PaperlayerView exact revision on arXiv

Source-linked AI summary

Pricing Cross-Bank Context in Federated Anti-Money Laundering

Lidia Losavio, Dario Fenoglio, Martin Gjoreski, Marc Langheinrich

arXiv:2610.35996v1cs.CRcs.AI

TL;DR

Graph-based AML methods often assume a pooled transaction graph, while banks hold fragmented views and the value of sharing missing context remains unclear. The paper uses transactions already recorded by both endpoint banks to approximate remote states locally, then compares added counts and exchanged GNN states. On AMLworld HI-Small, Observable provides the largest stable gain, counts offer a robust correction, and boundary states help only in specific regimes; formal protection preserves counts’ utility but not the tested states’ detection value.

  • Problem

    Graph-based AML often assumes a pooled transaction graph, while how to detect laundering across separate bank graphs and when residual-context sharing is worth its privacy exposure remain open questions.

    Source: §1 · p. 1

  • Method

    Observable approximates remote account states from transactions already recorded by each bank, and a disclosure ladder compares that baseline with transaction counts and owner-computed boundary states.

    Source: §1 · p. 1

  • Results

    Observable provides the largest stable gain, counts add a robust correction, and boundary states help only in specific regimes; protected counts retain utility while noise removes tested states’ detection value before meaningful worst-case privacy.

    Source: §5 · p. 3, §5.1 · p. 4

  • Takeaways & Limitations

    For the tested setting, use transactions banks already record and protect the limited additional information that must move, adding richer disclosures only when their value survives protection and refresh.

    Source: §6 · p. 4

    The results use controlled AMLworld partitions and transaction-driven models, do not certify end-to-end privacy, and leave real-bank validation open.

    Source: §2 · p. 2, §6 · p. 5

Abstract

from arXiv · show

Most graph-based Anti-Money Laundering (AML) methods assume access to a pooled transaction graph containing all accounts and payments, which in reality does not exist. Federated learning offers the necessary privacy guarantees but it remains unclear how money laundering patterns spanning separate graphs can effectively be detected. We exploit transactions already recorded by both endpoint banks to approximate remote account states locally, enabling multi-layer Graph Neural Network (GNN) computation without additional account-specific exchange. Starting from this baseline, we test whether the remaining context is worth sharing, using a disclosure ladder that adds two transaction counts per remote account or the counterparty's own GNN states. On AMLworld HI-Small, across six GNN backbones and up to 32 silos, the observable baseline yields the largest gain and keeps it as fragmentation shrinks the visible slice; counts add a robust correction, while exact remote states help only in specific regimes. In controlled privacy--utility studies, the noise needed to protect shared states erases their detection value before it buys meaningful privacy, whereas counts stay useful even under strong privacy protection. These findings support a practical rule for banks: use what they already record, and formally protect the little that must move.

1 Introduction

Graph-based AML often assumes a pooled transaction graph, although each bank sees only part of the network. This paper studies what cross-bank context is already locally observable and when sharing residual information is worth its privacy exposure.

1 Introduction

  • Banks see only part of transaction networks, where laundering is expressed through flow patterns such as cycles, fan-in/fan-out, and chains.GNNs can use transaction attributes and surrounding flow structure, but most graph-based AML methods assume a pooled graph.Source: §1 · p. 1
  • Federated AML remains underexplored, and the information genuinely missing to each institution—and its value relative to added privacy exposure—are open questions.This matters especially because AML-tailored attention and Transformer models can be difficult to federate.Source: §1 · p. 1
  • Observable estimates a counterparty account’s state from transactions already recorded by the bank, providing a no-additional-payload reference for residual context.The remaining hidden activity is the counterparty’s other activity within itself or with third institutions.Source: §1 · p. 1
  • The study compares Observable, transaction-count disclosure, and counterparty-computed boundary states across six GNN backbones and increasing fragmentation, then tests formal privacy protection.The interfaces specify available cross-bank information rather than how a GNN aggregates it, including for attention-based models.Source: §1 · pp. 1–2

2 Problem Setting

The paper models AML as edge classification on a directed transaction multigraph, with transactions carrying attributes and labels. Its base model class assumes shared public initial states and that both endpoint clients know cross-edge direction and attributes.

