It earns a place when
- Use it when positive labels are scarce, costly or delayed and the normal distribution can be described.
- You can evaluate it against a credible baseline.
- Its output fits the decision and data constraints.
Machine learning models · Phase 3 · Lesson 25
Anomaly and novelty detection
Distinguish rare observations in a dataset from future observations that differ from the training distribution.
Lesson goal
Distinguish rare observations in a dataset from future observations that differ from the training distribution.
The core idea
An anomaly detector learns what ordinary looks like, then assigns a degree of strangeness to a new case.
Mental model
Picture it this way. An anomaly detector learns what ordinary looks like, then assigns a degree of strangeness to a new case. The important question is what assumption this picture makes, and whether that assumption fits the data.
Mathematical core
Methods include distance or density scores, Isolation Forest path lengths, one-class SVM boundaries and probabilistic tail probabilities.
Worked example
A payment-monitoring system may learn ordinary behaviour from mostly legitimate transactions and flag a sudden device, location and amount combination for review.
When to use it
Do not make it the default when
- Do not assume every rare point is harmful, or train on a dataset already contaminated by many undetected positives.
- A simpler model has not been tested.
- The data or target definition is still unclear.
Failure modes
Watch for this. Changing the expected anomaly rate changes thresholds. Distribution shift can make the old notion of normal obsolete.
When a result looks surprisingly good, inspect the split, target timing, error slices and data-generating process before celebrating.
Practice
Use this as a small experiment rather than a recipe to copy blindly. Change one thing, record the result and explain the change.
Do this. Generate a mostly normal dataset with a few injected anomalies. Fit IsolationForest and measure precision at a review budget you choose.
Retrieval check
Answer from memory first. The buttons reveal feedback, but the durable step is explaining why.
1. What does an anomaly detector usually learn?
2. Why is an anomaly score not automatically a decision?
3. What happens if normal training data contains many positives?
Transfer prompt. Describe one real problem where this model or idea would be a sensible candidate. Name the target, the main risk and the metric you would inspect.
Primary source
scikit-learn User Guide. Use the source for the deeper treatment after you can explain the lesson's core idea without looking.