01 One Loop · Team WGG, National University of Singapore · AMEX AI Hackathon 2026 · Round 1 · A 29-page proposal, pages 1 to 22 and 84 to 90; pages 23 to 83 are evidence you may skip
Executive summary
One Loop is one transaction backbone serving three growth heads, one for each question above, entered under Amex's Growth theme, with a measurement layer that puts a behind every partner campaign so the lift can be certified rather than asserted. The operator is the Singapore Decision Science CoE; the customer is a GNS partner bank in APAC; what changes for them is that a signing list, an offer campaign and a corridor forecast each arrive with a number someone can check.
The scarce resource in payments AI is a number that still stands after an audit, rather than another model. This report presents such a number. 27 comparisons in this document carry an interval, one row per metric, depth, seed and arm the pre-registrations named: 7 cleared zero, 7 landed on the wrong side of it and 13 straddle it, all drawn at one size in Section 5, the wrong side including our own offers exhibit's primary endpoint. Most evaluations stop before that picture exists; the apparatus that produces it is the part of this we built. The revenue it builds toward is modelled, not measured: US$10.5M a year by year three of an APAC rollout, across eight partner markets, counting only discount revenue on , the base case of the three scenarios Section 2 prints. Section 2 builds it bottom-up and then shows what is left of it when the lanes that lost are struck out.
Opens the YouTube player in place. Also at youtu.be/g0ptMP5NRPo.
In the unit a budget owner uses: targeting a tenth of customers this way captures 59.3 percent of every incremental visit the campaign produced, against 48.6 percent for response ranking at the same reach. That is this tile's own figure at one tenth of the reach, not a second measurement. The version that carries a : against response ranking at that depth, this ranking adds 0.011 per customer targeted, interval [0.009, 0.014], entirely above zero.
What travels with it The ratio is point estimates over point estimates and carries no interval of its own. Most of that concentration is what response ranking already reaches alone, and the is what the model adds. The corpus is an advertising experiment. Visit was the robustness endpoint, and on conversion, the pre-registered primary, this same ranking lost at every depth, which Section 6 prints at the same size.
See the measurement, Section 6This is roughly two more correct answers in every hundred, on an interval above zero. This tile is included to show the number we could have printed instead. Scored the permissive way, the same frozen model on the same task shows a gain of 0.0590 rather than 0.0218, more than two and a half times as much. The guards, not the model, account for the difference, and the smaller number is the one we ship.
See the ladder, Section 5Every ranked list and lift report leaves with a narrative written by a self-hosted model over the committed numbers, never over free text. The five the direction check fails say the model beat the while their own facts say the naive was ahead: every numeral was correct and only the direction was wrong, which is the one thing the first two layers never checked. This layer explains decisions and never makes one, by choice; the model that does feed a decision is the pretrained transformer whose per-field likelihoods score fraud in Section 5.
What travels with it The cause was our fact bundle, not the model. It stated a false comparison rule, and layer two could not catch that because it is the same model reading the same bundle. The rule is fixed; the text is not regenerated, which needs a cluster GPU. Our red team also beats this gate on two of seven attack classes, fixed and re-measured in Section 6.
Step through the replay console, Section 6Self-assessment of the evidence
The full scoreboard, every interval drawn against one zero line, is in Section 5.
If you read nothing else
The product is summarized in two rows of a randomized experiment, both on the visit endpoint. The segment a response model ranks 26 of 28, so it never gets mailed, is the one the randomized arms measure moving most: visit uplift 5.82 points, ninety-five percent interval [3.96, 7.67], clear of zero. The segment it ranks 5 of 28, and mails, measures 2.31 points, interval [-1.25, 5.87], which cannot be told from zero, and its spend uplift spans zero too. The budget therefore goes to the row whose measurement cannot be distinguished from zero, and skips the row whose measurement can. Both intervals are the normal approximation on the stored standard error. Nothing in a response score sees either fact; only a randomized holdout does, and the first tile above is the same mechanism at 4,193,878 rows. It was built for about US$28 of compute at cited public rates, cash US$0, and stop three below describes how to check any number on this page.
| Figure | Committed file | Path inside it | Value as stored | Line | File checksum, leading characters |
|---|---|---|---|---|---|
| Offer targeting, paired difference at the top decile | results/uplift.json | /criteo/targeting_at_k/outcomes/visit/k/10/difference_cate_minus_response/value | 0.0110485 | 228 | 2e6322028c7aaabf |
| Fraud ranking, model added to the counting control, PR-AUC | results/protection.json | /comparisons_by_key/pll_plus_rarity_vs_rarity_all_fields/pr_auc/difference | 0.201423 | 498 | c9735e2ceace5bb6 |
| Corridor forecast, the pre-registered equal-weight combination, macro MASE | results/corridor_combination.json | /macro/mase_combination | 0.506081 | 90 | cce3eac9ab789275 |
The unfavourable results are reported deliberately, because the value of a decision product depends on the reliability of its numbers, including in the cases where a result shows none.
02Problem and ValueApplicability at American ExpressGrowth, primary
Only the smallest lane has a measurement under it
Amex's CEO named coverage as the constraint. Three lanes model US$10.5M a year by year three at base case; strike the lanes that lost their tests and the measured offers lane, the smallest, remains.
Coverage is the CEO's named constraint; the CoE operates it for a GNS partner bank; the Phase 1 bar is priced on the one lane a randomized measurement stands under.
Results that did not hold and are still reported
0.3%QRIS charges merchants 0.3% against card rates of 1.5% to 3%; APAC is Amex's fastest-growing market family and smallest developed region, at $5.22 billion (7.2% of the company total) in FY2025 revenue.
