DiffGAD: A Diffusion-based Unsupervised Graph Anomaly Detector

## Abstract

Abstract Graph Anomaly Detection (GAD) is crucial for identifying abnormal entities within networks, garnering significant attention across various fields. Traditional unsupervised methods, which decode encoded latent representations of unlabeled data with a reconstruction focus, often fail to capture critical discriminative content, leading to suboptimal anomaly detection.
To address these challenges, we present a Diff usion-based G raph A nomaly D etector (DiffGAD). At the heart of DiffGAD is a novel latent space learning paradigm, meticulously designed to enhance the model’s proficiency by guiding it with discriminative content. This innovative approach leverages diffusion sampling to infuse the latent space with discriminative content and introduces a content-preservation mechanism that retains valuable information across different scales, significantly improving the model’s adeptness at identifying anomalies with limited time and space complexity.
Our comprehensive evaluation of DiffGAD, conducted on six real-world and large-scale datasets with various metrics, demonstrated its exceptional performance. Our code is available at: https://github.com/fortunato-all/LJH_DiffGAD

## 1 Introduction

Graph structure has garnered significant attention from both academia (Wang et al., ; Gao et al., ; Roy et al., ; ; Chen et al., ; Gao et al., ; Fang et al., ) and industry (Breuer et al., ; Li et al., ; Yin et al., ; Zhong et al., ), with its potential to represent relationships and structures. Among its wide applications, graph anomaly detection (GAD) has evolved as a popular research topic, aiming to detect abnormal targets (nodes, edges, subgraphs, et al.) from the normal.

Existing research can be categorized into two branches: the semi-supervised learning branch (Dou et al., ; Liu et al., ; Gao et al., ; ) and the unsupervised learning branch (Hamilton et al., ; Chen et al., ; Li et al., ; Peng et al., ). Semi-supervised learning approaches utilize a small subset of labeled data to discern patterns of anomalies, enabling the prediction of labels for the remaining unlabeled dataset. However, human annotation is often time-consuming and labor-intensive, which limits the application of semi-supervised methods.

As alternate, unsupervised reconstruction-based strategies (Ding et al., ; Fan et al., ; Sakurada & Yairi, ) directly capture node characteristics and local structures without the need for annotation.
Specifically, these approaches are on the assumption that anomalous entities exhibit more complex distributions and are significantly more difficult to reconstruct (Ding et al., ; Fan et al., ; Sakurada & Yairi, ).
Consequently, they utilize encoders to map the graph data into a latent space (Kingma & Welling, ; Kipf & Welling, ; Velickovic et al., ).
Subsequently, the entities are decoded from such latent embeddings, wherein those exhibiting high reconstruction errors are deemed more likely to be anomalies.
However, these methods grapple with limitations in their discriminative capability, which results in suboptimal performance.
As outlined in (Dou et al., ; Liu et al., ), abnormal users often deliberately camouflage themselves among normal users. Consequently, they frequently exhibit a significant overlap in common attributes (*e.g.* age, occupation, length and frequency of reviews, etc.) with normal users. This behavior enables these anomalies to divert the focus of reconstruction-based models towards overlapping common content, reducing the models’ ability to discern truly discriminative features (such as transaction information for fraud detection (Dou et al., )). As a result, anomalous entities are difficult to identify by reconstruction error with such a trivial framework. As illustrated in Figure 1 (a), all data points in the latent space are equally distributed in the learned latent space, without preserving sufficient discriminative content, leading to the overlapping distribution space.

Furthermore, we find that the latent space constructed by the AE-based method (Ding et al., ) tends to represent all samples for the Books dataset (Sánchez et al., ) into the same point, which is misguided by the huge common content.
In addition to the aforementioned issue, the well-known Variational Autoencoder (VAE) based method (Kipf & Welling, ) faces a notable challenge: it constructs the latent space within a constrained distribution (e.g., the Gaussian distribution), leading to a uniform latent distribution. This limits the model’s expressive capacity, consequently making it challenging to distinguish between abnormal and normal samples.
To tackle this issue, we propose to enhance the latent space learning process by incorporating discriminative content. Drawing inspiration from the potent generative capabilities of Diffusion Models (DMs) (Ho et al., ; Rombach et al., ; Nichol et al., ; Dhariwal & Nichol, ), we introduce a diffusion-based detection approach, termed DiffGAD. Specifically, our DiffGAD tackles the issue from two aspects:

Figure: Figure 1: Given several normal and abnormal nodes, the data space is constructed by different methods. Specifically, (a) represents the latent space constructed by current reconstruction-based methods, (b) denotes the latent space learned by our discriminative guidance, (c) is the latent space constructed by introducing the preserved general content on (b).
Refer to caption: x1.png

Discriminative content is hard to capture due to the sparsity of anomalies, however, shared content is much easier to acquire. Hence we implicitly capture this discriminative information: Initially, we train an unconditional DM to focus on constructing features that encapsulate both discriminative and common elements, referred to as general content. Subsequently, a second DM is trained by conditioning on a common feature to learn the latent distribution inclusive of common content, where the common feature is constructed by adaptively filtering out potential anomalies in the unconditional DM reconstructed space. By differentiating the general content from this commonality, we isolate the discriminative content. This content is then integrated into the latent space through the application of classifier-free guidance across both trained DMs. As illustrated in Figure 1 (b), this process allows the latent space to segregate normal and abnormal distributions within overlapping areas, thereby enabling the differentiation between abnormal and normal samples.

Moreover, given that anomaly detection based on reconstruction error fundamentally aligns more with classification than generation, we introduce slight modifications to the diffusion model to better suit this task. Specifically, during the sampling stage, rather than initiating from a Gaussian distribution, we introduce minor corruptions to the given sample $x$ by adding noises for a small timestep $t<T$, and subsequently denoise it to generate a reconstructed sample $\hat{x}$.
Throughout this process, we argue that the general content could be preserved across different scales (reflecting by timestep $t$) to further bolster the model’s discriminative power with confidence. In detail, noise at smaller $t$ values preserves large-scale general content, whereas larger $t$ values maintain more localized general content. As illustrated in Figure 1 (c), by preserving this content, the constructed latent space becomes adept at accurately representing data points. This enhancement effectively widens the distributional discrepancy between anomalous and normal entities, resulting in a robust and discriminative latent space that fosters confident representations.

To summarize, we have the following contributions:

- •
To the best of our knowledge, we make the first attempt to transfer the diffusion model (DM) from the generation task to a detector in the GAD task and propose a DM-based Graph Anomaly Detector, namely DiffGAD.
- •
Our DiffGAD enhances the discriminative ability from two aspects: a discriminative content-guided generation paradigm to distill the discriminative content in latent space; and a content-preservation strategy to enhance the confidence of the guidance process.
- •
Extensive experiments over six real-world and large-scale datasets demonstrate our effectiveness, Theoretical and Empirical computational analysis illustrate our efficiency.

## 2 Background

In this section, we revisit some background. Specifically, we first introduce the preliminaries of the Graph Anomaly Detection (GAD) task, and then describe the diffusion model in latent space.

### 2.1 Task Formulation

In this work, we focus on the unsupervised node-level GAD over static attributed graphs.
The goal is to learn a detection model, which associates each node with an anomaly score, top-ranked nodes (with large scores) are always indicated as anomalies. In reconstruction-based methods, the anomaly score is the reconstruction error. Meanwhile, the data structure can be formalized as an attribute graph $\textbf{G}=\{\mathcal{V},\textbf{X},\bm{\mathcal{E}},\textbf{A}\}\in\bm{
\mathcal{G}}$, where $\mathcal{V},\textbf{X},\bm{\mathcal{E}},\textbf{A}$ denotes nodes, node attributes, edges, and adjacency matrix, respectively.

### 2.2 Diffusion Model in Latent Space

The Latent Diffusion Model (Latent DM) is composed of a pair of forward and reverse diffusion processes based on the unified formulation of Stochastic Differential Equation (SDE) (Song et al., ). Concretely, given a latent variable $\bm{z}$, the SDE can be formalized as:

$$ $\mathrm{d}\bm{z}=\bm{f}(\bm{z},t)\mathrm{d}t+g(t)\mathrm{d}\bm{w}_{t},$ (1) $$

where $\bm{f}(\cdot)$ and $g(\cdot)$ are the drift and diffusion functions, respectively, and $\bm{f}(\cdot)$ can also be expressed in the form of $\bm{f}(\bm{z},t)=\bm{f}(t)\bm{z}$. Then we define the forward, backward, and training process as:

Forward Process.
Given the latent variable $\bm{z}$, the forward process transforms $\bm{z}$ with noises to construct a sequence of step-dependent variables $\{\bm{z}_{t}\}_{t=0}^{T}$, where $\bm{z}_{0}=\bm{z}$ is the initial point of this process. Specifically, with SDE, the diffusion kernel is denoted as a conditional distribution of $\bm{z}_{t}$:

$$ $p\left({\bm{z}}_{t}\mid{\bm{z}}_{0}\right)=\mathcal{N}(s(t){\bm{z}}_{0},s^{2}( t)\sigma^{2}(t)\textbf{I}),$ (2) $$

where $s(t)$ and $\sigma(t)$ are step-dependent to control the noise level. We follow an efficient design (Karras et al., ; Zhang et al., ) to simplify the diffusion kernel, where we set $s(t)=1$ and $\sigma(t)=t$ in this work. Therefore, the forward process can be formulated as:

$$ $\bm{z}_{t}=\bm{z}_{0}+\sigma(t)\varepsilon,\text{where }\varepsilon\sim\bm{ \mathcal{N}}\left(\bm{0},\textbf{I}\right).$ (3) $$

Reverse Process.
The reverse process reconstructs the latent variable $\bm{z}$ by predicting and removing the added noises. Specifically, with SDE and our diffusion kernel simplification (Karras et al., ), the reverse process can be derived as:

$$ $\mathrm{d}\bm{z}=-2\dot{\sigma}(t)\sigma(t)\nabla_{\bm{z}}\log p_{t}(\bm{z}) \mathrm{d}t+\sqrt{2\dot{\sigma}(t)\sigma(t)}\mathrm{d}\bm{\omega}_{t},$ (4) $$

where $\nabla_{\bm{z}}\log p_{t}(\bm{z})$ is the score function of $\bm{z}$, and $\dot{\sigma}(t)$ is the first order derivative of $\sigma(t)$.

