Paper deep dive
Federated Graph AGI for Cross-Border Insider Threat Intelligence in Government Financial Schemes
Srikumar Nayak, James Walmesley
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 91%
Last extracted: 7/21/2026, 2:16:19 AM
Summary
The paper introduces FedGraph-AGI, a novel framework for cross-border insider threat detection in government financial schemes. It integrates federated graph neural networks, Mixture-of-Experts (MoE) aggregation, and Artificial General Intelligence (AGI) reasoning via Large Action Models (LAM). The system addresses privacy constraints, graph-structured interdependencies, and complex reasoning requirements by performing causal inference over distributed financial data while maintaining differential privacy.
Entities (9)
Relation Signals (7)
FedGraph-AGI → solves → Insider Threat Detection
confidence 96% · novel federated learning framework... for privacy-preserving cross-border insider threat detection
FedGraph-AGI → uses → Graph Neural Networks
confidence 95% · Our approach combines: (1) federated graph neural networks preserving data sovereignty
FedGraph-AGI → uses → Large Action Models
confidence 92% · AGI-powered reasoning via Large Action Models (LAM) performing causal inference over graph data
FedGraph-AGI → uses → Mixture-of-Experts
confidence 90% · (2) Mixture-of-Experts (MoE) aggregation for heterogeneous jurisdictions
Large Action Models → performs → Causal Inference
confidence 89% · LAMs perform causal inference over graph data
FedGraph-AGI → applies → Differential Privacy
confidence 88% · The system maintains epsilon = 1.0 differential privacy
Graph Attention Network → iscomponentof → FedGraph-AGI
confidence 87% · Each jurisdiction maintains a local Graph Attention Network (GAT)
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Cross-border insider threats pose a critical challenge to government financial schemes, particularly when dealing with distributed, privacy-sensitive data across multiple jurisdictions. Existing approaches face fundamental limitations: they cannot effectively share intelligence across borders due to privacy constraints, lack reasoning capabilities to understand complex multi-step attack patterns, and fail to capture intricate graph-structured relationships in financial networks. We introduce FedGraph-AGI, a novel federated learning framework integrating Artificial General Intelligence (AGI) reasoning with graph neural networks for privacy-preserving cross-border insider threat detection. Our approach combines: (1) federated graph neural networks preserving data sovereignty; (2) Mixture-of-Experts (MoE) aggregation for heterogeneous jurisdictions; and (3) AGI-powered reasoning via Large Action Models (LAM) performing causal inference over graph data. Through experiments on a 50,000-transaction dataset across 10 jurisdictions, FedGraph-AGI achieves 92.3% accuracy, significantly outperforming federated baselines (86.1%) and centralized approaches (84.7%). Our ablation studies reveal AGI reasoning contributes 6.8% improvement, while MoE adds 4.4%. The system maintains epsilon = 1.0 differential privacy while achieving near-optimal performance and scales efficiently to 50+ clients. This represents the first integration of AGI reasoning with federated graph learning for insider threat detection, opening new directions for privacy-preserving cross-border intelligence sharing.
Tags
Links
- Source: https://arxiv.org/abs/2602.16109v1
- Canonical: https://arxiv.org/abs/2602.16109v1
Trouble viewing inline? Open PDF directly →
Full Text
50,084 characters extracted from source content.
Expand or collapse full text
Federated Graph AGI for Cross-Border Insider Threat Intelligence in Government Financial Schemes Srikumar Nayak Incedo Inc., New Jersey, USA Indian Institute of Technology, Chennai, Tamil Nadu, India James Walmesley University of Kent, Kent, UK Abstract Cross-border insider threats pose a critical challenge to government financial schemes, particularly when dealing with distributed, privacy-sensitive data across multiple jurisdictions. Existing approaches face fundamental limitations: they cannot effectively share intelligence across borders due to privacy constraints, lack reasoning capabilities to understand complex multi-step attack patterns, and fail to capture intricate graph-structured relationships in financial networks. We introduce FedGraph-AGI, a novel federated learning framework integrating Artificial General Intelligence (AGI) reasoning with graph neural networks for privacy-preserving cross-border insider threat detection. Our approach combines: (1) federated graph neural networks preserving data sovereignty; (2) Mixture-of-Experts (MoE) aggregation for heterogeneous jurisdictions; and (3) AGI-powered reasoning via Large Action Models (LAM) performing causal inference over graph data. Through experiments on a 50,000-transaction dataset across 10 jurisdictions, FedGraph-AGI achieves 92.3% accuracy, significantly outperforming federated baselines (86.1%) and centralized approaches (84.7%). Our ablation studies reveal AGI reasoning contributes 6.8% improvement, while MoE adds 4.4%. The system maintains ϵ=1.0ε=1.0 differential privacy while achieving near-optimal performance and scales efficiently to 50+ clients. This represents the first integration of AGI reasoning with federated graph learning for insider threat detection, opening new directions for privacy-preserving cross-border intelligence sharing. Keywords: Federated Learning; Graph Neural Networks; Artificial General Intelligence; Large Action Models; Mixture of Experts; Neural Network; Insider Threat Detection; Privacy-Preserving Machine Learning; Cross-Border Intelligence 1 Introduction 1.1 Background and Motivation Government financial schemes—including social welfare programs, subsidy distribution, tax collection, and public procurement—process trillions of dollars annually. These systems increasingly face sophisticated insider threats: malicious actors with privileged access exploiting their position for fraud, embezzlement, or espionage. The World Bank estimates government corruption costs developing nations over $1 trillion yearly, while insider threats account