GLASS: Graph-Language Alignment with Spherical Scoring for Transferable Graph-Level Anomaly Detection

Xudong Wang; Chris Ding; Tongxin Li; Jicong Fan

cs.LGSep 4, 2026

GLASS: Graph-Language Alignment with Spherical Scoring for Transferable Graph-Level Anomaly Detection

Authors: Xudong Wang, Chris Ding, Tongxin Li, Jicong Fan

Organizations: School of Data Science, The Chinese University of Hong Kong, Shenzhen (CUHK-Shenzhen), China

Abstract

We introduce GLASS, a framework for graph-level anomaly detection (GLAD) that achieves robust cross-domain transferability through graph-language alignment on the unit hypersphere. GLASS builds a unified representation space by aligning a structure-aware graph encoder with an instruction-aware text embedding via a multi-slice soft cosine objective. Our framework serializes local, global, and semantic graph properties into a compact Graph Descriptor Prompt (GraphDP), creating a text bridge that enables domain-agnostic anomaly scoring. By enforcing multi-scale consistency through Matryoshka representation slices, the model captures anomalous deviations at multiple levels of granularity. We formulate anomaly detection as density estimation on the aligned hypersphere and introduce Spherical Multi-Modal Scoring (SMS), which instantiates von Mises-Fisher kernel density estimators in both graph and text embedding spaces. This probabilistic formulation recovers angular 1-nearest-neighbor scoring in the high-concentration limit, motivates the practical mean k-nearest-neighbor scorer, and provides a principled fusion of structural and semantic anomaly signals. The shared text embedding space further serves as a cross-domain bridge: by encoding a target domain's GraphDP without target-domain training data, GLASS performs zero-shot anomaly detection, and with only a handful of normal examples, few-shot adaptation via reference-set calibration. For privacy-sensitive deployment, we extend reference-set calibration with a bounded joint graph-text kernel summary that provides graph-record differential privacy while keeping the encoders fixed independently of the private target references. Across twelve benchmarks and three meta-domains, GLASS obtains the best average AUROC and rank compared with recent advanced GLAD baselines and enables effective cross-domain transfer.

Figures & tables

Fig. 1: Overview of GLASS . Local Topology Descriptors (LTDs) and graph attributes feed the graph encoder, while GraphDP embeds the same structural evidence through a frozen instruction-aware text encoder. Native Matryoshka text slices anchor graph-side alignment, and vMF prototypes shape training geometry. Inference uses angular normal-reference scoring; deployment regimes change reference construction. The optional text-adaptation branch denotes only the appendix LoRA diagnostic: text parameters are frozen in the main and private-reference experiments. The private extension replaces individual references with a released kernel summary (Section VI ).

