Download the Book (PDF): Introduction A modern smartwatch shines a green light into the skin of your wrist hundreds of times a second and listens for what comes back. Almost all of that light is wasted. It scatters through the epidermis, is absorbed by melanin and by the water and collagen of the dermis, and bounces about in a medium that, optically, behaves rather like a glass of milk. A tiny fraction returns to a photodiode a few millimetres away. Of that returning fraction, the part that actually changes with each heartbeat, the part that carries the pulse, is typically around one percent of the total, and on a cold day with poorly perfused skin it can be a tenth of that. Everything the watch tells you about your heart, from the number on the face to an alert that your rhythm looks irregular, is inferred from that flicker. A continuous glucose monitor faces a different version of the same problem. A filament thinner than a sewing thread sits a few millimetres under the skin of the arm or abdomen, bathed not in blood but in interstitial fluid, the watery medium that fills the spaces between cells. An enzyme on its surface reacts with glucose and produces a current measured in nanoamperes. That current drifts as the body wraps the filament in proteins and immune cells, changes with temperature, and lags the bloodstream by several minutes. From it, the device must report a number accurate enough that a person will decide, on the strength of it, how much insulin to inject. A wrong number in one direction leaves blood sugar dangerously high; in the other, it can put someone on the floor. Both devices then face a third problem, which receives far less public attention and determines almost everything about how they look and feel. They must do all of this, continuously, for days, weeks or a year, on a battery small enough to disappear into a wristband or an adhesive disc the size of a coin, and they must get the results across a few metres of air to a phone that may be in another room, asleep, or busy doing something else. The argument of this book This book is about the engineering that turns those weak, indirect, drifting signals into numbers that clinicians and regulators will trust. Its central claim is simple to state and demanding in practice: a medical-grade wearable is built backwards from its error budget and its energy budget. The question is never only "can we measure this?" It is "how wrong can this number be, in which direction, for whom, and under what conditions, and how many microjoules can we afford to spend finding out?" Every design decision, from the wavelength of an LED to the chemistry of an enzyme membrane to the interval at which a Bluetooth radio wakes up, is a trade between those two budgets. The devices that succeed are the ones whose makers were honest about where the chain from physiology to radio packet breaks, and engineered around the breaks rather than around the marketing. That claim decides what this book covers and what it leaves out. It concentrates on two sensing modalities that have crossed decisively into medical use: photoplethysmography, the optical measurement of pulsing blood volume that underlies heart rate, heart rate variability, rhythm screening and pulse oximetry; and continuous glucose monitoring, the electrochemical measurement of glucose in interstitial fluid. It treats sweat biosensing as a third, instructive case: a field with real scientific achievements and real products, but one where the gap between laboratory demonstration and trustworthy clinical number remains wide, for reasons that illuminate the other two. And it treats the electronics, firmware and radio that carry all of these signals as a single subject, because in a wearable they are a single subject: the analog front end, the processor and the radio draw from the same battery, and the decision to compute something on the wrist rather than send raw data to the phone is as consequential as any choice about optics or chemistry. It leaves out a great deal. Electrocardiography on a watch, bioimpedance, skin temperature, accelerometry for gait and falls, and the many experimental modalities chasing blood pressure or hydration appear only where they bear on the main argument. Insulin pumps and automated insulin delivery algorithms are discussed only as consumers of glucose data. The business of wearables, from subscription models to app ecosystems, is largely absent. The aim is depth on a narrow front. Why now The timing matters. For most of the last decade, consumer wearables and medical devices occupied separate worlds, with the boundary policed by the United States Food and Drug Administration's distinction between "general wellness" products, which need no clearance, and devices intended to diagnose or treat disease, which do. That boundary has been moving quickly. In 2024 the FDA cleared the first continuous glucose monitors sold over the counter without a prescription: Dexcom's Stelo in March and Abbott's Lingo in June. Glucose sensors that began as insulin-dosing tools for people with type 1 diabetes became products marketed to people with type 2 diabetes who do not use insulin and to people without diabetes at all. In September 2024 Senseonics received clearance for Eversense 365, an implanted sensor that lasts a year. In April 2025 Dexcom received clearance for a 15-day version of its G7 sensor, with a reported mean absolute relative difference from laboratory reference of 8.0 percent. Accuracy figures that would have seemed implausible fifteen years ago are now routine product specifications. On the optical side, the same years produced both triumphs and reckonings. Large studies of watch-based rhythm screening, including the Apple Heart Study with more than 400,000 participants, showed that photoplethysmography could identify possible atrial fibrillation at population scale. In September 2025 the FDA cleared a hypertension notification feature for the Apple Watch that analyses optical pulse data over thirty-day windows. But the COVID-19 pandemic also exposed, through work published in the New England Journal of Medicine in 2020, that hospital pulse oximeters overestimated oxygen saturation in Black patients often enough to miss dangerous hypoxaemia, and in January 2025 the FDA issued draft guidance proposing much stricter testing across skin tones. In February 2024 the agency warned consumers not to use smartwatches or rings claiming to measure blood glucose without piercing the skin. In July 2025 it sent a warning letter to the fitness-band maker Whoop over a blood pressure feature the company had marketed as a wellness product. Taken together, these events describe a field in which the engineering has become good enough to matter clinically, and in which regulators, clinicians and the public are learning, sometimes painfully, to ask the right questions of it. Those questions are the subject of this book. How the book is organised The first chapter sets out what "medical-grade" actually means: not a quality of materials or a marketing tier, but a claim about intended use, backed by evidence that the error in the number is bounded and understood. It introduces the error budget as the organising tool for the rest of the book. The next two chapters follow light through tissue. Chapter 2 explains the physics of photoplethysmography: why green light dominates the wrist, why red and infrared are needed for oxygen saturation, how skin tone, temperature and sensor placement shape the signal, and what the 2020 oximetry findings reveal about calibration. Chapter 3 moves from the raw waveform to the numbers derived from it: detecting individual beats in the presence of motion, extracting heart rate variability, and screening for arrhythmia, with careful attention to the difference between what a wrist sensor measures and what an electrocardiogram measures. Chapters 4 and 5 turn to glucose. Chapter 4 explains how an enzyme electrode works, why interstitial fluid lags blood, and how the body's response to an implanted filament shapes sensor lifetime. Chapter 5 examines how accuracy is proven and what accuracy figures conceal, from the statistical meaning of MARD to the regulatory special controls for integrated sensors and the reasons noninvasive glucose remains elusive. Chapter 6 takes up sweat: what sweat contains, how microfluidic patches collect it, which measurements are reliable, and why the dream of a sweat-based glucose meter has proven so hard. The last two chapters are about electronics. Chapter 7 covers the analog front end and firmware: how an LED pulse is turned into a digital sample, how ambient light is cancelled, and how much computation should happen on the device. Chapter 8 covers Bluetooth Low Energy as an engineering discipline for continuous telemetry, with a worked energy budget for a coin-cell device, the problem of lost data, and the constraints imposed by phone operating systems. The conclusion draws out what follows for people who build, buy, prescribe and regulate these devices. Throughout, the emphasis is on mechanism. Where a number is quoted, it comes from a named source, and where the evidence is unsettled, the book says so. The reader needs no background in electronics, optics or biochemistry, only patience with a few ideas that are worth understanding properly: that a signal is always a ratio of what you want to what you do not; that an average error can hide a dangerous one; and that energy, on a device that must run for a fortnight on a battery the size of a fingernail, is the currency in which every other ambition is paid. Chapter 1: What Medical-Grade Means The phrase "medical-grade" is used loosely in consumer electronics, usually to suggest better materials, tighter manufacturing or a premium price. In engineering and regulatory practice it means something narrower and more useful. A device is medical-grade when its maker claims that its output can be used to diagnose, monitor or treat a disease, and has demonstrated, to a regulator's satisfaction, that the error in that output is bounded, characterised and acceptable for the purpose. The hardware inside a medical-grade wearable may be almost identical to the hardware inside a wellness gadget. What differs is the claim, and the evidence that supports it. This distinction matters because it reorganises how a wearable is designed. A wellness device can report a resting heart rate that is usually close to the truth and occasionally wildly off, and the cost of the error is mild annoyance. A device that tells a person with diabetes that their glucose is 110 milligrams per decilitre when it is actually 55 has made an error that can cause a seizure. The first device can be built forwards from what the sensor happens to do well. The second must be built backwards from the question of how wrong it is allowed to be. Intended use is the dividing line In the United States, the legal definition of a medical device turns on intended use: an instrument intended for use in the diagnosis, cure, mitigation, treatment or prevention of disease, or intended to affect the structure or function of the body. Intended use is established by the maker's claims, labelling and marketing, and also, as the FDA has repeatedly made clear, by what the product actually does and how it is reasonably expected to be used. Since 2016 the FDA has also maintained guidance on "general wellness" products: low-risk devices intended only to maintain or encourage a healthy lifestyle, which the agency does not intend to regulate as medical devices. A step counter that encourages walking is a wellness product. A sleep tracker that reports how long you slept is a wellness product. The line becomes contested when a wellness product measures a quantity that is itself a clinical marker of disease. The clearest recent illustration is the warning letter the FDA sent to Whoop on 14 July 2025 concerning a feature called Blood Pressure Insights. Whoop's band estimated systolic and diastolic ranges from its optical sensor, and the company labelled the feature as not a medical device and not intended to diagnose any condition. The FDA's position, stated repeatedly in the letter, was that blood pressure estimation is inherently associated with the diagnosis of hypertension, so that a product providing it is a device regardless of disclaimers. Whoop publicly disagreed and argued that the feature fell within the wellness policy. Whatever the eventual resolution, the episode shows that the boundary is not drawn by labelling alone. A number that a reasonable person would use to make a medical decision invites medical scrutiny. Two months later, in September 2025, the FDA cleared Apple's hypertension notification feature for the Apple Watch. The contrast is instructive. Apple did not claim to measure blood pressure at all. Its feature analyses optical pulse data collected during waking hours across thirty-day windows and uses a machine-learning model to flag a pattern associated with hypertension, after which the user is told to take conventional cuff measurements. The claim is narrow, the output is a notification rather than a number, and the evidence was a clinical validation in more than 2,000 participants. A summary in the American Family Physician community blog reported a sensitivity of 41.2 percent and a specificity of 92.3 percent against a threshold of 130/80 mmHg. In other words, the notification misses most people with hypertension, and Apple's claim was built to be honest about that: absence of a notification does not mean absence of disease. The engineering supports a screening nudge. It does not support a blood pressure reading, and the product does not pretend otherwise. Table 1 places several well-known wearable features on this landscape. The pattern is that the regulated features make narrow, specific claims supported by targeted studies, while the general measurements on which they rest, such as heart rate, often remain outside regulation altogether. Table 1. Selected wearable features and their regulatory footing in the United States (sources: FDA announcements and company releases). Feature Product What it claims Status Irregular rhythm notification Apple Watch Flags pulse patterns suggestive of atrial fibrillation FDA De Novo, 2018 Integrated CGM (iCGM) Dexcom G6 Glucose values usable with compatible pumps First iCGM, De Novo, 2018 Over-the-counter CGM Dexcom Stelo Glucose for adults not using insulin 510(k), March 2024 One-year implanted CGM Eversense 365 Glucose for adults with diabetes Cleared September 2024 Blood Pressure Insights Whoop Estimated blood pressure ranges FDA warning letter, July 2025 Hypertension notifications Apple Watch Flags patterns linked to hypertension Cleared September 2025 Outside the United States the details differ but the logic is similar. Under the European Union's Medical Device Regulation, software that provides information used to take decisions for diagnostic or therapeutic purposes is generally placed in a higher risk class than it was under the previous directives, which pushed many health apps and algorithms out of self-certification and into review by notified bodies. Everywhere, the trigger is the same: the intended use of the output. The error budget Once a maker decides to make a medical claim, the central engineering artefact becomes the error budget. An error budget is an accounting of every source of discrepancy between what the device reports and the true physiological quantity, with an estimate of each contribution and an understanding of how they combine. It is the same tool used in precision optics or satellite navigation, and it is the tool that turns vague aspirations about "accuracy" into decisions. Consider a continuous glucose monitor. The quantity of clinical interest is blood glucose. The device, however, measures a current produced by an enzyme reaction in interstitial fluid. Between the two lie at least five distinct sources of error. The first is physiological. Glucose diffuses from capillaries into interstitial fluid, and when blood glucose is changing quickly, interstitial glucose trails behind by several minutes. During a rapid fall after exercise or an insulin dose, a perfectly accurate interstitial sensor will report a value that is too high, simply because it is measuring a different compartment. The second is the sensor itself: its sensitivity, meaning how many nanoamperes it produces per unit of glucose, varies from one manufactured filament to the next, and changes over the days of wear as tissue reacts to the implant. Some sensors are factory-calibrated by characterising every manufacturing lot; others ask the user for fingerstick calibrations to correct the drift. The third is electronic: noise in the potentiostat and analog-to-digital converter, temperature sensitivity of both the enzyme and the electronics, and the background current that flows even in the absence of glucose. The fourth is algorithmic: the filtering that smooths noise also delays the signal, and the models that compensate for lag can overshoot. A design that reports a glucose value every minute rather than every five minutes must decide how much smoothing to apply, and every choice trades noise against delay. The fifth, often forgotten, is the reference. Accuracy studies compare a sensor against something believed to be the truth, typically a laboratory glucose analyser measuring venous blood drawn during a clinic session. That analyser has its own error, small but not zero. A fingerstick meter, which many people treat as ground truth, is held under the international standard ISO 15197:2013 to having 95 percent of readings within 15 mg/dL of reference below 100 mg/dL and within 15 percent above it. A CGM that agrees closely with a fingerstick meter may simply be sharing the meter's errors. Writing these contributions down does two things. It shows where improvement is possible and where it is not: no amount of electronic refinement will remove the physiological lag, which can only be modelled. And it forces the designer to ask in which direction each error falls and in which conditions it matters. A sensor that reads ten percent high at 300 mg/dL and ten percent low at 60 mg/dL has the same average error as one that does the opposite, but the clinical consequences are very different. The first tends to understate hypoglycaemia, which is the dangerous direction. Photoplethysmography has an equivalent budget. For heart rate, the sources include the optical coupling between sensor and skin, the strength of the pulsatile signal relative to the steady one, contamination from motion, contamination from ambient light, and the algorithm's ability to pick the true cardiac frequency out of a spectrum that may contain a stronger peak from arm swing or cadence. For pulse oximetry, the budget is dominated by calibration: the mapping from an optical ratio to oxygen saturation is empirical, derived from studies in human volunteers, and if those volunteers do not represent the population of users, the calibration carries a systematic bias that no amount of signal processing can detect. Accuracy is a distribution, not a number The single most common mistake in reading wearable specifications is treating an accuracy figure as a property of each reading. It is a summary of a distribution, and summaries hide things. Continuous glucose monitors are usually described by their mean absolute relative difference, or MARD: for every paired reading, take the absolute difference between sensor and reference, divide by the reference, and average across all pairs. Dexcom's 15-day G7 sensor was reported at an MARD of 8.0 percent. Abbott reports 8.2 percent overall for its FreeStyle Libre 3 Plus, according to the Association of Diabetes Care and Education Specialists' device database. These are excellent numbers. But a MARD of 8 percent is fully compatible with a small fraction of readings that are off by 30 or 40 percent, and if those readings cluster in the hypoglycaemic range, or in the first day of wear, or during rapid change, the average conceals exactly the errors that matter most. This is why regulators increasingly specify accuracy by range and by tail rather than by average. The FDA's special controls for integrated continuous glucose monitors, codified in 2018 in the Code of Federal Regulations at 21 CFR 862.1355, set separate requirements for readings below 70 mg/dL, between 70 and 180, and above 180, specify what share must fall within tighter and wider bounds, require that these shares be demonstrated with statistical confidence rather than as point estimates, and forbid gross reversals: when the sensor reads below 70, no corresponding reference value may be above 180, and vice versa. Chapter 5 examines these requirements in detail. The principle is general. A medical-grade claim is a claim about the worst plausible errors, not the typical ones. Pulse oximeters are described by a different statistic, the root-mean-square difference between device and arterial blood gas measurements, abbreviated Arms. An Arms of 3 percent across the 70 to 100 percent saturation range is a common benchmark in FDA practice for transmission oximeters. Again, a respectable average can hide a systematic offset in one subgroup. The 2020 study by Michael Sjoding and colleagues in the New England Journal of Medicine found that among hospital patients whose pulse oximeters read between 92 and 96 percent, arterial blood showed a true saturation below 88 percent in 11.7 percent of Black patients compared with 3.6 percent of White patients in the University of Michigan cohort. Those devices had passed their accuracy testing. The error budget had a term that the test populations were not large or diverse enough to reveal. For rhythm screening, the relevant statistics are sensitivity, specificity and positive predictive value, and these depend heavily on who is being screened. The Apple Heart Study, published in the New England Journal of Medicine in 2019, enrolled 419,297 participants. Only 0.52 percent received an irregular pulse notification. Among notified participants who later wore an electrocardiogram patch, 34 percent had atrial fibrillation detected on the patch, and when a notification occurred while the patch was being worn, the positive predictive value for concurrent atrial fibrillation was 0.84. Each of these numbers answers a different question. The first describes how rarely the algorithm fires. The second reflects, in part, that atrial fibrillation is intermittent, so a patch worn days later may simply miss it. The third describes how often the algorithm is right at the moment it fires. Quoting any one of them as "the accuracy" misleads. Adjunctive and non-adjunctive claims The history of continuous glucose monitoring shows how a claim can be widened step by step as the error budget is tightened, and how much hangs on the precise wording. Early CGMs were cleared as adjunctive devices. They could show trends and warn of highs and lows, but users were instructed to confirm any reading with a fingerstick meter before making a treatment decision such as dosing insulin. In practice many users dosed from the sensor anyway, but the label reflected what the evidence then supported: sensor readings were good enough to prompt a check, not good enough to replace one. In December 2016 the FDA approved Dexcom's G5 Mobile system for non-adjunctive use, meaning that its readings could be used for treatment decisions without fingerstick confirmation, provided the user still calibrated the sensor twice daily. The change was not mainly a hardware change. It rested on accuracy data, on studies of how people actually made decisions using the sensor, and on an advisory committee's judgement that the residual risk was acceptable given the benefits of more frequent information. Two years later, the G6 removed the need for user calibration altogether and became the first sensor in the new integrated class. Each step widened what the device was permitted to be used for, and each was earned with evidence that a particular kind of error had been brought within a particular bound. The same structure applies elsewhere. A heart rhythm feature that notifies a user to see a doctor makes a smaller claim than one that diagnoses atrial fibrillation, and a feature that estimates the share of time spent in atrial fibrillation for someone already diagnosed makes a different claim again. A pulse oximeter used for spot checks in a general ward makes a smaller claim than one used to titrate oxygen in intensive care. In each case, the claim defines the decision the number will feed, the decision defines which errors are dangerous, and the dangerous errors define the evidence required. Engineers sometimes experience regulatory language as an obstacle that arrives late in a project. It is more accurately the first specification. The claim also defines the population. A device cleared for adults may behave differently in children, whose skin, perfusion and glucose dynamics differ. A rhythm algorithm validated mostly in people in their forties may perform differently in people in their seventies, among whom other arrhythmias are more common. A CGM tested in people with type 1 diabetes may encounter different glucose patterns, medications and body compositions in people with type 2 diabetes. When a maker extends a cleared device to a new population, the error budget must be re-examined, because some of its terms, particularly the physiological ones, belong to the population as much as to the device. Building backwards Taken together, these points imply a design method. A team building a medical-grade wearable starts by stating, precisely, the claim it intends to make and the population it intends to serve. From the claim follows the clinically acceptable error, specified by range and by tail, not by average. From that follows an error budget, with each term allocated a share of the allowable total. Only then do the hardware choices follow: the optical geometry or electrode chemistry, the front-end noise floor, the sampling rate, the filtering, the calibration strategy, and the study design that will prove the result in people who resemble the eventual users. The energy budget is set in parallel and constrains every one of these choices. Lower noise usually costs power: brighter LED pulses, higher sampling rates, more averaging, a more capable processor. Lower latency usually costs power too: more frequent radio connections. A device that must last fifteen days on a non-rechargeable cell, or a week between charges on a watch that also runs a display, cannot simply buy accuracy with energy. The art lies in spending energy where the error budget says it will do the most good, such as sampling more densely only when motion is detected, or transmitting promptly only when glucose is approaching a threshold. The remaining chapters follow this logic through each layer. They begin with light, because the optical problem illustrates with particular clarity how much of a wearable's performance is fixed by physics before a single line of firmware is written. Chapter 2: Light in Tissue Photoplethysmography is old. The physiologist Alrick Hertzman coined the term in the late 1930s for a technique that recorded changes in the amount of light passing through or reflected from tissue as blood volume rose and fell with each heartbeat. The principle has not changed since. Blood absorbs light strongly; with each systolic surge, the small arteries and arterioles in the illuminated tissue swell slightly and contain a little more blood; so slightly less light reaches the detector. Between beats, the vessels relax and more light returns. The resulting waveform, recorded over time, is the photoplethysmogram, and nearly every optical health feature on a modern wearable is derived from it. What has changed is everything around the principle: the light sources, the detectors, the electronics that drive and read them, the processors that interpret the waveform, and above all the ambition. A finger clip in a hospital asks the photoplethysmogram for one or two numbers under controlled conditions. A watch asks it for heart rate during a sprint, heart rate variability during sleep, rhythm irregularity over weeks, and, increasingly, signs of hypertension or sleep apnoea. To understand what is possible, and what is not, it helps to follow a photon on its journey. A photon's path Skin is not a window. It is a layered, turbid medium. The outermost layer, the epidermis, is around a tenth of a millimetre thick on the forearm and contains melanin, the pigment that gives skin its colour and that absorbs light strongly, particularly at shorter wavelengths. Beneath it lies the dermis, a millimetre or two of collagen, water and blood vessels, with a fine capillary network near its upper boundary and larger arterioles and venules deeper down. Below that is subcutaneous fat, and then, at the wrist, tendons and bone. When an LED on the back of a watch fires, its light enters this medium and immediately begins to scatter. Scattering in tissue is dominated by collagen fibres and cell structures, and it is far stronger than absorption at most visible and near-infrared wavelengths. A photon changes direction many times within the first millimetre. Its path becomes a random walk. Some photons are absorbed by melanin in the epidermis on the way in; some by haemoglobin in the blood vessels; some by water. A small fraction, having wandered through a banana-shaped region of tissue, emerges back at the surface near the photodiode and is counted. The geometry of that banana-shaped region matters. The average depth probed by the detected photons increases with the spacing between the LED and the photodiode, and with the wavelength. Light that travels farther before detection has, on average, gone deeper. A sensor designer chooses the spacing to reach the vessels that pulse most strongly while still collecting enough light to measure. Too close, and the detector sees mostly light scattered in the bloodless epidermis, which carries no pulse. Too far, and so little light returns that electronic noise dominates. The detected light has two components. The large, steady component, conventionally called DC, comes from light that has passed through tissue whose absorption does not change from beat to beat: skin, bone, fat, venous blood, and the non-pulsing portion of arterial blood. The small, varying component, called AC, comes from the change in arterial blood volume with each heartbeat. The ratio of AC to DC, often expressed as a percentage and called the perfusion index, is the fundamental figure of merit for a photoplethysmogram. At a fingertip in a warm room, it may be several percent. At the wrist it is commonly well under one percent, and in cold conditions, or in people with poor peripheral circulation, it can drop by an order of magnitude. This small ratio is the root of nearly every difficulty in wearable optics. The AC component is the signal. The DC component, which may be a hundred or a thousand times larger, must be measured with enough precision that changes of a fraction of a percent are visible above noise. Anything that moves the DC level, whether a shift in the sensor's position on the skin, a change in ambient light, or a change in the pressure of the strap, can easily produce a change larger than the pulse itself. Choosing a colour Haemoglobin, the oxygen-carrying protein in red blood cells, absorbs light very differently across the spectrum. In the green part of the spectrum, around 520 to 570 nanometres, both oxygenated and deoxygenated haemoglobin absorb strongly. In the red, around 660 nanometres, deoxygenated haemoglobin absorbs much more than oxygenated haemoglobin. In the near infrared, around 880 to 940 nanometres, the relationship reverses and oxygenated haemoglobin absorbs slightly more. Melanin absorbs most strongly at short wavelengths and progressively less towards the infrared. Water absorption rises in the infrared beyond about 950 nanometres. These facts determine the choice of light. Table 2 summarises the main wavelengths used in wearable photoplethysmography and their trade-offs. Table 2. Common wavelengths in wearable photoplethysmography and their trade-offs (based on standard tissue optics). Wavelength Typical use Penetration Main strength Main weakness Green, about 525 nm Heart rate on the wrist Shallow, about 1 mm or less Strong pulsatile contrast near surface; less sensitive to deep motion Strongly absorbed by melanin Red, about 660 nm Oxygen saturation Deeper Large difference between oxygenated and deoxygenated haemoglobin Weaker pulse at wrist; more motion sensitivity Infrared, about 880 to 940 nm Oxygen saturation; heart rate in some designs Deepest Less melanin absorption; reaches larger vessels More susceptible to motion and venous contributions Green dominates heart rate measurement on wrist wearables, a choice that sometimes surprises engineers trained on finger-clip oximeters, which use red and infrared. The reason lies in the error budget for motion. Green light, strongly absorbed, penetrates only shallowly and samples mainly the dense capillary and arteriolar bed in the upper dermis. Red and infrared light penetrate deeper, where they also sample larger veins and are more strongly modulated by movements of tendons and tissue beneath the sensor. Research groups comparing wavelengths during physical activity have generally found that green yields a more motion-robust pulse signal at the wrist. Green also has a higher ratio of pulsatile signal to steady signal in well-perfused superficial skin, because the absorption contrast between blood and bloodless tissue is so large at that wavelength. The cost of green is melanin. Because melanin absorbs green light strongly, darker skin returns less green light to the detector, lowering the DC level and, with it, the signal-to-noise ratio. The obvious engineering response is to increase LED drive current or integration time when the returned signal is weak, and most modern devices do so automatically, at the cost of power. Whether residual differences in accuracy remain has been studied directly. A 2020 study by Brinnae Bent and colleagues, published in npj Digital Medicine, compared several consumer and research wearables against electrocardiogram reference across the full Fitzpatrick skin type scale and across rest and activity. It found no statistically significant difference in heart rate accuracy by skin tone, but substantial differences by activity type, with errors during activity roughly thirty percent higher on average than at rest. That result is reassuring for heart rate on the devices tested, but it does not license the assumption that all optical measurements are equally robust, and it does not apply to oxygen saturation, where the calibration problem is of a different kind. The ratio of ratios Pulse oximetry was invented by Takuo Aoyagi, an engineer at the Japanese company Nihon Kohden, in the early 1970s. His insight was that the pulsatile component of the photoplethysmogram isolates arterial blood. If one measures the pulse at two wavelengths with different sensitivity to oxygenation, the ratio between them depends on the oxygen saturation of arterial blood and, to first order, not on how much tissue, skin or venous blood lies in the light path. The calculation is elegant. At each wavelength, divide the AC amplitude by the DC level. This normalisation removes the effects of LED brightness, detector sensitivity and the overall absorption of bloodless tissue. Then divide the normalised red value by the normalised infrared value. The resulting number, universally called R or the ratio of ratios, falls as saturation rises. At high saturation, the red pulse is small relative to the infrared pulse, because oxygenated haemoglobin absorbs little red light; as saturation falls, deoxygenated haemoglobin, which absorbs red strongly, makes the red pulse grow. The crucial point is what happens next. One might expect R to be converted to saturation using the known absorption spectra of haemoglobin and the Beer-Lambert law, which relates absorption to concentration and path length. In practice this does not work well enough, because the Beer-Lambert law assumes that light travels in straight lines through a non-scattering medium, and tissue violates that assumption completely. Scattering lengthens the photon path by different amounts at different wavelengths, and those differences depend on tissue properties that vary between people. So every commercial oximeter uses an empirical calibration curve, obtained by measuring R in healthy volunteers whose arterial saturation is deliberately lowered by breathing gas mixtures with reduced oxygen, while arterial blood samples are drawn and analysed by a laboratory co-oximeter. A frequently quoted textbook approximation is a straight line in which saturation falls by about 25 percentage points for each unit increase in R, but real devices use curves fitted to their own sensors. This is where the 2020 findings bite. If the volunteers in the calibration studies are mostly lightly pigmented, and if melanin affects red and infrared light differently enough to shift R slightly for the same arterial saturation, the calibration will be biased for darker-skinned users. The bias will not show up as noise; it will show up as a consistent overestimate, which no quality check within the device can detect. The study by Sjoding and colleagues found exactly that pattern: occult hypoxaemia, meaning a true arterial saturation below 88 percent while the oximeter read between 92 and 96 percent, was roughly three times as frequent in Black patients as in White patients, in both a single-centre and a multicentre cohort. Regulators had required some diversity in calibration studies for years. The FDA's 2013 guidance on pulse oximeters recommended that clinical testing include at least two darkly pigmented subjects or fifteen percent of the subject pool, whichever was larger. That requirement could be satisfied by studies of only ten or so people, too few to estimate a modest bias in a subgroup with any confidence. The draft guidance issued in January 2025 proposed a substantial change: clinical studies of at least 150 participants spanning a range of skin pigmentation, with skin tone assessed using the Monk Skin Tone scale and objective colour measurements rather than the Fitzpatrick scale alone, and labelling that tells users skin pigmentation can affect performance. Whatever its final form, the direction is clear. In the error budget for oximetry, the calibration term is now expected to be characterised across the population, not merely averaged across it. For wrist wearables, which measure oxygen saturation by reflectance rather than by shining light through a finger, the calibration problem compounds the signal problem. The red pulse at the wrist is weak, the path lengths are less predictable, and motion is constant. Most consumer watches that report blood oxygen therefore restrict measurement to moments when the wearer is still, and make no medical claim for the result. Apple's blood oxygen feature, for example, has been marketed as a wellness feature rather than a medical device. Its availability in the United States became entangled in a patent dispute with Masimo, the oximetry company, which led to its removal from newly sold watches in early 2024 and to a redesigned version, introduced in August 2025, in which the calculation is performed on the paired iPhone rather than the watch. The episode is a reminder that in this field, intellectual property can shape system architecture as decisively as physics. Contact, pressure and placement The photon's path depends not only on wavelength and skin but on the mechanics of how the sensor meets the body. Three variables dominate. The first is contact. Any gap between sensor and skin lets ambient light in and lets LED light skip directly to the detector without entering tissue. Both add DC light that carries no pulse. Watch makers shape the sensor window as a dome or raised lens to maintain contact, place optical barriers between emitters and detectors to block direct paths, and ask users to wear the device snugly, particularly during exercise. The second is pressure. Moderate pressure improves coupling and can increase the pulsatile amplitude, because it reduces the steady pressure across the arterial wall and allows it to distend more with each beat. Excessive pressure collapses capillaries and veins and eventually reduces the arterial pulse too. The optimum varies with the person and the site. A strap that tightens when the wrist flexes changes the pressure, and therefore the signal, with every movement. The third is placement. The fingertip is the classic oximetry site because it is richly perfused, thin enough to transilluminate, and has a high density of arteriovenous anastomoses. The wrist is convenient but optically poor: the back of the wrist has relatively sparse superficial vasculature, and beneath it lie tendons that slide with every finger movement. Rings, such as those made by Oura, sit at the base of the finger, where the digital arteries run along the palm side, and in some designs read from that inner surface; they trade the convenience of a watch for a site with stronger pulsation and less tendon motion, at the cost of a smaller battery and greater sensitivity to how the ring rotates. The ear, the forehead and the upper arm each have their own trade-offs and their own devices. Modern wrist sensors respond to these mechanical uncertainties with multiplicity. Instead of a single LED and a single photodiode, they use several emitters and several detectors arranged so that the device can choose, or combine, the light paths that give the best signal at any moment. If one detector sits over a tendon or loses contact, another may not. The cost is more LEDs to drive, more channels to read, and more decisions for the firmware. Temperature and the body's own controls Finally, the body changes its own optical properties. Skin blood flow is regulated by the sympathetic nervous system as part of temperature control. In a cold environment, or during stress, vessels in the skin of the hands and wrists constrict, sometimes dramatically, and the pulsatile signal can shrink to a fraction of its warm-room amplitude. During exercise, skin perfusion rises as the body sheds heat, which helps, but motion rises too, which hurts. Sleep brings stillness and generally good signals, which is one reason overnight measurements such as resting heart rate and heart rate variability tend to be the most reliable data a wrist wearable produces. These physiological swings are not noise in the usual sense. They are real changes in the tissue that the sensor is measuring. But they move the AC amplitude, the DC level and sometimes the shape of the waveform, and an algorithm that assumes a stable signal will misbehave when they occur. The perfusion index is therefore not just a figure of merit for design but a live quality metric: a device that knows its current signal is weak can widen its uncertainty, defer a measurement, or decline to raise an alert. That idea, of a sensor that knows when it is not to be trusted, becomes central once the waveform is turned into numbers. The next chapter follows it from the raw photoplethysmogram to beats, intervals and rhythms. Chapter 3: From Pulse to Rhythm A photoplethysmogram, sampled at a few dozen to a few hundred times a second, is a wavy line. Each wave has a sharp upstroke as the systolic pressure wave arrives, a peak, and a slower decline, often interrupted by a small notch or shoulder where the reflected pressure wave from the lower body returns. To turn that line into anything useful, a wearable must first find the beats, then measure the intervals between them, and then interpret the pattern of intervals. Each step has its own failure modes, and each is where an error budget for heart rate, heart rate variability or arrhythmia detection is won or lost. This chapter follows that sequence. It begins with the problem that dominates real-world performance, motion, then turns to heart rate variability, the subtlest common measurement, and finally to rhythm screening, where wrist optics have made their most significant clinical contribution. Finding the beat when the arm is moving At rest, beat detection is easy. The pulse dominates the signal, and any of several simple methods works: find local maxima above an adaptive threshold, find the steepest point of each upstroke using the first derivative, or match each wave against a template built from recent beats. The upstroke is usually preferred to the peak as the fiducial point, because the peak is rounded and its position is sensitive to noise and to changes in wave shape, whereas the point of maximum slope is sharply defined. Motion changes everything. When the wrist moves, the sensor shifts relative to the skin, the pressure under the strap changes, tendons slide beneath the optical window, and blood is pushed around in the tissue by acceleration. All of these modulate the detected light, often far more strongly than the pulse does. Worse, the modulation is frequently periodic. Running at a cadence of 170 to 180 steps per minute produces arm swing at roughly half that rate, around 85 to 90 cycles per minute, and the step impacts themselves at the full cadence. Both frequencies fall squarely within the range of plausible heart rates. A naive algorithm that picks the strongest peak in the spectrum will often lock onto the runner's stride and report it confidently as heart rate. The standard engineering response uses a second sensor. Nearly every wrist wearable contains a three-axis accelerometer, and the accelerometer measures the motion that is corrupting the optical signal. That reference can be used in several ways. The simplest is spectral subtraction. Compute the frequency spectrum of a few seconds of optical data and of the accelerometer data. Peaks that appear in both are likely to be motion. Suppress them in the optical spectrum, and choose the strongest remaining peak as heart rate. This works well when the motion frequency and heart rate are distinct, and fails when they coincide, which during running they often do. A second approach is adaptive filtering. An adaptive filter continuously adjusts its coefficients to predict the motion component of the optical signal from the accelerometer signal, and subtracts the prediction. Least-mean-squares filters and their normalised variants are cheap enough to run on a small microcontroller. Their weakness is that the relationship between acceleration and optical artefact is not linear or stable; it depends on strap tension, sensor position and the type of movement. A third approach is tracking. Heart rate does not jump arbitrarily from one second to the next. If the algorithm knows the heart rate was 152 beats per minute a moment ago, it can restrict its search to a narrow band around that value, and can use a model of how fast heart rate plausibly changes during exercise to reject a sudden jump to the stride frequency. The danger is that a tracker that loses lock can follow the wrong peak for a long time. These ideas were combined and benchmarked in a well-known academic effort. In 2015 Zhilin Zhang and colleagues published TROIKA, a framework that combined signal decomposition, sparse spectrum reconstruction and spectral peak tracking, and released a dataset of wrist photoplethysmograms with simultaneous accelerometry and electrocardiogram reference recorded during treadmill running. That dataset was used in the IEEE Signal Processing Cup competition the same year and has since become a common benchmark. A long line of later work, increasingly using neural networks trained on large datasets, has pushed errors on such benchmarks down to a few beats per minute. Benchmarks, however, are recorded under particular conditions. Commercial devices must also cope with weightlifting, where grip tension changes wrist anatomy without much rhythmic acceleration; with cycling, where the wrist is still but the road vibrates; and with swimming, where water floods the optical interface. The practical outcome is that well-designed modern wrist sensors are generally accurate for heart rate at rest and during steady rhythmic exercise, and less reliable during irregular or high-intensity activity and during rapid transitions. The study by Bent and colleagues mentioned in the previous chapter found exactly this pattern across devices. For a designer, the most important lesson is not which algorithm to use but that the algorithm must know when it is failing. A quality index, computed from the perfusion index, the agreement between multiple optical channels, the amount of motion and the consistency of the beat shape, lets the device decline to report a number, report it with lower confidence, or hold the previous value. For wellness heart rate, that may be a refinement. For any medical claim, it is essential. Heart rate variability The heart does not beat like a metronome. Even at rest, the interval between successive beats varies by tens of milliseconds, and the pattern of that variation carries information about the autonomic nervous system. The clearest example is respiratory sinus arrhythmia: heart rate rises slightly during inhalation and falls during exhalation, a modulation mediated by the vagus nerve. In healthy, rested people this modulation is pronounced; it diminishes with age, fatigue, illness, stress and many chronic conditions. Low heart rate variability is associated in large epidemiological studies with higher cardiovascular risk, and within an individual, a fall in variability from their own baseline can indicate accumulated strain, poor recovery or the onset of illness. The measurement conventions were standardised in 1996 by a task force of the European Society of Cardiology and the North American Society of Pacing and Electrophysiology, whose report in Circulation remains the reference. Heart rate variability can be described in the time domain, by statistics of the intervals themselves, or in the frequency domain, by how the variation is distributed across slow and fast oscillations. Table 3 summarises the measures that wearable users most often encounter. Table 3. Common heart rate variability measures (definitions follow the 1996 ESC/NASPE Task Force report). Measure Definition What it mainly reflects Typical wearable use SDNN Standard deviation of normal beat-to-beat intervals Overall variability, all sources Apple Health reports HRV as SDNN RMSSD Root mean square of successive interval differences Short-term, largely vagal (parasympathetic) modulation Overnight HRV in many rings and bands pNN50 Share of successive intervals differing by over 50 ms Short-term vagal modulation Less common in consumer devices HF power Variance in the 0.15 to 0.4 Hz band Respiratory, vagally mediated variation Research and clinical use LF/HF ratio Low-frequency over high-frequency power Once read as sympathovagal balance; now contested Some apps; interpretation disputed RMSSD has become the dominant measure in consumer wearables for good engineering reasons. It depends only on differences between adjacent intervals, so it is relatively insensitive to slow trends in heart rate, and it is stable over short recordings of a few minutes. SDNN, by contrast, depends strongly on recording length and on everything that changes heart rate during that period, so an SDNN computed over one minute and one computed over twenty-four hours are not comparable. Frequency-domain measures require evenly sampled data, careful handling of missing beats and longer stationary recordings. The LF/HF ratio, once widely interpreted as an index of the balance between sympathetic and parasympathetic activity, is now regarded by many physiologists as an oversimplification, because low-frequency power has substantial parasympathetic and baroreflex contributions. Pulse rate variability is not heart rate variability Measured from a photoplethysmogram, heart rate variability is strictly pulse rate variability. The electrocardiogram measures the electrical depolarisation of the heart, and the R wave is a sharp, unambiguous marker of each beat. The photoplethysmogram measures the arrival of a pressure wave at the periphery, some 150 to 300 milliseconds later. If that delay, the pulse arrival time, were constant, the intervals between optical beats would equal the intervals between electrical beats. It is not constant. It changes with blood pressure, with arterial stiffness, with posture and, importantly, with breathing, which modulates intrathoracic pressure and stroke volume. The consequences are predictable from the error budget. Pulse rate variability agrees closely with true heart rate variability in healthy people lying still, especially for slower, larger-scale measures. Agreement worsens for RMSSD and high-frequency measures, which are sensitive to small timing errors; it worsens during standing, exercise and mental stress; and it worsens with low sampling rates, because the timing resolution of each beat cannot be better than the sampling interval allows. A device sampling at 25 times per second has a raw resolution of 40 milliseconds, which is comparable to the very differences RMSSD is trying to measure. Interpolation of the waveform between samples can recover much of the lost resolution, but only if the waveform is clean. This is why the most credible wearable heart rate variability measurements are taken during sleep. The wearer is still, posture is stable, the perfusion is usually good, and the device can afford to sample at a high rate for a few minutes at a time. Most rings and bands that report a daily variability figure compute it from overnight data, sometimes restricted to particular sleep stages. Those figures are best understood as an individual's trend line rather than as clinical values to be compared against population norms. A ring's RMSSD and an ECG-derived RMSSD in the same person on the same night will typically be close, and the ring's day-to-day changes will usually track real physiological changes. But a single value, compared to someone else's or to a published reference range, says little. A further subtlety is ectopy. Occasional premature beats, which are common and usually benign, produce a short interval followed by a long one. A single ectopic beat can inflate RMSSD substantially. Electrocardiogram-based software identifies and removes such beats by their electrical shape; a photoplethysmogram-based algorithm can only infer them from timing and amplitude, because a premature beat often produces a weak pulse that may be missed altogether. Careful algorithms reject intervals that deviate too far from their neighbours, but each rejection is a judgement, and different devices make different ones. Screening for atrial fibrillation Atrial fibrillation is the most common sustained arrhythmia. In it, the upper chambers of the heart quiver chaotically instead of contracting in a coordinated way, and the lower chambers are driven irregularly. It raises the risk of stroke substantially, it is frequently asymptomatic, and it is often intermittent, so it can go undetected for years. A device worn continuously that could notice it would have obvious value. Atrial fibrillation also has a distinctive signature at the wrist: the intervals between beats become irregularly irregular, without the repeating patterns of most benign arrhythmias. Unlike heart rate variability, which requires millisecond precision, irregularity at this scale is detectable even in a modest optical signal. The design of a screening feature is shaped almost entirely by the error budget for false alarms. Atrial fibrillation is rare in young people. If a feature is run continuously on tens of millions of watches, even a very low false positive rate per measurement will generate enormous numbers of false notifications, each of which costs the user anxiety and the health system a consultation. The engineering answer is to sample opportunistically and to require persistence. Apple's irregular rhythm notification, the subject of the Apple Heart Study, illustrates the approach. The watch collects short tachograms, sequences of beat-to-beat intervals, opportunistically when the wearer is still, and classifies each as regular or irregular. A single irregular tachogram does not produce an alert; it triggers more frequent sampling, and a notification follows only if irregularity is confirmed repeatedly over a period of time. In the study's 419,297 participants, that design produced notifications in just 0.52 percent. When notified participants then wore an electrocardiogram patch, atrial fibrillation was found in 34 percent, a figure reduced in part by the intermittent nature of the arrhythmia; but when the watch fired during patch wear, atrial fibrillation was present on the patch at that time in 84 percent of cases. The Fitbit Heart Study, published in Circulation in 2022, enrolled 455,699 participants and tested a similar persistence-based algorithm. About one percent of participants received an irregular heart rhythm detection. Among those with analysable patch data, 32.2 percent had atrial fibrillation on the patch. When a detection occurred during patch monitoring, the positive predictive value for concurrent atrial fibrillation was 98.2 percent. The authors noted that sensitivity, the share of atrial fibrillation episodes that the algorithm caught, was lower, at roughly two thirds. That is the deliberate cost of insisting on persistence before alerting. The algorithm is built to be right when it speaks, not to speak whenever something might be wrong. These features have since been extended in ways that reveal how a screening signal can become a measuring instrument. Apple's AFib History feature, available to people already diagnosed with atrial fibrillation, estimates the share of time spent in the arrhythmia. In May 2024 the FDA qualified it as the first digital health technology in its Medical Device Development Tools programme, for use as a biomarker of atrial fibrillation burden in clinical trials of cardiac ablation devices. That decision is worth pausing on. It means the regulator accepted that a wrist optical sensor, within a defined context, could provide trial data on the frequency of an arrhythmia, a role that previously required implanted or adhesive electrocardiographic monitors. Two limits deserve emphasis. First, these algorithms detect irregularity, not atrial fibrillation as such. Frequent ectopic beats, atrial flutter with variable conduction, and other arrhythmias can look similar, and some forms of atrial fibrillation with a fairly regular ventricular response can be missed. Diagnosis still requires an electrocardiogram, which is why watches that offer rhythm notifications usually also offer a single-lead electrocardiogram recorded by touching the crown or bezel. Second, the validation populations matter. The Fitbit study was 71 percent female and 73 percent White, with a median age of 47; the Apple study also skewed younger than the population in which atrial fibrillation is common. Performance in older people, in whom both the prevalence of the condition and the prevalence of confounding arrhythmias are higher, is not simply the average reported in a study of younger ones. What the waveform still holds Beat timing is not the only information in the photoplethysmogram. The shape of each wave, including the timing and height of the reflected wave and the steepness of the upstroke, carries information about arterial stiffness and vascular tone. The slow modulation of amplitude and baseline carries information about breathing, which is how many wearables estimate respiratory rate during sleep. Repeated falls in amplitude and saturation overnight can indicate sleep apnoea, and several wearables have sought or received clearance for apnoea-related notifications. Apple's hypertension feature, discussed in Chapter 1, is an example of extracting a clinically useful pattern from these subtler features over many weeks rather than from any single measurement. Each such extension faces the same discipline. The features are small, they are distorted by motion, temperature and contact, and their relationship to the physiological quantity of interest is indirect and person-specific. The successful products make narrow claims, require persistence and quality before acting, and validate in populations that resemble their users. The failures, of which the noninvasive glucose claims discussed in Chapter 5 are the starkest example, make broad claims from features that cannot support them. Optical sensing has an advantage that the next subject lacks: it is noninvasive, and nothing inside the body reacts to it. Continuous glucose monitoring must put a sensor beneath the skin, where the body notices and responds. Hashtags: #WearableHealthTech #Photoplethysmography #ContinuousGlucoseMonitoring #WearableTechnology #HealthTechnology #DigitalHealth #MedicalWearables #Biosensors #PPG #CGM #Smartwatches #HealthMonitoring #RemotePatientMonitoring #BiomedicalEngineering #MedicalDeviceTechnology #OpticalSensing #ElectrochemicalSensors #GlucoseMonitoring #HeartRateMonitoring #HeartRateVariability #PulseOximetry #CardiacMonitoring #AtrialFibrillationDetection #PhysiologicalMonitoring #SensorAccuracy #MedicalDeviceInnovation #LowPowerElectronics #BluetoothLowEnergy #HealthcareInnovation #FutureOfHealthcare

Download the Book (PDF): Introduction Ask a modern language model to multiply two six-digit numbers and it will often produce an answer that looks right, has the right number of digits, begins with the right leading figures, and is wrong somewhere in the middle. Hand the same model a calculator and the problem disappears. The model knows, in some sense, what multiplication is. It can explain the algorithm, write code that performs it, and check a worked example step by step. What it cannot reliably do is carry out the procedure inside its own forward pass with the exactness the procedure demands. The calculator, a device with no understanding of anything, never makes this mistake. That small, almost comic failure contains the whole subject of this book. Two traditions in artificial intelligence have spent seventy years building machines that are good at opposite things. One tradition writes knowledge down: as rules, logical formulas, databases of facts, search procedures and programs. Its systems are exact, inspectable and capable of chaining a hundred steps of inference without drift, but they cannot see, cannot read messy text, and break the moment the world presents something their authors did not anticipate. The other tradition learns knowledge from examples: as millions or billions of numerical weights in a network tuned by gradient descent. Its systems recognise faces, transcribe speech, translate languages and write fluent prose, but their reasoning is approximate, their errors are hard to predict, and their internal workings resist explanation. Neuro-symbolic artificial intelligence is the attempt to build systems that have both sets of strengths at once. The phrase covers a wide range of work: networks trained to respect logical constraints, logic programs whose basic facts are supplied by neural perception, language models that write code and hand it to an interpreter, theorem provers guided by learned intuition, knowledge graphs consulted by chatbots, and formal verifiers that check what a generative model has said before it reaches a customer. Some of this work is decades old. Much of it has become urgent in the last few years, as large language models made neural systems far more capable and, at the same time, made their characteristic failures far more consequential. The argument of this book The usual way of describing neuro-symbolic AI is as a marriage: take the pattern recognition of deep learning, take the logic of classical expert systems, combine them, and obtain a system that is both perceptive and rigorous. The description is not wrong, but it hides the part that matters. Combining two kinds of machinery is easy to say and hard to do, because they represent the world in incompatible ways. A network represents a cat as a region of a high-dimensional space with soft edges. A logic program represents a cat as a symbol, cat, that either applies to an object or does not. Every hybrid system must somewhere convert one form into the other, and that conversion is where the hard problems live: where errors enter, where gradients stop flowing, where explanations become unfaithful, and where the guarantees one side promised quietly lapse. The argument of this book is that neuro-symbolic AI is best understood as a discipline of interfaces. The central design decision in any hybrid system is not whether to use learning or logic, since serious systems will use both, but which parts of a problem must be stated explicitly as rules that can be read and checked, which parts must be learned from data because no one can write them down, and how the boundary between the two is drawn and policed. Systems that succeed draw that boundary deliberately. They put symbolic machinery where exactness, accountability or compositional reuse is required, let learned components handle perception and judgement where rules cannot reach, and engineer the translation between them with the same care given to either side. Systems that fail usually got the boundary wrong: they asked a network to be exact, asked a rule base to be perceptive, or assumed the translation between them would take care of itself. Seen this way, a good deal of confusion about the field clears up. The long argument between champions of deep learning and champions of symbolic reasoning becomes less interesting, because both sides turn out to be describing components rather than complete systems. The recent success of language models at reasoning tasks becomes a data point about where the boundary can now sit, not a refutation of the need for one. And the practical question that matters to anyone building or buying such a system becomes clear: for this task, what must be guaranteed, what can be approximate, and who checks the joint? What the book covers The first chapter defines the reasoning gap carefully. It is easy to point at a chatbot's arithmetic mistake and declare that neural networks cannot reason; it is harder, and more useful, to say exactly which kinds of reasoning they find difficult and why. The chapter concentrates on systematic generalisation, exactness over long chains of inference, and the separation of knowledge from its use, and it takes seriously the evidence that scale and new training methods have narrowed some of these gaps. The second chapter returns to the symbolic tradition, and in particular to the expert systems of the 1970s and 1980s. These systems are usually remembered as a failure. They were in fact a qualified success whose limits were instructive, and the specific reasons they stalled, chiefly the cost of acquiring knowledge and the brittleness of hand-written rules at their edges, are exactly the problems that learned components are now asked to solve. The third chapter offers a map. Hybrid systems vary enormously, and a widely used taxonomy proposed by the computer scientist Henry Kautz sorts them by how the two kinds of component are arranged. The map matters because different arrangements put the interface in different places, and so fail in different ways. Chapters four and five examine the two most developed families of technique. The first puts logic inside the learning process, turning rules into differentiable constraints that shape what a network learns. The second keeps them apart, using networks to perceive and propose and symbolic engines to reason and verify. Systems from DeepMind that reached medal-level performance at the International Mathematical Olympiad belong to the second family, and they show both how powerful the arrangement can be and how much engineering the interface demands. Chapter six turns to large language models, which have changed the field more than any development since its founding. A language model that can write programs, call tools and translate natural language into formal specifications is a new kind of neural component, and it reopens old questions about where symbolic structure should live. The chapter also faces the strongest objection to this book's argument: that reasoning models trained with reinforcement learning may simply absorb the symbolic layer into the network. Chapter seven addresses explanation and trust, which are often given as the main reason to want symbolic components at all. The chapter distinguishes between explanations that describe what a system actually did and explanations that merely sound plausible, and between soft assurances and hard guarantees, and it considers what regulators and practitioners in medicine and finance actually require. Chapter eight is practical. It sets out how to decide where the boundary should sit in a particular system, what it costs to maintain the symbolic side, how to evaluate a hybrid fairly, and how such systems typically fail. The conclusion draws out what follows from the whole argument for the next phase of the field. What the book leaves out A short book on a large subject has to decline a great deal. This one does not survey every neuro-symbolic architecture published in the last decade; there are hundreds, and most will not matter in five years. It does not teach the mathematics of logic or of deep learning beyond what is needed to follow the argument, and it explains technical ideas in prose rather than equations. It does not attempt to settle philosophical questions about whether machines can truly reason or understand, though it touches them where they bear on engineering. And it treats cognitive science, which has its own long debate about symbols and networks in the human mind, only as background. What it tries to give instead is a way of thinking about hybrid systems that will remain useful as particular techniques come and go: an eye for where the interface sits, what crosses it, and what can go wrong there. A reader who finishes it should be able to look at any system that claims to combine learning and logic and ask the questions that reveal whether the combination is real. Chapter 1: The Reasoning Gap The claim that neural networks cannot reason is both widely repeated and frequently embarrassed. Each time a critic names a task that networks fail at, a larger network or a cleverer training method tends to succeed at it within a year or two. Language models that once stumbled over grade-school word problems now solve competition mathematics. Systems that could not count objects in an image now describe scenes in detail. Anyone who wants to argue that deep learning has a reasoning gap needs to be precise about what the gap is, or the argument will be overtaken by the next benchmark result. Precision is possible. The difficulty neural networks have with reasoning is not that they cannot produce correct answers to reasoning problems. They often can. It is that the way they produce those answers lacks three properties that explicit reasoning procedures have by construction: systematic generalisation, exactness over long chains, and a clean separation between what is known and how it is used. Each of these can be partly recovered by scale and training, and each has been. None of them is guaranteed, and the difference between "usually" and "guaranteed" turns out to matter a great deal in practice. Systematic generalisation In 1988 the philosophers Jerry Fodor and Zenon Pylyshyn published a critique of connectionism, the then-fashionable view that the mind is a network of simple units rather than a manipulator of symbols. Their central point concerned what they called systematicity. A person who understands the sentence "John loves Mary" also understands "Mary loves John". This is not a coincidence of experience: understanding one sentence involves grasping its parts and the rule that combines them, and once the parts and rule are grasped, every recombination comes free. Fodor and Pylyshyn argued that networks, which learn associations between whole patterns rather than rules over parts, would have no principled reason to exhibit this property. They might happen to generalise to new combinations, but nothing in their architecture would make them do so. For thirty years this was a debate conducted mostly in philosophy journals. It became empirical in 2018, when Brenden Lake and Marco Baroni introduced a benchmark called SCAN. The task was to translate simple commands such as "jump twice" or "walk left and run" into sequences of actions. The vocabulary was tiny and the grammar trivial. Lake and Baroni trained standard sequence-to-sequence networks on most of the possible commands and tested them on the rest. When the test commands were random held-out examples, the networks did nearly perfectly. When the split was systematic, for instance when the network had seen "jump" only on its own and was then asked to interpret "jump twice" or "jump around left", accuracy collapsed, in some conditions to near zero. A child who learns a new verb immediately knows what it means to do that thing twice. The networks did not. The finding has been refined rather than overturned. In 2023 Lake and Baroni themselves showed, in a paper in Nature, that a standard transformer trained by a method they called meta-learning for compositionality could match human performance on tasks of this kind. The network was trained not on one fixed language but on a stream of many small invented languages, so that what it learned was the skill of picking up new compositional rules quickly. This is an important result, and it cuts against any claim that networks are incapable of systematicity in principle. But notice what it took. Systematic behaviour had to be explicitly trained for, with a curriculum designed by people who already knew what systematic behaviour looked like. The architecture did not supply it; the training regime did, and only for the kind of composition the regime covered. Large language models show the same pattern on a bigger stage. They generalise remarkably across the vast range of combinations represented in their training data, and less reliably outside it. A widely discussed 2023 paper by Lukas Berglund and colleagues described what they called the reversal curse: a model trained on statements of the form "A is B" did not reliably learn that "B is A". A model that had learned that a particular person was the composer of a particular piece could fail to name the composer when given the piece. For a