Finding Readings That Are Easy to Separate

An isolated reading often needs few random splits to stand apart. Follow paths through small trees before averaging that evidence across a forest.

14 sections · 4 questions · 2 coding challenges

1 / 14

The arrow keys move between sections too.

Detecting by Isolation Rather Than Density

BOTIE

Liu, Ting and Zhou developed isolation-based anomaly detection, using random partitions to separate observations. The method estimates how easily a point can be isolated without first fitting a full density.

Our first tree has supplied splits so every branch can be followed. The second exercise averages path lengths from several trees. A production forest fits many random trees on subsamples and handles depth limits and unresolved leaves.

Sources for this history

Liu, Ting and Zhou: Isolation Forest

How Many Splits Does It Take to Isolate One Reading?

Four pressure readings sit close together and another lies far away. A split placed somewhere across their range often separates the distant reading immediately, while the close readings need more splits.

Isolation forests use this difference in path length. They repeatedly partition samples at random and score observations by how quickly they become isolated.

The paths are supplied examples from trees; the positive normaliser is given.

Step 1 of 3

Start with separated values

One value lies beyond a compact group.

Readings

Values: 0, 1, 2, 3, 20

Step 2 of 3

Make a first split

A threshold at ten isolates the last value.

Split at 10

Below 10

Values: 0, 1, 2, 3

At least 10

Values: 20

A split at 10 isolates the reading 20 immediately. The four nearby readings still need further splits.

Step 3 of 3

Continue splitting the compact group

The distant point has a shorter path in this example.

An invented example for this lesson.
Original reading	Depths after supplied splits
0	3
1	3
2	3
3	3
20	1

0
Depths after supplied splits
3
1
Depths after supplied splits
3
2
Depths after supplied splits
3
3
Depths after supplied splits
3
20
Depths after supplied splits
1

Easy separation can be evidence of an unusual observation

Averaging reduces dependence on one partition, and shorter paths receive higher scores.

How many splits did it take to isolate this reading?

One tree can get lucky with a split. Compare several recorded path lengths, then see how a shorter average path affects the isolation score.

BOTIE

Botie has this reading’s path length in each tree and the positive sample-size normaliser.

Choose an example

Paths across trees

Positive c(n)

Isolation score from the recorded paths

0.7071

Follow the operations

1. Set a constant
```
-1
```
2. Paths across trees
1. 01
2. 11
3. Mean
```
1
```
4. Positive c(n)
```
2
```
5. Divide
```
0.5
```
6. Multiply
```
-0.5
```
7. Raise two to a power
```
0.7071
```
8. Result
```
0.7071
```

Paths must come from fitted trees with a consistent subsample size and leaf correction policy.

1. Build a Random Partition Tree

Choose a feature with variation and a threshold between its minimum and maximum in the current subset. Divide records, then repeat inside each child. Stop when a record is isolated or a declared limit is reached.

A one-dimensional example needs only thresholds. In several dimensions, random feature choices also matter. Store the actual tree: prediction follows its splits rather than drawing fresh thresholds.

The hand-chosen tree here illustrates traversal, not random training.

2. Count Edges Along a Path

Path length counts the splits passed before reaching the leaf. A point isolated by the root split has length one. Closely packed observations tend to require more partitions, although any one random tree can be misleading.

Root threshold = 10
Left-child threshold = 1.5
Its child thresholds = 0.5 and 2.5
Paths for [0,1,2,3,20] = [3,3,3,3,1]

When a depth-limited leaf still contains multiple records, standard scoring adds an expected remaining-path correction.

3. Average Trees and Normalise

One random tree can give a misleadingly short or long path, so we average across the fitted trees. We then compare the average with a reference path length for the training subsample size. The conventional exponential score makes shorter paths produce larger anomaly scores.

That reference depends on subsample size, not on how many trees we fitted. For the small sample in the exercise, we can calculate it directly from the harmonic-number expression.

c(n) = 2 H(n-1) - 2(n-1)/n, for n > 1
score = 2^(-mean_path / c(n))

The score is a relative isolation measure, not a calibrated probability of failure.

Combine the path lengths from two trees

One tree isolated the observation after one split; another needed three. Average those path lengths before converting them to a score using the supplied sample-size normaliser.

Python

import numpy as np
paths = np.array([1., 3.])
normaliser = 4.0
mean_path = paths.mean()
score = 2.0 ** (-mean_path / normaliser)
print(float(mean_path))
print(f'{score:.3f}')

Output

2.0
0.707

The average reduces reliance on one lucky partition. Practice asks you to obtain path lengths by actually following a tree's branches.

4. Decide How to Investigate Alerts

Fit on representative records, assess validation alerts, and inspect effects of subsampling and feature representation. An unusual but valid operating mode may also be easy to isolate.

A contamination setting often determines a score cutoff; it does not prove the true fraction of faulty records. Use labelled incidents and operational costs when available, and preserve a route for a person to review the evidence.

The workshop aggregates paths. Its numerical tests check the direction of the score as path length changes.

5. A Tree Needs a Stopping Rule

A random isolation tree chooses a feature with variation, samples a split between its observed minimum and maximum, and sends observations left or right. Repeat until a node contains one observation, cannot be split or reaches a depth limit.

A query follows those saved decisions. It does not choose fresh splits while being scored. Keep the fitted tree, feature conventions and random seed so the path lengths can be reproduced.

6. Follow One Saved Tree

A distant reading can be separated near the root while central readings need more decisions. One tree can also make an unhelpful split by chance, which is why a forest averages across many random partitions.

The hand-specified tree below exposes the path-counting convention. It is an illustration of scoring a tree, not a trained isolation forest.

Count edges from the root to a leaf

The root splits at five. Its left child splits at 1.5.

Python

import numpy as np
reading = np.array([1.,2.,10.])
depth = np.where(reading >= 5, 1, 2)
print(depth.tolist())

Output

[2, 2, 1]

The distant observation needs fewer decisions in this tree. A different random tree can give different individual depths.

7. A Leaf with Several Records Has Unfinished Isolation Work

When training stops at a leaf containing several observations, the raw depth understates the remaining work of isolating one of them. Isolation-forest scoring commonly adds an expected path-length correction based on that leaf size before averaging and normalising.

Identical records may never be separated by feature-value splits. Check the implementation's treatment of such leaves, subsample size and score direction. A larger anomaly score in one API can correspond to a smaller normality score in another.

8. The Alert Fraction Is an Operational Choice

A contamination setting or chosen score quantile determines how many observations are flagged under a reference distribution. It does not measure the true fraction of faulty sensors without labels.

Inspect stability across seeds and reference samples. Keep the reference fit fixed when monitoring a new batch, and investigate which feature splits led an alert down a short path. The score is evidence of easy isolation, not an explanation of a physical fault.