DiffGAD: A Diffusion-based Unsupervised Graph Anomaly Detector
Authors: Jinghan Li
Yuan Gao
Jinda Lu
Junfeng Fang
Congcong Wen
Hui Lin
Xiang Wang
Venue: ICLR 2025 Poster (2025)
Keywords: Graph Anomaly Detection
Diffusion Models
Primary area: learning on graphs and other geometries & topologies
TL;DR: We design strategies to adapt the diffusion model as a detector for graph anomaly detection and achieve significant improvements.

Abstract: Graph Anomaly Detection (GAD) is crucial for identifying abnormal entities within networks, garnering significant attention across various fields. Traditional unsupervised methods, which decode encoded latent representations of unlabeled data with a reconstruction focus, often fail to capture critical discriminative content, leading to suboptimal anomaly detection.
To address these challenges, we present a Diffusion-based Graph Anomaly Detector (DiffGAD). At the heart of DiffGAD is a novel latent space learning paradigm, meticulously designed to enhance the model's proficiency by guiding it with discriminative content. This innovative approach leverages diffusion sampling to infuse the latent space with discriminative content and introduces a content-preservation mechanism that retains valuable information across different scales, significantly improving the model’s adeptness at identifying anomalies with limited time and space complexity. 
Our comprehensive evaluation of DiffGAD, conducted on six real-world and large-scale datasets with various metrics, demonstrated its exceptional performance. Our code is available at https://github.com/fortunato-all/DiffGAD

Published as a conference paper at ICLR 2025
DIFFGAD: A DIFFUSION-BASED UNSUPERVISED GRAPH ANOMALY DETECTOR
Jinghan Li', Yuan Gaolt, Jinda Lu', Junfeng Fang', Congcong Wen', Hui Lin Xiang Wang'
University of Science and Technology of China, New York University,
CChina Academy of Electronics and Information Technology
(1ijh111, lujd, fjf) 2mail ustc. edu. en y426.yuan, xiangwang1223 @gmmal com Linhui @whu. edu, en, wenecEnyu, edu *Corresponding author.
ABSTRACT
Graph Anomaly Detection (GAD) is crucial for identifying abnormal entities within networks, garnering significant attention across various fields. Traditional unsupervised methods, which decode encoded latent representations of unlabeled data with a reconstruction focus, often fail to capture critical discriminative content, leading suboptimal anomaly detection. To address these challenges, we present deffiusion-based Graph Anomaly Detector (DiffGAD). At the heart of DiffGAD is a novel latent space learning paradigm, meticulously designed to enhance the model's proficiency by guiding it with discriminative content. This innovative approach leverages diffusion sampling to infuse the latent space with discriminative content and introduces a content-preservatin information across different scales, significantly improving the model's adeptness at identifying anomalies with limited time and space complexity. Our comprehensive evaluation DiffGAD, conducted on six real-world and large-scale datasets with various metrics, demonstrated its exceptional performance. Our code is available at: https::t///ooo
mechanism that retains valuable
com/ fortunato- wot.tnatt-aalllliffooo.o all/DiffGAD,
INTRODUCTION
Graph structure has garnered significant attention from both academia (Gao al., 2023c; Roy et al., 2023; Gao et al., 2023a; Fang et al., 2024b) and industry (Breuer et al., 2020; Li et al., 2023; Yin et al., 2024), with its potential to represent relationships and structures. Among its wide applications, graph anomaly detection (GAD) has evolved as a popular research topic, aiming to detect abnormal targets (nodes, edges, subgraphs, et al.) from the normal.
Existing research can be categorized into two branches: the semi- supervuper learning branch (Dou et al., 2020; Gao et al., 2023b; 2024b) and the unsupervised learning branch (Hamilton et al., 2017; Chen al., 2020; Peng al., 2018). Semi-supervised learning approaches utilize small subset of labeled data to discern patterns of anomalies, enabling the prediction of labels for the remaining unlabeled dataset. However, human annotation is often time-consuming and fabor-intensive, which limits the application of semi-supervised methods.
As alternative, unsupervised strategies (Ding al., 2019; Fan et al., 2020; Sakurada & Yairi, 2014) directly capture node characteristics and local structures without the need for annotation. Specifically, these approaches are on the assumption that anomalous entities exhibit more complex distributions and are significantly more difficult to reconstruct (Ding et al., 2019; Fan et al., 2020; Sakurada & Yairi, 2014). Consequently, they utilize Autoencoder (AE) to first map the graph data into latent embeddings (Kingma & Welling, 2014; Kipf & Welling, 201 7a; Velickovic et al., 2018) and then decoding, wherein those exhibiting high reconstruction errors are deemed more likely to be anomalies. However, these methods grapple with limitations in their discriminative capability, which results in suboptimal performance. As outlined in (Dou et al., 2020; Liu et al., 2020), abnormal users often deliberately camouflage themselves among normal users. Consequently, they frequently exhibit a significant overlap in common attributes (e.g. age, occupation, length and frequency of reviews, etc.) with normal users. This behavior enables these anomalies to divert the focus of

---

Published as a conference paper at ICLR 2025
Original
Diseriminative
Multi-Contenl
Latent Space
Normal Nodes
Abnormal Nodes
Normal Distribution
Abnormal Distribution
Given several normal and abnormal nodes, the data space is constructed by different methods. Specifically, (a) represents the latent space constructed by current reconstruction- methods, (b) denotes the latent space learned by our discriminative guidance, (c) the latent space constructed by introducing the preserved general content on (b).
Figure 1:
reconstruction-basse models towards overlapping common content, reducing the models' ability to discern truly discriminative features (such as transaction information for fraud detection (Dou et al., 2019)). As a result, anomalous entities are difficult to identify by reconstruction error with such a trivial framework, As illustrated in Figure 1 (a), all data points in the latent space are equally distributed in the learned latent space, without preserving sufficient discriminative content, leading to the overlapping distribution space.
Furthermore, we find that the latent space constructed by the AE-based method (Ding et al., 2019) tends to represent all samples for the Books dataset (Sánchez et al., 2013) into the point, which misguided by the huge common content. In addition to the aforementioned issue, the well-known Variational Autoencoder (VAE) based method (Kipf & Welling, 2016) faces notable challenge: it constructs the latent space within constrained distribution (e.g., the Gaussian distribution), leading uniform latent distribution. This limits the model's expressive capacity, consequently making challenging to distinguish between abnormal and normal samples. To tackle this issue, we propose to enhance the latent space learning process by incorporating discriminative content. Drawing inspiration from the potent generative capabilities of Diffusion Models (DMs) (Ho et al., 2020; Rombach al., 2022; Nichol et al., 2022; Dhariwal & Nichol, 2021), we introduce diffusion-basee detection approach, termed DifGGAD. Specifically, our DiffGAD tackles the issue from two aspects:
Discriminative Distillation distill discriminative content (Section 3.5).
Discriminative content is hard to capture due to the sparsity of anomalies, however, shared content is much easier to acquire. Hence we implicitly capture this discriminative information: Initially, we train an unconditional DM to focus and common elements, referred to as general content. Subsequently, a second DM is trained by conditioning common feature to learn the latent distribution inclusive of common content, where the common feature constructed by adaptively filtering out potential anomalies the unconditional DM reconstructed space. By differentiating the general content from this commonality, we isolate the discriminative content. This content is then integrated into the latent space through the application of classifier-free guidance across both trained DMs. As illustrated in Figure I (b), this process allows the latent space to segregate normal and abnormal distributions within overlapping areas, thereby enabling the differentiation between abnormal and normal samples.
constructing features that encapsulate both discriminative
General Content Preservation to preserve different scale general content (Section 3.3).
Given that anomaly detection based on reconstruction error fundamentally aligns more with clas- sification than generation, we introduce slight modifications to the diffusion model to better suit this task. Specifically, during the sampling stage, rather than initiating from a Gaussian distribution, we introduce minor corruptions the given sample by adding noises for a small timestep t T. and subsequently denoise to generate a reconstructed sample å. Throughout this process, we argue that the general content could be preserved across different scales (reflecting by timestep to further bolster the model's discriminative power with confidence. In detail, noise at smaller values preserves large-scale general content, whereas larger values maintain more localized general
2

---

Published as a conference paper at ICLR 2025
content. As illustrated in Figure 1 (c), by preserving this content, the constructed latent space becomes adept at accurately representing data points. This enhancement effectively widens the distributional discrepancy between anomalous and normal entities, resulting in a robust and discriminative latent space that fosters confident representations.
To summarize, we have the following contributions:
To the best of our knowledge, make the first attempt to transfer the diffusion model (DM) from the generation task to a detector in the GAD task and propose DM-based Graph Anomaly Detector, namely DiffGAD.
Our DiffGAD enhances the discriminative ability from two aspects: discriminative content-gun -uideed generation paradigm to distill the discriminative content in latent space; and a strategy to enhance the confidence of the guidance process.
Extensive experiments over six real-world and large-scale datasets demonstrate our effectiveness, Theoretical and Empirical computational analysis illustrate our efficiency.
BACKGROUND
In this section, we revisit some background. Specifically, we first introduce the preliminaries of the Graph Anomaly Detection (GAD) task and then describe the diffusion model in latent space.
2.1 TASK FORMULATION
In this work, we focus on unsupervised node-level GAD over static attributed graphs, and each node associated with an anomaly score, where top-ranked nodes (with large scores) always indicated as anomalies. In reconstruction-ben barsed methods, the anomaly score reconstruction error. Meanwhile, the data structure can be formalized as an attribute graph G {V, X, &, A} 9, where V, E, denotes nodes, node attributes, edges, and adjacency matrix, specifically.
2.2 DIFFUSION MODEL IN LATENT SPACE
The Latent Diffusion Model (Latent DM) is composed of a pair of forward and reverse diffusion processes based on the unified formulation of Stochastic Differential Equation (SDE) (Song et al., 2021). Concretely, given latent variable z, the SDE can be formalized as:
dz (zz t)dt g())
where f-) and g(-) are the drift and diffusion functions, respectively, and f()) can also be expressed in the form of f(z,t) ft)zz. Then we define the forward, backward, and training process as:
Given the latent variable z, the forward process transforms z with noises to is the initial point of this process. Specifically, with SDE, the diffusion kernel is denoted as a conditional distribution 2,
Forward Process.
construct a sequence of step-dependent variables {z where
p (z+ 20) -N(ss)) (t)))
(2)
where s(t) and (t) are step-dependent to control the noise level. We follow an efficient design (Karras al., 2022; Zhang et al., 2023a) to simplify the diffusion kernel, where we set s(t) and (t) = in this work. Therefore, the forward process can be formulated as:
2 20 + o (t)e, where / (0.1).
Reverse Process. The reverse process reconstructs the latent variable by predicting and removing the added noises. Specifically, with SDE and our diffusion kernel simplification (Karras et al., 2022), the reverse process can be derived as:
dz -2 (66 (t))
+
(4)
where V- log (z)) is the score function of z, and (1) is the first order derivative of att).
3

