Graph Convolutional Network (GCN)

GCNs perform convolution in the spectral domain using the graph Laplacian's eigendecomposition. Unlike spatial methods that define aggregation heuristically, spectral GCNs derive the convolution filter mathematically from graph signal processing theory. The operation is localized via a first-order approximation of Chebyshev polynomials, restricting the filter to immediate 1-hop neighbors. This provides a rigorous mathematical foundation for feature propagation across the graph structure.

The core propagation rule uses a renormalized adjacency matrix with added self-loops: Â = A + I. This ensures nodes retain their own feature information during aggregation, preventing self-information loss. The symmetric normalization D̂⁻¹/² Â D̂⁻¹/² scales features by node degree, preventing high-degree nodes from dominating the representation space. This normalization is critical for stable training on financial graphs with power-law degree distributions common in transaction networks.

Each GCN layer applies a shared weight matrix W to transform node features before aggregation. This enables the model to learn task-specific feature mappings. The full layer operation is: H⁽ˡ⁺¹⁾ = σ(D̂⁻¹/² Â D̂⁻¹/² H⁽ˡ⁾ W⁽ˡ⁾). The weight matrix is shared across all nodes, making GCNs parameter-efficient and inductive—they can generalize to unseen nodes without retraining. This is essential for production fraud systems encountering new account registrations daily.

A 2-layer GCN aggregates information from a node's 2-hop neighborhood. Each additional layer extends the receptive field by one hop. This localized aggregation captures relational context without requiring global graph computation. In fraud detection, a 2-hop neighborhood around an account includes:

• 1-hop: Direct transaction counterparties
• 2-hop: Counterparties of counterparties, revealing indirect exposure to known fraudulent entities

GCN outputs are invariant to node ordering. The aggregation operation (sum, mean, or max) is a symmetric function that produces identical results regardless of how nodes are indexed. This property is essential because graph data has no canonical node ordering—the same transaction network can be represented with different adjacency matrix permutations. Permutation invariance ensures the model learns structurally meaningful patterns rather than artifacts of data formatting.

The original GCN formulation is transductive—it requires the full graph structure at training time and cannot directly generalize to unseen nodes. However, the weight-sharing mechanism makes it inductive in practice when combined with appropriate sampling. For financial applications, this distinction matters:

• Transductive: Suitable for analyzing a fixed historical transaction graph
• Inductive: Required for real-time scoring of new transactions on previously unseen accounts

A spatial-based GNN that introduces a self-attention mechanism to dynamically weigh the importance of neighboring nodes during aggregation.

• Computes attention coefficients for each edge, allowing the model to focus on the most relevant transactional relationships
• In fraud detection, GATs can automatically learn to prioritize high-value or suspicious connections over routine ones
• Eliminates the need for pre-computed edge weights or knowledge of the full graph structure upfront
• Particularly effective for heterogeneous transaction graphs where not all counterparties are equally informative

An inductive framework for node embedding that generates representations by sampling and aggregating features from a node's local neighborhood.

• Unlike transductive GCNs, GraphSAGE generalizes to previously unseen nodes without retraining the entire model
• Uses configurable aggregation functions: mean, LSTM, or max-pooling over sampled neighbor features
• Critical for production fraud systems where new accounts and merchants appear daily
• Enables real-time inference on dynamic transaction graphs without full graph recomputation

A GCN variant designed for heterogeneous graphs that applies distinct weight matrices for each relationship type.

• Preserves the semantic meaning of different financial transaction channels: wire transfers, ACH, card payments, internal transfers
• Each edge type gets its own transformation, preventing information loss when modeling diverse payment rails
• Essential for anti-money laundering systems that must distinguish between structuring, layering, and integration patterns
• Can incorporate entity type information (individual, business, shell company) alongside transaction types

An unsupervised learning architecture that uses a GCN encoder to produce latent node embeddings and a decoder to reconstruct the original graph adjacency matrix.

• Flags anomalies through high reconstruction error: fraudulent nodes or edges deviate from learned normal patterns
• Does not require labeled fraud data, making it ideal for detecting novel and previously unseen attack vectors
• Variants like DOMINANT jointly reconstruct both structural and attribute information for more robust anomaly scoring
• Can be combined with contrastive learning to learn tighter representations of legitimate transaction behavior

A neural architecture for dynamic graphs that maintains a compressed memory state for each node, updated continuously as new chronological interactions occur.

• Captures evolving transactional behavior rather than treating the graph as a static snapshot
• Uses a message function, memory updater, and embedding module to process streaming edge events
• Critical for detecting velocity-based fraud where the timing and sequence of transactions reveals malicious intent
• Enables continuous learning on live payment streams without periodic full retraining cycles

A graph learning task focused on predicting the existence or likelihood of a future connection between two nodes.

• In fraud detection, used to forecast hidden relationships between seemingly unrelated accounts
• GCN-based link predictors score candidate edges using learned node embeddings and a decoder function (dot product, MLP)
• Identifies potential collusion rings before fraudulent transactions occur by detecting anomalous proximity in embedding space
• Also applied to identity resolution: linking synthetic identities that share subtle behavioral or structural fingerprints