MacroBase-Style Unsupervised Detection
for Anti-Money Laundering over 9.5M Transactions

Abstract

We present an unsupervised, fully explainable anti-money-laundering (AML) detection pipeline applied to the SAML-D synthetic transaction dataset (Oztas et al., 2023). The pipeline follows the MacroBase architecture (Bailis et al., 2017) — ingest, feature-build, score, classify, explain — and combines three orthogonal anomaly scorers (Isolation Forest, Median Absolute Deviation, and Minimum Covariance Determinant) with a frequent-pattern-mining step that surfaces the attribute combinations most over-represented in the outlier set. At a top-1% classification cutoff, the Isolation Forest scorer achieves F1 = 0.0445 and ROC-AUC = 0.8506 on 9,504,852 transactions, recovering 23.65% of labeled money-laundering activity without ever seeing a label during training. The explanation stage surfaces 149 frequent predicate combinations at risk ratios up to 17.76× the population baseline. Per-typology analysis shows the pipeline is strongest on behavioural-change patterns (92.5% recall) and structurally distinctive typologies (Scatter-Gather 32.8%, Layered-Fan-Out 30.8%) and weakest on smurfing (0% recall), which motivates future work on temporal-window features.

1. Introduction

Anti-money-laundering (AML) detection is a needle-in-a-haystack problem. On SAML-D the positive rate is 0.104% — 9,873 labeled suspicious transactions out of 9.5 million — and most of those positives are individually indistinguishable from ordinary economic activity. Laundering typologies such as cycle, fan-out, scatter-gather, and structuring are defined by behaviour over multiple accounts and over time, not by any single feature of a single transaction. A detector that looks only at row-level attributes cannot, by construction, see them.

Production AML tools typically lean on hand-written rules ("report any wire above $10,000", "flag cash deposits just under the SAR threshold") which are brittle, high-false-positive, and easy to evade. Supervised machine learning is attractive but requires label noise and class imbalance so extreme that it rarely survives contact with real ops. We take the opposite approach: no labels at training time, and explanations built from the data itself.

Our contribution is threefold:

• A MacroBase-style pipeline instantiation for SAML-D, with a three-tier feature hierarchy (transaction, account, graph) that captures the typology-defining behaviours without requiring a full graph library.
• An empirical comparison of Isolation Forest, MAD, and MCD on a multimodal inlier distribution, with F1, ROC-AUC, and per-typology recall reported at six classification thresholds.
• An explainable alert layer built on FP-Growth over the outlier set that produces 149 frequent attribute combinations with risk ratios up to 17.76×, operationally actionable for an analyst team.

2. Related Work

2.1 MacroBase

Bailis et al. (2017) introduce MacroBase, a fast-data analytics pipeline that combines statistical outlier detection with a contrast-set mining stage producing human-readable explanations. Their risk ratio metric — the ratio of a predicate's support in the outlier set to its support in the full population — is the foundation of our explanation stage. We adopt their two-pass strategy: compute single-predicate risk ratios first, prune below a minimum threshold, then run frequent itemset mining (FP-Growth) over only the surviving candidates to control combinatorial blow-up.

2.2 Isolation Forest

Liu, Ting, and Zhou (2008) propose Isolation Forest, a non-parametric outlier detector that isolates anomalies by recursively random-splitting features and measuring the expected path length. Anomalies reach leaf nodes after fewer splits because they sit in sparse regions. The algorithm makes no distributional assumptions, which we found essential for SAML-D: its inlier population is multimodal (cash deposits, cheques, cross-border wires, and payroll all have distinct amount and timing distributions) and a single Gaussian cannot fit it. We follow the paper's recommended max_samples=256 and n_estimators=100 because subsampling reduces the "masking" effect when anomalies cluster.

