Practice / Probability for ML

The normal distribution and z-scores

Ten problems on the normal distribution: standardizing and reading Φ with its symmetry, the 68-95-99.7 rule for an initialization scale, a classifier threshold from an inverse z-score and the true positive rate it gives, z-scores that compare results on different scales, linear transforms, sums and differences of independent normals, the density's peak and inflection points, the normal approximation to a binomial with a continuity correction, a two-component Gaussian mixture, and the false alarms of a |z| > 3 outlier rule, with worked solutions and the mistakes of using a two-sided cutoff for a one-sided rate, adding standard deviations, dropping the continuity correction, reading a density as a probability and treating a mixture as one normal.

Before you start

The normal distribution is the bell curve: the shape of measurement noise, of averages by the central limit theorem, and of the random weights a network starts from. Every normal is a shifted and stretched copy of one standard normal, so a single table, or a single function Φ\Phi, answers every question about all of them once a value is converted to a z-score. These ten problems practice that conversion in both directions, from a value to a probability and from a probability back to a value, then use the closure of normals under linear maps and independent sums, look at the shape of the density itself, approximate a binomial count, and end with two places where the normal is only a model: a mixture of two normals, and an outlier rule run on many points at once. The five mistakes at the end are the ones that give a believable number: a two-sided cutoff used for a one-sided rate, standard deviations added instead of variances, a count approximated without the continuity correction, a density value read as a probability, and a mixture summarized by one normal with the same mean and variance.

  • Normal(μ,σ2)(\mu, \sigma^2) has density f(x)=1σ2πe−(x−μ)2/(2σ2)f(x) = \frac{1}{\sigma\sqrt{2\pi}}e^{-(x - \mu)^2/(2\sigma^2)}, mean μ\mu and variance σ2\sigma^2. The second parameter is the variance; the standard deviation is σ\sigma.
  • Standardizing. If XX is Normal(μ,σ2)(\mu, \sigma^2), then Z=(X−μ)/σZ = (X - \mu)/\sigma is Normal(0,1)(0, 1). The value z=(x−μ)/σz = (x - \mu)/\sigma is the z-score of xx: how many standard deviations it lies from the mean.
  • Φ\Phi is the standard normal CDF, Φ(z)=P(Z≤z)\Phi(z) = P(Z \le z), and φ(z)=e−z2/2/2π\varphi(z) = e^{-z^2/2}/\sqrt{2\pi} is its density. By symmetry Φ(−z)=1−Φ(z)\Phi(-z) = 1 - \Phi(z). So P(X≤x)=Φ((x−μ)/σ)P(X \le x) = \Phi\big((x - \mu)/\sigma\big).
  • Values used here. Φ(1)=0.8413\Phi(1) = 0.8413, Φ(1.5)=0.9332\Phi(1.5) = 0.9332, Φ(2)=0.9772\Phi(2) = 0.9772, Φ(3)=0.99865\Phi(3) = 0.99865. The cutoffs z0.95=1.6449z_{0.95} = 1.6449 and z0.975=1.9600z_{0.975} = 1.9600 satisfy Φ(zq)=q\Phi(z_q) = q. Other values come from a table or scipy.stats.norm.cdf and norm.ppf.
  • Closure. For constants a≠0a \ne 0 and bb, aX+baX + b is Normal(aμ+b,a2σ2)(a\mu + b, a^2\sigma^2). For independent normals X1,X2X_1, X_2, X1±X2X_1 \pm X_2 is normal with mean μ1±μ2\mu_1 \pm \mu_2 and variance σ12+σ22\sigma_1^2 + \sigma_2^2: variances add, in a sum or a difference.
  • Binomial. A Binomial(n,p)(n, p) count has mean npnp and variance np(1−p)np(1 - p). For large nn it is close to a normal with those moments; since the count takes only whole values, P(X≥k)P(X \ge k) is approximated by P(Y>k−12)P(Y > k - \tfrac12), the continuity correction.

