---
title: Ethereum Transaction Knowledge Graph
url: https://www.emergentmind.com/topics/transaction-knowledge-graph-tkg
type: topic
---

# Ethereum Transaction Knowledge Graph

Searching arXiv for the cited papers to ground the article in current literature.
A Transaction Knowledge Graph (TKG), in the formulation introduced in "KGBERT4Eth" [2509.03860], is a multi-relational directed graph over Ethereum addresses and transaction relations, designed to encode fund-flow structure together with expert-curated behavioral features. Within that framework, the TKG is one of two jointly trained components of a feature-complete encoder, the other being a Transaction Language Model (TLM) operating over conceptualized transaction records. The TKG supplies structured representations of transaction modalities, latent transaction relationships, and node-level financial, temporal, and network-structural signals, and is integrated with the transformer stream through masked co-attention during pre-training [2509.03860].

## 1. Formal definition and representational scope

In KGBERT4Eth, the TKG is defined as a multi-relational directed graph
$$
G = (V, E),
$$
where \(V\) is the set of entities, identified with Ethereum addresses, and \(E \subseteq V \times R \times V\) is the set of labeled edges or triples \((h,r,t)\) [2509.03860]. The node set comprises two account types: Externally Owned Accounts (EOA) and Contract Accounts (CA). The relation vocabulary contains two high-level transaction modalities: **external_tx**, denoting a direct Ether transfer from one address to another, and **contract_tx**, denoting a transfer or call that routes through a smart contract. Semantically, a triple \((h,r,t)\) means that entity \(h\) engages in a transaction of type \(r\) with entity \(t\) [2509.03860].

Each node \(v_i \in V\) is initialized with a real-valued feature vector \(x_i \in \mathbb{R}^F\). These attributes span three categories. The first is **financial statistics**, including examples such as max/min/avg incoming/outgoing amounts, balance, and in/out ratio. The second is **temporal activity**, including account lifetime, active days, and short/long-term transfer frequencies. The third is **network-structural metrics**, including degree, betweenness, closeness, Katz and eigenvector centralities, and clustering coefficient [2509.03860].

This schema makes the TKG explicitly heterogeneous at both the edge and feature levels. A plausible implication is that the graph is intended to preserve distinctions that would be collapsed in purely sequence-based or purely embedding-based fraud detectors. In the paper’s terminology, this is part of the broader attempt to combine structured fund-flow patterns with human-curated feature insights [2509.03860].

## 2. Construction from on-chain transaction records

The graph construction process begins with node extraction from raw on-chain data. All distinct addresses appearing in the **from**, **to**, or **contractAddress** fields of transactions are collected into \(V\). Each address is then labeled as EOA or CA depending on whether it ever appears as a **contractAddress** [2509.03860].

Edge extraction is transaction-wise. For each transaction record \(t\), let \(h = t.from\) and \(t = t.to\). If \(t.contractAddress\) is empty, the graph adds the triple \((h,\text{external\_tx},t)\). Otherwise, when the record corresponds to a contract invocation, it adds \((h,\text{contract\_tx},t)\) [2509.03860]. The resulting edge set therefore distinguishes direct Ether transfers from contract-mediated interactions using only two relation types.

Feature computation proceeds over a historical window. Per-node statistics such as total numbers of incoming and outgoing transfers and transferred amounts are computed. Temporal indicators are then derived, with lifetime defined as
$$
\text{last timestamp} - \text{first timestamp},
$$
and active days defined as the number of distinct days. A one-hop transaction graph is constructed to compute centrality and clustering metrics. These signals are concatenated to form the initial node embedding \(v_i^{(0)}\) [2509.03860].

The paper’s pseudocode summarizes this pipeline as follows: all unique addresses are inserted into \(V\); expert features \(x_v\) are computed for each node; an MLP maps these to initial node states \(v_v^{(0)}\); and the edge set \(E\) is populated by iterating over transactions and assigning either **external_tx** or **contract_tx** according to whether **contractAddress** is empty [2509.03860].

## 3. Embedding methodology and transaction link prediction

The TKG encoder is GNN-based. At layer \(l\), node embeddings \(\{v_i^{(l)}\}\) are updated by attention-weighted neighborhood aggregation:
$$
m_{s\to i} = W_m [v_s^{(l)} \parallel r_{s,i}],
$$
$$
\alpha_{s,i} = \text{softmax}_s \left( \frac{q_s \cdot k_i^\top}{\sqrt{d}} \right),
$$
where
$$
q_s = W_q v_s^{(l)}, \qquad
k_i = W_k [v_i^{(l)} \parallel r_{s,i}],
$$
and
$$
v_i^{(l+1)} = \sigma\!\left( W_v \cdot \sum_{s \in N_i \cup \{i\}} \alpha_{s,i} m_{s\to i} \right).
$$
Here \(r_{s,i} \in \mathbb{R}^d\) is the learned embedding of the relation label on edge \((s \to i)\), \(W_m, W_q, W_k, W_v\) are learnable linear maps, and \(\sigma\) is a nonlinearity. The formulation also permits multi-head variants through repetition with separate parameter sets [2509.03860].

