PaperlayerView exact revision on arXiv

Source-linked AI summary

Population-Calibrated Graph Screening at 835-Million-Address Scale, with Label-Free Transfer to New Chains

Yury Korolev

arXiv:2609.03036v1cs.CRcs.LG

TL;DR

Compliance screening often relies on registry lookups and clustering, while labels are sparse and uneven across chains. The paper presents graph-based screening over a five-chain EVM substrate with exact population-calibrated thresholds. It reports label-free transfer to held-out chains and flags 40 of 68 external registry events in a static replay at a 0.1% budget.

  • Problem

    Public designation lists are small, lag activity by months to years, and are unevenly distributed across chains, limiting screening based only on labelled addresses.

    Source: §1 · pp. 1–2

  • Method

    The system scores addresses from a shared inductive graph representation over five EVM chains, using per-chain population calibration and two scoring heads.

    Source: §1 · p. 2

  • Results

    40 of 68 external registry events were flagged at a 0.1% population alert budget, a ×152 lift over the event-level random baseline, in a static replay.

    Source: §11 · p. 16

  • Takeaways & Limitations

    The reported results include transfer to Base, Arbitrum, and Gnosis without target-chain labels in head training, alongside a serving path bit-identical to the offline artefact at p50 151 ms.

    Source: §11 · p. 16

    The lead-time replay uses features aggregated over complete address histories, so it does not establish that the signal was extractable at first appearance.

    Source: §9 · p. 14

Abstract

from arXiv · show

Compliance screening of blockchain addresses is, in practice, a lookup against sanctions registries plus clustering heuristics; it fails on unlabelled addresses and on chains with no label coverage at all. We describe a deployed system that scores an address by its position in a multi-chain transaction graph rather than by its presence in a list. The substrate is a single graph of 835,330,427 addresses and 15,826,261,934 edges across five EVM chains; a shared inductive encoder with per-chain normalisation feeds two scoring heads. Decision thresholds are exact quantiles of the score distribution over the full population, scanned per chain segment, so the alert volume is known in advance. We report: label-free transfer: heads trained on two chains recall 0.8598 / 0.8182 / 0.9967 of held-out positives on Base, Arbitrum and Gnosis at a $10^{-3}$ population alert rate, with no target-chain labels in head training; a static lead-time replay over 68 external registry events: 40 of 68 (58.8%) flagged at the 0.1% budget, $\times$152 over an event-level random-flagging baseline, with first on-chain appearance a median of 528.8 days (Ethereum) / 647.8 days (Tron) before public designation; a serving path whose score is bit-identical to the offline artefact at end-to-end p50 151 ms, gated by a 2,882-address drift panel; and an adversarial harness of eight recurrent reinforcement-learned archetypes that passes an 8-criterion degeneracy audit and, on a detector-independent snapshot, exposes a measured blind spot of the deployed heads against synthesised behaviour.

1 Introduction

The paper argues that label sparsity and uneven chain coverage constrain registry-based screening, motivating a graph-based screening signal and a five-chain EVM system. It also specifies limits on the claims and distinguishes released tooling from the closed data and deployed system.

1 Introduction

  • Label sparsity is the binding constraint: public designation lists are small, lag activity by months to years, and are unevenly distributed across chains.Doubling the labelled pool adds +0.018 recall on Ethereum and +0.014 on Tron, a real but modest return.Source: §1 · pp. 1–2
  • A model limited to labelled addresses inherits uneven label coverage, while a chain without labels has no answer when funds cross into it.The paper measures transfer by applying existing heads to chains that contributed no labels to training.Source: §1 · p. 2
  • The paper replaces estimated thresholds with exact population scans because sample-estimated thresholds can differ by roughly one histogram bin, or thousands of alerts at a 10^-3 budget.This makes the alert volume known in advance.Source: §1 · p. 2
  • The release includes label-production, simulator, detector-training, and evaluation tooling, but excludes trained weights, the substrate, embeddings, indices, and serving stack.The paper states that model figures are auditable rather than reproducible from the released tooling alone.Source: §1 · p. 2
  • 835,330,427 addresses and 15,826,261,934 edges across five EVM chains form one substrate for inductive graph screening rather than relying on target-chain labels.The contribution places screening signal in a graph representation, with contiguous per-chain index segments.Source: §1 · p. 2
  • The claims exclude cross-chain entity resolution, autonomous-agent class completeness beyond one chain, and detector improvement from adversarial co-training.Bitcoin screening uses a separate label-based path and is outside the five-chain EVM paper scope.Source: §1 · pp. 2–3

