Integrated Civilizational Systems Model (ICSM) Version 4: Model Description and Validation

11. Introduction

The Integrated Civilizational Systems Model (ICSM) is the Department’s principal quantitative instrument for assessing how stresses in one critical system propagate into others. It is maintained by the Office of Strategic Risk Assessment (OSRA) under the Integrated Systems Modeling Program, with the Office of Advanced Artificial Intelligence (OAAI) responsible for the Computational Systems and AI module and the Office of Long-Term Systems Research (OLSR) responsible for the scenario design and decision-analysis layer that sits above the model.

This report describes version 4.0 of the model as baselined on 17 April 2026 under configuration identifier ICSM-4.0-B1. It is intended for technical reviewers, for the Model Review Panel, and for readers of the Department’s assessments who wish to understand how the model’s outputs are produced and where they should be treated with caution. It does not present projections. The model’s principal downstream application is the Department’s first Civilizational Systems Outlook, scheduled for October 2026, which will run a revised version of the model through a full probabilistic ensemble.

Lineage

Versions 1 through 3 of the model were developed between 2024 and 2025 by the analytic staff of the Interagency Task Force on Civilizational Continuity (ITFCC) and informed its final report, ITFCC-2025-07, Report on Long-Horizon Systemic Risk. Those versions were built rapidly and had three structural weaknesses identified by the Task Force’s own reviewers: modules exchanged data annually, which suppressed fast propagation; the computational and AI-dependent elements of infrastructure were represented only as a productivity term within the energy and manufacturing modules; and there was no formal calibration across modules. Version 4 is a re-architecture rather than an update. Approximately 70 percent of the v3 code base was retired, the coupling interval was shortened from one year to one month, and two modules — Computational Systems and AI, and Information and Communications — were built as first-class components.¹

What the model is and is not

ICSM is a structured, quantitative representation of the mechanisms by which critical systems support and constrain one another. It is designed to explore the space of plausible trajectories under stated assumptions and to identify the configurations of conditions under which the coupled system enters regimes of high stress. It does not predict specific events such as a particular market failure, conflict or outbreak; such events enter the model as stochastic shocks drawn from specified distributions. Its outputs are conditional on its structure, its parameters and its scenario assumptions, and are reported as distributions over ensembles rather than as single trajectories.

22. Model architecture

ICSM v4 comprises eleven process modules, a central coupler, a stochastic shock generator, and a diagnostics layer that computes the Composite Systemic Stress Index. Each module is a reduced-form process model: it represents the stocks, flows and capacities of its system at regional resolution using a combination of system-dynamics formulations, network flow solvers and, in two modules, populations of stylized agents. Modules are developed and tested independently against their own reference data before coupling.

The world is divided into 24 regions, defined to balance data availability against the need to separate regions with distinct exposure profiles. Inter-regional flows of energy carriers, food commodities, intermediate goods, capital and data are carried on a shared network layer of 4,812 nodes and 17,306 directed edges, representing ports, pipelines, transmission interconnectors, subsea cable systems, major data-center clusters and financial clearing arrangements in aggregated form.

Module summaries

Energy represents primary supply, conversion, storage, transmission and end use for electricity, liquid fuels, natural gas and solid fuels, with an explicit representation of grid balancing reserves and of the share of dispatch and balancing functions performed by automated control systems. Food and Agriculture tracks production of eleven commodity groups, input dependencies (nitrogen fertilizer, diesel, irrigation water, seed), stocks held at farm, national and trader levels, and international trade. Water computes basin-level supply and withdrawals by sector and passes cooling-water and irrigation constraints to Energy and Food and Agriculture.

Climate and Environment does not run a climate model. It samples from an emulator trained on archived climate model ensembles to produce regional temperature and precipitation anomalies and a hazard sequence of heatwaves, droughts, floods and tropical cyclones, whose intensity distributions shift with the global warming level. Finance and Trade represents sectoral balance sheets, sovereign and bank exposures, commodity and freight prices, and trade finance availability. Supply Chain and Manufacturing is a regional input–output system with 46 sectors, explicit inventory buffers, and concentration terms for 19 tracked inputs including leading-edge semiconductors, large power transformers and processed critical minerals.

