Source-linked AI summary
Machine learning methods to detect money laundering in the Bitcoin blockchain in the presence of label scarcity
Joana Lorenz, Maria Inês Silva, David Aparício, João Tiago Ascensão, Pedro Bizarro
TL;DR
Money-laundering detection in Bitcoin is difficult because labeled transactions are scarce, limiting traditional supervised learning. The paper benchmarks unsupervised anomaly detection on real data and proposes active learning, which matches a supervised baseline with 5% of labels while unsupervised methods perform poorly.
Problem
Bitcoin money-laundering detection requires methods that work with few labels because institutions often lack large-scale labeled datasets.
Method
The paper benchmarks unsupervised anomaly detection on real Bitcoin transactions and progressively acquires informative labels to train a supervised classifier with active learning.
Results
Active learning achieves performance similar to the best supervised baseline using just a few hundred labels, or 5% of the total, while unsupervised anomaly detection performs poorly.
Takeaways & Limitations
Real-life Bitcoin experiments are important because feature-space anomalies are not indicative of illicit behavior, whereas limited targeted labeling can support effective detection.
Takeaways & Limitations
The class distribution and labeling strategies should be examined on other real-life datasets and across financial domains such as bank transfers, deposits, and loans.
Abstract
from arXiv · showhide
Every year, criminals launder billions of dollars acquired from serious felonies (e.g., terrorism, drug smuggling, or human trafficking) harming countless people and economies. Cryptocurrencies, in particular, have developed as a haven for money laundering activity. Machine Learning can be used to detect these illicit patterns. However, labels are so scarce that traditional supervised algorithms are inapplicable. Here, we address money laundering detection assuming minimal access to labels. First, we show that existing state-of-the-art solutions using unsupervised anomaly detection methods are inadequate to detect the illicit patterns in a real Bitcoin transaction dataset. Then, we show that our proposed active learning solution is capable of matching the performance of a fully supervised baseline by using just 5\% of the labels. This solution mimics a typical real-life situation in which a limited number of labels can be acquired through manual annotation by experts.
1 INTRODUCTION
The paper targets money-laundering detection in Bitcoin when labels are scarce, evaluating unsupervised methods and active learning against supervised detection. It benchmarks real-world data and reports that active learning can match supervised performance with approximately 5% of labels.
- 1 INTRODUCTION: Money laundering creates global harm, while cryptocurrencies provide a setting in which criminals benefit from pseudonymity.The paper situates Bitcoin AML within broader financial-crime and regulatory concerns.
- 1 INTRODUCTION: Rule-based AML systems can have high false-positive rates and low detection rates, motivating machine-learning methods that infer more complex patterns.Machine learning is presented as a way to overcome the rigidity of publicly available rule sets.
- 1 INTRODUCTION: Active Learning matches a supervised baseline using approximately 5% of the labels, addressing detection when only limited expert annotation is available.The setting is intended to mimic limited availability of human analysts for manual labeling.
- 1 INTRODUCTION: The study benchmarks illicit-activity detection methods on a real-world cryptocurrency dataset with a relatively large number of positive cases.This addresses the common evaluation limitation of synthetic data or real data with few positive samples.
- 1 INTRODUCTION: The paper presents itself as the first work to apply active learning to AML on a large transaction dataset in the cryptocurrency setting.The contribution focuses on operating under minimal access to labels.
2 RELATED WORK
Prior AML research commonly treats illicit cases as outliers, but heterogeneous datasets and labeling practices make comparisons difficult. The paper therefore benchmarks anomaly detection on labeled real-world cryptocurrency data and studies active learning under label scarcity.
- 2 RELATED WORK: Prior work commonly models licit behavior and identifies illicit instances as behavioral outliers.This assumption underlies many unsupervised anomaly-detection approaches.
- 2 RELATED WORK: Anomaly-detection results across prior AML studies are difficult to compare because evaluations use heterogeneous real, simulated, and unlabeled datasets.Reported outcomes include low false-positive rates and good detection rates, but the setups differ substantially.
- 2 RELATED WORK: The paper questions whether anomaly detection is reliable on non-synthetic data because criminals may intentionally mimic normal behavior.It contributes an in-depth benchmark on a labeled real-world cryptocurrency dataset against a supervised baseline.
