Conditional Diffusion Anomaly Modeling on Graphs
Authors: Chunyu Wei
Haozhe Lin
Yueguo Chen
Yunhai Wang
Venue: NeurIPS 2025 poster ()
Keywords: Anomaly detection
Graph Neural Network
Primary area: deep_learning

Abstract: Graph anomaly detection (GAD) has become a critical research area, with successful applications in financial fraud and telecommunications. Traditional Graph Neural Networks (GNNs) face significant challenges: at the topology level, they suffer from over-smoothing that averages out anomalous signals; at the feature level, discriminative models struggle when fraudulent nodes obfuscate their features to evade detection. In this paper, we propose a Conditional Graph Anomaly Diffusion Model (CGADM) that addresses these issues through the iterative refinement and denoising reconstruction properties of diffusion models. Our approach incorporates a prior-guided diffusion process that injects a pre-trained conditional anomaly estimator into both forward and reverse diffusion chains, enabling more accurate anomaly detection. For computational efficiency on large-scale graphs, we introduce a prior confidence-aware mechanism that adaptively determines the number of reverse denoising steps based on prior confidence. Experimental results on benchmark datasets demonstrate that CGADM achieves state-of-the-art performance while maintaining significant computational advantages for large-scale graph applications.

Conditional Diffusion Anomaly Modeling on Graphs
Chunyu Wei', Haozhe Lin', Yueguo Chen'; Yunhai Wang' Renmin University of China, China
TTinghua University, China
veicy15@icloud com linhz@mail tsinghua..... edu cn chenyueguogruc edu. cloudseawang@gmailcco com
Abstract
Graph anomaly detection (GAD) has become a critical research area, with suc- cessful applications in financial fraud and telccommunications Traditional Graph Neural Networks (GNNs) face significant challenges: at the topology level, they suffer from over-smoothing that averages out anomalous signals; the feature level, discriminative models struggle when fraudulent nodes obfuscate their fea- tures evade detection. In this paper, we propose Conditional Graph Anomaly Diffusion Model (CGADM) that addresses these issues through the iterative refine- ment and denoising reconstruction properties of diffusion models. Our approach incorporates prior-guided diffusion process that injects a pre-trained conditional anomaly estimator into both forward and reverse diffusion chains, enabling more accurate anomaly detection. For computational efficiency on large-scale graphs, we introduce a prior confidence-aware mechanism that adaptively determines the number of reverse denoising steps based on prior confidence. Experimental results on benchmark datasets demonstrate that CGADM achieves state-of-the of-the--rt art per- formance while maintaining significant computational advantages for large-scale graph applications.
1 Introduction
Graph anomaly detection (GAD) has become a critical research area, with successful applications in financial fraud detection Huang al., 2022, Dou et al., 2020] and telecommunication fraud detection Yang et al.) 2021 Graph Neural Networks (GNNs) have gained prominence for GAD due their ability to model topological structures through message passing, which aggregates neighborhood information to generate node representations that are then classified as normal or anomalous (Kipf and Welling 2017 Hamilton et al. 2017 Velickovie et al. 2018 Xu et al. 2019).
However, discriminative models based on feature aggregation exhibit inherent shortcomings.
1. From topology perspective. vanilla GNNs suffer from over-smoothing, acting as low-pass filters that average anomalous representations, making them less distinguishable. As illustrated in the left part of Figure [ fraudulent nodes exploit this by strategically connecting with carefully selected neighbors to disguise their anomalous patterns. For instance, in money laundering trans- actions, fraudsters can distribute transactions or create numerous interactions with bot accounts to blend in with the crowd.
"Corresponding author. He works at Big Data and Responsible Artificial Intelligence for National Governance, Renmin University China "The code is available on http::/gihuub..om//vveglL/CAAC
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

p(r)) = N N[Prioo, D) Ieoreeimproe
Geaph
Edtmation
Forwardi rorees
p(y.) p(y)
yt Yo 1r
p N(O.)
Riturral
Difision Precess
Anorralyy
Falte
Yo
Random
GWN-based Denoiser
Tapete and Nlur
y
ISoure Trabo
ee Anomatyy
Yo
Yt-At
R Reverse Process
Anromalyy Disntbutioo on Graph
Anbiraly Score
Figure I: An illustration of Generative Graph Anomaly Detection.
2. From feature-level perspective, discriminative models detect anomalies by learning decision boundaries between normal and anomalous points. As fraudulent nodes evolve and obfuscate their features, they can cross these boundaries, evading detection.
Diffusion models (DMs) can address these limitations through their two key properties: iterative refinement and denoising reconstruction. Iterative refinement applies GNN-based denoisers that incorporate neighborhood information while preserving high- segg-frequency anomaly signals via residual propagation, preventing smotthnn... Meanwhile, denoising reconstruction recovers underlying anomaly patterns even when nodes disguise their features. (See Appendix R for theoretical analysis).
Applying DMs for GAD introduces two major challenges, shown in right part of Figure
Effectiveness. Traditional denoising models have primarily focused unconditional generative modeling [Song and Ermon 2019, Song et al.) 2021b Ramesh et al. 2022]. While many tasks in the image or video domain have introduced guided-diffusion models generate photo-realistic images that match the semantic meanings or content of the label, text, or corrupted images, most work in the graph domain has started generating from white noise or empty or fully connected graphs. However, for anomaly detection graphs, due to various deceptive and obfuscating tactics employed by anomalous nodes, directly recovering the underlying true distribution from a random noise distribution may not yield satisfactory results.
Efficiency. The reverse process of DMs requires numerous iterative denoising samplings Yi et al. 2023 Chen et al., 2023b). Existing graph diffusion models utilize a GNN-based encoder to update all nodes at time step during each iterative refinement to obtain the nodes at time step 1. While this approach is feasible for standard graph generation tasks, it becomes computationally prohibitive for anomaly detection tasks on extremely large graphs. Performing such iterative operations across potentially millions of nodes in the entire graph can significantly increase computational overhead, thereby affecting the practical applicability of the algorithm.
We propose a novel Conditional Graph Anomaly Diffusion Model (CGADM) for graph anomaly detection to address the aforementioned challenges synergistically. Unlike existing diffusion- based approaches that performing data augmentation to address class imbalance, CGADM directly generates anomaly judgments through joint distribution modeling, representing fundamentally new model- centric paradigm for GAD.
To tackle the effectiveness issue, propose prior-guided diffusion process, which injects pre- trained conditional anomaly estimator into both the forward and reverse diffusion chains. This approach constructs denoising diffusion probabilistic model for more accurate anomaly detection. Specifically, we introduce a lightweight model to estimate an anomaly prior for each node, serving as the endpoint for our forward noise addition process and the starting point for reverse denoising process. Based on this new probabilistic model, we redesign the probability model and optimization objective of our CGADM.
To tackle the efficiency issue, we build on the intuition that normal nodes are generally farther from the decision boundary compared to anomalous nodes that have narrowly evaded detection. Therefore,

---

in the reverse process, we introduce prior confidence-awee aware mechanism to adaptively determine the reverse time step for each node. Nodes with high confidence in their anomaly prior require fewer time steps, while those with lower confidence require more sampling time steps. This approach not only accurately estimates the anomaly probability for each node but also reduces the number of predictions in the reverse process, thereby decreasing computational time.
Through experiments on benchmarks for GAD, CGADM achieves state-of-the-ar results. Additional studies confirm the computational advantages of our framework.
2 Related Work
2.1 Graph Anomaly Detection
Graph anomaly detection (Duan et al. most other nodes. Various based methods have been proposed to address this challenge. Early approaches like FdGars [Wang et al.) 2019b] and CARE-GNN (Dou et al.] [2220] focused on
2023 aims to identify nodes that deviate significantly from
user classification and neighbor aggregation respectively. Follow-up works tackled specific issues:
FRAUDRE (Zhang et al. 2021] and PC-GNN (Liu et al. 2021b) addressed class imbalance, while
AMNet (Chai et al. 2022], BWGNN [Tang et al. 2022]. and GHRN [Gao et al. 2023b improved
feature handling through frequency- based approaches.
Recent advancements have explored novel directions: GDN [Goo al. 2023a addressed structural distribution shifts, SEC-GFD [Xu et al. (2024) handled heterophily via spectral filtering, GGAD (Qiao
and ADA-GAD [He et al., 2024 mitigated anomaly overfitting, Unlike these approaches, our CGADM introduces a generative diffusion framework that models the joint anomaly distribution over the graph, enabling holistic detection without relying on augmentation strategies Wei et al. [023b].
al.
2024) generated eseudo-anomalice
However, existing methods Wei al. 2025 2023c rely on discriminative models with feature aggregation, making them vulnerable to over-smoothing Wei et al.] [202dd] and camouflage tactics. Our approach departs from this paradigm by proposing a generative model that jointly models the anomaly distribution of each node on the graph.
2.2 Diffusion Model
Denoising diffusion probabilistic models (DDPMs) (Ho et al. 2020 Song al. 2021a simply diffusion models, are class of probabilistic generative models that transform noise into data samples, hence primarily used for generative tasks [Dhariwal and Nichol 2021 Rombach et al. 2022).
biffusion-based generative models have demonstrated strong capabilities in generating High-quality graphs (Niu al. 2020 Liu et al. 2019 Jo et al. [2222] Haefeli et al. [022]] Chen et al., 2022
Vignac et al. 2023 Kong et al. 2023]. Haefeli et al. [2022] designed a model limited to graphs without attributes and similarly observed the benefits of discrete diffusion for graph generation.
Previous graph diffusion models were based on Gaussian noise. Niu et al. [2020] generated adjacency matrices indicating the presence of edges by thresholding continuous values, while Jo et al. [2022] extended this model to handle node and edge attributes. Digress [Vignac et al., [023] was the first to propose a discrete diffusion model for graphs. Regarding the severe label imbalance problem in anomaly detection, many existing anomaly detection methods improve datasets by generating synthetic anomalies [Chen al. 2020b Ding et al., 2020), creating a more balanced environment.
We approaches from diffferntt angle, using diffusion models to model the joint distribution of anomalies on large-scale graphs for more precise and robust anomaly detection.
3 Preliminaries
Attributed Graph. An attributed graph is denoted as 9 = {V,E,X) where y= {ei, 02 .2...., UN represents the of all N nodes on graph G, and = (ceg 02 U/ E V) signifies the set of edges, indicating the existence of an edge between nodes v; and uj. For each node v; there exists d- dimensional feature vector, E Rdd The feature vectors of all nodes form the feature matrix of the graph, denoted as X = [21, ... .x)] E xx An adjacency matrix A records the relationships between nodes graph G. Each entry Aij = 1 if there exists eig E, otherwise, Aij O.
3

---

Anomaly Detection on Graph. Consider two disjoint subsets of V, namely Vo and Vn. such that Va n V, 0. Vn contains all nodes labeled as anomalous, and V, comprises all normal nodes. The goal of graph anomaly detection (GAD) is to compute anomaly probability p(y|E [ X) of the unlabeled nodes with partial node labels. Please refer Appendix [ for challenges of GAD.
Diffusion Probabilistic Model. An efficient diffusion model must satisfy three key properties: (1) The conditional distribution ( (r) should possess a closed-form equation to circumvent the recursive application of noise during training. (2) The posterior q(2 [Z 2) should also have a closed-form solution serve the neural network's 's target. (3) The limiting distribution 9 limy- q( 2 should be independent of z, enabling its use as a prior distribution for inference. These properties are all met when the noise follows a Gaussian distribution. The common steps in the diffusion model are shown in Appendix B
4 Methodology
We formulate the GAD problem task of modeling the joint conditional distribution of anomalies on the graph. This prior distribution serves as the endpoint for adding noise and the starting point for inference. CGADM gradually transforms the ground truth anomaly distribution into the prior distribution instead of the conventional Guassian distribution. By utilizing a poollogicl-ggudeed denoising network, CGADM is capable of simultaneously modeling the topological information and features nodes to iteratively recover the ground truth. To expedite the inference process, we introduce prior-aware strided sampling strategy. To enable inference over arbitrary numbers of steps, we propose a conditional hon-Markowe reverse process.
4.1 Diffuse Ground Truth to Prior
we propose to cast the graph anomaly detection problem as a generative task. We set yn as the anomaly ground truth and YI:T as the intermediate predictions generated in the forward process of the diffusion model. The objective of graph anomaly detection then becomes the maximization of the log-likelihood p(yolE, X). Consequently, Equation 2 can be restructured as the following Conditional Evidence Lower Bound (CELBO) to serve our optimization target:
In light of Section 3
l X) log f Pe(yo:T X)dy 2 Bely log Po(yorle,,
(I)
olyi:T/yo,& X)
where Pe (Yo.r E, X) is the joint distribution of the target and the predictions under the denoising model parameters 0, and g(y lyo, , E, X) the conditional distribution of forward process given the ground truth and the input data.
By substituting Equation I into Equation| 17
express our opti objective as follows:
L Eg |- log po (yoly..
X)] + Eg [DKz (g(yrlyo, X)]| p(yr|E,
(2)
Byg DKL
E, X) (o
Following the conventions of Denoising Diffusion Probabilistic Models (DDPM) (Ho al. 2020), we respectively name the first, second, and third terms of the above objective Tunction as the reconstruction term Erecon. the prior matching term Eprior, and the consistency term Lcon.
To avoid our CGADM recovering the joint anomaly distribution starting from random noise Han et al., 2022b]. we modify the endpoint of the diffusion process from the conventional Guassian distribution (O,, 7) to:
P(yr|E, X) N (gg(E, X), I),
where go X) a parameterized network pretrained on training set D to estimate the mean value of the final normal distribution. By doing so, we effectively utilize the condition E, X in the distribution p(yr E, X) to help us establish prior understanding of the joint anomaly distribution.
The prior matching term Eprior is a parameter- free term. In order to make close to zero, we need to adjust the forward process combination with the calculation of the prior (E X). Following the practice of Pandey et al. 2022 we define the noise noise-adding process at each step as follows:
e(y:ly--1.996 x)) NN V
Biy+-1
V1 (e)g X), (2,),88,8 3,1,1)
(4)

