Dependence Changes the Meaning of Evidence

LESSON

Probability, Random Processes, and Statistical Thinking

004 25 min beginner

Dependence Changes the Meaning of Evidence

By the end of this lesson, you will be able to...

  • Calculate a conditional probability from a small joint table.

  • Distinguish independence from dependence and explain why shared causes create dependence.

  • Use Bayes rule as probability bookkeeping when new evidence changes a base rate.

Idea in one sentence: Evidence changes probability through a dependency model, so two observations cannot be multiplied safely until we know whether they share a cause.

Core Insight

Consider the notification client from the previous lessons: it sends an attempt, waits two seconds, and retries once after a timeout. Its possible complete histories are:

Outcome Meaning
A first attempt acknowledged
TA first attempt timed out, retry acknowledged
TT both attempts timed out

Lesson 001 used this toy distribution:

\[ P(A)=0.80,\qquad P(TA)=0.16,\qquad P(TT)=0.04 \]

The operations team now sees a first timeout. It asks:

Given that the first attempt timed out, how likely is the second attempt to time out too?

The answer is not the unconditional probability of TT, which is \(0.04\). We have learned something: the run is no longer in the full sample space. It is in the smaller set of histories that begin with T.

That is the role of conditional probability. It tells us how likely one event is after we restrict attention to another event.

The Small Situation: Evidence Arrives in Stages

Define these events:

From the outcome table:

\[ R=\{TA,TT\},\qquad F=\{TT\} \]

The probability of a retry is:

\[ P(R)=P(TA)+P(TT)=0.16+0.04=0.20 \]

The probability of a complete failure is:

\[ P(F)=P(TT)=0.04 \]

Once we know that a retry happened, only TA and TT remain possible. Of those retrying requests, \(0.04\) of all requests are TT and \(0.20\) of all requests use the retry. Therefore:

\[ P(F\mid R)=\frac{P(F\cap R)}{P(R)} =\frac{P(TT)}{P(TA)+P(TT)} =\frac{0.04}{0.20}=0.20 \]

Read the notation as “the probability of \(F\), given \(R\).” The vertical bar means that \(R\) is the information we already have.

Plain meaning:

After seeing a first timeout, one in five retrying requests fails again in this toy model.

Technical name:

For events \(A\) and \(B\), conditional probability is:

\[ P(A\mid B)=\frac{P(A\cap B)}{P(B)},\qquad P(B)>0 \]

The intersection \(A\cap B\) means that both events happen. We divide by \(P(B)\) because the new question is about the world in which \(B\) has already happened.

The Naive Multiplication

Suppose a teammate says:

“A timeout happens 20% of the time. Two timeouts should therefore happen with probability \(0.20\times0.20=0.04\).”

That calculation can be correct, but only under a model. It assumes that the second timeout probability remains \(0.20\) after the first timeout. In symbols:

\[ P(T_2\mid T_1)=P(T_2)=0.20 \]

For the toy distribution, the assumption happens to match the numbers:

\[ P(T_1\cap T_2)=P(TT)=0.04=0.20\times0.20 \]

But the arithmetic did not prove independence. It used independence as an assumption about the process.

This distinction matters because a shared cause can make observations move together. A congested service, a broken network route, or a regional outage can affect both attempts. After the first timeout, the second attempt may be much more likely to time out than it was before any evidence arrived.

A Worked Dependency Model: Healthy and Degraded Service

Make the shared cause explicit. Let the service be in one of two states during a request:

Assume the timeout probability for one attempt depends on that state:

Service state Probability of state \(P(T\mid\text{state})\)
Healthy \(H\) 0.80 0.05
Degraded \(D\) 0.20 0.50

The marginal probability of one timeout is found by considering both paths:

\[ \begin{aligned} P(T) &=P(T\mid H)P(H)+P(T\mid D)P(D)\\ &=0.05(0.80)+0.50(0.20)\\ &=0.04+0.10=0.14 \end{aligned} \]

So a randomly chosen attempt times out 14% of the time.

Now compare two attempts from the same request. Within each state, suppose attempts are independent once the state is fixed. The service state is still shared, however.

The probability of two timeouts is:

\[ \begin{aligned} P(T_1\cap T_2) &=P(T_1\cap T_2\mid H)P(H) +P(T_1\cap T_2\mid D)P(D)\\ &=(0.05\times0.05)(0.80) +(0.50\times0.50)(0.20)\\ &=0.002+0.050=0.052 \end{aligned} \]

If the attempts were independent based only on their marginal rate, we would predict:

\[ P(T_1)P(T_2)=0.14\times0.14=0.0196 \]

The shared degraded state makes two timeouts much more common: \(0.052\), not \(0.0196\).

The conditional probability makes the change visible:

\[ P(T_2\mid T_1)=\frac{0.052}{0.14}\approx0.371 \]

After seeing one timeout, the chance of a second timeout is about 37%, even though an unconditioned attempt times out only 14% of the time.

The evidence tells us something about the hidden state. A timeout is more plausible during degradation, so observing one timeout raises the probability that the service is degraded:

\[ \begin{aligned} P(D\mid T_1) &=\frac{P(T_1\mid D)P(D)}{P(T_1)}\\ &=\frac{0.50(0.20)}{0.14} =\frac{0.10}{0.14}\approx0.714 \end{aligned} \]

This is Bayes rule. It is not a magic predictor. It is a rearrangement of the joint-probability definition:

\[ P(D\mid T)=\frac{P(T\mid D)P(D)}{P(T)} \]

Plain meaning:

Start with a base rate for a possible cause, ask how likely the evidence is under that cause, then normalize across all possible causes.

In this example, one timeout moves the degraded-state probability from 20% to roughly 71%. That is why the next timeout is no longer an ordinary 14% event.

