Source-linked AI summary
Anti-Money Laundering in Bitcoin: Experimenting with Graph Convolutional Networks for Financial Forensics
Mark Weber, Giacomo Domeniconi, Jie Chen, Daniel Karl I. Weidele, Claudio Bellei, Tom Robinson, Charles E. Leiserson
TL;DR
AML systems must detect illicit transactions while avoiding financial exclusion caused by compliance burdens. The paper contributes the Elliptic Data Set and compares feature-based, graph-based, and temporal graph models for Bitcoin transaction classification. Random Forest outperforms Logistic Regression and GCN, while temporal EvolveGCN consistently outperforms nontemporal GCN and the authors identify combining forest and graph methods as future work.
Problem
AML analytics must classify a small illicit minority in massive, growing data sets while reducing false positives without increasing false negatives.
Method
The paper publicly releases the Elliptic Data Set and evaluates Logistic Regression, Random Forest, MLP, GCN, Skip-GCN, and EvolveGCN for illicit-transaction classification.
Results
Random Forest significantly outperforms Logistic Regression and GCN, while EvolveGCN consistently outperforms GCN with a nonsubstantial improvement on this data set.
Takeaways & Limitations
The results motivate algorithmic work combining Random Forest’s performance with graph methods’ relational information.
Takeaways & Limitations
All methods perform poorly after a dark-market shutdown, and even repeatedly retrained Random Forest cannot reliably capture new illicit transactions afterward.
Abstract
from arXiv · showhide
Anti-money laundering (AML) regulations play a critical role in safeguarding financial systems, but bear high costs for institutions and drive financial exclusion for those on the socioeconomic and international margins. The advent of cryptocurrency has introduced an intriguing paradox: pseudonymity allows criminals to hide in plain sight, but open data gives more power to investigators and enables the crowdsourcing of forensic analysis. Meanwhile advances in learning algorithms show great promise for the AML toolkit. In this workshop tutorial, we motivate the opportunity to reconcile the cause of safety with that of financial inclusion. We contribute the Elliptic Data Set, a time series graph of over 200K Bitcoin transactions (nodes), 234K directed payment flows (edges), and 166 node features, including ones based on non-public data; to our knowledge, this is the largest labelled transaction data set publicly available in any cryptocurrency. We share results from a binary classification task predicting illicit transactions using variations of Logistic Regression (LR), Random Forest (RF), Multilayer Perceptrons (MLP), and Graph Convolutional Networks (GCN), with GCN being of special interest as an emergent new method for capturing relational information. The results show the superiority of Random Forest (RF), but also invite algorithmic work to combine the respective powers of RF and graph methods. Lastly, we consider visualization for analysis and explainability, which is difficult given the size and dynamism of real-world transaction graphs, and we offer a simple prototype capable of navigating the graph and observing model performance on illicit activity over time. With this tutorial and data set, we hope to a) invite feedback in support of our ongoing inquiry, and b) inspire others to work on this societally important challenge.
1 TOWARD FINANCIAL INCLUSION
AML regulations are essential for safeguarding financial systems but can restrict access and impose high costs on people and businesses at society’s margins. Bitcoin’s pseudonymity creates risks for investigators, while its public transaction data creates opportunities to reconcile financial safety with inclusion.
- 1.7 billion adults are unbanked, while stringent AML regulations disproportionately affect low-income people, immigrants, and refugees.
- $529 billion in 2018 global remittances faced an average sending cost of 7 percent, compared with the Sustainable Development Goal target of 3 percent by 2030.
- AML compliance imposes high fixed costs and noncompliance penalties on money service businesses, making low-value customers less attractive.
- Money laundering causes substantial harm through illicit industries and scandals involving taxpayer funds and large illicit money flows.
- Bitcoin’s pseudonymity can help criminals hide, whereas public transaction data gives investigators access to the full graph network despite pseudonymous, unlabelled identities.
2 THE ELLIPTIC DATA SET
The Elliptic Data Set is a publicly shared, labelled graph of Bitcoin transactions designed to support cryptocurrency AML research. It combines transaction-level, one-hop neighbourhood, temporal, and heuristic labelling information, while aggregated features lose some graph-structure information.
- The data set labels transactions as licit or illicit by mapping them to real entities and representing BTC flows as directed graph edges.
- The Elliptic Data Set contains 203,769 transaction nodes, 234,355 directed payment-flow edges, and 166 features per node.
- 2 percent of transactions are labelled illicit and 21 percent licit, while the remaining transactions are unlabelled for licitness.
- The first 94 features describe local transaction information, while 72 aggregated features summarize one-hop backward and forward neighbourhood information.
- The data comprise 49 time steps spaced about two weeks apart, with each step forming a separate connected component and no cross-step edges.
- The 72 aggregated features use simple statistics over heterogeneous neighbourhoods, which can significantly lose information about local graph topology.
