Towards Anomaly-Aware Pre-Training and Fine-Tuning for Graph Anomaly Detection
Authors: Yunhui Liu
Jiashun Cheng
Yiqing Lin
Qizhuo Xie
Jia Li
Fugee Tsung
Hongzhi Yin
Tao Zheng
Jianhua Zhao
Tieke He
Venue: ICLR 2026 Poster (2026)
Keywords: Graph Anomaly Detection
Graph Pre-Training
Self-Supervised Learning
Primary area: learning on graphs and other geometries & topologies
TL;DR: An anomaly-aware pre-training and fine-tuning framework tailored to graph anomaly detection.

Abstract: Graph anomaly detection (GAD) has garnered increasing attention in recent years, yet remains challenging due to two key factors: (1) label scarcity stemming from the high cost of annotations and (2) homophily disparity at node and class levels. In this paper, we introduce Anomaly-Aware Pre-Training and Fine-Tuning (APF), a targeted and effective framework to mitigate the above challenges in GAD. In the pre-training stage, APF incorporates node-specific subgraphs selected via the Rayleigh Quotient, a label-free anomaly metric, into the learning objective to enhance anomaly awareness. It further introduces two learnable spectral polynomial filters to jointly learn dual representations that capture both general semantics and subtle anomaly cues. During fine-tuning, a gated fusion mechanism adaptively integrates pre-trained representations across nodes and dimensions, while an anomaly-aware regularization loss encourages abnormal nodes to preserve more anomaly-relevant information. Furthermore, we theoretically show that APF tends to achieve linear separability under mild conditions. Comprehensive experiments on 10 benchmark datasets validate the superior performance of APF in comparison to state-of-the-art baselines.

Published as a conference paper at ICLR 2026
TOWARDS ANOMALY- PRE-TRAINING AND FINE- -UNNIG FOR GRAPH ANOMALY DETECTION
Yunhui Liu's Jiashun Cheng"; Yiqing Lin Qizhuo Xie',
Jianhua Jia Lif, Fugee Tsung', Hongzhi Yin', Tao Jianhua Zhao', Tieke Hell 1 State Key Laboratory for Novel Software Technology. Nanjing University HKUST HKUST(GZZ) Tsinghua University The University of Queensland
ABSTRACT
Graph anomaly detection (GAD) has garnered increasing attention in recent years, yet remains challenging due to two key factors: (1) label scarcity stemming from the high cost of annotations and (2) homophily disparity node and class lev- els. In this paper, we introduce Anomaly-Aware Pre- Tre-Training and Tuning (APF), a targeted and effective framework to mitigate the above challenges in GAD. In the pre-training stage, APF incorporates node-specific subgraphs se- lected via the Rayleigh Quotient, label-free anomaly metric, into the learning objective to enhance anomaly awareness. It further introduces two learnable spectral polynomial filters to jointly learn dual representations that capture both general semantics and subtle anomaly cues. During fine-tuning, gated fusion mechanism adaptively integrates pre-trained representations across nodes and dimensions, while an anomaly-aware regularization loss encourages abnormal nodes to preserve more anomaly-relevant information. Furthermore, we theoret- ically show that APF tends to achieve linear separability under mild conditions. Comprehensive experiments on 10 benchmark datasets validate the superior perfor- mance of APF in comparison state-of-the baselines. The code available https: / g thub. com com/Cloudy 1225/AP5
INTRODUCTION
Graph anomaly detection (GAD) aims to identify small but significant portion of instances, such as abnormal nodes, that deviate significantly from the standard, normal, or prevalent patterns within graph- graph-structured data (Qiao et al. 2025b). The detection of these anomalies crucial for various scenarios, such financial fraud in transaction networks (Cheng et al. 2025). fake news in social media (Aimeur al. 2023), and sensor faults in IoT networks (Gaddam et al., 2020). Given their strong ability to model relational structure, graph neural networks (GNNs) have recently emerged as a leading choice for tackling GAD.
Despite notable progress, most existing GAD methods (Dou et al. 2020 Tang et al. 2022 7.uoo
ct al., 2024; Zheng et al. 2025al are not tailored for label-scarce scenarios, leading to suboptimal performance in real-world deployments where annotations are costly. Recent semi-supervised attempts, such as pseudo-labed -abellgn (Rizve et al.; 2021] Chen et al. 2024b) and synthetic sample generation (Ma et al.) 2024 Qiao al. (024)), seek to mitigate this but often suffer from instability due to the inherent uncertainty and confirmation bias that compromise performance (Rizve et al.) 2021). In contrast, the pre-training and fine-tuning paradigm has shown great promise in label-scarce learning across CV (Chen et al., 2020 Nandam et al., 2025), NLP (Devlin et al.] |019) et al.
2023), and graph learning (Zhu al. 22200]Ju et al. al.] (024)). recent study (Cheng a 2024)) further reveals that -prrpose graph pre- wre-trainig strategies (Veličković et al. 2019 Hou et al. 2022)
can match or even outperform GAD-specific methods under limited supervision. Despite their strong potential, existing graph pre-training frameworks are primarily designed to extract task-agnostic semantic knowledge. As such, they fail to address GAD's 's unique challenges, falling short capturing anomaly-relevant cues and leaving their adaptation to GAD an unsolved yet pressing task.
"Equal contribution. Corresponding author i i (.

---

Published as a conference paper at ICLR 2026
100
100
20
Normal Abnormal
Normal Abnermal
25
80-
Denstty.
Density
20
AUPRC
AUPRC:
10
35
10-
+
6.00
0.25
0.50
0.75
1.00
8.00
0.25
0.50
0.75
1.00
Q1
02
Q3
Q4
Q1
Q2
Q3
Q4
Local Homophilyy
Local Homophily
Local Hamaphily Quartiles
Local Homophily Quartiles
(a) Weibo
(b) T-Finance
(c) Weibo
(d) T- T-Finance
Figure 1: (a). (b): Distribution of local homophily for Weibo and T-Finance. (c), (d): Performance across local homophily quartiles (QI top 25%, Q4 bottom 25%) Weibo and T-Finance.
In GAD, global homophily, the intra-class edge ratio over the entire graph, tends to decrease due to challenges like camouflage (Dou al. 2020), making intuitive yet common anomaly indicator. Nonetheless, we highlight that local homophily, the class consistency within each node's neighbor- hood, reveals more nuanced disparity patterns, capturing localized yet often overlooked anomaly signals. As illustrated in Figures ((a)
and [(b] these disparities manifest at two granularities: (1)
node-level disparity represents the high variations in local homophily across individual nodes and (2)
class-level disparity refers to lower local homophily for abnormal nodes. Most existing approaches are built around global homophily and employ uniform processing schemes, such as edge reweight-
ing (Shi et al. 2022 Gao et al. 2023) spectral filtering (Tang al. 2022 Zheng et al.) 2025a).
However, such globally uniform designs lack aode-adaptive mechanisms necessary to accommodate the structural diversity of individual nodes, resulting in inconsistent anomaly distinguishability across nodes in different local homophily groups, as further evidenced Figures [(c) and l(d) These limitations jointly highlight critical challenge: How can we devise a GAD--peciiic pre-training and fine-tuming framework that effectively mitigates gual-granularity local homophily disparity?
Present Work. To address this challenge, we introduce Anomaly- Pre-Training and Fine- Tuning (APF), a novel framework designed for GAD under limited supervision, grounded in anomaly- aware pre-trainin and canuularrty-daapiii fine-tuning to handle homophily disparity.
In the context of anomaly- metric for quantifying anomaly degree, reduce reliance on label-dependent anomaly measures. In particular, building upon conventional pre-training objectives, we incorporate node-wise subgraphs, each selected maximize the Rayleigh Quotient, into the objective enhance anomaly awareness. We further adopt learnable spectral polynomial filters to jointly optimize two distinct representations: one capturing general semantic patterns and the other focusing on subtle anomaly cues. This dual-objective design effectively captures node-wise structural disparity, offering more informative initializations for downstream detection tasks.
pre-training. APF harnesses the Rayleigh Quotient, a label-free
To enable granularity adaptite fine-tuning, APF employs gated fusion network that adaptively combines pre-trained representations at both the node and dimension levels. An anomaly-awan regularization loss is further introduced to encourage abnormal nodes retain more anomaly- relevant information from pre-trained representations than normal nodes. Together, these components explicitly address local homophily disparity, by aligning the fine-tuning with the homophily disparity at node and class levels under label-guided optimization. Theoretical analysis further shows that APF tends achieve linear separability across all nodes.
Empirically, extensive experiments on 10 benchmark datasets are conducted to verify the superior performance of APF, demonstrating its effectiveness against label scarcity.
2 PRELIMINARY
In this section, we briefly introduce notations and key concepts. Detailed preliminaries and related works are provided in Appendix B and Appendix C respectively.
Graph Anomaly Detection (GAD). Let = (V,E, X) be a graph with n nodes and edges E. Each node U; has d-dimensional feature a., forming the feature matrix X E RRaxd The adjacency matrix
2

---

Published as a conference paper at ICLR 2026
is A, and D is the diagonal degree matrix. The neighbor set of 2 is denoted as MG. GAD is framed as a binary classification problem where anomalies are regarded as positive with label 1. Given labeled nodes V = Va U Va with labels y". the goal is to predict g for unlabeled nodes. Real-world settings typically exhibit extreme label scareity (V4) < [V]) and class imbalance (Val < [.x)).
Local Homophily. Given node Ug its local homophily h; is defined as the fraction of neighbors in M that share the same label:
Jng E E : = Uy!
h;
[WG
We then compute the average local homophily of abnormal and normal nodes, denoted by h and h", respectively, as:
ha En= h2
Σ Ey h4 2y.=0
h"
2
Both metries are bounded within [0, 1). Table 4 summarizes the values of he and h across datasets, where ht is consistently lower than h", highlighting the presence of class-level homophily disparity.
Graph Spectral Filtering. Given the adjacency matrix A, the graph Laplacian defined as L = D - A. which is symmetric and positive semi-definite. Their symmetric normalized versions noted as A D- AD-1/2 and L I D-1/2 AD-1/2 It admits eigendecomposition L U AA where U R contains orthonormal eigenvectors (the graph Fourier basis) and A = diag(Ay, (), ) are eigenvalues ordered as 0 = X S ... S An < 2 (frequencies). The graph
spectral filtering is then defined as X = Ug(A)U X, where g(-) denotes the spectral filter.
3 METHODOLOGY
In this section, we formally introduce our APF framework, targeted and effective solution tailored to the unique challenges GAD. The overall framework illustrated Figure 2
3.1 ANOMALY-AWARE TRA-TRAINI
Label-free Anomaly Indicator.
Most existing graph pre-training strategies (Veličković et al. 2019
Hou et al. 2022: Liu et al. 2024d) are designed to optimize task-agnostic objectives. As a result, the learned representations primarily encode general semantic knowledge. In contrast, the goal of GAD is to capture subtle anomaly cues that differentiate minority abnormal instances. However, many of these cues, such as relation camouflage (Dou et al., 2020), are inherently label-dependent, making them difficult to capture under the label-free pre-training.
This motivates the incorporation of effective label-free anomaly measures into the learning objective to guide the representation toward anomaly-aware semantics. Recent findings reveal that the existence of anomalies induces the 'right-shift' phenomenon (Tang et al., 2022 Gao et al., 2023 Dong et al.) 2024), where spectral energy distribution concentrates more high frequencies. The corresponding accumulated spectral energy can be quantified by the Rayleigh Quotient (Horn & Johnson 2012):
x² La
Eis
Aig (2, - x;
RQ(x, L)
xT. x
2
where Rn represents general graph signal and ã UTx denotes its projection in spectral space. Crucially, the Rayleigh Quotient measures the inconsistency between node attributes and the local graph structure (i.e., graph smoothness). A high value indicates that connected nodes have dissimilar features, which allows RQ to capture both attribute anomalies (where features deviate from neighbors) and structural anomalies (e.g., camouflaged edges connecting dissimilar nodes) (Tang jt al. 2022). We provide a detailed discussion on how RQ captures these different anomaly types in Appendix K The following lemma further illustrates the relationship between the Rayleigh Quotient and anomaly information.
Lemma 1. The Rayleigh Quotient RQ(x, L), which represents the accumulated spectral energy of a graph signal, increases monotonically with the anomaly degree. [Tang et al. 2022
3

---

Published as a conference paper at ICLR 2026
a Anomaly-Aware Pre- Training
(II) Gronularity-Adaptive Fine-Tuniin Tunnng
Input
Anomdly
Learnable Poly
Foolig
Fusion Net
Regularization
Low-poss Filter
ZL
Eye
Gated
Zy
Fusion
WER Semple
Z
Lace
High-puss Filter
Labels
Abnormal
Normal
Unlobeled
Learnable
Frozen
Figure Overview of our proposed APF.
Given this, Rayleigh Quotient stands out as a promising label-free anomaly metric. To guide each node v; in capturing its potential anomaly cues, we employ MRQSampler (Lin et al. (2024) extract its 2-hop subgraph G. Each subgraph selected maximize the Rayleigh Quotient, thereby preserving as much structural diversity and anomaly-relevant signal as possible (Lin et al. 2024).
Dual-filter Encoding. Beyond the learning objective, the architectural modules for encoding
anomaly-relevant information are equally critical. Recent studies highlight that capturing high- frequency components is essential for modeling heterophilic patterns (Bo et al. [202 Luan et al.) 2022 Lei et al. 2022). Motivated by this, we complement the conventional low-pass encoder with an additional high-pass encoder. This dual-branch design allows to simultaneously capture general semantic patterns (via low-pass filters) and subtle anomaly cues (via high-pass filters), the latter of which are often smoothed out by standard GNNs. We provide a detailed discussion on the motivation and spectral guarantees of this design in Appendix L To facilitate flexible spectral encoding, we adopt the learnable K Korrder Chebyshev polynomial (He et al. [022) and restrict it fit only low-pass and high-past figh-pass filters, denoted by (-) and g=((). following prior work Chen et al. (024a):
K
K Σ k=0
(i)
Σ w TTTT( k=0
wh
Th (É),
where i = 2L/AAn - I denotes the scaled Laplacian matrix. The Chebyshev polynomials are recursively defined (x) (2))) Tx-2(x) with To(x) 1 and (1(x) coefficients are computed as:
The
W
2
Σ (T(()) w
2
Σ
(T((t)),
(5)
M +
M
where 4 = cos( i+1/2
K+I m) ) 0....
denotes the Chebyshev nodes for TK+1(E)). The filter values
th and n is determined by:
&
+K =
Σ 1=1
Tk
(6)
j=0
where y = (Yo. .MM) is the shared learnable parameter with v/. 7/ As per Chen et al. (2024a), we have !! S HH and 7, 7/. thus guarantee the high-ppassllow-pass property for 9r Voa (-). Given such, our low-pass and high-pass encoders are formulated as:
Z = fer (LL(i)x) ZH = fen (i))
(7)
where ZL Zz E Rxe denote the low-pass and high-pass node representations respectively. for fou, (.) represent the learnable MLP for each filter. To ensure consistent scaling for sub- sequent fusion, both Zi, and Z и are standardized with zero mean and unit variance.
4

---

Published as a conference paper at ICLR 2026
Optimization. Unlike conventional objectives that only preserve task-agnostic semantics, optimization explicitly integrates anomaly awareness. We build the pre-training framework upon DGI (Veličković et al.) 2019) owing to its efficiency and effectiveness: we retain its standard low- pass branch to encode generic semantic structure, and further incorporate an anomaly-sensitie objective that maximizes the mutual information between each node and the summary of its Rayleigh Quotient-guided subgraph, computed by high-pass encoders. Let Z r, and Ž н denote negative samples generated from randomly shuffled inputs (Veličković et al. 2019). Our pre-training loss is:
1
Σ
log D 8%) + log (1 (1-D (2',
ppt
(8)
n
Σ
log log D , x!!) + log (1- [ , ))
n
where 8¹ = - z
is the global semantic summary and s.¹¹ [s! Σ Enjeg,a z is the anomaly-awar summary over the Rayleigh Quotient- based subgraph of node Us. The discriminator is defined as D(z, 8) o(= Ws). By jointly optimizing these two complementary objectives, our framework departs from existing pre-training methods and introduces principled way to capture task-agnostic semantic knowledge and node-specific anomaly cues, yielding more informative representations for downstream anomaly detection.
3.2
GRANULARITY-ADAPTIIA FINE-TUNING
Node- and Dimension-wise wise Fusion. After pre-training, we aim to develop a node-adaptive fusion
mechanism that selectively combines task-agnostic semantic knowledge (Z,, 1,) and node-specific structural disparities (Z :)) from the frozen pre-trained representations. This fusion is designed to better respond to local homophily variations across nodes under label-guided learning. Beyond trivial node-wise fusion, prior studies (Wang & Zhang 2022 Dong et al.) [021 Zheng et al. (025b)
highlight that different feature dimensions contribute unequally to downstream tasks, motivating a dimension-awee fusion design. To this end, we introduce a coefficient matrix C' [0, 10,11mxc to combine L and и node and dimension levels:
= Z (1-C) ZH,
where @ denotes the Hadamard product, and Z is the resulting fused representation passed to the classifier. A naive approach learn C is treating it as free parameters (Wang & Zhang 2022). but this leads to excessive overhead (O(n x E)). inefficient learning under sparse supervision, and neglect of input semantics. To alleviate this, we introduce lightweight Gated Fusion Network (GFN) that generates coefficients based on the input features:
C= (XW bb),
(10)
where W Rd a learnable matrix and b R is a bias term, ar)) is sigmoid function. The advantages of GFN over direct optimization are multifold: (1) GFN reduces the learnable parameter complexity of C from O(nxe) e) to ((d++1) xe). where d, < n;; (2) GFN allows sparse supervision to update the entire coefficient matrix, while direct optimization only affects labeled rows; (3) GFN leverages raw input features, which encode valuable anomaly-relevant attributes (Tang et al. 2023)
Anomaly-aware Regularization Loss. As indicated by the class-level local homophily disparity. abnormal nodes tend to camouflage themselves by connecting to normal ones. To account for this behavior, they should rely less on generic knowledge and be assigned more anomaly-relevant cues from pre-trained representations during the fusion process. To encourage this class-specific fusion preference, we introduce a regularization term that guides the optimization of the coefficient matrix C' accordingly. Let e; = = >> Ci denote the average fusion weight of node i; toward generic knowledge. We encourage c, to approach a class-speciff target: p" E [o, 1] for abnormal nodes and p" E [0, 1] for normal nodes, with the constraint pd p" to mimic the observed class-level disparity.
5

