DARPA-PS-25-10.pdf

Program Solicitation Information Innovation Office

Anticipatory and Adaptive Anti-Money Laundering

(A3ML)

DARPA-PS-25-10

March 14, 2025

1. OVERVIEW INFORMATION

Federal Agency Name: Defense Advanced Research Projects Agency (DARPA), Information Innovation Office (I2O) Funding Opportunity Title: Anticipatory and Adaptive Anti-Money Laundering (A3ML) Announcement Type: Program Solicitation, Initial Announcement Funding Opportunity Number: DARPA-PS-25-10 Dates – All times are Eastern Time Zone (ET):

o Proposers Day Occurred: 2/20/2025 o Posting Date: 03/14/2025 o Classified Addendum Request Due Date: 3/28/2025 o Classified Addendum Release Date: 4/11/2025 o Subcontractor Team Solicitation DD-254s Due Date: 4/18/2025 at 5:00 PM o Research Track Abstracts Due Date: 4/18/2025 at 5:00 PM o Questions Due Date: 4/16/2025 at 5:00 PM o Oral Presentations Due Date: By Government request, estimated one month after

Abstract submission: ~5/23/2025 o Competition Track Abstract Due Date: TBD – will be widely advertised at a later date

Anticipated individual award: Multiple awards are anticipated.

Types of instruments that may be awarded: Other Transaction (OT) for Prototype agreements.

Cost Sharing Requirements: In accordance with 10 U.S.C. § 4022, cost sharing may be required for OT for prototype awards.

Appendix A: Abstract Template Attachments to DARPA-PS-25-10:

o Attachment 1: Model OT (Fixed Support Nontraditional) o Attachment 2: Model OT (Fixed Support Traditional) o Attachment 3: Sample OT Certifications

The Government strongly encourages proposers to make red-lined edits (track-changes is sufficient) to the Model OT text that the proposer’s organization would like to negotiate if selected for award negotiations. Red-line edits should be accompanied by a comment box explaining context for the requested change.

Proposers should submit the edited Model OT with their abstract submission.

Questions & Answers (Q&A): DARPA intends to use electronic mail for all correspondence regarding this Program Solicitation. Administrative, technical, and award questions should be emailed to the agency contact stated immediately below. Proposers who desire to submit questions at a higher level of classification shall also email the agency contact to receive proper instructions on submission requirements. All questions must be written in English and must include the name, email address, and the telephone number of a point of contact.

DARPA will attempt to answer questions in a timely manner; however, questions submitted after the aforementioned questions due date above may not be answered. Distribution of Q&A material will be provided to authorized personnel at the appropriate classification level.

Agency Contact: The Solicitation Coordinator for this effort can be reached at A3ML@darpa.mil.

DARPA/I2O

ATTN: DARPA-PS-25-10

675 North Randolph Street Arlington, VA 22203-2114

2. PROGRAM SOLICITATION (PS) AUTHORITY

This Program Solicitation (PS) may result in the award of Other Transaction (OT) for Prototype Projects, which can include not only commercially available technologies fueled by commercial or strategic investment, but also concept demonstrations, pilots, and agile development activities that can incrementally improve commercial technologies, existing Government-owned capabilities, and/or concepts for broad defense and/or public application(s). The Government reserves the right to award an OT for Prototypes under 10 U.S.C. § 4022, make multiple OT awards, or make no award at all. Follow-on production contracts or transactions may also be awarded pursuant to 10 U.S.C. § 4022. In all cases, the Government Agreements Officer shall have sole discretion to negotiate all agreement terms and conditions with selected proposers.

3. ACQUISITION STRATEGY

3.1. Eligibility

This PS encourages submissions from all responsible sources capable of satisfying the Government’s needs, including large and small businesses, nontraditional defense contractors as defined in 10 U.S.C. § 3014, and research institutions as defined in 15 U.S.C. § 632.

Federally Funded Research and Development Centers (FFRDC), University Affiliated Research Centers (UARC), and Government Entities interested in participating in the A3ML program or proposing to this PS should first contact the Agency Point of Contact of this solicitation prior to developing and submitting an abstract submission.

NOTE: See Section 5 for security requirements that impact eligibility.

3.2. Other Transaction Agreements

OT for Prototype agreements offer DARPA and performers the flexibility to negotiate terms and conditions which closely reflect private-sector or commercial contracts. Thus, standard Government regulations, such as the Federal Acquisitions Regulations (FAR) or Defense Federal Acquisitions Regulations Supplement (DFARS) do not apply. Most notably, performers will be provided the flexibility of using their existing accounting systems and negotiating intellectual property rights in accordance with their standard business practice.

3.3. Hybrid Program Approach

DARPA intends to segment the A3ML Program into two tracks, the Research Track and the Competition Track. This PS primarily covers the Research Track (A3ML performer).

Participation in the intended Competition Track is briefly discussed in relation to abstract submissions; otherwise, any additional reference to the Competition Track, including future prize mailto:A3ML@darpa.mil competitions, is shared for situational awareness only.

