What Is an Outlier? A Practical Guide to PyOD in Python

Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.

An outlier is an observation that differs substantially from the pattern expected in its data. That difference may signal an error, fraud, equipment trouble, or a rare but valid event; it is not proof that the record is wrong. PyOD is an open-source Python toolkit for applying and comparing many outlier-detection algorithms through a consistent, scikit-learn-like workflow.

What is an outlier?

An outlier is a data point that departs from a relevant pattern. The relevant pattern depends on the question, the other features, and the observation’s context. A rule such as “anything far from the mean is an outlier” is too narrow: anomalies can be unusual in combinations of features, relative to a local neighborhood, or only at a particular time or place.

#	Preview	Product	Price
1		Python Machine Learning By Example: Unlock machine learning best practices with real-world use cases	$29.55	Buy on Amazon
2		Introduction to Machine Learning with Python: A Guide for Data Scientists	$33.05	Buy on Amazon
3		Machine Learning with PyTorch and Scikit-Learn: Develop machine learning and deep learning models...	$34.23	Buy on Amazon
4		Python Machine Learning: Machine Learning and Deep Learning with Python, scikit-learn, and...	$42.74	Buy on Amazon
5		Hands-On Machine Learning with Scikit-Learn, Keras, and TensorFlow: Concepts, Tools, and Techniques...	$49.50	Buy on Amazon

Different ways an observation can be unusual

• Univariate: a value is unusual in one feature, such as an unusually large transaction amount.
• Multivariate: individual values look ordinary, but their combination is rare—for example, a customer profile whose features do not resemble any established customer group.
• Global: an observation is unusual compared with the full dataset.
• Local: it is unusual compared with nearby observations, even if it is not extreme overall.
• Contextual: a value is unexpected in a particular setting, such as a temperature that is normal in summer but unusual in winter.
• Collective: a group of points or a sequence is abnormal together, such as a sensor pattern that looks normal point by point but is unusual over time.

These categories overlap. A useful detector must match the kind of deviation that matters for the task.

Why detect outliers—and why not delete them automatically?

Outlier detection can help surface fraud and abuse, manufacturing defects, equipment faults, network intrusions, data-quality problems, unusual customer behavior, scientific observations that need review, rare events, and changes in the data’s distribution. An unusual observation may be the signal a team is looking for, not a mistake to remove.

#1 Best Overall

Sale

Python Machine Learning By Example: Unlock machine learning best practices with real-world use cases

$29.55

Buy on Amazon

A flag should usually start an investigation. Depending on the evidence, the right response could be to correct a measurement, separate a new operating regime, escalate a transaction for review, retain the record while using a robust model, or remove a confirmed error. Preserve the original record and document any correction rather than silently discarding flagged rows. An introductory discussion of this distinction also appears in Analytics Vidhya’s overview of outlier detection with PyOD.

What is PyOD?

PyOD (Python Outlier Detection) is an open-source toolkit that brings many outlier and anomaly-detection methods into a common Python ecosystem. Its familiar estimators generally use operations such as fit, predict, and decision_function, making it practical to compare approaches without learning an entirely different interface for each one. The original PyOD paper describes the project as a toolbox for multivariate outlier detection; its scope has since expanded substantially. See the original PyOD paper, the current documentation, and the project repository.

As of August 18, 2026, the PyOD documentation describes more than 60 detectors and a catalog of 61. It covers tabular data as well as time-series, graph, text, image, and audio use cases, with capabilities such as embeddings, ensembles, thresholding utilities, lifecycle orchestration through ADEngine, and agent-oriented workflows. The available algorithms and their prerequisites differ; a base installation should not be assumed to include every optional integration.

PyOD is commonly used for unsupervised detection, but the project also includes supervised or label-assisted methods, including XGBOD and DevNet. The package is distributed under the BSD-2-Clause license. PyPI listed its current release on August 18, 2026, as having been released August 17, 2026, and specifies Python 3.9 or newer. Those release details can change; check PyPI’s PyOD page for the current package metadata.

