6 minute read

⭕ Part 2: HOTL (Human-On-The-Loop)

HOTL Banner

On the morning of August 1, 2012, Knight Capital’s order router pushed millions of erroneous orders into the market and lost more than $460 million in about 45 minutes. Before the open, an internal system had sent 97 automated error emails; they weren’t designed as alerts, and staff generally didn’t read them. There was no procedure to halt the router in response to its own aberrant activity [1].

Knight had people watching. What it lacked was a way to stop.

This is the sequel to Part 1: HITL (Human-In-The-Loop). Human-in-the-loop systems fail by starvation: the gatekeepers who make them safe also make them slow. Human-on-the-loop systems fail by poisoning: fast, quiet, and at scale. The test for which one you have: if every human went home for a long weekend, would the loop keep learning? In HITL, no. In HOTL, yes — and that is both the feature and the risk.

🕵️ You fired the gatekeepers. So who’s watching the loop?

In Part 1, it was the gatekeepers — not the users — who kept a HITL loop from closing. Two human gates made the system trustworthy and slow, and we called the bill Autonomy Debt.

HOTL pays it down the obvious way: it takes the humans out of the path.

  • Feedback is validated by code, not a curation team
  • Models are promoted by thresholds, not a governance meeting
  • Retraining runs on a trigger, not a calendar

The humans don’t leave. They move.

There’s an old automation joke — author unknown, in print in Datamation by 1978, and later popularized by Warren Bennis: the factory of the future will have two employees, a human and a dog. The human feeds the dog. The dog keeps the human from touching the equipment.

The same learning loop three ways: HITL with human gates on the loop, HOTL with humans observing from outside, and fully autonomous with nobody watching

A gatekeeper who dozes off stops the line. A watchdog who dozes off is just a dog.

👥 People design it, people watch it, nobody approves it

The term has receipts. The EU’s High-Level Expert Group on AI defines HITL as human intervention “in every decision cycle of the system” — which, it adds, “in many cases is neither possible nor desirable” — and HOTL as intervention “during the design cycle of the system and monitoring the system’s operation” [2].

Table: the five structural signatures of HOTL — automated validation, continuous learning, automated promotion, circuit breakers, asynchronous oversight

Mark Twain’s Pudd’nhead Wilson (1894) has the operating manual:

“Put all your eggs in the one basket and—WATCH THAT BASKET.”

HOTL is the first half of that sentence, done on purpose. The rest of this article is the second half.

🔍 Ranking: millions of decisions, zero reviewers

Recommendation finds candidate items a user is likely to value. Ranking scores those candidates and decides their order — the classic two-stage design behind large industrial recommenders [3]. Picture a platform with ten million technical articles, and a user searching for clustering algorithms.

Ten million articles narrowed to about 200 candidates, ranked to a top 10, with interactions fed back into training, validation and promotion

This is HOTL’s home turf: Part 1’s matching problem with the stakes turned down. A bad match there could cost a client; a bad ranking here costs a scroll. With millions of decisions a day and content stale within days, no curation team on Earth could keep up — so production systems stopped asking. Part 1’s model retrained on Tuesday nights. Google’s TFX paper describes models that are “continuously being updated” once launched, each update validated automatically against a fixed threshold and the current production model: fail, and it isn’t pushed and the team gets an alert [4].

⚖️ You’re not removing risk, you’re moving it

Table comparing HITL and HOTL: human role, default state, loop speed, scaling, bad input, failure style, accountability, signature cost

Catching problems after the fact only pays when the damage is bounded and reversible in the time it takes to notice. A results page qualifies. Knight’s order book did not.

🧪 Alignment Risk

This is Autonomy Debt’s mirror image. The ranker optimizes what it can measure — clicks — and clicks are a proxy for “this helped.” Worse, the loop trains on data its own rankings produced: what it shows shapes what users click, which shapes what it learns next [5].

A self-reinforcing loop: the ranker decides what is shown, users click what they see, clicks become training data, the model retrains on its own choices

Kent Beck, in Extreme Programming Explained (2000, p. 31), called optimism an occupational hazard of programming and feedback the treatment. He’s right — until the patient starts writing its own prescriptions.

