Sam Andersson, Karolinska institutet

Background

Problem gambling causes harm, but operational identification often relies on heuristic thresholds or sparse manual reviews. Routine logs are heavy-tailed and temporal, complicating monitoring. Methods: We analyzed de-identified records from one online operator across transactions, bets, sessions and payments. Thirty-day windows were leakage-audited and summarized with exceedance-frequency and magnitude features. Window embeddings were learned with a hierarchical conditional variational autoencoder using a responsible-gambling-proxy teacher and a student fine-tuned on sparse analyst labels from the training split. Backlog-aware label inference augmented training labels under missing-not-at-random assessment. Regularized Gaussian hidden Markov models produced dynamic regimes and a three-class operational proxy definition, evaluated on held-out labels and capacity-constrained alerting analyses. Results: Agreement was moderate and stream-dependent. Balanced accuracy ranged from 0.380 for transactions to 0.624 for payments, although payments requires caution because test support was skewed ([514, 22, 1386] low/medium/high) and high-risk argmax recall was 0.025. Bets had the strongest macro-averaged precision-recall harmonic mean (0.543); sessions had the highest high-risk argmax recall (0.757). Label augmentation effects were heterogeneous. In a common-support top-ten-per-week comparison, model detection exceeded responsible-gambling-ranked and random queues in every stream (55-78% versus 43-68% and 31-54%). Median alert-to-observed-assessment intervals were 65-210 days. Conclusions: The framework supports auditable, capacity-constrained monitoring, with cautious interpretation under selective review and class imbalance.