Skip to main content

Anomaly Detection

The anomaly detection engine runs five structural detectors across case data to surface potential quality issues:

Anomaly detectors

ParameterTypeDescription
Validation ClusterD1Multiple validation failures concentrated in the same document or field group.
Field ConflictD2The same field has contradictory values across documents in a case.
Duplicate Key DivergenceD3Documents share a link key value but differ on fields that should match.
Missing Document TypeD4A case template expects a document type that is absent from this case.
Value ReuseD5Identical values appear across unrelated fields, suggesting copy-paste or extraction errors.

Anomalies appear in the Anomalies tab of the case detail page (Advanced mode). Each anomaly card shows severity, affected fields, and a dismiss button. Dismissed anomalies are hidden by default but visible via the show dismissed toggle.

The detection engine runs automatically after case formation and whenever case membership changes (documents added, removed, or cases merged). Each detector operates independently — a single case can trigger multiple anomaly types simultaneously. Anomaly counts are displayed as badges in the case header for quick triage.

Use anomaly detection to surface data quality issues that would otherwise require manual comparison across documents. For best results, configure case templates so the Missing Document Type detector (D4) can flag incomplete cases. Most teams find that D2 (Field Conflict) and D3 (Duplicate Key Divergence) catch the highest-value issues in procurement and financial workflows.

A typical workflow starts on the cases list page, where anomaly count badges give you an at-a-glance view of which cases need attention. Click into a case with anomalies, switch to the Anomalies tab, and use the severity filter pills to focus on critical issues first. Each anomaly card explains the affected fields and the specific violation detected. Dismiss false positives with the dismiss button — they remain accessible via the show dismissed toggle if you need to revisit them later.

  • D1 — Validation Cluster: multiple validation failures concentrated in the same document or field group
  • D2 — Field Conflict: contradictory values for the same field across documents in a case
  • D3 — Duplicate Key Divergence: shared link key but differing values on fields that should match
  • D4 — Missing Document Type: case template expects a document type that is absent
  • D5 — Value Reuse: identical values across unrelated fields, suggesting copy-paste or extraction errors
List anomalies for a specific case
curl -s "https://api.talonic.com/v1/cases/case_abc/anomalies" \
  -H "Authorization: Bearer $TALONIC_API_KEY"

# Response:
# {
#   "anomalies": [
#     {
#       "id": "anom_001",
#       "detector": "D2",
#       "type": "field_conflict",
#       "severity": "high",
#       "fields": ["total_amount"],
#       "description": "total_amount is 12,450 in Invoice_4521.pdf but 12,500 in PO_8890.pdf",
#       "dismissed": false,
#       "detected_at": "2025-04-18T10:05:00Z"
#     }
#   ]
# }

Anomaly detection is designed for high-throughput triage. In a workspace processing hundreds of cases per week, the anomaly count badges on the cases list page give you an instant heat map of where problems are concentrated. A case with zero anomalies typically needs only a quick spot-check, while a case with multiple D2 (field conflict) or D3 (duplicate key divergence) anomalies warrants detailed investigation. This severity-based prioritization lets your team focus review effort where it has the highest impact, rather than reviewing every case with equal depth.

Anomaly detection requires Advanced mode to be enabled. In Simple mode, anomalies are still computed but not displayed in the case detail page. Toggle Advanced mode from the sidebar to access the full anomaly workflow.

Frequently asked questions

What anomalies does Talonic detect?+
Five structural patterns: validation clusters (D1), field conflicts (D2), duplicate key divergence (D3), missing document types (D4), and value reuse (D5). Each is surfaced as a dismissable card on the case detail page. D2 and D3 are the highest-value detectors for procurement and financial workflows — they catch contradictory values across related documents, such as mismatched amounts between an invoice and its corresponding purchase order.
Do anomalies update automatically when cases change?+
Yes. The detection engine re-runs whenever case membership changes — documents added or removed, cases merged or split. Anomaly badges in the case header update in real time. Each detector operates independently, so a single case can trigger multiple anomaly types simultaneously. This continuous re-evaluation ensures that anomalies stay current as your document corpus evolves.
Can I dismiss anomalies?+
Yes. Each anomaly card includes a dismiss button. Dismissed anomalies are hidden by default but can be revealed using the show dismissed toggle on the Anomalies tab.
What is the difference between anomaly detection and validation checks?+
Validation checks (Phase 3) operate on individual documents — they flag issues within a single record like date inconsistencies or format mismatches. Anomaly detection operates at the case level — it compares values across multiple documents within a case to find conflicts, divergences, and missing patterns. Both are complementary: validation catches per-document issues while anomaly detection catches cross-document issues.

Related

Cases
Evidence Validation
Validation Checks