RR Skillverse · Free Learning Handbook
RR Skillverse Module 9 of 12 Theory Handbook Finance + AI + Graphs

Module 9 — Graph Neural Networks

Same theory-first structure as Modules 1–8: for every technique below, what it is, why it exists — the specific problem it was invented to solve — what else you could use instead, and a real financial example. Every module so far has treated each applicant as an independent row. Module 9 asks what changes once you stop assuming that — and includes the most dramatic head-to-head result, and the most honest limitation, in this entire course.

⬇ Download the Module 9 notebook ← Back to Module 8 All modules →

Recap — what RR Finance already has

Module 9 is not a fresh start. Here's exactly what it inherits before adding a relational lens on top.

MODULE 1

The real 800-applicant dataset, always treated as independent rows — this module builds a real graph directly on top of it.

MODULE 5

A real RAG system over 4 real RR Finance policy documents — this module extracts structured facts from those same documents and combines both approaches.

MODULE 7

5 simulated institutions and their federated training setup — reused here as a real network topology for intrusion detection.

What's new in Module 9
Every prior module scored one applicant, one document, or one caller at a time. Module 9 asks what only becomes visible once you look at the CONNECTIONS between them — and honestly tests when that relational view actually helps versus when it doesn't.

Why relationships, not just rows

Some fraud patterns are invisible until you stop looking at applicants one at a time.

The independence assumption

Every classifier since Module 1 scores each row on its own — a reasonable assumption for most fraud, but not for coordinated fraud rings.

What graphs add

A Graph Neural Network learns from a node's own features AND its neighbors' — information a row-independent model structurally cannot access.

What graphs don't automatically fix

This module's closing lesson shows a real case where a GNN actually underperforms a simple baseline — the right tool depends on the shape of the pattern, not on using the most sophisticated technique by default.

CONCEPT 1

Why Graph Neural Networks

Some fraud patterns exist only between applicants, not within any one of them.

Overview
🧮 Math & Algorithm
What it is

A Graph Neural Network learns from a node's own features AND from its neighbors' features, propagated across a graph structure — information a row-independent classifier structurally cannot see.

Why it exists — the history
2005 → 2017
Early graph neural network formulations date to Gori et al., 2005, but the modern, widely-used **Graph Convolutional Network (GCN)** formulation comes from Kipf & Welling, 2017, "Semi-Supervised Classification with Graph Convolutional Networks", which simplified earlier spectral graph-learning approaches into an efficient, practical layer that generalises convolution from grids (images) to arbitrary graphs.

✓ Use it when

  • The pattern you're detecting is fundamentally RELATIONAL — who is connected to whom — not something visible in any single row's own features

✗ Don't assume it always wins

  • Concept 5 of this module shows a real, honest case where a GNN underperforms a much simpler approach — the technique is a tool for a specific SHAPE of problem, not a universal upgrade
REAL-WORLD FINANCIAL EXAMPLE
A fraud ring's members can each individually look like an ordinary applicant — the giveaway is that several of them share one device. Concept 2 builds and detects exactly this pattern, with a dramatic, real, measured result.
⬇ Run this lesson in the notebook
No formula in this framing lesson — it sets up the specific graph propagation rule covered in Concept 2.
CONCEPT 2

Fraud-Ring Detection with GNNs

The clearest demonstration in this course of when graph structure IS the entire signal.

Overview
🧮 Math & Algorithm
What it is

A Graph Convolutional Network (GCN) classifies each applicant as a likely fraud-ring member by repeatedly aggregating their own features with their graph neighbors' features across two layers — learning to recognise the "shape" of a device-sharing cluster.

Why it exists — the history
Kipf & Welling, 2017 (again) — GCNs applied to fraud specifically
Graph-based fraud detection using GCNs and their successors (GraphSAGE, GAT) became a standard approach in financial-crime and payments fraud teams through the late 2010s and 2020s — precisely because ring-based fraud is, by construction, a relational pattern that feature-only models miss.

