Learn
Interactive·

Outlier Detection

Four outliers together made the z-score rule find nothing

A z>3|z| > 3 rule over a table of server response times returned no outliers at all. Plotting it showed four points clustered near 200 ms, completely detached from the other twenty-four.

The reason is not subtle: those four points had pushed the standard deviation to 51. With a denominator that large, z came out at 2.51 and the rule went quiet — disarmed by exactly what it was supposed to catch. On the same data the IQR fence and the modified z-score flagged all four.

Rule applied to the same 28 valuesOutliers flaggedWhy
z>3|z| > 3 rule0the four points pushed the standard deviation to 51, so z never got past 2.51
IQR fence4quartiles are not dragged around by extreme values
Modified z-score4it measures from the median instead of the mean

Four points anyone would spot in a second on a chart, and the most commonly used rule was the one that missed them.

Outlier work looks like one task — find the far-away values — and is really three. Detect, then diagnose what the value is, then decide what to do. Most of the damage comes from doing the first and skipping the other two.

The key question

Is this value wrong, or is it rare and correct?

1

Concept

Far away and wrong are not the same thing

Outliers come in more than one shape

An outlier is not always a very large number. Some values are perfectly ordinary alone and impossible in combination; others are odd not as points but as a stretch.

Point outlier

extreme on one axis

Far from everything, on a single variable.

Contextual

normal, in the wrong place

28°C is fine in July and alarming in January.

Multivariate

odd only as a pair

Height 150 cm and weight 110 kg are each ordinary.

Collective

a run, not a point

No single value is odd; the stretch is.

  • Point outliers — far from everything on a single variable. The most common kind, and the easiest to find.
  • Contextual outliers — the value is fine, the context is not. 28°C in January.
  • Multivariate outliers — each variable is unremarkable, the combination is not. 150 cm tall and 110 kg.
  • Collective outliers — every value is normal but the run is not. A server returning the identical figure for thirty minutes.

What the standard rules cannot see

Both z-scores and IQR fences find point outliers only. The other three are invisible to them by construction. Test height and weight separately and 150 cm and 110 kg both fall inside the normal range — only the pairing is strange.

The three rules you will meet

Nearly every detection rule in practical use is one of these.

z=xxˉsfence=Q3+1.5IQRzmod=0.6745(xx~)MADz = \frac{x - \bar{x}}{s} \qquad \text{fence} = Q_3 + 1.5 \cdot IQR \qquad z_{\text{mod}} = \frac{0.6745\,(x - \tilde{x})}{\text{MAD}}

What separates them is which statistics they use for the centre and the width. The first takes the mean and the standard deviation; the other two take the median and the quartiles. Everything else follows from that choice.

RuleCut-offAssumesBreaks when
z-score|z| > 3Roughly normalThe outlier inflates σ and hides itself
IQR fenceQ1 − 1.5·IQR, Q3 + 1.5·IQRRoughly symmetricSkewed data flags the whole long tail
Modified z (MAD)|z| > 3.5A meaningful medianMore than half the values are identical
Percentile clipBelow P1, above P99Nothing about the shapeIt always finds 2%, even in clean data
Isolation ForestA contamination rate you setNothing distributionalYou have to state the answer in advance
Mahalanobis distanceχ² quantileMultivariate normalThe covariance is itself dragged by outliers
2

Why It Matters

Three rules, three different answers

The z rule is blunted by what it is hunting

The mean and the standard deviation are the two statistics most sensitive to outliers — and the z-score is built out of both. Add an extreme value and σ grows; once σ grows, that value's own z shrinks.

Table 1 Adding extreme points near 200 one at a time, and how each rule responds
Extreme points presentMeanSDzModified zFence
155.830.64.7125.366.0
261.240.73.4122.567.5
366.047.22.84 — missed20.269.0
470.451.72.51 — missed20.271.1
574.355.02.29 — missed20.174.5

With one extreme point z is 4.71 and catches it cleanly. At three points it drops to 2.84 and slips under the threshold. Over the same range the modified z stays above 20 and the fence never stops flagging. This is masking.

z has a ceiling it cannot pass

There is a deeper problem. In a sample of size n, no value can have a |z| larger than(n1)/n(n-1)/\sqrt{n}. Not unlikely — arithmetically impossible.

