GLASS: Graph-Language Alignment with Spherical Scoring for Transferable Graph-Level Anomaly Detection

Xudong Wang; Chris Ding; Tongxin Li; Jicong Fan

cs.LGSep 4, 2026

GLASS: Graph-Language Alignment with Spherical Scoring for Transferable Graph-Level Anomaly Detection

Authors: Xudong Wang, Chris Ding, Tongxin Li, Jicong Fan

Organizations: School of Data Science, The Chinese University of Hong Kong, Shenzhen (CUHK-Shenzhen), China

Abstract

We introduce GLASS, a framework for graph-level anomaly detection (GLAD) that achieves robust cross-domain transferability through graph-language alignment on the unit hypersphere. GLASS builds a unified representation space by aligning a structure-aware graph encoder with an instruction-aware text embedding via a multi-slice soft cosine objective. Our framework serializes local, global, and semantic graph properties into a compact Graph Descriptor Prompt (GraphDP), creating a text bridge that enables domain-agnostic anomaly scoring. By enforcing multi-scale consistency through Matryoshka representation slices, the model captures anomalous deviations at multiple levels of granularity. We formulate anomaly detection as density estimation on the aligned hypersphere and introduce Spherical Multi-Modal Scoring (SMS), which instantiates von Mises-Fisher kernel density estimators in both graph and text embedding spaces. This probabilistic formulation recovers angular 1-nearest-neighbor scoring in the high-concentration limit, motivates the practical mean k-nearest-neighbor scorer, and provides a principled fusion of structural and semantic anomaly signals. The shared text embedding space further serves as a cross-domain bridge: by encoding a target domain's GraphDP without target-domain training data, GLASS performs zero-shot anomaly detection, and with only a handful of normal examples, few-shot adaptation via reference-set calibration. For privacy-sensitive deployment, we extend reference-set calibration with a bounded joint graph-text kernel summary that provides graph-record differential privacy while keeping the encoders fixed independently of the private target references. Across twelve benchmarks and three meta-domains, GLASS obtains the best average AUROC and rank compared with recent advanced GLAD baselines and enables effective cross-domain transfer.

Figures & tables

Fig. 1: Overview of GLASS . Local Topology Descriptors (LTDs) and graph attributes feed the graph encoder, while GraphDP embeds the same structural evidence through a frozen instruction-aware text encoder. Native Matryoshka text slices anchor graph-side alignment, and vMF prototypes shape training geometry. Inference uses angular normal-reference scoring; deployment regimes change reference construction. The optional text-adaptation branch denotes only the appendix LoRA diagnostic: text parameters are frozen in the main and private-reference experiments. The private extension replaces individual references with a released kernel summary (Section VI ).

