Safeguarding Fraud Detection from Attacks: A Robust Graph Learning Approach

1 Introduction

In recent years, financial fraud has become a serious social problem that affects not only the property security of individuals and enterprises, but also the stability and credit of the financial system. The survey [PricewaterhouseCoopers, 2022] reveals that 46% of surveyed organisations reported suffering from some form of fraud or economic crime within the last 24 months. Increasingly, it appears that financial fraud has moved from the fringes of financial market activity to become a widespread type of behavior [Reurink, 2019], which has posed great threats to economic growth and social wellbeing like employment and personal safety. As the number of fraud cases has intensively risen in recent years, fraud detection is becoming an increasingly critical topic [Khedmati et al., 2020]. Since graphs can effectively capture long-range correlations among inter-dependent data objects [Akoglu et al., 2015], recent advanced researches have started to model and identify fraud behaviors on the basis of graphs [Xiang et al., 2023; Zhang et al., 2024]. Among many graph-based research methods, Graph Neural Networks (GNNs) have become a widely applied graph analysis method [Liang et al., 2023]. These methods can achieve a certain level of accuracy and efficiency in identifying financial fraud in various fields.

∗Corresponding Author is Dawei Cheng.

However, whenever it becomes known that one detection method is in place, criminals will adjust their fraud strategies accordingly and attempt alternative ones [Bolton and Hand, 2002]. The survey [PricewaterhouseCoopers, 2022] also reveals a trend that could threaten the social order to a great extent: organized crime groups are becoming more specialized and professional. This can be illustrated by their attempts to conceal their fraudulent behavior as legitimate. As is shown in Figure 1, fraud nodes will imitate the features of normal nodes and modify the graph structure to disturb the detector's judgment. Such a perturbation attack on the graph often leads to a decrease in the accuracy of the detector's judgment, which has become an urgent crisis and challenge for the finance industry and academia. If not properly addressed, fraudsters can exploit the vulnerability of those fraud-detecting models, causing severe property losses and social distrust of the existing financial system.

Existing researches have made decent progress in two critical aspects: some of them have improved the accuracy of models in fraud detection, while others have enhanced the robustness of models in universal scenarios. However, as real-world fraudsters continually evolving their fraud methods and carrying out purposed attacks on models, there still exist new challenges to be settled. First, for most existing GNN-based anti-fraud models, they do not take into account the increasingly complex financial-fraud scenarios consisting of adversarial attacks from different aspects. They rely heavily on the original graph which may be artificially perturbed by fraudsters and therefore become vulnerable during the process of node aggregation. On the other side, for those models specializing in the defense of graph adversarial attacks, they tend to study on ideal and unpractical environments and datasets, failing to focus on real-life based financial settings. And mainstream methods based on direct truncation or filtering [Wu et al., 2022; Huang et al., 2023] may lose parts of detailed information of the graph, which will to some extent affect their overall performance on fraud-detection missions in spite of their high robustness.

These motivate us to design a novel robust anti-fraud graph neural network framework to address the two main dilemmas. In this paper, we first design an algorithm which simultaneously perturbs node features and topological structures of graph data to simulate the possible multifaceted attacks from fraudsters, and then propose a novel GNN-based model with graph learning and singular value decomposition (SVD) called GLSGNN to defend against the attacks. In particular, there are two key points in the model: (i) design novel joint loss functions for the model by exploiting the properties of pure graph data to improve its robustness while maintaining classification precision; and (ii) decompose the graph and apply them as learnable parameters, which enables the model to learn more patterns of the graph in low-rank subspaces with sufficient details. Specifically, we first employ the method of SVD to decompose the adjacency matrix of the attacked graph into three matrices. Each of these matrices will be independently learned as a parameter during the update of the model. Then, we optimize the model with a specially designed loss function containing weighed penalization based on sparsity, class-homophily, and classification results and try to recover the pure graph. For the attack part, we select different proportions of fraud nodes. We not only falsify parts of their features to disguise them as non-fraud ones, but also reconnect them to innocent nodes to perturb the graph structure. We conduct experiments on a real-world medical insurance dataset [Gupta, 2019] and Amazon fraud dataset [Zhang et al., 2020], which demonstrates our model's superior performance on both fraud detection and robustness. Contributions of our work are summarized as follows:

• To the best of our knowledge, this is the first work that addresses the crucial anti-fraud problem in financial fields with multifaceted attacks on data by modeling the conspiracy defraud in a learnable robust graph neural network, which provides a solution to the newest and

most advanced fraud patterns.