✓ What the notebook demonstrates

  • A real, dramatic, measured gap: a non-graph baseline reaches AUC ≈ 0.63 on the SAME 11 applicant features Module 1 has always used; the GCN, using the identical features PLUS the graph, reaches AUC = 1.0

✗ Why this comparison is fair, not rigged

  • Ring members' individual features are constructed to look statistically ORDINARY — the gap is entirely attributable to the graph, not to a features shortcut hidden in the setup
REAL-WORLD FINANCIAL EXAMPLE
20 applicants, spread across 4 device-sharing rings of 5, are statistically indistinguishable from ordinary applicants on income, credit score, or debt-to-income — the GCN finds every one of them anyway, using only who they're connected to.
⬇ Run this lesson in the notebook
H^(l+1) = σ( D̂^(−1/2) · Â · D̂^(−1/2) · H^(l) · W^(l) )
 = A + I is the graph's adjacency matrix with self-loops added — every node aggregates its OWN previous representation as well as its neighbors'.
D̂ is the degree matrix of Â, used to NORMALISE the aggregation so nodes with many neighbors don't dominate purely by connection count.
H^(l) is the matrix of all nodes' representations at layer l (H^(0) is the raw input features); W^(l) is that layer's learned weight matrix; σ is a non-linearity (ReLU).
Two stacked layers (as used in the notebook) let information travel two hops — far enough for a ring member to "see" its device-sharing neighbors' representations directly, which is exactly the signal a single-node classifier cannot access.
CONCEPT 3

Knowledge Graphs

Turning free text into precise, queryable facts.

Overview
🧮 Math & Algorithm
What it is

A knowledge graph represents information as structured (entity, relation, value) triples — extracted here from Module 5's real policy documents — so precise questions (numeric comparisons, thresholds) can be answered by graph traversal instead of approximate text search.

Why it exists — the history
Long-standing AI concept, popularised at scale by Google's Knowledge Graph (2012)
Structured knowledge representation predates modern deep learning by decades (semantic networks, RDF triples), but Google's 2012 Knowledge Graph brought the term into mainstream use for exactly this pattern: extracting precise facts from unstructured sources so they can be queried reliably.

✓ What the notebook demonstrates

  • Real regex extraction of numeric facts (minimum credit score, interest rate, maximum amount) from RR Finance's 4 real policy documents — then real, exact-match graph queries over those facts

✗ An honest limitation, not smoothed over

  • The Gold Loan policy has no extracted min_credit_score fact — because the real policy text never states one (it's a secured product) — correctly reflected as an ABSENCE, not a missing feature to paper over
REAL-WORLD FINANCIAL EXAMPLE
"Which products does an applicant with credit score 640 qualify for?" is answered by the notebook with an exact, reliable graph query — precisely the kind of question pure text search answers only approximately.
⬇ Run this lesson in the notebook
No learned model here — graph traversal in this lesson is EXACT filtering over edges (e.g. "find all Product nodes with a min_credit_score edge whose weight is ≤ the applicant's score"), fundamentally different from Concept 2's GCN, which LEARNS a function over graph structure. Both are "graph techniques," but one is a database query and the other is a trained model — a distinction worth keeping clear.
CONCEPT 4

GraphRAG

Structured facts for precision, retrieved text for procedure.

Overview
🧮 Math & Algorithm
What it is

GraphRAG combines Concept 3's structured graph traversal with Module 5's text retrieval (here, real BM25 ranking) — using each for what it does well, then composing both into one answer.

Why it exists — the history
Emerged as a named pattern around 2023-2024
As RAG systems matured, practitioners recognised that pure vector/text retrieval handles precise numeric or relational questions poorly — GraphRAG (structured retrieval + text retrieval, composed together) became a common named pattern for closing that gap without abandoning the retrieval infrastructure already built.

