Dynamic Multi-sample Mixup with Gradient Exploration for Open-set Graph Anomaly Detection
Authors: Caiyang Yu
Wei Ju
Haixin Wang
Yifan Wang
Ziyue Qiao
Venue: ICLR 2026 Poster (2026)
Keywords: graph neural network
graph anomaly detection
open set
mixup
energy gradient
pseudo labelling
Primary area: learning on graphs and other geometries & topologies

Abstract: This paper studies the problem of open-set graph anomaly detection, which aims to generalize a graph neural network (GNN) trained with a small number of both normal and abnormal nodes to detect unseen anomalies different from training anomalies during inference. This problem is highly challenging due to both the data scarcity of unseen anomalies and the label scarcity for training nodes. Towards this end, we propose a novel approach named Dynamic Multi-sample Mixup with Gradient Exploration (DEMO) for open-set graph anomaly detection. The core of our proposed DEMO is to leverage a dynamic framework to adapt the optimization procedure with high generalizability. In particular, our DEMO first adaptively fuses multiple seen nodes to simulate the unseen anomalies, which expands the decision boundary for the detection model with enhanced generalizability. Moreover, we dynamically adjust sample weights based on their energy gradients to prioritize uncertain and informative nodes, ensuring a robust optimization procedure. To further address both label scarcity and severe class imbalance, we maintain a memory bank of historical records to guide the pseudo-labeling process of unlabeled nodes. Extensive experiments on various benchmark datasets validate the superiority of the proposed DEMO in comparison to various baselines.

Published as a conference paper at ICLR 2026
DYNAMIC MULTI-SAMPLE MIXUP WITH GRADIENT Ex- PLORATION FOR OPEN SET GRAPH ANOMALY DETEC- TION
Caiyang Yu- Wei Ju Haixin Wang" Yifan Wang
Ziyue Qiao
College of Computer Science, Sichuan University of China
Commuter Science Department, University of California, Los Angeles
"ccoool of Artificial Intelligence and Data Science, University of International Business and Economics "School of Computing and Information Technology. Great Bay University fyucy324 324, ziyuejoel @emaill.c. com
juwe wwweeiescueu....
whx@cs. ucla.edu
yi fiwwanggguueeeecco edu.cc
ABSTRACT
This paper studies the problem of open-set graph anomaly detection, which aims generalize graph neural network (GNN) trained with small number of both normal and abnormal nodes to detect unseen anomalies different from training anomalies during inference. This problem is highly challenging due to both the data scarcity of unseen anomalies and the label scarcity for training nodes. Towards this end, we propose a novel approach named Dynamic sulti-sample Mixup with Gradient Exploration (DEMO) for open-set graph anomaly detection. The core of our proposed DEMO is leverage a dynamic framework to adapt the optimization procedure with high generalizability. In particular, our DEMO first adaptively fuses multiple seen nodes to simulate the unseen anomalies, which expands the decision boundary for the detection model with enhanced generalizability. Moreover, we dynamically adjust sample weights based on their energy gradients to prioritize uncertain and informative nodes, ensuring robust optimization procedure. To further address both label scarcity and severe class imbalance, we maintain mem- ory bank of historical records to guide the pseudo-labeling process of unlabeled nodes. Extensive experiments on various benchmark datasets validate the superior- ity of the proposed DEMO in comparison to various baselines. Code is available https: / / thub. com hte/yyycyyy222 /DEMO..
INTRODUCTION
Graph anomaly detection (GAD) focuses on identifying rare or malicious patterns graph-structured data that significantly deviate from expected behaviors (Akoglu et al., 2015; Ma et al., 2021; Tang et al., 2023), such as fraudulent transactions in financial networks (Kim et al., 2024) or stcalthy attacks in Internet-of-Thingg (IoT) systems (Wu et al., 2021). Compared to traditional Euclidean space-based anomaly detection, GAD requires the joint modeling of node attributes and topological structure, where anomalies typically manifest attribute distributional shifts coupled with structural inconsistencies. This dual dependency introduces unique technical challenges: anomalies often exhibit high structural diversity and strong context dependence, making them inherently more difficult to define and detect (Vaska et al., 2022). As such, designing GAD approaches that are both effective and generalizable remains challenging and open research problem.
Current GAD methods predominantly rely on unsupervised and semi-supervised learning paradigms. Unsupervised approaches exploit topological structures and attribute statisties of graphs identify anomalies in the absence of labeled data. These methods typically estimate anomaly scores based on various principles (Ding et al., 2019; Liu et al., 2021; Ni al., 2025), offering strong generalizability
"Corresponding author.

---

Published as a conference paper at ICLR 2026
across diverse graph domains. However, these frameworks suffer from limited precision due to the absence of semantic guidance on anomaly properties. In contrast, semi-supervised frameworks (Dong et al., 2025a; Chen et al., 2024; Ding et al., 2021a) leverage scarce labeled normal or anomalous samples to guide learning processes, thereby achieving more discriminative representations and enhanced detection performance. These methods typically incorporate consistency regularization (Chen et al., 2024), generative objectives (Zhang et al., 2022a), and graph-based data augmentation (Liu et al., 2022) strategies improve model capabilities from limited supervision. Despite technical diversity among existing approaches, they universally operate under closed-set assumption, pre- suming training data fully represents all possible anomaly types or their underlying distributions, a premise that critically undermines their practicality in real-world graph analytics scenarios.
In this paper, we focus on an under-explored yet critically important problem: open-set graph anomaly detection (open-set GAD). The goal of this task is to train a GAD model using limited number of labelled nodes, with the dual objective of detecting both seen anomalies and unseen ones that exhibit behavior patterns significantly distinct from training anomalies and absent from the training data. Achieving this goal is non-trivial, as it entails addressing several interrelated and fundamental challenges in graph- -aa-dd settings. 1) How to generalize knowledge from limited seen anomalies to detect unseen anomalies? In practice, the training set for open-set GAD often has two critical limitations: the number of anomaly classes is small, and the diversity of these classes is insufficient. To detect unseen anomalies, it is essential to fully extract and leverage all useful information from the few seen anomalies available. However, existing methods (c.g.. (Wang et al., 2023b)) fail tap into this potential, leading to critical gap in using such supervision to support unseen anomaly detection. II) How to perform effective graph anomaly detection under limited labels and severe class imbalance? Open-set GAD faces two overlapping constraints: extremely scarce labeled data and severe class imbalance (normal nodes dominate the graph, while labeled/unlabeled anomalies are extremely rare). Existing semi-supervised GAD methods often struggle with this combination: they tend to overfit the dominant normal class, resulting in biased decision boundaries. These biased boundaries not only perform poorly on rare anomalies but also fail to generalize to unseen anomalies.
To address the aforementioned challenges, we propose a novel approach named Dynamic Multi- sample Mixup with Gradient Exploration (named DEMO) for open-set GAD. The goal of DEMO is to establish a dynamical adaptive training framework that improves generalization to unseen anomalies and enhances anomaly detection performance under limited supervision. Given the scarcity and homogeneity of anomaly classes in the training set, DEMO first adaptively fuses multiple seen anomaly samples generate synthesized nodes with enriched representations, approximating unseen anomalies to drive the learning of broader decision boundaries. Moreover, while augmenting the training set with synthesized anomalies is beneficial, not all samples contribute positively to model generalization. Consequently, we employ an energy gradient- feedback mechanism to evaluate and re- re-weight each sample dynamically. This ensures the model prioritizes the optimization of latent uncertain samples crucial for generalization, effectively guiding the training process. Finally, to directly address the dual challenges of limited labels and severe class imbalance, DEMO uses a memory bank to guide pseudo-labeling with adaptive, class-specific confidence thresholds, thereby mitigating the resulting training bias. Extensive experiments on diverse benchmark datasets demonstrate DEMO's 's consistently superior performance against state-of-tt sate-of-theeart baselines, effectively validating its robustness and effectiveness in challenging open-set scenarios.
The contribution of this paper is summarized as follows: ① Problem Connection. We present new perspective that connects open-set recognition with GAD under label scarcity, emphasizing the need to generalize beyond seen anomalies and revisit GAD through the lens of open-set detection. @ Novel Framework. We propose a novel framework named DEMO, which leverages multi-sample mixup strategy and energy gradient-based feedback mechanism data. Furthermore, DEMO incorporates memory bank to mitigate label scarcity by guiding the eseudo-labeling process of unlabeled nodes. @ Comprehensive Validation. Extensive experiments on multiple real-world benchmark datasets and under various challenging evaluation settings validate the superiority of DEMO over a diverse range of sfate-of-ther the--hrtt art GAD baselines.
fully exploit limited labeled
2

---

Published as a conference paper at ICLR 2026
2
RELATED WORK
Graph Anomaly Detection. Existing graph anomaly detection (GAD) methods generally fall into three categories: unsupervised (Huang et al., 2023; Dong et al., 2025b; Qiao & Pang. 2023), semi- supervised (Gao et al., 2023; Huang et al., 2022; Dong et al., 2025a), and supervised (Ding et al.. 2021b) methods. Unsupervised GAD does not rely on labeled anomalies, which identify outliers by modeling the graph's is inherent structural and attribute distributions (Ding al., 2019; Fan al., 2020). However, such methods often struggle to disentangle meaningful information from noise in the latent space. To improve discriminative ability, recent work incorporates diffusion-guide guided refinement of latent representations and content-preserve what pure reconstruction can achieve (Li et al., 2024). Additionally, some unsupervised approaches integrate contrastive learning (Duan et al., 2023b;a) generative modeling (Chen et al., 2020b) to bolster the robustness of learned representations. In contrast, semi-supprvised GAD methods utilize a limited number of labeled anomalies to guide the learning process and enhance detection accuracy. Common strategies include consistency training to enforce prediction stability under perturbations (Chen et al., 2024), as well graph-specific augmentations that improve the model's ability to generalize from scarce supervision (Liu et al., 2022). Fully supervised GAD methods, on the other hand, assume comprehensive labels. Recent work has focused on complex generalization challenges, such as meta-learning for few-shot detection (Meta-GDN) (Ding et al., 2021b), domms-d GAD (ACT) (Wang et al., 2023a), and generalist GAD (ARC (Liu et al., 2024), AnomalyGMF (Qiao et al., 2025)) aiming to unify performance across diverse graphs and anomaly types. However, most existing approaches, whether superviuee or fully supervised, assume consistent anomaly distribution between training and testing, ignoring real-world variability and thereby limiting their ability to generalize to unseen anomaly types. To address this limitation, we propose a novel open-set GAD framework explicitly tailored for detecting diverse and previously unseen anomalies.
constraints, enhancing anomaly separability beyond
Open-set Classification. Open-set classification addresses a practical challenge where the model must not only accurately classify inputs from known categories but also identify instances originating from previously unseen classes (Yang et al., 2024; Wang et al., 2023b; Bisgin et al., 2024). Existing open-set classification approaches are mainly divided into discriminative (Luke al., 2020; Chen et al., 2020a; Xu, 2024) and generative paradigms (Bao et al., 2023). Discriminative methods aim to learn well-separated decision boundaries for known classes while reserving ambiguous regions in the feature space to detect unknowns. In contrast, generative methods attempt to simulate the behavior of unknown classes by explicitly synthesizing samples, often combining generative models with discriminative classifiers in an adversarial framework. In the open-ser GAD, NSReg (Wang al., 2023b) is one of the few existing approaches that has shown promising results. adopts discriminative framework by introducing a regularization constraint to enforce compact semantic representations of normal nodes, thereby reducing overfitting to anomalies. However, its core idea focuses on constraining structural relations among normal nodes to enforce strict decision boundary, while overlooking the role of anomaly nodes in shaping the model's behavior. Therefore, our study emphasizes the significance of anomaly samples and achieves diverse representation through anomalies to enhance the generalization ability of the model.
3 THE PROPOSED APPROACH
Problem Definition. We consider the task of open-set GAD on attributed graphs, where only a small portion of anomalies are labeled during training and novel anomaly types may emerge at inference. Let g = (V,E, X) denote a graph with node set V. edge set E, and feature matrix X E xd The node set consists of a dominant group of normal nodes V,, and a minority of anomalous nodes Va. i.e., V = V, UV.. where [V.l < [..l During training, the labeled training nodes yuaan only cover a partial set of anomaly classes. To formalize this, we partition V4 into seen anomalies Vaeen and unseen anomalies Junseen The objective is to lear detection model ő : (G, V) - [0, 1] that assigns high anomaly scores to both Vieen and Vuinseen while suppressing scores for V,,- Formally, for all ea V. and U, E Vn, the model satisfies: Φ (G, va) > & (n)
3