On the Q4 2025 earnings call, Steve Squeri said Amex must "continue to build coverage, obviously, in international as that continues to grow and continues to be the fastest-growing overall part of our business"6. The gap is visible in Amex's own filing. APAC revenue was $5.22 billion (7.2% of the company total) in FY2025, the smallest developed region despite being the fastest-growing market family, and the card network business runs through partner relationships in approximately 110 countries and territories. Every figure in this paragraph is the 10-K's, not a third party's reading of it.
US$10.5M a year by year three, base case, three lanes, modelled; strike the lanes that lost and the measured offers lane remains.
Modelled, US dollars a year, declared assumptions not measurement; each scenario moves every input together, which obscures the input that most deserves scrutiny. Whitespace, the largest lane, lost its forward check.
One input moved across its own range, the rest held at base; the swing in US dollars a year. Partners live feeds all three lanes; a pilot measures the second.
Modelled, US dollars a year, declared assumptions not measurement; each scenario moves every input together, which obscures the input that most deserves scrutiny. Whitespace, the largest lane, lost its forward check.
Bound figures, read from the committed results file and checked by the numeral gate; nothing is computed at view time.
Months, modelled on the offers lane alone: size input assumed, mechanism measured on randomized data; a longer bar indicates a slower payback; the figures are the threshold to clear rather than an assumed budget, with the conservative scenario included.
Bound figures, read from the committed results file and checked by the numeral gate; nothing is computed at view time.
Modelled, base case, US dollars per partner a year; whitespace struck after losing its pre-registered forward check, corridors lose pooled to a seasonal naive; only offers carries a randomized measurement.
These figures are bound to the committed results file and checked by the numeral gate; nothing is computed at page-view time.
US$2.88Moffers lane · base case · mechanism measured, dollars assumed
03Why AmexApplicability at American ExpressGrowth, primary
The recipe is public, and only Amex holds both sides of the transaction
Visa, Stripe, Nubank and Revolut have run one backbone with many heads in production; each sees one side of a transaction. Amex's closed loop joins cardmember, network and merchant in one event stream.
Under Applicability, the data to run a proven recipe on both sides sits inside Amex's perimeter; Phase 1 needs only what the CoE holds. The advantage is argued, not measured.
Results that did not hold, reported here regardless
In 2025 and 2026 the payments industry reached a consensus on one question. One pretrained transaction backbone feeding many task heads beats per-task feature engineering, and the proof came with production numbers: Visa's TREASURE reports +111% on abnormal-behavior detection, Stripe reports card-testing detection moving from 59% to 97%, Nubank runs nuFormer in production for 100+ million customers, and Revolut's PRAGMA scaled the same idea to a billion parameters.
One row reads Yes, No, No: both sides joined in one event stream, and that row is about the proprietary markets.
Public positions by row, cited where a source exists; the marked row is argued, not measured: the pair-retention task came back null on synthetic data, both intervals spanning zero.
These figures are bound to the committed results file and checked by the numeral gate; nothing is computed at page-view time.
| Capability | Amex closed loop | Open-loop networks | Single banks and fintechs |
|---|---|---|---|
| Issuer-side view of the cardmember | Yes | Partial | Yes |
| Acquirer-side view of the merchant | Yes | Partial | Partial (acquiring banks hold it, one side only, never joined to an issuer view) |
| Both sides joined in one event stream | Yes | No | No |
| Premium cross-border cardmember base | Yes | Mixed | No |
| Partner-bank distribution across APAC (GNS)17 | Yes | Yes | No |
| Incrementality culture (a 2024 uplift contest run by this CoE)22 | Yes | Unpublished | Rare |
| Decision-science home under MAS in Singapore30 | Yes | Partial (data-science hubs in Singapore, without a closed-loop decision-science charter) | Some |
SAFR page 9 calls for agent-declared carts to be authenticated against their origin, the merchant side; a closed loop holds that side, and Amex is not a printed contributor.
04ArchitectureTechnical depth of the all-around system designProtection, demonstrated
One backbone with three heads, GenAI that explains but does not decide, and measured guards
One pretrained transaction backbone serves three growth heads and an always-on randomized measurement service; merchant-level wiring is the Phase 1 gate; GenAI explains on top of classical scores; data-rights guards are measured, not asserted.
Amex's red line is designed in: models score, GenAI explains, a measures, and the embeddings that leak stay inside the perimeter; the control plane is designed, not built.
Results that did not hold, reported here regardless
GenAI writes reason codes and partner narratives on top of classical scores; it never makes credit or approval decisions, Amex's own red line.
GenAI writes reason codes and partner-facing narratives on top of classical model scores. It never makes credit or approval decisions, which is Amex's own stated red line39, and it runs the way Amex already runs GenAI: a ConnectChain-style layer40 behind the AI firewall41, inside the GenAI Council's use-case funnel42.
10 venuesEmbeddings never leave Amex: a linear probe recovers amount decile at Matthews 0.9395 on synthetic TabFormer; whitespace cells carry at least 10 venues.
We have not checked, and cannot check, whether the GNS partner agreements as written permit any of it. A technical perimeter does not constitute contractual permission. Whether a partner's agreement covers training on Amex-owned inbound spend into their market, and scores flowing back, is a contracts question for Amex legal and the partnership owner, and Phase 1 should not open before they answer. A partner-facing product that has not asked is a demo, not a plan.
Two of five ACE services are still in development and intent-to-settlement traceability is unsolved; our forecasts and embeddings are a substrate and a roadmap hook rather than a demonstration.
Amex's ACE kit defines an intent-intelligence service with two of five services under development43, and Amex's engineering blog names intent-to-settlement traceability as unsolved44. The corridor forecasts and merchant embeddings here are a natural substrate for it. Agentic volumes are small today, so this is a roadmap hook rather than a demonstration claim.