---

Published as a conference paper at ICLR 2025
DifiGAD
(1), Training:
Weighted Sum
Forward
Ao
Ze-1
Latent Space
Learned Space
(3). Sampling:
DifIGAD
Reverse
Add ssstep noises
Guidance
Sampled Space
(2). Conditional DM Training:
Subtraction
Encoder
Forward
Decoder
Zo
Ze-
Common Feature
Condition
0 Normals
Anomalies
Figure 2: An overview of DiffGAD, Given a graph, we first encode it into latent space, and we then reconstruct with both unconditioned and conditioned diffusion models distill the discriminative content. Finally, we decode the reconstructed latent embedding for anomaly detection.
Training Process. The training process matches the noises in the forward and reverse processes. which can be achieved by denoising score matching (Song et al., 2021) as:
PDM zo (zerp(za (z0) ||eo (z,,)) e112.
(5)
where En is the neural network. After training, the diffusion model can be applied for further generation by the reverse process with the score function as V Po(): = -c//o c in Eq. 4.
3
METHODOLLOGY
In this section, we illustrate DifGGAD in detail.
3.1 OVERVIEW
Figure overviews our proposed DiffGAD, which functions primarily within the latent space. Upon receiving a graph, our methodology initiates by mapping it into the latent space, as detailed in $3.2. Within this transformed domain, we employ a dual Diffusion Model (DM) approach. The first DM is tasked with encapsulating the general content, elaborated in $3.3, while the second DM targets the extraction of common content, described in $3.4. Herein, the discriminative content is identified by the disparities between these two DM-captured representations. Inspired by (Ho & Salimans, 2022), the concurrent sampling the two DMs can enabled by controlling a simple hyper-parameter. It is worth noting that model's foundation is rooted in well-established hypothesis, supported by works such as (Ding et al., 2019; Fan et al., 2020; Sakurada & Yairi, 2014), which posits that anomalous entities exhibit more complex distributions and are significantly more difficult to reconstruct. Consequently, nodes with higher reconstruction error are more likely to be anomalies. To facilitate this detection mechanism, our framework requires the original samples with their respective reconstructed counterparts, process systematically described in $3.3.
3.2 LATENT SPACE PROJECTION
In this work, we leverage an encoder to map graph features into latent representation space, a pivotal step that precedes the detailed exposition of diffusion models in work. Thus, it is essential first delineate the methodology employed in projecting graph characteristics into this latent space.
More formally, for given graph G, utilize the Graph Autoencoder (AE) framework delineated in (Ding et al., 2019) to facilitate its transformation into the latent space. The architecture of the Graph AE comprises two primary components: encoder, denoted as T. and decoder, denoted
4

---

Published as a conference paper at ICLR 2025
Algorithm 1 The training and inference procedure of DifIGAD.
Input: An attribute graph G (V, X, E,),
Output: The detection scores of each node in G.
1: Train Graph AE {Φ, 4 by Eq. 12.
2: Extract latent embedding 2 by Eq. 6.
3: Initialize common feature co as the mean of z and set Courrent Co.
4: while Training unconditional DM Ea(z,, t) do
5: Update (z t) by Eq. 5,
6: Update common feature Cuext by Eq. 9 and Eq. 10,
7: Set Ceurrent Cnext-
8: end while
9: Set c Cuexts
10: Train conditional DM es (2), by Eq. 13.
11: Add t-step noises to latent embedding = by Eq.
12: Reconstruct the noisy embedding with the modified score in Eq. 11.
13: Decode the reconstructed embedding by Eq. 7.
Calculate detection scores between G and the decoded graph by Eq. 12.
as V The encoder function, +, is designed to process the node feature matrix X RRaxd and the adjacency matrix [R"X", thereby yielding latent feature embedding z, computed as:
A),
(6)
wherein & incorporates Graph Convolutional Network (GCN) (Kipf & Welling, 2017a) as its underlying mechanism for aggregating information from node features into latent embedding z, with Baxk and l representing the dimensionality of the latent space.
Subsequently, the decoder component is tasked with the reconstruction of the node feature matrix and adjacency matrix from the latent embedding z, expressed through the equations:
X A
feat (z, A); sur (=z?)²²))
in which teat and L stru are specifically designed for the prediction of node features and graph structure (edges), respectively. This meticulous elaboration of the latent space projection methodology set the stage for comprehensive understanding of our novel DiffGAD framework.
3.3 GENERAL CONTENT PRESERVATION
Once the latent space is ready, the reconstruction error by DM acts as proxy of the anomaly score associated with individual nodes. To achieve this, pairs of original and reconstructed samples necessary (Gao et al., 2024a). Our general content preservation aims to adapt the DM architecture the reconstruction error-based anomaly detection task. Unlike traditional DMs, which samples random Gaussian noise to generate &g, our approach perturbs original latent embedding 2o by mixing random noises from different scales as the initial points for sampling. Concretely, following the work in Ho et al. (2020), we categorize the noises into 500 different scales, and we add noises at each scale by the following equation:
t +
T T-t
T
20
T
(
where is random noise, and E AO,, 1), this corrupted embedding 2; is then used to generate reconstructed sample &o with the aim of preserving the general content. The benefit of this process are threefolds: (1) It facilitates the computation of reconstruction error by aligning original and reconstructed sample; (2) By modulating t, the extent preserved general content can be controlled; lower t value results in reconstruction that is closer to the original content, thereby retaining more of the general content. (3) As the DM functions without explicit conditioning, inherently associates with the general content, which lays the groundwork for the introduction of discriminative content.
5

---

Published as a conference paper at ICLR 2025
3.4 COMMON FEATURE CONSTRUCTION
In this study, treat divergence of unconditional and conditional DMs the discriminative content of interest. Besides unconditional DM, our approach also necessitates the incorporation of a conditional DM. This subsection dedicated elucidating the conditioning mechanism construction.
Consider the latent embedding 2 = {>")>=>> where each x" E IR* denotes the embedding of the v-th node. We initialize the common feature Cp the mean value over all latent node embeddings, capturing a global perspective of the node distribution and setting a prior for their generative process. This feature acts the conditioning and is not fixed during the training of DM, next we demonstrate the adaptive refinement of this feature in depth.
During the training phase of the unconditional DM, which we represent as e (Zt, t), the conditioning undergoes iterative updates. To illustrate, we identify the common feature conditioning at any training iteration as Courentt The feature update is governed by:
Great Σ Wp 2",
DEV
where Cueat is the updated common feature for the next training iteration, and is the weighting vector to control the update process. We obtain Wy by similarity calculation between the reconstructed node embedding 2" and current common feature Ceurrent. which can be formalized as:
exp(@u//T) where w. = cos (z", Ceurrent)
Wy Σ expp((n/T)
(10)
where т is the temperature parameter to control the smoothness of weights, cos (+:-) denotes the cosine similarity. The update of the common feature involves aggregating the contribution of all nodes, weighted by their respective we values. A larger Wa indicates a more significant contribution of the current 8 to the update process. Notably, nodes that significantly deviate from the current common feature, Ceurrent are assigned with lower weights during the update. The underlying rationale to mitigate the impact of potential anomalies and to derive a comprehensive common feature. Upon completing this iteration, Cuext is designated as the new current common feature Ceurrent for the forthcoming update cycle. Furthermore, we establish the final common feature e which corresponds to Cnext from the last training iteration. This finalized feature remains static during the detection phase. This approach ensures that the common feature reflective of the dataset's core attributes, which leads us to the discriminative content calculation.
3.5 DISCRIMINATIVE CONTENT DISTILLATION
Leveraging the unconditional DM, (z l), and the common feature our approach is able to extract the discriminative content through discriminative content distillation. Specifically, we first train conditional DM EØ( 22, c, t), which aims to learn the common knowledge by reconstructing latent embedding = = {2"}r Jr= with common feature c as conditional information.
Inspired by the idea of classifier-fres guidance (Ho & Salimans, 2022), distill the discriminative content by performing a linear combination of the unconditional and conditional DMs. Differently, unconditional DM co (2,, t) contains both discriminative and common content, and the conditional DM 6 60 c, !) captures the common content, which describes that "what most of the reconstructed nodes focus on". Thus, the discriminative content is achieved by subtracting the general content from the common content learned from the unconditional DM and conditional DM, respectively. Specifically, the modified score can be denoted as:
Eo (zt, t) = (1+X)60 (2,,1) - Xeo (,,, V log Eo (z1, c,t) (o(().
(11)
where À is the hyperparameter to regulate the strength. By utilizing the modified score for the sampling process, we distill the discriminative content into the latent space, and then obtain the discriminative latent embeddings.

---

Published as a conference paper at ICLR 2025
Table 1: The ROC-AUC performance with different components of our method.
Method
Weibo
Reddit
Disney
Books
Enron
Avg
AE
92.0 + 0.1
56.1 0.0
40.3 + 6.7
59.1 2.5
59.1 + 1.6
61.3 2.2
Diff
91.6 + 0.5
55.8 + 0.1
49.1 + 0.3
58.3 + 2.5
57.7 + 1.8
62.5 + 1.0
Cond-Diff
91.4 + 0.5
55.9 + 0.1
49.2 + 0.4
58.8 + 1.8
57.6 + 1.9
62.6 + 0.9
DifGGAD
93.4 +: 0.3
56.3 0.1
54.5 +
1.8
71.6 + 7.0
68.4 1.9
3.6 TRAINING AND INFERENCE
Training Stage. the training stage, given an attribute graph G = (V.X,E,A)) we firstly train the Graph AE by the following objective:
AE = a ||X 1||2 + (1-a) a) -1A AA-
(12)
where ||- ll denotes the L2 norm, and is nyper-parametee to balance the effect of feature and structural reconstruction. Then we train the unconditional DM co (z,,t) by the training objective in Eq. 5, meanwhile, we obtain the common feature Finally, train the conditional DM E9 (Zz, 1) by the following equation:
Coond Ezorp((s) E E Pes ||co (21, c, t) =112
(13)
Inference Stage. In the inference stage, given attribute graph G, we first transform into latent space by well-trained encoder Q. Second, we add t-step noises preserve the general content. Then, we discriminatively sample from both unconditional DM eş (Z,, t) and conditional DM co (zz, c, t) with Eq. 11 as scores. Finally, we transform the reconstructed embedding into graph space by decoder V for reconstruction error calculation.
on the extracted latent embedding to
4 EXPERIMENT
In this section, we conduct experiments to validate the effectiveness of our DiffGAD. Specifically, we first introduce the experimental settings, and next, we analyze the ablation studies, finally, we describe the comparison results with the ttte-of-thheart methods.
4.1 EXPERIMENTAL SETTINGS
Datasets. Following the work in (Liu et al., 2022b) we employ 13 baselines as benchmarks on 6 real-world datasets (Weibo (Zhao al., 2020), Reddit (Kumar et al., 2019; Wang et al., 2021), Disney (Sánchez et al., 2013), Books (Sánchez et al., 2013), Enron (Sánchez et al., 2013)), including large-scale dataset Dgraph (Huang et al., 2022) for evaluation.
Metrics. Following the extensive literature in GAD (Liu et al., 2022b; Ding et al.. 2019; Kipf & Welling, 2016), we compressively evaluate the performance of DifiGAD with the representative ROC- AUC (Receiver Operating Characteristic Area Under Curve), AP (Average Precision), Recall and the AUPRC (Area Under the Precision and Recall Curve) metries.
Comparisons. Following the work in (Liu et al., 2022b), we report the average performance with std results over trials for fair comparison. Moreover, we re-implement current methods for all datasets with (Liu et al., 2022a), and observe large performance gap for the ROC-AUC in Enron, while other datasets are similar (as the official GitHub issue mentioned in )). Therefore, to prevent ambiguity,
the re-implemented ROC-AUC results the Enron dataset and follow the results of other datasets and metrics in (Liu et al., 2022b).
4.2 ABLATION STUDIES
The effects of discriminative content distillation. We conduct experiments over various À in Eq. 11, and the experimental results are shown in Figure 3. Specifically, we list the AUC performance with the conditional DM 6g (Ze, e, t) as X -1.0 (only common content), with the unconditional DM 6g (z,, as À = 0.0 (only general content), and with different values of À ranging from 0.2 to 2.0