Research Track: Proposers who respond to this solicitation, receive an encouragement for oral presentations, and are selected for potential award under Technical Area 1 (TA-

1) and TA-2 will become A3ML performers within the Research Track. Proposers may submit to either or both Tracks; however, A3ML performers contracted under the Research Track will become ineligible to compete in A3ML prize competitions within the Competition Track.

Competition Track: The A3ML Program intends to hold a prize competition to further objectives of the A3ML Program. The objective of the Competition Track is to incentivize participation in A3ML TA-1 objectives by entities who are not eligible to participate in the TA-1 Research Track. Entities interested in participating in the Competition Track will be required to submit an abstract. Upon notification of encouragement, an entity will be eligible to become a participant in the Competition Track. Note, as stated above, any additional reference to the Competition Track, including future prize competitions, is shared for situational awareness only, and represents the intent of the A3ML program.

Additional information regarding the Research and Competition Tracks is discussed throughout this solicitation.

3.4. Abstracts

This solicitation requires the submission of an abstract. Proposers are required to submit an abstract for evaluation by DARPA to minimize effort and reduce the potential expense of preparing an unsuccessful proposal.

Abstract submissions are required for TA-1 and TA-2. DARPA will review abstracts for conformance; only conforming abstracts may be reviewed and receive feedback.

TA-1 and TA-2 Abstract feedback: DARPA will respond to the abstract with a statement as to whether DARPA is interested in scheduling a 90-minute (not to exceed 50-minute presentation, 30-minute Q&A, and 10-minute contracting dialogue) oral presentation. If DARPA is not interested in scheduling an oral presentation, the notification letter will state so and may provide feedback regarding this decision. Thus, upon review of abstracts, DARPA may elect to invite all, some, or none of the proposers to oral presentations. Only those proposers who receive an invitation to participate in oral presentations are eligible to provide one.

Technical Area 1 – Competition (TA-1-C) Abstract feedback: DARPA will respond to all submitted, conforming abstracts with a decision that encourages or discourages participation in the A3ML Competition Track.

Information about submission deadlines for TA-1-C abstracts will be widely advertised at a later date. See Section 6 for further details regarding submission requirements and the evaluation process.

NOTE: DARPA will not pay the costs associated with the preparation or submission of an abstract.

3.5. Oral Presentations

Upon notification of the opportunity to proceed, proposers to TA-1 and TA-2 (Research Track) may be invited to participate in an Oral Presentation; see Section 6 for Oral Presentation content requirements. Additional instructions (including content submission guidelines) will be provided in the invitation to participate. The Government will evaluate Oral Presentations in accordance with the evaluation criteria stated in Section 6.2. If selected for funding, and subject to the availability of funds, the selected performer may receive a Phase 1 award of an Other Transaction for Prototypes agreement and become eligible to participate in the future Phase 2 option; see Section 7 for additional information.

4. PROGRAM INFORMATION

4.1. Background

The A3ML program seeks to prevent the adversaries from financing their aggression and illegal activities by developing technologies that would make it prohibitively expensive to launder value through the global financial system. To achieve this strategic objective, the A3ML program will develop algorithms to extract illicit financial flow tactics, techniques, and procedures (TTP) from heterogeneous financial transaction data and represent TTPs in a generic sharable format, integrate developed algorithms into a prototype system, and rapidly transition the prototype system to operational users.

Adversaries depend on the global financial system to finance the development of weapons of mass destruction, back violent extremist organizations, and produce illicit drugs that kill Americans. North Korea, Russia, and other adversaries launder billions of U.S. dollars (USD) yearly despite U.S. anti-money laundering (AML) efforts. Open-source reporting estimates that approximately half of the North Korean nuclear program is funded through laundering of cryptocurrency into fiat currency used to procure critical program components.i Likewise, Russian oligarchs, who own key firms on which the Russian armed forces depend for sustainment, maintain their wealth and status by laundering billions of USD using diverse TTPs, including U.S. and Canadian real estate investmentii, shell companies, and “straw-man” intermediates.iii Transnational criminal organizations, who have long been at the forefront of money laundering innovation, now partner with Chinese nationals and underground banking groups to surreptitiously move capital out of the People’s Republic of China in exchange for financing the acquisition of fentanyl and other illicit drugs’ chemical precursors, according to open-source reporting.iv

Today, AML practitioners accumulate evidence of money laundering behavior largely via manual searches of myriad commercial and financial intelligence (FININT) databases and implement safeguards against money laundering largely using inflexible rule-based systems and subjective manual data analysis. Evidence for money laundering is drawn largely from three sources: (a) Bank Secrecy Act (BSA) reports that are supposed to be filed when transactions appear suspicious; (b) commercial data sources on transactions and beneficial ownership; and (c) intelligence collections. Industry often submits BSA reporting data “defensively” as a precautionary step. Because of this, BSA data usually exhibits very high false positive rates. To mitigate these failures, analysts manually fuse BSA data with commercial data and intelligence collections (e.g., financial transaction reports, communications intercepts, and clandestine human reporting), but this process is limited by time and human cognitive constraints. Fusion is often performed by enumerating a small list of static, subject-matter expert-constructed money laundering “templates” and manually searching through commercial and intelligence databases to see if reported transactions or relationships match one or more template. Because of the static nature of today’s AML processes, novel money laundering schemes are frequently successful for years and are shut down only when other, unexpected information provides definitive evidence of wrongdoing.

