Joint Safety Stopping Rules

Why Separate Dose Safety From Trial Stopping?

A dose-finding trial needs an explicit response to accumulating safety evidence. Without a prespecified rule, the same toxicity data may prompt different decisions at different times, especially when efficacy results are encouraging. A posterior safety rule makes the evidence threshold transparent: it specifies how much posterior evidence that a dose exceeds an acceptable toxicity rate is enough to trigger a safety action.

A dose-level action and a trial-level action are not the same. A protocol might stop assigning patients to one dose while continuing at lower doses. It might terminate the whole trial only when every available dose is judged too toxic, or when a separate protocol-defined sentinel event occurs. The trial-level rule must state which action follows from each possible pattern of dose-level results.

For example, a protocol could suspend dose \(j\) when \(P(p_{T,j}>p_T^*\mid\text{data})>c\), and terminate the trial if all doses still available for enrollment meet that suspension criterion. Other protocols may impose a more conservative rule, such as stopping if even the lowest dose crosses its boundary. The operational rule must say exactly what happens to dose availability, enrollment, and the trial; a probability cutoff alone is not a complete stopping rule.

Model and Posterior Safety Probability

For a basic calculation, suppose toxicity is a binary outcome assessed within the same fixed window for every participant. At a given dose, assume outcomes from different participants are conditionally independent with a common toxicity probability \(p_T\). Use a beta prior \(p_T\sim\operatorname{Beta}(a,b)\), where \(a,b>0\). If \(x\) of \(n\) participants have toxicity, the likelihood is proportional to \(p_T^x(1-p_T)^{n-x}\), so the posterior is \(\operatorname{Beta}(a+x,b+n-x)\). This conjugate calculation assumes the endpoint and assessment window are consistently defined, and that the included participants have sufficiently complete toxicity follow-up for their outcomes to be classified.

Here \(F_{\operatorname{Beta}(r,s)}\) is the cumulative distribution function of a beta distribution with shape parameters \(r\) and \(s\). The posterior probability is a statement about uncertainty in \(p_T\), conditional on the model, prior, and observed data. It is not the probability that an individual patient will experience toxicity; that probability is \(p_T\), which remains uncertain.

When the posterior shape parameters are positive integers, a useful calculation identity is \(P(p_T>q)=P(Y\le r-1)\), where \(Y\sim\operatorname{Binomial}(r+s-1,q)\) and \(p_T\sim\operatorname{Beta}(r,s)\). This identity follows from the beta-binomial relationship between the beta cumulative distribution function and a binomial tail. It can be used to check software output or to calculate a tail probability by summing binomial probabilities.

The rule depends on more than the observed toxicity fraction. The prior, acceptable toxicity limit \(p_T^*\), cutoff \(c\), and timing of interim reviews all affect the action. These choices should be justified and assessed before the trial begins. In particular, \(c=0.90\) is not inherently correct: it is one possible operating threshold whose consequences need to be examined for the design and clinical setting.

From Dose-Level Boundaries to a Trial-Level Rule

A trial-level safety rule combines dose-specific probabilities with the design’s dose-availability policy. One clear construction is: mark dose \(j\) as unsafe for further enrollment if its posterior probability exceeds \(c\); remove marked doses from the set of available doses; and terminate the trial if that set is empty. The protocol can also specify a different stopping condition for a serious event or an independent clinical safety review. Such conditions should be explicit rather than improvised after seeing the data.

This rule is interpretable only if the dose model supplies meaningful posterior probabilities at all doses considered. In a model that borrows information across doses, the dose-specific posterior is conditional on that model’s assumptions about the dose-toxicity relationship. The dose-level boundary can still be applied, but the resulting probabilities are not independent evidence from each dose; they may change when data at neighboring doses change.

Correlated Efficacy and Toxicity: Interpret, Do Not Trade Away Safety

Efficacy and toxicity can be associated within patients. For example, participants with greater drug exposure might be more likely both to respond and to experience toxicity. A joint outcome model represents this dependence and can distinguish the marginal response and toxicity probabilities from the probability of particular paired outcomes. Association changes the interpretation of the joint pattern: high response among participants with toxicity is not the same pattern as high response among participants without toxicity.

A safety limit remains a constraint on toxicity. If the protocol defines \(p_T^*\) as an unacceptable marginal toxicity probability, favorable efficacy should not be inserted as a credit that permits a dose above that limit. A utility-based dose choice and a safety stopping boundary answer different questions. A dose may have attractive estimated benefit while still crossing the prespecified safety boundary. Conversely, association in the observed data does not by itself prove that efficacy causes toxicity, or that toxicity causes efficacy.

When a joint model links efficacy and toxicity parameters, efficacy observations may affect the posterior for toxicity through the model’s dependence structure or shared parameters. That is a feature of the specified likelihood and prior, not a reason to discard the safety criterion. The relevant comparison remains the posterior probability that the defined toxicity parameter exceeds its limit, using the full prespecified model. Analysts should report the dependence assumptions and check whether the safety conclusion is sensitive to them.

Assumptions, Diagnostics, and Alternatives

Before applying a posterior stopping rule, verify that the endpoint definition, dose labels, assessment window, and outcome coding are consistent. The beta-binomial calculation assumes a common toxicity probability for the participants represented at a dose. Strong patient heterogeneity, changing supportive care, dose modifications, or substantial dependence among outcomes can make that simple model inadequate. A dose-response model adds structural assumptions, such as smoothness or monotonicity, which should be examined rather than treated as facts.

Interim monitoring also requires careful handling of follow-up. A participant who has not completed the toxicity window cannot automatically be counted as having no toxicity. The rule must specify which outcomes are mature enough to use, or use a model designed for time-to-event or delayed outcomes. Otherwise, a dose may appear safer simply because its participants have had less time to experience the event.

Useful checks include reviewing dose-specific event counts and follow-up completeness, comparing posterior predictions with observed toxicity patterns, and examining whether reasonable prior choices or model assumptions change the stopping decision. A posterior probability close to \(c\) signals a decision sensitive to small changes in assumptions or data; it should not be presented as a categorical clinical truth. The trial’s operating behavior should also be assessed under plausible toxicity scenarios, including scenarios near \(p_T^*\), before the rule is used.

A posterior rule’s limitations follow from its inputs: it depends on prior specification, model fit, endpoint ascertainment, and the selected \(p_T^*\), \(c\), and review schedule. It does not guarantee that every dose retained is safe, nor that a dose removed would necessarily have exceeded the limit. A stopping action is a decision under uncertainty, not proof about the true toxicity probability.

Common Mistakes

• Treating an unmet boundary as evidence of safety. If the posterior probability does not exceed \(c\), the rule has not triggered; this is not the same as establishing \(p_T\leq p_T^*\).
• Stopping the whole trial whenever one dose crosses its boundary. That follows only if the protocol says so. A dose-specific suspension may leave lower doses available.
• Letting efficacy compensate for an unacceptable safety probability. If the safety limit is binding, favorable efficacy does not erase a safety-boundary crossing.
• Ignoring joint-model assumptions. Correlation can affect the posterior when the model links outcomes or parameters. State that model and assess sensitivity rather than assuming the marginal safety estimate is unaffected.
• Counting incomplete follow-up as no toxicity. Apply the protocol’s maturity rule or an appropriate delayed-outcome model; do not treat pending outcomes as observed negatives.