DIFFI: Depth-based Isolation Forest Importance

• DIFFI is an interpretability framework for Isolation Forest that uses depth-based weighting to assign feature importance at both local and global levels in unsupervised anomaly detection.
• It transforms the tree path structure into actionable insights, enabling unsupervised feature selection and providing rapid explanations compared to methods like SHAP.
• Empirical evaluations highlight DIFFI’s effectiveness across diverse datasets while addressing challenges such as split-frequency bias and handling correlated predictors.

Searching arXiv for DIFFI and related explainable anomaly detection papers. arXiv search query: DIFFI Isolation Forest feature importance anomaly detection. Depth-based Isolation Forest Feature Importance (DIFFI) is an interpretability framework for Isolation Forest in unsupervised anomaly detection. The method was introduced to address a specific limitation of Isolation Forest: although the algorithm is widely adopted because of its proven effectiveness and low computational complexity, its random splitting mechanism makes the resulting anomaly score difficult to interpret. The original preprint presents DIFFI as a set of effective, yet computationally inexpensive, methods for defining feature-importance scores at both global and local level for Isolation Forest, together with a procedure for unsupervised feature selection for anomaly detection problems (Carletti et al., 2020).

1. Origin, scope, and problem addressed

Anomaly detection is an unsupervised learning task aimed at detecting anomalous behaviours with respect to historical data. In multivariate anomaly detection, a complex system or observed phenomenon is summarized by a single indicator, typically called an anomaly score. The attractiveness of this setting lies both in the use of multivariate information and in the fact that no human tagging is required (Carletti et al., 2020).

Within this setting, Isolation Forest is one of the most commonly adopted algorithms. The motivation for DIFFI is the lack of interpretability in Isolation Forest, described as an effect of the inherent randomness governing the splits performed by the Isolation Trees that compose the forest. DIFFI targets precisely that gap by assigning feature-importance scores to the variables involved in isolation. The original work further states that the same interpretability mechanism can be used to perform unsupervised feature selection and to tackle feature-importance evaluation in unsupervised anomaly detection (Carletti et al., 2020).

Later application papers describe DIFFI as a model-specific method for explaining why an instance is isolated quickly, with two main explanatory modes: local per-instance attributions and global feature importance over a set of anomalous or otherwise selected instances. In those descriptions, DIFFI is explicitly tied to the internal structure of Isolation Forest rather than to external perturbation or surrogate modeling (Isgandarov et al., 21 Jul 2025).

2. Dependence on Isolation Forest mechanics

The explanatory logic of DIFFI inherits the mechanics of Isolation Forest. Let the dataset be $X = \{x_i\}_{i=1}^n \subset \mathbb{R}^d$, where $d$ is the number of features. Isolation Forest builds an ensemble of $T$ binary trees, each trained on a subsample of size $\ell$. Each tree recursively isolates points by randomly selecting a feature and a split threshold until a termination condition is reached. For an instance $x$, the path length in tree $t$ is the number of edges traversed from the root to the external node, denoted $h_t(x) \in \mathbb{N}$. The expected path length is

$E[h(x)] = \frac{1}{T}\sum_{t=1}^T h_t(x),$

and the anomaly score is

$s(x,\ell)=2^{-E[h(x)]/c(\ell)},$

where

$c(\ell)=2H(\ell-1)-2(\ell-1)/\ell,$

with $d$0 the $d$1-th harmonic number. Small $d$2 implies $d$3 close to $d$4, whereas large $d$5 yields $d$6 close to $d$7 (Isgandarov et al., 21 Jul 2025).

DIFFI uses this path-based structure directly. Its basic intuition is that the features that participate in early isolation should receive higher importance than those that appear only in deeper parts of the tree. A common misconception is that simple path-based counting is sufficient. A later comparative discussion states that path-based attributions without depth weighting treat early and late splits equally and therefore miss Isolation Forest’s core intuition that isolation is mostly done early (Isgandarov et al., 21 Jul 2025).

3. Local attribution and depth weighting

A self-contained mathematical description of Local-DIFFI is given in a shared-mobility study that adopts the method. For each tree $d$8, let $d$9 be the ordered set of internal nodes visited by $T$0 from root to leaf, let $T$1 be the depth of node $T$2, and let $T$3 be the index of the feature used at node $T$4. DIFFI then uses a decreasing depth-weighting function

$T$5

with default $T$6. The per-tree, per-instance importance for feature $T$7 is

$T$8

and aggregation across trees yields

$T$9

An optional normalization produces

$\ell$0

so that $\ell$1. These normalized local importances are described there as Local-DIFFI (Isgandarov et al., 21 Jul 2025).

This formulation makes several implementation choices explicit. Root depth is set to $\ell$2, so the first split has weight $\ell$3 when $\ell$4. DIFFI attributes contributions only at internal split nodes along the path; external or leaf nodes do not add feature attribution. The method therefore interprets the explanatory signal as arising from the sequence of internal decisions that isolate the point, not from the terminal leaf itself (Isgandarov et al., 21 Jul 2025).

The same source emphasizes that DIFFI works entirely from the learned forest structure and requires no additional model fitting or perturbation sampling. Per instance, traversing one tree takes $\ell$5 on average, and for $\ell$6 trees the per-instance complexity is $\ell$7 (Isgandarov et al., 21 Jul 2025).