Furthermore, the process of searching for and mapping patterns of behavior is almost entirely manual and hence subject to unmitigated human biases and cognitive limitations, reducing its utility to Department of Defense (DoD), intelligence community (IC), and law enforcement entities. The lack of feedback from government to industry, coupled with heavy financial penalties when industry fails to report behavior that is eventually deemed associated with illicit finance often translates to overreporting by industry (i.e., reporting anything that could be deemed even slightly suspicious). This overreporting results in a false discovery rate (FDR) that by some estimates exceeds 95%v, generates far too much data to ever be processed manually, and unnecessarily reveals to USG the private information of entities who are not involved in illicit finance.

If successful, A3ML would revolutionize AML in the U.S. by replacing current manual, reactive, expensive, and coercive practices with agile, algorithmic methods that align incentives and reduce costs across government and the private sector. A3ML would achieve this outcome by developing algorithms and software that apply graph search techniques to distributed financial transaction records, referencing high-level models of money laundering TTPs to extract instances of illicit financial transactions from data. To adapt to changing adversary behavior, A3ML algorithms would also infer new TTPs from partially labeled transactions and metadata. By shifting the USG’s AML paradigm from manually searching for and reporting specific instances of illicit financial behavior to sharing generic patterns of illicit financial behavior, A3ML would: (a) increase the utility to USG of reporting of suspected illicit financial behavior by both USG entities and the private sector (e.g., as required by the BSA); and (b) decrease compliance costs incurred by U.S. financial institutions.

4.2. Program Description

4.2.1 Overall A3ML Program Scope

A3ML performers and competition participants will: (a) develop algorithms for extracting money laundering TTPs from financial transaction data; (b) develop algorithms for inferring new TTPs from partially labeled transaction data; (c) integrate TTP extraction and inference algorithms into a prototype system for automatic detection of illicit financial behavior; and (d) construct novel, hypothetical money laundering TTPs to test the effectiveness of TTP extraction and inference algorithms in novel scenarios. Technical advances in subgraph matching algorithms, graph convolutional and transformer networks, inverse planning, federated learning, and probabilistic modeling could help to achieve A3ML objectives.

TA-1 performers and TA-1-C participants will develop algorithms to extract and infer money laundering TTPs from financial transaction data, while performers on TA-2 will develop novel, hypothetical money laundering TTPs to red-team TA-1 algorithms. TA-1 and TA-2 performers will leverage program access to unique Government datasets and broad access to commercial data resources.

Together, performers and the Government team will facilitate uptake of A3ML algorithms and software by USG entities through integration with multiple existing USG programs, creation of new transition relationships across DoD and other USG entities, and continual intensive interaction with private-sector entities.

4.2.2 Technical Area 1 (TA-1) Research Track: Extract and Infer Money Laundering TTPs from Financial Transactions TA-1 performers will develop algorithms and prototype software for extracting and inferring money laundering TTPs from heterogeneous and distributed financial transaction data. Initially based on data provided by the Government data application programming interface (API), TA- 1 algorithms will generate estimates of the probability of entities (e.g., financial or other firms, personae) and transactions between entities being associated with illicit financial behavior.

TA-1 algorithms will represent money laundering TTPs in a generic, semantically meaningful format. The format’s structure and semantics must support iterative, asynchronous updating by multiple participants with access to different data resources (e.g., by a USG entity with access to intelligence collections and by a financial firm with access to private payment network data). The Government team will define formal semantics by which the Government-provided data is addressable and provide these semantics to performers upon inception of Phase 1. TA-1 performers are welcome to propose their own innovative format and semantics to represent TTPs, though performer-proposed formats will be required to interface with the Government-specified semantics for software prototype integration purposes.

The TA-1 performers will face an immense search problem even when considering only those transactions that are known or strongly suspected to be associated with illicit behavior. The classified addendum to this PS describes details of Government-provided data. For the purpose of unclassified abstract and proposal writing, the Government-provided data can be modeled as a very large (hundred petabyte-scale) semantic graph database query-able by an industry-standard language, such as SPARQL or Cypher. Proposed solutions should not rely on idiosyncratic features of a particular query language. Proposers should assume that data is mostly unlabeled; to the extent that the data is labeled (e.g., when a payment rail labels transactions as fraudulent or not fraudulent) there is very likely a heavy bias toward “not suspicious”, “not fraudulent”, “not illicit”, etc. Program data will contain a labeled true positive subset, though the subset is heterogeneous in content and semantics. In addition to Government-provided data, TA-1 performers may provide proprietary data or indirect access to distributed private1 data sources from diverse industry partners. A3ML algorithms will demonstrate their operational value when TA-1 TTP representations are asynchronously updated using these distributed private data sources. The Government API will initially support access to both unclassified and classified Government and commercially available data resources, which will be stored in a semantic graph format as described above. The API will support queries to the semantic graph database along with queries regarding database metadata and typical system status queries. As the program progresses, the Government API may support additional data resources, such as performer-provided data, but this access is dependent on the access modalities mutually agreed to by the Government and the provider of the private data sources.

