SALT-GNN: Handling Dense Neighborhoods in Anti-Money Laundering Graphs via Statistics-Aware Attention

# SALT-GNN: Handling Dense Neighborhoods in Anti-Money Laundering Graphs via Statistics-Aware Attention
Source: [https://arxiv.org/html/2607.10131](https://arxiv.org/html/2607.10131)
###### Abstract

Money laundering threatens financial stability and exposes institutions to penalties, motivating automated detection\. Because laundering schemes often emerge through relational patterns, graph neural networks \(GNNs\) are increasingly used for anti\-money laundering \(AML\)\. Yet AML GNNs are typically evaluated with aggregate metrics such as overall F1 score, which hide an operational issue: high\-activity recipient accounts concentrate many incoming transactions, making suspicious signals harder to isolate and costlier to investigate\. We introduce a recipient\-degree stratified evaluation that reports standard AML metrics across recipient\-context density\. Across three datasets \(HI\-Small, HI\-Medium, and AMLSim\-32k\-5%\), the evaluation reveals consistent degradation in dense recipient contexts, which we trace to three GNN characteristics: the first two are known GNN limitations that AML amplifies, i\.e\., \(1\) multiset non\-discriminability and \(2\) cardinality blindness; and \(3\) an attention\-specific effect, i\.e\., in dense neighborhoods, normalized attention attenuates weak but pattern\-relevant multi\-hop signals\. Guided by this diagnosis, we propose SALT\-GNN, a lightweight statistics\-aware architecture that fuses degree\-aware statistical aggregation with attention at each message\-passing layer\. This layer\-wise fusion allows distributional and cardinality information to shape the node states used by subsequent attention steps\. Ablation results support fusion placement as a key factor in dense\-context performance\. On HI\-Small and HI\-Medium it uses up to 77% fewer parameters than task\-specific graph\-transformer baselines while improving dense\-context F1 score by 3–6 points; on AMLSim\-32k\-5%, it improves highest\-degree F1 score by 16–20 points\. The gains hold for both Transformer\- and GAT\-style attention, indicating that the benefit comes from where statistical and attentional evidence is fused rather than from a specific attention operator\.

![Refer to caption](https://arxiv.org/html/2607.10131v1/figures/highDegree4.png)Figure 1:Recipient\-context example\. A suspicious incoming transaction \(red\) is easier to isolate at low in\-degree \(left\) than among many normal transfers at high in\-degree \(right\)\.## 1Introduction

Money laundering conceals illicit asset origins through placement, layering, and integration, involving an estimated 2–5% of global GDP \($800 billion to $2 trillion annually\)\(United Nations Office on Drugs and Crime[2011](https://arxiv.org/html/2607.10131#bib.bib31); Lannoo and Parlour[2021](https://arxiv.org/html/2607.10131#bib.bib17)\)\. Because compliance failures expose financial institutions to substantial penalties, effective anti\-money laundering \(AML\) systems are operationally essential\(Chen et al\.[2018](https://arxiv.org/html/2607.10131#bib.bib7)\)\. A central difficulty is that laundering rarely appears as a single anomalous transaction\(Altman et al\.[2023](https://arxiv.org/html/2607.10131#bib.bib1)\)\. Instead, risk signals often emerge from relational structures such as cycles, fan\-in/fan\-out, and layered flows \(Appendix A\)\. AML data is therefore naturally graph\-structured, with accounts as nodes and transactions as directed edges\. Graph Neural Networks \(GNNs\), which propagate and aggregate information over transaction graphs, have consequently become a prominent modeling family in AML research\(Altman et al\.[2023](https://arxiv.org/html/2607.10131#bib.bib1); Egressy et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib10)\)\. Although engineered\-feature pipelines remain competitive\(Blanuša et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib4)\), recent AML\-tailored GNNs provide strong benchmarks for both transaction\-level edge classification and account\-level node classification\(Suzumura and Kanezashi[2021](https://arxiv.org/html/2607.10131#bib.bib30); Lin et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib19)\)\. However, current AML\-GNN evaluation remains incomplete\. Aggregate metrics such as F1 score and PR\-AUC indicate whether a model performs well on average, but they do not show whether it remains reliable in the recipient contexts where many incoming transfers compete to be summarized\. We call the incoming neighborhood of a receiver a recipient context\. For edge classification, a transaction inherits the context of its receiver, since a transaction has no intrinsic degree; for node classification, the context is the evaluated account itself\. This unit is operationally meaningful: errors in dense recipient contexts are costly, because false positives can trigger large manual reviews, while false negatives may miss collection or mixing points associated with large\-scale laundering\(Kou et al\.[2004](https://arxiv.org/html/2607.10131#bib.bib16); Beneish and Vorst[2022](https://arxiv.org/html/2607.10131#bib.bib2)\)\.

Our central observation is that dense recipient contexts are a missing unit of AML\-GNN evaluation and design\. We expose them with a recipient\-degree diagnostic: a post\-hoc stratification of test predictions by recipient in\-degree \(Fig\.[1](https://arxiv.org/html/2607.10131#S0.F1)\) without changing training or model selection\. Across three widely used AML benchmarks—HI\-Small, HI\-Medium\(Altman et al\.[2023](https://arxiv.org/html/2607.10131#bib.bib1)\), and AMLSim\-32k\-5%\(Suzumura and Kanezashi[2021](https://arxiv.org/html/2607.10131#bib.bib30); Schmidt et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib27)\)—recipient\-degree stratified evaluation reveals a pattern hidden by aggregate metrics: GNN performance deteriorates precisely in high in\-degree recipient contexts\. These are exactly the regions where detection is technically difficult and operationally most costly\. This degradation is not incidental to a single model or dataset, and our results show that it is not resolved simply by increasing attention\-model capacity or tuning\. At the same time, the finding does not imply that attention should be abandoned\. Attention remains valuable in AML because it can selectively focus on relevant neighbors among large volumes of background activity\. The limitation is that, as recipient density grows, attention becomes fragile: weak but pattern\-relevant multi\-hop signals can be attenuated before the full laundering pattern is assembled\. Thus, recipient\-degree stratification localizes the failure, but it also points to a broader design question: what information should be available to the model before each attention step?

To answer this question, we map the dense\-recipient failure to three aggregation limitations that AML graphs amplify: \(i\) limited discrimination of neighborhood multisets under single summaries\(Corso et al\.[2020](https://arxiv.org/html/2607.10131#bib.bib8)\), \(ii\) loss of cardinality information in normalized or order\-statistic aggregators\(Zhang and Xie[2021](https://arxiv.org/html/2607.10131#bib.bib38)\), and \(iii\) attenuation of weak multi\-hop evidence under normalized attention\. These limitations are not specific to AML\(Wu, He, and Xu[2019](https://arxiv.org/html/2607.10131#bib.bib33); Wu et al\.[2022](https://arxiv.org/html/2607.10131#bib.bib34); Sun et al\.[2026](https://arxiv.org/html/2607.10131#bib.bib29); Xu et al\.[2019](https://arxiv.org/html/2607.10131#bib.bib35)\), but they become especially consequential in transaction graphs, where suspicious evidence is often relational, sparse within large volumes of benign activity, and meaningful only when multiple weak signals are composed into a broader pattern\. This leads to a simple design principle: attention provides useful selectivity, but dense recipient contexts require distributional and cardinality information to be incorporated into the node state before subsequent attention layers operate\. If this information is introduced only at prediction time\(Chen et al\.[2025](https://arxiv.org/html/2607.10131#bib.bib6)\), later attention steps still select over representations that may not contain the cues needed to distinguish dense suspicious contexts\. Our ablations support this view \(§[5](https://arxiv.org/html/2607.10131#S5); Appendix M\), showing that the placement of statistical\-attention fusion, rather than the mere presence of both branches, is critical for dense\-region performance\.

We instantiate this principle asSALT\-GNN, a lightweight architecture that couples degree\-aware statistical aggregation with learned attention at each message\-passing layer, so both distributional evidence and selective attention are available before the next propagation step\. To test whether the principle depends on a particular attention operator, we instantiate it with both Transformer\-style and GAT\-style attention \(*SALT\-Trans*,*SALT\-GAT*\)\. Empirically, SALT improves aggregate and high\-degree F1 score across all three benchmarks, using up to 77% fewer parameters than the strongest baselines on HI\-Small and HI\-Medium and reaching its largest gains in the dense recipient contexts the stratified evaluation identifies\. The gains hold for both backbones, supporting that the benefit comes from where evidence is fused rather than from a specific attention operator\.

#### Contributions\.

1. 1\.A recipient\-degree diagnostic for AML\-GNN evaluation\.We introduce a post\-hoc protocol that reports standard AML metrics across destination in\-degree ranges, revealing systematic degradation in dense recipient contexts that aggregate metrics conceal across both edge\- and node\-level tasks\.
2. 2\.A dense\-context diagnosis for AML GNNs\.We connect the observed degradation to aggregation limitations that AML graphs amplify: multiset non\-discriminability, cardinality blindness, and attenuation of weak multi\-hop evidence under normalized attention\.
3. 3\.SALT\-GNN, a lightweight statistics\-aware attention architecture\.We propose a layer\-wise fusion architecture that combines degree\-aware statistical aggregation with learned attention before each propagation step, improving performance precisely in the dense regions isolated by the diagnostic\.

We release code to reproduce the stratified protocol, baselines, and ablations, with the goal of making dense\-context reliability a standard part of AML\-GNN evaluation\.

## 2Background and Problem Formulation

We formalize financial transaction graphs and the edge\- and node\-level AML tasks, review message passing and attention in standard GNNs, and introduce three general aggregation limitations, linking them to AML transaction graphs\.

### Financial Transaction Graphs

Financial transaction networks are directed multigraphs𝒢=\(𝒱,ℰ\)\\mathcal\{G\}=\(\\mathcal\{V\},\\mathcal\{E\}\), with accounts as nodes and attributed transactions as directed edges; parallel edges encode repeated transfers\.

#### Task Formulation\.

We study transaction\-level edge classification and account\-level node classification, predicting whether a transaction or account is suspicious\. This dual formulation lets us validate architectural insights across task types\.

### Graph Neural Networks

Message Passing Neural Networks \(MPNNs\) update node representations as𝐡v\(k\)=U\(k\)​\(𝐡v\(k−1\),AGG\(k\)​\(\{𝐡u\(k−1\):u∈𝒩​\(v\)\}\)\)\\mathbf\{h\}\_\{v\}^\{\(k\)\}\\\!=\\\!\\mathrm\{U\}^\{\(k\)\}\\\!\\left\(\\mathbf\{h\}\_\{v\}^\{\(k\-1\)\}\\\!,\\mathrm\{AGG\}^\{\(k\)\}\\\!\\left\(\\\{\\mathbf\{h\}\_\{u\}^\{\(k\-1\)\}\\\!:\\\!u\\in\\mathcal\{N\}\(v\)\\\}\\right\)\\right\), where𝒩​\(v\)\\mathcal\{N\}\(v\)is the neighborhood ofvv,AGG\\mathrm\{AGG\}is a permutation\-invariant function, andU\\mathrm\{U\}is typically a Multilayer Perceptron \(MLP\)\. Afterkkrounds,𝐡v\(k\)\\mathbf\{h\}\_\{v\}^\{\(k\)\}incorporates information from up tokkhops\. Architectures mainly differ inAGG\\mathrm\{AGG\}: GCN uses degree\-normalized averaging\(Kipf and Welling[2017](https://arxiv.org/html/2607.10131#bib.bib15)\), GAT learns attention weights\(Velickovic et al\.[2018](https://arxiv.org/html/2607.10131#bib.bib32)\), GIN uses sum aggregation\(Xu et al\.[2019](https://arxiv.org/html/2607.10131#bib.bib35); Huang and Villar[2021](https://arxiv.org/html/2607.10131#bib.bib13)\), and PNA combines multiple statistics with degree\-based scaling\(Corso et al\.[2020](https://arxiv.org/html/2607.10131#bib.bib8)\)\. Attention\-based GNNs instead compute an adaptive weighted mean of neighbor representations as their aggregation function:

hi′=∑j∈𝒩​\(i\)αi​j​hjs\.t\.∑j∈𝒩​\(i\)αi​j=1h^\{\\prime\}\_\{i\}=\\sum\_\{j\\in\\mathcal\{N\}\(i\)\}\\alpha\_\{ij\}h\_\{j\}\\quad\\text\{s\.t\.\}\\quad\\sum\_\{j\\in\\mathcal\{N\}\(i\)\}\\alpha\_\{ij\}=1\(1\)wherehi′h^\{\\prime\}\_\{i\}is the updated embedding of nodeii,hjh\_\{j\}is the embedding of a neighborj∈𝒩​\(i\)j\\in\\mathcal\{N\}\(i\), andαi​j∈\[0,1\]\\alpha\_\{ij\}\\in\[0,1\]is a learned importance coefficient \(typically obtained via a softmax\) that distributes unit mass across all neighbors ofii\. For hub nodes with many incoming transactions, this normalization can down\-weight even moderately informative neighbors to near\-zero—underexplored yet problematic in pattern\-centric financial graphs, where weak but coordinated multi\-hop signals matter\.

