Graph ML for Risk Modeling: Reading Guide
A graph can tell you that two applications share a publisher. A useful risk system must also decide how much that relationship matters, whether the evidence existed at prediction time, and whether it improves the review queue. This series follows that path from observed relationships to evaluated decisions.
The task is scoring application nodes. Publisher and domain edges are observed inputs; predicting whether a new edge will appear is a different task. You can work through the core examples with tabular-classification knowledge and basic averages. No graph database or GNN framework is needed.
Three artifacts connect the whole series
Smoothed feature: 0.51
Keep evidence weight and provenance. This is a model input, not A’s probability of risk.Report findings and workload
Measure precision, recall, review volume, and the coverage of outcome labels.Read in this order
Click through publisher and domain neighborhoods. See how hubs expand into many app pairs, define connection weights, and rebuild features using only evidence available at a historical cutoff.
Calculate a weighted feature, remove neighbors, and adjust its prior. Step through propagation to see repeated information return. Then identify what changes when a GNN learns the representation.
Choose a threshold under precision and review constraints, freeze it, and reveal test outcomes. Separate new apps from new publishers and estimate missed risk with an outside-queue audit.
The progression keeps three numbers separate: a connection weight, a neighborhood feature, and a classifier score. A large value at one stage does not establish that the next stage is correct. Each stage needs its own definition and a trace back to the evidence.
Use the examples to answer one question at a time
On the first pass, read the prose and use the figures. The construction contract, propagation fixed-point explanation, and threshold-selection code sit in optional details so you can return to them when implementing. The figures move only when you change a control.
| Question | Where to look |
|---|---|
| Why can a common host be misleading? | Projection and hub weighting |
| Which timestamp prevents future leakage? | Event time and available time |
| What happens with no neighbors? | Prior-only and undefined means |
| Does another propagation round add new evidence? | The two-app exchange |
| What does a GNN learn? | The message-passing layer |
| Is a new app a new group? | The publisher split diagram |
| Can alert labels establish recall? | The audit example |
For a small implementation, produce the three artifacts in the opening diagram: an as-of graph snapshot, one reproducible feature row, and a report for a frozen decision rule. The published threshold-selection functions and synthetic cohort CSV let you reproduce the evaluation arithmetic before attaching a real model.
Reuse the foundations when you need them
Group splitting explains how to keep related examples together, while time-based splitting defines the direction of a forecasting evaluation. Graphs require both kinds of thinking because relationships and labels can cross a split in different ways.
For model comparisons, the paired uncertainty chapter explains how to compare systems on matching examples. In this series, the appropriate resampling unit may be a publisher, incident, or time block. For deeper graph representation learning, continue from the GraphSAGE and propagation references after you can explain the simpler graph-feature baseline.