Have you ever wondered why certain data points stand out so dramatically?
They might hold the key to everything from fraud detection to groundbreaking discoveries.
This week on Talk Python to Me, we dive into the world of outlier detection with Brett Kennedy.
You'll learn how outliers can signal errors, highlight novel insights, or even reveal hidden patterns lurking in the data you thought you understood.
We'll explore fresh research developments, practical use cases, and how outlier detection compares to other core data science tasks like prediction and clustering.
If you're ready to spot those game-changing anomalies in your own projects, stay tuned.
This is "Talk Python to Me," episode 497, recorded January 21st, 2025.
- Are you ready for your host, please?
- You're listening to Michael Kennedy on "Talk Python to Me." Live from Portland, Oregon, and this segment was made with Python.
- Welcome to "Talk Python to Me," a weekly podcast on Python. This is your host, Michael Kennedy. Follow me on mastodon where I'm @mkennedy and follow the podcast using @talkpython, both accounts over at fosstodon.org.
And keep up with the show and listen to over nine years of episodes at talkpython.fm. If you want to be part of our live episodes, you can find the live streams over on YouTube.
Subscribe to our YouTube channel over at talkpython.fm/youtube and get notified about upcoming shows. This by Posit Connect from the makers of Shiny.
Publish, share and deploy all of your data projects that you're creating using Python.
Streamlit, Dash, Shiny, Bokeh, FastAPI, Flask, Quarto, Reports, Dashboards and APIs.
Posit Connect supports all of them.
Try Posit Connect for free by going to talkpython.fm/posit, P-O-S-I-T.
Brett, welcome to Talk Python To Me.
- Well, thank you very much for having me.
- It's awesome to have you here.
A pair of Kennedys on the show.
- First time ever, that's pretty awesome.
- Yep, well it should be much more common.
- Indeed, well thank you for coming on the show.
I'm really interested to talk some data science and mathy type things with Python.
Python is being used for data science and analysis and just general science and mathematics so much these days.
I wonder if people have maybe a perception out there of thinking, well Python is kind of like, yeah people use that for the web and stuff and true, but these days it's data science, machine learning, those things.
Other languages are used a fair amount.
Statistical analysis are still used a lot.
And for high performance, machine learning, people will look at other languages, C++ is used a lot and like Mojo and things are coming, coming through now that are, but still a very, very large percent is done in Python.
Like all the work we're seeing with large language models, for example, like that's pretty much all, all Python.
And a lot of standard traditional machine learning is done in
a
very large portion of
it's done in Python.
Yeah.
And outlier detection as well.
Yeah.
I think Python is probably, I mean, arguably, but I think probably the richest set of tools for outlier detection of any language, again, R has quite a good suite and, and you get good, good tools in Java and in some other places.
But Python is probably where you find the, the strongest, just the sheer number of And also it covers a lot of the deep learning techniques and some kind of approaches to outlier detection
aren't really as well covered in other languages.
- Well, we're gonna dive into it.
You've written a whole book on it and a bunch of cool techniques you pull down.
We're talking about some libraries and things like that, as well as some other examples.
But before we get into that, let's just hear a quick introduction about who you are and what you do these days.
- Yes, well, my name is Brett Kennedy.
So I've worked in software in one capacity or another for about 30 years now.
I did my master's degree quite a long time ago at the University of Toronto.
And that was actually, well, I was around '98, '99.
So during one of the times when AI was being a bit of a winter.
Yeah, that was a very, very good experience going there.
And yeah, I've worked for one company doing software that was used for financial auditing.
So and that's where I really started to get into data science.
And that was about 15 years ago.
of what is a little bit not as mainstream as it is today. I mean, there's certainly a lot of other people doing it, but it wasn't the gigantic industry that it is now.
>> Yeah, there was definitely
some inflection points or places where it's really taken some steps, significant steps up in the Python data science and ML space. Probably one is the Pandas NumPy era around 2006, something around 2012. I don't know really what caused And certainly in the machine learning, AI is a whole nother spike of growth there.
So you were doing, it was kind of before mainstream data science, right?
It is starting to become mainstream, but like when working with text, for example, there's certain, there were spacey and word2vec and glove and things like that.
But this is long before GPT, but scikit-learn existed and yeah.
So we're actually using a lot of the same tools that you would, you would use now, but they're a little bit earlier versions of them.
They're, yeah, sure.
Yeah.
So things have, have, have progressed certainly a lot.
Though some things just, just work and have, have been, been fairly stable.
In that space.
I imagine a lot of the work
that's been done on the faster CPython initiative is probably paying benefits.
Yeah.
I mean, one of the things about Python is it, it is, does have a reputation as being not, not the fastest language you can use, you know, old versions of Python were certainly slower.
It's, it is getting faster.
Yeah.
C++ is probably about as performant as you can get in it, but you know, a lot of like scikit-learn for example, is, uses Cython so you get C code.
Characteristics.
Yeah.
It also goes back to what are you measuring?
What is your metric for fast?
Yeah.
What are your expectations?
And yeah, I could make a really fast thing in two weeks in C++ or I could make a somewhat slower thing, but get you the answer in half a day in Python.
It might run five times longer, but you'll have the answer today.
You know what I mean?
like that kind of thing.
There's really a trade off.
And I think, I mean, it's kind of the, well, it's, it's really the approach we've taken in data sciences to really privilege the data scientists time over the computation time.
Yeah.
And when it really does become a problem, there's a lot of stuff written in C or Rust or whatever.
Polars, pandas, et cetera.
Yeah.
That, you know, Polars is a big breakthrough
too.
Yeah.
Are you a fan of Polars?
They've been using any?
I use it when, when there's a need.
I mean, I'm still a big fan of pandas and I still use it quite a lot.
But when there's a performance issue, yeah, Polar's is one of the things I'll turn to.