### Characterization of Aggregation Limitations

The three characteristics below are established properties of GNN aggregation: the first two are general limitations of common neighborhood summaries\(Corso et al\.[2020](https://arxiv.org/html/2607.10131#bib.bib8); Zhang and Xie[2021](https://arxiv.org/html/2607.10131#bib.bib38)\), and the third follows from how normalized attention propagates across hops\. They have not, to our knowledge, been explicitly examined in the AML setting, yet this is a regime where they matter especially, because the structure of laundering interacts directly with each of them: illicit flows hide behind benign\-looking summaries, concentrate at high\-volume accounts, and are deliberately arranged to look locally legitimate\. In the rest of this section we therefore map each characteristic to a concrete AML reading\.

#### Characteristic 1 \(Multiset non\-discriminability\)\(Corso et al\.[2020](https://arxiv.org/html/2607.10131#bib.bib8)\)\.

A single neighborhood statistic such as the mean, maximum, minimum, or standard deviation cannot uniquely characterize a multiset, so distinct neighborhoods may collapse to similar summaries even when their risk profiles differ\. This matters in AML because the collision can hide structured behavior behind a benign\-looking summary: a smurfing pattern, in which an illicit total is split across many small incoming transfers, can present an average incoming amount close to that of an ordinary account while differing sharply in dispersion or extremes\.

#### Characteristic 2 \(Cardinality blindness\)\(Zhang and Xie[2021](https://arxiv.org/html/2607.10131#bib.bib38)\)\.

Common neighborhood summaries are normalized or order\-based: mean, min, max, and standard deviation do not by themselves encode how many neighbors produced the summary\. Normalized \(softmax\) attention likewise outputs a convex combination whose result does not expose neighborhood size, even though the attention weights are themselves shaped by it \(Characteristic 3\)\. Sum aggregation does scale with cardinality, but it entangles this size signal with feature content and, in dense neighborhoods, with large volumes of background traffic\. In AML this is a direct loss of signal rather than a generic limitation: the number of incoming transfers is itself informative, since high in\-degree accounts are candidate collection or mixing points where laundered flows concentrate, and cardinality also affects modeling difficulty and operational risk\.

#### Characteristic 3 \(Attention\-induced multi\-hop signal attenuation\)\.

The normalized attention of Eq\. \([1](https://arxiv.org/html/2607.10131#S2.E1)\) is selective, which is valuable in AML because many transactions are irrelevant background activity\. The same mechanism, however, can have a downside in AML settings: laundering is constructed through layering so that each individual transfer looks locally legitimate, which is precisely the regime in which a locally weak edge can be assigned a very small weight despite being part of a larger multi\-hop pattern\. Because the influence of an early\-hop neighbor on a downstream node compounds multiplicatively through the attention weights along the connecting path, repeated down\-weighting across successive dense hubs can attenuate such evidence before the full pattern is assembled\. This is distinct from the usual benefit of attention against noise: the mechanism that filters irrelevant neighbors is the same one that can suppress weak but coordinated signals that an adversary has deliberately shaped to appear benign\.

#### Implications for AML architectures\.

PNA\-type models address the first two characteristics by combining multiple statistics with degree scalers, but they still aggregate all neighbors and may be sensitive to dense background traffic\. Attention\-based GNNs and graph transformers provide selectivity, but normalized attention remains exposed to cardinality effects and can attenuate weak multi\-hop evidence\.

## 3From Diagnosis to a Design Principle: SALT\-GNN

Guided by the diagnosis in §[2](https://arxiv.org/html/2607.10131#S2.SSx3), we introduceSALT\-GNN, a statistics\-aware layer\-wise fusion architecture for directed transaction graphs\. At each message\-passing layer it computes a degree\-aware statistical update and an attention update, then fuses them before the next layer, so propagation uses states carrying both forms of evidence \(Fig\.[2](https://arxiv.org/html/2607.10131#S3.F2)\)\.

### Layer\-wise SALT update

Let𝒢=\(𝒱,ℰ\)\\mathcal\{G\}=\(\\mathcal\{V\},\\mathcal\{E\}\)be a directed transaction multigraph, with accounts as nodes and transactions as directed edges\. For a nodevv, let𝒩in​\(v\)\\mathcal\{N\}\_\{\\mathrm\{in\}\}\(v\)denote its incoming transaction neighborhood\. We writedv≡din​\(v\)=\|𝒩in​\(v\)\|d\_\{v\}\\equiv d\_\{\\mathrm\{in\}\}\(v\)=\|\\mathcal\{N\}\_\{\\mathrm\{in\}\}\(v\)\|for the in\-degree ofvv\. When multiple parallel transactions connect the same source accountuuto the same recipient accountvv, they are treated as distinct incoming messages; for notational simplicity, we index incoming messages byu∈𝒩in​\(v\)u\\in\\mathcal\{N\}\_\{\\mathrm\{in\}\}\(v\)and associate each message with an edge\-feature vector𝐞v,u\\mathbf\{e\}\_\{v,u\}\. Let𝐡v\(k−1\)∈ℝdh\\mathbf\{h\}\_\{v\}^\{\(k\-1\)\}\\in\\mathbb\{R\}^\{d\_\{h\}\}be the representation of nodevventering layerkk\. Before aggregation, each incoming transaction is represented as an edge\-conditioned neighbor message:

𝐦v,u\(k\)=𝐡u\(k−1\)\+𝐖e\(k\)​𝐞v,u,u∈𝒩in​\(v\),\\mathbf\{m\}\_\{v,u\}^\{\(k\)\}=\\mathbf\{h\}\_\{u\}^\{\(k\-1\)\}\+\\mathbf\{W\}\_\{e\}^\{\(k\)\}\\mathbf\{e\}\_\{v,u\},\\qquad u\\in\\mathcal\{N\}\_\{\\mathrm\{in\}\}\(v\),\(2\)where𝐖e\(k\)\\mathbf\{W\}\_\{e\}^\{\(k\)\}projects edge attributes to the hidden dimension\. If edge attributes are unavailable for a dataset or task, the second term is omitted\. The multiset aggregated by the two SALT channels is

ℳv\(k\)=\{𝐦v,u\(k\):u∈𝒩in​\(v\)\}\.\\mathcal\{M\}\_\{v\}^\{\(k\)\}=\\left\\\{\\mathbf\{m\}\_\{v,u\}^\{\(k\)\}:u\\in\\mathcal\{N\}\_\{\\mathrm\{in\}\}\(v\)\\right\\\}\.
#### Statistical channel\.

The statistical channel computes summaries ofℳv\(k\)\\mathcal\{M\}\_\{v\}^\{\(k\)\}using element\-wise aggregators𝒜=\{μ,σ,min,max\}\\mathcal\{A\}=\\\{\\mu,\\sigma,\\min,\\max\\\}and degree scalers𝒮\\mathcal\{S\}\. Following PNA\(Corso et al\.[2020](https://arxiv.org/html/2607.10131#bib.bib8)\), we use identity, amplification, and attenuation scalers:

sid​\(dv\)=1,samp​\(dv\)=γvδ,sattn​\(dv\)=δmax⁡\(γv,ϵ\),s\_\{\\mathrm\{id\}\}\(d\_\{v\}\)\\\!=\\\!1,\\quad\\;\\\>s\_\{\\mathrm\{amp\}\}\(d\_\{v\}\)\\\!=\\\!\\frac\{\\gamma\_\{v\}\}\{\\delta\},\\quad\\;\\\>s\_\{\\mathrm\{attn\}\}\(d\_\{v\}\)\\\!=\\\!\\frac\{\\delta\}\{\\max\(\\gamma\_\{v\},\\epsilon\)\},\(3\)whereγv=log⁡\(dv\+1\)\\gamma\_\{v\}=\\log\(d\_\{v\}\+1\),δ\\deltais the mean value oflog⁡\(d\+1\)\\log\(d\+1\)over the training graph, andϵ\>0\\epsilon\>0is a small constant used only to avoid division by zero\. The statistical summary is

𝐠v,stat\(k\)=⨁s∈𝒮⨁agg∈𝒜s​\(dv\)⋅agg​\(ℳv\(k\)\),\\mathbf\{g\}\_\{v,\\mathrm\{stat\}\}^\{\(k\)\}=\\bigoplus\_\{s\\in\\mathcal\{S\}\}\\bigoplus\_\{\\mathrm\{agg\}\\in\\mathcal\{A\}\}s\(d\_\{v\}\)\\cdot\\mathrm\{agg\}\\\!\\left\(\\mathcal\{M\}\_\{v\}^\{\(k\)\}\\right\),\(4\)and the statistical update is

𝐡v,stat\(k\)=Ustat\(k\)​\(𝐡v\(k−1\)∥𝐠v,stat\(k\)\),\\mathbf\{h\}\_\{v,\\mathrm\{stat\}\}^\{\(k\)\}=\\mathrm\{U\}\_\{\\mathrm\{stat\}\}^\{\(k\)\}\\left\(\\mathbf\{h\}\_\{v\}^\{\(k\-1\)\}\\,\\\|\\,\\mathbf\{g\}\_\{v,\\mathrm\{stat\}\}^\{\(k\)\}\\right\),\(5\)whereUstat\(k\)\\mathrm\{U\}\_\{\\mathrm\{stat\}\}^\{\(k\)\}is an MLP and∥\\\|denotes concatenation\.

#### Attention channel\.

The attention channel computes a learned weighted aggregation over the same incoming transaction messages\. SALT is agnostic to the attention scoring function\. For each incoming message fromuutovv, let

av,u\(k\)=score\(k\)​\(𝐡v\(k−1\),𝐦v,u\(k\)\)a\_\{v,u\}^\{\(k\)\}=\\mathrm\{score\}^\{\(k\)\}\\left\(\\mathbf\{h\}\_\{v\}^\{\(k\-1\)\},\\mathbf\{m\}\_\{v,u\}^\{\(k\)\}\\right\)\(6\)be an unnormalized attention score\. The normalized coefficient is

αv,u\(k\)=exp⁡\(av,u\(k\)\)∑u′∈𝒩in​\(v\)exp⁡\(av,u′\(k\)\),∑u∈𝒩in​\(v\)αv,u\(k\)=1\.\\alpha\_\{v,u\}^\{\(k\)\}=\\frac\{\\exp\(a\_\{v,u\}^\{\(k\)\}\)\}\{\\sum\_\{u^\{\\prime\}\\in\\mathcal\{N\}\_\{\\mathrm\{in\}\}\(v\)\}\\exp\(a\_\{v,u^\{\\prime\}\}^\{\(k\)\}\)\},\\qquad\\sum\_\{u\\in\\mathcal\{N\}\_\{\\mathrm\{in\}\}\(v\)\}\\alpha\_\{v,u\}^\{\(k\)\}=1\.\(7\)The attention update is then

𝐡v,att\(k\)=Uatt\(k\)​\(∑u∈𝒩in​\(v\)αv,u\(k\)​𝐦v,u\(k\)\),\\mathbf\{h\}\_\{v,\\mathrm\{att\}\}^\{\(k\)\}=\\mathrm\{U\}\_\{\\mathrm\{att\}\}^\{\(k\)\}\\left\(\\sum\_\{u\\in\\mathcal\{N\}\_\{\\mathrm\{in\}\}\(v\)\}\\alpha\_\{v,u\}^\{\(k\)\}\\mathbf\{m\}\_\{v,u\}^\{\(k\)\}\\right\),\(8\)whereUatt\(k\)\\mathrm\{U\}\_\{\\mathrm\{att\}\}^\{\(k\)\}is either an identity map or a learned projection, depending on the backbone instantiation\.

We instantiate this template with two standard attention operators\. In*SALT\-Trans*,score\(k\)\\mathrm\{score\}^\{\(k\)\}is a Transformer\-style dot\-product score\(Shi et al\.[2021](https://arxiv.org/html/2607.10131#bib.bib28)\); in*SALT\-GAT*, it is a GAT\-style additive score\(Velickovic et al\.[2018](https://arxiv.org/html/2607.10131#bib.bib32)\)\. In both cases, the SALT contribution is not the particular attention scoring rule, but the fact that the attention update is fused layer\-wise with a degree\-aware statistical update\.

