Generative Semi-supervised Graph Anomaly Detection
Authors: Hezhe Qiao
Qingsong Wen
Xiaoli Li
Ee-Peng Lim
Guansong Pang
Venue: NeurIPS 2024 poster (2024)
Keywords: Anomaly Detection
Graph Neural Network
Graph Anomaly Detection
Primary area: graph_neural_networks
TL;DR: We propose a novel Generative Graph Anomaly Detection approach (GGAD) for an under-explored semi-supervised setting that has only labeled normal nodes and establish an evaluation benchmark for the setting.

Abstract: This work considers a practical semi-supervised graph anomaly detection (GAD) scenario, where part of the nodes in a graph are known to be normal, contrasting to the extensively explored unsupervised setting with a fully unlabeled graph. We reveal that having access to the normal nodes, even just a small percentage of normal nodes, helps enhance the detection performance of existing unsupervised GAD methods when they are adapted to the semi-supervised setting. However, their utilization of these normal nodes is limited. In this paper, we propose a novel Generative GAD approach (namely GGAD) for the semi-supervised scenario to better exploit the normal nodes. The key idea is to generate pseudo anomaly nodes, referred to as 'outlier nodes', for providing effective negative node samples in training a discriminative one-class classifier. The main challenge here lies in the lack of ground truth information about real anomaly nodes. To address this challenge, GGAD is designed to leverage two important priors about the anomaly nodes -- asymmetric local affinity and egocentric closeness -- to generate reliable outlier nodes that assimilate anomaly nodes in both graph structure and feature representations. Comprehensive experiments on six real-world GAD datasets are performed to establish a benchmark for semi-supervised GAD and show that GGAD substantially outperforms state-of-the-art unsupervised and semi-supervised GAD methods with varying numbers of training normal nodes.

Generative Semi-supervised Graph Anomaly Detection
Hezhe Qiao', Qingsong Wen', Xiaoli Li Ee-Peng Lim', Guansong Pang
"School of Computing and Information Systems, Singapore Management University
"Squirel Al
3 Institute for Infocomm Research, A*STAR, Singapore
S*STAR Centre for Frontier AI Research, Singapore
httpeegiiaa..222pphhhee 2022@phdcs smu ag, gingsongedudgmail. com x11i@i2r. a-star edu. ag, eplim@smu edu sg, gspang0amu edu.
hezheqiao.
Abstract
This work considers practical semi-supervised graph anomaly detection (GAD) scenario, where part of the nodes in a graph are known to be normal, contrasting the extensively explored unsupervised setting with fully unlabeled graph. We reveal that having access to the normal nodes, even just a small percentage of normal nodes, helps enhance the detection performance of existing unsupervised GAD methods when they are adapted to the semi-supervised setting. However, their utilization of these normal nodes limited. In this paper we propose novel Generative GAD approach (namely GGAD) for the semi-supervised scenario to better exploit the normal nodes. The key idea is to generate pseudo anomaly nodes, referred to as outlier nodes, for providing effective negative node samples in training a discriminative one-class classifier. The main challenge here lies the lack of ground truth information about real anomaly nodes. To address this challenge, GGAD is designed leverage two important priors about the anomaly nodes asymmetric local affinity and egocentric closeness to generate reliable outlier nodes that assimilate anomaly nodes in both graph structure and feature representations. Comprehensive experiments six real-world GAD datasets are performed establish benchmark for semi-supervised GAD and show that GGAD substantially outperforms state-of-the-ee unsupervised and semi-supervised GAD methods with varying numbers of training normal nodes. Code available at https://githu..com//// www.e/ooomoaaaaaaieeaeo
Introduction
Graph anomaly detection (GAD) has received significant attention due its broad application domains, e.g., cyber security and fraud detection [9, 16,,33. However, it is challenging to recognize anomaly nodes in graph due its complex graph structure and attributes [27,34, 44, 46, 62, 65, 66]. Moreover, most traditional anomaly detection methods (4,39, (3,,9,6)) 60) are designed for Euclidean data, which are shown to be ineffective address this challenge, as an effective way of modeling graph data, graph neural networks (GNN) have been widely used for deep GAD [34, 45). These GNN methods typically assume that the labels of all nodes are unknown and perform anomaly detection in fully unsupervised way by, egg. data reconstruction [8, I], self-super learning [6, 28, 36, 61], one-class homophily modeling [44]. Although these methods achieve remarkable advances, they are not favored in real-world applications where the labels for normal nodes are easy obtain due to their overwhelming presence graph. This is because their capability to utilize those labeled normal nodes is very limited due to their
non-Euu Non-Euclidean data like graph data [8, 17, 18,28,44 48,44,,1,, 51,6), To
Corresponding author: G. Pang
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

inherent unsupervised nature. There have been some GAD methods [12, 26, 24, 54,45,50,522,4 designed in semi-supervised setting, but their training relies on the availability of both labeled normal and anomaly nodes, which requires a costly annotation of a large set of anomaly nodes. This largely restricts the practical application of these methods.
Different from the aforementioned two GAD settings, this paper instead considers practical yet under-explored semi-supervised GAD scenario, where part of the nodes in the graph are known be normal. Such a one-class classification setting has been widely explored in anomaly detection on other data types, such as visual data [4, 39], time series [57], and tabular data [19], but it is rarely explored in anomaly detection on graph data. Recently there have been a few relevant studies in this line [3. 27, 31, 3,83, 56], but they are on gruph- anomaly detection, i.e., detecting abnormal graphs from a set of graphs, while we explore the semi- supervipee setting for abnormal node detection. We establish an evaluation benchmark for this problem and show that having access to these normal nodes helps enhance the detection performance of existing unsupervised GAD methods when they are properly adapted to the semi-supervised setting (see Table 1). However, due to their original unsupervised designs, they cannot make full use of these labeled normal nodes.
To better exploit those normal nodes, we pro- pose a novel generative GAD approach, namely GGAD, aiming at generating pseudo anomaly nodes, referred to as outlier nodes, for provid- ing effective negative node samples in train- ing a discriminative one-class classifier on the given normal nodes. The key challenge in this type of generative approach is the ab- sence of ground-truth information about real anomaly nodes. There have been many gener- ative anomaly detection approaches that learn adversarial outliers to provide some weak su- pervision of abnormality [37.47, 59, 64], but they are designed for non-graph data and fail to take account of the graph structure information in the outlier generation. Some recent methods, such as AEGIS [7], attempt to adapt this ap- proach for GAD, but the outliers are generated based on simply adding Gaussian noises to the GNN-based node representations, ignoring the structural relations between the outliers and the graph nodes. Consequently, the distribution of the generated outliers is often mismatched to that of the real anomaly nodes, as illustrated in Fig. la, and demonstrates very different local structure (Fig. lc).
Normal
Outlier
Abnarmal
Normal
Outlier
Aboernal
de
V
Lacal Node Altiaty
Graph
09
AEGIS
GGLLD
An exemplar graph with the edge width indicates the level of affinity connecting two nodes, in which normal nodes (e.g., Un, and Un,) have stronger affinity to its neighboring normal nodes than anomaly nodes (e.g., V/, and vay) due to homophily relation within the normal class. Our approach GGAD aims to generate outliers (e.g., Vo, and Voy) that can well assimilate the anomaly nodes. Right: The outliers generated by methods like AEGIS [7] that ignore their structural rela- tion often mismatch the distribution of abnormal nodes (a), due their false local affinity (c). By contrast, GGAD incorporates two important priors about anomaly nodes to generate outliers so that they well assimilate the (b) feature representation and (d) local structure of abnormal nodes.
Figure I: Left:
Our approach GGAD tackles this issue with a method to generate outlier nodes that assimilate the anomaly nodes in both local structure and feature representation. It is motivated by two important priors about the anomaly nodes. The first one is an asymmetric local affinity phenomenon revealed in recent studies [12, 13, (4,44), ie., the asfimity between normal nodes is typically significantly stronger than that between normal and abnormal nodes. Inspired by this, GGAD generates outlier nodes in way to enforce that they have smaller local affinity to their local neighbors than the normal nodes. This objective aligns the distribution of the outlier nodes to that of the anomaly nodes in terms of graph structure. The second prior knowledge is that many anomaly nodes exhibit high similarity the normal nodes in the feature space due to its subtle abnormality [24,44) or adversarial camouflage [10, 14, 44,29.44 29.49]. We encapsulate this prior knowledge as egocentric closeness, mandating that the feature representation of the outlier nodes should be closed to the normal nodes that share similar local structure as the outlier nodes. GGAD incorporates these two priors through two loss functions to generate outlier nodes that are well aligned to the distribution of the anomaly nodes in both local structure affinity (see Fig. 1d) and feature representation (see Fig. lb). We can then train
2

---

discriminative one-class classifier on the labeled normal nodes, with these generated outlier nodes treated as the negative samples.
Accordingly, our main contributions can be summarized as follows:
We explore a practical yet under-explored semi-supervised GAD problem where part of the normal nodes are known, and establish an evaluation benchmark for the problem.
We propose a novel generative GAD approach, GGAD, for the studied setting. To the best of our knowledge, it is the first work aiming for generating outlier nodes that are of similar local structure and node representations to the real anomaly nodes. The outlier nodes serve as effective negative samples for training a discriminative one-class classifier.
We encapsulate two important priors about anomaly nodes asymmetric local affinity and egocentric closeness and leverage them to introduce an innovative outlier node generation method. Although these priors may not be exhaustive, they provide principled guidelines for generating learnable outlier nodes that can well assimilate the real anomaly nodes both graph structure and feature representation across diverse real-world GAD datasets.
Extensive experiments on six large GAD datasets demonstrate that our approach GGAD substantially outperforms 12 state-of-the-ar unsupervised and semi-supervised GAD meth- ods with varying numbers of training normal nodes, achieving over 15% increase in AU- ROC/AUPRC compared to the best contenders on the challenging datasets.
2 Related Work
2.1 Graph Anomaly Detection
Numerous graph anomaly detection methods, including shallow and deep approaches, have been proposed. Shallow methods like Radar [22], AMEN [43], and ANOMALOUS [42] are often bottlenecked due to the lack of representation power to capture the complex semantics of graphs. With the development of GNN in node representation learning, many deep GAD methods show better performance than shallow approaches. Here we focus on the discussion of the deep GAD methods in two relevant settings: unsupervised and semi-supervised GAD.
Unsupervised Approach. Existing unsupervised GAD methods are typically built using a conven- tional anomaly detection objective, such data reconstruction. The basic idea is capture the normal activity patterns and detect anomalies that behave significantly differently. As one of the most popular methods,
cnnsstruction-baseee methods using graph auto-encoder (GAE) have been widely applied for GAD [1]. DOMINANT is the first work that applies GAE on the graph to reconstruct the attribute and structure leveraging GNNs [8]. Fan al. propose Anomaly DAE to further improve the performance by enhancing the importance of the reconstruction on the graph structure. In addition reconstruction, some methods focus on exploring the relationship in the graph, e-g., the relation between nodes and subgraphs, to train GAD models. Among these methods, Qiao et al. propose TAM [44], which maximizes the local node affinity on truncated graphs, achieving good performance on the synthetic dataset and datasets with real anomalies. Although the aforementioned unsupervised methods achieve good performance and help us identify anomalies without any access class labels, they cannot effectively leverage the labeled nodes when such information is available.
Semi-Supervised Approach. The one-class classification under semi-supervised setting has been widely explored in anomaly detection on visual data, but rarely done on the graph data, except [3,27,31, 38, 56) that recently explored this setting for graph-level anomaly detection. To detect abnormal graphs, these methods address a very different problem from ours, which is focused on capturing the normality of a set of given normal graphs at the graph level. By contrast, we focus on modeling the normality at the node level. Some semi-supervised methods have been recently proposed for node-level anomaly detection, but they assume the availability of the labels of both normal and anomaly nodes [12, 16, 26, 41, 48,8,, 52]. By contrast, our setting eases this requirement and requires the labeled normal nodes only.
2.2 Generative Anomaly Detection
Generative adversarial networks (GANs) provide an effective solution to generate synthetic samples that capture the normal/abnormal patterns [2, 15,63) One type of these methods aims to learn latent
3

---

features that can capture the normality of generative network [30, Methods like ALAD [59], Fence GAN [37] and OCAN [64] are early methods in this line, aiming at making the generated samples lie at the boundary of normal data for more accurate anomaly detection. Motivated by these methods, a similar approach has also been explored in graph data, like AEGIS [7] and GAAN [6] which aim to simulate some abnormal features in the representation space using GNN, but they are focused on adding Gaussian noise to the representations of normal nodes without considering graph structure information. They are often able to generate pseudo anomaly node representations that are separable from the normal nodes for training their detection model, but the pseudo anomaly nodes mismatched with the distribution of the real anomaly nodes.
3 Methodology
3.1 Problem Statement
Semi-supervised GAD. We focus on the semi-supervised anomaly detection on the attributed graph
given some labeled normal nodes. An attributed graph can be denoted by S = (V, & X), where V V ("1.... uyy } denotes the node set, & S V V with e & is the edge set in the graph. Cty = 1 represents there is a connection between node U2 and Vj, and eij = 0 otherwise. The node attributes are denoted as X E R and A E {0, 1NNNN is the adjacency matrix of S. I; E R is the attribute vector of 0ú and A,j = if and only if (vz, 1;)) E E. V,, and Va represent the normal node set and abnormal node set, respectively. Typically the number of normal nodes is significantly greater than the abnormal nodes, i.e. [V,l >> [Val The goal of semi- cumi-supee GAD to learn an anomaly scoring function f 9 + R, such that f(v) < [(('), Ve E VV,, v' E Va given set of labeled normal nodes V, C Vn and no access to labels of anomaly nodes. All other unlabeled nodes, denoted by V. = V V., comprise the test data set.
Outlier Node Generation. Outlier generation aims to generate outlier nodes that deviate from the normal nodes and/or assimilate the anomaly nodes, Such nodes can be generated in either the raw feature space or the embedding feature space. This work is focused on the latter case, as it offers a more flexible way to represent relations between nodes. Our goal is to generate set of outlier nodes from 9, denoted by Vo. in the feature representation space, so that the outlier nodes are well aligned to the anomaly nodes, given no access to the ground-truth anomaly nodes.
Graph Neural Network for Node Representation Learning. GNN has been widely used to generate the node representations due to its powerful representation ability in capturing the rich graph attribute and structure information. The projection of node representation using GNN layer can be generally formalized as
( = GNN (A 1), w(O),
where (d) E I NXA" (f N are the representations of all N nodes in the (f)-th layer and (e- 1)-th layer, respectively, (()) is the dimensionality size, W(O are the learnable parameters, and ( is set to X. H (h,, hy...., by is set of representations of N nodes in the last GNN layer, with h Rd. In this paper, we adopt 2-lryer GCN model the graph.
3.2 Overview of the Proposed GGAD Approach
The key insight of GGAD is to generate learnable outlier nodes in the feature representation space that assimilate anomaly nodes in terms of both local structure affinity and feature representation. To this end, we introduce two new loss functions that incorporate two important priors about anomaly nodes asymmetric local affinity and egocentric closeness 2a. the outlier nodes are first initialized based on the representations of the neighbors of the labeled normal nodes, followed by the use of the two priors on the anomaly nodes. GGAD implements the asymmetric local affinity prior in Fig. 2b that enforces a larger local affinity of the normal nodes than that of the anomaly nodes. GGAD then models the egocentric closeness in Fig. 2c that pulls the feature representations of the outlier nodes to the normal nodes that share the same ego network. These two priors are implemented through two complementary loss functions in GGAD. Minimizing these loss functions optimizes the outlier nodes to meet both anomaly priors. The resulting outlier nodes are lastly treated as negative samples to train a discriminative one-class classifier on the labeled normal nodes, as shown in Fig. 2d. Below we introduce GGAD in detail.
optimize the outlier nodes. As shown in Fig.