2 Problem Setting

  • The task is edge classification on a directed transaction multigraph whose accounts are nodes and whose transactions retain parallel edges, attributes, and binary labels.The graph is partitioned among federated clients; cross edges are replicated for message passing but supervised only by the sender-side client.Source: §2 · p. 2
  • Synchronous FedAvg broadcasts a global model, aggregates client updates, and counts each cross-edge supervised example once.Clients update on their local graphs for a fixed number of epochs before their updates are averaged.Source: §2 · p. 2
  • The edge-observable model class uses transaction attributes as discriminative inputs, with public identical initial states and both endpoint clients knowing cross-edge direction and attributes.Node states accumulate and route transaction messages.Source: §2 · p. 2

3 Methodology

The methodology holds the model backbone, partition, supervised population, and FedAvg protocol fixed while comparing interfaces with increasing disclosure. It distinguishes locally visible transactions from hidden residual activity and tests local approximation, count disclosure, and exact boundary-state exchange.

3 Methodology

  • The comparison varies information disclosure while holding the backbone, partition, supervised population, and FedAvg protocol fixed.Source: §3 · p. 2

3.1 Defining Observable and Residual Context

  • For a frontier account, the observable slice comprises its transactions with accounts owned by the observing bank; residual context is the rest of its incident transactions.The directional frontier set includes accounts with a nonempty observable slice, and coverage is the visible transaction count divided by total incident transactions.Source: §3.1 · p. 2

3.2 Cross-Bank Interfaces

  • Observable sends no account-specific payload and approximates the remote first-layer state from the observer’s visible transactions, then caches it until synchronization.It enables multi-layer computation without residual transactions or boundary states, with missing-context error and staleness as costs.Source: §3.2 · p. 2
  • Observable+degree releases each remote account’s directed transaction counts; the observer can subtract its own counts to infer missing incoming and outgoing transactions.Counts are log-transformed, standardized, and appended to the public initial state; snapshots use only transactions recorded up to their time boundary.Source: §3.2 · pp. 2–3
  • Eobi replaces local approximations with owner-computed boundary states at synchronization, while cached exchanged tensors can grow stale as local weights move.At refresh, the received first-layer state matches the centralized one-hop state under the stated conditions; training itself does not coincide with centralized training.Source: §3.2 · p. 3

4 Experimental Setup

Experiments use AMLworld HI-Small under a chronological split and transductive protocol, with account ownership preserved across four silo counts. They compare six GNN backbones and report pooled minority-class test F1 across three seeds.

4 Experimental Setup

  • AMLworld HI-Small is evaluated under its standard chronological split and transductive protocol, with banks assigned to 4, 8, 16, or 32 silos.The degree snapshots entail no leakage under this protocol.Source: §4 · p. 3
  • The six evaluated backbones are GIN, PNA, TransConv, SALT-Trans, SALT-GAT, and FraudGT, using 100 FedAvg rounds and one local epoch per round.Hyperparameters from prior centralized AML studies are held fixed across interfaces, and validation F1 selects models.Source: §4 · p. 3
  • Pooled minority-class test F1 is reported as mean ± standard deviation over three training seeds with a fixed partition, alongside local, federated, and centralized references.The references include Local-only, edge-dropping FedAvg, centralized training, and compatible adaptations of existing federated graph-learning protocols.Source: §4 · p. 3

5 Results

Across HI-Small fragmentation levels, Observable provides the most robust gain, counts offer a consistently useful low-cost correction, and Eobi helps only in selected regimes. In controlled privacy studies, protection erases state-sharing gains before strong privacy is reached, while protected counts retain utility.

