How do you detect and handle outliers in multivariate datasets?

WHAT THIS TESTS: The interviewer wants to see if you understand that multivariate outliers are not just extreme values in single columns but rare combinations that violate the joint distribution. They are looking for awareness of the curse of dimensionality, the difference between statistical distance and feature-space density, and the business judgment to treat outliers as symptoms rather than garbage.

A GOOD ANSWER COVERS: First, detection methods appropriate for high dimensions. Mention distance-based approaches like Mahalanobis distance for continuous Gaussian-like data, tree-based methods like isolation forest or extended isolation forest for mixed data types, and density-based methods like local outlier factor when clusters have varying density. Second, visualization techniques that make multivariate outliers legible. PCA biplots or scatter matrices of the top principal components reveal points that break correlation structure. Pair plots colored by outlier score show which feature pairs drive extremity. For two or three dimensions, convex hulls or alpha shapes help. Mahalanobis distance quantile-quantile plots against chi-squared distributions provide a rigorous visual cutoff. Third, a decision framework for handling flagged points. Start with a root-cause check: is it a sensor malfunction, a data-entry error, or a timestamp mismatch? If it is a measurement error, remove or impute. If it is a legitimate but extreme event, keep it and use robust modeling or report it separately. If the point is highly influential, run sensitivity analysis with and without it before deciding. Document every choice.

COMMON WRONG ANSWERS: A major red flag is applying univariate three-sigma or IQR rules feature by feature in high dimensions, which ignores joint structure and produces false positives. Another is automatically dropping outliers to improve model metrics without investigating whether they represent fraud, rare equipment failures, or emerging user behavior. Saying you always winsorize or always remove shows a lack of domain reasoning.

LIKELY FOLLOW-UPS: The interviewer may ask how you would handle categorical features alongside continuous ones, which pushes toward methods like isolation forest or one-class SVM on a properly encoded matrix. They might ask about scalability, prompting a discussion of approximate nearest neighbor algorithms or distributed isolation forest implementations. They could also ask how you validate an anomaly detection model in production when labeled anomalies are rare, leading to precision-at-k or feedback-loop monitoring.

ONE CONCRETE EXAMPLE: Suppose you are monitoring a fleet of one thousand servers with metrics for CPU, memory, disk IO, and network latency. A server with normal CPU and memory but simultaneously maxed disk IO and zero network traffic is a multivariate outlier even though no single metric is unprecedented. You would detect it with Mahalanobis distance if the metrics are jointly normal, or an isolation forest if they are not. You would visualize it on a PCA biplot where this server sits far from the main cloud along a component loaded on disk and network. You would check logs to see if a backup job stalled the network interface. If confirmed as a stuck process, you remove the row or fix the timestamp; if it is a new workload pattern, you keep it and retrain a robust model.