PaperlayerView exact revision on arXiv

Source-linked AI summary

Mitigating Explanation Leakage in Financial Fraud Detection Systems

Muhammad Waleed Gul, Elaheh Homayounvala

arXiv:2608.22607v1cs.LGcs.CR

TL;DR

Financial fraud detection must reconcile decentralized data protection with regulatory demands for transparent predictions, but sharing high-fidelity TreeSHAP explanations creates membership-inference risk. The dissertation proposes DP-FedSHAP, which applies client-level differential privacy to post-hoc explanations and compares it with matched weight-level perturbation. DP-FedSHAP neutralizes membership inference while preserving predictive utility and substantial explanation fidelity, whereas weight-level noise collapses AUPRC.

  • Problem

    Sharing high-fidelity TreeSHAP explanations in federated fraud detection can expose membership information, creating a privacy gap alongside transparency requirements.

  • Method

    DP-FedSHAP clips post-hoc TreeSHAP vectors and adds calibrated noise, compared against Weight-Level DP that perturbs trained leaf weights under the same privacy settings.

  • Results

    DP-FedSHAP reduces MIA accuracy to 49.75%, preserves global test AUPRC at 0.8989, and retains 80.0% Top-10 Feature Overlap with 0.793 Spearman correlation; Weight-Level DP reaches 49.92% MIA accuracy but 0.5040 AUPRC.

  • Takeaways & Limitations

    Applying privacy protection to exposed explanations rather than tree-model weights preserves a usable predictive model while retaining substantial auditor-relevant explanation structure.

  • Takeaways & Limitations

    The federated system uses three IID-simulated clients, a single seeded run, a non-adaptive attacker, and a rebalanced 1:1 dataset rather than natural fraud prevalence.

Abstract

from arXiv · show

Financial fraud detection relies heavily on centralized machine learning models. This creates serious data privacy risks. Federated Learning (FL) decentralizes data processing, but financial regulations still require models to be transparent. This means using Explainable AI (XAI) tools such as TreeSHAP. Recent cybersecurity research shows a problem with this approach. Sharing high-fidelity SHAP explanations exposes the federated network to Membership Inference Attacks (MIAs). This dissertation proposes and evaluates DP-FedSHAP. It is a new architecture that applies client-level differential privacy only to post-hoc TreeSHAP vectors. It is compared against a Weight-Level DP baseline, which perturbs the trained model directly instead. Using the highly imbalanced IEEE-CIS Fraud Detection dataset, this study measures the trade-off between explanation fidelity, privacy preservation, and the model's Area Under the Precision-Recall Curve (AUPRC).

I. INTRODUCTION

Financial fraud detection needs accurate models that protect decentralized customer data while still providing regulator-facing explanations. The dissertation addresses the privacy leakage created when high-fidelity TreeSHAP explanations are shared by applying differential privacy at the explanation layer and comparing it with model-level perturbation.

  • Financial institutions use XGBoost because it handles highly imbalanced, non-linear transaction data well.
  • Federated Learning keeps raw transaction records local while institutions collaboratively train a global model by sharing model weights.
  • TreeSHAP provides an additive feature-attribution breakdown that helps auditors understand each transaction-level prediction.
  • Shared SHAP vectors can leak training-set membership because their statistical variation reflects the exact samples a model has seen.
  • DP-FedSHAP adds calibrated differential privacy noise to post-hoc TreeSHAP vectors, while Weight-Level DP perturbs trained model leaf weights under the same clipping norm and privacy budget.

II. RELATED WORK

Related work connects federated fraud detection, regulatory XAI, explanation privacy, and differential privacy. These strands motivate a framework that treats explanation leakage as a distinct privacy problem in collaborative financial modeling.

  • The literature treats federated prediction, regulatory explanations, and explanation privacy largely as separate research concerns.
  • Federated fraud-detection research enables collaborative anomaly detection while keeping participating institutions’ records local.
  • SHAP and TreeSHAP provide mathematically grounded feature attributions for explaining individual predictions from tree ensembles.
  • TreeSHAP computes exact Shapley values for tree ensembles in polynomial time rather than the exponential time required by naive Shapley calculation.

C. Privacy Leakage Through Model Explanations

Prior research shows that explanations can increase membership-inference risk, while existing defenses do not fully address the federated, tabular-finance setting. This dissertation positions DP-FedSHAP as a response to that specific gap.

  • Feature-based explanations released with predictions can increase membership-inference attack success compared with predictions alone.
  • Existing countermeasures include explanation-focused methods outside federated finance and training-time defenses such as SHAP entropy regularization.
  • Client-level differential privacy protects an entire client’s contribution by clipping local-model updates and adding calibrated noise across communication rounds.
  • No existing work applies client-level differential privacy directly to post-hoc TreeSHAP vectors while jointly evaluating AUPRC, explanation fidelity, and MIA resistance.