2.3 Graph Features for AML

Weber et al. (2019) demonstrate on the Elliptic Bitcoin dataset that graph-neural-network features improve AML detection F1 by 30–40% over transaction-level features alone, specifically on layering typologies where individual transactions appear normal. Savage et al. (2016) show that real-world laundering networks have measurably different topological properties — higher clustering coefficient, shorter average path length, more bidirectional ties — than legitimate transaction graphs. Both results motivated our graph feature layer, though we use a pandas-native approximation (cycle detection via self-joins, scatter-gather scoring via aggregation, shared-counterparty counts via set intersection) rather than a full GNN, so the pipeline remains tractable at 9.5 million rows on commodity hardware.

2.4 SAML-D Dataset

Oztas et al. (2023) release SAML-D, a synthetic AML monitoring dataset of 9.5 million transactions containing labeled instances of 17 laundering typologies. The paper explicitly labels Cycle, Scatter-Gather, Stacked Bipartite, and Layered Fan-In/Out as typologies that require network-level analysis to detect, which is the direct motivation for our graph feature layer. SAML-D is synthetic, but its typology definitions are drawn from real FATF typology reports, so the ground truth is structurally meaningful even if the counterparty identities are not real.

2.5 Regulatory Context

The United States Bank Secrecy Act requires financial institutions to file a Suspicious Activity Report (SAR) for any transaction above $5,000 deemed suspicious, and IRS Form 8300 triggers at $10,000. Launderers who know these thresholds engage in structuring, splitting a large transfer into many deposits just below the reporting threshold. Our just_below_2k, just_below_5k, just_below_10k, and just_below_50k features encode these hand-engineered regulatory signals directly. Country-level risk is sourced from the Financial Action Task Force's "Jurisdictions under Increased Monitoring" lists (FATF, February 2026), which enumerate sanctioned and high-risk jurisdictions; these populate the sender_blacklist / greylist and corresponding receiver features.

3. Dataset

We evaluate on the full SAML-D corpus. Key statistics:

Raw columns include transaction timestamp (Date, Time), sender and receiver account identifiers, amount in source currency, source and destination currencies, sender and receiver bank locations (country level), payment type (Wire, ACH, Cash Deposit, Cheque, Cross-border, ...), and two ground-truth columns (Is_laundering, Laundering_type) which are dropped before any unsupervised processing and only reattached in the evaluation stage.

4. Methods

4.1 Feature Engineering

Features are built in three layers, each targeting a different class of laundering signal.

Transaction-level

Row-by-row features computed independently per transaction.

Account-level

Per-account aggregates computed via groupby and merged back onto the transaction rows. These encode behaviour over time at the account level.

Graph-level

Transaction- and account-level features score each row independently; they cannot see patterns that emerge only across multiple related accounts. The graph-level layer computes a compact directed edge table (one row per unique sender→receiver pair) and derives per-account topological signals using pandas merge operations — no full graph traversal, so it scales to 9.5M rows.

4.2 Scoring

Three orthogonal scorers run in parallel on the same engineered feature matrix. All write to independent columns so results can be compared directly.

Isolation Forest (primary)

Non-parametric. Randomly splits features and measures the expected isolation depth of each point. Anomalies sit in sparse regions of feature space and are isolated in fewer splits. Handles multimodal inlier distributions natively, which is the decisive property on SAML-D. Hyperparameters per Liu et al.: n_estimators=100, max_samples=256, contamination=0.01.

Median Absolute Deviation (univariate)

For each feature independently, modified_z = 0.6745 · |x − median| / MAD, where 0.6745 calibrates MAD to a Gaussian standard deviation. The final score is the maximum modified z across all features: a row is anomalous if it is an outlier in any single dimension. Binary features (MAD = 0) are skipped to prevent divide-by-zero dominance.

Minimum Covariance Determinant (multivariate)

Fits a robust covariance ellipsoid to the densest 95% of inliers, then scores each transaction by its Mahalanobis distance from the robust centroid. Unlike MAD, MCD accounts for feature correlations. FastMCD is O(n·p²), so the model is fit on a 10,000-row subsample and used to score the full dataset.

4.3 Classification

We choose classification thresholds at percentiles of the score distribution rather than fixed scalar cutoffs, because the score distributions of the three methods live on completely different scales (see Results § 5.1). The default is the top 1% cutoff: at 0.1% true prevalence, 1% gives the explanation stage enough signal (~95K rows) to surface meaningful patterns while keeping the false-positive rate small enough that risk ratios remain interpretable.

