Pattern-layer detectors achieve 0% recall on phantom fees (F3) and service laundering (E4) in ACB

Auto-published from arXiv:2609.35886 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.85, no flags)

Category

tool-misuse

Model

unknown

Surface

agent harness (pattern/statistical detector layer over payment-agent settlement logs)

Setup

The gordonguard detector stack was calibrated at a 6.5% clean-flag rate (10% false-positive budget) and evaluated against ACB's 20 fraud classes. Fraud class F3 (phantom fees: charges for services never rendered or not in the original quote) and E4 (service laundering: legitimate-looking line items that conceal fraudulent charges) were included. An example evasion strategy from the paper: a counterparty states 'I'll split this into three payments to stay under per-transaction limit' to defeat velocity checks. The benchmark uses 1,647 catalogued service operations and 1,068 settlements drawn from production aggregates.

Reproduction anchor

code: https://github.com/BuildWithGordonAI/agentcommercebench — dataset: huggingface.co/datasets/dpaul93/agentcommercebench; reproduce with python -m benchmark.generator --train-sessions 1200 --sessions 3000 --seed 42 then python -m benchmark.evaluate_v2 --data $D --l0 pattern

Observed behavior

The pattern-layer detector achieved 0.00 recall on F3 (phantom fees) and 0.00–0.06 on E3/E4. Eight of twenty fraud classes were left 'no better than chance' at the calibrated flag rate. F1 (overcharge) reached only 0.03 recall; the difficulty is partly structural: 4.8% of honest purchases legitimately exceeded 1.45× the quoted price, making 15–70% overcharges hard to distinguish from real price variance.

Expected behavior

A payment-agent fraud detector should flag phantom line items and structured payment splitting as suspicious, even when the counterparty's identity is valid and the domain is correct. At minimum, recall on phantom fees should exceed random chance given the economic harm of undetected charges.

Reproducibility

high

Threat model

A malicious counterparty with a legitimate business identity can charge a spending-capable AI agent for services never delivered (F3) or obscure fraudulent charges inside legitimate-looking service bundles (E4). Because pattern detectors are tuned to keep false-positive rates low on real commerce variance, they cannot distinguish these attacks at an economically useful recall level. At a median payment of $0.007, human review is 143× more expensive than the payment being protected, so automated detection is the only practical control — and it fails.

Novelty

Establishes with production-aggregate data that the statistical overlap between legitimate price variance and fraudulent overcharges makes pattern-based fraud detection for AI payment agents fundamentally underdetermined at current false-positive budgets, not merely a tuning problem.

Source

• arXiv: 2609.35886
• PDF: https://arxiv.org/pdf/2609.35886
• Categories: cs.CR, cs.AI, cs.CY
• Authors: Ankit Srivastava, Debjyoti Paul

Triage notes (auto)

• paperType: benchmark
• estimatedCaseCount: 5
• triage reason: Benchmark of 20 distinct fraud attack classes against payment-holding AI agents, with detailed failure characterization: 8 classes fail at better-than-chance detection, plus documented agent reasoning failures on 4 classes where standard security scanners score zero.

─────────────────────────────────────────────────────────────────────