2 Related work

Prior work spans blockchain AML and crime-specific graph learning, scalable inductive representations, forensic measurement, agent screening, adversarial simulation, and evaluation discipline. This paper distinguishes itself by evaluating a five-chain population operating point against external ground truth rather than a single curated labelled dataset.

2 Related work

  • Prior blockchain graph-learning work addresses scalability, illicit-transaction benchmarks, crime-specific detection, label scarcity, larger ground truth, and synthetic labelled behaviour.The cited line includes Elliptic Bitcoin [34], Ethereum phishing approaches, and label-scarcity work.Source: §2 · p. 3
  • The evaluation unit differs from prior single-chain curated-label results: this paper reports five chains, full-population operating points, and ground truth external to the label pipeline.It omits a standard public benchmark result because its recorded Elliptic run lacks a validation split and uses an incomparable F1 protocol.Source: §2 · p. 3
  • The neighbour-sampling inductive encoder supports materialising embeddings for 835M nodes once and scoring a new address by lookup rather than retraining.Prior web-scale and partition- or subgraph-sampling regimes establish graph trainability, while serving consequences are less reported.Source: §2 · p. 4
  • Forensic tracing of criminal revenue pipelines motivates evaluation against real-world events, while cross-ledger work addresses a different problem from this paper’s transfer across chains.The paper reports that its block-diagonal graph does not support cross-chain identity claims.Source: §2 · p. 4
  • The second screening head separates autonomous agents from illicit addresses because automated activity may be non-illicit and otherwise produce alerts operators cannot action.The paper audits this class against its own prior.Source: §2 · p. 4
  • The paper’s adversarial policies build on recurrent-policy POMDP methods, PPO [28], and league-style opponent snapshots [7], with design choices tested by ablation.Agent-based simulators are established for evaluating controls against generated financial behaviour.Source: §2 · p. 4
  • Exact population scans, static-replay conventions, and independent evaluation snapshots address known threshold, temporal, and sampling pitfalls in deployed evaluation.The related work notes neural miscalibration and security-measurement bias.Source: §2 · p. 4

3 Substrate

The substrate combines five chains in one node space with address-history features and a provenance-tracked label store. Its layout supports per-chain normalisation and population calibration.

3.1 What is in the graph

  • A single node space gives each node a globally unique identifier and assigns each chain a contiguous index segment.Per-chain segment sizes in Table 1 sum to the node count, providing a printed consistency check.Source: §3.1 · p. 5, Table 1 · p. 5
  • Node features aggregate structural and behavioural transaction-history measures, including counts, value statistics, temporal spread, counterparty diversity, and contract-interaction ratios.The paper does not carry an effective-dimensionality claim for the current 25-feature line.Source: §3.1 · p. 5

3.2 Labels

  • The v8 training label set has 301,304 provenance-recorded rows, while the v5 serving store has 202,369 keys and no keys outside schema.Public lists, attribution repositories, and harvested public sources supply labels; provenance supports the autonomous-agent class audit.Source: §3.2 · p. 5

4 Model

The model uses two heads over a shared, per-chain-normalised graph encoder, with either-head recall evaluated at a population alert rate. Exact full-population quantiles set thresholds and reveal chain-specific departures between nominal and realised alert rates.