4.4 Explanation via FP-Growth

The explanation stage implements Algorithm 2 from Bailis et al. For each attribute combination over the outlier set, we compute:

risk_ratio(p) = P(p | outlier) / P(p | population)

A risk ratio of 40 means the predicate is 40× more common in flagged transactions than in the full dataset. The two-pass strategy from the paper keeps the combinatorial complexity bounded:

1. Compute single-attribute risk ratios over the ~95K outlier set. Prune anything below min_support = 0.001 or min_risk_ratio = 3.0.
2. Run FP-Growth on the outlier set using only the surviving candidate predicates. Compute risk ratios for each frequent itemset against the full population.

Attribute columns used for explanation: Payment_type, Sender_bank_location, Receiver_bank_location, Payment_currency, Received_currency, is_currency_conversion_str, any_high_risk_str, is_weekend_str.

5. Results

5.1 Scorer comparison at top 1%

Table 1 shows the head-to-head comparison of the three scorers at the default top-1% classification threshold. Isolation Forest is the clear winner on precision, recall, and F1, while MCD posts the highest ROC-AUC despite a narrower flagged range.

MAD flags ~4× more transactions than its percentile threshold would nominally imply because many rows share identical maximum modified-z values (ties on a small number of features), and the ranking is broken by insertion order. This inflates its raw flagged count without lifting its F1. MCD's high ROC-AUC comes with a very low recall at the chosen cutoff because its Mahalanobis distances form a heavy-tailed distribution where the top 1% captures only the most extreme outliers.

5.2 Precision–recall trade-off by threshold

Figure 1 sweeps the classification percentile from 0.1% to 10% on Isolation Forest scores and plots precision, recall, and F1. Precision peaks at the tightest threshold, as expected, while F1 peaks at 0.5% due to the precision–recall trade-off.

5.3 Per-typology recall

Figure 2 decomposes recall at the top-1% threshold by laundering typology. The pipeline is strongest on behavioural-change and structured-network typologies and weakest on smurfing and bipartite typologies that rely on very-small-amount structuring.

5.4 Top risk-ratio patterns

The explanation stage produced 149 frequent predicate combinations with risk ratios above 3.0. Table 3 lists the top 10 by risk ratio. The highest-risk patterns are dominated by cross-border wires from Albania involving currency conversion — a combination with a population support of 0.18% that accounts for 3.27% of the flagged set, a 17.76× concentration.

6. Empirical Validation

We computed permutation importance on the trained Isolation Forest using a 200,000 row stratified sample (balanced on is_anomalous). Five repeats, random_state=42. The scoring function was score_samples, so a larger drop when a column is shuffled means the column contributes more to anomaly ranking power. Results in Table 4.

Three findings from the permutation importance table bear directly on the design of the pipeline:

1. The top ten features are split between account aggregates and graph topology. Four of the six graph features (the cycle flags and scatter-gather intermediary counts) land in the top nine. This contradicts a prior we held going in, which was that a pandas based approximation of graph features would be too noisy to rank near a GNN embedding. On SAML-D, at Isolation Forest's granularity, the signal survives.
2. Hand engineered regulatory signals contribute nothing to scoring. any_high_risk (the FATF blacklist or greylist flag on either side of the transaction) has zero permutation importance. just_below_10k (the IRS Form 8300 structuring flag) has negative permutation importance: shuffling it actually improves the anomaly ranking, which is a strong signal that this column is pure noise to the scorer.
3. The FATF features still matter, but only at the explanation stage. The highest risk ratio predicates in Table 3 are dominated by Albania (a FATF greylisted jurisdiction), which tells us the FP-Growth stage is correctly recovering the hand engineered priors even when the scorer does not weight them. This is a clean separation of concerns: the scorer learns behavioural anomalies, the explanation stage imports the regulatory context.

