Notes from production
FundamentalsTestingMetrics

True/false vs positive/negative, explained

Every test gives one of two answers — "yes" or "no" — and reality is also one of two — "actually there" or "actually not". Pair them up and you get four outcomes: two where the test is right, two where it's wrong. Those are the true positive, true negative, false positive, and false negative — four words used everywhere, from smoke alarms to blood tests to spam filters.

This article puts all four in one 2×2 box, explains each corner in plain language, then shows the technical and the medical case. But one rule has to come first.

One rule first: mark what "positive" means

Before "true positive" means anything, you have to fix what counts as positive. Positive is the thing you're testing for: on a disease test, positive = "the patient is sick"; on a spam filter, positive = "this message is spam"; on a smoke alarm, positive = "there's a fire". Flip that definition and every true positive turns into a true negative.

Always mark what "positive" means first. Flip that one definition, and every true positive becomes a true negative.

Rule number one

So in every case below, the first sentence is always the same: positive here means…. Without it, the four boxes are meaningless.

Four boxes: true/false × positive/negative

Lay out two axes. Across: reality — the condition is actually present or not. Down: the test's call — positive or negative. Where they cross, you get four boxes.

REALITY (the truth)condition PRESENTcondition ABSENTTHE TEST'S CALLpositivenegativeTPtrue positive✓ correctFPfalse positive✗ false alarmFNfalse negative✗ a missTNtrue negative✓ correct
The x-axis is reality, the y-axis is the test's call. The 'true' diagonal is right; the 'false' diagonal is the two kinds of error.

Reading it is simple. The first word (true/false) says whether the test was right; the second word (positive/negative) says what the test said:

The whole table has a name: the confusion matrix. The correct diagonal (TP + TN) is where the test matches reality; the other two boxes are the two ways it can be wrong.

The technical view: cases

In software, all four boxes show up constantly — and each case starts by marking "positive":

  • Spam filterpositive = "this message is spam". TP: spam lands in junk. FP: real email goes to junk too (annoying). FN: spam slips into the inbox. TN: real email reaches the inbox.
  • Monitoring alertpositive = "something's wrong, fire the alarm". FP: the alarm fires while all is fine (a false alarm that wears the team out). FN: a real problem slips through with no alarm.
  • Cookie SameSite=Laxpositive = "the cookie is sent". Exactly the table in Cookie security: a legit link click is a true positive, a withheld CSRF request is a true negative.
Case"Positive" meansThe costliest error
Spam filterthis message is spamFalse positive — a real email is lost
Disease screeningthe patient is sickFalse negative — a missed diagnosis
Intrusion detectionthis is an attackFalse negative — an intruder gets through
Fraud blockthis charge is fraudFalse positive — a real card is declined

The medical case: a disease screening test

In medicine, these four boxes carry real stakes. Positive = "the test says you have the disease".

THE PATIENTactually SICKactually HEALTHYSCREENING TESTtest +test −TPcaught it✓ treat earlyFPfalse alarmneedless retestFNmissed it⚠ the dangerTNall clear✓ go home
The same box for a screening test. The false negative — sick but the test says clear — is the dangerous one: a missed diagnosis.
  • True positive — sick, and the test catches it. Treatment can start early.
  • True negative — healthy, and the test says clear. Go home reassured.
  • False positive — healthy, but the test says positive. A false alarm: needless worry and a follow-up test.
  • False negative — sick, but the test says clear. This is the one to fear: the disease goes untreated.

That's why screening tests are measured by two numbers. Sensitivity is how rarely the test misses the sick (few false negatives); specificity is how rarely it wrongly flags the healthy (few false positives).

You can't zero out both

Here's the unavoidable trade-off: tune a test to miss less often (fewer false negatives), and it gets twitchier (more false positives). Tune it to be calmer (fewer false positives), and it misses more. You can't drive both to zero at once — you choose which error you can least afford.

When a MISS is worstcut false negatives — accept more false alarmscancer screeningintrusion detectionsmoke alarmWhen a FALSE ALARM is worstcut false positives — accept more missesspam filterfraud blockflaky test suite
Which error costs more depends on the domain — and that decides which way you tune the test.

The bottom line

Four outcomes, two axes: what the test says (positive/negative) against what reality is (true/false). True positive and true negative are right; a false positive is a false alarm, a false negative is a miss. But it all hangs on one step first — mark what "positive" means. Once that's clear, you just pick which error is costliest in your case.

For a software example that plays out in full, see the Lax case table in Cookie security: SameSite, HttpOnly, Secure.

Sources

  1. Wikipedia — Confusion matrix
  2. Wikipedia — Sensitivity and specificity
  3. Wikipedia — Type I and type II errors