Generative Semi-supervised Graph Anomaly Detection

Hezhe Qiao; Qingsong Wen; Xiaoli Li; Ee-Peng Lim; Guansong Pang

cs.LGFeb 19, 2024

Generative Semi-supervised Graph Anomaly Detection

Authors: Hezhe Qiao, Qingsong Wen, Xiaoli Li, Ee-Peng Lim, Guansong Pang

Organizations: School of Computing and Information Systems, Singapore Management University · Squirrel AI · Institute for Infocomm Research, A*STAR, Singapore · A*STAR Centre for Frontier AI Research, Singapore

Abstract

This work considers a practical semi-supervised graph anomaly detection (GAD) scenario, where part of the nodes in a graph are known to be normal, contrasting to the extensively explored unsupervised setting with a fully unlabeled graph. We reveal that having access to the normal nodes, even just a small percentage of normal nodes, helps enhance the detection performance of existing unsupervised GAD methods when they are adapted to the semi-supervised setting. However, their utilization of these normal nodes is limited. In this paper, we propose a novel Generative GAD approach (namely GGAD) for the semi-supervised scenario to better exploit the normal nodes. The key idea is to generate pseudo anomaly nodes, referred to as 'outlier nodes', for providing effective negative node samples in training a discriminative one-class classifier. The main challenge here lies in the lack of ground truth information about real anomaly nodes. To address this challenge, GGAD is designed to leverage two important priors about the anomaly nodes -- asymmetric local affinity and egocentric closeness -- to generate reliable outlier nodes that assimilate anomaly nodes in both graph structure and feature representations. Comprehensive experiments on six real-world GAD datasets are performed to establish a benchmark for semi-supervised GAD and show that GGAD substantially outperforms state-of-the-art unsupervised and semi-supervised GAD methods with varying numbers of training normal nodes. Code will be made available at https://github.com/mala-lab/GGAD.

Figures & tables

Figure 1: Left: An exemplar graph with the edge width indicates the level of affinity connecting two nodes, in which normal nodes ( e.g. , $v_{n_{i}}$ and $v_{n_{j}}$ ) have stronger affinity to its neighboring normal nodes than anomaly nodes ( e.g. , $v_{a_{i}}$ and $v_{a_{j}}$ ) due to homophily relation within the normal class. Our approach GGAD aims to generate outliers ( e.g. , $v_{o_{i}}$ and $v_{o_{j}}$ ) that can well assimilate the anomaly nodes. Right: The outliers generated by methods like AEGIS [ 7 ] that ignore their structural relation often mismatch the distribution of abnormal nodes ( a ), due to their false local affinity ( c ). By contrast, GGAD incorporates two important priors about anomaly nodes to generate outliers so that they well assimilate the ( b ) feature representation and ( d ) local structure of abnormal nodes.

Figure 2: Overview of GGAD. ( a ) It first initializes the outlier nodes based on the feature representations of the ego network of a labeled normal node. We then incorporate the two anomaly node priors ( b-c ) to optimize the outlier nodes so that they are well aligned to the anomalies. ( d ) The resulting generated outlier nodes are treated as negative samples to train a discriminative one-class classifier.

Panel of Figure 3 — Figure 3: ( a-c ) t-SNE visualization of the node representations and ( d-f ) histograms of local affinity yielded by GGAD and its two variants on a GAD dataset T-Finance [ 50 ] .

Setting	Method	Dataset
		AUROC						AUPRC
		Amazon	T-Finance	Reddit	Elliptic	Photo	DGraph	Amazon	T-Finance	Reddit	Elliptic	Photo	DGraph
Unsupervised	DOMINANT	0.7025	0.6087	0.5105	0.2960	0.5136	0.5738	0.1315	0.0536	0.0380	0.0454	0.1039	0.0075
	AnomalyDAE	0.7783	0.5809	0.5091	0.4963	0.5069	0.5763	0.1429	0.0491	0.0319	0.0872	0.0987	0.0070
	OCGNN	0.7165	0.4732	0.5246	0.2581	0.5307	/	0.1352	0.0392	0.0375	0.0616	0.0965	/
	AEGIS	0.6059	0.6496	0.5349	0.4553	0.5516	0.4509	0.1200	0.0622	0.0413	0.0827	0.0972	0.0053

Table 1: AUROC and AUPRC on six GAD datasets. The best performance per dataset is boldfaced, with the second-best underlined. ‘/’ indicates that the model cannot handle the DGraph dataset.

