SAGE: Scalable Automatic Gating Ensemble

• SAGE is a fraud-detection methodology that combines SimHash-based stratified sampling with a modular gating ensemble to harvest high-confidence negatives from unlabeled data.
• It preserves behavioral diversity by enforcing floor constraints, thereby addressing representation bias and capturing rare legitimate user patterns.
• Adaptive k-of-n voting allows precise control over the precision-recall trade-off, with empirical results showing significant gains over traditional PU methods.

SAGE, short for Scalable Automatic Gating Ensemble, is a fraud-detection methodology for confident negative harvesting from unlabeled data. It was introduced in the context of music streaming fraud, where many legitimate edge cases—including super-fans and sleep-music sessions—can exhibit activity patterns that closely mimic coordinated fraud. The method is explicitly designed to address two linked problems: the counterfactual problem, in which legitimate but fraud-like behaviors are incorrectly treated as abuse, and representation bias in Positive-Unlabeled learning, in which rare but legitimate cohorts are systematically underrepresented. SAGE combines SimHash-based stratified sampling with a modular gating ensemble to identify high-confidence negatives while allowing an adaptive precision-recall trade-off through configurable voting thresholds (Tubati et al., 19 May 2026).

1. Problem setting and motivation

The motivating setting for SAGE is fraud detection under weak supervision, especially where labeled positives are available but reliable negatives are scarce. In music streaming fraud, the paper emphasizes that legitimate behavioral outliers can resemble fraud strongly enough that models trained on positives plus a small negative set produce high false positives. This is described as a counterfactual problem: the model encounters legitimate patterns that are close to the fraud manifold but absent from its negative supervision (Tubati et al., 19 May 2026).

The work also positions itself against the limits of conventional Positive-Unlabeled (PU) learning. According to the paper, purely PU methods do not scale and cannot guarantee representation of rare but legitimate behaviors. That claim is central to the design: the objective is not merely to extract likely negatives from unlabeled data, but to do so in a way that preserves long-tail behavioral coverage rather than reproducing the mainstream distribution.

A common misconception is that unlabeled-data harvesting can be treated as a generic outlier-filtering problem. SAGE argues for a more structured view. In this formulation, negative harvesting must be both counterfactual-aware and representation-aware: it must exclude fraud-like cases conservatively while also ensuring that uncommon legitimate cohorts are present in the harvested set.

2. Pipeline structure

SAGE is organized as a negative-harvesting pipeline with three main components: population-wide stratified sampling, statistical gating, and thresholded voting. The workflow is summarized below (Tubati et al., 19 May 2026).

Step	Mechanism	Purpose
Stratified Sampling	SimHash + Floor Constraints	Guarantee all behaviors are present
Confidence Filtering	Modular Gating Ensemble	Filter out possible fraud from negatives
Voting/Thresholds	Unanimous or k-of-n voting	Tune precision-recall adaptively

The first stage constructs a behaviorally diverse candidate pool from the unlabeled population. The second stage applies a set of independent statistical gates that test whether a sample is sufficiently far from the labeled fraud population. The third stage converts gate outputs into a final confident-negative decision using either strict or relaxed voting.

The training-set construction described in the paper combines human-labeled positives/suspicious examples with harvested confident negatives. This suggests that SAGE is intended less as a replacement for supervised fraud modeling than as an upstream data curation layer that improves the reliability and coverage of the negative class.

3. SimHash-based stratified sampling

The first technical component is SimHash-based stratified sampling, introduced to ensure that negative harvesting does not collapse onto only the most common legitimate behaviors. For a feature vector $x$, the paper computes a SimHash signature

$h(x) = \text{SimHash}(x).$

Behaviorally similar customers receive similar hashes, after which the data are partitioned into thousands of behavioral buckets. Sampling is then performed with floor constraints, so that for each bucket $b$,

$n_b \geq \text{floor threshold}.$

The stated purpose is to preserve and sample from all types of legitimate behaviors, not just the mainstream. In practice, this is the mechanism that addresses representation bias. Rare or long-tail cohorts remain present in the sampled candidate set even when they are numerically small. The paper identifies examples such as sleep-music patterns and edge hardware devices as behaviors that prior methods may underrepresent and therefore misclassify (Tubati et al., 19 May 2026).

This stage is not itself a fraud detector. Its role is coverage control. By enforcing bucket floors, SAGE ensures that subsequent filtering operates over a population that includes both common and rare behavioral regimes. A plausible implication is that the method treats diversity preservation as a prerequisite for trustworthy negative harvesting, rather than as a downstream modeling concern.

