Four outliers together made the z-score rule find nothing
A rule over a table of server response times returned no outliers at all. Plotting it showed four points clustered near 200 ms, completely detached from the other twenty-four.
The reason is not subtle: those four points had pushed the standard deviation to 51. With a denominator that large, z came out at 2.51 and the rule went quiet — disarmed by exactly what it was supposed to catch. On the same data the IQR fence and the modified z-score flagged all four.
| Rule applied to the same 28 values | Outliers flagged | Why |
|---|---|---|
| rule | 0 | the four points pushed the standard deviation to 51, so z never got past 2.51 |
| IQR fence | 4 | quartiles are not dragged around by extreme values |
| Modified z-score | 4 | it measures from the median instead of the mean |
Four points anyone would spot in a second on a chart, and the most commonly used rule was the one that missed them.
Outlier work looks like one task — find the far-away values — and is really three. Detect, then diagnose what the value is, then decide what to do. Most of the damage comes from doing the first and skipping the other two.
The key question
Is this value wrong, or is it rare and correct?
Far away and wrong are not the same thing
An outlier is not always a very large number. Some values are perfectly ordinary alone and impossible in combination; others are odd not as points but as a stretch.
Point outlier
extreme on one axisFar from everything, on a single variable.
Contextual
normal, in the wrong place28°C is fine in July and alarming in January.
Multivariate
odd only as a pairHeight 150 cm and weight 110 kg are each ordinary.
Collective
a run, not a pointNo single value is odd; the stretch is.
What the standard rules cannot see
Both z-scores and IQR fences find point outliers only. The other three are invisible to them by construction. Test height and weight separately and 150 cm and 110 kg both fall inside the normal range — only the pairing is strange.
Nearly every detection rule in practical use is one of these.
What separates them is which statistics they use for the centre and the width. The first takes the mean and the standard deviation; the other two take the median and the quartiles. Everything else follows from that choice.
| Rule | Cut-off | Assumes | Breaks when |
|---|---|---|---|
| z-score | |z| > 3 | Roughly normal | The outlier inflates σ and hides itself |
| IQR fence | Q1 − 1.5·IQR, Q3 + 1.5·IQR | Roughly symmetric | Skewed data flags the whole long tail |
| Modified z (MAD) | |z| > 3.5 | A meaningful median | More than half the values are identical |
| Percentile clip | Below P1, above P99 | Nothing about the shape | It always finds 2%, even in clean data |
| Isolation Forest | A contamination rate you set | Nothing distributional | You have to state the answer in advance |
| Mahalanobis distance | χ² quantile | Multivariate normal | The covariance is itself dragged by outliers |
Three rules, three different answers
The mean and the standard deviation are the two statistics most sensitive to outliers — and the z-score is built out of both. Add an extreme value and σ grows; once σ grows, that value's own z shrinks.
| Extreme points present | Mean | SD | z | Modified z | Fence |
|---|---|---|---|---|---|
| 1 | 55.8 | 30.6 | 4.71 | 25.3 | 66.0 |
| 2 | 61.2 | 40.7 | 3.41 | 22.5 | 67.5 |
| 3 | 66.0 | 47.2 | 2.84 — missed | 20.2 | 69.0 |
| 4 | 70.4 | 51.7 | 2.51 — missed | 20.2 | 71.1 |
| 5 | 74.3 | 55.0 | 2.29 — missed | 20.1 | 74.5 |
With one extreme point z is 4.71 and catches it cleanly. At three points it drops to 2.84 and slips under the threshold. Over the same range the modified z stays above 20 and the fence never stops flagging. This is masking.
There is a deeper problem. In a sample of size n, no value can have a |z| larger than. Not unlikely — arithmetically impossible.
| Sample size n | Largest possible |z| | The |z| > 3 rule |
|---|---|---|
| 10 | 2.85 | Cannot flag anything, ever |
| 15 | 3.62 | Barely functional |
| 25 | 4.80 | Works |
| 100 | 9.90 | Fine |
| 1,000 | 31.6 | Fine |
On ten observations, cannot return a result, no matter how absurd a value you plant in there. Run it on a small sample and "no outliers found" is not a finding about the data — it is a fact about the rule.
The fence is immune to outliers but assumes symmetry. On anything naturally right-skewed — incomes, wait times, claim sizes — it flags the entire legitimate tail.
Over-flagging on skewed data
Sampling from an exponential distribution, roughly 4.8% of values clear the upper fence.
From a normal distribution the figure is 0.7%.
Same rule, a sevenfold difference in flag rate. On skewed data, log-transform before fencing, or use a rule that accounts for the skew in the first place.
Note that the rate is not zero
Even on clean normal data 0.7% clear the fence. Seven values in a thousand get flagged with nothing whatsoever wrong with them. Being flagged is not evidence that a value is bad.
