Covariance Intersection — Fusing Correlated Estimates

Chapter 1: Consistency — The "No Overconfidence" Requirement

Before we can fix the problem we have to say precisely what "honest" means for an estimator. Chapter 0 kept saying the naive fuser was "overconfident" — its reported variance was smaller than it deserved. Let's pin that down into a single, checkable property, because it is the entire design target of Covariance Intersection. The property is called consistency.

An estimate is a pair: a mean x̂ (our best guess of the true value x) and a covariance P (our claimed uncertainty). The covariance is a promise: "the true value is probably within this much of my guess." A consistent estimator keeps that promise. Formally, the covariance it reports must be at least as large as the covariance of its actual errors:

Read it carefully. The right-hand side, E[(x̂−x)(x̂−x)^T], is the true error covariance — how wrong the estimate actually is on average. The left-hand side P is what the estimator claims. The symbol ≥ here is the matrix version of "greater-or-equal": it means P − (true error covariance) is positive-semidefinite — the claimed ellipse encloses the true error ellipse in every direction. Consistency says: never claim a tighter uncertainty than you actually have. You are allowed to be too humble (P too big); you are forbidden from being too cocky (P too small).

Why the naive fuser is inconsistent

Now the precise statement of Chapter 0's disaster. When two estimates A and B are correlated and you fuse them by the independent rule, the reported P comes out smaller than the true error covariance — the ≥ flips to a <. The claimed ellipse sits inside the true error ellipse. The estimator has broken its promise: reality routinely escapes the margin it advertised. That broken promise is overconfidence, and once a downstream consumer (a controller, a gate that rejects "unlikely" measurements) trusts that too-small P, it makes decisions on a lie. Hence divergence.

So the design target writes itself. Given two estimates with unknown correlation, we want a fused (x̂, P) that satisfies P ≥ (true error) no matter what the correlation turns out to be. It must enclose the true error ellipse for the best case (independent), the worst case (perfectly correlated), and every case in between — simultaneously, with one fixed P, because we never get to learn which case we are in.

Picture it: the consistency requirement as an ellipse that must enclose

Covariances in 2-D draw as ellipses: small tight ellipse = confident, big fat ellipse = uncertain, tilt = correlation between the two coordinates. Below, the dashed ellipse is the true error covariance (which we do not normally get to see). Drag the slider to shrink the claimed P. The moment the claimed ellipse stops enclosing the true one in any direction, the estimate goes inconsistent — and the panel turns red to mark the broken promise.

Notice the asymmetry the simulation makes vivid: making P too big (slider far right) is always green — an overcautious estimator is still consistent, just wasteful. Making P too small (slider left) eventually goes red — overconfidence is the only failure consistency forbids. Covariance Intersection lives exactly on the green side of that line, as small as it can be while never crossing it.

Chapter 2: The Covariance Intersection Update

We want a fusion rule that is consistent for every possible correlation. Julier and Uhlmann found one in 1997, and it is startlingly close to the rule we already know — it is the inverse-variance rule with a single parameter slipped in. Let's first recall the rule that fails, then see the one-line surgery that fixes it.

The rule that fails, in information form

From Lesson 9 you know any estimate can be written in information form: instead of carrying the covariance P and mean x̂, you carry the information matrix P⁻¹ (the inverse of the covariance — "how much you know") and the information vector P⁻¹x̂. In that form, independent fusion is just addition:

This is the source of all the trouble. Adding the information matrices says "I have all of source 1's information plus all of source 2's information" — which is true only if none of it overlaps. When they share information, this sum double-counts and inflates the total information (shrinks the variance) past what is real.

The one-line fix: take a weighted blend instead of a sum

Covariance Intersection replaces the sum with a weighted average governed by a single dial ω ∈ [0, 1]:

Stare at the difference. The naive rule has implicit coefficients of 1 and 1 on the two information matrices — it takes all of both. CI uses ω and (1−ω), which sum to one — it takes a convex combination of the two pieces of information rather than their sum. Because the weights sum to one, the total information can never exceed the larger of the two inputs by adding them up. That single change — coefficients that sum to 1 instead of coefficients that are both 1 — is what kills the double-counting. That is the entire algorithm.

