Self-Discriminative Modeling for Anomalous Graph Detection
Authors: Jinyu Cai
Yunhe Zhang
Jicong Fan
Venue: ICML 2025 poster (2025)
Keywords: Anomaly Detection
Graph Neural Networks
Primary area: general_machine_learning->unsupervised_and_semisupervised_learning

Abstract: Identifying anomalous graphs is essential in real-world scenarios such as molecular and social network analysis, yet anomalous samples are generally scarce and unavailable. This paper proposes a Self-Discriminative Modeling (SDM) framework that trains a deep neural network only on normal graphs to detect anomalous graphs. The neural network simultaneously learns to construct pseudo-anomalous graphs from normal graphs and learns an anomaly detector to recognize these pseudo-anomalous graphs. As a result, these pseudo-anomalous graphs interpolate between normal graphs and real anomalous graphs, which leads to a reliable decision boundary of anomaly detection. In this framework, we develop three algorithms with different computational efficiencies and stabilities for anomalous graph detection. Extensive experiments on 12 different graph benchmarks demonstrated that the three variants of SDM consistently outperform the state-of-the-art GLAD baselines. The success of our methods stems from the integration of the discriminative classifier and the well-posed pseudo-anomalous graphs, which provided new insights for graph-level anomaly detection.

Self-Discriminative Modeling for Anomalous Graph Detection
Jinyu Cai Yunhe Zhang" 22 Jicong Fan
Abstract
et al., 2024), tabular data (Dai et al., 2025; Dai & Fan, 2025), and graph nodes edges (Duan et al., 2020; Zheng et al., 2021), graph-level anomaly detection (GLAD) (Akoglu et al., 2015; Qiao et al., 2024a), which aims to identify entire graphs that substantially deviate from normal pat- terns, remains a greater challenge due to the difficulty in analyzing overall relationship between graphs.
Identifying anomalous graphs is essential in real- world scenarios such as molecular and social net- work analysis, yet anomalous samples are gener- ally scarce and unavailable. This paper proposes a Self-Discriminative Modeling (SDM) framework that trains deep neural network only on nor- mal graphs to detect anomalous graphs. The neu- ral network simultaneously learns to construct aseudo-anomaloo graphs from normal graphs and learns an anomaly detector to recognize these pseudo-anomalon graphs. As a result, these sseudo-anomalous graphs interpolate between normal graphs and real anomalous graphs, which leads to reliable decision boundary of anomaly detection. In this framework, we develop three algorithms with different computational efficien- cies and stabilities for anomalous graph detec- tion. Extensive experiments on 12 different graph benchmarks demonstrated that the three variants of SDM consistently outperform the state-of-the- art GLAD baselines. The success of our methods stems from the integration of the discriminative classifier and the well-posed pseudo-anomalous graphs, which provided new insights for graph- level anomaly detection.
A Aammalls Ars icsoablii is takiing Oocerrt oocetiin dee
O hweel
Twring
A
A
Figure I. Motivation of our method. The left plot illustrates a toy example, where the shadowed region is approximated as rectan- gle (or a hypercuboid when d' > 3). The right plot shows a real example, the t-SNE (Van der Maaten & Hinton, 2008) visualiza- tion of the result of our method on the real datasct AIDS.
Early research on GLAD explored the graph kernel (GK) methods (Vishwanathan et al., 2010; Shervashidze et al., 2011) identify graph anomalies by utilizing various simi- larity measurements, though these approaches are limited by their scalability. The emergence of graph neural networks (GNNs) (Kipf & Welling, 2017; Xu et al., 2019; Huang et al., 2023) has significantly advanced the development of GLAD through its powerful graph representation learning capabil- ity. Recent works (Zhao & Akoglu, 2021; Qiu et al., 2022: Zhang et al., 2024) have explored the integration of GNNs with deep one-class classification (DeepSVDD) (Ruff et al., 2018) for GLAD. A hypersphere is taught to model the dis- tribution of normal graphs in the latent space, and anomalies are identified as graphs whose embeddings fall outside of the hypersphere. Beyond these methods, other works have lever- aged various paradigms, such as knowledge distillation (Ma et al., 2022), information bottleneck (Liu et al., 2023a), and Rayleigh quotient (Dong et al., 2024), to enhance the detection of anomalies. Moreover, semi-supervised leam- ing (Zhang et al., 2022a) has been investigated to address the imbalance issue in GLAD by incorporating small fraction of labeled anomalies for decision boundary learning.
1. Introduction
Graphs are widely utilized to represent complex relation- ships or interactions between entities in a variety of real- world contexts, such as molecules, biology, and social net- work data analysis (Mislove et al., 2007; Li et al., 2021; Sun et al., 2023; 2024). Although there have been a lot of works of anomaly detection on image data (Cai & Fan, 2022: Fu
"Equal contribution 'Institute of Data Science, National Uni- versity of Singapore, Singapore 'Department of Computer and Information Science, SKL-IOTSC, University of Macau, Macau, China "School of Data Science, The Chinese University of Hong Kong, Shenzhen, China. Correspondence to: Jicong Fan <fanji- Long@cuhk.edu.cns.
Proceedings of the 42nd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).
Despite the recent advances, several critical challenges still remain to be addressed. The DeepSVDD ap-

---

Self-Disriminative Modeling for Anomalous Graph Detection
SDM-ATI
SDM-ATII
SOM-NAT
SDM-ATI
Generated Nodes X
SDM-ATI
Projector
Anomaly Score
Adversorial
Noise Vector 2
Training
Prior Distribution &
MI Ml.s-b
Discriminator
Generator
Generated Edges
Ancmnious Grapha
SDM-ATII
Projeti
SDM-ATINNAT
Raserbla Normal Crrphhs
Anomaly Score
Adversarial
Training
Disuriminator
Graph Representation
GIN
Node Generator
SDM-NAT
Projector
Anomally Soore
Graph Representation
Non-Adversarial
Normal Graphs
GIN
Edge Generator
Normal
Classifier
Training
Figure 2. Illustration of the architecture the proposed SDM variants. The Green, Orange, and Brown arrows denote the workflows the SDM-ATI, SDM-ATII, and SDM-NAT, respectively.
proaches (Zhao & Akoglu, 2021: Qiu al., 2022: Zhang al., 2024) rely the strong assumption that the distri- bution of graph embeddings follows hypersphere, which may not be realistically achievable in real-world scenar- ios. Additionally, some approaches (Ma et al., 2022; Liu et al., 2023a; Dong et al., 2024) require explicitly defined anomaly scores, which can be challenging to apply in prac- tice the criteria for measuring anomalous graphs could vary significantly across datasets. Although cemi-supervised approaches (Zhang al., 2022a) are promising solution, their effectiveness is constrained by the limited diversity of available graph anomalies in real-world scenarios.
guish normal graphs from yell-posed pseudo-am anomalous graphs effectively.
We introduce two adversarial approaches to produce pseudo-anomalove graphs that closely resemble normal graphs but more similar anomalous ones, where discriminator is learned jointly.
We introduce non-adversarial approach, which gener- ates
graphs by adaptively perturbing normal graphs, and trains classifier to distinguish them.
We demonstrate the effectiveness of three variants of SDM against the state-of-the-art GLAD methods on 12 graph benchmark datasets.
In this paper, we propose SeffDDisrrmminative Modeling (SDM), novel framework for graph-level anomaly de- tection. The key idea (illustrated Figure of SDM distinguish normal graphs from the generated pseudo- anomalous graphs that interpolate between normal and (real) anomalous ones. We introduce two approaches to gen- erate such pseudo-anomalous graphs: (1) training a gen- erator using random noise from a latent distribution and (2) training a perturbator to create anomalics from normal graphs. Both approaches leverage adversarial training, in- corporating discriminator differentiate between normal and pseudo-anomalous graphs. Moreover, propose non-adversarial variant of SDM enhance model stability and accuracy. Based on each of the three approaches, the diserimiinttor/llssiieer serves as the anomaly detector and adaptively learns the decision boundary between normality and abnormality. Figure presents the network structure of SDM (three variants). Our contributions are as follows:
2. Self-Discriminative Modeling for Anomalous Graph Detection
2.1. Problem Formulation and Motivation Description
Problem Formulation. Let G = {GI...., GN3 be graph dataset comprising graphs, where a single graph G = (V,, E.} contains a node set V, and an edge set E. The adjacency matrix of G; represented by A, {0, (0,1)mxxm, where n, [V]]. The feature matrix of nodes of G; is denoted X, E Roaxd Suppose the graphs in G are normal graphs, we want to train model from G to determine whether a new graph Gnew is normal or abnormal, This problem is called anomalous graph detection (AGD)*. A key assumption of the AGD problem is that GI,..., ......,G GN
Note that this is an unsupervised learning problem, of which the training data do not contain any anomalous graphs. There are also supervised and semi-supervised settings (Ruff al., 2020; Zhang et al., 2022a).
We propose a novel and efficient GLAD framework that re- volves around training discriminator (classifier) distin-
2

---

Self-Diseriminative Modeling for Anomalous Graph Detection
are drawn from an unknown distribution 2 (deemed as normal distribution), while any graphs drawn from any other distributions, denoted as G, are anomalous. Very impor- tantly, there is no overlap between 9 and all possible 9. The AGD problem can be regarded as a binary classification problem, i.e., justifying ~ 2 or G ~ D. The objective is to train a classifier fe, using only the given graph set G, to distinguish between G drawn from 9 and G drawn from Φ. However, the difficulty is that ② is completely unknown. Therefore, we need to estimate S from G, or at least gen- erate some samples drawn from a subset of 2 using G. To achieve this, we may solve the following problem
curve, which can be theoretically proved as follows. Let's consider more general case in d-dimension space. The shadowed region (between the two black curves in 2D) in the radius-r hypersphere (the yellow circle in 2D) can be approximated as a hypercuboid. Therefore, the volume of the shadowed region is approximated by
Vs
(3)
where w denotes the width of hypercuboid, wi
Wa = 2r and 1 S a < d. Then, the ratio of expected num- bers of pseudo-anomalous graphs in the shadowed region and the unshadowed region in the hypersphere is
minimize 0,9g
E (y.fo(G)) G~9
E fo()),
subject to dist( 9, 9.) ST,
(2r) ii=++1 W;
(4)
q4/2,ad I[I+d/2)
(2r) II: W;
where y = 1 and y = 0 denote the labels of normal and anomalous graphs, respectively, (-) denotes a classifier (e.g. a neural network) parameterized with 9, and E(-) de- notes the loss function. The constraint in Eq. (1) means that D and 9g should be close enough with respect to distance metric dist(..)) ) where T > 0 is a small constant. However, in Eq. (I), 9 remains unknown, and the requirement for to not overlap with 2 can be overly restrictive. Even if D. overlap with 2, the learned fe could still be effective, provided that the decision boundary encloses D compactly (to be shown in Figure 1).
where we have, WLOG, assumed that the points are dis- tributed uniformly because G ~ g (G( is stochastic oper-
ation. To simplify the analysis, we show the following two examples of Eq. (4):
if d d= and a 1,
TP 210
Awr
if d 3 and a = 2.
We see that i) decreases when w decreases or r increases, where r is related to the variation of pseudo-anomalous graphs. We can conclude that most eseudo-anomaloon graphs are outside the shadowed region when there are some small w,, namely, the latent dimension of the normal data is much lower than the ambient dimension. It also means they interpolate between normal graphs and real anomalous graphs. In this case, a classifier that can distinguish between the normal training data and most pseudo-anomalous graphs is sufficient to detect anomalous graphs. Besides, in Eq. (2), fe should not be too complex. Otherwise, it will overfit G and the pseudo-anomalous graphs, leading to poor generalization to unseen graphs.
Instead of solving Eq. (1), we propose to train model go that is able to generate geeuo-anomalous graphs from nor- mal graphs and simultancously train classifier fo that can provide a reliable decision boundary between normal graphs and anomalous graphs. To ensure an effective detector fo. we should guarantee the following properties:
The generated peuuo-annmaloot graphs by I6 interpolate between normal ones and (real) anomalous ones.
fe distinguishes between the normal training graphs and most of the generated pseudo-anomalout graphs.
The second plot in Figure I is a visualization of our method on a real dataset and highlights the successful learning of a useful decision boundary: the generated anomalous graphs surround the normal ones, alongside the (real) anomalous ones. More visualization results of real examples refer to Figures 7 and 8 (Appendix E). We call Eq. (2) Self- Discriminative Modeling (SDM) based GLAD. In the fol- lowing three sections, we will show how to solve Eq. (2) approximately and develop three variants of SDM.
We therefore solve
min E folG)) G~g
E
(o.f) (2)
0,0
Gr)
where (.) converts a normal graph to a distribution of pseudo-anomalous graphs.
Motivation Deseription. Here we visualize our motiva- tion and show that the two aforementioned properties can be guaranteed. As shown in Figure 1, the first plot sum- marizes the motivation of Eq. (2). Specifically, the blue points represent normal training data, roughly lying on a (blue) curve. Is perturbs each normal graph randomly to generate one or more pseudo-anone anoomalus graphs. We see that most aeeudoannoaloowe graphs are far from the blue
2.2. self-Disrimmnntive Modeling: SDM-ATI
We first present a GAN-based approach to generate pseudo- anomalous graphs. The model consists of graph gener- ator Go and a graph discriminator Dw, which are alterna- tively trained in an adversarial manner. The generator tries
3

