Problem
Random splits and precomputed graph features can overstate how well Bitcoin AML models will perform on future transactions.
Research paper · Graph learning · Financial forensics
Exploring Topological Resilience: A Decoupled Dual-Pathway Graph Neural Network for Bitcoin Anti-Money Laundering under Concept Drift
TELEPE 2026 · Frankfurt, Germany · June 24–26, 2026
Research summary
Method
TSG-Net separates topology-aware GATv2 learning from a local-feature pathway that preserves transaction-level information.
Finding
Under the paper’s strict temporal protocol, TSG-Net reports high illicit-class precision while matching Random Forest on F1.
Abstract
In recent years, Graph Neural Networks have shown some applications in the area of Bitcoin Anti-Money Laundering Detection. However, the actual performance of Graph Neural Networks (GNNs) in applications has often been significantly overestimated in previous research. Most existing studies use random segmentations of the data and pre-calculated global statistical features, causing concept drift. In order to facilitate effective detection in real-world forensic scenarios, this paper proposes a Topological Synchronization Graph Network (TSG-Net). A disentangled two-path architecture has been used. On one hand, it uses a multi-head graph-attention module to identify dynamic Topology-Aware Anomalies. On the other hand, it maintains the original attribute characteristics of the transaction node using a residual module. The findings indicate that when confronted with evolving transactions in subsequent time steps, the efficacy of conventional static models is significantly diminished, while TSG-Net exhibits superior temporal resilience. It was demonstrated that, while maintaining an F1 score above 0.75, the model increased the precision for illegal nodes to 96%. Based on the visualization of the hidden-layer manifold, this paper also verifies that end-to-end graph representation learning is effective for resolving complex financial obfuscation problems.
Problem and evaluation protocol
The study models transactions as nodes and capital flows as directed edges. It removes 72 precomputed neighborhood-aggregate features and retains the first 94 local transaction features. Training, model selection, and testing are separated chronologically to reduce temporal leakage.
T1–27Train
T28–34Validation
T35–49Future test
TSG-Net: two complementary pathways
The method uses a structural pathway to learn transaction-neighborhood patterns and a local-feature pathway to preserve information that may be diluted by message passing.
01
Topology pathway
Multi-head GATv2 learns risk-bearing patterns from the directed transaction graph.
02
Attribute-anchor pathway
A linear residual projection keeps the 94 local transaction features directly available.
03
Representation fusion
Both representations are concatenated before classification and validation-based threshold selection.
Main comparison
The chart below reproduces the comparison reported in the accepted manuscript. TSG-Net reaches 0.96 illicit-class precision and 0.75 F1. Random Forest also reaches 0.75 F1, but with lower precision and higher recall. This is a trade-off, not a claim of universal superiority.
0.96Illicit precisionPaper-reported result
0.61Illicit recallPaper-reported result
0.75Illicit F1Paper-reported result
Temporal analysis and its evaluation boundary
The forward-time analysis shows that illicit-label availability varies sharply across later test slices. Per-timestep F1 becomes unstable or undefined when a slice contains very few or no illicit instances. I therefore treat the tail analysis as an evaluation boundary, not as evidence of persistent performance at every future timestep.
Latent representation view
Red markers denote illicit-labeled transactions in a 2D projection of the fused representation. The view suggests local concentration, but it is not by itself proof of class separability; the reported Silhouette Score improves from −0.1467 to +0.0255.