Training Process. The training process matches the noises in the forward and reverse processes, which can be achieved by denoising score matching (Song et al., ) as:

$$ $\bm{\mathcal{L}}_{\text{DM}}=\mathbb{E}_{\bm{z}_{0}\sim p\left(\bm{z}\right)} \mathbb{E}_{{\bm{z}}_{t}\sim p\left({\bm{z}}_{t}\mid{\bm{z}}_{0}\right)}\left \|\bm{\epsilon}_{\theta}\left({\bm{z}}_{t},t\right)-\bm{\varepsilon}\right\|_{ 2}^{2},$ (5) $$

where $\bm{\epsilon}_{\theta}$ is the neural network. After training, the diffusion model can be applied for further generation by the reverse process with the score function as $\nabla_{\bm{z}}\log p_{t}(\bm{z})=-\bm{\epsilon}_{\theta}/\bm{\sigma}(t)$ in Eq. 4.

## 3 Methodology

In this section, we illustrate DiffGAD in detail.

Figure: Figure 2: An overview of DiffGAD. Given a graph, we first encode it into latent space, and we then reconstruct it with both unconditioned and conditioned diffusion models to distill the discriminative content. Finally, we decode the reconstructed latent embedding for anomaly detection.
Refer to caption: x2.png

### 3.1 Overview

Figure 2 overviews our proposed DiffGAD, which functions primarily within the latent space. Upon receiving a graph, our methodology initiates by mapping it into the latent space, as detailed in §3.2. Within this transformed domain, we employ a dual Diffusion Model (DM) approach. The first DM is tasked with encapsulating the general content, as elaborated in §3.3, while the second DM targets the extraction of common content, described in §3.4. Herein, the discriminative content is identified by the disparities between these two DM-captured representations. Inspired by (Ho & Salimans, ), the concurrent sampling of the two DMs is enabled without necessitating any additional parameters.
It is worth noting that our model’s foundation is rooted in a well-established hypothesis, supported by works such as (Ding et al., ; Fan et al., ; Sakurada & Yairi, ), which posits that anomalous entities exhibit more complex distributions and are significantly more difficult to reconstruct. Consequently, nodes with higher reconstruction error are more likely to be anomalies. To facilitate this detection mechanism, our framework requires the original samples with their respective reconstructed counterparts, a process systematically described in §3.3.

### 3.2 Latent Space Projection

In this work, we leverage an encoder to map graph features into a latent representation space, a pivotal step that precedes the detailed exposition of diffusion models in our work. Thus, it is essential to first delineate the methodology employed in projecting graph characteristics into this latent space.

More formally, for a given graph G, we utilize the Graph Autoencoder (AE) framework as delineated in (Ding et al., ) to facilitate its transformation into the latent space. The architecture of the Graph AE comprises two primary components: an encoder, denoted as $\bm{\Phi}$, and a decoder, denoted as $\bm{\Psi}$. The encoder function, $\bm{\Phi}$, is designed to process the node feature matrix $\textbf{X}\in\mathbb{R}^{n\times d}$ and the adjacency matrix $\textbf{A}\in\mathbb{R}^{n\times n}$, thereby yielding latent feature embedding $\bm{z}$, computed as:

$$ $\displaystyle\bm{z}=\bm{\Phi}(\textbf{X},\textbf{A}),$ (6) $$

wherein $\bm{\Phi}$ incorporates a Graph Convolutional Network (GCN) (Kipf & Welling, ) as its underlying mechanism for aggregating information from node features $\bm{X}$ into latent embedding $\bm{z}$, with $\bm{z}\in\mathbb{R}^{n\times k}$ and $k$ representing the dimensionality of the latent space.

Subsequently, the decoder component is tasked with the reconstruction of the node feature matrix and adjacency matrix from the latent embedding $\bm{z}$, expressed through the equations:

$$ $\displaystyle\left\{\begin{matrix}\hat{\textbf{X}}=\bm{\Psi_{\text{feat}}}(\bm {z},\textbf{A}),\\ \hat{\textbf{A}}=\bm{\Psi_{\text{stru}}}(\bm{z}\bm{z}^{T}),\end{matrix}\right.$ (7) $$

in which $\bm{\Psi_{\text{feat}}}$ and $\bm{\Psi_{\text{stru}}}$ are specifically designed for the prediction of node features and graph structure (edges), respectively. This meticulous elaboration of the latent space projection methodology set the stage for a comprehensive understanding of our novel DiffGAD framework.

Figure: Algorithm 1 The training and inference procedure of DiffGAD.

### 3.3 General Content Preservation

Once the latent space is ready, the reconstruction error by DM acts as a proxy of the anomaly score associated with individual nodes. To achieve this, pairs of original and reconstructed samples are necessary (Gao et al., ). Our general content preservation aims to adapt the DM architecture to the reconstruction error-based anomaly detection task. Unlike traditional DMs, which initiates $\bm{z}_{T}$ as random Gaussian noise to generate $\hat{\bm{z}}_{0}$, our approach perturbs original latent embedding $\bm{z}_{0}$ minimally to get initial points. Concretely, $\bm{z}_{t}$ at a selected small timestep $t<T$ is obtained with Eq. 3, this corrupted embedding is then used to generate reconstructed sample $\hat{\bm{z}}_{0}$ with the aim of preserving the general content. The benefit of this process are threefolds: (1) It facilitates the computation of reconstruction error by aligning original and reconstructed sample; (2) By modulating $t$, the extent of preserved general content can be controlled; a lower $t$ value results in a reconstruction that is closer to the original content, thereby retaining more of the general content. (3) As the DM functions without explicit conditioning, it inherently associates with the general content, which lays the groundwork for the introduction of discriminative content in the following.

### 3.4 Common Feature Construction

In this study, we treat divergence of unconditional and conditional DMs as the discriminative content of interest. Besides unconditional DM, our approach also necessitates the incorporation of a conditional DM. This subsection is dedicated to elucidating the conditioning mechanism construction.

Consider the latent embedding $\bm{z}=\{\bm{z}^{v}\}_{v=1}^{n}$, where each $\bm{z}^{v}\in\mathbb{R}^{k}$ denotes the embedding of the $v$-th node. We initialize the common feature $c_{0}$ as the mean value over all latent node embeddings, capturing a global perspective of the node distribution and setting a prior for their generative process. This feature acts as the conditioning and is not fixed during the training of DM, next we demonstrate the adaptive refinement of this feature in depth.

During the training phase of the unconditional DM, which we represent as $\bm{\epsilon}_{\theta}(\bm{z}_{t},t)$, the conditioning undergoes iterative updates. To illustrate, we identify the common feature conditioning at any training iteration as $c_{\text{current}}$. The feature update is governed by:

$$ $c_{\text{next}}=\sum_{v\in\mathcal{V}}\omega_{v}\cdot\hat{\bm{z}}^{v},$ (8) $$

where $c_{\text{next}}$ is the updated common feature for the next training iteration, and $\omega_{v}$ is the weighting vector to control the update process. We obtain $\omega_{v}$ by similarity calculation between the reconstructed node embedding $\hat{\bm{z}}^{v}$ and current common feature $c_{\text{current}}$, which can be formalized as:

$$ $\omega_{v}=\frac{exp(\bar{\omega}_{v}/\tau)}{\sum exp(\bar{\omega}_{v}/\tau)}, \text{where }\bar{\omega}_{v}=\text{cos}\left\langle\hat{\bm{z}}^{v},c_{\text{ current}}\right\rangle,$ (9) $$

where $\tau$ is the temperature parameter to control the smoothness of weights, $\text{cos}\left\langle\mathchoice{\mathbin{\vbox{\hbox{\scalebox{0.5}{$
\displaystyle\bullet$}}}}}{\mathbin{\vbox{\hbox{\scalebox{0.5}{$\textstyle
\bullet$}}}}}{\mathbin{\vbox{\hbox{\scalebox{0.5}{$\scriptstyle\bullet$}}}}}{
\mathbin{\vbox{\hbox{\scalebox{0.5}{$\scriptscriptstyle\bullet$}}}}},
\mathchoice{\mathbin{\vbox{\hbox{\scalebox{0.5}{$\displaystyle\bullet$}}}}}{
\mathbin{\vbox{\hbox{\scalebox{0.5}{$\textstyle\bullet$}}}}}{\mathbin{\vbox{
\hbox{\scalebox{0.5}{$\scriptstyle\bullet$}}}}}{\mathbin{\vbox{\hbox{\scalebox
{0.5}{$\scriptscriptstyle\bullet$}}}}}\right\rangle$ denotes the cosine similarity.
The update of the common feature involves aggregating the contribution of all nodes, weighted by their respective $\omega_{v}$ values. A larger $\omega_{v}$ indicates a more significant contribution of the current $\hat{\bm{z}}^{v}$ to the update process.
Notably, nodes that significantly deviate from the current common feature, $c_{\text{current}}$, are assigned with lower weights during the update. The underlying rationale is to mitigate the impact of potential anomalies and to derive a comprehensive common feature.
Upon completing this iteration, $c_{\text{next}}$ is designated as the new current common feature $c_{\text{current}}$ for the forthcoming update cycle.
Furthermore, we establish the final common feature $c$ which corresponds to $c_{\text{next}}$ from the last training iteration. This finalized feature remains static during the detection phase. This approach ensures that the common feature is reflective of the dataset’s core attributes, which leads us to the discriminative content calculation.

