One future is a lie

The present rarely fixes a single future. A world model worth trusting keeps the separate possibilities apart, puts honest probabilities on them, admits what it can’t know, and hands a decision rule the whole spread — not a tidy average that describes a world which never happens.

1 · Uncertainty is about what you don’t know, not cosmic dice

Ask a good driver “what will that pedestrian do?” and the honest answer isn’t a number — it’s “probably keep walking, but maybe step out.” Two futures, both real. Where does that spread come from? Write down exactly what you know now — call it I_t=(o_≤t,a_<t) — and a candidate plan a_t:t+H−1. The model is asked for a whole distribution:

The target y could be future latents, images, tracks, rewards, or constraint violations. The conditioning bar is the key. A future can be perfectly determined by the full physical microstate and still be uncertain to you, because your cameras have occlusions and finite resolution. Probability here measures what your information leaves unresolved — not necessarily randomness in the universe.

And several different things create the branches: a pedestrian’s hidden goal, friction you only roughly know, another agent who’ll act after seeing you, sensor noise blurring the start, a rare disturbance, or model parameters untrained in this corner. They all produce multiple plausible futures — but they don’t all call for the same response. So before picking a distribution family, we have to separate the kinds and sources of uncertainty.

2 · Why squared error paints a world that can’t exist

Start with the cleanest possible case. Suppose a scalar future Y is −1 for “go left” and +1 for “go right,” each with probability one half. A deterministic predictor must commit to one number m, chosen to minimize expected squared error:

Differentiate: dR/dm=2m, so the best number is m=0. But zero is not a blurry version of either future — it is the point exactly between them, where nothing ever goes. If Y is a path around a barrier, the “optimal” prediction drives through the barrier. If Y is an image, averaging different edges gives blur. If it’s object identity, you get a fractional object that doesn’t exist.

The general fact: squared error learns the conditional mean f*(x)=E[Y|X=x]. That’s fine when the mean is what you wanted, or when the spread is one roughly symmetric blob. It is not a description of the distribution. So low average MSE can sit happily on top of wrong event rates, missed rare hazards, and physically impossible samples. The mean is a summary; the future is a set of alternatives.

Drag the two modes apart with balanced mass and watch the dashed mean settle into the empty valley between them — high confidence in a future with almost no probability. Collapse the separation, or push all the mass to one side, and the mean becomes valid again. The lesson the widget makes physical: the danger isn’t uncertainty itself, it’s summarizing a split future by its center.

3 · A branch, once chosen, has to stick

The tempting fix — “just add noise to every predicted pixel or every step” — creates variety, not coherent worlds. If a pedestrian’s intent is “cross,” that one choice should shape position, pose, reactions, and collision risk across many frames, all consistently. So we need a persistent branch variable u that’s drawn once and then commits:

The overall future averages over the alternatives, p(y|I,a)=∫p(y|I,a,u)p(u|I)du, but any single draw of u should give one internally consistent story. In an RSSM the stochastic latents carry both persistent intent and fresh surprises, with deterministic memory carrying the chosen branch forward; hierarchical models make it explicit with a slow “scenario” latent plus fast local noise.

The trajectory’s probability has sequential structure too:

Each factor conditions on the branch chosen so far. Re-roll an independent “left or right” at every step and your agent teleports between modes. So temporal coherence is a testable property: within one sample, identity, intent, topology, and conserved quantities should hold steady, even while different samples disagree.

4 · Two kinds of not-knowing — and the label can change

Suppose the model reports a wide spread on stopping distance. A naïve system turns that width into one generic “low confidence” light. But the same width can mean two completely different situations that demand opposite responses.

In the first, the model has seen this road countless times, knows the dynamics cold, and still can’t know the outcome because a hidden cause hasn’t revealed itself — the pedestrian hasn’t committed, the gust hasn’t hit. This is aleatoric uncertainty at the current information level: several outcomes stay possible even for a perfect model, and more of the same camera-only data won’t help. The right move is to keep the branches and let a risk-aware rule act on them. (Note: a new kind of look — gaze, gesture — can still resolve it.)