---

Graph
Embedding
Outlier
Initialization
Normal
Outlier
b4) Oinan Seee-daaee fass: Claseiieer
VE
Kernal
Uetber
Pull
Peturbation
Locd Allaky Paier
taak (2. [F1N) +1443
+
Normal Nodes
Unlabeled Nodes
GNN
ATlaay
h
Exgaratiic
Anomaly Score
Ego Network V /V,
Asymmetric Local A Affinit
Egocentric C Closeness
Priors
Figure 2: Overview GGAD. (a) It first initializes the outlier nodes based on the feature representa- tions of the ego network of labeled normal node. We then incorporate the two anomaly node priors (b-c) to optimize the outlier nodes so that they are well aligned to the anomalies. (d) The resulting generated outlier nodes treated as negative samples to train discriminative one-class classifier.
3.3 Incorporating the Asymmetric Local Affinity Prior
Outlier Node Initialization. Recall that GGAD is focused on generating learnable outlier nodes in the representation space. To enable the subsequent learning the outlier nodes, we need to produce good representation initialization of the outlier nodes. To this end, we use neighborhood-aware outlier initialization module that generates the initial outlier nodes' representation based on the representations of the local neighbors of normal nodes. The representations from these neighbor nodes provide an important reference for being normal local graph structure. This helps ground the generation of outlier nodes to a real graph structure. More specifically, shown in Fig. 2a, given a labeled normal node o; V, and its ego network N(u;) that contains all nodes directly connected with Us we initialize outlier node in the representation space by:
h (v,,)) [N(e:]]
Σ oWh,), 2yEX(v.)
where a mapping function determined by parameters Og that contain the learnable parameters dxd We in this module in addition to the parameters ((() in Eq. (1), and ((-) an activation function. It is not required to perform Eq. (2) for all training normal nodes. We sample set of normal nodes from V, and respectively generate an outlier node each of them based on its ego network. h, in Eq. (2) serves as an initial representation of the outlier node, upon which two optimization constraints based on anomaly node priors are devised to optimize the representations of the outlier nodes, as elaborated in the following.
To incorporate the graph structure prior of anomaly nodes into our outlier node generation, GGAD introduces a local affinity-based loss to enforce the fact that the affinity of the outlier nodes to their local neighbors should be smaller than that of the normal nodes. More specifically, the local node affinity of e; denoted as r (v:), ), is defined as the similarity to its neighboring nodes:
Enforcing the Structural Affinity Prior.
T (vx)
Σ sim (h, hy),
(v:)
EyEN(
The asymmetric local affinity loss is then defined by margin loss function based on the affinity of the normal nodes and the generated outlier nodes as follows:
late max {0, a (7 (Vi) (Vo)))
where 7 (Vo)= = Vo
Σ (v.) and (Vi) V. Σ T (w:) represent the average local affinity VEV.
V.V.
of the outliers and normal nodes respectively, and a >> is hyperparameter controlling the margin between the affinities of these two types of nodes. Eq. (4) enforces this prior at the node set level rather than at each individual outlier node, as the latter case would be highly computationally costly when Vi V. is large.
5

---

3,4 Incorporating the Egocentric Closeness Prior
The outliers generated by solely using this local affinity prior may distribute far away from the normal nodes in the representation space, as shown in Fig. 3a. For those trivial outliers, although they achieve similar local affinity the abnormal nodes, as shown in Fig. 3d, they are still not aligned well with the distribution of the anomaly nodes, and thus, they cannot serve as effective negative samples for learning the one-class classifier on the normal nodes. Thus, we further in- troduce an egocentric closeness prior-based loss function to tackle this issue, which models subtle abnormality on anomaly nodes, i.e., the anomaly nodes that exhibit high similarity to the normal nodes. More specifically, let h, and h, be the representations of the normal node v; and its corresponding generated outlier node that shares the same ego network as fa (as discussed in Sec. 3.2), the egocentric closeness prior-based loss lee is defined as follows:
Lec
1
E P.EV.
hh-hh, + ++) {
(a) Using Eata Only (b) Using tnc only (c) Using GGAD
V.l
where [Vol is the number of the generated outliers and e is a noise perturbation generated from a Gaussian distribution. The perturbation is added to guarantee separability between h, and h, while enforcing its egocentric closeness. It is worth mentioning that Gaussian noise works like hyperparameter in the feature interpolation to diversify the outlier nodes in the feature representation space. Changes of this noise distribution do not affect the superiority of the performance of GGAD over the competing methods.
(d) Using fato Only (e) Using fee Only Using GGAD
Figure 3: (a-c) t-SNE visualization of the node representations and (d-f) histograms of local affinity yielded by GGAD and its two variants on GAD dataset T-Finance [50].
As shown in Fig. 3c, using this egocentric closeness prior- loss together with the local affinity prior-based loss learns outlier nodes that are well aligned to the real anomaly nodes in both the representation space and the local structure, as illustrated in Figs. 3c and 3f, respectively. Using the egocentric closeness alone also results in mismatches between the generated outlier nodes and the abnormal nodes (see Fig. 3e) since it ignores the local structure relation of the generated outlier nodes.
3.5 Graph Anomaly Detection using GGAD
Training. Since the generated outlier nodes are to assimilate the abnormal nodes, they can be used as important negative samples to train one-class classifier on the labeled normal nodes. We implement this classifier using a fully connected layer on top of the GCN layers that maps the node representations prediction probability- based anomaly score, denoted by n H - R, followed by a binary cross-entropy (BCE) loss function lace:
|Vo|+IVil
Lace Σ
yi log(p:) + (1 y/i log(1 pt);
(6)
where p; = ry(h;; O.) is the output of the one-class classifier indicating the probability that a node is normal node, and is the label of node. We set y = 1 if the node is labeled normal node, and y = if the node is a generated outlier node. The one-class classifier jointly optimized with the local affinity prior-based loss faia and egocentric closeness prior-based loss fee in an end-to-end manner. This results in mediation in the feature representation space where the generated outlier nodes are close to, yet separable from, the labeled normal nodes and their neighbors. Thus, these outlier nodes can be thought as hard anomalies that lie at the fringe of normal nodes in the feature representation space. The optimization of these two prior losses is continuously decreasing and converging finally during the training (see App. E), indicating that these two losses are collaborative rather than diverged. Thus, the overall loss Lotal can be formulated as:
Liotal lace + Blata + XLeas

---

where 3 and À are the hyperparameters to control the importance of the two constraints respectively. The learnable parameters are θ { O,).
Inference. During inference, we can directly use the inverse of the prediction of the one-class classifier as the anomaly score:
score (u²) 11))=1100 (b):)))
(8)
where O* is the learned parameters of GGAD. Since our outlier nodes well assimilate the real abnormal nodes, they are expected to receive high anomaly scores from the one-class classifier.
Experiments
Datasets. We conduct experiments on six large real-world graph datasets with genuine anomalies from diverse domains, including the co-review network in Amazon [10], transaction record network in T-Finance [50], social networks in Reddit [21], bitcoin transaction in Elliptic [55], co-purchase network in Photo [35] and financial network in DGraph [18]. See App. A for more details about the datasets. Although it is easy to obtain normal nodes, the human checking and annotation of large-scale nodes are still costly. To simulate practical scenarios where we need to annotate only a relatively small number of normal nodes, we randomly sample R% of the normal nodes as labeled normal data for training, in which R is chosen in {10, 15, 20, 25). with the rest of nodes treated as the testing set. Due to the massive set of nodes, the same R applied to DGraph would lead to a significantly larger set of normal nodes than the other three data sets, leading to very different annotation costs in practice. Thus, on DGraph, R is chosen in {0.05, 0.2, 0.35, 0.5} to compose the training data.
Competing Methods. To our best knowledge, there exist no GAD methods specifically designed for semi-supervised node-level GAD. To validate the effectiveness of GGAD, compare it with six state-of-the-ar (SOTA) unsupervised methods and their advanced versions in which we effectively adapt them our semi-supervised setting. These methods include two reconstruction--asse models: DOMINANT [8] and AnomalyDAE []. two one-class classification models: TAM [44] and OCGNN [53], and two generative models: AEGIS [7] and GAAN [6]. To effectively incorporate the normal information into these unsupervised methods, for the reconstruction models, DOMINANT and Anomaly DAE, the data reconstruction performed on the labeled normal nodes only during training. In OCGNN, the one-class center is optimized based on the labeled normal nodes exclusively. In TAM, we train the model by maximizing the affinity on the normal nodes only. As for AEGIS and GAAN, the normal nodes combined with their generated outliers are used to train an adversarial classifier. self-supervised-baasee
methods like CoLAA [28], SL-GAD [6], and HCM-A [17] and semi-supervised methods that require both labeled normal and abnormal nodes like GODM Jand DiffAD [32] are omitted because training these methods on the data with exclusively normal nodes does not work.
Evaluation Metric. Following prior studies [5,40,5 00,51,,, two popular and complementary evaluation metrics for anomaly detection, the area under ROC curve (AUROC) and Area Under the precision- recall curve (AUPRC), are used to evaluate the performance. Higher AUROC/AUPRC indicates better performance. AUROC reflects the ability to recognize anomalies while at the same time considering the false positive rate. AUPRC focuses solely on the precision and recall rates of anomalies detected. The AUROC and AUPRC results are averaged over 5 runs with different random seeds.
Implementation Details. GGAD is implemented in Pytorch 1.6.0 with Python 3.7. and all the experiments are run on a 24-core CPU. In GGAD, its weight parameters are optimized using Adam [20] optimizer with a learning rate of Le 3 by default. For each dataset, the hyperparameters and X for two constraints are uniformly set 1, though GGAD can perform stably with range of B and À (see App. C.2). The size of the generated outlier nodes $ is set to 5% of [V/] by default and stated otherwise. The affinity margin a is set to 0.7 across all datasets. The perturbation in Eq. (5) is drawn from a Gaussian distribution, with mean and standard variance set to 0.02 and 0.01 respectively, and is stated otherwise. All the competing methods are implemented by using their publicly available official source code or the library, and they are trained using their suggested hyperparameters. To apply GGAD and the competing models to very large graph datasets, i.e., DGraph, a min-batch training strategy is applied (see Algorithm 2 for detail).
7