#### Layer\-wise fusion\.

The full SALT layer is the residual fusion of the previous state, the statistical update, and the attention update:

𝐳v\(k\)\\displaystyle\\mathbf\{z\}\_\{v\}^\{\(k\)\}=𝐡v\(k−1\)​‖𝐡v,stat\(k\)‖​𝐡v,att\(k\),\\displaystyle=\\mathbf\{h\}\_\{v\}^\{\(k\-1\)\}\\,\\\|\\,\\mathbf\{h\}\_\{v,\\mathrm\{stat\}\}^\{\(k\)\}\\,\\\|\\,\\mathbf\{h\}\_\{v,\\mathrm\{att\}\}^\{\(k\)\},\(9\)𝐡~v\(k\)\\displaystyle\\widetilde\{\\mathbf\{h\}\}\_\{v\}^\{\(k\)\}=MLPfusion\(k\)​\(𝐳v\(k\)\),\\displaystyle=\\mathrm\{MLP\}\_\{\\mathrm\{fusion\}\}^\{\(k\)\}\\left\(\\mathbf\{z\}\_\{v\}^\{\(k\)\}\\right\),\(10\)𝐡v\(k\)\\displaystyle\\mathbf\{h\}\_\{v\}^\{\(k\)\}=12​\(𝐡v\(k−1\)\+𝐡~v\(k\)\)\.\\displaystyle=\\frac\{1\}\{2\}\\left\(\\mathbf\{h\}\_\{v\}^\{\(k\-1\)\}\+\\widetilde\{\\mathbf\{h\}\}\_\{v\}^\{\(k\)\}\\right\)\.\(11\)Eq\. \([11](https://arxiv.org/html/2607.10131#S3.E11)\) is the complete SALT update\. The two channels do not define two independent models: after every layer, their outputs are integrated into a single node representation𝐡v\(k\)\\mathbf\{h\}\_\{v\}^\{\(k\)\}, which is then consumed by the next message\-passing layer\.

### Architectural role of the two channels

Eqs\. \([4](https://arxiv.org/html/2607.10131#S3.E4)\)–\([11](https://arxiv.org/html/2607.10131#S3.E11)\) map directly to the aggregation characteristics of §[2](https://arxiv.org/html/2607.10131#S2.SSx3)\. The multi\-aggregation block \(Eq\. \([4](https://arxiv.org/html/2607.10131#S3.E4)\)\) addresses multiset non\-discriminability by exposing complementary summaries\(μ,σ,min,max\)\(\\mu,\\sigma,\\min,\\max\), and the degree scalerss​\(dv\)s\(d\_\{v\}\)address cardinality blindness by making recipient in\-degree an explicit input separated from feature content\. SALT does not remove softmax normalization, so the attention channel can still attenuate locally weak edges across hops; the mitigation of this effect is the coexistence of the attentive path with a parallel non\-attentive statistical path inside the same layer\-wise update, rather than a separate term\.

#### Propagation across hops\.

Layer\-wise fusion changes what later attention layers receive as input\. At layerk\+1k\+1, messages are built from𝐡\(k\)\\mathbf\{h\}^\{\(k\)\}, which already contains statistical and attentional evidence from the previous hop\. Thus subsequent attention scores are computed on statistics\-enriched states, unlike late\-fusion designs such as PNAGMDA\(Chen et al\.[2025](https://arxiv.org/html/2607.10131#bib.bib6)\), where branches interact only at prediction time\.

### Computational Efficiency\.

Despite combining two aggregation operators, SALT\-GNN remains lightweight: about 42k and 40k parameters for SALT\-Trans and SALT\-GAT, versus 182k for FraudGT, 61k for GAT, and 84k for a TransConv\-only model\. All models are instantiated at their best\-validation\-F1 configuration, so these differences are not tuned in SALT’s favor\. This compact design offers a favorable performance–parameter trade\-off, which matters where computational cost is a practical constraint\(Paoletti et al\.[2025](https://arxiv.org/html/2607.10131#bib.bib22)\)\.

InputStatistical Channelμ,σ\\mu,\\sigmamin,max\\min,\\maxAttention ChannelFusionConcat→\\toMLPOutput𝐡v\(k\)\\mathbf\{h\}\_\{v\}^\{\(k\)\}×s​\(dv\)\\times\\,s\(d\_\{v\}\)Residual𝐡v\(k−1\)\\mathbf\{h\}\_\{v\}^\{\(k\-1\)\}Global ResidualFigure 2:SALT\-GNN architecture\. Two parallel branches process each neighborhood: a*statistical channel*computes degree\-aware statistics \(aggregatorsμ,σ,min,max\\mu,\\sigma,\\min,\\maxrescaled by degree scalerss​\(dv\)s\(d\_\{v\}\)\) and an*attention channel*applies selective attention to highlight salient neighbors\. A learnable fusion block combines both with the residual state𝐡v\(k−1\)\\mathbf\{h\}\_\{v\}^\{\(k\-1\)\}, producing𝐡v\(k\)\\mathbf\{h\}\_\{v\}^\{\(k\)\}with a global residual connection\.

## 4Experimental Setup

We present our stratified evaluation protocol and attention diagnostics, then datasets, baselines, and statistical testing\.

### Recipient\-Stratified Evaluation

We use recipient\-degree\-stratified reporting as a post\-hoc diagnostic: models are trained and selected under the original benchmark protocol, and only the reporting of test predictions is stratified\. Alongside the stratified scores we report the overall F1 score used in prior work, making explicit how aggregate metrics conceal degradation in dense neighborhoods\. Each test prediction is assigned to a degree bin according to the in\-degree of its*recipient context*: for node classification this is the evaluated account itself, and for edge classification it is the receiver of the transaction, since the receiver is where incoming evidence is aggregated and competing transfers must be compressed\. Bins partition recipient in\-degree into logarithmically increasing ranges, and within each bin we compute the same metric as in the aggregate evaluation, over the predictions whose recipient context falls in that bin \(see Algorithms in Appendix L\)\.

#### Attention diagnostics\.

For attention\-based GNNs, ENNs measures attention spread \(Appendix D\), while Hit@kkmeasures fraud relevance: among nodes with at least one fraudulent incoming neighbor, it is the fraction whose top\-kkattention weights include one\. Low Hit@kkindicates that attention suppresses fraud\-relevant evidence before multi\-hop patterns can be assembled \(Characteristic 3 in §[2](https://arxiv.org/html/2607.10131#S2.SSx3)\)\.

Table 1:Datasets used in our experiments\.
#### Datasets\.

Because real banking data are severely restricted by privacy and regulation, AML research relies on reproducible synthetic benchmarks\. We use IBM’s HI\-Small and HI\-Medium\(Altman et al\.[2023](https://arxiv.org/html/2607.10131#bib.bib1)\), de facto standards for transaction\-level AML evaluation\(Gounoue, Sao, and Gottschalk[2025](https://arxiv.org/html/2607.10131#bib.bib11); Altman et al\.[2023](https://arxiv.org/html/2607.10131#bib.bib1); Egressy et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib10); Bilgi, Chen, and Atasu[2024](https://arxiv.org/html/2607.10131#bib.bib3); Karim et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib14); Lin et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib19); Blanuša et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib4)\), and AMLSim\-32k\-5%\(Schmidt et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib27)\), which provides account\-level labels from canonical laundering patterns \(Tab\.[1](https://arxiv.org/html/2607.10131#S4.T1)\)\. We use strictly temporal splits for HI\-Small and HI\-Medium\(Egressy et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib10); Altman et al\.[2023](https://arxiv.org/html/2607.10131#bib.bib1); Lin et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib19); Gounoue, Sao, and Gottschalk[2025](https://arxiv.org/html/2607.10131#bib.bib11); Bilgi, Chen, and Atasu[2024](https://arxiv.org/html/2607.10131#bib.bib3)\)and the data creators’ protocol for AMLSim\-32k\-5%\(Schmidt et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib27)\)\.

#### Baselines\.

We instantiate SALT\-GNN as SALT\-Trans \(Transformer\-based\) and SALT\-GAT \(GAT\-based\)\. On HI\-Small and HI\-Medium we compare against GIN\(Xu et al\.[2019](https://arxiv.org/html/2607.10131#bib.bib35)\), PNA\(Corso et al\.[2020](https://arxiv.org/html/2607.10131#bib.bib8)\), GAT\(Velickovic et al\.[2018](https://arxiv.org/html/2607.10131#bib.bib32)\), TransConv\(Shi et al\.[2021](https://arxiv.org/html/2607.10131#bib.bib28)\), FraudGT\(Lin et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib19)\), and PNAGMDA\(Chen et al\.[2025](https://arxiv.org/html/2607.10131#bib.bib6)\), the closest late\-fusion precedent\. We evaluate TransConv at hidden sizes6464\(84k params\) and128128\(318k params\) to test whether dense\-neighborhood degradation is merely a capacity issue\(Di Giovanni et al\.[2023](https://arxiv.org/html/2607.10131#bib.bib9)\)\. On AMLSim\-32k\-5% we also include GCN\(Kipf and Welling[2017](https://arxiv.org/html/2607.10131#bib.bib15)\)and the AML\-specialized for node classification GAMLNet\(Schmidt et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib27)\)\. Established baselines use best validation F1 score configurations from prior work\(Altman et al\.[2023](https://arxiv.org/html/2607.10131#bib.bib1); Lin et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib19); Schmidt et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib27)\)and tune the new ones equivalently; SALT and PNAGMDA inherit backbone hyperparameters, so gains stem from architectural fusion\. Full configurations are in Appendix I\.

#### Evaluation Protocol\.

Our primary metric is positive\-class F1 score, standard in AML\(Altman et al\.[2023](https://arxiv.org/html/2607.10131#bib.bib1); Lin et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib19); Egressy et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib10); Blanuša et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib4); Karim et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib14); Gounoue, Sao, and Gottschalk[2025](https://arxiv.org/html/2607.10131#bib.bib11)\)to keep a single comparable metric across bins and datasets\. Additionally, Appendix F reports degree\-stratified PR\-AUC on HI\-Small, HI\-Medium, and AMLSim\-32k\-5%\. We report mean and standard deviation across seeds \(5 for HI\-Small and AMLSim\-32k\-5%, 3 for HI\-Medium\), selecting checkpoints by best overall validation F1 score\.

#### Statistical Testing\.

We test SALT against the strongest baseline and PNAGMDA on overall and densest\-bin F1/PR\-AUC, using exact permutation tests where possible and Welch’stt\-test for HI\-Medium\. Throughout the result tables,∗\\astand†\\daggermark SALT gains atp<0\.05p<0\.05andp<0\.10p<0\.10after Holm correction against the comparison baseline named in each caption; full values are in Appendix E\.

## 5Results

Table 2:HI\-Small F1 by recipient degree \(mean±\\pmstd, 5 seeds\)\. Bold/underline: best/second best\.∗\\ast: gain over PNAGMDA atp<0\.05p<0\.05\(Holm\-corrected permutation test\)\. Contrasts vs\. FraudGT are not significant on F1, though SALT\-Trans significantly leads on overall PR\-AUC \(Appendix E\)\.Table 3:HI\-Medium F1 score by recipient degree \(mean±\\pmstd, 3 seeds\)\. Bold/underline mark best/second best\.∗\\ast/†\\daggermark SALT gains over TransConv\-84k, the strongest baseline, atp<0\.05p<0\.05/p<0\.10p<0\.10after Holm correction \(Welch’stt\-test,n=3n=3; Appendix E\)\. Contrasts against PNAGMDA do not reach significance after correction on this dataset \(Appendix E\)\.Table 4:Compact AMLSim\-32k\-5% node\-classification F1 score \(mean±\\pmstd, 5 seeds, 3 splits\)\. We report one sparse bin, two high\-degree tail bins, and the aggregate score; the full degree\-stratified table with mean±\\pmstd is in Appendix C\.∗\\ast/†\\daggermark SALT gains over GAT, the strongest attention baseline in the extreme bin, atp<0\.05p<0\.05/p<0\.10p<0\.10after Holm correction \(exact paired permutation test,n=15n=15\); both variants also exceed PNAGMDA there atpHolm<0\.001p\_\{\\text\{Holm\}\}<0\.001\(Appendix E\)\.Tables[2](https://arxiv.org/html/2607.10131#S5.T2)–[4](https://arxiv.org/html/2607.10131#S5.T4)show a consistent pattern: aggregate F1 score hides dense\-recipient degradation, while SALT remains competitive overall and is strongest in the highest\-degree regimes\. We discuss the results through three research questions \(RQ1–RQ3\)\.

RQ1: How do vanilla GNNs behave as structural complexity increases?Across benchmarks, standard GNNs degrade as in\-degree grows\. On the IBM tasks \(Tables[2](https://arxiv.org/html/2607.10131#S5.T2)–[3](https://arxiv.org/html/2607.10131#S5.T3)\), PNA and TransConv drop in dense bins; increasing TransConv from 84k to 318k parameters lowers dense\-bin F1 score, suggesting a structural rather than capacity\-only limitation\. GAT collapses on IBM \(overall F1 score≈\\approx0\.008\), consistent with prior AML results\(Altman et al\.[2023](https://arxiv.org/html/2607.10131#bib.bib1); Egressy et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib10); Lin et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib19)\)\. FraudGT is robust on HI\-Small but scales less reliably to HI\-Medium, and the deg\[5–9\] dip is linked to unstructured ”agent\-based” fraud \(Appendix J\)\. AMLSim \(Table[4](https://arxiv.org/html/2607.10131#S5.T4)\) similarly shows high overall F1 score but tail degradation, supporting that high\-degree hubs remain challenging across tasks\.

