Feature-Context Consistency: Unsupervised Adversarial Detection with Drift Stability on Attributed Graphs

Firas Bayram; Maxime Cordy

cs.LGOct 12, 2026

Feature-Context Consistency: Unsupervised Adversarial Detection with Drift Stability on Attributed Graphs

Authors: Firas Bayram, Maxime Cordy

Organizations: SnT, University of Luxembourg Luxembourg

Abstract

Adversarial detection on evolving attributed graphs faces two challenges: fraud labels arrive late or not at all, and natural distributional drift erodes any trained decision boundary. Modern detectors can reach strong detection rates when labels are available and the distribution is stationary; sustaining that quality without labels and under drift is the open problem. We identify feature-context consistency -- the alignment between a node's attributes and its aggregated neighborhood attributes -- as a single structural signal that addresses both. We formalize it as the Context Boost (CB) score within a Restricted Boltzmann Machine framework (CB-RBM) and prove two complementary worst-case guarantees: a strict separation between the expected CB of legitimate and adversarial nodes, with gap growing linearly in model capacity, whenever the adversary's context stays far enough from legitimate neighborhood context; and a Wasserstein-Lipschitz bound on how far the CB distribution moves under natural drift. We validate on XBlock Ethereum phishing (~153K nodes) and Reddit banned-user detection (~11K nodes), with two further datasets in the appendix spanning diverse domains. With zero labels, CB-RBM achieves AUROC >= 0.96 on four adversarial attacks and keeps FPR close to its calibrated 5% target under drift -- outperforming supervised GNNs (hundreds of labels), unsupervised graph-anomaly baselines, and a standard RBM whose FPR collapses to 89-100%. What typically requires separate mechanisms -- label-free operation and drift stability -- here follows from a single structural regularity of the data. Code: https://github.com/serval-uni-lu/CB-RBM.

Figures & tables

Panel of Figure 1 — Figure 1: CB score distributions, with calibrated threshold $\tau^{*}$ (5% FPR).

Panel of Figure 2 — Figure 2: Squared separation gap $[(\Psi{-}\Phi)/\Psi]^{2}$ vs. $\rho_{1}^{\mathrm{eff}}$ (Thm. 1 ).

	Attack	Energy-based		Supervised			Unsupervised
		CB-RBM	Std-RBM	SAGE	GAT	GCN	DOM.	CoLA	GAE
XBlock	Isolated Inj.	99.9 / 100	86.8/51.6	97.6/90.1	91.7/75.2	95.4/80.8	96.9/78.1	56.4/17.2	98.1/89.5
	Feat. Camo	99.9 / 100	51.3/11.0	92.6/77.8	54.6/10.2	84.0/29.7	96.4/72.5	57.3/16.2	96.7/78.7
	Sybil	99.8 / 100	86.8/51.6	98.8/94.9	99.4/ 100	99.6/ 100	98.1/98.8	62.5/21.6	96.6/77.4
	Rel. Camo	97.6/96.8	86.8/51.6	98.6 /92.4	98.2/ 97.8	97.8/87.8	97.0/86.9	72.1/20.2	97.7/88.9
Reddit	Isolated Inj.	99.4 /97.2	60.0/10.7	61.9/0.5	73.5/38.3	82.2/62.8	98.0/91.3	93.7/83.8	99.1/ 97.3

Table 1: Attack benchmark. Each cell: AUROC / TPR@5%FPR (%). Best per row in bold .

Panel of Figure 3 — Figure 3: Combined Score under gradual drift across 20 time steps.

Appendix figures & tables27 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 4 — Figure 4: CB-RBM pipeline. The sign-corrected neighbor mean $\mathbf{c}_{i}$ enters only through the GLU-gated pathway, and the Context Boost is the free-energy reduction due to context, in which the quadratic feature term cancels. The sign vector $\mathbf{s}$ and the threshold $\tau^{*}$ are label-free statistics that can be refreshed on a current unlabeled window without retraining (dashed arrows, Algorithm 1 ).

