Probability for Machine Learning

An abuse detector sends an API signup to manual review. On labeled signup data, it catches 95 percent of abusive signups. That number sounds reassuring until a reviewer asks a different question: when a signup is flagged, how often is it actually abusive?

If abuse is rare, even a modest false-alarm rate can fill the review queue with clean signups. That queue determines whether reviewers can keep up, so confusing detector recall with queue risk can turn into a costly operating decision.

Tracking that queue directly from raw counts gives you an intuitive anchor before touching any mathematical symbols. Once the mechanics of false alarms click, the definitions of sample spaces, random variables, conditional probability, and Bayes' theorem feel completely natural.^{[1]Reference 1Machine Learning: A Probabilistic Perspective.https://probml.github.io/pml-book/book0.html[2]Reference 2Pattern Recognition and Machine Learning.https://www.microsoft.com/en-us/research/publication/pattern-recognition-machine-learning/}

Start with the population

Suppose a fully labeled reference population contains 10,000 signups from one API signup surface. These are illustrative counts, not measured abuse rates. Pick one row uniformly at random, so every signup is equally likely to be chosen.

An abusive signup is one of 100 rows in this population, so its probability is a fraction:

$$P(\text{abusive}) = \frac{100}{10000} = 0.01$$

Read the result in plain language: before the detector says anything, 1 percent of signups are abusive.

That starting probability is the prior: the abuse rate before learning whether this signup was flagged. The posterior will be the probability after we observe that evidence.

The sample space, written $\Omega$, is the set of possible outcomes of our random pick: all 10,000 rows. An event is a subset of those outcomes. Let $A$ be the 100 abusive rows and $B$ the rows the detector flags. Probability assigns each event a value from 0 to 1; the whole sample space has probability 1.^{[3]Reference 3Deep Learning.https://www.deeplearningbook.org/}

For this example, frequencies are exact probabilities for a random pick from the reference population. Using them for future traffic adds an assumption: that traffic is sufficiently similar. Estimate its prior from a representative labeled sample, not just reviewed tickets. A queue selected by the detector overrepresents flagged signups and won't generally reveal the abuse rate among all signups.

Now reduce each selected signup to one bit: let Y = 1 when it's abusive and Y = 0 when it's clean. This is a random variable, a number whose value depends on which case you picked.

Its expectation is the probability-weighted average of its possible values. A 1 contributes with probability 0.01 and a 0 with probability 0.99:

$$E[Y] = 1 \times 0.01 + 0 \times 0.99 = 0.01$$

That 0.01 is the base rate written as an average instead of a fraction. A 0/1 variable like this is a Bernoulli variable, and its expectation is the probability of seeing the 1 outcome.

The average doesn't tell you what one pick looks like. Variance measures the average squared distance from the expectation, Var[Y] = E[(Y - E[Y])^2].

Here the 100 ones sit 0.99 above the mean, and the 9,900 zeros sit 0.01 below it. Weight their squared distances by their frequencies:

$$\text{Var}[Y] = 0.01(1 - 0.01)^2 + 0.99(0 - 0.01)^2 = 0.0099$$

For any Bernoulli variable with success probability p, this simplifies to p(1 - p). Here, variance describes the spread of individual 0/1 outcomes around the 1 percent average.

It isn't the same as uncertainty in an estimated rate or variation across product slices and repeated training runs. Later statistics chapters separate estimation noise from true distribution shifts.

The rows make this concrete: encode labels as 0s and 1s, and their mean must equal $P(\text{abusive})$. Before running the snippet, predict its last two lines from the prior and Bernoulli variance.

Evidence changes the question

Now let the detector provide evidence. Before looking at the posterior, predict what each rate is counting: the abusive pile, or the clean pile?

These are class-conditional rates. The true-positive rate, also called recall, asks: among abusive signups, what fraction are flagged?

The false-positive rate asks the parallel question for clean signups: what fraction are flagged anyway?

Once a flag arrives, product has to ask a different question:

Given that this signup was flagged, how likely is it abusive?

Notation makes the two questions visible:

Those lines aren't interchangeable. The first counts inside the abusive pile; the second counts inside the flagged pile.

