Towards Anomaly-Aware Pre-Training and Fine-Tuning for Graph Anomaly Detection

## Abstract

Abstract Graph anomaly detection (GAD) has garnered increasing attention in recent years, yet remains challenging due to two key factors:
(1) label scarcity stemming from the high cost of annotations and
(2) homophily disparity at node and class levels.
In this paper, we introduce A nomaly-Aware P re-Training and F ine-Tuning (APF), a targeted and effective framework to mitigate the above challenges in GAD.
In the pre-training stage, APF incorporates node-specific subgraphs selected via the Rayleigh Quotient, a label-free anomaly metric, into the learning objective to enhance anomaly awareness.
It further introduces two learnable spectral polynomial filters to jointly learn dual representations that capture both general semantics and subtle anomaly cues.
During fine-tuning, a gated fusion mechanism adaptively integrates pre-trained representations across nodes and dimensions, while an anomaly-aware regularization loss encourages abnormal nodes to preserve more anomaly-relevant information.
Furthermore, we theoretically show that APF tends to achieve linear separability under mild conditions.
Comprehensive experiments on 10 benchmark datasets validate the superior performance of APF in comparison to state-of-the-art baselines.

## 1 Introduction

Graph anomaly detection (GAD) aims to identify a small but significant portion of instances, such as abnormal nodes, that deviate significantly from the standard, normal, or prevalent patterns within graph-structured data GADSurvey.
The detection of these anomalies is crucial for various scenarios, such as financial fraud in transaction networks FraudSurvey1; FraudSurvey2, fake news and bots in social media FakeNewsSurvey; BotSurvey, and sensor faults in IoT networks IoTSurvey1; IoTSurvey2.
Given their strong ability to model relational structure, graph neural networks (GNNs) have recently emerged as a leading choice for tackling GAD.

Despite notable progress, most existing GAD methods CARE-GNN; PCGNN; BWGNN; GHRN are not tailored for label-scarce scenarios, leading to suboptimal performance in real-world deployments where annotations are costly.
Recent semi-supervised attempts, such as pseudo-labeling UPS; ConsisGAD and synthetic sample generation CGenGA; GGAD, seek to mitigate this but often suffer from instability due to the inherent uncertainty and confirmation bias that compromise performance UPS.
In contrast, the pre-training-and-fine-tuning paradigm has shown great promise in label-scarce learning across CV SimCLRv2; SSLEL, NLP BERT; TAPT, and graph learning GRACE; DEGL.
A recent study GPT further reveals that general-purpose graph pre-training strategies DGI; GraphMAE can match or even outperform GAD-specific methods under limited supervision.
Despite their strong potential, existing graph pre-training-and-fine-tuning frameworks are primarily designed to extract task-agnostic semantic knowledge.
As such, they fail to address GAD’s unique challenges, falling short in capturing anomaly-relevant cues and leaving their adaptation to GAD an unsolved yet pressing task.

In the context of GAD, global homophily, the same-class edge ratio over the entire graph, tends to decrease due to challenges like camouflage CARE-GNN, making it an intuitive yet common anomaly indicator.
Nonetheless, we highlight that local homophily, the class consistency within each node’s neighborhood, reveals more nuanced disparity patterns, capturing localized yet often overlooked anomaly signals.
As illustrated in Figures [1(a)](https://arxiv.org/html/2504.14250v2#S1.F1.sf1) and [1(b)](https://arxiv.org/html/2504.14250v2#S1.F1.sf2), these disparities manifest at two granularities:
(1) node-level disparity represents the high variations in local homophily across individual nodes and
(2) class-level disparity refers to lower local homophily for abnormal nodes.
Most existing approaches are built around global homophily and employ uniform processing schemes, such as edge reweighting H2-FDetector; GHRN or spectral filtering BWGNN; AMNet.
However, such globally uniform designs lack node-adaptive mechanisms necessary to accommodate the structural diversity of individual nodes, resulting in inconsistent anomaly distinguishability across nodes in different local homophily groups, as further evidenced in Figures [1(c)](https://arxiv.org/html/2504.14250v2#S1.F1.sf3) and [1(d)](https://arxiv.org/html/2504.14250v2#S1.F1.sf4).
These limitations jointly highlight a critical challenge: *How can we devise a GAD-specific pre-training-and-fine-tuning framework that effectively handles dual-granularity local homophily disparity?*

Figure: (a) Weibo
Refer to caption: x1.png

Present Work.
To address this challenge, we introduce Anomaly-Aware Pre-Training and Fine-Tuning (APF), a novel framework designed for GAD under limited supervision, grounded in anomaly-aware pre-training and granularity-adaptive fine-tuning to handle homophily disparity.

In the context of anomaly-aware pre-training, APF harnesses the Rayleigh Quotient, a label-free metric for quantifying anomaly degree, to reduce reliance on label-dependent anomaly measures.
In particular, building upon conventional pre-training objectives, we incorporate node-wise subgraphs, each selected to maximize the Rayleigh Quotient, into the objective to enhance anomaly awareness.
We further adopt learnable spectral polynomial filters to jointly optimize two distinct representations: one capturing general semantic patterns and the other focusing on subtle anomaly cues.
This dual-objective design effectively captures node-wise structural disparity, offering more informative initializations for downstream detection tasks.

To enable granularity-adaptive fine-tuning, APF employs a gated fusion network that adaptively combines pre-trained representations at both the node and dimension levels.
An anomaly-aware regularization loss is further introduced to encourage abnormal nodes to retain more anomaly-relevant information from pre-trained representations than normal nodes.
Together, these components explicitly address local homophily disparity, by aligning the fine-tuning with the homophily disparity at node and class levels under label-guided optimization.
Theoretical analysis further shows that, under mild conditions, APF tends to achieve linear separability across all nodes.

Empirically, extensive experiments on 10 benchmark datasets are conducted to verify the superior performance of APF, demonstrating its effectiveness against label scarcity.

## 2 Preliminary

In this section, we briefly introduce notations and key concepts.
Detailed preliminaries and related works are provided in Appendix [A](https://arxiv.org/html/2504.14250v2#A1) and Appendix [B](https://arxiv.org/html/2504.14250v2#A2), respectively.

##### Graph Anomaly Detection (GAD).

Let $\mathcal{G}=(\mathcal{V},\mathcal{E},\boldsymbol{X})$ be a graph with $n$ nodes and edges $\mathcal{E}$.
Each node $v_{i}$ has a $d$-dimensional feature $\boldsymbol{x}_{i}$, forming the feature matrix $\boldsymbol{X}\in\mathbb{R}^{n\times d}$.
The adjacency matrix is $\boldsymbol{A}$, and $\boldsymbol{D}$ is the diagonal degree matrix. The neighbor set of $v_{i}$ is denoted as $\mathcal{N}_{i}$.
GAD is framed as a binary classification problem where anomalies are regarded as positive with label 1.
Given labeled nodes $\mathcal{V}^{L}=\mathcal{V}_{a}\cup\mathcal{V}_{a}$ with labels $\boldsymbol{y}^{L}$, the goal is to predict $\boldsymbol{\hat{y}}^{U}$ for unlabeled nodes.
Real-world settings typically exhibit extreme label scarcity ($|\mathcal{V}^{L}|\ll|\mathcal{V}|$) and class imbalance ($|\mathcal{V}_{a}|\ll|\mathcal{V}_{n}|$).

##### Local Homophily.

Given a node $v_{i}$, its local homophily $h_{i}$ is defined as the fraction of neighbors in $\mathcal{N}_{i}$ that share the same label:

$$ $h_{i}=\frac{|v_{j}\in\mathcal{N}_{i}:y_{i}=y_{j}|}{|\mathcal{N}_{i}|}.$ (1) $$

We then compute the average local homophily of abnormal and normal nodes, denoted by $h^{a}$ and $h^{n}$, respectively, as:

$$ $h^{a}=\frac{\sum_{y_{i}=1}h_{i}}{\sum_{y_{i}=1}1},\quad h^{n}=\frac{\sum_{y_{i }=0}h_{i}}{\sum_{y_{i}=0}1}.$ (2) $$

Both metrics are bounded within $[0,1]$.
Table [3](https://arxiv.org/html/2504.14250v2#A7.T3) summarizes the values of $h^{a}$ and $h^{n}$ across datasets, where $h^{a}$ is consistently lower than $h^{n}$, highlighting the presence of class-level homophily disparity.

##### Graph Spectral Filtering.

Given the adjacency matrix $\boldsymbol{A}$, the graph Laplacian is defined as $\boldsymbol{L}=\boldsymbol{D}-\boldsymbol{A}$, which is symmetric and positive semi-definite.
Their symmetric normalized versions are noted as $\tilde{\boldsymbol{A}}=\boldsymbol{D}^{-1/2}\boldsymbol{A}\boldsymbol{D}^{-1/2}$ and $\tilde{\boldsymbol{L}}=\boldsymbol{I}-\boldsymbol{D}^{-1/2}\boldsymbol{A}
\boldsymbol{D}^{-1/2}$.
It admits eigendecomposition $\tilde{\boldsymbol{L}}=\boldsymbol{U}\boldsymbol{\Lambda}\boldsymbol{U}^{\top}$, where $\boldsymbol{U}\in\mathbb{R}^{n\times n}$ contains orthonormal eigenvectors (the graph Fourier basis) and $\boldsymbol{\Lambda}=\operatorname{diag}(\lambda_{1},\cdots,\lambda_{n})$ are eigenvalues ordered as $0=\lambda_{1}\leq\cdots\leq\lambda_{n}\leq 2$ (frequencies).
The graph spectral filtering is then defined as $\boldsymbol{\hat{X}}=\boldsymbol{U}g(\boldsymbol{\Lambda})\boldsymbol{U}^{\top
}\boldsymbol{X}$, where $g(\cdot)$ denotes the spectral filter.

## 3 Methodology

In this section, we formally introduce our APF framework, a targeted and effective solution tailored to the unique challenges in GAD.
The overall framework is illustrated in Figure [2](https://arxiv.org/html/2504.14250v2#S3.F2).

### 3.1 Anomaly-Aware Pre-Training

##### Label-free Anomaly Indicator.

Most existing graph pre-training strategies DGI; CCA-SSG; BGRL; GraphMAE; BLNN are designed to optimize task-agnostic objectives.
As a result, the learned representations primarily encode general semantic knowledge.
In contrast, the goal of GAD is to capture subtle anomaly cues that differentiate minority abnormal instances.
However, many of these cues, such as relation camouflage CARE-GNN; PCGNN, are inherently label-dependent, making them difficult to capture under the label-free pre-training.

This motivates the incorporation of effective label-free anomaly measures into the learning objective to guide the representation toward anomaly-aware semantics.
Recent findings reveal that the existence of anomalies induces the ‘right-shift’ phenomenon BWGNN; GHRN, where spectral energy distribution concentrates more on high frequencies.
The corresponding accumulated spectral energy can be quantified by the Rayleigh Quotient RQ:

$$ $RQ(\boldsymbol{x},\boldsymbol{L})=\frac{\boldsymbol{x}^{T}\boldsymbol{L} \boldsymbol{x}}{\boldsymbol{x}^{T}\boldsymbol{x}}=\frac{\sum_{i=1}^{n}\lambda_ {i}\hat{x}_{i}^{2}}{\sum_{i=1}^{n}\hat{x}_{i}^{2}}=\frac{\sum_{i,j}A_{ij}(x_{j }-x_{i})^{2}}{\sum_{i=1}^{n}x_{i}^{2}},$ (3) $$

where $\boldsymbol{x}\in\mathbb{R}^{n}$ represents a general graph signal and $\hat{\boldsymbol{x}}=\boldsymbol{U}^{T}\boldsymbol{x}$ denotes its projection in spectral space.
By definition, Rayleigh Quotient also quantifies global structural diversity, yielding higher values in the presence of relation camouflage.
The following lemma further illustrates the relationship between the Rayleigh Quotient and anomaly information.

###### Lemma 1 .

The Rayleigh Quotient $RQ(x,L)$, which represents the accumulated spectral energy of a graph signal, increases monotonically with the anomaly degree. BWGNN

Given this, Rayleigh Quotient stands out as a promising label-free anomaly metric.
To guide each node $v_{i}$ in capturing its potential anomaly cues, we employ MRQSampler UniGAD to extract its 2-hop sub-tree $\mathcal{G}_{i}^{RQ}$.
Each sub-tree is selected to maximize the Rayleigh Quotient, thereby preserving as much anomaly-relevant signal and structural diversity as possible.

###### Lemma 1 .

##### Dual-filter Encoding.

Beyond the learning objective, the architectural modules for encoding anomaly-relevant information are equally critical.
Recent studies highlight that capturing high-frequency components is essential for modeling heterophilic patterns FAGCN; ACM; EvenNet.
Motivated by this, we complement the conventional low-pass encoder with an additional high-pass encoder to better capture anomaly cues.
To facilitate flexible spectral encoding, we adopt the learnable $K$-order Chebyshev polynomial ChebNet2 and restrict it to fit only low-pass and high-pass filters, denoted by $g_{L}(\cdot)$ and $g_{H}(\cdot)$, following prior work PolyGCL:

$$ $g_{L}(\hat{\boldsymbol{L}})=\sum_{k=0}^{K}w_{k}^{L}T_{k}(\hat{\boldsymbol{L}}) ,\,g_{H}(\hat{\boldsymbol{L}})=\sum_{k=0}^{K}w_{k}^{H}T_{k}(\hat{\boldsymbol{L }}),$ (4) $$

where $\hat{\boldsymbol{L}}=2\tilde{\boldsymbol{L}}/\lambda_{n}-\boldsymbol{I}$ denotes the scaled Laplacian matrix.
The Chebyshev polynomials are recursively defined as $T_{k}(x)=2xT_{k-1}(x)-T_{k-2}(x)$ with $T_{0}(x)=1$ and $T_{1}(x)=x$.
The coefficients are computed as:

$$ $w_{k}^{L}=\frac{2}{M+1}\sum_{i=1}^{K}\gamma_{i}^{L}T_{k}(t_{i}),\,w_{k}^{H}= \frac{2}{M+1}\sum_{i=1}^{K}\gamma_{i}^{H}T_{k}(t_{i}),$ (5) $$

where $t_{i}=\cos(\frac{i+1/2}{K+1}\pi),i=0,\cdots,K$ denotes the Chebyshev nodes for $T_{K+1}(x)$.
The filter values $\gamma_{m}^{L}$ and $\gamma_{m}^{H}$ is determined by:

$$ $\gamma_{k}^{L}=\gamma_{0}-\sum_{j=1}^{k}\gamma_{j},\,\gamma_{k}^{H}=\sum_{j=0} ^{k}\gamma_{j},$ (6) $$

where $\boldsymbol{\gamma}=(\gamma_{0},\cdots,\gamma_{M})$ is the shared learnable parameter with $\gamma_{0}=\gamma_{0}^{L}=\gamma_{0}^{H}$.
As per PolyGCL, we have $\gamma_{i}^{H}\leq\gamma_{i+1}^{H}$ and $\gamma_{i}^{L}\geq\gamma_{i+1}^{L}$, thus guarantee the high-pass/low-pass property for $g_{L}(\cdot)$/$g_{H}(\cdot)$.
Given such, our low-pass and high-pass encoders are formulated as:

$$ $\boldsymbol{Z}_{L}=f_{\theta_{L}}\left(g_{L}(\hat{\boldsymbol{L}})\boldsymbol{ X}\right),\,\boldsymbol{Z}_{H}=f_{\theta_{H}}\left(g_{H}(\hat{\boldsymbol{L}}) \boldsymbol{X}\right),$ (7) $$

where $\boldsymbol{Z}_{L},\boldsymbol{Z}_{H}\in\mathbb{R}^{n\times e}$ denote the low-pass and high-pass node representations respectively.
$f_{\theta_{L}}(\cdot),f_{\theta_{H}}(\cdot)$ represent the learnable MLP for each filter.

Figure: Figure 2: Overview of our proposed APF.
Refer to caption: x5.png

##### Optimization.

We build our anomaly-aware pre-training framework upon DGI DGI, owing to its efficiency and proven ability to capture semantic structure.
To encode general semantic knowledge, we follow the standard DGI formulation using low-pass encoders.
To capture subtle anomaly cues, we further extend this paradigm by maximizing the mutual information between each node and the summary of its Rayleigh Quotient-guided sub-tree, computed from high-pass encoders.

Let $\tilde{\boldsymbol{Z}}_{L}$ and $\tilde{\boldsymbol{Z}}_{H}$ denote the negative samples generated from randomly shuffled inputs DGI.
Our dual-objective pre-training loss is formulated as:

$$ $\displaystyle\mathcal{L}_{pt}=$ $\displaystyle-\frac{1}{n}\sum_{i}^{n}\left(\log\mathcal{D}\left(\boldsymbol{Z} _{i}^{L},\boldsymbol{s}^{L}\right)+\log\left(1-\mathcal{D}\left(\tilde{ \boldsymbol{Z}}_{i}^{L},\boldsymbol{s}^{L}\right)\right)\right)$ (8) $\displaystyle-\frac{1}{n}\sum_{i}^{n}\left(\log\mathcal{D}\left(\boldsymbol{Z} _{i}^{H},\boldsymbol{s}_{i}^{H}\right)+\log\left(1-\mathcal{D}\left(\tilde{ \boldsymbol{Z}}_{i}^{H},\boldsymbol{s}_{i}^{H}\right)\right)\right),$ $$

where $\boldsymbol{s}^{L}=\frac{1}{n}\sum_{i=1}^{n}\boldsymbol{Z}_{i}^{L}$ is the global summary and $\boldsymbol{s}_{i}^{H}=\frac{1}{|\mathcal{G}_{i}^{RQ}|}\sum_{v_{j}\in\mathcal{
G}_{i}^{RQ}}\boldsymbol{Z}_{j}^{H}$ is the summary over the Rayleigh Quotient-based sub-tree of node $v_{i}$.
The discriminator is defined as $\mathcal{D}(\boldsymbol{z},\boldsymbol{s})=\sigma(\boldsymbol{z}^{\top}
\boldsymbol{W}\boldsymbol{s})$.
This dual-objective formulation enables the encoders to jointly capture task-agnostic semantic knowledge and node-specific structural disparities, yielding more informative representations for downstream anomaly detection.