Figure 4: AUPRC results w.r.t the size of training normal nodes ( $R$ % of $|\mathcal{V}|$ ). ‘Baseline’ denotes the performance of the best unsupervised GAD method.

Metric	Component		Dataset
Metric	${\ell_{{ala}}}$	${\ell_{{ec}}}$	Amazon	T-Finance	Reddit	Elliptic	Photo	DGraph
AUROC		✓	0.8871	0.8149	0.5839	0.6863	0.5762	0.5891
	✓		0.7250	0.6994	0.5230	0.7001	0.6103	0.5513
	✓	✓	0.9324	0.8228	0.6354	0.7290	0.6476	0.5943
AUPRC		✓	0.6643	0.1739	0.0409	0.1954	0.1137	0.0076
	✓		0.1783	0.0800	0.0398	0.2683	0.1186	0.0063

Table 2: Ablation study on our two priors.

Metric	Method	Dataset
Metric	Method	Amazon	T-Finance	Reddit	Elliptic	Photo	DGraph
AUROC	Random	0.7263	0.4613	0.5227	0.6856	0.5678	0.5712
	NLO	0.8613	0.6179	0.5638	0.6787	0.5307	0.5538
	Noise	0.8508	0.8204	0.5285	0.6786	0.5940	0.5779
	GaussianP	0.2279	0.6659	0.5235	0.6715	0.5925	0.5862
	VAE	0.8984	0.6674	0.6175	0.7055	0.6222	0.5801

Table 3: GGAD vs. alternative outlier generators.

Metric	Method	Dataset
Metric	Method	Amazon	T-Finance	Elliptic
#Anomalies/#Top-K Nodes		387/500	351/1000	1448/2000
AUROC	DOMINANT	0.7025	0.6087	0.2960
	GGAD-enabled DOMINANT	0.8186	0.6275	0.2986
	OCGNN	0.7165	0.4732	0.2581
	GGAD-enabled OCGNN	0.8692	0.5931	0.2638

Table 4: GGAD enabled unsupervised methods.

Appendix figures & tables12 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	Type	# Nodes	# Edges	# Attributes	#Anomalies Rate
Amazon	Co-review	11,944	4,398,392	25	6.9%
T-Finance	Transaction	39,357	21,222,543	10	4.6%
Reddit	Social Media	10,984	168,016	64	3.3%
Elliptic	Bitcoin Transaction	46,564	73,248	93	9.8%
Photo	Co-purchase	7,535	119,043	745	9.2%
DGraph	Financial Networks	3,700,550	4,300,999	17	1.3%

Appendix

Table 5: Key statistics of the six datasets used in our experiments.

Figure 6: Histogram of local affinity on more datasets

Figure 7: Affinity distribution based on raw node attributes

Figure 8: AUPRC of GGAD w.r.t hyperparameters $\alpha$ , $\beta$ , $\lambda$ , $S$ .

Figure 9: AUROC results w.r.t hyperparameters $\alpha$ , $\beta$ , $\lambda$ , $S$ .

Figure 10: AUPRC results w.r.t. different number of training normal nodes ( $R$ % of $|\mathcal{V}|$ ). DGraph is a very large dataset, so a significantly smaller $R$ is used to have a similar size of $\mathcal{V}_{l}$ as the other datasets. ‘Baseline’ denotes the performance of the best unsupervised GAD method per dataset.

Figure 11: AUROC results w.r.t. different number of training normal nodes ( $R$ % of $|\mathcal{V}|$ ). DGraph is a very large dataset, so a significantly smaller $R$ is used to have a similar size of $\mathcal{V}_{l}$ as the other datasets.‘Baseline’ denotes the performance of the best unsupervised GAD method per dataset.

Figure 12: AUPRC w.r.t. different anomaly contamination.

Figure 13: AUROC w.r.t. different anomaly contamination.

