Bayes' Theorem for Engineers: The Base-Rate Trap That Fools Doctors, Juries, and Alert Dashboards

A test that is 99% accurate for a condition that only 1 in 10,000 people have will, on a positive result, still be wrong far more often than it’s right — and the reason has nothing to do with the test being bad. It has to do with a fact almost everyone’s intuition skips over: how rare the thing you’re testing for was before the test ever ran. That prior rarity is not a footnote to the calculation, it’s usually the dominant term in it, and ignoring it is called the base-rate fallacy — a reasoning error so consistent that it fools trained physicians interpreting their own field’s tests, juries weighing DNA evidence, and engineers staring at an alert dashboard convinced a rare failure mode just fired. Bayes’ theorem is the formal fix. It isn’t exotic machinery reserved for statisticians; it’s arithmetic anyone can do with a pencil, and once the natural-frequency version of it clicks, the base-rate trap stops being able to fool you.

The Theorem, Stripped of Symbol-Pushing

Bayes’ theorem, in its standard form, looks like this:

P(A|B) = P(B|A) * P(A) / P(B)

Read left to right in plain language: the probability of A being true, now that you’ve observed B, equals how likely B would be if A were true, times how likely A was before you observed anything, divided by how likely B is overall. In the medical-test framing that makes this concrete: A is “has the disease,” B is “tested positive.” P(A) is the prior — how common the disease is in the population before any test result is known. P(B|A) is the likelihood — how reliably the test catches the disease when it’s actually present. P(A|B) is the posterior — what you actually want to know: given this positive result, what’s the real probability this person has the disease?

The formula is correct and has been for nearly three centuries — the theorem traces to work Thomas Bayes did in the 1740s, unpublished during his lifetime, and it was Pierre-Simon Laplace who independently rediscovered and formalized it into the modern equation by 1812, applying it to problems from celestial mechanics to jurisprudence. The math was never the hard part. The hard part, which persists today in clinics and courtrooms and incident channels, is that human intuition consistently substitutes P(B|A) — the test’s reliability — for P(A|B) — the answer you actually need — and those two numbers can be wildly different.

Where Intuition Breaks: The Mammogram Problem

Here is the canonical version of the trap, and it is not a hypothetical — it has been run as an actual experiment on practicing physicians. Breast cancer prevalence in the screened population is roughly 1%. A mammogram catches roughly 80% of actual cancers (its true-positive rate) but also flags roughly 9.6% of women who do not have cancer (its false-positive rate). Given a positive result, what’s the probability this specific patient has cancer?

When this exact question was posed to practicing physicians, the median guess was around 70-80% — essentially, doctors substituted the test’s sensitivity for the answer. The correct answer is roughly 7.8%. Working it in raw counts rather than percentages, using a round population of 1,000 women, makes the gap impossible to miss:

Out of roughly 103 total positive results (8 true positives plus 95 false positives), only 8 are real cancers — about 7.8%, nowhere near the test’s quoted 80% sensitivity. The false positives dominate the positive-result pool not because the test is bad, but because the disease is rare: there are simply far more healthy women to generate false alarms from than sick women to generate true ones, and a 9.6% false-positive rate applied to 990 healthy women produces almost twelve times more noise than an 80% true-positive rate applied to 10 sick ones.

Psychologist Gerd Gigerenzer’s research identified exactly why the percentage framing misleads and the raw-count framing doesn’t: when the same problem is presented as natural frequencies — “10 out of 1,000 have the disease; of those 10, 8 test positive; of the remaining 990, about 95 also test positive” — the fraction of people who answer correctly nearly triples in controlled experiments, without anyone being taught the formula at all. The insight isn’t that people are bad at math. It’s that percentages hide the denominator, and the denominator is where the base rate lives.

