Chapter map

1. 1. The practical need for novelty detection
2. 2. From observations to feature vectors
3. 3. The separating-hyperplane idea
4. 4. Reading the primal optimisation
5. 5. A transparent score calculation
6. 6. Why kernels change the boundary
7. 7. The dual view and support vectors
8. 8. What ν controls
9. 9. Kernel bandwidth and model flexibility
10. 10. Scaling defines similarity
11. 11. Training-set curation
12. 12. From sample scores to alerts
13. 13. Thresholds and score calibration
14. 14. Diagnosing an alert
15. 15. Relationship to SVDD
16. 16. Failure modes worth testing
17. 17. Time-aware validation
18. 18. A learning pathway for students
19. 19. Guidance for parents and teachers
20. 20. Responsible deployment and review

Visit the How Mathematics Works hub for the wider series and its connections to education, reasoning, science, computing, design and careers.

---

1. The practical need for novelty detection

The central mathematical idea is concrete. Many assets produce abundant records of routine operation and only a few confirmed faults. A one-class method asks what reference behaviour looks like and flags observations that do not fit it. This matches the label imbalance but changes the meaning of evaluation.

A concrete situation

A chiller may have months of healthy temperature, pressure and power data but only two compressor incidents. A novelty detector can learn a reference envelope without pretending those two incidents represent every future failure.

What the mathematics does not license

“Novel” does not mean “faulty.” A new setpoint, maintenance action or sensor replacement can be novel and healthy. Operational context must accompany the score. Keeping this boundary clear makes the result easier to audit and transfer.

Try it, check it, transfer it

Write three causes of novelty for one system: one fault, one benign operating change and one data-quality problem. Plan how a reviewer could distinguish them. Then explain the result to someone who has not seen the formula. If the explanation needs a hidden assumption, add that assumption to the model record.

---

2. From observations to feature vectors

Here the geometry becomes operational. Represent each time point or window as x in R^p. Features may be raw sensors, physical residuals, trends or spectral summaries. The One-Class SVM sees the supplied vector, not the equipment itself.

A concrete situation

A vibration window might become RMS amplitude, crest factor and band energies. A thermal process might use temperatures, differences and rates of change.

What the mathematics does not license

Feature engineering can leak future data or encode the answer if a window crosses an event boundary. Units and missing-value rules also shape distance and kernel similarity. A trustworthy workflow records the choice before seeing the final test result.

Try it, check it, transfer it

Create a feature dictionary with definition, unit, sampling window, causal availability and expected healthy range. Remove features that would not exist at decision time. Then explain the result to someone who has not seen the formula. If the explanation needs a hidden assumption, add that assumption to the model record.

---

3. The separating-hyperplane idea

This step deserves a careful pause. The standard One-Class SVM maps x to φ(x) and seeks a hyperplane that separates mapped training data from the origin with a large margin. The offset ρ positions the boundary; slack variables permit exceptions.

A concrete situation

The decision function has the form f(x)=w·φ(x)-ρ. Positive and negative sides are conventional, so always check the library’s sign before connecting it to an alarm.

What the mathematics does not license

The origin is part of the mathematical construction in feature space. It should not be described as a physical zero state of the machine. Evidence becomes stronger when the limitation is tested instead of hidden.

Try it, check it, transfer it

Draw a two-dimensional feature-space sketch with training points, origin, hyperplane, normal w and margin. Label which side your implementation calls normal. Then explain the result to someone who has not seen the formula. If the explanation needs a hidden assumption, add that assumption to the model record.

---

4. Reading the primal optimisation

The useful question is not only how to calculate, but what the calculation assumes. A standard primal is min ½||w||² +(1/(νn))Σξ_i -ρ subject to w·φ(x_i)≥ρ-ξ_i and ξ_i≥0. Every term has a job: simplicity, exceptions and separation.

A concrete situation

A larger ρ is rewarded by the minus sign, while the norm and slack prevent an unlimited or careless solution. ν balances tolerated violations against margin geometry.

What the mathematics does not license

Changing scaling changes φ(x), so it changes the optimisation even when ν stays fixed. The objective is convex for the standard fixed-kernel problem, but data design remains the harder question. Keeping this boundary clear makes the result easier to audit and transfer.

Try it, check it, transfer it

Annotate the objective term by term, including units or lack of units. Explain what behaviour would occur if the slack penalty disappeared. Then explain the result to someone who has not seen the formula. If the explanation needs a hidden assumption, add that assumption to the model record.

