When Your Dose-Response Model Ignores Subpopulation Susceptibility – What to Fix First

Imagine your dose-response model says a waterborne pathogen poses a 1 in 10,000 infection risk. Safe, right? But that average hides a brutal truth: for immunocompromised residents in a nursing home, the real risk might be 1 in 50. If your model ignores subpopulation susceptibility, you're not just wrong—you're dangerous. This isn't a theoretical nitpick. Outbreaks happen precisely because averages mask vulnerable groups.

So what do you fix first? Not everything at once. You start where the model's assumptions break hardest. This article gives you a practical checklist—tiered, honest, and built for people running real risk assessments, not textbook exercises. No silver bullets, but a clear path to make your model respect the people it's supposed to protect.

Who Needs This and What Goes Wrong Without It

Why averaging susceptibility is a dangerous shortcut

Most dose-response models treat a population as one big blob of identical humans. That's convenient for math — but it's a lie your data will eventually expose. The catch is that averaging immunity, age, and nutritional status across everyone hides the people who actually get sick. A model that says "0.1% infection rate" might sound safe until you realize it's 5% in elderly residents and zero in healthy adults. The average didn't lie. It just buried the truth where your risk threshold can't see it. I have watched water utilities greenlight a treatment process because the population-level risk sat below 1 in 10,000 — while their dialysis patients faced a 1-in-50 hit. That's not a model failure. That's a design failure. You don't fix this by adding more decimal places. You fix it by accepting that one curve can't represent everyone.

Real outbreaks caused by ignoring subpopulations

Cryptosporidium in Milwaukee wasn't a modeling error — it was a distribution problem that hit immunocompromised residents hardest. The odd part is that the original risk assessments for that system showed "acceptable" levels for the general public. Acceptable for whom? Not the transplant recipients. Not the chemotherapy patients. When you flatten susceptibility into a single parameter, you guarantee that the most vulnerable will be underprotected. That hurts. And it's not hypothetical — I have seen risk assessors defend single-curve models by saying "we don't have good subgroup data." Bad reason. You have better data than you think. You just haven't separated it yet.

'A dose-response model that ignores subpopulations doesn't protect everyone. It protects the average — and the average doesn't drink the water alone.'

— paraphrased from a risk manager who watched a neonatal ICU scare unfold

Who should prioritize fixing this: risk assessors, water utilities, regulators

If you sign off on microbial limits for drinking water, you need this fix. If you set recreational water guidelines, same. If you run a risk assessment for a food processing line that serves hospitals or schools — you're already late. Regulators tend to resist subgroup stratification because it complicates enforcement. That's a political constraint, not a technical one. The trade-off is real: adding subpopulation susceptibility increases model uncertainty in the short term. You trade a false sense of certainty for a messier but honest risk picture. What usually breaks first is the confidence interval — it widens, and stakeholders panic. Good. Panic beats a quiet outbreak. If your current model returns one risk number for a million people, you're not doing risk assessment. You're doing risk averaging. And that's not what the job pays you for.

Prerequisites You Should Settle First

What data you actually need: exposure distribution, dose-response parameters per subgroup, population fractions

Most teams skip this step — they reach for their favorite dose-response curve, grab a single parameter set from a textbook, and call it done. The catch is that one curve hides everything. You need three data buckets before you touch any model code. First, exposure distribution — not just mean dose but the full spread across your population, ideally stratified by age, health status, or occupation. Second, dose-response parameters per subgroup: that single ID₅₀ you’ve been using might be accurate for healthy adults but off by two orders of magnitude for immunocompromised individuals. Third, population fractions — what proportion of your exposed group falls into each susceptibility bin. Without those fractions, your aggregate risk estimate is a guess dressed up as a number.

What usually breaks first is the exposure data. Teams have a central estimate — “people ingest 10³ CFU per day” — but no variance. That hurts. A narrow lognormal spread versus a wide one changes your high-risk tail dramatically; I have seen projects where swapping from a geometric standard deviation of 2 to 4 turned a seemingly safe scenario into a 15% infection probability for the most susceptible subgroup. Wrong order. And if you don’t have subgroup-specific dose-response parameters? You’re not ready for the core workflow yet. The bare minimum is a literature-derived range — high, medium, low susceptibility — even if those are pulled from existing meta-analyses.