- 2 RELATED WORK: Cryptocurrency AML studies remain scarce and inconclusive because labels for evaluation are limited.Existing studies report both strong supervised performance and low detection rates for unsupervised methods in highly imbalanced data.
- 2 RELATED WORK: Active learning reduces labeling needs by iteratively selecting informative unlabeled instances for manual annotation and classifier training.Earlier work applied this approach to 92 real-life accounts and reported accurate threshold estimation with 22% of labels.
3 EXPERIMENTAL SETUP
The experiments use sequential Bitcoin transaction graphs to benchmark supervised, unsupervised anomaly-detection, and active-learning methods under limited-label conditions.
- 3.1 Data: 49 Bitcoin transaction graphs sampled at sequential time-steps form the experimental dataset.Each graph is a directed acyclic graph covering approximately two weeks of blockchain transactions.
- 3.1 Data: The dataset contains 203,769 transactions with 166 features, but only 2% are labeled illicit and most transactions are unlabeled.Licit and illicit categories are assigned from the category of the Bitcoin address that created each transaction.
- 3.2.2 Unsupervised Learning: Seven anomaly-detection algorithms are benchmarked, including LOF, KNN, PCA, OCSVM, CBLOF, ABOD, and Isolation Forest.The methods use different anomaly scores, so evaluation varies the contamination level from 0 to 1 in increments of 0.05.
- 3.2.3 Active Learning: Active learning progressively queries informative unlabeled instances, adds their labels to the labeled pool, and retrains a supervised classifier.The study compares uncertainty sampling, expected model change, elliptic envelope, Isolation Forest, and random sampling.
4 RESULTS
The results show that unsupervised anomaly detection performs substantially worse than supervised classification on the real Bitcoin dataset, whereas active learning can approach supervised performance with limited labels. Performance improves as active learning uses more informative labeled samples, especially under stronger class imbalance.
- 4.2 Anomaly detection: Anomaly detection methods perform significantly below the RF supervised baseline across all contamination levels.Table 1 compares illicit F1-scores across contamination levels, using the RF model as the reference baseline.
- 4.2 Anomaly detection: In the real Bitcoin dataset, illicit transactions are not outliers, so Isolation Forest identifies many outlying instances without reliably identifying illicit cases.UMAP comparisons show that predicted outliers and true illicit instances occupy different regions of the test-set projection.
- 4.3 Active learning: Switching from unsupervised warm-up learners to supervised hot-learners significantly improves active-learning performance, although no hot-learning policy is clearly best.Table 2 summarizes average illicit F1-scores for the tested classifiers and active-learning setups.
- 4.3 Active learning: RF active learning reaches the supervised baseline with 5% of the original labels, or 1500 of 30000, while near-optimal performance appears with 500 labels.Across classifiers, performance stabilizes after 1000 labels, with RF and XGBoost improving fastest.
- 4.3 Active learning: Random sampling improves faster than anomaly-detection warm-ups, while active-learning strategies increasingly outperform random sampling as class imbalance increases.At higher imbalance, the strongest setup uses random sampling for warm-up followed by uncertainty sampling.
5 CONCLUSION
The study evaluates illicit-activity detection on the Elliptic Bitcoin dataset under restricted label access. Unsupervised anomaly detection performs poorly, while Active Learning reaches performance similar to the supervised baseline with 5% of labels; broader validation remains open.
- The experiments compare supervised, unsupervised, and Active Learning detection under restricted access to labels.The supervised setting follows Weber et al. as a baseline, while the other settings reflect more limited label availability.
- Unsupervised anomaly detection methods have poor performance on the real Bitcoin transaction dataset.The study presents evidence that feature-space anomalies are not indicative of illicit behaviour.
- 5% of the labels yields performance similar to the best supervised baseline using Active Learning.The setting uses a few hundred labeled instances and represents limited availability of human analysts for manual labeling.
- Whether the observed class distribution generalizes to other real-life datasets and labeling strategies remains unexplored.The authors also call for comparable benchmarks on other financial-data verticals using real datasets with proper labels.
Note on reproducibility
The paper provides reproducibility code for Sections 4.1 and 4.2, but excludes the Active Learning experiments.
- Reproduction code covers Sections 4.1 and 4.2 but excludes the Active Learning experiments for intellectual property reasons.