4. Global importance, outlier–inlier contrast, and feature selection

One global aggregation strategy averages normalized local scores over a set $\ell$8 of instances, such as all detected anomalies or a filtered subset:

$\ell$9

The same formulation also allows anomaly-score weighting,

$x$0

This yields global rankings that summarize the most influential features in driving anomalies system-wide or within a subset such as a time window or operational regime (Isgandarov et al., 21 Jul 2025).

A distinct global formulation appears in an EV-charging study. There, DIFFI maintains cumulative feature-importance vectors for predicted inliers and predicted outliers, $x$1 and $x$2, together with feature-usage counters $x$3 and $x$4. For an internal node, an induced imbalance coefficient is defined as

$x$5

with

$x$6

When a point traverses a node that splits on feature $x$7, the update is

$x$8

and the global feature importance is then computed elementwise as

$x$9

This version explicitly contrasts outlier and inlier behaviour while correcting for how often each feature is used along paths (Cederle et al., 21 Jul 2025).

The original DIFFI preprint states that the interpretability procedure also serves to perform unsupervised feature selection (Carletti et al., 2020). Later case studies make that role concrete. In the EV-charging study, the authors retained only the nine most important features from the global ranking to simplify subsequent analysis and improve interpretability (Cederle et al., 21 Jul 2025). A plausible implication is that DIFFI is used not only as a post hoc explanation tool but also as a dimensionality-reduction mechanism tailored to anomaly detection.

5. Empirical uses and relation to other explainability methods

The original DIFFI preprint reports evaluation on several synthetic and real-world datasets, including comparisons against state-of-the-art interpretability techniques, and states that the code was made publicly available to enhance reproducibility and foster research in the field (Carletti et al., 2020).

A shared-mobility application uses Isolation Forest with DIFFI on station-hour observations in Boston/Cambridge for January 2023. The inputs include in/out traffic load, ratio of subscribers to on-demand users, average distance, duration, linear speed, timing variables, weather variables, neighborhood type, and nearby MBTA stops within $t$0. In that study, Local-DIFFI consistently ranked temperature, neighborhood, and day of week highly; transit accessibility emerged as critical; anomaly spikes occurred around $t$1 a.m. and on Thursdays; Jan 15 showed elevated anomalies under the highest wind speeds; and Jan 26 showed widespread anomalies under heavy rainfall of $t$2. For the subset of anomalies concentrated at $t$3 a.m. on Thursdays, Local-DIFFI highlighted public transit availability, trip duration, trip speed, wind speed, and precipitation as dominant contributors (Isgandarov et al., 21 Jul 2025).

An EV-charging application studies eight charging stations from Jan 2022 to Jun 2024 and analyzes 22,986 full recharges after removing sessions with missing or incomplete information. The feature space includes aggregate session variables, power descriptors, temperature descriptors, and the cross-signal correlation $t$4. Global DIFFI ranked temperature kurtosis $t$5, temperature number of peaks $t$6, and temperature correlation lag $t$7 as the top three features. Local-DIFFI on anomalous points was then used to rank features per anomaly, and domain experts judged the explanations reasonable and consistent with field experience (Cederle et al., 21 Jul 2025).

Both application papers position DIFFI against SHAP. In the shared-mobility study, SHAP and DIFFI surfaced similar top features, and Local-DIFFI ran in $t$8 per sample versus $t$9 for SHAP on a consumer laptop (Isgandarov et al., 21 Jul 2025). In the EV-charging study, the comparison is qualitative rather than metric-based, but the reported conclusion is similar: DIFFI and SHAP highlight similar influential features, while DIFFI is preferred in a time-sensitive, large-scale setting because of substantially lower computational cost (Cederle et al., 21 Jul 2025).

6. Methodological considerations, limitations, and open directions

Several implementation constraints recur across the later DIFFI literature. Standard Isolation Forest implementations such as scikit-learn accept only numerical features, so categorical variables must be encoded numerically; Isolation Forest does not handle NaNs, so missing inputs must be imputed before training and explaining; and randomness in feature and threshold selection requires a fixed random_state for reproducibility (Isgandarov et al., 21 Jul 2025). These are operational constraints of the underlying detector, but they directly affect DIFFI because DIFFI inherits the forest structure.

The method also has substantive limitations. Reported limitations include split-frequency bias, in which features that frequently appear in splits can accrue importance; difficulty in deconvolving correlated predictors because DIFFI is path-based; and sensitivity of interpretability to encoding choices for categorical variables (Isgandarov et al., 21 Jul 2025). The EV-charging study adds that rankings may still vary with different random seeds or data subsamples, even though DIFFI averages across trees and normalizes by feature-use counters, and recommends interpreting groups of correlated features jointly (Cederle et al., 21 Jul 2025).

These limitations clarify what DIFFI is and is not. It is not a model-agnostic attribution framework; it is tailored to Isolation Forest and exploits the semantics of path depth and split structure. It is not a full interaction model either: SHAP-based approaches are described as theoretically principled additive attributions that can capture interaction effects, whereas DIFFI is favored for simplicity and speed in tree-based anomaly detection (Isgandarov et al., 21 Jul 2025). Future improvements proposed in the shared-mobility study include adaptive depth weighting, incorporation of node mass into the weighting function, and hybrid DIFFI-plus-perturbation schemes (Isgandarov et al., 21 Jul 2025).

In this form, DIFFI occupies a specific methodological niche: it converts the isolation mechanism of Isolation Forest into local and global feature rankings, supports unsupervised feature selection, and provides explanations that are computationally lightweight enough for operational anomaly-analysis workflows (Carletti et al., 2020).