>> Yeah, excellent. So we're going to talk about outlier detection.
I think maybe a good way to introduce this topic is to maybe understand the problem space just a tiny bit.
Because sometimes you might think, well, if the mean is really weird or the median is really weird or something like that, then we might have an outlier and we can go check it out.
But it's really a lot more subtle than that.
And I want to maybe go back to a guest I had, was that six months ago or something like that, Stephanie Molin, and she has this really cool project called Datamorph, which I'll link to on GitHub, and we talked about it then.
But if you pull up her GitHub repo, it's an animated GIF, I believe, of a whole bunch of different, very clear concrete shapes, like a star, literally a panda, not pandas, but the animal, and continuous animation, a bunch of data points that go from one to the other.
And it shows the mean over time.
It's the same.
The standard deviation is the same.
The correlation, the same effectively do like four to the thousandth sort of thing.
And it just shows you this is not as simple as finding stuff that's just off the that's linear interpolation line or something like that, right?
Yeah.
It's a good example.
We're using a single or a handful of metrics to evaluate a data set can be a bit oversimplistic.
You can miss a lot of nuance when you do that.
Yeah, and you do definitely get into the same sort of issues when you're looking at outliers in a lot of areas of data science where you can kind of be misled by looking at metrics that maybe are relevant, but aren't just don't tell the tell the full story.
It's one view, but it maybe it's not.
It doesn't for sure.
Like you said, doesn't tell the whole story.
So let's talk about what is this outlier detection stuff and really why
do people care what kind of problems are being solved with it and so on.
When people start to learn machine learning, one of the early things you'll learn is there's supervised machine learning and there's unsupervised machine learning. And when you get into unsupervised machine learning, the two bigger areas of it are probably clustering and outlier detection.
And sometimes dimensionality reduction is kind of considered unsupervised as well. It's kind of like there's a whole host of reasons you might want to do clustering. It's a little but like that is that it's just one of those things that turns up time and again, when you're doing machine learning.
Outlier detection can be done for, for example, if you have a data set and you just want to say, you just want to try and understand the data.
One hand you can say, well, if you want to understand the data, there's really kind of two main parts of that.
There's what are trying to figure out what are the general patterns in the data and what are the exceptions to those?
And once you have both of those, you say, well, here's the patterns and Here's the extent to which those patterns hold true in the data, which is the outliers.
That kind of gives you a good sense of what the data is about.
Often when you're checking for data quality, outlier tests are very useful.
It gives you, like if you have say a table of whatever it is, credit card transactions or whatever, you can do this for image data or audio data or data of really any type.
But let's take a simple example of tabular data.
You might have a spreadsheet with a few million rows of credit card transactions or SQL table.
If you want to check it for errors before you go on to do other sort of analysis out of the data mining or building predictive models or the like, one thing we often do is try and see, well, what kind of data quality am I dealing with here?
And there's a number of ways to do that, but one of the steps you might often perform is say, we'll do outlier detection and see what are the strangest rows in my data.
And if you look at those, you see the strangest credit card transactions in there, Or if you could be a little more involved in analysis, you might look at the most unusual string of transactions for a given user or a given store or something like that.
And if you say, well, okay, these are the weirdest ones and they're only this weird, then we can have some sort of sense of what sort of range of anomalousness might be in your data.
Yes, it's used, alert detection is used a lot as well in security.
We're gonna be used like checking for fraud, checking for errors.
I mean, it's used in scientific analysis a lot.
It's very common for scientific projects for just to collect data through sensors or hand collecting data or whatever.
In the case of astronomy, it's through telescopes.
Astronomy is a good example where we collect such phenomenal volumes of data that if you want to find anything interesting in there, we used to be able to find interesting phenomena in astronomy data just by manually going through it.
example given the book is that's how pulsars were discovered. The low-hanging fruit's gone, probably. To really find something really, really interesting, given that we might collect petabytes of data per night, really the most effective way to do it is just go through an anomaly, run an anomaly detection on the data and say, "What are the strangest things in this set of data?" And those are odds are there was going to be the most interesting there that maybe things we've never seen before or haven't seen a whole lot. At least some examples.
- Yeah.
- Testing for online video games as well as...
- When I talked to Sarah Eisen about imaging a black, the black hole, the first
black hole image with Python, she talked about shipping, actually shipping hard drives around to sync up the data because there was so much data that it was faster to put it onto a plane and send it from all the different locations around the world. Like it literally couldn't keep up the internet. And so box them up into these big crates and ship them around.
When you're talking that much data, you gotta get a plane involved, it's pretty wild.
- We weren't doing anomaly detection at the time, but yeah, one of the companies I've worked with, just dealing with financial data, we
actually collected so much, it's actually faster to mail it.
- Really, you ended up doing that as well?
- At times, yeah.
- Yeah, how much of a hard drive would you put-- - Oh, gosh.
- In the mail?
I mean, it wouldn't be just a terabyte, it would have to be a pretty big hard drive, or set of hard drives, right?
- Well, part of the explanation of why we're doing this was this was about 15 years ago.
- I see, a terabyte sounds like a whole lot.
- Yeah, I think the internet we were paying for at the time was, you know, having sort of speeds we have with the internet now, the costs were prohibitive back
then.
- I have gigabit up and down at home for 75 bucks, which you could have sent it over that probably, but it's not quite back when the internet had a sound.
Do you remember when the internet had a sound?
You would connect to it and you would be like, okay, that's a good connection.
We're gonna have some stuff happening today.
That's early 90s when the internet stopped having a sound, mid 90s, it stopped having a sound.
>>
That's about when I first started getting a little, just as it's being opened up.
Remember the early days, it's basically university students that were on there.
>> What I would do when I was in high school is,
my brother and I, we would call the local university and they had a library dial-up for dial-up modems, and then you get on to Telnet and go for an Archie.
