012$ ms, the policy engine is free to three decimal places, and the exact group attribution over eight groups costs $0.436$ ms at p50 ($1.028$ p95, $1.448$ p99). The headline is that the exact explanation is cheaper than the approximate one: a complete end-to-end decision — score, explain, apply policy — costs $0.611$ ms at the median with exact group Shapley and $1.214$ ms with sixteen-step integrated gradients. The reason is architectural rather than algorithmic: the 256 coalition states form one $256\times 16$ matrix scored in a single batched forward pass, whereas integrated gradients require sixteen sequential gradient evaluations whose per-call overhead dominates at batch size one. At p99 the exact path costs $0.748$ ms against $1.528$ ms, three orders of magnitude inside the ∼500 ms threshold at which interface latency becomes perceptible. Explanation is not the bottleneck in this design, and there is no efficiency argument for disclosing an approximation.

6.6. Ablations

Table 6 removes one component at a time. Every arm is given the threshold that spends the same $1\%$ friction budget on validation, so the comparison is “same cost to clinicians, how much security do you get” — an earlier version compared arms at a fixed threshold, which conflated components that improve ranking with components that merely shift the score distribution.

Both evidence channels contribute, and the contextual channel contributes more ($\Delta =-0.221$) than the behavioural channel ($\Delta =-0.113$), consistent with four of six scenarios being primarily contextual; this supports R5, that neither channel alone is sufficient. Sequential credit assignment contributes modestly ($\Delta =-0.015$), weaker evidence for the sequential formulation than we expected and consistent with the finding that the RL layer is not where detection comes from.

Three arms deserve honest comment because they do not support the design. Removing the graded ladder improves G-mean ($+0.034$): collapsing four actions to allow/deny concentrates the same friction budget into denials, which contain more sessions. G-mean does not see the cost of doing so; the clinician-hours and emergency-denial columns do. Removing clinical cost terms also nudges G-mean up ($+0.010$, well inside one standard deviation) — the reward’s clinical weighting buys patient-safety behaviour, not raw separability. Removing risk calibration changes G-mean by $-0.000$, because once thresholds are budget-matched calibration is a monotone reparameterisation and cannot change the ranking; its value is that the budget becomes expressible at all and that the number the EDL attributes is a probability rather than an arbitrary margin. We report these null and adverse results rather than dropping the arms, and read them as a caution against optimising a single scalar.

The safety-valve arm is the only one that moves the patient-safety metric: emergency denials rise from $0.000\%$ to $0.080\%$ when it is removed, at essentially unchanged G-mean.

6.7. Template Ageing

Behavioural templates decay. Enrolling on sessions 1–4 and testing on progressively later sessions, keystroke EER rises monotonically from $0.0825$ at session 5 to $0.1028$ at session 8 — a relative increase of $24.6\%$ across four sessions. Our session-7–8 figure of $\approx 0.10$ is consistent with the $\approx 0.096$ Killourhy and Maxion report for scaled Manhattan [45], which is the sanity check that the behavioural channel is wired up correctly; we make this a unit test rather than a claim (Section 1.1).

The end-to-end effect is far smaller: HEAAF’s G-mean moves within its seed noise across session blocks (full figures over 3 seeds are released with the artefact), because multi-channel fusion absorbs behavioural decay — contextual, temporal and access-pattern evidence do not age on the same clock. This is an argument for fusion and simultaneously a caution: a system relying on keystroke evidence alone would require re-enrolment on a schedule this experiment suggests is measured in weeks.

6.8. Discussion

Read together the results support the four contributions of Section 1.1 and carry three implications we think generalise past this system.