5 Results

  • Observable loses only .008 F1 score for PNA and .028 for TransConv as coverage falls from .366 to .245, while Local-only and FedAvg approach zero.Observable’s median gain over edge-dropping FedAvg is +.275 F1 score at M=4; Figure 3 reports pooled test F1 across fragmentation levels.Source: §5 · p. 3, Figure 3 · p. 4
  • Two counts per frontier account make Observable+degree the most consistently robust correction, often matching or exceeding the centralized reference by mean F1 score.The benchmark payloads are unprotected; Figure 3 shows the fragmentation study.Source: §5 · p. 3, Figure 3 · p. 4
  • Eobi helps only in particular backbone–partition regimes, with no monotone trend as silo count increases.FedGCN is stable across silo counts, while FedGAT falls from .653 to .514 F1 score between M=4 and M=32; FedSage+ does not reverse the trend.Source: §5 · p. 3

5.1 When Is Residual Context Worth Sharing?

  • The controlled privacy study varies coverage and target-edge contribution across selective and cardinal residual tasks, with a distributional negative control.It uses three datasets, five noise draws per dataset, and paired 95% hierarchical-bootstrap intervals; guarantees cover additional releases under fixed observable information and encoder, not FedAvg updates.Source: §5.1 · p. 4
  • Gaussian noise on clipped boundary states removes their detection advantage before strong event-level protection is reached.At λ=.5, the +.147 PR-AUC unprotected gain reverses while the worst-case privacy bound remains weak (ε_e≈195, δ=10^-5).Source: §5.1 · p. 4, Figure 4 · p. 4
  • For cardinal PNA (ρ=.1, λ=.5), noisy counts retain a positive gain: +.004 PR-AUC [+.002, +.006] at ε=.01.The clean count gain is +.047 PR-AUC and is nearly intact at ε=.1 (+.042); Figure 5 plots ΔPR-AUC against pure event-level ε per count-vector release.Source: §5.1 · p. 4, Figure 5 · p. 4

6 Implications for Banks

The results favor using transactions banks already record and limiting extra disclosure to information whose value survives protection and refresh. The conclusions guide payload selection, not end-to-end privacy or deployment in real banks.

6 Implications for Banks

  • Observable transactions provide the largest stable gain, degree counts a robust low-cost correction, and richer boundary states have conditional value.The design rule is to use what banks already record and protect only what must move, such as two integers per account when missing cardinality matters.Source: §6 · pp. 4–5
  • These results guide payload selection rather than end-to-end privacy, with real-bank validation still open.The evaluation uses controlled AMLworld partitions, and cached approximations grow stale.Source: §6 · p. 5
  • Ego IDs, port encodings, and KYC attributes require additional information and are task-dependent.The study deliberately focuses on transaction-driven models; multigraph-specific GNN enhancements remain future work.Source: §6 · p. 5

A Forward Equivalence and Interface Scope

Observable first-hop approximations can match centralized computation under complete incident inputs and stated layer assumptions, but this is a narrow forward-pass result. Deeper exact states require federation-wide, layer-ordered exchange, and cached states do not establish training equivalence.

Forward equivalence

  • Under A1–A2, deterministic layers, and complete incident inputs, a client computes the same owned-account first-layer state as centralized evaluation at the same parameters.The argument is that centralized and local evaluation use the same incident transaction multiset, edge-conditioned messages, aggregation, and state update.Source: A Forward Equivalence and Interface… · p. 7
  • The first-hop equivalence does not cover private remote features, missing cross-edge attributes, omitted incident edges, or unavailable nonlocal normalization.It also does not imply privacy or an exact backward pass, and the observer’s approximation is not the exact first-hop state.Source: A Forward Equivalence and Interface… · p. 7

Interface scope

  • The observer’s visible outgoing edges are not incoming messages to the remote account and are not hidden residual transactions.The local approximation pools parallel payments across all observer-owned accounts connected to that account.Source: A Forward Equivalence and Interface… · p. 7
  • An account’s complete incident ledger guarantees its first-hop state, not all deeper states; exact deeper forward computation requires layer-ordered owner-state exchanges and model-specific cross-edge tensors.With complete records and synchronized deterministic layers, induction reproduces centralized forward values.Source: A Forward Equivalence and Interface… · p. 7
  • Received states are detached and cached for one local epoch, so they are not refreshed after each optimization step and no gradient crosses clients.Consequently, refresh-point forward exactness implies neither centralized training equivalence nor a predictive upper bound.Source: A Forward Equivalence and Interface… · p. 7

B HI-Small Protocol and Communication

The HI-Small protocol assigns banks to silos while preserving account ownership, replicates cross-silo transactions for message passing, and counts supervision once. Communication comparisons distinguish no account-specific payload, two counts, and owner-computed states.