---

Self-Diseriminative Modeling for Anomalous Graph Detection
to produce fake (pseudo-anomalous)) graphs (containing nodes and edges generation) that can fool the discrimina- tor, while the discriminator tries to differentiate between anomalous and normal graphs. Specifically, the genera- tor G generates nodes and edges to form a fake graph set G = (,,,..., ,..,. We first sample random variable 2 from a latent distribution Pz= ;= (0, 1) and construct the adjacency matrix as follows
where Pg denotes the normal graph data distribution, and Z, R is sampled from the prior distribution Pz
N 1). Particularly, the discriminator can naturally serve as an anomaly detector after training. Comparing to Eq. (1), we see that the constraint dist( 2, 2.) I < is guaranteed if Go given by Eq. (9) is strong enough. It is difficult to guarantee for Eq. (1) that L, does not overlap with 2, which however is not compulsory because it is still possible to learn a discriminator from overlapping L, 9, to distinguish between D and Φ. We call this method SDM- ATI, where AT represents adversarial training. Although SDM-ATI is promising for anomalous graph detection, it may suffer from the following problems:
À = T(XX)) X= (Z),, Ž P~rP Z
(6)
where Go is a Multi-Layer Perceptron (MLP)-based genera- tor that maps the random latent variable Ż E Nxdx xd to the anomalous node attributes, and T : E-- + [0, 1] denotes an element-wis transformation function, e.g. Sigmoid(-). In this way, we generate anomalous graph set G with the generator Gg. We then introduce a discriminator Dw., which takes the anomalous graphs G and normal graphs G as input, and aims to distinguish between them effectively. To fully exploit the structural information of graphs, Da is expected to be a GNN-based discriminator. Specifically, we leverage GIN (Xu et al., 2019) as the backbone network of the dis- criminator D., to learn graph-level representations. Assume we have an input graph G. the latent features (*)) (v) of node in the k-th layer of GIN can be obtained by aggregat- ing the learned features from its neighboring nodes in the (K- - 1) layer, which can be formulated as
An MLP-based generator may not effectively capture the structural information of graphs, which could impede the generation of high-quality anomalous graphs.
The interpretability of the GAN-based method is limited because generating anomalous graphs from random noise does not necessarily guarantee the quality of the generated anomalous graphs.
The optimization of the GAN-based method involves a min- main-mxx game, which can lead to instability during train- ing. Besides, the competition between the generator and discriminator may result in mode collapse, leading to the generation of poor-quality anomalous graphs.
h (w) =S(COMBINE( (w), AGGREGATE(() (in-)))))) (()))))(())))),
2.3. Self- Dise--isciiiitevve Modeling: SDM-ATII
To address the first two problems of SDM-ATI, we propose variant of our SDM-ATI, which can leverage the struetural information, and further provide more explicit guidance for the generator Ga. ensuring the generation of high-qualit, anomalous graphs that closely resemble normal ones but can still be distinguished by the discriminator. Specifically, we introduce the GIN-based VGAE (Kipf & Welling, 2016) framework to build the generator Gg. which consists of a node generator and an edge generator to learn anomalous graphs. The node generator aims to generate anomalous attributes X, while the edge generator, which does not in- clude decoder, aims to generate the adjacency matrix A. Instead of sampling the input of Go from the latent distribu- tion F we take the normal graph set C as the input of Go- to generate anomalous graphs G that are close to G but are expressive pseudo- aanomdoss graphs.
where C(v) denotes the neighbor set of node v, and 5(-) is non-linear activation function such as ReLU. AGGREGATE(.) function combines the features of neigh- boring nodes in C(v), and COMBINE(.) function combines the features from the previous layer and the aggregated neighborhood information to obtain the current layer's fea- tures. Note that the attribute x,, of node v serves the initial features, i.e., h (0)) (v) X Then the graph-level representation of graph G2 can be derived as follows
ha. = C((CONCAT(h**0 k E (L....,Khh,, e G.), (8)
where CONCAT(-) function concatenates the representa- tions learned in each GIN layer, and R(-) denotes the sum- readout function. Consequently, we can learn the graph- level representations Hg and Ha for normal and pseudo- anomalous graphs by aggregating the node features, and train the discriminator to distinguish them as much as possi- ble. The generator G, and discriminator D.,, are alternatively optimized with a min-max game as follows
Here, we only describe the node generator, as it differs from the edge generator just in the existence of a decoder. We first learns the graph-level representation H. for the in- put graphs G = (G1,..... GN) } by Eqs. (7) and (8), where G (X, A.). Next, map the graph-level represen- tation into latent Gaussian distribution N Nu,, a²)) in VGAE, where the means μ and deviations or are defined as
min max E [X,, A:)]-
AiNe
(9)
E (G. ((01 2,232
# = GIN, (He, A), a = exp(GGNN, (He, A)), (10)
4

---

Self-Diseriminative Modeling for Anomalous Graph Detection
where ja and a can explicitly define an inference model that can sample the latent graph representations Zς from it as follows
where the discrepancy loss and KL-divergence terms are specific to the generator. This variant is based on adver- sarial training and perturbation learning, where the pseudo- anomalous graphs are generated via perturbing the latent variable of normal graphs. For convenience, we call this method SDM-ATII. Compared to the GAN-based method, SDM-ATI and SDM-ATII offer better interpretability by ex- plicitly guiding the generator to generate peeudoannomaous graphs that closely resemble the normal ones. Additionally, SDM-ATII offers better control over the diversity of the generated graphs by penalizing the KI KI.-divergence between the distribution of learned latent graph representation and a prior Gaussian distribution. Compared to Eq. (2), we explicitly defined the discrepancy loss, i.e., Eq. (14), to guarantee that the generated anomalous graphs surrounded the normal ones and learn the decision boundary from the adversarial training of the generator and discriminator. This variant offers improved interpretability compared to SDM- ATI, which relies solely on adversarial training between the generator and discriminator to guarantee the constraint. However, SDM-ATII still suffers from the instability of the min-max optimization.
H A)= 9 Zg
II E=1
9 LG. Hg.
(11)
where g(Z.. Hg, A) = (Zz., in; diag(o;)). Since the sample operation could not provide gradient information, we leverage the reparametrization trick (Kingma & Welling, 2014) to sample the latent graph representation, i.e.
Zg ب + co, (( 1),
(12)
where e denotes the random Gaussian noise subject to the standard normal distribution. Consequently, we can generate a negative graph set, including edges and nodes by
À (ZzZE), X MLP(Ze),
(13)
where MLP(-) denotes an MLP-based decoder, which aims to generate anomalous attributes X from the latent graph representations, and the anomalous adjacent matrix Å is generated from the latent graph representation learned by the edge generator following Eq. (13).
We expect to generate high-quality pseudo-anomalous graphs that closely resemble normal ones but can still be distinguished by the classifier. This requires high level of similarity between the generated anomalous graphs and the normal graphs, which can be regarded as minimizing the discrepancy between the generated graphs and the normal ones. Therefore, we propose to minimize the following discrepancy loss:
2.4. Self-Disrrmminatie Modeling: SDM-NAT
To address the instability of the min-max optimization in the adversarial approaches SDM-ATI and SDM-ATII we fur- ther propose a non-adversarial variant called SDM-NAT for the perturbation learning- based variant SDM-ATII, which avoids the instability problem of GANs and simplifies the training process. Specifically, rather than training a genera- tor and a discriminator to compete against each other, we proposed to directly train a classifier fe to distinguish the anomalous graphs produced by generator Go from normal ones. We can accomplish this by utilizing the node genera- tor and edge generator to produce set of anomalous graphs G from normal graphs G, and subsequently train classifier to distinguish them. The overall objective is
Ldis
1 N
Σ
x. (|x
X|
(A, log(A,)
(14)
(1 A.) log(1 -A:))).
where X, and A; are the node attribute and adjacency ma- trix generated by the node generator and edge generator of Go respectively, i.e., X,, G,(X,,,), A.). The first term denotes the attribute reconstruction loss, and the sec- ond denotes the binary cross- cross-entropy loss. Additionally, the distribution of learned latent representation Ze is ex- pected to follow a pre-defined prior distribution, which allows the generated latent representations ZG to be uni- formly distributed in the latent space, ensuring the diver- sity of generated graphs. We can achieve this by penaliz- ing the KL-divergence between o( Ze| He, A) and a prior distribution P(Z). i.e., [L Zo Hc AZ)] where P(Z)= = 11. P(Z,) = (Z, J. I) typically follows a Gaussian prior distribution. The overall objective function of the perturbation learning-based approach is
I N Σ fol,, A.) + E(T (X., (16)
min 6,0
+ He
where E(.) denotes the binary cross-entropy loss of the clas- sifier, the definitions of Ldis and the KL-divergence are exactly the same as Eq. (15). The classifier is based on GIN, which receives attribute and adjacency matrices as inputs, allowing for consideration of the structural infor- mation of the graphs. More importantly, our method is unsupervised, requiring no supervised information. We simply set 9: _... UN 0 for the generated anoma- lous graphs, and y1 = ... = yn = for normal graphs. Compared to Eq. (2), we directly learn the decision bound- ary by simultancously training a classifier with a generator that produces high-quality pseudo-anomalout graphs for the
min max
E A,
[D, DG A.))
(15)
+ Matha + K Ze H5, A)JP(((()))
5

---

Self-Diseriminative Modeling for Anomalous Graph Detection
classifier. This makes our method particularly appealing for real-world applications where obtaining labeled data is challenging and costly.
We further highlight the conceptual advances of our SDM framework by extensively discussing existing GLAD meth- ods and GAN-based strategies in Appendix A. To facilitate the understanding of the proposed SDM methods, we also provide the detailed training procedures SDM-ATI, SDM- АTII and SDM-NAT in Appendix I.
(0e-11-2281)
10--11-2203)
10x-0) 2325)
07
3. Experiment
Figure 3. The decision boundaries learned from 2-D synthetic data x == sin(2) + with different e.
3.1. Experiment Configuration
Datasets. We evaluate the anomaly detection perfor- mance across various graph benchmark datasets, including (1) Small and Moderate-scale Dataset: Four molecule datasets (MUTAG, AIDS, COX2, and ER RMD), three bi- ological datasets (PROTEINS, DD, and ENZYMES), and one social network dataset HMMD--IIARYY These three types of data are typical graph-structured data in real-worid scenarios. (2) Imbalanced Large-scale Dataset: Four imbalanced large-scale molecule graph datasets (SW-620, MOLT-4, PC-3, and MCF-7) to evaluate the GLAD perfor- mance under imbalanced scenarios. Note that all the datasets used in our experiment are sourced from TUDataset (Moriis et al., 2020), a publicly available graph database For more details for each dataset, please refer to Appendix B.
Evaluation Metrics. We utilize AUC and F1-Score to evaluate the anomaly detection performance and report the mean value and standard deviation of 10 trials of each method on each dataset.
Other Details. We provide other settings in Appendix C, including the details regarding data split, trade-off parame- ters, baseline settings, training details, and implementation.
3.2. Simulation Analysis for Decision Boundary
We ran simulation show the key idea and effectiveness of our methods in addition to Figure 2. For convenience, we only consider SDM-NAT, and we will not use graphs because it is difficult to conduct a reasonable simulation for a number of graphs. Therefore, the corresponding back- bones of SDM-NAT are changed to VAE (generator) and common MLP-based classifier. Specifically, we generate number of synthetic 2-1) samples (normal training data) using z sin(z) + e, where is noise drawn from uniform distribution (-a, a). A larger leads to wider normal region. The simulation results are shown in Figure 3, where the pink curve denotes the learned decision bound- aries, and the background color in the figure (changing from blue red) implies that the score given by the classifier is increasing. The observations are as follows:
Network Architecture. For the network architecture of the proposed SDM variants, we utilize a 3-layer GIN as the backbone network for the generator and discriminator (classifier) in SDM-ATII and SDM-NAT, except for the gen- erator of SDM-ATI, which is an MLP-based neural network. The aggregated dimension and the dimensions of the two latent layers in GIN are set to 16 and 10, respectively.
Baselines. We extensively compare the three SDM vari- ants with ttate-of-the-art GLAD baselines:
1. Graph Kernel: Short-Path kernel (SP) (Borgwardt & Kriegel, 2005), Weisfeiler-Lehman kernel (WL.) (Sher- vashidze et al., 2011), Neighborhood Hash kernel (NH) (Hido & Kashima, 2009), and Random Walk kernel (RW) (Vishwanathan al., 2010).
The generated pseudo-anomalous data is usually dis- tributed close to the training (normal) data and shows a similar manifold trend as the normal one.
In most cases, the classifier can distinguish those pseudo- anomalous data far from the normal area.
2. GNN-based GLAD:
VGAE-AD (Kipf & Welling, 2016), GCN (Kipf& & Welling, 2017), GIN (Xu et al.,
2019), SOPOOL (Wang& & Ji, 2020), RWGNN (Nikolentzos & Vazirgiannis, 2020), OCGIN (Zhao& & Akoglu, 2021),
When the interval of normal data turns from narrow to wide, some generated pseudo-anomalous data may be lo- cated close to training data, but the classifier would neglect most of them and draw a superior decision boundary sur- rounding all training data.
GLocalKD (Ma et al., 2021), OCGTL (Qiu et al., 2022),
iGAD (Zhang et al., 2022a), SIGNET (Liu et al., 2023a),
MUSE (Kim et al., 2024), DO2HSC (Zhang et al., 2024).
In conclusion, the proposed model can effectively handle
6

