Isolation forest

Overview

Isolation forest is an unsupervised algorithm for finding anomalies in data. Its core idea is simple. Anomalies are few and different, so they are easy to separate from the rest. If you cut the data with random splits, an odd point ends up alone after only a few cuts, while a normal point buried in a crowd needs many cuts. The average number of cuts needed to isolate a point becomes its anomaly score.

This approach is fast, needs no labels, scales to large tables, and works with mixed numeric features after simple preparation. It does not measure distance or density, which makes it cheap in high volume settings. It is a common first detector for fraud, sensor faults, data quality checks, and security logs. It also serves as a helper signal inside larger systems, including models that learn from raw tables, as described in Unsupervised learning and in the sections on tabular foundation models below.

What it is

An isolation forest is an ensemble of random binary trees called isolation trees. Each tree is built on a small random sample of the data. At every node the tree picks a random feature and a random split value between the minimum and maximum of that feature in the node. It keeps splitting until each point sits alone in a leaf or a depth limit is reached.

What it outputs

• A score between 0 and 1 for each row.
• Scores near 1 mean the row is very likely an anomaly.
• Scores well below 0.5 mean the row is clearly normal.
• Scores near 0.5 across the board mean the data has no clear anomalies.

What kind of problem it solves

• Outlier detection. Find odd rows in a data set that may contain them.
• Novelty detection. Train on clean data, then score new rows.
• Data quality screening. Flag rows that look broken before a model sees them.
• Feature for downstream models. Use the score as an extra column.

What it is not

• It is not a classifier. It does not know what kind of anomaly it found.
• It is not a probability. The score is a ranking tool, not a chance of being wrong.
• It is not an explanation. You need other tools such as SHAP to say why a row scored high.

Where it came from

Before isolation forest, most anomaly detectors built a profile of normal data and flagged points that did not fit. Examples include distance-based methods, density-based methods, and clustering-based methods. They work, but they are costly. Distance methods need comparisons between many pairs of points. Density methods are sensitive to the choice of neighborhood size. Both slow down on large or high-dimensional data.

The 2008 paper

The idea of isolating anomalies directly was published in 2008 in a paper titled "Isolation Forest" at an international data mining conference. A longer journal version followed in 2012 under the name "Isolation-based anomaly detection". The authors argued that instead of describing normal behavior, one should measure how easily each point can be separated. They showed linear time cost and low memory use, which was unusual for the field.

Extensions

• Extended isolation forest. Published in the late 2010s, it replaces axis-parallel cuts with cuts along random slanted hyperplanes. This removes a visual artifact where scores form stripes along the axes and fixes some blind spots.
• Robust random cut forest. A related streaming approach that supports insertion and deletion of points.
• Deep isolation methods. Map data through a random or learned neural embedding before isolating.
• Generalized and functional variants. Handle categorical features, time series, and other structures.

Why it became standard

• It appeared in major open source machine learning libraries.
• It handled large tables where older detectors failed.
• It needs few parameters and has sensible defaults.
• It fits easily into pipelines for tabular data, where supervised learning labels for anomalies are rare.

How it works

The party analogy

Picture a crowded party. You want to find the odd guest. You ask random yes or no questions that split the room: "Is your age above 37?" "Is your height below 170?" Each question sends people to one side of the room. You keep splitting a side until a person stands alone.

A guest who is far away from everyone, such as a child at an adult party, is alone after one or two questions. A guest in the middle of the crowd, who looks like many others, needs many questions. The number of questions it takes to isolate a person is the path length. Short path means odd guest.

The trick is that one tree gives a noisy answer. A different set of random questions would give a different path length. So we ask many sets of questions, one per tree, and average the path lengths.

Step by step for training

1. Choose the number of trees. A common default is 100.
2. For each tree, draw a small random subsample of rows, without replacement. A common size is 256.
3. Set a maximum tree depth of about log base 2 of the subsample size. We only need short paths, because anomalies are isolated early.
4. Build the tree recursively. At each node, pick a random feature that is not constant in the node. Pick a random split value uniformly between that feature's minimum and maximum in the node. Send rows below the value to the left child and others to the right.
5. Stop when a node has one row, all rows are identical, or the depth limit is reached.

