# Find outliers

Model / anomaly

outlier or anomaly detection

Page: <https://meridian.online/operations/find-outliers>

## Status

Runs as a SQL step.

arcform carries it as a `sql:` step today.

## The DuckDB step

flag outliers by the interquartile rule

It reads the `orders` table the proofs share. Create it first:

```sql
CREATE TABLE orders AS SELECT * FROM (VALUES
  (1,  'Alice Ng',      'north', DATE '2026-01-03', 120.00, 'widget', 'a|b',   '{"channel":"web","items":[1,2]}'),
  (2,  'alice ng',      'north', DATE '2026-01-05',  80.50, 'gadget', 'b',     '{"channel":"shop","items":[3]}'),
  (3,  'Bob  Okafor',   'south', DATE '2026-01-05', 300.00, 'widget', 'a|c',   '{"channel":"web","items":[4,5,6]}'),
  (4,  'Carla Díaz',    'east',  DATE '2026-01-09',  NULL,  'gizmo',  NULL,    '{"channel":"web","items":[]}'),
  (5,  'Bob Okafor',    'south', DATE '2026-01-12',  45.25, 'gadget', 'c',     '{"channel":"phone","items":[7]}'),
  (6,  'Dev Patel',     'west',  DATE '2026-01-12', 510.00, 'widget', 'a',     '{"channel":"web","items":[8,9]}'),
  (7,  'Carla Diaz',    'east',  DATE '2026-01-20',  99.99, 'gizmo',  'b|c',   '{"channel":"shop","items":[10]}'),
  (8,  'Dev Patel',     'west',  DATE '2026-02-02', 510.00, 'widget', 'a',     '{"channel":"web","items":[8,9]}'),
  (9,  'Eve Larsen',    NULL,    DATE '2026-02-03',  15.00, 'gadget', NULL,    '{"channel":"web","items":[11]}'),
  (10, 'Alice Ng',      'north', DATE '2026-02-10', 220.00, 'gizmo',  'a|b|c', '{"channel":"phone","items":[12,13]}')
) t(order_id, customer, region, order_date, amount, product, tags, meta);
```

Then run the statement:

```sql
CREATE TEMP TABLE result AS
WITH readings AS (SELECT order_id, amount FROM orders WHERE amount IS NOT NULL UNION ALL SELECT 99, 5000.0),
     q AS (SELECT quantile_cont(amount, 0.25) AS q1, quantile_cont(amount, 0.75) AS q3 FROM readings)
SELECT order_id, amount, amount > q3 + 1.5 * (q3 - q1) OR amount < q1 - 1.5 * (q3 - q1) AS outlier FROM readings, q;
SELECT * FROM result ORDER BY order_id;
SELECT CASE WHEN ((SELECT list(order_id) FILTER (WHERE outlier) = [99] AND count(*) = 10 FROM result)) THEN 'as expected' ELSE error('the one reading far from the rest was not the one flagged') END AS verdict;
```

It needs nothing installed beyond DuckDB itself.

## What other tools call it

Meridian's classification; an independent blind rating agreed on 86.2% of 312 rows (exact class, version 2).

- AWS Glue: [`DetectAnomalies`](https://docs.aws.amazon.com/glue/latest/dg/dqdl-rule-types.html) (read 2026-09-27)
- RapidMiner Studio: [`Detect Outlier (COF)`](https://docs.rapidminer.com/latest/studio/operators/cleansing/outliers/detect_outlier_cof.html) (read 2026-09-27)
- RapidMiner Studio: [`Detect Outlier (Densities)`](https://docs.rapidminer.com/latest/studio/operators/cleansing/outliers/detect_outlier_densities.html) (read 2026-09-27)
- RapidMiner Studio: [`Detect Outlier (Distances)`](https://docs.rapidminer.com/latest/studio/operators/cleansing/outliers/detect_outlier_distances.html) (read 2026-09-27)
- RapidMiner Studio: [`Detect Outlier (LOF)`](https://docs.rapidminer.com/latest/studio/operators/cleansing/outliers/detect_outlier_lof.html) (read 2026-09-27)
- Yggdrasil Decision Forests: [`ANOMALY_DETECTION`](https://github.com/google/yggdrasil-decision-forests/blob/0a54b57c95ff0cf42ecf0310ace0513a4f32cb65/yggdrasil_decision_forests/model/abstract_model.proto) (read 2026-09-27)
- Yggdrasil Decision Forests: [`ISOLATION_FOREST`](https://github.com/google/yggdrasil-decision-forests/blob/0a54b57c95ff0cf42ecf0310ace0513a4f32cb65/yggdrasil_decision_forests/learner/isolation_forest/isolation_forest.h) (read 2026-09-27)