• In order to simulate real-world fraud scenarios, we design poisoning attacks on both the features of nodes and the edge structure. To defend against the attacks, We propose a novel anti-fraud graph neural network model learning decomposed adjacent matrix under the constraint of an elaborate joint loss function, which is capable of handling the variability of attack patterns while keeping high classification precision.
• Extensive experiments on real-world fraud datasets show that our proposed method outperforms the compared state-of-the-art baselines in fraud detection.

2 RelatedWorks

2.1 Graph Neural Networks for Fraud Detection

By mining the hidden features of nodes and focusing on the complex relationships between nodes, graph neural networks (GNNs) have become pivotal in fraud detection missions [Cheng et al., 2020; Ma et al., 2023], with recent researches adopting fraud detection strategies such as SemiGNN [Wang et al., 2019a] using attention mechanisms and information aggregation, [Zhang et al., 2023] introducing a rule mining module refined with expert knowledge, CARE-GNN [Dou et al., 2020], PC-GNN [Liu et al., 2021] utilizing neighbor selector for imbalanced supervised learning on graphs and so on. Other works also focus on different node types and various relationships between nodes. They utilize heterogeneous information networks to enhance their capabilities in fraud detection. FdGars [Wang et al., 2019b], HACUD [Hu et al., 2019], FRAUDRE [Zhang et al., 2021] focus on the features of different nodes or edges in real-world fraud detection scenarios. H2-FDetector [Shi et al., 2022] considers both homophilic and heterophilic connections and applies aggregation strategies separately. GAGA [Wang et al., 2023], a novel group aggregation enhanced transformer, provides a portable method to cope with the low homophily issue. However, these works rely heavily on the original graph and thus make it difficult to cope with fraudsters' disguises and perturbation, which poses a great threat to the security of the anti-fraud system. In contrast, we aim to devise our model and improve its robustness from the perspective of possible attacks on graph data in real-world financial fraud cases, which fills the gap in the field and can inspire more work in the community.

2.2 Graph Adversarial LearningMethod

In order to reduce the influence of adversarial attacks on graphs, researches have been made on defense methods. The defense methods on graph data can be mainly divided into four parts: disturbance detection, graph purification, adversarial training, and robust model. DONE [Bandyopadhyay et al., 2020] uses two parallel autoencoders to deal with structural and attribute anomalies respectively and detect abnormal disturbances of nodes. RTGNN [Qian et al., 2023] generates pseudo-labels on unlabeled nodes and supervises nodes with different types of labels adaptively for effective learning while minimizing the impact of noisy labels. GraphDefense [Wang et al., 2019c], BVAT [Deng et al., 2019], LATGCN [Jin and Zhang, 2019] construct a powerful perturbed

data close to the original data through adversarial training, and ultimately obtain a more robust model on these perturbations. Recent typical robust models employ various strategies such as RGCN [Zhu et al., 2019], RoHe [Zhang et al., 2022] using attention mechanisms, Pro-GNN [Jin et al., 2020] learning the clean graph structure, RT-GCN [Wu et al., 2022], GSR [Zhao et al., 2023] considering graph structure refinement, Mid-GCN [Huang et al., 2023] exploring midfrequency signals to enhance their effectiveness against adversarial attacks in graph-based scenarios. However, most existing defense methods still have flaws in our situation. In spite of their robustness, popular graph refinement algorithms based on truncation and filtering will break the graph structure and cause information losses, which makes them less competitive than those fraud detection models in overall performances on less disturbed graphs. Hence, we introduce a novel anti-fraud model that learns a decomposed adjacent matrix, constrained by an elaborate joint loss function, which makes full use of the graph details to enhance the accuracy of fraud detection while keeping its robustness.

3 ProposedMethod

In this section, we introduce the method proposed in detail. First, we present the definition of the problem. Second, we show the overall structure of our framework GLSGNN. Third, we explain the design of every part of GLSGNN, including the singular value decomposition, the convolutional layer, and the learning of decomposed adjacent matrix. Lastly, we introduce the optimization strategy.