---

where NV represents the Gaussian Distribution, and B E (0, 1) regulates the noise scales added at step t. This noise-adding step allows for closed-form form sampling distribution at any arbitrary timestep i, according to the additivity of the Gaussian distribution:
(5) where 0t := - 3t and ā₂ := II aq. This sampling distribution enables Lprior to be close to zero when f = T. Intuitively, the noise-adding process defined by Equation 5 can be interpreted as an interpolation between the true data Yo and the estimated prior ge X). which exhibits a gradual transition from the true data towards the estimated prior over the course of the forward process.
Yo, & X = g(y:lyo. Is X)) = (ye: Vo.yo + (1- (1
With the above formulation, denoising network. It can be expressed as follows:
derive tractable posterior that serves as the target for
qyv--ly:. Vo. &, X)= = q No: (E, X)) = W
(6)
where j :0 7o 71 + 7296 (E, X) and Bg 1- 1,, with:
1-ā;
(1- (1-ās-1)vay
To = 1
(a 1) + vai-1)
72- 1
For detailed derivation, please refer to Appendix C
4.2 Topdledical-guided Denoising Network
According to Equation we define po E, as Ny t, for 1 S T. Following the setup DDPM, we set Eg N,,t,,,X, = of untrained time-
dependent constants and set of = Be. For the parameterization, we may select:
Be (,xx),
, Vat (y:
(8)
VI- at
where co is parameterized network predicting the forward diffusion noise sampled for anomaly scores yt-
An anomalous node is typically strongly correlated not only with its node features but also with the its local topological structure. The bias brought about by a few anomalous nodes high- frequency information in the frequency domain. Most existing GNNs act as low-pass filters and cannot effectively capture the high-frequency signals carried by anomalous nodes. Borrowing the idea from GCNII [Chen et al. 2020aa,. we adopt residual propagation mechanism that prevents the high-frequency information of nodes from being overlooked due to over-smoothing in the multi-layer graph convolution process:
)) [(v) wEN(()
h =0 (W-1
Σ b E1
h
I AGG 4. h,), (9)
where L is the number of graph convolution layers and AGG(-) can be a simple aggregation function such as summation concatenation. With this message-passing mechanism, we detine our topological-aware denoising network as cy E, X) = =0 t, H/ For more details about the denoising network, please refer Appendix H
To execute our training, we sample y: according to Equation Through the reparameterization trick, can derive:
Y: = Voryo + (1 - (or)go(E X) + ōzc.
(10)
We simplify Lrecon and Leon obtain the final loss L:
C== = c + (1- (U-Var)ooE,x))
-1- 1, 1
(11)
Where elements in t is uniformly distributed between 1 and T. The case of = 1 corresponds to Lrecon- Similar DDPM, the cases where >> correspond to an unweighted version of Leon- The whole process of training is shown in Appendix |
5

---

4.3 Inference for Anomaly Detection
For image synthesis, DMs typically draw random Gaussian noise for the reverse process, with generation guided by pre- pre- treinra classifiers or other signals. However, for graph anomaly detection, generating directly from pure noise may yield accurate results due the deceptive tactics employed by anomalous nodes.
We propose inference strategy that aligns with CGADM training, starting from prior-guided initialization Yr (gg (E, X), 7) rather than standard Gaussian noise. At each step t, we first estimate the denoised anomaly score:
Yo = Vāz
(y: - (1- vār)go(E,X) - VI
(12)
Then use this estimate to predict the intermediate state: Yr-1 705o + 71 + 724a (E, X) Biz,
where (0, I) and the coefficients "to, 71, "/2 and Ag are defined in Equation 6 This process iteratively refines the anomaly representations until we obtain the final anomaly scores yo- The complete algorithm provided in Algorithm !
Algorithm 1 Inference for Anomaly Detection
1: Initialize yr (E,
2: fo I'
do 3: Calculate reparameterized ýo according to Equation 10
ÿo Vā. (y: - (1 Vār)go - vT &,, E,x))
(13)
4:
ift then
5:
Draw No, I)
6:
Yt-1 v0yo 71ye (E, B,2,, according Equation
7:
else
8:
Set ye- ÿo
9: end if
10:
end for
11:
return y/
The key advantage of this approach that it leverages our prior knowledge of anomaly patterns to guide the generation process, making it more resistant to deceptive tactics employed by anomalous nodes compared generating directly from random noise.
4.4 Prior-aware Strided Sampling
As can be seen from Equation 11 our training actually results in a topological-aware denoising network capable of denoising the predicted prior score arbitrary time step Inspired by |Song et al. 2021a), we can use this denoising network to perform time-step skipping sampling, greatly reducing the number of sampling steps. By discarding the Markov constraint brought by Equation 4 we can obtain the conditional Mon-Markovian reverse process different from Equation 6 as follows:
yt-1 Var-vño (1 vār (E, V ā, ofcoly,,,,,,3 + arc.
(14)
where ýo the denoised score in Equation 13
For detailed derivation, please refer to Appendix D By substituting Equation 13 into Equation
4 can obtain:
(y, (1 /a,)go(E vI a,eply,,t
Y1-1
(15)
1 V 0t- -- +
This allows the use of forward process defined only on subset the latent variables ....... Yr. where Ti.... is increasing subsequence of 1, .... I with length S, where S could be much

---

smaller than T. To reduce the number of sampling steps from T to K, we use K evenly spaced real numbers between and T (inclusive), and then round each resulting number to the nearest integer, as follows: [Ti)
(T-
1=11
When our prior is more confident, fewer sampling steps, or a smaller K, are needed, and vice versa. We propose heuristic strategy to dynamically adjust the size of K according to the confidence of different prior scores of anomalies. We choose the inverse sigmoid function to simulate the decay of the ratio as the confidence (o(E, X) 0.5| increases:
K
X T
(16)
(g 0.5] -05
1 + exp
0.5
Typically, with r set to 2. our framework adjusts the sampling steps K to around 1000 for ambiguous priors near 0.5, and reduces it to about 500 for high-confidence priors close to 1. Notably, most nodes on the graph are associated with high prior confidence, which leads to a substantial decrease in computational demand. Conversely, for anomalous nodes that are adept at camouflage, the lower prior confidence necessitates a larger number of diffusion steps, facilitating their accurate detection. Our method thus strikes balance between computational efficiency and thorough identification. We show the inference process with our prior-aware strided sampling in Appendix J
Experiments
5.1 Experimental Setup
Datasets
We have extensively employed five diverse datasets from various domains to verify our
method. They are the e-finance category dataset Elliptic [Weber et 2019), crowd-sourcing category
datasets Tolokers [Platonov et al. 2023 and YelpChi [Rayana and Akoglu 2015). and Social media
datasets Question [Platonov et al., 2023] and Reddit [Kumar et al. 2019 For the detail of dataset
statistics and processing, please refer to Appendix G
Baselines We have compared our CGADM with two categories of methods in the context of graph
anomaly detection: (1) Standard GNNs, which include GCN [Kipf and Welling [0117]. GIN (Xu
ct al. 2019], GrephSAGE [Hamilton et al., 2017]. and GAT |Velickovic et al. 2018]; (2) GNNs
specifically designed for anomaly detection, such as GAS [L et 20191, PCGNN [Lu et al.
2021b), BWGNN [Tang et al. 2202]]. GHRN [Gao et al., 2023b], XGBGraph [Tang et al. 2023 and
CONSISGAD [Chen et al. [022]] (3) diffusion-based data-centric approaches for GAD: GODM [Ma
ct al.
2024a], CGenGA Liu et al. 2023]. For detailed descriptions, please refer to Appendix
Metrics Following the evaluation setup employed by most anomaly detection works (Han et al. 2022a), we have chosen the Area Under the Receiver Operating Characteristic Curve (AUROC) and the Area Under the Precision-Recall Curve (AUPRC) as our metrics for graph anomaly detection. Both of these metrics range between 0 and 1, and we record them as percentages for convenience. For both metries, a higher value indicates better performance.
Implementation Details For CGADM, the layer number of graph convolution is set to three, a value considered reasonable by most works [Liu et al., 202Tb). For our diffusion process, the noise levels at the initial and final time steps. 31 and Br, are set to le-4 and 0.02, respectively. Additionally, we employ linear interpolation to divide the time steps between them, which is consistent with DDPM [Ho et al. 2020 For other implementation details, please refer to Appendix K
5.2 Overall Comparison
We summarize the performance of all algorithms in terms of AUROC and AUPRC across different datasets in Table [ We put more results of F1-score in Appendix N and results on additional datasets in Appendix A and The results demonstrate that our CGADM outperforms most other baselines across all metrics. We conduct two-sample t-tests, and value < 0.05 indicates that the improvements are statistically significant. In addition to these findings, we make the following observations:
7

---

Table 1: Performance Comparison on Graph Anomaly Detection
Filip
Tolo
Yelp
Quesi
Rockit
Average
Model
AUPRC
AUROC
AUPRC
AUROC
AUPRC
AUROC
AUPRC
AUROC
AUPRC
AUROC
AUPRC
AUROC
GCN
80.19
95.
41.44
73.58
23.59
59.89 89
10:27
67.73
5,65
62.55
32.23
71.27
GIN
83.88
96.21
37,89
74,02
38.13
77.40
11.23
68.97
5.38
65.25
35.30
76.19
Graphsage
86.16
96.61
43.73
77.30
50.23
83.24
13.86
70.64
5.78
63.67
39.95
78.29
GAT
87.59
97:11
42.18
76.66
81.95
5.42
39:00
77.29
GAS
$7.51
97.14
42.39
74.55
39.18
78.63
12.41
66.09
5.66
61.23
37.14
75.53
POGNN
67.29
93.88
36.76
71.28
45.32
79.61
13.79
69.12
4.13
54,58
33.46
73,69
BWGNN
77.80
77.45
CHRN
88.13
97.04
45.25
77.98
19.78
36
14.61
69.32
5.85
63.51
10.72
78.04
XGBGraph
90:47
94.3 94.35
44.47
77.28
75.91
91 85
14.33
64.90
4..99
60.58
45.95
77.79
CONSISGAD
$6.42
96.38
40.59
76.03
41,74
79.35
12.85
70.54
5.57
66,99
37.45
77.86
GODM
81.89
93.99 93.92
46.15
51.77
84.33
86
5.55
77.13
CGenGA
87.36
96.07
44,89
78.95
52.76
85.65
15 34
68.46
5.78
64.78
41.23
78.78
COADM
97.03
99.34
46,02
79,68
76,54
92.69
18.51
69.41
5.79
65.85
48,78
81.39
Bubiitac desskes laghos sore, undeetta indiass bestrovak baciiaes.
In terms of average performance, CGADM achieves 48.78% AUPRC and 81.39% AUROC, representing significant improvements 6. 6.15% in AUPRC and 4.53% in AUROC over the best baseline (XGBGraph for AUPRC and CONSISGAD for AUROC).
GAD methods represent state-of-the-art methods. This indicates that GAD, with its unique challenges of data imbalance, data heterogeneity, and deliberate node obfuscation, cannot be adequately addressed by general GNNs and requires specialized design.
No single baseline method consistently outperforms on all datasets. We believe this is because these discriminative models identify anomalous nodes through decision boundaries. Many anomalous nodes manage to cross these boundaries by obfuscating their features, making it difficult for these methods to adapt to various scenarios. In contrast, our CGADM consider the joint distribution of anomaly in a generative way, making it difficult for anomalous nodes to obfuscate.
Diffusion biffusion-based approaches (GODM, CGenGA) that use data augmentation show competitive performance, but CGADM consistently outperforms them by directly modeling the joint anomaly distribution rather than relying on data augmentation techniques.
Among standard GNN methods, GraphSage and GAT perform better than the other two methods, especially on the YelpChi dataset, which has significantly more edges. This aligns with our analysis in the introduction, where GNN, as low-pass filter, blurs the distinctive features of anomalies in its inherent feature aggregation mechanism, a problem that worsens with an increased number of edges. GraphSage and GAT to some extent mitigate the over-smoothing issue by sampling neighbors or amplifying the weight of important neighbors, respectively.
5.3 Comparison with Different Prior Model
In generating the final anomaly value with CGADM, to ensure effectiveness, do not start the reverse process from a random state. Instead, we opt for a conditional anomaly estimator to guide the reverse process of the model. For efficiency, as the estimator. Here, we explore both Random Forest (RF) and Extreme Gradient Boosting Tree (XGBT) as estimator. We denote CGADM using RF and XGBT conditional anomaly estimators as CGADM and CGADM respectively. Figure records the performance of these models on the Elliptic and YelpChi datasets. Two observations can be made from figure 2 Firstly, both CGADM and CGADMXGGR XGBT outperform their corresponding initial priors. This proves that our CGADM's 's diffusion process can significantly enhance the performance of GAD. Secondly, the performance gap between CGADM RF and CGADMxGET is significantly smaller than that between RF and XGBT. This indicates that our CGADM possesses strong robustness. Even in the face of initially inaccurate prior estimates, our CGADM can effectively correct the results under the iterative refinement of the topological-guien guided denoising network.
employ a lightweight ensemble trees model
5.4 Parameter Sensitivity
Impact of Graph Convolution Layer L In order to better capture the topological information sur- rounding nodes for joint distribution modeling, we employ a GNN-based encoder our topological- guided denoising network. We explored the impact of the number of graph convolution layers on the
8

