Semi-supervised Isolation Forest
Semi-supervised Isolation Forest for Anomaly Detection · Also known as: SSIF, semi-supervised iForest, label-guided Isolation Forest, partially supervised Isolation Forest
Semi-supervised Isolation Forest extends the classic Isolation Forest anomaly detector by incorporating a small set of labeled anomaly (and possibly normal) examples alongside a large unlabeled dataset. This label guidance adjusts the model's anomaly scores so that known anomalies are separated more reliably, bridging the gap between fully unsupervised and fully supervised detection.
Read the full method
Sign in with a free account to read this section.
Method map
The neighbourhood of related methods — select a node to explore.
When to use it
Use Semi-supervised Isolation Forest when you have a large pool of unlabeled data, the cost of full labeling is prohibitive, but you can obtain labels for at least a small set of confirmed anomalies (and optionally some confirmed normals). It is especially valuable for rare-event detection in cybersecurity, fraud, predictive maintenance, and medical monitoring where domain experts can label a handful of known incidents. Do not use it when no labeled anomalies are available at all (prefer standard Isolation Forest or One-Class SVM), when data is high-dimensional and sparse without preprocessing, or when a large fully labeled set is already available (a fully supervised classifier will outperform it).
Strengths & limitations
- Achieves higher precision and recall than fully unsupervised iForest by anchoring scores to real labeled anomalies.
- Requires only a small number of labels, making it practical when annotation is expensive.
- Inherits iForest's sub-linear training time and low memory footprint, scaling to large datasets.
- Handles high-dimensional tabular data without distance or density assumptions.
- Reduces arbitrary threshold selection: the labeled subset provides a principled calibration basis.
- Performance degrades if the labeled anomalies are not representative of the anomaly distribution in the unlabeled data.
- The optimal label-integration mechanism varies across implementations; no single universally dominant variant exists yet.
- Like standard iForest, it can struggle with anomalies clustered near the data centre or with certain multimodal distributions.
- Requires care to avoid label leakage when evaluating: the labeled set must not overlap with the test set.
Frequently asked
How many labeled anomalies do I need?
Even a handful — sometimes as few as 10–50 confirmed anomalies — can provide meaningful calibration. The key requirement is that they are representative of the anomaly types present in the unlabeled pool. More diverse label coverage across anomaly subtypes generally yields larger gains.
How is this different from standard Isolation Forest?
Standard Isolation Forest is fully unsupervised and scores anomalies solely by path length without any domain feedback. Semi-supervised Isolation Forest incorporates a small labeled set to adjust scores or tree weights, steering the model toward anomaly patterns that are actually relevant in your domain and enabling principled threshold calibration.
Can I include labeled normal examples as well as anomalies?
Yes, and it is generally beneficial. Labeled normals help the model distinguish boundary cases more sharply. Some variants treat the labeled set as a balanced reference for calibrating the scoring function, so including both classes when available improves the decision boundary.
Should I use cross-validation to evaluate the model?
Yes, but carefully. The labeled subset must be excluded from or properly stratified in the test set to avoid data leakage. A stratified train/test split on the labeled portion, combined with the full unlabeled pool for training, is the standard evaluation setup.
What if my labeled anomalies are not representative?
Label-guided adjustment can backfire if the labeled anomalies cover only a narrow slice of the true anomaly distribution. In that case, the model may miss novel anomaly types it was never shown. It is advisable to complement semi-supervised detection with unsupervised anomaly scoring and monitor for distributional drift in production.
Sources
How to cite this page
ScholarGate. (2026, June 3). Semi-supervised Isolation Forest for Anomaly Detection. ScholarGate. https://scholargate.app/en/machine-learning/semi-supervised-isolation-forest
Which method?
Set this method beside its closest kin and read them side by side — the library lays the books on the table; the choice is yours.
- Autoencoder Anomaly DetectionMachine learning↔ compare
- Isolation ForestMachine learning↔ compare
- Local Outlier FactorMachine learning↔ compare
- One-class SVMMachine learning↔ compare
- Random ForestMachine learning↔ compare
- Semi-supervised LearningMachine learning↔ compare