This is before the World Wide Web existed, before Mosaic, it was, for people that know I'm talking about.
>> TP.
>> Yeah, exactly.
>> Telnet, yes.
>> Unencrypted FTP. By the way, we had so much trust. We were so naive.
>> Yeah.
>> But yeah, when you would connect, it would go beep,
beep,
beep, beep,
[NOISE]
and depending on the sound, you would get to where you would go, "Oh, that means I connect to this bit rate or that bit rate," right? It's so wild.
>> Yeah, those are >> I'm nostalgic for it and I want nothing to do with it. I'm so happy we are where we are. >> Yeah, there's a certain charm to it.
But if you went back to it, you would hate it
because
you would watch the images load.
You would almost see the progressive scan lines come in.
I mean, it was really, it wasn't ideal.
No, I had a roommate once who used to download images.
These are just JPEGs, the same sort of files we have today, but it would take literally overnight to download a
JPEG.
They were interesting times, but we've certainly moved on.
So that's all good.
This portion of Talk Python to Me is brought to you by the folks at Posit.
Posit has made a huge investment in the Python community lately. Known originally for RStudio, they've been building out a suite of tools and services for Team Python.
Today, I want to tell you about a new way to share your data science assets, Posit Connect Cloud.
Posit Connect Cloud is an online platform that simplifies the deployment of data applications and documents. It might be the simplest way to share your Python content. Here's how it works in three easy steps. One, push your Python code to a public or private GitHub repo. Two, tell Posit Connect Cloud which repo contains your source code. Three, click deploy. That's it.
Posit Connect Cloud will clone your code, build your asset, and host it online at a URL for you to share. Best of all, Posit Connect Cloud will update your app as you push code changes to GitHub.
If you've dreamed of Git-based continuous deployment for your projects, Posit Connect Cloud is here to deliver. Any GitHub user can create a free Posit Connect Cloud account. You don't even need a special trial to see if it's a good fit.
So if you need a fast, lightweight way to share your data science content, try Posit Connect Cloud. And as we've talked about before, if you need these features, but on-prem, check out Posit Connect. Visit talkpython.fm/connect-cloud, See if it's a good fit.
That's talkpython.fm/connect-cloud.
The link is in your podcast players show notes.
Thank you to Posit for supporting Talk Python To Me.
You talked about some examples where you're looking for outliers for fraud, like credit card, and you talked about mailing around the financial data for those kinds of things.
It seems to me that outliers might also reveal new science or new information that you didn't expect.
Like it's an outlier because it doesn't match our model, but something is happening over here. And I think you pointed out astronomy, right? Like that part is really bizarrely bright. Why is that so bright? Is that a, you know, oh, that's a quasar. That's what that is.
- Brightness you're not expecting or a shape of a galaxy you're not expecting, that sort of thing.
- That nebula turns out to be a galaxy. We thought there was only one galaxy. Now there's many, right? That kind of thing.
- It's definitely a case, I think science is definitely a good example where outliers is something you want to find. Yeah, it's like biological data. It's used a lot too.
Well, I guess a lot of areas, the CERN particle accelerator at CERN uses outlier detection a lot just to find interesting things and to check that things are within certain bounds of what they expect or not.
But yeah, I mean, when you're dealing with certain domains, like one example that's kind of maybe the other end of the spectrum would be when you have, say you're monitoring industrial systems, like an assembly line or something like this, that's an environment where you really want something, we want the whole system to work in a specific way. And any kind of veering from that is probably a problem or indications of a potential problem down the road.
Right. You've got some IoT thing or you've got a more industrial type of robot and all of a sudden it's drilling holes outside of where you used to have it drill holes. You probably want it to stop.
It's
behavior is unusual or just the sensors picking up temperatures that are unusual or vibrations or sound levels that are higher than normal or oscillating faster than normal or something like that.
Yeah, yeah, yeah.
Quite often, yeah, an outlier can be something interesting or it can be a problem.
Yeah, it really depends on the context.
But in most cases, there's something that's, for one reason or other, it's common for them to be worth investigating for one, yeah, to expand your knowledge of the system or just to find fared out problems.
- Sure, what's the
scale of data that outlier detection makes sense for?
If I've got 20 measurements, does it make sense to ask this question?
If I've got 200 billion, is that too much to ask the question for?
Like, what's the story there?
- That's a good question.
I mean, when you have a very, I mean, it's like a lot of areas that could be, I guess the same thing with clustering or predictive models or generative models, anything along those lines.
You have too little data or you can have too much.
And there is kind of a sweet spot where the results are statistically stable, but it doesn't take you forever to find
them.
- They're statistically stable, but they can be computed.
- Yeah, it's not a lot of problems.
Like if you have, say you're checking a large company and you're just checking your accounting data for anomalies, there can be a lot of value to it.
And you can probably, on a lot of cases, you can measure it in dollar value.
If you find, well, if you find fraud, like you're a high level fraud where your CFO is misrepresenting the company or something, - Or low level fraud where your staff are ripping you off or just errors or inefficiencies or not
follow up.
- Contractors or what, subcontractors or something, yeah.
- Yeah, they can often, when contractors are working on you some way, they'll be doing kind of a concert with maybe some of your staff.
There's could be some collusion or things like that.
So looking at your staff behavior, it could be worth a lot of money and there could be a lot of benefit in it.
But if it takes you 600 hours to run a
process
and you find one thing, It may or may not be cost-effective.
Well, that example wouldn't be cost-effective.
Yeah, so there's kind of a balancing act you want to follow.
If you have an extremely small number of points, you can say that one is anomalous, given the others.
If you have a bunch of, say, you're going through your, maybe just looking at, just thinking of the example of staff and errors at a company.
Say you have, on staff, you have a bunch of people employed.
They're purchasers, they're just employed to buy supplies from your suppliers.
And some, maybe you have 10 of them and most of them make an average of about four purchases a day.