Read the vertical bar as "given." What appears to its right determines which rows you count inside.

The detector catches 95 percent of abusive signups. Does that mean a flagged signup is 95 percent likely to be abusive?

Answer

No. "Catches 95 percent of abusive signups" is $P(\text{flagged} \mid \text{abusive})$. The product question after a flag is $P(\text{abusive} \mid \text{flagged})$. Those conditionals count inside different piles.

Count the flagged pile

Hold off on Bayes rule. Build the review queue directly from the two base piles.

Abusive signups:

$$100 \times 0.95 = 95$$

Clean signups:

$$9900 \times 0.05 = 495$$

Now put the flagged signups into one pile.

Pause before dividing: which source should dominate the flagged queue? Five percent sounds small, but it acts on 9,900 clean signups. That produces more rows than 95 percent of the 100 abusive signups.

Now divide the abusive rows by the full flagged pile:

$$P(\text{abusive} \mid \text{flagged}) = \frac{95}{590} \approx 0.161$$

A flagged signup is about 16 percent likely to be abusive, not 95 percent likely. Recall measured the detector inside abusive rows; posterior risk measures the queue after the detector filters everyone.

Make the accounting executable. This small program prints both source piles before it prints the posterior, so each denominator stays visible.

Why does a 5 percent false-positive rate create 495 false alarms but the 95 percent true-positive rate creates only 95 true flags?

Answer

The rates apply to different base piles. Five percent applies to 9,900 clean signups, giving 495 false alarms. Ninety-five percent applies to only 100 abusive signups, giving 95 true flags. Base rates decide which pile dominates.

The table fixes both the population and its detector outcomes, so its posterior is exact. If 0.95 and 0.05 instead describe chances for new signups, the realized counts will vary. The table's counts then describe expectations, not promises.

Simulate 100,000 independent new signups to see that variation. rng.random() draws a number between 0 and 1, so comparing it with 0.01 produces abuse about 1 percent of the time. A second draw applies the appropriate flag probability. The fixed seed makes this run reproducible.

Conditioning means narrowing the world

Conditional probability is a filter followed by a count. It changes which rows are eligible before you divide.

For $P(\text{abusive} \mid \text{flagged})$, first keep only flagged rows. The denominator isn't all 10,000 signups; it's the 590 signups that survived the filter.

Ask "among which cases?" before you divide. Conditioning throws away the 9,410 passed signups. Those 95 abusive flags sit inside 590 flagged rows, not inside 10,000 signups.

Joint and marginal probability

Once the filter is visible, name the other views of the same rows. A joint probability is the chance that two events happen together. In this population, 95 signups are both abusive and flagged, so:

$$P(\text{abusive and flagged}) = \frac{95}{10000} = 0.0095$$

A marginal probability is the chance of one event without splitting by the other. To get the marginal flag rate, add every row that can produce a flag:

$$P(\text{flagged}) = \frac{95 + 495}{10000} = \frac{590}{10000} = 0.059$$

These views are linked by one identity. When $P(B) > 0$, conditional probability is the joint probability divided by the probability of the world you conditioned on:

$$P(A \mid B) = \frac{P(A \text{ and } B)}{P(B)}$$

Read in the other direction, the same identity gives the multiplication rule: a joint probability is a conditional probability times the probability of its conditioning event.

$$P(A \text{ and } B) = P(A \mid B)\,P(B) = P(B \mid A)\,P(A)$$

Check it against the counts: $P(\text{abusive} \mid \text{flagged}) = 0.0095 / 0.059 \approx 0.161$, the same posterior as before.

Bayes rule after the counts

The count is clear now, so give it a compact name. Bayes' theorem, also called Bayes rule, is the formula version of the flagged-pile count.

For events $A$ and $B$ with $P(B) > 0$:

$$P(A \mid B) = \frac{P(B \mid A)P(A)}{P(B)}$$

For this example:

When $B$ is the observed evidence, $P(B \mid A)$ is its likelihood under hypothesis $A$. It asks how compatible a flag would be with the hypothesis that the signup is abusive. Bayes rule combines that compatibility with the prior to obtain the posterior.