---

Table I: AUROC and AUPRC on six GAD datasets. The best performance per dataset boldfaced. with the second- best underlined. '/' indicates that the model cannot handle the DGraph dataset.
Dataset
Setting
Method
AUROC
AUPRC
Amazon
T-Finance
Reddit
Elliptic
Photo
DGruph
Amazoon
T-Fimance
Reddit
Eliitiic
Photo
DGruph
DOMINANT
0,7023
0.6087
0.5105
0.2960
0.5136
0.3738
0.1311
0,0536
0,0380
0.0154
0.1039
0.0075
AnomalyDAE
0.7783
0.5809
0.5091
0.4963
0.5069
0.5763
0.1429
0.8491
0.0319
0.0872
0.0987
0.0070
Unsupervised
OCGNN
0.7165
0.4732
0.5246
0.2581
0.5307
1
0.1352
0.0392
0,0375
0.0616
0.0965
AEGIS
0.6099
0.6496
0.5349
0.4553
0.5516
0.4509
0.1200
0,0622
0,0413
0.0827
0.9972 0.0053
GAAN
0.5133
0.3091
0.5216
0.2590
0.4296
/
0,0852
0.0283
0.0348
0.0436
0.0767
TAM
08303
0.6155
0.6022
0,4039
0.5675
/
0,4024
0.0547
0,0437
0.0502
0,1013
DUMINANT
0.3867
0.6167
0.3256
0.1233
DO00G
AnomalyDAF
0.9171
0.6027
0.5280
0,5409
0.5272 0.5866
0.2348
0.0538
0.8362
0.0949
0.1177
0.0071
Semi supervised
OCGINN
AEGIS
0
0.7593
0.5742
0.6728
0.5622
0,2881
0.5132
0.6461
0.4450
/
0.7538
0,0492
0.1685
0,0441
0,0400
0.0640
0.1501
0,1110
0.0058
/
GAAN
0.6531
0.3636
0.5349
0.2724
0.4355
0.0856
0.0324
0.8362
0.0611
0.0768
TAM
0.8405
0.5923
0.5829
0.4150
0.6013
0.5188
0,0551
0.4466
0.0552
0.1087
GGAD (Ours)
0.9443
0.8228
0.6354
0.7290
0.6476
0.5943
0.7922
0.1825
0.0610
0.2425
0,1442
0.0082
4.1
Main Comparison Results
Table shows the comparison of GGAD 12 models, in which semi-supervised models use 15% normal nodes during training while unsupervised methods are trained on the full graph in a fully unsupervised way. We will discuss results using more/less training normal nodes in Sec. 4.2.
Comparison to Unsupervised GAD Methods. As shown in Table 1, GGAD significantly outper- forms all unsupervised methods on six datasets, having maximally 21% AUROC and 39% AUPRC improvement over the pest-comp unsupervised methods on individual datasets. The results also show that the supervised versions of the unsupervised methods largely improve the performance of their unsupervised counterparts, justifying that i) incorporating the normal information into the unsupervised approaches is beneficial for enhancing the detection performance and ii) our approach to adapt the unsupervised methods is effective across various types of GAD models. TAM performs best among the unsupervised methods. AEGIS which leverages GAN learn the normal patterns performs better than AnomalyDAF and DOMINANT on T-Finance, Reddit, and Photo, By contrast, acconstucctonn-based methods work well on Amazon and DGraph. Similar observations can be found for the remi-supervised versions.
Comparison to Semi-supervised GAD Methods. The results in Table show that although the semi- supervised methods largely outperform unsupervised counterparts, they substantially underperform our method GGAD. The reconstruction-bart based approaches show the most competitive performance among the contenders in remi-supervised settings, e.g., AnomalyDAE performs best on Amazon and DGraph. Nevertheless, GGAD gains respectively about 1-3% AUROC/AUPRC improvement on these two datasets compared to best-competing AnomalyDAF. By training on the normal nodes only, methods like TAM and AEGIS largely reduce the interference of unlabeled anomaly nodes on the model and work well on most of the datasets, e.g., TAM on Amazon and Reddit, AEGIS on T-Finance and Reddit. However, their performance still lower than GGAD by relatively large margin. GGAD yields the best AUROC on the Photo while yielding the second-best in AUPRC, underperforming OCGNN. This indicates that GGAD can detect some anomalies very accu- rately in Photo, but it is less effective than OCGNN to get a bit more anomalies rank at the top of normal nodes in terms of their anomaly score. On average over the six datasets, GGAD outperforms the best semi-supervised contender AnomalyDAE by 11% in AUROC and 5% in AUPRC, demonstrating that GGAD can make much better use of the labeled normal nodes through our two anomaly prior-based losses.
GAAN
TAM
-GGDD
6.209
0.303
0.00
(4) Amsazo
(h) T-Flnance
Figure 4: AUPRC results w.n. the size of training normal nodes (R% of [V]. 'Baseline' denotes the performance of the best unsupervised GAD method.
4.2 Performance w.r.t. Training Size and Anomaly Contamination
In order to further illustrate the effectiveness of our method, we also compare GGAD with other semi-supervised methods using varying numbers of training normal nodes in Fig. 4 and having
8

---

various anomaly contamination rates in Fig. 5. Due to page limitation, we present the AUPRC results on two datasets here only, showing the representative performance. The full AUROC and AUPRC results are reported in App. C.
The results in Fig. 4 show that with increasing training samples of normal nodes, the per- formance of all methods on all four datasets generally gets improved since more normal samples can help the models more accurately capture the normal patterns during training. Importantly, GGAD consistently outperforms all compet- ing methods with varying numbers of normal nodes, re- inforcing that GGAD can make better use of the labeled normal nodes for GAD.
AEGIS
GAsh
TAM
GEAD
The labeled normal nodes can often be contaminated by anomalies due to factors like annotation errors. To con- sider this issue, we introduce a certain ratio of anomaly contamination into into the training normal node set Vt. The results of the models under different ratios of contam- Figure 5: AUPRC w.r.t contamination.
Amazza
[b) T-FTnunce
ination in Fig. 5. show that with increasing anomaly contamination, the performance of all methods decreases. Despite the decreased performance, our method GGAD consistently maintains the best performance under different contamination rates, showing good robustmess w.r.t. the contamination.
4.3 Ablation Study
Importance of the Two Anomaly Node Priors. The importance of the two proposed losses based on the priors on the anomaly nodes is examined by comparing our full model with its variant removing the corresponding loss, with the results shown in Ta- ble 4. It is clear that learning the outlier node representations using one of the two losses performs remarkably less effectively than our full model using both losses. It is mainly because although using Eata solely can obtain similar local affinity of the outliers to the real anomaly nodes, the outliers are still not aligned well with the distribution of the anomaly nodes in the node representation space. Likewise, only using the lee can result in mismatch be- tween the generated outliers and real abnormal samples in their graph structure. GGAD that ef- fectively unifies both priors through the two losses can generate outlier nodes that well assimilate the real abnormal nodes on both graph struc- ture and node representation space, supporting substantially more accurate GAD performance.
Table 2: Ablation study on our two priors.
Compuneni Lx
Fate
Amazon
L-Fimance
Eliipic Photo
Dirigl
0.8871
0.8149
0.5839 0.6863 0,5762
0.5891
AUROC:
4
0.7250
0.6994
0.5230
0.7001 0.6103
0.5513
7
6
0.9324
0.8228
0.6354
0.7290 0.6476
0,5943
016645
0.131
01309
0193
E.115T
B/006
AUPRC
0.1783
0,0800
0.0098
0.2683 0.1186
0,0063
0.7843
0.1924
0.0610
0.2255 0.1442 0,0067
GGAD vs. Alternative Outlier Node Genera- tion Approaches. To examine its effectiveness further, GGAD is also compared with four other approaches that could be used an alternative to generating the outlier nodes. These include (i) Random that randomly sample some nor- mal nodes and treat them as outliers to train a one-class discriminative classifier, (ii) Non- learnable Outliers (NLO) that removes the learnable parameters W in Eq. (2) in our outlier node generation, (iii) Noise that directly gener- ates the representation of outlier nodes from ran- dom noise, (iv) Gaussian Perturbation (Gaus- sianP) that directly adds Gaussian perturbations into the sampled normal nodes' representations to generate the outliers. Apart from the Noise and GaussianP, we further employ two advanced generation approaches, (vi) VAE that generate the outlier representations by reconstructing the raw attributes of selected nodes where our two anomaly prior-based constraints are applied to the gener- ation, and (v) GAN that generates the embedding from the noise and adds an adversarial function to discriminate whether the generated node is fake or real, with our two prior constraints applied in
Table 3: GGAD vs. alternative outlier generators.
Metric
Method
Amazon
T-Pinance
Reddit
Datasel
Elliptic
Photo
D'Graph
0.7263
0.4613
0.5227
0.5678
03712
NLO
0.6633
0.6179
0.5638
0.6787
0.5307
0.5338
AUROC
Noise
0.508
0.8204
0.5285
0.686
0.5940
0.5779
GaussianP
0.237
0.6699
0.5255
06715
0.5925
0.5862
VAE
0.8981
0.6674
0.6155
0,7055
0,6222
0.5801
GAN
03288
0.5487
0.5778
0.256
0.602
0.1101
GGAD (Oers)
0.9324
0
0.6354
0,7290
0,6476
0.5943
Random
0.1335
00102
0.0394
0.188
0.1063
00001
NLO
0.46%
0.1364
0.9495
0.1750
0.1092
0.0865
AUPRO
Noise
0.5384
0762
0.031
0.124
0.1200
0.0076
Gauassann
0.0997
0.0677
0.0376
0.1682
0.1194
0.0028
VAF
06111
00652
0.052
07344
0.1222
0U0065
GAN
0.3715
0.041
0.043
011263
0.1143
0.0051
GGAD (Oers)
0.7843
0.1924
0.0610
0.2425
0,1442
0J00K7
9

---

the generation as well. The results are shown in Table 3. Random does not work properly. since the randomly selected samples are not distinguishable from the normal nodes. NLO performs fairly well on some data sets such as Amazon, T-Finance, and Elliptic, but it is still much lower than GGAD, showcasing that having learnable outlier node representations can help better ground the outliers in real local graph structure. Despite that Noise and GaussianP can generate outliers that have separable representations from the normal nodes, they also fail to work well since the lack of graph structure in the outlier nodes can lead to largely mismatched distributions between the generated outlier nodes and the anomaly nodes. By contrast, the outlier nodes learned by GGAD can better align with the anomaly nodes due to the incorporation of the anomaly priors on graph structure and feature representation into our GAD modeling. Both VAE and GAN can work well on some datasets, which indicates two priors help them learn relevant outlier representations. But both of them are still much lower than GGAD, showcasing that the outlier generation approach in GGAD can leverage the two proposed priors generate better outliers.
GGAD vs. GGAD enabled Unsupervised Methods. We incorporate the outlier generation into existing unsupervised methods to demonstrate the generation in GGAD can also benefit the existing unsupervised methods. To allow the unsupervised methods to fully exploit the gen- erated outliers, we first utilize GGAD to generate outlier nodes by training on randomly sam- pled nodes from a graph (which can be roughly treated as all normal nodes due to anomaly scarcity) and then remove possible abnormal nodes from the graph dataset by filtering out Top-K most similar nodes to the generated outlier nodes. By removing these suspicious abnormal nodes, the unsupervised method is expected to train the cleaner graph (i.e., with less anomaly contamination). This approach to improve unsu- pervised GAD methods is referred to GGAD- enabled unsupervised GAD. We evaluate their effectiveness on three large-scale datasets. As shown in Table 4, where # #Anomalies/## Top-K Node represents the number of real abnormal nodes we successfully filter out and the number of nodes we choose to filter out (i.e., K) respec- tively. For example, we use the outlier nodes generated by GGAD to filter out 500 nodes from the Amazon dataset, of which there are 387 real abnormal nodes. This helps largely reduce the anomaly contamination rate in the graph. The results show that this approach can significantly improve the performance of three different representative unsupervised GAD methods, including DOMINANT, OCGNN, and AEGIS. Note that although the unsupervised methods achieve better performance, their performance still largely underperforms GGAD, which provides stronger evidence for the effective capability in anomaly detection of GGAD.
Table 4: GGAD enabled unsupervised methods.
Metric
Method
Amazon
T I'Finance
Dalaset
Elligtic
Mavealies Nodes
387750
3517/000
|-15/200
DOMINANT
0.6087
GGAD-enaled DOMINANT
0.186
0.6275
0.2966
AUROC
GGAD-emabled OCGNN
OCGNN
0.165
0.8622
0.5931
0.4322
0.2638
0.2581
ABGIS
0.6099
0.6496
0.4533
GGAD enabled AEGIS
0.3395
0.7024
0,5036
(GADD
0.9431
0.8108
IL7225
DUSINNANT
GGAD enddleed DOMINANT
0.3462
0.0585
0.0613
AUPRC
OGAD-emabled OCGNN
OCGNN
0.1352
0.3950
0.0480
0.0922
B.0616
0,0607
AEGIS
0.1200
0.0622
0,0K27
GGAD-ashhlld AFCIS
0.3833
0.0784
0.0910
GGAD
0.7769
0.1734
0L2484
5 Conclusion and Future Work
In this paper, we investigate new semi-supervised GAD scenario where part of normal nodes are known during training. To fully exploit those normal nodes, we introduce novel outler generation approach GGAD that leverages two important priors about anomalies in the graph to learn outlier nodes that well assimilate real anomalies in both graph structure and feature representation space. The quality of these outlier nodes is justified by their effectiveness in training discriminative one-class classifier together with the given normal nodes. Comprchensive experiments are performed to establish an evaluation benchmark on six real-world datasets for semi-supervised GAD, in which our GGAD outperforms 12 competing methods across the six datasets.
Limitation and Future work. The generation of the outlier nodes in GGAD is built upon the two important priors about anomaly nodes a graph. This helps generate outlier nodes that well assimilate the anomaly nodes across diverse real-world GAD datasets. However, these priors are not exhaustive, and there can be some anomalies whose characteristics may not captured by the two priors used. We will explore this possibility and improve GGAD for this case in our future work.
10

---

Acknowledgments. We thank the anonymous reviewers for their valuable comments. The participa- tion of Guansong Pang was supported in part by Lee Kong Chian Fellowship.
References
[1] Sambaran Bandyopadhyay, Lokesh N, Saley Vishal Vivek, and M Narasimha Murty. Outlier resistant unsupervised deep architectures for attributed network embedding. In Proceedings of the 13th international conference on web search and data mining, pages 25-33, 2020. 3
[2] Jinyu Cai and Jicong Fan. Perturbation learning based anomaly detection. Advances in Neural
Information Processing Systems, 35: 4311-1433,,, 2022. 3
[3] Jinyu Cai, Yunhe Zhang, and Jicong Fan. Seff-discriminative modeling for anomalous graph detection, arXiv preprint arXiv:2310.06261,, 2023. 2.
[4] Yunkang Cao, Xiaohao Xu, Jiangning Zhang, Yugi Cheng, Xiaonan Huang, Guansong Pang, and Weiming Shen. A survey on visual anomaly detection: Challenge, approach, and prospect.
arXiv preprint arXiv:2401.16400 2024. 1.2
[5] Ziwei Chai, Siqi You, Yang Yang, Shiliang Pu, Jiarong Xu, Haoyang Cai, and Weihao Jiang. Can abnormality be detected by graph neural networks. In Proceedings of the Twenty-Ninth International Joint Conference on Artificial Intelligence (IJCAI), Vienna, Austria, pages 23-29, 2022.
[6] Zhenxing Chen, Bo Liu, Meiqing Wang, Peng Dai, Jun Lv, and Liefeng Bo. Generative adversarial attributed network anomaly detection. In Proceedings of the 29th ACM International Conference Information & Knowledge Management, pages 1989-1992 2020. 1,4, 16
[7] Kaize Ding, Jundong Li, Nitin Agarwal, and Huan Liu. Inductive anomaly detection on attributed networks. Proceedings of the twenty-ninth international conference on international joint conferences on artificial intelligence, pages 2288-12944 2021. 2, 4, 7, 15
[8] Kaize Ding, Jundong Li, Rohit Bhanushali, and Huan Liu. Deep anomaly detection on attributed networks. In Proceedings of the 2019 SIAM International Conference on Data Mining, pages 594-602, SIAM, 2019. 1, 3, 15
[9] Linfeng Dong, Yang Liu, Xiang Ao, Jianfeng Chi, Jinghua Feng, Hao Yang, and Qing He. Bi-level selection via meta gradient for graph-based fraud detection. In International Conference on Database Systems for Advanced Applications, pages 387-394. Springer, 2022.
[10] Yingtong Dou, Zhiwei Liu, Li Sun, Yutong Deng, Hao Peng, and Philip S Yu. Enhancing graph neural network-based fraud detectors against camouflaged fraudsters. In Proceedings of the 29th ACM international conference on information knowledge management, pages 315-324, 2020. 2, 7, 15
[11] Haoyi Fan, Fengbin Zhang, and Zuoyong Li. Anomalydae: Dual autoencoder for anomaly detection on attributed networks. In ICASSP 2020-2020 IEEE International Conference Acoustics, Speech and Signal Processing (ICASSP), pages 5685-5689. IEEE, 2020. 1, 1,7, 15
[12] Yuan Gao, Xiang Wang, Xiangnan He, Zhenguang Liu, Huamin Feng, and Yongdong Zhang. Addressing heterophily in graph anomaly detection: A perspective of graph spectrum. In Proceedings of the ACM Web Conference 2023, pages 1528-1538 2023. 2,
[13] Yuan Gao, Xiang Wang, Xiangnan He, Zhenguang Liu, Huamin Feng, and Yongdong Zhang Alleviating structural distribution shift in graph anomaly detection. In Proceedings of the Sixteenth ACM International Conference on Web Search and Data Mining, pages 357-365 2023. 2
[14] Zheng Gong, Guifeng Wang. Ying Sun, Qi Liu, Yuting Ning, Hui Xiong, and Jingyu Peng. Beyond homophily: Robust graph anomaly detection via neural sparsification. In Proceedings of International Joint Conference on Artificial Intelligence, pages 2104-2113, 2023.
[15] Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial networks. Communications of the ACM, 63(11):139-144, 2020. 3
[16] Mengda Huang, Yang Liu, Xiang Ao, Kuan Li, Jianfeng Chi, Jinghua Feng, Hao Yang, and Qing He. Auc-oriented graph neural network for fraud detection. Proceedings of the ACM Web Conference 2022, pages 131 1311-,321, 2022. 2,