---

Published as a conference paper at ICLR 2026
The regularization loss is formulated as binary cross-entropy loss:
Creg
Σ
lp + (1 -0-pp)) log(1 -4))
|
V ===1
(11)
1
Σ
(p" log + p1"" log(1 - c))
[VL]
NEv' J4
This encourages the model to incorporate class-level fusion bias and enhances its ability to distinguish anomalies.
Optimization. Given the fused representations from Eq. we employ a two-layer MLP to predict the label ýt for each labeled node v4- The model is optimized using the standard binary cross-entropy loss:
Loce
1 1
Σ iEVE
(11 log is (1- ya) log(1 (z))
(12)
The overall fine-tuning objective combines the classification loss with the regularization term:
Le Lboe Greg-
(13)
3.3 THEORETICAL INSIGHTS
In this subsection, provide a theoretical analysis support architectural design. Our theoretical
analysis is grounded in the Contextual Stochastic Block Model (Deshpande et al. 2018), a widely used generative model for attributed graphs (Baranwal al. [221 et al. [022]] Mao et al. 2023
Han et al. 2024). To properly reflect homophily disparity, degree heterogeneity, and class imbalance GAD, first introduce variant, the Anomalous Stochastic Block Model (ASBM).
Definition 1 (ASBM An, μ, (PI,g) 91) (P2, (2), 0)). Let Ca and Cn be the abnormal and nor- mal node sets with sizes nh and nas respectively, n = 1la + Thn, class priors T. = -aan, nn = To sampled row-wise
X (N,, 21) and X,, ~ N(v, 11) with ||lll2 ||ll2 l22 I 1, and the full matrix X = [Xa: a: Xn). Each node U, has random variable 0, > (collected in 0) as the degree parameter, which controls how many edges it tends form. Nodes can follow either a homophilic or heterophilic connectivity pattern: a node in the homophilic set Ho prefers connect nodes of the same class, while node in the heterophilic set He prefers the opposite. Accordingly, edges are generated independently as follows:
with Ta < Tn. Node features
P1
P2 if h; ho and yi = Yjr if h; he and yi + Uj. 92 if h he and F Vj-
if Th; ho and y/i = Vj.
P(Ay = 1 Mj. h.) 0,0, x
91
Here E {a,n] is the class label and h; E hho indicates the local pattern (ho- mophillicheterophitte adopted by node 0;; p1 > qı enforces homophily (intra-class edges more likely), while p2 < Q2 enforces heterophily (inter-class edges more likely).
In line with prior analyses Baranwal et al. 2021), we adopt a linear classifier parameterized by w E Ed and E R. with predictions ò o_X Xv w + b1) on frozen filtered features X = U X.
optimized by the binary cross-entropy in Eq. 12
The separability of this model under adaptivee
filtering is characterized by the following theorem:
Theorem 1. For graph G(V, E, X) ( Rt, (p1, q1), (P2, (2), 0), when low- and high-pass filters are applied separately to the homophilic and heterophilic node sets Ho. He, there exist parameters w* bb* such that all nodes are linearly separable with probability 1 oa()).
We present the detailed proof in Appendix This theorem theoretically establishes that, under appropriate conditions, adaptively applying low-pass and high-pass filters to nodes based local homophily is possible to achieve linear separability across all nodes.
While the theorem assumes idcalized scenario with oracle filter assignments, our architectural design implements this principle in a data-driven manner. APF first extracts candidate representations via both low-pass and high-pass filters. Then, instead of hard filter selection, it employs Gated

---

Published as a conference paper at ICLR 2026
Fusion Network generate soft, continuous coefficients that approximate the node-wise filter assignment. Guided by class-specific fusion preferences and classification loss, our model learns to sense local homophily disparity and adjust fusion weights accordingly. This enables the learned fusion strategy to mimic the theoretical node-wise filter assignment without requiring all nodes' pattern labels, allocating representations based on each node's local homophily, thereby approaching the theoretical bound of linear separability and ultimately improving GAD performance.
EXPERIMENTS
In this section, we first evaluate the effectiveness of pre-training for GAD, the overall performance of our model, and its ability to mitigate homophily disparity (Section 4.2). We then analyze the contribution of each component and provide visualizations of the learned fusion coefficients (Sec- tion 4.3). Due to space constraints, additional experimental results, such as efficiency comparison, hyperparameter analysis, and representation visualization, are presented in Appendix |
4.1 EXPERIMENTAL SETUP
Datasets and Baselines. We conduct experiments on 10 GADBench (Tang et al. 2023) datasets
spanning diverse domains and scales. We compare with broad range of baseline methods, including
standard GNNs (Kipf & Welling, 2017; et al. 2019] Veličković et al. 2018 Luan et al. 2022 Bo
al.
2021| Dong et 2021 He et al. 2021).
D.A-cccccfic models (Li et 2019 Wang et al.
2021
Liu et al. 2021a a
Chai et al. [022 Tang et al.
2022 Gao et al. 2023
Chen et al.) 2024b
Dong et al., 2025) and graph pre- trainigg approaches (Veličković al. 2019 Zhu et al. 2020
Bielak et al.
2022 Hou et al. 2022 Thakoor et al. 2022 Liu et al. 2024cc
Chen et al. 2024a). For
detailed dataset statisties, dataset descriptions, and baseline descriptions, please kindly see Table
Appendix H.T and Appendix H.2. respectively.
Metrics and Implementation Details. To strictly align with real-worle label scarcity, we follow the semi-supervised setting defined in GADBench (Tang et al. 2023). Specifically, we standardize the training set include exactly 100 labeled nodes (20 anomalies and 80 normal nodes) across all datasets. Thus, the baseline results reported in this paper correspond to the semi-supervised performance metrics found in the GADBench Appendix (Table 11). For evaluation, we employ AUPRC, AUROC, and Rec@K K. We prioritize AUPRC over the threshold-dependenn Fl score to ensure a robust assessment of precision-recal tradeoffs independent of decision thresholds, which can be unstable under limited supervision. All experiments provided by GADBench for robustness. Due to space constraints, detailed evaluation protocols and hyperparameter settings are provided in Appendix H.3 and Appendix H.4 respectively. Our code is available at /ttps:://itthut com/ http//loooyly2222m2m
averaged over 10 random splits
H.3
4.2 PERFORMANCE COMPARISON
We summarize the performance across AUPRC, AUROC, and Rec@K Table T. Table 7 and Table 8 respectively. For comprehensiveness, DGI and BWDGI represent standard DGI pre-training with GCN and BWGNN as backbones. addition, APF (wo Lyx) is a variant of our method, skipping pre-training and directly optimizing the learnable spectral filters using Lft.
Effectiveness of Pre- Tre-Training. Overall, pre-training methods (from DGI BWDGI and APF) achieve competitive or even superior performance compared to GAD-specific models, especially on Reddit, Weibo, and Tolokers. In particular, DGI, BWDGI, and APF bring AUPRC improvements of +7.3%, +3.8%, and +4.9% over their respective end-to-end training counterparts (GCN, BWGNN, and APF (w/o C)))) These gains highlight the importance of pre-training in addressing the label scarcity inherent to GAD, by providing more expressive and transferable initializations.
To further validate the benefits of our pre- pre-training, we also evaluate the learned representations in a purely unsupervised setting, where they are directly coupled with an anomaly scorer IF (Liu et al. 2008) without fine-tuning. The results, presented Appendix I.T, confirm that our pre-training further enhances unsupervised detection performance, demonstrating its general effectiveness.
7

---

Published as a conference paper at ICLR 2026
Table 1: Comparison of AUPRC for each model. 7." denotes "out of memory". runner-up models are bolded and underlined.
The best and
Model
Roddit
Weibo
Amazon
Yelp.
T-Fin.
Ellipp
Tolo.
Quest.
DGraph.
T-Social
Avg.
GCN
4.230.8
86.025.7
32.82122
16.422.6
60.521088
43.12246
33.02336
6.120.9
2,350.2
8.423.8
29.3
GIN
4.3a0.6
67.62744
75.4
23.745.4
44.847.1
40.1433
31.823.
6.7s1.1
2,080.1
6.2s1.7
30.3
GAT
4.750.7
73.3473
81.621.7
25.022.9
28.91886
44.216.
33.022.
7.3+1.2
2.210.2
9:22200
30.9
ACM
4,4+0.7
66.0687
54.0=19.0
21,422.7
29.2+168
63.1
34.4+3.5
7.2=1.9
2,2+0.4
6.0#16
28.8
FAGCN
4.720.7
70.12106
77.0=2.3
22.512.6
39.8227.2
35.024.3
7.321.4
2.030.3
AdaGNN
4,9308
28. 3+2.
75.7:6.3
22.7:2.1
23.3+7.6
39 2:79
32.243.9
5,320,9
2.10
4.8
23.9
BemNeet
4.9
66.625.5
81.2522
23.942.7
51.8412.4
40.0&4.1
28.943.5
6.7a2.1
2.5
4.2s1.2
31.1
GAS
4.760.7
65.748.4
80.7
21.723.3
45.7
46.0a4.9
31.743.0
6.3g2.0
2.510.2
8.622.
31.4
DCI
4,350.4
76.261.
72.5=79
24.024488
51,027,2
43.4
32.1
6.1513
2,050.2
7,4+2.5
31.9
PCGNN
3.4305
69.3
81.9:19
25.0a3.5
58.1211.3
40.326.6
33.92177
6.421.8
2.4
8.0&1.
AMNet
4.930.4
67.1
82 4:2.2
23.923.5
60.248.2
33.3
28 15
7/4114
2.2+0.3
3.130.3
31.3
BWGNN
4.2a0.7
80.614.7
81.7=22
25.7+2.9
60.94138
43.4
35.3+2.2
6.5
2,13
15.946.2
35.4
GHRN
4.2100.
77.0255
80.7=1.7
23,842.8
63.4210.4
24.7
35.922.0
6.5
2.310.3
16.244.6
35.4
Cons&GAA
4.5
64.625.
78.745.7
25. 9+2.9
79.7+4.7
47.8
33.7+2.7
7.9
2,080.2
41.3a5.0
38.6
SpaceGNN
4.620.
79.2
81.122.3
25.742.4
81.0335
44.1135
33.812.5
7.4116
2,0
59 09.015.7
XGBGrrph
4,1
75.9
84,4=1.1
24.8+3.1
78.343.1
77.2+3.2
34.1
7.7+2.1
1.9802
40.6e47.6
42.9
DGI
4.840.6
90.8+25
46.5=5.7
17.0s1.2
75.0+4.9
45.9
39.7+0.8
6,4s1.2
2.1
37.8e6.1
36.6
GRACE
4.740.3
90.8118
51.3
18.221.6
79.3
48.1236
37.442.8
8.921.7
G-BT
5,0+0.7
87.5+339
38.7=2.2
18.8#1.6
76.8
45.2+444
37.9+2.8
9.1
2,6+1
42,2=7,4
36.4
GraphMAE
4.3
91.4226
39.4
17.3
70.824.7
32.7
36.112.11
5.920.3
2.1
BGRI.
5.3+0.3
93.6+12
43.9-a46
19.2+1.6
61.745.1
3R. 3+3.3
8,422
2,0802
46.7+8.4
36.6
SSGE
4.840.9
87.7426
39.1=24
18.821.6
77.640.9
47.4
38.242.8
8.151.1
2.5
46.4
37.1
PolyGCI
5,2408
79.7=66
24.3+2.5
43.346.4
50.0+5.2
33.0=188
5,7+08
2.240.
40.6+7.0
37.1
BWDGI
4.5
72.5+2.7
79.4=5.7
26.8+2.7
80.0a2.1
44.9
38.5+3.1
5.0%0.7
2.4
38.0a5.2
39.2
(wl Cx))
5,2406
85.84779
82.7=3.0
24.1
19.4
55.5+4.9
37,4+1.2
9,48155
2,3602
64.8=10.5
44.7
APF
5,930.9
93.9+1.1
83.8+2.0
28.4+1.4
82.5+2.6
67.7+3.
40.5+2.0
12.341.6
2.950.2
77.845.6
49.6
Superiority of Our Proposed APF. As observed, APF outperforms both GAD-specific approaches and graph pre-training methods in most cases. On average, APF achieves gains of +6.7% in AUPRC, +3.8% in AUROC, and +6.2% in Rec@ K. Even without the pre-training. APF (w/o Epx) surpasses all baseline methods, including BWGNN and AMNet, which also adopt multi-filter architectures. This highlights the strength of our fine-tuning module in adaptively emphasizing anomaly-relevant signals and approximating the theoretical linear separability established in Theorem [] We note that APF underperforms XGBGraph on Amazon and Elliptic, likely due to the tabular and highly heterogeneous node features that favor tree-based models (Grinsztajn et al. 2022 Tang et al. (2023]
as further discussed in Appendix D Overall, these strong results validate the effectiveness of our proposed anomaly-awan pre-training and granularity fine-tuning framework.
Mitigation of Homophily Disparity. To investigate the ability of our model to mitigate the impact
of local homophily disparity, we conduct a fine-grained performance analysis on abnormal nodes with varying degrees of local homophily. Specifically, we divide the abnormal nodes in the test set into four quartiles based on their local homophily scores and compute the model performance within each group against the remaining normal nodes,
The results are visualized Figure D 3 and 14 We observe that detection performance typically declines as local homophily decreases, highlighting the difficulty of identifying anomalies in heterophilic regions and the need for node-adaptive mechanisms. APF consistently achieves stronger performance across all homophily quar- tiles, demonstrating enhanced robustness to homophily disparity. Such mitigation mainly stems from our anomaly- aware pre-training and the adaptive fusion mechanism, allowing the model to tailor its decision boundary to each node's local structural context and mitigating performance degradation under local homophily disparity.
ComisRAD
Amazon
80
AUPRI
6.
40
01 Local Homophily Quartiles
02
03
04
01
02
04
Local Homophily Quartiles
Figure 3: Performance variations across local homophily quartiles (Q1 -op 25% Q4 = bottom 25%).
To provide a more fine-grained view, we further measure
the performance variance across homophily levels by reporting the AUPRC differences between lower-homophily groups (Q2, Q3, Q4) and the highest-homophily group (QI). The results in Table 2 show that APF generally yields the smallest or near-smallest performance variance across quartiles. This indicates that, although performance degradation remains as local homophily decreases, APF alleviates the disparity more effectively and yields more stable performance under challenging heterophilic conditions.
8