---

Published as a conference paper at ICLR 2026
Training Set
Normal Abnormal
Original Data
Evaluate the Weights Training Data
Mixup Data
Calculate Weight
Labule- Data
Validation Set
Anomaly
Normal
Multi- Sample le Mixup
Pseudo-Labeling
Embeddings
Mixup Oij
psoudo
save
count
lobeling
Memory Bank
Minxp Embeddings
Normal
Anomaly
number
Mexaz
N2
update
threshold
1234
Figure 1: An overview of the proposed DEMO. DEMO first expands the training data through two parallel augmentation techniques. Multi-Sample Mixup generates new synthetic anomalies, while Labeling assigns labels to reliable unlabeled nodes. This augmented training data, compris- ing original, mixup, and pseudo-labeled data, then proceeds a dynamic weighting stage.
3.1 FRAMEWORK OVERVIEW
Our study addresses the open-set GAD problem, aiming to detect both seen and unseen anomalies using limited labeled nodes. This involves two key challenges: (1) Generalization to Unseen Anomalies. (2) Label Scarcity and Class Imbalance. To tackle both challenges, we propose a novel framework DEMO that enhances the generalization of GNN-based detectors under minimal supervision. First, DEMO adaptively fuses multiple seen anomalies to synthesize diverse nodes that simulate unseen anomaly classes, thereby expanding the model's decision boundaries for improved generalization. Second, an energy gradient-drive feedback mechanism dynamically adjusts sample weights, enabling the model to focus on uncertain ambiguous instances and improve generalization. Finally, to mitigate bias caused by severe class imbalance and limited anomaly supervision, we introduce a memory bank of historical records adaptively update class-specific confidence thresholds and guide the pseudo-labeling of unlabeled nodes. The overall architecture of DEMO is illustrated in Figure 1, with detailed functionalities of each component elaborated in subsequent sections.
3.2 DYNAMIC MULTI-SAMPLE MIXUP FOR DECISION BOUNDARY EXPANSION
In the context of open-set GAD, existing methods (Wang et al., 2023b; Zhu et al., 2024; Isaac-Meding al., 2024) struggle to capture the diversity of anomalies due the limited quantity and class variety of anomalies in the training data. Consequently, becomes crucial to introduce diversified anomaly samples to enhance the model's generalization. To this end, DEMO employs a dynamic multi- sample mixup strategy that generates synthesized anomalies with diverse representations, effectively prompting the model to learn broader and more robust decision boundaries. The core innovation lies in adaptively fusing multiple seen anomalies to generate more challenging and diverse anomaly representations, which not only approximate the distribution of potential unseen anomalies but also systematically encourage the model to learn more robust decision boundaries, thereby enhancing generalization to previously unseen patterns.
Definition 3.1 (Multi-sample Mixup) Given the
anomaly node set Atrain
{uitoin ggain ... vrriin), }, which encoded into embeddings Zirain {2/painn ,22 ..... ,2 train For each original anomaly z/rain zrrain we generate corresponding synthetic representation é. This
4

---

Published as a conference paper at ICLR 2026
synthetic sample is defined as dynamic mix of all seen anomalies' embeddings: 2, Σi= Q1j22
where Σド=1 Olij = 1 and Ozaj [0, 1].
Notably, the mixing weights Ouj assigned based the feature similarity between embeddings (Zhang et al., 2022b), defined through the following normalized form:
exp (S ((2) Wm (z)rui) T ww,)
aij = Σn exp (S ((z)min) Wms
(I)
(2 train wn.)
with S representing a feature similarity function (e.g., s. inner product or cosine similarity), Wm and w learnable weights. Since highly similar samples more confusable the model, assigning larger weights to them encourages the synthesized representations to stay in more ambiguous regions of the feature space. Next, we provide a theoretical justification showing that the synthesized samples can still retain high similarity with the original ones. The detailed proof is presented in the Appendix C.
Theorem 3.1 Assume the inner-product similarity S (2s; = = between original sam- ples 2train and 2) ztrain higher than their average similarity all training anomalies, i.e. S ( (rtaann 2train)
( (2)rain, ,22 2train), then the synthesized sample &n satisfies: 1k=1= S
S ( =3) 2 S (zi,
(2)
= OGk IS (zk, zz) (zi, 21)l. That the similarity between the mixed sample &n and 2j is guaranteed to be no less than the original value minus a small perturbation tthrebyy preserving their intrinsic confusability.
where e e
Furthermore, to avoid degenerate cases where the synthesized representation is overly biased toward the original sample 2,, we introduce diversity regularization term suppress its dominant influence:
(2train)
Irain
Laiv = -NNNNN N Σ
Wm
Wn
(taii)))
Wm.
Upon synthesizing diverse anomalies, we further enhance the discriminative power of the model through consistency learning. The final loss function integrates both the diversity enhancement term (with hyperparameter )aiv) and the consistency learning term as follows:
Cmix
Leoms + Adiv Caiv:
where Ccons is the consistency learning loss between the original anomaly embeddings ب!! X and their projected representations train calculated using the Mean Squared Error (MSE).
3.3 GRADIENT EXPLORATION FOR GENERALIZABLE OPTIMIZATION
While the multi-sample mixup strategy creates more diverse of anomalies, not all samples in this expanded training set (both original and synthesized) are equally important for the model's generalization. Simply treating all samples equally suboptimal, as some may be highly informative boundary cases while others might be redundant or even introduce noise. To address this, we propose an energy gradient-driven mechanism (Chen et al.; Han et al., 2022) that dynamically weights each sample based on its quantified impact validation performance, thereby focusing optimization on the most critical nodes for more effective learning.
We define the energy of node as measure of predictive uncertainty, formulated as Eg (vx) = - -log Σ exp(2;), where z denotes the predicted logits node v, A lower energy indicates higher confidence, typically associated with normal nodes, while higher energy suggests potentially anoma- lous or ambiguous behavior. To characterize how node energy affects generalization, we analyze model parameter responses to minor energy perturbations. The response direction is determined by the energy gradient to model parameters, with magnitude governed by the Hessian matrix Hg:
11 VeEs (v:). Ig (v.) = -11
(5)
The Hessian matrix is evaluated at optimal parameters, quantifying sensitivity to local perturbations. However, parameter shifts alone cannot determine generalization benefits. We further evaluate their
5

---

Published as a conference paper at ICLR 2026
impact on validation loss by computing the inner product between validation loss gradients and energy gradient directions:
Layal - (1yaa 1751 H
Vo (vi).
(6)
where (-) denotes the binary cross-entropy loss, vyal and y)ai are the nodes of the validation set and the corresponding categories. Averaging over all validation nodes yields the average influence Tat (w:) of training node Us which determines the adaptive weight coefficient:
Vaal (ti)
B
m&X e Visa (Tal (v+)
Finally, we incorporate these weights into the energy-aware objective and define the overall loss as:
Cenergy
72 Σ
[c (vt, yei 0) Xeng Ee (v:)).
(8)
where Aeng is balance coefficient. The core idea of this mechanism is that when Tuat (w:) > reinforcing the energy guidance of node v; can effectively reduce validation error. Such nodes are often boundary cases that may resemble unseen anomalies. Conversely, negative influence suggests that the sample may impair generalization, and its contribution should be suppressed.
3.4 RELIABLE PSEUDO-LABELING WITH HISTORICAL GUIDANCE
After effectively leveraging labeled data to enhance the model's generalization to unseen anomalies, another crucial objective focuses on generating high-quality pseudo-labels for unlabeled samples to further alleviate the training bottleneck caused by label scarcity. Traditional pseudo-labeling methods employing fixed thresholds often fail account for the dynamic evolution of model prediction behaviors during training (Xie et al., 2020: Guo & Li, 2022). Mcanwhile, dynamic thresholding strategies (Zhang et al., 2021; Wang et al., 2023c: Chen al., 2023) perform poorly in imbalanced binary-class GAD due to their class-agnostic design, which often overlooks anomalies. To address this, we propose class-aware threshold adaptation scheme guided by historical records, enabling reliable pseudo-labe generation.
In detail, our method implements class cluss-specific dynamic threshold adaptation via a memory bank that incorporates historical information. Let T,e denote the set of samples selected for class e (c E (O(normal), 1 (annomaly]]) at the 1-th iteration, with its size Nr 17, stored the memory bank to track distribution evolution. By computing the historical peak Ne max maxisksi Nç, the model dynamically captures the historical optimal coverage for class c. Based on the ratio between the current selection count o (c) and Nc Mmax: the model dynamically adjusts the threshold Pe(c) = (c) max- where (c(c) is determined by the following condition:
M
oc(c) = -[-==1AAB
Vc= (w:) S [.
(9)
1=1
where M is the number of unlabeled samples, Pr (v;) is the predicted probability of node i; at iteration t, and 7,*h and represents the dynamic thresholds for anomaly and normal classes, respectively. The final asymmetric threshold update mechanism is formulated as:
(x(c))7T. (-- - (2 12- (2-p(c)),,
c= anomaly,
(10)
normal.
where + and -- denote predefined anomaly and normal class thresholds, with + + - This strategy ensures that anomaly thresholds 7, progressively increase with pr (anomaly) to en- hance minority-class sensitivity, while normal thresholds decrease through the nonlinear term (2 Pe (normal)) improving robustness against majority-class dominance.
3.5 SUMMARIZATION
In practice, we dynamically adjust the class-spectis specific thresholds during training and select unlabeled samples. The overall training objective defined as:
L Lenergy + Amix Emix Xunfun-
(11)

