Why Product-Integral Estimates Preserve Probability

Why Probability Preservation Matters

A transition-probability estimate should behave like a probability distribution: its entries should be nonnegative, and each row should sum to one. The Aalen–Johansen estimator is built by multiplying event-time update matrices. The key question here is algebraic: under what condition does each update have those probability properties, and why do they persist after multiplication?

The answer depends on a basic constraint from the risk sets. At an event time, the total number of observed transitions out of a state cannot exceed the number of people at risk in that state immediately before that time. When the transition counts and risk-set sizes satisfy this constraint, each update is a row-stochastic matrix, meaning it has nonnegative entries and every row sums to one. A product of such matrices has the same properties.

Event-Time Updates and Compatibility

Suppose there are \(K\) states, indexed by \(1,\ldots,K\). Use rows for origin states and columns for destination states. At event time \(t_m\), let \(Y_j(t_m)\) be the number at risk in state \(j\) immediately before \(t_m\), and let \(dN_{jk}(t_m)\) be the number of observed transitions from state \(j\) to state \(k\) at that time, for \(j\ne k\). The estimated transition-hazard increment from \(j\) to \(k\) is \(dN_{jk}(t_m)/Y_j(t_m)\) when \(Y_j(t_m)>0\).

This condition allows multiple transition types to occur at the same recorded time. Their counts are added within each origin state before checking compatibility. In the usual single-jump setup, the counts represent distinct people making at most one transition out of their state at that instant. Risk-set sizes are measured just before the event time, so people who transition at \(t_m\) are included in the denominator for that time.

The diagonal is defined as the amount needed to make the row sum one. This is an algebraic part of the update, not a separate observed transition count. The compatibility condition ensures that this diagonal entry is not negative.

Why Each Compatible Update Is a Probability Matrix

The verification can be made row by row. For a state \(j\) with \(Y_j(t_m)>0\), each off-diagonal entry is nonnegative because it is a nonnegative count divided by a positive risk-set size. Compatibility gives

The row sum is exactly

For a state with \(Y_j(t_m)=0\), the stipulated identity row is also nonnegative and sums to one. Hence every row of \(L(t_m)\) has nonnegative entries summing to one. This proves that a compatible event-time update is row-stochastic.

The proof uses the actual risk-set counts at each event time; it does not require event times to be distinct across transition types. If several types occur at one time, their outgoing counts are included together in the same row sum. That is precisely why compatibility must be checked for the total outgoing count from each state, rather than separately for each transition type.

Why Products Preserve the Property

Let \(A\) and \(B\) be two \(K\)-by-\(K\) row-stochastic matrices. Every entry of their product is nonnegative, because

For row \(i\), its sum is

The middle equality uses the fact that every row of \(B\) sums to one. Thus \(AB\) is row-stochastic. Applying the same argument repeatedly proves the result for any finite product of valid event-time updates.

With event times \(t_1<\cdots<t_M\), the Aalen–Johansen product through \(t_M\), under the row-origin convention, is \(L(t_1)L(t_2)\cdots L(t_M)\). If every event-time count is compatible with its risk sets, every factor is row-stochastic, so the full product is row-stochastic as well. This is the probability-preservation result: every entry of the product is nonnegative, and each of its rows sums to one.

When Compatibility Fails

The risk-set condition is not a technical nicety. Without it, the diagonal entry defined by the Aalen–Johansen update can be negative, so the update is not a probability matrix. For example, suppose a hypothetical state \(A\) has \(Y_A=4\), but the recorded counts at one event time are 3 transitions from \(A\) to \(B\) and 2 from \(A\) to \(C\). The total outgoing count is \(5>4\), and the update row would be

Its entries sum to one, but one is negative. A row sum of one alone is not enough: nonnegativity is also necessary. Such a result points to incompatible inputs or an invalid construction—for example, a risk set that was counted incorrectly, duplicated transition counts, or denominators that do not match the event-time convention. It should prompt a data and implementation check, not be repaired by silently truncating the negative entry.

Scope, Diagnostics, and Alternatives

Probability preservation is a finite-sample algebraic property; by itself, it does not establish that the estimated probabilities are unbiased, consistent, or scientifically appropriate. Statistical validity still depends on the study design, state definitions, observation process, and assumptions needed for estimating transitions from the observed data. In particular, a perfectly row-stochastic product can still estimate a poorly defined target if the states or time origin are wrong.

Useful checks at each event time are straightforward: verify that the risk-set size is positive wherever an outgoing event is recorded; check that counts are nonnegative; compare total outgoing counts with the corresponding risk-set sizes; and inspect every update row for nonnegative entries and a sum of one. Then verify the same properties for the final product, allowing for small rounding discrepancies if displayed values have been rounded. If a violation appears, inspect the unrounded calculations and event-time risk sets before drawing conclusions.

The product-integral construction combines transition increments in a single matrix update at each event time and retains the probability constraints by construction when its inputs are compatible. In contrast, estimating several transition or endpoint probabilities separately does not automatically enforce that they form a joint probability distribution. For example, treating a competing event as censoring in a separate Kaplan–Meier calculation targets a different quantity from a cumulative probability that accounts for competing events. These approaches answer different questions; the row-stochastic property is not a reason to treat them as interchangeable.

The result also has limits. It proves that the computed rows remain probability distributions, not that each entry is the true transition probability. It relies on the specified update formula and compatible counts; other ways of smoothing or modifying transition increments need not yield nonnegative updates. The crucial distinction is between preserving probability algebraically and estimating the intended probability accurately.