Builds on: Continuous random variables: densities, CDFs, expectation and the uniform, exponential and normal

Problems

  1. ·

    A model's response time is Normal(120,202)(120, 20^2) in milliseconds. Find P(X<150)P(X < 150), P(X>90)P(X > 90) and P(100<X<160)P(100 < X < 160).

  2. ·

    A layer's weights are initialized from Normal(0,0.022)(0, 0.02^2). Use the 68-95-99.7 rule to estimate the fraction of weights with ∣w∣>0.04|w| > 0.04, the fraction in (0.02,0.04)(0.02, 0.04), and an interval that holds 99.7%99.7\% of them. Then give the exact values from Φ\Phi.

  3. ··

    A detector's score on negative examples is Normal(0.3,0.12)(0.3, 0.1^2), and on positive examples Normal(0.7,0.152)(0.7, 0.15^2). Choose the threshold tt that flags 5%5\% of negatives (the false positive rate), and find the fraction of positives it catches (the true positive rate).

  4. ·

    A model scores 7878 on benchmark A, where published models have mean 7070 and standard deviation 55, and 6262 on benchmark B, where they have mean 5050 and standard deviation 1010. Assuming both are roughly normal, on which benchmark is the result more exceptional? What fraction of models does it beat on each?

  5. ··

    Show that if XX is Normal(μ,σ2)(\mu, \sigma^2) and a>0a > 0, then Y=aX+bY = aX + b is Normal(aμ+b,a2σ2)(a\mu + b, a^2\sigma^2), by computing its CDF. What changes for a<0a < 0? Then a sensor reads temperature CC as Normal(20,52)(20, 5^2) in degrees Celsius: find the distribution of F=1.8C+32F = 1.8C + 32 and P(F>77)P(F > 77).

  6. ··

    A request passes through preprocessing, Normal(30,42)(30, 4^2) ms, then inference, Normal(80,32)(80, 3^2) ms, independently. Find the distribution of the total time and P(total>120)P(\text{total} > 120). Then find the distribution of inference minus preprocessing and the probability that the difference is under 4040 ms.

  7. ···

    For f(x)=1σ2πe−(x−μ)2/(2σ2)f(x) = \frac{1}{\sigma\sqrt{2\pi}}e^{-(x - \mu)^2/(2\sigma^2)}, find the maximum value of ff and where it occurs, and show that the inflection points are at x=μ±σx = \mu \pm \sigma. Evaluate the peak for σ=0.1\sigma = 0.1, and the ratio f(μ+σ)/f(μ)f(\mu + \sigma)/f(\mu).

  8. ··

    A classifier that guesses at random answers 100100 balanced yes-or-no questions, so its number correct XX is Binomial(100,0.5)(100, 0.5). Approximate P(X≥60)P(X \ge 60) with a normal and the continuity correction, and compare with the exact value 0.02840.0284 and with the approximation without the correction.

  9. ···

    A model's score is drawn from a Gaussian mixture: with probability 0.70.7 from Normal(0,1)(0, 1) and with probability 0.30.3 from Normal(3,1)(3, 1). Find its mean, its variance and P(X>4)P(X > 4). Compare P(X>4)P(X > 4) with a single normal of the same mean and variance. Then find the probability that a score of x=2x = 2 came from the second component.

  10. ···

    An anomaly detector flags any point with ∣z∣>3|z| > 3. On 10 00010\,000 points drawn independently from a normal distribution with known mean and standard deviation, find the probability that one point is flagged, the expected number of flags, and the probability of at least one. What threshold on ∣z∣|z| gives one expected flag?

Worked solutions

Problem 1

A model's response time is Normal(120,202)(120, 20^2) in milliseconds. Find P(X<150)P(X < 150), P(X>90)P(X > 90) and P(100<X<160)P(100 < X < 160).

