README.md

---
library_name: xgboost
tags:
- fraud-detection
- phishing
- xgboost
- nexus
license: mit
---

# NEXUS Fraud Detection — model artifacts

Trained heads for [NEXUS Fraud Detection](https://github.com/Deepnar/NEXUS-Fraud-Detection)
(forked from [Rishit1769/NEXUS-Fraud-Detection](https://github.com/Rishit1769/NEXUS-Fraud-Detection)).
Each folder is a drop-in `ml/artifacts/<task>/<version>/` directory: copy it into the
repo's `ml/artifacts/` (or point `MODEL_ARTIFACT_ROOT` at this repo) and the
FastAPI model service (`ml/service.py`) picks it up with no code changes.

| Head | Folder | Model | Unseen-data result |
|---|---|---|---|
| Transaction fraud (XGBoost + isotonic, Optuna-tuned) | `transaction/` | `model.json` + `calibration_model.joblib` | Fresh-seed PR-AUC 0.689; future-years slice 0.847 |
| Message phishing (TF-IDF char+word + lexical, XGB) | `message-tfidf/` | `model.json` + `vectorizer.joblib` | 18/18 hand-crafted probes |
| Message count baseline (XGB, fallback) | `message/` | `model.json` | advisory-only fallback |
| URL phishing (lexical XGB) | `url/` | `model.json` | 19/20 probes |

`eval_unseen.json` is the full unseen-data ledger. Per-head `metrics.json`,
`thresholds.json` (recall>=0.80 operating points), `feature_manifest.json`,
`split_manifest.json`, and `training_manifest.json` document provenance.

**Note:** deterministic rules stay authoritative in NEXUS — these heads are
advisory and never override a critical rule. Transaction data is synthetic
(IBM); retrain on real adjudicated cases before production use.