3.1 ProblemFormulation

In this paper, we denote the graph as G = (V, E), where V = {ν0, ν1, . . . , νNv } represents the set of the nodes in the graph and E = {e0,0, e0,1, . . . , ei,j, . . . , eNv,Nv } represents the set of the edges in the graph. Nv = |V| is the number of nodes, Ne = |E| is the number of edges, and ei,j denotes the edge from node νi to node νj, representing the relationship between those two nodes. Considering the two significant aspects of a graph: node features and topological structure, a graph can also be denoted as G = (A,X), where A ∈ RNv×Nv is the adjacent matrix of the graph and X ∈ RNv×Nf is the feature matrix of the nodes. Simultaneously, the features of nodes can be denoted as X = {x0, x1, . . . , xNv }, with xi being the feature of node νi and Nf being the number of features of one node. Furthermore, the set of the labels is denoted as Y = {y0, y1, ..., yNv }, in which yi represents the label of node νi. The label of a normal node is 0, while the label of a fraud node is 1.

Based on reality, we design two different kinds of attacks on the graph to simulate the behavior of fraudsters. Firstly, since the features of nodes are important factors to classification and parts of them can be deliberately controlled by fraudsters, we perturb some of the values to perform feature attacks. Secondly, as fraudsters may impersonate others or participate with outsiders to conceal their identities by attaching themselves to non-fraudulent ones, we tend to add fake edges to the adjacent matrix to perform structure attacks. Different from most previous studies, we simultaneously apply attacks to features and graph structure, which is more challenging and closer to real life. Therefore, the problem we study in this paper can be presented as follows: given an attacked graph G = (V, E), we aim to get an ideal classification result on unlabeled nodes by learning both GNN parameters and the graph G in our proposed framework. In particular, our model needs to learn the classification criteria while purifying the graph to defend against attacks on data.

3.2 Model Architecture

The overall structure of our proposed framework is illustrated in Figure 2. In order to defend against the feature attacks and structure attacks mentioned above, we construct a novel model structure called GLSGNN. Firstly, we apply the singular value decomposition to the attacked graph to get the decomposed matrices of the adjacent matrix. Then, in addition to the common parameters of graph convolutional layers in GNN, we also set the decomposed matrices as learnable parameters in the model, aiming to fit the attacked graph to certain characteristics of pure ones. Besides the penalty for misclassified results, we design several loss functions specifically for the adjacent matrix to learn its sparsity and classhomophily. Besides, to avoid the learned graph being too different from the original one and containing too many noises, we add an extra restriction to it. Benefit from the combination of those methods, our model can make effective corrections to the attacked graph. At the same time, we can obtain a less interfered GNN model, which therefore performs better on the final classification mission.

3.3 Adversarial Learning with Structure Decomposition

We first decompose the adjacent matrix by using singular value decomposition (SVD), and the results will be applied as the initial values of three learnable parameters in the following GNN model which will be continuously updated and projected back as the approximation of the input graph. The motivation of this design is based on the fact that most existing low-rank methods merely preserving top-k singular components will inevitably impair the details of the graph [Deng et al., 2022]. And several recent researches in other fields like [Wang et al., 2021] have demonstrated that learning with decomposed matrices will help to get a low-rank structure and a better spectrum decay pattern of the original matrix by learning in low-rank subspaces, which further inspires us to perform the decomposition on the adjacent matrix of the graph. The SVD process can be formulated as:

U is the left singular vector matrix. Every its column vector ui is the eigenvector of AA⊤. The eigenvalue λui of AA⊤ satisfies:

V is the right singular vector matrix. Every its column vector vi is the eigenvector of A⊤A. The eigenvalue λvi of A⊤A satisfies:

Σ is the singular value matrix and it's a diagonal matrix. Every element σi on its diagonal is the singular value of A. The eigenvalue λui of AA⊤ satisfies:

Therefore SVD can be expressed in another equivalent form, in which r represents the rank of A:

It has to be additionally mentioned that choosing SVD as the method of matrix decomposition has more advantages. Each singular value multiplied by its corresponding left and right singular vectors will result in a matrix with rank 1. Each of them contains one part of the graph's information, and larger singular values refer to matrices representing more important patterns of the original adjacent matrix of the graph. Hence, by learning those decomposed matrices, the model is able to view the graph in different subspaces, which helps it obtain more information that may not be easily extracted from the original adjacent matrix.