  1. z=(150−120)/20=1.5z = (150 - 120)/20 = 1.5, so P(X<150)=Φ(1.5)=0.9332P(X < 150) = \Phi(1.5) = 0.9332Standardize, then read Φ\Phi.
  2. z=(90−120)/20=−1.5z = (90 - 120)/20 = -1.59090 ms is 1.51.5 standard deviations below the mean.
  3. P(X>90)=1−Φ(−1.5)=Φ(1.5)=0.9332P(X > 90) = 1 - \Phi(-1.5) = \Phi(1.5) = 0.9332Symmetry: the area above −1.5-1.5 equals the area below 1.51.5.
  4. z=−1z = -1 at 100100 and z=2z = 2 at 160160The two ends of the interval.
  5. Φ(2)−Φ(−1)=0.9772−(1−0.8413)\Phi(2) - \Phi(-1) = 0.9772 - (1 - 0.8413)The area below the top end minus the area below the bottom end.
  6. P(X<150)=0.9332P(X < 150) = 0.9332; P(X>90)=0.9332P(X > 90) = 0.9332; P(100<X<160)=0.8186P(100 < X < 160) = 0.8186The first two are equal because 9090 and 150150 sit symmetrically about the mean. Whether << or ≤\le is written makes no difference for a continuous variable.

Problem 2

A layer's weights are initialized from Normal(0,0.022)(0, 0.02^2). Use the 68-95-99.7 rule to estimate the fraction of weights with ∣w∣>0.04|w| > 0.04, the fraction in (0.02,0.04)(0.02, 0.04), and an interval that holds 99.7%99.7\% of them. Then give the exact values from Φ\Phi.

  1. ∣w∣>0.04|w| > 0.04 means ∣z∣>2|z| > 2, and about 95%95\% lies within 2σ2\sigma, so about 5%5\% lies outsideThe rule: 68%68\%, 95%95\% and 99.7%99.7\% within 11, 22 and 33 standard deviations.
  2. (0.02,0.04)(0.02, 0.04) is 1<z<21 < z < 2: about (95%−68%)/2=13.5%(95\% - 68\%)/2 = 13.5\%The band between 1σ1\sigma and 2σ2\sigma has two equal halves, one on each side.
  3. 99.7%99.7\% is within 3σ=0.063\sigma = 0.06: the interval (−0.06,0.06)(-0.06, 0.06)Three standard deviations either side.
  4. Exact: 2(1−Φ(2))=0.04552(1 - \Phi(2)) = 0.0455 and Φ(2)−Φ(1)=0.1359\Phi(2) - \Phi(1) = 0.1359From the table values.
  5. About 5%5\% (exactly 4.55%4.55\%) have ∣w∣>0.04|w| > 0.04; about 13.5%13.5\% (exactly 13.59%13.59\%) lie in (0.02,0.04)(0.02, 0.04); 99.7%99.7\% lie in (−0.06,0.06)(-0.06, 0.06)The rule is a rounded form of Φ\Phi. TensorFlow's truncated-normal initializer redraws every weight beyond 2σ2\sigma, which here is about one weight in 2222.

Problem 3

A detector's score on negative examples is Normal(0.3,0.12)(0.3, 0.1^2), and on positive examples Normal(0.7,0.152)(0.7, 0.15^2). Choose the threshold tt that flags 5%5\% of negatives (the false positive rate), and find the fraction of positives it catches (the true positive rate).