And you have one that every Friday makes 200 purchases a day.
So you only have like 10 points there, but one of them is so off the scale that you can say with some confidence, this is not necessarily a problem, but it is anomalous and it is worth understanding.
Either there's some errors or fraud or inefficiency or something, or the other people are just, They're the anomaly.
They're not doing their--
They're not doing their job.
Yeah, they're not buying enough.
You're definitely right, too.
You can have the other problem where you just have so much data, it's hard to go through.
Are there techniques that people use for, like--
use, for example, Dask or QPi, like the CUDA stuff for GPUs?
Are there sort of like really high-end compute stuff that people are using for these problems?
Yeah, and that's-- especially if you're using a deep learning-- well, I guess only.
But if you're using something that has a lot of matrix operations, a GPU will speed that up.
And Dask will often work out, especially have memory limitations as well.
Outlier detection can be done in parallel, which can speed things up.
Outlier detection works a little bit like predictive models in that there's a train step, and then there's a inference step.
OK.
You train it what's normal, and then you ask it if things seem normal or not.
OK.
Exactly.
So normally what you do with outlier detection of data. So, well, if you take the example of an industrial process, so say you monitor your, let's say in this example, you have sensors that are collecting a lot of data, so they're collecting temperature and sound and humidity and so on, information. And, you know, say you have a process that's run for weeks without any problem. So during that time, you know that everything was running properly. So you can take that data and give it to an outlier detection to train on, and then that builds up a sense of what's normal. In this case, it's not only statistically normal, but it's also kind of like a platonic norm. It's desirable as well. That's your inference step.
And a lot of times, that's only done once a month or every few months or something. And so, it's not terrible if it takes a little bit of time to train. In other contexts, in like a real-time situation, you can have streaming environments where you're just constantly reading in data and it's your sense of what's the new normal. You might be retraining every few minutes or a few hours in which case, yeah, the training time becomes a lot more relevant. It can be done offline, but then it's your inference time and that can be really relevant.
There are certain ways to keep down your training time as well. Sometimes if you have like months of sensor readings, you might not need to train on all of them. You can just take a sample of them or a certain time slice or something like that.
And
that's good enough to establish a decent sense of what's normal.
Right. It seems to me that the training could be done on a subset and that would probably be OK.
But I feel like the detection might need to run nearly on everything.
Right. Because it might be that that one in a million sort of thing.
Right. Astronomically, you're looking for that one little bright spot or that one little dip in brightness for a transit of a planet or something.
or I've had my credit card put on a block until I unblocked it because I bought something in a vending machine for a dollar with a credit card. And they're like, well, a lot of people who steal cards, they'll take them to vending machines to try them because it's a safe place with no one there to see if the stolen card still works. And then they'll go do bad stuff.
Well, it's hard to say what they're doing behind the scenes. Why they flagged it, it could have been because they do run outlier detection routines. They could have been done that or they could have been using like a rule-based system like you're describing where If it's in a certain location for a certain dollar value at a certain time of day and so on, they might have just flagged it because of that.
>> It was very shady.
I was at the
university.
>> Yeah, it's definitely the case that most of the time when you're running outlier detection, yeah, you want to check all of your data because otherwise it kind of – the question is, are there any anomalies in my data?
There are exceptions to that where you just want to check – you just kind of want to spot check your data and just want to make sure it's largely free of outliers or that there's not – I mean, depending on how you define them.
example, a sensor readings, like you always expect a certain number of point anomalies, like a certain point in time where something spikes up and it's not it is an anomaly, but it's not a big deal. So in some cases you might just want to make sure that your number of point anomalies is normal. So you don't have an unusual number of unusual events in that case or cases like that or if you're just doing data quality checks, for example, you might just want to make sure your data is large.
How do you know that you don't get outliers in your If you just feed it like a stream of data, you're like, well, this is what's normal.
Actually, there were outliers, but you weren't ready to detect them yet, and now it thinks they're normal.
Most of the time
when you train, you do assume that there's a certain number of outliers in your data.
Yeah, so what you're training on is often a statistical norm.
It's what's normative.
It's not necessarily what's ideal and clean.
It's very hard to get data that's really clean.
And if you do, it often biases the data in one way or the other, which kind of undermines outlier detection sometimes.
It's almost like overtraining, maybe.
Yeah, similar idea to that in that it learns very specific patterns as being normal.
Actually, what's fairly common in outlier detection is to train and to inference on the same data with the idea that there's outliers in there anyway.
So in some cases, like, well, go back to the example of a, let's say a credit card company.
So you have, you want to check all your transactions for the last day.
So you have a hundred gazillion.
You can train on that.
And then you can also run inference on that.
So you can say, relative to today's transactions, which are the unusual ones, unusual relative to the other ones.
So it's something you wouldn't do in prediction problems, but you actually can.
It's fairly common to do that note letter detection.
just with the idea that as long as most of the data is typical, most algorithms will be able to find the records that are the most extreme or the most unusual in one way or another relative to the other ones in the data.
Yeah, that's very interesting.
You can train on
the data and then ask it to find the outliers in that same data.
That seems very counterintuitive.
Yeah.
It is a little counterintuitive, but like, well, I guess the simple example I gave earlier where you have 10 purchasers for your company.
You can use those 10 to establish a sense of what's normal.
And it would say, well, about four purchases a day is normal.
And this one person that has 200 every Friday, that's unusual.
So it's actually doing, you can do that in the same data.
Now having said that, what you do do in outlier detection is you sometimes do that a little bit iteratively where you say, start with the original data and find the most anomalous records in there.
And then you might inspect them manually and say, "Okay, these are things, yeah, that we wouldn't normally expect to happen.
So we can remove those." Or there are things you say, "They're extreme, but
there's
nothing wrong with them.
They could happen again."
Or maybe they're a lightning flash when you're looking through a telescope.
