Cyber-Financial Contagion: Modeling the Propagation of an AI Vendor Compromise Through the Banking System

What it is

A single-author arXiv paper (Alex Leytes, NICE Actimize) proposing two models for treating a compromised shared AI vendor as a source of banking-system contagion. The summary names both models and their headline numbers; what it cannot carry is that every result is on synthetic data with tuned parameters — there is no real vendor, no empirical incident set, and the AUROC 0.82 / AUPRC 0.60 are measured against labels the authors generated in an independent simulation window, not observed outcomes.

How it works

CFC-Prop couples two known dynamics on a four-layer graph (vendors → banks → interbank exposures → customers):

• Vendor layer: an SIR epidemic. Infected vendors infect co-vendors sharing a bank with probability α; they "recover" with probability γ per step — γ is the patch-deployment rate, which is why patch latency drives the loss tail.
• Bank layer: each infected vendor raises downstream-bank impairment by U(0.10, 0.35) with probability β · s_vb · (0.5 + d_b), scaling with service-exposure and the bank's AI-dependency score.
• Interbank layer: a Furfine-style clearing cascade with fire-sale amplification φ; bank j defaults when inbound shock exceeds (1−φ)·κ_j·A_j.

An optional deposit-run channel (off by default, p_r=0) adds liquidity shocks for banks with impairment ≥ 0.4.

CFC-GNN is not a deep GNN — it is a gradient-boosting + MLP ensemble (0.55·GBM + 0.45·MLP) with a hand-tuned graph-degree bump (+0.02·deg_v), scoring which vendor node would trigger the largest cascade.

Why the author frames it as a distinct problem

Three arguments the summary omits, and the reason a supervisor should care:

1. The shock is endogenous to an AI market whose concentration is set outside banking.
2. A model-integrity/backdoor attack can degrade credit or fraud decisions for weeks before any balance-sheet footprint appears — so detection lags loss.
3. The same vendor serves direct competitors, so "idiosyncratic" vendor risk is correlated by construction across the institutions being protected.

The paper's central claim: classical stress testing (exogenous, immediately observable, institution-idiosyncratic shocks) is a lower bound on this risk, not an upper bound.

Caveats

• Entirely synthetic. Cascade labels are tuned so top-decile-criticality vendors cascade in ~⅓ of runs; that assumption is the finding, not evidence for it.
• Neither the epidemic model nor the clearing-with-fire-sale model is novel; the contribution is coupling them plus the vendor-node early-warning framing.
• Written by an employee of NICE Actimize, itself an AI fraud/AML vendor of exactly the type modeled — relevant context for how the "act on this" framing is positioned.
• Treat this as a conceptual/tooling contribution and a released reproducible pipeline, not empirical validation that such contagion has occurred.