# Judge a Transaction by the Company It Keeps — Somya Rai & MD Sharique, EXL

## Executive summary

This talk details an advanced fraud detection system that moves beyond traditional tabular feature engineering by leveraging Graph Neural Networks (GNNs). The core insight is that fraud is not a property of a single transaction (row), but a property of the neighborhood (edges) it belongs to. By feeding GNN-generated embeddings into an existing XGBoost classifier, the system achieved significant improvements in True Positive Rate (TPR) while maintaining a fixed, low alert budget. Key engineering achievements include managing data leakage through disjoint monthly graphs, optimizing the serving path by predicting on edges rather than nodes, and achieving a low latency of 3.1 ms at P99.

## Key takeaways

- Fraud Signal Location: Fraud is a property of the transaction's neighborhood (edges), not the transaction itself. Tabular features are limited because they only analyze the row, ignoring connections like shared devices or velocity chains across merchants.
- Performance Improvement: The GNN + XGBoost model achieved a 33% relative lift in TPR for card-related merchant transactions and a 27% lift for online transactions, compared to the XGBoost baseline, all while maintaining a fixed alert budget.
- Serving Optimization: To maintain low latency, the system optimized the cache footprint by predicting on the edge (user/merchant embeddings) rather than the node (transaction embeddings). This reduced the cache requirement from ~60 GB to 2-3 GB, enabling a 2.3 ms median / 3.1 ms P99 end-to-end latency.

## Technical details

- Graph Neural Network (GNN) Architecture: The GNN processes a node by aggregating neighbor hidden states via three operations: Gather (pulling neighbor states across edges), Collapse (reducing the neighbor set into a fixed-width vector using a permutation function), and Update (concatenating the aggregate with the node's own state).
- Advanced Aggregation Method: Instead of simple averaging, the model concatenates three order-invariant statistics (Mean, Max, and Standard Deviation) of neighbor states. This is crucial because averaging can dilute the signal from a single dangerous outlier (e.g., a fraud ring).
- Data Leakage and Sampling: To prevent leakage, the system uses disjoint graphs for each calendar month, ensuring no edge crosses the temporal boundary. The training uses a soft target fraud rate (e.g., 10x the natural rate) while retaining the full transactional history for all users to preserve connectivity.
- Feature Engineering: The model utilizes 202 features across three node types (user, transaction, merchant). Derived features include behavioral baselines (e.g., mean/std dev of last five amounts) and rolling window velocity counts (e.g., 5-minute, 1-hour, 24-hour counts).

## Practical implications

- The system provides edge-level attribution (e.g., 'Transaction to User velocity edge carries 0.94 mean importance'), which is critical for regulatory compliance and analyst trust.
- By moving the prediction target from the node to the edge, the system drastically reduces the required cache memory footprint (from 60 GB to 2-3 GB), making high-performance, low-latency deployment feasible.
- The focus on precision at a fixed alert budget (fixed K) ensures that the model's improvements are directly actionable for fraud analysts.

## Topics

Graph Neural Networks (GNN), Fraud Detection, Machine Learning Engineering, High-Throughput Serving, Data Leakage Prevention, Somya Rai, MD Sharique

Source: https://www.youtube.com/watch?v=SHvwutPSeZg