TGEditor: Task-Guided Graph Editing for Augmenting Temporal Financial Transaction Networks

An overview of our proposed ${\rm TGE{\small DITOR}}$ framework is presented in Figure 2 which consists of three modules: M1) Task-Guided Context Extractor, M2) Multi-Resolution Temporal Generative Model, and M3) Financial Transaction Editor. Given a financial transaction network, M1 first extracts task-guided network contextual information of financial transaction networks by sampling a set of TRW sequences $\mathcal {W}_c$ conditioned on a specific task $\mathcal {T}$ [23]. In M2, we develop a multi-resolution context generative model which consists of a TRW generator and a TRW discriminator to approximate the joint topological and temporal distribution of G, i.e., $p(v^{t_{v}} | G, \mathcal {T})$. In this module, we learn important task-guided contextual information from the extracted task-specific TRW sequences $\mathcal {W}_c$ in M1. In M3, we propose a novel financial transaction editor to augment G by proposing a handful of editions, including Add aims to recover the missing temporal links due to data sparsity, and Prune is formulated to remove irrelevant/noisy temporal links due to data noisiness.

M1. Task-Guided Context Extractor. In the field of graph-based data augmentation, prior methods have primarily been unsupervised, utilizing pre-established augmentation techniques such as structural perturbation and graph diffusion (e.g., structural-wise perturbation [28] and graph diffusion [11], contrastive learning [37]). However, these unsupervised approaches may not guarantee optimal performance in downstream tasks, particularly when label information is available. For instance, in the context of financial fraud detection, it is commonly observed that fraudsters are rare and skilled at evading detection systems. As a result, unsupervised data augmentation methods may not effectively emphasize fraudulent patterns without supervision. Furthermore, improper data augmentation may introduce artificial biases and degrade overall performance. Motivated by these considerations, we propose a task-guided context extractor that leverages both the input data G and the label information $\mathcal {L}$ from the downstream tasks $\mathcal {T}$ to achieve improved performance. Given a financial transaction network G with a label set $\mathcal {L}$ from the downstream task $\mathcal {T}$, M1 aims to extract task-specific contextual information to train M2. We utilize the technique of Temporal Random Walks (TRW) as a tool for sampling and extracting contextual information, such as neighborhood topology and temporal properties, from the given financial transaction network.

A straightforward approach to capture task-specific contextual information would be to conduct TRWs starting from each labeled vertex in $\mathcal {L}$. However, the label set may consist of both representative and boundary examples, such as examples located at the center versus the boundary of the support region of a class. To effectively capture task-specific contextual information, it is crucial to understand the task-specific contextual importance of each vertex in the labeled set $\mathcal {L}$.

We propose to quantify the task-specific contextual importance of each vertex $v^{t_{v}}$ in the labeled set $\mathcal {L}$ through the following conditional probability:

The results from many existing literature [1, 41] indicate a weak relationship between spatial distribution and temporal distribution in realistic temporal networks: vertices with high degrees tend to be active in future timestamps, while those with low degrees tend to be inactive. Specifically, clients who are highly active in making transactions are more likely to continue doing so in the future, whereas clients who are less active in making transactions are less likely to do so in the future. Following [1, 41], in this paper, we make the assumption that the task-specific topological distribution $p(v^{t_{v}} | \mathcal {N}_{spa}(v^{t_{v}}), \mathcal {T})$ and the task-specific temporal distribution $p(v^{t_{v}} | \mathcal {N}_{tem}(v^{t_{v}}), \mathcal {T})$ follow a weakly independent relationship. With that, we have, for δ > 0,

Based on the above equation, we propose a novel contextual sampling strategy. For each class c in $\mathcal {T}$, we sample a collection of TRWs with the length of T as $\mathcal {W}_c = \lbrace \mathbf {w}_1...\mathbf {w}_{|\mathcal {W}_c|} |c \in \mathcal {T}\rbrace$. With probability of α ∈ [0, 1], we sample temporal-guided graph context from vertices with high $p(v^{t_{v}} | \mathcal {N}_{tem}(v^{t_{v}}), \mathcal {T})$. With probability 1 − α, we sample spatial-guided graph context from vertices with high $p(v^{t_{v}} | \mathcal {N}_{spa}(v^{t_{v}}), \mathcal {T})$. By sampling representative vertices from both distributions, we aim to maximally capture topological and temporal properties for the given class c from G. In Figure 3, we show an illustrative example of how to jointly extract temporal and spatial neighborhood contextual information. After selecting corresponding class representative vertices, we use label-informed TRW sampler [24] to extract TRWs from each class, which will be fed into M2 for training purposes.

