Core ML

One-Class SVM

Learn one boundary around normal data using only normal examples, then flag anything outside it as novel, without seeing an example of what abnormal looks like.

A closed boundary is fit around the normal training cloud using only normal examples, and anything a new point outside that boundary gets flagged, whether or not any anomaly was ever seen during training

Why Does This Exist?

Support vector machines draw the boundary that best separates two labeled classes. Most real novelty-detection problems don't have two labeled classes at all — a manufacturing line has millions of examples of a part passing inspection and essentially none of every way a part could fail, since failures are rare and often haven't happened yet in a way anyone recorded. There's nothing to train a two-class boundary against.

One-class SVM asks a different question entirely: given only examples of "normal", can you learn a boundary that wraps around them, so that anything genuinely new — not just different from a labeled failure class, but different from anything seen during training — falls outside it? That's novelty detection, and it's a meaningfully different task from ordinary anomaly detection: novelty detection assumes the training data is clean and entirely normal, while anomaly detection often has to find anomalies mixed into the training data itself.

Think of It Like This

Learning the shape of a familiar crowd, not the shape of every stranger

A bouncer who's worked one venue for years knows the regulars — their faces, their usual arrival times, roughly how many show up on a normal night. Nobody ever handed the bouncer a labeled list of "troublemakers" to study; troublemakers are rare and each one is different from the last.

What the bouncer actually learned is the shape of a normal night: who tends to be there, and roughly how much variation is ordinary. Someone who doesn't fit that shape at all — not matched against any specific "bad" template, just clearly outside the pattern of a normal night — draws a second look. That's exactly what a one-class boundary does: it never studied an anomaly, it only ever studied normal, and it flags whatever falls outside the shape normal turned out to have.

How It Actually Works

One boundary, fit with no negative examples at all

One-class SVM adapts the same margin-maximizing machinery support vector machines use for two-class separation, but with only one class of training data: it finds a boundary — typically a hypersphere or a more complex shape in a kernel-transformed space — that encloses as much of the normal training data as possible while staying as tight as it can. The kernel trick does the same work here it does for ordinary SVMs: an RBF kernel lets the boundary bend around a normal cluster that isn't a simple circle or ellipse in the original feature space, at the cost of an extra kernel-width hyperparameter to tune.

The nu parameter: pricing how tight the boundary gets

Nu ( $\nu$ ) sets an upper bound on the fraction of training points the boundary is allowed to treat as outliers, and a lower bound on the fraction that can end up as support vectors defining that boundary. A small nu produces a wide, forgiving boundary that wraps loosely around the normal data, catching only points far outside anything seen; a large nu forces a tighter boundary that excludes more of the normal training data itself as if it were already anomalous. This is the same tradeoff SVM's C parameter makes for the two-class case, expressed as a fraction instead of a cost.

The tradeoff nu controls directly

Widen the boundary (small nu) and false positives on genuinely normal data drop, but so does the fraction of real novelties the boundary actually catches, since a looser fit lets more of the unusual-but-not-extreme cases through. Tighten it (large nu) and detection of real novelties improves, but normal data starts falling outside the boundary too, generating false alarms on cases that were never actually a problem. There is no nu that avoids this tradeoff entirely — every setting trades one error type against the other, and the right point on that tradeoff is a business decision about which error costs more, not a property of the data alone.

Show Me the Code

Three nu values, same normal training data, same held-out test set of normal and truly anomalous points.

1import numpy as np2from sklearn.svm import OneClassSVM3
4rng = np.random.default_rng(5)5train = rng.normal(0.0, 1.0, (500, 2))  # "normal" operating data, no anomalies at all6test_normal = rng.normal(0.0, 1.0, (200, 2))7test_anomaly = rng.uniform(-6.0, 6.0, (20, 2))8
9for nu in (0.01, 0.10, 0.40):10    boundary = OneClassSVM(kernel="rbf", gamma="scale", nu=nu).fit(train)11    false_positive_rate = float((boundary.predict(test_normal) == -1).mean())12    caught_rate = float((boundary.predict(test_anomaly) == -1).mean())13    print(f"nu={nu:.2f}  false positives on normal data: {false_positive_rate:.2f}   true anomalies caught: {caught_rate:.2f}")14# -> nu=0.01  false positives on normal data: 0.06   true anomalies caught: 0.7515# -> nu=0.10  false positives on normal data: 0.07   true anomalies caught: 0.9016# -> nu=0.40  false positives on normal data: 0.38   true anomalies caught: 0.95

Raising nu from 0.01 to 0.40 pushes the caught-anomaly rate from 75% to 95%, a real gain — but the false-positive rate on genuinely normal data jumps from 6% to 38% over the same range. Neither setting is simply "better"; each buys more detection at a specific, quantifiable cost in false alarms.

Watch Out For

Training on data that already contains the anomalies you want to catch

One-class SVM's entire premise is that the training set is clean, uncontaminated normal data — feed it a training set with even a small fraction of anomalies mixed in, and the boundary learns to consider those anomalies part of "normal", which is exactly the opposite of the intended effect. If the training data's cleanliness can't be guaranteed, a method built to tolerate some contamination, like isolation forest with a nonzero contamination parameter, is the more honest choice.

Choosing nu to hit a target false-positive rate without checking detection rate too

Nu is often tuned by asking "what false-positive rate can the business tolerate" and stopping there, which silently accepts whatever detection rate falls out of that choice without checking whether it's still useful. A nu chosen purely to minimize false alarms can end up catching so few real novelties that the system provides no practical value at all. Report both rates together for every candidate nu, the same way threshold selection reports both sides of any classification cutoff.

The Quick Version

One-class SVM learns a boundary around normal data using only normal training examples, for novelty detection rather than two-class separation.
The kernel trick lets the boundary bend around normal clusters that aren't simple circles or ellipses in the raw feature space.
Nu bounds the fraction of training points allowed to fall outside the boundary, trading a wider, more forgiving fit against a tighter, stricter one.
Every nu setting trades detection rate against false-positive rate; there's no setting that improves both simultaneously.
The method assumes clean, uncontaminated training data — if that assumption doesn't hold, a contamination-tolerant method is the better fit.