---

Published as a conference paper at ICLR 2025
633
51.0
64.0
61.0
90.5
61.5
$9.0
500
59.0
$7.0
49.5
565
$500
49.0
54.0
0.6
U.8
0.2
10
(a) Books
(b) Disney
(c) Enron
Figure 3: The ROC-AUC performance of 3 representative datasets under the different scale of the control of X, where x axis represents the variance of X, and y axis is the ROC-AUC results.
61.0
51.5
9334
58,0
490
926
520
44.0
91.0
50
506
50
150
38
400
450
500
50
100
700
300
350
444
(a) Books
(b) Disney
(c)
Weibo
Figure The ROC-AUC performance of different timesteps over representative datasets, where axis represents different timesteps t, and axis is the ROC-AUC results.
over the Books, Disney, and Enron datasets. From Figure 3, we find that different datasets have distinct sensitivities of X, and the performance on Books and Enron sensitive to the various X. Moreover, we can observe that the best results are achieved with large X (A = 2.0) for all 3 datasets, which not only demonstrates the effectiveness of our discriminative content distillation but also shows that the discriminative content is hard to mine for those datasets.
The influences of general content preservation. We conduct experiments over various timestep I in Sec. 3.3 to preserve general content from different scales, and the experimental results are illustrated in Figure Specifically, we list the AUC performance with timestep varies from 500 over the Books, Disney, and Weibo datasets. The full diffusion timestep is 500, where t = means sampling from large-scale general content, and 500 implies sampling from the noise. Specifically, from Figure 4, we can find that (1) general content from different scales is required for different datasets, where Weibo requires more general content (small t), and less general content is needed for Books and Disney (large !), and (2) compared with sampling from the noises (t 500), our general content preservation improves over all datasets (various (), which demonstrates our effectiveness.
The effects of different components. We conduct 100 experiments with different components such the Autoencoder ("AE"), the unconditional DM ("Diff"") 80 and the conditional DM ("Cond-Diff") the experi- mental results are shown in Table 1, where "DiffGAD" method. Specifically, we can find that: (1) ap- plying the DM over the AE model achieves marginal performance gains ("Diff" "AE"), which demon- strates that simply utilizing DM can't 't tackle the lack of discriminative content issue. (2) the conditional DM and the unconditional DM obtain similar results ("Diff" vs Cond-Diff"), which proves our hypoth- esis, that in the general content, the huge common content prioritizes the discriminative. (3) our method attains significant improvements over different com- ponents ("DifiGAD" vs others), this proves our ef- fectiveness, which could distill the discriminative
LOF
MLPAE
SCAN
RADAR
GONAE
HOMINANT
DONE
ANOMALVDAL
ADOAE
GAAN
CONAD
DIRGAD
ANOM
Figure 5: Average ROC-AUC performance over datasets, where the color represents the average AUC, and the central line is the median (Many methods for Dgraph encounter OOM and TLM restriction, thus Dgraph is omitted).
8

---

Published as a conference paper at ICLR 2025
Table 2: Performance comparison (ROC-AUC) among 13 algorithms on datasets, where we show the avg perf. + the std of perf. of each method. The best results of all methods are indicated in boldface, and the second best results are underlined. OOM refers to out-of-memory with CPU. TLE denotes time limit of 24 hours exceeded. We list the Avg result over 5 datasets, due to the unavailable Dgraph results with OOM and TLE for many methods, we omit Dgraph.
Algorithm
Weibo
Reddit
Disney
Books
Enron
Avg
Dgraph
craph-ggnottic
LOF
56.5 + 0.0
$7.2 0.0
47.9 + 0.0
36.5 + 0.0
46.4
48.9 0.0
TLE
IF
53.5 + 2.8
45.2 15.2-17
57.6 + 2.9
43.0 1.8
40.1 +
47.9 53.8 4.4
0.7 37.0 1.9
60.9
MLPAE
82.1 1: 3.6
50.6 0.0
49.2 + 5.7
42.5 +
44.6.1:
classical algorithms
SCAN
63.7 + 5.6
49.9 0.3
50,5 4.0
49.8 1.8817 1.7
52.8 t 3.4
$3.3 3.0
TLE
Radar
98.9 1 0.1
54,9 14.911 1.2
51.8 1 0.0
52.8 1.0 0.0
54.1 10.1
62.5 + 2.3
OOM
ANOMALOUS
98.9 1 0.1
54,9 + 5.6
51.8 1 0.0
0.0
55.0 1 9.8
62.7 3.1
OOM
deep algorithms
GCNAE
90.8
0.0
7.9
50.0
38.2
4.00
0.5
DOMINANT
85.0
0.2
47.1 4.5
5.01
4.2
5.74
OOM
DONE
4.1
2.9
41.7
4.
6.1
$4.2
OOM
AdONE
84.6
4.5
48.8
2.0
2.9
56,4
0OM
AnomalyDAE
91.5
55.7
4.2
6.12
51.3
62.5
0OM
GAAN
92.5 0.0
5.4
48.0 0.0
5.0
0.2
6.10
0OM
CONAD
85.4 14.3
5..1
48.0
3.5
6.9
4.3
58.7
34.7 1.2
DIIGAD
93.4 1 0.3
56.3 4 0.1
54.5 1 0.2
66.4 1: 1.8
71.6 1: 7.0
68.4 1 1.9
52.4 + 0.0
content and further boost the detection performance. Moreover, we also visualize the reconstructed distribution by different components in Appendix B.
4.3 COMPARISON WITH SOTA METHODS.
In this subsection, we comprehensively compare our method with various state-of-the-art algorithms, ranging from graph-agnostic algorithms LOF (Breunig al., 2000), MLPAE (Sakurada & Yairi, 2014), IF (Liu et al., 2012) 2), and classical algorithms Rador (Li et al., 2017), ANOMAL (Peng et al., 2018), SCAN (Xu et al., 2007), to deep algorithms GAAN (Chen et al., 2020), DOMINANT (Ding et al., 2019), GCNAE (Kipf& & Welling, 2016), DONE (Bandyopadhyay et al., 2020), CONAD (Xu et al., 2022), and the comparison results are reported in Table 2. Moreover, we also show the average of AUC results with standard deviation denoted as "Avg"" in the table, and then present a box chart to show the average AUC results of datasets Figure 5.
Specifically, we draw the following observations: (1) DifiGAD achieves "an outlier node detection method that works universally well on all datasets". obtains top-2 AUC results over all datasets and significantly outperforms current methods with large margin in average AUC with more than 9% average AUC (compared with the second Average AUC results in ANOMALOUS), (2) DiffGAD demonstrates robustness and stability across different datasets, it attains small std results over different datasets. (3) DifGGAD outperforms other deep-based algorithms by a large margin. Specially, the best improvement is for the Enron dataset, compared with the GAAN method, our DiffGAD attains more than 20.7% AUC gains. These achieved performances are significant, and this can be attributed the enhancement of discriminative ability. More detailed analysis is in Appendix C.I.
TIME AND COMPUTATIONAL ANALY SIS
In this study, we analyze the time and computational analysis from theoretical and empirical views.
5.1 THFORETICAL ANALYSIS
(1) Graph AutoEncoder. We analyze the complexity according to (Liu et al., 2022b). Specifically, utilize the Graph convolutional network backbone, whose complexity is linear to the edge numbers. For each layer, the convolution operation is D AD XW, and thus the complexity is (mmh) (Kipf & Welling, 2017b), where AX can be implemented efficiently with sparse-dens matrix multiplication. For O(mdh), m is the number of non non-zeru zero elements in matrix A, is the feature dimensions for the attributed network, and is the number of feature maps of the weight

