Adaptive KDE for Real-Time Thresholding: Prioritized Queues for Financial Crime Investigation

TL;DR

This work addresses real-time routing of streaming risk scores into limited-review queues under explicit capacity constraints by introducing density-anchored thresholding via an online adaptive KDE with boundary reflection and valley snapping. Thresholds are set on the estimated density and snapped to persistent density valleys, yielding capacity-true cuts and stable, multi-queue routing even as the score distribution drifts; the method operates in $O\left(G\right)$ per event with constant memory per activity and supports sliding-window or exponential forgetting updates. Key contributions include a formalization of density-anchored, capacity-matched thresholding for single and multi-queue routing, an online KDE with boundary corrections suitable for streaming, a persistence-based valley detector that stabilizes cuts without labels, and an evaluation on synthetic, drifting, multimodal streams showing competitive capacity tracking with reduced threshold jitter and controlled backlog. The approach is generic to any scored detector with limited investigative capacity, offering operational stability, explainable threshold placement, and audit-friendly thresholds suitable for real-time risk operations. $$U_t(c)=\int_{c}^{1} f_t(x)\,dx$$ and $$t^*=U_t^{-1}(\kappa_t)$$ illustrate how capacity constraints translate into density-based cuts that are then anchored to valleys for robustness.

Abstract

We study the problem of converting a stream of risk scores into one or more review queues under explicit intake constraints[cite: 6]. Instead of top-$K$ or manually tuned cutoffs, we fit an online adaptive kernel density to the score stream, transform the density into a tail-mass curve to meet capacity, and ``snap'' the resulting cut to a persistent density valley detected across bandwidths[cite: 7]. The procedure is label-free, supports multi-queue routing, and operates in real time with sliding windows or exponential forgetting[cite: 8]. On synthetic, drifting, multimodal streams, the method achieves competitive capacity adherence while reducing threshold jitter[cite: 9]. Updates cost $O(G)$ per event with constant memory per activity

Figures (10)

• Figure 1: Visual Depiction of Method
• Figure 2: The illustration shows a single panel with histogram(density), fixed-bandwith Epanechnikov KDE with boundary reflection, and Adaptative of KDE(Abrahamson)
• Figure 3: Figure 3a: Bandwidth profile $h(x)$. The estimator tightens in dense regions and widens in sparse tails, preserving real structure while dumping noise. Boundary reflection keeps the profile well-behaved near the end.
• Figure 4: Figure 3b: Sliding window vs exponential forgetting on the same stream segment; The window reacts faster to short shocks but is noisier, while forgetting yields a slightly smoother curve with mid lag
• Figure 5: Figure 4a and 4b: Adaptive KDE with boundary reflection (left) identifies candidate thresholds at density valleys (triangles). The persistence plot (right) shows which valleys survive across a range of bandwidths; persistent valleys are preferred for stable, real-time operation.