AI Research

Cyber-Financial Contagion: Modeling the Propagation... | AI Research

Key Takeaways

Modern banking relies heavily on a small group of shared artificial intelligence vendors to handle critical tasks like fraud screening, credit decisioning, a...
The banking system now depends on a small set of shared artificial intelligence vendors for fraud screening, credit decisioning, anti-money-laundering triage, customer analytics, and internal decision support.
We also train an early-warning model, CFC-GNN, that uses vendor-side incident telemetry and graph structure to flag high-cascade-risk vendors before impact.
Across four baselines the proposed model reaches AUROC 0.82 and AUPRC 0.60 while keeping calibration errors bounded.
We release the full code, synthetic data, and reproducible scripts.

Paper AbstractExpand

The banking system now depends on a small set of shared artificial intelligence vendors for fraud screening, credit decisioning, anti-money-laundering triage, customer analytics, and internal decision support. This paper studies how a compromise inside one of those vendors can propagate along a chain of operational, informational, and financial linkages until it triggers losses that look, from the outside, like a classical banking crisis. We build a four-layer heterogeneous network that couples AI vendors, financial institutions, interbank exposures, and customer accounts, and we propose CFC-Prop, a stochastic epidemic-and-clearing model that runs on that network. On a synthetic dataset with 60 vendors, 220 banks, roughly 2,500 vendor-bank service edges, and 1,400 interbank exposures, CFC-Prop reproduces the heavy-tailed loss distributions and the sharp dependence on patch latency that are consistent with prior cyber-financial evidence. We also train an early-warning model, CFC-GNN, that uses vendor-side incident telemetry and graph structure to flag high-cascade-risk vendors before impact. Across four baselines the proposed model reaches AUROC 0.82 and AUPRC 0.60 while keeping calibration errors bounded. We release the full code, synthetic data, and reproducible scripts. The results argue that cyber concentration among AI vendors is a first-order financial-stability problem and give supervisors a concrete quantitative tool for reasoning about it.

Modern banking relies heavily on a small group of shared artificial intelligence vendors to handle critical tasks like fraud screening, credit decisioning, and customer analytics. This research investigates the systemic risk posed by this concentration, specifically how a security compromise at a single AI vendor could cascade through the financial system, potentially triggering a crisis that mirrors traditional banking instability.

Modeling the Contagion

To understand these risks, the paper introduces a four-layer network model that maps the complex relationships between AI vendors, financial institutions, interbank financial exposures, and customer accounts. The author developed a tool called CFC-Prop, a stochastic epidemic-and-clearing model, to simulate how a cyber incident at a vendor spreads through these interconnected layers. By testing this model on a synthetic dataset—which includes 60 vendors, 220 banks, and thousands of service and financial links—the research demonstrates how a localized failure can evolve into widespread financial losses. The same reasoning question is explored in A Unified Physics-Aware Quantum Machine Learning..., which adds a research perspective.

Predicting Systemic Risk

Beyond simulating how a crisis might unfold, the paper introduces an early-warning system called CFC-GNN. This model uses graph structure and incident telemetry from vendors to identify which ones pose the highest risk of triggering a large-scale cascade before an impact occurs. In testing, this predictive model achieved an AUROC of 0.82 and an AUPRC of 0.60, showing promise as a tool for identifying high-risk nodes within the financial network. The same reasoning question is explored in Lose the Order, Keep the Hierarchy, which adds a research perspective.

Key Findings and Implications

The study highlights that the speed at which vendors can "patch" or resolve a security issue is a critical factor in preventing a minor incident from becoming a systemic event. The results suggest that the current level of cyber concentration among AI vendors is a significant financial-stability concern. By providing this quantitative framework, the research offers supervisors and regulators a concrete method to analyze and reason about the hidden vulnerabilities created by shared AI infrastructure in the banking sector. The author has made the code, synthetic data, and scripts publicly available to support further research and reproducibility. The same reasoning question is explored in Token-Efficient Data Reasoning Agents via Adaptive..., which adds a research perspective. as detailed in the full paper on Arxiv

Comments (0)

No comments yet

Be the first to share your thoughts!