✓ What the notebook demonstrates

  • A real, working, multi-hop answer: the graph precisely determines which products an applicant qualifies for by credit score, while BM25 retrieval finds the exact procedural text about debt-to-income review thresholds — genuinely needing both

✗ What this is NOT

  • A single unified model — this is two real, separate, well-understood techniques (Concept 3's traversal, Module 5's BM25) composed by simple, explicit Python logic, not a new learned architecture
REAL-WORLD FINANCIAL EXAMPLE
"Which products do I qualify for, and will my application need manual review?" gets answered correctly and precisely — the graph half says "PersonalLoan, GoldLoan"; the retrieved half explains the 50% debt-to-income review threshold, sourced from the real risk-review policy document.
⬇ Run this lesson in the notebook
score(D, Q) = Σ_(t∈Q) IDF(t) · [f(t,D)·(k₁+1)] / [f(t,D) + k₁·(1−b+b·|D|/avgdl)]
This is the BM25 ranking formula Module 5 introduced and this lesson reuses directly: f(t,D) is how often query term t appears in document D; IDF(t) downweights common terms; k₁ and b control term-frequency saturation and document-length normalisation.
GraphRAG's real mechanism is simpler than the formula above suggests: run the graph query (Concept 3) and the BM25 query independently, then compose their results with plain Python logic — no new mathematics beyond what each half already uses.
CONCEPT 5

GNN-Based Intrusion Detection: An Honest Limitation

When a simple baseline beats the sophisticated technique.

Overview
🧮 Math & Algorithm
What it is

The SAME kind of GCN as Concept 2, applied to a network-traffic graph (RR Finance's 5 simulated institutions from Module 7) to detect a compromised host — but tested honestly against a simple non-graph baseline, rather than assumed to win.

Why it exists — the history
A real, standing debate in graph-ML practice
Whether a GNN outperforms simpler graph-FEATURE engineering (degree, clustering coefficient, centrality measures fed into a plain classifier) is genuinely dataset- and problem-dependent — this is a well-known, actively discussed limitation in graph machine learning, not a settled question with one universal answer.

✓ What the notebook demonstrates

  • With content-only features, both a simple baseline and a GCN struggle. Once explicit structural features (degree, cross-institution connection ratio) are added, the SIMPLE baseline reaches perfect detection — and the GCN, on the identical features, does WORSE

✗ Why this isn't a failure to fix

  • The compromised host here is an INDIVIDUAL outlier (high degree, but connects to otherwise-normal hosts) — unlike Concept 2's ring members, which connect to EACH OTHER. A GCN's neighbor-averaging can dilute one node's own extreme signal when its neighbors are ordinary; it excels when the anomaly is a property of a connected group instead
REAL-WORLD FINANCIAL EXAMPLE
A compromised server beaconing widely across RR Finance's federated institutions (Module 7) has an unusual connectivity PATTERN, but talks to otherwise-normal peers — exactly the case where hand-engineered graph statistics, fed into a simple classifier, turn out to be the more reliable tool.
⬇ Run this lesson in the notebook
Same GCN propagation rule as Concept 2 (see that concept's Math & Algorithm toggle) — the mathematics is identical. What differs is the STRUCTURE of the anomaly: Concept 2's ring members form dense sub-cliques where averaging a member's neighbors' features reinforces the "ring" signal; this lesson's compromised host connects mostly to normal-looking neighbors, so the SAME averaging operation smooths its own extreme degree/connectivity signal toward the neighborhood average instead of preserving it.

Module 9 hand-off

The notebook builds a real fraud-ring detection pipeline on top of Module 1's actual applicant data — a GCN reaching AUC 1.0 against a non-graph baseline's 0.63 on identical features — extracts a real knowledge graph from Module 5's real policy documents, combines structured graph traversal with real BM25 retrieval into a working GraphRAG pipeline, and closes with an honest, tested finding about when a GCN does NOT outperform a much simpler approach -- with a metrics summary saved as an artifact for the next module.

What Module 10 builds on this
Module 10 (MLOps & On-Premises Deployment) shifts from "does this model work" to "how does RR Finance actually RUN this in production" -- FastAPI serving, Docker/Kubernetes, and DevSecOps tooling. It doesn't extend Module 9's graph machinery directly, but every model built since Module 1 -- including this module's fraud-ring GCN -- needs exactly the deployment discipline Module 10 covers before any of it reaches a real applicant.
←Back to all 12 modules ←Back to Module 8