A worked 1-D step, by hand

Drop to one dimension where matrices become plain numbers, and reuse Chapter 0's numbers so the contrast is brutal. Source 1 (Robot A): x̂₁ = 10.0 m, variance σ²₁ = 4 m². Source 2 (Robot B): x̂₂ = 9.0 m, variance σ²₂ = 4 m². Their correlation is unknown. Pick ω = 0.5 (we will justify this later; with equal variances it is the symmetric choice).

Step 1 — the information (inverse variances). In 1-D, P⁻¹ is just 1/σ²:

Step 2 — the fused information, CI rule. Weighted blend, not sum:

The fused variance is 4 m² — unchanged from the inputs. Compare to the naive rule that summed to 0.5 and reported 2 m². CI refuses to shrink the variance because, with the correlation unknown, the worst case is that B is a copy of A, in which case 4 m² is exactly right. CI plans for that worst case automatically.

Step 3 — the fused mean. The information-vector blend:

The fused mean is 9.5 m — the midpoint of the two estimates, which is sensible when both are equally trusted. So CI returns (9.5 m, 4 m²): a reasonable central guess with an honest, un-shrunk uncertainty. The naive rule returned (9.5 m, 2 m²) — same guess, but a variance half as large as it had any right to claim. The difference between those two is the difference between a filter that survives a network and one that diverges in it.

Why is it called "intersection"? The geometry that names the method

The name comes from a beautiful 2-D picture. Each input covariance is an ellipse. Here is the theorem Julier and Uhlmann proved: for every ω in [0,1], the CI ellipse passes through (and encloses) the intersection region of the two input ellipses — and as ω sweeps 0→1, the CI ellipse sweeps out a family of ellipses that all contain that lens-shaped overlap.

Why does the intersection matter? The intersection (the lens where both ellipses overlap) is the region consistent with both sources at once — the only place the true value could plausibly be regardless of the unknown correlation. Any honest fused estimate must enclose that lens; if it cut into the lens it would be excluding points that both sources still consider plausible, i.e., it would be overconfident. CI is, in a precise sense, the family of tightest ellipses that still enclose the intersection. The naive-fusion ellipse, by contrast, collapses to something smaller than the lens — it pokes inside the intersection, which is exactly the overconfidence we are forbidding.

Slide ω to 0 and the CI ellipse becomes source 2's ellipse exactly; slide to 1 and it becomes source 1's. Anywhere in between, it is a fatter ellipse that hugs the lens. Turn on the naive overlay and watch it shrink to a tiny ellipse buried inside the overlap — that tiny ellipse is the lie. CI's ellipse never enters that forbidden zone, which is precisely the consistency guarantee of Chapter 1, drawn in pictures.

Chapter 3: Choosing ω — The Trust Dial That Picks the Tightest Honest Ellipse

Chapter 2 promised that every ω in [0,1] gives a consistent fused estimate. So why not just grab any old ω? Because consistency is the floor, not the ceiling. Of all the consistent ellipses CI can produce as ω sweeps, we want the tightest one — the smallest honest uncertainty, the most information we are allowed to claim without lying. Different ω values give different-sized fused ellipses, and one of them is smallest. Finding it is the optimization step.

What "smallest ellipse" means, precisely

An ellipse's size can be measured two ways, and CI uses one of them as the objective:

• det(P_CI) — the determinant of the fused covariance, proportional to the ellipse's area (volume in higher dimensions). Minimizing it makes the overall blob as small as possible. This is the standard choice.
• trace(P_CI) — the trace (sum of the diagonal), the sum of the variances along each axis. Minimizing it makes the total per-axis spread small. Cheaper to optimize, useful when one axis matters more.

