Post hoc explanation methods generate interpretations after model training, typically by employing an external explainer to approximate a trained model’s decision logic without altering its internal structure (Du et al., 2020). SHAP is a family of additive feature-attribution methods whose explainer variants differ in their dependence on model structure. Some variants, such as KernelSHAP, are designed to be model-agnostic, whereas others, such as TreeSHAP and DeepExplainer, exploit model-specific structure. In the context of CCFD, SHAP-based post-hoc attribution methods and local interpretable model-agnostic explanations (LIME) (Ribeiro et al., 2016) are commonly used approaches; SHAP should therefore not be characterized as uniformly model-agnostic (Lundberg and Lee, 2017). Beyond SHAP and LIME, several studies report that layer-wise relevance propagation (LRP) can provide more efficient and informative attributions for CNN-based detectors applied to tabular fraud data (Ullah et al., 2021). Another line of research integrates autoencoders with post hoc or surrogate-based explanation modules, enabling anomaly evidence extracted from latent representations to be complemented by human-interpretable feature rankings, decision rules, or representative exemplars (Sowmya et al., 2025; Rao et al., 2020).

Intrinsic interpretability is achieved by designing self-explanatory models in which interpretability is embedded directly in the model architecture, rather than approximated post hoc (Du et al., 2020). Deep symbolic classification (DSC) (Visbeek et al., 2024) exemplifies this paradigm by replacing opaque neural architectures with concise, closed-form mathematical expressions. This design yields inherently transparent decision and model-level explanations while maintaining competitive performance against strong baselines such as XGBoost. Moreover, by directly optimizing performance metrics such as the F1-score and DSC, DSC naturally mitigates class imbalance without relying on oversampling or undersampling techniques. SEFraud (Li et al., 2024) extends this intrinsic approach by employing heterogeneous graph transformer networks with learnable feature and edge masks, enabling joint fraud detection and the generation of fine-grained self-explanations.

Although intrinsic XAI models represent important progress toward interpretable fraud detection, they are not universally interchangeable with the MTL setting considered here. Visbeek et al. (2024) demonstrate that intrinsic XAI can be applied to tabular transaction data through a concise, closed-form symbolic classifier trained on the PaySim dataset. However, their deep symbolic classification approach relies on a dedicated symbolic-regression search space and a single classification objective, whereas our framework uses a neural MTL architecture with reconstruction and transaction-amount prediction as auxiliary tasks. Our aim is therefore not to argue that intrinsic XAI is inapplicable to tabular fraud detection, but to study a different hybrid design that combines shared representation learning, reconstruction-based anomaly-sensitivity signals, and post-hoc classifier attribution.

In Task A, an AE is employed to reconstruct input data and learn richer feature relationships that support fraud detection. Both the encoder and decoder are implemented as multilayer perceptrons (MLPs). The encoder progressively compresses the input into a low-dimensional representation, while the decoder reconstructs the original features from this compressed representation. Reconstruction is trained using the mean squared error (MSE) loss; accurate reconstruction indicates that the bottleneck layer captures essential information.

To prevent data leakage, the payment amount p i and class label y i are excluded from the AE input. This ensures that the bottleneck representation cannot directly encode transaction amounts or class labels, which would otherwise render downstream prediction tasks trivial. The AE also functions as a reconstruction-based anomaly detector, learning the manifold of normal transactions. Consequently, elevated reconstruction errors for fraudulent samples serve as a warning sign. This behaviour provides model-derived global and feature-level anomaly evidence, but does not replace attribution of the classifier’s black-box decision (see Section 3.5).

Let f E and f D denote the encoder and decoder, respectively. For transaction i, the encoder produces a bottleneck representation z i B = f E ( x i ; θ E ), where θ E represents the encoder parameters. The decoder reconstructs the input as x ˆ i = f D ( z i B ; θ D ), where x ˆ i is the reconstructed feature vector and θ D denotes the decoder parameters.