---

5. A transparent score calculation

A small example makes the mechanism visible. For an illustration, choose one-dimensional φ(x)=x, w=1 and ρ=0.5. Then f(x)=x-0.5: training-like values 1,2,3 have positive scores, while x=0.2 has score -0.3.

A concrete situation

This arithmetic shows how a signed distance-like score leads to a side of the boundary. It is a chosen example, not a fitted One-Class SVM, because w and ρ were supplied rather than optimised.

What the mathematics does not license

Calling f a calibrated probability would be wrong. Its scale depends on kernel, features and fitted coefficients. A trustworthy workflow records the choice before seeing the final test result.

Try it, check it, transfer it

Recalculate with ρ=1.5. Observe which points change side and explain how moving the offset changes the reference region. Then explain the result to someone who has not seen the formula. If the explanation needs a hidden assumption, add that assumption to the model record.

---

6. Why kernels change the boundary

This is where modelling choices begin to affect evidence. A kernel K(x,z)=φ(x)·φ(z) computes inner products without explicitly listing all feature-space coordinates. An RBF kernel exp(-γ||x-z||²) gives high similarity to nearby points and low similarity to distant ones.

A concrete situation

If squared distance is 1 and γ=0.5, similarity is exp(-0.5)≈0.6065. At squared distance 4 it is exp(-2)≈0.1353.

What the mathematics does not license

Kernels do not discover the correct notion of similarity automatically. Irrelevant features, poor scaling or an unsuitable γ can make the boundary fragmented or nearly flat. Evidence becomes stronger when the limitation is tested instead of hidden.

Try it, check it, transfer it

Calculate RBF similarities for three distances at two γ values. Describe which setting makes the model more local and why that can increase sensitivity. Then explain the result to someone who has not seen the formula. If the explanation needs a hidden assumption, add that assumption to the model record.

---

7. The dual view and support vectors

The central mathematical idea is concrete. In the dual, the score is built from selected training observations: f(x)=Σα_iK(x_i,x)-ρ, with coefficient constraints tied to ν and n. Observations with nonzero α_i are support vectors.

A concrete situation

Support vectors carry the boundary calculation. A new point is compared through kernels to them rather than through an explicit w when using an RBF kernel.

What the mathematics does not license

A support vector is not automatically a bad sample. Many lie near the learned boundary and are essential representatives of healthy variation. Keeping this boundary clear makes the result easier to audit and transfer.

Try it, check it, transfer it

Inspect support-vector fraction, operating modes and time locations. A concentration in one batch can reveal sampling imbalance or an unstable regime. Then explain the result to someone who has not seen the formula. If the explanation needs a hidden assumption, add that assumption to the model record.

---

8. What ν controls

Here the geometry becomes operational. For the standard formulation, ν in (0,1] provides an upper bound on the fraction of training errors and a lower bound on the fraction of support vectors under the paper’s stated setting. It is a modelling control, not a future prevalence estimate.

A concrete situation

With n=1,000 and ν=0.05, the optimisation is allowed a particular slack trade-off; one should not translate that into “exactly 50 faults.”

What the mathematics does not license

Duplicate points, numerical tolerance and parameter conventions can affect observed fractions. Software documentation matters. A trustworthy workflow records the choice before seeing the final test result.

Try it, check it, transfer it

Sweep ν across a sensible grid and record training violations, support-vector fraction and validation alarm rate. Look for stable operating regions. Then explain the result to someone who has not seen the formula. If the explanation needs a hidden assumption, add that assumption to the model record.

---

9. Kernel bandwidth and model flexibility

This step deserves a careful pause. For an RBF kernel, γ determines how quickly similarity decays. Small γ creates broad influence and a smooth boundary; large γ creates narrow influence and potentially intricate islands around training points.

A concrete situation

A broad boundary may miss local anomalies. A narrow boundary may call normal drift anomalous and can memorise the training sample.

What the mathematics does not license

Choosing γ from training fit alone rewards complexity. A median-distance heuristic can start a search, but it is not a final scientific justification. Evidence becomes stronger when the limitation is tested instead of hidden.

Try it, check it, transfer it

Tune γ using held-out healthy periods and known events, then stress-test on shifted but acceptable regimes. Report the whole sensitivity curve. Then explain the result to someone who has not seen the formula. If the explanation needs a hidden assumption, add that assumption to the model record.

---

10. Scaling defines similarity

The useful question is not only how to calculate, but what the calculation assumes. An RBF kernel uses squared distance, so a high-variance or large-unit feature can dominate. Fit scaling on training data and keep physical interpretation available alongside the transformed coordinates.