6.1 Scorer agreement and disagreement

Cross scorer agreement at the top 1% cutoff is remarkably low. Table 5 breaks it down.

Two things are striking here. First, zero transactions are flagged by all three scorers simultaneously. At the same percentile cutoff, the three methods carve up the tail of the score distribution in completely different ways. Second, the IF only partition has nearly thirty times the precision of the MCD only partition (2.88% vs 0.10%). A naive ensemble that flags anything scored by any of the three methods would actually lower aggregate precision to 1.47%, worse than Isolation Forest alone. The empirical lesson is that MCD adds volume but no signal at this percentile, and any production ensemble should treat IF as the gate and use the others only for cross validation on borderline cases.

6.2 Typology catastrophes

Two findings stood out in the typology confusion matrix that the main per typology bar chart (Figure 2) does not make obvious:

• Smurfing catches zero true positives at any reasonable percentile. Of 932 labelled Smurfing transactions, the Isolation Forest flags none at top 1%. Smurfing positives sit entirely in the bulk of the score distribution, not the tail. Section 7.3 below discusses this in the context of the SMoTeF and GARG-AML results from the literature.
• The top false positive source is Normal_Foward, a benign typology that gets flagged at 51.3% of its population. Every second Normal_Foward transaction ends up in the top 1% of IF scores. Because the Normal_Foward population (42,031 rows) is small relative to the flagged set, it does not dominate raw false positive counts (it contributes 21,567 FPs), but it has the highest flagging rate of any non laundering typology by a wide margin. It is the biggest false positive driver per capita in the dataset.

7. Ablation Study: Feature Tier Contributions

We stratified sampled 489,394 rows (9,873 positives kept, negatives subsampled so positives make up 2.02% of the sample), then re-ran the Isolation Forest under three feature tier configurations with identical hyperparameters. Results in Table 6.

The account feature tier contributes by far the largest headline lift. Going from transaction features alone to transaction plus account features moves F1 from 0.0614 to 0.1659, a 2.7× jump, and lifts ROC-AUC from 0.6541 to 0.7468. On this sample, adding the graph features on top produces a regression: F1 falls back to 0.0849 and ROC-AUC to 0.7033.

7.1 Why graph features regress on the sample

The regression is a sampling artifact, not a feature defect. Two interacting effects explain it:

1. Graph features are computed over the sample edges, not the full graph. The sample retains every laundering positive but Bernoulli subsamples 98% of the negatives, which breaks most real cycles. A two hop cycle A → B → A that exists in the full 9.5M row graph survives into the sample only if both edges are retained, which happens with probability roughly 4% × 4% = 0.16% for negative edges. The in_any_cycle flag therefore fires on far fewer transactions in the sample than it does in the full run, and the ones it does fire on are biased toward short paths with few intermediaries.
2. Isolation Forest splits random features. At 17 features with a small positive count, the tree partitions the space more coarsely per feature; adding degraded graph features effectively lowers the average split quality.

The permutation importance study in Section 6 ran on the full 9.5M row dataset and placed four graph features in the top nine, which is the opposite conclusion. Both can be true simultaneously: graph features lift performance on the full dataset, and a sampled ablation under reports them. The practical takeaway for production is that any graph feature engineering on this pipeline needs to run on the full graph topology, not on per split samples.

7.2 Per tier typology shifts

The per typology breakdown under ablation surfaced one genuinely interesting shift independent of the sampling issue: Behavioural_Change_1 recall climbs from 1.8% (transaction only) to 49.2% (add account) to 69.8% (add graph). Every tier adds roughly 20 percentage points of recall to that specific typology. This confirms the hypothesis that behavioural change is a genuinely graph level phenomenon: an account whose counterparty mix and amount pattern changes is visible only once you aggregate over time and across the counterparty network.