Step by step for scoring

1. For a row, walk it down every tree until it reaches a leaf. Count the number of edges as the path length.
2. If the leaf holds more than one row because of the depth limit, add an adjustment equal to the expected path length of an unsuccessful search in a binary search tree for that many points. This estimates how much deeper the tree would have gone.
3. Average the path lengths over all trees.
4. Convert to a score with the formula below.

The score formula

Let E(h) be the average path length of a row. Let c(n) be the average path length of an unsuccessful search in a binary search tree built on n points. It is about 2 times (ln(n-1) plus 0.5772) minus 2(n-1)/n, where 0.5772 is Euler's constant.

The score is: s = 2 raised to the power of minus E(h) divided by c(n).

Reading it:

• If E(h) is much smaller than c(n), the exponent is near zero from below and s approaches 1. Anomaly.
• If E(h) is about equal to c(n), s is about 0.5. Ordinary.
• If E(h) is much larger than c(n), s drops toward 0. Very normal.

Why subsampling helps

It may seem odd to use only 256 rows per tree. But small samples help in two ways.

• Swamping reduction. Normal points close to anomalies are less likely to be mistaken for anomalies when the sample is small, because fewer neighbors crowd in.
• Masking reduction. A cluster of anomalies is less likely to hide itself, because a small sample contains fewer copies of them.

Subsampling also makes training cost nearly independent of data size. Doubling the table does not double the work.

Why random splits work

A random split is cheap, and averaging many random splits approximates a smooth notion of how "far out" a point is. Points near the edge of the data cloud lose company with every cut. Points in the middle keep company for a long time.

Contamination and thresholds

The score is continuous. To turn it into a yes or no flag, you need a threshold. Common choices:

• Flag the top k percent of scores, where k is a guess of the anomaly rate. Many libraries expose this as a contamination setting.
• Flag scores above a fixed value, such as 0.6, chosen from validation.
• Use a business rule, such as "review the top 50 rows per day".

The threshold is a business decision as much as a statistical one.

Why anomalies have short paths: a closer look

Think of the data as a cloud of points in space. A random cut slices the cloud in two. The probability that a cut separates a given point from most of the others depends on how much empty space surrounds that point.

• A point in empty space has a large gap on one side. A random cut lands in that gap with high probability, so the point is cut off early.
• A point in a dense region has tiny gaps. A random cut rarely lands in them, so many cuts are needed.

This is why the method works without any notion of distance. The empty space around a point is measured implicitly by how often random cuts fall there.

Depth limits and efficiency

Anomalies sit at shallow depth. So the algorithm does not need to grow full trees. It stops at a depth of about log base 2 of the subsample size. Deep nodes would only describe the details of normal data, which is not the goal. This saves time and memory.

Where the randomness enters

There are three sources of randomness, and each one matters.

1. The subsample of rows for each tree.
2. The choice of feature at each node.
3. The choice of split value at each node.

Averaging over many trees smooths all three. If results change a lot between seeds, add trees or reduce noisy features.

How the extended version differs

The basic method cuts along one feature at a time. This leaves a pattern: the score map shows bands that follow the axes, even where the data has no such structure. The extended version picks a random direction in feature space and a random offset, then splits by which side of that slanted plane a point falls on. The resulting score map is smooth and follows the true shape of the data more closely. The price is a small increase in compute and a parameter for the number of features used per cut.

What the score does not tell you

• Two rows with the same score may be unusual for different reasons.
• A high score does not say whether the row is an error, a fraud, or a rare but valid case.
• A low score does not guarantee that the row is correct. A clever anomaly that sits inside the normal cloud will be missed.

