Human-Centered LLM-Agent System for Detecting Anomalous Digital Asset Transactions

This paper presents HCLA, a human-centered multi-agent system that enhances transparency and accountability in digital asset anomaly detection by reconstructing traceable, expert-style reasoning processes through a conversational workflow that separates evidence scoring from justification, rather than merely explaining black-box models.

The Gist

Imagine you are trying to solve a mystery in a giant, chaotic library where millions of books (transactions) are being swapped every second. Some of these books are normal, but a few are "forgeries" or "stolen goods" (anomalous transactions).

In the past, finding these forgeries required a team of highly trained detectives who spoke a secret, complex language (code and math). If you weren't a detective, you couldn't even ask a question, let alone find the culprit.

This paper introduces "HCLA," a new system that acts like a friendly, super-smart detective assistant who speaks your language.

Here is how it works, broken down into simple parts:

1. The Three-Person Detective Squad

Instead of one giant, confusing computer brain, HCLA uses a team of three specialized "agents" (AI helpers) who talk to each other to solve the mystery:

• The Translator (Parsing Agent):
  • What it does: You type a question in plain English, like, "Hey, did anything weird happen in my wallet last week?"
  • The Analogy: Think of this agent as a bilingual secretary. You speak "Human," and it instantly translates your request into "Computer Code" (a structured list of data) that the machine can understand. It figures out exactly which dates, addresses, and amounts you are talking about.
• The Forensic Expert (Detection Agent):
  • What it does: This is the math wizard (using a tool called XGBoost). It looks at the data the Translator gave it and does the heavy lifting. It calculates the odds that a transaction is suspicious.
  • The Analogy: This is the detective with a magnifying glass. It doesn't care about your feelings; it just crunches the numbers to find the fingerprints. It says, "This transaction has a 90% chance of being a forgery."
• The Storyteller (Explanation Agent):
  • What it does: The math expert gives a number (like "0.90"), but that doesn't help you sleep at night. The Storyteller takes that number and turns it into a clear sentence.
  • The Analogy: This is the detective explaining the case to the jury. Instead of saying "Probability = 0.90," it says, "This transaction looks suspicious because it sent a huge amount of money to a stranger in the middle of the night, which is something normal people don't do."

2. The Conversation Loop

The magic of HCLA is that it's not a one-way street. It's a conversation.

• You: "Show me the weird stuff from last Tuesday."
• HCLA: "Here is a suspicious transaction. It sent money to an unverified address."
• You: "Wait, why is that address unverified? Is it a known scammer?"
• HCLA: "I checked the database. That address has never been used before and is linked to a 'mixer' (a tool used to hide money trails)."

You can keep asking "Why?" or "What if?" just like you would with a human colleague. The system remembers the context and adjusts its answers.

3. Why This Matters (The "Aha!" Moment)

The researchers tested this system with a group of experts (who acted like regular users). They compared HCLA to the old way (just showing a dashboard of numbers).

• The Old Way: Like being handed a spreadsheet full of red and green numbers. You know something is wrong, but you don't know why, and you don't trust it.
• The HCLA Way: Like having a detective walk you through the crime scene, pointing out the muddy footprints and the broken window.

The Results:

• Trust: People trusted the system much more because they understood the reasoning.
• Clarity: Even non-experts could understand the risks without needing a degree in computer science.
• Accuracy: The system was just as good at finding the bad transactions as the old, complex math models, but it was much easier to use.

The Bottom Line

This paper proposes a new way to handle financial security. Instead of building "black boxes" that only experts can open, they built a glass box where you can see exactly how the AI thinks.

It turns a scary, complex task (finding money laundering or fraud) into a simple chat. It's like upgrading from a manual typewriter that only a few people know how to use, to a smart voice assistant that helps you write a story, checks your grammar, and explains why it made its suggestions.

In short: HCLA makes high-tech financial forensics accessible to everyone, ensuring that when the AI raises an alarm, you know exactly why, and you can trust it.

Technical Summary

Here is a detailed technical summary of the paper "Human-Centered LLM-Agent System for Detecting Anomalous Digital Asset Transactions" (HCLA).

1. Problem Statement

The rapid evolution of decentralized finance (DeFi) and privacy tools (e.g., mixers like Wasabi Wallet) has made monitoring digital asset transactions increasingly difficult. Existing anomaly detection systems face two primary challenges:

• Opacity: High-performing models often operate as "black boxes," requiring specialized expertise to interpret results.
• Inaccessibility: Non-expert users (auditors, compliance officers, or general users) cannot easily query, probe, or refine detection logic without writing code or understanding complex data schemas.
• Lack of Interaction: Current systems typically offer one-way reporting, lacking mechanisms for sustained dialogue or iterative reasoning refinement.

2. Methodology: The HCLA Framework

The authors propose HCLA (Human-Centered LLM-Agent), a multi-agent system that transforms anomaly detection from a static classification task into an interactive, conversational workflow. The system is built on a modular architecture orchestrated via a Gradio web interface.