system that represented the fact as a relation between two symbols, reversal would be automatic. For a system that stored it as a direction of association, it was not. Exactness over long chains The second property is exactness. A logical inference engine that applies a rule correctly once applies it correctly a million times. Errors, when they occur, come from wrong rules or wrong facts, not from the act of inference itself. A neural network, by contrast, computes every output as a weighted blend of learned features. Each step is approximately right, and approximately right compounds badly. If a system performs each step of a twenty-step derivation with ninety-nine per cent reliability, its chance of completing all twenty correctly is a little over eighty per cent. At a hundred steps it falls to about a third. This is the arithmetic behind the multiplication failure described in the introduction, and it shows up wherever reasoning has to be carried out rather than recalled. A 2024 study by researchers at Apple, led by Iman Mirzadeh, took a well-known benchmark of grade-school mathematics problems and generated variants by changing names and numbers while keeping the underlying problems the same. Many models that scored highly on the original benchmark lost accuracy on the variants, and they lost considerably more when an irrelevant clause was added to a problem, such as a remark that some of the fruit picked was smaller than average. A system that was executing a procedure would ignore the irrelevant clause. Systems that were matching the problem against patterns they had seen tended to incorporate it. The most capable models of 2025 and 2026, trained with reinforcement learning to produce long chains of intermediate reasoning before answering, are much better at this. They check their own work, backtrack, and try alternative approaches, and on many mathematical benchmarks they now perform at or above the level of strong human students. In July 2025 both Google DeepMind and OpenAI announced that experimental models had achieved gold-medal standard on problems from that year's International Mathematical Olympiad, working in natural language. These are genuine advances. But the mechanism by which they were achieved is instructive: the models were trained to externalise their reasoning as text, to spend more computation on harder problems, and to verify intermediate steps. In other words, they were trained to behave more like explicit reasoning procedures. The gap narrowed because the network learned to imitate the properties of symbolic computation, not because those properties stopped mattering. What has not changed is the absence of a guarantee. A reasoning model that is right ninety-five times in a hundred on a class of problems gives no indication, on the hundred-and-first, of whether this is one of the five. For a competition score this is irrelevant. For a tax calculation, a drug interaction check or a safety interlock it is the whole question. Knowledge separated from its use The third property is less often discussed but matters most for building real systems. In a symbolic system, knowledge and inference are separate. The facts and rules sit in a knowledge base; the inference engine is a general procedure that operates on whatever is in the knowledge base. This separation has three practical consequences. First, knowledge can be updated directly. If a regulation changes, someone edits the rule that encodes it, and every subsequent inference reflects the change. In a neural network, knowledge is distributed across weights that also encode everything else the network knows. Changing one fact requires retraining or fine-tuning, which may disturb other facts in ways that are hard to predict. A substantial research literature on model editing exists precisely because this is difficult, and its results so far show that edits often fail to propagate to related facts or produce side effects elsewhere. Second, knowledge can be inspected. A rule can be read, and a person can decide whether it is correct. A network's weights cannot be read in this way. Interpretability research has made real progress in identifying features and circuits inside large models, but it remains far from the point where an auditor could list everything a model believes about, say, eligibility for a mortgage. Third, knowledge can be reused across tasks without relearning. A rule about family relationships, once stated, supports answering questions about grandparents, cousins and in-laws without any further training. Networks transfer knowledge across tasks too, often impressively, but the transfer is an empirical property to be measured rather than a structural one to be relied upon. How to measure the gap honestly Benchmarks for reasoning have a short shelf life. Once a benchmark is public, its problems and solutions find their way into training data, and models improve on it for reasons unrelated to reasoning ability. This makes it hard to tell, from leaderboard scores alone, whether the gap is closing. The most careful attempt to measure reasoning while resisting this problem is the Abstraction and Reasoning Corpus, introduced by François Chollet in 2019 alongside an essay called "On the Measure of Intelligence". Each task presents a few pairs of small coloured grids, an input and an output, and asks the solver to infer the transformation and apply it to a new input. The transformations involve ideas such as symmetry, counting, gravity and containment that a person grasps from two or three examples. The test tasks are kept private. For several years the best AI systems scored far below untrained humans. Scores rose sharply from late 2024 as reasoning models and systems that searched over candidate programs were applied to it, and a harder successor, ARC-AGI-2, was released in 2025 precisely because the original had begun to yield. The successor again opened a wide gap between people and machines, though that gap too has been narrowing. The lesson of the ARC series is not that machines cannot reason; it is that how a score is obtained matters as much as the score. Many of the strongest entries were themselves hybrids: they used a language model to propose candidate programs in a small domain-specific language, executed the programs exactly against the examples, and kept those that reproduced the outputs. The neural component supplied guesses and the symbolic component supplied verification. This division of labour recurs throughout the rest of this book. A fair statement of the reasoning gap in 2026 therefore runs as follows. Neural networks, especially large language models trained to reason step by step, can now solve many problems that require reasoning. They do so without structural guarantees of systematic generalisation, exactness or separable knowledge. Those properties can be approximated by training, often very well, but approximation leaves a residue of unpredictable failure that cannot be eliminated by more of the same, because it is a consequence of how the network represents what it knows. Symbolic methods provide the properties by construction but cannot by themselves perceive the world or cope with the open-endedness of natural language. Why the gap matters now If the residue of unpredictable failure were small and harmless, none of this would matter much. It matters because neural systems are now being placed in roles where failures carry real cost. Language models draft legal documents, answer customers' questions about insurance policies, summarise medical records, generate code that runs in production, and increasingly act as agents that take actions in software environments. In each case there is a part of the task that requires judgement over messy input, which networks do well, and a part that requires conformity to rules that someone has stated, such as a policy's terms, a programming language's semantics or a clinical guideline, which networks do approximately. The well-publicised failures of such systems usually occur at exactly this seam. Two cases have become standard illustrations. In 2023, in the case of Mata v. Avianca in the federal court for the Southern District of New York, lawyers submitted a brief containing citations to judicial decisions that did not exist; they had been produced by a chatbot the lawyers had used for research, and the court sanctioned them. In early 2024 a tribunal in British Columbia, in Moffatt v. Air Canada, held the airline responsible for a bereavement-fare policy that its website chatbot had described to a grieving customer and that the airline did not in fact offer. The airline's argument that the chatbot was responsible for its own statements did not succeed. In both cases the model did what language models do well: it produced fluent, contextually appropriate text in the right register. What it did not do was respect a body of explicit knowledge that existed and was authoritative, a database of reported cases in one instance and the airline's actual fare rules in the other. The system had no reliable way to consult that knowledge, and nothing checked its output against it. Coding assistants that call library functions which do not exist, and summarisation tools that attribute statements to the wrong source, fail in the same way. These are not failures of fluency or perception. They are failures at the point where a learned system meets a body of fact or rule that it was expected to honour. What the network does instead It helps to be clear about what a network is doing when it appears to reason, because the mechanism explains the shape of its failures. A trained network is a function that maps inputs to outputs, shaped by exposure to an enormous number of examples so that inputs resembling those examples produce outputs resembling theirs. Within the region of input space the examples cover densely, this function can be extraordinarily good. Outside that region, its behaviour is governed by whatever regularities happened to be easiest to learn, which may or may not be the ones the designer intended. Robert Geirhos and colleagues gave this phenomenon a name in a 2020 review in Nature Machine Intelligence: shortcut learning. Networks trained to recognise objects in photographs were found to rely heavily on texture rather than shape, so that an image of a cat with the texture of elephant skin would be classified as an elephant. Medical imaging models were found to exploit markers specific to the hospital where a scan was taken, which correlated with disease prevalence in the training data. In each case the network found a rule that worked on the training distribution and was not the rule a person would use. Because the network's rules are implicit, nobody could read them off and notice the problem; it surfaced only when the distribution shifted. Shortcut learning is the perceptual cousin of the reasoning failures described above. A language model that is distracted by an irrelevant clause in a mathematics problem is using a shortcut: problems with numbers in them have, in its experience, usually required doing something with all the numbers. A model that cannot reverse a fact it has learned is using a shortcut: the fact appeared in one direction in its training text, and the direction was learned along with the content. The point is not that networks are stupid. It is that their competence is a statistical property of their relation to their training data, and statistical competence has edges that cannot be located in advance by inspection. The neuro-symbolic programme is an answer to this situation. It does not say that networks should be replaced by rules, which would throw away everything the last fifteen years achieved. It says that where a task has a part that must be exact, inspectable or reliably compositional, that part should be handled by machinery that has those properties by construction, and the network should be connected to it through an interface designed for the purpose. Before looking at how such interfaces are built, it is worth looking closely at the machinery on the other side, and at why it was set aside in the first place. Chapter 2: What the Symbolic Tradition Got Right The standard history of artificial intelligence has a simple plot. Early researchers tried to build intelligence by writing down rules. The rules never captured enough of the world, the funding dried up in a series of "AI winters", and the field was rescued by machine learning, which let computers acquire knowledge from data instead. In this story the expert systems of the 1970s and 1980s are a cautionary tale: an overhyped technology that promised to bottle human expertise and delivered brittle programs nobody wanted. The story is not false, but it is badly incomplete, and the parts it leaves out are the parts a neuro-symbolic engineer most needs to know. Symbolic AI did not disappear. Much of it became so ordinary that it stopped being called AI. And the specific reasons the expert-system boom collapsed are a precise list of the problems that learned components are good at solving, which is why the combination is worth attempting at all. The expert-system idea The intellectual foundations were laid in the 1950s and 1960s. Allen Newell and Herbert Simon's work on the Logic Theorist and the General Problem Solver treated thinking as search through a space of symbolic states, guided by heuristics. John McCarthy proposed representing common-sense knowledge in formal logic so that a program could draw conclusions from it. These were ambitious projects aimed at general intelligence, and they ran into the problem that general knowledge turns out to be enormous and slippery. The expert-system idea was a strategic retreat to narrower ground. Edward Feigenbaum and his colleagues at Stanford argued that the power of an intelligent system lies less in its reasoning method than in the specific knowledge it possesses. A general inference procedure armed with a few hundred well-chosen rules about a narrow domain could, they proposed, perform at the level of a human specialist within that domain. The first demonstrations were in chemistry, with the DENDRAL program inferring molecular structures from mass spectrometry data, and then in medicine. MYCIN, developed at Stanford in the 1970s by Edward Shortliffe and others, is the best-known example. It advised on the selection of antibiotics for patients with serious bacterial infections. Its knowledge base consisted of several hundred rules of the form "if the organism is gram-negative, and its morphology is rod, and the patient is a compromised host, then there is suggestive evidence that the organism is pseudomonas", each annotated with a number called a certainty factor expressing how strongly the conclusion followed. MYCIN worked backwards from the question of which organisms might be present, asking the physician for the information it needed, and combined the certainty factors of the rules that fired to rank its conclusions. Two things about MYCIN deserve emphasis. The first is that it performed well. In a blinded evaluation published in 1979, its recommendations for cases of meningitis were judged acceptable by outside experts at a rate comparable to, and in that study slightly better than, those of the Stanford infectious-disease faculty. The second is that it could explain itself. A physician could ask why MYCIN wanted a piece of information, and it would display the rule it was trying to apply. A physician could ask how it had reached a conclusion, and it would trace the chain of rules that had led there. These explanations were not reconstructions after the fact; they were the actual computation, rendered in readable form. The explanation facility turned out to have a second use, which is less often remembered and more relevant to hybrid design. Randall Davis, working on the MYCIN project in the late 1970s, built a program called TEIRESIAS that used explanations to help experts maintain the knowledge base. When MYCIN reached a conclusion an expert disagreed with, TEIRESIAS let the expert walk back through the chain of rules to find the one that was wrong or missing, then helped the expert write a new rule, checking it against the patterns of existing rules to see whether it resembled them in form. If most rules concluding something about an organism's identity mentioned the site of the culture and the new rule did not, TEIRESIAS would ask whether that was an oversight. The explanation was not only a service to the user; it was the main tool for debugging the system's knowledge. A network offers nothing comparable. When it makes a mistake, there is no rule to find and fix, only a training set to adjust and a model to retrain. MYCIN's success also depended on a choice of domain that later projects did not always share. Antibiotic selection for bacterial infections was narrow, well documented in the medical literature, and structured around a small number of decisions with clear criteria. The relevant evidence, such as laboratory results, the site of infection and the patient's allergies, could be entered by a physician as discrete facts. In modern terms, MYCIN's perceptual front end was a human being, who read the charts and lab reports and typed the results into the program in the form its rules expected. The system never had to interpret an X-ray or a doctor's handwriting. Much of what later made expert systems brittle was the absence of such a front end in domains where the inputs were messier. MYCIN was never used in routine clinical care. The reasons were partly practical, since the program ran on a time-shared mainframe and consultation required lengthy typed dialogue, and partly legal and institutional. But its architecture was copied widely, and by the early 1980s expert systems were being built commercially. The most cited commercial success was R1, later called XCON, developed by John McDermott at Carnegie Mellon for Digital Equipment Corporation to configure orders for VAX computer systems. Configuring such a system meant choosing and arranging many components that had to fit together, a task that had required skilled technical staff and still produced frequent errors. XCON did it with a large and growing set of production rules, and it remained in use at Digital for years. A parallel strand of the symbolic tradition took a different route to the same goal. Logic programming, which originated with Alain Colmerauer's development of Prolog in Marseille in the early 1970s and Robert Kowalski's theoretical work in Edinburgh, proposed that a program could simply be a set of logical statements, with computation carried out by a general proof procedure. A Prolog program defining family relationships consists of facts, such as that Ann is the parent of Bob, and rules, such as that X is a grandparent of Z if X is a parent of some Y who is a parent of Z. Asking "who are Ann's grandchildren?" causes the system to search for proofs. The appeal was declarative: the programmer stated what was true and left the system to work out how to use it. That idea, knowledge stated once and reused for any question it bears on, is the property chapter one called separating knowledge from its use, and it is the reason logic programming reappears, in probabilistic and differentiable forms, in several of the hybrid systems described later in this book. Why the boom ended By the mid-1980s expert systems had attracted large investments, specialised hardware called Lisp machines, and national programmes including Japan's Fifth Generation Computer Systems project, which aimed to build massively parallel machines for logic programming. Within a few years the market for Lisp machines had collapsed, many expert-system companies had failed, and the Fifth Generation project ended in 1992 without achieving its larger goals. Four problems account for most of the disappointment, and each is worth stating precisely. The first was the knowledge acquisition bottleneck, a phrase Feigenbaum himself used. The rules in an expert system had to be extracted from human experts by knowledge engineers in long interviews. Experts are often unable to articulate what they know; much of their skill is tacit, a matter of recognising situations rather than applying stated principles. The process was slow, expensive and error-prone, and it had to be repeated for every new domain. The second was brittleness at the edges. Within the cases its authors anticipated, an expert system could perform superbly. Just outside them it could fail absurdly, because it had no knowledge beyond its rules and no way of noticing that a case was unusual. MYCIN knew nothing about anatomy beyond what its rules mentioned, so it could not recognise that a question made no sense for a particular patient. A human novice who knows far less medicine than MYCIN would at least have known that. The third was maintenance. Rule bases grew, and as they grew, rules interacted in ways their authors had not foreseen. XCON's rule base expanded substantially over its life, and keeping it consistent as Digital's product line changed became a significant engineering burden in its own right. Adding a rule to fix one case could break others, and there were few tools for detecting this. The fourth was the treatment of uncertainty. MYCIN's certainty factors were an ingenious engineering device, but they lacked a sound probabilistic foundation, and later analysis showed they could behave inconsistently when evidence was combined. The development of Bayesian networks, set out by Judea Pearl in his 1988 book on probabilistic reasoning, offered a principled alternative, but it arrived as the expert-system market was already contracting. Notice what these four problems have in common. None of them concerns the reasoning itself. Inference engines were correct, fast enough, and able to explain their conclusions. Every problem lay at the boundary between the system and the world: getting knowledge in, coping with inputs the knowledge did not cover, keeping the knowledge current, and handling the inherent noisiness of evidence. Those are exactly the tasks that statistical learning would later prove good at. The parts that never left While the expert-system industry contracted, other branches of symbolic AI went on to become indispensable infrastructure, so thoroughly that they are rarely thought of as AI at all. Automated reasoning is the clearest case. Programs called SAT solvers decide whether a formula in propositional logic can be made true, and their relatives, SMT solvers, extend this to arithmetic, arrays and other theories. Their performance improved by many orders of magnitude from the 1990s onward, through better algorithms rather than faster hardware, and they are now used routinely to verify hardware designs, check software for bugs, and solve scheduling and configuration problems. Model checkers verify that concurrent systems cannot reach unsafe states. Proof assistants such as Coq, Isabelle and Lean allow mathematicians and engineers to write proofs that a small, trusted program checks line by line; the CompCert compiler and the seL4 operating system kernel were verified this way. Cloud providers use automated reasoning to check that access-control policies mean what their customers think they mean. Knowledge representation also survived. Description logics, a family of formal languages for defining concepts and their relationships, underpin the Web Ontology Language and large biomedical ontologies such as SNOMED CT, which encodes clinical terminology used in electronic health records in many countries. Knowledge graphs, networks of entities and typed relations, became central to web search after Google introduced its Knowledge Graph in 2012 with the slogan "things, not strings". Wikidata, a collaboratively edited knowledge graph, holds structured facts about tens of millions of entities and supplies data to Wikipedia and many other services. Douglas Lenat's Cyc project, begun in 1984 with the aim of encoding common-sense knowledge by hand, continued for nearly four decades; it is often treated as a monument to the knowledge-acquisition bottleneck, but it also showed how far careful manual encoding could go. Rules engines persist throughout commercial software. Insurance underwriting, tax preparation, eligibility determination for public benefits and loan approval are all governed by rules that someone has written down, and the software that applies them is, in architecture, a descendant of the expert system. Nobody calls it AI, because it does not learn and it is not surprising. That is precisely its value: when a regulator asks why an application was denied, the answer is a rule that can be read. What each tradition does well It is now possible to set the two traditions side by side. The comparison is not between a successful approach and a failed one, but between two sets of capabilities that are close to mirror images of each other. Table 1 summarises the contrast along the dimensions that matter most for hybrid design. Table 1. Characteristic strengths of learned and symbolic components. Property Neural (learned) components Symbolic (explicit) components Source of knowledge Statistical regularities in data Rules and facts written by people Raw perceptual input Strong: images, audio, free text Weak: needs structured input Exactness of inference Approximate; errors compound Exact given correct rules Generalisation Smooth within data; uncertain beyond Systematic within the rules; none beyond Updating one fact Retraining, with side effects Edit the rule base directly Explanation Post hoc, often unfaithful The derivation itself Noise and ambiguity Tolerant by design Brittle unless explicitly modelled Main cost Data and computation Expert time and maintenance The table makes an obvious point that is nonetheless easy to lose sight of: almost every weakness on one side is a strength on the other. Networks cope with raw perception and noise, which rule systems cannot; rule systems offer exactness, direct editing and faithful explanation, which networks cannot. This complementarity is the whole case for neuro-symbolic AI. It is also why the combination is hard. A component that represents knowledge as soft statistical regularities and a component that represents it as hard discrete rules do not naturally speak to each other, and the translation between them must be built. Lessons for hybrid design Three lessons from the symbolic tradition carry directly into the design of hybrid systems. The first is that the expert-system failures were interface failures. The inference engine was rarely the problem; the trouble was getting the world into the system's representation and keeping that representation true. A hybrid that uses neural perception to populate a symbolic model is attacking the knowledge acquisition bottleneck and the brittleness problem at their source. But it is also inheriting them in a new form, because the neural perception can be wrong, and the symbolic reasoner, which assumes its inputs are true, will reason confidently from a false premise. The second is that explicit knowledge is valuable where it is cheap to state and expensive to get wrong. XCON worked because the constraints on configuring a VAX were knowable, stable enough to write down, and costly to violate. MYCIN's rules were harder to state and harder to maintain, and the domain shifted under them as microbiology and pharmacology advanced. The best candidates for the symbolic side of a hybrid are bodies of knowledge that are already written down, such as regulations, specifications, type systems and physical laws, rather than expertise that must be extracted from people's heads. The third is that the symbolic tradition's most durable products were not systems that tried to be intelligent but tools that did one exact thing very well: solvers, checkers, provers, type systems and databases. These are the components that modern hybrids most often connect to. A language model that writes a program and runs it, a learned prover that proposes steps for Lean to check, and a chatbot whose statements are verified by an SMT solver against a formalised policy are all using symbolic AI in this form: as a precise instrument rather than an attempt at a mind. With these lessons in hand, the variety of hybrid architectures becomes easier to navigate. They differ mainly in where they place the boundary between the learned and the explicit, and in which direction information and learning signals flow across it. Chapter 3: A Map of Hybrids "Neuro-symbolic" is a label, not an architecture. It has been applied to systems that differ from one another as much as either differs from a plain neural network: a game-playing program that searches a tree of moves with a neural network scoring each position, a vision system that turns images into symbolic scene descriptions and answers questions about them with a small program, a network whose loss function penalises violations of logical rules, and a chatbot that looks up facts in a knowledge graph before answering. To reason about this variety, one needs a map. The most useful map available was drawn by Henry Kautz, a computer scientist at the University of Rochester, in his Robert S. Engelmore Memorial Lecture at the AAAI conference in February 2020, later published in AI Magazine under the title "The Third AI Summer". Kautz proposed six categories, each named with a compact notation describing how neural and symbolic components are arranged. The notation is a little cryptic, but the categories it describes are clear, and they sort the field by exactly the feature this book argues matters most: where the interface sits and what crosses it. Kautz's six categories The first category, which Kautz wrote as symbolic Neural symbolic, is the ordinary case of deep learning applied to symbolic data. A language model takes in tokens, which are discrete symbols, converts them to continuous vectors, processes them, and converts the result back into tokens. The input and output are symbolic, but all the reasoning happens inside the network. Kautz included this category partly to make the point that almost all deep learning on language is, in a weak sense, already neuro-symbolic. In a stricter sense it is not, because the symbols are only an encoding at the edges; nothing inside the system manipulates them according to explicit rules. The second, Symbolic[Neural], places a neural network inside a symbolic procedure. The canonical example is DeepMind's AlphaGo and its successors. The outer algorithm is Monte Carlo tree search, a symbolic procedure that systematically explores possible sequences of moves. At each node, neural networks estimate how promising the position is and which moves are worth exploring. The search provides structure, lookahead and a guarantee that the rules of the game are respected; the networks provide the intuition that keeps the search tractable. The symbolic component is in charge, and it calls the neural one as a subroutine. The third, Neural | Symbolic, is a pipeline. A neural network converts raw perceptual input into a symbolic representation, and a separate symbolic reasoner operates on that representation. The vertical bar marks a clean handoff. Systems for visual question answering that first detect objects and their attributes in an image, then execute a program over the resulting list of objects, are examples. So, in a looser sense, is any industrial system where a vision model reads a document and a rules engine processes the extracted fields. The fourth, Neural: Symbolic → Neural, uses symbolic knowledge to produce training data or targets for a network, which then learns to imitate the symbolic process. A notable example is work by Guillaume Lample and François Charton at Facebook AI Research in 2019, who generated large numbers of integration and differential-equation problems with computer algebra, together with their solutions, and trained a transformer to map problems to solutions. The resulting network was fast and often correct, but at run time it contained no symbolic machinery at all: the symbolic system had been compiled into the network's weights through the data. The fifth, which Kautz wrote with the symbolic part as a subscript, Neural_{Symbolic}, uses symbolic rules to shape the structure or training of the network itself. Logical formulas become templates for network layers or terms in the loss function, so that the trained network respects the rules approximately. Logic Tensor Networks and related approaches, discussed in the next chapter, belong here. The rules are present at training time and influence what the network learns, but they are dissolved into continuous computation rather than executed. The sixth, Neural[Symbolic], inverts the second category: a neural system is in charge and calls a symbolic reasoner as a subroutine when it needs one. In 2020 Kautz described this as the category he expected to matter most in future and had few examples of. Within three years it had become the dominant pattern in applied AI, in the form of language models that call calculators, code interpreters, search engines, databases and solvers. A model that decides it needs to compute a figure, writes a short program, runs it, and reads the result is a Neural[Symbolic] system in exactly Kautz's sense. Table 2 sets out the six categories with a representative example of each and the location of the interface between learned and explicit components. Table 2. Kautz's taxonomy of neuro-symbolic systems. Category Example Where the interface sits symbolic Neural symbolic Language model Only at input and output encoding Symbolic[Neural] AlphaGo tree search Network scores states for the search Neural, then Symbolic (pipeline) Scene parsing plus program execution Fixed handoff of extracted symbols Neural: Symbolic → Neural Learned symbolic integration Training data; absent at run time Neural_{Symbolic} Logic Tensor Networks Loss function or architecture Neural[Symbolic] Language model with code interpreter Tool calls chosen by the network Source: adapted from Kautz, "The Third AI Summer", AI Magazine (2022). Three questions that place any system Kautz's categories are a starting point, but real systems often mix them, and new designs do not always fit neatly. A more flexible way to locate any hybrid on the map is to ask three questions about its interface. The first question is what crosses the boundary. In some systems what crosses is a discrete symbol: the vision network outputs "red cube, left of green sphere" and the reasoner receives exactly that. In others what crosses is a probability distribution over symbols: the network says the object is a cube with probability 0.9 and a cylinder with probability 0.1, and the reasoner must handle both possibilities. In others still what crosses is a program or formula, written by a neural model and executed by a symbolic one. The richer the thing that crosses, the more information survives the translation, and the more work the receiving side must do to use it. The second question is whether learning signals cross the boundary. If the symbolic reasoner reaches a wrong conclusion, can the error be traced back to adjust the network that supplied its inputs? In a simple pipeline the answer is no. The network is trained separately on labelled examples of the symbols it is supposed to produce, and the reasoner is fixed. This is easy to build but requires labelled intermediate data, which is often unavailable, and it means the network is not optimised for what the reasoner actually needs. In more tightly coupled systems, the symbolic reasoning is made differentiable or approximated so that gradients flow through it, allowing the whole system to be trained end to end from final answers alone. This is more powerful and much harder, for reasons the next chapter explains. The third question is which side is in charge. In a Symbolic[Neural] system such as tree search, the symbolic procedure decides what happens next, and the network is consulted. In a Neural[Symbolic] system such as a tool-using language model, the network decides, and the symbolic tool is consulted. This matters for guarantees. When the symbolic side is in charge, the system's overall behaviour inherits properties of the symbolic procedure: a tree search over legal moves will never play an illegal move however bad its evaluations. When the neural side is in charge, the symbolic tools are only as useful as the network's decisions about when and how to call them, and nothing forces the network to call them at all. These three questions, what crosses, whether learning crosses, and who is in charge, will recur in every chapter that follows. They are the coordinates on which hybrid systems differ in ways that matter. One task, several designs The questions become concrete when the same task is built in different ways. Consider a system that answers questions about supplier invoices: an accounts team wants to ask, in plain language, things such as "Which invoices from last quarter were billed above the contracted rate?". The inputs are scanned or emailed invoices in many layouts, a database of contracts, and the question. The first design is purely neural, Kautz's first category. A large multimodal model is given the invoices, the contracts and the question, and writes an answer. Nothing crosses any internal boundary, because there is none. The design is quick to build and handles unusual layouts gracefully. It will also, sooner or later, misread a figure, compare a price against the wrong contract line, or add up a column incorrectly, and its answer will look no less confident when it does. The second design is a pipeline, the third category. A document model extracts each invoice into a structured record of supplier, date, line items, quantities and unit prices. A separate model, or a fixed set of templates, translates the question into a database query. The query runs exactly against the extracted records and the contract database. What crosses the boundary is a discrete record, learning does not cross it, and the symbolic side, the query engine, determines the answer. The arithmetic and the comparison against contracted rates are now exact. Errors can still enter at extraction, but they enter at a known point and can be checked there, for instance by comparing extracted totals with the sum of extracted line items. The third design puts a language model in charge with tools, the sixth category. The model reads the question, decides it needs to query the invoice records, writes the query, inspects the results, perhaps decides to run another query, and composes an answer. This is more flexible than the fixed pipeline: it can handle questions the template designers never imagined. But the guarantees are weaker, because the model may write a subtly wrong query, misinterpret the results, or skip the query and answer from its impression of the documents. Its flexibility is bought at the cost of the clean handoff that made the pipeline auditable. A fourth design combines the second and third. The language model drafts the query, but the query and its results are shown with the answer, and the numerical claims in the answer are checked mechanically against the query results before the answer is released. The model has freedom over interpretation and phrasing; it has no freedom over the figures. None of these designs is correct in general. For a team that wants a quick sense of its spending, the first may be good enough. For an auditor, only the second or fourth will do. The point of the map is that the choice among them is a choice about the interface, and making it deliberately is most of the work. Loose and tight coupling A useful shorthand for the second question is the distinction between loosely and tightly coupled systems. Loosely coupled systems keep neural and symbolic components separate, train them separately or not at all, and connect them through a defined interface such as a list of facts, a program or an API call. Tightly coupled systems integrate them so that they are trained together and their representations are shared or mutually constrained. Loose coupling has large practical advantages. Each component can be developed, tested and replaced independently. The symbolic side can be an existing, mature tool, such as a commercial solver, a database or a proof assistant, rather than a research prototype. Failures can usually be localised to one side or the other. And the guarantees of the symbolic component remain intact, because it executes exactly as it would on its own. Most deployed hybrid systems in 2026 are loosely coupled. Tight coupling offers something loose coupling cannot: the ability to learn from weak supervision. If the only training data available consists of final answers, such as whether a question about an image was answered correctly, a loosely coupled system cannot use it to improve its perception, because it has no way of knowing which perceptual error caused a wrong answer. A tightly coupled system can, by propagating the error back through the reasoning. Tight coupling also allows symbolic knowledge to improve learning, for instance by teaching a network that certain combinations of labels are impossible, so that it needs fewer examples. The cost is that the symbolic component must be modified, usually by relaxing its discrete operations into continuous approximations, and in the process it loses some of the exactness that made it valuable. The choice between them is therefore a trade-off between trainability and guarantees, and it is one of the most consequential decisions in hybrid design. A system for answering questions about a fixed, well-specified domain where labelled intermediate data exists should almost certainly be loosely coupled. A research system that must learn concepts from raw images and answers alone may need tight coupling. Many successful systems use both: tight coupling during training to learn good perception, and a loosely coupled, exact reasoner at run time to produce answers that can be trusted. The "System 1 and System 2" analogy Much writing on neuro-symbolic AI borrows an analogy from psychology. Daniel Kahneman, summarising decades of research in his 2011 book Thinking, Fast and Slow, described two modes of human cognition: a fast, automatic, intuitive mode he called System 1, and a slow, deliberate, effortful mode he called System 2. Yoshua Bengio, one of the pioneers of deep learning, made the analogy prominent in AI in a keynote at the NeurIPS conference in 2019, arguing that deep learning had mastered System 1 and needed to develop System 2 capabilities. Neural networks, on this view, are System 1; symbolic reasoning is System 2; and a complete intelligence needs both. The analogy is helpful as orientation and misleading as engineering. It is helpful because it captures the complementarity in Table 1: fast pattern recognition and slow explicit reasoning are different things, and people use both. It is misleading in two ways. First, Kahneman's two systems are not separate modules in the brain, and the psychological evidence does not support a clean division of labour between them; people reason intuitively about logic and deliberately about perception. Second, and more importantly for builders, the analogy implies that the interface between the systems is natural and unproblematic, as though a mind simply hands a hard problem from one system to the other. In artificial systems, that handoff is the hardest part. The analogy says nothing about what crosses the boundary, whether learning crosses it, or who decides when to cross. Those questions are where the engineering lies. Bengio himself did not propose bolting a classical logic engine onto a network; his programme was to build networks with internal structure that supported System 2 properties such as compositional, causal and sparse reasoning. That is a legitimate and important alternative, and it bears on whether the symbolic side of a hybrid must remain explicit at all. Chapter six returns to this question in the context of reasoning-trained language models. For now, the point is that Kautz's map and the three questions about the interface provide a more precise vocabulary than the two-systems metaphor, and the next two chapters use that vocabulary to examine the two most developed families of hybrid technique in detail: those that put logic inside the network, and those that keep them apart. Hashtags: #NeuroSymbolicAI #NeuroSymbolicArtificialIntelligence #DeepLearning #SymbolicAI #ArtificialIntelligence #NeuralNetworks #SymbolicReasoning #LogicBasedAI #HybridAI #MachineLearning #KnowledgeRepresentation #KnowledgeGraphs #LogicalInference #AutomatedReasoning #ExplainableAI #AIReasoning #DifferentiableLogic #LogicTensorNetworks #NeuralSymbolicIntegration #ExpertSystems #FormalVerification #TheoremProving #CompositionalGeneralization #AIArchitectures #LargeLanguageModels #ReasoningModels #NeuralSymbolicLearning #KnowledgeBasedSystems #TrustworthyAI #FutureOfAI

Download the Book (PDF): Introduction In 1988 the humorist Art Buchwald watched Paramount release Coming to America, a comedy starring Eddie Murphy that a Los Angeles court would later find was based on a short treatment Buchwald had submitted to the studio in 1983, and which Paramount had optioned. The film earned a fortune at the box office. Buchwald's contract promised him a share of the picture's "net profits." According to the studio's accounting, there were none. The movie that had filled theaters around the world was, on paper, deep in the red, and it would stay there. The case that followed, Buchwald v. Paramount Pictures, became the most famous lesson in Hollywood law, and the lesson was not really about Eddie Murphy, or about whether Paramount had copied an idea. It was about a word. "Net profits" in a studio contract does not mean what an accountant, an economist or an ordinary English speaker means by net profits. It means whatever the contract's definition says it means, and the definition was written by the studio. Buchwald had signed a document that promised him a percentage of a number that, by design, almost never exists. That is the controlling idea of this book: in the entertainment business, the money and the power are allocated less by headline terms than by definitions, conditions and sequence. A two-million-dollar fee that is "pay-or-play" is a different thing from a two-million-dollar fee that is not. A film rights purchase price that is "payable upon exercise of the option" may never be paid at all. A director who has "the DGA director's cut" has a right that ends at a precise moment, after which the studio may do as it likes. A performer who "consents" to a digital replica has consented to exactly what the consent clause describes, and a great deal turns on how specific that description is. The lawyers who make careers in this field are, above all, readers and writers of definitions. Three layers Every talent deal and rights deal in Hollywood sits on three layers, and a reader who keeps them distinct will understand most of what follows. The first layer is the statutory and common law that governs contracts, copyright and personality. Copyright law decides who owns a novel, a screenplay or a finished film, and it imposes formal requirements on anyone who wants to acquire those rights. The Copyright Act gives authors, in certain circumstances, the power to take back what they sold decades earlier. State law, and above all California law, governs personal service contracts, talent agents, the earnings of child performers and, increasingly, the use of a person's digital likeness. Constitutional free-speech doctrine sets the outer boundary of what a filmmaker may say about a real person without permission. The second layer is the collective bargaining agreements negotiated by the entertainment guilds: SAG-AFTRA for performers, the Directors Guild of America for directors, the Writers Guild of America for writers. These agreements, negotiated with the studios' bargaining representative, the Alliance of Motion Picture and Television Producers, set minimum pay, residuals, pension and health contributions, working conditions and a surprising range of creative rights. They form a floor beneath every individual deal. No individual performer, however eager, can agree to work for less than the guild minimum on a covered production, and no studio that has signed the agreement can escape its obligations by persuading a performer to waive them. In 2023 both the writers and the actors struck for months, and the settlements they reached, followed by new four-year agreements ratified by all three major guilds in 2026, reshaped the rules on streaming compensation and artificial intelligence. The third layer is the individual contract: the actor's deal, the director's deal, the option agreement for a novel, the purchase of a person's life story. This is where agents and lawyers earn their fees, negotiating everything above the guild floor: fees, bonuses, credit, approvals, perquisites and the shares of revenue that the industry calls "backend." Most of the fame and most of the litigation live here. A dispute in Hollywood almost always involves a question about how these layers fit together. Can a studio's standard net profit definition be attacked as unconscionable under state contract law? Does a guild's rule on digital replicas override a clause in a performer's individual contract? Does a producer who paid for an option own the film rights, or merely a right to buy them, and did the paperwork satisfy the Copyright Act's writing requirement? The chapters that follow take up these questions in the order a production encounters them. The shape of the book The first chapter sets out the architecture of a Hollywood deal: the parties and representatives, the loan-out corporations through which talent usually contracts, the short deal memo that often governs a production long before the full contract is signed, and the California rules that make talent representation a regulated activity. Chapters 2 and 3 turn to the acquisition of material. Chapter 2 explains the option agreement, the standard device by which producers tie up a novel or other property without paying its full price, and the formal traps that can leave a producer holding nothing. Chapter 3 addresses the rights that surround a story: life rights, the law of idea submission, and the statutory termination rights that allow authors and their heirs to recapture works decades later, a body of law that the federal courts have been actively extending. Chapters 4 and 5 are about talent. Chapter 4 walks through the actor's deal clause by clause, from fixed compensation and pay-or-play to billing, approvals, morals clauses and the special rules for minors. Chapter 5 addresses the director's deal and the question that dominates it: who controls the final version of the film. Chapter 6 explains the guild system as it bears on individual deals, including SAG-AFTRA's membership rules, the legal limits on compulsory union membership and the terms of the 2026 agreements. Chapter 7 treats artificial intelligence and the digital performer, the area in which the law has changed fastest since 2023, with new state statutes, new contract terms and a federal bill still pending. Chapter 8 returns to where this introduction began: the definition of net profits, how studio accounting works, what courts have and have not been willing to do about it, and how the rise of streaming has changed the backend. The conclusion draws the threads together into practical guidance. The book is written principally about United States law and practice, and within that, principally about California and New York, where most of the business is transacted and where most of its law has been made. Where British or European practice differs in instructive ways, it is noted. The book is educational and is not legal advice. A word about vocabulary Hollywood has its own dialect, and part of what makes its contracts forbidding to outsiders is that ordinary words carry specialized meanings. "Gross" rarely means all the money. "Break-even" is a contractual event, not an economic one. "Above the line" and "below the line" divide a production budget between the creative principals (writers, producers, directors and principal cast, together with the cost of acquiring the underlying rights) and everyone and everything else. A "quote" is the fee an actor or director was most recently paid, used as a benchmark in negotiating the next fee. A "hold" is a producer's claim on an actor's time. "Scale" is the guild minimum, and "scale plus ten" is the guild minimum plus an additional ten percent to cover an agent's commission. These terms are defined where they first appear. The goal is not to turn the reader into a practitioner, but to make it possible to read a talent agreement, an option or a participation statement and to know where the important questions are. In each case, the answer to the question "what did I actually agree to?" is found not in the number at the top of the page but in the definitions at the back. Chapter 1: The Architecture of a Hollywood Deal A film or television series is, in legal terms, a bundle of contracts. Before a single frame is shot, a producer must have acquired rights to the underlying story, engaged a writer, attached a director and cast, arranged financing, secured distribution and signed the guild agreements that govern the people on set. Each of those relationships is documented separately, and each document refers to the others. An actor's fee may depend on whether the studio "greenlights" the picture; the greenlight may depend on whether that actor is attached; the actor's backend may be computed by reference to the studio's distribution agreement, which the actor has never seen. Understanding any single contract in this web requires a sense of the whole. This chapter sets out the architecture: who the parties are, how talent is represented and what the law permits representatives to do, why most talent contracts are signed by a corporation rather than a person, and why the short document negotiated in the first days of a deal often matters more than the long one that follows it. The parties at the table On one side of most deals sits a buyer of talent or rights. Historically that meant one of the major studios, the handful of companies that finance, produce and distribute films worldwide and that bargain collectively with the guilds through the Alliance of Motion Picture and Television Producers. Today the buyers also include the streaming services, some of which are divisions of the old studios and some of which are technology companies that entered the business in the last fifteen years, as well as broadcast and cable networks, independent production companies, and financiers who assemble money for individual pictures. The legal differences among these buyers are real. A major studio will insist on its own form contracts and its own definitions, and its bargaining leverage is enormous. An independent producer, by contrast, may need an actor's name to raise money at all, and the actor's lawyer will write much of the paper. On the other side sits the talent, and almost never alone. The typical working actor, director or writer is represented by some combination of a talent agent, a personal manager and an entertainment lawyer, and a successful one will also have a business manager who handles money after it arrives. The division of labor among these representatives is not just a matter of custom. In California, where most of the industry's representation takes place, it is shaped by statute. The Talent Agencies Act California's Talent Agencies Act, found in the Labor Code beginning at section 1700, requires anyone who acts as a "talent agency" to hold a license from the state Labor Commissioner. The Act defines a talent agency as a person or corporation who engages in the occupation of "procuring, offering, promising, or attempting to procure employment or engagements" for an artist. The definition is functional. It does not matter what a representative calls himself; if he procures employment, he is acting as an agent, and if he does so without a license, he is violating the Act. There is a narrow exception for procuring recording contracts for musicians, and a related provision permits an unlicensed person to work in conjunction with a licensed agent at the agent's request. Licensed agents are subject to regulation: they must post a bond, submit their form contracts to the Labor Commissioner and keep client funds in trust. Historically, the talent guilds added a second layer of regulation through "franchise" agreements that capped agents' commissions at ten percent and limited conflicts of interest. The ten percent commission remains the industry standard for agents, and it is why guild minimums for performers are often quoted as "scale plus ten": the extra ten percent covers the agent's commission so that the performer still takes home the minimum. Personal managers, by contrast, are not licensed. Their traditional role is advisory: guiding a career, choosing projects, managing image and relationships. They usually charge higher commissions than agents, commonly fifteen percent and sometimes more, on the theory that they are closer to the client and do more of the day-to-day work. The difficulty is that the line between advising a client and procuring work for her is often invisible in practice. A manager who takes a phone call from a casting director, pitches a client for a role or negotiates a fee has, arguably, procured employment. The consequences of crossing that line are severe. When a client disputes a manager's commissions, the client can petition the Labor Commissioner, who has exclusive original jurisdiction over controversies arising under the Act; the California Supreme Court confirmed that allocation in Styne v. Stevens (2001). If the Commissioner finds that the manager acted as an unlicensed agent, the management contract may be declared void and the manager may be barred from collecting commissions. For years, the question was whether a single act of procurement voided the entire contract. In Marathon Entertainment, Inc. v. Blasi (2008), a dispute between a management company and the actress Rosa Blasi, the California Supreme Court held that the doctrine of severability applies. A court or the Commissioner may void only the tainted part of the arrangement and allow the manager to recover commissions for lawful services, depending on the degree to which the illegality permeated the relationship. Marathon softened the Act's bite, but it did not remove it. Managers in California still structure their work so that a licensed agent is formally involved in any job offer, and many talent contracts for managers expressly disclaim any procurement role. New York takes a different approach. Its General Business Law regulates theatrical employment agencies but exempts managers whose procurement of employment is only "incidental" to their management business. The practical effect is that managers operating in New York face less exposure than their California counterparts, although the question of whether a given manager's activity was merely incidental can itself generate litigation. The different roles of the representatives are summarized in Table 1, which compresses the rules just described. Table 1. Talent representatives in California practice. Representative Regulation Typical compensation May procure work? Talent agent Licensed by Labor Commissioner; guild agreements 10% of gross earnings Yes Personal manager Unlicensed Commonly 15%, sometimes more Only with a licensed agent involved Entertainment lawyer State bar; professional conduct rules Often 5% of deals, or hourly Negotiates; procurement is contested ground Business manager Generally unlicensed; often accountants Often a percentage of income or a fee No; manages money Lawyers occupy an unusual position. Entertainment lawyers in Los Angeles commonly work on a percentage basis, typically five percent of the client's deals, rather than billing by the hour. They negotiate contracts, and senior lawyers often play a role in shaping careers that overlaps heavily with that of agents. Whether lawyers who solicit employment for clients are themselves subject to the Talent Agencies Act has long been debated. Lawyers are governed by their own ethical rules, and in practice the Act has rarely been applied to them, but a prudent lawyer avoids acting as a de facto agent for an unrepresented client. Packaging and the agency wars The Talent Agencies Act does not address one of the most important economic features of agency practice in the late twentieth century: packaging. In a package, an agency brought together several of its clients, typically a writer, a director and a star, and presented them as a unit to a studio or network, usually for a television series. Instead of commissioning each client, the agency received a "packaging fee" directly from the studio, often a fixed amount per episode plus a share of the series' backend. The clients paid no commission, which seemed generous. Critics, and eventually the Writers Guild of America, argued that the arrangement put agencies' interests in conflict with their clients': an agency paid by the studio had less reason to push the studio for higher client fees, and an agency's own backend participation depended on the same revenue from which its clients were paid. In April 2019 the WGA, after failing to negotiate a new agreement with the Association of Talent Agents, instructed its members to terminate their agents. Thousands did. The dispute produced litigation in both directions, including antitrust claims by the agencies against the guild and a suit by writers against the agencies alleging breaches of fiduciary duty. It was resolved not by a court but by attrition: one by one, the major agencies signed agreements with the WGA that phased out packaging fees and imposed strict limits on agency ownership of affiliated production companies. By 2021 all the large agencies had signed. The episode is instructive for two reasons. It showed the guilds' power to regulate the representation market through collective action, and it illustrated how a compensation structure that looks favorable to talent on the surface can conceal a divergence of interest underneath. The loan-out corporation When a studio engages a star, it rarely contracts with the star directly. It contracts with the star's "loan-out" company, a corporation that the performer owns and that employs the performer. The loan-out "lends" the performer's services to the studio in exchange for a fee, and pays the performer a salary out of that fee. The reasons are mainly financial. A loan-out may allow the performer to deduct business expenses, fund retirement plans and manage the timing of income. It may simplify work in foreign jurisdictions that tax local income. The corporate structure may provide some insulation from liability, although that benefit is limited, since a performer remains personally liable for his or her own torts. The tax advantages have waxed and waned with changes in federal law, and a performer's advisers should revisit the structure periodically rather than assume it always pays. The loan-out structure requires an additional document. Because the studio's contract is with the corporation, the studio needs assurance that the individual performer will actually render services and will be bound by the promises the corporation makes, including restrictions on publicity, grants of rights and representations about the performer's conduct. That assurance comes in an "inducement letter," signed by the performer personally, in which the performer agrees to be bound by the loan-out agreement, confirms that the loan-out has the right to lend his or her services, and agrees to look solely to the loan-out for payment. The inducement letter lets the studio proceed against the individual if the corporation fails, and it prevents the performer from claiming wages directly from the studio if the corporation mismanages its money. For guild purposes, the loan-out company is treated as the employer of record for some things but not others. The studio remains responsible for making pension and health contributions to the guild plans on the performer's compensation, and the guild agreements generally apply to the performer's services regardless of the corporate intermediary. A loan-out is a device for arranging money; it is not a way to escape the guild floor. Deal memos, short forms and the unsigned long form A curious feature of Hollywood practice is that productions frequently go forward, and sometimes finish, before the definitive contracts are signed. The typical sequence is this. The agent and the studio's business affairs executive agree on the key terms by telephone or email: the fee, the start date, the credit, the backend. Those terms are memorialized in a "deal memo" of a few pages, sometimes signed and sometimes only exchanged. The studio's lawyers then prepare a "long-form" agreement, which runs to dozens of pages and incorporates the studio's standard terms and conditions, often including an exhibit defining contingent compensation. The talent's lawyer marks up the long form, the studio responds, and the negotiation over the long form can continue for months. Meanwhile, the actor has reported to the set and the picture is shooting. The legal question this raises is whether the deal memo is itself a binding contract, or merely an agreement to agree. The answer depends on intent, and on whether the essential terms were settled. The classic illustration is the dispute over Boxing Helena, a low-budget picture from the early 1990s. The actress Kim Basinger had orally agreed, and in some documents appeared to have agreed, to star in the film; she later withdrew, the producer sued, and in 1993 a Los Angeles jury returned a verdict against her of nearly nine million dollars. The verdict was reversed on appeal in Main Line Pictures, Inc. v. Basinger (1994) because of a defect in the form of the special verdict the jury had been asked to complete, and the case later settled. But the trial result was enough to jolt the industry: it demonstrated that a jury could find an enforceable commitment in an exchange of informal communications, even though the long-form contract had never been signed. The lesson most practitioners drew from Basinger is twofold. First, if a party does not intend to be bound until the long form is signed, the deal memo should say so explicitly, stating that no agreement exists until a definitive written contract is executed. Second, and conversely, if a party does intend a binding deal, the deal memo should say that too, and should specify that the studio's standard terms, "subject to good faith negotiation within customary industry parameters," will fill the gaps. Many studio deal memos adopt this second approach, which makes the memo binding and pushes the fight over details into the long form without jeopardizing the deal itself. There is a further wrinkle when the deal concerns rights under copyright. As Chapter 2 explains, a transfer of copyright ownership, including an exclusive license, is not valid unless it is in a writing signed by the owner. An oral deal for the services of an actor may be enforceable. An oral deal for the exclusive film rights to a novel is not. Personal services and the limits of enforcement One principle runs underneath every talent contract: courts will not order a person to perform personal services. An actor who walks off a picture cannot be compelled by injunction to return to work. The remedy for breach is damages, and a studio suing a departing star must prove what the departure cost, which can be difficult. Courts will sometimes enforce the negative side of a personal services contract, by enjoining a performer from working for a competitor during the contract period. California law allows such negative injunctions only in narrow circumstances; under Civil Code section 3423, the contract must be in writing and must guarantee the performer minimum compensation at specified levels, and the services must be of a special, unique or extraordinary character. In practice, negative injunctions are uncommon in film and television, but the rule shapes the drafting of exclusive long-term deals, particularly for series regulars and recording artists. California also limits the duration of personal service contracts. Labor Code section 2855, known in the industry as the seven-year rule, provides that a contract to render personal service may not be enforced against the employee beyond seven years from the commencement of service. The rule's modern form owes much to De Haviland v. Warner Bros. Pictures (1944), in which the actress Olivia de Havilland challenged Warner Bros.' practice of extending her contract by adding periods of suspension, the time during which she had refused roles, to the end of the term. The California Court of Appeal held that the seven-year limit ran in calendar years, not in years of actual service, and she was freed. The decision helped dismantle the studio system of long-term contracts and remains a reason why television series regular deals, which may bind an actor for many seasons, are carefully structured. The statute contains a special provision for recording artists that allows record companies to recover damages for undelivered albums, a carve-out that has been controversial in the music industry but has limited application to film. Reading the architecture Seen from above, a Hollywood deal is a set of nested promises. The guild agreement sets the floor. The deal memo fixes the headline terms. The long form fills in the rest, often by incorporating standard terms that were written long before this particular production was conceived. The loan-out and inducement letter decide who is bound and who gets paid. The representatives, regulated in some cases and not in others, carry offers back and forth. And beneath all of it runs a body of state law that limits how long a person can be bound and what a court will do if a performer walks away. A dispute can arise at any joint in this structure. The rest of this book takes up the most important of them, beginning with the first thing a producer must acquire: a story. Chapter 2: Optioning the Story Most films and a large share of television series are adaptations. They begin as novels, nonfiction books, magazine articles, comic books, plays, podcasts, video games or earlier films. Before a producer can develop any of these into a screenplay and take it to financiers, the producer needs the right to do so. Buying those rights outright, at the price a successful adaptation would justify, would be ruinous: most projects in development never reach production, and a producer who paid full price for every property on the slate would be bankrupt long before one of them reached a screen. The solution the industry settled on long ago is the option. An option is a contract under which the owner of a property grants the producer, for a relatively small fee, the exclusive right to buy specified rights at a fixed price within a fixed period. During that period the producer can commission a screenplay, attach talent and shop the project, secure in the knowledge that no one else can buy the rights out from under it. If the project comes together, the producer exercises the option and pays the purchase price. If it does not, the option lapses, and the owner keeps the option fee and is free to sell to someone else. The option is simple in concept and treacherous in execution. It is two contracts in one, an option agreement and a purchase agreement, and the purchase agreement must be fully negotiated at the outset, because once the option is exercised, there is no further bargaining. A producer who has optioned a property on vague terms may find, at the moment of exercise, that the owner disputes what was sold. An owner who has granted an option on careless terms may find that the rights have been tied up for years for almost nothing, or that rights she thought she had kept went with the sale. The economics of an option An option has four basic economic terms: the option price, the option period, the extension terms and the purchase price. The option price is what the producer pays for the exclusive right. For a first novel by an unknown author, it may be nominal, a few thousand dollars or even a single dollar in the case of a producer with a close relationship to the author. For a bestselling book sought by several studios, it can run to six or seven figures. A traditional rule of thumb puts the option price at around ten percent of the purchase price, but practice varies widely. The option period is typically twelve to eighteen months. Development takes time, and a producer who obtains an option for only six months will spend most of it negotiating with writers. The period is almost always extendable: the producer may extend it one or more times, for an additional period of similar length, by paying an additional fee before the original period expires. A central negotiating point is whether option and extension payments are "applicable" against the purchase price, meaning deducted from it when the option is exercised. Owners prefer that the first payment be applicable and extension payments not, so that a producer who holds the rights for a long time pays more for the privilege. The purchase price is the amount the producer pays upon exercising the option. For feature films, it is often expressed as a percentage of the film's final budget, frequently in the low single digits, subject to a floor and a ceiling. A budget-based price aligns the owner's payment with the scale of the eventual production. A small independent film will pay close to the floor; a studio tentpole will pay the ceiling. For television, the structure differs: rights are often purchased for a pilot and series, with an initial payment and then a royalty per episode produced, plus additional payments for subsequent seasons, spin-offs and other derivative productions. On top of the fixed purchase price, owners with leverage negotiate contingent compensation. This may take the form of box office bonuses payable when the film's domestic gross reaches stated thresholds, bonuses if the book is a bestseller at the time of release, a sequel or remake payment set as a fraction of the original price, and a share of the film's backend, commonly expressed as a percentage of the producer's share of net profits. Chapter 8 explains why the last of these is often worth less than it sounds. The rights that are sold The heart of the