Skip to content

Vector Anomaly Detection

EigenLake can rank records that are semantically unusual relative to their nearest neighbors. The workload uses Local Outlier Factor (LOF) with cosine distance over a filtered snapshot of up to 10,000 embeddings.

Run anomaly detection

result = idx.search.anomalies(
    filter={"status": {"$eq": "open"}},
    limit=10_000,
    n_neighbors=20,
    top_n=100,
    text_fields=["subject", "description"],
    timeout=130.0,
)

n_neighbors controls the local semantic neighborhood. The service reduces it automatically when fewer records are available. The anomaly call uses a 130-second request timeout by default so synchronous Lambda execution is not constrained by the client's general 20-second default.

Read the result

for anomaly in result["anomalies"]:
    print(
        anomaly["rank"],
        anomaly["uuid"],
        anomaly["score"],
        anomaly["percentile"],
    )
    for neighbor in anomaly["nearest_neighbors"]:
        print("  evidence:", neighbor["uuid"], neighbor["distance"])

The response includes:

  • scores: compact ranked entries for every valid vector.
  • anomalies: detailed records for the requested top_n.
  • nearest_neighbors: three semantically closest records supporting each detailed result.
  • records_scored and records_skipped: snapshot accounting.
  • skipped_reasons: invalid, missing, non-finite, zero-norm, or inconsistent vectors.
  • backend: local or lambda.

An LOF score near 1.0 means the record has density similar to its neighbors. Higher values indicate stronger local isolation. percentile is a rank within the analyzed snapshot, not a probability or calibrated risk score.

V1 limits

  • Cosine distance only.
  • At least three valid, non-zero vectors.
  • At most 10,000 records in one synchronous request.
  • Snapshot outlier detection only; no streaming model or trusted-normal novelty mode.