A defensible number has no value if the system that produced it leaks or can be steered, so the privacy work below applies the 's method to the machinery itself: one frozen artifact, with guards turned on one at a time and the cost of each recorded beside it. The shape is the R-U confidentiality map of statistical disclosure control45, priced one rung at a time on the product metric a partner acts on. Where a guard cost something, the cost is here; where a check did not run, we say so. Nothing here measures American Express exposure: each result measures a mechanism on a public corpus.
Every control bounds the loss, none prevents it; four threats dropped with reasons; obligation rows are built or designed, none a compliance claim.
Interlude · Safety, measured
Protection theme. Privacy and safety priced one guard at a time, on the output a partner actually receives, with the failures printed beside the numbers.
A defensible number has no value if the system that produced it leaks or can be steered, so the privacy work below applies the 's method to the machinery itself: one frozen artifact, with guards turned on one at a time and the cost of each recorded beside it. The shape is the R-U confidentiality map of statistical disclosure control45, priced one rung at a time on the product metric a partner acts on. Where a guard cost something, the cost is here; where a check did not run, we say so. Nothing here measures American Express exposure: each result measures a mechanism on a public corpus.
0% churnEach guard is priced one rung at a time on the metric a partner acts on; at the shipped rung, top-twenty churn is 0.
Rows entering or leaving the top twenty relative to raw output, on a scale of zero to forty, where lower is better; the data are real public Foursquare venues on one frozen ranking, measuring a mechanism rather than exposure; the privacy unit is a venue.
Share of the raw top hundred still present after the guard; higher is better. Deeper in the ranking, suppression is no longer free. Noise spreads over seeds from 73.95 to 80.00.
Real public Foursquare venues, one frozen ranking; the figure measures the mechanism, not exposure. Suppression is free at the head but not deeper; bounding costs 10 churn, noise 7.70 more, seeds 12.95 to 23.05.
These figures are bound to the committed results file and checked by the numeral gate; nothing is computed at page-view time.
The free guard, with the mechanism that makes it free
The reason is a property of this scorer, not a general result, so it is printed with the number: the top twenty raw cells carry at least 113 contributing venues, so a threshold of 10 cannot reach them, and neither can 50. Density is one of the four scoring signals, so dense cells score high by construction. Deeper down it is not free: 338 of P0's 400 released rows are still in the released list at the shipped threshold, and 225 at the stricter one. The control makes that null informative rather than flattering: removing the same number of cells at random moves a mean churn of 22.20 and 33.70, against 0 for the rule.
The two guards the product lacks are the ones that cost. Bounding one venue to at most 20 recipients replaces 5 of the top twenty rows, a churn price of 10, paired, because both rungs score the same buckets. Noise on top adds 7.70 more. Turning suppression on changes which buckets are published, so that first step is unpaired: no interval exists for it and none is implied.
0.2724 of member accounts caught at the smallest measurable false-positive floor, 0.0024; interval 0.1576 to 0.5629. An attacker learns something, and the amount is measured.
Synthetic public TabFormer, account unit, share of member accounts caught at the false-positive floor 0.0024; model interval 0.1576 to 0.5629; the no-model attack scores higher, so the figure measures a confound rather than memorization.
These figures are bound to the committed results file and checked by the numeral gate; nothing is computed at page-view time.
At the account false-positive floor of 0.0024 the model arm recovers 0.2724 of member accounts, interval [0.1576, 0.5629], against 0.0019 for the counts-only control and 0.0026 for a random-label negative control. At the account operating point this attack DOES separate: the model arm recovers far more member accounts than the false positive rate it pays, while the counts-only control and the random negative control both sit at that floor, which is what tells you the pipeline is measuring something rather than nothing. What it separates is not established to be membership. By the membership rule itself a non-member account is an account that arrived after the corpus cut, so the two arms differ in tenure and in calendar position as well as in membership, and a no-model attack that uses only account size is reported beside the model for exactly that reason. Read this as a measurement of an attack against a confound, not as a measurement of what the model memorized, and not as evidence that no record is identifiable. A population average says nothing about the most exposed record: Aerni, Zhang and Tramer 2024 built a defence that fully leaks one training sample and still passes existing evaluations including TPR at low FPR, and measured their most vulnerable CIFAR-10 sample at 99.9 percent TPR at 0.1 percent FPR against a population figure of 4 percent. A population-average result says nothing about the most exposed record. This caveat belongs in the SAME paragraph as the number, never in a footnote.
The more informative result is the negative one. Counting an account's transactions needs no model, no checkpoint and no access to us, and at the same floor it recovers 0.9689 of member accounts against the model's 0.2724. The in account AUC is -0.0504, interval [-0.0617, -0.0395], a direction the file records as b_wins. A no-model attack winning means the model score buys an attacker nothing over the difference between the two account populations.
28 of 30 narratives pass unattacked, against 30 of 30 committed; two of seven attack classes beat the gate.
Static attacks, one attempt each, public-data bundles, measured; residual share, point shown, intervals in table; marked hole closed by replay, others unchanged; a zero is a null result and does not demonstrate a defence.
These figures are bound to the committed results file and checked by the numeral gate; nothing is computed at page-view time.
An adverse finding against the gate we ship
Layer one's allowed pool is built by collect_fact_numbers, which recurses the bundle and also harvests every numeral out of every fact string (faithcheck.py:42-43). A string written into a data field therefore enlarges the pool the defence checks against. No model is involved in this measurement. So a planted figure the matcher flags against a bundle's own facts is accepted once one attacker-written string sits in one field: 30 of 30 bundles, the median allowed pool growing from 14 numerals to 15. The flip is deterministic. A defence that checks a narrative against a document the attacker partly wrote does not have a trustworthy reference.
0 violationsDesigned and checked, not built: 8,294,400 mandate triples enumerated, 0 monotonicity violations, no model-derived read on the deterministic path.
