用户遇到未发现缺陷的概率的上限
An Upper Bound on the Probability That a User Encounters an Undiscovered Defect
浏览论文内容
中文总结 AI 辅助
研究用户遇到未发现缺陷的概率问题，核心方法是将beta测试报告视为样本、缺陷视为类别，以$s/n$作为概率上限，贡献是给出无分布估计，无需多种假设且能自动界定隐藏缺陷，还用合成群体验证了估计器。
中文摘要 AI 辅助
在向普通用户发布软件之前，开发者必须权衡一个问题：如果现在发布，有多少用户仍会遇到缺陷？这不是关于剩余缺陷数量或特定缺陷是否存在的问题，而是关于用户遇到缺陷的概率。我们给出了一个直接的、无分布的答案。将每个beta测试报告视为从用户群体中抽取的样本，每个不同的缺陷视为一个类别，我们表明恰好报告一次的缺陷比例$s/n$是用户遇到测试中未发现缺陷的概率的保守上限。这个上限是在一般瓮模型下未发现缺陷数量的精确最大似然估计。该估计不需要操作剖面，不需要对缺陷数量或频率做假设，也不需要程序内部结构模型。我们用已知真实情况的合成群体验证了估计器，并讨论了用户层面数据。
英文摘要
Before releasing software to a general population, a developer must weigh a single question: if we ship now, what fraction of users will still hit a defect? This is not a question about how many defects remain, nor whether any particular defect is present -- the quantities the reliability literature has long estimated -- but about a different and, for a release decision, more consequential one: the probability that a user encounters a defect at all. We give a direct, distribution-free answer. Reading each beta-test report as a draw from the user population and each distinct defect as a class, we show that the fraction of defects reported exactly once, $s/n$, is a conservative upper bound on the probability that a user encounters a defect unseen in testing. This bound is the exact maximum-likelihood estimate of the mass of unseen defects under a general urn construction -- the canonical form -- into which any population of classes embeds; because that construction charges every singleton to the unseen reservoir, $s/n$ overstates the user's risk rather than understating it, the direction a release decision requires. The estimate needs no operational profile, no assumption on the number or frequency of defects, and no model of the program's internal structure -- since a defect's report count already reflects how many users reach it, the estimate is invariant to whether the reachability graph is a tree or a directed acyclic graph, and defects hidden behind other defects are bounded automatically. We validate the estimator against synthetic populations with known ground truth, and discuss the encounter-level data -- beta or crash telemetry -- under which the user-facing reading holds.
