Coverage note · Financial Crime & AML · AML · Adversarial ML
RED QUEEN — Co-Evolutionary AML Sandbox
An adversarial population invents novel laundering schemes; a two-headed graph detector learns to catch them; every miss becomes its next lesson. Both co-evolve — the Red Queen dynamic — so the schemes nobody has seen yet are discovered in a sandbox instead of in the wild.
Key metrics
1. One canonical 20-dim topological feature space is computed identically on the synthetic environment and the real Elliptic graph, so a single detector trains on injected schemes yet stays anchored on a frozen Elliptic test holdout (PR-AUC every generation). Evasion is measured on schemes the detector has not yet trained on; misses are then labelled and fine-tuned in. Multi-objective fitness = w·evasion + w·novelty + w·realism, with a RAG realism floor flagging simulator exploits. Deterministic and seeded; the LLM adversary/referee swap in behind a mock that needs no API key.
The problem
Conventional transaction surveillance can only catch labelled, historical patterns — it is structurally blind to the typology nobody has written a rule for yet. The unknown-unknown is exactly where the loss sits.
So the design goal is to manufacture those unknown-unknowns on purpose, in a closed loop, and train the detector against crimes that do not exist yet — without ever leaving a synthetic sandbox or producing an operational playbook.
Architecture
- 01
Adversary population
Six persona agents (trade-based, shell layering, crypto mixing, smurfing, wash trading, mule networks) emit schema-validated SchemeSpecs — Pydantic-typed, never free text. Deterministic mock by default; a Claude backend swaps in behind one interface.
- 02
Scheme Compiler
Deterministic, seeded translator: each spec becomes a concrete synthetic transaction subgraph, with amount/timing patterns and anchor points that stitch it into legitimate background traffic so it is not a tell-tale floating island.
- 03
Environment
AMLSim-style legitimate background (communities, salary flows, retail spend) into which illicit subgraphs are injected and tracked by provenance.
- 04
Two-headed detector
Head A — an inductive GraphSAGE classifier (focal loss for the <1% illicit imbalance) that generalises to unseen subgraphs. Head B — a graph autoencoder whose per-node reconstruction error flags novel structure before any label exists. A scheme that evades both is gold.
- 05
Referee / adjudicator
Multi-objective fitness = evasion + novelty + realism. Realism is scored against a FATF/OFAC/EU-AMLD RAG corpus; a realism floor flags reward-hacks (beating the simulator, not laundering).
- 06
Evolution controller
Tournament selection with elitism, explicit novelty-preservation slots, and random immigrants — diversity pressure against mode collapse. Mutation makes a scheme sneakier; crossover merges two parents' tactics.
- 07
Typology Codex
Schemes that are novel + realistic + initially evasive are promoted with a narrative, graph signature, detection rule, and closest real precedent (or "no known precedent" — the exciting ones).
- 08
Orchestrator + dashboard
A LangGraph-style state machine drives generate→compile→inject→detect→adjudicate→promote→learn; FastAPI + WebSocket stream the loop live into a Next.js dashboard.
Key tradeoffs
One canonical 20-dim topological feature space, computed identically on the synthetic environment and the real Elliptic graph.
WhyIt lets a single detector train on injected schemes yet stay scored on a frozen real-Elliptic holdout — the anti-overfit anchor only works if both graphs live in the same feature space.
Inductive GraphSAGE, not a transductive GNN.
WhyThe detector must score subgraphs it never trained on, every generation. Transductive models cannot — that is disqualifying here.
A referee with a RAG realism floor gates promotion and flags reward-hacks.
WhyWithout it the adversary reward-hacks: it finds ways to beat the synthetic detector that have nothing to do with real laundering. Realism keeps the schemes meaningful.
Deterministic, seeded mock adversary is the default; Claude is an opt-in swap-in.
WhyThe full loop runs offline, free, and reproducibly; the frontier model is reserved for the one thing that needs it — creativity. Patterns/signatures only; raw generative prompts are not published.
Eval results
A sign-change + amplitude analyzer classifies the evasion series as oscillating vs collapsed; the measurable promise is sustained oscillation, not a trend to 0 or 1.
The frozen Elliptic test split is scored every generation through the same canonical features and detector weights; it must not degrade as the detector adapts to the simulator.
GraphSAGE (focal loss) for known typologies; graph-autoencoder reconstruction error for unknown structure — a scheme is "caught" only if a head flags it, "gold" only if it evades both.
Novelty = embedding distance to the nearest known scheme; coverage = mean pairwise distance across the generation — diversity, not just count, guards against mode collapse.
Production proof
The artifact that keeps the numbers honest: the eval harness and monitoring gates that run in CI, not a one-off notebook result.
Honest sandbox + anti-overfit anchor by construction
CI · PASSINGDefensive research, entirely on synthetic transaction graphs; outputs are detection signatures at the typology/pattern level, never operational instructions. The real Elliptic holdout is the anchor that keeps "beating a synthetic detector" honest.
Turns surveillance from a backward-looking rule list into a forward-looking immune system: it discovers the next typology in a sandbox, hardens the detector against it, and catalogues it for a compliance team — the unknown-unknown found before it is found in the wild.
Request coverage
I am focused on finance AI: credit risk, RegTech, AML, and agentic investment research. Open to roles, mentorship, and collaborators in fintech, quant, and bank AI.