GraphSAGE

Unlike transductive methods that require the entire graph at training time, GraphSAGE learns a mapping function from node features to embeddings. This allows it to generate representations for previously unseen nodes or entirely new graphs without retraining—critical for dynamic financial networks where new accounts and merchants appear continuously.

GraphSAGE performs fixed-size uniform sampling of a node's local neighborhood rather than using the full receptive field. This controls computational footprint and memory usage, enabling training on massive-scale transaction graphs with billions of edges where full-neighborhood aggregation would be infeasible.

The framework supports multiple differentiable aggregator architectures:

• Mean Aggregator: Takes element-wise mean of neighbor embeddings
• LSTM Aggregator: Applies a recurrent network to a random permutation of neighbors
• Pooling Aggregator: Feeds each neighbor through an MLP then applies element-wise max pooling
• GCN Aggregator: Uses the normalized adjacency-based convolution from spectral GCNs

Each aggregator captures different relational inductive biases.

GraphSAGE stacks multiple aggregation layers (typically K=2 or K=3) to capture information from increasingly distant neighbors. A 2-layer model aggregates features from nodes two hops away, enabling the detection of indirect collusion patterns where fraudsters are not directly connected but share common intermediaries.

The model leverages node attribute features (account age, transaction velocity, device fingerprints) alongside topological structure. This dual signal means a new node with features similar to known fraudulent nodes will receive a suspicious embedding even before forming many connections—enabling zero-shot fraud risk assessment for new accounts.

GraphSAGE is designed for mini-batch stochastic gradient descent. Each batch samples a target node set, recursively samples their neighbors up to depth K, and computes embeddings only for the required subgraph. This avoids loading the full graph into GPU memory, making it practical for production-scale financial graphs with hundreds of millions of transactions.

The process of mapping discrete graph nodes to a low-dimensional, continuous vector space. GraphSAGE is a specific inductive method for generating these embeddings, unlike transductive approaches like Node2Vec. The geometric proximity of these vectors preserves the structural roles and feature similarities of the original network, enabling them to be used as feature inputs for downstream classifiers.

The fundamental computational paradigm that GraphSAGE implements. Nodes iteratively exchange vectorized information with sampled neighbors to update their hidden states. The process involves three core functions:

• Message function: Computes a message from a neighbor's features
• Aggregation function: Pooling neighbors' messages (e.g., mean, LSTM, max-pooling)
• Update function: Combines aggregated messages with the node's own state

A spectral-based GNN that GraphSAGE was designed to improve upon. While GCNs require the full graph Laplacian during training and cannot generalize to unseen nodes, GraphSAGE replaces the spectral convolution with a spatial neighborhood aggregation function. This inductive capability makes GraphSAGE practical for dynamic financial graphs where new accounts are constantly created.

A spatial-based GNN that introduces a self-attention mechanism to dynamically weigh neighbor importance during aggregation. Unlike GraphSAGE's uniform or fixed sampling, GAT learns implicit weighting coefficients. In fraud detection, this allows the model to automatically discount noisy or irrelevant transaction partners while focusing on the most suspicious relationships.

A core graph learning task where GraphSAGE embeddings excel. By generating embeddings for two nodes, the likelihood of a hidden or future connection can be predicted using a binary classifier on the combined embeddings. In financial networks, this is used to forecast collusive relationships or discover undisclosed beneficial ownership links between seemingly unrelated accounts.

An architecture for dynamic graphs that maintains a compressed memory state for each node, updated continuously as new transactions occur. While GraphSAGE operates on static snapshots, TGNs process streaming edges. For real-time fraud detection, TGNs capture the evolving behavioral patterns that GraphSAGE's static aggregation would miss between periodic retraining cycles.