Payroll Fraud Detection in Synthetic HR/ERP Graphs: An Inductive Comparison of Rules, Path Features, and Graph Neural Networks

# Payroll Fraud Detection in Synthetic HR/ERP Graphs: An Inductive Comparison of Rules, Path Features, and Graph Neural Networks
Source: [https://arxiv.org/html/2610.41085](https://arxiv.org/html/2610.41085)
Genliang ZhuAffiliation:AccentrustAffiliation:Georgia Institute of TechnologyZiyuan WangAffiliation:Duke UniversityChu WangAffiliation:AccentrustAffiliation:University of Illinois Urbana\-Champaign

October 2026

###### Abstract

Payroll\-fraud screening requires finding hidden employee–payee links while distinguishing suspicious relationships from legitimate ones\. We formulate this problem as inductive link prediction and entity ranking on synthetic human\-resources and enterprise resource planning \(HR/ERP\) graphs, with unseen organizations and a matched benign twin for every planted case\. An original study on 24 held\-out organizations and a prospectively frozen extension compare analyst rules, explicit path features and graph neural networks \(GNNs\)\. A tuned gradient\-boosted model on chained\-join features achieved the highest overall link average precision \(AP; 0\.823\), above the GraIL\-style GNN \(0\.663\); its 4\-hop AP was 0\.646 versus 0\.272\. Thus, the observed multi\-hop gain is not specific to GNNs\. On a new synthetic cohort with 2\.0% positive entities, chained\-join boosting again led \(AP 0\.798\); the relational entity GNN also exceeded record\-aware rules \(0\.707 versus 0\.504\)\. At a 2% review budget, their precision was 0\.695 versus 0\.602\. Under 40% failed identifier joins, the entity GNN ranked above chained\-join boosting \(AP 0\.712 versus 0\.683, descriptively\)\. Structure\-only auditing exposed a shortcut in the initial generator; matched twins reduced the audited twin\-pool AUROC to 0\.493–0\.514\. These results separate multi\-hop candidate discovery, record\-based discrimination and review prioritization within an explicit synthetic evaluation design\. Code and data are available from the authors on request\.

Keywords:payroll fraud detection; ghost employees; occupational fraud; employee–vendor collusion; HR and ERP systems; internal audit; segregation of duties; inductive link prediction; knowledge graph completion; graph neural networks; gradient boosting; audit analytics; synthetic fraud benchmark; data leakage; preregistration\.

## 1Introduction

Payroll assurance involves both relational discovery and assessment of the records supporting a payment\. An employee and a vendor can share an account, a payee can use an account held by an employee’s emergency contact, and an approver can have an undisclosed relationship with a new hire\. The same graph shape can describe a legitimate joint account, a disclosed related\-party transaction or an authorized family\-member payee\. Internal\-control frameworks and fraud\-risk assessment therefore consider declarations, independent approvals, activity records and verified account changes alongside relational matches\[[7](https://arxiv.org/html/2610.41085#bib.bib58),[25](https://arxiv.org/html/2610.41085#bib.bib59),[55](https://arxiv.org/html/2610.41085#bib.bib40),[53](https://arxiv.org/html/2610.41085#bib.bib41)\]\.

These workflows pose three distinct questions\.*Candidate discovery*identifies which existing employee could be linked to a new employee or vendor\.*Record discrimination*distinguishes a suspicious candidate from a legitimate relationship of similar shape\.*Review prioritization*allocates a limited number of analyst checks across new entities\. Identifying a four\-hop chain does not establish that a payment is fraudulent; a direct\-match rule can interpret a control record accurately while missing indirect candidates\.

We study these questions as inductive link prediction and entity ranking on synthetic HR/ERP knowledge graphs\. Every test organization and its entities are unseen in training\. Every new entity–employee pair is scored without candidate filtering\. The design includes seven planted patterns and a structurally matched benign twin for every planted case\. Positive labels are controlled study assignments; the entity\-level suite also includes a separately identified segregation\-of\-duties \(SoD\) control deficiency\. This distinction does not equate a control exception with employee misconduct\.

#### Why compare rules, path features and GNNs together?

Inductive graph methods such as GraIL\[[51](https://arxiv.org/html/2610.41085#bib.bib1)\]and NBFNet\[[60](https://arxiv.org/html/2610.41085#bib.bib2)\]can score relations involving unseen entities\. An analyst can also follow identifier chains with relational joins and use their outputs as explicit features\. Both deserve comparison with record\-aware rules\. Prior graph\-anomaly benchmarking has shown that tree ensembles with neighborhood aggregation can outperform GNNs\[[49](https://arxiv.org/html/2610.41085#bib.bib55)\]\. Here the question is how these approaches compare for organization\-held\-out payroll relations with matched benign topology, not whether boosting or graph learning is universally superior\.

#### Main findings\.

The strongest overall link model in the extended comparison was a tuned GBDT on chained\-join features: average precision \(AP, reported as AUPRC in the result tables\) was 0\.823, versus 0\.663 for GraIL\-style\. At three and four hops it achieved 0\.692 and 0\.646, versus 0\.501 and 0\.272\. These results establish the value of multi\-hop features in the evaluated setting without attributing it exclusively to GNNs\. Boosting also achieved twin\-pool AUROC 0\.853, above record\-aware rules’ 0\.796\.

On a new synthetic cohort with 2\.0% positive entities, boosting again led \(AP 0\.798\)\. The RDL\-style entity GNN exceeded record\-aware rules \(0\.707 versus 0\.504\), including precision at a 2% per\-organization review budget \(0\.695 versus 0\.602\)\. Under 40% failed joins, that GNN ranked above boosting \(AP 0\.712 versus 0\.683, descriptively\)\. These are comparisons of implemented training procedures: boosting was validation\-tuned, whereas GNN hyperparameters stayed fixed from development\.

#### Topology and records as separate measurement targets\.

An attribute\-free audit separated the initial generator’s planted cases from hard negatives with AUROC 0\.990\. Benign twins generated by the same structural procedure reduced audited structure\-only twin\-pool AUROC to 0\.493–0\.514\. This checks a particular shortcut channel and creates a separate record\-discrimination view; it does not certify the absence of every possible shortcut\.

#### Evidence stages\.

The original protocol was internally frozen before its 24 test organizations were evaluated\. The extension fixed new methods and tests before new computations; its comparison and noise arms reuse those organizations, while its lower\-prevalence arm uses a new cohort from the same generator\.[Table4](https://arxiv.org/html/2610.41085#S6.T4)distinguishes these roles\. Original hypotheses, score\-only diagnostics and extension results remain separately identifiable, with all outcomes retained\.

#### Contributions\.

1. 1\.A relation\-level audit task\.Organization\-held\-out payroll and employee–vendor link prediction and entity ranking, with evidence\-hop and audit\-test breakdowns \([Section3](https://arxiv.org/html/2610.41085#S3)\)\.
2. 2\.Matched controls and shortcut diagnostics\.Paired suspicious and benign structures, with attribute\-free audits separating topology\-based discovery from record discrimination \([Sections4](https://arxiv.org/html/2610.41085#S4)and[5](https://arxiv.org/html/2610.41085#S5)\)\.
3. 3\.An explicit multi\-hop comparison\.Record\-aware and generic rules, chained\-join queries, tuned path\-feature boosting and GNN\-style models on shared pools \([Sections6](https://arxiv.org/html/2610.41085#S6),[7](https://arxiv.org/html/2610.41085#S7)and[8](https://arxiv.org/html/2610.41085#S8)\)\.
4. 4\.Review and robustness evidence\.A lower\-prevalence cohort, fixed review budgets, failed joins and missing records identify where rankings persist or change \([Section7](https://arxiv.org/html/2610.41085#S7)\)\.

#### Data and use\.

All records are synthetic, use opaque identifiers and contain no real employee or customer data\. The study evaluates behavior under the stated generator and protocols; operational use calls for population\-specific validation and human review \([Section11](https://arxiv.org/html/2610.41085#S11)\)\. Code, synthetic datasets and run records are available from the authors on request\.

## 2Related Work

The closest prior work falls into five groups: payroll\-fraud practice and audit analytics, inductive knowledge\-graph completion, graph\-based fraud and anomaly detection, machine learning on accounting and ERP data, and leakage in machine\-learning evaluation\. To our knowledge, based on an arXiv search and a Crossref search of journals and books \([AppendixB](https://arxiv.org/html/2610.41085#A2)\), the search identified a distinct opportunity for an organization\-held\-out payroll benchmark combining relation\-level labels, evidence\-hop comparisons and structurally matched benign controls\. The empirical contribution below is this combination and its measured consequences, rather than a claim to invent inductive link prediction or multi\-hop auditing\.

#### Payroll fraud and audit analytics\.

Occupational\-fraud surveys by the Association of Certified Fraud Examiners classify payroll schemes \(ghost employees, falsified wages, commission schemes\) as a distinct category of asset misappropriation\[[4](https://arxiv.org/html/2610.41085#bib.bib39)\], and practitioner handbooks describe the red flags we plant: a payee with no time records, a bank account or address shared with another employee, an employee who adds and pays the same record\[[55](https://arxiv.org/html/2610.41085#bib.bib40)\]\. Fraud data analytics turns such red flags into scenario\-based tests over core business systems\[[53](https://arxiv.org/html/2610.41085#bib.bib41)\]; digit analysis such as Benford’s law screens transaction amounts\[[36](https://arxiv.org/html/2610.41085#bib.bib42)\]; continuous auditing runs control tests automatically and repeatedly\[[2](https://arxiv.org/html/2610.41085#bib.bib43)\]; and process mining reconstructs and checks the actual approval paths of business processes\[[26](https://arxiv.org/html/2610.41085#bib.bib44)\]\. Role\-based access control and SoD rules in ERP systems are documented for practice\[[39](https://arxiv.org/html/2610.41085#bib.bib50)\]\. Many such tests are direct matches and threshold rules; our record\-aware rule baseline \(Rules v2,[Section6](https://arxiv.org/html/2610.41085#S6)\) represents this family in its one\-edge form, although a practitioner’s join query can also follow a short chain across tables\. Recent machine\-learning work on payroll fraud uses tabular classifiers: a scoping review of United States public\-sector payroll systems finds the evidence in payroll specifically thinner than in banking, tax or audit settings\[[9](https://arxiv.org/html/2610.41085#bib.bib46)\]; a preprint surveys supervised and unsupervised AI for payroll fraud in ERP systems\[[41](https://arxiv.org/html/2610.41085#bib.bib47)\]; and a study of home\-health workforces cross\-checks identity, scheduling, visit\-verification and payroll data on a synthetic dataset and reports gradient boosting above rule thresholds, with network\-style collusion indicators such as shared accounts and addresses\[[48](https://arxiv.org/html/2610.41085#bib.bib48)\]\. That learned models beat rule thresholds on such direct indicators there, whereas our record\-aware rules beat the GNNs on direct \(2\-hop\) matches, is plausibly explained by the baselines: their rules are thresholds, ours are generator\-aware conjunctions over control records\. None of these works models multi\-hop relations or unseen entities explicitly\.

#### Inductive knowledge\-graph completion and link prediction\.

Classical link\-prediction heuristics score a pair from its shared neighbourhood or its walks: common neighbours and the Adamic–Adar index\[[1](https://arxiv.org/html/2610.41085#bib.bib28),[33](https://arxiv.org/html/2610.41085#bib.bib30)\], the Katz index\[[29](https://arxiv.org/html/2610.41085#bib.bib29)\]and personalized PageRank\[[22](https://arxiv.org/html/2610.41085#bib.bib37)\]\. Relational GNNs such as R\-GCN\[[45](https://arxiv.org/html/2610.41085#bib.bib20)\]learn node embeddings over typed relations, but node\-wise embeddings cannot distinguish pairs whose endpoints are automorphic; labelling\-trick methods such as SEAL\[[57](https://arxiv.org/html/2610.41085#bib.bib21)\]fix this by marking the two target nodes, and[Zhang et al\. \[58\]](https://arxiv.org/html/2610.41085#bib.bib22)give the theory\. GraIL\[[51](https://arxiv.org/html/2610.41085#bib.bib1)\]applies the labelling idea to inductive relation prediction: it extracts the enclosing subgraph between head and tail, labels nodes by their distances to both, and scores the pair with an R\-GCN, so it never needs an embedding for an entity seen at training time\. NBFNet\[[60](https://arxiv.org/html/2610.41085#bib.bib2)\]generalizes path\-based methods with a Bellman–Ford message\-passing scheme conditioned on the query entity\. RED\-GNN\[[59](https://arxiv.org/html/2610.41085#bib.bib5)\]reasons over relational digraphs; NodePiece\[[17](https://arxiv.org/html/2610.41085#bib.bib51)\]represents entities compositionally from anchors and relations; InGram\[[31](https://arxiv.org/html/2610.41085#bib.bib4)\]extends inductiveness to unseen relations; ULTRA\[[18](https://arxiv.org/html/2610.41085#bib.bib3)\]aims at a single model that transfers across knowledge graphs\. GLAR, proposed in One Subgraph for All\[[56](https://arxiv.org/html/2610.41085#bib.bib6)\], encodes a single opening subgraph around the query entity and reuses it to score all candidate tails, which reduces the per\-pair extraction cost of GraIL\-style methods\. Inductive benchmarks\[[16](https://arxiv.org/html/2610.41085#bib.bib52)\]and re\-evaluations of GNN link prediction\[[32](https://arxiv.org/html/2610.41085#bib.bib53)\]stress, as we do, that evaluation protocol and negative sampling can change conclusions\. Our setting is the strictly inductive one these methods target: every test entity, every test link and every test organization is unseen in training\. We implement GraIL\-style and NBFNet\-style models and a model*inspired by*the opening\-subgraph idea; none is a reproduction of the original code \([Section6](https://arxiv.org/html/2610.41085#S6)\)\. Inductive link prediction has been applied to banking fraud\[[5](https://arxiv.org/html/2610.41085#bib.bib49)\]: new transactions are linked into an existing homogeneous customer graph and scored as fraudulent or not\. Our setting differs in three ways: induction is across organizations \(no test entity or organization is seen in training\), the prediction target is the colluding employee rather than a transaction label, and results are reported by evidence\-chain length\.

#### Graph\-based fraud and anomaly detection\.

Graph\-fraud benchmarking includes extensive work on node classification, camouflage and class imbalance\. CARE\-GNN\[[10](https://arxiv.org/html/2610.41085#bib.bib24)\]and PC\-GNN\[[34](https://arxiv.org/html/2610.41085#bib.bib27)\]address camouflaged fraudsters and class imbalance; BWGNN\[[50](https://arxiv.org/html/2610.41085#bib.bib54)\]and the GADBench benchmark\[[49](https://arxiv.org/html/2610.41085#bib.bib55)\]study spectral properties of anomalies and benchmark supervised graph anomaly detection;[Weber et al\. \[54\]](https://arxiv.org/html/2610.41085#bib.bib17)and[Elmougy and Liu \[12\]](https://arxiv.org/html/2610.41085#bib.bib56)released Bitcoin transaction graphs for anti\-money\-laundering;[Cheng et al\. \[6\]](https://arxiv.org/html/2610.41085#bib.bib9)review more than 100 studies of GNNs for financial fraud\. AMLworld\[[3](https://arxiv.org/html/2610.41085#bib.bib10)\]uses simulation to make financial\-crime ground truth explicit; here synthetic generation similarly supplies controlled labels\. The closest design is TravelFraudBench\[[43](https://arxiv.org/html/2610.41085#bib.bib7)\], a configurable generator of fraud rings in heterogeneous travel\-platform graphs that compares graph and non\-graph methods\. We differ in three ways: our task is*link discovery*\(which existing employee colludes with this new entity\) rather than node classification; it is strictly inductive across organizations; and the planted patterns are mapped to named audit tests\. Large language models have also been combined with graph fraud detectors\[[24](https://arxiv.org/html/2610.41085#bib.bib14)\]; we do not evaluate an LLM arm\.

#### Accounting, ERP and audit data\.

Deep autoencoders have been used to flag anomalous journal entries\[[46](https://arxiv.org/html/2610.41085#bib.bib18)\], and self\-supervised multi\-view representations of accounting data have been learned for audit tasks\[[47](https://arxiv.org/html/2610.41085#bib.bib19)\]\.[Tritscher et al\. \[52\]](https://arxiv.org/html/2610.41085#bib.bib8)generated open ERP system data with occupational\-fraud scenarios designed with auditing experts; their data are process and transaction records rather than an entity–relation graph with link\-level ground truth\. Recent arXiv work proposes ERP test\-data provisioning for financial control testing\[[44](https://arxiv.org/html/2610.41085#bib.bib11)\], a leakage\-safe ensemble benchmark for financial risk in ERP systems\[[35](https://arxiv.org/html/2610.41085#bib.bib12)\], and LLMs that flag irregularities in double\-entry ledgers\[[27](https://arxiv.org/html/2610.41085#bib.bib13)\]\. Relational deep learning\[[14](https://arxiv.org/html/2610.41085#bib.bib16)\]and RelBench\[[40](https://arxiv.org/html/2610.41085#bib.bib15)\]treat an enterprise relational database as a heterogeneous graph of rows linked by foreign keys and train GNNs end to end; an HR/ERP system is such a database, so we include an RDL\-style baseline at entity and link level \([Section6](https://arxiv.org/html/2610.41085#S6)\)\. Linking an emergency contact, an account holder and a vendor representative to the same person is a record\-linkage problem\[[13](https://arxiv.org/html/2610.41085#bib.bib45)\], which our generator assumes solved \([Section11](https://arxiv.org/html/2610.41085#S11)\)\.

#### Leakage, shortcuts, minimal pairs and prospective protocol\.

[Kaufman et al\. \[30\]](https://arxiv.org/html/2610.41085#bib.bib33)formalized leakage in data mining, and[Kapoor and Narayanan \[28\]](https://arxiv.org/html/2610.41085#bib.bib25)documented how leakage undermines ML\-based science\. Shortcut learning\[[20](https://arxiv.org/html/2610.41085#bib.bib26)\]—models exploiting a cue that predicts the label in the benchmark but not in the target task—is the failure mode we found in our first generator\. Our matched benign twins are the graph analogue of contrast sets\[[19](https://arxiv.org/html/2610.41085#bib.bib57)\]: minimally different inputs with different labels that test a model’s local decision boundary\. We follow the prospective protocol logic of[Nosek et al\. \[37\]](https://arxiv.org/html/2610.41085#bib.bib34), use AUPRC as the primary metric because only 0\.12% of candidate pairs are positive\[[8](https://arxiv.org/html/2610.41085#bib.bib31),[42](https://arxiv.org/html/2610.41085#bib.bib32)\], a cluster bootstrap over organizations\[[11](https://arxiv.org/html/2610.41085#bib.bib35),[15](https://arxiv.org/html/2610.41085#bib.bib36)\], and Holm’s step\-down correction\[[23](https://arxiv.org/html/2610.41085#bib.bib38)\]\.

## 3Problem Setting

We study two inductive tasks on one HR/ERP knowledge graph per organization: score every \(new entity, existing employee\) pair for hidden collusion, and score every new entity for fraud\. Results are broken down by the length of the planted evidence chain \(hop\)\.

We define an*HR/ERP knowledge graph*of one organization as a typed, directed multigraphG=\(V,E,R\)G=\(V,E,R\)whose nodes are employees, vendors, other persons \(emergency contacts, vendor representatives, account holders\), bank accounts, addresses and phones, and whose relation typesRRrecord pay accounts, account holders, addresses, phones, emergency contacts, vendor representatives, conflict\-of\-interest declarations, reporting lines \(reports\_to\) and hiring approvals \(hired\_by\)\. Payroll runs and access roles are exposed as node attributes \(runs paid, roles held\)\. The graph models see 28 relation types \(14 edge types and their inverses\)\. Persons are already resolved: the same emergency contact, account holder or vendor representative is one node wherever it appears \([Section11](https://arxiv.org/html/2610.41085#S11)\)\.

#### Unseen entities\.

Each organization has an*existing workforce*\(employees and vendors present before the observation window\) and a set of*new*entities: new hires and new vendors whose own records and edges are observed but who appear in no training organization\. We call a new entityuuand an existing employeecc\.

#### Tasks\.

We define two tasks\.

- •Link level\.For every pair\(u,c\)\(u,c\)of a new entity and an existing employee in an organization, score whetheruuandccare connected by a hidden fraudulent relation \(colludes\_withorsame\_beneficiary\)\. Every pair is scored; there is no candidate filtering\. The test pool has 483,912 pairs, of which 576 are positive \(prevalence 0\.12%\)\.
- •Entity level\.Score every new entity for whether it is fraudulent\. The test pool has 2,496 entities, of which 672 are positive \(26\.9%, a design parameter;[Section7](https://arxiv.org/html/2610.41085#S7)evaluates a lower\-prevalence cohort\)\. The 96 SoD conflicts among them are control deficiencies rather than frauds; we keep them because the prospective protocol does, and report H3 without them as an exploratory check\.

#### Hop\.

We define the*hop*of a planted fraud as the number of relations in its planted evidence chain betweenuuand the colludercc, excluding the direct manager or approver edge that every new hire has\. Hop 0 is the entity\-only SoD conflict; hop 1 is a ghost employee whose manager is also the hiring approver; hops 2–4 are chains through accounts, addresses, phones and persons \([Table1](https://arxiv.org/html/2610.41085#S3.T1)\)\. In auditors’ terms, hop 2 is a*direct match*\(uuandccshare an account, address or phone node, two edges apart\), and hops 3 and 4 are*indirect*matches through one or two intermediate persons or identifiers\. We call a rule*one\-step*if it tests one graph edge between identifiers \(or the manager/approver edge\); such rules can nameccdirectly only at hop≤2\\leq 2or through a manager/approver edge\. In audit\-query terms, some 3\-hop chains \(for example “the account holder isCC’s emergency contact”\) are a single join across two tables, so chained join queries could reach them; the extension evaluates a chained\-join query and boosting on path features \([Section7](https://arxiv.org/html/2610.41085#S7)\)\.