Table 5:Hit@20 on HI\-Small deg\[50–99\] \(mean±\\pmstd, 5 seeds\): fraction of nodes with at least one fraudulent neighbor among the top\-20 attention weights, at the first \(L0\) and second \(L1\) hop\. We setk=20k=20to match TransConv’s effective neighborhood in deg\[50–99\], which is close to2020at both hops \(ENNs≈20\.7\\mathrm\{ENNs\}\\approx 20\.7at L0 and17\.017\.0at L1; Appendix D\)\. Higher is better: it shows that the fraud signal remains among the most\-attended neighbors\.RQ2: How do attention\-based GNNs behave in dense transaction graphs?Attention*spread*alone does not explain dense\-bin behavior \(Appendix D\): a model can attend broadly but rank fraud\-relevant edges poorly, or narrowly and miss them\. We therefore use Hit@20 as the primary diagnostic\. As shown in Table[5](https://arxiv.org/html/2607.10131#S5.T5), in deg\[50–99\] TransConv reaches Hit@20 of only0\.3520\.352at L0, so in roughly 65% of cases no fraudulent neighbor appears among the top\-20 attention weights; once such an edge is down\-weighted early, multi\-hop propagation can attenuate it further \(§[2](https://arxiv.org/html/2607.10131#S2.SSx3)\)\. Both SALT variants repair this: Hit@20 rises to0\.4490\.449/0\.4680\.468at L0 \(SALT\-Trans/SALT\-GAT\) and from0\.5790\.579to0\.7740\.774/0\.7460\.746at L1\. The statistics\-aware pathway thus does not merely reshape attention entropy; it keeps weak fraud\-relevant evidence available across hops even when learned attention would suppress it\.RQ3: Does SALT\-GNN help in extreme\-degree areas and across tasks?On the IBM edge benchmarks, SALT leads in the densest bins: on HI\-Small deg\[50–99\], SALT\-Trans/SALT\-GAT reach 0\.741/0\.751 vs\. FraudGT 0\.706 and TransConv 0\.615; on HI\-Medium deg\[100\+\], 0\.673/0\.687 vs\. the best baseline PNAGMDA at 0\.652—with competitive or best overall F1 score\. On the AMLSim node task the effect persists in the extreme tail: in deg\[2000–4732\], SALT\-Trans/SALT\-GAT reach 0\.733/0\.782 vs\. TransConv 0\.442 and GAT 0\.573, with the SALT\-GAT gain significant atp<0\.05p<0\.05and SALT\-Trans atp<0\.10p<0\.10after correction\. This separates SALT from PNAGMDA\(Chen et al\.[2025](https://arxiv.org/html/2607.10131#bib.bib6)\), which fuses the same branches only at prediction time: it trails SALT on HI\-Small overall \(0\.676 vs\. 0\.716\) and in the densest bin \(0\.678 vs\. 0\.751\), and collapses to 0\.044 in AMLSim deg\[2000–4732\]\. Since this contrast is between\-model, we also isolate fusion placement with a within\-model knockout: moving SALT’s fusion from per\-layer to prediction\-time, operators fixed, still solves the task \(probe PR\-AUC0\.9950\.995\) yet collapses second\-hop attention routing onto the planted fraud from AUC1\.001\.00to0\.500\.50\(chance\), while per\-layer SALT keeps it at1\.001\.00\(Appendix M\)\. This shows that*where*the two views interact—not which branches are combined—drives the dense\-region gain\.

#### Characteristic\-level ablation\.

We ablate SALT\-Trans on HI\-Small \(Table[6](https://arxiv.org/html/2607.10131#S5.T6); full F1 score/PR\-AUC in Appendix F\), removing C1 \(multi\-aggregation\) and C2 \(degree\-aware encoding\) one at a time, then the statistical channel as a whole\. C3 is isolated by toggling the statistical channel on and off at fixed attention: removing it \(*no statistics*\) leaves attention unmitigated, while the full model mitigates it; PNA \(no attention\) and TransConv \(unmitigated attention\) bound the comparison\. Dropping multi\-aggregators \(mean only\) lowers deg\[50–99\] F1 score from0\.7410\.741to0\.6360\.636, with std restoring most of it \(0\.7200\.720\), supporting C1; removing degree\-awareness gives a comparable drop \(→0\.616\\to 0\.616\) at the highest variance, supporting C2\. Attention alone without the statistical channel is less reliable in the dense bin \(TransConv0\.6150\.615, PNA0\.5150\.515\), but complementing it with statistics in SALT\-Trans reaches0\.7410\.741\. Tellingly, removing the statistical channel entirely \(*no statistics*\) reduces dense\-bin F1 score to0\.6370\.637and doubles its variance while overall F1 score barely moves \(0\.6980\.698vs\.0\.7160\.716\), supporting that the dense\-region gain comes from the statistical channel and that aggregate F1 score hides it\.

Table 6:Characteristic\-level ablation on HI\-Small \(F1 score, mean±\\pmstd, 5 seeds\)\. ✓/∘\\circ/×\\timesdenote full/partial/absent\.C1\(multi\-aggregation\):∘\\circ= two aggregators,×\\times= mean only\.C2\(degree\-aware encoding\):×\\times= absent\.C3\(attention handling\): ✓ = attention with multi\-hop mitigation \(statistics preserve down\-weighted signal\),∘\\circ= attention without mitigation,×\\times= no attention\. C1, C2 are toggled internally on SALT\-Trans;*no statistics*removes the whole channel; PNA and TransConv are references\. Full F1 score/PR\-AUC version in Appendix F\.ModelC1C2C3deg\[50–99\]overallSALT\-Trans \(full\)✓✓✓0\.741±0\.0190\.741\\pm 0\.0190\.716±0\.0180\.716\\pm 0\.018↪\\hookrightarrowmean\+std only∘\\circ✓✓0\.720±0\.0420\.720\\pm 0\.0420\.712±0\.0040\.712\\pm 0\.004↪\\hookrightarrowmean only×\\times✓✓0\.636±0\.0650\.636\\pm 0\.0650\.690±0\.0200\.690\\pm 0\.020↪\\hookrightarrowno degree✓×\\times✓0\.616±0\.1030\.616\\pm 0\.1030\.713±0\.0130\.713\\pm 0\.013↪\\hookrightarrowno statistics×\\times×\\times∘\\circ0\.637±0\.0320\.637\\pm 0\.0320\.698±0\.0160\.698\\pm 0\.016PNA\(ref\.\)✓✓×\\times0\.515±0\.0990\.515\\pm 0\.0990\.629±0\.0320\.629\\pm 0\.032TransConv\(ref\.\)×\\times×\\times∘\\circ0\.615±0\.0180\.615\\pm 0\.0180\.645±0\.0310\.645\\pm 0\.031

## 6Discussion, Limitations, and Future Work

On HI\-Small, SALT\-GAT and SALT\-Trans train in 140s and 142s per epoch, close to PNA \(135s\) and TransConv\-318k \(123s\) and far faster than FraudGT \(242s\) under the same configuration \(Appendix K\)\. SALT thus improves dense\-region behavior without a heavy task\-specific graph transformer—operationally relevant, since high\-activity accounts concentrate investigation cost and missed\-risk exposure\. Our evaluation is restricted to public synthetic AML benchmarks, which, though standard, may not reflect the full heterogeneity of products, institutions, labeling practices, and cross\-border flows in deployed systems; validating recipient\-degree behavior and SALT\-style hybrids on proprietary, multi\-institution, and temporal graphs is an important next step\.

## 7Related Work

AML and financial\-fraud detection have been studied with graph feature pre\-processing, GNNs, temporal models, and graph transformers\. GFP\(Blanuša et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib4)\)extracts structural features for tree ensembles on the IBM AML benchmarks\(Altman et al\.[2023](https://arxiv.org/html/2607.10131#bib.bib1)\); GAMLNet\(Schmidt et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib27)\), MultiGNN\-style architectures\(Egressy et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib10); Bilgi, Chen, and Atasu[2024](https://arxiv.org/html/2607.10131#bib.bib3)\), TeMP\-TraG\(Gounoue, Sao, and Gottschalk[2025](https://arxiv.org/html/2607.10131#bib.bib11)\), temporal GNNs for online payments\(Saldaña\-Ulloa, De Ita Luna, and Marcial\-Romero[2024](https://arxiv.org/html/2607.10131#bib.bib24)\), and FraudGT\(Lin et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib19)\)demonstrate the value of graph and temporal structure\. Other work addresses scalable semi\-supervised learning and ensembles\(Karim et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib14)\), class imbalance\(Liu et al\.[2021](https://arxiv.org/html/2607.10131#bib.bib21); Boyapati and Aygun[2025](https://arxiv.org/html/2607.10131#bib.bib5)\), LLM–GNN integration\(Yang et al\.[2025](https://arxiv.org/html/2607.10131#bib.bib36)\), reverse message passing\(Schlichtkrull et al\.[2018](https://arxiv.org/html/2607.10131#bib.bib26)\), port numbering\(Sato, Yamada, and Kashima[2019](https://arxiv.org/html/2607.10131#bib.bib25)\), ego identifiers\(You et al\.[2021](https://arxiv.org/html/2607.10131#bib.bib37)\), and specialized pre\-processing\(Liang et al\.[2025](https://arxiv.org/html/2607.10131#bib.bib18)\)\. We focus on vanilla message passing and lightweight hybrids to isolate how standard aggregation and attention behave across recipient\-degree regimes\. PNAGMDA\(Chen et al\.[2025](https://arxiv.org/html/2607.10131#bib.bib6)\)is the closest architectural precedent because it combines PNA and GAT branches; we evaluate it directly and distinguish SALT\-GNN by layer\-wise rather than prediction\-time fusion\. Dense\-subgraph methods\(Hooi et al\.[2017](https://arxiv.org/html/2607.10131#bib.bib12); Liu, Hooi, and Faloutsos[2018](https://arxiv.org/html/2607.10131#bib.bib20)\)are complementary: they search for suspicious dense communities in an unsupervised or subgraph\-centric way, whereas we use recipient\-degree stratified evaluation to analyze supervised GNN behavior across graph regimes\. Work on scalable fraud pipelines\(Rees et al\.[2022](https://arxiv.org/html/2607.10131#bib.bib23); Paoletti et al\.[2025](https://arxiv.org/html/2607.10131#bib.bib22)\)emphasizes production constraints; we instead show that lightweight supervised GNNs improve dense\-region robustness without heavy graph transformers\.

## 8Conclusion

We introduced recipient\-degree stratified evaluation for AML GNNs, showing that aggregate metrics hide systematic degradation in dense, high\-activity recipient contexts, and SALT\-GNN, which fuses degree\-aware statistical aggregation and attention at every message\-passing layer\. Across three benchmarks, SALT improves dense\-bin performance with a compact footprint, and our ablations and Hit@kkdiagnostics support the central claim: layer\-wise interaction between statistics and attention is more robust in dense neighborhoods than either view alone or late fusion\.