8. Positioning in the Literature

The SAML-D dataset was released in late 2023 (Oztas et al., IEEE ICEBE 2023) and the Kaggle hosting page is currently the de facto distribution point. Published benchmarks on SAML-D specifically are sparse; the Science and Information Journal Volume 16 No. 6 (2025) reports an LSTM baseline achieving F1 89.8% (accuracy 91.5%, precision 89.4%, recall 90.2%), and a hybrid LSTM + GraphSAGE at 95.4% accuracy, both supervised on a balanced split. Those numbers are not directly comparable to the unsupervised top 1% F1 we report for two reasons. First, they evaluate on a balanced test split whereas we evaluate on the raw 0.1% positive rate distribution, which mechanically compresses F1. Second, they use full supervision at training time whereas our pipeline never sees a label until the evaluation stage. A fair apples to apples comparison would require computing the LSTM's precision and recall at the equivalent classification percentile, which that paper does not report.

On adjacent cryptocurrency AML benchmarks (Elliptic Bitcoin), the current state of the art is ChronoWave-GNN at F1 0.9799 (Scientific Reports 2025, Nature), followed by TFGAT with cyclic pseudo labels at 0.9046, both supervised. The original Weber et al. GCN from 2019 achieves approximately 0.80 illicit F1 on the same dataset, which is closer to the order of magnitude of our ROC-AUC on SAML-D once the class balance difference is accounted for.

8.1 Smurfing gap and targeted literature

Our 0% recall on Smurfing is the most glaring failure mode, and the literature offers two direct remedies, both from 2024 and 2025:

• SMoTeF (Applied Intelligence, 2024, Springer) proposes "computing maximum temporal flow within temporal order of events" as a dedicated smurfing detector. The key insight is that smurfing is a flow problem, not a row level problem: you need to integrate small amount transfers across a temporal window to expose the structured total. Our time_since_last_tx_hours is a single lag, not a window integral, and therefore misses this by design.
• GARG-AML (arXiv 2506.04292, 2025, arXiv) computes a single interpretable score from the second order transaction neighbourhood of each node. It is pandas friendly, intended to slot into existing AML workflows, and the paper reports specifically that it targets the smurfing detection gap that this writeup surfaces.

8.2 Production standard on explainability

The 2026 ScienceDirect piece on hybrid deep learning for AML (ScienceDirect) argues that the current production standard for explainable AML is XGBoost plus SHAP, with GNN based anomaly scoring layered on top for the typologies that row level gradient boosting cannot reach. Our architecture differs: we use MacroBase risk ratios on an unsupervised scorer, which Bailis et al. (SIGMOD 2017) show is 3.2× faster than running FP-Growth on inliers and outliers separately while producing interpretable group level explanations rather than row level SHAP scores. The two approaches answer different questions: SHAP answers "why was this specific transaction flagged?" and MacroBase answers "what attribute combinations are over represented in the flagged set as a whole?". Both are needed for a production analyst workflow.

A full literature review with fifteen additional references is available at analysis/literature_deep_dive.md.

9. Discussion

9.1 Where the pipeline succeeds

The pipeline achieves ROC-AUC = 0.8506 on SAML-D without ever seeing a label at training time. That discrimination is driven almost entirely by the feature engineering: transaction-level structuring signals (just_below_10k) and account-level behavioural features (sender_amount_cv, sender_fan_out_ratio) give Isolation Forest enough multivariate structure to separate classes with no supervision. The per-typology recall breakdown confirms that the pipeline is strongest exactly where the features target specific laundering behaviours:

• Behavioural_Change typologies (92.5% and 74.6%) are detected because the account-level time-since-last-transaction and coefficient-of-variation features fire strongly when an account's historical pattern changes abruptly.
• Scatter-Gather (32.8%) and Layered_Fan_Out (30.8%) are detected by the dedicated graph-level features (scatter_gather_score, sender_fan_out_ratio). Without the graph layer, these typologies drop by design — they are not visible at the row level.
• Structuring (27.1%) is detected by the just_below_Xk margin features, which encode SAR and IRS reporting thresholds as a direct signal.

