REVIEW 5 major objections 5 minor 42 references
DiT-SGCR: Directed Temporal Structural Representation with Global-Cluster Awareness for Ethereum Malicious Account Detection
T0 review · 5 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash
Pith's one-line read An unsupervised encoder that reads transaction direction, timestamps, and account clusters detects Ethereum phishing accounts at F1 up to 0.9156.
desk verdict Empirical claim is undercut by test-set threshold tuning and a duplicated baseline row, but the new dataset and the directed temporal aggregation idea make it worth a serious referee's time. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing object is a three-module embedding pipeline. Directed temporal aggregation represents each account by summing the embedding vectors of its incoming and outgoing neighbors at each timestamp, applying an exponential decay $\exp((t_i-t_{i-1})/\alpha)$, forming outer products between the current neighbor vector and an accumulated temporal embedding, and flattening the resulting $2K \times 2K$ matrices into a $4K^2+2K$-dimensional vector. Differentiable K-means then soft-assigns accounts to $K$ centroids and maps each account to normalized cosine distances from those centroids, producing a $K$-dimensional structural embedding. Graph-Laplacian optimization refines this embedding by minimizing $\operatorname{tr}(Z^{\top} L Z)+\lambda\sum_{c=1}^{K}\operatorname{tr}(Z^{\top} L_c Z)+\mu\|Z-B\|_F^2$, which the paper solves as the linear system $(L+\lambda\sum_c L_c+\mu I)Z=\mu B$; here $L=D-A$ is treated as the smoothness operator of the directed transaction graph.
What would settle it
Compute the smallest eigenvalue of the symmetric part of $L+\lambda\sum_{c=1}^{K}L_c+\mu I$ on the MulDiGraph adjacency with the paper's defaults; if it is negative, the optimization objective in Eq. (16) is not convex and the vector returned by conjugate gradient is not the claimed minimizer. As a minimal check, the single directed edge $u\to v$ already makes $\operatorname{tr}(Z^{\top} L Z)$ negative for embeddings $(1,2)$, showing the Laplacian term is not a guaranteed smoothness penalty.
Extended reading notes
Core claim
The central claim is that directional temporal aggregation plus global cluster awareness is sufficient to separate phishing accounts from normal accounts in Ethereum transaction graphs without supervised graph training. Concretely, the paper claims F1-score improvements over state-of-the-art baselines of 3.62% to 10.83% across the MulDiGraph, B4E, and Transactions Network datasets, with weighted F1 reaching 0.9461. The gains are attributed to three coordinated design choices: separating incoming and outgoing transaction flows, weighting recent transactions more heavily through an exponential decay, and regularizing the final embeddings with both a global and a cluster-specific graph Laplacian.
Load-bearing premise
The load-bearing premise is that the graph Laplacian built from a directed adjacency matrix behaves like a smoothness regularizer in the optimization; because that matrix is nonsymmetric, its quadratic form can take negative values, and the conjugate-gradient solve of Eq. (17) may not correspond to a well-defined minimum of Eq. (16).
Editorial extensions
If this is right
- On all three datasets the full pipeline beats every baseline tested, so the claimed gain is not confined to one graph: F1 improvements over the best baseline range from 3.62% to 10.83%.
- Ablation results attribute the gain to the mechanism itself: removing neighbor aggregation, temporal decay, or Laplacian refinement lowers F1, by up to 8.6% when neighbor embeddings are dropped.
- The complexity analysis puts per-iteration cost at roughly $O(|E|k+I_k|V|k^3+k\sqrt{|V||E|})$, simplifying to about $O(\sqrt{|V||E|})$ for sparse graphs, making the approach feasible for graphs with millions of nodes.
- Because the embedding stage is unsupervised, newly collected transaction graphs can be embedded and classified without retraining the encoder on labels.
- The released Transactions Network dataset, with 1,262 confirmed phishing accounts and 11.87 million transaction edges, adds a second large-scale benchmark for Ethereum phishing detection.
Reading between the lines
- A testable extension is to swap the nonsymmetric directed Laplacian for a symmetrized or renormalized directed Laplacian and re-run the benchmarks; if the F1 gains survive, the empirical result does not depend on the questionable linear algebra, and if they vanish, the reported mechanism is doing less work than claimed.
- The design suggests that direction and cluster coherence are transferable signals, so the same three-module recipe could be applied to Bitcoin, stablecoin, or bank-transfer graphs; the paper only evaluates Ethereum.
- Because the final classifier is a 100-tree Random Forest, a linear probe on the learned embeddings would reveal whether the representation itself carries the discriminative signal or whether the classifier's capacity is absorbing the work.