---

Self-Diseriminative Modeling for Anomalous Graph Detection
Table 1. Average AUCs and F1 -coorrs with standard deviation (10 trials) of different GLAD methods. We assess models by regarding the
individual classes as the normal class, respectively. The best results are highlighted in bold and "OM" means out of memory.
Method
Metric
PROTEINS
DD
IMDB BINARY
ER MD
0
SP (Borgwardt & Kriegel, 2005)
AUC
66.8310.00
52.02 0.00
82.73.10.00
31.57.0.000
45.92
0.00
47.16.10.00
40.9210.00
06.00.1..00
FI-Score
63.64+00.0
44.50-0.00
76.09+00.00
38.14+0.00
59.00-
0.00
61.00+0..00
37.74+0.00
63.89-00.00
AUC
73.194:0.00
50.19-0.00
81.57-+0.00
19:22+0.00
51.57 0.00
46.07-10.00
45.71+-0.00
72.11-00.00
WL (Shervashidze et al., 2011)
F1 F1-Score
76.82:00.0
33.80=00.00
74.64:10.00
26.8010.00
61.00-0000
58,00:10.00
45.28110.00
69.44:0.00
AUC
68.28:10.00
55.51=0.00
81.61=0.32
36.8422..00
53.21=0.00
46.52:20.00
51.55+22000
72.38=0.88 0.87
NH (Hidoo& & Kushima, 2009)
Fl Score
68.79100.3
41.93-0.21
73.91
40.82.11.54
57.71 1.46
64,40.10.80
50.1910..92
63.89.0..00
AUC
OM
OM
OM
OM
49051=0.00
53.11:10.00
78.94100.00
70.33:00.00
RW (Vishwanatham al., 2010)
F1-Score
OM
48.88
45.87:10.00
1..96100.00
62.60
AUC
2..95
26.09
79.01_11..64
64.95..5.34
65.36_
67.22.13.49
8..89
59.48_16.94
VGAE-AD (Kipf& Welling, 2016)
FI-Score
35.15:+2.117
79.33=2.06 06
70.4247.55
76.67=0.39
62.40=3.76
64.79:14.35
81.51+4.20
58.89
OCGIN (Zhao& & Akoglu, 2021)
AUC
55.011:9.65
47.77=1.64
66.59:+:4444
60.03+5.34
34.82=1.67
65.0448.79
37.63+3.559
67.51=1.32
F1-Score
64.18100.15
43.42=0.00
56.12:10.00
62.24::0.00
40.50 1 550
63.50:88.50
50.9411.899
59.46:00.00
AUC
72.12:t:000
74.80=0.12
80,59:20.00
79.96:2.01
53.83=1.24
53.34:00066
78.94:00.00
71.54:00000
GLocalKD (Ma et al.,, 2022)
F1-Score
70.76110.37
71.78
73.48.10.57
71.13.1.000
04.91-0.33
56.06.10.11
70.21110:00
62.86.10.00
OCGTL (Qia et al., 2022)
AUC
63.201:5.40
58.10=6.10
77.52:10.43
82:45:00119
65.10= 80
6..12:41.27
72.67::0.0
29.63=0.188
FI-Score
NIA
N/A
71,65=00.73
47.96=2.14
36.48=1.56
61.58:11.2 1.21
67.17=0.92
39.65=1.77 1.77
SIGNET (Liu et al., 2023a)
AUC
69.51++0.76
73.58=0.85
59.5343.45
59.92:#0770
67.9+0.96
64,31+0.44
17.18+8.. 12
60.43+47.3
FI-Soore
64.39:1:.62
73.33=0.91
56.76:3347
59.11=0.49
64.67=0.47
62.33=0047
60.43=7.33
56.11=6.43
AUC
13.17++1.20
41.86=1.31
61.06+3.03
38.01+22003
45.17=3.88
70.86+1 1.92
31.07=4.58
77,99=0.55
MUSE (Kim al., 2024)
F1-Score
6..58111116
44.67=0.97
58.32:13.08
40.21::2.01
46.10=4.70
65.13:1172
35.671:4.9
69.44:0.00
AUC
1,904:11.99
52.96=2.70
77.12+2.15
76.51=3.17
75.47=3.90
77.37:45003
68.31+4.31
72.65=0.09
DO2HSC (Zhang al., 2024)
F1-Score
61.14422.67
50.00-2.72
70.87++2.73
75.61+22.73
73.28-2.44
79.80++0.50
66.63433.04
68. 68.67=00.99
SDM-ATI
ADC
94.93+-0.03
89.19-0.11
85.71-11.37
88.50+-3.22
62.92-0.62 0.62
86.53-+0.00
90.524-2.93
95.05 1.48
FI-Soore
91.18+0.00
94.89=0.89
82,41+3.07
84,54=3.57
66. 14.76-0.28
75.58+00.99
89.94=0.89
80.00=0.00
AUC
95.28 II
95.15-00006
86.59++6.56
98.00=0.01
91.76=1.00 1.06
87.93-+0.25
77. 15:1:553..2
94,92=00811
SDM-ATII
F1-Soore
88.47:0.21
86.67=0.00
79.53:24.8
91.75=0000
86.29=0.58
81.25=:0.00
73.964331.6
91.11=1.11
SDM
AUC
95.91122.58
98.25-0.02
90.71.1.11
99,23
99,94 0.06
9..79
98.74
96.67
Fl Score
9..42+00.22
94.44 0.00
+3.68
97.59
99.75
0.25
91,33 14.92
91.19-0..0
92.31 - 0.65
For instance, in the first class of PROTEINS, SDM-NAT achieves 95.91 % AUC and 92.42% F1-Score, which signif- icantly outperforms the latest baselines such as SIGNET (69.51% AUC, 64.39% F1-Score). MUSE (73.17% AUC, 67.58% F1-Score), and DO2HSC (66.04% AUC, 61.14% FI-Score). Particularly, we identify "performance flip" phenomenon, where the performance of different classes in a dataset may have significant differences in approaches, such as most graph kernels, MUSE (on DD), and DO2HSC (on PROTEINS). phenomenon is largely absent in SDM variants, as they maintain robust and competitive performance across differ- ent classes. In terms of the stability of the proposed three SDM variants, we summarize a performance overview (cov- ering Tables I and 6) in Table 2, where the results indicate that SDM-NAT achieved the best performance in most cases and consistently maintains the lowest standard deviation (under 5%) for both AUC and F1-Score. This highlights the strong stability and effectiveness of SDM-NAT compared to the other two adversarial variants.
Table 2. Overall performance analysis for the three variants of SDM on One- One-Class GLAD (Tables and 6).
Metrie
SDM-ATI
SDM-ATII
SDM-NAT
Min std
5/14
4/14
10/14
AUC
std=55%
10/14
11/14
14/14
Best Result
2/14
2/14
14/14
Min stel
7/14
4/14
9/14
F1-Score
5%
13/14
12/14
14/14
Best Result
2/14
1/14
14/14
evident that the "performance flip"
normal intervals with different gaps, where the learned de- cision boundaries enclose the normal training data tightly. The simulation results in Figure 3 strongly support our as- sumption and motivation.
3.3. Experiment on One-Class GLAD
We compare our SDM variants (SDM-ATI, SDM-ATII, and SDM-NAT) with state-of-the-art GLAD approaches under the one-class classification setting, where the evalua- tions cover various types of graph-structured data, including molecule, biology, and social network data. Table and Table 6 (in Appendix D) present the experimental results in terms of AUC and F1-Score. We can observe that the three variants of SDM demonstrate consistent improvements over both graph kernel methods and GNN-base GLAD methods.
3.4. Experiment on Large-scale Imbalanced GLAD
We evaluate the performance on four large-scale imbalanced datasets, including SW-620, MOLT-4, PC-3, and MCF-7, where the rare "active" status in anti-cancer molecules is
7

---

Self-Diseriminative Modeling for Anomalous Graph Detection
Table Average AUCs and FI-Scores with standard deviation (10 trials) on large-scale imhalanced graph datasets. The best results are marked in bold, and "N/A" denotes that the result is not available.
Method
SW-620
MOLT-4
PC-3
MCF-7
Supervised
AUC
FI-Score
AUC
FI-Score
AUC
FI-Score
AUC
FI-Score
GCN (Kipf Welling, 2017)
74.90-00.4
52.00-0.887
72.55-0.52
50.53+1.03
75.36++2.13
49.99-1.66
72.70+11.05
48.76+00599
GIN (Xu et al., 2019)
78.61+2.85
58.47=5.43
75. 75.86=1.60
55.43+6.52
18.44+1.67
59.07=4.15
19,
58.27+3320
SOPOOL (Wang& & Ji, 2020)
75.51=5.06
58.11=2.86
75.11=0.97
56.20=3.64
1.537+1.53
57.80 57.80=3.74
75.64+2.17
56,82433577
RWGNN (Nikolentzos & Vazirgiamnis, 2020)
73.37+0.36
51,31=1.62
71.30+1.23
50.674-2.64
76.27+0..6
50.44-2.76
70.47+1.26
51.65433.6
iGAD (Zhang et al., 2022a)
85.82:00.9
63.68=1.56
83.59=1.07
63,30+11117
16.04+1.14
03.50=0073
83.22240.4
64,70422.5
Unsupervised
AUC
F1-Score
AUC
FI-Score
AUC
F1-Score
AUC
FI-Score
GLocalKD (Ma al., 2022)
64.14110.92
60.73.10.03
63.43.11.24
60.73
66.08 1.004
43.13 0.14
61.431 1.26
45.00110.17
OCGTI QQin al., 2022)
67.69+00.02
27.01-0.90
57.42+22.38
53.38-+0.64 6.64
68.42441.73
27.03-00442
64.92+1.99 1.92
+4.71--1..70
SIGNET (Liu et al., 2023a)
39.32=#0.77
75.40=0.19
44.28=0033
70,28++0.11 16
40.56-+3.05
76.17=0.31
40.22+00.55
68. 08.300+0.42
MUSE (Kim ct al., 2024)
N/A
N/A
N/AA
N/A
49.18:22.42
76.60=0.71
48. 48.7842.00
68.87:40.99
DO2HSC (Zhang et al., 2024)
43.12:0..0
33.65=0.66
51.51=2.39
42.30::1.34
52.25:3.118
35 35.66611226
53.08:2..38
43.73:::1.32
SDM-ATI
90.19:8..94
87.40=0.21
90.25=7.57
83,59=00224
91.59:66.3 73
86.82=2.12
81.62+8.18
80.61+0.04
SDM-ATII
92.91++5.48
91.61-0.00
97.05+ 2.39
83.76--0.07
94, 94.30--0.63
87.47-1.13
88.40+-0.13
82.344+0.12
SDM-NAT
94.26++2.86
93.16=1.99
94.20=44.79
90.36++2.39
97,09=
94.17=1.70
94.71+2.13
18.9
treated as anomalies. Note that we exclude graph kernel methods for comparison due to their scalability constraints. Instead, we compare our SDM variants with the latest GNN- based approaches, including both unsupervised and super- vised ones. Table presents the comparison results, where we observe that supervised methods such as DCGNN and
Algorithm
90
OCGIN
GLocalKD
OCGTL
80
MUSE
AUC (%)
SP
70
WL
iGAD, significantly outperform unsupervised baselines like
VGAE-AD
60
SIGNET
OCGTL and GLocalKD. This demonstrates that supervised methods can still leverage the limited labeled anomalies in large-scale imbalanced scenarios to facilitate anomaly detection. Nevertheless, supervised methods do not gener- alize well when the test data are not drawn from the same distribution as the training data, especially when the amount of available anomalous graphs limited. Conversely, the proposed SDM variants, such as SDM-ATII and SDM-NAT, consistently surpass supervised baselines such DGCNN and iGAD by more than 10% on most datasets. This can be attributed to the capability of SDM to generate high-quality aneualoanomalous graphs for refining a more robust deci- sion boundary without extensive reliance on labeled data. Additionally, SDM-NAT demonstrates better stability and accuracy compared to SDM-ATI, as it avoids the instability of GAN-based max-min optimization and explicitly defines an objective of generating high-quality anomalous graphs.
DO2HSC
SDM-ATI
50
SDM-ATII
SDM-NAT
Algorithm
Figure 4. Experimental results of multi-class graph-level anomaly detection task on ENZYMES.
ity and potential of the proposed methods in dealing with multi-class GLAD scenarios. Moreover, SDM-NAT and SDM-ATII demonstrate better performance than SDM-ATI, and SDM-NAT exhibits more stability than SDM-ATII, as it has fewer performance fluctuations.
3.6. Analysis of Discriminative Scores
Figure 5 shows the discriminative scores of SDM-ATI, SDM-ATII, and SDM-NAT on MUTAG (class 1). The top row represents the discriminative scores in the training stage, while the bottom row corresponds to the testing stage. It is evident that during the training phase, the proposed three models effectively differentiate between the generated anomalous data and normal data, and this distinction car- ries over the testing phase. These findings validate that the classifier trained using high-quality generated anoma- lous graphs can identify outstanding decision boundaries and exhibit excellent generalization capabilities during test- ing. Particularly, despite observing score overlap between the generated anomaly and normal graphs during the train-
3.5. Experiment on Multi-Class GLAD
We conduct multi-class graph-level anomaly detection experiment on ENZYMES to further demonstrate the ef- fectiveness of our methods. In this experiment, multiple classes are regarded as anomalies. Specifically, we set the class (0. 1, 2, 37 as the normal classes and (4,5) as the anomalous classes. Figure shows the experimental results of our methods against several state-of-the-an
GNN-baser GLAD methods. We can observe that the proposed three methods significantly outperform all the baselines by large margin (more than 20%). This demonstrates the feasibil-
8