---

Published as a conference paper at ICLR 2026
Table 1: AUC-ROC and AUC-PR three small-scale datasets. The best performance is boldfaced, with the second-best underlined.
Datascts
Photo
Computers
CS
Metrics
AUC-ROC
AUC-PR
AUC-ROC
AUC-PR
AUC-ROC
AUC-PR
ANOMALOUS
0.537440.012
0.087940.003
0.3037
0.169320.003
0.2997 10.011
0.163420.015
DOMINANT
0.4716100002
0.0837
0.5450
0.1644
0.402940.012
0.1886
AnomalyDAE
0.4179440.08
0.0770
0.5658
0.1723
0.397840.009
0.186440.008
GAAN
0.43464:0.0 014
0.071010.003
0.559G
0.179610.011
0.464610.026
0.2111
CoLA
0.561840.00
0.0989
0.4897
0..472
0.4353
0.2029
CONAD
0.4763110.05 037
0.086210.011
0.3445:10002
0.161920.015
0. 0,4028
0,188610.009
CONSISGAD
0.8668 40.021
0.5987 +00002
0.6250
0.357220.009
0.717840:034
0.527110.019
GGAD
0.7976440088
0.56774+0.00
0.7210
0..529
0.9081
0.8198
TAМ
0.6045+0.005
0.108440.00z
0.4432200.014
0,1355g00.010
0.6398
0.3542220.013
OCGNN
0.627910.00m 20.007
0.1323:0.007
0.5049::.022
0.150510.013
0.781940.081
0.4926:10.028
ANO-S
0.5730
0.1097:10006
0.4428
0.139220.005
0.8380+0.025
0.6401
DOM-S
0.5785 1.0063
0.1107110.013
0.4488:10.00
0.1330
0.844510.013
0.638210.019
SpaceGNN
0.8030+0.005
0.5271+0.009
0. 0.8296.2..00
0.6439 10.01
0.7784+0.0422
0,6587
NSReg
0.836020.012
0.4777+0.011
0.700
0.5437
0.9032
0.811520.016
GNN+OpenMax
0.761840.104
0.3942
0.67 0.0002
0.39422n.09s
0.8213+0.139
0.7559
DEMO
0. 0.9023+0.009
0.6330++0.00s
0.8439 +0.024
0.6458
0.9448+0.019
0.8857 +0.010
where Amix and Au are the balancing coefficients for the mixup loss and the unlabeled loss, respec- tively. Lun denotes the binary cross-entropy loss applied to pseudo-labeled samples. The detailed training procedure of DEMO is provided in the Appendix B.
4 EXPERIMENTS
4.1 EXPERIMENTAL SETTINGS
Datasets. To comprehensively evaluate the performance DEMO on the open-set GAD task, we conduct experiments on six real-world graph datasets that vary in scale and domain characteristics. Since no existing graph benchmarks are explicitly designed for open-set scenarios, we simulate by partitioning normal and anomalous nodes based on their non-uniform class distributions. Following (Wang et al., 2023b), we define normal nodes as majority classes and partition anomalies based on class proportions: (1) For small-scale datasets with multiple classes, such as Photo, Computers, and CS (Shchur et al., 2018), we treat categories with fewer than 5% the total nodes as anomaly classes (with least two anomaly classes retained); (2) For large-scale datasets, including Yelp (Rayana & Akoglu, 2015), ogbn-arxiv (Mikolov et al., 2013), and ogbn-mag (Wang et al., 2020), we apply similar strategy based on class proportions to distinguish normal and anomalous nodes. Further implementation details are provided in the Appendix.
Baselines. In our experiments, we compare DEMO with 12 representative GAD methods, which are categorized into two groups: unsupervised and semi-supervised approaches. The unsupervised methods include ANOMALOUS (Peng et al., 2018), DOMINANT (Ding et al., 2019), AnomalyDAE (Fan et al., 2020), GAAN (Chen et al., 2020b), CoLA (Liu et al., 2021), 1). and CONAD (Xu et al., 2022). The semi-supervised group includes ConsisGAD (Chen et al., 2024), GGAD (Qiao et al., 2024), TAM (Qiao & Pang, 2023), OCGNN (Wang et al., 2021), ANOMALOUS-SE DOMINANT-Semi (DMO-S), SpaceGNN (Dong et al., 2025a), and NSReg (Wang et al., 2023b). Notably, TAM, OCGNN, ANOMALOUS, and DOMINANT are originally unsupervised models. Following the design strategy GGAD, we adapt them into semi-supervised variants to ensure fair comparisons under the same supervision setting. Finally, we add GNN+OpenMax (Bendale & Boult, 2016), which adapts the classic open-set classification framework to a GNN baseline.
(ANO-S),
Implementation Details and Evaluation Metries. Following (Wang et al., 2023b). we adopt GraphSAGE as the backbone with 64 hidden units per layer. The model is optimized using the Adam optimizer with learning rate of 0.001 and weight decay of 0.0005. For training,
7

---

Published as a conference paper at ICLR 2026
Table 2: AUC-ROC and AUC-PR three large-scale datasets. The best performance is boldfaced, with the second-best underlined. 'OOM' indicates out-of-memory.
Datasets
Metries
ConsisGAD
GGAD
TAM
OGCNN
ANO-S
DOM-S
SpaceGNN
NSReg
DEMO
AUC-ROC
0.6988
0.6613
0.5319
0.6410
0.6567
0.6506
0.6853
0.7015
0.7097
Yelp
AUC-PR
0.2970
0.2549
0.0977
0.1118
0.1076
0.1048
0.2916
0.3029
0.2238
AUC-ROC
0.6216
0.6007
OOM
OOM
0.4510
0.4505
0.6133
0.6182
0.6364
ogbn-arxiv
AUC-PR
0.3148
0.2843
OOM
OOM
0.1463
0.1482
0.3301
0.3230
0,3329
AUC-ROC
0.4909
0OM
OOM
OOM
OOM
OOM
0,4626
0.4836
0.4967
ogbn-mag
AUC-PR
0.0043
0OM
OOM
OOM
OOM
OOM
0.0043
0.0041
0.0054
200 epochs on small-scale datasets and 400 epochs on large-scale datasets. We select 50 anomalous nodes (from a single anomaly class) and 5% of normal nodes as the training set, and 30 anomalous nodes (same class as training) along with 1% of normal nodes as the validation set; all remaining nodes are used for testing. We set the hyperparameter Adiv to 0.5, and conduct sensitivity analysis on the loss weights Aeng. Amix- and Aun. with detailed results provided in the Appendix. We evaluate performance using two widely adopted metries: Area Under the Receiver Operating Characteristic Curve (AUC-ROC), which measures the model's ability to distinguish between normal and anomalous nodes, and Area Under the Precision- Recall Curve (AUC-PR), which is particularly informative in imbalanced scenarios by emphasizing precision on the minority (anomalous) class.
4.2 EMPIRICAL RESULTS
Small-scale GAD Performance. We first perform the performance comparison of DEMO three small-scale graph datasets, the results are shown in Table 1. As shown, DEMO consistently outperforms all existing baselines across both AUC-ROC and AUC-PR metries. 1 Among unsupervised methods, DEMO achieves substantial improvements over all competitors. For instance, on the Photo dataset, it surpasses the best pest-performin unsupervised baseline (CoLA) by 60.61% in AUC-ROC, and the gain in AUC-PR is even more pronounced. Across three datasets, DEMO achieves 80.99% higher average AUC-ROC (vs. 0.4956 of CoLA) and 368.1 11% % improvement in average AUC-PR (vs. GAAN's 0. 1539). These results indicate that unsupervised approaches relying solely on structural reconstruction or embedding learning are limited in capturing the diversity of anomaly types under open-set conditions, resulting in poor generalization. @ In the semi-supervised setting, DEMO maintains dominant advantages, notably outprfooring strong baselines such as NSReg. On average, across the three datasets, DEMO achieves a 7. 7.86% improvement in AUC-ROC over the second- best method (NSReg), and a 17.60% gain in AUC-PR compared to GGAD. This highlights that beyond effectively leveraging limited labeled data, DEMO benefits from its diverse anomaly modeling and adaptive mechanisms, yielding stronger recognition of unseen anomalies. @ In summary. the comprehensive performance of DEMO small-scale datasets validates its effectiveness in the open- set GAD task, particularly under conditions of sparse anomaly distribution and limited supervision, where unified and robust modeling of both seen and unseen anomalies is essential
Large-scale GAD Performance. Furthermore, we present the performance evaluation results of DEMO on three large-scale graph datasets in Table 2. As observed, DEMO demonstrates strong robustness and broad adaptability in large-scale open-set scenarios. On the Yelp dataset, DEMO achieves an AUC-ROC of 0.7097, outperforming the second-best method NSReg by 1.16%. Although its AUC-PR is slightly lower than NSReg, it still exhibits reliable and stable performance. On the two extremely large datasets, DEMO delivers consistently strong results, improving AUC-ROC by 2.33% and 1.17%, and boosting AUC-PR by 0.85% and 25.58%, respectively, compared to the strongest baselines. @ These results confirm that DEMO maintains reliable performance even on acage graphs, and is particularly effective in handling complex topologies and extreme class imbalance by robustly expanding decision boundaries and accurately identifying previously unseen anomalies.
Data Efficiency. To further evaluate the impact of anomaly sample quantity model performance, we conducted experiments by varying the number of anomalous nodes in the training set across three levels: 20, 50, and 100. These experiments were performed on three datasets. Additional results and comparisons are provided in the Appendix. Figure 2 (a-c) illustrates how each method's AUC-ROC score changes with different amounts of anomaly supervision. As shown in the figure,
8