We will use det. So the recipe is: sweep ω from 0 to 1, compute P_CI(ω) at each value, and keep the ω that minimizes det(P_CI). Happily, det(P_CI) as a function of ω is smooth and has a single clear minimum — no nasty local minima — so a simple line search or golden-section search nails it in a handful of evaluations.

A worked 1-D example — unequal variances make ω lean

In 1-D, det(P) is just the variance σ²_CI itself, and we want to minimize it. Take asymmetric inputs so the optimal ω is interesting: source 1 is sharp, σ²₁ = 1 m² (information 1/1 = 1.0); source 2 is fuzzy, σ²₂ = 9 m² (information 1/9 ≈ 0.111). The fused variance as a function of ω:

Evaluate it across ω and watch where it bottoms out:

The blended information rises monotonically as ω → 1, so the variance falls monotonically and the minimum sits at ω = 1. The optimizer hands all the weight to the sharp source. That is the right call: in 1-D with unknown correlation, the best you can consistently do is take the more informative source and ignore the other — you cannot safely combine them to do better. (This is a famous and slightly humbling fact: 1-D CI never beats the best single source. The gains of CI appear only in higher dimensions, where the two sources can be sharp along different axes.)

The 2-D case — where ω earns its keep

The interesting ω appears when the two sources are precise along different directions: source 1 is a long thin ellipse (sure about x, vague about y), source 2 is the perpendicular thin ellipse (sure about y, vague about x). Now neither dominates — each holds information the other lacks — and the optimal ω lands in the interior of [0,1], blending them so the fused ellipse is sharp in both directions. The det(P_CI) curve has a genuine interior minimum, and CI's fused ellipse can be substantially smaller than either input. This is the only regime where CI actually gains, and it is the regime that matters for real multi-sensor fusion (different sensors are precise about different things).

The optimization in code — golden-section line search

Because det(P_CI)(ω) is unimodal on [0,1], a golden-section search converges in ~20 evaluations to machine precision. Here is the loop spelled out:

python
import numpy as np

def ci_fuse_at(x1, P1, x2, P2, w):
    # CI update at a fixed omega (information form)
    I1 = np.linalg.inv(P1); I2 = np.linalg.inv(P2)
    I  = w * I1 + (1 - w) * I2          # blended information (weights sum to 1)
    P  = np.linalg.inv(I)                  # fused covariance
    x  = P @ (w * I1 @ x1 + (1 - w) * I2 @ x2)   # fused mean
    return x, P

def best_omega(P1, P2, tol=1e-4):
    # golden-section search for the omega minimizing det(P_CI)
    cost = lambda w: np.linalg.det(np.linalg.inv(w*np.linalg.inv(P1) + (1-w)*np.linalg.inv(P2)))
    gr = (np.sqrt(5) - 1) / 2             # golden ratio ~0.618
    a, b = 0.0, 1.0
    c, d = b - gr*(b-a), a + gr*(b-a)
    while (b - a) > tol:
        if cost(c) < cost(d): b = d
        else: a = c
        c, d = b - gr*(b-a), a + gr*(b-a)
    return (a + b) / 2

def covariance_intersection(x1, P1, x2, P2):
    w = best_omega(P1, P2)            # 1) optimize the trust dial
    return ci_fuse_at(x1, P1, x2, P2, w)  # 2) fuse at the optimum

The best_omega search brackets [0,1], shrinks the bracket by the golden ratio each step (always keeping the better of two interior probes), and stops when the interval is tiny. Because the cost is unimodal, the bracket always contains the true minimum — no risk of latching onto a false one. The whole fuse is two calls: optimize ω, then apply the update at that ω.

Chapter 4: CI vs Naive KF — Watching One Diverge and the Other Hold

We have argued, by ellipses and by arithmetic, that naive Kalman-style fusion goes overconfident on correlated data while CI stays honest. Now let's run both on the same stream of correlated estimates, side by side, and watch the difference play out over time — because the failure of naive fusion is not a one-step error, it is a slow-motion collapse that compounds.

