Evi-VN: Hard Region Guided Virtual Node Evidence Injection for GNN-Based Fraud Detection

Jiran Tao; Yifan Wu; Binyan Jiang

cs.LGOct 8, 2026

Evi-VN: Hard Region Guided Virtual Node Evidence Injection for GNN-Based Fraud Detection

Authors: Jiran Tao, Yifan Wu, Binyan Jiang

Organizations: The Hong Kong Polytechnic University

Abstract

Online platforms contain growing numbers of bots, deceptive reviewers, and scam accounts that imitate legitimate users. Such camouflage blurs graph neighborhoods and behavioral attributes, making it difficult for graph neural networks (GNNs) to distinguish both well-disguised fraudsters and legitimate users. Across diverse GNNs, we observe overlapping errors on a shared hard region, suggesting the presence of latent fraud evidence that graph topologies and standard features fail to capture. Fraud-specific GNNs can mitigate particular graph pathologies, yet they still make limited use of heterogeneous evidence such as structured records, text, images, and audio; uniform multimodal fusion may also disturb nodes already handled reliably by the graph. We propose Evi-VN to learn and correct these shared blind spots rather than build another fraud detector. To our knowledge, Evi-VN is the first graph fraud detection framework to use feature isolated evidence chains to correct hard regions shared across GNNs. Its evidence chains connect behavior, content, and context across structured, textual, visual, and acoustic sources, helping expose camouflage that graph neighborhoods may miss. Crucially, Evi-VN selectively applies this evidence only to likely hard samples via virtual class nodes, preserving both the reliable predictions and the input design of existing GNNs. Shared hard regions also let Evi-VN enhance generic, fraud-specific, and unseen GNNs even with imperfect evidence models. Experiments across bot, fake-review, refund-evidence, and telecom-fraud tasks validate these advantages.

Figures & tables

Figure 1: Overview of Evi-VN . (a) Discovery-GNN OOF errors define consensus-hard targets; the evidence router gates prior generation and calibration. (b) Original and augmented versions of one target backbone run in parallel. A calibrated prior selects and weights a source-only virtual edge, where $v_{p}$ and $v_{n}$ denote the positive- and negative-class virtual nodes, respectively. The finalizer combines fold-held-out graph, prior, and routing scalars. (c) Fixed class-prototype inputs become hidden virtual-node proxies under proxy alignment, bounded separation, and stop-gradient anchors ( $a_{0}$ and $a_{1}$ ). Discovery backbones are training-only, and evidence-chain features never enter the GNN input.

Method	Acc.	F1 +	AUC
Backbone only	0.8606	0.7649	0.9207
GNN ensemble	0.9072	0.8325	0.9660
Prob. fusion	0.9171	0.8579	0.9692
Logit fusion	0.9172	0.8580	0.9695
Evi-VN	0.9283	0.8707	0.9769

Table 1: MGTAB test performance averaged over 13 GNN backbones. Metrics are Accuracy, positive class F1, and AUC.

Control	Metric	$\Delta$ (pp)	95% CI (pp)	SF $p$
Logit fus.	Acc.	+1.10	[0.36,1.90]	0.0106
Logit fus.	F1 +	+1.27	[0.23,2.38]	0.0216
Logit fus.	AUC	+0.74	[0.05,1.64]	0.0398
Prob. fus.	Acc.	+1.11	[0.33,1.96]	0.0133
Prob. fus.	F1 +	+1.27	[0.18,2.45]	0.0284
Prob. fus.	AUC	+0.77	[0.08,1.68]	0.0304

Table 2: MGTAB paired backbone tests. Differences are percentage points (pp). CI: bootstrap over backbones; SF: one-sided sign-flip test for Evi-VN superiority.

Hard subset	Base	Evi-VN	$\Delta$ Acc.
LOO consensus	52.97	66.79	+13.82

Table 3: MGTAB correction on target-excluded LOO consensus-hard nodes, averaged over 13 backbones. Accuracy is in percent.

Router	Prior	Routed	$\Delta$ over backbone
XGB	XGB	.8920/.8666/.9625	+.0673/+.1056/+.0557
XGB	LGBM	.8929/.8682/.9622	+.0660/+.1035/+.0545
XGB	TabICL v2	.8957/.8714/.9625	+.0643/+.1015/+.0547
LGBM	XGB	.8919/.8639/.9638	+.0622/+.0973/+.0532
LGBM	LGBM	.8955/.8679/.9630	+.0635/+.1000/+.0537
RF	XGB	.8947/.8695/.9632	+.0637/+.0997/+.0537

Table 4: MGTAB router/prior replacement using XGBoost ( Chen and Guestrin 2016 ) , LightGBM ( Ke et al. 2017 ) , random forest, and TabICLv2 ( Qu et al. 2026 ) . Each triplet reports Accuracy/F1/AUC; gains are over the matched 13-backbone Backbone only mean.

Dataset	Method	Acc.	F1 +	AUC
TwiBot-20	Backbone	0.7891	0.8078	0.8666
	Evi-VN	0.8438	0.8659	0.9196
Cresci-15	Backbone	0.8690	0.8883	0.9719
	Evi-VN	0.9035	0.9195	0.9752
YelpZip	Backbone	0.8182	0.5526	0.8689
	Evi-VN	0.9373	0.7422	0.9354

Table 5: Cross-dataset paired results. TwiBot-20, Cresci-2015, and TeleAntiFraud average 13 backbones; YelpZip uses DeepSeek-V4-Pro; FraudBench averages six graphs.