---

Elliptic
(1) Performance w.r. on Elliptic
(2) Performance w.r.t YelpChi
NCBT
125.0
13000
AIPRE
MIPRE
AUMOC
AUMOC
AUPIC 0%)
AUPRC (%)
25.5
91.23
AUROO
AUPRC
AUROC
00.0
09.00
74
-4
Metric
92.00
YelpChi
Graph Convolution Layer
Graph Convolution Layer
(3) Performance w.r.t Br on Tolokers
(1) Performance w.r.t Br Questions
MCBT COA
AIPA
APPRE
AUTOC
AUTOC
AUPRC (%3
55.0
AUROC
AUPRC
47.5
AUROO
715
23
14
14
72
15-
Metric
35.0
0.003
50.0
Final
Final Noise
Figure 2: Performance
w.r.t. Different Prior
Figure 3: Parameter Sensitivity on Different Datasets
Models
Elliptic and YelpChi datasets. The results shown in Figures and (2). From the results, observe a slowly gradual improvement in performance as the number of layers increases, reaching farther topological structure information. Even at depth of five layers, there no performance degradation. This suggests that our CGADM can effectively overcome the over-smoothing problem commonly encountered in traditional discriminative methods based GNNs. We attribute this mainly to two factors. First, the paradigm shift to generating the joint distribution of anomaly on the graph allows considering the influence of surrounding neighbor nodes. Second, our residual propagation mechanism prevents the high-frequency information of nodes, thereby retaining more valuable information for anomaly value generation.
Impact of the Final Noise Scale 3r We modify the endpoint of CGADM's diffusion process from the conventional Gaussian distribution N(O, I) to (E, X), I). Intuitively, By represents the maximum degree to which our noise-added y: can deviate from the ground truth. also represents the maximum scale which our denoising network can correct the prior. We studied the magnitude of this degree on the Tolokers and Questions datasets, with the results shown in Figure (3) and (4). We can observe that as the maximum correction scale increases, the performance initially improves. This suggests that the bias of the prior can be better corrected at this point. However, when the correction scale exceeds 0.02, the performance begins to decline as the maximum correction scale continues to increase. This may because the maximum correction scale has already surpassed the maximum bias produced by the prior. Overcorrection of the prior could prevent CGADM from modeling the true distribution. Therefore, we recommend using 8n = 0.02 in our cases,
5.5 Efficiency Analysis
In Section 4.4 we designed prior-aware strided sampling strategy to adaptively reduce the reverse steps needed to generate anomaly values. To verify its efficiency, we designed the following two ablation experiments. model performance of our CGADM with different sampling steps during generation. The results are shown in Figure 4 As can be seen, as our striding magnitude increases, i.e., the reverse steps of sampling become fewer, both computation time and model performance decrease. However, the decline computation time much greater than the decline graph anomaly detection performance. Even when the striding is not large the beginning. the decline in performance is not significant.
the first experiment, we tested the computation time and corresponding

---

Time Cast and Performance YelsChi
CGADM
CGADMs
Computation Tim
(1M)
AUROC (86)
Average
1000
583.0256
Reverse Step
AUPRC (%) AUROC (%)
76.5424 92.6930
73.6636
14
91.9423
22
Table 2: Performance Metrics
269
306 Sampling Step
20
330
Figure 4: Time cost and Accuracy w.r.t. Sampling Steps K
This implies that sacrificing a little performance can result in substantial savings in computation time. Therefore, we designed another ablation experiment. Here, we denote CGADM configured with prior-aware strided sampling as CGADM, and present its model performance and average reverse steps during inference Table Compared to the original 1000 sampling steps, our method reduces the average sampling steps for all nodes to 583, while ensuring only slight drop in model performance, which remains highly competitive.
6 Conclusions and Limitation
Existing GNN-based graph anomaly detection methods are vulnerable to fraudulent nodes due to their feature aggregation and discriminative nature. To address this, we propose the Conditional Graph Anomaly Diffusion Model (CGADM), which considers node anomalies holistically across the graph, generating a distribution of anomaly values. We introduce a prior-guides diffusion process with pre-trained conditional anomaly estimator to constrain the diffusion. Additionally, we implement& a confidence-aware mechanism adaptively determine reverse time steps, improving computational efficiency. Experimental results on standard benchmarks demonstrate that CGADM achieves state-of-the-ard performance.
While CGADM shows strong performance, a few limitations remain. First, the model's reliance on pre-trained anomaly priors may require adaptation for applications with dynamic graph structures. Second, the current approach assumes supervised setting, while real-world applications often require adaptation to unsupervised scenarios. These issues areas for future improvement.
Acknowledgments and Disclosure of Funding
This research was supported by the National Key R&D Program of China (No. 2023YFC33047011 NSFC 62000220072448 and No. No.UU4420233), the Shandong Provincial Natural Science Foundation (N..2Q202JJQ32), the Beijing Natural Science Foundation (L244707), the Fundamental Research Funds for the Central Universities, and the Research Funds of Renmin University of China. was also supported by Big Data and Responsible Artificial Intelligence for National Governance, Renmin University of China.
References
M. M. Breunig, H. Kriegel, R. T. Ng, and J. Sander. LOF: identifying density-based local outliers. In Chen, J. Naughton, and P. A. Bernstein, editors, Proceedings of the 2000 ACM SIGMOD International Conference Management of Data, May 16-18, 2000, Dallas, Texas, USA, pages 93-104. ACM, 2000.
Chai, S. You, Y. Yang, Pu, Xu, H. Cai, and W. Jiang Can abnormality detected by graph neural networks? In L. D. Raedt, editor, Proceedings of the Thirty-First International
10

---

Joint Conference on Artificial Intelligence, IJCAI 2022, Vienna, Austria, 23-29 July 2022, pages 1945-1951 org, 2022.
B. Chen, J. Zhang, X. Zhang, Y. Dong, J. Song. Zhang, K. Xu, E. Kharlamov. and J. Tang. GCCAD: graph contrastive coding for anomaly detection. IEEE Trans. Knowl. Data Eng., 35(8):8037-8051, 2023a.
M. Chen, Z. Wei, Z. Huang, B. Ding, and Y. Li. Simple and deep graph convolutional networks. In Proceedings of the 37th International Conference on Machine Learning, ICML 2020, 13-18 July 2020, Virtual Event, volume 119 of Proceedings of Machine Learning Research, pages 1725-1735. PMLR, 2020a.
N. Chen, Z. Liu, B. Hooi, B. He, R. Fathony, J. Hu, and J. Chen. Consistency training with learnable data augmentation for graph anomaly detection with limited supervision. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. OpenReview.net, 2024.
T. Chen and C. Guestrin. Xgboost: A scalable boosting system. In B. Krishnapuram, M. Shah, A. J. Smola, C. C. Aggarwal, D. Shen, and R. Rastogi, editors, Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, San Francisco, CA. USA, August 13-17, 2016, pages 785-794, ACM, 2016.
X. Chen, Y. Li, A. Zhang, and L. Liu. Nvdiff: Graph generation through the diffusion of node vectors. CoRR, abs/2211.10792) 2022.
X. Chen, J. He. X. Han, and L. Liu. Efficient and degree-guided guided graph generation via discrete diffusion modeling. A. Krause, E. Brunskill, K. Cho, B. Engelhardt, S. Sabato, and J. Scarlett, editors, International Conference on Machine Learning, ICML. 2023, 23-29 July 2023, Honolulu, Hawaii, USA, volume 202 of Proceedings of Machine Learning Research, pages PMLR, 2023b.
Z. Chen, B. Liu, M. Wang, P. Dai, J. Lv, and L. Bo. Generative adversarial attributed network anomaly detection. In M. d' d'Aquin, S. Dietze, C. Hauff, E. Curry, and P. Madré-Mauroux, editors, CIKM 20: The 29th ACM International Conference Information and Knowledge Management, Virtual Event, Ireland, October 19-23, 2020, pages 1989-1992. ACM, 2020b.
P. Dhariwal and A. Q. Nichol. Diffusion models beat gans on image synthesis. In M. Ranzato, A. Beygelzimer, Y. N. Dauphin, P. Liang, and J. W. Vaughan, editors, Advances in Neural Information Processing Systems 34: Annual Conference on Neural Information Processing Systems 2021, NeurlPS 2021, December 6-14, 2021, virtual, pages 8780-8794, 2021.
K. Ding, J. Li, N. Agarwal, and H. Liu. Inductive anomaly detection on attributed networks. In C. Bessicre, editor, Proceedings of the Twenty-Nimth International Joint Conference on Artificial Intelligence, IJCAI 2020, pages 1288-1294 ijeai.org, 2020.
Y. Dou, Z. Liu, L. Sun, Y. Deng, H. Peng, and P. S. Yu. Enhancing graph neural network-based fraud detectors against camouflaged fraudsters. M. d' Aquin, Dietze, C. Hauff, E. Curry, and P. Cudré- editors, CIKM '20: The 29th ACM International Conference on Information and Knowledge Management, Virtual Event, Ireland, October 19-23, 2020, pages 315-324. ACM, 2020.
J. Duan, S. Wang, P. Zhang, E. Zhu, J. Hu, H. Jin, Y. Liu, and Z. Dong. Graph anomaly detection via multi-scale contrastive learning networks with augmented view. In B. Williams, Y. Chen, and J. Neville, editors, Phirty-Sevent Thirty-Fifit Conference on Innovative Applications of Artificial Intelligence, IAAI 2023, Thirteenth Symposium Educational Advances in Artificial Intelligence, EAAI 2023, Washington, DC, USA, February 14, 2023, pages 7459-7467. AAAI Press, 2023.
AAAI Conference on Artificial Intelligence, AAAI 2023,
M. Fey and J. E. Lenssen. Fast graph representation learning with pytorch geometric. CoRR, abs/ Abs//199302428,, 2019.
11

---

Y. Gao, X. Wang, X. He, Z. Liu, H. Feng, and Y. Zhang. Alleviating structural distribution shift in graph anomaly detection. In T. Chua, H. W. Lauw, L. Si, E. Terzi, and P. Tsaparas, editors, Proceedings of the Sixteenth ACM International Conference on Web Search and Data Mining, WSDM 2023, Singapore, 27 February 2023 3 March 2023, pages 357-365. ACM, 2023a.
Y. Gao, X. Wang, X. He, Z. Liu, H. Feng, and Y. Zhang. Addressing heterophily in graph anomaly detection: A perspective of graph spectrum. In Y. Ding, Tang. J. F. Sequeda, L. Aroyo, C. Castillo, and G. Houben, editors, Proceedings of the ACM Web Conference 2023, WWW 2023, Austin, TX, USA, 30 April 2023 May 2023. pages 1528-1538. ACM, 2023b.
A. Garas, F. Schweitzer, and S. Havlin. A k-shell decomposition method for weighted networks. CoRR, abs/1 200.3720, 2012.
K. K. Haefeli, K. Martinkus, Perraudin, and R. Wattenhofer. Diffusion models for graphs benefit from discrete state spaces. CoRR, abs/2210.01549, 2022.
W. L. Hamilton, Z. Ying, and Leskovec. Inductive representation learning on large graphs In I. Guyon, U. von Luxburg, S. Bengio, H. M. Wallach, R. Fergus, S. V. N. Vishwanathan, and R. Garnett, editors, Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017, December 4-9, 2017, Long Beach, CA, USA, pages 1024-1034, 2017.
S. Han, X. Hu, H. Huang, M. Jiang, and Y. Zhao. Adbench: Anomaly detection benchmark. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, editors, Advances in Neural Information Processing Systems 35: Annual Conference on Neural Information Processing Systems 2022, NeurIPS 2022, New Orleans, LA, USA, November 28- December 9, 2022, 2022a.
X. Han, H. Zheng, and M. Zhou. CARD: classification and regression diffusion models. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, editors, Advances in Neural Information Processing Systems 35: Annual Conference on Neural Information Processing Systems 2022, NeurlPS 2022, New Orleans, LA, USA, November 28- December 9, 2022, 2022b.
He, Q. Xu, Y. Jiang, Z. Wang, and Q. Huang. ADA-GAD: anomaly-denoised autoencoders for graph anomaly detection. In J. Wooldridge. J. G. Dy, and S. Natarajan, editors, Thirty-Eighth AAAI Conference on Artificial Intelligence, AAAI 2024, Thirty-Sixth Conference on Innovative Applications of Artificial Intelligence, IAAI 2024, Fourteenth Symposium on Educational Advances in Artificial Intelligence EAAI 2014, February 20-27, 2024, Vancouver, Canada, pages 8481-8489. AAAI Press, 2024.
M. He, Z. Wei, Z. Huang, and H. Xu. Bernnet: Learning arbitrary graph spectral filters via bernstein approximation. In M. Ranzato, A. Beygelzimer, N. Dauphin, P. Liang, and J. W. Vaughan, editors, Advances Neural Information Processing Systems 34: Annual Conference on Neural Information Processing Systems 2021, NeurIPS 2021, December 6-14, 2021, virtual, pages 14239-14251, 2021.
Z. He, X. Xu, and S. Deng. Discovering cluster-based local outliers. Pattern Recognit. Lett., 24 (9- 9-10):1641-1650 2003.
J. Ho, A. Jain, and P. Abbeel. Denoising diffusion probabilistic models. In H. Larochelle, M. Ranzato, R. Hadsell, M. Balcan, and H. Lin, editors, Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurlPS 2020, December 6-12, 2020, virtual, 2020.
X. Huang, Y. Yang, Y. Wang, C. Wang, Z. Zhang, Xu, L. Chen, and M. Vazirgiannis. Dgraph: A large-scale financial dataset for graph anomaly detection. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, editors, Advances in Neural Information Processing Systems 35: Annual Conference Neural Information Processing Systems 2022, NeurIPS 2022, New Orleans, LA, USA, November 28- December 9, 2022, 2022.
Z. Jia, Y. Fan, C. Wei, and R. Yan. A spatial-temport hypergraph based method for service recommendation in the mobile internet of things-enabled service platform. Ady. Eng. Informatics, 57:102038, 2023a.
12