---

Published as a conference paper at ICLR 2025
Table 3:
Wall-clock running time (s) among Table 4: GPU Memory Consumption (MB) among deep algorithms on five different graph
deep algorithms on five different numbers of epochs, where the experiments are conducted on sizes (nodes), where the experiments are con- the gen gen_lime dataset by BOND (Liu et al., 2022b). ducted on the gen dataset by BOND (Liu et al.,
2022b).
Algorithm
10
100
200
300
400
GCNAE
0.27
2.40
4.46
6.80
10.95
DOMINANT
0.10
0.59
1.35
1.90
2.40
Algorithm
100
500
1000
5000
10000
DONE
0.11
0.75
1.61
2.26
3.18
GCNAE
180
200
200
200
262
AdONE
0.14
1.11
2.55
4.12
5.30
DOMINANT
218
224
240
750
2194
AnomalyDAE
0.11
0.70
1.12
1.71
2.04
DONE
218
226
264
900
2610
GAAN
0.09
0.61
1.17
1.44
1.89
CONAD
1.23
2.40
3.49
4.59
AdONE
220
260
292
904
2592
AnomalyDAE
218
228
262
1032
3756
DIfIGAD (AE a
0.65
1.26
1,91
2.55
GAAN
220
228
270
1032
3358
DifiGAD (AE a==
0.07
0.51
0.97
1.48
1.96
DifIGA
0.03
0.42
0.81
1.21
1.63
CONAD
218
226
246
864
2578
0.45
0.91
1.80
DiiGAD
220
228
246
830
2532
DiffCAD(Sample)
0.17
matrix. Moreover, to capture graph topological content, we devise a link prediction layer to reconstruct the original topological structure, and thus the overall complexity is O(mdH - n²), where H the summation of all feature maps across different layers, and n is the number of nodes.
(2) Latent Diffusion Models. We employ an MIPP as the denoising function by following (Karras et al., 2022; Zhang et al., 2023a). Specifically, during the training phase, a random timestep is sampled for each epoch to train the latent node embeddings. The time complexity of this process is O H²). where denotes the number of training epochs, H' is the number of feature maps for MLP, d' is the input dimension for DM, which also the feature map dimension of AE, since we adopt the output of AE the input of DM. During the inference phase, similarly, the time complexity is (Imd' H'), where / represents the number of sampling timesteps in the denoising process. The combined time complexity of both training and inference phases remains O((e + t)ydd H').
5.2 EMPIRICAL DISCUSSION
Following (Liu et al., 2022b), we employ the Wall-Clock time and GPU memory for empirical comparisons, and the experimental results are listed in Table 3 and Table 4, respectively. The whole testing is conducted on a Linux server with a 2.90GHz Intel(R) Xeon(R) Platinum 8268 CPU, IT RAM, and Nvidia 2080 Ti GPU with 1GGB memory.
We can observe that DifiGAD efficient in terms both time and memory usage. Specifically, benefitting from the advancements in diffusion acceleration, adopt more efficient EDM pler (Karras et al., 2022) within latent space and utilize 50 sampling steps. From Table 4, we can observe that the sampling time of DifGAA is quite short, only 0.17 seconds. Moreover, we also list the Autoencoder with a in Eq. 7, Denoted as DifrGAD (AE a = 1), which omits the topology reconstruction, and reduces AE costs to O(mdH.. We can observe that the running time of AE = and diffusion model are comparable.
Furthermore, as the size of the graph scales to real-world proportions, the overall time complexity of DM simplifies to O(n) as we discuss in 5.1. This indicates that the complexity O(n²) of AutoEncoder dominates the whole complexity, while the time required for diffusion model who adding and removing noise in latent space can be neglected.
CONCLUSION
In this work, we make the first effort to transfer the diffusion model from generation task to a detector and propose diffusion- based unsupervised graph anomaly detector, namely DiffGAD. Specifically, (1) discriminative content- guindd generation paradigm is proposed to capture the discriminative content and then distill it into the latent space, and (2) a content-preservant
strategy is designed to enhance the confidence of the aforementioned guidance process, and (3) extensive experiments on real-world and large-scale datasets with different metrics demonstrate the effectiveness of our method, and (4) comprehensive time and computational analysis demonstrate our efficiency. Limitation and Future Work. The expressiveness of latent embeddings might be limited by graph encoder, we will explore some encoder-free strategies in the future.
10

---

Published as a conference paper at ICLR 2025
7 CODE OF ETHICS AND REPRODUCIBILITY STATEMENT
Code of Ethics. We do not foresee any direct, immediate, or negative societal impacts stemming from the outcomes of our research. Reproducibility Statement. All results presented in this work are fully reproducible. We provide our code using the GitHub link. The optimal hyperparameters are detailed in Appendix D.
ACKNOWLEDGEMENTS
This research is supported by the National Natural Science Foundation of China (922701 14). This research was also supported by the advanced computing resources provided by the Supercomputing Center of the USTC.
REFERENCES
Sambaran Bandyopadhyay, Lokesh N, Saley Vishal Vivek, and M. Narasimha Murty. Outlier resistant unsupervised deep architectures for attributed network embedding. In WSDM, 2020.
Adam Breuer, Roee Eilat, and Udi Weinsberg. Friend or faux: Graph-based early detection of fake accounts on social networks. In WWW, 2020.
Markus M. Breunig, Hans-Peter Kriegel, Raymond T. Ng. and Jörg Sander. LOF: identifying density-based local outliers. In SIGMOD Conference, 2000.
Zhenxing Chen, Bo Liu, Meiqing Wang, Peng Dai, Jun Lv, and Liefeng Bo. Generative adversarial attributed network anomaly detection. In CIKM, 2020.
Prafulla Dhariwal and Alexander Quinn Nichol. Diffusion models beat gans on image synthesis, In NeurIPS, 2021.
Kaize Ding, Jundong Li, Rohit Bhanushali, and Huan Liu. Deep anomaly detection on attributed networks. In SDM, 2019.
Xiangyu Dong, Xingyi Zhang, and Sibo Wang. Rayleigh quotient graph neural networks for graph- level anomaly detection. ICLR, 2024.
Yingtong Dou, Weijian Li, Zhirong Liu, Zhenhua Dong, Jiebo Luo, and Philip S. Yu. Uncovering download fraud activities in mobile app markets. In ASONAM, 2019.
Yingtong Dou, Zhiwei Liu, Li Sun, Yutong Deng, Hao Peng, and Philip S. Yu. Enhancing graph neural network-based fraud detectors against camouflaged fraudsters. In CIKM, 2020.
Haoyi Fan, Fengbin Zhang, and Zuoyong Li. Anomalydae: Dual autoencoder for anomaly detection on attributed networks. In ICASSP. 2020.
Junfeng Fang, Houcheng Jiang, Kun Wang, Yunshan Ma, Xiang Wang, Xiangnan He, and Tat seng Chua. Alphaedit: Null-space constrained knowledge editing for language models. arXiv preprint arXiv:2410.02355. 2024a.
Junfeng Fang, Shuai Zhang, Chang Wu, Zhengyi Yang, Zhiyuan Liu, Sihang Li, Kun Wang, Wenjie Du, and Xiang Wang. Molte: Towards molecular relational modeling in language models. ACL (Findings), 2024b.
Yuan Gao, Xiang Wang, Xiangnan He, Huamin Feng, and Yong-Dong Zhang. Rumor detection with self-supervised learning on texts and social graph. Frontiers Comput. Sci., 17(4):174611, 2023a.
Yuan Gao, Xiang Wang, Xiangnan He, Zhenguang Liu, Huamin Feng, and Yongdong Zhang. Alleviating structural distribution shift in graph anomaly detection. In WSDM, 2023b.
Yuan Gao, Xiang Wang, Xiangnan He, Zhenguang Liu, Huamin Feng, and Yongdong Zhang Addressing heterophily in graph anomaly detection: A perspective of graph spectrum. In wWW. 2023c.
11

---

Published as a conference paper at ICLR 2025
Yuan Gao, Haokun Chen, Xiang Wang, Zhicai Wang, Xue Wang, Jinyang Gao, and Bolin Ding. Diffsformer: A diffusion transformer on stock factor augmentation. CoRR, abs/2402.06656, 2024a.
Yuan Gao, Jinghan Li, Xiang Wang, Xiangnan He, Huamin Feng, and Yongdong Zhang. Revisiting attack-caused structural distribution shift in graph anomaly detection. IEEE TKDE, 36(9))4849- 4861, 2024b.
Nate Gruver, Samuel Stanton, Nathan C. Frey, Tim G. Rudner, Isidro Hötzel, Julien Lafrance- Vanasse, Arvind Rajpal, Kyunghyun Cho, and Andrew Gordon Wilson. Protein design with guided discrete diffusion. In NeurIPS, 2023.
Jiaqi Guan, Xiangxin Zhou, Yuwei Yang, Yu Bao, Jian Peng. Jianzhu Ma, Qiang Liu, Liang Wang, and Quanquan Gu. Decompdiff: Diffusion models with decomposed priors for structure-based drug design. In ICML, 2023.
William L. Hamilton, Zhitao Ying, and Jure Leskovec. Inductive representation learning on large graphs. In NeurIPS, 2017.
Junwei He, Qianqian Xu, Yangbangyan Jiang. Zitai Wang, and Qingming Huang. ADA-GAD:
anomaly-denoised autoencoders for graph anomaly detection. In AAAI, 2024.
Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. CoRR, abs/2207. 2022.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In NeurIPS, 2020.
Han Huang, Leilei Sun, Bowen Du, and Weifeng Lv. Conditional diffusion based on discrete graph structures for molecular graph generation. In AAAI, 2023a.
Lei Huang, Hengtong Zhang, Tingyang Xu, and Ka-Chun Wong. MDM: molecular diffusion model for 3d molecule generation. In AAAI, 2023b.
Xuanwen Huang, Yang Yang, Yang Wang, Chunping Wang, Zhisheng Zhang, Jiarong Xu, Lei Chen, and Michalis Vazirgiannis. Dgraph: large-scale financial dataset for graph anomaly detection. In NewrlPS, 2022.
Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine. Elucidating the design space of diffusion- based generative models. In NewrlPS, 2022.
Diederik P. Kingma and Max Welling. Auto-encoding variational bayes. In ICLR, 2014.
Thomas N. Kipf and Max Welling. Variational graph auto-encoders. CoRR, abs/ lobs//611/ 1.07308, 2016.
Thomas N. Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. In ICLR (Poster), 2017a.
Thomas N. Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. In ICLR 20/7, 2017b.
Bryan Klimt and Yiming Yang. The enron corpus: A new dataset for email classification research. In ECML, 2004.
Srijan Kumar, Xikun Zhang, and Jure Leskovec. Predicting dynamic embedding trajectory in temporal interaction networks. In KDD, 2019.
Jure Leskovec, Lada A. Adamic, and Bernardo A. Huberman. The dynamics of viral marketing. ACM Trans. Web, 1(1):5, 2007.
Jundong Li, Harsh Dani, Xia Hu, and Huan Liu. Radar: Residual analysis for anomaly detection in attributed networks. In IJCAI, 2017.
Xujia Li, Yuan Li, Xueying Mo, Hebing Xiao, Yanyan Shen, and Lei Chen. Diga: Guided diffusion model for graph recovery in anti-money laundering. In KDD, 2023.
12

