> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.umnai.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.umnai.com/_mcp/server.

# Model monitoring

Model monitoring uses deployed-model behaviour to identify changes over time.

When the training dataset is representative of the real world, its [activation data](../explanations/local-explanations/predictions-and-attributions#activations) provides a baseline for typical model behaviour. Deployed-model activation data can then be monitored against that baseline to identify deviations from the norm.

## Activation data as a monitoring baseline

Activation data identifies which [partitions](../explainable-neural-net-xnn#partition) and [rules](../explainable-neural-net-xnn#rule) are activated by queries.

During training, the distribution of activations across the dataset describes how the model behaves under expected conditions. When the model is deployed, live queries produce their own activation patterns.

Comparing deployed activation patterns with the training baseline can reveal whether the model is seeing data that behaves differently from the data it was trained on.

## Detecting drift

A deviation from the expected activation pattern may indicate data drift.

For example, if deployed queries start activating partitions that were rarely activated during training, or if common training partitions become uncommon in production, this may show that the production data distribution has changed.

These signals can help determine whether the model should be reviewed, monitored more closely, or retrained.

## Detecting security events

Activation data can also be combined with query monitoring data to detect intrusion or security events.

Unusual activation patterns may indicate that the model is receiving unexpected, adversarial, or abnormal queries. When paired with query-level monitoring, activation data can help distinguish ordinary drift from potentially suspicious behaviour.

![Monitoring a module with three partitions using activations and showing data drift on the left and a potential intrusion on the right](https://files.buildwithfern.com/umnai.docs.buildwithfern.com/79c0a970d68130e94406b03bd4af4b85bb695eccbfe574c1615aa5775c77ed23/assets/images/module-monitoring-drift-intrusion.png)