---

Published as a conference paper at ICLR 2026
Table 2: AUPRC differences (QI Q*) across local homophily quartiles. Smaller absolute values
indicate lower performance gaps under homophily disparity.
Datasct
Q1-Q2
Weibo Q1-Q3
Q1-Q4
Q1-Q2
T-Finance Q1-Q3
Q1-Q4
Q1-Q2
YelpChi Q1-Q3
Q1-Q4
Q1-Q2
Amazon Q1-Q3
Q1-Q4
AMNet
9.40
32.88
27.32
3.44
30.27
58.66
-0.71
-0.19
0.54
5.42
20.65
47.10
BWGNN
10.73
39.18
44.89
9.47
56.56
86.60
-0.44
0.03
26.14
56.74
ConsisGAD
13.43
43,95
54.96
3.75
25.04
89.25
-1.75
-0.19
-0.06
-3,24
14,63
39.47
APF
-1.18
5.72
31,20
2,06
23.36
76.12
-0.50
0.16
0.78
4.18
17.98
45.46
4.3
MODEL ANALYSES
Contribution of Each Component. We perform a comprehensive ablation study to disentangle the contributions of the major components in both the pre-training and fine-tuning stages of APF. In
the pre-training stage, we design four controlled variants: (i) using only the low-pass filter gr. (.). (ii) using only the high-pass filter (+))), (iii) removing the Rayleigh Quotient-guidd -uideeg subgraph GRQ by applying standard DGI 91(-) and (=(,), and (iv) replacing G with a full k-hop subgraph "4"..
In the fine-tuning stage, we examine two factors: (i) discarding the anomaly- aware regularization loss freg. and (ii) replacing or attention fusion (Chai et al. 2022).
node- and dimension-adaption fusion with mean pooling, concatenation,
The results, shown in Table reveal several important findings. (1) Dual-filter necessity. Leveraging both low- and high-pass filters clearly outperforms using either alone, confirming that semantic regularities and anomaly-indicative irregularities must be jointly captured for GAD. (2) Power of G The Rayleigh Quotient-guided subgraph yields more precise anomaly discrimination than the full k-hop variant "4", highlighting the Rayleigh Quotient as an effective label-free anomaly indicator. (3) Adaptive fusion advantage. Our node- and dimension-adaptive fusion consistently surpasses the alternatives, showing the importance of exploiting frequency- seluentv-seeeeiivee signals while adapting to node- cade-specific contexts. (4) Regularization gains. The anomaly-awar regularization loss Lreg provides additional boosts, aligning representations with class-level fusion bias and further strengthening anomaly detection.
Table
Ablation study on each component of our APF.
Variants
Reddit
YelpChi
Questions
DGraph-Fin
96.
9N
G
PQ
Drgg
Fusion
AUPRC
AUROC
AUPRC
AUROC
AUPRC
AUROC
AUPRC
AUROC
NDAApi
5.920.9
66.813.9
28.4
68.2+2.3
12.3+1.6
71.922.1
2.940.2
72,4x1.3
/
X
V
NDApt
5.320.6
66.112.0
27.111.6
67.611.4
10.921.8
71.242.5
2.610.1
71.120.5
1
+
V
NDApt
5.520.7
66. 66.523.8
27.4+28
67.342.3
10.8:1.6
71.042.3
2.7+0.2
71.0+2.2
X
4.9+0.5
65.3+1.7
18.7+1.2
56.5+1.3
11.8+1.2
70.6+1.2
2.5+0.1
71.0+1.0
8
/
X
4.510.5
60.1133.0
24.412.4
64.012.5
6.310.7
66.113.2
2.610.1
71.140.5
X
NDApt 5.320.5
64.311.7
27.5+1.6
67.412.3
11.1:1.6
71.242.7
2.810.1
71.720.4
7
X
Mcan
5.1#0.6
63.5+2.0
27.6+1.6
67.242.1
10.8=1.7
71.0+2.4
2. 2.8+0.1
71.6+0.4
X
Concat
64.6+227
27.3+1.9
67.3+2.2
11.1+1.5
68.5+3.2
2.8+0.0
71.5+0.2
7
X
Atten.
5.240.7
62.812.3
26.211.6
66.711.7
8.312.
67.513.5
2.810.0
71.740.3
Visualization of Fusion Coefficients. To gain visual insights into our node- and dimension-ade addativve fusion, we present heatmaps of the learned fusion coefficients C' in Figure 4 For clarity, we focus on the top dimensions C for 3 randomly selected abnormal nodes 01, 02 0g and 3 randomly selected normal nodes 11,, 722, R3.. The heatmaps reveal substantial variation across both nodes and dimensions, confirming the adaptiveness of C. For Amazon, T-Finance, and Tolokers, abnormal nodes generally have lower coefficients than normal ones, aligning with the intuition that anomalies should rely more on high-pass (anomaly-senn sensitive) features, while normal nodes benefit more from low-pass (semantic) representations. In contrast, Weibo shows similar coefficient distributions between classes, likely due to the smaller local homophily gap between the two classes. Moreover, the variability of C across dimensions suggests that APF learns assign different levels of node-wise and dimension-wiss importance of information from both encoders, enabling more expressive fusion that captures subtle, localized anemaly-relevant patterns.
Additional Analyses. Due to space limitations, please kindly see the Appendix for extended dis- cussions. Specifically, we report the model's s time complexity in Appendix G and present efficiency analyses regarding training time and memory overhead in Appendix [.3 The effectiveness of our

---

Published as a conference paper at ICLR 2026
715
740
733
7731
.043
.337
243
.014
.042
.007
443
555
602
075
.11
035
500
723
150
729
753
2455
0.75
32
0012
007
226
1001
1926
1901
3.60
32
450
46.3
454
441
552
659
6.70
92
1:1
612
635
682
401
549
6.0
01
743
750
245
242
747
172
R1
5:4
310
540
.11L
540
.000
F1-
350
373
553
322
612
722
01
764
662
426
T24
.12
200
72
0g
R2
0.53
030
734
737
350
706
701
753
726
413
316
.00
757
775
630
555
677
A00
611
783
700
677
726
720
000
2
1671
2
3
4
20
3
6.48
5
1554
(a)
Weibo
(b) Amazon
(c) T-Finance
(d) Tolokers
Figure 4: Visualization of the learned coefficients for the top 6 dimensions. The nodes 41, 42 43 are 3 randomly selected abnormal nodes, while 1 722, fgg are randomly selected normal nodes.
pre-training under purely unsupervised GAD setting is discussed in Appendix Moreover, Appendix I.2 provides visualizations of the learned low-pass, high-pass, and fused node represen- tations. We also analyze the sensitivity hyperparameters Pa and p., in Appendix [1.4] investigate performance under varying amounts of labeled nodes in Appendix [.5] and include additional figures and tables complementing the main results. We further re-classify the baselines into supervised, semi- supervised, and self- supe-suue categories in Appendix [.8] and compare our two-stage (pre-training and tine-tuning) approach against a joint learning strategy in Appendix I.9 I.9 These analyses jointly provide a more comprehensive understanding of the proposed framework.
CONCLUSION
This paper tackles label scarcity and homophily disparity in GAD by introducing APE: APF first lever- ages Rayleigh Quotient- Quotient-guided guided subgraph sampling and dual spectral filters to capture both semantic and anomaly-sensine
signals without supervision. During fine-tuning, a node- and dimension- adaptive fusion mechanism, together with anomaly-aware regularization, enhances the model's 's ability to distinguish abnormal nodes under homophily disparity. Both theoretical analysis and extensive experiments on 10 benchmark datasets validate the effectiveness of our approach.
ETHICS STATEMENT
We adhere the ICLR Code of Ethics and have taken every measure to ensure that our research complies with the ethical guidelines set forth. Our work does not involve human subjects, nor does it raise any ethical concerns related to privacy or data usage. All datasets used in our experiments are publicly available, and we ensure that their release and use adhere proper data-sharing policies. We have carefully selected the datasets and evaluation metrics to ensure fairness and transparency in findings. No potential conflicts of interest. sponsorship biases, ethical violations have been identified our study. We commit to maintaining the highest standards of research integrity, and we open addressing any ethical concerns that may arise during the review process.
REPRODUCIBILITY STATEMENT
We have made efforts to ensure that this work fully reproducible. All experiments were conducted with well-defined and publicly available datasets, and the models were implemented using standard frameworks. To facilitate the reproducibility of our results, we provide a detailed description of our experimental setup the main text and Appendix, including hyperparameters. training protocols. evaluation methods, and the open- open-source link. We believe that all materials necessary for reproducing our experiments are clearly outlined.
ACKNOWLEDGMENTS
This work is partially supported by National Science and Technology Major Project (2026ZD160) 1601 1200), the National Natural Science Foundation of China (62306137, 72371217), the Guangzhou Industrial Informatics and Intelligence Key Laboratory (2024A03J0628), the Nan- sha Key Area Science and Technology Project (2023ZD003, 2021JC02X191) and the Australian
10

---

Published as a conference paper at ICLR 2026
Research Council under the streams of Future Fellowship (FT210100624), the Discovery Project (DP240101108, DP260100326), and the Linkage Project (LP230200892, LP240200546).
REFERENCES
Esma Aimeur, Sabrine Amri, and Gilles Brassard. Fake news, disinformation and misinformation in social media: review. Social Network Analysis and Mining, 13(1):30, 2023.
Aseem Baranwal, Kimon Fountoulakis, and Aukosh Jagannath. Graph convolution for semi- supervised classification: Improved linear separability and out-of-distribution generalization. In International Conference on Machine Learning, pp. 684-693. PMLR, 2021.
Piotr Bielak, Tomasz Kajdanowicz, and Nitesh V Chawla. Graph barlow twins: self-supervised Systems, 206:1, 2022.
representation learning framework for graphs. Knowledge-Bil
Deyu Bo, Xiao Wang. Chuan Shi, and Huawei Shen. Beyond low- wow-frequeney information in graph convolutional networks. In Proceedings of the AAAl conference on artificial intelligence, pp. 3950-3957, 2021.
Ziwei Chai, Siqi You, Yang Yang, Shiliang Pu, Jiarong Xu, Haoyang Cai, and Weihao Jiang. Can abnormality be detected by graph neural networks? In IJCAI, pp. 1945-1951, 2022.
Jingyu Chen, Runlin Lei, and Zhewei Wei. PolyGCL: GRAPH CONTRASTIVE LEARNING via learnable spectral polynomial filters. In The Twelfth International Conference on Learning Representations, 2024a.
Nan Chen, Zemin Liu, Bryan Hooi, Bingsheng He, Rizal Fathony, Jun Hu, and Jia Chen. Consistency training with learnable data augmentation for graph anomaly detection with limited supervision. In The Twelfth International Conference on Learning Representations, 2024b.
Tianqi Chen and Carlos Guestrin. Xgboost: A scalable tree boosting system. In Proceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining, pp. 785-794, 2016.
Ting Chen, Simon Kornblith, Kevin Swersky, Mohammad Norouzi, and Geoffrey E Hinton. Big self-supervised models strong semi-supervised learners. Advances in neural information processing systems, 33:22243-2223 2222252,,,,, 2020.
Dawei Cheng. Yao Zou, Sheng Xiang, and Changjun Jiang. Graph neural networks for financial fraud detection: a review. Frontiers of Computer Science, 19(9):1115, 2025.
Jiashun Cheng, Man Li, Jia Li, and Fugee Tsung. Wiener graph deconvolutional network improves graph sulf-supervised learning. In Proceedings of the AAAI conference on artificial intelligence, pp. 7131-71399 2023.
Jiashun Cheng, Zinan Zheng, Yang Liu, Jianheng Tang, Hongwei Wang, Yu Rong, Jia Li, and Fugee Tsung. Graph pre-training models are strong anomaly detectors. arXiv preprint arXiv:2410. 18487, 2024.
Fan Chung and Linyuan Lu. Concentration inequalities and martingale inequalities: a survey. Internet mathematics, 3(1):79-127, 2006.
Yash Deshpande, Subhabrata Sen, Andrea Montanari, and Elchanan Mossel. Contextual stochastic block models. Advances in Neural Information Processing Systems, 31, 2018.
Jacob Devlin, Ming- Meig-Wei Chang, Kenton Lee, and Kristina Toutanova. BERT: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies. Volume 1 (Long and Short Papers), pp. 4171-4186, 2019.
Kaize Ding, Jundong Li, Rohit Bhanushali, and Huan Liu. Deep anomaly detection on attributed networks. In Proceedings of the 2019 SIAM international conference on data mining, 2019.
11

---

Published as a conference paper at ICLR 2026
Kaize Ding, Kai Shu, Xuan Shan, Jundong Li, and Huan Liu. Cross-domain graph anomaly detection. IEEE Transactions on Neural Networks and Learning Systems, 33(6):2406-244 202
Kaize Ding, Qinghai Zhou, Hanghang Tong, and Huan Liu. Few-shot network anomaly detection via cross-network meta-learning. In Proceedings of the web conference 2021, pp. 2448-2456, 202
Xiangyu Dong, Xingyi Zhang, and Sibo Wang. Rayleigh quotient graph neural networks for graph- level anomaly detection. In The Twelfth International Conference on Learning Representations, 2024.
Xiangyu Dong, Xingyi Zhang, Lei Chen, Mingxuan Yuan, and Sibo Wang. SpaceGNN: Multi-space graph neural network for node anomaly detection with extremely limited labels. The Thirteenth International Conference Learning Representations, 2025.
Yushun Dong, Kaize Ding, Brian Jalaian, Shuiwang Ji, and Jundong Li. Adagnn: Graph neural networks with adaptive frequency response filter. In Proceedings of the 30th ACM international conference on information & knowledge management, pp. 392 0022401,440 2021.
Yingtong Dou, Zhiwei Liu, Li Sun, Yutong Deng, Hao Peng, and Philip S Yu. Enhancing graph neural network-based fraud detectors against camouflaged fraudsters. In Proceedings of the 29th ACM international conference on information & knowledge management, pp. 315-324, 2020.
Anuroop Gaddam, Tim Wilkin, Maia Angelova, and Jyotheesh Gaddam. Detecting sensor faults, anomalies and outliers in the internet of things: A survey on the challenges and solutions. Elec- tronics, 933)511, 2020.
Yuan Gao, Xiang Wang, Xiangnan He, Zhenguang Liu, Huamin Feng, and Yongdong Zhang. Ad- dressing heterophily in graph anomaly detection: perspective of graph spectrum. In Proceedings of the ACM Web Conference 2023, pp. 1528-1538, 2023.
Léo Grinsztajn, Edouard Oyallon, and Gaël Varoquaux. Why do tree-based models still outperform deep learning on typical tabular data? Advances in neural information processing systems, 35: 507-520, 2022.
Haoyu Han, Juanhui Li, Wei Huang, Xianfeng Tang, Hanqing Lu, Chen Luo, Hui Liu, and Jiliang Tang. Node-wise filtering in graph neural networks: A mixture of experts approach. arXiv preprint arXiv:2406.033: 04.46404444, 2024.
Trevor Hastie, Robert Tibshirani, Jerome Friedman, et al. The elements of statistical learning, 2009.
Mingguo He, Zhewei Wei, Hongteng Xu, al. Bernnet: Learning arbitrary graph spectral filters via bernstein approximation. Advances in Neural Information Processing Systems, 34:14239-14251, 2021.
Mingguo He, Zhewei Wei, and Ji-Rong Wen. Convolutional neural networks on graphs with chebyshev approximation, revisited. Advances in neural information processing systems, 35: 7264-7276, 2022.
Devon Hjelm, Alex Fedorov, Samuel Lavoie-Marchildoo Karan Grewal, Phil Bachman, Adam Trischler, and Yoshua Bengio. Learning deep representations by mutual information estimation and maximization. In International Conference on Learning Representations, 2019.
Roger A Horn and Charles R Johnson. Matrix analysis. Cambridge university press, 2012.
Zhenyu Hou, Xiao Liu, Yukuo Cen, Yuxiao Dong, Hongxia Yang. Chunjie Wang, and Jie Tang. Graphmae: Self-supervised masked graph autoencoders. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 594-604, 2022.
Xuanwen Huang, Yang Yang, Yang Wang, Chunping Wang. Zhisheng Zhang, Jiarong Xu, Lei Chen, and Michalis Vazirgiannis. Dgraph: A large-scale financial dataset for graph anomaly detection. Advances in Neural Information Processing Systems, 2022.
Yihong Huang, Liping Wang. Fan Zhang, and Xuemin Lin. Unsupervised graph outlier detection: Problem revisit, new insight, and superior method. In 2023 IEEE 39th International Conference on Data Engineering (ICDE), 2023.
12

