Security: What are the warning signs that a 51% attack is occurring or is about to occur?

I understand that this depends largely on the method of attack. The two most likely scenarios I can see would be:

Scenario 1] New mining platforms that add more than 50% of the power of online hashing to start a 51% attack.
This seems unlikely given how difficult and expensive it would be to buy the necessary equipment and hide them successfully.

or

Scenario 2] Existing mining groups that add> 50% of hash power begin an attack.
This could be the result of state coercion, criminal intent or piracy of mining pools.

Does anyone have any idea what the observable warning signs of these attacks would be? For example: scenario 2 could be preceded by a sharp drop in the hash rate> 50% in the bitcoin network. This would imply that half of the mining network has begun to extract blocks in a parallel chain.