Time series forecasting methods

Time series forecasting plays a crucial role in the operation and risk management of cross-border e-commerce (CBEC), particularly in logistics delay prediction, demand fluctuation forecasting, and transaction trend analysis [11]. Accurate temporal modeling can support inventory planning, logistics scheduling, and risk-oriented decision-making [12]. Traditional methods, such as ARIMA and exponential smoothing, are effective for relatively stable univariate and linear data. However, they are less suitable for CBEC scenarios where operational, transactional, and security data are usually multivariate, nonlinear, and affected by heterogeneous temporal patterns. Deep learning methods have therefore been increasingly adopted for e-commerce time series modeling [13]. RNN-based models, including LSTM and GRU, can capture sequential dependencies through memory mechanisms and have been widely used for demand forecasting and trend prediction [14]. Nevertheless, these models still face limitations in scalability and often struggle to model short-term fluctuations and long-term temporal dependencies simultaneously [15].

Transformer-based models have improved the modeling of long-range dependencies through attention mechanisms. Some variants further introduce sparse attention, decomposition modules, or hierarchical structures to reduce computational cost and improve forecasting performance. Pyraformer is a representative model that uses pyramidal attention to capture multi-scale temporal dependencies, enabling the extraction of both local patterns and global trends. However, most Transformer-based and Pyraformer-based methods are still primarily designed for single-task forecasting. They do not explicitly consider the joint modeling of regression-oriented operational risk forecasting and classification-oriented anomaly detection in CBEC. Therefore, although these models provide an important technical foundation for temporal dependency modeling, they are insufficient for unified CBEC risk analytics that requires simultaneous modeling of logistics delay, demand fluctuation, and security anomalies.

Multi-Task learning

Multitask Learning (MTL) has been widely studied in machine learning and deep learning, especially in scenarios involving multimodal data, multi-objective optimization, and related prediction tasks [16][?]. Conventional MTL frameworks usually rely on parameter sharing, where shared layers extract common representations and task-specific layers learn individual task patterns [17]. This design can improve generalization by transferring useful information across related tasks. However, when tasks have different data distributions, loss scales, or optimization objectives, simple parameter sharing may introduce task interference or negative transfer, reducing the performance of one or more tasks. To mitigate these problems, recent MTL studies have introduced dynamic feature sharing, attention-based task interaction, and adaptive task-weight optimization. These mechanisms allow the model to adjust the contribution of different tasks during training and reduce the dominance of any single task. In time series modeling, MTL is particularly useful because many CBEC tasks share temporal dependencies and user behavior patterns [10]. For example, logistics delay prediction, demand forecasting, and anomaly detection may all depend on historical transaction trends, delivery cycles, and abnormal behavioral changes. However, existing MTL models often focus on task sharing itself and lack a dedicated mechanism for multi-scale temporal feature extraction [18]. As a result, they may fail to fully capture both local short-term variations and long-term temporal trends in heterogeneous CBEC data.

Combining MTL with temporal models such as Pyraformer can improve the ability to learn shared time-dependent representations [19]. Nevertheless, a direct combination of these methods is still insufficient if task imbalance and heterogeneous objectives are not properly addressed. In CBEC risk management, regression tasks and classification tasks often differ greatly in loss functions, label distributions, and optimization difficulty. Therefore, an effective framework should not only extract shared temporal features but also provide task-specific prediction heads and a dynamic weighting mechanism to balance multiple objectives during training.

Cross-Border E-commerce risk management

As a vital component of global trade, CBEC plays an important role in promoting commodity circulation and expanding international market access [20]. However, CBEC platforms face various risks arising from logistics, transactions, inventory, and cybersecurity. Operational risks include logistics delays, inventory shortages, and demand fluctuations, while security risks involve transaction anomaly detection, data protection, and network security threats [21]. Traditional risk management methods usually rely on historical data analysis or single-task time series models, such as ARIMA and LSTM, to predict logistics timelines or demand variations [22]. These methods are useful for specific tasks but often ignore the coupling relationships among logistics, demand, and security risks. In practical CBEC scenarios, different types of risks are not isolated. Demand fluctuations may influence inventory pressure and delivery scheduling, logistics delays may affect customer behavior and transaction trends, and abnormal network traffic may indicate potential security threats during online transactions. With the rapid digitalization of e-commerce, security risks have become increasingly important for platform operation and user-data protection [23]. Therefore, CBEC risk management requires a unified modeling framework that can integrate operational and security information while supporting different prediction objectives.

