Bayes’ theorem as belief updating

Learning objective

Given a probability question, classifier signal, or product alert, define the hypothesis and evidence, distinguish P(H|E) from P(E|H), update prior odds with a likelihood ratio, and explain how base rates, dependence, calibration, and action costs change the decision.

1. The direction is the problem

Let H be the hypothesis that a payment is fraudulent, and let E be the event that a detector raises an alert. There are two natural questions:

• Likelihood or sensitivity: P(E|H) asks, “If the payment really is fraud, how often does the alert fire?”
• Posterior or positive predictive value: P(H|E) asks, “After I see an alert, how likely is fraud?”

The vertical bar points in a different direction, and the denominator changes with it. A detector can catch 95% of real cases while a positive alert means fraud only 16% of the time. That is not a contradiction: the two rates condition on different groups.

Bayes’ theorem is conditional probability rearranged. Assuming P(E)>0, start with the definition:

P(H|E) = P(H ∩ E) ÷ P(E)

The multiplication rule writes the same joint event from the other direction:

P(H ∩ E) = P(E|H)P(H)

Substitute that expression into the first equation:

P(H|E) = P(E|H)P(H) ÷ P(E)

The denominator is the step people skip. In a binary problem, every observed positive belongs to either H or its complement H^c. The law of total probability expands it:

P(E) = P(E|H)P(H) + P(E|H^c)P(H^c)

For a positive detector, P(E|H) is sensitivity and P(E|H^c) is the false-positive rate. The numerator counts true positives. The second term in the denominator counts false positives. Bayes is not a mysterious reversal; it is normalization over all explanations that could have produced the evidence.

2. Worked calculation: a positive screening result

Question. A condition affects 1% of a population. A test detects it 95% of the time when present and has a 5% false-positive rate when absent. If someone tests positive, what is the probability the condition is actually present?

Define the events before doing arithmetic: H means “condition present,” E means “positive,” P(H)=0.01, P(E|H)=0.95, and P(E|H^c)=0.05. The complement has probability P(H^c)=0.99.

Use 10,000 people so the rates become counts that can be inspected:

Now condition on the column named in the question. Among the 590 positive results, 95 are true cases:

P(H|E) = 95 ÷ (95 + 495) = 95 ÷ 590 = 0.161 = 16.1%

The formula reaches the same answer:

P(H|E) = [0.95 × 0.01] ÷ [(0.95 × 0.01) + (0.05 × 0.99)] = 0.0095 ÷ 0.059 = 16.1%

Sanity-check the direction. The likelihood ratio for a positive is LR⁺ = 0.95 ÷ 0.05 = 19, so a positive is 19 times as likely under H as under H^c. Belief should rise above the 1% prior. But 19 times the odds is not “19%,” and the huge absent group still contributes 495 positives. The posterior is 16.1%, not 95%.

A negative result answers a different question. Use complements: P(E^c|H)=0.05 and P(E^c|H^c)=0.95. Then:

P(H|E^c) = [0.05 × 0.01] ÷ [(0.05 × 0.01) + (0.95 × 0.99)] ≈ 0.053%

This is why “How accurate is the test?” is incomplete. Positive predictive value and negative predictive value depend on direction, base rate, and both conditional error rates. In a representative target population, the same test can be excellent at ruling out a rare condition while producing a modest fraction of true positives.

3. Odds make the update portable

Probabilities are intuitive, but odds make sequential updating easy to audit. Convert a probability p to odds with p/(1-p). For the screening example:

Posterior odds = prior odds × likelihood ratio

P(H|E) ÷ P(H^c|E) = (0.01 ÷ 0.99) × (0.95 ÷ 0.05) = (1 ÷ 99) × 19 = 19 ÷ 99

Convert the posterior odds back to a probability: (19/99) ÷ (1 + 19/99) = 19/118 = 16.1%. The likelihood ratio describes the strength and direction of the evidence; the prior odds describe where you started.

• If LR=1, the evidence is equally likely under both explanations, so it does not update the prior.
• If LR>1, the evidence supports H and the posterior rises.
• If LR<1, the evidence supports H^c and the posterior falls.

For a second signal E₂, update using P(E₂|H,E₁) and P(E₂|H^c,E₁). Multiplying two standalone likelihoods assumes conditional independence under both hypotheses. Two measurements from the same device, two model scores built from the same event, or two pieces of the same user behavior may share errors. Squaring rates without checking that assumption manufactures certainty.

4. Worked applied scenario: a marketplace fraud alert

Question. A marketplace wants to decide whether a payment alert should enter manual review. In the current payment population, 0.5% of payments are later confirmed fraudulent. The alert fires on 80% of fraudulent payments and on 2% of legitimate payments. What should the team infer from an alert?

