FraudLens

Zero-leakage topological Graph ML platform for crypto forensics, engineered to detect laundering syndicates where standard models collapse under temporal drift.

Comment

Inspiration

Most published machine learning benchmarks for cryptocurrency Anti-Money Laundering (AML) boast F1-scores exceeding 0.95. In production, these same models collapse.

When we investigated state-of-the-art benchmarks on temporal Bitcoin transaction graphs (such as the Elliptic dataset), we uncovered a fatal flaw: severe transductive test-label leakage. Published pipelines were computing neighborhood aggregations across test edges, effectively allowing models to query future ground-truth labels. When real-world shocks hit—such as the abrupt shutdown of a major darknet marketplace at timestep t = 43—standard Graph Neural Networks (GNNs) experience catastrophic regime collapse.

We built FraudLens to solve this: a mathematically decontaminated, zero-leakage Graph ML intelligence platform engineered to survive real-world temporal distribution shifts while delivering interpretable forensic workflows to compliance teams.

What It Does

FraudLens operates via a dual-engine architecture bridging rigorous backend machine learning with an interactive investigator workspace:

  • Engine 1: Drift-Resilient Detection: Operates under strict zero-test-knowledge constraints. Instead of brittle end-to-end GNN embeddings, Engine 1 extracts a 150-dimensional invariant topological manifold (sparse Laplacian spectral decompositions, 1-hop neighborhood degree convolutions, and anomaly densities). To conquer prior-probability shift after t = 43, an extreme-value Otsu tail-thresholding engine dynamically recalibrates decision boundaries, maintaining a 57.4% post-drift recall (+98.7% lift over the strict non-leaked baseline).
  • Engine 2: Live Forensic Diffusion Canvas: Graph scores alone are not actionable for compliance officers. Engine 2 allows investigators to select flagged transactions (such as seed #174085) and execute real-time Personalized PageRank (PPR) diffusion across the temporal subgraph, mapping laundering syndicates with a 76.45% Hit@50.
  • Explainable AI (XAI) Attribution: Every flagged entity features inline TreeSHAP local attributions, breaking down exactly how features like flow_energy_entropy and neigh_in_max_out_deg contributed to the risk score.

How We Built It

  • Machine Learning Pipeline: Engineered in Python using PyTorch Geometric, scikit-learn, LightGBM, SciPy, and NetworkX. Preprocessing, domain-adversarial pruning, and causal feature transformers are strictly isolated within cross-validation folds to guarantee zero data leakage.
  • Audit Trail & Baselines: We developed a dedicated audit suite (ML/audit/) that replicates the original >0.95 F1 leakage vulnerability (guilty_walker.py), documents failed remediation baselines (Group DRO, walk-forward training, GCNs/GATs), and proves our champion model's mathematical integrity.
  • Backend Serving: A high-throughput FastAPI service that powers live forensic queries, graph expansions, and telemetry streaming.
  • Frontend Forensic Dashboard: A responsive, dark-mode compliance platform built with Next.js, React, Tailwind CSS, and Cytoscape/vis-network, deployed on Vercel.

Challenges We Ran Into

  • Diagnosing Transductive Contamination: Tracing exactly how graph convolutions leaked future information required designing custom causal split verifiers to ensure zero temporal edge traversal from t_train into t_test.
  • The t = 43 Darknet Collapse: Following the marketplace shutdown, illicit transaction volume dropped precipitously. Fixed-threshold models suffered catastrophic precision degradation. We resolved this through adaptive tail thresholding calibrated on rolling background transaction densities.
  • Balancing Graph Diffusion with Latency: Computing Personalized PageRank over massive subgraphs in an interactive browser UI required optimizing sparse matrix operations on the backend to return sub-second responses.

Accomplishments That We're Proud Of

  • 100% Causal Pipeline Integrity: Completely eliminating test-label contamination while outperforming standard honest baselines by +98.7% post-drift recall.
  • Transparent Research Trail: Open-sourcing not just a champion model, but the entire forensic audit trail proving when and why conventional methods fail.
  • Bridging Research & UX: Creating an end-to-end platform where complex topological manifolds translate directly into intuitive visual graphs for human investigators.

What We Learned

  • Benchmark performance in graph learning is frequently an illusion caused by transductive edge leakage rather than genuine structural generalization.
  • Domain-specific topological invariants (Laplacian spectrum and localized entropy) provide far greater stability under non-stationary covariate shift than black-box deep GNNs.

What's Next for FraudLens

  • Dynamic Mempool Ingestion: Extending the streaming topology engine to score unconfirmed Bitcoin transactions directly from the mempool.
  • Cross-Chain Bridge Forensics: Expanding topological diffusion algorithms across cross-chain bridges and Layer-2 rollups where multi-hop peeling chains are increasingly obfuscated.

Built With

Share this project:

Updates

Submission history