     1,000 PEOPLE SCREENED
            |
    ________|________
   |                  |
 10 SICK          990 HEALTHY
   |                  |
 80% test+        9.6% test+
   |                  |
   8 true+          95 false+
   |__________________|
            |
   103 total positive results
   only 8 (7.8%) actually sick

The Same Trap, Different Courtroom: The Prosecutor’s Fallacy

The identical reasoning error shows up in criminal trials, where it’s specifically named the prosecutor’s fallacy: treating P(evidence | innocent) — how unlikely the evidence would be if the defendant were innocent — as if it were P(innocent | evidence), the number that actually matters for a verdict. Those are not the same quantity, and conflating them has produced real wrongful convictions.

The clearest documented case is Sally Clark, convicted in the UK in 1999 of murdering her two infant sons after both died of what was initially diagnosed as Sudden Infant Death Syndrome. The prosecution’s expert witness testified that the odds of two SIDS deaths occurring naturally in one family were roughly 1 in 73 million, treating that figure as effectively equivalent to Clark’s probability of innocence. Two errors compounded here. First, the 1-in-73-million figure assumed the two deaths were statistically independent events, when shared genetic and environmental factors within one family make a second SIDS death considerably more likely once a first has occurred — the calculation’s core premise was wrong. Second, and more fundamentally, even a genuinely rare coincidence probability is not the same number as the probability of guilt: a full Bayesian treatment has to weigh that rarity against the also-small prior probability that a mother in Clark’s circumstances would murder both children, and comparing the wrong two numbers is exactly what convicted her. The conviction was overturned on appeal in 2003 after statisticians publicly dismantled the reasoning; Clark died in 2007, and the case remains the standard citation in the UK legal and statistical literature for why raw improbability is not, by itself, evidence of guilt.

The Practical Machinery: Naive Bayes, Running Constantly and Invisibly

The same theorem, applied iteratively across many pieces of evidence rather than one test result, is the working core of naive Bayes spam classifiers — one of the oldest machine learning techniques still in daily production use. The idea is to treat every word in an email as a separate piece of evidence and combine them:

1
2
3
4
5
6
7

def spam_probability(email_words, word_stats, prior_spam_rate):
    # word_stats[w] = (P(w | spam), P(w | not_spam)) from training data
    log_odds = math.log(prior_spam_rate / (1 - prior_spam_rate))
    for word in email_words:
        p_spam, p_ham = word_stats.get(word, (0.5, 0.5))
        log_odds += math.log(p_spam / p_ham)
    return 1 / (1 + math.exp(-log_odds))

Each word nudges the running posterior up or down based on how disproportionately it appears in spam versus legitimate mail in the training data — “viagra” and “wire transfer” push hard toward spam, “meeting” and “attached” push toward ham — and the accumulated result after every word in the message is the final classification. The “naive” part of the name is an admitted simplification: the algorithm assumes each word’s presence is statistically independent of every other word given the class, which is obviously false in real language (word choice is correlated), but the approximation works well enough in practice that naive Bayes filters remained a dominant spam-detection technique for years and are still used as a baseline or ensemble component today. It doesn’t need the individual probabilities to be exactly right — it only needs spam messages to consistently score higher than legitimate ones, and that ranking survives the independence assumption’s inaccuracy just fine.

This same pattern — start from a prior, update on each new piece of evidence, arrive at a posterior — generalizes directly to incident triage. An alert firing for a rare failure mode should be weighted against how rare that failure mode actually is in your environment, not just against the alert rule’s individual accuracy; a rule that’s “95% accurate” but fires on a failure mode that occurs once a year, in a system generating thousands of unrelated anomalies daily, will still produce a flood of false positives dominating the true ones, for exactly the same arithmetic reason the mammogram does.

Doing the Arithmetic Yourself

The natural-frequency method scales to any base-rate problem without needing the formula memorized:

1. Pick a round population size (1,000 or 10,000 works well).
2. Compute how many in that population actually have the condition, using the prior/base rate.
3. Of those, compute how many the test correctly flags (true positives), using the sensitivity.
4. Of everyone else, compute how many the test incorrectly flags (false positives), using the false-positive rate.
5. Divide true positives by the total flagged (true positives plus false positives) — that’s your answer.

