The square root of the specification

Sun protection factor is measured under a standardised application of two milligrams of product per square centimetre of skin. Field studies of how much people actually apply consistently find somewhere between a quarter and a half of that.

Because attenuation is roughly exponential in film thickness, applying half the quantity does not give you half the protection — it gives you approximately the square root of the nominal factor. A bottle labelled 50 behaves, in ordinary use, closer to 7.

A model that takes the number on the label at face value is not making a small error. It is confidently reporting a protection level that is off by a factor of seven, in the unsafe direction, for essentially every user.

The general failure

The specification is not wrong. It is measured under conditions chosen for reproducibility, which is exactly what a standard should optimise for. The error is ours: we imported a parameter from one distribution and applied it to another, and the two are related by a transformation nobody wrote down.

This is one of the most common ways a technically correct model produces a wrong product, and it has the same shape everywhere it appears:

• Rated capacity measured at a temperature the device will never operate at.
• Fuel economy measured on a drive cycle no driver reproduces.
• Benchmark accuracy measured on a clean test split that shares no property with production traffic except its schema.
• Battery life measured at a screen brightness nobody chooses.
• Latency percentiles measured without the cold starts that dominate the real experience.

What we do about it

Three things, in order of how much they are worth.

1. 01Find the transformation. Somebody has usually measured the gap between the standard and the field. The dermatology literature has quantified real-world sunscreen application for thirty years. Look for that paper before inventing a fudge factor.
2. 02Model the decay, not just the offset. Protection is not a constant; it degrades with sweat, water and abrasion. We apply an exponential decay with a time constant of roughly two and a half hours, reset when the user reapplies. A single corrected number would still have been wrong an hour later.
3. 03Fail towards safety. Where the transformation is genuinely uncertain, choose the end of the interval where being wrong costs the user least — and say in the interface that you have done so.

Calibrating to the certification rather than the deployment is not a rounding error. It is the whole error.

One consequence worth stating, because it runs the other way: in this particular model, the transmission used for vitamin D synthesis never reaches zero, no matter how much protection is applied. That is not a safety margin we invented — it reflects the consensus position in the dermatological literature that real-world photoprotection does not compromise vitamin D status. When the evidence says the intuitive adjustment is wrong, the evidence wins.