The reconstruction loss for Task A is denoted by L 1 . Specifically, we adopt MSE to quantify the discrepancy between the original feature vector x i and its reconstruction x ˆ i . For one transaction, the reconstruction loss is defined as ℓ A , i = 1 d ∑ j = 1 d ( x i , j − x ˆ i , j ) 2 , where d is the number of input features, and x i , j and x ˆ i , j are the original and reconstructed values of feature j for transaction i, respectively. For n training transactions, the Task A objective is the average per-transaction loss, L 1 = 1 n ∑ i = 1 n ℓ A , i . The parameters θ E and θ D are optimized by minimizing L 1 .

The shared network transforms the bottleneck representation z i B produced by the AE. Let f S denote the shared feature network and θ S its parameters. The shared representation for transaction i is defined as z i S = f S ( z i B ; θ S ). The shared network consists of a two-layer MLP, with each layer using ReLU activation and dropout applied between layers to improve training stability. The same shared-network parameters generate the representation supplied to both task-specific heads. Thus, z i S simultaneously supports fraud classification (Task B) and transaction amount prediction (Task C).

The classifier C performs fraud detection by taking the shared latent representation z i S and concatenating it with the transaction amount p i . For transaction i, the classifier output is defined as y ˆ i = σ ( C ( z i S ⊕ p i ; θ C ) ), where ⊕ denotes concatenation, σ is the sigmoid function, and θ C represents the classifier parameters. The output y ˆ i ∈ ( 0 , 1 ) is the predicted probability that transaction i is fraudulent. When a hard class decision is required, this probability can be converted to a binary decision by applying a selected threshold. The per-transaction binary cross-entropy (BCE) loss for Task B is ℓ B , i = − [ y i log ( y ˆ i ) + ( 1 − y i ) log ( 1 − y ˆ i ) ] . For n training transactions, the Task B objective is L 2 = 1 n ∑ i = 1 n ℓ B , i .

The regressor R predicts the transaction amount and follows a structure similar to that of the classifier. It receives the shared representation z i S as input. The regressor output is expressed as p ˆ i = R ( z i S ; θ R ), where θ R denotes the trainable parameters and p ˆ i is the predicted transaction amount. The per-transaction MSE loss for Task C is ℓ C , i = ( p i − p ˆ i ) 2 , where p i is the ground-truth transaction amount. For n training transactions, the Task C objective is L 3 = 1 n ∑ i = 1 n ℓ C , i .

Uniform weighting is the most straightforward strategy for combining multiple task losses. Under this approach, the loss functions of all tasks are summed into a single aggregated objective. Formally, the total loss is defined as L tot = L 1 + L 2 + L 3 . This strategy assigns equal importance to all tasks during optimization, making it simple and easy to implement. However, in practice, tasks that converge faster or exhibit larger loss magnitudes tend to generate stronger gradients and dominate the training process. As a result, tasks that learn more slowly may be under-optimized. To mitigate this imbalance, we adopt the DWA method, which is described in the following subsection.

DWA (Liu et al., 2019) adaptively balances the contributions of multiple tasks during training, ensuring that no single task dominates the optimization process. At training step t, let λ i ( i = 1 , 2 , 3 ) denote the weight associated with the loss of the i-th task. The total loss at step t is then expressed as a weighted sum. That is, L tot = ∑ i = 1 3 λ i ( t ) L i ( t ).

The core principle of DWA is to assign weights inversely proportional to their learning speed. Tasks that exhibit slower loss reduction are assigned higher weights, while tasks that learn faster receive lower weights. Specifically, the weight λ k ( t ) for the k-th task computed as: λ k ( t ) = 3 × exp ( w k ( t − 1 ) / T ) ∑ i = 1 3 exp ( w i ( t − 1 ) / T ) , here, w k ( t − 1 ) quantifies the relative change in loss for task k between two consecutive training steps: w k ( t − 1 ) = L k ( t − 1 ) L k ( t − 2 ) .

