What the person meant
Pay a known merchant or send money to the person they trust.
PRIVACY-SAFE ADVERSARIAL LAB / INDIA
The story can lie.
The payment path can't.
MAYA creates controlled payment worlds where a bounded attacker searches for detector blind spots—then turns every valid miss into a stronger test for the defense.
MAYA lives in the gap between appearance and reality.
RED × BLUE / VERIFIED REPLAY
Let the attack
find the gap.
Red probes a frozen defense. Blue intercepts what it recognizes. Switch to the hardened policy to replay the same failure after it becomes training data.
VERIFIED RUN REPLAYRED SEARCH × BLUE DEFENSE
BASELINE6/36 scenarios caught
RED BUDGET96 queries
Allowed probes become hardening data.
Animated particles illustrate the run; the counters come from the pinned artifact. This reproduced search evaluates 96 candidates—it does not claim millions were executed.
THE MAYA PRINCIPLE / CONTINUITY OVER STORIES
Fraud hides between
the payment steps.
A payment can be authenticated and still be deceptive. MAYA asks whether three independently observable facts continue to agree.
What was authorized
The beneficiary, endpoint, amount, device, and timing presented at approval.
Where the value moved
How the receiving identity holds, spends, or fans out the money afterward.
ORDINARY PAYMENTCONTINUOUS
PERSON SEESGupta Medical Store
PAYMENT RESOLVES TOGupta Medical Store
VALUE SETTLES WITHRegistered merchant account
The intent, instruction, and receiving identity tell the same story.
SUBSTITUTED QRBREAK FOUND
PERSON SEESGupta Medical Store
PAYMENT RESOLVES TOPersonal payment alias
VALUE SETTLES WITHUnregistered beneficiary
The transaction looks normal in isolation. Its identity continuity does not.
INTERACTIVE CASE FILE / APP → MULE FAN-OUT
Watch a detector
meet its counterexample.
Select each phase. The payment world, attacker budget, policy, and evaluation split stay fixed; only the tested strategy and hardened decision change.
TEST SCOPECONTROLLED / SYNTHETIC ONLY
RUN IDfg-547def951da7-20260820
ROOT SEED20260820
GENERATORv0.1.0
A
CASE / APP-01ADVERSARIAL LOOP
ROUND 01 · FROZEN BASELINE
Direct APP-to-mule fan-out
BLOCKED
1
Fresh beneficiaryRelationship created just before payment
5 min
2
New-device signalPayment context departs from account history
NEW
3
Single high-risk transfer₹7,000 in one authorization
1 split
4
Immediate mule fan-outValue routed to 2 downstream accounts
2 exits
WHAT CHANGED
The obvious strategy is stopped. That result becomes the red search’s starting point, not the project’s conclusion.
THE HARDENING RESULT / HELD-OUT POPULATION
A failure became
a better test.
The useful outcome is not a perfect score. MAYA recovered the selected evasion—and measured the added friction instead of hiding it.
PROVISIONAL SYNTHETIC RESULTn=1,220 events216 fraud-labeled · 36 attack scenarios · one held-out seed
| Measure | Baseline | Hardened | Change |
|---|---|---|---|
| Scenario detection | 16.7% | 100.0% | +83.3 pp |
| Fraud-event recall | 36.1% | 100.0% | +63.9 pp |
| Value-weighted recall | 48.8% | 100.0% | +51.2 pp |
| False-positive rate | 0.10% | 1.10% | +1.00 pp |
| Legitimate value held | ₹514.93 | ₹6,008.63 | +₹5,493.70 |
Controlled, deterministic evaluation with an evidence-linked mechanism. This one-family mechanism test establishes laboratory behavior—not production prevalence, calibration, or bank-scale performance.
SHARED DECISION PATH / TWO DECEPTIONS
Different tricks.
One continuity check.
APP fan-out and merchant-QR substitution compile, execute, and reach the same payer-side authorization boundary through one feature contract.
ATTACK SCENARIOS CAUGHT24 / 24at least one event per scenario
CONTROLS INTERRUPTED0 / 24paired legitimate scenarios
FRAUD-EVENT RECALL75.0%36 of 48 fraud requests
HELD-OUT REQUESTS9648 fraud · 48 legitimate
CONTROLLED MECHANISM TEST63 encoded causal fieldsartifact 2e4e1c7cdcc3…
| Mechanism | Rule recall | Shared recall | Scenarios caught | Controls held |
|---|---|---|---|---|
| APP → mule fan-out | 0.0% | 66.7% | 12 / 12 | 0 / 12 |
| Merchant QR substitution | 100.0% | 100.0% | 12 / 12 | 0 / 12 |
Zero false positives means 0 of 48 legitimate requests in this controlled population. It is evidence for the paired mechanism test, not a low-FPR production claim.
REMOVE THE IDEA / MEASURE WHAT BREAKS
Does continuity
actually matter?
We restricted MAYA to request-local fields, kept the same split, and reran the detector. Then we restored history and endpoint continuity.
TRANSACTION FIELDS ONLY50.0%event recall · 17 encoded fields12 / 24 scenarios caught
+25 pp
+ HISTORY & ENDPOINT CONTINUITY75.0%event recall · 63 encoded fields24 / 24 scenarios caught
QR SUBSTITUTION Transaction-only recall 0.0% → continuity-aware 100.0%.
ATTACK ATLAS / RESEARCH BEFORE SIMULATION
Start with what is
actually happening.
Every simulated mechanism begins as a documented fraud pattern. Hypotheses about an AI-enabled extension remain explicitly separated from direct evidence.
40researched vectors
53unique source links
9AI-explicit evidence
31bounded extensions
Impersonation & coercion
10 documented vectors
UPI & merchant deception
9 documented vectors
Device & account compromise
8 documented vectors
Mules & laundering
7 documented vectors
Identity, onboarding & AePS
6 documented vectors
Atlas snapshot 2026-08-20. “AI extension” means the fraud pattern is documented while the GenAI role remains a bounded research hypothesis.
UNDER THE LAB / ONE CLOSED LOOP
From incident evidence
to a testable defense.
Attack atlas
Research-backed payment deception patterns
Scenario contracts
Typed actions, constraints, and private truth
Payment world
A stateful ledger with valid money movement
Red search
Bounded counterexample search with coarse feedback
Blue decision
Causal features scored before authorization
Evidence lab
Disjoint tests, paired controls, honest trade-offs
BUILT BY / SOLO SUBMISSION
Siddhant Gupta
Design, research, simulation, defense engineering, and the very necessary coffee.