Information and Communications represents network capacity, routing redundancy and failure states for terrestrial, subsea and satellite communications, and the payment and messaging services that depend on them. Computational Systems and AI represents installed compute capacity by class, its energy demand, and the degree to which control, optimization and decision functions in other modules are delegated to automated systems; its reliability parameters will be informed by the evaluation work of the Frontier System Evaluation Program. Public Health combines an epidemic compartment model with health-system capacity and labor-force effects. Governance and Social Cohesion estimates latent institutional capacity and public trust from observed indicators and translates them into the effectiveness of policy responses elsewhere in the model. Demography supplies population, age structure, labor force and migration.

33. Coupling and feedback structure

Modules do not call one another directly. Each exposes a defined set of exchange variables to the coupler, which advances the coupled system at a monthly interval, regrids regional and network quantities as required, and enforces conservation of physical quantities (energy, water, food mass) across module boundaries. Modules with shorter internal time steps sub-cycle within the coupling interval and report monthly aggregates together with within-month extremes, so that a ten-day grid emergency is not averaged away.²

Of the 110 possible directed couplings among eleven modules, v4.0 implements 63. Each implemented coupling is classified by mechanism. Physical couplings carry material or energy. Price and financial couplings carry prices, credit and capital. Control couplings carry the delegation of operational decisions from one system to another, principally from Energy, Finance and Trade and Supply Chain and Manufacturing to Computational Systems and AI. Institutional couplings carry the capacity of governments and organizations to respond. The control class is new in v4 and accounts for 9 of the 63 couplings.

Feedback loops

Automated loop enumeration on the module-level coupling graph identifies 214 distinct feedback loops of length five or fewer. Most are weak in the reference configuration. Sensitivity analysis using loop-gain estimates identifies seven that dominate the coupled behavior in at least one region under at least one scenario class; these are listed in Table 3. Loops are labelled R (reinforcing) or B (balancing).

Two structural features of v4 deserve emphasis. First, the strongest balancing loop, B2, runs through the Governance and Social Cohesion module, so the model’s capacity to recover from stress depends heavily on the least directly observed of its modules (see Section 9). Second, loop R1 has the shortest characteristic time of any reinforcing loop and is represented largely through within-month extremes. Tightly coupled, fast-acting loops of this kind are the class of structure that the systems literature associates with failures that propagate faster than operators can intervene.

44. Composite Systemic Stress Index

The Composite Systemic Stress Index (CSSI) summarizes the condition of the coupled system on a scale of 0 to 100. It is computed monthly at regional and global level. Each module reports a stress indicator sᵢ, constructed from two to five module variables that measure the gap between the demands placed on the system and its capacity to meet them, normalized against the distribution of that gap over a 1990–2019 reference period and transformed to a 0–100 scale. A value of 50 on a module indicator corresponds to the 97.5th percentile of the reference distribution.

The global index is CSSI(t) = 0.88 × Σ wᵢ·sᵢ(t) + 0.12 × S(t), where wᵢ are the module weights in Table 4 and S(t) is a synchrony term, also on a 0–100 scale, that rises when several modules are simultaneously above their own stress thresholds. The synchrony term exists because the historical record shows that simultaneous stress across systems is disproportionately associated with failures of response capacity; a linear weighted sum alone would treat three moderate stresses occurring together as equivalent to the same stresses occurring in sequence.³

The low weight on Climate and Environment does not imply that climate is unimportant. In ICSM, most climate effects reach the index through the modules they act on — crop losses through Food and Agriculture, cooling constraints through Energy and Water, heat mortality through Public Health. The module’s own indicator captures only the residual exposure to compound hazards. The model therefore treats climate primarily as a stress multiplier acting through other systems.

