Learned Execution Graphs for Anomaly Detection & Drift in APIs — Ritvik Pandya, JP Morgan Chase
Jul 23, 2026 · 19:38
Ritvik Pandya of JP Morgan Chase presents Learned Execution Graphs, a method that models each API request as a short-lived DAG of middleware steps learned from telemetry at over 1,600 requests per second. The system detects anomalies by comparing actual execution against a learned baseline, localizing deviations to exact nodes instead of whole endpoints. In production it flagged a 41x deviation at a single node that service-level monitoring missed, cutting root cause from hours to under 30 seconds. Pandya distinguishes one-off anomalies from drift, categorizing drift into structural (added/removed steps), volume (scaling needs), and covariate (shifting request demographics), using per-client baselines and KL divergence rather than a single threshold. The approach uses tiered checks: a cheap first check only escalates when the graph signals a real change, reducing false alarms and enabling faster automated responses.
