Model monitoring

Model monitoring uses deployed-model behaviour to identify changes over time.

When the training dataset is representative of the real world, its activation data provides a baseline for typical model behaviour. Deployed-model activation data can then be monitored against that baseline to identify deviations from the norm.

Activation data as a monitoring baseline

Activation data identifies which partitions and rules are activated by queries.

During training, the distribution of activations across the dataset describes how the model behaves under expected conditions. When the model is deployed, live queries produce their own activation patterns.

Comparing deployed activation patterns with the training baseline can reveal whether the model is seeing data that behaves differently from the data it was trained on.

Detecting drift

A deviation from the expected activation pattern may indicate data drift.

For example, if deployed queries start activating partitions that were rarely activated during training, or if common training partitions become uncommon in production, this may show that the production data distribution has changed.

These signals can help determine whether the model should be reviewed, monitored more closely, or retrained.

Detecting security events

Activation data can also be combined with query monitoring data to detect intrusion or security events.

Unusual activation patterns may indicate that the model is receiving unexpected, adversarial, or abnormal queries. When paired with query-level monitoring, activation data can help distinguish ordinary drift from potentially suspicious behaviour.