Abstract: In some embodiments, the present disclosure provides an exemplary system and method that may include steps of identifying a device capable of processing a data stream; calculating a plurality of hash keys for a plurality of monitored segmentations associated with the device capable of the data stream; generating an increment data counter that corresponds to each hash key in a plurality of counting structures; calculating an anomaly score associated for the plurality of monitored segmentations; selecting a monitored segmentation based on the anomaly score; determining that a selected monitored segmentation meets a predetermined threshold associated with the anomaly score; and automatically marking the device capable of the data stream with a pre-generated label.

Abstract: A method and related system operations include determining a predicted category by providing a prediction model with a set of input feature values and generating a plurality of conditionals based on the set of input feature values for a set of features and the predicted category. The method also includes filtering the plurality of conditionals based on a knowledge base to obtain a selected conditional by generating a set of sub-conditional paths by providing, as an input for a prompt generator model, a candidate conditional of the plurality of conditionals to the prompt generator model and selecting the candidate conditional as the selected conditional based on a determination that the set of sub-conditional paths satisfies a set of criteria associated with a set of sequences of the knowledge base. The method further includes storing the selected conditional in a data structure in association with the set of input feature values.

Abstract: In some embodiments, a computing system may generate a first set of importance metrics (e.g., scores or values) for a model. The importance metrics may be generated using an explainable artificial intelligence technique, and an individual importance metric may indicate how influential a corresponding feature is for a decision made by a model. The computing system may determine an important feature and create a modified dataset by removing the important feature from the dataset. The computing system may train the model on the modified dataset and evaluate the performance of the model to determine the effect of removing the feature (e.g., which may indicate how important the feature is to output generated by the model). This process may be repeated for additional features and additional performance metrics may be obtained.

Abstract: Aspects described herein may relate to techniques and/or methods that process certain forms of event data and/or tabular data for input to one or more machine learning models, such as a large language model. Additional aspects may relate to using the output of a large language model as part of a process for detecting fraud based on the event data and/or tabular data. In some variations, the event data and/or tabular data may be processed into data tokens, embeddings, or other forms of data suitable for use as input to a large language model.

Abstract: In some aspects, a computing system may aggregating multiple counterfactual samples so that machine learning explanations can be generated for sub-populations. In addition, methods and systems described herein use machine learning and counterfactual samples to determine text to use in an explanation for a model's prediction. A computing system may also train machine learning models to not only determine whether a request to perform an action should be accepted, but also to generate output that is consistent with output generated by previous machine learning models. Further, a computing system may generate counterfactual samples based on user preferences. A computing system may obtain preferences and then apply a penalty or adjustment parameter such that when a counterfactual sample is created, the computing system is forced to change one or more features indicated by the preferences to create the counterfactual sample.

Abstract: In some aspects, a computing system may use a surrogate machine learning model to detect whether a production or other machine learning model has a tendency to generate different output depending on which subpopulation a particular sample belongs to. The surrogate machine learning model may be trained using features/outputs that are not included in the data used by the production model. For example, by using demographic information in lieu of the original labels of a dataset that was used to train a production model, a surrogate model may be used to detect whether the production model is able to discern one or more characteristics associated with but not present in a sample using other features of the dataset. Output of the surrogate machine learning model may be clustered to detect whether certain subpopulations are treated differently by the production model.

Abstract: A computing system may generate a first set of importance metrics (e.g., scores or values) for a model. The importance metrics may be generated using an explainable artificial intelligence technique, and an individual importance metric may indicate how influential a corresponding feature is for a decision made by a model. The computing system may determine an important feature and create a modified dataset by removing the important feature from the dataset. The computing system may train the model on the modified dataset and evaluate the performance of the model to determine the effect of removing the feature (e.g., which may indicate how important the feature is to output generated by the model). This process may be repeated for additional features and additional performance metrics may be obtained.

Abstract: Aspects described herein may relate to techniques and/or methods that process certain forms of event data and/or tabular data for input to one or more machine learning models, such as a large language model. Additional aspects may relate to using the output of a large language model as part of a process for detecting fraud based on the event data and/or tabular data. In some variations, the event data and/or tabular data may be processed into data tokens, embeddings, or other forms of data suitable for use as input to a large language model.

Abstract: In some embodiments, a method and related system for creating a steam-adaptable encoder model includes generating a first complete encoded representation using the encoder model based on unrestricted data provided by a first unrestricted data stream and restricted data provided by a restricted data stream. The method also includes generating an unrestricted encoded representation based on the first unrestricted data, evaluating a loss function value by updating the loss function value based on a similarity between the first complete encoded representation and the unrestricted encoded representation, and updating the encoder model based on the loss function value. The method also includes updating the encoder model based on the loss function value, generating an encoded representation using the encoder model based on filtered data that includes additional data from the first unrestricted data stream, and generating an indicator based on the encoded representation.

Abstract: A method and related system operations include obtaining a time-ordered set of action types and generating a first dataset by determining, for each respective stored sequence of a plurality of stored sequences, a respective dataset element indicating that the respective stored sequence is present in the time-ordered set of action types. The method may also include generating a reduced dataset based on the first dataset by detecting that the first dataset indicates that a first sequence and a second sequence are present in the time-ordered set of action types, determining a reduced dataset element based on the detection of a presence of the first sequence and the second sequence in the time-ordered set of action types and a score between the first sequence and the second sequence indicated by a table, and detecting malicious activity using a decision model based on the reduced dataset.