1 Private in the economist’s sense, meaning “not for sale”.

4.2.2.1 TA-1 proposals should:

Detail how the proposed approach will address both “top-down” (extraction of instances of known TTPs from financial transaction data) and “bottom-up” (inference of new TTPs from partially labeled financial transaction data) problems.

Describe how TTPs will be represented in a generic format that is conducive to repeated alteration by multiple AML organizations with access to different data resources.

Proposals may assume that each of these organizations will use identical semantics (e.g., all entities will have access to, and use, an identical ontology).

Estimate the computational burden (time, physical and virtual resources, and monetary cost) of training (if applicable) and serving (e.g., prediction or searching) the proposed algorithms in a software system.

Provide evidence that the proposed algorithms will be able to aggregate information from diverse financial transaction data sources without requiring central, synchronous access to all data sources (i.e., without sharing data between sources).

4.2.2.2 The following features of TA-1 proposals will be considered a significant strength:

Propose and demonstrate viability of performer access to unique private financial transaction data or other relevant data sources. “Performer access” entails all performers’ algorithms using the private financial transaction data to train (if applicable) and search for instances of illicit financial behavior that match existing TTPs and infer new or augmented TTPs from the private data. Performer access does not entail sharing the actual private data with other performers or with the Government. The Government cannot and will not accept data that is reasonably likely to identify one or more specific U.S. persons. A notional access modality is the performer containerizing their prototype software (e.g., using Docker), sending the container to the private financial transaction data owner to run on their data, and receiving the results of the software run on the private financial transaction data; no data is shared with the performer or the Government, but the algorithms’ effectiveness is evaluated. “Demonstrate viability” means that the proposal outlines a realistic plan for performer access to the data with substantial evidence that the owner of the data is amenable to such access. Examples of unique private financial transaction data or other relevant data sources include as notional examples only: transactions in fine artwork, vehicles, or collectibles; digital assets transactions; cash deposits and withdrawals; virtual reality monetary transactions (e.g., monetary transactions in video games); securities transactions; itemized bills of lading; etc. Proposers are encouraged to propose and demonstrate viability of access to relevant and valuable data sources to which they believe their access is unique and compelling.

Explain the methodology for protecting the privacy of the owners of private data and of the entities from which the data was derived.

Explain how the structure of the proposed algorithm(s) enables graceful degradation of performance in operational environments with diminished access to high-value data sources.

4.2.2.3 The following features of TA-1 proposals will be considered a significant weakness:

Proposal of an algorithm that does not enable a generic representation of illicit financial behavior.

Proposal of an approach that addresses only one of the “top-down” or the “bottom-up” problems (described above under responsive TA-1 proposals).

Proposal of an approach that does not enable partial matching of data to a money laundering TTP. Missing data is the norm, not an aberration.

Proposal of an algorithm that requires a specific source of data for performant operation. Though TA-1 proposals are encouraged to suggest additional data sources – commercial, Government, and especially private – that could be of utility to the program, access to any one particular data source cannot be assumed. A3ML algorithms will be deployed in a wide variety of operational environments with varying data access limitations.

4.2.2.4 TA-1 Integration: TA-1 performers will deliver algorithms and software that can be integrated with two existing government programs in other agencies during Phase 1 of the program. Details on these programs are contained in the classified addendum to this PS.

4.2.2.5 TA-1 Anticipated Deliverables: Deliverables will consist of mathematical descriptions of algorithms, executable software, all necessary source code, detailed documentation, and detailed instructions and any toolchain necessary for compiling and executing the source code to replicate the executable software and to replicate program results.

4.2.2.6 TA-1 Anticipated Performance Capabilities: TA-1 performers should be capable of successfully delivering algorithms and software to extract and infer money laundering TTPs from heterogeneous financial transaction data. The following mixture of professional capabilities are anticipated, but are not limited to: technical expertise in graph search, subgraph matching algorithms, graph flow problems, graph convolutional or transformer neural networks, probabilistic modeling, and/or inverse planning; expertise in the design of payment systems and digital assets; and operational expertise in counter-threat finance (CTF) within DoD or the IC and/or AML in the private sector or law enforcement.

4.2.3 Technical Area 1 – Competition (TA-1-C) Track: Extract and Infer Money Laundering TTPs from Surrogate Data DARPA recognizes that many of the most knowledgeable and innovative entities (e.g., financial institutions, fintech startups, academic research labs) may not employ individuals with an active security clearance; therefore, A3ML intends to create a Competition Track to allow these entities to participate in the program. To that end, A3ML intends to create and provide high-quality unclassified surrogate financial data as a testbed for algorithm development to all TA-1-C competition participants. TA-1-C competition participants would then develop algorithms for extracting and inferring money laundering TTPs from surrogate financial transaction data.

The operational and technical objectives for TA-1-C competition participants are identical to those for TA-1 performers listed in the previous section. As such, A3ML is requiring those entities interested in the Competition Track to submit an abstract. TA-1-C abstracts should include the same features as the TA-1 abstracts described above, with the following exceptions:

TA-1-C abstracts should not discuss access to unique financial transaction data.

TA-1-C abstracts should focus exclusively on the possible technical merits of their proposed algorithms.