This isn’t hypothetical. In 2012, YouTube re-pointed its recommendations from views to watch time, because features built to drive views had rewarded videos that attracted clicks, not videos that kept viewers engaged [6]. Note who made that call: humans.

🏛️ Where the gates went

🧬HOTL Architecture Infographic

Each station, and its job on a results page:

Table: how each component of the HOTL loop maps to ranking and recommendation

🛡️ Seven ways to watch that basket

Asimov gave his robots three laws, then spent decades writing about the gaps and conflicts between them. Here are seven, distilled from the references. Set expectations accordingly.

  1. Replace every gate — never just delete it. The EU guidelines are blunt: the less oversight a human can exercise, the more testing and governance the system owes [2]. Automated validation is the gate now.
  2. Halting must not need a human. Knight’s 97 unread emails were the alarm; what was missing was the breaker. Trip on metric thresholds automatically, and let the humans own the reset.
  3. “Stop” means a safe state. A tripped breaker that leaves a half-promoted model serving traffic hasn’t stopped anything. Fall back to the last known-good model and freeze training.
  4. Don’t bet on vigilance. Bainbridge, citing vigilance research, concluded that nobody can watch a quiet display effectively for more than about half an hour, so monitoring for unlikely abnormalities belongs to alarms [7]. Page people on anomalies; don’t expect them to spot one on a dashboard.
  5. Promote gradually, and rehearse the rollback. Canary first, and practice rolling back when nothing is on fire [8]. Martin Fowler’s rule for painful chores applies: do them more often, and they hurt less.
  6. Keep some feedback the model didn’t choose. Clicks favor whatever the ranker put on top. A small randomized slice of traffic lets you measure that bias and correct for it [9], and continuous random exploration slows the loop’s drift into an echo chamber [5].
  7. Humans own the objective. New weights can ship themselves. A new metric, a new data source, or a new definition of “good” goes through people.

🧑‍⚖️ HITL or HOTL? Ask per gate, not per system

Decision table: six questions for choosing between keeping a human gate (HITL) and automating it (HOTL)

Automate data validation but keep human sign-off on model promotion, and you have a hybrid — often the right first step.

🗝️ The questions Part 1 left hanging

  • Will it cause the AI uprising? No. The realistic HOTL failure is duller: a ranker that quietly learns clickbait pays, faster than anyone notices.
  • Will it make everybody’s lives better? It can — fresher models, faster learning, experts freed from rubber-stamping. But it’s only as good as its breakers.

HOTL closes the loop and keeps one hand on the brake. The gatekeepers are gone; the watchdog is you.

This is Part 2 of a series; Part 1 covered HITL. In Part 3, we take the watchdog away too. Then who watches the basket?

📖 References

  1. U.S. Securities and Exchange Commission. In the Matter of Knight Capital Americas LLC, Release No. 34-70694, 16 October 2013.

  2. High-Level Expert Group on Artificial Intelligence. Ethics Guidelines for Trustworthy AI. European Commission, 8 April 2019.

  3. Covington, Paul, et al. “Deep Neural Networks for YouTube Recommendations.” RecSys ‘16, 2016.

  4. Baylor, Denis, et al. “TFX: A TensorFlow-Based Production-Scale Machine Learning Platform.” KDD ‘17, 2017.

  5. Jiang, Ray, et al. “Degenerate Feedback Loops in Recommender Systems.” AIES ‘19, 2019.

  6. Meyerson, Eric. “YouTube Now: Why We Focus on Watch Time.” YouTube Official Blog, 10 August 2012.

  7. Bainbridge, Lisanne. “Ironies of Automation.” Automatica 19(6), 1983.

  8. Breck, Eric, et al. “The ML Test Score: A Rubric for ML Production Readiness and Technical Debt Reduction.” IEEE BigData 2017.

  9. Joachims, Thorsten, et al. “Unbiased Learning-to-Rank with Biased Feedback.” WSDM ‘17, 2017.

Steven Miers — git-steven.github.io

You May Also Enjoy