The experiment

Set up the canonical decentralized loop. Two nodes each hold an estimate of one shared scalar (say, a tracked target's position). At every step they exchange and fuse. The catch: their estimates share a common component — they both depend on the same process noise / the same prior — so the cross-correlation is real and large but unknown to the fuser. We fuse the stream two ways:

• Naive KF fusion — treats every fusion as independent (adds the information). Reported variance keeps shrinking.
• Covariance Intersection — blends with optimal ω each step. Reported variance stays bounded by the honest worst case.

What you should predict before running it

The naive KF's reported variance will plunge toward zero — each fusion "discovers" information that was already counted. But the true error will not improve in step, because no genuinely new information arrived. The gap between "how sure the filter says it is" and "how wrong it actually is" widens every step. Eventually the filter is so falsely confident that it gates out (rejects as implausible) the very corrections that would save it, and its estimate drifts away unchecked — divergence. CI's reported variance, in contrast, plateaus at the honest level: it never claims information it cannot prove it has, so its confidence and its accuracy stay in agreement, and it tracks the target without collapsing.

Crank the shared-info fraction up and the naive KF's variance dives off the bottom of the plot while CI holds steady near the honest dashed line. Drop the shared fraction to 0 (truly independent) and the two converge — with no shared information, naive fusion is correct and CI is merely a bit conservative. The whole story is in the gap between the colored line and the dashed truth: CI keeps that gap closed; naive KF lets it blow open.

The 1-D bell-curve view of a single fusion

Zoom in on one fusion step to see the same effect as Gaussians. Two bells (the two correlated estimates), and the two fused results: naive (tall and skinny — falsely confident) vs CI (appropriately wide). The naive bell is so narrow it assigns almost zero probability to values that are perfectly plausible; the CI bell keeps those values in play.

Chapter 5: Extensions — Split CI, Inverse CI, and the Pessimism Tradeoff

Plain CI assumes the worst about correlation: it knows nothing about the cross-covariance, so it protects against the entire range from independent to perfectly correlated. That is maximally safe but maximally pessimistic. In practice you often know part of the correlation structure, and a family of refinements lets you claw back the lost sharpness without giving up consistency. This chapter is the map of those refinements.

Split CI — when some of the correlation is actually known

Often an estimate is a mix: part of its uncertainty is independent noise (each sensor's own measurement noise, which is genuinely uncorrelated) and part is correlated through shared history. Split Covariance Intersection exploits this by splitting each covariance into two pieces:

Split CI then applies the conservative CI blend only to the correlated parts (where it must be cautious) and the efficient independent-fusion rule to the independent parts (where it is safe to add information). The result is consistent like CI but tighter, because it stops being pessimistic about the genuinely-independent component. The intuition: be paranoid only about what you have reason to be paranoid about.

Inverse Covariance Intersection (ICI) — bounding the double-counted part

Inverse Covariance Intersection, a more recent refinement, takes a different angle: instead of being conservative about the whole estimate, it explicitly models the common information shared between the two sources as a quantity to be subtracted out, and bounds it conservatively. The effect is the same family — consistent under unknown correlation — but ICI is provably less pessimistic than plain CI in many cases: it produces a tighter (smaller) consistent covariance because it directly targets the shared-information overlap rather than guarding against the entire range of correlations at once. ICI is part of a broader effort, associated with work by Reinhardt and colleagues, on the minimum-pessimism question: what is the tightest covariance that is still guaranteed consistent for unknown correlation? CI is one safe answer; ICI and friends push closer to the theoretical floor.

Ellipsoidal CI — the geometric reading

Ellipsoidal CI is less a new algorithm than the clean geometric formulation: it frames the whole problem as "find the smallest ellipsoid that encloses the intersection of the input ellipsoids." That is precisely the picture from Chapter 2, made rigorous. It connects CI to the broader literature of set-membership and ellipsoidal estimation, where uncertainty is a region (a guaranteed bound) rather than a probability distribution. In that lens, CI is the natural fusion operator: the smallest guaranteed region consistent with both inputs.

