Deploying a new model to 100% of traffic is reckless. Canary rollouts send a small fraction (1–5%) of traffic to the new model while monitoring metrics. Blue-green deploys keep the old version warm for instant rollback. A/B tests run both models simultaneously to measure real-world lift.
To catch an error rate rising from 1.0% to 1.5% with the usual 5% significance and 80% power takes about 7,747 requests in each arm. With 100,000 requests a day and the canary on 5%, that is 1.5 days of canary traffic. A ten-minute canary on 1% of traffic can only catch outright breakage, not a regression of this size.
- Peeking at the canary every few minutes and stopping when it looks fine inflates false confidence; decide the sample size or use a sequential test.
- Canary traffic is often not a random slice (one region, one client version), so the comparison can be confounded.
- Business metrics such as conversion move slowly; a canary judged only on latency and errors can still ship a worse model.
from scipy.stats import norm p0, p1 = 0.010, 0.015 # error rate today, and the regression we want to catch alpha, power = 0.05, 0.80 z = norm.ppf(1 - alpha / 2) + norm.ppf(power) n = z**2 * (p0 * (1 - p0) + p1 * (1 - p1)) / (p1 - p0) ** 2 # requests needed in each arm daily = 100_000 days_at_5pct = n / (0.05 * daily) # canary gets 5% of traffic
Assumes import numpy as np and import pandas as pd. Each snippet carries its own example numbers; the comments say which are made up or simulated.
The same idea with a library
# Kubernetes canary with Istio traffic split # VirtualService: # http: # - route: # - destination: # host: model-service # subset: stable # weight: 95 # - destination: # host: model-service # subset: canary # weight: 5
- Trustworthy Online Controlled Experiments, R. Kohavi, D. Tang & Y. Xu, Cambridge University Press, 2020
- The Site Reliability Workbook, B. Beyer, N. R. Murphy, D. K. Rensin, K. Kawahara & S. Thorne (eds.), O’Reilly, 2018 — “Canarying Releases”
Last reviewed October 2026 · How this site checks its content · Report a mistake
1. A canary on 1% of traffic runs for an hour without alarms. Is the new model safe?
Show answer
C. A canary is a smoke test. Size and duration decide which failures it can possibly detect.
2. Why randomise an A/B test by user rather than by request?
Show answer
C. If one user sees both versions, their behaviour mixes the two and the comparison is contaminated.
3. You check an A/B test every day and stop as soon as it is significant. What is the problem?
Show answer
C. Use a fixed horizon or a sequential method designed for repeated looks.