Abstract: A method implements efficient counterfactual search. The method includes receiving a request corresponding to an input vector, processing the input vector with a model to generate an output vector that does not correspond to a selected class, and processing the input vector using a component, of a plurality of components, to generate a counterfactual vector to the selected class. The plurality of components includes a number of dimensions that is less than a number of features of the input vector. The method further includes processing the counterfactual vector to generate a recommendation and presenting the recommendation.

Abstract: A method finds short counterfactuals. The method includes receiving an input vector with a plurality of input features. The method further includes processing, with a model, the input vector to generate a score. The score of the input vector is not to a selected class. The method further includes searching for a counterfactual vector using a cost value and a heuristic value. The searching includes replacing one or more input features of the input vector with one or more counterfactual features to generate the counterfactual vector. The counterfactual vector corresponds to a counterfactual score to the selected class. The method further includes presenting one or more recommendations using the counterfactual vector.

Abstract: A method comprising generating, during multiple user sessions of a first user with a software application, first clickstream data from the multiple user sessions, and extracting, from the first clickstream data, a first plurality of task instances of the first user performing a first plurality of tasks. The method also includes decomposing, from the first clickstream data, each task instance of the first plurality of task instances into a first plurality of steps to obtain a first plurality of decomposed task instances. The first plurality of steps in the first plurality of decomposed task instances are each associated with a timestamp. The method further includes training a first user model with the first plurality of decomposed task instances to learn a user optimal order to perform the first plurality of tasks and presenting, to the first user, the user optimal order to perform the first plurality of tasks.

Abstract: Systems and methods are described for automatically documenting queries and dynamically populating interactive graphical user interfaces with query recommendations. A computing system receives an initial query from an interactive graphical user interface and asynchronously parses the query for strings matching predetermined phrases. In response to determining that the initial query recites strings matching the predetermined phrases, the system extracts metadata and identifies a table name in the initial query, and modifies a table data in key-value data structure corresponding to the table. Subsequent queries related to the initial query cause the system to asynchronously populate the graphical user interface with query recommendations related to the initial query.

Abstract: A method comprising generating, during multiple user sessions of a first user with a software application, first clickstream data from the multiple user sessions, and extracting, from the first clickstream data, a first plurality of task instances of the first user performing a first plurality of tasks. The method also includes decomposing, from the first clickstream data, each task instance of the first plurality of task instances into a first plurality of steps to obtain a first plurality of decomposed task instances. The first plurality of steps in the first plurality of decomposed task instances are each associated with a timestamp. The method further includes training a first user model with the first plurality of decomposed task instances to learn a user optimal order to perform the first plurality of tasks and presenting, to the first user, the user optimal order to perform the first plurality of tasks.

Abstract: Described herein are example implementations for handling of phishing attempts. A system receives a request to perform an electronic transaction, with the request including information regarding a user account. The system generates one or more probabilities of the request being valid based on the request and processing of a plurality of electronic transactions associated with one or more user accounts, identifies whether the request is valid based on the one or more probabilities, and in response to identifying that the request is not valid, provides an indication that the request is not valid.

Abstract: A method implements a table discovery service. The method includes receiving a query string, converting the query string to a query graph, and identifying a selected graph, of a set of graphs, that matches the query graph. The method further includes transmitting a notification identifying a previously generated table corresponding to the selected graph, receiving a notification response to accept the previously generated table, and transmitting data from the previously generated table in response to the query string.

Abstract: A method includes training, using first real data objects, a generative adversarial network having a generator model and a discriminator model to create a trained generator model that generates realistic data, and training, using adversarial data objects and second real data objects, the discriminator model to output an authenticity binary class for the adversarial data objects and the second real data objects. The method further includes deploying the discriminator model to a production system. In the production system, the discriminator model outputs the authenticity binary class to a system classifier model.

Abstract: Techniques for detecting fraud may include obtaining a merchant's financial data; determining, via a machine learning model, a first prediction of the merchant's industry; generating a first probability matrix based on the first prediction and the declared information regarding the merchant's industry; determining, via the machine learning model, a second prediction of the merchant's industry; generating a second probability matrix based on the second prediction and the declared information regarding the merchant's industry; obtaining a declared industry of a subject merchant in a runtime environment; determining, via the machine learning model, a predicted industry for the subject merchant; obtaining, based on the declared industry and the predicted industry of the subject merchant, a first value from the first probability matrix and a second value from the second probability matrix; and labeling the subject merchant for further investigation.

Abstract: Certain aspects of the present disclosure provide techniques for a personalized reporting service. Software applications can provide relevant reports that aggregate time series data to users that meet certain baseline values, including a threshold, timeframe, and cadence. The baseline values can be determined by a trained machine-learning model that identifies “interesting” trend components in the time series data. The reporting service can receive configurations from the user including feedback that are utilized by the machine-learning model to update the baseline values and provide relevant reports to the user.