Key concepts and terms

A worked example

A numeric walk-through of the score

Suppose each tree is built on n = 256 rows. First compute c(256):

• ln(255) is about 5.541.
• Add 0.5772 to get 6.118.
• Multiply by 2 to get 12.236.
• Subtract 2 times 255 divided by 256, which is about 1.992.
• So c(256) is about 10.24.

Now compare three rows:

Row A, isolated in four cuts on average, scores about 0.76. It is a strong anomaly candidate. Row C scores near 0.5 and is ordinary. The numbers show why the score is a ranking: the gap between 0.58 and 0.51 is small, and the gap between 0.76 and 0.51 is large.

A small isolation by hand

Take one feature with values 1, 2, 3, 4, 5, 6, 7, 100. Choose a random split between 1 and 100. The chance that the split falls between 7 and 100 is 93 percent. That one cut already puts 100 alone. For a value like 4 to be isolated, you need several cuts that land in the tiny gaps around it. On average the point 100 isolates in about two cuts and the point 4 in many more.

A code example

import numpy as np
import pandas as pd
from sklearn.ensemble import IsolationForest

rng = np.random.default_rng(0)

# 1000 normal rows and 20 anomalies
normal = rng.normal(loc=0.0, scale=1.0, size=(1000, 3))
odd = rng.uniform(low=-6, high=6, size=(20, 3))
X = np.vstack([normal, odd])

model = IsolationForest(
    n_estimators=200,
    max_samples=256,
    contamination="auto",
    random_state=0,
)
model.fit(X)

# Higher means more anomalous when we flip the sign
scores = -model.score_samples(X)

df = pd.DataFrame(X, columns=["f1", "f2", "f3"])
df["score"] = scores
print(df.sort_values("score", ascending=False).head(10))

The library returns a score where lower means more abnormal, so the example flips the sign to rank from most to least abnormal.

Handling a real table

Real tables mix types and contain gaps. A practical recipe:

1. Convert dates to numeric parts, such as age in days or hour of day.
2. Encode low-cardinality categories with ordinal or one-hot codes. Prefer one-hot for unordered categories.
3. Handle high-cardinality categories with frequency encoding. A rare category then becomes a small number, which isolation handles well.
4. Fill missing numbers with a median and add a missing-indicator column, because missingness itself is often a signal.
5. Do not scale for the sake of the algorithm. Splits are chosen between min and max, so scale does not matter, but heavy-tailed features can be log-transformed so that cuts are spread more usefully.
6. Fit, score, and review the top ranked rows with a domain expert.

Explaining a flagged row

A score alone is not enough. To explain it:

• Use TreeSHAP on the isolation forest, which is a tree ensemble. See SHAP.
• Or compute, for each feature, how much the score drops when that feature is replaced by its median.
• Or look at the depth at which the row was separated in each tree and which features were used at the first cuts.

Strengths and limitations

Strengths

• Speed. Training is linear in the number of trees and the subsample size. Scoring is linear in the number of rows.
• Low memory. Only small trees are stored.
• No labels needed. Works in the unsupervised setting.
• No distance computation. Avoids the cost and problems of distance in high dimensions.
• Few parameters. Defaults are good in many cases.
• Parallel. Trees are independent.
• Handles irrelevant features reasonably. Random feature choice dilutes them, though it does not remove them.

Limitations

• Axis-parallel bias. Basic splits align with feature axes, so scores can show artifacts and miss anomalies hidden in feature combinations.
• Local anomalies. An anomaly that is close to a dense region but still unusual locally may be missed. Density-based methods can be better here.
• Irrelevant features. Many noisy columns reduce quality because random splits waste effort on them.
• Categorical data. Needs encoding. Naive encoding can mislead.
• Threshold choice. The contamination setting is a guess.
• Weak explanations. The score does not say why.
• Anomaly clusters. If anomalies form a large group, they stop being rare and may look normal.
• Time dependence. The basic method treats rows as independent, so it ignores sequence structure.
• Evaluation difficulty. Real labels are scarce, so judging quality is hard.