---

Z. Jia, Y. Fan, J. Zhang, C. Wei, R. Yan, and X. Wu. Improving next location recommendation services with apatial-tempone multi-group contrastive learning. IEEE Trans. Serv. Comput. 16(5): 3467-3478, 2023b.
J. Jo, S. Lee, and S. J. Hwang. Score-based generative modeling of graphs via the system of stochastic differential equations. In K. Chaudhuri, S. Jegelka, L. Song, C. Szepesvári, G. Niu, and S. Sabato, editors, International Conference on Machine Learning, ICML 2022. 17-23 July 2022, Baltimore, Maryland, USA, volume 162 of Proceedings of Machine Learning Research, pages 10362-10383. PMLR, 2022.
T. N. Kipf and M. Welling. Semi-supervised classification with graph convolutional networks. In 5th International Conference on Learning Representations, ICI.R 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings. OpenReview.net,22 2017.
I.. Kong, J. Cui, H. Sun, Y. Zhuang, B. A. Prakash, and C. Zhang. Autoregressive diffusion model for graph generation. In A. Krause, E. Brunskill, K. Cho, B. Engelhardt, S. Sabato, and J. Scarlett, editors. International Conference on Machine Learning, ICML 2023, 23-29 July 2023, Honolulu, Hawaii, USA, volume 202 of Proceedings of Machine Learning Research, pages 17391-17408. PMLR, 2023.
S. Kumar, X. Zhang, and Leskovec. Predicting dynamic embedding trajectory in temporal interaction networks. In A. Teredesai, V. Kumar, Li, R. Rosales, E. Terzi, and G. Karypis, editors, Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, KDD 2019, Anchorage, AK, USA, August 4-8, 2019, pages 1269-1278. ACM, 2019.
A. Li. Z. Qin, R. Liu, Y. Yang, and D. Li. Spam review detection with graph convolutional networks. In W. Zhu, D. Tao, X. Cheng, Cui, E. A. Rundensteiner, D. Carmel, Q. He, and X. Yu, editors, Proceedings of the 28th ACM International Conference on Information and Knowledge Management, CIKM 2019, Beijing, China, November 3-7, 2019, pages 2703-2711, ACM, 2019.
X. Li, C. Xiao, Z. Feng, S. Pang, W. Tai, and F. Zhou. Controlled graph neural networks with denoising diffusion for anomaly detection. Expert Syst. Appl., 23r B):121533, 2024.
C. Liu, L. Sun, X. Ao, J. Feng, Q. He, and H. Yang. Intention-aware heterogeneous graph attention networks for fraud transactions detection. In F. Zhu, B. C. Ooi, and C. Miao, editors, KDD '21: The 27th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Virtual Event, Singapore, August 14-18, 2021, pages 1280-3288 ACM, 2021a.
J. Liu, A. Kumar, J. Ba, Kiros, and K. Swersky. Graph normalizing flows. In H. M. Wallach, H. Larochelle, A. Beygelzimer, F. d' d'Alché-Buc, E. B. Fox, and R. Garnett, editors, Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurlPS 2019, December 8-14, 2019, Vancouver, BC, Canuda, pages 13556-13566. 2019.
K. Liu, H. Zhang, Z. Hu, F. Wang, and P. S. Yu. Data augmentation for supervised graph outlier detection with latent diffusion models. CoRR, abs/23 17679, 2023.
K. Liu, H. L. Yu, Y. Yan, Z. Hu, P. Rajak, A. Weerasinghe, O. Boz, D. Chakrabarti, and F. Wang. Graph diffusion models for anomaly detection. In WSDM 2024, 2024. URL http::tttt///// amazon. scis wcwenceeeppiiiceeece httpee//plllciccccc wtt.iiiaatn/oggghheeoooeeee http:////ppolittt.oooooaa/aa/aaa http://grrap--afffsooooooooooe www.oooomooolll-ee -otaaaa----oooooooalaaeeeetttton
Y. Liu, X. Ao, Z. Qin, J. Chi, J. Feng, H. Yang, and Q. He. Pick and choose: A gnn-based imbalanced learning approach for fraud detection. In J. Leskovec, M. Grobelnik, M. Najork, J. Tang, and L. Zia, editors, WWW 21: The Web Conference 2021, Virtual Event/ / Ljubljana, Slovenia, April 19-23, 2021, pages 3168-3177 ACM/ IW3C2, 2021b.
Z. Liu, Y. Dou, P. S. Yu, Y. Deng, and H. Peng. Alleviating the inconsistency problem of applying graph neural network to fraud detection. In X. Huang, Y. Chang, X. Cheng, J. Kamps, Murdock, J. Wen, and Y. Liu, editors, Proceedings of the 43rd International ACM SIGIR conference on research and development in Information Retrieval, SIGIR 2020, Virtual Event, China, July 25-30. 2020, pages 1569-1572. ACM, 2020.
13

---

L. Lü, T. Zhou, Q.- Zhang, and H. E. Stanley. The h-index of network node and its relation to degree and coreness. Nature communications, 7(1):10168, 2016.
X. Ma. R. Li, F. Liu, K. Ding, J. Yang, and J. Wu. Graph anomaly detection with few labels: A data-centric approach. In R. Baeza-Yatte and F. Bonchi, editors, Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, KDD 2024, Barcelona, Spain, August 25-29, 2024, pages 2153-2164 ACM, 2024a.
X. Ma. R. Li. F. Liu, K. Ding, J. Yang. and J. Wu. New recipes for graph anomaly detection: Forward diffusion dynamics and graph generation, 2024b.
A. Mahmoody, C. E. Tsourakakis, and E. Upfal. Scalable betweenness centrality maximization via sampling. In B. Krishnapuram, M. Shah, J. Smola, C. C. Aggarwal, D. Shen, and R. Rastogi, editors, Proceedings of the 22nd ACM SIGKDD International Conference Knowledge Discovery and Data Mining, San Francisco, CA, USA, August 13-17, 2016, pages 1765-1773, ACM, 2016.
C. Niu, Y. Song, J. Song, S. Zhao, A. Grover, and S. Ermon. Permutation invariant graph generation via basore generative modeling. In S. Chiappa and R. Calandra, editors, The 23rd International Conference on Artificial Intelligence and Staristics, AISTATS 2020, 26-28 August 2020, Online [Palermo, Sicily, Italy], volume 108 of Proceedings of Machine Learning Research, pages 4474- 4484. PMLR, 2020.
K. Pandey, A. Mukherjee, P. Rai, and A. Kumar. Diffusevae: Efficient, controllable and high- fidelity generation from low-dimensional latents. Trans. Mach. Learn. Res., 2022, 2022.
S. Pang, C. Xiao, W. Tai, Z. Cheng, and F. Zhou. Graph anomaly detection with diffusion model-basee graph enhancement (student abstract). In M. J. Wooldridge, J. G. Dy, and S. Natarajan, editors, Tiitty-Eighth AAAI Conference Artificial Intelligence, AAAI 2024, Thirty-Sixth Conference on Innovative Applications of Artificial Intelligence, IAAI 2024, Fourteenth Symposium on Educational Advances in Artificial Intelligence, EAAI 2014, February 20-27, 2024, Vancouver, Canada, pages 23610-23612. AAAI Press, 2024.
A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, A. Desmaison, A. Köpf, E. Z. Yang, Z. Vito, M. Raison, A. Tejani, S. Chilamkurthy, B. Steiner, L. Fang, J. Bai, and S. Chintala. Pytorch: An imperative style, high-performance deep learning library. In H. M. Wallach, H. Larochelle, A. Beygelzimer, F. d' d'Alché-Buc, E. B. Fox, and R. Garnett, editors, Advances in Neural Information Processing Systems 32: Annual Conference Neural Information Processing Systems 2019, NeurlPS 2019, December 8-14, 2019, Vancouver, BC, Canada, pages 8024-8035, 2019.
F. Pedregosa, G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel, M. Blondel, P. Pretten- hofer, R. Weiss, V. Dubourg, J. VanderPlas, A. Passos, D. Cournapeau, M. Brucher, M. Perrot, and E. Duchesnay, Scikit-learn: Machine learning in python. J. Mach. Learn. Res., 12:2825-2830, 2011.
O. Platonov, D. Kuznedelev, M. Diskin, A. Babenko, and L. Prokhorenkova. A critical look at the evaluation of gnns under heterophily: Are we really making progress? In The Eleventh International Conference Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023. OpenReview.net, 2023.
H. Qiao, Q Wen, X. Li, E. Lim, and G. Pang. Generative semi-supervised graph anomaly detection. CoRR, abs/2402. 1887, 2024.
A. Ramesh, P. Dhariwal, A. Nichol, C. Chu, and M. Chen. Hierarchical text-conditional image generation with CLIP latents. CoRR, abs/2204.06125 2022.
S. Rayana and L. Akoglu. Collective opinion spam detection: Bridging review networks and metadata. In L. Cao, C. Zhang, T. Joachims, G. I. Webb, D. D. Margineantu, and G. Williams, editors, Proceedings of the 21th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Sydney, NSW, Australia, August 10-13, 2015, pages 985-994. ACM, 2015.
14

---

M. Richardson and P. M. Domingos. The intelligent surfer: Probabilistic combination of link and content information in pagerank. In G. Dietterich, Becker, and Z. Ghahramani, editors, Advances in Neural Information Processing Systems 14 [Neural Information Processing Systems: Natural and Synthetic, NIPS 2001, December 3-8, 2001, Vancouver, British Columbia, Canada], pages 1441-1448. MIT Press, 2001.
R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer. High-resolution image synthesis with latent diffusion models. In IEEE/CVE Conference on Computer Vision and Pattern Recognition, CVPR 2022, New Orleans, LA, USA, June 18- 24, 2022, pages 10674-10685. IEEE, 2022.
J. Song, C. Meng, and S. Ermon. Denoising diffusion implicit models. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021a.
Y. Song and S. Ermon. Generative modeling by estimating gradients of the data distribution. In H. M. Wallach, H. Larochelle, A. Beygelzimer, d' A'Ach-Buue E. B. Fox, and R. Garnett, editors, Advances in Neural Information Processing Systems 32: Annual Conference Neural Information Processing Systems 2019, NeurlPS 2019, December 8-14, 2019, Vancouver, BC, Canada, pages 11895-11907, 2019.
Y. Song. J. Sohi-Dickstein, D. P. Kingma, A. Kumar, S. Ermon, and B. Poole. Score-based generative modeling through stochastic differential equations. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021b.
J. Tang, J. Li, Z. Gao, and Li. Rethinking graph neural networks for anomaly detection. In K. Chaudhuri, S. Jegelka, L. Song, C. Szepesvári, G. Niu, and S. Sabato, editors, International Conference on Machine Learning, ICML 2022, 17-23 July 2022, Baltimore, Maryland, USA, volume 162 of Proceedings of Machine Learning Research, pages
PMLR, 2022.
J. Tang, F. Hua, Z. Gao, P. Zhao, and J. Li. Gadbench: Revisiting and benchmarking supervised graph anomaly detection. In A. Oh, Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, editors, Advances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 2023, New Orleans, LA, USA, December 10 16. 2023, 2023.
P. Velickovic, G. Cucurull, A. Casanova, A. Romero, Liò, and Y. Bengio. Graph attention networks. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30- May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018.
C. Vignac, I. Krawezuk, A. Siraudin, B. Wang, V. Cevher, and P. Frossard. Digress: Discrete denoising diffusion for graph generation. In The Eleventh International Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023. OpenReview.net, 2023.
D. Wang. Y. Qi, J. Lin, P. Cui, Q. Jia, Z. Wang, Y. Fang, Q. Yu, J. Zhou, and S. Yang. A semi- supervised graph attentive network for financial fraud detection. In J. Wang, K. Shim, and X. Wu, editors, 2019 IEFE International Conference on Data Mining, ICDM 2019, Beijing, China, November 8-11, 2019, pages 598-607 607. IEEE, 2019a
J. Wang, R. Wen, C. Wu, Y. Huang, and J. Xiong. Fdgars: Fraudster detection via graph convolutional networks in online app review system. In S. Amer-Yahia, M. Mahdian, A. Goel, G. Houben, K. Lerman, J. J. McAuley, R. Baeza- Yates, and L. Zia, editors, Companion of The 2019 World Wide Web Conference, WWW 2019, San Francisco, CA, USA, May 13-17, 2019, pages 310-316. ACM, 2019b.
Y. Wang, J. Zhang, S. Guo, H. Yin, C. Li, and H. Chen. Decoupling representation learning and classification for gnn- based anomaly detection. In F. Diaz, C. Shah, T. Suel, P. Castells, R. Jones. and T. Sakai, editors, SIGIR '21: The 44th International ACM SIGIR Conference on Research and Development in Information Retrieval, Virtual Event, Canada, July I 11-15, 2021, pages 1239-1248. ACM, 2021.
M. Weber, G. Domeniconi, J. Chen, D. K. I. Weidele, C. Bellei, T. Robinson, and C. E. Leiserson. Anti-money laundering in bitcoin: Experimenting with graph convolutional networks for financial forensics. CoRR,
2019.
15