4.1 Task and metric

  • The product metric is either-head recall at a fixed population alert rate, because a single head over a union pool understates recall by construction.An earlier iteration measured 0.44 single-head versus 0.596 either-head recall on the same checkpoint.Source: §4.1 · pp. 5–6

4.2 Encoder

  • The shared trunk is a three-layer GraphSAGE with mean aggregation over 25 features, while per-chain LayerNorm feeds separate ai_agent and fincrime MLP heads.The trunk uses width 128, batch normalisation and ReLU after each convolution, and dropout 0.3 after the first two layers.Source: §4.2 · p. 6

4.3 Training

  • Only the warm-start training arm was run, so the paper claims warm-starting was sufficient but not necessary; 5,222 token-tail ai_agent labels were excluded.The training run lasted 81.1–82.3 minutes on one 8×A100 node; embedding emission took 122.4–124.7 minutes on a second identical node.Source: §4.3 · p. 6

4.4 Calibration by exact population scan

  • Exact thresholds scan every score in each chain segment, rather than estimating a population quantile from a negative sample.The sample estimate and exact scan differ by about one bin, approximately 1.35% of the count; the paper distinguishes population alert rate from false-positive rate because population positives are unknown.Source: §4.4 · pp. 6–7
  • At a nominal 10^-2 budget, Gnosis has a 0.0486 threshold because its scores are compressed toward zero; Base flags 281 addresses at 10^-4 versus about 13,141 expected, as tied scores create a plateau.The scan reports realised counts, and cross-chain recall at a nominal rate should be read alongside those counts.Source: §4.4 · p. 7, Table 2 · p. 7

5 Label-free transfer to new chains

Supervised heads transfer to Base, Arbitrum, and Gnosis without target-chain labels, recalling 82–100% of held-out positives at a 0.1% population alert budget.

5 Label-free transfer to new chains

  • The heads use no target-chain labels, but the shared encoder sees target-chain structure unsupervised, and normalization and thresholds use target-chain population statistics.Evaluation holds out 20% of each chain’s labelled positives, samples 500,000 negatives per chain, and applies the population threshold.Source: §5 · p. 7
  • 82–100% of held-out positives were recalled at a 0.1% population alert budget on the target chains.The reported transfer result is for Base, Arbitrum, and Gnosis, evaluated at the served thresholds.Source: §5 · pp. 7–8, Table 3 · p. 8
  • Gnosis’s 0.9967 recall is the least informative result because its threshold is the grid’s lowest, 0.5431, alongside a compressed score distribution.The paper reports the measurement but cautions against interpreting the high recall without this threshold and distribution context.Source: §5 · p. 8
  • A chain can join the screening surface before labels have been acquired for it.Source: §5 · p. 8

6 Evaluation

Evaluation measures recall at population alert budgets, compares the production line with its predecessor, and tests a static replay against external registry events. The results also audit label leakage and the composition of the autonomous-agent class.

6.1 Per-chain recall grid at population thresholds

  • At 10^-3, Ethereum either-head recall was 0.8427, below fincrime-only recall of 0.8537 on the fincrime subset as 10,007 weaker-head agent positives entered the union.The Ethereum ai_agent head alone reported 0.9772 / 0.7853 / 0.2881 at τai 0.6503 / 0.8837 / 0.9636.Source: §6.1 · p. 8, Table 4 · p. 8

6.2 Headline pooled figures

  • At the 10^-3 population alert rate, either-head recall was 0.8314 on Ethereum and 0.5783 on Tron.The reported standard deviations were 0.008 across folds for Ethereum (n = 22,621) and 0.048 for Tron (n = 1,482).Source: §6.2 · p. 9

6.3 Comparison against the previous production line

  • All five chains improved over the previous production line: Ethereum +0.0707, Tron +0.0128, Base +0.0080, Arbitrum +0.0364, and Gnosis +0.0033.A controlled feature-only baseline reached 0.837 leak-free test recall at 10^-3, versus 0.9289 for the graph, and fell 0.2–0.3 behind on Base and Arbitrum.Source: §6.3 · p. 9