---

[17] Tianjin Huang, Yulong Pei, Vlado Menkovski, and Mykola Pechenizkiy. Hop-count based self-supervised anomaly detection on attributed networks. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases, pages 225-241. Springer, Spriinr,, 2022. 1,
7
[18] Xuanwen Huang, Yang Yang. Yang Wang, Chunping Wang, Zhisheng Zhang, Jiarong Xu, Lei Chen, and Michalis Vazirgiannis. Dgraph: A large-scale financial dataset for graph anomaly detection. Advances in Neural Information Processing Systems, 35:22765-227777 2022. 7, 15
[19] Minqi Jiang, Chaochuan Hou, Ao Zheng. Songqiao Han, Hailiang Huang, Qingsong Wen, Xiyang Hu, and Yue Zhao. Adgym: Design choices for deep anomaly detection. In Thirty- seventh Conference Neural Information Processing Systems Datasets and Benchmarks Track, 2023.
[20] Kinga, Jimmy Ba Adam, et al. method for stochastic optimization. In International conference on learning representations (ICLR), volume 5, page 6. San Diego, California, 2015,
7
[21] Srijan Kumar, Xikun Zhang, and Jure Leskovec. Predicting dynamic embedding trajectory in temporal interaction networks. In Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining, pages 1269-1278, 2019. 7, 15
[22] Jundong Li, Harsh Dani, Xia Hu, and Huan Liu. Radar: Residual analysis for anomaly detection in attributed networks. In IJCAI, pages 2152-2158, 2017.
[23] Kay Liu, Yingtong Dou. Yue Zhao, Xueying Ding. Xiyang Hu, Ruitong Zhang, Kaize Ding, Canyu Chen, Hao Peng, Kai Shu, George H. Chen, Zhihao Jia, and Philip S. Yu. Pygod: A python library for graph outlier detection. arXiv preprint arXiv:2204. /2095, 2022. 16
[24] Kay Liu, Yingtong Dou, Yue Zhao, Xueying Ding. Xiyang Hu, Ruitong Zhang, Kaize Ding, Canyu Chen, Hao Peng, Kai Shu, Lichao Sun, Jundong Li, George H. Chen, Zhihao Jia, and Philip S. Yu. Bond: Benchmarking unsupervised outlier node detection on static attributed graphs. Advances Neural Information Processing Systems, 15:27021-27033 2022. 2, 16
[25] Kay Liu, Hengrui Zhang, Ziqing Hu, Fangxin Wang, and Philip S Yu. Data augmentation for su- pervised graph outlier detection with latent diffusion models. arXiv preprint arXiv:2312.1767, 2023.
[26] Yang Liu, Xiang Ao, Zidi Qin, Jianfeng Chi, Jinghua Feng, Hao Yang, and Qing He. Pick and choose: a gnn-based imbalanced learning approach for fraud detection. In Proceedings of the web conference 2021, pages 3168-3177, 2021. 2,3
[27] Yixin Liu, Kaize Ding, Qinghua Lu, Fuyi Li, Leo Yu Zhang, and Shirui Pan. Towards self- interpretable graph-level anomaly detection. arXiv preprint arXiv:2310.16522 2023. 1,
3
[28] Yixin Liu, Zhao Li, Shirui Pan, Chen Gong, Chuan Zhou, and George Karypis. Anomaly detection attributed networks via contrastive self-supervised learning. IEEE transactions on neural networks and learning systems, 33(6):2378-2 2392, 2021. 1.7
[29] Zhiwei Liu, Yingtong Dou, Philip S Yu, Yutong Deng, and Hao Peng. Alleviating the inconsis- tency problem of applying graph neural network to fraud detection. In Proceedings of the 43rd international ACM SIGIR conference on research and development in information retrieval, pages 1569-15577 1572, 2020. 2
[30] Zuhao Liu, Xiao-Ming Wu, Dian Zheng, Kun Yu Lin, and Wei-Shi Zheng. Generating anoma- lies for video anomaly detection with prompt- based feature mapping. In Proceedings of the IEFF/CVE Conference on Computer Vision and Pattern Recognition, pages 24500-24510, 2023. 4
[31] Rongrong Ma, Guansong Pang, Ling Chen, and Anton van den Hengel. Deep graph-level anomaly detection by glocal knowledge distillation. In Proceedings of the Fifteenth ACM International Conference on Web Search and Data Mining, pages 704-714, 2022. 2,3
[32] Xiaoxiao Ma, Ruikun Li, Fanzhen I Liu, Kaize Ding, Jian Yang, and Jia Wu. New recipes for graph anomaly detection: Forward diffusion dynamics and graph generation. 2023.
[33] Xiaoxiao Ma, Jia Wu, Shan Xue, Jian Yang, Chuan Zhou, Quan Z Sheng, Hui Xiong, and Leman Akoglu. comprehensive survey on graph anomaly detection with deep learning. IEEE Transactions on Knowledge and Data Engineering 2021.
12

---

[34] Xiaoxiao Ma. Jia Wu, Jian Yang, and Quan Z Sheng, Towards graph-level anomaly detection via deep evolutionary mapping. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 1631-16423 2023. 1,2
[35] Julian McAuley, Christopher Targett, Qinfeng Shi, and Anton Van Den Hengel. Image- based recommendations styles and substitutes. In Proceedings of the 38th international ACM SIGIR conference on research and development in information retrieval, pages 43-52, 2015. 7, 15
[36] Lin Meng, Hesham Mostafa, Marcel Nassar, Xiaonan Zhang, and Jiawei Zhang. Generative graph augmentation for minority class in fraud detection. In Proceedings of the 32nd ACM International Conference Information and Knowledge Management, pages 4200 2023.
[37] Phuc Cuong Ngo, Amadeus Aristo Winarto, Connie Khor Li Kou, Sojeong Park, Farhan Akram, and Hwee Kuan Lee. Fence gan: Towards better anomaly detection. In 2019 IEEE 31S; International Conference on tools with artificial intelligence (ICTAI), pages 141-148. IEEE,
2019. 2,4
[38] Chaoxi Niu, Guansong Pang, and Ling Chen. Graph-level anomaly detection via hierarchical memory networks. In Joint European Conference Machine Learning and Knowledge Discovery in Databases, pages 201-218. Springer, 2023. 2,3
[39] Guansong Pang. Chunhua Shen, Longbing Cao, and Anton Van Den Hengel. Deep learning for anomaly detection: A review. ACM computing surveys (CSUR), 54(2):1-38, 2021. 1,2
[40] Guansong Pang, Anton van den Hengel, Chunhua Shen, and Longbing Cao. Toward deep supervised anomaly detection: Reinforeement learning from partially labeled anomaly data. In Proceedings of the 27th ACM SIGKDD conference on knowledge discovery & data mining, pages 1298-1308. 2021. 7
[41] Joonhyung Park, Jaeyun Song, and Eunho Yang. Graphens: Neighbor- awware aware ego network synthesis for insslaimbalnneed node classification. In The Tenth International Conference on Learning Representations, ICLR 2022. International Conference on Learning Representations (ICLR), 2022.
[42] Zhen Peng, Minnan Luo, Jundong Li, Huan Liu, and Qinghua Zheng. Anomalous: A joint modeling approach for anomaly detection on attributed networks. In IJCAI. pages 3513-3519, 2018. 3
[43] Bryan Perozzi and Leman Akoglu. Scalable anomaly ranking of attributed neighborhoods. In Proceedings of the 2016 SIAM International Conference on Data Mining, pages 207-215. SIAM. 2016. 3
[44] Hezhe Qiao and Guansong Pang. Truncated affinity maximization: One-class homophily modeling for graph anomaly detection. In Advances in Neural Information Processing Systems,
2023. 1, 2, 3, 7, 16
[45] Hezhe Qiao, Hanghang Tong, Bo An, Irwin King, Charu Aggarwal, and Guansong Pang. Deep graph anomaly detection: A survey and new perspectives. arXiv preprint arX1v:2409.09997, 2024.
[46] Amit Roy, Juan Shu, Jia Li, Carl Yang, Olivier Elshocht, Jeroen Smeets, and Pan Li. Gad-nr: : Graph anomaly detection via neighborhood reconstruction. In Proceedings of the 17th ACM International Conference on Weh Search and Data Mining, 2024.
[47] Mohammad Sabokrou, Mahmood Fathy, Guoying Zhao, and Ehsan Adeli. Deep end one-class classifier. IEFE transactions on neural networks and learning systems, 32(2):675566
2021. 2
[48] Fengzhao Shi, Yanan Cao, Yanmin Shang, Yuchen Zhou, Chuan Zhou, and Jia Wu. H2-fdetector: gnn-based fraud detector with homophilic and heterophilic connections. In Proceedings of the ACM Web Conference 2022, pages 1486-1494, 2022. 3
[49] Jianheng Tang, Fengrui Hua, Ziqi Gao, Peilin Zhao, and Jia Li. Gadbench: Revisiting and benchmarking supervised graph anomaly detection. arXiv preprint arXiv:2306. /225// 2023. 2
[50] Jianheng Tang, Jiajin Li, Ziqi Gao, and Jía Li. Rethinking graph neural networks for anomaly detection. In International Conference on Machine Learning, pages 21076-21089. PMLR,
2022. 2. 6, 15
13

---

[51] Qizhou Wang, Guansong Pang, Mahsa Salehi, Wray Buntine, and Christopher Leckie. Cross- domain graph anomaly detection via amomaly-aware contrastive alignment. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 4676-4684, 2023. 1,7
[52] Qizhou Wang, Guansong Pang, Mahsa Salehi, Wray Buntine, and Christopher Leckie. Open-set graph anomaly detection via normal structure regularisation. arXiv preprint 1.0685,, 2023. 2,
[53] Xuhong Wang, Baihong Jin, Ying Du, Ping Cui, Yingshui Tan, and Yupu Yang. One-class graph neural networks for anomaly detection in attributed networks. Neural computing and applications, 33:12073-
2021. 7, 15
[54] Yuchen Wang, Jinghui Zhang, Zhengjie Huang, Weibin Li, Shikun Feng, Ziheng Ma, Yu Sun, Dianhai Yu, Fang Dong, Jiahui Jin, al. Label information enhanced fraud detection against low homophily in graphs. In Proceedings of the ACM Web Conference 2023, pages 406-416, 2023. 2
[55] Mark Weber, Giacomo Domeniconi, Jie Chen, Daniel Karl I Weidele, Claudio Bellei, Tom Robinson, and Charles E Leiserson. Anti-money laundering in bitcoin: Experimenting with graph convolutional networks for financial forensics. arXiv preprint 190800 2019. 15
[56] Hongzuo Xu, Guansong Pang, Yijie Wang, and Yongjun Wang. Deep isolation forest for anomaly detection. IEEE Transactions on Knowledge and Data Engineering, 2023. 2, 3
[57] Yiyuan Yang, Chaoli Zhang, Tian Zhou, Qingsong Wen, and Liang Sun. Dedetector: Dual attention contrastive representation learning for time series anomaly detection. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2023. 2
[58] M Zaigham Zaheer, Arif Mahmood, M Haris Khan, Mattia Segu, Fisher Yu, and Seung-Ik, IIk Lee. Generative cooperative learning for unsupervised video anomaly detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 14744-14754, 2022. 4
[59] Houssam Zenati, Manon Romain, Chuan- Sheng Foo, Bruno Lecouat, and Vijay Chandrasekhar. Adversarially learned anomaly detection. In 2018 IEEE International conference on data mining (ICDM), pages 727-736. IEEE, 2018. 2, 4
[60] Chaoli Zhang, Tian Zhou, Qingsong Wen, and Liang Sun. Tfad: A decomposition time series anomaly detection architecture with fime-feqquenyy analysis. In Proceedings of the 31 ACM International Conference on Information & Knowledge Management, pages 2497-2507, 2022.
[61] Ge Zhang, Jia Wu, Jian Yang. Amin Beheshti, Shan Xue, Chuan Zhou, and Quan Z Sheng. Fraudre: Fraud detection dual-resistant to graph inconsistency and imbalance. In 2021 IEEE International Conference on Data Mining (ICDM), pages 867-876. IEEE, 2021. 1
[62] Ge Zhang, Zhenyu Yang, Jia Wu, Jian Yang, Shan Xue, Hao Peng, Jianlin Su, Chuan Zhou, Quan Z. Sheng, Leman Akoglu, et al. Dual-discriminative graph neural network for imbalanced graph-level anomaly detection. Advances in Neural Information Processing Systems, 35:24144- 24157, 2022.
[63] Zhijie Zhang, Wenzhong Li, Wangxiang Ding, Linming Zhang, Qingning Lu, Peng Hu, Tong Gui, and Sanglu Lu. Stad-gan: unsupervised anomaly detection on multivariate time series with self-training generative adversarial networks. ACM Transactions on Knowledge Discovery from Data, 17(5):1-18, 2023. 3
[64] Panpan Zheng, Shuhan Yuan, Xintao Wu, Jun Li, and Aidong Lu. One-class adversarial nets for fraud detection. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 33, pages 2286-1293, 2019. 2, 4
[65] Yanqiao Zhu, Yichen Xu, Feng Yu, Qiang Liu, Shu Wu, and Liang Wang. Deep graph contrastive representation learning, arXiv preprint arXiv:2006. 2.X.412006...111, 2020.
[66] Zhong Zhuang, Kai Ming Ting, Guansong Pang, and Shuaibin Song. Subgraph centralization: necessary step for graph anomaly detection. In Proceedings of the 2023 SIAM International Conference on Data Mining (SDM), pages 703-711, 1. SIAM, 2023.
14