---

Published as a conference paper at ICLR 2026
Photo
Computers
ACC-ROC (%)
AUC. ROC (%)
80
AUC. RCC
82
60
AUC
60
80
40
20
50
160
40
20
50
300
46
20
50
100
0.02 0.04 0.05 0.08 0le
Number of Anomalies
Number of Anomalies
Number of Anomalies
Norma--llass Threshold Photo - OS (d)
GGAD
SpaceGNNN
NSReg
DEND
(b)
(b)
(c)
Figure 2: (a), (b) and (c) Comparison of model performance under different numbers of training anomalies across three datasets. (d) Sensitivity analysis of the threshold T
DEMO consistently maintains the best or near-best performance across all datasets as the number of anomalies increases, and notably demonstrates clear advantages in low-resource settings, such as when 20 anomalous nodes are available. On the CS dataset, even with just 20 anomaly nodes, DEMO achieves an AUC-ROC of approximately 0,90, showing a substantial gap. On the Computers dataset, DEMO reaches its peak performance with 50 anomalies, significantly outperforming all baselines. In summary, DEMO exhibits strong anomaly detection capabilities under severe data scarcity and maintains excellent scalability and training efficiency as the number of anomaly samples grows. confirming its ad advantage in efficient use of limited supervision.
Sensitivity Analysis. In this part, we conduct a sensitivity analysis on the hyperparameters' 7 and T Figure 2 (d) illustrates the impact of the predefined normal-class threshold r on the detection performance under our proposed class-aware threshold adjustment strategy. Since the anomaly-class threshold is defined as r_, this experiment effectively evaluates the joint influence of both class thresholds. We vary rJ within the range of [0.01, 0.1] and examine its effect on AUC-ROC across two datasets. The results show that both datasets achieve optimal performance when - 0.01, indicating a ballnbal separation between normal and anomalous classes. As T decreases (i.e., the anomaly threshold increases), the model performance begins to fluctuate decline, suggesting that an overly relaxed anomaly selection criterion may introduce low-confidence samples into training and compromise learning. This demonstrates that setting a relatively lower normal-class threshold (or, cquivalently, a higher anomaly-class threshold) enables the model to more reliably select high- confidence pseudo-labeled samples, effectively mitigating label bias and improving overall detection performance. Therefore, we set r* and T to 0.99 and 0.01, respectively.
Ablation Study. We introduce several variants of DEMO to analyze the contribution of each component: (1) DEMO w/o All removes all three components; (2) DEMO w/o Mix re- moves the multi-sample fusion component; (3) DEMO w/o EG removes the energy gradient- guided optimization strategy; and (4) DEMO w/o PL. disables the pseudo-labeling component.
As shown in Table 3, the ablation results reveal that each component plays vital role in enhancing model performance. First, removing the PL com- ponent results in the most substantial performance drop across both datasets, demonstrating the crucial impact of class-aware pseudo-labeling in mitigating label scarcity and improving anomaly detection. Sec- ond, the exclusion of the EG module consistently reduces performance, validating the effectiveness of gradient-based reweighting in prioritizing informa- tive and uncertain samples during training. Third, the absence of the Mix module also causes noticeable degradation. highlighting the benefit of synthesizing diverse anomaly representations to better expand the decision boundary. Additionally, the variant DEMO w/o All, which disables all three components, yields the lowest overall performance, indicating that the full combination of modules essential for achieving the best anomaly detection results. Overall, these results confirm that all three modules contribute synergistically to the robustness and generalization of DEMO.
Table 3: Ablation Study on two benchmarks.
Datasets
Photo
Computers
Metrics
AR
AP
AR
AP
DEMO w/o All
0.8300
0.5692
0.7576
0.5325
DEMO w/o Mix
0.8750
0.6023
0.8197
0.6292
DEMO w/o EG
0.8849
0.6171
0.8100
0.5998
DEMO w/o PL
0.8616
0.6150
0.8094
0.5949
DEMO
0.9023
0.6330
0.8439
0.6458
Visualization Results. To further assess the representation quality of node embeddings learned by different models, we visualize the 2D t-SNE projections of node features on the Photo and Computers datasets, as shown in Figure 3. Blue and green points correspond to anomaly and normal nodes, respectively. On both datasets, DEMO produces clearly separated clusters between anomalous and normal nodes. The anomalies (in blue) more tightly grouped and distinctly detached from the

---

Published as a conference paper at ICLR 2026
N5Reg [Photo]
SpaceGMN (Photo)
DEMO (Photo)
N5Reg (Computers)
SpaceGNN (Computers)
DEMO (Computers)
Figure 3: Visualization results of the features of the three algorithms on the two datasets.
normal class, indicating that DEMO effectively enhances anomaly-specifi feature encoding and decision boundary clarity. In contrast, the embeddings generated by NSReg and SpaceGNN exhibit substantial overlap between the two classes, particularly the Computers dataset, where anomalies appear largely entangled with normal nodes.
5 CONCLUSION
This paper presents DEMO, novel framework for open-set graph anomaly detection. By combining multi-sample fusion with gradient-guided weight adjustment, DEMO enhances model generalization to unseen anomalies. To mitigate the effects of label scarcity, it further incorporates class-aware thresh- old adaptation scheme guided by historical records for reliable pseudo-labe generation. Extensive experiments validate its effectiveness across diverse datasets. In addition to strong empirical perfor- mance, DEMO demonstrates robustness across varying data scales and supervision levels, making broadly applicable real-world graph anomaly detection tasks.
ACKNOWLEDGMENT
This work is supported in part by the National Natural Science Foundation of China under Grants 62306014, the Postdoctoral Fellowship Program (Grade A) of CPSF under Grant BX20250376, the Sichuan Science and Technology Program under Grant 20252NSFSC Research Funds for the Central Universities under Grant 10822041 12K997, and the Sichuan University Interdisciplinary Innovation Fund.
the Fundamental
REFERENCES
Leman Akoglu, Hanghang Tong, and Danai Koutra. Graph based anomaly detection and description: survey, Data mining and knowledge discovery, 29:626-688, 2015.
Wentao Bao, Qi Yu, and Yu Kong. Latent space energy- energy-based model for fine fine-grained open set recognition. arXiv preprint 2309 10711, 2023.
Abhijit Bendale and Terrance E Boult. Towards open set deep networks. In Proceedings of the IEEE conference computer vision and pattern recognition, pp. 1563 1572, 2016.
Halil Bisgin, Andres Palechor, Mike Suter, and Manuel Günther. Large-scale evaluation open-set image classification techniques. arXiv preprint arXiv:2406.09111 2024.
Guangyao Chen, Limeng Qiao, Yemin Shi, Peixi Peng, Jia Li, Tiejun Huang, Shiliang Pu, and Yonghong Tian. Learning open set network with discriminative reciprocal points. In Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28. 2020, Proceedings, Part III 16, pp. 507-522. Springer, 2020a.
Hao Chen, Ran Tao, Yue Fan, Yidong Wang, Jindong Wang, Bernt Schiele, Xing Xie, Bhiksha Raj, and Marios Savvides. Softmatch: Addressing the quantity-quality trade-off in semi-supervised learning. International Conference on Learning Representations (ICLR), 2023.
Nan Chen, Zemin Liu, Bryan Hooi, Bingsheng He, Rizal Fathony, Jun Hu, and Jia Chen. Consistency training with learnable data augmentation for graph anomaly detection with limited supervision. In The Twelfth International Conference on Learning Representations (ICLR), 2024.
Yiting Chen, Qitian Wu, and Junchi Yan. Regularizing energy among training samples for out-of- distribution generalization. In The Thirteenth International Conference on Learning Representa- fions (ICLR).
10

---

Published as a conference paper at ICLR 2026
Zhenxing Chen, Bo Liu, Meiqing Wang, Peng Dai, Jum Lv, and Liefeng Bo. Generative adversarial attributed network anomaly detection. In Proceedings of the 29th ACM International Conference on Information & Knowledge Management, pp. 1989-19922 2020b.
Kaize Ding, Jundong Li, Rohit Bhanushali, and Huan Liu. Deep anomaly detection on attributed networks. In Proceedings of the 2019 SIAM international conference on data mining, pp. 594-602. SIAM, 2019.
Kaize Ding, Jundong Li, Nitin Agarwal, and Huan Liu. Inductive anomaly detection on attributed networks. In Proceedings of the twenty-ninth infernational conference on international joint conferences on artificial intelligence, pp. 1288-1294 2021a.
Kaize Ding, Qinghai Zhou, Hanghang Tong, and Huan Liu. Few-shot network anomaly detection via cross-network meta-learning. In Proceedings of the web conference 2021, pp. 2448-2444442 2456,22566222 2021b.
Xiangyu Dong, Xingyi Zhang, Lei Chen, Mingxuan Yuan, and Sibo Wang. Spacegnn: Multi-space graph neural network for node anomaly detection with extremely limited labels. The Thirteenth International Conference on Learning Representations (ICLR), 2025a.
Xiangyu Dong, Xingyi Zhang, Yanni Sun, Lei Chen, Mingxuan Yuan, and Sibo Wang. Smoothgnn: Smoothing- aware gnn for unsupervised node anomaly detection. In Proceedings of the ACM on Web Conference 2025, pp. 1225-1236, 2025b.
Jingcan Duan, Siwei Wang, Pei Zhang, En Zhu, Jingtao Hu, Hu Jin, Yue Liu, and Zhibin Dong. Graph anomaly detection via multi-scale contrastive learning networks with augmented view. In Proceedings of the AAAI conference on artificial intelligence, volume 37, pp. 7459-7467, 2023a.
Jingcan Duan, Pei Zhang, Siwei Wang, Jingtao Hu, Hu Jin, Jiaxin Zhang, Haifang Zhou, and Xinwang Liu. Normality learning-base based graph anomaly detection via suati-scale contrastive learning. In Proceedings of the 31st ACM International Conference on Multimedia, pp. 7502-7511, 2023b.
Haoyi Fan, Fengbin Zhang, and Zuoyong Li. Anomalydae: Dual autoencoder for anomaly detection on attributed networks. In /CASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 5685-5689, IEEE, 2020.
Yuan Gao, Xiang Wang, Xiangnan He, Zhenguang Liu, Huamin Feng, and Yongdong Zhang. Ad- dressing heterophily in graph anomaly detection: A perspective of graph spectrum. In Proceedings of the ACM web conference 2023, pp. 1528-1538, 2023.
Lan-Zhe Guo and Yu-Feng Li. Class-imbalanced semi-supervised learning with adaptive thresholding. In International Conference on Machine Learning, pp. 8082-8094, PMLR, 2022.
Andi Han, Dai Shi, Zhiqi Shao, and Junbin Gao. Generalized energy and gradient flow via graph framelets. arXiv preprint w:Xiv:22100041220 2022.
Mengda Huang, Yang Liu, Xiang Ao, Kuan Li, Jianfeng Chi, Jinghua Feng. Hao Yang. and Qing He. Auc-oriented graph neural network for fraud detection. In Proceedings of the ACM web conference 2022, pp. 1311-1321, 2022.
Yihong Huang, Liping Wang, Fan Zhang, and Xuemin Lin. Unsupervised graph outlier detection: Problem revisit, new insight, and superior method. In 2023 IEEE 39th International Conference on Data Engineering (ICDE), pp. 2565-2578. IEEE, 2023.
Brian KS Isaac-Medina, Yona Falinie A Gaus, Neelanjan Bhowmik, and Toby P Breckon. Towards open-world object-based anomaly detection via self-supervised outlier synthesis. In European Conference Computer Vision, pp. 196-214. Springer, 2024.
Yejin Kim, Youngbin Lee, Minyoung Choe. Sungju Oh, and Yongjae Lee. Temporal graph networks for graph anomaly detection in financial networks. arXiv preprint arXiv:2404.0000 2024.
Jinghan Li, Yuan Gao, Jinda Lu, Junfeng Fang, Congcong Wen, Hui Lin, and Xiang Wang. Diffgad: A diffusion- based unsupervised graph anomaly detector. The Thirteenth International Conference Learning Representations (ICIR), 2024.
11