We denote the initial value of the approximate adjacent matrix as A(0) . Considering the meaning of adjacent matrix in real life, we pass it through a ReLU function to eliminate the negative values, which can be formulated as:

3.4 Graph Convolutional Layer with Attention

Among all these GNN models, we choose a two layer GAT [Velickovic et al., 2017] as the base of our model. By assigning different weights to neighboring nodes, the attention mechanism can significantly enhance the robustness of graph convolutional layers, which aligns with our ultimate goal. Except from the weights W in convolutional layers, we set other three learnable parameters U(t) , Σ(t) , V(t) and initialize U(0) , Σ(0) , V(0) with the U, Σ, V obtained in SVD. The approximation of the adjacent matrix A(t) used in the learning of the model can be formulated as:

where t is the iteration number.

The attention mechanism can be calculated as follows. Firstly, we evaluate the similarity between nodes, where sij is the similarity coefficient, NN is a single layer feed-forward neural network, and hi is the embedding of node νi:

We can get the attention coefficient αij through the following formulation after passing the similarity coefficient sij through a LeakyReLU function to activate it, where Ni is the set of neighbors of νi:

Finally, the output of node embedding h′i after passing through the convolution layer can be formulated as follows, where we choose ELU as the activation function and K is the number of all the attention heads:

3.5 Graph Structure Learning

In those real-life pure graph data, most of the nodes are only connected to a small number of other nodes [Zhou et al., 2013]. The scale of connection between nodes is relatively small compared to the size of the whole graph, therefore the adjacency matrix of the entire graph will remain sparse. As analyzed above, fraudsters tend to connect themselves to other innocent nodes and add edges to the graph, which will to some extent make the graph denser. In order to learn the characteristics of sparsity, we consider adding a penalty for the extra edges in the graph. Therefore we introduce the frobenius form, and denote this loss function as Lsparse.

The sparsity of the graph in a normal adjacency matrix means that elements with the value of 1 are as few as possible. Although the adjacency matrix A(t) no longer only consists of binary values of 0 and 1 in the learning process, having fewer large values in the adjacent matrix still represents that the graph is sparser. Therefore, using frobenius norm as a constraint can have a decent effect.

Latest researches [Choi et al., 2022; Zhao et al., 2021] show that it is more helpful for GNNs to learn node classification criteria when there exist many edges in the graph connecting nodes of the same class. This kind of connection pattern between nodes is called class-homophily. This is also easy to understand in real-life circumstances. For example, in a social network, similar people with the same backgrounds and behaviors will have relationships with each other.

In our anti-fraud practice, the characteristic of classhomophily still exists. Firstly, conspiracy fraud involving gangs has become increasingly common in recent years. Secondly, an individual on suspicion of fraud is likely to behave fraudulently in several other records, which are usually connected in the graph structure. Hence, we evaluate the class similarity between nodes by designing a loss function denoted as Lclass. If the connected nodes have different labels, Lclass is going to increase for punishment.

3.6 Loss Function and Optimization

Except from Lsparse and Lclass, the entire loss function contains two more parts: Firstly, we denote the loss of classification as Lout. This is the common loss function of GNNs, which is applied to evaluate the gap between the original labels and the predicted results. We choose to use the crossentropy function to calculate it, where ˆ yi is the predicted label, because the cross-entropy function can not only present the performance of the model on node classification, but also keep a decent rate in the gradient descent process.

Secondly, we don't want the adjacency matrix to change too much during the learning of the model, which will introduce excessive noises and make the learned graph unreal. Therefore, we add another loss function Ldiff to make a constraint to the changes. By calculating the differences between the adjacent matrix in the learning process and the initial one, we can keep it in an appropriate range.

Finally, we add weights between all the parts mentioned above to formulate the entire joint loss function L, where α, β, γ are hyper-parameters:

The model can be optimized through standard stochastic gradient descent-based methods. We use a default Adam optimizer [Kingma and Ba, 2014] with a learning rate of 2×10-3 to execute the optimization process.

