---
id: "20261013-0231-outside-arxiv261013280-extracting-illicit"
title: "Extracting Illicit-Rich Subgraphs from Transaction Networks via Feed-Guided Shortest Paths (arXiv:2610.13280)"
type: "capture"
status: "promoted"
origin: "batch"
writer_model: "claude-sonnet-5"
date_created: "2026-10-13T00:00:00.000Z"
promoted_date: "2026-10-15T00:00:00.000Z"
provenance: "batch run 2026-10-13"
derived_from: []
tags: ["aml","anti-money-laundering","transaction-networks","graph-algorithms","spnsa","arxiv","outside"]
seek_code_commit: "d40ee39"
promoted_to: ["30-notes/claim-spnsa-motif-feed-selection-outperforms-baselines-but-not-universally.md","30-notes/claim-spnsa-illicit-enrichment-gain-traces-to-feed-selection-not-path-aggregation.md","30-notes/claim-spnsa-originated-2015-on-enron-email-corpus-not-financial-transactions.md","40-entities/entity-spnsa.md","40-entities/entity-asha-rao.md","40-entities/entity-pritheega-magalingam.md"]
not_promoted: ["Claim 2 (S4 loses to S2 on IBM-AML LI-Small) folded into the motif-feed-selection note as its caveat, not a separate note — 'atomic is not many' ruling: one result plus its boundary condition is one finding.","Doniyor Koshimbetov (entity candidate) — left as a mention, not a hub: lead author of only one paper so far in the vault; one-paper authorship alone doesn't clear the 2026-10-01 co-authorship bar.","Emine Şule Yazıcı (entity candidate) — mention only, co-author of one paper, no independent standing.","Stephen Davis (entity candidate) — mention only, co-author of the 2015 origin paper, no independent standing.","IBM-AML / AMLworld benchmark (entity candidate) — left as a mention inside the claim-notes, not promoted to a concept hub; load-bearing for this capture's numbers but not yet independently recurring in the vault.","Elliptic Bitcoin dataset (entity candidate) — mention only, same reasoning as IBM-AML.","Enron email corpus (entity candidate) — mention only, same reasoning.","Further leads (IBM-AML/AMLworld provenance paper, Elliptic dataset paper, Graph Feature Preprocessor paper, PNGNN paper, Klimt & Yang Enron corpus paper, the paper's GitHub code release, the arXiv abstract-page author-count discrepancy) — left in the capture unpursued; none read directly this session, none load-bearing for a kept claim."]
---


## Context

Topic surfaced from outside the vault: arXiv:2610.13280, submitted 2026-10-09, cs.SI (cross-listed cs.CE, cs.CY). The listing title given in the task ("Extracting Illicit-Rich Subgraph... " — singular "Subgraph") does not match the paper's own title page, which reads "Extracting Illicit-Rich **Subgraphs**... " (plural). Treat the PDF's own title page as authoritative; recorded as `source_title` below accordingly.

Both sources fetched in this session (the arXiv abstract page and the PDF, for both the 2026 paper and its 2015 ancestor) were plain academic text with no addressed-to-AI language, no override/authority claims, no tier self-assignment, and verified TLS. No safety flags fired this session — see `## Safety flags` below for the explicit (empty) statement.

## Claim: Motif-based feed selection yields markedly higher illicit concentration than random or degree-based baselines

The paper's central empirical result: starting from the existing Shortest Paths Network Search Algorithm (SPNSA — see separate claim below on its origin), the authors propose a new "motif-based coherent feed selection" strategy (labeled S4) for choosing which small set of entities to seed the algorithm with. Tested on the Elliptic Bitcoin transaction graph and two variants of the IBM-AML synthetic benchmark (HI-Small, HI-Medium), S4 produced the highest illicit-node ratio in the extracted subgraph of any strategy tested, including uniform-random (S1) and two degree-based heuristics (S2, S3), while keeping the extracted subgraph small (low hundreds of nodes).

