DLG-GNN: Decoupled Local-to-Global Graph Neural Network for Scalable Blockchain Fraud Detection

1. Introduction

The decentralization of financial ecosystems has facilitated global economic innovation but has simultaneously provided a veil for sophisticated financial crimes, including money laundering and smart contract-based fraud [1,2,3].

As transaction volumes on platforms such as Ethereum and Binance Smart Chain (BSC) continue to grow rapidly, the need for automated, high-precision monitoring systems has become urgent. Traditional machine learning approaches, which rely on manually engineered features, often fail to capture the complex, higher-order structural dependencies inherent in graph-structured blockchain data. To address these challenges, the research community has shifted toward Graph Neural Networks (GNNs) [4].

Early GNN-based fraud detection models typically treated the entire transaction network as a flat graph, often losing the distinction between individual contract logic and broader relational contexts [5]. The recent “Graphs of Graphs” (GoG) framework addressed this limitation by proposing a hierarchical architecture [6]. However, the original GoG implementation relies on a transductive learning paradigm where the entire global graph must be loaded into memory. This leads to a quadratic increase in memory complexity, i.e., $O\left(N^2\right)$, making deployment on standard hardware impractical for large-scale networks.

To address these limitations, we propose DLG-GNN, a resource-efficient framework specifically designed to overcome the scalability bottlenecks inherent in large-scale blockchain networks.

DLG-GNN employs a decoupled dual-level architecture to separately capture intra-contract logic (Level 1) and inter-contract relational dependencies (Level 2). Unlike existing transductive models that suffer from memory growth with the total number of nodes N, our framework atomizes the global transaction network into logical contract units. By combining a sequential inductive pipeline with proactive garbage collection, the peak memory requirement is bounded by the maximum partition size K, yielding $O\left(K^2\right)$ worst-case memory for dense subgraph operations, where K is fixed according to the available GPU memory [7]. Furthermore, the integration of GATv2 layers enables dynamic, context-aware feature extraction for both local contract behaviors and global relational contexts [8].

The remainder of this paper is organized as follows. Section 2 reviews prior research on GNN-based fraud detection and scalability techniques. Section 3 describes the architecture of DLG-GNN, including domain-aware segmentation logic and a hierarchical joint loss function. Section 4 reviews the experimental results, presenting an analysis of memory efficiency and a comparison of the proposed model’s performance. Finally, Section 5 concludes the paper and discusses future research directions.

2. Related Work

2.1. GNNs for Financial Fraud Detection

Early efforts, such as the work by Weber et al. [4], demonstrated that Graph Convolutional Networks (GCNs) could outperform traditional machine learning models on the Elliptic Bitcoin dataset by capturing structural patterns associated with illicit activity. Subsequent studies explored various graph-based anomaly detection architectures, including Graph Attention Networks (GAT) [9], DOMINANT [10], and AnomalyDAE [11], to identify suspicious nodes or transactions in attributed graphs. However, most of these models operate on “flat” graph structures, which can overlook the multi-level abstraction of blockchain data, such as the distinction between intra-contract behavior and inter-contract interactions.

2.2. Hierarchical Graph Learning

To capture the intrinsic hierarchical structure of blockchain ecosystems, Luo et al. [6] introduced the “Graphs of Graphs” (GoG) framework. This approach models individual smart contracts as local graphs (Level 1) and their interactions as a global meta-graph (Level 2). While GoG provides a structured representation of the hierarchical nature of multi-chain blockchain datasets, its reliance on transductive learning poses a significant scalability challenge. In the transductive paradigm, the entire graph or a large global representation must remain accessible during training and inference, leading to substantial memory overhead as the network scales. This limitation restricts the practical application of hierarchical GNNs to relatively small graphs or requires high-end hardware resources.

