# guessing a 4-digit access code

The company I work for shares a building with another company, so when we need to access that building, we use a 4-digit access code (which never changed in several years) for the main door, and then an electronic badge to access our own offices and labs. Earlier this week I was entering the code, when I noticed that the keys of the 4 digits of the code were particularly worn out, as you may expect after people have been tapping on them for years. This made me think of the statistical/mathematical implications of this situation, and I got a bit lost. I couldn't really fit it to any theory I know. I wonder if someone can please shed some light on the matter, e.g. advise me what to look for.

The only thing I'm fairly sure of is that there are 4! = 24 possible codes of 4 distinct digits, so a burglar who didn't know the code and wanted to break in would have to try at worst 24 codes. [Of course assuming that the burglar is clever and notices the 4 worn-out keys, AND is lucky and guesses (correctly) that the code is a 4-digit one].

The next question I asked myself was: assuming that many burglars try to break in, what would be the average number of codes they try out before finding the correct one?

Intuitively, without thinking, I guessed 12, but then I considered the situation more carefully and found I was (perhaps) wrong.
My vague idea was that the distribution of number of trials before break in would be a 'sort' of normal one, for a large number of burglars. Something like: lowest frequency for 1 trial, a bit higher for 2 trials, ..., maximal for 12 trials, and then symmetrical on the other 'side'. Already, if this were the case, maybe the expected value would be 12.5 rather than 12.
But in fact I later became convinced that this couldn't be the actual distribution.

The code is one 4-digit number out of 24 possible ones.
If the burglar were 'systematic' and tried the codes in ascending order, like 1234, 1243, 1324, 1342..., the number of trials before break in would always be the same, and depend on where the actual code is placed, as a number rather than as a generic object, in this ordered sequence. E.g. if the real code were '1 2 3 4', any systematic burglar would find it at the first trial, so the distribution would be: 100% @ trial = 1. At the opposite end of the scale, if the real code were '4 3 2 1', any systematic burglar would find it at the 24th trial, so the distribution would be: 100% @ trial = 24.
Instead, in the hypothesis that the burglar were 'unsystematic' and tried the codes completely at random (but not confused, so never repeating any code), what would be the probability of guessing the code at the 1st, 2nd, 3rd... 24th trial?

Here's where I started being quite unsure of what I was doing, so please correct me if I'm wrong.
I tried a simple conditional probability approach.

• A correct guess of the code at the 1st trial is like finding the 1 black ball out of an urn with 23 white balls and 1 black one. Probability = $1/24$. Nothing happens after that, the burglar is already inside the building.
• A correct guess of the code at the 2nd trial is like finding first a white ball, then the black one, same urn as above. Probability = $23/24 \cdot 1/23 = 1/24$.

As I continued applying this method, I realised that the probability was in fact the same for all cases.

Is this conclusion correct? If I plotted the frequency of the number of trials before success, under the above hypotheses, would I get a uniform histogram with each bar having height $1/24$?

I turned to R for a simulation. First, the data frame of all the codes you can make with distinct digits {1,2,3,4}:

require("gtools")
perms <- as.data.frame(permutations(4,4))
perms["code"] <- mapply(paste,perms$V1,perms$V2,perms$V3,perms$V4)


The random trials made by the unsystematic burglar would be random permutations of the set of codes. The position of the correct code in each of these permutations would be the number of trials needed to break in.
Thus a function generating a vector of number of trials for success, for NB burglars, if the correct code were "3 2 1 4", could be:

trials <- function(NB) {
v = vector(mode="numeric")
for (i in 1:NB)
{s = sample(perms$code,size=24) v = c(v,which(s == "3 2 1 4"))} return(v)}  The histogram returned by 100000 burglars seems to confirm that the distribution is indeed roughly uniform: vs <- trials(100000) plot(table(vs),type="h")  So the expected value for the number of trials seems to be indeed$\sum_{i=1}^{24} {\frac 1 {24} \cdot i} = \frac 1 {24} \cdot \frac {24 \cdot 25} {2} = 12.5$. But unlike most situations, where one imagines the average to be also close to the most frequent case, here it seemed that the number of burglars who would get in very quickly would be roughly the same as the number of those who struggle to get in, and as the number of those who try about 12-13 times... this was quite a surprise to me; I had not encountered such a case before. Apart from the simulation, do you think it makes sense theoretically? The next step was to test hypotheses with this unfamiliar (to me at least) distribution. Suppose the keypad is connected to a computer that keeps track of the number of trials by each person that eventually gets in (I had to try a few times myself on some occasions, but not because I am a burglar: just because I got it wrong; but OK). How would you use the data from, say, 1000 people who entered the building, to decide if any of them probably actually did not know the code and just tried them out until they found the correct one, and in the latter case, whether they tried systematically (in numerical order) or unsystematically (in random order)?. I would not know how to test or even simulate this, given the peculiar distribution that I'm looking at (or maybe I'm not seeing its obvious connection with a normal one?). Any suggestions? ## 1 Answer So the expected value for the number of trials seems to be indeed ∑24i=1124⋅i=124⋅24⋅252=12.5 . ... But unlike most situations, where one imagines the average to be also close to the most frequent case, here it seemed that the number of burglars who would get in very quickly would be roughly the same as the number of those who struggle to get in, and as the number of those who try about 12-13 times. Most (or at least many) real-life situations involve a probability that is bell-shaped (e.g., the Normal distribution), where the mode of the distribution is indeed close (or equal) to its mean. However, the uniform distribution is, well, uniform - the expected outcome is just as likely as any other one. How would you use the data from, say, 1000 people who entered the building, to decide if any of them probably actually did not know the code and just tried them out until they found the correct one This is a case which is presumably exactly the opposite - the distribution of attempts on the code (since it involves mostly people who know the code), is concentrated toward the mean. The distribution is probably similar to a geometric distribution with high$p$: : This gives a number of easy ways to detect unauthorized intrusion: flag the top$x$percentile of attempt tries, flag attempts that are more than$\alpha > 1\$ the expected number, or fit the distribution to a known expectation (e.g., the geometric one), and flag low-probability events.

• Thank you @Ami Tavory. I read the Wikipedia post you linked. Is it possible that the negative hypergeometric distribution is closer to my case, given that trials are not independent (i.e. the person never tries again a previously tried code)? – user6376297 Mar 18 '18 at 9:31
• @user6376297 It's possible, but I think we're talking about complementary distributions. The distribution of a legitimate user is probably geometric (or close to it), since a mistake is failing to press correctly, and hence (approximately) memoryless. I think you're referring to the distribution of an illegitimate user, but my suggestion is to check the hypothesis that the outcome would come from a legit user. – Ami Tavory Mar 18 '18 at 9:44