# Judge a Transaction by the Company It Keeps Somya Rai & MD Sharique, EXL | AI Engineer NYC 2026 | 20:28 Source: https://www.youtube.com/watch?v=SHvwutPSeZg Channel: AI Engineer (https://www.youtube.com/@aiDotEngineer). Summarised by AIE Talks. Page: https://aietalks.com/talks/judge-a-transaction-by-the-company-it-keeps Published: 2026-10-13 Tags: embeddings, finance, inference, latency ## TL;DR - Fraud signals often sit in a transaction's graph neighborhood, so the system combines graph embeddings with an existing XGBoost classifier. - The model is evaluated by precision at a fixed analyst alert budget, with reported relative detection improvements of 27% to 33% over the tabular baseline. - Sampling, monthly graph separation, mean-max-standard deviation aggregation, edge attribution, and cached representations make the system usable in production. ## Summary Somya Rai and MD Sharique describe an EXL fraud detection system that adds graph neural network embeddings to an XGBoost model. Rai begins with two identical transactions that receive very different scores when one is evaluated alongside a neighborhood containing recent fraud. She explains why adding more row-level features reached a ceiling and why physical point-of-sale and online transactions need separate models. Sharique then covers the engineering choices behind the system. Users retain their complete transaction histories during sampling, monthly graphs prevent temporal leakage, and graph features include entity history and rolling-window behavior. GraphSAGE aggregates neighbor states with mean, maximum, and standard deviation so an unusual neighbor is not hidden by averaging. The system attributes scores to transaction edges for analyst review. Cached user and merchant representations keep graph-sized work off the request path. The reported system reached 27% to 33% relative lifts at matched alert rates, with a reported 3.1 millisecond P99 latency. ## Key ideas ### Fraud can be visible in a transaction's neighborhood even when the row looks clean [00:04](https://www.youtube.com/watch?v=SHvwutPSeZg&t=4s) Somya Rai compares two identical online purchases. A tabular model gives the transaction a score of 0.04, while a graph-aware model gives it 0.91 after seeing that three connected transactions involving the user and merchant were fraudulent within the last hour. The row has not changed. The surrounding edges have. Rai says point-of-sale transactions have a natural fraud rate of roughly 0.05%, while online transactions have a rate of 0.6% and depend more on merchant and neighbor context. The two portfolios therefore have different base rates and signal patterns, which leads EXL to use separate models. ### The system optimizes fraud capture inside a fixed analyst alert budget [01:31](https://www.youtube.com/watch?v=SHvwutPSeZg&t=91s) Analysts review only the highest-scoring 0.5% to 1.5% of transactions. Rai therefore treats precision at a fixed K as more useful than area under the curve by itself. A model has to move more real fraud into that reviewed slice without exceeding the available latency. Adding engineered features to XGBoost improved the reported positive rate only from 35.5 to 36.6 for point-of-sale transactions, with a similar one-point gain online. Rai attributes the ceiling to row-level features being functions of the transaction and the card's own history, rather than its relationships to other entities. ### GraphSAGE adds neighborhood information before XGBoost makes the final score [03:20](https://www.youtube.com/watch?v=SHvwutPSeZg&t=200s) The graph neural network gathers hidden states from neighbors such as the transaction's user and merchant, reduces a variable-sized neighborhood to a fixed-width vector, and combines that vector with the node's own state. Two layers let a transaction receive information from its neighbors and their neighbors. EXL does not replace XGBoost. The graph network produces embeddings, and those embeddings are added to the same gradient-boosted model used for scoring. Rai reports a 27% to 33% relative lift in true positive rate over the tabular baseline at the same alert rate, evaluation window, and available features. ### Sampling keeps complete user histories so the graph does not lose its useful edges [06:54](https://www.youtube.com/watch?v=SHvwutPSeZg&t=414s) MD Sharique says the training data uses a soft fraud target of 0.5% for card-related merchant transactions and 6% for online transactions, about ten times their natural rates. Selected users keep their complete transactional histories. Removing genuine transactions to achieve a class ratio would remove the edges that define the neighborhood. Genuine transactions from fraudulent users remain as hard negatives. If a cap is needed, it reduces the budget for genuine users, while fraud users are not capped. Class imbalance is handled later with balanced batches inside training. Sharique reports average training-time user degree of about 11.5 to almost 14, matching inference neighborhoods. ### Disjoint monthly graphs and earlier timestamps constrain information