Concretely, at feed size k=200 and SPNSA radius r=1 on the Elliptic dataset, S4 produced a 213-node subgraph with an illicit ratio of 33.8%, against a dataset-wide base rate of 2.23% and a random-feed (S1) baseline near 2.4% at the same settings — a gain the authors themselves describe as approximately 14×.

This is a quantitative claim (specific percentages and an "Nx" multiplier) resting on the paper's own self-reported experimental results — an arXiv preprint, Tier 1 per the sourcing rubric's "papers on arXiv" entry, with the sourcing floor for quantitative claims (Tier 1–2) cleared directly by the primary document.

- source_url: https://arxiv.org/pdf/2610.13280
- source_sha: 3c9a5f3d8e419aeb050766f2a899f148ac8b436b32147f41f6ab1f60302b41d2
- source_author: Doniyor Koshimbetov, Emine Şule Yazıcı, Asha Rao
- source_date: 2026-10-09
- source_title: "Extracting Illicit-Rich Subgraphs from Transaction Networks via Feed-Guided Shortest Paths"
- source_venue: arXiv preprint (pre-review version; to be published in Proceedings of The Sixth International Symposium on Complex Systems, ISCS 2026)
- source_tier: 1
- source_quote: "we propose a new motif-based feed selection algorithm that outperforms the other tested strategies and achieves substantial gains on IBM-AML HI variants as well as an approximately 14× higher illicit ratio than random feed selection on Elliptic."
- source_quote_2: "at (k, r) = (200, 1) on Elliptic, S4+SPNSA extracts a compact subgraph with only 213 nodes while concentrating illicit activity to an illicit ratio of 33.8% (Table 3(d)). This is far above both the dataset base rate (2.23%, Table 1) and the uniform-random feed baseline (S1), which remains near 2–3% across settings."

## Claim: The motif-based strategy's advantage is not universal — it loses to a simpler heuristic in the lowest-illicit-density dataset

On IBM-AML LI-Small (the "Lower Illicit ratio" variant, dataset-wide illicit rate 1.04% — the lowest of the four datasets tested), the motif-based strategy (S4) was outperformed by a much simpler degree-imbalance heuristic (S2, ranking nodes by |out-degree − in-degree|). At feed size k=200, radius r=1, S2 reached an illicit ratio of 11.4% versus S4's 5.5%. The authors note this as evidence that the best graph-only feed-selection signal is dataset-regime-dependent rather than universal.

Quantitative claim, same Tier 1 arXiv-preprint self-report as above; floor cleared directly.

- source_url: https://arxiv.org/pdf/2610.13280
- source_sha: 3c9a5f3d8e419aeb050766f2a899f148ac8b436b32147f41f6ab1f60302b41d2
- source_author: Doniyor Koshimbetov, Emine Şule Yazıcı, Asha Rao
- source_date: 2026-10-09
- source_title: "Extracting Illicit-Rich Subgraphs from Transaction Networks via Feed-Guided Shortest Paths"
- source_venue: arXiv preprint (pre-review version; ISCS 2026)
- source_tier: 1
- source_quote: "On IBM-AML LI-Small, which has the lowest dataset-level illicit ratio (1.04%, Table 1), the best feed heuristic is the degree-imbalance strategy (S2), not the motif-based strategy. For example, at (k, r) = (200, 1), S2 achieves an illicit ratio of 11.4%, while S4 reaches 5.5% (Table 3(a))."

## Claim: The paper's own ablation attributes most of the illicit-enrichment gain to feed selection itself, not to the SPNSA path-aggregation step

To separate the contribution of feed choice from what SPNSA's shortest-path aggregation adds on top, the authors compared the full S4+SPNSA output against the subgraph simply induced by the S4 feed nodes alone (no path-finding). The induced-feed subgraph matched or exceeded the illicit ratio of the full SPNSA output across every dataset tested, which the authors read as showing SPNSA's main contribution is adding path-based "connector" nodes (and occasionally diluting concentration further), while the enrichment itself comes from which nodes were chosen as the feed.