### 3.2 Granularity-Adaptive Fine-Tuning

##### Node- and Dimension-wise Fusion.

After pre-training, we aim to develop a node-adaptive fusion mechanism that selectively combines task-agnostic semantic knowledge ($\boldsymbol{Z}_{L}$) and node-specific structural disparities ($\boldsymbol{Z}_{H}$) from the frozen pre-trained representations.
This fusion is designed to better respond to local homophily variations across nodes under label-guided learning.
Beyond trivial node-wise fusion, prior studies JacobiConv; AdaGNN; GFS highlight that different feature dimensions contribute unequally to downstream tasks, motivating a dimension-aware fusion design.
To this end, we introduce a coefficient matrix $\boldsymbol{C}\in[0,1]^{n\times e}$ to combine $\boldsymbol{Z}_{L}$ and $\boldsymbol{Z}_{H}$ at node and dimension levels:

$$ $\boldsymbol{Z}=\boldsymbol{C}\odot\boldsymbol{Z}_{L}+(1-\boldsymbol{C})\odot \boldsymbol{Z}_{H},$ (9) $$

where $\odot$ denotes the Hadamard product, and $\boldsymbol{Z}$ is the resulting fused representation passed to the classifier.
A naive approach to learn $\boldsymbol{C}$ is treating it as free parameters JacobiConv, but this leads to excessive overhead ($\mathcal{O}(n\times e)$), inefficient learning under sparse supervision, and neglect of input semantics.
To alleviate this, we introduce a lightweight Gated Fusion Network (GFN) that generates coefficients based on the input features:

$$ $\boldsymbol{C}=\sigma\left(\boldsymbol{X}\boldsymbol{W}_{c}+\boldsymbol{b}_{c} \right),$ (10) $$

where $\boldsymbol{W}_{c}\in\mathbb{R}^{d\times e}$ is a learnable matrix and $\boldsymbol{b}_{c}\in\mathbb{R}^{e}$ is a bias term.

The advantages of GFN over direct optimization are multifold:
(1) GFN reduces the learnable parameter complexity of $\boldsymbol{C}$ from $\mathcal{O}(n\times e)$ to $\mathcal{O}((d+1)\times e)$, where $d,e\ll n$;
(2) GFN allows sparse supervision to update the entire coefficient matrix, while direct optimization only affects labeled rows;
(3) GFN leverages raw input features, which encode valuable anomaly-relevant attributes GADBench.

##### Anomaly-aware Regularization Loss.

As indicated by the class-level local homophily disparity, abnormal nodes tend to camouflage themselves by connecting to normal ones.
To account for this behavior, they should rely less on generic knowledge and be assigned more anomaly-relevant cues from pre-trained representations during the fusion process.
To encourage this class-specific fusion preference, we introduce a regularization term that guides the optimization of the coefficient matrix $\boldsymbol{C}$ accordingly.
Let $c_{i}=\frac{1}{e}\sum_{j=1}^{e}\boldsymbol{C}_{ij}$ denote the average fusion weight of node $v_{i}$ toward generic knowledge.
We encourage $c_{i}$ to approach a class-specific target: $p^{a}\in[0,1]$ for abnormal nodes and $p^{n}\in[0,1]$ for normal nodes, with the constraint $p^{a}\leq p^{n}$, to mimic the observed class-level disparity.
The regularization loss is formulated as a binary cross-entropy loss:

$$ $\displaystyle\mathcal{L}_{reg}=$ $\displaystyle-\frac{1}{|\mathcal{V}^{L}|}\sum_{v_{i}\in\mathcal{V}^{L},y_{i}=1 }\left(p^{a}\log c_{i}+(1-p^{a})\log(1-c_{i})\right)$ (11) $\displaystyle-\frac{1}{|\mathcal{V}^{L}|}\sum_{v_{i}\in\mathcal{V}^{L},y_{i}=0 }\left(p^{n}\log c_{i}+(1-p^{n})\log(1-c_{i})\right).$ $$

This encourages the model to incorporate class-level fusion bias and enhances its ability to distinguish anomalies.

##### Optimization.

Given the fused representations $\boldsymbol{Z}$ from Eq. ([9](https://arxiv.org/html/2504.14250v2#S3.E9)), we employ a two-layer MLP to predict the label $\hat{y}_{i}$ for each labeled node $v_{i}$.
The model is optimized using the standard binary cross-entropy loss:

$$ $\mathcal{L}_{bce}=-\frac{1}{|\mathcal{V}^{L}|}\sum_{i\in\mathcal{V}^{L}}\left( y_{i}\log\hat{y}_{i}+(1-y_{i})\log(1-\hat{y}_{i})\right).$ (12) $$

The overall fine-tuning objective combines the classification loss with the regularization term:

$$ $\mathcal{L}_{ft}=\mathcal{L}_{bce}+\mathcal{L}_{reg}.$ (13) $$

### 3.3 Theoretical Insights

In this subsection, we provide a theoretical analysis to support our architectural design.
Our theoretical analysis is grounded in the Contextual Stochastic Block Model (CSBM) CSBM, a widely used generative model for attributed graphs GCTheory; HomoNece; Demy; Node-MoE; HSBM.
To properly reflect the homophily disparity, we introduce a novel variant, the Anomalous Stochastic Block Model (ASBM), which combines homophilic and heterophilic structures within a unified generative framework:

###### Definition 1 ( $ASBM(n_{a},n_{n},\boldsymbol{\mu},\boldsymbol{\nu},(p_{1},q_{1}),(p_{2},q_{2}) ,P_{a},P_{n})$ ) .

ASBM generates two disjoint node sets: abnormal nodes $\mathcal{C}_{a}$ and normal nodes $\mathcal{C}_{n}$, with sizes $n_{a}$ and $n_{n}$, respectively.
Feature matrices $\boldsymbol{X}_{a}\in\mathbb{R}^{n_{a}\times d}$ and $\boldsymbol{X}_{n}\in\mathbb{R}^{n_{n}\times d}$ are sampled row-wise from $\mathcal{N}(\boldsymbol{\mu},\frac{1}{d}\boldsymbol{I})$ and $\mathcal{N}(\boldsymbol{\nu},\frac{1}{d}\boldsymbol{I})$, where $|\boldsymbol{\mu}|_{2},|\boldsymbol{\nu}|_{2}\leq 1$. The full feature matrix $\boldsymbol{X}$ is formed by stacking $[\boldsymbol{X}_{a};\boldsymbol{X}_{n}]$.
Each node can follow either a homophilic or heterophilic connectivity pattern.
In the homophilic regime, edges are generated with intra-class probability $p_{1}$ and inter-class probability $q_{1}$, where $p_{1}>q_{1}$; in the heterophilic regime, $p_{2}<q_{2}$.
We further denote $\mathcal{H}_{o}$ and $\mathcal{H}_{e}$ as the set of homophilic and heterophilic nodes and assume that all nodes share a common expected degree: $p_{1}+q_{1}=p_{2}+q_{2}$.

To examine the impact of different spectral filters on ASBM, following prior analyses GCTheory; Node-MoE, we adopt a linear classifier parameterized by $\boldsymbol{w}\in\mathbb{R}^{d}$ and $b\in\mathbb{R}$.
Here, we denote $\boldsymbol{\hat{X}}=\boldsymbol{U}g(\boldsymbol{\Lambda})\boldsymbol{U}^{\top
}\boldsymbol{X}$ as the frozen filtered features, serving as fixed representations passed to downstream classifiers.
Then, the predicted labels are given by $\boldsymbol{\hat{y}}=\sigma(\boldsymbol{\hat{X}}\boldsymbol{w}+b\boldsymbol{1})$, where $\sigma(\cdot)$ is sigmoid function.
This classifier is optimized using the trivial binary cross-entropy loss defined in Eq. ([12](https://arxiv.org/html/2504.14250v2#S3.E12)).
The separability of this model under node-adaptive filtering is characterized by the following theorem:

###### Theorem 1 .

Assume the graph size $n=n_{a}+n_{n}$ is relatively large with $\omega(d\log d)\leq n\leq\mathcal{O}(poly(d))$, the graph is not too sparse with $p_{1},q_{1},p_{2},q_{2}=\omega(\log^{2}(n)/n)$, the feature center distance is not too small with $\|\boldsymbol{\mu}-\boldsymbol{\nu}\|=\Omega(\frac{\log n}{\sqrt{dn(p_{1}+q_{1
})}})$, the sizes of the homophilic and heterophilic node sets are approximately equal, and the norm of $\|\boldsymbol{w}\|$ is bounded by $\|\boldsymbol{w}\|\leq R$.
For a graph $\mathcal{G}(\mathcal{V},\mathcal{E},\boldsymbol{X})\sim ASBM(n_{a},n_{n},
\boldsymbol{\mu},\boldsymbol{\nu},(p_{1},q_{1}),(p_{2},q_{2}),P_{a},P_{n})$, when low- and high-pass filters are applied separately to the homophilic and heterophilic node sets $\mathcal{H}_{o},\mathcal{H}_{e}$, there exists an optimal $\boldsymbol{w}^{*},b^{*}$ such that all nodes are linearly separable with the following probability:

$$ $\mathbb{P}\left(\left(\boldsymbol{\hat{X}_{i}}\right)_{i\in\mathcal{V}^{L}} \text{is linearly separable}\right)=1-o_{d}(1),$ (14) $$

where $o_{d}(1)$ denotes a quantity that converges to 0 as $d\to\infty$.

The proof is provided in Appendix [D](https://arxiv.org/html/2504.14250v2#A4).
Theorem [1](https://arxiv.org/html/2504.14250v2#Thmtheorem1) theoretically establishes that, under appropriate conditions, adaptively applying low-pass and high-pass filters to nodes based on local homophily is possible to achieve linear separability across all nodes.

Our architectural design follows this principle by first extracting candidate representations for each node using both low-pass and high-pass filters.
These representations are then frozen during the downstream task, aligning with the setting in the theorem where fixed features are used.
Subsequently, the gated fusion network adaptively combines the frozen representations.
Guided by class-specific fusion preferences and classification loss, our model learns to sense local homophily disparity and adjust fusion weights accordingly.
This enables the learned fusion strategy to approximate the node-wise filter assignment in the theorem, allocating representations based on each node’s local homophily, thereby approaching the theoretical bound of linear separability and ultimately improving GAD performance.

###### Definition 1 ( A ⁢ S ⁢ B ⁢ M ⁢ ( n a , n n , 𝝁 , 𝝂 , ( p 1 , q 1 ) , ( p 2 , q 2 ) , P a , P n ) 𝐴 𝑆 𝐵 𝑀 subscript 𝑛 𝑎 subscript 𝑛 𝑛 𝝁 𝝂 subscript 𝑝 1 subscript 𝑞 1 subscript 𝑝 2 subscript 𝑞 2 subscript 𝑃 𝑎 subscript 𝑃 𝑛 ASBM(n_{a},n_{n},\boldsymbol{\mu},\boldsymbol{\nu},(p_{1},q_{1}),(p_{2},q_{2})%
,P_{a},P_{n}) italic_A italic_S italic_B italic_M ( italic_n start_POSTSUBSCRIPT italic_a end_POSTSUBSCRIPT , italic_n start_POSTSUBSCRIPT italic_n end_POSTSUBSCRIPT , bold_italic_μ , bold_italic_ν , ( italic_p start_POSTSUBSCRIPT 1 end_POSTSUBSCRIPT , italic_q start_POSTSUBSCRIPT 1 end_POSTSUBSCRIPT ) , ( italic_p start_POSTSUBSCRIPT 2 end_POSTSUBSCRIPT , italic_q start_POSTSUBSCRIPT 2 end_POSTSUBSCRIPT ) , italic_P start_POSTSUBSCRIPT italic_a end_POSTSUBSCRIPT , italic_P start_POSTSUBSCRIPT italic_n end_POSTSUBSCRIPT ) ) .

###### Theorem 1 .

## 4 Experiments

### 4.1 Experimental Setup

##### Datasets and Baselines.

We conduct experiments on 10 GADBench GADBench datasets spanning diverse domains and scales.
We compare with a broad range of baseline methods, including standard GNNs GCN; GIN; GAT; ACM; FAGCN; AdaGNN; BernNet, GAD-specific models GAS; DCI; PCGNN; AMNet; BWGNN; GHRN; ConsisGAD; SpaceGNN, and graph pre-training approaches DGI; GRACE; G-BT; GraphMAE; BGRL; SSGE; PolyGCL.
For detailed dataset statistics, dataset descriptions, and baseline descriptions, please kindly see Table [3](https://arxiv.org/html/2504.14250v2#A7.T3), Appendix [G.1](https://arxiv.org/html/2504.14250v2#A7.SS1), and Appendix [G.2](https://arxiv.org/html/2504.14250v2#A7.SS2), respectively.

##### Metrics and Implementation Details.

Following GADBench GADBench, we use AUPRC, AUROC, and Rec@K as metrics, with 100 labeled nodes (20 anomalies) per training set.
All experiments are averaged over 10 random splits provided by GADBench for robustness.
Due to space constraints, detailed evaluation protocols and hyperparameter settings are provided in Appendix [G.3](https://arxiv.org/html/2504.14250v2#A7.SS3) and Appendix [G.4](https://arxiv.org/html/2504.14250v2#A7.SS4), respectively.