When you can proceed with limited data and what assumptions are minimally acceptable

You don’t always have perfect numbers. That’s fine — but only if you document what you’re assuming and test how much those assumptions drive the result. The minimally acceptable setup: one exposure distribution (fitted or expert-elicited), two or three susceptibility classes, and a sensible prior for each subgroup’s dose-response slope. Why two classes rather than one? Because a single curve always underrepresents the tail. Split your population into “typical” and “vulnerable” — maybe 80/20 — and assign the vulnerable group a lower ID₅₀ (say, half the typical value). Is that crude? Yes. Does it beat pretending everyone responds identically? Absolutely. The trade-off is that with sparse data you trade precision for honesty — your confidence intervals will widen, and that’s the point. A narrow interval built on bad assumptions is worse than a wide one that says “we don’t know this cleanly.”

One rhetorical question to test your readiness: Can you defend the number of subgroups you chose to a skeptical colleague? If the answer is “because three felt right,” you need a stronger rationale. Start with one clear biological or epidemiological boundary — age over 65, or pre-existing condition — and build from there. I once watched a team waste three weeks optimizing a six-subgroup model when their exposure data came from a single literature value with no reported variance. The model’s precision was a mirage. Don’t do that.

Required software or statistical knowledge: R packages like drc or Bayesian frameworks

The tooling prerequisite is straightforward but non-negotiable. If you’re working in R — and most microbial risk modelers do — you need drc for fitting dose-response curves and ggplot2 for visualizing the subgroup splits. But here’s the pitfall: drc assumes independent observations and a single population. For hierarchical susceptibility, you’ll want a Bayesian approach — packages like brms or rstan let you specify random effects for subgroup parameters. That sounds heavy, and it's. The learning curve is real: you should be comfortable writing formulas like bf(response ~ dose | subgroup, nl = TRUE) and interpreting posterior intervals. If Bayesian workflows feel foreign, start with the drm() function in drc using a factor for subgroup — it’s not ideal (it treats groups as independent) but it gets you running in an afternoon. Just know the model will be optimistic about uncertainty because it ignores borrowing strength across groups.

What about Python users? scipy.optimize.curve_fit works for simple exponential or beta-Poisson models, but you’ll need PyMC or NumPyro for the Bayesian version. The odd part is — most microbial risk papers still use R, so Python users often end up re-implementing published models from scratch. That’s doable but slow. I’d grab one of the pre-coded Stan models from the epiprom repository if you want a head start. Required statistical knowledge: understand what a log-likelihood is, recognize overdispersion when you see it, and know why a 95% credible interval on subgroup risk differs from a confidence interval.

“The single-curve model gave us a false sense of precision. Splitting by age doubled our uncertainty — but it also doubled our trust in the result.”

— risk modeler reflecting on a drinking-water safety assessment, personal correspondence

Core Workflow: Adjusting Your Model for Subpopulation Susceptibility

Step 1: Identify and define subpopulations (age, health status, genetics)

Start by carving out the groups that actually shift risk. You don't need a census — just the factors your pathogen cares about. Age is the obvious one: infants and elderly often show steeper dose-response curves. But health status — immunocompromised, pregnant, malnourished — can flip a low-risk scenario into a near-certain infection. Genetics matter too, though you'll rarely have allele-level data. Proxy it: geography, ethnicity, or prior exposure history. The trap is over-splitting. I once watched a team define 14 subpopulations from a dataset of 200 observations. The result was variance so wide the model was useless. Keep groups to 3–5 at first. Merge any where the physiology doesn't justify a separate curve.

Reality check: name the safety owner or stop.

How do you decide what matters? Pull outbreak data or literature for your organism — Cryptosporidium hits children harder than adults by roughly 3× in some studies; Listeria targets pregnant women and the elderly almost exclusively. Wrong grouping, wrong risk estimate. The catch is that published dose-response parameters are usually for "healthy adults." You're on your own for the rest.