#### Inductive split\.

Organizations, not pairs, are split: 12 development \(dev\) organizations and 24 test organizations\. Learned models train on 9 dev organizations and early\-stop on the other 3\. Every test entity, every test link and every test organization is therefore unseen in training\.

#### Metrics and pools\.

The primary metric is link\-level AUPRC \(step\-wise average precision with tied scores forming one threshold\)\. We define the*hop\-hhpool*as all hop\-hhpositives together with all negatives; positives of other hops are excluded to retain a common negative reference for within\-hop method comparisons\. This is a diagnostic pool, not a full deployment pool\. Its chance AUPRC is its prevalence, which is 0\.010%, 0\.040%, 0\.050% and 0\.020% forh=1,…,4h=1,\\dots,4; because prevalence differs, AUPRC values should be compared across methods within a hop, not across hops\. We also report AUROC \(ties count half\), recall at a fixed false\-positive rate \(thresholds between tie groups only\), precision atkk, and per\-pattern and per\-test cells\. We define the*twin pool*as the planted positives together with their structurally matched benign twins only \([Section4](https://arxiv.org/html/2610.41085#S4)\); its AUROC measures whether a method reads the control records rather than the topology\. We define the*hard\-negative pool*of the exploratory phases as the planted positives together with the hand\-built hard negatives of generator v1 \([Section5](https://arxiv.org/html/2610.41085#S5)\)\.

Table 1:Each of the seven planted fraud patterns is caught by one of six audit tests, each named after the control it checks, and is planted at one, two or three different hop lengths \(CC= colluding existing employee; EC = emergency contact\)\. The two employee–vendor patterns share one test\.patternaudit test \(control checked\)entityhopsplanted evidence chainghost employeeghost\-employee test \(activity vs pay\)new hire1, 3paid in≥2\\geq 2runs with no activity, reports toCC; h1:CCis also the hiring approver; h3: pay account held byCC’s ECshared payroll accountshared\-account test \(account uniqueness\)new hire2, 3, 4h2: same account asCC; h3: account holder isCC’s EC; h4: holder lives atCC’s addressemployee–vendor accountemployee–vendor test \(conflict\-of\-interest declaration\)new vendor2, 3, 4h2: vendor account equalsCC’s; h3: holder isCC’s EC; h4: holder sharesCC’s phoneemployee–vendor contactemployee–vendor test \(conflict\-of\-interest declaration\)new vendor2, 3, 4h2: vendor address or phone equalsCC’s; h3: representative lives atCC’s address; h4: representative shares a phone withCC’s ECapprover linkapprover–payee test \(four\-eyes approval\)new hire2, 3hired byCC; h2: sharesCC’s address or account; h3: a person at the hire’s address isCC’s ECaccount change before runbank\-change test \(call\-back verification\)hire or vendor2, 3bank details changed at most 3 days before a run; h2: toCC’s account; h3: to an account held byCC’s ECSoD conflictSoD test \(maintain data×\\timesrun payroll\)new hire0holds both*maintain employee data*and*run payroll*without an approved exception \(entity level only; a control deficiency\)

## 4A Leakage\-Controlled Synthetic HR/ERP Generator

The confirmatory study uses generator v2, which plants seven fraud patterns at 0–4 hops and gives each a benign twin with identical topology\. Its central design decision is that*the label depends on control records, not on topology*: every planted fraud shape is built a second time as a benign twin with the same topology, and only the records attached to the entities say which of the two is fraud\. Generator v1, used in the exploratory phases, lacked this property;[Section5](https://arxiv.org/html/2610.41085#S5)shows the consequence\.

### 4\.1Organizations and background structure

Each synthetic organization has 150–240 existing employees and 30–45 existing vendors, 6 payroll runs 15 days apart, HR maintainers and payroll runners \(one of whom holds both roles with an approved exception\), and 72 new hires and 32 new vendors that form the unseen query entities\. Entities are opaque random identifiers; there are no names\. Benign structure that resembles fraud is generated on purpose: couples who share an address, list each other as emergency contacts and sometimes hold a joint account; siblings who share an emergency contact; joint accounts held by a non\-employee spouse; office main lines shared by many employees; multi\-tenant commercial buildings shared by vendors; declared employee–vendor relationships; benign recent bank\-detail changes; untracked attendance and leave\. The v1 hand\-built hard negatives \(for example, a new hire who is the spouse of an existing employee\) are kept in v2\. Test organizations have 1,639–2,200 nodes and 3,341–4,640 edges\.

### 4\.2Planted fraud

Each organization receives 28 planted frauds \(fraud multiplier 2\), one per fraudulent entity, covering the seven patterns of[Table1](https://arxiv.org/html/2610.41085#S3.T1)\. Hop counts rotate across organizations so that every pattern–hop cell is populated; in the 24 test organizations the link\-level cells have at least 32 positives each, and the hop totals are 48 \(h1\), 192 \(h2\), 240 \(h3\) and 96 \(h4\); there are 96 SoD conflicts at entity level \([Table20](https://arxiv.org/html/2610.41085#A3.T20)in the appendix\)\. The ground truth stores, for every instance, the pattern, hop, entity, colluder, relation and the planted evidence edges; methods receive only the observed graph\.

### 4\.3Matched benign twins

For every planted fraud the generator calls the*same*structural code a second time withfraud=falseon another new entity and another existing employee \(look\-alike ratio 1\)\. The twin reuses the fraud’s variant, so it has the same evidence edge types, the same hop chain, the same intermediary types and the same degree side\-effects—for example, if the fraud gives the colluder an extra emergency contact, so does the twin\. Each twin has a benign story: relatives with a declared joint account, a family\-member payee who is the related employee’s emergency contact, a declared related vendor, a referral hire approved by a related employee, a verified change to a family account shortly before a run, a documented SoD exception\.[Figure1](https://arxiv.org/html/2610.41085#S4.F1)shows one pair\.

new hireuuaccountAApersonPPemployeeCCpays intoheld byemerg\. contactfraud\(shared payroll account, h3\): no third\-party payee authorization; conflict\-of\-interest declaration missing or late; approval not independentnew hireu′u^\{\\prime\}accountA′A^\{\\prime\}personP′P^\{\\prime\}employeeC′C^\{\\prime\}pays intoheld byemerg\. contactbenign twin\(family\-member payee\): payee authorization on file; declaration filed on time; four\-eyes approvalFigure 1:A planted 3\-hop fraud and its matched benign twin have identical topology; only the control records attached to the entities differ\. A model that separates the two must read the records\.
### 4\.4Control records and the label

Each planted shape has two or three evidence*channels*, stored as observed employee or vendor attributes: conflict\-of\-interest declaration on file and its timing \(a declaration filed long after the start date counts as late\); third\-party payee or joint\-account authorization; call\-back verification of a bank\-detail change; four\-eyes \(independent\) approval; badge and system\-login activity; time\-sheets; and the SoD exception record\. For a fraud, each channel is suspicious with probability 0\.7, with at least one suspicious channel\. We define a*camouflaged*fraud as one with exactly one suspicious channel and legitimate\-looking records otherwise; a fraction 0\.25 of frauds is camouflaged\. For a twin, each channel is suspicious with probability 0\.15 \(missing paperwork, late filing, legitimately low activity\)\. Background entities carry the same attributes at background rates \(for example, a conflict\-of\-interest declaration rate of 0\.07\)\. Every record of every employee or vendor is independently missing with probability 0\.05\. No label noise is applied\. All rates are modelling choices made to keep the record signal noisy but learnable; none is estimated from real cases\.

The record distributions overlap by design: a camouflaged case and a benign twin can carry the same observed controls\. The twin comparison therefore tests discrimination from noisy records, separately from whether a connecting chain exists\.

### 4\.5Data, seeds and the superseded export

The confirmatory dataset \(hrgraph\-004\) has 36 organizations—12 dev and 24 test—generated from base seed 9134004\. A manifest records the SHA\-256 of every organization file and of the generator sources; the confirmatory run re\-checked all 217 data files and 6 generator sources before training \(0 mismatches\)\. Two data\-handling deviations are disclosed in[AppendixA](https://arxiv.org/html/2610.41085#A1): a seed collision that ruled out the first suggested seed, and a superseded first v2 export \(hrgraph\-003\)\.

## 5Leakage Audit: Near\-Perfect Scores, Structural Tells and Generator v2

An attribute\-free audit identified a structural shortcut in the initial generator; matched twins provide a control for that channel\. Before the confirmatory study, two exploratory phases on generator v1 produced GNN results that looked like a strong positive finding\. A leakage audit showed they were mostly a property of the generator\. This section reports that sequence because it changed the study design and because the audit is reusable\. All numbers in this section are exploratory and come from dev organizations or from v1 data; none enters the confirmatory test\.

### 5\.1Exploratory results and the audit trigger

In phase 1 \(generator v1, 71,995 test pairs, 96 positive\) the tuned rules had the best link AUPRC \(0\.492, against 0\.284 for path features \+ LR\), but they recovered only 0\.205 of 3\-hop positives at 1% FPR, against 1\.000 for the path model; no phase\-1 method solved 4 hops at low FPR\. Phase 2 scaled the corpus to 24 test organizations \(215,545 pairs, 288 positive\) and added the GNNs\. The result \([Table2](https://arxiv.org/html/2610.41085#S5.T2)\) looked decisive: NBFNet\-style link AUPRC 0\.997 and GraIL\-stylek=3k=30\.973, against 0\.502 for the tuned rules, with 4\-hop recall at 1% FPR of 1\.000 and 1\.000 where the rules had 0\.000\. At entity level the R\-GCN reached AUPRC 0\.989\.

Table 2:Exploratory phase 2 on generator v1 \(24 test orgs, 215,545 pairs\): near\-ceiling GNN scores that the leakage audit later traced to structural tells\. Not confirmatory; reported to document the trap\.methodAUROCAUPRCAUPRC h3AUPRC h4R@1%FPR h3R@1%FPR h4Rules tuned0\.8260\.5020\.2010\.0000\.2000\.000Personalized PageRank0\.9910\.0800\.0330\.0050\.7420\.062Path features \+ LR0\.9840\.3120\.2710\.0021\.0000\.021RDL\-style \(link\)†0\.8920\.065±\\pm0\.0730\.0370\.0230\.4390\.194GraIL\-stylek=2k\{=\}2†0\.9830\.805±\\pm0\.0150\.9750\.0031\.0000\.194GraIL\-stylek=3k\{=\}30\.9990\.973±\\pm0\.0100\.9740\.9281\.0001\.000NBFNet\-style†1\.0000\.997±\\pm0\.0020\.9930\.9021\.0001\.000Opening\-subgraph \(OSFA\-insp\.\)†0\.9980\.956±\\pm0\.0130\.9280\.9490\.9811\.000

The high scores motivated an attribute\-free audit: the initial generator planted cases through structural code paths that benign entities did not share\. Phase 1 had identified one candidate cue, an*extra*emergency contact of the colluder\. We tested those structural signals before the original prospective protocol was finalized\.

### 5\.2The audit: structure\-only baselines

The audit \(leakage\-audit\.mjs, dev organizations only\) asks how far one gets*without any node or edge attributes*—topology and relation types only\. It fits four structure\-only baselines with leave\-one\-organization\-out logistic regression:

- •A0: an unsupervised “a path of length≤4\\leq 4exists” score;
- •A1: a bag of typed simple paths betweenuuandcc\(length≤4\\leq 4\);
- •A2: relation\-type degree profiles ofuu, ofccand ofuu’s neighbours, with*no*uu–ccpath feature;
- •A3: A1 and A2 together\.

It evaluates them on four pools: all pairs; connected pairs; the hard\-negative pool \(positives against the hand\-built hard negatives\); and, for v2, the twin pool\.

#### Finding 1: topology alone solved v1\.

On v1 dev data \(103,785 pairs, 144 positive\), A3 reached link AUROC 0\.999, AUPRC 0\.685 and recall 1\.000 at 1% FPR; A1 alone reached AUPRC 0\.598\. For comparison, the tuned rules had test AUPRC 0\.502 in phase 2\.

#### Finding 2: degree profiles alone separated fraud from the hard negatives\.

On the hard\-negative pool, A2—which sees nouu–ccpath at all—reached AUROC 0\.990\. The tells came from v1’s construction\. A colluder gained an extra emergency contact \(single\-feature AUROC of the colluder’s emergency\-contact out\-degree: 0\.637 over all pairs\)\. Hard negatives carried the opposite tells: the mutual\-emergency\-contact path occurred in 0 of 144 positives and in 48 of 156 hard negatives\. At entity level A2 alone reached AUROC 0\.888 and AUPRC 0\.838\.

#### Conclusion of the audit\.

In v1, “this multi\-hop structure exists around this pair” was close to equivalent to “this pair is fraud”\. The near\-ceiling phase\-2 GNN scores therefore did not show multi\-hop*reasoning about fraud*; they showed that the models could detect the generator’s planting code\.

### 5\.3Generator v2 and the twin check

Generator v2 \([Section4](https://arxiv.org/html/2610.41085#S4)\) removed the tells by construction: every fraud has a twin produced by the same structural code, and the label lives in the control records\. We re\-ran the same audit on v2 dev data \([Table3](https://arxiv.org/html/2610.41085#S5.T3)\)\.

Table 3:Leakage audit on the 12 dev organizations: with generator v1, topology alone \(no attributes\) separated fraud from the hand\-built hard negatives \(hard\-negative\-pool AUROC up to 0\.990\); with generator v2 every structure\-only baseline is at chance on the twin pool\. Upper block: link level; lower block: entity level\. A0–A3 are the attribute\-free audit baselines; ATTR \(attributes only\) is a non\-structural reference\.baselineall pairsAUPRC v1v2all pairsrecall@1% v1v2hard\-neg\.AUROC v1v2twin poolAUROC v2link: A0 path exists0\.0180\.0200\.0070\.0070\.1460\.3840\.509link: A1 path bag0\.5980\.3740\.9440\.9760\.7880\.5990\.506link: A2 degree profile0\.0090\.0040\.0760\.0310\.9900\.6660\.494link: A3 = A1 \+ A20\.6850\.3891\.0000\.9970\.9350\.6440\.504entity: A0 \(max overcc\)0\.2990\.3020\.0000\.0000\.4250\.4740\.513entity: A1 \(max overcc\)0\.6340\.4100\.1670\.0270\.7670\.6190\.514entity: A2 degree profile0\.8380\.4540\.6730\.0330\.9200\.6850\.493entity: A3 \(max overcc\)0\.7600\.4270\.1960\.0180\.8760\.6540\.508entity: ATTR \(attributes only\)0\.8050\.6810\.5710\.1700\.8800\.8450\.792

#### Finding 3: structure\-only baselines are at chance on the twin pool\.

Every structure\-only baseline has twin\-pool AUROC between 0\.493 and 0\.514 at both levels, and no single structural feature in the univariate screen deviates from 0\.5 by more than 0\.021 on the twin pool\. The attributes\-only reference \(ATTR\) reaches entity twin\-pool AUROC 0\.792: the signal is in the records, as intended\.

#### Finding 4: structural candidate generation and the twin\-pool diagnostic\.

The generator connects each planted positive pair, and only a small fraction of all pairs is\. On all pairs, A3 still reaches link AUROC 0\.999 and recall 0\.997 at 1% FPR on v2, but its AUPRC drops to 0\.389 \(v1: 0\.685\): the ranking puts each fraud next to its twin\. Per hop, A3 reaches dev AUPRC 0\.191, 0\.317 and 0\.051 at hops 2, 3 and 4 \(A1: 0\.194, 0\.299, 0\.052\)\. These are dev values from leave\-one\-organization\-out fits, not comparable one\-to\-one with the test values of[Section8](https://arxiv.org/html/2610.41085#S8), and the audit baselines were not run on the test split\. With one twin per fraud, an idealized structure\-only detector that ranks each hop\-hhfraud and its twin together above every other pair, and cannot order the two, has hop\-hhAUPRC of about 0\.5; this is the ceiling that reach alone can attain on our pools\. The hard\-negative pool stays above chance on v2 \(A2 AUROC 0\.666\) only because the v1 hard negatives keep their own benign structure, which points*away*from fraud\.

#### Consequence for the protocol\.

Two decisions in the prospective protocol follow directly\. First, link recall at 1% FPR is saturated by structure alone on v2 and was declared non\-informative before the test\. Second, the twin\-pool AUROC became a confirmatory hypothesis \(H2\): it is the only link\-level view in which a model cannot win by finding the candidate, and must read the records\.

### 5\.4A checklist for synthetic graph fraud benchmarks

We propose four checks that would have caught our v1 problem before any model was trained:

1. 1\.Structure\-only ceiling\.Fit attribute\-free baselines \(path bags, degree profiles\); if they approach the best model, the benchmark measures structure, not the target concept\.
2. 2\.Matched twins\.Generate each positive’s benign twin with the same code path and report the twin\-pool AUROC of every method; structure\-only baselines must be at chance there\.
3. 3\.Univariate screens\.List the single features with the most extreme AUROC on each pool; planting side\-effects show up as degree features\.
4. 4\.Saturation audit of metrics\.Identify metrics that structure\-only baselines already saturate and declare them non\-informative before the test\.

## 6Methods, Study Stages and Analysis Protocols

The original study compares 24 link\-level and 20 entity\-level scorers: four rule sets, four graph heuristics, a path\-feature model, seven GNN configurations from five families, and rule–GNN combinations\. The extension adds generic rules, a chained\-join query and tuned path\-feature boosting\. Selection uses development organizations; original hyperparameters and the extension grid were fixed before their respective formal computations\.[Table4](https://arxiv.org/html/2610.41085#S6.T4)distinguishes the evidence stages\. The original five\-test and extension nine\-test families retain their recorded organization\-bootstrap convention and Holm adjustments\.

Table 4:Study lineage\. Prospective freezes are internal protocol records, not public registry registration\. Reused test organizations remain identified; new seeds from the same generator are not an independent external data source\.stagedata and prior visibilityroleselection and inferenceOriginalhrgraph\-004; no prior test output24 held\-out organizationsDev\-fixed models; five recorded testsDiagnosticsOriginal written scores and truthSeed, twin, prevalence and SoD analysesExploratory, no trainingExtension Ahrgraph\-004; original results visibleMulti\-hop/non\-GNN and generic\-rule comparisonsDev\-selected GBDT; reused testExtension BNew hrgraph\-005; no prior cohort output2\.0% positive\-rate ranking and review budgetNew cohort, same generator; retrainingExtension Chrgraph\-004; original results visibleFailed joins and missing recordsClean\-dev training; reused test organizations### 6\.1Analyst rules

#### Rules naive and rules tuned\.

Eight direct, one\-step rules: shared account, account\-holder mismatch, shared address, shared phone, recent bank\-detail change, SoD conflict, paid without attendance, and a match with the hiring approver\. The tuned variant adds the exemptions an analyst would apply: declared household \(mutual emergency contact\), declared conflict of interest, office main line, approved SoD exception, untracked attendance or leave, and an account holder who is the entity’s own contact\. The entity score is the number of flags; the link score counts direct identifier matches betweenuuandcc, plus manager\-and\-no\-attendance and approver\-and\-approver\-link, plus a small multiple of the entity flag count\.

#### Rules severity\.

The tuned rules with hand\-set severity weights \(beneficiary and control flags weigh more than contact overlaps, which weigh more than a recent change\)\. These weights were added after a phase\-1 debug run showed heavy ties among flag counts; they are not fitted, but they are not blind either \([AppendixA](https://arxiv.org/html/2610.41085#A1)\)\.

#### Rules v2 \(record\-aware\)\.

The primary baseline\. On top of the tuned rules it reads the v2 control records: an identifier match is exempt if a conflict\-of\-interest declaration was filed on time and the approval was not single\-handed; a holder mismatch is exempt if a payee authorization is on file; a recent change is exempt if it was call\-back verified; “paid without activity” also fires on low badge*and*login activity; and a new flag fires when approval was not independent\. The weights are hand\-set\. Rules v2 is a generator\-informed reference whose exemptions use the control\-record schema \([AppendixA](https://arxiv.org/html/2610.41085#A1)\); its performance is not a bound on other analysts\. It remains one\-step: it can name a colluder only through a direct identifier match or a manager/approver edge\.

### 6\.2Graph heuristics and path features

Common neighbours, Adamic–Adar, truncated Katz and personalized PageRank \(PPR\) are computed on an undirected linkage view of the graph; entity scores are the maximum over candidates\.*Path features \+ LR*counts typed simple paths of length≤3\\leq 3betweenuuandcc\(edge\-type and direction sequences\), combined with the entity’s attribute flags \(including the v2 records\) and attribute×\\timespath\-type crosses, in an L2\-regularized logistic regression fitted on all 12 dev organizations; its entity model is a second logistic regression on the attributes and the maximum and count of positive link logits\.

### 6\.3Graph neural networks

All GNNs use the same 79\-dimensional node features: type one\-hot, log degrees \(total and per relation\), the phase\-1 attribute flags, run and activity counts, account\-change and role indicators, and*the v2 control records*\. No feature is derived from the label \(unit\-tested\)\. Hyperparameters were fixed in phase 2, before generator v2 existed, and were not tuned \([Table21](https://arxiv.org/html/2610.41085#A4.T21)\)\.