2.3. Scalability and Efficiency in GNNs

To address the challenges associated with scaling GNNs to large-scale graphs, as discussed earlier, sampling and partitioning techniques have been developed. GraphSAGE [12] introduced inductive learning using neighbor node (graph) sampling, enabling the model to generalize to unknown nodes without having to retrain the entire graph. Cluster-GCN [13] achieved a breakthrough in efficiency by partitioning the graph into smaller clusters, thereby reducing the computational overhead of graph convolutions. GraphSAINT [7] further advanced scalable training by employing graph sampling strategies. Despite these advancements, existing scalable solutions typically prioritize either local neighborhood sampling or global partitioning, and there are few examples of them processing hierarchical blockchain data—which requires maintaining both intra-contract integrity and inter-contract relationships—under resource-constrained environments such as strict memory limitations.

3. Proposed Method

Figure 1 shows an overview of the proposed DLG-GNN architecture. This framework utilizes a “Load-Process-Purge” loop to keep memory usage constant. By partitioning the global transaction graph into contract-level subgraphs, the Level 1 GATv2 [8] encoder can extract local features even under strict VRAM constraints. These compressed embeddings are then used to construct a relational meta-graph for Level 2 learning, enabling the system to capture multi-scale fraud signatures without the scalability bottlenecks inherent in traditional transductive models.

3.1. Problem Formalization and Graph Representation

We define the global blockchain transaction network as a massive directed graph $G_{\mathrm{global}}=({\mathcal{V}}_{\mathrm{all}},{\mathcal{E}}_{\mathrm{all}},{\mathbf{X}}_{\mathrm{all}})$. Unlike traditional transductive approaches that load $G_{\mathrm{global}}$ as a single monolithic tensor, we decompose the network into a set of M independent contract-level subgraphs:

$$\mathcal{G}=\{g_1,g_2,\dots ,g_M\},\mathrm{where}{g}_m=({\mathcal{V}}_m,{\mathcal{E}}_m,{\mathbf{X}}_m)$$

(1)

To ensure strict memory compliance, we introduce a domain-aware partitioning function $\Phi$ [7,13]. If a subgraph exceeds a predefined node limit K (derived from the available VRAM), it is further atomized as follows:

$$\Phi \left(g_m\right)=\{g_{m,1},\dots ,g_{m,p}\},\mathrm{s}.\mathrm{t}.\forall k,\left|{\mathcal{V}}_{m,k}\right|\le K$$

(2)

3.2. Level 1: Intra-contract Encoding with GATv2

Level 1 focuses on capturing suspicious patterns within individual smart contracts. We employ the GATv2 (Graph Attention Network v2) [8] layer to overcome the limitations of static attention in the original GAT [9]. For any node i and its neighbor $j\in {\mathcal{N}}_i$ within subgraph $g_m$, the dynamic attention score $e_{ij}$, the normalized attention coefficient ${\alpha }_{ij}$, and the updated node representation ${\mathbf{h}}_i^{\prime }$ are computed as follows:

$$e_{ij}={\mathbf{a}}^{\top }\mathrm{LeakyReLU}\left({\mathbf{W}}_s{\mathbf{h}}_i+{\mathbf{W}}_t{\mathbf{h}}_j\right)$$

(3)

$${\alpha }_{ij}={\displaystyle \frac{exp\left(e_{ij}\right)}{{\displaystyle \sum _{k\in {\mathcal{N}}_i}exp\left(e_{ik}\right)}}}$$

(4)

$${\mathbf{h}}_i^{\prime }=\sigma \left(\sum _{j\in {\mathcal{N}}_i}{\alpha }_{ij}\mathbf{W}{\mathbf{h}}_j\right)$$

(5)

The full Level 1 forward pass over subgraph $g_m$ and the subsequent contract-level embedding ${\mathbf{z}}_m^{\left(L1\right)}$ are obtained via a readout function:

$${\mathbf{H}}_m^{\left(L1\right)}=\mathrm{GATv}{2}^{\left(L1\right)}(g_m;{\theta }_{L1})$$

(6)

$${\mathbf{z}}_m^{\left(L1\right)}=\mathrm{Readout}\left(\left\{{\mathbf{h}}_i^{\left(L1\right)}\mid v_i\in {\mathcal{V}}_m\right\}\right)$$

(7)

