A test detects a rare condition with great accuracy. A person tests positive. How likely is it that they really have the condition? Almost everyone answers «very», and almost everyone is wrong. Bayes' theorem explains why, and it is one of the most useful tools for anyone working with alerts, filters, intrusion detectors or any system that classifies rare events.
The theorem in one line
The theorem, named after the Reverend Thomas Bayes, who lived in the eighteenth century, links the two inverse conditional probabilities:
P(A|B) = P(B|A) · P(A) / P(B)
In practical problems A is a hypothesis («the person is ill», «the email is spam», «the server is compromised») and B is observed evidence («the test is positive», «the word free appears», «there is traffic to a suspicious IP»). The terms have precise names:
- P(A): the prior probability of the hypothesis, before seeing the evidence;
- P(B|A): the likelihood, how probable the evidence is if the hypothesis is true;
- P(B): the overall probability of the evidence, summing all the ways it can appear;
- P(A|B): the posterior probability, what we want to know.
The diagnostic test case
Let us fix some hypothetical but realistic numbers:
- the condition affects 1% of the population being tested;
- the test has a sensitivity of 99%: among those who are ill, 99% test positive;
- the test has a specificity of 95%: among those who are healthy, 95% test negative, so 5% test positive by mistake.
Reasoning with frequencies
The clearest way is to imagine 10,000 actual people.
| Positive | Negative | Total | |
|---|---|---|---|
| Ill | 99 | 1 | 100 |
| Healthy | 495 | 9,405 | 9,900 |
| Total | 594 | 9,406 | 10,000 |
There are 594 positive people, but only 99 are ill. The probability of being ill given a positive test is 99/594 ≈ 16.7%. About five positives out of six are false positives, despite a test that looks excellent.
With the formula
P(positive) = 0.99 · 0.01 + 0.05 · 0.99 = 0.0099 + 0.0495 = 0.0594
P(ill | positive) = 0.0099 / 0.0594 ≈ 0.167
The result is the same. The reason is that the healthy are very numerous: even a small error rate over a huge population produces more positives than there are truly ill people.
Base rate neglect
The intuitive mistake has a name: base rate neglect. We focus on the quality of the test and forget how rare the condition is. The same dynamic appears everywhere:
- an intrusion detection system with a low percentage of false alarms, applied to millions of events a day, generates hundreds of false alarms for every real attack;
- an accurate anti-fraud filter on transactions where fraud is extremely rare blocks many honest customers;
- screening a low-risk population produces more false positives than screening a high-risk population, with exactly the same test.
The practical consequence is that a classifier's accuracy cannot be judged without knowing the frequency of the class it is looking for.
Updating several times
Bayes' theorem can be applied in sequence: the posterior probability from one step becomes the prior for the next. If the person repeats an independent test with the same characteristics and tests positive again:
- prior: 0.167;
- P(positive) = 0.99 · 0.167 + 0.05 · 0.833 ≈ 0.165 + 0.042 = 0.207;
- posterior: 0.165 / 0.207 ≈ 0.80.
Two independent positives bring the estimate to about 80%. This is why a first positive result is often confirmed with a second test, preferably based on a different principle, so that the errors of the two tests are not correlated.
The odds form
There is an even handier version for mental arithmetic. The odds of an event are the ratio of its probability to the probability of the opposite: a probability of 1% corresponds to odds of 1 to 99. The theorem becomes:
posterior odds = prior odds × likelihood ratio
where the likelihood ratio is P(evidence | hypothesis true) / P(evidence | hypothesis false). In our test it is 0.99 / 0.05 = 19.8. Starting from 1 to 99, after one positive the odds are about 19.8 to 99, roughly 1 to 5: once again, a probability of about 1/6.
How to use it in everyday work
- Always ask for the base rate. How common is the event the system is looking for?
- Reason in natural frequencies. «Out of 10,000 cases…» is clearer than conditional percentages.
- Distinguish sensitivity from predictive value. The first concerns the test, the second concerns whoever receives the result.
- Combine independent evidence. Several weak but independent clues can be worth more than one strong one.
In short
- Bayes' theorem inverts conditional probabilities using the prior probability.
- With a rare condition, even a very accurate test can produce mostly false positives.
- Ignoring the base rate is a common error in medicine, security and fraud prevention.
- The estimate is updated in sequence: today's posterior is tomorrow's prior.
- The odds form makes calculations quick and intuitive.