---

A Detailed Dataset Description
The key statistics of the datasets are presented in Table 5. detailed introduction of these datasets is given as follows.
Amazon [10]: includes product reviews under the Musical Instrument category. The users with more than 80% of helpful votes were labeled as begin entities, with the users with less than 20% helpful votes treated as fraudulent entities. There are three relations including U-P-U (users reviewing at least one same product), U-S-U (users giving least same star rating within one week), and U-V-U (users with top-5% mutual review similarities). In this paper, do not distinguish this connection and regard them as the same type of edges, ie.,, all connections are used. There are 25 handcrafted features that were collected as the node features.
T-Finance [50]: is financial transaction network where the node represents anonymous account and the edge represents two accounts that have transaction records. The features of each account are related to some attributes of logging, such registration days, logging activities, and interaction frequency. etc. The users are labeled as anomalies when they fall into the categories of fraud money laundering and online gambling.
Reddit [21]: It is user-subreddit graph, capturing month's 's worth of posts shared across various subreddits at Reddit. The users who have been banned by the platform are labeled anomalies. The text of each post is transformed into the feature vector and the features of the user and subreddits are the feature summation of the post they have posted.
Elliptic [55]: It is bitcoin transaction network in which the node represents the transactions and the edge is the flow of Bitcoin currency.
Photo [35]: It is an Amazon co-purchase network in which the node represents the product and the edge represents the co-purchase relationship. The attribute of the node is bag of works representation of the user's ' comments.
DGraph [18]: It is large-scale attributed graph with millions of nodes and edges where the node represents user account in a financial company and the edge represents that the user was added to another account as an emergency contact. The feature of a node is the profile information of users, such as age, gender, and other demographic features. The users who have overdue history are labeled as anomalies.
B More Information about the Competing Methods
B.1 Competing Methods
A more detailed introduction of the six GAD models we compare with is given as follows.
DOMINANT [8] leverages the auto-encoder for graph anomaly detection. It consists of an encoder layer and decoder layer which devised to reconstruct the features and structure of the graph. The reconstruction errors from the features and the structural modules are combined as anomaly score.
AnomalyDAE [11] consists of a structure autoencoder and an attribute autoencoder to learn both node embeddings and attribute embeddings jointly in a latent space. In addition, an attention mechanism is employed in the structure encoder to capture normal structural patterns more effectively.
OCGNN [53] applies one-class SVM and GNNs, aiming at combining the recognition ability of one-class classifiers and the powerful representation of GNNs. A one-class hypersphere learning objective used to drive the training of the GNN, The sample that falls outside hypersphere is defined as anomaly.
AEGIS [7] designs a new graph neural layer to learn anomaly-aware node representations and further employ generative adversarial networks to detect anomalies among new data. The generator takes noises sampled from prior distribution as input, and attempts to generate informative pseudo anomalies. The discriminator tries to distinguish whether an input is the representation of normal node generated anomaly.
15

---

Table 5: Key statistics of the six datasets used in our experiments.
Dataset
Type
Nodes
Edges
Auributes
#Anomalies (Rate)
Amazon
Co-review
11,944
4.398,392
821(6.9%)
T-Finance
Transaction
39,357
21,222,543
1,803(4.6%)
Reddit
Social Media
10,984
168,016
64
366(3.3%)
Elliptic
Bitcoin Transaction
46,564
73.248
93
4,545 (9.8%)
Photo
Co-purchase
7,535
119,043
745
698(9 .2%)
DGraph
Financial Networks
3,700,550
73,105,508
15,509(1.3%)
GAAN [6] is based on a generative adversarial network where fake graph nodes are generated by generator. To encode the nodes, they compute the sample covariance matrix for real nodes and fake nodes, and a discriminator is trained to recognize whether two connected nodes from real fake node.
TAM [44] learns tailored node representations for local affinity-based anomaly measure by maximizing the local affinity nodes to their neighbors. TAM optimized on truncated graphs where non-homophily edges are removed iteratively. The learned representations result in significantly stronger local affinity for normal nodes than abnormal nodes. So, the local affinity of node in the learned representation space is used anomaly score.
B.2 Official Source Code.
All the competing methods except TAM are implemented by PyGOD Library [23,24). The code of TAM is taken from its authors. The links to their source codes are follows:
PyGOD: P/G0D//ttrr//ghhhhbbo/o////rrrrp
TAM: #AANkttggg/ggttaab.ooomaaaaalaaa
AEGIS: AAC00h/ttttr//ggtnnno.o/////ggga
GAAN: GAANVattppr//gttttii.oo//////ggg
DOMINANT.httss:/giiiiaei. /wt.0///w.../////...ooo//o//o///
OCGNN: Att.ah//D....ttrrsggghhhhhooooaa
C Additional Experimental Results
C.1 More Prior Information
To further verify asymmetric local affinity, we provide more affinity visualization results on other GAD datasets including Amazon, Reddit, Elliptic, and Photo, shown in Fig. 6. The results show that the normal nodes have a much stronger affinity to their neighboring normal node than the sampled abnormal nodes.
For egocentric closeness prior, feature representations of outlier nodes should be closed normal nodes that share similar local structure the outlier nodes, verify this prior by analyzing similarity between normal and abnormal nodes based on raw node attributes on the other four datasets shown in Fig. 7. The results show that the real abnormal nodes can exhibit high similarity to the normal nodes in terms local affinity in the raw attribute space. The main reason is that some abnormalities are weak the existence of adversarial camouflage that disguises abnormal nodes to have similar attributes to the local community. This the key intuition behind the second prior.
C.2 Sensitivity Analysis
This section analyzes the sensitivity of GGAD w.r.t four key hyperparameters, including the affinity margin a, hyperparameters of structural affinity loss 3 and egocentric closeness X, and number of generated outlier nodes S. The AUPRC results reported in Fig, 8. We discuss these results below.
16

---

12
17.5
Normal Outlier Abnormal
Outler Abnormal
Outller
15.0
Outller
Abnormal
12.3
Abnormal
Absact
10.0
7.3
5.0
10
2.5
Hil
0 0.650. 700, 750 800 850 900 951.00
-.20.00 0.0
0.2 0.4 0.6 0.8 1.0
0.0
0.0
0.2
044
0.6 0.8
100
0.2
Local Alficily
Local A.limily (b) Redilt
Local A Allinity
Local A fffnity
Amazon
(c) Ellipicc
Photo
Figure 6: Histogram of local affinity on more datasets
Nermal Abnermal
Normal
2.5
Nammol
Abnormal
Abnormal
2.5
Appanc
400
Densiyy
300
2.5
200-
6.0
Raw A Itributte A ffinity
Raw tributee Affiityy
Raw Atribute A Minityy
Raw uribute Afinty
(a) A Amzoon
Reddit
(c) Elliptic
(d) Photo
Figure 7: Affinity distribution based on raw node attributes
Impact of Margin a in lata- ar lata denotes the affinity difference we enforce between the normal and outlier nodes. As Fig. 8(a) shows, GGAD performs best on Amazon and Photo with increasing a while it performs stably on the other four datasets with varying a, indicating that enforcing local separability is more effective on Amazon and Photo than the other datasets, can also be observed in Table 3.
Impact of Hyperparameters 3 and X. As shown in Figs. 8(b)(c), with increasing 3 and X, our model GGAD generally performs better, indicating that stronger structural affinity or egocentric closeness constraint is generally preferred to generate outlier nodes that are more aligned with the real abnormal nodes.
The Number of Generated Outlier Nodes S. As shown in Fig. 8(d), where S indicates that we generate the outlier nodes in a quantity rate of 5% of [Vr), GGAD gains some improvement with more generated outlier nodes but maintains the same performance after a certain number of outlier nodes. This is mainly because the generated outlier nodes may not be diversified enough to resemble all types of abnormal nodes, even with much more outlier nodes. The declined performance on Amazon and Photo is mainly due the fact that the labeled normal data in these two datasets is small and is overwhelmed by increasing outlier nodes, leading to worse training of the one-class classifier. The AUROC results these four key hyperparameters are shown Fig. 9, which show similar trend as the AUPRC results.
C.3 More Results for Models Trained on Varying Number of Normal Nodes
The results of AUPRC and AUROC under different training normal sample sizes are shown in Fig. 10. and Fig. 11 respectively. The results show that increasing training samples of normal nodes can help the methods more accurately capture the normality, resulting in a consistent improvement. Among these methods, GGAD consistently outperforms the competing methods with varying numbers of training normal nodes, indicating that GGAD can make better use labeled normal nodes.
C.4 More Results for Robustness w.rtt. Anomaly Contamination
The full AUROC and AUPRC results under different anomaly contamination rates for all six real- world datasets are shown Fig. 12 and Fig. 13, respectively. The results show that the performance of all methods decreases with the increasing rate of contamination. The reconstruction- methods DOMINANT and AnomalyDAF. are the most sensitive models, followed by GAAN, TAM, and AEGIS. OCGNN is relatively stable under the contamination. Despite the declined performance for
17

---

A mazon
T-Finance
Reddit
Elliptic
Photo
Drraph
0.8
0.6
AUPRC
0.3
AUPRC
0.5
0.4
0.4
0.3
0.3
0.2
0.4
0.5
0.6
07
0.8
0.9
1.0
0.4
0.3
(a)
(b)
00
0.7
0.6
AUPRC
0.5-
AUPRC
0.5
0.4
02
0.1
04 0.5
0.6
0.7
0.8
0.9
10
0.000000 250 300.35
(d)
Figure 8: AUPRC of GGAD w.r. hyperparameters a, 8, A, S.
Amazon
T-Finance
Reddit
Elliptic
Photo
DGraph
0.95
95
0.90
RURO
0
0.75
7.70
0.65
0.5
0.4
0.5
0.6
077
0.8
0.9
1.0
0.4
0.5
0.6
0.7
0.8
0.9
1.0
8
(b)
0.95
0.85
0.80
AUROC
0.80
0.75
0.75
0.70
0.60
0.58
0.4
0.5
0.6
0.7
0.0
0.9
1.0
@
Figure 9: AUROC results w.r.t hyperparameters a, 3, A, S.
18

---

Baseline
DOMINANT
AnomalyDAE
OCGNN
AEGIS
GAAN
TAM
GGAD
0.800
0.200
0.060
0.700
0.600
AU
0.055
0.150
0.500
UUPP
0.125
0.400
R
0.100
0.045
0.300
0.075
0.040
0.200
0,050
0.035
0.100
0.025
10
15
20
25
10
15
20
25
R
R
(a) Amazon
(b) T-Finance
(c) Reddit
0.010
0.250
0.150
0.140
0.200
0.130
AUPRC
0.008
UUPR
0.120
0.150
0.110
0.100
0.006
0.100
0.090
0.005
0.050
0.080
25
R (d) Elliptic
R
(e) Photo
(f) DGraph
Figure 10: AUPRC results w.r.t different number of training normal nodes (/%% of (V). DGraph very large dataset, so significantly smaller R used have similar size of Vi the other datasets. 'Baseline' denotes the performance of the best unsupervised GAD method per dataset.
Baseline
DOMINANT
AnomalyDAE
OCGNN
AEGIS
GAAN
TAM
GGAD
0.900
AUROC
0.850
0.700
AUROC
0.600
0.800
0.600
0.580
0.500
0.560
0.400
0.540
0.700
0.650
0.300
0.520
10
20
25
15
20
25
15
20
25
R
(a) Amazon
T-Finance
(c) Reddit
0.700
0.650
0.600
0.600
AUROO
DUROO
0.560
00000500
0.500
0.550
0.540
0.520
0.400
0.500
0.300
0.450
10
155
25
460
0.1
0.2
0.3
0.4
05
R (d) Elliptic
R
R
(e) Photo
( DGraph
Figure 11: AUROC results w.r.t. different number of training normal nodes (R% of VV. DGraph very large dataset, significantly smaller R is used have similar size of V, the other datasets. BBaellnee' denotes the performance of the best unsupervised GAD method per dataset.
19