  1. P(negative score>t)=0.05P(\text{negative score} > t) = 0.05 means Φ((t−0.3)/0.1)=0.95\Phi\big((t - 0.3)/0.1\big) = 0.95A one-sided rate: all 5%5\% sits in the upper tail.
  2. (t−0.3)/0.1=z0.95=1.6449(t - 0.3)/0.1 = z_{0.95} = 1.6449Invert Φ\Phi.
  3. t=0.3+1.6449⋅0.1=0.4645t = 0.3 + 1.6449 \cdot 0.1 = 0.4645Undo the standardization: x=μ+zσx = \mu + z\sigma.
  4. For positives, z=(0.4645−0.7)/0.15=−1.570z = (0.4645 - 0.7)/0.15 = -1.570Standardize the same threshold with the positives' mean and standard deviation.
  5. P(positive score>t)=1−Φ(−1.570)=Φ(1.570)P(\text{positive score} > t) = 1 - \Phi(-1.570) = \Phi(1.570)Symmetry.
  6. t≈0.4645t \approx 0.4645; true positive rate ≈0.9418\approx 0.9418About 5.8%5.8\% of positives are missed. Moving tt trades one error for the other, and tracing that trade as tt varies draws the ROC curve.

Problem 4

A model scores 7878 on benchmark A, where published models have mean 7070 and standard deviation 55, and 6262 on benchmark B, where they have mean 5050 and standard deviation 1010. Assuming both are roughly normal, on which benchmark is the result more exceptional? What fraction of models does it beat on each?

  1. On A: z=(78−70)/5=1.6z = (78 - 70)/5 = 1.6Standard deviations above that benchmark's mean.
  2. On B: z=(62−50)/10=1.2z = (62 - 50)/10 = 1.2B's raw gain of 1212 points is larger, but B's scores are twice as spread out.
  3. Φ(1.6)=0.9452\Phi(1.6) = 0.9452 and Φ(1.2)=0.8849\Phi(1.2) = 0.8849The fraction of models scoring below each result.
  4. More exceptional on A (z=1.6z = 1.6, beating about 94.5%94.5\%) than on B (z=1.2z = 1.2, beating about 88.5%88.5\%)A z-score removes the units and the spread, so results on different scales can be compared. The comparison relies on both distributions having the same shape; the percentiles are only as good as the normal model.

Problem 5

Show that if XX is Normal(μ,σ2)(\mu, \sigma^2) and a>0a > 0, then Y=aX+bY = aX + b is Normal(aμ+b,a2σ2)(a\mu + b, a^2\sigma^2), by computing its CDF. What changes for a<0a < 0? Then a sensor reads temperature CC as Normal(20,52)(20, 5^2) in degrees Celsius: find the distribution of F=1.8C+32F = 1.8C + 32 and P(F>77)P(F > 77).

  1. P(Y≤y)=P(X≤(y−b)/a)P(Y \le y) = P\big(X \le (y - b)/a\big)Solve aX+b≤yaX + b \le y for XX; dividing by a>0a > 0 keeps the inequality.
  2. =Φ((y−b)/a−μσ)= \Phi\Big(\dfrac{(y - b)/a - \mu}{\sigma}\Big)Standardize XX.
  3. =Φ(y−(aμ+b)aσ)= \Phi\Big(\dfrac{y - (a\mu + b)}{a\sigma}\Big)Multiply the top and bottom by aa.
  4. That is the CDF of Normal(aμ+b,a2σ2)(a\mu + b, a^2\sigma^2)Step 3 is Φ\Phi of a z-score with mean aμ+ba\mu + b and standard deviation aσa\sigma.
  5. For a<0a < 0: P(Y≤y)=P(X≥(y−b)/a)P(Y \le y) = P\big(X \ge (y - b)/a\big)Dividing by a<0a < 0 flips the inequality.
  6. =1−Φ(y−(aμ+b)aσ)= 1 - \Phi\big(\tfrac{y - (a\mu + b)}{a\sigma}\big)Standardize, and multiply the top and bottom by aa as in step 3.
  7. =Φ(y−(aμ+b)∣a∣σ)= \Phi\big(\tfrac{y - (a\mu + b)}{|a|\sigma}\big)Symmetry, 1−Φ(u)=Φ(−u)1 - \Phi(u) = \Phi(-u), with −a=∣a∣-a = |a|: again a normal CDF, now with standard deviation ∣a∣σ|a|\sigma.
  8. FF has mean 1.8⋅20+32=681.8 \cdot 20 + 32 = 68 and standard deviation 1.8⋅5=91.8 \cdot 5 = 9The closure rule with a=1.8a = 1.8, b=32b = 32.
  9. P(F>77)=1−Φ((77−68)/9)=1−Φ(1)P(F > 77) = 1 - \Phi\big((77 - 68)/9\big) = 1 - \Phi(1)7777 degrees Fahrenheit is 2525 degrees Celsius, one standard deviation up on either scale.
  10. YY is Normal(aμ+b,a2σ2)(a\mu + b, a^2\sigma^2) for every a≠0a \ne 0, with standard deviation ∣a∣σ|a|\sigma; FF is Normal(68,92)(68, 9^2) and P(F>77)=0.1587P(F > 77) = 0.1587A change of units moves and stretches the distribution but leaves every z-score where it was. Standardizing a feature is the case a=1/σa = 1/\sigma, b=−μ/σb = -\mu/\sigma.

