How long should I wait to consider that the transation is "definitely" confirmed?
I'm not sure it's exactly what you're asking about, but pages seven and eight of the Bitcoin white paper are concerned with calculating the probability that an attacker could, after having sent payment to a recipient, change the transaction to instead pay himself - specifically, from the paragraph that begins, "We now consider how long the recipient of a new transaction needs to wait before being sufficiently certain the sender can't change the transaction," onwards.

https://bitcoin.org/bitcoin.pdf