## References

- Altman et al\. \(2023\)Altman, E\.; Blanuša, J\.; Niederhäusern, L\. V\.; Egressy, B\.; Anghel, A\.; and Atasu, K\. 2023\.Realistic Synthetic Financial Transactions for Anti\-Money Laundering Models\.In*Thirty\-seventh Conference on Neural Information Processing Systems Datasets and Benchmarks Track*\.
- Beneish and Vorst \(2022\)Beneish, M\. D\.; and Vorst, P\. 2022\.The cost of fraud prediction errors\.*The Accounting Review*, 97\(6\): 91–121\.
- Bilgi, Chen, and Atasu \(2024\)Bilgi, H\. Ç\.; Chen, L\. Y\.; and Atasu, K\. 2024\.Multigraph Message Passing with Bi\-Directional Multi\-Edge Aggregations\.*arXiv preprint arXiv:2412\.00241*\.
- Blanuša et al\. \(2024\)Blanuša, J\.; Cravero Baraja, M\.; Anghel, A\.; von Niederhäusern, L\.; Altman, E\.; Pozidis, H\.; and Atasu, K\. 2024\.Graph Feature Preprocessor: Real\-time Subgraph\-based Feature Extraction for Financial Crime Detection\.In*Proceedings of the 5th ACM International Conference on AI in Finance*, ICAIF ’24, 222–230\. New York, NY, USA: Association for Computing Machinery\.ISBN 9798400710810\.
- Boyapati and Aygun \(2025\)Boyapati, M\.; and Aygun, R\. 2025\.BalancerGNN: Balancer Graph Neural Networks for imbalanced datasets: A case study on fraud detection\.*Neural Networks*, 182: 106926\.
- Chen et al\. \(2025\)Chen, C\.; Ma, M\.; Nie, J\.; Wang, L\.; and Xu, J\. 2025\.PNAGMDA: A Principal Neighborhood Aggregation Based Graph Neural Network for miRNA\-Disease Association Prediction\.*IEEE/ACM Transactions on Computational Biology and Bioinformatics*\.
- Chen et al\. \(2018\)Chen, Z\.; Van Khoa, L\. D\.; Teoh, E\. N\.; Nazir, A\.; Karuppiah, E\. K\.; and Lam, K\. S\. 2018\.Machine learning techniques for anti\-money laundering \(AML\) solutions in suspicious transaction detection: a review\.*Knowledge and Information Systems*, 57\(2\): 245–285\.
- Corso et al\. \(2020\)Corso, G\.; Cavalleri, L\.; Beaini, D\.; Liò, P\.; and Velickovic, P\. 2020\.Principal Neighbourhood Aggregation for Graph Nets\.In Larochelle, H\.; Ranzato, M\.; Hadsell, R\.; Balcan, M\.; and Lin, H\., eds\.,*Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6\-12, 2020, virtual*\.
- Di Giovanni et al\. \(2023\)Di Giovanni, F\.; Giusti, L\.; Barbero, F\.; Luise, G\.; Lio, P\.; and Bronstein, M\. M\. 2023\.On over\-squashing in message passing neural networks: The impact of width, depth, and topology\.In*International conference on machine learning*, 7865–7885\. PMLR\.
- Egressy et al\. \(2024\)Egressy, B\.; Von Niederhäusern, L\.; Blanuša, J\.; Altman, E\.; Wattenhofer, R\.; and Atasu, K\. 2024\.Provably powerful graph neural networks for directed multigraphs\.In*Proceedings of the AAAI Conference on Artificial Intelligence*, volume 38, 11838–11846\.
- Gounoue, Sao, and Gottschalk \(2025\)Gounoue, S\.; Sao, A\.; and Gottschalk, S\. 2025\.TeMP\-TraG: Edge\-based Temporal Message Passing in Transaction Graphs\.*arXiv preprint arXiv:2503\.16901*\.
- Hooi et al\. \(2017\)Hooi, B\.; Shin, K\.; Song, H\. A\.; Beutel, A\.; Shah, N\.; and Faloutsos, C\. 2017\.Graph\-based fraud detection in the face of camouflage\.*ACM Transactions on Knowledge Discovery from Data \(TKDD\)*, 11\(4\): 1–26\.
- Huang and Villar \(2021\)Huang, N\. T\.; and Villar, S\. 2021\.A short tutorial on the weisfeiler\-lehman test and its variants\.In*ICASSP 2021\-2021 IEEE International Conference on Acoustics, Speech and Signal Processing \(ICASSP\)*, 8533–8537\. IEEE\.
- Karim et al\. \(2024\)Karim, M\. R\.; Hermsen, F\.; Chala, S\. A\.; De Perthuis, P\.; and Mandal, A\. 2024\.Scalable semi\-supervised graph learning techniques for anti money laundering\.*IEEE Access*, 12: 50012–50029\.
- Kipf and Welling \(2017\)Kipf, T\. N\.; and Welling, M\. 2017\.Semi\-Supervised Classification with Graph Convolutional Networks\.In*5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24\-26, 2017, Conference Track Proceedings*\. OpenReview\.net\.
- Kou et al\. \(2004\)Kou, Y\.; Lu, C\.\-T\.; Sirwongwattana, S\.; and Huang, Y\.\-P\. 2004\.Survey of fraud detection techniques\.In*IEEE International Conference on Networking, Sensing and Control, 2004*, volume 2, 749–754 Vol\.2\.
- Lannoo and Parlour \(2021\)Lannoo, K\.; and Parlour, R\. 2021\.Anti\-Money Laundering in the EU: Time to get serious\.Technical report, Centre for European Policy Studies\.
- Liang et al\. \(2025\)Liang, S\.; Xie, Q\.; Feng, J\.; Yue, Y\.; Li, H\.; Ye, J\.; and Jie, W\. 2025\.Feature Reconstruction for Anomaly Detection on Directed Multigraphs: A Preprocessing Framework for GNNs\.In*Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V\. 2*, 1707–1717\.
- Lin et al\. \(2024\)Lin, J\.; Guo, X\.; Zhu, Y\.; Mitchell, S\.; Altman, E\.; and Shun, J\. 2024\.FraudGT: a simple, effective, and efficient graph transformer for financial fraud detection\.In*Proceedings of the 5th ACM International Conference on AI in Finance*, 292–300\.
- Liu, Hooi, and Faloutsos \(2018\)Liu, S\.; Hooi, B\.; and Faloutsos, C\. 2018\.A contrast metric for fraud detection in rich graphs\.*IEEE Transactions on Knowledge and Data Engineering*, 31\(12\): 2235–2248\.
- Liu et al\. \(2021\)Liu, Y\.; Ao, X\.; Qin, Z\.; Chi, J\.; Feng, J\.; Yang, H\.; and He, Q\. 2021\.Pick and choose: a GNN\-based imbalanced learning approach for fraud detection\.In*Proceedings of the web conference 2021*, 3168–3177\.
- Paoletti et al\. \(2025\)Paoletti, G\.; Giobergia, F\.; Giordano, D\.; Cagliero, L\.; Ronchiadin, S\.; Moncalvo, D\.; Mellia, M\.; and Baralis, E\. 2025\.MAD: Multicriteria Anomaly Detection of Suspicious Financial Accounts from Billions of Cash Transactions\.In*Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V\. 2*, 4751–4760\.
- Rees et al\. \(2022\)Rees, B\.; Wang, X\.; Eaton, J\.; Yilmaz, O\.; Ratzel, R\.; and LaSalle, D\. 2022\.Accelerated GNN training with DGL and RAPIDS cuGraph in a Fraud Detection Workflow\.In*Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining*, 4820–4821\.
- Saldaña\-Ulloa, De Ita Luna, and Marcial\-Romero \(2024\)Saldaña\-Ulloa, D\.; De Ita Luna, G\.; and Marcial\-Romero, J\. R\. 2024\.A Temporal Graph Network Algorithm for Detecting Fraudulent Transactions on Online Payment Platforms\.*Algorithms*, 17\(12\): 552\.
- Sato, Yamada, and Kashima \(2019\)Sato, R\.; Yamada, M\.; and Kashima, H\. 2019\.Approximation ratios of graph neural networks for combinatorial problems\.*Advances in Neural Information Processing Systems*, 32\.
- Schlichtkrull et al\. \(2018\)Schlichtkrull, M\.; Kipf, T\. N\.; Bloem, P\.; Van Den Berg, R\.; Titov, I\.; and Welling, M\. 2018\.Modeling relational data with graph convolutional networks\.In*European semantic web conference*, 593–607\. Springer\.
- Schmidt et al\. \(2024\)Schmidt, J\.; Pasadakis, D\.; Sathe, M\.; and Schenk, O\. 2024\.GAMLNet: a graph based framework for the detection of money laundering\.In*2024 11th IEEE Swiss Conference on Data Science \(SDS\)*, 241–245\. IEEE\.
- Shi et al\. \(2021\)Shi, Y\.; Huang, Z\.; Feng, S\.; Zhong, H\.; Wang, W\.; and Sun, Y\. 2021\.Masked Label Prediction: Unified Message Passing Model for Semi\-Supervised Classification\.In Zhou, Z\., ed\.,*Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence, IJCAI 2021, Virtual Event / Montreal, Canada, 19\-27 August 2021*, 1548–1554\. ijcai\.org\.
- Sun et al\. \(2026\)Sun, J\.; Chang, W\.; Yang, C\.; Huang, Q\.; and Wang, S\. 2026\.Relieving the Over\-Aggregating Effect in Graph Transformers\.*Advances in Neural Information Processing Systems*, 38: 6673–6699\.
- Suzumura and Kanezashi \(2021\)Suzumura, T\.; and Kanezashi, H\. 2021\.Anti\-Money Laundering Datasets: InPlusLab Anti\-Money Laundering DataDatasets\.http://github\.com/IBM/AMLSim/\.
- United Nations Office on Drugs and Crime \(2011\)United Nations Office on Drugs and Crime\. 2011\.Estimating Illicit Financial Flows Resulting from Drug Trafficking and Other Transnational Organized Crimes\.Technical report, UNODC\.Global money laundering estimates: 2\-5% of global GDP\.
- Velickovic et al\. \(2018\)Velickovic, P\.; Cucurull, G\.; Casanova, A\.; Romero, A\.; Liò, P\.; and Bengio, Y\. 2018\.Graph Attention Networks\.In*6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 \- May 3, 2018, Conference Track Proceedings*\. OpenReview\.net\.
- Wu, He, and Xu \(2019\)Wu, J\.; He, J\.; and Xu, J\. 2019\.Net: Degree\-specific graph neural networks for node and graph classification\.In*Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining*, 406–415\.
- Wu et al\. \(2022\)Wu, Q\.; Zhao, W\.; Li, Z\.; Wipf, D\. P\.; and Yan, J\. 2022\.Nodeformer: A scalable graph structure learning transformer for node classification\.*Advances in neural information processing systems*, 35: 27387–27401\.
- Xu et al\. \(2019\)Xu, K\.; Hu, W\.; Leskovec, J\.; and Jegelka, S\. 2019\.How Powerful are Graph Neural Networks?In*7th International Conference on Learning Representations, ICLR 2019, New Orleans, LA, USA, May 6\-9, 2019*\. OpenReview\.net\.
- Yang et al\. \(2025\)Yang, C\.; Liu, H\.; Wang, D\.; Zhang, Z\.; Yang, C\.; and Shi, C\. 2025\.Flag: Fraud detection with llm\-enhanced graph neural network\.In*Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V\. 2*, 5150–5160\.
- You et al\. \(2021\)You, J\.; Gomes\-Selman, J\. M\.; Ying, R\.; and Leskovec, J\. 2021\.Identity\-aware graph neural networks\.In*Proceedings of the AAAI conference on artificial intelligence*, volume 35, 10737–10745\.
- Zhang and Xie \(2021\)Zhang, S\.; and Xie, L\. 2021\.Improving attention mechanism in graph neural networks via cardinality preservation\.In*Proceedings of the Twenty\-Ninth International Joint Conference on Artificial Intelligence*, IJCAI’20\.ISBN 9780999241165\.

## Appendix AMoney Laundering Known Patterns

![Refer to caption](https://arxiv.org/html/2607.10131v1/figures/MoneyLaunderingPatterns.png)Figure 3:Canonical money laundering patterns observed in AML datasets\. The blue node denotes the main laundering account; depending on the task, all nodes and transactions involved in the pattern are typically labeled as fraudulent\.
## Appendix BDegree\-Stratified Evaluation

Figure[4](https://arxiv.org/html/2607.10131#A2.F4)illustrates the recipient\-degree stratified evaluation protocol, which reorganizes a single aggregate metric into a breakdown by the volume of incoming transactions per node \(account\)\.

![Refer to caption](https://arxiv.org/html/2607.10131v1/figures/degree-stratified-eval.png)Figure 4:Degree\-stratified evaluation: from an overall metric to a breakdown by the volume of incoming transactions per node \(account\)\.
## Appendix CFull AMLSim Degree\-Stratified Results

The complete degree\-stratified F1 results on AMLSim\-32k\-5% are reported in Table[12](https://arxiv.org/html/2607.10131#A6.T12), presented together with the corresponding PR\-AUC breakdown in the Threshold\-Free Metric section below, so that the two large AMLSim tables can be read side by side\.

## Appendix DEffective Number of Neighbors Diagnostics

For completeness, we report entropy\-based attention\-spread diagnostics\. For a nodeiiat layerℓ\\ell, let𝜶i\(ℓ\)\\boldsymbol\{\\alpha\}\_\{i\}^\{\(\\ell\)\}be the normalized attention vector over its incoming neighbors\. We compute

H​\(𝜶i\(ℓ\)\)\\displaystyle H\(\\boldsymbol\{\\alpha\}\_\{i\}^\{\(\\ell\)\}\)=−∑jαi​j\(ℓ\)​log⁡αi​j\(ℓ\),\\displaystyle=\-\\sum\_\{j\}\\alpha\_\{ij\}^\{\(\\ell\)\}\\log\\alpha\_\{ij\}^\{\(\\ell\)\},ENNs​\(𝜶i\(ℓ\)\)\\displaystyle\\mathrm\{ENNs\}\(\\boldsymbol\{\\alpha\}\_\{i\}^\{\(\\ell\)\}\)=exp⁡\(H​\(𝜶i\(ℓ\)\)\)\.\\displaystyle=\\exp\\\!\\big\(H\(\\boldsymbol\{\\alpha\}\_\{i\}^\{\(\\ell\)\}\)\\big\)\.Uniform attention givesENNs=di\\mathrm\{ENNs\}=d\_\{i\}, while single\-neighbor concentration givesENNs=1\\mathrm\{ENNs\}=1\. ENNs measures attention spread, not ranking correctness; the main paper therefore uses Hit@20 as the primary attention\-preservation diagnostic\.

