A KNN detector scores an observation by its distances to its k nearest neighbors. A point far from those neighbors receives a higher outlier score. Although each score uses a neighborhood, KNN is a global detector: distances are judged against a dataset-wide standard, not against what is typical within that neighborhood. This can emphasize isolated points while giving less meaningful scores to some local outliers. section 3.3.3
The main choice is k. With the “largest” scoring method, the score uses the distance to the kth-nearest neighbor; with “mean,” it averages distances to the k neighbors. KNN scores can change substantially with k, especially under “largest.” Averaging distances is generally less sensitive, but neither method removes the need to examine parameter choices. section 3.3.7 section 8.1.1
When a small cluster changes status
Consider a dataset with a cluster of five points and another of 50. At k = 3, points in the small cluster have enough close neighbors to look normal. At k = 300, even the 50-point cluster lacks enough close neighbors and receives elevated scores. Choosing k between the sizes regarded as suspicious and normal can be a useful starting heuristic, not a guaranteed setting. section 8.1.1 section 8.2.1
Figure 8.5 Contour plot of the decision boundary of a KNN model using k = 3, 10, and 300. We can see the regions around the small cluster in the bottom-right are considered normal when k = 3 (as each point has this many close neighbors) but not when k is higher. When k is very high, such as 300, even fairly large clusters may receive moderate outlier scores.
Compare the score regions at k = 3, 10, and 300 to see how neighborhood size changes which clusters appear unusual. section 8.2.1
For a Python workflow, encode categorical columns and scale features before relying on distances. PyOD’s KNN can then be fitted to data; decision_scores_ holds training scores, while decision_function() scores test records and predict() returns binary labels. Numeric scores are useful for ranking and inspection: a flagged point is not automatically a meaningful anomaly. section 5.1 section 6.1
Listing 6.1 Basic example using PyOD with the KNN detector
from pyod.models.knn import KNN clf = KNN() clf.fit(data) scores = clf.decision_scores_
A minimal PyOD example shows the import, fit, and retrieval of training scores. section 6.1
Inspect scores across several k values rather than trusting one run. Two-dimensional scatterplots and contour plots make changes easy to see, but a setting that looks good in two dimensions cannot usually be transferred directly to data with more features or rows. KNN also does little during fitting but evaluates many distances during prediction; benchmark prediction time when scale matters. section 8.1.1 section 8.7