---

Published as a conference paper at ICLR 2026
Wei Ju, Siyu Yi, Yifan Wang. Qingqing Long, Junyu Luo, Zhiping Xiao, and Ming Zhang. A survey of data-efficient graph learning. In Proceedings of the Thirty-Thine International Joint Conference on Artificial Intelligence, IJCAI-24, 2024.
Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In ICLR, 2015.
Thomas N. Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. In International Conference on Learning Representations, 2017.
Srijan Kumar, Xikun Zhang, and Jure Leskovec. Predicting dynamic embedding trajectory in temporal interaction networks. In Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining, pp. 1269-1278, 2019.
Jing Lei and Alessandro Rinaldo. Consistency of spectral clustering in stochastic block models. The Annals of Statistics, pp. 215-237, 2015.
Runlin Lei, Zhen Wang, Yaliang Li, Bolin Ding, and Zhewei Wei. Evennet: Ignoring odd-hop neigh- bors improves robustness of graph neural networks. Advances in Neural Information Processing Systems, 55:4694-7706, 2022.
Ao Li, Zhou Qin, Runshi Liu, Yiqun Yang, and Dong Li. Spam review detection with graph convolutional networks. In Proceedings of the 28th ACM international conference on information and knowledge management, pp. 2703-2711, 2019.
Jinghan Li, Yuan Gao, Jinda Lu, Junfeng Fang, Congcong Wen, Hui Lin, and Xiang Wang. Diff- GAD: A diffusion-basee unsupervised graph anomaly detector. In The Thirteenth International Conference on Learning Representations, 2025.
Yiqing Lin, Jianheng Tang, Chenyi Zi, H Vicky Zhao, Yuan Yao, and Jia Li. Unigad: Unifying multi-level graph anomaly detection. Advances in neural information processing systems, 2024.
Fei Tony Liu, Kai Ming Ting, and Hua Zhou. Isolation forest. In 2008 eighth ieee international conference on data mining, pp. 413-422. IEEE, 2008
Kay Liu, Yingtong Dou, Yue Zhao, Xueying Ding, Xiyang Hu, Ruitong Zhang, Kaize Ding, Canyu Chen, Hao Peng. Kai Shu, et al. Bond: Benchmarking unsupervised outlier node detection on static attributed graphs. Advances in Neural Information Processing Systems, 2022.
Yang Liu, Xiang Ao, Zidi Qin, Jianfeng Chi, Jinghua Feng, Hao Yang, and Qing He. Pick and choose: a gan-based imbalanced learning approach for fraud detection. In Proceedings of the web conference 2021, pp. 3168-3177, 2021a.
Yixin Liu, Zhao Li, Shirui Pan, Chen Gong, Chuan Zhou, and George Karypis. Anomaly detection on attributed networks via contrastive self- superviidd learning. IEEE transactions on neural networks and learning systems, 33(6):2378-22) 22777, 2021b.
Yixin Liu, Shiyuan Li, Yu Zheng, Qingfeng Chen, Chengqi Zhang, and Shirui Pan. Are: A generalist graph anomaly detector with in-context learning. Advances in neural information processing systems, 2024a.
Yunhui Liu, Xinyi Gao, Tieke He, Tao Zheng, Jianhua Zhao, and Hongzhi Yin. Reliable node similarity matrix guided contrastive graph clustering. IEEE Transactions on Knowledge and Data Engineering, 2024b.
Yunhui Liu, Tieke He, Tao Zheng, and Jianhua Zhao. Negative-free self-supervised gaussian embedding of graphs. Neural Networks, 2024c.
Yunhui Liu, Huaisong Zhang, Tieke He, Tao Zheng, and Jianhua Zhao. Bootstrap latents of nodes and neighbors for graph self-supervised learning. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases, pp. 76-92. Springer, 2024d.
Sitao Luan, Chenqing Hua, Qincheng Lu, Jiaqi Zhu, Mingde Zhao, Shuyuan Zhang, Xiao- Wen Chang, and Doina Precup. Revisiting heterophily for graph neural networks. Advances in neural information processing systems, 136213621375 2022.
13

---

Published as a conference paper at ICLR 2026
Xiaoxiao Ma, Ruikun Li, Fanzhen Liu, Kaize Ding, Jian Yang, and Jia Wu. Graph anomaly detection with few labels: A data-centric approach. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp.
2024.
Yao Ma, Xiaorui Liu, Neil Shah, and Jiliang Tang. Is homophily necessity for graph neural networks? In International Conference on Learning Representations, 2022.
Haitao Mao, Zhikai Chen, Wei Jin, Haoyu Han, Yao Ma, Tong Zhao, Neil Shah, and Jiliang Tang. Demystifying structural disparity in graph neural networks: Can one size fit all? Advances in neural information processing systems, 2023.
Julian John McAuley and Jure Leskovec. From amateurs to connoisseurs: modeling the evolution of user expertise through online reviews. Proceedings of the 22nd international conference on World Wide Web, pp. 897-908, 2013.
Srinivasa Rao Nandam, Sara Atito, Zhenhua Feng, Josef Kittler, and Muhammed Awais. Investigating self-supervised methods for label-efficient learning. International Journal of Computer Vision, pp. 1-16, 2025.
Chaoxi Niu, Hezhe Qiao, Changlu Chen, Ling Chen, and Guansong Pang. Zero-shot generalist graph anomaly detection with unified neighborhood prompts. In Proceedings of the Thirty-Fourd International Joint Conference Artificial Intelligence, IJCAI-25, pp. 9226-3234 2025.
Guansong Pang, Chunhua Shen, Huidong Jin, and Anton Van Den Hengel. Deep seakly-supervieed anomaly detection. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 1795-1807, 2023.
Oleg Platonov, Denis Kuznedelev, Michael Diskin, Artem Babenko, and Liudmila Prokhorenkova. A critical look at the evaluation of GNNs under heterophily: Are we really making progress? In The Eleventh International Conference on Learning Representations, 2023.
Hezhe Qiao and Guansong Pang. Truncated affinity maximization: One-class homophily modeling for graph anomaly detection. Advances in Neural Information Processing Systems, 2023.
Hezhe Qiao, Qingsong Wen, Xiaoli Li, Fe-Peng Lim, and Guansong Pang. Generative semi- supervised graph anomaly detection. Advances neural information processing systems, 2024.
Hezhe Qiao, Chaoxi Niu, Ling Chen, and Guansong Pang. Anomalygfm: Graph foundation model for zero/few-shot anomaly detection. In Proceedings of the 31 ACM SIGKDD Conference Knowledge Discovery and Data Mining V. 2, pp. 2326-23313 2025a.
Hezhe Qiao, Hanghang Tong, Bo An, Irwin King, Charu Aggarwal, and Guansong Pang. Deep graph anomaly detection: A survey and new perspectives. IEEE Transactions Knowledge and Data Engineering, 2025b.
Shebuti Rayana and Leman Akoglu. Collective opinion spam detection: Bridging review networks and metadata. In Proceedings of the 21th acm sigkdd international conference on knowledge discovery and data mining, pp. 985-994, 2015.
Mamshad Nayeem Rizve, Kevin Duarte, Yogesh S Rawat, and Mubarak Shah. In defense of pseudo- labeling: An uncertainty-aware pseudo-label selection framework for semi-supervised learning. In International Conference on Learning Representations, 2021.
Amit Roy, Juan Shu, Olivier Elshocht, Jeroen Smeets, Rugi Zhang, and Pan Li. GAD-EBM: Graph anomaly detection using energy-basee models. NeurlPS 2023 Workshop: New Frontiers in Graph Learning, 2023.
Fengzhao Shi, Yanan Cao, Yanmin Shang, Yuchen Zhou, Chuan Zhou, and Jia Wu. H2-fdetector: A based fraud detector with homophilic and heterophilic connections. In Proceedings of the ACM web conference 2022, pp. 1486-1494, 2022.
Zhengxiang Shi, Francesco Tonolini, Nikolaos Aletras, Emine Yilmaz, Gabriella Kazai, and Yunlong Jiao. Rethinking semi-supervised learning with language models. In Findings of the Association for Computational Linguistics: ACI. 2023, pp. 5614-5634, 2023.
14

---

Published as a conference paper at ICLR 2026
Jianheng Tang, Jiajin Li, Ziqi Gao, and Jia Li. Rethinking graph neural networks for anomaly detection. In International Conference on Machine Learning, pp. 11076-210899 PMLR, 2022.
Jianheng Tang, Fengrui Hua, Ziqi Gao, Peilin Zhao, and Jia Li. Gadbench: Revisiting and bench- marking supervised graph anomaly detection. Advances in Neural Information Processing Systems, 36:29628 29653,, 2023.
Shantanu Thakoor, Corentin Tallec, Mohammad Gheshlaghi Azar, Mehdi Azabou, Eva L Dyer, Remi Munos, Petar Veličković, and Michal Valko. Large-scale representation learning on graphs via bootstrapping. In International Conference on Learning Representations, 2022.
Petar Veličković, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Liò, and Yoshua Bengio. Graph attention networks. In International Conference on Learning Representations, 2018.
Petar Veličković, William Fedus, William I.. Hamilton, Pietro Liò, Yoshua Bengio, and R Devon Hjelm. Deep graph infomax. In International Conference Learning Representations, 2019.
Minjie Wang, Da Zheng, Zihao Ye, Quan Gan, Mufei Li, Xiang Song, Jinjing Zhou, Chao Ma, Lingfan Yu, Yu Gai, al. Deep graph library: A graph-centric, highly-performant package for graph neural networks. arXiv preprint arXiv: 2019.
Qizhou Wang, Guansong Pang, Mahsa Salchi, Wray Buntine, and Christopher Leckie. Cross-domaa graph anomaly detection via anomaly- contrastive alignment. In Proceedings of the AAAI Conference on Artificial Intelligence, pp. 4676-4684, 2023.
Qizhou Wang, Guansong Pang, Mahsa Salehi, Xiaokun Xia, and Christopher Leckie. Open-set graph anomaly detection via normal structure regularisation. In ICLR, 2025.
Xiyuan Wang and Muhan Zhang. How powerful are spectral graph neural networks. In International conference on machine learning, 2022.
Yanling Wang, Jing Zhang, Shasha Guo, Hongzhi Yin, Cuiping Li, and Hong Chen. Decoupling representation learning and classification for gan-based anomaly detection. In Proceedings of the 44th international ACM SIGIR conference on research and development in information retrieval, pp. 1248, 2021.
Mark Weber, Giacomo Domeniconi, Jie Chen, Daniel Karl I Weidele, Claudio Bellei, Tom Robin- son, and Charles E Leiserson. Anti-money laundering in bitcoin: Experimenting with graph convolutional networks for financial forensics. arXiv preprint arXiv: 025511 2019.
Keyulu Xu, Weihua Hu, Jure Leskovec, and Stefanie Jegelka. How powerful are graph neural networks? In International Conference Learning Representations, 2019.
Hengrui Zhang, Qitian Wu, Junchi Yan, David Wipf, and Philip Yu. From canonical correlation analysis to self-supervised graph neural networks. Advances in Neural Information Processing Systems, 34:76-89, 2021.
Jianbo Zheng, Chao Yang, Tairui Zhang, Longbing Cao, Bin Jiang, Xuhui Fan, Xiao-ming Wu, and Xianxun Zhu. Dynamic spectral graph anomaly detection. In Proceedings of the AAAI Conference on Artificial Intelligence, pp. 13410-15 1341-1111, 2025a.
Yilun Zheng, Xiang Li, Sitao Luan, Xiaojiang Peng, and Lihui Chen. Let your features tell the differences: Understanding graph convolution by feature splitting. In The Thirteenth International Conference on Learning Representations, 2025b.
Shuang Zhou, Xiao Huang, Ninghao Liu, Huachi Zhou, Fu-Lai Chung, and Long-Kai Huang. Improving generalizability graph anomaly detection models via data augmentation. IEEE Transactions Knowledge and Data Engineering, 35 1221111322 2023.
Yanqiao Zhu, Yichen Xu, Feng Yu, Qiang Liu, Shu Wu, and Liang Wang. Deep graph contrastive representation learning. arXiv preprint 2006042006.4431,,, 2020.
15

---

Published as a conference paper at ICLR 2026
Yanqiao Zhu, Yichen Xu, Feng Yu, Qiang Liu, Shu Wu, and Liang Wang. Graph contrastive learning with adaptive augmentation. Proceedings of the web conference 2021, pp. 1069-2080, 2021.
Wei Zhuo, Zemin Liu, Bryan Hooi, Bingsheng He, Guang Tan, Rizal Fathony, and Jia Chen. Partitioning message passing for graph fraud detection. In The Twelfth International Conference on Learning Representations, 2024.
A USE OF LARGE LANGUAGE MODELS
In accordance with the ICLR 2026 Policies Large Language Model Usage, we disclose that Large Language Models (LLMs) were employed during the preparation this manuscript. Specifically, LLMs were used to (i) check grammar and spelling, (ii) improve clarity and conciseness of sentences, (ii) format tables for consistency, and (iv) shorten certain passages to reduce redundancy. Importantly, LLMs were not used to generate research ideas, design experiments, analyze results, draft new scientific content. The authors remain fully responsible for all claims, findings, and conclusions presented in this work.
B DETAILED PRELIMINARIES
given an attributed graph G E, X),, where V (u,,... ,,,, is the set of n nodes, & = {ez }o is the set of edges, and Cjj = (v;, 12) represents an edge between nodes e; and Uz. We define A as the corresponding adjacency matrix and D as the diagonal degree matrix with Dü: = d: = E; Aij. The neighbor set N, of each node ;; is given by M₁ = {uz Cij E}. For each node Us. it has d-dimensional feature vector æ; R., and collectively the features of all nodes are denoted as X (I1, Ix,) Raxd
Notations. In general scenario,
Graph Anomaly Detection. GAD is formulated as a binary classification problem where anomalies regarded as positive with label I, while normal nodes are negative with label O. Given V Va U Vn. where V, consists of labeled abnormal nodes and V, comprises labeled normal nodes, along with their corresponding labels y the goal is to identify the anomalous status g" for the unlabeled nodes y = VV V² Usually. obtaining authentic labels often costly, we assume that label information is only available for small subset of nodes (i.e., |/ << VV). Furthermore, there are usually significantly fewer abnormal nodes than normal nodes (i.e.. Val (V.l).
Graph Spectral Filtering. Given the adjacency matrix A, the graph Laplacian matrix is defined as = D A. which is symmetric and positive semi-definite. Their symmetric normalized versions are noted as À = AD AD-1/2 112 and İ = I 1-2 -D112 Its eigendecomposition is given by L U YUUT. where the columns of U E R are orthonormal eigenvectors (graph Fourier basis), and A diagg() (X1, λ2,... An)) contains the eigenvalues (frequencies), arranged such that 0 = A v X S ... < An Given the graph features X and a filter function g()), the corresponding
filtered features is thus defined as X = U-(AAU X.
Typically. À acts low-pass filter with g(A) = X, while - À and L serve high-pass filters, and (A) X, respectively. practice, self-loop often added to each node in the graph (i.c., A A + I) to alleviate numerical instabilities and improve performance Kipf & Welling 2017).
with (
C RELATED WORKS
C.1 GRAPH ANOMALY DETECTION
GNN-based approaches have emerged promising paradigm for GAD, due to their strong ability to capture both complex structural and node attribute patterns graph data. A comprehensive and up-to-date survey of deep GAD methods is provided in (Qiao al. 2025b), while BOND (Liu et al. 2022) and GADBench (Tang et al., 2023) establish performance benchmarks for unsupervised and semi-/supervised GAD approaches, respectively.
16

---

Published as a conference paper at ICLR 2026
Unsupervised GAD approaches do not rely on labeled data for training and instead use unsupervised learning techniques to identify anomaly patterns in graph data. For instance, DOMINANT (Ding et al. 2019) employs graph autoencoder to reconstruct both attributes and structure using GNNs. CoLA (Liu et al. 2021b) explores the consistency between anomalies and their neighbors across different contrastive views assess node irregularity. VGOD (Huang et al. (2023) combines variance- based and attribute reconstruction models to detect anomalies in a balanced manner. TAM (Qiao) & Pang 2023) introduces local affinity as an anomaly measure, aiming
learn tailored node representations for GAD by maximizing the local affinity between nodes and their neighbors. GAD- EBM (Roy et al. 2023) evaluates the likelihood of normal and anomalous nodes address GAD with an energy- based model. DiffGAD (Li et al., 2025) leverages diffusion sampling to infuse the latent space with discriminative content and introduces a content-preservation mechanism that retains valuable information across different scales for GAD.
Semi-/supervised GAD approaches assume that labels for some normal and abnormal nodes are available for training. They aim to assign labels by learning decision boundary between normal and abnormal nodes. For example, BWGNN (Tang et al. 2022) uses a Beta graph wavelet to learn band-pass filters that capture anomaly signals, while DSGAD (Zheng al. 2025a) extends BWGNN with dynamic wavelets and feature fusion. AMNet (Chai et al. (022)) employs a restricted Bernstein polynomial parameterization approximate filters in fueeueyrr groups. CARE-
GNN (Dou et al.) 2020), PCGNN (Liu et al., (221a), and GHRN (Gao et al.) (023) adaptively prune inter-class edges based on neighbor distributions or the graph spectrum. PMP (Zhuo et al.) 2024) introduces a partitioned message-passee
mechanism to handle homophilic and heterophilic neighbors independently. To address settings with limited labeled data, CGenGA (Ma et al. 2024) proposes diffusion- based graph generation method to synthesize additional training nodes, while ConsisGAD (Chen et al., 2024b) incorporates learnable data augmentation to utilize the abundance of unlabeled data for consistency training. GGAD (Qiao et al., (0024) introduces novel semi- supervised framework using only labeled normal nodes. Space Dong et al. (2025) combines space projection, distance-aware propagation, and ensemble mechanisms across multiple latent spaces to improve generalization. It is worth noting that some approaches can also address label scarcity by leveraging auxiliary data, such as cross-netwond meta-learning (Meta-GDN (Ding et al. (022b) or cross-domain adaptation (Commander (Ding et al., 2021a), ACT (Wang et al. 2003)). In contrast, our proposed APF targets the single-graph setting where no external auxiliary networks source domains are available, relying instead on mining intrinsic anomaly signals from unlabeled nodes within the target graph.
Additionally, several works have explored GAD within the pre-training and fine-tuning paradigm. DCI (Wang et al. 202T) decouples representation learning and classification through a cluster- enhanced self-supervised learning task. Cheng et al.] (2024) evaluates the performance of DGI /Veličković et al.] 2019) and GraphMAE (Hou et al. 2022) for GAD, demonstrating the potential of leveraging graph pre-training to enhance GAD with limited supervision. However, most existing methods pre-train a uniform global low-pass filter (e.g., GCN (Kipf & Welling 2017)) and then fine-tune classifier on frozen node representations. The homophily disparity in GAD presents a significant challenge for directly applying these methods. To address this, we propose a pre-training and fine-tuning framework tailored for GAD.
In addition to the above work, PReNet (Pang et al. 2023) and NSReg (Wang et al. 2025) aim to identify anomalies whose patterns differ from labeled led examples by enforcing strong normality modeling. GDN-AugAN (Zhou et al. (202)) enhances cross datss-dttaset robustness through augmentation- based domain generalization. UniGAD (Lin al. 2024), ARC (Liu et al.) 2024a), UNPrompt (Niu) et al. 2025), and AnomalyGFM (Qia et al. (222a) have explored foundation models for generalist GAD. While UniGAD (Lin al., 2024) also employs a Rayleigh Quotient-based sampler. uses the sampler as unification tool to transform node/edge tasks into graph tasks for multi-level detection. In contrast, APF utilizes the sampler specifically to inject anomaly awareness during pre-training to address label scarcity in node anomaly detection.
C.2 GRAPH TRE-TRRINING
Graph pre-training has emerged promising paradigm for label-efficient learning (Cheng et al. 2023, Ju et al., 2024). These methods first learn universal knowledge from unlabeled data using self-supervised objectives, which are then transferred to tackle specific downstream tasks. Existing
17

