PaperlayerView exact revision on arXiv

Source-linked AI summary

Towards Adversarially Robust Multigraph Neural Networks for Financial Crime Analysis

Dennis Heijmans, H. Çağrı Bilgi, Rui Wang, Kubilay Atasu

arXiv:2610.31718v1cs.LG

TL;DR

Multigraph neural networks can model the repeated, attributed transactions found in financial networks, but their robustness to structural evasion attacks has been largely unexplored. This paper develops incidence-matrix attacks and adversarial training; on the IBM AML benchmark, learned attacks substantially reduce PR-AUC and training mitigates the vulnerability.

  • Problem

    The robustness of multigraph neural networks to adversarial transaction rewiring is largely unexplored, although such changes can help conceal criminal activity and adjacency-based attacks do not represent parallel transactions.

    Source: §1 · pp. 1–2

  • Method

    The framework uses incidence-matrix reformulations to optimize edge-target rewiring attacks and adversarial training for multigraph neural networks.

    Source: §1 · p. 2, §3.1 · p. 3, §3.2 · p. 4

  • Results

    On IBM AML, PR-BCD reduces PR-AUC by up to 20%, while uniform random rewiring causes substantially smaller drops and adversarial training mitigates the vulnerability.

    Source: §5 · p. 10

  • Takeaways & Limitations

    Multigraph neural networks are vulnerable to learned structural attacks, while adversarial training provides an effective defense in the evaluated AML setting.

    Source: §5 · p. 10

    The threat model is white-box: the attacker knows the model, graph, and labels, and real-world adversaries may lack this knowledge or control.

    Source: §3.1 · p. 3

Abstract

from arXiv · show

Financial transaction networks are naturally represented as multigraphs, where repeated transactions between the same pair of accounts are modeled as distinct edges. Recently proposed multigraph neural network architectures leverage this structure explicitly to achieve a strong performance on anti-money laundering (AML) tasks. However, their robustness to adversaries that manipulate transaction structures to evade detection remains largely unexplored. We present the first scalable framework for structural attacks and adversarial training of multigraph neural networks using node-edge incidence matrices, adapting projected gradient descent and projected randomized block coordinate descent methods to optimize structural perturbations over such matrices. We further introduce a cycle-based regularizer that penalizes changes in the global counts of directed 2- and 3-cycles, providing a structural measure of attack plausibility. Experiments on synthetic pattern-detection and realistic AML datasets show that our learned attacks substantially outperform non-learnable perturbation baselines in reducing detection performance (PR-AUC), while adversarial training consistently improves robustness against these attacks. These results demonstrate that multigraph neural networks are vulnerable to learned structural attacks and that adversarial training provides an effective defense. Our code is available at https://github.com/denheijmans/robust_multignn.

1 Introduction

Financial crime detection increasingly uses graph neural networks, but the robustness of multigraph-specific models to transaction rewiring remains largely unexplored. This section motivates and introduces structural attacks, cycle-based plausibility, and scalable adversarial defenses for these models.

1 Introduction

  • Money laundering is concealed among legitimate financial flows, with an estimated 2–5% of global GDP laundered each year.The paper notes that detecting illicit transfers increasingly relies on automated analysis of transaction networks.Source: §1 · p. 1
  • Transactions are modeled as attributed edges in a multigraph because account pairs can exchange multiple payments over time.In evaluated AML datasets, more than half of occupied directed account pairs contain multiple transactions, and these pairs account for over 91% of transactions.Source: §1 · pp. 1–2
  • Robustness to structural attacks remains largely unexplored for multigraph neural networks, while existing GNN attack methods rely on simple-graph adjacency matrices.Those matrices cannot represent perturbations that modify one transaction while preserving other parallel transactions.Source: §1 · p. 2
  • Incidence-matrix reformulations enable differentiable structural attacks on multigraph neural networks while preserving distinct parallel edges.The framework is derived for multigraph variants of GIN and PNA [17] and applies to models expressible as differentiable functions of the incidence matrix.Source: §1 · p. 2
  • A cycle-based loss penalizes changes in global directed 2- and 3-cycle counts, corresponding to reciprocal transfers and triangular routing patterns.The paper argues that preserving these counts avoids conspicuous changes to statistics that a monitor could track.Source: §1 · p. 2
  • The framework scales to large financial networks through incidence-matrix PR-BCD and uses adversarial training to harden Multi-GNNs against structural attacks.The authors state that this adaptation prevents memory from growing with network size.Source: §1 · p. 2

2 Background and Related Work

GNNs aggregate information from graph neighborhoods, and multigraph architectures extend this approach to transaction edges with attributes. Prior structural attacks and defenses generally target adjacency representations of simple graphs, unlike the repeated-edge and relation settings discussed here.