purchase agreement is the grant of rights, and it is where the most expensive mistakes are made. A typical grant, drafted by a studio, conveys the exclusive right throughout the universe and in perpetuity to produce motion pictures based on the property, together with television, sequel, remake and "allied and ancillary" rights, including merchandising, soundtrack and interactive rights, as well as the right to use the title of the property and the author's name in connection with the production. The author's lawyer will seek to carve out "reserved rights" that remain with the author. The most important are print publication rights (the author must remain free to publish the book and future editions), live stage rights, radio and audio rights, and the right to write and publish sequels using the same characters. The last is delicate, because the studio acquiring a successful book wants control of any franchise that grows from it. The usual compromise is that the author may write and publish sequels, but the studio receives a right of first negotiation, or a right of last refusal, to acquire film rights in them. A "first negotiation" right obliges the author to negotiate in good faith with the studio for a period before approaching anyone else. A "last refusal" right allows the studio to match any offer the author later receives from a third party. The two are often combined. Reserved rights may themselves be subject to holdbacks. A studio may insist that the author not exploit live stage or radio rights for a number of years after the film's release, so that a competing adaptation does not dilute the market. And certain rights may be "frozen," meaning neither party may exploit them without the other's consent. The principal terms, and what each party typically seeks, are set out in Table 2. Table 2. Principal terms of a literary option and purchase agreement. Term What it governs Owner's usual position Producer's usual position Option price Fee for the exclusive right Higher; nonrefundable Lower; applicable to purchase Option period and extensions How long rights are tied up Short; extensions not applicable Long; several extensions Purchase price Payment on exercise Budget-based with high floor Fixed or low ceiling Grant of rights What is conveyed Narrow; strong reserved rights Universe, perpetuity, all media Contingent compensation Bonuses and backend Box office bonuses; gross-based share Net profits share only Reversion Return of unproduced rights Automatic after a set period None, or on repayment of costs The writing requirement Copyright law imposes a formal requirement that shapes every option and every purchase. Under section 204(a) of the Copyright Act, a transfer of copyright ownership "is not valid unless an instrument of conveyance, or a note or memorandum of the transfer, is in writing and signed by the owner of the rights conveyed." The Act defines a "transfer of copyright ownership" to include an exclusive license. Because film rights in a novel are almost always granted exclusively, the grant must be in writing and signed by the author. The Ninth Circuit, whose jurisdiction includes Los Angeles, has applied this requirement strictly. In Effects Associates, Inc. v. Cohen (1990), a special effects company had created footage for a low-budget horror film, The Stuff, and, unhappy with the payment it received, claimed that the filmmaker's use of the footage infringed its copyright. Judge Alex Kozinski's opinion began with the observation that "Moviemakers do lunch, not contracts," and went on to hold that the writing requirement applied to transfers of ownership, but that a nonexclusive license could be implied from conduct. Because the effects company had created the footage at the filmmaker's request and handed it over intending that it be used, the filmmaker had an implied nonexclusive license to use it. The effects house could sue for its unpaid fee, but it could not stop the film. The distinction matters enormously. An implied nonexclusive license may let a producer use material, but it will not give the producer exclusivity, and without exclusivity a producer cannot give a studio the clean chain of title it demands. Only a signed writing will do that. The consequences for options were made plain in Konigsberg International Inc. v. Rice (1994). The producers Frank Konigsberg and Larry Sanitsky claimed that the novelist Anne Rice had orally agreed in 1987 to write a story about a mummy and give them television and film rights, with a period to exploit them and an extension. Rice delivered an outline and was paid, but no written agreement was ever signed. When Rice later published The Mummy as a novel, the producers claimed they had extended their rights. They pointed to a letter Rice had written years later, during the dispute, which referred to the arrangement. The Ninth Circuit held that the letter could not satisfy section 204(a) because it was not substantially contemporaneous with the alleged agreement and was not a product of the parties' negotiations. The court stressed that the writing requirement serves to make ownership certain and to force parties to specify precisely what rights are being transferred and at what price. The producers' claim failed. The Ninth Circuit reached a similar result in Radio Television Espanola S.A. v. New World Entertainment, Ltd. (1999), holding that faxes and correspondence discussing a licensing deal for Spanish television rights did not constitute a signed writing conveying the rights. The pattern is consistent: in rights deals, correspondence and conduct will rarely substitute for a signed conveyance. The practical upshot is that a careful producer obtains a signed option agreement at the outset and also obtains, at the same time, two short documents signed by the owner: a "short-form option" and a "short-form assignment." The short-form option records the existence of the option in a page or two without disclosing the price. The short-form assignment is held in escrow and becomes effective upon exercise. Both can be recorded with the Copyright Office. Recordation under section 205 of the Copyright Act gives constructive notice of the transfer and, in a contest between conflicting transfers, can establish priority. A producer who records promptly protects against the possibility that an author, whether deliberately or through carelessness, grants the same rights to someone else. Exercise, expiry and the strict construction of options Options are construed strictly. An option is an offer that the producer may accept only in the manner and within the time specified. If the agreement requires written notice of exercise and payment of the purchase price before a date, then notice after that date, or notice without payment, is ineffective, and the rights revert. Courts have generally been unwilling to relieve an option holder from a missed deadline, on the view that time is the essence of an option. For this reason, producers negotiate provisions that extend the option period automatically in specified circumstances. The most common is a force majeure clause, which suspends the option period during events beyond the producer's control, often including strikes by the entertainment guilds. The writers' and actors' strikes of 2023, which halted most production for months, made these provisions vital: producers whose options would otherwise have expired while no scripts could be written relied on force majeure suspensions to preserve their rights. Owners, for their part, try to cap the total length of any suspension. Another common provision extends the option if the producer is in active preproduction when the period expires, typically on payment of an additional fee. And producers sometimes negotiate for a claims extension, suspending the option period while a third-party claim to the property remains unresolved. Chain of title and the insurer's eye Why do studios care so intensely about the paperwork? Because no film can be financed or distributed without "errors and omissions" insurance, and no E&O insurer will write a policy without a clean chain of title. Chain of title is the documented sequence of transfers by which the producer came to own the rights it is exploiting: the author's original copyright, the option, the exercise, the assignment, the writer's agreements for each draft of the screenplay, and any intermediate transfers among producers or companies. A gap anywhere in this sequence is a potential claim. A distributor's lawyers, a financier's lawyers and the E&O carrier will each review it. They will also typically require a copyright search report and a title report, prepared by specialized research firms, to identify any competing registrations, recorded transfers or conflicting uses of the title. Titles themselves are not protected by copyright, but they can be protected against confusing uses under trademark and unfair competition law, and the Motion Picture Association operates a title registration bureau through which member companies register and resolve disputes over titles. The purchase agreement supports the chain of title with representations and warranties from the owner: that the owner wrote the work, that it is original, that it does not infringe or defame anyone, that the rights have not been granted elsewhere, and that there are no pending claims. The owner indemnifies the producer against losses from any breach. An author with limited resources may resist broad indemnities, and a sensible compromise limits the author's indemnity to matters within the author's knowledge or caps it at the amounts received. What happens when the chain is broken is illustrated by the dispute over Watchmen in 2008. Warner Bros. had spent heavily producing a film adaptation of the celebrated graphic novel. Twentieth Century Fox sued, arguing that it had acquired rights in the property years earlier and that, under a turnaround agreement with the producer Lawrence Gordon, it retained rights that Warner had never cleared. In December 2008 the federal district court in Los Angeles ruled that Fox did hold a copyright interest entitling it to distribution rights. With the film's release weeks away, Warner settled in January 2009, reportedly paying Fox an undisclosed sum and a share of the film's gross. A missing piece of paper from the early 1990s had become a toll on one of the year's largest releases. Turnaround and reversion Many projects die in development. When they do, the question is what happens to the rights, and to the money already spent. In "turnaround," a studio that has abandoned a project gives the producer who brought it to the studio the right to set it up elsewhere for a limited period. The new buyer must reimburse the original studio for its costs, typically the option and purchase payments, writers' fees and overhead, plus interest, and the original studio often keeps a small share of the backend or a passive producer credit. Turnaround terms are negotiated in the producer's original deal, and a producer who fails to secure them may find a project locked in a studio vault indefinitely. The Watchmen dispute arose from precisely such an arrangement. Authors have a parallel concern. If a studio exercises its option and purchases the rights but never makes the film, the rights may sit unused for decades. An author with leverage will negotiate a reversion clause, under which the rights return to the author if production does not commence within a set period after purchase, sometimes on repayment of the purchase price and sometimes without. Studios resist automatic reversion, and the compromise is often a reversion subject to repayment of the studio's direct costs, with the studio keeping a lien on any future production. Writers of original screenplays who are covered by the Writers Guild's Minimum Basic Agreement have a limited reacquisition right under the guild agreement, allowing a writer, after a period during which the studio has not actively developed a purchased original script, to buy it back on specified terms. The right is narrower than many writers assume and must be exercised within strict windows, but it illustrates how collective bargaining can supply terms that an individual writer might not have the leverage to obtain. What the owner should insist on From the owner's side of the table, the lessons of the option can be reduced to a few principles. The purchase agreement must be fully negotiated at the time of the option, because exercise will be unilateral. The grant of rights should be as narrow as the buyer will accept, with reserved rights stated expressly rather than left to implication. Extension payments should not be applicable to the purchase price, and the total option period should be capped, including any force majeure suspensions. Contingent compensation should be tied, where possible, to measurable events such as budget, box office thresholds or episode counts rather than to definitions of profit. And a reversion clause, even an imperfect one, is better than none. From the producer's side, the lessons are the mirror image. Obtain a signed writing before doing any development work. Record the short forms. Calendar the expiry date and extension deadlines and treat them as absolute. Negotiate suspension provisions broad enough to cover strikes and claims. And build the chain of title as though an insurer will read it, because one will. Chapter 3: Life Stories, Ideas and the Rights That Come Back A novel is the easy case. It has an author, a copyright, a publisher's contract that says who owns what, and a finite set of rights that can be optioned and bought. Much of what Hollywood adapts is messier. A producer wants to tell the story of a real person, living or recently dead. A writer pitches a concept in a meeting and, two years later, sees something very like it on a streaming service. A studio has owned a property for forty years and discovers that the author's heirs have served a notice reclaiming it. None of these situations is governed by an ordinary option, and each has produced a distinct body of law. This chapter takes them in turn: the acquisition of "life rights," the law governing the submission of ideas, and the statutory termination rights that allow authors and their families to recover what was sold. What a life rights deal actually buys The phrase "life rights" suggests a property interest, as though a person owned the story of her own life the way an author owns a novel. No such property exists in American law. Facts are not copyrightable, and the events of a person's life, once they are public, are available to anyone who wants to write about them. A producer who acquires "life rights" is buying something else: a bundle of contractual promises that reduce legal risk and provide practical advantages. The first element of the bundle is a release. The subject agrees not to sue the producer for defamation, invasion of privacy, false light, misappropriation of name or likeness, or violation of the right of publicity arising from the production. Dramatized biography invites all of these claims. Screenwriters compress timelines, invent dialogue, create composite characters and assign motives. A release protects the producer against claims arising from those liberties, at least as to the subject who signed it. The second element is access and cooperation. The subject agrees to give interviews, share documents, photographs and letters, and introduce the producer to family and friends. This material is often the difference between a thin story and a rich one, and it is information the producer could not otherwise obtain. The third element is exclusivity. The subject agrees not to cooperate with any competing production. The subject cannot prevent a rival from telling the story from public sources, but the rival will have no interviews and no private documents, and will not be able to promote the production as authorized. The fourth element, sometimes included, is consultation. The subject may be engaged as a consultant, paid a fee, and given the right to review the script and comment. Studios almost never grant a subject approval over the content, since approval would give the subject a veto over the story. Because the release is the core legal protection, it must be drafted broadly and must bind the right people. A subject's spouse, children or business partners may have their own claims, and a release from the subject does not bind them. Producers therefore obtain separate releases from the principal people who will appear on screen, or make them sufficiently fictional to avoid identification. And because the release is a contract, it may be vulnerable if the subject can show that it was procured by fraud or that the producer breached the accompanying promises. When no rights are acquired Many films and series about real people are made without any rights deal at all, and the First Amendment gives filmmakers considerable room to do so. Two cases from California define the modern landscape. In Sarver v. Chartier (2016), an Army sergeant who had served in Iraq claimed that the central character in The Hurt Locker was based on him and that the film misappropriated his life story and likeness. The Ninth Circuit held that the film was speech on a matter of public concern, that California's right of publicity could not constitutionally be applied to restrict it, and that the claim was subject to dismissal under California's anti-SLAPP statute, which allows defendants to strike claims arising from protected speech at an early stage and recover attorney's fees. In De Havilland v. FX Networks, LLC (2018), Olivia de Havilland, then over a hundred years old, sued over her portrayal by Catherine Zeta-Jones in the FX docudrama series Feud: Bette and Joan. She objected to invented dialogue, including a scene in which her character used a vulgar term to describe her sister, and claimed both false light and misappropriation. The California Court of Appeal ordered the claims dismissed under the anti-SLAPP statute. The court reasoned that the right of publicity does not reach expressive works that portray real people, including docudramas, and that de Havilland could not show that the invented material was highly offensive or that it had been published with actual malice. The court treated a docudrama's invented dialogue as a recognized convention that viewers understand, not a factual assertion. The United States Supreme Court declined to hear her appeal. These decisions do not immunize filmmakers. Defamation remains a live risk, particularly when a production presents itself as literally true and makes specific factual claims about identifiable private individuals. In 2024 the Netflix series Baby Reindeer, which opened with the statement that it was a true story, prompted a defamation suit by a Scottish woman who said she had been identified as the model for the stalker at the center of the series. In September of that year a federal court in Los Angeles refused to dismiss her defamation claim, reasoning in part that the series' insistence that it was a true story made its depiction of her actionable as a factual assertion. Similarly, Linda Fairstein, the former Manhattan prosecutor portrayed in the Netflix series When They See Us, sued for defamation; a federal court in New York allowed several of her claims to proceed to trial, and the parties settled on the eve of trial in June 2024, reportedly without any payment to her. The lesson for producers is that the protection the First Amendment gives to dramatization is broad but not unconditional, and it is weakest precisely where the marketing is strongest: in the claim that everything on screen really happened. A rights deal, with its release, remains the most reliable protection for productions that center on living private individuals. For public figures and matters of public record, a careful producer relies on a legal review of the script, annotating each factual assertion to its source, and on disclaimers that accurately describe the degree of dramatization. The law of ideas Copyright protects expression, not ideas. The Copyright Act says so explicitly in section 102(b), which excludes "any idea, procedure, process, system, method of operation, concept, principle, or discovery" from protection. A writer who pitches a concept, "a comedy about an African prince who comes to America to find a bride," say, has no copyright in it. If a studio takes the concept and has someone else write the script, the writer has no copyright claim, unless the studio copied protected expression such as specific dialogue, characters or sequences of events. Yet Hollywood runs on pitches. Writers and producers bring ideas to studios every day, and if studios could take them freely, the market for pitches would collapse. California law fills the gap with contract. The foundational case is Desny v. Wilder (1956). Victor Desny telephoned the office of the director Billy Wilder and described to Wilder's secretary a story based on the real-life entrapment of Floyd Collins, a man trapped in a Kentucky cave in 1925. He later read her a synopsis over the phone and told her that he expected to be paid if the idea were used. Wilder's film Ace in the Hole followed. The California Supreme Court held that although Desny had no property right in the idea, he could recover on an implied-in-fact contract if he could prove that he had disclosed the idea on the condition that he would be paid if it were used, that the recipient knew of the condition and voluntarily accepted the disclosure, and that the recipient then used the idea. The elements of what practitioners call a Desny claim therefore turn on the circumstances of the submission. An unsolicited idea blurted out to a stranger creates no contract, because the recipient had no opportunity to refuse the disclosure. A pitch made in a meeting set up by an agent, in an industry where both sides understand that writers pitch in the expectation of payment, may well create one. The plaintiff must also prove use, typically by showing access and substantial similarity, although a contract claim does not require the similarity to reach protected expression. A persistent question has been whether federal copyright law preempts Desny claims, since they concern the use of material that falls within the general subject matter of copyright. The Ninth Circuit has answered no. In Grosso v. Miramax Film Corp. (2004), involving a claim that the poker film Rounders was based on a screenplay the plaintiff had submitted, the court held that an implied contract claim includes an extra element, the promise to pay, that makes it qualitatively different from a copyright claim. The en banc Ninth Circuit reaffirmed the point in Montz v. Pilgrim Films & Television, Inc. (2011), which concerned a pitch for a reality series about paranormal investigators, holding that the plaintiff's implied contract and confidentiality claims were not preempted and could proceed. New York treats idea claims somewhat differently, requiring some showing that the idea was novel; the Second Circuit held in Nadel v. Play-By-Play Toys & Novelties, Inc. (2000) that for a contract claim, novelty to the buyer can suffice. The industry's response to Desny is procedural. Studios and networks generally refuse to accept unsolicited submissions and return them unopened. Material from writers without agents is accepted only if the writer signs a submission release, a document in which the writer acknowledges that the studio may be developing similar material, that similarity alone does not create liability, and often that any claim is limited in amount or subject to arbitration. These releases have generally been enforced. For writers, the practical protections are to pitch through representatives, to keep contemporaneous records of what was disclosed and to whom, and to register scripts and treatments with the Copyright Office, which establishes a date and permits statutory damages and fees in any later infringement action. Termination: the right to take it back The most powerful right an author holds is one that the author cannot sign away. The Copyright Act of 1976 gave authors and their statutory heirs the right to terminate grants of copyright after a fixed period, notwithstanding any agreement to the contrary. Congress's premise was that authors, particularly early in their careers, sell their work before its value is known, and that they should have a second chance to share in its success. There are two termination regimes. Section 203 applies to grants made by the author on or after January 1, 1978. Such a grant may be terminated during a five-year window beginning thirty-five years after the grant, or, if the grant covers the right of publication, beginning at the earlier of thirty-five years after publication or forty years after the grant. Section 304 applies to works whose copyrights were secured before 1978, allowing termination of grants made before that date during a window that begins fifty-six years after the copyright was secured, with a second opportunity under section 304(d) for those who missed the first. In each case, the author or heirs must serve a written notice on the grantee between two and ten years before the effective date, and record it with the Copyright Office. The formalities are strict, and defective notices have been held invalid. Because grants made in 1978 became terminable in 2013, and grants from the late 1980s are terminable now, the entertainment industry has entered a period in which termination is a live issue for a large part of its catalog. The underlying works that feed film franchises, including novels, short stories, magazine articles, comic books and original screenplays, are all potentially subject to recapture. Two limits confine the right. The first is the exclusion of works made for hire. Termination applies only to grants made by an author, and when a work is made for hire, the employer or commissioning party is the author. Studio screenplays written by writers employed by the studio are works for hire, and so are specially commissioned contributions to motion pictures when the parties have signed a written work-for-hire agreement. This is why the question of whether a work was made for hire is so often the decisive issue in termination litigation. In Marvel Characters, Inc. v. Kirby (2013), the heirs of the comic book artist Jack Kirby served termination notices on Marvel covering characters Kirby had co-created in the late 1950s and early 1960s, including many of the figures at the center of Marvel's film franchise. Because those works predated the 1976 Act, the Second Circuit applied the old "instance and expense" test and held that the works were made for hire: Marvel had assigned the work, paid for it and controlled its publication. The Kirby family petitioned the Supreme Court, and the parties settled in 2014 before the Court decided whether to hear the case. The heirs of another writer fared better. In Horror Inc. v. Miller (2021), the Second Circuit considered Victor Miller's screenplay for the 1980 film Friday the 13th. The producers argued that Miller had written it as an employee, pointing out that he had written it under a Writers Guild agreement that treated writers as employees for guild purposes. The court applied the common-law agency factors that the Supreme Court had set out in Community for Creative Non-Violence v. Reid (1989) and held that Miller was an independent contractor: he wrote at home, with his own tools, was paid a flat fee, received no employee benefits and had no ongoing relationship with the producers. Guild membership did not make him an employee for copyright purposes. His termination was valid, and the domestic rights to the screenplay reverted to him. The second limit is the derivative works exception. A derivative work prepared under a grant before its termination may continue to be exploited under the terms of the grant after termination, but no new derivative works may be made. A studio that produced a film under a license from a novelist may keep distributing the film after the novelist terminates, but it may not make a new sequel or remake based on the novel without a new license. This rule places a premium on timing: a studio facing an effective termination date has every incentive to get a new production underway, or to negotiate a new deal with the author, before the date arrives. The dispute over Top Gun: Maverick shows how these issues interact with ordinary copyright doctrine. The original Top Gun (1986) was based in part on a 1983 magazine article by Ehud Yonay about the Navy's fighter weapons school. Yonay's heirs served a termination notice, effective in 2020, and argued that Paramount's 2022 sequel, released after the termination took effect, was an unlicensed derivative work of the article. The district court granted summary judgment to Paramount, holding that the sequel did not copy protected expression from the article, since the similarities concerned facts and stock elements of the setting, and the Ninth Circuit affirmed in January 2026. The heirs had recaptured their copyright, but the copyright did not cover what the sequel took. Termination returns what the author owned, and a factual article owns less than a novel. The geographic reach of termination became contested in 2026. It had been widely assumed that termination recaptured only United States rights, because the Copyright Act governs rights under United States law, and foreign rights were governed by the laws of each country. In Vetter v. Resnik, involving a songwriter's termination of a grant of rights in a 1960s song, the Fifth Circuit held in January 2026 that termination returned the rights conveyed by the original grant, including rights throughout the world. The decision is in tension with long industry practice and with commentary suggesting that foreign rights remain with the grantee, and it is likely to be tested in other circuits. If it holds, the stakes of termination for film and television rights, whose value is increasingly international, rise substantially. Planning for the return of rights For studios and producers, termination is now a routine element of due diligence. A chain of title review for any property based on a work licensed after 1978 must ask when the grant becomes terminable, whether a notice has been served, whether any exception applies and whether a new deal should be negotiated before the window opens. Because termination cannot be waived by contract, the only reliable solution is a new agreement with the author or heirs after termination rights have vested, or a structure, such as a genuine work-for-hire relationship at the outset, that avoids the issue. For authors and heirs, termination is an asset that must be managed with care. The notice formalities are unforgiving, and service must be made on the right parties within the statutory window. The recaptured rights are subject to the derivative works exception, so their value lies in future adaptations, not in existing ones. And, as the Top Gun litigation demonstrates, recapturing a copyright is not the same as proving that a new work infringes it. Across all three topics in this chapter, the same theme recurs. What a producer can do with a story depends less on what is true, fair or customary than on what was conveyed, in what document, by whom, and when. The paperwork is not a formality around the rights. It is the rights. Hashtags: #EntertainmentLaw #TalentContracts #OptionAgreements #GuildRegulations #EntertainmentIndustry #HollywoodLaw #FilmLaw #TelevisionLaw #MediaLaw #IntellectualPropertyLaw #CopyrightLaw #TalentRepresentation #TalentAgencies #EntertainmentContracts #FilmRights #LiteraryOptions #LifeRights #RightsAcquisition #ChainOfTitle #ContractNegotiation #SAGAFTRA #WritersGuildOfAmerica #DirectorsGuildOfAmerica #CollectiveBargaining #TalentCompensation #ResidualPayments #ProfitParticipation #DigitalReplicaRights #FilmProductionLaw #EntertainmentLegalPractice

Download the Book (PDF): Introduction A good tutor does something that looks effortless and is not. She watches a student work a problem, notices that the student set up the equation correctly but fumbled the sign when moving a term across the equals sign, and decides, in a second or two, that the next thing this student needs is not another equation of the same kind but a short question about why the sign changes. She is not reacting to the last answer alone. She is drawing on a running estimate of what this particular student understands, what he half-understands, and what he only appears to understand because he has memorised a pattern. Then she chooses an action, and the choice is shaped by a theory of how people learn: she would rather make him find the error than point to it. Every serious attempt to build adaptive learning software is an attempt to mechanise those two judgements. The first is diagnostic: what does this learner know right now? The second is pedagogical: given that estimate, what should happen next? For forty years the field has had a good, mathematically clean answer to the first question for well-structured subjects, and a set of workable rules for the second. What it lacked was the tutor's voice: the ability to respond to a student's own words, to ask a question that fits the specific confusion on the screen, to explain the same idea three different ways. Large language models now supply that voice cheaply and at scale. The temptation is to conclude that the voice is the tutor. This booklet argues the opposite. The central claim is simple: an adaptive learning system is only as good as its model of what the learner knows and its discipline about what to do with that model, and a language model's fluency adds value only when it is subordinated to both. An eloquent machine that does not know what the student knows will explain the wrong thing beautifully. An eloquent machine that knows what the student knows but has no pedagogical restraint will hand over the answer, and the student will feel that he has learned when he has not. The evidence for that second failure is no longer speculative; it has been measured in classrooms, and the measurements appear later in these pages. Why the learner model comes first The oldest and most influential learner model in educational technology is Bayesian Knowledge Tracing, introduced by Albert Corbett and John Anderson at Carnegie Mellon in the early 1990s for the tutors that later became Carnegie Learning's Cognitive Tutor. It treats each skill as something a student either has or has not yet acquired, treats each answer as noisy evidence about which state the student is in, and updates a probability after every step. Four numbers govern the whole process: how likely the student was to know the skill at the start, how likely he is to learn it at each opportunity, how likely he is to guess right without knowing it, and how likely he is to slip and get it wrong even though he knows it. With those four numbers and Bayes' rule, a system can say, after each attempt, how confident it is that the student has mastered the skill. That modest machine has been criticised, extended, outperformed on prediction benchmarks by neural networks, and declared obsolete more than once. It is still running, in one form or another, inside commercial products. The reason is not inertia. Its parameters mean something a teacher can understand, its errors can be diagnosed, and its output is a quantity, the probability of mastery, that maps directly onto a decision: keep practising this skill or move on. A great deal of this booklet is about why that last property matters more than a point or two of predictive accuracy. The learner model is also where the hardest technical problems sit. A model has to be fitted to data, and the fitted parameters can be absurd in ways that look fine on a leaderboard. A model has to be told which skills each problem exercises, and that mapping, written by people, is often wrong. A model has to cope with forgetting, with students who game the system, with problems that differ in difficulty, and with the plain fact that a correct answer is weaker evidence than it looks. None of these problems go away when the system acquires a conversational front end. They become more urgent, because the conversation hides them. What the booklet covers The first chapter sets out the problem personalisation is supposed to solve, starting from Benjamin Bloom's famous observation that one-to-one tutoring with mastery learning produced results about two standard deviations above conventional classroom teaching, and from Kurt VanLehn's later finding that much of that advantage can be captured by systems that respond to each step of a student's work rather than only to final answers. It introduces the three components every adaptive system has, whether or not its designers name them: a model of the domain, a model of the learner, and a policy for choosing what to do. The next three chapters are about the learner model. Chapter 2 works through Bayesian Knowledge Tracing step by step, with numbers, so that the reader can see exactly how one wrong answer changes the system's belief. Chapter 3 is about what goes wrong when the model meets real data: parameters that cannot be uniquely identified, fitted values that imply correct answers are evidence of ignorance, and the family of logistic and item-response models that grew up as alternatives. Chapter 4 takes up deep knowledge tracing, the neural-network approach that appeared in 2015 with striking accuracy claims, and the careful re-examinations that followed, which showed how much of the gain came from things simpler models could also capture. Chapter 5 turns to the domain model, the map of skills and prerequisites on which every learner model depends. It covers the Q-matrix that links items to skills, the knowledge-component analysis developed around the Pittsburgh Science of Learning Center, learning curves as a diagnostic tool, and knowledge space theory, the mathematical framework behind the ALEKS system. Chapter 6 asks what to do with an estimate of mastery: when to stop practice, how to detect a student who is spinning his wheels, how to schedule review against forgetting, and how bandit algorithms and reinforcement learning have been used to sequence instruction, with candid attention to how often the fancier methods have failed to beat sensible rules. Chapter 7 is about language models as tutors. It explains what they add, how they fail, and why the Socratic style, asking rather than telling, is not a matter of tone but of what the student's brain is made to do. It examines the controlled studies that now exist, including a large experiment in Turkish high schools in which unrestricted access to a chatbot raised practice scores and then lowered exam scores, and a Harvard physics trial in which a carefully designed tutor outperformed active-learning lessons. It argues for an architecture in which the language model generates dialogue but the learner model and the pedagogical policy decide what the dialogue is for. Chapter 8 deals with evidence and responsibility at scale: how large the effects of adaptive systems really are when evaluated in ordinary schools, why effect sizes from short laboratory studies shrink in the field, how bias enters learner models, and what privacy law and emerging AI regulation require of systems that make inferences about children. What the booklet leaves out The focus is narrow by design. It concentrates on subjects where answers can be scored as right or wrong, chiefly mathematics, early science, language mechanics and similar structured domains, because that is where knowledge tracing is mature and where the evidence is strongest. Essay feedback, automated grading of open writing, learning analytics dashboards for administrators, proctoring and plagiarism detection all deserve their own treatment and receive little here. The booklet also says little about the business of educational technology: procurement, pricing, market consolidation. These matter, but they do not change the central technical question of how a machine should decide what a learner knows and what the learner should do next. A word on audience. The booklet assumes no background in machine learning or statistics beyond comfort with probabilities and a willingness to follow a short calculation. Where an equation is necessary, it is explained in words first and worked through with numbers. Readers who build these systems will find the material on fitting, evaluation and architecture directly useful; readers who buy, deploy or teach with them will find the questions they should be asking vendors; and readers who are simply curious about whether a chatbot can teach their child algebra will find a careful answer, which is: sometimes, under conditions that can be specified, and not in the way most people imagine. Chapter 1: The Problem Personalisation Solves In 1984 the educational psychologist Benjamin Bloom published a short paper in Educational Researcher with a title that has become a slogan: "The 2 Sigma Problem: The Search for Methods of Group Instruction as Effective as One-to-One Tutoring." Bloom summarised dissertation studies by two of his doctoral students at the University of Chicago, Joanne Anania and Arthur Burke, in which students were taught short units of probability and cartography under three conditions. One group received conventional classroom instruction with periodic tests. A second received mastery learning: the same classroom teaching, but with formative tests after each unit, corrective work for those who had not reached a set standard, and a second test before moving on. A third received one-to-one or small-group tutoring combined with the same mastery procedures. The results Bloom reported were dramatic. The average student in the mastery-learning classes scored about one standard deviation above the average conventionally taught student, which places that student around the 84th percentile of the control group. The average tutored student scored about two standard deviations above, around the 98th percentile. Bloom's "problem" was that society could not afford a tutor for every child, so the task was to find group methods that came close. Forty years on, the two-sigma figure is quoted far more often than it is examined. The studies were short, the measures were designed by the researchers, and the tutors were trained in the mastery procedure itself. Later syntheses have found smaller effects. Kurt VanLehn's 2011 review in Educational Psychologist, which pooled controlled comparisons of human tutoring with no tutoring, estimated an average effect of about 0.79 standard deviations, large by the standards of education research but well short of two. A meta-analysis of 96 randomised trials of tutoring programmes by Andre Nickow, Philip Oreopoulos and Vincent Quan, released through the National Bureau of Economic Research in 2020, found a pooled effect of about 0.37 standard deviations, with the strongest results for programmes run by trained teachers or paraprofessionals, delivered frequently during the school day. The shrinkage does not undermine Bloom's point; it sharpens it. Tutoring works, often substantially, and the question for anyone building adaptive software is which parts of what a tutor does produce the gain. If the gain comes from warmth and attention, software will struggle. If it comes from fine-grained diagnosis and immediate, targeted response, software has a chance. What tutors actually do Research on human tutors in the 1990s and 2000s, much of it by Michelene Chi, Arthur Graesser and VanLehn, produced a picture less glamorous than the image of a brilliant Socratic mentor. Most tutors are not experts in pedagogy. They rarely use sophisticated Socratic dialogue. What they do, constantly, is monitor. They watch each step of the student's work, intervene quickly when a step goes wrong, give hints that are often vague at first and become more specific if the student remains stuck, and choose the next problem based on what has just happened. Graesser and colleagues described a recurring five-step dialogue frame in tutoring sessions: the tutor poses a question, the student answers, the tutor gives brief feedback, the two collaborate to improve the answer, and the tutor checks whether the student has understood. VanLehn's 2011 review is the most useful lens on this because it sorted computer tutors by the grain size at which they interact. Answer-based systems look only at the final answer to a problem, as a typical online homework system does. Step-based systems look at each step of a multi-step solution, such as each line of an algebraic derivation or each entry in a physics free-body diagram, and respond to each. Substep-based systems try to engage with the reasoning inside a step, typically through dialogue. VanLehn's headline finding was that the answer-based systems produced an average effect of about 0.31 standard deviations against no tutoring, step-based systems about 0.76, and human tutors about 0.79. Substep systems, in the studies available to him, did not beat step-based ones. The implication VanLehn drew was what he called an interaction plateau: once a system responds at the level of individual steps, making the interaction finer-grained does not seem to add much. Whether that plateau survives the arrival of language models, which interact at the substep level by default, is one of the questions this booklet returns to. For now the point is that a substantial share of tutoring's power appears to come from a tight loop: observe a step, judge it, respond, update an internal picture of the student, choose the next task. That loop is computable. The anatomy of an adaptive system The intelligent tutoring systems literature, going back to Jaime Carbonell's SCHOLAR system of 1970, which conducted a question-and-answer dialogue about South American geography, and consolidated in Etienne Wenger's 1987 book Artificial Intelligence and Tutoring Systems, describes adaptive systems in terms of a few components. The vocabulary varies, but three are essential. The domain model represents what is to be learned. In a simple system it is a list of topics. In a serious one it is a set of knowledge components, the smallest units of skill or concept that can be separately learned and assessed, together with a mapping from each problem or step to the components it exercises and, often, a graph of which components are prerequisites for which. A domain model for fractions might distinguish finding a common denominator, converting a mixed number to an improper fraction and simplifying a result, and record that adding fractions with unlike denominators requires the first. The learner model, also called the student model, represents what a particular learner currently knows. Its inputs are the learner's actions: answers, steps, hint requests, response times. Its outputs are estimates, usually probabilities, of the learner's state on each knowledge component. Knowledge tracing is the name for the family of methods that keep these estimates up to date as evidence arrives. The pedagogical model, sometimes called the tutoring model or instructional policy, decides what to do. It chooses the next problem, decides whether to give a hint and how specific to make it, decides when to declare a skill mastered, and decides when to intervene with an explanation or a worked example. VanLehn, in a 2006 paper on the behaviour of tutoring systems, added a distinction that clarifies how these components interact. The inner loop operates within a single task: the student takes a step, the system gives feedback or a hint, the student takes another step. The outer loop operates between tasks: when the student finishes a problem, the system chooses the next one. Knowledge tracing sits at the junction. Evidence gathered in the inner loop updates the learner model; the learner model drives choices in the outer loop. This decomposition is worth holding onto because the arrival of language models has blurred it. A chatbot tutor that receives a student's message and produces a reply is performing all three functions at once, implicitly, inside a neural network that was not trained to do any of them explicitly. It has some notion of the subject, some impression of what the student seems to know from the conversation so far, and some disposition about how to respond. None of these is inspectable, and none is guaranteed to persist from one session to the next. Much of the argument of this booklet is that the three functions should be separated again, with the language model assigned the part it is best at. The Carnegie Mellon lineage The most influential concrete realisation of this architecture came out of John Anderson's laboratory at Carnegie Mellon University. Anderson's ACT family of cognitive theories, developed from the 1970s onward, holds that skilled performance rests on production rules, condition-action pairs such as "if the goal is to isolate x and there is a term added to x on one side, then subtract that term from both sides." Learning a skill, on this view, means acquiring the right production rules and making them reliable. From that theory came a style of tutor built on model tracing. The system contains a cognitive model, a set of production rules that can solve the problems in the curriculum in all the ways a student might reasonably solve them, together with buggy rules representing common errors. As the student works, the tutor matches each step against the model. If the step matches a correct rule, the tutor stays quiet or confirms. If it matches a buggy rule, the tutor can give a targeted message. If it matches nothing, the tutor flags an error. Hints are generated by asking the model what the next correct step would be. The early tutors in this line taught the LISP programming language and high-school geometry. In the 1990s, Kenneth Koedinger, Anderson and colleagues worked with teachers in Pittsburgh public schools to build an algebra tutor embedded in a full course, reported by Koedinger, Anderson, William Hadley and Mary Mark in 1997 as substantially improving outcomes on problem-solving measures relative to traditional classes. That work became the Cognitive Tutor curriculum, and from 1998 it was commercialised by Carnegie Learning. Model tracing handles the inner loop: step-by-step diagnosis within a problem. It does not, by itself, say how much the student has learned across problems. For that, Albert Corbett and Anderson developed knowledge tracing, published in its standard form in 1994 in User Modeling and User-Adapted Interaction. Each production rule became a knowledge component whose probability of being known was updated after every opportunity to apply it. The tutor used those probabilities in the outer loop, giving students more problems that exercised the rules they had not yet mastered and retiring a rule from practice once its probability crossed a threshold, conventionally 0.95. This pairing, a fine-grained cognitive model for the inner loop and a probabilistic knowledge tracer for the outer loop, defined the field for two decades. ASSISTments, developed at Worcester Polytechnic Institute by Neil and Cristina Heffernan from the early 2000s, took a lighter approach to the domain model, building on teachers' own problem sets with hints and scaffolding questions, but used the same basic idea of tracking each student's performance on each skill and adapting accordingly. ALEKS, developed at the University of California, Irvine from a different mathematical tradition called knowledge space theory, which Chapter 5 describes, arrived at a structurally similar division: a map of the domain, an evolving estimate of the learner's state within it, and a policy for choosing what to teach next. What "personalised" should mean The word personalised is used in educational technology for almost anything. It is applied to a system that lets students choose an avatar, to one that varies the pace at which a fixed sequence of videos unlocks, and to one that maintains a probabilistic estimate of each of several hundred skills and selects every problem accordingly. These are not the same thing, and the differences matter for whether learning improves. A useful working definition follows from the tutoring research. A system personalises instruction in the sense that matters if three conditions hold. First, it maintains an estimate of what the individual learner knows, at a grain size fine enough to distinguish things a student could know independently of each other. Second, it updates that estimate from the learner's own performance, not from demographic proxies or self-report. Third, it changes what the learner does next in response to the estimate, in ways justified by evidence about learning: more practice on what is weak, less on what is secure, review before forgetting sets in, prerequisites before what depends on them. By that definition, many products marketed as adaptive are not. A system that sorts students into three tracks after a placement test and then delivers a fixed sequence within each track adapts once. A system that adjusts difficulty up after a correct answer and down after an error, without an estimate of which skill the error concerned, adapts to noise. A language model that tailors its explanations to the conversation but forgets everything when the session closes adapts in the moment and not across time. Each can be useful. None replicates the diagnostic loop that the tutoring research suggests is doing the work. The definition also exposes a less obvious requirement. Because the estimate drives decisions, its errors have costs, and the costs are asymmetric. If a system concludes too early that a student has mastered a skill, it moves him on to material that depends on that skill, and he struggles for reasons that the system then misattributes to the new material. If it concludes too late, it wastes his time on practice he does not need, which is boring at best and, at worst, teaches him that the system is not paying attention. Both errors are failures of the learner model, and both are invisible unless someone looks at what the model believes and checks it against independent evidence. Three systems, one error A single example shows how much these distinctions matter in practice. A student is solving 3x + 7 = 22 and writes 3x = 29 as his first step. He has added 7 to the right side instead of subtracting it. An answer-based homework system sees nothing until he submits a final answer. If he continues correctly from his error, he will submit x = 29/3, which is marked wrong. He learns that the answer is wrong but not why, and he may conclude that he does not understand division, or fractions, or algebra in general. The system records one incorrect answer on a problem tagged "linear equations." Its picture of him has become slightly worse and no more precise. A step-based tutor in the Cognitive Tutor tradition sees the first line. Its cognitive model recognises the step as matching a buggy rule, applying the inverse operation with the wrong sign, and it can respond at once with a targeted message or a question. It records an incorrect first attempt on a specific knowledge component, something like "isolate the variable term by subtracting a constant from both sides," and lowers its estimate for that component alone. His estimate for division is untouched, because he has not yet had an opportunity to show it. When the problem is finished, the outer loop sees that this one component is weak and chooses a next problem that exercises it again. A general-purpose chatbot, shown the student's work and asked for help, will very likely spot the error and may explain it well. It may also, unless constrained, simply show the correct solution in full. When the conversation ends, nothing persists. Tomorrow, faced with 5x − 4 = 21, the student begins again with a system that has no record of yesterday's sign error and no reason to check whether it recurs. Each system has strengths. The point is that only the second does the full diagnostic loop: it localises the error to a specific skill, updates an estimate of that skill, and lets the estimate shape what happens next. The tutoring research suggests that this loop, not the quality of the explanation in any single exchange, is where much of the learning advantage comes from. The two questions Everything that follows can be organised around the two judgements described at the start of this booklet: the diagnostic question of what the learner knows, and the pedagogical question of what should happen next. The first is a problem of inference under uncertainty. A student's answers are noisy; a correct answer may be a guess, an error may be a slip, and the same skill may be exercised by problems of very different difficulty. The second is a problem of decision-making under uncertainty, with an objective, long-term learning, that is hard to observe and easy to confuse with short-term performance. Both problems are older than machine learning and were partly solved before it. What machine learning offers is the ability to fit models to very large amounts of interaction data, to learn representations that humans did not specify, and, with language models, to generate tutoring dialogue on any topic. What it does not offer, by default, is any guarantee that the representations correspond to knowledge, that the predictions are calibrated enough to drive decisions, or that the dialogue serves learning rather than the appearance of it. The next chapter starts with the simplest serious answer to the diagnostic question, because its very simplicity makes the issues visible. Chapter 2: Bayesian Knowledge Tracing, Step by Step Bayesian Knowledge Tracing rests on a deliberately crude picture of learning. For any single knowledge component, a student is in one of two states: he knows it, or he does not. He cannot be observed directly in either state. What can be observed is his performance each time he has an opportunity to apply the skill: a correct or incorrect first attempt at a step that requires it. Between opportunities, a student who did not know the skill may learn it. A student who knows it stays knowing it. Performance is a noisy reflection of the hidden state: a student who knows the skill usually gets the step right but occasionally slips, and a student who does not know it usually gets it wrong but occasionally guesses correctly. That is the whole model. In the language of statistics it is a hidden Markov model with two hidden states, two possible observations, and a transition that can only go one way. Its appeal lies in how much decision-relevant information it extracts from so little machinery, and in how plainly its assumptions can be read off and argued with. The four parameters The model is governed by four probabilities for each knowledge component. Table 1 sets them out with their conventional names and the question each one answers. Table 1. The four parameters of standard Bayesian Knowledge Tracing. Parameter Usual symbol Question it answers Effect if set too high Prior knowledge P(L0) How likely is a student to know the skill before any practice? Mastery declared too early for weak students Learning (transit) P(T) After each opportunity, how likely is an unlearned skill to become learned? Model assumes fast learning; practice cut short Guess P(G) How likely is a correct answer from a student who does not know the skill? Correct answers count for little; practice prolonged Slip P(S) How likely is an error from a student who does know the skill? Errors count for little; struggling students moved on The first two describe learning; the last two describe measurement. The prior, P(L0), captures the fact that students arrive with different amounts of prior knowledge, though in the standard model it is a single number for the whole population. The learning rate, P(T), captures how much a single opportunity to practise moves the average student; in the standard model it is the same at every opportunity. The guess and slip parameters capture the imperfection of answers as evidence. A multiple-choice item with four options invites a high guess rate; a free-response algebra step invites a low one. A skill that involves tedious arithmetic invites slips even from students who understand it. Each knowledge component gets its own four values, fitted from historical data, as the next chapter discusses. Two components in the same curriculum may have very different profiles. Identifying the slope of a line from two points might have a moderate prior, a high learning rate and a low guess rate. Recognising when a word problem calls for a system of equations might have a low prior, a low learning rate, and a substantial slip rate, because students who can do it in principle still misread problems. The update, in words and numbers At any moment the model holds a single number per skill per student: the current probability that the student knows the skill, written P(Ln) after n opportunities. Each new observation changes that number in two steps. The first step is to interpret the evidence. Suppose the student answers the next step correctly. That could happen in two ways: he knows the skill and did not slip, or he does not know it and guessed. Bayes' rule says the probability that he knows the skill, given the correct answer, is the probability of the first route divided by the total probability of both routes. In symbols, the posterior after a correct answer is P(Ln) times (1 − P(S)), divided by the sum of that same quantity and (1 − P(Ln)) times P(G). If the answer is wrong, the two routes are knowing and slipping, or not knowing and not guessing, and the posterior is P(Ln) times P(S), divided by the sum of that quantity and (1 − P(Ln)) times (1 − P(G)). The second step accounts for the chance to learn. Having attempted the step, and typically having received feedback on it, the student may have acquired the skill if he did not have it already. So the probability for the next opportunity is the posterior plus the remaining probability of not knowing, multiplied by the learning rate: P(Ln+1) equals the posterior plus (1 − posterior) times P(T). The model also makes a prediction before each observation. The probability that the student will answer the next step correctly is P(Ln) times (1 − P(S)), plus (1 − P(Ln)) times P(G). This is the number a knowledge tracing model is usually evaluated on: how well it predicts the next answer. Numbers make the mechanics concrete. Take a skill with a prior of 0.30, a learning rate of 0.10, a guess rate of 0.20 and a slip rate of 0.10. A new student arrives. Before his first attempt the model predicts he will answer correctly with probability 0.30 × 0.90 + 0.70 × 0.20 = 0.41. He answers correctly. The posterior is 0.27 divided by 0.41, about 0.66. Applying the learning step, the estimate for the next opportunity becomes 0.66 plus 0.34 × 0.10, about 0.69. One correct answer has more than doubled the model's confidence, because a correct answer from someone who does not know the skill is fairly unlikely at a guess rate of 0.20. He answers the second step correctly as well. The model had predicted a correct answer with probability about 0.69; the posterior rises to about 0.91 and, after learning, to about 0.92. The model is now fairly confident. Then he gets the third step wrong. The model predicted a correct answer with probability about 0.84, so this is somewhat surprising. Knowing the skill and slipping has probability 0.92 × 0.10, about 0.09; not knowing and failing to guess has probability 0.08 × 0.80, about 0.06. The posterior falls to about 0.59, and after the learning step to about 0.63. A single error has cut the estimate by roughly a third. Notice that it has not sent it back to the start: the two earlier correct answers still count. Two more correct answers follow. The estimate rises to about 0.90 and then to about 0.98. On a conventional mastery threshold of 0.95, the system would now declare the skill mastered and stop giving the student problems that exercise it. Five observations, two of them strong evidence in each direction, have taken the model from 0.30 to 0.98. The walk-through also exposes the model's sensitivity. Had the slip rate been 0.30 rather than 0.10, the error on the third step would have been much weaker evidence of not knowing, and the estimate would have fallen less. Had the guess rate been 0.40, the early correct answers would have been weaker evidence of knowing, and mastery would have taken longer. The parameters are not cosmetic; they encode how much each answer should be believed. Reading two trajectories The same arithmetic shows why a single estimate can hide important differences between students. Imagine a second student on the same skill, with the same parameters, who answers incorrectly on his first three attempts and then correctly on the next three. His estimate begins at 0.30 and falls to about 0.15, 0.12 and 0.12 after the three errors; it would fall further but for the learning step, because the model assumes learning happens at a steady rate per opportunity regardless of success or failure, and so credits him with some chance of having learned from each failed attempt and its feedback. Once he starts answering correctly, the estimate climbs quickly, to about 0.43, then 0.80, then 0.95. The first student and the second student are both declared to have mastered the skill. A teacher looking at their histories would see two very different stories: one student who knew most of it already and made a single error along the way, and another who struggled, perhaps received several hints, and then seemed to get it. The model's estimate of the present state is similar. What it does not record is the path, and the path often carries information a teacher would want, such as whether the second student's sudden success came after a specific explanation, or whether he might be pattern-matching on a run of similar items without understanding why the method works. This is not a defect peculiar to BKT; every model that summarises history into a current state discards information. But it is a reason to keep the raw history available alongside the estimate and to treat a mastery declaration as a decision about practice, not a certificate of understanding. A sensible system also follows up: it schedules a later item on the same skill, in a different context or mixed with other skills, and checks whether the estimate holds. If the second student's success was shallow, that delayed item is where it will show. The assumptions, stated plainly Every model is a simplification, and BKT's simplifications are unusually visible. Five matter most. Knowledge is binary. A student either knows the skill or does not. Partial understanding, fragile understanding and understanding that works only on familiar-looking problems are all forced into one of two boxes. In practice, the probability of knowing partly absorbs this, since a student who sometimes applies the skill correctly will hover at an intermediate estimate, but the model has no way of distinguishing a student who is uncertain from a population in which some students know and others do not. There is no forgetting. Once learned, a skill stays learned. Within a single practice session this is a reasonable approximation. Across weeks it is plainly false, and later extensions add a forgetting parameter, as the next chapter describes. Parameters are the same for every student. The standard model fits one set of four values per skill and applies it to everyone. A student who learns quickly and one who learns slowly receive the same update for the same sequence of answers. Their estimates will diverge because their answers differ, but the model does not learn that one of them is a fast learner and adjust its expectations. Skills are independent. Evidence about one skill tells the model nothing about another. Mastering the addition of fractions with like denominators does not raise the estimate for unlike denominators, even though the two are related. This assumption keeps the model tractable and makes it easy to explain, but it discards information. Each observation maps to one skill. Standard BKT assumes that each step exercises a single knowledge component. Real problem steps often require several. If a step requires both finding a common denominator and simplifying, and the student gets it wrong, which skill is to blame? Practical systems handle this in various ways: updating every skill involved as though the step were evidence for each separately, assigning blame to the skill with the lowest current estimate, or modelling the step as requiring all skills jointly. Each choice has consequences, and none is fully satisfactory. There is also a set of conventions about what counts as an observation. In the Cognitive Tutor tradition, only the first attempt at each step is used; subsequent attempts after feedback are not treated as evidence of prior knowledge, because the student has been told something. A request for a hint before attempting the step is usually scored as incorrect, on the grounds that the student did not demonstrate the skill unaided. These conventions are sensible, but they are design decisions, not facts about the student, and they interact with student behaviour in ways the model does not represent. A student who has discovered that asking for hints quickly gets the answer will generate a stream of "incorrect" observations, keeping his estimates low and his practice long, while learning little. Why such a simple model persists A natural reaction is that a model this crude must have been superseded. In terms of raw predictive accuracy it often has been, as Chapters 3 and 4 explain. Yet BKT, or something close to it, remains embedded in deployed systems, and the reasons are instructive for anyone choosing a learner model. The first reason is that its output is directly actionable. The number the model maintains is an estimate of the probability that the student knows the skill. A threshold on that number is a decision rule. A teacher can understand "the system thinks there is a 95 percent chance she has mastered this" in a way she cannot understand a vector of hidden-unit activations. The second reason is that its parameters can be inspected and argued with. If the fitted guess rate for a skill is 0.45, someone can look at the items for that skill and ask why students who do not know it are answering correctly almost half the time. Perhaps the items are multiple-choice with an obviously wrong distractor. Perhaps the answer can be read off the problem's layout. Perhaps the skill has been defined too broadly. Each diagnosis suggests a fix. A parameter that means something is a tool for improving the curriculum, not just the model. The third reason is that it works with little data. A skill with a few hundred students' worth of attempts can be fitted reasonably. A new student's estimate starts updating from the first answer. There is no need for millions of interactions to learn a representation. The fourth reason is that it fails in ways that can be anticipated. Because the assumptions are explicit, the cases where the model will mislead are predictable: long gaps between sessions (no forgetting), heterogeneous students (no individualisation), skills that build on each other (no transfer), multi-skill steps (credit assignment). A system designer can add guardrails for each. What the model is for It is worth being precise about what BKT is meant to do, because much confusion in later debates arises from evaluating it against a goal it was not designed for. The model was built to drive mastery decisions in a tutor: to decide, for each student and each skill, whether more practice is needed. Its job is to be right about the moment when a student has learned the skill well enough to stop practising it. Predicting whether the next answer will be correct is related to that job but not identical. A model can predict the next answer well by exploiting regularities that have nothing to do with knowledge: a student who has just got three right is likely to get the fourth right, whatever skill it concerns; a student who is rushing late in a session is likely to make errors. Exploiting those regularities improves next-answer prediction without improving, and sometimes while degrading, the estimate of knowledge. Conversely, a model whose estimate of knowledge is excellent might predict individual answers only moderately well, because answers are noisy. This distinction, between predicting performance and estimating knowledge, runs through the rest of the booklet. It is the reason that higher accuracy on a benchmark does not automatically translate into better tutoring, and it is the reason that a language model which can produce a plausible tutoring response is not, by that fact, maintaining a model of what the student knows. The next chapter examines what happens when BKT's four parameters are fitted to real data, and why getting them wrong produces errors that no accuracy metric will flag. Chapter 3: When the Model Lies: Fitting, Identifiability and the Logistic Alternative The four parameters of Bayesian Knowledge Tracing are not handed down; they are estimated from data. For each knowledge component, a system collects the sequences of right and wrong first attempts from many students and searches for the four values that make those sequences most probable. This sounds like routine statistics. It is not, and the ways it goes wrong reveal something general about learner models: a model can fit the data well while telling a false story about the students. Fitting the parameters Three methods dominate. The classical one is expectation-maximisation, specifically the Baum-Welch algorithm for hidden Markov models. It alternates between estimating, for each student at each opportunity, the probability that he was in the known state, given current parameter values, and then re-estimating the parameters given those state probabilities. It converges, but only to a local optimum, and which optimum it reaches depends on where it starts. The second method is brute-force search. Because there are only four parameters, each between zero and one, a system can evaluate every combination on a grid, say at intervals of 0.01, and keep the combination with the best fit. Ryan Baker and colleagues used this approach in several influential studies, partly because it avoids the local-optimum problem and partly because it makes the shape of the fit visible: one can see whether many combinations fit about equally well. The third method is gradient descent on the likelihood, which became more common once