Robust Fraud Transaction Detection: A Two-Player Game Approach

Robust Fraud Transaction Detection: A Two-Player Game Approach

Speakers: Qi Tan (presented by Wenjun Yang)

Conference: NDSS Symposium 2026

YouTube: https://www.youtube.com/watch?v=TdU07N0ww1s

Overview

This talk presents Gamer, a novel fraud detection system that models the adversarial interaction between fraudsters and detection systems as a two-player game. The core insight is that fraudsters exploit insufficient training data through feature falsification -- strategically modifying transaction features to evade AI-based detection models. Rather than using conventional adversarial training or data augmentation, which only locally enhance robustness, Gamer uses game-theoretic equilibrium to determine optimal feature selection strategies that account for the cost-profit dynamics of both attackers and defenders.

The system employs two specialized models: a Completer model that uses all features for maximum accuracy on legitimate transactions, and a Selector model trained with equilibrium-based feature masking that is robust against falsification. By comparing predictions from both models, Gamer can detect whether a transaction has been falsified and route it to the appropriate model. Evaluated on real-world data from Ant Group, Gamer increased F1 scores by 67.5% on average over two months of fraud detection, with particularly strong performance during a large-scale attack in January 2023.

Background

▶ Watch: AI-based fraud detection and the feature falsification problem (0:00)

AI-based fraud detection systems follow a standard workflow: transaction features are collected, a model is trained on historical data, and the deployed model predicts whether new transactions are fraudulent. Decisions based on these predictions -- interrupting transactions or disabling accounts -- directly affect fraudster profits, creating strong incentives for evasion.

Transaction features include both mandatory and temporal attributes that are not restricted to small intervals. Crucially, modifying these features consumes resources -- for example, falsifying "days after certificate" requires maintaining fraudulent accounts over time. This cost structure means fraudsters are rational economic actors who weigh the cost of falsification against expected profits.

Previous defensive approaches -- adversarial training, model regularization, and data augmentation -- share a fundamental limitation: they only locally enhance model robustness without considering the economic incentives driving feature falsification. They treat the problem as a static optimization rather than a dynamic adversarial interaction where both sides adapt their strategies.

The authors apply causal analysis to the fraud detection lifecycle, identifying two causal paths between real labels and predicted labels: a model-inclusive path representing genuine correlations, and a falsification-inclusive path that creates spurious correlations exploited by fraudsters. The key finding is that these spurious correlations arise specifically from selection bias in training data -- insufficient coverage of falsified transaction patterns.

Key Findings

▶ Watch: Causal analysis of the fraud detection lifecycle (4:00)

Causal root cause of evasion: Through formal causal analysis of the fraud detection lifecycle, the authors demonstrate that successful feature falsification originates from insufficient training data (selection bias). When training data does not adequately represent falsified transactions, the model learns correlations that fraudsters can exploit by modifying features to create spurious predictions.

Game-theoretic equilibrium for feature selection: By modeling fraud detection as a two-player game where fraudsters choose which features to falsify and defenders choose which features to select, the authors derive an optimal mixed strategy at the Nash equilibrium. Cost-profit information collected from security experts defines the payoff matrix, and the equilibrium provides probabilistic feature selection strategies that are robust against rational adversaries.

Dual-model detection system: The Gamer architecture uses divergence between the Completer and Selector model predictions as a signal for falsification. When predictions differ significantly, the transaction is likely falsified, and the Selector's prediction (trained to be robust against falsification) is used. When predictions agree, the Completer's prediction (trained for maximum accuracy) is used.

67.5% F1 improvement in production: On real-world Ant Group transaction data, Gamer improved fraud detection F1 scores by an average of 67.5% over a two-month evaluation period. During a large-scale attack in January 2023 that doubled the enterprise's asset loss rate, Gamer exhibited even more significant detection improvements.

Technical Deep Dive

▶ Watch: Two-player game formulation with cost-profit payoff matrix (6:00)

The technical framework begins with formalizing the fraud detection lifecycle as a causal diagram. Variables include real labels (Y), features (X), predicted labels (Y-hat), decisions (D), and profits (P). The causal diagram reveals two paths from Y to Y-hat: the model-inclusive path (Y -> X -> Y-hat, representing genuine learned correlations) and the falsification-inclusive path (Y -> P -> X' -> Y-hat, where profits motivate feature modification).