9.2 Where the pipeline struggles

The two failure modes are informative:

• Smurfing (0.0% recall) is an intentional limitation of the feature set. Smurfing spreads small amounts (well under $1,000) across many accounts and many days, without any row-level "just below threshold" signal. Detecting it requires a rolling temporal window feature ("has this account received >20 deposits of similar size in the last 7 days?") that our current account-level aggregates do not compute. Adding a windowed aggregation would be the single largest gain available.
• Cash_Withdrawal (4.6% recall) suffers from the same root cause as Smurfing: the laundering signal is in the sequence of withdrawals, not in any single one.
• Bipartite typologies (Bipartite 10.2%, Fan_Out 13.5%) are partially detected — the scatter-gather graph features catch the intermediary role but miss the "terminal" accounts that only appear as endpoints. A GNN-style message-passing layer would likely close this gap.

9.3 The Albania bias in the top alerts

The top nine risk-ratio patterns in Table 3 are all dominated by Albania. Two factors drive this:

1. Albania appears on the FATF Grey List in the February 2026 update, which our sender_greylist feature encodes directly. Any Isolation Forest tree that splits on this feature will push Albanian senders toward the outlier leaf, systematically over-representing them in the top 1%.
2. Albanian lek is a low-liquidity currency. Any cross-border transaction from Albania in lek is forced into currency conversion, producing a conjunction of three flagged features (sender_greylist, is_currency_conversion, cross-border payment type) that is rare in the population (support < 0.2%) but dense in the outlier set (support > 3%).

This is not a bug so much as a design feature: it shows the pipeline correctly propagating the FATF-informed prior into the explanation layer. In production, an analyst could either accept this as legitimate risk stratification or add a country-stratified evaluation mode where risk ratios are computed per-jurisdiction to surface within-country anomalies.

9.4 Limitations

• Temporal structuring across days. time_since_last_tx_hours captures rapid-succession structuring but misses coordinated transactions spread over multiple days. A rolling-window count would be more precise but is expensive at 9.5M rows.
• Overlapping classes. SAML-D includes typologies Normal_Fan_Out and Suspicious_Fan_Out that are structurally similar. Unsupervised detection will produce false positives in regions of feature space where the two populations overlap. This is the dominant source of the precision ceiling at ~3.37% at the 0.1% threshold.
• Graph feature scalability. The graph layer runs in O(E²) time in the number of unique edges. On SAML-D this is manageable (~80 seconds for the full dataset), but on production-scale streams it would need either a sampling strategy or a streaming approximation.
• MCD multimodality assumption. MCD assumes the inliers form a single Gaussian cluster. SAML-D's inliers are multimodal, so MCD misfits — this is visible in its ROC-AUC being highest (0.8527) while its recall at the 1% cutoff is lowest (4.27%). MCD ranks well on average but is overconfident at the tails.

9.5 Future work

• Rolling-window behavioural features. A 7-day and 30-day rolling count of same-amount deposits per sender/receiver should push Smurfing recall from 0% to at least 20–30%, and it is the single largest addressable gap.
• Graph neural network layer. Replacing the pandas approximation of graph features with a GCN on the transaction graph (Weber et al., 2019) should close the gap on Bipartite and Layered-Fan-In typologies at the cost of substantial compute.
• Threshold stratification. A per-country or per-payment-type classification cutoff would reduce the FATF-driven bias in the top alerts and make risk ratios more locally interpretable.
• Feedback loop. The platform already ships with an analyst console (FastAPI + React) that displays flagged transactions, explanations, and a graph viewer. Adding an accept/reject button and using the captured labels as seed data for a semi-supervised refinement of Isolation Forest would be a natural next step.

10. Future Work: Polymarket Insider Detection and Prediction Market Fraud

Prediction markets such as Polymarket are an emerging surveillance target where the MacroBase pipeline maps with striking directness. Polymarket operates a hybrid decentralized central limit order book (CLOB) on the Polygon blockchain, settling binary outcome contracts in USDC.e. Every bet, cancellation, and resolution is recorded on chain, and each user interacts through a deterministic proxy wallet whose full history is publicly queryable (Polymarket CLOB Docs). This transparency is a double edged sword: it makes insider trading detectable in a way that traditional equity markets cannot match, but it also means that detection must keep pace with adversaries who can see the same data.