for 34% of government fraud cases with median losses exceeding $150,000 per incident. The challenge is compounded by three critical factors. First, cross-border complexity: Modern financial schemes involve multiple jurisdictions, with transactions crossing national boundaries. Detecting sophisticated fraud requires intelligence sharing, yet data privacy regulations (GDPR, national sovereignty laws) prohibit centralized aggregation. Second, graph-structured interdependencies: Financial transactions form complex networks where threats manifest as structural anomalies—unusual patterns, suspicious connections, coordinated multi-party schemes invisible when examining isolated transactions. Third, reasoning requirements: Insider threats increasingly employ multi-step strategies requiring causal reasoning—privilege escalation over months, shell companies across jurisdictions, coordination with policy changes—patterns demanding human-like reasoning over long horizons. Traditional machine learning approaches fail in this context. Centralized models cannot access cross-border data due to privacy constraints. Standard federated learning enables distributed training but lacks graph awareness and reasoning capabilities. Graph neural networks (GNNs) excel at relational data but struggle in federated settings where graph structure spans multiple data silos. Existing systems lack abstract reasoning—causal inference, counterfactual analysis, multi-hop logical deduction—that human analysts employ investigating complex fraud. 1.2 The Need for AGI-Enhanced Federated Graph Learning Artificial General Intelligence represents a paradigm shift from narrow, task-specific models to systems capable of abstract reasoning and human-like problem-solving. Recent advances in foundation models and Large Action Models (LAM) demonstrate that neural architectures can learn general-purpose reasoning when trained at scale on diverse tasks. LAMs extend large language models with action-taking abilities, enabling environment interaction, multi-step planning, and goal-directed reasoning. We posit that integrating AGI reasoning—specifically LAM-based causal inference and planning—into federated graph learning solves the insider threat challenge. Such a system would: (1) operate in a privacy-preserving federated manner; (2) leverage GNNs for relational patterns; (3) employ AGI reasoning for sophisticated multi-step attacks; and (4) use MoE for jurisdiction heterogeneity. 1.3 Limitations of Current State-of-the-Art Methods Standard Federated Learning: Methods like FedAvg and FedProx operate on independently-and-identically-distributed (IID) tabular data, failing to model graph-structured relationships central to financial networks. They treat transactions as independent samples, missing coordinated attacks, money laundering chains, and collusion networks. Our experiments show FedAvg achieves only 82.3% accuracy. Centralized GNNs: Graph Convolutional Networks (GCN), Graph Attention Networks (GAT), and GraphSAGE excel at graph data but require centralized access, unsuitable for cross-border scenarios. They lack reasoning for novel attack strategies. Federated GNNs: Recent attempts face challenges: assuming complete local subgraphs (unrealistic when transactions span jurisdictions) and using simple averaging-based aggregation failing to account for heterogeneity across countries. Lack of Reasoning: All existing approaches rely on pattern matching rather than reasoning. They detect attacks resembling training examples but fail when adversaries employ novel strategies requiring causal inference. 1.4 Our Contributions This paper introduces FedGraph-AGI, the first framework integrating AGI reasoning with federated graph neural networks for cross-border insider threat detection: 1. Novel Architecture: Three-layer federated architecture combining local graph neural networks, MoE aggregation handling cross-jurisdiction heterogeneity, and an AGI reasoning module based on LAMs performing causal inference over aggregated graph representations. 2. Privacy-Preserving Cross-Border Learning: Federated protocol enabling collaborative training without sharing raw transaction data. Employs differential privacy (ϵ=1.0ε=1.0) and secure aggregation protecting sensitive information while maintaining utility. 3. AGI-Powered Reasoning: LAM-based module constructing causal graphs of attacker behavior, performing counterfactual inference, and executing multi-hop logical deduction across financial networks. 4. MoE for Heterogeneous Jurisdictions: Learned aggregation mechanism discovering and leveraging jurisdiction-specific patterns rather than naive averaging. 5. Comprehensive Evaluation: First large-scale cross-border financial fraud dataset (50,000 transactions across 10 jurisdictions). FedGraph-AGI achieves 92.3% accuracy, outperforming baselines by 6.2–9.6%. Ablation studies quantify each component’s contribution with privacy-utility tradeoff and scalability analysis. 6. Theoretical Analysis: Convergence guarantees for federated learning under non-IID graph data, differential privacy bounds, and computational complexity analysis. 1.5 Organization Section 2 surveys related work. Section 3 presents the FedGraph-AGI framework. Section 4 describes experimental setup and results. Section 5 discusses findings and limitations. Section 6 concludes with future directions. 2 Related Work Our work intersects federated learning, graph neural networks, insider threat detection, and AGI. We organize thematically, highlighting how our approach differs from existing work. 2.1 Federated Learning for Privacy-Preserving Collaboration Federated Learning (FL) was introduced for training models across decentralized data without centralizing raw data. FedAvg computes local updates and aggregates via weighted averaging. Extensions include FedProx addressing heterogeneity through proximal regularization, FedOpt with adaptive optimization, and SCAFFOLD reducing client drift. While effective for image classification and language modeling on IID data, these methods struggle with cross-border financial settings. Financial data is highly non-IID across jurisdictions due to regulatory differences and economic conditions. Existing FL focuses on tabular or sequential data, not graph structures, and ignores reasoning capabilities. Our MoE-based aggregation extends FL to extreme heterogeneity by learning which local models are relevant for which patterns, departing from standard averaging. 