Drift and Adaptation — Defending Against an Adversary Who Read Your Model
Ordinary ML drift is weather — the world changes and models age. Fraud drift is war — the distribution shifts precisely because you deployed, as attackers probe the new boundary and route around it. A fraud system's long-run performance is therefore determined less by any single model than by its adaptation loop: how fast drift is detected, how fast a response ships, and how safely the response is validated against labels that haven't arrived yet. This post builds that loop.
Against an adapting adversary the system is the loop: detection cascaded by speed (input drift, score drift, proxy labels, chargeback truth), responses laddered by cost (expiring tactical rules in minutes, threshold posture, cadence-plus-trigger retrains, shadow challengers), validation staged around label delay.