Unsupervised learning
Structure Discovery Without Answer Keys
Learn how unsupervised methods propose structure, why several answers can be defensible, and what evidence makes a result useful.
By the end you can
- Define unsupervised structure discovery without implying that the data contains one canonical partition
- Distinguish algorithmic output, statistical pattern, and domain interpretation
- Identify the assumptions that shape clusters, embeddings, and anomaly scores
- Design a validation question before choosing an unsupervised method
Thirty rules for counting clusters, and no agreement among them
Ask how many groups are in a data set and the field hands you a shelf of answers. Thirty of them, in 1985. Milligan and Cooper ran a Monte Carlo evaluation of 30 procedures for determining the number of clusters, on artificial data sets built to contain either 2, 3, 4 or 5 distinct non-overlapping clusters. The true answer was known by construction. That is the easiest possible test. Their finding, in Psychometrika: “The simulation results for the stopping rules revealed a wide range in their ability to determine the correct number of clusters in the data.” They added a caution that has aged well, that “users are cautioned that the performance of some of the criteria may be data dependent”.
Thirty years later the question had not converged. NbClust, an R package released in 2014, opened by observing that “a wide variety of indices have been proposed to find the optimal number of clusters”, and it shipped accordingly: the package “provides 30 indices which determine the number of clusters in a data set”. Thirty procedures in 1985, thirty indices in 2014. An analyst still has to pick one and defend the pick.
That is the subject of this lesson. A clustering result depends on a feature definition, a scale, a distance, an algorithm and a stopping rule. No target label arrives afterwards to settle the argument. Unsupervised learning makes those choices visible precisely because nothing external adjudicates them.
An unsupervised result is a model-dependent proposal about structure.
Case
Three reasonable properties, no function that has all three — and the way out
Three properties look like the least anyone could ask of a clustering function: scale-invariance, richness and consistency. Kleinberg named them in 2002 and proved they cannot be had together. His theorem is blunt: “there is no clustering function satisfying all three”. It holds for every point set of size two or more.
The result is escapable, and the escape is on the record. In 2008 Ben-David and Ackerman axiomatised clustering-quality measures — how good a given partition is — rather than the clustering function itself, and replaced consistency with the weaker monotonicity. Van Laarhoven and Marchiori describe the move: “Ackerman and Ben-David (2008) continued on this work, and showed that the impossibility result does not apply when formulating these properties in terms of quality functions instead of clustering functions, where consistency is replaced with a weaker property called monotonicity.” The impossibility is a fact about what was being axiomatised. It is not a verdict on the activity.
Visual
Four layers between raw records and a claimed pattern
Four layers stand between the raw records and whatever an analyst finally says the data means. Each of them is a decision, and any of them can alter the result.
Every named result in this lesson sits at one of these layers. The 30 stopping rules and the quality measures that answered Kleinberg are arguments about the structure rule. The distortion measured in two-dimensional embeddings of single-cell data is introduced at the representation layer. The sepsis phenotypes below are what happens at the fourth layer, when a grouping acquires a name.
- 01
Observed records
Rows, events, documents, images, or sequences enter with measurement errors and sampling choices.
- 02
Representation
Features, embeddings, transformations, and missing-value rules determine what differences are visible.
- 03
Structure rule
Distance, density, connectivity, reconstruction, or variance defines what the method rewards.
- 04
Domain meaning
Humans decide whether the proposed groups or directions correspond to a useful operational distinction.
Every unsupervised claim inherits assumptions from all four layers.
Comparison
Three very different outputs often called “patterns”
Clustering, dimensionality reduction, and anomaly detection answer different questions even when they run on the same feature matrix. Two of the three have a published record of what their output cannot be asked to carry.
Compression to two dimensions is lossy, and the loss has been measured rather than merely suspected. Chari and Pachter said so in their 2023 abstract: “we show that extreme dimension reduction, from hundreds or thousands of dimensions to 2, inevitably induces significant distortion of high-dimensional datasets”. Their results put a number on it: the “correlation of cell type neighbor rankings to that of the ambient space were low (≤0.4) in PCA-preprocessed 2D embeddings, and at least 33% lower than those of the higher dimensional PCA spaces”. The rebuttal is the instructive part. A reply in the same journal the next year defended the pictures while conceding the distance claim outright: “while t-SNE and UMAP embeddings of single-cell data do not preserve high-dimensional distances, they can nevertheless provide biologically relevant information”. Both sides agree the picture does not preserve distances. They disagree about what the picture is still good for. That is this lesson’s own argument, running live in the literature.
An anomaly score, meanwhile, is worth only the review capacity behind it. The 2013 Target breach affected as many as 110 million customers. The Senate Commerce Committee’s majority staff report found that Target’s FireEye intrusion-detection system triggered urgent alerts on each installation of the data-exfiltration malware, and that “Target's security team neither reacted to the alarms nor allowed the FireEye software to automatically delete the malware in question”. On the generic “malware.binary” alert the staff wrote: “It is possible that Target staff could have viewed this alert as a false positive if the system was frequently alarming.” The detector fired. The ranking was correct. Nothing downstream of it happened. That is the failure mode a threshold argument is actually about.