Pre-training on the graph uses a Transaction Link Prediction (TLP) objective. Let \(S\) be the set of positive triples \((h,r,t) \in E\), and let \(S'\) be a set of negative, corrupted triples. Using a scoring function \(d(v_h,r,v_t)\), with examples including TransE, RotatE, and DistMult, the loss is defined as
$$
L_{\text{TLP}} =
\sum_{(h,r,t)\in S} -\log \sigma(\gamma - d(v_h,r,v_t))
+
\sum_{(h',r,t')\in S'} -\log \sigma(d(v_{h'},r,v_{t'}) - \gamma),
$$
where \(\gamma\) is a margin and \(\sigma\) is the sigmoid. The paper also gives a simplified notation:
$$
L_{\text{TLP}}(\theta^l) =
\sum_{(h,r,t)\in S} [-\sigma(d(v_h,r,v_t))]
+
\sum_{(h',r,t')\in S'} [\sigma(d(v_{h'},r,v_{t'}))].
$$
For graph pre-training in the full model, RotatE scoring is used by default [2509.03860].

This embedding design makes the TKG not merely a static store of engineered features, but a learnable relational encoder whose node representations are updated by message passing and supervised by link prediction. This suggests that latent transaction regularities are expected to emerge from both topological context and explicit relation labels.

## 4. Coupling with the transformer through mask-invariant attention synergy

The TKG is not trained in isolation. In KGBERT4Eth it is jointly optimized with a transformer-based TLM through a **mask-invariant attention synergy** module. At layer \(l\), the transformer provides semantic embeddings
$$
H^{(l)} = [h_{\text{CLS}}^{(l)}; h_1^{(l)}; \dots; h_L^{(l)}] \in \mathbb{R}^{(L+1)\times d},
$$
while the graph encoder provides entity embeddings
$$
V^{(l)} = [v_1^{(l)}; \dots; v_{|V|}^{(l)}] \in \mathbb{R}^{|V|\times d}.
$$
The co-attention update from semantics to graph restricts cross-attention so that only the \([CLS]\) position can attend to \(V\), implemented by a visibility mask
$$
M[p,q] =
\begin{cases}
0 & \text{if } p = C \\
-\infty & \text{otherwise}.
\end{cases}
$$
The attention weights are
$$
\alpha_{p,v} = \text{softmax}_v \left( \frac{q_p \cdot k_v^\top + M[p,v]}{\sqrt{d}} \right),
$$
and the attended representation is
$$
\hat y_{h_p}^{(l)} = \sum_{v=1}^{|V|} \alpha_{p,v} \cdot v_v^{(l)}.
$$
In practice, only \(p=\text{CLS}\) receives non-masked attention; all other tokens remain unchanged [2509.03860].

The update is symmetric in the reverse direction. Treating \(V^{(l)}\) as queries, graph embeddings are allowed to attend only to \(h_{\text{CLS}}\):
$$
\alpha_{v,p} = \text{softmax}_p \left( \frac{q_v \cdot k_p^\top + M'[v,p]}{\sqrt{d}} \right),
$$
$$
\hat y_v^{(l)} = \sum_{p=\text{CLS}} \alpha_{v,p} \cdot h_p^{(l)}.
$$
The fused outputs are integrated by residual feed-forward updates and layer normalization:
$$
h_{\text{CLS}}^{(l)} \leftarrow \text{LayerNorm}\bigl(h_{\text{CLS}}^{(l)} + \text{FFN}(\hat y_{h_{\text{CLS}}}^{(l)})\bigr),
$$
with each \(v_i^{(l)}\) updated analogously [2509.03860].

A notable design decision is that no extra coordination loss is introduced; the two streams influence each other purely through this masked co-attention. Within the paper’s framework, the TKG therefore contributes to representation fusion indirectly through layerwise interaction rather than through a separate alignment objective.