- •R\-GCN \(entity\): a two\-layer relational GCN\[[45](https://arxiv.org/html/2610.41085#bib.bib20)\]entity classifier with basis decomposition\.
- •RDL\-style \(entity / link\): a relational\-deep\-learning\-style baseline\[[14](https://arxiv.org/html/2610.41085#bib.bib16),[40](https://arxiv.org/html/2610.41085#bib.bib15)\]\. The graph is treated as relational tables \(node tables and foreign\-key tables\); per\-table input encoders are followed by two layers of heterogeneous message passing with GraphSAGE\-style\[[21](https://arxiv.org/html/2610.41085#bib.bib23)\]convolutions\. Embeddings are node\-wise, with no labelling trick\. The entity head is an MLP onhuh\_\{u\}; the link head is an MLP on\[hu,hc,hu⊙hc\]\[h\_\{u\},h\_\{c\},h\_\{u\}\\odot h\_\{c\}\]\.
- •GraIL\-style \(k=2k=2,k=3k=3\): for each candidate pair, the enclosing subgraph of radiuskkis the intersection of the two radius\-kkneighbourhoods, with distances recomputed inside the subgraph and nodes farther thankkpruned\[[51](https://arxiv.org/html/2610.41085#bib.bib1)\]\. Nodes carry double\-radius distance labels*concatenated with the node features*\(original GraIL uses labels only\), and a three\-layer R\-GCN with a \[mean\-pool,huh\_\{u\},hch\_\{c\}\] readout scores the pair\. On dev, enclosing subgraphs had 5\.1 \(k=2k=2\) and 49\.7 \(k=3k=3\) nodes on average\. A 4\-hop chain fits inside akk\-subgraph only whenh≤k\+1h\\leq k\+1, sok=2k=2cannot see h4 by construction\.
- •NBFNet\-style: six layers of generalized Bellman–Ford message passing from a boundary condition at the query entity, with relation\-conditioned \(DistMult\) messages and a \[sum, min\] aggregator\[[60](https://arxiv.org/html/2610.41085#bib.bib2)\]; observed node features are injected in every update \(a deviation from the original\); candidates are scored from\[hc,xc\]\[h\_\{c\},x\_\{c\}\]\.
- •Opening\-subgraph \(OSFA\-insp\., inspired by One Subgraph for All\): inspired only by the abstract\-level idea of GLAR\[[56](https://arxiv.org/html/2610.41085#bib.bib6)\]: one shared opening subgraph, the radius\-4 ball around the query entity, is encoded once by a four\-layer R\-GCN with distance\-from\-query labels and reused to score all candidates; candidates outside the ball get a learned embedding\. Nothing else from that paper is implemented; it is not a reproduction\.

Entity scores from link models are the maximum over all candidates\.

#### Training\.

GNNs train on the first 9 dev organizations with class\-balanced binary cross\-entropy and Adam, and keep the epoch with the best validation AUPRC on the remaining 3\. Each GNN is trained with 3 seeds \(9131, 9132, 9133\); we define the*seed\-mean metric*as the metric computed separately on each seed’s scores and then averaged over the seeds, and all reported GNN values are seed\-mean metrics, with the seed standard deviation \(SD\) reported separately\. Training ran on CPU only\.

#### Combinations\.

Rules v2 is combined with each GNN in two ways, fitted only on the 3 validation organizations \(the same ones used for early stopping, so the combination weights are not independent of model selection\):lris a two\-feature class\-balanced logistic regression on the two scores;maxtakes the maximum of the two methods’ validation\-negative\-calibrated surprisals\. Themaxcombination saturates at the validation pool size and produces ties at the top; it was kept unchanged from phase 2 and is reported only in the appendix tables\.

### 6\.4Original prospective protocol and statistics

The original prospective protocol was internally frozen on 2026\-10\-14 asfreeze\-phase3\-001: the prospective protocol text, all code, the data manifest and the design document, 60 files with SHA\-256 checksums \(checksum file digest598b8b47161d…\)\. No file of any test organization had been opened by an analysis script at that point\. The frozen run script verified every checksum and every data file before training, ran each model once, and wrote to a create\-only directory; the report script re\-verified the freeze \(60 files\) before reading any score\.

#### Pre\-specified models\.

Chosen on the dev rehearsal before the freeze: GraIL\-stylek=3k=3is the primary link model \(highest dev link AUPRC, 0\.697\) and RDL\-style \(entity\) the primary entity model \(highest single\-model dev entity AUPRC and twin AUROC\); Rules v2 is the primary baseline\. R\-GCN \(entity\), NBFNet\-style and the opening\-subgraph model were run under the same protocol but are not pre\-specified; their results are descriptive\.

#### Hypotheses\.

One family of five one\-sided tests:

- •H1\-h2, H1\-h3, H1\-h4 \(multi\-hop reach\)\.GraIL\-stylek=3k=3minus Rules v2 link AUPRC\>0\>0, separately for hop\-hhpositives against all negatives,h=2,3,4h=2,3,4\.
- •H2 \(record reading; leakage\-free\)\.GraIL\-stylek=3k=3minus Rules v2 link AUROC\>0\>0on the twin pool\.
- •H3 \(entity\)\.RDL\-style \(entity\) minus Rules v2 entity AUPRC\>0\>0over all unseen entities\.

#### Statistics and recorded decision rule\.

The statistic is the difference of seed\-mean metrics on the pooled test organizations\. A paired organization\-cluster bootstrap\[[11](https://arxiv.org/html/2610.41085#bib.bib35),[15](https://arxiv.org/html/2610.41085#bib.bib36)\]uses 1,000 replicates of the 24 test organizations \(seed 913\), shared across methods and pools\. Each GNN replicate averages separately computed seed metrics\. The protocol reports\(1\+\#\{db≤0\}\)/\(1\+B\)\(1\+\\\#\\\{d\_\{b\}\\leq 0\\\}\)/\(1\+B\)as a one\-sided bootstrap\-tail statistic, applies Holm over five tests, and records support when the point difference is positive and the adjusted statistic is≤0\.025\\leq 0\.025\. Its minimum reported value 0\.001 is Monte Carlo resolution, not a bound on a populationpp\-value\. This uncentered tail convention is approximate, not an exact null\-randomization test; adjustment alone does not establish finite\-sample calibration\. We preserve the recorded tests and their decisions\. Percentile intervals condition on these organizations and fitted seeds; seed variability is reported separately\.

#### Secondary and non\-informative metrics\.

Three secondary comparisons are descriptive and outside the family \(all non\-family CIs in this paper are unadjusted\): S1 the rules \+ GraIL\-stylelrcombination against each of its inputs on overall link AUPRC, S2 GraIL\-style against Rules v2 on overall link AUPRC, and S3 RDL\-style against Rules v2 on the entity twin pool\. Link\-level recall at 1% FPR was declared non\-informative in the prospective protocol, because structure\-only baselines saturate it on v2 dev data \([Section5](https://arxiv.org/html/2610.41085#S5)\); it is reported, but no claim rests on it\.

#### Dev expectations\.

Before the freeze, a dev rehearsal \(train on 6 dev organizations, validate on 2, evaluate on the remaining 4\) recorded the expected directions: H1\-h2 not supported \(dev difference−\-0\.034\), H1\-h3 and H1\-h4 supported \(\+0\.405, \+0\.286\), H2 not supported \(−\-0\.061\), H3 supported \(\+0\.087\)\. These were recorded so that the expected negative results would be reported as such\.

## 7Cross\-Method Comparison and Robustness Studies

The extension adds generic rules, explicit multi\-hop references, a lower\-prevalence synthetic cohort and identity\-error conditions\. It was designed after original results were available, with its code, data manifest and nine\-test decision family internally frozen before new formal computations \(SHA\-256 prefixef29f64b37209738\)\. The original five decisions remain unchanged\. A/C reuse the already\-evaluatedhrgraph\-004organizations; B evaluates a newhrgraph\-005cohort from the same generator \([Table4](https://arxiv.org/html/2610.41085#S6.T4)\)\. The run verified 12 extension and 60 original files and completed in 1\.3 h on CPU\.

### 7\.1New arms and data

#### Generic rules \(not tuned to the generator\)\.

Ten standard payroll and vendor red flags, each counted once: shared bank account; third\-party payee without authorization on file; shared residential address or non\-office phone with an existing employee; unverified bank change within 5 days of a run; SoD conflict without documented exception; paid with zero attendance or with low badge and login activity; approver conflict \(shared identifier or non\-independent approval\); identifier match without a related\-party disclosure on file; and any missing control record\. Unlike Rules v2 there are no weights and no exemption logic that combines disclosure timing with four\-eyes approval\. The authors who wrote it know the generator, so it is untuned, not blind\.

#### Chained\-join query and chained\-join GBDT\.

We enumerate every simple path of length 1–4 from a new entity to an existing employee through identifier and person records \(bank accounts, addresses, phones, persons\), typed by relation and node class\. The*chained\-join query*is a deterministic audit query: shortest identifier chain first, then the number of chains, with commercial addresses and office switchboard lines ignored\. The*chained\-join GBDT*is a*tuned*gradient\-boosted tree model\[[38](https://arxiv.org/html/2610.41085#bib.bib60)\]on hand\-crafted features: log counts of 24 path types, counts per length, the shortest length, and the same observed record attributes that the GNNs receive for both endpoints \(188 features\)\. It is trained on the 9 training dev organizations, and its hyperparameters were chosen by a pre\-specified grid \(8 link and 16 entity settings\) on the 3 validation dev organizations \(link: learning rate 0\.05, 63 leaves, min\. leaf size 20,ℓ2\\ell\_\{2\}1\)\. An entity\-level variant aggregates the path features over all candidates\.

#### A 2% positive\-rate synthetic cohort \(hrgraph\-005\)\.

The same generator code with larger organizations \(600–900 existing employees\), 700 new entities per organization and one copy of each planted pattern gives 14 frauds per organization, 2\.0% of new entities; every fraud keeps one matched twin\. The 24 test organizations hold 16,800 new entities, 336 of them fraudulent\. All learned models \(R\-GCN and RDL\-style entity GNNs with the frozen hyperparameters and seeds, and the chained\-join GBDT\) were retrained on its 12 dev organizations\. This corpus is evaluated at entity level only: its ~19 million candidate pairs were not scored\. We report precision and recall when each organization reviews a fixed share of its new entities \(1, 2 or 5%; 2% equals the number of frauds per organization\)\.

#### Identity\-resolution noise\.

On the observed test graphs, each identifier link \(to a bank account, address or phone\) is re\-pointed with probabilityp∈\{0\.1,0\.2,0\.4\}p\\in\\\{0\.1,0\.2,0\.4\\\}to a duplicate record, so that the join fails \(“split”\)\. In a second family of conditions, each emergency\-contact, account\-holder, representative and conflict\-of\-interest record is missing with probabilityq∈\{0\.1,0\.2,0\.4\}q\\in\\\{0\.1,0\.2,0\.4\\\}\(“drop”\)\. Models are trained on clean dev organizations\. GraIL was not retrained \(~11\.5 h per run\), so the NBFNet\-style model is the link GNN of this stage\. Retrained with the frozen code, seeds and hyperparameters, the RDL\-style model reproduced its frozen test scores exactly, while the NBFNet\-style model did not reproduce bitwise under the changed thread count \(clean link AUPRC 0\.688 against 0\.673 frozen; disclosed\)\.

Table 5:Extension: the nine pre\-specified tests \(one Holm family, one\-sidedα=0\.025\\alpha=0\.025\)\. Stage A reuses thehrgraph\-004test organizations \(new arms against the frozen GNN scores\); stage B uses the new 2%\-prevalence corpushrgraph\-005; stage C uses thehrgraph\-004test organizations with 20% of identifier links split \(failed joins\)\. Difference = method−\-reference with 95% paired org\-bootstrap CI;ppone\-sided\. Designed after the original results were examined; the original five tests are unchanged\.idtest \(method−\-reference, metric\)methodref\.difference \[95% CI\]ppHolmppsupportedA1Rules v2−\-generic rules, link twin AUROC0\.7960\.667\+0\.129 \[\+0\.109, \+0\.147\]0\.0010\.009yesA2GraILk=3k\{=\}3−\-generic rules, link twin AUROC0\.6740\.667\+0\.007 \[−\-0\.020, \+0\.033\]0\.3171\.000noA3GraILk=3k\{=\}3−\-chained\-join GBDT, link AUPRC h30\.5010\.692−\-0\.191 \[−\-0\.225,−\-0\.152\]1\.0001\.000noA4GraILk=3k\{=\}3−\-chained\-join GBDT, link AUPRC h40\.2720\.646−\-0\.374 \[−\-0\.443,−\-0\.292\]1\.0001\.000noA5RDL\-style−\-chained\-join GBDT, entity AUPRC0\.7520\.861−\-0\.109 \[−\-0\.127,−\-0\.089\]1\.0001\.000noB1RDL\-style−\-Rules v2, entity AUPRC \(2% prevalence\)0\.7070\.504\+0\.202 \[\+0\.147, \+0\.256\]0\.0010\.009yesB2RDL\-style−\-Rules v2, precision at 2% budget0\.6950\.602\+0\.094 \[\+0\.045, \+0\.139\]0\.0010\.009yesC1NBFNet\-style−\-Rules v2, link AUPRC h3 \(idsplit 0\.2\)0\.4410\.090\+0\.350 \[\+0\.299, \+0\.395\]0\.0010\.009yesC2RDL\-style−\-Rules v2, entity AUPRC \(idsplit 0\.2\)0\.7310\.684\+0\.047 \[\+0\.016, \+0\.080\]0\.0030\.015yes

### 7\.2Results

5 of the 9 addendum hypotheses were supported \(A1, B1, B2, C1, C2\) and 4 were not \(A2, A3, A4, A5\); see[Table5](https://arxiv.org/html/2610.41085#S7.T5)\.

#### The multi\-hop advantage is not specific to GNNs \(A3–A5 not supported\)\.

The tuned chained\-join GBDT was the strongest model in the whole study \([Tables6](https://arxiv.org/html/2610.41085#S7.T6)and[7](https://arxiv.org/html/2610.41085#S7.T7)\)\. Its link AUPRC was 0\.823 overall, against 0\.663 for the GraIL\-style model and 0\.735 for the best rules \+ GNN combination\. At 3 hops it reached 0\.692 against 0\.501 \(difference−\-0\.191 \[−\-0\.225,−\-0\.152\]\), and at 4 hops 0\.646 against 0\.272\. At entity level it reached AUPRC 0\.861 against 0\.752 for the RDL\-style model\. It also read the records best: its link twin AUROC was 0\.853 \[0\.826, 0\.876\], above Rules v2 \(0\.796\)\. The deterministic chained\-join query reaches 4\-hop colluders \(AUPRC 0\.104\) but cannot read records \(twin AUROC 0\.500\)\. Following the pre\-specified interpretation rule, the H1 finding must be restated\.*Multi\-hop models*reach colluders that one\-step rules cannot name, and a tuned model on explicit path features did so better than the subgraph and path GNNs in our setting\. The finding is not a GNN\-specific advantage\.

#### Record discrimination depends on rule specification \(A1 supported, A2 not\)\.

Generic rules separated frauds from their twins much worse than Rules v2 \(link twin AUROC 0\.667 vs\. 0\.796; difference \+0\.129 \[\+0\.109, \+0\.147\], Holmp=0\.009p=0\.009\)\. Against these rules, GraIL\-style had AUROC 0\.674 versus 0\.667, a difference of \+0\.007 \[−\-0\.020, \+0\.033\]\. The directional hypothesis was unsupported; this is not equivalence\. Weights, exemptions and logic also change\. In accordance with the extension’s interpretation rule, explanations beyond generator knowledge remain; this comparison does not identify knowledge as the predominant cause of H2’s result\. Generic rules were also far weaker at entity level \(AUPRC 0\.490 vs\. 0\.698\)\.

Table 6:Stage A, link level, on thehrgraph\-004test organizations \(483,912 candidate pairs\)\.∗New arm of addendum v2; all other rows are the frozen scores of the confirmatory run \(GNN values = mean of 3 seeds\)\. AUPRC per hop = hop\-hhpositives vs\. all negatives; twin AUROC = planted positives vs\. their matched benign twins\. Brackets: 95% org\-bootstrap CI\.methodAUPRCh1h2h3h4twin AUROCRules v20\.3470\.3240\.6500\.081\[0\.066, 0\.098\]0\.000\[0\.000, 0\.000\]0\.796\[0\.773, 0\.818\]Generic rules∗0\.1860\.0840\.2920\.025\[0\.022, 0\.029\]0\.000\[0\.000, 0\.000\]0\.667\[0\.650, 0\.682\]Path features \+ LR \(len\. 3\)0\.2950\.0510\.1770\.239\[0\.222, 0\.260\]0\.001\[0\.001, 0\.002\]0\.619\[0\.602, 0\.637\]Chained\-join query∗0\.3110\.0000\.2820\.220\[0\.209, 0\.230\]0\.104\[0\.092, 0\.117\]0\.500\[0\.494, 0\.506\]Chained\-join GBDT∗0\.8230\.1700\.6030\.692\[0\.631, 0\.746\]0\.646\[0\.536, 0\.755\]0\.853\[0\.826, 0\.876\]GraIL\-stylek=3k\{=\}30\.6630\.1400\.4420\.501\[0\.462, 0\.549\]0\.272\[0\.220, 0\.337\]0\.674\[0\.643, 0\.705\]NBFNet\-style0\.6730\.3860\.5180\.461\[0\.420, 0\.502\]0\.154\[0\.132, 0\.188\]0\.668\[0\.642, 0\.691\]Opening\-subgraph0\.5840\.0450\.3710\.394\[0\.357, 0\.444\]0\.197\[0\.174, 0\.229\]0\.635\[0\.611, 0\.663\]Rules v2 \+ GraILk=3k\{=\}3\(LR\)0\.7350\.2010\.7300\.437\[0\.412, 0\.468\]0\.190\[0\.160, 0\.224\]0\.763\[0\.742, 0\.783\]

Table 7:Stage A, entity level,hrgraph\-004test organizations \(2,496 new entities, 26\.9% fraudulent\)\. AUPRC@2% = AUPRC with negatives re\-weighted to 2% prevalence \(descriptive\); P@bb= precision when each organization reviews its topbbof new entities\.∗New arm; other rows frozen\.methodAUROCAUPRCtwin AUROCAUPRC@2%P@2%P@5%Rules v20\.8720\.698\[0\.669, 0\.728\]0\.817\[0\.793, 0\.839\]0\.1580\.8580\.826Generic rules∗0\.7800\.490\[0\.467, 0\.515\]0\.735\[0\.712, 0\.756\]0\.0540\.5780\.616Path features \+ LR \(len\. 3\)0\.8760\.725\[0\.692, 0\.757\]0\.815\[0\.788, 0\.837\]0\.1650\.8890\.908Chained\-join query∗0\.6280\.325\[0\.323, 0\.327\]0\.500\[0\.495, 0\.504\]0\.0270\.1170\.146Chained\-join GBDT∗0\.9520\.861\[0\.832, 0\.884\]0\.881\[0\.860, 0\.898\]0\.3290\.9580\.950R\-GCN entity0\.9000\.776\[0\.744, 0\.808\]0\.821\[0\.796, 0\.846\]0\.2370\.9310\.922RDL\-style entity0\.8900\.752\[0\.719, 0\.784\]0\.821\[0\.797, 0\.843\]0\.1980\.8960\.881Rules v2 \+ RDL\-style \(LR\)0\.9140\.792\[0\.763, 0\.822\]0\.844\[0\.822, 0\.866\]0\.2250\.8890\.894

#### Ranking and review precision on the 2% cohort \(B1, B2 supported\)\.

Onhrgraph\-005the RDL\-style model reached entity AUPRC 0\.707 \[0\.669, 0\.754\] against 0\.504 \[0\.453, 0\.559\] for Rules v2 \(difference \+0\.202 \[\+0\.147, \+0\.256\];[Table8](https://arxiv.org/html/2610.41085#S7.T8),[Fig\.2](https://arxiv.org/html/2610.41085#S7.F2)\)\. With a review budget of 2% of new entities per organization, 0\.695 of the reviewed entities were frauds for the RDL\-style model and 0\.602 for the rules \(\+0\.094 \[\+0\.045, \+0\.139\]\)\. At a 5% budget the RDL\-style model recovered 0\.900 of all frauds and the rules 0\.668\. This differs from the fixed\-score re\-weighting in[Section9](https://arxiv.org/html/2610.41085#S9)\. Organization size, new\-entity counts, benign composition and training data also change, so the comparison does not isolate prevalence as a cause\. One possible reason, which we did not test, is that the rules’ coarse, tied scores rank many ordinary entities with a single missing or late record alongside the frauds\. The chained\-join GBDT was again the best \(AUPRC 0\.798; P@2% 0\.735; R@5% 0\.994\)\. Generic rules fell to AUPRC 0\.155, and on the twin pool no method exceeded 0\.828\. These numbers come from one synthetic mix of benign entities and are not deployment precision\.

Table 8:Stage B: a 2% positive\-rate synthetic cohort\. New corpushrgraph\-005\(24 unseen test organizations, 16,800 new entities, 336 fraudulent = 2\.0%\); every model retrained on its 12 dev organizations\. P@bb/ R@bb= precision / recall when each organization reviews its topbbof new entities \(at 2%, 14 reviews per organization, equal to its number of frauds, so P@2% = R@2%\)\. AUPRC@1% = negatives re\-weighted to 1% prevalence \(descriptive\)\.∗Not a GNN, new in addendum v2\. Brackets: 95% org\-bootstrap CI\.methodAUROCAUPRCtwin AUROCP@1%P@2%P@5%R@5%AUPRC@1%Rules v20\.9000\.504\[0\.453, 0\.559\]0\.7920\.8000\.602\[0\.561, 0\.645\]0\.2670\.6680\.405Generic rules∗0\.8550\.155\[0\.123, 0\.198\]0\.7280\.3430\.239\[0\.203, 0\.276\]0\.1740\.4340\.091Chained\-join query∗0\.8710\.211\[0\.208, 0\.215\]0\.5000\.0980\.184\[0\.171, 0\.197\]0\.3140\.7860\.121Chained\-join GBDT∗0\.9950\.798\[0\.761, 0\.838\]0\.8280\.8510\.735\[0\.702, 0\.768\]0\.3980\.9940\.681R\-GCN entity0\.9740\.686\[0\.651, 0\.726\]0\.7490\.7800\.670\[0\.639, 0\.700\]0\.3580\.8940\.561RDL\-style entity0\.9590\.707\[0\.669, 0\.754\]0\.7720\.8080\.695\[0\.672, 0\.721\]0\.3600\.9000\.586

000\.10\.10\.20\.20\.30\.30\.40\.40\.50\.50\.60\.60\.70\.70\.80\.80\.90\.911000\.20\.20\.40\.40\.60\.60\.80\.811recallprecision \(interpolated\)Rules v2Generic rulesChained\-join queryChained\-join GBDTR\-GCN entityRDL\-style entityFigure 2:Stage B: precision–recall curves at the natural 2\.0% prevalence ofhrgraph\-005\(pooled 24 test organizations; GNN curves = mean over 3 seeds of the interpolated precision at recall0\.05,…,10\.05,\\dots,1\)\. Exact values are in[Table8](https://arxiv.org/html/2610.41085#S7.T8)\.
#### Both advantages survive failed identity joins \(C1, C2 supported\)\.