Dataset	$\rho_{0}$ (A1)	$\beta_{0}$ (A2)	$M_{x}$ (A3)	$M_{c}$ (A3)
XBlock	$0.30$	$0.38$	$6.6$	$23.5$
Reddit	$0.68$	$0.95$	$8.6$	$7.8$

Appendix

Table 2: Verified Assumption 1 – 3 constants on training data.

		XBlock			Reddit
Family	Method	TPR	FPR drift	Combined	TPR	FPR drift	Combined
Ours	CB-RBM	$0.99$	$5.2$	$\mathbf{0.94}$	$0.96$	$8.4$	$\mathbf{0.88}$
Supervised	GraphSAGE	$0.89$	$5.6$	$0.84$	$0.06$	$5.0$	$0.05$
	GAT	$0.71$	$11.6$	$0.63$	$0.32$	$4.6$	$0.31$
	GCN	$0.75$	$5.4$	$0.71$	$0.36$	$4.6$	$0.35$
	XGBGraph	$0.98$	$17.8$	$0.81$	$0.01$	$0.0$	$0.01$

Appendix

Table 3: All detectors at the last drift step,

T{=}20

	Method	Isolated Inj.	Feat. Camo	Sybil	Rel. Camo
XBlock	XGBGraph	$99.9$ / $99.3$	$98.9$ / $93.2$	$99.9$ / $99.7$	$99.7$ / $99.9$
	Graph Transformer	$98.5$ / $94.2$	$92.7$ / $71.6$	$98.7$ / $95.2$	$97.1$ / $86.2$
	BWGNN	$83.4$ / $28.5$	$65.1$ / $3.0$	$99.1$ / $97.1$	$97.8$ / $88.0$
	GDN	$95.8$ / $90.3$	$90.2$ / $79.0$	$99.1$ / $96.2$	$65.4$ / $44.3$
	ARC	$94.8$ / $40.0$	$94.9$ / $40.0$	$92.3$ / $40.0$	$91.0$ / $39.5$
	GAD-NR	$99.7$ / $100.0$	$99.4$ / $100.0$	$60.1$ / $0.0$	$82.0$ / $12.3$

Appendix

Table 4: Per-attack AUROC / TPR@5%FPR (%).

	XBlock			Reddit
Fraud in pool	FPR	AUROC	Rel. Camo TPR	FPR	AUROC	Rel. Camo TPR
$0\%$ (clean)	$4.6$	$0.99$	$80.5$	$4.0$	$0.98$	$65.5$
Natural	$4.3$	$0.99$	$85.6$	$4.5$	$0.98$	$63.5$
$5\%$	$3.4$	$0.99$	$68.2$	$4.6$	$0.98$	$70.0$
$10\%$	$2.7$	$0.99$	$39.0$	$5.0$	$0.98$	$66.0$

Appendix

Table 5: Fraud in the training and calibration pools (FPR and TPR in %).

	XBlock			Reddit
Flipped	FPR	Iso. TPR	FPR after refresh	FPR	Iso. TPR	FPR after refresh
$0\%$	$5.0$	$100.0$	$5.0$	$5.0$	$97.5$	$5.0$
$10\%$	$19.1$	$100.0$	$5.0$	$11.6$	$99.0$	$5.0$
$25\%$	$94.4$	$100.0$	$5.0$	$93.4$	$98.0$	$5.0$
$50\%$	$99.9$	$100.0$	$5.0$	$97.5$	$97.5$	$5.0$

Appendix

Table 6: Sign vector with a share of its dimensions flipped, and after re-estimating it without labels (FPR and TPR in %).