---

Self-Disriminatiie Modeling for Anomalous Graph Detection
Germated Anomalous Data
Gennated Anomalous Data
Genrated Anorelluss Dets
Frequency Density
Normal Data
Frequency Density
0.3
Normal Data
Frequency Density
Narmal Data
0.8
0.8
0.25
0.6
0.2
0.6
0.4
0.15
0.4
0.2
0.2
0.06
-0.5
-0.4
-0.3
-0.2
-0.1
5
6
7
8
10
0
0.2
0.4
0.6
0.8
Score
Score
x110
Score
0.6
0.25
0.25
Anomaious Dats
Anomalous Data
Anometoue Data
Frequency Density
0.5
Frequency Density
Frequency Density
0.2
0.4
0.15
0.15
0.3
0.1
0.2
0.1
0.05
0.05
-0.016
Score
Score
x10
Score (c) SDM-NAT
(a) SDM-ATI
(b) SDM-ATII
Figure 5. The discriminative scores of SDM-ATI, SDM-ATII, and SDM-NAT MUTAG (Class 1), where the top and bottom represent the result of the training stage and testing stage, respectively. Note that the x-axis and y-axis indicate the output scores and the number density data samples within certain interval.
ing phase SDM-ATII, significant differentiation is still achieved during the testing phase. This can be attributed to our objective of training powerful classifier by gener- ating high-quality anomaly graphs that closely resemble normal graphs. Although the classifier may not separate these anomalies adequately during training, which may be due to the over-idealization of the generated anomaly data, the learned decision boundaries are sufficiently effective in distinguishing the anomalies during the test phase.
much higher learning stability and detection accuracy than the other two methods. The comprehensive experiments on various graph benchmark datasets, including molecular, bio- logical, social network, and large-scale imbalanced molecu- lar datasets, demonstrate the effectiveness of our methods compared to state-of-the-art graph-level anomaly detection methods. Surprisingly, although our methods are unsuper- vised learning, they outperformed few strong baselines of semi-supervised learning methods. One limitation of our work that we have not considered any real anomalous graphs in the training stage, though they may be available in some scenarios.
3.7. More Experimental Analysis
Due to the page limitation, we provide more experimen- tal analysis in our appendix, including the experimental results on more datasets (Appendix D), visualization anal- ysis(Appendix E), parameter analysis (Appendix F), and ablation study on generator backbone (Appendix G), etc.
Acknowledgements
This work was supported by the National Natural Science Foundation of China under Grant No.62376236 and the Gen- eral Program of Natural Science Foundation of Guangdong Province under Grant No.22024A1515111777
4. Conclusion
In this paper, we proposed self-discriminative modeling (SDM) framework for graph-level anomaly detection. The key idea is generate pseudo-anomalous graphs that inter- polate between normal graphs and (real) anomalous graphs, though real anomalies are not presented in the training stage. We provide three variants of SDM, namely. SDM-ATI, SDM-ATII, and SDM-NAT. Particularly, SDM-NAT has
Impact Statement
This paper presents work whose goal is to advance the field of Machine Learning. There are many potential societal consequences of our work, none of which we feel must be specifically highlighted here.

---

Self-Diseriminative Modeling for Anomalous Graph Detection
References
Ding, K., Li, J., Agarwal, N., and Liu, H. Inductive anomaly detection attributed networks. In Proceedings of the International Joint Conferences Artificial Intelligence, pp. 288-1294, 2021.
Akoglu, L., Tong, H., and Koutra, D. Graph based anomaly detection and description: a survey. Data Mining and Knowledge Discovery, 29:626-688 688, 2015.
Borgwardt, K. M. and Kriegel, H.-P. Shortest-par paatest-paathhae kernels on graphs. In Proceedings of the Fifth IEEE International Conference on Data Mining, pp. 8-pp. IEEE, 2005.
Dong, X., Zhang, X., and Wang, S. Rayleigh quotient graph neural networks for graph-level anomaly detection. In Proceedings of the International Conference on Learning Representations, 2024.
Cai, J. and Fan, J. Perturbation learning based anomaly detection, Advances in Neural Information Processing Systems, 35, 2022.
Duan, D., Tong, L., Li, Y., Lu, J.. Shi. L., and Zhang, C. Aane: Anomaly aware network embedding for anomalous link detection. In Proceedings of the IEEE International Conference on Data Mining, pp. 1002--007. IEEE, 2020.
Cai, J., Han, Y. Guo, W., and Fan, J. Deep graph-level clustering using pseudo-label-guided mutual information maximization network. Neural Computing and Applica- fions, 2024a.
Duan, J., Wang, S., Zhang, P., Zhu, E., Hu, J., Jin, H., Liu, Y., and Dong, Z. Graph anomaly detection via multi-scale contrastive learning networks with augmented view. In Proceedings of the AAAI Conference on Artificial Intelli- gence, volume 37, pp. 7459-7467 2023.
Cai, J., Zhan, Y., Lu. Z., Guo, W. and Ng. S.-K. To- wards effective federated graph anomaly detection via self-boosted knowledge distillation. In Proceedings of the ACM International Conference on Multimedia, pp. 5537-5546, 2024b.
Fey, M. and Lenssen, J. E. Fast graph representation learning with pytorch geometric. arXiv preprint arXiv: 1903000903 2019.
Cai, J., Zhang, Y., Fan, J., Du Y., and Guo, W. Dual contrastive graph-level clustering with multiple cluster perspectives alignment. national Joint Conference on Artificial Intelligence, pp. 3770-3779, 2024c.
Fu, D., Zhang, Z., and Fan, J. Dense projection for anomaly detection. In Proceedings of the AAAI Conference Artificial Intelligence, volume 38, pp. 8398 8408, 2024.
Proceedings of the Inter-
Goodfellow, I., Pouget-Abadic, J., Mirza, M., Xu, B. Warde-Farley, D., Ozair, S., Courville, A., and Bengio, Y. Generative adversarial nets. Advances in Neural Informa- tion Processing Systems, 27, 2014.
Cai, J., Zhang, Y., Fan, J., and Ng. S.-K. Lg-fgad: An effective federated graph anomaly detection framework. In Proceedings of the International Joint Conference Artificial Intelligence, pp. 3760-3769, 2024d.
Cai, J., Zhang, Y., Wang. S., Fan, J., and Guo, W. Wasser- stein embedding learning for deep clustering: A gener- ative approach. IEEE Transactions on Multimedia, pp. 7567-7580, 2024c.
Han, X., Chen, X., and Liu, L.PP. Gan ensemble for anomaly detection. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pp. 4090-4097, 2021.
Hido, S. and Kashima, H. A linear-time graph kernel. In Proceedings of the Ninth IEEE International Conference on Data Mining, pp. 179-188. IEEE, 2009.
Chen, Z. Liu, B., Wang, M.. Dai, P., Lv, J., and Bo, L. Generative adversarial attributed network anomaly de- tection. In Proceedings of the 29th ACM International Conference on Information & Knowledge Management, pp. 1989-1992, 2020.
Huang, W., Wan, G., Ye, M., and Du, B. Federated graph semantic and structural learning. In Proceedings of the Thirty-Secone International Joint Conference on Artifi- cial Intelligence, pp. 3830-3838, 2023.
Dai, and Fan, J. AutoUAD:
optimiza- tion for unsupervised anomaly detection. In The Thir- teenth International Conference on Learning Represen- tations, 2025. URL https: /ttp::////////e///eeeemem nnt// forum? ddt.mmdddrrrrdddd.....
Huang, X., Yang, Y., Wang, Y.. Wang, C., Zhang, Z., Xu,
J., Chen, L.,, and Vazirgiannis, M. Dgraph: large-scale financial dataset for graph anomaly detection. Advances in Neural Information Processing Systems, 35:22765- 22777, 2022.
Dai, W. Hwang, K., and Fan, J. Unsupervised anomaly detection for tabular data using deep noise evaluation. Proceedings of the AAAI Conference on Artificial Intel- ligence, (9(1)):11533-1155 Apr. 2025. doi: 10. 100/ URL index hndex..pig//AAs/atttite////ee//s
Kim, S., Lee, S. Bu, F., Kang, S., Kim, K., Yoo, J., and Shin, K. Rethinking reconstruction based graph-level anomaly detection: Limitations and a simple remedy. Ad- vances in Neural Information Processing Systems, 2024.
aaai.
org/
10

---

Self-Diseriminative Modeling for Anomalous Graph Detection
Kingma, D. P. and Ba, J. Adam: A method for stochastic optimization. arXiv preprint arXiv: 141.6698,, 2014.
Mislove, A., Marcon, M., Gummadi, K. P., Druschel, P., and Bhattacharjee, B. Measurement and analysis of online so- cial networks. In Proceedings of the 7th ACM SIGCOMM Conference on Internet Measurement, pp. 29-42, 2007.
Kingma, D. P. and Welling, M. Auto-encoding variational bayes. In Proceedings of the International Conference on Learning Representations, 2014.
Morris, C., Kriege, N. M., Bause, F., Kersting, K., Mutzel, P., and Neumann, M. Tudataset: A collection of benchmark datasets for learning with graphs. In Proceedings of the International Conference of Machine Learning Workshop on Graph Representation Learning and Beyond, 2020.
Kipf, T. N. and Welling, M. Variational graph auto-encoders. arXiv preprint ar arXiv:661..07300 2016.
Kipf, T. N. and Welling, M. Semi-supervised classification with graph convolutional networks. In Proceedings of the International Conference on Learning Representations, 2017.
Mou, S., Gu, X., Cao. M., Bai, H., Huang, P., Shan, J., and Shi, J. Rgi: robust gan-inversion for mask-free free image inpainting and unsupervised pixel-wise anomaly detec- tion. Proceedings of the International Conference on Learning Representations, 2023.
Lee, S., Jeong, B., Kim, M., Jang, R., Paik, W. Kang, J., Chung, W.J., Hong. G.-S,, and Kim, N. Emergeney triage of brain computed tomography via anomaly detection with deep generative model. Nature Communications, 13(1):4251, 2022.
Nikolentzos, G. and Vazirgiannis, M. a. Random walk graph neural networks. Advances in Neural Information Processing Systems, 33:16211-16221 2020.
Li, R., Yuan, X., Radfar, M., Marendy, P., Ni, W., O'Brien, Casillas-Espinosa, T. J., and Casillas- Espinosa, P. M. Graph signal pro- cessing, graph neural network and graph learning on bi- ological data: systematic review. IEEE Reviews in Biomedical Engineering, 2021.
Pan, J., Liu, Y., Zheng, X., Zheng, Y., Liew, A. W.-C., L., and Pan, S. A label-free heterophily-guided approach for unsupervised graph fraud detection. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pp. 12443- 2025.
Qi, Z., Meng. L., Li, Z., Hu, H., and Meng, X. Cross-silo feature space alignment for federated learning on clients with imbalanced data. In Proceedings of the Annual AAAI Conference Artificial Intelligence, pp. 19986-19994, 2025.
Li, X., Sun, Y., Sun, Q., Ren, Z., and Sun, Y. Cross-view graph matching guided anchor alignment for incomplete multi-view clustering. Information Fusion, 2023.
Liu, Y., Ding, Lu, Q., Li, F., Zhang, L. Y., and Pan, S. Towards self-interpretable graph-level anomaly detection. Advances in Neural Information Processing Systems, 36, 2023a.
Qiao, H. and Pang, G. Truncated affinity maximization: One-class homophily modeling for graph anomaly detec- tion. Advances in Neural Information Processing Systems, 36:49490-499 49512, 2023.
Liu, Y., Liang, K., Xia, J., Zhou, S., Yang, X., Liu, X., and Li, S. Z. Dink-net: Neural clustering on large graphs. In International Conference on Machine Learning, pp. 21794-21812 PMLR, 2023b.
Qiao, H., Tong, H., An, B., King, I., Aggarwal, C., and Pang, G. Deep graph anomaly detection: A survey and new perspectives. arXiv preprint arXiv:2409.0995, 2024a.
Qiao, H., Wen, Q. Li, X., Lim, E.PP., and Pang, G. Gen- erative semi-supervised graph anomaly detection. Ad- vances in Neural Information Processing Systems, 37: 4660-4688, 2024b.
Liu, Y., Li, S., Zheng, Y., Chen, Q.. Zhang, C., and Pan, S. Are: A generalist graph anomaly detector with in-context learning. Advances in Neural Information Processing Systems, 2024.
Qiu, C.,, Pfrommer, T., Kloft, M., Mandt, S., and Rudolph, M. Neural transformation learning for deep anomaly detection beyond images. In Proceedings of the Interna- tional Conference on Machine Learning, pp. 8703-8714. PMLR, 2021.
Ma, R., Pang, G.. Chen, L., and van den Hengel, A. Deep graph-level anomaly detection by glocal knowledge distil- lation. In Proceedings of the Fifteenth ACM International Conference Web Search and Data Mining, pp. 704- 714, 2022.
Qiu, C., Kloft, M., Mandt, S., and Rudolph, M. Raising the bar in graph-level anomaly detection. In Proceedings of the International Joint Conference on Artificial Intelli- gence, pp. 2196-2203, 2022. doi: 10.24963/jjca.20222 305.
Ma, X., Wu, J., Xue, S., Yang, J.. Zhou, C., Sheng, Q. Z., Xiong, H., and Akoglu, L. A comprehensive survey on graph anomaly detection with deep learning. IEEE Transactions on Knowledge and Data Engineering, 2021.

