Unsupervised Anomaly Detection in Manufacturing: A Practical Guide
Averroes
Jun 26, 2026
Labeled defect classes give supervised inspection models something to recognize. They don’t give them anything to do with the unknown.
Unsupervised anomaly detection handles that side of the problem – learning the shape of normal from good parts alone, flagging whatever falls outside it.
We’ll cover how unsupervised anomaly detection works in manufacturing, what data it needs, and how to integrate it without the deployment pitfalls that kill operator trust.
Key Notes
Unsupervised anomaly detection trains on good parts only – no defect labels required.
Supervised and unsupervised inspection handle different problems (both layers are needed).
Reliable “good part” examples matter more than a complete defect taxonomy to get started.
Why Supervised-Only Inspection Leaves Gaps
Supervised defect detection is purpose-built for known failure modes. Feed it labeled examples of scratches, voids, cracks, and contamination – it learns to recognize them at high accuracy.
The limitation is structural: a supervised model can only flag what it’s seen before.
In Practice, That Creates Three Recurring Blind Spots:
Rare Defect Classes
Some defect types appear once a month or once a quarter on a well-controlled line.
You can’t build a classification model on three examples, so these get caught – or don’t – by human review. Inconsistent and doesn’t scale.
Emerging Failure Modes
Process drift, new material lots, tooling wear, and technology node changes all produce defect morphologies that weren’t in the training data.
A supervised model will either misclassify them or assign them to the nearest known class with false confidence – which is arguably worse than missing them outright.
Labeling Economics
Getting a process engineer to label hundreds of images per defect class, across multiple product types and lines, at the cadence that process changes demand – that’s expensive and slow.
Supervised models also degrade when labeling is inconsistent across shifts and teams, which is the norm rather than the exception.
None Of This Makes Supervised Inspection The Wrong Tool
Unsupervised anomaly detection covers the residual it leaves behind.
How Does Unsupervised Anomaly Detection Work?
Unsupervised anomaly detection learns what normal looks like, then flags anything that deviates from it. No defect labels required during training – only confirmed good samples.
The Training Process Is Straightforward In Principle:
Collect a representative dataset of defect-free parts, signals, or process states.
Train the model to learn the distribution of normal – its structure, variation, boundaries.
At inference, score each new sample against that learned distribution.
Flag samples whose anomaly score exceeds a set threshold for human review.
What Varies Between Methods Is How “Distance From Normal” Gets Computed
The main approaches used in industrial settings:
Method
How It Scores Anomalies
Common Use Case
Autoencoders
High reconstruction error – the model can’t reconstruct what it hasn’t learned
Image-based surface inspection
PatchCore / PaDiM
Feature distance from a memory bank of normal patch embeddings
High-accuracy image anomaly detection
Isolation Forest
Anomalies isolate in fewer partitioning steps than normal points
Tabular and sensor data
Normalizing Flows
Low likelihood under a learned normal distribution
Image and multivariate process data
The Threshold Is Where Engineering Judgment Comes In
Quality and process teams set the operating point on the anomaly score distribution to balance missed anomalies against false positives.
Start conservative – fewer flags, higher operator confidence – then tighten it as you validate performance.
Unsupervised vs. Supervised: What Each Handles
These aren’t competing approaches as they handle different parts of the same inspection problem.
Supervised
Unsupervised
Trains on
Labeled defect examples
Confirmed good samples only
Catches
Known, recurring defect types
Unknown defects, rare failures, process drift
Output
Specific defect class
Normal vs. anomalous
Supports
Routing, rework, classification
Escapes outside the known taxonomy
A Terminology Note
In manufacturing literature, “anomaly detection” and “defect detection” get used interchangeably. They’re not the same thing.
Anomaly detection models the OK class and treats deviations as potential issues.
Same data, inverted model assumption (and an important distinction when you’re deciding which tool to reach for).
Where The Two Connect
Unsupervised anomaly detection works well as a first-pass filter feeding into a supervised system:
Flagged samples go to operators for review.
Confirmed defects get labeled.
Recurring modes eventually get absorbed into the supervised classifier as a new defect class.
The anomaly detection layer keeps catching whatever the supervised model hasn’t been trained on yet (which means the two layers make each other more complete over time).
Do You Need to Label Every Defect Type?
No – and this is one of the most common misconceptions about deploying AI inspection.
Unsupervised anomaly detection requires reliable “good part” examples and a clear pass/fail definition. A complete defect taxonomy isn’t a prerequisite.
What Minimal Labeling Is Still Useful:
A test set of confirmed NOK parts for threshold tuning and performance validation – you need to know if the system is catching things.
Operator dispositions on flagged samples (“true defect,” “false alarm,” “process variation”) so you can measure false positive rate and refine accordingly.