### 3.5 Discriminative Content Distillation

Leveraging the unconditional DM, $\bm{\epsilon}_{\theta}(\bm{z}_{t},t)$, and the common feature $c$, our approach is able to extract the discriminative content through discriminative content distillation. Specifically, we first train a conditional DM as $\bm{\epsilon}_{\theta}(\bm{z}_{t},c,t)$, which aims to learn the common knowledge by reconstructing latent embedding $\bm{z}=\{\bm{z}^{v}\}_{v=1}^{n}$ with common feature $c$ as conditional information.

Inspired by the idea of classifier-free guidance (Ho & Salimans, ), we distill the discriminative content by performing a linear combination of the unconditional and conditional DMs.
Differently, our unconditional DM $\bm{\epsilon}_{\theta}(\bm{z}_{t},t)$ contains both discriminative and common content, and the conditional DM $\bm{\epsilon}_{\theta}(\bm{z}_{t},c,t)$ captures the common content, which describes that "what most of the reconstructed nodes focus on".
Thus, the discriminative content is achieved by subtracting the general content from the common content learned from the unconditional DM and conditional DM, respectively.
Specifically, the modified score can be denoted as:

$$ $\displaystyle\tilde{\bm{\epsilon}_{\theta}}\left({\bm{z}}_{t},c,t\right)=(1+$ $\displaystyle\lambda)\bm{\epsilon}_{\theta}\left(\bm{z}_{t},t\right)-\lambda \bm{\epsilon}_{\theta}\left(\bm{z}_{t},c,t\right),$ (10) $\displaystyle\nabla_{\bm{z}}\log p_{t}(\bm{z})$ $\displaystyle=-\tilde{\bm{\epsilon}_{\theta}}\left({\bm{z}}_{t},c,t\right)/\bm {\sigma}(t),$ $$

where $\lambda$ is the hyperparameter to regulate the strength. By utilizing the modified score for the sampling process, we distill the discriminative content into the latent space, and then obtain the discriminative latent embeddings.

### 3.6 Training and Inference

Training Stage.
In the training stage, given an attribute graph $\textbf{G}=\{\mathcal{V},\textbf{X},\bm{\mathcal{E}},\textbf{A}\}$, we firstly train the Graph AE by the following objective:

$$ $\displaystyle\bm{\mathcal{L}}_{\text{AE}}=\alpha\cdot||\textbf{X}-\hat{\textbf {X}}||_{2}+(1-\alpha)\cdot||\textbf{A}-\hat{\textbf{A}}||_{2},$ (11) $$

where $||\cdot||_{2}$ denotes the L2 norm, and $\alpha$ is a hyper-parameter to balance the effect of feature and structural reconstruction.
Then we train the unconditional DM $\bm{\epsilon}_{\theta}\left({\bm{z}}_{t},t\right)$ by the training objective as in Eq. 5, meanwhile, we obtain the common feature $c$.
Finally, we train the conditional DM $\bm{\epsilon}_{\theta}\left({\bm{z}}_{t},c,t\right)$ by the following equation:

$$ $\bm{\mathcal{L}}_{\text{Cond}}=\mathbb{E}_{\bm{z}_{0}\sim p\left(\bm{z}\right) }\mathbb{E}_{\bm{z}_{t}\sim p\left(\bm{z}_{t}\mid\bm{z}_{0},c\right)}\left\| \bm{\epsilon}_{\theta}\left(\bm{z}_{t},c,t\right)-\bm{\varepsilon}\right\|_{2} ^{2}.$ (12) $$

Inference Stage.
In the inference stage, given attribute graph G, we first transform it into latent space by well-trained encoder $\bm{\Phi}$.
Second, we add $t$-step noises ($t<T$) on the extracted latent embedding to preserve the general content.
Then, we discriminatively sample from both unconditional DM $\bm{\epsilon}_{\theta}\left(\bm{z}_{t},t\right)$ and conditional DM $\bm{\epsilon}_{\theta}\left(\bm{z}_{t},c,t\right)$ with Eq. 10 as scores.
Finally, we transform the reconstructed embedding into graph space by decoder $\bm{\Psi}$ for reconstruction error calculation.

## 4 Experiment

In this section, we conduct experiments to validate the effectiveness of our DiffGAD. Specifically, we first introduce the experimental settings, and next, we analyze the ablation studies, finally, we describe the comparison results with the state-of-the-art methods.

### 4.1 Experimental Settings

Datasets.
Following the work in (Liu et al., ) we employ 13 baselines as benchmarks on 6 real-world datasets (Weibo (Zhao et al., ), Reddit (Kumar et al., ; Wang et al., ), Disney (Sánchez et al., ), Books (Sánchez et al., ), Enron (Sánchez et al., )), including a
large-scale dataset Dgraph (Huang et al., ) for evaluation.
Metrics.
Following the extensive literature in GAD (Liu et al., ; Ding et al., ; Kipf & Welling, ), we compressively evaluate the performance of DiffGAD with the representative ROC-AUC (Receiver Operating Characteristic Area Under Curve), AP (Average Precision), Recall@k, and the AUPRC (Area Under the Precision and Recall Curve) metrics.
Comparisons.
Following the work in (Liu et al., ), we report the average performance with std results over 20 trials for a fair comparison.
Moreover, we re-implement current methods for all datasets with (Liu et al., ), and observe a large performance gap for the ROC-AUC in Enron, while other datasets are similar (as the official GitHub issue mentioned in (^1^11https://github.com/pygod-team/pygod)).
Therefore, to prevent ambiguity, we use the re-implemented ROC-AUC results on the Enron dataset and follow the results of other datasets and metrics in (Liu et al., ).

### 4.2 Ablation Studies

Figure: ((a))
Refer to caption: x3.png

**Table 1: The ROC-AUC performance with different components of our method.**
| Method | Weibo | Reddit | Disney | Books | Enron | Avg |
| --- | --- | --- | --- | --- | --- | --- |
| AE | 92.0 $\pm$ 0.1 | 56.1 $\pm$ 0.0 | 40.3 $\pm$ 6.7 | 59.1 $\pm$ 2.5 | 59.1 $\pm$ 1.6 | 61.3 $\pm$ 2.2 |
| Diff | 91.6 $\pm$ 0.5 | 55.8 $\pm$ 0.1 | 49.1 $\pm$ 0.3 | 58.3 $\pm$ 2.5 | 57.7 $\pm$ 1.8 | 62.5 $\pm$ 1.0 |
| Cond-Diff | 91.4 $\pm$ 0.5 | 55.9 $\pm$ 0.1 | 49.2 $\pm$ 0.4 | 58.8 $\pm$ 1.8 | 57.6 $\pm$ 1.9 | 62.6 $\pm$ 0.9 |
| DiffGAD | 93.4 $\pm$ 0.3 | 56.3 $\pm$ 0.1 | 54.5 $\pm$ 0.2 | 66.4 $\pm$ 1.8 | 71.6 $\pm$ 7.0 | 68.4 $\pm$ 1.9 |

Figure: ((a))
Refer to caption: x6.png

The effects of discriminative content distillation.
We conduct experiments over various $\lambda$ in Eq. 10, and the experimental results are shown in Figure 3. Specifically, we list the AUC performance with the conditional DM ${\bm{\epsilon}_{\theta}}\left({\bm{z}}_{t},c,t\right)$ as $\lambda=-1.0$ (only common content), with the unconditional DM ${\bm{\epsilon}_{\theta}}\left({\bm{z}}_{t},t\right)$ as $\lambda=0.0$ (only general content), and with different values of $\lambda$ ranging from 0.2 to 2.0 over the Books, Disney, and Enron datasets.
From Figure 3, we find that different datasets have distinct sensitivities of $\lambda$, and the performance on Books and Enron are sensitive to the various $\lambda$.
Moreover, we can observe that the best results are achieved with large $\lambda$ ($\lambda=2.0$) for all 3 datasets, which not only demonstrates the effectiveness of our discriminative content distillation but also shows that the discriminative content is hard to mine for those datasets.

The influences of general content preservation.
We conduct experiments over various timestep $t$ in Sec. 3.3 to preserve general content from different scales, and the experimental results are illustrated in Figure 4. Specifically, we list the AUC performance with timestep varies from $1$ to $500$ over the Books, Disney, and Weibo datasets. The full diffusion timestep is 500, where $t=1$ means sampling from large-scale general content, and $t=500$ implies sampling from the noise. Specifically, from Figure 4, we can find that (1) general content from different scales is required for different datasets, where Weibo requires more general content (small $t$), and less general content is needed for Books and Disney (large $t$), and (2) compared with sampling from the noises ($t=500$), our general content preservation improves over all datasets (various $t$), which demonstrates our effectiveness.

The effects of different components.
We conduct experiments with different components such as the Autoencoder (“AE”), the unconditional DM (“Diff”), and the conditional DM (“Cond-Diff”), the experimental results are shown in Table 1, where “DiffGAD” is our method. Specifically, we can find that:
(1) applying the DM over the AE model achieves marginal performance gains (“Diff” vs “AE”), which demonstrates that simply utilizing DM can’t tackle the lack of discriminative content issue.
(2) the conditional DM and the unconditional DM obtain similar results (“Diff” vs “Cond-Diff”), which proves our hypothesis, that in the general content, the huge common content prioritizes the discriminative.
(3) our method attains significant improvements over different components (“DiffGAD” vs others), this proves our effectiveness, which could distill the discriminative content and further boost the detection performance.
Moreover, we also visualize the reconstructed distribution by different components in Appendix B.