Step 1 — frame the unit and action. The unit is one payment. The target population is current marketplace payments, the horizon is the label window used to confirm fraud, H is fraud, E is an alert, and the action is manual review—not automatic cancellation. The 0.5% rate is a prior for this population and time window, not a timeless property of the detector.

Step 2 — use 100,000 payments. There are 500 fraudulent payments and 99,500 legitimate payments. The alert catches 500 × .80 = 400 true frauds and fires on 99,500 × .02 = 1,990 legitimate payments. There are 2,390 alerts total, so:

P(H|E) = 400 ÷ 2,390 = 16.7%

In odds, the prior is 0.005 ÷ 0.995 = 1/199 and LR⁺ = 0.80 ÷ 0.02 = 40. The alert multiplies the prior odds by 40, but it does not make the posterior 40% or 80%. Most alerts are still legitimate because legitimate payments are so numerous.

Step 3 — turn probability into a decision. Suppose, purely as a toy economic illustration, that allowing a fraudulent payment through has an expected recoverable loss of $100, manual review costs $5 for a legitimate payment, and review prevents the fraud loss. For an alerted payment, allowing it through carries expected loss 0.167($100) = $16.70. The expected review cost from legitimate traffic alone is 0.833($5) = $4.17. Those simplified numbers support review, but not necessarily blocking.

A real recommendation would add review capacity, delay, customer friction, appeal outcomes, segment-specific costs, delayed labels, and the possibility that review changes which labels become observed. If capacity is fixed, the team may optimize precision among the top 1% of payments rather than use one universal probability threshold. Bayes supplies the posterior; expected cost and operations choose the policy.

Step 4 — check prior shift. Suppose a holiday campaign raises the fraud rate to 5%, while sensitivity and false-positive rate remain 80% and 2%. The same alert now means:

P(H|E) = [0.80 × 0.05] ÷ [(0.80 × 0.05) + (0.02 × 0.95)] = 67.8%

The meaning changed because the starting population changed. Before using the old posterior, estimate the new base rate, check that alert rates are stable by segment and time, inspect calibration, and re-threshold or recalibrate. A posterior is population-specific.

What this does not establish. The calculation does not prove the alert caused fraud, that labels are complete, that performance is fair across groups, or that a review policy will save money outside the assumed costs. It is a conditional probability under a stated population and measurement process. Those boundaries are part of the answer, not an apology after it.

5. Assumptions and failure modes

Bayes’ identity is exact when its probabilities describe the same data-generating process. The hard work in production is deciding whether the rates and population actually match.

• Wrong population: a case-control sample with equal numbers of fraud and non-fraud can estimate sensitivity and false-positive rate, but its observed PPV is not the marketplace PPV. Recompute with the target prevalence.
• Prior shift: seasonality, a new market, a changed policy, or a new eligibility filter can change P(H). The same conditional rates then yield a different posterior.
• Selection and delayed labels: if only alerted payments are reviewed, or fraud confirmation arrives later, observed rates may be selected or incomplete. Ask how the “truth” label is generated before trusting the table.
• Correlation: different feature names do not guarantee conditional independence. Use joint rates or a dependence-aware model when signals share a source.
• Calibration failure: a model score can rank cases well while failing to mean “the probability is p.” Check reliability in a representative holdout and recalibrate when the score’s probability meaning changes.
• Probability-to-action leap: a 16.7% posterior is not an automatic block decision. Include cost, capacity, harm, and uncertainty in the policy.
• Overclaiming: Bayes updates a conditional belief. It does not demonstrate causality, fairness, or diagnostic truth by itself.

6. Nearest alternatives: identity, model, or policy?

Interviewers sometimes hear “Bayes” and expect a discussion of Bayesian parameter inference. Keep the boundaries clear. Event-level Bayes is a probability identity for updating a hypothesis after evidence. A Bayesian parameter model uses a prior distribution over an unknown parameter and a likelihood for observed data; that is a broader modeling framework with questions about prior sensitivity and posterior uncertainty. This lesson uses the identity, not MCMC or conjugate-prior algebra.

Logistic regression learns a conditional relationship such as P(H|X) directly from labeled data; Bayes’ rule explains how a prior and likelihoods combine, but it is not itself a feature-learning algorithm. Naive Bayes instead specifies class-conditional feature distributions and usually assumes conditional independence. Choose among them based on data volume, feature structure, calibration needs, interpretability, and the action—not because one method sounds more “Bayesian.”

Common interview trap

Interview practice bank

1. 1. What is Bayes’ theorem, and why is P(H|E) not generally P(E|H)?

   Strong answer: start from conditional probability and write P(H|E)=P(E|H)P(H)/P(E). The conditioning event changes the denominator. Give a rare-condition or fraud example where sensitivity is high but PPV is lower because false positives from the larger complement matter. Likely follow-up: When would the two conditionals happen to be equal? Signal: directional precision and base-rate awareness.

2. 2. A condition has prevalence 1%, sensitivity 95%, and false-positive rate 5%. What is the probability after a positive?