knowledge tracing was implemented in the same software frameworks as neural networks. It is fast and flexible but inherits expectation-maximisation's sensitivity to starting values. Whatever the method, practitioners usually constrain the search. A widely used convention in the Cognitive Tutor tradition caps the guess rate at 0.3 and the slip rate at 0.1. The constraints are not arbitrary; they encode a belief about what the parameters should mean, which is exactly what the unconstrained data sometimes fails to respect. The identifiability problem In 2007, Joseph Beck and Kai-min Chang published a paper at the User Modeling conference with a blunt title: "Identifiability: A Fundamental Problem of Student Modeling." Their observation was that quite different combinations of BKT parameters can produce essentially the same predicted pattern of correct and incorrect answers across a population. The intuition is straightforward. Suppose that across all students, the proportion answering correctly rises from about 40 percent on the first opportunity to about 80 percent on the tenth. One story says students arrive knowing little, learn fairly quickly, and rarely guess or slip. Another story says many students arrive already knowing the skill but slip often, and learning is slow. A third combines a moderate prior with a high guess rate. Each story can be tuned to produce a similar curve of average performance. The data, viewed in aggregate, cannot tell them apart. The stories differ enormously in what they imply about knowledge. Under the first, a student with two errors in his first three attempts probably does not know the skill and needs practice. Under the second, he probably does know it and slipped twice. The mastery decision, which is the whole point of the model, flips depending on which story the fitting procedure happened to land on. And standard accuracy metrics will not flag the problem, because all the stories predict next-answer correctness about equally well. A concrete pair makes the danger plain. Model A has a prior of 0.10, a learning rate of 0.20, a guess rate of 0.25 and a slip rate of 0.05: students arrive knowing little, learn steadily, and the main source of noise is lucky guessing. Model B has a prior of 0.30, a learning rate of 0.28, a guess rate of 0.05 and a slip rate of 0.15: more students arrive knowing the skill, they learn faster, guessing is rare, and knowledgeable students make careless errors fairly often. Work out the proportion of students each model expects to answer correctly at each of the first eight opportunities, and the two curves never differ by more than about three percentage points. Model A expects the success rate to climb from about 32 percent to about 82 percent; Model B, from about 29 percent to about 79 percent. With realistic amounts of data, aggregate performance would not separate them. Now take a single student who answers correctly, correctly, then incorrectly, incorrectly. Under Model A, his estimated probability of knowing the skill after those four answers is about 0.23: the early successes were plausibly guesses, the later errors are strong evidence, and he needs more practice. Under Model B it is about 0.93: guessing is rare, so the early successes are strong evidence of knowledge, and the errors are slips. One model would keep him practising; the other would be close to retiring the skill. Nothing in the population-level fit says which is right. Only additional evidence, such as how students who answered this way performed on a delayed test, or how often careless arithmetic errors occur on these specific items, can decide. Beck and Chang proposed using Dirichlet priors, essentially prior beliefs about plausible parameter values, to pull the fit towards interpretable regions. Others have used the bounds described above, or fitted on data with richer structure, such as students who receive no instruction between opportunities, so that learning can be separated from measurement noise. None of these is a complete cure. Identifiability is a property of the model and the data together, and the honest response is to treat fitted parameters as hypotheses to be checked rather than facts. Degenerate models A related failure was named by Ryan Baker, Albert Corbett and Vincent Aleven in a 2008 paper on contextual estimation of guess and slip. They called it model degeneracy: fitted parameters that violate the model's own conceptual assumptions. The clearest case is a fitted model in which a student who does not know the skill is more likely to answer correctly than one who does, that is, where the guess rate exceeds one minus the slip rate. Under such parameters a correct answer is evidence that the student does not know the skill. A short calculation shows the absurdity. Take a prior of 0.50, a learning rate of 0.05, a guess rate of 0.60 and a slip rate of 0.50. A student answers correctly three times in a row. After the first correct answer the probability that he knows the skill falls to about 0.46 before the learning step and 0.48 after it; after the second, to about 0.47; after the third, to about 0.45. Three consecutive successes have made the model less confident that he has learned the skill. Nobody would choose these parameters on purpose. They arise because the fitting procedure is maximising fit to the data, and in some datasets the best-fitting values sit in a degenerate region. This can happen when the items tagged with a skill are a mix of easy ones that most students get right regardless and hard ones that even knowledgeable students miss, so that the skill label is hiding two different things. It can happen when students game the system, producing patterns that look like knowledge collapsing. Baker and colleagues distinguished theoretical degeneracy, where the parameters themselves violate the model's logic, from empirical degeneracy, where the fitted model makes absurd predictions for real response sequences, such as continuing to rate a student as not knowing a skill after a long run of correct answers. A practical audit is not complicated. For every knowledge component, check that one minus the slip rate comfortably exceeds the guess rate, so that correct answers count as evidence of knowing. Check that the learning rate is not so close to zero that the model implies practice is useless, nor so high that a single opportunity is expected to teach most students. Simulate a few response sequences, such as five correct answers in a row, or alternating right and wrong, and confirm that the resulting estimates move in the direction any teacher would expect. Components that fail these checks should be held back from automated mastery decisions until the cause is found. The lesson is general. A learner model's fitted parameters should be audited against the model's intended meaning before the model is allowed to make decisions. A degenerate skill is a signal that something upstream is wrong, usually in how items are mapped to skills, and Chapter 5 returns to that. Extending the model Most of the research on BKT since the mid-2000s has been about relaxing one of the assumptions listed in the previous chapter. Four extensions matter in practice. Contextual guess and slip. Baker, Corbett and Aleven's 2008 paper proposed estimating guess and slip not as fixed numbers for each skill but as functions of the context of each answer: how long the student took, whether he had just requested a hint, how many errors he had made recently. A very fast correct answer after a run of errors looks more like a guess; a wrong answer from a student who has been answering correctly for some time looks more like a slip. Their contextual model predicted post-test performance better than the standard model. Individualisation. Zachary Pardos and Neil Heffernan, in a 2010 paper, showed how to give each student his own prior within a Bayesian-network implementation of knowledge tracing, initialised from his early performance. Michael Yudelson, Kenneth Koedinger and Geoffrey Gordon, in a 2013 study using data from the Cognitive Tutor, compared individualising different parameters and found that student-specific learning rates improved the model more than student-specific priors. That finding is plausible on reflection: students differ not only in where they start but in how quickly practice moves them. Item difficulty. Standard BKT assumes every item for a skill is equally hard. Pardos and Heffernan proposed a variant, often called KT-IDEM, that gives each item its own guess and slip parameters, allowing harder items to count as stronger evidence of knowledge when answered correctly. This requires more data per item, but on large datasets it improves prediction and makes the model's evidence more honest. Forgetting. Adding a parameter for the probability that a known skill becomes unknown between opportunities turns the one-way transition into a two-way one. Several groups have done this, and Mohammad Khajah, Robert Lindsey and Michael Mozer showed in 2016 that adding forgetting, along with a few other simple extensions, closed much of the predictive gap between BKT and deep neural models. Forgetting is best modelled as depending on elapsed time, which the basic Markov structure does not represent; models of spaced practice, discussed in Chapter 6, handle time more naturally. Multiple skills per step. When a step requires two knowledge components, standard BKT has no principled way to apportion blame for an error. One family of extensions treats the step as conjunctive: the student must know every required component to succeed, so the probability of a correct answer is computed from the joint state of all of them, and an error raises suspicion about whichever component the model is least sure of. This is more faithful to the logic of the task but multiplies the computation, and it requires the item-to-skill mapping, discussed in Chapter 5, to be accurate, since a falsely listed component will absorb blame that belongs elsewhere. Each extension makes the model more realistic and more data-hungry. Each also weakens the property that made BKT attractive in the first place: four numbers per skill that anyone can read. A model with item-specific guess and slip, student-specific learning rates and time-dependent forgetting is still interpretable in principle, but in practice it is reviewed by fewer people. The logistic alternative Running alongside BKT is a second tradition that models the probability of a correct answer directly, without hidden knowledge states, as a logistic function of features of the student, the item and the history. Its roots lie in psychometrics, in the item response theory developed for standardised tests, and in the analysis of learning curves. The simplest member is the Rasch model, introduced by the Danish mathematician Georg Rasch in 1960. It says that the log-odds of a correct answer equal the student's ability minus the item's difficulty. It describes a single test sitting and has no notion of learning, but its idea of placing students and items on a common scale is the backbone of computerised adaptive testing. Hao Cen, Kenneth Koedinger and Brian Junker added learning in their 2006 work on Learning Factors Analysis, whose statistical core is now usually called the Additive Factors Model. In this model the log-odds of a correct answer are the sum of a student's proficiency, the easiness of each skill involved, and, for each skill, a learning rate multiplied by the number of prior opportunities the student has had to practise it. Every practice opportunity nudges the odds up by a skill-specific amount. Philip Pavlik, Hao Cen and Kenneth Koedinger refined this in 2009 with Performance Factors Analysis, which counts prior successes and prior failures separately, each with its own coefficient. The change matters because a success and a failure are not equally informative: a student who has succeeded five times is in a different position from one who has failed five times, even though both have had five opportunities. PFA also handles steps involving multiple skills more naturally than BKT, because the contributions simply add up. A related, lighter-weight approach adapts the Elo rating system from chess. Each student and each item has a rating; after each answer both ratings are adjusted according to how surprising the result was. Radek Pelánek's 2016 review in Computers & Education documented its use in adaptive educational systems, where its appeal is that it updates instantly, needs no batch fitting, and handles new items gracefully. Table 2 sets these families side by side. Table 2. Major families of learner models for structured practice. Family Representative work What it tracks Main strength Main weakness Hidden-state (BKT) Corbett and Anderson, 1994 Probability each skill is known Direct mastery estimate; readable Identifiability; no transfer between skills Item response Rasch, 1960 Ability and item difficulty Strong psychometric basis No learning within a session Logistic learning Cen, Koedinger and Junker, 2006; Pavlik, Cen and Koedinger, 2009 Odds of success from practice counts Handles multi-skill items; stable fits No explicit knowledge state Rating-based Pelánek, 2016 (review) Student and item ratings Online updating; simple Coarse; tuning is heuristic Neural sequence Piech and colleagues, 2015 Learned hidden representation Captures complex patterns Opaque; can be poorly calibrated What the comparisons show The logistic family has an awkward lesson for BKT's defenders. In a careful 2020 comparison across nine datasets in the Journal of Educational Data Mining, Théophile Gervet, Kenneth Koedinger, Jeff Schneider and Tom Mitchell found that logistic regression with a well-chosen set of features led on datasets of moderate size or with many interactions per student, deep knowledge tracing led on very large datasets or where precise timing mattered, and Markov-process methods like BKT lagged behind both. That result needs reading carefully. It concerns next-answer prediction. It does not say BKT's mastery decisions are worse, because that was not what was measured. But it removes the excuse that BKT's simplicity is the price of nothing: a logistic model with sensible features is about as easy to interpret, often easier to fit, and predicts better. The deeper lesson concerns what both families share. In each, a model of the learner is a statistical summary of how performance changes with practice, organised around a list of skills that someone specified in advance. The quality of that list, the domain model, bounds the quality of any learner model built on it. Before turning to that list, the next chapter examines the most ambitious attempt to do without it: neural networks that learn their own representation of student knowledge directly from sequences of answers. Hashtags: #EdTechAndAdaptiveLearning #EdTech #AdaptiveLearning #KnowledgeTracing #AITutors #ArtificialIntelligenceInEducation #EducationalTechnology #PersonalizedLearning #IntelligentTutoringSystems #BayesianKnowledgeTracing #DeepKnowledgeTracing #StudentModeling #LearnerModeling #MasteryLearning #AIInEducation #LearningAnalytics #AdaptiveTutoring #SocraticTutoring #AIpoweredEducation #EducationalAI #LearningPersonalization #StudentPerformancePrediction #KnowledgeComponents #LearningScience #InstructionalDesign #ReinforcementLearning #AdaptiveAssessment #DigitalLearning #LearningOptimization #FutureOfEducation

Download the Book (PDF): Introduction There is a particular kind of tired that sleep does not fix. A student wakes after eight hours and feels as if she has not slept at all. She opens her laptop to a reading she chose, for a major she once loved, and feels nothing, or worse, a dull resentment. She reads the same paragraph four times. She tells herself she just needs to push through until the break, and when the break comes she spends it half-asleep on the couch, dreading the first day back. By the second week of the new term she is exactly where she was. That pattern has a name, and it is not laziness, and it is not weakness. It is burnout: a state that researchers have studied for nearly fifty years, first in nurses, social workers and teachers, and later in students, who turn out to be vulnerable to it for many of the same reasons. The word gets used loosely now, as a synonym for being busy or fed up. This book uses it precisely, because the precise version is more useful. Burnout, in the research sense, is a response to prolonged stress that has three recognisable parts: a deep exhaustion, a growing distance or cynicism toward the work, and a fading sense that you are any good at it. Each of those parts points toward a different kind of repair. Why this matters now Students are not imagining the strain. In the Lumina Foundation and Gallup State of Higher Education study, fielded in late 2023, 35 percent of currently enrolled students said they had considered leaving their program in the previous six months. Among those who had, 54 percent named emotional stress as a reason and 43 percent named mental health, ahead of cost and ahead of academic difficulty. The Healthy Minds Study, which surveyed more than 84,000 students across 135 campuses in 2024–2025, found encouraging signs of improvement over the previous three years, yet still recorded that 37 percent of students screened positive for moderate to severe depression and 32 percent for moderate to severe anxiety. Those numbers are not burnout numbers; the large national surveys do not measure burnout directly. But they describe the climate in which it grows. And the research that does measure student burnout shows that it matters for learning, not only for wellbeing. A 2021 meta-analysis pooling 29 studies and more than 100,000 students found that higher burnout was consistently associated with lower academic achievement, and that the strongest link came from the dimension people talk about least: the loss of a sense of efficacy, the feeling that effort no longer produces competence. This is the heart of the problem. The student who is burning out usually responds by trying harder, with more hours and more caffeine and more guilt. The strategy that got her into college, and that works for ordinary stress, is exactly the wrong one for a condition defined by depleted resources. You cannot spend your way out of a bank account that is already overdrawn. What this book argues The central claim here is simple to state and harder to live: academic burnout is a signal of a sustained mismatch between what your studies are demanding and what you have available to meet those demands, and recovery comes from changing that mismatch deliberately, in the right order, rather than from willpower. The order matters. Exhaustion must be addressed with genuine recovery before anything else will work. Only then does it make sense to reduce or restructure the load, and only after that can motivation be rebuilt on firmer ground. Students who try to rediscover their passion while still running on empty usually conclude that the passion is gone for good. Often it is simply buried under fatigue. The chapters follow that logic. Chapter 1 sets out what burnout is and how it is measured in students, using the framework developed by Christina Maslach and colleagues and adapted for university students by Wilmar Schaufeli and his collaborators. Chapter 2 turns to the body and mind: the physical and cognitive signs of severe exhaustion, and the medical causes that can mimic it and should be ruled out. Chapter 3 takes on the question students ask most anxiously, whether what they have is burnout or depression, and sets out clearly when to seek professional help, including crisis help. Chapter 4 explains why students burn out, looking past individual habits to the structure of academic life. Chapter 5 presents what is known about recovery: why some rest restores and some does not, and why sleep sits at the centre of everything. Chapter 6 is practical: how to take a mental health day, or a longer reset, so that it actually works. Chapter 7 covers the academic options that most students never hear about until it is too late, from reduced course loads to incompletes to medical withdrawal, including their financial consequences. Chapter 8 draws on self-determination theory, one of the best-supported accounts of human motivation, to show how interest and drive can be rebuilt. The conclusion argues for a different way of thinking about the whole episode. Who this is for The main reader is a college or university student who suspects something has gone wrong, whether a first-year who hit a wall in November, a senior who cannot face the thesis, or a graduate student years into a program that no longer makes sense. The book is also written for the people around them: parents who see a child fading on video calls, advisers and faculty who notice a strong student go quiet, residence staff and coaches who are often the first to know. Where the advice differs for these readers, the text says so. The student scenarios throughout are illustrative composites, drawn from patterns that are common and well described in the research, not portraits of real individuals. The figures and findings come from published studies and official sources, listed in the Notes. A necessary word, said once: this book offers general information, not individual medical, psychological, legal or financial advice. Burnout overlaps with conditions that need proper assessment, and academic policies differ between institutions. Use what follows to understand your situation and to ask better questions of the people who can see it directly: a doctor, a counsellor, an academic adviser, a financial aid officer. And if at any point you are thinking about ending your life, or you are worried that someone else is, do not wait to finish a chapter. In the United States, you can call or text 988 to reach the 988 Suicide and Crisis Lifeline at any hour. Elsewhere, local emergency numbers and national crisis lines serve the same purpose. Chapter 3 says more about this. A note on what recovery looks like People who have burned out often want to know how long it will take to feel normal again. The honest answer is that it depends on how deep the depletion runs, how long it has been building, and how much of the underlying situation can be changed. Some students recover their footing within a few weeks of real rest and a lighter load. Others need a term away. What is consistent is that recovery is not a return to the exact person you were before. The students who come through burnout well tend to come out with something they did not have going in: a clearer sense of their limits, an early-warning system, and a relationship with their studies that is chosen rather than merely endured. That is the reset this book is about. Not a single dramatic day off, though a day off can help, but a deliberate rebuilding of the conditions under which learning can feel worth doing again. Chapter 1: What Burnout Actually Is Consider a second-year engineering student who, by any outside measure, is doing fine. Her grades dipped slightly last term but remain respectable. She still attends lectures and hands in problem sets. Yet she describes her days as grey and heavy. She is tired in a way that feels structural, as if something load-bearing has cracked. When a lab partner mentions an interesting result, she notices that she does not care, and that not caring frightens her more than the tiredness does. She has started to suspect she was never really suited to engineering and simply fooled everyone, including herself. Each piece of that description corresponds to a component of burnout as researchers define it. Understanding those components is the first practical step, because a vague sense of being "burnt out" leads to vague remedies, while a precise picture tells you where to start. Where the idea came from The term entered psychology in the 1970s. The psychiatrist Herbert Freudenberger used it in 1974 to describe the gradual emotional depletion he observed in volunteers at a free clinic in New York, people who had begun with high commitment and ended exhausted, irritable and detached. Around the same time, the social psychologist Christina Maslach was interviewing workers in human services, such as nurses, social workers, poverty lawyers and police officers, about how they managed the emotional strain of their jobs. She kept hearing about the same trajectory: fatigue, then a protective coldness toward the people they served, then a sense of failure. In 1981 Maslach and Susan Jackson published a questionnaire to measure this experience, the Maslach Burnout Inventory, and it became the most widely used instrument in the field. Their model has three dimensions, and that three-part structure has held up across decades of research and dozens of countries. Maslach and Michael Leiter, reviewing the evidence in 2016, described burnout as a psychological syndrome emerging as a prolonged response to chronic interpersonal stressors on the job, defined by overwhelming exhaustion, feelings of cynicism and detachment from the job, and a sense of ineffectiveness and lack of accomplishment. The World Health Organization adopted essentially the same three dimensions when it included burnout in the eleventh revision of the International Classification of Diseases, announced in 2019. Two details of the WHO definition matter for students. First, the WHO lists burnout as an "occupational phenomenon", a factor that influences health and brings people into contact with health services, not as a medical condition in itself. Second, it describes burnout as resulting from chronic workplace stress "that has not been successfully managed", and states that the term refers specifically to the occupational context and should not be applied to other areas of life. That second point raises a fair question: can students burn out if burnout is defined around work? The research answer is yes, because studying has the structural features that produce burnout in jobs. Students face sustained demands, deadlines they do not set, evaluation by others, limited control over content and pace, and, for many, the pressure of a future that seems to depend on present performance. Schoolwork is work, even when it is unpaid, and for a large share of students it sits on top of paid work as well. Measuring burnout in students In 2002 Wilmar Schaufeli and colleagues adapted the Maslach inventory for university students, producing the Maslach Burnout Inventory–Student Survey, usually shortened to MBI-SS. They tested it with students in Spain, Portugal and the Netherlands and found that the same three-part structure appeared: exhaustion because of study demands, a cynical and detached attitude toward one's studies, and a feeling of incompetence as a student. Items are rated on a frequency scale running from never to every day, so the inventory asks not whether you have ever felt this way but how often. The same study made an important observation. Burnout and engagement, the energetic, absorbed, dedicated state that students experience when studying goes well, behaved as rough opposites. Students who scored high on burnout tended to score low on engagement. Burnout, in other words, is not an extra problem added onto an otherwise normal student life. It is what happens when the energy and meaning that normally drive study drain away. A second instrument, the School Burnout Inventory developed by Katariina Salmela-Aro and colleagues in Finland, uses a similar three-part structure for school and university students: exhaustion at school, cynicism toward the meaning of school, and a sense of inadequacy as a student. Different wording, same underlying shape. Two cautions apply to both instruments. They were designed for research, not for diagnosing individuals, and Maslach herself has repeatedly warned against treating any score as a clinical cutoff. There is no validated line above which a student "has burnout" and below which she does not. The value of the three dimensions for an individual is not a score but a map: which parts of the experience are strongest for you, and which are still intact. The three dimensions, one at a time Table 1 sets out the three dimensions as they tend to appear in student life. The phrases in the third column are illustrative, the sort of thing students report saying to themselves, not items from any questionnaire. Table 1. The three dimensions of burnout as students experience them. Dimension Core experience What you might catch yourself thinking How it shows in study Exhaustion Emotional and physical depletion that rest does not fully restore "I'm tired before the day starts." Rereading without absorbing; hours at the desk with little output Cynicism Distance, detachment or bitterness toward studies "None of this matters anyway." Skipping class, doing the minimum, resenting instructors or peers Reduced efficacy Feeling incompetent or ineffective as a student "I used to be good at this. Maybe I never was." Avoiding hard tasks, not asking questions, giving up quickly Exhaustion is the dimension everyone recognises, and it is the one closest to ordinary stress. It is the sense of being drained, of having nothing left to give. In students it often shows up first as a change in how long things take. A reading that used to take an hour now takes three, not because it is harder but because attention keeps sliding off it. Exhaustion is the central strain component of burnout, and it is usually the first to appear. But exhaustion alone is not burnout. Plenty of students are exhausted at the end of a hard term, rest over the break, and come back ready. What distinguishes burnout is that exhaustion becomes chronic and starts to reshape a person's relationship with the work itself. Cynicism, sometimes called depersonalisation in the original workplace version, is that reshaping. It is a distancing, a withdrawal of emotional investment. Maslach's early interviews suggested that detachment begins as a kind of self-protection: if caring about the work is costing more than you have, caring less is a way to cut costs. The trouble is that detachment also cuts off the things that made the work rewarding. The student who stops caring about her lab results also stops feeling the small satisfaction of getting one right. Cynicism is often the dimension that feels most shameful, because it contradicts the student's picture of herself as someone who loves learning. It is worth saying plainly that cynicism in burnout is usually a symptom of depletion, not a revelation of your true feelings about your field. Reduced efficacy, sometimes called reduced accomplishment or inadequacy, is the erosion of your sense that you are capable. It can come from genuine drops in performance, since exhaustion does reduce output, or from a distorted self-assessment in which recent struggles are read as proof of a fixed lack of ability. This dimension has a particular importance for students. In the 2021 meta-analysis by Daniel Madigan and Thomas Curran, which pooled 29 studies and more than 109,000 students, all three dimensions were associated with lower academic achievement, but the association was strongest for reduced efficacy, with a pooled correlation of about −.39, compared with about −.24 for cynicism and −.15 for exhaustion. The analysis was correlational, so it cannot say which way the effect runs; poor grades can reduce efficacy as easily as low efficacy can reduce grades. What it does suggest is that the sense of competence is tightly bound up with academic outcomes, and that rebuilding it deserves direct attention, a point Chapter 8 returns to. Not all struggling students are burned out One of the more useful developments in burnout research has been the recognition that the three dimensions do not always move together. Leiter and Maslach, analysing large samples of workers, described several distinct profiles. Some people are engaged, with high energy and involvement and a solid sense of efficacy. Some are overextended, high in exhaustion only. Some are disengaged, high in cynicism only. Some are ineffective, low in efficacy only. And some show the full burnout profile, with all three dimensions strongly present. These profiles translate well into student life, and they matter because they call for different responses. The overextended student is running on empty but still cares and still believes she can do the work. She is the classic end-of-term exhaustion case, and she usually responds well to recovery and to trimming the load. Her risk is that the exhaustion, left alone, slides into the other dimensions. The disengaged student has energy but has lost connection with the point of his studies. He may be spending that energy elsewhere, on a job, a relationship, a creative project, and treating classes as an obligation. Rest will not help him much, because he is not depleted. What he needs is a reconsideration of purpose and fit, which is the territory of Chapter 8. The ineffective student has energy and still cares, but has come to doubt her competence, often after a specific setback such as a failed exam or a harsh piece of feedback in a first graduate seminar. She needs evidence of progress and better support for learning the material, not a day off. The student with the full burnout profile needs all of it, in order: recovery first, then structural change, then the slower work of rebuilding meaning and competence. Knowing which profile fits you, even roughly, changes the question from "what is wrong with me?" to "which of my resources has run lowest?" That is a question with answers. Drawing your own map Because the inventories are research tools rather than diagnostic tests, the most useful thing a student can do with the three dimensions is to draw a rough map of her own experience. It takes ten minutes and a sheet of paper. For exhaustion, ask: over the past month, how often have I woken up already tired? Does a full night's sleep or a free weekend restore me, partly restore me, or make no difference? For cynicism, ask: do I still care how my work turns out, or have I started doing the minimum? When I think about my courses, is the main feeling interest, indifference, or resentment? For efficacy, ask: do I still believe that effort leads to learning in my subject? When I get something right, do I count it, or dismiss it as luck? Rate each dimension, informally, as low, moderate or high. The result is not a score but a profile, and the profile tells you where to begin. A student high in exhaustion but still invested in her work needs recovery before anything else. A student whose energy is intact but who no longer sees the point needs to look at purpose and fit. A student who is tired, detached and doubting all at once needs the full sequence this book describes, and probably some outside support to carry it out. Repeating the exercise every few weeks during recovery is also a useful way of noticing change, which in burnout tends to be gradual enough to miss. How burnout develops Burnout rarely arrives suddenly, even when the moment of recognising it is sudden. The usual course runs over months. It often starts with a period of high commitment, such as a demanding first year or the push to qualify for a competitive major, in which a student willingly spends more energy than she recovers. For a while this works. Grades are good, praise comes, and the overspending feels justified. Then the demands continue past the point where the student can sustain them. Sleep is cut first, because it is the easiest thing to cut. Social contact and exercise follow. The student begins to experience the work as something done under pressure rather than chosen, and small detachments creep in: skimming readings, dreading office hours. As performance starts to slip, efficacy wavers. The student responds by working longer, which deepens the exhaustion, which worsens performance, and the cycle tightens. Several features of this course are worth noticing. The first is that the student at the beginning of the cycle is often the most committed, not the least. Burnout has been described as a problem of people who were once on fire, and while that is a slogan rather than a finding, it captures something real: you cannot burn out on something you never invested in. The second is that the early stages are hard to see from the inside, because overspending energy on something you value feels like dedication. The third is that the coping strategy most students reach for, more effort, is precisely the one that accelerates the process. The context around the student Maslach and Leiter's most important contribution may be their insistence that burnout is not primarily an individual weakness. Their research on workplaces identified six areas where a mismatch between person and environment predicts burnout: workload, control, reward, community, fairness and values. Chapter 4 applies this framework to academic life in detail. For now, the essential point is that burnout sits at the meeting point of a person and a situation. This has two implications that pull in slightly different directions. On one hand, it relieves some of the shame. If you are burning out in a program with an unmanageable workload, little flexibility and a culture of competitive overwork, the fault is not simply yours, and many of your peers are likely struggling too, whether or not they show it. On the other hand, it means that individual self-care, while necessary, is not sufficient. A student who adds meditation to an unchanged schedule of 70 hours a week has addressed a symptom. Real recovery usually requires changing something in the situation, even if that change is small. It also has a third implication for the adults around students. Faculty members, advisers and parents are part of the situation. The deadlines they set, the expectations they communicate, the flexibility they offer or withhold, all shape whether a student's demands and resources are in balance. A professor who responds to a request for an extension with curiosity rather than suspicion is, in a small way, part of the treatment. What the definition leaves out A definition is a tool, and this one has limits. Burnout, as measured by the MBI-SS, describes a pattern of experience; it does not explain everything a struggling student is going through. The same student may also have a sleep disorder, a thyroid problem, an anxiety disorder, a learning disability that was never identified, a family crisis at home, or depression. Burnout does not rule any of these out, and some of them are far more treatable once identified. The next two chapters take up those possibilities: first what the body is telling you, and then the difficult question of where burnout ends and depression begins. For now, return to the engineering student at the start of this chapter. Her exhaustion, her detachment from the lab and her creeping doubt about her ability are not three separate problems. They are three faces of one process. And that means her suspicion that she was never suited to engineering, the thought that frightens her most, is itself best understood as a symptom rather than as a verdict. It may turn out to be true. But it is not a judgement she can make well from inside the depletion, and it is not one she needs to make yet. Chapter 2: Reading the Body Burnout is usually discussed as a psychological state, and it is one. But students rarely notice it first as a thought. They notice it in the body: the headache that arrives every afternoon, the cold that lingers for five weeks, the stomach that churns before every seminar, the strange heaviness in the limbs when the alarm goes off. By the time a student can say "I think I'm burning out", her body has often been saying it for months. This chapter is about learning to read those signals accurately. That means two things. It means recognising the physical and cognitive signs that tend to accompany severe, prolonged exhaustion, so that you can take them seriously rather than overriding them. And it means recognising that many of the same signs have other causes, some of them medical and readily treatable, which is why severe fatigue deserves a proper check-up rather than a self-diagnosis. Why stress lives in the body The body's stress response is built for short emergencies. When the brain perceives a threat or a demand, it activates two linked systems: a fast one through the sympathetic nervous system, which raises heart rate and blood pressure and releases adrenaline, and a slower hormonal one, often called the hypothalamic-pituitary-adrenal axis, which releases cortisol. Together they mobilise energy, sharpen attention and prepare the body to act. When the demand passes, the systems are meant to switch off and the body returns to rest, repair and digestion. The problem with chronic academic stress is not that any single deadline is dangerous. It is that the switch rarely turns fully off. A student with three overlapping deadlines, a part-time job and a group project in trouble may spend weeks in a state of low-grade activation. Sleep is shortened and lighter. Meals are irregular. Recovery activities disappear. The systems that were built to turn on for minutes stay partly on for months. The research on workers makes clear that this is not harmless. A 2017 systematic review by Denise Salvagioni and colleagues examined 36 prospective studies, the kind that measure burnout first and then follow people forward to see what happens. Burnout predicted a long list of later physical problems, including prolonged fatigue, headaches, gastrointestinal issues, musculoskeletal pain, respiratory problems and, over longer periods, cardiovascular disease and type 2 diabetes, along with psychological outcomes such as insomnia and depressive symptoms. These were studies of employed adults, mostly older than typical students, and a young body is more forgiving. But the direction of the evidence is unambiguous: sustained burnout is not only a mood. The signs of severe exhaustion The signs fall into three broad groups: what happens in the body, what happens in thinking, and what happens in behaviour. The third group is often the first that other people see. The physical signs The physical signs of burnout are real but not specific. None of them proves burnout, and all of them have other possible causes. What makes them meaningful is the pattern: several appearing together, building over weeks or months, tracking the intensity of academic demands, and failing to lift with ordinary rest. Fatigue that sleep does not fix. This is the signature. Ordinary tiredness responds to a good night's sleep or a quiet weekend. Burnout exhaustion does not, or does so only briefly. Students describe waking already tired, feeling heavy through the day, and experiencing a kind of energy ceiling that no amount of coffee lifts. Disturbed sleep. Paradoxically, the exhausted student often sleeps badly. The common patterns are difficulty falling asleep because the mind will not stop rehearsing tasks, waking in the early hours with a jolt of worry, and unrefreshing sleep even when it is long enough. Many students also drift into irregular schedules, going to bed at 3 a.m. on some nights and 11 p.m. on others, which on its own degrades sleep quality. Frequent illness. Students under chronic stress often report catching every cold that passes through the residence hall and taking longer to shake each one off. The link between chronic stress and immune function is well established in general terms, though the size of the effect varies a great deal between individuals. Headaches and muscle tension. Tension headaches, jaw clenching, and pain in the neck, shoulders and upper back are common, and are worsened by long hours hunched over a laptop. Digestive changes. Nausea, stomach pain, loss of appetite, or the opposite, grazing and cravings, are frequent companions of prolonged stress. Some students develop or notice a worsening of irritable bowel symptoms during heavy academic periods. Changes in appetite and weight. Some students stop eating proper meals because there is no time, or because food has lost its appeal. Others eat more, particularly at night. Either direction can be a stress response, but significant unexplained weight change always deserves medical attention. Physical restlessness or heaviness. Some students feel wired and jittery, unable to sit still, heart racing. Others feel slowed down, as if moving through water. Some alternate between the two within the same day. The cognitive signs The cognitive signs are often the most disturbing for students, because thinking is their work. A student whose mind was her most reliable tool suddenly finds it unreliable. Difficulty concentrating. Attention keeps slipping. The student reads a page and cannot recall a sentence of it. She opens a problem set and finds herself, twenty minutes later, scrolling a phone she does not remember picking up. Memory lapses. Forgetting deadlines, appointments, or what was said in yesterday's lecture. Losing keys and cards more often than usual. Slower processing. Tasks that used to be quick now feel effortful. Writing a simple email takes half an hour. Decisions, even trivial ones like what to eat, feel oddly heavy. Mental fog. A general sense of dullness, as if thinking through cotton wool. These cognitive symptoms are strongly connected to sleep. Sleep deprivation on its own impairs attention, working memory and the consolidation of new learning, and in their review of sleep among college students, Shelley Hershner and Ronald Chervin reported that around half of college students experience daytime sleepiness and some 70 percent get insufficient sleep. For many burned-out students, it is not possible to separate the cognitive effects of burnout from the cognitive effects of chronic short sleep, and in practice it does not matter much, because improving sleep is part of the answer either way. Chapter 5 returns to this. What matters for the student's self-understanding is this: when your brain stops working the way it used to, the most likely explanation is depletion, not a sudden loss of intelligence. Students in burnout often read their cognitive symptoms as evidence that they were never capable, and this feeds directly into the reduced-efficacy dimension described in Chapter 1. It helps to know that the fog is a state, and states change. The behavioural signs Some signs are easier for others to see than for the student herself. Parents, roommates, advisers and friends may notice: · Withdrawal from people and activities the student used to enjoy. · Increasing irritability, or flat, unresponsive affect. · Missed classes or deadlines in a student who was previously reliable. · Rising use of caffeine, energy drinks, alcohol, cannabis or other substances to get through the day or to switch off at night. · Procrastination that looks like avoidance rather than distraction, with the student sitting in front of the work, unable to begin. · Unusually long hours in the library with little to show for them. That last one is easily missed, because it looks like diligence. Burned-out students often spend more time at the desk, not less, precisely because each hour yields so little. A parent who hears "I've been in the library all day" may feel reassured when the more useful question would be "How much actually got done, and how did it feel?" What others can do with what they notice Because the behavioural signs are often more visible from outside, friends, roommates, parents and staff have a real part to play. The difficulty is knowing what to do with what they see. The most useful response is usually the simplest: a specific, private, non-judgemental observation followed by a question. "You've seemed really wiped out the last few weeks, and you've missed a few of our study sessions. How are you doing, honestly?" Naming specific things you have noticed works better than a general "Are you okay?", which invites a reflexive "I'm fine". Listening without rushing to fix is more valuable than advice, at least at first. If the student describes severe or prolonged exhaustion, it is reasonable to encourage a visit to the health service, and to offer practical help in making it happen, such as finding the number or walking over together. Parents can help by taking the medical possibilities in this chapter seriously rather than assuming the problem is stress, and by making sure the student knows how to use her insurance or the campus health service. Staff who notice a pattern of missed work can reach out with concern rather than a warning, and point the student toward the dean of students office or counselling centre. None of this requires expertise. It requires noticing, saying something, and following up. When the cause is not burnout Here is the most practical point in this chapter. Severe, persistent fatigue in a young adult has a range of possible causes, and several of them are common in student populations and treatable. A student who assumes she is burned out, and treats herself accordingly, may spend months resting and adjusting her schedule while an iron deficiency or an underactive thyroid goes untreated. Table 2 lists some physical and cognitive signs, the range of things they can reflect, and when a medical visit makes particular sense. It is a guide to conversation with a clinician, not a diagnostic tool. Table 2. Common signs of severe exhaustion and why they are worth checking. Sign Can reflect burnout, but also See a clinician especially if Fatigue unrelieved by sleep Anaemia, thyroid problems, post-viral fatigue, sleep disorders, depression It lasts more than a few weeks or worsens after exertion Poor or unrefreshing sleep Insomnia, sleep apnoea, delayed sleep timing, anxiety, substance use Loud snoring, gasping at night, or sleepiness while driving Frequent infections Chronic stress, poor sleep, other immune issues Infections are severe, unusual or constant Headaches Tension, eye strain, dehydration, caffeine withdrawal, migraine Sudden, severe, or with fever, stiff neck, vision or speech changes Stomach problems Stress, irregular eating, IBS, food intolerance, other gut conditions There is weight loss, blood, or pain that wakes you at night Brain fog, poor concentration Sleep loss, depression, ADHD, medication effects, low iron It is sudden, severe, or accompanied by other neurological signs Appetite or weight change Stress, depression, disordered eating, thyroid or metabolic issues Change is large, unintended or accompanied by restrictive eating Several possibilities deserve particular mention because they are common in the college years. Iron deficiency, with or without anaemia, is common among people who menstruate, among vegetarians and vegans who are not careful about iron sources, and among endurance athletes. It causes fatigue, poor concentration and reduced exercise tolerance, all of which look like burnout. Thyroid disorders, particularly an underactive thyroid, cause tiredness, low mood, feeling cold and slowed thinking. A simple blood test can check. Infectious mononucleosis and other viral illnesses can leave fatigue that lingers for weeks or longer after the acute illness passes. A student who "never quite recovered" from an illness earlier in the term may be dealing with post-viral fatigue rather than, or as well as, burnout. If exertion reliably makes the fatigue markedly worse a day or two later, a pattern clinicians call post-exertional malaise, that is important to report, because it changes how activity should be approached. Sleep disorders, including obstructive sleep apnoea, which is not limited to older or heavier people, and circadian rhythm problems, in which the body clock is shifted so late that early classes fall in the middle of the student's biological night. Under-fuelling and disordered eating. Students who are not eating enough, whether through lack of time, lack of money, or an eating disorder, will be exhausted. Student athletes are at particular risk of not eating enough for their training load. Food insecurity is also a real problem on many campuses, and a tired student may simply be a hungry one. Substance effects. Heavy caffeine use disturbs sleep. Alcohol sedates at first but fragments sleep later in the night. Regular cannabis use can blunt motivation and energy. Stimulants taken without a prescription to study longer can cause rebound exhaustion and disturbed sleep. None of this is moral judgement; it is simply that these substances interact with fatigue in ways that make the underlying problem worse. Depression and anxiety disorders, which Chapter 3 addresses directly. The practical upshot is straightforward. If severe fatigue has lasted more than a few weeks, see a doctor or nurse practitioner, at the campus health service or elsewhere. Describe the fatigue specifically: when it started, what makes it better or worse, how it affects your days. Mention your sleep, your eating, your substance use and your mood honestly. Ask whether basic blood tests make sense in your case. If everything comes back normal, that is useful information too, because it strengthens the case that what you are dealing with is depletion from sustained stress, and it lets you act on that with confidence. When to get help urgently Some signs call for prompt or emergency care rather than a routine appointment. Seek care right away for chest pain, fainting, a sudden severe headache unlike any you have had, weakness or numbness on one side of the body, difficulty speaking, high fever with a stiff neck, vomiting blood or passing black or bloody stool, or any physical symptom that frightens you. Seek urgent mental health help if you are having thoughts of suicide or self-harm, if you feel unable to keep yourself safe, or if you notice a friend showing those signs. In the United States, calling or texting 988 connects you with the 988 Suicide and Crisis Lifeline; in an immediate emergency, call 911. Chapter 3 says more about recognising these moments. Listening without catastrophising There is a balance to strike. Students who have been ignoring their bodies for months often need permission to take physical signals seriously. At the same time, a student who reads this chapter while exhausted and anxious may start scanning every sensation for disease. Neither extreme helps. A reasonable middle path is to keep a simple record for a week or two: hours slept and how rested you felt, meals eaten, headaches or stomach problems, energy across the day, and what was happening academically. A few lines a day is enough. The point is not to monitor yourself obsessively but to replace a vague sense of being unwell with a picture you can act on and show to a clinician. Patterns tend to jump out. One student finds her headaches cluster on days she skips lunch. Another sees that her worst days follow nights when she studied past 2 a.m. A third notices that her energy has been low every single day for two months regardless of what she does, which is the kind of pattern that belongs in a doctor's office. The body keeps a more honest ledger than the mind. The mind is good at telling a story in which you are fine, or will be fine after the next deadline, or have no right to be tired when others are working harder. The body simply records what it has been asked to do and what it has been given in return. Reading that ledger is the first act of recovery, because it is the moment you stop negotiating with the evidence. Chapter 3: Burnout or Depression? A junior in a pre-medical track has been struggling for most of a semester. She is exhausted, she has stopped caring about her classes, and she feels like a fraud. She has read about burnout and thinks it fits. But lately she has also stopped enjoying the things outside school that used to restore her: the weekly pickup soccer game, calls with her sister, the novels she read on the bus. She is sleeping ten hours on weekends and still waking tired. On a few bad nights she has thought, not in any planned way, that it would be easier not to be here. Is this burnout? Is it depression? Does the label matter? The label matters less than students often fear, and more than they sometimes hope. It matters less because the first steps, recovery, support, reducing the load, and talking to someone qualified, overlap considerably. It matters more because depression is a treatable medical condition with effective treatments, and a student who calls her depression "just burnout" may wait far too long to get them. And the thought she described in passing, that it would be easier not to be here, is a signal that should never be filed under burnout at all. Why the line is blurry The honest scientific position is that burnout and depression overlap substantially, and researchers disagree about how distinct they really are. In 2015 Renzo Bianchi, Irvin Schonfeld and Eric Laurent published a review of the evidence on the burnout–depression overlap in Clinical Psychology Review. They noted that the exhaustion dimension of burnout, which is its core, correlates strongly with depressive symptoms, that the two share many symptoms including fatigue, sleep disturbance, concentration problems and loss of interest, and that people with high burnout scores frequently meet criteria for depression when they are assessed. They argued that the case for treating burnout as a separate condition from depression is weaker than the popular use of the term suggests. Other researchers, including Maslach and Leiter, have maintained that burnout remains a useful distinct concept because it is defined by its link to a specific context and carries different implications for what needs to change. The debate is ongoing and has not been settled. For a student, the practical meaning of that debate is this: you cannot reliably tell burnout from depression on your own by reading a checklist, and neither the concept of burnout nor an online quiz substitutes for an assessment by someone trained to do one. What you can do is notice certain features that point in one direction or the other, and use those observations to decide how urgently to seek help. Features that point one way or the other Table 3 sets out some features that tend to distinguish the two. They are tendencies, not rules, and the two conditions can and often do coexist. Table 3. Burnout and depression: overlapping but not identical. Feature More typical of burnout More typical of depression Scope Tied mainly to studies or work Pervades most areas of life Pleasure outside studies Largely preserved; breaks feel good Reduced or absent even in free time Response to time away Often improves with real rest Often persists despite rest Self-view "I'm failing at this" "I'm worthless" or "I'm a burden" Formal status Occupational phenomenon (WHO ICD-11) Diagnosable mental disorder Scope. The most commonly cited distinction is that burnout is context-specific while depression is pervasive. The burned-out student dreads the library but still lights up at a friend's birthday dinner. The depressed student struggles to feel much at the dinner either. When the flatness has spread beyond the academic context into friendships, hobbies, food, music and the future, depression becomes a much more likely part of the picture. Pleasure. Closely related is the question of anhedonia, the loss of the capacity to feel pleasure or interest. It is one of the two core symptoms of major depression in the standard diagnostic criteria, alongside persistently depressed mood. The pre-medical student in the opening scenario has lost interest in soccer, her sister and reading. That spread is the single most important detail in her story. Response to rest. A burned-out student who takes a genuine break, say a week away with no academic work, usually feels at least some lift, even if the lift fades on return. A depressed student often finds that time away brings no relief, or that unstructured time makes things worse. Self-view. Burnout tends to attack a person's sense of competence in a particular role. Depression tends to attack the sense of worth as a person. "I'm not cut out for this program" is a burnout thought. "Everyone would be better off without me" is not a burnout thought; it is a warning sign. Duration and intensity. The standard diagnostic criteria for a major depressive episode require that at least five of nine specified symptoms, including depressed mood or loss of interest, be present for most of the day, nearly every day, for at least two weeks. Those symptoms include changes in sleep and appetite, fatigue, difficulty concentrating, feelings of worthlessness or excessive guilt, slowed movement or agitation, and recurrent thoughts of death. Many of them overlap with burnout. What the criteria add is the insistence on pervasiveness and near-daily persistence. Where anxiety fits Depression is not the only condition that overlaps with burnout. Anxiety is at least as common among students, and it shares a good deal of territory: poor sleep, difficulty concentrating, irritability, muscle tension, fatigue, and a mind that will not switch off. In the Healthy Minds data cited in the introduction, nearly a third of students screened positive for moderate to severe anxiety. The relationship between anxiety and burnout often runs in a particular direction. A student with a strong tendency to worry spends a great deal of energy on anticipating, checking and rehearsing, energy that is not available for the work itself or for recovery. Over a term, that expenditure can produce exactly the exhaustion that burnout describes. At the same time, the demands that produce burnout, such as high stakes and little control, are themselves powerful triggers for anxiety. The two can build on each other quietly. A few features suggest that anxiety deserves attention in its own right. Worry that is hard to control and spreads across many areas of life, not only academic ones, is one. Panic attacks, sudden surges of intense fear with a racing heart, breathlessness or a sense of doom, are another, and are worth a medical check the first time they occur. So is avoidance that has begun to shape daily life: not opening emails, not checking grades, skipping classes because of dread rather than tiredness. Anxiety disorders, like depression, respond well to treatment, particularly cognitive behavioural approaches, and the same campus services that assess mood can assess anxiety. A student who recognises herself in this description does not have to decide whether her problem is anxiety or burnout before seeking help. She can simply describe what is happening and let a clinician help sort it out. Why the distinction matters for what you do If you are dealing mainly with burnout, the core of the response is to change the relationship between demand and recovery: rest, reduce, restructure, rebuild. This book is largely about that. If you are dealing with depression, whether or not burnout is also present, those steps still help, but they are unlikely to be enough. Depression has well-established treatments, chiefly specific forms of psychotherapy such as cognitive behavioural therapy and behavioural activation, and antidepressant medication in moderate and severe cases, often in combination. One of these, behavioural activation, is particularly relevant here because it works by gradually reintroducing rewarding and meaningful activities, a principle this book draws on in Chapter 8. A meta-analysis by David Ekers and colleagues pooling 26 randomised trials found it clearly more effective than control conditions for depression. But it is delivered as a structured treatment, usually by a trained clinician, and that structure is part of why it works. There is another reason the distinction matters. Depression can make everything in this book harder to do. The student with depression who reads that she should take a mental health day, protect her sleep and reconnect with the parts of her studies that interest her may find that she cannot, and then blame herself for failing at self-care. That self-blame is itself a symptom. If the steps in later chapters feel impossible rather than merely difficult, that is important information, and the right response is to seek professional support rather than try harder. Screening, and what it can and cannot tell you Many campus health and counselling centres use brief screening questionnaires. One of the most common is the nine-item Patient Health Questionnaire, the PHQ-9, which maps onto the diagnostic criteria for depression and asks how often each symptom has bothered you over the past two weeks. It is quick, it is widely validated, and it is the tool behind many of the depression statistics reported in national student surveys. A screening questionnaire is a useful way to start a conversation, not the end of one. A high score means you should talk to a clinician soon; it does not by itself mean you have depression. A low score does not mean you are fine if you still feel unwell. And the final item of the PHQ-9 asks about thoughts that you would be better off dead or of hurting yourself, and any positive answer to that item deserves a conversation with a professional, whatever the total score. When to seek help, and from whom A reasonable rule is to talk to a professional if any of the following apply: · Your low mood, loss of interest, or exhaustion has lasted more than two weeks and extends beyond your studies. · You have tried rest and reducing your load and nothing has lifted. · You are struggling to do basic things such as eating, washing, getting out of bed or attending anything at all. · You are using alcohol or drugs to cope, or your use has increased. · People close to you have said they are worried. · You have any thoughts of death, suicide or self-harm. Where to go depends on your situation. Most colleges and universities have a counselling centre, often free or low-cost to enrolled students, and many offer same-day or urgent appointments for students in distress, even when routine appointments have a waiting list. Campus health services can assess physical causes, as discussed in Chapter 2, and some can prescribe and manage medication. Many institutions also contract with telehealth services that provide counselling outside office hours. Off campus, a primary care doctor is a reasonable first stop and can refer on. Students on a family health insurance plan should check what mental health care is covered. Students are often reluctant to use counselling services because they assume others need them more, or because they fear it will appear on an academic record. Campus counselling is confidential under professional ethics and applicable law, with narrow exceptions such as an imminent risk of serious harm, and counselling records are generally kept separate from academic records. It is reasonable to ask about confidentiality at the start of the first appointment. As for whether others need it more, the Healthy Minds Study found that about 37 percent of students reported receiving therapy or counselling in the past year. Seeking help is a common student experience, not a rare one. Many students put off a first appointment partly because they do not know what will happen in it. Typically, a counsellor or clinician will ask what brought you in, how long things have been difficult, how you are sleeping and eating, how your studies and relationships are going, whether you use alcohol or drugs, and whether you have had any thoughts of harming yourself. You may be asked to complete a short questionnaire. The aim is to understand your situation well enough to suggest a next step, which might be short-term counselling, a group, a referral for longer-term therapy or a medical assessment, help with academic arrangements, or simply a follow-up. You do not need to arrive with the right words or a tidy account. "I've been exhausted and I've stopped caring about things, and I don't know if it's burnout or something else" is a perfectly good opening sentence. When it is urgent Some situations are not about burnout or depression as categories at all. They are about safety. Seek help immediately if you are thinking about suicide, if you have a plan or the means, if you have started to say goodbye to people or give things away, if you feel trapped or unbearably hopeless, or if you are worried you might act on thoughts of harming yourself. The same applies if you notice these signs in someone else, including a friend who talks about wanting to die or being a burden, withdraws abruptly, or behaves in ways that suggest they are putting affairs in order. In the United States, call or text 988 to reach the 988 Suicide and Crisis Lifeline, or use the chat service through its website. It is free, confidential, and available at all hours. Counsellors there are trained to help people in suicidal crisis and emotional distress, and also to help people who are worried about someone else. You do not have to be sure you are "in crisis enough" to call. In Canada, 9-8-8 also connects to a national suicide crisis line. In the United Kingdom and Ireland, Samaritans can be reached on 116 123. Elsewhere, local emergency numbers and national crisis lines serve the same purpose. In immediate danger, call emergency services or go to the nearest emergency department. For friends, parents and staff, the most important thing to know is that asking someone directly whether they are thinking about suicide does not put the idea in their head. It gives them permission to tell the truth. A plain question, "Are you thinking about killing yourself?", asked calmly and followed by listening, is one of the most protective things a worried person can do. If the answer is yes, stay with them or keep them on the line, and connect them to help, whether that is 988, campus crisis services or emergency care. Returning to the pre-medical student What should the student in the opening scenario do? Her exhaustion and cynicism about her studies look like burnout. But the loss of pleasure in soccer, her sister and reading, the oversleeping, and above all the passing thoughts that it would be easier not to be here, all point toward depression, and the last of these means she should talk to someone soon, not after exams. The best next step for her is concrete: call or walk into the campus counselling centre and ask for the earliest available appointment, saying plainly that she has been having thoughts that it would be easier not to be here. If those thoughts become more intense before she is seen, or if she starts to think about how she might act on them, she calls or texts 988 or goes to an emergency department. Alongside that, she tells one trusted person, perhaps her sister, what is going on. None of this requires her to have decided whether what she has is burnout or depression. It requires her to recognise that it has gone beyond what she should manage alone. For many students the answer will turn out to be both: a period of burnout that, left unaddressed, slid into depression, or a depression that made ordinary academic demands feel crushing and produced burnout on top. The two feed each other, and treating one often helps the other. The value of the distinction is not in getting the label right. It is in making sure that a student who needs treatment gets it, and that a student who needs rest is not told she is ill. Hashtags: #CopingWithAcademicBurnout #AcademicBurnout #BurnoutRecovery #StudentMentalHealth #RediscoveringMotivation #AcademicMotivation #BurnoutPrevention #StudentWellbeing #MentalHealthAwareness #StressManagement #AcademicStress #EmotionalExhaustion #StudentSelfCare #MentalHealthReset #OvercomingBurnout #MotivationRecovery #AcademicResilience #StudyLifeBalance #PsychologicalRecovery #SelfDeterminationTheory #IntrinsicMotivation #HealthyStudyHabits #StudentSuccess #EmotionalWellbeing #StressRecovery #MentalHealthSupport #AcademicWellbeing #PersonalGrowth #SelfCompassion #SustainableLearning

