Online Test-Time Adaptation for Generalizable Dynamic Graph Anomaly Detection
Authors: Jialun Zheng, Hanchen Yang, Jiannong Cao, Yankai Chen, Yuanjing Feng, Philip S. Yu
Organizations: Department of Computing, The Hong Kong Polytechnic University, Hong Kong, China · Department of Computer Science, University of Illinois at Chicago (UIC), Chicago, IL, USA · Institute of Information Processing and Automation, Zhejiang University of Technology, Zhejiang, China
Generalizable dynamic graph anomaly detection (DGAD) enables pretrained detectors to identify anomalies in unseen target domains without costly retraining. However, existing methods often fail for two reasons. First, they mainly rely on domain-agnostic patterns and miss domain-specific patterns that keep evolving. Second, they assume access to the full target domain data, whereas in more practical online test-time adaptation settings, target data arrive sequentially in unlabeled chunks. To address these limitations, we formulate online test-time adaptation for generalizable DGAD and propose OTTA-DGAD. OTTA-DGAD first extracts dynamic prototypes, i.e., evolving representations of normal and anomalous patterns, from temporal ego-graphs and stores them in a memory buffer. The buffer selectively retains general patterns shared across the source domains used for pretraining while incorporating new patterns from the target domain. An anomaly scorer then compares incoming edge representations against these prototypes to identify both general and domain-specific anomalies. During adaptation, OTTA-DGAD updates the memory buffer using reliable pseudo-labels identified through confidence-based detection. It further enriches each target chunk with relevant representations retained from previous chunks, compensating for information loss resulting from the sequential arrival of data. Extensive experiments under strict test-then-adapt OTTA settings demonstrate state-of-the-art performance on ten real-world datasets from diverse domains.
Figures & tables
Fig. 1: Motivating experiments. (a) Anomalous patterns change over time, chunks and cross datasets. (b) Existing generalist methods capture only domain agnostic patterns, without cross chunk information preservation. (c) Our method, OTTA-DGAD, captures both domain-agnostic and domain-specific patterns. Cross chunk information is also preserved.
Fig. 2: General framework of OTTA-DGAD . (a) Starting with the first source dataset, we extract ego-graphs to capture temporal patterns and store the most distinct prototype pairs in a memory buffer. (b) As we pretrain on the following source datasets, new domain-specific patterns are added while general domain-agnostic patterns are retained. Prototype distributions are then compared with edge embeddings for anomaly scoring. (c) On target chunks, reliable detections, measured by prediction entropy and agreement with neighboring edges, provide pseudo-labels for memory updates. The buffer retains representations with high similarity to chunk distribution, which we define as coverage score and different with stored entries. These representations enrich subsequent chunks with cross-chunk context, while the generalist model remains frozen.
Dataset
Domain
#Nodes
#Edges
Avg. Degree
Wikipedia
Online Collaboration
9,227
157,474
34.13
Bitcoin-OTC
Transaction Network
5,881
35,588
12.10
Bitcoin-Alpha
Transaction Network
3,777
24,173
12.80
Email-DNC
Online Communication
1,866
39,264
42.08
UCI Messages
Online Communication
1,899
13,838
14.57
AS-Topology
Autonomous Systems
34,761
171,420
9.86
TABLE I: Statistics of datasets
Metrics
Category
Methods
AS-Topology
Bitcoin-Alpha
Email-DNC
UCI Messages
Bitcoin-OTC
TAX51
DBLP
Synthetic-Hijack
1%
5%
10%
1%
5%
10%
1%
5%
10%
1%
5%
10%
1%
5%
10%
1%
5%
10%
1%
5%
10%
1%
5%
10%
AUROC
DGADs
SAD
40.16
43.81
43.43
57.61
55.59
60.27
50.05
54.54
52.28
56.91
58.28
59.74
70.04
69.19
74.12
42.52
43.56
46.39
43.02
42.98
47.87
59.85
59.67
58.14
SLADE
40.47
42.21
44.42
60.62
59.25
62.98
47.98
50.37
52.11
54.64
55.28
58.32
67.34
66.35
70.44
46.68
48.04
49.33
42.11
41.17
41.35
60.53
60.34
59.99
FALCON
46.73
50.24
53.09
57.13
61.48
66.76
76.81
72.71
75.02
59.36
57.05
62.22
67.37
68.43
70.16
45.27
48.79
50.28
44.41
46.30
47.11
59.06
60.17
65.55
GeneralDyG
41.99
43.51
45.80
62.26
63.03
65.09
50.93
52.63
54.78
50.33
53.50
58.91
70.91
71.77
73.84
52.79
50.58
50.42
48.33
47.34
46.78
56.78
53.47
54.02
TADDY
40.11
42.57
41.08
43.69
45.44
42.03
50.77
53.27
56.90
49.82
50.39
56.12
44.47
50.79
48.72
40.48
42.21
46.94
40.32
40.59
42.40
58.77
60.59
62.10
TABLE II: Overall model performance under the OTTA setting across eight datasets with three anomaly percentages.
