When Anomaly Detection Flags Your Best Affiliates: The Baseline Problem in ML Fraud Detection

Last month I watched a legit affiliate go from “normal” to “under review” in a single afternoon - because a post went viral and the audience happened to be geographically tight. No bots. No incentivized junk. Just a distribution shift. My thesis: a lot of ML-based affiliate fraud detection is doing exactly what it was designed to do - flag low-density behavior relative to a baseline. The failure mode is that “low-density” often includes the best legitimate partners, because high performance in affiliate is structurally outlier-shaped. And yes, I’m seeing this now.