XBlock ( $38$ dimensions)			Reddit ( $73$ dimensions)
$n$	Wrong dimensions	FPR	$n$	Wrong dimensions	FPR
$763$	$1.4\pm 0.8$	$6.9\pm 1.7$	$53$	$1.0\pm 0.9$	$28.7\pm 33.8$
$1{,}526$	$0.8\pm 0.8$	$6.5\pm 2.8$	$106$	$1.0\pm 0.9$	$28.7\pm 33.8$
$7{,}630$	$0.6\pm 0.5$	$5.1\pm 0.1$	$530$	$0.2\pm 0.4$	$6.0\pm 2.0$
$15{,}260$	$0.4\pm 0.5$	$5.1\pm 0.1$	$1{,}061$	$0.0\pm 0.0$	$5.0\pm 0.0$
$152{,}600$	$0.0\pm 0.0$	$5.0\pm 0.0$	$10{,}618$	$0.0\pm 0.0$	$5.0\pm 0.0$

Appendix

Table 7: Sign vector estimated from

n

unlabeled legitimate nodes (FPR in %).

\pm

is the standard deviation over 5 seeds.

Condition	Features	Context	XBlock	Reddit
A	adversarial	random	$0.942$	$0.921$
B	legitimate	random	$0.942$	$0.929$
C	legitimate	legitimate	$0.078$	$0.095$
D	adversarial	legitimate	$0.111$	$0.632$

Appendix

Table 8: Feature-context decomposition, Combined Score.

Dataset	Node	CB	Coherent units	Mean gated context
XBlock	Legitimate (median CB)	$1046.0$	$111/256$	$+7.36$
	Same node after $20$ drift steps	$952.0$	$88/256$	$+6.51$
	Injected adversary	$28.4$	$97/256$	$+0.55$
Reddit	Legitimate (median CB)	$116.2$	$57/128$	$+2.41$
	Same node after $20$ drift steps	$115.5$	$52/128$	$+2.45$
	Injected adversary	$33.8$	$34/128$	$+1.39$

Appendix

Table 9: Unit-level trace through the trained models.

Figure 5: Capacity ablation. Shaded band shows min–max Combined Score across all four attacks at each $n_{h}$ . Dashed vertical lines mark the optimal values: $n_{h}{=}256$ for XBlock, $n_{h}{=}128$ for Reddit.

Attack	Mean	Max	Weighted-deg.	Attention
Isolated Injection	$0.950$	$0.914$	$0.930$	$0.950$
PGD	$0.326$	$0.145$	$0.224$	$0.263$

Appendix

Table 10: Pooling operator on XBlock, Combined Score.

Figure 6: White-box PGD budget sweep. Detection AUROC vs. perturbation budget $\epsilon$ .

	XBlock		Reddit
Regime	CB-RBM	Std-RBM	CB-RBM	Std-RBM
Gaussian	$8.4$	$96.4$	$9.0$	$73.8$
Correlated $\rho{=}0.3$	$12.8$	$95.8$	$2.8$	$74.0$
Correlated $\rho{=}0.6$	$15.4$	$97.2$	$0.2$	$69.0$
Heavy-tail $\mathrm{df}{=}10$	$10.8$	$95.2$	$9.0$	$71.2$
Heavy-tail $\mathrm{df}{=}3$	$7.6$	$73.8$	$6.6$	$55.2$

Appendix

Table 11: Drift-induced FPR at

T{=}20

under five drift regimes (%).

Dataset	$L$	$\delta_{\mathrm{drift}}$	$T$	RMS-based budget	Observed $\|\Delta\mathrm{CB}\|$	Slack
XBlock	$1189.5$	$1.23$	$5$	$7{,}288$	$23.3$	$312\times$
			$10$	$14{,}575$	$35.7$	$408\times$
			$15$	$21{,}863$	$46.1$	$474\times$
			$20$	$29{,}151$	$55.4$	$\mathbf{526\times}$
Reddit	$154.0$	$1.70$	$5$	$1{,}313$	$0.68$	$1{,}921\times$
			$10$	$2{,}625$	$1.03$	$2{,}549\times$

Appendix

Table 12: Wasserstein–Lipschitz bound vs. observed CB shift on legitimate nodes (Gaussian drift).

