Normalisation and Initialisation Strategies for Graph Neural Networks in Blockchain Anomaly Detection

This paper systematically evaluates how weight initialisation and normalisation strategies impact the performance of GCN, GAT, and GraphSAGE architectures on the Elliptic Bitcoin dataset, revealing that optimal configurations are architecture-dependent and providing practical guidance for deploying GNNs in anti-money laundering systems.

The Gist

Imagine you are a detective trying to catch money launderers in a massive, chaotic city. In this city, every transaction is a person, and every time money changes hands, a new road is built between two people. This creates a giant, shifting map of connections—a graph.

For a long time, detectives used simple tools (like checking a single person's ID) to find criminals. But criminals don't work alone; they move in groups, creating complex patterns on the map. To catch them, we need a smarter tool: a Graph Neural Network (GNN). Think of a GNN as a super-intelligent detective that doesn't just look at one person, but studies the whole neighborhood, the roads, and how people interact to spot suspicious behavior.

However, the authors of this paper discovered that even with this super-detective, the results depend heavily on how you set up the detective's brain before the investigation begins. They tested two specific "setup" strategies:

1. Initialization (The "Starting Point"): How do you give the detective their initial clues? Do you start them with a blank slate, or do you give them a specific "gut feeling" (mathematically, a specific way of assigning random numbers to their brain cells)?
2. Normalization (The "Stabilizer"): As the detective gathers information from neighbors, the data can get messy or overwhelming. Normalization is like a filter that keeps the detective's focus steady, preventing them from getting confused by a few loud neighbors or losing their train of thought.

The Big Experiment: The Bitcoin City

The researchers tested these strategies on the Elliptic dataset, which is a real map of Bitcoin transactions. In this city:

• Most people are innocent.
• A tiny few are criminals (only 2% of the labeled people).
• The rest are unknown.

This is a classic "needle in a haystack" problem. If your detective is too eager, they might accuse innocent people (false alarms). If they are too cautious, they miss the criminals.

The Three Detective Styles

They tested three different types of GNN "detectives," each with a unique personality:

1. GCN (The Traditionalist): This detective looks at everyone in the neighborhood equally. It's reliable and simple.
2. GAT (The Focused Analyst): This detective uses "attention." It decides which neighbors are more important and focuses its energy there, ignoring the noise.
3. GraphSAGE (The Sampler): This detective is practical. Instead of studying the whole city, it samples a few neighbors to make a quick, smart guess. It's great for growing cities.

The Surprising Findings

The researchers tried mixing different "Starting Points" and "Stabilizers" with these three detectives. Here is what they found, using simple analogies:

1. The Traditionalist (GCN)

• The Result: The Traditionalist didn't care much about the fancy setups.
• The Analogy: Imagine a seasoned veteran detective. They have their own routine. Whether you give them a fancy new notebook (GraphNorm) or a specific starting hint (Xavier initialization), they perform about the same. They are already stable and don't need much help.
• Takeaway: For this type, stick to the basics. Don't overcomplicate it.

2. The Focused Analyst (GAT)

• The Result: This detective shined the brightest when given both a specific starting hint (Xavier) and a stabilizer (GraphNorm).
• The Analogy: This detective is like a brilliant but easily distracted genius. If you just give them a hint, they might get overwhelmed by the noise. But if you give them the hint and a noise-canceling headset (GraphNorm) to keep their focus on the important connections, they become incredibly accurate at spotting the criminals.
• Takeaway: For attention-based models, you need a full "training package" to get the best results.

3. The Sampler (GraphSAGE)

• The Result: This detective performed best with only the specific starting hint (Xavier). Adding the stabilizer (GraphNorm) actually made them slightly worse.
• The Analogy: This detective is a quick thinker who relies on sampling. Giving them the right starting hint (Xavier) helped them hit the ground running. But adding the stabilizer (GraphNorm) was like putting them in a straightjacket—it slowed them down and interfered with their natural ability to sample neighbors quickly.
• Takeaway: Sometimes, less is more. A good start is all they need.

Why Does This Matter?

In the real world of Anti-Money Laundering (AML), banks and governments use these AI models to stop crime.

• Before: People might have just picked a model and hoped for the best, or assumed one "perfect" setup works for everything.
• Now: This paper says, "Stop guessing!" You must match your training strategy to your specific model.
  • If you use GraphSAGE, just tune the starting weights.
  • If you use GAT, you need both the starting weights and the graph-specific stabilizer.
  • If you use GCN, just keep it simple.

The Bottom Line

Building a fraud detection system isn't just about picking the right algorithm; it's about how you tune the engine. Just like a Ferrari, a truck, and a motorcycle all need different fuel and maintenance to run at their peak, different AI models need different "initialization" and "normalization" strategies to catch criminals effectively.

The authors have also released their "recipe book" (code and data) so other researchers can try these methods without making the same mistakes, ensuring that future fraud detection systems are more stable, accurate, and ready for the real world.

