The user count that is not one

Everything measured tonight comes out of a generator that builds a population, gives each party some addresses and produces transactions from them. Nothing here describes anything outside this page. That is a deliberate choice and it is the only choice that makes tonight worth forty five minutes.

On rows from anywhere else, an entity count is unknowable, which means every method is unfalsifiable and the discussion collapses into whose method sounds more careful. Here the generator knows the truth, the method never sees it, and the two get compared afterwards. That is the difference between a claim and a measurement, and it is the reason this world exists.

• Address. One identifier in the rows. About 1,000 of them appear in a Larkfield month.
• Entity. One real party, holding one or more addresses. There are 304, and the data never says so.
• Co-spend. A single transaction that spends from two addresses at once. The only evidence of common control that exists in these rows.
• Cluster. A set of addresses the method has decided belong together. There are 676 to 707 of them.
• Still split. Clusters beyond the true entity count: addresses that belong to one party and were not joined. The whole of the remaining error.
• Wrongly merged. A cluster holding addresses from more than one party. Zero, in every month measured.
• Operator. A party running many addresses deliberately. Four of them here, and they turn out not to be the main problem.
• Probabilistic linkage. Joining records by fuzzy attributes and scores, which is a different craft and lives in learn-entity-resolution-with-phoebe. The evidence here is structural and the join is deterministic.

A co-spend is strong evidence. To spend from two addresses in one transaction you have to be able to authorise both, which means one party controls both, which is exactly the thing being inferred. When the method says two addresses belong together it is right, and the measurements later confirm that it is right every single time.

The absence of a co-spend is evidence of nothing at all. It is consistent with two different owners and it is equally consistent with one owner who never happened to spend from both at once. Nothing distinguishes those cases, and nothing else in the rows carries an alternative signal, because there are no attributes to compare. Names, contact details and behavioural fingerprints do not exist here; that whole family of technique belongs to learn-entity-resolution-with-phoebe and there is nothing for it to work on.

Read those two paragraphs together and the shape of the error is already determined before anyone runs anything. Strong positive evidence, no negative evidence, therefore missed links and no false links. That is a property of the method, not a property of the data, and it is what makes the result reportable.

It is tempting to read the diagram as a story about evasion, and every conversation about address counts drifts that way within a few minutes. Owner 3 is the correction. Three addresses, one ordinary person, nothing concealed, no intent of any kind, and the method returns three parties.

People hold several addresses for reasons that have nothing to do with hiding: one for a long-term holding, one for day to day, one that came with a device, one they stopped using. No rule was broken and no counter-measure would help. The addresses simply never got spent together, and the only evidence the method uses is the one that never arrived.

Keep owner 3 in mind through Part 2, because the second measured finding of the night is that owner 3, not the operators, is where most of the remaining error lives.

Given what follows, a reasonable reaction is to ask why anyone bothers. The answer is that it removes about half the error, it does so with no tuning and no parameters, and it produces an artefact that is worth more than the number: a bound with a known direction.

A method with no parameters is also a method nobody can quietly tilt. There is no threshold to move when the result is unwelcome, no similarity cutoff to argue about in a review, and no way to produce a different answer from the same rows. For a figure that will be read by people outside the company, that property is not a consolation prize. It is most of the value.

Drag the slider anywhere you like and watch the wrongly merged column. It stays at zero. Across every month and every setting, the method has never once put two real parties in the same cluster, and the reason is structural rather than lucky: a co-spend cannot happen between two parties who cannot authorise each other's addresses.

That single fact changes what can be said out loud. "Larkfield has 696 users" is a claim with an unknown error in an unknown direction, and it is wrong. "Larkfield has at most 696 entities, and the true figure is somewhere below that" is a claim with a known direction, a stated method and no tuning, and it is correct. The second sentence is less satisfying and considerably more useful, because a decision made on a ceiling is a decision that cannot be embarrassed by the truth arriving later.

Notice what the bound does not give you. There is no floor. Nothing in this run says the answer is above 400, or above 304, or above anything at all, and inventing one from the shape of the distribution would be putting back exactly the false confidence that the bound removed.

Every conversation about address counts ends up about operators, and every proposed fix is aimed at them. So take the four operators in Larkfield's world and vary how carefully they avoid co-spending, from careless at 50 percent to perfect at 100 percent. The clustered count moves from 666 to 697.

That is a range of 31, against a gap between the clustered figure and the truth of 392. Perfect operator tradecraft and sloppy operator tradecraft produce almost the same number, which means the operators' behaviour is not what the gap is made of. Their many addresses still are: decomposed, the operators account for 235 of the 392 and ordinary holders for 157. What barely moves is the part that responds to how carefully they act.

The consequence for a plan of work is direct and unwelcome. Effort aimed at detecting deliberate multi-address behaviour is aimed at a small fraction of the error. The large fraction is not a detection problem at all, because there is nothing to detect and nobody is doing anything.

One camp holds that you report the bound and you refuse the point estimate, in every forum, permanently. Their argument is that a ceiling is the only thing the evidence supports, and that a number offered with a caveat becomes a number without a caveat by the second slide it appears on. They have watched it happen. Give a board 696 with a footnote and within a quarter the 696 is in a target, a bonus and an external deck, and the footnote is gone.

The other camp holds that refusing to give a figure does not remove the figure, it relocates it. Somebody will still put a number in the board pack, and it will be produced by whoever is least equipped to caveat it, using a method nobody wrote down. On this view the responsible move is to publish the clustered number with a stated direction of error, a documented method and a standing instruction that it can only be compared with itself. A wrong number with known properties beats a vacuum that gets filled.

Both camps are staffed by people who have been burned. Notice that they disagree about organisations rather than about statistics: neither one disputes the measurement. Which one is right in your building depends on whether a caveat survives contact with your reporting chain, and you probably already know the answer to that.