Synthetic Tabular Generators Fail to Preserve Behavioral Fraud Patterns: A Benchmark on Temporal, Velocity, and Multi-Account Signals

Bhavana Sajja

cs.LGApr 13, 2026

Synthetic Tabular Generators Fail to Preserve Behavioral Fraud Patterns: A Benchmark on Temporal, Velocity, and Multi-Account Signals

Authors: Bhavana Sajja

Organizations: Independent Researcher

Abstract

We introduce behavioral fidelity -- a third evaluation dimension for synthetic tabular data that measures whether generated data preserves the temporal, sequential, and structural behavioral patterns that distinguish real-world entity activity. Existing frameworks evaluate statistical fidelity (marginal distributions and correlations) and downstream utility (classifier AUROC on synthetic-trained models), but neither tests for the behavioral signals that operational detection and analysis systems actually rely on. We formalize a taxonomy of four behavioral fraud patterns (P1-P4) covering inter-event timing, burst structure, multi-account graph motifs, and velocity-rule trigger rates; define a degradation ratio metric calibrated to a real-data noise floor (1.0 = matches real variability, k = k-times worse); and prove that row-independent generators -- the dominant paradigm -- are structurally incapable of reproducing P3 graph motifs (Proposition 1) and produce non-positive within-entity IET autocorrelation (Proposition 2), making the positive burst fingerprint of fraud sequences unachievable regardless of architecture or training data size. We benchmark CTGAN, TVAE, GaussianCopula, and TabularARGN on IEEE-CIS Fraud Detection and the Amazon Fraud Dataset. All four fail severely: on IEEE-CIS composite degradation ratios range from 24.4x (TVAE) to 39.0x (GaussianCopula); on Amazon FDB, row-independent generators score 81.6-99.7x, while TabularARGN achieves 17.2x. We document generator-specific failure modes and their resolutions. The P1-P4 framework extends to any domain with entity-level sequential tabular data, including healthcare and network security. We release our evaluation framework as open source.

Figures & tables

Figure 1: P3 graph motif destruction. In real data (left), fraud ring members share device nodes, creating high fan-out and dense bipartite structure. In synthetic data (right), row-independent generators sample device IDs from a marginal distribution, collapsing fan-out to 1 for every device node. All tested generators reproduce this failure to varying degrees.

Rule	Feature	Op	Threshold	Window
R1	Transaction count per card	$>$	3	1 hour
R2	Distinct merchants per card	$>$	5	24 hours
R3	Sum of amounts per card	$>$	$1,000	24 hours
R4	Transaction count per card	$>$	1	Account age $<$ 7 days
R5	Distinct payment methods	$>$	2	7 days
R6	Max / median amount ratio	$>$	3.0	30-day history

Table 1: Canonical velocity rule set

\mathcal{R}

, derived from Bahnsen et al. (2016) and Dal Pozzolo et al. (2014) . Rules R1–R5 are active in all benchmark evaluations; R6 is active for datasets with amount history; R7–R8 require columns absent from the 48-column training subset and are excluded from the P4 composite score.

Figure 2: Three-layer evaluation framework. Layers 1 (statistical fidelity) and 2 (downstream utility) are established practice but do not capture behavioral fraud patterns. Layer 3 (behavioral fidelity, this work) quantifies degradation relative to a real-data noise floor via the degradation ratio

\mathrm{DR}(G,m)

Group	Columns
Core evaluation	TransactionDT , TransactionAmt , isFraud , card4
Velocity counts	C1 – C14 (transaction velocity counts)
Time-delta features	D1 – D15 (days since prior transactions/events)
Match flags	M1 – M9 (billing/shipping address match)
Geographic	addr1 , addr2 , dist1 , dist2
Email domain	P_emaildomain , R_emaildomain

Table 2: Feature subset used for all four generators (48 columns). V1–V339 excluded.