A concrete situation

A pressure in kilopascals and a dimensionless efficiency ratio should not compete accidentally through their numeric magnitudes.

What the mathematics does not license

Aggressive clipping can hide true extremes. Global standardisation before a chronological split leaks later distribution information. Keeping this boundary clear makes the result easier to audit and transfer.

Try it, check it, transfer it

For every feature, compare raw and scaled contributions to one pairwise squared distance. This exposes which channels control similarity. Then explain the result to someone who has not seen the formula. If the explanation needs a hidden assumption, add that assumption to the model record.

---

11. Training-set curation

A small example makes the mechanism visible. The reference set should cover expected healthy modes, seasons, loads and controller states while excluding confirmed faults and corrupted intervals. Diversity is useful only when it represents behaviour the model should accept.

A concrete situation

A motor model trained only at half load may flag full load continuously. Adding verified full-load data can fix coverage; adding an unlabeled bearing fault can corrupt the boundary.

What the mathematics does not license

A one-class algorithm does not absolve label work. Baseline selection is a substantive engineering decision. A trustworthy workflow records the choice before seeing the final test result.

Try it, check it, transfer it

Create an inclusion log for each training period: operating regime, maintenance status, sensor health, reason for inclusion and reviewer. Then explain the result to someone who has not seen the formula. If the explanation needs a hidden assumption, add that assumption to the model record.

---

12. From sample scores to alerts

This is where modelling choices begin to affect evidence. A raw sign can be too sensitive for operations. Teams often require persistence, combine nearby samples or calibrate a secondary threshold on held-out healthy data.

A concrete situation

An alert might require five negative scores within ten minutes plus valid sensor-quality checks. This reduces single-sample noise while preserving a documented response time.

What the mathematics does not license

Smoothing can delay detection, and tuning persistence on known incidents can overfit their duration. Evidence becomes stronger when the limitation is tested instead of hidden.

Try it, check it, transfer it

Plot event timelines with raw score, threshold, persistence state and maintenance record. Measure detection delay and false alerts per operating hour. Then explain the result to someone who has not seen the formula. If the explanation needs a hidden assumption, add that assumption to the model record.

---

13. Thresholds and score calibration

The central mathematical idea is concrete. The zero boundary comes from the fitted optimisation, but an operational threshold can differ when costs and validation evidence justify it. Calibrate only after the model and preprocessing are frozen.

A concrete situation

If a slightly positive score region contains many false alerts due to numerical jitter, an operational margin may be useful. If early faults remain positive, a higher sensitivity threshold may be considered.

What the mathematics does not license

Changing the threshold changes the operating point; it does not improve the underlying representation. Probabilities require separate, defensible calibration data. Keeping this boundary clear makes the result easier to audit and transfer.

Try it, check it, transfer it

Build a validation table across thresholds: event detection, median delay, false alerts, workload and missed-event consequences. Then explain the result to someone who has not seen the formula. If the explanation needs a hidden assumption, add that assumption to the model record.

---

14. Diagnosing an alert

Here the geometry becomes operational. One-Class SVM answers a boundary question, not a root-cause question. Pair the score with sensor residuals, local comparisons, counterfactual perturbations or a supervised diagnostic model.

A concrete situation

If a point becomes normal when one vibration band is restored to its recent baseline, that feature is relevant to the decision. The result is still associative.

What the mathematics does not license

Kernel explanations can be unstable among correlated variables. Changing one feature alone may create an impossible physical combination. A trustworthy workflow records the choice before seeing the final test result.

Try it, check it, transfer it

Group related sensors, test plausible perturbations and compare with maintenance evidence. State uncertainty rather than manufacturing a single cause. Then explain the result to someone who has not seen the formula. If the explanation needs a hidden assumption, add that assumption to the model record.

---

15. Relationship to SVDD

This step deserves a careful pause. Support Vector Data Description seeks a compact sphere in feature space, while the One-Class SVM separates data from the origin. Under some kernels and conditions their decisions are closely related, but their formulations and parameters should not be casually conflated.

A concrete situation

Comparing both on the same split can reveal whether the geometry choice matters for an application.

What the mathematics does not license

Different software packages may name parameters similarly while scaling them differently. Identical labels do not prove identical models. Evidence becomes stronger when the limitation is tested instead of hidden.

Try it, check it, transfer it

Read the mathematical objective in the documentation, record kernel conventions and compare decisions on a small hand-checkable dataset. Then explain the result to someone who has not seen the formula. If the explanation needs a hidden assumption, add that assumption to the model record.