Partition and data

  • At M=4, 64.9% of HI-Small transactions are cross-silo, producing 374,791 directional frontier registrations.Each bank identifier is assigned to one of M silos, and every account inherits its bank’s assignment; a silo may group multiple banks.Source: B HI-Small Protocol and Communication · p. 7
  • Cross-silo transactions are copied to both endpoint subgraphs for message passing but assigned once to the sender-side silo for supervision and pooled evaluation.Federated training uses synchronous FedAvg with coordinator broadcasts and averaged client updates.Source: B HI-Small Protocol and Communication · p. 7

Models and baselines

  • The six evaluated backbones are GIN, PNA, TransConv, SALT-Trans, SALT-GAT, and FraudGT, compared across three interfaces with Local-only and centralized anchors.FedAvg, FedGCN, FedGAT, and FedSage+ provide external federated references where applicable.Source: B HI-Small Protocol and Communication · p. 7

Evaluation protocol

  • Each run uses 100 federated rounds and one local epoch per round; pooled minority-class test F1 is reported as the mean and standard deviation over three seeds.Model selection maximizes validation F1 under an oracle coordinator convention, and benchmark payloads are unprotected.Source: B HI-Small Protocol and Communication · p. 7

Communication

  • Observable+degree releases two counts at each of three cumulative snapshots, while Eobi’s scalar traffic depends on state width and refresh rounds.Neither raw residual transactions nor a pooled ledger is transferred; traffic accounting excludes the computation and synchronization requirements of each interface.Source: B HI-Small Protocol and Communication · pp. 7–8
  • Observable sends no account-specific payload, Observable+degree sends two degree counts, and Eobi sends the owner-computed cut state.The Figure 6 caption contrasts these three prices for cross-bank context at a frontier account.Source: B HI-Small Protocol and Communication · p. 7, Figure 6 · p. 8

C Interface Value by Typology

On HI-Small, the value of residual context varies by typology: counts help cardinal patterns, exchanged states help selective patterns, and locally complete evidence needs neither. These benchmark typology findings are distinct from the controlled study’s privacy–utility results.

C Interface Value by Typology

  • For cycles, Eobi helps at M=4 and most at M=32 as deeper partitioning disperses more witnesses; degree gains by correcting biased attention normalization.The cycle-closing transaction may lie outside the labeling silo, leaving the observable slice without the required witness.Source: C Interface Value by Typology · p. 8
  • For fan-in, degree can be useless or harmful at low fragmentation but strongly beneficial at high fragmentation, when it repairs an underestimated count.Two integers outperform the d-float Eobi payload because the count is sufficient for this cardinal pattern.Source: C Interface Value by Typology · p. 8
  • For fan-out, the labeling silo observes the pattern in full, so residual context adds no label information and Eobi decays as fragmentation grows.The hub sends every transaction of the pattern; additional remote states are uninformative.Source: C Interface Value by Typology · p. 8
  • At high fragmentation, Gather–Scatter is repaired chiefly by degree, while Scatter–Gather benefits from both payloads because its structure mixes cardinal and selective evidence.Source: C Interface Value by Typology · p. 8
  • On HI-Small, cardinal patterns are repaired by counts, selective patterns by exchanged states, and locally complete patterns by neither.The typology profiles indicate that the controlled study’s residual classes are not an artifact of its generator.Source: C Interface Value by Typology · p. 8

D Controlled Residual-Context Study

D.1 Generator, Interfaces, and Evaluation

The controlled generator varies target-edge contribution, observable coverage, and residual-context type to compare interfaces. Its unprotected results favor exchange when coverage is low and residual context matters, while the privacy analysis is bounded by its stated threat model and release assumptions.