**Table 1: Comparison of AUPRC for each model. "-" denotes "out of memory". The best and runner-up models are bolded and underlined.**
| Model | Reddit | Weibo | Amazon | Yelp. | T-Fin. | Ellip. | Tolo. | Quest. | DGraph. | T-Social | Avg. |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| GCN | 4.2±0.8 | 86.0±6.7 | 32.8±1.2 | 16.4±2.6 | 60.5±10.8 | 43.1±4.6 | 33.0±3.6 | 6.1±0.9 | 2.3±0.2 | 8.4±3.8 | 29.3 |
| GIN | 4.3±0.6 | 67.6±7.4 | 75.4±4.3 | 23.7±5.4 | 44.8±7.1 | 40.1±3.2 | 31.8±3.2 | 6.7±1.1 | 2.0±0.1 | 6.2±1.7 | 30.3 |
| GAT | 4.7±0.7 | 73.3±7.3 | 81.6±1.7 | 25.0±2.9 | 28.9±8.6 | 44.2±6.6 | 33.0±2.0 | 7.3±1.2 | 2.2±0.2 | 9.2±2.0 | 30.9 |
| ACM | 4.4±0.7 | 66.0±8.7 | 54.0±19.0 | 21.4±2.7 | 29.2±16.8 | 63.1±4.8 | 34.4±3.5 | 7.2±1.9 | 2.2±0.4 | 6.0±1.6 | 28.8 |
| FAGCN | 4.7±0.7 | 70.1±10.6 | 77.0±2.3 | 22.5±2.6 | 39.8±27.2 | 43.6±10.6 | 35.0±4.3 | 7.3±1.4 | 2.0±0.3 | - | - |
| AdaGNN | 4.9±0.8 | 28.3±2.8 | 75.7±6.3 | 22.7±2.1 | 23.3±7.6 | 39.2±7.9 | 32.2±3.9 | 5.3±0.9 | 2.1±0.3 | 4.8±1.1 | 23.9 |
| BernNet | 4.9±0.3 | 66.6±5.5 | 81.2±2.4 | 23.9±2.7 | 51.8±12.4 | 40.0±4.1 | 28.9±3.5 | 6.7±2.1 | 2.5±0.2 | 4.2±1.2 | 31.1 |
| GAS | 4.7±0.7 | 65.7±8.4 | 80.7±1.7 | 21.7±3.3 | 45.7±13.4 | 46.0±4.9 | 31.7±3.0 | 6.3±2.0 | 2.5±0.2 | 8.6±2.4 | 31.4 |
| DCI | 4.3±0.4 | 76.2±4.3 | 72.5±7.9 | 24.0±4.8 | 51.0±7.2 | 43.4±4.9 | 32.1±4.2 | 6.1±1.3 | 2.0±0.2 | 7.4±2.5 | 31.9 |
| PCGNN | 3.4±0.5 | 69.3±9.7 | 81.9±1.9 | 25.0±3.5 | 58.1±11.3 | 40.3±6.6 | 33.9±1.7 | 6.4±1.8 | 2.4±0.4 | 8.0±1.6 | 32.9 |
| AMNet | 4.9±0.4 | 67.1±5.1 | 82.4±2.2 | 23.9±3.5 | 60.2±8.2 | 33.3±4.8 | 28.6±1.5 | 7.4±1.4 | 2.2±0.3 | 3.1±0.3 | 31.3 |
| BWGNN | 4.2±0.7 | 80.6±4.7 | 81.7±2.2 | 23.7±2.9 | 60.9±13.8 | 43.4±5.5 | 35.3±2.2 | 6.5±1.7 | 2.1±0.3 | 15.9±6.2 | 35.4 |
| GHRN | 4.2±0.6 | 77.0±6.2 | 80.7±1.7 | 23.8±2.8 | 63.4±10.4 | 44.2±5.7 | 35.9±2.0 | 6.5±1.7 | 2.3±0.3 | 16.2±4.6 | 35.4 |
| ConsisGAD | 4.5±0.5 | 64.6±5.5 | 78.7±5.7 | 25.9±2.9 | 79.7±4.7 | 47.8±8.2 | 33.7±2.7 | 7.9±2.4 | 2.0±0.2 | 41.3±5.0 | 38.6 |
| SpaceGNN | 4.6±0.5 | 79.2±2.8 | 81.1±2.3 | 25.7±2.4 | 81.0±3.5 | 44.1±3.5 | 33.8±2.5 | 7.4±1.6 | 2.0±0.3 | 59.0±5.7 | 41.8 |
| XGBGraph | 4.1±0.5 | 75.9±6.2 | 84.4±1.1 | 24.8±3.1 | 78.3±3.1 | 77.2±3.2 | 34.1±2.8 | 7.7±2.1 | 1.9±0.2 | 40.6±7.6 | 42.9 |
| DGI | 4.8±0.6 | 90.8±2.5 | 46.5±3.7 | 17.0±1.2 | 75.0±4.9 | 45.9±2.5 | 39.7±0.8 | 6.4±1.2 | 2.1±0.2 | 37.8±6.1 | 36.6 |
| GRACE | 4.7±0.3 | 90.8±1.8 | 51.3±4.3 | 18.2±1.6 | 79.3±0.7 | 48.1±3.6 | 37.4±2.8 | 8.9±1.7 | - | - | - |
| G-BT | 5.0±0.7 | 87.5±3.9 | 38.7±2.2 | 18.8±1.6 | 76.8±1.8 | 45.2±4.4 | 37.9±2.8 | 9.1±1.9 | 2.6±0.3 | 42.2±7.4 | 36.4 |
| GraphMAE | 4.3±0.1 | 91.4±2.6 | 39.4±0.3 | 17.3±0.1 | 70.8±4.7 | 32.7±3.8 | 36.0±2.1 | 5.9±0.5 | 2.1±0.1 | 42.6±10.5 | 34.2 |
| BGRL | 5.3±0.3 | 93.6±1.9 | 43.9±4.6 | 19.2±1.6 | 61.7±5.1 | 47.4±6.0 | 38.3±3.3 | 8.4±2.0 | 2.0±0.2 | 46.7±8.4 | 36.6 |
| SSGE | 4.8±0.9 | 87.7±2.6 | 39.1±2.4 | 18.8±1.6 | 77.6±0.9 | 47.4±3.0 | 38.2±2.8 | 8.1±1.1 | 2.5±0.3 | 46.4±3.9 | 37.1 |
| PolyGCL | 5.2±0.8 | 87.3±2.1 | 79.7±6.6 | 24.3±2.5 | 43.3±6.4 | 50.0±5.2 | 33.0±1.8 | 5.7±0.8 | 2.2±0.3 | 40.6±7.0 | 37.1 |
| BWDGI | 4.5±0.6 | 72.5±2.7 | 79.4±5.7 | 26.8±2.7 | 80.0±2.1 | 44.9±6.5 | 38.5±3.1 | 5.0±0.7 | 2.4±0.2 | 38.0±5.2 | 39.2 |
| APF (w/o $\mathcal{L}_{pt}$) | 5.2±0.6 | 85.8±7.9 | 82.7±3.0 | 24.1±2.2 | 79.4±3.4 | 55.5±4.9 | 37.4±1.2 | 9.4±1.5 | 2.3±0.2 | 64.8±10.5 | 44.7 |
| APF | 5.9±0.9 | 93.9±1.1 | 83.8±2.9 | 28.4±1.4 | 82.5±2.6 | 67.7±3.4 | 40.5±2.0 | 12.3±1.6 | 2.9±0.2 | 77.8±5.6 | 49.6 |

### 4.2 Performance Comparison

We summarize the performance across AUPRC, AUROC, and Rec@K in Table [1](https://arxiv.org/html/2504.14250v2#S4.T1), Table [5](https://arxiv.org/html/2504.14250v2#A7.T5), and Table [6](https://arxiv.org/html/2504.14250v2#A7.T6), respectively.
For comprehensiveness, DGI and BWDGI represent standard DGI pre-training with GCN and BWGNN as backbones.
In addition, APF (w/o $\mathcal{L}_{pt}$) is a variant of our method, skipping pre-training and directly optimizing the learnable spectral filters using $\mathcal{L}_{ft}$.

##### Effectiveness of Pre-Training.

Overall, graph pre-training methods achieve competitive or even superior performance compared to GAD-specific models, especially on Reddit, Weibo, and Tolokers.
In particular, DGI, BWDGI, and APF achieve AUPRC gains of +7.3%, +3.8%, and +4.9% over their end-to-end training counterparts (GCN, BWGNN, and APF (w/o $\mathcal{L}_{pt}$)).
These gains highlight the importance of pre-training in addressing the label scarcity problem inherent to GAD, by providing more expressive and transferable initializations.

##### Superiority of Our Proposed APF.

As observed, APF outperforms both GAD-specific approaches and graph pre-training methods in most cases.
On average, APF achieves gains of +6.7% in AUPRC, +3.8% in AUROC, and +6.2% in Rec@K.
Even without the pre-training, APF (w/o $\mathcal{L}_{pt}$) surpasses all baseline methods, including BWGNN and AMNet, which also adopt multi-filter architectures.
This highlights the strength of our fine-tuning module in adaptively emphasizing anomaly-relevant signals and approximating the theoretical linear separability established in Theorem [1](https://arxiv.org/html/2504.14250v2#Thmtheorem1).
We note that APF underperforms XGBGraph on Amazon and Elliptic, likely due to the tabular and highly heterogeneous node features that favor tree-based models Tree; GADBench, as further discussed in Appendix [C](https://arxiv.org/html/2504.14250v2#A3).
Overall, these strong results validate the effectiveness of our proposed anomaly-aware pre-training and granularity-adaptive fine-tuning framework.

##### Mitigation of Homophily Disparity.

To investigate the ability of our model to mitigate the impact of local homophily disparity, we conduct a fine-grained performance analysis on abnormal nodes with varying degrees of local homophily. Specifically, we divide the abnormal nodes in the test set into four quartiles based on their local homophily scores, and compute the model performance within each group against the remaining normal nodes. The results are visualized in Figure [1](https://arxiv.org/html/2504.14250v2#S1.F1), [3](https://arxiv.org/html/2504.14250v2#S4.F3), [10](https://arxiv.org/html/2504.14250v2#A7.F10) and [11](https://arxiv.org/html/2504.14250v2#A7.F11).

Figure: Figure 3: Performance variations across local homophily quartiles (Q1 = top 25%, Q4 = bottom 25%).
Refer to caption: x6.png

We observe that detection performance typically declines as local homophily decreases, highlighting the difficulty of identifying anomalies in heterophilic regions and the need for node-adaptive mechanisms.
APF consistently achieves stronger performance across all homophily quartiles, demonstrating enhanced robustness to homophily disparity.
Such robustness mainly stems from our anomaly-aware pre-training and the adaptive fusion mechanism, allowing the model to tailor its decision boundary to each node’s local structural context and mitigating performance degradation under local homophily disparity.

### 4.3 Model Analysis

##### Contribution of Each Component.

We conduct ablation experiments to examine the impact of key components in both the pre-training and fine-tuning stages of APF.
In the pre-training stage, we test three variants: using only the low-pass filter $g_{L}(\cdot)$, only the high-pass filter $g_{H}(\cdot)$, and removing the Rayleigh Quotient-guided sub-tree $\mathcal{G}^{RQ}$ by applying standard DGI on $g_{L}(\cdot)$ and $g_{H}(\cdot)$.
In the fine-tuning stage, we evaluate the effect of removing the anomaly-aware regularization loss $\mathcal{L}_{reg}$ and replacing our node- and dimension-adaptive fusion with simpler alternatives such as mean, concatenation, and attention-based fusion AMNet.
The results, shown in Table [2](https://arxiv.org/html/2504.14250v2#S4.T2), reveal several important findings.
(1) Using information from both low- and high-pass filters generally yields better performance than relying on either alone, confirming the necessity of dual-filter pre-training to capture both semantic regularities and anomaly-relevant irregularities in graph structure.
(2) Our node- and dimension-adaptive fusion strategy consistently outperforms the alternatives, demonstrating its effectiveness in adapting to node-specific structural variation.
(3) The Rayleigh Quotient-guided sub-tree $\mathcal{G}^{RQ}$ and the regularization term $\mathcal{L}_{reg}$ both contribute to improved anomaly discrimination, further boosting performance by encouraging more anomaly-aware representation learning.

**Table 2: Ablation study on each component of our APF.**
| Variants | YelpChi | Questions | DGraph-Fin |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| $g_{L}$ | $g_{H}$ | $\mathcal{G}^{RQ}$ | $\mathcal{L}_{reg}$ | Fusion | AUPRC | AUROC | Rec@K | AUPRC | AUROC | Rec@K | AUPRC | AUROC | Rec@K |
| ✓ | ✓ | ✓ | ✓ | NDApt | 28.4±1.4 | 68.2±2.3 | 31.4±1.6 | 12.3±1.6 | 71.9±2.1 | 16.5±0.9 | 2.9±0.2 | 72.4±1.3 | 4.2±0.7 |
| ✓ | ✓ | ✗ | ✓ | NDApt | 27.1±1.6 | 67.6±1.4 | 30.2±1.6 | 10.9±1.8 | 71.2±2.5 | 16.0±1.4 | 2.6±0.1 | 71.1±0.5 | 3.3±0.5 |
| ✓ | ✗ | ✗ | ✗ | - | 18.7±1.2 | 56.5±1.3 | 20.6±1.7 | 11.8±1.2 | 70.6±1.2 | 16.1±0.9 | 2.5±0.1 | 71.0±1.0 | 3.2±0.1 |
| ✗ | ✓ | ✓ | ✗ | - | 24.4±2.4 | 64.0±2.5 | 27.2±2.5 | 6.3±0.7 | 66.1±3.2 | 9.8±1.9 | 2.6±0.1 | 71.1±0.5 | 3.1±0.5 |
| ✓ | ✓ | ✓ | ✗ | NDApt | 27.5±1.6 | 67.4±2.3 | 30.6±1.9 | 11.1±1.6 | 71.2±2.7 | 15.9±0.9 | 2.8±0.1 | 71.7±0.4 | 3.7±0.2 |
| ✓ | ✓ | ✓ | ✗ | Mean | 27.6±1.6 | 67.2±2.1 | 30.5±1.8 | 10.8±1.7 | 71.0±2.4 | 15.7±1.2 | 2.8±0.1 | 71.6±0.4 | 3.8±0.2 |
| ✓ | ✓ | ✓ | ✗ | Concat | 27.3±1.9 | 67.3±2.2 | 30.4±2.1 | 11.1±1.5 | 68.5±3.2 | 15.2±1.7 | 2.8±0.0 | 71.5±0.2 | 3.6±0.3 |
| ✓ | ✓ | ✓ | ✗ | Atten. | 26.2±1.6 | 66.7±1.7 | 29.5±1.7 | 8.3±2.2 | 67.5±3.5 | 13.6±2.6 | 2.8±0.0 | 71.7±0.3 | 3.8±0.2 |

##### Visualization of Fusion Coefficients.

To gain visual insights into our node- and dimension-adaptive fusion, we present heatmaps of the learned fusion coefficients $\boldsymbol{C}$ in Figure [4](https://arxiv.org/html/2504.14250v2#S4.F4).
For clarity, we focus on the top 6 dimensions of $\boldsymbol{C}$ for 3 randomly selected abnormal nodes $a_{1},a_{2},a_{3}$ and 3 randomly selected normal nodes $n_{1},n_{2},n_{3}$.
The heatmaps reveal substantial variation across both nodes and dimensions, confirming the adaptiveness of $\boldsymbol{C}$.
For Amazon, T-Finance, and Tolokers, abnormal nodes generally have lower coefficients than normal ones, aligning with the intuition that anomalies should rely more on high-pass (anomaly-sensitive) features, while normal nodes benefit more from low-pass (semantic) representations.
In contrast, Weibo shows similar coefficient distributions between classes, likely due to the smaller local homophily gap between the two classes.
Moreover, the variability of $\boldsymbol{C}$ across dimensions suggests that APF learns to assign different levels of node-wise and dimension-wise importance of information from both encoders, enabling more expressive fusion that captures subtle, localized anomaly-relevant patterns.

Figure: (a) Weibo
Refer to caption: x7.png

##### Hyperparameter Analysis.

In addition to the adaptive fusion mechanism, our APF further introduces two hyperparameters, $p_{a}$ and $p_{n}$, which represent the expected preference for low-pass representations in abnormal and normal nodes, respectively.
To assess their impact on our performance, we vary these hyperparameters from $0.0$ to $1.0$ in increments of $0.1$.
The results are presented in Figure [5](https://arxiv.org/html/2504.14250v2#S4.F5), [12](https://arxiv.org/html/2504.14250v2#A7.F12) and [13](https://arxiv.org/html/2504.14250v2#A7.F13).
It is observed that the right half of the heatmap, corresponding to relatively larger $p_{n}$ values, generally outperforms the left half.
This aligns with the understanding that normal nodes benefit more from low-pass representations for generic knowledge, due to their strong structural consistency with neighbors.
Additionally, the optimal combination of $(p_{a},p_{n})$ always appears in the lower-right half of the heatmap, where $p_{a}\leq p_{n}$.
This indicates that abnormal nodes are assigned lower $p_{a}$ values, thus placing greater emphasis on anomaly-indicative components, which better capture their deviation from the local context.
These observations are consistent with the intuition behind our adaptive fusion design: normal and abnormal nodes require different emphases of knowledge to maximize discriminability.
Overall, $p_{a}$ and $p_{n}$ provide a simple yet effective way that consistently guides APF toward strong and stable anomaly detection performance with minimal tuning effort.

Figure: (a) Weibo
Refer to caption: x11.png

##### Additional Analysis.

Due to space constraints, the additional results, including (1) efficiency analyses regarding training time and memory overhead, (2) performance comparisons under varying numbers of labeled nodes, and (3) additional figurative and tabular results for the presented analyses, are deferred in Appendix [F](https://arxiv.org/html/2504.14250v2#A6) and [G.5](https://arxiv.org/html/2504.14250v2#A7.SS5).

## 5 Conclusion

This paper tackles label scarcity and homophily disparity in GAD by introducing APF.
APF leverages Rayleigh Quotient-guided subgraph sampling and dual spectral filters to capture both semantic and anomaly-sensitive signals without supervision.
During fine-tuning, a node- and dimension-adaptive fusion mechanism, together with anomaly-aware regularization, enhances the model’s ability to distinguish abnormal nodes under homophily disparity.
Both theoretical analysis and extensive experiments on 10 benchmark datasets validate the effectiveness of our approach.

## Acknowledgments and Disclosure of Funding

We would like to express our sincere gratitude to the reviewers and chairs for their invaluable time and effort dedicated to the evaluation of our manuscript.