Method

MUTAG

PROTEINS

D&D

ENZYMES

DHFR

BZR

COX2

AIDS

IMDB-B

NCI1

COLLAB

REDDIT-B

Avg. AUROC

Avg. Rank

Graph Kernel + Detector

PK-SVM

46.06_{\pm 0.47}

49.43_{\pm 0.69}

47.69_{\pm 0.24}

52.45_{\pm 0.29}

48.31_{\pm 0.47}

46.67_{\pm 0.52}

52.15_{\pm 0.16}

50.93_{\pm 0.19}

51.75_{\pm 0.30}

51.39_{\pm 0.19}

49.72_{\pm 0.60}

48.36_{\pm 0.67}

49.58

12.42

PK-iF

47.98_{\pm 0.41}

61.24_{\pm 0.34}

75.29_{\pm 0.46}

49.82_{\pm 0.67}

52.79_{\pm 0.35}

59.08_{\pm 0.29}

52.48_{\pm 0.38}

52.01_{\pm 0.53}

52.83_{\pm 0.51}

50.22_{\pm 0.12}

51.38_{\pm 0.20}

46.19_{\pm 0.21}

54.28

11.25

WL-SVM

62.18_{\pm 0.29}

53.85_{\pm 0.26}

47.98_{\pm 0.32}

53.75_{\pm 0.34}

50.30_{\pm 0.31}

51.16_{\pm 0.36}

53.34_{\pm 0.27}

52.56_{\pm 0.41}

52.98_{\pm 0.69}

54.18_{\pm 0.67}

54.62_{\pm 1.28}

49.50_{\pm 0.54}

53.03

10.67

WL-iF

65.71_{\pm 0.38}

65.75_{\pm 0.35}

70.49_{\pm 0.28}

51.03_{\pm 0.42}

51.64_{\pm 0.22}

51.71_{\pm 0.45}

49.56_{\pm 0.11}

61.42_{\pm 0.50}

51.79_{\pm 0.32}

50.41_{\pm 0.31}

51.41_{\pm 0.39}

49.84_{\pm 0.11}

55.90

11.00

GNN-based Deep Learning Methods

Table 2

Dataset	0.6B	4B	8B
MUTAG	91.42 $\pm$ 0.87	90.98 $\pm$ 1.35	90.96 $\pm$ 1.06
PROTEINS	80.63 $\pm$ 0.42	80.10 $\pm$ 0.76	79.46 $\pm$ 0.81
D&D	79.41 $\pm$ 0.49	80.22 $\pm$ 1.25	78.62 $\pm$ 1.28
ENZYMES	66.20 $\pm$ 0.46	70.51 $\pm$ 0.25	68.42 $\pm$ 0.27
DHFR	69.38 $\pm$ 0.37	69.03 $\pm$ 0.30	68.25 $\pm$ 0.27
BZR	80.93 $\pm$ 0.38	79.77 $\pm$ 0.10	80.23 $\pm$ 0.18

TABLE II: Text-encoder scaling (0.6B, 4B, 8B of Qwen3-Embedding Model) ablation in single-domain AUROC (%) across all 12 datasets. The 0.6B column is the default setting of GLASS .

Source $\to$ Target	Dataset	Transfer	Single	$\Delta$
Mol $\to$ Social	IMDB-B †	$74.65_{\pm 0.38}$	$77.20_{\pm 0.35}$	$-$ 2.6
Mol $\to$ Social	REDDIT-B †	$69.34_{\pm 1.61}$	$88.80_{\pm 0.69}$	$-$ 19.5
Social $\to$ Mol	MUTAG †	$90.95_{\pm 0.77}$	$91.42_{\pm 0.87}$	$-$ 0.5
Social $\to$ Mol	AIDS †	$99.38_{\pm 0.30}$	$99.32_{\pm 0.59}$	+0.06
Mol $\to$ Protein	PROTEINS †	$83.55_{\pm 0.30}$	$80.63_{\pm 0.42}$	+2.9
	D&D †	$83.99_{\pm 1.08}$	$79.41_{\pm 0.49}$	+4.6

TABLE III: Zero-shot cross-domain AUROC (%). Target datasets marked

\dagger

are scored without target-domain training.

$k$	MUTAG †	PROTEINS †	IMDB-B †
0	74.35 $\pm$ 3.68	65.59 $\pm$ 3.56	63.47 $\pm$ 3.68
1	68.15 $\pm$ 3.03	73.33 $\pm$ 3.04	58.97 $\pm$ 2.93
4	68.96 $\pm$ 1.88	74.95 $\pm$ 2.01	62.09 $\pm$ 2.47
8	77.12 $\pm$ 1.47	78.24 $\pm$ 1.37	62.82 $\pm$ 1.60
16	80.05 $\pm$ 1.39	79.69 $\pm$ 1.11	63.50 $\pm$ 1.61
32	84.54 $\pm$ 1.18	79.81 $\pm$ 0.93	63.99 $\pm$ 1.34

TABLE IV: Few-shot target calibration (AUROC %). Parameters are frozen;

k

target normal graphs are used only as references.

Source	Target	$n$	Source NN	Target NN	Exact KDE	Sketch	$\epsilon=1$	$\epsilon=4$	$\epsilon=8$
Mol	PROTEINS	128	$60.55\!\pm\!5.18$	$72.34\!\pm\!1.85$	$74.20\!\pm\!1.83$	$74.03\!\pm\!1.93$	$70.86\!\pm\!2.34$	$73.78\!\pm\!1.87$	$73.89\!\pm\!2.00$
Mol	D&D	128	$59.54\!\pm\!6.19$	$71.74\!\pm\!2.48$	$66.67\!\pm\!3.46$	$66.86\!\pm\!3.27$	$64.04\!\pm\!2.45$	$66.82\!\pm\!3.34$	$66.78\!\pm\!3.43$
Protein	AIDS	128	$29.69\!\pm\!14.76$	$98.74\!\pm\!0.96$	$89.75\!\pm\!5.83$	$88.41\!\pm\!5.65$	$82.31\!\pm\!4.50$	$88.67\!\pm\!4.60$	$88.32\!\pm\!5.54$
Mol	IMDB-B	128	$47.55\!\pm\!5.76$	$57.85\!\pm\!2.87$	$59.91\!\pm\!4.88$	$59.93\!\pm\!4.89$	$57.95\!\pm\!3.21$	$59.70\!\pm\!4.54$	$59.89\!\pm\!4.91$