2.2 Graph Neural Networks and Federated Extensions Graph Neural Networks revolutionized learning on relational data. Seminal architectures include GCN generalizing convolutions to graphs, GAT introducing attention, and GraphSAGE enabling inductive learning. Advanced architectures like Graph Transformers further push performance. These models require centralized graph access, violating privacy in cross-border settings. Federated GNNs have emerged: some works partition graphs across clients with FedAvg aggregation; others propose structure sharing with differential privacy; and others introduce subgraph learning with knowledge distillation. Despite advances, existing FedGNNs assume complete local subgraphs (unrealistic when transactions span jurisdictions), use simple averaging failing to model jurisdiction-specific patterns, and lack interpretability required for government fraud detection. Our approach handles cross-client edges via secure message passing, employs MoE-based selective aggregation, and includes AGI reasoning for human-interpretable explanations. 2.3 Insider Threat Detection in Financial Systems Insider threat detection has been extensively studied in cybersecurity. Traditional approaches use rule-based systems, anomaly detection, or supervised learning. In finance, methods range from statistical outlier detection to deep learning using autoencoders, recurrent networks, and graph-based fraud detection. Recent work explores graph approaches: some detect collusion networks; others use GNNs for e-commerce fraud; others address label scarcity via self-supervised learning. This work universally assumes centralized data access. No prior work tackles federated, cross-border insider threat detection with privacy constraints and reasoning capabilities for sophisticated multi-step attacks. 2.4 Artificial General Intelligence and Large Action Models Artificial General Intelligence refers to AI with broad, human-like intelligence capable of abstract reasoning and transfer learning. Foundation models—large neural networks pre-trained on massive, diverse data—bring AGI closer. Large Action Models (LAM) extend large language models with action-taking capabilities. While LLMs like GPT-4 excel at language, LAMs learn environment interaction, multi-step planning, and goal-directed behavior, showing promise in robotics and software development. Application of AGI/LAM to graph reasoning is nascent. Some work explores LLMs for knowledge graph reasoning but focuses on single-domain question answering, not complex multi-step threat detection in multi-jurisdictional settings. Our work represents the first application of LAM-based AGI reasoning to federated graph learning for insider threat detection, demonstrating LAMs can perform causal inference over financial graphs and generate interpretable explanations. 2.5 Mixture-of-Experts Architectures Mixture-of-Experts (MoE) uses multiple sub-models (experts) specializing in input space aspects, with a gating network routing inputs. MoE gained attention with sparse models like Switch Transformers and GLaM. In federated learning, FedMoE assigns clients to expert groups but focuses on tabular data without graph structures or reasoning. We introduce novel MoE for federated graph learning where experts correspond to jurisdiction-specific models, and gating learns which jurisdictions’ insights are relevant for specific threats—fundamentally different in data structure and semantic meaning. 2.6 Gap Identification No existing work combines federated learning, graph neural networks, and AGI reasoning for privacy-preserving cross-border threat detection. FedGraph-AGI fills this gap by uniquely integrating privacy-preserving federated protocols for graph data, MoE aggregation for jurisdiction heterogeneity, and AGI-powered reasoning via LAMs for causal inference. 3 Methodology We present FedGraph-AGI in detail: problem formulation (§3.1), federated graph learning (§3.2), MoE aggregation (§3.3), AGI reasoning (§3.4), privacy mechanisms (§3.5), and theoretical analysis (§3.6). 3.1 Problem Formulation Consider a cross-border government financial system with K jurisdictions. Each jurisdiction k∈1,…,Kk∈\1,…,K\ maintains a local financial transaction database forming a conceptual global financial network. 3.1.1 Graph Representation We model the system as a heterogeneous attributed graph =(,ℰ,X,Y)G=(V,E,X,Y) where: • =v1,…,vNV=\v_1,…,v_N\: nodes representing entities (users, accounts, institutions) • ℰ⊆×E ×V: directed edges representing financial transactions • X∈ℝN×dX ^N× d: node feature matrix where xi∈ℝdx_i ^d contains node viv_i attributes • Y∈0,1NY∈\0,1\^N: node label vector where yi=1y_i=1 indicates insider threat Each edge eij=(vi,vj)∈ℰe_ij=(v_i,v_j) has features zij∈ℝdez_ij ^d_e (transaction amount, timestamp, type). 3.1.2 Federated Partition Global graph G is partitioned across K jurisdictions: =⋃k=1KkG= _k=1^KG_k, where k=(k,ℰk,Xk,Yk)G_k=(V_k,E_k,X_k,Y_k) is jurisdiction k’s local subgraph. These may overlap—a transaction between users in different countries creates edges belonging to both jurisdictions. Let ℰcross=(vi,vj)∈ℰ:vi∈k,vj∈k′,k≠k′E_cross=\(v_i,v_j) :v_i _k,v_j _k ,k≠ k \ denote cross-border edges. Neither jurisdiction has complete access to both endpoints. 3.1.3 Objective Learn global model fθ:→[0,1]f_θ:V→[0,1] predicting insider threat probability: y^i=fθ(vi,) y_i=f_θ(v_i,G) (1) subject to constraints: (1) Privacy: No jurisdiction shares raw data (k,ℰk,Xk,Yk)(V_k,E_k,X_k,Y_k); (2) Differential Privacy: Model updates satisfy (ϵ,δ)(ε,δ)-differential privacy; (3) Performance: Federated model fθf_θ approximates centralized model f∗f^*. Minimize global loss: ℒglobal(θ)=1N∑i=1Nℓ(fθ(vi,),yi)L_global(θ)= 1N _i=1^N (f_θ(v_i,G),y_i) (2) where ℓ is binary cross-entropy, accessing only local losses ℒk(θ)=1Nk∑vi∈kℓ(fθ(vi,k),yi)L_k(θ)= 1N_k _v_i _k (f_θ(v_i,G_k),y_i). 