---

Published as a conference paper at ICLR 2025
Fei Tony Liu, Kai Ming Ting, and Cua Zhou. Isolation- based anomaly detection. ACM Trans. Knowl. Discov. Data, 611):3113339, 2012.
Kay Liu, Yingtong Dou, Yue Zhao, Xueying Ding, Xiyang Hu, Ruitong Zhang, Kaize Ding, Canyu Chen, Hao Peng. Kai Shu, George Chen, Zhihao Jia, and Philip S. Yu. Pygod: python library for graph outlier detection. CoRR, abs/2204. 12095, 2022a.
Kay Liu, Yingtong Dou, Yue Zhao, Xueying Ding, Xiyang Hu, Ruitong Zhang. Kaize Ding, Canyu Chen, Hao Peng, Kai Shu, Lichao Sun, Jundong Li, George H. Chen, Zhihao Jia, and Philip S. Yu. BOND: benchmarking unsupervised outlier node detection on static attributed graphs. In NeurIPS, 2022b.
Kay Liu, Hengrui Zhang, Ziqing Hu, Fangxin Wang, and Philip S. Yu. Data augmentation for supervised graph outlier detection with latent diffusion models. CoRR, abs/2312.17679, 2023.
Zhiwei Liu, Yingtong Dou, Philip S. Yu, Yutong Deng, and Hao Peng. Alleviating the inconsistency problem of applying graph neural network to fraud detection. In SIGIR, 2020.
Jinda Lu, Shuo Wang, Xinyu Zhang, Yanbin Hao, and Xiangnan He. Semantic-bart selection, synthesis, and supervision for few-shot learning. In ACM Multimedia, 2023.
Jinda Lu, Shuo Wang, Yanbin Hao, Haifeng Liu, Xiang Wang, and Meng Wang. Rethinking visual content refinement in low-shot clip adaptation. CoRR, abs/2407.14117 2024.
Jinda Lu, Junkang Wu, Jinghan Li, Xiaojun Jia, Shuo Wang, YiFan Zhang, Junfeng Fang, Xiang Wang, and Xiangnan He. Dama: Data-and model-aware alignment of multi-modal llms. CoRR, abs/2502.01943, 2025.
Wenyu Mao, Shuchang Liu, Haoyang Liu, Haozhe Liu, Xiang Li, and Lantao Hu. Distinguished quantized guidance for diffusion-based sequence recommendation. CoRR, abs/2501.17670, 2025.
Alexander Quinn Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Ilya Sutskever, and Mark Chen. GLIDE: towards photorealistic image generation and editing with text-guided diffusion models. In ICML, 2022.
Zhen Peng, Minnan Luo, Jundong Li, Huan Liu, and Qinghua Zheng. ANOMALOUS: A joint modeling approach for anomaly detection attributed networks. In IJCAI, 2018.
James W Pennebaker, Martha E Francis, and Roger Booth. Linguistic inquiry and word count:
Liwe 2001. Mahway: Lawrence Erlbaum Associates, 71 (12001)):2001, 2001.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. In CVPR, 2022.
Amit Roy, Juan Shu, Olivier Elshocht, Jeroen Smeets, Ruqi Zhang, and Pan Li. Gad-ebm: Graph anomaly detection using energy-based models. In NeurlPS Workshop: New Frontiers in Graph Learning, 2023.
Mayu Sakurada and Takehisa Yairi. Anomaly detection using autoencoders with nonlinear dimen- sionality reduction. In MLSDA @ PRICAI, 2014.
Patricia Iglesias Sánchez, Emmanuel Müller, Fabian Laforet, Fabian Keller, and Klemens Böhm. Statistical selection of congruent subspaces for mining attributed graphs In ICDM, 2013.
Arne Schneuing, Yuanqi Du, Charles Harris, Arian R. Jamasb, Ilia Igashov, Weitao Du Tom Blundell, Pietro Lió, Carla Gomes, Max Welling, Michael M. Bronstein, and Bruno E. Correia. Structure-based drug design with equivariant diffusion models. CoRR, abs/2210. 01.221..1366 13695, 2022.
Jascha Sohl- Dickstein, Eric A. Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. In ICML, 2015.
Yang Song and Stefano Ermon. Generative modeling by estimating gradients of the data distribution. In NewrlPS, 2019.
13

---

Published as a conference paper at ICLR 2025
Yang Song and Stefano Ermon. Improved techniques for training score- generative models. In NeurIPS, 2020.
Yang Song, Jascha Sohl-Dickstein, Diederik P. Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In ICLR, 2021.
Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research, 9(11), 2008.
Petar Velickovic, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Liö, and Yoshua Bengio. Graph attention networks. In ICLR (Poster), 2018.
Daixin Wang, Yuan Qi, Jianbin Lin, Peng Cui, Quanhui Jia, Zhen Wang, Yanming Fang, Quan Yu, Jun Zhou, and Shuang Yang. A semi-supervised graph attentive network for financial fraud detection. In ICDM, 2019.
Yanling Wang, Jing Zhang, Shasha Guo, Hongzhi Yin, Cuiping Li, and Hong Chen. Decoupling representation learning and classification for gnn-based anomaly detection. SIGIR, 2021.
Jinheng Xie, Yuexiang Li, Yawen Huang, Haozhe Liu, Wentian Zhang, Yefeng Zheng, and Mike Zheng Shou. Boxdiff: Text-to-image synthesis with training-free free box-constrained diffusion. In ICCV, 2023.
Tian Xie, Xiang Fu, Octavian-Eugen Ganea, Regina Barzilay, and Tommi S. Jaakkola. Crystal diffusion variational autoencoder for periodic material generation. In ICLR, 2022.
Xiaowei Xu, Nurcan Yuruk, Zhidan Feng, and Thomas Schweiger. SCAN: a structural clustering algorithm for networks. In KDD, 2007.
Zhiming Xu, Xiao Huang, Yue Zhao, Yushun Dong, and Jundong Li. Contrastive attributed network anomaly detection with data augmentation. In PAKDD (2), 2022.
Shu Yin, Peican Zhu, Lianwei Wu, Chao Gao, and Zhen Wang. GAMC: an unsupervised method for fake news detection using graph autoencoder with masking. In AAAI, 2024.
Xu Yuan, Na Zhou, Shuo Yu, Huafei Huang, Zhikui Chen, and Feng Xia. Higher-order structure based anomaly detection on attributed networks. In IEEE BigData, 2021.
Hengrui Zhang. Jiani Zhang, Balasubramaniam Srinivasan, Zhengyuan Shen, Xiao Qin, Christos Faloutsos, Huzefa Rangwala, and George Karypis. Mixed-type tabular data synthesis with score- based diffusion in latent space. CoRR, abs/2310.09655 2023a.
Yangtian Zhang, Zuobai Zhang, Bozitao Zhong, Sanchit Misra, and Jian Tang. Diffpack: A torsional diffuuion model for autoregressive protein side-chain packing. In NewrIPS, 2023b.
Yuchen Zhang, Xiaoxiao Ma, Jia Wu, Jian Yang, and Hao Fan. Heterogeneous subgraph transformer for fake news detection. In WWW, 2024.
Tong Zhao, Chuchen Deng, Kaifeng Yu, Tianwen Jiang, Daheng Wang, and Meng Jiang. Error- bounded graph anomaly loss for gnns. In CIKM, 2020.
Xiangping Zheng. Bo Wu, Xun Liang, and Wei Li. Friend or foe? mining suspicious behavior via graph capsule infomax detector against fraudsters. In WWW, 2024.
Wei Zhuo, Zemin Liu, Bryan Hooi, Bingsheng He, Guang Tan, Rizal Fathony, and Jia Chen. Partitioning message passing for graph fraud detection. In ICLR, 2024.
14

---

Published as a conference paper at ICLR 2025
A RELATED WORKS
In this section, we introduce notable prior works on graph anomaly detection, list the related diffusion model-based methods, and enumerate the differences between DifIGAD and related methods.
Graph Anomaly Detection (GAD) aims to detect abnormal targets from huge number of normal samples. In the semi-supervised branch, Graph Neural Networks (GNNs) (Wang et al., 2019; He et al., 2024; Zhang et al., 2024) have achieved remarkable success in detecting graph anomalies across various domains for its excellent representation capabilities for modeling complex relationships. Specially, CapsGI (Zheng et al.. 2024) combines capsules with self-supervised learning (SSL) to overcome the inconsistency of anomaly detection on graphs. PMP (Zhuo et al., 2024) introduces Partitioning Message Passing to adaptively adjust the information aggregated from its heterophilic and homophilic neighbors. RQGNN (Dong et al., 2024) proves that the accumulated spectral energy of the graph signal can be represented by its Rayleigh Quotient, and proposes Rayleigh Quotient GNN for graph-level anomaly detection.
To tackle the issue of limited labeled data, recent methods (Fan et al., 2020; Yuan et al., 2021; Xu et al., 2022) propose unsupervised approaches over the large-scale unlabeled data, where the anomaly score is calculated the reconstruction error. For example, the representative work in (Ding et al., 2019) uses GCN (Kipf & Welling, 201 and AE (Kingma & Welling, 2014) to encode the graph into a nigh-ddmeesiionl latent space, decodes the structure and attributes separately using the decoder, and then utilizes the weighted reconstruction error of node feature and structure as the anomaly score.
Diffusion Models (DMs) have garnered widespread attention for their remarkable advances in generating high-quality images and videos. Fueled by the explosion of deep learning (Lu et al., 2025; Fang et al., 2024a; Lu et al.. 2023; 2024), representative models like DDPM (Ho et al., 2020; Sohl- Dickstein et al., 2015). SMG (Song & Ermon, 2019; 2020), and SDE (Song et al., 2021) have been widely adapted various domains (Xie et al., 2023; Mao et al., 2025). For instance, within the scope of GNNs, researchers explore to employ DMs to enhance molecular graph modeling (Huang et al., 2023b;a), protein design (Zhang et al., 2023b; Gruver et al., 2023), drug discovery (Guan et al., 2023; Schneuing et al., 2022), material design (Xie et al., 2022), etc, and achieve significant improvement. There also has been an exploration in GAD, Diga (Li et al., 2023) proposes a semi sumi-supe DM to detect money laundering, where the DM is guided by labeled anomalies for subgraph recovery. GODM (Liu et al., 2023) introduces a and--ay package to adopt a variational encoder and diffusion model to generate effective negative samples solve the class imbalance.
Compared with GODM (Liu et al., 2023), which aims to utilize the powerful generative ability of DMs to generate sufficient negative samples to enhance the performance of current GAD methods, directly employ DMs to detect the abnormal targets as an end-to-end model with careful designation.
B VISUALIZATION
In this section, we visualize the distribution of the reconstructed representations by using t- SNE (Van der Maaten & Hinton, 2008). For fair demonstration, we select the smaller-scale Books and the larger-scale Weibo dataset and illustrate the results in Figure and Figure 7, respectively. Moreover, for clearer demonstration, we refine the visualization of Books in Figure
Specifically, we visualize the t-SNE results of the reconstructed general, common, and discriminative content with small timestep (t=100) and large timestep (t=400). Additionally, we compare these outcomes against the leamed representations derived from the SOTA reconstruction-base method, DOMINANT, and can draw several observations:
(1) Current reconstruction-baseee methods tend to produce highly condensed clusters of learned representations, thereby constraining the discriminative information inherent between distinct nodes. While DM significantly enhances the ability to capture the distribution patterns of samples.
(2) Compared to the general content, the common content emphasizes the shared attributes across disparate samples, leading to clustering effect. Conversely, discriminative content mines the differences, making a more discernible distribution of samples.
(3) Discriminative Content exhibits superior performance in identifying anomalous samples, with them distributed at the boundary of the data distributions. This contrasts with the more even distribution of other content categories.
15