, and not run
SAFE-B1, unicity on the pretraining corpus did not run: scripts/safety/unicity.py was never written, so no result exists. The consequence for the page, stated as a rule: the de Montjoye reference stays a citation and never becomes a comparison. No claim about how many spatiotemporal points single out an account in this corpus may appear anywhere, in either direction.
Inside the injection red team, a narrower list of probes did not run; the reasons are recorded in the results file: adaptive attack, meaning search or gradient guided payloads; injection into the merchant name field of a live partner bundle; a second served model as an independent auditor.
Every control bounds the loss, none prevents it; four threats dropped with reasons; obligation rows are built or designed, none a compliance claim.
05BackboneFeasibility to develop and implementProtection, demonstratedProductivity, supporting
Built end to end, with every loss printed in full
The backbone pretrained on 24 million synthetic rows, and the we ship is the one that survived every guard, 0.0218; the same protocol went negative on a real corpus.
Phase 1 can start inside the perimeter with a , because the recipe, the guards and the controls already run end to end at prototype scale on synthetic data.
What lost, and is printed anyway
One question organizes what follows: whether adding the model to the cheap control improves what a partner would actually run, rather than whether the model beats that control on its own. The rows are read that way; the model-alone results remain printed.
20.54MThe model has about 20.54M parameters and was pretrained for 8 epochs on 24 million synthetic public transactions; the loss curve shown is from the actual run.
A field-tokenized masked language model over transaction sequences, in the TabBERT lineage48, about 20.54M parameters, pretrained for 8 epochs on an A100 on the public IBM TabFormer benchmark (24 million synthetic transactions, labeled as such). The loss curve below is the actual run. This direction extends work Amex itself has published on sequence models for credit monitoring49.
A public blueprint of about 29M parameters uses the same corpus, so we are not the first to work on it; our contribution is the protocol rather than the architecture.
0.2570.235 to 0.257 next-category accuracy with embeddings, interval [0.0103, 0.0343] clear of zero, both tasks pre-registered; full-corpus fraud is a null on a saturated baseline.
400 of 2,000 accounts held out ; labels are excluded from the vocabulary, embeddings are computed as-of, identifiers are hashed, and four checks are asserted in the results file.
TabFormer · synthetic, labeled 20.54M params · 8 epochs · corpus cut 2017-08-25T09:37:00Z
| Task | Metric | Baseline | +Embeddings | Δ (95% CI) |
|---|---|---|---|---|
| Fraud (Protection head v0) | AUC | 0.99994 | 0.99961 | [-0.0012, 0.0001] |
| PR-AUC | 0.99389 | 0.99600 | [-0.0041, 0.0086] | |
| Next merchant category | Top-1 accuracy | 0.23493 | 0.25678 | [0.0103, 0.0343] |
| Top-5 accuracy | 0.53084 | 0.55260 | [0.0106, 0.0336] |
seed 7 · data labels: synthetic · generated by scripts/fm/transfer_eval.py --check-able · lightgbm 4.7.0 · numpy 2.5.2 · polars 1.43.2 · pyarrow 25.0.1 · python 3.12.3 · sklearn 1.9.0 · torch 2.13.0+cu130
0.02180.0590 under a permissive protocol, 0.0218 under ours, same frozen checkpoint: the difference is attributable entirely to the guards rather than to the model.
L0: temporal split only, same accounts on both sides, one pooled embedding that sees the scored row. This is the largest figure in the ladder; it is scored on different rows and is unpaired.
L1 holds out whole accounts. The lift does not merely decrease; it falls below zero. Our reading is that most of the L0 gain reflected account identity rather than transfer. This step changes three things at once.
L2 truncates the embedding before the scored transaction, and the transfer signal appears. It uses the same rows as L1, so the guard is priced directly: top-one accuracy moves 0.0399, clear of zero.
L3 is the shipped protocol behind every other number on this page. Top-one accuracy moves 0.0060, with an interval spanning zero; top-five accuracy changes by -0.0329. Fraud cannot discriminate between protocols because it is saturated at every rung.
Synthetic corpus, next-category top-one delta, rungs pre-registered, entity-level paired intervals, measured. L0 scores different rows and is unpaired; L1 sits below zero; the last guard costs top-five lift, -0.0329.
These figures are bound to the committed results file and checked by the numeral gate; nothing is computed at page-view time.
One of those steps is not a single switch, and a reader should have that before the numbers rather than after. The first step, L0 to L1, moves three things together in our own code, because they all hang off the same entity-disjoint flag. It replaces the row selection: L0 trains on the earlier part of the post-cut pool and tests on the later part, while L1 onward uses the shipped split, which holds out whole accounts. It therefore also changes what the test set is a sample of, from a later slice of time to a set of accounts drawn across the whole post-cut window, which is why L0 and L1 do not score the same rows or the same number of them. And it restricts the rows the category, city and state frequency encodings are fitted on, from every pre-cut row to the pre-cut rows of accounts that are not held out, so the baseline's own features tighten at that step as well. The other two steps each move exactly one thing, which is the other reason only they carry a on the change. We would rather name the compound step than let the phrase "one guard at a time" stand for all three.
