Cyber-Financial Contagion: Modeling the Propagation of an AI Vendor Compromise Through the Banking System

Alex Leytes

Source-linked AI summary

Cyber-Financial Contagion: Modeling the Propagation of an AI Vendor Compromise Through the Banking System

Alex Leytes

arXiv:2609.10350v1Sep 9, 2026cs.AIcs.CYcs.LG

TL;DR

The paper studies how compromise of a shared AI vendor can propagate through banking operations and financial networks. It combines a four-layer graph with the CFC-Prop epidemic-and-clearing model and trains CFC-GNN for vendor-level early warning. Synthetic experiments show sensitivity to patch latency and improved early-warning performance, while the authors identify simulator-generated labels and simplified impairment and co-vendor assumptions as key limitations.

Problem
Shared AI-vendor dependencies create a cyber-financial contagion channel whose operational and financial propagation requires more structured end-to-end analysis.
Method
The paper couples a four-layer vendor-bank-interbank-customer graph with CFC-Prop and trains CFC-GNN using vendor telemetry and graph structure.
Results
CFC-GNN shows a modest but consistent improvement over strong tabular baselines, while experiments show heavy-tailed losses and strong sensitivity to patch latency.
Takeaways & Limitations
The findings support treating AI-vendor concentration, patch cycles, and model integrity as first-order supervisory variables.
Takeaways & Limitations
The evaluation uses simulator-generated labels, simplifying co-vendor lateral movement and scalar bank impairment; real-world validation remains necessary.

Abstract

from arXiv · show

The banking system now depends on a small set of shared artificial intelligence vendors for fraud screening, credit decisioning, anti-money-laundering triage, customer analytics, and internal decision support. This paper studies how a compromise inside one of those vendors can propagate along a chain of operational, informational, and financial linkages until it triggers losses that look, from the outside, like a classical banking crisis. We build a four-layer heterogeneous network that couples AI vendors, financial institutions, interbank exposures, and customer accounts, and we propose CFC-Prop, a stochastic epidemic-and-clearing model that runs on that network. On a synthetic dataset with 60 vendors, 220 banks, roughly 2,500 vendor-bank service edges, and 1,400 interbank exposures, CFC-Prop reproduces the heavy-tailed loss distributions and the sharp dependence on patch latency that are consistent with prior cyber-financial evidence. We also train an early-warning model, CFC-GNN, that uses vendor-side incident telemetry and graph structure to flag high-cascade-risk vendors before impact. Across four baselines the proposed model reaches AUROC 0.82 and AUPRC 0.60 while keeping calibration errors bounded. We release the full code, synthetic data, and reproducible scripts. The results argue that cyber concentration among AI vendors is a first-order financial-stability problem and give supervisors a concrete quantitative tool for reasoning about it.

I. INTRODUCTION

The paper frames shared AI vendors as a missing link between cyber operational risk and financial contagion, then proposes coupled network models and an early-warning learner to analyze vendor-originated cascades.

Motivation: Shared AI vendors now mediate core banking activities, placing external technology providers between institutions and their customers.These services include customer interactions, credit decisions, and monitoring.
Motivation: A single vendor compromise can distort outputs across institutions and transmit operational and reputational shocks through interbank counterparties.The shock may reach counterparties before regulators detect it.
Research gap: Prior research treats financial contagion, shared-vendor operational risk, and cyber events largely in parallel, leaving their end-to-end connection less structured.The paper positions its contribution as bridging these literatures.
Contributions: The paper builds a four-layer heterogeneous graph linking AI vendors, banks, interbank exposures, and customer accounts.The model shifts analysis from individual customers toward vendors as systemic nodes.
Contributions: CFC-Prop couples vendor infection with bank impairment and interbank clearing, while CFC-GNN uses vendor telemetry and exposure structure to flag high-cascade-risk vendors.The learner is compared with logistic regression, random forest, gradient boosting, and multilayer perceptron baselines.
Results: CFC-GNN improves discrimination and calibration on a held-out synthetic dataset relative to the stated baselines.The paper presents this as an early-warning complement to the propagation model.

II. RELATED WORK

The related-work discussion connects financial contagion, cyber supply-chain security, and graph learning, while defining the heterogeneous network and threat assumptions used to join them.