---

Throughout the proof, we Published as a conference paper at ICLR 2026
pre-training approaches can be broadly categorized into two groups: contrastive and non-contrastive approaches.
Contrastive approaches typically follow the principle of mutual information maximization (Hjelm
ct al. 2019), where the objective functions contrast positive pairs against negative ones. For instance,
DGI Veličković et al., 2019) and DCI (Wang al. 202T focus representation learning by
maximizing the mutual information between leve- representations and a global summary representation. GRACE (Zhu al. (020)), GCA (Zhu al. 202T), and NS4GC (Liu al. (024b) learn node representations by pulling together the representations of the same node (positive pairs) across two augmented views, while pushing apart the representations of different nodes (negative pairs) across both views.
Non-contrastive approaches, on the other hand, climinate the need for negative samples. For example, CCA-SSG (Zhang et al. (021) and G-BT (Bielak et al. (2022) aim to learn augmentation-invan invarriannnnn information while introducing feature decorrelation to capture orthogonal features. BGRL (Thakoor al. 2 and BLNN (Liu et al. (2224d) employ asymmetric architectures that learn node repre- sentations by predicting alternative augmentations of the input graph and maximizing the similarity between the predictions and their corresponding targets. GraphMAE Hou et al. (2022) focuses on feature reconstruction using a masking strategy and scaled cosine error. Additionally, SSGE (Liu et al. 2024ch minimizes the distance between the distribution of learned representations and the isotropic Gaussian distribution to promote the uniformity of node representations.
However, the methods discussed above rely low-pass GNN encoders that inherently smooth neighbor representations, leading to unsatisfactory performance on heterophilic abnormal nodes. Although recent work, PolyGCL (Chen al., 2024a), employs both low- and high-pass encoders, combines them using simple linear strategy to obtain final node representations for fine-tuning. This approach is less flexible and effective than our proposed node- and iemeesiionaddptiii fine-tuning strategy, as demonstrated in Theorem
D LIMITATIONS
While APF demonstrates strong performance across wide range of benchmarks, exhibits limita- tions in certain scenarios. Specifically, APF underperforms tree-based models such as XGBGraph on datasets like Amazon and Elliptic, where node features are highly heterogeneous and dominate over structural signals. This suggests that in such cases, tree-based models, known for their robustness to feature heterogeneity, may outperform deep learning- GNNs Grinsztajn et al. (2022). Future work could explore hybrid architectures that better integrate rich tabular features with graph topology.
Moreover, although APF is designed as a tailored framework for graph anomaly detection and holds promise in real-world applications such as financial fraud and cybersecurity, false positives remain concern. Misclassifying normal nodes as anomalies may lead to unnecessary disruptions or adverse consequences for benign users. Addressing such risks requires further research into uncertainty quantification and trustworthy anomaly detection in graph settings.
E PROOF OF THEOREM 1
Proof. We extend the argument Baranwal al. (2021) from a single-patter CSBM the mixed- pattern, bggree-corrected, and class- dass-imbalancee ASBM in Definition
make the following standard assumptions:
the graph size is relatively large with wol d) S n.s S Opoly((d);
2. sparsity level obeys Pl, q1 P2, 92 = wlog² n/n));
3. degree parameters are bounded and centered as 0min S 0, S 0max with x 9max//min (1) and E 2, = 1 for 2; E {a, n):;
4. class prior is imbalanced with F. na n na-
18

---

Published as a conference paper at ICLR 2026
Following Baranwal et al. (2021); Ma et al. (2022) Mao al. (2023); Han et al. (2024). adopt
the aadom-walk operator S = D A as a low-pat ww-pass filter and its negative - S as high-pass filter. Concretely, each node 0; assigned a spectral filter function g(-) depending on its pattern: g()) if E Ho (homophilic), and g(A) - if tq E He (heterophilic), This yields the node-adaptive filtered features X UA) X.
Concentration under degree correction. Let degree dN = -E, Asy and recall that, conditional on
(zs, hi), we have E[[Ai Fi, Ej, ht] 0,0, B,0,B Standard Bernstein (Chung & Lu 2006 Lei & Rinaldo 2015 bounds with bounded 0 and wlog" n/n) sparsity yield
((a)) d; 0: 1 ((he) Tn 2..1)
(1 + o(1))
where B. = ((h). Hence for any node and any unit vector w,
1 Σ A, X, = ([|X 24 k.ltE)). X. = di
(E., w)) =
=0 log d
=o(v =V(Vano,
= =0
log
with K; == TaPena + Tn T effective average connectivity under imbalance be
(ba) The sign + corresponds to low- vs. high-pass filtering. Let the
Keff = min { TaPi + Tnhi, TaQi + TaPi, TaP2 + Ta TaQ2 + TnP2).
Using 0 Omin and 2 Keff, obtain the uniform deviation bound (Baranwal et al. 2021
cV
log d Rieff
| - E[X; 25s hi]. wi)
(14)
matching the CSBM rate up the effective factor Keff-
Pattern-dependent means after node-adaptive filtering. Condition on 2 and hG. A neighboring node vj belongs to class with probability proportional to 0, and to class with probability proportional to 0, a(hh) By (iii) and bounded heterogeneity x = ((),, the neighbor-class proportions concentrate
Ta (11)
(hc)
(he)
(la)
Wia
(kc)
(h.)
Wi,
wia
Ta
Thus the low-pass mean is a degree-normalized mixture
E[SX]:
Wia la Win
(h.)
(lh)
(1 + o(1)) o1))
while the high- pass mean flips the sign: h; (homophily):
E[-SX} -E[SX); Enumerating cases gives, for
T.p.p-s.gLL +uag
(1
2, = a,
E
(1 o()), 2,
R. F.P1
and for h; e (heterophily) the same expressions with (p1 (1) replaced by (p2, 92). followed by an overall sign flip due to the high-pass ()S). Consequently, under the node-adaptive choice (low-pass on H. and high-pass on Ho), all class-wise means align in the same ordering along direction v fa:
E x = a], 11) < E X;
= =n] 14),
with a gap proportional to A a.Pa + qs + tuaps
Pp mnl
(here h E {1,2} indexes (p1. qi) or lpa -ul and independent of due to the Pa aa
(2)) hence lower bounded by constant multiple of random-walk normalization.
19

---

Published as a conference paper at ICLR 2026
Prior-aware linear separator and margin. Consider the linear classifier with direction w R -- and a bias that accounts for the class prior shift
6" Ft + v,
Ta log (T/ Ta)
Tw
2
1 ml
The additive term T is the standard LDA correction under unequal priors with spherical covari- ances (Hastie et al. 2009). For any E Ca, combining Step 2 and Eq 14 gives
(Xi, w") = (B[X; 2, a], w") (1 V, w=)
Tn + X;
1) w"
2
fluctuation
R R KA 11 wll (1)) + Ta + oRR
log a datt
2
where l',, > 0 depends on the pattern (homophily heterophily) via the mixture coefficients in Step 2 (and is uniformly bounded away from as [PA - qal > 0). For E Cn the sign of the leading term is positive. Hence, if the feature center distance satisfies
log
|| wI 2
dn Kelf
for a sufficiently large constant > 0, the margin term dominates both the stochastic fluctuation
OBV
log'
and the prior correction
OX R (og(Ta/T))l/Il
=ll) even when To & Th.
d
Therefore, according part 2 of Theorem in Baranwal et al. (2021). sign((X w²) + b*) equals the true label for all nodes with probability (1) by union bound over U; E V. This establishes linear separability of node-adaptively filtered features under degree correction and class imbalance, proving the theorem.
F FORMULATIONS OF FUSION METHODS
Here, we provide the mathematical formulations of the fusion methods described in Section 4.3 These fusion methods aim to generate overall node representations Z by combining the representations generated by the low-pass encoder (Z "X" and high-pass encoder (Z h [R=
The "Mean" method averages the representations from the low-pass and high-pass encoders, i.e., Z 0.5 (Z + Z.).
The "Concat" method concatenates the representations from the low-pass and high-pass encoders. i.e., Z 1Z zb.
Chai et al. (2022) employs an attention mechanism to learn the weights The "Atten." method Chhii
or,, E [0, 10,1]xx1 for nodes, such that Z ar Zz. as Zn. Specifically, for node i; with Z z ige the attention scores are computed as:
wf =q -tanh tanh ! + W
(15)
w " = q tanh ( 2 + W x
where W4 W Re'xe and W X W B are learnable parameter matrices, and q E R x1 the shared attention vector. The final attention weights of node e; are obtained by normalizing the attention values using the softmax function:
exp(uf)
a exp(wt) + exp(w(f)
(16)
"1 exp(w,") 0. exp(w!t) + exp(w!f)
G TIME COMPLEXITY
We analyze the time complexity of proposed APF framework by dividing the computation into three stages. Let n and m denote the number nodes and edges in the graph, respectively, and let K be the order of the spectral polynomial filters.
20

---

Published as a conference paper at ICLR 2026
Preprocessing. We first extract Rayleigh Quotient-guidde subgraph _: for each node using the MRQSampler Lin et al. 22024). which has a total complexity of O( log n). Since the sampling for cach node is independent, this step can be parallelized to further reduce runtime. Importantly, this subgraph sampling is performed only once and reused in both training and inference, thereby introducing minimal overhead.
Pre-training. The coefficients of the polynomial filters in APF can be precomputed in time linear to K. Given that K-order spectral filters propagate information across K hops, the filtering process requires O(K + Kn) time. The loss function Lyc. which operates over all nodes and edges, incurs an additional O(n + m) cost. The overall time complexity of the pre-training stage is therefore O(KK (m + n)), which scales linearly with the graph size and filter order.
Fine-tuning. The gated fusion network computes adaptive coefficients with complexity O(n), and the two-layer MLP used for classification adds another ((2)). ). The anomaly-aware loss ft involves only the labeled nodes and thus contributes Ol), where / is the number of labeled nodes. The total fine-tuning complexity is O(3n + l).
In summary, the pre- vre-training and fin-tuning phases of APF scale linearly with the graph size. Given that the subgraph extraction is only performed once and can be computed in parallel, APF exhibits strong scalability and well-suited for large-scale graphs. For example, our model can be applied to datasets like T-Social, which contains over 5.7 million nodes and 73 million edges. We additionally conduct efficiency comparison in Appendix L.3
H ADDITIONAL EXPERIMENTAL DETAILS
H.1 DATASETS
Following GADBench Tang et al. 2023), we conduct experiments on 10 real-world datasets span- ning various scales and domains. Reddit Kumar al. (2019), Weibo Kumar al. (2019), Ques- tions Platonov et al. (2023). and T-Social Tang et al. (2022) focus on detecting anomalous accounts on social media platforms, Tolokers Platonov ToltoersPPaaoonv al. (2023 Amazon McAuley & Leskovee (2013).
and YelpChi Rayana & Akoglu (2015) are designed to identify fraudulent workers, reviews, and reviewers in crowdsourcing or e-commerce platforms. T-Finance Taag et al. (2022), Elliptic Weber
et al.) (2019), and DGraph-Fin Huang et al. (2022) target the detection of fraudulent users, illicit entities, and overdue loans in financial networks. Dataset Statistics are presented Table 4 Detailed descriptions of these datasets are as follows.
Reddit Kumar al. (2019): This dataset includes a user-subreddit graph, capturing one month's 's worth of posts shared across various subreddits. It includes verified labels for banned users and focuses on the 1,000 most active subreddits and the 10,000 most engaged users, resulting in 672.447 interactions. Posts are represented as feature vectors based on Linguistic Inquiry and Word Count (LIWC) categories.
Weibo Kumar et al. ( This dataset consists of a user-hashtag graph from the Tencent- Weibo platform, containing 8,405 users and 61,964 hashtags. Suspicious activities defined as posting two messages within a specific time frame, such as 60 seconds. Users engaged in at least five such activities are labeled as "suspicious," while others are catego- rized as "benign." The feature vectors are based on the location of posts and bag-of-words features.
Weibo/Kumar
This dataset focuses on detecting users who are paid to write fake reviews for products in the Musical Instrument category on Amazon.com It contains three types of relationships: U-P-U (users reviewing the same product), U-S-U (users giving the same star rating within one week), and U-V-U (users with top 5% mutual review similarities).
Amazon McAuley & Leskoved 20033::
YelpChi Rayana & Akoglu (201)): This dataset aims to identify anomalous reviews on Yelp.com that unfairly promote or demote products businesses. It includes three types of edges: R-U-R (reviews by the same user), R-S-R (reviews for the same product with the same star rating), and R-T-R (reviews for the same product within the same month).
21

---

Published as a conference paper at ICLR 2026
Table 4: Dataset statistics including the number of nodes and edges, the node feature dimension, the ratio of anomalies, the local homophily, the concept of relations, and the type of node features. h", and h" represent the average local homophily for abnormal nodes and normal nodes respectively. As shown, htth is much smaller than h², highlighting the presence of class-level local homophily disparity. "Mise." refers to node features that are combination of heterogeneous attributes, which may include
categorical, numerical, and temporal information.
Dataset
#Nodes
#Edges
#Feat.
Anomaly
ht
4"
Relation Concept
Feature Type
Reddit
10,984
168,016
64
3.3%
0.000
0.994
Under Same Post
Text Embedding
Weibo
8,405
407,963
400
10.3%
0.858
0.977
Under Same Hashtag
Text Embedding
Amazon
11,944
4,398,392
25
9.5%
0.102
0.968
Review Correlation
Misc. Information
YelpChi
45,954
3,846,979
32
14.5%
0.195
0.867
Reviewer Interaction
Misc. Information
T-Finance
39,357
21,222.543
10
4.6%
0.543
0.976
Transaction Record
Mise. Information
Elliptic
203,769
234,355
166
9.8%
0.234
0.985
Payment Flow
Misc. Information
Tolokers
11,758
519,000
10
21.8%
0.476
0.679
Work Collaboration
Misc. Information
Questions
48,921
153,540
301
3.0%
0.111
0,922
Question Answering
Text Embedding
DGraph-Fin
3,700,550
4.300,999
17
1.3%
0.013
0,997
Loan Guarantor
Misc. Information
T-Social
5,781,065
73,105,508
10
3.0%
0.174
0,900
Social Friendship
Mise. Information
T-Finance Tang et al. (2022): : This dataset is designed to detect anomalous accounts in transaction networks. The nodes represent unique anonymized accounts with 10-dimensional features related to registration days, login activities, and interaction frequency. Edges represent transactions between accounts, and anomalies annotated by human experts based on categories such as fraud, money laundering, and online gambling.
Elliptic Welie al. (219)): This dataset includes over 200,000 Bitcoin transactions (nodes), 234, ,000 directed payment flows (edges), and 166 node features. It maps Bitcoin transactions to real-world entities, categorizing them as either licit (e.g., exchanges, wallet providers, miners) illicit (e.g., scams, malware, terrorist organizations, ransomware, and Ponzi schemes).
Tolokers Platonov et (023): ) This dataset is derived from the Toloka crowdsoureing platform. Nodes represent workers who have participated in at least one of 13 selected projects. An edge connects two workers if they collaborate on the same task. The goal is to predict which workers were banned in any of the projects. Node features are based on worker profiles and task performance.
Questions Platonov al. (2023): This dataset is collected from the Yandex Q question- answering platform. It includes users as nodes, with edges representing answers between users during one-year period (September 2021 to August 2022). It focuses on users interested in the "medicine" topic. The task is to predict which users remained active by the end of the period. Node features include the mean of FastTText embeddings for words in the user descriptions, with binary feature indicating users without descriptions.
DGraph-Fin Huang et al. (2022): This dataset is large-scale dynamic graph from the Finvolution Group representing financial industry social network. Nodes represent users, and edges indicate emergency contact relationships. Anomalous nodes correspond to users exhibiting overdue behaviors. The dataset includes over million nodes, 4 million dynamic edges, and more than 1 million unbalanced ground-truth anomalies.
T-Social Tang et al. (2022): This dataset targets anomalous accounts in social networks. Nodes share the same annotations and features as those in T-Finance, with edges representing friend relationships maintained for more than three months. Anomalous nodes are annotated by experts in categories like fraud, money laundering. and online gambling.
H.2 BASELINES
We compare our model with a series baseline methods, which can be categorized into the fol-
lowing groups: (1) Standard GNN Architectures, including GCN Kipf & Welling (0017), GIN Xu
et al. 2019). GAT Veličković et al. (2018), ACM Luan et al.) (2022). , FAGCN Bo et al. (021)) AdaGNN Dong al. (2021). and BernNet He et al. (2021): ; (2) GNNs Specialized for GAD, includ- ing GAS Li et al. (2019), DCI Wang et al. (2021), PCGNN et al. (2021a). AMNet Chai ct al.
2022). BWGNN Tang et al. 2022), GHRN Gao et al. (003)) ConsisGiD Chen et al. (004bb).
22