Sample size nLargest possible |z|The |z| > 3 rule
102.85Cannot flag anything, ever
153.62Barely functional
254.80Works
1009.90Fine
1,00031.6Fine

On ten observations, z>3|z| > 3 cannot return a result, no matter how absurd a value you plant in there. Run it on a small sample and "no outliers found" is not a finding about the data — it is a fact about the rule.

The IQR fence has its own failure mode

The fence is immune to outliers but assumes symmetry. On anything naturally right-skewed — incomes, wait times, claim sizes — it flags the entire legitimate tail.

Over-flagging on skewed data

Sampling from an exponential distribution, roughly 4.8% of values clear the upper fence.

From a normal distribution the figure is 0.7%.

Same rule, a sevenfold difference in flag rate. On skewed data, log-transform before fencing, or use a rule that accounts for the skew in the first place.

Note that the rate is not zero

Even on clean normal data 0.7% clear the fence. Seven values in a thousand get flagged with nothing whatsoever wrong with them. Being flagged is not evidence that a value is bad.

3

How It Works

Detect, then diagnose, then decide

1. Match the rule to the shape of the data

If the data isUseBecause
Roughly normal, one suspect pointz-score or the fenceBoth perform well
Suspected of holding several outliersModified z (MAD)Resistant to masking
Right-skewedLog-transform, then fenceOtherwise it over-flags
Fewer than 30 observationsLook at the plot yourselfThe z ceiling binds
MultivariateMahalanobis or Isolation ForestUnivariate rules cannot see combinations
A time seriesResiduals, after removing seasonalityContextual outliers hide in the raw series

2. Detection is followed by diagnosis

All a rule ever tells you is "this value is far away". Why it is far away can only be answered by knowing how the data came to exist.

What the value turns out to beWhat to doWhy
A typo — 1800 kg for a personFix it, or set it missingThe true value exists; this is not it
A sentinel — 999 for unknownConvert to missingIt was never a measurement
A unit mix-up — pounds among kilosConvert, do not deleteThe observation is real
A different population — a wholesale orderAnalyse separatelyTwo processes are mixed in one table
A genuine extreme — a real record saleKeep it, and say soDeleting it deletes the finding
UnclearReport both with and withoutLet the reader see how much it mattered

Note that deletion is the right answer in none of the six rows. Typos get fixed or nulled, unit mix-ups get converted, a different population gets analysed separately, and a genuine extreme gets kept.

3. Alternatives to deleting

  • Transform — a log or square root shortens the tail and reduces the pull of extremes without discarding anything.
  • Winsorise — replace the top and bottom 1% with the boundary value. Order is preserved, influence is not.
  • Robust models — quantile regression, Huber loss, tree ensembles. Extremes stop steering the fit.
  • Weighting — down-weight extreme observations. A continuous dial between keeping and dropping.
  • Segment them — if the outliers form a coherent group, that group is a segment, not an error.

4. Log it, and report both ways

Without a record of what you removed, nobody can check the work. And when the call is genuinely ambiguous, reporting the result with and without is the honest option.

  • Record how many were removed and by which rule
  • Summarise the removed observations separately
  • Compute the headline result both ways
  • If the conclusion flips, say so — that is the finding
  • Fit outlier thresholds on the training rows only

When the conclusion flips

If including or excluding a handful of observations changes the answer, you do not have an outlier problem — you have a weak result. That has to be acknowledged before deciding which version to publish.

4

Example

The findings that deletion would have erased

In practice: what automatic removal was deleting

A team running automatic outlier removal in their pipeline finally looked at what it had been throwing away. None of it was an error.

Flagged valueUnder automationWhat it actually was
Order of $84,000DeletedA B2B bulk order — a top-revenue account
Session length of 4 hoursDeletedAn abandoned tab — the session definition is wrong
Response time of 12 secondsDeletedA timeout on one API — a genuine incident
Age of 3DeletedA child using the service on a parent account
47 repeat purchasesDeletedA reseller — deserves its own segment

All five were findings that deletion erased. The third is the worst of them: it was a real outage, and outlier removal was quietly disabling the monitoring.

