Conspiracy Spoofing Detection via Structure-Augmented Generative Graph Model

1 Introduction

Spoofing, a deceptive trading practice, manipulates market perceptions to gain unfair advantages. For example, as shown in Figure 1, traders may place large non-executable orders (e.g., sell orders before buying or buy orders before selling) to distort supply and demand, thereby manipulating prices [Charoenwong et al., 2024]. This practice distorts market dynamics, undermines fairness and transparency, and causes significant economic losses annually. Detecting spoofing is critical for fair trading in financial markets such as stock trading and commodity exchanges [Du et al., 2024; Charoenwong et al., 2023]. Recently, as computing power grows, algorithmic trading and high-frequency trading enable spoofing to be executed at unprecedented speeds, making manual spoofing detection difficult. The expansion of e-commerce and digital banking further exacerbates this issue, highlighting the need for advanced fraud detection systems [Motie and Raahemi, 2024; See et al., 2024].

∗Corresponding Author.

Traditional spoofing detection relied on rule-based methods, which generated alerts based on predefined behaviors [Whitrow et al., 2009]. These methods lacked adaptability to evolving fraud patterns. Machine learning approaches emerged as data-driven solutions that continuously improve over time [Bhattacharyya et al., 2011]. Deep learning techniques, particularly Convolutional Neural Networks (CNNs) and Graph Neural Networks (GNNs), have advanced the field by identifying complex fraud patterns [Fu et al., 2016; Cheng et al., 2020; Xiang et al., 2023; Liu et al., 2023a; Li et al., 2024]. Graph-based methods have further enhanced fraud detection by considering both individual node features and network relationships [Cheng et al., 2025]. These methods capture intricate patterns often missed by traditional approaches [Vatter et al., 2023]. For example, graph attention networks and spatial graph networks have been applied to financial fraud detection [Liu et al., 2023b]. Recent models like BWGNN, GAGA, PC-GNN, GTAN, and BSL address challenges such as spectral heterophily and label scarcity [Tang et al., 2022b; Wang et al., 2023; Liu et al., 2021; Xiang et al., 2023; Yu et al., 2024].

However, existing graph-based methods face three main challenges in spoofing detection: (i) newly emerging transactions often lack labeled connections, limiting the effectiveness of label propagation; (ii) current methods struggle to capture complex substructures associated with spoofing; and (iii) they fail to simultaneously account for temporal dynamics and heterogeneity in distinguishing spoofing from benign transactions. All the baselines fall in at least one of them. To address these challenges, we propose a novel StructureAugmented Generative Graph Model (SAG2M). Our approach includes a GPU-friendly preprocessing step to extract subgraph pattern frequencies, generating node orbit data that enhances GNN generalization. A structure-augmented generative encoder captures neural representations of node orbit frequencies and temporal-heterogeneous aggregation mechanisms propagate these representations across nodes. Extensive experiments on seven datasets show that SAG2M outperforms state-of-the-art models. Additionally, a case study demonstrates our model's ability to adaptively select key node orbits and generate meaningful subgraph representations for improved detection performance.

Our contributions can be summarized as follows:

• We present the first work addressing financial spoofing detection through structure-augmented generative graph learning with subgraph patterns enhancement.
• We develop a structure-augmented generative encoder to generate discriminative neural representations for neighbor substructures and propose temporal-heterogeneous graphs for representation aggregation.
• Extensive experiments on public datasets and real-world case studies demonstrate our model's superior performance in conspiracy spoofing detection.

2 RelatedWorks

This section reviews existing methodologies relevant to our work, focusing on: (i) spoofing detection methods and (ii) deep graph learning for fraud detection.

2.1 Spoofing Detection

Spoofing has become a critical issue in financial markets [Chanthati, 2024]. Existing spoofing detection methods can be categorized into statistical model-based approaches, which utilize mathematical metrics to identify anomalies [Leangarun et al., 2016], and MDP-based methods that simulate hidden states for detecting irregularities through state transitions [Cao et al., 2014; Wang and Charoenwong, 2024]. Agent-based methods have been used to model spoofing strategies in limit order books [Wang and Wellman, 2017], while rule-based systems remain widely adopted despite their limited adaptability [Mendonc¸a and De Genaro, 2020]. Some approaches focus on detecting price manipulation through order book volume imbalances [Tao et al., 2022]. Deep learning techniques, including CNNs and GNNs, have been explored for conspiracy spoofing detection [Arora and Bhatia, 2020; Kang et al., 2023]. However, these models face challenges such as handling distribution shift [Wu et al., 2023], limited expressiveness for complex trading patterns, and difficulty in modeling the dynamic nature of financial transactions.