## 5. Joint pre-training objectives, algorithmic workflow, and operational scale

The transformer stream is pre-trained with **Biased Masked Prediction (BMP)**. For each account’s transaction text \(X_i\), BM25 scores are computed per token. A token \(tok_j\) is masked if
$$
\frac{\text{BM25}(tok_j, X_i)}{\sum_{tok' \in X_i} \text{BM25}(tok', X_i)} > \tau,
$$
with \(\tau = 0.1\), and standard MLM cross-entropy is applied only over selected tokens:
$$
L_{\text{BMP}} = - \sum_{i=1}^L \text{Mask}(tok_i)\cdot \log P(tok_i \mid h_i).
$$
The graph stream is trained with the TLP objective described above, and the combined loss is
$$
L = L_{\text{BMP}} + L_{\text{TLP}}.
$$
The paper states that the biased masking task is designed to emphasize rare anomalous transactions by focusing on statistical outliers [2509.03860].

The joint pre-training loop alternates between transformer forward propagation over masked transaction text, GNN propagation over sampled account subgraphs, application of the mask-invariant attention synergy module, and accumulation of \(L_{\text{BMP}}\) and \(L_{\text{TLP}}\). Parameters of both encoders are then updated jointly by back-propagation. In the provided pseudocode, a batch of accounts \(B\) and their subgraphs \(G_B\) are sampled; token embeddings are processed through transformer layers; node embeddings are processed through GNN layers; the MiAS module fuses the streams; and losses are accumulated before an optimizer step [2509.03860].

The operational scale reported for pre-training is a corpus of **3.25 M transactions**, yielding approximately **500 k nodes** and **1 M edges**. The transformer backbone is **BERT-base (12 layers, \(d=768\))** with maximum sequence length \(L_{\max}=512\). The mask threshold is \(\tau=0.1\) using the **BM25L variant**. The number of GNN layers is not explicitly fixed, though **2–3** are described as typical experimentally. At fine-tuning time, subgraph sampling uses a **2-hop neighborhood with \(\le 100\) nodes**. Optimization uses the **Adam optimizer (standard BERT settings)** with learning rate approximately **\(1\text{e-}4\)** and total steps approximately **100 k** [2509.03860].

## 6. Role in Ethereum fraud detection and relation to broader TKG literature

Within KGBERT4Eth, the TKG is one component of a feature-complete encoder for **multi-task Ethereum fraud detection**. The paper states that existing detection mechanisms bifurcate into three technical strands: expert-defined features, graph embeddings, and sequential transaction patterns, and argues that the absence of cross-paradigm integration mechanisms forces practitioners to trade off among sequential context awareness, structured fund-flow patterns, and human-curated feature insights. The TKG is introduced specifically to incorporate expert-curated domain knowledge into graph node embeddings so as to capture fund-flow patterns and human-curated feature insights, while the TLM captures contextual semantic representations from conceptualized transaction records [2509.03860].

Empirically, KGBERT4Eth is reported to significantly outperform state-of-the-art baselines in both phishing account detection and de-anonymization tasks, with **absolute F1-score improvements of 8–16% on three phishing detection benchmarks and 6–26% on four de-anonymization datasets** [2509.03860]. Because the model is defined as jointly optimizing the TLM and TKG pre-training objectives, these improvements are attributed at the system level rather than to the graph component alone.

A common source of terminological ambiguity is that **TKG** is also widely used to denote **Temporal Knowledge Graph** in the knowledge graph forecasting and completion literature. In that literature, a TKG is a set of timestamped quadruples \((s,r,o,t)\) or, equivalently, a sequence of graph snapshots \(\{G_1,G_2,\dots,G_T\}\), and typical tasks involve forecasting future facts or completing missing entities under temporal constraints [2305.10613]. T-GAP, for example, defines a Temporal Knowledge Graph as a set of time-annotated facts \(G_{\text{KG}}=\{(v,r,u,t)\}\) and studies query answering of the form \((v_{\text{query}},r_{\text{query}},?,t_{\text{query}})\) באמצעות displacement-aware temporal GNN encoding and path-based attention flow [2012.10595]. HyperVC likewise treats a TKG as a sequence of graph snapshots and models chronological hierarchies autoregressively in hyperbolic space with variable curvature [2209.05635].

This dual usage does not indicate conceptual identity between the two notions. In KGBERT4Eth, the TKG is a transaction-centric, feature-augmented relational graph over Ethereum accounts; in the temporal KG literature, the graph is defined primarily through timestamped facts and forecasting or completion objectives. A plausible implication is that the acronym alone is insufficiently specific in cross-domain discussion, especially when blockchain transaction graphs and temporal knowledge graphs are both under consideration.

Source: https://www.emergentmind.com/topics/transaction-knowledge-graph-tkg