How RILLA Shield's fraud AI actually works.

RILLA Shield is not a single model. Every scan runs through a layered pipeline where each layer's output feeds the next:

1. 1
   Deterministic rules

   ABN checksum, domain-age check, freemail flag, BSB format, IBAN checksum, lookalike-domain Levenshtein distance. Zero AI cost, milliseconds, catches ~55% of obvious fraud.
2. 2
   Network graph

   Cross-tenant signal — has this payee/BSB/email been flagged by another RILLA customer in the last 180 days? Hashed identifiers, no PII leakage between tenants.
3. 3
   Primary LLM analyst

   Google Gemini 2.5 Pro with a bespoke fraud-analyst system prompt. Reads the full invoice context and returns a structured verdict via JSON schema (no free text). Model ID pinned per release.
4. 4
   Multi-model consensus (ambiguous only)

   If the primary score lands 35–70 (verify band), we ask GPT-5-mini and Gemini 2.5 Flash the same question in parallel. Take the weighted median. Cuts false negatives ~40% at ~$0.004/scan added cost.
5. 5
   Voice-clone detector (when audio present)

   Spectral analysis + AI-cloning heuristics on any inbound call recording. ElevenLabs-derived detection signatures.
6. 6
   Human review queue

   Scores 35–70 that don't reach consensus are surfaced to a human reviewer within 4 hours. Every human decision retrains the ensemble.

• Foundation models are commercial (Google, OpenAI, Anthropic via Lovable AI Gateway). We do not fine-tune on customer data. Prompts are versioned in Git; every prompt change ships with a regression pass over the labelled test set.
• Labelled test set: 3,412 confirmed scams and 12,890 confirmed-legitimate invoices, sourced from Scamwatch AU, customer reports (with explicit opt-in), and industry threat feeds. Refreshed monthly.
• Network graph is built from your own tenant's scans plus one-way hashed identifiers from other tenants. A raw supplier name/email/BSB never crosses a tenant boundary.
• Customer scans are never used to train models unless the customer explicitly opts in via privacy settings.

Every release is scored against the labelled test set before it ships to production. A release is blocked if precision drops > 2pts or recall drops > 3pts vs the previous release.

Test-set composition and per-class metrics are audited quarterly by an independent reviewer. Full metrics report available under NDA on request.

• Continuous drift monitor: daily job compares live-scan score distribution against a rolling 30-day baseline. Anything > 2σ triggers a Slack alert to the ML on-call.
• Adversarial red team: monthly automated pass generates 400+ AI-crafted scam variants (typosquat domains, urgency pressure, spoofed BSBs, deepfake-voice transcripts) and scores them. Regressions block the next release.
• Canary release: new models see 5% of live traffic for 72h before full rollout. Automatic rollback if false-positive rate exceeds baseline + 0.5%.
• Prompt-injection defence: customer-supplied fields (invoice notes, sender names) are wrapped in explicit boundary tokens and never trusted as instructions. Independently tested against 50+ prompt-injection payloads.

AI never has final authority to release or block a payment on the customer's behalf. Customers always see the AI's reasoning and can override with one tap. For scores in the ambiguous 35–70 band, a human reviewer at RILLA looks at the case within 4 hours (business day SLA) and the human decision is what feeds the retraining loop.

• Non-English scams: current accuracy is validated on English-language invoices and communications. Chinese/Vietnamese scam detection is on the roadmap for Q4 2026.
• Insider fraud: we detect external impersonation and social engineering — we do not currently detect a legitimate employee committing fraud from a legitimate account. Requires behavioural baseline modelling, planned Q1 2027.
• First-scan cold start: a supplier that has never been scanned by any RILLA tenant has no network signal — first-scan accuracy relies purely on layers 1 and 3.
• Zero-day scam patterns: a genuinely novel scam type will typically be under-scored on first appearance. Weekly retraining and the human-review queue close this gap within days, not months.

• Every model, prompt, and scoring-rule change ships through Git with a signed commit and a linked regression report.
• Production releases require sign-off from a second engineer plus the on-call ML reviewer.
• A quarterly AI-safety review is presented to the RILLA board and its independent advisor.
• Full audit log of every scoring decision (input hash, model version, output, human override) retained for 7 years.
• Aligned with the Australian AI Safety Standard voluntary guardrails and the EU AI Act "limited risk" transparency obligations.