L

is the Lipschitz constant of

\mathrm{CB}

evaluated at the RMS value of

M_{c}

(Appendix C );

\delta_{\mathrm{drift}}

is the per-step

W_{1}

budget; the RMS-based budget is

L\cdot T\cdot\delta_{\mathrm{drift}}

; slack is budget

/

observed.

	XBlock		Reddit
$T$	Threshold shift	FPR	Threshold shift	FPR
$1$	$5.6\pm 1.9$	$5.1\pm 0.1$	$0.18\pm 0.01$	$5.1\pm 0.0$
$5$	$14.1\pm 4.2$	$5.4\pm 0.1$	$0.84\pm 0.23$	$5.5\pm 0.1$
$10$	$27.3\pm 5.8$	$5.6\pm 0.1$	$1.67\pm 0.31$	$6.0\pm 0.1$
$15$	$34.2\pm 6.6$	$5.8\pm 0.1$	$2.55\pm 0.27$	$6.4\pm 0.2$
$20$	$42.7\pm 5.9$	$6.1\pm 0.1$	$3.41\pm 0.27$	$7.1\pm 0.3$

Appendix

Table 13: Shift of the

95

th-percentile threshold and FPR (%) at the threshold frozen at

t{=}0

\pm

is the standard deviation over 3 drift seeds.

	XBlock		Reddit
Regime	$\rho$	FPR	$\rho$	FPR
Co-evolving (reference)	$0.141$	$5.4$	$0.615$	$7.5$
Context lag, $L{=}5$	$0.141$	$5.3$	$0.588$	$8.2$
Context lag, $L{=}10$	$0.142$	$5.3$	$0.567$	$9.4$
Context lag, $L{=}20$	$0.144$	$5.6$	$0.509$	$10.6$
Private drift, $p{=}0.3$	$0.138$	$5.4$	$0.602$	$8.0$

Appendix

Table 14: Correlation-weakening drift at

T{=}20

, measured

\rho

and legitimate FPR (%) at the frozen threshold. Each block has its own co-evolving reference run.

	XBlock		Reddit
Method	Frozen	Refreshed	Frozen	Refreshed
CB-RBM	$0.92$	$\mathbf{0.90}$	$0.88$	$\mathbf{0.90}$
Std-RBM	$0.003$	$0.004$	$0.016$	$0.014$
GraphSAGE	$0.82$	$0.82$	$0.06$	$0.06$
GAT	$0.60$	$0.61$	$0.11$	$0.11$
GCN	$0.74$	$0.72$	$0.15$	$0.15$

Appendix

Table 15: Threshold recalibration for the eight methods of Table 1 under the co-evolving drift at

T{=}20

, Combined Score before and after, from this experiment’s run. Best refreshed score in bold.

Panel of Figure 7 — Figure 7: XBlock real-temporal validation. (Left) FPR and (right) TPR at the calibrated $5\%$ -FPR operating point across five windows (trained and calibrated on the 2017 window, evaluated on 2017–2018 windows).

	XBlock		Reddit
Scenario	CB-RBM	Std-RBM	CB-RBM	Std-RBM
Natural drift (benign)	never	$15$	never	$23$
Sybil	$0$	never	$0$	never
Relation Camouflage	$0$	never	$0$	never
Isolated Injection	$18$	never	$24$	never
Feature Camouflage	$24$	never	$26$	never

Appendix

Table 16: First-fire step

T

(first

T

with

\geq\!90\%

200

target nodes flagged). Lower is better for adversarial rows; “never” is correct for natural drift.

		XBlock		Reddit
Step	Clique size	CB-RBM	Std-RBM	CB-RBM	Std-RBM
$0$	$2$	$92.3$	$51.3$	$61.0$	$9.5$
$10$	$12$	$100.0$	$51.3$	$100.0$	$9.5$
$20$	$21$	$100.0$	$51.3$	$100.0$	$9.5$
$30$	$31$	$100.0$	$51.3$	$100.0$	$9.5$
$40$	$40$	$100.0$	$51.3$	$100.0$	$9.5$

Appendix

Table 17: Fraction of attack nodes flagged (%) as the Sybil clique grows from

2

50

members.