PyOD or scikit-learn?

scikit-learn already includes outlier and novelty-detection estimators such as Isolation Forest, Local Outlier Factor (LOF), One-Class SVM, SGDOneClassSVM, and EllipticEnvelope. PyOD is not needed just to make scikit-learn detect unusual observations. Its advantage is breadth: it offers additional statistical, proximity-based, density-based, ensemble, neural, graph, and specialized detectors in one ecosystem.

Choose scikit-learn when its available estimators cover the task and its pipelines and broader tooling suit your project. Consider PyOD when you want to compare a wider range of detectors or use an algorithm scikit-learn does not provide. For a local dataset or research workflow, these Python libraries are usually more relevant than a hosted observability platform; managed services make more sense when the need is continuous operational monitoring, dashboards, and alerting rather than a standalone detector.

Rank #2

Sale

Introduction to Machine Learning with Python: A Guide for Data Scientists

$33.05

Buy on Amazon

For details on the estimators and their behavior, consult scikit-learn’s outlier and novelty detection guide.

Install PyOD

The commands below are general Python environment practice; the virtual environment is not a PyOD-specific requirement. Current PyOD package metadata requires Python 3.9 or newer.

1. Create a virtual environment:

   python -m venv .venv

2. Activate it in Windows PowerShell:

   .venvScriptsActivate.ps1

   Or on macOS/Linux:

   source .venv/bin/activate

3. Upgrade pip and install PyOD and the packages used in the examples:

   python -m pip install --upgrade pip
   python -m pip install pyod pandas scikit-learn

To upgrade an existing PyOD installation, run python -m pip install --upgrade pyod. Optional extras cover integrations and model families such as PyTorch, graph, audio, embeddings, and other tools. Consult the package page and the documentation for the extras and prerequisites for the detector you intend to use.

Prepare the data before fitting a detector

PyOD detectors operate on features, so preprocessing can change what counts as unusual. Keep the original row identifiers for review, but exclude identifiers that merely encode row identity. Decide how to handle missing values, encode categorical features in a way the chosen algorithm can use, and remove target information that would leak the answer into the features.

• Scale when the method depends on distance or covariance. KNN, LOF, PCA, and SVM-based approaches can be distorted when features use different units. Tree-based methods such as Isolation Forest are generally less dependent on scale.
• Review skewed features. A log transform may help for heavily skewed positive values, but it should reflect the data and the model’s assumptions.
• Split before learning preprocessing. Fit transformations on training data and apply them to held-out data; do not learn preprocessing statistics from the complete dataset in a production-style evaluation.
• Check feature relevance and population structure. Irrelevant features can obscure anomalies, and one global model may struggle when legitimate groups have different patterns.

For example, a distance-based model can be placed after a scaler in a scikit-learn pipeline:

Rank #3

Sale

Machine Learning with PyTorch and Scikit-Learn: Develop machine learning and deep learning models with Python

$34.23

Buy on Amazon

from sklearn.pipeline import make_pipeline
from sklearn.preprocessing import StandardScaler
from pyod.models.knn import KNN

model = make_pipeline(
    StandardScaler(),
    KNN(contamination=0.05)
)
model.fit(X_train)
predictions = model.predict(X_test)

The example assumes X_train and X_test contain suitable numeric features. Handle missing values and categorical encoding as appropriate for the data and detector.

Choose a detector that matches the anomaly

There is no universally best PyOD algorithm. Start with a small set justified by the data, then validate the results. The following are practical starting points, not guarantees.

PyOD’s catalog also includes methods such as ABOD, MAD, CBLOF, LOCI, Feature Bagging, LSCP, autoencoders, VAE variants, and DeepSVDD. Neural and embedding-based approaches are better treated as later candidates when simpler baselines do not meet the need: they can require extra dependencies, more tuning, and more effort to explain.

Isolation Forest: a useful first baseline

Isolation Forest is a reasonable starting point for many tabular problems. It can model nonlinear structure and usually scales better than neighborhood-based methods, without requiring the distributional modeling of a covariance-based approach. It is not immune to poor feature representation or a badly chosen contamination assumption.

LOF and KNN: when neighborhoods matter

LOF and KNN are useful when unusualness means being sparse or far from nearby observations. Their results are sensitive to the distance metric, feature scaling, and neighborhood size. They can also be misleading when legitimate clusters have substantially different densities.

