{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"ai/unsupervised-learning","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/ai/unsupervised-learning/","da":"https://cmaintz.github.io/tech-atlas/da/terms/ai/unsupervised-learning/"},"term":{"en":"Unsupervised learning","da":"Ikke-superviseret læring"},"aka":{"en":[],"da":["unsupervised learning","uovervåget læring"]},"domain":["ai"],"cluster":"ml-fundamentals","layer":"training","status":"current","summary":{"en":"Machine learning from examples with no answers attached, where the model finds groups, patterns or odd cases on its own.","da":"Maskinlæring ud fra eksempler uden svar, hvor modellen selv finder grupper, mønstre eller usædvanlige tilfælde."},"body":{"formal":{"en":"A form of machine learning that works on training data without labels, finding structure in it, for example grouping similar items or flagging items that differ from the rest.","da":"En form for maskinlæring, der arbejder på træningsdata uden mærkater og finder struktur i dem - fx ved at gruppere lignende ting eller markere ting, der skiller sig ud fra resten."},"plain":{"en":"Like sorting a box of mixed buttons into piles by colour and size without anyone telling you what the piles should be.","da":"Som at sortere en kasse blandede knapper i bunker efter farve og størrelse, uden at nogen har fortalt dig, hvilke bunker der skal være."},"inPractice":{"en":"A monitoring tool at a hospital learns what normal logins look like and raises an alert when a nurse's account suddenly logs in at 3 a.m. from another country.","da":"Et overvågningsværktøj på et hospital lærer, hvordan normale logins ser ud, og slår alarm, når en sygeplejerskes konto pludselig logger ind kl. 3 om natten fra et andet land."},"whyItMatters":{"en":"It can spot new, unknown threats nobody has labelled yet, but it also flags harmless unusual behaviour, so people must still judge the alerts.","da":"Den kan opdage nye, ukendte trusler, som ingen har mærket endnu, men markerer også harmløs usædvanlig adfærd, så mennesker stadig skal vurdere alarmerne."}},"deepDive":{"en":"Unsupervised learning estimates properties of the input distribution P(X) alone, with no target variable. The main task families are clustering (k-means, hierarchical clustering, DBSCAN, Gaussian mixture models fitted with the EM algorithm), dimensionality reduction (principal component analysis, which projects data onto the directions of greatest variance; t-SNE (van der Maaten and Hinton, 2008) and UMAP (McInnes et al., 2018) for non-linear visualisation), density estimation (kernel density estimates, mixture models, normalising flows) and association rule mining (the Apriori algorithm for market-basket analysis).\n\nAnomaly detection is the most common security use and is what behavioural analytics products (UEBA) typically build on. Methods include isolation forests (Liu, Ting and Zhou, 2008), which isolate points by random splits and score outliers by how few splits they need; one-class SVMs; local outlier factor; and autoencoders, which learn to reconstruct normal data and flag inputs with high reconstruction error. All of these model \"normal\" from historical data, so an attacker who was already present during the baseline period becomes part of normal, and legitimate change (a new VPN provider, a reorganisation) produces bursts of false positives.\n\nEvaluation is the central difficulty. Without labels there is no ground truth to score against, so practitioners use internal criteria (silhouette score, Davies-Bouldin index, reconstruction error, log-likelihood on held-out data) that measure geometric or statistical fit rather than usefulness. In anomaly detection, a small labelled set of known incidents is often assembled after the fact purely for evaluation. Results are sensitive to feature scaling, distance metric and hyperparameters such as the number of clusters or the contamination rate, and in high dimensions distances concentrate so that nearest and farthest neighbours become hard to distinguish.\n\nThe boundary with self-supervised learning is often blurred. Autoencoders and language-model pretraining both learn from unlabelled data, but self-supervised methods construct an explicit prediction target from the data and train with a supervised-style loss, which is why they are now usually treated as a separate category. Unsupervised methods also serve as preprocessing for supervised ones: PCA or learned embeddings reduce dimensionality, and cluster assignments can become features.