What machine learning is: rules learned from examples

This is the first post in a series that explains machine learning in plain words, with examples from payments and finance, and small code you can run.

Start with the basic question.

The old way: write the rules yourself

Imagine you work on a card fraud team. Your job is to stop fraudulent payments.

The traditional way is to write rules. You look at past fraud, notice that stolen cards are often used for big purchases, and write:

If the amount is over $1,000, flag it as fraud.

It works, for a while. Then fraudsters change their behaviour, you write more rules, and a few years later you have thousands of them. Nobody remembers why half of them exist.

The machine learning way: show examples, let it find the rules

Machine learning flips this around. Instead of writing the rules, you give the computer a large set of past transactions where you already know the answer, fraud or not fraud. The computer looks for the patterns that separate the two, and writes the rules for you.

In the old way, a person writes the rules. In machine learning, the data plus the known answers produce the rules.

A small example

I made up 4,120 card transactions. Each one has two facts: the amount and the hour of day. Most are normal daytime purchases. Some are fraud, and the fraud comes in two shapes:

• Big purchases, at any hour.
• Tiny charges at night, a few dollars each. Fraudsters often do this to test whether a stolen card works before they use it for something bigger.

I tested the hand-written rule (“over $1,000 is fraud”) and a simple machine learning model on the same set of transactions:

The hand-written rule caught every big fraud and missed every small night-time one. Nobody told the model about card testing. It found that pattern in the data on its own.

The rules it learned are readable, which I did not expect:

If the amount is over $1,257, it’s fraud. Otherwise, if it’s before 5:24 am and the amount is under $29, it’s fraud. Everything else is normal.

That’s very close to what an experienced fraud analyst would write after studying the data for a week. The computer did it in under a second.

The code is short. This uses scikit-learn, the most common Python library for machine learning. Four names do all the work:

X is a capital letter because it is a table (many columns); y is lower case because it is one column. That is only a naming habit, but nearly every machine learning example follows it.

Here it is with fourteen made-up past transactions typed in by hand. Install the library with pip install scikit-learn, paste this into a file, and run it:

from sklearn.tree import DecisionTreeClassifier, export_text

# Training data: past transactions where we already know the answer.
# Each row of X_train is one transaction: [amount in $, hour of day (0-24)]
X_train = [
    [45, 14], [120, 10], [60, 18], [30, 12], [80, 16],   # normal daytime purchases
    [3, 13], [5, 15], [2, 11],                           # normal small purchases (a coffee)
    [35, 1], [70, 4],                                    # normal night purchases (a taxi)
    [2500, 15], [4000, 3], [1800, 22],                   # fraud: big purchases, any hour
    [2, 2], [4, 1], [1, 4],                              # fraud: tiny charges at night
]
# y_train holds the answers, one per row of X_train: 1 = fraud, 0 = normal
y_train = [0, 0, 0, 0, 0,
           0, 0, 0,
           0, 0,
           1, 1, 1,
           1, 1, 1]

model = DecisionTreeClassifier(max_depth=3, random_state=0)
model.fit(X_train, y_train)               # learn the rules from past examples

# Test data: new transactions the model has never seen
X_test = [[3, 3], [55, 13], [3000, 12]]
print(model.predict(X_test))              # one answer per row of X_test
print(export_text(model, feature_names=["amount", "hour"]))   # the rules it learned

It prints [1 0 1]: the night-time $3 charge and the $3,000 purchase are fraud, the $55 lunch is normal. The printed rules have the same shape as the ones above, learned from only fourteen rows.

import numpy as np
from sklearn.model_selection import train_test_split
from sklearn.tree import DecisionTreeClassifier, export_text

rng = np.random.default_rng(7)   # random numbers, same every run

# 1. Make up 4,120 transactions: columns are [amount in $, hour of day]
normal = np.column_stack([rng.lognormal(4.0, 0.9, 4000),            # amounts around $55
                          rng.normal(15, 3.5, 4000).clip(0, 23.9)])  # mostly daytime
big    = np.column_stack([rng.uniform(1500, 5000, 60), rng.uniform(0, 23.9, 60)])
tiny   = np.column_stack([rng.uniform(0.5, 5, 60), rng.uniform(0, 5, 60)])  # small, at night
X = np.vstack([normal, big, tiny])            # all rows stacked: 4,120 x 2
y = np.r_[np.zeros(4000), np.ones(120)]       # answers: 0 = normal, 1 = fraud

# 2. Hold back 30% as test data the model never sees while learning
X_train, X_test, y_train, y_test = train_test_split(
    X, y, test_size=0.3, random_state=0, stratify=y)   # stratify: same fraud share in both

# 3. The hand-written rule: anything over $1,000 is fraud
rule = (X_test[:, 0] > 1000).astype(int)      # X_test[:, 0] = the amount column

# 4. Learn rules from the training data instead
model = DecisionTreeClassifier(max_depth=3, random_state=0)
model.fit(X_train, y_train)
learned = model.predict(X_test)

# 5. Score both on the test data, against the true answers in y_test
for name, pred in [("hand rule", rule), ("learned", learned)]:
    caught = ((pred == 1) & (y_test == 1)).sum()
    false_alarms = ((pred == 1) & (y_test == 0)).sum()
    print(f"{name:10} caught {caught} of {int(y_test.sum())} frauds, {false_alarms} false alarms")

print(export_text(model, feature_names=["amount", "hour"], decimals=1))

My data is made up and clean, so the model looks perfect. Real fraud is much harder. Fraud is a tiny fraction of all payments, the patterns overlap with normal behaviour, and fraudsters keep changing what they do.

