Hypothetico-Deductive Method
TL;DR
The hypothetico-deductive method is science’s working loop: state a hypothesis, deduce what must be observably true if it holds, then go looking — hardest — for the observation that would break it. As a graph, the deduction is a dedicated node whose output is a list of predictions that could fail, and the disconfirmation gate enforces the discipline the shortcut skips: a genuine attempt at refutation must have run before any conclusion is admitted. The output is never “proven”; it is corroborated — a hypothesis that survived named tests, with the tests on the record. Reach for it whenever a story fits the evidence and the question is whether it would fit any evidence.
The theory that explained everything
The investigator’s theory is elegant: the customer is structuring. It explains the cash deposits just under the threshold. It explains the multiple branches. It explains the timing — and when a deposit comes in over the threshold, it explains that too: he’s getting sloppy. A week in, every new fact lands as further confirmation, and the case file reads like a conviction.
Her supervisor asks one question: what would you expect to see if you were wrong? Not what fits — what, specifically, should be absent if the theory is true and present if it is false? A payroll pattern matching the deposits. A cash-intensive business with receipts to match. The question converts an explanation into a test, and the test into two possible worlds — and it takes one records request to learn which world this is. A theory that every observation confirms is not a strong theory; it is an unfalsifiable one.
An unguided model is a confirmation machine — it completes the story it has started. The hypothetico-deductive graph must first deduce what could break the story, then actually go look.
How the graph works, step by step
Generate the hypothesis. The candidate explanation is stated as a claim about the world, not a vibe about the case: this customer is structuring cash deposits to evade CTR reporting. One hypothesis per run; rivals get their own runs, which is what keeps the tests honest.
Deduce the predictions. The strategy’s signature node. From the hypothesis, derive observations that must hold if it is true and — critically — observations that would refute it: if structuring, then no legitimate cash source matching the pattern; if structuring, then the sub-threshold clustering should persist across months. A hypothesis that yields no refutable prediction fails here, before any evidence is touched.
Retrieve the evidence, both directions. Each prediction becomes a retrieval task with its own scope: the payroll records, the business receipts, the deposit histogram. The node is charged with finding disconfirming evidence as diligently as confirming — the search that unaided reasoning quietly skips.
Critique and gate. The critique node compares outcomes to predictions: which held, which failed, which came back indeterminate. The gate then admits one of three verdicts — refuted (a load-bearing prediction failed), corroborated (the named tests passed; not proof, and the trace says so), or untested (the discriminating evidence was unavailable — an honest state that routes to escalation, not to a conclusion).
The gates, operationally
| Gate | What it checks | Fails when |
|---|---|---|
| Prediction gate | The hypothesis yields specific observations that would be different if it were false | The theory is compatible with every possible observation — explanation without exposure |
| Disconfirmation gate | A genuine search for refuting evidence ran, with scope and results recorded | Only confirming evidence was gathered, or the “test” checked predictions that couldn’t have failed |
| Verdict gate | The conclusion is stated as refuted / corroborated / untested, bound to the specific tests run | Survival gets reported as proof, or an untested hypothesis ships as a finding |
Where it fits — three use cases
1. Investigation hypotheses (AML, fraud)
Structuring, mule activity, elder exploitation — each is a hypothesis that predicts things beyond the alert that raised it. Running the investigation as HD produces the artifact a SAR narrative (or a well-founded decision not to file) actually needs: the rival explanations considered, the discriminating evidence pulled, and what it showed.
2. Root-cause validation
Abduction proposes the best explanation for an incident; the hypothetico-deductive graph is how you test it before remediating. If the control gap caused the breach, then the exception pattern should predate the incident and stop after the fix — checkable predictions that turn a plausible root cause into a validated one, or expose it as a convenient story.
3. Model-drift diagnosis
“The alert-rate drop is seasonal” vs. “the upstream data changed” vs. “the threshold migration broke something” — three hypotheses, three different predictions about which segments moved and when. HD structure forces the discriminating comparison instead of the first story that fits the aggregate chart.
When to reach for it
Reach for the hypothetico-deductive method when an explanation already exists and the danger is believing it too easily — investigations, diagnoses, post-incident narratives. It pairs naturally with abduction (which generates the candidate explanations HD then tests) and with steelmanning (a rival hypothesis is the strongest opposition there is). Its boundary is honest: corroboration is not proof, and the graph never claims otherwise — it claims, with receipts, that the story was given a real chance to fail and didn’t.
- Falsifiable prediction
- An observation deduced from the hypothesis that would look different if the hypothesis were false — the unit of testability.
- Disconfirmation search
- Evidence retrieval explicitly scoped to what could break the theory, run with the same diligence as the confirming search.
- Corroborated, not proven
- The strongest admissible verdict: the hypothesis survived the named tests — which are on the record, so a reviewer can judge how hard it was actually tested.