2 Background and Related Work

  • GNNs learn relational representations by aggregating information from local neighborhoods, often using adjacency-based updates or explicit message passing.The adjacency-based formulation is a special case of message passing over an explicit edge multiset.Source: §2 · p. 2
  • Multi-GNN [3] adds ego identifiers, port numbering, and reverse message passing for multigraphs; FraudGT reuses these adaptations.These specialized methods complement message-passing GNN formulations that operate directly on explicit edge representations [20] [21].Source: §2 · p. 3
  • Structural GNN attacks and defenses typically perturb adjacency matrices, which cannot represent changing one edge while preserving parallel edges.The paper therefore frames multigraph attacks over node–edge incidence matrices.Source: §2 · p. 3
  • Hypergraph and heterogeneous-graph attacks use different structural representations, but the cited approaches do not support repeated edges between the same node pair.Multigraph incidence-matrix columns represent individual source–destination edges, including repeated edges, without requiring predefined relation types.Source: §2 · p. 3

3 Method

The method formulates budgeted target-rewiring attacks on multigraphs using differentiable incidence matrices. It scales attack optimization, regularizes cycle-count changes for plausibility, and adversarially trains models using generated perturbations.

3.1 Problem Statement and Threat Model

  • The attacker rewires at most Δ edge targets in a white-box evasion setting, with model parameters fixed and source nodes unchanged.The fixed edge count makes the perturbation a fixed-dimensional optimization variable.Source: §3.1 · p. 3

3.2 Incidence-Based Multi-GNN Reformulation

  • The oriented incidence matrix preserves parallel edges and makes Multi-GIN and Multi-PNA computations differentiable with respect to graph structure.Its positive and negative parts encode edge destinations and sources; weighted log-sum-exp relaxes minimum and maximum aggregators during continuous optimization.Source: §3.2 · p. 4

3.3 Structural Perturbations

  • The continuous incidence relaxation assigns each edge a rewiring probability and candidate-target distribution, then samples discrete graphs and selects the lowest-PR-AUC instance.The projection keeps the expected number of rewired edges within the budget.Source: §3.3 · p. 5, Figure 2 · p. 5

3.4 Scalable Attacks

  • PR-BCD restricts optimization to fixed-size edge and target-node blocks, reducing learnable parameters to O(bE · bV) regardless of graph size.Blocks are periodically refreshed to avoid overfitting to the initial edge subset, and bE must be at least Δ.Source: §3.4 · pp. 5–6

3.5 Attack Plausibility

  • The plausibility regularizer penalizes changes in directed 2- and 3-cycle counts, keeping the perturbed graph’s cycle profile close to the original.These cycle lengths correspond to reciprocal transfers and triangular routing; the regularizer uses saturated adjacency values and is balanced against attack loss by λ.Source: §3.5 · p. 6

3.6 Adversarial Training

  • Adversarial training approximates its inner maximization at each training step with PR-BCD, generating a fresh budget-constrained adversarial example for the model update.Source: §3.6 · p. 6

4 Empirical Evaluation

The evaluation tests structural attacks and adversarial training on a synthetic pattern-detection benchmark and realistic AML transaction graphs. Learned attacks degrade detection, while adversarial training improves robustness in both settings.