The policy layer, not the classifier, is where clinical safety is won. The largest effect in the study is not a detection improvement but the transformation of the same RL action-values from a controller interrupting $41.05\%$ of benign traffic into one interrupting $1.34\%$, together with the elimination of emergency denial at a G-mean cost of $0.005$. Two systems with the same ROC curve — HEAAF-SupervisedRisk and B4-XAI-Static@budget share an AUROC of $0.960$ — impose $7.6$ and $26.5$ clinician-hours of annual friction respectively. A literature that ranks adaptive-authentication systems by detection metrics alone cannot see that difference, and it is the difference a hospital pays for. It is also why we report the ablation in which removing the graded ladder improves G-mean: a single scalar is the wrong instrument.

Grouping changes what is affordable, not merely what is readable. Semantic grouping is usually presented as a convenience, but it changes the feasible set: at sixteen features exactness costs $57.2$ ms and every deployable method is an approximation, whereas at eight groups exactness costs $0.44$ ms on the decision path and dominates every approximation on both fidelity and latency. The corollary is a warning. Because block-summed feature attributions are a different quantity from the group Shapley value — disagreeing on the dominant factor in $13\%$ of decisions here — practitioners who aggregate SHAP values into groups for readability, including in recent security applications [17,18], are reporting something other than the group value, and can compute the correct quantity more cheaply once the partition is small.

Reinforcement learning earns its place in the action space. Our negative result is not that RL is unsuited to authentication, but that a sparse, delayed, $1\%$-positive reward is a poor substitute for per-event supervision when the task is ranking. The agent nonetheless attains the highest containment in Table 3 acting greedily on its own action-values. The constructive reading, consistent with Bansal and Ouda [8], is a division of labour: supervise the score, learn the policy.

Governance follows from the architecture. Under the EU AI Act [48] a system of this kind in a clinical setting is plausibly high-risk, attracting obligations on risk management, logging, transparency and human oversight; under UK GDPR and the NHS Data Security and Protection Toolkit [1], per-decision attributions provide the evidence trail that access controls are risk-proportionate. Three properties address these directly: attributions are generated at decision time and stored with the decision, satisfying record-keeping without post-hoc reconstruction from a retrained model; the graded ladder and valve keep a human in the loop by construction, since the strongest action against a clinician in a declared emergency is to request a second factor; and role-scoped disclosure separates the transparency duty owed to the data subject from the completeness duty owed to the regulator.

7. The Explanation Channel as an Attack Surface

Every explanation returned to a challenged user is information returned to whoever is at the keyboard, adversary included. The XAI-authentication literature does not treat this as a design constraint [9,10], but the wider XAI-security literature is unambiguous that it should: attributions leak membership [33], Shapley vectors permit reconstruction of private inputs [34], post-hoc explainers can be actively fooled [35], and the surface is now surveyed [36,37,49].

Authentication is the sharper case. Unlike a loan applicant, an adversary here controls the very features being attributed, can issue many probes, and receives feedback each time. A signed per-feature attribution vector paired with a numeric score is close to a gradient oracle: it identifies which coordinate to change and in which direction, and repeated probing reduces evasion to hill-climbing — the threat model Agrawal et al. demonstrate against touch-based continuous authentication [50].

HEAAF resolves the tension between the transparency duty and this leakage by refusing to emit one explanation, projecting the same attribution vector differently per audience. The subject being challenged receives one dominant semantic group, named in clinical English, with a three-level magnitude band and no numeric score: measured over the test instances this releases 1 coordinate of 8, carries at most ${log}_2(8\times 3)=4.58$ bits per decision, and the named group accounts for $56.9\%$ of the positive attribution mass, so more than two-fifths of the evidence is undisclosed. The analyst receives the complete signed eight-vector, the calibrated score and the reconciliation against the clinical reference. The audit record receives everything, written at decision time; because the justification is generated inside the decision cycle (Figure 1) it cannot later be reconstructed from a retrained model, which is what makes it admissible as a record of why that decision was taken.