Most teams skip this because they think 'average human' is good enough. That's where the model stops protecting the people who actually die.

— epidemiologist, food safety risk assessment

Step 2: Gather or estimate dose-response parameters per group

Now the hard part — numbers that don't exist. For healthy adults you have exponential or Beta-Poisson fits from the literature. For vulnerable groups you often have nothing. Don't freeze. You can estimate using relative potency factors: if immunocompromised mice show 10× lower LD₅₀, apply a scaling factor to the human healthy-adult model. Crude? Yes. Better than ignoring it entirely.

What usually breaks first is assuming linear scaling across doses. That's rarely true — the slope can steepen or flatten. Run a quick check: does your group's response differ in the low-dose linear region or the high-dose plateau? Most dose-response curves are sigmoidal; shifting them left changes risk differently at 1 CFU versus 100 CFU. If you lack data, use a simple exponential model with a scaled r parameter. Document the assumption clearly — someone downstream will need to defend it.

The trade-off: precise parameters need animal or human feeding trials you don't have. Estimates introduce uncertainty, but ignoring subpopulations introduces bias. Bias kills more models than noise ever did.

Step 3: Construct a weighted mixture model

Take your per-group dose-response functions and combine them by population fraction. If 15% of your exposed cohort is immunocompromised and their infection probability at dose d is 0.4, while the healthy group's is 0.1, the mixture infection probability is 0.15×0.4 + 0.85×0.1 = 0.145. Simple linear weighting — but only if exposure dose is identical across subgroups. That's a strong assumption. Real exposure often varies by behavior (kids drink more water per body weight; elderly eat softer foods with higher pathogen load).

To handle that, weight both the dose and the response. Build a two-dimensional mixture: dose distribution per subgroup times response probability per subgroup. This is where your model gets its real structure. The math isn't fancy — nested sums in R or Python — but the logic must reflect the exposure pathway. We fixed a dairy-processing model this way: elderly consumers had 30% higher per-serving dose due to portion size, which combined with a 2× steeper dose-response curve. The baseline model had underestimated risk by a factor of 6.

Step 4: Run sensitivity analysis on subgroup fractions

Here's the step most people skip — and it hurts. Your model now has fragile inputs: the fraction of each subpopulation. A 10% swing in the immunocompromised fraction can double your predicted outbreak size. Run a one-at-a-time sensitivity sweep: vary each subgroup proportion ±20% and watch the overall risk metric. If the output barely moves, you're safe. If it lurches, you need better data on that fraction — not on the dose-response curve.

The odd part is that many modelers obsess over refining the dose-response parameters while treating population fractions as fixed. Wrong priority. In a hospital outbreak model I reviewed, the age distribution shifted by only 5% between two wards but changed the predicted attack rate by 40%. They'd spent months on curve-fitting. Sensitivity analysis would have caught this in an afternoon.

One rhetorical question to test your workflow: would your model's recommendation change if the vulnerable group made up 25% versus 35% of the population? If yes, you're not ready to publish risk thresholds. You're ready to commission a survey. That's not failure — that's honest model science.

Next, take the sensitivity results and build a decision boundary. Plot risk contours across plausible subgroup fractions. Mark the region where your mitigation (say, a 2-log reduction) still fails. That contour tells you exactly where the model is trustworthy versus where it's guessing. Act on the trustworthy zone first.

Tools, Setup, and Environment Realities

R packages: `drc`, `popbio`, `bayesmix` for mixture models

The R ecosystem has mature dose-response tooling, but none of it was designed for subpopulation susceptibility out of the box. You'll stretch drc with its mix argument—that's your entry point for fitting separate curves to latent groups. popbio helps when you're projecting population-level risk from stage-structured data, though it assumes you already have the susceptibility split defined. The odd part is—bayesmix works beautifully for identifying unknown subgroups from response heterogeneity, but it demands you know your priors. Most teams skip that step. They feed it flat priors and wonder why chains refuse to converge. Wrong order. Set informative priors using external knowledge: age-stratified attack rates from literature, or historical outbreak data with known vulnerable cohorts. You'll lose a day otherwise.