Table 7:Attention diagnostics on HI\-Small: mean \(5 seeds\) Effective Number of Neighbors \(ENNs\\mathrm\{ENNs\}\) at the first \(L0\) and second \(L1\) hop, computed asENNs=exp⁡\(H\)\\mathrm\{ENNs\}=\\exp\(H\)withHHthe Shannon entropy\. Uniform attention givesENNs=d\\mathrm\{ENNs\}=d\(degree\); single\-neighbor focus givesENNs=1\\mathrm\{ENNs\}=1\.
## Appendix EStatistical Significance Tests

We test whether each SALT variant outperforms the relevant baselines beyond seed variability, on two contrasts per benchmark \(overall performance and the densest populated degree bin\) and, for the IBM datasets, on both F1 score and PR\-AUC\. Besides the strongest baseline, we also test against PNAGMDA, the closest dual\-branch precedent, to isolate per\-layer from prediction\-time fusion\. The test matches each benchmark’s design\. On AMLSim, runs are paired by split×\\timesseed \(identical graph\), so we use an exact paired permutation test \(n=15n=15; Table[9](https://arxiv.org/html/2607.10131#A5.T9)\)\. On HI\-Small we use an exact two\-sample permutation test \(n=5n=5\)\. On HI\-Medium \(n=3n=3\) the permutation null admits only\(63\)=20\\binom\{6\}\{3\}=20assignments, lower\-bounding the two\-sidedppat0\.100\.10; we therefore use a two\-sided Welch’stt\-test, which retains power at smallnn\(Table[8](https://arxiv.org/html/2607.10131#A5.T8)\)\. Within each family of related tests we apply Holm correction and reportpHolmp\_\{\\text\{Holm\}\}; the markers∗\\ast\(p<0\.05p<0\.05\) and†\\dagger\(p<0\.10p<0\.10\) in the main tables refer to these corrected values\. Given the small seed counts on the IBM datasets, we report effect sizes \(Δ\\Delta\) alongsidepp\-values and treat those tests as indicative\.

Table 8:Statistical significance of SALT variants against the strongest baselines on HI\-Small and HI\-Medium\. We test two contrasts \(overall and the densest*populated*degree bin: deg\[50–99\] for HI\-Small, deg\[100\+\] for HI\-Medium\) on F1 score and PR\-AUC\. HI\-Small \(n=5n=5\): exact two\-sample permutation test\. HI\-Medium \(n=3n=3\): two\-sided Welch’stt\-test, since the permutation null admits only\(63\)=20\\binom\{6\}\{3\}=20assignments \(minimum two\-sidedp=0\.10p=0\.10\)\.Δ\\Deltais the mean difference \(SALT−\-baseline\)\.pHolmp\_\{\\text\{Holm\}\}applies Holm correction within each family of four tests \(the two contrasts×\\timestwo metrics for a given SALT variant, baseline, and dataset\)\.∗\\astp<0\.05p<0\.05,†\\daggerp<0\.10p<0\.10\(onpHolmp\_\{\\text\{Holm\}\}\)\. Effect sizes are reported alongsidepp\-values; given the small seed counts, tests are indicative\.Table 9:Statistical significance on AMLSim\-32k\-5% \(node classification\)\. Runs are paired by split×\\timesseed \(same train/val/test graph\), so we use an exact paired permutation test \(sign\-flip,n=15n=15paired runs\)\. We report overall F1 score, the aggregated high\-degree regime \(deg\[100\+\]\), and the extreme bin \(deg\[2000–4732\]\), against the strongest attention baseline \(GAT\) and against PNAGMDA \(per\-layer vs\. prediction\-time fusion\)\. The deg\[100\+\] contrast pools all test predictions with recipient degree at least 100 and is not the arithmetic mean of the degree\-bin F1 scores\.Δ\\Deltais the mean paired difference \(SALT−\-baseline\)\.pHolmp\_\{\\text\{Holm\}\}is Holm\-corrected within each variant–baseline family\.∗\\astp<0\.05p<0\.05,†\\daggerp<0\.10p<0\.10\(onpHolmp\_\{\\text\{Holm\}\}\)\.Across the three benchmarks, the evidence is strongest on AMLSim, where the paired design yields full statistical power: both SALT variants significantly outperform GAT and PNAGMDA overall and in the high\-degree regime \(pHolm<0\.001p\_\{\\text\{Holm\}\}<0\.001for all but the SALT\-Trans extreme\-bin contrast, which reachespHolm=0\.062p\_\{\\text\{Holm\}\}=0\.062\)\. The contrast with PNAGMDA in the extreme bin is the sharpest: PNAGMDA collapses to0\.0440\.044while both SALT variants exceed0\.730\.73\(Δ\>0\.68\\Delta\>0\.68,pHolm<0\.001p\_\{\\text\{Holm\}\}<0\.001\), directly supporting per\-layer over prediction\-time fusion\. On HI\-Small, SALT\-Trans significantly outperforms PNAGMDA on every contrast after correction \(overall F1 score, overall PR\-AUC, and dense\-bin F1 score/PR\-AUC;pHolm=0\.032p\_\{\\text\{Holm\}\}=0\.032for all four\) and FraudGT on overall PR\-AUC \(pHolm=0\.032p\_\{\\text\{Holm\}\}=0\.032\); On HI\-Medium, SALT\-Trans significantly outperforms TransConv\-84k overall \(F1 score and PR\-AUC,pHolm=0\.024p\_\{\\text\{Holm\}\}=0\.024\) and in deg\[100\+\] F1 score \(pHolm=0\.043p\_\{\\text\{Holm\}\}=0\.043\)\. Several dense\-bin contrasts on the IBM datasets do not reach significance after correction: this is expected, as their high\-degree bins contain very few positive examples \(see the Fraud Distribution Across Degree Bins section\), inflating variance and reducing power\. We therefore emphasize effect sizes alongsidepp\-values, and note that the consistent direction and magnitude of the gains across all three benchmarks is the central evidence, with formal significance strongest where the data permit it\.

## Appendix FThreshold\-Free Metric: PR\-AUC

Because F1 score depends on the decision threshold \(fixed to0\.50\.5in the main paper for consistency with prior AML work and across degree bins\), we additionally report threshold\-free PR\-AUC on HI\-Small\. Table[10](https://arxiv.org/html/2607.10131#A6.T10)shows the same ordering as the F1 score results: SALT\-Trans attains the best overall PR\-AUC \(0\.7020\.702\), while SALT\-GAT attains the best dense\-bin PR\-AUC \(0\.7300\.730in deg\[50–99\]\), both improving over FraudGT and the TransConv configurations\. We additionally report degree\-stratified PR\-AUC on HI\-Medium \(Table[11](https://arxiv.org/html/2607.10131#A6.T11)\) and AMLSim\-32k\-5% \(Table[13](https://arxiv.org/html/2607.10131#A6.T13)\), computed from the same checkpoints used for the F1 score results\. The threshold\-free ordering matches the F1 score analysis on both: on HI\-Medium, SALT\-GAT and SALT\-Trans attain the best overall PR\-AUC \(0\.6990\.699\) and lead in the densest populated bin \(deg\[100\+\],0\.6840\.684/0\.6830\.683\); on AMLSim, both variants are best overall \(0\.8240\.824/0\.8260\.826\) and dominate the extreme\-degree tail \(deg\[2000–4732\],0\.8320\.832/0\.7070\.707\)\. On HI\-Medium, where the densest populated bin \(deg\[100\+\]\) is only at moderate density, PNAGMDA remains competitive in PR\-AUC \(0\.6720\.672in deg\[100\+\]\); this is consistent with our claim that late fusion degrades specifically in the extreme\-density regime, which among our benchmarks is reached only on AMLSim, where PNAGMDA collapses to0\.0740\.074PR\-AUC while SALT exceeds0\.700\.70\.

Table 10:PR\-AUC on HI\-Small test, stratified by degree \(mean±\\pmstd, 5 seeds\);boldmarks best andunderlinedsecond best\.Table 11:PR\-AUC on Medium\-HI dataset, stratified by degree \(mean±\\pmstd, 3 seeds\);boldmarks best andunderlinedsecond best\.Table 12:F1 score on AMLSim dataset\(Schmidt et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib27)\), stratified by degree \(mean±\\pmstd, 5 seeds, 3 splits\);boldmarks best andunderlinedsecond best\.∗\\ast/†\\daggerin the extreme\-degree bin denote a SALT variant significantly better than the strongest attention baseline \(GAT\) atp<0\.05p<0\.05/p<0\.10p<0\.10after Holm correction; the full set of significant contrasts \(overall and high\-degree, vs\. GAT and PNAGMDA\) is reported in the Statistical Significance Tests section of this supplement\.Table 13:PR\-AUC on AMLSim dataset\(Schmidt et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib27)\), stratified by degree \(mean±\\pmstd across split means, 5 seeds, 3 splits\);boldmarks best andunderlinedsecond best\.Table 14:Characteristic\-level ablation on HI\-Small, full F1 score / PR\-AUC \(mean±\\pmstd, 5 seeds\)\. Symbols as in the characteristic\-level ablation table of the main paper\.ModelC1C2C3deg\[50–99\]overallSALT\-Trans \(full\)✓✓✓0\.741±0\.019/0\.723±0\.0390\.741\\pm 0\.019/0\.723\\pm 0\.0390\.716±0\.018/0\.700±0\.0140\.716\\pm 0\.018/0\.700\\pm 0\.014↪\\hookrightarrowmean\+std only∘\\circ✓✓0\.720±0\.042/0\.703±0\.0650\.720\\pm 0\.042/0\.703\\pm 0\.0650\.712±0\.004/0\.674±0\.0130\.712\\pm 0\.004/0\.674\\pm 0\.013↪\\hookrightarrowmean only×\\times✓✓0\.636±0\.065/0\.613±0\.0790\.636\\pm 0\.065/0\.613\\pm 0\.0790\.690±0\.020/0\.665±0\.0210\.690\\pm 0\.020/0\.665\\pm 0\.021↪\\hookrightarrowno degree✓×\\times✓0\.616±0\.103/0\.585±0\.1050\.616\\pm 0\.103/0\.585\\pm 0\.1050\.713±0\.013/0\.667±0\.0150\.713\\pm 0\.013/0\.667\\pm 0\.015↪\\hookrightarrowno statistics×\\times×\\times∘\\circ0\.637±0\.032/0\.589±0\.0310\.637\\pm 0\.032/0\.589\\pm 0\.0310\.698±0\.016/0\.669±0\.0170\.698\\pm 0\.016/0\.669\\pm 0\.017PNA\(ref\.\)✓✓×\\times0\.515±0\.099/0\.495±0\.1020\.515\\pm 0\.099/0\.495\\pm 0\.1020\.629±0\.032/0\.559±0\.0490\.629\\pm 0\.032/0\.559\\pm 0\.049TransConv\(ref\.\)×\\times×\\times∘\\circ0\.615±0\.018/0\.585±0\.0760\.615\\pm 0\.018/0\.585\\pm 0\.0760\.645±0\.031/0\.629±0\.0300\.645\\pm 0\.031/0\.629\\pm 0\.030
## Appendix GBaseline Tuning Robustness

A natural concern is whether the dense\-region gap between SALT and the attention baselines is an artifact of insufficient baseline tuning\. We address this with three additional studies on HI\-Small\.

#### Dense\-bin tuning of TransConv and FraudGT\.

We re\-tuned TransConv by selecting on densest\-bin validation F1 score rather than overall validation F1 score\. The best configuration reached0\.7080\.708on deg\[50–99\] validation \(lr=0\.005=0\.005, hidden=64=64, class weight=6\.156=6\.156, dropout=0\.131=0\.131\), but only0\.570±0\.0240\.570\\pm 0\.024on the deg\[50–99\] test set and0\.604±0\.0170\.604\\pm 0\.017overall, still well below SALT\-Trans\. FraudGT showed the same trend\. On AMLSim, tuning over the dense tail \(the last bin had too few positives to tune on directly\) yielded F1 score of0\.638/0\.503/0\.514/0\.771/0\.5330\.638/0\.503/0\.514/0\.771/0\.533from deg\[100–199\] to deg\[2000–4732\]: mixed and, on aggregate, below the SALT variants evaluated against the globally tuned TransConv\. Tuning the baselines specifically for dense bins therefore does not close the gap\.

