Forged

ReCaptcha trained AI by making you prove you're human. Forged trains fraud detection AI by making you prove you're a criminal. Your gameplay becomes training data no existing dataset can replicate.

Comment

## Inspiration ##

ReCaptcha digitized books by making users prove they're human. Pokemon Go mapped the world by
making people walk. Duolingo translated the internet by teaching languages. The best training
data comes from products people actually want to use. Fraud detection AI is stuck training on
static transaction logs. It's never seen how a real person probes, hesitates, and adapts when
trying to beat it. We built a game people want to play, where every creative attack generates adversarial behavioral data that doesn't exist in any dataset today.

## What it does##

Forged is a multiplayer game where you and your friends play as white-collar criminals in a shared cartoon office, forging invoices, faking checkouts, and trying to slip past an AI fraud inspector. You walk around a 3D office, talk to coworkers with your actual voice, dodge your boss's patrol routes, bribe NPCs with donuts, and sneak forged documents past a live ML model that's learning your tricks in real time.

Early levels teach you the ropes against a simple model. As you level up, you go head-to-head against our custom LightGBM model trained on real IEEE-CIS transaction data, which catches 97% of player attacks. Every move you make, how you probe, how you adapt when caught, feeds back into training. The model retrains on your tricks and your behavioral patterns populate a dataset of adversarial fraud signals that traditional transaction logs simply don't capture.

## How we built it##

The game is a browser-based 3D office built entirely from Three.js primitives. No art assets, just boxes, cylinders, and emoji sprites. The entire audio landscape is synthesized in real time with WebAudio: ambient HVAC hum, adaptive jazz that intensifies with suspicion, spatial footsteps that change with the floor surface, and big-band stings for verdicts.

Players can talk to NPCs using their microphone. The Web Speech API handles recognition, and characters, using Cartesia AI, respond with synthesized voices tuned per personality. The clerk files
your spoken words as cover notes. The boss gets suspicious if you shout near him.

Multiplayer runs over WebSockets with up to four players sharing one office. The boss is authoritative: one player's browser walks him, everyone else mirrors. Fire drills, coffee runs, and desk phone calls create dynamic chaos that players can exploit.

Two ML systems run behind the scenes. A logistic regression model scores forged invoices using 34 features with an in-session kNN memory system that catches repeated tricks. A LightGBM model trained on 100k+ real credit card transactions augmented with player-generated attacks handles the checkout fraud. Both retrain live with promotion gates that prevent regression. The backend runs on Render, Python fronting FastAPI, the fraud model, and Redis in one container, with CRS identity verification for real credit bureau signals.

##Challenges we ran into##

Keeping the disguise. The game had to feel like a game. Wacky, silly, fun, so players engage naturally rather than performing for a data pipeline. If people realize they're generating training data, their behavior changes and the data loses value. We spent a lot of time on tone: googly-eyed coworkers, a boss who says "Nice weather for compliance," donut bribes, and fire drill chaos.

Finding real training data. We needed real transaction data to bootstrap the system before any players touched it. The IEEE-CIS Kaggle competition gave us 100k+ real credit card transactions with device info, identity signals, and fraud labels. That became the foundation.

Preventing misuse. We're building a game that teaches people to commit fraud. The data flows one way only. Player behavior feeds into defensive models. Raw evasion strategies aren't extractable; they're consumed by the retrain pipeline and surfaced only as model weight updates and aggregate behavioral features.

Making the models hold up. Naive retraining on player data destroyed our model twice before we got the promotion gates right. We needed frozen test sets, bootstrap checks, and hard FPR ceilings. By v4, the model catches 97% of attacks at a 3.6% false positive rate, and the kNN memory boosts invoice fraud recall by 15-30%.

## Accomplishments that we're proud of##

The model actually works. 97% catch rate on player attacks, 3.6% false positive rate on real transactions. It retrains live, gets harder as you play, and the promotion gates prevent regression.

The game is genuinely fun. People laugh. They bribe Gus with donuts, steal the boss's pre-approved stamp, shout at coworkers over voice chat, and exploit fire drills to sneak deliveries past the inspector. Nobody thinks about data pipelines.

The graphics. The entire game is boxes, cylinders, and spheres. No imported assets. Shadow-casting furniture, half-drawn window blinds, chunky door frames, and spatial lighting gave it more character than we expected from literal geometry.

The audio. Every sound is synthesized. No audio files in the entire project. Ambient office hum, adaptive jazz, spatial footsteps on different floor surfaces, and a sad trombone when you get caught. All generated in real time with WebAudio.

Multiplayer just works. Four friends in one office, voice chatting with NPCs, snitching on each other during coffee runs, racing to deliver during fire drills. The shared boss and synchronized events turned a single-player puzzle into social chaos.

##What we learned##

Making something fun and useful at the same time is genuinely hard. Make the fraud too realistic and the game stops being funny. Make it too silly and the data loses signal. Every design decision was a tug-of-war between engagement and research utility.

Players are creative in ways datasets aren't. Static fraud datasets capture what fraud looks like. Players show you how fraud thinks. They probe, iterate, back off, try a different angle. The best adversarial data comes from humans having fun trying to win.

ML models need guardrails to learn from users. Learning from adversarial input is powerful but fragile. One clever player can tank your recall without frozen test sets, bootstrap checks, and hard FPR ceilings.

We came out with a strong understanding of how human-in-the-loop data collection actually works in practice. You're balancing game design against data quality, model stability against learning speed, and player fun against research utility. The gap between "we have a fraud dataset" and "we have data on how people actually try to commit fraud" is enormous, and that gap is exactly where this lives.

##What's next for Forged##

Forged can end up becoming a lot of things as it develops.

Enterprise red-teaming as a game. Companies plug their own fraud models into Forged and let their finance teams attack them, turning offensive analysis from a quarterly compliance chore into a Friday afternoon activity with coworkers. Domain experts probing a live model surface blind spots faster than any automated test suite.

A synthetic data engine for fraud attempts. Existing datasets capture successful fraud. Forged captures the full funnel: the probes that went nowhere, the near-misses, the pivots after getting caught. That's behavioral data that's missing from the market today.

Understanding what probing looks like. There's almost no research on the behavioral patterns of someone actively trying to find holes in a detection system. Forged generates that data at scale. Hesitation patterns, strategy shifts, information gathering sequences, with applications well beyond fraud into any adversarial detection problem.

Education without the risk. Forged teaches people what fraud looks like. How invoices get doctored, how identity theft works, what red flags to watch for, without making them effective fraudsters. The game shows you what the inspector sees, why you got caught, and what gave you away. That's a training tool for finance teams, compliance departments, and everyday people who might spot a scam someday because they played a silly office game.

Share this project:

Updates

Submission history