In the second, the road surface is unfamiliar and several trained models flatly disagree about braking. The physics may be nearly deterministic, but you don’t know the right mapping from your data. This is epistemic uncertainty, and representative data usually shrinks it. The right move is not to average the candidate models — the average can hide ignorance — but to explore safely, gather data, abstain, shorten the horizon, or fall back. A practical test: hold out regions or actions during training and check that disagreement (or an out-of-support score) rises before error does.

So the linear decision rule is: first ask what information is missing? Then ask would representative experience with the same inputs erase the spread? If no, carry the possibilities into risk-aware planning. If yes, treat the spread as a flag that you’re off-support, and change behavior or go collect knowledge. A single confidence number destroys this distinction.

The law of total variance makes the split exact. With model parameters W still uncertain after data D:

The first term is expected variation within a model — the aleatoric part. The second is disagreement between plausible models — the epistemic part. Deep ensembles estimate the second by training several models and comparing them. It isn’t a perfect Bayesian split — shared architecture and data can make every member confidently wrong — so remember: disagreement is evidence of ignorance; agreement is not proof of knowledge.

5 · Each distribution family bakes in a different assumption

Heteroscedastic Gaussian. Predict a mean μ(x) and a spread σ(x), trained with

The first term fits the mean; dividing by variance lets noisy cases tolerate bigger misses; log σ stops the model from claiming infinite uncertainty to dodge the penalty. Great for one continuous mode — but it still fills the empty space between separated modes.

Mixture density. Predict weights, means, and scales for K components: p(y|x)=Σ_kπ_kN(y;μ_k,σ_k²). Now modes are explicit and sampling is fast — but you must pick K, and components can collapse onto one mode, swap identities over time, or shrink their variance to memorize examples.

Categorical latents and tokens. Cross-entropy over a codebook naturally keeps separated alternatives apart, and autoregressive tokens express rich joint densities through conditioning. But quantization distorts, ordering affects latency, and rare codes train poorly — a token probability only means something if the tokenizer preserved the distinctions the planner cares about.

Diffusion and flow. Turn noise into samples through iterative denoising or transport. They capture rich continuous multimodality with no fixed component count — but likelihoods and mode probabilities are awkward to query in real time, and sampling is expensive.

Ensembles / approximate posteriors. Several models expose epistemic disagreement and support pessimistic planning — at compute and memory that grow with size, and with the caveat that identical data breeds shared blind spots.

Quantiles, expectiles, conformal sets. If a decision only needs a tail boundary, learn the 95th percentile directly instead of generating the whole world. Quantile losses target marginal coverage; conformal calibration can give finite-sample guarantees — but per-step intervals can stitch together into impossible whole paths.

6 · Worked example: the probability, not the average, makes the decision

A delivery robot nears a partly blocked crossing. Its world model predicts three mutually exclusive branches for the next four seconds:

• u=clear, probability 0.70: nobody enters the path.
• u=cross, probability 0.25: a pedestrian steps out after one second.
• u=blocked, probability 0.05: an unseen cart already sits in the lane.

Under continue, the costs are 0, 20, 100; under slow, 3, 5, 12. Expected costs:

Expectation already favors slowing. But look closer: a chance constraint of “collision probability below 1%” rejects continue outright — the 5% blocked branch alone breaks it — and a worst-tail (CVaR) rule agrees. Now collapse those branches to a single averaged future and all of that signal vanishes. This is why returning only the mean trajectory or the expected reward throws away exactly what the decision rule needs.

Now a second danger. Suppose “blocked” is predicted at 5% across 1,000 similar encounters but actually happens 120 times — an observed 12%. The model is sharply overconfident on a safety-critical tail. Its ranking might still be good (higher scores really are more dangerous), yet the number 0.05 can’t be trusted as a probability. Being right about order is not the same as being right about magnitude — that second property is calibration.