The denominator $P(B)$ is the marginal probability of a flag: how often a flag happens at all. It must include both source piles, weighted by how common abusive and clean signups are:

$$P(B) = P(B \mid A)P(A) + P(B \mid \text{not }A)P(\text{not }A)$$

Before substituting, predict what belongs in the denominator: only true flags, or every flag? Both source piles belong there:

$$P(B) = 0.95 \times 0.01 + 0.05 \times 0.99 = 0.059$$

With that denominator in hand, compute the posterior:

$$P(A \mid B) = \frac{0.95 \times 0.01}{0.059} \approx 0.161$$

Same answer as the count table. Bayes rule is the compact form of the same accounting: track where the flagged signups came from before you divide.

Likelihood compares explanations for observed labels

Probability starts with a candidate rate and asks what outcomes it could produce.

Likelihood starts with labels already observed and compares candidate rates as explanations for those labels. The expression can look identical because the quantity being varied is different.^{[1]Reference 1Machine Learning: A Probabilistic Perspective.https://probml.github.io/pml-book/book0.html[2]Reference 2Pattern Recognition and Machine Learning.https://www.microsoft.com/en-us/research/publication/pattern-recognition-machine-learning/}

Suppose reviewers label three flagged signups [abuse, clean, abuse]. Assume the labels are independent, so knowing one label doesn't change the probabilities for the others, and all share candidate abuse rate $p$. Here $p$ describes the flagged queue, not all signups.

Try $p = 0.80$. The probability of this ordered sequence is $0.80 \times 0.20 \times 0.80 = 0.128$. Holding the labels fixed and varying $p$ gives the likelihood:

$$L(p) = p \times (1 - p) \times p = p^2(1-p)$$

Of these three candidates, 0.80 has the largest likelihood, just ahead of 0.50. It isn't the best value over every possible $p$: the maximum occurs at the observed fraction, $p = 2/3$. The table also doesn't say there's a 12.8 percent chance that $p = 0.80$. Likelihood isn't a probability distribution over candidate rates.

With many labels, multiplying likelihood terms or summing their log values leads to maximum-likelihood training, which Statistics and Uncertainty names explicitly.

Independence means no update

If a flag appears at the same rate in abusive and clean signups, predict whether it should update your belief. It shouldn't: equal rates carry no information about the event.

When $P(B) > 0$, seeing $B$ leaves the probability of $A$ unchanged if the events are independent:

$$P(A \mid B) = P(A)$$

Start with a broken abuse detector:

Out of 10,000 signups, this detector produces:

The flagged pile is still 1 percent abusive:

$$\frac{20}{2000} = 0.01$$

Independence holds here because $P(A \text{ and } B) = 20 / 10{,}000 = 0.002$ equals $P(A)P(B) = 0.01 \times 0.20$. Independent events can still happen together; mutually exclusive events can't.

This detector creates review work without changing the queue's abuse rate.

Make that prediction executable: when both classes are flagged at 20 percent, expect the posterior to equal the prior and the update to be zero.

A detector flags 20 percent of abusive signups and 20 percent of clean signups. What should happen to your belief after seeing a flag?

Answer

It should stay at the prior. The flag appears at the same rate for both groups, so it doesn't distinguish abuse from clean signups. The evidence is independent of the event.

Same detector, different world

Freeze detector performance first:

Change only the population. Before reading the posterior column, predict which world makes a flag most trustworthy.

Detector performance stayed fixed; the traffic mix changed. The same detector produces a 16 percent posterior in a 1 percent-abuse world and a 95 percent posterior when abuse is already half the traffic.

That shift can happen across traffic sources or time periods. Holding both detector rates fixed isolates the effect of the base rate; real traffic shifts can change all three rates. Remeasure them before carrying an old queue policy forward.

The detector's true-positive and false-positive rates stay fixed, but abuse base rate rises from 1 percent to 10 percent. Why does the posterior after a flag rise?

Answer

The true-flag pile gets much larger because abusive signups are more common. The false-positive rate didn't change, but it now applies to a smaller clean share of the population. More of the flagged pile is made of true abuse.