Overall, existing studies provide valuable foundations for e-commerce time-series forecasting, multitask learning, and CBEC risk management, but several limitations remain. Traditional time-series forecasting models mainly focus on single-task prediction and are not sufficiently designed to capture the interactions among logistics delay, demand fluctuation, and anomaly detection. Transformer-based and Pyraformer-based methods improve long-range temporal dependency modeling, but they are generally developed for forecasting-oriented scenarios and do not explicitly integrate regression and classification objectives within a unified risk-management framework. Meanwhile, conventional multitask learning methods can share representations across tasks, but they often lack a dedicated multi-scale temporal feature extraction mechanism and may suffer from task imbalance or negative transfer when different tasks have heterogeneous optimization objectives. Therefore, existing approaches are still insufficient for CBEC risk management, where operational and security risks are coupled with multimodal, multiscale, and task-heterogeneous temporal patterns. In contrast, MT-PyraRisk addresses these limitations by combining pyramidal attention-based shared feature extraction, task-specific prediction heads, and dynamic task-weight adjustment, thereby enabling joint modeling of operational risk forecasting, demand prediction, and anomaly detection.

Overview of our network

To address the need for integrated planning of operational and security tasks in cross-border e-commerce risk management, this paper proposes the MT-PyraRisk model, a unified framework that combines multi-task learning with a pyramidal attention mechanism [24,25]. Fig 1 illustrates the overall architecture of the model, which consists of an input module, a shared-feature extraction layer, task-specific layers, and a joint optimization module.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 1. Overall architecture of the MT-PyraRisk model.

https://doi.org/10.1371/journal.pone.0352809.g001

The MT-PyraRisk model takes multimodal time-series data as input, which are preprocessed and then passed into a shared-feature extraction layer for multi-scale modeling. By leveraging the pyramidal attention mechanism (PAM), this layer captures both local and global temporal dependencies, ensuring high-quality shared features for the subsequent task-specific layers. The task-specific layers contain independent prediction heads designed for tasks such as forecasting logistics delays, predicting demand fluctuations, and detecting anomalies. Finally, a joint optimization module balances learning across tasks through a dynamic weight-adjustment mechanism [26]. The input module forms the foundation of the model, responsible for transforming operational, transactional, and security data into time-series representations. Operational data include logistics routes, delivery times, and inventory levels; transactional data cover user behavior, purchase history, and sales records; security data comprise network traffic, transaction frequency, and payment patterns. This multimodal data is segmented into time windows, normalized, and integrated before being fed into the shared-feature layer, ensuring a consistent data structure for different tasks [27]. The shared-feature extraction layer is the core module of MT-PyraRisk. It employs the pyramidal attention mechanism (PAM) to extract multi-scale features from the time-series data [28]. This mechanism enables the simultaneous modeling of short-term dynamics and long-term trends. Its hierarchical structure progressively compresses the time series and extracts salient information across different time spans, ensuring comprehensive data representation and improving prediction accuracy. Task-specific layers provide independent prediction heads for each task, flexibly adapting to both regression and classification objectives. For regression tasks, fully connected networks are used to generate continuous-value predictions.

Thanks to its modular design, the MT-PyraRisk model enables efficient modeling and joint optimization of multi-task, multimodal data. Its integration, flexibility, and efficiency offer an innovative solution for forecasting risks in cross-border e-commerce.

Data input module

The data entry module is a fundamental part of the MT-PyraRisk model, responsible for converting multimodal data from cross-border electronic commerce into a format of time series that can be processed by the model. Fig 2 shows the specific architecture of this module, which consists of three main stages: data acquisition, preprocessing, and generation of tensors for time series.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 2. Architecture of the Data Input Module.

