Prediction model study
A prediction model does not ask which variable is associated with the outcome; it asks what this person's risk is — and that switch changes what counts as passing. This chapter walks through a real external validation where discrimination barely drops while calibration goes systematically wrong.
Change the question and you change what counts as passing
The models in the previous chapters were all answering aetiological questions: is this exposure associated with this outcome, how strongly, and is it causal. A prediction model asks something entirely different: given this person’s data, what is their risk?
That switch has larger consequences than it sounds:
| Aetiological study | Prediction model | |
|---|---|---|
| What you want to know | The effect of one variable | One person’s risk |
| Whether a variable enters the model | Decided by causal structure — is it a confounder, is it a mediator | Decided by whether it helps prediction; causality is beside the point |
| Collinearity | Destabilises the coefficient you care about, so it is a problem | Not a problem as long as the predictions are stable |
| How you judge it | Is the estimate unbiased, do the assumptions hold | How it performs on people it has never seen |
The worked example: a genuine external validation
Two breast cancer cohorts: develop the model on survival::rotterdam (2982 patients) and validate it externally on survival::gbsg (686 patients).
There is exactly one reason for this pairing: it is the only combination on this site that can demonstrate external validation honestly. Splitting one dataset in half is internal validation wearing an external validation’s clothes — a real external validation requires different people, different investigators, a different time and place.
First, the half that usually goes unwritten: harmonising the data
The two datasets do not define their fields the same way, so before any model can be fitted a series of mapping decisions has to be made. Every one of them could move the result, yet a paper’s Methods section will typically compress the lot into “variables were harmonised across the two cohorts prior to analysis”.
This chapter lists them all:
| # | Harmonisation decision |
|---|---|
| 1 | rotterdam records recurrence and death separately: recurrence-free survival is taken as the first of the two, to match gbsg's single rfstime endpoint. |
| 2 | rotterdam records tumour size in bands (<=20, 20-50, >50 mm); each band is mapped to its midpoint (15, 35, 60 mm) so it can enter the model as a continuous term alongside gbsg's millimetres. |
| 3 | Grade is collapsed to 1-2 versus 3 because the two cohorts do not use the same grading detail. |
| 4 | Complete cases only, on the four predictors and the endpoint. |
Development: EPV and variable selection
The model is a Cox regression with four predictors: age, tumour size, node count and grade.
The development cohort has 2982 patients and 1713 events, giving 428 events per variable (EPV).
The rule of thumb for EPV is “at least 10 events per variable”. This is far above it, so sample size is not what limits this model.
The model’s coefficients:
| Term | HR | 95% CI | p |
|---|---|---|---|
| age_y | 1.01 | 1.00–1.01 | 0.005 |
| size_mm | 1.01 | 1.01–1.02 | < 0.001 |
| nodes_n | 1.07 | 1.07–1.08 | < 0.001 |
| grade_f3 | 1.39 | 1.24–1.57 | < 0.001 |
Internal validation: how large is the optimism
Performance measured on the same data the model was developed on is always flattering, because the coefficients were chosen to make that dataset look good. The gap is called optimism, and the bootstrap measures it: resample, fit the model on the resample, compare how it does on the resample against how it does on the original data, and the difference is the optimism.
| Metric | Value |
|---|---|
| Apparent C-index | 0.666 |
| Bootstrap optimism (200 resamples) | 0.0004 |
| Corrected C-index | 0.666 |
Optimism is only 0.0004 — effectively nil. That is not because the model is unusually good, but because the sample is very large relative to the number of parameters (EPV 428); there is nothing much left to overfit. In a model with single-digit EPV, this gap would be far larger.
External validation: discrimination holds up, calibration does not
This is the heart of the chapter. The same model, dropped onto gbsg (686 patients, 299 events):
| Metric | Development cohort | External cohort |
|---|---|---|
| C-index | 0.666 | 0.642 |
| Calibration slope | 1 (by definition) | 0.691 (95% CI 0.539–0.842) |
Look only at the C-index and you would conclude the model transported reasonably well — from 0.666 down to 0.642, a drop of about 2.4 percentage points, the kind of change a paper would usually describe as “discrimination was well maintained”.