It's really bright.
Well, you get a lot of, like, when you're dealing with anything like that, you get a lot of data artifacts where it's not that the phenomena that happened that you're monitoring was unusual.
the equipment you use to monitor it had some sort of power surge or something like that.
And that's a data artifact, you might want to remove it. So sometimes you just, you kind of iteratively make your data cleaner and cleaner and gets kind of more pristine sense of what's normal. But you can overfit doing that, you can go too far doing that.
Yeah, would you maybe find, sort of do a, like you say, a
loop a couple times, say, train it and then ask it what's abnormal and figure out, well, these things are truly not part of the things we want to consider. So we'll take them out and then train it again.
excluding those and kind of like iterate on it that way?
- It's not imperative, but that would be a fairly, fairly standard way to do things, yeah.
- We haven't properly introduced your book yet, Outlier Detection in Python.
- Yes. - From Manning.
And I want to give you a chance to give a shout out about it and then I want to talk to you about a couple of things that you've covered in your book, of course.
So I know that we have some discount code for the book that Manning has given us.
I'll put that in the show notes for people if they're interested.
Well, yeah, tell us, tell us about your book of it and why do you write it and what people can learn from it?
One job I worked at a few years ago, I just spent an enormous amount of time.
I was managing a research team and there's about 10 of us on the team.
And we looked into a lot of areas of machine learning too, but I, outlier detection was the biggest one for us.
And so we were doing a lot of work around that.
For, well, this is the company, as I mentioned, that was doing financial auditing. So we're building tools that would allow financial auditors to, when performing an audit, examine their client's data and just in a fairly easy way, see what's unusual in their data. The idea that, for example, if you're looking through their financial transactions, like if you're an accounting firm and you're auditing spatula world, this example I used to always give for the word elf fans, I guess, is they would have a set of sales and a set of purchases and set of payroll transactions and so on. So you can go, what auditors would often do is just find the most anomalous of those with the idea that those are the ones that are among the most important to investigate, to see if there's anything off with them that could suggest an error or something like that.
So we spent a lot of time doing that. We were working with regulators around the world, not just audit firms, but also regulators and bodies like that.
And we spent a lot of time looking at how can we justify the outliers that we're finding?
Because if we run some of these, most of these algorithms are a little bit like black boxes, blocks algorithms.
So like if you're doing a predictive model and you send something through an XGBoost model or a neural net or something, it gives you a prediction.
And it's hard to say why it made that prediction.
So a lot of outlier detection algorithms are like that, but it's kind of an issue sometimes because in outlier detection, probably more than with prediction or classification or something, or clustering, I should say, it's important to have an explanation of why something is unusual.
Like if you're flagging something as maybe being potentially fraudulent, or if you're doing security and you're flagging some web activity as being problematic, or a person in some sort of security context is possibly being some sort of security risk.
You gotta know why in order to investigate effectively and quickly.
So we spent a lot of time looking at how to make Outlier Detection 1 interpretable and also just kind of justify the results that we're finding if we assess the tables of data and come back with a summary of them saying, these are the most unusual records in this data.
But it's actually a hard problem to try and explain why that was the case.
So I ended up just reading hundreds of, I think like literally hundreds of papers on the subject.
And we did a lot of original research and it ended up building up quite a lot of expertise.
But also during that time, it was just a really fascinating, interesting problem.
Realized outlier detection, it's just a really, it just kind of grabs you because yeah, It's just kind of something fascinating, but you're trying to figure out if you have a collection of images or a collection of sound files or a collection of, like one job I had, we were working with network data, like social networks in that case, connection kind of graph models.
What are the most unusual records in there?
This is really challenging.
There's no definitive answer, but there's certainly good answers.
And there's ways to do it efficiently and interpretably and accurately, But it's difficult, but it's just really rewarding when you kind of get something, a hard problem
like that working well.
- Yeah, I imagine it's the kind of thing that if you have those answers, you kind of become real good friends with the CEO or the decision makers.
They're like, this person can look at it and answer the questions that we can't even know to ask.
- Yeah, exactly.
It does open up different ways of thinking about things.
And yeah, it's just, yeah.
It has a lot of benefits when you're looking at data.
- I imagine you could
probably
also
make really important decisions for where to put your energy in your company, right?
Like you had spatula world as an example.
Like if some product all of a sudden seems like it's doing really well and that's an outlier, like you should be able to answer, this is actually gaining a lot of traction, we should manufacture a bunch.
Or no, that's just some weird glitch and that's not gonna be, that's not predictive of, should we order 100,000 green spatulas or is that just something weird that happened some restaurant come and bought all the ones at a store.
So
it's really hard to, but important to be able to quantify these things and just give some context of
you
could end up in a bad place if you make an investment.
Yeah.
So it's the curse of, of half understanding
of
a little bit of knowledge.
I guess.
I've got a great idea.
Yeah.
All right.
Let's talk about some of the tools that you highlighted in your book.
Like the PI OD, Python outlier detection.
Yeah.
Let's talk about this one.
What was the story of this thing?
It's used quite a bit, used by 4,000 people and 8.8 thousand GitHub stars.
That's pretty, pretty well used.
It is.
Yeah.
It's really the, it's the go-to one for outlier detection in Python.
Okay.
Anyone's doing any kind of machine learning work in, in Python.
I mean, the one tool there they'll know is scikit-learn.
And scikit-learn comes with four outlier, well, it comes to four outlier detectors.
And also some tools that make it relatively easy to do some other types of outlier detection, like as a KDE tool.
we'll see kernel density estimation, which makes it fairly easy to find outliers to just points in space that have low density as well clustering method called Gaussian mixture models and GM, which makes it fairly easy to do outlier detection using that as well.
But PIIOD, yeah, so PIIOD has those, has basically everything in scikit-learn, wraps it in its own interface.