## References

- (1)
Esma Aïmeur, Sabrine Amri, and Gilles Brassard.
Fake news, disinformation and misinformation in social media: a
review.
Social Network Analysis and Mining, 13(1):30, 2023.
- (2)
Aseem Baranwal, Kimon Fountoulakis, and Aukosh Jagannath.
Graph convolution for semi-supervised classification: Improved linear
separability and out-of-distribution generalization.
In International Conference on Machine Learning, pages
684–693. PMLR, 2021.
- (3)
Piotr Bielak, Tomasz Kajdanowicz, and Nitesh V Chawla.
Graph barlow twins: A self-supervised representation learning
framework for graphs.
Knowledge-Based Systems, 256:109631, 2022.
- (4)
Deyu Bo, Xiao Wang, Chuan Shi, and Huawei Shen.
Beyond low-frequency information in graph convolutional networks.
In Proceedings of the AAAI conference on artificial
intelligence, pages 3950–3957, 2021.
- (5)
Alessandro Bondielli and Francesco Marcelloni.
A survey on fake news and rumour detection techniques.
Information sciences, 497:38–55, 2019.
- (6)
Ziwei Chai, Siqi You, Yang Yang, Shiliang Pu, Jiarong Xu, Haoyang Cai, and
Weihao Jiang.
Can abnormality be detected by graph neural networks?
In IJCAI, pages 1945–1951, 2022.
- (7)
Jingyu Chen, Runlin Lei, and Zhewei Wei.
PolyGCL: GRAPH CONTRASTIVE LEARNING via learnable spectral
polynomial filters.
In The Twelfth International Conference on Learning
Representations, 2024.
- (8)
Nan Chen, Zemin Liu, Bryan Hooi, Bingsheng He, Rizal Fathony, Jun Hu, and Jia
Chen.
Consistency training with learnable data augmentation for graph
anomaly detection with limited supervision.
In The Twelfth International Conference on Learning
Representations, 2024.
- (9)
Tianqi Chen and Carlos Guestrin.
Xgboost: A scalable tree boosting system.
In Proceedings of the 22nd acm sigkdd international conference
on knowledge discovery and data mining, pages 785–794, 2016.
- (10)
Ting Chen, Simon Kornblith, Kevin Swersky, Mohammad Norouzi, and Geoffrey E
Hinton.
Big self-supervised models are strong semi-supervised learners.
Advances in neural information processing systems,
33:22243–22255, 2020.
- (11)
Dawei Cheng, Yao Zou, Sheng Xiang, and Changjun Jiang.
Graph neural networks for financial fraud detection: a review.
Frontiers of Computer Science, 19(9):1–15, 2025.
- (12)
Jiashun Cheng, Zinan Zheng, Yang Liu, Jianheng Tang, Hongwei Wang, Yu Rong, Jia
Li, and Fugee Tsung.
Graph pre-training models are strong anomaly detectors.
arXiv preprint arXiv:2410.18487, 2024.
- (13)
Kelton AP Da Costa, João P Papa, Celso O Lisboa, Roberto Munoz, and Victor
Hugo C de Albuquerque.
Internet of things: A survey on machine learning-based intrusion
detection approaches.
Computer Networks, 151:147–157, 2019.
- (14)
Yash Deshpande, Subhabrata Sen, Andrea Montanari, and Elchanan Mossel.
Contextual stochastic block models.
Advances in Neural Information Processing Systems, 31, 2018.
- (15)
Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova.
BERT: Pre-training of deep bidirectional transformers for language
understanding.
In Proceedings of the 2019 Conference of the North American
Chapter of the Association for Computational Linguistics: Human Language
Technologies, Volume 1 (Long and Short Papers), pages 4171–4186, 2019.
- (16)
Kaize Ding, Jundong Li, Rohit Bhanushali, and Huan Liu.
Deep anomaly detection on attributed networks.
In Proceedings of the 2019 SIAM international conference on data
mining, 2019.
- (17)
Xiangyu Dong, Xingyi Zhang, Lei Chen, Mingxuan Yuan, and Sibo Wang.
SpaceGNN: Multi-space graph neural network for node anomaly
detection with extremely limited labels.
In The Thirteenth International Conference on Learning
Representations, 2025.
- (18)
Yushun Dong, Kaize Ding, Brian Jalaian, Shuiwang Ji, and Jundong Li.
Adagnn: Graph neural networks with adaptive frequency response
filter.
In Proceedings of the 30th ACM international conference on
information & knowledge management, pages 392–401, 2021.
- (19)
Yingtong Dou, Zhiwei Liu, Li Sun, Yutong Deng, Hao Peng, and Philip S Yu.
Enhancing graph neural network-based fraud detectors against
camouflaged fraudsters.
In Proceedings of the 29th ACM international conference on
information & knowledge management, pages 315–324, 2020.
- (20)
Anuroop Gaddam, Tim Wilkin, Maia Angelova, and Jyotheesh Gaddam.
Detecting sensor faults, anomalies and outliers in the internet of
things: A survey on the challenges and solutions.
Electronics, 9(3):511, 2020.
- (21)
Yuan Gao, Xiang Wang, Xiangnan He, Zhenguang Liu, Huamin Feng, and Yongdong
Zhang.
Addressing heterophily in graph anomaly detection: A perspective of
graph spectrum.
In Proceedings of the ACM Web Conference 2023, pages
1528–1538, 2023.
- (22)
Léo Grinsztajn, Edouard Oyallon, and Gaël Varoquaux.
Why do tree-based models still outperform deep learning on typical
tabular data?
Advances in neural information processing systems, 35:507–520,
2022.
- (23)
Haoyu Han, Juanhui Li, Wei Huang, Xianfeng Tang, Hanqing Lu, Chen Luo, Hui Liu,
and Jiliang Tang.
Node-wise filtering in graph neural networks: A mixture of experts
approach.
arXiv preprint arXiv:2406.03464, 2024.
- (24)
Mingguo He, Zhewei Wei, and Ji-Rong Wen.
Convolutional neural networks on graphs with chebyshev approximation,
revisited.
Advances in neural information processing systems,
35:7264–7276, 2022.
- (25)
Mingguo He, Zhewei Wei, Hongteng Xu, et al.
Bernnet: Learning arbitrary graph spectral filters via bernstein
approximation.
Advances in Neural Information Processing Systems,
34:14239–14251, 2021.
- (26)
Waleed Hilal, S Andrew Gadsden, and John Yawney.
Financial fraud: a review of anomaly detection techniques and recent
advances.
Expert systems With applications, 193:116429, 2022.
- (27)
R Devon Hjelm, Alex Fedorov, Samuel Lavoie-Marchildon, Karan Grewal, Phil
Bachman, Adam Trischler, and Yoshua Bengio.
Learning deep representations by mutual information estimation and
maximization.
In International Conference on Learning Representations, 2019.
- (28)
Roger A Horn and Charles R Johnson.
Matrix analysis.
Cambridge university press, 2012.
- (29)
Zhenyu Hou, Xiao Liu, Yukuo Cen, Yuxiao Dong, Hongxia Yang, Chunjie Wang, and
Jie Tang.
Graphmae: Self-supervised masked graph autoencoders.
In Proceedings of the 28th ACM SIGKDD Conference on Knowledge
Discovery and Data Mining, pages 594–604, 2022.
- (30)
Xuanwen Huang, Yang Yang, Yang Wang, Chunping Wang, Zhisheng Zhang, Jiarong Xu,
Lei Chen, and Michalis Vazirgiannis.
Dgraph: A large-scale financial dataset for graph anomaly detection.
Advances in Neural Information Processing Systems, 2022.
- (31)
Yihong Huang, Liping Wang, Fan Zhang, and Xuemin Lin.
Unsupervised graph outlier detection: Problem revisit, new insight,
and superior method.
In 2023 IEEE 39th International Conference on Data Engineering
(ICDE), 2023.
- (32)
Wei Ju, Siyu Yi, Yifan Wang, Qingqing Long, Junyu Luo, Zhiping Xiao, and Ming
Zhang.
A survey of data-efficient graph learning.
In Proceedings of the Thirty-Third International Joint
Conference on Artificial Intelligence, IJCAI-24, 2024.
- (33)
Diederik P. Kingma and Jimmy Ba.
Adam: A method for stochastic optimization.
In ICLR, 2015.
- (34)
Thomas N. Kipf and Max Welling.
Semi-supervised classification with graph convolutional networks.
In International Conference on Learning Representations, 2017.
- (35)
Srijan Kumar, Xikun Zhang, and Jure Leskovec.
Predicting dynamic embedding trajectory in temporal interaction
networks.
In Proceedings of the 25th ACM SIGKDD international conference
on knowledge discovery & data mining, pages 1269–1278, 2019.
- (36)
Runlin Lei, Zhen Wang, Yaliang Li, Bolin Ding, and Zhewei Wei.
Evennet: Ignoring odd-hop neighbors improves robustness of graph
neural networks.
Advances in Neural Information Processing Systems,
35:4694–4706, 2022.
- (37)
Ao Li, Zhou Qin, Runshi Liu, Yiqun Yang, and Dong Li.
Spam review detection with graph convolutional networks.
In Proceedings of the 28th ACM international conference on
information and knowledge management, pages 2703–2711, 2019.
- (38)
Yiqing Lin, Jianheng Tang, Chenyi Zi, H Vicky Zhao, Yuan Yao, and Jia Li.
Unigad: Unifying multi-level graph anomaly detection.
Advances in neural information processing systems, 2024.
- (39)
Kay Liu, Yingtong Dou, Yue Zhao, Xueying Ding, Xiyang Hu, Ruitong Zhang, Kaize
Ding, Canyu Chen, Hao Peng, Kai Shu, et al.
Bond: Benchmarking unsupervised outlier node detection on static
attributed graphs.
Advances in Neural Information Processing Systems, 2022.
- (40)
Yang Liu, Xiang Ao, Zidi Qin, Jianfeng Chi, Jinghua Feng, Hao Yang, and Qing
He.
Pick and choose: a gnn-based imbalanced learning approach for fraud
detection.
In Proceedings of the web conference 2021, pages 3168–3177,
2021.
- (41)
Yixin Liu, Zhao Li, Shirui Pan, Chen Gong, Chuan Zhou, and George Karypis.
Anomaly detection on attributed networks via contrastive
self-supervised learning.
IEEE transactions on neural networks and learning systems,
33(6):2378–2392, 2021.
- (42)
Yunhui Liu, Xinyi Gao, Tieke He, Tao Zheng, Jianhua Zhao, and Hongzhi Yin.
Reliable node similarity matrix guided contrastive graph clustering.
IEEE Transactions on Knowledge and Data Engineering, 2024.
- (43)
Yunhui Liu, Tieke He, Tao Zheng, and Jianhua Zhao.
Negative-free self-supervised gaussian embedding of graphs.
Neural Networks, 2024.
- (44)
Yunhui Liu, Huaisong Zhang, Tieke He, Tao Zheng, and Jianhua Zhao.
Bootstrap latents of nodes and neighbors for graph self-supervised
learning.
In Joint European Conference on Machine Learning and Knowledge
Discovery in Databases, pages 76–92. Springer, 2024.
- (45)
Sitao Luan, Chenqing Hua, Qincheng Lu, Jiaqi Zhu, Mingde Zhao, Shuyuan Zhang,
Xiao-Wen Chang, and Doina Precup.
Revisiting heterophily for graph neural networks.
Advances in neural information processing systems,
35:1362–1375, 2022.
- (46)
Xiaoxiao Ma, Ruikun Li, Fanzhen Liu, Kaize Ding, Jian Yang, and Jia Wu.
Graph anomaly detection with few labels: A data-centric approach.
In Proceedings of the 30th ACM SIGKDD Conference on Knowledge
Discovery and Data Mining, pages 2153–2164, 2024.
- (47)
Yao Ma, Xiaorui Liu, Neil Shah, and Jiliang Tang.
Is homophily a necessity for graph neural networks?
In International Conference on Learning Representations, 2022.
- (48)
Haitao Mao, Zhikai Chen, Wei Jin, Haoyu Han, Yao Ma, Tong Zhao, Neil Shah, and
Jiliang Tang.
Demystifying structural disparity in graph neural networks: Can one
size fit all?
Advances in neural information processing systems, 2023.
- (49)
Julian John McAuley and Jure Leskovec.
From amateurs to connoisseurs: modeling the evolution of user
expertise through online reviews.
In Proceedings of the 22nd international conference on World
Wide Web, pages 897–908, 2013.
- (50)
Srinivasa Rao Nandam, Sara Atito, Zhenhua Feng, Josef Kittler, and Muhammed
Awais.
Investigating self-supervised methods for label-efficient learning.
International Journal of Computer Vision, pages 1–16, 2025.
- (51)
Oleg Platonov, Denis Kuznedelev, Michael Diskin, Artem Babenko, and Liudmila
Prokhorenkova.
A critical look at the evaluation of GNNs under heterophily: Are we
really making progress?
In The Eleventh International Conference on Learning
Representations, 2023.
- (52)
Hezhe Qiao and Guansong Pang.
Truncated affinity maximization: One-class homophily modeling for
graph anomaly detection.
Advances in Neural Information Processing Systems, 2023.
- (53)
Hezhe Qiao, Hanghang Tong, Bo An, Irwin King, Charu Aggarwal, and Guansong
Pang.
Deep graph anomaly detection: A survey and new perspectives.
arXiv preprint arXiv:2409.09957, 2024.
- (54)
Hezhe Qiao, Qingsong Wen, Xiaoli Li, Ee-Peng Lim, and Guansong Pang.
Generative semi-supervised graph anomaly detection.
Advances in neural information processing systems, 2024.
- (55)
Shebuti Rayana and Leman Akoglu.
Collective opinion spam detection: Bridging review networks and
metadata.
In Proceedings of the 21th acm sigkdd international conference
on knowledge discovery and data mining, pages 985–994, 2015.
- (56)
Mamshad Nayeem Rizve, Kevin Duarte, Yogesh S Rawat, and Mubarak Shah.
In defense of pseudo-labeling: An uncertainty-aware pseudo-label
selection framework for semi-supervised learning.
In International Conference on Learning Representations, 2021.
- (57)
Fengzhao Shi, Yanan Cao, Yanmin Shang, Yuchen Zhou, Chuan Zhou, and Jia Wu.
H2-fdetector: A gnn-based fraud detector with homophilic and
heterophilic connections.
In Proceedings of the ACM web conference 2022, pages
1486–1494, 2022.
- (58)
Zhengxiang Shi, Francesco Tonolini, Nikolaos Aletras, Emine Yilmaz, Gabriella
Kazai, and Yunlong Jiao.
Rethinking semi-supervised learning with language models.
In Findings of the Association for Computational Linguistics:
ACL 2023, pages 5614–5634, 2023.
- (59)
Jianheng Tang, Fengrui Hua, Ziqi Gao, Peilin Zhao, and Jia Li.
Gadbench: Revisiting and benchmarking supervised graph anomaly
detection.
Advances in Neural Information Processing Systems,
36:29628–29653, 2023.
- (60)
Jianheng Tang, Jiajin Li, Ziqi Gao, and Jia Li.
Rethinking graph neural networks for anomaly detection.
In International Conference on Machine Learning, pages
21076–21089. PMLR, 2022.
- (61)
Shantanu Thakoor, Corentin Tallec, Mohammad Gheshlaghi Azar, Mehdi Azabou,
Eva L Dyer, Remi Munos, Petar Veličković, and Michal Valko.
Large-scale representation learning on graphs via bootstrapping.
In International Conference on Learning Representations, 2022.
- (62)
Petar Veličković, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro
Liò, and Yoshua Bengio.
Graph attention networks.
In International Conference on Learning Representations, 2018.
- (63)
Petar Veličković, William Fedus, William L. Hamilton, Pietro Liò, Yoshua
Bengio, and R Devon Hjelm.
Deep graph infomax.
In International Conference on Learning Representations, 2019.
- (64)
Junfu Wang, Yuanfang Guo, Liang Yang, and Yunhong Wang.
Understanding heterophily for graph neural networks.
In Forty-first International Conference on Machine Learning,
2024.
- (65)
Minjie Wang, Da Zheng, Zihao Ye, Quan Gan, Mufei Li, Xiang Song, Jinjing Zhou,
Chao Ma, Lingfan Yu, Yu Gai, et al.
Deep graph library: A graph-centric, highly-performant package for
graph neural networks.
arXiv preprint arXiv:1909.01315, 2019.
- (66)
Xiyuan Wang and Muhan Zhang.
How powerful are spectral graph neural networks.
In International conference on machine learning, 2022.
- (67)
Yanling Wang, Jing Zhang, Shasha Guo, Hongzhi Yin, Cuiping Li, and Hong Chen.
Decoupling representation learning and classification for gnn-based
anomaly detection.
In Proceedings of the 44th international ACM SIGIR conference on
research and development in information retrieval, pages 1239–1248, 2021.
- (68)
Mark Weber, Giacomo Domeniconi, Jie Chen, Daniel Karl I Weidele, Claudio
Bellei, Tom Robinson, and Charles E Leiserson.
Anti-money laundering in bitcoin: Experimenting with graph
convolutional networks for financial forensics.
arXiv preprint arXiv:1908.02591, 2019.
- (69)
Keyulu Xu, Weihua Hu, Jure Leskovec, and Stefanie Jegelka.
How powerful are graph neural networks?
In International Conference on Learning Representations, 2019.
- (70)
Hengrui Zhang, Qitian Wu, Junchi Yan, David Wipf, and Philip S Yu.
From canonical correlation analysis to self-supervised graph neural
networks.
Advances in Neural Information Processing Systems, 34:76–89,
2021.
- (71)
Yilun Zheng, Xiang Li, Sitao Luan, Xiaojiang Peng, and Lihui Chen.
Let your features tell the differences: Understanding graph
convolution by feature splitting.
In The Thirteenth International Conference on Learning
Representations, 2025.
- (72)
Yanqiao Zhu, Yichen Xu, Feng Yu, Qiang Liu, Shu Wu, and Liang Wang.
Deep graph contrastive representation learning.
arXiv preprint arXiv:2006.04131, 2020.
- (73)
Yanqiao Zhu, Yichen Xu, Feng Yu, Qiang Liu, Shu Wu, and Liang Wang.
Graph contrastive learning with adaptive augmentation.
In Proceedings of the web conference 2021, pages 2069–2080,
2021.
- (74)
Wei Zhuo, Zemin Liu, Bryan Hooi, Bingsheng He, Guang Tan, Rizal Fathony, and
Jia Chen.
Partitioning message passing for graph fraud detection.
In The Twelfth International Conference on Learning
Representations, 2024.

## Appendix A Detailed Preliminaries

##### Notations.

In a general scenario, we are given an attributed graph $\mathcal{G}=(\mathcal{V},\mathcal{E},\boldsymbol{X})$, where $\mathcal{V}=\{v_{1},\cdots,v_{n}\}$ is the set of $n$ nodes, $\mathcal{E}=\{e_{ij}\}$ is the set of edges, and $e_{ij}=(v_{i},v_{j})$ represents an edge between nodes $v_{i}$ and $v_{j}$.
We define $\boldsymbol{A}$ as the corresponding adjacency matrix and $\boldsymbol{D}$ as the diagonal degree matrix with $\boldsymbol{D}_{ii}=d_{i}=\sum_{j}\boldsymbol{A}_{ij}$.
The neighbor set $\mathcal{N}_{i}$ of each node $v_{i}$ is given by $\mathcal{N}_{i}=\{v_{j}:e_{ij}\in\mathcal{E}\}$.
For each node $v_{i}$, it has a $d$-dimensional feature vector $\boldsymbol{x}_{i}\in\mathbb{R}^{d}$, and collectively the features of all nodes are denoted as $\boldsymbol{X}=(\boldsymbol{x}_{1},\cdots,\boldsymbol{x}_{n})^{\top}\in\mathbb
{R}^{n\times d}$.

