Local Outlier Factor and Neighborhood Anomalies

Local Outlier Factor compares the effective density around a point with the densities around its neighbors, in five steps. Select a k-neighborhood under the chosen feature geometry. Limit very small pairwise distances using each neighbor's k-distance, giving reachability distances. Invert the average reachability distance from the point to its neighbors to estimate a local density. Average the ratio of neighbor density to the point's own density. Rank observations by that ratio.

The last step rests on a proof, not a convention. Take an object p whose MinPts-nearest neighbours, and their MinPts-nearest neighbours, all lie inside a cluster C. Its score is then trapped between two computable bounds: 1/(1+ε) ≤ LOF(p) ≤ (1+ε), with ε = (reach-dist-max/reach-dist-min − 1). That is Lemma 1 of the paper that introduced the score, published in 2000. Breunig and his three co-authors state the consequence plainly: “Lemma 1 above shows a basic property of LOF, namely that for objects deep inside a cluster, their LOFs are close to 1, and should not be labeled as a local outlier.”

That bound is why scikit-learn can tell a user, in the docstring of its LocalOutlierFactor class, that “Inliers tend to have a LOF score close to 1”. A value near one is not a soft verdict of innocence. It is the arithmetic of a density ratio whose numerator and denominator are drawn from the same region. The width of the band around one is ε, a property of the data rather than of the analyst.

Six goals in 15 games is a forgettable season. That was Michael Schjönberg's in the German Bundesliga in 1998/99, and measured against the league it is nothing: the season's top scorer, Michael Preetz, finished on 23 goals, ahead of Ulf Kirsten on 19. Yet when the four authors of the LOF paper ran their new score over the 375 players of that season, sweeping MinPts from 30 to 50, Schjönberg came out as the second strongest outlier in the data, at LOF 1.70. The paper says why in one sentence: “The second strongest outlier is Michael Schjönberg. He played an average number of games, but he was an outlier because most other defense players had a much lower average number of goals scored per game.”

Above him at LOF 1.87 sat Preetz: 34 games, 23 goals, offence, extreme on any scale you care to apply. Below him at LOF 1.67 sat the goalkeeper Hans-Jörg Butt, 34 games and 7 goals. That is an enormous number for a goalkeeper and a modest one for anybody else. A global threshold on goals scored returns Preetz and stops. The local density ratio returns all three. Two of the three exist only because each player was scored against the density of players in his own position.

Local outlier methods compare each point with the density of nearby points. Their strength is exactly this context. Their weakness is that the context is a modelling choice. The peer group has to be trustworthy before the ranking means anything.

Local methods need example-level review across density and boundary conditions. Three of the five signatures below are documented in the method's own founding paper or in the published benchmarks, with the numbers attached.

The neighborhood scale should be selected through operational and geometric evidence, not inherited from a library default.

1. Validate feature geometry. Review scaling, high-dimensional behavior and nearest-neighbor examples. The peers a point is scored against are produced by the metric. Change the scaling and the point gets a different set of neighbors to be unusual against.

2. Sweep k. There is a published range to sweep around rather than a single correct value. The original paper recommends a MinPtsLB of at least 10 to remove statistical fluctuations, and for the general case writes: “For most of the datasets we experimented with, picking 10 to 20 appears to work well in general.” scikit-learn hard-codes the top of that range as n_neighbors=20 and repeats the reasoning in its user guide: “In practice, such information is generally not available, and taking n_neighbors=20 appears to work well in general.” Compare score rankings across neighborhoods smaller and larger than the local groups you expect, and record how the ranking moves.

3. Inspect regimes. Review dense, sparse, boundary, rare-group and duplicated regions separately. Each of the failure signatures above lives in a different region, and an aggregate metric averages them away.

4. Compare baselines. Test global distance, peer-group rules and isolation methods on the same alert budget, and expect no outright winner. ADBench, a 2022 benchmark, ran 30 algorithms across 57 datasets in 98,436 experiments. Its critical-difference analysis reported that “None of the unsupervised methods is statistically better than the others”. Selection therefore has to be made on the anomaly type you actually face, not on a leaderboard.

5. Validate future scoring. Use later observations and delayed adjudication when novelty detection is intended, with the novelty flag set deliberately and the reference period written down.

A heterogeneous dataset can contain several normal density regimes. The choice between a global and a local reference is measurable on the same data, not a matter of taste.

The measurement is blunt. On pen-local, LOF reaches an AUC of 0.9877 ± 0.0016. On pen-global — the same pen-based data preprocessed to carry global anomalies instead of local ones — it falls to 0.8495 ± 0.0679. On kdd99 it reaches 0.5964 ± 0.0284, a dataset where a global k-NN score reaches 0.9747. Goldstein and Uchida published all three in 2016. The algorithm did not change between those numbers. Only the kind of anomaly did.

A global distance score measures distance from a center or broad reference. It finds globally extreme points, can miss anomalies inside subpopulations, is simple to explain, and assumes one broad normal scale. Local Outlier Factor compares density with nearby points. It adapts to local regimes, depends on neighborhood quality, can flag boundary points, and needs k sensitivity checks. A peer-group baseline defines neighborhoods through known entity or context groups — defenders scored against defenders rather than against the league. It uses domain structure, can reduce confounding, requires reliable peer assignment, and may miss cross-group novelty.

ADBench reached the same conclusion across 57 datasets: “Again, there is no algorithm performing well on all types of anomalies; LOF achieves the best AUCROC on local anomalies (Fig. 5a) and the second best AUCROC rank on dependency anomalies (Fig. 5c), but performs poorly on clustered anomalies (Fig. 5d).” Two independent benchmarks, six years apart, put the decision in the same place. Name the anomaly type first, then pick the detector.

LOF can identify subtle anomalies in populations with several normal density regimes. It does so by trusting the local graph around each point. When those neighborhoods are unstable, contaminated or semantically wrong — duplicated records, a cluster smaller than MinPts, 400 dimensions — the score inherits the problem, and it inherits it silently. Report neighborhood sensitivity with every operational threshold, alongside the k you swept and the reference period you used.

The comparison behind the word “local” was run in PLOS ONE in 2016, over “19 different unsupervised anomaly detection algorithms … on 10 different datasets from multiple application domains”. Goldstein and Uchida's working definition is the useful part. A point is a local anomaly when it is “only anomalous when compared with its close-by neighborhood”. Whether that kind of anomaly matters, they add, “depends on the application”.

That last clause is the whole operational question. Schjönberg is anomalous only among defenders. Preetz, at LOF 1.87 and 23 league goals, is anomalous in either frame. A system that can only see the second is cheaper to explain and blind to half the problem. A system that sees the first has taken on the obligation to justify its neighborhoods.