4. Modular gating ensemble

After stratified sampling, SAGE applies a modular gating ensemble to unlabeled candidates. Each gate is an independent detector of outlierness relative to the labeled fraud population, with its own calibrated threshold. The paper currently instantiates the ensemble with two gates (Tubati et al., 19 May 2026):

• Mahalanobis Distance for global outlierness
• k-NN density estimation for local outlierness

The Mahalanobis Distance gate measures distance from the fraud centroid using labeled frauds. Its score is

$$D_M(x) = \sqrt{(x - \mu_F)^\top \Sigma_F^{-1} (x - \mu_F)},$$

where $\mu_F$ is the mean vector of the fraud-labeled population and $\Sigma_F$ is the covariance matrix. The paper specifies Ledoit-Wolf shrinkage for robust covariance estimation. A sample passes this gate when

$D_M(x) > t_{MD}.$

The k-NN density gate estimates local fraud density around the sample. Low density relative to fraud labels is interpreted as evidence that the sample is not embedded in a fraud cluster. A sample passes when the local fraud density is below $t_{kNN}$.

The ensemble is explicitly described as pluggable. The paper notes that other gates such as Isolation Forest, LOF, and domain heuristics can be added as needed. This modularity matters because the gating layer is not tied to a single statistical notion of separation. Instead, it combines complementary views of distance from fraud: one global and one local.

Confident negatives are defined as unlabeled samples that pass the ensemble’s strictest thresholds, thereby minimizing contamination. In other words, SAGE treats negative harvesting as a conservative acceptance problem rather than a direct relabeling of the unlabeled pool.

5. Voting, calibration, and empirical results

SAGE exposes an explicit precision-recall control surface through its voting mechanism. Under unanimous voting, a sample must pass all gates, which the paper associates with maximizing precision. Under k-out-of-n voting, more samples are accepted, increasing recall at the cost of lower precision. Thresholds for each gate are calibrated independently on held-out validation data, and contamination—that is, false negative harvesting—is measured directly to choose operating points (Tubati et al., 19 May 2026).

The empirical evaluation compares SAGE against unsupervised, semi-supervised, and PU-oriented baselines. The paper names Isolation Forest and Variational Autoencoder as unsupervised baselines, and Random undersampling, Student-Teacher, and K-Means cluster undersampling as semi-supervised baselines. Reported improvements are summarized below.

Method	Δ Precision (pp)	Δ Recall (pp)
Variational Autoencoder	+55.8	+10.1
Random undersampling	+73.8	+82.2
Student-Teacher	+82.0	+22.3
Cluster undersampling	+80.5	+75.0
SAGE	+81.9	+87.2

The paper further reports that SAGE achieves +85.2 in $\Delta F1$ and describes this as the best balanced gain in precision and recall relative to baseline. Evaluation is stated to show strong precision and recall on held-out data. The ablation study reported as Figure 1 shows that only the combination of stratified SimHash sampling and dual-gate filtering achieves the highest precision-recall.

These results are significant in the paper’s framing because they support a joint claim: diversity-aware candidate construction and conservative statistical filtering are both necessary. Neither component alone is presented as sufficient.

6. Generalization and interpretation

SAGE is reported to generalize across fraud detection domains, specifically to both customer-level and artist-level fraud, without modification to the core methodology (Tubati et al., 19 May 2026). This is an important architectural claim. The core method is defined at the level of behavioral stratification plus fraud-relative gating, rather than at the level of a domain-specific fraud ontology.

The paper also presents the broader applicability of the paradigm to domains such as financial fraud, bot detection, spam, and cybersecurity, particularly where negatives are weakly labeled or closely resemble positives. This suggests that SAGE is intended as a reusable pattern for weakly supervised anomaly-adjacent classification problems, provided that a positive class and a large unlabeled pool are available.

Conceptually, SAGE departs from the assumption that one can learn adequate negatives through random sampling or pure PU inference. Its central claim is narrower and more operational: when legitimate rare behaviors are both consequential and easily confused with fraud, negative harvesting must first guarantee population-wide behavioral coverage and then enforce counterfactual-aware rejection of fraud-like candidates. Within that framing, SAGE is best understood as a data curation method for constructing a more reliable negative set under severe label asymmetry.

7. Place within fraud-learning methodology

Within fraud-learning workflows, SAGE occupies the interface between weak supervision and downstream classification. It does not replace supervised fraud models, nor is it presented as a generic anomaly detector. Instead, it addresses the specific training-data pathology that arises when the negative class is both underlabeled and behaviorally heterogeneous.

Its contribution can be decomposed into four elements (Tubati et al., 19 May 2026): SimHash-based stratification for diversity coverage, dual statistical gating for confident negative identification, adaptive voting thresholds for operating-point control, and generalization across fraud granularities. Taken together, these components define a methodology for harvesting negatives that are simultaneously high-confidence and behaviorally representative.

The broader methodological significance is that SAGE makes negative-set construction an explicit object of design. Rather than assuming that unlabeled data can be consumed directly, it treats the unlabeled pool as something to be sampled, structured, filtered, and calibrated. This suggests a shift in fraud detection from model-centric treatment of weak labels toward pipeline-centric treatment of supervision quality.