---

Published as a conference paper at ICLR 2025
Small (t= 100)
G General Content
C Common Content
Discriminative Content
Large 400)
Graph Auto Encoder
Normal Nodes
A bnormal Nodes
G General Content
Common Content
Discriminative Content.
Figure 6: Visualization results of the learned representations by (1) reconstruct-hased method (e-g- Dominant), and (2) different components of DifiGAD on the Books dataset. Variances of points in Graph Auto Encoder: [6. (6.066866e-22. 335-313 very close
Small (t = 100)
General Content
Common Content
Discr Discriminative Content
Large (t 400)
Graph Auto Encoder
Normal Nodes
Anormaa Nodes
Leneral Content
Common Content
Discriminative Content
Figure 7: Visualization results of the latent space constructed by (1) reconstruct-based method (e.g. Dominant), and (2) different components DiffGAD on the Weibo dataset.
C MORE EXPERIMENTAL DETAILS
C. DETAILED EXPERIMENTAL ANALYSIS
In this subsection, analyze the experimental results of our DifIGAD over the datasets where achieve sub-optimal performance.
Weibo. The success of most methods on Weibo is because the outliers in Weibo exhibit the properties of both structural and contextual outliers. Specifically, in Weibo, the average clustering coefficient of the outliers is higher than that of inliers (0.400 vs. 0.301), meaning that these outliers correspond to structural outliers. Meanwhile, the average neighbor feature similarity of the outliers is far lower than that of inliers (0.004 0.993), the outliers also correspond contextual outliers.
16

---

Published as a conference paper at ICLR 2025
General Content
Common Content
Discriminative Content
(a)
(b)
(c)
(e)
Figure 8: Visualization results of the learned representations by different components of DiffGAD on the Books dataset, for clear illustration, we construct the boundary by connecting neighbors and highlight the abnormal samples. Where (a), (b), (c) are with small (t=100), and (d), (c). (f) are with large (t=400), please zoom for clearer observation.
The two classical algorithms Radar and ANOMALOUS employ graph-based features to extract the anomalous signals from graphs to more flexibly encode graph information to spot outlier nodes, which helps them perform best Weibo. As they constraint graph/node types prior knowledge, they can not generalize well on other datasets.
Reddit & Dgraph. In contrast, the outliers in the Reddit and DGraph datasets have similar average neighbor feature similarities and clustering coefficients for outliers and inliers. Therefore, their abnormalities rely more outlier annotations with domain knowledge.
Non-graph algorithm LOF (Local Outlier Factor) identifies local outliers based on density while IF (Isolation Forest) builds an ensemble of base trees to isolate the data points and defines the decision boundary as the closeness of an individual instance to the root of the tree. Both of them solely use node attributes thus avoiding the influence of structures.
Disney. DiffGAD and most of the deep algorithms do not work particularly well on Disney compared classical baselines. The reason is that Disney has small graphs in terms of 'Nodes'. 'Edges' and 'Features" (See Table 5 ). The small amount of data could make it difficult for the deep learning methods to encode inlier distribution well and could also possibly lead to overfitting issues.
C.2 DETAILED DATASET DESCRIPTIONS
The detailed statistics of the datasets shown in Table 5.
Weibo (Zhao et al., 2020): Weibo describes the relationship between users, posts, and hashtags on the social platform Tencen Weibo, where the hashtags serve as the edges, the post's information and the text's s bag-of-wort word vectors make up for the node features. Temporal information is used to label data and the users suspicious if they post frequently bots.
17

---

Published as a conference paper at ICLR 2025
Table 5: The statistics of datasets.
Dataset
#Nodes
#Edges
#Features
Avg.eegree
Ratio
Weibo
8405
407963
400
48.5
10.3%
Reddit
10984
168016
64
15.3
3.3%
Disney 124
335
28
2.7
4.8%
Books
1418
3695
21
2.6
2.0%
Enron
13533
176987
18
13.1
0.4%
Dgraph
3700550
4300999
17
1.2
0.4%
Reddit (Kumar et al., 2019; Wang et al., 2021): Reddit consists of user posts on subreddits feature vector represent the LIWC
within one month, and the text of each post transferred categories (Pennebaker et al., 2001). The features of users and subreddits are derived by summing the features of respective posts, where the banned users on the platform are considered be anomalous.
Disney and Books (Sánchez et al., 2013): Disney and Books are co-purchase networks of movies and books from Amazon co-purchase networks respectively (Leskovec al., 2007). Whose node features both include prices, ratings, number of reviews, etc. The ground truth labels of Disney are manually annotated according to the majority vote of high school students and those of Books are derived from amazonfail tag information.
Enron (Sánchez et al., 2013): Enron denotes the email network extracted from (Klimt & Yang, 2004), where the email addresses having spam messages regarded anomalies. The nodes are composed of emails, whose features describe the average number of recipients, the time range between two emails, and
Dgraph (Huang et al., 2022): Dgraph is large-scale attributed graph with 3M nodes, 4M dynamic edges, and 1M ground-truth nodes. A node represents financial user, and edge from to another means that the user regards the other user as the emergency contact person. Users who exhibit least one fraud activity, such as not repaying the loans long time after the due date and ignoring the platform's 's repeated reminders, are defined as anomalies/fraudsters.
C.3 MORE EXPERIMENTAL COMPARISONS
In this subsection, we show more experimental metrics, including Average Precision (AP), Recall@k k and Area Under the Precision and Recall Curve (AUPRC), and the experimental results listed in Table 6, 7, and 8, respectively. Specifically, we can observe that our DifTGAD achieves favorable performances with small std results around all benchmarks, which demonstrates our effectiveness.
C.4 MORE ABLATION RESULTS
In this subsection, we provide more ablation results validate our method. Specifically, we empir- ically explore the validity of the generated common feature Crents and show the distance between Crext with the reconstructed Abnormal and Normal features statistically, the L2 distances are shown in Table 9, and the Standardized cosine distances are depicted in Table 10. We can observe that Cnezt more similar to the normal samples from both results, which shows that normal samples contain more common attributes.
Furthermore, we show more experimental results with different Figure 9. We can observe that both the Reddit and Weibo datasets are not sensitive with different À (A < 2), but the performance of both datasets drops with À = 2, borrowing from the classifier-free guidance (Ho & Salimans, 2022), we believe that À serves trading factor, where Reddit needs discriminative content from X 0.8. and À = 1.0 works better for Weibo.
Moreover, also supplement more experimental results with different timestep in Figure 10. We can observe that Reddit is not sensitive to different (values from the axis), and small-scale general content works better for the Enron dataset.
18

---

Published as a conference paper at ICLR 2025
Table 6: Performance comparison (Average Precision, AP) among algorithms datasets, where we show the avg perf. + the sid of perf. of each method. The best results of all methods are indicated in boldface, and the second best results are underlined. OOM refers to mut-of-memory with CPU. TLE denotes time limit of 24 hours exceeded.
Algorithm
Weibo
Reddit
Disney
Books
Enron
Dgraph
graph-agnostic
LOF
15.8 0.0
4.2 = 0.0
5.2 = 0.0
1,5 + 0.0
0.0 + 0.0
TLE 0.9 + 0.0
IF
12.9 2.6
0.1
10.1 + 4.5
0.2
0.0
MLPAE
52.8 = 9.9
3.4 0.0
5,9 = 0.8
1.8 + 0.3
0.1 = 0.0
classical algorithms
SCAN
17.3 3.4
0.0
5.0 0.3
0.1
0.0
TLE
Radar
0.7
0.2
7.2 - 0.0
2.2
22+000 0.0
OOM
ANOMALOUS
92.1 0.7
4.0 = 0.6
7.2 = 0.0
2.2 0.0
0.2 0.0
OOM
deep algorithms
GCNAE
70.8 5.0
3 0.0
4.8 0.7
2.1 + 0.4
0.1 + 0.0
1.0 + 0.0
DOMINANT
3.7
5.6
2.2
0.1
OOM
DONE
6
3.7
0.7
1.8
0.3
0.0
OOM
AdONE
6.5
0.4
6.1
0.3
0.1
OOM
AnomalyDAE
22.5
3.1
5.2
3.5
1.4
0.1
OOM
GAAN
80.3 = 0.2
0.1
5.6
2.6 + 0.8
0.1
0OM
CONAD
15.6 6.9
3.7 0.3
6.0 1.4
2.5 0.8
0.1
0.9 0.0
DiffGAD
80.9 1.7
3.8 = 0.0
6.2 = 0.0
8.1 + 2.8 1.7 4.7
57.5 + 0.0
Table 7: Performance comparison (Recallkk%) among 13 algorithms on datasets, where we show the avg perf. + the sid of perf. of each method. The best results of all methods are indicated in boldface, and the second best results are underlined. OOM refers to out-of-memory with CPU. TLE denotes time limit of 24 hours exceeded.
Algorithm
Weibo
Reddit
Disney
Books
Enron
Dgraph
graph-agnostic
LOF
22.0 + 0.0
4.4 + 0.0
0.0 0.0
0.0 + 0.0
0.0 0.0
TLE
13.8 6.4
0.1 0.1
9.2 8.3
1.1 + 1.6
0.0 : 0.0
0.1 + 0.1 0.5 + 0.1
MLPAE
48.9 = 11.0
3.0 1 0.0
0.0 + 0.0
0.9 + 1.6
0.0 + 0.0
classical algorithms
SCAN
23.8 7.0
2.7 0.3
7.5 11.2
0.7 + 1.4
0.0
TLE
Radar
86.4
0.8
2.1 0.8
0.0 0.0
0.0 1:000 0.0
0.0:0.0 0.0
OOM
ANOMALOUS
86.4 0.8
4.0 +
1.9
0.0 + 0.0
0.0 + 0.0
0.0 0.0
OOM
deep algorithms
GCNAE
67.6 - 5.2
3.0
0.0
0.7 1.8
0.0
0.4 0.0
DOMINANT
19.7 : 13.8
0.4
3.7
1.6
0.0
OOM
DONE
1.6
0.0
1.1
0.0
00M
AdONE
7.6
1.0
1.7
1.7
0.0
0OM
AnomalyDAE
4
0.9 0.5
0.0
2.7 2.2
0.0
00M
GAAN
77.1 7.11002
1.1
1.1
0.4
0.0
1.8
18 1.8
0.0
00M
CONAD
20.3 13.3
1.3
1.6
0.8
1.7
2.9
0.0 10+00.0 0.0
0.4 0.I
DifGGAD
77.1 0.5
0.0
13.8 + 2.9
3.0 + 7.3
57.3 + 0.0
C.5 ADAPTATION WITH DIFFERENT BACKBONES.
In this subsection, evaluate the adaptation ability of DifIGAD with different backbones, Specifi- cally, we utilize different encoder & decoder architectures, including VGAE, MLP, VAE, Graph Transformer, and evaluate the ROC-AUC result. The experimental results the backbones are listed in Table I, and results on DiffGAD with different backbones are shown in Table 12. From the experimental results, draw following observations:
19