Panel of Figure 8 — Figure 8: Context interpolation sweep, detection view. TPR at the calibrated $5\%$ -FPR operating point vs $\alpha$ ; the $50\%$ crossing marks $\alpha^{*}$ .

Panel of Figure 9 — Figure 9: Context interpolation sweep, separation view. Tail-band quantities $\hat{\Psi}$ (legit $5^{\rm th}$ -pctile), $\hat{\Phi}$ (attack $95^{\rm th}$ -pctile), and empirical tail-band midpoint $\hat{\tau}=(\hat{\Psi}+\hat{\Phi})/2$ ; shaded band is $|\hat{\Phi}-\hat{\Psi}|$ , with magnitudes at $\alpha{=}0,1$ annotated.

Attack	Energy-based		Supervised			Unsupervised
	CB-RBM	Std-RBM	SAGE	GAT	GCN	DOM.	CoLA	GAE
Isolated Inj.	96.4 / 89.3	51.2/4.2	88.4/52.5	72.0/34.0	92.8/58.7	73.3/23.7	55.0/26.2	92.7/77.8
Feat. Camo	97.5 / 87.8	51.2/6.0	66.7/28.0	54.4/18.7	70.0/34.3	77.9/33.5	57.6/38.5	95.4/86.5
Sybil	98.9/96.7	51.2/4.2	97.1/86.7	98.9/ 100	99.1/ 100	97.3/96.7	68.1/40.5	99.8 / 100
Rel. Camo	97.2 / 79.0	51.2/4.2	79.4/13.7	80.1/22.3	77.6/15.7	68.6/15.5	63.8/11.7	57.6/12.7

Appendix

Table 18: Attack benchmark on Tolokers. Each cell: AUROC / TPR@5%FPR (%). Best per row in bold .

	Energy-based		Supervised			Unsupervised
	CB-RBM	Std-RBM	SAGE	GAT	GCN	DOM.	CoLA	GAE
Mean TPR	0.882	0.047	0.452	0.438	0.522	0.424	0.292	0.693
Stability	0.936	0.676	0.890	0.934	0.944	0.940	0.782	0.686
Combined Score	0.826	0.031	0.403	0.409	0.493	0.398	0.229	0.475

Appendix

Table 19: Tolokers drift evaluation at

T{=}20

: mean TPR (across the 4 attacks), drift stability, and Combined Score.

Attack	Energy-based		Supervised			Unsupervised
	CB-RBM	Std-RBM	SAGE	GAT	GCN	DOM.	CoLA	GAE
Isolated Inj.	76.6/34.5	50.3/10.5	98.6 / 93.3	79.0/53.0	87.2/74.3	82.7/26.5	80.3/35.0	73.6/20.5
Feat. Camo	78.9/41.5	62.9/14.5	89.6 / 62.7	56.8/27.0	64.4/35.8	80.3/15.0	85.5/48.5	70.0/12.5
Sybil	74.9/15.0	50.3/10.5	98.9/94.2	99.5/ 100.0	99.8 / 100.0	73.1/15.5	60.0/5.5	61.7/12.0
Rel. Camo	98.2 / 86.5	50.3/10.5	97.5/83.8	82.7/41.7	79.2/11.0	72.8/15.5	61.8/11.5	61.5/11.5

Appendix

Table 20: Attack benchmark on YelpChi (net_rtr). Each cell: AUROC / TPR@5%FPR (%). Best per row in bold .