---

16. Failure modes worth testing

The useful question is not only how to calculate, but what the calculation assumes. Unseen healthy regimes, seasonal drift, sensor replacement, synchronisation errors and missing-value imputation can all create novelty. High dimensions can also make distances less informative.

A concrete situation

A recalibrated flow sensor may shift every record without any process fault. The model correctly sees change but cannot know its benign cause.

What the mathematics does not license

Automatically adding alerted points to training risks teaching the model to accept a growing fault. Keeping this boundary clear makes the result easier to audit and transfer.

Try it, check it, transfer it

Run challenge sets for each failure mode and define a safe response: investigate, fall back, recalibrate or retrain after approval. Then explain the result to someone who has not seen the formula. If the explanation needs a hidden assumption, add that assumption to the model record.

---

17. Time-aware validation

A small example makes the mechanism visible. Keep runs, assets or time blocks together. Random row splits allow near-duplicate autocorrelated observations to appear in both training and test sets, exaggerating generalisation.

A concrete situation

Train on earlier verified healthy blocks, tune on later blocks and test on an untouched final period with documented incidents. Cross-asset validation answers a different question and should be labelled.

What the mathematics does not license

A high ROC AUC can coexist with intolerable alert frequency. Event-level metrics and maintenance workload are essential. A trustworthy workflow records the choice before seeing the final test result.

Try it, check it, transfer it

Report false alerts per 100 operating hours, event coverage, detection delay and performance by load regime, alongside any sample-level metric. Then explain the result to someone who has not seen the formula. If the explanation needs a hidden assumption, add that assumption to the model record.

---

18. A learning pathway for students

This is where modelling choices begin to affect evidence. Build a linear one-dimensional score first, then compute RBF kernels for a few points. Next fit a library implementation and inspect support vectors, ν and γ.

A concrete situation

Use a simple dataset with one dense reference cluster and several deliberately different points. Change one parameter at a time and explain the result before looking at the plot.

What the mathematics does not license

Treating the package as a magic anomaly detector blocks transfer. The transferable skill is connecting geometry, optimisation and evidence. Evidence becomes stronger when the limitation is tested instead of hidden.

Try it, check it, transfer it

Keep a parameter diary: hypothesis, change, expected effect, observed effect and revised explanation. Then explain the result to someone who has not seen the formula. If the explanation needs a hidden assumption, add that assumption to the model record.

---

19. Guidance for parents and teachers

The central mathematical idea is concrete. Ask what the model learned, what a negative score means and what else can cause novelty. Invite the learner to distinguish classification, probability and investigation.

A concrete situation

Connect the topic to school algebra through dot products, inequalities and graphs, then to computing through kernels and optimisation.

What the mathematics does not license

Avoid promises that one technique guarantees an AI career or a particular result. Mathematics education builds options through durable reasoning and communication. Keeping this boundary clear makes the result easier to audit and transfer.

Try it, check it, transfer it

Celebrate careful limits: “This score supports a check” is stronger thinking than “the machine is broken.” Then explain the result to someone who has not seen the formula. If the explanation needs a hidden assumption, add that assumption to the model record.

---

20. Responsible deployment and review

Here the geometry becomes operational. Version training intervals, feature code, scaler, kernel, ν, γ, support vectors, ρ and alert logic. Monitor input drift, support coverage, alert burden and confirmed outcomes.

A concrete situation

A staged rollout can run silently beside existing checks before alerts reach operators. Incident review can compare model evidence with physical inspection.

What the mathematics does not license

If responsibilities are unclear, even a mathematically sound score can create alarm fatigue or delayed action. A trustworthy workflow records the choice before seeing the final test result.

Try it, check it, transfer it

Assign owners for data quality, threshold approval, incident review and retraining. Define rollback criteria before the first live alert. Then explain the result to someone who has not seen the formula. If the explanation needs a hidden assumption, add that assumption to the model record.

---

A seven-day practice lab

1. Day 1: define the decision, observation unit, X variables and Y or reference condition.
2. Day 2: reproduce the smallest worked example and check every dimension, unit and sign.
3. Day 3: build a transparent baseline and write what it assumes.
4. Day 4: fit the main method inside a training-only pipeline; record every parameter.
5. Day 5: challenge one assumption with a deliberately difficult dataset or operating regime.
6. Day 6: compare validation metrics with the practical workload created by errors.
7. Day 7: present one supported conclusion, one unresolved uncertainty and one safe next experiment.