Problem 6

A request passes through preprocessing, Normal(30,42)(30, 4^2) ms, then inference, Normal(80,32)(80, 3^2) ms, independently. Find the distribution of the total time and P(total>120)P(\text{total} > 120). Then find the distribution of inference minus preprocessing and the probability that the difference is under 4040 ms.

  1. Mean of the total: 30+80=11030 + 80 = 110Means add.
  2. Variance of the total: 42+32=254^2 + 3^2 = 25, so the standard deviation is 55For independent variables, variances add.
  3. P(total>120)=1−Φ((120−110)/5)=1−Φ(2)P(\text{total} > 120) = 1 - \Phi\big((120 - 110)/5\big) = 1 - \Phi(2)A sum of independent normals is normal.
  4. The difference has mean 80−30=5080 - 30 = 50 and variance 32+42=253^2 + 4^2 = 25Subtracting is adding −1-1 times a variable, and (−1)2=1(-1)^2 = 1: the variances still add.
  5. P(D<40)=Φ((40−50)/5)=Φ(−2)=1−Φ(2)P(D < 40) = \Phi\big((40 - 50)/5\big) = \Phi(-2) = 1 - \Phi(2)Standardize the difference.
  6. Total: Normal(110,52)(110, 5^2), P(total>120)=0.0228P(\text{total} > 120) = 0.0228; difference: Normal(50,52)(50, 5^2), P(D<40)=0.0228P(D < 40) = 0.0228The standard deviation of the total is 55, not 4+3=74 + 3 = 7 (Mistake 2). Independence is needed for the variances to add; correlated stages add a covariance term.

Problem 7

For f(x)=1σ2πe−(x−μ)2/(2σ2)f(x) = \frac{1}{\sigma\sqrt{2\pi}}e^{-(x - \mu)^2/(2\sigma^2)}, find the maximum value of ff and where it occurs, and show that the inflection points are at x=μ±σx = \mu \pm \sigma. Evaluate the peak for σ=0.1\sigma = 0.1, and the ratio f(μ+σ)/f(μ)f(\mu + \sigma)/f(\mu).

