Graph neural networks (GNNs) offer a principled approach to financial fraud detection by jointly learning from node features and transaction graph topology. However, their effectiveness on real-world anti-money laundering (AML) benchmarks depends critically on training practices such as specifically weight initialisation and normalisation that remain underexplored. We present a systematic ablation of initialisation and normalisation strategies across three GNN architectures (GCN, GAT, and GraphSAGE) on the Elliptic Bitcoin dataset. Our experiments reveal that initialisation and normalisation are architecture-dependent: GraphSAGE achieves the strongest performance with Xavier initialisation alone, GAT benefits most from combining GraphNorm with Xavier initialisation, while GCN shows limited sensitivity to these modifications. These findings offer practical, architecture-specific guidance for deploying GNNs in AML pipelines for datasets with severe class imbalance. We release a reproducible experimental framework with temporal data splits, seeded runs, and full ablation results.
Figures & tables
Figure 1: The base model architecture. The evaluated architecture follows a modular design consisting of an input layer (166 transaction features), followed by 1–3 GNN layers with 3 different types (GCN, GAT, and GraphSAGE). Each GNN variant is followed by GraphNorm and dropout (0.08–0.64) for regularisation. The processed features are passed to an embedding layer (64-128 dimensions) and then to a classification head (linear layer) for binary prediction. All layers use standard weight initialisation methods.
Parameter
Range
Scale
GAT
GCN
GraphSAGE
Learning rate
[2×10−6,10−3]
Log
6.999×10−4
8.475×10−4
5.302×10−4
Hidden dimension
[128,256]
Linear
148
211
140
Embedding dim.
[64,128]
Linear
89
90
103
Number of layers
{1,2,3}
Categorical
2
2
2
Dropout rate
[0.08,0.64]
Log
0.2522
0.2361
0.1135
Number of epochs
[128,512]
Linear
508
497
397
Table 1: Hyperparameter search space and optimal values obtained for each model via Optuna optimisation. Weight decay is fixed at 5×10−4 for all models.
Baseline
Xavier
GraphNorm + Xavier
Model
AUC
AUPRC
AUC
AUPRC
888 AUC
AUPRC
GCN
0.8728
0.5993
0.8740
0.5939
888 0.8736
0.5442
GAT
0.8585
0.6022
0.8486
0.6190
888 0.8700
0.6568
GraphSAGE
0.8593
0.6551
0.8826
0.6678
888 0.8755
0.6651
Table 2: Effect of initialisation and GraphNorm on model performance. GCN achieves its best AUPRC at baseline (0.5993), with marginal changes under Xavier or GraphNorm. GAT benefits most from GraphNorm combined with Xavier ( + 0.055 AUPRC, + 0.012 AUC over baseline). GraphSAGE reaches peak performance with Xavier initialisation alone ( + 0.013 AUPRC, + 0.023 AUC over baseline), with GraphNorm providing diminishing returns.
Figure 2: Convergence behaviour of GCN, GAT, and GraphSAGE on the Elliptic dataset. ( 2(a) ) Training loss curves show that GraphSAGE converges faster than GCN and GAT. ( 2(b) ) Validation score trajectories highlight that GraphSAGE consistently achieves higher validation scores, while GAT exhibits more variance and GCN stabilises more slowly.
Figure 3: Performance comparison of GCN, GAT, and GraphSAGE on the Elliptic dataset. ( 3(a) ) Overall performance across metrics including AUC, AUPRC, and F1 at multiple thresholds. ( 3(b) ) Precision-Recall scatter plots at 90% confidence, illustrating the distribution across architectures.
Method
AUC
AUPRC
Source
Prior GNN Methods
GraphSAGE
0.8712
0.6392
Deprez et al. [ 7 ]
This Work
GAT (GraphNorm + Xavier)
0.8700
0.6568
Ours
GCN (baseline)
0.8728
0.5993
Ours
GraphSAGE (Xavier)
0.8826
0.6678
Ours
Table 3: Comparison with prior methods on the Elliptic dataset. Direct comparison is limited by differences in evaluation protocols.