https://doi.org/10.1371/journal.pone.0352809.g002

To address timestamp alignment across heterogeneous data sources, the data input module first converts all records into a unified daily time interval. Transaction, logistics, and inventory records from the e-commerce dataset are aggregated at the daily level, while millisecond- or second-level network traffic records are downsampled into daily windows. The daily aggregation process generates task-related statistics such as order count, total transaction volume, average delivery time, inventory level, packet count, average packet size, protocol frequency, connection count, and the number or proportion of abnormal traffic records. After aggregation, all data sources are aligned according to the same daily timestamp index. Missing timestamps are padded before model input. Continuous missing values are filled by forward filling within the same sequence, and remaining missing values at the beginning of a sequence are replaced by the mean value calculated from the training set. Missing categorical values are assigned to an additional unknown category. In the current experiments, the implemented features consist of e-commerce transaction features, logistics and inventory features, and network traffic features. The transaction, logistics, and inventory features are used to describe operational risk, demand fluctuation, and supply-chain status, while the network traffic features are used to represent security-related risk and anomaly detection patterns. Geospatial variables, news sentiment, social-media monitoring data, and geopolitical factors are not used as experimental inputs in the present model. This synchronization and feature-definition strategy reduces temporal mismatch between operational, transactional, and security-related data before they are processed by the shared feature extraction layer, and clearly defines the actual input scope of MT-PyraRisk in the experiments.

Let X_op, X_tr, and X_sec denote operational data, transactional data, and security data, respectively. The integrated input tensor is represented as , with T denoting the number of aligned daily time steps, N denoting the number of data sources, and D denoting the feature dimension:

(1)

To reduce the influence of feature-scale differences, numerical features are standardized using z-score normalization:

(2)

The symbol denotes the original value of the j -th feature in the i -th sample, and and denote the mean and standard deviation of the j -th feature calculated from the training set. The normalized data are then divided into fixed-length time windows. Given the window length w and sliding step s, the time-window sample at time t is defined as:

(3)

In this study, w is set to 30 days and s is set to 1 day. This setting allows each sample to contain sufficient historical information while preserving short-term temporal changes.

To provide explicit temporal information, the timestamp index is encoded by periodic time embeddings and combined with the normalized input features. The time encoding is generated as:

(4)

The parameter denotes the periodic scale of the k -th temporal basis. The final time-aware input representation is obtained by combining the normalized feature tensor and the temporal encoding:

(5)

The operator ⊕ denotes feature concatenation. The resulting tensor Z provides a unified input representation for the shared feature extraction layer. The regression and classification branches receive the shared temporal representation derived from Z, and their predictions can be expressed as:

(6)

(7)

In the current experiments, the implemented input features consist of e-commerce transaction features, logistics and inventory features, and network traffic features. Geospatial variables, news sentiment, social-media monitoring, and geopolitical factors are not included as experimental inputs in the present model. They are discussed only as possible extensions for future CBEC risk analysis. This clarification avoids confusion between the features actually used in the experiments and external factors that may be incorporated in future versions of the framework.

Shared feature extraction layer

The shared feature extraction layer is the core of the MT-PyraRisk model and uses PAM for large-scale feature extraction [29]. This layer is designed to extract characteristics from multimodal data from time series at different time scales, so that subsequent task-specific layers can make more accurate predictions. In response to the enhancement of anomaly detection capabilities, we have incorporated additional external sources of information, such as news sentiment and social media monitoring, into the feature extraction process. These data sources help improve the model’s ability to detect new security threats, thereby increasing the model’s anomaly detection performance. Fig 3 shows the architecture of this module.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 3. Architecture of the Shared Feature Extraction Layer.

https://doi.org/10.1371/journal.pone.0352809.g003

PAM is used as the core module of the shared feature extraction layer to capture multi-scale temporal dependencies from the time-aware input representation Z generated by the data input module. The input representation is denoted as , with T representing the number of aligned daily time steps and D representing the feature dimension. The pyramidal structure contains multiple hierarchical attention layers. Lower layers mainly preserve short-term local variations, while higher layers progressively aggregate wider temporal contexts to capture long-term trends. In the l -th attention layer, the input representation is denoted as . It is first projected into the query, key, and value matrices through learnable linear transformations:

(8)

The matrices , , and are learnable projection parameters. The scaled dot-product attention is then used to calculate the attention weight matrix:

(9)

The symbol denotes the dimension of the key vector. Based on the attention weight matrix, the output of the l -th layer is computed as:

(10)

The output contains temporal features extracted at the corresponding scale. In the pyramidal attention structure, the output of one layer is passed to the next layer after temporal compression or hierarchical aggregation, enabling the model to gradually expand its temporal receptive field.