---

Self-Diseriminative Modeling for Anomalous Graph Detection
Ruff, L., Vandermeulen, R., Goernitz, N., Deecke, L., Sid- diqui, S. A., Binder, A., Müller, E.,, and Kloft, M. Deep one-class classification. In Proceedings of the Interna- tional Conference on Machine Learning, pp. 4393 4402. PMLR, 2018.
Vishwanathan, S. V. N., Schraudolph, N. N., Kondor, R., and Borgwardt, K. M. Graph kernels. Journal of Machine Learning Research, 1 11:1201-1242, 2010,
Wan, G., Tian, Y., Huang, W., Chawla, N. V., and Ye, M. S3gel: Spectral, swift, spatial graph contrastive learn- ing. In Forty-first International Conference on Machine Learning, 2024.
Ruff, L., Vandermeulen, R. A., Görnitz, N., Binder, A., Müller, E., Müller, K.-R., and Kloft, M. Deep semi- supervised anomaly detection. In Proceedings of the International Conference on Learning Representations, 2020.
Wan, G., Shi, Z.., Huang, W., Zhang, G., Tao, D., and Ye, M. Energy- Energy-based backdoor defense against federated graph learning. In Proceedings of the International Conference on Learning Representations, 2025.
Schlegl. T., Sceböck, P., Waldstein, S. M., Schmidt-Erfurth, U., and Langs, G. Unsupervised anomaly detection with generative adversarial networks to guide marker discov- ery. In Proceedings of the International Conference Information Processing in Medical Imaging, pp. 146-157. Springer, 2017.
Wang, Q. Ding, Z., Tao, Z., Gao, Q., and Fu, Y. Generative partial multi-view clustering with adaptive fusion and cy- cle consistency. IEEE Transactions on Image Processing. 30:1 30:1771-1783, 2021.
Wang, T., Qiao, M., Lin, Z., Li, C., Snoussi, H., Liu, Z., and Choi, C. Generative neural networks for anomaly detection in crowded scenes. IEEE Transactions on Infor- mation Forensics and Security, 14(5):139--139,, 2018.
Schlegl, T., Seeböck, P., Waldstein, S. M., Langs, G., and Schmidt-Erfurthh U. f-anogan: Fast unsupervised anomaly detection with generative adversarial networks. Medical Image Analysis, 54:30 44, 2019.
Wang, Z. and Ji, S. Second-order pooling for graph neural networks. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2020.
Schölkopf, B., Williamson, R. C., Smola, A., Shawe-Taylon J., and Platt, J. Support vector method for novelty detec- tion. Advances in Neural Information Processing Systems, 12, 1999.
Wu, Z., Pan, S., Chen, F., Long, G., Zhang, C., and Philip, S. Y. A comprehensive survey on graph neural networks. IEEE Transactions on Neural Networks and Learning Systems, 32((1):4222 24, 2020.
Shervashidze, N., Schweitzer, P., Van Leeuwen, E. J., Mehlhorn, K., and Borgwardt, K. M. Weisfeiler-lhhman graph kernels. Journal of Machine Learning Research, 12(9), 2011.
Wu, Z., Zhang, Z., and Fan, Graph convolutional kernel machine versus graph convolutional networks. Advances in Neural Information Processing Systems, 2023.
Sun, Y.. Qin. Y., Li, Y., Peng, D., Peng, X., and Hu, P. Robust multi-view clustering with noisy correspondence. IEEE Transactions on Knowledge and Data Engineering, 2024.
Xiao, C., Xu, X., Lei, Y., Zhang, K., Liu, S., and Zhou, F. Counterfactual graph learning for anomaly detection on attributed networks. IEEE Transactions on Knowledge and Data Engineering, 2023.
Sun, Z., Ding, C., and Fan, J. Lovász principle for unsuper- vised graph representation learning. Advances in Neural Information Processing Systemx, 2023.
Xu, K., Hu, W., Leskovec, J., and Jegelka, S. How pow- erful are graph neural networks? In Proceedings the International Conference on Learning Representations, 2019.
Tieleman, T., Hinton, G., et al. Lecture 6.5-rmsprop: Divide the gradient by running average of its recent magnitude. COURSERA: Neural Networks for Machine Learning, 4 (2):26-31,200) 2012.
Zhang, G., Yang, Z., Wu, J., Yang. J., Xue, S., Peng, H., Su, J., Zhou, C., Sheng, Q. Z.., Akoglu, I.,, al. mnal-discriminative graph neural network for imbalanced graph-level anomaly detection. Advances in Neural Infor- mation Processing Systems, 35:24144-2415 2022a.
Tu, W., Zhou, S., Liu, X., Cai, Z., Zhao, Y., Liu, Y., and He, K. Wage: Weight-sharing attribte-misssng graph autoencoder. IEEE Transactions on Patlern Analysis and Machine Intelligence, 2025.
Zhang, X., Mu, J., Zhang, X., Liu, H., Zong, L., and Li, Y. Deep anomaly detection with self superviee learning and adversarial training. Pattern Recognition, 121:108234, 2022b.
Van der Maaten, L. and Hinton, G. Visualizing data using t-sne Journal of Machine Learning Research, 9(11), 2008.
12

---

Self-Diseriminative Modeling for Anomalous Graph Detection
Zhang, Y., Sun, Y., Cai, J., and Fan, J. Deep orthogonal hypersphere compression for anomaly detection. In Pro- ceedings of the International Conference Learning Representations. 2024.
Zhao, L. and Akoglu, L. On using classification datasets to evaluate graph outlier detection: Peculiar observations and new insights. Big Data, 2021.
Zheng, Y., Jin, M., Liu, Y., Chi, I.., Phan, T., and Chen, Y.-P. P. Generative and contrastive self-supervised learn- ing for graph anomaly detection. IEEE Trunsactions on Knowledge and Data Engineering, 2021.
Zhou, J., Cui, G., Hu, S., Zhang, Z., Yang, C., Liu, Z., Wang, L., Li, C., and Sun, M. Graph neural networks: review of methods and applications. Al open, 1:57-81, 2020.
13

---

Self-Diseriminative Modeling for Anomalous Graph Detection
A. Related Works
A.1. Graph-level Anomaly Detection
Graph-level anomaly detection (Ma et al., 2021; Liu ct al., 2024; Cai et al., 2024b;d) typically refers to the identification of graphs that are significantly different from others, e.g., the active state of molecules or abnormal relational structure in social networks, which exhibit significant differences compared to normal graphs. Different from the anomaly detection tasks on node-level and edge-level (Ding al., 2021; Huang al., 2022; Duan et al., 2023; Qiao & Pang. 2023; Qiao et al., 2024b; Pan et al., 2025), graph-level anomaly detection demands the consideration of relationships between different graphs measured from the perspective of the entire graph. Graph kernels (GK), e.g., Short-Path kernel (SP) (Borgwardt & Kriegel, 2005), Weisfeiler-Lehmaal kernel (WL.) (Shervashidze et al., 201 1), Random walk kernel (RW) (Vishwanathan et al., 2010), IO), etc, are generally used to measure the similarity between pair-wise graphs (Akoglu et al., 2015). They can be utilized to achieve graph-level anomaly detection by combining with classical AD methods such as one-class support vector machine (OCSVM) (Schölkopf et al., 1999).
In recent years, graph neural networks (GNNs) (Zhou et al., 2020; Wu et al., 2020; 2023; Liu et al., 2023b; Li et al., 2023; Cai et al., 2024a; Wan et al., 2024; Cai et al., 2024c; Tu et al., 2025) have become a paradigm for learning graph representations. Many outstanding works take advantage of the graph learning capability of GNNs, such as GCN (Kipf & Welling, 2017; Wan et al., 2025) and GIN (Xu et al., 2019), to facilitate graph-level anomaly detection. For instance, Zhao & Akoolu (2021) combined GIN with DeD (Ruff et al., 2018) to construct an end-to-end graph anomaly detection framework. Qiu et al. (2022) leveraged graph transformation learning (Qiu et al., 2021) to alleviate the performance flip issue in graph anomaly detection. Ma et al. (2022) proposed learn richer normal patterns of graphs from both local and global perspectives through the knowledge distillation within graph and node representations. Zhang et al. (2022b) investigated the problem of anomaly detection on imbalanced graphs and addressed this issue by introducing supervised loss function based on point mutual information. Compared
dual-discriminative framework with an imbalanced-speciffee with them, our methods do not require any assumption on the shape of the embedding distribution (e.g.. hypersphere (Zhao & Akoglu, 2021: Qiu et al., 2022; Zhang et al., 2024)) or explicitly defined anomaly scores (Ma et al., 2022; Liu et al., 2023a; Dong et al., 2024). Besides, our method fully unsupervised but is able to generate high-quality pseudo-anomalous graphs for training the anomaly detector (classifier), which is more cost-efficient than supervised methods (Zhang et al.. 2022b).
A.2. GAN-based Anomaly Detection
As an emerging branch of deep learning techniques, generative adversarial network (GAN) (Goodfellow et al., 2014; Wang et al., 2021; Cai al., 2024e) has been widely studied and utilized in anomaly detection, particularly in the vision area (Schlegl et al., 2019; Cai & Fan, 2022; Mou et al., 2023). For example, Schlegl et al. (2017) proposed AnoGAN, which applied GAN and unsupervised training to learn manifold for normality, thereby identifying the anomalies in image data. Han et al. (2021) proposed a multiple GAN ensemble framework for anomaly detection, which better models normal data distribution through the interaction between multiple groups of generators and discriminators. Zhang et al. (2022b) leveraged sulf-super learning with a deep adversarial framework to capture the marginal distribution of normal image data for detecting anomalies. Nevertheless, although some recent works (Chen et al., 2020; Zheng et al., 2021; Xiao et al., 2023) explored the feasibility of GAN in node-level AD tasks, the studies and efforts on graph-level AD tasks that require taking both attributes and edges into account are still limited. To this end, our work endeavors to bridge this research gap.
We here discuss the connection between the proposed three variants of SDM (refer to Section 2) with the GAN- approaches. First, SDM-ATI shares the idea of adversarial training in GAN, but they differ in several details. For example, the generator of SDM-ATI simultancously produces anomalous nodes and edges for an anomalous graph, which differs from the others that focus solely on nodes or images. Besides, most GAN-based approaches adopt two-stage frameworks and define a specific anomaly score, e.g., mapping loss function (Schlegl et al., 2017; 2019), reconstruction error (Wang et al., 2018; Lee et al., 2022) for detecting anomalies, while SDM-ATI is designed a joint training framework and relies on the output of the discriminator. Second, SDM-ATII learns to generate high-quality anomalous samples from normal graphs, whereas other GaN-based approaches typically generate from random noise. More importantly, the variational inference (Kipf& & Welling, 2016) involved in SDM-ATII guarantees the diversity of generated anomalous graphs. Third, we further proposed another variant, i.e., SDM-NAT, to address the instability problem during training and generate high-quality anomalous graphs in a non-adversarial manner.
14

---

Self-Disrimmnatiiv Modeling for Anomalous Graph Detection
B. Dataset
Table 4 illustrates the detailed information of each graph dataset used our experiment, including the number of graphs, average nodes, average edges, node classes, graph classes, and data type. We also show the imbalance ratio of four large-scale graph datasets in Table 5.
Table Detailed information of the graph benchmark datasets.
Dataset Name
Graphs
# Average [V]
# Average
[
# Node Classes
Graph Classes
Data Types
Small and moderate-scale datasets
PROTEINS
1,113
39.06
72.82
3
2
Biology
DD
1,178
284.32
715.66
82
Biology
ENZYMES
600
32.63
62.14
Biology
AMDB-BINAR
1,000
19.77
96.53
2
Social networks
ER MD
446
21.33
234.85
10
Molecule
MUTAG
188
17.93
19.79
Molecule
AIDS
2,000
15.69
16,20
38
2
Molecule
COX2
467
41.22
43.45
8
Molecule
Imbalanced large-scale datasets
SW-620
40,532
26.06
28.09
65
Molecule
MOLT-4
39,765
26.10
28.14
64
2
Molecule
PC-3
27,509
26.36
28.49
Molecule
MCF-7
27,770
26.40
28.53
46
Molecule
Table 5. The imbalance ratio of large-scale graph benehmark datascts.
Datasets
Class
# Graphs
Imbalance Ratio
Normal Anomalous
38,122
SW-620
5.95%
2,410
Normal
25,476
MCF-7
8.26%
Anomalous
2,294
Normal 25,941
PC-3
9.34%
Anomalous
1,568
Normal 36,625
MOLT-4
7.90%
Anomalous
3,140
C. Detailed Experimental Settings
We consider three types of experiments in this paper to evaluate anomaly detection performance. (1) The first experiment focuses on the one-class classification task, where we treat each class of dataset as the normal class and assess the anomaly detection performance for each class individually. (2) The second experiment involves anomaly detection on large-scale imbalanced graph datasets, where the class with a small number of samples designated as the anomaly. (3) Moreover, we evaluate anomaly detection in multi-class scenarios, where the anomalies may come from multiple classes. Here, we describe the detailed experimental settings follows:
Data Split: For small and moderate-scale datasets, we allocate 80% of the data from the normal class for training, and subsequently construct the testing data by combining the remaining normal data with an equal or smaller number of anomalous data samples. For large-scale imbalanced datasets, we allocate 80% of the data in the normal class as the training set, and form the test with the rest of the normal data and all the abnormal data.
Trade-off' Parameters: For SDM-ATI and SDM-ATII, we fix the clipping parameter e of the adversarial loss at 0.01. Besides, SDM-ATII and SDM-NAT have two critical hyper-parameterd À and y, their loss functions, which control the contributions the discrepancy loss and KL-divergence loss, respectively. We employ a grid search strategy, covering a range of [0.001, 100), to explore the parameter space and determine their optimal values thoroughly. Furthermore,
15