---

Published as a conference paper at ICLR 2026
20.
Abroria
25
Abroma
Abromna
-00
15
20
10.
10.
0.00
0.25
0.50 2:75
2.00
6:00
0.15
0.50
1.50
0.29
0.50
0:15
202
0.00
0,50
0.15
1.00
0.00
0.25
6.75 Lorel liomsphlly
0.50
Local Hommphll
loca flomephlly
Locd Homoppily
Local fiomophlly
(a) Reddit
(b) Weibo
(c) Amazon
(d) YelpChi
(e) T-Finance
140
Nurmal
Abnomal
2.
Abrarral
10-
Abnorm
120-
20. Aanomall
Abnerma
2725
20
Den
Donstr
100
t0-
615
0.5
20
8.00
6.5
0.50
2.75
6.50
0.25
0.50
1.50
0.25 Local Homophily
0.50
0.75
3.02
5.50
525
0.52
0.75
1.50
6.00
0.5
5.50
6:75
Local Homophily
Local Homophity
Local Homophity
Local Homophily
(f) Ellipticc
g Tolokers
(h) Questions
DGraph-Fin
i T-Sncial
Figure 5: Distribution of local homophily across different datasets. GAD graphs display two levels of
local homophily disparity: (1) Different nodes exhibit varying degrees of local homophily (node-level) and (2) Abnormal nodes tend to show lower local homophily than normal nodes (class-level). On Reddit, we only plot the distribution of local homophily for normal nodes, since the local homophily of all abnormal nodes is O.
SpaceGNN Dong et al. (2025), ) and XGBGraph Tang et al. (2023); (3) Graph Pre- Tec-Trainig Methods, including DGI Veličković et (2019). GRACE Zhu al. (2020). G-BT Bielak et al. (2022). }. Graph-
MAE Hou et al. (2022), BGRL Thakoor et al. 2022), SSGE et al. (002cc), PolyGCL Chen et al. (2024a), and BWDGI which incorporates BWGNN and DGI. Detailed descriptions of these baselines
are as follows.
H.2.1 STANDARD GNN ARCHITECTURES
GCN & Welling 2017) employs a convolutional operation on the graph to propagate information from each node to its neighboring nodes, enabling the network learn representation for each node based on its local neighborhood.
GIN Xu al. (019) designed capture the structural properties of graph while preserving graph isomorphism. Specifically, it generates identical embeddings for graphs that are structurally identical, regardless of permutations in node labels.
GAT Veličković et al. (2018) incorporates an attention mechanism, assigning different levels of importance to nodes during the information aggregation process. This allows the model to focus on the most relevant nodes within a neighborhood.
ACM Luan al. (2022) leverages low-, high, and full-pass spectral filters and attention- based mixing mechanism to adaptively extract richer localized information for diverse node heterophily situations.
FAGCN Bo et al. (202T) adaptively integrates low- wwwfrequency and through self-gating mechanism. This approach enhances the model's ability handle both homophilic and heterophilic networks.
signals
AdaGNN et al. (2021) leverages adaptive frequency response filter to capture the varying importance of different frequency components for node representation learning. This approach improves the expressiveness of the model and alleviates the over-smoothing problem.
BernNet He et al. 2021 provides robust framework for designing and learning arbitrary graph spectral filters. It uses an order-K K Bernstein polynomial approximation to estimate filters over the normalized Laplacian spectrum of a graph.
23

---

Published as a conference paper at ICLR 2026
H.2.2 GNNs SPECIALIZED FOR GAD
GAS Li et al. (209)) is highly scalable method for detecting spam reviews. extends GCN to handle heterogeneous and heterophilic graphs and adapts to the graph structure of specific GAD applications using the KNN algorithm.
DCI Wang et al. ) reduces inconsistencies between node behavior patterns and label semantics, and captures intrinsic graph properties within concentrated feature spaces by
clustering the graph into multiple segments,
PCGNN Liu et al. (2021a) uses label-balanced sampler to select nodes and edges for training, ensuring balanced label distribution in the induced subgraph. Additionally, it employs learnable, parameterized distance function to select neighbors, filtering out redundant links while adding beneficial ones for improved fraud prediction.
AMNet Chai et al. (0222) captures both low- and high-frequency signals by stacking multiple BernNets, adaptively combining signals from different frequency ranges.
BWGNN Tang et al. (2022) addresses the "right-shift" phenomenon in graph anomalies,
where spectral energy distribution shifts from low to high frequencies. uses a Beta kernel to address high-frregu tiegurryy anomalies through flexible, spatially- and spectrally-localize band-pass filters.
Gao al. 2023) targets the heterophily problem in the spectral domain for graph This method prunes inter-class edges highlight and delineate the graph's 's high-freyuency components.
GHRN
anomaly detection.
ConsisGAD Chen et al. (2024b) focuses on graph anomaly detection with limited supervi- sion. It incorporates learnable data augmentation utilize the abundance of unlabeled data for consistency training.
SpaceGNN Dong et al. (2025) integrates learnable space projection, distance-aware propa- gation, and multiple space ensemble modules to leverage the benefits of different spaces (Fuclidean, hyperbolic, and spherical) for node anomaly detection with extremely limited labels.
XGBGraph Tang et al. (2023) first aggregates features from neighboring nodes to enhance the representation of each node, and then uses XGBoost Chen & Guestrin (2016) to classify nodes as normal or anomalous. This approach leverages the robustness and efficiency tree ensembles while incorporating graph structure to improve anomaly detection performance.
H.2.3 GRAPH PRE-TRAINING METHODS
DGI Veličković al. 2019) learns representations by maximizing the mutual information between node representations and a global summary representation.
GRACE Veličković al. (2019) learns node representations by pulling together the rep- resentations of the same node (positive pairs) across two augmented views, while pushing apart the representations of different nodes (negative pairs) across both views.
masked graph auto-encoder that focuses feature reconstruction using both a masking strategy and scaled cosine error.
GraphMAE Hou et al. (2022)
BGRL Thakoor et al. (2022) employs asymmetric architectures to learn node representations by predicting alternative augmentations of the input graph and maximizing the similarity between these predictions and their corresponding targets.
G-BT Bielak et al. 2022) utilizes cross-correlation based loss function to reduce redun- dancy the learned representations, which enjoys fewer hyperparameters and significantly reduced computation time.
SSGE Liu et al. (2024c) minimizes the distance between the distribution of learned rep- resentations and an isotropic Gaussian distribution, promoting the uniformity node representations.
PolyGCL Chen et al. (2024a) addresses heterophilic challenges in graph pre- pre-training by using polynomial filters as encoders and incorporating a combined linear objective between low- and high-frequency components in the spectral domain.
24

---

Published as a conference paper at ICLR 2026
BWDGI pre-traine the State-of-the-ar GAD backbone BWGNN Tang et al. (2022) using DGI Veličković et al. (2019) as the pretext objective.
H.3 EVALUATION PROTOCOLS
Following GADBench Tang al. 2023), evaluate performance using three popular metrics: the Area Under the Receiver Operating Characteristic Curve (AUROC), the Area Under the Precision- Recall Curve (AUPRC) calculated via average precision. and the Recall score within the top-K' predictions (Ree@ K). Here, K corresponds to the number of anomalies in the test set. We prioritize these
(AUROC, AUPRC) and rank-based (Rec@ K) metries to avoid the instability associated with selecting decision thresholds under label-scarce conditions. For all metrics, anomalies treated the positive class, with higher scores indicating better model performance. To closely simulate real-world scenarios with limited supervision, we strictly adhere the semi-supervised setting defined in GADBench. Accordingly, training/validation set across all datasets to include 100 labels - 20 positive (abnormal) and 80 negative (normal) labels Tang et al. (023). This specific configuration ensures our results are directly comparable to the semi-supervised benchmarks reported in the GADBench Appendix (Table 11). To ensure the robustness of our findings, we perform 10 random splits, as provided by GADBench, on each dataset and report the average performance.
the F1 score
standardize the
H.4 IMPLEMENTATION DETAILS
We use the implementations all baseline methods provided by GADBench Tang et al. (2023) or the respective authors. Our APF model is implemented using PyTorch and the Deep Graph Library (DGL) Wang et al. (2019). Experiments are conducted on Linux server equipped with an Intel(R) Xeon(R) Gold 6248 CPU @ 2.50GHz and 32GB NVIDIA Tesla V100 GPU.
During the pre-training phase, each model is trained for up to 800 epochs using the Adam opti- mizer Kingma& & Ba (2015), with a patience of 20. Hyperparameters are tuned as follows: filter order (2,3), learning rate (0.01, 0.001, 0.0001], representation dimension E {32, 64), activation function {ReLU, ELU, PReLU, Tanh]. and normalization {none, batch, layer). For efficiency, we extract I-hop subgraphs instead 2-hop ones on denser or larger datasets Amazon, T-Finance, and T-Social.
During the fine-tuning phase, a 2-layer MLP classifier is trained for up to 500 epochs using the Adam optimizer Kingmaa & Ba (2015), with learning rate of 0.01 and weight decay selected from (0.0, 0.01, 0.0001). The classifier with the highest validation AUROC score is selected for testing. Regarding the regularization hyperparameters, while we conduct full grid search (pn, Pa [0, 1)) for the sensitivity analysis, we adopt an efficient strategy for practical tuning: we fix Pr. to high default value (e.g., 0.9 or 1.0) and perform small search for Pa (e.g., (0.0, 0.1, 0.2, 0.3, 0.4)). subject to
Pa < Pn. Our implementation codes are available at https:::p//........... /ttp:://gttia hub. com htmm//louddyl Cloddd1252/
APF
1 ADDITIONAL EXPERIMENTS
1.1 PRETRAINING-ONLY FOR UNSUPERVISED GAD
To further verify the effectiveness of our pre- pre-training, we also investigate its performance under purely unsupervised scenario where no anomaly labels are available. In this case, the pre-training stage remains unchanged. After obtaining the pre-trained low- and high-pass node representations, we directly concatenate them and feed the representations into Isolation Forest (IF) (Liu et al.) 2008), a widely used ensemble method for unsupervised anomaly detection, to derive anomaly scores for each node. This modification enables our framework to operate in label-free manner, aligning with common practice in unsupervised GAD.
We follow the evaluation pipeline of the unsupervised GAD benchmark BOND Liu al. 2022). and select the three datasets overlapping with ours: Reddit, Weibo, and DGraph. We incl ude comparisons with two recent state-of-the-art unsupervised baselines, GAD-EBM (Roy al. 2023)
25

---

Published as a conference paper at ICLR 2026
and DiffGAD (i al. 2025). Table reports AUROC results, where baseline numbers taken from the respective papers.
Table Unsupervised GAD results (AUROC %).
Method
Reddit
Weibo
DGraph
GAD-EBM Roy al.
2023
58.5#1.6
93.2+1.8
60.3+2.5
DiffGAD (Li et al. 2025
56.320.1
93.4+0.3
52.4#0.0
IF (raw feats) (Luu et al. IF + Our Pre-traiing
2008
45.2+1.7
53.5+2.8
60.9+0.7
59.9+2.4
93.1+1.8
63.320.6
Ours (Semi-superviise)
66.8+3.9
98.8+0.3
72,4+1.3
From the results, observe that: (i) pretraining substantially improves the performance of IF, which alone struggles to capture structural anomalies; (ii) our method surpasses the state-of- th-thh-art DifiGAD on Reddit and DGraph in the unsupervised setting: (iii) nevertheless, the semi-supervised version of our full framework still achieves the best performance, indicating that anomaly-aware pretraining brings general benefits while labels further boost detection accuracy.
Overall, these findings demonstrate that the proposed pre-training not only benefits semi-supervised settings but also provides clear gains in purely unsupervised anomaly detection, further validating its general effectiveness.
1.2 VISUALIZATION OF LEARNED REPRESENTATIONS
To provide more intuitive insights into the learned representations, apply t-SNE visualize the distributions of Z L. z and their fused representation Z. As shown in Figure 6 the results consistently reveal clear patterns: (i) the low-pass representation Z L and the high-pass representation Z typically occupy distinct and largely non non-overlapping regions in the embedding space, indicating that they capture complementary signals; (ii) the fused representation with both z, and Zu. suggesting that it effectively integrates information from both frequency domains. These visualizations thus provide direct evidence that the dual-filter encoding indeed extracts complementary information, and the adaptive fusion mechanism successfully combines them into more comprehensive node representations.
exhibits partial overlaps
(a) Reddit
(b) Weibo
(c) Amazon
(d) YelpChi
(e) T-Finance
(I) Elliptic
(g) Tolokers
(h) Questions
Figure 6: Visualization of the learned representations Zz. ZH. and Z.
I.3 EFFICIENCY COMPARISON.
We evaluate the training time and memory usage of APF on two large-scale datasets, YelpChi and Social, shown in Table 6 Compared to end-to-end models like GCN, AMNet, and BWGNN, APF
26

---

Published as a conference paper at ICLR 2026
incurs higher computational costs due to its pre-training phase. However, it remains efficient than GHRN, which performs fine- grained edge-level operations and thus consumes substantially more memory, particularly large graphs. When compared to models specifically designed for label-scarce settings, e.g. ConsisGAD and SpaceGNNN, our method demonstrates lower training time and comparable even lower memory usage. Overall, although APF introduces moderate computational overhead due to its two-stage design, the additional cost is justified by the significant gains in anomaly detection performance. These results demonstrate that APF is viable and scalable solution for real-world, large-scale GAD applications.
Table 6: Efficiency comparison in terms of training time and GPU memory.
YelpChi
T-Social
Model
Time (s)
Mem. (MB)
Time (s)
Mem. (MB)
GCN
1.93
547.73
61.75
13241 .26
AMNet
4.09
773.38
213.82
18970.04
BWGNN
2.66
729.17
112.01
16146.46
GHRN
3.22
3360.71
161.00
28080.33
ConsisGAD
89.28
16390.42
1674.87
14145.61
SpaceGNN
13.80
24217.29
1273.43
20518.91
APF
7.89
1370.62
569.35
26351.84
1.4 HYPERPARAMETER ANALYSIS
In addition to the adaptive fusion mechanism, our APF further introduces two hyperparameters, and Pa, which represent the expected preference for low-pass representations in abnormal and normal nodes, respectively. To assess their impact on our performance, we vary these hyperparameters from 0.0 1.0 in increments of 0.1. The results are presented in Figure 7 and It is observed that the right half of the heatmap, corresponding to relatively larger values, generally outperforms the left half. This aligns with the understanding that normal nodes benefit more from low-pass representations for generic knowledge, due to their strong structural consistency with neighbors. Additionally, the optimal combination of (Pa, Pn) always appears in the lower-right half of heatmap, where Pa I Pn- This indicates that abnormal nodes are assigned lower Pa values, thus placing greater emphasis on from the local context. These observations consistent with the intuition behind our adaptive fusion design: normal and abnormal nodes require different emphases of knowledge to maximize discriminabiliity Overall, Pa and Pn. provide simple yet effective way that consistently guides APF toward strong and stable anomaly detection performance with minimal tuning effort.
indicative components, which better capture their deviation
1.0
94.1
1.0
85,0
1.0
28.1
1.0
83.2
93.4
9233
27.5
01.4
0.6
0.6
0.6
0.6
6
92.8
79.7
26,9
79.5
92.1
77.0
0.2
26.4
0.2
77.7
0.0
0.0
0.2
0.4
0.6
0.8
1.0
91.4
0.0
0.0
0.2
0.4
0.5 0.8
1.0
74.3
0.0
0.0
0.2
044
0.6
0.8
1.0
25.8
0.0
0.0
0.2 0.4 0.6 0.8
75.8
Pn
Pn
Pa
Pn
(a) Weibo
(b) Amazon
(c) YelpChi
(d) T- T-Finance
Figure 7: How the AUPRC score varies with different values of and Pn.
I.5 UNDER VARYING SUPERVISION
This section evaluates the performance of APF under varying levels of supervision by modifying the number of labeled abnormal nodes. Following Tang al. (2023). the number of labeled normal nodes set to four times the number of labeled abnormal nodes. We present the results terms of AUPRC, AUROC, and Rec @ K in Figures 10 and 12 respectively. As expected, performance generally improves across all methods as the number of labeled nodes increases. Notably, APF delivers consistent improvements over baseline pre-training methods and surpasses the state-of-the-art GAD
27

