Temporal Graph Network (TGN)

The core innovation of a TGN is its node memory, a compressed vector state that is updated after each interaction. Unlike discrete-time models that process snapshots, the memory module ingests events asynchronously using a recurrent mechanism (often a GRU or LSTM). When a transaction occurs between two accounts, the model retrieves their current memory vectors, processes the interaction, and writes updated states back. This allows the model to remember long-term behavioral patterns, such as a dormant account suddenly becoming active, without reprocessing the entire history.

TGNs compute messages between interacting nodes to update their states. A critical component is the temporal encoding, which maps the timestamp of an interaction into a high-dimensional vector. This encoding, often using Bochner's theorem or sinusoidal functions, allows the model to learn periodic patterns (e.g., payroll cycles) and understand the significance of time intervals. The message function combines node features, edge features, and this temporal encoding to generate a raw update vector, which is then fed into the memory module.

A direct read of node memory can be problematic if a node has been inactive for a long time—its memory state becomes stale. The TGN embedding module solves this by computing a fresh node embedding on-the-fly using a graph attention mechanism. It aggregates information from the node's temporal neighborhood, effectively interpolating between the stale memory and the current state of its neighbors. This ensures that even a dormant account's representation reflects the latest context of its counterparties before a new transaction is scored.

TGNs are trained on chronologically ordered interaction streams, not shuffled batches. The training loop processes events sequentially, updating node memories as it goes. To maintain computational efficiency, the graph is divided into temporal batches—contiguous chunks of time. Within each batch, interactions are processed in parallel where dependencies allow, but the memory state is propagated sequentially from one batch to the next. This preserves the causal structure of the data and prevents information leakage from the future.

In financial fraud detection, TGNs excel at identifying adaptive adversaries. A fraud ring might slowly build a legitimate-looking transaction history before executing a bust-out scheme. A TGN's memory module tracks this gradual behavioral shift, while the temporal encoding flags the anomalous acceleration of activity. When a new transaction arrives, the model computes a risk score in milliseconds by combining the sender's and receiver's up-to-date embeddings, effectively performing link prediction on the dynamic transaction graph.

A static GNN treats a transaction graph as a single, timeless snapshot, losing all sequential information. It cannot distinguish between a payment made yesterday and one made a year ago. A TGN, by contrast, models the graph as a temporal point process. Key differences include:

• Statefulness: TGNs maintain evolving node states; static GNNs compute embeddings from scratch.
• Inductive Capability: Both handle new nodes, but TGNs can immediately incorporate a new node's first interaction into its memory.
• Temporal Generalization: TGNs learn patterns of when things happen, not just what is connected.

The fundamental data structure underlying TGNs, representing a network where nodes and edges evolve over time. Unlike static snapshots, a dynamic graph captures the chronological sequence of financial transactions as a continuous stream of timestamped events. This allows the model to learn from the temporal order of interactions, distinguishing a legitimate salary deposit followed by normal spending from a sudden burst of high-velocity transfers indicative of account takeover. TGNs operate directly on this temporal representation, treating the graph as a living, breathing entity.

The core computational mechanism adapted by TGNs for the temporal domain. When a new transaction occurs between two nodes, a message is computed based on the interaction's features, the sender's current memory state, and the timestamp. This message is then passed to update the recipient's compressed memory. This process allows information to propagate through the graph over time, enabling a node's representation to reflect not just its own history, but the chronological influence of its neighbors.

A compressed, learnable vector maintained for each node that summarizes its entire historical interaction sequence. The memory is updated recursively via a learnable function (often a GRU or LSTM) whenever the node is involved in a new event. This acts as a temporal state, capturing long-term behavioral patterns without needing to store the full raw history. For fraud detection, a node's memory encodes its evolving risk profile, updating instantly after each transaction.

An attention mechanism that learns to dynamically weigh the importance of past interactions when updating a node's representation. Instead of treating all historical neighbors equally, temporal attention assigns higher scores to recent or highly relevant transactions. This is critical for fraud detection, where a node's most recent behavior is often the strongest indicator of current risk, allowing the model to focus on the recency and relevance of relational signals.

The primary downstream task for which TGNs are optimized. Given the current memory states of two nodes at a specific timestamp, the model predicts the probability of a future interaction occurring between them. In financial networks, this translates directly to forecasting whether a specific account will transact with a known fraudulent entity or a new, suspicious counterparty. A high-probability link to a high-risk node is a powerful anomaly signal.

TGNs model the graph's evolution in continuous time rather than discrete time steps. This means the model can handle transactions arriving at irregular, arbitrary intervals—the exact nature of real-world payment streams. The architecture uses a time-encoding function to represent the gap between events, allowing it to understand the significance of temporal distance. A $10,000 transfer 5 minutes after a password change carries a different risk signal than one occurring 5 days later.