---

Self-Diseriminative Modeling for Anomalous Graph Detection
Table Average AUCs and F1-Scores with standard deviation (10 trials) on MUTAG, AIDS, and COX2. bold.
The hest results marked in
MUTAG
AIDS
COX2
Method
Metric
0
AUC
69,44:10.00
67.52:10.00
97.78110.00
79.54
54.08:10.00
57.60:10.00
SP (Borgwardt & Kriegel, 2005)
F1-Score
58.33=20.00
60.00+00.00
95.00=0.000
76.56=0.00
49.32-10.00
45.00::0.00
AUC
19.44:10.00
89.12:1:.00
98. 08.84:10.00
8..44:10.00
09.00:10.00
29.25:+0.00
WL (Shervashidze et al., 2011)
FI-Score
16.67:+00.00
76.00:+00.0
93.75++0.00
83.55++0.00
60.27++0.00
35.00+0000
AUC
6,,53:1:330
79.97=10.40
96.85:1.221
63.47=33.33
61.41=0.82
47.17+00.00
NH (Hido Kashima, 2009)
F1-Score
56.67:16224
76.00=0..00
97.50:10.00
59.25=1.35
16.44=1.03
50.00:3.116
AUC
94.04:1:0.0
86.98:10.00
73.611:0.00
58.31::0.00
52.43:1:.00
28.75:+0.00
RW (Vishwanathan et al., 2010)
FI-Score
83.33++0.00
80.00++0.00
66.25-+00.0
57.50++0.00
47.95++0.00
30.00++0.00
AUC
80.00=7.007
73.30
56.59:11599
96.74=0.53
59.28=11.55
13.33+1148
VGAE-AD (Kipf& & Welling, 2016)
F1-Score
7..73++6.67
65.56+22.22
55.34++..1
93.94++0.11
59.19+0.000
73.00+5.10
AUC
88,40=2.114
74.66:11.68
94.38:10.10
20.56:14.52
59.6415.78
56.83+7.68
OCGIN (Zhao & Akoglu, 2021)
F1-Score
61.54:00.00
62.95:40.00
88.12:10.62
29.22:4..16
47.95=10.00
52.38:10.00
AUC
84.03++0.00
90.59++0.61
100.00 0.00
94.45-+5.88
01.42:0066
65.79++0.98
GLocalKD (Ma al., 2022)
FI-Score
83.33++0.00
17+0099
100.00 0.00
88.27+7.70
51.24+0.60
65.33++0.67
AUC
93.61=0.224
87.04=1.774
98.09:10.48
99.49=10.08
60.42:10.90
54.65#:3.09
OCGTL (Qiu et al., 2022)
FI-Score
38.46-12.89
80.00++0.00
97.50++0.00
97.25++0.57
55.62+55.24
52.38+-4.26
AUC
79.4011..6
86.13:3.55
18.28111.69
96.15=0.89
47.25=1.00
64.50:0..00
SIGNET (Liu et al., 2023a)
F1-Score
80,5611393
80.0013.277
80.25:12.00
89.69-1.06
52.05:10.00
60.00+0.000
AUC
83.79++7.02
87.73+22.45
55.96++2.12
92.56++3.03
54.1443.23
48.08+7.04
MUSE (Kim al., 2024)
F1-Score
75.20++6.1 14
73.07++4.11
52.88+1.22
85.91+44.39
52.14+3.49
48.50+99.50
AUC
94.72:14.47
88.83-16.58
91.09:1..34
88.03:10.91
63.16:3..36
72.28:14.67
DO2HSC (Zhang et al., 2024)
F1-Score
89.17+7.50
86.80+6.21
82.92+33.12
83.50+00.56
58.36+22.55
69.00++-4900
AUC
95.83-10.00
33.44
100.00=10.00
100.00110.00
71.4619.15
79.45:15.82
SDM-ATI
F1-Score
83.33:10.00
91.67-10.00
100.00=10.00
100.00110.00
70.78:1.91
67. 17.10.4..17
AUC
99.31 1,131+1..42
21.50+25.666
100.00++0.00
100.00++0000
81.51+0.31
91.78++3.95
SDM-ATII
FI-Score
99.13++1.77
80,27+-33.47
99.37++0.63
100.00++0.00
74.05+
84.79+-3.38
AUC
100.00110.00
99.3611.35
100.00=0.000
100.00110.00
96.66_1..00
97.05:11.62
SDM-NAT
F1-Score
100.00:10.00
98.53:10.20
100.00=10.00
100.00110.00
90.41:10.00
22.50
Appendix F contains the evaluation of the impact of variations in the values of À and on the anomaly detection performance.
Baseline Settings: We achieve anomaly detection for all graph kemels and InfoGraph by combining them with OCSVM (Schölkopf et al., 1999). For other baseline methods, e.g., OCGIN, OCGTL, GLocalKD, iGAD, SIGNET, MUSE, and DO2HSC, we follow the settings in their papers and reproduce the experimental results with the officially released codes. To guarantee a fair comparison, we use the same network structure, i.e., GIN (Xu et al., 2019), for each GNN-based baseline and SDM variants. Particularly, in the imbalanced graph anomaly detection task, we apply the cross-entropy loss function to the supervised GNN baselines, e.g., GCN, DGCNN, GIN, SOPOOL, and RWGNN.
Training Details: For small-scale graph datasets, the grid search strategy utilized to find the optimal performance, where the coefficients (A and ?) vary in f0.1, 10), and the batch size varies in {4, 8, 16), while we increase the batch size to 256 to accommodate the requirement of experiment on larger-scale datasets. We utilize RMSprop (Tieleman et al., 2012) as the optimizer for SDM-ATI and SDM-ATII, and Adam (Kingma & Ba, 2014) for SDM-NAT during training. Besides, set the learning rate p 0.001 with the total training epochs to 300.
Implementation: We leverage Py PoTch Geometric (Fey & Lenssen, 2019) for implementation, and all experiments are executed on an NVIDIA Tesla A 100 GPU with an AMD EPYC 7532 CPU.
16

---

Self-Diseriminative Modeling for Anomalous Graph Detection
D. More Experimental Results
D.I. Performance Comparison on More Datasets
Table 6 presents an additional evaluation of our SDM framework (SDM-ATI, SDM-ATII, and SDM-NAT) against various graph kernel methods and ENN-based GLAD methods on four benchmark datasets, including MUTAG, AIDS, and COX2. We observe that our SDM variants consistently outperform baseline methods across all benchmark datasets. Particularly, SDM-NAT performance achieves 96.66% (AUC) and 90.41% 1% (F1-Score) on the challenging dataset COX2 (class 0), which marks more than 20% improvement over other state-of-the-art approaches such as OCGTL and DO2HSC. Notably, SDM-NAT exhibits markedly lower variance than adversarial strategies (SDM-ATI, SDM-ATII) and competing baselines, which highlights its robustness in decision boundary learning. Moreover, we notice that certain baselines show substantial performance drops when setting another class as the normal class, e.g., the AUC decline OCGIN on AIDS and SIGNET on COX2, which implies the challenges of handling heterogeneous distributions without strong assumptions. In contrast, the proposed SDM framework achieves consistent efficacy across graph datasets from diverse domains, demonstrating its broad applicability real-world scenarios.
D.2. Explanation of SDM's Advantages on Imbalance GLAD
To better understand the success of SDM, we provide visual illustration in Figure to explain why the SDM can outperform other supervised methods in the context of imbalanced scenarios (Kim et al., 2024; Qi et al., 2025). This figure demonstrates a binary classification scenario where the anomalous data used for training lies the right side of the normal data, and the trained classifier successfully categorizes them with a red decision boundary. However, unknown anomalies may be located on the left side of the decision boundary (shown by the blue dashed line), where the binary classifier fails to detect them. This phenomenon is common in large-scale unbalanced anomaly detection due to limited supervised information, where the distribution of test data is not exactly the same as that the training data.
Decisio
Training
Risory dlasifiacco
Nocnal samples
Mdcal dacinim hourdey
Amoriious sumples
Tostnn data
A
A
Nomaa
!
Ansmaloss cempla
Uniceson anomalese
4
4
A
Unizzonn coonalles surple
A
A
4
A
4
Figure 6. The illustration of the advantages of SDM. The red line denotes the decision boundary learned by the binary classification. whereas the blue dashed line denotes the ideal decision boundary.
E. Visual Analysis of Learned Decision Boundary
In this section, we aim to intuitively demonstrate the effectiveness of the proposed methods. Specifically, we provide visualization results learned embeddings using t-SNE (Van der Maaten & Hinton, 2008). We show the t-SNE visualizations (on MUTAG and AIDS) for the learned embeddings of several baseline methods and the three variants of SDM in Figures 7 and 8, enabling a more comprehensive assessment. These two figures show that the proposed SDM methods learn more explicit decision boundaries to distinguish anomalous samples compared to the visualization results of other baseline methods. Besides, these figures also offer compelling insights into the learned decision boundaries derived from the generated anomalous data. We can observe that the normal data from both training and testing stages approximately lie on the same manifold, which implies that the normality is well captured in our methods. Moreover, the real anomalous and generated sscudo-anomalon data are well separated into different regions from the normal data. This distinct separation serves as compelling evidence of the discriminative power implicit in our methods.
17

---

Self-Disriminntiiv Modeling for Anomalous Graph Detection
12
VGAF-AD
OCGIN
(c) GLocalKD
(d) OUGTL
(c) SIGNET
MUSE
DOZESC
SDM-ATI
SDM ATH
CI SAM
Figure 7. The t-SNE visualization on MUTAG (Class 1). Note that the points marked in red, light blue, and dark blue represent the real anomalous data, and the normal data in training and testing stages, while points marked in yellow denote the generated anomalous data in our methods.
110
47-
1901
OF 0b)OCGIN
(A) AD
(c) GLealKD
(C/OGTT
SIGNET
(O MUSE
( DO2SSC
(b) SDM-ATI
SDM ATI
i SDM-NAT
Figure 8. The t-SNE visualization on AIDS (Class 1). Note that the points marked in red, light blue, and dark blue represent the real anomalous data, and the normal data in training and testing stages, while points marked in yellow denote the generated anomalous data in methods.
Nevertheless, it is worth noting that t-SNE would change the actual data distribution through dimensionality reduction. Therefore, the distribution of generated anomalies may not encompass the normal data in the visualization results. However, we can still observe that more discriminative latent representations are learned in SDM variants compared to other baselines. This observation demonstrates the strong discrimination of the trained classifier, which is attributed to the high-quality pseudo-anomalous graphs generated adaptively. These insightful visualizations offer a better understanding of the proposed methods, vividly illustrating their ability to learn effective decision boundaries and unveil intricate patterns and anomalies hidden within complex graph structures.
F. Parameter Sensitivity Analysis
We investigate the impact of two main performance. Note that SDM-ATI is not included in this analysis because its loss function does not have any hyper- parameters. Specifically, we set the value of and y from wide range, i.e., [1e-3, lea), to evaluate their impact on anomaly detection performance. Figures and 10 show the experimental results on COX2 and ER_MD, where we have the following observations.
and y, in SDM-ATII and SDM-NAT on the anomaly detection
First, we find that balanced trade-off of X and y is crucial to achieve ideal performance for SDM-ATII and SDM-NAT. As illustrated in these two figures, we can observe that either excessively large or small values of À and y typically yield sub-optimal results in various cases. Second, we can observe that both SDM-ATII and SDM-NAT exhibit relatively stable performance across a broad range of [le 33 1e?] for À and y values, particularly on MR (Class 0) where SDM-ATII and SDM-NAT show stable performance in terms of AUC and F1 F1-Score. Additionally, from the experimental results on other
18

---

Self-Diseriminative Modeling for Anomalous Graph Detection
Ft-Score (%)
F1-Score (%)
AUC (%)
AUC (%5
30
10.
Class 0
Class
(a) COX2
F1-Score (50)
100
F1-Score (5)
100.
AUC (%)
AUC (9)
Class 0
Class
(b) ER MD
Figure 9. Parameter sensitivity analysis of SDM-ATII on COX2 and ER_ RD.. Note that the values of À and changes in the range of [le-3 1.
100
F1-Score (%)
(%)
AUC (36
Class
Class
COX2
100
100
F1-Score (%)
AUG (%)
F1-Score
AUG
30
20.
Class 0
Class
(b) ER MD
Figure Parameter sensitivity analysis of SDM-NAT on COX2 and ER MD. Note that values and y change the range [1e 1e2).
cases, we can observe that the performance variation of both methods under varying À and values also remains marginal within a relatively wide range. These observations fully demonstrate the stability and robustness of our methods.
G. Ablation Study of Generator Backbone
We conduct an ablation study by thoroughly comparing VGAE-based and GIN-based generators elucidate our rationale for leveraging VGAE the preferred backbone for generators in SDM. It should be noted that the key difference between VGAE-based and GIN-based backbones lies in the incorporation of variational inference, which introduces stochasticity in generating anomalous graphs. Figure 11 shows comprehensive performance comparison in terms of AUC across three graph datasets, including COX2, DD, and MUTAG.
From this figure, we can observe that the VGAE-based backbone consistently outperforms the GaN-based backbone by a substantial margin. This significant improvement can be attributed to the inherent disparities their respective generation
19