6.4 Leakage control and label scaling

  • After held-out positives were checked against every training pool, test-split recall was 0.9289; doubling labels added +0.018 recall on Ethereum and +0.014 on Tron.The label-scaling gains were measured across five folds in the earlier embedding space.Source: §6.4 · p. 9

6.5 Lead-time replay against external registry events

  • 40 of 68 external registry events were detected at the 10^-3 budget, versus 0.26 expected under event-level random flagging.The replay is static: 37 of 40 detections preceded publication, but the complete-history features do not establish an early warning; median first-seen lead was 528.8 days for Ethereum and 647.8 days for Tron.Source: §6.5 · pp. 9–10, Table 5 · p. 10

6.6 Audit of the autonomous-agent class

  • All 10,007 agent-class positives had label-row explanations, with zero behavioural-only unexplained positives; protocol-level tags, not the motivating yield-contract hypothesis, were the largest contributors.The audit found that only eight addresses from that hypothesis reached training, accounting for 0.08% of the pool’s agent positives.Source: §6.6 · pp. 10–11

7 Serving

Serving retrieves a materialised address embedding, scores it with both heads, and applies the address’s chain threshold. Exact score reproduction and explicit degradation behavior are acceptance gates.

7.1 The path an address takes

  • A screening call resolves an address through an 835,330,427-key index, reads its 128-dimensional embedding, evaluates both heads, and compares against the per-chain threshold.End-to-end authenticated HTTPS latency was p50 151 ms and p95 256 ms (n = 15, one warm address).Source: §7.1 · p. 11

7.2 Bit-exactness and honest degradation as acceptance gates

  • Every model swap must reproduce scores exactly across a 2,882-address drift panel; the adversarial campaign returned exact zeros across all three transfer chains.A well-known mixer contract’s deployed score was bit-identical to its offline computation.Source: §7.2 · p. 11
  • For an unserved chain or unreachable scoring tier, the API returns an explicit degradation flag rather than a fabricated score.An unserved chain receives a null score with a detector_unserved_chain flag.Source: §7.2 · p. 11

8 An adversarial harness for this class of detector

The section evaluates eight recurrent adversary archetypes, first auditing whether their policies avoid collapse and then testing deployed-head scores under different evaluation snapshots. It finds the heads do not separate generated activity from background on a detector-independent snapshot, while bounding what the simulator and fingerprint comparisons establish.

Result 1 — the policies are non-degenerate

  • The 8-criterion degeneracy audit passes 8/8 on two runs and 7/8 on a third, while entropy stays above zero across all 13 checkpoints for the previously collapsed archetypes.The third-run failure is single-rejection-code concentration (0.72 against a 0.70 threshold).Source: §8 · p. 12

Result 2 — what fixed the collapse

  • With embeddings zeroed, the ablation still passes 7/8, identifying recurrence—not structural embeddings—as the fix for policy collapse.This contradicted the authors’ pre-specified hypothesis that informative embeddings plus recurrence would resolve collapse.Source: §8 · p. 12

Result 3 — long-horizon stability

  • At 604–621 steps per archetype, action entropy remains 1.270–1.889 with no collapse, while concentrated rejection codes are attributed to simulated-environment constraints.The reported concentrations are bridge-liquidity rejection for the regulatory arbitrageur and slippage rejection for the agent coordinator.Source: §8 · p. 12

Result 4 — evaluation snapshots are part of the threat model

  • On an independently drawn snapshot, all eight archetypes are blind spots; detector-stratified seeding instead makes every archetype read as detected.The largest elevation over background on the random snapshot is +0.0366 against a 0.1092 baseline mean, below the pre-set +0.05 threshold.Source: §8 · p. 12

Fingerprint-level reading

  • The 78-dimensional fingerprint comparison uses the simulator’s later generations as references, so its similarity scores do not establish resemblance to the detector’s training set.The address-level training pools do not have bundle-level fingerprints.Source: §8 · p. 13

What this section does not claim

  • The adversarial findings concern generated behavior and evaluation methodology, not real-market forecasting or an improvement from co-evolving the detector.The simulator’s role is to generate structurally plausible behavior; detector co-evolution is not measured.Source: §8 · p. 13

9 Limitations

The reported evidence is bounded by chain coverage, data and evaluation protocols, and unfinished infrastructure. In particular, the paper does not claim cross-chain identity, global community structure, served retrieval, or results beyond its five-chain EVM scope.