---

C. Wei, B. Bai, K. Bai, and F. Wang. Gsl4rec: Session- based recommendations with collective graph structure learning and next interaction prediction. In F. Laforest, R. Troncy. E. Simperl, D. Agarwal, A. Gionis, I. Herman, and I.. Médini, editors, WWW '22: The ACM Web Conference 2022, Virtual Event, Lyon, France, April 25 29, 2022, pages 2120-2130. ACM, 2022a.
C. Wei, Y. Fan, and Zhang. High-order social graph neural network for service recommendation. IEEE Trans. Netw. Serv. Manag., 19(4):4615 4628 2022b.
C. Wei, J. Liang, B. Bai, and D. Liu. Dynamic hypergraph learning for collaborative filtering. In M. A. Hasan and L. Xiong, editors, Proceedings of the 31 ACM International Conference on Information & Knowledge Management, Atlanta, GA, USA, October 17-21, 2022, pages 2108 2117. ACM, 2022c.
C. Wei, Liang. D. Liu, and F. Wang. Contrastive graph structure learning via information bottleneck for recommendation. In S. Koyejo. S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, editors, Advances in Neural Information Processing Systems 35: Annual Conference on Neural Information Processing Systems 2022, NeurlPS 2022, New Orleans, LA, USA, November 28: December 2022, 2022d.
C. Wei, Y. Fan, and J. Zhang. Time-aware service recommendation with social-powered graph hierarchical attention network. IEEE Trans. Serv. Comput., 16(3):2229-2240,, 2023a.
C. Wei, J. Liang, D. Liu, Z. Dai, M. Li, and F. Wang. Meta graph learning for long-tail recommenda- tion. In A. K. Singh, Y. Sun, L. Akoglu, D. Gunopulos, X. Yan, R. Kumar, F. Ozean, and Ye, editors, Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, KDD 2023, Long Beach, CA, USA, August 6-10, 2023, pages 2512-2522. ACM, 2023b.
C. Wei, Y. Wang. B. Bai, K. Ni, D. Brady, and L. Fang. Boosting graph contrastive learning via graph contrastive saliency. In A. Krause, E. Brunskill, K. Cho, B. Engelhardt, S. Sabato, and J. Scarlett, editors, International Conference on Machine Learning, ICML 2023, 23-29 July 2023, Honolutu, Hawaii, USA, volume 202 of Proceedings of Machine Learning Research, pages 36839-36855. PMLR, 2023c.
C. Wei, Y. Fan, Z. Jia, and J. Zhang. Cross-view graph alignment for mashup recommendation. IEEE Trans. Serv. Comput., 17(5):1151-2164, 2024a.
C. Wei, Y. Fan, J. Zhang, Z. Jia, and R. Yan. Dynamic relation graph learning for time-aware service recommendation. IEEE Trans. Netw. Serv. Manag,, 21): 10331117, 2024b.
C. Wei, W. Hu, X. Hao, Y. Wang. Y. Chen, B. Bai, and F. Wang. Graph evidential learning for anomaly detection. In L. Antonie, J. Pei, X. Yu, F. Chierichetti, H. W. Lauw, Y. Sun, and S. Parthasarathy, editors, Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining, V.2, KDD 2025, Toronto ON, Canada, August 3-7, 2025, pages 3122-3133. ACM, 2025.
C. Xiao, S. Pang. X. Xu, X. Li, G. Trajcevski. and F. Zhou. Counterfactual data augmentation with denoising diffusion for graph anomaly detection. CoRR, abs/2407.022 02143, 2024.
F. Xu, N. Wang, H. WU, X. Wen, X. Zhao, and H. Wan. Revisiting graph-based fraud detection in sight of heterophily and spectrum. In M. J. Wooldridge, J. G. Dy, and S. Natarajan, editors, Thirty-Eigh AAAI Conference on Artificial Intelligence, AAAI 2024, Thirty-Sixth Conference on Innovative Applications of Artificial Intelligence, IAAI 2024, Fourteenth Symposium on Educational Advances in Artificial Intelligence, EAAI 2014, February 20-27, 2024, Vancouver, Canada, pages 9214-9222. AAAI Press, 2024.
K. Xu, W. Hu, J. Leskovec, and S. Jegelka. How powerful are graph neural networks? In 7th International Conference Learning Representations, ICLR 2019, New Orleans, LA, USA, May 6-9, 2019. OpenReview.net, 2019.
Y. Yang, Xu, Sun, Y. Dong, Wu, and Zhuang. Mining fraudsters and fraudulent strategies in large-scale mobile social networks. IEEE Trans. Knowl. Data Eng., 33(1):169-179, 2021.
16

---

K. Yi. B. Zhou, Y. Shen, P. Lió, and Y. Wang. Graph denoising diffusion for inverse protein folding. In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, editors, Advances in Neural Information Processing Systems 36: Annual Conference Neural Information Processing Systems 2023, NeurlPS 2023, New Orleans, IA, USA, December 10 16, 2023, 2023.
G. Zhang. J. Wu, J. Yang, A. Beheshti, S. Xue, C. Zhou, and Q. Z. Sheng. FRAUDRE: fraud detection dual-resistant to graph inconsistency and imbalance. In J. Bailey, P. Miettinen, Y. S. Koh, D. Tao, and X. Wu, editors, IEEE International Conference on Data Mining, ICDM 2021, Auckland, New Zealand, December 7-10, 2021, pages 867-876. IEEE, 2021.
J. Zhang and Y. Luo. Degree centrality, betweenness centrality, and closeness centrality in social network. In 2017 2nd international conference on modelling, simulation and applied mathematics (MSAM2017), pages 300-303. Atlantis press, 2017.
X. Zhang. Wei, R. Yan, Y. Fan, and Z. Jia. Large language model ranker with graph reasoning for zero-shot recommendation. In M. Wand, K. Malinovská, J. Schmidhuber, and I. V. Tetko, editors, Artificial Neural Networks and Machine Learning ICANN 2024 33rd International Conference on Artificial Neural Networks, Lugano, Switzerland, September 17-20, 2024, Proceedings, Part V, volume 15020 of Lecture Notes Computer Science, pages 356-370. Springer, 2024.
X. Zhang, R. Yan, Y. Fan, J. Zhang, H. Yuan, and C. Wei. for recommendation. Adv. Eng. Informatics, 68:103667, 2025.
attention transfer network
T. Zhao, T. Jiang, N. Shah, and M. Jiang. A synergistic approach for graph anomaly detection with pattern mining and feature learning. IEEE Trans. Neural Networks Learn. Syst., 33(6):2393-2405, 2022.
J. Zhu, Y. Yan, L. Zhao, M. Heimann, L. Akoglu, and D. Koutra. Beyond homophily in graph neural networks: Current limitations and effective designs. In H. Larochelle, M. Ranzato, R. Hadsell, M. Balcan, and H. Lin, editors, Advances Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, virtual, 2020.
17

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
Our abstract and introduction clearly claim our task (scope), contributions and
solutions.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
We discuss the limitation in Conclusion.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
18

---

Justification:
We provide all the proof in Appendix S.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification:
We provide our code in the supplementary material.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm. (b) the contribution is primarily a new model architecture, the paper should describe the architccture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. the case of closed-source models, may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
19

---

Answer: [Yes]
Justification: We provide our code in the supplementary material. And we will provide a github repository containing the code once accepted.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips... cc/
public/guides/Codes httpes//ooosuuuiisiioooooooo..
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to to reproduce the results. See the NeurlPS code and data submission guidelines (https
ssicnlolicy) for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: In the Appendix L
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: We conduct two-sample t-tests, and p-value < 0.05 indicates that the improve- ments are statistically significant.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
20

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: In the Appendix
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics http://wwrrp...c........hhaccaaa
Answer: [Yes]
Justification:
This research conforms, in every respect, with the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
In appendix T.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no socictal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
21

---

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: Not Applicable.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g.. code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
We cite the original papers or website links about the dataset and open-source codes.
Justification:
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the Datasets.papersstt paperswi thcode. cww/ datasets package should be provided. For popular datasets,
has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
22

---

If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: Not Applicable.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/mmoel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: Not Applicable.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question:
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: Not Applicable.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
23

---

Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that if the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification: Not Applicable.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs any important, original, non-standard components.
Please refer to our LLM policy fattps://neurip:::: /ttpaarrpp..cco/ooofeeeeeee////s for what should or should not be described.
24

---

A Evaluation on Additional Datasets
To further validate the generalizability of our approach, conducted experiments four additional real-world datasets Tang et al. (2023]: Weibo, Amazon, T-Finance, and T-Social. These datasets represent diverse application domains and vary in their structural properties and anomaly distributions. Tables and present the AUPRC and AUROC results, respectively, comparing our CGADM with state-of-the-ar methods XGBGraph and CONSISGAD.
presen
Table 3: AUPRC comparison additional datasets
Model
Weibo
Amazon
T-Finance
T-Social
XGBGraph
0.9516
0,9020
0.8836
0.9203
CONSISGAD
0.8847
0.8047
0.7283
0.5212
CGADM (Ours)
0.9735
0.9191
0.9154
0.9408
Table 4: AUROC comparison on additional datasets
Model
Weibo
Amazon
T-Finance
T-Social
XGBGraph 0.9937
0,9682
0,9623
0,9914
CONSISGAD
0.9654
0.9409
0.9026
0.8963
CGADM (Ours)
0.9879
0.9736
0.9708
0.9761
The results demonstrate that CGADM consistently outperforms both XGBGraph and CONSISGAD terms of AUPRC across all four additional datasets. While XGBGraph achieves marginally higher AUROC on Weibo and T-Social datasets, CGADM maintains competitive performance and excels on Amazon and T-Finance datasets. These comprehensive evaluations across nine diverse datasets underscore the robustness and effectiveness of our generative approach to graph anomaly detection across various domains and graph structures.
B Common Process of Diffusion Probabilistic Model
Here we show the common steps in the diffusion model as follows:
q(2o), the forward process constructs the latent variables 21:T Markov chain by progressively adding Gaussian noises over T' steps. Specifically, the forward transition -4-1 + 2, is defined as q(z, (==)) N( /I 3, 3,1), where (1...., refers to the diffusion step, A denotes the Gaussian distribution, and 3r (0, 1) regulates the noise scales added at step t. If T + co, 2r approaches a standard Gaussian distribution (Ho al. 2020).
Forward process: Given an input data sample
Diffusion models (DMs) aim to remove the added noises from H; recover Tt-1 in the reverse step, striving to capture minor alterations the complex generation process. Formally, taking Zy as the initial state. DMs learn the denoising process H2 Zt-1 iteratively by Po Po(2;11/z7) [2g) = N (2 1; (Iz t), Eo( t)), where (Z t) and Eg t) are the mean and neural network with parameters 6.
Reverse process:
covariance of the Gaussian distribution predicted
Optimization: DMs are optimized by maximizing the Evidence Lower Bound (ELBO) of the likelihood of observed input data zo. Denote (rl(pllg) the Kullback-Leibler (KL) divergence from distribution to distribution q:
logo( log / p(zoor)ddr = log E
p(aur) 9(x)r (wo]
p(zar)
9(x1eT( (
(17)
Eg)
(logpo Dx D
E Eytore mo)
2=2
25

---

Inference: After training 0, DMs can draw 2T ~ NO, I) and use p=(2x-1(2z) to iteratively repeat the generation process 2T + 2T-1 7 20-
C Posterior Coefficients Derivation
Similar to Han al. 2022b], here give the detailed derivation of Equation 6 and 7
((y 11,, E)
= 10yyy-11yyy 1 IolE, X)) x y(Ve xx (0)
1o(E, X))
(U: - (1- vax) 90 (6,E, vary
x exp
2
Be
(31-1
vac-1310 (1 - V 01-1 1) 96 (o(E)
- ō(
a.yi 2 - 2/ (/
(1 vae) 10 X)) V1-1
α exp
2
31
(18)
V/-1 2 (v 1990 + (1 - / 1,, (e)
Ōt-1
1 at
exp(
(1
2
1 xs-1
Term
04-1
Vai
Vos (Vor-1)
1 aa--1
2(
V:
90(E,X)))(
a1-1
Br
Br
1 āc-1
Torm
where
at (1 - a,
1 - πt
Term
(19)
31 (1 ā
3: (1 Ō2-1)
8, = (1) = āx-1 3r,
(20)
Afterwards, we divide each coefficient in Term by Term 1.
Vat-1
/
v 0t
3
(21)
at-1
1 at
Vut
/1
/an1
(22)
Br
and
v 0/
(Vay
01 - 1)
1 - V /1
72
3r +
1 Gt-1
04
σt /ot (1 x 1) + Br Br v0c-
(23)
Clt
1 (Vāz - 1) (V/o vo--1)
1-āc
Finally, we put every No. 7i, and 72 together and obtain Equation 6 and
ü (ye, No. (E, X)) Youo 713, + 729 (E,
(24)
26

