RED QUEEN: Training an AML Detector Against Crimes That Do Not Exist Yet

Let me put the responsible framing first, because this project demands it: RED QUEEN is defensive research that runs entirely on synthetic transaction graphs. Its outputs are detection signatures at the typology and pattern level — never operational instructions, never a how-to, never a published generative prompt. With that established, here is the problem it attacks. Conventional transaction surveillance can only catch labelled, historical patterns. It is structurally blind to the laundering typology nobody has written a rule for yet — and the unknown-unknown is exactly where the loss sits. So the design goal is deliberately strange: manufacture those unknown-unknowns on purpose, in a closed loop, and train a detector against crimes that do not exist yet — without ever leaving the sandbox.

Try the live demo →

The Red Queen dynamic

The name is the mechanism. In Lewis Carroll, the Red Queen tells Alice it takes all the running you can do to keep in the same place. In evolutionary biology it is the predator-prey arms race where both sides must keep adapting just to hold their ground. RED QUEEN makes that the architecture: an adversarial population invents novel laundering schemes, a deep-learning detector tries to catch them, and every miss becomes the detector's next lesson. Both sides co-evolve.

The measurable promise is not that the detector "wins." It is sustained oscillation: time-to-detection of a newly invented scheme falls while the adversary keeps finding fresh evasions. A flat line means one side collapsed — and collapse is the failure mode, not the goal.

That reframes surveillance from a backward-looking rule list into something closer to a forward-looking immune system.

Ten components, one loop

RED QUEEN implements all ten components of the architecture as a generation loop — generate → compile → inject → detect → adjudicate → promote → learn — driven by a LangGraph-style state machine, with FastAPI and WebSocket streaming the loop live into a Next.js dashboard. The pieces that matter most:

The adversary population. Six persona agents — trade-based laundering, shell layering, crypto mixing, smurfing, wash trading, mule networks — emit schema-validated SchemeSpecs, Pydantic-typed objects, never free text. That typing is a safety boundary as much as an engineering one: the adversary produces structured patterns, not prose playbooks. The default engine is a deterministic, seeded mock; a Claude backend swaps in behind the exact same interface when you want genuine creativity, and only then.

The two-headed detector. This is the heart of it. Head A is an inductive GraphSAGE classifier with focal loss to survive the sub-1% illicit class imbalance — inductive specifically because it must score subgraphs it never trained on, every single generation (a transductive GNN cannot, which is disqualifying here). Head B is a graph autoencoder whose per-node reconstruction error flags novel structure before any label exists. A scheme caught by either head is detected; a scheme that evades both is gold — the unknown-unknown the whole system exists to surface.

The referee. Multi-objective fitness = evasion + novelty + realism. The realism term is scored against a FATF / OFAC / EU-AMLD RAG corpus, and a realism floor is what stops the adversary from reward-hacking — finding ways to beat the simulator that have nothing to do with real laundering. Without that gate, the system optimises for a meaningless exploit. With it, the schemes stay grounded in how financial crime actually behaves.

The anti-overfit anchor

Here is the design choice I am proudest of, and it is the one that keeps the whole thing honest. There is a single canonical 20-dimensional topological feature space, computed identically on the synthetic environment and on the real Elliptic Bitcoin graph. Because both graphs live in the same feature space, one detector can train on injected synthetic schemes and be scored, every generation, against a frozen real-Elliptic holdout — which must not degrade as the detector adapts to the simulator.

That anchor is the answer to the obvious objection: "you are just teaching a model to beat your own simulator." The frozen real-data PR-AUC is the gate that catches exactly that failure. It is the same instinct as the leakage discipline in CreditForge and the feature-parity gate in AEGIS Live — the unglamorous correctness mechanism is what separates a system that works on its own toy from one that holds up on data it never touched. RED QUEEN and AEGIS are the two halves of the same picture: AEGIS is the live detector on the wall; RED QUEEN is the adversary that invents the typologies a detector like that has not yet learned to see.

Diversity is a first-class objective

Evolutionary systems collapse to a single dominant strategy if you let them — mode collapse. RED QUEEN fights it structurally: the evolution controller runs tournament selection with elitism, but reserves explicit novelty-preservation slots and injects random immigrants for diversity pressure. Novelty is measured as embedding distance to the nearest known scheme; coverage as mean pairwise distance across the generation. You are not optimising for one clever crime — you are maintaining a diverse population of them.

Schemes that come out novel, realistic, and initially evasive are promoted into the Typology Codex, each with a narrative, a graph signature, a candidate detection rule, and its closest real precedent — or "no known precedent," which are the genuinely interesting ones. That Codex is the deliverable a compliance team actually uses.

What this taught me

1. Oscillation, not victory, is the right success metric. A co-evolutionary system that "wins" has collapsed. Measuring the sign-changes and amplitude of the evasion series — and demanding sustained oscillation — is what tells you the arms race is healthy.
2. An anti-overfit anchor is non-negotiable for self-play. The moment a system grades itself against its own simulator, you need a frozen, real-world holdout in the same feature space, or you are just teaching it to game you.
3. The safety boundary is part of the design, not a disclaimer. Typed SchemeSpecs instead of free text, signatures instead of playbooks, synthetic-only graphs, an opt-in frontier model — these are architectural decisions that make adversarial research publishable rather than reckless.

RED QUEEN is the most ambitious thing I have built, and the most carefully fenced. It is a bet that the next decade of financial-crime defence will not be won by writing more rules for yesterday's typologies — it will be won by systems that discover tomorrow's in a sandbox first.

Try the live demo → · Source on GitHub → · Full case study →