Financial contagion: Financial-contagion research studies how interbank-exposure topology determines whether shocks are absorbed or amplified.Prior work includes clearing models, simulation-based contagion estimation, network fragility, and DebtRank centrality.
Cyber supply chains: Cybersecurity literature covers adversarial model attacks, supplier backdoors, data-side risks, and software supply-chain vulnerabilities.These works provide the threat background for vendor-originated model-integrity and availability failures.
Graph learning: Graph-learning applications in finance include fraud rings, transaction screening, and anti-money-laundering ranking, which motivates vendor-node risk scoring.Here, a vendor’s blast radius depends on the bank neighborhood it serves.
Synthesis: The paper’s novelty is coupling existing epidemic and clearing mechanisms on a graph where an AI service is the shared dependency.It also pairs this coupled dynamic with a supervisory early-warning learner.
Model setting: The graph contains vendor, bank, interbank-exposure, and customer-account layers, with vendor-bank service edges weighted by operational dependence.Vendors carry criticality, market share, and patch latency; banks carry assets, capital ratios, and AI-dependency scores.
Threat assumptions: The threat model includes availability, model-integrity, and data-exfiltration compromises, which are represented downstream as bank operational impairment.Impairment depends on service exposure and AI-dependency, while interbank losses follow bilateral exposures and fire-sale amplification.

IV. THE CFC-PROP AND CFC-GNN MODELS

CFC-Prop models vendor infection as a stochastic process that generates persistent bank impairment, while impaired banks transmit capital-sensitive shocks through interbank clearing.

Bank impairment: An infected vendor raises impairment for connected banks according to service exposure and bank AI-dependency.Each affected edge can add a random increment drawn from U(0.10, 0.35), subject to an impairment cap.
Vendor dynamics: Vendor infection spreads among co-vendors sharing a bank with probability α, and infected vendors recover with probability γ representing patch deployment.Recovered vendors remain immune during the modeled horizon.
Financial clearing: Impaired or defaulted banks transmit interbank shocks weighted by bilateral exposures and scaled by impairment or default state.A bank defaults when inbound shock exceeds a fraction of its regulatory capital after fire-sale amplification.
Outputs: The model records vendor infections, impaired banks, defaults, affected customers, and total system loss for every realization.These outputs support cascade-risk and loss-distribution analysis.
CFC-Prop: CFC-Prop is implemented as a discrete-time cascade over vendor, bank, interbank, and customer-linked structures.The run records infections, impaired banks, defaults, affected customers, and total loss over a finite horizon.

B. CFC-GNN: an early-warning learner

CFC-GNN treats supervisory monitoring as vendor-level cascade-risk classification, combining vendor telemetry with graph exposure features and lightweight predictive models.

Task: The early-warning task asks which vendor would trigger the largest bank cascade under a hypothetical compromise.The target is whether a vendor causes a bank cascade in an independent hold-out simulation window.
Features: Features combine vendor criticality, patch latency, market share, incident history, detection lag, cascade rate, bank degree, and exposure-weighted neighborhood assets.The feature design joins telemetry with structural measures of vendor reach.
Model: CFC-GNN stacks gradient-boosting and multilayer-perceptron predictions with a graph-degree adjustment to produce vendor risk scores.The model is trained from a feature matrix, labels, and the vendor-bank graph.
Integration: The early-warning learner complements CFC-Prop by identifying high-risk vendor nodes before a compromise occurs.CFC-Prop supplies the cascade framing, while CFC-GNN turns it into a node-level monitoring problem.
Extension: The customer-run extension converts withdrawals from sufficiently impaired banks into liquidity shocks and additional counterparty fire-sale losses.The base experiments set pr = 0, with sensitivity analyzed separately.

V. SYNTHETIC DATA

The synthetic system combines documented distributions for vendors, banks, dependencies, and exposures into a reproducible graph. Simulations show that losses are concentrated in top-critical vendors, grow super-linearly with criticality, and depend convexly on patch latency.

