ORACLE：從串流應用程式使用行為的部分軌跡預測詐騙

摘要

智慧型手機詐騙日益猖獗，通常表現為多階段、跨應用程式的過程，且意圖逐漸浮現。因此，有效的干預需要在意圖明確之前預測詐騙行為。這本質上具有挑戰性，因為決策必須依賴含有時間分散證據的部分軌跡。在本文中，我們提出 ORACLE（Online Reasoning for Anticipating Cross-temporal Latent thrEats，跨時間潛在威脅預測線上推理），這是首個用於從串流應用程式使用軌跡中提前預測詐騙的代理框架。為支援此設定，我們構建了一個真實世界、長時程的串流應用程式使用軌跡基準，涵蓋12種詐騙類型，跨長時間（平均15天），涉及多樣化的應用程式（95個應用），並交織正常與詐騙行為。針對零散證據，我們引入一個自演化情境管理器，能隨著時間適應性地整合以實體為中心的互動，從而更有效地從部分觀察中重建跨時間證據。為了增強對早期潛在訊號的敏感度，我們提出一種在策略自我蒸餾機制，其中教師模型在總結反詐騙反思與技能提示的條件下，監管無法取得此類反思的學生模型。此機制因此蒸餾出具證據依據的知識，並提升從部分軌跡中辨識新興詐騙模式的能力。實驗顯示，ORACLE 持續改善早期詐騙預測，在現實串流場景中提供及時警告，同時減少誤報。

English

Smartphone scams are increasingly prevalent and typically manifest as multi-stage, cross-application processes with gradually emerging intent. Effective intervention thus requires anticipating scams before the intent becomes explicit. This is inherently challenging, as decisions must rely on partial trajectories with temporally distributed evidence. In this paper, we propose ORACLE Online Reasoning for Anticipating Cross-temporal Latent thrEats, the first agentic framework for early scam anticipation from streaming app-usage trajectories. To support this setting, we curate a real-world long-horizon benchmark of streaming app-usage trajectories, covering 12 scam types, spanning extended periods (15 days on average), involving diverse applications (95 apps), and interleaving normal and scam behaviors. To address fragmented evidence, we introduce a self-evolving context manager that adaptively consolidates entity-centric interactions over time, enabling more effective reconstruction of cross-temporal evidence from partial observations. To enhance sensitivity to latent early-stage signals, we propose an on-policy self-distillation scheme in which a teacher model, conditioned on summarized anti-scam reflections and clues by skills, supervises a student model without access to such reflections. This scheme thereby distills evidence-informed knowledge and improves recognition of emerging fraud patterns from partial trajectories. Experiments show that consistently improves early scam anticipation, yielding timely warnings while reducing false alerts in realistic streaming scenarios.