---

D Derivation of conditional non-Markovian reverse process
Following DDIM, we formally carry out the derivation of discarding the Markov constraint in- troduced by Equation 4 in our prior-conditional reverse step Equation 6 First, let's organize our target: given q (y: Yo. (,, X)) and (y:-1 | Yo: Io (E, X)), without q (y, Yt-1), we aim to find q (y--1 Yo, (6, X)).
Here assume that Yt-1 is linear combination of yı, Yo and prior go X) with coefficients denoted as my, ny and Oz, respectively. That is,
yt-1 myye + neyo + (E) + 0,e1
(25)
We also know that
Y1 vayyo + (1 (1-va)lall x + v1 - CGEE,
(26)
Yt-1 vār-1yo + (1- (E X) + v1-
(27)
Here, the subscripts of en are used distinguish different samples from the Gaussian distribution. Substituting Equation 26 into Equation 25 we get
Yt-1 = -m (Vonyo + (1 Vor)go X) + vI -I- a(ez) + n.Yo + 0, + 0,e1
(28)
=mmvat + m4) + (m+ mivār + (0) + -mvmmvI--a 0,62 +
(29)
Therefore, we have
mey + nt V0t-1,
(30)
m (1 a:) + to = - ā1-l;
(31)
m m /z + O = 1 V
(32)
Immediately, we can calculate my and nz:
ā 2
my
(33)
1 Ōz
n4 = /a-11
(1 0;-1 - -,?,
(34)
1 aq
ā1-1 0?
0 1 Vā
(1 v Va,).
(35)
Substituting back into Equation 25
we have
Y1-1 V 1 α2
Ū o²
(aa-1
1 1 11-6 aq
αt
(1- āl-1 - -of) yo
0t-1 07
+ (1 - var-1
(1
Vār))go(E,X) o0c
(36)
= -oi--1yo iyo + (1
Va (E,
+ + 1- āi-1 - of
Yc
Var
Yo
go go(E, x))
+ t
(37)
VI O4
VI αi
v1
Voi--180 + (11
V /01-1)90(E,})
+ /11 - 51-1- o2 Yt Vo,yo
(1 (E, X)
+,c
(38)
VI- ax
Substituting the model's predicted value, we have
yz-1 = Voo- + (1 vār-1)go(E, X) + v 11 δ1-
1, t
(39)
27

---

At this point, the derived result Equation 39 is completely consistent with Equation 15 That is, we use the two conditions q (y: No. X)) and q (v-1 Yo- 9o X)), without q (y. Yr-1). and obtain q (yr-1 Yt, Vo, (E, X)). DDPM removes the condition q (ye Yt-1): leading to the more general DDIM sampling formula.
E
Baselines
In this section, we introduce the baseline models, which can be broadly bifurcated into two cate- gories: (1) General-purpose graph neural networks, and (2) Techniques specifically designed for graph anomaly detection, and (3) Diffusion-based data augmentation approaches for graph anomaly detection. We have annotated each model with their respective categories for easy differentiation.
GCN [Kipf and Welling, 2017 (I): This technique employs the convolution operation on graphs propagate information from node its adjacent nodes. This allows the network to learn a representation for each node, grounded on its local neighborhood.
GIN [uu et al. 2019 (1): A variant of GNN, GIN is designed to encapsulate the graph's 's structure while maintaining graph isomorphism. This implies that yields identical embed- dings for graphs that are structurally indistinguishable, irrespective of permutations in their node labels.
[Hamilton et al.) 2017 (1): This is an inductive learning framework that generates node embeddings by sampling and aggregating features from node's local neighborhood.
GraphSAGE
GAT Velickovic al. 2018 (1): This GNN framework incorporates the attention mecha- nism, assigning varying degrees of importance to different nodes during the neighborhood information aggregation process. This enables the model to concentrate on the most infor- mative neighbors.
GAS [i et al. 2019 (2): This is highly scalable technique for detecting spam reviews. It expands GCN to manage heterogeneous and heterophilic graphs and adapts to the graph structure of specific GAD applications using the KNN algorithm.
PCGNN [Lu al. 202Tb (2): This framework is designed for imbalanced GNN learning in fraud detection. It employs label-balanced sampler to select nodes and edges for training, leading to a balanced label distribution the induced sub-graph. Additionally, uses learnable parameterized distance function to select neighbors, filtering out superfluous links and incorporating beneficial ones for fraud prediction.
BWGNN (Tang et al. 2022] (2): This technique is proposed to address the 'right-shift' phenomenon graph anomalies. where the spectral energy distribution focuses less on low frequencies and more on high frequencies. It utilizes the Beta kernel to tackle higher frequency anomalies through multiple flexible, apatial/spectralllocallii
and band- pass
filters.
GHRN [Gao al. 2023b (2): This approach addresses the heterophily issue in the spectral
domain of graph anomaly detection by pruning inter-class edges to highlight and outline the graph's high-freyuency components.
XGBGraph [Tagg et al., 2023 (2): gradient boosting framework that combines traditional
XGBoost with graph structural features.
CONSISGAD [Chen et al. 2024 (2): A consistency training approach that leverages
learnable data augmentation for graph anomaly detection with limited supervision.
GODM Ma et al. 2024a (3): A data-centric approach for graph anomaly detection with few labels. It employs o a diffusion model to generate positive examples in the latent space, addressing the label imbalance problem that is inherent in anomaly detection tasks.
CGenGA [Lu et al. 2023 (3): A framework that uses latent diffusion models for data augmentation in graph anomaly detection. It generates synthetic graph data to enhance the training of supervised outlier detection methods, particularly effective in scenarios with limited labeled anomalies.
28

---

Challenge of Graph Anomaly Detection
Although GAD essentially a binary node classification problem, it presents several unique chal- lenges. Firstly, anomalous nodes typically constitute small fraction of the total nodes, leading significant data imbalance [Liu et al. 2021b]. Secondly, graphs containing anomalies often exhibit strong heterophily, where connected nodes possess diverse features and labels [Gao al. 2023b Tang et al., 2023). This heterophily necessitates the development of methods that can effectively handle neighborhood feature disparities during message passing. Lastly, anomalous nodes tend to camouflage their features and connections, striving to blend in by mimicking normal patterns within the graph [Liu 2020
G Details of the datasets
The detailed statistics of the datasets we used are in Table[5] In line with the data characteristics of anomaly detection, the selected datasets each contain over 100 anomaly points, and the proportion of anomalies does not exceed 25%, satisfying the inherent imbalance problem in graph anomaly detection [Tang et al. 2023]. For each dataset, we randomly selected 20% of the points as training data, 10% of the points as validation data, and the remaining points as test data.
Table 5: Descriptive statistics the datasets.
#Nodes
#Edges
Feature Dim
Anomaly Ratio
Feature Type
Ellipticc
203,769
234,355
166
9.8%
Timestamps and transaction information
Tolokers
11,758
519,000
21.8%
User profile with task performance statistics
YelpChi
45,954
3,846,979
32
14.5%
review features and statisties
Questions
48,921
153,540
301
3.0%
FastText embeddings for user descriptions
Reddit
10,984
168,016
64
3.3%
Hand-crafted review features and statisties
H Implementation of Topological-guided Denoising Network
Reflecting upon Equation 9
we initially extend the formula of graph convolution to matrix form to facilitate computation across the entire graph, as shown below:
H' = owo (I- D AH'-l))
After conducting rounds of convolution, we use weighted summation our aggregation function for the hidden representations obtained from each layer of graph convolution. The formula is as follows:
Hinal AGG H² H
Σ H
Here, the weights for each layer's representation, which can be learned during training. Having obtained the representation of nodes that integrates both topological structure and node features, we construct our denoising function co (y,, f, H H/mal) through Multilayer Perceptron (MLP). Following the original DDPM et al. [2020), we also adopt position embedding to encode time f. Therefore, the denoising function co as follows:
Eg (ot((C H finol]
In this equation, Pos(t) represents the position embedding of time mathbft, yt is the current representation of the nodes, and H is the final aggregated representation after L layers of graph convolution.
I Training of CGADM
According to the loss in Equation I| the pseudo algorithm for training is shown in Algorithm 2
29

---

Algorithm 2 CGADM Training
1: Pre-train (6(E that predicts the anomaly prior
2: repeat
3: Draw t~ Uniform((1,..... T))
4: Draw E~ (N( I)
5: Compute the noise estimation loss:
C.
| colvā,yo + (1- Var))o(E, + v1 -,,,t,
Take a numerical optimization step on VoL.
7:
until Convergence
Inference with Prior-aware Strided Sampling
We show the complete pseudo algorithm inference with our prior-aware strided sampling strategy in Algorithm
Algorithm 3 Inference for Anomaly Detection with Sampling Strategy
I: Initialize yr (Ng (E, X), () Compute K based on the prior confidence (E, X) 0.5| using:
K
x T
1 1 exp [1)(E.))-0.5)
0.5
where r is hyporparameter. 3: Generate sampling time steps {Ti (T])/=
(T () 1)
14
i= L...,
K -
4: for K to 1 do
Set T.
6: Calculate reparameterized ýo using Equation 13
yo V (yr (1 Vāt)go(E,X) X)- - E,,
7: i then
Draw NO
9:
Update yt-1 using the modified non-Markovian reverse process:
1 aay 3o + (1 (E,EE)) /1 /1-aa ar;,, o, + toz
(E,
10:
else
Set yt-1 yo
end if
13: end for
14: return
K Implementation Detail
All experiments were conducted on a Linux machine equipped with an Nvidia GeForce RTX 3090.
The CUDA version used was 11.1, and the driver version was 455.45.01. We implemented our algorithm and the corresponding baseline methods using PyTorch [Paszke et al., 2019 and the graph Geometrieeee [Fey and Lenssen, 2019]. For the Random Forest (RF) and Extreme Gradient Boosting Tree (XGBT) that serve as conditional anomaly estimators, we used the RF version implemented in the Scikit-Lear library Pedregosa et al. [201]] For XGBoost and Guestrin 2016), utilized its official implementation.
computation framework Pytorch-Geometric
30

---

Table Performance comparison on the DGraph dataset.
Method
AUPRC
AUROC
GCN
3.66
74.97
GIN
3,22
73.14
GraphSAGE
3.43
73.81
GAT
3,65
75.17
GAS
2.91
71.21
PCGNN
2.82
71.78
BWGNN
3.63
75.16
GHRN
3.68
75.15
CGADM
3.83
76.43
We initialize the latent vectors for all models with Gaussian Distribution, having mean value of 0 and standard deviation of 0.01. To ensure a level playing field, the dimension the hidden layer for all baseline models, as well our CGADM, is set to 64. We conducted grid search for hyper-parameter tuning. The learning rates were selected from the set [0.005, 0.01, 0.02, 0.05]. To prevent overfitting, we incorporated an L2 norm with the coefficient tuned from the set [0.001, 0.005, 0.01, 0.02, 0.1]. For methods, we selected the best models by implementing early stopping when the AUROC on the validation set did not increase for five consecutive epochs.
L Efficacy in Highly Imbalanced Scenarios
We conducted additional experiments on the DGraph dataset dataset|Hung Huang et al. [2022] a highly imbalanced
real-world financial fraud detection dataset where anomalies constitute only 1.3 % of the data. The results are presented in Table
As Table fillutritlustratess CGADM consistently outperforms all baseline methods on both AUPRC and AUROC metries in this extremely imbalanced setting. Notably, the AUPRC metric demonstrates CGADM's ability to handle rare event detection by excelling in anomaly-specific precision and recall. Similarly, the superior AUROC indicates robust overall discriminative performance.
M Empirical Results on Efficiency
We conducted experiments to compare memory usage, training time, and inference time with baselines specifically designed for anomaly detection on the Elliptic dataset, which contains 203,769 769 nodes and 234,355 edges. The results summarized in Table
Table Efficiency comparison on the Elliptic dataset.
Model
Memory (MB)
Training Time (s/epoch)
Inference Time (s)
GAS
1418
14.96
2.3865
PCGN
914
1.86
0,0827
BWGNN
446
0.75
0.1185
GHRN
924
1.57
0.1249
CGADM (ours)
1048
2.21
0.5691
From these empirical results, we draw the following observations:
Memory Efficiency: The use of sparse matrix computations ensures that CGADM remains efficient in tenms of memory usage, even for large- scale graphs. The marginal increase in memory usage is negligible compared to the scalability benefits.
Training Efficiency: While CGADM's training time moderately higher than discrim- inative methods (2.21s vs 0.75s for BWGNN), the performance gains (+10% AUPRC improvement over BWGNN) justify this reasonable overhead, especially considering the substantial improvement in detection capability.
31

---

While our inference time is higher than most discriminative methods, the increase is justified given the novel generative anomaly detection paradigm. Considering the already low baseline inference time of anomaly detection tasks, the additional time overhead is acceptable, especially in scenarios where performance improvements are critical.
Inference Time:
Overall, these results demonstrate that CGADM achieves state-of-the-arr detection performance with reasonable computational demands, striking an effective balance between accuracy and efficiency. The slightly higher computational cost compared to discriminative methods is worthwhile trade-off given the substantial performance improvements observed our experiments.
N Additional Experiment Results
We computed the Fi-scores for our model and baseline methods across all datasets. These results further confirm the superior performance our model. Table presents the Fl-scores, which show consistency with the experiment results in Table 1
Table 8: Fl-scores comparison across datasets.
Model
Ellip
Tolo
Yelp
Quest
Reddit
GCN
73.672
47.376
27.658
6.856
7.794
GIN
75.338
49.443
42.214
10.288
6.443
GraphSAGE
81.096
50.226
43.949
12.041
10.075
GAT
80.498
50.878
48.891
11.157
8.432
GAS
77.844
48.253
43.404
10.867
9.071
PCGNN
45.090
47.213
44.608
5.796
6.981
BWGNN
83.134
49.983
47.323
12.788
6.501
GHRN
85.678
51.493
45,970
12.696
6.702
XGBGraph
87.555
51.079
65.121
16.088
2.954
CONSISGAD
79.120
49.762
41.606
9.848
6.443
Ours (CGADM)
93.390
51.595
69.396
17.162
9.754
Robustness of CGADM against Feature Manipulation
To evaluate the robustness of CGADM against feature manipulation, introduced feature perturba- tions in the Elliptic and Tolokers datasets, Specifically, we randomly perturbed the features of nodes with varying proportions (10%, 20%, and 30%) by randomly selecting values from their possible ranges with uniform probability. We then compared the performance of CGADM with GHRN (the best-performing baseline from our original experiments) under these conditions.
The results are summarized in Figure 5 As the proportion of perturbed nodes increases, the perfor- mance of both models decreases. However, CGADM consistently exhibits slower decline compared to GHRN. This highlights CGADM's 's superior robustness to feature perturbations, which we attribute to its denoising reconstruction mechanism. This mechanism leverages information from neighboring nodes during the reverse diffusion process to iteratively restore the true anomaly signals.
P Effect of High- and Low-frequency Signals
To further substantiate that the high-frequency components are indeed reflected in the residual propa- gations, we designed an ablation study comparing our original CGADM (denoted as CGADM with variant (denoted as CGADM,P) that only propagates frw-frreuency signals. In CGADMLP. the graph convolution operation is replaced with the standard GCN:
h
Σ
h
(40)
W(+)] +1
uE.((u)
low-frequency signals. where the feature representation is averaged across the node and its neighbors, propagating only
32