L1 — Tron is our weakest chain

  • Tron is the weakest chain: either-head recall is 0.5783 at population alert rate 10^-3, versus 0.8314 on Ethereum, on only 1,482 positives.The authors attribute the gap to label coverage, and report that gradient boosting matches the graph on Tron.Source: §9 · p. 13

L2–L3 — Cross-chain entity resolution

  • Cross-chain entity resolution fails on these embeddings: cluster purity is 0.410 on Ethereum and 0.333 on Tron, and none of 168 candidate pairs resolve across chains.The graph is block-diagonal by construction; the paper distinguishes per-chain transfer from cross-chain identity capability.Source: §9 · p. 13

L4 — The dead-column census

  • The dead-column census used an earlier 20-feature epoch, so the paper makes no effective-dimensionality claim for the current 25-feature transfer line.The current matrix has not been recounted after aggregate features were backfilled on Base, Arbitrum, and Gnosis.Source: §9 · pp. 13–14

L5–L6 — Evaluation coverage and lead time

  • The autonomous-agent evaluation pool is Ethereum-only, and the lead-time replay is static rather than time-censored.The 528.8-day Ethereum median reflects first on-chain appearance for flagged addresses using complete-history features; whether the signal was available at first appearance is unestablished.Source: §9 · p. 14

L7–L8 — Threshold comparability and latency

  • Nominal alert-rate points do not realise equally across chains, and the end-to-end latency sample is small while the larger server-side sample excludes network and API time.The server-side distribution is chunk-cache-bound, not compute-bound.Source: §9 · p. 14

L9–L10 — Clustering and retrieval

  • Full-graph clustering has not completed, and retrieval is not served; its index also lags the substrate by one epoch.The clustering build exceeded single-device memory, while retrieval measurements cover 686M vectors against 835M nodes and the endpoint is outside the serving path.Source: §9 · p. 14

L11–L12 — Scope and public benchmark

  • The five-chain EVM claims do not cover Bitcoin, and no public Elliptic benchmark result is reported because the recorded run did not meet the paper’s protocol standard.The deployed Bitcoin path is separate and label-based.Source: §9 · p. 14

L13–L15 — Harness bounds and self-supervision

  • The adversarial results are simulator- and methodology-specific, while the self-supervised recipe scores 0.559–0.570 against 0.642 for the supervised one.Long-horizon rejection-code concentration is attributed to environment constraints, and fingerprint references come from simulator generations rather than the detector’s training subgraph.Source: §9 · pp. 14–15

10 Ethics, dual use and data provenance

The paper uses public blockchain data and public-source labels, while limiting claims about identity linkage and constraining release of adversarial artefacts. It also describes population-budget thresholds and label-based precedence as safeguards relevant to deployment harms.

Data

  • All chain data and label sources are public, and the authors do not link addresses to natural persons or combine them with off-chain identity data.No human subjects, user studies, or personal-data collection were involved.Source: §10 · p. 15

Dual use

  • The adversarial work is dual-use, so policy checkpoints, environment configuration, and generated bundles are withheld while aggregate results and detector-side artefacts are released.The stated release is sufficient for the methodological claim but not an evasion recipe.Source: §10 · p. 15

Deployment harms

  • Because false positives can freeze legitimate funds, thresholds are expressed as population budgets and registry label verdicts take precedence over model scores at serve time..Source: §10 · p. 15

11 Conclusion

The conclusion centers on label-free transfer, population-calibrated thresholds, and retrospective detection of external registry events, with additional serving and adversarial-evaluation results. The appendices distinguish publicly runnable label tooling from internal artefacts that are auditable but not third-party reproducible.