leakage [08:28](https://www.youtube.com/watch?v=SHvwutPSeZg&t=508s) Each calendar month is a separate graph, and no edge crosses the monthly boundary. A transaction aggregates only neighbors with earlier timestamps. The graph connects a transaction to its user and merchant and follows a five-hop chain through recent history. This construction blocks future leakage and train, validation, and test paths across months. The fraud flag is used as the target rather than as a feature or edge. Scalar preprocessing and vocabularies are fitted on the training month and then frozen. Sharique presents these controls as properties of graph construction rather than checks performed only after training. ### Mean, maximum, and standard deviation preserve unusual neighbors [11:26](https://www.youtube.com/watch?v=SHvwutPSeZg&t=686s) The graph model uses 202 features across users, transactions, and merchants, including history, risk aggregates, and rolling temporal features. For neighborhood aggregation, it concatenates mean, maximum, and standard deviation instead of relying on an average. Sharique gives an example with three neighbors scoring around 0.1 and one neighbor tied to a fraud ring scoring 0.92. The average becomes 0.32, which hides the outlier, while the maximum keeps the 0.92 signal. Standard deviation adds information about disagreement within the neighborhood. The chosen embedding dimension is 128 after a sweep; 64 slightly underfits and 256 adds cost without improving validation performance. ### Edge attribution gives analysts evidence for a suspicious score [14:32](https://www.youtube.com/watch?v=SHvwutPSeZg&t=872s) EXL runs subgraph attribution on 200 flagged cases in each channel. Transaction-to-transaction velocity edges have mean importance of 0.94 for card-related transactions and 0.62 online, and they are the top evidence in all 200 card-present cases. Merchant edges matter more online, with reported importance of 0.19 versus 0.04 for card-present cases. The explanation can connect a score of 0.91 to three linked transactions in the last 40 minutes. Sharique ties this to regulatory documentation, analyst investigation speed, model debugging, and the quality of labels returned to later training rounds. ### Cached representations keep graph-sized computation off the request path [16:58](https://www.youtube.com/watch?v=SHvwutPSeZg&t=1018s) The serving system computes representations offline with a layer-wise graph pass and stores user, merchant, and recent transaction states in an embedding store. A user's last five transactions sit in a ring buffer, and the request path reconstructs neighbor states with exponential time decay. The online service runs only the new transaction's two-layer forward pass and the XGBoost head. This avoids graph construction and any request-time work that scales with the graph. Caching every transaction would require about 60 GB and introduce a one-day embedding lag. Moving to user and merchant embeddings reduces the stated footprint to 2 to 3 GB. The reported end-to-end latency is 2.3 milliseconds at the median and 3.1 milliseconds at P99. ## Notable quotes - Somya Rai: "Fraud isn't a property of a transaction. It is a property of the neighborhood it sits in." (00:49) - Somya Rai: "The alert budget is fixed." (01:34) - MD Sharique: "If you trim a genuine user's history to hit a class ratio, you break the connectivity their neighbors depend on." (07:21) - MD Sharique: "A single dangerous neighbor among many genuine ones is exactly the pattern fraud rings create." (12:26) - MD Sharique: "Nothing that scales with graph size runs per request." (17:53) ## Tools & references mentioned - EXL - XGBoost - GraphSAGE - Nvidia ## Who should watch - You are building fraud or abuse detection where analysts can review only a small, fixed share of alerts. - Your tabular model has reached a feature-engineering ceiling and related entities may contain useful signals. - You need graph features in a low-latency service and have to explain individual scores to analysts or model-risk reviewers. ## Related talks - [Graph Intelligence: Enhance Reasoning and Retrieval Using Graph Analytics](https://aietalks.com/talks/graph-intelligence-enhance-reasoning-and-retrieval-using-graph-analytics) (Alison Cossette & Andreas Kollegger, Neo4j, 1:41:16) - [Knowledge Graphs & GraphRAG: Techniques for Building Effective GenAI Applications](https://aietalks.com/talks/knowledge-graphs-graphrag-techniques-for-building-effective-genai-applications) (Zach Blumenthal & Andreas, Neo4j, 1:39:52) - [Anchoring Enterprise GenAI with Knowledge Graphs](https://aietalks.com/talks/anchoring-enterprise-genai-with-knowledge-graphs) (Jonathan Lowe, Pfizer & Stephen Chin, Neo4j, 20:59) - [Judge the Judge: Building LLM Evaluators That Actually Work with GEPA](https://aietalks.com/talks/judge-the-judge-building-llm-evaluators-that-actually-work-with-gepa) (Mahmoud Mabrouk, Agenta AI, 40:51) - [Improving Agents is a Data Mining Problem](https://aietalks.com/talks/improving-agents-is-a-data-mining-problem) (Vivek Trivedy, LangChain, 20:02)