Posterior Regimes and Latent Deception: Variational Bayesian Inference in Hidden Markov Models for Sequential Fraud Detection in Financial Transactions

Joseph Uririoghene Obukofe; Anthony O'Hare; Chioma Sandra Dike

cs.LGSep 27, 2026

Posterior Regimes and Latent Deception: Variational Bayesian Inference in Hidden Markov Models for Sequential Fraud Detection in Financial Transactions

Authors: Joseph Uririoghene Obukofe, Anthony O'Hare, Chioma Sandra Dike

Organizations: Computing Science and Mathematics, Faculty of Natural Sciences, University of Stirling, Stirling FK9 4LA, Scotland, United Kingdom · University of Nottingham, Nottingham, NG7 2RD, United Kingdom

Abstract

We present a three-tier progression of Hidden Markov Models: maximum-likelihood (Baum-Welch), variational Bayesian (VBEM), and a neural variational extension (Neural VBEM), that model each customer's transaction history as a trajectory through a small number of latent behavioural regimes, one of which is empirically identified as fraud-associated. The Neural VBEM HMM replaces the fixed Gaussian-multinomial emission family with a learned encoder, compressing a 741-dimensional transaction representation into a 64-dimensional latent space in which the VBEM HMM's posterior operates; a UMAP projection of this space reveals that the discovered regimes are not discrete clusters but ordered segments of a single continuous behavioural manifold, with confirmed fraud concentrated at its extreme. We show that the model's natural output, that is, the posterior probability of regime membership, is routinely mistaken for a fraud probability, and quantify the resulting miscalibration (the regime-membership interpretation error, MRIE); a corrected posterior-predictive score, closes most of this gap. We further distinguish batch (smoothed) inference, which uses look-ahead unavailable at deployment time, from filtered (forward-only) inference, and report both. On IEEE-CIS transaction data, the neural tier achieves a 14.4 $\times$ fraud enrichment in its identified regime; while its AUPRC trails a discriminative XGBoost baseline, we show this gap is structural and not incidental, and argue the model is best positioned as a calibrated triage and interpretability layer rather than a drop-in ranking replacement.

Figures & tables

Model	$K^{*}$	Occupancy	Fraud rate	Enrichment
Baum-Welch HMM	8	1.77%	19.4%	$5.48\times$
VBEM HMM	7	3.78%	25.3%	$7.16\times$
Neural VBEM HMM ( $d_{z}=64$ )	9	3.8%	50.9%	$14.43\times$

Table 1: Selected model order and fraud-state diagnostics for each HMM tier under batch posteriors for engineered features.

Model	Score	AUPRC	KS	ECE
Baum-Welch HMM	raw / batch	0.0775	0.2667	0.0414
	corrected / batch	0.0853	0.3883	$\approx 0$
	corrected / filtered	0.0853	0.3883	$\approx 0$
VBEM HMM	raw / batch	0.0667	0.2151	0.0685
	corrected / batch	0.0806	0.2841	$\approx 0$
	corrected / filtered	0.0806	0.2841	$\approx 0$

Table 2: HMM tier predictive performance under three scoring conditions. Raw/batch is

\gamma_{t}(k^{*})

, smoothed posteriors; corrected/batch and corrected/filtered use

\mathcal{F}_{\mathrm{corrected}}=\sum_{k}\gamma_{t}(k)\eta_{k}

( Section 3.6 ) under smoothed and forward-only posteriors respectively.

Model	AUPRC	KS	ECE
Isolation Forest	0.098	0.365	0.458
Neural VBEM HMM	0.199	0.471	0.049
XGBoost	0.514	0.563	0.019

Table 3: Predictive performance against non-sequential baselines on held-out evaluation set. Neural VBEM figure is the raw/batch score,

\gamma_{t}(k^{*})

; see note below.

Figure 1 : UMAP projection of the Neural VBEM HMM ( $d_{z}=64$ , $K^{*}=9$ ) latent embeddings. Panel (i): each transaction coloured by its hard state assignment, fraud-associated state $k^{*}=4$ highlighted in red. Panel (ii): the same projection coloured by ground-truth fraud label. Confirmed fraud concentrates at the same terminal tip, density diminishing continuously toward the legitimate-dominated body.

Appendix figures & tables18 assets

Supplementary material from the paper’s appendix.

Appendix

Symbol	Form	Description
$\mathcal{D}$	Set	Full dataset of $N$ labelled transactions.
$N$	Scalar integer	Total number of transactions.
$U$	Scalar integer	Total number of unique customers.
$u$	Index	Customer index, $u=1,\ldots,U$ .
$n$	Index	Global transaction index, $n=1,\ldots,N$ .
$t$	Index	Chronological index within customer $u$ ’s sequence, $t=1,\ldots,T_{u}$ .