---

DOMINANT
AnomalyDAE
OCGNN AEGIS
GAAN
TAM
GGAD
0.80
30
0.08
0.70
23
0.07
0.60
00
0.50
AUPRC
SUPRA
0.05
0.40
015
0.04
0.30
10
0.20
0.02
0.10
0.01
0.00
0%
5%
10%
15%
20%
0.00
0%
5%
10%
15%
20%
0%
5%
10%
15%
20%
(a)
Amaoon
(b) T-Finance
(c) Reddit
0.25
0.30
0.010
0.008
AUPRC
0.20
AUPRC
AUPRC
0.15
0.15
0.004
0.10
0.05
0.05
0.002
0%
5%
10%
15%
20%
0.00
0%
3%
15%
20%
0.000
0%
3%
10%
15%
20%
(d) Ellittic
(e) Photo
(0 DGraph
Figure 12: AUPRC w.r.t. different anomaly contamination.
DOMINANT
AnomalyDAE
OCGNN
AEGIS
GAAN
TAM
GGAD
1.00
0.80
AUROC
AUROC
0.60
0.60
0.60
0.40
0.40
0.40
0.20
0.20
0.20
0.00
0%
59
10%
15%
20%
0%
5%
10%
15%
20%
0%
5%
10%
15%
20%
(a)
A Aazon
(b) T-FT--Faaa F-Finance
(c) Reddit
0.800
0.70
30
0.600
AUROC
0.50
0 4040
0.500
0.40
300
30
0.30
0.300
0.10
010
0.100
0.0 0.00
0%
10%
15%
20%
10%
15%
20%
0.000
0%
5%
10%
15%
20%
(d) Elliptic
(e) Photo
(l) DGraph
Figure 13: AUROC w.r.t. different anomaly contamination.
all the methods, our method GGAD still maintains the best performance under different contamination rates.
C.5 More Analysis on the Generated Outliers
We further employ the Maximum Mean Discrepancy (MMD) distance to measure the distance between the generated outliers and the real abnormal nodes (and the normal data as well) to illustrate more in-depth characteristics of the generated outlier nodes. As shown in Table. 6, it is clear that the
20

---

Table 6: Analysis of the generated outlier nodes using MMD distance.
Dataset
Metrie
Amazon
T-Finance
Elliptic
Photo
Reddit
with Abnormal Node with Normal Node
0.1980
0.0784
0.1094
0.3703 0.3880
0.3409
0.2318
0.1040
0.1304
0.3605
Table 7: Runtimes (in seconds) the six datasets on CPU.
Dataset
Method
Amazon
T-Finance
Reddit
Elliptic
Photo
DGraph
DOMINANT
1592
10721
125
1119
437
388
AnomalyDAE
1656
18560
161
8296
445
457
OCGNN
765
5717
3517
125
AEGIS
1121
15258
166
5638
417
1022
GAAN
1678
12120
94
1866
307
TAM
4516
17360
432
13200
165
GGAD (Ours)
658
9345
368
5146
106
488
distribution the generated outliers have much smaller MMD distance to the real abnormal nodes than the normal nodes, indicating the good alignment of the distribution of the generated outliers with the real abnormal nodes.
D Computational Efficiency Analysis
D.1 Time Complexity Analysis
This subsection analyzes the time complexity of GGAD. We build GCN to obtain the representation of each node, which takes (mmhh), where m is the number of non-zero elements in matrix A, is the dimension of representation, and h is the number of feature maps. The outliers the ego network of labeled normal node, which takes O(Skd)) where S is the number of generated outliers and & is the number of average neighbors for each outlier. The affinity calculation will take O(N2d) d), where is the number of nodes. The structural affinity and egocentric closeness losses take ((N) and OSSd), respectively. The MLP layer mapping the representation the anomaly score takes O(N Thus, the overall complexity of GGAD O(mdh + Skd + 2 + + Sd Nd)..
generated from
D.2 Runtime Results
The runtimes, including both training and inference time, of GGAD and six semi-supervised com- peting methods on CPU shown in Table 7. In GGAD, although calculating the local affinity of each node requires some overheads, it is still much more efficient than the reconstruction operations on both the attributes and the structure in DOMINANT and AnomalyDAE. Compared to the generative models AEGIS and GAAN, GGAD is generally more efficient on larger graph datasets like Amazon, T-Finance, and DGraph. OCGNN is model with the simplest operation, which our GGAD can also have comparable efficiency. These results demonstrate the advantage of GGAD in computational efficiency
E The Training Curves of Optimization
To further demonstrate the collaboration between these two prior-based losses, we visualize the optimization loss during the training Fig. 14, where 'ala" and 'ec" represent two priors losses and the 'total' represents the sum of these two priors and the BCE loss. From the results, we can see that the two prior losses and the total loss are continuously decreasing and converging finally, indicating that these optimizations collaborative rather than diverged.
21

---

Campare Cul STave CIMP
Conpare tna aloeet www.ein boa
Corean kos be effeer moke mokk pilaae
10-
3.7
303
3.0
0.6
09
0.4
(b) T- T-Finance
(c) Reddit
(a) Aazon
Concart strectroces tukhigg
Ibers
Itors
(d) Elliptic
(e) Photo
Figure 14: Loss curve of different modules in GGAD
F Pseudo Code of GGAD
The training algorithms of GGAD summarized in Algorithm 1 and Algorithm 2. Algorithm describes the full training process of GGAD. Algorithm 2 describes the mini-batch processing for handling very large graph datasets, i.e., DGraph. Since the number of the outlier nodes is significantly smaller than that of the normal nodes, we guarantee that each mini-batch consists of both normal and outlier nodes address the data imbalance problem. The outputs are the mini-batches of samples from the graph and corresponding structural information, which can then be used as the input of GGAD or the competing models to perform GAD on DGraph. Note that when using Algorithm 2 for the competing models, the steps that involve the generated outliers are not used if they do not have the outlier generation component.
22

---

Algorithm GGAD
Input:
Graph, 9= &V, X). N: Number of training nodes, Nu Number of unlabeled nodes, L:
Number of layers, E: Training epochs, Virain Training set, Test S: The number of the generated outlier nodes
Output: Anomaly scores of all nodes.
1: Sample the ego networks of some normal nodes upon which the outlier nodes are to be generated
V. ........, Vo,
2: Compose Virain with the outlier nodes V. and the given labeled normal node set V
3: Randomly initialize GNN (h)
(0) h22 h t
4: for epoch 1.... do
5: for each in V Vraain do
6: for = 1,
do
h = @(h 1111)) (
7:
h = ReLU (AGG((h)) (0,00) (
8:
9:
end for
10:
end for
for k= 1. do
Obtain the representations (e.g., hig) of the generated outliers using our outlier generation method using Eq. (2)
end for
14:
Compute the normal nodes' affinity r(V.) and the outlier nodes' affinity T(Vi)
Compute the structural affinity loss lata and egocentric closeness loss lor using Eq. (4) and Eq. (5) respectively.
Compute the BCE loss function lace for our one-class classifier ry(h;; Os) using Eq. (6)
17:
Compute the total loss hrotal ldce + Blata + MMec
18: Update the weight parameters θ O, and θ, by using gradient descent
19: end for
20: for each vú in Vtest do
21: Anomaly scoring by s (v:) =1-n (by;;
22: end for
23: return Anomaly scores s(v1), ,((NN.)
Algorithm 2 Mini-Batch Processing
Input: Graph, 9- (V, E, X), N: Number of nodes, l: Batch size, Number of batches, S: The number the generated outlier nodes, Dtrain:Training set Output: Mini-batches and sub-graph structure.
1: Initialize the hatch B (b1,.., b.), where b [M1,... U/] from given Varain
2: for each b in B do
3: Sample 5/2 nodes initial outliers (Nor....los] from batch b
4: Initialize a node set Vp, for batch b
5: for each in b do
6: Find the 2-hop neighborhoods Nº of v and add them into the node set V.
7: end for
8: Build sub- sub-graph structure Ep for batch b using the node set Vb
9:
end for
10: return The batch B = (b), ..., b.) and sub-graph structure [E,, .... Ez]
23

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
Our main claims are elaborated in both the abstract and introduction sections.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results
be expected to generalize other settings.
is fine to include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We discuss the limitation of our proposed GGAD in Sec. 5.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification. asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low images are taken in low lighting. Or speech-to-text system might be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question:
For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]

---

4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed reproduce the main perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided not)?
Answer[[Yes]
Justification: We provide a detailed implementation detail in the paper where the hyper- parameters like learning rate, batch size, etc. are given for reproducing our experimental results.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (c.g., in the case of large language model), releasing of a model checkpoint, other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers have some path reproducing verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: We provide the code of our proposed method and the adapted competing methods for this new setting with detailed instructions for the reproduction. The datasets are also publicly available.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (kttps://nips.ce cc/
for more details.
25

---

While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: / //nips. wttpcccpppcccccccccccccccccccccc gttpc//ggg/////eeeeeeeeiccccsse/ gewides/ooeeuuuiiiee wwweeobmissionnnooooooooioiooiie onslcccc) for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We specify all hyperparameters and types of optimizers in the implementation detail section.
Guidelines:
The answer NA means that the paper does include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [No]
Justification: Error bars are not reported because calculating them for all methods across multiple large graph datasets would be prohibitively computationally expensive.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results accompanied by enror bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
26

---

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative enror rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: We provide the information about computer resources in the implementation details. All the experiments are run on a 24-core CPU. We also analyze the runtime of our GGAD and other competing methods across different datasets in the appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the ines?
NeurIPS Code of Ethics https: / //nuurrrss... cc wtcpppplcc///e/eeeeceeecceaatttt
Answer: [Yes]
Justification:
The research conducted in the paper conforms to the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. there special consid- eration due to laws or regulations in their jurisdiction).
Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA]
Justification: There is no societal impact of the work performed.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation. generating fake profiles, surveillance), fairness considerations (e.g.. deployment of technologies that could make decisions that unfairly impact specific groups). privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
27

---

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of MI.).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
The paper poses no such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: The original owners of assets used in the paper are properly credited and the license and terms use are explicitly mentioned and properly respected.
Guidelines:
The answer NA means that the paper does
existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, possible, include a URL.
The name of the license (e.g., CC-BY 4.0) should be included for each
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license dataset.
For existing datasets that are re- e-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
28

