← All reportsRecorded WARNING evidence
Account takeover velocity surge
transaction-velocity-surge--warning--20260807T053217Z-544a48.md
Provenance Impact Report
- Run ID:
20260807T053217Z-544a48
- State: PUBLISHED
- Started: 2026-08-07 05:32:17.105619+00:00
- Completed: 2026-08-07 05:32:23.296966+00:00
Proposed Change
- Asset:
urn:li:dataset:(urn:li:dataPlatform:kafka,payments.authorized_transaction_events,PROD)
- Source column:
transactions_last_10_minutes
- Scenario: transaction-velocity-surge
- Request: A payment-fraud monitoring agent detected a sixfold transaction-velocity surge across eight percent of evaluated payments, consistent with an account-takeover-shaped stress condition.
- Trigger event:
account-takeover-001
- Trigger source:
payment-fraud-monitoring-agent
DataHub Context (through MCP)
- Source:
urn:li:dataset:(urn:li:dataPlatform:kafka,payments.authorized_transaction_events,PROD) (payments.authorized_transaction_events)
- Selected field:
transactions_last_10_minutes
- Owners:
urn:li:corpGroup:payment-fraud-monitoring
- Tags: Production, PaymentFraud, RealTimeML
Complete lineage
| Hop |
Upstream |
Downstream |
Relationship |
| 1 |
urn:li:dataset:(urn:li:dataPlatform:kafka,payments.authorized_transaction_events,PROD) |
urn:li:dataset:(urn:li:dataPlatform:postgres,fraud.realtime_payment_features,PROD) |
lineage |
| 2 |
urn:li:dataset:(urn:li:dataPlatform:postgres,fraud.realtime_payment_features,PROD) |
urn:li:mlFeature:(realtime_payment_risk_features,transactions_last_10_minutes) |
lineage |
| 3 |
urn:li:mlFeature:(realtime_payment_risk_features,transactions_last_10_minutes) |
urn:li:mlModel:(urn:li:dataPlatform:mlflow,payment_fraud_detector_v3,PROD) |
lineage |
Affected models
urn:li:mlModel:(urn:li:dataPlatform:mlflow,payment_fraud_detector_v3,PROD) ➔ payment_fraud_detector_v3
Evidence URNs
urn:li:dataset:(urn:li:dataPlatform:kafka,payments.authorized_transaction_events,PROD)urn:li:dataset:(urn:li:dataPlatform:postgres,fraud.realtime_payment_features,PROD)urn:li:mlFeature:(realtime_payment_risk_features,transactions_last_10_minutes)urn:li:mlModel:(urn:li:dataPlatform:mlflow,payment_fraud_detector_v3,PROD)
Experiment Plan
- Target asset:
urn:li:dataset:(urn:li:dataPlatform:kafka,payments.authorized_transaction_events,PROD)
- Rationale Explanation: Reproduce the observed account-takeover-shaped velocity surge against a bounded evaluation cohort and measure how the affected fraud model behaves.
- Expected signals: AUC drop, prediction flip rate, mean absolute probability shift
| # |
Operator |
Column |
Fraction |
Value |
| 1 |
scale_numeric |
transactions_last_10_minutes |
0.08 |
6.0 |
Observed Results
Experiment 1: scale_numeric
- Column:
transactions_last_10_minutes
- Duration (how long the mutation and mutated inference took)[ms]: 5.49460000002
- Error: n/a
| Metric |
Observed value |
baseline_auc |
0.8092934782608696 |
mutated_auc |
0.7688586956521739 |
auc_drop |
0.04043478260869571 |
prediction_flip_rate |
0.038 |
mean_absolute_probability_shift |
0.038155929963187674 |
inference_error_rate |
0.0 |
- Rows selected: 40 / 500
- Before summary:
{"maximum": 6.0, "mean": 1.806, "minimum": 0.0, "missing": 0}
- After summary:
{"maximum": 24.0, "mean": 2.436, "minimum": 0.0, "missing": 0}
Deterministic Decision
- Status: WARN
- Summary: Warning triggered by 1 deterministic rule(s).
Triggered policy rules
| Experiment |
Metric |
Observed |
Rule |
Result |
Reason |
| 1 |
auc_drop |
0.04043478260869571 |
>= 0.02 |
WARN |
AUC drop 0.040435 reached warning threshold 0.020000 |
Publication
- Local JSON:
mockup_data/artifacts/runs/20260807T053217Z-544a48.json
- Local Markdown:
mockup_data/artifacts/runs/20260807T053217Z-544a48.md
- Remote succeeded: yes
- DataHub tag: Provenance-WARN
- DataHub document: urn:li:document:shared-4c6c03c6-335b-4271-9930-228ca658b570
- Remote error: n/a