How it compares with alternatives

How to choose

• Start with isolation forest as a fast baseline.
• Add a density method if local anomalies matter.
• Add an autoencoder or a learned model if the data has deep structure.
• Use rule-based checks for known bad patterns. Learned detectors are for unknown unknowns.
• Combine detectors by ranking and averaging their scores. Diverse detectors often beat any single one.

Role in tabular foundation models

Tabular foundation models learn from raw tables. A table is a grid with rows and columns. Columns can be numbers, categories, dates or text. Cells can be missing. Column names can be absent or unreliable. Models such as TabPFN and TabICL are pre-trained on large numbers of synthetic tables and sometimes real ones, and then use in-context learning: they take a set of example rows as context and produce predictions for new rows in a forward pass, without gradient updates. See /model/research and /model/architecture for design details.

Anomaly detection fits into this picture in several concrete ways.

As a baseline and a reference signal

When you evaluate how well a learned model finds anomalies, isolation forest is the natural baseline. It is cheap, standard, and independent of the foundation model. In benchmark suites for anomaly detection on tables, results are usually reported against it. See /model/benchmarks.

As an auxiliary feature

The isolation score is a single number per row that summarizes "how unusual is this row among its peers". Adding it as a column can help a downstream predictor. For example, a model that predicts default risk may use the anomaly score as a hint that a record is out of pattern. In an in-context learner, the extra column simply becomes another feature in the context rows.

As a context filter

In-context models are sensitive to the rows given as context. A few corrupted or mislabeled rows can hurt. Running isolation forest on the context set before prediction can drop the most extreme rows, which makes the context cleaner. This is a cheap form of data hygiene for models that cannot be retrained quickly.

As a data quality gate

Before a table reaches a foundation model, you want to know if it looks like what the model has seen. A drift check using the isolation score on new data against a reference window can show that the new table comes from a different world. When the share of high scores jumps, stop and investigate.

Row and column structure

Isolation forest treats each row as a point and each column as an axis. It ignores the row-to-row and column-to-column relationships that attention-based tabular models use, as in axial attention. That is a limitation and a feature. It is a different view of the same grid, so its mistakes differ from those of a neural model. Ensembles of both tend to be stronger.

Mixed types and missing values

A learned tabular model can embed categories and missing indicators natively. Isolation forest needs them prepared by hand, as in the recipe above. The extra care pays off: a missing-indicator column lets the forest isolate rows whose gaps are unusual, a frequent pattern in broken data feeds.

No column names

Isolation forest does not use names at all. It only sees values. This makes it a safe detector when names are missing or misleading. It also means that it does not benefit from semantic knowledge, such as "this column is a price, so negative values are impossible". A semantic layer, such as semantic sector heads, can add such constraints as rules on top of the statistical score.

Pre-training on synthetic tables

Models pre-trained on synthetic tables can be tested with synthetic anomalies. Inject known outliers into generated tables, then check that both the learned model and isolation forest rank them high. The synthetic setting gives exact ground truth, which real data lacks. Differences between the two highlight what the learned model has or has not absorbed.

Continual learning

When a model keeps learning from new data, anomalies in the stream can poison it. A streaming or periodically refit isolation forest can screen incoming batches. Rows with extreme scores can be quarantined rather than learned from. This links to practices in active learning, where a human reviews the most unusual rows and labels them.

Imputation

Anomalies and imputation interact. An extreme value can be a genuine rare case or a data entry error. If a cell is flagged, you may want to mask it and impute a value from the rest of the row, which is the idea behind masked cell modeling and imputation networks. The gap between the observed value and the imputed value is itself an anomaly score at the cell level.

Sector and semantic classification

When a classifier assigns rows to sectors or semantic classes, some rows do not belong to any known class. An isolation score on the row, or on its embedding, helps to route such rows to an "unknown" bucket rather than force a wrong label. This is a practical form of open-set handling.

Mixture-of-experts routing

In a mixture-of-experts system, a router picks experts per input. Rows that the isolation forest scores as highly unusual can be sent to a fallback expert or to human review, since specialists are trained on typical data.