3.2 Federated Graph Learning Architecture Our architecture consists of three hierarchical components: local graph neural networks, global aggregation server, and AGI reasoning layer (Figure 1). FedGraph-AGI Architecture [Country A Data] [Country B Data] [Country C Data] [Country D Data] [Country E Data] ↓ ↓ ↓ ↓ ↓ [Local GNN 1] [Local GNN 2] [Local GNN 3] [Local GNN 4] [Local GNN 5] ↓ Mixture-of-Experts Federated Aggregator ↓ AGI Reasoning Layer (LAM + Graph Attention + Causal Inference) ↓ ↓ ↓ [Threat Detection] [Anomaly Scoring] [Pattern Analysis] Privacy-Preserving via Differential Privacy & Secure Aggregation Figure 1: FedGraph-AGI System Architecture. Local GNN clients process jurisdiction-specific graph data, Mixture-of-Experts layer aggregates updates handling heterogeneity, and AGI reasoning module performs causal inference and threat analysis. 3.2.1 Local Graph Neural Network Each jurisdiction k maintains a local Graph Attention Network (GAT) operating on kG_k. We choose GAT for learning adaptive importance weights for different neighbors, crucial in financial networks. Local model fθkf_ _k consists of L graph attention layers. For layer ℓ , node representation i(ℓ)h_i^( ): i(ℓ)=σ(∑j∈(i)αij(ℓ)(ℓ)j(ℓ−1))h_i^( )=σ\! ( _j (i) _ij^( )W^( )h_j^( -1) ) (3) where (i)N(i) is node i’s neighborhood in kG_k, (ℓ)W^( ) is a learnable weight matrix, σ is LeakyReLU, and αij(ℓ) _ij^( ) is the attention coefficient: αij(ℓ)=exp(LeakyReLU(T[(ℓ)i(ℓ−1)‖(ℓ)j(ℓ−1)‖zij]))∑k∈(i)exp(LeakyReLU(T[(ℓ)i(ℓ−1)‖(ℓ)k(ℓ−1)‖zik])) _ij^( )= \! (LeakyReLU\! (a^T [W^( )h_i^( -1)\|W^( )h_j^( -1)\|z_ij ] ) ) _k (i) \! (LeakyReLU\! (a^T [W^( )h_i^( -1)\|W^( )h_k^( -1)\|z_ik ] ) ) (4) where ∥\| denotes concatenation, a is a learnable attention vector, and zijz_ij are edge features. 3.2.2 Handling Cross-Border Edges For cross-border edges eij∈ℰcrosse_ij _cross where vi∈kv_i _k but vj∈k′v_j _k (k≠k′k≠ k ), we employ privacy-preserving message passing: Algorithm 1 Privacy-Preserving Cross-Border Message Passing 1:Node vi∈kv_i _k with cross-border neighbor vj∈k′v_j _k 2:Aggregated message mjim_ji 3:// Jurisdiction k′k computes encrypted message 4:mjiraw=(ℓ)j(ℓ−1)m_ji^raw=W^( )h_j^( -1) 5:mjienc=Encrypt(mjiraw,pk)m_ji^enc=Encrypt(m_ji^raw,pk_k) 6:Send mjiencm_ji^enc to jurisdiction k via secure channel 7:// Jurisdiction k decrypts and uses message 8:mji=Decrypt(mjienc,sk)m_ji=Decrypt(m_ji^enc,sk_k) 9:Incorporate mjim_ji into attention aggregation for viv_i 10:return mjim_ji This ensures jurisdiction k never learns raw features or labels of cross-border node vjv_j, only receiving an encrypted aggregated representation. 3.2.3 Local Training Each jurisdiction k trains local model fθkf_ _k minimizing: ℒk(θk)=1Nk∑vi∈kℓ(fθk(vi,k),yi)+λ‖θk−θglobal‖2L_k( _k)= 1N_k _v_i _k (f_ _k(v_i,G_k),y_i)+λ\| _k- _global\|^2 (5) The second term is proximal regularization preventing local models from drifting, important given non-IID cross-border data. Local training proceeds for E epochs: θk(t+1)=θk(t)−η∇θkℒk(θk(t)) _k^(t+1)= _k^(t)-η _ _kL_k( _k^(t)) (6) 3.3 Mixture-of-Experts Federated Aggregation Standard federated averaging aggregates via: θglobal(t+1)=∑k=1KNkNθk(t+1) _global^(t+1)= _k=1^K N_kN _k^(t+1) (7) This is suboptimal when jurisdictions have heterogeneous distributions—it gives equal weight regardless of relevance to specific threats. We introduce MoE aggregation learning to selectively combine jurisdiction-specific models based on input characteristics, treating each jurisdiction as an “expert.” 3.3.1 Gating Network Gating network gϕ:ℝd→ℝKg_φ:R^d ^K takes node feature xix_i and outputs probability distribution over experts: wi=softmax(gϕ(xi))=softmax(gxi+bg)w_i=softmax(g_φ(x_i))=softmax(W_gx_i+b_g) (8) where wi∈ℝKw_i ^K and ∑k=1Kwik=1 _k=1^Kw_ik=1. 3.3.2 Expert Aggregation For node viv_i, predictions from experts combine according to gating weights: y^i=∑k=1Kwik⋅fθk(vi,k) y_i= _k=1^Kw_ik· f_ _k(v_i,G_k) (9) During global aggregation, we weight each jurisdiction’s update by average gating weight: θglobal(t+1)=∑k=1Kw¯k(t)θk(t+1) _global^(t+1)= _k=1^K w_k^(t) _k^(t+1) (10) where w¯k(t)=1Nbatch∑vi∈Batchwik(t) w_k^(t)= 1N_batch _v_i w_ik^(t). 3.3.3 Joint Training Gating network parameters ϕφ train jointly with global model minimizing: ℒMoE(θ,ϕ)=∑i=1Nℓ(∑k=1Kwikfθk(vi),yi)+γH(wi)L_MoE(θ,φ)= _i=1^N \! ( _k=1^Kw_ikf_ _k(v_i),y_i )+γ H(w_i) (11) where H(wi)=−∑k=1KwiklogwikH(w_i)=- _k=1^Kw_ik w_ik is entropy regularization encouraging diverse expert usage. This MoE approach offers: (1) adaptive weighting learning which jurisdictions are informative for different threats; (2) heterogeneity handling explicitly modeling distribution differences; and (3) interpretability revealing which jurisdictions contributed to flagging threats. 3.4 AGI Reasoning Module Based on Large Action Models While GNNs excel at pattern recognition, they lack reasoning for complex multi-step insider attacks. We introduce AGI reasoning based on LAMs performing causal inference, counterfactual analysis, and multi-hop logical deduction. 3.4.1 LAM Architecture for Graph Reasoning Our LAM builds on a transformer architecture pre-trained on large-scale graph data and financial logs. Input: (1) Graph Context: local subgraph localG_local around suspicious node viv_i, encoded as node-edge-node triples; (2) Temporal History: transaction sequences involving viv_i over past T time steps; (3) Candidate Hypothesis: natural language threat pattern description. Output: (1) Threat Probability: P(threat|local,history,hypothesis)P(threat|G_local,history,hypothesis); (2) Causal Explanation: structured explanation identifying causal factors; (3) Counterfactual Analysis: what-if scenarios. 3.4.2 Causal Inference via Attention Mechanisms LAM employs causal attention masks learning temporal dependencies. For event sequence e1,…,eTe_1,…,e_T, causal attention score between eie_i and eje_j (i<ji<j): CausalAttn(ei,ej)=exp(qjTki/dk)∑k≤jexp(qjTk/dk)CausalAttn(e_i,e_j)= (q_j^Tk_i/ d_k) _k≤ j (q_j^Tk_k/ d_k) (12) where qj,kiq_j,k_i are query and key vectors. High scores indicate strong causal relationships. 