III. METHODOLOGY

The methodology simulates horizontal federated learning across three institutions using balanced IEEE-CIS transaction data and XGBoost models. A global ensemble is evaluated with TreeSHAP explanations, using AUPRC as the principal predictive-utility measure.

  • The experiment simulates Horizontal Federated Learning in which institutions share features but retain distinct private transaction records.
  • The IEEE-CIS dataset combines transaction and identity records with categorical and continuous features, while fraud is originally a small minority class.
  • Random Under Sampling caps each class at 5,000 transactions, producing a balanced 1:1 working sample of 10,000 transactions.
  • The centralized baseline achieves a mean validation AUPRC of 0.9012±0.0031 under stratified 5-fold cross-validation.
  • FedAvg trains local XGBoost models on three client partitions and aggregates them into a collaborative global model.
  • 0.8989 global ensemble AUPRC is achieved on the held-out 2,000-transaction test set.
  • Post-hoc TreeSHAP computes exact feature contributions for every prediction produced by the trained global model.

C. The DP-FedSHAP Defense Mechanism

DP-FedSHAP protects explanation outputs rather than perturbing the trained tree model. It combines client-level clipping and calibrated noise, alongside a Weight-Level DP baseline for controlled comparison.

  • Defense design: DP-FedSHAP applies client-level differential privacy exclusively to post-hoc explanation outputs, preserving the tree ensemble’s structural integrity.Noise is added after training rather than to the model’s internal structure.
  • Defense design: Sensitivity bounding clips every TreeSHAP vector to an L2 threshold of C = 0.8 before noise injection.The threshold is computed once from combined member and non-member batches.
  • Defense design: Calibrated Laplacian noise is injected into clipped explanation vectors under a fixed privacy budget of ϵ = 1.2.The mechanism is designed to limit the influence of extreme attribution outliers.
  • Controlled baseline: The Weight-Level DP baseline applies the same clipping norm and privacy budget to trained leaf outputs, then generates predictions and TreeSHAP explanations from the noised model.This enables direct comparison of predictive utility and explanation fidelity across noise locations.

E. End-to-End Pipeline Summary

The evaluation pipeline partitions IEEE-CIS data across simulated clients, trains and aggregates local XGBoost models, privatizes either explanations or leaf weights, and evaluates the outputs. The study also calibrates model overfitting and holds DP parameters constant for comparison.

  • End-to-end workflow: The pipeline preprocesses and horizontally partitions IEEE-CIS data across three simulated clients before federated XGBoost training and FedAvg aggregation.The full workflow proceeds through five stages, ending with evaluation of the resulting model.
  • Implementation: The federated network is implemented with a custom client–server loop using Python, xgboost, and shap.xgboost supports predictive modelling and shap computes feature attributions.
  • Model calibration: The centralized baseline is calibrated for realistic overfitting so its membership signal does not appear artificially weak.Underfit or overly regularized models could understate the privacy risk of releasing TreeSHAP vectors.
  • Optimization: Optuna’s TPE sampler sequentially searches promising hyperparameter regions instead of using exhaustive or random grid search.The sampler models which regions are likely to yield low loss and concentrates subsequent trials there.
  • DP configuration: DP-FedSHAP and Weight-Level DP both use fixed ϵ = 1.2 and C = 0.8, excluded from the Optuna search for a controlled comparison.The parameters are treated as post-processing bounds.

B. Threat Model Implementation

The threat model trains a direct attacker on the target model’s TreeSHAP outputs using known member and non-member origins. Evaluation emphasizes privacy-aware and explanation-fidelity metrics alongside predictive utility.

  • Attacker model: The MIA attacker is trained directly on the target model’s TreeSHAP outputs rather than on outputs from a shadow model.This represents an adversary with unmediated access to the target’s explanations.
  • Membership construction: Membership labels use 2,000 training vectors and 2,000 held-out test vectors, with 1,200 unseen explanations reserved for evaluation.The 4,000-vector pool is split 70/30 in a stratified manner.
  • Evaluation metrics: AUPRC measures predictive utility because class imbalance makes standard accuracy unsuitable for this evaluation.AUPRC heavily penalizes false positives and missed fraud detections.
  • Evaluation metrics: Explanation fidelity is measured by Top-10 Feature Overlap and Spearman Rank Correlation against original attribution vectors.The first tracks retained influential features, while the second measures monotonic rank agreement.

B. Privacy Metrics

Privacy leakage is defined by how far MIA accuracy departs from 50% random guessing. Lower leakage indicates stronger practical resistance to membership inference, and the evaluation summarizes a trajectory from vulnerability to preservation.