Method

MUTAG

PROTEINS

D&D

ENZYMES

DHFR

BZR

COX2

AIDS

IMDB-B

NCI1

COLLAB

REDDIT-B

Avg. AUROC

Avg. Rank

Graph Kernel + Detector

PK-SVM

46.06_{\pm 0.47}

49.43_{\pm 0.69}

47.69_{\pm 0.24}

52.45_{\pm 0.29}

48.31_{\pm 0.47}

46.67_{\pm 0.52}

52.15_{\pm 0.16}

50.93_{\pm 0.19}

51.75_{\pm 0.30}

51.39_{\pm 0.19}

49.72_{\pm 0.60}

48.36_{\pm 0.67}

49.58

12.42

PK-iF

47.98_{\pm 0.41}

61.24_{\pm 0.34}

75.29_{\pm 0.46}

49.82_{\pm 0.67}

52.79_{\pm 0.35}

59.08_{\pm 0.29}

52.48_{\pm 0.38}

52.01_{\pm 0.53}

52.83_{\pm 0.51}

50.22_{\pm 0.12}

51.38_{\pm 0.20}

46.19_{\pm 0.21}

54.28

11.25

WL-SVM

62.18_{\pm 0.29}

53.85_{\pm 0.26}

47.98_{\pm 0.32}

53.75_{\pm 0.34}

50.30_{\pm 0.31}

51.16_{\pm 0.36}

53.34_{\pm 0.27}

52.56_{\pm 0.41}

52.98_{\pm 0.69}

54.18_{\pm 0.67}

54.62_{\pm 1.28}

49.50_{\pm 0.54}

53.03

10.67

WL-iF

65.71_{\pm 0.38}

65.75_{\pm 0.35}

70.49_{\pm 0.28}

51.03_{\pm 0.42}

51.64_{\pm 0.22}

51.71_{\pm 0.45}

49.56_{\pm 0.11}

61.42_{\pm 0.50}

51.79_{\pm 0.32}

50.41_{\pm 0.31}

51.41_{\pm 0.39}

49.84_{\pm 0.11}

55.90

11.00

GNN-based Deep Learning Methods

Table 2

Dataset	0.6B	4B	8B
MUTAG	91.42 $\pm$ 0.87	90.98 $\pm$ 1.35	90.96 $\pm$ 1.06
PROTEINS	80.63 $\pm$ 0.42	80.10 $\pm$ 0.76	79.46 $\pm$ 0.81
D&D	79.41 $\pm$ 0.49	80.22 $\pm$ 1.25	78.62 $\pm$ 1.28
ENZYMES	66.20 $\pm$ 0.46	70.51 $\pm$ 0.25	68.42 $\pm$ 0.27
DHFR	69.38 $\pm$ 0.37	69.03 $\pm$ 0.30	68.25 $\pm$ 0.27
BZR	80.93 $\pm$ 0.38	79.77 $\pm$ 0.10	80.23 $\pm$ 0.18

TABLE II: Text-encoder scaling (0.6B, 4B, 8B of Qwen3-Embedding Model) ablation in single-domain AUROC (%) across all 12 datasets. The 0.6B column is the default setting of GLASS .

Source $\to$ Target	Dataset	Transfer	Single	$\Delta$
Mol $\to$ Social	IMDB-B †	$74.65_{\pm 0.38}$	$77.20_{\pm 0.35}$	$-$ 2.6
Mol $\to$ Social	REDDIT-B †	$69.34_{\pm 1.61}$	$88.80_{\pm 0.69}$	$-$ 19.5
Social $\to$ Mol	MUTAG †	$90.95_{\pm 0.77}$	$91.42_{\pm 0.87}$	$-$ 0.5
Social $\to$ Mol	AIDS †	$99.38_{\pm 0.30}$	$99.32_{\pm 0.59}$	+0.06
Mol $\to$ Protein	PROTEINS †	$83.55_{\pm 0.30}$	$80.63_{\pm 0.42}$	+2.9
	D&D †	$83.99_{\pm 1.08}$	$79.41_{\pm 0.49}$	+4.6

TABLE III: Zero-shot cross-domain AUROC (%). Target datasets marked

\dagger

are scored without target-domain training.

$k$	MUTAG †	PROTEINS †	IMDB-B †
0	74.35 $\pm$ 3.68	65.59 $\pm$ 3.56	63.47 $\pm$ 3.68
1	68.15 $\pm$ 3.03	73.33 $\pm$ 3.04	58.97 $\pm$ 2.93
4	68.96 $\pm$ 1.88	74.95 $\pm$ 2.01	62.09 $\pm$ 2.47
8	77.12 $\pm$ 1.47	78.24 $\pm$ 1.37	62.82 $\pm$ 1.60
16	80.05 $\pm$ 1.39	79.69 $\pm$ 1.11	63.50 $\pm$ 1.61
32	84.54 $\pm$ 1.18	79.81 $\pm$ 0.93	63.99 $\pm$ 1.34

TABLE IV: Few-shot target calibration (AUROC %). Parameters are frozen;

k

target normal graphs are used only as references.

Source	Target	$n$	Source NN	Target NN	Exact KDE	Sketch	$\epsilon=1$	$\epsilon=4$	$\epsilon=8$
Mol	PROTEINS	128	$60.55\!\pm\!5.18$	$72.34\!\pm\!1.85$	$74.20\!\pm\!1.83$	$74.03\!\pm\!1.93$	$70.86\!\pm\!2.34$	$73.78\!\pm\!1.87$	$73.89\!\pm\!2.00$
Mol	D&D	128	$59.54\!\pm\!6.19$	$71.74\!\pm\!2.48$	$66.67\!\pm\!3.46$	$66.86\!\pm\!3.27$	$64.04\!\pm\!2.45$	$66.82\!\pm\!3.34$	$66.78\!\pm\!3.43$
Protein	AIDS	128	$29.69\!\pm\!14.76$	$98.74\!\pm\!0.96$	$89.75\!\pm\!5.83$	$88.41\!\pm\!5.65$	$82.31\!\pm\!4.50$	$88.67\!\pm\!4.60$	$88.32\!\pm\!5.54$
Mol	IMDB-B	128	$47.55\!\pm\!5.76$	$57.85\!\pm\!2.87$	$59.91\!\pm\!4.88$	$59.93\!\pm\!4.89$	$57.95\!\pm\!3.21$	$59.70\!\pm\!4.54$	$59.89\!\pm\!4.91$

TABLE V: Private target-reference calibration, AUROC (%). All columns use independently retrained public-source encoders. NN denotes angular mean 5-NN; Exact KDE and Sketch use

\kappa=4

. Private columns use the same target-only sketch,

\delta=10^{-5}

, and one total graph–text budget. Values are mean

\pm

sample standard deviation over four model/split seeds, after averaging ten noise draws per private condition. No checkpoint or scorer is selected using target labels.