2.2 Deep Graph Learning for Fraud Detection

Deep graph learning has emerged as a powerful approach for fraud detection, leveraging the relational structure of data to uncover hidden patterns [Wu et al., 2024]. These methods span a variety of techniques, each addressing specific challenges in fraud detection. Convolutional Neural Networks (CNNs) and Graph Neural Networks (GNNs) have been proposed to enable automatic feature engineering for fraud detection tasks [Cheng et al., 2020]. Graph attentive networks, introduced in [Liu et al., 2023b], further enhanced fraud detection by assigning attention weights to critical nodes and edges. To tackle challenges like camouflaged fraud, reinforcement learning-enhanced GNNs were developed [Dou et al., 2020], demonstrating their ability to adaptively learn fraud strategies. Label imbalance, a common issue in fraud detection datasets, has been addressed through methods such as PC-GNN [Liu et al., 2021], which incorporates both positive and negative sampling to improve performance. Given the high cost of acquiring labeled data, weakly supervised methods have also been proposed [Xiang et al., 2023], reducing reliance on extensive labeled datasets while maintaining detection efficacy [Ma et al., 2024; Zou et al., 2024]. Additionally, the heterogeneous nature of graph data has spurred the development of heterogeneous graph neural networks (HGNNs). These include methods addressing spectral heterophily [Tang et al., 2022b] and spatial heterophily [Wang et al., 2023], which leverage unique graph properties to improve detection performance. These approaches have achieved notable success on publicly available datasets, particularly in domains like review fraud detection.

However, these methods have not been specifically tailored to address the unique challenges of conspiracy spoofing detection, such as distribution shifts caused by data isolation and dynamic trading patterns. To bridge this gap, we propose the Structure-Augmented Generative Graph Model (SAG2M). Our model introduces a novel structureaugmented generative encoder alongside an end-to-end GNN architecture, specifically designed to capture the structural and dynamic complexities of spoofing detection.

3 Methodology

In graph-based fraud detection, GNNs often struggle with capturing complex patterns due to limited expressive power [Chen et al., 2020]. Additionally, new transactional data frequently lacks connections with historical data, hindering feature and label propagation effectiveness [Wang et al., 2023; Xiang et al., 2023]. To address these challenges, we propose a structure-augmented generative graph model. This section introduces the framework and its key components.

3.1 ProblemDefinition

In this paper, we focus on three key concepts for detecting spoofing behavior in financial trading:

• Transactional Graphs: Represented as G = (V,E,X), where V is nodes (traders/accounts), E is edges (transactional relationships), and X denotes node attributes (e.g., order size).
• Node Orbit Features: Characterize roles of nodes in graph structures. Formally, the orbit of node v is defined as O(v) = {roles of v across subgraphs}.
• Spoofing Detection Task: Given historical transactional graph G and labels Y , predict fraud likelihood for new order o. Formally, estimate ˆ yo = f(G, xo, Y ), where ˆ yo indicates fraud legitimacy.

3.2 Model Architecture

Our Structure-Augmented Generative Graph Model (SAG2M) consists of four components: (i) StructureAugmented Generative Encoding: Captures structural properties using orbit-based embeddings through a Structure Reconstruction mechanism; (ii) Temporal and Heterogeneous Graph Generation: Extracts temporal snapshots (e.g., e - 3, e - 2, e - 1, e) and considers node/edge heterogeneity; (iii) Temporal Graph Aggregation: Uses Mean pooling followed by MLP to aggregate temporal neighbor information; (iv) Heterogeneous Graph Attention and Node Classification: Incorporates attention mechanism to weight important neighbors, producing final classification scores via MLP. Now we will go to each component.