D.1 Generator, Interfaces, and Evaluation

  • Each synthetic example has one always-observable target transaction and 16 remote boundary accounts; λ controls target-edge contribution, while ρ controls the fraction of boundary events Observable sees.At least one event is retained; the degree interface adds the true total event count, whereas Eobi supplies the exact first-hop state.Source: §D.1 · p. 9
  • The generator separates distributional, cardinal, and selective residuals: respectively, mean activity, total event count, or one query-matched boundary account determines the residual score.In the selective regime, a count cannot identify the relevant account, and its evidence may be outside the observable slice.Source: §D.1 · p. 9
  • The study pairs those regimes with GIN, PNA, and TransConv, generating 3,000 examples per seed and reporting mean PR-AUC over three dataset seeds.The evaluation uses a 60/20/20 train/validation/test split and shares initialization and minibatch order across interfaces.Source: §D.1 · p. 9

D.2 Unprotected Interface Value

  • The low-coverage stress slice is ρ=.1 and λ=.75, and its table reports three-seed mean PR-AUC; the full grid varies both λ and ρ.At ρ=1, interfaces receive the same information; at λ=1, residual context is irrelevant to the label.Source: §D.2 · p. 9, Table 1 · p. 9
  • Unprotected Eobi gains concentrate where coverage is low and residual context is label-relevant, then shrink quickly as coverage grows; GIN and PNA also gain.The grid plots Eobi−Observable over target-edge contribution λ and observable coverage ρ; gains are not limited to attention-based models.Source: Figure 8 · p. 9, §D.2 · p. 9

E.1 Scope and Threat Model

  • The privacy study trusts the owner, models an honest-but-curious recipient, and analyzes one protected payload release with the observable slice and target transaction fixed.It does not account for learned-encoder changes or disclosure through model updates; its Gaussian analysis concerns synthetic first-hop states, not the benchmark’s complete multi-level cut-state record.Source: §E.1 · p. 10

E.2 Protecting the State Payload

  • The state mechanism clips each row to norm 3 and adds Gaussian noise; larger σ gives stronger protection but greater distortion.Source: §E.2 · p. 10
  • Event-level ε_e uses a worst-case event replacement, while ε_m scopes the account to state displacements within r90; its 90% coverage is empirical, not a worst-case guarantee.The worst-case bound can be much looser than one restricted to smaller state changes, and the two accounts are not interchangeable.Source: §E.2 · p. 10

E.3 Paired Utility and State Results

In paired privacy–utility tests, noise erases the selective value of exact state exchange before the tested mechanism attains a meaningful worst-case privacy bound. By contrast, noisy total counts retain confirmed utility in the controlled cardinal study, though the two privacy accounts are not directly comparable.

E.3 Paired Utility and State Results

  • At σ=.175, Observable is confirmed preferable to EOBI, while at σ=.075 exchange is useful but the worst-case ε_e is still 468.Clipping alone preserves a selective gain of +.044; conclusions are limited to the tested mechanism and tasks.Source: §E.3 · p. 10
  • At σ=.075, the r90-scoped bound rises from 3.55 for one release to 74.7 for 100, but this is not a privacy guarantee for the full benchmark training procedure.The accounting uses the same per-release distance and noise account.Source: §E.3 · p. 10
  • At λ=.5, TransConv’s clean EOBI gain is +.147, yet Observable is confirmed preferable at σ=.125 with Δ = −.020 [−.032, −.007].Clipping-only Δ = +.001 [−.007, +.009], with no confirmed useful noisy point.Source: §E.3 · p. 10

E.4 Protecting the Total-Count Payload

  • At ε=.01, noisy total counts retain a confirmed +.004 gain over Observable [+.002, +.006], with count MAE 32.2 on N_max = 80.This controlled cardinal study privatizes one total count per frontier account; the count and state privacy parameters use different objects and adjacency relations and are not directly comparable.Source: §E.4 · p. 10
Loading 2610.35996v1…