Independence Is a Model Claim

Two events \(A\) and \(B\) are independent when learning one does not change the probability of the other:

\[ P(A\mid B)=P(A) \]

When \(P(B)>0\), an equivalent form is:

\[ P(A\cap B)=P(A)P(B) \]

Independence is not the same as “the events look unrelated” or “the events happen at different times.” It is a claim about probabilities after conditioning.

Examples that may be approximately independent:

Examples that are often dependent:

The word “may” matters. Independence must be justified by the process or checked against data. It should not be inserted merely because multiplication is convenient.

Evidence and Base Rates: A Test Example

Transfer the same bookkeeping to a defect test. Suppose:

What is the probability that a build is defective after the test fails?

First compute the total probability of a failure:

\[ \begin{aligned} P(F) &=P(F\mid D)P(D)+P(F\mid\neg D)P(\neg D)\\ &=0.80(0.10)+0.10(0.90)\\ &=0.08+0.09=0.17 \end{aligned} \]

Then apply Bayes rule:

\[ P(D\mid F)=\frac{0.80(0.10)}{0.17}\approx0.471 \]

So a failing test makes a defect substantially more likely, but the probability is about 47%, not 80%. The 80% was the test's sensitivity, \(P(F\mid D)\). The question asks for the reverse direction, \(P(D\mid F)\). The base rate and false-positive path both matter.

The lesson is not “always distrust tests.” It is:

Name the direction of the conditional probability before interpreting evidence.

Trade-offs and Limits

Conditional probability gives a sharper answer after evidence arrives, but it also makes the model more expensive to state and maintain. This trade-off is deliberate: we define the conditioning event, preserve the direction of the question, and track shared causes that may change over time. An independence shortcut is cheaper to calculate, but it can understate correlated failures. Bayes bookkeeping does not identify the true cause by itself; it only updates the probabilities supplied by the model. The boundary appears when the state, base rate, or measurement process changes and the old conditional rates no longer describe current behavior.

Common Confusions

Confusion: \(P(A\mid B)\) is the same as \(P(B\mid A)\)

Why it is tempting: both expressions mention the same two events.

Better model: the condition changes the reference group. \(P(\text{failure}\mid\text{degraded})\) asks about failures among degraded runs; \(P(\text{degraded}\mid\text{failure})\) asks about degraded runs among failures.

Confusion: Multiplication proves independence

Why it is tempting: the product rule is short and familiar.

Better model: multiplication of marginals is valid only when independence is justified. With dependence, use \(P(A\cap B)=P(A)P(B\mid A)\).

Confusion: Independent means mutually exclusive

Why it is tempting: both ideas describe relationships between events.

Better model: mutually exclusive events cannot happen together. Independent events can happen together; learning one simply does not change the probability of the other. Non-trivial mutually exclusive events are dependent.

Confusion: A positive test result gives the test's accuracy as the posterior

Why it is tempting: sensitivity sounds like the probability we want.

Better model: keep the direction visible. Evidence updates a base rate through both true-positive and false-positive paths.

Check Your Understanding

Check: In the notification model, why is \(P(TT\mid R)=0.04/0.20\) instead of \(0.04\)?

Think first, then reveal.

Answer: Once a retry \(R\) is observed, the reference group contains only TA and TT requests. The conditional probability renormalizes the complete-failure cases within that smaller group.

Check: In the healthy/degraded model, why is \(P(T_2\mid T_1)\) greater than \(P(T_2)\)?

Think first, then reveal.

Answer: The first timeout is evidence that the shared service may be degraded. Degradation raises the chance of another timeout, so the conditional probability is larger than the marginal probability.

Check: A test fails. Which quantity answers “what is the probability the build is defective now”: \(P(F\mid D)\) or \(P(D\mid F)\)?

Think first, then reveal.

Answer: \(P(D\mid F)\). The condition is the evidence we observed: a failing test.

Practice: Audit an Alert Rule

An incident detector watches two alerts:

In a historical set of 1,000 comparable five-minute windows:

Answer:

  1. Estimate \(P(A)\), \(P(B)\), and \(P(A\cap B)\).
  2. Compare \(P(A\cap B)\) with \(P(A)P(B)\). Does the independence approximation look plausible?
  3. If \(A\) has already fired, estimate \(P(B\mid A)\).
  4. Name one shared cause that could explain the dependence and one additional measurement that would help distinguish it from coincidence.

Model answer

\[ P(A)=100/1000=0.10,\qquad P(B)=200/1000=0.20 \]
\[ P(A\cap B)=60/1000=0.06 \]

If the alerts were independent, the product of their marginal probabilities would be:

\[ P(A)P(B)=0.10(0.20)=0.02 \]

The observed joint rate, 0.06, is three times the independent estimate. That is evidence of dependence in this sample, although it is not by itself proof of a particular cause.

The conditional estimate is:

\[ P(B\mid A)=\frac{0.06}{0.10}=0.60 \]

A shared overloaded database, a traffic burst, or a common downstream dependency could produce both alerts. Useful follow-up measurements include request volume, service state, deployment timing, and whether the alerts came from independent components. The extra measurement should test the proposed cause rather than merely add another correlated symptom.

Connections

Lessons 001–003 built outcomes, random variables, distributions, expectation, and variance. This lesson adds the rule for updating a probability after evidence arrives. Lesson 005 will use simulation to make these differences visible across repeated trials, and lesson 006 will ask the learner to audit the whole model.

The track uses Bayes rule here only as conditional-probability bookkeeping. Priors, posterior computation, and latent-variable inference depth belong in the downstream probabilistic-modeling track.

Resources

Key Takeaways

PREVIOUS Expectation Is a Summary, Not a Promise NEXT Simulation Lets Randomness Move