The pessimism tradeoff, stated plainly

Every member of this family trades sharpness for safety under ignorance. The more you know about the correlation, the less pessimism you must accept:

Read top to bottom and you see the bargain: independent fusion is sharpest but bets everything on a correlation assumption; plain CI gives up all sharpness it cannot prove but never loses; Split CI and ICI sit in between, using whatever partial knowledge you have to recover sharpness without breaking consistency. The right tool is the one whose assumption matches what you actually know.

Chapter 6: Showcase — The Live CI Sandbox

Here is the payoff — everything from the lesson in one interactive instrument. Two 2-D covariance ellipses you can reshape; the live CI fused ellipse with its optimized ω; the det-vs-ω curve underneath with the optimum marked; and the naive-fusion ellipse shown for contrast so you can see, in real time, exactly how much the naive rule overclaims. There is no quiz here — the simulation is the test. If you can predict how the fused ellipse moves before you drag, you understand Covariance Intersection.

Things to try: (1) Make both ellipses round and equal — the fused ellipse sits between them, ω ≈ 0.5, and the naive ellipse is a tiny dot inside (max overconfidence). (2) Make them perpendicular thin slivers — CI fuses to a compact ellipse sharp in both axes (this is where CI gains), and ω lands in the interior. (3) Make one tiny and one huge — ω slams to the informative one and CI nearly ignores the vague source. Watch the det-vs-ω curve's minimum slide as you reshape.

The perpendicular-slivers case (try elongation 6 on both, angles 0 and 90) is the one to internalize: each source is nearly blind along one axis and sharp along the other. Independent fusion would (correctly, if they were independent) produce a tiny ellipse. CI produces a modest, compact ellipse — sharp in both axes, but bigger than the independent result, because it cannot rule out that the two sources' errors are correlated. That gap between the green CI ellipse and the red naive ellipse is the visible price of honesty under unknown correlation. Everything in this lesson lives in that gap.

Chapter 7: Use Cases & Real Products

Covariance Intersection is not a curiosity — it is the workhorse of decentralized estimation, the regime where you cannot maintain a single global filter that tracks all correlations for you. Anywhere estimates are produced by separate agents that then share them, the unknown-correlation problem appears, and CI (or one of its refinements) is the standard cure. Here is where it actually ships.

Decentralized sensor networks

Imagine dozens of cheap nodes spread over a field, each estimating some quantity (temperature gradient, a moving intruder's position) and gossiping estimates to neighbors. There is no central computer, no global state. An estimate started by node 3 can travel a loop — 3→7→12→3 — and arrive back at node 3, which would then fuse its own old information with itself. No node can trace these paths, so no node knows the correlations. CI is the canonical fusion operator here precisely because it needs no correlation knowledge and is provably consistent regardless — it was, in fact, one of the original motivating applications in Julier and Uhlmann's General Decentralized Data Fusion with Covariance Intersection (2001).

Multi-robot map merging and distributed SLAM

Two robots explore a building and each builds a map (a SLAM estimate of landmark positions). To combine their maps you must fuse their landmark estimates. But if the two robots overlapped — both saw the lobby, exchanged a relative pose, or one localized off the other's map — their map errors are correlated through that shared experience, and the amount is generally untrackable in a real deployment. Naive map merging produces a falsely tight joint map that the planner trusts and crashes into. CI-based map merging produces a consistent joint map: a little fuzzier, but one whose stated uncertainty the planner can safely believe. The same logic carries into modern SLAM back-ends when sub-maps from different sessions or agents are stitched.

Track-to-track fusion in radar / defense surveillance

This is CI's birthplace problem. Two radar sites each run their own tracker on the same aircraft and produce a track (state + covariance). A fusion center wants one combined track. But both trackers filtered the same maneuvering target — the target's own random accelerations are a common driving noise — so the two tracks' errors are correlated, and that correlation depends on the target's unknown maneuver history. Classic track-to-track fusion formulas that ignore this produce overconfident combined tracks; CI (and Split CI, separating the common target-process noise from each radar's independent measurement noise) gives a consistent combined track. This is why CI appears throughout the aerospace and defense data-fusion literature.