#### Attention\-temperature scaling\.

We also tested whether manually forcing TransConv to spread its attention wider \(via softmax temperature scaling\) resolves its dense\-bin failure\. It does not, and broader attention does not monotonically improve dense\-bin F1 score: at temperature44, TransConv reached0\.443±0\.0980\.443\\pm 0\.098on deg\[50–99\] and0\.599±0\.0080\.599\\pm 0\.008overall; at temperature22,0\.455±0\.2140\.455\\pm 0\.214and0\.673±0\.0120\.673\\pm 0\.012\. This supports our reading of theENNs\\mathrm\{ENNs\}diagnostics: the problem is not the raw spread of attention but whether weak fraud\-relevant evidence is preserved\.

#### Parameter\-matched ablation\.

Finally, to rule out model size as the explanation, we evaluated a TransConv reduced to≈\\approx40k parameters \(matching SALT\)\. It reached overall F1 score0\.624±0\.0170\.624\\pm 0\.017and0\.544±0\.0480\.544\\pm 0\.048on deg\[50–99\], confirming that SALT’s gains are not explained by parameter count alone\.

## Appendix HFinal Residual\-Step Ablation

The final update averages the previous state and the fusion output,𝐡v\(k\)=\(𝐡v\(k−1\)\+𝐡v,fusion\(k\)\)/2\\mathbf\{h\}\_\{v\}^\{\(k\)\}=\(\\mathbf\{h\}\_\{v\}^\{\(k\-1\)\}\+\\mathbf\{h\}\_\{v,\\mathrm\{fusion\}\}^\{\(k\)\}\)/2\. We keep this residual integration consistent with other AML GNNs so that gains cannot be attributed to removing the usual residual step\. Removing the final residual \(using𝐡v\(k\)=𝐡v,fusion\(k\)\\mathbf\{h\}\_\{v\}^\{\(k\)\}=\\mathbf\{h\}\_\{v,\\mathrm\{fusion\}\}^\{\(k\)\}directly\) on HI\-Small slightly destabilizes training and reduces dense\-bin F1 score, while the per\-layer fusion remains the dominant source of the dense\-region improvement; the previous\-state term in the concatenation𝐳v\(k\)\\mathbf\{z\}\_\{v\}^\{\(k\)\}is what supplies the fusion MLP with context, not the residual averaging alone\.

## Appendix IHyperparameter Configuration

All models are trained with the Adam optimizer\. Unless otherwise stated, the optimization objective is the F1 score of the minority \(fraudulent\) class on the validation set\. Table[15](https://arxiv.org/html/2607.10131#A9.T15)summarizes, for each model and dataset, whether the configuration was*reused*from prior work,*tuned by us*, or*selected via full grid search*\.

Table 15:Provenance of hyperparameter configurations\. Reused: published tuned configs adopted as\-is; Tuned: tuned by us over the ranges below; Grid: full grid search with the ranges below\.### HI\-Small and HI\-Medium

Both HI\-Small and HI\-Medium adopt a*strictly temporal split*: transactions are ordered by timestamp and partitioned into non\-overlapping training, validation, and test intervals\. Consequently, the data distribution \(including fraud distribution across degree bins\) is fixed and identical across runs and seeds\.

For these benchmarks, we followed standard practice in prior AML work and reused the published baseline configurations consistently adopted across these datasets\(Altman et al\.[2023](https://arxiv.org/html/2607.10131#bib.bib1); Lin et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib19); Egressy et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib10); Bilgi, Chen, and Atasu[2024](https://arxiv.org/html/2607.10131#bib.bib3)\), rather than introducing a new full re\-tuning pipeline for already\-established baselines\. A full grid search at this scale is impractical: a conservative grid \(4 learning rates, 2 depths, 3 hidden sizes, 3 dropouts, 3 class weights\) would require\>\>2000 GPU\-hours on HI\-Small and\>\>13000 on HI\-Medium on a single RTX A6000, which is precisely why prior AML\-GNN work reuses published tuned configs\. The reference search ranges are:

Models evaluated\.

- •PNA, GIN, GAT
- •TransConv \(84k parameters, hidden size6464\)
- •TransConv \(318k parameters, hidden size128128\)
- •FraudGT, PNAGMDA
- •SALT\-GAT, SALT\-Trans

TransConv configurations\.Since no canonical tuned configuration exists for these IBM benchmarks, we tuned TransConv ourselves\. We fixed the depth to 2 layers, in line with all baselines on these datasets, to test whether the degradation is mainly a width/capacity issue rather than a full model\-selection effect\. TransConv inherits the same architectural hyperparameters as the GAT tuned byAltman et al\. \([2023](https://arxiv.org/html/2607.10131#bib.bib1)\)\(number of heads and dropout\), which are consistent with those found byLin et al\. \([2024](https://arxiv.org/html/2607.10131#bib.bib19)\)for FraudGT, differing only in the attention operator and learning rate\. After a coarse search, we fine\-tuned the learning rate∈\{0\.006,0\.005,0\.003,0\.002,0\.001,0\.0005\}\\in\\\{0\.006,0\.005,0\.003,0\.002,0\.001,0\.0005\\\}for hidden sizes 64 and 128:

- •84k parameters: hidden dimension6464;
- •318k parameters: hidden dimension128128\.

SALT variants and PNAGMDA\.SALT\-GAT inherits all PNA hyperparameters \(depth, hidden size, aggregation, normalization, loss weighting\)\. SALT\-Trans is identical to PNA in all hyperparameters, with the learning rate fixed to0\.0010\.001\. PNAGMDA reuses the SALT\-GAT backbone hyperparameters\. SALT performs no model\-specific tuning, so performance differences are attributable to architectural design rather than additional tuning advantages\.

Final HI\-Small / HI\-Medium configurations\.All models use the Adam optimizer, cross\-entropy loss with positive\-class weightww, z\-normalization,22GNN layers, and a single MLP layer; both datasets share the same configuration per model\. The two TransConv variants differ only in hidden size \(6464vs\.128128\), as noted above\.

- •GIN:lr=0\.0062=0\.0062,F=64F=64,w=6w=6, dropout=0\.010=0\.010, final dropout=0\.105=0\.105\.
- •PNA:lr=0\.0006=0\.0006,F=20F=20,w=7w=7, dropout=0\.083=0\.083, final dropout=0\.288=0\.288\.
- •GAT:lr=0\.006=0\.006,F=64F=64,H=4H=4,w=6w=6, dropout=0\.009=0\.009, final dropout=0\.1=0\.1\.
- •TransConv \(84k\):lr=0\.001=0\.001,F=64F=64,H=4H=4,w=6w=6, dropout=0\.009=0\.009, final dropout=0\.1=0\.1\.
- •TransConv \(318k\):as above, withF=128F=128\.
- •FraudGT:lr=0\.001=0\.001\(AdamW, cosine schedule with55warmup epochs, weight decay10−510^\{\-5\}\),F=64F=64,H=8H=8,w=6w=6,22transformer layers \(\+2\+2post\-GT layers\), transformer dropout=0\.2=0\.2, attention dropout=0\.3=0\.3; edge\-masked sparse\-node attention with layer norm and GELU\.
- •SALT\-GAT:lr=0\.0006=0\.0006,F=20F=20,w=7w=7, dropout=0\.083=0\.083, final dropout=0\.288=0\.288\.
- •SALT\-Trans:lr=0\.0012=0\.0012,F=20F=20,w=7w=7, dropout=0\.083=0\.083, final dropout=0\.288=0\.288\.
- •PNAGMDA:lr=0\.0006=0\.0006,F=20F=20,w=7w=7, dropout=0\.083=0\.083, final dropout=0\.288=0\.288\.

### AMLSim dataset

Hyperparameter search\.For models not already optimized in prior work, we perform a grid search over:

- •learning rate∈\{0\.01,0\.005,0\.001\}\\in\\\{0\.01,0\.005,0\.001\\\};
- •number of layersK∈\{2,3,4,5,6\}K\\in\\\{2,3,4,5,6\\\};
- •hidden dimensionF∈\{8,16,32,64\}F\\in\\\{8,16,32,64\\\};
- •class\-weight parameterw∈\{0\.26,0\.44,0\.79,0\.96\}w\\in\\\{0\.26,0\.44,0\.79,0\.96\\\};
- •heads∈\{2,4,8\}\\in\\\{2,4,8\\\}when applicable \(GAT/TransConv\);
- •attention dropout∈\{0\.0,0\.1,0\.2,0\.3\}\\in\\\{0\.0,0\.1,0\.2,0\.3\\\}when applicable\.

Each configuration is evaluated over multiple seeds; the best model is selected by validation F1 score\.

Final AMLSim configurations\.

- •GAMLNet:lr=0\.01=0\.01,w=0\.44w=0\.44,K1=2,K2=6K\_\{1\}=2,\\ K\_\{2\}=6,F1=8,F2=64F\_\{1\}=8,\\ F\_\{2\}=64\(GIN and GraphSAGE components\)\.
- •GIN:lr=0\.01=0\.01,w=0\.44w=0\.44,K=1K=1,F=8F=8\.
- •GCN:lr=0\.01=0\.01,w=0\.44w=0\.44,K=3K=3,F=32F=32\.
- •GAT:lr=0\.01=0\.01,w=0\.79w=0\.79,K=2K=2,F=64F=64,H=2H=2, dropout=0\.0=0\.0\.
- •TransConv:lr=0\.005=0\.005,w=0\.44w=0\.44,K=3K=3,F=64F=64,H=2H=2, dropout=0\.3=0\.3\.
- •PNA:lr=0\.005=0\.005,w=0\.96w=0\.96,K=2K=2,F=20F=20\.
- •SALT\-GAT:lr=0\.005=0\.005,w=0\.79w=0\.79,K=2K=2,F=40F=40, dropout=0\.0=0\.0\.
- •SALT\-Trans:lr=0\.005=0\.005,w=0\.44w=0\.44,K=2K=2,F=40F=40, dropout=0\.3=0\.3\.

Prior works on AMLSim adopt a*random split*\. Random partitioning can yield degenerate splits in which some degree bins \(especially dense ones\) contain no fraudulent examples in train/val/test, biasing the evaluation\. We apply a pre\-defined validity filter to avoid degenerate random splits where the target degree\-stratified metric is undefined:

- •all degree bins, including the densest, contain fraudulent examples in train, validation, and test;
- •each split contains, in each bin, at least one recognizable fraud pattern, i\.e\., patterns provably detectable by vanilla GNNs without reverse message passing, ports, or ego identifiers\(Egressy et al\.[2024](https://arxiv.org/html/2607.10131#bib.bib10)\), such as cycles, fan\-in, scatter\-gather, and gather\-scatter\.

All AMLSim results are averaged over these three splits\.

## Appendix JFraud Distribution Across Degree Bins

For HI\-Small and HI\-Medium, the split is*strictly temporal*; the fraud distribution is therefore fixed and identical across runs and seeds\. Tables[16](https://arxiv.org/html/2607.10131#A10.T16),[17](https://arxiv.org/html/2607.10131#A10.T17), and[18](https://arxiv.org/html/2607.10131#A10.T18)report the fraud distribution across in\-degree bins\. Both datasets concentrate fraudulent activity in medium\-to\-high degree bins, underscoring the importance of handling dense neighborhoods where legitimate and illicit transactions are tightly interwoven\.

Table 16:Agent\-based fraud distribution across degree bins for HI\-Small\.Table 17:Complete in\-degree binning analysis across all splits on HI\-Small\.Table 18:Complete in\-degree binning analysis across all splits on HI\-Medium\.
## Appendix KTime Performance

![Refer to caption](https://arxiv.org/html/2607.10131v1/figures/TimeEpoch.png)Figure 5:Average training time per epoch for HI\-Small on a single NVIDIA RTX A6000 with batch size8,1928\{,\}192and 100 neighbors per hop\.Despite its hybrid design, SALT exhibits a training cost comparable to PNA and substantially lower than high\-capacity TransformerConv models, confirming that improved detection performance does not come at the expense of prohibitive computational overhead\.

## Appendix LAlgorithms

For completeness, we provide pseudocode for the two procedures referenced in the main paper\. Algorithm[1](https://arxiv.org/html/2607.10131#alg1)details the recipient\-degree stratified evaluation protocol, and Algorithm[2](https://arxiv.org/html/2607.10131#alg2)details the layer\-wise SALT\-GNN forward pass\.