Data outputs: The simulation includes documented graph-generation outputs and associated telemetry files for studying coupled dynamics and early-warning learning.The pipeline emits seven CSV files and graph statistics for the synthetic system.
Generating distributions: Vendor criticality uses a shifted Pareto distribution, market shares use a symmetric Dirichlet distribution, and patch latency follows a truncated Gamma distribution.These choices model concentrated vendor infrastructure and patch-cycle variability.
Generating distributions: Bank assets vary by institutional tier, while capital ratios are sampled from a truncated normal distribution and AI dependency from a Beta distribution.Vendor-bank edges use preferential attachment weighted by vendor criticality and scaled by bank AI dependency.
Synthetic-data scope: The synthetic data are designed as a controllable, reproducible substrate rather than a jurisdiction-specific forecast.The authors state that distributional choices match reported concentration and exposure statistics but are not calibrated to a particular institution.
Cascade outcomes: Top-critical vendors produce long-tailed losses, whereas median losses are near zero for low-criticality vendors.The experiments use 150 trajectories across top, mid, and low vendor-criticality tiers.
Cascade outcomes: 8.3× is the top-to-mid mean-loss ratio, exceeding the corresponding 3.1× vendor-criticality ratio.The paper attributes this super-linearity to additional downstream connections that include more systemically important banks.
Sensitivity analysis: Patch-latency multipliers from 0.25× to 3.0× produce convex changes in peak impaired banks and 90th-percentile loss.The result supports aggressive patch-cycle service-level objectives for systemically important vendors.

D. Early-warning detection benchmark

The early-warning evaluation compares CFC-GNN with four baselines and examines calibration, robustness, ablations, and scenario severity. CFC-GNN provides a modest but consistent lift from combining telemetry and graph structure, with stable performance near selected defaults.

Benchmark results: CFC-GNN improves discrimination and calibration over the strongest baseline while remaining a simple, auditable model.The benchmark reports AUROC, AUPRC, and Brier score across four baselines and CFC-GNN.
Benchmark results: Graph structure gives a small but reliable lift over strong tabular learners.The improvement over gradient boosting is described as modest but consistent.
Hyperparameter sensitivity: Model quality remains stable across a wide neighborhood of the selected mixing weights and graph-degree correction.This sensitivity supports evaluating the score for supervisory adoption without relying on a narrow parameter setting.
Ablation analysis: Removing graph features lowers AUROC by roughly 0.020, while removing incident telemetry lowers it by 0.043.The ablation identifies structural and behavioral signals as complementary channels.
Stress scenarios: Peak impaired-bank count rises from 128 to 187 when two top-five critical vendors are seeded simultaneously.The accompanying 95th-percentile loss roughly doubles in this joint-cyber scenario.

VII. END-TO-END CASE STUDY

The case study follows a high-criticality vendor compromise from early telemetry changes through widespread bank impairment, interbank defaults, and systemic loss. CFC-GNN would have identified the vendor as high risk before impact.

V003, the highest-criticality vendor, served 194 banks and had patch latency in the 90th percentile.
Roughly 40% of banks reached impairment level xb ≥ 0.4 by day 4, triggering interbank shocks and some defaults.
Defaults formed a small, essentially irreversible tail while surviving-bank impairment plateaued as patches rolled out.
CFC-GNN would have flagged V003 as a top-decile risk using criticality, patch latency, and downstream degree.
A 9% inference-error increase appeared on selected routing keys before hard financial losses were booked.

D. Convexity in patch latency

The model links patch latency to epidemic persistence and then to convex tail losses from interbank fire-sale amplification. This motivates treating patch latency as a supervisory control parameter.

Expected impairment scales linearly with patch latency, while fire-sale effects create a super-linear tail in losses.
R0 ≈ 22.8 with k̄ ≈ 41, α = 0.10, and γ = 0.18, placing the synthetic system well above the epidemic threshold.
The expected impairment envelope increases monotonically with vendor criticality, service exposure, and bank AI dependency.
Interbank concentration makes a bank fragile when one sufficiently impaired counterparty exceeds its capital-adjusted shock threshold.
CFC-Prop and CFC-GNN can support vendor systemic-importance heatmaps, scenario analysis, and rolling supervisory watch lists.