7 · Calibration turns a score into a belief

For a binary event with forecast p and outcome y∈{0,1}, calibration means exactly what it sounds like:

Among cases you called 80% likely, about 80% should happen. A reliability diagram bins forecasts and compares your confidence to the real frequency; expected calibration error summarizes the gaps — but it depends on binning and can hide rare regimes, so report counts and confidence intervals, especially in the tails.

Proper scoring rules reward being both accurate and honest. The Brier score is (p−y)²; the negative log-likelihood is −[y log p + (1−y)log(1−p)], which punishes confident mistakes hard. For continuous outcomes, check likelihood, probability-integral-transform histograms, interval coverage, and width. And beware trivial coverage: an interval spanning every outcome is perfectly calibrated and perfectly useless — you want the narrowest interval that still covers.

Calibration must be sliced — by horizon (uncertainty should generally widen with time), by action (aggressive or unseen actions are less supported), by scene (weather, geography, object class), and by rarity. Aggregate numbers can look great while a rare pedestrian class is dangerously overconfident. And when testing distribution shift, ask whether uncertainty rises before error, not just whether accuracy fell afterward. Post-hoc temperature scaling can fix categorical logits on a fixed distribution, and isotonic regression is more flexible but data-hungry — but neither invents a missing mode or grants awareness under novel conditions. Calibration starts with coverage and a distribution family that can express the truth; rescaling is the last step, not the foundation.

8 · Every variable calibrated, the whole world still wrong

A model can be perfectly calibrated on each variable separately and still assign the wrong joint future. Say it predicts a 50% chance of rain and a 50% chance of a wet road. Both marginals can match reality, yet a sampler that draws them independently will happily produce “dry road during rain” and “wet road, no rain” far too often. World models are used for coupled consequences, so dependence across variables and time is the whole game.

Let A be “pedestrian crosses” and B be “robot must brake.” Knowing P(A)=0.2 and P(B)=0.2 does not fix P(A∩B). If braking is needed exactly when crossing happens, the joint is 0.2; assume independence and you get 0.04 — a planner using the latter underestimates the linked safety event fivefold. Persistent scenario latents and autoregressive conditioning are how you learn that dependence.

So test the joints at the level decisions consume them: does predicted collision co-occur with the relevant object path, does audio impact line up with visual contact, does termination agree with state constraints, does interval coverage hold simultaneously across a whole trajectory? Simultaneous 90% coverage is much harder than 90% at each step — per-step misses accumulate. This also explains why scoring generated futures against the single recorded continuation is delicate: the record is one valid branch, not all of them. “Different from the recording” is not automatically “wrong.”

9 · Train modes, probabilities, and ignorance as separate things

1. Name the decision-relevant events. Beyond dense latent or pixel targets, label collision, contact, route choice, termination, and threshold crossings — calibration needs countable outcomes.
2. Keep whole trajectory samples. A recorded continuation is one draw from the future. Averaging or aligning futures before training erases modes at the dataset level.
3. Condition on all available causal context. Include action, timing, map, and sensor context you’ll have at deployment — missing known inputs inflate apparent aleatoric noise.
4. Choose a coherent stochastic factorization. Use a persistent scenario latent whose branch survives the rollout; decide which variables are global, per-object, and per-step.
5. Optimize a proper probabilistic objective. Negative log-likelihood, cross-entropy, a diffusion score loss, or quantile loss — and don’t let an auxiliary MSE quietly drag modes back to their mean.
6. Prevent mode collapse. Track component usage or code entropy, inspect conditional samples, ensure rare modes appear in batches — and if you reweight rare events, correct the changed prior when reporting probabilities.
7. Estimate epistemic uncertainty. Train ensembles or a parameter-uncertainty approximation with genuinely different seeds, bootstraps, or data splits, and validate disagreement on controlled held-out regions.
8. Calibrate on untouched data. Fit any temperature or conformal threshold without contaminating the test set; recalibrate when the deployment mixture or policy changes.
9. Evaluate the decision interface. Feed branches into expected-cost, chance-constrained, and tail-risk planners. A density improvement matters only if a real decision or safety estimate improves.