This ladder is not an audit of any other team's work. It measures what our own pipeline reports when its evaluation guards are removed one step at a time, on a synthetic public corpus. We are not claiming that any particular published result used any particular rung, and we put no other team's numbers next to ours anywhere on this page. The use we do claim is narrower and more useful to a reviewer: when two transfer results disagree, the protocol is a measurable variable, and this is what measuring it looks like. The idea underneath is not ours. Constraining and measuring the rather than assuming it is what TESSERACT did for malware classifiers across time and distribution54, and a study of recommender offline evaluation found that a split ignoring the global timeline moves reported accuracy unpredictably55. What we add is a price rather than a warning: one frozen checkpoint, four rungs, and a paired interval on each step whose rungs score identical rows.
| Rung | Entity-disjoint split | As-of embeddings | Aggregate baseline | Baseline features |
|---|---|---|---|---|
| L0 permissive | off | off | off | 4 / 11 |
| L1 entity-disjoint split | on | off | off | 4 / 11 |
| L2 as-of embeddings | on | on | off | 4 / 11 |
| L3 aggregate-equipped baseline (shipped) | on | on | on | 10 / 18 |
| Rung | Next-MCC Δtop-1 (95% CI) | Next-MCC Δtop-5 (95% CI) | Fraud ΔAUC (95% CI) | Fraud ΔPR-AUC (95% CI) |
|---|---|---|---|---|
| L0 | 0.0590 [0.0547, 0.0634] | 0.1064 [0.1010, 0.1122] | -0.000017 [-0.000044, 0.000005] | -0.0002 [-0.0162, 0.0160] |
| L1 | -0.0240 [-0.0373, -0.0112] | 0.0000 [-0.0158, 0.0140] | -0.000789 [-0.002698, 0.000149] | 0.0052 [-0.0098, 0.0218] |
| L2 | 0.0159 [0.0077, 0.0246] | 0.0547 [0.0421, 0.0674] | -0.000006 [-0.000221, 0.000158] | 0.0076 [-0.0022, 0.0212] |
| L3 | 0.0218 [0.0103, 0.0343] | 0.0218 [0.0106, 0.0336] | -0.000335 [-0.001213, 0.000093] | 0.0021 [-0.0041, 0.0086] |
| Step and guard turned on | Next-MCC Δtop-1 change (95% CI) | Next-MCC Δtop-5 change (95% CI) | Fraud ΔAUC change (95% CI) | Fraud ΔPR-AUC change (95% CI) |
|---|---|---|---|---|
| L0 to L1 · entity-disjoint split by account | -0.0831 not paired | -0.1064 not paired | -0.0007720 not paired | 0.0054 not paired |
| L1 to L2 · as-of prefix-only embeddings | 0.0399 [0.0249, 0.0561] | 0.0547 [0.0385, 0.0742] | 0.0007821 [-0.0000067, 0.0025274] | 0.0024 [-0.0046, 0.0125] |
| L2 to L3 · baseline equipped with per-entity temporal aggregates | 0.0060 [-0.0020, 0.0152] | -0.0329 [-0.0436, -0.0219] | -0.0003282 [-0.0010353, -0.0000002] | -0.0055 [-0.0169, 0.0055] |
Merchant-side embedding: pre-cut pooled at every rung; only the account-side embedding varies, so L0 is a lower bound on how much a fully permissive protocol inflates, not an upper bound
seed 7 · data labels: synthetic · generated by scripts/fm/ladder_eval.py --check-able · lightgbm 4.7.0 · numpy 2.5.2 · polars 1.43.2 · pyarrow 25.0.1 · python 3.12.3 · sklearn 1.9.0 · torch 2.13.0+cu130
-0.0160 and -0.0147 household transfer on real retail data, both intervals below zero; store head positive both seeds, offers mixed. The result depends on the corpus.
Real retail basket lines, not card data; pre-registered, entity-clustered paired intervals, measured, predictive not causal. Three metrics share one zero line: transfer negative, store positive but wide, offers mixed.
These figures are bound to the committed results file and checked by the numeral gate; nothing is computed at page-view time.
0.32960.1282 to 0.3296 PR-AUC with the added to counting, interval clear of zero; on its own it loses on ROC-AUC. This analysis is post hoc and was not pre-registered.
The control with no model: how globally rare each field value is, fitted on pre-cut rows. Synthetic TabFormer, 945 fraud positives, entity-level intervals, measured, no labels in the score.
The backbone's surprise score is read off the frozen checkpoint without retraining and measures how unlikely each value is given the account's history. On its own it scores below counting on ROC-AUC and ties with counting on PR-AUC.
Both scores are standardized and added without weights; nothing is fitted and no labels are used. The top one percent holds 0.5989 of the fraud against 0.3228 for counting alone. This comparison is post hoc and was not pre-registered.
The same combination is repeated with the calendar fields and the error flag dropped, keeping the six fields that describe what the transaction did. The result is stronger, which indicates that the surprise signal comes from behaviour rather than from an unseen year token.
The control uses no model and scores how globally rare each field value is, fitted on pre-cut rows. The data are synthetic TabFormer with 945 fraud positives; the intervals are entity-level, the figures are measured, and no labels enter the score.
These figures are bound to the committed results file and checked by the numeral gate; nothing is computed at page-view time.
Synthetic corpus, card-fraud labels, paired on identical rows, entity-level intervals, measured; the combination is post hoc, not pre-registered. Alone the model is behind on ROC-AUC and not separated on PR-AUC.
These figures are bound to the committed results file and checked by the numeral gate; nothing is computed at page-view time.
The limitation is real and we state it here explicitly. No public dataset carries authorized-scam labels, so we validate on card-fraud labels. A ranking that separates card fraud is not thereby shown to separate scam-induced authorized payments, and this exhibit does not claim that it is. What it does establish is narrower and still useful: a frozen masked-field backbone yields a transaction-level ranking with no labels at all, the ranking can be measured with entity-level intervals, and it has to be measured against a counts-only control before the model can be credited with the improvement. Testing the same score against authorized-scam outcomes needs labels only a network holds, which is what the Section 8 pilot is for. The corpus here is the same synthetic one as the rest of this section, and it is marked as such.
The recipe runs end to end at prototype scale on synthetic data; production performance at Amex is not proven here.
0.9040.638 to 0.904 fraud PR-AUC at ten million rows, with the PR-AUC interval above zero and the AUC interval spanning zero; the next-category interval clears zero from ten million rows onward, and the merchant axis result is null.
Per-merchant embeddings projected to two dimensions, coloured by category group; this structure is what the whitespace head's similarity signal runs on.