Backbone	Backbone only			Evi-VN
	Acc.	F1 +	AUC	Acc.	F1 +	AUC
SGC	0.8105	0.7140	0.9109	0.9176	0.8612	0.9783
GraphTrans.	0.8928	0.8202	0.9569	0.9294	0.8764	0.9782
FiLM	0.8948	0.8193	0.9570	0.9301	0.8772	0.9786
ResGatedGCN	0.8484	0.7588	0.9234	0.9275	0.8686	0.9798
CARE-GNN	0.9059	0.8393	0.9637	0.9255	0.8713	0.9779

Table 6: MGTAB transfer to unseen GNN backbones.

Dataset	Diag. hard rate	Acc. gap	AUC gap
TwiBot-20	48.0%	0.462	0.519
MGTAB	18.0%	0.424	0.445
Cresci-2015	2.7%	0.171	0.111
YelpZip	28.6%	0.245	0.184
FraudBench	37.2%	0.559	0.781
TeleAntiFraud	24.0%	0.632	0.770

Table 7: Cross-dataset GNN common hard-region diagnosis. The diagnostic hard rate is the fraction of nodes marked consensus hard in the leave-one-backbone-out diagnosis.

Final input / control	Acc.	F1 +	AUC
Evi-VN	0.9283	0.8710	0.9767
Stacking w/o VN	0.9175	0.8600	0.9755
w/o augmented score	0.9166	0.8572	0.9731
w/o router score/mask	0.9164	0.8560	0.9724
w/o backbone score	0.9150	0.8552	0.9728
w/o prior score	0.9122	0.8508	0.9706

Table 8: MGTAB final input ablation and no-VN stacking control.

Figure S1: MGTAB distribution of hard vote counts over the 13 GNN backbones.

Figure S2: MGTAB leave-one-backbone-out easy-hard accuracy gap. The target backbone is excluded from hard region discovery.

Figure S3: TwiBot-20 distribution of hard vote counts over the 13 GNN backbones.

Figure S4: TwiBot-20 leave-one-backbone-out easy-hard accuracy gap. The target backbone is excluded from hard region discovery.

Figure S5: TwiBot-20 structural differences between consensus hard and easy nodes.

Explore similar work

Beyond Sparse Supervision: Diffusion-Guided Learning for Few-Shot Graph Fraud Detection
Jun 26, 2026Liming Liu, Chao Hu, Mingfei Lu +3Graph Neural Networks Graph SSL
Central South University, Changsha, China · University of Technology Sydney, Australian Artificial Intelligence Institute, Sydney, Australia
L2IR: Revealing Latent Intent in Graph Fraud Detection
May 25, 2026Jinsheng Guo, Zhenhao Weng, Yibo Liu +2Anomaly Detection
Hefei University of Technology Hefei, China
When Graph Structure Becomes a Liability: A Critical Re-Evaluation of Graph Neural Networks for Bitcoin Fraud Detection under Temporal Distribution Shift
Apr 21, 2026Saket MagantiGraph Neural Networks Distribution Shift

Jun 26, 2026, cs.LGJ/K move · Enter open · S save

Beyond Sparse Supervision: Diffusion-Guided Learning for Few-Shot Graph Fraud Detection

Liming Liu, Chao Hu, Mingfei Lu, Yiwei Ge+2

Central South University, Changsha, China · University of Technology Sydney, Australian Artificial Intelligence Institute, Sydney, Australia

Graph Neural Networks Graph SSL Financial Fraud Detection Few-Shot Learning Spectral Graph Convolution Anomaly Detection

Open paper AskPDF arXiv

Graph-based fraud detection is essential for safeguarding large-scale transaction systems, where undetected anomalies may lead to substantial financial losses and security risks. Real-world fraud graphs pose two coupled challenges: sparse and imbalanced supervision, where verified fraudulent labels are scarce and heavily skewed toward benign accounts, and representation dilution, where spatial message passing may oversmooth camouflaged anomalies while spectral filters may suppress fraud-relevant mid- and high-frequency irregularities. To address these challenges, we propose ADC-GNN, short for Attention-guided Diffusion-Contrastive Graph Neural Network, a unified framework that combines diffusion-guided feature augmentation, contrastive representation learning, and multi-hop spectral attention for few-shot graph fraud detection. The diffusion component is formulated as a feature-space denoising augmentation mechanism rather than a full topology-generative graph diffusion model: it constructs noise-perturbed node-feature views under a cosine schedule and uses contrastive learning to stabilize node representations across perturbations. The spectral attention module further adaptively emphasizes fraud-relevant hop-level and relation-level cues. We evaluate ADC-GNN primarily on three public benchmarks and additionally report a proprietary real-world telecom transaction dataset with approximately 60,000 records as a private case study. Under the 1% training setting, ADC-GNN achieves consistent improvements over original graph fraud baselines and four protocol-consistent recent graph anomaly/fraud baselines on the public benchmarks. Additional analyses on split stability, training ratios, oversampling alternatives, module-level ablations, diffusion schedules, and runtime and memory-consumption comparisons further characterize the effective operating regime of ADC-GNN.

Abstract

Explore similar work

Beyond Sparse Supervision: Diffusion-Guided Learning for Few-Shot Graph Fraud Detection

L2IR: Revealing Latent Intent in Graph Fraud Detection

When Graph Structure Becomes a Liability: A Critical Re-Evaluation of Graph Neural Networks for Bitcoin Fraud Detection under Temporal Distribution Shift