Explanation detail
What produced each reason: the field's value against the reference population's typical value, its signed contribution (positive pushes toward anomaly), each detector's method and share, and every caveat that applies. Explainer explain@2, reference consensus_normal.
#1 · row 7 · amount=900.0 · ok
| # | Field | Value | Reference | Direction | Signed | Magnitude | Methods (weight, share) | Transformed features | Flags |
|---|
| 1 | amount | 900.0 | 50.0 | above | +0.8 | 0.9 | isolation_forest: tree_shap (model_specific) w=1.00, +0.8 | amount +0.8 | treeshap_path_length |
| 2 | lat | 1.5 | 50.0 | below | -0.1 | 0.9 | isolation_forest: tree_shap (model_specific) w=1.00, +0.8 | lat +0.8 | treeshap_path_length |
#2 · row 3 · <b>cat</b>=x · partial
| # | Field | Value | Reference | Direction | Signed | Magnitude | Methods (weight, share) | Transformed features | Flags |
|---|
| 1 | <b>cat</b> | <script>alert(1)</script> | A | different | +0.8 | 0.9 | isolation_forest: tree_shap (model_specific) w=1.00, +0.8 | <b>cat</b> +0.8 | not_covered_by:lof
treeshap_path_length |
#3 · row 9: no explanation (beyond_max_rows).
What the flags mean
- not_covered_by:<det>
- Beyond this detector's explain.max_rows; it contributes nothing to this row.
- treeshap_path_length
- TreeSHAP decomposes the forest's expected path length, of which the score is a monotone, nonlinear transform; the shares rank the fields but do not sum to the score.