---

Bligkic Datuwil:
Datavel: AUROC
-10
220
110
Charge PUT 176)
20
-2
50
-21
Perorbatton Ni.s
Portriation Nate 760
Dataset:
60
120
Chonge-1
C-NN
310
Charge: (0 MAAU-AAC
20
Pertriation Na.s 766
Porariation Hate 780
Figure 5: Robustness against Feature Manipulation
We conducted experiments the Elliptic and YelpChi datasets, varying the number of GNN layers in the denoiser module. The results are shown in Table g
Table 9: Performance comparison of CGADM and CGADME. with varying GNN layers.
GNN Layers
Model
AUPRC (Elliptie) &
AUROC (Kiliptic))
AUPRC (VelpCh)) AUROC (YelpChi) %
CGADMpr
97.13
99.22
75.04
92.37
CGADMLP
95.71
98.43
72.23
91.88
2
CGADMBP
97.31
99.38
75.20
92.62
CGADMEP
93.73
97.60
70.92
90.88
CGADMaP
97.32
99.44
76.54
92.69
CGADMLP
90.83
95.58
71.43
89.64
CGADMAP
97.53
77.27
93.05
CGADMLP 87.12
92.60
69.98
87.71
CGADMAP 97.57
99.50
77.29
92.92
CGADMLP
81.20
89.49
68.71
86.08
According to Table we have the following observations:
1. High-Frequency Signal Preservation Matters: CGADM#P. which retains high- frequency signals through residual propagation, consistently outperforms CGADM1P across all metrics and datasets. This highlights the importance of preserving high-frequency information for anomaly detection, as anomalies often manifest as local deviations that are captured by these components.
2. Sensitivity to GNN Layers: For CGADMLP, performance declines significantly the number of GNN layers increases. This is indicative of the well-known over-smoothing issue, where stacking multiple low-pass filters causes node representations converge, losing discriminative information. Conversely, CGADM remains robust, and its performance even improves slightly with additional layers, demonstrating the effectiveness of residual propagation mitigating over-smoothing.
Iterative Refinement Amplifies Over-Smoothing: the context of our diffusion model, the iterative refinement process repeatedly aggregates neighborhood information, exacer-
33

---

bating the impact of wwershig in CGADMLP. This leads to a failure to capture new anomaly- rreevaatt signals each stage of refinement. In contrast, CGADM avoids this issue by leveraging high-frequency signals to refine anomaly detection throughout the iterative process.
More Comparison with Data-augmentation Methods
The main distinction between CGADM and the existing data-augmentation methods lies in the underlying approach to anomaly detection. While prior works focus using diffusion models for data augmentation to improve detection performance, CGADM adopts a generative, model-centric paradigm directly model the joint distribution of anomalies on the entire graph. Below, summarize the key differences:
CAGAD Xiao et al. 2024]: Uses graph-specific diffusion model to generate counterfactual representations by transforming normal neighbors into anomalous ones. This is a classic data augmentation technique to enhance anomaly distinguishability.
DEGAD [Pang et al. 2024]: Employs diffusion models to generate manipulated neigh- bors, enhancing graphs by creating augmented data. This technique is used as data enhancement module within a contrastive learning framework.
ConGNN Li et 2024]: Introduces generator based on diffusion models to control neighborhood aggregation and create augmented data for better anomaly detection perfor- mance.
GD (Liu et al. 2024]: Tackles the label imbalance problem by generating positive examples using a diffusion model the latent space. The primary goal to balance datasets, not directly detect anomalies.
Diffad Ma et al. 2024b]: Investigates denoising diffusion models to synthesize graph structures and enhance existing methods. This approach focuses on data synthesis rather than directly detecting anomalies.
We have conducted detailed experimental comparison of our proposed Conditional Graph Anomaly Diffusion Model (CGADM) with some diffusion-bel based data augmentation methods CAGAD Xiao et al. ] DEGAD (Pang al., 2024), ConGNN [Li et al. 2024], GD (Liu et al., 2024 and Diffad Ma et al. 2024b). We analyzed their performance across several standard benchmark datasets
(Elliptic, Tolokers, and YelpChi), and the key results summarized below:
Table 10: AUPRC and AUROC comparison with Data Augmentation Methods
Metric
Model
Ellip
Tolo
Yelp
CAGAD
89.75
40.80
72.30
DEGAD
93.86
43.51
75.11
ConGNN
91.60
42.22
73.60
AUPRC
GD
88.63
39.90
68.01
Diffad
90.05
41.75
71.28
CGADM
97.28
45.11
76.54
CAGAD
94.82
72.22
90.34
DEGAD
97.88
76.20
92.22
ConGNN
95.60
74.56
91.33
AUROC
GD
93.53
70.70
83.84
Diffad
92.72
73.31
88.21
CGADM
99.34
78.11
92.69
As shown in the Table TO CGADM consistently outperforms the data-augmentation methods in both AUPRC and AUROC across all datasets. This underscores the efficacy of our generative framework in addressing graph anomaly detection challenges.
34

---

Q.1 Quantitative Analysis of Over-smoothing Mitigation
To provide quantitative evidence that CGADM effectively mitigates the over-smoothing problem, we conducted a Dirichlet Energy analysis, which measures the preservation of high eighffreuency signals in node embeddings. Dirichlet Energy is defined as:
E(f) - 2
Σ wis((() - f())² (K,))E
where Wij represents the weight of edge (i,j), and f(i) is the value of the embedding node i. Higher Dirichlet Energy indicates better preservation of high-frequency signals, which is critical for distinguishing anomalous nodes.
We compared our CGADM with a variant where the GNN layers were replaced with traditional GCN layers, and the results are presented in Table
Table 11: Dirichlet Energy comparison between CGADM and GCN-based variant
Model
Dirichlet Energy (Elliptic) Dirichlet Energy (Tolo)
CGADM CGADM with GCN
105,002
3,977
66,345
1,383
The results demonstrate that CGADM consistently produces embeddings with significantly higher Dirichlet Energy compared to the GCN-based variant across both datasets. This confirms that our residual propagation mechanism effectively preserves high-frequency signals that critical for anomaly detection, thereby mitigating the over-smoothing problem common in traditional GNN approaches.
These findings complement our ablation studies in Section 5.4 where we showed that CGADM's performance improves with deeper GNN layers, and analysis in Appendix P, which demonstrates the importance of preserving high-frequency components for effective anomaly detection.
R Theoretical Analysis of Over-smoothing Mitigation in CGADM
In this section, we provide rigorous theoretical analysis of how our Conditional Graph Anomaly Diffusion Model (CGADM) effectively mitigates the over-smoothing problem typically encountered in deep GNNs while still capturing long-range dependencies.
R.1 Background: Over-smoothing GNNs
Over-smoothing in GNNs occurs when node representations become increasingly similar more layers are stacked, eventually converging to indistinguishable representations. For a standard GNN with L layers, the representation of a node at layer I can be expressed as:
h
w
Σ
W(t) +1 h 1-1)
(41)
(EN(U)U(e)
It has been shown that as - oc, all node representations converge: nodes and u in connected graph.
[h! h
for any
R.2 Receptive Field Analysis
We define the receptive field R2(v) of a node v after L layers of message passing as the set of nodes whose features contribute the final representation of
(v) {u V dist(u, v) < L}
(42)
where dist(u, v) represents the shortest path distance between nodes and
35

---

Theorem R.1. For CGADM model with an L-layer GNN denoiser and T' denoising steps, the effective receptive field of node RCGADM (v) RExT(U), equivalent an (L T -layer traditional GNN without the over-smoothing effect.
Proof. In CGADM, each denoising step t applies an L-layer GNN to refine the node representations. The key difference from traditional GNNs is residual propagation mechanism in Equation (9):
Σ h )
h = w
(43)
uEN(w)
For each denoising step i, we define the influence set I!xL as the set of nodes that contribute to representation of node u after l denoising steps, each involving L graph convolution layers.
For the influence is identical the receptive field of an L-layer GNN:
T1xL (v)
(44)
For successive denoising steps, the influence set expands recursively:
T
(u)
(45)
NET ((-xx
This recursive expansion leads to:
ITxL RLXI (v)
(46)
Thus, after T denoising steps, the effective receptive field of node in CGADM encompasses nodes up to L x T hops away, equivalent to an (L x -layyr traditional GNN.
To prove that over-smoothing is mitigated, we analyze the residual propagation mechanism. Unlike standard GNNs that apply a low-pass filter by averaging features, our approach computes the difference between the node's ' feature and the average of its neighbors' features:
h4
Σ b (EN
(47)
W(O)
This operation equivalent to a high-pat figh-passshe filter that preserves the high-frequency components of the signal. In the spectral domain, for graph signal with Fourier coefficients x, the residual propagation applies a transfer function:
H(A)=1-X
(48)
where A; are the eigenvalues of the normalized Laplacian matrix. This transfer function amplifies the contribution eigenvectors corresponding to larger eigenvalues (high-frequency components) while reducing the contribution of eigenvectors corresponding smaller eigenvalues flow-frequency components).
Consequently, even after multiple denoising steps, the node representations retain their distinctive high-frequenc, signals, preventing over smoothin while still capturing information from distant neighborhoods.
R.3 Dirichlet Energy Analysis
To further support our theoretical findings, we analyze the Dirichlet energy, measure of smoothness in graph signals. For graph signal f, the Dirichlet energy is defined as:
F((f) = 2
Σ wey (f(1) - f()))
(49)
(KJ)EE
36

---

where Wij is the weight of edge (i,5). Higher Dirichlet energy indicates preservation of more high-freequ feehffreueenyy components.
Proposition R.2. The residual propagation mechanism in CGADM preserves higher Dirichlet energy
compared to standard GNN aggregation, resulting in less smoothed node representations.
Proof. Let (()) represent the node representations layer For standard GNN aggregation:
GNN (0)
(w) +
Σ mEN(U)
p(- (
(50)
((O)+1 +1
For CGADM's residual propagation:
CGADM (v) (1) Www'l
Σ (()
(51)
ueN(o)
Focusing on the edge (i, for standard GNN:
(NN (1) (i) I
(1-1)(1)+ + Σ (u)
(52)
mEN((1
((-1) Σ (1)
(53)
MEN()
This averaging operation reduces the difference between adjacent nodes, decreasing the Dirichlet energy.
For CGADM's residual propagation:
()) (G)DM(()) FEGADDM (f) (()-
Σ (w)
(54)
Wiii
uEN()
((ー WGI
Σ dEN()
(()
(55)
This operation emphasizes the differences between a node and its neighborhood average, preserving and potentially amplifying the differences between adjacent nodes, thus maintaining higher Dirichlet energy.
Empirically, as shown in our experiments (Table CGADM maintains significantly higher Dirichlet energy compared to standard GNN aggregation, confirming our theoretical analysis.
Broader Impact
This research on Conditional Graph Anomaly Diffusion Model (CGADM) has significant potential for positive social impact across multiple domains. By improving the detection of anomalous nodes in large-scale graphs, our work enhance fraud detection systems in financial networks, helping protect consumers and institutions from financial crimes. social networks, it can identify malicious actors attempting to spread misinformation engage in coordinated inauthentic behavior. By providing more accurate, efficient anomaly detection, CGADM can contribute to creating safer digital environments while minimizing false positives that might otherwise affect legitimate users.
37