Fig. 3: Visualization of chunk-wise metric and coefficient of variation over domain/chunks on TAX51 10% anomaly ratio.
Metric
Variants
Dataset
AS-Topology
Bitcoin-Alpha
Email-DNC
UCI Messages
Bitcoin-OTC
TAX51
DBLP
Synthetic-Hijack
AUROC
w/o DPA
53.64
62.21
66.77
58.90
70.53
44.11
49.06
60.12
w/o DPAD
40.10
45.03
47.82
50.41
54.74
48.09
45.09
47.22
w/o CDGA
63.34
69.98
72.50
60.19
74.57
60.13
55.58
70.26
w/o Wiki
60.01
53.16
67.21
52.83
48.04
46.32
50.28
67.97
w/o MOOC
55.86
60.07
53.15
60.37
62.94
56.36
46.12
58.81
TABLE III: Ablation results of different variants of OTTA-DGAD.
Fig. 4: Impact of dynamic prototype memory buffer size M , momentum α , confident detection Ncon and chunk size on the OTTA-DGAD performance .
Fig. 5: Effect of Cross-Chunk Context Enrichment and Structural-Guided Pseudo-labeling accuracy.
A significant number of anomalous nodes in the real world, such as fake news, noncompliant users, malicious transactions, and malicious posts, severely compromises the health of the graph data ecosystem and urgently requires effective identification and processing. With anomalies that span multiple data domains yet exhibit vast differences in features, cross-domain detection models face severe domain shift issues, which limit their generalizability across all domains. This study identifies and quantitatively analyzes a specific feature mismatch pattern exhibited by domain shift in graph anomaly detection, which we define as the Anomaly Disassortativity issue (AD). Based on the modeling of the issue AD, we introduce a novel graph foundation model for anomaly detection. It achieves cross-domain generalization in different graphs, requiring only a single training phase to perform effectively across diverse domains. The experimental findings, based on fourteen diverse real-world graphs, confirm a breakthrough in the model's cross-domain adaptation, achieving a pioneering state-of-the-art (SOTA) level in terms of detection accuracy. In summary, the proposed theory of AD provides a novel theoretical perspective and a practical route for future research in generalist graph anomaly detection (GGAD). The code is available at https://anonymous.4open.science/r/Anonymization-TA-GGAD/.
Xiong Zhang, Hong Peng, Changlong Fu +3
School of Software and AI, Yunnan University, Kunming, China
Test-time adaptation (TTA) on graphs aims to adapt a graph neural network (GNN) that is well-trained on the training graph to the test graph, which involves potential distribution shifts that may harm model generalization and test-time inference. While recent efforts have investigated TTA on static graphs, there is still a research gap on dynamic graphs learned with dynamic GNN (DGNN) models, where both structural connectivity and node semantics evolve continuously over time. This makes adapting a DGNN model for reliable test-time performance substantially challenging. To fill this gap, in this work, we propose a novel framework of temporal memory-aware Online Test-Time Adaptation on Dynamic Graphs, named DGOTTA, to effectively adapt well-trained DGNNs during test time. Specifically, the proposed DGOTTA contains three modules: (1) temporal-aware augmentation, to extend the diversity of test dynamic graphs for addressing complex temporal and spatial shifts; (2) memory-aware model prediction, to alleviate catastrophic forgetting; (3) consistency-guided online adaptation, to enforce temporal alignment and memory smoothness. Extensive experiments on three real-world datasets and four DGNN backbones demonstrate that DGOTTA significantly improves generalization under diverse distribution shifts and multiple model architectures.
Bo Li, Xin Zheng, Ming Jin +2
Griffith University, Gold Coast, Australia · RMIT University, Melbourne, Australia
Cross-domain graph anomaly detection (GAD) aims to identify abnormal nodes in unseen target graphs, showing strong potential in real-world applications with heterogeneous graph data. However, existing methods often depend on dataset-specific feature semantics and structural patterns, which limits their ability to generalize across different domains. To address this challenge, we propose AlignGAD, a zero-shot generalized graph anomaly detection framework. Our framework is built upon three key components: a Global Unification Module that aligns heterogeneous node features and normalizes graph signals in the spectral domain; a Clustering Module that constructs cluster-aware graph views to capture group-level abnormal patterns; and a Node Discrepancy Scoring Module that measures reconstruction discrepancy and aggregates anomaly evidence from different graph views. Experiments on multiple real-world datasets demonstrate the effectiveness of AlignGAD under the zero-shot GAD setting.