Technical Summary

1. Problem Statement

Financial fraud detection, particularly Anti-Money Laundering (AML) in cryptocurrency, relies heavily on Graph Neural Networks (GNNs) to model transaction networks. While GNNs outperform traditional i.i.d. models by leveraging node features and graph topology, their deployment in real-world scenarios (like the Elliptic Bitcoin dataset) faces critical challenges:

• Severe Class Imbalance: Illicit transactions constitute a tiny fraction (approx. 2%) of labeled data, making standard metrics like accuracy misleading.
• Training Instability: The effectiveness of GNNs is highly sensitive to training practices, specifically weight initialisation and normalisation, which are often overlooked in favor of architectural changes.
• Graph-Specific Dynamics: Standard normalisation techniques (BatchNorm, LayerNorm) assume independent samples, which violates the structural dependencies of graph data, potentially leading to over-smoothing (where node representations become indistinguishable) and feature drift.

The paper addresses the gap in understanding how specific initialisation and normalisation strategies interact with different GNN architectures (GCN, GAT, GraphSAGE) in the context of highly imbalanced, temporal transaction graphs.

2. Methodology

Dataset and Preprocessing

• Dataset: The Elliptic Bitcoin Dataset, containing ~203k nodes (transactions) and ~234k directed edges.
• Features: 166-dimensional vectors per node (raw features + 1-hop aggregated stats).
• Graph Construction: Directed edges are symmetrized to create an undirected graph for message passing. Self-loops are added, and duplicates removed.
• Temporal Splitting: To prevent data leakage, the dataset is split strictly by time: 29 time steps for training, 10 for validation, and 10 for testing. This simulates real-world deployment where models predict future transactions based on past data.

Model Architectures

The study evaluates three standard GNN architectures:

1. GCN (Graph Convolutional Network): Aggregates neighbor features using normalized adjacency matrices.
2. GAT (Graph Attention Network): Uses attention mechanisms to assign weights to neighbors.
3. GraphSAGE: An inductive framework using sampling and aggregation (mean/max/LSTM) to generate embeddings for unseen nodes.

Experimental Design

• Variables:
  • Initialisation: Comparison of Xavier (uniform) vs. default/He initialisation.
  • Normalisation: Comparison of GraphNorm (graph-level statistics) vs. standard baselines (no specific graph normalisation).
• Hyperparameter Optimization: Used Optuna with Tree-structured Parzen Estimator (TPE) and ASHA over 100 trials to tune learning rates, hidden dimensions, dropout rates, and layer counts.
• Evaluation Metrics:
  • Primary: AUPRC (Area Under the Precision-Recall Curve) due to severe class imbalance.
  • Secondary: AUC-ROC, Precision, Recall, and F1-score at high-confidence thresholds (90th, 99th, 99.9th percentiles).
  • Robustness: Performance was validated via repeated subsampling (100 runs selecting 50% of test nodes) to estimate generalization variance.

3. Key Contributions

1. Systematic Ablation Study: The first controlled analysis of how initialisation and graph-level normalisation affect GNN performance specifically on the Elliptic AML benchmark.
2. Architecture-Dependent Insights: The paper demonstrates that "one-size-fits-all" training strategies do not exist. The optimal strategy is strictly dependent on the GNN architecture used.
3. Reproducible Framework: The authors released a leakage-free experimental framework featuring temporal splits, seeded runs, and full ablation results, setting a new standard for AML benchmarking.

4. Key Results

The study reveals distinct optimal configurations for each architecture:

Architecture	Optimal Strategy	Performance Gain (vs. Baseline)	Key Observation
GCN	Baseline (Default Init)	Highest AUPRC: 0.5993	GCN showed limited sensitivity to Xavier or GraphNorm. Adding GraphNorm actually degraded performance.
GAT	GraphNorm + Xavier	AUPRC: 0.6568 (+0.055)	GAT benefits significantly from the combination. GraphNorm stabilizes the attention mechanism against degree skew.
GraphSAGE	Xavier Only	AUPRC: 0.6678 (+0.013)	GraphSAGE performs best with Xavier initialisation alone. Adding GraphNorm provided diminishing returns or slight degradation.

• Convergence: GraphSAGE converged faster and achieved higher validation scores than GCN and GAT.
• Comparison to SOTA: The best model (GraphSAGE with Xavier) achieved an AUPRC of 0.6678, surpassing the previous benchmark of 0.6392 (Deprez et al.).
• Over-smoothing: GraphNorm was effective for GAT in mitigating over-smoothing but was counterproductive for GraphSAGE, likely interfering with its specific neighborhood aggregation mechanics.

5. Significance and Conclusion

Practical Implications:
The findings provide actionable guidance for deploying GNNs in financial fraud detection pipelines:

• Do not assume GraphNorm is universally superior; it must be paired with the correct architecture (e.g., GAT).
• GraphSAGE is the most robust architecture for this specific dataset when paired with Xavier initialisation.
• GCN remains a strong baseline but requires careful tuning of the baseline configuration rather than adding complex normalisation layers.

Theoretical Impact:
The paper highlights that training dynamics in GNNs are not uniform. The interaction between inductive bias (architecture) and optimization hyperparameters (initialisation/normalisation) dictates performance. In highly imbalanced, temporal graphs, architectural choices and training strategies must be co-optimized rather than treated as independent variables.

Limitations & Future Work:
The study was limited to three architectures and the Elliptic dataset (which simplifies real-world edge types). Future work should explore Graph Transformers, temporal GNNs, and the newer Elliptic2 dataset to validate these findings on more complex, heterogeneous financial networks.