3.4.3 Multi-Step Reasoning via Chain-of-Thought For complex threats requiring multi-hop reasoning, LAM employs chain-of-thought prompting. Given suspicious transaction tit_i, LAM generates intermediate reasoning steps: (1) identify preconditions; (2) trace privilege acquisition path in graph; (3) verify timing consistency with known attack patterns; (4) construct causal graph of events leading to tit_i; (5) output final threat assessment with confidence. Implemented via autoregressive generation where each step sts_t conditions on previous steps: P(st|local,s1,…,st−1)=LAM(local,s1,…,st−1)P(s_t|G_local,s_1,…,s_t-1)=LAM(G_local,s_1,…,s_t-1) (13) 3.4.4 Integration with GNN Predictions LAM operates as a second-stage refinement over GNN predictions. For nodes flagged as high-risk (probability >0.7>0.7), LAM performs deeper analysis: Algorithm 2 AGI-Enhanced Threat Assessment 1:Node viv_i with GNN risk score pGNN(vi)p_GNN(v_i) 2:Final threat probability pfinal(vi)p_final(v_i) and explanation EiE_i 3:if pGNN(vi)>0.7p_GNN(v_i)>0.7 then 4: Extract local subgraph localG_local around viv_i (2-hop) 5: Retrieve transaction history HiH_i for node viv_i 6: Generate threat hypotheses =h1,…,hMT=\h_1,…,h_M\ 7: for each hypothesis h∈h do 8: ph=LAM(local,Hi,h)p_h=LAM(G_local,H_i,h) 9: end for 10: pLAM(vi)=maxh∈php_LAM(v_i)= _h p_h 11: Generate explanation EiE_i for most probable hypothesis 12: pfinal(vi)=0.6⋅pGNN(vi)+0.4⋅pLAM(vi)p_final(v_i)=0.6· p_GNN(v_i)+0.4· p_LAM(v_i) 13:else 14: pfinal(vi)=pGNN(vi)p_final(v_i)=p_GNN(v_i), Ei=NoneE_i=None 15:end if 16:return pfinal(vi)p_final(v_i), EiE_i This hybrid approach leverages GNN pattern recognition and LAM reasoning capabilities, achieving superior performance. 3.5 Privacy-Preserving Mechanisms Privacy protection is paramount. We employ a multi-layered approach combining differential privacy, secure aggregation, and homomorphic encryption. 3.5.1 Differential Privacy for Model Updates We apply differential privacy to local model updates before sharing with the global server. For jurisdiction k, model update Δθk=θk(t+1)−θk(t) _k= _k^(t+1)- _k^(t) is privatized via the Gaussian mechanism: Δθ~k=Δθk+(0,σ2S2I) θ_k= _k+N(0,σ^2S^2I) (14) where S=maxDk,Dk′‖Δθ(Dk)−Δθ(Dk′)‖2S= _D_k,D_k \| θ(D_k)- θ(D_k )\|_2 is sensitivity, and σ is calibrated for (ϵ,δ)(ε,δ)-differential privacy: σ=Sϵ2log(1.25/δ)σ= Sε 2 (1.25/δ) (15) 3.5.2 Privacy Budget Accounting Over T federated rounds, privacy budget accumulates. We employ moments accountant for tight bounds: ϵtotal=ϵ⋅T⋅q+q⋅T⋅ϵδ _total=ε· T· q+ q· T·εδ (16) where q is the sampling ratio. For experiments, we set ϵ=1.0ε=1.0 and δ=10−5δ=10^-5 per round, resulting in ϵtotal≈10.5 _total≈ 10.5 after 100 rounds—within acceptable bounds for government applications per NIST guidelines. 3.5.3 Secure Aggregation To prevent the global server from learning individual jurisdiction updates, we employ secure multi-party computation via secret sharing. Each jurisdiction k shares update Δθ~k θ_k as additive shares: Δθ~k=sk,1+sk,2+⋯+sk,K θ_k=s_k,1+s_k,2+·s+s_k,K (17) where share sk,js_k,j is sent to jurisdiction j. The global server only sees: ∑k=1KΔθ~k=∑k=1K∑j=1Ksk,j _k=1^K θ_k= _k=1^K _j=1^Ks_k,j (18) computable without any jurisdiction revealing individual updates. 3.5.4 Homomorphic Encryption for Cross-Border Messages As in Algorithm 1, cross-border message passing uses additively homomorphic encryption (Paillier cryptosystem), enabling: Enc(m1)⊕Enc(m2)=Enc(m1+m2)Enc(m_1) (m_2)=Enc(m_1+m_2) (19) allowing encrypted message aggregation without decryption. This combination ensures: (1) transaction data never leaves the jurisdiction; (2) model updates are differentially private; (3) the aggregation server cannot infer individual updates; and (4) cross-border graph structure is protected via encryption. 3.6 Theoretical Analysis We provide theoretical guarantees for FedGraph-AGI. Theorem 1 (Convergence of FedGraph-AGI). Under assumptions: (1) local losses ℒkL_k are L-smooth and μ-strongly convex; (2) gradient variance bounded: [‖∇ℒk(θ)‖2]≤G2E[\| _k(θ)\|^2]≤ G^2; (3) local models do not drift too far: [‖θk−θglobal‖2]≤Δ2E[\| _k- _global\|^2]≤ ^2; FedGraph-AGI with learning rate η=O(1/(LT))η=O(1/(L T)) achieves: [ℒglobal(θ(T))]−ℒglobal(θ∗)≤O(G2+Δ2μT)E[L_global(θ^(T))]-L_global(θ^*)≤ O\! ( G^2+ ^2μ T ) (20) where θ∗θ^* is the optimal global model. Proof Sketch. Follows standard federated learning convergence analysis extended to graph data. Key steps: (1) Bound per-round progress: ℒglobal(θ(t+1))≤ℒglobal(θ(t))−η‖∇ℒglobal(θ(t))‖2+Lη22(variance terms)L_global(θ^(t+1)) _global(θ^(t))-η\| _global(θ^(t))\|^2+ Lη^22(variance terms); (2) Variance terms include gradient noise G2G^2 and model drift Δ2 ^2; (3) Proximal regularization bounds Δ2 ^2; (4) Summing over T rounds and optimizing the learning rate yields the stated bound. ∎ Theorem 2 (Differential Privacy of FedGraph-AGI). For each jurisdiction k with local dataset DkD_k, FedGraph-AGI ensures (ϵtotal,δtotal)( _total, _total)-differential privacy after T rounds, where: ϵtotal=ϵ⋅2Tlog(1/δ),δtotal=T⋅δ _total=ε· 2T (1/δ), _total=T·δ (21) Proof Sketch. Follows composition theorems for differential privacy: (1) Each round’s Gaussian mechanism provides (ϵ,δ)(ε,δ)-DP; (2) Advanced composition bounds accumulation over T rounds; (3) Secure aggregation adds no additional privacy leakage (information-theoretic security). ∎ Proposition 1 (Computational Complexity). Computational complexity of FedGraph-AGI per communication round: 1. Local GNN training: O(E⋅L⋅d2⋅|ℰk|)O(E· L· d^2·|E_k|) per jurisdiction 2. MoE aggregation: O(K⋅d⋅Nbatch)O(K· d· N_batch) at server 3. AGI reasoning: O(M⋅TLAM)O(M· T_LAM) where M is high-risk nodes Overall per-round complexity is dominated by local GNN training, parallelizable across jurisdictions. AGI reasoning is applied only to a small fraction of nodes (GNN-flagged), making it computationally tractable. 4 Experiments and Results We present comprehensive experimental evaluation including dataset description, implementation details, baseline comparisons, ablation studies, privacy-utility tradeoff, and scalability analysis. 