### 4.3 Comparison with SOTA methods.

In this subsection, we comprehensively compare our method with various state-of-the-art algorithms, ranging from graph-agnostic algorithms LOF (Breunig et al., ), MLPAE (Sakurada & Yairi, ), IF (Liu et al., ), and classical algorithms Rador (Li et al., ), ANOMALOUS (Peng et al., ), SCAN (Xu et al., ), to deep algorithms GAAN (Chen et al., ), DOMINANT (Ding et al., ), GCNAE (Kipf & Welling, ), DONE (Bandyopadhyay et al., ), CONAD (Xu et al., ), and the comparison results are reported in Table 2. Moreover, we also show the average of AUC results with standard deviation ( denoted as “Avg”) in the table, and then present a box chart to show the average AUC results of 5 datasets in Figure 5.

Figure: Figure 5: Average ROC-AUC performance over 5 datasets, where the color represents the average AUC, and the central line is the median (Many methods for Dgraph encounter OOM and TLM restriction, thus Dgraph is omitted).
Refer to caption: x9.png

Specifically, we draw the following observations:
(1) DiffGAD achieves “an outlier node detection method that works universally well on all datasets”. It obtains top-2 AUC results over all datasets and significantly outperforms current methods with a large margin in average AUC with more than 9% average AUC (compared with the second Average AUC results in ANOMALOUS).
(2) DiffGAD demonstrates robustness and stability across different datasets, it attains small std results over different datasets.
(3) DiffGAD outperforms other deep-based algorithms by a large margin. Specially, the best improvement is for the Enron dataset, compared with the GAAN method, our DiffGAD attains more than 20.7% AUC gains.
These achieved performances are significant and can be attributed to enhancing discriminative ability.

**Table 2: Performance comparison (ROC-AUC) among 13 algorithms on 6 datasets, where we show the avg perf. $\pm$ the std of perf. of each method. The best results of all methods are indicated in boldface, and the second best results are underlined. OOM refers to out-of-memory with CPU. TLE denotes time limit of 24 hours exceeded. We list the Avg result over 5 datasets, due to the unavailable Dgraph results with OOM and TLE for many methods, we omit Dgraph.**
| Algorithm | Weibo | Reddit | Disney | Books | Enron | Avg | Dgraph |
| --- | --- | --- | --- | --- | --- | --- | --- |
| graph-agnostic |  |  |  |  |  |  |  |
| LOF | 56.5 $\pm$ 0.0 | 57.2 $\pm$ 0.0 | 47.9 $\pm$ 0.0 | 36.5 $\pm$ 0.0 | 46.4 $\pm$ 0.0 | 48.9 $\pm$ 0.0 | TLE |
| IF | 53.5 $\pm$ 2.8 | 45.2 $\pm$ 1.7 | 57.6 $\pm$ 2.9 | 43.0 $\pm$ 1.8 | 40.1 $\pm$ 1.4 | 47.9 $\pm$ 2.1 | 60.9 $\pm$ 0.7 |
| MLPAE | 82.1 $\pm$ 3.6 | 50.6 $\pm$ 0.0 | 49.2 $\pm$ 5.7 | 42.5 $\pm$ 5.6 | 44.6 $\pm$ 7.1 | 53.8 $\pm$ 4.4 | 37.0 $\pm$ 1.9 |
| classical algorithms |  |  |  |  |  |  |  |
| SCAN | 63.7 $\pm$ 5.6 | 49.9 $\pm$ 0.3 | 50.5 $\pm$ 4.0 | 49.8 $\pm$ 1.7 | 52.8 $\pm$ 3.4 | 53.3 $\pm$ 3.0 | TLE |
| Radar | 98.9 $\pm$ 0.1 | 54.9 $\pm$ 1.2 | 51.8 $\pm$ 0.0 | 52.8 $\pm$ 0.0 | 54.1 $\pm$ 10.1 | 62.5 $\pm$ 2.3 | OOM |
| ANOMALOUS | 98.9 $\pm$ 0.1 | 54.9 $\pm$ 5.6 | 51.8 $\pm$ 0.0 | 52.8 $\pm$ 0.0 | 55.0 $\pm$ 9.8 | 62.7$\pm$ 3.1 | OOM |
| deep algorithms |  |  |  |  |  |  |  |
| GCNAE | 90.8 $\pm$ 1.2 | 50.6 $\pm$ 0.0 | 42.2 $\pm$ 7.9 | 50.0 $\pm$ 4.5 | 38.2 $\pm$ 6.5 | 54.4 $\pm$ 4.0 | 40.9 $\pm$ 0.5 |
| DOMINANT | 85.0 $\pm$ 14.6 | 56.0 $\pm$ 0.2 | 47.1 $\pm$ 4.5 | 50.1 $\pm$ 5.0 | 53.7 $\pm$ 4.2 | 58.4 $\pm$ 5.7 | OOM |
| DONE | 85.3 $\pm$ 4.1 | 53.9 $\pm$ 2.9 | 41.7 $\pm$ 6.2 | 43.2 $\pm$ 4.0 | 46.7 $\pm$ 6.1 | 54.2 $\pm$ 4.7 | OOM |
| AdONE | 84.6 $\pm$ 2.2 | 50.4 $\pm$ 4.5 | 48.8 $\pm$ 5.1 | 53.6 $\pm$ 2.0 | 44.5 $\pm$ 2.9 | 56.4 $\pm$ 3.3 | OOM |
| AnomalyDAE | 91.5 $\pm$ 1.2 | 55.7 $\pm$ 0.4 | 48.8 $\pm$ 2.2 | 62.2 $\pm$ 8.1 | 54.3 $\pm$ 11.2 | 62.5 $\pm$ 4.6 | OOM |
| GAAN | 92.5 $\pm$ 0.0 | 55.4 $\pm$ 0.4 | 48.0 $\pm$ 0.0 | 54.9 $\pm$ 5.0 | 59.3 $\pm$ 0.2 | 62.0 $\pm$ 1.1 | OOM |
| CONAD | 85.4 $\pm$ 14.3 | 56.1 $\pm$ 0.1 | 48.0 $\pm$ 3.5 | 52.2 $\pm$ 6.9 | 51.6 $\pm$ 4.3 | 58.7 $\pm$ 5.8 | 34.7 $\pm$ 1.2 |
| DiffGAD | 93.4 $\pm$ 0.3 | 56.3 $\pm$ 0.1 | 54.5 $\pm$ 0.2 | 66.4 $\pm$ 1.8 | 71.6 $\pm$ 7.0 | 68.4 $\pm$ 1.9 | 52.4 $\pm$ 0.0 |

## 5 Time and Computational Analysis

In this study, we analyze the time and computational analysis from theoretical and empirical views.

### 5.1 Theoretical Analysis

(1) Graph AutoEncoder. We analyze the complexity according to (Liu et al., ). Specifically, we utilize the Graph convolutional network as our backbone, whose complexity is linear to the edge numbers. For each layer, the convolution operation is $\tilde{D}^{-\frac{1}{2}}\tilde{A}\tilde{D}^{-\frac{1}{2}}XW$, and thus the complexity is $\mathcal{O}(mdh)$ (Kipf & Welling, ), where $\tilde{A}X$ can be implemented efficiently with sparse-dense matrix multiplication. For $\mathcal{O}(mdh)$, $m$ is the number of non-zero elements in matrix $A$, $d$ is the feature dimensions for the attributed network, and $h$ is the number of feature maps of the weight matrix.
Moreover, to capture graph topological content, we devise a link prediction layer to reconstruct the original topological structure, and thus the overall complexity is $\mathcal{O}(mdH+n^{2})$, where $H$ is the summation of all feature maps across different layers, and $n$ is the number of nodes.
(2) Latent Diffusion Models. We employ an MLP as the denoising function by following (Karras et al., ; Zhang et al., ). Specifically, during the training phase, a random timestep is sampled for each epoch to train the latent node embeddings. The time complexity of this process is $\mathcal{O}(en{d}^{\prime}{H}^{\prime})$, where $e$ denotes the number of training epochs, ${H}^{\prime}$ is the number of feature maps for MLP, ${d}^{\prime}$ is the input dimension for DM, which is also the feature map dimension of AE, since we adopt the output of AE as the input of DM. During the inference phase, similarly, the time complexity is $\mathcal{O}(tn{d}^{\prime}{H}^{\prime})$, where $t$ represents the number of sampling timesteps in the denoising process. The combined time complexity of both training and inference phases remains $\mathcal{O}((e+t)n{d}^{\prime}{H}^{\prime})$.

### 5.2 Empirical Discussion

Following (Liu et al., ), we employ the Wall-Clock time and GPU memory for empirical comparisons, and the experimental results are listed in Table 4 and Table 4, respectively. The whole testing is conducted on a Linux server with a 2.90GHz Intel(R) Xeon(R) Platinum 8268 CPU, 1T RAM, and 1 Nvidia 2080 Ti GPU with 11GB memory.

We can observe that DiffGAD is efficient in terms of both time and memory usage. Specifically, benefitting from the advancements in diffusion acceleration, we adopt a more efficient EDM sampler (Karras et al., ) within latent space and utilize 50 sampling steps. From Table 4, we can observe that the sampling time of DiffGAD is quite short, only 0.17 seconds.
Moreover, we also list the Autoencoder with $\alpha=1$ in Eq. 7, Denoted as DiffGAD (AE $\alpha=1$), which omits the topology reconstruction, and reduces AE costs to $\mathcal{O}(mdH)$. We can observe that the running time of AE $\alpha=1$ and diffusion model are comparable.

Furthermore, as the size of the graph scales to real-world proportions, the overall time complexity of DM simplifies to $\mathcal{O}(n)$ as we discuss in 5.1. This indicates that the complexity $\mathcal{O}(n^{2})$ of Auto Encoder dominates the whole complexity, while the time required for diffusion model who adding and removing noise in latent space can be neglected.