M2. Multi-Resolution Temporal Generative Model. Through M1, we extract task-guided temporal random walks (TRW) $\mathcal {W}_c$ that preserve the temporal and topological properties of the financial transaction network and the label information from downstream tasks $\mathcal {T}$. Most existing methods for learning temporal graph representations from TRWs, such as [40, 41], are task-agnostic and rely heavily on preprocessing steps to transform the temporal transactions from multi-resolution to single resolution (e.g., coarsening the resolution of timestamps in days as shown in Figure 1). To overcome this limitation, we propose to jointly utilize the extracted TRWs $\mathcal {W}_c$ and label information to infer the task-guided conditional probability distribution of temporal edges $p(v_i, v_j, t_i | \mathcal {T})$ in the given financial transaction network G, where {v_i, v_j ∈ G, t_i} is a set of continuous timestamps, and $\mathcal {T}$ is the downstream task. By learning this distribution, we can better understand how a client vertex from class c interacts with other client vertices temporally and topologically, given the task $\mathcal {T}$. However, directly approximating this distribution is challenging due to the correlation between (v_i, v_j, t_i). Inspired by [23], we propose to model the distribution of $p(v_i, v_j, t_i | \mathcal {T})$ in a conditional generative manner. The proposed method utilizes a temporal generator $\mathcal {G}_{\theta }$ with two decoders to separately decode a vertex $v_{t_i}$ and continuous timestamp t_i. Additionally, a discriminator $\mathcal {D_{\theta }}$ is used to evaluate a sequence of TRWs to identify whether they are true TRWs sampled from G or ones generated by the temporal generator $\mathcal {G}_{\theta }$. The overall objective function of M2 is defined as:

Generator. We aim to generate TRW samples from class c to explicitly capture temporal and topological properties from class c. A latent vector is initialized as a multi-variant vector $\mathbf {z} \in \mathcal {N}(0, \mathbf {I}_d)$ which is a multi-variant normal distribution. A one-hot vector of class c is further concatenated with z to form the initial label-informed latent vector z_c. As shown in Figure 2, in each LSTM cell, there are mainly two sub-modules: a vertex decoder and a temporal decoder. The vertex decoder decodes a client vertex with the highest probability from learned $\mathcal {G}_{\theta }$ and LSTM state h_{i, c}. The temporal decoder decodes a timestamp from the current LSTM hidden state h_i following the temporal constraint (i.e., $t_{e_i} \le t_{e_{i+1}}$) and prior temporal distributions. Specifically, in each unique time step i, an LSTM cell produces a cell state vector m_{i, c} and a hidden state vector h_{i, c} as input. The concatenated cell state is denoted as $\mathbf {\tilde{m}}_{i,c}$. The detailed process is shown in Figure 4, where ‖ denotes a concatenate operation.

Discriminator. The discriminator $\mathcal {D}$ uses a standard LSTM architecture. At each time step, a one-hot vertex representation v_t and a temporal representation t are concatenated as input to the LSTM cells. After processing the entire sequence of T vertices, the discriminator outputs a logit indicating the probability of the input TRW being sampled from G. With the Temporal Graph Generator, $\mathcal {G}_{\theta }$, and Discriminator, $\mathcal {D}_{\theta }$, the model learns the joint probability distribution of $p(v_i, v_j, t_i | \mathcal {T})$ to characterize properties of G. This information is used in M3 to augment the financial transaction network through the financial transaction editor in M3.

M3. Financial Transaction Editor. In M2, we learn a multi-resolution temporal generative model $\mathcal {G}_{\theta }$, which samples from a task-guided joint temporal edge probability distribution $p(v_{i}, v_j, t_i | \mathcal {T})$. To answer C3, we propose an augmentation constraint to preserve most G’s temporal and topological properties while fully capturing label information without "over-augmenting" (i.e., injecting extensive artificial biases) which may hurt the performance on a downstream task $\mathcal {T}$. In particular, we take sampled W as a basis for augmentation, without perturbation from these artificial biases. To this goal, we propose a general financial transaction editor module that consists of two graph editing operations{${\tt add}$, ${\tt prune}$}:

• add: The add operation is done in a three-step fashion. First, we decode the joint probability distribution p(v₁, v₂, t₁) of candidate vertices from the output of the vertex decoder and temporal decoder. At each time step, we examine whether argmax(p(v_i|v₁, v₂, t₁)) is over our add threshold ζ_add. As shown in Figure 2, v_argmax and t_i are decoded from a temporal vertex decoder and a time decoder, respectively. For each instance, only one edge is added to avoid over-editing.
  
• prune: The prune operation is similar to the add operation, but instead of adding an edge to $\mathcal {G}$, we prune edges associated to the current vertex if p(v_{i − 1}, v_i, t_i) is lower than our prune threshold ζ_prune for the purpose of consistency.
  

In addition to $\mathcal {G}_{\theta }$ and $\mathcal {D}_{\theta }$, a TRW editor discriminator $\mathcal {D}_{\mathcal {W}}$ is introduced to prevent overediting if an edited sequence z is less likely preserving G’s network properties.

Datasets. We evaluate ${\rm TGE{\small DITOR}}$ on 5 real temporal graphs with vertex labels/edge labels, including variations of DBLP [41], SO [41], Chase [2], Bitcoin [34]. DBLP and SO are temporal collaboration networks, Chase [2] is a temporal fraudulent transaction network, and Bitcoin [34] is an anti-money laundering temporal transaction network.

