Changepoint Detection and CUSUM

A strategy's daily P&L has averaged roughly flat with some noise for months, but you suspect something changed three weeks ago — maybe a market-structure shift quietly eroded the edge. Looking at a rolling average can hint at this, but rolling averages lag and smear out exactly when a real shift happened, and they react to every wiggle, not just genuine, persistent changes. Changepoint detection methods are built specifically to answer "did something real change, and if so, exactly when" — separating a true, lasting shift in behavior from ordinary short-term noise, using the fact that a genuine break leaves an accumulating, one-directional footprint in the data that noise alone does not.

An analogy: a tally that only grows when something's off

Imagine tracking a machine's output by writing down, each hour, how far that hour's production deviated from the expected target, and keeping a running total of these deviations rather than looking at each hour in isolation. If the machine is working normally, positive and negative deviations roughly cancel out over time, so the running total wanders near zero, going up a bit, down a bit. But if the machine's calibration genuinely slips — say, it starts running consistently low — every hour's deviation now points the same direction, and the running total starts climbing (or falling) steadily rather than wandering. The CUSUM (cumulative sum) method is exactly this running tally: it's built to stay near zero under normal noise, but to build up a clear, accelerating signal exactly once a persistent shift begins.

The mechanics, one symbol at a time

The CUSUM statistic accumulates deviations of the series $y_t$ from a reference value $\mu_0$ (the target or historical mean), typically with a small allowance $k$ for normal drift:

$$S_t = \max\big(0,\; S_{t-1} + (y_t - \mu_0) - k\big),$$

where $S_t$ is the running cumulative sum at time $t$ (reset to 0 whenever it would go negative, so it only tracks sustained upward deviation — a mirror-image version tracks downward shifts), $y_t - \mu_0$ is this period's raw deviation from target, and $k$ is a small slack term subtracted each period so ordinary noise doesn't slowly accumulate into a false alarm. In plain English: each period, add this period's deviation (minus a small allowance) to the running total, but never let the total go below zero — under normal conditions, deviations that are sometimes positive and sometimes negative keep $S_t$ hovering near zero, but once the series shifts to a persistently higher level, every period adds a positive amount and $S_t$ climbs steadily. A changepoint alarm triggers when $S_t$ crosses a pre-chosen threshold $h$, and the changepoint's estimated location is typically identified as where the climb actually began, not where the alarm fired.

Worked example 1: CUSUM catching a mean shift

Suppose a strategy's daily P&L target is $\mu_0 = 0$ with allowance $k=0.1$, and actual daily P&Ls for 6 days are $\{0.2, -0.1, 0.3, 0.9, 1.1, 0.8\}$ (a shift up starting around day 4). Computing $S_t$ step by step: $S_1 = \max(0, 0+0.2-0.1)=0.1$; $S_2=\max(0, 0.1-0.1-0.1)=\max(0,-0.1)=0$; $S_3=\max(0,0+0.3-0.1)=0.2$; $S_4=\max(0,0.2+0.9-0.1)=1.0$; $S_5=\max(0,1.0+1.1-0.1)=2.0$; $S_6=\max(0,2.0+0.8-0.1)=2.7$. The statistic sat near zero for the first three days (normal noise canceling out) and then climbed steadily from day 4 onward — if the alarm threshold were set at $h=1.5$, the alarm would trigger on day 5 ($S_5=2.0 > 1.5$), correctly flagging that a persistent upward shift began around day 4.

Worked example 2: choosing the threshold trade-off

Suppose two thresholds are considered: $h=1.0$ and $h=2.5$, applied to the same P&L sequence. With $h=1.0$, the alarm would have triggered already on day 4 ($S_4=1.0$) — fast detection, but more prone to false alarms on noisy days that happen to run a short positive streak. With $h=2.5$, the alarm doesn't trigger until day 6 ($S_6=2.7$) — slower to react, but far less likely to be fooled by ordinary noise. This is CUSUM's fundamental trade-off: a lower threshold catches real changes faster (and false alarms more often); a higher threshold catches real changes slower (but false alarms less often) — the choice of $h$ should reflect how costly a missed change is versus how costly a false alarm is in the specific application.

What this means in practice

CUSUM and related changepoint methods are used to monitor live strategy P&L, model residuals, or risk factor exposures for genuine regime breaks, distinguishing a real degradation in edge from ordinary streaky noise — critical for deciding when to actually pull a strategy rather than reacting to every rough week. It complements smoother trend-extraction tools like the Hodrick-Prescott filter (see The Hodrick-Prescott Filter), which characterizes gradual trend versus cycle but isn't designed to pinpoint discrete break moments the way CUSUM is.