Part-level pass/fail records from existing quality systems, which most manufacturers already have.
When Detailed Per-Defect Labeling Becomes Relevant:
Automated routing and rework – the line needs to know what kind of defect it’s dealing with, not just that something’s wrong.
Regulated traceability requirements where customers or regulators require class-level defect reporting (medical, aerospace, semiconductor).
Building supervised classification models for high-impact recurring modes on top of the anomaly filter.
Even then, you’re labeling a small number of high-priority defect classes (20–40 images per defect class needed).
Unsupervised Anomaly Detection Across Data Modalities
Manufacturing produces more than images, and unsupervised anomaly detection applies across all of them. The algorithm choice and what “normal” looks like differs by modality.
Visual / Image-Based Inspection
The most established application.
Models score individual images or image patches against a learned distribution of normal surface appearance.
Applicable to surfaces, solder joints, assemblies, welds – anything a camera can capture.
Methods like PatchCore produce pixel-level anomaly heatmaps showing operators exactly where the deviation is.
Useful on two fronts: Supports operator review queues, and accelerates labeled dataset building when recurring anomalies need absorbing into a supervised classifier.
Time-Series & Sensor Data
Unsupervised time series anomaly detection applies to continuous process signals.
The model learns normal equipment signatures across operating conditions and flags deviations before they manifest as scrap or downtime.
Signals covered: vibration, current draw, temperature, pressure, torque.
Operating conditions the model accounts for: load, speed, ambient temperature, wear state.
Particularly hard to replace with supervised methods – predictive maintenance failure modes are often unknown in advance, too varied to label exhaustively, or both.
Tabular Process Data
Cycle times, dimensional measurements, setpoints, line speeds, SPC metrics.
Unsupervised methods – Isolation Forest and autoencoder variants in particular – detect multivariate anomalies that univariate SPC rules miss.
A process can look normal on every individual parameter while the combination of values is statistically unusual.
That’s the pattern univariate SPC doesn’t catch and unsupervised learning does.
Particularly relevant for complex, multi-parameter processes where interactions between variables drive quality outcomes.
Deployment: From Pilot To Production
Unsupervised anomaly detection has one specific failure mode in deployment: a false-positive rate high enough that operators stop trusting the system and start dismissing alerts.
Getting the rollout right prevents that.
Shadow Mode First
Run the system in parallel with existing inspection – logging flags without acting on them.
Validate against confirmed good and bad parts before the system has any authority over production decisions.
Builds operator familiarity before alerts affect their workload
Gives you a clean performance baseline before go-live
Threshold Calibration
Set thresholds conservatively at first.
Fewer alerts means each one gets taken seriously.
Tighten sensitivity gradually as confidence in the score distribution builds
Walking back an over-flagging system that’s already eroded operator trust is significantly harder than moving in the other direction
Data Coverage Before Training
The training dataset needs to cover natural production variation before the model goes live.
Shifts, material lots, seasonal temperature variation, different machine wear states
A model trained on a narrow window of ideal conditions will flag acceptable parts the moment anything changes
Monitoring For Drift
What “normal” looks like shifts over time.
Monitor the anomaly score distribution continuously.
Triggers for retraining: lighting changes, process recipe updates, new product introductions, equipment maintenance
A baseline shift in score distribution is a signal to retrain – not a signal to raise the threshold
Operator Feedback Loop
Every disposition is training signal.
Build a workflow that captures it systematically.
Disposition categories to capture: true defect, false alarm, acceptable variation, new SKU
Without this loop, the system stagnates post-deployment rather than improving
Anomaly Detection As Part Of A Broader Inspection Stack
Unsupervised anomaly detection works best as one layer in a multi-stage inspection architecture.
How The Layers Divide The Work
Supervised inspection engine: Handles the known defect taxonomy – classification, segmentation, and routing decisions for recurring failure modes at high accuracy.
Unsupervised anomaly detection: Runs in parallel, covering deviations that don’t match any known class but clearly fall outside the normal distribution.
How The Two Layers Stay Current Over Time
Anomaly detection surfaces something outside the known taxonomy
Engineers review and label it
If it recurs with enough frequency, it gets added to the supervised model as a new defect class
The anomaly detection layer keeps catching whatever hasn’t been absorbed yet
Supervised handles what’s known, unsupervised catches what isn’t yet, and the boundary between those two categories shifts as the system matures.
Where This Matters Most
This is the role WatchDog plays in the Averroes inspection platform – running alongside our supervised defect classification, detection, and segmentation models, flagging anomalies that fall outside the configured class taxonomy.
In semiconductor and electronics inspection, the stakes are specific:
New process nodes continuously produce new failure modes with no labeled history
A single escape on a critical layer can propagate through hundreds of downstream wafers before detection
The cost of a missed unknown anomaly isn’t one defective part – it’s the yield hit that accumulates before anyone realizes there’s a new failure mode to deal with
What Would Catching The Unknown Do For Your Yield?