Fig. 2: Private reference calibration with independently trained public-source models. Top: privacy-budget sweep at

n=128

; the dashed line is the identical nonprivate target summary. Bottom: reference-size sweep at

\epsilon=4

; the dotted line uses only the public source summary. Source shrinkage fixes

\lambda=n/(n+32)

. Error bars are sample standard deviations across four model/split seeds after averaging ten noise draws, not forty independent training runs.

Target	Graph	Text	Joint	Joint+source
PROTEINS	71.57	53.71	73.78	72.79
D&D	65.79	54.54	66.82	66.03
AIDS	90.92	79.51	88.67	85.55
IMDB-B	59.05	57.17	59.70	59.99

TABLE VI: Private modality and source-prior diagnostics at

n=128

\epsilon=4

. AUROC averaged over four seeds and ten draws. All methods use the same total privacy budget.

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	# Graphs	# Classes	Avg. Nodes	Avg. Edges	Node Labels	Node Attributes	Node Features	Domain
							(w/o attributes)
PROTEINS	1 113	2	39.1	72.8	3 SSE types	1	4 (3)	Protein
D&D	1 178	2	284.3	715.7	89 AA types	–	89 (89)	Protein
ENZYMES	600	6	32.6	62.1	3 SSE types	18	21 (3)	Protein
MUTAG	188	2	17.9	19.8	7 atom types	–	7 (7)	Molecule
DHFR	756	2	42.4	44.5	Atom types	3	56 (53)	Molecule

Appendix

TABLE VII: Statistics of the datasets [ 38 ] used in our experiments. Each graph-level dataset is characterized by the number of graphs, classes, average number of nodes and edges, and node feature dimensions. The “Node Labels” column indicates discrete node types (e.g., atom or amino-acid types), “Node Attributes” indicates additional continuous attributes, and “Node Features” shows the final dimensionality when loading with use_node_attr=True . Values in parentheses show dimensions without attribute loading.

Dataset	Graph	Text	Fusion	vMF	SMS	Fixed	GLASS
AIDS	95.52 $\pm$ 3.29	99.79 $\pm$ 0.01	97.09 $\pm$ 2.02	90.67 $\pm$ 5.86	93.92 $\pm$ 3.32	99.77 $\pm$ 0.03	99.32 $\pm$ 0.59
IMDB-B	68.64 $\pm$ 0.39	74.12 $\pm$ 0.51	74.13 $\pm$ 0.40	68.88 $\pm$ 2.39	65.74 $\pm$ 1.11	77.29 $\pm$ 0.35	77.20 $\pm$ 0.35
PROTEINS	74.83 $\pm$ 0.91	71.31 $\pm$ 1.25	77.08 $\pm$ 0.98	69.19 $\pm$ 1.65	79.70 $\pm$ 0.58	80.63 $\pm$ 0.42	80.63 $\pm$ 0.42
MUTAG	91.07 $\pm$ 1.10	74.20 $\pm$ 1.90	83.19 $\pm$ 1.42	68.96 $\pm$ 0.71	82.30 $\pm$ 2.13	88.77 $\pm$ 0.74	91.42 $\pm$ 0.87
ENZYMES	69.12 $\pm$ 0.40	62.65 $\pm$ 0.26	69.91 $\pm$ 0.64	64.41 $\pm$ 0.89	62.58 $\pm$ 1.09	66.20 $\pm$ 0.46	66.20 $\pm$ 0.46
DHFR	70.18 $\pm$ 0.39	59.09 $\pm$ 0.25	68.25 $\pm$ 0.44	61.33 $\pm$ 0.66	58.26 $\pm$ 0.58	67.80 $\pm$ 0.38	69.38 $\pm$ 0.37

Appendix

TABLE VIII: Scoring ablations (AUROC %, mean

\pm

std over five seeds). Graph/Text/Fusion use individual or fused angular

k

-NN channels; vMF and SMS instantiate the density view; Fixed uses equal graph/text weights with normal-reference calibration; GLASS uses the normal-reference reliability weights here.