Download the Book (PDF): Introduction Every supervised model is a compressed record of human judgment. Somewhere behind a spam filter, a tumour classifier, or a contract-review system sits a set of examples that a person looked at and labeled: this one is spam, this one is malignant, this clause is an indemnity. The model's job is to generalize from those judgments. The data scientist's job, more often than the textbooks admit, is to get enough of them. That second job is where a surprising share of real projects stall. Raw data is usually cheap. A hospital has hundreds of thousands of archived scans; a bank has millions of transactions; a support team has years of tickets. What it does not have is those items labeled by someone qualified to label them. A radiologist's time is billed by the hour. A lawyer reviewing clauses costs more. Even crowdsourced labels for apparently simple tasks become expensive once quality control, adjudication, and rework are counted. The bottleneck in applied machine learning is rarely the algorithm and rarely the compute. It is the number of trustworthy human judgments a team can afford. The default way to spend that budget is to draw a random sample and label it. Random sampling has real virtues. It is simple, it is unbiased, and it produces a training set whose distribution matches the data the model will see. But it is also wasteful in a specific and predictable way. Most randomly drawn examples are easy. Once a model has seen a few hundred obvious spam messages, the next obvious spam message teaches it almost nothing. The annotator spends the same thirty seconds on it as on a genuinely ambiguous case, and the model barely moves. Active learning is the family of methods that tries to stop that waste. Instead of labeling examples at random, the model itself helps choose what gets labeled next. It looks across the pool of unlabeled data, identifies the examples it is least sure about or on which several plausible models disagree, and sends those to a human. The labels come back, the model retrains, and the cycle repeats. The promise is that a model trained on a few thousand carefully chosen examples can match one trained on many times as many random ones. The argument of this book This book makes a single argument, and it is worth stating plainly at the start: active learning is a way of spending a scarce human resource, and it succeeds or fails on whether the whole loop, not just the selection rule, is designed around that resource. The selection rules themselves are not hard to understand. Uncertainty sampling asks the model which examples it is least confident about. Query-by-committee trains several models and asks where they disagree. Both ideas date from the early 1990s, both can be written in a few lines of code, and both work, often impressively, on clean benchmark data. The book explains them carefully, with worked examples, because a practitioner needs to know exactly what each one measures and why. But the history of active learning in practice is full of projects where a correctly implemented query strategy did no better than random sampling, or did worse. The reasons are almost never mathematical errors. They are things like these: the model's confidence scores were badly calibrated, so "least confident" meant something different from "most informative". The batch of examples sent to annotators was full of near-duplicates. The strategy kept selecting garbled, unanswerable inputs that confused the model because they would confuse anyone. The hardest examples took annotators three times as long and produced labels they disagreed about. The labeled set, carefully tuned to one model, turned out to be a poor training set for the next model the team wanted to try. And nobody measured the comparison against random sampling properly, so nobody knew. Each of those failures is about the human side of the loop or the engineering around it. That is why the book spends roughly as much time on annotators, batch design, evaluation, and stopping as it does on acquisition functions. The aim is not to make the reader an active learning researcher. It is to make them someone who can decide whether active learning is worth trying on a given project, run it competently, and tell honestly whether it worked. What the book covers Chapter 1 sets out the economics. It treats a label as a purchase, explains how learning curves show where labels stop paying for themselves, and introduces the three basic settings in which a learner can ask for labels. It also makes the case for random sampling as a serious baseline rather than a straw man. Chapter 2 is about uncertainty sampling, the simplest and most widely used strategy. It works through least-confidence, margin, and entropy measures on concrete numbers, shows where they agree and where they diverge, and explains why calibration matters more than most tutorials suggest. Chapter 3 covers query-by-committee and its modern descendants. It starts from the original idea of shrinking the space of consistent hypotheses, moves through practical committee construction with bagging and ensembles, and arrives at the Bayesian framing of disagreement that underlies methods such as BALD. Chapter 4 is a catalogue of the ways uncertainty-driven selection goes wrong: sampling bias, outliers, redundant batches, cold starts, and class imbalance. For each it describes the remedies that have held up, including density weighting and diversity-aware batch selection. Chapter 5 turns to the people. The examples a model finds most confusing are frequently the ones humans find hardest too, and that has consequences for annotation time, label quality, guideline design, and annotator wellbeing that a selection strategy ignores at its peril. Chapter 6 is about engineering the loop: choosing batch sizes, deciding when to retrain, building the plumbing that connects a model to an annotation tool, and deciding when to stop. Chapter 7 is about measurement. It explains how to run a fair comparison against random sampling, why the labeled set can be less reusable than it looks, and what recent large-scale replication studies have found about how much active learning really buys. Chapter 8 places all of this in the current landscape, where large pretrained models change the starting point. Embeddings from foundation models make cold starts easier and diversity sampling cheaper; language models can propose labels or act as first-pass annotators; and the selection of human preference data for training language models has become an active learning problem in its own right. The conclusion draws the threads together into a practical stance: when to use active learning, what to build, and what to watch. Who this is for The intended reader is a working data scientist or machine learning engineer who knows how to train and evaluate a classifier, is comfortable with probabilities and a little information theory, and is facing a labeling budget that feels too small for the problem. Managers who commission labeling work and annotation leads who run labeling teams will find the chapters on cost, people, and measurement directly relevant even if they skip the equations. The book uses a small amount of notation and an occasional code sketch where an idea is easier to grasp in code than in words. It assumes classification as the main setting, because that is where most active learning practice lives and where the ideas are clearest, but it notes where the same reasoning carries over to sequence labeling, object detection, and regression. A final note on expectations. Active learning is not magic, and the research literature is more mixed about its benefits than enthusiastic blog posts suggest. On some problems it cuts labeling cost by half or more. On others it matches random sampling and adds complexity. The skill this book tries to teach is telling those situations apart before the budget is spent, and building the loop so that, if the method does not help, the team finds out quickly and loses little. Chapter 1: The Economics of a Label Before choosing a query strategy, it helps to be clear about what is being optimized. Active learning is often described as "reducing the number of labels needed", and that description is close enough to be useful but loose enough to mislead. What a team actually wants to reduce is the total cost of reaching a model that is good enough for its purpose. Labels are one part of that cost, usually the largest, but they are not uniform units, and the count of labels is not the same thing as the cost of obtaining them. A label is a purchase Treat each label as a purchase and the questions become concrete. What does one label cost? Who pays it, in what currency, and on what schedule? What does the label buy? The cost side has more components than it first appears. There is the annotator's time on the item itself, which varies enormously with the task: a sentiment judgment on a short product review might take a few seconds, a bounding box around every pedestrian in a street scene a minute or more, a relevance judgment on a long legal document several minutes. There is the cost of quality control, whether that is a second annotator on a sample of items, a full double-annotation scheme, or an expert adjudicating disagreements. There is the overhead of writing and revising guidelines, training annotators, answering their questions, and auditing their output. There is the engineering cost of the annotation tool and the pipeline that feeds it. And in specialist domains there is an opportunity cost: the hour a pathologist spends labeling slides is an hour not spent on patients. The value side is harder to see. A label buys a change in the model, and that change can be large, small, or negative. The first hundred labels on a new problem typically buy enormous improvements. The ten-thousandth label of the most common class buys almost nothing. A mislabeled example can buy a small step backwards. The economic question at the heart of active learning is whether we can predict, before paying, which purchases will be valuable, and buy those first. A simple exercise makes the point. Take a hypothetical document-review task where an annotator labels an item in an average of ninety seconds, ten per cent of items are double-labeled for quality control, and a senior reviewer adjudicates the disagreements, which arise on perhaps one in five double-labeled items and take five minutes each. Add a fixed overhead for guideline writing and annotator training, spread across the project. Even before engineering costs, the effective cost per label is noticeably higher than the ninety seconds of direct work, and it is higher still for the hard items, which take longer to label and are more likely to be disagreed about. The numbers in any real project will differ, but the structure does not: the true cost of a label is the direct time plus a share of everything needed to make that label trustworthy, and that share grows with the item's difficulty. Any honest comparison of labeling strategies must count it. This framing already says something important. If labels are cheap relative to the engineering effort of an active learning system, or if the team only needs a few hundred labels in total, the potential savings are small and the complexity may not be worth it. If labels are expensive, the unlabeled pool is large, and the task is one where most examples are easy, the potential savings are large. Active learning is most attractive exactly where label costs dominate, and that is the situation in medical imaging, legal and regulatory review, scientific annotation, and any domain where qualified annotators are scarce. Learning curves and diminishing returns The most useful single picture of this economy is the learning curve: model performance on a fixed test set plotted against the number of training labels. For most problems the curve rises steeply at first and then flattens. Doubling the labeled set from 100 to 200 examples might add ten points of accuracy; doubling from 10,000 to 20,000 might add one. The exact shape depends on the task, the model, and the data, but the pattern of diminishing returns is close to universal. Diminishing returns are what make active learning possible. If every additional random label were equally valuable, there would be nothing to gain by choosing. The curve flattens because random labels increasingly duplicate information the model already has. A spam filter that has seen five hundred pharmaceutical spam messages is not learning much from the five-hundred-and-first. The hypothesis of active learning is that the flattening is partly an artifact of random selection: that somewhere in the pool are examples that would still produce steep improvements, and a well-chosen query strategy can find them. When active learning works, its effect shows up as a learning curve that sits above the random-sampling curve, reaching a given accuracy with fewer labels. The size of the gap at a target accuracy is the saving. In the classic text-classification experiments of the 1990s and 2000s, savings of several-fold were sometimes reported on benchmark tasks. On modern deep-learning benchmarks the gaps are often smaller, and some careful studies find them close to zero for well-tuned baselines, a point Chapter 7 returns to in detail. The honest summary is that the gap varies from large to nonexistent depending on the problem, and the only way to know is to measure it. Learning curves also discipline the question of how many labels a project needs at all. A team that plots its curve after each round of labeling, even with random sampling, can often see the point at which further labels stop paying for themselves. That point is worth knowing whether or not active learning is used. Many labeling budgets are set by guesswork ("let's do ten thousand") and spent long past the point of meaningful return. The three settings Active learning research distinguishes three settings that differ in how the learner gets access to candidate examples. The distinction matters because it determines which strategies are even possible. Table 1 summarises them. Table 1. The three basic active learning settings. Setting How candidates arise Typical use Main difficulty Membership query synthesis Learner constructs any input it likes Theory, some robotics and science Synthesized inputs may be meaningless to humans Stream-based selective sampling Examples arrive one at a time; learner keeps or discards each Live traffic, sensors, online systems Must decide without seeing the whole pool Pool-based sampling Learner ranks a large fixed pool of unlabeled data Most practical projects Scoring the pool can be expensive The first setting, membership query synthesis, comes from the computational learning theory of the late 1980s, most notably Dana Angluin's work on learning with queries. The learner is allowed to construct any input and ask for its label. That is powerful in theory but frequently useless in practice. An early and often-cited illustration involved neural networks trained to recognise handwritten digits: when the learner synthesised the inputs it wanted labeled, it produced images that were hybrid smudges no human could confidently assign to any digit. The query was informative to the mathematics and meaningless to the annotator. Query synthesis survives in settings where the "annotator" is an experiment or a simulator rather than a person, such as a robot scientist choosing which experiment to run next. The second setting, stream-based selective sampling, assumes examples arrive one at a time and the learner must decide immediately whether to ask for a label or let the example pass. This fits systems that watch live traffic: a fraud model that can flag a small fraction of transactions for manual review, or a content-moderation pipeline that routes some posts to human moderators. The decision rule is usually a threshold on some informativeness score, and the practical difficulty is setting that threshold so that the stream of queries matches the review team's capacity. The third setting, pool-based sampling, is the one most data scientists will actually use and the main subject of this book. The team has a large collection of unlabeled data already sitting in storage. The learner scores every item in the pool, ranks them, and sends the top items to annotators. Then it retrains and scores again. Pool-based sampling can look at the whole pool before choosing, which makes it possible to consider not just how informative each example is but how representative it is and how it relates to the others being chosen. The cost is computational: scoring a pool of millions of items with a large model after every round is not free. The basic loop Pool-based active learning follows a loop that is simple to state: 1. Start with a small labeled set, called the seed set, and a large unlabeled pool. 1. Train a model on the labeled set. 2. Use the model to score every item in the unlabeled pool with an acquisition function, a rule that estimates how useful each item's label would be. 3. Select the highest-scoring items, usually a batch of them, and send them to annotators. 4. Add the returned labels to the labeled set and remove those items from the pool. 5. Repeat from step 2 until the budget is spent or a stopping rule fires. In code, the skeleton is a few lines. A minimal version looks like this: labeled = seed_set pool = unlabeled_items while budget_remaining() and not should_stop(): model = train(labeled) scores = acquisition(model, pool) batch = top_k(pool, scores, k=batch_size) new_labels = annotate(batch) # humans do this part labeled = labeled + new_labels pool = pool - batch Everything interesting in active learning lives in three lines of that sketch. The acquisition function is where uncertainty sampling, query-by-committee, and their relatives live, and Chapters 2 and 3 are about it. The top_k line hides the question of whether the best batch is simply the top-scoring items, which Chapter 4 shows it usually is not. The annotate line hides an entire human operation with its own costs, errors, and limits, which is the subject of Chapter 5. And the loop structure itself raises engineering questions about batch size, retraining frequency, and stopping that Chapter 6 takes up. Random sampling is a serious baseline It would be easy to frame random sampling as the naive approach that active learning improves on. That framing does practitioners a disservice. Random sampling is a strong baseline with properties that active learning gives up, and any decision to abandon it should be made knowing what is lost. First, a random sample is an unbiased sample. The labeled set has the same distribution as the pool, which means the model is trained on data that looks like the data it will be tested on, and any accuracy estimate computed on held-out random labels is honest. Active learning deliberately creates a biased labeled set, over-representing the hard cases. That is the point, but it has consequences for training and evaluation that must be managed. Second, random sampling requires no model in the loop. Labels can be collected in one large batch, in parallel, by as many annotators as the budget allows, with no waiting for retraining. For a team with a hard deadline and a large annotation workforce, the wall-clock advantage of one big random batch can outweigh the label efficiency of a careful sequential process. Third, a randomly labeled set is model-agnostic. If the team switches from a gradient-boosted tree to a transformer six months later, the random set is exactly as useful for the new model as for the old one. An actively selected set was chosen to resolve the uncertainties of a particular model, and there is good evidence, discussed in Chapter 7, that it can be less useful for a different one. Fourth, random sampling is hard to get wrong. Active learning has many moving parts, and each one is a place where a bug or a poor choice can quietly erase the benefit. A team that implements uncertainty sampling with a miscalibrated model, a tiny seed set, and large batches of near-duplicate items may end up with a worse model than random sampling would have produced, and without a proper comparison it may never find out. None of this argues against active learning. It argues for treating random sampling as the thing to beat, measuring against it honestly, and often keeping a random component in the labeling stream even when active selection is used. A common and sensible practice is to label a slice of every batch at random. That slice keeps the labeled set from drifting too far from the true distribution, provides an unbiased evaluation sample, and gives a running comparison against the actively selected items. When the economics favour active learning Putting these considerations together gives a rough test for whether a project is a good candidate. Active learning tends to pay off when most of the following hold: · Labels are expensive per item, because they require experts, careful reading, or complex markup. · The unlabeled pool is much larger than the labeling budget, so there is a real choice about what to label. · Much of the pool is easy or redundant, so random labels would waste effort on examples the model already handles. · The model can be retrained reasonably quickly, so the loop can run several rounds within the project's timeline. · The team expects to use broadly the same kind of model for the foreseeable future, so the labeled set's tie to that model is not a serious liability. · There is a way to measure the outcome against random sampling. It tends not to pay off, or to pay off less, when labels are cheap and fast, when the budget is large relative to the pool, when the data is so varied that almost every example teaches something, when retraining takes days, or when the target is not a single model but a reusable dataset intended for many future models and uses. There is also a class of problems where the goal is not a general-purpose classifier at all but finding a needle in a haystack: locating all the relevant documents in a litigation archive, all the fraudulent claims among millions, all the rare events in years of sensor logs. Here active learning in a modified form has a long and well-documented record. In legal discovery, Gordon Cormack and Maura Grossman's 2014 study of technology-assisted review compared protocols and found that continuous active learning, in which reviewers repeatedly label the documents the model currently ranks as most likely relevant, achieved high recall with substantially less review effort than protocols based on random or uncertainty-based training. That variant is closer to relevance feedback than to classic uncertainty sampling, and it is a useful reminder that the right acquisition function depends on what the labels are for. What follows The rest of this book builds the loop piece by piece. The next two chapters describe the two most important families of acquisition function. Uncertainty sampling asks a single model where it is unsure. Query-by-committee asks several models where they disagree. Both rest on the same intuition: the examples worth paying a human to label are the ones the current model cannot already answer. The chapters after that are about the many ways that intuition, sound as it is, can lead a project astray, and what to do about it. Chapter 2: Uncertainty Sampling The simplest idea in active learning is also the most widely used: ask the model which examples it is least sure about, and label those. If a classifier assigns a probability of 0.99 to "spam" for a message, a human confirming that label adds little. If it assigns 0.51, the label is likely to change something. Uncertainty sampling turns that intuition into a ranking rule. The idea is usually traced to David Lewis and William Gale's 1994 paper on training text classifiers, which showed that selecting documents whose predicted probability of relevance was closest to one half could reach a given level of effectiveness with far fewer labeled documents than random selection on their news-categorization task. Three decades later, uncertainty sampling in one form or another remains the default strategy in most annotation tools that offer active learning at all, and it remains a stubbornly competitive baseline in research comparisons. Understanding it well is the foundation for everything else. Why uncertainty should mean information It is worth pausing on why uncertainty should correspond to usefulness, because the reasoning tells us when the correspondence breaks. Think of a classifier as drawing a boundary through the input space, with examples on one side assigned to one class and examples on the other assigned to the other. The model's confidence is roughly a function of how far an example sits from the boundary. Examples far from the boundary are confidently classified, and their labels almost always agree with the prediction, so learning them barely moves the boundary. Examples near the boundary are exactly where the boundary's position is uncertain. Their labels tell the model which side of the line they belong on, and that pins the line down. The cleanest version of this argument is for a one-dimensional threshold. Suppose the true rule is "positive if x is greater than some unknown t", and we have a pool of points along a line. Labeling at random, we need on the order of 1/ε labels to locate t within a precision ε. Labeling actively, we can do binary search: label the point in the middle of the current uncertain interval, discard the half that the answer rules out, and repeat. That needs on the order of log(1/ε) labels. The gap between those two quantities is exponential, and it is the theoretical prize that drew researchers to active learning in the first place. Real problems are not one-dimensional thresholds, and the exponential gain does not survive in general. But the mechanism is the same. Labels near the boundary resolve ambiguity; labels far from it confirm what is already known. Uncertainty sampling is a heuristic for finding the examples near the boundary. The argument also reveals the assumption doing the work: that the model's uncertainty reflects genuine ambiguity about where the boundary should be. If the model is uncertain about an example for some other reason, because the example is noise, because it lies in a region the model has never seen, or because the model's probabilities are simply badly scaled, then labeling it may not resolve anything useful. Much of Chapter 4 is about those other reasons. Three ways to measure uncertainty For a binary classifier, uncertainty is easy to define: the closer the predicted probability is to 0.5, the more uncertain the model. With more than two classes, there are several reasonable definitions, and they do not always agree. The three standard ones are least confidence, margin, and entropy. Least confidence looks only at the model's top prediction. If the most probable class has probability p₁, the least-confidence score is 1 − p₁. An example where the best guess has probability 0.4 is more uncertain than one where it has probability 0.9. This measure is simple and directly tied to the chance that the model's prediction is wrong, if the probabilities are calibrated. Margin looks at the top two predictions. If the most probable class has probability p₁ and the second most probable has p₂, the margin is p₁ − p₂, and smaller margins mean more uncertainty. The idea, associated with work by Tobias Scheffer and colleagues in 2001, is that the decision most at stake is the choice between the two leading candidates. An example the model splits between "cat" and "dog" is on a meaningful boundary even if the overall confidence is moderate. Entropy uses the whole probability distribution. For class probabilities p₁ through pₖ, the entropy is the negative sum of each pᵢ multiplied by its logarithm. Entropy is highest when the probability is spread evenly across all classes and lowest when it is concentrated on one. It is the information-theoretic measure of how much the model does not know about the label, and it is the natural choice if one wants to treat uncertainty as expected information. For binary classification all three measures produce exactly the same ranking, because they are all monotone functions of how close the single probability is to one half. The differences emerge with three or more classes, and they emerge in a specific way that is easiest to see with numbers. A worked comparison Consider a four-class news classifier with labels Politics, Sport, Business, and Technology, and three unlabeled articles with the following predicted probabilities. Table 2 shows the distributions and the score each measure gives. Table 2. Three uncertainty measures on the same predictions (four-class example; entropy in bits). Article Predicted probabilities (Pol, Spo, Bus, Tec) Least confidence (1 − p₁) Margin (p₁ − p₂) Entropy A 0.50, 0.48, 0.01, 0.01 0.50 0.02 1.14 B 0.40, 0.20, 0.20, 0.20 0.60 0.20 1.92 C 0.30, 0.25, 0.25, 0.20 0.70 0.05 1.99 The values are straightforward to verify. For article A, the top probability is 0.50, so least confidence is 0.50; the top two differ by 0.02; and the entropy is −(0.5 log₂ 0.5 + 0.48 log₂ 0.48 + 2 × 0.01 log₂ 0.01), which comes to about 1.14 bits. For article B the entropy is −(0.4 log₂ 0.4 + 3 × 0.2 log₂ 0.2), about 1.92 bits. For article C it is about 1.99 bits, close to the maximum of 2 bits for four classes. Now look at the rankings. Least confidence says C is most uncertain, then B, then A. Entropy agrees: C, then B, then A. Margin disagrees sharply. It ranks A as by far the most uncertain, because the model is torn almost exactly between Politics and Sport. It ranks C second and B last, because in B the top class leads its nearest rival by a comfortable 0.20. Which ranking is right depends on what kind of uncertainty is worth paying for. Article A is a clean, two-way confusion: perhaps a story about government funding for a stadium, which plausibly belongs to either Politics or Sport. A label here directly teaches the model where the line between those two classes runs. Article C is diffuse confusion: the model has little idea what the article is about. That can mean the article is genuinely informative because it lies in an unexplored region, or it can mean the article is a garbled scrape, a non-English text, or an advertisement that belongs to no class at all. Entropy and least confidence are drawn to diffuse confusion; margin is drawn to sharp two-way confusion. In practice, margin sampling has a good empirical record and is often recommended as the default for multi-class problems, precisely because it targets decision boundaries rather than regions of general ignorance. Entropy is attractive in theory and useful when the label space is small or the classes are genuinely interrelated, but it is more easily seduced by outliers. Least confidence sits between them. None of these is universally best. Benchmark comparisons over the years have found each winning on some datasets and losing on others, and the differences between them are usually smaller than the difference between any of them and a poorly designed batch procedure. Uncertainty sampling for other kinds of model The same idea extends to models that do not produce class probabilities directly. For a support vector machine, the natural uncertainty measure is distance to the separating hyperplane. Simon Tong and Daphne Koller's 2001 work on SVM active learning for text classification selected examples closest to the hyperplane and gave a version-space argument for why that roughly halves the set of consistent classifiers with each query. Their results on text categorization were a strong early demonstration that the approach could work at scale. For sequence labeling tasks such as named-entity recognition, the model produces a label for every token, and uncertainty can be defined over the whole sequence. Common choices include the probability of the single most likely labeling of the sentence, the average token-level entropy, or the margin between the best and second-best labelings. Burr Settles and Mark Craven's 2008 comparison of strategies for sequence labeling found that the choice of aggregation matters: summing token uncertainties biases selection toward long sentences, which take longer to annotate, while averaging removes that bias but can favour short, uninformative sentences. That tension between informativeness and annotation cost is a theme Chapter 5 develops. For object detection, each image contains several predicted boxes with class probabilities, and the image-level score must aggregate them. Taking the maximum box uncertainty, the mean, or the sum each produces different behaviour, again with consequences for annotation cost, because images with many objects take longer to label. For regression, there is no class distribution, and uncertainty is usually represented as predictive variance. Some models, such as Gaussian processes, provide that variance directly. Others need it estimated, typically with the committee or ensemble methods described in the next chapter. The calibration problem All of this rests on the model's probabilities meaning something. If a classifier says 0.6, it should be right about sixty per cent of the time on examples where it says 0.6. A model with that property is said to be calibrated. Many modern models are not. Chuan Guo and colleagues showed in 2017 that deep neural networks of the kind that dominated image classification at the time tended to be overconfident: their top-class probabilities were systematically higher than their actual accuracy, and the problem had grown worse as networks had become deeper and been trained in particular ways. Later work found that calibration varies a great deal by architecture and training regime, with some more recent model families considerably better calibrated, but the general lesson stands. A model's softmax output is not automatically a trustworthy probability. Miscalibration damages uncertainty sampling in two ways. First, it can compress the useful range: if the model is wildly overconfident, almost every example gets a top-class probability above 0.95, and the differences between candidates become tiny and noisy. Second, and more insidiously, miscalibration is not uniform. A model may be well calibrated in regions with plenty of training data and badly overconfident in regions with little. Those sparse regions are exactly where labels would be most useful, and an overconfident model will rank them as certain and never ask about them. Neural networks in particular are known to produce confident predictions far from their training data, which is the opposite of what an active learner needs. There are partial remedies. Temperature scaling, which divides the model's output logits by a single learned constant before the softmax, is cheap and often substantially improves calibration on in-distribution data; it can be fitted on a small held-out labeled set. Label smoothing and some forms of data augmentation during training tend to reduce overconfidence. But the more robust fix is to stop relying on a single model's point estimate of its own uncertainty and to estimate uncertainty from the variation across several models or several stochastic forward passes. That is the subject of the next chapter. A useful habit, regardless of method, is to check calibration before trusting an uncertainty-based strategy. A reliability diagram, or simply a table of predicted confidence bins against observed accuracy on a held-out set, takes minutes to produce. If the model's 0.9 bin is right only 70 per cent of the time, the uncertainty scores need correcting before they are used to spend money. Two kinds of uncertainty A distinction that has become central in modern active learning is between two sources of uncertainty, usually called aleatoric and epistemic. Aleatoric uncertainty is uncertainty in the data itself. Some inputs are genuinely ambiguous: a blurry photograph that could be a wolf or a husky, a one-line review that is sarcastic or sincere depending on context the text does not supply, a medical image where experts would disagree. No amount of additional training data will make the model confident about these, because the information is not in the input. Labeling them adds little to the model and may add noise, because annotators will disagree too. Epistemic uncertainty is uncertainty in the model: it arises because the model has not seen enough data in this region to know the answer, even though a well-informed model would. This kind of uncertainty is reducible. Labeling examples with high epistemic uncertainty is exactly what active learning should be doing. A single model's predicted probability mixes the two. Article C in Table 2 might have a flat distribution because it is genuinely ambiguous (aleatoric) or because the model has never seen articles like it (epistemic), and the probabilities alone cannot tell which. That is a fundamental limitation of plain uncertainty sampling. It treats all uncertainty as equally worth buying, when only one kind can be reduced by buying labels. Separating the two requires some representation of the model's own uncertainty about its parameters, which in practice means comparing several plausible models. When several models trained on the same data all agree that an example is a coin flip, that suggests aleatoric uncertainty. When the models each make confident but conflicting predictions, that suggests epistemic uncertainty: the data does not yet pin down which model is right. This observation is the bridge to query-by-committee. Using uncertainty sampling well Despite these caveats, uncertainty sampling is the right first strategy to try on most problems, for good reasons. It is cheap: one forward pass per pool item. It is simple to implement and to explain to stakeholders. It works with almost any probabilistic model. And in many careful comparisons it performs about as well as far more elaborate methods. Several practical habits make it work better: · Check calibration first, and apply temperature scaling or a similar correction if the model is badly overconfident. · Prefer margin over entropy for multi-class problems unless there is a specific reason to want diffuse uncertainty. · Never take the raw top-k by uncertainty as the batch without checking for redundancy; Chapter 4 explains why and what to do instead. · Mix in a fraction of random samples, both to protect against sampling bias and to keep an unbiased evaluation stream. · Inspect the queries. Read the twenty examples the strategy most wants labeled after each of the first few rounds. If they are mostly junk, duplicates, or inputs no annotator could answer, the strategy is broken, and no amount of metric-watching will reveal that as fast as looking. That last habit deserves emphasis. The simplest diagnostic in active learning is to read what it selects. A data scientist who would never ship a model without looking at its errors will often run an active learning loop for weeks without looking at its queries. The queries are the strategy's output, and they are where its failures first become visible. Chapter 3: Query-by-Committee and Disagreement Uncertainty sampling asks one model where it is unsure. Query-by-committee asks several models where they disagree. The difference sounds small, but it changes what is being measured. A single model's uncertainty mixes ambiguity in the data with ignorance in the model. Disagreement among models that all fit the labeled data equally well is a more direct signal of the second kind: it says that the data seen so far does not yet determine the answer, and a label here would help decide between competing explanations. The original idea: shrinking the version space Query-by-committee was introduced by H. Sebastian Seung, Manfred Opper, and Haim Sompolinsky in 1992, and analysed further by Yoav Freund and colleagues in 1997. The setting was theoretical, but the idea is easy to state without mathematics. Imagine the set of all classifiers of a given kind that are consistent with the labels collected so far. This set is called the version space. At the start, before any labels, it contains every possible classifier. Each label rules some out: a classifier that would have called a spam message legitimate is eliminated once that message is labeled spam. The learner's goal is to shrink the version space until every classifier left in it is close to the truth. The fastest way to shrink a set by asking questions is to ask the questions that split it most evenly. If half the remaining classifiers say an example is positive and half say negative, then whichever label comes back, half the version space is eliminated. If all of them agree, the label eliminates nothing; it was already known. Query-by-committee approximates this ideal by drawing a small committee of classifiers from the version space and querying the examples on which the committee is most evenly split. Freund, Seung, Shamir, and Tishby showed that under certain assumptions about the data distribution and the class of classifiers, this procedure could achieve an exponential reduction in the number of labels needed compared with random sampling, the same kind of gain as binary search on a threshold. The assumptions are strong, and the exact result does not carry over to messy real-world problems, but the guiding principle has proved durable: an informative label is one that discriminates between plausible models. Building a committee in practice The theory assumes one can sample classifiers from the version space. In practice, that is impossible for most model classes, and the committee is built by cheaper means that produce models which are each reasonable given the data but differ from one another. The most common approach is bagging, short for bootstrap aggregating, a method introduced by Leo Breiman in 1996. Each committee member is trained on a bootstrap sample of the labeled set: a sample of the same size drawn with replacement, so that each member sees a slightly different subset with some examples repeated and others missing. Naoki Abe and Hiroshi Mamitsuka proposed using bagging and boosting to build committees for active learning in 1998, and the technique remains a standard choice. Its appeal is that it works with any model and produces diversity that reflects genuine uncertainty about which training examples matter. A second approach uses different model types: a logistic regression, a random forest, and a gradient-boosted tree, say, all trained on the same data. Their disagreements reflect different inductive biases, which can be useful, but they also reflect systematic differences that would not disappear with more data. A random forest and a linear model may disagree on an example forever because one can represent the true boundary and the other cannot. Such a committee can keep querying regions where the disagreement is structural rather than informative. A third approach, now dominant for neural networks, is to use different random initializations or training runs of the same architecture. Balaji Lakshminarayanan and colleagues showed in 2017 that such "deep ensembles", typically five or so independently trained networks, give uncertainty estimates that are well calibrated and that degrade more gracefully on unfamiliar inputs than single-model estimates. For active learning, William Beluch and colleagues reported in 2018 that ensembles outperformed the cheaper Monte Carlo dropout approach on image classification tasks. The cost is obvious: training five networks per round costs five times as much as training one. A fourth approach, and the cheapest for neural networks, is Monte Carlo dropout. Yarin Gal and Zoubin Ghahramani argued in 2016 that a network trained with dropout, a regularization technique that randomly zeroes units during training, can be treated as an approximate Bayesian model if dropout is also left on at prediction time. Running the same input through the network many times with different dropout masks produces a distribution of predictions, and the spread of that distribution is an estimate of the model's uncertainty. Each forward pass is effectively a committee member drawn from an approximate posterior. This costs extra forward passes but no extra training. The size of the committee matters less than one might expect. Even two members can produce a useful disagreement signal, and the original QBC analyses worked with committees as small as two. Practical systems commonly use between three and ten members for trained committees and somewhere in the tens of stochastic passes for Monte Carlo dropout. The returns from larger committees diminish quickly, and the cost rises linearly. Measuring disagreement Once a committee exists, it must be turned into a score. There are three common measures, and they map onto the distinctions drawn in the previous chapter. Vote entropy is the simplest. Each member casts a vote for its predicted class, and the score is the entropy of the vote distribution. If five members vote Sport, Sport, Sport, Politics, Business, the vote distribution is 0.6, 0.2, 0.2, and the entropy is moderate. If they all vote Sport, the entropy is zero. Vote entropy ignores how confident each member is, which is both a strength, since it is robust to miscalibrated probabilities, and a weakness, since it throws away information. Consensus entropy, sometimes called soft vote entropy, averages the members' probability distributions and computes the entropy of the average. This is closer to ordinary uncertainty sampling applied to the ensemble's mean prediction, and it inherits the same tendency to be drawn to diffuse uncertainty. Average Kullback-Leibler divergence to the consensus measures how far each member's distribution is from the average, and takes the mean across members. This was proposed by Andrew McCallum and Kamal Nigam in 1998 for text classification. It is high only when members genuinely disagree, not when they agree that the example is ambiguous. If every member predicts 0.25 for each of four classes, consensus entropy is at its maximum but KL divergence to the consensus is zero, because the members agree perfectly that they do not know. If two members confidently predict Sport and two confidently predict Politics, both measures are high. That last distinction is the practical heart of query-by-committee. Table 3 contrasts two committees on a single example to make it concrete. Table 3. Two committees on one example: agreement about ambiguity versus confident disagreement (two classes, three members). Committee Member predictions for P(positive) Mean prediction Entropy of mean Disagreement among members Agreeing on ambiguity 0.50, 0.52, 0.48 0.50 Maximal (1 bit) Near zero Confidently disagreeing 0.95, 0.05, 0.50 0.50 Maximal (1 bit) High Both committees produce the same averaged prediction, and so plain uncertainty sampling on the average would treat them as equally worth labeling. But they are telling different stories. The first committee has reached a stable view that this example is a coin toss; more labels in the neighbourhood are unlikely to change that, which suggests aleatoric uncertainty. The second committee contains members who each believe they know the answer and contradict one another, which means the data so far has not determined which of them is right. A label there will settle an argument. The Bayesian framing: BALD The intuition in Table 3 has a precise information-theoretic form. In 2011 Neil Houlsby, Ferenc Huszár, Zoubin Ghahramani, and Máté Lengyel proposed Bayesian Active Learning by Disagreement, or BALD. It selects the example whose label carries the most information about the model's parameters, measured as the mutual information between the label and the parameters. That mutual information decomposes neatly into two terms. The first is the entropy of the averaged prediction, which is the total uncertainty about the label. The second is the average of each individual model's prediction entropy, which is the uncertainty that would remain even if we knew which model was correct. Their difference is the part of the uncertainty that comes from not knowing which model is correct: the epistemic part. In symbols, BALD's score is H[mean prediction] minus mean of H[each member's prediction]. Apply this to Table 3. In the first committee, the entropy of the mean is 1 bit and each member's own entropy is also very close to 1 bit, so the difference is close to zero. BALD sees nothing to learn. In the second committee, the entropy of the mean is still 1 bit, but the first two members are highly confident, with entropies of about 0.29 bits each, and the third has 1 bit. Their average is about 0.53 bits, so BALD's score is roughly 0.47 bits. BALD would query this example and skip the first. Yarin Gal, Riashat Islam, and Zoubin Ghahramani combined BALD with Monte Carlo dropout in 2017 to apply it to image classification with convolutional networks, in a paper that helped bring Bayesian active learning into the deep learning mainstream. BALD, in its various approximations, has since become one of the standard strategies against which new methods are compared. BALD has a known weakness that is worth flagging here and treating fully in Chapter 4. When it is used to choose a batch of examples rather than one at a time, it scores each example independently, and the top-scoring examples are often near-duplicates that would each resolve the same disagreement. Andreas Kirsch, Joost van Amersfoort, and Yarin Gal addressed this in 2019 with BatchBALD, which scores a batch by the joint mutual information of all its labels, so that redundant examples add little to the batch's score. The cost is computational, and cheaper approximations have followed. Expected model change and expected error reduction Query-by-committee and BALD are both ways of asking which label would most change the model's beliefs. Two other families take that question more literally, and while they are less often used in practice, knowing them clarifies what the cheaper methods approximate. Expected model change selects the example whose label would change the model's parameters the most. The best-known form, expected gradient length, proposed by Burr Settles, Mark Craven, and Soumya Ray in 2008, computes for each candidate the gradient of the training loss that would result from adding it with each possible label, weights those by the model's predicted probability of each label, and takes the expected length. Large gradients mean large updates. The method is intuitive and works with any gradient-trained model, but it can be fooled by examples with large feature values that produce large gradients without being informative, and computing it for every pool item is expensive for big models. A related modern method, BADGE, introduced by Jordan Ash and colleagues in 2020, uses the gradient with respect to the final layer as a representation that captures both uncertainty and diversity, and is discussed in the next chapter. Expected error reduction goes further still. For each candidate, it imagines adding the example with each possible label, retrains the model, and estimates how much the error on the rest of the pool would fall, weighting by the probability of each label. Nicholas Roy and Andrew McCallum proposed this in 2001. It is the most direct expression of what active learning actually wants, because it optimizes the quantity of interest rather than a proxy. It is also the most expensive by a wide margin, requiring a retraining per candidate per possible label, and it is rarely feasible beyond small models and pools. Seen together, these methods form a ladder of approximations. Expected error reduction asks the real question at enormous cost. Expected model change asks a cheaper question that correlates with it. Query-by-committee and BALD ask how much disagreement among plausible models the label would resolve. Uncertainty sampling asks the cheapest question of all: how unsure is the one model we have. Moving down the ladder trades fidelity for speed, and the remarkable empirical finding of the field is how often the cheap end of the ladder performs nearly as well as the expensive end. Choosing between uncertainty sampling and committees A practitioner deciding between single-model uncertainty and a committee-based method should weigh a few considerations. The first is cost. A committee requires either several trained models, which multiplies training cost, or many stochastic forward passes, which multiplies scoring cost. For a small model retrained in seconds, this is negligible. For a large network that takes hours to train, a five-member ensemble may make each round of the loop impractically slow, and Monte Carlo dropout may be the only affordable route. The second is calibration. If the model is badly calibrated and cannot be fixed, committee methods are more robust, because they rely on variation between members rather than on any one member's absolute probabilities. Vote entropy in particular does not use probabilities at all. The third is the presence of genuinely ambiguous examples. If the data contains a lot of inherent ambiguity, such as noisy user-generated text, borderline medical cases, or low-quality images, plain uncertainty sampling will keep selecting those cases and annotators will keep struggling with them. Disagreement-based scores, and BALD especially, are designed to avoid that trap. The fourth is the downstream use of the ensemble. If the production system will be an ensemble anyway, as many are for accuracy reasons, then committee-based selection costs nothing extra: the committee is already there. In practice, many teams begin with margin-based uncertainty sampling on a single model because it is cheap and simple, check whether the queries look sensible, and move to an ensemble or Monte Carlo dropout with BALD-style scoring if the queries are dominated by ambiguous or junk examples. That progression follows the logic of this chapter: start with the cheapest measure of uncertainty, and pay for a finer one only when the cheap one demonstrably fails to separate learnable confusion from irreducible noise. What disagreement cannot fix Disagreement-based methods are a real improvement over single-model uncertainty in one specific respect: they help distinguish uncertainty that labels can resolve from uncertainty they cannot. They do not, on their own, solve the other problems of selecting examples by informativeness. A committee can disagree vigorously about an outlier that is unrepresentative of anything the model will encounter in production. It can disagree about fifty near-identical examples in the same pocket of the input space. It can fail to disagree about a whole region of the data that no member has ever seen, because all members extrapolate in the same confident direction. And when the labeled set is tiny, the members are so poorly trained that their disagreements are close to random. These are not failures of query-by-committee as such. They are failures of any strategy that ranks examples one at a time by how informative they look to the current models. The next chapter takes them up directly. Hashtags: #ActiveLearning #HumanDataLabeling #DataAnnotation #MachineLearning #ArtificialIntelligence #HumanInTheLoop #DataLabelingOptimization #SupervisedLearning #UncertaintySampling #QueryByCommittee #BayesianActiveLearning #BALD #BatchBALD #AnnotationEfficiency #LabelingCostReduction #DataQuality #TrainingData #LabelEfficiency #HumanAnnotation #ModelUncertainty #EpistemicUncertainty #AleatoricUncertainty #DiversitySampling #PoolBasedSampling #IntelligentDataSelection #AnnotationWorkflows #ModelCalibration #LearningCurves #DataCentricAI #MachineLearningEngineering

Download the Book (PDF): Introduction A public blockchain is an odd machine. Thousands of computers around the world, owned by people who do not know or trust each other, agree on a single shared record of who owns what. They manage this by a brute-force method that would embarrass any engineer working on an ordinary database: every participant checks everything. When a block of transactions arrives, each full node replays every transfer, every contract call, every signature check, and arrives independently at the same result. Nobody is asked to take anyone else's word for anything. That is the source of the system's trustworthiness, and it is also the reason it is slow, expensive, and completely transparent. The slowness follows directly from the method. If every node must redo every computation, the network as a whole can go no faster than a modest computer run by a hobbyist, because the moment you demand more than that, the hobbyists drop out and the network quietly becomes a club of data centres. Ethereum, for most of its life, has processed something on the order of fifteen to thirty transactions per second on its base layer, and in periods of heavy demand a simple token swap has cost tens of dollars in fees. The transparency follows from the same method. If everyone must check everything, everyone must be able to see everything: every balance, every payment, every counterparty, forever. For years these looked like the unavoidable price of decentralisation. You could have a ledger that nobody controls, or you could have one that was fast and private, but not both. This booklet is about the branch of cryptography that broke that bargain. The asymmetry at the centre A zero-knowledge proof is a way for one party, the prover, to convince another, the verifier, that a statement is true without revealing anything beyond the fact of its truth. The classic illustration is a password: I can convince you that I know it without telling it to you. The idea dates from a 1985 paper by Shafi Goldwasser, Silvio Micali and Charles Rackoff, and for two decades it lived almost entirely in theory, admired for its elegance and dismissed as impractical. What changed between roughly 2010 and today is that the proofs became succinct. A modern proof system can take an enormous computation, say the execution of ten thousand Ethereum transactions, and produce a proof a few hundred bytes to a few hundred kilobytes long that anyone can check in milliseconds. The prover does a great deal of work. The verifier does almost none. And the verifier's confidence does not depend on trusting the prover at all; it depends only on mathematics. That asymmetry is the controlling idea of this booklet. The "zero-knowledge" part of the name, the ability to hide information, is real and important, and much of the book is about it. But the property that is actually reshaping blockchains is the other one: that checking a computation can be made exponentially cheaper than doing it. Once that is possible, the old rule that every node must replay everything simply dissolves. A network can let one well-equipped machine do the heavy computation off-chain, publish a short proof, and have every other participant check the proof instead of the work. That is a rollup, and rollups are now the centre of Ethereum's plan for growth. Privacy turns out to be the same trick seen from a different angle. If I can prove that a transaction is valid, that I own the coins I am spending and that I am not spending them twice, without revealing which coins they are, then a public ledger can enforce its rules without exposing its users. Zcash has done this since 2016. Newer systems are trying to do it for general-purpose programs. Scaling and privacy, in other words, are not two separate applications of zero-knowledge proofs that happen to share a name. They are two consequences of a single shift: the replacement of re-execution with verification. Understanding that shift, and what it costs, is the purpose of what follows. What this booklet covers, and what it does not The first two chapters build the foundations without assuming any background in cryptography. Chapter 1 explains what it means to prove something in zero knowledge, using the original interactive protocols and the trick by which interaction was later removed. Chapter 2 explains the step that makes everything else possible: the translation of an arbitrary computer program into a statement about polynomials, and why polynomials are such good material for proofs. Chapters 3 and 4 take the two great families of practical proof systems in turn. zk-SNARKs, the older family, produce tiny proofs but traditionally require a "trusted setup", a ceremony whose secret byproducts must be destroyed. zk-STARKs dispense with the ceremony and rest on nothing but hash functions, at the cost of larger proofs, and have the useful side-effect of resisting quantum computers. The line between the two families has blurred considerably in recent years, and Chapter 4 explains how modern systems mix and nest them. Chapters 5 and 6 turn to scaling. Chapter 5 explains rollups, the difference between the optimistic and validity-proof kinds, the data problem that proofs cannot solve on their own, and the long engineering struggle to prove the Ethereum Virtual Machine itself. Chapter 6 follows the more recent development of general-purpose zero-knowledge virtual machines and the race, which reached a milestone in 2025, to prove entire Ethereum blocks in less time than it takes to produce them, a capability that may eventually change how Ethereum's base layer itself works. Chapter 7 returns to privacy: shielded payments, mixers, private identity, and the political and legal conflict that followed when privacy tools were used by thieves and sanctioned states. Chapter 8 is about failure. Proofs are mathematics, but proof systems are software, written by people, and the history of the field already includes a hidden counterfeiting flaw in a major cryptocurrency, a class of bugs that let attackers forge proofs, and a widespread habit of shipping systems whose "trustless" guarantees are backstopped by a small committee with an override key. The booklet does not attempt a rigorous mathematical treatment. There are excellent textbooks for that, several of which are listed at the end. Nor does it survey every project in a crowded and fast-moving industry. Names of protocols and companies appear where they illustrate a mechanism or a turning point, not to rank them. Where figures are given, they come from public sources and are offered as orders of magnitude; in a field where proving costs have been falling by factors of ten in a year or two, any precise number has a short shelf life. Who this is for The intended reader is intelligent and curious but not a cryptographer: a developer who has used Ethereum but never looked under the hood of a rollup, an investor or policymaker who keeps hearing "ZK" and wants to know what is actually being claimed, a student deciding whether the field is worth entering. The mathematics is explained in words, step by step, and the few technical terms that cannot be avoided are defined where they first appear. The aim is not to make the reader capable of building a proof system. It is to make them capable of understanding what one does, judging the claims made for it, and recognising where its guarantees end. That last point matters more than it might seem. Zero-knowledge proofs are sometimes presented as a kind of magic, a way to get trust for free. They are not. They move trust from one place to another: away from the honesty of the people running a computation, and towards the soundness of the mathematics, the correctness of the code, and the integrity of whatever setup or governance surrounds them. A reader who finishes this booklet should know exactly where that trust has gone. Chapter 1: Proving Without Telling Mathematicians have always known what a proof is. It is a sequence of statements, each following from the last by accepted rules, that ends in the thing to be proved. You write it down, hand it over, and the reader checks every step. If the steps hold, the reader is convinced, and the reader is convinced in a way that does not depend on trusting you. The proof carries its own authority. This kind of proof has a property so obvious that for a long time nobody thought of it as a property at all: it reveals its reasoning. If I prove to you that a large number is not prime by showing you two factors that multiply to give it, you now know the factors. If I prove that a Sudoku puzzle has a solution by handing you a filled-in grid, you now have the solution. The proof and the knowledge are inseparable, because the proof is the knowledge, written out. In the early 1980s three researchers at MIT asked whether that had to be so. Shafi Goldwasser, Silvio Micali and Charles Rackoff were working on the foundations of cryptography, and they were interested in a question that sounds almost philosophical: how much knowledge does a proof convey? Their paper, The Knowledge Complexity of Interactive Proof Systems, circulated from 1985 and was published in its final form in 1989. It introduced two ideas that would eventually underpin a large part of modern blockchain engineering. The first was that a proof could be a conversation rather than a document. The second was that such a conversation could convince the listener of a fact while teaching them nothing else at all. Goldwasser and Micali later received the Turing Award, in part for this work. Proof as a conversation Imagine a prover and a verifier. The prover claims some statement is true. Rather than writing out a static proof, the prover agrees to answer questions. The verifier asks something chosen at random; the prover responds; the verifier checks the response; and they repeat. At the end, the verifier either accepts or rejects. Two things are required of such a protocol for it to count as a proof. The first is completeness: if the statement is true and the prover is honest, the verifier will accept. The second is soundness: if the statement is false, no prover, however clever and however dishonest, can make the verifier accept, except with some tiny probability. That probability is the crucial concession. An interactive proof does not deliver absolute certainty in the way a written theorem does. It delivers certainty up to a margin of error that can be driven as low as one likes by asking more questions. One chance in two to the power of 128 is a typical target, a number so small that the probability of being fooled is dwarfed by the probability of the verifier's computer being struck by a meteorite during the calculation. The randomness is what makes this work. A prover who is lying can perhaps prepare an answer to any one question in advance, but cannot prepare answers to all possible questions, because if they could, the statement would actually be true. Each random question is a chance to catch the liar out, and each round in which the liar survives by luck halves their remaining chance of surviving the next. The children's version of this, popularised in a 1989 paper by Jean-Jacques Quisquater and colleagues titled How to Explain Zero-Knowledge Protocols to Your Children, involves a circular cave. The entrance leads to a fork; the left and right passages curve round and meet at the back, where a door blocks the way. The door opens only with a secret word. Peggy, the prover, claims to know the word. Victor, the verifier, waits outside while Peggy walks in and takes one passage or the other, at random. Victor then steps up to the fork and shouts which side he wants her to come out of. If Peggy knows the word, she can always comply, opening the door if necessary. If she does not, she can comply only if she happened to pick the right side to begin with, which she will do half the time. After twenty rounds a fraudulent Peggy has roughly one chance in a million of having got lucky every time. And here is the remarkable part. At the end of all this, Victor is convinced that Peggy knows the word, but he does not know the word himself. He has watched her emerge from the requested side twenty times. That is all he has seen, and it contains no information about the secret. What "zero knowledge" actually means The cave captures the intuition, but intuitions about information are slippery, and Goldwasser, Micali and Rackoff's real contribution was to make the notion precise. Their definition is subtle and worth understanding, because every later system inherits it. The question is how to say formally that a verifier "learned nothing". Their answer was to use a thought experiment called a simulator. Suppose that, without access to the prover or the secret, someone could produce a transcript of a conversation that is indistinguishable from a real one. Then the real conversation cannot have taught the verifier anything, because anything the verifier could have computed from the real transcript, it could have computed equally well from the fake one, which it could have made by itself. In the cave, the simulator is easy to describe. Victor could make a video with an accomplice who does not know the word. Before each round, they agree which side she will come out of; she walks in on that side, Victor shouts for that side, she walks out. Edited together, the video looks exactly like a genuine run of the protocol. If Victor showed it to a third party, it would prove nothing, because Victor could have faked it. That is precisely the point. The transcript Victor obtains from the real Peggy is something he could have manufactured without her, so it carries no transferable knowledge. What convinces Victor is not the transcript but the fact that he chose his questions at random, in real time, after Peggy had committed to a side. This also shows why the order of operations matters so much. In every zero-knowledge protocol, the prover first commits to something, then the verifier issues a random challenge, then the prover responds. If the prover could see the challenge before committing, she could cheat, as the accomplice in the fake video does. The entire security of the protocol rests on the challenge being unpredictable at the moment of commitment. Hold on to that observation: it is the source of one of the most serious bug classes in deployed systems, discussed in Chapter 8. Cryptographers distinguish several flavours of the property. Perfect zero knowledge means the simulated and real transcripts are identically distributed. Statistical zero knowledge means they are so close that no observer, however powerful, could tell them apart except with negligible probability. Computational zero knowledge means they could in principle be told apart, but only by doing a computation believed to be infeasible. Most practical systems offer statistical or computational zero knowledge, and for the purposes of a blockchain the difference rarely matters. From caves to computation A cave with a magic door is a toy. The question that mattered was whether zero-knowledge proofs existed for problems anyone cared about. In 1986 Oded Goldreich, Silvio Micali and Avi Wigderson gave a sweeping answer: assuming only that secure commitment schemes exist, every statement in the complexity class NP has a zero-knowledge proof. NP is, roughly, the class of problems whose solutions can be checked efficiently even if they are hard to find. Is this Sudoku solvable? Does this number have a factor smaller than a given bound? Is there a route through these cities shorter than a given length? Does this transaction carry a valid signature from the owner of these coins? In each case, the "witness" (the filled-in grid, the factor, the route, the private key) may be hard to find, but once found it can be checked quickly. The Goldreich–Micali–Wigderson result says that for any such problem you can prove that you hold a witness without revealing it. Their construction used a problem called graph three-colouring. A graph is a set of points joined by lines; a three-colouring assigns one of three colours to each point so that no line joins two points of the same colour. Finding such a colouring for a large graph is believed to be hard. Every NP problem can be translated into a three-colouring problem, so a zero-knowledge proof for three-colouring yields one for everything in NP. The protocol runs as follows. The prover knows a valid colouring. In each round she randomly permutes the three colours, say swapping every red for blue, every blue for green and every green for red, so that the colouring remains valid but the specific colours are freshly scrambled. She then puts each point's colour in a sealed envelope, a cryptographic commitment, and hands the envelopes over. The verifier picks one line at random and asks to open the two envelopes at its ends. If the colours differ, the round passes. Because the colours were randomly permuted, seeing two different colours at the ends of one line tells the verifier nothing about the overall colouring; it would look exactly the same for any valid colouring. But if the prover's colouring were invalid, at least one line would have matching ends, and the verifier would have a chance of picking it in every round. Repeat enough times, and a cheat is caught with overwhelming probability. This was a theoretical triumph and a practical non-starter. Translating a real computation, such as checking a digital signature, into graph colouring produces an absurdly large graph, and the protocol requires many rounds of back-and-forth for each tiny reduction in error. For decades, "zero-knowledge proof" meant something you could prove existed rather than something you would actually run. The path from here to a rollup required three further ideas: removing the interaction, making the proof short, and finding a far better way to represent computation. The first two are the subject of the rest of this chapter; the third is the subject of the next. A proof about a secret number Before moving on, it is worth seeing one small protocol that is genuinely practical and that sits, in modified form, inside a great deal of real software. It is due to Claus Schnorr, who published it around 1989, and it lets someone prove they know a private key without revealing it. In many cryptographic systems, a private key is a secret number, call it x, and the corresponding public key is a value obtained by "raising" a public base number to the power x within some carefully chosen mathematical group. Going from x to the public key is easy. Going backwards, recovering x from the public key, is the discrete logarithm problem, which is believed to be infeasible for well-chosen groups. The question is how to prove you know x. Schnorr's protocol has the familiar three moves. First, the prover picks a fresh random number r, computes the base raised to r, and sends that value as a commitment. Second, the verifier sends a random challenge number c. Third, the prover sends back a response: r plus c times x. The verifier can check, using only public values, that the base raised to this response equals the commitment multiplied by the public key raised to c. If the prover knows x, this check always passes. If the prover does not, she can pass it only by guessing the challenge in advance. Why does this reveal nothing about x? Because the response is x scrambled by the random r, which the verifier never sees, and the whole transcript can be simulated by someone who knows only the public key: pick the response and the challenge first, then work backwards to find a commitment that makes the equation balance. Why does it prove knowledge of x? Because if a prover could answer two different challenges for the same commitment, simple algebra would let anyone extract x from the two responses. A prover who can reliably pass the protocol must, in a precise sense, "know" the secret. This property, that a successful prover's knowledge could in principle be extracted, is called knowledge soundness, and it is what the K in SNARK refers to. Removing the conversation Interaction is a nuisance. A blockchain cannot hold a conversation with every user who wants to prove something; it needs a proof that can be written once, posted publicly, and checked by anyone, at any time, without the prover being present. The trick that achieves this was published by Amos Fiat and Adi Shamir in 1986, and it is beautifully simple. The verifier's only role in protocols like Schnorr's is to supply an unpredictable challenge after the prover has committed. So replace the verifier with a cryptographic hash function. A hash function takes any input and produces a fixed-length output that looks random and cannot be predicted without actually computing it. The prover computes her commitment, feeds it into the hash function, and uses the output as the challenge. Since she cannot know what the hash will produce until she has fixed the commitment, she cannot tailor her commitment to the challenge, which is exactly the guarantee the live verifier provided. The result is a non-interactive proof: a single message containing the commitment and the response, which anyone can check by recomputing the hash. Apply the Fiat–Shamir transform to Schnorr's protocol, and include the message being signed in the hash input, and you get the Schnorr signature scheme, which Bitcoin adopted in its 2021 Taproot upgrade. Every Schnorr signature is, quite literally, a non-interactive zero-knowledge proof that the signer knows the private key. The transform has a condition that is easy to state and, as it turned out, easy to get wrong in practice: everything the prover has committed to, and every public input to the statement, must go into the hash. If anything