Source-linked AI summary
Privacy-Preserving GNN Inference on Financial Transaction Graphs via Homomorphic Encryption
H. Çağrı Bilgi, Kemal Mutluergil, Ceren Yıldırım, Kubilay Atasu, Erkay Savas
TL;DR
Money-laundering schemes often unfold across transaction chains spanning multiple banks, so detecting them requires coordinated monitoring. Banks provide encrypted transaction features for a server to evaluate an edge-centric GNN using incidence-matrix operations and CKKS. The authors report competitive performance with plaintext GNN baselines and near-zero accuracy loss for encrypted transaction-level classification on the IBM AML benchmark.
Problem
Money-laundering schemes often unfold across transaction chains spanning multiple banks, so detecting them requires coordinated monitoring.
Source: §1 · p. 1Method
Banks provide encrypted transaction features for a server to evaluate an edge-centric GNN using incidence-matrix operations and CKKS.
Source: §1 · p. 2Results
Takeaways & Limitations
The framework demonstrates transaction-level AML classification under full encryption on the IBM AML benchmark using a consumer-grade GPU.
Source: §1 · p. 2Reported inference figures exclude client-side encryption and decryption, key generation, network communication, and the row-wise-to-bicyclic encoding transformation required in deployment.
Source: §6.2 · p. 7
Abstract
from arXiv · showhide
Anti-money laundering (AML) in financial networks requires modeling transaction patterns that span multiple institutions. In practice, however, banks cannot share account and transaction features due to strict privacy regulations. We propose a privacy-preserving graph neural network (GNN) inference framework tailored to this multi-bank setting. A central server holds the graph connectivity and pretrained model weights in plaintext, while each bank keeps its transaction features encrypted. Inference is then carried out entirely on encrypted features under the CKKS homomorphic encryption scheme, so that no plaintext transaction features or predictions are exposed to the server. The key to making this practical is an edge-centric GNN architecture, wherein message passing is expressed through operations on node--edge incidence matrices. This formulation not only preserves the edge-attributed multigraph structure of transaction networks but also reduces every aggregation step to plaintext--ciphertext matrix products. Since CKKS can evaluate only polynomial circuits, we also approximate each nonlinearity with a composite polynomial of the sign function, which we calibrate per activation site. On the IBM AML benchmark, our model achieves performance competitive with plaintext baselines, and with a consumer-grade GPU, classifies each queried transaction end-to-end in as little as 5.31 seconds, while per-transaction latency can be amortized to 1.65 seconds when optimized for throughput.
1 Introduction
AML patterns span transactions across banks, but privacy rules prevent institutions from sharing the features needed to analyze them jointly. The paper proposes encrypted GNN inference for this setting, using incidence-matrix message passing and polynomial activation approximations.
1 Introduction
- The framework performs cross-bank GNN inference on encrypted transaction features while the server holds graph connectivity and model weights in plaintext.The server returns encrypted predictions, so neither features nor predictions are exposed to it in plaintext.Source: §1 · pp. 1–2, Figure 1 · p. 1
- Earlier HE-compatible GNN methods did not support edge-attributed multigraphs with distinct parallel transactions or per-query neighborhood sampling.The paper describes the combination as, to the authors’ knowledge, a first for this setting.Source: §1 · p. 2
- Incidence-matrix message passing preserves individual multigraph edges and their features while reducing the forward pass to matrix operations suited to homomorphic encryption.The architecture addresses the mismatch between HE arithmetic and scatter-gather operations in standard message-passing GNNs.Source: §1 · p. 2
- The authors report competitive plaintext-baseline performance and practical transaction-level AML classification under full encryption, with near-zero accuracy loss.Their evaluation uses the IBM AML benchmark and a consumer-grade GPU.Source: §1 · p. 2
2 Related Work
Prior privacy-preserving GNN approaches differ in graph assumptions, architecture, and inference setting. This paper positions its contribution around encrypted edge classification on directed multigraphs with fresh query-based sampling.
