AI anomaly detection learns what normal looks like, from images of good parts or signals from a healthy machine, and flags anything that deviates. Because it is trained mostly on good examples, it can catch defects and faults that were never seen during training. That makes it the natural choice when bad parts are rare, defects are unpredictable or a product is too new to have a defect library.
This article is part of our guide to industrial AI. Anomaly detection works on both camera images and sensor data, so it bridges AI vision inspection and data acquisition. Here we cover how it works, how to set the threshold, and where it fits next to classifiers.
Supervised classification vs anomaly detection
Most AI inspection models are supervised: they learn from labeled examples of each defect type and output a class. Anomaly detection, usually unsupervised or semi-supervised, flips the problem. It models the normal population and measures how far a new example sits from it.
| Supervised defect classifier | Anomaly detection | |
|---|---|---|
| Trained on | Good parts and labeled examples of each defect | Mostly or only good parts |
| Output | Defect class and confidence | Anomaly score, often with a heatmap of where |
| Finds unseen defects | No; only classes it was trained on | Yes, if they look different from normal |
| Names the defect type | Yes | No; it says “different”, not “scratch” |
| Data effort | Collect and label many defects | Collect many good parts covering normal variation |
| Best for | Known, recurring defects that need sorting by type | Rare, unpredictable or new defects; new products |
How anomaly detection works on images
Three families of methods dominate industrial vision:
- Feature-embedding methods. A pre-trained network turns small patches of each good image into feature vectors, stored as a “memory bank” of normal. At run time, each patch of a new image is compared with its nearest normal neighbors; patches far from anything normal light up in the heatmap. These are currently among the most accurate approaches on industrial benchmarks.
- Reconstruction methods. An autoencoder learns to compress and rebuild good images. It rebuilds normal regions well and defects poorly, so the difference between input and reconstruction highlights the anomaly.
- Student-teacher and normalizing-flow methods. Models learn the statistics of normal features; regions where predictions disagree or probability is low are flagged.
All of them need consistent imaging. The model learns everything about normal, including lighting, position and background, so a shadow or a shifted part can look as anomalous as a crack. Fixturing, lighting and alignment matter even more than with a classifier.
How anomaly detection works on sensor data
The same idea applies to vibration, motor current, pressure, temperature and test-station measurements captured by a DAQ system:
- Acquire. Sample fast enough for the phenomenon: bearing faults show up in vibration at kilohertz frequencies, so sample rates of tens of kilohertz are common, with proper anti-aliasing (see sampling rate and anti-aliasing).
- Extract features. Compute RMS, peak, kurtosis and crest factor, spectral band energies from an FFT, or cycle-by-cycle shape features for a press or pump stroke.
- Model normal. Fit a statistical model, an isolation forest, a one-class model or an autoencoder to features from healthy operation across normal speeds, loads and temperatures.
- Score and alarm. Score each new window and alarm when the score stays above a threshold, rather than on a single spike.
For the sensor and wiring side, our articles on signal conditioning and high-speed data acquisition go deeper. Anomaly detection on machine data is also the foundation of AI predictive maintenance.
Setting the threshold: a worked example
An anomaly model outputs a score, not a verdict. Where you set the threshold trades false rejects against escapes, so set it from data, not by eye:
- Score a large validation set of good parts the model has not seen, for example 5,000 images.
- Choose a threshold at a high percentile of those scores. At the 99.9th percentile, about 0.1% of good parts score above it.
- Check recall on every real defect you have: what share score above the threshold?
- Adjust, and record the final threshold and both rates in the validation report.
What does 0.1% mean on the floor? At 300 parts per minute, an 8-hour shift is 300 × 480 = 144,000 parts. A 0.1% false-reject rate is about 144 good parts rejected per shift. If that is too many to re-inspect, raise the threshold and confirm you still catch the defects that matter, or add a second-stage classifier to clear obvious false alarms.
| Threshold (percentile of good scores) | Expected false rejects | Per 144,000-part shift |
|---|---|---|
| 99% | 1% | 1,440 |
| 99.5% | 0.5% | 720 |
| 99.9% | 0.1% | 144 |
| 99.99% | 0.01% | about 14 |
Raising the threshold always risks missing subtle defects, which is why the defect-recall check in step 3 is not optional.
When to use anomaly detection
- Defects are rare, so you cannot collect hundreds of examples of each
- Defect types are unpredictable: contamination, foreign material, damage in shipping
- A new product launches before any defect history exists
- You want a safety net behind a classifier that only knows known defects
- Machine faults are rare and every machine is a little different
Limits to plan for
- It cannot name the defect. Pair it with a classifier, or a person, if you need to sort by type.
- Normal must be complete. Every acceptable variation (lots, colors, suppliers, operating speeds) must be in the training set, or it will be flagged.
- Drift. As tools wear and materials change, normal moves. Monitor score distributions and retrain on fresh good data.
- Subtle defects. Defects that look almost normal can score below the threshold; verify recall on real examples.
Anomaly detection and classification together
A robust inspection often runs both. The anomaly model flags anything unusual; a classifier names the known defects; whatever is anomalous but not a known class is set aside for review. Reviewed images then become new training data, so the classifier grows over time. For flagged images, a vision language model can also draft a description for the operator, as discussed in VLM vs LLM.
Rare defects, few bad samples?
Sciotex designs and builds industrial AI systems that use anomaly detection on images and sensor data, with thresholds validated on your parts, designed, programmed, built and supported in the US since 1997.
Frequently asked questions
It is an AI technique that learns what normal parts or normal machine behavior look like and flags anything that deviates, so it can catch defects or faults that were never seen during training.
A classifier is trained on labeled examples of each defect and names the defect type. Anomaly detection is trained mostly on good examples and outputs how unusual a part is, without naming the defect.
Yes. Unsupervised methods learn only from good examples. Real defect examples are still needed to validate that the threshold catches the defects that matter.
Score a large set of unseen good parts, pick a high percentile of their scores as the threshold to fix the false-reject rate, then check that real defects score above it and adjust.
Yes. Features such as RMS, kurtosis and spectral band energies from vibration, current or pressure signals are modeled during healthy operation, and windows that deviate are flagged, which is the basis of predictive maintenance.
