LMAE4Eth: Multi-View Ethereum Fraud Detection

• LMAE4Eth is a multi-view learning framework that integrates transaction semantics, masked graph autoencoding, and expert knowledge to detect fraudulent Ethereum accounts.
• TxCLM converts transaction histories into linguistic tokens using masked modeling and token-aware contrastive learning, with its removal causing a significant 17% F1 drop.
• MAGAE, combined with a cross-attention fusion network, reconstructs expert-crafted node features and accelerates mini-batch processing by 3.8x–5.4x on large-scale Ethereum networks.

LMAE4Eth is a multi-view learning framework for Ethereum fraud detection that fuses transaction semantics, masked graph embedding, and expert knowledge. It was introduced to address three limitations identified in prior work: reliance on context-independent, numerical transaction sequences; difficulty learning discriminative account embeddings from the pervasive homogeneity of Ethereum transaction records; and the mismatch between graph-reconstruction-oriented self-supervised learning and node-level fraud account detection, together with associated scalability challenges. The framework combines a transaction-token contrastive LLM (TxCLM), a masked account graph autoencoder (MAGAE), and a cross-attention fusion network (CAFN), and is evaluated against 21 baseline approaches on three datasets (Jia et al., 4 Sep 2025).

1. Problem Setting and System Composition

LMAE4Eth treats Ethereum fraud detection as a node-level account classification problem in which neither purely sequential modeling nor purely structural modeling is considered sufficient. The framework therefore uses two complementary views of an account. One view represents transaction histories as logically cohesive linguistic representations; the other represents the account in a transaction graph with expert-crafted node features and normalized transaction-count edge weights. These views are then unified through cross-attention rather than simple concatenation or addition (Jia et al., 4 Sep 2025).

The system has three principal components. TxCLM converts each account’s transaction history into a token sequence and pretrains a Transformer with masked transaction modeling and token-aware contrastive learning. MAGAE performs generative self-supervised learning on the account graph by masking node features and reconstructing them, with a design choice that explicitly prioritizes node representations over graph reconstruction. CAFN aggregates the semantic and graph views through learnable tokens and cross-attention before a task-specific classifier predicts fraud labels.

A notable feature of the framework is that it is explicitly multi-view rather than merely hybrid. The semantic branch is intended to expose behavioral signals in transaction amount, direction, and timing, while the graph branch incorporates transaction statistics, temporal behaviors, and centralities. The paper’s ablations indicate that these components are not interchangeable: removing TxCLM produces a much larger degradation than removing MAGAE, while omitting the fusion mechanism also materially reduces performance. This suggests that the reported gains are driven by both semantic enrichment and controlled integration across views, rather than by any single masked-modeling module alone.

2. TxCLM: Transaction-Semantic Language Modeling

TxCLM begins from the premise that raw numerical transaction sequences are context-independent and therefore semantically impoverished. For an account with transaction history $\mathcal{T} = \{t_1,\dots,t_N\}$, each transaction is written as

$t_i = (v_i, d_i, \tau_i),$

where $v_i$ is amount, $d_i \in \{-1,1\}$ is direction, and $\tau_i$ is timestamp. Each transaction is then transformed into a textual sequence,

$$\mathcal{L}(t_i) = \{\text{"amount:" } v_i,\ \text{"direction:" } d_i,\ \text{"timestamp:" } \tau_i\}.$$

Addresses are intentionally omitted to avoid tokenization issues; structural account information is handled by MAGAE instead (Jia et al., 4 Sep 2025).