With 20% of identifier links split, the NBFNet\-style model kept 3\-hop link AUPRC 0\.441 against 0\.090 for Rules v2, and the RDL\-style model kept entity AUPRC 0\.731 against 0\.684 \([Table9](https://arxiv.org/html/2610.41085#S7.T9)\)\. The degradation is real\. The 4\-hop AUPRC of the NBFNet\-style model fell from 0\.172 to 0\.026 atp=0\.4p=0\.4, and that of the chained\-join GBDT from 0\.646 to 0\.116, because a 4\-hop chain breaks if any of its identifier links is split\. The entity\-level GNN degraded least: atp=0\.4p=0\.4the RDL\-style model \(0\.712\) was ahead of both the chained\-join GBDT \(0\.683\) and Rules v2 \(0\.626\)\. Missing relationship records hurt the 3\-hop link results most \(chained\-join GBDT 0\.692 to 0\.340 atq=0\.4q=0\.4\), because they remove the middle of the chain\. Our noise model is simple: duplicates are clean singletons, and the joins never create false links\.

Table 9:Stage C: identity\-resolution noise on thehrgraph\-004test organizations\. “splitpp”: each identifier link \(to a bank account, address or phone\) is re\-pointed with probabilityppto a duplicate record, so the join fails; “dropqq”: each emergency\-contact, account\-holder, representative and conflict\-of\-interest record is missing with probabilityqq\. Models trained on clean dev organizations; NBFNet\-style and RDL\-style retrained with the frozen settings \(3 seeds\)\. Pre\-specified condition: split 0\.2\.methodcleansplit 0\.1split 0\.2split 0\.4drop 0\.1drop 0\.2drop 0\.4*link AUPRC, all hops*Rules v20\.3470\.3050\.2920\.2010\.3470\.3440\.338Generic rules0\.1860\.1650\.1610\.1220\.1850\.1840\.184Chained\-join query0\.3110\.2510\.2190\.1230\.2790\.2620\.208Chained\-join GBDT0\.8230\.7160\.6640\.4740\.7500\.7010\.576NBFNet\-style0\.6880\.6050\.5530\.3990\.6100\.5560\.447*link AUPRC, 3\-hop colluders*Rules v20\.0810\.0840\.0900\.0860\.0770\.0730\.066Generic rules0\.0250\.0260\.0270\.0320\.0250\.0240\.024Chained\-join query0\.2200\.1980\.1730\.1170\.1710\.1340\.071Chained\-join GBDT0\.6920\.6380\.6080\.4530\.5770\.4800\.340NBFNet\-style0\.5020\.4780\.4410\.3340\.3850\.3040\.179*entity AUPRC*Rules v20\.6980\.6740\.6840\.6260\.6880\.6850\.655Generic rules0\.4900\.4800\.4940\.4710\.4840\.4820\.466Chained\-join query0\.3250\.3100\.3050\.2790\.3200\.3200\.310Chained\-join GBDT0\.8610\.8000\.7780\.6830\.8210\.8080\.736RDL\-style entity0\.7520\.7350\.7310\.7120\.7370\.7310\.705

#### What changes in the paper’s reading\.

\(i\) The reach claim is restated as a claim about multi\-hop methods, not about GNNs\. On these graphs, a tuned GBDT on explicit chained\-join features is a stronger and cheaper baseline than any GNN we ran\. \(ii\) Record discrimination is sensitive to rule specification; the generic\-rule comparison establishes neither equivalence nor a causal knowledge effect\. \(iii\) The entity GNN exceeds rules in the new 2% cohort and specified split\-noise conditions; boosting remains strongest except in the high split\-noise condition\. \(iv\) Findings concern the stated synthetic populations and perturbations, not estimated operational performance\.

## 8Original Frozen Study: Results and Recorded Decisions

Subsections[8\.2](https://arxiv.org/html/2610.41085#S8.SS2)–[8\.4](https://arxiv.org/html/2610.41085#S8.SS4)report the five confirmatory tests; the secondary comparisons and further results are descriptive, and the exploratory post\-hoc analyses follow in[Section9](https://arxiv.org/html/2610.41085#S9)\. 3 of the 5 pre\-specified hypotheses are supported and 2 are not \([Table10](https://arxiv.org/html/2610.41085#S8.T10)\)\. The GraIL\-style model’s multi\-hop reach beats the one\-step record\-aware rules for colluders 3 and 4 hops away, and the RDL\-style entity model beats them at entity level; the GraIL\-style model does not beat the generator\-aware rules for 2\-hop collusion or at separating a fraud from its benign twin\. Every outcome has the direction recorded from the dev rehearsal before the freeze \([Table15](https://arxiv.org/html/2610.41085#S8.T15)\), and, in an exploratory check, every difference has the same sign for each of the 3 GNN seeds \([Section9](https://arxiv.org/html/2610.41085#S9)\)\.

### 8\.1Run integrity

The frozen run script was executed once\. It verified the 60 frozen files and all 217 data files \(0 mismatches\) before any training, trained every model with 3 seeds, and finished without a crash in 11\.5 hours of wall time \(41,521 s; the GraIL\-stylek=3k=3model alone took 9\.1 hours for 3 seeds on CPU\)\. The formal run log records no crash or rerun of this stage; development and extension work are tracked separately \([AppendixA](https://arxiv.org/html/2610.41085#A1)\)\. The evaluation pool is exactly the pre\-specified one: 24 test organizations, 2,496 entities \(672 positive\) and 483,912 pairs \(576 positive\)\. Early stopping ended every training run before its epoch cap except 1 \([Table22](https://arxiv.org/html/2610.41085#A4.T22)\)\.

Table 10:Pre\-specified confirmatory tests on the 24 unseen test organizations: the GraIL\-style model’s multi\-hop reach beats one\-step record\-aware rules at 3 and 4 hops and the RDL\-style model beats them at entity level, but the GraIL\-style model does not beat the generator\-aware rules at 2 hops or on the twin pool\. Reference = Rules v2 in every row; one\-sided tests of model−\-Rules v2\>0\>0; paired org\-cluster bootstrap \(1,000 replicates,ppfloor 0\.001\); Holm over the five tests; one\-sidedα=0\.025\\alpha=0\.025; CIs are per\-test \(unadjusted\)\.idpool / groupmetricmodelmodel\[95% CI\]Rules v2\[95% CI\]difference\[95% CI\]ppHolmppoutcomeH1\-h2link, all poolhop 2 \(n\+=n\_\{\+\}\{=\}192\)AUPRCGraIL\-stylek=3k\{=\}30\.442\[0\.400, 0\.497\]0\.650\[0\.585, 0\.716\]−\-0\.208\[−\-0\.262,−\-0\.150\]1\.0001\.000not supportedH1\-h3link, all poolhop 3 \(n\+=n\_\{\+\}\{=\}240\)AUPRCGraIL\-stylek=3k\{=\}30\.501\[0\.462, 0\.549\]0\.081\[0\.066, 0\.098\]\+0\.420\[0\.375, 0\.469\]0\.0010\.005supportedH1\-h4link, all poolhop 4 \(n\+=n\_\{\+\}\{=\}96\)AUPRCGraIL\-stylek=3k\{=\}30\.272\[0\.220, 0\.337\]0\.000\[0\.000, 0\.000\]\+0\.272\[0\.219, 0\.337\]0\.0010\.005supportedH2link, twin pooloverall \(n\+=n\_\{\+\}\{=\}576\)AUROCGraIL\-stylek=3k\{=\}30\.674\[0\.643, 0\.705\]0\.796\[0\.773, 0\.818\]−\-0\.122\[−\-0\.151,−\-0\.094\]1\.0001\.000not supportedH3entity, all pooloverall \(n\+=n\_\{\+\}\{=\}672\)AUPRCRDL\-style\(entity\)0\.752\[0\.719, 0\.784\]0\.698\[0\.669, 0\.728\]\+0\.053\[0\.025, 0\.086\]0\.0020\.006supported

### 8\.2H1 \(confirmatory\): multi\-hop reach beats one\-step rules at 3 and 4 hops

#### H1\-h3 and H1\-h4 are supported\.

For 3\-hop collusion the GraIL\-style model had link AUPRC 0\.501 \[0\.462, 0\.549\] against 0\.081 \[0\.066, 0\.098\] for Rules v2, a difference of \+0\.420 \[0\.375, 0\.469\] \(Holmp=0\.005p=0\.005\)\. For 4\-hop collusion the difference is \+0\.272 \[0\.219, 0\.337\] \(Holmp=0\.005p=0\.005\)\. Rules v2 has 4\-hop AUPRC 0\.000, at chance level: a one\-step rule cannot name a colluder whose link to the new entity passes through an account holder and that holder’s phone\. H1\-h4 therefore checks multi\-hop access relative to a reference with a shorter evidence horizon; H1\-h3 is less so, because Rules v2 names some 3\-hop colluders through the manager or approver edge\. The recorded bootstrap\-tail statistics reach their simulation floor \(0\.001 before adjustment\), not a certified bound on a populationpp\-value\.

#### H1\-h2 is not supported\.

For 2\-hop collusion—where the evidence is a direct identifier match such as a shared account, address or phone—the GraIL\-style model had AUPRC 0\.442 \[0\.400, 0\.497\] against 0\.650 \[0\.585, 0\.716\] for the rules, a difference of−\-0\.208 \[−\-0\.262,−\-0\.150\]\. The one\-sided test cannot show that the rules are better; descriptively they are, and the dev rehearsal had predicted this direction \(−\-0\.034\)\.

#### What the hop\-hhAUPRC measures\.

The hop\-hhpool contains every matched twin as a negative, so a hop\-hhAUPRC mixes two abilities: reaching the colluder and ranking the fraud above its twin\. A detector that reaches every hop\-hhcolluder but cannot tell fraud from twin scores about 0\.5 \([Section5](https://arxiv.org/html/2610.41085#S5)\); the GraIL\-style model’s 0\.501 at 3 hops is at that level\. The exploratory analysis of[Section9](https://arxiv.org/html/2610.41085#S9)separates the two parts\.

[Figure3](https://arxiv.org/html/2610.41085#S8.F3)\(a\) and[Table11](https://arxiv.org/html/2610.41085#S8.T11)put these tests in context\. The pattern is the same for every learned path or subgraph model: NBFNet\-style \(not pre\-specified\) reaches AUPRC 0\.461 at h3 and 0\.154 at h4, the opening\-subgraph model \(not pre\-specified\) 0\.394 and 0\.197\. GraIL\-stylek=2k=2reaches 0\.392 at h3 but only 0\.002 at h4, as expected from theh≤k\+1h\\leq k\+1constraint\. Path features \+ LR, the only non\-GNN multi\-hop model, is limited to paths of length 3 and has 0\.239 at h3 and 0\.001 at h4; a four\-hop non\-GNN reference was absent from this original method set and is supplied by the extension \([Section7](https://arxiv.org/html/2610.41085#S7)\)\. The h1 cell \(a ghost employee whose manager is also the hiring approver; 48 positives\) was not tested\.

h1h2h3h4000\.20\.20\.40\.40\.60\.60\.80\.811AUPRC \(all pairs\)\(a\) Link AUPRC by hoph1h2h3h40\.40\.40\.60\.60\.80\.811AUROC \(twin pool\)\(b\) Twin pool \(fraud vs its twin\), by hop

Rules v2GraIL\-stylek=3k\{=\}3NBFNet\-style†Rules v2 \+ GraIL\-stylek=3k\{=\}3\(lr\)

Figure 3:Original\-stage comparison: subgraph and path GNNs reach distant colluders; the generator\-aware rules are descriptively higher on the twin pool\. \(a\) Link AUPRC per planted hop \(hop\-hhpositives vs all negatives; not comparable across hops\): record\-aware rules beat both GNNs at 2 hops but cannot name a colluder at 4 hops, where the GraIL\-style model is best\. \(b\) On the twin pool \(fraud vs its structurally identical benign twin; dashed line = chance\) the rules lead at every hop except h4\. Exact values: Tables[11](https://arxiv.org/html/2610.41085#S8.T11)and[12](https://arxiv.org/html/2610.41085#S8.T12)\.†Not a pre\-specified primary model\.Table 11:Original\-stage link level, all 483,912 candidate pairs: subgraph and path GNNs lead on 3\- and 4\-hop collusion, record\-aware rules beat every single GNN on 2\-hop collusion, and the rules \+ GraIL\-style combination has the best overall AUPRC within this original method set\. Per\-hop columns compare hop\-hhpositives with all negatives, other\-hop positives excluded \(n\+n\_\{\+\}= 48 / 192 / 240 / 96; chance AUPRC = prevalence, at most 0\.0005\); AUPRC values are not comparable across hops because prevalence differs\. GNN values are seed means±\\pmseed SD; brackets are 95% org\-cluster bootstrap CIs\.†GNN that is not a pre\-specified primary model \(descriptive\)\.methodAUROCAUPRC\[95% CI\]recall at0\.1% FPRAUPRCh1AUPRCh2AUPRCh3AUPRCh4Rules tuned0\.7650\.237\[0\.222, 0\.253\]0\.4340\.0840\.4950\.0200\.000Rules v2 \(record\-aware\)0\.8080\.347\[0\.321, 0\.376\]0\.4290\.3240\.6500\.0810\.000Personalized PageRank0\.9930\.093\[0\.090, 0\.100\]0\.0570\.0700\.0470\.0370\.006Path features \+ LR0\.9810\.295\[0\.281, 0\.315\]0\.5300\.0510\.1770\.2390\.001RDL\-style \(link\)†0\.9530\.082±\\pm0\.023\[0\.075, 0\.092\]0\.1480\.0140\.0780\.0210\.011GraIL\-stylek=2k\{=\}2†0\.9790\.473±\\pm0\.012\[0\.456, 0\.493\]0\.7890\.0360\.4240\.3920\.002GraIL\-stylek=3k\{=\}30\.9990\.663±\\pm0\.071\[0\.630, 0\.698\]0\.9060\.1400\.4420\.5010\.272NBFNet\-style†0\.9990\.673±\\pm0\.017\[0\.645, 0\.698\]0\.9360\.3860\.5180\.4610\.154Opening\-subgraph \(OSFA\-insp\.\)†0\.9990\.584±\\pm0\.033\[0\.559, 0\.617\]0\.9000\.0450\.3710\.3940\.197Rules v2 \+ GraIL\-stylek=3k\{=\}3\(lr\)1\.0000\.735±\\pm0\.026\[0\.711, 0\.763\]0\.9610\.2010\.7300\.4370\.190Rules v2 \+ NBFNet\-style†\(lr\)0\.9990\.626±\\pm0\.111\[0\.605, 0\.648\]0\.9100\.2220\.4810\.4090\.164

### 8\.3H2 \(confirmatory\): graph models do not read control records better than generator\-aware rules

#### H2 is not supported\.

On the twin pool—the 576 planted fraud pairs and their 576 structurally identical benign twins—the GraIL\-style model has AUROC 0\.674 \[0\.643, 0\.705\] and Rules v2 0\.796 \[0\.773, 0\.818\], a difference of−\-0\.122 \[−\-0\.151,−\-0\.094\]\. Topology cannot help here: a method can only rank a fraud above its twin by reading the declaration, authorization, verification, approval and activity records\. The test was one\-sided, so its failure shows only that the GNN did not beat the rules; descriptively, the rules are higher\. Two features of the design favour the rules on this test: Rules v2 was written knowing which record types the generator emits, and the GNN hyperparameters were fixed on generator v1 and never tuned for v2\. The comparison is therefore between generator\-aware rules and untuned GNNs, and the result is conditional on the generator\-informed rule specification, not a performance bound for other analysts\.

The descriptive pattern holds beyond the pre\-specified model \([Table12](https://arxiv.org/html/2610.41085#S8.T12); unadjusted CIs\)\. The paired\-difference CI lies below zero for 13 of 13 other single link methods and for 10 of 10 rules \+ GNN combinations\. The highest learned single model on the twin pool is the RDL\-style link model \(not pre\-specified\) \(0\.738,Δ=\\Delta=\{\}−\-0\.058\[−\-0\.080,−\-0\.034\]\), whose node\-wise embeddings are weak at finding the candidate \(overall AUPRC 0\.082\) but encode the entity’s own records\. Structure\-only heuristics are at chance \([Table25](https://arxiv.org/html/2610.41085#A5.T25)\)\.[Figure3](https://arxiv.org/html/2610.41085#S8.F3)\(b\) shows that the rules lead at h1–h3 and that the GraIL\-style model is level with or above them only at h4 \(0\.803 vs\. 0\.780\), a descriptive per\-hop view\. At entity level the gap disappears: on the entity twin pool the pre\-specified RDL\-style entity model has a close point estimate to the rules \([Section8\.4](https://arxiv.org/html/2610.41085#S8.SS4)\)\.

Table 12:Twin pool \(each of the 576 planted fraud pairs against its structurally identical benign twin, 1,152 pairs in all\): no learned link model separates fraud from its twin as well as the generator\-aware Rules v2 \(descriptive except for the GraIL\-stylek=3k\{=\}3row, which is H2\)\. Per\-hop columns compare same\-hop positives and twins;Δ\\Deltais the paired difference against Rules v2 with an unadjusted 95% CI\.†GNN that is not a pre\-specified primary model \(descriptive\)\.methodtwin AUROC\[95% CI\]h1h2h3h4Δ\\Deltavs Rules v2\[95% CI\]Rules tuned0\.547\[0\.537, 0\.555\]0\.7800\.5010\.5470\.502−\-0\.250\[−\-0\.269,−\-0\.230\]Rules v2 \(record\-aware\)0\.796\[0\.773, 0\.818\]0\.8930\.8180\.7760\.780–Path features \+ LR0\.619\[0\.602, 0\.637\]0\.8290\.6290\.6440\.742−\-0\.177\[−\-0\.201,−\-0\.151\]Personalized PageRank0\.501\[0\.496, 0\.507\]0\.4750\.4990\.5040\.503−\-0\.295\[−\-0\.317,−\-0\.271\]RDL\-style \(link\)†0\.738±\\pm0\.005\[0\.715, 0\.764\]0\.8560\.7430\.7200\.718−\-0\.058\[−\-0\.080,−\-0\.034\]GraIL\-stylek=2k\{=\}2†0\.573±\\pm0\.006\[0\.559, 0\.588\]0\.7480\.5920\.6090\.740−\-0\.224\[−\-0\.244,−\-0\.202\]GraIL\-stylek=3k\{=\}30\.674±\\pm0\.057\[0\.643, 0\.705\]0\.7800\.6410\.6900\.803−\-0\.122\[−\-0\.151,−\-0\.094\]NBFNet\-style†0\.668±\\pm0\.025\[0\.642, 0\.691\]0\.8480\.6760\.6920\.549−\-0\.129\[−\-0\.152,−\-0\.103\]Opening\-subgraph \(OSFA\-insp\.\)†0\.635±\\pm0\.030\[0\.611, 0\.663\]0\.8740\.6120\.6480\.713−\-0\.161\[−\-0\.187,−\-0\.131\]Rules v2 \+ GraIL\-stylek=3k\{=\}3\(lr\)0\.763±\\pm0\.036\[0\.742, 0\.783\]0\.8390\.8130\.7360\.828−\-0\.034\[−\-0\.047,−\-0\.019\]Rules v2 \+ RDL\-style \(link\)†\(lr\)0\.772±\\pm0\.003\[0\.751, 0\.794\]0\.8630\.8160\.7350\.729−\-0\.025\[−\-0\.039,−\-0\.010\]

### 8\.4H3 \(confirmatory\): an entity\-level GNN ranks fraudulent new entities higher

#### H3 is supported\.

Over all 2,496 unseen entities, the RDL\-style entity model has AUPRC 0\.752 \[0\.719, 0\.784\] against 0\.698 \[0\.669, 0\.728\] for Rules v2, a difference of \+0\.053 \[0\.025, 0\.086\] \(Holmp=0\.006p=0\.006\)\. The gain survives removing the 96 SoD conflicts from the positives \(exploratory;Δ=\\Delta=\{\}\+0\.052\[0\.021, 0\.088\];[Table18](https://arxiv.org/html/2610.41085#S9.T18)\)\. Link models aggregated by the maximum over candidates are weaker at entity level \(GraIL\-style 0\.612\), mainly because they cannot see the entity\-only SoD conflict\.

On the entity twin pool the comparison did not establish a gain \(secondary S3\): RDL\-style has twin AUROC 0\.821 against 0\.817 for the rules, a difference of \+0\.004 \[−\-0\.013, 0\.023\]\. The entity GNN is therefore better at*ranking*across all entities, which combines many weak cues, but not at reading the records of a given fraud–twin pair\. The pre\-specified combination Rules v2 \+ RDL\-style \(lr\) reaches entity AUPRC 0\.792 \(descriptive\)\. Two models that were not pre\-specified are higher still: the R\-GCN entity model \(0\.776 \[0\.744, 0\.808\]\) and its combination with the rules \(0\.801\); we report them without inference\. Low\-FPR entity recall remains modest for every method: at 1% FPR the rules recover 0\.104 of fraudulent entities and the RDL\-style model 0\.197 \(±\\pm0\.060 across seeds\)\.

