Towards Adversarially Robust Multigraph Neural Networks for Financial Crime Analysis

Dennis Heijmans; H. Çağrı Bilgi; Rui Wang; Kubilay Atasu

cs.LGOct 22, 2026

Towards Adversarially Robust Multigraph Neural Networks for Financial Crime Analysis

Authors: Dennis Heijmans, H. Çağrı Bilgi, Rui Wang, Kubilay Atasu

Organizations: Delft University of Technology Delft, The Netherlands

Abstract

Financial transaction networks are naturally represented as multigraphs, where repeated transactions between the same pair of accounts are modeled as distinct edges. Recently proposed multigraph neural network architectures leverage this structure explicitly to achieve a strong performance on anti-money laundering (AML) tasks. However, their robustness to adversaries that manipulate transaction structures to evade detection remains largely unexplored. We present the first scalable framework for structural attacks and adversarial training of multigraph neural networks using node-edge incidence matrices, adapting projected gradient descent and projected randomized block coordinate descent methods to optimize structural perturbations over such matrices. We further introduce a cycle-based regularizer that penalizes changes in the global counts of directed 2- and 3-cycles, providing a structural measure of attack plausibility. Experiments on synthetic pattern-detection and realistic AML datasets show that our learned attacks substantially outperform non-learnable perturbation baselines in reducing detection performance (PR-AUC), while adversarial training consistently improves robustness against these attacks. These results demonstrate that multigraph neural networks are vulnerable to learned structural attacks and that adversarial training provides an effective defense. Our code is available at https://github.com/denheijmans/robust_multignn.

Figures & tables

Panel of Figure 1 — Figure 1: Financial transactions form a multigraph; a GNN flags suspicious accounts; an adversary rewires transactions to evade detection while a cycle plausibility term keeps the short-cycle distribution statistically unchanged; and adversarial training restores robustness against the attacks.

Figure 2: The discrete oriented incidence matrix

\boldsymbol{B}

(left) and its continuous relaxation

\boldsymbol{\hat{B}}

(right).

\boldsymbol{E}^{(k)}\sim\text{Bernoulli}(\boldsymbol{p})\quad\text{s.t.}\quad\sum_{j=1}^{m}E^{(k)}_{j}\leq\Delta

(8)

Algorithm 1 Adversarial incidence matrix selection using randomized perturbation sampling.

Figure 3: PR-AUC drop (percentage points) per pattern, comparing the learned PR-BCD attack (

y

-axis) with uniform random rewiring (

x

-axis), at a

5\%

(left) and

10\%

(right) rewiring budget. Each marker is one of the

11

structural patterns, with the macro average shown as a star. The dashed line is the diagonal

y=x

Figure 6: Relative change in test PR-AUC on Small HI and Small LI under our threat model as the attack ratio increases. Each line shows the change relative to the same model’s clean (un-attacked) PR-AUC, which is listed in each panel;

0

means no degradation. Standard is the undefended model; adv. trained (

x\%

) is the model fine-tuned against PR-BCD at an attack ratio of

x\%

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Pattern	Threshold	Positive Ratio
In-Degree	$>3$	35.5%
Out-Degree	$>3$	35.2%
Fan-In	$>3$	32.9%
Fan-Out	$>3$	32.2%
2-Cycle	—	18.8%
3-Cycle	—	34.4%

Appendix

Table C.1: Positive-class ratio of each structural pattern label in the synthetic pattern-detection dataset.

Dataset	# Nodes	# Edges	Illicit rate	Split [%]
AML Small HI	515,088	5,078,345	0.102%	64/19/17
AML Small LI	705,907	6,924,049	0.051%	64/19/17
AML Medium HI	2,077,023	31,898,238	0.110%	61/17/22
AML Medium LI	2,032,095	31,251,483	0.051%	61/17/22

Appendix

Table C.2: Node count, edge count, illicit-transaction rate, and train/validation/test split for the four IBM HI/LI datasets.

Figure D.1: Per-pattern PR-AUC of the multigraph GIN under PR-BCD as the rewiring budget grows to

10\%

. Each of the nine rows spans its lowest-to-highest PR-AUC. Dot color and size encode the evaluation attack ratio, and the

x

-axis is reversed.

Figure D.2: Macro PR-AUC of models trained with adversarial training at different budgets (rows;

0\%

is the undefended baseline, separated at the top), each evaluated under the PR-BCD attack at test budgets from

0\%

10\%

, with the cycle regularizer disabled (

\lambda=0

) in both the training-time and test-time attacks. Dot color and size encode the test attack ratio, and the

x

-axis is reversed. Each point averages

9

runs (

3

model seeds

\times

3

attack seeds).