  1. Let u=(x−μ)/σu = (x - \mu)/\sigma, so f=1σφ(u)f = \dfrac{1}{\sigma}\varphi(u) with du/dx=1/σdu/dx = 1/\sigmaEvery normal density is the standard one, moved and rescaled.
  2. φ′(u)=−u φ(u)\varphi'(u) = -u\,\varphi(u)Chain rule on e−u2/2e^{-u^2/2}.
  3. φ′′(u)=(u2−1) φ(u)\varphi''(u) = (u^2 - 1)\,\varphi(u)Product rule: −φ(u)−uφ′(u)=−φ+u2φ-\varphi(u) - u\varphi'(u) = -\varphi + u^2\varphi.
  4. f′(x)=0f'(x) = 0 only at u=0u = 0, that is x=μx = \mu, a maximumφ>0\varphi > 0, and −u-u changes sign from ++ to −- there.
  5. f′′f'' changes sign where u2=1u^2 = 1: x=μ±σx = \mu \pm \sigmaf′′(x)=φ′′(u)/σ3f''(x) = \varphi''(u)/\sigma^3, and φ>0\varphi > 0, so the sign is that of u2−1u^2 - 1.
  6. Peak f(μ)=1/(σ2π)f(\mu) = 1/(\sigma\sqrt{2\pi}); for σ=0.1\sigma = 0.1 it is 3.9893.9891/2π=0.39891/\sqrt{2\pi} = 0.3989.
  7. f(μ+σ)/f(μ)=e−1/2=0.6065f(\mu + \sigma)/f(\mu) = e^{-1/2} = 0.6065u=1u = 1 in the exponent.
  8. Maximum 1/(σ2π)1/(\sigma\sqrt{2\pi}) at x=μx = \mu, which is 3.9893.989 for σ=0.1\sigma = 0.1; inflection points at μ±σ\mu \pm \sigma, where the density is e−1/2≈0.607e^{-1/2} \approx 0.607 of its peakThe inflection points are where the curve turns from bending down to bending up, which is the way to read σ\sigma off a plotted bell curve. A density above 11 is fine: it is probability per unit length, not a probability (Mistake 4).

Problem 8

A classifier that guesses at random answers 100100 balanced yes-or-no questions, so its number correct XX is Binomial(100,0.5)(100, 0.5). Approximate P(X≥60)P(X \ge 60) with a normal and the continuity correction, and compare with the exact value 0.02840.0284 and with the approximation without the correction.

  1. Mean np=50np = 50, variance np(1−p)=25np(1 - p) = 25, standard deviation 55The binomial's moments.
  2. P(X≥60)≈P(Y>59.5)P(X \ge 60) \approx P(Y > 59.5)The count 6060 stands for the interval (59.5,60.5)(59.5, 60.5), so the area starts half a unit below 6060.
  3. z=(59.5−50)/5=1.9z = (59.5 - 50)/5 = 1.9Standardize.
  4. 1−Φ(1.9)=0.02871 - \Phi(1.9) = 0.0287From a table.
  5. Without the correction: 1−Φ((60−50)/5)=1−Φ(2)=0.02281 - \Phi\big((60 - 50)/5\big) = 1 - \Phi(2) = 0.0228This leaves out half of the bar at 6060.
  6. P(X≥60)≈0.0287P(X \ge 60) \approx 0.0287 with the correction, against 0.02840.0284 exactly; 0.02280.0228 without itThe corrected value is off by 1%1\% of the answer, the uncorrected one by 20%20\%. A model that gets 6060 of 100100 right is unlikely, but not impossible, to be guessing: this is the p-value of a one-sided test.

Problem 9

A model's score is drawn from a Gaussian mixture: with probability 0.70.7 from Normal(0,1)(0, 1) and with probability 0.30.3 from Normal(3,1)(3, 1). Find its mean, its variance and P(X>4)P(X > 4). Compare P(X>4)P(X > 4) with a single normal of the same mean and variance. Then find the probability that a score of x=2x = 2 came from the second component.