4 Experiments

4.1 Experiment Settings

Datasets. To demonstrate the effectiveness of our model, we choose two real-world datasets. The first one is a medical insurance dataset based on real medicare claims [Gupta, 2019] containing inpatient data, outpatient data, and beneficiary details data. Due to the limit of computing resources, we choose a subset of the original dataset and join different kinds of data according to the claimID. Experts from our cooperating organization help us analyze the data and label fraud behaviors. We view each claim as a node, and if two claims within a certain time period have the same provider or beneficiary, we connect these two nodes with an edge. We also filter out several unhelpful features. The other one is the Amazon fraud dataset, a multi-relational graph dataset built upon the Amazon review dataset [Dou et al., 2020]. 25 handcrafted features from [Zhang et al., 2020] are used in the dataset including product data, user data, etc. Users are nodes in the graph, and have three relations: U-P-U, U-S-U, and U-V-U, which respectively connect users reviewing same products, users giving same ratings and users with similar reviews. We use the union of all these relations in our experiment. Table 1 shows the detailed statistics of the datasets.

Baselines. We employ the following state-of-the-art methods on our benchmark dataset to highlight the effectiveness of the proposed GLSGNN, which are mainly divided into two categories. Firstly, we select popular GNN-based fraud detection methods including GraphSage [Hamilton et al., 2017], GEM [Liu et al., 2018], FdGars [Wang et al., 2019b], GraphConsis [Liu et al., 2020], CARE-GNN [Dou et al., 2020], PCGNN [Liu et al., 2021], FRAUDRE [Zhang et al., 2021], H2 - FDetector [Shi et al., 2022], GAGA [Wang et al., 2023]. Secondly, we also select several graph adversarial defense methods including GCN [Kipf and Welling, 2016], GAT [Velickovic et al., 2017], RGCN [Zhu et al., 2019], ProGNN [Jin et al., 2020], GARNET [Deng et al., 2022], RT-GCN [Wu et al., 2022], Mid-GCN [Huang et al., 2023]. In these experiments, the tasks are learned independently.

Evaluation Metrics and Parameter Settings. In the experiment, we utilize area under curve (AUC), macro average of F1 score (F1-macro), recall score and accuracy to evaluate the effectiveness of our model, which ensures the validity of our experiment. For the hyper-parameters, in consideration of the overall performance, we set the weight α of Lsparse to 0.0005, the weight β of Lclass to 0.0005, and the weight γ of Ldiff to 0.1. We adopt a GNN framework with 2 graph convolutional layers, 8 hidden features and 5 attention heads.

Adversarial AttackMethod. We adopt a poisoning attack rather than an evasion attack, since the former perturbs the data before the training process of the model while the latter only performs attacks on test data. In most cases, it is more difficult to defend a poisoning attack because it will directly affects the learning of parameters of the model, which is also closer to real-life scenarios. Specifically, We simultaneously attack the features and structures of the graph data to simulate complex fraud behaviors, and we will first introduce our strategy on the medical insurance dataset:

• Feature Attack: we first randomly select some fraud nodes in an attempt to disguise them as normal nodes. Then, we manually choose parts of the features which have the risk of being controlled by fraudsters like reimbursements, deductible amount, etc. After calculating the data distribution of normal nodes, we randomly modify those picked features of the selected fraud nodes to random values between 40%-60% quantiles of the feature attributes of normal nodes.
• Structural Attack: we are inspired by real-world crimes and base on the connection rules mentioned above to perturb the structure. For the fraud nodes previously chosen, we change the provider of it to the one of a random normal claim within the limited time period. Therefore these nodes will be reconnected to other normal ones, thereby perturbing the entire graph structure.

And for the Amazon fraud dataset, since the data are wellencapsulated and thus being hard for us to distinguish the specific features and nodes, we slightly modify the attack patterns by perturbing several random features of those selected fraud nodes to the range of normal ones and creating fake edge links directly on the adjacent matrix.

4.2 Fraud Detection Performance

We compare our model with the state-of-the-art anti-fraud methods to validate its performance in the original fraud detection task. Table 2 shows the result of the experiment. From the statistics, it can be seen that our proposed GLSGNN model achieves excellent performances in the cases, and surpasses most of the baseline methods. Especially in the medical insurance dataset, our model consistently outperforms the baseline with AUC values ranging from 5.9% to 45.6%, F1 score ranging from 5.0% to 79.0%, recall score ranging from 10.8% to 46.4%, and accuracy ranging from 5.0% to 64.6%, representing a notable enhancement. Due to the design of learning matrices decomposed from the full input graph, our model doesn't suffer from the flaws of existing defense models of missing important graph details, thus showing its strong ability in fraud detection precision.

