Alert fatigue and threshold economics

"I can raise a thousand alarms an hour. Whether anyone still reads the thousand-and-first is a question my ROC curve refuses to answer."

An Overzealous AI Agent

This section assumes you can already produce a calibrated anomaly score and reason about its error trade-offs, which is the work of Section 12.3 and Section 12.6. It also leans on the cost-of-errors framing from the probability primer in Chapter 4. Where earlier sections asked "is this alarm correct," here we ask the sharper operational question: "is this alarm worth raising, given everything else competing for attention right now."

Why low precision is fatal even when recall looks great

The uncomfortable arithmetic behind alert fatigue is the base-rate effect. Faults are rare. Suppose a machine truly fails on \(1\) sample in \(10{,}000\) and your detector is excellent: \(99\%\) recall and a false-positive rate of just \(1\%\). Run it on a million samples and you catch essentially every one of the \(100\) real faults, but you also fire on \(1\%\) of the \(999{,}900\) healthy samples, which is roughly \(9{,}999\) false alarms. The precision is about \(1\%\): ninety-nine out of every hundred alerts are noise. No human triages at that ratio for long. The formal object here is the precision at a fixed base rate,

where \(\pi\) is the fraction of anomalous samples. When \(\pi\) is tiny, the \((1-\pi)\,\text{FPR}\) term dominates unless FPR is driven to something comparable to \(\pi\) itself. That is the whole game: to keep precision usable at a base rate of \(10^{-4}\), your false-positive rate has to live near \(10^{-4}\) too, which is far stricter than the "three sigma" reflex from Section 12.3 delivers.

Threshold economics: a cost model for the line

To place the threshold deliberately, attach money (or time, or risk) to each cell of the confusion matrix. Let a missed fault cost \(C_{\text{FN}}\), a false alarm cost \(C_{\text{FP}}\) (the responder minutes plus the erosion of trust), and let true positives carry a benefit \(V_{\text{TP}}\) from acting early. For a threshold \(\tau\) that yields \(\text{TPR}(\tau)\) and \(\text{FPR}(\tau)\), the expected cost per sample is

Minimizing this over \(\tau\) gives the economically optimal operating point, and it is almost never where a symmetric statistical rule lands. The ratio \(C_{\text{FN}}/C_{\text{FP}}\) is the single most important number you will elicit from a domain expert, and it swings across domains by orders of magnitude. A missed bearing failure that scraps a turbine dwarfs the cost of a nuisance ticket, so you push \(\tau\) down. A false cardiac arrhythmia alert that sends someone to the emergency department at 3 a.m. is expensive and frightening, so you push \(\tau\) up. The math is identical; only the costs move the line. This is also why a single global threshold across a heterogeneous fleet is usually wrong: the base rate \(\pi\) and the costs both vary per asset, so the optimal \(\tau\) does too.

Budgeting attention: alert rate as a first-class constraint

Once you accept that attention is finite, the natural control variable is not the score threshold directly but the alert rate it produces. Pick the volume a responder can absorb, say \(k\) alerts per shift, and choose \(\tau\) so the empirical firing rate on recent healthy data matches that budget. This is the alarm-flood lesson codified in the process-industry standards (ISA-18.2, EEMUA-191), which put concrete numbers on tolerable load: roughly one alarm per operator every ten minutes as a manageable steady state, and floods above ten alarms in ten minutes as the point where operators stop coping. Rate budgeting has three practical virtues over raw thresholding. It is robust to score drift, because you re-solve \(\tau\) from the current distribution rather than trusting a frozen number. It composes across a fleet, because you can allocate the global budget to assets by expected value. And it degrades gracefully, because when a genuine broad event arrives the budget forces prioritization of the most surprising alerts rather than a formless flood.

Two mechanisms turn a raw score stream into a budgeted, low-fatigue alert stream. Hysteresis (dual thresholds: fire at a high level, clear only after dropping below a lower one) kills the chatter of a score dithering across a single line, which otherwise generates dozens of open-close pairs per real event. Debouncing or persistence requires the score to stay elevated for \(m\) consecutive samples before alerting, trading a little detection latency for a large cut in single-sample false positives. The persistence idea connects directly to the change-point accumulators of Section 12.4: a CUSUM that must build up evidence is a debounced detector by construction, which is exactly why change-point methods tend to alert less noisily than pointwise thresholds.

import numpy as np

def budgeted_threshold(scores_healthy, k_per_shift, samples_per_shift):
    """Pick the score threshold that fires at most k times per shift on healthy data."""
    rate = k_per_shift / samples_per_shift            # target per-sample alert rate
    tau = np.quantile(scores_healthy, 1.0 - rate)     # invert the empirical tail
    return tau

def alerts_with_hysteresis(scores, tau_hi, tau_lo, persistence=3):
    """Emit one alert per sustained excursion, not one per sample above the line."""
    alerts, armed, run = [], True, 0
    for t, s in enumerate(scores):
        run = run + 1 if s > tau_hi else 0
        if armed and run >= persistence:              # sustained, and not already firing
            alerts.append(t); armed = False
        if not armed and s < tau_lo:                  # cleared: re-arm for the next event
            armed = True
    return alerts

rng = np.random.default_rng(0)
healthy = rng.normal(0, 1, 200_000)
tau_hi = budgeted_threshold(healthy, k_per_shift=15, samples_per_shift=28_800)
stream = np.r_[rng.normal(0, 1, 5_000), rng.normal(4.5, 1, 60), rng.normal(0, 1, 5_000)]
print(f"tau_hi={tau_hi:.2f}, alerts={len(alerts_with_hysteresis(stream, tau_hi, tau_hi-1.0))}")

The snippet above shows the two moves in isolation, but production alerting stacks add deduplication, grouping of correlated assets, escalation tiers, and suppression during known maintenance windows. You should not hand-roll all of that.

Measuring fatigue and closing the loop

Threshold economics only works if you instrument the loop you are trying to protect. The metrics that matter are operational, not statistical: the alert-to-action ratio (fraction of alerts that lead to any intervention), the acknowledgement latency and its drift over time (rising latency is the early signature of fatigue), the auto-close and mute rates (an operator silencing a source is a loud signal that precision has failed), and the true faults that arrived without a preceding open alert. Feed these back into the cost model: the empirical false-alarm cost \(C_{\text{FP}}\) is not a constant but rises as responders tire, so a system that ignores fatigue systematically under-prices its own false positives. Practically, review the alert budget on the same cadence you retrain, treat any asset whose mute rate crosses a threshold as mis-calibrated, and remember that lowering the alert rate is often a larger real-recall win than any model improvement, because it buys back the attention that turns alerts into actions. This closes the loop with the fleet-operations concerns of Chapter 69, where alert quality is a monitored, drifting quantity like any other.

What's Next

In Chapter 13, we leave hand-built scores and thresholds behind and let the model learn its own representation of a sensor stream. Neural encoders will give us richer anomaly scores, but the economic lesson of this section carries forward unchanged: a learned detector still emits alerts into a finite pool of attention, and the fanciest representation in the world earns nothing until its threshold respects the budget.