Temporal Graph Network (TGN)

Unlike discrete-time methods that process snapshots, TGNs operate on continuous-time dynamic graphs where events (transactions) arrive asynchronously. The core innovation is a temporal neighborhood aggregation scheme that interpolates node memory based on the exact timestamp of an interaction, not a batch window. This allows the model to capture sub-second fraud patterns like burst attacks that would be averaged out in hourly snapshots.

Each node maintains a memory vector—a compressed, learned representation of its entire interaction history up to the current time. When a new edge (e.g., a payment) occurs between a sender and receiver, the memory module updates both nodes' states using a recurrent architecture like a GRU. This memory acts as a running summary, eliminating the need to store and re-process the full history for every prediction.

For every temporal edge e_ij(t) between node i and j at time t, a message function computes a vector that encapsulates the interaction's information. This message typically concatenates:

• The source node's current memory
• The destination node's current memory
• Edge features (e.g., transaction amount, currency type)
• A time encoding of the interaction timestamp This message is then used to update the memory of the involved nodes.

To compute an embedding for a node at a specific time, TGNs use a temporal graph attention layer. This mechanism aggregates information from the node's temporal neighborhood—the set of past interactions. Crucially, attention weights are a function of:

• The features of the neighboring nodes
• The relative time delta between the interaction and the query time
• The edge features This allows the model to naturally discount stale connections and focus on recent, relevant transactions when assessing fraud risk.

Raw timestamps are not directly consumable by neural networks. TGNs employ a time encoder—often a Fourier feature mapping—to project a scalar time value into a high-dimensional vector. The encoding uses sine and cosine functions of different frequencies: cos(w*t + b). This continuous representation captures the periodic nature of time (e.g., hourly, daily cycles) and allows the model to learn temporal patterns like 'transactions at 3 AM are anomalous' without manual feature engineering.

The primary downstream task for TGNs in fraud detection is temporal link prediction. At any moment, the model computes a score for a potential edge between two nodes. A high score for an edge between a legitimate account and a known fraudulent entity signals a suspicious connection. This enables the real-time identification of evolving fraud rings—criminal networks that slowly build connections to avoid static graph analysis. The model learns to predict not just if a link exists, but when it is likely to form.

A graph structure that evolves over time through node/edge additions, deletions, and feature mutations. Unlike static graphs, dynamic graphs capture the temporal evolution of financial transaction networks.

• Continuous-time dynamic graphs: Events occur at arbitrary timestamps
• Discrete-time dynamic graphs: Captured as snapshots at fixed intervals
• Critical for modeling evolving fraud rings where new members join and transaction patterns shift
• TGNs operate natively on continuous-time representations, avoiding information loss from snapshot discretization

The core computational mechanism in TGNs where messages are exchanged between nodes upon each interaction to update a compressed memory state.

• Message function: Computes a message from source node, destination node, edge features, and timestamp
• Message aggregator: Pools multiple messages arriving simultaneously (e.g., mean, attention-based)
• Memory updater: A recurrent module (GRU or LSTM) that updates node memory given aggregated messages
• This mechanism enables nodes to remember long-term behavioral patterns without storing the entire interaction history

An attention mechanism that weights the importance of historical neighbors based on both structural and temporal proximity when computing node embeddings.

• Learns to attend more strongly to recent, relevant transactions
• Uses time-encoding functions (e.g., cosine-based) to represent continuous timestamps as vectors
• Attention scores combine content-based similarity with temporal decay
• Enables the model to distinguish between a legitimate recurring payment and a sudden, anomalous transfer to a new counterparty

GraphSAGE is a static inductive framework that samples and aggregates neighbor features; TGN extends this paradigm into the temporal domain.

• GraphSAGE: Operates on a fixed snapshot, no concept of time
• TGN: Incorporates temporal neighborhood sampling — only edges occurring before the target interaction are considered
• TGN adds memory state that persists across time, which GraphSAGE lacks
• For fraud detection, TGN captures the sequence of transactions leading to a suspicious event, while GraphSAGE sees only a static relational structure

The task of predicting the probability of a future edge between two nodes at a given timestamp, directly applicable to identifying suspicious transactions before they occur.

• TGN computes edge probability from source memory, destination memory, and temporal features
• Enables real-time scoring: as a new transaction request arrives, the model evaluates its likelihood given all prior graph history
• Low-probability edges under the learned normal model are flagged as anomalies
• Outperforms static methods on new account fraud by leveraging the temporal context of account creation and early activity

A function that maps continuous scalar timestamps into high-dimensional vector representations that can be consumed by neural networks.

• Cosine encoding: cos(t * w) where w is a learnable frequency vector
• Preserves temporal translation invariance properties
• Allows attention mechanisms to compute relative time differences between events
• Essential for TGNs to understand that a transaction occurring 5 minutes ago is fundamentally different from one occurring 5 days ago