The A3ML Program intends to award prize money to Competition Track participants pursuant to the authority vested in 10 U.S.C. § 4025. Additional details regarding the intended Competition Track, including the submission deadline for TA-1-C abstracts, will be widely advertised when available.

4.2.4 Technical Area Two (TA-2) Research Track: Red-teaming

TA-2 performers will develop algorithms that automatically generate novel, hypothetical money laundering TTPs and instances of those TTPs to test the ability of TA-1 algorithms to detect out-of-distribution illicit financial behavior. The objective of TA-2 is to reduce the risk of TA-1 algorithms overfitting to existing illicit finance TTPs, as adversaries may change the way in which they transfer illicit value and new adversaries may emerge. Therefore, TA-2 algorithms must be able to generate TTPs that simulate the illicit financial activities of America’s adversaries but also be able to generate entirely new TTPs that are quantitatively and qualitatively dissimilar from existing threat actors’ TTPs.

TA-2 proposals should describe how the proposed solution will improve TA-1 algorithm quality and increase the probability of A3ML successfully meeting program metrics. Proposers should note that all A3ML program metrics are, essentially, TA-1 program metrics; there are no program metrics that specifically test the quality of TA-2 algorithms. Proposals should include precise quantitative descriptions of additional metrics to specifically measure the performance of TA-2 algorithms.

TA-2 is intentionally less-specified than TA-1. DARPA seeks maximum diversity in proposed solutions to TA-2 technical problems.

Additional information regarding TA-2 objectives, deliverables, and suggested team capabilities is available in the classified addendum.

4.2.5 Government Test and Evaluation (T&E) Team: Data Engineering, Surrogate Data Generation, and Program Evaluation This information is provided for informational purposes only. Abstracts or Proposals submitted in response to the T&E Team will not be evaluated. The T&E team will augment an existing semantic graph database, develop high-quality surrogate data for use by TA-1-C competition participants, and integrate the semantic graph database with other USG efforts and software platforms. The T&E team will conduct performer evaluations during each phase of the program according to the metrics described in Section 4.4.2. The Government team will be composed of representatives from the US Air Force (USAF) Concepts Development Management – Research (CDMR) Intelligence Systems Support Office (ISSO), U.S. Central Command (CENTCOM) J3 Interagency Action Group, and additional Government partners. Information on the Government application programming interface (API) is provided in Section 4.2.2.

More information on the Government T&E Team’s role is available in the classified addendum.

4.3. Program Structure

As previously stated, A3ML has a Research Track and an intended Competition Track. The Research Track consists of an 18-month Phase 1 and an optional 12-month Phase 2. A3ML intends for the Competition Track to run concurrently with the Phase 1 Research Track until competition completion. Additionally, there will be an up-to-12-month Phase 0 for the Government T&E team prior to commencement of the Research and Competition Tracks.

Phase 1 of A3ML will commence when all TA-1 and TA-2 performers are on contract, or 12 months from 1 MAR 2025, whichever date is sooner. The intended Competition Track would commence no sooner than the beginning of Phase 1. The Government does not anticipate limiting the number of Competition Participants under TA-1-C.

During Phases 1 and 2, constant communication between TA-1 and TA-2 performers will be required. DARPA will consider Associate Contractor Agreements to enable formal information sharing between contractors.

4.3.1 Phase 0:

In Phase 0, the Government T&E team will consolidate data for use by TA-1 and TA-2, prepare a data- and software-engineering environment for use by TA-1 and TA-2 and in the competition, and generate unclassified surrogate financial transaction data for use in subsequent competitions. Performance under the Research and Competition track will not commence until Phase 1. Reminder: this solicitation is NOT soliciting abstracts of proposals for Phase 0 solutions. Abstracts of Proposals received against Phase 0 will not be evaluated.

4.3.2 Phase 1 (Research Track):

In Phase 1, performers will develop algorithms and prototype software for extracting illicit finance TTPs from heterogeneous financial transaction data (TA-1) and algorithms and prototype software for generating novel, hypothetical illicit finance TTPs to test TA-1 algorithms (TA-2). Phase 1 is anticipated to be 18-months in length. A program review will be held toward the conclusion of Phase 1 and the Government T&E team will evaluate performer algorithms. The T&E team’s assessment of these algorithms and availability of funding will be considered when deciding which, if any, performer teams will continue into Phase 2.

4.3.3 Phase 2 (Research Track Option):

In Phase 2, TA-1 and TA-2 performers will fully integrate their algorithms and prototype software into a DoD program, the USAF/CDMR-ISSO Mortal Mint program, and another USG program, details of which are available in the classified addendum to this PS. Phase 2 is anticipated to be 12 months long. Phase 2 will occur only conditioned on approval by the Director, DARPA. All proposers to TA-1 and TA-2 research tracks should prepare a fully costed out Phase 2 option as part of their proposal.

4.4. Program Goals, Metrics, and Evaluation

4.4.1 Program Goals

The fundamental objective of A3ML is to develop technology that would make it prohibitively expensive for adversaries to launder illicit value through the global financial system. To accomplish program objectives, A3ML algorithms and prototype software must be deemed useful by Government and commercial transition partners, not merely exhibit technical excellence.

