Anchors

Anchors generate rules with a user-specified precision threshold (e.g., 95%). This means the rule is statistically guaranteed to hold for the defined fraction of instances it covers. For a fraud analyst, an anchor like 'IF transaction_amount > $10,000 AND account_age_days < 30' provides a concrete, verifiable condition that anchors the model's decision, ensuring that other feature changes do not flip the prediction from fraud to legitimate.

The anchor algorithm treats the underlying model as a complete black box. It operates solely by perturbing inputs and observing outputs, requiring no access to gradients, internal weights, or model structure. This makes it applicable to any classifier:

• Gradient-boosted trees (XGBoost, LightGBM)
• Deep neural networks
• Ensemble methods
• Proprietary third-party models This agnosticism is critical in financial environments where model architectures are heterogeneous and often vendor-supplied.

Anchors are constructed using a multi-armed bandit exploration strategy that efficiently searches the space of possible rules. The algorithm balances exploitation of candidate rules with high estimated precision against exploration of new feature combinations. The final output includes a coverage metric, quantifying the proportion of instances in the dataset to which the anchor applies. A high-coverage, high-precision anchor provides a broadly applicable explanation for a class of fraudulent behaviors.

Unlike global feature importance methods, an anchor provides a local sufficiency condition. The rule defines a region in the feature space where the prediction is invariant. Formally, an anchor A satisfies: P(pred(x)=pred(z) | A(z)) ≥ τ, where z is a perturbed instance and τ is the precision threshold. This probabilistic guarantee is essential for generating adverse action reason codes that regulators can audit, as the explanation is tied directly to a stable decision boundary.

Anchors produce rules composed of independent feature predicates (e.g., amount > X, country = Y). This decomposition allows a fraud investigator to understand the exact combination of factors that triggered an alert. For example, an anchor might reveal that a model flags transactions not just for high velocity, but specifically for 'high velocity AND a beneficiary account in a high-risk jurisdiction AND a device fingerprint mismatch'. This granularity enables precise, targeted investigation rather than vague suspicion.

Anchors naturally complement counterfactual explanations. While an anchor defines the conditions sufficient to maintain a prediction, a counterfactual identifies the minimal changes required to flip it. Together, they provide a complete picture: the anchor explains 'why this is fraud', and the counterfactual explains 'what would make it legitimate'. This dual approach is powerful for model debugging, revealing if a model relies on spurious correlations that can be exploited by adversaries.

A global visualization tool showing the marginal effect of one or two features on predictions, averaged over all other features. While Anchors provides local, instance-specific rules, PDPs reveal aggregate model behavior across the entire dataset.

• Identifies monotonic relationships and thresholds
• Useful for regulatory model documentation
• Pair with ICE plots to detect heterogeneous effects

An interpretable model (linear regression, decision tree) trained to mimic a black-box model's predictions. Provides global insight into complex fraud detection ensembles. Anchors can be seen as generating local surrogate rules rather than global approximations.

• Enables stakeholder comprehension of model logic
• Used when direct model inspection is impossible
• Trade-off between fidelity and interpretability