**Table 3: Wall-clock running time (s) among deep algorithms on five different numbers of epochs, where the experiments are conducted on the gen_time dataset by BOND (Liu et al., ).**
| Algorithm | 10 | 100 | 200 | 300 | 400 |
| --- | --- | --- | --- | --- | --- |
| GCNAE | 0.27 | 2.40 | 4.46 | 6.80 | 10.95 |
| DOMINANT | 0.10 | 0.59 | 1.35 | 1.90 | 2.40 |
| DONE | 0.11 | 0.75 | 1.61 | 2.26 | 3.18 |
| AdONE | 0.14 | 1.11 | 2.55 | 4.12 | 5.30 |
| AnomalyDAE | 0.11 | 0.70 | 1.12 | 1.71 | 2.04 |
| GAAN | 0.09 | 0.61 | 1.17 | 1.44 | 1.89 |
| CONAD | 0.17 | 1.23 | 2.40 | 3.49 | 4.59 |
| DiffGAD (AE $\alpha\neq 1$) | 0.07 | 0.65 | 1.26 | 1.91 | 2.55 |
| DiffGAD (AE $\alpha=1$) | 0.07 | 0.51 | 0.97 | 1.48 | 1.96 |
| DiffGAD(Diff) | 0.03 | 0.42 | 0.81 | 1.21 | 1.63 |
| DiffGAD(Cond-Diff) | 0.03 | 0.45 | 0.91 | 1.35 | 1.80 |
| DiffGAD(Sample) | 0.17 |  |  |  |  |

## 6 Conclusion

In this work, to tackle the limited ability to capture discriminative content for graph anomaly detection,
we make the first effort to transfer the diffusion model from the generation task to a detector and propose a diffusion-based unsupervised graph anomaly detector, namely DiffGAD.
Specifically, (1) a discriminative content-guided generation paradigm is proposed to capture the discriminative content and then distill it into the latent space, and (2) a content-preservation strategy is designed to enhance the confidence of the aforementioned guidance process, and (3) extensive experiments on 6 real-world and large-scale datasets with different metrics demonstrate the effectiveness of our method, and (4) comprehensive time and computational analysis demonstrate our efficiency.
Limitation and Future Work.
It’s noteworthy that our work is operated in the latent space, but we believe that its expressiveness is limited by the graph encoder, which may restrict the model’s ability to fully capture intricate graph structures and relationships.
We will also explore some encoder-free strategies with the help of LLM (Fang et al., ) in the future.

## 7 Code of Ethics and Reproducibility Statement

Code of Ethics. This work is primarily foundational in Graph Anomaly Detection, focusing on the development of a more robust, reliable graph anomaly detector. Its primary aim is to contribute to the academic community by enhancing the understanding and implementation of Graph Anomaly Detection techniques. We do not foresee any direct, immediate, or negative societal impacts stemming from the outcomes of our research.
Reproducibility Statement. All results presented in this work are fully reproducible. We provide our code using the anonymous GitHub link. The optimal hyperparameters are detailed in Appendix D.

## Appendix A Related Works

In this section, we introduce notable prior works on graph anomaly detection, list the related diffusion model-based methods, and enumerate the differences between DiffGAD and related methods.

Graph Anomaly Detection (GAD) aims to detect abnormal targets from a huge number of normal samples.
In the semi-supervised branch, Graph Neural Networks (GNNs) (Gao et al., ; Wang et al., ; Liu et al., ; He et al., ; Zhang et al., ; Chen et al., ; ) have achieved remarkable success in detecting graph anomalies across various domains for its excellent representation capabilities for modeling complex relationships.
Specially, CapsGI (Zheng et al., ) combines capsules with self-supervised learning (SSL) to overcome the inconsistency of anomaly detection on graphs. PMP (Zhuo et al., ) introduces Partitioning Message Passing to adaptively adjust the information aggregated from its heterophilic and homophilic neighbors. RQGNN (Dong et al., ) proves that the accumulated spectral energy of the graph signal can be represented by its Rayleigh Quotient, and proposes Rayleigh Quotient Graph Neural Network for graph-level anomaly detection.

To tackle the issue of limited labeled data, recent methods (Fan et al., ; Kipf & Welling, ; Bandyopadhyay et al., ; Yuan et al., ; Xu et al., ) propose unsupervised approaches over the large-scale unlabeled data, where the anomaly scores is calculated as the reconstruction error.
For example, the representative work in (Ding et al., ) uses GCN (Kipf & Welling, ) and AE (Kingma & Welling, ) to encode the graph into a high-dimensional latent space, decodes the structure and attributes separately using the decoder, and then utilizes the weighted reconstruction error of node feature and structure as the anomaly score.

Diffusion Models (DMs) have garnered widespread attention for their remarkable advances in generating high-quality images and videos. Representative models like DDPM (Ho et al., ; Sohl-Dickstein et al., ), SMG (Song & Ermon, ; ), and SDE (Song et al., ) have been widely adapted to various domains (Xie et al., ; Zhao et al., ; Anciukevicius et al., ; Bar-Tal et al., ; Zhou et al., ).
For instance, within the scope of GNNs, researchers explore to employ DMs to enhance molecular graph modeling (Huang et al., ; ; Morehead & Cheng, ), protein design (Zhang et al., ; Gruver et al., ; Wu et al., ), drug discovery (Guan et al., ; Schneuing et al., ), material design (Xie et al., ), etc, and achieve significant improvement. There also has been an exploration in GAD, Diga (Li et al., ) proposes a semi-supervised DM to detect money laundering, where the DM is guided by labeled anomalies for subgraph recovery. GODM (Liu et al., ) introduces a plug-and-play package to adopt a variational encoder and diffusion model to generate effective negative samples to solve class imbalance.

Compared with GODM (Liu et al., ), which aims to utilize the powerful generative ability of DMs to generate sufficient negative samples to enhance the performance of current GAD methods,
we directly employ DMs to detect the abnormal targets as an end-to-end model with careful designation.

## Appendix B Visualization

In this section, we visualize the distribution of the reconstructed representations by using t-SNE (Van der Maaten & Hinton, ). For a fair demonstration, we select the smaller-scale Books and the larger-scale Weibo dataset and illustrate the results in Figure 6 and Figure 7, respectively.

Specifically, we visualize the t-SNE results of the reconstructed general, common, and discriminative content with small timestep (t=100) and large timestep (t=400). Additionally, we compare these outcomes against the learned representations derived from the SOTA reconstruction-based method, DOMINANT, and can draw several observations:

(1) Current reconstruction-based methods tend to produce highly condensed clusters of learned representations, thereby constraining the discriminative information inherent between distinct nodes. While DM significantly enhances the ability to capture the distribution patterns of samples.
(2) Compared to the general content, the common content emphasizes the shared attributes across disparate samples, leading to a clustering effect. Conversely, discriminative content mines the differences, making a more discernible distribution of samples.
(3) Discriminative Content exhibits superior performance in identifying anomalous samples, with them distributed at the boundary of the data distributions. This contrasts with the more even distribution of other content categories.

Figure: Figure 6: Visualization results of the learned representations by (1) reconstruct-based method (e.g. Dominant), and (2) different components of DiffGAD on the Books dataset.
Refer to caption: x10.png

Figure: Figure 7: Visualization results of the latent space constructed by (1) reconstruct-based method (e.g. Dominant), and (2) different components of DiffGAD on the Weibo dataset.
Refer to caption: x11.png

## Appendix C More Experimental Details

### C.1 Detailed Dataset Descriptions

The detailed statistics of the datasets are shown in Table 5.

Weibo (Zhao et al., ):
Weibo describes the relationship between users, posts, and hashtags on the social platform Tencen-Weibo, where the hashtags serve as the edges, the post’s information and the text’s bag-of-word vectors make up for the node features. Temporal information is used to label data and the users are suspicious if they post as frequently as bots.

Reddit (Kumar et al., ; Wang et al., ):
Reddit consists of the user posts on subreddits within one month, and the text of each post is transferred to a feature vector to represent the LIWC categories (Pennebaker et al., ). The features of users and subreddits are derived by summing the features of their respective posts, where the banned users on the platform are considered to be anomalous.

Disney and Books (Sánchez et al., ):
Disney and Books are co-purchase networks of movies and books from Amazon co-purchase networks respectively (Leskovec et al., ). Whose node features both include prices, ratings, number of reviews, etc. The ground truth labels of Disney are manually annotated according to the majority vote of high school students and those of Books are derived from amazonfail tag information.

Enron (Sánchez et al., ):
Enron denotes the email network extracted from (Klimt & Yang, ), where the email addresses having spam messages are regarded as anomalies. The nodes are composed of emails, whose features describe the average number of recipients, the time range between two emails, and so on.

Dgraph (Huang et al., ):
Dgraph is a large-scale attributed graph with 3M nodes, 4M dynamic edges, and 1M ground-truth nodes. A node represents a financial user, and an edge from one user to another means that the user regards the other user as the emergency contact person. Users who exhibit at least one fraud activity, such as not repaying the loans a long time after the due date and ignoring the platform’s repeated reminders, are defined as anomalies/fraudsters.

**Table 5: The statistics of datasets.**
| Dataset | #Nodes | #Edges | #Features | Avg.Degree | Ratio |
| --- | --- | --- | --- | --- | --- |
| Weibo | 8405 | 407963 | 400 | 48.5 | 10.3% |
| Reddit | 10984 | 168016 | 64 | 15.3 | 3.3% |
| Disney | 124 | 335 | 28 | 2.7 | 4.8% |
| Books | 1418 | 3695 | 21 | 2.6 | 2.0% |
| Enron | 13533 | 176987 | 18 | 13.1 | 0.4% |
| Dgraph | 3700550 | 4300999 | 17 | 1.2 | 0.4% |

### C.2 More Experimental Comparisons

In this subsection, we show more experimental metrics, including Average Precision (AP), Recall@k, and Area Under the Precision and Recall Curve (AUPRC), and the experimental results are listed in Table 6, Table 7, and Table 8, respectively. Specifically, we can observe that our DiffGAD achieves favorable performances with small $std$ results around all benchmarks, which demonstrates our effectiveness.