Three caveats. Coarsening reduces the leak rate but does not eliminate it, and an adversary who can force many challenges still accumulates information; rate-limiting disclosure per subject per interval is a natural companion control, not evaluated here. We quantify the channel but do not run an adaptive adversary against it, the most important piece of future work this design implies. And coarsening trades against the GDPR Article 22 interest in meaningful information about automated decision-making [51]: our position is that the subject receives a meaningful reason and the regulator the complete record, but this is a defensible design choice rather than a settled legal question.

8. Limitations and Threats to Validity

Several of these bear directly on how far the results generalise.

The clinical context is simulated. The behavioural channel is the real CMU corpus with a genuine ageing split, but role, shift, device, geography, resource sensitivity and attack labels come from a parameterised generator (Section 5.1). Absolute rates are therefore properties of the generator, not estimates of hospital reality, and should not be quoted as such; what the simulation supports is relative comparison under identical conditions, which is what every claim in Section 6 is.

Generator–detector circularity. Detectors are evaluated on data whose generative process is known to us. We mitigate this with per-session stealth parameters, partial driver activation and a hard-negative class designed to be unusual but legitimate, but the mitigation is partial, and the absolute detection rates in Table 3 would be optimistic on real traffic.

Single behavioural modality, and no adaptive adversary. The CMU corpus is fixed-text password typing on a desktop keyboard, whereas clinical workflows involve tablets, shared workstations, gloved hands and voice; free-text and touch dynamics carry different error characteristics, so our conclusions about the behavioural channel do not automatically transfer. Attacks are also drawn from a fixed taxonomy and do not respond to the defence: given that we return explanations to the person being challenged, an adaptive-adversary evaluation is the single most important missing experiment (Section 7).

Seed count and comparability. Eight seeds give a stable mean but a small sample for a rank test; as noted in Section 5.6 no claim rests on the seed-level Wilcoxon test, and all significance claims come from the event-level bootstrap. Separately, we do not compare against RLAuth’s published G-mean of $92.62\%$ [7]: our B5 is a faithful reimplementation of the formulation — binary, bandit-style, no clinical cost terms — evaluated on our corpus, not a reproduction of their result on different data with a different base rate and action space.

Cost parameters are illustrative. Clinician-seconds per action and breach costs are plausible published estimates, not measurements from a partner site. The $3.5\times$ friction reduction depends on the ratio between challenge and denial time, which we report explicitly in Section 5 so it can be re-derived under other assumptions.

9. Conclusion

We set out to build an adaptive continuous-authentication system that could justify itself inside the decision cycle and price patient safety explicitly, testing the hypothesis that reinforcement learning would supply the detection. That hypothesis was wrong, and we report it as such: a supervised detector inside the same policy engine gains $0.378$ G-mean $[0.283,0.469]$ over the RL-derived score. The contribution of the RL formulation lies in the action layer — routed through the calibrated head, graded ladder and safety valve, the same agent goes from interrupting $41.05\%$ of benign traffic to $1.34\%$.

Two positive results stand. The explanation disclosed to a clinician need not be an approximation: because sixteen evidence features partition into eight semantic groups, exact group Shapley values cost 256 coalition evaluations, run in $0.44$ ms, and make a complete decision with an exact justification cheaper ($0.611$ ms) than the same decision explained approximately ($1.214$ ms); and summing feature attributions into groups is a different quantity from the group Shapley value, disagreeing on the dominant factor about one time in eight — a caution applying wherever attributions are aggregated for readability. Second, an explicit clinical safety valve eliminates emergency denials: holding detector and friction budget fixed, denial under declared emergency falls from $1.099\%$ to $0.000\%$ for $0.005$ G-mean, and the graded ladder delivers the same detection at $7.6$ rather than $26.5$ clinician-hours of annual friction.

The wider lesson is that in clinical security the policy layer, not the classifier, is where safety is won or lost — and that a system which must explain itself to the person it is challenging should decide, in advance, how much it is willing to say. Future work follows from Section 8: an adaptive adversary against the disclosure channel, free-text and touch modalities, and validation of the generator against a partner site.