The terms L k ( t − 1 ) and L k ( t − 2 ) represent the average loss values of task k at steps t − 1 and t − 2, respectively. A larger value of w k ( t − 1 ) indicates slower convergence for task k. The temperature parameter T controls the smoothness of the weighting scheme. Larger values of T yield more uniform task weights, whereas smaller values accentuate differences among tasks. The constant factor 3 corresponds to the total number of tasks and ensures that the sum of task weights satisfies ∑ i = 1 3 λ i ( t ) = 3. Overall, DWA discourages excessive emphasis on simpler tasks and reallocates learning capacity toward more challenging objectives.

Conflicting gradients are a common challenge in MTL and arise when a model is optimized for multiple objectives simultaneously. Specifically, gradient conflict occurs when gradients associated with different tasks lose point in substantially different or opposing directions in parameter space. In such cases, parameter updates that improve one task may degrade the performance of others, thereby limiting overall learning efficiency. To address this issue, we employ a gradient surgery technique known as PCGrad (Yu et al., 2020). This method modifies task-specific gradients during backpropagation to reduce inter-task interference, enabling more aligned parameter updates and more stable joint optimization.

One effective gradient surgery technique is PCGrad. Figure 2 illustrates the working mechanism of PCGrad. In this framework, two tasks i and j are considered conflicting when the cosine similarity between their corresponding gradient vectors g i and g j is negative. As shown in Fig. 2(a), g 1 and g 2 represent gradients from two non-conflicting tasks. In contrast, Fig. 2(b) illustrates a conflicting scenario, where the cosine similarity between g 1 and g 2 is negative.

When tasks i and j are in conflict, PCGrad resolves this issue by modifying the gradient g i by projection onto the normal plane of g j , as illustrated in Fig. 2(c). In this figure, Proj n 2 denotes the projection operator, and Proj n 2 g 1 represents the projection of g 1 onto the normal vector of g 2 . This operation effectively removes the component of g 1 that conflicts with g 2 , thereby reducing the gradient interference between tasks.

The European Credit Card Fraud Dataset1¹

The dataset is available at https://www.kaggle.com/mlg-ulb/creditcardfraud

The dataset comprises 30 numerical features, including 28 anonymized principal component analysis (PCA) features (V1–V28) and two original variables: Time, which represents the elapsed time in seconds since the first recorded transaction, and Amount, which denotes the transaction value in euros. The dataset is publicly available through Kaggle (i.e. https://www.kaggle.com/mlg-ulb/creditcardfraud).

For all experiments, the dataset is first partitioned using a stratified holdout split, with 25% of the observations reserved as an independent test set and the remaining 75% used as the development set. Hyperparameter optimization is performed on the development set using shuffled stratified five-fold cross-validation. The resulting validation folds generate out-of-fold (OOF) predictions, which are pooled for model development and hyperparameter selection, whereas the independent test set is reserved exclusively for the final evaluation of the selected model configuration.

Following established practice, the dataset is preprocessed using a sequence of transformations performed exclusively on the training data within each cross-validation fold. All data-dependent preprocessing parameters are estimated only after the initial holdout split and separately within each training fold. Specifically, for fold k, each preprocessing component is fitted solely on train k and subsequently applied, without refitting, to train k , val k , and the held-out test set. Consequently, neither validation nor test samples contribute to estimating scaling parameters or outlier thresholds.

The preprocessing pipeline begins by applying a log ( 1 + Amount ) transformation to the Amount feature. The continuous features are then scaled according to the preprocessing strategy selected during hyperparameter optimization (HPO). This approach reduces the influence of extreme values, which are common in financial transaction data.

The distribution of transaction amounts is highly skewed, with a relatively small number of transactions exhibiting exceptionally large values. Because both distance-based and gradient-based learning algorithms are sensitive to extreme values, the logarithmic transformation compresses the dynamic range of the Amount feature, reducing skewness while preserving the relative ordering of transaction values.