3.3 Node Orbit Counting Algorithm

To enhance GNN expressive power for new accounts disconnected from historical data, we propose a 4-node orbit counting approach. Given input graph G, we compute orbit features based on subgraph patterns (e.g., triangles and 4-cliques). Our three-stage GPU-accelerated algorithm has complexity O(d3 ) and produces an attribute matrix O ∈ Rn×r , where n is nodes and r is orbit types.

Algorithm 1: Node Orbit Counting Algorithm

Input : G(V,E): the given graph

Output: O: node orbit counts for each node

for e(u, v) ∈ E do

T [e] ← Enumerate triangles involved by edge e;

for v ∈ V do

C[v] ← Enumerate 4-cliques involved by node v;

for v ∈ V do

Enumerate all 4-node subgraph frequencies;

O[v] ← Build equations of orbit counting for node v;

return O ;

Triangle Count per Edge

We propose an efficient algorithm for enumerating triangles related with each edge in a graph G(V,E). Neighbors of nodes are sorted by their unique identifiers to enable optimized traversal. For an edge e(x, y), let Nx and Ny denote the neighbor lists of nodes x and y. Using a two-pointer technique, we identify common neighbors between Nx and Ny to count triangles involving e(x, y). The pseudocode is shown in Algorithm 2. The algorithm processes each edge in linear time relative to the degrees of its endpoints. For an edge e(x, y), the time complexity is O(deg(x) + deg(y)). Summing over all edges gives an overall complexity of O(E · ¯ d), where ¯ d is the average degree of all nodes.

4-Clique Count per Node

This algorithm efficiently counts 4-cliques involving a node x using sorted neighbor lists and a temporary global storage structure. For each neighbor y > x of x, we identify common neighbors z stored in neigh tri. Pairs of common neighbors z1 and z2 are checked for connectivity to detect 4-cliques. The pseudocode is provided in Algorithm 3. For a node x, the algorithm runs in O(deg(x)3 ). Summing over all nodes gives an overall complexity of O (∑x∈V deg(x)3 ).

Algorithm 2: Enumerate Triangles for Each Edge

Input : G(V,E): the given graph, with neighbors

sorted by ID Output: T: number of triangles for each edge for e(x, y) ∈ E do T [e] ← 0 ; Nx ← neighbors(x); Ny ← neighbors(y); i ← 0, j ← 0; while i < |Nx| and j < |Ny| do if Nx[i] < Ny[j] then i ← i + 1; else if Nx[i] > Ny[j] then j ← j + 1; elseT [e] ← T [e] + 1; i ← i + 1, j ← j + 1; return T ;

Full Graphlet and Node Orbit

By leveraging edge triangle counts T[e] and node 4-clique counts C[v], we derive graphlet frequencies and node orbit distributions. For each node x in a 3-node graphlet xyz, four types of orbits are defined: (i) x is a side node in a path (T|e(x,y)| = 0); (ii) x is a side node in a triangle; (iii) x is the center node in a path (T|e(x,y)| = 0); (iv) x is the center node in a triangle. These classifications extend to 4-node orbits, capturing structural roles within graphlets. Edge triangle counts identify paths vs. triangles, while 4-clique counts detect fully connected subgraphs.

GPU-based Enumeration

Graphlet enumeration algorithms are parallelizable on GPUs with two key considerations: (i) Safe write operations in node 4-clique counting: Each thread writes to a preallocated memory region for its assigned node x and neighbors, avoiding interference; (ii) Memory constraints for center-orbit paths: Enumerating squares (4-cycles) must be handled directly without precomputed path counts due to limited perthread memory and unsafe parallel writes. The proposed algorithms efficiently utilize GPU cores by localizing computations to individual edges or nodes. This enables scalable performance in large graphs and facilitates orbit label computation for identifying spoofing transactions.

