Isolation Forest and One-Class Boundaries

Isolation methods and one-class boundaries come at novelty from opposite directions. Isolation Forest partitions features and values at random, then measures how short a path is needed to cut a point out of the sample. It never estimates a density, and it never needs to see the whole training set at once. A One-Class SVM instead learns a kernel boundary that separates most of the reference data from the origin. Each new point is then asked whether it falls inside that support region.

The two costs are not comparable, and the difference is documented rather than folkloric. scikit-learn's user guide gives the one-class solver a range rather than a figure: “The QP solver used by the libsvm-based implementation scales between O(n_features × n_samples^2) and O(n_features × n_samples^3) depending on how efficiently the libsvm cache is used in practice (dataset dependent).” Isolation Forest's published cost is O(tψ log ψ) to train and O(nt log ψ) to evaluate. Here ψ is the sub-sample per tree and t the number of trees. The sample size enters the training term only through ψ, and ψ is held at 256 by default.

Sensitivity to units is documented by the maintainers of both standard implementations. The same scikit-learn page warns that “Support Vector Machine algorithms are not scale invariant, so it is highly recommended to scale your data.” The LIBSVM authors open the scaling section of their practical guide with the sentence “Scaling before applying SVM is very important.” The reason they give is arithmetic, not stylistic: “The main advantage of scaling is to avoid attributes in greater numeric ranges dominating those in smaller numeric ranges.” Their instruction is explicit: “We recommend linearly scaling each attribute to the range [−1, +1] or [0, 1].” Feed raw amounts in one column and raw counts in another to a One-Class SVM, and you have already chosen which feature the boundary listens to.

A sparse combination of features is isolated after only a few random tree splits. Common observations require deeper partitions. Isolation Forest converts that path-length difference into an anomaly ranking. The method's efficiency comes from a structural assumption: rare observations with unusual attribute values are often easier to isolate. Not every anomaly satisfies that assumption.

The defaults carry the assumption, and they are the paper's defaults. The original Isolation Forest paper, published in 2008, fixes the sub-sample at ψ = 256 and the ensemble at t = 100 trees. It reports training complexity O(tψ log ψ) and evaluation complexity O(nt log ψ). Its discussion section states the practical consequence: “For Http data set, when ψ = 256, t = 100 and evaluating 283,748 instances, the total processing time is 7.6 seconds only.” Two hundred and eighty-three thousand points scored in under eight seconds, by trees that each saw 256 rows.

scikit-learn ships exactly those numbers. Its IsolationForest reference documents 100 estimators by default and max_samples='auto', defined as “max_samples=min(256, n_samples)”. It records that the contamination default changed to 'auto' in version 0.22, with offset -0.5, and it cites both isolation papers, the 2008 conference one and the 2012 journal one. Feeding a million rows to the estimator does not give each tree a million rows. A small sample per tree is the design, not a shortcut. The examples section shows a case where enlarging it makes the detector measurably worse.

Method choice should follow the kind of departure the domain expects, and the size of that effect has been measured. ADBench, a 2022 benchmark, ran 30 algorithms across 57 datasets in 98,436 experiments. Its first finding is a negative one: “None of the unsupervised methods is statistically better than the others, as shown in the critical difference diagram of Fig. 4a”.

The ranking is not merely flat. It inverts with the shape of the anomaly. On the benchmark's synthetic clustered anomalies the AUCROC values run LOF 47.17, COF 53.00, DeepSVDD 55.97, OCSVM 95.53, IForest 96.94 and PCA 97.77. A local-density method that would win on scattered outliers scores below chance on clustered ones in the same suite. A support-based method reaches 95.53 there, and an isolation-based one 96.94. The authors state the rule the numbers imply: “Performance of unsupervised algorithms highly depends on the alignment of its assumptions and the underlying anomaly type.”

An earlier independent evaluation reached a compatible verdict about the support-based family. Goldstein and Uchida evaluated 19 unsupervised algorithms on 10 datasets, in PLOS ONE in 2016, and concluded that “One-class SVMs turned out to be not outstanding algorithms and results are average.” They also report the spread in cost that a leaderboard hides. On kdd99 their runtimes range from under 4 seconds for HBOS to more than 6 days for GMGOS-MCD.

Read the four assumptions as four hypotheses about the departure, each with a measured failure mode. Isolation asks that anomalies need fewer random partitions. A support boundary asks that normal data occupy a learnable region. Local density asks that anomalies be sparse relative to nearby peers. Reconstruction asks that anomalies reconstruct poorly under a learned normal representation. The 47.17-versus-96.94 gap in one column of one figure is what happens when the wrong hypothesis is chosen.

Disagreement can reveal the anomaly mechanism rather than identify one universal winner. Each of the following is a documented failure of an assumption rather than a hypothetical.

Use the same feature pipeline, time split, alert budget, and adjudication process. Three of the steps below have measured stakes rather than stylistic ones.

Defining the expected anomaly form comes first. On ADBench's clustered anomalies LOF scores 47.17 AUCROC and IForest 96.94, in the same experiment. The choice made before any tuning is larger than most of the tuning that follows. Preparing the reference means documenting contamination, legitimate diversity, missingness and time coverage. The SyRI judgment is the record of what an undocumented reference population costs.

Tuning structural parameters means treating the sub-sample as a real parameter and not a default. The Isolation Forest paper's own Mulcross result moved AUC from 0.67 to 0.91 by cutting ψ from the full 4,096-instance sample to 128, and scikit-learn's max_samples='auto' will not do that for you. On the one-class side, nu is not a tolerance knob but a budget with a proven meaning, and its default of 0.5 is rarely the budget anyone intended. Scaling is a prerequisite rather than a step: the LIBSVM guide's instruction — each attribute linearly scaled to the range [−1, +1] or [0, 1] — decides which column the boundary can see.

Then compare score rankings under one alert capacity: precision at capacity, event coverage, subgroup yield and score stability. Finally, monitor unknowns — drift, new regimes, reviewer overturns and reference refresh decisions. ADBench's six-fold duplication experiment cost unsupervised methods −16.43% median ΔAUCROC while semi-supervised methods lost −0.05%. The presence or absence of labels changes what monitoring has to catch.

Isolation Forest asks how quickly random axis-parallel partitions separate a point. One-Class SVM asks whether it lies inside a learned support region. Neither score is a calibrated risk probability by default. Their operational value depends on the anomaly mechanism, reference coverage, threshold, and review process.

One-class methods turn the same question into a budget, and the budget has a proof behind it. The 1999 paper that introduced the one-class support vector method states, in its Proposition 1, that ν “is an upper bound on the fraction of outliers” and “is a lower bound on the fraction of SVs”. scikit-learn's OneClassSVM reference documents the same property in its own words: nu is “An upper bound on the fraction of training errors and a lower bound of the fraction of support vectors. Should be in the interval (0, 1]. By default 0.5 will be taken.”

Choosing nu therefore decides in advance how much of the reference sample counts as abnormal. It is an alert budget written into the fit, not a sensitivity dial discovered afterwards. Isolation Forest's equivalent decision is contamination, which scikit-learn moved to 'auto' in version 0.22 with an offset of -0.5. In both cases a default that nobody chose is still a choice. And the ADBench verdict stands over the whole family: “Performance of unsupervised algorithms highly depends on the alignment of its assumptions and the underlying anomaly type.”