TABLE V: Private target-reference calibration, AUROC (%). All columns use independently retrained public-source encoders. NN denotes angular mean 5-NN; Exact KDE and Sketch use

\kappa=4

. Private columns use the same target-only sketch,

\delta=10^{-5}

, and one total graph–text budget. Values are mean

\pm

sample standard deviation over four model/split seeds, after averaging ten noise draws per private condition. No checkpoint or scorer is selected using target labels.

Fig. 2: Private reference calibration with independently trained public-source models. Top: privacy-budget sweep at

n=128

; the dashed line is the identical nonprivate target summary. Bottom: reference-size sweep at

\epsilon=4

; the dotted line uses only the public source summary. Source shrinkage fixes

\lambda=n/(n+32)

. Error bars are sample standard deviations across four model/split seeds after averaging ten noise draws, not forty independent training runs.

Target	Graph	Text	Joint	Joint+source
PROTEINS	71.57	53.71	73.78	72.79
D&D	65.79	54.54	66.82	66.03
AIDS	90.92	79.51	88.67	85.55
IMDB-B	59.05	57.17	59.70	59.99

TABLE VI: Private modality and source-prior diagnostics at

n=128

\epsilon=4

. AUROC averaged over four seeds and ten draws. All methods use the same total privacy budget.

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	# Graphs	# Classes	Avg. Nodes	Avg. Edges	Node Labels	Node Attributes	Node Features	Domain
							(w/o attributes)
PROTEINS	1 113	2	39.1	72.8	3 SSE types	1	4 (3)	Protein
D&D	1 178	2	284.3	715.7	89 AA types	–	89 (89)	Protein
ENZYMES	600	6	32.6	62.1	3 SSE types	18	21 (3)	Protein
MUTAG	188	2	17.9	19.8	7 atom types	–	7 (7)	Molecule
DHFR	756	2	42.4	44.5	Atom types	3	56 (53)	Molecule

Appendix

TABLE VII: Statistics of the datasets [ 38 ] used in our experiments. Each graph-level dataset is characterized by the number of graphs, classes, average number of nodes and edges, and node feature dimensions. The “Node Labels” column indicates discrete node types (e.g., atom or amino-acid types), “Node Attributes” indicates additional continuous attributes, and “Node Features” shows the final dimensionality when loading with use_node_attr=True . Values in parentheses show dimensions without attribute loading.

Dataset	Graph	Text	Fusion	vMF	SMS	Fixed	GLASS
AIDS	95.52 $\pm$ 3.29	99.79 $\pm$ 0.01	97.09 $\pm$ 2.02	90.67 $\pm$ 5.86	93.92 $\pm$ 3.32	99.77 $\pm$ 0.03	99.32 $\pm$ 0.59
IMDB-B	68.64 $\pm$ 0.39	74.12 $\pm$ 0.51	74.13 $\pm$ 0.40	68.88 $\pm$ 2.39	65.74 $\pm$ 1.11	77.29 $\pm$ 0.35	77.20 $\pm$ 0.35
PROTEINS	74.83 $\pm$ 0.91	71.31 $\pm$ 1.25	77.08 $\pm$ 0.98	69.19 $\pm$ 1.65	79.70 $\pm$ 0.58	80.63 $\pm$ 0.42	80.63 $\pm$ 0.42
MUTAG	91.07 $\pm$ 1.10	74.20 $\pm$ 1.90	83.19 $\pm$ 1.42	68.96 $\pm$ 0.71	82.30 $\pm$ 2.13	88.77 $\pm$ 0.74	91.42 $\pm$ 0.87
ENZYMES	69.12 $\pm$ 0.40	62.65 $\pm$ 0.26	69.91 $\pm$ 0.64	64.41 $\pm$ 0.89	62.58 $\pm$ 1.09	66.20 $\pm$ 0.46	66.20 $\pm$ 0.46
DHFR	70.18 $\pm$ 0.39	59.09 $\pm$ 0.25	68.25 $\pm$ 0.44	61.33 $\pm$ 0.66	58.26 $\pm$ 0.58	67.80 $\pm$ 0.38	69.38 $\pm$ 0.37