2 Related Work
- Prior FHE-GNN layouts and schedules are tuned to a graph fixed at encryption time, whereas this framework samples a fresh neighborhood subgraph for each query.FicGCN bounds neighbors within a fixed graph rather than varying the sampled subgraph across queries.Source: §2 · pp. 2–3
- The paper presents encrypted edge classification on directed multigraphs with query-based sampling as a capability not supported by prior frameworks.Because prior systems differ in architecture and target task, Table 1 is a qualitative rather than quantitative comparison.Source: §2 · p. 2, Table 1 · p. 3
- Most prior FHE-GNN methods approximate nonlinearities with quadratic polynomials, while this work uses a higher-degree composite approximation because low-degree polynomials degrade accuracy on complex decision boundaries.DESIGN is an exception, using a multi-degree polynomial.Source: §2 · p. 2
- Effendi and Chattopadhyay pursue cross-bank AML under FHE, but their GNN pipeline cannot compile scatter-gather message passing and their encrypted results use XGBoost on a data subset.The paper addresses the GNN obstacle with incidence-matrix multiplication.Source: §2 · p. 3
3 Background
The background introduces CKKS, transaction-graph notation, and neighborhood-based GNN updates. It motivates incidence matrices for representing distinct transactions between the same accounts.
3.1 Fully Homomorphic Encryption
- CKKS supports approximate floating-point arithmetic, aligning with machine-learning computations, and is the homomorphic encryption scheme adopted in this work.Homomorphic multiplication consumes a finite multiplicative budget; bootstrapping can refresh noisy ciphertexts for further computation.Source: §3.1 · p. 3
3.2 Graph Notation
- Transaction graphs are directed edge-attributed multigraphs: parallel transactions between the same accounts remain distinct, and each has its own feature vector.An adjacency matrix cannot distinguish parallel edges, while a node–edge incidence matrix assigns a separate column to each edge.Source: §3.2 · p. 3
3.3 Graph Neural Networks
- A GNN updates each node representation by aggregating information from its neighborhood through learnable message and update functions.The background gives a degree-normalized mean-aggregation matrix form using the normalized adjacency matrix.Source: §3.3 · p. 3
4 Problem Formulation
Banks retain transaction features privately while a central server holds the global graph structure and plaintext model weights. For each queried transaction, the protocol samples a local subgraph, gathers encrypted features, and evaluates the GNN on ciphertexts.
4 Problem Formulation
- Banks keep their transaction features from other banks and the server, while the central server holds the global incidence matrices and trained plaintext weights.The model is trained in plaintext; only inference uses encrypted inputs.Source: §4 · p. 4
- For each query edge, the server samples a neighborhood subgraph from the plaintext graph, reducing inference from the full graph to a smaller subgraph.The paper motivates sampling by noting that real-world transaction graphs contain millions of edges and make full-graph inference intractable.Source: §4 · p. 4
- The server requests encrypted features for the sampled edges and, when available, nodes from their host banks, then evaluates the GNN using plaintext incidence matrices and model weights.Encrypted logits are returned to the initiating bank, which decrypts them with its secret key.Source: §4 · p. 4
5 Method
The method recasts directed, edge-attributed multigraph message passing as incidence-matrix operations, then implements those operations and activations in a form suitable for homomorphic evaluation.
5.1 Message Passing with Incidence Matrices for Directed Edge-attributed Multigraphs
- Incidence-matrix message passing preserves individual transaction edges while enabling separate incoming and outgoing aggregation before node representations are propagated back to edges.Degree-normalized incidence matrices are used, and available node attributes enter the node update as an additional linear term.Source: §5.1 · p. 4
5.2 Homomorphic Evaluation Methodology
- The model uses matrix operations for homomorphic evaluation, replacing ReLU with polynomial approximations and folding batch normalization into preceding linear maps.The remaining operations are additions, multiplications, and ciphertext rotations.Source: §5.2 · p. 5
5.2.1 Efficient Homomorphic Matrix Multiplication.
- Tricycle supports layer-to-layer ciphertext chaining without repacking, plaintext left-multiplication, and matrices larger than one ciphertext’s slot capacity.Its baby-step giant-step sweep reduces rotation cost from O(n) to O(√n); incoming bank ciphertexts are converted from row-wise layout with a one-time rotate-and-add packing step.Source: §5.2.1 · p. 5