Questions for a student, parent or mentor

• Which part of the model is a mathematical definition, and which part is a choice?
• What small calculation would catch a sign, scale or dimension error?
• What evidence comes from training, validation and the untouched test?
• What benign condition could look like a fault or prediction failure?
• How would the answer change for another response, asset, school project or time period?
• What should a human review before acting on the score?

A method-specific audit before deployment

A novelty audit should name the accepted world. Record the loads, seasons, assets, controller states and sensor versions represented in the reference set. The model's practical claim is limited to that documented world. Map support vectors back to timestamps and conditions: concentration around start-up may mean the boundary is describing transitions, while concentration near maintenance may reveal contamination. Support vectors are not automatically bad records, but their context explains which observations carry the boundary and where reference coverage is thin.

Keep score ordering separate from probability. A more negative decision value may place a record farther onto the novelty side under the fitted function, but it is not automatically twice as risky. Calibrating risk needs representative labelled outcomes. Challenge the detector with benign novelty, including a verified healthy regime, recalibration and controlled setpoint change. Also test slow deterioration that stays near the boundary. Measure how persistence logic changes alert delay. Abrupt anomalies and gradual faults are different detection problems, and a single threshold may not serve both well.

Record investigation outcomes without creating self-confirming labels. An operator may dismiss an alert because evidence is incomplete or action is deferred; that does not prove the observation was healthy. Use reviewed categories such as confirmed fault, benign regime, data issue, unresolved and maintenance-related change. Maintain a frozen evaluation stream, so the model is not judged only on cases it helped define. Report alert workload and unresolved cases with detection metrics. This turns the boundary into one source of operational evidence rather than an unquestioned verdict.

Run a reproducibility check from stored support vectors, dual coefficients, kernel settings and offset. Recompute several decision values independently and compare them with the production service. Include points close to zero, because small numerical differences can change the side of the boundary. If the operational threshold uses persistence or a margin beyond zero, reproduce that logic too. The test should end with the same alert state, not merely the same floating-point score.

Before retraining, compare old and candidate boundaries on a fixed reference panel containing routine points, known faults, benign novelties and data-quality failures. Count which decisions change and explain them by regime. A lower aggregate false-alarm rate may come from accepting a previously important fault pattern. Change control is therefore a case-by-case review as well as a summary metric.

---

Frequently asked questions

What makes a One-Class SVM “one class”?

Training focuses on a reference distribution, often healthy behaviour, rather than learning a boundary between many labelled fault classes.

Is ν the expected fault rate?

No. In the standard formulation it controls the trade-off and has bounds involving training errors and support vectors. It should not be presented as a known future fault probability.

Does a negative score prove a fault?

No. It means the record falls on the model’s novelty side of the fitted boundary. Sensor error, a new healthy regime or preprocessing drift can also cause it.

Why use an RBF kernel?

It permits curved boundaries in the original input space through similarity calculations, but its bandwidth must be tuned and checked.

Can I train on contaminated healthy data?

Small contamination may be tolerated depending on ν and geometry, but substantial or structured contamination can redefine the reference region. Curate and audit the baseline.

How should alarms be reported?

Report score, persistence, operating context, input-quality checks and supporting sensor changes. Keep the model as evidence for investigation, not a final diagnosis.

---

Primary source and fact-check note

Bernhard Schölkopf, John C. Platt, John Shawe-Taylor, Alex J. Smola and Robert C. Williamson, “Estimating the Support of a High-Dimensional Distribution,” Neural Computation 13(7), 1443–1471 (2001), DOI 10.1162/089976601750264965. Definitions and core claims in this article were checked against this primary publication. Calculations shown here were independently recomputed. Examples are educational illustrations; they are not reported industrial performance results.

Useful next reading

• Support Vector Data Description
• Fisher Discriminant Analysis
• Set-membership fault diagnosis

Keep the options open. Mathematics education supports clearer questions, transferable problem-solving skills and informed choices across science, engineering, computing, AI, statistics, design and many other careers. It does not guarantee intelligence, income, admission or employment; those outcomes depend on far more than one subject or model.

A final alert rehearsal

Before release, replay one confirmed event, one benign novel regime and one corrupted sensor interval from raw inputs. Reconstruct features, scaling, kernel scores, persistence and the operator-facing message. Check that each case reaches the intended route and that the evidence shown is sufficient for a human decision. Record elapsed time, missing context and any manual workaround. This rehearsal tests the complete decision system rather than the classifier alone, and it gives students a clear example of how optimisation, software and responsible communication meet in practice.