Abstract: A method and related system for efficiently capturing relationships between event feature values in embeddings includes flattening an event sequence into a feature sequence including a first event prefix, a second event prefix, and a first set of feature values. The method includes generating an attention mask including first mask indicators to associate the first set of feature values with each other and second mask indicator to associate a first feature value of the first set of feature values with the second event prefix. The method includes providing the feature sequence and the attention mask to a self-attention neural network model to generate an embedding.

Abstract: Methods and systems are described herein for generating group definition sequences for accounts (e.g., user accounts) using action sequence processing and then classifying accounts using those group definition sequences. A plurality of user account actions and corresponding time that each action was taken may be received and based on that information, a sequence of action types sometimes referred to as a time-ordered dataset of action types (e.g., based on a chronological order of the actions) may be generated. The time-ordered dataset of action types may be compared with known time-ordered sequences for a particular user group or user classification. If the time-ordered dataset of action types matches the time-ordered sequences of the particular user group, the user may be classified into that user group.

Abstract: Aspects described herein may relate to techniques and/or methods that process certain forms of event data and/or tabular data for input to one or more machine learning models, such as a large language model. Additional aspects may relate to using the output of a large language model as part of a process for detecting fraud based on the event data and/or tabular data. In some variations, the event data and/or tabular data may be processed into data tokens, embeddings, or other forms of data suitable for use as input to a large language model.

Abstract: In some embodiments, the present disclosure provides an exemplary system and method that may include steps of identifying a device capable of processing a data stream; calculating a plurality of hash keys for a plurality of monitored segmentations associated with the device capable of the data stream; generating an increment data counter that corresponds to each hash key in a plurality of counting structures; calculating an anomaly score associated for the plurality of monitored segmentations; selecting a monitored segmentation based on the anomaly score; determining that a selected monitored segmentation meets a predetermined threshold associated with the anomaly score; and automatically marking the device capable of the data stream with a pre-generated label.

Abstract: Methods and systems are described herein for generating group definition sequences for accounts (e.g., user accounts) using action sequence processing and then classifying accounts using those group definition sequences. A plurality of user account actions and corresponding time that each action was taken may be received and based on that information, a sequence of action types sometimes referred to as a time-ordered dataset of action types (e.g., based on a chronological order of the actions) may be generated. The time-ordered dataset of action types may be compared with known time-ordered sequences for a particular user group or user classification. If the time-ordered dataset of action types matches the time-ordered sequences of the particular user group, the user may be classified into that user group.

Abstract: Systems and methods for ranking user interface elements using explainability vectors. The system receives training data for a ranking machine learning model. The training data comprises values for a first set of features. The system trains the ranking machine learning model using the training data. The system processes the ranking model to extract an explainability vector. Based on the explainability vector, the system processes the first set of features to generate a second set of features. The system processes the second set of features and the output of the predictive machine learning model to generate an explanative factor and trains a ranking model using the explanative factor and a third set of features. The system receives as output from the ranking model a vector indicating display positions and rankings of user interface elements.

Abstract: Systems and methods for generating contextual data for downstream models using explainability vectors. The system receives training data for an upstream machine learning model. The training data comprises values for a first set of features. The system trains the upstream machine learning model using the training data. The system processes the upstream machine learning model to extract an explainability vector. Based on the explainability vector, the system processes the first set of features to generate a second set of features. The system processes the second set of features and the output of the upstream machine learning model to generate an explanative factor and trains a downstream model using the explanative factor and a third set of features.

Abstract: Systems and methods for executing resource availability notifications to user systems are described. In some aspects, the system receives, for a first plurality of user systems, a first plurality of user profiles and a plurality of resource availability values. Each user profile includes values for a set of features. The system processes a first machine learning model which generates resource availability values from the set of features and extracts an explainability vector. The system uses the explainability vector to generate an embedding map that translates feature values into a corresponding embedding in an embedding space. The system encodes a second plurality of user profiles and processes the resulting user profile vectors using a second machine learning model to generate clusters of user profile vectors. The system selects a cluster from the clusters of user profile vectors and determines user systems corresponding to the cluster for executing resource availability notifications.

Abstract: Systems and methods for generating communications based on user account activity data are described herein. For example, the system may receive an input activity log and generate a plurality of tokens. The system may generate a time-ordered sequence of tokens based on the plurality of tokens. The system may generate an output vector encoding based on a machine learning model. The system may generate a predicted communication based on a vector encoding model. The system may transmit the predicted communication to a user device.

Abstract: Systems and methods for generating communications based on user account activity data are described herein. For example, the system may obtain an input activity log and generate an activity log transformation. The system may input the activity log transformation into a vector encoding model to obtain a first output vector encoding. The system may input the first output vector encoding into a contrastive machine learning model to obtain a first matching vector encoding. The system may access a first plurality of vector encodings from a communication database. Based on comparing each vector encoding in the first plurality of vector encodings with the first matching vector encoding, the system may generate the matching communication.