---

Self- Self-Dssrimmnntive Modeling for Anomalous Graph Detection
100
92,12
Ub. 10.00
100
86.59
90.60
90.71
100
99.31
100.0
102.0
AUC (%)
80
60
80
60
AUC
AUC
40
20
20
20
SDM-ATI
SDM-ATII SDM-NAT SDM-NAT
SDM-ATII (GIN)
SDM-ATII SDM-NAT SDM-NAT
SDM-ATII
SOM-ATII
SOM-NAT (GIN)
SDM-NAT (VGAE)
(GIN)
(VGAE)
(GIN)
(VGAE)
(VGAE)
(GIN)
(VGAE)
(GIN)
(VGAE)
(a) COX2 ( (Class 0)
(b) DD (Class 0)
(c) MUTAG (Class 0)
120
120
120
100
91,78
97.05
100
95.55
91.44
99.23
100
74,93
81.5
99.56
62.45
AUC (%)
80
60
AUC
AUC
40
40
40
20
20-
20-
SDM-ATII
SDM-ATII SOM-NAT SDM-NAT (YGAE)
SDM-ATII
SDM-ATII NAM SDM NAT (GIN)
SDM-ATII SOM-ATII SDM-NAT SDM- NAT
(GIN)
(GIN) (VGAE)
(VGAE) (GIN) (VGAE)
(GIN) (VGAE)
(GIN)
(VGAE)
(d) COX2 (Class 1)
(e) DD (Class 1)
(3) MUTA G (Class 1)
Figure 11. Performance comparison between VGAE-based and GIN-based generator.
processes. The GIN-based backbone generates graphs deterministically. while the VGAE-based generator incorporates stochasticity. In contrast to the based backbone, VGAE employs the reparameterization technique to learn target distribution, allowing it to capture the data and underlying distribution. Consequently, the latent distribution of generated pseudo-anomalous data more likely to reside in plausible regions rather than simply approximating the normal data. The experiment demonstrates the exceptional ability of the VGAE-based generator produce high-quality pseudo-anomalous graphs, yielding superior performance in graph-level anomaly detection tasks. This also aligns with the motivation and expectation depicted in Figure 6, where the stochasticity in the generation process plays important role in learning good decision boundary.
H. Robustness Analysis under Data Contamination
To evaluate the robustness of the proposed SDM under data contamination, we conduct an experiment by injecting anomalous data into the training set at varying contamination levels, which is defined certain percentage of the normal data (0%, 10%, 20%, and 30%, respectively). Table shows the experimental results MUTAG (class 0), where the three SDM variants maintain stable performance under different contamination levels. In particular, the performance of SDM variants under a 10% contamination level still outperforms the SOTA baseline, such as DOH2SC (94.72% AUC w/o contamination). These results fully demonstrate the robustness and real-world applicability of our approach.
observe that
Table Comparison of model performance different contamination levels.
Contamination Level
0%
10%
20%
30%
AUC
95.83(0.00)
94.77(0.79)
93.85(0.04)
94.23(1.23)
SDM-ATI F1-Score
83.33(0.00)
(2.61(0.46)
80.24(0.00)
81.27(1.96)
AUC
99.31(1.42)
97.58(0.48
97.25(0.02)
97.04(0.15)
SDM-ATII FI-Score
99.13(1.74)
94.12(0.00)
88.24(0.00)
89.22(0.98)
AUC
100.00(0.00)
97.67(0.73)
96.44(0.21)
95.71(2.17)
SDM-NAT
F1 F1-Score
100.00(0.00)
92.16(1.96)
88.24(0.00)
87.70(3.39)
20

---

Self-Diseriminative Modeling for Anomalous Graph Detection
I. Detailed Algorithm
To facilitate the understanding of the training procedure of the proposed SDM methods, we provide the detailed algorithms of three SDM variants in Algorithms 1, 2, and 3.
Algorithm 1 SDM-ATI
Input: Input graph set G, number of GIN layers K, clipping parameter c, learning rate p. batch size m, total training epochs T.
Output: The anomaly detection scores.
1: Initialize the network parameters Φ, 42;
2: for t + T do
3: for each batch G do
4: Update Generator:
Unfreeze the the parameter & of generator Gş:
6: Freeze the the parameter w of discriminator Dwi
7: Sample random variable Z from latent Gaussian distribution P2 ~ ~0, 1);
Generate anomalous graph G from generator 96 with the input Z via Eq. (6);
9:
Update the parameter & of generator Go by
9o V EM (9. (C (Z).
Ô Φ P- RMSPPop(c G+))
10:
Update Discriminator:
11:
Freeze the the parameter @ of generator Gş: Unfreeze the the parameter w of discriminator Dw;
12:
13:
Repeat steps 6 6-7, 7;
14:
Update the parameter w of generator Du by DW + -I- m Σm (X,, A.) th tm - p. RMSPPop(w, Dw); clip(w,-c, c);
(2.)
15: end for
16: end for
17: Compute anomaly detection scores for test graphs via the trained discriminator Dw:
18: Return: The anomaly detection scores.
21

---

Self-Disrimmnntiiv Modeling for Anomalous Graph Detection
Algorithm SDM-ATII
Input: Input graph set G, number of GIN layers K, clipping parameter e, learning rate batch size m, total training epochs T.
Output: The anomaly detection scores.
1: Initialize the network parameters 42,
2: for + 7 do
3: for each batch G do
4: Update Generator:
5: Unfreeze the the parameter & of generator Gạ:
6: Freeze the the parameter w of discriminator Dui
7: Extract graph-level representation with input normal attributes X and adjacency matrix A via Eqs. (7) and (8);
8: Generate anomalous anomalous graph set G from generator Gg with normal attributes and adjacency matrix A
via Eqs. (10), (11), (12), and (13); Update the parameter & of generator Go by
9:
9o VI- - m Ee (W (X,, A.) + m E (IX X,1l? (A, log(Ai) A,) Ai))) +
(Zz H., A) P(Z)]]
+ Ø P RMSProp(Ø,, Go))
10:
Update Diseriminator:
11:
Freeze the the parameter Φ of generator Gg:
12:
Unfreeze the the parameter w discriminator Dw; Repeat steps 6-77 7:
13:
Update the parameter s of generator Dw by
DW VI- n Σm (X, A,) m > (X,, A,))); +
RMSProp(w, Dw);
< clip cc,
15:
end for
16: end for
17: Compute anomaly detection scores for test graphs via the trained discriminator Dw:
Return: The anomaly detection scores.
Algorithm SDM-NAT
Input: Input graph set G, number of GIN layers K, learning rate p, batch size total training epochs T.
Output: The anomaly detection scores.
1: Initialize the network parameters p, for anomalous generator G6 and classifier fo:
2: for + T do
3: for each batch G do
4: Extract graph-level representation with the input normal attributes X and adjacency matrix A via Eqs. (7) and (8);
5: Generate anomalous graph set G from generator Gø with normal attributes X and adjacency matrix A via Eqs.
(10), (11), (12), and (13);
6:
Calculate the anomalous reconstruction loss via Eg. (14);
7: Calculate the total loss via Eq. (16);
8: Update the parameter & and of anomalous generator Go and classifier fo using backpropagation;
9: end for
end for
11: Compute anomaly detection scores for test graphs via the trained classifier fo;
12: Return: The anomaly detection scores.
22