---

Published as a conference paper at ICLR 2025
Table 8: Performance comparison (Area under Precision Recall Curve, AUPRC) among deep learning based algorithms on 5 datasets, where we show the avg perf. + the std of perf. of each method. The best results of all methods are indicated boldface, and the second best results are underlined.
Algorithm
Weibo
Reddit
Disney
Books
Enron
GCNAE
76.5 + 6.9
3.4 0.0
4.0 + 0.5
1,9 + 0.2
0.0 0.0
DOMINANT
3.0
6.0 + 0.7
1.6 0.1
0.100.0
DONE
64.9 1.9
3.0
3.7
1.5
0.0
AdONE
67.7 0.9
3.0
4.0
0.0
0.1
AnomalyDAE
72.2 +: 10.8
3.7
4.8
11.6 + 17.2
0.1
CONAD
61.0 + 27.4
3.0
3.7
2.2 = 0.5
0.1
DITGAD
80.9 = 1.7
3.7
5.0
7.8 = 2.3
1.4
Table L2 distance (L) Cnezt to the reconstructed abnormal and normal samples, respectively, The distance is calculated the mean of all timesteps.
L2 Dis ())
Weibo
Reddit
Disney
Books
Enron
Abnormal
295.16 18.05
0.4223
2611.96
0.9888
0.0718
Normal
0.4209
2372.6
0.9886
0.0704
1. GAE and DifIGAD(GAE) consistently exhibit superior performance compared to different encoder decoder architectures across different datasets terms of ROC-AUC. Such results underscore the robustness of GAE and the generalization ability of DifGGAD.
Without encoding graph structure, the DifIGAD(MLP) achieves notable results the Enron dataset, this indicates that the graph structure can lead to a loss of discriminative information, as MLPs rely solely on node features as input.
3.
The different performance of GAE, VAE, and VGAE reflects the impact different encoder and decoder architectures. However, the architecture of Graph Transformer may be somewhat excessive for this task, as it exhibits a relatively high complexity, but without demonstrating any performance improvement.
To sum up: find that (1) DinGAD achieves robust performance gains over different architectures, which demonstrates its adaptation ability, and (2) simple architecture (i.e. GAE) is enough for latent space construction over current datasets, which preserves sufficient discriminative information, and further works with this latent space can boost the detection performance.
C.6 CHOICES ABOUT A.
In this subsection, we describe the selection of the key hyper-parameter X. Specifically, we statistic the heterophily of the Abnormal samples over different dataset, and the results listed in Table 13. We observe that on the datasct with larger anomaly heterophily, such as Enron, Disney, and Books, larger À works well, while the dataset with smaller anomaly heterophily, like Weibo and Reddit, smaller works well. To summarize, we draw the following conclusion:
1. Larger À works better on the datasets where anomaly samples has larger heterophily, and we recommend using larger than I on such data. Larger heterophily for anomaly samples means they are hidden within normal samples, and thus they are harder to detect.
2. Smaller works well the datasets where anomaly samples has smaller heterophily, and recommend using À smaller than on such data. Smaller heterophily for anomaly samples means they clustered together, and thus they easier to detect.
20

---

Published as a conference paper at ICLR 2025
Table 10: Standardized Cosine distance (1) of Cnent to the reconstructed abnormal and normal samples, respectively. The distance is calculated as the mean of all timesteps.
Cos Dis (1)
Weibo
Reddit
Disney
Books
Enron
Abnormal
0.1828
0.4947
0.3424
0.5006
0.4987
Normal
0.4347
0.4949
0.4214
0.5008
0.4998
$7.0
92.
56.0
91.7
55,0
91.4
54.0
91.1
53.0
90.8
2.0
(a) Reddit
(b) Weibo
Figure 9: The ROC-AUC performance of another datasets under the different scale of the control of X, where axis represents the variance of X, and y axis is the ROC-AUC results.
C.7 DETAILED BASELINE DESCRIPTION
LOF (Breunig et al., 2000): Local Outlier Factor (LOF) calculates the extent which the node anomalous according to how isolated it is compared to its neighborhood. It is worth noting that LOF only uses node features, and the neighborhood is chosen by eenearest-niightee (KNN).
IF (Liu et al., 2012): Isolation Forest (IF) is well-established tree ensemble technique employed in anomaly detection, where it constructs an ensemble base trees to isolate data points. The decision boundary is established based on the proximity of individual instances to the root of each tree. IF only utilizes the node features of the data.
MLPAE (Sakurada & Yairi, 2014): MLPAE utilizes the Multilayer Perceptron (MLP) both the encoder and decoder to reconstruct node features. Specifically, the encoder processes the node features to learn their low-dimensional embedding, and the decoder reconstructs the input node features from these embedding, employing the reconstruction loss of the node features as the anomaly score for each node.
SCAN (Xu et al., 2007) The Structural Clustering Algorithm for Networks (SCAN) is a method designed to detect clusters, hub nodes, and outlier nodes in graph using only the graph's structural information. SCAN identifies structural anomalies by detecting clusters and considering the nodes within these clusters as potential outliers. Since structural outliers exhibit distinct clustering patterns, SCAN is particularly effective for this purpose.
Radar (Li et al., 2017): Radar is an anomaly detection framework for attributed graphs that utilizes both graph structure and node features as inputs. It identifies outlier nodes whose behaviors deviate significantly from the majority terms of the residuals of feature information and coherence with network structure. The anomaly score is determined by the norm of reconstruction residuals.
ANOMALOUS (Peng et al., 2018): ANOMALOUS performs both anomaly detection and attribute selection attributed graphs using CUR decomposition and residual analysis. Similar to Radar, the anomaly score is also determined by the norm of reconstruction residuals.
GCNAE (Kipf& & Welling, 2016): GCNAE is an AE framework that employs GCN as both the encoder and decoder. The encoder takes graph structure and node features as inputs to aggregate information from node's 's neighbors learn its latent representation and the decoder uses the GCN to reconstruct the node features and graph structure from the embedding. The anomaly score for each node is determined by the reconstruction error of the decoder.
21

---

Published as a conference paper at ICLR 2025
63.0
563
59.0
559
57.0
55.7
550
585
40
100
08
200
ost
150
500
50
100
190
100
130
100
350
400
450
500
(a)
Enron
(h) Reddit
Figure 10: The ROC-AUC performance of different timesteps over another 2 representative datasets, where r axis represents different timesteps t, and y axis is the ROC-AUC results.
Table 11: ROC-AUC result different encoder-encoder architectures on datasets, where we show the avg perf. + the std of perf. of each method. The best results of all methods are indicated in boldface.
Backbone
Weibo
Reddit
Disney
Books
Enron
Avg.
MLP
85.5 i 0.3
50.6 + 0.0
48.1
5.9
41.3 14.1
55.0 +
VAE
84,4 0.2
50.6
48.0 + 0.1
50.5 5.4
42,9
+ 8.2
55.3 + 2.8
VGAE
92.5 = 0.0
55.8 0.1
47.8 3.
4.2
56.8 0.7
60.3 + 1.7
GTrans
0.4
56.1
31.0
32.5 12.3
12.3
55.5
1 0.6
53.2 +
GAE
9.1
56.1 + 0.0
40.3
6.7
59.1 4
59.1 + 1.6
61.3 + 2.2
DOMINANT (Ding et al., 2019): DOMINANT is pioneering work that leverages GCN and AE for anomaly detection. It follows encoder-decoder architecture with two-layer GCN. The node feature decoder is also a two-layer GCN, while the graph structure is decoded by a one-layer GCN and dot product. The anomaly score of each node determined by the weighted sum of two decoders.
DONE (Bandyopadhyay et al., 2020): DONE leverages an MLP-based encoder-decoder architecture reconstruct both the adjacency matrix and node features. employs separate AEs for structural and feature information. The optimization of node embeddings and anomaly scores is performed simultaneously using a unified loss function.
AdONE (Bandyopadhyay et al., 2020): AdONE is extension of DONE, incorporating an additional discriminator to differentiate between the learned structural and feature embedding of node. This adversarial training strategy aims to achieve better alignment of two distinct embeddings within the latent space.
AnomalyDAE (Fan et al., 2020): Anomaly DAE employs both structural AE and attribute AE to detect outlier nodes. The encoder encodes adjacency matrix and node features respectively to obtain two embeddings, while the attribute decoder reconstructs the node features using both structural and attribute embeddings.
GAAN (Chen et al., 2020): GAAN is GAN-based method for outlier node detection utilizing MLP-based generator to create fake graphs and an MLP-based encoder to encode graph information. discriminator is then trained distinguish between real and fake graphs. The anomaly score is determined by combining the node reconstruction error and the confidence in identifying real nodes.
CONAD (Xu et al., 2022): CONAD leverages graph augmentation and cognitive learning techniques to detect outlier nodes. It generates augmented graphs to impose prior knowledge of anomalies. The graph encoder is optimized through a contrastive learning loss. Similar DOMINANT, the outlier score is determined by the weighted sum of two different decoders.
D IMPLEMENTATION DETAILS
Environment. The key libraries and their versions used in the experiment are as follows: Python=3.11. CUDA_ version=11 1.8, torch=2.0.1. 1roorh__eometrii-2..000 pygod=0.4.0, numpy=1.25.0
22