See unsupervised anomaly detection working on your inspection data.
Unsupervised Anomaly Detection FAQs
What is an example of unsupervised anomaly detection in manufacturing?
A common anomaly detection example is training a model on thousands of defect-free PCB images, then deploying it on a live AOI line to flag solder joints that deviate from the learned normal – including bridging patterns or voids the supervised model was never trained on. No defect labels required; the model flags anything that doesn’t look like the good parts it learned from.
How is unsupervised anomaly detection different from statistical process control?
Traditional SPC monitors individual parameters against fixed control limits – it catches univariate shifts but misses complex interactions between variables. Unsupervised anomaly detection models the full multivariate distribution of normal process behavior, flagging combinations of parameter values that are statistically unusual even when no single metric breaches its limit.
Can unsupervised anomaly detection work with small datasets?
Unsupervised anomaly detection generally needs enough normal samples to cover natural production variation (shifts, material lots, equipment states). Averroes is built to train on minimal data, requiring as few as 20–40 images per class on the supervised side. For the unsupervised layer, prioritize coverage over volume – a narrow training set will over-flag acceptable variation regardless of how many images it contains.
What causes unsupervised anomaly detection models to degrade over time?
Model degradation typically comes from distribution shift – when what “normal” looks like in production drifts away from what the model was trained on. Common triggers include lighting changes, process recipe updates, new product introductions, and equipment wear. Monitoring anomaly score distributions over time and scheduling periodic retraining keeps the model calibrated to current production conditions.
Conclusion
Unsupervised anomaly detection doesn’t replace supervised inspection – it handles the part that supervised inspection structurally can’t.
A failure mode with no labeled history, a process drift that hasn’t produced a recognized defect signature yet, a morphology that shows up twice a year: these don’t wait for you to build a training set.
The deployment discipline matters as much as the algorithm choice – data coverage, threshold calibration, and an operator feedback loop are what separate a system that earns trust from one that gets bypassed after the first wave of false positives.
If you want to see how Averroes handles the known and unknown sides of inspection, book a free demo.
Labeled defect classes give supervised inspection models something to recognize. They don’t give them anything to do with the unknown.
Unsupervised anomaly detection handles that side of the problem – learning the shape of normal from good parts alone, flagging whatever falls outside it.
We’ll cover how unsupervised anomaly detection works in manufacturing, what data it needs, and how to integrate it without the deployment pitfalls that kill operator trust.
Key Notes
Why Supervised-Only Inspection Leaves Gaps
Supervised defect detection is purpose-built for known failure modes. Feed it labeled examples of scratches, voids, cracks, and contamination – it learns to recognize them at high accuracy.
On well-characterized defect taxonomies, it works extremely well.
The limitation is structural: a supervised model can only flag what it’s seen before.
In Practice, That Creates Three Recurring Blind Spots:
Rare Defect Classes
Some defect types appear once a month or once a quarter on a well-controlled line.
You can’t build a classification model on three examples, so these get caught – or don’t – by human review. Inconsistent and doesn’t scale.
Emerging Failure Modes
Process drift, new material lots, tooling wear, and technology node changes all produce defect morphologies that weren’t in the training data.
A supervised model will either misclassify them or assign them to the nearest known class with false confidence – which is arguably worse than missing them outright.
Labeling Economics
Getting a process engineer to label hundreds of images per defect class, across multiple product types and lines, at the cadence that process changes demand – that’s expensive and slow.
Supervised models also degrade when labeling is inconsistent across shifts and teams, which is the norm rather than the exception.
None Of This Makes Supervised Inspection The Wrong Tool
Unsupervised anomaly detection covers the residual it leaves behind.
How Does Unsupervised Anomaly Detection Work?
Unsupervised anomaly detection learns what normal looks like, then flags anything that deviates from it. No defect labels required during training – only confirmed good samples.
The Training Process Is Straightforward In Principle:
What Varies Between Methods Is How “Distance From Normal” Gets Computed
The main approaches used in industrial settings:
The Threshold Is Where Engineering Judgment Comes In
Quality and process teams set the operating point on the anomaly score distribution to balance missed anomalies against false positives.
Start conservative – fewer flags, higher operator confidence – then tighten it as you validate performance.
Unsupervised vs. Supervised: What Each Handles
These aren’t competing approaches as they handle different parts of the same inspection problem.
A Terminology Note
In manufacturing literature, “anomaly detection” and “defect detection” get used interchangeably. They’re not the same thing.
Same data, inverted model assumption (and an important distinction when you’re deciding which tool to reach for).