After the hierarchical attention layers, the multi-scale outputs are aggregated to form the shared feature representation. Let L denote the number of pyramidal attention layers, and let denote the aggregation coefficient of the l -th layer. The final shared feature representation is formulated as:

(11)

The coefficients control the contribution of different temporal scales to the final shared representation. The resulting H_shared is then passed to the task-specific prediction heads described in Section 3.4. Through this design, the shared feature extraction layer can jointly preserve local short-term fluctuations and global long-term dependencies, providing a consistent feature representation for operational risk forecasting, demand prediction, and anomaly detection.

Task-Specific layer

The task layer is an essential element of the MT-PyraRisk model, responsible for making predictions based on the shared information provided by the shared feature extraction layer [25]. Given the diversity of risk management tasks related to cross-border electronic commerce, which include both regression and classification tasks, the task layer must develop independent forecasting heads for each task to meet the specific requirements of each task. Additionally, the adaptive weighting of tasks in this layer is necessary to ensure that the model can dynamically adjust its focus based on the importance of each task. This adaptive weighting is analytically justified, as it enables the model to prioritize tasks that are more critical in a given context, thereby improving the model’s overall performance. Fig 4 shows the architecture of a specific task layer that focuses on forming regression and classification tasks.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 4. Task-Specific Layer Architecture Diagram.

https://doi.org/10.1371/journal.pone.0352809.g004

Let H_shared denote the shared feature representation generated by the pyramidal attention-based feature extraction layer. Since cross-border e-commerce risk management involves heterogeneous prediction objectives, MT-PyraRisk employs independent task-specific heads for regression tasks, such as operational risk forecasting and demand prediction, and classification tasks, such as anomaly detection.

For regression tasks, the model outputs continuous values through a fully connected prediction head. Given the shared representation H_shared, the predicted regression output is formulated as:

(12)

The term denotes the regression prediction head, and denotes the predicted continuous value. The regression loss is measured by the mean squared error:

(13)

The symbols and denote the true and predicted regression values of the i -th sample.

For classification tasks, the model predicts the probability distribution over predefined classes through a fully connected classification head followed by a Softmax function:

(14)

The term denotes the classification prediction head, and denotes the predicted class probability distribution. The classification loss is defined by the cross-entropy loss:

(15)

The symbol C denotes the number of classes. The term denotes the ground-truth label of the i -th sample for class c, and denotes the corresponding predicted probability.

The total training objective combines the regression and classification losses through task weights:

(16)

The parameters and denote the weights assigned to the regression and classification tasks, respectively. Instead of using fixed task weights, this study adopts a GradNorm-based adaptive weighting strategy to dynamically balance the optimization of different tasks. This mechanism is not an uncertainty-weighting method, but a gradient-normalization strategy that adjusts task weights according to the training speed and gradient contribution of each task.

Let denote the set of tasks, and let denote the parameters of the shared feature extraction layer. For each task , the gradient norm of the weighted task loss with respect to the shared parameters is calculated as:

(17)

The variables and represent the loss and weight of task k at training step t, respectively. To measure the relative training speed of each task, the normalized loss ratio is defined as:

(18)

The term is the initial loss of task k. A larger indicates that the task is learning more slowly than the average training speed. The target gradient norm for task k is defined as:

(19)

The average gradient norm is , and is the GradNorm balancing coefficient controlling the strength of task reweighting.

The task weights are updated by minimizing the gradient-balancing objective:

(20)

After each update, the task weights are normalized to keep the total weight scale stable:

(21)

Through this adaptive weighting mechanism, tasks with slower convergence or insufficient gradient contribution receive larger weights, while tasks that dominate the optimization process are assigned smaller weights. This design prevents either the regression objective or the classification objective from overwhelming the shared representation learning process, thereby reducing task imbalance and potential negative transfer. In MT-PyraRisk, the performance improvement over baseline models is not attributed to the weighting strategy alone, but to the joint effect of several components. The pyramidal attention mechanism provides multi-scale temporal representations by capturing both local short-term fluctuations and long-range dependencies. The unified temporal synchronization process reduces misalignment among operational, transactional, and security-related data. The multitask structure further enables regression and classification tasks to share useful temporal information while maintaining task-specific prediction heads. Based on these components, the GradNorm-based dynamic weighting mechanism stabilizes joint optimization by adaptively balancing the contribution of each task during training. Therefore, the task-specific layer not only supports heterogeneous prediction objectives, but also strengthens multitask optimization and improves the robustness of MT-PyraRisk in CBEC risk prediction.