---

Published as a conference paper at ICLR 2025
Table 12: ROC-AUC result of DiftGAD with different encoder-encoder architectures on 5 datasets, where we show the avg perf. + the std of perf. of each method. The best results of all methods are indicated in boldface.
Method
Weibo
Reddit
Disney
Books
Enron
Avg.
90.0 + 1.1
50.6 + 0.0
49.1 + 0.2
50.0 + 0.0
81.9 5.2
64.3 + 1.3
DifiGAD( VAE)
5.0
48.5 0.2
67.1 2.9
66.0 + 1.8
64.5 : 1.1
DifGGAD(VGAE)
5.00 9.0
52.1
51.0
57.8 0.2
61.9 01.9:00.
DiGGGAD(TTranS)
56.2 9.70++0.7
0.6
+1.5
65.7 4.9
63.6 1.4
DifEGAD(GAE)
93.4 + 0.3
56.3 - 0.1
54.5
66.4
71.6 7.0
68.4 1.9
Table 13: The homophily and heterophily of anomalies on 5 datasets.
Weibo
Reddit
Disney
Books
Enron
Homophily 0.87
0.18
0.01
0.00
1.00
Heterophily
0.13
0.82
0.99
1.00
0.00
Hardware configuration. All the experiments were performed on Linux server with a 3.00GHz Intel Xcon Gold 6248R CPU,IT RAM, and NVIDIA A40 GPU with 45GB memory.
Model Architectures. The architectural details of DifiGAD are listed here for casier reproduction. The Graph AE, which is optimized by Adam, uses a two-layer GCN as the encoder and two-layer GCN decoder to reconstruct the node attribute. The structural decoder utilizes one-layer GCN and dot product to reconstruct the graph adjacency matrix. As for the DM, the denoising function is multi-layer MLP with SiLU activations. More details can be found in code.
Hyper-parameters. The hyper-parameters are listed in Table 14, our unconditional DM and condi- tional DM share the same parameters.
Table 14: Hyper-parameter for different datasets.
Hyper-paramter
Type
Weibo
Reddit
Disney
Books
Enron
Dgraph
Batch size
AE
FULL BATCH
8192
Epochs
AE
300
Early stop
AE
No
Dropout
AE
0.3
0.3
0.3
0.1
0.1
0.3
Learning Rate
AE
0.01
0.05
0.01
0.1
0.01
0.1
AE
0.8
0.8
0.5
0.0
1.0
dimension
AE
128
32
8
8
8
Batch size
DM
FULL BATCH
8192
Epochs
DM
800
Early stop
DM
Yes
Learning Rate
DM
0.005
dimension
DM
256
64
16
16
16
16
DM
1.0
0.8
2.0
2.0
2.0
1.0
23


Reviews:
[{"review_id": "l9qlypBU2P", "reviewer": "Reviewer_pSKo", "summary": "The paper proposes a Diffusion-based Graph Anomaly Detector for unsupervised identifying abnormal entities in networks. The contributions can be summarized as follows: 1: The author made the first attempt to transfer the diffusion models to the graph anomaly diffusion tasks. The model consists of an auto-encoder framework and two diffusion models to conduct unconditional diffusion and conditional diffusion. 2: To guide the training of diffusion models in latent space, the authors propose to use a discriminative content-guided generation paradigm to distill the discriminative content in latent space; and a content-preservation strategy to enhance the confidence of the guidance process. 3: The authors conduct experiments on 7 real-world datasets and make comparisons with 13 baseline methods.", "questions": "- Why did you choose to use GAE as the encoder and decoder instead of considering other models, such as VGAE, graph transformers, etc.? Is it possible to use these models as the encoder and decoder?\n- What are the conditions that a good latent space should satisfy? Or, what constitutes a good latent space for performing the diffusion process to conduct anomaly detection tasks?\n- Regarding the training process, it looks like you first train a satisfactory encoder and decoder, then fix the parameters, and train the diffusion models. Why did you not choose to construct a global loss and train the GAE and diffusion models together?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The first attempt to transfer the generative diffusion models to the GAD task is a great try, bringing new perspectives to the anomaly detection community.\n- The idea of distilling the discriminative content based on a linear combination of the two different diffusion models is interesting and easy to follow.", "weaknesses": "- Some parts of the paper need further explanation. For example, in the introduction, the authors mention that some researchers utilize encoders to map graph data into a latent space, but there is a lack of essential discussion about why they are doing that.\n- The motivation behind some of the model designs is ambiguous. For instance, in the selection of the encoder and decoder, the conditions that a good encoder and decoder should satisfy are unclear. Instead of directly utilizing the GAE framework, it seems more important to discuss the criteria for selecting a good encoder and decoder and add related experiments to support your claims. I did not see any discussions related to that.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "mjaVDno774", "reviewer": "Reviewer_fVC2", "summary": "The paper introduces DiffGAD, a diffusion based model designed for graph anomaly detection (GAD). It employs a latent space learning paradigm and incorporates discriminative content to enhance profiency. The authors present experimental results on six large real world datasets to demonstrate model performance. Code is made available as well.", "questions": "1. Did the authors explore any alternatives to the currently used AE?\n2. Follow-up: a less comlex alternative could give an efficiency boost at some performance cost. Would be interesting to see. (not required for acceptance)\n3. Are there any particular type of datasets that are more \"conducive\" to DiffGAD than others?", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The use of diffusion models for GAD is an innovative application\n2. A generous number of meaningful datasets are used for experimentation\n3. The figures used in the paper manage to illustrate the problem and approach well.", "weaknesses": "1. A specific graph autoencoder (AE) is used by the model. This may limit the adaptability of the model. (See Q1)\n2. Hyperparameters like λ affect the performance of DiffGAD. If this turns in to an \"art\" to get the best performance, then it may be problematic for real world scenarios. Clarification from the authors about some guidelines to selecting λ could be helpful.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Sa23NEgY1a", "reviewer": "Reviewer_wf4Y", "summary": "This article presents DiffGAD, a new method based on Diffusion Models (DM), for dealing with the problem of anomaly detection in graph data. A research framework based on Diffusion Models is constructed, which encodes the graph data into the latent space via an encoder, then adds noise to preserve the general content and samples from unconditional and conditional diffusion models, and finally transforms the reconstructed embedding back into the graph space via a decoder to compute the reconstruction error. Finally, through experiments on multiple real-world datasets, the authors conclude the effectiveness of DiffGAD on graph anomaly detection tasks.", "questions": "1、How do the two DMs achieve concurrent sampling without adding extra parameters?\n2. In 3.3, the minimum perturbation is used to change the potential embedding z0 to zt. How is this “minimum perturbation” defined and quantified?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1、The method combines graph neural networks (GNNs) with diffusion models, an innovative fusion of techniques that takes advantage of both the strengths of GNNs in graph structural analysis and the sophistication of diffusion models in generative modeling.\n2、 DiffGAD uses both conditional and unconditional diffusion models to reconstruct the graph, and this combination improves the model's sensitivity and ability to recognize anomalies.", "weaknesses": "1、the experimental part of the dataset settings, the dataset selected in this paper are relatively small feature dimensions, have you considered the use of high-dimensional features of the dataset for the experiment?\n2、Comparison methods on although there are based on deep learning, but the latest is 2022, it is recommended to increase the comparison experiments, and the current advanced methods in the field, to show the advantages of the project method.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "yy382GQRft", "reviewer": "Reviewer_2tPm", "summary": "This paper proposes DiffGAD, an unsupervised graph anomaly detector based on diffusion models, designed to address the limited capability of capturing discriminative content in graph anomaly detection.\n\nThe main contributions include:\n\nPioneering the application of diffusion models in graph anomaly detection by adapting them from generative tasks, presenting DiffGAD to enhance the model's discriminative ability.\nProposing a generative paradigm guided by discriminative content to extract and refine discriminative features into the latent space, and designing a content preservation strategy to improve the reliability of the guidance process.\nDemonstrating the effectiveness of DiffGAD through extensive experiments on 6 real-world datasets and 13 baseline methods.", "questions": "The paper mentions that graph encoders (such as GCN in Graph AE) might limit the model’s ability to represent complex graph structures and relationships, but it does not detail how this limitation manifests in practical applications or to what extent it impacts DiffGAD’s performance. For instance, when processing graphs with highly heterogeneous node attributes or complex topologies (e.g., multi-layer nested structures, frequently dynamic graphs), would the current encoder lead to critical information loss? How does this information loss impact the accurate extraction of discriminative content and, subsequently, anomaly detection accuracy? The authors could quantify this impact by designing targeted experiments. For example, they could construct synthetic graph datasets with varying levels of heterogeneity and topological complexity to compare DiffGAD’s performance when using the current encoder versus a hypothetical ideal encoder (with stronger representational power). Metrics such as anomaly detection accuracy and recall could provide insight into performance differences.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1、The authors innovatively adapt diffusion models from generative tasks to the field of graph anomaly detection, introducing DiffGAD, which brings new perspectives to graph anomaly detection.\n\n2、A novel latent space learning paradigm is introduced by combining unconditional and conditional diffusion models to capture and refine discriminative content, offering a fresh approach to address the challenge of extracting discriminative features in graph anomaly detection.\n\n3、When addressing anomaly detection, the method incorporates diffusion sampling and a content preservation mechanism, effectively injecting and retaining discriminative content across different scales.\n\n4、In the experimental section, six different real-world and large-scale datasets are used for evaluation, covering various types of data scenarios, such as social networks (Weibo, Reddit), commercial networks (Disney, Books, Enron), and large-scale financial networks (Dgraph), ensuring the reliability and generalizability of the experimental results.", "weaknesses": "1、Although the paper mentions that graph encoders (e.g., GCN in Graph AE) may limit the model's ability to represent complex graph structures and relationships, it only briefly notes this issue without analyzing how this limitation impacts DiffGAD’s performance in specific experiments or real-world scenarios. For example, when handling highly heterogeneous or dynamically changing graph structures, the encoder may fail to accurately capture critical information, potentially leading to reduced anomaly detection accuracy.\n\n2、For the key hyperparameter λ in the model, simply showing the impact of different values on performance through experiments is insufficient. There is a lack of theoretical justification explaining why the optimal value differs across datasets and the intrinsic connection between these values and data characteristics.\n\n3、In the introduction, the logical connection between the research motivation and the subsequent presentation of DiffGAD's innovations could be clarified. It would be helpful to explicitly highlight the specific limitations of traditional methods in capturing discriminative content and how DiffGAD’s unique design (such as the generative paradigm guided by discriminative content and content preservation strategy) directly addresses these issues.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "DebJg6haAB", "reviewer": "Reviewer_epRR", "summary": "The paper presents a graph anomaly detection method, DiffGAD, which aims to capture critical discriminative content in reconstruction. By leveraging diffusion sampling, DiffGAD infuses the latent space with discriminative content. To evaluate its effectiveness, the authors conduct experiments on seven datasets and compare its performance against other anomaly detection methods.", "questions": "1. The GAE model detects anomalies by calculating reconstruction error. Wouldn’t it be more effective to focus on reconstructing common attributes rather than distinguishable features, as anomalies are typically identified by their deviations from common patterns?\n2. Why add noise to the features? Can’t the original features capture the general patterns?\n3. In the visualization results, normal nodes and abnormal nodes are not clearly distinguished.", "limitations": "", "rating": 5, "confidence": 5, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. This paper presents a clear motivation.\n2. The logical structure of the paper is clear.", "weaknesses": "1. The paper states that ‘the latent space constructed by the AE-based method (Ding et al., 2019) tends to represent all samples for the Books dataset (Sánchez et al., 2013) into the same point’ and 'VAE constructs the latent space within a constrained distribution (e.g., the Gaussian distribution), leading to a uniform latent distribution.' This argument should be further supported through experimental validation.\n2. Authors should add the latest baselines to demonstrate the effectiveness of DiffGAD.\n3. Sec. 4.3 should further analyze why DIFFGAD does not achieve optimal performance.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)