Appendix

Table 4 : Dataset and Sequence Notation

Symbol	Form	Description
$K$ , $K^{*}$	Scalar integers	Candidate and selected model order.
$k,i,j$	State indices	General, from-, and to-state indices over $1,\ldots,K$ .
$q_{u,t}$ , $\mathbf{q}_{u}$	Latent, Latent path	Hidden state at $t$ ; full hidden state sequence.
$k^{*}$	Scalar integer	Index of the fraud-associated state, identified post-training as $\arg\max_{k}\eta_{k}$ .
$\bm{\theta}$	Parameter set	All HMM parameters: $\bm{\pi},A,\bm{\mu}_{k},\bm{\Sigma}_{k},\bm{\pi}_{k}^{(j)}$ .
$\bm{\pi}$ , $\pi_{k}$	Vector, scalar	Initial state distribution; probability of starting in state $k$ .

Appendix

Table 5 : Hidden Markov Model Notation

Symbol	Form	Description
$\alpha_{t}(k)$ , $\bm{\alpha}$	Scalar, matrix	Forward variable; full forward matrix for a sequence.
$\beta_{t}(k)$ , $\bm{\beta}$	Scalar, matrix	Backward variable; full backward matrix for a sequence.
$\gamma_{t}(k)$ , $\bm{\gamma}$	Scalar, matrix	Batch (smoothed) state-occupancy posterior; full matrix for a sequence.
$\gamma^{\mathrm{filt}}_{t}(k)$	Scalar	Filtered (forward-only) state-occupancy posterior: conditions on $\mathbf{x}_{u,1:t}$ only, no backward pass.
$\xi_{t}(i,j)$ , $\bm{\xi}$	Scalar, tensor	Transition posterior; full tensor for a sequence.
$\odot$	Operator	Element-wise multiplication.

Appendix

Table 6 : Forward-Backward Variables

Symbol	Form	Description
$p(\mathbf{X}_{u}\mid\theta)$ , $p(\mathbf{X}_{u},\mathbf{q}_{u}\mid\theta)$	Scalars	Marginal and joint sequence probabilities.
$p(\bm{\theta})$ , $p(\bm{\theta}\mid\mathbf{X})$ , $p(\mathbf{X})$	Distributions, scalar	Prior, true posterior, and model evidence.
$q(\cdot)$ , $q_{i}(\theta_{i})$	Distributions	Variational posterior; its mean-field factors.
$D_{\mathrm{KL}}(p\\|q)$	Functional	Kullback-Leibler divergence.
$\mathbb{E}_{q}[\cdot]$	Operator	Expectation under $q$ .
$\mathcal{L}(q)$	Scalar	Evidence Lower Bound.

Appendix

Table 7 : Variational Bayesian Inference Notation

Symbol	Form	Description
$f_{\theta}$	Function	Neural encoder, $f_{\theta}:\mathbb{R}^{F}\to\mathbb{R}^{d_{z}}$ .
$\mathbf{z}_{u,t}$ , $d_{z}$ , $d_{h}$	Vector, integers	Latent embedding; latent and hidden dimensions ( $d_{z}\in\{32,64,128\}$ , $d_{h}=512$ ).
$d_{e_{j}}$ , $E_{j}$	Integer, matrix	Embedding dimension and table for categorical feature $j$ .
$\hat{\mathbf{x}}$	Vector	Normalised continuous features fed to the encoder MLP (LayerNorm output).
$\mathrm{LN}(\cdot)$ , $\mathrm{GELU}(\cdot)$	Operator, activation	Layer Normalisation; Gaussian Error Linear Unit.
$\mathbf{h}^{\mathrm{cont}}$ , $\mathbf{h}^{\mathrm{cat}}$ , $\mathbf{h}^{\mathrm{fused}}$	Vectors	Continuous-pathway, categorical-pathway, and fused hidden representations.

Appendix

Table 8 : Neural VBEM Notation

Symbol	Form	Description
$\mathbf{m}_{0}^{\mathrm{p}},\mathbf{S}_{0}^{\mathrm{p}}$	Vector, matrix	Population-level NIW prior (moment-matched).
$\hat{\mathbf{m}}_{k}^{(u)},\hat{\mathbf{S}}_{k}^{(u)}$	Vector, matrix	Customer- $u$ converged posterior statistics feeding the population prior.
$\mathcal{F}(\mathbf{x}_{u^{\prime},t}\mid\mathbf{X}_{u^{\prime},1:t})$	Scalar	Cold-start fraud score for new customer $u^{\prime}$ .

