ATM-GAD: Adaptive Temporal Fraud Detection

• ATM-GAD is a graph-based fraud detection model that leverages adaptive time windows and temporal motif analysis to identify anomalous financial transaction patterns.
• It employs dual-attention mechanisms to aggregate intra- and inter-motif evidence, thereby uncovering multi-step fraud schemes with improved AUC and AUPRC.
• The end-to-end architecture integrates a GCN backbone, adaptive window learning, and motif extraction to outperform baselines on diverse real-world datasets.

ATM-GAD, short for Adaptive Temporal Motif Graph Anomaly Detection for Financial Transaction Networks, is a graph-based fraud detection model for financial transaction networks that combines temporal motif analysis, adaptive per-node observation windows, and dual-attention aggregation. Its central premise is that financial fraud is often expressed through two temporally grounded signals: recurring, suspicious subgraphs that encode money-flow patterns as they unfold, and short, account-specific intervals of anomalous activity that are diluted by static or globally windowed models. ATM-GAD operationalizes these signals in an end-to-end trainable architecture that maps a financial transaction graph to node-level fraud probabilities (Zhang et al., 28 Aug 2025).

1. Formal setting and design objective

ATM-GAD is defined on a Financial Transaction Graph

$G=(V,E,X,T,Y),$

where $V$ is the set of accounts, $E$ is the set of directed transactions, $X\in\mathbb{R}^{n\times d}$ are node features, $T=\{t_v\}$ are node timestamps, and $Y=\{y_v\}\in\{0,1\}$ are fraud/non-fraud labels. Each directed edge $e=(u\to v)$ carries a timestamp $t_e$ (Zhang et al., 28 Aug 2025).

The architecture is organized into four stages: an input stage with a GCN backbone, an Adaptive Time-Window Learner, a Temporal Motif Extractor, and a Dual-Attention Aggregation module followed by prediction. In the backbone, a two- or three-layer GCN produces an initial embedding $h_v\in\mathbb{R}^d$ for each node; the GCN reference named in the formulation is Kipf and Welling’s model (Kipf et al., 2016).

The problem ATM-GAD addresses is narrower than generic graph anomaly detection. The model is designed for settings in which suspicious behavior is not fully captured by static neighborhood structure alone, because the relevant evidence lies in how small transaction subgraphs are ordered in time and in when, for a given account, those structures become salient. A plausible implication is that ATM-GAD is best understood as a node-level detector for temporally localized relational anomalies, rather than as a purely topological fraud classifier.

2. Adaptive temporal localization

A defining component of ATM-GAD is the Adaptive Time-Window Learner, which assigns each node $v$ a personalized observation horizon

$V$0

where $V$1 is the latest timestamp in the dataset, $V$2 is a sigmoid, and $V$3 is a small MLP (Zhang et al., 28 Aug 2025).

This construction ensures

$V$4

and remains differentiable, so the time-window parameters can be optimized jointly with the rest of the network. The learned window is then used to define the node-specific temporal interval $V$5 over which motifs are searched.

The role of this module is methodological rather than merely cosmetic. Fixed-window comparisons reported for ATM-GAD show that no single global $V$6 achieves both good AUC and AUPRC across datasets, whereas the learned per-node $V$7 consistently matches or outperforms the best fixed choice by 1–3 points in AUC and AUPRC (Zhang et al., 28 Aug 2025). This directly targets the claim that fraud often appears in short bursts unique to each account rather than over a uniform observation scale.

3. Temporal motifs and motif typing

ATM-GAD uses temporal motifs as its basic high-order units of evidence. In the general definition used by the model, a temporal motif is

$V$8

where $V$9, $E$0, $E$1, $E$2, and

$E$3

Here $E$4 is the set of edge timestamps (Zhang et al., 28 Aug 2025).

In the ATM-GAD instantiation, the model enumerates all 3-node, 3-edge temporal motifs of the form $E$5 whose edge timestamps satisfy the node-specific condition

$E$6

These motif instances are grouped by motif type $E$7, and the paper states that there are $E$8 static triad configurations. For node $E$9 and motif type $X\in\mathbb{R}^{n\times d}$0, the instance set is denoted

$X\in\mathbb{R}^{n\times d}$1

This extraction stage is explicitly designed to preserve both topology and temporal pattern. The paper’s qualitative description emphasizes that the relevant structures are not merely triads as static graphlets, but triads constrained by tight temporal succession, such as short money-flow chains that unfold within a learned node-specific interval (Zhang et al., 28 Aug 2025). A plausible implication is that ATM-GAD treats motif occurrence, temporal compactness, and motif-type heterogeneity as coupled signals rather than as separate feature families.

4. Dual-attention aggregation

The motif evidence is processed through two attention mechanisms: Intra-Motif Attention (IntraA) and Inter-Motif Attention (InterA).