Data balance needs special care. Oversampling rare hazards helps representation learning but changes their frequency: if the likelihood sees a 50/50 resampled set when the real rate is 1/99, raw output probabilities inherit the artificial prior unless you apply importance weights or a prior correction. Ranking can improve while calibration silently becomes unusable.

10 · Failure modes, read as causal chains

Debug uncertainty the same disciplined way each time: start from what a person can see in a rollout, name the mechanism that could cause it, run one test that separates that mechanism from the alternatives, and only then change the model.

1. Samples differ only in texture. Shirts recolor, pavement shimmers — but every pedestrian walks the same path and every reward is identical. The trap is “many visual samples ⇒ many worlds.” The mechanism: noise bypassed the dynamics and entered only the detail decoder. Measure diversity in object paths, events, and rewards, not pixels; inject a persistent latent before the dynamics and supervise branch-relevant heads. Success = a sampled choice changes coherent downstream consequences.
2. Mixture components overlap. You allocated several components; they converged to the same mean or inflated until each covers everything. Plot usage, means, entropy, responsibilities; improve initialization, regularize usage, or move to discrete/hierarchical latents. Re-test that components specialize into distinct event topologies without shrinking variance to memorize.
3. Identity flips inside one sample. A pedestrian is “crossing,” then “waiting,” then “crossing,” because intent is resampled every step. That’s not uncertainty; it’s a broken branch variable. Carry the sampled mode in memory or draw a trajectory-level latent once. The diagnostic: disagreement between samples, consistency within each.
4. Confident on unfamiliar states. A single net has no mechanism for parameter ignorance, or every ensemble member shares one blind spot. Hold out regions, classes, or action ranges, then compare error against disagreement or a support score. If confidence doesn’t degrade before accuracy does, add genuinely diverse ensembles, out-of-distribution features, and a fallback. Never promote “no detected disagreement” to “proof of correctness.”
5. Uncertainty grows everywhere. A model can inflate variance to make residuals cheaper, masking bias. Compare residual magnitude, the NLL scale term, and interval width by regime. If routine cases get the same broad intervals as ambiguous ones, improve the model and let the likelihood punish unjustified width. Honest doubt grows where information is missing, not as a blanket excuse.
6. Overall calibration great, safety tail wrong. Common easy events dominate the aggregate and hide rare collisions. Draw reliability plots by class, horizon, action, and rarity, with counts. Add tail-specific heads, targeted data, group calibration, or a conservative threshold — then verify that slice directly; a better global number is not evidence the tail was fixed.
7. High sample diversity, low mode coverage. Many variations may all stay on one route while a second valid route never appears. Best-of-N distance can improve just by buying near-duplicates; pair it with event-mode recall and predicted frequency. Represent an absent topology explicitly and train on examples that contain it.
8. The ensemble agrees and still fails. All members inherit the same dataset gap. Random splits preserve that shared blind spot, so test controlled shifts that remove a region or mechanism. Broaden data and model class when everyone fails together. Disagreement is a useful alarm; agreement is never a safety certificate.

Two reading notes. Best-of-N metrics need care — more samples raise the chance one lands near truth even if probability mass is misallocated, so report coverage and probability quality. And visual realism never proves physical correctness: measure conservation, collision, permanence, cross-modal consistency, and event timing inside each sampled world.

11 · Architecture and objective choices are planner choices

A sampling planner may score M action sequences with K stochastic branches over horizon H — roughly M·K·H transition steps. Double the ensemble or branch count and you double cost; diffusion adds denoising steps inside every transition. So probability fidelity has to be designed with the compute budget, not bolted on afterward.

