Overfitting: When the Model Learns the Dataset Too Closely

A model overfits when its behavior is substantially better on data that influenced fitting than on new cases drawn from the intended use conditions. That difference is often called a generalization gap.

The gap alone needs context. Training and validation may differ because of distribution shift, data quality, preprocessing mismatch, or a harder validation population. Investigation should confirm that the partitions are comparable for the claim being made.

Here is that gap on a system already running in hospitals. Epic's proprietary sepsis prediction model was validated from the outside, on 27,697 patients across 38,455 hospitalizations at Michigan Medicine between 6 December 2018 and 20 October 2019. Andrew Wong and colleagues published the result in JAMA Internal Medicine on 21 June 2021: “Our observed hospitalization-level model performance (AUC, 0.63) was substantially worse than that reported by Epic Systems (AUC, 0.76-0.83) in internal documentation (shared with permission)”. That 0.63 carried a 95% confidence interval of 0.62–0.64. The shortfall is not sampling noise.

A second, independent team measured the same vendor model again, in two county emergency departments, and published in November 2024: 14.7% sensitivity within a 6-hour window, and a median alert lead time of 0 minutes. Nothing about the model changed between the developer's number and these two. The data it was scored on did.

Overfitting can occur at several levels. Each of the four below has a documented case in this lesson: a convolutional network fitting a random labeling, a classifier reading a photographer's source tag, a public leaderboard tuned for months by thousands of practitioners, and a search-term model rebuilt around whatever had correlated with last winter.

Learning curves often show training improving continuously while validation improves, plateaus, and then deteriorates.

That shape is a common observation, not a law. The exception has a name and a measurement behind it. Belkin and three colleagues documented it in PNAS on 6 August 2019: “This "double-descent" curve subsumes the textbook U-shaped bias–variance trade-off curve by showing how increasing model capacity beyond the point of interpolation results in improved performance.” Test risk falls, rises toward a peak as capacity approaches the interpolation threshold, and then falls again on the far side. A curve that has turned upward is not proof that the best model is behind you.

The effect survives in modern deep networks. Nakkiran and colleagues reproduced it in the Journal of Statistical Mechanics on 29 December 2021. They showed it occurs as a function of training epochs as well as of model size, which puts it directly in the path of an epoch-based stopping rule. They also identified regimes in which quadrupling the number of training samples hurts test performance.

Overfitting risk rises when flexibility grows faster than reliable evidence. Google Flu Trends is the worked example of exactly that ratio.

The methodology matched the best of 50 million search terms to 1,152 data points. Its developers had to discard seasonal terms — high-school basketball among them — that correlated with the CDC series without predicting flu. Lazer and colleagues took the system apart in Science on 14 March 2014: “This should have been a warning that the big data were overfitting the small number of cases—a standard concern in data analysis. This ad hoc method of throwing out peculiar search terms failed when GFT completely missed the nonseasonal 2009 influenza A–H1N1 pandemic. In short, the initial version of GFT was part flu detector, part winter detector.” From 21 August 2011 to 1 September 2013 the system reported overly high flu prevalence in 100 out of 108 weeks. It overshot the 2011–2012 level by more than 50%.

An independent team had already reached the same diagnosis. Writing in PLOS Computational Biology on 17 October 2013, they documented GFT “completely missing the first wave of the 2009 influenza A/H1N1 pandemic” and “greatly overestimating the intensity of the A/H3N2 epidemic during the 2012/2013 season”.

A structured investigation prevents a blind search through regularization settings.

Step 1 is not merely good practice. In one domain it is published regulatory expectation. On 27 October 2021 the FDA, Health Canada and the MHRA jointly issued ten Good Machine Learning Practice guiding principles for medical device development. The fourth is titled “Training data sets are independent of test sets” and reads: “Training and test datasets are selected and maintained to be appropriately independent of one another. All potential sources of dependence, including patient, data acquisition and site factors are considered and addressed to assure independence.”

Three regulators name the dependencies by category: patient, data acquisition, site. The Mount Sinai result is precisely what the site clause exists to catch. A partition check that stops at “no duplicate rows” has addressed one of the three.

Train models on progressively larger training subsets. Evaluate them under the same validation policy. If training performance declines slightly while validation improves and the gap narrows, additional representative data may help.

If both curves plateau at poor performance, the bottleneck may be underfitting or weak signal. If validation remains unstable because the holdout is tiny, better evaluation design may be more urgent than more training data.

The monotone reading of that curve has its own measured exception. Nakkiran and colleagues identified regimes in which quadrupling the number of training samples hurts test performance. More data is the usual answer. It is not an unconditional one.

The same visible gap can justify different interventions, and this lesson's cases sort them. Explicit regularization did not stop convolutional networks from fitting a random labeling, so a penalty term is not a general answer to memorization. More training samples hurt test performance in some of the regimes Nakkiran and colleagues identified, so more data is a strong default rather than a guarantee. The horse classifier needed the photographer's tag removed — that is task and feature redesign, not capacity control. And Epic's sepsis model needed an external cohort of 38,455 hospitalizations before anyone could see there was a gap to remedy at all.