---

Published as a conference paper at ICLR 2026
Fanzhen Liu, Xiaoxiao Ma, Jia Wu, Jian Yang, Shan Xue, Amin Beheshti, Chuan Zhou, Hao Peng, Quan Sheng, and Charu C Aggarwal. Dagad: Data augmentation for graph anomaly detection. In 2022 IEEE international conference data mining (ICDM), pp. 259-268. IEEE, 2022.
Yixin Liu, Zhao Li, Shirui Pan, Chen Gong, Chuan Zhou, and George Karypis. Anomaly detection on attributed networks via contrastive self-superviser learning. IEEE transactions neural networks and learning systems, (166):2378-2322 2021.
Yixin Liu, Shiyuan Li, Yu Zheng, Qingfeng Chen, Chengqi Zhang, and Shirui Pan. Are: A generalist graph anomaly detector with in-context learning. Advances in Neural Information Processing Systems, 11:50722-50804 2024.
Ditria Luke, Benjamin J Meyer, and Tom Drummond. Opengan: Open set generative adversarial networks. In Proceedings of the Asian Conference on Computer Vision, 2020.
Xiaoxiao Ma, Jia Wu, Shan Xue, Jian Yang, Chuan Zhou, Quan Z Sheng, Hui Xiong, and Le- man Akoglu. A comprehensive survey on graph anomaly detection with deep learning. IEEE transactions on knowledge and data engineering, 35(12): 12038, 2021.
Julian McAuley, Christopher Targett, Qinfeng Shi, and Anton Van Den Hengel. Image-based baage-based recommendations on styles and substitutes. In Proceedings of the 38th international ACM SIGIR conference on research and development in information retrieval, pp. 43-52, 2015.
Tomas Mikolov, Ilya Sutskever, Kai Chen, Greg S Corrado, and Jeff Dean. Distributed representations of words and phrases and their compositionality. Advances in neural information processing systems, 26, 2013.
Hang Ni, Jindong Han, Nengjun Zhu, and Hao Liu. Unsupervised graph anomaly detection via multi- huptt-hhpersspher heterophilic graph learning. arXiv preprint arXiv:2503. /2037, 2025.
Zhen Peng, Minnan Luo, Jundong Li, Huan Liu, Qinghua Zheng, et al. Anomalous: A joint modeling approach for anomaly detection attributed networks. In IJCAI, volume 18, pp. 3513-3519) 2018.
Hezhe Qiao and Guansong Pang. Truncated affinity maximization: One-class homophily modeling for graph anomaly detection. Advances Neural Information Processing Systems, 11449990--95111 2023.
Hezhe Qiao, Qingsong Wen, Xiaoli Li, Pe-Peng Lim, and Guansong Pang. Generative semi- supervised graph anomaly detection. Advances in neural information processing systems, 2024.
Hezhe Qiao, Chaoxi Niu, Ling Chen, and Guansong Pang. Anomalygfm: Graph foundation model for zero/few-wet shot anomaly detection. In Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 2, pp. 2326-2337, 2025.
Shebuti Rayana and Leman Akoglu. Collective opinion spam detection: Bridging review networks and metadata. In Proceedings of the 21th acm sigkdd international conference on knowledge discovery and data mining, pp.
2015.
Oleksandr Shchur, Maximilian Mumme, Aleksandar Bojchevski, and Stephan Günnemann. Pitfalls of graph neural network evaluation. arXiv preprint arXiv: I. 1005668, 2018
Jianheng Tang, Fengrui Hua, Ziqi Gao, Peilin Zhao, and Jia Li. Gadbench: Revisiting and bench- marking supervised graph anomaly detection. Advances in Neural Information Processing Systems, 36:29628 22222323-2963,, 2023.
Nathan Vaska, Kevin Leahy, and Victoria Helus. Context-dependent anomaly detection with knowl- edge graph embedding models. In 2022 IEEE 18th International Conference on Automation Science and Engineering (CASE), pp. 2020-2027. IEEE, 2022.
Kuansan Wang, Zhihong Shen, Chiyuan Huang, Chich-Han Wu, Yuxiao Dong, and Anshul Kanakia. Microsoft academic graph: When experts are not enough. Quantitative Science Studies, 1(1): 396-413, 2020.
12

---

Published as a conference paper at ICLR 2026
Qizhou Wang, Guansong Pang, Mahsa Salehi, Wray Buntine, and Christopher Leckie. Cross-domain graph anomaly detection via anomaly aware contrastive alignment. In Proceedings of the AAAI Conference Artificial Intelligence, volume 37, pp. 4676-4684, 2023a.
Qizhou Wang, Guansong Pang, Mahsa Salehi, Xiaokun Xia, and Christopher Leckie. Open-set graph anomaly detection via normal structure regularisation. The Thirteenth International Conference on Learning Representations, 2023b.
Xuhong Wang, Baihong Jin, Ying Du, Ping Cui, Yingshui Tan, and Yupu Yang. One-class graph neural networks for anomaly detection in attributed networks. Neural computing and applications, 13:12073-12085, 2021.
Yidong Wang. Hao Chen, Qiang Heng. Wenxin Hou, Yue Fan, Zhen Wu, Jindong Wang. Marios Savvides, Takahiro Shinozaki, Bhiksha Raj, Bernt Schiele, and Xing Xie. Freematch: Self-adaptive thresholding for semi-supervised learning. International Conference on Learning Representations
(ICLR), 2023c.
Yulei Wu, Hong- Dai, and Haina Tang. Graph neural networks for anomaly detection industrial internet of things. IEEE Internet of Things Journal, 9(12):9214-922) 2021.
Qizhe Xie, Zihang Dai, Eduard Hovy, Thang Luong, and Quoc Le. Unsupervised data augmentation for consistency training. Advances in neural information processing systems, 33:6256-623 62688, 2020.
Jiawen Xu. Know yourself better: Diverse discriminative feature learning improves open set recognition. arXiv preprint arXiv:2404. 10370, 2024.
Zhiming Xu, Xiao Huang. Yue Zhao, Yushun Dong, and Jundong Li. Contrastive attributed network anomaly detection with data augmentation. In Pacific-Asia conference on knowledge discovery and data mining, pp. 457. Springer, 2022.
Chen Yang, Zhixi Feng, Shuyuan Yang, and Qiukai Pan. Open-icl: Open-set modulation classification via incremental contrastive learning. IEEE Transactions on Neural Networks and Learning Systems, 2024.
Hanqing Zeng, Hongkuan Zhou, Ajitesh Srivastava, Rajgopal Kannan, and Viktor Prasanna. Graph- saint: Graph sampling based inductive learning method. International Conference on Learning Representations (ICLR), 2019.
Bowen Zhang, Yidong Wang. Wenxin Hou, Hao Wu, Jindong Wang, Manabu Okumura, and Takahiro Shinozaki. Flexmatch: Boosting semi-supervised learning with curriculum pseudo labeling. Advances in neural information processing systems, 34: 14:18408-18419, 2021.
Jiaqiang Zhang, Senzhang Wang. and Songean Chen. Reconstruction enhanced multi view contrastive learning for anomaly detection on attribbued networks. Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence (IJCAI), pp. 2376-2382, 2022a.
Shaofeng Zhang, Meng Liu, Junchi Yan, Hengrui Zhang, Lingxiao Huang, Xiaokang Yang, and Pinyan Lu. M-mix: Generating hard negatives via multi-sample mixing for contrastive learning. In Proceedings of the 28th ACM SIGKDD conference on knowledge discovery and data mining, pp- 2461-2470, 2022b.
Jiawen Zhu, Choubo Ding, Yu Tian, and Guansong Pang. Anomaly heterogeneity learning for open-set supervised anomaly detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 17616- 1761611766,, 2024.
13

---

Published as a conference paper at ICLR 2026
A STATEMENT ON THE USE OF LARGE LANGUAGE MODELS
During the preparation of this manuscript, we used the Large Language Model (LLM) to polish the language and correct grammatical errors to improve readability. The LLM not involved in any core research aspects of the paper, such as research ideation, experimental design, or analysis of results.
B ALGORITHM
The complete training algorithm of our proposed DEMO framework outlined in Algorithm 1. We divide the training process into three successive parts. Each part corresponds to a core component of DEMO, including mixup anomalies generation, adaptive weighting, and pseudo-labe) generation.
Algorithm Training Procedure of the Proposed DEMO Framework
Require: Graph 9 (V, E, (),, training set Yurin, training anomalies Virin, unlabeled set V
training epochs
Ensure: Trained model parameters 0
Initialize model parameters 0
2: Initialize memory bank .M <- ()
3: for in 1.2...., do
4: Part I: sulti-sample Mixup for Unseen Anomaly Simulation
5: for all anomaly node oatain E Vtrain do
6: Generate mixup embeddings & = Ej 0ig using similarity-based weights ai (Eq. 1)
7: Obtain augmented views 2, bf via node augmentation
8: Calculate consistency loss Loons between views
9:
end for
10: Part II: Energy Gradient-Based Weight Adaptation
11:
for all training node uftain E Vtrain do
12:
Compute energy (v;); and influence score Tva Derive adaptive weight Be, based on energy gradient (Eq. 7)
13:
14:
end for
15:
Part III: Pseudo-Labeling Generation
16:
Update memory bank M with selection history from epoch t
for all unlabeled node Vy E Vu do
18:
Predict probability (1;1;) for each class
19:
Compute class-specifi adaptive thresholds 7, and Te (Eq. 10)
20:
if (v;) 2 ग or (u;) (u,)) I T then
Assign pseudo-label ūú to By based on threshold rule Add (ey, ú5) to V
22:
23:
end
24:
end for
25: Compute total loss in Eq. 11
26:
Update 9 using optimizer
27:
end for
28:
return Final model parameters
C PROOF OF THEOREM
Since more similar samples are inherently more challenging for the model to distinguish, leveraging such samples can enhance the robustness of the model. Therefore, we desire that the synthesized samples generated through the mixup operation retain similarity to the original seen anomaly samples, yet differ sufficiently to approximate the distribution of unseen anomalies. Specifically, by using similarity as weights in the mixup process, we aim to achieve:
(2t, 2z) ) S (21, 27),
(12)
14