C. Step 3: CFC-GNN early warning

CFC-GNN is positioned as a calibrated early-warning model that combines vendor telemetry with graph information. Its evaluation shows modest robustness and improved calibration relative to gradient boosting.

The model is intended to generate a confidential rolling watch list from real-time vendor telemetry rather than predict a specific attack.
Across a new graph realization, AUROC decreases from 0.817 to 0.791 and AUPRC from 0.597 to 0.552.
CFC-GNN’s expected calibration error is 0.041 versus 0.058 for gradient boosting.
CFC-GNN’s AUROC falls from 0.817 to 0.771 as telemetry noise increases to σ = 0.20, while gradient boosting falls to 0.734.
The customer-run extension raises 95th-percentile loss by roughly 18% at pr = 0.005 in the top-critical seed scenario.

F. Comparison against a network-only baseline

CFC-GNN outperforms structural and epidemic-only vendor-ranking baselines, while ranking stability and feature importance clarify why telemetry adds value. The synthetic setting remains a scope boundary for policy interpretation.

The weighted-exposure network baseline reaches AUROC 0.744 and AUPRC 0.502, below CFC-GNN.
The epidemic-only CFC-Prop ranking reaches AUROC 0.786 and AUPRC 0.548, below CFC-GNN because it omits incident-side telemetry.
With 2% label flips, the top-10 vendor ranking changes by at most two positions in more than 90% of trials.
The leading features are vendor bank-degree, incident severity, patch latency, criticality, and detection lag.
The synthetic concentration pattern supports studying vendor systemic importance but does not establish forecasts for a specific institution.

E. From alerts to capital

The paper sketches supervisory uses for CFC-GNN while emphasizing disclosure, calibration, simulator-label, and model-risk boundaries. It concludes that AI-vendor concentration, patch cycles, and model integrity are supervisory variables, but several extensions and real-world validations remain.

From alerts to capital: A vendor in the top decile of CFC-GNN, above a hard degree threshold, could trigger a proportional operational-risk buffer for exposed banks.The proposed bridge applies when a bank’s weighted service exposure exceeds a set fraction of Tier 1 capital.
From alerts to capital: AML impairment can delay laundering detection and downstream fraud losses, while compliance and reputational effects remain outside the model’s first-order impairment treatment.The eventual balance-sheet impact is described as a lagged function of the impairment period.
From alerts to capital: Real-world validity is limited because the vendor-vendor graph simplifies lateral movement and bank impairment is represented as a scalar rather than business-line-specific vector.Different business lines also receive different capital treatments.
From alerts to capital: CFC-GNN evaluation may be optimistic because training labels come from the same simulator that generates shocks, despite partial cross-graph checks.The paper identifies real-world validation as the ultimate test once vendor-exposure disclosures permit it.
From alerts to capital: Deployment is technically modest, but supervisors need granular per-bank vendor-dependency reports and a common service-category ontology.The paper identifies exposure disclosure as the heavier implementation task.
From alerts to capital: The learner favors auditability over deeper architectures, while future work targets real-exposure calibration, finer customer-run modeling, adversarial robustness, and privacy-preserving analytics.The paper explicitly weighs improved discrimination against additional model-risk overhead.

APPENDIX A NOTATION SUMMARY

The appendix records the graph notation, vendor-state variables, reproducibility pipeline, and the vendor-infection reproduction-number calculation. It also specifies the lightweight Python environment and fixed random seeds used for regeneration.

Notation: V and B denote the vendor and bank sets, while E_vb and E_ib denote vendor-bank and interbank edge sets.
Notation: c_v, m_v, and ℓ_v represent vendor criticality, market share, and patch latency; s_vb and w_ij represent service and interbank exposure.
Notation: S_t, I_t, and R_t denote vendor SIR states.
Reproducibility: The pipeline regenerates figures and tables in under two minutes on a laptop, with code, data, and manuscript shipped together.
Vendor infection: For the co-vendor projection, R0 = αk̄/γ; with k̄ = 41, α = 0.10, and γ = 0.18, R0 ≈ 22.8.The effective reproduction number later decays as the projection graph saturates.
Reproducibility: The implementation uses Python 3.11 with numpy, pandas, scikit-learn, and matplotlib, and fixes random seeds for data generation and experiments.