Table 13:Entity level \(2,496 unseen new hires and vendors, 672 planted, 26\.9% prevalence by design\): the pre\-specified RDL\-style entity model ranks fraudulent entities above record\-aware rules, but on the twin pool it has a close point estimate to the rules; combining the rules with an entity GNN helps on both views \(descriptive\)\. Link models are aggregated by the maximum over candidates\.†GNN that is not a pre\-specified primary model \(descriptive\)\.methodAUROCAUPRC\[95% CI\]recall at1% FPRrecall at5% FPRtwinAUROCtwinΔ\\DeltavsRules v2 \[95% CI\]Rules severity0\.7580\.486\[0\.475, 0\.499\]0\.0100\.1240\.564−\-0\.253\[−\-0\.271,−\-0\.234\]Rules v2 \(record\-aware\)0\.8720\.698\[0\.669, 0\.728\]0\.1040\.3870\.817–Path features \+ LR0\.8760\.725\[0\.692, 0\.757\]0\.1920\.4630\.815−\-0\.002\[−\-0\.021, 0\.018\]RDL\-style \(entity\)0\.8900\.752±\\pm0\.018\[0\.719, 0\.784\]0\.1970\.5240\.821\+0\.004\[−\-0\.013, 0\.023\]R\-GCN \(entity\)†0\.9000\.776±\\pm0\.015\[0\.744, 0\.808\]0\.2330\.5460\.821\+0\.004\[−\-0\.017, 0\.025\]RDL\-style \(link\)†0\.7800\.638±\\pm0\.016\[0\.614, 0\.665\]0\.1200\.3810\.718−\-0\.099\[−\-0\.114,−\-0\.080\]GraIL\-stylek=3k\{=\}30\.7820\.612±\\pm0\.060\[0\.584, 0\.641\]0\.1000\.3390\.631−\-0\.186\[−\-0\.208,−\-0\.162\]NBFNet\-style†0\.7910\.621±\\pm0\.017\[0\.596, 0\.643\]0\.1290\.3090\.624−\-0\.193\[−\-0\.213,−\-0\.172\]Rules v2 \+ RDL\-style \(entity\) \(lr\)0\.9140\.792±\\pm0\.004\[0\.763, 0\.822\]0\.2660\.5670\.844\+0\.027\[0\.019, 0\.037\]Rules v2 \+ R\-GCN \(entity\)†\(lr\)0\.9210\.801±\\pm0\.004\[0\.769, 0\.832\]0\.2870\.6030\.847\+0\.030\[0\.019, 0\.041\]

### 8\.5Secondary: the strongest combination within the original method set

The pre\-specified secondary comparisons \([Table14](https://arxiv.org/html/2610.41085#S8.T14)\) are descriptive\. The two\-feature logistic combination of Rules v2 and the GraIL\-style model has the highest overall link AUPRC of the 24 original\-stage link methods \(0\.735\), above Rules v2 \(0\.347;Δ=\\Delta=\{\}\+0\.388\[0\.364, 0\.412\]\) and above the GraIL\-style model alone \(0\.663;Δ=\\Delta=\{\}\+0\.072\[0\.047, 0\.099\]\)\. It inherits the rules’ strength at h2 \(AUPRC 0\.730, the best h2 value of any method\) but gives up part of the GNN’s advantage at h3 \(0\.437 vs\. 0\.501\) and h4 \(0\.190 vs\. 0\.272\); on the twin pool it reaches 0\.763, still below the rules alone\.

Table 14:Pre\-specified secondary comparisons \(descriptive, outside the Holm family, unadjusted CIs\): the rules \+ GraIL\-style logistic combination has the highest overall link AUPRC within the original method set, above both of its inputs, and the RDL\-style entity model has a close point estimate to the rules on the entity twin pool\.idpool / groupmetricmethodvaluereferencevaluedifference \[95% CI\]one\-sidedpp\(unadjusted\)S1alink, all, overallAUPRCRules v2 \+GraIL\-stylek=3k\{=\}3\(lr\)0\.735Rules v20\.347\+0\.388\[0\.364, 0\.412\]0\.001S1blink, all, overallAUPRCRules v2 \+GraIL\-stylek=3k\{=\}3\(lr\)0\.735GraIL\-stylek=3k\{=\}30\.663\+0\.072\[0\.047, 0\.099\]0\.001S2link, all, overallAUPRCGraIL\-stylek=3k\{=\}30\.663Rules v20\.347\+0\.316\[0\.274, 0\.355\]0\.001S3entity, twin pool, overallAUROCRDL\-style\(entity\)0\.821Rules v20\.817\+0\.004\[−\-0\.013, 0\.023\]0\.348

### 8\.6Further descriptive results

#### Low\-FPR link recall is saturated, as pre\-specified\.

9 of the 24 link methods recall at least 99% of the positives at 1% FPR \([Table23](https://arxiv.org/html/2610.41085#A5.T23)\), including the GraIL\-style model \(0\.997\)\. At 0\.1% FPR the measure is still informative: GraIL\-style 0\.906 against 0\.429 for the rules\.

#### Graph heuristics\.

Personalized PageRank has the highest AUROC of any non\-learned method \(0\.993\) but AUPRC 0\.093: it finds the neighbourhood of the colluder but not the colluder\.

#### Per audit test\.

[Table29](https://arxiv.org/html/2610.41085#A5.T29)gives link AUPRC per audit test\. Rules v2 is strongest on the two tests whose evidence is usually an edge the rules can read directly—ghost employee \(0\.474\) and approver–payee link \(0\.409\)—and weakest on shared payroll accounts \(0\.099\), bank\-detail changes before a run \(0\.100\) and employee–vendor links \(0\.125\), where half or more of the planted chains are 3 or 4 hops long\. The GraIL\-style model reverses that ordering \(employee–vendor 0\.466, ghost 0\.231\)\. These per\-test and per\-pattern cells \([Tables28](https://arxiv.org/html/2610.41085#A5.T28)and[30](https://arxiv.org/html/2610.41085#A5.T30)\) are exploratory and have different prevalences\.

#### Seed variance\.

The pre\-specified GraIL\-style model has a seed SD of 0\.071 in overall link AUPRC\. The organization bootstrap does not include seed variance; the reported CIs are for the seed\-mean metric and are conditional on these 3 seeds \([Section11](https://arxiv.org/html/2610.41085#S11)\)\.

Table 15:Every confirmatory outcome matched the direction recorded from the dev rehearsal before the freeze \(dev: 4 held\-out dev organizations; test: 24 unseen test organizations\)\.iddev difference \(point\)dev direction\>0\>0test difference \[95% CI\]test outcomeH1\-h2−\-0\.034no−\-0\.208 \[−\-0\.262,−\-0\.150\]not supportedH1\-h3\+0\.405yes\+0\.420 \[0\.375, 0\.469\]supportedH1\-h4\+0\.286yes\+0\.272 \[0\.219, 0\.337\]supportedH2−\-0\.061no−\-0\.122 \[−\-0\.151,−\-0\.094\]not supportedH3\+0\.087yes\+0\.053 \[0\.025, 0\.086\]supported

## 9Exploratory Post\-hoc Analyses

Every analysis in this section is exploratory and was not pre\-specified\. The analyses were run after the confirmatory report, on the frozen score files of the confirmatory run and the test\-organization ground truth, with no model trained or re\-run, and none replaces a pre\-specified result; all CIs here are unadjusted\. Recomputing the confirmatory values from the score files reproduced the report to within1\.5×10−51\.5\\times 10^\{\-5\}in AUPRC\.

#### Seeds\.

For each of the 5 pre\-specified tests, the difference has the same sign for every GNN seed as for the seed mean \([Table17](https://arxiv.org/html/2610.41085#S9.T17)\); for example, H1\-h4 ranges from \+0\.130 to \+0\.378 across seeds and H2 from−\-0\.185 to−\-0\.074\.

#### Reach without the twins\.

Removing the matched twins of all hops from the negatives leaves a pool in which a method has to find the colluder among all other candidate pairs, including the other hand\-built hard negatives, but never has to order a fraud against its twin\. There the GraIL\-style model reaches link AUPRC 0\.982, 0\.995 and 0\.989 at hops 2, 3 and 4, against 0\.854, 0\.180 and 0\.000 for Rules v2 \(paired differences \+0\.127 \[0\.082, 0\.177\], \+0\.815 \[0\.798, 0\.833\] and \+0\.988 \[0\.969, 0\.999\]; unadjusted\)\. The subgraph and path GNNs find nearly every planted colluder at hops 2–4 \(GraIL\-stylek=2k=2excepted at 4 hops, outside its radius\), so their loss on H1\-h2 and their sub\-ceiling AUPRC at 3 and 4 hops come from ordering frauds against their twins\. At hop 1 the rules lead \(reach 0\.833 against 0\.562 for the GraIL\-style model\)\. Two caveats apply: Rules v2’s reach values still include its record exemptions, so they mix reach and reading; and because a twin copies its fraud’s planting side\-effects, near\-perfect GNN reach may partly reflect chain shapes that are rare in the generated background rather than a general ability to follow multi\-hop relations\. Path features \+ LR, limited to length\-3 paths, reaches 0\.336 at h3 and 0\.001 at h4\.

#### More look\-alikes per fraud\.

The generator plants one benign twin per fraud \(look\-alike ratio 1\)\. Counting each twin of every hopwwtimes among the negatives is a deterministic stress test for a higher ratio: the duplicated twins keep their scores exactly, which is not the same as sampling new look\-alikes\. Newly sampled look\-alikes would also vary in their records, so the proxy may be optimistic or pessimistic for a given method; its direction is unknown\. Atw=8w=8the GraIL\-style model’s AUPRC falls to 0\.126 at h3 and 0\.050 at h4, and Rules v2 to 0\.018 and 0\.000 \([Table16](https://arxiv.org/html/2610.41085#S9.T16)\)\. The sign of the H1\-h3 and H1\-h4 differences is unchanged at every weight, but the absolute AUPRC values of the confirmatory test depend strongly on the planted ratio and should not be read as deployment precision\.

#### Lower entity base rates\.

Fraud prevalence among the new entities is 26\.9% by design, and 67% of the 1,824 entity negatives are matched twins \(672\) or other hand\-built hard negatives \(552\); only 600 are ordinary\. We lowered the prevalence in two ways \([Table18](https://arxiv.org/html/2610.41085#S9.T18)\)\. Scaling all negatives keeps that look\-alike share and supplies one fixed\-score scenario: at 1% prevalence entity AUPRC falls to 0\.089 for Rules v2 and 0\.119 for the RDL\-style model\. Scaling only ordinary negatives supplies a different mixture scenario: at 1% the rules keep 0\.538 and the RDL\-style model has 0\.393, and at 0\.1% 0\.518 against 0\.269\. The entity\-level ranking of H3 therefore depends on what the additional benign entities look like; these scenarios are not estimates of real rates or mixtures\.

#### Within\-pair concordance\.

The cleanest view of record reading compares each planted fraud with its own twin\. The share of frauds scored above their twin is 0\.820 \[0\.792, 0\.847\] for Rules v2 and 0\.728 \[0\.694, 0\.762\] for the GraIL\-style model at link level \(Δ=\\Delta=\{\}−\-0\.092 \[−\-0\.119,−\-0\.066\]\), and every single GNN is below the rules \([Table19](https://arxiv.org/html/2610.41085#S9.T19)\); at entity level the observed estimates are close, without an equivalence test \(0\.831 against 0\.830\)\. This agrees with H2 and S3\.

#### H3 without SoD conflicts\.

Removing the 96 SoD conflicts but keeping their twins as negatives gives an RDL\-style gain of \+0\.052 \[0\.021, 0\.088\]; removing the twins as well gives \+0\.073 \[0\.045, 0\.106\] \([Table18](https://arxiv.org/html/2610.41085#S9.T18)shows the first variant\)\.

Table 16:Exploratory, post hoc: with the matched twins of all hops removed from the negatives \(“reach”; the other hand\-built hard negatives stay\), the GraIL\-stylek=3k\{=\}3, NBFNet\-style and opening\-subgraph models find almost every planted colluder at hops 2–4 \(GraIL\-stylek=2k\{=\}2cannot see 4 hops\) but not at hop 1, while one\-step Rules v2 finds mainly 1\- and 2\-hop colluders\. When each twin of every hop countswwtimes among the negatives \(a deterministic stress test: duplicated twins keep their scores\) the AUPRC of these models falls steeply, but their lead over the rules at 3 and 4 hops keeps its sign\.w=1w\{=\}1is the confirmatory pool; GNN values are seed means; no CIs\.†GNN that is not a pre\-specified primary model \(descriptive\)\.reach \(twins removed\)h3, twin weightwwh4, twin weightwwmethodh1h2h3h4all148148Rules v20\.8330\.8540\.1800\.0000\.4310\.0810\.0320\.0180\.0000\.0000\.000PPR0\.0760\.0530\.0410\.0060\.1030\.0370\.0280\.0210\.0060\.0050\.004Path features \+ LR0\.0810\.2430\.3360\.0010\.3800\.2390\.1290\.0810\.0010\.0010\.001GraIL\-stylek=2k\{=\}2†0\.4870\.9650\.9840\.0030\.8090\.3920\.1430\.0770\.0020\.0020\.002GraIL\-stylek=3k\{=\}30\.5620\.9820\.9950\.9890\.9810\.5010\.2150\.1260\.2720\.0930\.050NBFNet\-style†0\.7780\.9910\.9860\.9580\.9890\.4610\.2210\.1480\.1540\.0450\.023OSFA\-insp\.†0\.5430\.9560\.9630\.9710\.9720\.3940\.1480\.0830\.1970\.0590\.030RDL\-style \(link\)†0\.0140\.0800\.0210\.0110\.0840\.0210\.0190\.0180\.0110\.0100\.009Rules v2 \+ GraIL\-stylek=3k\{=\}3\(lr\)0\.8160\.9960\.9950\.9880\.9900\.4370\.1660\.0910\.1900\.0570\.030

Table 17:Exploratory, post hoc: every pre\-specified difference has the same sign for each of the 3 GNN seeds as for the seed mean \(point values only; per\-seed tests were not run\)\. Confirmatory test pool, recomputed from the frozen score files; Rules v2 is deterministic\.model, seeddifference, seedtestmetricRules v2913191329133913191329133seed meanH1\-h2AUPRC0\.6500\.5210\.3920\.412−\-0\.129−\-0\.258−\-0\.238−\-0\.208H1\-h3AUPRC0\.0810\.5040\.4270\.571\+0\.424\+0\.346\+0\.490\+0\.420H1\-h4AUPRC0\.0000\.3790\.1300\.308\+0\.378\+0\.130\+0\.307\+0\.272H2AUROC0\.7960\.7220\.6110\.689−\-0\.074−\-0\.185−\-0\.108−\-0\.122H3AUPRC0\.6980\.7470\.7710\.737\+0\.049\+0\.073\+0\.039\+0\.053

Table 18:Exploratory, post hoc: entity\-level AUPRC at lower fraud prevalence depends on what the added negatives look like\. Scaling all negatives \(hard\-negative mix fixed: 67% twins and hand\-built hard negatives\) is a pessimistic stress test under which AP decreases for every listed method; scaling only the 600 ordinary negatives keeps most of the rules’ AUPRC and reverses the ranking in their favour\. The RDL\-style gain over Rules v2 survives removing the 96 SoD conflicts \(control deficiencies\)\. Observed prevalence 26\.9%; base\-rate columns have no CIs; brackets are unadjusted org\-cluster bootstrap CIs\.†GNN that is not a pre\-specified primary model \(descriptive\)\.all negatives scaledordinary scaledwithout SoD conflictsmethodobserved1%0\.1%1%0\.1%AUPRC \[95% CI\]Δ\\Deltavs Rules v2Rules severity0\.4860\.0270\.003––––Rules v20\.6980\.0890\.0120\.5380\.5180\.667\[0\.633, 0\.700\]–Path features \+ LR0\.7250\.0920\.0120\.3890\.2820\.681\[0\.642, 0\.717\]\+0\.014\[−\-0\.015, 0\.047\]RDL\-style \(entity\)0\.7520\.1190\.0280\.3930\.2690\.719\[0\.681, 0\.754\]\+0\.052\[0\.021, 0\.088\]R\-GCN \(entity\)†0\.7760\.1470\.0220\.4180\.2440\.740\[0\.704, 0\.777\]\+0\.074\[0\.041, 0\.111\]Rules v2 \+ RDL\-style \(entity\) \(lr\)0\.7920\.1320\.0200\.5900\.4810\.766\[0\.730, 0\.800\]\+0\.099\[0\.082, 0\.116\]Rules v2 \+ R\-GCN \(entity\)†\(lr\)0\.8010\.1340\.0180\.6060\.498––

Table 19:Exploratory, post hoc: within\-pair concordance, the share of planted frauds scored above their own matched twin \(ties count half; 576 link pairs, 672 entity pairs\)\. At link level every single GNN is below the generator\-aware Rules v2 and the rules \+ GraIL\-style combination has a close point estimate; at entity level GNN point estimates are close to the rules and the combinations are above them\. Seed means; brackets are unadjusted org\-cluster bootstrap CIs\.†GNN that is not a pre\-specified primary model \(descriptive\)\.methodconcordance\[95% CI\]h1h2h3h4Δ\\Deltavs Rules v2\[95% CI\]Rules v20\.820\[0\.792, 0\.847\]0\.8850\.8390\.7960\.812–PPR0\.503\[0\.470, 0\.536\]0\.4790\.4790\.5250\.510−\-0\.317\[−\-0\.354,−\-0\.280\]Path features \+ LR0\.735\[0\.701, 0\.770\]0\.7920\.6980\.6920\.891−\-0\.085\[−\-0\.115,−\-0\.051\]RDL\-style \(link\)†0\.759\[0\.736, 0\.786\]0\.8820\.7330\.7330\.816−\-0\.061\[−\-0\.087,−\-0\.032\]GraIL\-stylek=2k\{=\}2†0\.684\[0\.650, 0\.718\]0\.7640\.6390\.6780\.750−\-0\.136\[−\-0\.168,−\-0\.104\]GraIL\-stylek=3k\{=\}30\.728\[0\.694, 0\.762\]0\.8120\.6650\.7250\.819−\-0\.092\[−\-0\.119,−\-0\.066\]NBFNet\-style†0\.697\[0\.666, 0\.726\]0\.8610\.7150\.6940\.583−\-0\.124\[−\-0\.155,−\-0\.090\]OSFA\-insp\.†0\.696\[0\.663, 0\.730\]0\.8890\.6460\.6720\.760−\-0\.124\[−\-0\.149,−\-0\.099\]Rules v2 \+ GraIL\-stylek=3k\{=\}3\(lr\)0\.819\[0\.786, 0\.853\]0\.8750\.8300\.7900\.844−\-0\.001\[−\-0\.019, 0\.018\]entity: Rules v20\.830\[0\.800, 0\.856\]0\.8850\.8360\.7920\.812–entity: Path features \+ LR0\.857\[0\.827, 0\.882\]0\.8540\.8100\.8540\.922\+0\.028\[0\.005, 0\.053\]entity: RDL\-style \(entity\)0\.831\[0\.804, 0\.860\]0\.8610\.7880\.8290\.875\+0\.002\[−\-0\.024, 0\.029\]entity: R\-GCN \(entity\)†0\.845\[0\.818, 0\.872\]0\.8890\.8090\.8430\.896\+0\.016\[−\-0\.003, 0\.036\]entity: Rules v2 \+ RDL\-style \(entity\) \(lr\)0\.858\[0\.829, 0\.883\]0\.8820\.8280\.8530\.889\+0\.029\[0\.013, 0\.045\]entity: Rules v2 \+ R\-GCN \(entity\)†\(lr\)0\.865\[0\.839, 0\.891\]0\.9030\.8470\.8560\.896\+0\.035\[0\.024, 0\.047\]

## 10Discussion

### 10\.1Multi\-hop discovery is an information\-access advantage

The comparison separates direct\-record checks from methods that combine several relations\. In the original study, GraIL\-style exceeded one\-step rules at three and four hops\. The extension supplied the non\-GNN control: a chained\-join query reached four\-hop candidates, and tuned boosting on typed paths exceeded the evaluated GNNs\. At four hops its AP was 0\.646, versus 0\.272 for GraIL\-style\. The original contrast therefore identifies multi\-hop access relative to the implemented one\-step rules, rather than a benefit unique to neural message passing\.

Both graph and relational\-query methods can follow records linked through account holders, representatives, contacts and identifiers\. GADBench’s tree\-ensemble result\[[49](https://arxiv.org/html/2610.41085#bib.bib55)\]concerns anomalous nodes in other datasets; the present evidence adds organization\-held\-out relations and matched benign counterparts\. The contribution is the task, controls and decomposition of measured behavior, not a universal algorithm\-family ranking\.

### 10\.2Record discrimination is separate from finding a chain

On matched twins, the original GraIL\-style model had AUROC 0\.674 against 0\.796 for generator\-informed Rules v2\. With generic rules as reference, the difference was \+0\.007 with interval \[−\-0\.020, \+0\.033\]\. This comparison did not establish a difference in either direction; no equivalence margin or equivalence test was specified\.

Rule specification matters, but the comparison does not isolate analyst knowledge: weights, exemptions and logic also change, and both rule sets were authored with knowledge of the generator\. The extension protocol retained explanations beyond generator knowledge for this outcome\. In the full method set, boosting achieved twin AUROC 0\.853, above Rules v2’s 0\.796\. Thus rules are not necessarily the best record\-reading layer; connectivity alone is insufficient, and multiple method classes can use record features\.

### 10\.3Review priorities depend on the cohort

At the new cohort’s 2\.0% positive rate, RDL\-style achieved entity AP 0\.707 against 0\.504 for Rules v2\. At a 2% review budget, their precisions were 0\.695 and 0\.602; boosting achieved 0\.735\. These operating points connect ranking to a defined review workload rather than equating AUROC with a useful shortlist\.

