Derivatives Foundation puzzles, solved step by step

Puzzles
100
Traced to a firm
66
Topics
12
Hard
29
Topic
All topicsMental maths and estimation9Random walks and Markov chains7Conditional probability and Bayes7Volatility and correlation7Option pricing intuition7Expected value and optimal stopping10Market making11Option payoffs and no-arbitrage10Probability and counting11Distributions and statistics8Games and logic8Betting and sizing5
Level
AnyWarm upCoreHard
Source
AnyReported at a firmStandard
Showing 1–1 of 1 · filtered from 100Clear filters
  1. 006A trade surveillance system raises an alert on 95% of genuinely suspicious trades and, wrongly, on 2% of normal trades. One trade in a thousand is genuinely suspicious. An alert has just fired on a trade. What is the probability the trade is suspicious?Conditional probability and BayesWarm upCitadelMiami · 2022

    Try it first

    Gut answer before you count anything.

    Show the worked solution

    About 4.5%. Count 100,000 trades. One in a thousand is suspicious, so 100 are, and 95 of those alert. The other 99,900 are normal, and 2% of them, 1,998, alert anyway. Alerts total 2,093, of which 95 are genuine, so the probability that an alerted trade is suspicious is 95 over 2,093, about 4.5%. The 95% hit rate is not the answer; the base rate is what decides it.

    Why does a 95% accurate system give a 4.5% answer?

    A smoke alarm that goes off for 2% of toast is a fine alarm in a house that is never on fire; nearly every ring will be toast. When the thing you are looking for is rare, even a small false-alarm rate applied to the huge normal pile produces more alerts than the true cases produce. Here 2% of 99,900 normal trades is 1,998, twenty times the 95 genuine alerts. The system is not bad; the base rate is low, and that is what the question is testing.

    Count 100,000 trades: the false alarms from the normal pile swamp the true onesAll trades100,0001 in 1,000999 in 1,000Genuinely suspicious100Normal99,90095% alert5% missed2% alert98% quietTrue alerts95Missed5False alerts1,998Quiet97,902Alerts in all: 95 + 1,998 = 2,093. Suspicious given an alert = 95 / 2,093 = 4.5%
    Of 100,000 trades, 100 are suspicious and raise 95 true alerts, while the 99,900 normal trades raise 1,998 false ones, so alerts total 2,093 and a trade that alerts is genuinely suspicious only 4.5% of the time.
    The relationship
    P(S∣A)=P(A∣S) P(S)P(A∣S) P(S)+P(A∣N) P(N)=0.95×0.0010.95×0.001+0.02×0.999=952,093≈4.5%P(S \mid A) = \frac{P(A \mid S)\,P(S)}{P(A \mid S)\,P(S) + P(A \mid N)\,P(N)} = \frac{0.95 \times 0.001}{0.95 \times 0.001 + 0.02 \times 0.999} = \frac{95}{2{,}093} \approx 4.5\%
    S, Na suspicious trade, a normal trade
    Aan alert fires
    P(A | S) = 0.95the hit rate
    P(A | N) = 0.02the false-alarm rate
    P(S) = 0.001the base rate
    What it says in wordsTrue alerts divided by all alerts, where all alerts are the true ones plus the false ones from the normal pile.

    What is the fastest way to say it in the room?

    Do not write Bayes' formula; count a round number of trades. Say: in 100,000 trades, 100 are suspicious and 95 alert; 99,900 are normal and 1,998 alert; 95 over 2,093 is about 4.5%. Three sentences, no algebra, and every number is checkable by the person listening. The odds form is just as quick: prior odds 1 to 999, likelihood ratio 0.95 over 0.02, about 47.5, so posterior odds 47.5 to 999, roughly 1 to 21.

    What does the desk do with a 4.5% answer?

    It decides what the alert is for. A 4.5% hit rate is fine for a filter that sends trades to a human for a second look, and useless for an automatic block, because 95% of blocked trades would be legitimate business. That is the trade-off every surveillance, fraud and risk-limit system lives with: a lower threshold catches more of the 100 but drags in more of the 99,900. Say the limitation too: the 2% and 95% are themselves estimates from past data, and a system tuned on last year's patterns can drift.

    Where candidates lose it

    The whole trap is answering 95%, confusing the probability of an alert given a suspicious trade with the probability of a suspicious trade given an alert. Interviewers ask this precisely because the two sound the same and are twenty times apart.

    The second loss is reaching for the formula and tangling the denominator. Count 100,000 trades and the denominator builds itself: 95 plus 1,998.

    What the interviewer asks next

    • The false-alarm rate is cut to 0.5%. What is the probability now?
    • Two independent systems both alert on the same trade. What is the probability it is suspicious?
    • What base rate would make an alert a coin flip, and what does that tell you about where surveillance is worth running?

    Asked at Citadel, Sales and Trading, Miami, 2022 (Wall Street Oasis): I got a question about Bayes' theorem applied to a practical scenario, which I handled decently