Core Architecture

The system decomposes the detection process into three specialized agents communicating via JSON messages under a central controller:

1. Parsing Agent (LLM-A):

   • Role: Converts unstructured natural language queries (e.g., "Check my wallet for suspicious activity last week") into structured JSON schemas.
   • Mechanism: Uses prompt engineering to extract entities (wallet IDs, time ranges, value thresholds) and resolve ambiguities through interactive clarification.
   • Output: A normalized schema compatible with the detection model.

2. Detection Agent (XGBoost Baseline):

   • Role: Computes anomaly probabilities based on the structured features.
   • Mechanism: Utilizes an XGBoost model trained on engineered temporal, transactional, and graph-connectivity features (frequency, direction, connectivity).
   • Modularity: While XGBoost is the prototype, the architecture supports swapping in Graph Neural Networks (GNNs) or temporal models without altering the orchestration layer.

3. Explanation Agent (LLM-B):

   • Role: Translates numerical anomaly scores and feature weights into human-readable, context-aware narratives.
   • Mechanism: Generates plain-language rationales (e.g., "High risk due to repeated high-value transfers to unverified counterparties during off-peak hours") and supports follow-up questions.

Interaction Loop

The system operates in a cyclical Human-in-the-Loop manner:

1. User Query: Natural language input.
2. Parsing: Conversion to JSON schema.
3. Detection: Calculation of anomaly likelihoods ($p(a)$).
4. Explanation: Generation of narrative reasoning.
5. Refinement: The user can filter, group, or pivot the analysis (e.g., "Show only exchange-linked clusters"), triggering a re-evaluation with preserved context.

3. Dataset and Experimental Setup

• Dataset: A labeled Bitcoin-mixing dataset derived from Wasabi Wallet (2020–2024), containing 318,388 normal and 69,031 anomalous transactions.
• Split: Training on 2020–2022 data; testing on 2023–2024 data to simulate real-world deployment.
• Evaluation Protocol:
  • Quantitative: Standard metrics (Accuracy, Precision, Recall, F1-score) and latency.
  • Qualitative: A Simulated User Study involving a "Micro-Expert Panel" ($n=32$) with AI and Digital Asset backgrounds. Participants compared HCLA's narrative explanations against a baseline XGBoost numerical dashboard.

4. Key Results

Quantitative Performance

The underlying XGBoost detector achieved strong performance metrics, ensuring that the LLM layer did not compromise detection accuracy:

• Accuracy: 0.9159
• Precision: 0.9317
• Recall: 0.9159
• F1-Score: 0.9209
• Latency: < 2 seconds per query (average response time in the interactive loop).

User Study Findings

The simulated user study demonstrated significant improvements in human-centric metrics:

• Trust and Clarity: Participants rated HCLA explanations significantly higher than the numerical dashboard on both Trust and Clarity scales ($p < .001$).
• Comprehension: The narrative format improved the ability of non-experts to understand the "why" behind an anomaly, not just the "what."
• Reliability: Cronbach's $\alpha$ values for clarity (0.94–0.98) and trust (0.82–0.90) indicated high internal consistency in the survey instruments.

5. Key Contributions

1. Conversational Workflow: Introduced a modular pipeline that couples natural-language intents with structured anomaly analytics, allowing non-experts to steer analysis without coding.
2. Separation of Concerns: Distinct Parsing, Detection, and Explanation modules ensure that improvements in one area (e.g., a better detector) do not destabilize the others.
3. Human-Centered Interpretability: Demonstrated that interactive, human-readable rationales enhance accessibility and trust without sacrificing detector performance.
4. Auditability: The system makes every step (Parsing $\to$ Detection $\to$ Explanation) visible and queryable, fostering transparency in financial forensics.

6. Significance and Limitations

Significance:
HCLA bridges the gap between algorithmic intelligence and human sensemaking. By treating anomaly detection as a conversation plus computation, it lowers the barrier to entry for financial auditing and compliance, making high-dimensional financial data accessible to a broader audience. It advances the vision of "Human-Centered AI" by prioritizing transparency and user control over raw automation.

Limitations:

• Computational Latency: LLM calls introduce a 2–3 second delay per query, which may hinder real-time monitoring of high-frequency streams.
• Domain Adaptation: General-purpose LLMs occasionally produce ambiguous terminology (e.g., confusing "cluster" vs. "wallet"), necessitating domain-specific fine-tuning.
• Scalability: The current prototype handles batch processing; scaling to continuous blockchain streams requires asynchronous orchestration and caching.
• Study Scope: The user study relied on a small academic panel, limiting the external validity of the trust/clarity findings.

Future Directions:
The authors plan to integrate real-time streaming pipelines (Kafka/Flink), fine-tune LLMs on financial corpora to reduce semantic drift, and conduct large-scale, IRB-approved user validation studies.