A two-dimensional projection of the backbone's per-merchant embeddings, colored by merchant category group. Structure in this map is what the whitespace head's embedding-similarity signal runs on.
Misc Retail & DiningRetail GoodsBusiness & EntertainmentApparelUtilities & TelecomPersonal ServicesProfessional & MembershipTransportationCar RentalLodgingFinancial ServicesGovernmentContracted ServicesAirlines
seed 42 · data labels: synthetic · generated by scripts/scale/atlas_build.py --check-able · lightgbm 4.7.0 · numpy 2.5.2 · polars 1.43.2 · pyarrow 25.0.1 · python 3.12.3 · sklearn 1.9.0 · torch 2.13.0+cu130 · umap 0.5.12
838,8630.002829 PR-AUC, interval [-0.000422, 0.006311] spanning zero, on 838,863 pre-cut pairs: the merchant-native task is a null, with the question properly put.
What the null is worth is the question, not the answer. The two earlier merchant-axis nulls came from tasks that could not have shown a gain; this one could have. The baseline here scores 0.940356 ROC-AUC and 0.863579 PR-AUC against a test positive rate of 0.177578, which leaves real headroom, where the next-category baseline on the same axis already sits at 0.985 top-1. A null with the question properly put is a different and more useful thing than a null from a task that was never going to answer it.
06OffersTechnical depth of the all-around system designFeasibility to develop and implementGrowth, primary
The measurement layer, rather than the model, is the product
On 4,193,878 randomized advertising holdout rows, uplift ranking beats response ranking at the top decile on visit, interval above zero, and loses on conversion, the primary, at every depth.
This CoE ran the same metric as its 2024 contest; One Loop ships it as a standing per-partner, per-campaign lift report, interval attached, whichever way it lands.
What lost, and is printed anyway
Every campaign carries a by design; each partner gets an auditable incremental-lift report. This is the ghost-ads pattern, productized for partner banks.
The judges are familiar with this problem. The 2024 edition of this hackathon was an uplift contest scored on incremental activation across 12.6 million customer x merchant pairs. One Loop turns that contest's metric into a standing service.
Up to 6.8 percentage points more churn reduction from treatment-effect targeting than from response targeting aimed at the wrong customers, in Ascarza's randomized field experiments.
13,979,592 randomized Criteo rows: the winning ranking changes with the endpoint. Response ranking wins on conversion, the pre-registered primary; uplift ranking wins on visit at the top decile.
The data are from Criteo, a real randomized advertising holdout rather than payments data. Share of incremental outcome captured: point estimates, modelled rankings scored against randomized arms. Conversion is the pre-registered primary; uplift ranking loses it.
These figures are bound to the committed results file and checked by the numeral gate; nothing is computed at page-view time.
0.011049 paired difference over response ranking at the top decile on visit, interval entirely above zero, on 4,193,878 holdout rows; the advantage fades beyond the decile.
Incremental visit rate, treated minus control, among rows each ranking would target at this depth; the data are the randomized Criteo dataset, not payments data. The decile carries 5.9 times the average effect, point estimates only.
When the budget is widened to a fifth of the holdout, the two rankings converge; the paired difference at this depth, 0.001199, has an interval that spans zero.
At the top third the advantage has faded, difference 0.000454 with an interval spanning zero. A budget is spent at a particular depth, and the decile is the depth at which a partner would act.
Incremental visit rate, treated minus control, among rows each ranking would target at this depth; the data are the randomized Criteo dataset, not payments data. The decile carries 5.9 times the average effect, point estimates only.
These figures are bound to the committed results file and checked by the numeral gate; nothing is computed at page-view time.
Visit is the denser outcome. The figure shows the paired difference of uplift minus response with bootstrap intervals on the Criteo randomized advertising holdout, which is not a payments dataset. The difference clears zero at the top decile only; at the deeper cutoffs the two rankings are not separated.
Conversion is the pre-registered primary and the rare outcome. On the same holdout, arms and depths, every interval sits entirely below zero, so plain response ranking performs better on this one dataset.
Criteo, real randomized advertising holdout, not payments. Paired difference, uplift minus response, bootstrap intervals, measured. Visit clears zero only at the top decile; conversion, the pre-registered primary, stays below zero.
These figures are bound to the committed results file and checked by the numeral gate; nothing is computed at page-view time.
Dense outcome, uplift won here; rare outcome, response won. Nothing in the model says which regime you are in; the does.
28.4 percent of an in-sample response model's top-third budget lands where Hillstrom's randomized arms measure the least uplift. The dataset is retail e-commerce, so this demonstrates the mechanism rather than the size of the effect.
Hillstrom, real randomized email arms, not payments; mechanism, not size. Measured visit uplift, no model. 28.4 percent of an in-sample response model's top-third budget lands here; halves, 63.8 percent.
These figures are bound to the committed results file and checked by the numeral gate; nothing is computed at page-view time.
The response model therefore concentrates on the group the experiment says responds least, and measuring incrementality instead of response corrects it. That is one proxy on one retail corpus and the models behind the selection columns are in-sample, exactly as the segment table above is flagged, so this describes the mechanism rather than certifying an outcome. Phase 1 is required to deliver the real version: subgroup lift and selection rates on the partner's own protected attributes, pre-registered before the first campaign opens and reported whichever way they move.
Every lift report ships with a plain-language narrative written on top of the exhibit numbers. Facts go in from the committed results files, the text comes out of a self-hosted model, and a gate then decides whether that text is allowed to stand. The gate is the part we would defend in a review. The layer explains scores and reports. It never makes a decision.
Interlude · GenAI explanation layer
This section covers technical depth. The contribution is the gate rather than the prose that passes through it.