The consensus that GCN, GraphSAGE, GAT, and EvolveGCN outperform feature-only baselines on the Elliptic Bitcoin Dataset is widely cited but has not been rigorously stress-tested under a leakage-free evaluation protocol. We perform a seed-matched inductive-versus-transductive comparison and find that this consensus does not hold. Under a strictly inductive protocol, Random Forest on raw features achieves F1 = 0.821 and outperforms all evaluated GNNs, while GraphSAGE reaches F1 = 0.689 +/- 0.017. A paired controlled experiment reveals a 39.5-point F1 gap attributable to training-time exposure to test-period adjacency. Additionally, edge-shuffle ablations show that randomly wired graphs outperform the real transaction graph, indicating that the dataset's topology can be misleading under temporal distribution shift. Hybrid models combining GNN embeddings with raw features provide only marginal gains and remain substantially below feature-only baselines. We release code, checkpoints, and a strict-inductive protocol to enable reproducible, leakage-free evaluation.
Anti-money laundering (AML) in financial networks requires modeling transaction patterns that span multiple institutions. In practice, however, banks cannot share account and transaction features due to strict privacy regulations. We propose a privacy-preserving graph neural network (GNN) inference framework tailored to this multi-bank setting. A central server holds the graph connectivity and pretrained model weights in plaintext, while each bank keeps its transaction features encrypted. Inference is then carried out entirely on encrypted features under the CKKS homomorphic encryption scheme, so that no plaintext transaction features or predictions are exposed to the server. The key to making this practical is an edge-centric GNN architecture, wherein message passing is expressed through operations on node--edge incidence matrices. This formulation not only preserves the edge-attributed multigraph structure of transaction networks but also reduces every aggregation step to plaintext--ciphertext matrix products. Since CKKS can evaluate only polynomial circuits, we also approximate each nonlinearity with a composite polynomial of the sign function, which we calibrate per activation site. On the IBM AML benchmark, our model achieves performance competitive with plaintext baselines, and with a consumer-grade GPU, classifies each queried transaction end-to-end in as little as 5.31 seconds, while per-transaction latency can be amortized to 1.65 seconds when optimized for throughput.
H. Çağrı Bilgi, Kemal Mutluergil, Ceren Yıldırım +2
Money laundering threatens financial stability and exposes institutions to penalties, motivating automated detection. Because laundering schemes often emerge through relational patterns, graph neural networks (GNNs) are increasingly used for anti-money laundering (AML). Yet AML GNNs are typically evaluated with aggregate metrics such as overall F1 score, which hide an operational issue: high-activity recipient accounts concentrate many incoming transactions, making suspicious signals harder to isolate and costlier to investigate. We introduce a recipient-degree stratified evaluation that reports standard AML metrics across recipient-context density. Across three datasets (HI-Small, HI-Medium, and AMLSim-32k-5%), it reveals consistent degradation in dense recipient contexts, which we trace to three GNN characteristics: two known limitations that AML amplifies, i.e., (1) multiset non-discriminability and (2) cardinality blindness, and (3) an attention-specific effect: in dense neighborhoods, normalized attention attenuates weak but pattern-relevant multi-hop signals. Guided by this diagnosis, we propose SALT-GNN, a lightweight statistics-aware architecture that fuses degree-aware statistical aggregation with attention at each message-passing layer, so distributional and cardinality information shapes the node states used by subsequent attention steps. Ablations support fusion placement as a key factor in dense-context performance. On HI-Small and HI-Medium, SALT-GNN uses up to 77% fewer parameters than task-specific graph-transformer baselines while improving dense-context F1 score by 3-6 points; on AMLSim-32k-5%, it improves highest-degree F1 score by 16-20 points. The gains hold for both Transformer- and GAT-style attention, indicating that the benefit comes from where statistical and attentional evidence is fused rather than from a specific attention operator.
Lidia Losavio, Francesco Sovrano, Dario Fenoglio +2
Università della Svizzera italiana (USI) Lugano, Switzerland