How to Build an Anomaly Detection Model Without Code

You can build an anomaly detection model in TensorTurn two ways depending on your labels: with no labeled anomalies, it trains an unsupervised scikit-learn detector (Isolation Forest or One-Class SVM) that scores how unusual each record is; with some confirmed anomalies, it trains a class-weighted classifier (XGBoost or scikit-learn) like a rare-event problem. Either way you upload your data, describe the goal in chat, it runs on a cloud GPU, and it deploys a /predict API that returns an anomaly score you threshold to flag outliers. The health check's built-in outlier and correlation analysis is a useful first look before you train anything.

Two paths: labeled vs. unlabeled

The right approach hinges on whether you have examples of the anomaly. Unlabeled (the common case): you only have normal-looking data and want to flag whatever deviates, so Isolation Forest or One-Class SVM learn the shape of 'normal' and score how far each record sits from it. Labeled (you have confirmed failures, intrusions or defects): this is imbalanced classification, where a class-weighted XGBoost or scikit-learn model learns the anomaly directly and usually beats unsupervised methods. Many teams start unsupervised, review the flags, and graduate to supervised once they have collected confirmed labels.

What data you need

• One row per entity or time window — a machine reading, a network session, a transaction, a sensor snapshot.
• Numeric and categorical features that describe normal behavior: measurements, rates, counts, ratios.
• For unlabeled detection: mostly-normal historical data, so the model learns what typical looks like.
• For labeled detection: as many confirmed anomalies as you can gather (even a few hundred helps), plus normal examples.
• No leakage columns that only exist after an anomaly is known — a repair ticket, a post-incident flag, a resolution field.

How to build an anomaly detection model with TensorTurn (no code)

• Import your data (CSV, Excel, zip or URL).
• Run the tabular health check — its outlier, correlation and duplicate analysis already surfaces obvious anomalies and data problems.
• In chat, be explicit about labels: 'I have no labels — train an Isolation Forest to score unusual rows,' or 'Detect anomalies in the failure column (about 1% positive), maximise recall.'
• TensorTurn trains the right kind of model, self-heals broken cells, and reports the appropriate metrics.
• Review the anomaly scores, or, if labeled, PR-AUC and recall at a chosen precision; tune the threshold to your review capacity.
• Deploy a /predict endpoint that returns an anomaly score per record.

How it's evaluated (this is the hard part)

Evaluation is straightforward when you have labels — use PR-AUC and recall at a fixed precision, exactly like a rare-event classifier, and validate on later time periods so you are not testing on the same past you trained on. When you have no labels, there is no ground truth, so evaluation is judgment: you set a threshold, review the top-scored records, and confirm whether they are genuinely unusual or just rare-but-fine. This is inherently iterative — expect to adjust the threshold and features as you learn what 'anomaly' actually means for your data.

Honest limits

Unsupervised detectors flag statistical outliers, which are not always the anomalies you care about — a legitimate but rare event looks identical to a real problem. They cannot tell you why something is anomalous beyond feature importance, and they drift as normal behavior changes, so retrain periodically. If your anomaly is well-defined and you can label it, a supervised model is almost always more accurate; treat unsupervised detection as a starting point that helps you collect those labels. For financial fraud specifically, the dedicated fraud-detection guide goes deeper on the labeled, imbalanced case.

Deploy as an API

Publish an authenticated /predict endpoint on Modal with a SHA-256-hashed Bearer key, per-call logging and scale-to-zero. Stream each new record to the endpoint, compare the returned anomaly score to your threshold, and route it to alert, hold or ignore. The playground gives cURL, JavaScript, Python and Rust snippets.