- The per-iteration cost structure makes an incremental variant plausible: embeddings could be refreshed per new block by updating only affected accounts, directly addressing the static-graph limitation the authors list.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper introduces DiT-SGCR, an unsupervised embedding method for directed temporal graphs, which combines directional temporal aggregation, differentiable K-means clustering, and graph Laplacian optimization to produce node embeddings for Ethereum malicious account detection. The method is evaluated on three datasets (MulDiGraph, B4E, and a new Transactions Network dataset) against nine baselines, reporting F1-score improvements of 3.62% to 10.83% over the strongest baseline. The authors also provide a complexity analysis and a new phishing dataset.
Significance. If the reported results are reliable, the proposed method would be a noteworthy contribution: it offers a non-GNN, scalable approach to capturing directionality and temporal dynamics in transaction graphs, and the new dataset may be a useful community resource. The design is interesting, particularly the use of differentiable clustering with Laplacian regularization, and the computational complexity analysis is a positive feature. However, the experimental validation as presented is not sound: the threshold is tuned on the test set, hyperparameters are selected without a validation split, no error bars are reported, and at least one baseline result appears transcribed incorrectly. In addition, the graph Laplacian optimization step is not mathematically justified for directed graphs as written. Because these issues directly affect the central empirical claim, the paper cannot be accepted in its current form.
major comments (5)
- [Table II, Section VI-A] The GrabPhisher row is identical for the B4E and Transactions Network datasets (Precision 0.8197, Recall 0.7549, F1-Score 0.7860, W-F1 0.8593). This is implausible for two different datasets and strongly suggests a transcription or copying error. Since GrabPhisher appears to be among the strongest baselines, this error directly affects the claimed F1 improvements and must be corrected before the comparison can be considered.
- [Section VI-A, threshold selection] The decision threshold is described as 'empirically set to 0.35 based on experimental performance and prior experience.' Because F1-Score is threshold-dependent, and no validation split or threshold-selection protocol is reported for the baseline methods, the proposed method may have benefited from test-set tuning while baselines did not. This makes the reported improvements potentially unfair and unverifiable.
- [Section VI-C, hyperparameter selection] Hyperparameters α, β, K, λ, and μ are selected based on experiments that appear to use the same test data (RQ3 is conducted on the MulDiGraph dataset, and the chosen values are those with the best F1). Without a clean validation set and separate test evaluation, the reported performance may be optimistically biased, and the comparison to baselines is not on equal footing.
- [Section III-D, Eq. (16)-(17)] The graph Laplacian L = D - A for a directed graph is non-symmetric and its quadratic form tr(Z^T L Z) is not guaranteed to be nonnegative. Consequently, the minimization objective in Eq. (16) may not be well-posed as a smoothness regularizer, and the linear system in Eq. (17), (L + λ Σ L_c + μI)Z = μB, may have an indefinite coefficient matrix. The conjugate gradient method is not guaranteed to converge for indefinite systems. The authors should either replace L with a symmetric positive semidefinite Laplacian (e.g., using the symmetrized form) or provide a proof or empirical evidence that the matrix is positive definite for the considered graphs.
- [Section III-B, Eq. (4)] The temporal decay factor is written as exp((t_i - t_{i-1})/α) without a negative sign. This factor grows with the elapsed time, which would amplify, rather than decay, older contributions—contrary to the stated purpose of emphasizing recent transactions. Additionally, Section III-A states that timestamps are ordered in descending order, but Eq. (4) assumes t_i > t_{i-1}. The sign and the ordering convention should be corrected and clarified.
minor comments (5)
- [Throughout] There are several typos, including 'Insitute' in the author affiliations and 'Temperal' in Table III; these should be corrected.
- [Section II] The list of related work uses inconsistent numbering (a), 2), 3)), which makes the text harder to follow.
- [Abstract and Section VI] The method is described as an 'unsupervised graph encoder,' but the evaluation uses a Random Forest classifier with labels. It would be clearer to state that the embeddings are learned unsupervisedly and then evaluated with a supervised downstream classifier.
- [Section V] The time complexity simplification to O(sqrt(|V||E|)) is not rigorously derived from the preceding expression; the authors should either state the assumptions (e.g., constant k, I_k, d) explicitly or remove the simplified form.
- [Figure 3] The caption of Figure 3 does not explain what each curve represents; please clarify which method each curve corresponds to, as this makes the figure difficult to interpret.