4.3 Adversarial Attack Performance

In the experiment, we apply the attack algorithm introduced above on both of the datasets and set the attack rate at every 5% from 0% to 25%. From table 3, compared with popular graph adversarial defense methods, our model shows a better performance, which maintains a stable level on all metrics with small fluctuations within an acceptable range. Our model keeps high AUC scores over 0.96 and F1 scores over 0.9 on the amazon-fraud dataset. And simultaneously, on all attack ratios on the medical insurance dataset, our model reaches AUC scores over 0.72 and F1 scores over 0.69, which shows a greater advantage over the defense baselines.

And it is worth mentioning that many popular baselines can not get satisfying results on the medical insurance dataset. The most probable reason is that this dataset has only 89218 edges, far less than the Amazon fraud dataset, which makes some models struggle to aggregate information. However in real-world fraud cases, the number of edges in the data varies a lot, and the superior performance of our model on the medical insurance dataset further improves the ability and practical value of it on different real-world scenarios. In conclusion, these outcomes strongly affirm the superiority of our proposed model, showing its high precision in detecting fraud nodes and the stability against intentional perturbations.

4.4 Parameter Sensitivity and Ablation Study

We first vary the important hyper-parameters of α, β, and γ in the loss function to discover their effects on classification results. We make this experiment on the medical insurance dataset and set the attack rate to a peak value of 25%. Figure

3(a), 3(d) show the influence of the weight α of Lsparse varying from 0.0001 to 0.002. The result shows that our model performs better when increasing α from 0.0001 to 0.0005, and then remains stable. Figure 3(b), 3(e) show the influence of the weight β of Lclass varying from 0.0001 to 0.002. The result slightly fluctuates when β exceeds 0.0005 as focusing too much on edges connecting similar nodes may introduce unnecessary noises. Figure 3(c), 3(f) show the influence of the weight γ of Ldiff varying from 0.1 to 1. The AUC score shows a overall decline when we increase the value of γ, which is probably due to the fact that limiting changes to the graph will also to some extent restrict the model's ability to purify the graph. In conclusion, we can observe that our model shows a strong stability with different hyperparameters. It implies that different loss items in our joint loss function can keep a dynamic balance during the learning of the model, which guarantees the capability of our model in complicated and volatile situations.

In order to demonstrate the effectiveness of the important components in our proposed method, we also conduct an ablation study. After ablating the SVD module, the AUC score falls by 4.6% and the F1 score falls by 3.0%. We also remove the additional items in the joint loss function and only keep the cross-entropy loss. In this situation, the AUC score falls by 2.9% and the F1 score falls by 2.1%. The result of this experiment validates the necessity of the components of our GLSGNN in robust fraud detection missions.

5 Conclusion

In this paper, in order to solve the two novel critical challenges on financial fraud detection: (i) anti-fraud GNN models are fragile facing attacks from fraudsters on graph data; and (ii) robust defense models have unsatisfying classification precision due to information losses during the process of truncation or filtering, we propose a novel robust anti-fraud framework GLSGNN. To mimic the behavior of real-life fraudsters, we simultaneously implement attacks on graph structure and features. In order to keep both high robustness and superior performance on classification, our model learns the adjacent matrix decomposed by SVD in a graph convolutional network with attention mechanism and specially designed loss functions, which enables the model to learn better patterns with a graph being continuously purified without losing too much details. Experiments on real-world fraud datasets demonstrate the outstanding performance of our GLSGNN on fraud detection and robustness compared with other baselines. The effectiveness of GLSGNN will also provide the real-life anti-fraud systems and practitioners with new ideas and inspirations to improve social security and justice, which will make contributions to economic growth and social well-being including employment, health and so forth.

Acknowledgements

This work was supported by the National Key R&D Program of China (Grant no. 2022YFB4501704), the National Natural Science Foundation of China (Grant no. 62102287), and the Shanghai Science and Technology Innovation Action Plan Project (Grant no. 22YS1400600 and 22511100700).