4.1.1 Experimental Setup

  • The synthetic inductive benchmark uses independently seeded 8,192-node directed multigraphs, 11 structural-pattern labels, and minority-class PR-AUC macro-averaged across patterns.Models use six message-passing layers and neighborhood sampling; attacks are white-box, with fixed-model parameters and equal-budget random rewiring as the baseline.Source: §4.1.1 · p. 7

4.1.2 Structural Attack Effectiveness

  • At both 5% and 10% budgets, learned PR-BCD causes larger PR-AUC drops than uniform random rewiring for almost every pattern and the macro average.The gap is largest for higher-order cycles, which random rewiring rarely reaches.Source: Figure 3 · p. 7, §4.1.2 · p. 7

4.1.3 Plausibility Trade-offs

  • At λ = 0.05, cycle-count loss falls significantly while macro PR-AUC rises by less than one point; larger λ brings marginal cycle-loss reductions but weaker attacks.The cycle statistics are directed 2- and 3-cycle counts; preserving them does not guarantee evasion of monitors using other statistics.Source: Figure 4 · p. 8, §4.1.3 · p. 8

4.1.4 Adversarial Training Defense

  • At a 10% test attack, adversarially trained models retain about 88% macro PR-AUC versus 80% for the undefended baseline, with clean PR-AUC near 99%.Training against a 0.5% attack ratio already yields most of the robustness benefit.Source: Figure 5 · p. 8, §4.1.4 · p. 8

4.2.1 Experimental Setup

  • The IBM AML evaluation classifies transactions as licit or illicit on temporally split Small HI and Small LI datasets, using illicit-class PR-AUC.The model uses two message-passing layers, an edge-classification head, and class-weighted cross-entropy; AML experiments omit the cycle regularizer.Source: §4.2.1 · pp. 8–9

4.2.2 Threat Model

  • In the criminal threat model, attackers can rewire illicit transactions only among criminal accounts, preserving senders, transaction attributes, and labels.The white-box attacker knows the model, graph, and laundering activity; the authors characterize this as a worst-case simplification.Source: §4.2.2 · p. 9

4.2.3 Adversarial Attacks and Defenses

  • AML PR-BCD optimizes a tanh-margin loss, samples 50 discrete perturbations, and selects the lowest-PR-AUC attack; adversarial training fine-tunes at a 20% training attack ratio.The random baseline follows the same constraints and also selects the best of 50 samples.Source: §4.2.3 · p. 9

4.2.4 Structural Attack Effectiveness and Adversarial Training on AML Graphs

  • On AML graphs, PR-BCD cuts PR-AUC by up to one fifth; 20%-ratio adversarial training makes 50%-attack degradation comparable to undefended random rewiring.For attack ratios at or below 5%, PR-AUC drops by less than 5% on both datasets.Source: §4.2.4 · pp. 9–10, Figure 6 · p. 10

5 Conclusion and Discussion

On IBM AML, learned PR-BCD attacks reduce detection performance, while adversarial training mitigates the vulnerability. The cycle regularizer offers a limited plausibility constraint, and scalable optimization supports large networks.

5 Conclusion and Discussion

  • The cycle regularizer penalizes changes in global directed 2- and 3-cycle counts; larger weights weaken the attack, while small weights preserve its effect.At small regularization weight, cycle-count changes are as small as with larger weights, with PR-AUC nearly unchanged from the unregularized attack.Source: §5 · p. 10
  • Because it tracks only 2- and 3-cycles, the regularizer does not ensure attacks evade monitors of other graph statistics.Additional statistics can be incorporated as further plausibility terms.Source: §5 · p. 10
  • Incidence-matrix message passing enables gradient-based attacks on Multi-GIN and Multi-PNA, while projected randomized block coordinate descent makes the framework memory-efficient for large networks.PR-BCD attacks substantially outperform uniform random rewiring at the same budget; adversarial training recovers robustness within the framework.Source: §5 · p. 10
  • On IBM AML, PR-BCD reduces PR-AUC by up to 20%, while adversarial training keeps the drop comparable to undefended uniform rewiring, even at half rewired.Under the same criminal-account constraints, uniform random rewiring causes substantially smaller drops than PR-BCD.Source: §5 · p. 10

A Proof of Adjacency Matrix Factorization

The proof shows that incidence-matrix factors recover directed adjacency counts, including parallel edges. The multilabel attack surrogate supplies gradient signal near the decision boundary.

