Masks that calibrate themselves

The question

A Skipper-CCD counts single electrons in millions of pixels. Before any physics is extracted, analyses discard pixels with masks, each aimed at one problem: charge left behind during transfer, hits in the serial register, hot columns and pixels, photons emitted around high-energy tracks (the halo), clusters of low-energy events, and muons. Every mask has sizes and thresholds — a radius, a trail length, a rate cut — chosen by hand for one sensor, readout and site.

The working hypothesis: what transfers between sensors is not the numbers but the procedure used to choose them. So each mask was written twice: a fixed form with hand-set constants, and an adaptive form that measures its own sizes on the images it is applied to and sets its threshold by a false-positive rate (α = 0.01, corrected for the number of tests) or by measurable physical properties of the sensor.

How it was tested

A simulator that remembers where every electron came from

Each source of charge fills its own map, so a mask can be scored against exactly the events it should remove. Three sensors differ the way real deployments do. Their geometry, noise, dark rates, background rates and muon fluxes come from public measurements (SENSEI at SNOLAB and MINOS, Oscura sensors at the surface, SNO, PDG); defect populations are not published in a transferable form and are scenario values chosen to differ between sensors.

Three versions of every mask were compared on an independent test stack of each sensor: the oracle (fixed form tuned with the simulator's truth on that sensor), the transplant (the oracle constants of a different sensor) and the adaptive form, calibrated without truth. The figure of merit is S/√(S+B): surviving injected signal against surviving target background.

A check against real images

Before relying on anything, the public SENSEI SNOLAB data release was read and its single-electron rate reproduced: 1.39 × 10^-5 ± 1.1 × 10^-6 e−/pix/day against the published 1.39 × 10^-5 ± 1.1 × 10^-6 (pull -0.02).

Result 1 · How often the adaptive masks fire when there is nothing to find

50 independent runs of each of the three sensors with every defect the masks look for switched off, keeping what a real sensor cannot switch off: dark current, spurious charge, the injected signal, muon tracks and high-energy deposits. The stack-calibrated masks decide once per run of 2 images; the others decide per image. The test is two-sided, so a mask that is far more conservative than α is visible as well.

The muon mask is not in that table, and could not be: the five above are switched off by setting a defect rate to zero, while tracks are what a real sensor cannot switch off, and the halo is generated from their charge. Asked separately, on sensors with the tracks and the high-energy background switched off as well, it fired in 0 of 600 images (all three sensors, 200 images each), an upper limit of 0.018 at 95 %. Its threshold is physical rather than a tail probability — a cluster long enough, straight enough and carrying about the charge a minimum-ionising particle leaves crossing this sensor — so there is no α for it to match; what is measured is whether dark current can imitate a track, and at these exposures it cannot.

Result 2 · What a mask fires on when the defect present is not its own

The defect-free test above switches every defect off together, so a mask that fires on another mask's defect passes it unseen. Here each sensor is simulated with one defect at its preset value and the other four at zero, 15 configurations in all, 20 runs each, with the same chain of adaptive calibrations and the same things a real sensor cannot switch off. A mask that fires when its own defect is absent and another one is present is firing on the wrong thing.

The same question is asked of 60 mask-and-defect cells, so the bound a cell has to clear is taken at 99.92 % confidence rather than 95 %, which controls a 5 % chance of one false call over the whole grid. The hot-column row is compared with 0.02 rather than α, because it fires when either of two α-level procedures does. The 2 images of a run share the calibrations made on that run's stack, so for the two per-image masks they are not independent trials and the per-image interval is narrower than it should be. Counted one run at a time instead — a run counts as firing if either of its images did, which cannot invent a firing and throws the second image away — 6 of those 6 cells still fire. One caveat stands: a cell marked below as sitting at its detection floor fired the fewest times that could produce this verdict at all.