Where The Two Connect
Unsupervised anomaly detection works well as a first-pass filter feeding into a supervised system:
The anomaly detection layer keeps catching whatever the supervised model hasn’t been trained on yet (which means the two layers make each other more complete over time).
Do You Need to Label Every Defect Type?
No – and this is one of the most common misconceptions about deploying AI inspection.
Unsupervised anomaly detection requires reliable “good part” examples and a clear pass/fail definition. A complete defect taxonomy isn’t a prerequisite.
What Minimal Labeling Is Still Useful:
When Detailed Per-Defect Labeling Becomes Relevant:
Even then, you’re labeling a small number of high-priority defect classes (20–40 images per defect class needed).
Unsupervised Anomaly Detection Across Data Modalities
Manufacturing produces more than images, and unsupervised anomaly detection applies across all of them. The algorithm choice and what “normal” looks like differs by modality.
Visual / Image-Based Inspection
The most established application.
Models score individual images or image patches against a learned distribution of normal surface appearance.
Time-Series & Sensor Data
Unsupervised time series anomaly detection applies to continuous process signals.
The model learns normal equipment signatures across operating conditions and flags deviations before they manifest as scrap or downtime.
Tabular Process Data
Cycle times, dimensional measurements, setpoints, line speeds, SPC metrics.
Unsupervised methods – Isolation Forest and autoencoder variants in particular – detect multivariate anomalies that univariate SPC rules miss.
Deployment: From Pilot To Production
Unsupervised anomaly detection has one specific failure mode in deployment: a false-positive rate high enough that operators stop trusting the system and start dismissing alerts.
Getting the rollout right prevents that.
Shadow Mode First
Run the system in parallel with existing inspection – logging flags without acting on them.
Validate against confirmed good and bad parts before the system has any authority over production decisions.
Threshold Calibration
Set thresholds conservatively at first.
Fewer alerts means each one gets taken seriously.
Data Coverage Before Training
The training dataset needs to cover natural production variation before the model goes live.
Monitoring For Drift
What “normal” looks like shifts over time.
Monitor the anomaly score distribution continuously.
Operator Feedback Loop
Every disposition is training signal.
Build a workflow that captures it systematically.
Anomaly Detection As Part Of A Broader Inspection Stack
Unsupervised anomaly detection works best as one layer in a multi-stage inspection architecture.
How The Layers Divide The Work
How The Two Layers Stay Current Over Time
Supervised handles what’s known, unsupervised catches what isn’t yet, and the boundary between those two categories shifts as the system matures.
Where This Matters Most
This is the role WatchDog plays in the Averroes inspection platform – running alongside our supervised defect classification, detection, and segmentation models, flagging anomalies that fall outside the configured class taxonomy.
In semiconductor and electronics inspection, the stakes are specific:
What Would Catching The Unknown Do For Your Yield?
See unsupervised anomaly detection working on your inspection data.
Unsupervised Anomaly Detection FAQs
What is an example of unsupervised anomaly detection in manufacturing?
A common anomaly detection example is training a model on thousands of defect-free PCB images, then deploying it on a live AOI line to flag solder joints that deviate from the learned normal – including bridging patterns or voids the supervised model was never trained on. No defect labels required; the model flags anything that doesn’t look like the good parts it learned from.
How is unsupervised anomaly detection different from statistical process control?
Traditional SPC monitors individual parameters against fixed control limits – it catches univariate shifts but misses complex interactions between variables. Unsupervised anomaly detection models the full multivariate distribution of normal process behavior, flagging combinations of parameter values that are statistically unusual even when no single metric breaches its limit.
Can unsupervised anomaly detection work with small datasets?
Unsupervised anomaly detection generally needs enough normal samples to cover natural production variation (shifts, material lots, equipment states). Averroes is built to train on minimal data, requiring as few as 20–40 images per class on the supervised side. For the unsupervised layer, prioritize coverage over volume – a narrow training set will over-flag acceptable variation regardless of how many images it contains.
What causes unsupervised anomaly detection models to degrade over time?
Model degradation typically comes from distribution shift – when what “normal” looks like in production drifts away from what the model was trained on. Common triggers include lighting changes, process recipe updates, new product introductions, and equipment wear. Monitoring anomaly score distributions over time and scheduling periodic retraining keeps the model calibrated to current production conditions.
Conclusion
Unsupervised anomaly detection doesn’t replace supervised inspection – it handles the part that supervised inspection structurally can’t.
A failure mode with no labeled history, a process drift that hasn’t produced a recognized defect signature yet, a morphology that shows up twice a year: these don’t wait for you to build a training set.
The deployment discipline matters as much as the algorithm choice – data coverage, threshold calibration, and an operator feedback loop are what separate a system that earns trust from one that gets bypassed after the first wave of false positives.
If you want to see how Averroes handles the known and unknown sides of inspection, book a free demo.