A Perfect Fit to the Wrong Answer: The CausalTwin Approach to Correct-by-Construction Patient Twins

A patient digital twin should answer interventional "what-if" queries, but twins trained for distributional realism reproduce the confounded treatment outcome association in observational data and answer counterfactuals incorrectly; no distributional check detects this, because the failure lives in the model's causal structure. CausalTwin compiles a discovered temporal DAG into a neural structural causal model through a hard graph mask: each variable's equation receives only its true parents, making non causes provably inert (Proposition 1) and do(A=a) exact graph surgery rather than approximate conditioning. Counterfactuals follow from Monte-Carlo g-computation with decomposed aleatoric/epistemic uncertainty, each guarantee pinned by an automated test, so causal validity reduces to stated assumptions rather than implementation trust. We prove the masking and consistency guarantees and derive the exact bias under hidden confounding. Against the strong longitudinal causal baselines CRN, G-Net, the Causal Transformer, and CEVAE, CausalTwin is competitive on the tumour growth simulator and leads them $\sim 4\times$ on per patient accuracy on a MIMI-IV semi-synthetic benchmark with real ICU covariates and known effects ($\sqrt{\mathrm{PEHE}}$ 0.068 vs. 0.264/0.271); it degrades measurably, not silently, under hidden confounding and tolerates 10\% graph-discovery error gracefully ($\sqrt{\mathrm{PEHE}}$ 0.50$\rightarrow$0.53). On real MIMIC-IV, lacking a counterfactual oracle, we scope claims to fidelity and privacy (MMD 0.004, membership-inference AUC 0.53).