The cohorts differ in organization size, new\-entity counts, benign composition and training data as well as prevalence\. Their comparison does not identify prevalence as the sole cause of the changed gap\. Re\-weighting holds written scores fixed; the new cohort evaluates methods retrained on a different synthetic population\. Neither estimates real payroll\-fraud prevalence or deployment precision\.

### 10\.4Identity noise changes the useful representation

Failed joins weaken explicit paths because a missing join can interrupt an evidence chain\. At 40% split noise, boosting’s four\-hop AP declined from 0\.646 to 0\.116\. The entity GNN retained more entity\-ranking performance: AP 0\.712, versus boosting’s 0\.683\. This is a descriptive contrast under the specified perturbation, not superiority under every identity\-error process\.

Explicit paths are strong on the resolved graphs evaluated here; node\-wise aggregation supplies a complementary reference when joins fail\. The perturbations are splits and missing records, not false merges, free\-text matching or an estimated operational error distribution\.

### 10\.5Practical implications and transferable audit checks

Method selection should compare candidate retrieval, discrimination using control records, and ranking under an actual review budget\. A cascade using different methods for retrieval and final assessment is a possible design, but was not evaluated end to end here\.

For benchmark construction, attribute\-free audits, matched benign controls, univariate screens and metric\-saturation checks make shortcuts visible\. The v1\-to\-v2 audit demonstrates one correction: initial high scores reflected the planting procedure, while the revised twin pool requires control\-record discrimination\. Independent generators and case data would test the transfer of that diagnostic pattern\.

## 11Study Scope, Reproducibility and Responsible Use

#### Population and target\.

Both cohorts are synthetic outputs of the same HR/ERP generator\. Testing on new organizations measures transfer within that mechanism, not to a new schema or an independently sampled payroll population\. Positive labels denote planted cases; the original entity task also includes SoD control deficiencies, with an exploratory exclusion analysis\. The 26\.9% and 2\.0% positive rates and one\-twin\-per\-case ratio are study parameters, not estimates of real\-world prevalence\. Operational misconduct determinations require evidence beyond a screening score\.

#### Implementation and selection\.

The GNNs are the feature\-augmented style implementations specified in[Section6](https://arxiv.org/html/2610.41085#S6), not original\-system reproductions\. Their hyperparameters remained fixed from generator\-v1 development; extension GBDTs were validation\-tuned\. Results compare these implemented procedures, not algorithm families under equal tuning effort\. Rules v2 is a generator\-informed reference, not an upper bound on other analysts or rule systems\. Typed path features also use schema knowledge\.

#### Evidence and uncertainty\.

[Table4](https://arxiv.org/html/2610.41085#S6.T4)separates original testing, exploratory analyses, reused\-test extensions and the new synthetic cohort\. Both prospective protocols are internal freezes; no public registry identifier is asserted\. All five original and nine extension decisions are retained\. Organization\-bootstrap intervals condition on fitted models and the 3 recorded seeds; they do not include all training or generator variability\. GraIL\-style’s overall seed SD was 0\.071\. Non\-family intervals and per\-pattern cells are descriptive\. The recorded bootstrap\-tail decision convention is approximate, not an exact randomization test; Holm adjustment does not independently validate its calibration\. Unsupported directional hypotheses do not establish equivalence\.

#### Perturbations and operating points\.

The identity experiments model failed joins and missing records, not false merges or a measured operational linkage process\[[13](https://arxiv.org/html/2610.41085#bib.bib45)\]\. Noise results use fixed perturbation realizations\. Budget precision describes the synthetic cohort and tie\-handling rule, not projected deployment yield\. Re\-weighted AP is a fixed\-score sensitivity analysis rather than a newly sampled cohort\.

#### Run provenance\.

Original and extension runs verified code/data checksums and wrote separate outputs\. The archived history distinguishes design changes, superseded exports, exploratory work and test reuse \([AppendixA](https://arxiv.org/html/2610.41085#A1)\)\. Changing CPU threads altered retrained NBFNet\-style scores \(clean AP 0\.688 versus 0\.673\); the RDL\-style check reproduced its written scores\. Original outputs remain unchanged\. This supports an auditable specification, without asserting bitwise identity across all training environments\.

#### Responsible application\.

No real employee or customer data are used; no person is evaluated for hiring, promotion or performance\. Shared addresses, family contacts and joint accounts can be legitimate\. Operational applications should treat signals as review leads, retain human decisions, protect personal data and validate population\-specific error rates\. The contribution is a controlled comparison and audit procedure, not an automated finding of wrongdoing\.

## 12Conclusion

We evaluated inductive payroll\-fraud screening through employee–payee link discovery, record discrimination and review prioritization\. The synthetic HR/ERP design combines unseen organizations, complete planted labels, typed evidence chains and benign twins, with organization\-level paired analyses and preserved stage provenance\.

On the resolved graphs, a tuned GBDT on chained\-join features achieved the strongest overall link ranking \(AP 0\.823, versus 0\.663 for GraIL\-style\) and highest measured twin discrimination\. The original GNN advantage over one\-step rules at three and four hops is a multi\-hop evidence advantage, not a GNN\-specific result\. On the new cohort with 2\.0% positive entities, boosting again led; the entity GNN also exceeded record\-aware rules in AP \(0\.707 versus 0\.504\) and precision at a 2% review budget \(0\.695 versus 0\.602\)\. At 40% failed joins, that GNN ranked above boosting in the evaluated condition \(AP 0\.712 versus 0\.683, descriptively\)\.

A graph benchmark must distinguish finding a planted chain from interpreting the records that make it suspicious\. Structure\-only audits exposed an initial shortcut; matched twins supplied a direct control for that channel\. These results provide reproducible evidence for comparing relational screening under explicit data, training and review conditions\. Balanced tuning, independently sourced cases and richer identity\-error processes are the next validation targets\.

#### Artifact availability\.

Generators, synthetic datasets and run records are available from the authors on request\.

## References

- \[1\]L\. A\. Adamic and E\. Adar\(2003\)Friends and neighbors on the Web\.Social Networks25\(3\),pp\. 211–230\.External Links:[Document](https://dx.doi.org/10.1016/S0378-8733%2803%2900009-1)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px2.p1.1)\.
- \[2\]M\. G\. Alles, A\. Kogan, and M\. A\. Vasarhelyi\(2008\)Putting Continuous Auditing Theory into Practice: Lessons from Two Pilot Implementations\.Journal of Information Systems22\(2\),pp\. 195–214\.External Links:[Document](https://dx.doi.org/10.2308/jis.2008.22.2.195)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px1.p1.1)\.
- \[3\]E\. Altman, J\. Blanuša, L\. von Niederäusern, B\. Egressy, A\. Anghel, and K\. Atasu\(2023\)Realistic Synthetic Financial Transactions for Anti\-Money Laundering Models\.External Links:2306\.16424,[Link](https://arxiv.org/abs/2306.16424)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px3.p1.1)\.
- \[4\]Association of Certified Fraud Examiners\(2024\)Occupational Fraud 2024: A Report to the Nations\.Note:Association of Certified Fraud Examiners, Austin, TXExternal Links:[Link](https://www.acfe.com/fraud-resources/report-to-the-nations-archive)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px1.p1.1)\.
- \[5\]H\. A\. Bukhori and R\. Munir\(2023\)Inductive Link Prediction Banking Fraud Detection System Using Homogeneous Graph\-Based Machine Learning Model\.In2023 IEEE 13th Annual Computing and Communication Workshop and Conference \(CCWC\),pp\. 246–251\.External Links:[Document](https://dx.doi.org/10.1109/ccwc57344.2023.10099180)Cited by:[Appendix B](https://arxiv.org/html/2610.41085#A2.p1.1),[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px2.p1.1)\.
- \[6\]D\. Cheng, Y\. Zou, S\. Xiang, and C\. Jiang\(2024\)Graph Neural Networks for Financial Fraud Detection: A Review\.Note:Frontiers of Computer Science 2025External Links:2411\.05815,[Link](https://arxiv.org/abs/2411.05815)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px3.p1.1)\.
- \[7\]Committee of Sponsoring Organizations of the Treadway Commission \(COSO\)\(2013\)Internal control—integrated framework\.Note:COSO[https://www\.coso\.org/guidance\-on\-ic](https://www.coso.org/guidance-on-ic)Cited by:[§1](https://arxiv.org/html/2610.41085#S1.p1.1)\.
- \[8\]J\. Davis and M\. Goadrich\(2006\)The relationship between Precision\-Recall and ROC curves\.InProceedings of the 23rd International Conference on Machine Learning \(ICML ’06\),pp\. 233–240\.External Links:[Document](https://dx.doi.org/10.1145/1143844.1143874)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px5.p1.1)\.
- \[9\]R\. Debrah, M\. Oman\-Amoako, and E\. Tetteh\(2026\)Artificial Intelligence and Machine Learning for Payroll Fraud Detection in the United States Public Sector Payroll Systems: A Scoping Review\.Asian Journal of Economics, Business and Accounting26\(7\),pp\. 65–90\.External Links:[Document](https://dx.doi.org/10.9734/ajeba/2026/v26i72317)Cited by:[Appendix B](https://arxiv.org/html/2610.41085#A2.p1.1),[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px1.p1.1)\.
- \[10\]Y\. Dou, Z\. Liu, L\. Sun, Y\. Deng, H\. Peng, and P\. S\. Yu\(2020\)Enhancing Graph Neural Network\-based Fraud Detectors against Camouflaged Fraudsters\.Note:CIKM 2020\. Related DOI: 10\.1145/3340531\.3411903External Links:2008\.08692,[Link](https://arxiv.org/abs/2008.08692)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px3.p1.1)\.
- \[11\]B\. Efron\(1979\)Bootstrap Methods: Another Look at the Jackknife\.The Annals of Statistics7\(1\)\.External Links:[Document](https://dx.doi.org/10.1214/aos/1176344552)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px5.p1.1),[§6\.4](https://arxiv.org/html/2610.41085#S6.SS4.SSS0.Px3.p1.1)\.
- \[12\]Y\. Elmougy and L\. Liu\(2023\)Demystifying Fraudulent Transactions and Illicit Nodes in the Bitcoin Network for Financial Forensics\.External Links:2306\.06108,[Link](https://arxiv.org/abs/2306.06108)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px3.p1.1)\.
- \[13\]I\. P\. Fellegi and A\. B\. Sunter\(1969\)A Theory for Record Linkage\.Journal of the American Statistical Association64\(328\),pp\. 1183–1210\.External Links:[Document](https://dx.doi.org/10.1080/01621459.1969.10501049)Cited by:[§11](https://arxiv.org/html/2610.41085#S11.SS0.SSS0.Px4.p1.1),[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px4.p1.1)\.
- \[14\]M\. Fey, W\. Hu, K\. Huang, J\. E\. Lenssen, R\. Ranjan, J\. Robinson, R\. Ying, J\. You, and J\. Leskovec\(2023\)Relational Deep Learning: Graph Representation Learning on Relational Databases\.External Links:2312\.04615,[Link](https://arxiv.org/abs/2312.04615)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px4.p1.1),[2nd item](https://arxiv.org/html/2610.41085#S6.I1.i2.p1.1)\.
- \[15\]C\. A\. Field and A\. H\. Welsh\(2007\)Bootstrapping Clustered Data\.Journal of the Royal Statistical Society Series B: Statistical Methodology69\(3\),pp\. 369–390\.External Links:[Document](https://dx.doi.org/10.1111/j.1467-9868.2007.00593.x)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px5.p1.1),[§6\.4](https://arxiv.org/html/2610.41085#S6.SS4.SSS0.Px3.p1.1)\.
- \[16\]M\. Galkin, M\. Berrendorf, and C\. T\. Hoyt\(2022\)An Open Challenge for Inductive Link Prediction on Knowledge Graphs\.External Links:2203\.01520,[Link](https://arxiv.org/abs/2203.01520)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px2.p1.1)\.
- \[17\]M\. Galkin, E\. Denis, J\. Wu, and W\. L\. Hamilton\(2021\)NodePiece: Compositional and Parameter\-Efficient Representations of Large Knowledge Graphs\.Note:ICLR 2022External Links:2106\.12144,[Link](https://arxiv.org/abs/2106.12144)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px2.p1.1)\.
- \[18\]M\. Galkin, X\. Yuan, H\. Mostafa, J\. Tang, and Z\. Zhu\(2024\)Towards Foundation Models for Knowledge Graph Reasoning\.InProceedings of the International Conference on Learning Representations,External Links:2310\.04562,[Link](https://arxiv.org/abs/2310.04562)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px2.p1.1)\.
- \[19\]M\. Gardner, Y\. Artzi, V\. Basmova, J\. Berant, B\. Bogin, S\. Chen, P\. Dasigi, D\. Dua, Y\. Elazar, A\. Gottumukkala, N\. Gupta, H\. Hajishirzi, G\. Ilharco, D\. Khashabi, K\. Lin, J\. Liu, N\. F\. Liu, P\. Mulcaire, Q\. Ning, S\. Singh, N\. A\. Smith, S\. Subramanian, R\. Tsarfaty, E\. Wallace, A\. Zhang, and B\. Zhou\(2020\)Evaluating Models’ Local Decision Boundaries via Contrast Sets\.Note:Findings of EMNLP 2020External Links:2004\.02709,[Link](https://arxiv.org/abs/2004.02709)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px5.p1.1)\.
- \[20\]R\. Geirhos, J\. Jacobsen, C\. Michaelis, R\. Zemel, W\. Brendel, M\. Bethge, and F\. A\. Wichmann\(2020\)Shortcut Learning in Deep Neural Networks\.Note:Perspective article published at Nature Machine Intelligence\. Related DOI: 10\.1038/s42256\-020\-00257\-zExternal Links:2004\.07780,[Link](https://arxiv.org/abs/2004.07780)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px5.p1.1)\.
- \[21\]W\. L\. Hamilton, R\. Ying, and J\. Leskovec\(2017\)Inductive Representation Learning on Large Graphs\.Note:NIPS 2017External Links:1706\.02216,[Link](https://arxiv.org/abs/1706.02216)Cited by:[2nd item](https://arxiv.org/html/2610.41085#S6.I1.i2.p1.1)\.
- \[22\]T\. H\. Haveliwala\(2002\)Topic\-sensitive PageRank\.InProceedings of the 11th international conference on World Wide Web,pp\. 517–526\.External Links:[Document](https://dx.doi.org/10.1145/511446.511513)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px2.p1.1)\.
- \[23\]S\. Holm\(1979\)A Simple Sequentially Rejective Multiple Test Procedure\.Scandinavian Journal of Statistics6\(2\),pp\. 65–70\.Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px5.p1.1)\.
- \[24\]T\. Huang, Y\. Wang, Q\. Li, C\. He, and J\. Gao\(2025\)Can LLMs Find Fraudsters? Multi\-level LLM Enhanced Graph Fraud Detection\.Note:ACM MM 2025External Links:2507\.11997,[Link](https://arxiv.org/abs/2507.11997)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px3.p1.1)\.
- \[25\]International Auditing and Assurance Standards Board \(IAASB\)\(2025\)ISA 240 \(revised\), the auditor’s responsibilities relating to fraud in an audit of financial statements\.Note:IAASB / IFACEffective for periods beginning on or after 15 December 2026; available from[https://www\.iaasb\.org](https://www.iaasb.org/)Cited by:[§1](https://arxiv.org/html/2610.41085#S1.p1.1)\.
- \[26\]M\. Jans, M\. Alles, and M\. Vasarhelyi\(2013\)The case for process mining in auditing: Sources of value added and areas of application\.International Journal of Accounting Information Systems14\(1\),pp\. 1–20\.External Links:[Document](https://dx.doi.org/10.1016/j.accinf.2012.06.015)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px1.p1.1)\.
- \[27\]M\. A\. Kadir, S\. S\. Macharla Vasu, S\. S\. Nair, and D\. Sonntag\(2025\)AuditCopilot: Leveraging LLMs for Fraud Detection in Double\-Entry Bookkeeping\.External Links:2512\.02726,[Link](https://arxiv.org/abs/2512.02726)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px4.p1.1)\.
- \[28\]S\. Kapoor and A\. Narayanan\(2022\)Leakage and the Reproducibility Crisis in ML\-based Science\.External Links:2207\.07048,[Link](https://arxiv.org/abs/2207.07048)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px5.p1.1)\.
- \[29\]L\. Katz\(1953\)A New Status Index Derived from Sociometric Analysis\.Psychometrika18\(1\),pp\. 39–43\.External Links:[Document](https://dx.doi.org/10.1007/BF02289026)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px2.p1.1)\.
- \[30\]S\. Kaufman, S\. Rosset, C\. Perlich, and O\. Stitelman\(2012\)Leakage in data mining: Formulation, detection, and avoidance\.ACM Transactions on Knowledge Discovery from Data6\(4\),pp\. 1–21\.External Links:[Document](https://dx.doi.org/10.1145/2382577.2382579)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px5.p1.1)\.
- \[31\]J\. Lee, C\. Chung, and J\. J\. Whang\(2023\)InGram: Inductive Knowledge Graph Embedding via Relation Graphs\.InProceedings of the International Conference on Machine Learning,External Links:2305\.19987,[Link](https://arxiv.org/abs/2305.19987)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px2.p1.1)\.
- \[32\]J\. Li, H\. Shomer, H\. Mao, S\. Zeng, Y\. Ma, N\. Shah, J\. Tang, and D\. Yin\(2023\)Evaluating Graph Neural Networks for Link Prediction: Current Pitfalls and New Benchmarking\.InAdvances in Neural Information Processing Systems, Datasets and Benchmarks Track,External Links:2306\.10453,[Link](https://arxiv.org/abs/2306.10453)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px2.p1.1)\.
- \[33\]D\. Liben\-Nowell and J\. Kleinberg\(2007\)The link\-prediction problem for social networks\.Journal of the American Society for Information Science and Technology58\(7\),pp\. 1019–1031\.External Links:[Document](https://dx.doi.org/10.1002/asi.20591)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px2.p1.1)\.
- \[34\]Y\. Liu, X\. Ao, Z\. Qin, J\. Chi, J\. Feng, H\. Yang, and Q\. He\(2021\)Pick and Choose: A GNN\-based Imbalanced Learning Approach for Fraud Detection\.InProceedings of the Web Conference 2021,pp\. 3168–3177\.External Links:[Document](https://dx.doi.org/10.1145/3442381.3449989)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px3.p1.1)\.
- \[35\]S\. Mishra\(2026\)ERP\-RiskBench: Leakage\-Safe Ensemble Learning for Financial Risk\.External Links:2603\.06671,[Link](https://arxiv.org/abs/2603.06671)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px4.p1.1)\.
- \[36\]M\. J\. Nigrini\(2012\)Benford’s Law: Applications for Forensic Accounting, Auditing, and Fraud Detection\.Wiley\.External Links:[Document](https://dx.doi.org/10.1002/9781119203094)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px1.p1.1)\.
- \[37\]B\. A\. Nosek, C\. R\. Ebersole, A\. C\. DeHaven, and D\. T\. Mellor\(2018\)The preregistration revolution\.Proceedings of the National Academy of Sciences115\(11\),pp\. 2600–2606\.External Links:[Document](https://dx.doi.org/10.1073/pnas.1708274114)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px5.p1.1)\.
- \[38\]F\. Pedregosa, G\. Varoquaux, A\. Gramfort, V\. Michel, B\. Thirion, O\. Grisel, M\. Blondel, A\. Müller, J\. Nothman, G\. Louppe, P\. Prettenhofer, R\. Weiss, V\. Dubourg, J\. Vanderplas, A\. Passos, D\. Cournapeau, M\. Brucher, M\. Perrot, and É\. Duchesnay\(2011\)Scikit\-learn: Machine Learning in Python\.Note:Journal of Machine Learning Research 12, 2011External Links:1201\.0490,[Link](https://arxiv.org/abs/1201.0490)Cited by:[§7\.1](https://arxiv.org/html/2610.41085#S7.SS1.SSS0.Px2.p1.1)\.
- \[39\]S\. Rahim\(2023\)Oracle R12 EBusiness Suite Role Based Access Control and Roles Lifecycle Management\.External Links:2304\.13514,[Link](https://arxiv.org/abs/2304.13514)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px1.p1.1)\.
- \[40\]J\. Robinson, R\. Ranjan, W\. Hu, K\. Huang, J\. Han, A\. Dobles, M\. Fey, J\. E\. Lenssen, Y\. Yuan, Z\. Zhang,et al\.\(2024\)RelBench: A Benchmark for Deep Learning on Relational Databases\.External Links:2407\.20060,[Link](https://arxiv.org/abs/2407.20060)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px4.p1.1),[2nd item](https://arxiv.org/html/2610.41085#S6.I1.i2.p1.1)\.
- \[41\]B\. Saha\(2025\)Leveraging AI to Predict Payroll Fraud in Enterprise Resource Planning \(ERP\) Systems\.Note:SSRN preprintExternal Links:[Document](https://dx.doi.org/10.2139/ssrn.5224746),[Link](https://doi.org/10.2139/ssrn.5224746)Cited by:[Appendix B](https://arxiv.org/html/2610.41085#A2.p1.1),[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px1.p1.1)\.
- \[42\]T\. Saito and M\. Rehmsmeier\(2015\)The Precision\-Recall Plot Is More Informative than the ROC Plot When Evaluating Binary Classifiers on Imbalanced Datasets\.PLOS ONE10\(3\),pp\. e0118432\.External Links:[Document](https://dx.doi.org/10.1371/journal.pone.0118432)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px5.p1.1)\.
- \[43\]B\. Sajja\(2026\)TravelFraudBench: A Configurable Evaluation Framework for GNN Fraud Ring Detection in Travel Networks\.External Links:2604\.21093,[Link](https://arxiv.org/abs/2604.21093)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px3.p1.1)\.
- \[44\]A\. Samudrala\(2026\)ERP Data Provisioning Financial Control Testing\.External Links:2607\.09712,[Link](https://arxiv.org/abs/2607.09712)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px4.p1.1)\.
- \[45\]M\. Schlichtkrull, T\. N\. Kipf, P\. Bloem, R\. van den Berg, I\. Titov, and M\. Welling\(2017\)Modeling Relational Data with Graph Convolutional Networks\.Note:ESWC 2018External Links:1703\.06103,[Link](https://arxiv.org/abs/1703.06103)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px2.p1.1),[1st item](https://arxiv.org/html/2610.41085#S6.I1.i1.p1.1)\.
- \[46\]M\. Schreyer, T\. Sattarov, D\. Borth, A\. Dengel, and B\. Reimer\(2017\)Detection of Anomalies in Large Scale Accounting Data using Deep Autoencoder Networks\.External Links:1709\.05254,[Link](https://arxiv.org/abs/1709.05254)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px4.p1.1)\.
- \[47\]M\. Schreyer, T\. Sattarov, and D\. Borth\(2021\)Multi\-view Contrastive Self\-Supervised Learning of Accounting Data Representations for Downstream Audit Tasks\.External Links:2109\.11201,[Link](https://arxiv.org/abs/2109.11201)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px4.p1.1)\.
- \[48\]N\. Sultana, A\. Nasir, and A\. Hasan\(2025\)HRIS\-Integrated Fraud Detection for U\.S\. Home Health Agency Workforce Compliance: Identifying Ghost Worker Schemes and Payroll Irregularities in Medicare and Medicaid\-Funded Care Programs\.International Journal of Computational and Experimental Science and Engineering11\(1\)\.External Links:[Document](https://dx.doi.org/10.22399/ijcesen.5496)Cited by:[Appendix B](https://arxiv.org/html/2610.41085#A2.p1.1),[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px1.p1.1)\.
- \[49\]J\. Tang, F\. Hua, Z\. Gao, P\. Zhao, and J\. Li\(2023\)GADBench: Revisiting and Benchmarking Supervised Graph Anomaly Detection\.InAdvances in Neural Information Processing Systems, Datasets and Benchmarks Track,External Links:2306\.12251,[Link](https://arxiv.org/abs/2306.12251)Cited by:[§1](https://arxiv.org/html/2610.41085#S1.SS0.SSS0.Px1.p1.1),[§10\.1](https://arxiv.org/html/2610.41085#S10.SS1.p2.1),[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px3.p1.1)\.
- \[50\]J\. Tang, J\. Li, Z\. Gao, and J\. Li\(2022\)Rethinking Graph Neural Networks for Anomaly Detection\.Note:ICML 2022External Links:2205\.15508,[Link](https://arxiv.org/abs/2205.15508)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px3.p1.1)\.
- \[51\]K\. K\. Teru, E\. Denis, and W\. L\. Hamilton\(2020\)Inductive Relation Prediction by Subgraph Reasoning\.InProceedings of the International Conference on Machine Learning,External Links:1911\.06962,[Link](https://arxiv.org/abs/1911.06962)Cited by:[§1](https://arxiv.org/html/2610.41085#S1.SS0.SSS0.Px1.p1.1),[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px2.p1.1),[3rd item](https://arxiv.org/html/2610.41085#S6.I1.i3.p1.1)\.
- \[52\]J\. Tritscher, F\. Gwinner, D\. Schlör, A\. Krause, and A\. Hotho\(2022\)Open ERP System Data For Occupational Fraud Detection\.External Links:2206\.04460,[Link](https://arxiv.org/abs/2206.04460)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px4.p1.1)\.
- \[53\]L\. W\. Vona\(2017\)Fraud Data Analytics Methodology: The Fraud Scenario Approach to Uncovering Fraud in Core Business Systems\.Wiley\.External Links:[Document](https://dx.doi.org/10.1002/9781119270331)Cited by:[Appendix B](https://arxiv.org/html/2610.41085#A2.p1.1),[§1](https://arxiv.org/html/2610.41085#S1.p1.1),[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px1.p1.1)\.
- \[54\]M\. Weber, G\. Domeniconi, J\. Chen, D\. K\. I\. Weidele, C\. Bellei, T\. Robinson, and C\. E\. Leiserson\(2019\)Anti\-Money Laundering in Bitcoin: Experimenting with Graph Convolutional Networks for Financial Forensics\.Note:Tutorial in the Anomaly Detection in Finance Workshop at the 25th SIGKDD Conference on Knowledge Discovery and Data MiningExternal Links:1908\.02591,[Link](https://arxiv.org/abs/1908.02591)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px3.p1.1)\.
- \[55\]J\. T\. Wells\(2017\)Corporate Fraud Handbook: Prevention and Detection\.Wiley\.External Links:[Document](https://dx.doi.org/10.1002/9781119351962)Cited by:[Appendix B](https://arxiv.org/html/2610.41085#A2.p1.1),[§1](https://arxiv.org/html/2610.41085#S1.p1.1),[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px1.p1.1)\.
- \[56\]Z\. Xie, Y\. Zhang, G\. Zhou, J\. Liu, X\. Tu, and J\. X\. Huang\(2024\)One Subgraph for All: Efficient Reasoning on Opening Subgraphs for Inductive Knowledge Graph Completion\.External Links:2404\.15807,[Link](https://arxiv.org/abs/2404.15807)Cited by:[item 8](https://arxiv.org/html/2610.41085#A1.I1.i8.p1.1),[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px2.p1.1),[5th item](https://arxiv.org/html/2610.41085#S6.I1.i5.p1.1)\.
- \[57\]M\. Zhang and Y\. Chen\(2018\)Link Prediction Based on Graph Neural Networks\.Note:NIPS 2018External Links:1802\.09691,[Link](https://arxiv.org/abs/1802.09691)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px2.p1.1)\.
- \[58\]M\. Zhang, P\. Li, Y\. Xia, K\. Wang, and L\. Jin\(2020\)Labeling Trick: A Theory of Using Graph Neural Networks for Multi\-Node Representation Learning\.Note:NeurIPS 2021External Links:2010\.16103,[Link](https://arxiv.org/abs/2010.16103)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px2.p1.1)\.
- \[59\]Y\. Zhang and Q\. Yao\(2022\)Knowledge Graph Reasoning with Relational Digraph\.InProceedings of The Web Conference,External Links:2108\.06040,[Link](https://arxiv.org/abs/2108.06040)Cited by:[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px2.p1.1)\.
- \[60\]Z\. Zhu, Z\. Zhang, L\. Xhonneux, and J\. Tang\(2021\)Neural Bellman\-Ford Networks: A General Graph Neural Network Framework for Link Prediction\.InAdvances in Neural Information Processing Systems,External Links:2106\.06935,[Link](https://arxiv.org/abs/2106.06935)Cited by:[§1](https://arxiv.org/html/2610.41085#S1.SS0.SSS0.Px1.p1.1),[§2](https://arxiv.org/html/2610.41085#S2.SS0.SSS0.Px2.p1.1),[4th item](https://arxiv.org/html/2610.41085#S6.I1.i4.p1.1)\.