3.3. Level 2: Inter-contract Relational Contextualization

The extracted embeddings ${\left\{{\mathbf{z}}_m^{\left(L1\right)}\right\}}_{m=1}^M$ serve as nodes in a relational meta-graph ${\mathcal{G}}^{\left(L2\right)}=\left({\left\{{\mathbf{z}}_m^{\left(L1\right)}\right\}}_{m=1}^M,{\mathcal{E}}_{\mathrm{rel}}\right)$. Level 2 applies a second GATv2 stack to learn contextual dependencies between contracts:

$${\mathbf{Z}}^{\left(L2\right)}=\mathrm{GATv}{2}^{\left(L2\right)}\left({\mathcal{G}}^{\left(L2\right)};{\theta }_{L2}\right)$$

(8)

The final fraud score $s_m$ for contract m is produced by a fusion head that concatenates the local and relational representations:

$$s_m=\sigma \left(\mathrm{MLP}\left({\mathbf{z}}_m^{\left(L1\right)}\parallel {\mathbf{z}}_m^{\left(L2\right)}\right)\right)$$

(9)

3.4. Resource-Efficient Inductive Pipeline

The primary innovation of DLG-GNN lies in its Sequential Fitting and Garbage Collection (GC) strategy. By adopting an inductive paradigm [12], the model processes each subgraph $g_m$ independently, without requiring access to the full graph during training or inference.

The peak GPU memory is bounded by the largest processed subgraph, yielding $O\left(K^2\right)$ worst-case memory for dense subgraph operations, where $K\ll N$ is fixed by the hardware budget. This ensures that peak VRAM usage remains stable (e.g., below 200 MB) regardless of the growth of N. Once ${\mathbf{z}}_m^{\left(L1\right)}$ is computed, $g_m$ is immediately purged from VRAM, allowing the next subgraph to be loaded without memory accumulation.

3.5. Hierarchical Joint Loss Function

To optimize the dual-level structure, we define a joint loss function ${\mathcal{L}}_{\mathrm{total}}$ that balances local detection and relational propagation:

$${\mathcal{L}}_{\mathrm{total}}={\lambda }_1{\mathcal{L}}_{L1}+{\lambda }_2{\mathcal{L}}_{L2}+\eta {\parallel \Theta \parallel }^2$$

(10)

where ${\mathcal{L}}_{L1}$ and ${\mathcal{L}}_{L2}$ can be instantiated as weighted binary cross-entropy or focal losses [14] to address the extreme class imbalance prevalent in fraudulent blockchain datasets, and ${\eta \parallel \Theta \parallel }^2$ is an ${\mathcal{\ell }}_2$ regularization term.

3.6. Design Rationale

DLG-GNN differs from existing flat anomaly detectors in three key aspects. First, it separates intra-contract behavior from inter-contract relational context, enabling multi-scale representation learning that is invisible to single-level flat models. Second, it adopts an inductive sequential pipeline that avoids loading the entire global graph into GPU memory, fundamentally overcoming the transductive “scalability wall.” Third, it uses domain-aware partitioning based on smart contract boundaries, preserving blockchain-specific semantic units—and thus the “money trail” context—while reducing memory overhead. These design choices allow DLG-GNN to retain local forensic signals and global relational dependencies simultaneously, even under strict hardware constraints.

4. Experiments

4.1. Experimental Setup

Datasets: We utilize transaction datasets from Binance Smart Chain (BSC), Ethereum (ETH), and Polygon (MATIC) [6]. These datasets contain complex smart contract interactions with labeled fraudulent and benign nodes. The fraud-labeled ratio in Table 1 denotes the class distribution within the processed GoG benchmark subset, not the real-world prevalence of fraudulent entities in the entire blockchain network. Because the benchmark subsets are constructed around labeled suspicious activities, some chains exhibit highly skewed fraud-labeled ratios. Since PR-AUC and Best-F1 are sensitive to the positive-class prior, we primarily rely on ROC-AUC for cross-chain comparison while reporting PR-AUC and Best-F1 as supplementary metrics.

Hardware Environment: All experiments for DLG-GNN were conducted on a consumer-grade laptop equipped with an NVIDIA RTX-series laptop GPU with 8 GB VRAM and 32 GB of system RAM.