The words you’ll keep hearing

A one-line definition

Tom Mitchell’s classic textbook defines it like this, in my own words:

A program learns when it gets better at a task, measured in some way, as it sees more experience.

For our fraud team: the task is flagging fraud, the measure is how many frauds we catch, and the experience is the history of past transactions with known answers. More history, better rules.

Three kinds of machine learning

The kinds differ in one thing: what you can give the computer to learn from.

Supervised is what the fraud example did: past transactions came with the answer (fraud or not), and the model learned a rule that turns the facts into that answer. It is the most useful kind when answers exist, and its catch is that someone has to supply them, which is often slow and expensive. When the answer is a number (a loan’s loss, next month’s volatility) it is called regression; when it is a category (fraud or not) it is classification. The regression vs classification post is about that split.

Unsupervised also learns from examples, but each one has only the features: the same transactions without the fraud column. It cannot learn “fraud”, because it was never told what fraud is, but it can learn what normal spending looks like and flag whatever does not fit. That makes it useful for the fraud nobody has seen yet, which a supervised model, trained only on past fraud, misses. Its catch is that nothing tells you whether its groups are right: a person has to look at them and decide what they mean.

Reinforcement learns by acting: it tries an action, sees the reward, and adjusts, like a person learning a game by playing it. A trading program buys or sells and is rewarded by its profit. It is not told which action was right, only how well things went. Its catch is that the reward often comes late and covers many actions at once: when a month of trading ends in a profit, it is not clear which of the many trades earned it.

One trap: supervised classification and unsupervised grouping both end with things sorted into groups. Classification learns groups you named in advance (fraud, not fraud) from examples that carry the answer; unsupervised grouping, called clustering, invents its own groups from examples that do not, and a person decides afterwards what each one means. The three kinds are the main ones, not the only ones: there are mixes, such as learning from data where only some examples have answers.

This series is mostly about the first kind, supervised learning. It’s the one you’ll meet most in payments and banking.

Signal plus noise, and two kinds of learner

Every label is a learnable pattern plus luck nobody can predict:

The model learns $f$. The noise is the part no model can learn, however good: a fraud that looks exactly like a normal purchase, a market move caused by news that had not happened when the features were measured. In finance $f$ is small and the noise is large, which is why good models there still look weak by the standards of other fields, and why a model that looks too good is the first thing to check.

A “good” model is more than an accurate one. It is accurate and stable when the data shifts a little, and fast enough to answer in time, and explainable when someone asks why, judged against the real goal rather than the score alone.

Two words that come up in every model discussion:

And two meanings of one word. Training is fitting the model on history, which happens offline and can be slow. Inference, in the engineering sense, is using it on a new case, which happens live and has to be fast. (In statistics “inference” means something else: understanding how each feature affects the answer, as opposed to predicting it. A model can be good for prediction and useless for that kind of inference, or the reverse.)

What machine learning can’t do

• It only knows the past. If a new kind of fraud has never appeared in the data, the model has never seen it.
• The world changes. Fraudsters adapt to whatever you block. A model that worked last year needs new data and retraining this year. It’s a game against people who are watching your rules.
• Bad data in, bad rules out. If past transactions were labelled wrongly, the model learns the wrong lesson, very confidently.

People also tend to trust an answer more when a computer gives it. The answer is only as good as the examples behind it.

References

• Tom M. Mitchell, Machine Learning (McGraw-Hill, 1997), chapter 1, section 1.1: the definition (task, performance measure, experience)
• Kevin P. Murphy, Probabilistic Machine Learning: An Introduction (MIT Press, 2022), chapter 1: supervised (1.2), unsupervised (1.3, including clustering and why it is hard to evaluate) and reinforcement learning (1.4)
• Kevin P. Murphy, Probabilistic Machine Learning: Advanced Topics (MIT Press, 2023), section 19.3.2: anomaly detection, including the unsupervised method (fit what normal data looks like, flag what does not fit)
• James, Witten, Hastie, Tibshirani and Taylor, An Introduction to Statistical Learning, with Applications in Python (Springer, 2023), section 2.1.4: supervised versus unsupervised learning, clustering, and semi-supervised learning
• Richard S. Sutton and Andrew G. Barto, Reinforcement Learning: An Introduction (MIT Press, 2nd edition, 2018), section 1.1: how reinforcement learning differs from supervised and unsupervised learning
• Mike Chen and Weili Zhou, “On Machine Learning Applications in Investments”, in Handbook of Artificial Intelligence and Big Data Applications in Investments (CFA Institute Research Foundation, 2023), chapter 1
• scikit-learn: decision trees