Basis Lab

Watching a Model After Launch

The Failures That Make No Noise

Last timeDeciding to Retrain

A broken input, a stale lookup and a confident answer about something never seen are the three production failures that leave every quality number looking normal.

A broken input

Three failures remain, and they share one property that makes them the hardest

things in this course: they produce no bad number anywhere.

Start with the simplest. A field stops arriving for twelve per cent of

requests, because an app release stopped sending it, or an upstream service

started returning an empty string instead of absent, or a currency unit

changed. The model receives a default value for those rows and answers

confidently.

FIG 1What a local failure does to the overall number
the share of rows affected
the error rate on the unaffected rows
the error rate on the affected rows
the overall error rate, which is the number on the report
Twelve per cent of rows failing at thirty one per cent error, against seven per cent on the rest, gives an overall error of about nine point nine per cent. The report shows a rise from seven to ten, which is three points on a measure that wobbles by one or two, so it looks like a slow month. Meanwhile one request in eight is being answered on a default value, and the people affected are not a random eighth of the population, they are whoever uses the app version that broke.

Two properties make this worse than the arithmetic suggests. The affected rows

are systematic rather than random, so the damage lands on one group of users

repeatedly. And the quality number arrives weeks later for all the reasons in

the fourth lesson, so a failure of this kind typically runs for a month before

anybody has a number to be suspicious about.

The only thing that catches it quickly is a check on the input itself, which is

the second row of the very first figure in this course.

Stale values and two code paths

The second quiet failure is more insidious because nothing is broken anywhere.

Every component works. They disagree.

A model uses a customer average spend over ninety days. In training, that

value was computed by a query over the warehouse. In serving, it is read from

a lookup table refreshed by a different job written by a different person at a

different time. The two produce slightly different numbers: one excludes

refunds, one includes them, or one counts ninety days from midnight and the

other from the moment of the request.

The lesson stops here

5 more paragraphs to go

You have read the opening. The rest of the argument, the problems that check whether it landed, and the lines worth keeping at the end all come with a plan.

The first lesson of every course in the library reads the whole way through, free, so you can see exactly what the rest of them are.

See the planThe contents

This is the reading half

Starting the course gives you your own copy of it. Every idea on every page has problems standing under it, marked with a reason rather than a tick, and any sentence you do not believe can be opened and argued with. None of that can happen on a page nobody owns.

The contents

The rest of this course

  1. 01What You Can Measure Without Labels
  2. 02When the Inputs Moveopening only
  3. 03When the Right Answer Movesopening only
  4. 04Labels That Arrive Weeks Lateropening only
  5. 05The Model Changing Its Own Inputsopening only
  6. 06What Deserves an Alarmopening only
  7. 07Deciding to Retrainopening only
  8. 08The Failures That Make No Noiseyou are here

Read alongside