## Appendix AProtocol History and Execution Provenance

The development record distinguishes pilots, the original frozen study, score\-only analyses and the extension \([Table4](https://arxiv.org/html/2610.41085#S6.T4)\)\. Their results remain separately identified\.

1. 1\.Exploratory development\.Phases 1 and 2 used generator v1 before the prospective protocol was finalized\. RDL\-style and audit\-test breakdowns were added after a phase\-2 development run\. These outputs are exploratory \([Sections5](https://arxiv.org/html/2610.41085#S5)and[2](https://arxiv.org/html/2610.41085#S5.T2)\)\.
2. 2\.Protocol finalization\.Before original testing, the family expanded from three hop tests to five tests, the decision became the Holm\-adjusted bootstrap\-tail rule, and the combination hypothesis became descriptive S1\. These changes are infreeze\-phase3\-001\.
3. 3\.Seed and export qualification\.The exporter refused an adjacent seed that would reproduce earlier organizations\. Final seed 9134004 was checked against earlier corpora\. An initial v2 export matched two\-hop variants only in distribution; a test exposed this before GNN results\. Correctedhrgraph\-004supplied the study\. Only dev organizations of supersededhrgraph\-003were analyzed; interrupted dev GNN runs supplied no result used here\.
4. 4\.Audit corrections\.Intermediate dev audits mixed hops in a twin comparison and used an incorrect entity lookup\. Corrected audits superseded them; reported values use the final audit\.
5. 5\.Development\-file retention\.A phase\-1 debug output exposing an omitted four\-hop intermediary and two seed\-refusal logs were deleted during development; none contributes a result\. Later debug runs were retained separately\. Partial extension smoke outputs and scratch noise data were deleted; the final dev\-only smoke run was retained\. A number\-check directory deleted during manuscript rebuilding was regenerated\. The run log records these events separately from preserved formal outputs\.
6. 6\.Rule construction\.Severity weights followed phase\-1 inspection of ties\. Rules v2 has hand\-set weights and generator\-informed exemptions\. Generic rules have unit weights and different exemptions; both were authored with knowledge of the generator, not as a blinded manipulation of analyst knowledge\.
7. 7\.Twin analysis\.The report forms pools from written scores\. Original twin intervals and comparisons were implemented before the freeze and regression\-checked on dev values\.
8. 8\.Implementation\.GraIL\-style concatenates features and distance labels; NBFNet\-style injects features at each layer; the opening\-subgraph model is inspired by GLAR\[[56](https://arxiv.org/html/2610.41085#bib.bib6)\]\. Hyperparameters stayed fixed from phase 2\. Saturating validation\-calibratedmaxcombinations remain descriptive appendix rows\.
9. 9\.Score\-only analyses\.Frozen scores and test truth supplied seed comparisons, twin removal, concordance, re\-weighting and SoD exclusions after the original report\. No model was trained for them and no original decision replaced \([Section9](https://arxiv.org/html/2610.41085#S9)\)\.
10. 10\.Extension and test reuse\.The extension was designed after original results were examined and frozen before new formal computations\. A/C reuse hrgraph\-004 test organizations; B uses new hrgraph\-005\. Dev\-only smoke tests preceded the freeze\. NBFNet\-style replaces GraIL as the stage\-C link model\.
11. 11\.Extension interpretation\.The protocol’s actual A1\-supported/A2\-unsupported outcome retained explanations beyond generator knowledge for H2\. The final interpretation therefore describes sensitivity to rule specification without identifying knowledge as the unique or predominant cause\. All nine recorded decisions are retained\.
12. 12\.Thread\-count reproduction\.Four rather than six CPU threads reproduced RDL\-style scores but changed NBFNet\-style clean AP to 0\.688 from 0\.673\. Original and extension outputs remain distinct\.

Internal simulated manuscript reviews in the run log were preparation activities, not journal peer review or evidence for performance\.

## Appendix BLiterature Search

The novelty statement in[Section2](https://arxiv.org/html/2610.41085#S2)rests on a set of arXiv API queries covering 2018–2026, run on 14 October 2026, with abstracts read for the closest hits\. The following queries returned no relevant hit: “ghost employee”; “payroll fraud”; payroll AND fraud; “inductive link prediction” AND fraud; “knowledge graph completion” AND fraud; “vendor fraud”; “shared bank account” or “shared address” AND fraud; procurement AND fraud AND “knowledge graph”; “fraud ring” AND synthetic AND graph; inductive AND “unseen entities” AND fraud; “knowledge graph” AND audit AND fraud\. Semantic Scholar was rate\-limited during that search\. To cover accounting, auditing and information\-systems journals and books outside arXiv, we queried the Crossref API on 15–16 October 2026 \(bibliographic queries “ghost employee payroll fraud”, “payroll fraud detection machine learning” and “graph link prediction occupational fraud audit employee vendor”; top 20 hits each; a fourth query was rate\-limited and not repeated\) and read the abstracts of the relevant hits\. The search returned practitioner handbook chapters on payroll schemes\[[55](https://arxiv.org/html/2610.41085#bib.bib40),[53](https://arxiv.org/html/2610.41085#bib.bib41)\], public\-sector and policy studies of ghost workers, a scoping review and a preprint on machine learning for payroll fraud\[[9](https://arxiv.org/html/2610.41085#bib.bib46),[41](https://arxiv.org/html/2610.41085#bib.bib47)\], a synthetic HRIS study with tabular classifiers and network\-style collusion indicators\[[48](https://arxiv.org/html/2610.41085#bib.bib48)\], and an inductive link\-prediction system for banking fraud\[[5](https://arxiv.org/html/2610.41085#bib.bib49)\]; none formulates payroll or employee–vendor fraud as link prediction\. Crossref coverage of accounting journals is incomplete, so the novelty statement remains “to our knowledge”\. Every reference was checked against its arXiv abstract page, its Crossref DOI record, or \(for the ACFE report\) the publisher’s archive page on 15–16 October 2026; Holm \(1979\) has no DOI and was checked against a secondary reference list\.

## Appendix CDesign Details

#### Planted counts\.

[Table20](https://arxiv.org/html/2610.41085#A3.T20)lists the planted positives per pattern and hop in the test organizations\. Each test organization contributes 28 planted frauds and the same number of matched twins\.

Table 20:Planted positives per pattern and hop in the 24 test organizations \(analytic counts from the generator configuration\)\. Every planted pair also has one structurally matched benign twin\.patternhopentityn\+n\_\{\+\}linkn\+n\_\{\+\}account change before run24848account change before run34848approver link24848approver link34848employee–vendor account23232employee–vendor account33232employee–vendor account43232employee–vendor contact23232employee–vendor contact33232employee–vendor contact43232ghost employee14848ghost employee34848shared payroll account23232shared payroll account33232shared payroll account43232SoD conflict096–
#### Rules v2 exemptions\.

An identifier match \(shared account, address, phone, approver link\) is exempt when a conflict\-of\-interest declaration is on file, filed on time, and the approval was independent\. A holder mismatch is exempt when a third\-party payee authorization is on file\. A recent bank\-detail change is exempt when it was call\-back verified\. “Paid without activity” fires on zero tracked attendance, or on low badge*and*login activity for a tracked employee not on leave\. A separate flag fires when the hiring or change approval was not independent\. The link score adds direct identifier matches betweenuuandcc\(unless exempt\), plus one ifuuis paid without activity and reports tocc, plus one ifuuhas an approver link and was hired bycc, plus a small multiple of the weighted entity flags\.

#### Node features\.

Type one\-hot; log degree, total and per relation; the phase\-1 entity\-attribute flags; new\-entity indicator; runs paid; attendance, start and onboarding times \(log\); account change; roles; address and phone kind; and the v2 control records \(conflict\-of\-interest declaration and its timing, payee authorization, call\-back verification, independent approval, badge and login activity, time\-sheets, SoD exception\), each with a missing indicator\. The feature dimension is 79\.

#### Tests\.

Before the freeze, the JavaScript test suite \(generator determinism, label validity, hard\-negative behaviour, metrics on hand\-computed cases including ties, leakage checks, export reproducibility, and the twin audit on dev data\) and the Python test suite \(subgraph extraction against a reference implementation, labelling, that the loader never opens label columns or test organizations in dev mode, that no feature equals the label, invariance of every model class to identifier relabelling, and metric parity with the JavaScript implementation\) all passed\.

## Appendix DHyperparameters and Training

Table 21:GNN hyperparameters, fixed in phase 2 before generator v2 existed and not tuned \(as recorded in the confirmatory run’s metrics file\)\.modelhyperparametersR\-GCN \(entity\)hid 64, layers 2, bases 8, dropout 0\.2, lr 0\.005, max epochs 300, patience 30RDL\-style \(entity, link\)hid 64, layers 2, dropout 0\.2, lr 0\.005, max epochs 300, patience 30GraIL\-style \(k=2k\{=\}2,k=3k\{=\}3\)hid 32, layers 3, bases 4, dropout 0\.1, lr 0\.002, max epochs 40, patience 8, batch 256, neg frac 0\.25NBFNet\-stylehid 32, layers 6, lr 0\.002, max epochs 60, patience 10, chunk 28Opening\-subgraph \(OSFA\-insp\.\)k 4, hid 32, bases 4, dropout 0\.1, lr 0\.002, max epochs 60, patience 10, chunk 14

Table 22:Training on the confirmatory run \(seeds 9131 / 9132 / 9133\): early stopping on the held\-out dev orgs ended almost every run before its epoch cap; runs that reached the cap: Opening\-subgraph \(OSFA\-insp\.\) seed 9132\.modelbest epochepochs runcapval AUPRCwall h \(3 seeds\)R\-GCN \(entity\)91 / 33 / 28122 / 64 / 593000\.777 / 0\.771 / 0\.7640\.10RDL\-style \(entity\)73 / 43 / 62104 / 74 / 933000\.802 / 0\.799 / 0\.7780\.11RDL\-style \(link\)140 / 140 / 193171 / 171 / 2243000\.099 / 0\.141 / 0\.0820\.27GraIL\-stylek=2k\{=\}217 / 25 / 1526 / 34 / 24400\.493 / 0\.572 / 0\.5532\.23GraIL\-stylek=3k\{=\}324 / 11 / 1833 / 20 / 27400\.712 / 0\.586 / 0\.6299\.06NBFNet\-style18 / 21 / 3429 / 32 / 45600\.649 / 0\.620 / 0\.6620\.36Opening\-subgraph \(OSFA\-insp\.\)29 / 52 / 2540 / 60 / 36600\.553 / 0\.540 / 0\.5011\.02

## Appendix EFull Original\-Study Tables

All tables in this appendix are generated from the confirmatory report\. GNN values are seed means; “±\\pm” is the seed SD; brackets are 95% organization\-cluster bootstrap CIs over the 24 test organizations\. Per\-pattern and per\-control breakdowns are exploratory\.

Table 23:All link\-level methods on the test pool: recall at 1% FPR is saturated \(9 of 24 methods reach at least 0\.99\), as declared in the prospective protocol, so no claim rests on it\. P@100 \(precision in the top 100\) was not pre\-specified\.†GNN that is not a pre\-specified primary model \(descriptive\)\.methodAUROCAUPRC95% CIP@100recall at0\.1% FPRrecall at1% FPRrecall at5% FPRper\-orgAUROC rangeRules naive0\.6980\.024\[0\.020, 0\.029\]0\.1780\.0900\.1010\.4480\.631–0\.771Rules tuned0\.7650\.237\[0\.222, 0\.253\]0\.5050\.4340\.4340\.4340\.707–0\.834Rules severity0\.7720\.239\[0\.224, 0\.256\]0\.5050\.4340\.4340\.4340\.714–0\.837Rules v20\.8080\.347\[0\.321, 0\.376\]0\.7900\.4290\.4290\.4360\.709–0\.891Common neighbours0\.6450\.003\[0\.003, 0\.003\]0\.0030\.0000\.0140\.0140\.599–0\.717Adamic–Adar0\.6590\.124\[0\.113, 0\.137\]0\.2150\.3330\.3400\.3590\.613–0\.732Katz0\.8290\.023\[0\.022, 0\.025\]0\.0500\.0420\.3370\.3560\.779–0\.886PPR0\.9930\.093\[0\.090, 0\.100\]0\.0900\.0570\.7971\.0000\.990–0\.994Path features \+ LR0\.9810\.295\[0\.281, 0\.315\]0\.4100\.5300\.8190\.8960\.964–0\.992NBFNet\-style†0\.9990\.673±\\pm0\.017\[0\.645, 0\.698\]0\.8300\.9360\.9990\.9990\.992–1\.000OSFA\-insp\.†0\.9990\.584±\\pm0\.033\[0\.559, 0\.617\]0\.5770\.9000\.9980\.9980\.994–1\.000RDL\-style \(link\)†0\.9530\.082±\\pm0\.023\[0\.075, 0\.092\]0\.2800\.1480\.4690\.8060\.924–0\.978Rules v2 \+ NBFNet\-style†\(max\)0\.9990\.619±\\pm0\.018\[0\.527, 0\.720\]0\.8570\.7920\.9990\.9990\.988–1\.000Rules v2 \+ NBFNet\-style†\(lr\)0\.9990\.626±\\pm0\.111\[0\.605, 0\.648\]0\.7170\.9100\.9990\.9990\.992–1\.000Rules v2 \+ OSFA\-insp\.†\(max\)0\.9990\.583±\\pm0\.011\[0\.491, 0\.691\]0\.6580\.8520\.9980\.9980\.988–1\.000Rules v2 \+ OSFA\-insp\.†\(lr\)0\.9990\.624±\\pm0\.063\[0\.599, 0\.654\]0\.6270\.9210\.9980\.9980\.994–1\.000Rules v2 \+ RDL\-style \(link\)†\(max\)0\.9550\.292±\\pm0\.014\[0\.256, 0\.351\]0\.6260\.4480\.6210\.7960\.914–0\.990Rules v2 \+ RDL\-style \(link\)†\(lr\)0\.9660\.391±\\pm0\.002\[0\.364, 0\.423\]0\.8030\.4460\.6170\.8560\.932–0\.993GraIL\-stylek=2k\{=\}2†0\.9790\.473±\\pm0\.012\[0\.456, 0\.493\]0\.5970\.7890\.8410\.9150\.940–0\.997GraIL\-stylek=3k\{=\}30\.9990\.663±\\pm0\.071\[0\.630, 0\.698\]0\.7600\.9060\.9970\.9990\.998–1\.000Rules v2 \+ GraIL\-stylek=2k\{=\}2†\(max\)0\.9790\.462±\\pm0\.012\[0\.392, 0\.544\]0\.6250\.7370\.8510\.9000\.953–0\.997Rules v2 \+ GraIL\-stylek=2k\{=\}2†\(lr\)0\.9830\.591±\\pm0\.009\[0\.567, 0\.618\]0\.7470\.8090\.8500\.9240\.958–0\.998Rules v2 \+ GraIL\-stylek=3k\{=\}3\(max\)0\.9990\.655±\\pm0\.061\[0\.594, 0\.726\]0\.7770\.8550\.9990\.9990\.996–1\.000Rules v2 \+ GraIL\-stylek=3k\{=\}3\(lr\)1\.0000\.735±\\pm0\.026\[0\.711, 0\.763\]0\.7770\.9610\.9990\.9990\.998–1\.000