Explaining the anomaly

Pair the detector with SHAP so that each flagged row comes with a ranked list of the columns that drove its score. That is what reviewers need in order to act.

Practical guidance and best practices

Choosing parameters

• Number of trees. 100 to 300 is typical. More trees reduce variance with diminishing returns.
• Subsample size. 256 works well in many cases. Larger values can help with subtle anomalies but cost more and increase masking.
• Max features. Using all features is the default. Reducing it adds more randomness and can help with many noisy columns.
• Contamination. Set it from domain knowledge. If unknown, use the automatic setting and rank rather than threshold.
• Random seed. Fix it for reproducibility, and check stability over several seeds.

Preparing data

• Remove columns that are identifiers, such as row IDs, since they carry no information about unusualness.
• Treat rare categories with frequency encoding.
• Log-transform heavy-tailed amounts.
• Add missing indicators.
• Fit on a clean reference window if you can.

Evaluating without labels

1. Inspect the top 50 ranked rows by hand with a domain expert.
2. Inject synthetic anomalies of known types and measure recall.
3. Track the score distribution over time. It should be stable when the data is stable.
4. Compare with a second detector. Rows flagged by both are strong candidates.
5. If you have a few labels, report area under the ROC curve and precision at k.

Operating in production

• Version the model together with the encoders.
• Log score distributions and review rates.
• Refit on a schedule or when drift is detected.
• Keep humans in the loop for the top ranked alerts.
• Allow feedback: confirmed anomalies and confirmed false alarms feed later tuning.

Typical use cases and what to watch for

A simple review loop

1. Score the new batch.
2. Send the top ranked rows to a reviewer with the top contributing columns.
3. Record the verdict: error, real rare case, or false alarm.
4. Use the verdicts to set the threshold and to build a small labeled set.
5. Once a labeled set exists, test a supervised model and compare it with the detector.

Scaling up

• Fit on a subsample of the table, since each tree only uses a few hundred rows anyway.
• Score in batches and in parallel.
• Use extended isolation forest if you see striped artifacts or miss slanted anomalies.

Combining isolation forest with other detectors

A single detector has blind spots. A small committee is more robust.

• Convert each detector's scores to ranks, so that scales do not matter.
• Average the ranks, or take the maximum if you want to catch anything that one detector finds odd.
• Check the overlap. Rows flagged by all detectors are high-confidence cases.
• Review rows flagged by only one detector as a sample, to learn what each detector sees that the others miss.

Good partners for isolation forest include a density-based detector for local anomalies, a reconstruction-based detector for deep structure, and simple rules for known bad patterns.

Monitoring the detector itself

A detector is a model, and models drift.

• Track the share of rows above the threshold per day. A sudden rise suggests data drift or a broken upstream feed.
• Track the mean score. A slow rise suggests that the population is moving away from the reference data.
• Track the review outcomes. If the share of false alarms climbs, tune or refit.
• Keep a fixed set of synthetic test anomalies and score them after every refit. Their ranks should stay high.

When not to use it

• When the anomalies you care about are many and common. They are then not rare, and the core assumption fails.
• When you have plenty of labeled anomalies. A supervised model will beat an unsupervised one.
• When the signal lives in order or time. Use a sequence model or build window features.
• When you must explain every decision in plain rules. Use rule systems or interpretable models.

Common mistakes

• Treating the score as a probability. It is a ranking value only.
• Leaving identifiers in the table. Unique IDs make every row look odd or none, depending on encoding.
• Using a fixed threshold across data sets. Score distributions change with the data.
• Training on contaminated data and expecting novelty detection. If anomalies are in the training set, the forest learns them as normal when they are frequent.
• Ignoring categorical encoding. Ordinal codes on unordered categories create fake structure.
• Using far too many irrelevant features. Select or group features first.
• Not checking stability. Different seeds can reorder the middle of the ranking.
• Assuming a flagged row is an error. Anomalies are often the most valuable true cases.
• Skipping explanations. Reviewers need reasons to act.
• Evaluating on the same synthetic anomalies used to tune. This inflates results.
• Forgetting time. For sequences, build window features first, otherwise the detector sees each row alone.

