encoder/configs/model_fraud_pattern.yaml

# Phase-1 multi-surface model configuration: Fraud Pattern.
#
# Built on the same encoder + projector + LFM2.5-350M frozen + LoRA
# recipe as dispute and collections. Differences:
#   - probability head: FraudPatternHead (two independent categoricals
#     emitting 5-class stage + 4-class type from a shared pooled rep).
#   - encoder: enables 5 Fraud-specific markers at the flagged position
#     (probe_cluster, post_attack, novel_device, signature_clean,
#     recent_authorize) — lesson 2 / cross-position signals readable
#     from the input.
#   - stage_class_weights up-weight the rare bands (PROBING,
#     MONETIZATION, EXFILTRATION) since the broad corpus is dominated
#     by PRE_ATTACK and DORMANT.
#
# LM head NOT trained (lesson 4: 350M generation is anti-pattern).

architecture:
  surface: fraud_pattern
  sequence_length: 64
  text_max_length: 256
  reasoning_max_length: 128

encoder:
  d_feat: 32
  d_encoder: 256
  mlp_hidden: 384
  enable_fraud_markers: true

projector:
  hidden: null
  use_layernorm: true

backbone:
  hf_path: LiquidAI/LFM2.5-350M-Base
  dtype: bfloat16
  lora:
    enabled: true
    r: 16
    alpha: 32
    dropout: 0.05
    target_modules:
      - q_proj
      - k_proj
      - v_proj
      - out_proj
      - lm_head

heads:
  probability:
    type: fraud_pattern
    name: fraud_pattern
    num_stages: 5
    num_types: 4
    mlp_hidden: 256
    dropout: 0.1
    num_tx_positions: 64
    # Stage class weights: up-weight the rare bands. PRE_ATTACK and
    # DORMANT are the natural-distribution majority; PROBING /
    # MONETIZATION / EXFILTRATION are the headline attack signals.
    # Per-class weights tuned from the v1_targeted distribution.
    stage_class_weights: [1.0, 2.0, 4.0, 2.0, 1.5]
    # Type class weights: SCAM_REDIRECTED and DECLINED_LEGIT are rarer
    # than VICTIM_FRAUD and ACCOUNT_TAKEOVER.
    type_class_weights: [1.0, 1.0, 2.5, 2.0]
  attribution:
    name: fraud_pattern_attribution
    mlp_hidden: 64
    dropout: 0.1
    num_tx_positions: 64
    # Attribution density is low (~4% mean per audit) because the
    # attribution highlights specific cluster positions. Higher
    # pos_weight than collections.
    pos_weight: 8.0