Technical Summary: FedGraph-VASP

Problem Statement

Virtual Asset Service Providers (VASPs) face a critical dilemma in combating cross-institutional money laundering. Effective detection of sophisticated schemes, such as "chain-hopping" across multiple blockchains and institutions, requires access to transaction data beyond a single entity's silo. However, regulatory frameworks like the FATF "Travel Rule" mandate data sharing that conflicts with user privacy and competitive intelligence concerns.

Current solutions are insufficient:

• Siloed Local Training: While preserving privacy, these systems fail to detect cross-chain laundering patterns, creating a "cross-chain blind spot."
• Standard Federated Learning (e.g., FedAvg): These methods exchange model parameters but fail to capture cross-institutional graph topology because they do not share structural information about edges connecting different clients.
• Generative Imputation (e.g., FedSage+): While attempting to synthesize missing neighbors, these methods risk "hallucinating" plausible but inaccurate structural data, which can obscure the subtle signals of minority fraud classes in highly imbalanced datasets.

Furthermore, financial data is long-lived, making it vulnerable to "harvest now, decrypt later" attacks by future quantum computers, necessitating post-quantum security measures often absent in current privacy-preserving frameworks.

Methodology

The paper proposes FedGraph-VASP, a privacy-preserving federated graph learning framework designed to enable collaborative Anti-Money Laundering (AML) without exposing raw user data. The system operates on a distributed transaction graph $G = (V, E)$ partitioned across $K$ VASPs.

1. Boundary Embedding Exchange

Instead of sharing raw features or generating synthetic neighbors, the framework identifies boundary nodes ($B_k$)—accounts involved in transactions across different VASPs.

• Mechanism: Each VASP trains a local GraphSAGE GNN on its subgraph. For boundary nodes, the system extracts compressed, non-invertible vector embeddings ($h_v$) representing the node's structural neighborhood.
• Alignment: These embeddings are shared to compute a boundary alignment loss ($L_{boundary}$), which encourages the local model to produce representations for shared accounts that are consistent with the representations held by other institutions. This provides authentic topological context without revealing raw transaction data.

2. Post-Quantum Security

To protect the exchanged embeddings against both classical and future quantum adversaries, the system employs a hybrid Key Encapsulation Mechanism (KEM) / Data Encapsulation Mechanism (DEM) architecture:

• Key Encapsulation: Uses Kyber-512 (NIST-standardized ML-KEM) to establish quantum-resistant session keys.
• Data Encapsulation: Uses the shared secret from Kyber as a key for AES-256-GCM authenticated encryption.
• Protocol: Boundary embeddings are encrypted before transmission to an aggregation server, ensuring confidentiality and integrity.

3. Training Protocol

The training loop involves:

1. Local Training: Clients train on local subgraphs for $E$ epochs, minimizing classification loss and boundary alignment loss.
2. Exchange: Clients upload model weights ($\theta$) and encrypted boundary embeddings ($E_k$) to the server.
3. Aggregation: The server aggregates weights via FedAvg and distributes foreign boundary embeddings back to clients.
4. Update: Clients decrypt foreign embeddings and update their local buffers to refine boundary alignment in the next round.

Key Contributions

1. Boundary Embedding Exchange Protocol: A novel approach that shares compressed, non-invertible GNN representations of boundary accounts. This provides authentic topological information for cross-institutional detection while preventing the reconstruction of personally identifiable information (PII).
2. Post-Quantum Cryptographic Integration: The first integration of NIST-standardized Kyber-512 and AES-256-GCM into a federated graph learning framework for AML, specifically addressing the "harvest now, decrypt later" threat to long-term financial data.
3. Rigorous Empirical Evaluation: Comprehensive validation on the Elliptic Bitcoin and Ethereum fraud detection datasets, including statistical significance testing, ablation studies, and comparisons against state-of-the-art baselines (FedAvg, FedSage+, and Local GNN).

Experimental Results

Performance on Bitcoin (Elliptic Dataset)

Using realistic Louvain partitioning (simulating ~0.24% cross-silo edges, representing fragmented real-world banking):

• FedGraph-VASP achieved an F1-score of 0.508.
• This outperformed the state-of-the-art generative baseline FedSage+ (F1=0.453) by 12.1%.
• It also surpassed FedAvg (F1=0.499) and Local GNN (F1=0.389).
• Analysis: The results suggest that in low-connectivity, highly imbalanced fraud scenarios, exchanging actual encrypted embeddings is superior to generative imputation, which introduces noise that obscures minority fraud signals.

Performance on High-Connectivity Scenarios

Using METIS partitioning (simulating ~33% cross-silo edges, representing future "Open Banking" scenarios):

• FedGraph-VASP achieved an F1-score of 0.633, matching centralized performance levels (F1 $\approx$ 0.620).
• This demonstrates the framework's scalability as financial ecosystems become more interconnected.

Generalizability to Ethereum

On the Ethereum Fraud Detection Dataset (Account-based, sparse connectivity):

• FedGraph-VASP (F1=0.635) performed comparably to FedAvg but was significantly outperformed by FedSage+ (F1=0.855).
• Trade-off: The paper notes a distinct trade-off: topological embedding exchange excels in connected graphs (Bitcoin), while generative imputation dominates in highly modular, sparse graphs (Ethereum).

Privacy and Efficiency

• Privacy: Embedding inversion attacks yielded a modest $R^2$ score of 0.32, indicating partial but not exact feature recovery. However, Membership Inference Attacks (MIA) showed high leakage (AUC=0.95), a known limitation of non-private GNNs on sparse graphs. The authors argue the system prioritizes feature confidentiality over membership privacy, which aligns with the goal of protecting proprietary transaction intelligence.
• Efficiency: The post-quantum encryption overhead is negligible (<0.5% of total training time), with a throughput of ~10,500 embeddings per second using Kyber-512.

Significance and Claims

The paper claims that FedGraph-VASP offers a practical path toward regulatory compliance that respects institutional privacy boundaries. By resolving the tension between data sharing and privacy, it enables VASPs to detect cross-chain laundering patterns that are currently invisible to siloed systems.

The authors emphasize that their approach provides authentic structural visibility rather than synthetic data, which is critical for AML where accuracy directly impacts the detection of complex laundering schemes. Furthermore, by integrating post-quantum cryptography, the framework proactively addresses long-term security threats to financial data, ensuring that collaborative AML models remain secure against future quantum capabilities. The work highlights that while no single method dominates all graph topologies, the proposed boundary embedding exchange is a superior strategy for the highly imbalanced, low-connectivity environments typical of current cryptocurrency AML challenges.