The spurious correlation Y=1 (fraud) -> Y-hat=0 (predicted benign) occurs when the falsification-inclusive path dominates, which happens specifically when training data exhibits selection bias -- i.e., the model has not seen enough examples of falsified fraudulent transactions.

The two-player game is formulated with the following structure. For each feature, the fraudster has two strategies: falsify or not. The detection system has two strategies: select or not. The payoff matrix is constructed using cost-profit knowledge from domain experts. Feature falsification costs (resources required to modify a feature) and detection benefits (accuracy improvement from using a feature) define the payoffs for each strategy combination.

The Nash equilibrium of this game yields a mixed strategy -- probabilistic decisions on which features to select. This is converted into an equilibrium-based mask that probabilistically zeros out features during both training and inference. The probabilistic masking ensures that:

1. Features likely to be falsified are excluded, preventing the model from learning exploitable correlations
2. The training distribution matches the inference distribution when masking is applied
3. The strategy is optimal against rational adversaries who consider cost-profit tradeoffs

The Gamer architecture trains two models in parallel:

• Completer: Trained on all features without masking, optimized for accuracy on unfalsified transactions
• Selector: Trained with equilibrium-based masking applied, optimized for robustness against falsified transactions

At inference time, both models process the same transaction. The Completer sees all features; the Selector sees masked features. If their predictions diverge significantly, the transaction is flagged as potentially falsified and the Selector's prediction is used. If predictions agree, the Completer's more accurate prediction is used.

Demo / Proof of Concept

▶ Watch: Gamer architecture: Completer vs Selector dual-model design (8:00)

No live demo was performed. The evaluation consisted of two experimental tracks:

Simulated experiments: Feature falsification costs were randomly assigned, and experiments were repeated 30 times to eliminate bias from cost assignment. Gamer was tested against both rational fraudsters (who optimize for cost-profit) and irrational fraudsters (who maximize attack success rate regardless of cost). Gamer outperformed existing methods against both adversary types, demonstrating robustness across the adversarial spectrum.

Real-world experiments: Using production transaction data from Ant Group with cost-profit information validated by Ant Group security experts, Gamer was evaluated over a two-month period. The 67.5% average F1 improvement was achieved across both months. The January 2023 large-scale attack, which doubled the enterprise's asset loss rate, served as a natural stress test where Gamer's improvements were even more pronounced.

Defensive Implications

▶ Watch: Real-world results: 67.5% F1 improvement on Ant Group data (10:00)

Gamer offers a fundamentally different approach to fraud detection robustness that has several practical implications for defenders:

Game theory over brute-force adversarial training: Rather than trying to generate all possible adversarial examples, Gamer reasons about the strategic incentives of fraudsters. This is more efficient and more realistic, since real fraudsters are economic actors who weigh costs against profits.

Expert knowledge integration: The payoff matrix construction leverages cost-profit information from security experts, creating a formal mechanism for incorporating domain knowledge into model design. This bridges the gap between security analysts who understand attacker economics and machine learning engineers who build detection models.

Falsification detection as a first-class signal: The divergence between Completer and Selector predictions provides an explicit signal that a transaction has been tampered with, rather than just a fraud/benign classification. This could trigger additional investigation workflows or stepped-up verification for flagged transactions.

Adaptability to evolving threats: When fraudsters change their falsification strategies, the game can be re-solved with updated cost-profit information to produce new equilibrium-based feature selection strategies, providing a systematic framework for adapting to evolving threats.

Key Takeaways

• Feature falsification in fraud detection succeeds because of selection bias in training data -- insufficient representation of falsified transaction patterns
• Modeling fraud detection as a two-player game with cost-profit payoffs yields an optimal feature selection strategy at Nash equilibrium
• The dual-model Gamer architecture (Completer + Selector) detects falsified transactions by comparing predictions with and without equilibrium-based feature masking
• Real-world evaluation on Ant Group data showed 67.5% average F1 improvement over two months, with stronger gains during active large-scale attacks
• The approach works against both rational (cost-optimizing) and irrational (success-rate-maximizing) adversaries
• Causal analysis provides a principled framework for understanding why and how fraudsters exploit feature falsification to evade detection

About the Speaker(s)

Wenjun Yang, a PhD candidate at the University of Washington, presented this work on behalf of the original authors, including Qi Tan, who were unable to attend due to visa issues. The research was conducted in collaboration with Ant Group, whose security experts provided the cost-profit domain knowledge used to construct the game-theoretic payoff matrices and validate the real-world experimental results.