An autoencoder learns to compress each input down to a small bottleneck, then reconstruct it. Trained only on normal data, it reconstructs normal patterns well but struggles with anything unfamiliar.
error = mean((input - reconstruction)^2)
threshold = mean(error_normal) + z(p) * std(error_normal)
flag anomaly if error > threshold
- Bottleneck size — width of the compressed layer. Too small and even normal inputs reconstruct poorly (high baseline error); too large and the network has enough capacity to reconstruct anomalies too well, so the error stops separating normal from anomalous.
- Anomaly rate — fraction of the incoming stream that is genuinely anomalous, hidden from you until each point is reconstructed.
- Threshold percentile — sets the statistical cutoff (mean + z·σ) above which reconstruction error is flagged as anomalous, trading missed anomalies against false alarms.
- Stream speed — how fast new data points are generated and pushed through the network.
Watch the strip below the network: each bar is one reconstructed point's error, green under the threshold line and red above it — the same signal a real anomaly-detection pipeline would alert on.