4.2. Performance Comparison

Table 1 summarizes the detection performance in terms of ROC-AUC, PR-AUC, and Best-F1 score. For the PyGOD-based comparison, we evaluated multiple graph anomaly detection models and report the best-performing baseline for each dataset. All baselines were trained and evaluated under the same data split and metric protocol for fair comparison. DLG-GNN-Full consistently outperforms the reported strongest PyGOD-based baseline across all chains. .

The results indicate that DLG-GNN-Full achieves a substantial performance gain, particularly on the Ethereum network, with an absolute ROC-AUC improvement of 15.49 percentage points over the strongest reported PyGOD-based baseline.

Figure 2 illustrates the detection performance of DLG-GNN variants across the three blockchain networks. Ethereum exhibits higher graph density and more complex interactions between smart contracts than BSC or Polygon, making fraud detection more challenging. The substantial ROC-AUC improvement on Ethereum supports the effectiveness of the proposed decoupling strategy. In high-density transaction graphs, local malicious signals can be obscured by global structural noise; however, the Level 1 encoder of DLG-GNN filters local contract-level features before relational reasoning is performed.

DLG-GNN-L1 captures only internal contract behaviors, whereas DLG-GNN-L1+L2 integrates intra-contract patterns with inter-contract relational dependencies. DLG-GNN-Full represents the complete framework with optimized sequential fitting and GATv2-based dynamic attention. The incremental performance gains from DLG-GNN-L1 to DLG-GNN-Full indicate that relational context is important for capturing multi-hop laundering activities. The integration of GATv2 layers allows the model to assign dynamic importance to inter-contract edges, effectively identifying suspicious money trails that are difficult for single-level detectors to capture.

4.3. Resource Efficiency and Scalability Analysis

The experimental results indicate that main memory (RAM) usage scales proportionally with graph size, reaching a peak of approximately 6.5 GB for the dense Ethereum dataset. Crucially, however, peak GPU VRAM consumption remains consistently below 200 MB across all test scenarios. This demonstrates that while global data structures reside in main memory, DLG-GNN prevents the VRAM-intensive “scalability wall” inherent in legacy transductive models.

4.4. Ablation Study: Impact of Hierarchical Layers

The local-only variant, DLG-GNN-L1, achieves a ROC-AUC of 0.8478, indicating that intra-contract behavioral patterns alone provide meaningful fraud detection signals. When Level 2 relational contextualization is added, DLG-GNN-L1+L2 substantially improves ROC-AUC to 0.9476, corresponding to an absolute gain of 9.98 percentage points over DLG-GNN-L1. This result demonstrates that inter-contract dependencies are critical for detecting sophisticated laundering behaviors that span multiple contracts.

These results suggest that the full framework preserves the discriminative benefits of hierarchical local-to-global learning while improving robustness in positive-class retrieval. Overall, the ablation study confirms that the major performance gain comes from incorporating Level 2 relational reasoning, while the full DLG-GNN configuration provides the most balanced performance across evaluation metrics.

5. Conclusion

In this study, we addressed the critical challenge of scalability in hierarchical Graph Neural Networks (GNNs) for blockchain fraud detection. While previous hierarchical models such as GoG provided useful architectural insights, their transductive nature and quadratic memory complexity $O\left(N^2\right)$ posed a significant “scalability wall,” restricting their use to high-end hardware environments. The proposed DLG-GNN overcomes these limitations by introducing a resource-efficient decoupled local-to-global learning pipeline.

By implementing domain-aware partitioning and a sequential inductive fitting strategy with proactive garbage collection, DLG-GNN bounds peak GPU memory usage by the maximum partition size K, yielding $O\left(K^2\right)$ worst-case memory for dense subgraph operations. This design allows large-scale networks such as Ethereum to be analyzed within a stable GPU memory footprint below 200 MB.

Our findings suggest that organizing transaction data into logical contract units is not only computationally efficient but also useful for filtering structural noise inherent in massive blockchain graphs. This work provides a foundation for resource-efficient on-chain monitoring systems.