This is a specific technical-mechanism claim about where a result's effect actually originates (feed construction vs. the algorithm's aggregation step) — the sourcing floor requires Tier 1–2 for this kind of claim, and it is cleared directly: the claim is the authors' own stated interpretation of their own ablation table (Table 4, Appendix), in the same Tier 1 arXiv preprint.

- source_url: https://arxiv.org/pdf/2610.13280
- source_sha: 3c9a5f3d8e419aeb050766f2a899f148ac8b436b32147f41f6ab1f60302b41d2
- source_author: Doniyor Koshimbetov, Emine Şule Yazıcı, Asha Rao
- source_date: 2026-10-09
- source_title: "Extracting Illicit-Rich Subgraphs from Transaction Networks via Feed-Guided Shortest Paths"
- source_venue: arXiv preprint (pre-review version; ISCS 2026)
- source_tier: 1
- source_quote: "Using the same S4 feed, the induced subgraph consistently attains an illicit ratio that is equal to or higher than the SPNSA output (Table 4, Appendix). This indicates that the primary enrichment gains attributed to S4+SPNSA arise from the feed construction itself, while SPNSA mainly adds path-based connector nodes and occasionally additional illicit nodes, which can dilute illicit concentration."

## Claim: SPNSA, the algorithm this 2026 paper builds on, was introduced in 2015 for a different domain entirely — the Enron email corpus, not financial transactions — by a team that shares a co-author with this paper

The core algorithm used throughout the 2026 paper, the Shortest Paths Network Search Algorithm (SPNSA), is not new to this work. It was introduced by Pritheega Magalingam, Stephen Davis, and Asha Rao in "Using shortest path to discover criminal community" (*Digital Investigation* 15, 1–17, 2015; preprint on arXiv as 1503.06289, submitted 2015-03-21). That original paper applied SPNSA to the Enron e-mail communications dataset, seeding the algorithm's "feed" with people convicted of money laundering in the Enron collapse, and showed the method found compact, interpretable sub-networks compared to standard community-detection and k-neighbourhood baselines. Asha Rao is a co-author of both the 2015 origin paper and the 2026 paper under study here — an eleven-year authorial through-line from the algorithm's original domain (corporate-fraud email networks) to its application here (synthetic and real financial transaction graphs).

This is a historical/technical-mechanism ancestry claim that is load-bearing for understanding what is actually novel in the 2026 paper (feed-selection strategy, not the core algorithm) — escalated past the Tier 3–4 floor that would otherwise suffice for an uncontested historical claim, and confirmed directly against the 2015 paper's own arXiv preprint text, not merely the 2026 paper's citation of it.

- source_url: https://arxiv.org/pdf/1503.06289
- source_sha: 2271163dba301677007e80ad572b89c9925942eb499e262f520f1df35fb388df
- source_author: Pritheega Magalingam, Stephen Davis, Asha Rao
- source_date: 2015-03-21
- source_title: "Using shortest path to discover criminal community"
- source_venue: arXiv preprint (published version: Digital Investigation, vol. 15, pp. 1–17, December 2015)
- source_tier: 1
- source_quote: "We apply the SPNSA on the Enron Dataset of e-mail communications starting with those convicted of money laundering in relation to the collapse of Enron as the algorithm feed."
- cross-reference: the 2026 paper (arXiv:2610.13280, same sha as Claim 1) independently states this ancestry — "we build upon the Shortest Paths Network Search Algorithm (SPNSA) proposed by Magalingam et al. [8]" and "the original SPNSA study evaluates the method on the Enron e-mail communication graph from the early 2000s... which is both domain-specific and temporally distant from modern transaction ecosystems" — corroborating but not substituting for the primary read above.

