Isolation Forest and One-Class SVM for Evidence-Import Anomalies

Define an operational target

A proposed MailTrace experiment could flag likely extraction failures using features such as extracted characters per page, page count and parser error counts. Start with explicit rules for known invalid states. A statistical model is worth considering only for patterns those rules miss.

Isolation Forest and One-Class SVM make different assumptions about unusual observations. Their outputs depend on the feature representation and training sample. A rare format may be perfectly valid, while a common parser failure may look statistically ordinary. The target is “inspect this import,” not “discard this evidence.”

Preserve the reason for a flag

This illustrative event stores a model flag alongside the measured import features and an explicitly pending review. It is an experiment contract, not a currently deployed MailTrace schema.

{
  "source_id": "document-example",
  "features": {"pages": 12, "extracted_characters": 0},
  "detector_version": "import-anomaly-experiment-v1",
  "action": "request_preparation_review",
  "evidence_excluded": false
}

Compare against simple checks first

A twelve-page document with no text can be detected without machine learning. If it is a scan and OCR is unavailable, the correct state is a clear extraction limitation, not a mysterious anomaly score. The reported evidence update explicitly leaves OCR and other media analysis unavailable.

For remaining cases, evaluate precision at a fixed review budget and the types of failures found beyond deterministic rules. Inspect unflagged samples to estimate misses. If a detector earns a role, retain a bounded review queue, version its training data and monitor changes in incoming formats. Anomaly detection should improve visibility of pipeline problems, not create a new hidden filter.