is left out, a malicious prover can vary the omitted part after seeing the challenge, and the soundness of the whole system can collapse. Formally, the security of Fiat–Shamir is proved in an idealised model where the hash function behaves like a perfectly random oracle; real hash functions only approximate this, and theorists have found contrived cases where the approximation fails. Practitioners accept the model because no realistic attack on it has been found when the transform is applied correctly. The words "when applied correctly" carry a good deal of weight. The missing ingredient: succinctness By the end of the 1980s, then, the field had zero-knowledge proofs for any NP statement and a way to make them non-interactive. What it did not have was proofs that were short, or fast to check. In the three-colouring protocol, the verifier's work grows with the size of the computation; checking a proof about a billion-step program takes at least a billion steps. That is no help to a blockchain whose problem is precisely that every node must redo every computation. The theoretical answer arrived in stages. The 1990s produced the PCP theorem, short for probabilistically checkable proofs, one of the deepest results in computer science. It says, informally, that any proof can be rewritten in a special redundant format such that a verifier can be convinced of its correctness, with high confidence, by reading only a handful of randomly chosen bits. In 1992 Joe Kilian showed how to combine this with cryptographic hashing so that the prover need not send the whole enormous rewritten proof, only a short commitment to it plus the few bits the verifier asks for. In 1994, in work published in journal form in 2000, Silvio Micali applied the Fiat–Shamir idea to Kilian's construction, producing what he called computationally sound proofs: non-interactive, short, and quick to verify, for any computation. This was the blueprint for everything that followed. It established that, in principle, a verifier could check a computation in time vastly smaller than the computation itself, logarithmic or even constant in its size, while a computationally bounded prover could not cheat. It was also, in its original form, hopelessly inefficient for the prover. The PCP constructions of the period would have required more computing power than existed on Earth to prove anything interesting. The vocabulary of the field still carries the marks of this history. A system in which soundness holds only against provers with limited computing power is technically an argument rather than a proof, and the acronym SNARK stands for Succinct Non-interactive ARgument of Knowledge. Succinct means the proof is short and quick to verify. Non-interactive means it is a single message. Argument means soundness is computational. Of Knowledge means a successful prover must actually possess a witness. Add "zk" in front and you have a zk-SNARK: all of the above, plus the guarantee that the proof reveals nothing beyond the truth of the statement. A STARK, the subject of Chapter 4, is a Scalable Transparent ARgument of Knowledge; the word "transparent" will turn out to matter a great deal. It is worth noticing which of these properties blockchains actually need. Privacy applications need zero knowledge. Scaling applications, strictly speaking, do not: a rollup that proves a batch of public transactions were executed correctly has nothing to hide, and many so-called "zk-rollups" do not use the zero-knowledge property at all. What they need is succinctness. The industry kept the "ZK" label because the same proof systems deliver both, and because it was already the familiar brand. The confusion is harmless once one is aware of it, and it underlines the central point of this booklet. The property that turned an elegant curiosity into infrastructure is not secrecy but the chasm between the cost of doing a computation and the cost of checking that it was done. Getting across that chasm in practice required a way of turning arbitrary programs into a form that proof systems could digest efficiently. The material that made this possible was not graphs or caves, but polynomials. Chapter 2: From Programs to Polynomials Every practical zero-knowledge proof system performs the same opening move. Before it can prove anything about a computation, it translates that computation into a statement about polynomials. This step, called arithmetisation, is the least glamorous part of the field and arguably the most important. It is where most of the engineering effort goes, where most of the performance is won or lost, and, as Chapter 8 will show, where most of the dangerous bugs live. A reader who understands arithmetisation understands why proof systems are built the way they are. Why polynomials Start with the question of why polynomials should be the right material at all. A polynomial is an expression such as three x squared plus two x plus seven: a sum of powers of a variable, each multiplied by a coefficient. The degree is the highest power that appears. Polynomials have a property that makes them almost absurdly well suited to probabilistic checking, and it can be stated in one sentence: two different polynomials of degree d can agree on at most d points. The reason is elementary. If two polynomials agree at some point, their difference is zero there. The difference is itself a polynomial of degree at most d, and a nonzero polynomial of degree d has at most d roots. So two distinct polynomials can coincide at no more than d places. Now consider what this means if you choose a point at random from a very large set. Suppose the polynomials have degree one million, and you are working over a set of numbers with about two to the power 256 elements, which is typical. The chance that a randomly chosen point happens to be one of the at most one million places where two different polynomials agree is about one million divided by two to the 256, which is to say effectively zero. So if you want to know whether two enormous polynomials are identical, you do not need to compare them coefficient by coefficient. You evaluate both at a single random point and compare two numbers. If they match, the polynomials are, with overwhelming probability, the same. This observation, formalised in what is called the Schwartz–Zippel lemma, is the engine underneath nearly every modern proof system. It converts a question about a million things into a question about one thing, and it does so with a quantifiable and tiny chance of error. The whole of arithmetisation is an effort to get a computation into a form where its correctness can be expressed as "these polynomials are equal" or "this polynomial is zero at these points", so that a random evaluation can check it. There is one more ingredient. Ordinary integers grow without bound when multiplied, and real numbers suffer from rounding. Proof systems instead work in a finite field, a set of numbers that wraps around at some prime modulus, as clock arithmetic wraps around at twelve. In the field of integers modulo a prime p, every addition and multiplication produces another number between zero and p minus one, division by any nonzero number is always possible, and there is no rounding. The size of the prime determines the size of the space from which random points are drawn, and thus the soundness of the checks. Choosing the field turns out to be one of the most consequential design decisions in a proof system, and much of the recent progress described in Chapter 4 comes from learning to work in smaller, faster fields without losing security. Programs as circuits The next step is to express a computation in terms that polynomials can capture. Computers execute instructions: load, store, compare, jump. Polynomials know only two operations, addition and multiplication. So the computation must be flattened into an arithmetic circuit, a network of addition and multiplication gates over field elements, with no loops and no branches. A standard teaching example, made famous by an explanatory post Vitalik Buterin wrote in 2016, is a prover who wants to show that she knows a number x such that x cubed plus x plus five equals thirty-five, without revealing that x is three. The computation is broken into the smallest possible steps, each involving a single operation. First, a variable for x times x. Second, a variable for that result times x, giving x cubed. Third, x cubed plus x. Fourth, that sum plus five. Finally, the claim that the result equals thirty-five. Each intermediate value gets its own name, and the list of all values, including the secret x and every intermediate result, is called the witness. The prover knows the witness; the verifier knows only the public output, thirty-five, and the shape of the circuit. The circuit is then expressed as a set of constraints, equations that every valid witness must satisfy. In the most widely used format, called a rank-one constraint system or R1CS, each constraint says that one linear combination of witness values, multiplied by another linear combination, equals a third. "x times x equals the first intermediate" is one constraint. "The first intermediate times x equals the second" is another. Additions can be folded into the linear combinations at no cost, which is why practitioners often say that in R1CS "additions are free and multiplications cost one constraint each". A circuit's size, and roughly the cost of proving it, is measured in the number of multiplication constraints. This flattening has consequences that surprise newcomers. A conditional statement, "if this then that, else the other", cannot be executed as a branch, because a circuit has no branches. Instead both sides are computed and the result is selected arithmetically: multiply one outcome by a bit that is one when the condition holds and zero when it does not, multiply the other outcome by one minus that bit, and add. A loop must be unrolled to a fixed maximum number of iterations. Comparisons such as "is a less than b" are expensive, because a field element has no natural notion of order; the usual approach is to decompose the numbers into individual bits, add a constraint for each bit asserting that it is either zero or one, and compare bit by bit. Each of these patterns adds constraints, and each constraint the circuit designer forgets to add is a hole through which a dishonest prover can pass a false witness. Turning constraints into a single polynomial identity A circuit with a million constraints is a million equations. The proof system's job is to let the verifier check all of them without reading them all. The decisive idea, introduced in a 2013 paper by Rosario Gennaro, Craig Gentry, Bryan Parno and Mariana Raykova on what they called quadratic arithmetic programs, is to bundle all the constraints into polynomials so that the whole system holds if and only if one polynomial divides another. The construction goes like this. Number the constraints one, two, three and so on, and associate each with a distinct point in the field. For each witness variable, build a polynomial that, at each constraint's point, takes the value of that variable's coefficient in that constraint. This is always possible: given any list of values at any list of points, there is a unique polynomial of the appropriate degree passing through them, a fact known since Lagrange. Combine these polynomials using the witness values, and you obtain three polynomials, call them A, B and C, corresponding to the left, right and output sides of the constraints. The constraint system is satisfied exactly when A times B minus C equals zero at every constraint point. A polynomial that equals zero at a given set of points must be divisible by the "vanishing polynomial" for those points, the product of (x minus each point). So the prover's claim becomes: there exists another polynomial, the quotient H, such that A times B minus C equals H times the vanishing polynomial. And this is precisely the kind of claim that Schwartz–Zippel lets one check at a single random point. If the identity holds at a randomly chosen value, it holds everywhere, with overwhelming probability, and therefore every one of the million constraints is satisfied. The verifier's work has collapsed from checking a million equations to checking one. What remains is to make sure the prover cannot cheat in the evaluation itself, that is, cannot simply invent numbers that satisfy the identity at the random point without actually having polynomials that satisfy it everywhere. Commitments: sealing a polynomial in an envelope The solution is a polynomial commitment scheme. It plays the same role as the sealed envelopes in the graph-colouring protocol of Chapter 1. The prover first commits to her polynomials, producing a short value that binds her to them without revealing them. Only after the commitment is fixed is the random evaluation point chosen, through Fiat–Shamir hashing of the commitment. The prover then reveals the polynomial's value at that point, together with a short proof that the revealed value is consistent with what she committed to. Because she was bound before the point was known, she cannot tailor the polynomial to the point. A good commitment scheme for this purpose has three properties. It must be binding: once committed, the prover cannot open the commitment to values of a different polynomial. It must be succinct: the commitment and the evaluation proofs must be small, much smaller than the polynomial itself. And for privacy applications it should be hiding: the commitment should reveal nothing about the polynomial beyond the values deliberately opened. The choice of commitment scheme is the most important single factor separating the families of proof systems discussed in the next two chapters. One family uses commitments built from elliptic curves with a special algebraic structure called a pairing; these produce extremely short proofs but require a one-time setup ceremony to generate public parameters, and their security rests on assumptions that a large quantum computer would break. Another family uses commitments built from nothing but hash functions; these need no ceremony and are believed to resist quantum attacks, but produce larger proofs. Almost every trade-off in the field can be traced back to this choice. This modularity is one of the more useful insights of the past decade of research. A modern proof system is best understood as two separable components bolted together: an interactive oracle proof, which arithmetises the computation and reduces its correctness to claims about polynomials, and a polynomial commitment scheme, which makes those claims checkable cryptographically. Designers can, and do, mix and match. The same arithmetisation can be paired with a pairing-based commitment for minimal proof size or a hash-based one for transparency, depending on the application. Execution traces and the alternative to circuits Circuits are a natural fit for fixed computations such as "verify this signature" or "check this Merkle path". They are a poor fit for running a general-purpose program, where the sequence of operations depends on the input and the same step is repeated many times. For this, a different arithmetisation has become dominant, associated with STARKs and introduced by Eli Ben-Sasson and colleagues under the name algebraic intermediate representation, or AIR. The idea is to think of a computation as a machine with a fixed set of registers that evolves step by step. Write down the state of every register at every step, and you have a table, the execution trace, with one column per register and one row per step. Correct execution is then expressed as a set of transition constraints, polynomial rules that must hold between each row and the next. For a simple counter, the rule might be "the value in the next row equals the value in this row plus one". For a processor, the rules encode what each instruction does to the registers. Separate boundary constraints pin down the starting state and the final output. Each column of the trace is then interpolated into a polynomial, and the transition constraints become polynomial identities that must hold at every step. The great advantage is that the constraints describe one step, not the whole computation, so a program running for a billion steps needs no more constraint definitions than one running for ten. The trace gets longer, but the rules do not. Lookups, and the cost of being unnatural Arithmetisation is efficient for computations that are naturally arithmetic, such as field multiplications or the elliptic-curve operations used in signatures. It is painfully inefficient for computations designed around binary computer hardware. A bitwise exclusive-or of two 64-bit numbers, which a processor does in one cycle, requires the circuit to decompose both numbers into 64 bits each, constrain every bit, and recombine them, at a cost of hundreds of constraints. This matters enormously for blockchains, because Ethereum was designed before anyone expected to prove it. Its hash function, Keccak-256, is built from exactly the bitwise rotations and exclusive-ors that circuits handle worst. Proving a single Keccak hash has historically cost on the order of tens of thousands to over a hundred thousand constraints, depending on the system, and an Ethereum block involves a very large number of them, because Ethereum's state is organised as a tree of Keccak hashes. The same is true of SHA-256, used throughout Bitcoin. Much of the difficulty of building zero-knowledge versions of these systems, described in Chapter 5, is the difficulty of proving hash functions that were never meant to be proved. Two responses emerged. The first was to design new hash functions that are cheap inside circuits. Poseidon, published in 2019 by Lorenzo Grassi, Dmitry Khovratovich, Christian Rechberger, Arnab Roy and Markus Schofnegger, uses only field additions and multiplications and needs a few hundred constraints where Keccak needs tens of thousands. Systems built from scratch, such as Zcash's later designs and many rollups' internal data structures, use such "arithmetisation-friendly" primitives. They are newer and less battle-tested than the traditional ones, and cryptanalysts continue to study them, but they can make proofs one or two orders of magnitude cheaper. The second response was the lookup argument. Rather than computing a hard function inside the circuit, the prover asserts that a given input and output appear as a row in a precomputed table, such as a table of every possible eight-bit exclusive-or, and proves that assertion efficiently. Ariel Gabizon and Zachary Williamson's Plookup, from 2020, made this practical, and successive refinements have made lookups so cheap that some recent systems, notably the Lasso and Jolt designs from researchers at a16z crypto and collaborators, build an entire processor out of little more than lookups. A large part of the dramatic speed-up in proving general programs since 2022 comes from this technique. What arithmetisation costs It is worth being clear about the scale of the overhead involved. Running a program natively on a modern processor costs a few nanoseconds per instruction. Proving that the same program ran correctly costs, even in the best current systems, many thousands of times more, and historically the multiple was in the millions. Estimates vary widely with the system and the workload, but an overhead of several orders of magnitude over plain execution remains normal, with the gap narrowing rapidly as hardware acceleration and better arithmetisation arrive. This overhead is the price of the asymmetry described in the introduction. The prover pays heavily so that the verifier can pay almost nothing. Whether the trade is worthwhile depends on how many verifiers there are. For a blockchain, the answer is easy: a single expensive proof replaces thousands or millions of re-executions by every node, now and in the future, and anyone who later syncs the chain can check the proof rather than replay history. One prover's large cost, divided by an enormous number of verifiers, becomes a small cost per participant. Everything else in the field follows from this arrangement. The commitments determine what the verifier must trust. The field determines how fast the prover can work. The arithmetisation determines how much of the prover's work is wasted on representing operations polynomials find unnatural. The next two chapters take the two main ways of assembling these components, starting with the one that first made zero-knowledge proofs practical on a blockchain. Chapter 3: zk-SNARKs and the Ceremony Problem In October 2016, six people in six different places each ran a piece of software, generated a random number, used it in a computation, passed the result along, and then destroyed the hardware that had held the number. One of them, the Bitcoin developer Peter Todd, did his part on a laptop in a moving car crossing Canada, then burned the computer. The journalist Morgan Peck, who was invited to witness one of the stations, wrote about it for IEEE Spectrum, describing the elaborate precautions taken against eavesdropping. The purpose of all this theatre was to launch Zcash, the first cryptocurrency to use zero-knowledge proofs to hide who was paying whom and how much. If all six participants had colluded, or if each had been separately compromised, someone could have created counterfeit Zcash coins out of nothing, and nobody would ever have been able to tell. The ceremony is the most famous image associated with zk-SNARKs, and it captures both their power and their awkwardness. They deliver the smallest and fastest-to-verify proofs known. In their original form, they also require a setup procedure that produces a dangerous secret, which must be destroyed, and whose destruction can never be proved. This chapter explains why that secret exists, how the field learned to live with it, and how it has gradually been tamed. From theory to Pinocchio The theoretical constructions of the 1990s, described in Chapter 1, were too slow to be useful. The breakthrough that made SNARKs practical came from a different direction: the use of elliptic curves with a special property called a bilinear pairing. An elliptic curve, for these purposes, is simply a mathematical group in which one can add points and multiply them by whole numbers, but in which the reverse of multiplication, recovering the number from the point, is believed to be infeasible. This one-way property is what lets a polynomial be "hidden" inside curve points. If you take a secret value s and publish the curve points corresponding to s, s squared, s cubed and so on up to some large power, then anyone can compute the curve point corresponding to any polynomial evaluated at s, by combining those published points with the polynomial's coefficients, without ever learning s itself. The polynomial gets evaluated at a secret point that nobody knows. A pairing adds the ability to check a multiplicative relationship between hidden values. Given points hiding a, b and c, a pairing lets anyone check whether a times b equals c without learning any of the three. That is exactly the ability needed to check the polynomial identity from Chapter 2, A times B minus C equals H times the vanishing polynomial, at the hidden point s. Put these together and the outline of a SNARK appears. A setup procedure picks a random s, publishes the curve points for its powers, and then forgets s. The prover uses the published points to compute hidden evaluations of her polynomials at s. The verifier uses a pairing to check that the identity holds. Because s was random and is unknown to the prover, she cannot have constructed fake polynomials that happen to satisfy the identity at s; by the Schwartz–Zippel argument, a fake would be caught with overwhelming probability. The first system to make this fast enough for real use was Pinocchio, published in 2013 by Bryan Parno, Jon Howell, Craig Gentry and Mariana Raykova under the title Pinocchio: Nearly Practical Verifiable Computation. It built on the quadratic arithmetic programs described in the previous chapter and produced proofs of a few hundred bytes, checkable in milliseconds regardless of the size of the computation. A closely related line of work by Eli Ben-Sasson, Alessandro Chiesa, Eran Tromer, Madars Virza and colleagues produced efficient SNARKs for general programs, and the same group, together with Christina Garman, Matthew Green and Ian Miers, published the Zerocash paper in 2014, describing a fully private digital currency built on them. That design became Zcash. Toxic waste The secret s is the problem. It must exist during setup, because the powers of s must be computed. It must then be destroyed, because anyone who knows s can forge proofs. With s in hand, a cheater can construct polynomials that satisfy the verifier's check at s without satisfying the underlying constraints at all, because they know exactly where the check will be performed. In a private currency, a forged proof of a valid transaction means coins created from nothing, and because the system's whole point is to hide transaction details, the forgery would be undetectable. The total supply could be inflated indefinitely and nobody would know. Practitioners took to calling s and its companions "toxic waste". The public parameters derived from it are called a structured reference string, or sometimes a common reference string, and the procedure that creates them is the trusted setup. The way to reduce the danger is to have many people generate the secret jointly, in such a way that it can be reconstructed only if every one of them colludes. This is a multi-party computation, and for SNARK setups it has an elegant form. The first participant picks a random number and computes the powers. The second participant takes those results, picks their own random number, and multiplies it in, so that the effective secret is now the product of both numbers. Each subsequent participant does the same. The final secret is the product of every participant's contribution, and recovering it requires knowing every single one. If even one participant genuinely destroyed their number, the toxic waste is gone forever. This is called the "one honest participant" or "1-of-N" trust assumption. Zcash's original ceremony in 2016 had six participants. For its 2018 upgrade, called Sapling, the Zcash team ran a far larger ceremony using a protocol called Powers of Tau, designed by Sean Bowe, Ariel Gabizon and Ian Miers, which allowed participants to join sequentially over months without coordinating in advance. Dozens of people contributed, some using deliberately unusual sources of randomness and air-gapped machines. The larger the ceremony, the more implausible the assumption that every participant was dishonest or compromised. The trust assumption remains uncomfortable for a technology whose whole appeal is removing the need for trust. A ceremony can be audited for correct computation, and each participant can verify that their own contribution was included. What cannot be audited is whether anyone kept their number. One participant out of a hundred acting honestly is a weak assumption, but it is an assumption, and it rests on people rather than mathematics. Groth16: the smallest proof In 2016 Jens Groth published a refinement that became, and in many places remains, the standard against which all other systems are measured. Groth16, as it is universally known, produces a proof consisting of just three elliptic-curve points. On the curve most commonly used with Ethereum, called BN254, that is a little under two hundred bytes uncompressed, and verification requires a fixed handful of pairing operations, no matter how large the underlying computation. Ethereum made Groth16 cheap to use on-chain. Its Byzantium upgrade in October 2017 added precompiled contracts for the BN254 curve's addition, multiplication and pairing operations, built-in functions that the virtual machine executes natively rather than in slow contract code. A 2019 upgrade, Istanbul, cut their cost substantially. As a result, a smart contract can verify a Groth16 proof for a few hundred thousand units of gas, a modest fraction of a block, regardless of whether the proof concerns a single hash or a million transactions. Many privacy protocols and early rollups were built on precisely this capability, and several still are. Groth16 has a significant limitation beyond the trusted setup itself. Its setup is circuit-specific. The structured reference string encodes details of one particular circuit, so every new circuit, and every change to an existing one, requires a new ceremony. For a privacy coin with a single fixed transaction circuit, that is tolerable. For a rollup whose circuit must be updated whenever the protocol changes or a bug is fixed, it is a serious burden. In practice, Groth16 setups are usually done in two phases: a universal first phase, the Powers of Tau, that can be shared across many projects, and a second, circuit-specific phase that each project runs for itself. Universal setups and PLONK The next step was to make the setup universal, so that a single ceremony could serve every circuit up to some maximum size. Several systems achieved this around 2019, including Sonic and Marlin, but the one that came to dominate was PLONK, published that year by Ariel Gabizon, Zachary Williamson and Oana Ciobotaru. The name is an awkward acronym, permutations over Lagrange bases for oecumenical noninteractive arguments of knowledge, and the design was a distinct shift in how circuits are represented. Instead of R1CS, PLONK uses a table of gates, each of which constrains a few wires with a general equation whose coefficients are fixed per gate. A separate permutation argument enforces that wires which should carry the same value, the output of one gate feeding the input of another, actually do. The arrangement is flexible: designers can add "custom gates" that perform complex operations in one step, and the system adapts naturally to lookup arguments. Variants and descendants of PLONK, collectively called "Plonkish" systems, underlie a very large share of the production proving systems built since. PLONK's commitment scheme is the one that makes the universal setup possible. Introduced in 2010 by Aniket Kate, Gregory Zaverucha and Ian Goldberg and known by their initials as KZG, it commits to a polynomial as a single elliptic-curve point, the polynomial evaluated at the secret s, and lets the prover show the polynomial's value at any chosen point with another single curve point. Because the setup consists only of powers of s, it does not depend on any particular circuit, and one ceremony serves all. The price is that PLONK proofs are somewhat larger than Groth16's and somewhat more expensive to verify, typically a kilobyte or less rather than a couple of hundred bytes, which is still tiny. KZG commitments became important to Ethereum in a way that had nothing to do with zero-knowledge proofs directly. When Ethereum introduced a new form of cheap data storage for rollups in 2024, discussed in Chapter 5, it chose KZG commitments as the way to refer to that data. That required a structured reference string, and the Ethereum community ran the largest trusted setup ceremony ever held. It opened in January 2023 and ran for most of that year; by its close it had collected more than 140,000 contributions, from individuals who did so through a web browser. With that many participants, the idea that every one of them colluded or was compromised is not a realistic concern. The ceremony shows how far the "trusted" in trusted setup can be diluted when participation is cheap. Recursion and the end of the ceremony The longer-term answer to the ceremony problem came from a direction that also turned out to matter enormously for scaling: recursion, the ability of one proof to verify another. The idea is that verifying a SNARK is itself a computation, and a fairly small one. So it can be written as a circuit, and a second SNARK can prove that the first was valid. A proof of a proof is still a short proof. Chained, this gives incrementally verifiable computation: a long-running process can carry forward a single small proof that every step so far was correct, updating it at each step without ever growing. Applied in a tree, it gives aggregation: thousands of independent proofs can be combined, pair by pair, into one proof that all of them were valid. Both are central to how modern rollups work. Recursion with pairing-based SNARKs is awkward because of a mismatch between fields. The arithmetic inside an elliptic-curve proof happens over one field, while the curve's points have coordinates in a different field, so a circuit that verifies a proof must emulate foreign arithmetic, which is expensive. The workaround is to find pairs of curves, called cycles, where each curve's coordinate field is the other's arithmetic field, so that proofs on one can efficiently verify proofs on the other. In 2019 Sean Bowe, Jack Grigg and Daira Hopwood at the Electric Coin Company, the developer of Zcash, published a system called Halo. It used a cycle of curves, later named Pallas and Vesta, together with a commitment scheme that needed no trusted setup at all, and it showed that recursion could be achieved by deferring the expensive part of each verification and accumulating it, rather than fully verifying at each step. Halo's commitment, based on a technique known as an inner-product argument, produces larger proofs and slower verification than KZG, but requires no toxic waste. Its successor, Halo 2, combined this with a Plonkish arithmetisation, and in May 2022 Zcash activated a network upgrade that introduced a new shielded pool, Orchard, built on it. The currency that had begun with six people burning laptops had, six years later, eliminated the need for a ceremony entirely in its newest design. The accumulation idea at the heart of Halo was generalised into folding schemes, beginning with Nova, published in 2021 by Abhiram Kothapalli, Srinath Setty and Ioanna Tzialla. Folding combines two instances of a constraint system into one at very low cost, postponing all the expensive proving work until the very end of a long chain of steps. It is among the most active research areas in the field. What SNARKs are good at By the mid-2020s, the SNARK family had reached a kind of maturity. Its distinctive strength is the size and verification cost of its proofs. A Groth16 proof is the smallest object that can convince a smart contract of an arbitrary computation, and on a blockchain, where every byte posted and every operation executed costs money, small is valuable. Even systems that do most of their work with other techniques often finish by wrapping their final proof inside a Groth16 or PLONK proof, a step practitioners call "wrapping" or "compression", purely so that it can be verified cheaply on Ethereum. Its distinctive weaknesses are three. The first is the trusted setup, now largely mitigated by universal ceremonies with huge participation and by setup-free designs such as Halo 2, but never quite absent for pairing-based systems. The second is that elliptic-curve arithmetic over large fields is slow, so SNARK provers are comparatively expensive. The third is quantum vulnerability. The security of every pairing-based SNARK rests on the hardness of the discrete logarithm problem on elliptic curves, which a sufficiently large quantum computer running Shor's algorithm would solve efficiently. No such machine exists, and estimates of when one might range from about a decade to never. But a blockchain is a long-lived record, and a proof system whose soundness could one day collapse is a structural concern. There is an important nuance in that last point. A quantum computer that broke a SNARK's soundness would let someone forge new proofs; it would not retroactively expose the secrets hidden in old ones, if the zero-knowledge property was statistical, as it is in many systems. The danger is to the integrity of the system going forward, not necessarily to the privacy of its past. Each of these weaknesses pointed towards a different design, one that would build its commitments not from elliptic curves but from the humblest primitive in cryptography, the hash function. That design is the subject of the next chapter. Hashtags: #ZeroKnowledgeProofs #ZKProofs #zkSNARKs #zkSTARKs #PrivacyPreservingBlockchain #BlockchainTechnology #Cryptography #ZeroKnowledgeCryptography #BlockchainPrivacy #BlockchainScalability #Ethereum #ZKRollups #Layer2Scaling #ValidityProofs #SuccinctProofs #CryptographicProofs #NonInteractiveProofs #PolynomialCommitments #TrustedSetup #TransparentProofSystems #PostQuantumCryptography #ZKVirtualMachines #zkEVM #ZKVM #ShieldedTransactions #Zcash #DecentralizedFinance #PrivacyPreservingTechnology #VerifiableComputation #BlockchainSecurity

Download the Book (PDF): Introduction In 2017 a group of researchers printed a handful of black and white rectangles, stuck them onto an ordinary American stop sign, and photographed the result from a range of distances and angles. To a passing driver the sign looked vandalised, nothing more. To the image classifier they were testing, it read in most of the frames as a speed-limit sign. The stickers had not been placed at random. They had been computed, by an optimisation procedure that asked which small, physically printable changes would push the model's internal representation of the image across a decision boundary it could not see and nobody had drawn. Eight years later, in July 2025, the Attorney General of Massachusetts announced a settlement with a student loan company. Its underwriting models had used, among other inputs, the historical default rate of the college an applicant attended. The variable looked like a neutral measure of risk. In the state's account it worked as a channel through which race reached the decision, penalising Black and Hispanic applicants more often, and the company had not tested its models for that kind of disparate effect. It agreed to pay two and a half million dollars, drop the variable, and build a governance programme around its use of algorithms. And in December 2024 the European Data Protection Board, the body that coordinates Europe's privacy regulators, published an opinion on a question that many engineers had assumed was settled: when is a trained machine learning model itself personal data? The answer was not "never". A model trained on personal data can be treated as anonymous, the Board said, only if the likelihood of extracting personal data from it, whether directly or through the kind of probing that researchers call membership inference and model inversion, is insignificant, and if ordinary use of the model does not surface such data either. A file of weights, in other words, can carry the people it learned from. These three episodes belong to three different research communities, three bodies of law and three sets of conferences. They are usually taught separately, staffed separately inside companies and regulated by different agencies. This book argues that they are best understood as one problem. The argument The word "trustworthy" invites a list of virtues. Systems should be robust, fair, private, transparent, accountable, safe. Almost every government and large company has published some version of that list, and almost none of the lists has changed how a model is built on a Tuesday afternoon. The reason is that a virtue cannot be tested. A property can. The controlling claim of this book is that robustness, fairness and privacy become useful only when each is stated as a measurable property defined against an explicit model of threat or harm: who is trying to do what, with what access, and what outcome counts as failure. Once they are stated that way, three things follow. First, each property can be measured, and most of the published claims about it turn out to be weaker than they sounded. Second, the properties interact. Making a model harder to fool can make it leak more about its training data; adding mathematical privacy guarantees can make it less accurate for the smallest groups in the data, which are often the groups fairness work exists to protect; and enforcing equal approval rates can be in direct tension with other reasonable definitions of fairness. Third, because the properties interact, choosing among them is a decision, not a discovery. It needs to be made deliberately, by people with authority to make it, and recorded in a form that a regulator, an auditor or an adversary could check. Nothing in that argument is anti-technical. The technical work is the only way to make the decision honestly. You cannot weigh a privacy guarantee against a loss of accuracy for a minority group unless you know how to quantify both, and the quantification is where the mathematics earns its place. Why these three, and why now Trustworthy AI covers more ground than any one short book can, and this one leaves a good deal out on purpose. It does not treat explainability as a property in its own right, although explanations appear wherever the law requires them, as it does when a lender turns someone down. It does not discuss the long-term safety of advanced general systems, the economics of automation, or copyright. It concentrates on robustness, fairness and privacy because these three share a structure: each can be specified formally, each has a mature attack literature showing how naive approaches fail, and each is now the subject of binding legal obligations rather than voluntary principles. The legal pressure is real and specific. The European Union's AI Act treats creditworthiness assessment of individuals as a high-risk use, and requires providers of such systems to manage data quality and bias, to achieve an appropriate level of accuracy and robustness, and to resist attempts by third parties to alter the system's behaviour by exploiting its vulnerabilities. A package of amendments adopted in July 2026 pushed the date on which those obligations apply to stand-alone high-risk systems back to December 2027, and at the same time widened the legal basis for processing sensitive personal data in order to detect and correct bias. The General Data Protection Regulation, meanwhile, has applied since 2018 and does not care whether a dataset is called "training data". The Court of Justice of the European Union has spent the last several years sharpening what counts as personal data, what counts as an automated decision, and what an affected person is entitled to be told. In the United States, the legal ground for algorithmic lending fairness is shifting under practitioners' feet: in April 2026 the Consumer Financial Protection Bureau finalised a rule declaring that the Equal Credit Opportunity Act does not support liability for disparate impact, while the Fair Housing Act and a number of state laws continue to support it and state attorneys general have made clear that they intend to use them. That legal landscape is unstable, and it would be a mistake to write a book whose usefulness depended on any one rule. The technical facts underneath are much more stable. Adversarial examples were described in 2013 and the basic phenomenon has not gone away; the impossibility results that constrain fairness definitions were proved in 2016 and 2017 and will not be repealed; differential privacy was defined in 2006 and remains the only widely accepted formal standard for what it means to learn from data without learning about individuals. This book is built on those foundations, and uses the current law to show why they matter rather than the other way round. How the book is organised The three running examples in the subtitle are deliberately concrete. Defending against adversarial perturbations is the robustness problem in its sharpest form. Ensuring demographic parity in loan approvals is a fairness problem with a long legal history, real money at stake and a definition that is easy to state and hard to live with. Anonymising training data to comply with the GDPR is the privacy problem as most organisations actually meet it, through a lawyer's question about whether a dataset falls inside or outside the regulation. Chapter 1 sets out the method that the rest of the book applies: how to turn a value into a property, a property into a measurement, and a measurement into a claim that can fail. Chapters 2 and 3 take robustness, first by showing exactly how models break under adversarial pressure and then by separating the defences that survive serious evaluation from the larger number that do not. Chapters 4 and 5 take fairness, first by laying out what the competing definitions measure and why they cannot all be satisfied together, and then by working through the design of a loan approval system that aims at demographic parity, including what that aim costs and where the law permits or forbids it. Chapters 6 and 7 take privacy, first by describing how models leak and what European law now means by "anonymous", and then by comparing the techniques available for anonymising training data, from the classical to the mathematically rigorous. Chapter 8 brings the three together, sets out the evidence on how they conflict, and describes the governance machinery, from threat models to assurance cases, that lets an organisation make those trade-offs on purpose. The conclusion draws out what follows for the people who build, buy and regulate these systems. The reader this book has in mind is intelligent, numerate and busy: an engineer who has trained models but never had to defend one in front of a regulator, a risk or compliance officer who keeps being asked to sign off on systems they cannot inspect, a policymaker who wants to know which technical claims to believe. No mathematics beyond the idea of a probability and an average is required, though the arguments are not softened to avoid it. Where a technique rests on a formula, the book explains what the formula guarantees and, just as important, what it does not. One warning before starting. Much of what follows is about failure: attacks that work, defences that do not, definitions that contradict each other, anonymisation that can be undone. That emphasis is deliberate and should not be mistaken for pessimism. The fields described here have made real progress precisely by taking failure seriously, by insisting that a claim of robustness, fairness or privacy is worthless until someone has tried hard to break it. A system that has survived that kind of scrutiny, and whose builders can say exactly what it protects against and what it does not, deserves a kind of trust that no statement of principles can confer. Chapter 1: From Principles to Properties In the second half of the 2010s, public bodies, professional associations and technology firms published guideline after guideline on ethical or trustworthy artificial intelligence. When Anna Jobin, Marcello Ienca and Effy Vayena surveyed 84 such documents in a 2019 paper in Nature Machine Intelligence, they found striking convergence on a small vocabulary: transparency, justice and fairness, non-maleficence, responsibility, privacy. The European Commission's High-Level Expert Group published its Ethics Guidelines for Trustworthy AI in April 2019, organised around seven requirements that included technical robustness and safety, privacy and data governance, and diversity, non-discrimination and fairness. The OECD adopted its AI Principles the following month. The vocabulary was settled almost before the field had decided what it meant. Convergence on words concealed divergence on everything that mattered. Two organisations could both commit to "fairness" while one meant equal approval rates across groups and the other meant equally accurate risk scores, and, as Chapter 4 shows, these two commitments are in general mathematically incompatible. Two firms could both promise "privacy" while one meant that names were removed from the training set and the other meant a formal bound on how much any individual's record could influence the model; the first promise is routinely broken by linkage attacks and the second is not. A principle that can be satisfied by incompatible engineering choices does not constrain engineering at all. This chapter sets out the method the rest of the book uses to get from principle to practice. It has three steps. A value is turned into a property by specifying a threat or harm model. A property is turned into a measurement by fixing a metric and a test procedure. And a measurement is turned into a claim by stating the conditions under which the claim would be false. The anatomy of a property Consider robustness. In ordinary language a robust system is one that keeps working when things go wrong. That is a value. To turn it into a property, we need to say which things go wrong, how badly, and what "keeps working" means. The adversarial machine learning literature does this with a threat model, a specification of the attacker. A standard threat model has four parts. The first is the attacker's goal: to cause any misclassification, or a specific one (stop sign to speed limit, rejected loan to approved), or to extract information, or to degrade performance generally. The second is the attacker's knowledge: complete access to the model's architecture and weights (the "white-box" setting), access only to its outputs through queries ("black-box"), or knowledge of the training data and procedure but not the final model. The third is the attacker's capability: what they are allowed to change. For images, this is often expressed as a budget on the size of the perturbation, for instance that no pixel may change by more than eight levels on the standard 0 to 255 scale. For a loan application it might be a set of fields the applicant controls, such as stated income or the number of open credit lines, with plausible ranges. The fourth is the stage of the lifecycle at which the attack happens: at training time, by contaminating the data, or at deployment time, by manipulating inputs. Only once all four parts are fixed does the robustness property have content. "This classifier is robust" means nothing. "This classifier's accuracy on the test set remains above 60 percent against any white-box attacker who may alter each pixel by at most 8/255" is a property. It can be measured, and it can be false. The same structure applies to the other two properties, though the vocabulary differs. For fairness the threat model becomes a harm model: which groups are protected, which decision is at issue, which distribution of outcomes counts as unjust, and against what baseline. "The model is fair" is a value. "Among applicants who would in fact repay, the approval rate for Black applicants is within two percentage points of the approval rate for white applicants" is a property, specifically a version of what Chapter 4 calls equal opportunity, and it can be checked against data. For privacy, the threat model specifies who might try to learn what about whom: an outsider querying a deployed model to discover whether a particular patient's record was in its training set, an insider with access to a released dataset and an auxiliary voter roll, a recipient of pseudonymised data with or without the means to reverse the pseudonyms. "The data are anonymous" is a value or a legal conclusion. "No attacker with access to the released model and to public records can determine membership of any individual record with a true positive rate above one percent at a false positive rate of 0.1 percent" is a property. These examples are illustrative, but each element is drawn from the way the respective research fields actually state their results. The common thread is that a property names an adversary or a harm, fixes a measure, and sets a threshold. Why explicit threat models change the answer It might seem that this is pedantry, that any competent engineer knows roughly what robustness or privacy means and the formal statement merely writes it down. The history of all three fields says otherwise. Again and again, systems that were believed to be robust, fair or private turned out not to be, and the reason was almost always that the threat model had been left implicit and the actual adversary did something outside it. In robustness, the canonical episode came in 2018. A group of defences against adversarial examples had been accepted at the International Conference on Learning Representations, one of the field's leading venues. Anish Athalye, Nicholas Carlini and David Wagner examined the nine that made white-box robustness claims and found that seven of them relied on a phenomenon they named "obfuscated gradients": the defences made the model's gradients uninformative, so that standard gradient-based attacks failed, without making the model any harder to fool. When the authors designed attacks that worked around the obfuscation, six of the seven were broken completely and one partially. The defences had been evaluated against a threat model in which the attacker used one particular family of methods. The real threat model, an attacker who knows the defence and adapts to it, had not been tested. In privacy, the classic episode is older. In the late 1990s Latanya Sweeney showed that the Massachusetts Group Insurance Commission's release of "anonymised" state employee hospital records could be linked to a voter roll using only date of birth, sex and five-digit ZIP code, and famously identified the record of the state's then governor. She later estimated that this combination of three attributes was enough to identify a large majority of the US population uniquely, with the frequently quoted figure being 87 percent based on 1990 census data. The implicit threat model behind the release was an attacker with only the released file. The real attacker had a second file. In fairness, the pattern is subtler but just as consistent. Lenders who removed race from their models, believing that a model blind to race could not discriminate by race, found that variables correlated with race, such as postcode, the college attended or patterns of spending, could reproduce much of the same disparity. The implicit harm model treated discrimination as the use of a protected attribute. The harm that regulators and courts actually recognise, at least in many jurisdictions, includes unjustified disparities in outcome however they arise. Each of these failures has the same shape. A property was claimed against a narrow, unstated model of the threat, the real threat was wider, and the claim collapsed. Stating the threat model explicitly does not guarantee that it is the right one, but it does two indispensable things. It makes the claim falsifiable, so that someone can show it is wrong. And it makes the scope of the claim visible, so that the people relying on it know what it does not cover. Measurement, and the problem of the tail A property needs a measurement, and here a second set of traps opens up. The most common is to report an average when the property concerns a tail. Robustness is about the worst case within a threat model, not the average case. A model that resists ninety-nine out of a hundred randomly chosen perturbations of a given size may still be broken by the hundredth, and an adversary will search for the hundredth. That is why serious robustness evaluation reports accuracy under the strongest available attack, or a certified lower bound that holds against every possible attack within the budget, rather than accuracy under random noise. Chapter 3 returns to this distinction, which separates defences that work from defences that merely look as though they work. Privacy has the same structure. Membership inference attacks, which try to determine whether a particular record was used in training, were long evaluated by their average accuracy across all records. A 2022 paper by Carlini and colleagues argued that this was the wrong measure: an attack that is barely better than a coin toss on average can still identify a small number of individuals with near certainty, and those individuals, often the outliers whose records the model has effectively memorised, are exactly the ones whose privacy is at stake. The authors proposed reporting the true positive rate at a very low false positive rate instead, and that has become standard practice. The shift sounds technical, but it changes conclusions: methods that looked private by the average measure look much less so by the tail measure. Fairness is typically measured by comparing rates across groups, and the tail problem there takes the form of small groups and intersections. A lending model can show equal approval rates for men and women and for each of several racial groups considered separately, while showing large disparities for, say, older women of a particular ethnicity. Kimberlé Crenshaw's concept of intersectionality, developed in legal scholarship in 1989, has a direct statistical counterpart: the number of subgroups grows multiplicatively with each attribute considered, the data available for each shrinks, and the measured disparities become noisy. A fairness property must say which groups it covers, and a fairness measurement must report its uncertainty, or it will hide the cases that matter most. From measurement to claim The third step is to turn a measurement into a claim that can be relied upon by someone other than the engineer who made it. That requires saying under what conditions the measurement holds. A robustness measurement holds for a particular threat model, a particular data distribution and a particular version of the model. If the deployment data drift away from the evaluation data, as they almost always do, the measurement may no longer hold. A fairness measurement holds for a particular population and time period; a credit model evaluated on applicants from 2019 may behave very differently on applicants from 2023, after a pandemic, a period of high inflation and a change in who applies. A privacy measurement holds for the attacks that were tried, unless it is backed by a formal guarantee like differential privacy, in which case it holds for all attacks but only for the specific mathematical definition, with its specific parameters, that was proved. The emerging regulatory frameworks all, in their different vocabularies, demand exactly this kind of conditional claim. The US National Institute of Standards and Technology's AI Risk Management Framework, released in January 2023, organises its recommendations around four functions: govern, map, measure and manage. Mapping corresponds closely to specifying the threat or harm model; measuring to fixing metrics and test procedures; managing to deciding what to do about the residual risks. The framework lists characteristics of trustworthy systems, among them being valid and reliable, safe, secure and resilient, privacy-enhanced, and fair with harmful bias managed, but it is explicit that these characteristics must be evaluated in context and that improving one may come at the cost of another. The EU AI Act takes a more prescriptive approach for systems it classifies as high-risk, which include systems used to evaluate the creditworthiness of individuals or establish their credit score, other than systems used to detect financial fraud. Article 10 requires that training, validation and testing data be subject to governance practices that include examination for possible biases likely to affect health, safety or fundamental rights or to lead to prohibited discrimination, and appropriate measures to detect, prevent and mitigate them. Article 15 requires that such systems achieve an appropriate level of accuracy, robustness and cybersecurity, that accuracy metrics be declared in the instructions for use, and that the systems be resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting vulnerabilities. It names data poisoning, model poisoning, adversarial examples and confidentiality attacks explicitly. None of these provisions tells an engineer what number to hit. All of them require the engineer to be able to state, with evidence, what the system does and how that was established. The GDPR, which predates all of this, is in some ways the most demanding. Its accountability principle, in Article 5(2), places on the controller the burden of being able to demonstrate compliance. A company that claims its training data are anonymous, and therefore outside the regulation, must be able to show that identification is not reasonably likely given the means available. That is a property claim with a threat model built into it, and Chapter 6 shows how the European courts and regulators have been filling in the details. The shape of the trade-offs If each of the three properties can be stated, measured and claimed in this way, why not simply maximise all of them? Because they compete with each other and with the thing the model was built to do. The competition with accuracy is the most familiar. Adversarially trained image classifiers are typically less accurate on clean inputs than their standard counterparts; models trained with strong differential privacy guarantees are typically less accurate than models trained without them; and constraining a lending model to approve equal proportions of two groups whose measured repayment rates differ will, by construction, change some decisions away from what the unconstrained model would have chosen. In each case the size of the cost is an empirical question that depends on the data, and sometimes it is small. But it is rarely zero, and claiming that it is zero is usually a sign that the property has been defined too weakly. The competition among the properties themselves is less familiar and, for practitioners, more important. Chapter 8 sets out the evidence in detail, but the headline findings are worth stating now so that they can be kept in view. Adversarial training, which improves robustness, has been shown to increase a model's vulnerability to membership inference, because robust models tend to fit their training points in a way that makes them more distinguishable. Differentially private training, which improves privacy, tends to reduce accuracy most for underrepresented groups, because the noise it adds swamps the weaker signal available from fewer examples. Enforcing some fairness constraints has been shown to increase the privacy risk for members of the groups the constraint protects. And adversarial training can widen the gap in accuracy between classes, making the robust model less even in its errors. None of these interactions is a law of nature with a fixed magnitude. Each depends on the data, the model and the specific methods used, and researchers continue to find ways of reducing the tension. But they are real enough that a system optimised for one property, with the others left to chance, will often be worse on the others than a system that was never optimised at all. This is the deepest reason for insisting on properties rather than principles. A list of principles lets everyone believe that all the good things can be had at once. A set of properties, each with a measure and a threshold, forces the question of which matters more when they conflict, by how much, and who gets to decide. The remaining chapters take each property in turn and then return to that question. Chapter 2: How Models Break The paper that opened the modern study of adversarial examples was not looking for them. In late 2013 a team at Google, led by Christian Szegedy and including Ian Goodfellow, was investigating what the units inside deep neural networks represent. Along the way they reported something they called an "intriguing property": for every image in their test set that a state-of-the-art classifier labelled correctly, they could find a second image, differing from the first by changes too small for a person to see, that the classifier labelled wrongly, often with high confidence. A school bus became an ostrich. The perturbations were not random noise; random noise of the same size did almost nothing. They were found by optimisation, by asking which direction in the space of images most quickly increased the classifier's error. Two further observations in that paper shaped everything that followed. The perturbations were not idiosyncratic to one model: an image crafted to fool one network often fooled others trained separately, even with different architectures or on different subsets of the data. And the phenomenon was not confined to one architecture or dataset. It appeared to be a general property of the high-dimensional models that were then beginning to dominate computer vision. More than a decade later, that remains true. Adversarial examples have been found in every kind of learned model that has been seriously examined: image classifiers, speech recognisers, malware detectors, models of tabular financial data, and large language models. This chapter explains how the attacks work, why they work, and how they generalise beyond the tidy laboratory setting in which they were discovered. The point is not to catalogue every attack but to show the structure that any defence, the subject of Chapter 3, has to confront. The geometry of a perturbation A classifier takes an input, such as an image represented as a long list of pixel intensities, and assigns it to a class. Internally it computes a score for each class and picks the highest. Training adjusts the model's parameters so that the right class scores highest on the training examples. What training does not do is control how the scores behave in the vast space of inputs that are not in the training set, and in particular in the immediate neighbourhood of each training point. Imagine the input space as a landscape in which each point is a possible image and the decision boundaries are the borders between regions assigned to different classes. In two or three dimensions our intuition says that a correctly classified point is usually comfortably inside its region. In the hundreds of thousands of dimensions of a real image, that intuition fails. A point can be far from the boundary in almost every direction yet very close to it in a few, and an attacker needs to find only one such direction. Goodfellow, Jonathon Shlens and Szegedy offered an explanation in 2015 that is still the most useful starting point. Many neural networks, despite their nonlinear components, behave approximately linearly in the neighbourhood of a given input. For a linear function, a small change to each of many inputs, each change chosen to push the output in the same direction, adds up to a large change in the output. If an image has a hundred thousand pixels and the attacker nudges each by a barely visible amount in whichever direction increases the score of the wrong class, the cumulative effect on the score can be enormous. High dimension is what makes the attack cheap. From this explanation came the fast gradient sign method, the simplest attack and still a common baseline. The attacker computes the gradient of the model's loss with respect to the input, which tells them, for each pixel, whether brightening or darkening it would increase the error. They then move every pixel by the same small amount in the indicated direction. One step, one gradient computation, and in 2015 that was enough to fool most undefended image classifiers on most inputs. The stronger attacks that followed refine this idea rather than replace it. Projected gradient descent, set out as a standard by Aleksander Madry and colleagues in 2018, takes many small steps instead of one large one, and after each step projects the image back into the allowed region so that the total perturbation never exceeds the budget. It is, in effect, a careful search for the worst-case input within the threat model. Nicholas Carlini and David Wagner's attacks of 2017 cast the problem as an optimisation that finds the smallest perturbation sufficient to change the label, and were the first to break a defence, called defensive distillation, that had been reported as highly effective. In 2020 Francesco Croce and Matthias Hein combined several complementary attacks into a parameter-free ensemble called AutoAttack, which became the standard benchmark for evaluating defences precisely because it removed the evaluator's freedom to tune the attack weakly. How big is small Every one of these attacks operates within a budget, and the budget is the part of the threat model most often misunderstood. Researchers measure the size of a perturbation by a norm, a way of collapsing the list of changes into a single number. The most common is the L-infinity norm, which is simply the largest change made to any single pixel. A budget of 8/255 under this norm means that no pixel's intensity may change by more than eight levels out of 255. Another common choice, the L2 norm, measures the overall energy of the perturbation, allowing larger changes to some pixels if others are left alone. The L0 norm counts how many pixels are changed at all, which corresponds to attacks that alter a small patch. These norms are mathematical conveniences. None corresponds exactly to human perception, and none corresponds to every attack that matters. A small rotation or a slight change in lighting can move an image a long way in L-infinity distance while leaving it perfectly recognisable to a person. A sticker on a stop sign is large in L-infinity terms but confined to a small area. A model that is certified robust against all L-infinity perturbations of size 8/255 has been certified against exactly that and nothing else. This is the first lesson for anyone reading a robustness claim: ask what the budget was, in what norm, and whether that budget bears any relation to what an attacker in the deployment setting could actually do. Attacks without the weights The white-box setting, in which the attacker has full access to the model, is the most powerful and the one most used in research, because a defence that survives a white-box attacker is likely to survive weaker ones. But it is fair to ask whether real attackers have that access. Often they do not. Deployed models sit behind interfaces that return a label or a score, and their weights are trade secrets. Unfortunately, this offers less protection than it seems, for two reasons. The first is transferability, the property Szegedy's team noticed in 2013. An attacker who cannot see the target model can train a substitute model on similar data, craft adversarial examples against the substitute, and use them against the target. Nicolas Papernot and colleagues demonstrated this against commercial machine learning services in 2016 and 2017, training substitutes by querying the target and using its answers as labels, and achieving high rates of misclassification on models they had never seen. Transfer rates are not perfect, and they vary with how similar the substitute is to the target, but they are high enough to make secrecy a weak defence. The second reason is that queries themselves leak information about the decision boundary. Score-based attacks estimate the gradient by observing how the model's confidence changes as the input is varied slightly. Decision-based attacks, introduced by Wieland Brendel and colleagues in 2018, need only the final label: they start from an input that is already misclassified and walk it step by step back towards the original, staying always on the wrong side of the boundary, until the difference becomes imperceptible. These attacks need many queries, often thousands, which makes them detectable in principle if the operator is watching. But they work, and they work against systems whose internals the attacker never sees. Out of the laboratory Early critics argued that adversarial examples were an artefact of the digital setting. A perturbation calculated to the exact pixel would not survive being printed, photographed under different light and viewed from a different angle. That argument did not last long. In 2016 Mahmood Sharif and colleagues printed patterned eyeglass frames that, when worn, caused a face recognition system to misidentify the wearer as a specific other person. In 2017 and 2018 the stop sign work by Kevin Eykholt and colleagues, mentioned in the Introduction, produced perturbations that survived real-world variation by optimising them over a range of simulated distances, angles and lighting conditions. Anish Athalye and colleagues formalised this approach as "expectation over transformation" and used it to 3D-print a model turtle that a standard image classifier identified as a rifle from almost every viewpoint. The general recipe is now well understood: if the attacker can model the transformations the physical world will apply, they can optimise a perturbation that is robust to all of them. The relevance of physical attacks depends entirely on the application. For a lending model they are irrelevant; nobody photographs a loan application. For an autonomous vehicle, a security camera or a medical imaging system they are central. A threat model that ignores the physical channel when the system operates in the physical world is not conservative; it is wrong. Poisoning the well Everything so far concerns attacks at deployment time, on a model that has already been trained. A second family of attacks targets training itself. In a poisoning attack, the adversary inserts carefully chosen examples into the training data so that the resulting model behaves as they wish. The most alarming version is the backdoor. Tianyu Gu, Brendan Dolan-Gavitt and Siddharth Garg showed in 2017, in a paper titled BadNets, that a model could be trained to behave normally on ordinary inputs but to produce an attacker-chosen output whenever a specific trigger, such as a small yellow square, appeared. Their demonstration used a street sign classifier in which a sticker caused stop signs to be read as speed limits. Because the model performs well on standard tests, a backdoor can pass every conventional evaluation. It reveals itself only when the trigger is present. Poisoning was once thought to require insider access to the training pipeline. The scale of modern training data has changed that. Large models are increasingly trained on data scraped from the web, and the web is writable. In a paper published at the IEEE Symposium on Security and Privacy in 2024, Carlini and colleagues examined two practical poisoning routes. One exploits the fact that large image-text datasets are distributed as lists of URLs rather than as the images themselves, so that whoever controls a domain when the data are downloaded controls what the model sees; they found that expired domains referenced by these datasets could be purchased, and estimated