3.4 Structure-Augmented Encoder

We propose a structure-augmented encoder that transforms node orbit features O into embeddings Horb ∈ Rn×d using binning encoding with Xorb = BinningEncoding(O, b), and attention mechanisms, which is:

where attention weights αi are formulated as follows:

Algorithm 3: Enumerate 4-Cliques for Each Node

Input : G(V,E): the given graph, with neighbors

sorted by ID Output: C: number of 4-cliques for each node for x ∈ V do Nx ← neighbors(x); for y ∈ Nx where y > x do n tri ← 0; for z ∈ neighbors(y) where z > y do if z ∈ Nx then n tri ←n tri +1; neigh tri[n tri] ← z; for i ← 1 to n tri do for j ← i + 1 to n tri do z1 ← neigh tri[i]; z2 ← neigh tri[j]; if (z1, z2) ∈ E then C[x] ← C[x] + 1; C[y] ← C[y] + 1; C[z1] ← C[z1] + 1; C[z2] ← C[z2] + 1; return C ;

The embeddings are concatenated with original graph attributes for input to the aggregation network.

3.5 Temporal and Heterogeneous Aggregation

Our aggregation process includes: (i) Graph Construction: Edges are labeled as pos or neg based on a threshold score. Pseudo-labels are determined by model predictions; (ii) Temporal Aggregation: Historical transaction features are aggregated using: Htemp(i) = Mean (∑j∈N(i) X(i)); (iii) Heterogeneous Aggregation: Information from positive, negative, and all neighbors is aggregated using attention mechanisms:Hhet = HeteroAttention(Hpos,Hneg,Hall); The coefficients βpos, βneg, and βall are computed as:

The final node representation is:

3.6 Optimization Objective

The optimization objective combines binary classification loss and a generative auto-encoder loss:

where Lall is optimized using Adam, yi denotes the ground truth label, and MLP denotes the multi-layer perceptron to reconstruct features.

4 Experiments

4.1 Experimental Settings

Datasets. We collect partially labeled records from our collaborated partners forming the new dataset called Spoof Detection, which is designed for detecting spoofing behaviours. The ground truth labels are obtained from cases reported by traders and confirmed by financial domain experts. If a transaction is reported by a trader or identified by financial experts as fraudulent, we label it as 1; otherwise, it is labeled as 0. Besides, we also experimented on seven public fraud detection datasets: Amazon, YelpChi, Reddit, Weibo, T-Finance, T-Social, and FFSD. The Amazon dataset [McAuley and Leskovec, 2013] contains product reviews for musical instruments, with nodes as users and edges as review relationships. The YelpChi dataset [Rayana and Akoglu, 2015] includes hotel and restaurant reviews, where nodes are reviews and edges are their connections. The Reddit dataset [Kumar et al., 2019] features posts across subreddits, with nodes as users, edges as interactions, and features derived from Linguistic Inquiry and Word Count categories. The Weibo dataset [Zhao et al., 2020] represents Tencent Weibo users as nodes, with features including location and bag-of-words representations, while edges indicate associations between users and hashtags. The T-Finance and T-Social [Tang et al., 2022a] datasets focus on anomaly detection in transaction and social networks, respectively, with nodes as accounts and edges as transactions or friendships. The FFSD dataset [Xiang et al., 2023] models financial fraud with nodes as transactions and edges representing relationships. The datasets' basic statistics are shown in Table 1.

Compared Methods. To highlight the effectiveness of our proposed SAG2M, we compared it with several state-of-theart methods including: MLP, a Multi-Layer Perceptron with hidden size 32; RF, a Random Forest model using default parameters; GCN [Kipf and Welling, 2017], a Graph Convolutional Network with hidden size 64 and learning rate 0.01; GAT [Veliˇckovi´c et al., 2018], a Graph Attention Network with similar hyperparameters as GCN; CARE-GNN [Dou et al., 2020] and PC-GNN [Liu et al., 2021], both using default parameters for fraud detection on relational graphs and class imbalance problems respectively; BWGNN [Tang et al., 2022b], a model using spectral analysis for anomaly detection; GTAN [Xiang et al., 2023], a semi-supervised GNN with Gated Temporal Attention Networks; PMP [Zhuo et al., 2024], a Partitioning Message Passing framework with learning rate 0.01 and batch size 256; DGA-GNN [Duan et al., 2024], a Dynamic Grouping Aggregation GNN using decision tree binning with hidden dimension 192. Our proposed SAG2M uses threshold h = 0.1, embedding dimension d = 128, and number of bins b = 4.