Circularity Check
No circular derivation: the embedding pipeline is self-contained and benchmark claims are empirical; minor self-citation is not load-bearing.
full rationale
The claimed contribution is an empirical detection pipeline, not a derived analytic result. The embedding construction (Section III) proceeds from transaction timestamps through directed temporal aggregation (Eqs. 1-8), differentiable K-means (Eqs. 9-15), and Laplacian optimization (Eqs. 16-17); the final Z is obtained by solving a sparse linear system whose right-hand side is built from the cluster-distance subx, with no target label entering the representation. No equation in the paper is equal to another by construction, and no fitted parameter is renamed as a predicted quantity. The sentence "In the final classification stage, the decision threshold was empirically set to 0.35 based on experimental performance and prior experience" (Section VI-A) is an evaluation-protocol risk, because test-set threshold tuning can inflate F1, and the identical GrabPhisher row for B4E and Transactions Network in Table II is a data-integrity concern; both bear on the soundness of the SOTA comparison, but neither makes the reported F1 a definitional consequence of the method's inputs. The only self-citation, [29], appears in the related-work survey of static GNNs and is not used to justify any design choice or to exclude alternatives, so it is not load-bearing. The Limitations section (Section VII) explicitly acknowledges feature-set, static-graph, temporal-coverage, and blockchain-specific scope restrictions, which are honest scope caveats rather than circular dependencies. Therefore there is no significant circularity.
Assumptions & free parameters
free parameters (6)
- Temporal decay factor α =
1.0
- Inverse temperature β =
10.0
- Number of clusters K =
10
- Laplacian weight λ =
1.0
- Fidelity weight μ =
1.0
- Decision threshold =
0.35
assumptions (3)
- ad hoc to paper The directed graph Laplacian L = D - A is a valid smoothness operator for the optimization objective.
- domain assumption The exponential weighting in Eq. (4) implements a temporal decay that downweights older timestamps.
- domain assumption Transaction timestamps alone are sufficient to capture malicious behavior for the detection task.
Cite this review
Pith. "Pith review of DiT-SGCR: Directed Temporal Structural Representation with Global-Cluster Awareness for Ethereum Malicious Account Detection." pith.science (2026). https://pith.science/paper/2F2SUSYZ
@misc{pith2026250620123,
author = {Pith},
title = {Pith review of: DiT-SGCR: Directed Temporal Structural Representation with Global-Cluster Awareness for Ethereum Malicious Account Detection},
year = {2026},
howpublished = {\url{https://pith.science/paper/2F2SUSYZ}},
note = {Machine review of arXiv:2506.20123}
}
read the original abstract
The detection of malicious accounts on Ethereum - the preeminent DeFi platform - is critical for protecting digital assets and maintaining trust in decentralized finance. Recent advances highlight that temporal transaction evolution reveals more attack signatures than static graphs. However, current methods either fail to model continuous transaction dynamics or incur high computational costs that limit scalability to large-scale transaction networks. Furthermore, current methods fail to consider two higher-order behavioral fingerprints: (1) direction in temporal transaction flows, which encodes money movement trajectories, and (2) account clustering, which reveals coordinated behavior of organized malicious collectives. To address these challenges, we propose DiT-SGCR, an unsupervised graph encoder for malicious account detection. Specifically, DiT-SGCR employs directional temporal aggregation to capture dynamic account interactions, then coupled with differentiable clustering and graph Laplacian regularization to generate high-quality, low-dimensional embeddings. Our approach simultaneously encodes directional temporal dynamics, global topology, and cluster-specific behavioral patterns, thereby enhancing the discriminability and robustness of account representations. Furthermore, DiT-SGCR bypasses conventional graph propagation mechanisms, yielding significant scalability advantages. Extensive experiments on three datasets demonstrate that DiT-SGCR consistently outperforms state-of-the-art methods across all benchmarks, achieving F1-score improvements ranging from 3.62% to 10.83%.