that for about sixty US dollars an attacker could have controlled 0.01 percent of either of two widely used datasets, LAION-400M and COYO-700M, in 2022. The other route exploits periodic snapshots of crowd-edited sites such as Wikipedia, by timing malicious edits to land just before a snapshot is taken. Whether 0.01 percent of a dataset is enough to do damage depends on the attack's goal, but earlier work had shown that targeted poisoning can succeed with very small fractions. For a lending model trained on a firm's own historical applications, web-scale poisoning is not the concern. But a related problem is: if the training data include decisions or outcomes that were themselves manipulated, for instance by applicants who learned to game an earlier model or by fraud rings that cultivated accounts before defaulting, the model will learn the manipulation as if it were signal. Adversaries in a spreadsheet Most of the adversarial literature concerns images, because that is where it began and where the threat models are easiest to state. Tabular models, the kind that score loan applications, detect fraud and set insurance premiums, raise different questions, and the differences matter for anyone deploying them. The first difference is that tabular inputs have meaning and constraints. A pixel can take any value between 0 and 255; an applicant's age cannot decrease, their number of past defaults cannot be negative, and their income and debt-to-income ratio must be consistent. An adversarial perturbation that sets someone's age to 17.3 or their credit utilisation to minus four percent is not an attack; it is a malformed input that validation should reject. Research on tabular adversarial examples, such as work by Vincent Ballet and colleagues in 2019, has therefore concentrated on perturbations that respect domain constraints and change features the attacker can plausibly control. The second difference is that the line between attack and legitimate behaviour is blurred. An applicant who pays down a credit card before applying in order to improve their utilisation ratio is changing an input to obtain a better outcome. So is a fraudster who structures transactions to stay below a detection threshold. The first is often what a lender would want to encourage; the second is what it must prevent. The study of strategic classification, formalised by Moritz Hardt and colleagues in 2016, treats this as a game between a decision-maker who publishes a rule and individuals who adapt their features in response at some cost. One of its conclusions is uncomfortable: a classifier that is optimal on the data it was trained on may perform badly once people respond to it, and the best response to gaming may be to rely on features that are costly to change, which can in turn disadvantage people for whom every change is costly. Robustness, in this setting, is already entangled with fairness. The third difference is that the attacker's goal is often to move a single decision rather than to cause general misclassification. A loan applicant does not care whether the model misclassifies anyone else; they care whether they are approved. That makes the relevant threat model targeted and individual, and it makes the measure of interest the cost to an applicant of crossing the decision boundary, which is closely related to the "recourse" that adverse action notices are meant to provide. If a rejected applicant is told that their debt-to-income ratio was the principal reason, they have been given, among other things, a hint about which direction to push. Language models and the generalised attack The arrival of large language models has extended the adversarial problem to a new kind of input: instructions. Developers align these models, through additional training, to refuse certain requests. Attackers try to craft inputs, known as jailbreaks, that elicit the refused behaviour anyway. In 2023 Andy Zou and colleagues showed that automated optimisation, conceptually similar to the gradient attacks on images, could find strings of apparently meaningless tokens that, appended to a harmful request, caused aligned open models to comply, and that suffixes found against open models often transferred to commercial ones. The parallel with image attacks is exact: the model behaves well on the distribution of inputs it was trained on and badly on inputs found by search. A related threat, prompt injection, arises when a language model processes content from an untrusted source, such as a web page, an email or a document, that contains instructions. If the model cannot reliably distinguish the instructions of its operator from instructions embedded in data, an attacker who controls the data controls the model. Kai Greshake and colleagues demonstrated indirect prompt injection against applications built on commercial models in 2023. For any organisation that uses a language model to read loan documents, summarise customer correspondence or assist in decisions, this is not an exotic risk. A taxonomy to work with The attacks in this chapter vary along the dimensions of the threat model set out in Chapter 1, and it helps to see them laid out together. The US National Institute of Standards and Technology maintains a reference taxonomy for exactly this purpose, most recently updated in March 2025 as NIST AI 100-2 E2025, which classifies attacks on predictive and generative systems by the stage of the lifecycle they target, the attacker's goals and the attacker's knowledge and capabilities. Table 1 compresses the main families into that frame. Table 1. Principal families of attack on machine learning systems. Attack family Stage Attacker access and goal Example White-box evasion Deployment Full weights; misclassify chosen inputs Projected gradient descent; AutoAttack Black-box evasion Deployment Queries or a substitute model; misclassify chosen inputs Transfer attacks; boundary attack Physical evasion Deployment Ability to alter real objects Stop sign stickers; eyeglass frames Poisoning and backdoors Training Influence over training data; degrade or plant a trigger BadNets; expired-domain poisoning Strategic manipulation Deployment Knowledge of features; move one's own decision Gaming credit inputs; structuring Jailbreak and injection Deployment Text input or content the model reads; override behaviour Adversarial suffixes; indirect injection The table hides one point that should be explicit. These families are not independent. A model hardened against evasion may remain completely open to poisoning, and a model trained on clean data may still be evaded. A threat model has to say which families it covers, and a defence has to be evaluated against the families it claims to resist. Why the problem does not go away It would be comforting to believe that adversarial vulnerability is a bug, a sign of immature models that larger datasets and better architectures will fix. The evidence of the past decade points the other way. Andrew Ilyas, Aleksander Madry and colleagues argued in 2019, in a paper titled "Adversarial Examples Are Not Bugs, They Are Features", that standard training rewards models for using any pattern in the data that predicts the label, including patterns that are genuinely predictive but imperceptible and brittle to humans. Their experiments showed that a model trained only on such "non-robust features", on images that looked mislabelled to people, could still generalise to correctly labelled test data. If that account is right, adversarial vulnerability is not a failure of learning but a consequence of learning too well from the data as given. A model that is to be robust must be told, through its training objective, which features it is not allowed to rely on. That is the starting point for Chapter 3. The defences that survive serious scrutiny are those that change what the model is trained to do, or that prove mathematically what it cannot do, rather than those that try to hide its weaknesses from the attacker. Chapter 3: Defences That Survive Scrutiny The literature on defending machine learning models against adversarial examples is large, and most of it is wrong. That is not a polemical claim. It is the considered view of many of the researchers who know the field best, and it is supported by a series of systematic re-evaluations in which published defences, each accompanied by experiments showing that it worked, were broken by attacks designed with knowledge of how the defence operated. Reading this literature without a framework for judging it is a reliable way to end up deploying protection that does not protect. This chapter provides that framework. It begins with the one empirical defence that has held up over many years of attack, adversarial training, and explains what it costs. It then sets out the discipline of evaluation that separates real robustness from apparent robustness. It turns next to certified defences, which replace empirical claims with mathematical proofs, and explains why they are both more trustworthy and more limited. And it ends by widening the lens from deliberate attackers to the much more common threat of ordinary change in the world, which for most deployed systems, including credit models, is where robustness is won or lost. Training against the attacker The idea behind adversarial training is simple: if the model fails on adversarial examples, include adversarial examples in its training. Szegedy's team suggested it in 2013 and Goodfellow's team developed it in 2015, but early versions trained against weak, single-step attacks and produced models that resisted those attacks while remaining vulnerable to stronger ones. The decisive formulation came from Aleksander Madry and colleagues in a paper published in 2018. They framed robust training as a contest between two players. An inner player, the attacker, searches within the threat model's budget for the perturbation that maximises the model's loss on each training example. An outer player, the learner, adjusts the model's parameters to minimise the loss on those worst-case examples. In practice the inner search is done with projected gradient descent, the multi-step attack described in Chapter 2, and each training step therefore requires running an attack on every example in the batch. Models trained this way were the first to show robustness that survived sustained attack. Years later, after many attempts by many groups, the core approach has not been broken in the sense that matters: within the threat model it was trained for, its measured robustness under the strongest known attacks has stayed roughly where it was originally reported. Almost every defence near the top of public robustness leaderboards today is a descendant of it. The costs are substantial, and anyone deploying the method should know them in advance. The first is compute. Running a ten-step attack on every training example makes each epoch roughly an order of magnitude more expensive than standard training. Eric Wong, Leslie Rice and Zico Kolter showed in 2020 that a carefully configured single-step method could recover much of the benefit at a fraction of the cost, though it requires care to avoid a failure mode in which the model suddenly loses its robustness partway through training. The second cost is clean accuracy. Adversarially trained image classifiers are reliably less accurate on unperturbed inputs than standard ones. On small benchmarks the gap has been large, often ten percentage points or more, though it has narrowed as methods improved and as researchers added large amounts of additional training data, including synthetic images produced by generative models. Dimitris Tsipras and colleagues argued in 2019, in a paper titled "Robustness May Be at Odds with Accuracy", that some of this gap is fundamental rather than a sign of immature methods: in their theoretical examples, the features that give the highest standard accuracy are precisely the brittle ones that a robust model must give up. A method called TRADES, proposed by Hongyang Zhang and colleagues in 2019, made the trade explicit by introducing a single parameter that sets how much clean accuracy the practitioner is willing to sacrifice for each unit of robustness. That parameter is a useful reminder that the trade-off is a choice, not an accident. The third cost is narrowness. A model adversarially trained against perturbations bounded in one norm is not, in general, robust against perturbations bounded in another, nor against rotations, colour shifts or patches. Training against several threat models at once is possible but compounds the costs. The protection extends as far as the threat model and not much further. The fourth cost, which Leslie Rice, Eric Wong and Zico Kolter documented in 2020, is a peculiar kind of overfitting. As adversarial training continues, robust accuracy on the training set keeps rising while robust accuracy on held-out data peaks and then declines. Standard training rarely shows this pattern so sharply. The practical consequence is that adversarially trained models need early stopping based on robust validation accuracy, which in turn requires running attacks on the validation set throughout training. The discipline of evaluation If adversarial training is the one defence that has survived, why did so many others appear to work? The answer lies almost entirely in how they were evaluated. The obfuscated gradients episode of 2018, described in Chapter 1, revealed the most common failure. A defence that makes the model's gradients noisy, discontinuous or uninformative will defeat gradient-based attacks that rely on those gradients, without making the model any harder to fool by other means. Some defences did this deliberately, by adding randomness or non-differentiable preprocessing; others did it accidentally, through numerical effects. Either way the defence was evaluated against attacks that it had disabled rather than defeated. In 2019 a group of researchers including Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry and Alexey Kurakin published "On Evaluating Adversarial Robustness", a set of recommendations that amounts to a code of practice for anyone making a robustness claim. Its central principle is that the evaluation must use adaptive attacks: attacks designed by someone who knows exactly how the defence works and is trying to circumvent it. Running the standard attack from a software library is not an evaluation; it is a smoke test. The paper also lists warning signs that should make any reader of a robustness claim suspicious, and they are worth knowing because they can be checked without deep expertise. If black-box attacks, which have less information, succeed more often than white-box attacks, the white-box attacks are probably being obstructed by gradient masking. If increasing the perturbation budget without limit does not eventually drive accuracy to zero, something is wrong with the attack, since a large enough change can turn any image into any other. If adding random noise is more effective than the optimised attack, the optimisation is failing. If the defence is evaluated only against attacks published before it, and never against attacks designed for it, the claim is untested. A year later Florian Tramèr, Nicholas Carlini, Wieland Brendel and Aleksander Madry put these principles into practice. In "On Adaptive Attacks to Adversarial Example Defenses", they took thirteen recently published defences, each of which had claimed robustness against adaptive attacks, and circumvented all thirteen, in most cases by tailoring the attack to the specific mechanism of the defence. Their paper is written partly as a tutorial: for each defence it explains what the authors' evaluation missed and how a more careful evaluation would have caught it. Detection-based defences, which try to recognise adversarial inputs and reject them rather than classify them correctly, have fared no better. In 2017 Carlini and Wagner examined ten published detection methods and showed that all of them could be bypassed by attacks that took the detector into account. The general lesson is that a detector is just another model, and an attacker can optimise against the combined system as easily as against the classifier alone. The field's institutional response to this history was standardisation. RobustBench, launched in 2020 by Francesco Croce, Maksym Andriushchenko and colleagues at the University of Tübingen and EPFL, maintains public leaderboards of robust accuracy on standard benchmarks under fixed threat models, evaluated with the AutoAttack ensemble. By removing the evaluator's ability to choose a weak attack, it makes claims comparable. The leaderboards also carry an implicit message for practitioners. Even the best models on them, under modest perturbation budgets on small image benchmarks, are robust on a substantially smaller fraction of inputs than the fraction they classify correctly when unperturbed. Adversarial robustness remains a partial achievement. Proof instead of evidence Empirical defences, however carefully evaluated, can only show that the attacks tried so far have failed. A better attack might succeed tomorrow. Certified defences take a different approach: they prove that no perturbation within a specified budget can change the model's output on a given input. The claim is no longer that nobody has found an adversarial example, but that none exists. The most direct approach is exact verification. Given a trained network and an input, a verification algorithm searches exhaustively for an adversarial example within the budget and either finds one or proves that there is none. Guy Katz and colleagues' Reluplex system, published in 2017, adapted techniques from software verification to networks built from the most common type of nonlinear unit and used them to verify properties of a prototype collision-avoidance system for aircraft. Exact verification gives the strongest possible answer, but the problem it solves is computationally hard in general, and it scales poorly to the large networks used in practice. A second family of methods trades exactness for speed by computing bounds. Starting from the range of allowed inputs, these methods propagate an interval or a more refined set through each layer of the network to obtain a guaranteed range of outputs. If the correct class's score is guaranteed to exceed every other class's score across that whole range, the input is certified. The bounds are conservative, so some inputs that are in fact robust will not be certified, but the computation is fast. Training the network with these bounds in the loop, a technique known as interval bound propagation and developed by Sven Gowal and colleagues at DeepMind in 2018, produces networks that are much easier to certify. The third and, for many purposes, most practical family is randomised smoothing, set out rigorously by Jeremy Cohen, Elan Rosenfeld and Zico Kolter in 2019. The idea is to replace the original classifier with a smoothed version: to classify an input, add random Gaussian noise to it many times, run the original classifier on each noisy copy, and return the class that wins the majority vote. Cohen and colleagues proved that if one class wins the vote by a sufficient margin, the smoothed classifier's prediction cannot be changed by any perturbation smaller than a radius that can be calculated from that margin and the noise level. The guarantee holds regardless of how the underlying classifier works. Randomised smoothing scales to large models and large images, which exact methods cannot. Its costs are that each prediction requires many forward passes through the model, that the certificate is naturally stated in the L2 norm rather than the L-infinity norm often used elsewhere, and that heavier noise, which gives larger certified radii, reduces accuracy. Across all three families, certified robust accuracy is lower than the empirical robust accuracy of the best adversarially trained models for the same threat model. That gap is the price of certainty. For a system where an attacker who finds a single failure can cause serious harm, the price may be worth paying. For a system where occasional failures are tolerable and monitored, an empirically robust model evaluated with full rigour may be the better choice. Either way, the claim made about the system should say which kind of evidence supports it. The more common enemy For all the attention adversarial examples receive, most models deployed in the real world do not fail because an adversary attacked them. They fail because the world changed. The data a model sees in deployment drift away from the data it was trained on, slowly or suddenly, and its performance degrades in ways that standard test-set accuracy does not predict. The evidence for how fragile standard models are under natural shift is sobering. In 2019 Benjamin Recht and colleagues built a new test set for ImageNet, the benchmark on which much of modern computer vision was developed, by following the original data collection procedure as closely as they could. Models' accuracy on the new test set dropped by roughly eleven to fourteen percentage points, even though the images were drawn, as far as anyone could tell, from the same kind of source. Dan Hendrycks and Thomas Dietterich published a benchmark the same year that applied common corruptions, such as blur, fog, frost and digital compression artefacts, at graded levels of severity, and found that standard models degraded sharply. The WILDS benchmark, assembled by Pang Wei Koh and colleagues in 2021, collected real distribution shifts from domains including medical imaging, satellite imagery and text, and showed that methods designed to improve robustness to shift often did not outperform standard training. Credit models face distribution shift constantly. The population of applicants changes with marketing campaigns, competitor behaviour and the economic cycle. The relationship between features and repayment changes too. The COVID-19 pandemic offered an extreme example: government support programmes, payment holidays and forbearance meant that for a period many borrowers showed fewer recorded delinquencies than their circumstances would previously have predicted, and models trained on pre-pandemic relationships had to be reconsidered once those programmes ended. Inflation, interest rate changes and new forms of credit such as buy-now-pay-later products have each altered what familiar variables mean. The credit industry developed tools for this long before machine learning became fashionable. The population stability index, a simple measure that compares the distribution of a score or a variable in current applicants with its distribution in the development sample, has been a staple of credit model monitoring for decades. Banking supervisors have long expected model risk management programmes that include independent validation and ongoing monitoring; in the United States the Federal Reserve and the Office of the Comptroller of the Currency set out a widely adopted framework for this in their 2011 supervisory guidance on model risk management, known as SR 11-7, which introduced the useful notion of "effective challenge" by qualified people independent of the model's developers. These practices are the unglamorous core of robustness for most deployed systems, and they deserve more attention from machine learning teams than they typically get. Defending a credit model What does all this mean for a concrete system, such as a model that scores applications for unsecured personal loans? The threat model differs from the image classification setting in several ways, and the defences differ accordingly. Perturbation-style evasion matters less, because applicants cannot make imperceptible changes to many continuous features at once. What matters is the small number of features an applicant controls or can misrepresent, such as stated income, employment details and the purpose of the loan, and the risk that the model's response to those features rewards manipulation. The first line of defence is therefore verification of inputs against independent sources, which is a business process rather than a modelling technique. The second is to examine the model's sensitivity to the features that applicants control: if a small increase in stated income moves a large number of applicants across the approval threshold, the model has created an incentive that will be exploited. Monotonicity constraints are a useful tool here. Many gradient boosting libraries, the workhorses of tabular modelling, allow the developer to require that the model's output never decrease as a given input increases, or never increase. Requiring that predicted risk does not fall as the number of past delinquencies rises, for example, rules out a class of perverse behaviours in which an unusual combination of inputs produces an implausible score. Such constraints usually cost little accuracy, they make the model's behaviour easier to explain, and they close off some of the strange regions of input space that adversarial and strategic manipulation exploit. For models exposed through an online interface, the decision-based attacks described in Chapter 2 are a practical concern. An applicant or a fraud ring that can submit many slightly varied applications and observe the outcomes can map the decision boundary. Rate limits, monitoring for clusters of near-duplicate applications and refusing to disclose scores beyond what the law requires are all sensible. So is recognising that the adverse action reasons a lender must provide to rejected applicants, which Chapter 5 discusses, reveal something about the boundary by design; that is a deliberate policy choice in favour of transparency and recourse, and the robustness analysis should account for it rather than try to evade it. Poisoning risk for a credit model comes mainly from the training labels. If a fraud ring cultivates accounts that perform well for a period before defaulting together, or if earlier model versions created feedback loops in which only approved applicants generated outcome data, the training set will carry those distortions forward. The defences are good data provenance, careful construction of the outcome variable and analysis of whether the training population is representative of the population the model will score, a problem the credit industry calls reject inference. Finally, there is distribution shift, which for a credit model is not a possibility but a certainty. Monitoring of input distributions, score distributions and realised performance, with predefined thresholds that trigger review, is the most important robustness measure most credit models will ever have. What a credible robustness claim looks like Pulling these threads together, a robustness claim that deserves trust has a recognisable form. It states the threat model in full: the attacker's goal, knowledge, capabilities and the stage of the lifecycle. It states the measure, whether empirical robust accuracy under named attacks or a certified bound, and gives the numbers alongside clean accuracy so that the trade-off is visible. It describes how the evaluation was made adaptive, or acknowledges that it was not. It says what the claim does not cover, including other norms, other attack families and natural distribution shift. And it describes the monitoring that will detect when the conditions under which the claim was made no longer hold. That is a demanding standard, and few deployed systems meet it. But each of its elements responds to a specific way in which robustness claims have failed in the past, and the EU AI Act's requirement that high-risk systems be resilient against attempts to exploit their vulnerabilities, with their accuracy metrics declared, is in effect a requirement to be able to produce something like it. The same pattern of property, measure and stated limits now carries over to fairness, where the threat is not an adversary but a distribution of outcomes, and where the first problem is deciding what to measure at all. Hashtags: #TrustworthyAI #AIRobustness #AIFairness #AIPrivacy #ResponsibleAI #EthicalAI #ArtificialIntelligence #AITrustworthiness #AIAccountability #AIGovernance #AIRiskManagement #AdversarialMachineLearning #AdversarialAttacks #AdversarialTraining #RobustMachineLearning #AlgorithmicFairness #AlgorithmicBias #BiasMitigation #DemographicParity #FairLending #DataPrivacy #DifferentialPrivacy #PrivacyPreservingAI #DataAnonymization #GDPRCompliance #EUAIAct #ModelSecurity #AIThreatModeling #ModelEvaluation #AICompliance

Download the Book (PDF): Introduction Consider a third-year engineering student who used to play the piano. Not seriously, not for exams, just in the evenings, badly and happily, working through the same few pieces until her fingers found them. In her first year she played three or four nights a week. In her second year the problem sets got longer and she told herself she would pick it up again after midterms. By her third year the keyboard in her room had become a surface for textbooks. She is not failing anything. Her grades are fine. But she wakes up tired, she has stopped caring about material she once found beautiful, and she has a quiet, persistent sense that nothing she does is good enough. When a friend asks what she does for fun, she has to think about it. This is one of the most common shapes academic life takes, and it rarely looks like a crisis from the outside. It looks like responsibility. Each individual decision to drop the piano was reasonable. Each hour reclaimed went to something that mattered. And yet the sum of those reasonable decisions produced a person who is running on less, caring about less, and believing in herself less than she did two years earlier. Those three changes, exhaustion, detachment, and a falling sense of competence, are the core of what researchers mean by burnout. This book makes a specific argument about that pattern. It is not that art is magic, nor that every student should take up watercolors. The argument is this: a creative outlet pursued for its own sake protects against academic burnout because it supplies the particular experiences that academic life systematically withholds, namely mental distance from the work, a sense of mastery that nobody is grading, genuine control over what you do and how, and the kind of deep absorption that lets a mind recover rather than merely pause. The protection depends on a condition that is easy to state and surprisingly easy to violate: the outlet has to stay outside the machinery of evaluation. The moment your hobby becomes another arena for performance, comparison, or productivity, it starts to draw on the same depleted reserves your studies do. What the evidence can and cannot tell us Honesty about the evidence matters here, because the subject attracts a great deal of cheerful overstatement. You will find articles online claiming that research has "proven" that making art cures stress, or that a particular hobby rewires the brain. The research does not support claims that strong, and a book that pretended otherwise would deserve to be ignored. What the research does support is substantial, and it is more interesting than the slogans. A large body of work on recovery from demanding work, mostly with employees rather than students, shows that the experiences people have in their off-hours predict how exhausted they feel and how well they function. Studies of creative activity specifically find that people who engage in it report more of those recovery experiences, and in at least one well-known study, their colleagues rated their work more favorably. Daily diary research with young adults finds that on days when people do something creative, they tend to report more positive feelings and a greater sense of flourishing, and that the effect carries into the next day. Laboratory work has found that a short session of art-making lowered a stress hormone in most participants regardless of artistic skill. A World Health Organization review of more than 900 publications concluded that the arts play a meaningful role in promoting health and preventing illness, while noting that the quality of the evidence varies considerably. What the research does not yet provide is the study everyone would like to see: a large, long-term trial that randomly assigns university students to take up a creative hobby and then tracks whether they become less burned out over several years. That study has not been done at scale. So when this book argues that creative outlets prevent burnout, it is making an inference, a strong one, built by connecting three bodies of evidence: what burnout is and what drives it, what recovery requires, and what creative activity reliably provides. Each link in that chain is well supported. The chain as a whole is the most reasonable reading of the evidence, not a settled fact. Where the book is confident, it will say so. Where it is extrapolating from workers to students, or from short-term effects to long-term ones, it will say that too. This distinction is not academic hair-splitting. It changes what you should do. If creative activity were a proven cure, the right advice would be to take the prescribed dose and expect the result. Because it is instead a well-grounded protective practice whose effects depend heavily on how it is done, the right advice is to understand the mechanisms well enough to set up the practice properly, and to recognize when it is not enough. Why students in particular Most of the research on recovery was developed to understand employees, and students are not employees. In some ways their situation is worse. A worker usually has an end to the working day, even if it is blurry. A student's work has no natural boundary: there is always another reading, another problem, another draft that could be improved. The workplace is often physically separate from home; for many students, the bedroom is also the library. Workers are evaluated periodically; students are evaluated almost continuously, through assignments, quizzes, participation marks, and exams, and increasingly through the informal comparisons that social media makes constant. And students are frequently at an age when identity is still forming, which means a poor grade can feel less like feedback on a piece of work and more like a verdict on who they are. All of this makes it harder for students to get what recovery requires. It is hard to detach from work that is never finished. It is hard to feel masterful when mastery is always being measured against a rubric. It is hard to feel in control when the syllabus, the deadlines, and the standards are set by someone else. And it is hard to be absorbed in anything when a phone is buzzing with reminders of everything you have not done. A creative outlet answers each of these difficulties in a way that other forms of rest often do not. Scrolling or watching a series provides a pause, but it does not usually build a sense of competence, and it rarely demands enough attention to push academic worries out of the mind. Exercise is excellent and supported by strong evidence of its own, and nothing in this book argues against it; but for many people it does not provide the kind of self-expression or the particular form of absorption that making something does. Creative activity is not the only good form of recovery. It is an unusually complete one. How this book proceeds The first chapter sets out what burnout actually is, drawing on the measures researchers use with students, and distinguishes it from ordinary tiredness and from depression, with which it overlaps. The second chapter explains why rest alone often fails to restore people, drawing on the science of recovery. The third chapter lays out the evidence on creative activity directly, study by study, with a candid assessment of what each kind of study can show. The fourth chapter examines the mechanisms through which making things seems to help: absorption, mastery, expression, and connection with others. The fifth chapter is the pivot of the book. It explains why the condition of doing something purely for joy is not a sentimental extra but the active ingredient, and why grading, monetizing, or performing your hobby can quietly neutralize its benefits. It also addresses the special case of students whose major is itself an art. The sixth chapter considers how to choose a medium, arguing that the particular art form matters less than what it gives you. The seventh deals with the most practical question of all, how to protect time for an outlet when there seems to be no time. The eighth chapter is about limits: what a creative outlet cannot do, when burnout has causes no hobby can fix, and when to seek professional help. Throughout, the book uses illustrative scenarios of students in realistic situations. These are composites, constructed to show how the ideas play out, not accounts of real individuals. One note before beginning. This book is educational. It draws on research about stress, burnout, and well-being, but it is not a substitute for individual advice from a doctor, psychologist, or counselor. If you are struggling with persistent low mood, anxiety, sleep problems, or thoughts of harming yourself, the most important step is to talk to a professional, and most universities offer counseling services for exactly this reason. The final chapter says more about when and how to do that. The student who stopped playing the piano did not lose her music because she stopped loving it. She lost it because nothing in her environment protected it, and because every argument for giving it up sounded more serious than every argument for keeping it. This book is, in part, an attempt to make the serious argument for keeping it. Chapter 1: What Burnout Actually Is The word burnout is now used so loosely that it has almost stopped meaning anything. Students say they are burned out after a long week, after a bad exam, after a night without sleep. Sometimes they mean they are tired. Sometimes they mean they are bored. Sometimes they mean something much more serious. If this book is going to argue that creative outlets protect against burnout, it first has to be precise about what burnout is, because a vague target makes any protective claim either trivially true or impossible to test. The research tradition that gave us the concept began with studies of people in demanding helping professions, such as nurses, social workers, and teachers. The psychologist Christina Maslach and her colleagues noticed a recurring pattern in these workers, and developed a questionnaire, the Maslach Burnout Inventory, to measure it. The pattern had three parts. The first was emotional exhaustion: a deep, chronic depletion, not the tiredness that a good night's sleep resolves but the kind that persists through weekends and holidays. The second was what they originally called depersonalization and later more broadly cynicism: a hardening, distanced attitude toward the work and the people in it, a sense of going through the motions. The third was reduced personal accomplishment, or inefficacy: a declining belief that one is any good at the job or that one's efforts matter. Burnout among students For a long time burnout was treated as a strictly occupational problem. But researchers noticed that students, whose studies are in many respects a full-time job with demanding tasks, deadlines, and evaluation, seemed to show the same three-part pattern. In 2002, Wilmar Schaufeli and colleagues published a student version of the Maslach questionnaire, which asks about feeling emotionally drained by one's studies, doubting the significance of one's studies, and doubting one's ability to complete them well. Around the same time, the Finnish psychologist Katariina Salmela-Aro and her colleagues developed the School Burnout Inventory, which measures exhaustion at school, cynicism toward the meaning of school, and a sense of inadequacy as a student. These two instruments, and their descendants, underpin most of what we know about student burnout. It is worth being clear about the status of the term. The World Health Organization's International Classification of Diseases, in its eleventh revision, includes burnout, but defines it as an occupational phenomenon resulting from chronic workplace stress that has not been successfully managed, not as a medical condition, and states that it refers specifically to the occupational context. Student burnout is therefore a research concept rather than a diagnosis. That does not make it less real. It means that when you hear someone say they "have burnout," they are describing a recognizable pattern of experience, not a condition a doctor would formally diagnose. It also means that if what you are experiencing is severe, the right step is to have a professional assess it, since the same symptoms can point to other conditions that do have diagnoses and effective treatments. Does burnout actually matter for students, or is it simply the unpleasant but harmless background noise of higher education? The evidence suggests it matters. In 2021, Daniel Madigan and Thomas Curran published a meta-analysis, a statistical combination of many studies, drawing together data from more than 100,000 students. They found that burnout was consistently associated with lower academic achievement. The association was modest in size, which is typical for studies of this kind, but it appeared across different countries, age groups, and measures. It was most pronounced for the inefficacy dimension: students who had come to doubt their competence tended to perform less well. Because most of the studies were correlational, the direction of influence cannot be fully untangled. Poor grades can erode confidence, and eroded confidence can lead to poorer grades. The most plausible picture is a loop in which each feeds the other. That loop is one of the most important features of burnout, and it explains why prevention matters more than cure. Once exhaustion sets in, students tend to cope by withdrawing effort from anything that feels optional, which often includes the very activities that might restore them. Once cynicism sets in, the work feels meaningless, so effort feels pointless. Once inefficacy sets in, each setback confirms the belief that one is not good enough. A student deep in this loop does not usually decide to take up a creative hobby. The time to establish an outlet is before the loop has closed. Three dimensions, three kinds of need The three-part structure of burnout is not just a way of organizing a questionnaire. It suggests that burnout is not one problem but several, and that each part responds to something different. This is the key to understanding why a creative outlet might help, and it is set out in Table 1, which pairs each dimension with what it looks like in a student's life and with what the research on recovery suggests it needs. Table 1. The three dimensions of student burnout and what each calls for. Dimension How it shows up in students What it signals What tends to restore it Exhaustion Tired through weekends; dread before opening work Demands have outrun recovery Detachment and genuine rest Cynicism Studies feel pointless; going through the motions Meaning and ownership have eroded Control and self-chosen purpose Inefficacy "I'm not good at this"; each setback feels like proof Sense of competence is depleted Mastery experiences outside evaluation Exhaustion is the most familiar part and the one most people mean when they use the word. It is fundamentally a problem of balance: the demands placed on you have outrun your capacity to recover from them. Some of the solution lies in reducing demands, which is not always possible. The rest lies in recovering more effectively, which, as the next chapter explains, is not the same thing as resting more. Cynicism is more subtle and often more dangerous. It frequently begins as a defense. When you care deeply about work that keeps exhausting you, distancing yourself from it is a way of reducing the pain. But the distance does not stay contained. Students who become cynical about their studies often become cynical about their field, their future, and eventually their own motives. Cynicism tends to grow when people feel they have little control over their work and little say in what it is for. A syllabus is set by someone else; the standards are set by someone else; the reasons for learning something are often explained, if at all, in terms of exams and credentials. It is not surprising that meaning drains away. Inefficacy is the dimension most closely linked to achievement, and it is the one students most often mistake for a fact about themselves. Consider a first-year student in a competitive program who arrives having been at the top of every class she has ever taken. For the first time, she is surrounded by people who are as capable as she is, and her marks, while perfectly respectable, are no longer exceptional. Nothing about her ability has changed. But her sense of efficacy was built on a comparison that no longer holds, and she has nothing else to build it on. Every piece of feedback becomes evidence in a case against herself. What is striking about all three dimensions is that the academic environment itself makes the corresponding remedy hard to obtain. Detachment is hard when work is never finished. Control is hard when the structure is externally imposed. Mastery outside evaluation is almost impossible within a system that evaluates everything. This is not a criticism of universities, which have good reasons for their structures. It is simply an observation that the remedies for academic burnout mostly have to come from outside academic work. What burnout is not, and what resists it Two distinctions help clarify the target further. The first is between burnout and ordinary stress. Stress is a response to a demand, and in the short term it can be useful, focusing attention and mobilizing effort before an exam. It becomes a problem when it is chronic and when recovery never catches up. The difference is often visible in how people respond to a break. A stressed student who gets a long weekend usually comes back feeling somewhat restored. A burned-out student often does not; the tiredness persists, and the prospect of returning to work produces dread rather than readiness. The second distinction is between burnout and depression. The two overlap considerably, and some researchers, notably Renzo Bianchi and colleagues, have argued that the overlap is so large that burnout may be better understood as a form of depressive condition arising in a work context. Others disagree, pointing out that burnout is, at least initially, tied to a specific domain, whereas depression tends to spread across all of life. The debate is unresolved. For practical purposes, the useful point is this: if your low mood, loss of interest, and exhaustion are confined to your studies, and you still find pleasure in friends, food, and other activities, you are likely dealing with something closer to burnout. If the loss of interest and pleasure extends to everything, if you are having difficulty sleeping or eating, or if you are having thoughts that life is not worth living, you need to talk to a professional. That is not a failure of self-care. It is the right response to a condition that often requires more than self-care to treat. This book is about the first situation: the student who is heading toward burnout, or is in its early stages, and who still has the capacity to do something about it. A creative outlet is a preventive practice. It can help someone in the middle of a crisis feel a little better, but it is not a treatment for depression, and nobody should delay seeking help in the hope that a hobby will fix it. Chapter 8 returns to this point in detail. One influential way of thinking about burnout, the job demands-resources model developed by Arnold Bakker and Evangelia Demerouti, frames it as the outcome of two processes. Demands, such as workload, time pressure, and emotional strain, drain energy and, when chronic, lead toward exhaustion. Resources, such as autonomy, support, feedback, and opportunities to grow, sustain motivation and engagement, and buffer the impact of demands. Burnout becomes likely when demands are high and resources are low. The model was developed for workplaces, but researchers have applied its logic to students with reasonable success, and it is a useful frame for what follows. Much advice about student burnout focuses on demands: managing time, reducing workload, dropping a course. Those strategies are important, but students often have limited control over their demands. They usually have more control over their resources, and in particular over the personal resources they build and maintain outside their studies. A creative outlet is best understood as a resource of this kind. It does not reduce the number of problem sets due on Friday. What it can do is replenish some of what those problem sets take, and provide, in a separate domain, the autonomy, competence, and sense of meaning that academic work may be failing to provide. Think of the engineering student from the introduction. Her piano playing did not make her coursework lighter. But it gave her a few hours a week in which she was absorbed in something, in charge of it, getting better at it, and not being judged. When it disappeared, the demands stayed the same and a resource vanished. How the slide happens Burnout rarely arrives as a single event. It accumulates through small trades, each of which looks sensible at the time. Following one illustrative student through a year makes the mechanism easier to see. Consider a second-year biology student who arrives in September with a full life. He studies seriously, but he also plays in a five-a-side football game on Wednesdays, sketches in a notebook on the bus, and spends Sunday afternoons cooking with his flatmates. In October, a lab report and a midterm fall in the same week, and he skips football. That is a reasonable decision. In November he stops sketching on the bus because he has started using that time for flashcards, which also seems reasonable, since the flashcards help. By December, Sunday cooking has turned into Sunday studying, because exams are coming and everybody else seems to be working all weekend. At the end of the first term he is tired, but he tells himself that is what exams do to people. Over the break he sleeps a great deal and feels somewhat better. In January he does not restart football, because the group has reorganized without him, and he does not restart sketching, because the notebook is at the bottom of a bag and he has lost the habit. He has not decided to give these things up. They have simply fallen away, one reasonable decision at a time. By March he notices something he cannot quite name. His marks are fine, but he no longer finds the material interesting. He reads the same paragraph several times. He feels a flat irritation toward his lecturers and a vague envy of classmates who seem to be coping. On weekends he does not work particularly hard, but he does not do anything else either; he lies in bed with his phone for hours and feels guilty about it. When his mother asks on the phone whether he is enjoying the year, he says it is fine, and means that it is not. Nothing in this story is dramatic, and that is the point. At every step, he traded a resource for a small gain against a demand. The gains were real: he did get a slightly better mark on the lab report, and the flashcards did help. But the resources he traded away, social contact, a creative habit, a weekly ritual of making something with others, were doing work he did not notice until it stopped being done. By the time the cost became visible, the path back looked harder than the path that led there, because restarting anything takes energy he no longer had. This pattern suggests two practical lessons. The first is that the protective activities in a student's life are most vulnerable precisely when they are most needed, during periods of high demand, and that they need some kind of deliberate protection if they are going to survive those periods. The second is that it is much easier to keep an outlet going than to restart one, which is why this book places so much emphasis on establishing a creative practice before burnout sets in and on keeping it alive, even in a reduced form, through exam periods. Chapter 7 deals with the practical side of that. Because prevention is easier than recovery, it helps to know what early burnout looks like before it has fully set in. The signs are usually undramatic. You notice that you are consistently tired on Monday mornings, even after a weekend without much work. You find yourself doing the minimum on assignments you would once have enjoyed. You catch yourself thinking that none of it really matters. You compare yourself with classmates more often, and come off worse more often. You stop doing things you used to do for fun, not because you decided to, but because you never quite have the energy. You feel guilty whenever you are not working, and you are not particularly productive when you are. Any one of these on its own is normal. Everyone has weeks like this, especially around exams. The warning sign is persistence: when the pattern lasts across weeks and survives breaks, when it has become your ordinary state rather than a bad patch. That is the point at which it is worth asking what, in your life, is doing the work of recovery, and whether it is enough. For many students, the honest answer is that nothing is doing that work. The time that is not spent studying is spent recovering in the thinnest possible sense, lying down, scrolling, watching something, sleeping late, which provides a pause but not replenishment. The next chapter explains why that kind of rest so often fails, and what recovery science suggests is missing. Chapter 2: Why Rest Alone Does Not Refill the Tank Most students, when they feel depleted, reach for rest. They lie down, put on a series, scroll, sleep late. There is nothing wrong with any of this, and sometimes it is exactly what is needed. But many students notice a frustrating pattern: they rest, sometimes for whole days, and do not feel restored. They come back to their desks as tired as they left them, and now they also feel guilty about the time they lost. The explanation lies in a body of research that has grown up over the past three decades around a deceptively simple question: what actually helps people recover from demanding work? Recovery is not the same as stopping The starting point of this research is a model developed by the Dutch psychologists Theo Meijman and Gijsbertus Mulder, known as the effort-recovery model. Its core idea is that effort at work produces strain, both physiological and psychological, and that this strain is normally reversed during periods when the demands are removed. If recovery is complete, a person returns to work the next day at baseline. If it is incomplete, they return already partly depleted, must expend extra effort to perform, and accumulate strain over time. Chronic incomplete recovery is, in this view, the path to exhaustion. The crucial word is "removed." Recovery does not happen simply because you have stopped working. It happens when the systems that were taxed by the work are no longer being taxed. And for many people, the thing that taxes them most is not the work itself but thinking about it. You can be lying on your bed, doing nothing, and still be rehearsing tomorrow's seminar, calculating how many pages of the essay remain, replaying an awkward comment from a tutor, or worrying about whether you studied the right material. Physically you are resting. Psychologically you are still at work. Researchers call this persistent, work-directed thinking perseverative cognition, or more familiarly rumination and worry. The psychologists Jos Brosschot, William Gerin, and Julian Thayer argued in an influential 2006 paper that much of the health cost of stress comes not from stressful events themselves but from the way people continue to think about them long after the events are over, keeping the body's stress response activated. For students, whose work has no natural endpoint and whose evaluation is continuous, perseverative cognition is almost the default state. The essay is always unfinished. The exam is always approaching. There is no moment at which the mind receives a clear signal that the work is done. This is why lying in bed for a day so often fails to restore. The body stops, but the mind keeps working, and it keeps working on precisely the material that caused the depletion. Worse, the kind of low-demand activity people typically choose when they are tired, scrolling through feeds, half-watching a program, leaves plenty of spare attention for the worries to occupy. A mind that is only partly engaged is a mind with room to ruminate. The four recovery experiences In 2007, Sabine Sonnentag and Charlotte Fritz published a paper that has shaped almost all subsequent research in this area. Rather than asking what activities people did in their off-hours, they asked what experiences those activities provided, on the reasoning that the same activity might be restorative for one person and draining for another. They identified four recovery experiences and developed a questionnaire to measure each. The first is psychological detachment: the experience of mentally switching off from work, not thinking about it, being genuinely somewhere else. The second is relaxation: a state of low activation and calm, the physical and emotional loosening that follows the removal of pressure. The third is mastery: the experience of learning something new or facing a challenge outside work, of stretching oneself and succeeding. The fourth is control: the experience of deciding for oneself what to do with one's time and how to do it. Of these, detachment has received the most research attention, and the findings are consistent. People who detach more from work during their off-hours tend to report less exhaustion, better mood, and better sleep, both in cross-sectional surveys and in diary studies that track the same people across days. Sonnentag has summarized this evidence in a number of reviews, and a large meta-analysis published in 2021 by Laurens Bujold Steed and colleagues, which combined many studies of employee recovery, found that recovery experiences in general, and detachment in particular, were related to better well-being and lower strain. The relationship between detachment and exhaustion is one of the most reliable findings in the field. Mastery is interesting because it runs against intuition. When people are tired, the last thing they usually think they need is a challenge. Yet mastery experiences appear to contribute to recovery in a distinctive way. They build resources rather than simply conserving them, providing a sense of competence and growth that can offset the depletion caused by work. The psychologist Stevan Hobfoll's conservation of resources theory offers one explanation: stress arises from the loss or threatened loss of resources, and recovery involves not only halting the loss but gaining new resources. Mastery experiences are resource gains. They give you something rather than merely stopping something from being taken. Control matters because the loss of autonomy is itself a source of strain. Much of what makes academic work tiring is that someone else sets the terms. Off-hours in which you decide what to do, and how, and for how long, provide a counterweight. Notably, control over leisure time is not the same as having a lot of it. A student with two free hours that are genuinely hers may recover more than a student with a free afternoon spent at the mercy of group chats and other people's plans. These four experiences also suggest why some forms of rest work better than others. Sleep, when it is good, provides relaxation and a biological form of detachment. Watching a favorite program may provide relaxation and some detachment, especially if it is absorbing. Scrolling social media provides little of any of them for most people: it is rarely relaxing, it often returns the mind to comparison and worry, it provides no mastery, and it is designed to erode control over one's time. None of these activities is bad in itself. The point is that they each supply a particular mix of recovery experiences, and some supply very little. Why students struggle to recover Almost all of the research described so far was conducted with employees, and it would be a mistake to assume that every finding transfers unchanged to students. But the logic of the model applies with particular force to student life, for reasons that are worth spelling out. The first is the absence of boundaries. Most workers have a commute, a building, a time when the office closes. These physical and temporal boundaries do some of the work of detachment automatically. Many students have none. Their work lives on the same laptop they use for leisure. They study in the same room they sleep in. There is no bell at five o'clock. The effort required to detach is therefore greater, and the environment offers fewer cues to do so. The second is the continuous nature of evaluation. A worker's performance review may come once a year. A student may be evaluated several times a week. Each evaluation is an event to anticipate, experience, and then ruminate over, and the cycle rarely pauses long enough for the mind to settle. The third is the absence of external structure for leisure. At school, many young people had extracurricular activities built into their week, organized and scheduled by others. At university, these structures largely disappear, and students must build their own. It is entirely possible to arrive at university as someone who played music, painted, or wrote, and to find two years later that you have done none of these things, not because you decided to stop but because no one arranged for them to happen. The fourth, and perhaps the most important, is guilt. Many students feel that any time not spent working is time stolen from their future. This belief is corrosive to recovery in two ways. It makes students less likely to engage in restorative activities at all. And when they do take time off, it ensures they spend that time thinking about work, feeling guilty about not doing it, which is to say, not detaching. A student who takes an evening off and spends it feeling guilty has paid the cost of lost study time without receiving the benefit of recovery. There is a further difficulty, and it may be the cruelest finding in this research. In 2018, Sonnentag described what she called the recovery paradox: the people who most need recovery are often the least able to achieve it. High demands and high stress make detachment harder, because stressful work is harder to stop thinking about. They drain the energy needed to start active, restorative activities, so people default to passive ones. And they often come with long hours that simply leave less time. The result is that recovery is weakest exactly when strain is greatest, which is the dynamic that allows exhaustion to accumulate. For students, the recovery paradox takes a familiar form. In the quiet weeks at the start of term, when recovery is least needed, students have time and energy for their hobbies. In the weeks before exams, when it is most needed, they abandon them. The paradox cannot be escaped by willpower alone, because willpower is one of the things depleted by high demand. It can only be managed by building recovery activities that are easy enough to start when tired and structured enough to survive busy periods, a problem this book returns to in Chapter 7. It may help to make the contrast concrete. Consider two illustrative students in the same chemistry course, each with a free evening in the middle of a heavy week. The first student finishes her lab write-up at seven, eats quickly, and gets into bed with her phone. She intends to rest. She opens a messaging app and sees that her study group is discussing the upcoming exam; someone mentions a topic she has not reviewed. She closes the app and opens a video platform. The videos are mildly entertaining, but she is only half watching, and part of her mind keeps returning to the topic she has not reviewed. At some point she opens a social media feed and sees a classmate's post about an internship. She keeps scrolling, past midnight, not because she is enjoying it but because stopping would mean facing the fact that the evening is over and she does not feel any better. She sleeps late and poorly. The next day she is as tired as she was the day before, and she has the additional burden of believing she wasted an evening. The second student finishes the same write-up at seven, eats, and then spends an hour and a half working on a short story he has been writing since the summer. He leaves his phone in another room, partly by habit and partly because he finds he cannot write with it nearby. For the first ten minutes his mind keeps drifting to the exam. Then a problem in the story, how to get one character out of a room without it feeling contrived, takes over his attention, and for the next hour he does not think about chemistry at all. He solves the problem, or half solves it, and writes a page he is pleased with. At nine-thirty he stops, feels a mild sense of accomplishment, reads for a while, and goes to sleep. Neither of these students did anything dramatic. Neither evening was a therapeutic intervention. But measured against the four recovery experiences, the difference is stark. The first student experienced little detachment, since her evening repeatedly returned her to academic worries; little relaxation, since the scrolling kept her mildly agitated; no mastery; and diminishing control, as the apps directed her attention rather than the other way around. The second student had strong detachment once the story absorbed him, some relaxation, a clear mastery experience, and complete control over what he did. It would be surprising if they did not wake up in different states. The comparison is illustrative, not experimental, and real evenings are messier. Some nights the story will go badly and the second student will go to bed frustrated. Some nights the first student will see a funny video, laugh with a friend, and feel genuinely lighter. The point is not that one activity always wins. It is that the second student has built into his week an activity that reliably provides the experiences recovery requires, and the first has not. Over a semester, that difference compounds. What an effective recovery activity looks like Putting these findings together, we can describe the characteristics an activity would need in order to provide robust recovery for a student. It would need to be absorbing enough to occupy the mind fully, so that detachment happens without requiring effort. It would need to offer some challenge and the possibility of improvement, so that it builds a sense of mastery. It would need to be self-directed, so that it restores a sense of control. It would ideally have some calming quality, so that relaxation is possible. And it would need to be separate enough from academic work that it does not trigger the evaluative thinking that drives rumination. Research on leisure more broadly supports the idea that what people do with their free time matters for well-being. A 2015 meta-analysis by Lauren Kuykendall, Louis Tay, and Vincent Ng, published in Psychological Bulletin, combined data from many studies and found a consistent positive relationship between leisure engagement and subjective well-being. Importantly, they included experimental and longitudinal studies, not only cross-sectional ones, which strengthens the case that leisure contributes to well-being rather than merely accompanying it. They also found that the relationship was partly explained by leisure's capacity to meet psychological needs, including the need to feel competent and autonomous. Leisure, in other words, helps to the extent that it provides certain experiences, which is exactly what the recovery framework predicts. Many activities can meet these criteria. Sport often provides absorption, mastery, and, in teams, social connection. Learning a language can provide mastery and control. Cooking elaborate meals, gardening, and repairing things all have their devotees. This book does not argue that creative activity is the only route to recovery; it argues that it is an unusually complete one, and one that students often abandon precisely when they need it. The reason creative activity is so complete is that making something almost by definition requires full attention, involves a skill that can improve, is directed by the maker, and occupies a domain that can be kept entirely separate from academic judgment. Consider a second-year law student who spends two hours on a Sunday afternoon working on a linocut print. Cutting the block requires steady, focused attention; a lapse means a slip of the blade, so the mind cannot wander to contract law. The skill improves visibly from print to print. Every decision about the image is hers. The pace is slow, the room is quiet, and the activity is calming. And there is no rubric, no grade, no comparison with classmates. In those two hours she has gathered, in a single activity, all four recovery experiences. Compare this with the same two hours spent on her phone, and the difference in what she brings back to her Monday is not mysterious. The comparison should not be pushed too far. Some people find scrolling relaxing, and some people find art-making stressful, especially if they approach it with perfectionism. Recovery experiences are, as Sonnentag and Fritz emphasized, about the experience, not the activity. But for many students, creative activity is the most reliable way of bundling together the experiences that recovery requires, which is why the next chapter turns to the evidence on creative activity specifically. Chapter 3: What the Evidence Actually Shows Claims about the benefits of creative activity are everywhere, and most of them are either vague or inflated. Art is described as healing, music as medicine, writing as therapy. These phrases contain some truth, but they obscure more than they reveal, because they do not tell you what kind of evidence stands behind them or how much weight it can bear. This chapter sets out the most relevant research directly, study by study, and asks of each piece what it can and cannot show. The goal is not to cast doubt on the case for creative outlets but to establish it on ground that will hold. Reading the evidence honestly Before looking at individual studies, it helps to understand the kinds of research that exist in this field and what each kind can establish. Not all evidence is equal, and many of the most confident claims you encounter rest on the weakest designs. The most common kind of study is cross-sectional: researchers survey a group of people at one point in time, asking about their creative activities and their well-being, and look for associations. These studies are valuable for identifying patterns, but they cannot establish direction. If people who paint report less stress, it may be that painting reduces stress, or that less stressed people have more time and energy to paint, or that some third factor, such as income or personality, produces both. Longitudinal studies follow the same people over time, which allows researchers to ask whether creative activity at one point predicts well-being later, after accounting for well-being at the start. Diary studies are a particularly useful variant for questions about recovery, because they track people day by day and can examine whether a creative day predicts a better next day. These designs are stronger on direction, though they still cannot rule out every alternative explanation. Experimental studies randomly assign people to engage in a creative activity or not, and compare outcomes. This is the strongest design for establishing cause, but experiments in this area are usually short, often small, and typically measure immediate effects such as mood or anxiety after a single session, rather than long-term outcomes like burnout. Finally, systematic reviews and meta-analyses combine the results of many studies. They are powerful when the underlying studies are good, and they can reveal patterns that single studies miss, but they cannot improve on the quality of the studies they include. Table 2 summarizes the main kinds of evidence discussed in this chapter, what each can show, and where it falls short. It is worth keeping in view, because the case this book makes depends on how these different kinds of evidence fit together. Table 2. Kinds of evidence on creative activity and well-being. Kind of study Example discussed here What it can show Main limitation Cross-sectional survey Eschleman and colleagues, 2014 Creative activity goes with better recovery and performance Cannot establish direction Daily diary Conner and colleagues, 2018 Creative days predict better next days Short time span; self-report Short experiment Kaimal and colleagues, 2016; Sandmire and colleagues, 2012 Immediate drops in stress markers or anxiety Small samples; short-term only Large longitudinal cohort Mak and colleagues, 2023 Hobbies predict later well-being across countries Older adults, not students Systematic review Martin and colleagues, 2018; Fancourt and Finn, 2019 Consistent pattern across many studies Varying quality of included studies The core studies The study most directly relevant to this book's argument was published in 2014 by Kevin Eschleman and colleagues in the Journal of Occupational and Organizational Psychology. It connected creative activity explicitly to the recovery framework described in the previous chapter. The researchers surveyed two groups: 341 employees drawn from a national sample, and 92 active-duty officers in the United States Air Force. They asked about the extent of participants' creative activities outside work, their recovery experiences, and aspects of their job performance. In the second group, performance was rated not by the participants themselves but by coworkers and subordinates, which reduces the risk that people who feel good about themselves simply rate everything favorably. The researchers found that creative activity was positively associated with recovery experiences, including mastery, control, and relaxation. They also found that people who engaged in more creative activity outside work were rated as more helpful to colleagues and more creative in their problem