A posterior function that matches the table

Turn that accounting into a reusable function. Its flow follows the table: validate each probability, form the true-flag and false-flag masses, then divide true flags by all flags.

Before running the sweep, predict its shape. The detector stays fixed while the prior moves from 1 percent to 50 percent, so the posterior should rise.

Put this in probability_demo.py; it rejects invalid probabilities and zero-probability evidence so undefined decisions surface early.

The invalid prior is rejected instead of silently clipped. The final call represents a detector that never flags anyone. Conditioning on its flag is undefined because the denominator is zero; returning the prior would invent an answer.

A threshold changes two probabilities at once

A detector can emit a score rather than just a flag. A threshold turns that score into review evidence: flag when the score exceeds the threshold. On the same scored dataset, raising the threshold can only remove signups from the queue. Recall and false-positive rate can't increase, but precision needn't improve at every threshold.

Use this illustrative measurement table for the same 1 percent abuse population. In a real system, measure both rates on labeled data rather than treating them as permanent detector properties.

At 10,000 signups, broad review catches 95 abusive signups and falsely flags 495 clean ones. Strict review catches 80 and falsely flags 99, producing a queue of 179. Its abuse fraction is $80/179 \approx 44.7\%$.

Run both policies through the same accounting. Review rate is the fraction of all signups flagged; precision is the fraction of that queue that is abusive. This helper assumes its three inputs are valid probabilities.

The stricter policy sends fewer signups to review and raises the abuse fraction in that queue, which is precision. It catches fewer abusive signups, so recall falls.

That is the precision-recall tradeoff shown by the output.

Probability exposes the options; product cost and safety policy choose between them. A reviewer team may value queue cleanliness, coverage, or both.

A threshold can also send no signups to review. Then queue precision is undefined because no flagged pile exists, so code should reject or explicitly represent the empty queue instead of dividing by zero.

A score isn't automatically a probability

A model may emit a score such as 0.80 instead of a thresholded flag. Before treating it as risk, ask: among similarly scored signups, what fraction is actually abusive?

A model is calibrated for this event and population when cases assigned a given probability have a matching event frequency. For scores near 0.80, we'd expect an abuse fraction near 80 percent across sufficiently many comparable signups. This is a group-level property, not a guarantee about any one signup.

Guo et al. found that then-standard image classifiers could achieve high classification accuracy while their confidence estimates were poorly calibrated.

Measure the match; a number in $[0, 1]$ isn't enough to establish calibrated risk.^{[4]Reference 4On Calibration of Modern Neural Networkshttps://arxiv.org/abs/1706.04599}

Inspect one small score bucket. Its six labels contain three abusive signups. Compare that observed fraction with the average score, then express the difference in percentage points.

Six signups can't establish how a deployed model is calibrated. They do show what to measure: predicted risk against observed abuse in a comparable bucket.

Statistics and Uncertainty teaches how much evidence you need before trusting the measured gap.

Other quantities need other distributions

The abuse label was a Bernoulli 0/1 because one signup either is or isn't abusive. Other ML quantities can take different values, so they need different sets of possible values.

A probability distribution describes how probability is spread over those values; choosing one is a modeling assumption, not a fact that the data proves.^{[1]Reference 1Machine Learning: A Probabilistic Perspective.https://probml.github.io/pml-book/book0.html[2]Reference 2Pattern Recognition and Machine Learning.https://www.microsoft.com/en-us/research/publication/pattern-recognition-machine-learning/}

Use the possible values as a first sanity check.

For Bernoulli, E[Y] = p and Var[Y] = p(1 - p). Categorical class probabilities are nonnegative and sum to one.

For a Binomial count, the mean and variance are np and np(1 - p). For 100 independent signups with p = 0.01, the expected abuse count is 1 and its variance is 0.99. "Expected count 1" doesn't mean every batch contains exactly one abusive signup.^{[5]Reference 5NIST/SEMATECH e-Handbook: Binomial Distributionhttps://www.itl.nist.gov/div898/handbook/eda/section3/eda366i.htm}

For a Poisson count, the mean and variance both equal $\lambda$, the expected number of arrivals in the chosen interval. At an average of two alerts per minute, a five-minute count has $\lambda = 10$, provided the process assumptions hold. Bursty, coordinated abuse may violate those assumptions.^{[6]Reference 6NIST/SEMATECH e-Handbook: Poisson Distributionhttps://www.itl.nist.gov/div898/handbook/eda/section3/eda366j.htm}

A Normal variable isn't bounded to [0, 1], so it isn't a default model for probabilities. Distributions and Sampling later lets you simulate these families and test whether their assumptions fit observed data.