Explicit mixtures let a planner keep named high-probability modes and stratify samples by weight. Implicit generators cover richer futures but can waste samples on redundant branches. Quantile heads are cheap for one-dimensional risk limits but can’t answer arbitrary counterfactuals. Ensembles can run only on high-risk or low-support states while a single model handles the familiar. And objectives choose behavior too: maximum likelihood covers the data and punishes near-zero density on observed events; adversarial or perceptual losses sharpen samples while dropping modes; best-of-many objectives get one good sample but not correct probabilities; risk-weighted losses boost safety recall while deliberately distorting the natural distribution unless a separate calibrated head is kept.

12 · System-design implications

Expose structured uncertainty. Return samples or modes with weights, event probabilities, epistemic scores, and horizon — not a single “confidence” scalar that mixes incompatible meanings and can’t be validated.

Separate prediction from risk preference. The model estimates what may happen; the planner chooses expectation, variance penalty, chance constraint, CVaR, or worst-case. Baking one risk attitude into the latent makes reuse and calibration harder.

Track support under candidate actions. A planner can exploit optimistic errors by proposing actions absent from training. Measure action-conditioned density or disagreement, penalize unsupported plans, and route unfamiliar cases to a conservative controller.

Preserve rare branches through the pipeline. Beam pruning, sample budgets, cache compression, and dashboard averaging can each silently delete a 0.5% catastrophe. Safety-relevant modes need explicit retention rules even when they barely move the expected loss.

Monitor calibration after policy changes. Once a planner uses the model, it changes which states get visited. A forecast calibrated under the collection policy can drift under the new one — log predicted probabilities and eventual outcomes to catch it.

Design fallback behavior before deployment. Epistemic uncertainty is only useful if the system can respond: thresholds, minimum-risk maneuvers, operator escalation, sensing actions. Otherwise it’s an unread dashboard statistic.

Record the probability before the outcome. Calibration monitoring needs immutable, timestamped forecasts joined later with outcomes. Recomputing a forecast after new evidence leaks the answer and makes reliability look artificially good; store model version, sensors, proposed and chosen action, horizon, and event definition so an apparent shift can be traced to a changed model, policy, or label.

13 · Takeaway — and why this must survive the rollout

We can now represent separate modes, distinguish “unresolved” from “unknown,” train probabilities with proper scores, and test their calibration — all at a single transition. But a planner doesn’t take one step; it composes the model with itself, feeding each output back as the next input. A slight mean bias shifts the next state; a missed low-probability branch can never reappear; an inflated variance can explode; a wobbly branch variable flips identities. Lesson 06 studies that self-composition directly — contrasting teacher-forced one-step accuracy with free-running rollout, deriving how errors propagate, and showing why multi-step objectives, state perturbations, and re-observation are complementary rather than interchangeable.

Interview prompts

• Why does MSE blur a multimodal future? Its population optimum is the conditional mean, which lies between modes and may correspond to no valid outcome.
• Why is independent decoder noise insufficient? It creates local variation but not a persistent causal branch; intent, identity, geometry, and events must remain coherent across the sampled trajectory.
• How do aleatoric and epistemic uncertainty differ? Aleatoric variation remains among outcomes at the available information level; epistemic uncertainty comes from not knowing the correct model and can usually be reduced with representative data.
• Does ensemble agreement prove the model is in distribution? No. Members can share data and architecture blind spots; disagreement signals ignorance, while agreement is not proof of knowledge.
• What is calibration? Among events assigned probability r, approximately fraction r should occur, evaluated within relevant horizon and regime slices.
• Why report sharpness with coverage? An extremely wide interval can cover the truth while being useless; sharpness asks for the narrowest uncertainty consistent with correct coverage.
• How can class rebalancing damage probabilities? Oversampling changes the training prior. Without importance weighting or prior correction, predicted frequencies reflect the resampled dataset rather than deployment.
• How should a planner use rare catastrophic branches? Through explicit chance constraints, tail-risk measures such as CVaR, or safety envelopes—not by averaging them away in expected reward.