A Proof of Adjacency Matrix Factorization

  • Multiplying source and destination incidence matrices counts directed edges from each node pair, recovering adjacency entries while preserving parallel-edge multiplicity.Each product term contributes one when an edge leaves the source node and enters the destination node.Source: A Proof of Adjacency Matrix… · p. 13

B Multilabel Surrogate Loss

  • Because accuracy loss is nondifferentiable and existing surrogate losses assume mutually exclusive classes, the paper introduces a surrogate for multilabel outputs.The multilabel setting includes benchmarks where nodes carry multiple labels.Source: B Multilabel Surrogate Loss · p. 13
  • The surrogate concentrates attack gradients on nodes with logits near zero, where small structural perturbations are most likely to flip predictions.Confidently classified or misclassified nodes contribute little gradient because the sigmoid gradient is near zero at either extreme.Source: B Multilabel Surrogate Loss · p. 13

C Implementation Details

The synthetic benchmark uses neighborhood-sampled training and repeated discrete attack sampling. The realistic AML setting uses transaction batches and distinct budgets for attack evaluation and adversarial training.

C.1 Synthetic Pattern-Detection

  • Synthetic models use 64-dimensional hidden states, train for 120 epochs, and sample neighborhoods with 32 target nodes and fan-outs [10] [5] in both directions.The ego embedding dimension is 32, dropout is 0.1, and optimization uses Adam with learning rate 10^-3 and weight decay 10^-4.Source: §C.1 · p. 13
  • Synthetic attacks run 100 optimization steps with 50 block resamples and learning rate 0.1, selecting the strongest of K = 25 sampled discrete perturbations.The naive baseline uses the same K = 25 sampling procedure.Source: §C.1 · p. 13

C.2 Realistic AML Setting

  • Realistic AML models train on batches of 8,192 target transactions, with hidden dimension 32 and dropout 0.1; standard training runs for at most 80 epochs with validation-PR-AUC checkpointing.Adversarial training runs for at most 20 epochs; the positive-class loss weight is 7.0.Source: §C.2 · p. 13
  • For constrained AML attacks, the block spans all illicit transactions and permitted criminal-account receivers; evaluation uses K = 50 samples and up to 100 steps, versus K = 20 and up to 30 steps during adversarial training.No block resampling is used for the constrained Small-dataset attacks because the block already spans all permitted rewirings.Source: §C.2 · p. 14
  • The unconstrained AML threat model uses blocks of 512 candidate receivers and 400,000 candidate transactions on Small datasets or 1,300,000 on Medium datasets.It uses 30 block resamples for evaluation and 10 during adversarial training.Source: §C.2 · p. 14

C.3 Dataset Statistics

The appendix tables report positive-class ratios for synthetic structural-pattern labels and dataset statistics for four IBM HI/LI datasets.

C.3 Dataset Statistics

  • Table C.1 reports the positive-class ratio for each structural-pattern label in the synthetic pattern-detection dataset.The dataset includes 11 pattern labels.Source: Table C.1 · p. 14, §C.3 · p. 14
  • Table C.2 gives node count, edge count, illicit-transaction rate, and train/validation/test split for the four IBM HI/LI datasets.The passage identifies the table’s statistics but does not provide their values.Source: Table C.2 · p. 14, §C.3 · p. 14

D.1 Per-Pattern Robustness Across Attack Ratios

The appendix complements the 5% and 10% per-pattern PR-AUC drops with a full attack-ratio sweep, showing absolute PR-AUC across nine patterns and explaining two omissions.

D.1 Per-Pattern Robustness Across Attack Ratios

  • Figure D.1 tracks absolute per-pattern PR-AUC from the clean graph through attack ratios of 0.5%, 1%, 2%, 5%, and 10%.Figure 3 instead reports per-pattern PR-AUC drops at 5% and 10%.Source: §D.1 · p. 14, Figure D.1 · p. 15
  • In Figure D.1, each of nine rows spans that pattern’s lowest-to-highest PR-AUC, while dot color and size encode attack ratio on a reversed x-axis.Source: Figure D.1 · p. 15, §D.1 · p. 15
  • Out-degree and fan-out are omitted because destination-only rewiring leaves out-degree invariant and fan-out near-invariant.Source: §D.1 · p. 15

D.2 Adversarial Training Without the Cycle Regularizer

Adversarial training retains its robustness benefit when the cycle regularizer is disabled in both training-time and test-time attacks. This indicates the defense effect is attributable to training rather than the plausibility constraint.