No calculus, no distributions, no code required — just five multiplications and one division, and the answer is exact.

The same five steps work just as well on an infrastructure question as a medical one. Suppose an intrusion-detection rule flags a specific rare attack pattern with 99% sensitivity and a 1% false-positive rate — numbers most engineers would call excellent — and that pattern genuinely occurs in about 1 out of every 50,000 requests your system handles. Run the same table:

A rule that looks nearly perfect on paper — 99% sensitivity, 1% false-positive rate — still produces a firehose of alerts where the genuine attack is buried under roughly 500 false ones, purely because the event being detected is rare enough that even a 1% error rate applied to a huge pool of benign traffic outnumbers it by two orders of magnitude. This is precisely why mature detection systems layer multiple independent signals (each update multiplying the posterior odds further, exactly as the naive Bayes spam filter does word by word) rather than trusting any single rule’s advertised accuracy in isolation — one pass through Bayes’ theorem is rarely enough when the base rate is this far in the tail.

Honest Trade-offs

• The base rate has to actually be known, and it’s often the shakiest number in the calculation. Disease prevalence, fraud rates, and rare-failure frequencies are themselves estimates, frequently derived from limited or biased samples, and a Bayesian calculation built on a wrong prior produces a confidently wrong posterior — the arithmetic doesn’t protect you from bad inputs.
• Sequential updating compounds small framing errors. Naive Bayes and similar iterative-evidence systems multiply many small probability estimates together; if the independence assumption is badly violated (correlated evidence being double-counted as if independent), the compounding error grows with every additional piece of evidence rather than averaging out.
• Natural frequencies fix comprehension, not decision-making under pressure. Gigerenzer’s research shows raw counts triple correct answers in a calm, unhurried setting — a radiologist or juror under time pressure, or without the framing presented to them at all, gets no benefit unless the natural-frequency format is deliberately built into how the result is communicated.
• A correct posterior still requires a judgment call about the threshold. Knowing a positive result means 7.8% probability of disease doesn’t by itself tell you whether to biopsy — that depends on the cost of a false negative versus a false positive, a decision-theory question the theorem doesn’t answer on its own.
• This post deliberately stays at the intuition layer. For the deeper machinery — conjugate priors, Markov Chain Monte Carlo sampling, and a full worked Bayesian A/B test — see /posts/bayesian-statistics-for-engineers/, which picks up where this post’s arithmetic-only approach stops.

Verdict

Bayes’ theorem’s real value for engineers isn’t the formula — it’s the discipline of never letting a test’s or alert’s individual accuracy stand in for the answer you actually need, which is the probability given everything else you already knew going in. The mammogram problem, the Sally Clark conviction, and a noisy alert dashboard are the same arithmetic error wearing three different outfits: substituting P(evidence | hypothesis) for P(hypothesis | evidence), and letting a rare base rate get silently dropped from the calculation. Reframe the problem as natural frequencies over a concrete population instead of abstract percentages, and the trap mostly disarms itself — no advanced math required, just the discipline to ask what the base rate actually was before trusting what a single positive result seems to say.

Sources

• ScienceInsights — What Is Base Rate Fallacy? Definition and Examples
• Cogn-IQ — Base-Rate Neglect: Definition, the Medical-Test Example & Bayes
• PMC — The Psychology of Bayesian Reasoning
• Scientific American — Why Bayes Rules: The History of a Formula That Drives Modern Life
• Wikipedia — Bayes’ Theorem
• Wikipedia — Prosecutor’s Fallacy
• Bayesian Intelligence — Sally Clark Is Wrongly Convicted of Murdering Her Children
• Wikipedia — Naive Bayes Spam Filtering
• Cornell — History of Bayes’ Rule