Normal is the model.
Weird is the signal.

A credit card in New York at 2 pm and in Tokyo at 2:05 pm. A factory sensor reading 150° when its normal band is 80–120. A server answering in 205 ms when it usually takes about 120. These are anomalies — but notice that each sentence contains a hidden model: a usual travel pattern, a normal operating band, a service-level baseline. Anomaly detection is the business of fitting that model of normal and scoring how far new data departs from it.

Labels are the reason the framing flips. Fraud is roughly 0.1% of transactions; equipment failures happen a few times a year. One million transactions contain about 1,000 frauds — but the fraud you will see next month is a scheme nobody labeled yet. A classifier trained only on yesterday’s fraud types learns exactly those; a model of normal flags whatever does not fit, including the new scheme. And a classifier that answers “normal” to everything is 99.9% accurate and catches nothing, which is why accuracy never appears in this lesson’s metrics.

The source lesson calls anomaly detection “fundamentally different from classification”, and the difference is the training distribution. A classifier needs examples of both classes; a detector needs a trustworthy picture of normal and a way to measure deviations. When a clean baseline exists, use it: fitting on normal-only data is the strongest setup, because anomalies can never teach the model that they are ordinary. When labels exist, resist the urge to just train a classifier — keep them for evaluation and let the detector stay broad. In production the two coexist: unsupervised detection for coverage, a supervised model for the known high-priority types, and humans for the ambiguous middle.

Z-score. Standardize every feature: subtract its mean, divide by its standard deviation, and flag readings beyond a threshold. The default k = 3 comes from the bell curve (99.7% of normal data falls inside 3σ). It is fast, explainable — “this reading is 3.7σ above normal” — and only faithful when the baseline is one roughly-Gaussian cluster. On the lesson’s 55 response times the contaminated statistics are mean 121.16 ms and std 22.66 ms, so the reading 205.0 scores z = 3.70, 180.0 scores 2.60, and 152.0 scores 1.36. Notice what happened: the planted faults inflated the std. Fit only on the 50 ordinary readings and the std is 9.56 ms — then 180.0 scores 6.19σ and 152.0 scores 3.26σ. Contamination hides the very points that caused it.

IQR. Take the middle half of the data instead: Q1 (25th percentile) and Q3 (75th), then flag anything below Q1 − 1.5·IQR or above Q3 + 1.5·IQR, where IQR = Q3 − Q1. Percentiles barely move when one point goes wild, so this rule is robust to contamination and says nothing about bell curves. On the same 55 readings Q1 = 114.05, Q3 = 128.50 and IQR = 14.45, giving bounds [92.38, 150.18]: all five planted points are outside, with no false alarms. (Tighten to factor 1.0 and the bounds [99.60, 142.95] flag six points — five true, one false.) Its blind spot is the joint space: each feature is checked alone, so a point can be normal in every feature and still be impossible in combination.

Mahalanobis distance keeps the shape. Instead of measuring distance feature by feature, it first rotates the axes until the correlations vanish and rescales each axis to unit spread — the mathematical name is whitening — and then measures ordinary Euclidean distance in that cleaned-up space. In one dimension it is the z-score; in a tilted two-dimensional cloud it is the only one of the three that notices a point sitting off the diagonal. The lesson’s correlated baseline has mean (−0.148, −0.123), σx = 0.919, σy = 0.813 and correlation ρ = 0.862. The planted point (2.6, −2.5) scores 2.99 on x and −2.92 on y — each barely under the 3σ line — but its Mahalanobis distance is 11.27, while the largest baseline point scores 2.74. At the same threshold of 3.0, per-feature z-score misses two of the six planted points; Mahalanobis misses none.

How it works. Build many trees. At each node, pick a random feature, pick a random split value between that feature’s minimum and maximum, and send every point left or right. Keep splitting until each point is alone (or a depth limit is reached). A normal point lives in a dense region, so many random questions are needed before it is separated from its neighbors. A far-out point is separated almost immediately. That is the whole trick: anomalies have short average path lengths across the forest.

The raw path length depends on the dataset size, so the score is normalized by c(n), the expected path length of an unsuccessful search in a random binary search tree. A score near 0.5 means ordinary; near 1 means isolated fast; near 0 means buried deep in a dense cluster. In the lab the six planted points have average paths 3.46–4.62 and the deepest normal point 10.49, and a threshold near 0.635 separates them exactly — with no labels used to build the forest.

One-class SVM treats the normal points as a single class and fits a boundary that encloses them in a high-dimensional feature space. Because it uses a kernel, the boundary can bend around clusters that a circle cannot wrap: the RBF kernel lets the fence curve in whatever shape the data needs. SVDD (support vector data description) is the sphere-shaped cousin: it looks for the smallest sphere that contains the normal data, allowing a few points to sit outside through slack variables.

Both share the parameter ν (nu). It sets the fraction of training points allowed outside the boundary — the same role contamination plays for the threshold of a score-based detector. A larger ν buys a tighter fence and catches more deviations, at the cost of ringing the baseline’s own edge. The lab below is the simplest possible SVDD: a circle fitted so that ν of the baseline lies on or outside it. Real one-class SVM solves a quadratic program, but the tradeoff you feel on the slider is exactly the one production uses.

An autoencoder has two halves: an encoder that compresses the input into a small code, and a decoder that rebuilds the input from the code. Train it on normal data with a reconstruction loss, and it learns the regular structure well enough to copy it. At test time, feed it a new point, measure the reconstruction error, and treat a large error as the anomaly score: the network never learned how to compress that kind of point, so the round trip loses information.

The linear version is a picture you can compute by hand. A 2-D cloud with a one-number bottleneck must project every point onto a line; the best line is the direction along which the data varies most (the first principal component), and the reconstruction error is the distance from the point to that line. On the lesson’s correlated cloud the axis is u = (0.7554, 0.6553) and it holds 93.2% of the variance. The ordinary point (1.12, 0.48) projects to (0.874, 0.763) and reconstructs with error 0.375; the planted point (2.6, −2.5) projects to (0.244, 0.217) and reconstructs with error 3.596. All six planted points land between 2.01 and 4.23; every baseline point stays under 0.87. A threshold of 1.0 separates the two groups perfectly.

Predict “normal” for every credit-card transaction and you are right 99.9% of the time while catching 0% of the fraud. That is why this lesson never uses accuracy. The practical alternatives are precision@k — of the k most suspicious items, how many are real — recall at a fixed review budget, and AUPRC, the area under the precision–recall curve. AUROC is seductive but misleading under heavy imbalance: the false-positive rate stays tiny while precision collapses, so a detector can score 0.95 AUROC and still waste most of an analyst’s queue.

contamination deserves its own sentence. It does not change the anomaly scores, and it is not used during training: it only converts continuous scores into flags by cutting at the corresponding quantile. Setting contamination = 0.05 means “flag the top 5%”. If the true rate is 0.5%, four out of five alerts are false by construction. When you do not know the rate — almost always — work with raw scores and choose the cut from costs and review capacity.