And I think a couple dozen more, and it also has a number of deep learning based ones.
So for tabular data, it's really where you want to go first, probably.
So yeah, in terms of deep learning, it has well autoencoders, variational autoencoders, GANs.
There are some limitations with PYAD, and I do get into that in the book.
It assumes you're dealing with strictly numeric data, for example, which if you're dealing with tabular data, realistically, you have mixed data, categorical columns, date columns.
So PYAD does not handle that.
And it's strictly for tabular data.
So if you're working with time series data or image data or audio data, that sort of thing, there are other tools involved for that.
But yeah, for tabular data, it's pretty much the most used one.
- Okay, got the NLP 80 bench for NLP anomaly detection.
So I'm guessing this is in text.
I'm not sure, you'll have to tell us what kind of stuff you detect with that, but I wanna give it some articles or maybe give it social media posts or something along those lines, then ask it.
What kind of questions could you ask it about
that?
NLP is kind of a, it's a dicey area without layer detection.
And I shouldn't, dicey is too strong a word.
It's a harder area.
It's certainly a harder area to work with because like if you have tables of data again, like say accounting data, for example, if a bunch of transactions, it's difficult to say which are the most unusual transactions in your data, but it's kind of, like if you see something that's very unusual, you can say, okay, that transaction is unusual.
With text, that is harder to say.
I mean, if it's a completely different language or something like that, or the tone, or the writing style is completely
different.
- And you have curse words, and people might think it's angry, but in fact, it's just sort of a coarse way of expressing excitement, right?
Like, oh, these people are really angry.
Like, no, they're actually really happy, but they don't really express it super properly.
- Right, but if the rest of the corpus did not have any expletives, then in a sense that's anomalous in that way.
Yeah, with text, there's just so many ways that text can be just a little bit different.
I would consider it one of the more challenging areas of machine learning of outlier detection, yeah.
- I'm sure,
we'll talk about LLMs as well and see how that changes things or not in a little bit.
But the other one you mentioned is scikit-learn.
Like this is kind of the granddaddy of a lot of the data science type of stuff.
And they've got a whole section on novelty and outlier detection.
maybe I'm headed up on the screen for a little bit, but give people a sense of kind of problems you can ask with this one or problems you solve questions you can ask.
It's a little bit like PIOD, it's less so, but it doesn't have like 30 or so detectors, it has four, but includes two of them.
So again, it's just for tabular data.
And again, it's just numeric tabular data, but it has two of the go-to algorithms.
They're called one's called isolation forest.
And the other is called local outlier factor.
I think most of the time with outlier detection, if you're doing tabular data, if you're only gonna use two algorithms, those are the two.
Outlier detection is a little bit different than say prediction, because if you're building a predictive model, say on tabular data, most of the time you would use, say an XGBoost model or a CatBoost model or a random forest or something like that.
You would tend to use one model.
Sometimes if you really wanna squeeze all the accuracy you can out of it, you'd create an ensemble.
Actually, internally is an ensemble of, it's a boosted ensemble of decision trees, but normally you wouldn't, sometimes you do, but probably more often we don't create an ensemble of a KNN and an SVM and a neural net and a random forest.
In outlier detection, that's a lot more common to do that.
And the reason is that each outlier detection algorithm, it can be a little bit limited in one way or another.
They're not in an extreme way, but they each look for different types of outliers and they each look for outliers in different ways.
And it's just, there's a lot more advantage to using multiple detection algorithms with outlier detection than you would with prediction.
And you can do it in just really simple ways.
If you say, Scikit-Learn has four outlier detectors, it has isolation forest, it has local outlier factor, has one called one class SVM and has one called elliptic envelope.
So if I run the four of those on my data, and let's say they're all four of them are appropriate and work well. Any records that are scored highly by all four of those detectors, you can say, well, these records are really
weird.
You can say, yeah.
Yeah, you can let it say, we've checked many different ways and we've got the same answer that it's an outlier in these different aspects.
And so it's really likely.
It's really likely. It's not necessarily a problem, but it is statistically unusual.
And yeah, and I think a lot of time, if you're just, if you don't have a lot of intense outlier detection work to do, you just have a small data set and you just wanna quickly get a sense of what are the most anomalous records in it.
Just using scikit-learn with the assumption that you, you're using scikit-learn anyways for a lot of your work.
Just using that is probably gonna be, yeah, sufficient for a lot of cases.
If you want to do a little bit more thorough job using more detectors again, and just using detectors that can be a little bit more, PIOD has ones that are a little bit more performative, has some that are a little more interpretable.
It could be a good decision just to use PIOD and use a bunch of the detectors there.
One of the nice things about PIOD is it has the same API signature for all of its detectors.
So if you write code, and it's usually only like four or five lines, it's really kind of boilerplate easy, other than the hyperparameters for them.
It's really quite easy to just kind of swap one out and swap in another and just try a whole bunch of them.
One thing I do get into the book is that there's a lot of algorithms beyond even what's in PIOD that can be very useful to use.
The ones in PIOD, they're good and they're sufficient quite often, but they're limited into how interpretable they are.
So again, if you're in a situation where you're saying, well, this looks like a security threat or this looks like failing equipment this looks like a novel specimen. Say from astronomy, this looks like a novel transit.
This is a transit that's not normal. You want to know why. So a lot of the detectors from PIOD don't provide that necessarily to the degree you would wish. So I do suggest a bunch of others that could be useful for that purpose and that support categorical data
as well.
That's non-numeric stuff like male, female or high income, low income or whatever.
- Exactly.
- We talked about time series a little bit.
You said that time series are pretty challenging and I guess it depends on how rapidly the time series data is coming in as well.
- Yeah, that's actually one of the things about time series data is that it can be streaming and coming in extremely fast.
And yeah, so just like I was saying, like very often we use ensembles of outlier detectors to try and analyze the data.