  1. E[X]=0.7⋅0+0.3⋅3=0.9E[X] = 0.7 \cdot 0 + 0.3 \cdot 3 = 0.9The mean of a mixture is the weighted mean of the means.
  2. E[X2]=0.7(1+0)+0.3(1+9)=3.7E[X^2] = 0.7(1 + 0) + 0.3(1 + 9) = 3.7For each component, E[X2]=σ2+μ2E[X^2] = \sigma^2 + \mu^2.
  3. Var⁡(X)=3.7−0.92=2.89\operatorname{Var}(X) = 3.7 - 0.9^2 = 2.89, standard deviation 1.71.7Within-component variance 11 plus the spread of the means, 0.7⋅0.3⋅32=1.890.7 \cdot 0.3 \cdot 3^2 = 1.89.
  4. P(X>4)=0.7(1−Φ(4))+0.3(1−Φ(1))P(X > 4) = 0.7(1 - \Phi(4)) + 0.3(1 - \Phi(1))Total probability over the two components.
  5. =0.7⋅0.00003+0.3⋅0.1587=0.0476= 0.7 \cdot 0.00003 + 0.3 \cdot 0.1587 = 0.0476The first component contributes almost nothing.
  6. One normal: 1−Φ((4−0.9)/1.7)=1−Φ(1.824)=0.03411 - \Phi\big((4 - 0.9)/1.7\big) = 1 - \Phi(1.824) = 0.0341Same mean and variance, different shape.
  7. Responsibility: 0.3 φ(2−3)0.7 φ(2)+0.3 φ(2−3)\dfrac{0.3\,\varphi(2 - 3)}{0.7\,\varphi(2) + 0.3\,\varphi(2 - 3)}Bayes' rule, with each component's density at x=2x = 2.
  8. =0.3⋅0.24200.7⋅0.0540+0.3⋅0.2420=0.07260.1104= \dfrac{0.3 \cdot 0.2420}{0.7 \cdot 0.0540 + 0.3 \cdot 0.2420} = \dfrac{0.0726}{0.1104}φ(1)=φ(−1)=0.2420\varphi(1) = \varphi(-1) = 0.2420 and φ(2)=0.0540\varphi(2) = 0.0540.
  9. Mean 0.90.9, variance 2.892.89, P(X>4)≈0.0476P(X > 4) \approx 0.0476 (one normal with those moments gives 0.03410.0341); a score of 22 came from the second component with probability ≈0.658\approx 0.658The single normal underestimates this tail by about 28%28\% (Mistake 5). The responsibility in step 7 is the E step of the EM algorithm for fitting a mixture.

Problem 10

An anomaly detector flags any point with ∣z∣>3|z| > 3. On 10 00010\,000 points drawn independently from a normal distribution with known mean and standard deviation, find the probability that one point is flagged, the expected number of flags, and the probability of at least one. What threshold on ∣z∣|z| gives one expected flag?

  1. P(∣Z∣>3)=2(1−Φ(3))=0.0027P(|Z| > 3) = 2(1 - \Phi(3)) = 0.0027Both tails.
  2. Expected flags: 10 000⋅0.0027=2710\,000 \cdot 0.0027 = 27Linearity of expectation; independence is not needed for this.
  3. P(at least one)=1−(1−0.0027)10 000P(\text{at least one}) = 1 - (1 - 0.0027)^{10\,000}Independence: no point is flagged with probability 0.99730.9973 each time.
  4. ≈1−e−27\approx 1 - e^{-27}, which is 11 to eleven decimal places(1−q)n≈e−nq(1 - q)^n \approx e^{-nq} for small qq.
  5. One expected flag needs 2(1−Φ(c))=10−42(1 - \Phi(c)) = 10^{-4}, so Φ(c)=0.99995\Phi(c) = 0.99995Divide the target count by 10 00010\,000, and split it over two tails.
  6. P(flag)=0.0027P(\text{flag}) = 0.0027; 2727 expected flags and at least one almost surely, with no anomaly present; ∣z∣>3.89|z| > 3.89 gives one expected flagA cutoff that is rare for one point is routine across thousands, the multiple-comparisons problem in another form. Real data usually have heavier tails than the normal, so the true count of false flags is often higher still.

Where this goes wrong

1. Using the two-sided cutoff for a one-sided rate

The number 1.961.96 is the one remembered alongside 5%5\%, from confidence intervals and two-sided tests.