Appendix

TABLE VIII: Scoring ablations (AUROC %, mean

\pm

std over five seeds). Graph/Text/Fusion use individual or fused angular

k

-NN channels; vMF and SMS instantiate the density view; Fixed uses equal graph/text weights with normal-reference calibration; GLASS uses the normal-reference reliability weights here.

Regime	Evidence	Interpretation
Related-domain gain	Mol $\to$ PROTEINS (+2.9), Mol $\to$ D&D (+4.6)	shared substructure vocabulary
Near-lossless coverage	Protein $\to$ MUTAG (+0.4), Social/Protein $\to$ AIDS (+0.06)	compatible normal geometry
Few-shot calibration	PROTEINS $65.59\to 79.81$ from $0\to 32$ shots	target references repair local density
Source dilution	All-domain helps PROTEINS but lowers MUTAG/IMDB-B	heterogeneous references broaden density
Hard target shift	REDDIT-B loses 15–20pp under transfer	different social semantics
Fine-grained gaps	ENZYMES and DHFR remain below the best baselines	missing biochemical substructure fields

Appendix

TABLE IX: Observed transfer regimes and empirical evidence.

Dataset	Frozen	LoRA warm-up	LoRA tuned	$\Delta$ Warm-up	$\Delta$ Frozen
MUTAG	91.42 $\pm$ 0.87	90.02 $\pm$ 1.41	90.31 $\pm$ 1.22	+0.29	$-$ 1.11
PROTEINS	80.63 $\pm$ 0.42	80.05 $\pm$ 0.47	75.36 $\pm$ 0.86	$-$ 4.68	$-$ 5.27
D&D	79.41 $\pm$ 0.49	76.23 $\pm$ 1.56	76.24 $\pm$ 1.84	+0.01	$-$ 3.17
ENZYMES	66.20 $\pm$ 0.46	65.05 $\pm$ 0.73	67.96 $\pm$ 0.63	+2.91	+1.76
DHFR	69.38 $\pm$ 0.37	68.25 $\pm$ 0.29	68.42 $\pm$ 0.26	+0.17	$-$ 0.96
BZR	80.93 $\pm$ 0.38	81.33 $\pm$ 0.20	83.51 $\pm$ 0.22	+2.19	+2.58

Appendix

TABLE X: Frozen text anchors versus LoRA text adaptation under the default 0.6B setting (AUROC %). The frozen column is the single-domain GLASS .

Source	Target	$n$	Source NN	Target NN	Exact KDE	Sketch	$\epsilon=1$	$\epsilon=4$	$\epsilon=8$
Mol	BZR	128	$39.42\!\pm\!5.51$	$77.74\!\pm\!1.49$	$62.76\!\pm\!2.10$	$61.37\!\pm\!3.54$	$59.03\!\pm\!3.07$	$60.92\!\pm\!3.62$	$61.03\!\pm\!3.46$
Mol	COLLAB	128	$26.81\!\pm\!5.83$	$59.94\!\pm\!11.26$	$59.56\!\pm\!15.69$	$55.09\!\pm\!17.16$	$54.28\!\pm\!11.70$	$55.14\!\pm\!15.41$	$55.40\!\pm\!16.76$
Mol	COX2	128	$56.48\!\pm\!8.28$	$59.61\!\pm\!3.21$	$46.00\!\pm\!4.58$	$45.77\!\pm\!4.14$	$45.98\!\pm\!3.48$	$45.75\!\pm\!4.30$	$45.90\!\pm\!3.94$
Mol	D&D	128	$59.54\!\pm\!6.19$	$71.74\!\pm\!2.48$	$66.67\!\pm\!3.46$	$66.86\!\pm\!3.27$	$64.04\!\pm\!2.45$	$66.82\!\pm\!3.34$	$66.78\!\pm\!3.43$
Mol	DHFR	128	$52.73\!\pm\!2.99$	$51.80\!\pm\!4.98$	$43.02\!\pm\!4.31$	$43.31\!\pm\!4.48$	$44.99\!\pm\!3.58$	$43.36\!\pm\!4.50$	$43.64\!\pm\!4.29$
Mol	ENZYMES	128	$48.99\!\pm\!4.79$	$49.11\!\pm\!3.45$	$49.04\!\pm\!5.19$	$49.70\!\pm\!4.86$	$49.53\!\pm\!3.56$	$49.58\!\pm\!4.78$	$49.59\!\pm\!4.95$