---

Justification:
The paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
29


Reviews:
[{"review_id": "JVY0ZfV1dW", "reviewer": "Reviewer_FpxG", "summary": "The paper studies an under-explored graph anomaly detection problem where the detection models have access to a set of labeled normal nodes. To tackle this problem, it introduces a generative approach namely GGAD that generates pseudo anomaly nodes, called outlier nodes, to support the training of a discriminative one-class classifier. The key idea underlying this approach is to generate the outlier nodes in a way that can well simulate real anomaly nodes in both graph structure and feature representation perspectives. To achieve this, GGAD defines and incorporates two priors, including asymmetric local affinity and egocentric closeness, into its optimization objectives, with the former prior focusing on the alignment on the graph structure aspect and the latter on the feature representation aspect. The method is evaluated on six large real-world datasets and shows impressive detection performance compared to existing state-of-the-art methods.", "questions": "See the weakness", "limitations": "NA", "rating": 7, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "- The paper is generally well-written and easy-to-follow.\n- The problem setting is practical since labeled normal samples are easy to obtain in many real-world applications. Compared to the commonly studied unsupervised setting, this semi-supervised setting often results in better detection performance.\n- The proposed method GGAD is novel. There have been many generative anomaly detection methods, but as far as I know, they are unable to consider the graph structure and the neighboring nodes’ representations. By introducing the two new priors, GGAD addresses this issue well. Fig.1 and Fig. 3 help demonstrate this effect.\n- The method is compared with a range of unsupervised and semi-supervised methods on 6 real-world datasets with diverse genuine anomalies, and gains largely improved detection performance over these competing methods.\n- The ablation study is plausible and justifies the contribution of each proposed prior.", "weaknesses": "- The outlier node generation in GGAD may cause non-trivial computational overhead.\n- Despite better performance than the competing methods, GGAD gains an AUC of only around 0.6 on some datasets, such as DGraph and Reddit.\n- In Fig. 4 (b), GGAD shows a fast AUPRC growth with increasing training size, but the other methods have a flat performance trend. What would be the reason behind?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you very much for the constructive comments. We are grateful for the positive comments on our studied problem, technical contribution, and empirical justification. Please see our detailed response below\n\n> **Weaknesses #1**  The generation may cause non-trivial computational\n\nWe agree that GGAD may cause computational overhead due to the outlier node generation. However, the overhead is small. This is justified by the time complexity analysis and running time statistical results in Appendix D, where GGAD runs much faster than many competing methods and it is comparable efficiency to the remaining methods.\n\n> **Weaknesses #2**  Low AUC on Reddit and DGraph\n\nThank you very much for the comment. Reddit and DGraph are two challenging datasets in GAD. DGraph is a very large-scale graph that includes more than millions of nodes where the anomalies only account for 1.3 \\%.  The fully supervised methods only yield an average of 0.02/0.67 in AUPRC and AUROC on this dataset [Ref1-2]. Similarly, Photo is a user-subreddit graph network on which fully supervised methods only yield an average of 0.06/0.65  in AUPRC and AUROC  [Ref1-2].\nAlthough our GGAD achieved low AUROC/AUPRC on these two datasets, not as high as the other datasets, it still shows good improvement compared to other state-of-the-art unsupervised and semi-supervised methods. \n\n\n \n> **Weaknesses #3**  The reason behind the flat performance of other methods\n\nThe main reason is that these competing methods are trained based on their unsupervised proxy GAD tasks, so they have limited capability to increase their discriminability with increasing the number of normal nodes.\nOn the contrary, our GGAD utilizes partially labeled normal nodes and two important anomaly priors to generate outlier nodes as negative samples to train a discriminative one-classifier. As the number of normal nodes increases, the generated outliers become more diverse, closely aligning with the real abnormal nodes in the dataset, thereby resulting in better discriminability and thus better AUPRC.\n\n**References**:\n\n- [Ref1] GADBench: Revisiting and Benchmarking Supervised Graph Anomaly Detection, NIPS2023\n- [Ref2] BOND: Benchmarking Unsupervised Outlier Node Detection on Static Attributed Graphs, NIPS2022", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "oNvnPj5Plf", "reviewer": "Reviewer_yDqR", "summary": "This paper explores the problem of semi-supervised graph anomaly detection (GAD), where some nodes are known to be normal, in contrast to the typical unsupervised setting with no labeled data. The authors show that even a small percentage of labeled normal nodes can improve the performance of existing unsupervised GAD methods when adapted to the semi-supervised scenario. The paper proposes a novel Generative GAD approach (GGAD) to better exploit normal nodes by generating pseudo anomaly nodes, called 'outlier nodes', to provide effective negative samples for training a one-class classifier. GGAD generates these outlier nodes using priors about anomaly nodes, such as asymmetric local affinity and egocentric closeness, to mimic anomalies in structure and features. Experiments on six real-world GAD datasets show that GGAD outperforms state-of-the-art methods in both unsupervised and semi-supervised settings.", "questions": "1. Theoretical analysis of the proposed method, especially these two priors.\n\n2. Experimental settings including hardware and anomaly contamination.\n\n3. Analysis of the generated outlier nodes.", "limitations": "The authors have adequately addressed the limitations", "rating": 5, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "+ This paper studies a new problem of semi-supervised GAD that has not been widely studied. \n\n+ The proposed method is simple and effective from the empirical perspective.\n\n+ The experiments are extensive including effectiveness and efficiency analyses and the method has been tested on real-world large-scale graphs to verify the scalability.", "weaknesses": "- The two priors that are used to generate outlier nodes are heuristic or based on empirical evidence. There is no theoretical analysis provided to better guarantee the effectiveness of the proposed method.\n\n- It will be more interesting and helpful to show the generated outlier nodes can capture the characteristics of anomalous nodes in addition to comparing their representations.\n\n- The experimental settings of anomaly contamination are not very clear: how the contamination is introduced?\n\n- Overall experimental settings. What hardware has been used in the experiments, e.g., memory, and why are the experiments conducted on CPUs?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you very much for the constructive comments. We are grateful for the positive comments on our studied problem, technical contribution, and empirical justification. Please see our detailed response below\n\n> **Weaknesses #1**  There is no theoretical analysis to guarantee the effectiveness of the proposed method\n \nWe encapsulate two important anomaly priors to generate the outliers that are similar in the local structure and feature representation as real abnormal nodes. This provides a principled framework for generative GAD. To further verify the intuition of the priors and our proposed method, we have added empirical evidence that justifies the two priors in more real-world GAD datasets in the uploaded **pdf**. Please refer to our reply to **Global Response to Share Concern #1** in the overall author rebuttal section above for details. Overall, our method, as the first piece of work explicitly designed for the semi-supervised GAD problem, presents solid findings and interesting insights into the problem, laying a good foundation for future work on theoretical analysis and more advanced methods in this research line. \n\n\n> **Weaknesses #2** and **Q3**  More analysis on the generated outliers like shot the generated outliers can capture the characteristic of anomalous in addition to comparing their representations\n\nThank you very much for the suggestion. Please see Fig.3 in the paper and Fig. 1 in the uploaded **pdf** for the visualization based on the local structure information of the generated outlier nodes. We further employ the Maximum Mean Discrepancy (MMD) distance to measure the distance between the generated outliers and the real abnormal nodes (and the normal data as well) to illustrate more in-depth characteristics of the generated outlier nodes. As shown in Table A1 below, it is clear that the distribution of the generated outliers have much smaller MMD distance to the real abnormal nodes than the normal nodes, indicating the good alignment of the distribution of the generated outliers with the real abnormal nodes.\n\n```\nTable A1. Analysis of the generated outlier nodes using MMD distance\n```\n|**Data**|**Amazon**     |**T-Finance**   |**Elliptic** |  **Photo** |  **Reddit** |          \n|:----   |:----:         |:----:          |  :----:   |  :----:   |:----:   |\n|with Abnormal Node|  **0.1980**  |  **0.0784**  |  **0.1094**   |   **0.3703**  |   **0.3409** | \n|with Normal Node  |    0.2318    |  0.1040      |  0.1304        |  0.3880       |  0.3605      |\n\nWe will add this MMD distance-based outliers analysis into the final paper.\n\n\n> **Weaknesses #3** and **Questions #2** Clarification on the setting of contamination \n\nThanks for pointing out the issue.  When studying the semi-supervised GAD, it's important to consider that some normal nodes may be mislabeled or affected by some noise interference. To introduce a certain ratio of anomaly contamination, we randomly sample $V_l$ nodes from the real abnormal nodes set in the dataset and add them as the contaminated nodes into the training data. The rest of the abnormal nodes are used as part of the test dataset. We will add these details of the contamination setting in the final paper.\n\n>**Weaknesses #4** and  **Questions #2**  Overall experimental settings. Provide more information about the hardware and why the experiments are conducted on the CPU.\n\nThe existing baseline methods require different GPU memory and environments depending on their methodology design.  To conduct a unified comparison of operational efficiency, we chose an AMD EPYC 7443P 24-core CPU with 125G memory as the running platform. We also provided a computational efficiency analysis in Appendix D.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "25Yt6Bnugi", "reviewer": "Reviewer_JEU8", "summary": "This paper introduces a novel generative-based GAD approach, named GGAD, tailored for the semi-supervised scenario. Unlike existing GAD frameworks, the authors highlight the feasibility and importance of a semi-supervised setting where labels for normal nodes are relatively easy to obtain during training, but labeled abnormal nodes are very limited. In this context, the paper proposes generating pseudo-anomaly nodes to serve as substitutes for real anomaly nodes in training, thus aiding in anomaly detection. These pseudo-anomalies are generated through two unique loss-guidance mechanisms. Experimental results demonstrate the effectiveness of GGAD.\n\nHowever, the description of the semi-supervised setting in this paper lacks clarity and unconvincing. Additionally, there is minimal differentiation between the proposed method and existing works that generate pseudo-anomaly samples for data augmentation. I think this paper's novelty is limited. I still think that doing unsupervised GAD is more necessary, and if the authors can prove that the pseudo-outlier proposed by GGAD can benefit unsupervised GAD as a general module, I can up my score.", "questions": "1. why semi-supervised GAD is more important than unsupervised GAD, How do you overcome the labeling cost?\n2. If unsupervised GAD methods use outliers in GGAD, is it beneficial for them?\n3. why Eq.5 need Gaussian noise?\n4.In addition to the outlier generation methods mentioned on lines 376-396 (they seem overly simplistic), are there more advanced methods for generating outliers similar to GGAD? How does GGAD compare to them?", "limitations": "No limitation need to discuss", "rating": 5, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1.The complete experiment shows the effectiveness of the method and the necessity of each component.\n\n2.Some visual illustrations help the reader understand, although the shapes of the images seem to be compressed.", "weaknesses": "1. I am still confused about the motivation for performing semi-supervised GAD. Why do most methods emphasize unsupervised scenarios? The cost of labeling normal nodes seems too expensive, as the authors themselves state on lines 268 to 269, yet they assert again on line 31 that labels for normal nodes are easy to obtain.This inconsistency hinders a clear understanding of the necessity and practical applications of semi-supervised GAD, which significantly undermines the motivation for this work.\n\n2. While the first loss function proposed by the authors appears intuitively valid, the second loss function aims to generate outliers similar to normal nodes. In my opinion, optimizing these two losses together is unreasonable because they conflict with each other. It seems that they should correspond to different outlier generation processes\n\n3. The paper validates the improvement of unsupervised GAD using labeled normal nodes and claims that GGAD remains superior. I think the authors ignore the fact that unsupervised methods do not obtain this outlier like GGAD and this comparison is not reasonable.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you very much for the constructive suggestions.  We are grateful for the positive comments on our readability and empirical justification. Please see our response to your comments one by one below.\n\n\n> **Weakness in Summary** Minimal differentiation with existing generation pseudo-anomaly samples (Benefits to unsupervised GAD).\n\nOur work is the first method that leverages the priors related to graph anomalies into the outlier node generation, which enables the generation of outlier nodes considering both graph structure and feature representations of real abnormal nodes, which is not viable to any existing outlier/pseudo-anomaly generation methods (We will show how GGAD can benefit unsupervised GAD as an outlier generation module in our reply to Question #2 below).\n\n\n> **Weaknesses #1** and **Questions #1** The motivation of Semi-supervised GAD and labeling cost \n\nThank you very much for the comment. Most of the methods are based on unsupervised scenarios since it requires no labeling cost. However, they are too restricted in the real applications, because labels for a small set of normal nodes are easy to obtain. This is mainly due to the fact that the number of normal nodes typically overwhelmingly dominates the full graph. Thus, for example, one can randomly sample some nodes from the graph as the normal nodes, without any human manual labeling (the same labeling cost as unsupervised GAD). The quality of this 'random'  normal labeling is high considering the scarcity of anomalies. Even involving human checking, such a small node set does not require much effort.\n\nThe randomly labeled normal nodes may include a very small number of abnormal samples in some cases. This is also why we perform extensive experiments on such cases in Fig. 6, where the detectors are evaluated on anomaly-contaminated normal data. \n\nIn line 31, we stated that ``the normal nodes are easier to obtain due to their overwhelming presence in the graph``. We will rephrase that ``a small part of normal nodes is easier to obtain`` to avoid misunderstanding. In lines 268-269 we meant that human checking of large-scale normal nodes can be costly, contrasting to that for a small part of the normal nodes. \n\n\n\n> **Weaknesses #2**  Optimize these two losses seems to conflict and they should correspond to different outliers\n\nPlease refer to our reply to **Global Response to Share Concern #2** in the overall author Rebuttal section.\n\n\n> **Weaknesses #3** and **Questions #2**  Ignore the fact that unsupervised GAD methods do not obtain the outlier like GGAD and if GGAD can benefit existing unsupervised methods as a general module\n\nIncorporating the outlier generation into existing unsupervised methods would lead to fairer empirical comparison.  To allow the unsupervised methods to exploit the generated outliers, we first utilize GGAD to generate outlier nodes by training on randomly sampled nodes from a graph (which can be roughly treated as all normal nodes due to anomaly scarcity) and then remove possible abnormal nodes from the graph dataset by filtering out Top-K most similar nodes to the generated outlier nodes.  By removing these suspicious abnormal nodes, the unsupervised method is expected to train on the cleaner graph (i.e., with less anomaly contamination).  \nThis approach to improve unsupervised GAD methods is referred to as GGAD-enabled unsupervised GAD. We evaluate their effectiveness on three large-scale datasets.  Please refer to **global response** for the results in Table A1, where  #Anomalies/#Top-K Node in the table respectively represents the number of real abnormal nodes we successfully filter out and the number of nodes we choose to filter out (i.e., K).\n  \nFor example, we use the outlier nodes generated by GGAD to filter out 500 nodes from the Amazon dataset, of which there are 387 real abnormal nodes. This helps largely reduce the anomaly contamination rate in the graph. The results show that this approach can significantly improve the performance of three different representative unsupervised GAD methods, including DOMINATE, OCGNN, and AEGIS.\n\nNote that although the GGAD-enabled unsupervised methods achieve better performance, their performance still largely underperforms GGAD, which provides stronger evidence for the effectiveness of GGAD.\n\n> **Qestions #3** The role of Gaussian noise in Eq.5\n\nThis simple perturbation can help maintain the affinity separability while enforcing the egocentric closeness constraint. \n\n> **Questions #4** Compare with more advanced methods for generating outliers similar to GGAD\n\nApart from the outlier generation in the ablation study, we further employ two advanced generation approaches, VAE and GAN.  In VAE, we generate the outlier representations by reconstructing the raw attributes of selected nodes where our two anomaly prior-based constraints are applied to the generation. For GAN. we generate the embedding from the noise and add an adversarial function to discriminate whether the generated node is fake or real, with our two prior constraints applied in the generation as well. As shown in Tab.1 in uploaded **pdf**. These two advanced generation approaches can work well on some datasets, which indicates two priors help them learn relevant outlier representations. But both of them are still much lower than GGAD, showcasing that the outlier generation approach in GGAD can leverage the two proposed priors to generate better outlier nodes.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "rA2IjZH4UJ", "reviewer": "Reviewer_R8Ff", "summary": "The paper proposes a novel approach called GGAD aimed at improving anomaly detection in graphs under a semi-supervised framework. GGAD generates pseudo anomaly nodes that serve as negative samples for training a one-class classifier. This method is built on two\nkey priors: asymmetric local affinity and egocentric closeness, which help in generating reliable outlier nodes that mimic real anomalies in terms of both graph structure and feature representation. Extensive experimental results demonstrate the effectiveness of the method across diverse graph anomaly detection datasets.", "questions": "see weakness", "limitations": "yes, the authors point out that some anomalies whose characteristics may not be captured by the two priors used", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1.The method is innovative. The proposed graph anomaly detection method can exploit the feature and structure information of normal nodes more effectively in the studied semi-supervised scenario compared to existing methods.  The proposed two priors provide a meaningful characterization of desired properties of outliers in this semi-supervised setting and can be utilized to explore other beneficial priors further. \n\n2.The experiments in the paper are comprehensive and thorough.", "weaknesses": "1. The model relies on prior knowledge to generate anomaly points. This prior knowledge can limit the model’s application scenarios. The model performs best only when the real anomalies align with this prior knowledge. For anomaly types that do not conform to the prior knowledge, the model may not effectively detect them.\n\n2.The model does not perform best on the Photo dataset in Table 1, and the article lacks an explanation of the results at the overall data level.\n\n3. This model employs a semi-supervised approach that uses some positive samples for training. However, it does not consider the issue of noise interference within the positive samples, namely, how the model overcomes interference when some positive samples are mislabeled.\n\n4. During the initialization step, only the initial feature of outliers are obtained while the connections between the outliers and normal nodes are not well illustrated in the paper. From Figure 2, one outlier is connected to more than one normal node while the feature of the outlier is generated according to single normal node. The neighborhood of outliers is important since the it involves the computation of node affinity score of outliers.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you very much for the constructive comments. We are grateful for the positive comments on our paper clarity, research motivation, and empirical justification. Please see our response to your comments one-by-one below.\n\n> **Questions #1** The anomalies do not conform to the prior knowledge\n\nPlease also refer to the response to Review 7mdh Question #1 for detailed clarification. \n\n\n> **Questions #2** Analysis of the results of the Photo and the results at the overall data level\n\nThank you very much for the comment and suggestion. GGAD yields the best AUROC on the Photo while yielding the second-best in AUPRC, underperforming OCGNN. Having the best AUROC while less effective AUPRC indicates that GGAD can detect some anomalies very accurately in Photo, but it is less effective than OCGNN to get a bit more anomalies rank in the top of normal nodes in terms of their anomaly score. \nWe will add the above discussion into the final paper.\n\n> **Questions #3** How the model overcome mislabeled positive samples\n\nTo consider this issue, we introduce a certain ratio of anomaly contamination into the\ntraining normal node set to simulate the normal nodes that are mislabeled in our experiments.  The results of the models under different ratios of contamination in Fig. 5. and App. C.3 shows that with increasing anomaly contamination, the performance of all methods decreases. Despite the decreased performance, our method GGAD consistently maintains the best performance under different contamination rates, showing good robustness w.r.t. the contamination/noise. The main reason is that, unlike most unsupervised methods, GGAD not only learns normal patterns through normal models but also learns abnormalities by generating anomalies based on two priors, which reduces the dependency on the quality of normal data.\n\n> **Questions #4**  The connection between the outliers and the normal node is not well-illustrated \n\nIn the initialization step, we first sample some normal nodes and generate the outliers based on the representations of the neighbors of each target normal node, so the generated outlier nodes share similar neighborhood information as the target normal nodes. We will add more detailed explanations for Fig.2 in the final paper to clarify this point.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Z2QN5ZkVlh", "reviewer": "Reviewer_7mdh", "summary": "This paper works on node anomaly detection in the novel semi-supervised setting where few labeled normal nodes are given and proposes to generate new anomaly nodes to boost the training data. The anomaly generation algorithm is inspired by the empirical observation that:\n\n(1) Anomaly nodes have lower affinity score than normal nodes\n(2) Feature distribution of anomaly nodes are similar to normal nodes if they share similar neighborhood patterns.", "questions": "(1) As stated in the weakness, the core regularization loss terms are designed based on two assumptions:\n* The anomaly nodes have a lower affinity score than normal nodes. However, there is no comprehensive experimental verification of the other datasets on this. It might be better to provide the verification like Figure 1 but on more different datasets.\n* Anomaly nodes sharing similar neighborhood structures should possess similar feature distributions to their corresponding normal nodes. Although some references have been attached to justify this hypothesis, it might be better to include some empirical verification on this as well.\n\nFurthermore, there might be some contradiction between these two assumptions by themselves. First, if assumption 1 holds, it means anomaly nodes should share different local subgraphs with the normal nodes, which indicates that assumption 2 cannot hold. How do we mediate this situation?\n\n(2) Is there any difficulty when optimizing the loss according to Eq. (4) and Eq. (5) at the same time? Firstly, for Eq. (4), since the fixed terms would be embeddings of normal nodes and their neighbors, the embeddings of abnormal nodes ($\\hat{\\mathbf{h}}_i$ in Eq. (2)) would be optimized towards being further away from the neighbors' embeddings. However, Eq. (5) would also enforce the $\\hat{\\mathbf{h}}_i$ to be close to the normal one $\\mathbf{h}_i$. These two directions seem to be contradictory to each other. \n\n(3) Joint optimization according to Eq. (7) does not make sense under this generative augmentation setting. Here we use a generative model to augment the training data. This therefore should be that the training model is fixed. Moreover, if we jointly optimize the anomaly detection term and the other two generative terms, it would lead to the gradient for anomaly detection leaks to classification. This is quite confusing to me and might need more clarification.\n\n(4) How many layers of the subgraphs are used in optimizing the affinity score? If we use 2-hop neighbors, it might cause the computation to consider the significantly large number of nodes. If not, how should we decide on this parameter?\n\n(5) The comparison misses the baseline [1]\n\n[1] Liu, Kay, et al. \"Graph diffusion models for anomaly detection.\" (2024).", "limitations": "In addition to the limitations mentioned by the author, there are some other limitations worth addressing:\n\n(1) The currently proposed anomaly generation method is still operated in the embedding space. As admitted by the author anomaly behavior is heavily based on interactional behaviors, therefore, it is also helpful to consider directly characterizing/generating anomaly in the graph space.\n\n(2) The comparison misses one generative-based baseline [1]\n\n[1] Liu, Kay, et al. \"Graph diffusion models for anomaly detection.\" (2024).", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "(1) The setting is novel and aligned to the real-world situation where normal nodes are typically known compared with anomaly nodes.\n\n(2) The motivation for the proposed two regularization losses is very intuitive and clear.\n\n(3) The experimental results are very impressive.", "weaknesses": "(1) The proposed two regularization losses are heavily based on the empirical analysis, which might not transfer to other anomalies in other datasets. \n\n(2) For the second prior, its assumption that anomaly nodes sharing similar local structures would share a similar feature distribution has not been empirically verified.\n\n(3) Experiments miss the comparison with diffusion-based generative anomaly detection baseline.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you very much for the constructive comments and questions. We are grateful for the positive comments on the novelty and soundness of the experiments. Please see our detailed one-by-one responses below.\n\n> **Weaknesses #1** The regularization is heavily based on the empirical analysis, which might not transfer to other anomalies.\n\nThe graph data is non-i.i.d. data with rich structure information, and the representation of a node should be grounded in a local context. Thus, as shown in Fig.1 and Fig.2 in the uploaded **pdf**,  these two important priors about graph anomalies generally hold in all these real-world graph anomaly detection datasets. This is also one main reason why the popular graph reconstruction and graph contrastive learning methods for GAD are generally effective on various GAD datasets, since their intuitions are essentially based on similar priors as ours (though they did not explicitly summarize and propose the priors).\n\nWe agree that there can be some anomalies that may not well conform to these two priors. GGAD can work well for these cases too. This is because the outlier nodes generated by GGAD are essentially located at the fringe of the normal nodes in the representation space, as shown in Fig.3 (c). GGAD then leverages these outlier nodes to build a one-class classifier with a decision boundary tightly circled around the normal nodes. Such decision boundary can discriminate not only the anomalies well simulated by the outlier nodes but also the other anomalies that lie at the same side of the outlier nodes.\n\n> **Weaknesses #2** and **Questions #1**  More verification on more datasets and empirical verification of the second prior\n\nPlease refer to our reply to **Global Response to Share Concern #1** in the overall author Rebuttal section above for this concern.\n\n\n> **Weaknesses #3** and  **Limitations #2** and **Questions #5** The lack of diffusion model based generation\n\nThanks for pointing out the related study, but the work and other diffusion-based GAD methods as well focus on the fully supervised setting where both labeled normal and abnormal nodes are required during the training. This is different from the semi-supervised setting we proposed in our paper. We will discuss and include this work in our revision.  Additionally, we have added more ablation studies in the outlier generation module, please refer to the response to Reviewer JEU8's Question #4.\n\n\n> **Questions #2**  How do we mediate the two assumptions that might be some contradiction and is there any difficulty in optimization?\n \nPlease refer to our reply to **Global Response to Share Concern #2** in the overall author rebuttal section above for this concern.\n\n> **Questions #3**  Clarification on the joint optimization with anomaly detector\n\nDifferent from existing augmentation-based generation, since we generate the outliers in the latent space rather than the raw node attribute space, the joint optimization allows the model to impose both anomaly priors more effectively.  The total loss generally decreases and converges finally,  see Fig. 3 in the uploaded **pdf**. To further investigate the benefits of joint optimization, we compare the two-step optimization method with our joint optimization approach. The experimental results are shown in Table A1. The results show that the joint optimization significantly outperforms the two-step approach. The main reason is that many more effective outlier samples can be generated during the optimization process of the two anomaly priors. By jointly optimizing with the BCE loss function, these outliers can be fully exploited for the training of the one-class classifier, enabling a mutually enhanced outlier node generation and one-class classification process.\n\n```\nTable A1. Results of two-step training and joint training  (AUPRC/AUROC).\n```\n|**Data**|**Amazon**|**T-Finance**|**Reddit**|**Elliptic**|**Photo**| **DGraph**|\n|:----   |:----:    |:----:       |:----:     |:----:     |:----:    |:----:    |\n| Two-step   | 0.1899 /0.7322   | 0.0805/0.7022     | 0.0399/0.5233     |  0.2282/0.6873   |0.1179/0.6089      |0.0050/0.5392     |   \n| GGAD(Joint)|**0.7922/0.9443** | **0.1825/0.8228** | **0.0610/0.6354** | **0.2425/0.7290**| **0.1442/0.6476** |**0.0082/0.5943** | \n\n\n> **Questions #4** The number of layers of the subgraphs, how should we decide on this parameter\n\nWe used one layer subgraph by default as the egonet of the target node to calculate the affinity score, because anomalies are primarily reflected in the relationships among the neighbors immediately connected to themselves [Ref1-2].  We agree that incorporating 2-hop neighbors can include more community information for GAD but might cause more computational overhead. We leave it as a promising future work direction.\n\n\n\n> **Limitations #1** The generation is still operated in the embedding space, heavily based on interactional behavior.\n\nThank you very much for pointing out this.  Generation in the latent space is a simple yet effective way to support efficient generative GAD training. It can also mitigate the notorious over-smoothing representation problem in the GNN aggregation.   \n\nGenerating in the graph space is also a promising direction that offers a valuable approach for analyzing characteristics and enhancing interpretability. We will include and discuss this limitation in the final paper.\n\n**References**:\n\n- [Ref1] Addressing Heterophily in Graph Anomaly Detection: A Perspective of Graph Spectrum, WWW2023\n- [Ref2] Truncated Affinity Maximization: One-class Homophily Modeling for Graph Anomaly Detection, NIPS2023", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
Dear All Reviewers,