##### Graph Anomaly Detection.

GAD is formulated as a binary classification problem where anomalies are regarded as positive with label 1, while normal nodes are negative with label 0.
Given $\mathcal{V}^{L}=\mathcal{V}_{a}\cup\mathcal{V}_{a}$, where $\mathcal{V}_{a}$ consists of labeled abnormal nodes and $\mathcal{V}_{n}$ comprises labeled normal nodes, along with their corresponding labels $\boldsymbol{y}^{L}$, the goal is to identify the anomalous status $\boldsymbol{\hat{y}}^{U}$ for the unlabeled nodes $\mathcal{V}^{U}=\mathcal{V}\setminus\mathcal{V}^{L}$.
Usually, obtaining authentic labels is often costly, we assume that label information is only available for a small subset of nodes (i.e., $|\mathcal{V}^{L}|\ll|\mathcal{V}|$).
Furthermore, there are usually significantly fewer abnormal nodes than normal nodes (i.e., $|\mathcal{V}_{a}|\ll|\mathcal{V}_{n}|$).

##### Graph Spectral Filtering.

Given the adjacency matrix $\boldsymbol{A}$, the graph Laplacian matrix is defined as $\boldsymbol{L}=\boldsymbol{D}-\boldsymbol{A}$, which is symmetric and positive semi-definite.
Their symmetric normalized versions are noted as $\tilde{\boldsymbol{A}}=\boldsymbol{D}^{-1/2}\boldsymbol{A}\boldsymbol{D}^{-1/2}$ and $\tilde{\boldsymbol{L}}=\boldsymbol{I}-\boldsymbol{D}^{-1/2}\boldsymbol{A}
\boldsymbol{D}^{-1/2}$.
Its eigendecomposition is given by $\tilde{\boldsymbol{L}}=\boldsymbol{U}\boldsymbol{\boldsymbol{\Lambda}}
\boldsymbol{U}^{\top}$, where the columns of $\boldsymbol{U}\in\mathbb{R}^{n\times n}$ are orthonormal eigenvectors (graph Fourier basis), and $\boldsymbol{\boldsymbol{\Lambda}}=\operatorname{diag}(\lambda_{1},\lambda_{2},
\cdots,\lambda_{n})$ contains the eigenvalues (frequencies), arranged such that $0=\lambda_{1}\leq\lambda_{2}\leq\cdots\leq\lambda_{n}$.
Given the graph features $\boldsymbol{X}$ and a filter function $g(\cdot)$, the corresponding filtered features is thus defined as $\boldsymbol{\hat{X}}=\boldsymbol{U}g(\boldsymbol{\boldsymbol{\Lambda}})
\boldsymbol{U}^{\top}\boldsymbol{X}$.

Typically, $\tilde{\boldsymbol{A}}$ acts as a low-pass filter with $g(\lambda)=1-\lambda$, while $-\tilde{\boldsymbol{A}}$ and $\tilde{\boldsymbol{L}}$ serve as high-pass filters, with $g(\lambda)=\lambda-1$ and $g(\lambda)=\lambda$, respectively.
In practice, a self-loop is often added to each node in the graph (i.e., $\boldsymbol{A}=\boldsymbol{A}+\boldsymbol{I}$) to alleviate numerical instabilities and improve performance [34].

## Appendix B Related Works

### B.1 Graph Anomaly Detection

GNN-based approaches have emerged as a promising paradigm for GAD, due to their strong ability to capture both complex structural and node attribute patterns in graph data.
A comprehensive and up-to-date survey of deep GAD methods is provided in [53], while BOND [39] and GADBench [59] establish performance benchmarks for unsupervised and semi-/supervised GAD approaches, respectively.

Unsupervised GAD approaches do not rely on labeled data for training and instead use unsupervised learning techniques to identify anomaly patterns in graph data.
For instance, DOMINANT [16] employs a graph autoencoder to reconstruct both attributes and structure using GNNs.
CoLA [41] explores the consistency between anomalies and their neighbors across different contrastive views to assess node irregularity.
VGOD [31] combines variance-based and attribute reconstruction models to detect anomalies in a balanced manner.
TAM [52] introduces local affinity as an anomaly measure, aiming to learn tailored node representations for GAD by maximizing the local affinity between nodes and their neighbors.

Semi-/supervised GAD approaches assume that labels for some normal and abnormal nodes are available for training.
They aim to assign labels by learning a decision boundary between normal and abnormal nodes.
For example, BWGNN [60] uses a Beta graph wavelet to learn band-pass filters that capture anomaly signals.
AMNet [6] employs a restricted Bernstein polynomial parameterization to approximate filters in multi-frequency groups.
CARE-GNN [19], PCGNN [40], and GHRN [21] adaptively prune inter-class edges based on neighbor distributions or the graph spectrum.
PMP [74] introduces a partitioned message-passing mechanism to handle homophilic and heterophilic neighbors independently.
To address settings with limited labeled data, CGenGA [46] proposes a diffusion-based graph generation method to synthesize additional training nodes, while ConsisGAD [8] incorporates learnable data augmentation to utilize the abundance of unlabeled data for consistency training.
Furthermore, GGAD [54] introduces a novel semi-supervised framework using only labeled normal nodes.

Additionally, several works have explored GAD within the pre-training and fine-tuning paradigm.
DCI [67] decouples representation learning and classification through a cluster-enhanced self-supervised learning task.
[12] evaluates the performance of DGI [63] and GraphMAE [29] for GAD, demonstrating the potential of leveraging graph pre-training to enhance GAD with limited supervision.
However, most existing methods pre-train a uniform global low-pass filter (e.g., GCN [34]) and then fine-tune a classifier on frozen node representations.
The heterophily of abnormal nodes in GAD presents a significant challenge for directly applying these methods.
To address this, we propose a pre-training and fine-tuning framework tailored for GAD.

### B.2 Graph Pre-Training

Graph pre-training has emerged as a promising paradigm for label-efficient learning [32].
These methods first learn universal knowledge from unlabeled data using self-supervised objectives, which are then transferred to tackle specific downstream tasks.
Existing pre-training approaches can be broadly categorized into two groups: contrastive and non-contrastive approaches.

Contrastive approaches typically follow the principle of mutual information maximization [27], where the objective functions contrast positive pairs against negative ones.
For instance, DGI [63] and DCI [67] focus on representation learning by maximizing the mutual information between node-level representations and a global summary representation.
GRACE [72], GCA [73], and NS4GC [42] learn node representations by pulling together the representations of the same node (positive pairs) across two augmented views, while pushing apart the representations of different nodes (negative pairs) across both views.

Non-contrastive approaches, on the other hand, eliminate the need for negative samples.
For example, CCA-SSG [70] and G-BT [3] aim to learn augmentation-invariant information while introducing feature decorrelation to capture orthogonal features.
BGRL [61] and BLNN [44] employ asymmetric architectures that learn node representations by predicting alternative augmentations of the input graph and maximizing the similarity between the predictions and their corresponding targets.
GraphMAE [29] focuses on feature reconstruction using a masking strategy and scaled cosine error.
Additionally, SSGE [43] minimizes the distance between the distribution of learned representations and the isotropic Gaussian distribution to promote the uniformity of node representations.

However, the methods discussed above rely on low-pass GNN encoders that inherently smooth neighbor representations, leading to unsatisfactory performance on heterophilic abnormal nodes.
Although a recent work, PolyGCL [7], employs both low- and high-pass encoders, it combines them using a simple linear strategy to obtain final node representations for fine-tuning.
This approach is less flexible and effective than our proposed node- and dimension-adaptive fine-tuning strategy, as demonstrated in Theorem [1](https://arxiv.org/html/2504.14250v2#Thmtheorem1).

## Appendix C Limitations

While APF demonstrates strong performance across a wide range of benchmarks, it exhibits limitations in certain scenarios.
Specifically, APF underperforms tree-based models such as XGBGraph on datasets like Amazon and Elliptic, where node features are highly heterogeneous and dominate over structural signals.
This suggests that in such cases, tree-based models, known for their robustness to feature heterogeneity, may outperform deep learning-based GNNs [22].
Future work could explore hybrid architectures that better integrate rich tabular features with graph topology.

Moreover, although APF is designed as a tailored framework for graph anomaly detection and holds promise in real-world applications such as financial fraud and cybersecurity, false positives remain a concern.
Misclassifying normal nodes as anomalies may lead to unnecessary disruptions or adverse consequences for benign users.
Addressing such risks requires further research into uncertainty quantification and trustworthy anomaly detection in graph settings.

## Appendix D Proof of Theorem 1

###### Proof.

The proof is derived from [2], which analyzes the linear separability of a single graph convolution under a single CSBM model with only one pattern $CSBM(n,\boldsymbol{\mu},\boldsymbol{\nu},(p,q))$. We extend the analysis to our $ASBM(n_{a},n_{n},\boldsymbol{\mu},\boldsymbol{\nu},(p_{1},q_{1}),(p_{2},q_{2})
,P_{a},P_{n})$.

Following [2], our analysis is based on the following assumptions: 1) The graph size $n$ is relatively large, with $\omega(d\log d)\leq n\leq\mathcal{O}(poly(d))$. 2) The graph is not too sparse, with $p_{1},q_{1},p_{2},q_{2}=\omega(\log^{2}(n)/n)$.
The first assumption ensures that the number of nodes is at least quasilinearly large and at most polynomially large relative to the feature dimension. The second assumption ensures that the CSBM is not excessively sparse, maintaining a significant difference between the number of intra-class and inter-class edges.
Additionally, we assume that the sizes of the homophilic and heterophilic node sets are approximately equal for theoretical tractability.

For simplicity, we use the random walk normalized adjacency matrix, $\boldsymbol{D}^{-1}\boldsymbol{A}$, as the low-pass filter, and its negative, $-\boldsymbol{D}^{-1}\boldsymbol{A}$, as the high-pass filter [2, 47, 45, 48, 23, 64]. Due to the Gaussian distribution of node features, the filtered node features also follow a Gaussian distribution. Specifically, for the low-pass filtered node features $\boldsymbol{\hat{X}}=\boldsymbol{D}^{-1}\boldsymbol{A}\boldsymbol{X}$, the means of nodes in different classes and patterns are given by [2]:

$$ $\mathbb{E}(\boldsymbol{\hat{X}}_{i})=\left\{\begin{aligned} \frac{p_{1} \boldsymbol{\mu}+q_{1}\boldsymbol{\nu}}{p_{1}+q_{1}}(1+o(1))\quad\text{for}\,i \in\mathcal{C}_{a}\cap\mathcal{H}_{o},\\ \frac{q_{1}\boldsymbol{\mu}+p_{1}\boldsymbol{\nu}}{p_{1}+q_{1}}(1+o(1))\quad \text{for}\,i\in\mathcal{C}_{n}\cap\mathcal{H}_{o},\\ \frac{p_{2}\boldsymbol{\mu}+q_{2}\boldsymbol{\nu}}{p_{2}+q_{2}}(1+o(1))\quad \text{for}\,i\in\mathcal{C}_{a}\cap\mathcal{H}_{e},\\ \frac{q_{2}\boldsymbol{\mu}+p_{2}\boldsymbol{\nu}}{p_{2}+q_{2}}(1+o(1))\quad \text{for}\,i\in\mathcal{C}_{n}\cap\mathcal{H}_{e},\\ \end{aligned}\right.$ (15) $$

where $\mathcal{C}_{a}$ and $\mathcal{C}_{n}$ represent the abnormal and normal node sets, respectively, while $\mathcal{H}_{o}$ and $\mathcal{H}_{e}$ denote the homophilic and heterophilic node sets. The covariance matrix for $\boldsymbol{\hat{X}}_{i}$ is given by $\mathbb{C}(\boldsymbol{\hat{X}}_{i})=\frac{1}{d\boldsymbol{D}_{ii}}$. Based on Lemma 2 in [2], for any unit vector $\boldsymbol{w}$, we have

$$ $\left|\left(\boldsymbol{\hat{X}}_{i}-\mathbb{E}(\boldsymbol{\hat{X}}_{i}) \right)\cdot\mathbf{w}\right|=\mathcal{O}\left(\sqrt{\frac{\log n}{dn(p_{1}+q_ {1})}}\right).$ (16) $$

When considering only the nodes in the homophily set $\mathcal{H}_{o}$, Lemma 3 in [2] shows that an optimal linear classifier can be found with the following parameters:

$$ $\boldsymbol{w}^{*}=R\frac{\boldsymbol{\nu}-\boldsymbol{\mu}}{\|\boldsymbol{\mu }-\boldsymbol{\nu}\|},\quad b^{*}=-\frac{\langle\boldsymbol{\mu}+\boldsymbol{ \nu},\boldsymbol{w}^{*}\rangle}{2},$ (17) $$

where $R$ is the norm constraint, i.e., $\|\boldsymbol{w}\|\leq R$, and the distance between $\boldsymbol{\mu}$ and $\boldsymbol{\nu}$ is sufficiently large, with $\|\boldsymbol{\mu}-\boldsymbol{\nu}\|=\Omega(\frac{\log n}{\sqrt{dn(p_{1}+q_{1
})}})$. This linear classifier can correctly separate homophily nodes $\mathcal{H}_{o}$. Specifically, for $i\in\mathcal{C}_{a}\cap\mathcal{H}_{o}$, we have:

$$ $\displaystyle\langle\boldsymbol{\hat{X}}_{i},\boldsymbol{w}^{*}\rangle+b^{*}$ (18) $\displaystyle=\frac{\langle p_{1}\boldsymbol{\mu}+q_{1}\boldsymbol{\nu}, \boldsymbol{w}^{*}\rangle}{p_{1}+q_{1}}(1+o(1))+\mathcal{O}\left(\|\boldsymbol {w}^{*}\|\sqrt{\frac{\log n}{dn(p1+q1)}}\right)-\frac{\langle\boldsymbol{\mu}+ \boldsymbol{\nu},\boldsymbol{w}^{*}\rangle}{2}$ $\displaystyle=\frac{\langle 2p_{1}\boldsymbol{\mu}+2q_{1}\boldsymbol{\nu}-(p_{ 1}+q_{1})(\boldsymbol{\mu}+\boldsymbol{\nu}),\boldsymbol{w}^{*}\rangle}{2(p_{1 }+q_{1})}(1+o(1))+o(\|\boldsymbol{w}^{*}\|)$ $\displaystyle=\frac{p_{1}-q_{1}}{2(p_{1}+q_{1})}\langle\boldsymbol{\mu}- \boldsymbol{\nu},\boldsymbol{w}^{*}\rangle(1+o(1))+o(\|\boldsymbol{w}^{*}\|)$ $\displaystyle=-\frac{R(p_{1}-q_{1})}{2(p_{1}+q_{1})}\|\boldsymbol{\mu}- \boldsymbol{\nu}\|(1+o(1))<0.$ $$

Similarity, for $i\in\mathcal{C}_{n}\cap\mathcal{H}_{o}$, we obtain:

$$ $\langle\boldsymbol{\hat{X}}_{i},\boldsymbol{w}^{*}\rangle+b^{*}=-\frac{R(q_{1} -p_{1})}{2(p_{1}+q_{1})}\|\boldsymbol{\mu}-\boldsymbol{\nu}\|(1+o(1))>0.$ (19) $$

However, if we apply this linear classifier to the heterophilic node set $\mathcal{H}_{e}$, where $p_{2}<q_{2}$, all nodes are misclassified:

$$ $\langle\boldsymbol{\hat{X}}_{i},\boldsymbol{w}^{*}\rangle+b^{*}=\left\{\begin{ aligned} -\frac{R(p_{2}-q_{2})}{2(p_{2}+q_{2})}\|\boldsymbol{\mu}-\boldsymbol{ \nu}\|(1+o(1))>0\quad\text{for}\,i\in\mathcal{C}_{a}\cap\mathcal{H}_{e},\\ -\frac{R(q_{2}-p_{2})}{2(p_{2}+q_{2})}\|\boldsymbol{\mu}-\boldsymbol{\nu}\|(1+ o(1))<0\quad\text{for}\,i\in\mathcal{C}_{n}\cap\mathcal{H}_{e}.\\ \end{aligned}\right.$ (20) $$

Next, consider the high-pass filtered node features $\boldsymbol{\hat{X}}=-\boldsymbol{D}^{-1}\boldsymbol{A}\boldsymbol{X}$, the mean of nodes in different classes and patterns are given by:

$$ $\mathbb{E}(\boldsymbol{\hat{X}}_{i})=\left\{\begin{aligned} -\frac{p_{1} \boldsymbol{\mu}+q_{1}\boldsymbol{\nu}}{p_{1}+q_{1}}(1+o(1))\quad\text{for}\,i \in\mathcal{C}_{a}\cap\mathcal{H}_{o},\\ -\frac{q_{1}\boldsymbol{\mu}+p_{1}\boldsymbol{\nu}}{p_{1}+q_{1}}(1+o(1))\quad \text{for}\,i\in\mathcal{C}_{n}\cap\mathcal{H}_{o},\\ -\frac{p_{2}\boldsymbol{\mu}+q_{2}\boldsymbol{\nu}}{p_{2}+q_{2}}(1+o(1))\quad \text{for}\,i\in\mathcal{C}_{a}\cap\mathcal{H}_{e},\\ -\frac{q_{2}\boldsymbol{\mu}+p_{2}\boldsymbol{\nu}}{p_{2}+q_{2}}(1+o(1))\quad \text{for}\,i\in\mathcal{C}_{n}\cap\mathcal{H}_{e}.\\ \end{aligned}\right.$ (21) $$

Applying the same linear classifier with $\boldsymbol{w}^{*}$ and $b^{*}$ yields the following results:

$$ $\langle\boldsymbol{\hat{X}}_{i},\boldsymbol{w}^{*}\rangle+b^{*}=\left\{\begin{ aligned} \frac{R(p_{2}-q_{2})}{2(p_{2}+q_{2})}\|\boldsymbol{\mu}-\boldsymbol{ \nu}\|(1+o(1))<0\quad\text{for}\,i\in\mathcal{C}_{a}\cap\mathcal{H}_{e},\\ \frac{R(q_{2}-p_{2})}{2(p_{2}+q_{2})}\|\boldsymbol{\mu}-\boldsymbol{\nu}\|(1+o (1))<0\quad\text{for}\,i\in\mathcal{C}_{n}\cap\mathcal{H}_{e}.\\ \end{aligned}\right.$ (22) $$

Therefore, the same linear classifier is capable of separating both the homophilic node set $\mathcal{H}_{o}$ and the heterophilic node set $\mathcal{H}_{e}$. And according to part 2 of Theorem 1 in [2], we have

$$ $\mathbb{P}\left(\left(\boldsymbol{\hat{X}_{i}}\right)_{i\in\mathcal{V}^{L}} \text{is linearly separable}\right)=1-o_{d}(1),$ (23) $$

where $o_{d}(1)$ denotes a quantity that converges to 0 as $d\to\infty$.
∎

###### Proof.

## Appendix E Formulations of Fusion Methods

Here, we provide the mathematical formulations of the fusion methods described in Section [4.3](https://arxiv.org/html/2504.14250v2#S4.SS3.SSS0.Px1).
These fusion methods aim to generate overall node representations $\boldsymbol{Z}$ by combining the representations generated by the low-pass encoder ($\boldsymbol{Z}_{L}\in\mathbb{R}^{n\times e}$) and high-pass encoder ($\boldsymbol{Z}_{H}\in\mathbb{R}^{n\times e}$).