Clusters
A partition or soft grouping of observations.
- Asks which observations belong together
- Depends on a grouping objective
- May force every point into a group
- Needs interpretation beyond cluster IDs
Low-dimensional coordinates
A compressed representation for analysis or downstream modeling.
- Asks which directions or neighborhoods to preserve
- Can distort distances during compression
- Does not automatically define groups
- May be useful without being visually dramatic
Anomaly scores
A ranking of observations by unusualness under a reference model.
- Asks what looks atypical relative to a population
- Requires a definition of normal context
- Rare does not necessarily mean harmful
- Thresholds depend on review capacity and cost
Example
What useful unsupervised work looks like
The strongest projects connect a structural hypothesis to a concrete decision or investigation, and say in advance what would count as the hypothesis failing.
- Product research: Group support tickets to reveal recurring issue families, then verify each family with sampled messages and support specialists rather than with the grouping’s own internal score.
- Manufacturing: Map sensor windows into operating regimes, then test whether those regimes predict maintenance workload or known process transitions.
- Biology: Compress gene-expression profiles for exploration while holding both published limits in view — the neighbour-ranking loss Chari and Pachter measured in two-dimensional embeddings, and the finding that a consensus procedure can look stable on data containing no clusters at all.
- Security: Rank unusual login sessions for investigation and measure analyst yield, because the Senate staff report on Target describes a detector that fired correctly into a queue where nobody acted on it.
- Catalog organization: Discover item neighborhoods for browsing, then compare them with search behavior and merchant taxonomy rather than naming them automatically.
Analogy
A cartographer drawing several legitimate maps
One region mapped for drivers, hikers, flood planners, and historians yields four different maps. Each emphasizes different relationships, although the landscape has not changed.
Unsupervised methods behave similarly, because their objective determines which structure becomes prominent. A cartographer’s landscape at least holds still. Measurements and sampling can change the terrain itself. The exchange between Chari and Pachter and their rebutters is a version of this argument conducted in print. Nobody in it disputes that the two-dimensional map distorts the terrain. The whole disagreement is over which journeys it remains good enough for.
Ask which map serves the job instead of demanding one map for every purpose.
Key idea
Four sepsis phenotypes, and what happened when the method was re-run
Four sepsis phenotypes came out of a consensus k-means clustering of 29 variables in 20,189 patients, and they were labelled α, β, γ and δ. Seymour and colleagues published them in JAMA in 2019. The α phenotype accounted for 33% of patients, β for 27%, γ for 27% and δ for 13%, and cumulative 28-day mortality across them ran 5%, 13%, 24% and 40%. The paper’s Key Points summarised the work this way: “In this retrospective analysis using data from 63 858 patients in 3 observational cohorts, 4 novel sepsis phenotypes (α, β, γ, and δ) with different demographics, laboratory values, and patterns of organ dysfunction were derived, validated, and shown to correlate with biomarkers and mortality”. Greek letters attached to a fourfold mortality gradient are a powerful invitation to start describing a patient as being a δ.
Six years later the method was re-run across four cohorts: the NICE registry (n = 28,621), MIMIC-IV (n = 18,661), MARS (n = 2,499) and MARS2 (n = 2,445). The study was led by a different group at Amsterdam UMC, though two of the original authors co-authored it. Van Amstel and colleagues reported in Critical Care in 2025 that “subtypes were not one-on-one reproduced using method-based validation in an ICU setting”, and that “frequency and outcome distributions varied significantly across cohorts”.
Keep the claim narrower than the label invites. Describe the observed profile, the uncertainty, the cohort it was derived in, and the procedure that produced it. If a clinical or business action follows, test the action rather than assuming the name explains the case.
A convenient label should not become an invented essence.
Steps
Frame the investigation before opening a clustering library
Use this sequence to turn a vague desire for “insights” into a testable unsupervised project. Step four is the one that gets skipped, and it is the one with a published cautionary tale behind it.
Stability is the reflex answer to how anyone knows the clusters are real, and stability can be manufactured by the procedure itself. Consensus clustering was run against data with nothing in it and produced groups anyway. Şenbabaoğlu and colleagues reported that in Scientific Reports in 2014: “Through simulations we find that CC is able to divide randomly generated unimodal data into apparently stable clusters for a range of K, essentially reporting chance partitions of cluster-less data.” The same paper found that “For data with known structure, the common implementations of CC perform poorly in identifying the true K”, and introduced the proportion of ambiguously clustered pairs, PAC, as a corrective measure.
The mechanism is now standard knowledge in the field’s tooling. M3C, a consensus-clustering package for Bioconductor, states it plainly in its vignette: the PAC score “has bias towards greater values of K. This is due to a general problem with this type of consensus clustering algorithm that occurs because as K increases the consensus matrix converges towards a matrix of perfect stability simply by chance.” That is why the fourth step reads predefine evidence rather than check stability. A stability number read off a run, with no null to compare it against, is exactly the number that randomly generated unimodal data also produces.
