🧠 Autoencoder Reconstruction Error Anomaly Detection Lab

About this simulation

An autoencoder is trained only on normal data, learning to compress each point through a narrow bottleneck and reconstruct it back out. Because it has only ever seen normal patterns, it becomes very good at reconstructing them — but poor at reconstructing anything unusual. The purple surface below is the learned manifold: everywhere the network can faithfully reproduce. Each sphere is a data point; the line from a point down to the surface is its reconstruction error — the core signal used for anomaly scoring.

How it works

• Green points sit close to the manifold — low reconstruction error, classified normal.
• Red points sit far from the manifold — high reconstruction error, flagged as anomalies.
• Raising the bottleneck size gives the network more latent capacity. A little helps it capture normal variation, but too much lets it start memorizing outliers too — reconstruction error for anomalies drops and they become harder to catch, a real overfitting risk in autoencoder-based detection.
• Switching to Density-based scores each point by distance to its nearest neighbour instead — the same idea used by DBSCAN, LOF and One-Class SVM, which need no reconstruction step but can struggle in high dimensions or uneven density.

Controls

• Anomaly rate — fraction of points injected as out-of-distribution outliers.
• Bottleneck size — latent capacity of the autoencoder; higher values fit the manifold more tightly (and can overfit).
• Error threshold — the cutoff score above which a point is flagged.
• Detection method — switch between reconstruction-error and density-based scoring.
• Show error vectors — toggle the lines connecting each point to its reconstruction.
• ↺ Resample data — draws a fresh random dataset. Drag to rotate, scroll to zoom.

Did you know?

Reconstruction-error thresholding is popular precisely because it needs no labelled anomalies to train on — only a clean sample of normal behaviour — which is why it's widely used for fraud, sensor-fault and network-intrusion detection where anomalies are rare and constantly evolving.