11 Conclusion

  • The five-chain system reports label-free transfer, exact population-quantile thresholds, and 40 of 68 registry events flagged at the 0.1% budget, with a ×152 lift over the event-level random baseline.For Base, Arbitrum, and Gnosis, held-out-positive recall is 0.8598 / 0.8182 / 0.9967; the Ethereum median first-appearance lead is 528.8 days under a static-replay convention.Source: §11 · pp. 15–16
  • The serving path is bit-identical to the offline artefact at p50 151 ms, while the adversarial contribution is a paired-snapshot experiment showing evaluation depends on drawing snapshots independently of the detector.The conclusion also states that the system does not provide cross-chain identity, full-graph community structure, or served retrieval.Source: §11 · p. 16

A.1 Label-tooling path (third-party runnable, released)

  • The released label tooling builds tag packs from public sources, and a clean clone run reproduces the same output by sha256 verification.The release includes scrapers for nine jurisdictions and registry builders; regulator dumps and third-party aggregator-derived data are excluded where redistribution is not permitted or included.Source: §A.1 · pp. 18–19

A.2 Internal-artefact path (auditable, not publicly runnable)

  • Internal figure production is auditable from pinned artefacts, but not claimed to be third-party reproducible because the substrate is hundreds of gigabytes over a graph the authors built.A reviewer with access can rerun one command and compare output byte for byte.Source: §A.2 · p. 19

A.3 What a reviewer can check without our data

The appendix documents how reported measurements can be checked, clarifies what is withheld, and audits the external-event replay and feature-only comparison.

A.3 What a reviewer can check without our data

  • Reviewers can recompute segment totals, flagged counts, embedding-store size, replay detection rates, and lifts from the printed counts and stated rates.The appendix identifies these as checks possible without access to the underlying data.Source: §A.3 · p. 19

A.4 What we do not release

  • The paper does not release trained weights, the graph substrate, embeddings, address and provenance indices, serving stack, or adversary-side artefacts.The passage directs readers to Sect. 10 for the reasoning.Source: §A.4 · p. 19

A.5 Training details

  • Training combines agent and fincrime binary-cross-entropy losses at weights 0.3 and 0.7, uses measured positive-class weights, and applies a stratified seed-42 split.The test set is 10%; validation is 10% of the remainder, and the stated early-stop rule never triggered. A token-derived Ethereum tail was routed to the last chain’s normalisation block; the fix preserved byte-identical parameters.Source: §A.5 · pp. 19–20

B Number provenance

  • Table 6 maps figure groups to measurement classes, while the paper withdraws a public-benchmark result for protocol defects and a single-chain result that did not hold at served operating points.The withdrawn benchmark used top-k rather than threshold F1, lacked a validation split, reported an intermediate-epoch test AUC, and had no retained producer script.Source: B Number provenance · p. 20, Table 6 · p. 21

C The external-event registry: audit of the 68-event replay

  • The replay includes Ethereum and Tron events only when registry entries contain an address on an indexed chain, and its audited lead medians are 528.8 and 647.8 days, respectively.The replay uses the fincrime head at each chain’s 10^-3 population threshold; the either-head variant detects one more event but is not reported throughout.Source: C The external-event registry: audit… · p. 22

D Feature-only baselines

  • Gradient boosting is close to the graph model on Ethereum, at parity on Tron, and 0.2–0.3 recall lower on Base and Arbitrum with the same labels.The comparison uses engineered features and each model’s population threshold at an alert rate of 10^-3.Source: D Feature-only baselines · p. 23, Table 9 · p. 24

E Deployment lessons

  • Exact population quantiles over 835M nodes require scanning every score; at a 10−3 budget over 323M addresses, a negative-sample threshold applied to the population can be off by about a bin—thousands of alerts.Threshold provenance determines whether an operator can state alert volume in advance.Source: E Deployment lessons · p. 25
Loading 2609.03036v1…