Then look at the calibration plot:
figures/scripts/D5-prediction-rotterdam-gbsg.R| Quintile of predicted risk | n | Predicted 5-year risk | Observed | Gap |
|---|---|---|---|---|
| Group 1 | 138 | 28.7% | 36.4% | 7.7 percentage points |
| Group 2 | 137 | 33.2% | 44.4% | 11.2 percentage points |
| Group 3 | 137 | 38.8% | 46.0% | 7.3 percentage points |
| Group 4 | 137 | 47.2% | 55.1% | 7.9 percentage points |
| Group 5 | 137 | 70.5% | 72.1% | 1.7 percentage points |
A calibration slope of 0.691, clearly below 1, says something separate: the risk differences the model produces are too extreme for this population — it pushes high-risk patients too high and presses low-risk patients too low. A slope below 1 is the commonest pattern in external validation, and usually means either overfitting during development or a genuinely different risk structure in the two populations.
What to do when calibration is broken
Not discard the model — recalibrate it. There are three levels, from light to heavy:
- Intercept only (calibration-in-the-large) — correct the shift in the overall risk level. The overall underestimation here belongs in this category, and it is the easiest part to fix: the new population has a higher baseline risk, so swap the baseline risk out. The slope of 0.691 is a separate problem and would still need level 2.
- Intercept plus slope — also correct how large the risk differences are.
- Re-estimate every coefficient — at which point you are close to developing a new model.
What TRIPOD asks you to state plainly
The TRIPOD+AI checklist is long, but for a reader these are the items that matter most:
- Is the model complete enough to use? Every coefficient, the intercept, the baseline risk — and for a survival model, the baseline survival function too. Miss one and it cannot be reproduced.
- How and when were the predictors measured? If a variable is unobtainable in the deployment setting, the model is unusable there.
- How was missing data handled? Multiple imputation during development is fine, but what happens when a deployed patient is missing one lab value?
- Was the validation internal or external? A split is not external.
- Was calibration reported? A prediction model paper that reports only the C-index or the AUC has reported half of what it owes.
Common misuses
| Misuse | Why it is wrong |
|---|---|
| Reporting the C-index or AUC without calibration | Ranking right does not mean the numbers are right; this chapter’s example has acceptable discrimination and systematically shifted calibration |
| Calling a data split “external validation” | It is internal validation; external means different people and different investigators |
| Choosing the best cut-off in the same data used to report performance | Optimism bias; cut-offs need validating too |
| Selecting variables by stepwise regression and then reporting p-values | The selection process itself consumed the degrees of freedom, so the resulting p-values mean nothing |
| Declaring a model invalid because calibration is off | In most cases recalibration is enough, especially when only the overall risk level is shifted |
| Not reporting the harmonisation decisions | Each mapping decision can change the result, and the reader has no way to judge |
| Claiming a model is robust with EPV < 10 | Almost certainly overfitted — though EPV ≥ 10 is no guarantee either; use Riley’s sample size calculation |
| Publishing a model without its baseline risk | Without a baseline risk no absolute risk can be computed, so the model cannot be used |
Reproducing every number on this page
/opt/homebrew/bin/Rscript figures/scripts/D5-prediction-rotterdam-gbsg.RRead the figure
The answer comes from the same statistical output that produced this page's figures, not from a number typed in beside them.
Moving the model from the development cohort to the external one costs only a little discrimination. Does that support saying the model transported acceptably?
Show the answer and why
Correct answer: No. The calibration slope is 0.691, clearly below perfect, and the C-index is immune to shifting or stretching the risk scale
The C-index asks only whether the model ranks higher-risk people above lower-risk ones. Multiply or add a constant to every predicted risk and the ordering is untouched, so the C-index does not move either. The fall from 0.666 to 0.642 therefore says nothing about whether the predicted numbers themselves are right. The calibration slope of 0.691 speaks to something else: the risk differences the model produces are too extreme for this population, pushing high-risk people too high and low-risk people too low. A prediction model paper reporting only a C-index or an area under the curve, with no calibration, has reported half of what matters.
On the external calibration plot all five risk quintiles sit above the diagonal. How should the lowest-risk group be read?
Show the answer and why
Correct answer: The model predicted 0.287 for them and 0.364 actually occurred, so this group would be filed as low risk when their real risk is not low
All five groups sitting above the diagonal means the whole scale has been shifted down, not that one group had bad luck in sampling. The lowest-risk group was predicted 0.287 and observed 0.364, which is clinically the most dangerous place for the error to land: a threshold rule compares the predicted value against the threshold, and predictions that are systematically low file people who should be treated on the untreated side. The 0.721 is indeed the highest-risk group's observed value, but that group's prediction nearly matches it, because the shift is not uniform and the low-risk end is off by more. The shape comes from two things at once: the whole scale translated downward, plus a calibration slope below perfect calibration pulling the high-risk end back. A shallow slope alone could not produce this plot, since it would put the high-risk end below the diagonal.