- •
The "Mean" method averages the representations from the low-pass and high-pass encoders, i.e., $\boldsymbol{Z}=0.5\cdot(\boldsymbol{Z}_{L}+\boldsymbol{Z}_{H})$.
- •
The "Concat" method concatenates the representations from the low-pass and high-pass encoders, i.e., $\boldsymbol{Z}=[\boldsymbol{Z}_{L},\boldsymbol{Z}_{H}]$.
- •
The "Atten." method [6] employs an attention mechanism to learn the weights $\boldsymbol{\alpha}_{L},\boldsymbol{\alpha}_{H}\in[0,1]^{n\times 1}$ for $n$ nodes, such that $\boldsymbol{Z}=\boldsymbol{\alpha}_{L}\cdot\boldsymbol{Z}_{L}+\boldsymbol{
\alpha}_{H}\cdot\boldsymbol{Z}_{H}$.
Specifically, for node $v_{i}$ with $\boldsymbol{Z}_{i}^{L},\boldsymbol{Z}_{i}^{H}\in\mathbb{R}^{1\times e}$, the attention scores are computed as:
$\displaystyle\omega_{i}^{L}$
$\displaystyle=\boldsymbol{q}^{\top}\cdot\text{tanh}\left(\boldsymbol{W}_{Z}^{L
}\boldsymbol{Z}_{i}^{L^{\top}}+\boldsymbol{W}_{X}^{L}\boldsymbol{x}_{i}\right),$
(24)
$\displaystyle\omega_{i}^{H}$
$\displaystyle=\boldsymbol{q}^{\top}\cdot\text{tanh}\left(\boldsymbol{W}_{Z}^{H
}\boldsymbol{Z}_{i}^{H^{\top}}+\boldsymbol{W}_{X}^{H}\boldsymbol{x}_{i}\right),$
where $\boldsymbol{W}_{Z}^{L},\boldsymbol{W}_{Z}^{H}\in\mathbb{R}^{e^{\prime}\times e}$ and $\boldsymbol{W}_{X}^{L},\boldsymbol{W}_{X}^{H}\in\mathbb{R}^{e^{\prime}\times d}$ are learnable parameter matrices, and $\boldsymbol{q}\in\mathbb{R}^{e^{\prime}\times 1}$ is the shared attention vector.
The final attention weights of node $v_{i}$ are obtained by normalizing the attention values using the softmax function:
$\displaystyle\alpha_{i}^{L}$
$\displaystyle=\frac{\exp(\omega_{i}^{L})}{\exp(\omega_{i}^{L})+\exp(\omega_{i}
^{H})},$
(25)
$\displaystyle\alpha_{i}^{H}$
$\displaystyle=\frac{\exp(\omega_{i}^{H})}{\exp(\omega_{i}^{L})+\exp(\omega_{i}
^{H})}.$

## Appendix F Time Complexity

We analyze the time complexity of our proposed APF framework by dividing the computation into three stages. Let $n$ and $m$ denote the number of nodes and edges in the graph, respectively, and let $K$ be the order of the spectral polynomial filters.

##### Preprocessing.

We first extract a Rayleigh Quotient-guided sub-tree $\mathcal{G}_{i}^{RQ}$ for each node using the MRQSampler [38], which has a total complexity of $O(n\log n)$. Since the sampling for each node is independent, this step can be parallelized to further reduce runtime. Importantly, this subgraph sampling is performed only once and reused in both training and inference, thereby introducing minimal overhead.

##### Pre-training.

The coefficients of the polynomial filters in APF can be precomputed in time linear to $K$. Given that $K$-order spectral filters propagate information across $K$ hops, the filtering process requires $O(Km+Kn)$ time. The loss function $\mathcal{L}_{pt}$, which operates over all nodes and edges, incurs an additional $O(n+m)$ cost. The overall time complexity of the pre-training stage is therefore $O((K+1)(m+n))$, which scales linearly with the graph size and filter order.

##### Fine-tuning.

The gated fusion network computes adaptive coefficients with complexity $O(n)$, and the two-layer MLP used for classification adds another $O(2n)$. The anomaly-aware loss $\mathcal{L}_{ft}$ involves only the labeled nodes and thus contributes $O(l)$, where $l$ is the number of labeled nodes. The total fine-tuning complexity is $O(3n+l)$.

In summary, the pre-training and fine-tuning phases of APF scale linearly with the graph size. Given that the sub-tree extraction is only performed once and can be computed in parallel, APF exhibits strong scalability and is well-suited for large-scale graphs. For example, our model can be applied to datasets like T-Social, which contains over 5.7 million nodes and 73 million edges. We additionally conduct efficiency comparison in Appendix [G.5](https://arxiv.org/html/2504.14250v2#A7.SS5).

## Appendix G Additional Experimental Details

### G.1 Datasets

Following GADBench [59], we conduct experiments on 10 real-world datasets spanning various scales and domains. Reddit [35], Weibo [35], Questions [51], and T-Social [60] focus on detecting anomalous accounts on social media platforms.
Tolokers [51], Amazon [49], and YelpChi [55] are designed to identify fraudulent workers, reviews, and reviewers in crowdsourcing or e-commerce platforms.
T-Finance [60], Elliptic [68], and DGraph-Fin [30] target the detection of fraudulent users, illicit entities, and overdue loans in financial networks.
Dataset Statistics are presented in Table [3](https://arxiv.org/html/2504.14250v2#A7.T3). Detailed descriptions of these datasets are as follows.

- •
Reddit [35]: This dataset includes a user-subreddit graph, capturing one month’s worth of posts shared across various subreddits.
It includes verified labels for banned users and focuses on the 1,000 most active subreddits and the 10,000 most engaged users, resulting in 672,447 interactions.
Posts are represented as feature vectors based on Linguistic Inquiry and Word Count (LIWC) categories.
- •
Weibo [35]: This dataset consists of a user-hashtag graph from the Tencent-Weibo platform, containing 8,405 users and 61,964 hashtags.
Suspicious activities are defined as posting two messages within a specific time frame, such as 60 seconds.
Users engaged in at least five such activities are labeled as "suspicious," while others are categorized as "benign."
The feature vectors are based on the location of posts and bag-of-words features.
- •
Amazon [49]: This dataset focuses on detecting users who are paid to write fake reviews for products in the Musical Instrument category on Amazon.com.
It contains three types of relationships: U-P-U (users reviewing the same product), U-S-U (users giving the same star rating within one week), and U-V-U (users with top 5% mutual review similarities).
- •
YelpChi [55]: This dataset aims to identify anomalous reviews on Yelp.com that unfairly promote or demote products or businesses.
It includes three types of edges: R-U-R (reviews by the same user), R-S-R (reviews for the same product with the same star rating), and R-T-R (reviews for the same product within the same month).
- •
T-Finance [60]: This dataset is designed to detect anomalous accounts in transaction networks.
The nodes represent unique anonymized accounts with 10-dimensional features related to registration days, login activities, and interaction frequency.
Edges represent transactions between accounts, and anomalies are annotated by human experts based on categories such as fraud, money laundering, and online gambling.
- •
Elliptic [68]: This dataset includes over 200,000 Bitcoin transactions (nodes), 234,000 directed payment flows (edges), and 166 node features.
It maps Bitcoin transactions to real-world entities, categorizing them as either licit (e.g., exchanges, wallet providers, miners) or illicit (e.g., scams, malware, terrorist organizations, ransomware, and Ponzi schemes).
- •
Tolokers [51]: This dataset is derived from the Toloka crowdsourcing platform.
Nodes represent workers who have participated in at least one of 13 selected projects. An edge connects two workers if they collaborate on the same task.
The goal is to predict which workers were banned in any of the projects.
Node features are based on worker profiles and task performance.
- •
Questions [51]: This dataset is collected from the Yandex Q question-answering platform. It includes users as nodes, with edges representing answers between users during a one-year period (September 2021 to August 2022).
It focuses on users interested in the "medicine" topic. The task is to predict which users remained active by the end of the period.
Node features include the mean of FastText embeddings for words in the user descriptions, with a binary feature indicating users without descriptions.
- •
DGraph-Fin [30]: This dataset is a large-scale dynamic graph from the Finvolution Group representing a financial industry social network.
Nodes represent users, and edges indicate emergency contact relationships.
Anomalous nodes correspond to users exhibiting overdue behaviors.
The dataset includes over 3 million nodes, 4 million dynamic edges, and more than 1 million unbalanced ground-truth anomalies.
- •
T-Social [60]: This dataset targets anomalous accounts in social networks.
Nodes share the same annotations and features as those in T-Finance, with edges representing friend relationships maintained for more than three months.
Anomalous nodes are annotated by experts in categories like fraud, money laundering, and online gambling.

**Table 3: Dataset statistics including the number of nodes and edges, the node feature dimension, the ratio of anomalies, the local homophily, the concept of relations, and the type of node features. $h^{a}$, and $h^{n}$ represent the average local homophily for abnormal nodes and normal nodes respectively. *As shown, $h^{a}$ is much smaller than $h^{n}$, highlighting the presence of class-level local homophily disparity.* "Misc." refers to node features that are a combination of heterogeneous attributes, which may include categorical, numerical, and temporal information.**
| Dataset | #Nodes | #Edges | #Feat. | Anomaly | $h^{a}$ | $h^{n}$ | Relation Concept | Feature Type |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Reddit | 10,984 | 168,016 | 64 | 3.3% | 0.000 | 0.994 | Under Same Post | Text Embedding |
| Weibo | 8,405 | 407,963 | 400 | 10.3% | 0.858 | 0.977 | Under Same Hashtag | Text Embedding |
| Amazon | 11,944 | 4,398,392 | 25 | 9.5% | 0.102 | 0.968 | Review Correlation | Misc. Information |
| YelpChi | 45,954 | 3,846,979 | 32 | 14.5% | 0.195 | 0.867 | Reviewer Interaction | Misc. Information |
| T-Finance | 39,357 | 21,222,543 | 10 | 4.6% | 0.543 | 0.976 | Transaction Record | Misc. Information |
| Elliptic | 203,769 | 234,355 | 166 | 9.8% | 0.234 | 0.985 | Payment Flow | Misc. Information |
| Tolokers | 11,758 | 519,000 | 10 | 21.8% | 0.476 | 0.679 | Work Collaboration | Misc. Information |
| Questions | 48,921 | 153,540 | 301 | 3.0% | 0.111 | 0.922 | Question Answering | Text Embedding |
| DGraph-Fin | 3,700,550 | 4,300,999 | 17 | 1.3% | 0.013 | 0.997 | Loan Guarantor | Misc. Information |
| T-Social | 5,781,065 | 73,105,508 | 10 | 3.0% | 0.174 | 0.900 | Social Friendship | Misc. Information |

Figure: (a) Reddit
Refer to caption: x15.png

### G.2 Baselines

We compare our model with a series of baseline methods, which can be categorized into the following groups:
(1) Standard GNN Architectures, including GCN [34], GIN [69], GAT [62], ACM [45], FAGCN [4], AdaGNN [18], and BernNet [25];
(2) GNNs Specialized for GAD, including GAS [37], DCI [67], PCGNN [40], AMNet [6], BWGNN [60], GHRN [21], ConsisGAD [8], SpaceGNN [17], and XGBGraph [59];
(3) Graph Pre-Training Methods, including DGI [63], GRACE [72], G-BT [3], GraphMAE [29], BGRL [61], SSGE [43], PolyGCL [7], and BWDGI which incorporates BWGNN and DGI.
Detailed descriptions of these baselines are as follows.

#### G.2.1 Standard GNN Architectures

- •
GCN [34] employs a convolutional operation on the graph to propagate information from each node to its neighboring nodes, enabling the network to learn a representation for each node based on its local neighborhood.
- •
GIN [69] is designed to capture the structural properties of a graph while preserving graph isomorphism.
Specifically, it generates identical embeddings for graphs that are structurally identical, regardless of permutations in node labels.
- •
GAT [62] incorporates an attention mechanism, assigning different levels of importance to nodes during the information aggregation process.
This allows the model to focus on the most relevant nodes within a neighborhood.
- •
ACM [45] leverages low-, high, and full-pass spectral filters and an attention-based mixing mechanism to adaptively extract richer localized information for diverse node heterophily situations.
- •
FAGCN [4] adaptively integrates low-frequency and high-frequency signals through a self-gating mechanism.
This approach enhances the model’s ability to handle both homophilic and heterophilic networks.
- •
AdaGNN [18] leverages an adaptive frequency response filter to capture the varying importance of different frequency components for node representation learning.
This approach improves the expressiveness of the model and alleviates the over-smoothing problem.
- •
BernNet [25] provides a robust framework for designing and learning arbitrary graph spectral filters.
It uses an order-K Bernstein polynomial approximation to estimate filters over the normalized Laplacian spectrum of a graph.

#### G.2.2 GNNs Specialized for GAD

- •
GAS [37] is a highly scalable method for detecting spam reviews. It extends GCN to handle heterogeneous and heterophilic graphs and adapts to the graph structure of specific GAD applications using the KNN algorithm.
- •
DCI [67] reduces inconsistencies between node behavior patterns and label semantics, and captures intrinsic graph properties within concentrated feature spaces by clustering the graph into multiple segments.
- •
PCGNN [40] uses a label-balanced sampler to select nodes and edges for training, ensuring a balanced label distribution in the induced subgraph.
Additionally, it employs a learnable, parameterized distance function to select neighbors, filtering out redundant links while adding beneficial ones for improved fraud prediction.
- •
AMNet [6] captures both low- and high-frequency signals by stacking multiple BernNets, adaptively combining signals from different frequency ranges.
- •
BWGNN [60] addresses the "right-shift" phenomenon in graph anomalies, where spectral energy distribution shifts from low to high frequencies.
It uses a Beta kernel to address high-frequency anomalies through flexible, spatially- and spectrally-localized band-pass filters.
- •
GHRN [21] targets the heterophily problem in the spectral domain for graph anomaly detection.
This method prunes inter-class edges to highlight and delineate the graph’s high-frequency components.
- •
ConsisGAD [8] focuses on graph anomaly detection with limited supervision.
It incorporates learnable data augmentation to utilize the abundance of unlabeled data for consistency training.
- •
SpaceGNN [17] integrates learnable space projection, distance-aware propagation, and multiple space ensemble modules to leverage the benefits of different spaces (Euclidean, hyperbolic, and spherical) for node anomaly detection with extremely limited labels.
- •
XGBGraph [59] first aggregates features from neighboring nodes to enhance the representation of each node, and then uses XGBoost [9] to classify nodes as normal or anomalous.
This approach leverages the robustness and efficiency of tree ensembles while incorporating graph structure to improve anomaly detection performance.

#### G.2.3 Graph Pre-Training Methods

- •
DGI [63] learns representations by maximizing the mutual information between node representations and a global summary representation.
- •
GRACE [63] learns node representations by pulling together the representations of the same node (positive pairs) across two augmented views, while pushing apart the representations of different nodes (negative pairs) across both views.
- •
GraphMAE [29] is a masked graph auto-encoder that focuses on feature reconstruction using both a masking strategy and scaled cosine error.
- •
BGRL [61] employs asymmetric architectures to learn node representations by predicting alternative augmentations of the input graph and maximizing the similarity between these predictions and their corresponding targets.
- •
G-BT [3] utilizes a cross-correlation-based loss function to reduce redundancy in the learned representations, which enjoys fewer hyperparameters and significantly reduced computation time.
- •
SSGE [43] minimizes the distance between the distribution of learned representations and an isotropic Gaussian distribution, promoting the uniformity of node representations.
- •
PolyGCL [7] addresses heterophilic challenges in graph pre-training by using polynomial filters as encoders and incorporating a combined linear objective between low- and high-frequency components in the spectral domain.
- •
BWDGI pre-trains the state-of-the-art GAD backbone BWGNN [60] using DGI [63] as the pretext objective.