1. Name the decision
Specify what someone will inspect, prioritize, design, or monitor after seeing the output.
2. Choose the unit
Define whether one observation is a customer, session, device, document, location, or time window.
3. State the preserved relation
Write whether proximity, density, variance, connectivity, or reconstruction should carry meaning.
4. Predefine evidence
Select stability checks, expert review, downstream tests, or operational yield before tuning the method.
5. Record alternatives
List simpler summaries, supervised targets, or rule-based workflows that could solve the actual problem.
A disciplined result is narrower and more valuable
The goal is not to announce that the algorithm found hidden truth. The goal is a defensible representation, grouping, or ranking that helps a stated task — a narrower claim than “we discovered four segments”, and a far more useful one. Each result in this lesson is narrow in that way. The 30 procedures disagreed on synthetic data with a known answer, so the number of clusters is a choice you make and defend. Chari and Pachter measured how much a two-dimensional embedding loses, so a picture is evidence about neighbourhoods only up to a stated limit. The α to δ phenotypes were not reproduced one-to-one in other cohorts, so a label records a procedure and a population rather than a kind of patient. That stance makes later lessons easier. Every algorithm can be judged by the relation it preserves, the assumptions it imposes, and the evidence supporting its use.
Structure discovery becomes trustworthy when its purpose and limits are explicit.
Case
The argument that clustering has no application-independent answer
What is clustering actually for? Von Luxburg and colleagues put that question at the centre of a 2012 paper called Clustering: Science or Art? Clustering, they argue, “should not be treated as an application-independent mathematical problem, but should always be studied in the context of its end-use”. The obstacle they name is the habit of evaluating an algorithm “without taking into account the context: why does the user cluster his data in the first place, and what does he want to do with the clustering afterwards?”
Position
Which clustering is correct is not a question mathematics has answered
Kleinberg’s result is usually delivered as bad news, and read as a reason to distrust the whole activity. It is more useful than that. He named three properties any reasonable clustering function might be expected to have — scale-invariance, richness and consistency — and proved that there is no clustering function satisfying all three, for every point set of size two or more. Those were not exotic requirements. They were the kind of thing one might reasonably ask for. They are not jointly available.
What follows is narrower than distrust. The three properties cannot be held at once, so they cannot certify any one function as the right one, and a disagreement between two results has no tiebreaker waiting in those axioms. Milligan and Cooper’s stopping rules are the ordinary working form of the same situation: 30 published procedures, a wide range in their ability to recover a number that was true by construction, and 30 indices still shipping in NbClust thirty years later. No diagnostic in that list is going to arbitrate between two defensible partitions. Arbitration is not what any of them does.
The impossibility is also a statement about a formalism rather than about clustering, and its authors of record say so. “We argue that an impossibility result is not an inherent feature of clustering, but rather, to a large extent, it is an artifact of the specific formalism used in Kleinberg”, wrote Ben-David and Ackerman in 2008. Their constructive claim followed: “We show that principles like those formulated in Kleinberg's axioms can be readily expressed in the latter framework without leading to inconsistency”. Axiomatise the quality of a given partition instead of the partitioning function, replace consistency with monotonicity, and the three principles coexist. They exhibit several natural quality measures satisfying all the axioms, and show those measures can be computed in polynomial time. What changed was not the mathematics of clustering. It was the object being axiomatised.
Which is why the end-use question is the operative one. Clustering, von Luxburg and colleagues argue, “should always be studied in the context of its end-use”. Read that as a work instruction rather than a philosophical stance. Name the decision the output has to support before opening the library. On their argument the criterion comes from that end-use, and no diagnostic further down will invent one for you. “The algorithm found four segments” is not yet a finding.
Which of two defensible clusterings is right is a question about the end-use.
Key takeaways
- Unsupervised outputs are proposals shaped by data, representation, objective, and interpretation: Milligan and Cooper found a wide range among 30 procedures for choosing the number of clusters, and NbClust still shipped 30 indices in 2014.
- Clusters, compressed coordinates, and anomaly scores solve distinct problems despite sharing inputs, and the Target staff report shows what a correct ranking is worth with no review capacity behind it.
- A validation question should exist before algorithm selection, because consensus clustering divided randomly generated unimodal data into apparently stable clusters across a range of K.
- Visual separation is weak evidence: Chari and Pachter measured cell-type neighbour-ranking correlations of ≤0.4 in PCA-preprocessed 2D embeddings, at least 33% below the higher-dimensional PCA spaces.
- Cluster names describe observed profiles, and the α to δ sepsis phenotypes were not one-on-one reproduced when the method was re-run across the NICE, MIMIC-IV, MARS and MARS2 cohorts.
- The best unsupervised project connects a bounded structural claim to a real decision; Ben-David and Ackerman showed Kleinberg's impossibility is an artifact of a formalism, not a verdict on clustering.