Vehicle cooperative perception (V2X)

Connected cars broadcast their object detections to nearby vehicles (a pedestrian here, a stopped truck there). Car X fuses its own detections with messages from cars Y and Z. The hazard: a detection that Y relayed from Z, which X then fuses alongside Z's direct message, is the same information arriving twice — and at highway speed the messaging topology changes too fast to track. Overconfident cooperative perception is a safety nightmare (a car confidently "knows" an empty lane is clear when its confidence is borrowed, double-counted air). CI gives each car a consistent fused world model: detections it can trust to the degree it has actually, independently confirmed them.

Chapter 8: Practical Application — How To Actually Use CI

Knowing the formula is not the same as deploying it well. This chapter is the field manual: when to reach for CI, how to run the ω optimization efficiently, when to upgrade to Split CI, and what it costs you compared to a plain Kalman fuse.

Step 1: decide whether you even have a correlation problem

CI is the right tool only when correlation is unknown. The decision is a single question: did the two estimates I am fusing come from one filter, or from separate filters that have shared information?

• One centralized filter, fusing a fresh independent measurement → use the ordinary Kalman update. The filter tracks the correlations; there is no hidden sharing. Do not use CI — it would needlessly inflate your covariance.
• Two separate estimators that have ever exchanged information (robots, tracks, network nodes) → suspect correlation. If you cannot prove independence, use CI.
• Estimates that may have looped back through the network → definitely CI; this is the data-incest case where correlation is not just unknown but adversarially structured.

Step 2: run the ω optimization

The objective det(P_CI)(ω) is unimodal on [0,1], so you have two cheap, robust options:

• Golden-section search (Chapter 3) — ~20 evaluations to high precision, no derivatives needed. Default choice; bulletproof because the cost is unimodal.
• Coarse grid + local refine — evaluate det at ω = 0, 0.1, …, 1.0, take the best, then a few golden steps around it. Trivially parallelizable; good when you fuse many pairs at once.

Each evaluation costs one matrix inverse (to form P_CI from the blended information) plus one determinant. For a small state (2–6 dimensions, typical of position/velocity tracks) this is microseconds. If you optimize trace instead of det, the cost function is even cheaper (no determinant) and often gives a near-identical ω — a fine speed-up when you are fusing thousands of pairs per second.

Step 3: use Split CI when you can name the independent part

Before defaulting to plain CI, ask: is part of each estimate's noise genuinely independent? Almost always, each sensor's own measurement noise is. If you can decompose P_i = P_i^(corr) + P_i^(indep), Split CI (Chapter 5) recovers real sharpness by being conservative only about the correlated part. The bookkeeping cost is modest and the accuracy gain is often large — in track-to-track fusion it is the difference between a usable combined track and an over-inflated one.

Step 4: budget the cost vs a Kalman fuse

CI costs roughly an order of magnitude more compute per fusion than a bare Kalman update (the line search), but for the small states typical of fusion that is still negligible, and you buy a guarantee that is otherwise impossible without tracking every correlation in the network. The real "cost" is not compute — it is the deliberately larger covariance, the pessimism you accept in exchange for safety.

Chapter 9: Debugging & Failure Modes

Two ways to get correlation handling wrong, and they fail in opposite directions. Ignoring correlation that exists (using KF where you needed CI) makes you overconfident and you diverge. Inventing correlation that does not exist (using CI where KF was fine) makes you needlessly fuzzy and you throw away accuracy. This chapter is how to spot both from the symptoms.