Algorithm 1Degree\-Stratified Evaluation0:Graph

𝒢=\(𝒱,ℰ\)\\mathcal\{G\}=\(\\mathcal\{V\},\\mathcal\{E\}\); trained model

ff; bin edges

ℬ=\{b0,b1,…\}\\mathcal\{B\}=\\\{b\_\{0\},b\_\{1\},\\ldots\\\}\(log\-spaced\); task

τ∈\{node,edge\}\\tau\\in\\\{\\text\{node\},\\text\{edge\}\\\}
0:Per\-bin scores

\{F​1b\}\\\{F1\_\{b\}\\\}; \(attention models\)

\{ENNsb\(ℓ\),Hit​@​kb\}\\\{\\mathrm\{ENNs\}\_\{b\}^\{\(\\ell\)\},\\mathrm\{Hit@\}k\_\{b\}\\\}
1:Initialize empty prediction set

Pb←∅P\_\{b\}\\leftarrow\\emptysetfor each bin

bb
2:for alltarget

tt\(node

vvor transaction

\(u,v\)\(u,v\)\) in the test setdo

3:

v←tv\\leftarrow tif

τ=node\\tau=\\text\{node\}else receiver of

tt\{receiver aggregates incoming evidence\}

4:

dv←\|𝒩in​\(v\)\|d\_\{v\}\\leftarrow\|\\mathcal\{N\}\_\{\\text\{in\}\}\(v\)\|
5:

b←Bin​\(dv,ℬ\)b\\leftarrow\\textsc\{Bin\}\(d\_\{v\},\\mathcal\{B\}\)
6:

Pb←Pb∪\{\(f​\(t\),yt\)\}P\_\{b\}\\leftarrow P\_\{b\}\\cup\\\{\(f\(t\),y\_\{t\}\)\\\}\{store \(prediction, label\)\}

7:endfor

8:for allbin

bbdo

9:

F​1b←F1​\(Pb\)F1\_\{b\}\\leftarrow\\textsc\{F1\}\(P\_\{b\}\)at threshold

0\.50\.5
10:endfor

11:if

ffuses attentionthen

12:for allnode

ii, layer

ℓ\\elldo

13:

𝜶i\(ℓ\)←\\boldsymbol\{\\alpha\}\_\{i\}^\{\(\\ell\)\}\\leftarrowattention weights over

𝒩​\(i\)\\mathcal\{N\}\(i\)
14:

H←−∑jαi​j\(ℓ\)​log⁡αi​j\(ℓ\)H\\leftarrow\-\\sum\_\{j\}\\alpha\_\{ij\}^\{\(\\ell\)\}\\log\\alpha\_\{ij\}^\{\(\\ell\)\}
15:

ENNsi\(ℓ\)←exp⁡\(H\)\\mathrm\{ENNs\}\_\{i\}^\{\(\\ell\)\}\\leftarrow\\exp\(H\)\{

=di=d\_\{i\}if uniform,

11if peaked\}

16:endfor

17:for allnode

iiwith

≥1\\geq 1fraudulent in\-neighbordo

18:

hiti←𝟏​\[∃fraud edge in top\-​k​of​𝜶i\]\\mathrm\{hit\}\_\{i\}\\leftarrow\\mathbf\{1\}\[\\exists\\text\{ fraud edge in top\-\}k\\text\{ of \}\\boldsymbol\{\\alpha\}\_\{i\}\]
19:endfor

20:Aggregate

ENNsb\(ℓ\)\\mathrm\{ENNs\}\_\{b\}^\{\(\\ell\)\},

Hit​@​kb\\mathrm\{Hit@\}k\_\{b\}per bin

bb
21:endif

22:return

\{F​1b\}\\\{F1\_\{b\}\\\}and attention diagnostics

Algorithm 2SALT\-GNN Layer\-wise Forward Pass0:Graph

𝒢\\mathcal\{G\}; edge features

𝐞\\mathbf\{e\}; input features

𝐡v\(0\)\\mathbf\{h\}\_\{v\}^\{\(0\)\}; layers

KK; aggregators

𝒜=\{μ,σ,min,max\}\\mathcal\{A\}=\\\{\\mu,\\sigma,\\min,\\max\\\}; degree scalers

𝒮\\mathcal\{S\}
0:Final node embeddings

𝐡v\(K\)\\mathbf\{h\}\_\{v\}^\{\(K\)\}
1:for

k=1k=1to

KKdo

2:for allnode

v∈𝒱v\\in\\mathcal\{V\}do

3:// Statistical channel \(Characteristics 1–2\)

4:

𝐚v←⨁s∈𝒮⨁agg∈𝒜s​\(dv\)⋅agg​\(\{𝐡u\(k−1\):u∈𝒩v\}\)\\mathbf\{a\}\_\{v\}\\leftarrow\\bigoplus\_\{s\\in\\mathcal\{S\}\}\\bigoplus\_\{\\mathrm\{agg\}\\in\\mathcal\{A\}\}s\(d\_\{v\}\)\\cdot\\mathrm\{agg\}\\big\(\\\{\\mathbf\{h\}\_\{u\}^\{\(k\-1\)\}\\\!:u\\in\\mathcal\{N\}\_\{v\}\\\}\\big\)
5:

𝐡v,stat\(k\)←Ustat\(k\)​\(𝐡v\(k−1\)∥𝐚v\)\\mathbf\{h\}\_\{v,\\mathrm\{stat\}\}^\{\(k\)\}\\leftarrow\\mathrm\{U\}\_\{\\mathrm\{stat\}\}^\{\(k\)\}\\big\(\\mathbf\{h\}\_\{v\}^\{\(k\-1\)\}\\,\\\|\\,\\mathbf\{a\}\_\{v\}\\big\)
6:// Attention channel \(selectivity\)

7:

αv,u\(k\)←softmaxu∈𝒩v​\(score​\(𝐡v\(k−1\),𝐡u\(k−1\),𝐞v,u\)\)\\alpha\_\{v,u\}^\{\(k\)\}\\leftarrow\\mathrm\{softmax\}\_\{u\\in\\mathcal\{N\}\_\{v\}\}\\big\(\\text\{score\}\(\\mathbf\{h\}\_\{v\}^\{\(k\-1\)\},\\mathbf\{h\}\_\{u\}^\{\(k\-1\)\},\\mathbf\{e\}\_\{v,u\}\)\\big\)
8:

𝐡v,att\(k\)←∑u∈𝒩vαv,u\(k\)​\(𝐡u\(k−1\)\+𝐞v,u\)\\mathbf\{h\}\_\{v,\\mathrm\{att\}\}^\{\(k\)\}\\leftarrow\\sum\_\{u\\in\\mathcal\{N\}\_\{v\}\}\\alpha\_\{v,u\}^\{\(k\)\}\\big\(\\mathbf\{h\}\_\{u\}^\{\(k\-1\)\}\+\\mathbf\{e\}\_\{v,u\}\\big\)
9:// Layer\-wise fusion \(interaction during propagation\)

10:

𝐳v\(k\)←\[𝐡v,stat\(k\)​‖𝐡v,att\(k\)‖​𝐡v\(k−1\)\]\\mathbf\{z\}\_\{v\}^\{\(k\)\}\\leftarrow\\big\[\\mathbf\{h\}\_\{v,\\mathrm\{stat\}\}^\{\(k\)\}\\,\\\|\\,\\mathbf\{h\}\_\{v,\\mathrm\{att\}\}^\{\(k\)\}\\,\\\|\\,\\mathbf\{h\}\_\{v\}^\{\(k\-1\)\}\\big\]
11:

𝐡v,fusion\(k\)←MLPfusion\(k\)​\(𝐳v\(k\)\)\\mathbf\{h\}\_\{v,\\mathrm\{fusion\}\}^\{\(k\)\}\\leftarrow\\mathrm\{MLP\}\_\{\\mathrm\{fusion\}\}^\{\(k\)\}\\big\(\\mathbf\{z\}\_\{v\}^\{\(k\)\}\\big\)
12:

𝐡v\(k\)←\(𝐡v\(k−1\)\+𝐡v,fusion\(k\)\)/2\\mathbf\{h\}\_\{v\}^\{\(k\)\}\\leftarrow\\big\(\\mathbf\{h\}\_\{v\}^\{\(k\-1\)\}\+\\mathbf\{h\}\_\{v,\\mathrm\{fusion\}\}^\{\(k\)\}\\big\)/2
13:endfor

14:endfor

15:return

\{𝐡v\(K\)\}\\\{\\mathbf\{h\}\_\{v\}^\{\(K\)\}\\\}

## Appendix MControlled Synthetic Validation

The degree\-stratified results in the main paper are observational: they localize*where*GNNs degrade but cannot, on real data alone, attribute the degradation to a specific aggregation property\. To complement them, we build a small controlled testbed of synthetic transaction graphs with*planted ground truth*, in which each of the three characteristics analyzed in the main paper can be isolated and turned on or off\. All models are instantiated from a single backbone that differs only in the component under test \(statistical channel, attention operator, degree scalers, and per\-layer vs\. prediction\-time fusion\); every task includes a feature\-only floor \(a classifier with no graph access, expected at chance\) and an oracle that scores the planted rule \(the attainable ceiling\)\. The generators, models, and protocol are released with our code\.

#### Characteristics 1–2 \(multiset and cardinality\)\.

We construct two families of graphs\. In the*multiset*family, positive and negative accounts are built to share the same neighborhood mean while differing in the rest of the multiset, so that a single mean summary collapses them; in the*cardinality*family, all incoming transactions are made feature\-identical and only their*count*differs, so that a normalized aggregator cannot recover the signal\. Table[19](https://arxiv.org/html/2607.10131#A13.T19)reports the results\. A single mean aggregator and the feature\-only floor collapse to chance on both, whereas multi\-aggregation recovers the multiset signal and degree\-aware scaling recovers the cardinality signal\. The comparison is causal at the component level: removing only the degree scalers from SALT \(“SALT\-Trans−\-degree”\) reproduces the cardinality failure, while the full model matches the oracle\. Attention alone passes the multiset case \(it can emphasize extreme neighbors\) but, like the mean aggregator, remains blind to cardinality, mirroring the behavior of the attention baselines on dense real neighborhoods\.

Table 19:Controlled synthetic validation of Characteristics 1–2\. Candidate\-edge PR\-AUC \(↑\\uparrow;0\.50\.5= chance, oracle=1\.0=1\.0\), mean over seeds\.Boldmarks a model collapsing to chance on that axis\. “−\-degree” removes only the degree scalers from SALT \(a component\-level knockout\)\.
#### Characteristic 3 \(layer\-wise fusion and attention routing\)\.

The third characteristic concerns whether weak but pattern\-relevant evidence remains available to attention across hops\. A pure task\-accuracy separation is not the right test here: a PNA\-containing late\-fusion model can often solve an existence\-style synthetic label through its statistical branch, even if its attention branch never routes mass to the planted fraud\. We therefore measure the mechanism directly\.

We plant a two\-hop motif \(Fig\.[6](https://arxiv.org/html/2607.10131#A13.F6)\) in which a dense receiver collects fromD=40D=40mules\. Positive receivers hide one to three coordinated mules; negative receivers hide none\. A mule is coordinated only if its own upstream neighborhood has a high\-cardinality signature, so the cue is unavailable to the receiver’s attention at the first hop\. The graded probe edge asks whether the receiver contains any coordinated mule\. We report probe PR\-AUC only as a sanity check\. The C3 metric is the attention AUC over incoming mule edges on positive test receivers:0\.50\.5is random ranking and1\.01\.0means the coordinated mule is ranked above all legitimate mules\. We also report Hit@10, matching the main\-paper diagnostic\.

Table[20](https://arxiv.org/html/2607.10131#A13.T20)shows the result\. At L0 all attention models are random, because coordinated and legitimate mules have not yet incorporated their upstream statistics\. At L1, only per\-layer SALT routes attention to the planted fraud\. The strict causal control is*SALT\-Trans−\-per\-layer*, which keeps the same statistical and Transformer\-attention operators but moves fusion to prediction time; it still solves the probe label \(PR\-AUC0\.9950\.995\) yet its L1 attention remains random\. PNAGMDA, the external late\-fusion precedent, also solves the probe label but does not reliably route attention to the coordinated mules\. Thus the experiment does not claim a representational impossibility for late fusion; it isolates the mechanism SALT needs in dense AML graphs: statistical evidence must enter the state before the next attention step, not only at the final classifier\.

Table 20:Controlled C3 routing test on the planted two\-hop motif \(D=40D=40, 5 seeds\)\. Probe PR\-AUC confirms that late\-fusion statistical branches can solve the label; attention AUC and Hit@10 measure whether the receiver’s attention ranks the planted coordinated mule highly\. Only layer\-wise SALT moves the L1 attention from random ranking to perfect routing\.![Refer to caption](https://arxiv.org/html/2607.10131v1/figures/motif_A3.png)Figure 6:A constructed two\-hop fraud motif\. A receiver \(hub\) collects from many mules; a few*coordinated*mules \(red\) are the planted fraud, distinguishable only by a first\-hop statistic of their own upstream \(here, high cardinality\), while legitimate mules \(gray\) have a sparse upstream\. The fraud is rare among the neighbors, as on real high\-degree accounts\.![Refer to caption](https://arxiv.org/html/2607.10131v1/figures/results_A3.png)Figure 7:Hop\-resolved attention quality \(AUC of fraud vs\. legitimate mules ranked by attention;0\.50\.5= random\)\. All models are at chance at the first hop \(L0\); only per\-layer fusion \(SALT\) lifts the second\-hop \(L1\) attention onto the planted fraud\. Flipping SALT\-Trans to prediction\-time fusion \(knockout\) removes the lift\.