Regime	Evidence	Interpretation
Related-domain gain	Mol $\to$ PROTEINS (+2.9), Mol $\to$ D&D (+4.6)	shared substructure vocabulary
Near-lossless coverage	Protein $\to$ MUTAG (+0.4), Social/Protein $\to$ AIDS (+0.06)	compatible normal geometry
Few-shot calibration	PROTEINS $65.59\to 79.81$ from $0\to 32$ shots	target references repair local density
Source dilution	All-domain helps PROTEINS but lowers MUTAG/IMDB-B	heterogeneous references broaden density
Hard target shift	REDDIT-B loses 15–20pp under transfer	different social semantics
Fine-grained gaps	ENZYMES and DHFR remain below the best baselines	missing biochemical substructure fields

Appendix

TABLE IX: Observed transfer regimes and empirical evidence.

Dataset	Frozen	LoRA warm-up	LoRA tuned	$\Delta$ Warm-up	$\Delta$ Frozen
MUTAG	91.42 $\pm$ 0.87	90.02 $\pm$ 1.41	90.31 $\pm$ 1.22	+0.29	$-$ 1.11
PROTEINS	80.63 $\pm$ 0.42	80.05 $\pm$ 0.47	75.36 $\pm$ 0.86	$-$ 4.68	$-$ 5.27
D&D	79.41 $\pm$ 0.49	76.23 $\pm$ 1.56	76.24 $\pm$ 1.84	+0.01	$-$ 3.17
ENZYMES	66.20 $\pm$ 0.46	65.05 $\pm$ 0.73	67.96 $\pm$ 0.63	+2.91	+1.76
DHFR	69.38 $\pm$ 0.37	68.25 $\pm$ 0.29	68.42 $\pm$ 0.26	+0.17	$-$ 0.96
BZR	80.93 $\pm$ 0.38	81.33 $\pm$ 0.20	83.51 $\pm$ 0.22	+2.19	+2.58

Appendix

TABLE X: Frozen text anchors versus LoRA text adaptation under the default 0.6B setting (AUROC %). The frozen column is the single-domain GLASS .

Source	Target	$n$	Source NN	Target NN	Exact KDE	Sketch	$\epsilon=1$	$\epsilon=4$	$\epsilon=8$
Mol	BZR	128	$39.42\!\pm\!5.51$	$77.74\!\pm\!1.49$	$62.76\!\pm\!2.10$	$61.37\!\pm\!3.54$	$59.03\!\pm\!3.07$	$60.92\!\pm\!3.62$	$61.03\!\pm\!3.46$
Mol	COLLAB	128	$26.81\!\pm\!5.83$	$59.94\!\pm\!11.26$	$59.56\!\pm\!15.69$	$55.09\!\pm\!17.16$	$54.28\!\pm\!11.70$	$55.14\!\pm\!15.41$	$55.40\!\pm\!16.76$
Mol	COX2	128	$56.48\!\pm\!8.28$	$59.61\!\pm\!3.21$	$46.00\!\pm\!4.58$	$45.77\!\pm\!4.14$	$45.98\!\pm\!3.48$	$45.75\!\pm\!4.30$	$45.90\!\pm\!3.94$
Mol	D&D	128	$59.54\!\pm\!6.19$	$71.74\!\pm\!2.48$	$66.67\!\pm\!3.46$	$66.86\!\pm\!3.27$	$64.04\!\pm\!2.45$	$66.82\!\pm\!3.34$	$66.78\!\pm\!3.43$
Mol	DHFR	128	$52.73\!\pm\!2.99$	$51.80\!\pm\!4.98$	$43.02\!\pm\!4.31$	$43.31\!\pm\!4.48$	$44.99\!\pm\!3.58$	$43.36\!\pm\!4.50$	$43.64\!\pm\!4.29$
Mol	ENZYMES	128	$48.99\!\pm\!4.79$	$49.11\!\pm\!3.45$	$49.04\!\pm\!5.19$	$49.70\!\pm\!4.86$	$49.53\!\pm\!3.56$	$49.58\!\pm\!4.78$	$49.59\!\pm\!4.95$

Appendix

TABLE XI: Private target-reference calibration, AUROC (%). All columns use independently retrained public-source encoders. NN denotes angular mean 5-NN; Exact KDE and Sketch use

\kappa=4

. Private columns use the same target-only sketch,

\delta=10^{-5}

, and one total graph–text budget. Values are mean

\pm

sample standard deviation over four model/split seeds, after averaging ten noise draws per private condition. No checkpoint or scorer is selected using target labels. All 18 disjoint source–target dataset settings are shown; MUTAG has 100 available reference graphs.