Weights were derived in two steps. A structured elicitation produced a distribution of weights for each module. A consequence-weighting exercise then estimated, using the uncoupled modules, the share of a common set of downstream harms attributable to stress in each module. The final weights take the elicited median and move it toward the consequence weight where the two disagree, constrained to the elicited 10th–90th percentile range. Replacing these weights with equal weights changes the reconstructed 2020 value by +0.8 points and the 2026 nowcast by −1.1 points.

The reconstructed historical index, computed by running the calibrated model with observed forcing, is approximately 31 in 2000, 38 in 2010 and 46 in 2020. The provisional nowcast for early 2026 is approximately 54, the first year-average value in the High band. The index has never been observed at or above 70 at global level within the calibration period.

55. Data sources

ICSM v4.0 ingests 3,412 time series and 61 static datasets. These are grouped into six classes for provenance tracking. Every series is registered in the program’s data catalog with its origin, license terms, transformation steps, vintage date and the module variables it informs. Inputs are frozen at baseline; the ICSM-4.0-B1 input snapshot has a data vintage of 31 March 2026.

Two data gaps shape the model’s uncertainty more than any others. The first is the extent of automated control in critical infrastructure, which is not collected systematically by any statistical system; v4.0 relies on a Departmental survey inherited from the ITFCC and on expert elicitation. The second is the set of indicators used for institutional capacity and trust, which are sparse, irregular in timing and not consistently comparable across regions.⁴

66. Calibration

ICSM v4.0 has 1,146 free parameters. Calibration proceeds in two stages so that the coupled calibration, which is expensive, is confined to the parameters that most influence coupled behavior.

In stage one, each module is calibrated independently against its own reference data with its exchange inputs prescribed from observations. Parameters are estimated by penalized likelihood where data allow and fixed at literature or elicited values otherwise. Stage one fixes 932 parameters.

In stage two, the remaining 214 parameters — predominantly coupling elasticities, buffer depletion rates, response lags and the latent-state parameters of the Governance and Social Cohesion module — are constrained jointly using Bayesian history matching. A Gaussian-process emulator is trained on coupled runs to approximate 38 calibration targets, and parameter regions whose emulated outputs are implausibly far from observations, after accounting for observation error, emulator error and an explicit allowance for model discrepancy, are ruled out. Five waves of history matching reduced the non-implausible region to approximately 0.8 percent of the initial parameter volume.⁵

From the final non-implausible region, 2,000 parameter sets were drawn and confirmed by full model runs. These plausible parameter sets, rather than a single best fit, are carried into all ensemble work. A scenario configuration combines exogenous assumptions (policy settings, technology trajectories, emissions pathway, shock-generator settings) with a sample of plausible parameter sets; parametric and scenario uncertainty are thereby represented jointly.

Calibration targets are weighted to avoid the model being tuned to the episodes later used for validation. Each historical episode in Section 7 is excluded from the targets of a corresponding leave-one-episode-out calibration, and the validation results reported there are computed from those held-out calibrations rather than from the full calibration.

77. Validation and hindcasting

Validation of a model of this kind cannot rest on a single test. The program applies four families of tests: structural tests (dimensional consistency, conservation, behavior under extreme parameter values), module-level tests against independent data, coupled hindcasts of historical stress episodes, and a decade-long free run. This section reports the coupled hindcasts and the free run.

Hindcast design

Each hindcast initializes the model from observed conditions twelve to eighteen months before an episode and runs forward with observed exogenous forcing (climate, policy rates, pandemic onset and similar externally determined events) while all internal propagation is left to the model. For the 2020–2022 episode, the arrival of the pathogen is imposed; the test is of the model’s representation of how health, labor, logistics, finance and governance responses interacted, not of whether the pandemic itself was foreseeable.

Skill is measured by the continuous ranked probability skill score (CRPSS) of the ensemble CSSI against a persistence reference (positive values indicate improvement on persistence, 1.0 is perfect), by the coverage of the ensemble 90 percent interval, and by the error in the timing and magnitude of peak stress.