For each motif instance $X\in\mathbb{R}^{n\times d}$2, ATM-GAD constructs an augmented 4-node “supernode” subgraph $X\in\mathbb{R}^{n\times d}$3 containing the target node $X\in\mathbb{R}^{n\times d}$4, its two partners, and a trainable supernode $X\in\mathbb{R}^{n\times d}$5. Their embeddings are stacked into

$X\in\mathbb{R}^{n\times d}$6

These are linearly projected as

$X\in\mathbb{R}^{n\times d}$7

and the attention matrix is computed by row-wise softmax:

$X\in\mathbb{R}^{n\times d}$8

Using the supernode’s row $X\in\mathbb{R}^{n\times d}$9, the instance embedding becomes

$T=\{t_v\}$0

ATM-GAD then introduces a recency weight

$T=\{t_v\}$1

where $T=\{t_v\}$2 is the latest edge-time in motif instance $T=\{t_v\}$3, and $T=\{t_v\}$4 is node $T=\{t_v\}$5’s earliest timestamp. This yields the type-specific embedding

$T=\{t_v\}$6

At the motif-type level, InterA scores each $T=\{t_v\}$7 by

$T=\{t_v\}$8

applies sparse attention

$T=\{t_v\}$9

and aggregates

$Y=\{y_v\}\in\{0,1\}$0

The final node representation is

$Y=\{y_v\}\in\{0,1\}$1

and a two-layer MLP $Y=\{y_v\}\in\{0,1\}$2 produces

$Y=\{y_v\}\in\{0,1\}$3

the predicted fraud probability (Zhang et al., 28 Aug 2025).

The interpretive significance of this design is explicit in the paper: IntraA reasons over interactions within a single motif, while InterA aggregates evidence across motifs to expose multi-step fraud schemes. The use of SparseMax rather than dense softmax at the inter-motif stage further indicates a preference for selective motif-type attribution rather than uniform smoothing across all 84 motif types.

5. Optimization and reported empirical performance

ATM-GAD is trained with standard binary cross-entropy on node labels:

$Y=\{y_v\}\in\{0,1\}$4

All parameters, including those of the $Y=\{y_v\}\in\{0,1\}$5-MLP, GCN backbone, $Y=\{y_v\}\in\{0,1\}$6, $Y=\{y_v\}\in\{0,1\}$7, and prediction head $Y=\{y_v\}\in\{0,1\}$8, are learned end-to-end by backpropagation. The formulation also allows optional $Y=\{y_v\}\in\{0,1\}$9 regularization,

$e=(u\to v)$0

with $e=(u\to v)$1 (Zhang et al., 28 Aug 2025).

The experiments are reported on four real-world financial graph datasets—Ethereum phishing (“ETH”), Elliptic++ (“Elli”), Bitcoin Alpha, and Bitcoin OTC—in eight size variants. ATM-GAD is compared against seven baselines: GraphSAGE, ARISE, HO-GAT, MotifGNN, COFD, Random Forest, and XGBoost. The primary metrics are AUC and AUPRC.

Dataset	ATM-GAD	Best baseline
ETH-200	AUC=0.911, AUPRC=0.739	MotifGNN: AUC=0.875, AUPRC=0.633
ETH-1000	AUC=0.961, AUPRC=0.844	MotifGNN: AUC=0.946, AUPRC=0.723
Elli-500	AUC=0.944, AUPRC=0.911	RandomForest: AUC=0.930, AUPRC=0.887
Bitcoin Alpha	AUC=0.762, AUPRC=0.618	HO-GAT: AUC=0.768, AUPRC=0.607

Across all eight variants, ATM-GAD achieves the highest AUPRC and is first or second in AUC. On average it outperforms the strongest motif-based baseline by +4–10 points in AUC and +10–20 points in AUPRC (Zhang et al., 28 Aug 2025).

The reported ablations isolate the contribution of each architectural component. Adding the Temporal Motif Extractor with fixed $e=(u\to v)$2 raises AUC by approximately 2%. Replacing fixed $e=(u\to v)$3 with adaptive $e=(u\to v)$4 adds another approximately 1–2% AUC. Adding either IntraA or InterA contributes approximately 1–3% AUC, and the full ATM-GAD configuration—adaptive $e=(u\to v)$5 plus IntraA and InterA—yields the overall +4–5% AUC gain over the GCN alone. These results position the model’s improvements as cumulative rather than attributable to a single mechanism.

6. Qualitative behavior, interpretation, and scope

The qualitative case study highlighted in the paper concerns the Ethereum fraud account 0x44a7…78. Over its full lifespan, ordinary methods observe a mixture of small and large transfers and miss a short-lived burst of laundering activity. ATM-GAD’s adaptive $e=(u\to v)$6 instead zooms in on that burst structurally and temporally: it captures 3-node money-flow triads in tight succession, tunes $e=(u\to v)$7 to the duration of the burst, and then uses dual attention to emphasize the intra-motif ordering [small→medium→spike→back] while aggregating across multiple motif types to uncover a multi-step scheme described as payer→mule→beneficiary chains (Zhang et al., 28 Aug 2025).

The paper also reports that heat-maps of temporal motif counts show fraud nodes clustering in distinct motif-count signatures, including high frequency of “fan-in” triads in short windows. According to that account, GraphSAGE or fixed-$e=(u\to v)$8 motif models cannot separate these patterns from normal traffic as effectively, whereas ATM-GAD’s per-node, per-motif attention upweights the suspicious motifs that matter for precision and recall on rare fraud labels.

A common misconception in this area is that static triad counts, or a single global temporal horizon, are sufficient to capture fraud structure. The ATM-GAD results argue against that view in two ways. First, the reported gains from adaptive windows indicate that fraud evidence is time-local and account-specific rather than globally synchronized. Second, the gains from IntraA and InterA indicate that the ordering within a motif and the selective combination of motif types both matter. This suggests that ATM-GAD should be situated within the broader class of graph fraud detectors as a model that explicitly fuses temporal localization, motif enumeration, and hierarchical attention into a single anomaly-scoring pipeline.