	Energy-based		Supervised			Unsupervised
	CB-RBM	Std-RBM	SAGE	GAT	GCN	DOM.	CoLA	GAE
Mean TPR	0.444	0.115	0.835	0.554	0.553	0.181	0.251	0.141
Stability	0.933	0.006	0.861	0.885	0.930	0.598	0.879	0.443
Combined Score	0.414	0.001	0.718	0.490	0.514	0.108	0.221	0.062

Appendix

Table 21: YelpChi (net_rtr) drift evaluation at

T{=}20

: mean TPR (across the 4 attacks), drift stability, and Combined Score.

	Unsupervised				Supervised
	Std-RBM	DOMINANT	GAE	CoLA	SAGE	GAT	GCN
YelpChi	93.5	89.9	93.2	87.6	91.0	90.9	92.9

Appendix

Table 22: YelpChi rescue rates (%) at

T{=}20

Explore similar work

Graph Anomaly Detection as Finite-Horizon Control: Training-Free Scoring via Empirical Bayes
Sep 29, 2026Fred Xu, Thomas Markovich, Florence Regol +1Anomaly Detection
University of California, Los Angeles · Block · Mila – Quebec AI Institute
NK-GAD: Neighbor Knowledge-Enhanced Unsupervised Graph Anomaly Detection
Apr 17, 2026Zehao Wang, Lanjun WangGraph Neural Networks Reconstruction-Based Anomaly Detection
College of Intelligence and Computing, Tianjin University, Tianjin, China · School of New Media and Communication, Tianjin University, Tianjin, China
Generalist Graph Anomaly Detection via Prototype-Based Distillation
May 26, 2026Yiming Xu, Zihan Chen, Zhen Peng +4Unsupervised Anomaly Detection Zero-Shot Anomaly Detection
School of Computer Science and Technology, Xi’an Jiao-tong University, Xi’an, China · National Engineering Research Center for Visual Information and Applications, Xi’an, China · University of Virginia, Charlottesville, USA +3

Sep 29, 2026J/K move · Enter open · S save

Graph Anomaly Detection as Finite-Horizon Control: Training-Free Scoring via Empirical Bayes

Fred Xu, Thomas Markovich, Florence Regol, Yizhou Sun

University of California, Los Angeles · Block · Mila – Quebec AI Institute

Anomaly Detection

Open paper AskPDF arXiv

Node-level graph anomaly detection (GAD) identifies nodes whose attributes and interactions deviate from dominant graph regularities. Existing GAD models encode normality and anomaly scoring indirectly through architectures, message passing, reconstruction or contrastive objectives, and tuned score families. This entangles graph trust (how strongly graph structure should define normality), graph-spectral weighting, and anomaly-score choice, yielding scores that are costly, opaque, and unstable across graph regimes. We propose EB-GAD (Empirical-Bayes GAD), a training-free framework that models normality as graph-aware generalized Ornstein-Uhlenbeck (GOU) relaxation toward a graph-filtered template. Empirical Bayes fits the graph precision from the residual-field likelihood; the GOU then turns scoring into a closed-form finite-horizon control energy, the minimum effort to steer a feature-neutral node to its observed endpoint along graph-spectral relaxation. Sweeping relaxation horizon and endpoint tolerance yields a bank of scores that share one fitted prior: equilibrium Mahalanobis scoring is one limit, while finite-horizon control-energy and scale-normalized ratio scores reveal anomalies that static equilibrium scoring can mask. A label-free selector chooses the score family from feature homophily, edge density, and feature dimension, then ranks candidates by fitted-null deviation and rank stability. On 11 benchmarks and without labels at any step, EB-GAD has the best or tied-best AUROC on 9: the four financial fraud networks (up to 3.7M nodes), the YelpChi and Amazon review graphs, Weibo, Reddit and Facebook, with margins of up to 21.7 points. It is second on BlogCatalog and ACM.

Abstract

Explore similar work

Graph Anomaly Detection as Finite-Horizon Control: Training-Free Scoring via Empirical Bayes

NK-GAD: Neighbor Knowledge-Enhanced Unsupervised Graph Anomaly Detection

Generalist Graph Anomaly Detection via Prototype-Based Distillation