Metric	Dataset
Metric	Amazon	T-Finance	Elliptic	Photo	Reddit
with Abnormal Node	0.1980	0.0784	0.1094	0.3703	0.3409
with Normal Node	0.2318	0.1040	0.1304	0.3880	0.3605

Appendix

Table 6: Analysis of the generated outlier nodes using MMD distance.

Method	Dataset
Method	Amazon	T-Finance	Reddit	Elliptic	Photo	DGraph
DOMINANT	1592	10721	125	1119	437	388
AnomalyDAE	1656	18560	161	8296	445	457
OCGNN	765	5717	162	3517	125	/
AEGIS	1121	15258	166	5638	417	1022
GAAN	1678	12120	94	1866	307	/

Appendix

Table 7: Runtimes (in seconds) on the six datasets on CPU.

Figure 14: Loss curve of different modules in GGAD

Graph-Based Anomaly Detection

See all 44 papers

NK-GAD: Neighbor Knowledge-Enhanced Unsupervised Graph Anomaly Detection
Apr 17, 2026Zehao Wang, Lanjun WangGraph Neural Networks Reconstruction-Based Anomaly Detection
College of Intelligence and Computing, Tianjin University, Tianjin, China · School of New Media and Communication, Tianjin University, Tianjin, China
TERGAD: Structure-Aware Text-Enhanced Representations for Graph Anomaly Detection
May 19, 2026Wen Shi, Zhe Wang, Huafei Huang +6Graph Representation Learning Text-Attributed Graph Learning
College of Computer Science and Technology, Jilin University, Changchun 130012, China · School of Computer Science and Information Technology, Adelaide University, Adelaide SA5095, Australia · School of Computing Technologies, RMIT University, Melbourne, VIC 3000, Australia +1
AnomalyGFM: Graph Foundation Model for Zero/Few-shot Anomaly Detection
Feb 13, 2025Hezhe Qiao, Chaoxi Niu, Ling Chen +1Graph-Based Anomaly Detection Anomaly Detection
School of Computing and Information Systems Singapore Management University Singapore · Australian Artificial Intelligence Institute University of Technology Sydney Sydney, Australia

Apr 17, 2026J/K move · Enter open · S save

NK-GAD: Neighbor Knowledge-Enhanced Unsupervised Graph Anomaly Detection

Zehao Wang, Lanjun Wang

College of Intelligence and Computing, Tianjin University, Tianjin, China · School of New Media and Communication, Tianjin University, Tianjin, China

Graph Neural Networks Reconstruction-Based Anomaly Detection Unsupervised Anomaly Detection Graph Heterophily Anomaly Detection Graph-Based Anomaly Detection

Open paper AskPDF arXiv

Graph anomaly detection aims to identify irregular patterns in graph-structured data. Most unsupervised GNN-based methods rely on the homophily assumption that connected nodes share similar attributes. However, real-world graphs often exhibit attribute-level heterophily, where connected nodes have dissimilar attributes. Our analysis of attribute-level heterophily graphs reveals two phenomena indicating that current approaches are not practical for unsupervised graph anomaly detection: 1) attribute similarities between connected nodes show nearly identical distributions across different connected node pair types, and 2) anomalies cause consistent variation trends between the graph with and without anomalous edges in the low- and high-frequency components of the spectral energy distributions, while the mid-part exhibits more erratic variations. Based on these observations, we propose NK-GAD, a neighbor knowledge-enhanced unsupervised graph anomaly detection framework. NK-GAD integrates a joint encoder capturing both similar and dissimilar neighbor features, a neighbor reconstruction module modeling normal distributions, a center aggregation module refining node features, and dual decoders for reconstructing attributes and structures. Experiments on seven datasets show NK-GAD achieves an average 3.29% AUC improvement.

Abstract

Graph-Based Anomaly Detection

Explore similar work

NK-GAD: Neighbor Knowledge-Enhanced Unsupervised Graph Anomaly Detection

TERGAD: Structure-Aware Text-Enhanced Representations for Graph Anomaly Detection

AnomalyGFM: Graph Foundation Model for Zero/Few-shot Anomaly Detection