4.1 Datasets and Experimental Setup 4.1.1 Cross-Border Financial Transaction Dataset We construct a novel synthetic dataset simulating cross-border transactions across 10 jurisdictions (USA, UK, China, India, Germany, France, Japan, Canada, Australia, Brazil). The dataset comprises: • Transactions: 50,000 over a 2-year period • Users: 10,000 unique accounts distributed across jurisdictions • Graph Structure: 1,000 nodes (accounts, institutions) with 2,991 edges • Features: 15-dimensional node features, 8-dimensional edge features • Labels: 5% labeled as anomalous (insider threats) Insider threat patterns are modeled on real-world attacks: privilege escalation, collusion networks, money laundering chains, off-hours activity. Dataset statistics in Table 1. Table 1: Cross-Border Financial Transaction Dataset Statistics Metric Value Notes Total Transactions 50,000 Spanning 2 years Unique Users 10,000 Across 10 jurisdictions Graph Nodes 1,000 Accounts & institutions Graph Edges 2,991 Financial relationships Node Feature Dim 15 Behavioral attributes Edge Feature Dim 8 Transaction metadata Anomaly Rate 4.93% Insider threats Cross-Border Edges 32% Multi-jurisdiction The synthetic dataset is publicly available at https://doi.org/10.6084/m9.figshare.31350937. 4.1.2 Implementation Details • Framework: PyTorch 2.0 with PyTorch Geometric • Hardware: NVIDIA A100 GPUs (40GB memory) • GNN Architecture: 3-layer GAT, hidden dimension 256, 8 attention heads, dropout 0.1 • MoE Configuration: 5 experts (one per region), gating network: 2-layer MLP with 128 hidden units • LAM Configuration: GPT-3.5-based architecture fine-tuned on 100K graph reasoning examples • Federated Learning: 100 communication rounds, 5 local epochs per round, batch size 64 • Optimizer: Adam with learning rate 0.001, weight decay 5e-4 • Privacy Parameters: ϵ=1.0ε=1.0, δ=10−5δ=10^-5, noise scale σ=0.8σ=0.8 4.2 Baseline Methods We compare FedGraph-AGI against state-of-the-art approaches. Centralized Methods (Upper Bound): Centralized GNN (standard GAT on full graph, no privacy constraints) and Centralized GNN + Rules (GAT with rule-based fraud detection). Federated Learning Baselines: FedAvg (standard averaging on tabular features), FedProx (FedAvg with proximal regularization), and FedGNN (federated graph neural network with standard averaging). Graph-Based Fraud Detection: GraphSAGE (inductive graph learning, centralized) and FraudNE (GNN specialized for fraud, centralized). All methods use the same train/validation/test split (60%/20%/20%) with grid search hyperparameter tuning. 4.3 Main Results Table 2 presents a comprehensive performance comparison. Table 2: Performance Comparison on Cross-Border Insider Threat Detection Method Accuracy Precision Recall F1 AUC Privacy Centralized Baselines (No Privacy) Centralized GNN 0.847 0.801 0.764 0.782 0.889 × GraphSAGE 0.833 0.785 0.752 0.768 0.871 × FraudNE 0.856 0.812 0.779 0.795 0.901 × Federated Methods (Privacy-Preserving) FedAvg 0.823 0.775 0.738 0.756 0.854 ✓ FedProx 0.836 0.788 0.755 0.771 0.867 ✓ FedGNN 0.861 0.815 0.790 0.802 0.893 ✓ FedGraph-AGI 0.923 0.904 0.879 0.891 0.956 ✓ Key findings: (1) FedGraph-AGI achieves 92.3% accuracy, outperforming the best federated baseline (FedGNN, 86.1%) by 6.2% and the best centralized baseline (FraudNE, 85.6%) by 6.7%. (2) Federated methods generally underperform centralized ones, but FedGraph-AGI reverses this trend. (3) Graph structure is crucial: FedAvg (no graph awareness) achieves 82.3%, while FedGNN reaches 86.1%—a 3.8% improvement. (4) AUC-ROC of 0.956 indicates excellent discrimination across all thresholds. 4.4 Ablation Studies Table 3 presents systematic ablation results. Table 3: Ablation Study: Component Contributions Model Variant F1-Score Accuracy F1 Acc Full Model (FedGraph-AGI) 0.891 0.923 – – w/o AGI Reasoning 0.823 0.861 −6.8%-6.8\% −6.2%-6.2\% w/o Mixture-of-Experts 0.847 0.889 −4.4%-4.4\% −3.4%-3.4\% w/o Graph Attention 0.856 0.893 −3.5%-3.5\% −3.0%-3.0\% w/o Privacy Mechanisms 0.889 0.921 −0.2%-0.2\% −0.2%-0.2\% Only GNN (no Fed) 0.782 0.847 −10.9%-10.9\% −7.6%-7.6\% Key findings: (1) AGI Reasoning is the most critical component, with its removal causing a 6.8% F1 drop. (2) MoE aggregation provides a 4.4% improvement over standard averaging. (3) Graph attention contributes 3.5%. (4) Privacy mechanisms have minimal cost: only 0.2% degradation, demonstrating differential privacy doesn’t significantly hurt utility. 4.5 Training Convergence Analysis FedGraph-AGI reaches 90% accuracy by round 60, while FedGNN requires 85+ rounds to plateau at 86%. Our method exhibits less oscillation due to MoE-based aggregation weighting updates intelligently. The final accuracy is 6.2% higher than FedGNN, demonstrating superior optimization. 4.6 Privacy-Utility Tradeoff Analysis There are diminishing returns beyond ϵ=1.0ε=1.0: accuracy increases steeply from ϵ=0.1ε=0.1 (82.3%) to ϵ=1.0ε=1.0 (89.1%), but gains plateau beyond that (92.3% at ϵ=10.0ε=10.0). The recommended setting ϵ=1.0ε=1.0 balances strong privacy (acceptable for government per NIST) with near-optimal performance. Even at stringent ϵ=0.5ε=0.5, accuracy remains 86.7%, outperforming non-private FedGNN (86.1%). 4.7 Scalability Analysis Communication cost scales from 25 MB/round (5 clients) to 195 MB/round (50 clients)—manageable for government networks. Training time increases from 62 seconds/round (5 clients) to 178 seconds/round (50 clients), demonstrating sub-linear scaling via parallel local training. With 5–10 clients (typical for cross-border collaborations), training time is under 2 minutes per round, enabling daily updates. 4.8 Confusion Matrix and Error Analysis FedGraph-AGI achieves a high true positive rate (87.9%) with a low false positive rate (5.9%). False negatives (12.1%) primarily reflect novel attack patterns not well-represented in training; few-shot learning could address this. False positives (5.9%) mainly stem from legitimate but unusual transactions (e.g., one-time large property purchases); domain adaptation to jurisdiction-specific norms could reduce this. 4.9 Feature Importance and Interpretability The AGI reasoning module reveals the top predictive features: (1) Graph Centrality (18.5%): nodes with high betweenness centrality are more likely involved in fraud; (2) Transaction Frequency (16.2%): sudden activity spikes indicate suspicious behavior; (3) Cross-Border Patterns (14.8%): unusual international transaction patterns correlate with threats. This interpretability is critical for government investigators needing to validate system predictions. 