Our AI Solutions Architect Kateryna Kononova on the hybrid model she built, why every result has to be explainable and repeatable, and why data is the hardest part of the job.
A risk flag is worth exactly what you can prove about it. When an investigator marks a transaction as illicit and a prosecutor, a compliance officer, or opposing counsel asks why, “the model said so” ends the conversation badly. That question shaped the architecture of our AI investigator long before anything was trained.
In the clip above, Kateryna Kononova walks through how the model is put together and why it’s built that way. This post covers the same ground in more depth.
Why explainability decided the model choice
Kateryna is direct about the constraint: “It is important to provide our customers with explainable solutions.” So the machine learning model she chose for this task is a white box, one whose results can be explained explicitly.
Black-box models were ruled out for two reasons, and the second gets less attention than it deserves. The first is familiar: a black box returns a verdict with no traceable reason behind it, which is a liability in court and in front of a regulator. The second is repeatability. In Kateryna’s words, black-box results “couldn’t be explained and couldn’t even be repeated.”
Repeatability is what turns a result into a method
Run the same transaction data through a white-box model twice and you get the same answer. Meet the same pattern in a different case and the logic carries over, which is what Kateryna means when she says the results can be replicated in other cases.
For legal and compliance readers, that’s the practical test. A finding another analyst can reproduce from the same evidence is a finding that survives challenge. A finding that shifts between runs is an opinion with a technical accent.
How the hybrid model works
The model is built from two separate parts doing two different jobs.
The first is a machine learning model trained on data from our investigated cases. Those cases matter because they carry ground truth, real outcomes established through real investigations, and that’s what lets the model distinguish illicit transactions from regular ones. Public data can suggest a pattern. A closed case tells you what actually happened.
The second part is a fine-tuned open-weight language model. It was tuned on investigated cases as well, but for a different purpose: the team generated examples of explanations drawn from those cases to teach the model how to explain the results the machine learning model produces.
That split is the whole design. The machine learning model decides, the language model puts the reasoning into readable language, and the explanation layer never gets a vote on the finding itself.
What the language model is allowed to do
This deserves precision, because “we use an LLM” means very different things across this industry. Ours runs on open weights, fine-tuned on our own material, inside our own closed environment. Client data isn’t sent to a public model for processing, and live casework doesn’t depend on anyone’s external API.
The practical consequence is that the explanation you read in a report traces back to the model’s own decision path rather than to a general-purpose assistant’s best guess about blockchain data.
Why data is the hardest part of the build
Ask Kateryna what the biggest challenge is and she doesn’t reach for the model. “The most challenging aspect, of course, in all such projects is the data.”
Three questions carry the weight: how you collect it, how you know it was collected correctly, and how you merge data from different sources. Merging is where most of the pain sits, because case material arrives from different tools, chains, and formats, and a quiet merge error propagates into everything downstream.
She calls it “the most boring and the longest stage,” then immediately “the most important stage.” Both are true, and that’s precisely why it’s the hardest part: the work that determines whether the model is any good is the work nobody enjoys doing.
How ground truth catches hallucinations
The strength behind this particular development is volume. A large dataset of investigated cases gives the team a reference to test the model against, to see whether it works correctly or produces, in Kateryna’s words, “some hallucinations.”
That check only exists if you own the cases. A team without an investigative corpus can measure a model against public benchmarks. A team with hundreds of resolved investigations can measure it against what actually happened, and can keep doing that as the corpus grows with every new case the investigators close.
The takeaway
Explainability set the boundaries of this build from the start. A white-box machine learning model, so every decision can be traced and repeated. A fine-tuned open-weight LLM confined to explaining rather than deciding. A ground truth dataset from investigated cases to hold the whole thing against reality.
For the wider picture, our CTO covers vendor neutrality, data safety, and the roadmap in the AI behind Recoveris, and you can see the methodology applied to live matters in our blockchain investigations work.
If your organisation needs findings that hold up in front of a regulator or a court, or you want to test the tools Kateryna describes, schedule a consultation with Recoveris.