For the primary preprocessing configuration explored during HPO, RobustScaler is applied to Time and the log-transformed Amount, whereas StandardScaler is applied to the PCA features (V1–V28). RobustScaler estimates scaling parameters from the median and interquartile range (IQR), making it less sensitive to extreme values than StandardScaler, which relies on the mean and standard deviation. The HPO search space also includes an outlier-aware preprocessing option that estimates IQR-based thresholds using only legitimate transactions in train k , clips values outside the estimated bounds, and generates corresponding outlier indicator variables.

To address the severe class imbalance, Borderline-SMOTE (Han et al., 2005) is applied only to the transformed training subset after all training-derived preprocessing steps have been completed. Unlike conventional oversampling methods that primarily replicate minority-class examples, Borderline-SMOTE generates synthetic minority samples through interpolation, focusing on instances located near the decision boundary. The validation and test sets retain their original class distributions and are never resampled.

Each fold-specific preprocessing pipeline is retained together with its corresponding trained model. During HPO, pooled out-of-fold AUC-PR serves as the optimization objective for selecting both the preprocessing strategy and the model hyperparameters. This metric is chosen because previous studies have shown that precision-recall-based evaluation is informative for highly imbalanced datasets, as precision more directly reflects the impact of false-positive predictions (Davis and Goadrich, 2006; Gray et al., 2011; Gaudreault et al., 2021). During the final evaluation, the preprocessing pipeline fitted for the k-th fold is applied to the held-out test set before the transformed samples are evaluated by the corresponding k-th model. The final prediction for each test instance is obtained by aggregating the outputs of the five fold-specific models using soft voting.

Consistent with the framework described in Section 3.5, we evaluate the autoencoder (AE) reconstruction error (RE) as a global, model-derived anomaly-sensitivity indicator. The underlying premise is that the AE, trained predominantly on legitimate transactions, learns the distribution of normal transaction patterns but reconstructs the relatively rare and irregular patterns associated with fraudulent transactions less accurately. To evaluate this behaviour at the ensemble level, a fold-specific RE was computed for every transaction using each of the five Task A models. For transaction i in fold k, the RE was calculated as the mean squared reconstruction error across all input features. The ensemble RE was then defined as the arithmetic mean of the five fold-specific RE values. This procedure produced one ensemble RE for each of the 71 202 transactions in the held-out test set, comprising 71 079 legitimate transactions and 123 fraudulent transactions.

Table 6 summarizes the reconstruction error statistics for the two classes and reveals a clear difference in reconstruction quality. Legitimate transactions exhibit substantially lower ensemble reconstruction errors (median RE = 0.3608), whereas fraudulent transactions show markedly higher errors (median RE = 1.5975), corresponding to a 4.43-fold increase in the median reconstruction error. The fraudulent class also exhibits considerably greater variability (standard deviation = 6.1562 versus 1.2611). Although the two distributions overlap and both classes contain high-error observations, the upward shift in the fraud distribution indicates that fraudulent transactions are generally more difficult for the ensemble of fold-specific autoencoders to reconstruct.

To assess whether this distributional shift is statistically significant, we performed a one-sided Mann–Whitney U test using the transaction-level ensemble reconstruction errors. The hypotheses were defined as follows:

H 0 : Fraudulent transactions do not exhibit stochastically larger ensemble reconstruction errors than legitimate transactions.

H 1 : Fraudulent transactions exhibit stochastically larger ensemble reconstruction errors than legitimate transactions.

The test yielded U = 7 860 113 and a p-value of 2.92 × 10 − 53 , providing overwhelming evidence against H 0 . These results indicate that fraudulent transactions generally produce larger ensemble reconstruction errors than legitimate transactions. Accordingly, the five-fold ensemble reconstruction error serves as a useful model-derived anomaly-sensitivity indicator within the proposed hybrid model-analysis pipeline.

Building on the framework described in Section 3.5, we extend the analysis to the feature level by examining the feature-wise reconstruction error, denoted as FRE( x i , j ). A higher value of FRE( x i , j ) indicates that feature j of transaction x i is reconstructed less accurately by the AE and therefore contributes more to that transaction’s reconstruction error.