4.4.2 Program Metrics and Evaluation

Evaluation of A3ML algorithms and prototype software will occur during designated evaluation exercises during Phase 1 and continually during transition to operational partners in Phase 2. A3ML algorithms will be evaluated at the program level across three dimensions: (1) accuracy and precision; (2) parsimony; and (3) operational effectiveness. Table 1 below displays these metrics, with brief descriptions and associated critical values.

Criteria Metric Description Phase 1 Phase 2 Accuracy and precision Binary classification metrics

False Discovery Rate (FDR) = ; Negative Predictive

𝐹𝑃

𝐹𝑃 + 𝑇𝑃

Value (NPV) = .

𝑇𝑁

𝑇𝑁 + 𝐹𝑁

FDR < 12.5%;

NPV > 85.7%

Unchanged

Parsimony (internal validity)

Information Criterion

𝐴𝐼𝐶(𝑚) = 2|𝑓| ‒ 2

, where is a log 𝐿(𝐺(𝑚)|𝑓) 𝑓 money laundering theory, is |𝑓| the number of free parameters in the theory, is a 𝐺(𝑚) transaction graph parameterized by the number of TTP types , 𝑚 and is the likelihood 𝐿(𝐺(𝑚)|𝑓) of the observed graph given .𝑓

At least 2x as likely to minimize the information loss over expert SME description

Unchanged

Parsimony (external validity)

SME evaluation CTF/FININT analyst rating of utility of select money laundering TTPs (Likert scale 1-4)

3; useful for at least two known threat actors

4; very useful across many threat actors

Operational effectiveness

Illicit financial targets identified

Mann-Whitney U test of sample differences – with vs without

A3ML analytics

N/A >90% common-language effect size Table 1: A3ML metrics and notional associated critical values. The critical values may change as the program progresses.

The purpose of the accuracy and precision metrics are to validate the effectiveness of A3ML algorithms in extracting signals of illicit financial behavior from heterogeneous financial transaction data. A3ML tests FDR and negative predictive value (NPV) instead of other binary classification metrics because values of FDR and NPV can be estimated from operational data today, while many other quantities (e.g., the true positive or true negative rate) cannot be reliably estimated from today’s operational data. TA-1 algorithms will label entities and transactions as associated with illicit financial behavior or not; the T&E team will compare these labels with ground-truth labels as assigned by CENTCOM J3 analysts, ODNI personnel, or other operational partners.

The purpose of the parsimony metrics is to assess the extent to which A3ML algorithms can recover generic, re-usable representations of illicit financial behaviors – TTPs. Algorithms that can accurately and precisely label entities and transactions as (un)involved in illicit finance, but are unable to recover generic, re-usable patterns of illicit financial conduct are only marginally useful to a CTF or FININT analyst. Generic, re-usable patterns of illicit financial conduct can be further analyzed or modified to understand the effect of an adversary’s possible future change in behavior. A3ML uses an information criterion to balance the concision of the inferred TTPs against their ability to explain observed data.

Notionally, A3ML will use the Akaike Information Criterion (AIC) to perform this assessment. A3ML intends to assess TA-1-C competitors only on the AIC of their algorithms as evaluated on the surrogate financial transaction data. Because of the nonstationary nature of illicit finance, A3ML also relies on a qualitative assessment of the inferred TTPs’ parsimony and general utility, collating subject-matter expert reviews of the utility of inferred TTPs across multiple distinct threat actors.

The purpose of the operational effectiveness metric, introduced in Phase 2, is to empirically assess if A3ML algorithms are making an objective difference in CTF and anti-money laundering efforts across USG. Groups of CTF and FININT analysts across USG will be provided with access to A3ML algorithms as implemented in Mortal Mint or other Government-operated software, while other groups will continue to use current techniques.

The total illicit financial targets identified will be compared across groups and the significance of the effect assessed using a nonparametric statistical test.

4.5. Program Schedule and Milestones, Events, and Deliverables

4.5.1 Program Schedule/Milestones

A notional schedule of the execution of A3ML is displayed in Figure 1 below, including program phases, evaluation events, and principal investigator (PI) and integration events.

Figure 1: notional schedule for the execution of A3ML.

4.5.2 Program Events

As illustrated in Figure 1, A3ML will hold regular performer meetings and evaluation events.

Proposers should use September 2025 as the date of Phase 1 kick-off to estimate travel costs associated with the events noted below.

Performer meetings: Proposers should plan for a one-day Phase 1 kickoff meeting, followed by two additional one-day PI meetings and two three-day evaluation exercises during Phase

1. For Phase 2, proposers should similarly plan for a one-day Phase 2 kickoff meeting and a final one-day PI meeting and three-day evaluation exercise. Proposers should also expect periodic one-day site visits by the A3ML DARPA team and Government T&E team during the execution of Phase 1.

Evaluation tests/exercises: The Government T&E team will conduct periodic evaluation exercises during the execution of the program. The nature of these evaluations will likely change as the focus of the program moves from technology development to transition in Phase 2.