**Table 6: Performance comparison (Average Precision, AP) among 13 algorithms on 6 datasets, where we show the avg perf. $\pm$ the std of perf. of each method. The best results of all methods are indicated in boldface, and the second best results are underlined. OOM refers to out-of-memory with CPU. TLE denotes time limit of 24 hours exceeded.**
| Algorithm | Weibo | Reddit | Disney | Books | Enron | Dgraph |
| --- | --- | --- | --- | --- | --- | --- |
| graph-agnostic |  |  |  |  |  |  |
| LOF | 15.8 $\pm$ 0.0 | 4.2 $\pm$ 0.0 | 5.2 $\pm$ 0.0 | 1.5 $\pm$ 0.0 | 0.0 $\pm$ 0.0 | TLE |
| IF | 12.9 $\pm$ 2.6 | 2.8 $\pm$ 0.1 | 10.1 $\pm$ 4.5 | 1.9 $\pm$ 0.2 | 0.1 $\pm$ 0.0 | 1.8 $\pm$ 0.0 |
| MLPAE | 52.8 $\pm$ 9.9 | 3.4 $\pm$ 0.0 | 5.9 $\pm$ 0.8 | 1.8 $\pm$ 0.3 | 0.1 $\pm$ 0.0 | 0.9 $\pm$ 0.0 |
| classical algorithms |  |  |  |  |  |  |
| SCAN | 17.3 $\pm$ 3.4 | 3.3 $\pm$ 0.0 | 5.0 $\pm$ 0.3 | 2.0 $\pm$ 0.1 | 0.0 $\pm$ 0.0 | TLE |
| Radar | 92.1 $\pm$ 0.7 | 3.6 $\pm$ 0.2 | 7.2 $\pm$ 0.0 | 2.2 $\pm$ 0.0 | 0.2 $\pm$ 0.0 | OOM |
| ANOMALOUS | 92.1 $\pm$ 0.7 | 4.0 $\pm$ 0.6 | 7.2 $\pm$ 0.0 | 2.2 $\pm$ 0.0 | 0.2 $\pm$ 0.0 | OOM |
| deep algorithms |  |  |  |  |  |  |
| GCNAE | 70.8 $\pm$ 5.0 | 3.4 $\pm$ 0.0 | 4.8 $\pm$ 0.7 | 2.1 $\pm$ 0.4 | 0.1 $\pm$ 0.0 | 1.0 $\pm$ 0.0 |
| DOMINANT | 18.0 $\pm$ 10.2 | 3.7 $\pm$ 0.0 | 7.6 $\pm$ 5.0 | 2.2 $\pm$ 0.6 | 0.1 $\pm$ 0.1 | OOM |
| DONE | 65.5 $\pm$ 13.4 | 3.7 $\pm$ 0.4 | 5.0 $\pm$ 0.7 | 1.8 $\pm$ 0.3 | 0.1 $\pm$ 0.0 | OOM |
| AdONE | 62.9 $\pm$ 9.5 | 3.3 $\pm$ 0.4 | 6.1 $\pm$ 1.5 | 2.5 $\pm$ 0.3 | 0.1 $\pm$ 0.0 | OOM |
| AnomalyDAE | 38.5 $\pm$ 22.5 | 3.7 $\pm$ 0.1 | 5.7 $\pm$ 0.2 | 3.5 $\pm$ 1.4 | 0.1 $\pm$ 0.0 | OOM |
| GAAN | 80.3 $\pm$ 0.2 | 3.7 $\pm$ 0.1 | 5.6 $\pm$ 0.0 | 2.6 $\pm$ 0.8 | 0.1 $\pm$ 0.0 | OOM |
| CONAD | 15.6 $\pm$ 6.9 | 3.7 $\pm$ 0.3 | 6.0 $\pm$ 1.4 | 2.5 $\pm$ 0.8 | 0.1 $\pm$ 0.0 | 0.9 $\pm$ 0.0 |
| DiffGAD | 80.9 $\pm$ 1.7 | 3.8 $\pm$ 0.0 | 6.2 $\pm$ 0.0 | 8.1 $\pm$ 2.8 | 1.7 $\pm$ 4.7 | 57.5 $\pm$ 0.0 |

**Table 7: Performance comparison (Recall@k%) among 13 algorithms on 6 datasets, where we show the avg perf. $\pm$ the std of perf. of each method. The best results of all methods are indicated in boldface, and the second best results are underlined. OOM refers to out-of-memory with CPU. TLE denotes time limit of 24 hours exceeded.**
| Algorithm | Weibo | Reddit | Disney | Books | Enron | Dgraph |
| --- | --- | --- | --- | --- | --- | --- |
| graph-agnostic |  |  |  |  |  |  |
| LOF | 22.0 $\pm$ 0.0 | 4.4 $\pm$ 0.0 | 0.0 $\pm$ 0.0 | 0.0 $\pm$ 0.0 | 0.0 $\pm$ 0.0 | TLE |
| IF | 13.8 $\pm$ 6.4 | 0.1 $\pm$ 0.1 | 9.2 $\pm$ 8.3 | 1.1 $\pm$ 1.6 | 0.0 $\pm$ 0.0 | 0.1 $\pm$ 0.1 |
| MLPAE | 48.9 $\pm$ 11.0 | 3.0 $\pm$ 0.0 | 0.0 $\pm$ 0.0 | 0.9 $\pm$ 1.6 | 0.0 $\pm$ 0.0 | 0.5 $\pm$ 0.1 |
| classical algorithms |  |  |  |  |  |  |
| SCAN | 23.8 $\pm$ 7.0 | 2.7 $\pm$ 0.3 | 7.5 $\pm$ 11.2 | 0.7 $\pm$ 1.4 | 0.0 $\pm$ 0.0 | TLE |
| Radar | 86.4 $\pm$ 0.8 | 2.1 $\pm$ 0.8 | 0.0 $\pm$ 0.0 | 0.0 $\pm$ 0.0 | 0.0 $\pm$ 0.0 | OOM |
| ANOMALOUS | 86.4 $\pm$ 0.8 | 4.0 $\pm$ 1.9 | 0.0 $\pm$ 0.0 | 0.0 $\pm$ 0.0 | 0.0 $\pm$ 0.0 | OOM |
| deep algorithms |  |  |  |  |  |  |
| GCNAE | 67.6 $\pm$ 5.2 | 3.0 $\pm$ 0.0 | 0.0 $\pm$ 0.0 | 0.7 $\pm$ 1.8 | 0.0 $\pm$ 0.0 | 0.4 $\pm$ 0.0 |
| DOMINANT | 19.7 $\pm$ 13.8 | 0.9 $\pm$ 0.4 | 3.3 $\pm$ 6.7 | 1.6 $\pm$ 3.1 | 0.0 $\pm$ 0.0 | OOM |
| DONE | 65.4 $\pm$ 12.4 | 2.8 $\pm$ 1.6 | 0.0 $\pm$ 0.0 | 1.1 $\pm$ 1.6 | 0.0 $\pm$ 0.0 | OOM |
| AdONE | 64.3 $\pm$ 7.6 | 1.0 $\pm$ 1.2 | 1.7 $\pm$ 5.0 | 3.0 $\pm$ 1.7 | 0.0 $\pm$ 0.0 | OOM |
| AnomalyDAE | 42.2 $\pm$ 23.7 | 0.9 $\pm$ 0.5 | 0.0 $\pm$ 0.0 | 2.7 $\pm$ 2.2 | 0.0 $\pm$ 0.0 | OOM |
| GAAN | 77.1 $\pm$ 0.2 | 1.1 $\pm$ 0.4 | 0.0 $\pm$ 0.0 | 1.8 $\pm$ 1.8 | 0.0 $\pm$ 0.0 | OOM |
| CONAD | 20.3 $\pm$ 13.3 | 1.3 $\pm$ 1.6 | 0.8 $\pm$ 3.6 | 1.7 $\pm$ 2.9 | 0.0 $\pm$ 0.0 | 0.4 $\pm$ 0.1 |
| DiffGAD | 77.1 $\pm$ 0.5 | 2.3 $\pm$ 1.2 | 0.0 $\pm$ 0.0 | 13.8 $\pm$ 2.9 | 3.0 $\pm$ 7.3 | 57.3 $\pm$ 0.0 |

**Table 8: Performance comparison (Area under Precision Recall Curve, AUPRC) among deep learning based algorithms on 5 datasets, where we show the avg perf. $\pm$ the std of perf. of each method. The best results of all methods are indicated in boldface, and the second best results are underlined.**
| Algorithm | Weibo | Reddit | Disney | Books | Enron |
| --- | --- | --- | --- | --- | --- |
| GCNAE | 76.5 $\pm$ 6.9 | 3.4 $\pm$ 0.0 | 4.0 $\pm$ 0.5 | 1.9 $\pm$ 0.2 | 0.0 $\pm$ 0.0 |
| DOMINANT | 55.6 $\pm$ 9.4 | 3.7 $\pm$ 0.0 | 6.0 $\pm$ 0.7 | 1.6 $\pm$ 0.1 | 0.1 $\pm$ 0.0 |
| DONE | 64.9 $\pm$ 1.9 | 3.7 $\pm$ 0.0 | 3.7 $\pm$ 0.0 | 1.5 $\pm$ 0.0 | 0.0 $\pm$ 0.0 |
| AdONE | 67.7 $\pm$ 0.9 | 3.4 $\pm$ 0.0 | 4.2 $\pm$ 0.0 | 2.5 $\pm$ 0.0 | 0.1 $\pm$ 0.0 |
| AnomalyDAE | 72.2 $\pm$ 10.8 | 3.7 $\pm$ 0.0 | 4.8 $\pm$ 0.9 | 11.6 $\pm$ 17.2 | 0.1 $\pm$ 0.0 |
| CONAD | 61.0 $\pm$ 27.4 | 3.7 $\pm$ 0.0 | 5.4 $\pm$ 3.7 | 2.2 $\pm$ 0.5 | 0.1 $\pm$ 0.0 |
| DiffGAD | 80.9 $\pm$ 1.7 | 3.7 $\pm$ 0.0 | 5.0 $\pm$ 0.0 | 7.8 $\pm$ 2.3 | 1.4 $\pm$ 4.5 |

### C.3 More Ablation Results

In this subsection, we provide more ablation results to validate our method. Specifically, we empirically explore the validity of the generated common feature $c_{next}$, and show the distance between $c_{next}$ with the reconstructed Abnormal and Normal features statistically, the L2 distances is shown in Table 9, and the Standardized cosine distances in depicted in Table 10.
We can observe that $c_{next}$ is more similar to the normal samples from both results, which shows that normal samples contain more common attributes.