Dataset	Metric	Baseline value
IEEE-CIS	P1: IET $W_{1}$ , fraud (seconds)	9,581.9
IEEE-CIS	P1: within-entity autocorrelation gap	0.0027
IEEE-CIS	P2: active lifetime $W_{1}$ , fraud (sec)	195,109.9
IEEE-CIS	P2: burst length $W_{1}$ ( $\delta$ =5 min)	0.0408
IEEE-CIS	P4: mean velocity-rule trigger rate gap	0.0110
Amazon FDB	P3: fan-out $W_{1}$	0.0046

Table 3: Baseline raw scores (real-data 50/50 split). All degradation ratios are relative to these values; a perfect generator scores 1.0 on each.

Generator	Fraud Rate	JS Div. (mean)	Corr. $\|\Delta\|$	TSTR AUROC
Real (TRTR)	0.035	—	—	0.903
CTGAN	0.035	0.257	0.211	0.798
TVAE	0.035	0.294	0.214	0.806
GaussianCopula	0.035	0.313	0.186	0.523
TabularARGN	0.034	0.224	0.183	0.681

Table 4: Layer 1/2 evaluation results. JS Div. : mean Jensen-Shannon divergence across all 48 columns (lower is better). Corr.

|\Delta|

: mean absolute pairwise correlation matrix difference (lower is better). TSTR AUROC : XGBoost Chen and Guestrin (2016) trained on synthetic, tested on real held-out set Esteban et al. (2017) (higher is better; real TRTR baseline = 0.903). All TVAE results reflect the conditional-sampling corrected run (fraud rate restored to 3.5%); unconditional generation collapses the fraud rate to

\approx

0.03% (Section 7.1 ).

Figure 3: P1 fraud inter-event time (IET) distributions, IEEE-CIS. Real fraud transactions (black) exhibit a compressed, heavy-tailed IET distribution reflecting account-takeover burst patterns. All synthetic generators (colors) produce diffuse, near-uniform distributions with no burst structure. Left: linear scale (0–48 h) highlighting burst region; right: log scale showing all ranges.

Generator	P1 IETD	P1 AutoCorr	P2 AL	P2 BurstLen	P4 VR-TR	Composite
CTGAN ∗	30.0	40.5	35.5	32.2	22.9	32.2
TVAE †	25.9	5.9	38.0	31.5	20.6	24.4
GaussianCopula	30.1	75.1	35.5	32.6	21.6	39.0
TabularARGN	30.7	60.9	37.1	32.6	20.1	36.3
Noise floor (real)	1.0	1.0	1.0	1.0	1.0	1.0

Table 5: Behavioral fidelity degradation ratios on IEEE-CIS (P1, P2, P4). Lower is better; 1.0 = real-data noise floor;

>

10 = severe failure. Bold values indicate best (lowest) per column; ties in P2 AL are shared by CTGAN and GaussianCopula. ∗ CTGAN trained on 66K-row subsample (1:3 fraud:legitimate ratio; see Section 7.8 ). † TVAE evaluated with conditional sampling to restore the 3.5% fraud rate; unconditional generation collapses fraud rate to

\approx

0.03% and inflates composite to 45.4

\times

(Section 7.1 ).

Figure 4: P3 attribute fan-out CDFs, Amazon FDB. Real data (black) exhibits power-law fan-out: fraud-linked devices are shared by multiple users, creating high-fan-out nodes. Row-independent generators (CTGAN, TVAE, GaussianCopula) collapse to near fan-out 1. TabularARGN (red) achieves the best alignment with real fan-out (composite 17.2

\times

) due to autoregressive cross-feature conditioning, though still substantially divergent.