The urgency is real. In 2025 and 2026, a series of high profile insider trading incidents demonstrated both the scale of the problem and the feasibility of on chain detection:

10.1 How the MacroBase pipeline maps to Polymarket

The pipeline's three tier feature hierarchy translates to prediction market insider detection with one structural advantage: because Polymarket settles on Polygon, every bet is a timestamped on chain event with a known proxy wallet, a known market, a known direction (YES/NO), and a known size in USDC. This is richer than the SAML-D row schema because it includes an observable outcome (market resolution) that lets us define "informed" versus "uninformed" trading ex post.

10.2 Insider trading typologies on prediction markets

Prediction market insider trading comes in recognizable typologies, analogous to the AML typologies in SAML-D:

Pre announcement sniping

The actor has advance knowledge of a future event (military action, policy announcement, prize winner) and places a large directional bet before the information becomes public. The Nobel Peace Prize and Tehran incidents are textbook examples. Detection features: time_to_resolution_minutes (very small), bet_size_usdc (very large), payout_multiple (very high), and proxy_wallet_age_days (often a new wallet created specifically for the trade).

Sybil coordinated betting

The April 2026 ceasefire incident involved 50 newly created accounts placing bets in a short window, each individually below any single account threshold but collectively moving the market. This is the prediction market analog of smurfing. The graph level usdc_funding_cluster_size and co_bet_cluster_count features detect it by tracing the on chain USDC funding paths and bet timing correlation.

Outcome manipulation

An actor who can influence the outcome (a politician who can announce a policy, a judge who can issue a ruling) bets on the outcome they intend to cause. Polymarket's 2025 Market Integrity rules explicitly ban this (XMR Vegas). Detection is harder because the bet itself may look normal; the signal is in the identity of the bettor, not the trade pattern. Wallet clustering linked to known public figures (via exchange KYC deposit tracing or ENS domain registration) becomes the key feature.

Wash trading and market manipulation

Fortune reported in October 2024 that Polymarket's Trump election market was "rife with fake wash trading" based on analysis by academic researchers (Fortune). A single French national operated four accounts totaling $45M in Trump bets. Our cycle detection features (in_2hop_cycle) can detect wash trades directly: USDC flowing from wallet A to wallet B's bet, then outcome tokens from B back to A, forms a detectable 2 hop cycle on the Polygon transaction graph.

10.3 Existing detection tools and prior art

Two systems are currently operational:

• polymarket-insider-detector (GitHub). An open source Next.js tool that computes four statistical signals per wallet: binomial p value on win rate (flag at p < 0.001), pre resolution timing analysis (flag trades within 1 to 10 minutes of resolution), whale thresholds ($5K+ bets, "mega whale" at $25K+), and USDC funding source tracing on Polygon for Sybil detection. Produces a composite risk score from 0 to 10 with Low/Medium/High/Critical tiers.
• Kalshi's "Poirot" system (The Block). Kalshi operates as a CFTC designated contract market and runs a proprietary pattern recognition tool named Poirot that has flagged over 200 investigations and multiple account freezes. No public technical details have been released.

Our MacroBase pipeline would sit between these two: more statistically principled than the p value heuristic (which ignores multivariate feature interactions) and more transparent than a proprietary black box. The FP-Growth explanation layer is the differentiator: it produces human readable predicate combinations that could serve as evidence in a DOJ investigation, not just a scalar risk score.

10.4 Technical architecture for Polymarket ingestion

Polymarket exposes three APIs that together provide every data point the pipeline needs (Chainstack guide):

• Gamma API (public, no auth). Market discovery: condition IDs, descriptions, categories, resolution timestamps, and current probabilities. This is the equivalent of our CSV's metadata columns.
• CLOB API (authenticated for trading, read only for order book). Real time and historical order book depth, fills, and cancellations. Each fill record includes the proxy wallet address, direction, price, size, and timestamp. This is the core transaction stream.
• Polygon RPC. On chain settlement records, USDC.e transfers, and proxy wallet deployment transactions. This is where funding source tracing and wallet clustering happen.