During Phase 1, the evaluation exercises will assess the ability of TA-1 algorithms to detect pre-determined illicit financial behavior. This behavior will be composed of historical examples of illicit financial transactions from defined threat actors and of de novo instances of existing and new TTPs constructed by TA-2 algorithms. Specifics regarding historical examples of illicit financial transactions are available in the classified addendum. Phase 1 evaluations will be conducted in Tampa, FL at ISSO facilities. Performer teams will be required to travel to Tampa for evaluations.

During Phase 2, evaluation will be conducted in conjunction with transition partner operations. Transition partners will use A3ML algorithms and prototype software to execute their mission and will report qualitative and quantitative metrics to performers directly and to the Government T&E team. Phase 2 evaluations will be conducted in Tampa, FL at ISSO or CENTCOM facilities and in the National Capital Region (NCR) at other USG facilities.

Performer teams will be required to travel to Tampa and throughout the NCR for evaluations.

Additional information regarding Phase 2 evaluations is available in the classified addendum.

4.5.3 Program Deliverables

The following tables state the anticipated program deliverables during each phase.

Deliverable(s) Description Due Date Monthly Status Reports Monthly reports detailing technical status and progress during the reporting period against planned progress.

Monthly (15 days After End of Month)

Algorithm Deliverable Theoretical development of algorithms expressed mathematically or in pseudocode; detailed documentation of algorithms.

Updates to theoretical work due monthly with Monthly Status Reports

Prototype Software Deliverable

Executable software, all relevant source code, detailed documentation, and detailed instructions, along with the toolchain, for compiling and executing the source code to replicate the executable software and any program results.

Major releases due two weeks prior to each evaluation event (Months 9 and 17 of Phase 1 execution)

Final Base Period Report

Final report detailing the totality of effort in accomplishing the work, such as task objectives, technical problems/challenges, general approach, technical results and important findings, etc.

15 days After End of Period of Performance

Table 2: Phase 1 Deliverables for TA-1 and TA-2 Research Track performers

Item Description Due Date Prototype Software Deliverable

Executable software, all relevant source code, detailed documentation, and detailed instructions, along with the toolchain, for compiling and executing the source code to replicate the executable software and any program results.

Continuous (notionally weekly updates)

Table 3: Phase 1 Deliverables for TA-1-C Competition Participants

5. SECURITY AND INFORMATION TECHNOLOGY

At this time, DARPA anticipates that abstract/proposals submitted in response to this PS may generate or involve access to classified information. Classified submissions shall be transmitted and marked in accordance with the guidance in this section. Security classification guidance via a Security Classification Guide (SCG) and a DARPA DD Form 254, “DoD Contract Security Classification Specification,” will be provided with the classified addendum, if requested by the proposer. The classified addendum to this PS will be released to eligible organizations that request it no later than close of business on 2/24/2025. The classified addendum is TOP SECRET/SCI and will only be transmitted via JWICS, DoD Secure Integration Cloud (SIC), or the DARPA Savannah ASCEND network email.

A3ML anticipates most TA-1 work will be performed at the unclassified level and work under TA- 2 will mostly be performed at the TOP SECRET/Sensitive Compartmented Information (TS/SCI) level. The prime proposer team organization on both TA-1 and TA-2 must be able to receive, process, and store classified information at the TS/SCI level. As mentioned above, TA-1-C (Competition Track) competition participants will receive unclassified surrogate financial transaction data for use in subsequent competitions.

Potential proposers to TA-1 and TA-2 are strongly encouraged to request the classified addendum and carefully review the A3ML classification guidance contained within, prior to preparing any abstract/proposal material. The classified addendum must be requested no later than 2/24/2025 by emailing the following information to A3ML@darpa.mil. The classified addendum will only be released to organizations meeting the security eligibility criteria in this section. All information must be received in a complete and accurate manner for DARPA to consider requests for the classified addendum.

Classified addendum request format:

1. Organization name (listed on Facility Clearance Letter):

2. CAGE Code:

3. Physical address:

4. SCI network name:

5. SCI email address to receive addendum:

6. SCIF Room #:

7. SCIF ID (government issued):

8. Does the SCIF accreditation have waivers? YES/NO:

9. Government Special Security Officer (SSO) name/ POC for SCIF (classified Phone & email):

10. Government POC for SCI network name/POC (classified Phone & email):

11. Contractor Special Security Officer (CSSO) on site name/ POC:

12. The same information above for all alternate work locations where the classified addendum will be transmitted/ stored within your organization:

Proposers will not further disseminate the classified addendum to other potential subcontractor proposal team members without first issuing a solicitation subcontractor DD-254 approved by DARPA. Subcontractor DD-254s must be received by DARPA no later than the time specified in Section 1 to be considered for approval.

If a submission contains Classified National Security Information or the suspicion of such, as defined by Executive Order 13526, the information must be appropriately and conspicuously marked with the proposed classification level and declassification date. Submissions requiring DARPA to make a final classification determination shall be marked as follows:

“CLASSIFICATION DETERMINATION PENDING. Protect as though classified ____________________________ (insert the recommended classification level, e.g., Top Secret, Secret or Confidential)”

NOTE: Classified submissions must indicate the classification level of not only the submitted materials, but also the classification level of the anticipated award.

Submissions containing both classified information and CUI must be appropriately and conspicuously marked with the proposed classification level, as well as ensuring CUI is marked in accordance with DoDI 5200.48.