Figures
Reference graph
Works this paper leans on
- [1]
-
[2]
G. Wood, et al., Ethereum: A secure decentralised generalised transac- tion ledger, Ethereum project yellow paper 151 (2014) (2014) 1–32
work page 2014
- [3]
-
[4]
N. Deepa, Q.-V . Pham, D. C. Nguyen, S. Bhattacharya, B. Prabadevi, T. R. Gadekallu, P. K. R. Maddikunta, F. Fang, P. N. Pathirana, A survey on blockchain for big data: Approaches, opportunities, and future directions, Future Generation Computer Systems 131 (2022) 209–226
work page 2022
-
[5]
A. Pal, C. K. Tiwari, A. Behl, Blockchain technology in financial services: a comprehensive review of the literature, Journal of Global Operations and Strategic Sourcing 14 (1) (2021) 61–80
work page 2021
-
[6]
G. Iyengar, F. Saleh, J. Sethuraman, W. Wang, Economics of permis- sioned blockchain adoption, Management Science 69 (6) (2023) 3415– 3436
work page 2023
-
[7]
X. Chen, Q. Cheng, T. Luo, The economic value of blockchain applica- tions: Early evidence from asset-backed securities, Management Science 70 (1) (2024) 439–463
work page 2024
-
[8]
H. Chen, M. Pendleton, L. Njilla, S. Xu, A survey on ethereum sys- tems security: Vulnerabilities, attacks, and defenses, ACM Computing Surveys (CSUR) 53 (3) (2020) 1–43
work page 2020
Show all 42 references
-
[9]
Z. Wang, H. Jin, W. Dai, K.-K. R. Choo, D. Zou, Ethereum smart contract security research: survey and future research opportunities, Frontiers of Computer Science 15 (2021) 1–18
2021
-
[10]
Z. Chen, Y . Hu, B. He, D. Luo, L. Wu, Y . Zhou, Dissect- ing payload-based transaction phishing on ethereum, arXiv preprint arXiv:2409.02386 (2024)
2024 arXiv
-
[11]
URL https://www.trmlabs.com/resources/reports/ 2025-crypto-crime-report
TRM Labs, 2025 crypto crime report: Key trends that shaped the illicit crypto market in 2024, accessed: 27 April 2025 (2025). URL https://www.trmlabs.com/resources/reports/ 2025-crypto-crime-report
2025
-
[12]
F. Xia, J. Liu, H. Nie, Y . Fu, L. Wan, X. Kong, Random walks: A review of algorithms and applications, IEEE Transactions on Emerging Topics in Computational Intelligence 4 (2) (2019) 95–107
2019
-
[13]
J. Zhou, G. Cui, S. Hu, Z. Zhang, C. Yang, Z. Liu, L. Wang, C. Li, M. Sun, Graph neural networks: A review of methods and applications, AI open 1 (2020) 57–81
2020
-
[14]
Longa, V
A. Longa, V . Lachi, G. Santin, M. Bianchini, B. Lepri, P. Lio, F. Scarselli, A. Passerini, Graph neural networks for temporal graphs: State of the art, open challenges, and opportunities, arXiv preprint arXiv:2302.01018 (2023)
2023 arXiv
-
[15]
Pareja, G
A. Pareja, G. Domeniconi, J. Chen, T. Ma, T. Suzumura, H. Kanezashi, T. Kaler, T. Schardl, C. Leiserson, Evolvegcn: Evolving graph convo- lutional networks for dynamic graphs, in: Proceedings of the AAAI conference on artificial intelligence, V ol. 34, 2020, pp. 5363–5370
2020
-
[16]
Rossi, B
E. Rossi, B. Chamberlain, F. Frasca, D. Eynard, F. Monti, M. Bronstein, Temporal graph networks for deep learning on dynamic graphs, arXiv preprint arXiv:2006.10637 (2020)
2020 arXiv
-
[17]
D. Xu, C. Ruan, E. Korpeoglu, S. Kumar, K. Achan, Inductive repre- sentation learning on temporal graphs, arXiv preprint arXiv:2002.07962 (2020)
2020 arXiv
-
[18]
J. Liu, J. Chen, J. Wu, Z. Wu, J. Fang, Z. Zheng, Fishing for fraudsters: Uncovering ethereum phishing gangs with blockchain data, IEEE Trans- actions on Information Forensics and Security 19 (2024) 3038–3050
2024
-
[19]
Agarwal, S
R. Agarwal, S. Barve, S. K. Shukla, Detecting malicious accounts in permissionless blockchains using temporal graph properties, Applied Network Science 6 (2021) 1–30
2021
-
[20]
Perozzi, R
B. Perozzi, R. Al-Rfou, S. Skiena, Deepwalk: Online learning of social representations, in: Proceedings of the 20th ACM SIGKDD international conference on Knowledge discovery and data mining, 2014, pp. 701– 710
2014
-
[21]
Grover, J
A. Grover, J. Leskovec, node2vec: Scalable feature learning for net- works, in: Proceedings of the 22nd ACM SIGKDD international con- ference on Knowledge discovery and data mining, 2016, pp. 855–864
2016
-
[22]
