Drift Detector — Machine Learning/Anomaly Detection

Drift Detector

Machine Learning / Anomaly Detection

Watches a scalar score for a sustained shift away from the value the model was fitted around, and raises a flag when the evidence for one accumulates. With d = u − Reference Mean, the Detector parameter selects one of the three standard sequential monitors:

• EWMA – s ← (1−a)·s + a·d, and stat = |s|. A smoothed estimate of the current mean offset; it forgets, so a transient fades on its own.
• CUSUM – gp ← max(0, gp + d − K) and gm ← max(0, gm − d − K), with stat = max(gp, gm). Two-sided, and it accumulates, so it catches a shift far smaller than the noise.
• Page-Hinkley – m ← m + d − K and mm ← min(mm, m), with stat = m − mm. One-sided: it reports how far the running sum has climbed above its own lowest point.

drift is 1 on a sample where stat exceeds Threshold and 0 elsewhere. On that sample the accumulators reset to zero, so the monitor re-arms itself – and stat is reported before the reset, so the firing sample carries the value that actually crossed.

Ports

• u – the monitored score, a scalar [1,1]. Anything whose typical level is known from the training run: a reconstruction error, a Mahalanobis distance, a confidence, a residual.
• stat – a scalar [1,1]: the detector's statistic this step, in the units of u.
• drift – a scalar [1,1]: 1 or 0, ready to drive a switch, an enable or a Signal Recorder.

Parameters

• Detector – which monitor runs. Each is a different code path, so each is verified as a mode of its own:
  • EWMA – forgets at the rate Smoothing Factor sets. Use it when a drift that stops mattering should stop being reported.
  • CUSUM – accumulates in both directions. The most sensitive of the three to a small persistent shift, and the usual first choice.
  • Page-Hinkley – accumulates upward only. Use it when only an increase is a fault, which is the common case for an error score.
• Reference Mean – a scalar: the level the score sat at while the model was healthy. Everything is measured relative to it.
• Drift Allowance – a scalar ≥ 0: how much departure per sample is treated as noise rather than evidence. Used by CUSUM and Page-Hinkley; EWMA ignores it. Conventionally about half the smallest shift worth catching.
• Threshold – a scalar > 0: the level of stat that raises drift. Larger means slower to fire and less prone to a false alarm.
• Smoothing Factor – a scalar in (0, 1]: EWMA's weight on the newest sample. Small forgets slowly, 1 forgets everything but the current sample. Used by EWMA only; the other two ignore it.
• Sampling Time (s) – zero or less inherits the solver's rate; a positive value runs the block at that period.

Code export

All ten targets: Python, MATLAB, Java, Rust, C, C++, VHDL, Verilog, SystemVerilog and PLC Structured Text. Every parameter is baked into the body at export time; there is no tunable parameter object, and the selected detector is the only code emitted.

The three HDL targets are genuine synthesizable Q16.16, not the simulation-only real arithmetic most of this family needs: the whole monitor is adds, constant multiplies and comparisons, with no division and no transcendental. The accumulators are registered state, and the reset on a firing sample is what keeps them inside the fixed-point range.

Simulink bridge

None. Sequential change detection of this kind lives in the Statistics and Machine Learning Toolbox, which is not installed on this machine, so there is no block whose parameters this one could be mapped onto or verified against; and nothing in the base Simulink libraries accumulates evidence this way – Detect Change reports that a signal differs from its previous value, which is a different question entirely. The bridge reports the block rather than dropping it silently, and it has no parity testbench, which is the documented consequence of Support::None rather than a gap. Code export verification still covers it across all ten languages, in all three detector modes.

Notes

• Stateful and inherently discrete (setDiscreteOnlyBlock(true)): the accumulators advance once per sample and have no derivative to integrate.
• The state starts at zero and cannot be seeded, deliberately – a monitor begins with no accumulated evidence. To restart one mid-run, gate its input rather than looking for a reset port.
• Nonlinear, and deliberately carries no state space. The max/min clamps and the threshold are not describable by A/B/C/D, so model reduction correctly refuses the block.
• Tuning is a trade, not a setting. A smaller Drift Allowance or Threshold fires sooner and more often; the pair is what sets the false-alarm rate, and it is worth reading stat on a healthy run before choosing either.