By their nature, ensembles can be a little bit slower.
Now you can run them in parallel.
- Yeah, right, 'cause it's basically, you take three or four or a thousand decision trees them all what their answers are and then you kind of like decide what the, it's like a voting process or something almost, right?
And that would be exactly how you would do it in a predictive model. So with an outlier detection model, well there's probably the closest thing to what you just described with outlier detection is there's an algorithm called isolation forest, which is a forest of isolation trees. So it's kind of similar ideas. It's probably close to, a little bit close to random forests, probably a little closer to extra trees for anyone who's familiar with predictive models. That's isolation forest. So it's kind of the outlier detection equivalent of extra trees model. And like that is that it's composed of a whole bunch of trees and depending on the implementation of it, not scikit-learns, but depending on the implementation of it, you can run all those trees in parallel, which can give you your answers quite fast if you have sufficient hardware.
What can also be done with outlier detection too is, which can actually, depending on your environment, work a little faster, can actually be faster to run your detectors in sequence, believe it or not, because what you can do then is, depending on how you define your outliers, but say you say, I'm only concerned with things that are flagged by the isolation forest and the local outlier fracture model and the KNN model and the autoencoder model.
You can run them in, so anything that's filtered out by the first model doesn't need to be sent to the second model and then, or the third model or the fourth model, so you can run it, you can kind of put the fastest one out first and then the.
Yeah.
That's interesting.
Almost like thinking about it, like an if statement or a while loop or something in programming where, where the ands short circuit, so like you want to do the simplest test first and then the next one, the next one, and you're only going to evaluate it until you hit a false and then you stop, be a positive in this case or something.
Yeah.
That's a good way to put it.
Yeah, if you do it in sequence, that's, that'll definitely speed it up.
Rather than taking all the data, run it in parallel across all the, the cores.
You're like, well, look how awesome it is.
It's using all the cores, but if you're like, no, we just run less of it.
So we don't have to do it so much.
There will still be benefit to that.
If you want to know specifically how anomalous things are, which you might, like, if you're not looking for to flag the individual anomalies, you're trying, you're more interested in collecting statistics about the volume of anomalies.
Like you're, it's more data monitoring project or something as opposed to picking out the individual anomalies.
You may still want to do that, but if you just want to pick out the really anomalous records, then yes, they might be the ones that are flagged by all of your, or almost all of your detectors, say.
- Right,
well, you don't even have to do, you could even do it partially.
If it's not flagged by three out of five, then we're not gonna pass it further down the line, right?
Like you could still do some sort of intermediate, more squishy analysis like that, but you could still short circuit it some.
- That would be a good balance, I think, yeah.
I mean, it's like anything, there's gonna be false positives and false negatives, but you
want to get a good balance of that.
- One of the other projects that you called out is Profit, time series anomaly detection with Profit, and it's based on the Facebook's open source library, Profit.
This is Profit anomaly detection versus just straight Profit, which is a tool for producing high quality forecasts for time series data that has multiple seasonality with linear and nonlinear growth.
I imagine that Facebook probably has a lot of data in its time series.
- If anyone does, yes, they would have phenomenal amounts.
And there's probably all sorts of things they wanna forecast.
- So tell people about this project and how they might use it.
- There's a number of ways to do outlier detection with time series data.
It's a little bit like I was saying with tabular data, you can look at your data in all kinds of different ways and they might all be legitimate.
They just find different types of outliers.
A really, really simple case, which can be useful, despite its simplicity is if you just have just a timeline over, over time of points.
So say you have a, well, say you're a social media BMF that has a half of humanity signed up.
You might want to look at your server usage or ad revenues.
And there's, there's all, just all kinds of things that you're, you're predicting.
One thing that things will be going viral.
And so maybe we should boost that in the algorithm and show it to more people, which could be very good or not so good, but anyway, it still works with the incentives and the goals of, "Hey, we want more engagement on the platform," right?
I guess one would be simple example, maybe weather data or going outside of a social media company where you just tracked temperature over time and there's certain seasonality to that.
What is that plot there? That is... Hard to say what that is.
Their example is, let's see if they call it out.
Oh, that
could be weather data
or it could be stock.
They don't really say. Have they named their... All their data is named DF
and
stuff.
- They
do, the way profit works is that there's only, you work with tables data and they only have two columns.
There's the time column and there's the value column.
And
you can't expand much.
- The legend says anomaly actual predicted base.
There's no information here that tells you what data this is but it still gives you a, it's still a cool picture to show you how it works.
It's like, here's the prior block of data like last week or something.
And now here's the next week.
And are we gonna predict if this is an anomaly or not?
That
is kind of the nature of time series data is it doesn't really matter if it's weather data or stock data or bird migration data. As long as there's certain patterns to it that can be found, you can work with that kind of equivalently. What I think they're showing there is something you often do in time series data is you have a certain pattern that's existed in time. So there's a certain downward trend in that and there's some seasonality.
So maybe those might be days of the week or yeah, those look like days of the week.
So maybe things are busier on a weekend or something like that.
So given the patterns that have occurred in the past where you know, look at the time of the day and the day of the week, the month, the year and the like, you can make projections into the future forecasts.
And then you look at your actual data.
If your forecast is generally correct, but you have some points that are way off from your projection, that's a form of anomaly.
So that's something that's often done for outlier detection.
It's just saying, given the history of what we've seen, we would have really expected a value of 10 here, but we see a value of 38.
So there's something unusual there.
It just doesn't follow the normal seasonality and normal trends that we've seen.
>> Yeah. It probably can't necessarily
give
you too much insight as to why, but you should go look at it, right?
'Cause it's just
the
quantity and time, right?
It's pretty sparse data.
- You might be able to see why you made the prediction you did because it's just based on how you, there's a lot of ways to do, profit works a certain way and there's a lot of ways to do time series forecasting, but generally you're just looking at the regular patterns, the general trend and maybe just like lag features and things like that.