Evaluation Metrics. We employ three evaluation metrics to assess the experimental results on spoof detection and other public fraud detection datasets: area under the ROC curve (AUC), macro average of F1 score (F1-macro), and averaged precision (AP). We count the number of True Positive NTP (i.e., correct identification of positive labels), False Positive NFP (i.e., incorrect identification of positive labels), and False Negatives NFN (i.e., incorrect identification of negative labels). Then, F1 score and AP are formulated as follows: F1macro = 1l ∑li=1 2×Pi×Ri Pi+Ri , where Pi = NTP NTP+NFP and Ri = NTP NTP+NFN . And similarly, the AP score is formulated as follows: AP = ∑li=1 (Ri -Ri-1)Pi.

4.2 Performance Comparison

In this section, we compare the performance of our proposed model against several baseline methods across three domains: Finance, Review, and Social. We utilize metrics such as Area Under the ROC Curve (AUC) and Precision to assess the effectiveness of each method. Table 2 displays the detailed results of these comparisons. In the experimental setup, each model was evaluated over ten iterations, with average results presented in Table 2. Significant improvements, marked with ∗ , were validated through a paired t-test with a p-value threshold of 0.01. The first 11 rows of Table 2 showcases the performance of machine learning baselines and traditional GNNbased models such as CARE-GNN, PC-GNN, BW-GNN, GTAN, and DGA-GNN across the three domains. It becomes evident that MLP and RF struggle to handle complex financial fraud scenarios due to their limited ability to utilize relational information. In contrast, GNN-based methods, such as PCGNN and BW-GNN, yield improved outcomes due to their enhanced architectural advancement, though they still lag behind more advanced models. GTAN and DGA-GNN further refine this progression, with DGA-GNN consistently delivering competitive results due to its dynamic grouping capabilities. The addition of our model, listed as "Ours" in Table 2, consistently surpasses all baseline methods. Notably, our approach achieves at least 0.21%, 1.12%, and 0.35% improvements in AUC for T-Finance, FFSD, and Reddit datasets, respectively. Furthermore, the precision enhancements across these datasets emphasize our model's robustness in identifying fraudulent activities with higher accuracy. This indicates the superior capability of our model in capturing intricate patterns and relationships in graph-structured data, thereby offering a substantial advantage in fraud detection tasks.

4.3 Ablation Study

To evaluate the contribution of each component in our model, we conducted an ablation study by removing specific features from the model: (i) Without Heterogeneous Aggregation: This variant omits the heterogeneous aggregation mechanism, which leverages mean-aggregation to collect different types of neighbor data; (ii) Without Structure-Augmented Encoder: We removed the structure-augmented encoder to assess its impact on the model's ability to leverage graph structures effectively; (iii) Without Node Orbit Features: This configuration excludes the node orbit features, which are pivotal in capturing subgraph patterns like triangles and 4-cliques. The experimental results on T-Finance dataset, as shown in Table 3, illustrate the significant impact of each component, demonstrating that the full model achieves superior performance by integrating these features.

It is well-known that subgraph enumeration algorithms are typically complex and time-consuming. To further evaluate our approach, we conducted a runtime comparison on synthetic Erd˝os-R´enyi graph datasets [Erdos and R´enyi, 1984]. Specifically, we compared our GPU-friendly improved version ("Ours") with the original C++ implementation ("Orca") [Hoˇcevar and Demˇsar, 2014] in terms of time consumption across graph sizes ranging from 100 to 1 million nodes. As shown in Figure 3, our method significantly outperforms the baseline in all tested scenarios. Notably, the maximum speedup achieved by our approach over Orca is 11x on Stage 1, 24x on Stage 2, 32x on Stage 3, and 28x on All Stages combined. These substantial improvements highlight the efficiency of our GPU-accelerated implementation, which effectively exploits parallelism to handle large-scale transaction graphs. Furthermore, our method maintains consistent scaling performance as the graph size increases, demonstrating its robustness for graphs with millions of nodes. By leveraging a GPU-friendly design, our approach reduces the computational overhead associated with subgraph enumeration, making it feasible for practical applications involving large graphs. The results underscore the superiority of our proposed approach in terms of runtime efficiency, which is suitable for real-world spoofing detection systems.

