GCTAM: Global and Contextual Truncated Affinity Combined Maximization Model For Unsupervised Graph Anomaly Detection

Xiong Zhang; Hong Peng; Zhenli He; Cheng Xie; Xin Jin; Hua Jiang

cs.SIMar 2, 2026

GCTAM: Global and Contextual Truncated Affinity Combined Maximization Model For Unsupervised Graph Anomaly Detection

Authors: Xiong Zhang, Hong Peng, Zhenli He, Cheng Xie, Xin Jin, Hua Jiang

Organizations: School of Software, Yunnan University, Kunming, China

Abstract

Anomalies often occur in real-world information networks/graphs, such as malevolent users, malicious comments, banned users, and fake news in social graphs. The latest graph anomaly detection methods use a novel mechanism called truncated affinity maximization (TAM) to detect anomaly nodes without using any label information and achieve impressive results. TAM maximizes the affinities among the normal nodes while truncating the affinities of the anomalous nodes to identify the anomalies. However, existing TAM-based methods truncate suspicious nodes according to a rigid threshold that ignores the specificity and high-order affinities of different nodes. This inevitably causes inefficient truncations from both normal and anomalous nodes, limiting the effectiveness of anomaly detection. To this end, this paper proposes a novel truncation model combining contextual and global affinity to truncate the anomalous nodes. The core idea of the work is to use contextual truncation to decrease the affinity of anomalous nodes, while global truncation increases the affinity of normal nodes. Extensive experiments on massive real-world datasets show that our method surpasses peer methods in most graph anomaly detection tasks. In highlights, compared with previous state-of-the-art methods, the proposed method has +15% $\sim$ +20% improvements in two famous real-world datasets, Amazon and YelpChi. Notably, our method works well in large datasets, Amazin-all and YelpChi-all, and achieves the best results, while most previous models cannot complete the tasks.

Figures & tables

Figure 1: The motivation of the work. (a) original graph with an anomaly. (b) Insufficient Truncation; (c) Indistinguishable Truncation; (d) Excessive Truncation.

Figure 2: An overview of the GCTAM framework. The contextual truncation graph $G^{\circledast}$ truncates the edges between normal and anomaly nodes to decrease the affinity of anomaly nodes. Conversely, the Global Truncation Graph $G^{*}$ reinforces edges between normal nodes to increase their affinity.

Dataset	Type	R/I	Nodes	Edges	Attributes	Anomalies(Rate)
Amazon	Co-review	R	10244	175,608	25	693(6.66%)
YelpChi	Co-review	R	24,741	49,315	32	1,217(4.91%)
ACM	Citation Networks	I	16,484	71,980	8,337	597(3.63%)
Facebook	Social Networks	R	1,081	55,104	576	27(2.49%)
Reddit	Social Networks	R	10,984	168,016	64	366(3.33%)
Amazon-all	Co-review	R	11,944	4,398,392	25	821(6.87%)

Table 1: The statistics of seven datasets. The R/I represents the datasets with Injected/Real anomalies.

Datasets	w/o $G^{\circledast}\&{G}^{*}$	w/ $G^{\circledast}$	w/ ${G}^{*}$	GCTAM
Amazon	83.86	83.90	84.07	84.38
YelpChi	69.73	73.07	77.43	79.00
ACM	84.30	89.06	88.70	90.77
Facebook	89.03	91.55	89.67	92.38
Reddit	57.09	58.95	57.21	59.21
Amazon-all	87.32	88.14	88.41	88.89

Table 3: The evaluation of CAT

G^{\circledast}

and GAT

{G}^{*}

module over the metric AUROC.

Figure 3: Edge Truncation Ratio VS AUROC and AUPRC

Figure 4: Number of Neighbors k VS AUROC and AUPRC

Figure 5: Affinity Truncation Score Compare

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	Method	Affinity Truncation Score
Amazon	RA	26.26
	TAM	46.52
	GCTAM	55.52
YelpChi	RA	24.75
	TAM	18.29
	GCTAM	42.84

Appendix

Table 4: Comparison of affinity truncation scores.

Dataset	Lr	Epochs	Neighbors k	$\beta$	Layers	HiddenSize
Amazon	1e-5	500	20	0.9	2	128
YelpChi	1e-5	500	55	0.0	2	128
ACM	1e-5	500	25	0.3	2	128
Facebook	1e-5	500	20	0.3	2	128
Reddit	1e-5	500	20	0.1	2	128
Amazon-all	1e-5	500	20	0.9	2	128

Appendix

Table 5: Hyperparameter settings on each dataset.