**Table 9: L2 distance ($\downarrow$) of $c_{next}$ to the reconstructed abnormal and normal samples, respectively. The distance is calculated as the mean of all timesteps.**
| L2 Dis ($\downarrow$) | Weibo | Reddit | Disney | Books | Enron |
| --- | --- | --- | --- | --- | --- |
| Abnormal | 295.16 | 0.4223 | 2611.96 | 0.9888 | 0.0718 |
| Normal | 18.05 | 0.4209 | 2372.6 | 0.9886 | 0.0704 |

**Table 10: Standardized Cosine distance ($\uparrow$) of $c_{next}$ to the reconstructed abnormal and normal samples, respectively. The distance is calculated as the mean of all timesteps.**
| Cos Dis ($\uparrow$) | Weibo | Reddit | Disney | Books | Enron |
| --- | --- | --- | --- | --- | --- |
| Abnormal | 0.1828 | 0.4947 | 0.3424 | 0.5006 | 0.4987 |
| Normal | 0.4347 | 0.4949 | 0.4214 | 0.5008 | 0.4998 |

Figure: ((a))
Refer to caption: x12.png

Figure: ((a))
Refer to caption: x14.png

Furthermore, we show more experimental results with different $\lambda$ in Figure 8. We can observe that both the Reddit and Weibo datasets are not sensitive with different $\lambda$ ($\lambda<2$), but the performance of both datasets drops with $\lambda=2$, borrowing from the classifier-free guidance (Ho & Salimans, ), we believe that $\lambda$ serves as a trading factor, where Reddit needs discriminative content from $\lambda=0.8$, and $\lambda=1.0$ works better for Weibo.

Moreover, we also supplement more experimental results with different timestep $t$ in Figure 9. We can observe that Reddit is not sensitive to different $t$ (values from the $y$ axis), and small-scale general content works better for the Enron dataset.

### C.4 Detailed Baseline Description

LOF (Breunig et al., ):
Local Outlier Factor (LOF) calculates the extent to which the node is anomalous according to how isolated it is compared to its neighborhood. It is worth noting that LOF only uses node features, and the neighborhood is chosen by k-nearest-neighbors (KNN).

IF (Liu et al., ):
Isolation Forest (IF) is a well-established tree ensemble technique employed in anomaly detection, where it constructs an ensemble of base trees to isolate data points. The decision boundary is established based on the proximity of individual instances to the root of each tree. IF only utilizes the node features of the data.

MLPAE (Sakurada & Yairi, ):
MLPAE utilizes the Multilayer Perceptron (MLP) as both the encoder and decoder to reconstruct node features. Specifically, the encoder processes the node features to learn their low-dimensional embedding, and the decoder reconstructs the input node features from these embedding, employing the reconstruction loss of the node features as the anomaly score for each node.

SCAN (Xu et al., )
The Structural Clustering Algorithm for Networks (SCAN) is a method designed to detect clusters, hub nodes, and outlier nodes in a graph using only the graph’s structural information. SCAN identifies structural anomalies by detecting clusters and considering the nodes within these clusters as potential outliers. Since structural outliers exhibit distinct clustering patterns, SCAN is particularly effective for this purpose.

Radar (Li et al., ):
Radar is an anomaly detection framework for attributed graphs that utilizes both graph structure and node features as inputs. It identifies outlier nodes whose behaviors deviate significantly from the majority in terms of the residuals of feature information and coherence with network structure. The anomaly score is determined by the norm of reconstruction residuals.

ANOMALOUS (Peng et al., ):
ANOMALOUS performs both anomaly detection and attribute selection on attributed graphs using CUR decomposition and residual analysis. Similar to Radar, the anomaly score is also determined by the norm of its reconstruction residuals.

GCNAE (Kipf & Welling, ):
GCNAE is an AE framework that employs GCN as both the encoder and decoder. The encoder takes graph structure and node features as inputs to aggregate information from a node’s neighbors to learn its latent representation and the decoder uses the GCN to reconstruct the node features and graph structure from the embedding. The anomaly score for each node is determined by the reconstruction error of the decoder.

DOMINANT (Ding et al., ):
DOMINANT is one of the pioneering works that leverages GCN and AE for anomaly detection. It follows an encoder-decoder architecture with a two-layer GCN. The node feature decoder is also a two-layer GCN, while the graph structure is decoded by a one-layer GCN and dot product. The anomaly score for each node is determined by the weighted sum of both decoders.

DONE (Bandyopadhyay et al., ):
DONE leverages an MLP-based encoder-decoder architecture to reconstruct both the adjacency matrix and node features. It employs separate AEs for structural and feature information. The optimization of node embeddings and anomaly scores is performed simultaneously using a unified loss function.

AdONE (Bandyopadhyay et al., ):
AdONE is an extension of DONE, incorporating an additional discriminator to differentiate between the learned structural and feature embedding of a node. This adversarial training strategy aims to achieve better alignment of two distinct embeddings within the latent space.

AnomalyDAE (Fan et al., ):
AnomalyDAE employs both a structural AE and an attribute AE to detect outlier nodes. The encoder encodes adjacency matrix and node features respectively to obtain two embeddings, while the attribute decoder reconstructs the node features using both structural and attribute embeddings.

GAAN (Chen et al., ):
GAAN is a GAN-based method for outlier node detection utilizing an MLP-based generator to create fake graphs and an MLP-based encoder to encode graph information. A discriminator is then trained to distinguish between real and fake graphs. The anomaly score is determined by combining the node reconstruction error and the confidence in identifying real nodes.

CONAD (Xu et al., ):
CONAD leverages graph augmentation and cognitive learning techniques to detect outlier nodes. It generates augmented graphs to impose prior knowledge of anomalies. The graph encoder is optimized through a contrastive learning loss. Similar to DOMINANT, the outlier score is determined by the weighted sum of two different decoders.

## Appendix D Implementation Details

Environment. The key libraries and their versions used in the experiment are as follows: Python=3.11, CUDA_version=11.8, torch=2.0.1, pytorch_geometric=2.4.0, pygod=0.4.0, numpy=1.25.0

Hardware configuration.
All the experiments were performed on a Linux server with a 3.00GHz Intel Xeon Gold 6248R CPU,1T RAM, and 1 NVIDIA A40 GPU with 45GB memory.

Model Architectures.
The architectural details of DiffGAD are listed here for easier reproduction. The Graph AE, which is optimized by Adam, uses a two-layer GCN as the encoder and a two-layer GCN decoder to reconstruct the node attribute. The structural decoder utilizes a one-layer GCN and dot product to reconstruct the graph adjacency matrix.
As for the DM, the denoising function is a multi-layer MLP with SiLU activations. More details can be found in our code.

Hyper-parameters.
The hyper-parameters are listed in Table 11, our unconditional DM and conditional DM share the same parameters.

**Table 11: Hyper-parameter for different datasets.**
| Hyper-paramter | Type | Weibo | Reddit | Disney | Books | Enron | Dgraph |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Batch size | AE | FULL BATCH | 8192 |  |  |  |  |
| Epochs | AE | 300 |  |  |  |  |  |
| Early stop | AE | No |  |  |  |  |  |
| Dropout | AE | 0.3 | 0.3 | 0.3 | 0.1 | 0.1 | 0.3 |
| Learning Rate | AE | 0.01 | 0.05 | 0.01 | 0.1 | 0.01 | 0.1 |
| $\alpha$ | AE | 0.8 | 0.8 | 1.0 | 0.5 | 0.0 | 1.0 |
| dimension | AE | 128 | 32 | 8 | 8 | 8 | 8 |
| Batch size | DM | FULL BATCH | 8192 |  |  |  |  |
| Epochs | DM | 800 |  |  |  |  |  |
| Early stop | DM | Yes |  |  |  |  |  |
| Learning Rate | DM | 0.005 |  |  |  |  |  |
| dimension | DM | 256 | 64 | 16 | 16 | 16 | 16 |
| $\lambda$ | DM | 1.0 | 0.8 | 2.0 | 2.0 | 2.0 | 1.0 |

## Peer Reviews

confidence: 3
contribution: 2
initial_rating: 5
presentation: 3
questions: - Why did you choose to use GAE as the encoder and decoder instead of considering other models, such as VGAE, graph transformers, etc.? Is it possible to use these models as the encoder and decoder?
- What are the conditions that a good latent space should satisfy? Or, what constitutes a good latent space for performing the diffusion process to conduct anomaly detection tasks?
- Regarding the training process, it looks like you first train a satisfactory encoder and decoder, then fix the parameters, and train the diffusion models. Why did you not choose to construct a global loss and train the GAE and diffusion models together?
soundness: 3
strengths: - The first attempt to transfer the generative diffusion models to the GAD task is a great try, bringing new perspectives to the anomaly detection community.
- The idea of distilling the discriminative content based on a linear combination of the two different diffusion models is interesting and easy to follow.
summary: The paper proposes a Diffusion-based Graph Anomaly Detector for unsupervised identifying abnormal entities in networks. The contributions can be summarized as follows: 1: The author made the first attempt to transfer the diffusion models to the graph anomaly diffusion tasks. The model consists of an auto-encoder framework and two diffusion models to conduct unconditional diffusion and conditional diffusion. 2: To guide the training of diffusion models in latent space, the authors propose to use a discriminative content-guided generation paradigm to distill the discriminative content in latent space; and a content-preservation strategy to enhance the confidence of the guidance process. 3: The authors conduct experiments on 7 real-world datasets and make comparisons with 13 baseline methods.
weaknesses: - Some parts of the paper need further explanation. For example, in the introduction, the authors mention that some researchers utilize encoders to map graph data into a latent space, but there is a lack of essential discussion about why they are doing that.
- The motivation behind some of the model designs is ambiguous. For instance, in the selection of the encoder and decoder, the conditions that a good encoder and decoder should satisfy are unclear. Instead of directly utilizing the GAE framework, it seems more important to discuss the criteria for selecting a good encoder and decoder and add related experiments to support your claims. I did not see any discussions related to that.