Appendix

Table 9 : Hierarchical Prior Extension

Symbol	Form	Description
$\mathcal{K}$ , $\mathcal{K}^{*}$	Sets	Candidate model orders $\{2,\ldots,10\}$ ; the eligible subset.
$N^{(K)}_{k}$ , $\mathrm{o}^{(K)}_{k}$	Scalars	Effective count and fractional occupancy of state $k$ under order $K$ .
$F^{(K)}_{k}$ , $\eta^{(K)}_{k}$	Scalars	Fraud-weighted effective count; empirical fraud rate of state $k$ under order $K$ .
$k^{*(K)}$ , $\mathrm{e}^{(K)}_{k}$	Integer, scalar	Fraud-associated state under order $K$ ; its enrichment ratio.
$\bar{\eta}$ , $\delta$	Scalars	Population fraud rate ( $\approx 3.5\%$ ); parsimony tolerance ( $=0.5$ ).
$\mathrm{f}$	Notation	Shorthand for “fraud”.

Appendix

Table 10 : State Diagnostics and Model Selection

Symbol	Form	Description
$\mathbf{c}_{u,t}$	Vector, $\Delta^{K-1}$	Transaction consequence: the real-time belief state, updated one transaction at a time from $\mathbf{c}_{u,t-1}$ ; coincides with $\gamma^{\mathrm{filt}}_{t}(\cdot)$ .
$\mathcal{F}_{\mathrm{batch}}(\mathbf{x}_{u,t})$	Scalar	Batch fraud score, $\gamma_{t}(k^{*})$ .
$\mathcal{F}_{\mathrm{real}}(\mathbf{x}_{u,t})$	Scalar	Real-time fraud score, $\mathbf{c}_{u,t}(k^{*})$ .
$\mathcal{F}_{\mathrm{corrected}}(\mathbf{x}_{u,t})$	Scalar	Posterior-predictive corrected fraud score, $\sum_{k}\gamma_{t}(k)\eta_{k}$ .
$\mathrm{MRIE}$	Scalar	Mean Regime Interpretation Error, $\mathrm{o}_{k^{}}(1-\eta_{k^{}})$ .

Appendix

Table 11 : Inference and Fraud Scoring

K	Occup. (p)	Occup. (e)	F. Rate (p)	F. Rate (e)	Enrich. (p)	Enrich. (e)
2	$0.242$	$0.242$	$0.082$	$0.083$	$2.337$	$2.343$
3	$0.219$	$0.109$	$0.090$	$0.137$	$2.536$	$3.877$
4	$0.073$	$0.103$	$0.162$	$0.134$	$4.596$	$3.790$
5	$0.041$	$0.057$	$0.163$	$0.195$	$4.618$	$5.513$
6	$0.045$	$0.044$	$0.216$	$0.224$	$6.125$	$6.358$
7	$0.040$	$0.030$	$0.219$	$0.211$	$6.194$	$5.973$

Appendix

Table 12: Baum-Welch HMM: fraud-state occupancy, fraud rate, and enrichment under batch (smoothed) posteriors,

K\in\{2,\ldots,10\}

, processed (p) and engineered (e) features.

K	Occup. (p)	Occup. (e)	F. Rate (p)	F. Rate (e)	Enrich. (p)	Enrich. (e)
2	$0.242$	$0.242$	$0.082$	$0.083$	$2.337$	$2.343$
3	$0.219$	$0.109$	$0.090$	$0.137$	$2.536$	$3.877$
4	$0.073$	$0.103$	$0.162$	$0.134$	$4.596$	$3.790$
5	$0.041$	$0.057$	$0.163$	$0.195$	$4.618$	$5.513$
6	$0.045$	$0.044$	$0.216$	$0.224$	$6.125$	$6.358$
7	$0.040$	$0.030$	$0.219$	$0.211$	$6.194$	$5.974$

Appendix

Table 13: Baum-Welch HMM: fraud-state occupancy, fraud rate, and enrichment under filtered (forward-only) posteriors,

K\in\{2,\ldots,10\}

, processed (p) and engineered (e) features.

K	Occup. (p)	Occup. (e)	F. Rate (p)	F. Rate (e)	Enrich. (p)	Enrich. (e)
2	$0.242$	$0.242$	$0.082$	$0.083$	$2.337$	$2.344$
3	$0.085$	$0.110$	$0.135$	$0.136$	$3.824$	$3.858$
4	$0.071$	$0.104$	$0.161$	$0.134$	$4.549$	$3.784$
5	$0.050$	$0.052$	$0.134$	$0.213$	$3.809$	$6.043$
6	$0.026$	$0.046$	$0.152$	$0.220$	$4.311$	$6.242$
7	$0.056$	$0.038$	$0.186$	$0.253$	$5.261$	$7.158$

Appendix

Table 14: VBEM HMM: fraud-state occupancy, fraud rate, and enrichment under batch (smoothed) posteriors,

K\in\{2,\ldots,10\}

, processed (p) and engineered (e) features.