J. Wu, Q. Yuan, D. Lin, W. You, W. Chen, C. Chen, Z. Zheng, Who are the phishers? phishing scam detection on ethereum via network embedding, IEEE Transactions on Systems, Man, and Cybernetics: Systems 52 (2) (2020) 1156–1166
2020
-
[23]
J. Liu, C. Yin, H. Wang, X. Wu, D. Lan, L. Zhou, C. Ge, Graph embedding-based money laundering detection for ethereum, Electronics 12 (14) (2023) 3180
2023
-
[24]
Alarab, S
I. Alarab, S. Prakoonwit, M. I. Nacer, Competence of graph con- volutional networks for anti-money laundering in bitcoin blockchain, in: Proceedings of the 2020 5th international conference on machine learning technologies, 2020, pp. 23–27
2020
-
[25]
T. N. Kipf, M. Welling, Semi-supervised classification with graph convolutional networks, arXiv preprint arXiv:1609.02907 (2016)
2016 arXiv
-
[26]
Veli ˇckovi´c, G
P. Veli ˇckovi´c, G. Cucurull, A. Casanova, A. Romero, P. Lio, Y . Bengio, Graph attention networks, arXiv preprint arXiv:1710.10903 (2017)
2017 arXiv
-
[27]
Hamilton, Z
W. Hamilton, Z. Ying, J. Leskovec, Inductive representation learning on large graphs, Advances in neural information processing systems 30 (2017)
2017
-
[28]
S. Li, R. Wang, H. Wu, S. Zhong, F. Xu, Siege: Self-supervised incre- mental deep graph learning for ethereum phishing scam detection, in: Proceedings of the 31st ACM International Conference on Multimedia, 2023, pp. 8881–8890
2023
-
[29]
J. Sun, Y . Jia, Y . Wang, Y . Tian, S. Zhang, Ethereum fraud detection via joint transaction language model and graph representation learning, Information Fusion 120 (2025) 103074
2025
-
[30]
L. Wang, M. Xu, H. Cheng, Phishing scams detection via temporal graph attention network in ethereum, Information Processing & Management 60 (4) (2023) 103412
2023
-
[31]
S. Li, G. Gou, C. Liu, C. Hou, Z. Li, G. Xiong, Ttagn: Temporal transaction aggregation graph network for ethereum phishing scams detection, in: Proceedings of the ACM Web Conference 2022, 2022, pp. 661–669
2022
-
[32]
Zhang, H
J. Zhang, H. Sui, X. Sun, C. Ge, L. Zhou, W. Susilo, Grabphisher: Phishing scams detection in ethereum via temporally evolving gnns, IEEE Transactions on Services Computing (2024)
2024
-
[33]
C. Wu, J. Chen, Z. Zhao, K. He, G. Xu, Y . Wu, H. Wang, H. Li, Y . Liu, Y . Xiang, Tokenscout: Early detection of ethereum scam tokens via temporal graph learning, in: Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 956– 970
2024
-
[34]
Layne, J
J. Layne, J. Carpenter, E. Serra, F. Gullo, Temporal sir-gn: Efficient and effective structural representation learning for temporal graphs, Proceedings of the VLDB Endowment 16 (9) (2023) 2075–2089
2023
-
[35]
Mavromatis, G
C. Mavromatis, G. Karypis, Graph infoclust: Maximizing coarse-grain mutual information in graphs, in: Pacific-Asia conference on knowledge discovery and data mining, Springer, 2021, pp. 541–553
2021
-
[36]
Breiman, Random forests, Machine learning 45 (2001) 5–32
L. Breiman, Random forests, Machine learning 45 (2001) 5–32
2001
-
[37]
L. Chen, J. Peng, Y . Liu, J. Li, F. Xie, Z. Zheng, Xblock blockchain datasets: Inpluslab ethereum phishing detection datasets (2019)
2019
-
[38]
S. Hu, Z. Zhang, B. Luo, S. Lu, B. He, L. Liu, Bert4eth: A pre-trained transformer for ethereum fraud detection, in: Proceedings of the ACM Web Conference 2023, 2023, pp. 2189–2197
2023
-
[39]
Fawcett, An introduction to roc analysis, Pattern recognition letters 27 (8) (2006) 861–874
T. Fawcett, An introduction to roc analysis, Pattern recognition letters 27 (8) (2006) 861–874
2006
-
[40]
G. Du, J. Zhang, M. Jiang, J. Long, Y . Lin, S. Li, K. C. Tan, Graph-based class-imbalance learning with label enhancement, IEEE transactions on neural networks and learning systems 34 (9) (2021) 6081–6095
2021
-
[41]
Vaswani, N
A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, I. Polosukhin, Attention is all you need, Advances in neural information processing systems 30 (2017)
2017
-
[42]
Bergstra, Y
J. Bergstra, Y . Bengio, Random search for hyper-parameter optimization, The journal of machine learning research 13 (1) (2012) 281–305
2012
Reviewed August 6, 2026 · model on record in the stance chip above.
Discussion (0). Sign in to comment.