Datasets

To evaluate the effectiveness of the MT-PyraRisk model in predicting cross-border e-commerce risks, this study utilizes two publicly available datasets: the Global E-Commerce Dataset and the Kaggle Network Traffic Dataset. These datasets represent the operational and security domains respectively, enabling a comprehensive assessment of the model’s performance across various risk-management tasks. Table 1 summarizes key information about the two datasets, including data types, content description, time span, and data volume.

Download:

• PNG
  larger image
• TIFF
  original image

Table 1. Overview of E-commerce and Network Traffic Datasets Used in the Experiment.

https://doi.org/10.1371/journal.pone.0352809.t001

The Global E-Commerce Dataset contains transactional, logistics, and trading data collected from several e-commerce platforms [30]. It includes features such as transaction history, revenue, order status, logistics routes, delivery timelines, transportation modes, and other relevant time-series attributes. Due to its multimodal nature and cross-border e-commerce context, this dataset supports the modeling and prediction of operational risks—particularly logistics delays and demand fluctuations.

The Network Traffic Dataset is primarily used for network security analysis and comprises extensive records of network traffic, including packet size, transmission time, source/destination addresses, protocol type, and traffic labels (normal or anomalous) [31]. This dataset reflects potential cybersecurity threats that e-commerce platforms may encounter during transactions, especially concerning payment processing and user-information protection.

Experimental details

The experiments in this study were performed on a workstation equipped with an NVIDIA RTX 3090 GPU, 64 GB of memory, and 2 TB of storage. The experimental environment was configured with Python 3.8, PyTorch 1.9, and TensorFlow 2.0 for model implementation and baseline verification. All neural-network-based models were trained on the GPU to accelerate matrix operations and improve computational efficiency. To ensure reproducibility and fair comparison, all models used the same preprocessing strategy, temporal split, sliding-window setting, and evaluation metrics. In the preprocessing stage, all numerical features were standardized using z-score normalization to reduce the influence of feature-scale differences. Missing values in continuous variables were first handled by forward filling within the same sequence, and remaining missing entries at the beginning of a sequence were replaced by the mean value calculated from the training set. Missing categorical values were assigned to an additional unknown category. The time-series samples were generated using a sliding-window strategy, with the window length set to 30 days and the sliding step set to 1 day. All datasets were divided chronologically into 70% training data, 15% validation data, and 15% testing data to avoid information leakage from future observations.

To synchronize the Global E-commerce Dataset and the Kaggle Network Traffic Dataset in the multitask learning framework, all data sources were converted into a unified daily time interval. E-commerce transaction, logistics, and inventory records were aggregated at the daily level using task-related statistics, including order count, total transaction volume, average delivery time, inventory level, and abnormal transaction frequency. Network traffic records originally stored at millisecond- or second-level granularity were downsampled into daily windows by calculating packet count, average packet size, protocol frequency, connection count, and the number or proportion of abnormal traffic records. This study used aggregation and downsampling rather than interpolation because the aim was to preserve daily operational and security patterns instead of reconstructing high-frequency traffic sequences. After temporal aggregation, all task-specific sequences were aligned according to the same daily timestamp index, and missing timestamps were padded using the missing-value strategy described above. During model training, the regression and classification heads were jointly optimized using the GradNorm-based adaptive weighting mechanism described in Section 3.4. The task weights were initialized as and . The GradNorm balancing coefficient was selected from {0.5,1.0,1.5,2.0} according to validation performance, and the final value was set to 1.5. Adam was used as the optimizer with an initial learning rate of 0.001, the batch size was set to 64, and the maximum number of training epochs was 100. Early stopping was applied when the validation loss did not improve for 10 consecutive epochs. Gradient clipping with a maximum norm of 5.0 and task-weight normalization were used to improve optimization stability and avoid extreme task weights.

Evaluation metrics

To comprehensively assess the effectiveness of the MT-PyraRisk model in performing cross-border risk forecasting tasks in e-commerce, we selected the following five evaluation indicators. These indicators reflect the different needs of the regression and classification tasks, so we can measure the performance of the model from several points of view [32].

MSE is a commonly measure typically used for regression problems. It measures the mean square difference between the predicted and actual values. is the true value, is the predicted value, and N is the number of samples.