Modeling bridge: The same choice appears in language models. Next-token prediction is categorical: one token out of a vocabulary. Training then cares about the probability assigned to the observed token.

A token model multiplies probabilities

For one observed target token, training rewards probability assigned to that token.

The observed token is the target class. A one-hot target assigns 1 to that class and 0 to every other vocabulary entry. Its cross-entropy contribution is negative log probability, -log(p), where p is the model's probability for the target. Python's math.log uses the natural logarithm, so these losses are measured in nats.^{[3]Reference 3Deep Learning.https://www.deeplearningbook.org/}

Predict the ordering before running the snippet: the observed token with probability 0.01 should incur the largest loss.

Lower probability costs more because the observed token was more surprising under the model.

For a sequence, extend the same idea one token at a time. The model's joint probability follows the chain rule: multiply the conditional probability of each next token given its preceding context.

$$P(t_1, t_2, \ldots, t_n) = P(t_1) \prod_{i=2}^{n} P(t_i \mid t_1, \ldots, t_{i-1})$$

Here, $t_i$ is the token at position $i$, and $\prod$ means multiply the terms for positions 2 through $n$. Each term conditions on the preceding tokens; the chain rule doesn't assume tokens are independent. If there's a prompt, every term also conditions on that prompt.

For three token probabilities, $0.5 \times 0.2 \times 0.1 = 0.01$. Their log probabilities add to the log of that product. With long sequences, summing logs also avoids underflow from multiplying tiny numbers.

Make the numeric failure visible by multiplying 200 token probabilities in Python:

The mathematical probability is $10^{-400}$, not zero. It's too small to represent as a nonzero value in Python's usual binary64 floating-point format, so this calculation underflows to 0.0.^{[7]Reference 7Floating-Point Arithmetic: Issues and Limitationshttps://docs.python.org/3/tutorial/floatingpoint.html}

Keep the finite log probability instead. Converting it back with math.exp would underflow again. A genuinely zero token probability is different: its mathematical log is negative infinity, and math.log(0) raises ValueError. Later language-modeling chapters use log-space calculations for cross-entropy and perplexity.

Common mistakes

Most probability bugs begin before the formula. Someone changed the event, population, or denominator without saying so.

When a dashboard number looks implausible, ask one question:

Among which cases am I counting?

Once that answer is explicit, the denominator usually stops being mysterious.

Try it yourself

Use the same 10,000-signup population, with 100 abusive signups. Try the counts first, then use code to check your arithmetic.

1. A signup isn't flagged by the original detector. How many abusive and clean signups are in that group? Compute its abuse probability.
2. An improved detector keeps 95 percent recall but lowers the false-positive rate to 1 percent. Compute its review count and posterior. Why isn't this the same scenario as raising the original detector's threshold?
3. Reviewers can handle 200 of these 10,000 signups. Compare broad review, strict review, and the improved detector. Which queues fit, and how many abusive signups does each miss? Treat these as the worked counts, not a guarantee of tomorrow's workload.
4. Someone proposes using the review queue's abuse rate as next month's prior for all signups. Explain the selection error and suggest a better sampling plan.
5. Compute -log(0.80) and -log(0.10). Then call math.log(0). Explain how a genuinely zero probability differs from a nonzero sequence probability that underflows.

Solution checks

Compare your denominators as well as your answers.

A complete probability claim

For this reference population, a complete claim is:

Of the 590 signups flagged by broad review, 95 are abusive: 16.1 percent. Strict review raises that fraction to 44.7 percent, but misses 20 of the 100 abusive signups instead of 5.

The probabilities describe two queues. They don't choose a policy for you. That decision also needs review capacity, the cost of false alarms, and the harm of missed abuse.