5 Discussion 5.1 Interpretation of Results Our experimental results demonstrate FedGraph-AGI achieves state-of-the-art performance on cross-border insider threat detection while preserving data privacy. Several factors contribute to this success. AGI Reasoning Enables Novel Threat Detection: The 6.8% performance gain from AGI reasoning validates our core hypothesis that human-like reasoning capabilities are essential for detecting sophisticated, multi-step attack strategies. Our LAM-based module constructs mental models of attacker intent and reasons about counterfactual scenarios, enabling detection of zero-day fraud schemes. MoE Handles Jurisdiction Heterogeneity: The 4.4% contribution demonstrates the importance of intelligent model combination in cross-border settings. Naive averaging dilutes jurisdiction-specific insights, while our learned gating network selectively combines relevant expertise. Federated Learning + AGI >> Centralized GNN: Our federated approach outperforms centralized baselines with unrestricted data access, suggesting AGI reasoning and sophisticated aggregation more than compensate for distributed data challenges. Privacy Comes at Minimal Cost: With ϵ=1.0ε=1.0 differential privacy, FedGraph-AGI achieves 89.1% accuracy vs. 92.3% without privacy—only a 0.2% degradation. 5.2 Limitations and Challenges Synthetic Data Evaluation: Experiments use synthetic transaction data. Validation on real-world data (subject to privacy clearances) is essential future work. Computational Cost of AGI Reasoning: LAM-based reasoning requires several seconds per inference for complex analysis. While mitigated by applying it only to GNN-flagged high-risk nodes (∼ 5%), scaling to real-time analysis of millions of daily transactions remains challenging. Assumption of Honest Participants: Our federated protocol assumes all jurisdictions are honest-but-curious. Defending against Byzantine attacks requires additional mechanisms like robust aggregation. Cold Start Problem: New jurisdictions joining the federation lack historical data for effective local models. Transfer learning and meta-learning approaches could address this. Interpretability-Performance Tradeoff: While our AGI module provides human-interpretable explanations, these sometimes sacrifice precision. Balancing explanation quality with decision accuracy is an ongoing challenge. 5.3 Broader Implications Federated Graph Learning Paradigm: We demonstrate federated learning can effectively extend to graph-structured data with heterogeneous partitions, opening possibilities in social network analysis, citation networks, and supply chain analytics. AGI for Domain-Specific Reasoning: Our work shows LAMs can be adapted for specialized reasoning tasks beyond general-purpose dialogue, suggesting a pathway for deploying AGI capabilities in high-stakes domains like healthcare, cybersecurity, and scientific discovery. Privacy-Preserving Government Intelligence Sharing: FedGraph-AGI provides a technical framework for privacy-preserving collaboration, potentially accelerating federated approaches in government and defense. 5.4 Ethical Considerations Fairness and Bias: If training data contains biases, the model may perpetuate discrimination. We recommend regular fairness audits and adversarial debiasing techniques. Due Process: Automated threat detection should augment, not replace, human judgment. Flagged individuals deserve investigation and due process before punitive action. Transparency: Governments deploying such systems should disclose their use to citizens while protecting operational details. Privacy Beyond Technical Guarantees: Differential privacy provides mathematical guarantees, but building public trust requires clear communication, independent audits, and legal frameworks governing system use. 6 Conclusion We have introduced FedGraph-AGI, the first framework integrating Artificial General Intelligence reasoning with federated graph neural networks for cross-border insider threat detection in government financial schemes. By combining privacy-preserving federated learning, graph-aware neural architectures, Mixture-of-Experts aggregation, and LAM-based causal reasoning, our approach achieves 92.3% accuracy on a novel cross-border financial dataset—outperforming state-of-the-art baselines by 6.2–9.6% while maintaining strong privacy guarantees. Our key contributions include: a novel federated graph learning architecture handling heterogeneous cross-border data partitions; a Mixture-of-Experts aggregation mechanism tailored to jurisdiction-specific threat patterns; an AGI reasoning module based on LAMs performing causal inference and multi-step threat analysis; comprehensive privacy-preserving mechanisms achieving (ϵ=1.0,δ=10−5)(ε=1.0,δ=10^-5)-differential privacy with minimal utility loss; and extensive experimental validation demonstrating state-of-the-art performance, fast convergence, scalability, and interpretability. This work opens several avenues for future research: real-world validation in actual government financial systems; multi-modal reasoning extending the AGI module to incorporate additional data modalities; continual learning adapting the model to evolving threat landscapes; federated transfer learning enabling new jurisdictions to rapidly bootstrap effective models; and robustness to adversarial attacks. In conclusion, FedGraph-AGI demonstrates that privacy-preserving, cross-border AI collaboration is not only feasible but can achieve superior performance compared to centralized approaches. As global threats increasingly transcend borders, such frameworks will be essential for enabling international cooperation while respecting data sovereignty and individual privacy. Author Contributions. S.N. conceived the project, designed the FedGraph-AGI architecture, implemented the system, conducted experiments, contributed to theoretical analysis, and wrote the manuscript. J.W. edited the manuscript. All authors reviewed and approved the final manuscript. Data Availability Statement. The synthetic cross-border financial transaction dataset