Graph Neural Network

SubgraphGNN with heterogeneous message passing for structural risk classification

Graph Neural Network

The GNN provides Layer 2 (structural) scoring by analyzing the relational context around each action. It operates on a heterogeneous graph with 13 node types and 20 edge types, using multi-task learning for risk classification, severity regression, and threat category detection.

Architecture: SubgraphGNN

Event → Subgraph Extraction (k=3 hop) → Node Feature Encoding
    → 2-layer HeteroConv (SAGEConv per edge type, sum aggregation)
    → Global Mean Pooling (over Action nodes)
    → Multi-Task Heads

Multi-Task Outputs

Head	Output	Loss
Risk level classification	5 classes (none/low/medium/high/critical)	Cross-entropy
Severity score regression	0-100 continuous	MSE
Threat category multi-label	10 binary labels	Binary cross-entropy
Binary threat detection	is_threat (0/1)	Binary cross-entropy

Threat Categories (10)

Category	Description
policy_violation	Customer policy breach
exfiltration	Data leaving security boundary
privilege_escalation	Increasing access beyond scope
scope_creep	Accessing new resource types
excessive_agency	Agent acting beyond instructions
multi_step_attack	Coordinated action chain
prompt_injection	Prompt manipulation attempt
tool_poisoning	MCP tool description manipulation
supply_chain	Dependency/server compromise
anomalous_access	Statistical behavioral anomaly

Node Types & Features

Core Nodes

Node Type	Feature Dim	Key Features
Action	52	action_type(20) + verb_risk(1) + tool_hash(8) + tool_risk(1) + param_features(20) + time(2)
Agent	24	agent_type(14) + model(4) + deployment_context(6)
Resource	22	sensitivity(1) + resource_type(13) + data_classification(5) + name_risk(3)
User	17	clearance(1) + department(10) + role(6)
Policy	10	severity(1) + rule_type(6) + scope_hash(3)
Session	4	message_count(1) + tool_call_count(1) + time_features(2)

Data Nodes

Node Type	Feature Dim	Key Features
DataField	3	is_pii(1) + is_sensitive(1) + field_risk(1)
ExternalEndpoint	6	is_whitelisted(1) + domain_hash(4) + suspicious(1)

MCP Nodes

Node Type	Feature Dim	Key Features
MCPServer	4	is_verified(1) + is_local(1) + transport(1) + version_changed(1)
MCPTool	2	has_description_changed(1) + is_duplicate_name(1)
MCPResource	2	sensitivity_level(1) + is_static(1)
MCPPrompt	1	single feature
OAuthToken	2	is_broad_scope(1) + scope_breadth(1)

Edge Types (20)

("Agent", "PERFORMED", "Action")          # Core behavioral
("Action", "ACCESSED", "Resource")
("Action", "TOUCHED_FIELD", "DataField")
("Action", "SENT_TO", "ExternalEndpoint")
("Session", "INITIATED_BY", "User")
("Agent", "BELONGS_TO", "Session")
("Resource", "GOVERNED_BY", "Policy")
("Policy", "PERMITS", "Action")           # Policy evaluation
("Policy", "BLOCKS", "Action")
("Action", "PRECEDED_BY", "Action")       # Temporal chains
("Action", "ESCALATED_FROM", "Action")
("Action", "SIMILAR_TO", "Action")
("Agent", "CONNECTED_TO", "MCPServer")    # MCP topology
("Action", "INVOKED", "MCPTool")
("Action", "READ_RESOURCE", "MCPResource")
("Action", "USED_PROMPT", "MCPPrompt")
("MCPServer", "EXPOSES", "MCPTool")
("MCPServer", "AUTHENTICATED_BY", "OAuthToken")
("MCPTool", "DESCRIPTION_CHANGED", "MCPTool")
("MCPTool", "CROSS_SERVER_CALL", "MCPTool")

Score Production

The GNN maps its probability distribution to a 0-100 score using risk class centers:

centers = {"none": 5, "low": 20, "medium": 45, "high": 72, "critical": 92}
gnn_score = sum(prob[class] * centers[class] for class in risk_classes)

GNN Predictor API

from quint_graph.gnn import GNNPredictor

predictor = GNNPredictor(
    model_path="path/to/model.pt",
    hidden_channels=64,
    num_layers=2,
    device="cpu"
)

# Full inference
result = predictor.predict(event, centrality=None)
# Returns: risk_class, probabilities, confidence, severity, is_threat

# Score only
score = predictor.predict_score(event, centrality=None)
# Returns: float 0-100

Training Data

The GNN trains on synthetic data generated without proprietary customer data:

Source	Examples	Percentage
Simulated (benign)	12,000-18,000	~40%
Simulated (threat)	8,000-12,000	~25%
Adversarial evasion	5,000-8,000	~18%
LLM-generated scenarios	3,000-5,000	~12%
Real-world (design partners)	500-2,000	~5%

Evaluation Targets

Metric	Target
Risk Score MAE	< 8 points
Risk Level Accuracy	> 92%
Threat Detection F1	> 95%
False Positive Rate	< 3%
Adversarial Detection Rate	> 75%

GPU is NOT required for inference. For our graph size (~1,500 ontology + dynamic events), CPU inference is 5-15ms.