solving at work. Interestingly, some of the association with performance appeared to operate directly, over and above the recovery experiences, which suggests that creative activity may contribute something beyond recovery alone. The study's limitation is its cross-sectional design: it cannot show that creative activity caused better recovery or performance. But it provides the clearest demonstration that creative activity and recovery experiences travel together, in the direction the theory predicts, in real working adults. The second key study addresses the question of direction directly, and it was conducted with young adults close in age to university students. In 2018, Tamlin Conner, Colin DeYoung, and Paul Silvia published a daily diary study in The Journal of Positive Psychology. They asked several hundred young adults to report every day for about two weeks on their creative activities, their emotions, and their sense of flourishing, meaning a feeling of engagement, purpose, and growth. The design allowed them to ask whether being creative on one day predicted how people felt the next. It did. On days when people spent more time on creative activities, they reported more positive emotion and greater flourishing, and those effects carried over into the following day. Because the analysis looked at change within the same individuals across days, it was not confounded by stable differences between people, such as personality or background. Because it looked at time lags, it provided some evidence that creative activity came first. The authors framed their findings with appropriate modesty, as support for the idea that everyday creativity is one path to well-being. For this book's purposes, the study is important for three reasons: it studied young adults, it looked at ordinary everyday creativity rather than formal arts programs, and it showed an effect on the positive side of well-being, the side that burnout erodes. The third study concerns the body. In 2016, Girija Kaimal, Kendra Ray, and Juan Muniz, researchers at Drexel University, published a study in Art Therapy that measured cortisol, a hormone involved in the body's response to stress, before and after a session of art-making. Thirty-nine adults spent 45 minutes working with materials such as markers, paper, and modeling clay, with an art therapist present but without instruction or direction. About three-quarters of participants showed lower cortisol levels after the session. Strikingly, the reduction was not related to prior artistic experience: people who had never made art benefited as much as those who had. The study had no control group, so it cannot rule out the possibility that simply sitting quietly for 45 minutes would have produced a similar effect. And cortisol is a complicated measure that fluctuates across the day. But the finding that prior skill made no difference is important for the argument of this book, because it undercuts the belief, common among students, that creative activity is only for people who are already good at it. The fourth study is small but directly relevant to students. In 2012, David Sandmire and colleagues published a pilot study in Art Therapy in which undergraduates in the week before final exams were randomly assigned either to a short art-making session or to a control condition. Students who made art showed greater reductions in anxiety than those in the control group. It is a pilot study, with a small sample and a short time frame, and it measured anxiety immediately afterwards rather than burnout over time. But it demonstrates, in a controlled design, that even brief creative activity can reduce distress in students at a point of high academic pressure. The wider picture Beyond these individual studies, several larger reviews provide context. In 2018, Lily Martin and colleagues published a systematic review in Behavioral Sciences examining arts interventions for stress, across the four modalities of visual art, music, dance and movement, and drama. They included 37 studies, of which roughly three-quarters were randomized controlled trials, and found that just over 80 percent reported a significant reduction in stress. This is a strong consistency of findings. The caveat is that many of these were structured interventions or therapies, often led by trained professionals, rather than hobbies people pursued on their own. Whether the benefits of a guided intervention carry over to a self-directed hobby is plausible but not established by this review. In 2019, the World Health Organization published a scoping review by Daisy Fancourt and Saoirse Finn, which surveyed more than 900 publications, including over 200 reviews that between them covered more than 3,000 studies. The review concluded that the arts can contribute to both the prevention of ill health and the promotion of health across the lifespan, including in mental health. It was candid about the uneven quality of the evidence, noting that it ranges from small pilot studies to randomized trials, and argued that the overall picture is nonetheless compelling because consistent findings emerge across different research designs, each with different weaknesses. In 2023, Hei Wan Mak, Daisy Fancourt, and colleagues published an analysis in Nature Medicine of more than 93,000 adults aged 65 and over in 16 countries, drawn from five long-running longitudinal studies. They found that having a hobby was associated with fewer depressive symptoms and higher self-reported health, happiness, and life satisfaction, after accounting for a range of confounding factors, and that the associations were remarkably consistent across countries. Further analyses suggested a temporal relationship, meaning that hobby engagement tended to precede the improvements. This is a very large, methodologically careful study. Its obvious limitation for our purposes is that its participants were older adults, not students, and "hobby" was defined broadly rather than as creative activity specifically. It establishes that having a hobby is one of the more robust predictors of mental well-being across diverse populations, but it does not tell us directly what happens to twenty-year-olds in a competitive degree program. Finally, it is worth mentioning one creative activity that has been studied more thoroughly than any other: expressive writing. Beginning with a 1986 study by James Pennebaker and Sandra Beall, researchers have asked people to write about difficult experiences for short periods over several days, and compared them with people who wrote about neutral topics. A 2006 meta-analysis by Joanne Frattaroli, combining well over one hundred such studies, found a small but reliable benefit across a range of outcomes. The effect is modest, and expressive writing is a specific structured exercise rather than a creative hobby in the usual sense. But its long research history is a useful reminder that putting experience into words can have measurable effects, and it bears on the mechanisms discussed in the next chapter. What the evidence adds up to Assembled together, what does this research establish? It is worth being precise. First, there is strong and consistent evidence that creative activity is associated with lower stress and better well-being. This finding appears across different designs, populations, and countries, and in both brief experiments and large longitudinal studies. Second, there is good evidence, from experiments and diary studies, that engaging in creative activity produces short-term improvements in mood, anxiety, and stress markers, and some evidence that these effects carry into the following day. Third, there is reasonable evidence, mostly from workers, that creative activity outside work goes along with the recovery experiences, particularly mastery, control, and relaxation, that are known from separate research to protect against exhaustion. Fourth, there is strong evidence, from a much larger body of research on recovery, that those recovery experiences are related to lower exhaustion and better functioning. What is missing is a direct, long-term test in students: a study that follows students over years, or randomly assigns them to take up creative outlets, and measures burnout on the standard instruments. Such studies may exist in small numbers, or may be under way, but there is not yet a body of this kind of evidence large enough to settle the question on its own. Before accepting that inference, a skeptical reader should consider the strongest alternative explanations, because they are real and the research has not fully dispatched them. The first is selection. People who engage in creative hobbies differ from those who do not. They may have more money, more free time, more supportive families, or personalities more open to new experience. Any of these could make them less prone to burnout regardless of their hobbies. Good studies try to account for such differences statistically, and the large cohort studies in particular adjust for income, education, and health. The diary studies go further by comparing the same people on different days, which removes stable personal differences from the picture. But no statistical adjustment is perfect, and some of the association between creativity and well-being in cross-sectional research is almost certainly due to who chooses to be creative in the first place. The second is reverse causation. People who are already coping well have more energy to spend on hobbies, while people who are struggling drop them. This is not merely a statistical nuisance; it is exactly the pattern Chapter 1 described in the student who let his sketching and football slide as the year got harder. It means that in any survey, the association between hobbies and well-being will partly reflect well-being causing hobbies. The time-lagged designs help here, but they do not remove the problem entirely. The third is publication bias. Studies that find positive effects are more likely to be published than studies that find nothing, and this tends to inflate the apparent strength of any literature. The arts and health field is not immune, and some of its smaller studies were conducted by researchers with a professional commitment to the arts, which is not evidence of bias but is a reason for care. The fourth is the gap between the outcomes measured and the outcome we care about. A drop in cortisol after 45 minutes is not the same as protection from burnout over a year. A better mood the next day is not the same as sustained engagement with one's studies. Much of the evidence concerns short-term states, and the step from those states to long-term outcomes is an inference, however plausible. None of these objections overturns the case. Each is partly addressed by at least one strand of the evidence, and it would take a remarkable coincidence for all of the consistent findings across designs to be artifacts. But they explain why a careful reader should talk about strong support rather than proof. So the honest claim is this. The evidence does not prove that creative hobbies prevent academic burnout. It does show, from several independent directions, that creative activity reliably produces the experiences that recovery research identifies as protective against exhaustion, that it improves mood and reduces stress in the short term, that its benefits extend into the following day, and that across populations, people with hobbies tend to have better mental health over time. If burnout is, as the previous chapters argued, largely a failure of recovery, then the inference that creative outlets help prevent it is well founded. It is the kind of inference we make all the time in health, where the ideal trial has not been run but the mechanisms and the surrounding evidence point clearly in one direction. There are also things the research cannot tell you, and it is worth naming them so that you do not look for answers in the wrong place. It cannot tell you how much is enough. There is no established dose of creative activity for burnout prevention, and anyone who tells you that twenty minutes a day or three hours a week is the magic number is inventing it. What the evidence suggests is that regularity matters more than intensity, since the recovery benefits appear to operate day by day, but beyond that the research is silent. It cannot tell you which medium is best. Studies have looked at visual art, music, writing, dance, drama, and crafts, and benefits appear across all of them. There is no convincing evidence that one is superior in general. Chapter 6 argues that the best medium is the one that provides you with the recovery experiences you most lack, which is a personal rather than a universal question. It cannot tell you that any particular creative activity will work for you. Averages hide variation. Some people find art-making relaxing; others find it anxiety-provoking, particularly if they approach it with perfectionism or self-criticism. The finding that about three-quarters of participants in the cortisol study showed a reduction means that about a quarter did not. Part of the purpose of this book is to explain what distinguishes a creative practice that restores from one that depletes, which is the subject of Chapter 5. And it cannot substitute for professional help when that is needed. The evidence on arts interventions for mental illness comes largely from structured programs, sometimes with trained therapists. A hobby is not a therapy, and a student who is struggling with depression or an anxiety disorder needs more than a sketchbook. Within those limits, the evidence gives a clear direction. The next chapter examines why creative activity has these effects, because understanding the mechanisms is what allows you to set up a practice that actually delivers them. Hashtags: #TheCreativeOutletCure #AcademicBurnout #BurnoutPrevention #CreativeOutlets #ArtAndWellbeing #CreativeHobbies #StudentWellbeing #MentalHealthAwareness #StressManagement #AcademicStress #CreativityAndWellbeing #ArtForStressRelief #CreativeExpression #StudentMentalHealth #EmotionalWellbeing #PsychologicalRecovery #WorkLifeBalance #MindfulCreativity #CreativeSelfCare #LeisureActivities #HobbiesForStudents #ArtisticExpression #PersonalGrowth #StressRecovery #CreativeFlow #SelfExpression #EmotionalResilience #HealthyStudyHabits #StudentSelfCare #AcademicWellbeing

Download the Book (PDF): Introduction A user in Sydney opens a product page served from a data center in northern Virginia. Before a single byte of HTML arrives, light has to cross the Pacific and most of North America and come back, several times. The TCP handshake costs one round trip. TLS costs at least one more. The request itself costs a third. If the origin then queries a database, renders a template, and calls two internal services, the user waits for all of that too. Even on a perfect network the physical floor for a single Sydney-to-Virginia round trip is well over 100 milliseconds, and real routes are longer than great circles. Stack three or four of those round trips before the first byte and the page has lost half a second to geography alone, before any code has run slowly. For two decades the standard answer was the content delivery network. A CDN puts servers in hundreds of cities, terminates the connection close to the user, and serves copies of static files from a nearby cache. That fixed images, scripts, and stylesheets. It did little for anything that changed per user, per request, or per minute, because a cache can only return what it already holds. The moment a page depended on a cookie, a country, a logged-in session, or an experiment bucket, the request went all the way home. Serverless edge computing is the attempt to close that gap. Instead of only storing copies of responses in those hundreds of cities, the CDN runs your code there. A function written in JavaScript, TypeScript, Rust, Go, Python, or anything else that compiles to WebAssembly executes in the same building that terminated the user's TLS connection, typically within a few milliseconds of network distance from the user. It can inspect the request, rewrite it, decide what to cache and under which key, assemble a response from fragments, verify a token, choose an experiment variant, or answer outright without contacting any origin at all. Two platforms define the field and are the subject of this booklet. Cloudflare Workers, launched in 2017, runs JavaScript and WebAssembly inside V8 isolates, the same sandboxing technology that separates tabs in the Chrome browser, and has grown into a full application platform with key-value storage, strongly consistent Durable Objects, a SQL database, object storage, queues, and containers. Fastly's offering, launched as Compute@Edge and renamed simply Fastly Compute in late 2023, compiles customer code to WebAssembly and runs each request in a fresh, isolated Wasmtime instance, a design that grew out of Fastly's deep involvement in the WebAssembly standards and the Bytecode Alliance. The title of this booklet keeps the older name because it is still how many engineers search for the product; the text uses the current one. The argument of this booklet The thesis is simple to state and easy to forget in practice: the edge is not a faster place to run your origin. It is a different kind of computer, with abundant proximity and scarce shared state, and edge systems work when they move decisions to the user while keeping authoritative data where it can be coordinated. Almost every disappointment with edge computing comes from ignoring one half of that sentence. Teams port an entire server-rendered application to Workers, discover that every request still makes four sequential calls to a database in one region, and find the page slower than before, because the code moved closer to the user and further from its data. Other teams treat the edge as a fancy cache configuration language and never use it to make the decisions that only the edge can make cheaply: which variant to serve, which cache key applies, whether a request is even worth forwarding. Both have mistaken location for architecture. The useful mental model is that a request at the edge has two clocks running. One measures the distance between the user and the code, which the edge has made nearly free. The other measures the distance between the code and the state it needs, which the edge has not changed at all unless you deliberately move or replicate that state. Good edge design is the discipline of keeping the second clock short: caching aggressively and correctly, reading from replicated stores where staleness is acceptable, routing to a single coordinated object where it is not, and placing the remaining work near the database instead of near the user when that is the shorter path. What the chapters cover Chapter 1 sets out the physics: why round trips dominate latency, what a CDN already does, and what changed when CDNs began running arbitrary code. Chapter 2 compares the two runtime models in depth. V8 isolates and per-request WebAssembly instances make different trade-offs about start-up cost, memory, language support, and isolation, and those trade-offs explain most of the practical differences between the platforms. Chapters 3 and 4 are practical tours of each platform as it stands in late 2026: how a Worker is structured, configured, bound to resources, and deployed; how a Fastly Compute service is built, how it talks to named and dynamic backends, and how its configuration, key-value, and secret stores work. These chapters show real code, but the emphasis is on the programming model and its consequences rather than on reproducing reference documentation. Chapter 5 is the heart of the booklet for most readers: caching logic. Programmable caching is the single most valuable thing edge code does, and also the most common source of subtle bugs. The chapter covers cache keys, normalization, variation, freshness and revalidation, request collapsing, purging by tag, and the caching primitives each platform exposes. Chapter 6 confronts state. It explains eventual consistency in Workers KV and Fastly's KV Store, the single-writer model of Durable Objects, the role of regional databases, connection pooling, and placement controls that run code near data rather than near users. Chapter 7 applies all of this to personalized rendering: geolocation, experiments, authentication at the edge, streaming HTML rewriting, and the techniques that let a personalized page still be mostly cached. Chapter 8 covers security and reliability, including the real outages that have taken edge platforms down and what they teach about blast radius, configuration rollout, and failing open or closed. Chapter 9 deals with cost, observability, testing, and the decision that matters most: what belongs at the edge and what does not. Who this is for The intended reader is a working engineer or technical lead who understands HTTP, has built or operated a web application, and wants to know whether and how to push logic to the edge. No prior experience with either platform is assumed. Every term specific to edge computing is defined when it first appears. Code samples use JavaScript or TypeScript for Workers and Rust or JavaScript for Fastly, and are kept short; the prose carries the argument. Specific limits and prices change. Where this booklet gives numbers, such as CPU-time ceilings, memory limits, storage quotas, or per-request pricing, they come from each vendor's published documentation as of late 2026, and the text says so. Treat them as orders of magnitude that shape design, and check the current documentation before relying on any one of them in a contract or a capacity plan. What is deliberately out of scope This is not a survey of every edge platform. Akamai, AWS (with Lambda@Edge and CloudFront Functions), Vercel, Netlify, Deno Deploy, and others offer related products, several built on the same underlying technologies. The ideas in the following chapters transfer to them, and occasionally a comparison illuminates a point, but the booklet concentrates on the two platforms whose designs most clearly represent the two main approaches to running untrusted code in thousands of locations at once. It is also not an introduction to WebAssembly or JavaScript as languages. It explains as much of WebAssembly's module and component model as is needed to understand why Fastly runs code the way it does, and as much of V8's isolate model as is needed to understand Workers, and no more. The reward for working through the material is a clear sense of where milliseconds actually go, a set of patterns for caching and personalization that survive contact with production traffic, and the judgment to tell when the edge is the right place for a piece of logic and when it is merely a more distant place to wait for a database. Chapter 1: Latency Physics and the Road to Programmable Edges Performance engineering usually starts with code: a slow query, an inefficient loop, a blocking call. For globally distributed web traffic that instinct is often wrong. The largest single component of the time a distant user waits is frequently neither CPU nor disk but distance, multiplied by the number of times a request has to cross it. Edge computing exists because that multiplication is so punishing, and understanding it precisely is the foundation for every design decision in the rest of this booklet. Distance, round trips, and the floor you cannot optimize away Light in optical fiber travels at roughly two thirds of its speed in a vacuum, about 200,000 kilometers per second. That works out to approximately one millisecond for every 200 kilometers, one way. A round trip, which is what every handshake and every request-response exchange requires, doubles it. Sydney to Washington, D.C. is around 15,700 kilometers along a great circle, so the theoretical minimum round trip through fiber is close to 160 milliseconds. Real cables do not follow great circles, real packets pass through routers and switches that each add delay, and real routes sometimes detour through a third continent. Observed round trips on that path are commonly well above the theoretical floor. No amount of code optimization reduces this. A faster CPU in Virginia does nothing for the 160 milliseconds the packet spends in glass. The only levers are to reduce the distance or reduce the number of crossings. The number of crossings is where the damage accumulates. Consider what happens when a browser loads a page from a server it has not talked to before, using HTTP over TCP with TLS 1.3: 1. A DNS lookup, which may itself involve round trips to resolvers, unless cached. 2. The TCP handshake: one round trip before any application data can flow. 3. The TLS 1.3 handshake: one more round trip to agree keys and verify the certificate. 4. The HTTP request and the first byte of response: one more round trip, plus however long the server takes to produce that byte. That is three round trips at minimum before the first byte, even with modern protocols. HTTP/3 over QUIC folds the transport and cryptographic handshakes together and can reduce this to two, or one on resumed connections, but the principle stands: the user pays the distance several times. At 160 milliseconds per crossing, a first byte from the other side of the world costs half a second before the server does anything at all. Then the server does things. A typical dynamic page in a conventional architecture authenticates the session against a store, queries one or more databases, perhaps calls an internal service or two, and renders a template. If those calls are in the same data center as the application server, each costs well under a millisecond of network time, and the server-side work might total 50 to 200 milliseconds. Now the time budget is clear: geography costs more than the application, and it is paid on every new connection. What a CDN already does A content delivery network attacks the distance term directly. It operates servers in hundreds of locations, called points of presence or PoPs, and uses DNS or anycast routing to send each user to a nearby one. Anycast means the same IP address is announced from many locations at once, so the internet's routing system naturally delivers packets to the topologically closest PoP. Cloudflare and Fastly both rely heavily on anycast. Once the user is connected to a nearby PoP, three things improve even before any caching happens. First, the handshakes are short. The TCP and TLS round trips now travel tens of kilometers instead of thousands. A Sydney user connecting to a Sydney PoP completes both handshakes in a few milliseconds. Second, the long-haul leg is reused. The PoP maintains warm, persistent connections back to the origin, often over the CDN's own optimized backbone. The expensive transoceanic handshake is paid once by the CDN and amortized across thousands of users, instead of being paid by each user on each new connection. Only the request and response themselves cross the ocean. Third, if the response is cacheable and already in the PoP's cache, the long-haul leg disappears entirely. The user gets a response in the time it takes to cross town. This is why CDNs became standard infrastructure for anything served to a geographically dispersed audience. But the third benefit, the large one, depends on the response being cacheable, and the definition of cacheable in classic CDNs is narrow. A response is cached under a key derived from its URL, plus perhaps a few headers listed in a Vary header. If the response differs by cookie, by user, by experiment, by device capability expressed in some non-standard way, or by anything the cache cannot see in its key, the CDN either refuses to cache it or, worse, caches one user's version and serves it to everyone. A latency budget, worked through It helps to put rough numbers on a single request and watch where the time goes under different architectures. Take a user in Sydney, an origin in northern Virginia, and an assumed real-world round trip of 200 milliseconds between them, somewhat above the physical floor. Assume the user's round trip to a Sydney PoP is 5 milliseconds and the origin needs 80 milliseconds of server-side work to produce a dynamic page. With no CDN, the user pays TCP, TLS, and request round trips across the Pacific: three times 200 milliseconds, plus 80 milliseconds of server work, for about 680 milliseconds to first byte on a new connection. With a CDN in front but the page uncacheable, the user pays two short handshake round trips to Sydney, 10 milliseconds, and then the request travels over the CDN's warm connection to Virginia and back, 200 milliseconds, plus 80 milliseconds of server work. First byte arrives at about 290 milliseconds. The CDN has removed more than half the delay without caching anything, purely by terminating connections locally. With the page cacheable and in the Sydney cache, the user pays the two handshakes and a local request: about 15 milliseconds, plus a millisecond or so for the cache lookup. Roughly a fortyfold improvement over the original. Now suppose the page is personalized by a cookie, so the classic CDN cannot cache it, but most of the page is identical for everyone. If code at the Sydney PoP can fetch the shared portion from the local cache and obtain the personalized portion from somewhere fast, first byte could arrive in 20 to 30 milliseconds. If the code instead has to ask Virginia for the personalized portion, it pays one long round trip, and the page lands at around 230 milliseconds, still better than the uncached CDN case because the shared portion is local and the server's work is smaller. If the code makes four sequential calls to Virginia, it pays 800 milliseconds and is slower than having no CDN at all. These numbers are illustrative rather than measured, but the ratios are robust and they explain the industry's history. Connection termination at the edge cuts latency roughly in half. Caching cuts it by an order of magnitude or more. Edge code can extend caching to content that was previously uncacheable, or can squander all of it with sequential calls to distant state. Inside a point of presence It also helps to know roughly what an edge location contains, because the physical design shapes what edge code can assume. A PoP is a set of servers in a colocation facility or carrier exchange, connected to many local networks and internet exchange points so that traffic from nearby users enters it with few intermediate hops. Cloudflare operates in more than 300 cities and has long followed a design in which every server in every location runs every service: DNS, the HTTP proxy, the cache, the firewall, and the Workers runtime. Any machine can handle any request for any customer. Fastly has historically chosen fewer, larger PoPs with very high-capacity servers, arguing that concentrating traffic improves cache hit ratios, because a request is more likely to find its object already cached when more traffic shares the same cache. Both approaches are defensible, and both mean that edge code runs on general-purpose servers shared with the provider's other functions and with many other customers. Two consequences follow for anyone writing edge code. First, a customer's code is not pinned to a machine. Successive requests from the same user may be handled by different servers within a PoP, or by different PoPs if routing shifts, so nothing in local memory can be relied upon from one request to the next. Second, the cache in a PoP is shared across many servers and is large, but it is not the same cache as the one in the next city. An object cached in Sydney is not cached in Singapore until someone in Singapore requests it, unless a tiered or shielded arrangement, discussed in Chapter 5, connects them. The long march toward programmable edges CDN operators recognized this limitation early and spent twenty years expanding how much logic customers could push to the PoP. Edge Side Includes, published as a W3C note in 2001 by Akamai and others, let an origin return an HTML template containing tags that the CDN would replace with separately cached fragments. A page could be mostly cached, with a personalized header fetched per user. ESI worked, but it was a narrow, markup-based language with limited logic, and support varied between vendors. Fastly was built on Varnish, an open-source HTTP accelerator, and exposed Varnish Configuration Language (VCL) to customers. VCL is a domain-specific language that hooks into the stages of a request's life: when it arrives, when the cache is checked, when a response comes back from the origin, before delivery. Customers could rewrite URLs, normalize headers, choose backends, set cache lifetimes, and generate synthetic responses, all at the edge. It was powerful and fast, and Fastly customers still run enormous amounts of VCL. But VCL is deliberately restricted: no loops, no arbitrary libraries, no general-purpose data structures. It is a configuration language that grew, not a programming language. Cloudflare's early equivalent was a set of declarative rule systems, configured in a dashboard, for redirects, cache settings, and header changes. These have since been reorganized into products such as Cache Rules, Transform Rules, and Origin Rules. They remain the right tool for simple, declarative behavior, and later chapters return to when a rule beats code. The shift came when operators decided to let customers run general-purpose code. Cloudflare announced Workers in 2017 and made it generally available in 2018. The same year AWS shipped Lambda@Edge, which runs Node.js and Python functions at CloudFront regional locations. Fastly announced its WebAssembly-based Compute@Edge platform in 2019 and opened it for general use over the following years, renaming it Fastly Compute in late 2023. The jump from configuration languages to general code is not merely about expressiveness. It changes what kind of system the edge is. A configuration language can only manipulate what the CDN already does: route, cache, rewrite. General code can do new things. It can verify a cryptographic signature, parse JSON, call several backends in parallel and merge their results, maintain counters, render HTML from a template, run a small machine-learning model, or implement an entire API. At that point the PoP stops being a cache with knobs and becomes a computer, distributed across hundreds of cities, on which you can run applications. Why "serverless" matters here The word serverless is overused, but it has a precise meaning in this context that explains why edge computing took the shape it did. A serverless platform runs your code in response to events, typically HTTP requests, without your provisioning, sizing, patching, or managing any servers. You deploy code, not machines. The platform decides where and how many instances run, scales them from zero to whatever the traffic demands, and bills you for what is used. For an edge platform this model is not optional. A customer cannot reasonably provision capacity in more than three hundred cities and adjust it hour by hour as the sun moves across the planet and traffic follows it. The only workable arrangement is for the platform to run every customer's code in every location on demand, sharing the same hardware among thousands of tenants. That requirement leads directly to the central engineering problem the next chapter examines: how to start a tenant's code fast enough to serve a request that may be the only one that location sees from that tenant all hour, while keeping tenants strictly isolated from one another on shared machines. Traditional serverless platforms such as AWS Lambda solved isolation with lightweight virtual machines, and for years accepted cold starts measured in hundreds of milliseconds or more. A cold start is the delay when a request arrives and no instance of the function is ready, so the platform must create one. In a single region with steady traffic, cold starts are an occasional nuisance. At the edge they would be fatal. Traffic is spread across hundreds of locations, so each location sees a small slice of any one customer's requests, so instances are far more likely to be cold. A design that adds 200 milliseconds to cold requests would erase the latency advantage the edge exists to provide. Both Cloudflare and Fastly therefore rejected per-tenant containers and virtual machines for their core request path. Cloudflare chose V8 isolates; Fastly chose WebAssembly instances. Both achieve start-up times measured in microseconds to low milliseconds rather than hundreds of milliseconds. The difference between those two approaches is the subject of Chapter 2. The two clocks It is worth formalizing the observation from the introduction, because it will recur in every chapter. Every request handled at the edge involves two distances. The first is from the user to the code. Edge platforms shrink it to the distance to the nearest PoP, typically single-digit to low tens of milliseconds for users in well-served regions. This distance is paid for every handshake and every request-response exchange between browser and edge. The second is from the code to the state it needs: the database, the session store, the inventory system, the origin that renders whatever the edge cannot. Moving code to the edge does nothing to this distance unless the state also moves. If anything, it can make it worse. An application server that once sat in the same rack as its database now sits in Sydney while the database stays in Virginia. Each sequential query now costs a transpacific round trip instead of a sub-millisecond hop. The arithmetic is unforgiving. Suppose a page needs four sequential database reads. In the conventional architecture the user pays perhaps three long round trips for connection setup and request, and the server pays four tiny ones to its database. Move the rendering to the Sydney PoP without moving the data, and the user pays three short round trips but the edge code pays four long ones, each around 160 milliseconds. The page is now slower than it was before the migration. This exact pattern, edge code making several sequential calls to a distant origin or database, is the most common failure in edge architecture. The rest of the booklet is, in a sense, a catalogue of ways to keep the second clock short: • Answer from cache, so no state is needed. (Chapter 5.) • Read from data replicated to the edge, accepting bounded staleness. (Chapter 6.) • Route all requests that share mutable state to one coordinating object, placed sensibly. (Chapter 6.) • Run the data-heavy part of the work near the data rather than near the user, and keep only the decision-making at the edge. (Chapters 6 and 9.) • Make one parallel batch of calls instead of a sequential chain. (Chapters 3, 4 and 7.) • Split the page so the personalized part is small and the expensive part is cacheable. (Chapter 7.) Each technique has costs and failure modes, and none applies everywhere. But together they explain why the best edge systems look less like a relocated application server and more like an intelligent, programmable front door: a layer that decides, filters, assembles, and caches, close to users, in front of systems that hold the truth further back. Chapter 2: Two Runtime Models: V8 Isolates and WebAssembly Sandboxes Every edge platform must solve the same problem. Thousands of customers, most of whom do not trust one another, want their code available in hundreds of locations. Any given location may see a request for a particular customer only occasionally. When that request arrives, the customer's code must start, run, and finish within a few milliseconds, on hardware shared with everyone else, without any possibility of one customer reading another's memory or starving another's CPU. Containers and virtual machines are too slow to start and too heavy to keep thousands resident per machine. Cloudflare and Fastly each found a different way through, and the choice shapes nearly everything about how their platforms behave. Cloudflare: many tenants in one process V8 is the JavaScript and WebAssembly engine inside Chrome and Node.js. It has a concept called an isolate: an independent instance of the JavaScript heap with its own objects, its own garbage collector state, and no way to reference objects in any other isolate. Chrome uses isolates to keep web pages apart. Cloudflare's insight was that the same mechanism could keep customers apart. A Cloudflare Workers server runs a process, built on Cloudflare's open-source runtime workerd, which hosts many isolates at once, one per active Worker script. When a request arrives for a Worker that is already loaded, the runtime hands it to the existing isolate. When it arrives for a Worker that is not loaded, the runtime creates a new isolate, loads and compiles the script, runs its top-level code, and then dispatches the request. Creating an isolate costs a few milliseconds, which is enormously cheaper than starting a container or a Node.js process, because the engine itself, the standard library, and the runtime's APIs are already in memory and shared. Each new tenant pays only for its own heap and compiled code. Cloudflare added a further trick to hide even that cost. When a browser opens a TLS connection, the first message includes the hostname it wants, in a field called Server Name Indication. The Workers runtime reads that hostname at the very start of the handshake and begins loading the relevant Worker while the cryptographic negotiation is still completing. By the time the HTTP request arrives, the isolate is usually warm. Cloudflare has described this as eliminating cold starts for most requests, and for typical scripts it largely does. Because an isolate is reused for many requests, sometimes thousands, a Worker behaves less like a function and more like a small, long-lived server that the platform may discard at any moment. Variables declared at module scope persist between requests that happen to hit the same isolate. This is useful: you can parse a configuration blob once, hold a compiled regular expression, or keep a small in-memory cache. It is also dangerous. A developer who stores request-specific data in a module-level variable, perhaps a "current user" set at the top of the handler and read further down, will eventually see one user's data leak into another's response when two requests interleave in the same isolate during an await. And nothing guarantees that the global state survives: the same user's next request may land on a different machine, a different isolate, or a freshly created one. Module-scope state in Workers is a best-effort cache, never a store. Isolates also share a process, which raises the question of side-channel attacks. The Spectre family of vulnerabilities showed that code running in one security context could, with a precise enough timer, infer data from another context in the same process by measuring cache behavior. Cloudflare's response combines several measures. Inside a Worker, the clock does not advance during computation: Date.now() and performance.now() return the time of the last I/O event, so a tight loop cannot time itself. Multithreading primitives that could be used to build a substitute timer are not exposed. The runtime monitors for behavior characteristic of side-channel attacks and can move a suspicious Worker into its own process. Workers are also grouped into separate processes by trust level, so free-tier code does not share a process with enterprise customers' code. No defense against Spectre is absolute, but these choices raise the cost of attack considerably while keeping the multi-tenant process model. The frozen clock has a practical consequence developers trip over: measuring how long a piece of code takes with Date.now() before and after will report zero unless there was I/O in between. Profiling in Workers is done with the platform's tooling and CPU-time metrics, not with hand-rolled timers. Fastly: a fresh sandbox for every request Fastly took a different path, rooted in WebAssembly. WebAssembly, usually shortened to Wasm, is a portable binary instruction format designed as a compilation target. Code written in Rust, C, C++, Go, and many other languages can be compiled to a Wasm module. The module declares what it needs from the outside world as a list of imports, and the host decides what to provide. A Wasm module has a single block of linear memory that it can address; every load and store is bounds-checked, so it cannot read or write outside that block. It has no ambient access to files, sockets, clocks, or anything else. It can only call the functions the host has explicitly handed it. This makes Wasm an attractive sandbox. Fastly built an ahead-of-time compiler called Lucet, open-sourced in 2019, which translated Wasm modules to native machine code at deploy time so that instantiation at request time was nearly free. Fastly described Lucet as able to instantiate a module in tens of microseconds. Fastly later folded that work into Wasmtime, the WebAssembly runtime developed by the Bytecode Alliance, a non-profit whose founding members included Fastly, Mozilla, Intel, and Red Hat. Fastly Compute runs customer code on Wasmtime today. The defining property of Fastly Compute is that each request gets its own fresh instance. When a request arrives, the platform creates a new instance of the customer's precompiled module, with clean linear memory, runs the handler, and destroys the instance when the response is complete. Nothing from one request can survive into the next, because nothing survives at all. There is no shared module scope, no warm in-memory cache, and no possibility of the cross-request leakage described above. That sounds expensive, but instantiating a precompiled Wasm module mostly involves setting up memory mappings, and the instance's initial memory image can be mapped copy-on-write so that only pages the request actually modifies cost anything. For languages that need significant initialization, such as JavaScript, which must boot an entire engine, Fastly relies on snapshotting. A tool called Wizer, which originated at Fastly and now lives in the Bytecode Alliance, runs a module's initialization at build time and saves the resulting memory as the module's starting image. Fastly's JavaScript SDK uses this approach: it compiles Mozilla's SpiderMonkey JavaScript engine to WebAssembly, loads and initializes the customer's script at build time, and snapshots the result, so each request starts from an already-initialized engine. Per-request isolation also changes the security argument. Each request runs in its own linear memory, bounds-checked by compiled code, with only the host functions Fastly chooses to expose. A bug in one request cannot corrupt another request's state, even for the same customer. Spectre-style concerns still apply to any shared hardware, and Wasmtime includes mitigations, but the absence of long-lived shared state within a tenant removes a whole class of application-level bugs. How the models differ in practice Most practical differences between the platforms trace back to these two designs. Table 1 summarizes the most consequential ones, using limits from each vendor's published documentation as of late 2026. Table 1. How the two runtime models compare in practice (sources: Cloudflare Workers limits documentation; Fastly Compute resource limits documentation, late 2026). Property Cloudflare Workers Fastly Compute Sandbox unit V8 isolate, reused across requests Wasmtime instance, one per request State between requests Module scope may persist (best effort) None Native languages JavaScript, TypeScript, Python, Wasm Rust, JavaScript, Go, C++ via Wasm Memory per unit 128 MB per isolate 128 MB heap, 1 MB stack CPU time per request 10 ms free; 30 s default, 5 min max paid 50 ms listed limit Code size 64 MiB uncompressed 100 MB compiled package A few rows deserve elaboration. Languages. Workers is fundamentally a JavaScript runtime. TypeScript compiles to JavaScript. Rust and other languages run by compiling to Wasm and executing inside the V8 isolate alongside a JavaScript shim, which is workable but means calls to platform APIs cross a boundary between Wasm and JavaScript. Python reached general availability on Workers in September 2026 after a two-year beta; it runs on Pyodide, the CPython interpreter compiled to WebAssembly, inside the same V8 runtime, with the consequence that threading and multiprocessing are unavailable. Fastly is fundamentally a Wasm runtime. Rust is the most mature SDK, because Rust compiles to compact, fast Wasm with no garbage collector to carry along. JavaScript runs via the embedded SpiderMonkey engine. Go is officially supported, and C++ through the WASI SDK. Any language that can target WebAssembly and speak Fastly's host interface can in principle run. CPU limits. Both platforms meter CPU time, not wall-clock time. Time spent waiting on a network response does not count. This matters: a Worker that waits two seconds for an origin but computes for three milliseconds has used three milliseconds of CPU. Cloudflare's free tier allows 10 milliseconds per request, enough for routing, header manipulation, and light transformation but not for heavy rendering. The paid tier defaults to 30 seconds and can be raised to five minutes, which moves Workers into territory once reserved for regional serverless functions. Fastly's published limits list 50 milliseconds of CPU per execution and a wall-clock maximum of two minutes (60 seconds on trial accounts). The practical lesson on both is the same: the edge is for work measured in milliseconds of CPU, and work measured in seconds belongs elsewhere unless you have deliberately configured for it. Memory. Both offer about 128 megabytes. In Workers that budget belongs to the isolate and is shared across all concurrent requests it is handling, so a Worker that buffers large bodies under load can hit the limit even if each request is modest. In Fastly it belongs to the single request. Either way, the right pattern for large payloads is streaming, passing bytes through without holding them all in memory, which both platforms support well. Global state. This is the difference most likely to surprise someone moving between platforms. Code that relies on a module-level cache in Workers, for example memoizing an expensive configuration parse, will run correctly on Fastly but pay the full cost every request. Code written for Fastly's clean-slate model will run on Workers, but if it accidentally stores request data in globals, it may leak across requests. Write edge code as if global state does not exist, and treat any module-scope caching on Workers as a deliberate, bounded optimization. Language performance across the two models The sandbox choice has a less obvious consequence for raw execution speed, and it runs in opposite directions for the two main languages. JavaScript on Workers runs on V8 with its full just-in-time compilation pipeline. Hot functions are profiled and compiled to optimized machine code while the isolate runs, and because isolates are reused across many requests, that optimization work pays off: a Worker that has served a few hundred requests is typically running well-optimized native code for its hot paths. CPU-heavy JavaScript, such as parsing a large JSON document or rendering a template, performs much as it would in Node.js. JavaScript on Fastly runs differently. SpiderMonkey compiled to WebAssembly cannot generate new machine code at run time inside the sandbox, because WebAssembly has no facility for a module to emit and execute fresh code; that restriction is part of what makes it a strong sandbox. The engine therefore runs JavaScript in its interpreter. And because each request starts from a fresh snapshot, no warm-up accumulated by one request benefits the next. Engineers at Fastly and in the Bytecode Alliance have attacked this with ahead-of-time techniques, including a partial evaluator called weval that specializes the interpreter for the specific JavaScript in a package at build time, and have reported substantial speedups. Even so, CPU-intensive JavaScript generally runs slower on Fastly than on V8. For the usual edge workload, which is mostly header manipulation, routing, and waiting on I/O, the difference rarely matters. For heavy computation it can. Rust reverses the picture. On Fastly, Rust compiles to WebAssembly and Wasmtime compiles that ahead of time to native code at deploy time, so Rust handlers run at close to native speed with no garbage collector and no interpreter. On Workers, Rust also compiles to WebAssembly and V8 compiles it efficiently, but calls between the Rust code and the JavaScript-based platform APIs, such as fetch, the request and response objects, and bindings, cross a language boundary with copying and conversion costs. The workers-rs library smooths the ergonomics, but Rust on Workers is best suited to compute-heavy cores, such as image processing, parsing, or cryptography, called from a JavaScript or TypeScript shell, rather than to request handling that touches platform APIs constantly. Bundle size interacts with all of this. On Workers, a large script or Wasm module takes longer to compile when an isolate is created, which shows up as start-up latency on the first request to a location; the documented limit on start-up time is one second, after which the deployment is rejected. On Fastly, compilation happens at deploy time, but a large package still has a larger memory image to map. In both cases, keeping edge bundles small, by avoiding heavyweight dependencies and splitting rarely used functionality into separate services, is one of the cheapest performance improvements available. Standards and portability One more difference has grown in importance. Cloudflare built Workers around web-platform APIs: the fetch function, Request and Response objects, streams, URL, the Web Crypto API, and so on. These are the same interfaces browsers implement. In 2022 Cloudflare, Deno, Vercel, Shopify, and others formed a working group, WinterCG, to align server-side JavaScript runtimes on a common subset of these APIs; the effort continued as WinterTC under Ecma International. The effect is that edge JavaScript written against standard fetch, Request, and Response is fairly portable among Workers, Deno, Bun, Node.js, and Fastly's JavaScript SDK, which exposes the same core classes. Workers also offers a Node.js compatibility mode that implements many Node built-in modules, so a large share of npm packages now run unmodified. Fastly's portability story centers on WebAssembly standards. The WebAssembly System Interface, WASI, defines standard host interfaces so that a Wasm module is not tied to one runtime. WASI 0.2, stabilized in early 2024, introduced the Component Model: a way to describe a module's imports and exports in a typed interface language called WIT, and to compose components written in different languages. One of the standard "worlds" WASI 0.2 defines is wasi:http/proxy, an interface for components that receive an HTTP request and produce a response, possibly making outbound requests along the way. That is precisely the shape of an edge function, and Fastly engineers were among its designers. WASI 0.3, released in June 2026, moved asynchronous operations into the Component Model itself with native async functions, stream and future types, and considerably simpler HTTP interfaces. The long-term promise is that an HTTP handler compiled to a standard component could run on Fastly, on other Wasmtime-based hosts, or on a developer's laptop without modification. In late 2026 that promise is partly realized: the standards exist and runtimes implement them, but each commercial platform still exposes proprietary capabilities, such as its cache, its stores, and its geolocation data, through its own interfaces. Portability of the core request-handling logic is real; portability of a whole application that uses a platform's storage and caching features is not. Choosing between the models Neither design is better in the abstract. The isolate model offers a richer JavaScript ecosystem, module-scope caching, and a platform that has grown outward into storage, databases, queues, and containers. The per-request Wasm model offers stronger isolation by construction, first-class support for compiled languages, and a cleaner path toward standard, portable components. For most teams the decision is driven less by the sandbox than by what surrounds it: which platform fronts their existing traffic, which storage primitives they need, which language their team writes, and which caching model fits their content. The next two chapters look at each platform as a programming environment, beginning with Workers. Chapter 3: Programming Cloudflare Workers A Worker is a module that exports handlers for events. The event that matters most is an incoming HTTP request, but the same module can also handle scheduled triggers, queue messages, email, and calls from other Workers. This chapter walks through the programming model as it stands in late 2026: the handler, the environment and its bindings, configuration, background work, composition between Workers, deployment, and local development. The aim is not to reproduce the reference documentation but to explain the shape of the system and the decisions it pushes you toward. The handler, the environment, and the context The simplest useful Worker looks like this: export default { async fetch(request, env, ctx) { const url = new URL(request.url); if (url.pathname === "/healthz") { return new Response("ok"); } const country = request.cf?.country ?? "XX"; const upstream = await fetch(request); const res = new Response(upstream.body, upstream); res.headers.set("x-edge-country", country); return res; }, }; Three arguments arrive with every request, and each embodies a design decision. request is a standard Request object, the same class browsers use. It carries the method, URL, headers, and a streaming body. Cloudflare adds a non-standard cf property containing metadata the edge knows about the connection: the visitor's country, city, region, approximate latitude and longitude, autonomous system number, the PoP's airport code, TLS version, HTTP protocol, and more. This is the raw material for geographic personalization in Chapter 7, and it costs nothing to read because the edge computed it while terminating the connection. env holds the Worker's bindings. A binding is a named, pre-authorized handle to a resource: a KV namespace, a Durable Object class, a D1 database, an R2 bucket, a queue, another Worker, a secret, or a plain configuration variable. The Worker never sees credentials or connection strings for these resources. It simply calls env.FLAGS.get("checkout-v2") or env.BUCKET.put(key, body), and the runtime routes the call. This capability-based design has two benefits. Security is simpler, because there are no keys in code to leak and a Worker can reach only what it has been bound to. And the same code runs unchanged in development, staging, and production, because only the bindings differ. ctx is the execution context. Its most important method is waitUntil, discussed below. Note what the example does with the upstream response. A Response returned from fetch has immutable headers, so to modify them the code constructs a new Response from the old one's body and metadata. The body is passed as a stream; the Worker never buffers it. A Worker that only rewrites headers adds almost no memory pressure and almost no latency, even for very large responses. Configuration, compatibility dates, and secrets A Worker is configured in a file read by Wrangler, Cloudflare's command-line tool. Newer projects use wrangler.jsonc, a JSON file that permits comments; older ones use wrangler.toml. A representative configuration: { "name": "storefront-edge", "main": "src/index.ts", "compatibility_date": "2026-09-01", "compatibility_flags": ["nodejs_compat"], "routes": [ { "pattern": "shop.example.com/*", "zone_name": "example.com" } ], "kv_namespaces": [{ "binding": "FLAGS", "id": "" }], "vars": { "ORIGIN": "https://origin.example.com" }, "observability": { "enabled": true } } The compatibility_date field deserves attention because it solves a problem every platform with a runtime eventually faces. When Cloudflare fixes a bug or changes an API's behavior in a way that could break existing code, it gates the change behind a date. A Worker declares the date it was written against, and the runtime emulates the behavior as of that date. Old Workers keep running exactly as they did, while new Workers get current behavior. Individual changes can also be toggled with compatibility_flags; the nodejs_compat flag, for instance, enables the Node.js built-in modules that let many npm packages run. Bumping the compatibility date is a deliberate act and should be treated like a dependency upgrade: read the change log, run the tests, deploy gradually. Routes attach the Worker to traffic. A route pattern such as shop.example.com/* means requests to that hostname on a zone proxied by Cloudflare invoke the Worker before anything else. Alternatively a Worker can own a custom domain outright, acting as the origin with no other server behind it, or be reached on a workers.dev subdomain for testing. Secrets, such as API keys for third-party services, are never placed in the configuration file. They are uploaded with wrangler secret put NAME and appear on env alongside other bindings, encrypted at rest and invisible in the dashboard after creation. Plain vars are for non-sensitive configuration only. Background work and the shape of a request A Worker's response should be sent as soon as it is ready. Work that the user does not need to wait for, such as sending an analytics event, writing a log line to an external collector, or refreshing a cache entry, should not delay it. ctx.waitUntil exists for exactly this purpose: export default { async fetch(request, env, ctx) { const res = await handle(request, env); ctx.waitUntil( fetch("https://collector.example.com/events", { method: "POST", body: JSON.stringify({ path: new URL(request.url).pathname, status: res.status, ts: Date.now() }), }) ); return res; }, }; The response goes back immediately; the runtime keeps the isolate alive until the promise passed to waitUntil settles, within limits. Without waitUntil, a promise left unawaited after the handler returns may be cancelled when the request ends. Forgetting this is a common source of silently missing analytics. The second principle concerns outbound calls. Recall from Chapter 1 that sequential calls to distant services are the main way edge code becomes slow. Whenever calls are independent, issue them together: const [user, cart, recs] = await Promise.all([ fetch(`${env.API}/me`, { headers: auth }), fetch(`${env.API}/cart`, { headers: auth }), fetch(`${env.API}/recommendations`, { headers: auth }), ]); Three calls that each take 120 milliseconds from a distant PoP cost 120 milliseconds together instead of 360 in sequence. The runtime limits how many outbound connections can be waiting for response headers simultaneously, documented as six per invocation, with additional requests queued until one completes, so fan-out is not unlimited. The total number of subrequests per invocation is also capped: 50 on the free plan and, by default, 10,000 on the paid plan. Composition: service bindings and RPC Real systems grow beyond one Worker. An authentication check, a pricing service, or an image transformer may be shared by several front-end Workers. Calling them over public HTTP would work but would add a network hop, require authentication between them, and expose internal services to the internet. Service bindings solve this. One Worker binds to another by name, and calls go directly through the runtime, often within the same machine and sometimes within the same thread, with no public network involved and no extra charge for the call. Originally service bindings forwarded Request objects; since 2024 they also support remote procedure calls, in which the target Worker exports a class whose methods the caller invokes as if they were local: // auth-worker import { WorkerEntrypoint } from "cloudflare:workers"; export class AuthService extends WorkerEntrypoint { async verify(token) { const claims = await verifyJwt(token, this.env.JWKS_URL); return { userId: claims.sub, plan: claims.plan }; } } // storefront-edge, with binding AUTH -> auth-worker / AuthService const user = await env.AUTH.verify(token); Arguments and return values are serialized with the structured-clone algorithm, so plain objects, arrays, dates, and binary data pass naturally, and functions and stubs can be passed by reference. This makes it practical to split a system into small, independently deployed Workers without paying the latency and complexity tax of internal HTTP APIs. The same RPC mechanism is how Workers talk to Durable Objects, described in Chapter 6. Beyond request handlers The same module can export other handlers. A scheduled handler runs on a cron schedule declared in configuration, useful for refreshing data that the request path reads from KV. A queue handler consumes batches of messages from Cloudflare Queues, which decouples a fast request path from slower downstream work: the request handler enqueues a message and returns; a consumer processes it with retries. Cloudflare Workflows, generally available since 2025, builds durable multi-step execution on top of Workers and Durable Objects, so that a long process, such as an order pipeline that waits for payment confirmation and then provisions an account, survives restarts and retries individual steps. For static files, Workers Static Assets lets a single Worker deployment include a directory of HTML, JavaScript, CSS, and images that the platform serves directly, without invoking the Worker's code and without counting against CPU time, with the Worker handling only dynamic routes. This has largely absorbed the role Cloudflare Pages once played and is how full-stack frameworks deploy to Workers. And when something genuinely cannot run in an isolate, such as a native binary, a program needing a full Linux filesystem, or a workload needing many gigabytes of memory, Cloudflare Containers, available on the paid plan, runs container images controlled from a Worker through a Durable Object. That is a different performance profile, with container start times instead of isolate start times, and should be thought of as an escape hatch rather than the main path. Python deserves a brief note. Since September 2026 Python Workers have been generally available. A Python Worker defines a WorkerEntrypoint subclass with a fetch method (older examples use a top-level on_fetch function), accesses the same bindings through self.env, and can import many pure-Python packages and packages that Pyodide has compiled to WebAssembly. Start-up is heavier than for JavaScript because an interpreter must be initialized; Cloudflare mitigates this with memory snapshots taken at deploy time. For edge logic that is mostly routing and light transformation, JavaScript or TypeScript remains the lower-latency choice; for teams whose business logic already lives in Python, the option removes a rewrite. Deployment and gradual rollout wrangler deploy uploads the Worker and makes it live globally, typically within seconds. That speed is a double-edged sword. A change that breaks every request breaks it everywhere, almost at once. Workers therefore supports versions and gradual deployments. wrangler versions upload creates a new version without sending it any traffic. wrangler versions deploy then assigns percentages, for example 5 percent to the new version and 95 to the old, and the runtime splits traffic accordingly. Each request is tagged with the version that served it, so error rates and latency can be compared between versions in the platform's metrics before shifting more traffic. A rollback is a reassignment of percentages, not a rebuild. Any change to a Worker that sits in front of production traffic should go through this path; Chapter 8 returns to why. Local development and testing wrangler dev runs the Worker locally on workerd, the same open-source runtime that powers production, so behavior such as the frozen clock, the absence of certain Node APIs without the compatibility flag, and the semantics of streams match closely. Local KV, D1, R2, Durable Objects, and queues are simulated on disk, or the developer can bind to remote resources for integration testing. For automated tests, Cloudflare publishes an integration for Vitest that runs test files inside the Workers runtime itself, with isolated per-test storage. This matters because the most common class of edge bug, code that works in Node.js but fails in the Workers runtime because of a missing API or different stream behavior, is invisible to tests run in Node. Testing in the real runtime catches it before deployment. A worked example: an edge gateway Many organizations' first serious Worker is a gateway that sits in front of several backends: a legacy monolith, a newer API service, a marketing site hosted elsewhere. The gateway routes by path, enforces authentication on some routes, and gives every backend a consistent set of headers. A compact version shows how the pieces from this chapter combine: const ROUTES: Array<[RegExp, string, boolean]> = [ [/^\/api\//, "https://api.internal.example.com", true], [/^\/account\//, "https://app.internal.example.com", true], [/^\//, "https://www.origin.example.com", false], ]; export default { async fetch(request: Request, env: Env, ctx: ExecutionContext) { const url = new URL(request.url); const [, base, needsAuth] = ROUTES.find(([re]) => re.test(url.pathname))!; const headers = new Headers(request.headers); headers.delete("x-user-id"); // never trust the client if (needsAuth) { const token = headers.get("authorization")?.replace(/^Bearer /, ""); const user = token ? await env.AUTH.verify(token).catch(() => null) : null; if (!user) return new Response("Unauthorized", { status: 401 }); headers.set("x-user-id", user.userId); } const target = new URL(url.pathname + url.search, base); return fetch(new Request(target, { method: request.method, headers, body: request.body, redirect: "manual" })); }, }; Several decisions in this short program are worth drawing out. The routing table is data, not branching logic, so adding a backend is a one-line change that is easy to review. The x-user-id header is deleted from the incoming request before anything else happens, so that only the gateway can set it; the backends can trust it precisely because the client cannot forge it. Authentication is delegated to a separate Worker over a service binding, so the verification logic and its keys are owned by one team and reused by every gateway. A verification failure is treated as unauthenticated rather than as an error, so a malformed token yields a clean 401 instead of a 500. The body is passed through as a stream, never buffered. And redirect: "manual" ensures that redirects from backends are passed to the browser rather than followed by the gateway, which would otherwise expose internal hostnames and break relative URLs. In production this gateway would also attach a request ID, log the route and outcome through waitUntil, and set cache options on the public route. But even the compact version replaces what used to be a load balancer configuration, an authentication middleware layer in each service, and some header-rewriting rules, with one reviewed, tested, versioned program running in every PoP. Mistakes that recur Certain errors appear again and again in Workers code, and almost all of them come from habits formed in long-running server environments. Reading a body twice. A request or response body is a stream and can be consumed once. Code that calls await request.json() to inspect a payload and then forwards request to an origin will send an empty body. Clone first with request.clone(), or read the body once and construct a new request from the parsed value. Modifying immutable headers. Responses returned by fetch have immutable headers. Attempting to set a header on them throws. Construct a new Response from the original, as in the first example in this chapter. Losing background work. A promise started but not awaited and not passed to ctx.waitUntil may be cancelled when the response completes. Analytics, logging, and cache writes belong in waitUntil. Request data in module scope. As described in Chapter 2, module-level variables are shared by all requests an isolate handles. Anything specific to one request must live in local variables or be passed explicitly. Sequential awaits on independent calls. Writing await on each outbound call in turn is natural and expensive. Independent calls should be started together and awaited with Promise.all. Assuming request.cf exists everywhere. The cf object is populated by Cloudflare's edge. In local development it is simulated, and in tests it may be absent. Code that reads request.cf.country without a fallback will throw in environments where it is undefined. Using Node.js APIs without the compatibility flag. Many npm packages import Node built-ins. Without nodejs_compat they fail at build or run time; with it, most work, but some, particularly those that use native addons or the file system, never will. Check dependencies in the real runtime early. What the model encourages Taken together, the Workers programming model nudges developers toward a particular style. Handlers are small and stream rather than buffer. Resources are reached through bindings, not credentials. Independent calls run in parallel. Non-critical work moves to waitUntil or a queue. Larger systems split into several Workers connected by service bindings rather than one large script. Static content is served without invoking code at all. And anything with persistent or coordinated state is pushed into a storage primitive designed for it, never into module-scope variables. That last point leads naturally to the storage chapter. Before that, the next chapter examines Fastly Compute, whose programming model shares the same request-in, response-out shape but makes noticeably different choices about backends, configuration, and state. Hashtags: #ServerlessEdgeComputing #EdgeComputing #ServerlessComputing #CloudflareWorkers #FastlyCompute #ComputeAtEdge #CloudComputing #EdgeFunctions #ContentDeliveryNetwork #CDN #WebAssembly #Wasm #V8Isolates #Wasmtime #DistributedSystems #CloudArchitecture #LowLatency #PerformanceOptimization #EdgeCaching #ProgrammableCaching #CacheManagement #GlobalInfrastructure #EdgeSecurity #CloudNative #DurableObjects #WorkersKV #HTTP3 #WebPerformance #EdgePersonalization #ScalableInfrastructure