Every lift report ships with a plain-language narrative written on top of the exhibit numbers. Facts go in from the committed results files, the text comes out of a self-hosted model, and a gate then decides whether that text is allowed to stand. The gate is the part we would defend in a review. The layer explains scores and reports. It never makes a decision.
n = 30 narratives · strict 30 of 30 pass both layers · model Qwen/Qwen3-32B · self-hosted vLLM on NUS GPU
checker: numeric-claim extraction vs source JSON + LLM cross-check failures ship by rule
seed 42 · data labels: genai-explanation-layer facts-from-committed-results explains-never-decides · generated by scripts/narratives/generate.py (check: scripts/narratives/check.py --check) · python 3.11.15 · torch 2.11.0+cu130 · transformers 5.14.1 · vllm 0.26.0
Picked because the model loses to the seasonal-naive baseline on this corridor, and the generated text says so rather than talking around it.
whatcorridorregionholdout_monthsmase_modelmase_seasonal_naivemase_model_reconciledtop3_model_attributions[0].featuretop3_model_attributions[0].mean_abs_shap_log1p_unitstop3_model_attributions[1].featuretop3_model_attributions[1].mean_abs_shap_log1p_unitstop3_model_attributions[2].featuretop3_model_attributions[2].mean_abs_shap_log1p_unitsattribution_labelWe conducted a 13-month holdout backtest of Singapore inbound visitor arrivals from the Taiwan corridor, part of the Greater China region, using a model with a MASE of 1.137818, which underperformed the seasonal-naive baseline of 0.840431. The reconciled version of the model improved to a MASE of 1.016972. The top three model attributions were "lag1" (0.244893), "corridor_id" (0.132313), and "lag3" (0.12867), measured in mean absolute SHAP values on log1p-arrivals units. These attributions reflect associations learned by the model, not causal drivers.
holdout_monthsmase_modelmase_seasonal_naivemase_model_reconciledwhattop3_model_attributions[0].mean_abs_shap_log1p_unitstop3_model_attributions[1].mean_abs_shap_log1p_unitstop3_model_attributions[2].featuretop3_model_attributions[2].mean_abs_shap_log1p_unitswhatLayer one: every numeral in this text is carried by a fact above. Every numeral the extractor finds is marked, including a digit sitting inside a name, because this layer matches numerals and does not read sentences. The match is also percent-aware, so a fact and the same quantity printed as a percentage both count as support, which widens what layer one accepts. The field named beside each numeral is the closest supporting fact, not the first one found.
Layer two: the cross-examination reported no claim the facts do not carry.
This example is included deliberately. Layer one passes this text, although a careful reader should not: the count of places inside the bucket is read out as a count of buckets. The gate checks the numerals and does not check the nouns to which those numerals attach.
whatbucket_labelareacategoryrank_real_signalsn_poisscore_real_signalsreasons[0]reasons[1]reasons[2]sensitivity[0].leakage_strengthsensitivity[0].ranksensitivity[1].leakage_strengthsensitivity[1].ranksensitivity[2].leakage_strengthsensitivity[2].rankThe Personal Services cluster — Clarke Quay area is ranked 28th out of 151 pseudonymized merchant-signing whitespace buckets in Singapore, with a score of 0.785897 based on real public signals. Key contributing factors include its proximity to a premium-demand corridor (within 0.4 km of Clarke Quay, with a zone score of 0.79), a mix of MDR-sensitive categories (Personal Services, with card MDRs at 1.5-3% versus 0.3% for QRIS anchors), and a dense commercial environment (median of 493 POIs within 250 m). Sensitivity analysis shows that if a simulated demand-weighted acceptance-gap signal were added, the bucket’s rank would shift to 29 at 0.1 strength, 24 at 0.25 strength, and 23 at 0.5 strength.
rank_real_signalsn_poisscore_real_signalsreasons[0]reasons[0]reasons[1]reasons[1]reasons[1]reasons[2]reasons[2]sensitivity[0].ranksensitivity[0].leakage_strengthsensitivity[1].ranksensitivity[1].leakage_strengthsensitivity[2].ranksensitivity[2].leakage_strengthLayer one: every numeral in this text is carried by a fact above. Every numeral the extractor finds is marked, including a digit sitting inside a name, because this layer matches numerals and does not read sentences. The match is also percent-aware, so a fact and the same quantity printed as a percentage both count as support, which widens what layer one accepts. The field named beside each numeral is the closest supporting fact, not the first one found.
Layer two: the cross-examination reported no claim the facts do not carry.
This panel presents one Hillstrom segment in the form a partner would see it in a lift report.
whatsegmentn_treatedn_controlresponse_rankuplift_rankmeasured_uplift_rankmeasured_visit_uplift_ppmeasured_visit_uplift_se_ppverdictverdict_ruleThe customer segment "3) $200 - $350 x recency 10-12m" includes 815 treated and 788 control customers from the Hillstrom e-mail experiment. This segment ranks 23rd in response rank and 18th in both uplift rank and measured uplift rank. The measured visit uplift per person is 3.9581 with a standard error of 1.6262, and the verdict is "aligned," indicating that the response model and measured uplift are consistent.
segmentsegmentsegmentsegmentsegmentn_treatedn_controlresponse_rankuplift_rankmeasured_visit_uplift_ppmeasured_visit_uplift_se_ppLayer one: every numeral in this text is carried by a fact above. Every numeral the extractor finds is marked, including a digit sitting inside a name, because this layer matches numerals and does not read sentences. The match is also percent-aware, so a fact and the same quantity printed as a percentage both count as support, which widens what layer one accepts. The field named beside each numeral is the closest supporting fact, not the first one found.
Layer two: the cross-examination reported no claim the facts do not carry.
07Signing and corridorsAlignment to the three themesGrowth, primary
Density beat our composite; no claim is made for the blend on either view
On the forward check venue density beat ; the corridor model loses pooled and wins five of twelve corridors; the equal-weight blend wins on only, 6 of 12, no interval claimed.
