𝗜𝘀𝗼𝗹𝗮𝘁𝗶𝗼𝗻 𝗙𝗼𝗿𝗲𝘀𝘁: 𝗔𝗻𝗼𝗺𝗮𝗹𝘆 𝗗𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻 𝗕𝘆 𝗔𝘀𝗸𝗶𝗻𝗴, “𝗛𝗼𝘄 𝗘𝗮𝘀𝘆 𝗜𝘀 𝗧𝗵𝗶𝘀 𝗣𝗼𝗶𝗻𝘁 𝗧𝗼 𝗜𝘀𝗼𝗹𝗮𝘁𝗲?”

Many anomaly detection algorithms try to model what normal data looks like and identify deviations.

Isolation Forest takes a different approach: instead of explicitly modeling normality, it measures how easily a data point can be isolated from the rest of the dataset.

The key intuition is simple:

Anomalies are easier to isolate. Normal points are harder to isolate.

🔹 𝗛𝗼𝘄 𝗜𝘀𝗼𝗹𝗮𝘁𝗶𝗼𝗻 𝗙𝗼𝗿𝗲𝘀𝘁 𝗪𝗼𝗿𝗸𝘀

𝟭. 𝗥𝗮𝗻𝗱𝗼𝗺 𝗦𝗽𝗹𝗶𝘁𝘁𝗶𝗻𝗴

Each tree is built using a small, randomly selected subset of the data. It then repeatedly:

• Randomly selects a feature.
• Randomly selects a split value between that feature’s minimum and maximum within the current node.

Unlike traditional decision trees, these splits are not optimized using criteria such as Gini impurity or entropy. They are purely random.

𝟮. 𝗪𝗵𝗲𝗻 𝗗𝗼𝗲𝘀 𝗦𝗽𝗹𝗶𝘁𝘁𝗶𝗻𝗴 𝗦𝘁𝗼𝗽?

A branch stops growing when:

• The node contains a single data point.
• The points in the node have identical feature values.
• The maximum tree depth is reached.

𝟯. 𝗣𝗮𝘁𝗵 𝗟𝗲𝗻𝗴𝘁𝗵: 𝗧𝗵𝗲 𝗞𝗲𝘆 𝗦𝗶𝗴𝗻𝗮𝗹

Path length is the number of splits required to isolate a data point.

• Anomalies tend to exist in sparse regions, so they are often isolated quickly, resulting in shorter paths.
• Normal points tend to belong to dense regions, requiring more splits to separate them from neighboring points.

𝟰. 𝗔𝘃𝗲𝗿𝗮𝗴𝗶𝗻𝗴 𝗔𝗰𝗿𝗼𝘀𝘀 𝗧𝗵𝗲 𝗙𝗼𝗿𝗲𝘀𝘁

A single tree can produce noisy results depending on its random splits.

Isolation Forest therefore builds many randomized trees and calculates the average path length for each data point.

This average is then converted into an anomaly score:

• Shorter average path → higher anomaly likelihood
• Longer average path → lower anomaly likelihood

💡 𝗪𝗵𝘆 𝗜𝘀𝗼𝗹𝗮𝘁𝗶𝗼𝗻 𝗙𝗼𝗿𝗲𝘀𝘁 𝗜𝘀 𝗨𝘀𝗲𝗳𝘂𝗹

• It does not require labeled anomalies.
• Random subsampling can help reduce the effects of masking and swamping.
• Trees can be built independently, making the method highly parallelizable.
• It does not require a specific probability distribution for normal data.
• It can efficiently identify unusual observations in high-dimensional datasets.

🔍 𝗦𝗛𝗔𝗣: 𝗘𝘅𝗽𝗹𝗮𝗶𝗻𝗶𝗻𝗴 𝗠𝗼𝗱𝗲𝗹 𝗣𝗿𝗲𝗱𝗶𝗰𝘁𝗶𝗼𝗻𝘀

After detecting an anomaly, the next question is:

“Why did the model flag this particular data point?”

That is where SHAP — SHapley Additive exPlanations — can help.

Get Affan Ahmed’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

SHAP is based on Shapley values from cooperative game theory, where a total payout is distributed among players according to their contributions.

In machine learning:

• The players are the features.
• The payout is the model’s output.
• The SHAP values represent each feature’s contribution to that output.

🔹 𝗛𝗼𝘄 𝗦𝗛𝗔𝗣 𝗪𝗼𝗿𝗸𝘀

Conceptually, SHAP evaluates how a feature changes a model’s output when added to different combinations of other features.

It considers possible feature subsets, measures the feature’s marginal contribution, and averages those contributions using Shapley-value weighting.

The result is a SHAP value for each feature and each prediction.

🔹 𝗞𝗲𝘆 𝗣𝗿𝗼𝗽𝗲𝗿𝘁𝗶𝗲𝘀

• Additive: The baseline output plus the SHAP values sum to the model’s output, within the chosen SHAP explanation framework.
• Local: SHAP explains individual predictions, so different observations can have different feature contributions.
• Global insights: Aggregating the absolute SHAP values across observations can provide an overview of feature importance.

💡 𝗪𝗵𝘆 𝗧𝗵𝗶𝘀 𝗠𝗮𝘁𝘁𝗲𝗿𝘀

For models such as XGBoost, Random Forest, or Isolation Forest, SHAP can help identify which features influenced a particular output.

For many tree-based models, optimized approaches such as TreeSHAP can make explanations considerably faster.

However, the computational cost and available explanation methods depend on the specific model and SHAP implementation.

For example:

“This observation received a high anomaly score partly because of unusual values in features X and Y.”

Remember: SHAP explains the model’s behavior, not necessarily the real-world cause of an anomaly.

🚀 𝗧𝗵𝗲 𝗕𝗶𝗴 𝗣𝗶𝗰𝘁𝘂𝗿𝗲

Isolation Forest helps identify unusual data points.

SHAP helps explain which features influenced the model’s output.

Together, they provide a useful workflow:

Detect the anomaly → Investigate the contributing features → Understand the model’s reasoning.