Reviews:
[{"review_id": "pLGncjZWaN", "reviewer": "Reviewer_5giQ", "summary": "The paper introduces a new framework called Self-Discriminative Modeling (SDM) for detecting anomalous graphs. The proposed method trains a deep neural network using only normal graphs, without access to real anomalous examples. To achieve this, the authors generate pseudo-anomalous graphs from normal graphs. These pseudo-anomalous graphs help the model learn an effective decision boundary for identifying real anomalies. The authors propose three versions of their method: two based on adversarial training (SDM-ATI and SDM-ATII) and one based on a simpler, non-adversarial approach (SDM-NAT). Experiments conducted on 12 benchmark datasets show that all three versions of SDM outperform existing methods, with the non-adversarial version (SDM-NAT) achieving the most stable and highest performance.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**We thank the reviewer for the positive comments. Below are our responses to your concerns:**\n\n**To Q1:** The statement \"no overlap between $\\mathscr{D}$ and $\\tilde{\\mathscr{D}}$\" is intended to facilitate a more precise problem definition for our paper, as we would not be able to identify normal or abnormal for a data point in the overlapping region between $\\mathscr{D}$ and $\\tilde{\\mathscr{D}}$.  This is also a common assumption defined in anomaly detection literature [1], where normal and anomalous instances are modeled as originating from distinct distributions to establish a clear separation. However, we recognize the reviewer’s valid concern. In a continuous graph space, distributions may exhibit overlapping supports. We would like to answer this question by the following two aspects:\n1. The \"no overlap\" assumption refers to the idealized setup where $\\mathscr{D}$ and $\\tilde{\\mathscr{D}}$ are generated from non-overlapping processes. This abstraction facilitates the design of our anomaly detection method by providing a clean delineation between normal and anomalous behaviors.\n2. In practice, real-world graph distributions may not be perfectly separable, which can be caused by outliers or the nature of the data. Our framework, however, is designed to handle such scenarios effectively. For instance, we generate pseudo-anomalous graphs to simulate $\\tilde{\\mathscr{D}}$, which may lie close to normal graphs in the feature space. This is evident in our t-SNE visualizations (e.g., Figures 7 and 8), where the proximity of these distributions tests the model’s ability to detect subtle anomalies. Our simulation experiment (in Sec 3.2) and empirical result (in Sec 3.3-3.5) on benchmark datasets demonstrate that the method performs robustly even when the theoretical assumption of non-overlapping supports is relaxed.\n```\n[1] Lukas Ruff, et al. Deep One-Class Classification, ICML, 2018.\n```\n**To Q2:** In our paper, we describe our approach as an unsupervised learning problem where \"the training data do not contain any anomalous graphs.\" This means that during the training phase, the model is exposed exclusively to normal graphs from the distribution $\\mathscr{D}$, with no anomalous graphs from $\\tilde{\\mathscr{D}}$ present. This setup aligns with the standard \"one-class\" anomaly detection paradigm [2], a well-established approach under unsupervised settings. Specifically:\n1. Training Phase: The training dataset consists solely of normal graphs (from $\\mathscr{D}$), and no labels are provided, consistent with unsupervised learning.\n2. Testing Phase: The model is evaluated on a separate test set that includes both normal graphs (from $\\mathscr{D}$) and anomalous graphs (from $\\tilde{\\mathscr{D}}$). The task is distinguishing anomalies from normal instances, despite not encountering anomalies during training.\n\nThe reviewer is correct that, in a broader unsupervised learning context, training data could contain a mix of normal and anomalous instances without labels, requiring the model to discover anomalies implicitly. Therefore, we also conducted an experiment to evaluate our performance in the data contamination case (refer to the response to Reviewer 1ZeV's W4), where part of the anomalies are included in the training dataset. We can observe that our method also works when the training data have some unlabeled anomalies.\n```\n[2] Bernhard Schölkopf, et al. Estimating the support of a high-dimensional distribution, Neural Computation, 2001.\n```", "claims_and_evidence": "Overall, the claims in the paper are supported by the provided experiments. The authors show that the proposed Self-Discriminative Modeling (SDM) methods outperform existing techniques across multiple datasets.", "methods_and_evaluation_criteria": "The proposed methods and evaluation criteria make sense for the anomalous graph detection task. Generating pseudo-anomalous graphs to learn decision boundaries when real anomalies are unavailable is reasonable. The use of adversarial (SDM-ATI, SDM-ATII) and non-adversarial (SDM-NAT) approaches for generating pseudo-anomalous data also make sense. The evaluation metrics (AUC and F1-score) and chosen benchmark datasets are suitable, and commonly used in many previous works.", "theoretical_claims": "No theorems provided in the paper, but the mathematical motivations behind the training objective make sense.", "experimental_designs_or_analyses": "I checked the experimental setup described in the Experiments section and the appendix. The authors include experiments in multiple settings, which I think is good. The baselines used by the authors are also sufficiently many. No major concern on the experimental design and analysis.", "relation_to_broader_scientific_literature": "The paper builds clearly on existing methods like DeepSVDD-based approaches and GAN-based anomaly detection techniques. It addresses known issues of strong assumptions in graph embedding distributions in the previous works, by generating pseudo-anomalous graphs using various techniques. I think the contributions of the paper fills some of the gap in the previous literature.", "essential_references_not_discussed": "Nothing as far as I know.", "other_strengths_and_weaknesses": "Nothing additional.", "other_comments_or_suggestions": "Some of the statements in the paper need clarification:\n- ‘no overlap between D and \\tilde{D}’. Could you clarify on this, as the distribution of graphs is continuous, there may be some overlap in the support of the distribution?\n- ‘Note that this is an unsupervised learning problem, of which the training data do not contain any anomalous graphs’. In general, unsupervised learning problems only means that label is unavailable. However, in the labeled data, there could also be anomalous data that a model needs to discover. Please clarify the setup.", "questions_for_authors": "Please address the concerns above.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "NAq5miDr9d", "reviewer": "Reviewer_1ZeV", "summary": "This paper proposes a novel GLAD framework named Self-Discriminative Modeling (SDM). The key idea of SDM is to generate pseudo-anomalous graphs from normal graphs and train a classifier/discriminator to distinguish them. The generative model and discriminative model are jointly trained to learn a more robust decision boundary. Moreover, the authors further introduce a non-adversarial variant for SDM. Experiments on 12 benchmark datasets demonstrate the SDM variants achieve superior performance compared to state-of-the-art GLAD baselines.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**We thank the reviewer for recognizing our work. Below are our responses to your concerns:**\n\n**To W1:** We would like to address your concern from the following two aspects:\n\n1. From the embedding visualization (e.g., Figure 7), the embedding distributions of the pseudo-anomalous graphs are mostly separated into different regions from the normal data. As an illustrative example, Figure 7(j) shows that the pseudo-anomalous graphs successfully interpolate between the real anomalous and normal samples, which is good evidence to demonstrate the effect of the generated pseudo graph anomalies as the auxiliary signals to benefit decision boundary learning.\n2. To more explicitly address your concerns, we evaluated SDM-NAT on AIDS (class 1) by employing the **normalized $k$-nearest-neighbor distance** to quantify the discrepancy. Specifically, we computed the average pair-wise one-nearest-neighbor distance between:  \n* **Normal graphs vs. Normal graphs**, which is $0.0127$.\n* **Real anomalous graphs vs. Normal graphs**, which is $0.1056$.\n* **Pseudo-anomalous graphs vs. Normal graphs**, which is $0.0542$.\n\nThe results confirm that the pseudo-anomalous graphs are sufficiently different from normal graphs, supporting their role in enhancing decision boundary learning.\n\n**To W2:** We would like to clarify how our approach ensures the generation of diverse pseudo-anomalous graphs:\n\n1. Our method does not generate pseudo-anomalous graphs as a one-time, static process. Instead, the generation is dynamic and evolves continuously throughout training. Early in the process, the pseudo-anomalous graphs exhibit significant deviations from normal graphs, posing a relatively straightforward GLAD task. As training progresses, the generator will produce pseudo-anomalous graphs that increasingly resemble normal graphs, thereby escalating the difficulty of the task. This progressive shift aligns with the principles of curriculum learning [1], where the model begins with simpler examples and gradually tackles more challenging ones. As a result, the model can be exposed to a broad and diverse spectrum of pseudo-anomalous samples, rather than just a narrow subset.\n2. In SDM-ATI and SDM-ATII, the adversarial interplay between generator and discriminator also drives diversity. The generator needs to vary its perturbation strategies to challenge the discriminator, preventing repetitive patterns. This results in the diversity of generated pseudo-anomalous graphs. In SDM-NAT, pseudo-anomalous graphs are generated by sampling from the latent distribution of normal data. Therefore, the generated pseudo-anomalies are expected to enclose the normal samples in the latent space, which naturally enhances the diversity. This also aligns well with our motivation illustrated in Figure 1.\n```\n[1] Yoshua Bengio, et al. Curriculum Learning, ICML, 2009.\n```\n**To W3:** The overlap observed in Figure 6 (top row) during training is a natural outcome of the adversarial design of SDM-ATII, where the generator produces pseudo-anomalous graphs resembling normal graphs to challenge the discriminator. Actually, while the overlap is observed, the majority of normal graphs and anomalous graphs are still separable, and it helps the model to learn an effective decision boundary. The results observed in the bottom row of Figure 6 fully validate this claim, where SDM-ATII indicates strong generalization by successfully distinguishing real anomalous graphs in the test phase. We will supplement this discussion in the paper.\n\n**To W4:** We agree with the reviewer that the robustness evaluation under data contamination is important. In response, we conducted an experiment on MUTAG (class 0) by injecting anomalous data into the training set at varying contamination levels defined as certain percentages of the normal data. The experimental results shown below indicate that the three SDM variants maintain stable performance under different contamination levels, which still outperform SOTA baseline DOH2SC (94.72\\% AUC w/o contamination) under 10\\% contamination level. This demonstrates the robustness and real-world applicability of our approach. \n\n$\\begin{matrix}\n\\\\hline\n\\text{Contamination Level}& &0\\\\%&10\\\\% &20\\\\% &30\\\\% \\\\\\\\\\hline\n\\text{SDM-ATI} & \\text{AUC} &\\bf95.83 (0.00) &94.77 (0.79) &93.85 (0.04) &94.23 (1.23)  \\\\\\\\\n& \\text{F1-Score} &\\bf83.33 (0.00) &82.61 (0.46) &80.24 (0.00) & 81.27 (1.96)\\\\\\\\\\hline\n\\text{SDM-ATII} & \\text{AUC} & \\bf99.31 (1.42) & 97.58 (0.48)&97.25 (0.02) &97.04 (0.15) \\\\\\\\\n& \\text{F1-Score} &\\bf99.13 (1.74) & 94.12 (0.00)&88.24 (0.00) &89.22 (0.98) \\\\\\\\\\hline\n\\text{SDM-NAT} & \\text{AUC} & \\bf100.00 (0.00)&97.67 (0.73) & 96.44 (0.21) &95.71 (2.17) \\\\\\\\\n& \\text{F1-Score} &\\bf100.00 (0.00) &92.16 (1.96) &88.24 (0.00) & 87.70 (3.39) \\\\\\\\\\hline\n\\end{matrix}$\n\n**To Other Comments:** We will (1) double-check and harmonize the format of \"$\\textit{i.e.,}$\" and \"$\\textit{e.g.},$\", and (2) supplement the ratio of samples in each category for all datasets.", "claims_and_evidence": "The main claim of this paper is that SDM can effectively detect anomalous graphs by leveraging the generated pseudo-anomalous graphs to refine a more reliable decision boundary. This claim is well-supported by experimental results.", "methods_and_evaluation_criteria": "The propose SDM methods make sense for the GLAD problem in real-world scenarios. The benchmark datasets are selected from diverse real-world domains, including molecular, biological, and social graphs with both balanced and imbalanced settings. The evaluation metrics (AUC, F1-Score) are standard and appropriate to evaluate anomaly detection performance.", "theoretical_claims": "The analysis in Sec. 2.1 theoretically describes the motivation of generating pseudo graph anomalies to refine a more robust decision boundary, and the simulation results in Sec. 3.2 well support this claim.", "experimental_designs_or_analyses": "I have checked the soundness/validity of the experimental designs and analysis. The experiments in this paper are comprehensive, covering diverse real-world GLAD scenarios. The data split strategy is consistent for each competitive method, the comparison is fair, and the experimental analysis is thorough and in-depth.", "relation_to_broader_scientific_literature": "Compared to recent GLAD approaches (e.g., [1, 2]) which imposes strict assumptions (e.g., hypersphere) on the latent space, SDM offers a more flexible solution by refining the decision boundaries through pseudo anomaly generation. Moreover, the unsupervised scheme of SDM also makes it more practical compared to supervised approaches [3].\n\n[1] Raising the bar in graph-level anomaly detection, IJCAI, 2022.\n\n[2] Deep orthogonal hypersphere compression for anomaly detection. ICLR, 2024.\n\n[3] Dual-discriminative graph neural network for imbalanced graph-level anomaly detection, NeurIPS, 2022.", "essential_references_not_discussed": "No other references are necessarily to be cited/discussed. The authors have comprehensively reviewed the latest GLAD literature. They have broadly discussed the connection of the proposed framework with existing GLAD methods and GAN-based methods.", "other_strengths_and_weaknesses": "**Strengths:**\n1. This paper is well-written. The idea of generating pseudo-anomalous graphs as the anomaly proxy for robust decision boundary learning is innovative and meaningful in addressing several key challenges in existing GLAD approaches.\n2. The motivation of the proposed SDM framework is clearly illustrated, and it is well supported by the theoretical analysis (Sec. 2.1) and simulation experiment (Sec. 3.2). Moreover, three variants of SDM are designed to focus on different challenges.\n3. The comparison experiments are extensive and demonstrate the effectiveness of SDM over state-of-the-art GLAD baselines in various scenarios such as one-class, multi-class, and large-scale imbalanced GLAD. \n\n**Weaknesses:**\n1. As the pseudo graph anomaly generation is the core of the proposed SDM, the major concern is whether the pseudo-anomalous graphs are sufficiently different from normal graphs so that they can truly benefit decision boundary learning.\n2. The proposed framework generates pseudo-anomalous graphs by perturbing normal graphs. However, how does the method ensure that it captures diverse potential anomalies rather than a narrow subset?\n3. In Fig. 6, it can be observed that the pseudo graph anomalies generated on SDM-ATII overlap significantly with the distribution of normal graphs (top row). The authors should further discuss this observation and its impact on model training.\n4. This paper did not involve the robustness analysis of SDM under data contamination situations, which is common in real-world scenarios.", "other_comments_or_suggestions": "1.\tPlease harmonize the formatting of “i.e.” and “e.g.”, such as unifying them as italics or not.\n2.\tAuthors should further list in Table 4 the ratio of samples in each category.", "questions_for_authors": "Please refer to the Weaknesses part above.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "I7tpZi74t1", "reviewer": "Reviewer_L2j6", "summary": "The paper presents self-discriminative modeling method for graph-level anomaly detection. By generating pseudo-anomalous graphs to interpolate between normal and anomalous samples, the method constructs a reliable decision boundary solely based on normal data. The claims are well supported by corresponding theory and analyses, and comparison experiments on various graph benchmarks validates the effectiveness of the proposed method.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**To W1:** Thank you for the insightful question. The adversarial training of SDM-ATI and SDM-ATII utilizes a generator to produce pseudo-anomalous graphs, with a discriminator balancing this via an adversarial loss (Eq. 9). Therefore, the numbers of training epochs for the generator and discriminator inherently control the gap between normal and pseudo-anomalous graphs. In practice, we employed a balanced setting of training epochs for both the generator and discriminator, and achieved superior performance. As visual evidence illustrated by the t-SNE plots (Figure 7), although generated anomalies stay close to normal data, they remain sufficiently distinct. SDM-NAT controls the gap through $\\lambda$, a larger $\\lambda$ implies a larger similarity between the generated pseudo anomalous graphs and the normal graphs, but we can observe that the performance is robust across a wide range of $\\lambda$ (see Figure 9).\n\nWe want to clarify that this setting would not introduce difficulties in training the classifier, as the adversarial dynamic and the joint learning in our methods can adaptively balance the discrimination capability of the classifier and the generation quality of the generator. The performance comparison (Tables 1, 3, and 6) across multiple datasets is good evidence to support this claim, and the embedding separation (e.g., Figure 7) also confirms the discrimination capability of the classifier. Besides, we further provided statistical analysis to demonstrate that pseudo-anomalous graphs are sufficiently different from normal graphs, so that they can truly benefit decision boundary learning (see response to Reviewer 1ZeV's W1).\n\n**To W2:** Thank you for your valuable concern. We tested the performance by removing the overlapping generated pseudo graph anomalies but gained only a slight improvement (usually $\\leq 1\\\\%$, sometimes even drops) in performance. Actually, our method doesn't require explicitly distinguishing between normal and pseudo anomaly graphs. Our results (e.g., Figure 6) show that despite overlaps observed between normal and pseudo anomalies during training, SDM variants still maintain superior generalization performance in the test phase and achieve robust separation of normal and anomalous graphs.\n\n**To W3:** We appreciate the suggestion. Actually, we have included relevant visualization results in Appendix E.2. For example, in Figure 7, we not only visualize the normal and real anomalous graphs for our methods (as in other baselines), but also visualize the generated pseudo anomalous graphs for comparison. The data points marked in yellow denote the generated pseudo-anomalous graphs in our methods. We observe that SDM effectively separates normal and anomalous graphs, with pseudo-anomalous graphs interpolated between normal and real anomalous graphs (refer to Figure 7 (h), (i), and (j)). This serves as good evidence to support the strengths of those pseudo-anomalous graphs in learning a more robust decision boundary compared to other baseline methods.\n\n**Again, we thank the reviewer for recognizing our work, and we hope that our responses can solve your concerns.**", "claims_and_evidence": "This paper asserts that an accurate decision boundary for normal data can be determined by generating anomalous data that closely resembles normal data. This claim is supported by both theoretical analysis and simulation experiments.", "methods_and_evaluation_criteria": "The proposed methods are effective and novel, and the evaluations are justified.", "theoretical_claims": "The theoretical claim is that the proposed model can effectively distinguish normal graphs from the generated pseudo-anomalous graphs, which serve as intermediates between normal and real anomalies. Additionally, the method for generating pseudo-anomalous graphs is well justified.", "experimental_designs_or_analyses": "The experiments in this paper are comprehensive and the experimental comparison is fair. The results are consistent to related analyses.", "relation_to_broader_scientific_literature": "N/A", "essential_references_not_discussed": "No other references are necessarily to be cited/discussed.", "other_strengths_and_weaknesses": "- Strengths:\n    1. This paper presents a clear and logical structure, making it easy to understand. The proposed approach appears promising for graph-level anomaly detection.\n    2. The motivation is well-articulated and reinforced through both theoretical analysis and experimental validation.\n    3. The study includes extensive comparative experiments, providing strong evidence of the method’s effectiveness.\n- Weaknesses:\n    1. How do the three proposed methods control the gap between pseudo-anomalous graphs and normal graphs without prior knowledge of real anomalous data? Does this introduce difficulties for the classifier in distinguishing them?\n    2. In Figure 3, there are significant overlaps between pseudo-anomalous and normal data. If these overlapping pseudo data points were removed, would the proposed method perform better?\n    3. Could the authors provide visualizations of the generated anomalous and normal data? This would greatly enhance the credibility of the approach.", "other_comments_or_suggestions": "Please refer to Weaknesses.", "questions_for_authors": "Please refer to the Weaknesses.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: Three reviewers have evaluated this work and scored it 3, 3 and 4. Overall, all reviewers are satisfied with the rebuttal and advocate acceptance.
Decision: Accept (poster)