Figure 6: Amazon-all and Facebook Affinity Truncation Score Compare

Method	Dataset
Method	Amazon	YelpChi	ACM	Facebook	Reddit
CoLA	821	15340	1604	65	2761
TAM	142	683	827	23	161
GCTAM (Ours)	86	369	192	5	89

Appendix

Table 6: Runtime (in seconds) results.

Explore similar work

Aug 17, 2026

RagGAD: Rationale-Aware Conditional Gaussian Mixture Normalizing Flow for Unsupervised Graph Anomaly Detection

Graph anomaly detection aims to identify nodes that deviate from normal behavioral patterns within graphs. However, existing methods largely rely on the homophily assumption, which makes it difficult to distinguish spurious affinities and to capture the diverse behaviors of normal nodes,limiting their robustness in complex real-world scenarios. To address this problem, we propose RagGAD, an unsupervised graph anomaly detection framework based on rationale-aware conditional Gaussian mixture normalizing flow. RagGAD introduces an adaptive rationale disentangler to disentangle stable rationales from spurious correlations within node interrelationships, and further decomposes stable rationales into robust and fragile components. The learned rationales capture underlying interaction patterns that characterize normal behaviors under varying conditions, while anomalies emerge as deviations associated with unstable or spurious correlations. To model the intricate distributions of normal and abnormal nodes, RagGAD integrates rationale-non-rationale Gaussian mixture modeling with a robust-fragile rationale mixture learning strategy. By mitigating spurious homophilic correlations and embracing the heterogeneity of normal patterns, RagGAD identifies anomalies as low-density regions within a structure-aware distribution space. Extensive experiments on multiple benchmark datasets demonstrate that RagGAD outperforms state-of-the-art methods.

Junxin Lu, Jing Zhao, Shiliang Sun

School of Computer Science and Technology, East China Normal University, Shanghai 200062, China · State Key Laboratory of Submarine Geoscience, School of Automation and Intelligent Sensing, Shanghai Jiao Tong University, 800 Dongchuan Road, Shanghai 200240, China

Unsupervised Anomaly Detection Anomaly Detection Gaussian Mixture Models

Ask PDF

Apr 29, 2026

Context-Aware Graph Attention for Unsupervised Telco Anomaly Detection

We propose C-MTAD-GAT, an unsupervised, context-aware graph-attention model for anomaly detection in multivariate time series from mobile networks. C-MTAD-GAT combines graph attention with lightweight context embeddings, and uses a deterministic reconstruction head and multi-step forecaster to produce anomaly scores. Detection thresholds are calibrated without labels from validation residuals, keeping the pipeline fully unsupervised. On the public TELCO dataset, C-MTAD-GAT consistently outperforms MTAD-GAT and the Telco-specific DC-VAE, two state-of-the-art baselines, in both event-level and pointwise F1, while triggering substantially fewer alarms. C-MTAD-GAT is also deployed in the Core network of a national mobile operator, demonstrating its resilience in real industrial settings.

Sara Malacarne, Eirik Hoel-Høiseth, Erlend Aune +2

Telenor Research and Innovation, Norway · Norwegian University of Science and Technology (NTNU), Norway · Hance, Norway +2

Graph Attention Networks Reconstruction-Based Anomaly Detection Unsupervised Anomaly Detection Time-Series Anomaly Detection Anomaly Detection

Ask PDF

Sep 16, 2026

FoundAna: A GNN-assisted Foundation Model for Graph Anomaly Detection

Graph anomaly detection aims to identify graph structures (e.g., nodes, edges, or subgraphs) that deviate significantly from expected patterns, which supports critical applications in fraud detection, spam identification, network intrusion, etc. Despite the growing methods in the field, existing approaches follow a one-model-per-dataset paradigm, limiting their transferability across diverse real-world scenarios due to task heterogeneity, label scarcity, and domain variability. In this work, we introduce FoundAna, a GNN-assisted Foundation Model for Graph Anomaly Detection - the first foundation model framework designated for generalizable, cross-graph anomaly detection by combining GNNs and transformers. FoundAna integrates an anomaly detection-specific GNN component with a standard transformer encoder augmented by four complementary positional encodings, which enable the model to capture both local and global structural information. Specifically, the positional encoding enriched node representations are passed through attribute and adjacency decoders, and the reconstruction errors serve as the anomaly score. Extensive experiments on nine benchmark datasets spanning financial, social, and citation network domains demonstrate that FoundAna consistently outperforms state-of-the-art baselines. The code implementation and Supplementary materials are here: https://github.com/FoundAna331/FoundAna.

Suprim Nakarmi, Chahana Dahal, Yue Zhao +2

Department of Computer Science, University of Nevada Las Vegas, Las Vegas, USA · Department of Computer Science, University of Southern California, Los Angeles, USA

Graph Neural Networks Reconstruction-Based Anomaly Detection Graph Foundation Models Anomaly Detection

Ask PDF