The pretraining objective has two parts. The first is a standard BERT-style masked language modeling objective, referred to in the paper as masked transaction modeling. The second is token-aware contrastive learning, motivated by the claim that high transaction homogeneity in Ethereum leads to isotropic embeddings with limited discriminability. The contrastive setup uses two branches: an anchor model $A$ that is frozen and an enhanced model $E$ that is trainable, with both initially sharing BERT weights. Given masked input $\tilde{\mathcal{C}}$, the paper defines the token-aware loss as

$$\mathcal{L}_{\mathrm{Ta}} = -\sum_{i=1}^{n}\mathrm{mask}(\tilde{x}_i)\cdot \log \frac{\exp(\mathrm{sim}(\tilde{h}_i,h_i)/\tau)} {\sum_{j=1}^{n}\exp(\mathrm{sim}(\tilde{h}_i,h_j)/\tau)},$$

where $t_i = (v_i, d_i, \tau_i),$0 is cosine similarity, $t_i = (v_i, d_i, \tau_i),$1 is the temperature, and $t_i = (v_i, d_i, \tau_i),$2 indicates a masked token. The total TxCLM objective is

$t_i = (v_i, d_i, \tau_i),$3

Within the reported system, TxCLM is not simply a language-model front end. It is the mechanism by which account behavior is rendered semantically legible. The paper’s ablation reports that removing the LLM causes a -17% F1 drop, and removing token-aware contrastive learning causes a -3% F1 drop (Jia et al., 4 Sep 2025). This places the semantic branch at the center of the framework’s discriminative capacity.

3. MAGAE: Masked Account Graph Autoencoding and Scalable Sampling

MAGAE addresses a different weakness: the paper argues that prior graph methods either overemphasize structure-centric reconstruction or suffer from neighborhood explosion and over-smoothing. Instead of reconstructing the graph, MAGAE reconstructs account node features, which the paper presents as a better fit for node-level fraud detection (Jia et al., 4 Sep 2025).

Each node is initialized with a rich handcrafted feature vector derived from expert knowledge. The paper lists transaction statistics, temporal behaviors, and centralities among these features, including in-degree, out-degree, max/min/average in-/out-amount, balance, lifetime, transfer frequencies, degree centrality, betweenness centrality, eigenvector centrality, and clustering coefficient. Edge weights are normalized transaction counts.

During pretraining, a subset of nodes in a batch is masked by replacing its feature vector with a mask token. An encoder $t_i = (v_i, d_i, \tau_i),$4 operates on the sampled adjacency and masked node features, while a decoder $t_i = (v_i, d_i, \tau_i),$5 reconstructs the original node features from hidden states in which masked nodes are replaced with a decoder mask token. The reconstruction loss is the Scaled Cosine Error (SCE) on masked nodes:

$t_i = (v_i, d_i, \tau_i),$6

where $t_i = (v_i, d_i, \tau_i),$7 is the reconstructed feature and $t_i = (v_i, d_i, \tau_i),$8 is the scaling factor. After pretraining, only the encoder is retained to produce final node embeddings.

To make this practical on million-node graphs, the framework integrates layer-neighbor sampling through LABOR. For every node $t_i = (v_i, d_i, \tau_i),$9 in a batch, a subset of neighbors is sampled probabilistically, reducing edges and nodes per batch. The paper reports that this led to a 3.8x–5.4x speedup in mini-batch processing and an order-of-magnitude reduction in sampled edges compared to PLADIES/LADIES sampling (Jia et al., 4 Sep 2025). In the paper’s interpretation, LABOR is not an incidental engineering detail but a prerequisite for scaling masked graph embedding to real Ethereum transaction networks.

4. Cross-Attention Fusion and Supervised Fraud Detection

The semantic and graph branches are integrated by a Cross-Attention Fusion Network (CAFN). The paper motivates CAFN by stating that existing work usually combines heterogeneous features by simple concatenation or addition, whereas LMAE4Eth uses cross-attention with learnable aggregation tokens to dynamically integrate information from both views (Jia et al., 4 Sep 2025).