  1. The threshold must flag 5%5\% of negatives, Normal(0.3,0.12)(0.3, 0.1^2)Right so far: Problem 3.
  2. “5%5\% means z=1.96z = 1.96.”The habit that causes the mistake: 1.961.96 leaves 2.5%2.5\% in each of two tails. A false positive rate counts only the upper tail, so the cutoff is z0.95=1.6449z_{0.95} = 1.6449.
  3. t=0.3+1.96⋅0.1=0.496t = 0.3 + 1.96 \cdot 0.1 = 0.496This flags only 2.5%2.5\% of negatives, and the true positive rate falls from 0.94180.9418 to Φ(1.36)≈0.9131\Phi(1.36) \approx 0.9131. The detector is stricter than asked, and catches about 33 fewer positives in every 100100.

2. Adding standard deviations

The means of the two stages add, and the standard deviation looks like the same kind of quantity.

  1. The total has mean 30+80=11030 + 80 = 110 msRight so far: Problem 6.
  2. “Its standard deviation is 4+3=74 + 3 = 7 ms.”Variances add for independent variables, not standard deviations: 42+32=5\sqrt{4^2 + 3^2} = 5.
  3. P(total>120)=1−Φ(10/7)≈0.0766P(\text{total} > 120) = 1 - \Phi(10/7) \approx 0.0766The right answer is 1−Φ(2)≈0.02281 - \Phi(2) \approx 0.0228, so the wrong spread makes a slow request look more than three times as common. Adding standard deviations is right only when the two times are perfectly correlated.

3. Dropping the continuity correction

A normal is continuous, so it seems natural to put the boundary of the count where it is written.

  1. XX is Binomial(100,0.5)(100, 0.5), approximated by YY, Normal(50,52)(50, 5^2)Right so far: Problem 8.
  2. “P(X≥60)≈P(Y≥60)P(X \ge 60) \approx P(Y \ge 60).”Each whole count kk stands for the interval (k−12,k+12)(k - \tfrac12, k + \tfrac12) under the curve, so the bar at 6060 starts at 59.559.5.
  3. P(X≥60)≈1−Φ(2)=0.0228P(X \ge 60) \approx 1 - \Phi(2) = 0.0228The exact value is 0.02840.0284 and the corrected approximation 0.02870.0287. Shifting the wrong way, to 60.560.5, is worse still: 1−Φ(2.1)≈0.01791 - \Phi(2.1) \approx 0.0179. For ≥k\ge k use k−12k - \tfrac12; for ≤k\le k use k+12k + \tfrac12.

4. Reading a density value as a probability

The density is the function that gets plotted and evaluated, and its value at a point looks like the chance of that point.

  1. XX is Normal(0,0.12)(0, 0.1^2), with f(0)=3.989f(0) = 3.989Right so far: Problem 7.
  2. “f(0)f(0) is the probability that XX is 00.”A probability is an area under ff; a single point has probability 00, and ff is probability per unit length.
  3. P(X=0)=3.989P(X = 0) = 3.989A probability above 11 is impossible, which is the clue. The chance of landing within 0.010.01 of 00 is 2Φ(0.1)−1≈0.07972\Phi(0.1) - 1 \approx 0.0797, close to f(0)⋅0.02≈0.0798f(0) \cdot 0.02 \approx 0.0798: density times width, for a short interval.

5. Treating a mixture as one normal

Any distribution has a mean and a variance, and a normal with the same two numbers looks like a fair summary of it.

  1. The mixture of Problem 9 has mean 0.90.9 and standard deviation 1.71.7Right so far.
  2. “So XX is approximately Normal(0.9,1.72)(0.9, 1.7^2).”A normal is determined by two numbers, but a mixture is not: this one has two bumps, and its upper tail is the tail of the second component.
  3. P(X>4)≈1−Φ(1.824)≈0.0341P(X > 4) \approx 1 - \Phi(1.824) \approx 0.0341The mixture gives 0.04760.0476, about 40%40\% more. A z-score is only a probability when the distribution really is normal; with two bumps it can be far off in either direction.

Print this set: normal-distribution-and-z-scores.pdf (problems, answers, and worked solutions on separate pages).

Read the guide: The normal distribution and z-scores: divide by σ, pick the right tail, and add the variances