Of the 60 combinations in which the defect present is not the one the mask looks for, 7 fire more often than α allows and 53 are consistent with it. The largest is the low-energy clusters mask on the surface laboratory sensor when the only defect present is charge-transfer trails: it fires in 1.00 of trials and masks a median 0.121 of the image.

Result 3 · Transplanted constants can do harm; self-calibration avoids the large failures, at a cost

Figure of merit relative to the oracle of the sensor in the first column; median, with the range over seeds in brackets.

Result 4 · The same procedures on a real sensor

Everything above is simulated. Here the adaptive masks run unchanged on the 4 exposures of the public SENSEI SNOLAB release: a fourth sensor, real, with a geometry none of the presets has (3072 × 16 active superpixels, each binning 32 physical rows, so a step along a column is 32 times a step along a row). Nothing about it was tuned, and the release publishes its own mask, so where the two overlap they can be compared. The pairing of one of our masks with a bit of that mask follows the hypothesis tested against the release's own geometry earlier on this page.

Given only the images, the estimator measures a readout noise of 0.141–0.142 e, where the independent fit of the rate reproduction above, on the same files, gives 0.1413–0.1420 e, and a single-electron density that grows with exposure.

What the hot-column procedure finds. It flags 2, 4, 6, 7 columns as the exposure grows, and the sets are nested: each one keeps the previous columns and adds the next loudest. At the longest exposure the 7 columns with the highest rate of charged pixels are exactly the ones it flags, and every one of them lies inside the release's own bad-column mask; the next column down (1659, at 0.019 charged pixels per pixel) is in the release's mask and is not flagged, which is the conservative direction. Each flagged column carries 102 to 1830 times the charged-pixel rate of the columns left alone.

The two directions of agreement say different things, so both are here. Of what we flag, the release also flags 0.99–1.00: we stay inside their mask. Of what they flag, we flag 0.027–0.095: they mask far more than we do, 0.042 to 0.130 of the image against our 0.0007 to 0.0094. The first number is the easy direction — a procedure that flagged one true column would score 1.00 — and it rests on 2 to 7 column decisions, not on the hundreds of pixels it is counted over.

The trail calibration chose length zero on every exposure, which the expectation registered in PLAN.md did not predict. The reason is in the result file: the release blinds its hits, so a whole exposure holds 0, 70, 103, 844 trigger pixels. At the longest exposure the test does see the excess on the right side — 13 single electrons within 5 superpixels downstream of a trigger against 2 upstream, p = 0.0037 — but the corrected threshold is p < 6.3e-05. Part of that strictness is an artefact: the correction counts 80 distance blocks per direction, and on an image 16 rows tall only three of them can ever be filled. Correcting for the tests that can exist would ask for about 1.7×10^-3, which this p-value still does not meet, so the decision stands. The halo radius behaves the same way: 0 where there are no triggers, 25 column widths at the longest exposure.

What the checks caught

Every error below was found by a test or a diagnostic against the simulator's truth, fixed, and recorded.

• The pixel threshold of every “adaptive” mask was set from the simulator's true mean charge: truth leaking into the masks, and at the surface a threshold of 0.50 e that turned read noise into fake events. Found by an independent review; the threshold is now measured from each image's charge histogram and every result was re-run.
• The simulator redrew hot columns in every image, which would have invalidated every calibration on a stack.
• The hot-column mask flagged the innocent neighbours of each hot column (17 of them in a test).
• The halo test treated its reference rate as exact; a 4σ fluctuation gave a halo where there was none.
• At the surface no pixel is far from every muon track: the first halo calibration fell back to its largest radius and masked the whole image. It now compares each annulus with everything outside it.
• Crossing muons merged into wide clusters that the track criterion rejected (24 % of muon pixels missed); tracks cut by the image border were missed too.
• Hot columns were calibrated before charge-transfer trails, whose vertical trails from muons made 69 of 81 flagged columns false.
• On the real release the halo mask measured distance in superpixels, and a superpixel there bins 32 physical rows, so a radius of 15 covered the whole height of a 16-row frame. It hid the loudest column in the image from the hot-column calibration, which then did not flag it — the same cross-talk Result 2 measures, on real data. Found by a second independent review; distances now carry the pixel geometry.
• The fraction of the image masked was reported as the sum of five overlapping masks rather than their union, and only the flattering direction of the agreement with the release's own mask was in the prose. Same review.
• The one-defect-at-a-time verdict was applied to sixty cells at 5 % each, with no correction for their number; about one and a half would have been called by chance. The bound is now taken at a confidence corrected for the cells tested.
• In one seed the halo radius, chosen by significance alone, reached 125 px on the surface sensor and masked 99.9 % of the image. The radius now maximises a figure of merit estimated from the data within the significant range; all seeds were re-run, plus two seeds never used during development.