   Strong answer: define H,E, use 10,000 people, compute 95 true positives and 495 false positives, then 95/(95+495)=16.1%. Call it PPV, not sensitivity. Likely follow-up: What is the probability after a negative? Signal: auditable intermediate quantities and a correct denominator.

3. 3. A signal has LR⁺ = 10. What does that mean for a 1% prior?

   Strong answer: the signal is 10 times as likely under H as under H^c, so posterior odds are 10 times prior odds. Prior odds are 1/99, posterior odds are 10/99, and probability is about 9.2%—not 10% or 90%. Likely follow-up: What if the prior is 50%? Signal: can move between probabilities and odds.

4. 4. Why can the same fraud detector have PPV 16.7% in one market and 67.8% in another?

   Strong answer: sensitivity and false-positive rate are conditional rates; PPV also uses prevalence. Recompute with the new prior and validate that conditional rates are stable by time and segment. Name prior shift and recalibration. Likely follow-up: Which metric would you report to a product manager? Signal: connects the math to deployment context.

5. 5. Two positive tests make the posterior jump from 1% to 78%. Is that automatically valid?

   Strong answer: only if the joint or sequential likelihoods justify it. Squaring the rates assumes conditional independence under both hypotheses. Repeated measurements or shared model inputs may have correlated errors; estimate joint rates or model dependence. Likely follow-up: How would you test the assumption? Signal: recognizes overconfidence from double-counting.

6. 6. When would you use Bayes’ rule by hand, logistic regression, or Naive Bayes?

   Strong answer: use the identity for explicit priors and small tables; logistic regression to learn a conditional predictor from labeled features; Naive Bayes for a fast generative baseline when the independence approximation is serviceable. Validate calibration separately from ranking. Likely follow-up: Can Naive Bayes classify well but have poor probabilities? Signal: distinguishes an identity from model classes.

7. 7. A marketplace has 400 confirmed frauds among 2,390 alerts. Should it block all alerts?

   Strong answer: calculate PPV as 16.7%, then ask about action, review capacity, prevented loss, false-decline cost, delayed labels, segment calibration, and appeals. Recommend a threshold or review policy tied to expected cost and validate it prospectively. Likely follow-up: What if fraud prevalence doubles? Signal: turns a posterior into a bounded operational decision.

8. 8. A model was calibrated last quarter but its current probabilities are too low. What do you investigate?

   Strong answer: check prevalence and feature drift, label delay and selection, missingness, policy changes, pipeline bugs, and slice-level calibration. Separate ranking degradation from probability calibration; recalibrate after diagnosing the changed data-generating process. Likely follow-up: Can AUC stay constant while PPV changes? Signal: understands that probability meaning depends on population.

Timed synthesis: eight minutes

Three quick checks

1. A test has 90% sensitivity. What probability does that give you after a positive?

   It gives P(E|H), the chance of a positive when the condition is present. For a positive person, we need P(H|E), which also needs the prior and false-positive rate.

2. Why can a positive test be mostly false positives?

   The non-hypothesis population can be much larger. The product P(E|H^c)P(H^c) can exceed the true-positive product even when the test is sensitive.

3. What should happen when sensitivity equals the false-positive rate?

   The positive likelihood ratio is 1, so the signal is uninformative and the posterior equals the prior. It has not updated belief.

Explain without notes: draw a 100-payment table for a product manager. Name the prior, true alerts, false alerts, and the fraction of alerts that are truly fraud. Then explain why a policy threshold is a separate decision.

Interview-ready recap

• Direction: write P(H|E) or P(E|H) before plugging in numbers.
• Bayes: P(H|E)=P(E|H)P(H)/P(E).
• Denominator: include every mutually exclusive path that can produce the evidence.
• Counts: when in doubt, use true positives ÷ all positives.
• Odds: posterior odds = prior odds × likelihood ratio.
• LR = 1: the evidence does not update the prior.
• Repeated evidence: require conditional independence or joint-likelihood evidence.
• Deployment: prior shift changes posterior meaning; calibration and action costs still matter.

Sources and boundaries

The theorem, partition denominator, and natural-frequency calculation follow Penn State STAT 414, Lesson 6: Bayes’ Theorem and the UC Berkeley probability notes. The prior-to-posterior update and distinction between event-level Bayes and Bayesian parameter models are cross-checked against the NIST/SEMATECH e-Handbook. Model comparison and calibration boundaries use the maintained scikit-learn Naive Bayes guide and probability-calibration guide. The Chan Zuckerberg Initiative 2025 interview guide calibrates emphasis on explaining reasoning, alternatives, and edge cases; it is one employer’s material, not a universal interview-loop claim. This lesson intentionally omits conjugate priors, MCMC, Bayes factors, full diagnostic-study design, causal effects of testing, and formal uncertainty intervals for estimated rates.