Frequently asked questions

How does isolation forest find anomalies?

It builds many random trees that split the data at random feature values until each row is alone. Rows that are far from the others get isolated after very few splits, while rows in dense regions need many. The average depth at which a row is isolated is turned into a score, and short depth means a high anomaly score.

Does isolation forest need labeled data?

No. It is unsupervised, so it works from the structure of the data alone. If you have a few labels, use them to choose a threshold and to evaluate the ranking, but the model itself does not train on them.

What is the contamination parameter?

It is your estimate of the fraction of rows that are anomalies. It is used to set the cutoff on the score so that roughly that share is flagged. It does not change the ranking of the rows. If you do not know the rate, rank the rows and review from the top.

Why does isolation forest use small subsamples?

Small subsamples make anomalies easier to isolate and reduce two problems called swamping and masking. They also make training fast and nearly independent of the size of the table. Averaging many trees built on different small samples gives a stable score.

Can isolation forest handle categorical features?

Not directly. You must encode categories as numbers first. One-hot encoding suits unordered categories with few levels, and frequency encoding suits categories with many levels. Rare categories become small values and are isolated quickly, which is usually the behavior you want.

How is isolation forest different from local outlier factor?

Local outlier factor compares the density around a point with the density around its neighbors and needs distance calculations. Isolation forest uses random splits and no distances. The first is better for local anomalies and the second is much faster on large tables.

Does feature scaling matter?

For the algorithm itself, almost not at all, because split values are drawn between the minimum and the maximum of each feature. Scaling does not change which rows are separated first. However, transforming heavy-tailed features, for example with a logarithm, can change how isolation behaves and often improves results.

Can I use isolation forest for streaming data?

The classic version is a batch method, but you can refit it on a sliding window or on a schedule. There are also streaming variants such as robust random cut forests that update the trees as new points arrive. For a simple setup, refit regularly and compare score distributions across windows.

How do I explain why a row was flagged?

Use a feature attribution tool. TreeSHAP works on isolation forests because they are tree ensembles, and it gives a per-feature contribution to the score of a row. A cheaper approach replaces each feature by a typical value and sees how much the score falls.

Is isolation forest useful with tabular foundation models?

Yes. It is a fast baseline for anomaly benchmarks, a source of an extra score column, a filter for the context rows of in-context learners, and a drift gate for incoming tables. Its errors differ from those of neural models, so the two together are stronger than either alone.

Glossary

• Anomaly score: a number from 0 to 1, higher meaning more unusual, derived from average path length.
• Contamination: the assumed share of anomalies in a data set.
• Extended isolation forest: a variant that uses randomly oriented hyperplane splits.
• Isolation: the act of separating one row from all others with splits.
• Isolation tree: a binary tree of random splits.
• Masking: when anomalies hide each other because there are too many of them.
• Novelty detection: training on normal data to spot new unusual data later.
• Outlier: a row that differs strongly from the bulk of the data.
• Path length: the number of edges from the root to the leaf that holds a row.
• Subsample size: the number of rows used to grow each tree.
• Swamping: when normal rows near anomalies are wrongly flagged.

Summary

Isolation forest detects anomalies by asking how quickly a row can be separated from the rest with random cuts. Short average paths give high scores. It is fast, label-free, easy to parameterize, and a strong default baseline for tables. Prepare categories and missing values carefully, treat the score as a ranking, pick thresholds with the business in mind, and explain results with attribution tools such as SHAP. In the world of tabular foundation models, it works as a benchmark baseline, an auxiliary feature, a context filter, and a drift gate, and it pairs well with learned detectors built on autoencoders or masked cell models. For tuning its settings systematically, see Bayesian optimization, and for wider evaluation see /model/benchmarks.

Related

It belongs to Classical ML in my stack, under Foundation models and applied ML. Others in the same group: