Paper deep dive
Dual-Scale Relational Graph Transformers for Ecosystem-Aware Fraud Detection
Mohsen Nayebi Kerdabadi, Xinrou Li, Yao Xiao, Zijun Yao, Xin Sun
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%
Last extracted: 10/6/2026, 10:49:54 AM
Summary
The paper introduces HERMES, a dual-scale graph transformer architecture for detecting Account Takeover (ATO) fraud in digital banking. It combines Micro-GT, which models local heterogeneous relational structures using structured attention masks, with Macro-GT, which captures global ecosystem context via non-anticipative climate tokens and adaptive class prototypes. Evaluated on 130 million sessions from a U.S. financial institution, HERMES significantly outperforms production tabular models and graph-based baselines, reducing customer friction by 44.44% and improving fraud recall by 24.66%.
Entities (8)
Relation Signals (8)
Hermes → appliedto → Account Takeover (ATO) Fraud
confidence 99% · Account takeover (ATO) fraud is a growing threat... We present HERMES... for high-risk Sessions
Hermes → consistsof → Macro-GT
confidence 98% · Macro-GT models ecosystem-level context using non-anticipative climate tokens...
Hermes → consistsof → Micro-GT
confidence 98% · Micro-GT captures local heterogeneous graph structure... Complementing this local representation, Macro-GT models ecosystem-level context...
Macro-GT → uses → Adaptive Class Prototypes
confidence 95% · ...together with adaptive class prototypes that track representative fraud and benign session patterns over time.
Micro-GT → uses → Structured Attention Masks
confidence 95% · Micro-GT applies a relational graph transformer... using four structured attention masks to preserve relation-specific semantics...
Macro-GT → uses → Climate Tokens
confidence 95% · Macro-GT models ecosystem-level context using non-anticipative climate tokens...
Hermes → developedby → Capital One
confidence 85% · Evaluated on more than 130 million high-risk transaction sessions from a leading U.S. financial institution... Affiliation: AI Foundations, Capital One
Hermes → developedby → University of Kansas
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Account takeover (ATO) fraud is a growing threat to digital banking, requiring effective detection while minimizing friction for legitimate customers. Production systems predominantly rely on tabular models that score sessions in isolation, discarding the relational structure of the underlying interaction network. Although graph-based models exploit relationships among sessions and network entities, they primarily reason over local neighborhoods and therefore capture only part of the problem: fraud risk depends jointly on the local relational structure surrounding a session and the evolving global state of the fraud ecosystem. We present HERMES (HEterogeneous Relational Micro--macro graph transformer Encoder for high-risk Sessions), a dual-scale architecture that jointly models these complementary scales of information. Micro-GT captures local heterogeneous graph structure through structured, relation-aware attention over a temporally safe session neighborhood. Complementing this local representation, Macro-GT models ecosystem-level context using non-anticipative climate tokens that summarize fraud dynamics, platform shifts, and infrastructure reuse, together with adaptive class prototypes that track representative fraud and benign session patterns over time. Evaluated on more than 130 million high-risk transaction sessions from a leading U.S. financial institution, HERMES consistently outperforms production and strong graph-based baselines, achieving a 44.44% relative reduction in customer friction and a 24.66% relative improvement in fraud recall over the production system. Ablation and temporal-stability analyses further demonstrate complementary gains from local relational modeling and global ecosystem context across changing fraud regimes.
Tags
Links
- Source: https://arxiv.org/abs/2610.04138v1
- Canonical: https://arxiv.org/abs/2610.04138v1
Trouble viewing inline? Open PDF directly →
Full Text
52,799 characters extracted from source content.
Expand or collapse full text
Geometric Distributional Deep Learning (GDDL) Dual-Scale Relational Graph Transformers for Ecosystem-Aware Fraud Detection Mohsen Nayebi Kerdabadi Affiliation: University of Kansas, Lawrence, KS, USA Email: xinrou.li@capitalone.com Xinrou Li Affiliation: AI Foundations, Capital One, McLean, VA, USA Email: yao.xiao@capitalone.com Yao Xiao Affiliation: AI Foundations, Capital One, McLean, VA, USA Email: xin.sun@capitalone.com Zijun Yao Affiliation: University of Kansas, Lawrence, KS, USA Email: mohsen.nayebi@ku.edu Xin Sun Affiliation: AI Foundations, Capital One, McLean, VA, USA Email: zyao@ku.edu Abstract Account takeover (ATO) fraud is a growing threat to digital banking, requiring effective detection while minimizing friction for legitimate customers. Production systems predominantly rely on tabular models that score sessions in isolation, discarding the relational structure of the underlying interaction network. Although graph-based models exploit relationships among sessions and network entities, they primarily reason over local neighborhoods and therefore capture only part of the problem: fraud risk depends jointly on the local relational structure surrounding a session and the evolving global state of the fraud ecosystem. We present Hermes (HEterogeneous Relational Micro–macro graph transformer Encoder for high-risk Sessions), a dual-scale architecture that jointly models these complementary scales of information. Micro-GT captures local heterogeneous graph structure through structured, relation-aware attention over a temporally safe session neighborhood. Complementing this local representation, Macro-GT models ecosystem-level context using non-anticipative climate tokens that summarize fraud dynamics, platform shifts, and infrastructure reuse, together with adaptive class prototypes that track representative fraud and benign session patterns over time. Evaluated on more than 130 million high-risk transaction sessions from a leading U.S. financial institution, Hermes consistently outperforms production and strong graph-based baselines, achieving a 44.44% relative reduction in customer friction and a 24.66% relative improvement in fraud recall over the production system. Ablation and temporal-stability analyses further demonstrate complementary gains from local relational modeling and global ecosystem context across changing fraud regimes. 1 Introduction Account takeover (ATO) fraud is a growing threat to digital financial services, causing substantial financial losses and eroding customer trust. In an ATO attack, an adversary gains access to a legitimate user’s account to conduct unauthorized activity or obtain sensitive information. Effective detection therefore presents a fundamental operational tradeoff: increasing fraud recovery often requires challenging more legitimate customers, introducing friction that degrades user experience (Doerfler et al., 2019). As attack strategies become increasingly sophisticated, practical fraud detection requires models that improve fraud recovery while minimizing unnecessary customer friction. ATO fraud is inherently a structured and non-stationary prediction problem. Sessions are connected through a heterogeneous interaction graph of shared accounts, devices, and network identifiers, creating relation-specific and temporal dependencies that session-level features alone cannot capture (Kerdabadi et al., 2025). At the same time, the risk associated with a local graph pattern depends on the broader fraud ecosystem, which evolves as attack volume, platform concentration, and infrastructure reuse shift over time. Reliable detection therefore requires reasoning jointly over the local relational structure surrounding a session and the evolving global ecosystem state in which that structure occurs. This challenge is further compounded by extreme class imbalance and delayed fraud adjudication, requiring models to operate non-anticipatively using only information available at scoring time. Existing fraud-detection models capture these complementary sources of information only partially. Production tabular systems score sessions largely in isolation, discarding relational dependencies among connected entities. Graph neural networks (Hamilton et al., 2017; Rao et al., 2021; Xiang et al., 2023) improve upon this by aggregating information from local neighborhoods, and temporal label propagation (Kerdabadi et al., 2025) can further incorporate confirmed fraud signals from connected sessions. However, conventional message passing can struggle to preserve informative dependencies across multiple hops because repeated aggregation may induce oversmoothing and oversquashing (Dwivedi et al., 2026). Generic aggregation can also blur the distinct semantics of account, device, and network relations and inadequately capture higher-order interactions across heterogeneous paths within a multi-hop neighborhood. Moreover, models restricted to local neighborhoods remain largely unaware of ecosystem-level regime changes. Consequently, existing approaches lack a unified mechanism for combining expressive local relational modeling with the evolving global context in which that structure should be interpreted. We present Hermes: HEterogeneous Relational Micro–macro Graph Transformer Encoder for high-risk transaction Sessions, a dual-scale architecture that addresses these limitations by jointly modeling local relational structure and global ecosystem context. Micro-GT applies a relational graph transformer over a temporally safe sampled neighborhood, using four structured attention masks to preserve relation-specific semantics and capture higher-order interactions across heterogeneous paths. Complementing this local representation, Macro-GT attends over non-anticipative ecosystem climate tokens that summarize evolving fraud dynamics, platform shifts, and infrastructure reuse, together with adaptive class prototypes that provide representative references for fraud and benign session patterns as they evolve. The two representations are fused and trained end-to-end for session-level fraud prediction. Evaluated on more than 130 million high-risk transaction sessions collected over one year at a leading U.S. financial institution, Hermes consistently outperforms both the production gradient-boosted system and strong graph-based baselines. Relative to the production system, Hermes achieves a 44.44% reduction in customer friction at fixed fraud recall and a 24.66% improvement in fraud recall at a fixed flag rate. Ablation studies demonstrate complementary gains from the proposed components, while temporal evaluation across four held-out test months demonstrates robustness to distribution shift. Our main contributions are as follows: • We present Hermes, a dual-scale architecture that jointly reasons over local graph neighborhood structure and evolving global ecosystem-level distributional context, enabling session-level fraud prediction across two complementary scales within a unified framework. • We propose Micro-GT, a local relational graph transformer that uses four structured attention masks to preserve heterogeneous relation semantics and capture higher-order interactions across temporally safe multi-hop neighborhoods. • We propose Macro-GT, an ecosystem-scale transformer that attends over a rich set of non-anticipative daily climate tokens covering multiple fraud signal categories, augmented with adaptive class prototypes that provide representative references for fraud and benign session patterns. • We conduct a production-scale evaluation on more than 130 million high-risk transaction sessions from a leading U.S. financial institution, with extensive ablations and temporal analyses demonstrating complementary gains from the local and global components and substantial improvements over the deployed production system. 2 Problem Formulation 2.1 Heterogeneous Temporal Session Graph Let S denote the set of high-risk digital transaction sessions. Each session v∈v is associated with a feature vector v∈ℝdx_v ^d, an occurrence timestamp τ(v)τ(v), and a binary fraud label yv∈0,1y_v∈\0,1\. Because fraud labels are adjudicated with delay, yvy_v becomes observable only at τ(v)+ℓτ(v)+ , where ℓ>0 >0 denotes the label lag. Let ℛR denote the set of relation types corresponding to account, device, and network identifiers, and let idr(v)id_r(v) denote the identifier of type r∈ℛr associated with session v. We define the relation-specific temporal predecessors of v as r−(v)=TopKτ(u∈:idr(u)=idr(v),τ(v)−T≤τ(u)<τ(v)),N_r^-(v)=TopK_τ ( \u :id_r(u)=id_r(v),\;τ(v)-T≤τ(u)<τ(v) \ ), (1) where T is the recency window and TopKτ(⋅)TopK_τ(·) retains up to K candidate sessions with the largest occurrence timestamps. For each destination session v, relation type r, and associated identifier a=idr(v)a=id_r(v), we instantiate a time-conditioned identifier node ir,aτ(v)i_r,a^τ(v), representing the state of identifier a at time τ(v)τ(v). Rather than treating identifiers as static entities, this formulation allows their representations to evolve as additional historical activity becomes available. Each shared-identifier relation is represented as u⟶ir,a(τ(v))⟶v,u∈r−(v),a=idr(u)=idr(v).u i_r,a^(τ(v)) v, u _r^-(v), a=id_r(u)=id_r(v). (2) Thus, ir,aτ(v)i_r,a^τ(v) represents the time-conditioned state of identifier a, summarizing its history available when session v is scored. For a target session v0v_0, we recursively apply Eq. (1) for H session hops to construct the local computation graph (v0)G(v_0). We define session-hop distance by treating each path u→ir,a(τ(v))→vu→ i_r,a^(τ(v))→ v as one relational hop. Accordingly, v0v_0 is assigned hop 0, its direct session predecessors hop 1, and more distant predecessors increasing hop indices up to H. Because every expansion satisfies τ(u)<τ(v)τ(u)<τ(v), (v0)G(v_0) is temporally ordered and contains no future-session information. 2.2 Temporally-Safe Node Representation Session nodes carry their session-level features vx_v. To incorporate historical fraud information without label leakage, label-dependent features are computed only from predecessors whose labels are observable when v is scored. For relation r, the lag-safe predecessor set is ℒr−(v)=u∈r−(v):τ(u)+ℓ≤τ(v).L_r^-(v)= \u _r^-(v):τ(u)+ ≤τ(v) \. (3) Thus, structural inclusion requires τ(u)<τ(v)τ(u)<τ(v), while label-dependent features additionally require τ(u)+ℓ≤τ(v)τ(u)+ ≤τ(v). Identifier-node features likewise use only information available at the destination timestamp. Full feature definitions are provided in Appendix A.1. 2.3 Task Definition For a target session v0v_0, let (v0)X(v_0) denote the serve-time features associated with its local computation graph, and let τ(v0)C_τ(v_0) denote the global ecosystem context available at time τ(v0)τ(v_0). The session-level fraud detection task is y^v0=fθ((v0),(v0),τ(v0))∈[0,1], y_v_0=f_θ\! (G(v_0),X(v_0),C_τ(v_0) )∈[0,1], (4) where y^v0 y_v_0 estimates the probability that v0v_0 is fraudulent. All local and global inputs are restricted to information available at τ(v0)τ(v_0), ensuring consistent temporal constraints during training, evaluation, and production inference. 3 Method Hermes is a dual-scale architecture that represents each target session from two complementary perspectives. Micro-GT models the local relational structure of the target-conditioned temporal graph, while Macro-GT captures the evolving ecosystem context available at the target’s scoring time. The two representations are fused through a learned projection and optimized jointly for session-level fraud prediction. Figure 1 provides an overview. Figure 1: Hermes architecture. Micro-GT encodes the target session’s local heterogeneous neighborhood through structured relational attention, while Macro-GT models non-anticipative ecosystem context together with adaptive fraud and benign reference prototypes. 3.1 Local Graph Tokenization For a target session v0v_0, Micro-GT operates on the target-conditioned computation graph (v0)G(v_0) defined in Section 2. We instantiate H=2H=2 session hops and retain fixed budgets of at most K1K_1 hop-1 and K2K_2 hop-2 session predecessors, selected according to the temporal sampling rule in Eq. (1). Missing positions are padded and masked from all subsequent attention operations. Time-conditioned identifier states mediate relational paths throughout (v0)G(v_0), but only those adjacent to the target are explicitly tokenized. Specifically, for each relation r∈ℛr , we include ir,arτ(v0)i_r,a_r^τ(v_0), where ar=idr(v0)a_r=id_r(v_0). Their serve-time feature construction is detailed in Appendix A.3. Figure 2 illustrates the resulting local context. Each tokenized session or identifier state q is mapped to q∈ℝdt_q ^d by combining feature, type, hop, temporal, and structural encodings following Dwivedi et al. (2026): q=fmix(feat(q),type(q),hop(q),time(q,v0),pe(q)),t_q=f_mix\! (h_feat(q),\,h_type(q),\,h_hop(q),\,h_time(q,v_0),\,h_pe(q) ), (5) where fmixf_mix is a two-layer MLP projecting the concatenated components to dimension d. The components are feat(q) _feat(q) =MLPϕ(q)(BNϕ(q)(q))∈ℝd, =MLP_φ(q)\! (BN_φ(q)(x_q) ) ^d, (6) type(q) _type(q) =type[ϕ(q)], =E_type[φ(q)], hop(q) _hop(q) =hop[p(q,v0)], =E_hop[p(q,v_0)], time(q,v0) _time(q,v_0) =tlog(1+Δτ(q,v0))+bt. =w_t \! (1+ τ(q,v_0) )+b_t. Here, MLPϕ(q)MLP_φ(q) and BNϕ(q)BN_φ(q) denote type-specific feature projection and normalization, mapping raw node features of potentially different dimensions to d; ϕ(q)φ(q) denotes the node type and p(q,v0)p(q,v_0) the session-hop index. The target and its adjacent identifier states are assigned hop 0, while hop-1 and hop-2 sessions receive indices 1 and 2, respectively. For session tokens, Δτ(q,v0)=τ(v0)−τ(q) τ(q,v_0)=τ(v_0)-τ(q); for target-adjacent identifier states, Δτ(q,v0)=0 τ(q,v_0)=0. Finally, pe(q)h_pe(q) is a permutation-equivariant structural positional encoding produced by a lightweight GNN with randomized initialization over (v0)G(v_0), following Dwivedi et al. (2026). Let vk(1)k=1K1\v_k^(1)\_k=1^K_1 and vk(2)k=1K2\v_k^(2)\_k=1^K_2 denote the padded hop-1 and hop-2 session slots, and let aj=idrj(v0)a_j=id_r_j(v_0). The Micro-GT input sequence is (0)=[ ^(0)= [ v0|v1(1),…,vK1(1)|v1(2),…,vK2(2)| _v_0\; |\;t_v_1^(1),…,t_v_K_1^(1)\; |\;t_v_1^(2),…,t_v_K_2^(2)\; |\; (7) ir1,a1(τ(v0)),…,ir|ℛ|,a|ℛ|(τ(v0))]∈ℝL×d,L=1+K1+K2+|ℛ|. _i_r_1,a_1^(τ(v_0)),…,t_i_r_|R|,a_|R|^(τ(v_0)) ] ^L× d, L=1+K_1+K_2+|R|. Padding positions remain masked throughout Micro-GT. Figure 2: Micro-GT local graph tokenization with the target session, hop-1 and hop-2 predecessors, and target-adjacent time-conditioned identifier states. 3.2 Micro-GT: Local Relational Transformer Let =(0)T=Z^(0) denote the token sequence from Eq. (7). Rather than applying undifferentiated all-pair attention, Micro-GT uses four structured attention masks applied sequentially, each with independent query, key, and value projections. Each masked attention pass follows the pre-norm residual form ←+Attnm(LN(),Mm),Attnm(,Mm)=softmax(mm⊤dk+Mm)m,T +Attn_m (LN(T),M_m ), _m(T,M_m)=softmax ( Q_mK_m d_k+M_m )V_m, (8) where m=mQQ_m=TW_m^Q, m=mKK_m=TW_m^K, and m=mVV_m=TW_m^V. Each Mm∈0,−∞L×LM_m∈\0,-∞\^L× L specifies the permitted interactions for attention pass m. The four masks are illustrated in Figure 3. (1) Identity-Self mask 1M_1. The target token and its identifier tokens attend to one another, allowing the model to first establish the target’s relational identity context. Let ℐ0=v0∪ir,arτ(v0):r∈ℛI_0= \v_0 \∪ \i_r,a_r^τ(v_0):r \. Then 1[i,j]=0M_1[i,j]=0 iff both tokens i and j belong to ℐ0I_0. (2) Relation-group mask 2M_2. For each session token q, let ρ(q)⊆ℛρ(q) denote the relation types it shares with the target. Two session tokens may interact when their relation sets overlap, while the target and identifier-context tokens remain accessible to all groups: 2[i,j]=0⇔ρ(i)∩ρ(j)≠∅ori∈ℐ0orj∈ℐ0.M_2[i,j]=0 ρ(i)∩ρ(j)≠ \;\;or\;\;i _0\;\;or\;\;j _0. (9) This preserves relation-specific interactions while allowing sessions linked through multiple identifiers to participate in multiple groups. (3) Chain mask 3M_3. For each hop-1 session, the target, that hop-1 session, and its associated hop-2 predecessors form an attention group. This explicitly models multi-hop relational chains while keeping paths through different hop-1 intermediaries separate. (4) Full-context mask 4M_4. All non-padding tokens attend to one another, enabling information exchange across relation groups and propagation chains after the structured passes. The four passes are applied in order: identity-self, relation-group, chain, full-context, followed by a shared feed-forward sublayer with pre-norm residual. This constitutes one relational transformer block, and Hermes stacks NLN_L such blocks. The final local representation micro∈ℝdh_micro ^d is obtained through seed-conditioned attention pooling: micro=v0(NL)+∑i≠v0αii(NL),αi=exp(r⊤[v0(NL)∥i(NL)])∑j≠v0exp(r⊤[v0(NL)∥j(NL)]),h_micro=t_v_0^(N_L)+ _i≠ v_0 _i\,t_i^(N_L), _i= \! (w_r [t_v_0^(N_L)\|t_i^(N_L)] ) _j≠ v_0 \! (w_r [t_v_0^(N_L)\|t_j^(N_L)] ), (10) where r∈ℝ2dw_r ^2d is learned and padding positions are excluded from the softmax. Figure 3: Micro-GT applies four sequential attention patterns over the local token sequence followed by seed-conditioned pooling to obtain microh_micro. 3.3 Macro-GT: Ecosystem Context Transformer Macro-GT models the global ecosystem context τ(v0)C_τ(v_0) available when target session v0v_0 is scored. For each calendar date t, we construct typed climate tokens summarizing complementary aspects of the fraud ecosystem: (1) global fraud activity (G), including multi-window fraud-rate trends, session volume, and acceleration; (2) platform-specific behavior (P1,P2P_1,P_2), capturing per-channel fraud rates, traffic share, and temporal trends; (3) cross-platform shifts (X), reflecting changes in fraud concentration across channels; (4) velocity and anomaly signals (V), capturing sudden changes in fraud rate, volume, and campaign intensity; (5) ecosystem topology (E), summarizing new-entity activity, identifier sharing, and infrastructure concentration; and (6) the current risk regime (R), including label coverage, high-risk infrastructure prevalence, and repeat-fraud activity. All statistics are computed non-anticipatively; in particular, label-dependent quantities use only sessions satisfying τ(u)+ℓ≤tτ(u)+ ≤ t. Complete climate-feature definitions are provided in Appendix A.6. Each climate feature vector is projected to ℝdR^d and combined with a learned type embedding. Macro-GT additionally receives the target session representation, its time-conditioned identifier states, and adaptive class prototypes representing characteristic fraud and benign patterns. Let 0s_0 denote the projected target representation, kc_k a climate token, and ri_r the encoded state ir,ar(τ(v0))i_r,a_r^(τ(v_0)) of the target’s identifier of type r, where ar=idr(v0)a_r=id_r(v_0). The input sequence is (0)=[0|G,P1,P2,X,V,E,R|1,…,|ℛ||1+,…,Kf+,1−,…,Knf−].S^(0)= [s_0\; |\;c_G,c_P_1,c_P_2,c_X,c_V,c_E,c_R\; |\;i_1,…,i_|R|\; |\; μ_1^+,…, μ_K_f^+, μ_1^-,…, μ_K_nf^- ]. (11) A standard pre-norm transformer layer applies full self-attention over (0)S^(0), allowing the target to jointly compare its own state with the current ecosystem context, its identifier history, and representative fraud and benign patterns. The resulting macro representation macro∈ℝdh_macro ^d is obtained using the same seed-conditioned attention pooling as in Micro-GT, with 0s_0 as the query. 3.3.1 Adaptive Class Prototypes Fraud and benign sessions may exhibit multiple characteristic patterns rather than forming a single cluster. We therefore maintain separate sets of representative prototypes in the Macro-GT embedding space: +=k+k=1Kf,−=k−k=1Knf,P^+= \ μ_k^+ \_k=1^K_f, ^-= \ μ_k^- \_k=1^K_nf, (12) where +P^+ and −P^- provide reference patterns for fraud and benign sessions, respectively. Initialization. The two prototype sets are initialized separately using K-Means++ seeding (Arthur and Vassilvitskii, 2007) on class-stratified training embeddings in batch-normalized representation space. Adaptive update. After each training batch, a session embedding is assigned only to the nearest prototype of its own class. For class c∈+,−c∈\+,-\, let kcC_k^c denote the batch embeddings assigned to prototype kc μ_k^c. Assigned prototypes are updated by exponential moving average (EMA): kc←αkc+(1−α)1|kc|∑v∈kc^macro(v),c∈+,−, μ_k^c←α\, μ_k^c+(1-α) 1|C_k^c| _v _k^c h_macro(v), c∈\+,-\, (13) where ^macro=BN(macro) h_macro=BN(h_macro) and α∈(0,1)α∈(0,1) is the EMA momentum. The prototypes are maintained as non-learnable buffers and updated outside the backward pass, decoupling their adaptation from the classification objective. Prototypes that remain unassigned beyond a fixed patience threshold are reinitialized from class-matched batch embeddings to maintain coverage of the representation space. 3.4 Training Objective The micro and macro embeddings are combined via a learned linear projection: hout=c[hmicro∥hmacro]+c,h_out=W_c [h_micro\;\|\;h_macro ]+b_c, (14) and a two-layer MLP head with GELU activation and dropout produces the scalar logit. Hermes is trained end-to-end with class-reweighted binary cross-entropy: ℒ=−1|ℬ|∑v∈ℬ[w+yvlogy^v+(1−yv)log(1−y^v)],w+=|0||1|,L=- 1|B| _v [w^+\,y_v y_v+(1-y_v) (1- y_v) ], w^+= |V_0||V_1|, (15) where y^v=σ(logitv) y_v=σ(logit_v), |0||V_0| and |1||V_1| are the non-fraud and fraud counts in the training set, and ℬB is a mini-batch sampled via a neighborhood loader. The EMA prototype update is applied after each gradient step, strictly outside the backward pass. 4 Experiments 4.1 Dataset and Evaluation Protocol We evaluate Hermes on a proprietary dataset of more than 130 million high-risk transaction sessions collected over one year from the digital channels of a leading U.S. financial institution. Each session includes behavioral, platform, and device-related features, together with shared account, device, and network identifiers that define the relational graph. Fraud labels are binary and become observable only after an adjudication delay of ℓ days. Fraud accounts for less than 0.1% of all sessions, resulting in extreme class imbalance. We use a chronological split: the final four months form the test set, the preceding two months form the validation set, and all earlier sessions are used for training. The four test months are also evaluated separately for temporal-stability analysis. All models use the same temporal splits and obey the serve-time and label-maturity constraints defined in Section 2, preventing future-session and immature-label leakage. We report ROC-AUC overall and separately for two digital access channels, denoted P1P_1 and P2P_2 for confidentiality. To evaluate deployment-relevant performance, we additionally report two operating-point metrics based on the flag rate, i.e., the fraction of sessions flagged as high risk and subjected to friction interventions. Flag rate therefore serves as an operational proxy for customer friction. Specifically, FR@50R denotes the flag rate required to achieve 50% fraud recall (lower is better), while R@5FR denotes fraud recall at a 5% flag rate (higher is better). 4.2 Results Table 1 compares Hermes with production, tabular, sequential, and graph-based baselines, followed by an incremental ablation of the proposed architecture. All relative changes are reported with respect to the production XGBoost system. Baseline comparison. XGBoost (production) is the gradient-boosted production system that scores sessions independently and serves as the primary reference, achieving 80.26% overall AUC, 78.05% P1 AUC, and 74.10% P2 AUC. MLP performs nearly identically, indicating that additional model capacity alone provides little benefit without relational information. FT-Transformer (Gorishniy et al., 2021) underperforms XGBoost, particularly on P2 (66.54% AUC). Transformer-Seq improves overall AUC to 81.95% but remains weak on P2 (72.97%), showing that sequential context alone cannot capture broader cross-session dependencies. GNN (GraphSAGE) exploits the shared-identifier graph, increasing overall AUC to 82.00% and P2 AUC to 76.20%, while reducing FR@50R by 10.03% relative to production. GNN + LP (ATLAS) (Kerdabadi et al., 2025) further incorporates lag-safe fraud history from connected predecessors, reaching 84.02% overall AUC, 82.45% P1 AUC, and 78.75% P2 AUC. Relative to production, ATLAS reduces FR@50R by 34.59% and improves R@5FR by 19.62%, establishing a strong relational baseline and highlighting the value of adjudicated fraud signals from connected sessions. Component ablation. Starting from ATLAS, Micro-GT (full attention) replaces homogeneous SAGE-style aggregation with a local transformer over the heterogeneous node tokens defined in Eq. (6). This raises overall AUC from 84.02% to 84.58% and P2 AUC from 78.75% to 80.47%, while improving FR@50R from 6.325% to 5.821% and R@5FR from 46.93% to 47.75%. These gains show that incorporating node heterogeneity and direct all-pair interactions captures higher-order dependencies beyond conventional message passing. Micro-GT (relational masks) further increases overall AUC to 84.78% and P1 AUC to 83.10%, while maintaining comparable operational performance, supporting structured attention over account, device, network, and multi-hop relational interactions. Adding Macro-GT (climate tokens) raises overall AUC to 84.93% and P2 AUC to 81.06%, while reducing FR@50R to 5.519% and increasing R@5FR to 48.44%. The strong P2 improvement indicates that ecosystem-level fraud dynamics, platform shifts, velocity, and infrastructure signals provide complementary information beyond the local neighborhood. Finally, adaptive class prototypes complete Hermes, yielding the best performance across all reported metrics: 85.12% overall AUC, 83.46% P1 AUC, 81.35% P2 AUC, 5.373% FR@50R, and 48.91% R@5FR. Compared with production, Hermes improves overall, P1, and P2 AUC by 4.86, 5.41, and 7.25 points, respectively, while achieving a 44.44% relative reduction in FR@50R and a 24.66% relative improvement in R@5FR. Overall, the results demonstrate complementary gains from expressive local relational modeling, structured relation-aware attention, global ecosystem context, and adaptive class prototypes. Table 1: Overall performance and component ablation. All values are in %. FR@50R denotes the flag rate at 50% fraud recall (↓ ), and R@5FR denotes fraud recall at a 5% flag rate (↑ ). Parentheses report relative change from the production XGBoost baseline. Model AUC P1 AUC P2 AUC FR@50R↓ R@5FR↑ XGBoost (production) 80.26 78.05 74.10 9.671 39.24 MLP 80.29 (+0.03) 77.99 (−-0.08) 75.10 (+1.35) 9.360 (−-3.21) 39.78 (+1.39) FT-Transformer 79.16 (−-1.37) 77.02 (−-1.31) 66.54 (−-10.20) 11.213 (+15.94) 35.42 (−-9.74) Transformer-Seq 81.95 (+2.10) 80.28 (+2.86) 72.97 (−-1.52) 9.244 (−-4.41) 39.60 (+0.91) GraphSAGE 82.00 (+2.16) 80.05 (+2.57) 76.20 (+2.84) 8.701 (−-10.03) 41.54 (+5.87) GraphSAGE + LP (ATLAS) 84.02 (+4.69) 82.45 (+5.64) 78.75 (+6.28) 6.325 (−-34.59) 46.93 (+19.62) Micro-GT (full attention) 84.58 (+5.39) 82.83 (+6.13) 80.47 (+8.59) 5.821 (−-39.80) 47.75 (+21.70) Micro-GT (relational masks) 84.78 (+5.64) 83.10 (+6.48) 80.37 (+8.47) 5.801 (−-40.01) 47.83 (+21.89) + Macro-GT 84.93 (+5.82) 83.24 (+6.65) 81.06 (+9.40) 5.519 (−-42.93) 48.44 (+23.45) Hermes (+centroids) 85.12 (+6.06) 83.46 (+6.94) 81.35 (+9.79) 5.373 (−-44.44) 48.91 (+24.66) 4.3 Temporal Stability To assess robustness to temporal distribution shift, we evaluate Hermes and key baselines separately across four consecutive held-out test months. Figure 4 shows that Hermes consistently outperforms all baselines throughout the evaluation window, with no degradation relative to the graph-based models in later months. The gains remain stable across periods with changing fraud activity, indicating that the combination of local relational modeling and global ecosystem context improves robustness across evolving fraud regimes. Such temporal stability is particularly important in production settings, where fraud distributions shift continuously, and frequent model recalibration is costly. Figure 4: Temporal stability: ROC-AUC of Hermes and key baselines across four consecutive held-out test months. Hermes consistently outperforms all baselines. 5 Related Work Account takeover detection in operational systems requires balancing fraud prevention against unnecessary intervention on legitimate users. Doerfler et al. (2019) study this tradeoff at Google by evaluating risk-aware login challenges against real-world account hijacking attempts and quantifying the resulting user friction. In an industrial marketplace setting, Kawase et al. (2019) analyze ATO at mobile.de and develop a concept-drift-sensitive detection strategy for evolving attacker behavior. Relational modeling has also been explored more broadly for financial fraud (Liu et al., 2018; Jiang et al., 2022; Egressy et al., 2024). TitAnt (Cao et al., 2019) demonstrates large-scale real-time transaction fraud detection using transaction-network information at Ant Financial, while xFraud (Rao et al., 2021) applies heterogeneous graph neural networks to large-scale real-world transaction networks. GTAN (Xiang et al., 2023) constructs temporal transaction graphs and propagates risk through gated temporal attention, and FraudGT (Lin et al., 2024) introduces an edge-aware graph transformer for financial transaction graphs. Beyond fraud-specific architectures, Relational Graph Transformer (RelGT) (Dwivedi et al., 2026) introduces multi-element relational tokenization with local subgraph attention and global centroids for general relational prediction. Hermes builds on this tokenization framework while introducing temporally structured local attention, ecosystem climate tokens, and class-stratified EMA prototypes for non-anticipative ATO detection. Among ATO-specific methods, ATLAS (Kerdabadi et al., 2025) is most closely related, modeling consumer-banking ATO as node classification on a time-respecting session graph that links sessions through shared account, device, and network identifiers using GraphSAGE and serve-time-safe label propagation. Building on this line of relational fraud modeling, Hermes combines structured local reasoning over heterogeneous, time-conditioned session relationships with non-anticipative ecosystem-level context and adaptive fraud and benign reference prototypes. 6 Conclusion We presented Hermes, a dual-scale graph transformer architecture for ATO fraud detection that combines structured local relational modeling with global ecosystem context. Micro-GT captures heterogeneous multi-hop interactions, while Macro-GT incorporates non-anticipative climate signals and adaptive class prototypes. Evaluated on more than 130 million high-risk transaction sessions, Hermes achieves 85.12% ROC-AUC, a 44.44% relative reduction in customer friction, and a 24.66% relative improvement in fraud recall over the production system. Ablation and temporal analyses show complementary gains from the local and global components and robust performance across evolving fraud conditions. References Arthur and Vassilvitskii (2007) D. Arthur and S. Vassilvitskii K-means++: the advantages of careful seeding. In ACM-SIAM Symposium on Discrete Algorithms, Cited by: §3.3.1. Cao et al. (2019) S. Cao, X. Yang, C. Chen, J. Zhou, X. Li, and Y. Qi TitAnt: online real-time transaction fraud detection in ant financial. Proc. VLDB Endow. 12 (12), p. 2082–2093. External Links: ISSN 2150-8097, Link, Document Cited by: §5. Doerfler et al. (2019) P. Doerfler, K. Thomas, M. Marincenko, J. Ranieri, Y. Jiang, A. Moscicki, and D. McCoy Evaluating login challenges as adefense against account takeover. In The World Wide Web Conference, p. 372–382. Cited by: §1, §5. Dwivedi et al. (2026) V. P. Dwivedi, S. Jaladi, Y. Shen, F. Lopez, C. Kanatsoulis, R. Puri, M. Fey, and J. Leskovec Relational graph transformer. In International Conference on Learning Representations, C. Vondrick, B. Hariharan, C. Raffel, L. Pinto, D. Yang, and A. Faust (Eds.), Vol. 2026, p. 154348–154369. External Links: Link Cited by: §1, §3.1, §3.1, §5. Egressy et al. (2024) B. Egressy, L. Von Niederhäusern, J. Blanuša, E. Altman, R. Wattenhofer, and K. Atasu Provably powerful graph neural networks for directed multigraphs. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 38, p. 11838–11846. Cited by: §5. Gorishniy et al. (2021) Y. Gorishniy, I. Rubachev, V. Khrulkov, and A. Babenko Revisiting deep learning models for tabular data. In Advances in Neural Information Processing Systems, Cited by: §4.2. Hamilton et al. (2017) W. L. Hamilton, R. Ying, and J. Leskovec Inductive representation learning on large graphs. In Advances in Neural Information Processing Systems, Cited by: §1. Jiang et al. (2022) J. Jiang, Y. Li, B. He, B. Hooi, J. Chen, and J. K. Z. Kang Spade: a real-time fraud detection framework on evolving graphs. Proceedings of the VLDB Endowment 16 (3), p. 461–469. Cited by: §5. Kawase et al. (2019) R. Kawase, F. Diana, M. Czeladka, M. Schüler, and M. Faust Internet fraud: the case of account takeover in online marketplace. In Proceedings of the 30th ACM conference on hypertext and social media, p. 181–190. Cited by: §5. Kerdabadi et al. (2025) M. N. Kerdabadi, W. A. Byron, X. Sun, and A. Iranitalab Spatio-temporal directed graph learning for account takeover fraud detection. arXiv preprint arXiv:2509.20339. Cited by: §1, §1, §4.2, §5. Lin et al. (2024) J. Lin, X. Guo, Y. Zhu, S. Mitchell, E. Altman, and J. Shun FraudGT: a simple, effective, and efficient graph transformer for financial fraud detection. In Proceedings of the 5th ACM International Conference on AI in Finance, p. 292–300. Cited by: §5. Liu et al. (2018) Z. Liu, C. Chen, X. Yang, J. Zhou, X. Li, and L. Song Heterogeneous graph neural networks for malicious account detection. In ACM International Conference on Information and Knowledge Management, Cited by: §5. Rao et al. (2021) S. X. Rao, S. Zhang, Z. Han, Z. Zhang, W. Min, Z. Chen, Y. Shan, Y. Zhao, and C. Zhang XFraud: explainable fraud transaction detection. Proc. VLDB Endow. 15 (3), p. 427–436. External Links: ISSN 2150-8097, Link, Document Cited by: §1, §5. Xiang et al. (2023) S. Xiang, M. Zhu, D. Cheng, E. Li, R. Zhao, Y. Ouyang, L. Chen, and Y. Zheng Semi-supervised credit card fraud detection via attribute-driven graph representation. In Proceedings of the AAAI conference on artificial intelligence, Vol. 37, p. 14557–14565. Cited by: §1, §5. Appendix A Appendix A.1 Token Feature Definitions Throughout this appendix, ϵ>0ε>0 denotes a small constant for numerical stability, clip(x,a,b)=min(max(x,a),b)clip(x,a,b)= ( (x,a),b), yu∈0,1y_u∈\0,1\ is the fraud label of session u, τ(u)τ(u) its timestamp, ℓ the label lag, t0t_0 the dataset start date, and idr(u)id_r(u) the identifier of type r∈ℛr associated with session u. We use acc(u)acc(u), dev(u)dev(u), and net(u)net(u) as shorthand for the account, device, and network identifiers, respectively. A.2 Label-Propagated (LP) Features For each session v, let ℒ−(v)=⋃r∈ℛℒr−(v)L^-(v)= _r L_r^-(v) (16) denote the set of direct predecessors with adjudicated labels available at score time, where ℒr−(v)L_r^-(v) is defined in Section 2. Four aggregate statistics are computed and prepended to vx_v: nℓ(v) n_ (v) =|ℒ−(v)| =|L^-(v)| number of labeled predecessors, (17) nf(v) n_f(v) =∑u∈ℒ−(v)yu = _u ^-(v)y_u count of fraudulent predecessors, (18) ρf(v) _f(v) =nf(v)max(nℓ(v), 1) = n_f(v) (n_ (v),\,1) local fraud rate, (19) f(v) 1_f(v) =[nf(v)>0] =1[n_f(v)>0] any-fraud indicator. (20) A.3 Identifier Token Features For relation type r and identifier a, each time-conditioned identifier state ir,a(t)i_r,a^(t) carries a 25-dimensional feature vector representing the information available for identifier a at time t. Let r,a(t)=u∈:idr(u)=a,τ(u)<tA_r,a(t)=\u :id_r(u)=a,\;τ(u)<t\ (21) denote all sessions observed through identifier a before t, and let r,aℓ(t)=u∈r,a(t):τ(u)+ℓ≤tA_r,a (t)=\u _r,a(t):τ(u)+ ≤ t\ (22) denote the lag-safe subset. For readability, we suppress the identifier index a from the feature symbols below. A.4 Fraud rates (lag-safe, 4 features): ρr(w)(t)=∑u∈r,aℓ(t),τ(u)≥t−wyumax(|u∈r,aℓ(t):τ(u)≥t−w|, 1),w∈7,30,90,∞ days. _r^(w)(t)= _u _r,a (t),\;τ(u)≥ t-wy_u (|\u _r,a (t):τ(u)≥ t-w\|,\;1 ), w∈\7,30,90,∞\ days. (23) Absolute fraud and clean counts (lag-safe, 2 features): nfr(t) n_f^r(t) =∑u∈r,aℓ(t)yu,ncr(t)=|r,aℓ(t)|−nfr(t). = _u _r,a (t)y_u, n_c^r(t)=|A_r,a (t)|-n_f^r(t). (24) Session volume (no lag, 4 features): cr(w)(t)=|u∈r,a(t):τ(u)≥t−w|,w∈7,30,90,∞ days.c_r^(w)(t)=|\u _r,a(t):τ(u)≥ t-w\|, w∈\7,30,90,∞\ days. (25) Maturity (no lag, 2 features): days_activer(t) \_active_r(t) =t−minu∈r,a(t)τ(u), =t- _u _r,a(t)τ(u), (26) recencyr(t) _r(t) =t−maxu∈r,a(t)τ(u). =t- _u _r,a(t)τ(u). (27) Co-identifier diversity (no lag, 6 features): Let r′r and r′r be the two identifier types other than r. For window w∈7,30,90w∈\7,30,90\ days, count distinct co-occurring identifiers of type r′r observed alongside a: dr,r′(w)(t)=|idr′(u):u∈r,a(t),τ(u)≥t−w|.d_r,r ^(w)(t)= | \id_r (u):u _r,a(t),\;τ(u)≥ t-w \ |. (28) Features are computed for both r′r and r′r , giving 2×3=62× 3=6 features. Fraud-linked co-identifier counts (lag-safe, 4 features): For window w∈30,90w∈\30,90\ days and each of the two other identifier types r′,r′r ,r : dr,r′f,(w)(t)=|idr′(u):u∈r,aℓ(t),yu=1,τ(u)≥t−w|.d_r,r ^f,(w)(t)= | \id_r (u):u _r,a (t),\;y_u=1,\;τ(u)≥ t-w \ |. (29) Coverage (3 features): covr(w)(t)=min(days_activer(t),w)w,w∈7,30,90 days.cov_r^(w)(t)= (days\_active_r(t),\,w)w, w∈\7,30,90\ days. (30) A.5 Cross-Identifier Session Features Each session node v is further augmented with 7 cross-identifier features appended to vx_v, capturing pairwise relational risk signals across identifier types. Let r,r′(v,t)=u∈:idr(u)=idr(v),idr′(u)=idr′(v),τ(u)<tP_r,r (v,t)= \u :id_r(u)=id_r(v),\;id_r (u)=id_r (v),\;τ(u)<t \ (31) denote sessions sharing both identifiers r and r′r with v before t, and let r,r′ℓ(v,t)=u∈r,r′(v,t):τ(u)+ℓ≤tP_r,r (v,t)=\u _r,r (v,t):τ(u)+ ≤ t\ (32) denote the lag-safe subset. W denotes the lookback window for pair-level features. For quantities inherited from the identifier features above, the identifier for relation r is ar=idr(v)a_r=id_r(v). ρr,r′(v,t) _r,r (v,t) =∑u∈r,r′ℓ(v,t)yumax(|r,r′ℓ(v,t)|,1),(r,r′)∈(acc,dev),(acc,net),(dev,net), = _u _r,r (v,t)y_u (|P_r,r (v,t)|,1), (r,r )∈\(acc,dev),(acc,net),(dev,net)\, (33) nfpair(v,t) n_f^pair(v,t) =∑u∈acc,devℓ(v,t)yu, = _u _acc,dev (v,t)y_u, (34) ρmax(v,t) _ (v,t) =maxr∈ℛρr(90)(t), = _r _r^(90)(t), (35) any(v,t) 1_any(v,t) =[∃r∈ℛ:nfr(t)>0], =1 [∃\,r :n_f^r(t)>0 ], (36) covpair(v,t) _pair(v,t) =min(t−t0,W)W. = (t-t_0,\,W)W. (37) A.6 Ecosystem Climate Token Features Climate tokens are precomputed daily at date t. Let (t,w)=u∈:t−w≤τ(u)<tD(t,w)=\u :t-w≤τ(u)<t\ denote all sessions in a w-day window before t, and let ℓ(t,w)=u∈(t,w):τ(u)+ℓ≤tD (t,w)=\u (t,w):τ(u)+ ≤ t\ denote the lag-safe subset. The dataset start date t0t_0 is used for coverage normalization. For platform p∈P1,P2p∈\P_1,P_2\, let p(t,w)=u∈(t,w):platform(u)=pD_p(t,w)=\u (t,w):platform(u)=p\ and let pℓ(t,w)D_p (t,w) denote the corresponding lag-safe subset. Define the global fraud rate ρ(t,w)=∑u∈ℓ(t,w)yumax(|ℓ(t,w)|,1)ρ(t,w)= _u (t,w)y_u (|D (t,w)|,1) and the platform fraud rate ρp(t,w)=∑u∈pℓ(t,w)yumax(|pℓ(t,w)|,1). _p(t,w)= _u _p (t,w)y_u (|D_p (t,w)|,1). Token G — Global fraud climate (12 features): ρwG _w^G =ρ(t,w),w∈7,14,30,90 days, =ρ(t,w), w∈\7,14,30,90\ days, (38) νwG _w^G =log(1+|(t,w)|),w∈7,30 days, = (1+|D(t,w)|), w∈\7,30\ days, (39) δ7/30G _7/30^G =ρ(t,7)/(ρ(t,30)+ϵ)−1,δ30/90G=ρ(t,30)/(ρ(t,90)+ϵ)−1, =ρ(t,7)/(ρ(t,30)+ε)-1, _30/90^G=ρ(t,30)/(ρ(t,90)+ε)-1, (40) aG a^G =δ7/30G−δ30/90G(fraud acceleration), = _7/30^G- _30/90^G (fraud acceleration), (41) covwG _w^G =min(t−t0,w)/w,w∈7,30,90. = (t-t_0,w)/w, w∈\7,30,90\. (42) Tokens P1P_1, P2P_2 — Platform-specific climate (10 features each): For platform p: ρwp _w^p =ρp(t,w),w∈7,30,90, = _p(t,w), w∈\7,30,90\, (43) σ7p _7^p =|p(t,7)|/max(|(t,7)|,1)(session share), =|D_p(t,7)|/ (|D(t,7)|,1) (session share), (44) ϕ7p _7^p =∑u∈pℓ(t,7)yu/max(∑u∈ℓ(t,7)yu,1)(fraud share), = _u _p (t,7)y_u\;/\; \! ( _u (t,7)y_u,1 ) (fraud share), (45) δ7/30p _7/30^p =ρp(t,7)/(ρp(t,30)+ϵ)−1,ν7p=log(1+|p(t,7)|), = _p(t,7)/( _p(t,30)+ε)-1, _7^p= (1+|D_p(t,7)|), (46) covwp _w^p =min(t−t0,w)/w,w∈7,30,90. = (t-t_0,w)/w, w∈\7,30,90\. (47) Token X — Cross-platform shift (5 features): Let ϕwp=∑u∈pℓ(t,w)yumax(∑u∈ℓ(t,w)yu,1) _w^p= _u _p (t,w)y_u ( _u (t,w)y_u,1) denote the share of total fraud attributable to platform p in window w, and let σwp=|p(t,w)|/max(|(t,w)|,1) _w^p=|D_p(t,w)|/ (|D(t,w)|,1) denote its session share. ξw _w =ρP1(t,w)/(ρP2(t,w)+ϵ),w∈7,30, = _P_1(t,w)/( _P_2(t,w)+ε), w∈\7,30\, (48) γw _w =ϕwP1−σwP1,w∈7,30(fraud concentration shift), = _w^P_1- _w^P_1, w∈\7,30\ (fraud concentration shift), (49) H7 H_7 =−σ7P1log(σ7P1+ϵ)−(1−σ7P1)log(1−σ7P1+ϵ). =- _7^P_1 ( _7^P_1+ε)-(1- _7^P_1) (1- _7^P_1+ε). (50) Token V — Velocity and anomaly (7 features): zρ(w) z_ρ^(w) =clip(ρ(t,w)−ρ(t,90)ρ(t,90)(1−ρ(t,90))+ϵ,−5,5),w∈7,30, =clip\! ( ρ(t,w)-ρ(t,90) ρ(t,90)(1-ρ(t,90))+ε,-5,5 ), w∈\7,30\, (51) zν(7) z_ν^(7) =clip(|(t,7)|/7−|(t,90)|/90|(t,90)|/90+ϵ,−5,5), =clip\! ( |D(t,7)|/7-|D(t,90)|/90 |D(t,90)|/90+ε,-5,5 ), (52) zf(7) z_f^(7) =clip(f7/7−f90/90f90/90+ϵ,−5,5),fw=∑u∈ℓ(t,w)yu, =clip\! ( f_7/7-f_90/90 f_90/90+ε,-5,5 ), f_w= _u (t,w)y_u, (53) bG b^G =clip(maxk=06ρ(t−k,1)ρ(t,30)+ϵ,0,20)(fraud burst), =clip\! ( _k=0^6ρ(t-k,1)ρ(t,30)+ε,0,20 ) (fraud burst), (54) covwV _w^V =min(t−t0,w)/w,w∈7,30. = (t-t_0,w)/w, w∈\7,30\. (55) Token E — Ecosystem topology (10 features): Let r(t,w)X_r(t,w) be the set of unique identifiers of type r observed in (t,w)D(t,w), and let rnew(t,w)⊆r(t,w)X_r^new(t,w) _r(t,w) denote those first observed within [t−w,t)[t-w,t). ηr(w) _r^(w) =|rnew(t,w)|/max(|r(t,w)|,1),r∈dev,acc,w=7, =|X_r^new(t,w)|/ (|X_r(t,w)|,1), r∈\dev,acc\,\;w=7, (56) s¯dev(t) s_dev(t) =meani∈dev(t,7)|j∈acc(t,7):∃u,dev(u)=i∧acc(u)=j|, =mean_i _dev(t,7) | \j _acc(t,7):∃ u,\;dev(u)=i (u)=j \ |, (57) κnet(t) _net(t) =∑top-5ci/|(t,7)|,ci=|u∈(t,7):net(u)=i|, = _top-5c_i\;/\;|D(t,7)|, c_i=|\u (t,7):net(u)=i\|, (58) ψ(t) ψ(t) =|acc(t,7)|/max(|dev(t,7)|,1), =|X_acc(t,7)|/ (|X_dev(t,7)|,1), (59) Δηdev _dev =clip(ηdev(7)/(ηdev(30)+ϵ)−1,−2,5), =clip\! ( _dev^(7)/( _dev^(30)+ε)-1,-2,5 ), (60) Δκnet _net =clip(|net(t,7)|/(7|net(t,30)|/30+ϵ)−1,−2,5), =clip\! (|X_net(t,7)|/(7|X_net(t,30)|/30+ε)-1,-2,5 ), (61) covwE _w^E =min(t−t0,w)/w,w∈7,30,90. = (t-t_0,w)/w, w∈\7,30,90\. (62) Token R — Risk regime (7 features): Let ℱℓ(t)=u∈:τ(u)+ℓ≤t,yu=1F (t)=\u :τ(u)+ ≤ t,\;y_u=1\ be all confirmed fraud sessions before t, and define hr(w)(t)=|u∈(t,w):idr(u)∈idr(f):f∈ℱℓ(t)|max(|(t,w)|,1)h_r^(w)(t)= | \u (t,w):id_r(u)∈\id_r(f):f (t)\ \ | (|D(t,w)|,1) as the fraction of sessions in window w that share an identifier of type r with any known-fraud session. λ(t) λ(t) =|ℓ(t,30)|/max(|(t,30)|,1)(label coverage), =|D (t,30)|/ (|D(t,30)|,1) (label coverage), (63) hr(7)(t) h_r^(7)(t) r∈net,dev(high-risk identifier share, 7-day), r∈\net,dev\ (high-risk identifier share, 7-day), (64) χacc(t) _acc(t) =hacc(7)(t)(repeat-fraud account rate), =h_acc^(7)(t) (repeat-fraud account rate), (65) Δhdev h_dev =clip(hdev(7)(t)/(hdev(30)(t)+ϵ)−1,−2,5)(contamination trend), =clip\! (h_dev^(7)(t)/(h_dev^(30)(t)+ε)-1,-2,5 ) (contamination trend), (66) covwR _w^R =min(t−t0,w)/w,w∈7,30. = (t-t_0,w)/w, w∈\7,30\. (67)