Every utility loses power it never gets paid for. Some of that is technical — resistance, transformer losses — and some of it is theft: tampered meters, bypassed connections, quiet under-reporting. The technical part you engineer away. The non-technical part hides inside millions of ordinary-looking consumption records, and finding it with a hand-written rule (“flag anyone whose usage fell”) buries your field team in false positives while the careful thief sails through.

The better question isn’t “did usage drop?” It’s “does this meter still behave like an honest one?” Honest consumption has a rhythm — a weekly shape, a variability, a texture. Theft disturbs that rhythm, and a model can learn the difference.

Behaviour, encoded

Vastvic Grid’s theft detector turns each customer’s meter history into 43 behavioural features — means, variability, quantiles, run-lengths, entropy, a Gini coefficient — plus a normalised 148-point weekly profile that captures the shape of a typical week. Those features light up the patterns inspectors already know by instinct:

  • sustained low or zero consumption that doesn’t fit the premises;
  • sudden drops with no seasonal reason;
  • flatlines — the signature of a meter reporting a fixed number;
  • lost weekly rhythm and low signal entropy, where a real household’s variety has gone missing.

A model built for a rare event

Theft is rare, and rare events break naive models — you can score 91% “accuracy” by calling everyone honest. So the detector is a LightGBM classifier weighted for imbalance and judged on the metrics that survive it: PR-AUC and recall, not accuracy. On the public SGCC benchmark — 42,372 customers, over a thousand daily reads each, roughly 8.5% theft — it reaches a ROC-AUC around 0.82 with recall tuned to catch the majority of true cases at the best precision that allows.

A theft model that can’t beat “assume everyone’s honest” shouldn’t ship. Ours has to clear that bar before it’s allowed out.

A gate, then a queue

No model reaches production on a hope. A release gate requires it to beat both a logistic-regression and a prevalence baseline and to clear minimum PR-AUC and recall thresholds — or it doesn’t ship. What field teams get is not a verdict but a ranked audit queue: customers ordered by probability, highest first, so limited inspection capacity lands where it pays. The score is a lead, not an accusation — a human still knocks on the door.

Theft detection done well isn’t surveillance and it isn’t a shot in the dark. It’s learning the shape of honest use, measuring the distance from it, and handing inspectors a shorter, smarter list — then letting them do their job.

Key takeaways

  • Theft shows up as disturbed behaviour, not just lower numbers — so the model reads behaviour.
  • 43 statistical features plus a 148-point weekly profile encode each meter’s rhythm.
  • A LightGBM model tuned for imbalance is judged on PR-AUC and recall, not accuracy.
  • A release gate enforces beating baselines; the output is a ranked audit queue, not an accusation.