Graph Neural Network (GNN)

The core mechanism of a GNN is the message-passing framework. Each node updates its hidden state by aggregating feature vectors from its local neighborhood. This recursive process allows a node to capture information from its multi-hop surroundings, effectively encoding the local graph topology into a fixed-size embedding. Common aggregation functions include mean, sum, and max pooling, with advanced architectures like Graph Attention Networks (GATs) using self-attention to learn optimal weighting for each neighbor.

GNNs are designed to be permutation invariant, meaning the output for a node or graph is independent of the arbitrary ordering of input nodes. This is a critical property for graph data, which has no inherent canonical node order. The readout function—which aggregates all node embeddings into a single graph-level vector—must also be invariant, typically using operations like global sum or mean pooling. This ensures identical graphs with different node ID assignments produce identical representations.

Unlike transductive methods that require all nodes to be present during training, inductive GNNs like GraphSAGE learn a function to generate embeddings for previously unseen nodes. By learning a set of aggregation functions parameterized by the node's local neighborhood features, the model can generalize to new entities added to a dynamic transaction graph without retraining. This is essential for production fraud systems where new accounts are created constantly.

Financial ecosystems contain diverse entities. Relational Graph Convolutional Networks (R-GCNs) and Heterogeneous Graph Transformers extend the GNN framework to handle multiple node types (e.g., account, merchant, device) and edge types (e.g., pays, owns, logs_in). They apply distinct weight matrices for each relationship type, preserving the semantic meaning of different interactions. This allows a single model to learn a unified representation space for the entire financial graph.

Standard GNNs operate on static snapshots, but fraud is inherently temporal. Temporal Graph Networks (TGNs) maintain a compressed, continuously updated memory state for each node. When a new transaction (edge) occurs, the model updates the involved nodes' memories using a recurrent module like a GRU. This allows the network to capture evolving behavioral patterns and detect anomalies in the sequence of interactions, not just their static structure.

Labeled fraud data is scarce. GNNs can be pre-trained using contrastive learning objectives that maximize mutual information between different augmented views of the same graph. By learning to distinguish a node's true local subgraph from a corrupted one without any labels, the model captures robust structural and feature-based priors. This pre-trained encoder can then be fine-tuned on a small set of labeled fraud examples, dramatically improving performance in low-resource scenarios.