GRP-114-127 Gamma-Sieve: Structural De-obfuscation of Financial Regime Manipulation via Heterophilic Graph Neural Networks

GRP-114-127 Gamma-Sieve: Structural De-obfuscation of Financial Regime Manipulation via Heterophilic Graph Neural Networks

https://www.kennesaw.edu/ccse/events/computing-showcase/sp26-cday-program.php

Market manipulation increasingly exploits fragmentation — dispersing orders across dozens of accounts, venues, and sub-second timing windows — to evade rule-based surveillance. We present Gamma-Sieve, a heterophilic graph neural network approach that constructs heterogeneous transaction graphs (four node types, ten edge types) from market microstructure data, applying CARE-GNN with RL-gated edge filtering and TFE-GNN with spectral triple-frequency decomposition. At production scale, heterophilic GNNs outperform a bidirectional LSTM baseline by +16% AUC on fragmented coordination attacks. However, evaluation on real NASDAQ equity data (LOBSTER Level 3) reveals a critical domain-shift challenge: GNN false positive rates of 42–88% on legitimate trading, caused by structural overlap between adversarial fragmentation and real market-making coordination. Fragmentation calibration resolves this for CARE-GNN, reducing FPR from 7.5% to 2.4%. A cross-attack experiment further qualifies the structural advantage: GNNs catastrophically fail on unseen single-agent attacks while the LSTM detects them perfectly, demonstrating that robust deployment requires multi-architecture ensembles. These results establish graph topology as essential for detecting dispersed coordination while revealing the practical necessity of domain calibration and attack-diverse training for real-world deployment.