K	Occup. (p)	Occup. (e)	F. Rate (p)	F. Rate (e)	Enrich. (p)	Enrich. (e)
2	$0.242$	$0.242$	$0.082$	$0.083$	$2.337$	$2.344$
3	$0.085$	$0.110$	$0.135$	$0.136$	$3.824$	$3.858$
4	$0.071$	$0.104$	$0.161$	$0.134$	$4.549$	$3.784$
5	$0.050$	$0.052$	$0.134$	$0.213$	$3.809$	$6.043$
6	$0.026$	$0.046$	$0.152$	$0.220$	$4.311$	$6.242$
7	$0.056$	$0.038$	$0.186$	$0.253$	$5.261$	$7.159$

Appendix

Table 15: VBEM HMM: fraud-state occupancy, fraud rate, and enrichment under filtered (forward-only) posteriors,

K\in\{2,\ldots,10\}

, processed (p) and engineered (e) features.

K	Occup. (p)	Occup. (e)	F. Rate (p)	F. Rate (e)	Enrich. (p)	Enrich. (e)
2	$0.705$	$0.441$	$0.049$	$0.055$	$1.386$	$1.560$
3	$0.229$	$0.145$	$0.136$	$0.198$	$3.860$	$5.617$
4	$0.179$	$0.128$	$0.165$	$0.204$	$4.675$	$5.778$
5	$0.130$	$0.119$	$0.215$	$0.187$	$6.079$	$5.300$
6	$0.059$	$0.122$	$0.340$	$0.206$	$9.644$	$5.843$
7	$0.053$	$0.075$	$0.363$	$0.253$	$10.292$	$7.157$

Appendix

Table 16: Neural VBEM HMM (

d_{z}=32

): fraud-state occupancy, fraud rate, and enrichment under batch posteriors,

K\in\{2,\ldots,10\}

, processed (p) and engineered (e) features.

K	Occup. (p)	Occup. (e)	F. Rate (p)	F. Rate (e)	Enrich. (p)	Enrich. (e)
2	$0.391$	$0.633$	$0.044$	$0.054$	$1.240$	$1.530$
3	$0.384$	$0.106$	$0.074$	$0.243$	$2.100$	$6.891$
4	$0.120$	$0.083$	$0.215$	$0.307$	$6.083$	$8.686$
5	$0.116$	$0.085$	$0.226$	$0.285$	$6.411$	$8.074$
6	$0.065$	$0.074$	$0.279$	$0.314$	$7.913$	$8.887$
7	$0.063$	$0.074$	$0.275$	$0.239$	$7.794$	$6.776$

Appendix

Table 17: Neural VBEM HMM (

d_{z}=64

): fraud-state occupancy, fraud rate, and enrichment under batch posteriors,

K\in\{2,\ldots,10\}

, processed (p) and engineered (e) features.

K	Occup. (p)	Occup. (e)	F. Rate (p)	F. Rate (e)	Enrich. (p)	Enrich. (e)
2	$0.360$	$0.448$	$0.053$	$0.059$	$1.493$	$1.677$
3	$0.254$	$0.181$	$0.051$	$0.089$	$1.442$	$2.521$
4	$0.111$	$0.113$	$0.237$	$0.244$	$6.700$	$6.903$
5	$0.071$	$0.125$	$0.264$	$0.208$	$7.489$	$5.888$
6	$0.066$	$0.082$	$0.247$	$0.313$	$6.986$	$8.864$
7	$0.072$	$0.088$	$0.206$	$0.274$	$5.847$	$7.774$

Appendix

Table 18: Neural VBEM HMM (

d_{z}=128

): fraud-state occupancy, fraud rate, and enrichment under batch posteriors,

K\in\{2,\ldots,10\}

, processed (p) and engineered (e) features.

Model	$K$	Occupancy	Fraud rate	Enrichment
Baum-Welch HMM	8	$4.3\%$	$22.3\%$	$6.31\times$
VBEM HMM	-	-	-	-
Neural VBEM ( $d_{z}=32$ )	8	$4.4\%$	$42.5\%$	$12.03\times$
Neural VBEM ( $d_{z}=64$ )	10	$3.4\%$	$48.1\%$	$13.61\times$
Neural VBEM ( $d_{z}=128$ )	10	$4.6\%$	$30.3\%$	$8.59\times$

Appendix

Table 19: Fraud-state diagnostics under processed features, by tier, at the model order given (

K

is the eligible/selected order where one exists).

