Statistical Inference & Model Failure Modes

Abstractions about how statistical models go wrong or get evaluated — inference procedures like Bayes factors and false-discovery control, distribution-shift failures like label shift, and adversarial ML attacks like data poisoning and membership inference.

16 abstractions in this family — domain-specific abstractions that sit near one another in structural-signature space (k-means over structural-signature embeddings). Each is shown with its short description.

• Bayes Factor — The ratio of the marginal likelihoods of the data under two specific models, isolating the data's weight of evidence between them and updating prior model odds to posterior odds multiplicatively — with an automatic Occam penalty on flexible models.
• Benjamini–Hochberg Procedure — A step-up rule that sorts m p-values and rejects through the largest rank k where p(k) ≤ (k/m)·α, bounding the false discovery rate — the expected proportion of false rejections among discoveries — rather than the probability of any false positive.
• Class Imbalance — Diagnose why a 99%-accurate classifier can be useless: when one class vastly outnumbers the class of interest, additive loss aggregation lets majority examples dominate the gradient, so the model learns to ignore the rare minority.
• Data Poisoning Attack — The adversarial-ML failure mode where an attacker corrupts training inputs so the model learns an attacker-chosen behaviour — an upstream contamination that runtime defenses are structurally powerless against and that clean benchmark accuracy cannot detect.
• Distributional Blind Spot — The region of a model's input space inadequately sampled during development into which the deployed model still makes confident predictions — extrapolations whose error is unknown, indistinguishable in confidence from in-distribution outputs.
• Ecological Inference Problem — Recover individual-level joint distributions from group-level marginal totals, a many-to-one inverse problem where the data alone only pin the answer to the Duncan-Davis bounds and any tighter estimate rests on an explicit, contestable identifying assumption.
• Feature scaling — The preprocessing step that rescales numerical inputs to a common range so no variable's unit of measurement silently dominates a scale-sensitive method — making the choice of weighting an explicit analytical commitment rather than an accident of source units.
• Imputation Leakage — The model-evaluation failure in which a missing-value repair step is fit across the train/test boundary, so its parameters encode facts about the held-out rows — inflating performance that survives into the test metric, because imputation, mentally filed as data cleaning, is really a model.
• Jeffreys-Lindley Paradox — The result that a frequentist significance test and a Bayesian posterior-odds comparison of the same data against the same point null can reach opposite verdicts, with the disagreement growing without bound as sample size increases — because the two answer different questions.
• Label Shift — The distribution shift in which the label marginal P(Y) changes between training and deployment while P(X|Y) stays fixed, so a classifier's discrimination survives but its calibration and thresholds miscalibrate — correctable by re-estimating the deployment prior rather than retraining.
• Membership Inference Attack — Determine whether a specific record was in a model's training set by reading the systematic behavioural gap — lower loss, higher confidence — between the samples it saw and statistically matched samples it did not.
• Model Inversion Attack — Recover the content of individual training records by treating a deployed model as a constrained inverse oracle — combining predictions-as-evidence with a prior over the input space to solve for the generating input, so 'the model is not the data' becomes a quantitative claim.
• Model Skewing — The adversarial AI-security attack in which a stream of individually-unflaggable, region-biased inputs to an online learning loop gradually pulls a model's decision boundary off the deployer's criterion toward one the attacker prefers — capturing a deployment that launched clean.
• Prior Probability Shift
• Receiver Operating Characteristic — Sweep a binary classifier's decision threshold across its full score range to trace every achievable sensitivity-versus-false-positive-rate tradeoff at once, factoring detection into orthogonal discriminability (the curve's height) and criterion (where the threshold sits) coordinates.
• Stein's Paradox — The result that estimating three or more means each by its own sample mean is inadmissible under total squared-error loss — a shrinkage estimator pulling each toward a common reference achieves strictly lower joint error for every true parameter vector, however unrelated the quantities.