Classified Submissions: For classified abstract/proposals, applicants will ensure all industrial, personnel, and information systems processing security requirements are in place and at the appropriate level (e.g., Facility Clearance Level (FCL), Automated Information Security (AIS), Certification and Accreditation (C&A), and any Foreign Ownership Control and Influence (FOCI) issues are mitigated prior to submission. Additional information on these subjects can be found at https://www.dcsa.mil/.

Proposers choosing to submit classified information from other classified sources (i.e., sources other than DARPA) must ensure (1) they have permission from an authorized individual at the cognizant Government agency (e.g., Contracting Officer, Program Manager); (2) the abstract/proposal is marked in accordance with the source Security Classification Guide (SCG) from which the material is derived; and (3) the source SCG is submitted along with the abstract/proposal.

Confidential, Secret, and Top Secret (TS) Information: Use transmission, classification, handling, and marking guidance provided by previously issued SCGs, the DoD Information Security Manual (DoDM 5200.01, Volumes 1 - 4), and the National Industrial Security Program Operating Manual, including the Supplement Revision 1 (DoD 5220.22-M and DoD 5200.22-M Sup. 1), when submitting Confidential, Secret, and/or Top Secret classified information.

SCI information must be marked, managed, and transmitted in accordance with DoDM 5105.21 https://www.dcsa.mil/

Volumes 1-3. Questions regarding the transmission of SCI may be sent to the DARPA Technical Office Program Security Officer (PSO) via the BAA mailbox or by contacting the DARPA Special Security Officer (SSO) at 703-812-1970.

Controlled Unclassified Information (CUI): For unclassified abstract/proposals containing CUI, applicants will ensure personnel and information systems processing CUI security requirements are in place. If an unclassified submission contains CUI or the suspicion of such, as defined by Executive Order 13556 and 32 CFR Part 2002, the information must be appropriately and conspicuously marked CUI in accordance with DoDI 5200.48. Identification of what is CUI about this DARPA program will be detailed in a DARPA CUI Guide and SCG and may be requested by emailing A3ML@darpa.mil.

Proposers submitting abstract/proposals involving the pursuit and protection of DARPA information designated as CUI must have, or be able to acquire prior to contract award, an information system authorized to process CUI information IAW NIST SP 800-171 and DoDI 8582.01.

Pertinent Information at other Classification Levels: Abstract/proposals may incorporate prior work or data at the SCI level or at Special Access Program (SAP) levels. SAP information must be marked in accordance with DoDM 5205.07 Volume 4 and transmitted by specifically approved methods, which will be provided by the Technical Office PSO or their staff. Proposers choosing to submit SAP information from an agency other than DARPA are required to provide the DARPA Technical Officer PSO written permission from the source material’s cognizant Special Access Program Control Officer (SAPCO) or designated representative. For clarification regarding this process, contact the DARPA Technical Office PSO via the BAA mailbox or the DARPA SAPCO at 703-526- 4102.

Additional SAP security requirements regarding facility accreditations, information security, personnel security, physical security, operations security, test security, classified transportation plans, and program protection planning may be specified in the DD Form 254.

NOTE: All abstract/proposals containing Special Access Program (SAP) information must be processed on a SAP information technology (SAP IT) system that has received an Approval-to-Operate (ATO) from the DARPA Technology Office PSO or other applicable DARPA SAP IT Authorizing Official. The SAP IT system ATO will be based upon the Risk Management Framework (RMF) process outlined in the Joint Special Access Program Implementation Guide (JSIG), current version (or successor document). (Note: A SAP IT system is any SAP IT system that requires an ATO. It can range from a single laptop/tablet up to a local and wide area networks.)

The Department of Defense mandates the use of a component’s SAP enterprise system unless a compelling reason exists to use a non-enterprise system. The DARPA Chief Information Officer (CIO) must approve any performer abstract/proposal to acquire, build, and operate a non-enterprise SAP IT system during the awarded period of performance. Use of the DARPA SAP enterprise system, SAVANNAH, does not require CIO approval.

SAP IT disposition procedures must be approved in accordance with the DoD CIO Memorandum of April 20, 2020.

Selected performers on this contract are required to abide by the requirements governing the conduct of DoD Intelligence Activities in DoD Manual 5240.01, available at http://www.esd.whs.mil/Directives/issuances/dodm/. Additionally, selected performers will be required to adhere to the Intelligence Oversight (IO) plan issued by DARPA specific to this program.

Implementation of this program’s specific IO plan will be addressed by the performer and furnished to DARPA as an annex to the OPSEC plan, S&T PIP, or as a stand-alone IO Implementation Plan.

Proposal security sections will contain detailed information related to the data type, data source, collection means, intended use, minimization, safeguarding, and dissemination of data sources potentially containing U.S. Persons Information (USPI) that will occur during the proposed work.

Any potential Questionable Intelligence Activities (QIA) or Significant Highly Sensitive Matter (S/HSM) matters encountered during solicitation activities will be reported to the PSO within 24hrs of discovery by emailing I2Osecurity@darpa.mil.

Security Related Eligibility Criteria: Proposers to TA-1 and TA-2 are required to have at least the prime proposal team organization satisfy the…