Model	$K^{*}$	Occupancy	Fraud rate	Enrichment
Baum-Welch HMM	8	$1.8\%$	$19.4\%$	$5.48\times$
VBEM HMM	7	$3.8\%$	$25.3\%$	$7.16\times$
Neural VBEM ( $d_{z}=32$ )	8	$3.7\%$	$46.1\%$	$13.05\times$
Neural VBEM ( $d_{z}=64$ )	9	$3.8\%$	$50.9\%$	$\mathbf{14.43\times}$
Neural VBEM ( $d_{z}=128$ )	9	$3.8\%$	$55.1\%$	$15.59\times$

Appendix

Table 20: Fraud-state diagnostics under engineered features, by tier, at each tier’s selected

K^{*}

( Table 1 ).

Encoder architecture
Component	Value
Hidden dimension $d_{h}$	512 (fixed)
Latent dimension $d_{z}$	$\{32,64,128\}$ (swept)
Categorical embedding dim. $d_{e_{j}}$	$\min(50,\max(2,\lfloor(C_{j}+1)/2\rfloor))$
Continuous pathway	LayerNorm $\to$ 2-layer MLP, GELU
Dropout	0.1

Appendix

Table 21: Encoder architecture and training hyperparameters, Neural VBEM HMM.

Explore similar work

Sep 8, 2026cs.LG

Topological Fraud Detection in Latent Transaction Spaces

Working entirely on topologically anonymized embeddings, we perform fraud detection using iterative rounds of unsupervised filtering followed by supervised sniping. The result is an ultra-low latency privacy--preserving triage that allows institutions to flag suspicious activity without compromising Personally Identifiable Information.

Avraham Bourla

Fraud Detection Log-Ratio-Based Gaussian Trust Weight Triage

Ask PDF

Jul 20, 2026cs.CR

Detection, Attribution, Narration: An End-to-End Pipeline for Explainable Money Mule Identification

Money mule accounts are critical facilitators of financial fraud, yet detecting them at scale remains challenging due to the heterogeneous nature of transactional and behavioural data. We present an end-to-end pipeline for customer-level mule detection comprising three stages: (1) a LightGBM classifier trained on 280 engineered features spanning transaction patterns, account demographics, network topology, and temporal behaviour; (2) a TreeSHAP attribution layer that decomposes each prediction into feature contributions; and (3) a large language model (LLM) module that converts SHAP attributions into analyst-facing natural-language narratives. We evaluate across three open-weight LLM families and assess explanation quality through analyst feedback. In a live production deployment, the system achieves a yield rate of 89%, up from 61% under the incumbent rule-based system, with monthly alert volume expanding from 211 to 302, reflecting broader true-positive coverage rather than increased noise. This corresponds to a 60% incremental adverse detection beyond existing review workflows, substantially outperforming the rule-based approach. Qualitative feedback from analysts indicates that LLM-generated narratives reduce cognitive load during alert triage. We further discuss implications of deploying LLM-augmented explainability in regulated financial environments.

Yuge Zhang, Yuanxing Zhang, Yichao Jin +7

OCBC, Singapore

Fraud Detection Artificial Intelligence Detection Model Auditing Narratives Gradient Boosted Decision Tree

Ask PDF

Sep 23, 2026cs.LG

SR-Fraud: An Outcome-Supervised Reflective LLM Agent Framework for Non-Stationary Payment Fraud Detection

Real-time payment fraud detection is a non-stationary streaming prediction problem: adversaries adapt before supervised labels mature, and localized burst attacks can cause losses before retraining. Production systems typically rely on tabular classifiers and rules, which can struggle to capture these emerging sequential patterns before periodic retraining occurs. We present SR-Fraud, an outcome-supervised reflective LLM framework that decouples request-time decisions from offline adaptation. A frozen, stateless agent scores each transaction from a Hybrid Episodic Window to track behavioral shifts, while an offline reflection agent proposes boundary hypotheses from matured errors. A deterministic verifier then admits only supported hypotheses into an executable knowledge state. On a production payment-fraud benchmark, SR-Fraud improves all detection metrics over its frozen decision agent, obtains higher point estimates than static and periodically retrained CatBoost, and detects an emerging fraud burst.

Xuwei Tan, Yao Ma, Xueru Zhang

Coinbase, Inc. · The Ohio State University

Fraud Detection Large Language Model Agents

Ask PDF