Visualizations generated by the AML_Visualizations_Production.ipynb notebook for the NodeGINe GNN model trained on Ethereum transaction data for OFAC sanctions detection.
Data Source: Processed outputs from Data-Modeling/ pipeline (formatted_transactions.parquet, node_labels.parquet, trained model checkpoint).
Dataset: 889,615 nodes, 23,082,561 edges, 69 OFAC-sanctioned addresses.
UMAP 2D projection of learned node embeddings from the penultimate GNN layer. Sanctioned nodes (red stars) cluster in the bottom-left, separated from 111,847 benign validation nodes — evidence the GNN learned a meaningful, separable representation.
1–2 hop transaction neighborhoods around OFAC-sanctioned nodes. Node size reflects in-degree; edge color encodes transaction amount (ETH). Four representative sanctioned addresses shown:
Dense radial subgraph with predominantly light edges (low-value transactions). This topology exemplifies the placement stage: many small outgoing transfers scatter funds across a wide set of counterparties. The model's sum aggregation preserves the high fan-out count, distinguishing this pattern from legitimate addresses with fewer connections.
Clear hub-spoke structure with high-value edges (red/orange, >15,000 ETH) connecting the sanctioned node through a central hub. This is consistent with integration-stage laundering via an intermediary mixer or exchange, where consolidated funds flow through a small number of high-value channels. The Amount Received feature captures this asymmetry.
Large neighborhood capped at 2,000 highest-degree nodes. Spectral layout separates the sanctioned node from peripheral clusters.
Radially diffuse with uniform low-value edges, characteristic of the layering phase — distributing funds to maximize intermediary hops and obscure the trail. The Timestamp feature is critical here, as these transfers tend to be temporally compressed into short bursts.
10 evenly-spaced weekly snapshots showing the largest connected component at each time window. Node size is proportional to degree; red nodes indicate sanctioned addresses.
SHAP values from a GBR surrogate (R²=0.880, 114 sampled nodes) fitted to the GNN's predictions, using aggregated edge features per node (excluding leaked Is_Laundering and EdgeID features). Timestamp dominates (mean |SHAP| ≈ 0.022), followed by Amount Received (~0.009) and Amount Sent (~0.008); three placeholder features contribute negligibly.
Direct gradient backpropagation through the GNN to raw edge features. Left panel shows global sensitivity; right panel shows sensitivity on edges incident to sanctioned nodes. Gradient attribution identifies the same three dominant features but reorders the hierarchy, with Amount Received showing the highest sensitivity, consistent with a more continuous gradient response to transaction amounts versus the threshold-like temporal signal captured by SHAP.
TP=7, FN=7, FP=37, TN=111,810. The model catches 50% of sanctioned nodes (recall=0.500) with precision=0.159 under extreme class imbalance (14 positives vs 111,847 negatives).
AUC=0.999. Near-perfect ROC is expected but misleading under extreme imbalance — even small FPR translates to many false positives at this scale.
PR-AUC=0.183 — the most honest metric for this imbalanced setting. The model meaningfully outperforms the random baseline (0.000) but precision degrades as recall increases.
- Elmougy & Liu (2023): Elliptic++ dataset multi-view graph work
- Morris et al. (2019): GNN expressiveness and 1-WL algorithm
- SHAP: Lundberg & Lee (2017)