---

Published as a conference paper at ICLR 2026
where S denotes the inner- mener-trouct similarity function. Thus, the synthesized samples maintain similar levels of similarity to original samples after mixup. Note that both 2, and 2y are anomaly training samples (z!um and 2j ") abbreviated here for clarity.
Proof of Theorem 3.1: The similarity between the synthesized sample 2; and original sample 2; can be expressed as:
N
N O (zk: 2z).
(2), =
Σ
Oikk
2j
(13)
We separate the contribution from 2j and other samples:
( zj) = aujS a., (z), +
Σ kØj
aasS (Zzs 2z))
(14)
Since the weights Oskk are obtained via a softmax function, follows that (zi, 23) 2 S Ex),
then oij 2 Ozk- Thus, the weights concentrate on highly similar samples. Assuming the similarity between 2 and 2y is the highest among all other samples, it follows that az significantly exceeds the remaining weights.
Further, observing that S (zz,2) 2,) || 11? and letting (=k, 22) S ((2, 2z) + ōkj. where ōkj (2k, 22) - S (Zi, 2z), we substitute into the above equation:
S (ci 2j) ong || + Σ
(S (z;, 2j) + 525]
(15)
Rearranging terms, we have:
S 25) = S (z),
Σ
Osk + ass 1|2/11+ + Σ
Oakōki
(16)
Given that Ex Oikk 1, this simplifies to:
S (z1,,z) = S (z) (1 - (1-)))) + oui |=
Σ Kip
(17)
Since ōkj can be positive or negative, we cannot directly determine the sign of the summation Exes asddyy However, bound its magnitude by applying the triangle inequality:
Σ Oaj 2 2gd
Σ aak 16kzl-
(18)
Thus, we have:
S 28,, 2 S (2 2z) aij)) + ai ||2,
Σ tgg
ass 18yg-
(19)
Letting c= =Ekey Ask 1okyl. we rewrite this as:
S 25),,))) 2 S (21, 24) (1 aij) + ais ||, -c. Despite =; being highly similar to z, it is evident that the similarity between identical samples is greater than between different samples, thus, ai ||zy|| > azzS (zt, 21). Consequently, we have:
(20)
S ( 23) 2 (zs; 2z) (1 ang) + anjS (zi, 2z) - =S S(;,
(21)
Interpretation of c: The value quantifies the cumulative disturbance caused by non-target samples (I: # j) in the synthesized sample's ''s similarity. It is influenced by two factors: 1) Concentration of the weights au (greater concentration implies smaller e. 2) Similarity differences [ōky| among samples (smaller differences imply smaller e).
15

---

Published as a conference paper at ICLR 2026
Table 4: Statistics of 6 datasets including the number of nodes, edges, and dimensions, the number of classes, the number of anomalous classes, the number of anomalous nodes, and the selection interval for anomalous nodes.
Dataset
#Nodes
#Edge
#Dimension
#Classes
#Ano. Classes
# Ano.
#Ano. Prop
Photo
7,650
238,162
745
2
700
0%-55%
Computers
13,752
491,722
767
10
5
2,064
0%-55%
CS
18,333
163,788
6,805
8
4,159
0%6-5%
Yelp 45,954
3,846,979
2
6,677
0%-55%
ogbn-arxiv
169,343
1,166,243
128
40
4
27,830
3%-5%
ogbn-mag 736,389
5,416,271
128
349
15
3,135
0%-00.3%%
D DATASETS DETAILS
We evaluate the performance DEMO on open-set graph anomaly detection using six real-world graph datasets. Notably, there are currently dedicated benchmark datasets tailored for open-set GAD tasks. Therefore, we adapt existing datasets through customized processing to simulate the open-set scenario. Specifically, conduct experiments three small-scale datasets (Photo, Computers, and CS) and three large-scale datasets (Yelp, ogbn-arxiv, and ogbn-mag). Table 4 summarizes the dataset processing details, where "Ano. Classes" denotes the number of anomalous classes, "Ano" indicates the total number of anomalous nodes, and "Ano. Prop" reflects the proportion range of node count each class used determine whether setting, we designate classes with low sample counts as anomaly classes, creating mismatch between the class distribution of the training and testing phases. This better reflects where unknown or unseen anomaly types may emerge test time, posing a significant challenge for generalization. Additional descriptions of each dataset are provided below.
selected as an anomaly class. To emulate the open-set
scenarios
Photo and Computers (McAuley et al., 2015). Amazon Computers and Amazon Photo are subsets of the Amazon co-purchase graph, where nodes represent products, and edges indicate co-purchase relationships. The node features are encoded as bag-of-words from product reviews, and class labels correspond to the product category.
CS. The Computer Science (CS) section of the Coauthor dataset is used for node classification tasks. this dataset, nodes represent authors connected by an edge if they have co-authored a paper. The node features capture the keywords of the authors' papers, while the class labels represent the most active research fields of each author.
Yelp (Zeng et al., 2019). The task of Yelp dataset categorizing types businesses based on customer reviewers and friendship. The Yelp dataset is heterogeneous graph with three distinct views. For our experiments, we focus on the "Review-Ur Assriew--U----e -eve-w (RUR)" edge subset.
ogbn-arxiv (Mikolov et al., 2013). The ogbn-arxiv dataset is a citation network of Computer Science (CS) arXiv papers, where each node represents paper and each directed edge indicates citation. The task to predict the 40 subject areas of these papers, using 40-class classification approach, with realistic data split based publication dates for training, validation, and testing.
ogbn-mag (Wang et al., 2020). The ogbn-mas mag dataset is a heterogeneous network derived from the Microsoft Academic Graph (MAG), consisting of four types of entities: papers, authors, institutions, and fields of study. The task is to predict the venue (conference or journal) of each paper, given its content, references, authors, and affiliations, which formulated as a 349-class classification problem. For experiments, we focus the "paper" nodes, using the ("paper", "citeps", "paper") edges to represent citations between papers.
E BASELINES DETAILS
In our experiments, we compare DEMO with 12 representative GAD methods, which are categorized into two groups: unsupervised and semi-supervised approaches. Notably, TAM, OCGNN, ANOMA- LOUS, and DOMINANT are originally unsupervised models; to incorporate supervision for fair comparison, adopt the semi-supervised design strategy proposed in GGAD. Specifically, for
16

---

Published as a conference paper at ICLR 2026
TAM, refine its affinity maximization objective focus exclusively on labeled normal nodes. In OCGNN, the one-class center optimization is constrained to labeled normal instances. For DOMI- NANT and AnomalyDAE, we restrict their auto-encoding loss computation to labeled normal nodes during training. Below, we provide brief descriptions of these 12 methods.
ANOMALOUS (Peng et al.. 2018). ANOMALOUS proposes joint framework for anomaly detection on attributed networks that integrates attribute selection and anomaly detection using CUR decomposition and residual analysis. It filters out noisy and irrelevant node attributes, improving detection performance by focusing on the most representative attributes.
DOMINANT (Ding et al., 2019). DOMINANT proposes a deep learning model that combines Graph Convolutional Networks (GCN) and autoencoders for anomaly detection in attributed networks, addressing challenges like sparsity and nonlinearity by measuring reconstruction errors from both structural and attribute perspectives.
AnomalyDoo DAE (Fan et al., 2020). Anomaly DAE incorporates an attention mechanism to capture structure patterns and uses both node and attribute embeddings to model cross- moddaltyy interactions during reconstruction, enabling effective anomaly detection.
GAAN (Chen et al., 2020b). GAAN generates fake graph nodes using Gaussian noise and employs an encoder to map both real and fake nodes into latent space, using a discriminator distinguish between real and fake nodes. Anomaly detection is then performed by evaluating reconstruction errors and identification confidence.
CoLA (Liu al., 2021). CoLA uses a contrastive sulf-supe learning framework for anomaly detection in attributed networks, which captures local information by sampling contrastive instance pairs and utilizing GNN- contrastive learning model. The framework targets anomaly detection through specific learning objective and adapts to large networks by training batches of instance pairs rather than the full graph.
CONAD (Xu et al., 2022). CONAD introduces a framework that integrates human knowledge of different anomaly types into attributed network anomaly detection. It employs a novel data augmentation strategy to model prior human knowledge, which is then incorporated into Siamese graph neural network encoder with contrastive loss. Anomalies are detected by ranking nodes based on their reconstruction error.
ConsisGAD (Chen et al., 2024). ConsisGAD a model designed for graph anomaly detection in settings with limited supervision and class imbalance. It leverages unlabeled data through consistency training and a learnable data augmentation mechanism, while utilizing homophily distribution variance to improve class distinction using simplified GNN backbone.
GGAD (Qiao et al., 2024). GGAD introduces semi-supervised generative approach for graph anomaly detection, aiming to better utilize known normal nodes by generating pseudo anomaly nodes ("outlier nodes") for training one-class classifier. It leverages priors asymmetric local affinity and egocentric closeness to generate reliable outlier nodes, thus enhancing detection performance in the absence of ground truth for real anomalies.
TAM (Qiao & Pang, 2023). TAM introduces a novel unsupervised anomaly scoring measure based on local node affinity, where normal nodes exhibit stronger connections with each other than abnormal nodes. It employs Truncated Affinity Maximization (TAM) to learn node representations that maximize local affinity, optimizing on truncated graphs to remove non-homophily edges and improve anomaly detection performance.
OCGNN (Wang al., 2021). OCGNN introduces one-class classification framework for graph anomaly detection, combining the powerful representation ability of graph neural networks with the classical one-class support vector machine objective. This approach addresses the limitations of traditional anomaly detection methods in graph data, achieving significant improvements over existing baselines.
SpaceGNN (Dong al., 2025a) SpaceGNN introduces model for node anomaly detection with limited labels, using a Learnable Space Projection function and a Distance Aware Propagation mod- ule to enhance node representations and information propagation. outperforms data augmentation techniques and achieves better results than existing methods.
NSReg (Wang et al., 2023b). NSReg introduces a novel approach for open-set graph anomaly detection by adding a regularization term to enforce compact, semantically-rich representations of
17