### G.3 Evaluation Protocols

Following GADBench [59], we evaluate performance using three popular metrics: the Area Under the Receiver Operating Characteristic Curve (AUROC), the Area Under the Precision-Recall Curve (AUPRC) calculated via average precision, and the Recall score within the top-$K$ predictions (Rec@K).
Here, $K$ corresponds to the number of anomalies in the test set.
For all metrics, anomalies are treated as the positive class, with higher scores indicating better model performance.
To closely simulate real-world scenarios with limited supervision, we standardize the training/validation set across all datasets to include 100 labels — 20 positive (abnormal) and 80 negative (normal) labels [59].
To ensure the robustness of our findings, we perform 10 random splits, as provided by GADBench, on each dataset and report the average performance.

### G.4 Implementation Details

We use the implementations of all baseline methods provided by GADBench [59] or the respective authors.
Our APF model is implemented using PyTorch and the Deep Graph Library (DGL) [65].
Experiments are conducted on a Linux server equipped with an Intel(R) Xeon(R) Gold 6248 CPU @ 2.50GHz and a 32GB NVIDIA Tesla V100 GPU.

During the pre-training phase, each model is trained for up to 800 epochs using the Adam optimizer [33], with a patience of 20.
Hyperparameters are tuned as follows: filter order $\in\{2,3\}$, learning rate $\in\{0.01,0.001,0.0001\}$, representation dimension $\in\{32,64\}$, activation function $\in\{\text{ReLU},\text{ELU},\text{PReLU},\text{Tanh}\}$, and normalization $\in\{\text{none},\text{batch},\text{layer}\}$. For efficiency, we extract 1-hop sub-trees instead of 2-hop ones on denser or larger datasets Amazon, T-Finance, and T-Social.

During the fine-tuning phase, a 2-layer MLP classifier is trained for up to 500 epochs using the Adam optimizer [33], with a learning rate of 0.01 and weight decay selected from $\{0.0,0.01,0.0001\}$.
The classifier with the highest validation AUROC score is selected for testing.
The hyperparameters $p_{n}$ and $p_{a}$ are varied within the range of 0.0 to 1.0.

### G.5 Additional Experiments

##### Efficiency Comparison.

We evaluate the training time and memory usage of APF on two large-scale datasets, YelpChi and T-Social, as shown in Table [4](https://arxiv.org/html/2504.14250v2#A7.T4).
Compared to end-to-end models like GCN, AMNet, and BWGNN, APF incurs higher computational costs due to its pre-training phase.
However, it remains more efficient than GHRN, which performs fine-grained edge-level operations and thus consumes substantially more memory, particularly on large graphs.
When compared to models specifically designed for label-scarce settings, e.g., ConsisGAD and SpaceGNN, our method demonstrates lower training time and comparable or even lower memory usage.
Overall, although APF introduces moderate computational overhead due to its two-stage design, the additional cost is justified by the significant gains in anomaly detection performance.
These results demonstrate that APF is a viable and scalable solution for real-world, large-scale GAD applications.

**Table 4: Efficiency comparison in terms of training time and GPU memory.**
| Model | YelpChi | T-Social |  |  |
| --- | --- | --- | --- | --- |
| Time (s) | Mem. (MB) | Time (s) | Mem. (MB) |  |
| GCN | 1.93 | 547.73 | 61.75 | 13241.26 |
| AMNet | 4.09 | 773.38 | 213.82 | 18970.04 |
| BWGNN | 2.66 | 729.17 | 112.01 | 16146.46 |
| GHRN | 3.22 | 3360.71 | 161.00 | 28080.33 |
| ConsisGAD | 89.28 | 16390.42 | 1674.87 | 14145.61 |
| SpaceGNN | 13.80 | 24217.29 | 1273.43 | 20518.91 |
| APF | 7.89 | 1370.62 | 569.35 | 26351.84 |

##### Under Varying Supervision.

This section evaluates the performance of APF under varying levels of supervision by modifying the number of labeled abnormal nodes.
Following [59], the number of labeled normal nodes is set to four times the number of labeled abnormal nodes.
We present the results in terms of AUPRC, AUROC, and Rec@K in Figures [7](https://arxiv.org/html/2504.14250v2#A7.F7), [8](https://arxiv.org/html/2504.14250v2#A7.F8), and [9](https://arxiv.org/html/2504.14250v2#A7.F9), respectively.
As expected, performance generally improves across all methods as the number of labeled nodes increases.
Notably, APF delivers consistent improvements over baseline pre-training methods and surpasses the state-of-the-art GAD models, even with only 5 labeled abnormal nodes.
This highlights the effectiveness of our approach in addressing GAD with limited supervision.

Figure: Figure 7: How the AUPRC score varies with different numbers of labeled anomalies.
Refer to caption: x25.png

Figure: Figure 8: How the AUROC score varies with different numbers of labeled anomalies.
Refer to caption: x26.png

Figure: Figure 9: How the Rec@K score varies with different numbers of labeled anomalies.
Refer to caption: x27.png

##### Additional Results for Model Comparison.

We provide additional results in terms of AUROC and Rec@K for model comparison in Table [5](https://arxiv.org/html/2504.14250v2#A7.T5) and Table [6](https://arxiv.org/html/2504.14250v2#A7.T6), respectively.

**Table 5: Comparison of AUROC for each model. "-" denotes "out of memory". The best and runner-up models are bolded and underlined.**
| Model | Reddit | Weibo | Amazon | Yelp. | T-Fin. | Ellip. | Tolo. | Quest. | DGraph. | T-Social | Avg. |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| GCN | 56.9±5.9 | 93.5±6.6 | 82.0±0.3 | 51.2±3.7 | 88.3±2.5 | 86.2±1.9 | 64.2±4.8 | 60.0±2.2 | 66.2±2.5 | 71.6±10.4 | 72.0 |
| GIN | 60.0±4.1 | 83.8±8.3 | 91.6±1.7 | 62.9±7.3 | 84.5±4.5 | 88.2±0.9 | 66.8±5.2 | 62.2±2.2 | 65.7±1.8 | 70.4±7.4 | 73.6 |
| GAT | 60.5±3.9 | 86.4±7.7 | 92.4±1.9 | 65.6±4.0 | 85.0±4.5 | 88.5±2.1 | 68.1±3.0 | 62.3±1.4 | 67.2±1.9 | 75.4±4.8 | 75.1 |
| ACM | 60.0±4.3 | 92.5±2.9 | 81.8±7.9 | 61.3±3.8 | 82.2±8.1 | 90.6±0.8 | 69.3±4.2 | 60.8±4.1 | 67.6±5.3 | 68.3±4.9 | 73.4 |
| FAGCN | 60.2±4.1 | 83.4±7.7 | 90.4±1.9 | 62.4±2.9 | 82.6±8.4 | 86.1±3.0 | 68.1±6.6 | 60.8±3.2 | 63.0±3.7 | - | - |
| AdaGNN | 62.0±4.7 | 69.5±4.8 | 90.8±2.2 | 63.2±3.1 | 83.6±2.6 | 85.1±2.8 | 63.3±5.3 | 58.5±4.1 | 67.6±3.7 | 64.7±5.6 | 70.8 |
| BernNet | 63.1±1.7 | 80.1±6.9 | 92.1±2.4 | 65.0±3.7 | 91.2±1.0 | 87.0±1.7 | 61.9±5.6 | 61.8±6.4 | 69.0±1.4 | 59.8±6.3 | 73.1 |
| GAS | 60.6±3.0 | 81.8±7.0 | 91.6±1.9 | 61.1±5.2 | 88.7±1.1 | 89.0±1.4 | 62.7±2.8 | 57.5±4.4 | 69.9±2.0 | 72.1±8.8 | 73.5 |
| DCI | 61.0±3.1 | 89.3±5.3 | 89.4±3.0 | 64.1±5.3 | 88.0±3.2 | 88.5±1.3 | 67.6±7.1 | 62.2±2.5 | 65.3±2.3 | 74.2±3.3 | 75.0 |
| PCGNN | 52.8±3.4 | 83.9±8.1 | 93.2±1.2 | 65.1±4.8 | 92.0±1.1 | 87.5±1.4 | 67.4±2.1 | 59.0±4.0 | 68.4±4.2 | 69.1±2.4 | 73.8 |
| AMNet | 62.9±1.8 | 82.4±4.6 | 92.8±2.1 | 64.8±5.2 | 92.6±0.9 | 85.4±1.7 | 61.7±4.1 | 63.6±2.8 | 67.1±3.2 | 53.7±3.4 | 72.7 |
| BWGNN | 57.7±5.0 | 93.6±4.0 | 91.8±2.3 | 64.3±3.4 | 92.1±2.7 | 88.7±1.3 | 68.5±2.7 | 60.2±8.6 | 65.5±3.1 | 77.5±4.3 | 76.0 |
| GHRN | 57.5±4.5 | 91.6±4.4 | 90.9±1.9 | 64.5±3.1 | 92.6±0.7 | 89.0±1.3 | 69.0±2.2 | 60.5±8.7 | 67.1±3.0 | 78.7±3.0 | 76.1 |
| ConsisGAD | 59.6±2.8 | 85.0±3.7 | 92.3±2.2 | 66.1±3.8 | 94.3±0.8 | 88.6±1.3 | 68.5±2.0 | 65.7±3.9 | 67.1±3.0 | 93.1±1.9 | 78.0 |
| SpaceGNN | 62.3±1.9 | 94.4±0.9 | 91.1±2.5 | 66.8±2.8 | 93.4±1.0 | 88.5±1.2 | 68.9±2.6 | 66.0±1.8 | 63.9±3.7 | 94.7±0.7 | 79.0 |
| XGBGraph | 59.2±2.7 | 96.4±0.7 | 94.7±0.9 | 64.0±3.5 | 94.8±0.6 | 91.9±1.3 | 67.5±3.4 | 61.4±2.9 | 62.4±4.1 | 85.2±1.8 | 77.8 |
| DGI | 63.0±3.0 | 96.7±2.5 | 87.7±0.7 | 54.0±1.8 | 91.8±0.8 | 86.2±1.4 | 71.5±0.7 | 68.7±3.8 | 64.3±2.2 | 89.3±1.3 | 77.3 |
| GRACE | 64.5±3.3 | 97.1±1.9 | 87.9±0.7 | 55.5±1.4 | 93.1±0.3 | 88.8±1.8 | 70.6±1.6 | 68.2±1.7 | - | - | - |
| G-BT | 63.8±4.3 | 97.3±1.1 | 84.8±1.6 | 55.5±1.8 | 93.0±0.6 | 88.5±1.2 | 71.7±1.3 | 67.0±1.6 | 69.4±2.5 | 90.9±1.2 | 78.2 |
| GraphMAE | 61.0±0.5 | 95.7±2.3 | 84.2±0.3 | 55.2±0.3 | 91.4±0.7 | 82.5±1.4 | 66.3±3.0 | 62.5±1.4 | 63.7±1.6 | 89.2±4.5 | 75.2 |
| BGRL | 65.3±2.2 | 99.0±0.5 | 84.3±1.0 | 57.0±1.2 | 88.0±1.7 | 88.5±1.7 | 72.0±1.8 | 65.7±2.9 | 64.9±1.6 | 90.2±1.3 | 77.5 |
| SSGE | 62.2±4.7 | 95.1±1.6 | 84.7±2.0 | 55.7±1.8 | 92.9±0.7 | 86.7±1.2 | 71.9±1.5 | 65.5±1.5 | 68.6±2.9 | 92.3±0.8 | 77.6 |
| PolyGCL | 62.7±3.9 | 97.4±0.6 | 93.3±1.3 | 65.1±4.1 | 89.3±0.6 | 87.9±0.9 | 68.1±1.8 | 64.8±3.8 | 67.4±2.0 | 91.4±1.5 | 78.7 |
| BWDGI | 60.0±3.5 | 91.4±0.8 | 94.1±1.6 | 66.9±2.7 | 94.0±0.6 | 87.6±1.5 | 71.4±1.9 | 64.0±3.9 | 69.8±1.8 | 82.8±2.6 | 78.2 |
| APF (w/o $\mathcal{L}_{pt}$) | 63.6±2.2 | 96.3±3.2 | 92.9±2.9 | 65.6±3.4 | 94.2±0.5 | 90.4±0.7 | 70.8±1.5 | 67.2±2.4 | 69.0±1.6 | 94.4±1.5 | 80.4 |
| APF | 66.8±3.9 | 98.8±0.3 | 94.9±1.1 | 68.2±2.3 | 94.8±0.5 | 91.2±0.9 | 73.7±1.0 | 71.9±2.1 | 72.4±1.3 | 95.1±1.4 | 82.8 |

**Table 6: Comparison of Rec@K for each model. "-" denotes "out of memory". The best and runner-up models are bolded and underlined.**
| Model | Reddit | Weibo | Amazon | Yelp. | T-Fin. | Ellip. | Tolo. | Quest. | DGraph. | T-Social | Avg. |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| GCN | 6.2±2.2 | 79.2±4.3 | 36.9±2.6 | 16.9±3.0 | 60.6±7.6 | 49.7±4.2 | 33.4±3.5 | 9.8±1.2 | 3.6±0.4 | 10.2±8.1 | 30.6 |
| GIN | 4.8±1.9 | 66.5±7.3 | 70.4±5.7 | 26.5±6.1 | 54.4±5.0 | 47.6±3.1 | 33.6±3.0 | 10.3±1.1 | 2.1±0.5 | 5.3±2.9 | 32.2 |
| GAT | 6.5±2.3 | 70.2±4.6 | 77.1±1.7 | 28.1±3.4 | 36.2±10.3 | 51.4±5.8 | 35.1±1.8 | 10.9±0.9 | 3.1±0.7 | 11.6±3.0 | 33.0 |
| ACM | 5.4±1.8 | 70.7±9.5 | 56.1±14.2 | 23.9±3.8 | 37.2±19.3 | 60.2±3.3 | 35.8±4.2 | 11.4±2.6 | 1.9±0.7 | 8.1±1.8 | 31.1 |
| FAGCN | 7.2±1.9 | 67.8±8.1 | 71.7±3.1 | 25.0±2.8 | 39.6±30.3 | 48.5±11.3 | 35.6±3.7 | 12.3±2.3 | 2.5±0.8 | - | - |
| AdaGNN | 6.3±2.2 | 38.3±3.7 | 74.2±4.0 | 25.6±2.4 | 31.3±11.3 | 46.3±7.4 | 33.6±3.7 | 10.0±2.4 | 1.1±0.4 | 7.9±2.7 | 27.5 |
| BernNet | 6.4±1.5 | 60.9±4.6 | 77.2±2.1 | 26.8±3.1 | 60.5±11.1 | 47.0±4.5 | 30.1±3.8 | 10.3±2.7 | 3.8±0.6 | 3.3±2.8 | 32.6 |
| GAS | 6.6±2.5 | 62.0±6.9 | 77.4±1.7 | 24.6±4.1 | 54.2±9.5 | 51.9±5.2 | 33.0±3.9 | 9.1±2.9 | 3.4±0.4 | 11.5±4.6 | 33.4 |
| DCI | 4.5±1.4 | 68.5±3.5 | 68.3±7.2 | 26.8±5.3 | 58.5±6.3 | 50.0±3.8 | 33.5±5.6 | 9.9±1.9 | 2.3±0.7 | 6.3±6.8 | 32.9 |
| PCGNN | 3.0±2.1 | 65.1±6.6 | 78.0±1.5 | 27.8±3.8 | 63.9±6.3 | 46.5±7.3 | 34.3±1.6 | 10.1±3.9 | 3.7±1.0 | 13.5±3.1 | 34.6 |
| AMNet | 6.8±1.5 | 62.1±4.4 | 77.8±2.3 | 26.6±4.3 | 65.7±6.3 | 37.8±6.7 | 30.5±1.9 | 12.7±2.6 | 2.6±0.8 | 1.6±0.5 | 32.4 |
| BWGNN | 6.0±1.4 | 75.1±3.5 | 77.7±1.6 | 26.4±3.2 | 64.9±11.7 | 49.7±6.1 | 35.5±3.1 | 10.9±3.2 | 3.1±0.8 | 24.3±7.4 | 37.4 |
| GHRN | 6.3±1.5 | 72.4±2.6 | 77.7±1.3 | 26.9±3.1 | 67.7±4.3 | 50.8±4.8 | 36.1±3.1 | 11.1±3.4 | 3.4±0.7 | 24.6±7.0 | 37.7 |
| ConsisGAD | 6.3±2.5 | 58.6±4.6 | 77.5±2.8 | 28.7±3.2 | 76.5±4.2 | 50.8±7.8 | 34.8±2.3 | 12.8±3.1 | 1.8±0.5 | 48.5±4.6 | 39.6 |
| SpaceGNN | 6.0±2.0 | 72.2±3.9 | 76.8±2.0 | 28.9±2.4 | 76.6±3.7 | 48.6±4.9 | 35.4±2.5 | 11.5±2.2 | 2.3±0.8 | 63.3±4.0 | 42.2 |
| XGBGraph | 4.9±1.9 | 68.9±5.7 | 78.2±1.5 | 26.8±3.0 | 72.4±3.8 | 68.9±3.7 | 36.6±3.0 | 10.6±2.9 | 2.5±0.7 | 43.0±7.6 | 41.3 |
| DGI | 6.5±1.3 | 85.5±2.1 | 49.2±2.2 | 18.8±1.2 | 71.7±4.8 | 48.0±2.1 | 39.1±1.1 | 9.8±2.8 | 3.1±0.7 | 43.2±4.3 | 37.5 |
| GRACE | 5.6±2.6 | 85.6±2.5 | 51.8±4.5 | 20.4±1.4 | 74.8±1.1 | 52.4±3.7 | 38.4±2.0 | 13.0±1.9 | - | - | - |
| G-BT | 6.8±1.7 | 85.1±3.6 | 46.3±3.4 | 20.6±1.5 | 74.0±1.9 | 50.7±3.7 | 38.3±2.8 | 12.0±3.4 | 3.8±0.6 | 46.2±6.0 | 38.4 |
| GraphMAE | 4.7±0.5 | 86.8±2.4 | 47.6±1.1 | 20.2±0.2 | 67.4±4.7 | 37.9±3.6 | 37.1±2.0 | 9.6±2.1 | 3.5±0.4 | 44.8±10.6 | 36.0 |
| BGRL | 7.4±1.1 | 90.3±1.1 | 45.3±3.7 | 21.6±1.5 | 59.2±3.4 | 51.0±4.7 | 38.2±3.1 | 11.5±3.6 | 2.7±0.6 | 47.1±5.2 | 37.4 |
| SSGE | 6.4±2.2 | 81.0±2.2 | 45.1±3.9 | 20.6±1.8 | 74.7±0.9 | 51.6±2.8 | 38.3±2.7 | 11.4±1.6 | 3.6±0.8 | 49.5±3.2 | 38.2 |
| PolyGCL | 7.4±2.5 | 81.7±2.9 | 72.5±7.5 | 27.5±2.9 | 50.4±3.8 | 55.0±2.5 | 35.6±1.8 | 9.0±2.4 | 1.9±0.7 | 44.7±5.1 | 38.6 |
| BWDGI | 6.2±1.7 | 64.5±1.7 | 72.2±7.7 | 29.8±2.9 | 75.6±2.7 | 50.3±5.4 | 39.5±2.5 | 7.5±1.5 | 3.1±0.6 | 43.3±3.8 | 39.2 |
| APF (w/o $\mathcal{L}_{pt}$) | 7.6±1.2 | 80.8±7.7 | 77.4±2.4 | 27.2±2.5 | 74.8±3.8 | 57.8±2.7 | 38.3±1.6 | 13.6±1.5 | 3.0±0.6 | 69.7±8.2 | 45.0 |
| APF | 8.8±1.6 | 88.7±2.4 | 78.5±4.2 | 31.4±1.6 | 78.9±1.3 | 62.1±2.1 | 40.8±1.7 | 16.5±0.9 | 4.2±0.7 | 74.1±5.4 | 48.4 |

