Multi-source Bayesian corroboration

Methodology

Each country-day is one observation. Per source s, we compute the presence indicator: did s emit any elevated/warning/critical-level signal on that day? We then estimate two likelihoods on the training window:

• P(s present | C=1): how often s fires on labeled censorship days
• P(s present | C=0): how often s fires on background days

We use Laplace smoothing (α=1) on both branches so no source produces a zero or infinite likelihood. The posterior is computed in log-odds space for numerical stability:

log_odds(C=1) = log(prior/(1-prior))
              + Σ_s log(LR(s = observed))

LR(s=present) = P(s present | C=1) / P(s present | C=0)
LR(s=absent)  = P(s absent  | C=1) / P(s absent  | C=0)

posterior = sigmoid(log_odds)

Training window: 2026-02-20 to 2026-04-21. Held-out test: last 30 days (63 positives, 2,485 rows total).

Honest caveats

• Naive-Bayes independence is violated. OONI and CensoredPlanet both probe DNS resolvers — when one fires, the other often does too. This inflates the joint likelihood (we'd need a Bayesian network or copula model to fix it). We chose interpretability over correctness here.
• Posterior caps around 0.37 because the empirical prior is only 3.5%. Even with all four sources firing, the model never crosses 0.5 — that's the math, not a bug. Treat posterior ≥ 0.2 as “multi-source corroborated” in this regime.
• CensoredPlanet dominates AUC (+23pp). The other three sources add modest signal. Without CensoredPlanet the AUC drops to 0.69 — useful, but not a near-perfect detector.
• IODA actively subtracts (−0.4pp AUC). IODA fires more often on non-censorship days than on labeled-censorship days, because our labels exclude IODA-only disruptions (those are connectivity events, not confirmed censorship). Including IODA in the fusion is a deliberate honesty signal — we report what every source observed, even when it pushes against the label.
• Voidly probes contribute near-zero (Δ AUC ≈ 0). Most Voidly probes run from open-net countries (US, UK, NL, DE, FR) for safety, so they rarely fire on the same country-days that produce confirmed-censorship labels from heavily censored countries. Coverage growth in censored regions would flip this.