---

confidence: 3
contribution: 3
initial_rating: 8
presentation: 3
questions: 1. Did the authors explore any alternatives to the currently used AE?
2. Follow-up: a less comlex alternative could give an efficiency boost at some performance cost. Would be interesting to see. (not required for acceptance)
3. Are there any particular type of datasets that are more "conducive" to DiffGAD than others?
soundness: 3
strengths: 1. The use of diffusion models for GAD is an innovative application
2. A generous number of meaningful datasets are used for experimentation
3. The figures used in the paper manage to illustrate the problem and approach well.
summary: The paper introduces DiffGAD, a diffusion based model designed for graph anomaly detection (GAD). It employs a latent space learning paradigm and incorporates discriminative content to enhance profiency. The authors present experimental results on six large real world datasets to demonstrate model performance. Code is made available as well.
weaknesses: 1. A specific graph autoencoder (AE) is used by the model. This may limit the adaptability of the model. (See Q1)
2. Hyperparameters like λ affect the performance of DiffGAD. If this turns in to an "art" to get the best performance, then it may be problematic for real world scenarios. Clarification from the authors about some guidelines to selecting λ could be helpful.

---

confidence: 3
contribution: 3
initial_rating: 6
presentation: 3
questions: 1、How do the two DMs achieve concurrent sampling without adding extra parameters?
2. In 3.3, the minimum perturbation is used to change the potential embedding z0 to zt. How is this “minimum perturbation” defined and quantified?
soundness: 3
strengths: 1、The method combines graph neural networks (GNNs) with diffusion models, an innovative fusion of techniques that takes advantage of both the strengths of GNNs in graph structural analysis and the sophistication of diffusion models in generative modeling.
2、 DiffGAD uses both conditional and unconditional diffusion models to reconstruct the graph, and this combination improves the model's sensitivity and ability to recognize anomalies.
summary: This article presents DiffGAD, a new method based on Diffusion Models (DM), for dealing with the problem of anomaly detection in graph data. A research framework based on Diffusion Models is constructed, which encodes the graph data into the latent space via an encoder, then adds noise to preserve the general content and samples from unconditional and conditional diffusion models, and finally transforms the reconstructed embedding back into the graph space via a decoder to compute the reconstruction error. Finally, through experiments on multiple real-world datasets, the authors conclude the effectiveness of DiffGAD on graph anomaly detection tasks.
weaknesses: 1、the experimental part of the dataset settings, the dataset selected in this paper are relatively small feature dimensions, have you considered the use of high-dimensional features of the dataset for the experiment?
2、Comparison methods on although there are based on deep learning, but the latest is 2022, it is recommended to increase the comparison experiments, and the current advanced methods in the field, to show the advantages of the project method.

---

confidence: 3
contribution: 2
initial_rating: 6
presentation: 2
questions: The paper mentions that graph encoders (such as GCN in Graph AE) might limit the model’s ability to represent complex graph structures and relationships, but it does not detail how this limitation manifests in practical applications or to what extent it impacts DiffGAD’s performance. For instance, when processing graphs with highly heterogeneous node attributes or complex topologies (e.g., multi-layer nested structures, frequently dynamic graphs), would the current encoder lead to critical information loss? How does this information loss impact the accurate extraction of discriminative content and, subsequently, anomaly detection accuracy? The authors could quantify this impact by designing targeted experiments. For example, they could construct synthetic graph datasets with varying levels of heterogeneity and topological complexity to compare DiffGAD’s performance when using the current encoder versus a hypothetical ideal encoder (with stronger representational power). Metrics such as anomaly detection accuracy and recall could provide insight into performance differences.
soundness: 3
strengths: 1、The authors innovatively adapt diffusion models from generative tasks to the field of graph anomaly detection, introducing DiffGAD, which brings new perspectives to graph anomaly detection.

2、A novel latent space learning paradigm is introduced by combining unconditional and conditional diffusion models to capture and refine discriminative content, offering a fresh approach to address the challenge of extracting discriminative features in graph anomaly detection.

3、When addressing anomaly detection, the method incorporates diffusion sampling and a content preservation mechanism, effectively injecting and retaining discriminative content across different scales.

4、In the experimental section, six different real-world and large-scale datasets are used for evaluation, covering various types of data scenarios, such as social networks (Weibo, Reddit), commercial networks (Disney, Books, Enron), and large-scale financial networks (Dgraph), ensuring the reliability and generalizability of the experimental results.
summary: This paper proposes DiffGAD, an unsupervised graph anomaly detector based on diffusion models, designed to address the limited capability of capturing discriminative content in graph anomaly detection.

The main contributions include:

Pioneering the application of diffusion models in graph anomaly detection by adapting them from generative tasks, presenting DiffGAD to enhance the model's discriminative ability.
Proposing a generative paradigm guided by discriminative content to extract and refine discriminative features into the latent space, and designing a content preservation strategy to improve the reliability of the guidance process.
Demonstrating the effectiveness of DiffGAD through extensive experiments on 6 real-world datasets and 13 baseline methods.
weaknesses: 1、Although the paper mentions that graph encoders (e.g., GCN in Graph AE) may limit the model's ability to represent complex graph structures and relationships, it only briefly notes this issue without analyzing how this limitation impacts DiffGAD’s performance in specific experiments or real-world scenarios. For example, when handling highly heterogeneous or dynamically changing graph structures, the encoder may fail to accurately capture critical information, potentially leading to reduced anomaly detection accuracy.

2、For the key hyperparameter λ in the model, simply showing the impact of different values on performance through experiments is insufficient. There is a lack of theoretical justification explaining why the optimal value differs across datasets and the intrinsic connection between these values and data characteristics.

3、In the introduction, the logical connection between the research motivation and the subsequent presentation of DiffGAD's innovations could be clarified. It would be helpful to explicitly highlight the specific limitations of traditional methods in capturing discriminative content and how DiffGAD’s unique design (such as the generative paradigm guided by discriminative content and content preservation strategy) directly addresses these issues.

---

confidence: 5
contribution: 2
initial_rating: 3
presentation: 2
questions: 1. The GAE model detects anomalies by calculating reconstruction error. Wouldn’t it be more effective to focus on reconstructing common attributes rather than distinguishable features, as anomalies are typically identified by their deviations from common patterns?
2. Why add noise to the features? Can’t the original features capture the general patterns?
3. In the visualization results, normal nodes and abnormal nodes are not clearly distinguished.
soundness: 3
strengths: 1. This paper presents a clear motivation.
2. The logical structure of the paper is clear.
summary: The paper presents a graph anomaly detection method, DiffGAD, which aims to capture critical discriminative content in reconstruction. By leveraging diffusion sampling, DiffGAD infuses the latent space with discriminative content. To evaluate its effectiveness, the authors conduct experiments on seven datasets and compare its performance against other anomaly detection methods.
weaknesses: 1. The paper states that ‘the latent space constructed by the AE-based method (Ding et al., 2019) tends to represent all samples for the Books dataset (Sánchez et al., 2013) into the same point’ and 'VAE constructs the latent space within a constrained distribution (e.g., the Gaussian distribution), leading to a uniform latent distribution.' This argument should be further supported through experimental validation.
2. Authors should add the latest baselines to demonstrate the effectiveness of DiffGAD.
3. Sec. 4.3 should further analyze why DIFFGAD does not achieve optimal performance.

Meta-review: This paper proposes a diffusion-based graph anomaly detector (DiffGAD) to identify abnormal entities in networks.  DiffGAD encodes graph data into a latent space via an encoder, adds noise and samples using unconditional and conditional diffusion models, and transformers embeddings back to the graph space via a decoder.  The authors demonstrate DiffGAD's effectiveness compared to baseline deep anomaly detectors on a variety of datasets.

Reviewers leaned positively towards this work, and appreciated the adaptation of diffusion models to the GAD space and the breadth of experiments authors conducted.  There were a few points of concern reviewers raised:

- Clarification around conditions of what a good latent space is for anomaly detection and how this influences the autoencoder choice (pSKo, fVC2, 2tPm)

- Some newer baselines were missed in the initial draft; reviewers addressed some of these concerns, but folding them in and presenting the comparisons with the most recent work is important (wf4Y, epRR)

- Concerns around hyperparameter (\lambda) sensitivity (2tPm, fVC2)

I encourage the authors to fold these into the revision.

Decision: Accept (Poster)