The lesson here

An outlier is far more often an error in your assumptions than an error in the data. That $84,000 order looked wrong because the analysis assumed a consumer-only customer base. The outlier was reporting that the assumption was false.

In practice: odd only in combination

Health screening data passed univariate checks on height and weight with almost nothing flagged. The scatter plot showed twelve points sitting well off the main body.

Each value fine, the pair impossible

Height 152 cm — near the 5th percentile, comfortably in range

Weight 118 kg — near the 98th percentile, comfortably in range

Both clear any univariate rule. Together they give a BMI of 51, a combination that barely occurs. The cause turned out to be 152 typed where 182 was meant.

Univariate rules alone would have passed all twelve. Once there is more than one variable, you need a rule that looks at the combination.

Common misunderstandings

Misconception 1

❌ If it was flagged, it is an outlier.

Flagging establishes only that a value is far away. Seven in a thousand clear the fence on perfectly normal data. Far away and wrong are different claims.

Misconception 2

❌ Removing outliers before analysis is standard practice.

Removal is defensible only with a reason to believe the value is an error. Without one, it is indistinguishable from adjusting the data until the result comes out the way you wanted.

Misconception 3

❌ |z| > 3 is a general-purpose rule.

At n = 10 it cannot flag anything at all, several outliers hide each other, and on a non-normal distribution the number 3 has no justification behind it.

Misconception 4

❌ Removing outliers improves the model.

It improves the training metrics. But production keeps sending outliers, and a model that has never seen one has no idea what to do when it arrives.

Misconception 5

❌ Outlier thresholds can be set on the full dataset.

The quantiles and standard deviations behind the threshold must come from the training rows only. Otherwise the test data helps decide which test rows get filtered out.

5

Interactive

Drag one point and watch three rules disagree

Drag one point and watch three rules disagree

Twenty-four fixed observations plus one you control. Push the slider right and watch when each rule reacts — and where z stops climbing.

24 fixed observations plus the point you are dragging. Every rule is recomputed after each move.

50100150200250fenceμ + 3σ
z-score |z| > 3
2.71not flagged
IQR fence Q3 + 1.5·IQR
66.0flagged
Modified z |z| > 3.5
3.37not flagged

The fence at 66.0 has already flagged this point while z is only 2.71. The quartiles ignored the newcomer; the mean and SD did not.

A rule built from the mean and SD is disarmed by the outliers it is looking for.

What to look for

  • Which rule reacts first?
  • Push the point to the far end — what does z converge to, and why?
  • At that same position, how high does the modified z go?
  • Turn on masking. What happens to z?
  • With masking on, why does the fence barely move?

Learning points

The μ + 3σ line follows the point to the right as you drag it. The fence does not.

Several extremes hide each other, and a mean-based rule then finds nothing at all.

|z| cannot exceed (n1)/n(n-1)/\sqrt{n}, and on small samples that ceiling sits below 3.

Key takeaways

Detection

Every rule has a blind spot

  • z is disarmed by what it hunts
  • IQR over-flags skewed data
  • Two outliers can mask each other

Diagnosis

Find out what it is before deciding

  • Typo, sentinel, unit, or real
  • Only the first two are errors
  • The rule cannot tell you which

Decision

Deleting is the last resort

  • Transform or model robustly instead
  • Report results with and without
  • Write down what you removed

The question is not "which rule should I use?"

It is "why is this value here?" A rule only tells you where to look. Whether you are seeing an error or a discovery is not something it can answer.

How does this apply to real data?

Outlier handling swings results more than most steps and is unusually easy to document properly. In SKARI you can check the following alongside.

Univariate detection

z-score, Modified z (MAD), IQR Fence, Grubbs

Multivariate detection

Mahalanobis, Isolation Forest, LOF, DBSCAN

Influence diagnostics

Cook's Distance, Leverage, DFBETA

Responses

Winsorize, Log Transform, Robust Regression

Once this clicks, you can answer questions like these.

  • Which detection rule suits the shape of this data?
  • Could several outliers here be masking one another?
  • Is this an error, a different population, or a real extreme?
  • Can I reduce its influence without deleting it?
  • Does the conclusion survive dropping this point?
Now try it on real dataOpen in Lab

Go Deeper

Transforms & Log Transformation