Table 14

Explore similar work

Sep 16, 2026cs.LG

FoundAna: A GNN-assisted Foundation Model for Graph Anomaly Detection

Graph anomaly detection aims to identify graph structures (e.g., nodes, edges, or subgraphs) that deviate significantly from expected patterns, which supports critical applications in fraud detection, spam identification, network intrusion, etc. Despite the growing methods in the field, existing approaches follow a one-model-per-dataset paradigm, limiting their transferability across diverse real-world scenarios due to task heterogeneity, label scarcity, and domain variability. In this work, we introduce FoundAna, a GNN-assisted Foundation Model for Graph Anomaly Detection - the first foundation model framework designated for generalizable, cross-graph anomaly detection by combining GNNs and transformers. FoundAna integrates an anomaly detection-specific GNN component with a standard transformer encoder augmented by four complementary positional encodings, which enable the model to capture both local and global structural information. Specifically, the positional encoding enriched node representations are passed through attribute and adjacency decoders, and the reconstruction errors serve as the anomaly score. Extensive experiments on nine benchmark datasets spanning financial, social, and citation network domains demonstrate that FoundAna consistently outperforms state-of-the-art baselines. The code implementation and Supplementary materials are here: https://github.com/FoundAna331/FoundAna.

Suprim Nakarmi, Chahana Dahal, Yue Zhao +2

Department of Computer Science, University of Nevada Las Vegas, Las Vegas, USA · Department of Computer Science, University of Southern California, Los Angeles, USA

Generalist Graph Anomaly Detection Graph Anomaly Detection Graph Foundation Model Foundation Model

Ask PDF

Jun 10, 2026cs.LG

A Zero-shot Generalized Graph Anomaly Detection Framework via Node Reconstruction

Cross-domain graph anomaly detection (GAD) aims to identify abnormal nodes in unseen target graphs, showing strong potential in real-world applications with heterogeneous graph data. However, existing methods often depend on dataset-specific feature semantics and structural patterns, which limits their ability to generalize across different domains. To address this challenge, we propose AlignGAD, a zero-shot generalized graph anomaly detection framework. Our framework is built upon three key components: a Global Unification Module that aligns heterogeneous node features and normalizes graph signals in the spectral domain; a Clustering Module that constructs cluster-aware graph views to capture group-level abnormal patterns; and a Node Discrepancy Scoring Module that measures reconstruction discrepancy and aggregates anomaly evidence from different graph views. Experiments on multiple real-world datasets demonstrate the effectiveness of AlignGAD under the zero-shot GAD setting.

Phan Nguyen, Dat Cao, Hien Chu +1

School of Computing, KAIST

Generalist Graph Anomaly Detection Graph Anomaly Detection Spectral

Ask PDF

May 20, 2026cs.LG

NeighborDiv: Training-free Zero-shot Generalist Graph Anomaly Detection via Neighbor Diversity

Graph Anomaly Detection (GAD) is increasingly shifting to Generalist GAD (GGAD) for cross-domain "one-for-all" detection, but existing GGAD methods predominantly rely on the neighbor consistency principle, falling into the \textbf{Node-to-Neighbor Consistency Paradigm} for anomaly quantification. These methods suffer from complex training pipelines, heavy training data dependency, high computational costs, and unstable cross-domain generalization. To address these limitations, we propose NeighborDiv, a training-free generalist graph anomaly detection framework based on neighbor diversity. Departing from the dominant Node-to-Neighbor Consistency Paradigm, we shift the focus to the \textbf{Neighbor-to-Neighbor Diversity Paradigm}, and uncover that the internal structural dispersion of a node's neighbor set is a powerful, independently discriminative anomaly signal. We quantify neighbor diversity via the variance of inter-neighbor feature similarities, which captures how a node organizes its local graph environment, and operates independently of conventional node-to-neighbor consistency frameworks. Extensive experiments under two standard GGAD evaluation paradigms show NeighborDiv achieves state-of-the-art performance, with relative gains of 10.25% in average AUC and 17.78% in average AP over the second-best baseline under Single-Domain Independent Training (SDIT), and 6.89%/9.58% in AUC/AP under Unified Multi-Domain Training (UMDT), respectively. Notably, NeighborDiv yields zero performance volatility across all datasets, eliminating training-set dependency and establishing a lightweight and highly practical GGAD framework.

Kaifeng Wei, Teng Liu, Liang Dong +2

School of Software Technology Zhejiang University Ningbo, China · School of Advanced Technology Xi’an Jiaotong-Liverpool University Suzhou, China

Generalist Graph Anomaly Detection Graph Anomaly Detection Diversity Training-Free

Ask PDF