Generator	Fanout DR	Composite DR
CTGAN ∗	99.7	99.7
TVAE ∗	89.3	89.3
GaussianCopula	81.6	81.6
TabularARGN ‡	17.2	17.2
Noise floor (real)	1.0	1.0

Table 6: Behavioral fidelity on Amazon FDB (P3 graph motifs). Fanout DR : Wasserstein-1 fan-out degradation ratio normalized by the real-data noise floor (0.0046); lower is better; 1.0 = indistinguishable from real-data sampling variability. ∗ CTGAN and TVAE retrained with LabelEncoder encoding of device_id / ip_address to avoid one-hot OOM; row-independent architecture prevents co-occurrence learning regardless of encoding. ‡ Trained with all 9 feature columns and MOSTLY AI value protection disabled; autoregressive cross-feature conditioning captures device co-occurrence structure (Section 7.3 ).

Figure 5: Degradation ratio summary across all generators and patterns. Each cell reports $\mathrm{DR}(G,m)$ (lower is better; 1.0 = real-data noise floor). IEEE-CIS (P1, P2, P4) and Amazon FDB (P3) are separated by the dashed line. On P3, TabularARGN (17.2 $\times$ ) achieves a clear architectural advantage over row-independent generators (81–100 $\times$ ); on temporal patterns all generators remain in the 20–75 $\times$ range.

Synthetic Tabular Data Generation

Synthetic tabular data generation creates artificial records that preserve useful feature relationships while limiting exposure of sensitive data.

See all 99 papers

EmDT: Embedding Diffusion Transformer for Tabular Data Generation in Fraud Detection
Mar 13, 2026En-Ya Kuo, Sebastien MotschSynthetic Data Generation Synthetic Tabular Data Generation
Arizona State University – School of Mathematical and Statistical Sciences, Tempe, AZ, USA
Seq2Synth: Benchmarking Temporal Fidelity in Synthetic Sequential Tabular Data
Jul 17, 2026Kiwan Kwon, Kangmin Kim, Hojin Lee +5Synthetic Data Evaluation
UNIST · HUFS · JP Morgan AI Research +1
Improving TabPFN's Synthetic Data Generation by Integrating Causal Structure
Mar 10, 2026Davide Tugnoli, Andrea De Lorenzo, Marco Virgolin +1Tabular Foundation Models Synthetic Data Generation
Department of Mathematics, Informatics and Geosciences, University of Trieste, Trieste, Italy · InSilicoTrials Technologies, Riva Grumula 2, 34123 Trieste, Italy · Department of Engineering and Architecture, University of Trieste, Trieste, Italy +3

Mar 13, 2026J/K move · Enter open · S save

EmDT: Embedding Diffusion Transformer for Tabular Data Generation in Fraud Detection

En-Ya Kuo, Sebastien Motsch

Arizona State University – School of Mathematical and Statistical Sciences, Tempe, AZ, USA

Synthetic Data Generation Synthetic Tabular Data Generation Tabular Diffusion Models Financial Fraud Detection Diffusion Transformer

Open paper AskPDF arXiv

Imbalanced datasets pose a difficulty in fraud detection, as classifiers are often biased toward the majority class and perform poorly on rare fraudulent transactions. Synthetic data generation is therefore commonly used to mitigate this problem. In this work, we propose the Clustered Embedding Diffusion-Transformer (EmDT), a diffusion model designed to generate fraudulent samples. Our key innovation is to leverage UMAP clustering to identify distinct fraudulent patterns, and train a Transformer denoising network with sinusoidal positional embeddings to capture feature relationships throughout the diffusion process. Once the synthetic data has been generated, we employ a standard decision-tree-based classifier (e.g., XGBoost) for classification, as this type of model remains better suited to tabular datasets. Experiments on a credit card fraud detection dataset demonstrate that EmDT significantly improves downstream classification performance compared to existing oversampling and generative methods, while maintaining comparable privacy protection and preserving feature correlations present in the original data.

Abstract

Synthetic Tabular Data Generation

Explore similar work

EmDT: Embedding Diffusion Transformer for Tabular Data Generation in Fraud Detection

Seq2Synth: Benchmarking Temporal Fidelity in Synthetic Sequential Tabular Data

Improving TabPFN's Synthetic Data Generation by Integrating Causal Structure