  • Leakage definition: Privacy leakage L equals the absolute distance between MIA accuracy and 50% random guessing.The metric captures the attacker’s departure from chance performance.
  • Security criterion: Practical security against membership inference is approached as L →0.Leakage is minimized when attacker accuracy converges toward random guessing.
  • Evaluation framing: The empirical evaluation summarizes a trajectory from baseline vulnerability to robust privacy preservation in Table I.This statement frames the reported privacy results comparatively across the evaluated systems.

A. Baseline Vulnerability

The centralized and standard federated baselines retain high predictive and explanation utility but remain vulnerable to membership inference. DP-FedSHAP reduces leakage to chance-level while preserving predictive utility, with a modest fidelity decrease.

  • Centralized Baseline: 61.67% MIA accuracy and L = 11.67% show that the centralized baseline leaks substantial membership information despite perfect explanation fidelity.Its AUPRC is 0.9012 ± 0.0031, with 100% Top-10 Overlap and Spearman Rank = 1.000.
  • Standard Federated Learning: 51.58% MIA accuracy and L = 1.58% show that standard federated learning reduces, but does not eliminate, explanation-based leakage.Standard FL retains 100% Top-10 Overlap and Spearman Rank = 0.980.
  • DP-FedSHAP: 49.75% MIA accuracy and L = 0.25% make DP-FedSHAP statistically indistinguishable from random guessing.The configuration uses ϵ = 1.2 and C = 0.8.
  • DP-FedSHAP: 0.8989 global test AUPRC shows that DP-FedSHAP fully preserves predictive utility while perturbing only post-hoc TreeSHAP explanations.The same passage reports local CV utility of 0.8797±0.0138.
  • DP-FedSHAP: 80.0% Top-10 Feature Overlap and Spearman Rank = 0.793 indicate a modest fidelity reduction while retaining most influential fraud indicators.The passage states that 8 of the top 10 indicators remain intact.

D. Weight-Level DP: An Instructive Failure Mode

Weight-Level DP matches DP-FedSHAP in suppressing membership inference but severely damages predictive utility and explanation fidelity. The comparison supports applying noise at the explanation layer rather than to the trained tree model, within the reported evaluation scope.

  • Privacy Outcome: 49.92% MIA accuracy shows that Weight-Level DP neutralizes membership inference comparably to DP-FedSHAP under the identical privacy budget.Both configurations use ϵ = 1.2 and C = 0.8.
  • Predictive Utility: 0.5040 global test AUPRC shows that Weight-Level DP collapses predictive utility to random-guessing performance on the balanced binary task.Noise is applied to the trained model’s leaf weights rather than post-hoc explanation vectors.
  • Predictive Utility: DP-FedSHAP preserves full predictive utility with global test AUPRC = 0.8989 because perturbation remains confined to the explanation layer.The decision boundary is not directly perturbed.
  • Explanation Fidelity: 70.0% Top-10 Feature Overlap and Spearman Rank = 0.7623 show greater fidelity degradation for Weight-Level DP than DP-FedSHAP’s 80.0% and 0.793.The comparison attributes the difference to noising internal model structure versus the explanation layer.
  • Evaluation Scope: The study reports a single seeded run for the DP mechanisms, so repeated independently seeded noise draws remain recommended for characterizing estimate stability.The broader evaluation also uses a single stratified test partition for the aggregated federated ensemble and MIA evaluation.

VII. CONCLUSION

The dissertation finds that DP-FedSHAP protects against explanation-based membership leakage while retaining predictive and explanatory utility. Its conclusions also identify evaluation extensions needed to assess stability, generalizability, and robustness under stronger conditions.

  • Privacy findings: 61.67% centralized MIA accuracy fell to 51.58% with standard federated averaging, showing that averaging alone is not a reliable privacy defense.The reduction came from incidental averaging of client explanations rather than a formal privacy mechanism.
  • DP-FedSHAP results: 49.75% MIA accuracy, 0.8989 AUPRC, and 80.0% Top-10 feature overlap show DP-FedSHAP reduced leakage while preserving model utility and explanation fidelity.These values were reported relative to the undefended explanations where specified.
  • Baseline comparison: 49.92% MIA accuracy with Weight-Level DP was statistically comparable, but AUPRC fell to 0.5040, demonstrating the importance of where DP noise enters the pipeline.The baseline noised trained model leaf weights under an identical privacy budget.
  • Architectural contribution: Applying L2 sensitivity bounding and calibrated Laplacian noise to post-hoc explanation vectors avoids the weight-level utility collapse without changing the underlying predictive model.This architecture supports formal privacy protection for institutions using XGBoost and TreeSHAP for regulatory transparency.
  • Future work: Future evaluation should test multiple noise draws, adaptive clipping under streaming non-IID clients, additional benchmarks, natural class imbalance, and adaptive adversaries.These directions target estimate stability, explanation fidelity, generalizability, and robustness under a stronger threat model.
Loading 2608.22607v1…