For each transaction–feature pair, the FRE values produced by the five fold-specific models were first averaged to obtain an ensemble feature-wise reconstruction error. The 29 input features were then ranked according to the ratio of the median FRE for fraudulent transactions to that for legitimate transactions. For brevity, Table 7 reports only the ten features with the largest median ratios. This descriptive ranking highlights the largest class-wise differences in reconstruction error and should not be interpreted as implying that the remaining features are uninformative.

All ten reported features exhibit higher median FRE values for fraudulent transactions than for legitimate transactions, with fraud-to-non-fraud median ratios ranging from 4.19 to 26.26. V8 shows the largest disparity, followed by V14, V17, V21, and V12. These findings provide feature-level evidence of deviations under the reconstruction objective and complement the transaction-level reconstruction-error analysis presented in Section 5.5.1.

In summary, feature-wise RE analysis provides model-derived, feature-level anomaly evidence by identifying the input variables that exhibit the largest class-wise differences in reconstruction error. This localized analysis complements the transaction-level ensemble RE analysis described in Section 5.5.1.

The final analysis examines the decision function of the fraud classifier (Task B) using SHAP. Unlike the reconstruction-based outputs, which characterize deviations from learned transaction patterns, SHAP provides post-hoc attribution of the classifier’s output to its actual inputs: the shared latent representation ( Z S ) and the Amount feature, i.e. [ Z S ; Amount ]. SHAP values quantify input contributions to the classifier’s fraud logit relative to the selected background data. Because the logit is monotonically related to the predicted fraud probability, positive SHAP values indicate contributions that increase the predicted fraud probability, whereas negative SHAP values indicate contributions that decrease it. Figure 4 presents global SHAP beeswarm summaries for the five fold-specific classifiers. Each panel displays the 12 classifier inputs with the largest mean absolute SHAP values. To ensure a consistent evaluation protocol across folds, each analysis includes all 123 fraudulent transactions together with a randomly selected sample of 1 877 legitimate transactions, while 500 legitimate training transactions are used as the SHAP background set.

Across the five folds, the mean absolute SHAP values indicate that the classifier relies primarily on a subset of the learned latent components, with the ten most influential classifier inputs accounting for 49.4%–64.9% of the total mean absolute attribution. The identities of the highest-ranked latent components vary across folds because the fold-specific networks are trained independently and their latent spaces are not intrinsically aligned. Consequently, the same latent dimension should not be interpreted as representing the same semantic factor across different folds. Despite this variation, the beeswarm summaries exhibit a consistent directional pattern. The dominant latent components generally show negative SHAP values at high latent values and positive SHAP values at low latent values. Across the complete SHAP results, the Amount feature also exhibits a consistent directional effect in all five folds: larger transaction amounts tend to increase the fraud logit, whereas smaller amounts tend to decrease it. This directional relationship should be distinguished from the unconditional mean SHAP value. Although the mean SHAP value for Amount is negative in every fold (approximately − 0.017 to − 0.001), this statistic reflects the average contribution of the evaluated transactions relative to the background prediction rather than the conditional effect of high versus low transaction amounts. In Fold 3, Amount ranks 18th in terms of mean absolute SHAP value and therefore does not appear among the top 12 features shown in the beeswarm plot. Nevertheless, its directional effect remains evident in the complete SHAP results. Overall, the learned latent representation provides the primary fold-specific decision cues, whereas Amount contributes complementary and directionally consistent information to the classifier.

Overall, the five fold-specific SHAP summaries show that the classifier’s decisions are driven primarily by the learned latent representation, with transaction amount providing an additional, directionally consistent contribution. This analysis complements the reconstruction-based anomaly evidence presented in Sections 5.5.1 and 5.5.2 by providing a post-hoc attribution of the classifier’s prediction while remaining within the scope and assumptions of the SHAP framework.