Symptom 1: the filter is overconfident — you needed CI and used KF

This is the dangerous one. The tell-tale signs:

• NEES too high. The Normalized Estimation Error Squared — the squared error scaled by the reported covariance — should average around the state dimension if the filter is consistent. If NEES runs far above that (the error is much bigger than the covariance says it should be), the covariance is too small: overconfidence. This is the single most diagnostic metric for the unknown-correlation bug.
• Reported covariance shrinking with no new sensors. If the variance keeps dropping while you are merely re-fusing estimates that share history, you are double-counting. Plot reported variance over time — a monotonic dive in a decentralized loop is the data-incest signature from Chapter 0.
• The estimate diverges despite "good" reported covariance. The cruel part: the filter looks healthy (tight covariance, confident) right up until it has gated out so many real corrections that it walks off into the weeds. A tight covariance next to a growing true error is the contradiction that screams "overconfident."

Symptom 2: the estimate is needlessly fuzzy — you used CI where the sources were independent

The opposite, less dangerous but wasteful, mistake. If you apply CI to estimates that genuinely are independent, CI's worst-case pessimism inflates the covariance far beyond what is warranted — you are protecting against a correlation that is not there. The signs:

• NEES too low. The mirror image of Symptom 1: the error is consistently smaller than the covariance predicts. The filter is over-cautious; it has more information than it admits. Average NEES well below the state dimension means you are being too conservative.
• Covariance refuses to shrink when it should. You add a genuinely independent, informative sensor and the fused covariance barely drops — because CI assumes the new sensor might be correlated. If you can prove independence, you are leaving accuracy on the table; switch that fusion to KF or Split CI.

How to detect which mistake you are making

Run a NEES test offline against ground truth (or a high-fidelity simulation). It is the referee:

The discipline: measure NEES, do not guess. Engineers routinely reach for CI as a security blanket and then wonder why their estimates are mushy, or trust a KF in a network and wonder why it diverges. NEES tells you which side of the line you are on, so you can match the fuser to the actual correlation structure rather than to your hopes.

Chapter 10: Connections, References & Cheat-Sheet

Covariance Intersection sits at the hinge between the centralized filtering of the first half of this series and the decentralized world of robot teams and sensor networks. It is the answer to a question every other fuser quietly dodged — "what if the things I'm fusing are secretly correlated?" — and once you see that question you cannot un-see it. Here is how it links to the rest of what you know.

Where this connects

• The Kalman Filter — the fuser CI fixes. The KF is optimal when the independence assumptions hold; CI is what you reach for when they do not. Reading them back to back makes the independence assumption that hides inside the KF visible.
• The Information Filter — the form CI is written in. CI is the information-form fusion rule with a convex weight; understanding information vs covariance form is the prerequisite for seeing why CI works.
• Fusion Architectures — centralized vs decentralized vs distributed. CI is the operator that makes the decentralized and distributed architectures actually consistent; that chapter sets the stage this one resolves.
• Classical SLAM & Modern SLAM — multi-robot map merging and multi-session back-ends are where CI earns its living in robotics; the correlated-map-error problem is exactly the unknown-correlation problem.

The cheat-sheet

References

1. S. J. Julier and J. K. Uhlmann. "A Non-divergent Estimation Algorithm in the Presence of Unknown Correlations." Proceedings of the American Control Conference (ACC), 1997. — the founding paper that introduces Covariance Intersection.
2. S. J. Julier and J. K. Uhlmann. "General Decentralized Data Fusion with Covariance Intersection." In Handbook of Multisensor Data Fusion, 2001. — the decentralized / sensor-network treatment.
3. J. K. Uhlmann. "Covariance Consistency Methods for Fault-Tolerant Distributed Data Fusion." Information Fusion, 4(3):201–215, 2003. — consistency under unknown correlation, formalized.
4. B. Noack, J. Sijs, M. Reinhardt, and U. D. Hanebeck. "Decentralized Data Fusion with Inverse Covariance Intersection." Automatica, 79:35–41, 2017. — ICI and the minimum-pessimism question.
5. M. Reinhardt, B. Noack, P. O. Arambel, and U. D. Hanebeck. "Minimum Covariance Bounds for the Fusion under Unknown Correlations." IEEE Signal Processing Letters, 22(9):1210–1214, 2015. — the theoretical floor on pessimism.