and all experimental code are publicly available at https://doi.org/10.6084/m9.figshare.31350937. Due to privacy and security concerns, real government financial data cannot be shared, but our synthetic dataset is designed to realistically mimic real-world patterns based on published fraud detection literature. Acknowledgments. We thank the anonymous reviewers for constructive feedback, and colleagues at Incedo Inc., IIT Madras, and University of Kent for valuable discussions. Conflicts of Interest. The authors declare no competing financial or non-financial interests. References [1] World Bank. Combating Corruption and Financial Fraud in Government Programs. Technical report, World Bank Group Publications, 2023. [2] Association of Certified Fraud Examiners. Report to the Nations: 2024 Global Study on Occupational Fraud and Abuse. Technical report, ACFE Press, 2024. [3] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas. Communication-efficient learning of deep networks from decentralized data. In Proceedings of the Artificial Intelligence and Statistics, pages 1273–1282. PMLR, 2017. [4] T. N. Kipf and M. Welling. Semi-supervised classification with graph convolutional networks. In Proceedings of the International Conference on Learning Representations (ICLR), 2017. [5] P. Veličković, G. Cucurull, A. Casanova, A. Romero, P. Lio, and Y. Bengio. Graph attention networks. In Proceedings of the International Conference on Learning Representations (ICLR), 2018. [6] B. Goertzel and C. Pennachin. Artificial General Intelligence. Springer Science & Business Media, 2014. [7] R. Bommasani et al. On the opportunities and risks of foundation models. arXiv:2108.07258, 2021. [8] Z. Yang, L. Gao, H. Liu, Y. Zhang, and H. Wang. Large action models: From inception to implementation. arXiv:2401.12345, 2024. [9] T. Li, A. K. Sahu, M. Zaheer, M. Sanjabi, A. Talwalkar, and V. Smith. Federated optimization in heterogeneous networks. In Proceedings of Machine Learning and Systems (MLSys), volume 2, pages 429–450, 2020. [10] W. Hamilton, Z. Ying, and J. Leskovec. Inductive representation learning on large graphs. In Advances in Neural Information Processing Systems (NeurIPS), volume 30, 2017. [11] K. Zhang et al. Subgraph federated learning with missing neighbor generation. In Advances in Neural Information Processing Systems (NeurIPS), volume 34, pages 6671–6682, 2021. [12] C. Wu et al. FedGraph: Federated graph learning with intelligent sampling. IEEE Transactions on Parallel and Distributed Systems, 33:1775–1786, 2022. [13] S. Reddi et al. Adaptive federated optimization. In International Conference on Learning Representations (ICLR), 2021. [14] S. P. Karimireddy et al. SCAFFOLD: Stochastic controlled averaging for federated learning. In International Conference on Machine Learning (ICML), pages 5132–5143. PMLR, 2020. [15] V. P. Dwivedi and X. Bresson. A generalization of transformer networks to graphs. In AAAI Conference on Artificial Intelligence, volume 35, pages 7157–7165, 2021. [16] X. Peng et al. Federated graph convolutional networks with knowledge distillation. IEEE Transactions on Knowledge and Data Engineering, 35:3421–3433, 2023. [17] L. Liu et al. Detecting and preventing cyber insider threats: A survey. IEEE Communications Surveys & Tutorials, 20:1397–1417, 2018. [18] F. Yuan et al. Insider threat detection with deep neural network. In International Conference on Computational Science (ICCS), pages 43–56. Springer, 2021. [19] R. J. Bolton and D. J. Hand. Statistical fraud detection: A review. Statistical Science, 17:235–255, 2002. [20] U. Fiore et al. Using generative adversarial networks for improving classification effectiveness in credit card fraud detection. Information Sciences, 479:448–455, 2019. [21] L. Zheng et al. Improved TrAdaBoost and its application to transaction fraud detection. IEEE Transactions on Computational Social Systems, 5:1304–1316, 2018. [22] M. Weber et al. Scalable graph learning for anti-money laundering: A first look. In NeurIPS Workshop on Challenges and Opportunities for AI in Financial Services, 2018. [23] S. Rayana and L. Akoglu. Collective opinion spam detection: Bridging review networks and metadata. In ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), pages 985–994, 2015. [24] Y. Liu et al. Pick and choose: A GNN-based imbalanced learning approach for fraud detection. In ACM Web Conference (W), pages 3168–3177, 2021. [25] D. Wang et al. Alleviating structural distribution shift in graph anomaly detection. In ACM International Conference on Web Search and Data Mining (WSDM), pages 875–883, 2021. [26] OpenAI. GPT-4 technical report. arXiv:2303.08774, 2023. [27] A. Brohan et al. RT-1: Robotics transformer for real-world control at scale. In Robotics: Science and Systems (RSS), 2023. [28] S. Pan, L. Luo, Y. Wang, C. Chen, J. Wang, and X. Wu. Unifying large language models and knowledge graphs: A roadmap. arXiv:2306.08302, 2023. [29] R. A. Jacobs, M. I. Jordan, S. J. Nowlan, and G. E. Hinton. Adaptive mixtures of local experts. Neural Computation, 3:79–87, 1991. [30] W. Fedus, B. Zoph, and N. Shazeer. Switch transformers: Scaling to trillion parameter models with simple and efficient sparsity. Journal of Machine Learning Research, 23:1–39, 2022. [31] N. Du et al. GLaM: Efficient scaling of language models with mixture-of-experts. In International Conference on Machine Learning (ICML), pages 5547–5569. PMLR, 2022. [32] H. Zhang, M. Cissé, Y. N. Dauphin, and D. Lopez-Paz. Mixtures of experts for federated learning. In NeurIPS Workshop on Federated Learning, 2022. [33] M. Abadi et al. Deep learning with differential privacy. In ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 308–318, 2016. [34] C. Dwork and A. Roth. The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science, 9:211–407, 2014. [35] P. Kairouz, S. Oh, and P. Viswanath. The composition theorem for differential privacy. In International Conference on Machine Learning (ICML), pages 1376–1385. PMLR, 2015. [36] D. Yin, Y. Chen, R. Kannan, and P. Bartlett. Byzantine-robust distributed learning: Towards optimal statistical rates. In International Conference on Machine Learning (ICML), pages 5650–5659. PMLR, 2018.