Table 24:Link recall per hop at 0\.1% and 1% FPR \(hop\-hhpositives vs all negatives\)\. At 1% FPR the GraIL\-stylek=3k\{=\}3, NBFNet\-style and opening\-subgraph models recall nearly all positives at every hop; the one\-step rules recall none of the 4\-hop positives at either FPR\.†GNN that is not a pre\-specified primary model \(descriptive\)\.recall at 0\.1% FPRrecall at 1% FPRmethodh1h2h3h4h1h2h3h4Rules naive0\.0000\.2600\.0080\.0000\.0000\.2760\.0210\.000Rules tuned0\.6671\.0000\.1080\.0000\.6671\.0000\.1080\.000Rules severity0\.6671\.0000\.1080\.0000\.6671\.0000\.1080\.000Rules v20\.8330\.8540\.1790\.0000\.8330\.8540\.1790\.000Common neighbours0\.0000\.0000\.0000\.0000\.0000\.0310\.0080\.000Adamic–Adar0\.0001\.0000\.0000\.0000\.0001\.0000\.0170\.000Katz0\.4790\.0050\.0000\.0001\.0000\.2500\.4080\.000PPR0\.6670\.0050\.0000\.0001\.0001\.0000\.7870\.312Path features \+ LR0\.6040\.5680\.6960\.0001\.0000\.9580\.9630\.094NBFNet\-style†0\.7150\.9830\.9420\.9380\.9931\.0001\.0001\.000OSFA\-insp\.†0\.5830\.9130\.9260\.9690\.9860\.9981\.0001\.000RDL\-style \(link\)†0\.2220\.2200\.0860\.1220\.5560\.5050\.4390\.431Rules v2 \+ NBFNet\-style†\(max\)0\.8330\.9550\.7110\.6490\.9931\.0001\.0001\.000Rules v2 \+ NBFNet\-style†\(lr\)0\.7080\.9060\.9430\.9380\.9931\.0001\.0001\.000Rules v2 \+ OSFA\-insp\.†\(max\)0\.8330\.9440\.7960\.8190\.9860\.9981\.0001\.000Rules v2 \+ OSFA\-insp\.†\(lr\)0\.7710\.9290\.9260\.9690\.9860\.9981\.0001\.000Rules v2 \+ RDL\-style \(link\)†\(max\)0\.8330\.8580\.1970\.0660\.8330\.8800\.4540\.413Rules v2 \+ RDL\-style \(link\)†\(lr\)0\.8330\.8420\.1940\.0870\.8330\.8680\.4560\.410GraIL\-stylek=2k\{=\}2†0\.6320\.9700\.9900\.0000\.8260\.9791\.0000\.177GraIL\-stylek=3k\{=\}30\.3750\.9170\.9720\.9860\.9790\.9980\.9991\.000Rules v2 \+ GraIL\-stylek=2k\{=\}2†\(max\)0\.8330\.9700\.8260\.0000\.9030\.9951\.0000\.163Rules v2 \+ GraIL\-stylek=2k\{=\}2†\(lr\)0\.8190\.9910\.9850\.0000\.8820\.9931\.0000\.174Rules v2 \+ GraIL\-stylek=3k\{=\}3\(max\)0\.8330\.9440\.8420\.7221\.0001\.0000\.9991\.000Rules v2 \+ GraIL\-stylek=3k\{=\}3\(lr\)0\.7710\.9860\.9680\.9900\.9931\.0000\.9991\.000

Table 25:All link\-level methods on the twin pool: structure\-only heuristics sit at chance \(as designed\) and no single method or combination exceeds the generator\-aware Rules v2 \(descriptive; unadjusted CIs\)\.†GNN that is not a pre\-specified primary model \(descriptive\)\.methodAUROC95% CIAUPRCh1h2h3h4Δ\\Deltavs Rules v2 \[95% CI\]Rules naive0\.536\[0\.526, 0\.548\]0\.5230\.7480\.5100\.5230\.495−\-0\.260 \[−\-0\.285,−\-0\.234\]Rules tuned0\.547\[0\.537, 0\.555\]0\.5270\.7800\.5010\.5470\.502−\-0\.250 \[−\-0\.269,−\-0\.230\]Rules severity0\.548\[0\.539, 0\.557\]0\.5290\.7800\.4990\.5420\.505−\-0\.248 \[−\-0\.267,−\-0\.229\]Rules v20\.796\[0\.773, 0\.818\]0\.7420\.8930\.8180\.7760\.780–Common neighbours0\.498\[0\.489, 0\.509\]0\.4990\.4790\.4970\.5020\.495−\-0\.298 \[−\-0\.326,−\-0\.270\]Adamic–Adar0\.497\[0\.489, 0\.505\]0\.4970\.4790\.4790\.5030\.494−\-0\.300 \[−\-0\.328,−\-0\.273\]Katz0\.494\[0\.485, 0\.502\]0\.5000\.5140\.5140\.4870\.467−\-0\.303 \[−\-0\.327,−\-0\.278\]PPR0\.501\[0\.496, 0\.507\]0\.5070\.4750\.4990\.5040\.503−\-0\.295 \[−\-0\.317,−\-0\.271\]Path features \+ LR0\.619\[0\.602, 0\.637\]0\.6020\.8290\.6290\.6440\.742−\-0\.177 \[−\-0\.201,−\-0\.151\]NBFNet\-style†0\.668\[0\.642, 0\.691\]0\.6760\.8480\.6760\.6920\.549−\-0\.129 \[−\-0\.152,−\-0\.103\]OSFA\-insp\.†0\.635\[0\.611, 0\.663\]0\.5930\.8740\.6120\.6480\.713−\-0\.161 \[−\-0\.187,−\-0\.131\]RDL\-style \(link\)†0\.738\[0\.715, 0\.764\]0\.7270\.8560\.7430\.7200\.718−\-0\.058 \[−\-0\.080,−\-0\.034\]Rules v2 \+ NBFNet\-style†\(max\)0\.711\[0\.686, 0\.734\]0\.7030\.8510\.7660\.7030\.549−\-0\.086 \[−\-0\.105,−\-0\.064\]Rules v2 \+ NBFNet\-style†\(lr\)0\.622\[0\.602, 0\.642\]0\.6300\.8460\.6160\.6680\.547−\-0\.174 \[−\-0\.198,−\-0\.149\]Rules v2 \+ OSFA\-insp\.†\(max\)0\.714\[0\.690, 0\.738\]0\.6700\.8870\.7620\.6650\.713−\-0\.083 \[−\-0\.106,−\-0\.058\]Rules v2 \+ OSFA\-insp\.†\(lr\)0\.669\[0\.648, 0\.692\]0\.6310\.8830\.6720\.6530\.716−\-0\.127 \[−\-0\.151,−\-0\.102\]Rules v2 \+ RDL\-style \(link\)†\(max\)0\.769\[0\.748, 0\.790\]0\.7370\.8800\.8140\.7250\.718−\-0\.028 \[−\-0\.040,−\-0\.013\]Rules v2 \+ RDL\-style \(link\)†\(lr\)0\.772\[0\.751, 0\.794\]0\.7440\.8630\.8160\.7350\.729−\-0\.025 \[−\-0\.039,−\-0\.010\]GraIL\-stylek=2k\{=\}2†0\.573\[0\.559, 0\.588\]0\.5640\.7480\.5920\.6090\.740−\-0\.224 \[−\-0\.244,−\-0\.202\]GraIL\-stylek=3k\{=\}30\.674\[0\.643, 0\.705\]0\.6700\.7800\.6410\.6900\.803−\-0\.122 \[−\-0\.151,−\-0\.094\]Rules v2 \+ GraIL\-stylek=2k\{=\}2†\(max\)0\.634\[0\.618, 0\.650\]0\.6080\.8390\.7060\.6200\.765−\-0\.163 \[−\-0\.184,−\-0\.142\]Rules v2 \+ GraIL\-stylek=2k\{=\}2†\(lr\)0\.672\[0\.656, 0\.688\]0\.6770\.8170\.8030\.6710\.755−\-0\.125 \[−\-0\.140,−\-0\.108\]Rules v2 \+ GraIL\-stylek=3k\{=\}3\(max\)0\.749\[0\.725, 0\.774\]0\.7140\.8600\.7580\.7190\.802−\-0\.048 \[−\-0\.067,−\-0\.029\]Rules v2 \+ GraIL\-stylek=3k\{=\}3\(lr\)0\.763\[0\.742, 0\.783\]0\.7380\.8390\.8130\.7360\.828−\-0\.034 \[−\-0\.047,−\-0\.019\]

Table 26:All entity\-level methods on the test pool: entity GNNs and the rules \+ entity\-GNN combinations have the highest AUPRC, and link models aggregated by the maximum miss the entity\-only SoD conflict \(h0\)\. Per\-hop columns: AUPRC of hop\-hhpositives vs all negatives\.†GNN that is not a pre\-specified primary model \(descriptive\)\.methodAUROCAUPRC95% CIrecall at1% FPRrecall at5% FPRh0h1h2h3h4Rules naive0\.6330\.343\[0\.332, 0\.357\]0\.0160\.0160\.0760\.0270\.1920\.1500\.048Rules tuned0\.7390\.447\[0\.437, 0\.458\]0\.0120\.0120\.0840\.0430\.3370\.2200\.080Rules severity0\.7580\.486\[0\.475, 0\.499\]0\.0100\.1240\.1070\.0540\.3720\.2510\.104Rules v20\.8720\.698\[0\.669, 0\.728\]0\.1040\.3870\.3270\.2610\.6080\.4110\.229Common neighbours0\.4610\.254\[0\.250, 0\.261\]0\.0000\.0130\.0630\.0290\.1080\.1050\.040Adamic–Adar0\.5170\.302\[0\.295, 0\.311\]0\.0000\.0090\.0440\.0210\.3660\.0910\.038Katz0\.4440\.239\[0\.231, 0\.250\]0\.0040\.0420\.0800\.0610\.0740\.0920\.047PPR0\.4540\.235\[0\.229, 0\.245\]0\.0040\.0240\.0720\.0770\.0830\.0860\.033Path features \+ LR0\.8760\.725\[0\.692, 0\.757\]0\.1920\.4630\.4120\.2490\.3230\.5870\.339R\-GCN \(entity\)†0\.9000\.776±\\pm0\.015\[0\.744, 0\.808\]0\.2330\.5460\.5020\.2830\.4550\.6280\.416NBFNet\-style†0\.7910\.621±\\pm0\.017\[0\.596, 0\.643\]0\.1290\.3090\.0290\.3880\.5190\.4630\.155OSFA\-insp\.†0\.7870\.550±\\pm0\.023\[0\.529, 0\.578\]0\.0230\.2450\.0320\.0490\.3740\.3980\.198RDL\-style \(entity\)0\.8900\.752±\\pm0\.018\[0\.719, 0\.784\]0\.1970\.5240\.4110\.2430\.4450\.5760\.405RDL\-style \(link\)†0\.7800\.638±\\pm0\.016\[0\.614, 0\.665\]0\.1200\.3810\.0280\.2730\.4880\.4800\.264Rules v2 \+ R\-GCN \(entity\)†\(max\)0\.9160\.782±\\pm0\.013\[0\.752, 0\.811\]0\.1870\.5570\.4330\.2410\.5630\.5810\.354Rules v2 \+ R\-GCN \(entity\)†\(lr\)0\.9210\.801±\\pm0\.004\[0\.769, 0\.832\]0\.2870\.6030\.4380\.3110\.6380\.5830\.333Rules v2 \+ RDL\-style \(entity\) \(max\)0\.9070\.760±\\pm0\.019\[0\.729, 0\.789\]0\.0890\.4940\.3590\.2070\.5530\.5360\.345Rules v2 \+ RDL\-style \(entity\) \(lr\)0\.9140\.792±\\pm0\.004\[0\.763, 0\.822\]0\.2660\.5670\.4110\.2830\.6400\.5650\.334GraIL\-stylek=2k\{=\}2†0\.7260\.506±\\pm0\.007\[0\.492, 0\.523\]0\.0430\.1940\.0270\.0460\.4290\.3930\.059GraIL\-stylek=3k\{=\}30\.7820\.612±\\pm0\.060\[0\.584, 0\.641\]0\.1000\.3390\.0280\.1440\.4430\.5010\.272

Table 27:All entity\-level methods on the twin pool: entity GNNs tie Rules v2 and rules \+ entity\-GNN combinations exceed it \(descriptive; unadjusted CIs\)\.†GNN that is not a pre\-specified primary model \(descriptive\)\.methodAUROC95% CIh0h1h2h3h4Δ\\Deltavs Rules v2 \[95% CI\]Rules naive0\.519\[0\.500, 0\.536\]0\.5030\.7040\.5100\.5110\.495−\-0\.298 \[−\-0\.327,−\-0\.269\]Rules tuned0\.560\[0\.550, 0\.572\]0\.7870\.7560\.5030\.5390\.502−\-0\.257 \[−\-0\.276,−\-0\.236\]Rules severity0\.564\[0\.553, 0\.575\]0\.7890\.7800\.4990\.5420\.505−\-0\.253 \[−\-0\.271,−\-0\.234\]Rules v20\.817\[0\.793, 0\.839\]0\.9120\.8930\.8160\.7810\.780–Common neighbours0\.487\[0\.467, 0\.507\]0\.4720\.5420\.4940\.4790\.493−\-0\.330 \[−\-0\.365,−\-0\.297\]Adamic–Adar0\.491\[0\.480, 0\.503\]0\.4660\.5090\.4790\.4880\.485−\-0\.326 \[−\-0\.354,−\-0\.298\]Katz0\.492\[0\.479, 0\.506\]0\.4620\.5140\.4910\.4830\.502−\-0\.325 \[−\-0\.349,−\-0\.299\]PPR0\.504\[0\.489, 0\.519\]0\.4510\.4750\.4960\.5120\.522−\-0\.313 \[−\-0\.338,−\-0\.288\]Path features \+ LR0\.815\[0\.788, 0\.837\]0\.9060\.8650\.7980\.7900\.844−\-0\.002 \[−\-0\.021, 0\.018\]R\-GCN \(entity\)†0\.821\[0\.796, 0\.846\]0\.8770\.8830\.7630\.8270\.856\+0\.004 \[−\-0\.017, 0\.025\]NBFNet\-style†0\.624\[0\.605, 0\.641\]0\.5060\.8480\.6760\.6920\.549−\-0\.193 \[−\-0\.213,−\-0\.172\]OSFA\-insp\.†0\.605\[0\.587, 0\.624\]0\.6940\.8740\.6120\.6480\.713−\-0\.212 \[−\-0\.235,−\-0\.188\]RDL\-style \(entity\)0\.821\[0\.797, 0\.843\]0\.8580\.8560\.7930\.8150\.857\+0\.004 \[−\-0\.013, 0\.023\]RDL\-style \(link\)†0\.718\[0\.699, 0\.737\]0\.8600\.8550\.7600\.7870\.826−\-0\.099 \[−\-0\.114,−\-0\.080\]Rules v2 \+ R\-GCN \(entity\)†\(max\)0\.841\[0\.815, 0\.864\]0\.8790\.8840\.8160\.8320\.849\+0\.024 \[0\.008, 0\.039\]Rules v2 \+ R\-GCN \(entity\)†\(lr\)0\.847\[0\.823, 0\.868\]0\.9080\.8940\.8280\.8280\.838\+0\.030 \[0\.019, 0\.041\]Rules v2 \+ RDL\-style \(entity\) \(max\)0\.835\[0\.811, 0\.856\]0\.8660\.8680\.8160\.8270\.846\+0\.018 \[0\.005, 0\.033\]Rules v2 \+ RDL\-style \(entity\) \(lr\)0\.844\[0\.822, 0\.866\]0\.9000\.8790\.8240\.8240\.844\+0\.027 \[0\.019, 0\.037\]GraIL\-stylek=2k\{=\}2†0\.559\[0\.548, 0\.569\]0\.6440\.7490\.5920\.6090\.752−\-0\.258 \[−\-0\.278,−\-0\.237\]GraIL\-stylek=3k\{=\}30\.631\[0\.607, 0\.653\]0\.6230\.7840\.6410\.6900\.803−\-0\.186 \[−\-0\.208,−\-0\.162\]

Table 28:Link AUPRC per planted pattern and hop \(cell positives vs all negatives; exploratory, not pre\-specified as a test\): Rules v2 leads most 2\-hop cells and scores zero in every 3\- and 4\-hop cell except the ghost\-employee cell, whose evidence includes the manager edge, while the GraIL\-stylek=3k\{=\}3, NBFNet\-style and opening\-subgraph models score above zero in every cell\.†GNN that is not a pre\-specified primary model \(descriptive\)\.patternhopn\+n\_\{\+\}Rules v2Pathfeatures \+ LRGraIL\-stylek=2†k\{=\}2^\{\\dagger\}GraIL\-stylek=3k\{=\}3NBFNet\-style†OSFA\-insp\.†Rules v2 \+GraIL\-stylek=3k\{=\}3\(lr\)account change before run2480\.1990\.0270\.2220\.1360\.1840\.1020\.214account change before run3480\.0000\.0500\.0860\.1790\.0900\.1130\.127approver link2480\.8180\.2010\.2420\.2000\.3300\.1870\.854approver link3480\.0000\.0560\.0960\.1730\.1360\.0840\.094employee–vendor account2320\.2790\.0400\.1320\.1950\.2380\.1290\.268employee–vendor account3320\.0000\.0550\.0730\.1960\.0820\.1160\.118employee–vendor account4320\.0000\.0020\.0020\.1310\.0760\.0860\.085employee–vendor contact2320\.2650\.0170\.0540\.2620\.1280\.0710\.287employee–vendor contact3320\.0000\.0150\.0800\.1020\.0650\.0610\.062employee–vendor contact4320\.0000\.0000\.0010\.1460\.0570\.0680\.075ghost employee1480\.3240\.0510\.0360\.1400\.3860\.0450\.201ghost employee3480\.3990\.1590\.2960\.1860\.5950\.1360\.352shared payroll account2320\.2950\.0260\.1360\.1050\.1760\.1440\.236shared payroll account3320\.0000\.0420\.0920\.1950\.0810\.2170\.093shared payroll account4320\.0000\.0000\.0010\.1060\.0520\.1050\.071

Table 29:Link AUPRC per audit test \(exploratory\): Rules v2 is strongest on ghost\-employee and approver–payee tests, whose evidence is usually a direct edge, and the GraIL\-style model on employee–vendor tests\. The employee–vendor test merges the account and contact patterns; the sixth test, the SoD conflict, is entity\-only and appears in Table[30](https://arxiv.org/html/2610.41085#A5.T30)\.†GNN that is not a pre\-specified primary model \(descriptive\)\.audit test \(named after its scheme\)n\+n\_\{\+\}Rules tunedRules v2Pathfeatures \+ LRGraIL\-stylek=3k\{=\}3NBFNet\-style†Rules v2 \+GraIL\-stylek=3k\{=\}3\(lr\)Approver–payee link960\.2580\.4090\.1920\.2880\.3270\.566Bank\-account change before payroll run960\.1420\.1000\.0660\.2580\.2160\.267Employee–vendor account/contact1920\.0740\.1250\.0650\.4660\.3550\.425Ghost employee960\.1260\.4740\.1640\.2310\.5600\.409Shared payroll account960\.0410\.0990\.0400\.2770\.2100\.266

Table 30:Entity AUPRC per planted pattern \(exploratory\): entity GNNs gain most over Rules v2 on the employee–vendor patterns and the SoD conflict \(a control deficiency, read from role attributes\), the rules and their combination lead on approver links, and the link GNN aggregated by the maximum misses the SoD conflict\.n\+n\_\{\+\}counts all hops of a pattern\.†GNN that is not a pre\-specified primary model \(descriptive\)\.patternn\+n\_\{\+\}Rules v2Pathfeatures \+ LRR\-GCN\(entity\)†RDL\-style\(entity\)GraIL\-stylek=3k\{=\}3Rules v2 \+RDL\-style\(entity\) \(lr\)account change before run960\.3060\.2840\.3520\.3500\.2580\.362approver link960\.4270\.1720\.3750\.3020\.2890\.476employee–vendor account960\.3730\.5230\.5080\.5110\.3490\.488employee–vendor contact960\.1300\.2270\.3000\.2380\.3060\.197ghost employee960\.4670\.4480\.5080\.4370\.2350\.566shared payroll account960\.3660\.2620\.3120\.3100\.2770\.386SoD conflict960\.3270\.4120\.5020\.4110\.0280\.411

## Appendix FReproducibility and Provenance

#### Number provenance\.

Result macros and numerical table bodies are retained from the original and extension report exporters\. Source bindings record the report hashes\. This offline manuscript revision changes prose, ordering and captions, not recorded scores, table values, model fits or test decisions\. The original exporter reads study reports, training logs, freeze and design records, development outputs, audits and score\-only analyses; the extension uses a separate report exporter\. Design constants and the idealized twin\-reference value of 0\.5 are identified as such\.

#### Freeze\.

The prospective protocol, all code, the data manifest and the design document were frozen as 60 files with SHA\-256 checksums \(checksum\-file digest beginning598b8b47161d\) on 2026\-10\-14; the confirmatory run script refused to start unless every checksum and every data file matched, and wrote to a directory that it refused to overwrite\.

#### Environment\.

Python 3\.12\.15 with PyTorch 2\.14\.1 and PyTorch Geometric on CPU \(6 threads per process, low scheduling priority\) for the GNNs; Node\.js for the generator, rules, heuristics and path features\.

#### Addendum v2\.

Every addendum number is generated from the addendum report by a separate script into its own macro file; the addendum freeze \(text, 12 files, checksum\-file digest beginningef29f64b37209738\) was verified by the run script before any new score was computed, together with the original 60 frozen files\. Org\-cluster bootstrap with 1000 replicates \(rng seed 913\) as in the original run; CPU only, 4 threads, low priority\.

#### Artifact availability\.

Code and data \(generators, synthetic datasets and run records\) are available from the authors on request\.