Training budget	$\lambda=0.05$	$\lambda=0$
$0\%$ (undefended)	$80.36\pm 0.55$	$79.52\pm 0.71$
$0.5\%$	$87.64\pm 0.11$	$88.06\pm 0.11$
$1\%$	$88.08\pm 0.17$	$88.54\pm 0.13$
$2\%$	$88.15\pm 0.26$	$88.73\pm 0.18$
$5\%$	$87.88\pm 0.17$	$88.89\pm 0.14$
$10\%$	$87.80\pm 0.26$	$88.69\pm 0.11$

Appendix

Table D.1: Macro PR-AUC [%] at a

10\%

test attack budget, with and without the cycle plausibility term in both the training-time and test-time attacks. Rows are adversarial-training budgets;

0\%

is the undefended baseline. Mean

\pm

std over

9

runs (

3

model seeds

\times

3

attack seeds).

Figure E.1: Relative change in test PR-AUC on the four IBM datasets under the unconstrained threat model as the attack ratio

\rho

increases. Each line shows the change relative to the same model’s clean PR-AUC, which is listed in each panel. Standard is the undefended model; adv. trained is fine-tuned against unconstrained PR-BCD at

\rho=5\%

. Bands show one standard deviation over attack seeds.

Figure E.2: Relative change in test PR-AUC on Small HI and Small LI with Multi-PNA under the criminal threat model, as the attack ratio increases. Each line shows the change relative to the same model’s clean (un-attacked) PR-AUC, which is listed in each panel; $0$ means no degradation. Standard is the undefended model. Lines show the mean and bands one standard deviation over $3$ seeds.

Adversarial Attacks

Adversarial attacks exploit crafted inputs, poisoned data, or system interactions to manipulate AI predictions, behavior, privacy, or reliability.

See all 448 papers

LineMVGNN: Anti-Money Laundering with Line-Graph-Assisted Multi-View Graph Neural Networks
Mar 24, 2026Chung-Hoo Poon, James Kwok, Calvin Chow +1Anti-Money Laundering Detection Financial Fraud Detection
Logistics and Supply Chain MultiTech R&D Centre, Level 11, Cyberport 2, 100 Cyberport Road, Hong Kong · Department of Computer Science and Engineering, The Hong Kong University of Science and Technology, Clear Water Bay, Kowloon, Hong Kong
MINT: Mitigating Structural Inconsistency via Attentive Message Passing for Financial Anomaly Detection
Oct 26, 2026Yin-Ju Wu, Bi-Cheng Yan, Berlin ChenGraph-Based Anomaly Detection Financial Fraud Detection
National Taiwan Normal University Taipei, Taiwan
Privacy-Preserving GNN Inference on Financial Transaction Graphs via Homomorphic Encryption
Oct 13, 2026H. Çağrı Bilgi, Kemal Mutluergil, Ceren Yıldırım +2Anti-Money Laundering Detection Privacy-Preserving ML
Sabancı University, Istanbul, Türkiye

Mar 24, 2026J/K move · Enter open · S save

LineMVGNN: Anti-Money Laundering with Line-Graph-Assisted Multi-View Graph Neural Networks

Chung-Hoo Poon, James Kwok, Calvin Chow, Jang-Hyeon Choi

Logistics and Supply Chain MultiTech R&D Centre, Level 11, Cyberport 2, 100 Cyberport Road, Hong Kong · Department of Computer Science and Engineering, The Hong Kong University of Science and Technology, Clear Water Bay, Kowloon, Hong Kong

Anti-Money Laundering Detection Financial Fraud Detection Graph Neural Networks

Open paper AskPDF arXiv

Anti-money laundering (AML) systems are important for protecting the global economy. However, conventional rule-based methods rely on domain knowledge, leading to suboptimal accuracy and a lack of scalability. Graph neural networks (GNNs) for digraphs (directed graphs) can be applied to transaction graphs and capture suspicious transactions or accounts. However, most spectral GNNs do not naturally support multi-dimensional edge features, lack interpretability due to edge modifications, and have limited scalability owing to their spectral nature. Conversely, most spatial methods may not capture the money flow well. Therefore, in this work, we propose LineMVGNN (Line-Graph-Assisted Multi-View Graph Neural Network), a novel spatial method that considers payment and receipt transactions. Specifically, the LineMVGNN model extends a lightweight MVGNN module, which performs two-way message passing between nodes in a transaction graph. Additionally, LineMVGNN incorporates a line graph view of the original transaction graph to enhance the propagation of transaction information. We conduct experiments on two real-world account-based transaction datasets: the Ethereum phishing transaction network dataset and a financial payment transaction dataset from one of our industry partners. The results show that our proposed method outperforms state-of-the-art methods, reflecting the effectiveness of money laundering detection with line-graph-assisted multi-view graph learning. We also discuss scalability, adversarial robustness, and regulatory considerations of our proposed method.

Abstract

Adversarial Attacks

Explore similar work

LineMVGNN: Anti-Money Laundering with Line-Graph-Assisted Multi-View Graph Neural Networks

MINT: Mitigating Structural Inconsistency via Attentive Message Passing for Financial Anomaly Detection

Privacy-Preserving GNN Inference on Financial Transaction Graphs via Homomorphic Encryption