For future, unseen observations, pay special attention to LOF’s novelty mode. Scikit-learn documents that ordinary LOF is intended for outlier detection on the fitted data; novelty detection requires novelty=True, and predictions for training data should not be treated as interchangeable with fit_predict results. Check the API and behavior of the specific estimator you use.

Rank #4

Sale

Python Machine Learning: Machine Learning and Deep Learning with Python, scikit-learn, and TensorFlow 2, 3rd Edition

$42.74

Buy on Amazon

ECOD, COPOD, PCA, and HBOS: simpler baselines

ECOD and COPOD are distribution-based options that can serve as relatively transparent baselines. PCA is useful when unusual reconstruction or projection error is meaningful in a lower-dimensional structure. HBOS can be fast and simple when feature independence is a reasonable approximation, but it may fail to capture interaction-based anomalies.

Fit a detector and score observations

Here is a small runnable example using Isolation Forest. The array has six illustrative training observations with two numeric features; it is a demonstration, not evidence that any particular detector is accurate for a real dataset.

import numpy as np
from pyod.models.iforest import IForest

X_train = np.array([
    [10.0, 1.0],
    [11.0, 1.2],
    [10.5, 0.9],
    [12.0, 1.1],
    [11.2, 1.0],
    [50.0, 8.0],
])

detector = IForest(contamination=0.10, random_state=42)
detector.fit(X_train)

train_labels = detector.labels_
train_scores = detector.decision_scores_

X_new = np.array([
    [10.8, 1.1],
    [48.0, 7.5],
])

new_scores = detector.decision_function(X_new)
new_labels = detector.predict(X_new)

print(train_labels)
print(train_scores)
print(new_labels)
print(new_scores)

labels_ contains thresholded labels for fitted observations, while decision_scores_ contains their training scores. For new observations, decision_function(X_new) returns scores and predict(X_new) returns labels. PyOD conventions commonly represent outliers with label 1 and inliers with 0; consult the selected detector’s documentation for its exact API and score behavior.

A score is a model-specific measure of abnormality, not a reason. Score direction and meaning should be checked for the selected detector and version. Do not assume that raw scores from different algorithms share a scale or can be compared directly.

Set contamination without treating it as ground truth

In PyOD, contamination represents an expected outlier proportion or is used to establish a decision threshold, depending on the estimator. For example, contamination=0.02 configures the workflow around approximately 2% anomalous observations; it does not prove that the dataset contains exactly 2% true anomalies.

If the actual rate is unknown, try several plausible settings and compare the resulting cases. Validate them with labeled examples, expert review, stability checks, or the costs of false positives and missed anomalies. A threshold should reflect the review capacity and consequences of action as well as the model’s ranking.

Best Value

Sale

Hands-On Machine Learning with Scikit-Learn, Keras, and TensorFlow: Concepts, Tools, and Techniques to Build Intelligent Systems

• Use scikit-learn to track an example ML project end to end
• Explore several models, including support vector machines, decision trees, random forests, and ensemble methods
• Exploit unsupervised learning techniques such as dimensionality reduction, clustering, and anomaly detection
• Dive into neural net architectures, including convolutional nets, recurrent nets, generative adversarial networks, autoencoders, diffusion models, and transformers
• Use TensorFlow and Keras to build and train neural nets for computer vision, natural language processing, generative models, and deep reinforcement learning

$49.50

Buy on Amazon

Review scores, labels, and explanations separately

Keep four questions distinct: the score ranks observations by the detector’s criterion; the label applies a threshold to make an inlier/outlier decision; an explanation describes why a record appears unusual; and an action decides what a person or downstream system should do. A high score is not proof of fraud, bad data, or causation.

Keep row identifiers beside scores and labels so people can investigate the original records. For example, assuming score direction has been verified for the chosen detector:

import pandas as pd

results = pd.DataFrame({
    "row_id": row_ids,
    "anomaly_score": scores,
    "is_outlier": labels == 1,
})

results = results.sort_values(
    "anomaly_score",
    ascending=False
)

Confirm that larger scores mean more anomalous before sorting this way. A review of the highest-ranked cases can establish whether the detector is surfacing relevant issues or simply unusual but legitimate records.