Limitations

• Defect populations (hot columns, trail lengths, serial hits, clusters) are scenario values, not measurements.
• One figure of merit; the oracle is tuned mask by mask, not jointly, so a combined adaptive mask can exceed it.
• Adaptive trail lengths are limited by the number of bright pixels in the calibration stack: they are short when data are few.
• The muon figure of merit counts pixels, which weighs every missed track pixel heavily.
• The adaptive muon mask uses the sensor's diffusion model and the minimum-ionising charge per length, and the simulated muons carry exactly that mean charge with no Landau tail, so its charge tolerance is tested against the model it was built from.
• The defects are switched on one at a time, which finds a mask firing on another single defect, but not what a mask does when several defects overlap in the same pixels.
• The oracle is the best fixed mask on a grid of parameters. Every seed passed a check that no optimum lies on an edge of its grid other than a physical bound (a length of zero, a factor of one), but the grid is still finite.
• An adaptive mask cannot tell injected signal from dark current, so it estimates signal as every uniform single electron; the evaluation counts only the injected signal. At the surface, where dark current is ~20 times the signal, the adaptive halo therefore chooses not to mask and reaches ~0.7 of the oracle. The figure of merit was not changed after this was seen (the no-mask reference and wider grids were added later, for other reasons).
• On the real release only four of the six masks can be checked at all: it publishes no counterpart to the low-energy-cluster mask, and its binned superpixels make the muon mask's geometry meaningless, so that mask was not run there.

Reproduce

uv sync --group dev
uv run python scripts/fetch_public_data.py
uv run pytest
uv run python analysis/reproduce_release_rate.py
uv run python analysis/check_release_mask_bits.py
uv run python analysis/adaptive_masks_on_public_data.py
uv run python analysis/null_false_positive_rates.py 50
uv run python analysis/muon_mask_null_rate.py 100
uv run python analysis/cross_defect_false_positives.py 20
for seed in 20260915 20260916 20260917 20260920 20260921; do
  uv run python analysis/compare_masks_across_sensors.py 4 --seed $seed --out results/compare_masks/seed_$seed
done
uv run python analysis/figure_release_rate.py
uv run python analysis/figure_null_rates.py
uv run python analysis/figure_cross_defect.py
uv run python analysis/figure_compare_masks.py
uv run python analysis/build_report.py
uv run python scripts/make_pdf.py

Every output has a .provenance.json sidecar with the script, git commit, input hashes, parameters and seed; PROVENANCE.md says how each result was checked.

What that reproduction covered, as of 2026-09-16, written by hand unlike every number above it, because it describes runs made outside this repository. Each was re-run in a fresh clone that shares nothing with the working copy but the commit and the pinned environment, and compared at a relative tolerance of 1e-9. Identical, largest relative difference zero: the rate reproduction, the mask-bit check, the defect-free test and the real-sensor result at the current commit; the muon-mask test in a second clone; all five seeds of the transplant result at the commit that froze it, whose code has changed since only inside a docstring; and the one-defect-at-a-time result, the slowest of them at about two and a half hours, re-run in a clone that had to be resumed after something killed it six runs in. Every analysis in this repository has therefore been produced twice, the second time somewhere that shares nothing with the working copy but the commit and the pinned environment.