##### Additional Results for Homophily Disparity.

We provide additional results in terms of AUROC and Rec@K for homophily disparity in Figure [10](https://arxiv.org/html/2504.14250v2#A7.F10) and Figure [11](https://arxiv.org/html/2504.14250v2#A7.F11), respectively.

Figure: Figure 10: Performance across local homophily quartiles (Q1 = top 25%, Q4 = bottom 25%).
Refer to caption: x28.png

Figure: Figure 11: Performance across local homophily quartiles (Q1 = top 25%, Q4 = bottom 25%).
Refer to caption: x29.png

##### Additional Results for Hyperparameter Analysis.

We provide additional results in terms of AUROC and Rec@K for hyperparameter analysis in Figure [12](https://arxiv.org/html/2504.14250v2#A7.F12) and Figure [13](https://arxiv.org/html/2504.14250v2#A7.F13), respectively.

Figure: (a) Weibo
Refer to caption: x30.png

Figure: (a) Weibo
Refer to caption: x34.png

## NeurIPS Paper Checklist

- 1.
Claims
- Question: Do the main claims made in the abstract and introduction accurately reflect the paper’s contributions and scope?
- Answer: [Yes]
- Justification: See Section [1](https://arxiv.org/html/2504.14250v2#S1).
- Guidelines:
•
The answer NA means that the abstract and introduction do not include the claims made in the paper.
•
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
•
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
•
It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.
- 2.
Limitations
- Question: Does the paper discuss the limitations of the work performed by the authors?
- Answer: [Yes]
- Justification: See Appendix [C](https://arxiv.org/html/2504.14250v2#A3).
- Guidelines:
•
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
•
The authors are encouraged to create a separate "Limitations" section in their paper.
•
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
•
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
•
The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
•
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
•
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
•
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren’t acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
- 3.
Theory assumptions and proofs
- Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
- Answer: [Yes]
- Justification: See Appedix [D](https://arxiv.org/html/2504.14250v2#A4).
- Guidelines:
•
The answer NA means that the paper does not include theoretical results.
•
All the theorems, formulas, and proofs in the paper should be numbered and cross-referenced.
•
All assumptions should be clearly stated or referenced in the statement of any theorems.
•
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.
•
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
•
Theorems and Lemmas that the proof relies upon should be properly referenced.
- 4.
Experimental result reproducibility
- Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
- Answer: [Yes]
- Justification: See Appedix [G.3](https://arxiv.org/html/2504.14250v2#A7.SS3) and [G.4](https://arxiv.org/html/2504.14250v2#A7.SS4).
- Guidelines:
•
The answer NA means that the paper does not include experiments.
•
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
•
If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
•
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
•
While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a)
If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b)
If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.
(c)
If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d)
We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
- 5.
Open access to data and code
- Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?
- Answer: [Yes]
- Justification: See Appendix [G.1](https://arxiv.org/html/2504.14250v2#A7.SS1) and [G.4](https://arxiv.org/html/2504.14250v2#A7.SS4).
- Guidelines:
•
The answer NA means that paper does not include experiments requiring code.
•
Please see the NeurIPS code and data submission guidelines ([https://nips.cc/public/guides/CodeSubmissionPolicy](https://nips.cc/public/guides/CodeSubmissionPolicy)) for more details.
•
While we encourage the release of code and data, we understand that this might not be possible, so “No” is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
•
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ([https://nips.cc/public/guides/CodeSubmissionPolicy](https://nips.cc/public/guides/CodeSubmissionPolicy)) for more details.
•
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
•
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.
•
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
•
Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.
- 6.
Experimental setting/details
- Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
- Answer: [Yes]
- Justification: See Appendix [G.3](https://arxiv.org/html/2504.14250v2#A7.SS3) and [G.4](https://arxiv.org/html/2504.14250v2#A7.SS4).
- Guidelines:
•
The answer NA means that the paper does not include experiments.
•
The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.
•
The full details can be provided either with the code, in appendix, or as supplemental material.
- 7.
Experiment statistical significance
- Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
- Answer: [Yes]
- Justification: See Section [4.2](https://arxiv.org/html/2504.14250v2#S4.SS2).
- Guidelines:
•
The answer NA means that the paper does not include experiments.
•
The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
•
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
•
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
•
The assumptions made should be given (e.g., Normally distributed errors).
•
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
•
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.
•
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
•
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
- 8.
Experiments compute resources
- Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
- Answer: [Yes]
- Justification: See Appendix [G.4](https://arxiv.org/html/2504.14250v2#A7.SS4).
- Guidelines:
•
The answer NA means that the paper does not include experiments.
•
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
•
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
•
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn’t make it into the paper).
- 9.
Code of ethics
- Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics [https://neurips.cc/public/EthicsGuidelines](https://neurips.cc/public/EthicsGuidelines)?
- Answer: [Yes]
- Justification: This paper conforms to the NeurIPS Code of Ethics.
- Guidelines:
•
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
•
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
•
The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).
- 10.
Broader impacts
- Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
- Answer: [N/A]
- Justification: This paper only involves the algorithmic design for anomaly detection that has no societal impact.
- Guidelines:
•
The answer NA means that there is no societal impact of the work performed.
•
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
•
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
•
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
•
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
•
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
- 11.
Safeguards
- Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
- Answer: [N/A]
- Justification: This paper poses no risk.
- Guidelines:
•
The answer NA means that the paper poses no such risks.
•
Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
•
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
•
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.
- 12.
Licenses for existing assets
- Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
- Answer: [Yes]
- Justification: See Appendix [G.1](https://arxiv.org/html/2504.14250v2#A7.SS1).
- Guidelines:
•
The answer NA means that the paper does not use existing assets.
•
The authors should cite the original paper that produced the code package or dataset.
•
The authors should state which version of the asset is used and, if possible, include a URL.
•
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
•
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
•
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, [paperswithcode.com/datasets](paperswithcode.com/datasets) has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.
•
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
•
If this information is not available online, the authors are encouraged to reach out to the asset’s creators.
- 13.
New assets
- Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
- Answer: [N/A]
- Justification: This aper does not release new assets.
- Guidelines:
•
The answer NA means that the paper does not release new assets.
•
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
•
The paper should discuss whether and how consent was obtained from people whose asset is used.
•
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
- 14.
Crowdsourcing and research with human subjects
- Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
- Answer: [N/A]
- Justification: This paper does not involve crowdsourcing nor research with human subjects.
- Guidelines:
•
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
•
Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.
•
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
- 15.
Institutional review board (IRB) approvals or equivalent for research with human subjects
- Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
- Answer: [N/A]
- Justification: This paper does not involve crowdsourcing nor research with human subjects.
- Guidelines:
•
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
•
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
•
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
•
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
- 16.
Declaration of LLM usage
- Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
- Answer: [N/A]
- Justification: The core method development in this research does not involve LLMs.
- Guidelines:
•
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.
•
Please refer to our LLM policy ([https://neurips.cc/Conferences/2025/LLM](https://neurips.cc/Conferences/2025/LLM)) for what should or should not be described.

## Peer Reviews

confidence: 4
contribution: 2
initial_rating: 6
presentation: 3
questions: Please refer to my weaknesses.
soundness: 3
strengths: 1. The proposed method and problem setting are interesting and well-motivated.
2. The paper provides theoretical analyses to justify the model design.
3. A comprehensive set of benchmark datasets is used, and the method achieves competitive performance across them.
summary: This paper introduces AFP, a GAD framework designed to address label scarcity and local homophily disparity through a two-stage design. In the pre-training stage, a Rayleigh Quotient and dual spectral filter-based module are trained to learn anomaly-sensitive information. In the fine-tuning stage, a fusion network and anomaly-aware regularization adapt to the test graph. Theoretical analyses are provided for separability. The proposed method shows competitive performance on the selected benchmark datasets. My view is that the proposed method is an improved strategy to take the advantages of both unsupervised and supervised training.
weaknesses: 1. While many baseline methods are included, they should be categorized by the type of anomaly information used (i.e., supervised, semi-supervised, or unsupervised) to clarify performance differences.
2. The paper explores a unique within-graph pre-training and fine-tuning setting. A discussion comparing it with other GAD settings using label information, such as meta-learning GAD (Meta-GDN, Ding et al., 2021), cross-domain GAD (Commander, Ding et al., 2021; ACT, Wang et al., 2023), and the more recent spectral paper (DSGAD, Zheng et al., 2025) would better position the contribution.
3. Most baselines are purely unsupervised or purely supervised. It would be helpful to discuss how combining supervised and unsupervised strategies (joint learning) would perform compared to the proposed method.
4. Since pre-training generally enables faster adaptation under distribution shift, could the authors comment on whether the proposed approach could extend to cross-dataset GAD or detecting novel types of anomalies as studied in (PreNet, Pang et al., 2022; GDN-AugAN, Zhou et al., 2023; and NSReg, Wang et al., 2025)?

---

confidence: 4
contribution: 2
initial_rating: 2
presentation: 2
questions: **Q1**.What are the substantial discrepancies between your reported baseline results and those in the original GADBench paper? Please provide a detailed explanation.

**Q2**. F1 scores for all methods in the main experimental results should also be reported.

**Q3**. How does the theoretical analysis in Theorem 1 relate to the actual deployment of APF?
soundness: 2
strengths: **S1**. The paper articulates the challenges in GAD, particularly label scarcity and homophily disparity, in a clear and accessible manner. The motivation for using the Rayleigh Quotient as a label-free anomaly indicator is well-explained, and the distinction between local and global homophily effectively highlights limitations of uniform processing schemes. The paper is easy to follow.

**S2**. The incorporation of the Rayleigh Quotient for subgraph selection and the use of separate high-pass and low-pass spectral filters represent sensible design choices for capturing both general semantic patterns and anomaly-specific signals.

**S3**. The authors conduct extensive experiments across 10 diverse real-world datasets.
summary: This paper addresses graph anomaly detection under label scarcity by introducing APF, a two-stage framework that combines anomaly-aware pre-training with granularity-adaptive fine-tuning. The core methodology consists of: (i) a pre-training stage that uses the Rayleigh Quotient to guide subgraph sampling and employs both low-pass and high-pass learnable filters to capture both semantic and anomaly-specific signals, and (ii) a fine-tuning stage that adaptively fuses these representations via a gated fusion network with anomaly-aware regularization. The authors provide theoretical analysis under an Anomalous Stochastic Block Model to demonstrate potential linear separability and conduct extensive experiments on 10 benchmark datasets to validate the effectiveness of APF.
weaknesses: **W1**. While the paper combines several techniques, the individual components are largely incremental adaptations of well-established methods. The Rayleigh Quotient has been extensively used in prior GAD work [1,2,3], and spectral filtering with Chebyshev polynomials is standard practice [4], representing a modest modification rather than a fundamental innovation. The paper would benefit from more clearly articulating what specific technical innovations go beyond combining existing techniques and why this particular combination is uniquely effective.

**W2**. The theoretical analysis in Section 3.3 and Theorem 1 suffers from several critical limitations that undermine its relevance to the actual method: (i) The ASBM assumes Gaussian-distributed node features, which is unrealistic for most real-world datasets that contain heterogeneous, sparse, or even categorical features; (ii) The theoretical setup assumes perfect knowledge of node homophily patterns and proposes applying filters accordingly, whereas the actual method uses a data-driven gated fusion network that does not explicitly model or utilize such discrete pattern assignments; (iii) The proof relies on a linear classifier with frozen filtered features, but APF uses learnable polynomial filters, MLP encoders, and a trainable fusion mechanism, creating multiple layers of learnable transformations that are not captured by the theoretical model. These gaps make it unclear what practical insights the theory provides beyond general intuition that adaptive filtering could be beneficial.

**W3**. Comparing Table 1 with the original GADBench paper [4] reveals substantial discrepancies that are difficult to reconcile. While some variation is expected across different hardware/software configurations, differences of this magnitude are concerning, particularly since the authors claim to use GADBench's implementation and evaluation protocol.

**W4**. The paper exclusively reports AUPRC, AUROC, and Rec@K, but omits F1 score—a standard and important metric for imbalanced classification that provides complementary information about precision-recall tradeoffs.

---

**Reference**

[1] J. Tang et al. *Rethinking Graph Neural Networks for Anomaly Detection*. ICML 2022. 

[2] Y. Gao et al. *Addressing Heterophily in Graph Anomaly Detection: A Perspective of Graph Spectrum*. WWW 2023.

[3] X. Dong et al. *Rayleigh Quotient Graph Neural Networks for Graph-level Anomaly Detection*. ICLR 2024

[4] J. Tang et al. *GADBench: Revisiting and Benchmarking Supervised Graph Anomaly Detection*. NeurIPS 2023.

---

confidence: 4
contribution: 3
initial_rating: 6
presentation: 3
questions: Please refer to the weaknesses.
soundness: 3
strengths: 1. Drawing on recent research findings, this paper provides an in-depth analysis of local data issues in graph anomaly detection.

2.It creatively applies Rayleigh Quotient to node-level subgraph selection and demonstrates its effectiveness through experiments.

3.Experiments span 10 diverse datasets, ensuring robustness and generalizability across domains such as social networks and finance.
summary: This paper addresses the challenges of label scarcity and homophily disparity in graph anomaly detection (GAD). It proposes a novel framework called Anomaly-Aware Pre-Training and Fine-Tuning (APF), which incorporates a label-free anomaly metric (Rayleigh Quotient) and dual spectral filters during pre-training to capture both semantic and anomaly-sensitive signals. For fine-tuning, APF employs a gated fusion mechanism and an anomaly-aware regularization loss to adaptively handle node- and class-level homophily disparities.
weaknesses: 1. The authors only cite the relationship between spectral energy (i.e., the quantification of the "right shift" phenomenon) and anomaly degree, but do not clearly discuss its connection to graph anomaly detection. For example, is this anomaly due to abnormal node attributes or abnormal edge connections? Will the two types of anomalies differ in spectral density / energy?

2. Considering the use of the MRQSampler algorithm in this paper, the authors should add a discussion of UniGAD to clarify the paper's distinction and contribution.

3. The design of the Dual-filter Encoding lacks detailed explanation.

---

confidence: 3
contribution: 2
initial_rating: 6
presentation: 3
questions: Please refer to the weaknesses.
soundness: 3
strengths: 1. The authors introduce Anomaly-Aware Pre-Training and Fine-Tuning (APF), a two-stage framework for supervised GAD. 
2. Experiments show the effectiveness of the framework.
summary: The authors introduce Anomaly-Aware Pre-Training and Fine-Tuning (APF), a two stage framework for supervised GAD. Experiments show the effectiveness of the framework.
weaknesses: 1. The novelty can be a question, as all the components are from existing work, which means such a framework can be considered an implementation rather than a contribution. 
2. How to choose the hyperparameters for new datasets can be a question since the combinations of hyperparameters require extensive experiments for grid search, as shown in Appendix H.4.


Decision: Accept (Poster)