---

Published as a conference paper at ICLR 2026
1.0
0.8
0.8
0.8
0.0
94.5
94.0
0.4
0.4
0.2
02
0.2
0.2
0.0
1.0
0.6
0.2
0.2
Pn
Pn
Pn
Pn
(a) Weibo
(b) Amazon
(c) YelpChi
(d) T- T-Finance
Figure How the AUROC score of APF varies with different values of Pa. and Pn-
1.0
1.0
79.2
0.8
0.8
0.8
0.8
77.4
6 0.4
0.4
0.4
0.4
0.2
0.2
0.2
0.0
0.0
1.0
0.0
0.6
0.2
0.2
Pn
Pn
(a) Weibo
(b) Amazon
(c) YelpChi
(d) T-Finance
Figure 9: How the @K score of APF varies with different values of pa and pn-
models, even with only 5 labeled abnormal nodes. This highlights the effectiveness our approach in addressing GAD with limited supervision.
BWGNN
ConsisGAD
DGI
G-BT
APF
Reddit
Amazon
Tolokers
Questions
40
60
10
5
20
10
40
10
20
40
5
10
20
40
Labeled Anomalies
#
Labeled Anomalies
Labeled Anomalies
Labeled Anomalies
Figure 10: How the AUPRC score varies with different numbers of labeled anomalics.
28

---

Published as a conference paper at ICLR 2026
BWGNN
ConsisGAD
DGI
G-BT
APF
Reddit
Amazon
Tolokers
Questions
70
75
75
65
AUROC
90-
70
60
85
65
55
80-
60
60
5
10
20
40
10
20
40
5
20
40
10
20
40
# Labeled Anemalies
Labeled Anomalies
# Labeled Anomalies
Labeled Anomalies
Figure 11: How the AUROC score varies with different numbers of labeled anomalies.
BWGNN
ConsisGAD
DGI
G-BT
APF
Reddit
Amazon
Tolokers
Questions
80
17.5
Rec@K
60
12.5
50
10.0
40
Labeled Anomalies
Anomalies
Anomalies
Anomalies
Figure 12: How the Rec@ K score varies with different numbers of labeled anomalies.
29

---

Published as a conference paper at ICLR 2026
1.6 ADDITIONAL RESULTS FOR MODEL COMPARISON.
We provide additional results in terms of AUROC and Rec@ K for model comparison in Table 7 and Table 8 respectively.
Table 7: Comparison of AUROC for each model. "L" denotes "out of memory". The best and
runner-up models are bolded and underlined.
Model
Reddit
Weibo
Amazon
Yelp.
T-Fin.
Ellip.
Tolo.
Quest.
DGGraph.
T-Social
Avg.
GCN
56.925.9
93.525.6
82.020.3
51.243.7
88.312.5
86.241.9
64.24:1.8
60.0s2.1
66.2x2.5
7162210.4
72.0
GIN
60.0s4.1
83.8
91.6+1.7
62.947.3
84.5+45
88. 2:0.9
66.845.2
62.242.2
68, 66,7418
70.4=74
73.6
GAT
60.5+3.9
86.4
92.4+1.9
65.6+440
85.0+4.5
88.5+2.1
68. 68.1+30
62.3+14
67.2+19
75.4-4.8
75.1
ACM
30.0s4.3
81.827.
61.1438
82.248.1
90.6:0.8
69.3
60.8+411
68.364.9
FAGCN
60.2244.1
83.427.7
90.4a1.9
62.442.9
82 61..4884
86. 123.0
68.126.6
60.81322
63.023.7
AdaGNN
62.0tl17
90.8+2.2
63.223.1
63.622.
85. 1+2.8
63.325.3
58.5+111
67.623.7
64.755.6
70.8
BernNet
63. 1+1.7
80. 1
92.1
65.0+3.7
91.2+110
87.0+1.7
61.945.6
61 8+6.4
09.0+14
59.8 59.8
73.1
GAS
60.6133.0
81.827.0
91.61199
88.711.1 61.115.2
89.021.4
62.7
57.52144
69.9
72. 12.18
DCI
61.0+5.1
89. 3:5.3
89.4
14.1
83 0+332
88.5#1.3
67.627.11
62.2+2.5
65, 3+2.3
74.2:3.3
75.0
POGNN
$2.8+3.4
83.9+8.1
93.2+1.2
+
92.0+11
87.5+14
47,4+2.1
59.0+4.0
68.4
192.4
73.8
AMNe
62.9+1.8
82.4
92.8+2.1
64.845.2
92. 640.
85.4+1.7
61.7+4.1
63.6+28
67.1
53.743.4
72.7
BWGNN
57.745.0
93.624.0
91.82..3
64.343.4
92.1
88.7
68.5+2.7
60.248.6
65.5a3.1
77.5
76.0
GHRN
57.564..5
90.9+1.9
64.5+3.1
92.6+077
19.0+1.3
69.0=2.2
60.5+8.7
67.1430
78.7=3.0
76.1
ConsisGAD
59,642.8
85 05..7
92.3+2.2
66.1
94.340.8
88.621.3
68 5=2.0
65.741.
67. 67.1
93.1
78.0
SpaceGNN
62.3+119
94.420.9
91.122.5
66.82228
93.4210
88 38.52112
68.9126
66.0118
63.923.7
94.7=0.7
XGBGmaph
59,2+2.7
96.42007
94.7+009
64.0+3.5
94.8
91.9#1.3
67.5+334
61 4+2.
62.4b4.1
85.221.8
71.8
63.0&:3.0
76..5
87.7
54.0a1.8
8
86.
71.5
68.7
64.3222
89.321.3
GRACE
64,5+3.3
97. 97.1
87.920.7
55.521.1
93. 120.3
18.8
70.621.6
68.2
G-BT
63.8+4.3
97.3=111
84.8+1.6
93.0H0
88.5+1.2
71.7+1.3
69.4+2.5
90.9=1.2
GraphMAEE
61.0+0.5
95.7=2.3
84.2+0.3
55,240.3
91 41.4
82.5+1.4
66 66.3+330
62.5+14
63.7+16
89.2+4.5
75.2
BGRL
65.3+2.2
99.020.5
14.3+1.
57.0+1.2
88.0&1.7
18.5
72.02188
65.7+2.9
64.9116
90.2s1.3
77.5
SSGE
62,224.7
95. 15.1
84.722.0
55.721.8
92.910.7
86.721.2
71.921.5
65.5115
68.6129
92.320.8
77.6
PolyGCL
62.7+3.9
97.4291.
93.3+1.3
65.1
69.3#00
87,950.9
68.1=188
64,8+18
67, 67,4+2.0
91.4=1.5
78.7
BWDGI
60.0+3.5
91.4+018
94.1+1.6
66,94227
94.0+06
87.6+1.5
71.4+199
64.0+3.9
09.8+1.8
82.8+2.6
APF (wla Cxc)
63.6+2.2
96.3+3.2
92.9+229
65.6++3.
94,2+0.5
90.4+0.7
70.8+1.5
67.2+2.4
69.0+1.6
94,4=1.5
80.4
66.823.9
98.820.3
94.9=1.1
68.242.3
94.8+0.5
91.2+00.9
73.721.0
71.9=21
72.4+1.3
95.1=1.4
Table 8: Comparison of Rec K for each model. 'L"" denotes "out of memory". runner-up models are bolded and underlined.
The best and
Model
Reddit
Weibo
Amazon
Yelp.
T.Fin.
Ellip.
Tolo.
Quest.
DGraph.
T.Social
Avg.
GCN
6.212.2
79.2+1.3
36.922.6
16.9=3.0
60.62766
49.724.2
33.4+3.5
9.82122
3.620.4
10.2:8.1
30.6
GIN
4.8a1.9
66.5a73
70.4a5.7
26. S
$4.425.0
47.623.1
33.623.0
10.3a1.1
2.150.5
5.342.9
32.2
GAT
6.512.3
70.221.6
77.121.7
36.2410.3
51.425.8
35. 35.1118
10.920.9
3.120.7
1166330
ACM
5
70.7495
56.1214.2
23 23.983.
37,2+19.3
60.2=3.3
35.864-2
11442.6
1.9:0.7
8.1
31.1
FAGCN
7.221.9
67.818.1
71.723.1
25.0:28
39.6120.3
48.5211.3
35.613.7
12.342.3
2.510.8
AdaGNN
6.322.2
38 3e3.7
74.24-10
6224
31,3+11.3
46.327.4
33.613.7
10.022.4
1.1504
7,912.7
27.5
BemNet
6.44155
60.984.6
77.242.1
26.8+3.1
60.+1111
47.0=4.5
30. 14338
10.3+2.7
3.8806
3,3428
32.6
6.642.5
62.0+69
77.4+1.7
24.654.1
54,2+9.5
51.9-5.2
33.0+3.
9.1+2.9
3.4+044
11,5646
DCI
4.51144
58.553.5
68, 3:7.2
26. 8:5.3
58.516.1 3
50.0=3.8
33.515.6
9.921.9
2.3
6,34668
$2.9
POGNN
3.0+2.1
6
78.0+1.5
27.8+3.8
63.946 3
46.5=7.3
34, 34.6
10.1+3.9
3.7+1.0
13,5+3.1
34.6
AMNet
6.811.5
62.1
77 77.842..
26.624.3
65.74663
37.8 8=6.7
30.5+19
12.742.6
2.6:008
1.640.5
32.4
BWGNN
6.021.4
75.123.5
77.721.6
26.413.2
64.9111.7
19.7
35.5
10.933.2
3.1
24.3
37.4
GHRN
6.3e1.5
72.4+2.
77.7+1.3
26.9+3.1
67.744.
50.8=488
36.
11.1=3.4
3.4+077
24.6770
37.7
ConsisGAD
6.3
58. 58.62446
77.5+2.
28. 723.2
76.5142
50.8
34.8
12.8a3.1
1.8
48.5
39.6
SpaceGNN
6.012.0
72. 223.9
76.61177
62:.9
35.4
11.512.2
2.310.8
63.31:10
XGBGraph
4.921.9
68.945.7
78.2+1.5
26.8:3.00
72.4
68.923.7
36.623.0
10.642.9
2.5
43.057.6
41.3
DGI
6.521.3
85.5&2.1
19.2622.
18.821.2
71.7
48 022.11
39, 19.1
9,8
3.1
43.264.3
37.5
GRACE
5.622.6
85.612.55
51.824.5
20.4:1.4
74.841.1
$2.423.7
38.412.0
13.021.9
G-BT
6.t11.7
1
46.3+33.4
20.6
74.0+1.9
50.7=3.7
38. 3+2.8
12.0:3.4
3,8
46.26600
38.4
GraphMAE
4.720.5
86.8122.4
47.621.11
20.21:0.
67.414.7
37.923.6
3.510.4
BGRL
7.411.1
90.3&1.1
45.3:33.
21.621.5
59.2433.
$1.024.7
38.24331
11.5:33.
2.720.6
47. 47.1252
37.4
SSGE
6.422.2
81 01..2..2
45.1+3.9
6.1.
74.740.9
51 11.6=2.8
38. 3+2.7
11.41166
3.64018
49.5+3.2
38.2
PolyGCL
7.42.5
81.7429
72.5+7.5
27.5+2.9
50.443.8
55.0=2.5
35.6&1.8
9.0=24
1.9:0.7
44.725.1
38.6
BWDGI
6.2+1.7
64.5+117
72.247.7
29.8+229
75.6+12.7
50.3+54
39,5+2.5
1,5
3.160
43,3+3.8
39.2
APF pwlo Cxe)
7.6+1.2
80.8+7.7
77. 77.442.4
27.2+2.5
74.8+3.8
57.8=2.7
38, 3614
13.641.5
3.0806
69.748.2
45.0
APF
8.8+1.6
88. 777-4
78.5+4.2
31.4=16
7% 931.
62.1-221
40.&
16.5+00.9
4.2
74.1+5.4
48.4
30

---

Published as a conference paper at ICLR 2026
1.7 ADDITIONAL FIGURES FOR HOMOPHILY DISPARITY.
We provide additional figures in terms of AUROC and Rec@K for homophily disparity in Figure 13
and Figure 14. respectively.
AMNet
BWGNN
ConsisGAD
APF
Weibo
Amazon
T-finance
YelpChi
100
100
72
95
AUROC
90
90
80
Q1
02
Q3
Q4
Q1
02
Q3
Q4
Q1
Q2
Q3
Q4
Q1
Q2
Q3
Q4
Local Homophily Quartiles
Locall Homophily Quartiles
Local Homophily Quartiles
Local Homophily Quartiles
Figure 13: Performance across local homophily quartiles (Q1 top 25%, Q4 = bottom 25%)..
AMNet
BWGNN
ConsisGAD
-+- APF
Welbo
Amazon
T-Finance
YelpChi
80
80
80
Recok
60
60
40
40
20
20
Q2
Homophily Quartiles
Local Homophily Quartiles
Homaphily Quartiles
Local Homophily Quartiles
Figure 14: Performance across local homophily quartiles (Q1 = top 25% Q4 = bottom 25%)
1.8 PERFORMANCE ANALYSIS BY SUPERVISION PARADIGM
To clarify performance differences and better position method within the landscape of GAD approaches, we provide an additional analysis categorizing baseline methods by the type of anomaly information used. While our main text categorizes models by architecture (e.g., Standard GNNs vs. Specialized GAD models), here we classify them based on their reliance on supervision, particularly under the label-scarce setting (100 labeled nodes) used in our experiments:
Supervised Models:
These models trained directly using the available labeled anomalies. This category includes standard GNNs (e.g., GCN, GAT, ACM) and supervised GAD- specific models (e.g., GAS, PCGNN, AMNet, BWGNN, GHRN).
Semi-supervised Models: These are specialized subclasses of supervised methods de- signed to effectively leverage limited anomaly labels. This category includes ConsisGAD, SpaceGNN, and XGBGraph.
Self-supervised Models:
These models adopt a two-stage paradigm: first pre-training on unlabeled data to learn general representations, followed by fine-tuning with labeled anomalies. This category includes general graph pre-training methods (e.g., DGI, DCI, GraphMAE, SSGE, PolyGCL, BWDGI) and our proposed APF.
Table 9 summarizes the performance of the top-3 models from each category alongside APF, This categorization yields two critical observations regarding label scarcity in GAD:
Potential of Pre-training: In this realistic label-scarce scenario, supervised models (e.g., BWDGI, SSGE) are competitive with, and often outperform, the best specialized supervised GAD models (e.g., GHRN, BWGNN), For instance, BWDGI achieves average AUPRC of 39.2% compared GHRN's 35.4%. This confirms the advantage of the pre- treiiiinn paradigm in extracting transferable knowledge from abundant unlabeled data when supervision is limited.
self-
31