\n\nIn a governance context, unsupervised output is a hypothesis, not a finding. Clusters and anomaly scores need human interpretation before they drive decisions about people, and profiling built on them can still fall under GDPR rules on profiling and automated decision-making (Article 22) when it produces legal or similarly significant effects.","da":"Ikke-superviseret læring estimerer egenskaber ved inputfordelingen P(X) alene, uden en målvariabel. De vigtigste opgavetyper er klyngeanalyse (k-means, hierarkisk klyngeanalyse, DBSCAN, gaussiske mixture-modeller tilpasset med EM-algoritmen), dimensionsreduktion (principal component analysis, der projicerer data på retningerne med størst varians; t-SNE (van der Maaten og Hinton, 2008) og UMAP (McInnes m.fl., 2018) til ikke-lineær visualisering), tæthedsestimering (kernetæthedsestimater, mixture-modeller, normalizing flows) og associationsregler (Apriori-algoritmen til kurvanalyse i detailhandel).\n\nAnomalidetektion er den mest udbredte sikkerhedsanvendelse og det, adfærdsanalyseprodukter (UEBA) typisk bygger på. Metoderne omfatter isolation forests (Liu, Ting og Zhou, 2008), der isolerer punkter med tilfældige opsplitninger og scorer afvigere efter, hvor få opsplitninger de kræver; one-class SVM'er; local outlier factor; og autoencodere, der lærer at rekonstruere normale data og markerer input med stor rekonstruktionsfejl. Alle modellerer \"normalen\" ud fra historiske data, så en angriber, der allerede var til stede i baselineperioden, bliver en del af det normale, og legitime ændringer (en ny VPN-udbyder, en omorganisering) giver bølger af falske positiver.\n\nEvaluering er den centrale vanskelighed. Uden mærkater findes der ingen facit at score mod, så man bruger interne kriterier (silhouette-score, Davies-Bouldin-indeks, rekonstruktionsfejl, log-likelihood på tilbageholdte data), der måler geometrisk eller statistisk tilpasning frem for nytte. Ved anomalidetektion samler man ofte bagefter et lille mærket sæt af kendte hændelser alene til evaluering. Resultaterne er følsomme over for skalering af features, afstandsmål og hyperparametre som antal klynger eller forventet andel afvigere, og i mange dimensioner koncentreres afstandene, så nærmeste og fjerneste nabo bliver svære at skelne.\n\nGrænsen til selvsuperviseret læring er ofte flydende. Autoencodere og fortræning af sprogmodeller lærer begge af umærkede data, men selvsuperviserede metoder konstruerer et eksplicit forudsigelsesmål ud fra data og træner med et tab i superviseret stil, og derfor behandles de nu som regel som en særskilt kategori. Ikke-superviserede metoder bruges også som forbehandling til superviserede: PCA eller lærte embeddings reducerer dimensionerne, og klyngetildelinger kan blive til features.\n\nI en governance-sammenhæng er ikke-superviseret output en hypotese, ikke et fund. Klynger og anomaliscorer kræver menneskelig fortolkning, før de styrer beslutninger om personer, og profilering bygget på dem kan stadig falde ind under databeskyttelsesforordningens regler om profilering og automatiske afgørelser (artikel 22), når den har retsvirkning eller på tilsvarende vis betydeligt påvirker den registrerede."},"edges":[{"type":"requires","to":"ai/training-data","confidence":"high","strength":"normal"},{"type":"kind-of","to":"ai/machine-learning","confidence":"high","strength":"normal"}],"depth":1,"sources":[{"title":"Russell & Norvig (2020), Artificial Intelligence: A Modern Approach, 4th edition","url":"https://aima.cs.berkeley.edu/","tier":"textbook","publisher":"Pearson"},{"title":"Goodfellow, Bengio & Courville (2016), Deep Learning","url":"https://www.deeplearningbook.org/","tier":"textbook","publisher":"MIT Press"},{"title":"ISO/IEC 22989:2022, Information technology: Artificial intelligence concepts and terminology","url":"https://www.iso.org/standard/74296.html","tier":"standard","publisher":"ISO/IEC"},{"title":"van der Maaten & Hinton (2008), Visualizing Data using t-SNE","url":"https://www.jmlr.org/papers/v9/vandermaaten08a.html","tier":"reference","publisher":"Journal of Machine Learning Research"},{"title":"McInnes, Healy & Melville (2018), UMAP: Uniform Manifold Approximation and Projection for Dimension Reduction","url":"https://arxiv.org/abs/1802.03426","tier":"reference","publisher":"arXiv"},{"title":"Regulation (EU) 2016/679 (GDPR), Article 22","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","tier":"standard","publisher":"European Union"}],"draft":true}