Tim Pinard

Traditional portfolio risk measures—Value at Risk, Sharpe ratio, and beta—are designed to quantify known risks based on historical patterns. While these tools remain essential, they are not built to answer a different and increasingly important question:

Is there something unusual about a portfolio’s behavior that may indicate elevated or emerging risk?

This article introduces a machine-learning–based approach to portfolio anomaly detection that complements traditional risk metrics rather than replacing them.

Why Anomaly Detection?

Markets evolve. Correlations shift, volatility regimes change, and portfolio structures that once appeared stable can begin to behave in unexpected ways. These changes often manifest first as structural inconsistencies rather than outright losses:

Momentum and volatility indicators sending conflicting signals
Portfolios whose diversification breaks down under stress
Concentration risk that is not obvious until market conditions shift

Anomaly detection focuses on identifying these unusual patterns before they fully materialize as realized risk.

A Dual-Model Machine Learning Approach

The system described in the accompanying whitepaper uses a dual-model ensemble:

An Autoencoder neural network learns normal market behavior by compressing and reconstructing correlated technical indicators. When familiar patterns break down, reconstruction error increases.
An Isolation Forest independently identifies observations that are structurally rare relative to the broader market.

By combining these models, the system detects both subtle pattern shifts and sharp statistical outliers. The models are trained on a broad market universe, allowing immediate evaluation of new portfolios without requiring portfolio-specific historical data.

Market-Relative Risk Context

Raw anomaly scores alone can be misleading during periods of market-wide stress. To address this, portfolio anomaly scores are normalized against the current market distribution using z-scores. This provides a market-relative perspective, answering not just “Is this portfolio unusual?” but “Is it more unusual than the market as a whole right now?”

Who This Is For

This work is intended for:

Investment professionals interested in complementary risk signals
Engineers and data scientists exploring applied anomaly detection
Organizations evaluating ML-driven approaches to risk assessment

It is not a trading system, nor a replacement for established financial risk metrics. Instead, it serves as an early-warning and investigative tool.

Read the Full Whitepaper

The full technical whitepaper covers:

System architecture and data pipeline
Feature engineering and portfolio aggregation strategy
Model validation using realistic anomaly scenarios
Market-relative scoring and risk classification logic

👉 Download the Whitepaper (PDF)

The complete implementation is available as an open-source project on GitHub at timpinard/portfolio-anomaly-detection.

Tim Pinard is a software engineer focused on applying machine learning to financial and risk analysis problems.

I have mostly worked for large corporations over the years, so it’s exciting when I get a chance to help out a small business. These smaller organizations often lack the resources to manage the information systems that are critical to their operations. There are usually opportunities to make a meaningful impact with minimal cost and often share with other organizations which is rewarding.

While working with a local Veterinary hospital, I noticed potential areas for improvement. Similar to a large hospital, they need to work with X-ray or Ultrasound imagery on premise. This hospital has an X-ray machine connected to a local server with purchased software that handles the communication with the equipment via proprietary protocols. Unlike a large hospital the capital investment ends there, and although more robust solutions are available its unlikely additional products for integration would be purchased. I found two major gaps:

Lack of medical imagery backup and failover
Suboptimal workflows for secure search, retrieval and sharing of medical imagery

The current VetViewer server collects the images but can only be accessed by logging onto that PC. We needed to add a component that can index images and provide secure access from any Internet enabled device. Think drop box for medical imagery. The high level system design solution would consist of a remote service for storing and retrieving and a complementary server agent for synching medical imagery from the VetView Server to the Distributed SaaS. This system enhancement will provide both protection from data loss and greatly improve workflow and increase over quality of services.

Although product upgrades or adds on are available for these use cases; they were expensive and included many features that wouldn’t be used. Since this simple but effective solution might be useful to other smaller organizations, certain components will be made available freely alongside the possible expansion of the service to provide multi-tenancy subscription support. Github project to follow…