What usually breaks first is the assumption that mixture models will cleanly separate susceptibilities without any group membership hints. They won't. You need either a covariate that partially identifies subgroups (vaccination status, age bracket, comorbidity flag) or at least three dose levels per suspected subpopulation. Fewer than that and the model swaps group labels mid-chain—a debugging nightmare I've burned two weeks on. The fix: lock one group's parameters using prior constraints from published studies. Ugly but functional.

Python packages: `scipy.optimize`, `Pyro` or `Stan` for Bayesian approaches

Python is the hard path that pays off when your data is messy. scipy.optimize.curve_fit handles the quick-and-dirty: three-parameter log-logistic model, run it once per subgroup, compare AIC. That sounds fine until you realize your subgroups overlap in covariate space—then the optimizer finds a local minimum that ignores low-count vulnerable classes entirely. The seam blows out. You switch to Pyro or Stan (via pystan) for Bayesian hierarchical models that shrink estimates from sparse subgroups toward the population mean. That shrinkage is a trade-off—it stabilizes variance but masks extreme susceptibility if your prior is too tight. Start with weakly informative half-Cauchy priors on group standard deviations. Not yet convinced? Try Pyro's autoguide; it's better for rapid iteration than Stan's manual HMC tuning, though you sacrifice some sampling efficiency.

Reality check: name the safety owner or stop.

I have seen teams run Stan on 200 samples with 5 subgroups and wonder why the effective sample size drops to 12. The fix is brutal: either pool rare subgroups or increase minimum sample size per group to 30. Below that, your posterior intervals stretch wider than a field season, and rhat diagnostics lie—they'll show convergence even when the model can't distinguish subpopulation effects from noise. One rhetorical question: is your toolchain correctly handling censored exposures? Both Pyro and Stan require explicit censoring models via log_survival functions; the default Bernoulli likelihood assumes you observed every outcome. That assumption alone can bias susceptibility estimates by 40% when low-dose groups have unobserved infections.

'We had perfect convergence metrics but the model predicted the elderly subgroup was invincible. Turns out we forgot to right-censor the dropout column.'

— observation from a food-safety risk modeler, 2023

Data requirements: minimum sample sizes, censoring issues, missing covariates

The catch: no published rules exist for subpopulation dose-response because the required N depends on effect size disparity. If the susceptible group has a 10× lower ID50, you can detect it with 40 total observations. If the disparity is 2×, you'll need 200+ and every subgroup covariate measured without error. That hurts. Start by checking missingness patterns on age, immune status, and prior exposure—if >15% of rows lack these, your mixture model will silently assign missing-covariate cases to the wrong susceptibility class. I have seen this create a phantom 'resistant' subpopulation that was actually just the missing-data bin. Fix it with multiple imputation (use mice in R or sklearn.impute.IterativeImputer in Python) before feeding the model.

Censoring compounds everything. Left-censored doses (below detection limit) and right-censored responses (experiment ended before all animals showed illness) are common in microbial risk data. Most dose-response models assume you observed the exact response time or binary outcome—they don't handle interval censoring where you only know 'sick between day 3 and day 7'. Wrong assumption. Use icenReg in R or lifelines in Python for interval-censored survival models, then pass the imputed failure times to your susceptibility model. The trade-off: imputation adds variance that inflates your credible intervals by 15–30%. That's better than the alternative—a point estimate that's confidently wrong. End with a specific action: pull your dataset, count rows with missing or censored outcomes, and if that number exceeds 10% of total, build a sensitivity analysis comparing complete-case results versus imputed results before you touch any Bayesian machinery.

Variations for Different Constraints: Data-Poor, High-Risk, or Legacy Models

Data-poor: Using expert elicitation and sensitivity ranges

No data means no model — or does it? I have been in rooms where teams stare at a spreadsheet with three rows of human challenge data and a shrug. The fix is not to fake numbers. You use expert elicitation: structured interviews that turn gut feelings into probability distributions. Ask two or three domain specialists: ‘What fraction of immunocompromised individuals would respond at this dose?’ Have them justify low, best, and high estimates. Then run your model across those ranges — not point estimates. Sensitivity sweeps become your safety net. The catch is that elicitation is slow, and experts disagree. That hurts only if you treat their answers as truth rather than as boundaries. You’ll end up with a band of plausible risk curves, not a single line. That's honest. It beats pretending your sparse dataset generalizes to everyone.