(22)

MAE is another measure of regression that measures the mean absolute differences between the predicted and actual values. Unlike MSE, MAE does not punish severely for large errors, which makes it more reliable in exceptional cases.

(23)

Accuracy is an important indicator for classification, especially if he is This is unbalanced data. Accuracy is of particular importance for cross-border electronic commerce security tasks, such as the detection of anomalies. TP is number of true positive cases, and FP is number of false positive cases.

(24)

Recall, measure the ability of the classifier to identify all positive samples. For anomaly detection tasks, a high recall indicates that the model can detect more anomalies, which is crucial for the security of cross-border e-commerce platforms.

(25)

F1-score is the harmonic mean of accuracy and memory that combines the two dimensions to measure the model’s performance when identifying positive samples. The F1-score is particularly useful when it comes to uneven recordings, as it balances the trade-off between accuracy and memory. This makes it ideal for tasks such as detecting anomalies in which false positives and false negatives have a significant influence.

(26)

Comparative experimental results

To assess the overall the effectiveness of the MT-PyraRisk model for cross-border e-commerce risk forecasting tasks, we compare it to other common risk forecasting and anomaly detection models and we put the focus on its effectiveness on five indicators of evaluation [13]. This section presents the experimental results of the MT-PyraRisk model on the global e-commerce dataset and the Kaggle network traffic dataset. The table 2 below shows the results of the experiment.

Download:

• PNG
  larger image
• TIFF
  original image

Table 2. Performance Comparison of MT-PyraRisk and Baseline Models on Global E-commerce and Kaggle Network Traffic Datasets.

https://doi.org/10.1371/journal.pone.0352809.t002

Based on the comparative results in Fig 5, it can be found that the MT-PyraRisk model outperforms other models in most indicators, especially in the management of various tasks such as forecasting delays in logistics, predicting demand fluctuations, and detecting anomalies in Kaggle network and global e-commerce traffic records. For regression problems, the MT-PyraRisk model shows a significant improvement in MSE and MAE compared to other models. On the Global E-commerce Dataset, it reduces MSE by 4.3% and MAE by 14.3% compared to Timesformer, while on the Kaggle Network Traffic Dataset it reduces MSE by 5.1% and MAE by 12.4% compared to CNN-LSTM. The superior performance in regression tasks is attributed to the pyramidal architecture, which helps the model capture dependencies at multiple scales and reduces computational noise, thus improving its predictive accuracy. In classification tasks, the MT-PyraRisk model shows an anomaly detection accuracy that is 4.4% higher and a recall rate 4.7% higher on the Kaggle network traffic dataset compared to Timesformer. This suggests that the combination of the pyramidal attention mechanism and the multi-task learning (MTL) framework’s regularization effect enhances the model’s ability to detect anomalies more effectively. Compared to conventional models such as ARIMA and ensemble methods like XGBoost, the MT-PyraRisk model demonstrates significant performance improvements in both accuracy and recall. This indicates its excellent ability to identify anomalies. In terms of accuracy and recall, the MT-PyraRisk model achieves the highest F1 score, outperforming other models in the Kaggle network traffic dataset by 4.2% and in the global e-commerce dataset by 1.1%. This highlights the excellent performance of multi-task learning in optimizing overall model efficiency. While models such as LSTM and GRU perform well on individual tasks, they are still insufficient compared to MT-PyraRisk in defining both local and global dependencies between tasks. This demonstrates the advantages of integrating multi-task learning with a pyramidal architecture and joint optimization in handling complex, multi-dimensional data.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 5. Comparative experimental results.

https://doi.org/10.1371/journal.pone.0352809.g005

Overall, the MT-PyraRisk model shows a high multitasking learning ability, outperforms both regression and classification tasks, and outperforms several traditional models in terms of accuracy, recall, and overall F1-score.. In the future, we will continue to examine the contribution of each module to the model through ablation experiments to better understand its impact on the final performance.

Ablation study results

To further verify the contribution of each module in the MT-PyraRisk model to its overall performance, we conducted an ablation study in which different modules were gradually removed from the model and observed according to the variation in power [40]. These ablation experiments allow us to analyze the relative value of each module and verify the effectiveness of the entire architecture. Table 3 presents the experimental results of the MT-PyraRisk model for these three ablation parameters.

