1. A system, comprising: one or more processors; one or more non-transitory computer-readable storage mediums including instructions configured to cause the one or more processors to perform operations including: generating a filtering rule; partitioning training data using the filtering rule, wherein the training data includes past data representing unauthorized activity; analyzing a set of partitions, wherein analyzing includes providing the set of partitions to a model, wherein the model repeatedly generates a set of classifications, and wherein a classification is associated with a partition; accessing known information associated with the training data; identifying an accurate set of classifications using the known information, wherein the accurate set of classifications is associated with the analyzed set of partitions; accessing first data that represents activity involving a first service provided to a user; accessing second data that represents activity involving a second service provided to a user, wherein the activity involving the second service and the activity involving the first service both include authorized user activity, and wherein the activity associated with the second service further includes unauthorized activity; filtering, on a computing device, a portion of the first data for use in classifying activity associated with the second service, wherein filtering the portion of the first data includes using the filtering rule and the accurate set of classifications; determining a retained portion of the first data, wherein the retained portion of the first data is separate from the filtered portion of the first data; and analyzing the second data and the retained portion of the first data, wherein analyzing includes classifying the activity associated with the second service, and wherein classifying distinguishes the unauthorized activity from the authorized activity associated with the second service.