4.4 Parameter Sensitivity

To examine the sensitivity of our model to its hyperparameters, we conduct a comprehensive analysis by varying key parameters including embedding size, learning rate, and threshold. Figure 4 illustrates the impact of these parameters on the model's performance across different configurations using the spoofing detection dataset. Specifically, in Figure 4(a), we observe the effect of varying the threshold parameter ranging from 0 to 0.1. The results reveal significant fluctuations in performance metrics as the threshold increases. While the AUC metric remains relatively stable and maintains high performance across different thresholds, both the F1 score and AP exhibit sharp declines once the threshold exceeds 0.1. This suggests that higher thresholds may lead to a loss of heterogeneous information crucial for accurate detection. In Figure 4(b), we analyze the model's sensitivity to hidden size variations from 20 to 128. The performance metrics initially increase as the hidden size grows, reaching optimal values around 100-128 dimensions. Beyond this range, the F1 score and AP begin to slightly decline, indicating that while larger hidden sizes enable the model to capture more complex patterns, they also risk overfitting or diminishing returns. The trends in batch size, shown in Figure 4(c), reveal a clear peak in performance at a batch size of 128. Both the AUC and F1 scores improve significantly as the batch size increases from 50 to 128, after which performance plateaus or slightly declines. astly, Figure 4(d) evaluates the effect of learning rate adjustments. A lower learning rate of around 0.002 to 0.004 appears optimal, as indicated by higher values in all performance metrics. The AP and F1 scores decrease substantially with higher learning rates, suggesting that too large a step may lead to instability in training or skipping over optimal solutions. Based on these analyses, we choose our best parameter settings according to these results.

4.5 Case Studies

In this section, we perform an in-depth case analysis using the spoofing detection dataset to evaluate the influence of node orbit features on detecting fraudulent activities. By examining attention values associated with different node orbits, we identify key subgraph patterns that distinguish spoofing behaviors from legitimate transactions. Figure 5(a) illustrates the distribution of attention weights across various node orbits. Each bar represents the importance assigned to a specific node orbit in the detection process, with higher weights indicating greater significance. Figure 5(b) provides visualizations of subgraph structures, including triangles and 4cliques. Notably, node orbits associated with 4-cliques and triangles exhibit substantially higher attention weights compared to other structures. This suggests that these subgraph patterns play a pivotal role in identifying intricate structural anomalies characteristic of conspiracy spoofing behaviors. The prominence of these orbits underscores their importance as critical indicators, reflecting the underlying complexity of fraudulent behavior within trading networks. The results demonstrate the potential of SAG2M to enhance fraud detection accuracy by leveraging complex graph topology structures. By focusing on these key subgraph patterns, our approach offers significant advantages over traditional graphbased detection methods that may overlook such nuanced structural features in detecting sophisticated fraudulent activities such as conspiracy spoofing.

5 Conclusion

In this paper, we proposed a structure augmented generative graph mode for spoofing detection task, which is a critical data mining task in financial trading. The structure distribution shifts between new spoofing transactions and historical transactions often limit the utility of graph-based detection methods. To overcome these challenges, we introduced the Structure-Augmented Generative Graph Model (SAG2M), which leverages a novel preprocessing and subgraph frequency-enhanced detection approach. Our method focuses on extracting subgraph pattern frequencies among node neighbors. Considering real-world implementation, we use a parallelizable enumeration to efficiently compute the node orbit data. Then, the generative encoding of structure information allows for the capture of intricate structural patterns to provide a comprehensive representation of each transaction. Furthermore, the temporal and heterogeneous aggregation scheme effectively collects and analyzes neighborhood node interactions to identify conspiracy spoofing patterns. The experimental results, conducted on diverse datasets such as Amazon, YelpChi, and T-Finance, demonstrate that SAG2M consistently outperforms existing models in detection accuracy. Our findings underscore the superiority of SAG2M in enhancing the detection of spoofing transactions by harnessing complex graph structures and sophisticated aggregation techniques. The case study on conspiracy spoofing detection further validates the model's efficacy, illustrating its potential for real-world applications in financial fraud detection. Future work could explore extending the scalability of node orbit counting algorithms where relational data play a critical role in spoofing detection.

Acknowledgments

This work is sponsored by the National Science Fundation of China (62522213, 62472317), Shanghai Pujiang Program (25PJA139), and the Fundamental Research Funds for the Central Universities.