Interpretation

Three regularities appear across the hindcasts. First, the model has positive skill against persistence in every episode, which indicates that its coupled structure captures propagation that a trend-following reference cannot. Second, the model peaks late and low: modelled peak stress arrives two to four months after the reconstructed peak and is two to four points lower. Diagnostic runs attribute most of the lag to the monthly coupling interval and to the smoothing of financial and logistics responses within the Supply Chain and Manufacturing module, and most of the magnitude bias to the synchrony term, whose coefficient is constrained by a calibration record that contains few episodes of simultaneous multi-module stress. Third, the 90 percent interval captures the reconstructed value 79–88 percent of the time, below its nominal coverage. The ensemble is under-dispersed.

The late-and-low bias means that, other things equal, v4.0 is more likely to understate than overstate the speed and severity of stress episodes of the kind that have occurred. Under-dispersion means that its probability statements are somewhat over-confident. Both findings are addressed in the planned revisions (Section 10.3).

88. Computational implementation

Module kernels are written in compiled languages and run under a common coupler and workflow layer that manages configuration, ensemble scheduling, checkpointing and provenance capture. Each ensemble member is a single, independent coupled run; ensembles are therefore embarrassingly parallel at the member level, and individual members parallelize across regions and across the network solvers of the Energy, Supply Chain and Manufacturing and Information and Communications modules. The Computational Systems and AI and Governance and Social Cohesion modules use accelerator-resident agent populations.

Production runs are planned to execute on ALPHA-1 at Continuity Research Facility Alpha in southern Nevada, whose site transferred to the Department in April 2026. ALPHA-1 comprises 9,216 accelerators with a peak of approximately 1.1 exaFLOPS in double precision, and a 410 PB parallel storage tier backed by a 1.6 EB tape archive. With a reserved partition of 1,536 accelerators, the planned 40,000-member production ensemble is expected to require approximately seven days of wall-clock time, leaving room for repeated ensembles during sensitivity analysis and review. Full archived output for every member will be retained on the parallel tier for the life of the corresponding Outlook and on tape thereafter.

Because Facility Alpha had not reached initial operating capability at the time of baselining, the history matching campaign and the validation ensemble reported here were executed on an interim allocation of shared federal research computing arranged during the ITFCC period. Migration to ALPHA-1 will be accepted only after a reproducibility test: bitwise reproducibility of a reference member, and statistical equivalence of a 1,000-member reference ensemble, assessed by two-sample tests on the monthly CSSI distribution at each of twelve lead times.⁶

99. Known limitations

The limitations below are those the program considers most consequential for interpretation of ICSM outputs. They are listed in approximate order of their estimated influence on the probability of entry into the systemic breakdown regime.

1. Extrapolation beyond observed regimes. As set out in Section 7, the model has been tested only at stress levels below the Critical band. Nonlinear behaviors that might emerge only at higher stress — threshold failures in institutions, abrupt changes in public behavior — are represented by assumption rather than evidence.
2. Governance and Social Cohesion calibration. The module’s latent-state formulation is identified from sparse and heterogeneous indicators. History matching constrains its parameters less tightly than those of any other module, and the module carries the strongest balancing loop (B2). In its review of the v4.0 baseline, the Model Review Panel identified this module as the principal open calibration issue.
3. Ensemble under-dispersion. Interval coverage of 79–88 percent against a nominal 90 percent indicates that structural uncertainty is under-represented.
4. Automation exposure data. The degree of automated control in critical infrastructure is estimated from survey and elicitation and changes faster than the survey is repeated.
5. Regional aggregation. Twenty-four regions conceal sub-national concentrations of exposure, including the concentration of particular manufacturing and data-center capacity in small geographic areas.
6. Policy reflexivity. Policy responses are represented through stylized response rules whose effectiveness depends on governance state. The model does not represent strategic adaptation by governments to the model’s own outputs, or deliberate adversarial action beyond stochastic shocks.
7. Weighting judgments. CSSI weights embody value judgments about the relative consequence of stress in different systems. Alternative defensible weightings shift the index by up to ±2 points at current levels.
8. Monthly coupling. Propagation faster than one month is represented through within-month extremes rather than resolved dynamics, contributing to the timing lag observed in hindcasts.

1010. Configuration management and review