Detect, then diagnose, then decide
| If the data is | Use | Because |
|---|---|---|
| Roughly normal, one suspect point | z-score or the fence | Both perform well |
| Suspected of holding several outliers | Modified z (MAD) | Resistant to masking |
| Right-skewed | Log-transform, then fence | Otherwise it over-flags |
| Fewer than 30 observations | Look at the plot yourself | The z ceiling binds |
| Multivariate | Mahalanobis or Isolation Forest | Univariate rules cannot see combinations |
| A time series | Residuals, after removing seasonality | Contextual outliers hide in the raw series |
All a rule ever tells you is "this value is far away". Why it is far away can only be answered by knowing how the data came to exist.
| What the value turns out to be | What to do | Why |
|---|---|---|
| A typo — 1800 kg for a person | Fix it, or set it missing | The true value exists; this is not it |
| A sentinel — 999 for unknown | Convert to missing | It was never a measurement |
| A unit mix-up — pounds among kilos | Convert, do not delete | The observation is real |
| A different population — a wholesale order | Analyse separately | Two processes are mixed in one table |
| A genuine extreme — a real record sale | Keep it, and say so | Deleting it deletes the finding |
| Unclear | Report both with and without | Let the reader see how much it mattered |
Note that deletion is the right answer in none of the six rows. Typos get fixed or nulled, unit mix-ups get converted, a different population gets analysed separately, and a genuine extreme gets kept.
Without a record of what you removed, nobody can check the work. And when the call is genuinely ambiguous, reporting the result with and without is the honest option.
When the conclusion flips
If including or excluding a handful of observations changes the answer, you do not have an outlier problem — you have a weak result. That has to be acknowledged before deciding which version to publish.
The findings that deletion would have erased
A team running automatic outlier removal in their pipeline finally looked at what it had been throwing away. None of it was an error.
| Flagged value | Under automation | What it actually was |
|---|---|---|
| Order of $84,000 | Deleted | A B2B bulk order — a top-revenue account |
| Session length of 4 hours | Deleted | An abandoned tab — the session definition is wrong |
| Response time of 12 seconds | Deleted | A timeout on one API — a genuine incident |
| Age of 3 | Deleted | A child using the service on a parent account |
| 47 repeat purchases | Deleted | A reseller — deserves its own segment |
All five were findings that deletion erased. The third is the worst of them: it was a real outage, and outlier removal was quietly disabling the monitoring.
The lesson here
An outlier is far more often an error in your assumptions than an error in the data. That $84,000 order looked wrong because the analysis assumed a consumer-only customer base. The outlier was reporting that the assumption was false.
Health screening data passed univariate checks on height and weight with almost nothing flagged. The scatter plot showed twelve points sitting well off the main body.
Each value fine, the pair impossible
Height 152 cm — near the 5th percentile, comfortably in range
Weight 118 kg — near the 98th percentile, comfortably in range
Both clear any univariate rule. Together they give a BMI of 51, a combination that barely occurs. The cause turned out to be 152 typed where 182 was meant.
Univariate rules alone would have passed all twelve. Once there is more than one variable, you need a rule that looks at the combination.
Misconception 1
❌ If it was flagged, it is an outlier.
Flagging establishes only that a value is far away. Seven in a thousand clear the fence on perfectly normal data. Far away and wrong are different claims.
Misconception 2
❌ Removing outliers before analysis is standard practice.
Removal is defensible only with a reason to believe the value is an error. Without one, it is indistinguishable from adjusting the data until the result comes out the way you wanted.
Misconception 3
❌ |z| > 3 is a general-purpose rule.
At n = 10 it cannot flag anything at all, several outliers hide each other, and on a non-normal distribution the number 3 has no justification behind it.
Misconception 4
❌ Removing outliers improves the model.
It improves the training metrics. But production keeps sending outliers, and a model that has never seen one has no idea what to do when it arrives.
Misconception 5
❌ Outlier thresholds can be set on the full dataset.
The quantiles and standard deviations behind the threshold must come from the training rows only. Otherwise the test data helps decide which test rows get filtered out.
Drag one point and watch three rules disagree
Twenty-four fixed observations plus one you control. Push the slider right and watch when each rule reacts — and where z stops climbing.
24 fixed observations plus the point you are dragging. Every rule is recomputed after each move.
The fence at 66.0 has already flagged this point while z is only 2.71. The quartiles ignored the newcomer; the mean and SD did not.
A rule built from the mean and SD is disarmed by the outliers it is looking for.
Learning points
The μ + 3σ line follows the point to the right as you drag it. The fence does not.
Several extremes hide each other, and a mean-based rule then finds nothing at all.
|z| cannot exceed , and on small samples that ceiling sits below 3.
Detection
Every rule has a blind spot
Diagnosis
Find out what it is before deciding
Decision
Deleting is the last resort
The question is not "which rule should I use?"
It is "why is this value here?" A rule only tells you where to look. Whether you are seeing an error or a discovery is not something it can answer.
Outlier handling swings results more than most steps and is unusually easy to document properly. In SKARI you can check the following alongside.
Univariate detection
z-score, Modified z (MAD), IQR Fence, Grubbs
Multivariate detection
Mahalanobis, Isolation Forest, LOF, DBSCAN
Influence diagnostics
Cook's Distance, Leverage, DFBETA
Responses
Winsorize, Log Transform, Robust Regression
Once this clicks, you can answer questions like these.