---

Published as a conference paper at ICLR 2026
Table 5: AUC-ROC and AUC-PR on the unseen anomaly classes three small-scale datasets. The best performance is boldfaced, with the second-best underlined.
Datasets
Photo
Computers
CS
Metries
AUC-ROC
AUC-PR
AUC-ROC
AUC-PR
AUC-ROC
AUC-PR
Anomalous
0.4841 10.015
10.015
0.0435
010
0.5640.0.orz
0,1435 100000
0.2364
0.1323 10.004
DOMINANT
0.4721 10.021
0.0548 20648.1.00 004
0.5597 10.078
0.1474 2..00s
0.3836
0.1601 10.003
AnomalyDAE
0.4098
0.0495
0.5793.10.04
0.1530 0.000
0.3724
0. 150610.000
GAAN
0.4708
0.0432.20.om 0002
0.573922.000 0280
0. g..0022
0.4636-20.015
0. 18445200000
CoLA
0.706440.024
0.0808 =0.08.00006
0.4565 #0.01
0.1149=0.00a
0.44 11441..m =00029
0.1792+0.omm
CONAD
0.474664.0024
0.0564=0.011
0.5560+o.com
0.1436=0.00
0.3838
000035
0. o..00
ConsisGAD
0.557 +0.059
0.0563=2000z
0.5057 20.020
0.1
0.7364_0.002
0.4004
GGAD
0.6274
0.0679
0.6636 10.007
0.2471 100054
0.8931 00009
0. 45.56
TAM
10.077
0.0604.10.00 003
0.4458 10.049
0.1159 000000
10.01
0.330610.0m
OCGNN
0,520810.00
0.0563
0,51 10.003
0,1308 10008/0.000
0. 0.7662 2766220.0006
0. 0.440610.007
ANO-S
0.5015+0.032
0.0573
0.4508 #0.061
0.1168:00.02
0,8181 =0.082
0.5727 +0.052
DOM-S
0.5005++o.03
0.0589
0.44244+0.044
0.1118=a..08
0.8239
0.56:55:0.0as
SpaceGNN
0.6808 +0.0a1
0.0733=0.c0m
0.8108
0.5010
00.025
1..14550..06s
11.333++o.0d
NSReg
0.7369 10.014
0.0956
1.0 10,000 pos
0.6846
U.3547=20.00
0.8863_00.o
0.7460
DEMO
0.8202 00.019
0.1303 0..00
0.8119
40.036
0.5032110001
0.935410.com
0,8417 00.017
normal nodes. This helps the model generalize unseen anomalies while reducing false negatives and improving detection performance.
F IMPLEMENTATION DETAILS
F.1 EXPERIMENTAL. PROTOCOL.
In our open-set graph anomaly detection (GAD) experiments, we follow process that alternates between treating different anomaly classes "seen" anomalies and considering the remaining anomaly classes as "unseen" anomalies. For each dataset, we first select a class to be treated as seen and train the model using this class along with normal nodes. The training set consists of the normal nodes and the selected anomaly class. Next, we evaluate the model's 's performance by measuring AUC-ROC and AUC-PR scores on anomaly classes (results Section 4.2) and only on the unseen anomaly classes (results can be found in Section G). Additionally, for smaller datasets (Photo, Computers, CS), we repeat this process five times and record the average and variance. For larger datasets (Yelp, ogbn-arxiv, rgbn-mag), we conduct single experiment due to the large volume of data. We use the same data split for training the baselines to ensure fairness.
F.2 HYPERPARAMETEE SETTING
In addition the implementation details described Section 4.1, we made the following hyperpa- rameter settings. According to (Wang et al., 2023b), we set the number of neighbors for GraphS AGE aggregation to 25 for the first layer and 10 for the second layer, except for the oghn-mag dataset, to improve computational efficiency. We configured the CraphSAGE model with 2 layers, set the dropout rate to 0.5, and the batch size to 512. For the reproduction of unsupervised methods, we referred to the code and would like to thank the authors for making their implementation publicly available.
G MORE EXPERIMENTS
G. GAD PERFORMANCE EXTENSION EXPERIMENT
We evaluate the detection capabilities of all methods on unseen anomaly classes. Specifically, Tables 5 and present the performance each algorithm on three small-scale datasets (Photo, Computers, and CS) and three large-scale datasets (Yelp, ogbn-arxiv, and ogbn-mag), respectively, where seen anomaly
18

---

Published as a conference paper at ICLR 2026
Table 6: AUC-ROC and AUC-PR the unseen anomaly classes on three large-scale datasets. The best performance is boldfaced, with the second-best underlined.
Datasets
Metries
ConsisGAD
GGAD
TAM
OCGNN
ANO-S
S
SpaceGiNN
NSReg
DEMO
AUC-ROC
0.5238
0.6819
0.6016
0,7185
0.7168
0.7056
0.5212
0.4941
0.7235
Yelp
AUC-PR
0.0205
0.0776
0.0351
0.0625
0.0538
0.0381
0,0220
0.0178
0.0635
AUC-ROK RCC
0.5254
0.5101
0OM
OOM
0.4462
0.4474
0,5180
0.5356
0,5643
aghn-arxiv
AUC-PR
0.1655
0.1473
0OM
OOM
0.1187
0,1204
0.1611
0.1566
0,1808
AUC-ROC
0.4879
0OM
0OM
OOM
OOM
OOM
0.4425
0.4628
0.4995
oghn-mag
AUC-PR
0.0039
0OM
0OM
OOM
0.0036
0.0036
0.0053
Photo
Computers
CS
100
100
100
AUC-ROC (%)
AUC-ROC (%)
AUC-ROC (%)
60
60
60
40
40
40
10
20
30
50
100
20
30
50
100
10
20
30
50
100
Number Anomalies
Number of Anomalies
Number Anomalies
CONSISCAD
OCGNN
ANO-S
GGAD
SpaceGNN
NSReg
DEMO
Figure 4: The AUC-ROC under different numbers of training anomalies across three datasets.
nodes are excluded from the test set. Only normal and unseen anomaly nodes are considered in the computation of AUC-ROC and AUC-PR. Overall, DEMO consistently achieves the best performance across both categories of datasets, further confirming its strong generalization ability to unknown anomalies in realistic open-set GAD scenarios. Across all six datasets, DEMO not only outperforms all unsupervised baselines but also significantly exceeds other competitive semi-supervised methods, especially in AUC-PR. Specifically, DEMO achieves the highest AUC-ROC and AUC-PR scores on all three small-scale datasets. For example, on the Photo dataset, DEMO reaches an AUC-ROC of 0.8202, notably surpassing the second-bess method NSReg (0.7369), while also achieving an AUC-PR of O. 0.1303, substantially outperforming all baselines. Similar trends are observed on Computers and CS, indicating that DEMO effectively detects diverse and distribution-shife
unseen anomalies. On large-scale datasets, DEMO again obtains the best and near-best results on Yelp and ogbn-arxiv, with AUC-ROC scores of 0. 7235 and 0.5643, showing significant improvements over all other methods. Even the most challenging ogbn-mag dataset, characterized by extreme class imbalance and large graph size, DEMO maintains its advantage, achieving an AUC-ROC of 0.4995 and an AUC- PR of 0.0053, demonstrating high sensitivity to low-frequency unseen anomalies. In summary, DEMO exhibits strong robustness and generalizability even when seen anomalies are excluded from evaluation, validating its effectiveness in identifying unknown patterns in open-set graph anomaly detection.
G.2 DATA EFFICIENCY EXTENSION EXPERIMENT
We investigate the impact of the number of seen anomalous nodes in the training set on model performance. Specifically, we conduct experiments on three small-scale datasets (Photo, Computers, and CS) by varying the number of training anomalies across five levels: 10, 20, 30, 50, and 100. We evaluate the performance of all methods using AUC-ROC (Figure 4) and AUC-PR (Figure 5) to analyze their adaptability and robustness under both low-resource and high-resource settings. Overall, DEMO consistently outperforms all baselines across different settings. particularly exhibiting a clear advantage under low-resource scenarios (e.g., with only 10 or 20 anomalies), indicating its strong training efficiency and generalization ability in anomaly-scarce situations. More specifically, on the Photo dataset, DEMO achieves the best results both AUC-ROC and AUC-PR in most configurations, with stable performance especially at 20 and 30 anomalies. On the Computers dataset, performance improves steadily as anomalies are added. On the CS dataset, DEMO demonstrates high overall stability, maintaining the best performance even with as few as 10 anomalies, and consistently achieving top scores across different anomaly scales. In conclusion, DEMO demonstrates stable and
19

---

Published as a conference paper at ICLR 2026
Table 7: Loss weights of six datasets
Datasets
Aun
Amix
Aeng
Photo
0.5
0.1
0.1
Computers
0.1
0.5
CS
0.3
0.1
0.3
Yelp
0.3
0.1
0.1
ogbn-arxiv
0.5
0.1
0.1
ogbn-mag
0.5
0.1
0.1
Table 8: Ablation Study on the other three benchmarks.
Datasets
CS
Yelp
ogbu-arxiv
Metries
AR
AP
AR
AP
AR
AP
w/o All
0.7815
0.6394
0.5942
0.1063
0,4219
0.1944
w/o Mix
0.8841
0.8151
0.6519
0.1927
0.5061
0.2455
0.9027
0.7964
0.6637
0.1833
0.5337
0.2849
PL
0.8364
0.8005
0.6362
0.1624
0.4868
0.2517
DEMO
0.9448
0.8857
0.7097
0.2238
0.6364
0.3329
superior detection capability across different levels of anomaly supervision, with its exceptional performance under limited anomaly samples further validating its data efficiency and robustness in open-set GAD.
Photo
Computers
CS
70
70
100
AUC-PR (%)
AUC-PR (%)
AUC-PR (%)
30
30
40
10
50
10
20
100
20
50
100
Number Anomalies
Number Anomalies
Number of Anomalies
CONSISGAD
OCGNN
ANO-S
GGAD
SpaceGNN
NSRRg
DEMO
Figure 5: The AUC-PR under different numbers of training anomalies across three datasets.
G.3 MORE ABLATION STUDY
To further validate our method, we present the ablation study results three additional benchmarks in Table The results consistently corroborate the conclusions from our main analysis. First, removing the PL component results in a substantial performance drop across all three datasets, particularly CS and ogbn-arxiv, demonstrating the critical impact of our class-aware pseudo-labeling in complex scenarios. Second, the exclusion of the EG and Mix modules also leads clear degradation in performance, validating their respective effectiveness prioritizing informative samples and synthesizing diverse anomaly representations. Additionally, the variant DEMO w/o All consistently yields the lowest performance, confirming that the full combination of modules is essential for achieving optimal results. Overall, these extensive results provide further evidence that all three components contribute synergistically to the robustness and superior performance of DEMO.
G.4 PARAMETERS SENSITIVITY
We conduct sensitivity analysis of the loss weights on two datasets (Photo and Computers) to evaluate the contribution and robustness of each component both overall performance and unseen anomaly
20