One team we worked with had zero subpopulation-specific data for a Legionella model. They polled three hospital epidemiologists and got a spread: low-end 1.4× susceptibility, high-end 8×. Running their beta-Poisson model across that range revealed that the risk in elderly patients swung by nearly two orders of magnitude. That knowledge drove different ventilation targets for different wards. Better than guessing. Worse than real data — but in data-poor contexts, a defensible range beats a false point.

High-risk: Worst-case subpopulation scenario modeling

Sometimes you don’t have the luxury of ranges. Regulators need a number tomorrow. Or a hospital is facing an outbreak and must decide whether to close a ward. Here you model the worst plausible subpopulation — not the average, not the median. The most susceptible 1% of the exposed group. The catch is defining ‘worst plausible.’ I have seen teams default to the most extreme published value without checking if that subpopulation actually overlaps with their exposure route. That leads to absurdly conservative models that trigger unnecessary evacuations. Instead, pick a specific high-risk group present in your setting: renal transplant patients in a waterborne outbreak, for instance. Parameterize your dose-response using their known immune impairment. Then run a deterministic scenario at the 95th percentile of that group’s susceptibility — not the mean. You will get a number that's conservative but tied to a real subpopulation, not a hypothetical worst-case universe.

A rhetorical question worth asking: Is it better to close one floor for a day based on a defensible worst-case model, or to wait two weeks for perfect data while people get sick? Most teams answer that wrong — they wait. The trade-off is clear: speed trades precision for protection. Accept that explicitly. Document your assumptions. Then act.

‘Worst-case subpopulation modeling is a decision tool, not a scientific claim — use it to set thresholds, not to publish truths.’

— paraphrased from a risk manager who closed three wards in 2017

Legacy models: Augmenting with a susceptibility multiplier

You have a validated dose-response model used for ten years. It’s embedded in regulations. Rebooting it from scratch is not an option — the political and technical cost is too high. The pragmatic fix is a susceptibility multiplier applied at the risk calculation layer. Don't touch the core dose-response function. Instead, after you compute the probability of infection for the general population, multiply by a factor that scales for specific subpopulations. Where does that factor come from? It can be a ratio of published infection rates between groups, or a derived fold-change from animal data scaled by body mass and immune function. The multiplier should be bounded — I have seen people apply a 100× factor without checking whether that saturates the response curve. Wrong order. If your general population risk is already 0.6, multiplying by 2 gives you nonsense probability >1.0. Cap it. Use a logit-scale adjustment instead: P_sub = 1 / (1 + exp(-(logit(P_general) + log(multiplier)))). That keeps probabilities in bounds. Most teams skip this step. Their seam blows out during peer review.

The odd part is that legacy models often embed assumptions that conflict with the multiplier approach — a linear dose-response assumption, for instance. You may need to reassess the dose range over which the multiplier is valid. Test it against two extreme doses: very low (where susceptible individuals may show response while general population doesn't) and moderate (where saturation starts). If the multiplier breaks at either end, you're masking a deeper problem. Fix that first. The multiplier is a patch, not a cure.

What to do next: Pick one of these three constraints and run a single subpopulation scenario this week. Use your existing model. Add the multiplier. Document the assumption. Share it with one colleague. That action generates more signal than three weeks of reading theory.

Pitfalls, Debugging, and What to Check When It Fails

Overfitting to the majority population

You run your updated dose-response model and it looks beautiful — tight confidence intervals, elegant curves. That's the warning sign. When your optimizer feasts on the dominant subgroup's signal, it quietly starves the minority. I have watched teams celebrate a 0.98 R² only to discover their vulnerable subpopulation predictions were off by two orders of magnitude. The fix isn't fancier math; it's checking residual distributions per subgroup. Pull those residuals and plot them separately. If your error bars for the high-susceptibility cohort barely overlap the data, your model learned the majority and ignored the rest. Weight your likelihood function by inverse subgroup frequency or, better, stratify your training loss — common in epidemiology but rare in food-safety risk shops.

