Most outlier detectors start by describing what "normal" looks like. They fit a density, or measure how far every point sits from its neighbours, and then flag whatever falls outside the comfortable middle. Isolation Forest throws that idea out. It never models normal at all. It just tries to cut each point off from the rest with random slices, and asks one question: how many cuts did that take?
The intuition is almost too simple. Picture a dense blob of points with a couple of strays sitting way off on their own. Draw a random line through the plane. Draw another. Keep slicing, each time keeping only the region a point lives in, until that point is completely alone in its own little cell. A stray out in empty space gets fenced off in one or two cuts, because there is nothing around it to protect it. A point buried in the middle of the crowd needs many cuts, because you have to keep whittling the crowd down before it is finally on its own.
That count of cuts is called the path length, and it is the whole signal. Short path means the point was easy to isolate, which means it was already sitting apart from everyone, which means it is probably an anomaly. Long path means it was deep in the crowd, which means it is normal. You do not need distances, you do not need a density estimate, you do not need to pick a radius. You count cuts.
Building a tree
Each tree is built by recursion. At a node you pick one feature at random, then pick a split value uniformly between that feature's smallest and largest value among the points that reached the node. Send points left or right, recurse on each side, and stop when a point is alone or you hit a depth cap. That is it. The splits are random, there is no target variable, and there is no cleverness in where the cuts go. The randomness is the point.
One tree is noisy. A lucky first cut could isolate a normal point early, or fail to catch a real outlier. So you build a whole forest, usually around a hundred trees, and average each point's path length across all of them. The noise cancels out and a stable ranking falls out: real anomalies are short across almost every tree, normal points are long across almost every tree.
Turning cuts into a score
Raw path length depends on how many points you fed in, so you normalise it. The reference is c(n), the average depth of a point in a random binary tree of n points, which works out to roughly 2·ln(n) minus a small correction. The anomaly score is:
s(x) = 2^(-E(h(x)) / c(n))
where E(h(x)) is the average path length for point x. When paths are very short the exponent pushes the score toward 1, so scores near 1 are clear anomalies. When a point's path is about average, the score sits near 0.5, which reads as "nothing unusual here." That gives you a clean 0-to-1 number you can threshold, or you can tell it a contamination rate and let it flag the top scorers until it hits that fraction.
The subsampling trick
Here is the part that surprised me. Each tree is not trained on the full dataset but on a small random subsample, often just 256 points. That is not only for speed. When you feed in everything, dense clusters and clumps of anomalies mask each other and blur the signal. Thinning the data down to a small sample makes the strays stand out even more, so they isolate faster. Smaller samples also cap the tree depth at about log2 of the sample size, which is why the whole thing runs in near-linear time and stays cheap on millions of rows.
Where it fits
Compared with density methods like DBSCAN or LOF, Isolation Forest measures no distance and picks no scale, so it barely needs tuning and holds up well in high dimensions where distance-based methods fall apart. The catch is that it assumes anomalies are globally rare and different, so a tight cluster of anomalies hiding in a low-density pocket can slip past it. In practice it is a strong first tool for fraud scoring, log and metric monitoring, intrusion detection, and sensor faults.
I built a live version where you can grow the forest one tree at a time, watch the score heatmap form over a scatter, and drag a threshold to flag the outliers. The strip chart makes the whole idea concrete: flagged points really do pile up on the short-path side.
Play with it here: https://dev48v.infy.uk/ml/day26-isolation-forest.html
Top comments (0)