---

Published as a conference paper at ICLR 2026
PHOTO
COMPUTER ERS
Yelp
20 bracid
Figure 6: Visualization of sample embeddings after Mixup
detection. Specifically, we vary the loss weight Au {0.1, 0.3, 0.5, 0.7} and Xeng E {0.1, 0.5). The results are shown in Figure 7 and 8. Notably, although multi-sample mixup enhances anomaly representation diversity, an overly large mixup ratio may introduce distributional shifts or generate overly blurred features, thereby disrupting the learning of original decision boundaries. This issue becomes more pronounced when labeled anomalies are searce, often leading to unstable training. To mitigate this, treat mixup a lightweight augmentation strategy provide auxiliary distributional support while minimizing structural disruption, and fix its weight at 0.1. As shown the Figure, on the Photo dataset, the model achieves optimal performance when the Aun 0.5 and the Xeng 0.1. For the Computers dataset, the best results are observed when Aun = 0.1 and Aeny = 0.5. In summary, the optimal loss weight configuration varies across datasets, which can be attributed to differences in graph structure complexity, anomaly separability, and feature distribution. For example, datasets with more entangled representations or higher intra-class variability (e.g., Computers) may benefit from stronger sample reweighting to focus on informative nodes. Finally, Table 7 shows the loss weight values across the different datasets.
AUC ROC (AII)
MUC (Al))
AUC-ROC (Unseen)
AUC PR (Unseen)
0.1
0.8030
08577
0.5422
0.1 0.0100
5.0026
0
0.1
2.7342
0.7357
0.7035
5.1 0.111
3.1032
0.0322
1.0
0.3
0.0936
0.8744
0.8486
3.89
0.3
0.6272
0.6120
55003
40
03
0.6020
0.775
0.7205
0.3
0.1266
3.2073
0.0157
3.0
3.66
0.7
0,8977
6
0.7
0
6.6148
0.5466
0.
5.114
0.793
0.7570
0,7
0.1277
3,1150
0.1
0.3
9.5
01
0.5
61
03
0.5
0.1
63
0.5
Aang
Awg
Aur
Aur
Figure 7: Performance impact of loss weights on the Photo dataset.
AUC- ROC (All)
AUC-PR (AlI)
AUC-ROC (Unseen)
AUC-PI (Unseen)
0.1
0.8264
0.004
0 8.344
0.1 0.677)
0.611
0 6:158
0.1
2.7914
0.856
0.811
5.1
0.4901
3.5 3.5019
0.5332
1.64
0.3
0.825
0.829
0.3
0.6264
6432
033
5,7859
0.7552
0.8073
0.495
5.4664
10
-
0.9226
399
-77
C44
0.7.
0.0000
08036
0.617
07. 0.532
0.5774
05550
07.
0.754
0 7630
0.777
0.0209
3.4185
0.224
0.1
0.3
0.5
012
05
61
0.5
0.1
0.3
Pang
Aug
Avrg
Aur
Figure 8: Performance impact of loss weights on the Computers dataset.
G.5 VISUALIZATION OF MIXUP EMBEDDINGS
To investigate the distribution of synthesized anomalies relative to both seen anomalies and nor- mal data, conducted an extended t-SNE visualization experiment across datasets with varying characteristics (Photo, Computers, CS, and Yelp). We projected the embeddings of normal nodes, original "Seen Anomaly" samples, and the synthetic "Mixup Anomaly" samples generated by our
21

---

Published as a conference paper at ICLR 2026
method. As illustrated in Figure 6, the visualization reveals two key observations. First, the "Mixup Anomaly" embeddings (yellow) do not merely overlap with the "Seen Anomaly" cluster (red) but form a broader, diffused distribution that expands outward. This confirms that our strategy effectively explores the potential feature space beyond the limited training samples. Second, across all datasets, there remains clear and distinct separation between the synthesized Mixup anomalies and the normal node clusters. This empirical evidence demonstrates that DEMO successfully expands the anomaly decision boundary to enhance generalization without encroaching upon the normal data distribution, thereby ensuring both the diversity of anomaly representations and the stability of model training.
22


Reviews:
[{"review_id": "gPFFfS9M3F", "reviewer": "Reviewer_PTtY", "summary": "The authors propose a framework, DEMO (Dynamic Multi-sample Mixup with Gradient Exploration), to address the problem of open-set graph anomaly detection (GAD). This task aims to detect not only anomalies seen during training but also novel, unseen types of anomalies, using only a small set of labeled data. The core idea is a three-part dynamic training framework. First, to generalize from limited seen anomalies, DEMO uses a multi-sample mixup strategy that adaptively fuses multiple seen anomaly nodes to synthesize new, diverse samples, thereby expanding the decision boundary. Second, it employs an energy gradient-driven feedback mechanism to dynamically re-weight all training samples, prioritizing uncertain and informative nodes to ensure a more robust optimization process. Third, to combat label scarcity and class imbalance, it maintains a memory bank of historical predictions to guide a pseudo-labeling process with adaptive, class-specific confidence thresholds. The authors demonstrate that DEMO achieves performance on six real-world graph datasets under various open-set evaluation settings.", "questions": "Please address the weaknesses mentioned above.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "There are a few things I like about the paper:\n1. The paper addresses a practical challenge in graph anomaly detection, moving from the closed-set assumption to a more realistic open-set scenario. This is relevant in many application areas when the anomalies are always evolving.\n2. The authors provide experimental validation on six benchmark datasets of varying scales and domains.\n3. The authors provide theoretical analysis of the proposed method.\n4. The authors performed an ablation study to see the source of the performance improvement.", "weaknesses": "1. The work is motivated by open set problem setting. Which aims to also detect new types of anomalies. However, the main ingredient of the proposed method is mixup, where it can only detect anomalies that are linear combinations of seen anomalies in the embedding space. It will be less effective in detecting totally novel anomalies outside the one that have been seen before (which is the advantage of a purely unsupervised model).\n2. There are two types of anomalies that need to be considered in the evaluation, anomalies that come from existing sets/classes, and anomalies that come from new set/classes (open-set). The paper, however, does not distinguish these two in the evaluation. I would suggest the authors add more experimentation that distinguishes these two. Particularly, I am interested in the performance of the proposed method vs semi-supervised baselines on detecting anomalies from existing sets/classes, and the performance of the proposed method vs purely unsupervised baselines on detecting anomalies from new sets/classes.\n3. In the large-scale experiments, DEMO's AUC-PR score on the Yelp dataset is noticeably lower than the best-performing baseline (0.2238 vs. NSReg's 0.3029). Given that AUC-PR is a critical metric for highly imbalanced datasets, this specific underperformance needs further exploration.\n4. The adaptation of purely unsupervised models into semi-supervised models is not clearly explained in the paper.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "UMCgpwCjzY", "reviewer": "Reviewer_5pMP", "summary": "The paper studies open-set GAD, where the goal is to detect both seen and unseen anomalies with limited labelled data. It proposes DEMO, a dynamic multi-sample mixup and gradient exploration framework that generates diverse anomaly samples and adaptively re-weights them based on energy gradients. A memory-bank pseudo-labelling module is further introduced to enhance training stability and handle label scarcity. The perposed method on avergae outperform the baseline methods on the selected datasets.", "questions": "Please refer to my weaknesses.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. The paper explores an interesting and important setting of open-set graph anomaly detection.\n2.  The paper is well-written and easy to follow, with clear structure and presentation.\n3. Theoretical analysis is provided for the proposed augmentation methods for GAD.", "weaknesses": "1. The proposed method relies on data augmentation (multi-sample mixup) as a key contribution, but none of the baseline methods use comparable augmentation strategies. If augmentation is the main source of improvement, the paper should include comparisons with existing augmentation-based methods such as GraphSMOTE (Zhao et al. 2021) or other graph Mixup approaches to ensure a fair evaluation.\n\n2. The ablation results show that removing the pseudo-labelling component leads to a notable performance drop. Does this mean much of the improvement may come from this module rather than the proposed mixup strategy?   It would be helpful for the authors to further clarify on this.\n    \n2. The GAD-related work section fails to mention recent methods that leverage label information, such as meta-learning GAD (Meta-GDN, Ding et al., 2021), cross-domain GAD (ACT, Wang et al., 2023), and generalist GAD (ARC, Liu et al., 2024; AnomalyGMF, Qiao et al., 2024).\n\n3. Since there are two hyperparameters in the main loss, the sensitivity study should cover all datasets and include comparisons with the baselines. The results in Tables 6 and 7 also appear quite sensitive to these parameters.\n\n4. Several references cited as related work are already accepted by recent conferences but are still listed in arXiv format. \n\n5. The number of supervised baselines and datasets used in the experiments is relatively limited. A good reference for finding additional datasets and resources is the GAD Benchmark (Tang et al., 2023).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "YGZE2QHtAa", "reviewer": "Reviewer_5VDR", "summary": "This paper introduces Dynamic Multi-sample Mixup with Gradient Exploration (DEMO) to tackle open-set graph anomaly detection. Its method (1) synthesizes anomalies via multi-sample mixup at the embedding level, (2) weights samples using validation-gradient signals, and (3) adapts class thresholds with a memory bank. Experiments cover six datasets and twelve baselines with ablation studies and sensitivity analysis.", "questions": "See Weakness.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. Open-set graph anomaly detection is an important problem, and is under-explored.\n2. Multi-sample mixup at the embedding level is a neat way to approximate unseen anomalies.\n3. Comprehensive experiments covering 6 datasets and 12 baselines with ablations study and sensitivity analysis.", "weaknesses": "1. The use of index i seems inconsistent. In Definition 3.1, i appears to index synthetic representations, but in Equation 1, i seems to refer to original seen anomaly nodes. Please clarify the indexing scheme and distinguish between source nodes and synthetic outputs.\n\n2. In Section 3.3, some implementation details are missing for the Hessian matrix computation: (i) How is the Hessian computed in practice? (ii) What are the \"optimal parameters\"—current parameters at each step or from separate optimization? (iii) Computing and inverting the full Hessian is computationally prohibitive for large weights. Is any approximation like diagonal Hessian or Hessian-vector products used? Implementation details and computational feasibility discussion are needed.\n\n3. The gradient-based weighting in Section 3.3 uses validation loss gradients to compute training sample weights, which appears to use validation data to guide training. This could have the risk of data leakage and overfitting to the validation set. It would be helpful to discuss whether this leads to data leakage or overfitting and, if feasible, include empirical evidence.\n\n\n4. Section 3.4 would benefit from further clarification. Could you please specify what is meant by “samples selected for class c”? Are these unlabeled samples assigned the pseudo-label c? Given that Table 3 shows pseudo-labeling has a substantial impact on performance, including visualizations of how the thresholds evolve during training could help illustrate this component’s contribution.\n\n\n5. The manuscript does not include a computational or memory complexity analysis. Please provide the method’s time complexity and memory overhead. Given the use of Hessian matrices and their inverses, a scalability analysis with respect to model sizes is also needed.\n\n\n6. In Figure 2, similar colors make methods difficult to distinguish. Please use distinct colors for each method.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "6mtNuc4FjI", "reviewer": "Reviewer_1orP", "summary": "The authors propose an approach named Dynamic Multi-sample Mixup with Gradient Exploration (DEMO) for open-set graph anomaly detection, leveraging a dynamic framework to adapt the optimization procedure with generalizability. Given experimental comparison show the effectiveness to some extent.", "questions": "Please refer to the weaknesses.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. The authors propose an approach named Dynamic Multi-sample Mixup with Gradient Exploration (DEMO) for open-set graph anomaly detection. \n2. Given experimental comparison show the effectiveness to some extent.", "weaknesses": "1. It can be a question that, since there exists anomaly detection dataset benchmark such as [1], why the authors didn't conduct experiments on the real-world datasets. It will be better to report the experimental results on those datasets. \n2. The unseen anomaly simulation can be an significant part of the framework. Therefore, the authors should show the generated embedding of the simulation to show the effectiveness (on above mentioned datasets). \n3. The pseudo-labling generation can be an important component of the framework, and the corresponding loss require a high-quality pseudo-labels. The auhors should present if the generated pseudo labels match with the ground truths (on above mentioned datasets). \n\n[1] Jianheng Tang, Fengrui Hua, Ziqi Gao, Peilin Zhao, Jia Li. GADBench: Revisiting and Benchmarking Supervised Graph Anomaly Detection. NeurIPS 2023.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)