Thank you very much for the time and effort in reviewing our paper, and for the constructive and positive comments. Our rebuttal consists of two parts: **Global Response** where we address shared concerns from two or more reviewers and **Individual Response** where we provide a detailed one-by-one response to address your questions/concerns individually.

> ### Global Response to Shared Concern #1 More empirical evidence to verify the two priors and the second prior has not been empirically verified.


The asymmetric local node affinity prior,  ``the affinity between normal node is stronger than that between normal and abnormal nodes``, has been revealed in multiple recent studies on a range of datasets [Ref1-3]. To further verify this prior,  we provide more affinity visualization results on other GAD datasets including Amazon, Reddit, Elliptic, and Photo, as shown in Fig.1 in the uploaded **pdf**. The results show that the normal nodes have a much stronger affinity to its neighboring normal node than the abnormal nodes. 

For the egocentric closeness prior,  ``the feature representations of outlier nodes should be closed to the normal nodes that share similar local structure as the outlier nodes``, we verify this prior by analyzing the similarity between normal and abnormal nodes based on the raw node attributes on the other four datasets in Fig.2 in the uploaded **pdf**. The results show that the real abnormal nodes can exhibit high similarity to the normal nodes in terms of local affinity in the **raw attribute space**. The main reason is that some abnormalities are weak or the existence of adversarial camouflage that disguises abnormal nodes to have similar attributes to the local community. This is the key intuition behind the second prior.


> ### Global Response to Shared Concern #2 The direction of two constraints seem to be contradictory to each other.

$L_{ala}$ and $L_{ec}$ are collaborative constraints rather then conflicting ones. $L_{ala}$ is designed to make the generated outliers have asymmetric affinity separability from normal nodes from the graph structure perspective, while $L_{ec}$ is devised to pull the representation of generated outliers closed to the node representations in its egonet in the feature representation space.  If we solely apply $L_{ala}$， it may generate some trivial outliers that are far from the normal node, see Fig.3(a) in the paper.  Although these trivial outliers share some local affinity property as the abnormal,  they have adverse effects on training a compact, discriminative one-class classifier in the feature representation space. Thus, we further introduce the egocentric closeness prior-based loss $L_{ec}$.  It enables the generated nodes to be close to the distribution of normal nodes. This joint force will result in outlier representations that are at the fringe of the normal node representations while structurally separable, preventing the generation of trivial outliers that are far away from the normal nodes.  This collaborative effect can also be observed in Fig.3 (a)-(c) in the paper. To further demonstrate the collaboration between these two prior-based losses,  we visualize the optimization of loss during the training in Fig.3 in the uploaded **pdf**, where 'ala' and 'ec' represent the two priors losses and the 'total' represents the sum of these two priors and BCE loss. From the results, we can see the two prior losses and the total loss are continuously decreasing and converging finally, further indicating that these optimizations are collaborative, resulting in an effective one-class discriminator.

Note due to the space limitations,  all the visualization figures of other datasets will be provided in the final paper.

As for **Individual Response**, we have provided a detailed one-by-one response to answer/address your questions/concerns after your individual review.

We very much hope our response has clarified the confusion, and addressed the concerns. We're more than happy to take any further questions if otherwise. Please kindly advise!

**Due to the space limitation, here we put a table for addressing Review JEU8 Question #2**
```
Table A1.  Comparison with the unsupervised GAD methods that use our GGAD-generated outliers (AUPRC/AUROC).
```
|**Data**        |**Amazon**          |**T-Finance**    |**Elliptic**    |
|:----           |:----:              |:----:           |:----:           |
| #Anomalies/#Top-K Nodes   |   387/500          |  351/1000       | 1448/2000       |
|  DOMINATE       |   0.1315/0.7025        | 0.0536/0.6087       | 0.0454/0.2960   | 
|  GGAD-enabled DOMINATE|   **0.3462/0.8186**    | **0.0585/0.6275**   | **0.0613/0.2986**   | 
|  OCGNN          |   0.1352/0.7165        | 0.0392/0.4732       | 0.0616/0.2581   | 
|  GGAD-enabled OCGNN  |  **0.3950/0.8692**     | **0.0480/0.5931**   | **0.0607/0.2638**   |   
|  AEGIS          |   0.1200/0.6059        | 0.0622/0.6496       | 0.0827/0.4553   |
|  GGAD-enabled AEGIS   |   **0.3833/0.8395**    | **0.0784/0.7024**   | **0.0910/0.5036**   | 
|  GGAD           | 0.7769/0.9431          | 0.1734/0.8108       | 0.2484/0.7225   | 


**References**:

- [Ref1] Addressing Heterophily in Graph Anomaly Detection: A Perspective of Graph Spectrum, WWW2023
- [Ref2] Truncated Affinity Maximization: One-class Homophily Modeling for Graph Anomaly Detection, NIPS2023
- [Ref3] Graph anomaly detection with bi-level optimization, WWW2024

Meta-review: This paper proposes a semi-supervised graph anomaly detection method that enhances accuracy by effectively generating outlier nodes. The reviewers appreciated the well-motivated problem setting and recognized the high originality of the proposed approach, as well as the comprehensive experiments conducted. Given the positive reviews from all reviewers, I recommend acceptance.
Decision: Accept (poster)