Evaluate detector results

When labels are available

Use metrics that reflect rare-event decisions and operational cost. Precision and recall show different sides of the threshold; precision at a fixed review budget answers how useful the top cases are when reviewers can only inspect a limited number. PR-AUC is often informative when positive cases are rare, while ROC-AUC can also be appropriate. Assess false-positive and false-negative costs, performance across important segments, and threshold behavior. Keep evaluation data separate from the fitting and preprocessing process.

When labels are not available

Do not report accuracy on an unlabeled dataset. Instead, review top-ranked observations with domain experts, check whether rankings are stable across random seeds and resamples, compare detector families, and test sensitivity to scaling and contamination choices. For time-dependent data, use temporal holdouts, monitor drift, and record whether investigations confirm a problem.

Common failure modes to check

• Deleting all flagged rows: this can erase rare but valuable cases. Flag and investigate before changing data.
• Treating contamination as a measured rate: it is a model configuration or thresholding assumption unless independently validated.
• Ignoring scale: features measured in large units can dominate distance-based models.
• Fitting preprocessing on all observations: this leaks information into an evaluation. Learn transformations on training data only.
• Using pointwise methods for sequences: a detector that sees each row independently may miss collective temporal behavior.
• Forcing one model onto multiple populations: segment by product, geography, device, or customer type when groups have different normal patterns; alternatively, model operating regimes separately.
• Using distances blindly in high dimensions: remove irrelevant features, select features with domain knowledge, consider dimensionality reduction, and check stability.
• Confusing a score with an explanation: investigate what drove a flag before acting on it.
• Assuming every capability installs with PyOD: verify the dependency path for the particular neural, graph, audio, or embedding detector.
• Ignoring process changes: a model trained on historical behavior can flag ordinary records after a genuine shift. Use time-based validation, drift checks, and a retraining policy.

When PyOD is enough—and when a managed platform is relevant

PyOD fits local Python development, research, batch scoring, and custom detection pipelines. It is open source under BSD-2-Clause and has no PyOD subscription indicated on its package listing. Scikit-learn is a sensible alternative when its smaller set of estimators suffices and close integration with preprocessing pipelines is the priority.

A managed observability platform serves a different operational need: continuous signals tied to infrastructure, applications, dashboards, and alerting. For example, Datadog’s pricing page lists observability products; those are not direct substitutes for a local PyOD tabular detector. A student or analyst scoring a local dataset may gain little from that additional platform, while a team responsible for production services may need operational monitoring beyond what a Python library provides.

Quick Recap

SaleBestseller No. 1

Python Machine Learning By Example: Unlock machine learning best practices with real-world use cases

$29.55

SaleBestseller No. 2

Introduction to Machine Learning with Python: A Guide for Data Scientists

$33.05

SaleBestseller No. 3

Machine Learning with PyTorch and Scikit-Learn: Develop machine learning and deep learning models with Python

$34.23

SaleBestseller No. 4

Python Machine Learning: Machine Learning and Deep Learning with Python, scikit-learn, and TensorFlow 2, 3rd Edition

$42.74

SaleBestseller No. 5

Hands-On Machine Learning with Scikit-Learn, Keras, and TensorFlow: Concepts, Tools, and Techniques to Build Intelligent Systems

Use scikit-learn to track an example ML project end to end

$49.50

A practical decision path

1. Define the event. Decide whether the target is a global extreme, local density change, contextual deviation, collective sequence, or a known labeled class.
2. Prepare a leakage-safe feature set. Preserve row IDs, handle missing values and categorical features, remove identifiers and leaked targets, and scale where the chosen method needs it.
3. Fit a defensible baseline. Isolation Forest is a reasonable first tabular comparison; add LOF or KNN for local structure, and ECOD or COPOD for distribution-based comparison when appropriate.
4. Inspect scores and labels. Verify score direction, examine top-ranked records, and keep model outputs separate from explanations and actions.
5. Validate before deployment. Use labels if available; otherwise combine expert review, stability checks, segment analysis, and time-aware monitoring.
6. Choose a response, not an automatic deletion rule. Correct, retain, segment, investigate, or remove only according to the evidence and the cost of being wrong.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.