D.2 Adversarial Training Without the Cycle Regularizer

  • The comparison disables the regularizer in both training-time and test-time attacks while leaving other hyperparameters unchanged, addressing whether restricted attacks explain the recovery.Source: §D.2 · p. 15
  • At a 10% test budget, the best defended model improves macro PR-AUC over the undefended baseline by 7.8 points with λ = 0.05 (80.36 → 88.15) and 9.4 points with λ = 0 (79.52 → 88.89).Figure D.2 points average 9 runs (3 model seeds × 3 attack seeds).Source: §D.2 · p. 15, Figure D.2 · p. 16
  • With the cycle term disabled, every adversarially trained model retains substantially more macro PR-AUC under PR-BCD than the undefended baseline.The benefit is largely insensitive to the training budget.Source: §D.2 · p. 15, Figure D.2 · p. 16
  • The authors conclude that adversarial training, not the plausibility constraint, accounts for the reported robustness; the regularizer instead keeps perturbations statistically unnoticeable.Source: §D.2 · p. 16

E.1 AML Results Under an Unconstrained Threat Model

The unconstrained threat model permits arbitrary transaction rewiring and yields large PR-AUC drops, while adversarial training improves robustness at a clean-performance cost. The section also reports Multi-PNA results, ethical boundaries, and possible extensions to feature and endpoint perturbations.

E.1 AML Results Under an Unconstrained Threat Model

  • The unconstrained attacker can rewire licit as well as illicit transactions, making this setting implausible and its attack ratios incomparable with the criminal threat model.Source: §E.1 · p. 16
  • At ρ = 10%, unconstrained PR-BCD reduces test PR-AUC by 39% to 70%, while uniform rewiring reduces it by 19% to 64%.Uniform rewiring comes within six percentage points of PR-BCD on the Medium datasets; Figure E.1 shows relative changes across the four IBM datasets.Source: §E.1 · p. 16, Figure E.1 · p. 17
  • Adversarial training at ρ = 5% improves robustness on all four datasets, but clean PR-AUC falls by 2.0 to 6.5 percentage points.On Small HI and Medium LI, the trained model has lower PR-AUC through attack ratios of ρ = 2%, so its defense helps only at larger ratios.Source: §E.1 · p. 17

E.2 Adversarial Attacks on Multi-PNA

  • On Small LI, Multi-PNA’s PR-AUC drops approximately 24% under PR-BCD at a 50% attack ratio, versus 4% under uniform rewiring.On Small HI, both attacks have limited impact: approximately 3% for PR-BCD and 2% for uniform rewiring.Source: §E.2 · p. 17, Figure E.2 · p. 18

F Ethical Considerations

  • The authors identify potential misuse for evading AML detection, while noting that immediate risk is limited by white-box access and structural rewiring scope.Experiments use synthetic and open-source benchmarks, not live financial systems or real bank transactions.Source: F Ethical Considerations · p. 18

G.1 Joint Structural and Feature Perturbations

  • The current attack changes graph structure while keeping edge features fixed; future work could compare structural, feature-only, and joint perturbations and defenses.Source: §G.1 · p. 19

G.2 Extending the Structural Perturbation Space

  • The current threat model preserves each selected edge’s source and rewires only its destination; source rewiring, both-endpoint changes, and node insertion remain unevaluated extensions.The practical relevance of these extensions depends on the adversary’s assumed capabilities.Source: §G.2 · p. 19

H Broader Impact

The paper frames multigraph-aware robustness evaluation as important before AML deployment because multigraph attacks can evade defenses built for simple graphs. It also cautions that adversarial training may trade clean accuracy for robustness.

H Broader Impact

  • Multigraph structure creates an attack surface absent from simple graphs: individual transactions can be added or rerouted while aggregate flow statistics remain approximately unchanged.Source: H Broader Impact · p. 20
  • Simple-graph defenses use compressed adjacency representations and cannot detect these perturbations, motivating multigraph-aware robustness evaluation before deployment.Source: H Broader Impact · p. 20
  • Adversarial training recovers accuracy under attack but may reduce clean-graph accuracy, so practitioners should assess the trade-off for their deployment context.The paper also recommends monitoring false negatives and false positives under clean and adversarial conditions.Source: H Broader Impact · p. 20

Related papers

Loading 2610.31718v1…