---

Published as a conference paper at ICLR 2026
Table 9: Comparison of top-performing models across different supervision paradigms. Results
are averaged across all 10 datasets. Our proposed APF (Self-supervised) demonstrates superior
performance compared the best models in Supervised and Semi-supervised categories.
Category
Model
Avg. AUPRC
Avg. AUROC
Avg. Rec@ K
PCGNN
32.9
73.8
34.6
Supervised
BWGNN
35.4
37.4
GHRN
35.4
76.1
37.7
ConsisGAD
38.6
78.0
39.6
Semi-supervised
SpaceGNN
79.0
42.2
XGBGraph
42.9
77.8
41.3
SSGE
37.1
77.6
38.2
PolyGCL
37.1
78.7
38.6
Self-supervised
BWDGI
39.2
78.2
39.2
APF (Ours)
49.6
82.8
48.4
2. Effectiveness of Anomaly-Aware Design: While general self-suuerrised models show promise, our proposed APF significantly outperforms them, as well as the strongest semi- supervised baselines. APF achieves an average AUPRC of 49.6%, surpassing the best semi-supervised model (XGBGraph, 42.9%) by 6.7% and the best baseline celf-supervised model (BWDGI, 39.2%) by 10.4%. This validates our core motivation: while the pre-training paradigm is beneficial, general-purpose objective insufficient. framework specifically tailored to capture anomaly-aware signals, as APF does via the Rayleigh Quotient and dual-filter encoding, is essential for maximizing performance in GAD.
1.9 COMPARISON WITH JOINT LEARNING STRATEGY
To justify our design choice of two-stage framework (pre-training followed by fine-tuning), compare our proposed method against a joint learning strategy. We define the two strategies as follows:
Two-stage (Ours): The model is first trained with the unsupervised pre-training objective. The resulting representations are then frozen or used as initialization for fine-tuning with the supervised binary classification loss.
Joint Learning: The model is trained end-to-end by simultaneously optimizing both the supervised classification loss and the unsupervised pre-training loss (i.e., Liotat Csup + ALnneu)).
We applied these strategies to standard baselines (GCN and BWGNN, using DGI as the auxiliary unsupervised objective) well as to our APF framework. Table presents the AUPRC performance across four representative datasets.
Table 10: Performance comparison (AUPRC %) between Supervised-only. Joint Learning, and Two-stage strategies. The two-stage paradigm consistently outperforms joint learning, with APF achieving the best overall results.
Model
Training Strategy
Reddit
YelpChi
Tolokers
DGraph-Fin
Supervised-only
4.2 0.8
16.4 2.6
33.0 + 3.6
2.3 0.2
GCN
Joint Learning (w/ DGI)
4.4 1.0
18.2 2.3
38.0 3.4
2.3
Two-stage (w/ DGI)
4.8 0.6
17.0 + 1.2
39.7 + 0.8
2.1 0.2
Supervised-only
4.7
23.7 2.9
35.3 2.2
2.1
BWGNN
Joint Learning (w/ DGI)
26.8 0.6
38.2 3.4
2.3 0.2
Two-stage (w/ DGI)
0.6
26.8 + 2.7
38.5 + 3.1
0.2
Supervised-only (w/o Lpt)
5.2 0.6
24.1 2.2
37.4 47.41112 1.2
2.3
APF
Joint Learning
5.5 0.7
28.0 1.8
39.6
2.7
Two-stage (Ours)
5.9 0.9
28.4 1.4
40.5 + 2.0
2.9 0.2
32

---

Published as a conference paper at ICLR 2026
The results yield two critical insights:
1. Benefits of Unsupervised Signals: Consistent with our hypothesis, incorporating unsu- pervised objectives (whether via joint learning or two-stage training) generally improves performance over purely supervised baselines. For example, GCN with Joint Learning improves upon the supervised GCN on Reddit and YelpChi.
2. Superiority of Two-Stage Learning: In nearly all cases, the two-stage paradigm out- performs the joint learning strategy. This trend is particularly pronounced in APF, where the two-stage approach achieves the highest performance across all datasets. We attribute this to the potential confict between the unsupervised pre-training objective and the su- pervised classification loss when optimized simultaneously, which may lead to suboptimal representations. This observation aligns with prior findings in GAD literature (Wang et al., 2021), which suggest that decoupling representation learning from classification often yields superior detection performance.
J DISCUSSION ON THEORETICAL ASSUMPTIONS AND APPLICABILITY
In Section 3.3 we establish the linear separability of anomalies under node-adaptive filtering using the Anomalous Stochastic Block Model (ASBM). We acknowledge that this theoretical model relies on certain idealizations compared to the deployed APF architecture, Here, we clarify the scope of these assumptions and their connection to the practical implementation.
Gaussian Feature Assumption. Our theoretical analysis assumes Gaussian-distriutee node features to ensure analytical tractability and derive closed-fore form separability conditions. This assumption is standard in theoretical analyses of GNNs and GAD to isolate the effects of structural properties like homophily (Baranwal et al.) 202T: Ma et al. 2022 Mao al., 2023 Han et al. 2024). While real- world datasets such as YelpChi and T-Finance contain heterogencous categorical features (Tang) cct al. 2022), the ASBM serves as a simplified "sandbox" to demonstrate the efficacy of node-adaptive low-/high-pan pass filtering under homophily disparity. Our empirical results on these non-Gaussian datasets (Table I suggest that the architectural insights derived from this Gaussian setting are robust distributions.
and transferable to more complex,
Oracle Patterns vs. Data-Driven Fusion. Theorem | assumes an idealized scenario where node homophily patterns known, allowing for the precise assignment of low-pass high-pass filters. In practice, APF replaces this oracle assignment with the Gated Fusion Network (GFN) and anomaly- aware regularization. Specifically, the GFN generates continuous coefficients C' create soft, learnable relaxation of the hard filter assignment used in the theorem. The regularization loss Creg further encourages the model to mimic the theoretical ideal by guiding abnormal nodes to rely more on the anomaly- sensiiive (high-pass) branch. Visualizations of the learned coefficients (Figure 4) confirm that APF successfully approximates this ideal allocation data-driven manner.
Linear vs. Deep Architectures. Finally, while the theorem proves the existence of a linear separator on frozen filtered features, APF employs learnable polynomial filters and MLP encoders. The theoretical result is intended to provide conceptual justification for the core mechanism of APF: the node-specific combination of low-pass and high-pass information. By proving that linear classifier suffices under ideal filtering, we motivate the design of APF, which employs more expressive parameterized implementation to learn these optimal filters and fusion strategies.
K ANALYSIS OF RAYLEIGH QUOTIENT ON DIFFERENT ANOMALY TYPES
To further justify our use of the Rayleigh Quotient (RQ) as a label-free anomaly indicator, we analyze its sensitivity to different graph anomaly types. The "right-shift" phenomenon, where spectral energy concentrates on high frequencies, is fundamental indicator of anomaly degree (Tang et al. 2022). Here, we clarify how this phenomenon captures both attribute anomalies and structural anomalies through the lens of graph signal smoothness.
The Rayleigh Quotient is defined as RQ(x, L) x "
Læ TTng et al. 2022
The numerator,
La: Eis Aig 22)2. quantifies the "smoothness" consistency of the node attributes
33

---

Published as a conference paper at ICLR 2026
with respect to the graph structure L. A higher RQ value indicates "right-shift" in spectral energy, signifying a high level of inconsistency. Both primary anomaly types contribute to this inconsistency:
Abnormal Node Attributes: In this scenario, a node v possesses feature values 2; that deviate significantly from the distribution of its neighbors x.-- This creates large feature difference (a;; - x across edges connected to Uy- Consequently, the term x Le increases, resulting in a higher Rayleigh Quotient and a shift toward high-frequency spectral energy. This aligns with the theoretical analysis of Gaussian anomalies provided by Tang al.
(202)).
Abnormal Edge Connections (Structural Anomalies): This scenario typically involves
"camouflaged" anomalies, where abnormal node intentionally connects benign (normal) nodes to evade detection [Tang et al. (022). While the node's 's features might appear valid in isolation, the connection creates an edge between dissimilar classes (anomalous vs. normal), Because the features of the anomalous node are inherently different from those of the normal community it has invaded, the term (z; - xzy2 along these spurious edges becomes large. This breakage of homophily similarly increases the Læ term, manifesting as "right-shift" in the spectrum.
Both attribute and structural anomalies fundamentally break the smoothness assumption of the graph signal, leading to a higher concentration of spectral energy in the high-frequency domain. This universality makes the Rayleigh Quotient robust, unified, and label-free metric for pre- training stage, allowing APF to effectively target node-specific subgraphs that exhibit feature-structure mismatches regardless of the anomaly's 's origin.
L DETAILS OF DUAL-FILTER ENCODING
In this section, elaborate the design rationale and implementation details of the Dual-filter Encoding module introduced in Section 3.1
Motivation. The motivation behind our dual-filter design stems from the inherent complexity of the GAD task, which requires the simultaneous extraction of two distinct types of information:
These represent the "normality" of the graph, where connected nodes typically share similar features (homophily). Such patterns are concentrated in the low-frequency range the graph spectrum and are well-modeled by conventional low-pass filters used in standard GNNs.
General Semantic Patterns:
Subtle Anomaly Cues:
Anomalies often manifest as high- figh-frequency signals, characterized by abrupt changes in features across edges (heterophily) or structural inconsistencies. Re- lying solely on low-pass filters tends smooth out these critical high-frequency signals, making anomalies indistinguishable from normal nodes.
To address this, APF complements the low-pass encoder with an explicit high-pass encoder. This ensures that while Z captures the general semantic structure, Z н preserves the subtle anomaly cues, providing a comprehensive basis for the subsequent fusion module.
Spectral Guarantees. To implement these filters efficiently while retaining flexibility, we utilize the learnable Chebyshev polynomial approximation restricted by specific constraints on the coefficients. As defined in Eq. 7, the filter values are derived from a shared parameter vector y via cumulative summation: 7 7o0 Σ/ 7 and 7
k Σド= 75
This construction provides a theoretical guarantee on the spectral behavior of the filters. As demon- strated prior work (Chen al., (2024)), this formulation enforces the monotonicity of the filter response values at the Chebyshev nodes:
2 7
S 7
(17)
These inequalities ensure that (1) consistently attenuates high frequencies (low-pass property) while g amplifies them (high-pass property), preventing the optimization process from collapsing into arbitrary redundant filter shapes.
34


Reviews:
[{"review_id": "QWaNTGsfb5", "reviewer": "Reviewer_HGx6", "summary": "This paper introduces AFP, a GAD framework designed to address label scarcity and local homophily disparity through a two-stage design. In the pre-training stage, a Rayleigh Quotient and dual spectral filter-based module are trained to learn anomaly-sensitive information. In the fine-tuning stage, a fusion network and anomaly-aware regularization adapt to the test graph. Theoretical analyses are provided for separability. The proposed method shows competitive performance on the selected benchmark datasets. My view is that the proposed method is an improved strategy to take the advantages of both unsupervised and supervised training.", "questions": "Please refer to my weaknesses.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. The proposed method and problem setting are interesting and well-motivated.\n2. The paper provides theoretical analyses to justify the model design.\n3. A comprehensive set of benchmark datasets is used, and the method achieves competitive performance across them.", "weaknesses": "1. While many baseline methods are included, they should be categorized by the type of anomaly information used (i.e., supervised, semi-supervised, or unsupervised) to clarify performance differences.\n2. The paper explores a unique within-graph pre-training and fine-tuning setting. A discussion comparing it with other GAD settings using label information, such as meta-learning GAD (Meta-GDN, Ding et al., 2021), cross-domain GAD (Commander, Ding et al., 2021; ACT, Wang et al., 2023), and the more recent spectral paper (DSGAD, Zheng et al., 2025) would better position the contribution.\n3. Most baselines are purely unsupervised or purely supervised. It would be helpful to discuss how combining supervised and unsupervised strategies (joint learning) would perform compared to the proposed method.\n4. Since pre-training generally enables faster adaptation under distribution shift, could the authors comment on whether the proposed approach could extend to cross-dataset GAD or detecting novel types of anomalies as studied in (PreNet, Pang et al., 2022; GDN-AugAN, Zhou et al., 2023; and NSReg, Wang et al., 2025)?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "4kChtdkqNK", "reviewer": "Reviewer_sLnc", "summary": "This paper addresses graph anomaly detection under label scarcity by introducing APF, a two-stage framework that combines anomaly-aware pre-training with granularity-adaptive fine-tuning. The core methodology consists of: (i) a pre-training stage that uses the Rayleigh Quotient to guide subgraph sampling and employs both low-pass and high-pass learnable filters to capture both semantic and anomaly-specific signals, and (ii) a fine-tuning stage that adaptively fuses these representations via a gated fusion network with anomaly-aware regularization. The authors provide theoretical analysis under an Anomalous Stochastic Block Model to demonstrate potential linear separability and conduct extensive experiments on 10 benchmark datasets to validate the effectiveness of APF.", "questions": "**Q1**.What are the substantial discrepancies between your reported baseline results and those in the original GADBench paper? Please provide a detailed explanation.\n\n**Q2**. F1 scores for all methods in the main experimental results should also be reported.\n\n**Q3**. How does the theoretical analysis in Theorem 1 relate to the actual deployment of APF?", "limitations": "", "rating": 2, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "**S1**. The paper articulates the challenges in GAD, particularly label scarcity and homophily disparity, in a clear and accessible manner. The motivation for using the Rayleigh Quotient as a label-free anomaly indicator is well-explained, and the distinction between local and global homophily effectively highlights limitations of uniform processing schemes. The paper is easy to follow.\n\n**S2**. The incorporation of the Rayleigh Quotient for subgraph selection and the use of separate high-pass and low-pass spectral filters represent sensible design choices for capturing both general semantic patterns and anomaly-specific signals.\n\n**S3**. The authors conduct extensive experiments across 10 diverse real-world datasets.", "weaknesses": "**W1**. While the paper combines several techniques, the individual components are largely incremental adaptations of well-established methods. The Rayleigh Quotient has been extensively used in prior GAD work [1,2,3], and spectral filtering with Chebyshev polynomials is standard practice [4], representing a modest modification rather than a fundamental innovation. The paper would benefit from more clearly articulating what specific technical innovations go beyond combining existing techniques and why this particular combination is uniquely effective.\n\n**W2**. The theoretical analysis in Section 3.3 and Theorem 1 suffers from several critical limitations that undermine its relevance to the actual method: (i) The ASBM assumes Gaussian-distributed node features, which is unrealistic for most real-world datasets that contain heterogeneous, sparse, or even categorical features; (ii) The theoretical setup assumes perfect knowledge of node homophily patterns and proposes applying filters accordingly, whereas the actual method uses a data-driven gated fusion network that does not explicitly model or utilize such discrete pattern assignments; (iii) The proof relies on a linear classifier with frozen filtered features, but APF uses learnable polynomial filters, MLP encoders, and a trainable fusion mechanism, creating multiple layers of learnable transformations that are not captured by the theoretical model. These gaps make it unclear what practical insights the theory provides beyond general intuition that adaptive filtering could be beneficial.\n\n**W3**. Comparing Table 1 with the original GADBench paper [4] reveals substantial discrepancies that are difficult to reconcile. While some variation is expected across different hardware/software configurations, differences of this magnitude are concerning, particularly since the authors claim to use GADBench's implementation and evaluation protocol.\n\n**W4**. The paper exclusively reports AUPRC, AUROC, and Rec@K, but omits F1 score—a standard and important metric for imbalanced classification that provides complementary information about precision-recall tradeoffs.\n\n---\n\n**Reference**\n\n[1] J. Tang et al. *Rethinking Graph Neural Networks for Anomaly Detection*. ICML 2022. \n\n[2] Y. Gao et al. *Addressing Heterophily in Graph Anomaly Detection: A Perspective of Graph Spectrum*. WWW 2023.\n\n[3] X. Dong et al. *Rayleigh Quotient Graph Neural Networks for Graph-level Anomaly Detection*. ICLR 2024\n\n[4] J. Tang et al. *GADBench: Revisiting and Benchmarking Supervised Graph Anomaly Detection*. NeurIPS 2023.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "EeK0eMXRlz", "reviewer": "Reviewer_EFtV", "summary": "This paper addresses the challenges of label scarcity and homophily disparity in graph anomaly detection (GAD). It proposes a novel framework called Anomaly-Aware Pre-Training and Fine-Tuning (APF), which incorporates a label-free anomaly metric (Rayleigh Quotient) and dual spectral filters during pre-training to capture both semantic and anomaly-sensitive signals. For fine-tuning, APF employs a gated fusion mechanism and an anomaly-aware regularization loss to adaptively handle node- and class-level homophily disparities.", "questions": "Please refer to the weaknesses.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Drawing on recent research findings, this paper provides an in-depth analysis of local data issues in graph anomaly detection.\n\n2.It creatively applies Rayleigh Quotient to node-level subgraph selection and demonstrates its effectiveness through experiments.\n\n3.Experiments span 10 diverse datasets, ensuring robustness and generalizability across domains such as social networks and finance.", "weaknesses": "1. The authors only cite the relationship between spectral energy (i.e., the quantification of the \"right shift\" phenomenon) and anomaly degree, but do not clearly discuss its connection to graph anomaly detection. For example, is this anomaly due to abnormal node attributes or abnormal edge connections? Will the two types of anomalies differ in spectral density / energy?\n\n2. Considering the use of the MRQSampler algorithm in this paper, the authors should add a discussion of UniGAD to clarify the paper's distinction and contribution.\n\n3. The design of the Dual-filter Encoding lacks detailed explanation.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "dtEpExKZRT", "reviewer": "Reviewer_TPKe", "summary": "The authors introduce Anomaly-Aware Pre-Training and Fine-Tuning (APF), a two stage framework for supervised GAD. Experiments show the effectiveness of the framework.", "questions": "Please refer to the weaknesses.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. The authors introduce Anomaly-Aware Pre-Training and Fine-Tuning (APF), a two-stage framework for supervised GAD. \n2. Experiments show the effectiveness of the framework.", "weaknesses": "1. The novelty can be a question, as all the components are from existing work, which means such a framework can be considered an implementation rather than a contribution. \n2. How to choose the hyperparameters for new datasets can be a question since the combinations of hyperparameters require extensive experiments for grid search, as shown in Appendix H.4.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)