The ingestion layer would poll the CLOB API for fills (or subscribe via WebSocket for real time), enrich each fill with Gamma metadata (market category, resolution status, current odds), and trace the proxy wallet's USDC funding chain via Polygon RPC. The resulting row schema maps directly onto the existing pipeline's load_data() interface.

10.5 Phased research roadmap

10.6 Open research questions

1. What constitutes "informed" versus "lucky" on a prediction market? The existing insider-detector GitHub tool flags wallets with win rates above 80% at p < 0.001, but prediction markets reward genuine expertise. A sophisticated political analyst who consistently beats the market is not an insider. Separating skill from information requires conditioning on market category, question difficulty, and timing relative to public information flow.
2. Can FP-Growth explanations serve as legal evidence? The DOJ SDNY is actively exploring whether prediction market bets violate insider trading laws. A risk ratio explanation like "wallets matching this predicate combination are 40x more concentrated in the pre resolution window than baseline" is more rigorous than a scalar p value, but it has not been tested in court. Collaborating with a legal scholar on the evidentiary standard would be a high value next step.
3. How fast does the adversary adapt? The progression from single whale accounts (2024 election) to 50 coordinated Sybil accounts (April 2026 ceasefire) happened in 18 months. A streaming detection pipeline must be retrained or at least recalibrated on a monthly cadence to keep pace with adversarial evolution.
4. Is Isolation Forest the right scorer for prediction markets? The inlier distribution on Polymarket is simpler than SAML-D (most bets are small, long dated, and lose), which means the multimodality advantage of IF is less important. A gradient boosted model (XGBoost or LightGBM) trained on the known insider incidents as positives might outperform IF once a small labeled set is available. The MacroBase architecture supports swapping the scorer without changing the explanation layer.

References

1. Bailis, P., Gan, E., Madden, S., Narayanan, D., Rong, K., & Suri, S. (2017). MacroBase: Prioritizing Attention in Fast Data. SIGMOD 2017.
2. Oztas, B., Cetinkaya, D., Adedoyin, F., Budka, M., & Aksu, H. (2023). Enhancing Anti-Money Laundering: Development of a Synthetic Transaction Monitoring Dataset. IEEE 2023.
3. Liu, F. T., Ting, K. M., & Zhou, Z.-H. (2008). Isolation Forest. ICDM 2008.
4. Han, J., Pei, J., & Yin, Y. (2000). Mining Frequent Patterns without Candidate Generation. SIGMOD 2000.
5. Weber, M., Domeniconi, G., Chen, J., Weidele, D. K. I., Bellei, C., Robinson, T., & Leiserson, C. E. (2019). Anti-Money Laundering in Bitcoin: Experimenting with Graph Convolutional Networks for Financial Forensics. KDD Workshop 2019.
6. Savage, D., Wang, Q., Chou, P., Zhang, X., & Yu, X. (2016). Detection of Money Laundering Groups Using Supervised Learning in Networks. arXiv:1608.00708.
7. Financial Action Task Force (2026). Jurisdictions under Increased Monitoring. February 2026 update.
8. Prediction markets caught insider traders in real time. Congress wants to shut them down anyway. Fortune, April 2 2026. Link.
9. Federal prosecutors exploring whether prediction market bets trip insider trading laws. CNN, March 30 2026. Link.
10. Korosec, D. and Weisenthal, J. From Iran to Taylor Swift: Informed Trading in Prediction Markets. Harvard Law School Forum on Corporate Governance, March 25 2026. Link.
11. suislanchez. polymarket-insider-detector: Statistical analysis tool for detecting insider trading patterns on Polymarket. GitHub, 2025. Link.
12. Kalshi, Polymarket tighten insider trading controls amid Senate scrutiny. The Block, 2025. Link.
13. Polymarket CLOB Introduction. Polymarket Developer Documentation. Link.
14. Election betting site Polymarket gives Trump a 67% chance but is rife with fake wash trading, researchers say. Fortune, October 30 2024. Link.