Both heads map to the Growth theme, and each has a measured bar to beat in Phase 1: density for signings and the seasonal naive for corridors. Only the signing head reads the backbone today, at category level.
What lost, and is printed anyway
0.5477Ranked by real signals over 364,635 places; on the pre-registered forward check density scored 0.6869 against the composite's 0.5477, the Phase 1 bar.
Real Foursquare records, pre-registered, observational, measured Spearman on venue formation over 24 months, not signings; higher is better. Density is the bar to beat; the composite's gap interval sits entirely below zero.
Bound figures, read from the committed results file and checked by the numeral gate; nothing is computed in the browser.
We state here what the check does not settle. The composite is built to rank signing yield and signing yield is not what was scored here, so nothing above shows that the composite would beat density on signings, and nothing shows that it would not: the question is open, it is the Phase 1 gate in Section 8, and density is the bar the composite has to clear there. Two limits on the outcome: date_created is the day a record entered Foursquare rather than the day a venue opened, and the slice keeps only venues still open at the snapshot, so the predictors are computed on survivors. The backbone wire is not an arm here either: the embedding-similarity column is a per-category constant entering neither the tested composite nor the shipped ranking order, so nothing about the backbone was tested and lost. The shipped ranking is unchanged, because this is a forward check of the frozen ranking and not a re-rank. For a partner, the relevant feature is the loop itself: this is the same forward validation the Phase 1 pilot runs inside Amex, with signings as the outcome instead of venue formation.
0.623Model loses pooled, MASE 0.623 against 0.53; the pre-registered equal-weight blend wins on macro-MASE only, 6 of 12 corridors, a point comparison, no interval.
Scaled error, MASE, averaged over twelve corridors, 13 held-out months, lower is better; model loses pooled, wins five of twelve; the pre-registered equal-weight blend beats the naive on this average.
Absolute error in arrivals summed over the corridors across the holdout, every arrival weighted equally, lower is better; the blend costs 968.83 more and wins 6 of 12 corridors.
MASE on the total series. Reconciliation makes corridor, country and region totals agree by construction and pools variance; it provides coherence rather than an accuracy headline, and the naive remains ahead.
Scaled error, MASE, averaged over twelve corridors, 13 held-out months, lower is better; model loses pooled, wins five of twelve; the pre-registered equal-weight blend beats the naive on this average.
These figures are bound to the committed results file and checked by the numeral gate; nothing is computed at page-view time.
Modelled holdout attributions on real public arrivals, point shares of the total, no interval printed, shown as they came out. Customer segments and category shifts are absent from public data.
These figures are bound to the committed results file and checked by the numeral gate; nothing is computed at page-view time.
The corridor head forecasts monthly inbound demand by origin market, demonstrated on Singapore visitor arrivals as the stated public proxy for cross-border spend corridors.
08Implementation PlanFeasibility to develop and implementApplicability at American ExpressGrowth firstProtection demonstratedProductivity supported
Six months, one pilot, a gate we might fail
Phase 1: six months inside the SG CoE on data it already holds, no data moves, and it stops unless embeddings beat production features on at least two of three heads offline, paired intervals.
The ask is six months of CoE time, not priced here: no Amex data leaves the perimeter, and a failed gate still leaves the behind.
Counts across this page's pre-registered comparisons, each with a measured interval, synthetic and real corpora alike, printed at the same size as the wins, so that a reader can compare their own number against them.
These figures are bound to the committed results file and checked by the numeral gate; nothing is computed at page-view time.
What lost, and is printed anyway
The first business action. Phase 1 below: six months inside the SG Decision Science CoE on data it already holds, which is what turns the offers lane in Section 2 from a modeled number into a measured one. The brief asks for the business actions that execute the idea, and this is the first of them.
Independent holdout assignment. The pilot's holdout assignment is co-signed by the partner before a campaign opens, so the party being paid is never the party deciding who went untreated.
The plan has three phases: six months inside the SG CoE, one partner pilot with Malaysia as the illustrative case, and APAC scale-out, each behind a .
| Phase | Timeline | Owner | Business actions | Gate to pass |
|---|---|---|---|---|
| 1. Internal pilot | Months 0 to 6 | SG Decision Science CoE30 | Hand model risk the leakage rules and pre-registrations, then run the in-perimeter build (pretrain on proprietary-market and Amex-owned inbound data, rebuild the transfer table under the same rules) and take the go or no-go at month six against the printed gate | Embeddings beat production per-task features on at least 2 of 3 heads, offline, with paired CIs |
| 2. One-market partner pilot | Months 6 to 12 | GMNS APAC (partner), ICS (issuing side) | Run a test-and-learn with one GNS partner; Maybank is the illustrative case, a live Amex network partnership in Malaysia18; ship ranked signing lists and two measured offer campaigns | Measured incremental billed business above zero at 95% confidence; signing-list conversion above the current prioritization; partner signs for a second cycle |
| 3. APAC scale-out | Year 2 onward | GMNS APAC with SG CoE as model owner | Extend to additional GNS markets under the market-by-market license model17; stand up the corridor product for partner budget planning | Positive unit economics per market; lift reports adopted in partner planning cycles |
Monetization hypothesis: rev-share on measured , so the pricing model and the lift measurement are the same artifact.
8.3 GPU-hours and 131 core-hours measured, US$27.56 at public rates, cash US$0, 18 of 46 failed jobs counted; US$2.42 to refresh one million merchants.
Gen X fraud, Orchestra, the CoE uplift contest and sequence research are the existing record; One Loop applies the same capabilities to growth, in a partner-facing form, with lift reports.
The synthetic backbone, the negative household on a real retail corpus, the merchant-axis null, the corridor losing to the naive, and density beating are all reported on this page.
63.0%Package the , which priced 63.0 percent of our own headline as protocol, build the pilot kit, and pre-register the pilot evaluation.