Ignoring correlation between exposure and susceptibility

Here's where it gets sneaky. You assume exposure level and host susceptibility are independent. They're not. Children (high susceptibility) touch everything and put it in their mouths (high exposure). Immunocompromised patients often work in controlled environments (low exposure). The odd part is — when you treat these as uncorrelated, your joint risk estimate for the most vulnerable group can undershoot by 40% or more. The seam blows out because your model sees low exposure for a high-susceptibility group and concludes "safe enough," when the real-world correlation flips that logic. Fix this with a copula model or, if you're data-poor, a simple sensitivity check: multiply exposure and susceptibility distributions under worst-case correlation assumptions. If that multiplication changes your conclusion, your original model wasn't robust — it was lucky.

Honestly — most food posts skip this.

Numerical instability in mixture model optimization

Mixture models can turn into numerical nightmares. Components swap labels mid-iteration, log-likelihoods spiral into NaN territory, and standard optimizers choke on the multimodal surface. What usually breaks first is initialization — start your susceptible-group parameters too close to the main group and you'll never separate them. We fixed this by initializing with domain knowledge: give the vulnerable component a mean shift of at least one log-unit from the bulk population. Another trick? Restrict component variance during early iterations, then release it. That stabilizes the optimizer long enough to find the real split. But — if your dataset has fewer than about 200 total observations per subgroup, mixture models will hallucinate clusters where none exist.

Checking convergence and posterior predictive checks for Bayesian models

Bayesian adds its own layer of misery. R-hat values below 1.01? Not enough. Trace plots looking fuzzy but stationary? Still not enough. The concrete check I use: simulate data from your posterior and compare the simulated outbreak distributions to your real data — stratified by subpopulation. If your model predicts 5% attack rates for children but the observed data clusters at 20%, something in the prior for the susceptibility offset is too tight.

When the posterior looks clean but the predictive check stinks, you didn't fit the data. You fit the prior.

— internal debugging mantra, applied after too many late-night convergence checks

Loosen that prior, re-run, and watch your effective sample size. If it drops below 100 per chain, your model is too complex for your data. Not everyone needs a three-component mixture. Sometimes a simple shifted log-normal with a susceptibility multiplier works better — and converges in an hour instead of three days.

FAQ: Quick Answers to Common Questions (Stripped Down)

Do I need exact dose-response parameters for each subgroup?

Ideally, yes. Realistically, you probably don't have them. The mistake is waiting for perfect data before adjusting anything. You can start with a reasonable anchor — say, a published beta-Poisson model for a general population — then shift the median infectious dose by a factor of 2 or 5 for a vulnerable subgroup. The catch: this assumes the shape parameter stays constant. That assumption breaks when the mechanism changes, not just the tolerance. I have seen teams waste months polishing subgroup-specific α and β values that their aggregate data couldn't possibly resolve. Wrong order. Fix the stratification logic first; refine parameters later.

How do I choose the number of subpopulations?

Start with two: general and susceptible. Adding a third group quadruples your parameter space — that's not ambition, that's a debugging trap. The practical threshold is when you can actually define each group's exposure route and endpoint separately. Immunocompromised, elderly, infants — that's usually as far as you get before the data thins out. More groups don't fix bad assumptions; they just multiply them.

— common trap in consulting engagements

If your aggregate curve already shows a long tail at low doses, that's a signal for two groups, not an invitation to carve the population into six dietary cohorts. What usually breaks first is the fitting algorithm — it becomes non-identifiable because multiple combinations of subgroup fractions and dose-response curves produce the same total risk. You lose a day chasing convergence. Keep it lean.

What if my data is only aggregate?