Abstract: A method including monitoring, using a machine learning model, network events of a network. The machine learning model generates fraud scores representing a corresponding probability that a corresponding network event is fraudulent. The method also includes detecting a failure of the machine learning model to generate, within a threshold time, a given fraud score for a given network event. The method also includes determining, by the machine learning model and after the threshold time, the given fraud score. The method also includes logging, responsive to detecting the failure, the given network event in a first table, including logging the given fraud score. The method also includes determining a metric based on comparing the first table to a second table which logs at least the given fraud score and the fraud scores. The method also includes generating an adjusted machine learning model based on the metric.

Abstract: Described herein are example implementations for generating a perturbation seed for the perturbation of electronic data. A system obtains a plurality of datapoints (with one or more statistics calculated from the plurality of datapoints to be perturbed based on a perturbation seed). The system calculates one or more metrics from the plurality of datapoints. The system also generates, for each of the one or more metrics, a rounded metric by rounding the metric. The system further generates the perturbation seed. Generating the perturbation seed includes hashing the one or more rounded metrics. Rounding a metric may be to a defined place value (such as the second most significant place value), and a binary output of hashing the one or more rounded metrics may be converted to a number. The system may perturb one or more statistics based on the perturbation seed and output the one or more perturbed statistics.

Abstract: Systems and methods are described for automatically documenting queries and dynamically populating interactive graphical user interfaces with query recommendations. A computing system receives an initial query from an interactive graphical user interface and asynchronously parses the query for strings matching predetermined phrases. In response to determining that the initial query recites strings matching the predetermined phrases, the system extracts metadata and identifies a table name in the initial query, and modifies a table data in key-value data structure corresponding to the table. Subsequent queries related to the initial query cause the system to asynchronously populate the graphical user interface with query recommendations related to the initial query.

Abstract: A method implements a table discovery service. The method includes receiving a query string, converting the query string to a query graph, and identifying a selected graph, of a set of graphs, that matches the query graph. The method further includes transmitting a notification identifying a previously generated table corresponding to the selected graph, receiving a notification response to accept the previously generated table, and transmitting data from the previously generated table in response to the query string.

Abstract: Systems and methods are described for training a large language model with query auto-completion training data and automatically generating query auto-completion training data in an interactive GUI. A computing system continuously trains and refines a large language model utilizing masking techniques to on complex software-related queries. The computing system is further configured to utilize the large language model to provide complex software-related query suggestions to users operating a graphical user interface real-time.

Abstract: Described herein are example implementations for handling of phishing attempts. A system receives a request to perform an electronic transaction, with the request including information regarding a user account. The system generates one or more probabilities of the request being valid based on the request and processing of a plurality of electronic transactions associated with one or more user accounts, identifies whether the request is valid based on the one or more probabilities, and in response to identifying that the request is not valid, provides an indication that the request is not valid.

Abstract: Aspects of the present disclosure involve systems, methods, devices, and the like for auto-labeling clusters generated by machine learning models. In one embodiment, a system is introduced that can perform a series of operations for determining comprehensive labels for clusters output from machine learning methods used to classify data sets. The auto-labeling system may include generating labels determined using a computation of a frequency count, ratio, and coverage. These computations may use feature-based dictionaries which aid in the determination, storage, and analysis of the relevant features useful in labeling the clusters.

Abstract: A method includes training, using first real data objects, a generative adversarial network having a generator model and a discriminator model to create a trained generator model that generates realistic data, and training, using adversarial data objects and second real data objects, the discriminator model to output an authenticity binary class for the adversarial data objects and the second real data objects. The method further includes deploying the discriminator model to a production system. In the production system, the discriminator model outputs the authenticity binary class to a system classifier model.

Abstract: Systems and methods for identifying suspected anomalies in time series data are disclosed. An example method may receiving time series data for at least one quantity, the time series data including values of the at least one quantity at each of a plurality of times, determining a list of gradients for the time series data, each gradient in the list of gradients based on two or more values of the time series data separated by a specified number of values of the time series data, deriving a plurality of statistics based on the determined list of gradients, and performing a supervised machine learning process based on the derived plurality of statistics to generate a trained machine learning model for identifying one or more suspected anomalies in the time series data.

Abstract: Certain aspects of the present disclosure provide techniques for placing targeted messages in communications within a software application using machine learning models. An example method generally includes retrieving, from a repository, a data set of targeted messages. For each respective targeted message in the data set of targeted messages, an effectiveness score for a party associated with the respective targeted message, a distance score between the party associated with the respective targeted message and a host party, and a match score between the party associated with the respective targeted message and the host party. Based on the effectiveness score, the distance score, and the match score for each respective targeted message in the data set of targeted messages, a message is selected to be included in one or more communications by the host party. The one or more communications including the selected message are generated and output for transmission.