Download:

• PNG
  larger image
• TIFF
  original image

Table 3. Ablation Study of MT-PyraRisk Model: Performance on Global E-commerce and Kaggle Network Traffic Datasets with Removed Modules.

https://doi.org/10.1371/journal.pone.0352809.t003

Based on the updated ablation results in Table 3 and Fig 6, each core component of MT-PyraRisk contributes differently to the final performance. The removal of the Pyramidal Attention Mechanism (w/o PAM) causes a clear decline in both regression and classification performance. On the Global E-commerce Dataset, MSE increases from 0.045 to 0.052, and MAE increases from 0.030 to 0.035, corresponding to relative increases of 15.6% and 16.7%, respectively. Meanwhile, the F1-score decreases from 0.89 to 0.84. On the Kaggle Network Traffic Dataset, the degradation is more evident, with the F1-score decreasing from 0.93 to 0.86 and MSE increasing from 0.037 to 0.046. This result indicates that PAM is essential for capturing multi-scale temporal dependencies. Without the pyramidal structure, the model becomes less effective in simultaneously representing short-term local fluctuations and long-term temporal trends, which directly weakens both risk forecasting and anomaly detection. The removal of the multitask learning structure (w/o MTL) further demonstrates the importance of joint modeling. In this variant, regression and classification tasks are optimized more independently, and the shared representation learning process is weakened. As a result, the F1-score decreases by about 6.7% on the Global E-commerce Dataset and about 8.6% on the Kaggle Network Traffic Dataset. MSE also increases from 0.045 to 0.057 on the Global E-commerce Dataset and from 0.037 to 0.049 on the Kaggle Network Traffic Dataset. This shows that operational risk forecasting, demand prediction, and anomaly detection are not completely isolated tasks. They share temporal patterns related to transaction changes, delivery cycles, and abnormal behavior. Removing MTL reduces the ability of the model to transfer useful temporal information across tasks, thereby weakening generalization performance. The removal of the dynamic weighting mechanism (w/o Dynamic Weighting) also leads to consistent performance degradation. In this setting, fixed task weights are used instead of the GradNorm-based adaptive weighting strategy. The F1-score decreases from 0.89 to 0.85 on the Global E-commerce Dataset, corresponding to a relative decrease of 4.5%, and from 0.93 to 0.88 on the Kaggle Network Traffic Dataset, corresponding to a relative decrease of 5.4%. This result suggests that fixed weights are insufficient for balancing heterogeneous tasks with different loss scales and convergence speeds. Without dynamic weighting, either the regression task or the classification task may dominate the optimization process, causing task imbalance and potential negative transfer. Therefore, the GradNorm-based mechanism improves training stability by assigning larger weights to slower-learning tasks and reducing the influence of tasks that dominate gradient updates. The influence of temporal synchronization is reflected by the w/o Time Alignment variant. When the unified daily alignment strategy is removed, the F1-score decreases from 0.89 to 0.86 on the Global E-commerce Dataset, corresponding to a relative decrease of 3.4%, and from 0.93 to 0.87 on the Kaggle Network Traffic Dataset, corresponding to a relative decrease of 6.5%. The corresponding MSE increases from 0.045 to 0.053 and from 0.037 to 0.044, representing relative increases of 17.8% and 18.9%, respectively. This confirms that time alignment is particularly important when combining e-commerce transaction records, logistics and inventory data, and high-frequency network traffic data. Without daily aggregation and timestamp alignment, the model may learn noisy or mismatched temporal relationships, especially between millisecond-/second-level traffic records and daily operational indicators. Therefore, the temporal synchronization strategy improves the reliability of multimodal time-series fusion.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 6. Results of ablation experiment.

https://doi.org/10.1371/journal.pone.0352809.g006

Overall, the ablation results show that the performance improvement of MT-PyraRisk does not come from a single module, but from the complementary effects of multi-scale temporal modeling, multitask representation learning, adaptive task balancing, and temporal synchronization. PAM mainly contributes to multi-scale dependency extraction, MTL enables knowledge sharing across related tasks, dynamic weighting stabilizes joint optimization, and time alignment reduces temporal mismatch among heterogeneous data sources. These findings provide stronger empirical evidence for the architectural design of MT-PyraRisk and explain why the complete model achieves better performance than its ablated variants.