5.2.2 Homomorphic ReLU Approximation via AppReLU.
- AppReLU approximates ReLU(x)=max(0,x) using x(1+sgn(x))/2, replacing sgn with a composite minimax polynomial and using a clipping bound B>0 at each activation site.Composing f4 d times improves sign approximation but adds four multiplicative-depth levels per composition; at d=5, the circuit uses 8 external and 8d internal bootstraps, 48 total. Finetuning uses knowledge distillation to adapt the ReLU-trained network to AppReLU’s approximation error.Source: §5.2.2 · p. 5
6 Experiments
Experiments compare IncidenceGNN with plaintext AML baselines and evaluate encrypted inference, accuracy fidelity, latency, and batch-size trade-offs. The results show competitive plaintext performance and practical encrypted scoring, with latency depending on batch size and polynomial degree.
6.1 Plaintext Results
- IncidenceGNN beats standard GIN on three of four splits and is competitive with Multi-GIN, while running 2.61× faster than Multi-GIN.The main plaintext performance gap is on Medium-LI, where IncidenceGNN underperforms Multi-GIN.Source: §6.1 · p. 5, Table 2 · p. 6, Table 3 · p. 6
- The message-passing path has the largest ablation impact: forward and reverse messages are complementary, need separate weights, and retaining edge direction improves performance.Ego IDs and port numbering provide consistent gains at negligible encrypted overhead; hidden dimension 128 gives only marginal gains while increasing ciphertext costs, so the baseline uses 64.Source: §6.1 · p. 6, Table 4 · p. 6
6.2 Encrypted Inference
- Knowledge distillation beats Naïve CE-only finetuning by 9.97 F1 points on average and preserves more of the original ReLU model's F1.The comparison is for the d=5 AppReLU model averaged over three seeds on Small-HI.Source: §6.2 · p. 6, Table 5 · p. 6
- AppReLU plaintext F1 improves monotonically with degree across all four splits, and d=5 predictions under FHE agree with plaintext predictions 99.25% of the time.The d=5 KD-finetuned model exceeds Table 2 mean F1 by 2.50 points on Medium-HI and 6.97 points on Medium-LI; improvements on Small splits are marginal.Source: §6.2 · p. 6, Table 6 · p. 7
- The latency measurements exclude client encryption and decryption, key generation, network communication, and the row-wise-to-bicyclic encoding transformation required in deployment.The simulation encrypts features directly in bicyclic layout; a deployed protocol would require the server to perform that transformation on receipt of bank ciphertexts.Source: §6.2 · p. 7
- 5.31 seconds per inference at d=5 and batch size 1; amortized latency reaches 1.65 seconds per transaction at batch size 16.The latency results are measured on Small-HI test batches; larger batches trade single-query speed for throughput.Source: §6.2 · p. 7, Table 7 · p. 7
- The authors report encrypted GNN transaction classification at this scale on a single consumer-grade GPU, with a few seconds per query fitting AML compliance screening rather than real-time authorization.They characterize the homomorphic-evaluation overhead as a price paid for accuracy and full feature confidentiality.Source: §6.2 · p. 7
- Batch size has negligible F1 impact across the tested range, so batch size can be tuned for latency or throughput without retraining.Batch size 1 minimizes single-query latency, while larger batches amortize fixed homomorphic-operation costs across transactions and improve bulk-screening throughput.Source: §6.2 · p. 7
7 Conclusion
The framework performs AML GNN inference on encrypted features and is competitive with plaintext baselines on the IBM AML benchmark. The discussion identifies throughput scaling, sequential single-batch latency, and account-feature evaluation as remaining considerations.
7 Conclusion
- The encrypted-feature framework is competitive with plaintext baselines on the IBM AML benchmark, with 5.31-second end-to-end latency for one query and 1.65-second amortized latency per transaction when batched.The reported latency excludes communication and encryption overhead.Source: §7 · p. 7
- Throughput scales linearly with additional GPUs, but single-batch latency depends on sequential bootstrapping and requires a faster GPU—not GPU parallelization alone—to decrease.The benchmark supplies only transaction attributes, so evaluating account-level inputs and their detection and homomorphic costs at realistic feature dimensions remains future work.Source: §7 · pp. 7–8