Appendix

TABLE XI: Private target-reference calibration, AUROC (%). All columns use independently retrained public-source encoders. NN denotes angular mean 5-NN; Exact KDE and Sketch use

\kappa=4

. Private columns use the same target-only sketch,

\delta=10^{-5}

, and one total graph–text budget. Values are mean

\pm

sample standard deviation over four model/split seeds, after averaging ten noise draws per private condition. No checkpoint or scorer is selected using target labels. All 18 disjoint source–target dataset settings are shown; MUTAG has 100 available reference graphs.

Table 14

Explore similar work

FoundAna: A GNN-assisted Foundation Model for Graph Anomaly Detection
Sep 16, 2026Suprim Nakarmi, Chahana Dahal, Yue Zhao +2Generalist Graph Anomaly Detection Graph Anomaly Detection
Department of Computer Science, University of Nevada Las Vegas, Las Vegas, USA · Department of Computer Science, University of Southern California, Los Angeles, USA
A Zero-shot Generalized Graph Anomaly Detection Framework via Node Reconstruction
Jun 10, 2026Phan Nguyen, Dat Cao, Hien Chu +1Generalist Graph Anomaly Detection Graph Anomaly Detection
School of Computing, KAIST
NeighborDiv: Training-free Zero-shot Generalist Graph Anomaly Detection via Neighbor Diversity
May 20, 2026Kaifeng Wei, Teng Liu, Liang Dong +2Generalist Graph Anomaly Detection Graph Anomaly Detection
School of Software Technology Zhejiang University Ningbo, China · School of Advanced Technology Xi’an Jiaotong-Liverpool University Suzhou, China

Sep 16, 2026, cs.LGJ/K move · Enter open · S save

FoundAna: A GNN-assisted Foundation Model for Graph Anomaly Detection

Suprim Nakarmi, Chahana Dahal, Yue Zhao, Junggab Son+1

Department of Computer Science, University of Nevada Las Vegas, Las Vegas, USA · Department of Computer Science, University of Southern California, Los Angeles, USA

Generalist Graph Anomaly Detection Graph Anomaly Detection Graph Foundation Model Foundation Model

Open paper AskPDF arXiv

Graph anomaly detection aims to identify graph structures (e.g., nodes, edges, or subgraphs) that deviate significantly from expected patterns, which supports critical applications in fraud detection, spam identification, network intrusion, etc. Despite the growing methods in the field, existing approaches follow a one-model-per-dataset paradigm, limiting their transferability across diverse real-world scenarios due to task heterogeneity, label scarcity, and domain variability. In this work, we introduce FoundAna, a GNN-assisted Foundation Model for Graph Anomaly Detection - the first foundation model framework designated for generalizable, cross-graph anomaly detection by combining GNNs and transformers. FoundAna integrates an anomaly detection-specific GNN component with a standard transformer encoder augmented by four complementary positional encodings, which enable the model to capture both local and global structural information. Specifically, the positional encoding enriched node representations are passed through attribute and adjacency decoders, and the reconstruction errors serve as the anomaly score. Extensive experiments on nine benchmark datasets spanning financial, social, and citation network domains demonstrate that FoundAna consistently outperforms state-of-the-art baselines. The code implementation and Supplementary materials are here: https://github.com/FoundAna331/FoundAna.

Abstract

Explore similar work

FoundAna: A GNN-assisted Foundation Model for Graph Anomaly Detection

A Zero-shot Generalized Graph Anomaly Detection Framework via Node Reconstruction

NeighborDiv: Training-free Zero-shot Generalist Graph Anomaly Detection via Neighbor Diversity