Change Point Detection

9 min read

Learn

Quick Reading

Estimated 9 mins

Prereq

Intermediate

Basic ML concepts helpful

Interactive

Static Playbook

Static guide & reference tables

What counts as a change point

A change point is a moment in a time series where the underlying statistical properties shift — the mean, the variance, the trend slope, or the full distribution generating the data. Unlike anomaly detection, which flags individual unusual points, change point detection (CPD) asks a structural question: does the series behave differently before and after time $t$? This matters for monitoring (did a server deployment change latency behavior?), finance (did volatility regime shift?), and sensor data (did a machine's vibration pattern change, signaling wear?).

Formally, given a series $y_1, \dots, y_n$, CPD looks for a set of indices $\tau_1 < \tau_2 < \dots < \tau_k$ that split the series into segments, each of which is well-modeled by its own simpler model (e.g., its own mean and variance), such that no single global model fits well across segment boundaries.

CUSUM: detecting a shift in the mean

The cumulative sum (CUSUM) control chart is one of the oldest CPD tools, originally developed for industrial quality control (Page, 1954). It accumulates the signed deviation from a reference mean $\mu_0$: $S_t = \max(0, S_{t-1} + (x_t - \mu_0 - k))$, where $k$ is a small allowance (slack) parameter. If $S_t$ exceeds a threshold $h$, a change is flagged. Because deviations accumulate, CUSUM can detect persistent small shifts that a single-point threshold test would miss, while still responding quickly to large shifts. The tradeoff between $k$, $h$, detection delay, and false-alarm rate is well studied and can be tuned via average run length (ARL) calculations.

Offline detection: optimal partitioning and PELT

When you have the full series available and want to find the single best set of change points retrospectively (offline detection), the problem becomes a model selection task: choose segment boundaries that minimize $\sum_{i=1}^{k+1} C(y_{\tau_{i-1}:\tau_i}) + \beta k$, where $C$ is a cost function measuring how poorly a constant model fits each segment (e.g., negative log-likelihood, or sum of squared deviations from the segment mean), and $\beta k$ penalizes adding more change points to avoid simply cutting the series into tiny, trivially well-fit pieces.

Brute-force search over all possible partitions is $O(n^2)$ or worse. PELT (Pruned Exact Linear Time, Killick, Fearnhead & Eckley, 2012) finds the exact optimal partition in expected $O(n)$ time by pruning candidate change-point locations that provably can never be part of the optimal solution, using a dynamic programming recursion with an early-elimination rule.

Offline and online change point detection with ruptures

python

import ruptures as rpt
import numpy as np

signal = np.load("sensor_readings.npy")  # 1D or multivariate array

# --- Offline: PELT with a mean-shift cost model ---
algo = rpt.Pelt(model="rbf", min_size=10, jump=1)
algo.fit(signal)
# penalty controls sensitivity: larger penalty => fewer detected change points
change_points = algo.predict(pen=10)
print("Detected change points:", change_points)

# --- Offline: fixed number of change points via dynamic programming ---
algo_k = rpt.Dynp(model="l2", min_size=10).fit(signal)
change_points_k = algo_k.predict(n_bkps=3)

# --- Visualize ---
rpt.display(signal, change_points)

Bayesian Online Change Point Detection reasons in run lengths

For streaming data, BOCPD (Adams & MacKay, 2007) maintains a probability distribution over the 'run length' — how many observations have passed since the last change point — updating it with each new data point using Bayes' rule and a hazard function for how often change points are expected to occur. Instead of a single hard detection, BOCPD gives a posterior probability that a change happened at each possible recent point, which is useful when you want calibrated uncertainty rather than a binary alarm, and it naturally handles detecting multiple regimes online without needing to know $k$ in advance.

Choosing a change point detection method

Method	Online/Offline	Assumes known # of change points?	Output
CUSUM	Online	No	Binary alarm when threshold crossed
PELT	Offline	No (penalty-driven)	Exact optimal set of change points
Dynamic programming (Dynp)	Offline	Yes (k specified)	Exact optimal set for given k
BOCPD	Online	No	Posterior probability per run length

Penalty choice dominates the result, not the algorithm

In practice, the biggest source of disagreement between CPD runs isn't which algorithm you pick — it's the penalty term $\beta$ (for PELT) or the threshold $h$ (for CUSUM). Too small, and the method flags noise as structural change, cutting the series into dozens of spurious segments. Too large, and real regime shifts get absorbed into a single averaged segment and missed entirely. Methods like BIC-based penalty selection or cross-validation on held-out segments help, but domain knowledge about how often genuine changes are expected usually matters more than any automatic tuning procedure.

What's next

Change point detection complements forecasting rather than replacing it: knowing that a regime shift just occurred tells you to discount pre-shift history, retrain on the new regime, or raise an alert — decisions that sit on top of whatever forecasting model is in use. Combining detected change points with the trend, seasonal, and sequence models covered elsewhere gives a more complete picture of how a series behaves and when that behavior has actually changed.

I build these systems professionally.

Whether it's a RAG pipeline, analytics migration, or AI workflow — let's talk.

Work With Me →