## Further leads

- IBM-AML / "AMLworld" synthetic benchmark (HI-Small, LI-Small, HI-Medium, HI-Large/LI-Large) introduced by Altman, Blanuša, Von Niederhäusern, Egressy, Anghel & Atasu, "Realistic Synthetic Financial Transactions for Anti-Money Laundering Models," NeurIPS 2023 Datasets & Benchmarks track; arXiv preprint 2306.16424 — worth its own capture on dataset provenance/methodology.
- Elliptic Bitcoin dataset (real-world labeled BTC transaction graph) introduced by Weber, Domeniconi, Chen, Weidele, Bellei, Robinson & Leiserson, ACM SIGKDD 2019 — the real-world counterpart dataset to IBM-AML's synthetic graphs.
- Blanuša et al., "Graph Feature Preprocessor: Real-time subgraph-based feature extraction for financial crime detection," 5th ACM Intl. Conf. on AI in Finance (2024) — a related motif-mining approach for AML feature extraction, cited by the 2026 paper as prior work.
- Egressy, von Niederhäusern, Blanuša, Altman, Wattenhofer & Atasu, "Provably powerful graph neural networks for directed multigraphs," AAAI 2024 — cited as the detection-model (classifier) line of AML research that this paper's investigative-subgraph-extraction approach is explicitly contrasted against.
- Klimt & Yang, "Introducing the Enron Corpus," CEAS 2004 — origin of the underlying Enron email dataset used by the 2015 SPNSA paper; would ground the Enron-corpus provenance claim at Tier 1 if pursued further.
- Code release for the 2026 paper at https://github.com/koshimbetovv/spnsa-feed-selection (unverified — not fetched this session).
- arXiv abstract page for 2610.13280 lists the lead author plus "7 other authors" in its PDF-link caption line, but only three named authors (Koshimbetov, Yazıcı, Rao) appear anywhere on the page or the paper itself — an apparent arXiv template/metadata inconsistency, not a sourced claim about additional hidden authors; noted here only as an oddity worth a sanity-check if this paper is revisited.

## Entity candidates

- Pritheega Magalingam — person — first author of the 2015 paper that introduced SPNSA; the foundational figure the 2026 paper's whole method rests on and is compared against.
- Asha Rao — person — co-author of both the 2015 SPNSA origin paper (RMIT) and the 2026 paper under study; the authorial bridge carrying the algorithm from a 2001-era corporate email scandal to 2026 financial-crime transaction graphs.
- Stephen Davis — person — co-author of the 2015 SPNSA origin paper (RMIT).
- Doniyor Koshimbetov — person — lead author of the 2026 paper (Koç University, Istanbul); proposes the motif-based feed-selection method (S4).
- Emine Şule Yazıcı — person — co-author of the 2026 paper (Koç University).
- SPNSA (Shortest Paths Network Search Algorithm) — concept — the feed-guided shortest-path subgraph-extraction method originated in 2015 for criminal-network discovery, now repurposed for AML transaction graphs; a natural standalone concept note given its documented cross-domain reuse.
- IBM-AML benchmark / AMLworld — concept — the synthetic AML transaction-graph benchmark family (HI/LI × Small/Medium/Large) that has become a standard testbed across several cited papers.
- Elliptic Bitcoin dataset — concept — the standard real-world labeled Bitcoin transaction graph used across AML graph-learning literature.
- Enron email corpus — concept — the original (and very different-domain) dataset SPNSA was validated on in 2015; relevant to any note on how graph-investigation algorithms migrate across domains.

## Safety flags

None. Both fetched sources (arXiv:2610.13280 abstract + PDF, and arXiv:1503.06289 abstract + PDF) were ordinary academic text: no addressed-to-AI language, no override/authority language, no tier self-assignment, no file-system or credential-related instructions, no urgency framing. Both PDF fetches reported `tls: "verified"`. No Tier 5 downgrades or sources.md additions needed from this session.

> [!note] Seek's commentary:
> The genuinely interesting hook here wasn't the headline "14×" number — it's that the paper's own core method isn't new. SPNSA was built in 2015 to find Enron's money launderers in an email graph, and the same senior author carried it, eleven years later, into Bitcoin and synthetic bank-transaction graphs. The 2026 paper's actual contribution is narrower than its title suggests: not a new subgraph-extraction algorithm, but a new way of choosing which nodes to feed an old one. That's a legitimate and well-evidenced contribution, but a reader skimming only the abstract would reasonably come away thinking SPNSA itself was proposed here.