You still have options — just fewer. Your tool needs an expectation-maximization routine that can impute subgroup membership probabilities from the mixture. Most teams skip this step: they feed total cases and total exposure into a single model, call the fit "reasonable," and move on. That hurts. The fix is to treat the observed outbreak curve as a weighted sum of unknown subgroup responses. You'll need an estimate of the subgroup fraction in the exposed population — censuses, clinical registries, survey data — and that estimate is often a 30–50% guess. That's fine. The trade-off is that your confidence intervals will look ugly. They should. Aggregate-only models produce artificially tight intervals; the moment you admit you're mixing populations, the uncertainty swells. Don't shrink from it.

Is a simple log-normal adjustment enough?

For some pathogens, yes — especially when the mechanism is purely threshold-based. Shift the log-mean downward by 0.5 or 1.0 log units for the sensitive group and you get a raw approximation. The pitfall: log-normal adjustments assume proportional scaling across the entire dose range. That means the relative risk between groups is constant at low and high doses, which is rarely true. I've debugged models where a log-normal tweak overprotected at low doses (false-safe region) and underpredicted at high doses (missed severe outcomes). The edging you need is a mechanism-based split — e.g., different exponential decay rates for subgroups — not a universal slider. If you only have aggregate data and one afternoon, a log-normal shift beats nothing. But treat it as a placeholder, not a publication-grade solution. Your next step is running a sensitivity: vary the shift magnitude and see if your risk conclusions flip. If they do, you need better data, not a better slider.

What to Do Next: Specific Actions You Can Take Today

Audit your current model for susceptibility assumptions

Pull up the dose-response curve you're using right now. Look at the data source — is it from one healthy adult cohort? A single animal study? That single curve is almost certainly hiding variation. The fix starts with a simple question: what subgroup would break first if this model were wrong? I have seen teams spend months perfecting a Poisson model only to realize their entire risk estimate shifted by two orders of magnitude when they added a single immunocompromised group. Don't guess — trace your model's lineage back to the original experimental population. If that population doesn't match your real-world exposure groups, you've already introduced bias. The catch is that most published dose-response parameters don't advertise their limitations. You need to read the fine print on animal strains, human age ranges, and health screening criteria.

Collect or compile subgroup-specific dose-response data from literature

Start with three sources: existing meta-analyses on immunocompromised populations, outbreak reports that broke down attack rates by age or health status, and any published dose-response re-fits that included a susceptibility covariate. The tricky bit is that subgroup data is often buried in supplemental tables or reported as "non-significant" and tossed aside. Grab it anyway. Even rough attack-rate ratios from a single outbreak can anchor a two-group model. Most teams skip this step because it feels messy — but a 30% confidence interval from real data beats a false 99% interval from a wrong model. Aim for at least one point estimate for your most vulnerable subgroup: elderly, neonates, or transplant recipients.

Implement a simple two-group mixture model as a sensitivity check

You don't need a full Bayesian hierarchical structure on day one. Write a two-line mixture: P(infection) = p * f_susceptible(dose) + (1-p) * f_resistant(dose). Use a fixed mixing fraction (say 15% susceptible, based on your literature haul). Then vary that fraction from 5% to 30% and watch how your risk output changes. What usually breaks first is the assumption that everyone responds identically. The odd part is — you might find your original model was fine for point estimation but dangerous for the tail. That's the insight you want: where does the seam blow out? If the mixture model swings your 95th percentile risk by 5x, you have a problem worth fixing deeper.

"The model never lies — but it does let you believe your assumptions are universal."

— risk modeler reflecting on why single-curve fits fail in mixed populations

Document and communicate risk ranges to stakeholders

Stop reporting single-number risk estimates. Start reporting ranges that explicitly account for subpopulation differences. Write: "For healthy adults, 10% infection risk at 100 CFU; for immunocompromised, same risk at 3 CFU — applies to 12% of exposed population." That plain sentence does more work than a dozen sensitivity tables. One concrete anecdote: I once watched a regulatory submission get rejected because the dose-response curve didn't consider pregnant women. The fix cost three days of literature scraping and one footnote. Do it before someone asks. And yes — put the worst-case subgroup risk in your executive summary, not buried in Appendix G.