Comparison Methods. We compare ${\rm TGE{\small DITOR}}$ with baseline models in two different aspects: 1) Temporal graph generative model adapted for data augmentation [2] and 2) traditional graph data augmentation methods [3]. For 1), we further divide our baseline models into two sets of models: Static graph generative models (i.e., Barabási Albert (BA) [3]) and temporal graph generative models (TagGen [41] and TGGAN [40]). To uniformly compare methods on financial transaction networks and other temporal graphs, we use a well-known embedding method HTNE [42] as a basis to process augmented graph $\tilde{G}$ from our baseline methods and the proposed methods. We then use logistic regression to evaluate the models’ performances on the downstream tasks.

Evaluation Metrics. We evaluate performances with baseline models in two aspects: 1) network properties and 2) effectiveness on downstream tasks (vertex classification and fraud detection). For evaluating network properties, we consider five widely-used network properties (i.e., Mean Degree, Number of components, LCC, Wedge Count, Claw Count) for evaluation. They help us how well a given model preserves the topological properties of a given financial transaction network. Given input financial transaction network G, the augmented network $\tilde{G}$ and the evaluating metric $\tilde{m}$, we measure each property $f_{\tilde{m}}(\cdot)$ as follows.

From our evaluation results, we draw several interesting observations from these results. 1) ${\rm TGE{\small DITOR}}$ outperforms the baseline methods across the five evaluation metrics and four datasets in most of the cases. 2) Two random graphs (i.e., BA and ER) generated $\tilde{G}$s have the worst performance. We suspect such random graph algorithms are often designed to model a certain structural distribution (e.g., n-component distribution) which leads to a lack of understanding of capturing many other network properties (e.g., LCC the largest connected component of the graph). (3) Deep generative models (NetGAN, TGGAN, TagGen) have outperformed random graph generators and the graph augmentation model (GASOLINE) but are not comparable with ${\rm TGE{\small DITOR}}$ in most cases even though it shows competitive performance on classification tasks. From our assumptions, we suspect the following reasons why our ${\rm TGE{\small DITOR}}$ is better compared with other baseline models: 1) Task guidance from label-informed TRWs helps ${\rm TGE{\small DITOR}}$ framework preserve and understand topological properties.

2) ${\rm TGE{\small DITOR}}$ framework's $D_{\mathcal {W}}$ prevents ${\rm TGE{\small DITOR}}$ framework from overediting G to minimally alters the topological properties.

Overall, from our observations, we find TGEditor accurately captures and preserves G’s topological properties.

In this subsection, we compare ${\rm TGE{\small DITOR}}$ framework with 6 baseline methods across 4 datasets on 2 evaluation downstream tasks: vertex classification and fraudulent transaction identification. We split the data set into training and test sets with the three sets of ratio: 10% training set: 90% test set, 15% training set: 85% test set, and 20% training set: 80% test set. Each experiment is repeated five times, and we report the average score (recall for fraudulent transaction indentification or Marco F1 score for vertex classification) across 4 datasets in Table 2 and Table 3.

Vertex Classification. In this task, we use the SO and DBLP datasets for temporal collaboration graph classification. The goal is to predict vertex labels based on the model's understanding of temporal and topological context. Results in Table 2 show that: 1) HTNE, a temporal graph embedding method, performs the worst due to its lack of deep understanding of topological and temporal attributes. 2) Deep generative models (NetGAN, TGGAN, TagGen) perform better than HTNE but underperform compared to the traditional graph data augmentation model (GASOLINE) and TGEditor. This is likely due to the fact that temporal collaboration networks are not sensitive to temporal attributes and topological properties are more important for classifying vertices. 3) ${\rm TGE{\small DITOR}}$ outperforms other baseline models, demonstrating that task-guided label information can be a key factor in augmenting a temporal graph and improving performance on vertex classification tasks.

Fraudulent Transaction Identification. The detection of fraudulent transactions is a critical problem for financial institutions. This task is challenging due to the time-sensitive and complex nature of the problem, as fraudulent transactions are often large in scale and the sparsity of financial transaction networks G presents a significant challenge for models to generalize effectively. We demonstrate a detailed comparison across different models in this task in TABLE 3. In our experiments, we employed an MLP-based classification approach to determine whether a given edge, e, in the network, represented by the concatenation of two vertex embeddings, v₁ and v₂, e = [v₁, v₂], is fraudulent or not, based on the encoded contextual information. Our proposed method, TGEditor, outperforms other methods, including GASOLINE and other deep generative models. This is attributed to the incorporation of task-guided label information, $\mathcal {L}$, and multi-resolution properties in TGEditor, which addresses the challenges of sparsity in financial transaction networks. Furthermore, ${\rm TGE{\small DITOR}}$ preserves both topological and temporal properties of the original network, G, minimizing the potential injection of noisy information into the augmented network, $\tilde{G}$. Overall, the comparison experiments demonstrate that ${\rm TGE{\small DITOR}}$ effectively improves the generalization performance of the augmented financial transaction network $\tilde{G}$ across all datasets.