Let $v_i$0 denote the semantic embedding from TxCLM and let $v_i$1 denote the graph embedding from MAGAE. The first fusion step aggregates semantic tokens through learnable tokens $v_i$2:

$v_i$3

The resulting semantic representation $v_i$4 is then combined with the graph embedding $v_i$5 through a linear layer,

$v_i$6

followed by a second cross-attention stage with learnable fusion tokens $v_i$7:

$v_i$8

Fraud prediction is then performed by an MLP with cross-entropy loss,

$v_i$9

The paper reports that CAFN versus naive fusion yields +5–7% F1, indicating that the fusion mechanism is itself a material contributor rather than a neutral wrapper around two already-strong encoders (Jia et al., 4 Sep 2025). A plausible implication is that semantic and graph embeddings are not aligned well enough for fixed linear composition, and that attention-based aggregation is useful precisely because the two views encode different granularities of evidence.

5. Evaluation, Datasets, and Empirical Behavior

LMAE4Eth is evaluated on three datasets: MulDiGraph, B4E, and SPN. The paper describes them as follows.

Dataset	Graph scale	Fraud labels
MulDiGraph	2.97M nodes, 13.6M edges	1,165 phishing accounts
B4E	597K nodes, 11.7M edges	3,220 phishers
SPN	496K nodes, 831K edges	5,619 phishers

The comparison set contains 21 baseline approaches spanning shallow graph embedding, sequence models, and graph-based GNNs/autoencoders. The reported F1 results are:

Dataset	LMAE4Eth F1	Best baseline F1
MulDiGraph	0.8960	0.7936
B4E	0.8143	0.7258
SPN	0.8002	0.7353

The paper further states that balanced accuracy surpasses all baselines by 4–7% across datasets (Jia et al., 4 Sep 2025). These results are accompanied by several ablations. Removing TxCLM causes -17% F1; removing MAGAE causes -3.6% F1; removing expert features causes -2.5% F1; and replacing TxCLM/MAGAE with BERT/GAT produces a >2–4% F1 drop. The account-semantics branch is therefore the largest single contributor in the reported experiments, while masked graph embedding, expert features, and cross-attention each add smaller but still substantive gains.

The framework is also evaluated under more restrictive settings. On isolated connected-component splits, where training, validation, and test accounts lie in separate subgraphs, LMAE4Eth still achieves 5–10% higher F1 than the best baselines. Under few-shot robustness, with only 1% of data (~6K samples), the method achieves 56% F1, compared with 9–45% for baselines. These results are used in the paper to support the descriptor “generalizable and robust.”

6. Interpretation, Scope, and Position in Ethereum Fraud Detection

LMAE4Eth occupies a specific position within Ethereum fraud detection research. It is neither a purely sequential fraud detector nor a purely graph-based detector, and it does not frame self-supervision primarily as graph reconstruction. Instead, it combines a semantic account history encoder, a feature-reconstructive graph encoder, and expert-designed statistics in a single pipeline (Jia et al., 4 Sep 2025).

One potentially misleading reading of the name is to treat the method as merely another masked autoencoder. The paper’s technical design shows otherwise. The framework contains a masked graph autoencoder, but its overall contribution is broader: it explores transaction semantics through language modeling, counteracts homogeneous transaction records with token-aware contrastive learning, injects expert knowledge through handcrafted account features, and then resolves view interaction through cross-attention. The reported ablations support this broader interpretation.

The paper also advances a particular methodological claim about self-supervised objectives for fraud detection. By focusing MAGAE on reconstructing account node features rather than graph structure, it argues for a closer alignment between pretraining target and downstream task. This does not amount to a universal claim that structure reconstruction is ineffective; rather, within the reported experiments, node-feature reconstruction is presented as superior for node-level account detection. Likewise, LABOR sampling is presented not as a general replacement for all graph sampling schemes, but as the mechanism that enables large-scale training without compromising training quality.

In aggregate, LMAE4Eth proposes that high-performance Ethereum fraud detection requires simultaneous modeling of what accounts do, how accounts are situated in the graph, and which expert-derived statistics summarize long-range behavioral regularities. The empirical record reported for the framework indicates that this combination is more effective than any of those views in isolation.