3 TASK AND METHODS
The task is to classify illicit versus licit Bitcoin transactions in massive, imbalanced data, comparing feature-based benchmarks with graph-based and temporal graph models. GCNs aggregate transformed neighbourhood embeddings, while EvolveGCN updates GCNs over time using recurrent dynamics.
- 3 TASK AND METHODS: AML analytics screens unlabelled Bitcoin transactions by classifying each as illicit or licit, with emphasis on detecting the minority illicit class.
- 3.1 Benchmark Methods: The benchmark methods use the first 94 features for supervised binary classification with Logistic Regression, Multilayer Perceptron, and Random Forest.
- 3.2 Graph Convolutional Networks (GCN): GCNs extend feed-forward layers with neighbourhood aggregation, using adjacency information to update node embeddings and produce prediction probabilities.
- 3.2 Graph Convolutional Networks (GCN): Skip-GCN adds a connection from intermediate embeddings to input features and reduces to Logistic Regression when both learned graph-layer weights are zero.
- 3.2 Graph Convolutional Networks (GCN): EvolveGCN computes a separate GCN at each time step and connects successive models through a recurrent neural network to capture system dynamics.
4 EXPERIMENTS
The experiments compare standard classifiers, GCN variants, and temporal graph models for illicit-transaction prediction under a temporal train/test split. Random Forest performs best overall, while graph-enhanced features and temporal modeling provide additional benefits, but robustness to emerging events remains difficult.
- Experimental setup: The evaluation uses the first 34 time steps for training and the last 15 for testing in a 70:30 temporal split.This temporal split places GCN in an inductive setting.
- Experimental setup: The models are evaluated with all 166 features and with only the first 94 local features, alongside GCN-based experiments.The study includes Logistic Regression, Random Forest, MLP, and GCN variants.
- Classification results: Random Forest achieves the best illicit F1 score, while GCN and Skip-GCN outperform Logistic Regression.The results indicate both informative input features and useful graph-based representations.
- Feature and graph effects: Aggregated information improves accuracy for all three evaluated models, and enhanced feature sets improve performance with both AF + NE and LF + NE.The comparisons indicate that graph information can enhance transaction representations even for standard machine-learning models.
- Temporal modeling: EvolveGCN consistently outperforms GCN, although the improvement is not substantial on this data set.The temporal model connects time-specific GCNs through recurrent updates to capture system dynamics.
- Robustness: After the dark market shutdown at time step 43, all methods perform poorly, and even repeatedly retrained Random Forest cannot reliably capture new illicit transactions.Robustness to emerging events is identified as a major challenge.
5 DISCUSSION
Random Forest significantly outperforms Logistic Regression and GCN, despite GCN using graph structure. The discussion therefore considers combining Random Forest with graph neural networks, but leaves end-to-end integration for future work.
- Model comparison: Random Forest significantly outperforms both Logistic Regression and GCN, even though GCN uses graph-structure information.Random Forest ensembles decision trees, whereas GCN uses Logistic Regression as its final output layer.
- Hybrid models: Augmenting node features with GCN embeddings helps Random Forest only marginally according to prior experimentation.The paper describes this as one possible but limited route to combining the methods.
- Hybrid models: Replacing GCN’s Logistic Regression output layer with a differentiable decision tree could enable end-to-end integration, but execution is left for future investigation.This proposal is intended to incorporate graph information while retaining decision-tree modeling.
6 GRAPH VISUALIZATION
Chronograph combines time-aware graph visualization with model outputs to support AML analysis and explainability. It lets analysts compare transaction layouts, inspect neighborhoods, and identify potential model weaknesses over time.
- Chronograph integrates graph visualization with model representations to support human analysis and explainability in AML.The prototype represents model performance alongside high-dimensional transaction structure.
- Transactions are positioned globally across time with UMAP, while a time-step slider renders selected snapshots and colors illicit nodes red.Licit nodes are blue and unclassified nodes remain uncolored.
- Users can select transactions to highlight them in orange, their neighbors in green, and inspect graph statistics and transfers between transaction classes.
- Chronograph supports comparing UMAP projections based on raw features or final-layer activations, colored by actual labels or GCN predictions.These alternatives produce four network visualizations for a single time step.
- Model-based layouts concentrate illicit nodes, while nearby erroneous predictions can reveal qualitative differences or possible systematic underperformance.Examining such transactions may inform future model improvements.
7 SUMMARY
The paper presents Bitcoin forensics as an ecosystem for crowdsourcing AML methods, contributing labelled data, experimental results, and visualization tools. It concludes by encouraging further work toward safer and more inclusive financial systems.
- The paper frames cryptocurrency forensics, particularly Bitcoin, as an ecosystem for crowdsourcing methods against criminal activity.
- The authors contribute a large labelled transaction data set that was previously unavailable publicly.
- The work shares early experiments with multiple methods, including Graph Convolutional Networks, and discusses directions for algorithmic advances.
- Chronograph provides a prototype for visualizing transaction data and models to augment human analysis and explainability.