So you can figure out why you made the prediction you did, but yeah, why it actually had the actual value that it did.
Yeah, you'll probably have to go and investigate.
Sure.
Maybe pull up some, some different tools and different algorithms now that you can focus in on that.
All right, Brett, let's talk about one more thing while we're here.
What's the story with LLMs and outlier detection?
And I think there's two angles I'd like to talk about this with you pretty, pretty quickly, just briefly.
One, can I just throw a ton of data at ChatGPT and I'm not talking the, the ChatGPT four model.
I'm, I'm talking like, Oh, one reason the higher end model that can take could hold all the data potentially.
And it's a little bit more thorough.
You can ask it, find me the outliers.
Like, is that a world, a thing that you might, might work?
And the other is, could I give it some data and say, describe the data and say, okay, here's the situation.
Here's what this data means.
Recommend me algorithms and tools and libraries and, and even techniques to analyze it.
Like, does chat make sense for either of
these?
I mean, it's going to be like a lot of things.
If you have an, if you have an expertise in these, sort of areas, you're you're gonna be better off just to take advantage of that.
But like a lot of areas of data science, if you're working into an area that you're, you don't happen to have spent years thinking about, these, yeah, these tools can be a good place to get you started.
I've worked with them a bit.
And what I've found is, though I have to admit, I haven't used O1 yet.
I used tools that were a little bit older.
And what I was finding is it was suggesting outliers, but in a really perfectly legitimate, but a limited way.
So it would suggest doing like a Z score test on your numeric columns or checking interquartile ranges and things like that, which are good ways to find outliers.
And I think it may be suggested using an isolation forest and a couple of things.
So I think it went over the basics reasonably well.
I kept trying to do a lot of prompt engineering to try and get it to push it towards more sophisticated analysis of the data.
and that wasn't happening.
Though, who knows, maybe if not this version, maybe the next one, a version of the LMS.
I think we're heading to that point where it can start to do that.
And again, yeah, same with trying to summarize the data and find the patterns in there.
It's able to do fairly well.
It's not at the level of like what a real, certainly not at the level of someone with domain expertise that really understands the data is gonna be able to do.
But it can provide
some rough summarization of the data.
maybe point you in the right direction to find some tools you don't know maybe and you could go use them.
I'm kind of like leaning towards saying it's not going to be doing the best.
But having said that, they work a lot better for when I have tested them for outlier detection than a year ago or something like that.
So it's heading in the direction where they might be able to do something quite useful.
Yeah, I've started using the O1 model and it's a lot slower, but you just got to change your mindset.
It's not a chat conversation.
and it's like I've given an intern a job and I expect it to come back with me a little later.
It's getting better and better.
It's a crazy time.
- It's remarkable.
Yeah, mixed feelings.
- I know.
Let's close this whole thing out with maybe just a final call to action.
People are interested in this topic.
They wanna do more.
Maybe another shout out to your book if you want.
And yeah, people are interested.
They wanna do more, go deeper.
What do you tell 'em?
- I would recommend the book, of course.
I really, it's on
Manning.
I really wanted to write, when I was looking to write with Manning, it's just a publishing company I always thought highly of.
Yeah, if you just go to manning.com and look for outlier detection, and I think, well, the affiliate link, that'll give you 45% off too, which is a nice link.
I think, I mean, the book has gotten quite good feedback.
One thing I was really happy with is some of the people that are architects of the most important algorithms in outlier detection.
So things like isolation forest, local outlier factor, extended isolation forest.
They gave some really nice feedback on the book.
It's gotten quite good feedback so far.
And I think it's probably as comprehensive a book as you would need.
- I'll say it's quite comprehensive.
I was going through it.
- It covers what you would, yeah.
If you're not doing time series analysis, for example, you can probably skip the chapter on time series analysis, but, or deep learning.
But most of it, I think, is actually-- there's a lot of gotchas with outlier detection.
I mean, they're not too hard to get your head around, but you do have to think about them.
And so it does cover pretty much anything you would need to know.
I think for almost any case, you wouldn't need to look for too many other resources after
reading this.
Excellent.
And PyOD is also another good resource maybe to get started with, you think?
Depending on your situation, either just scikit-learn or PyOD.
And then if you really need to go into deep learning, I would go in deep OD or even just pyod.
And for time series, there's quite a number of libraries
you can use as well.
- Okay,
excellent.
Well, thank you so much for being on the show and sharing your work.
- Well, thank you very much for having me.
Yeah, that was very good.
- Yeah, you bet.
Bye now.
This has been another episode of "Talk Python to Me." Thank you to our sponsors.
Be sure to check out what they're offering.
It really helps support the show.
This episode is sponsored by Posit Connect from the makers of Shiny.
publish, share, and deploy all of your data projects that you're creating using Python.
Streamlit, Dash, Shiny, Bokeh, FastAPI, Flask, Quarto, Reports, Dashboards, and APIs.
Posit Connect supports all of them.
Try Posit Connect for free by going to talkpython.fm/posit, P-O-S-I-T.
Want to level up your Python?
We have one of the largest catalogs of Python video courses over at Talk Python.
Our content ranges from true beginners to deeply advanced topics like memory and async.
And best of all, there's not a subscription in sight.
Check it out for yourself at training.talkpython.fm.
Be sure to subscribe to the show, open your favorite podcast app, and search for Python.
We should be right at the top.
You can also find the iTunes feed at /itunes, the Google Play feed at /play, and the Direct RSS feed at /rss on talkpython.fm.
We're live streaming most of our recordings these days.
If you wanna be part of the show and have your comments featured on the air, be sure to subscribe to our YouTube channel at talkpython.fm/youtube.
This is your host, Michael Kennedy.
Thanks so much for listening.
I really appreciate it.
Now get out there and write some Python code.