The bootstrap optimism comes out at almost zero. Does that mean the model is unusually good?
Show the answer and why
Correct answer: No. An optimism of 0.0004 is that small because the number of events is very large relative to the number of parameters, leaving almost nothing to overfit
Optimism measures how much better a model looks on the data that produced it than on data it has never seen. It comes out small usually because the model had no room to overfit, and here four predictors sit alongside more than seventeen hundred events, giving each variable a three-digit number of events, far beyond any rule of thumb. So 0.0004 says the sample is ample relative to the parameters, not that the model has captured something. The near identity of 0.6661 and 0.6657 is the same fact written twice. More importantly, however clean the internal validation is, it cannot answer the external question: this model's calibration in the external cohort is systematically off, and no bootstrap on the development data will ever see that.
This chapter develops on one cohort and validates on another rather than splitting a single dataset in half. Where is the difference?
Show the answer and why
Correct answer: External validation uses different people: those 686 patients differ from the development cohort in enrolment era, setting and clinical pathway
Splitting one dataset leaves both halves sharing the same eligibility criteria, the same investigators, the same time and place and the same variable definitions, so what it measures is internal stability rather than transportability. The difference between 686 validation patients and 2982 development patients is not the count but the fact that they are another cohort, which is also why a chain of harmonisation decisions has to be made before any model runs, such as converting banded tumour sizes into band midpoints. That conversion is an assumption rather than data, and it will not show up in any statistical test. The 1713 events are certainly ample, but having enough events never turns internal validation into external validation.
This model has four predictors and far more events per variable than the rule of thumb of ten. Does that establish that the sample size is adequate?
Show the answer and why
Correct answer: Broadly yes, but for the right reason: 428 events per variable is far past the rule of thumb, so sample size is not this model's constraint
The ten-events-per-variable rule comes from simulations of the nineteen nineties, and later work shows the required sample size is far more complicated than a single number, with the sample size calculations of Riley and colleagues being the current recommendation. So 428 supports a limited conclusion: it is enough to say sample size is not the constraint here, and not enough to say the sample is adequate because it cleared a threshold. Where the rule still earns its keep is in the other direction, since a model with single-digit events per variable is almost certainly overfitted. Both 1713 and 2982 are totals, and a large total with many predictors can still be too small; what decides is the ratio, not either absolute number.
Calibration fails in the external cohort: all five groups are underestimated and the calibration slope is clearly below perfect. What should be done?
Show the answer and why
Correct answer: Fix the overall underestimation with the intercept first, then deal with the slope, because a slope of 0.691 is not something a shift can repair and needs the second layer of recalibration
Recalibration has three layers, from light to heavy: intercept only, intercept plus slope, and re-estimating every coefficient. This plot shows two problems at once, so two layers are needed. The overall underestimation belongs to the first layer and is fixed by replacing the baseline risk. The slope of 0.691 belongs to the second, and no shift will move it. The 0.444 is the second group's observed risk and the largest departure, but being the largest does not mean aligning it fixes the rest, since the other four groups are off by different amounts. As for 0.539, that is only the lower bound of the slope interval, and broken calibration is almost never a reason to discard a model: recalibration usually suffices, which layer to use depends on how much data the new population supplies, and whichever layer is used, the recalibrated model needs validating again.
Methods used in this chapter
- ROC curves and the area under them
- Variable selection for prediction models
- Shrinkage and penalised regression
- Events per variable, and the Riley sample size criteria
- Internal validation and optimism
- External validation
- Calibration
- Decision curve analysis
- Time-dependent ROC and cumulative-dynamic AUC(t)
- Nomograms
- Brier score, NRI and IDI
- The Cox proportional hazards model
- Restricted cubic splines and the dose-response curve
Watch next
Hazard Ratios – Best explanation for beginners
COX REGRESSION and HAZARD RATIOSSources and licences
- TRIPOD+AI statement: updated guidance for reporting clinical prediction modelsCC BYThe chapter's section order follows the TRIPOD+AI items. The prose is original.