Reviews:
[{"review_id": "xsW4WnZ9ft", "reviewer": "Reviewer_6Eqp", "summary": "This paper introduces Conditional Graph Anomaly Diffusion Model (CGADM), a novel generative approach for graph anomaly detection. Unlike prior discriminative models or data augmentation techniques, CGADM directly models the joint anomaly distribution via a conditional diffusion process. The key contributions include (1) a prior-guided diffusion framework that integrates pre-trained anomaly priors into both forward and reverse processes, (2) a confidence-aware strided sampling strategy for computational efficiency, and (3) thorough theoretical analysis and empirical evaluation demonstrating superior performance over state-of-the-art baselines across diverse datasets. The method achieves notable improvements in AUPRC/AUROC and offers robustness against feature obfuscation and data imbalance.", "questions": "1. How sensitive is the method to the choice of prior model (e.g., RF, XGBT, et al.)? What is the criteria for its selection?\n2. See Weaknesses.", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "S1.The good point of this paper is to propose a novel generative diffusion-based paradigm beyond traditional discriminative or augmentation methods.\n\nS2.The efficient prior-aware sampling can balance the accuracy and computation.\n\nS3.The implementation and evaluation parts are detailed. Extensive experiments on 5 benchmarks demonstrate superior performance.\n\nW1.Considering the time and space complexity of introducing diffusion model, I recommend the author to conduct empirical experiments on large scale real-world datasets e.g. DGraph, T-Social, to verify efficiency on time and memory.\n\nW2.It will be better to take the latest related work into account. \n\n[1] Li et al. DiffGAD: A Diffusion-based Unsupervised Graph Anomaly Detector. ICLR 2025.", "was_revised": true, "final_justification": "The authors address the time and memory issue in the rebuttal, and successfully distinguish DiffGAD and CGADM from the perspective different settings (supervised and unsupervised).", "rebuttal": "We sincerely thank the reviewer for the constructive feedback and positive assessment of our work. We are pleased that the reviewer appreciates our novel generative diffusion-based paradigm, efficient prior-aware sampling, and thorough experimental evaluation. We address the reviewer's concerns below.\n\n> W1. Considering the time and space complexity of introducing diffusion model, I recommend the author to conduct empirical experiments on large scale real-world datasets e.g. DGraph, T-Social, to verify efficiency on time and memory.  \n\nWe appreciate the reviewer's concern about computational efficiency. In fact, we have provided comprehensive empirical results on efficiency in **Appendix N**, where we conducted experiments on the real-world **Elliptic dataset** containing **203,769 nodes and 234,355 edges**, which represents a large-scale graph.   \n\nOur results demonstrate that CGADM achieves:   \n- **Memory usage**: 1048 MB (comparable to baseline methods)\n- **Training time**: 2.21s per epoch (reasonable overhead compared to 0.75s for BWGNN)\n- **Inference time**: 0.5691s (acceptable for the significant performance gains)\n\nThese results confirm that CGADM strikes an effective balance between accuracy and efficiency, with the performance improvements (+10% AUPRC over BWGNN) justifying the modest computational overhead.\n\nTo further address the reviewer's suggestion, we have conducted additional experiments on the **T-Social dataset** (5,781,065 nodes, 73,105,508 edges)\n\n\n| **Model** | **Memory (GB)** | **Training Time (s/epoch)** | **Inference Time (s)** |\n|-----------|-----------------|----------------------------|----------------------|\n| BWGNN     | 38.31        | 1.52                       | 0.821              |\n| GHRN      | 38.48            | 2.89                       | 0.912              |\n| **CGADM** | **38.55**        | **4.34**                   | **3.124**          |\n\nOur observations on this large-scale graph are consistent with our analysis in Appendix N. The memory bottleneck is primarily determined by storing the node feature matrix and sparse edge matrix, which explains the comparable memory usage across methods. From a temporal perspective, training times remain within the same order of magnitude for competitive methods.\n\nRegarding inference time, while our method requires more time than discriminative approaches, this overhead is justified by the novel generative anomaly detection paradigm. As we noted in Appendix N: \"While our inference time is higher than most discriminative methods, the increase is justified given the novel generative anomaly detection paradigm. Considering the already low baseline inference time of anomaly detection tasks, the additional time overhead is acceptable, especially in scenarios where performance improvements are critical.\"   \n\n\n---\n\n\n\n\n> W2. It will be better to take the latest related work into account.  \n\nWe thank the reviewer for bringing DiffGAD to our attention. We will update our related work section to include this recent contribution. \n\nThe fundamental distinction between CGADM and DiffGAD lies in the task setting: **DiffGAD is explicitly designed for unsupervised learning**, while **CGADM operates in a supervised setting**. This core difference leads to fundamentally different objectives and methodologies. While DiffGAD improves traditional reconstruction-based methods through diffusion modeling, CGADM introduces a novel generative framework that fundamentally changes the anomaly detection paradigm by directly modeling the anomaly distribution rather than relying on reconstruction errors.\n\nTo better demonstrate the effectiveness of our approach, we have conducted experiments comparing CGADM with DiffGAD in our supervised setting:\n\n| **Model** | **Elliptic** |  | **Amazon** |  | \n|-----------|-------------|-------|------------|-------|\n|           | **AUPRC**   | **AUROC** | **AUPRC** | **AUROC** | \n| DiffGAD | 6.16 | 25.81 | 13.52 | 71.65 | \n| **CGADM** | **97.03** | **99.34** | **91.91** | **97.36** | \n\nThese results clearly demonstrate that our supervised generative approach achieves superior performance compared to reconstruction-based methods.  \n\n---\n\n\n\n\n> Q1. How sensitive is the method to the choice of prior model (e.g., RF, XGBT, et al.)? What is the criteria for its selection?  \n\n\nWe have addressed this important question in **Section 5.3** (\"Comparison with Different Prior Model\") and **Figure 2**. Our experiments on the Elliptic and YelpChi datasets compared CGADM's performance using Random Forest (RF) and XGBoost (XGBT) as prior estimators.\n\n**Key findings from our analysis:**\n\n1. **Robustness**: As shown in Figure 2, while XGBT achieves significantly higher baseline performance than RF, the final performance of $CGADM_{XGBT}$ and $CGADM_{RF}$ are remarkably close, with both substantially outperforming their respective priors. This demonstrates our diffusion process's strong robustness—it can effectively correct and improve even less accurate initial priors through its iterative, topology-guided denoising mechanism, successfully leveraging graph structure to compensate for initial estimation errors.\n\n2. **Selection Criteria**: The primary criterion for selecting the prior model is **balancing predictive accuracy with computational efficiency**. We choose lightweight and efficient models like RF and XGBT because they provide excellent performance-to-cost ratios, offering reasonably accurate anomaly estimates without introducing significant computational complexity. This ensures our framework remains scalable for large-scale graphs.\n\nAs stated in our paper (Section 5.3): \"This indicates that our CGADM possesses strong robustness. Even in the face of initially inaccurate prior estimates, our CGADM can effectively correct the results under the iterative refinement of the topological-guided denoising network.\"\n\n---\n\nWe hope these responses adequately address the reviewer's concerns. We are committed to incorporating all suggested improvements in the camera-ready version and believe these additions will further strengthen our contribution."}, {"review_id": "JtgL4zujzF", "reviewer": "Reviewer_Cmcp", "summary": "This paper focuses on Graph Anomaly Detection (GAD), and introduce a Conditional Graph Anomaly Diffusion Model (CGADM) to address the over-smoothing and feature obfuscation issues of traditional Graph Neural Networks (GNNs). CGADM uses a prior-guided diffusion process, incorporating a pre-trained conditional anomaly estimator into both forward and reverse diffusion chains. It also introduces a prior confidence-aware mechanism to adaptively determine reverse denoising steps for computational efficiency.", "questions": "Please see the weaknesses above", "limitations": "yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "***Strengths***\n\n1. The paper introduces the diffusion model into the field of GAD. Instead of using DM for data expansion, it directly uses DM to fit the joint probability distribution of the data to detect outliers. This is the difference between the article and the existing work. A large number of experiments have proved the effectiveness of this method.\n\n2. A large number of formula derivations in the text are an advantage, and a large number of experiments have proved the effectiveness of this method.\n\n***Major weakness***\n1. The diffusion model can fit the probability distribution of the dataset. Please test the cross-domain generalization. For example, when the model trained on the Ellip dataset is tested on Yelp, does it still significantly improve?\n\n2. The performance of the model seems unstable. There is a significant improvement in Ellip and Yelp, but it seems to have no effect on Reddit and Tolo. Please analyze it in connection with the inherent shortcomings of the discriminative model mentioned in the article from the data level. \n\n3. It is mentioned in the paper that CGADM solves the problem of fraudulent nodes, but it is not further explained in the paper, nor is there any related experiment, and as can be seen from Figure 1, CGADM also uses a GNN-based network. Is this a heuristic inference? If not, please supplement relevant experiments.\n\n4 The paper does not present the network structure and the training inference process. Moreover, as can be seen from Table 1, the experimental results of CGADM and XGBGraph are close, especially in the evaluation on the Yelp dataset. The author needs to present the network details more clearly and explain the differences from XGBGraph. Meanwhile, if there are parts in the CGADM model that refer to the XGBGraph, ablation experiments are required.\n\n5 The reverse step of the diffusion model has a significant impact. However, as can be seen from Figure 4, it seems that CGADM does not conform to this characteristic. Instead, it drops sharply when the step is from 1 to 0. Does this mean that the core of CGADM is still a GNN-based network rather than a conditional diffusion? The author also needs to explain the abnormal spikes that appear on the AUROC curve.\n\n***Minor weakness***\n1 In Table 1, the data listed on Reddit shows that the test results of CGADM are not the highest scores, but they have been bolded, which is misleading. Meanwhile, CONSISGAD has the highest test result on Quest but is not bold.", "was_revised": true, "final_justification": "The reviewer thanks the authors for their effort and timely response. Most of the concerns have been addressed. The reviewer suggests that the authors include the experiments of rebuttal in the revised version and clarify the methodologies to avoid confusion for readers. The reviewer is also happy to raise the score from 3 to 4.", "rebuttal": "We sincerely thank the reviewer for their thorough evaluation and constructive feedback. We address each concern below with additional experiments.\n\n> W1. Cross-domain Generalization\n\nFollowing your suggestion, we conducted zero-shot cross-domain experiments where models trained on **Elliptic** were evaluated on **YelpChi** and **Tolokers** without fine-tuning.\n\n**Table R1: Zero-shot Cross-domain Generalization Performance**\n\n| Model | Train Dataset | Test Dataset | AUPRC (%) | AUROC (%) |\n|-|---|--|--|--|\n| GHRN | Elliptic | YelpChi | 18.72 | 55.41 |\n| **CGADM (Ours)** | Elliptic | **YelpChi** | **24.59** | **61.03** |\n| *Improvement* | | | *+31.3%* | *+10.1%* |\n| GHRN | Elliptic | Tolokers | 22.15 | 60.18 |\n| **CGADM (Ours)** | Elliptic | **Tolokers** | **27.88** | **64.72** |\n| *Improvement* | | | *+25.9%* | *+7.5%* |\n\nDespite expected performance drops in zero-shot settings, **CGADM consistently outperforms GHRN by significant margins**, suggesting our model captures more fundamental and transferable anomaly patterns.\n\n---\n\n\n> W2. The performance of the model seems unstable. There is a significant improvement in Ellip and Yelp, but it seems to have no effect on Reddit and Tolo. Please analyze it in connection with the inherent shortcomings of the discriminative model mentioned in the article from the data level.  \n\n\nWe respectfully disagree with the characterization that our model \"has no effect\" on Reddit and Tolokers.   \n\nAnd we extracted the relevant metrics for top-performing methods on these datasets:   \n\n**Table R2: Performance Analysis on Tolokers and Reddit Datasets**\n\n| Method | **Tolokers** | | **Reddit** | | Avg. Rank |\n|--|---|---|---|---|--|\n| | AUPRC | AUROC | AUPRC | AUROC | |\n| GODM | **46.15** | 76.42 | 5.55 | 62.10 | 3.25 |\n| CGADM (Ours) | 46.02 | **79.68** | 5.79 | 65.85 | **1.75** |\n| GHRN | 45.25 | 77.98 | **5.85** | 63.51 | 2.75 |\n| CONSISGAD | 40.59 | 76.03 | 5.57 | **66.99** | 3.25 |\n\nAs shown in Table R2:\n\n- On **Tolokers**: GODM achieves the best AUPRC (46.15%), but CGADM is extremely close at 46.02% (only 0.13% difference) while achieving the **best AUROC (79.68%)**  \n- On **Reddit**: GHRN has the best AUPRC (5.85%), with CGADM at 5.79% (only 0.06% difference), while CONSISGAD achieves the best AUROC (66.99%), with CGADM at 65.85% (1.14% difference)  \n\n**Critical observation**: From Table 1 in the paper, GODM, GHRN, and CONSISGAD **fail to maintain their performance across other datasets**:\n- GODM (best on Tolokers AUPRC) drops to 51.77% on YelpChi, far below our 76.54%  \n- CONSISGAD (best on Reddit AUROC) achieves only 41.74% AUPRC on YelpChi, while we achieve 76.54%  \n- GHRN (best on Reddit AUPRC) is outperformed by CGADM on 3 out of 5 datasets  \n\n\nThis analysis demonstrates that while individual methods may slightly edge out CGADM on specific dataset-metric combinations, they exhibit **significant performance drops** on other datasets. In contrast, **CGADM maintains first-tier performance across all 5 datasets** with anomaly ratios ranging from 3.0% to 21.8%, as evidenced by our **highest average scores** (48.78% AUPRC, 81.39% AUROC). This consistency is the true indicator of model **stability** - the ability to perform well across diverse data characteristics without overfitting to specific datasets.  \n\n\n---\n\n> W3. It is mentioned in the paper that CGADM solves the problem of fraudulent nodes, but it is not further explained in the paper, nor is there any related experiment, and as can be seen from Figure 1, CGADM also uses a GNN-based network. Is this a heuristic inference? If not, please supplement relevant experiments.  \n\nOur claim is not merely heuristic but grounded in CGADM's two core mechanisms:\n\n**1. Denoising Reconstruction Against Camouflage:** Our iterative refinement process is designed to recover true anomaly signals even from obfuscated features. To validate this, we conducted new experiments with feature perturbations on Elliptic and Tolokers datasets. As shown in the newly added **Figure 5** (Appendix P), CGADM's performance degrades much more slowly than GHRN under feature manipulation, demonstrating superior robustness.\n\n**2. Mitigating Over-smoothing via Residual Propagation:** While we use a GNN-based denoiser, it's specifically designed to avoid over-smoothing. As detailed in **Equation (9)**, our residual propagation mechanism acts as a **high-pass filter** that preserves high-frequency anomaly signals, unlike standard GNNs that act as low-pass filters.\n\nWe provide direct evidence through a ablation study in **Appendix Q**, comparing our full model ($CGADM_{HP}$) with a variant using standard GCN low-pass filtering ($CGADM_{LP}$). **Table 9** shows that $CGADM_{HP}$ consistently outperforms $CGADM_{LP}$, with the performance gap widening as GNN layers increase. Additionally, we provide rigorous **theoretical analysis** in **Appendix S** formally proving how our model captures long-range dependencies while avoiding over-smoothing.\n\n---\n\n> W4. The paper does not present the network structure and the training inference process. Moreover, as can be seen from Table 1, the experimental results of CGADM and XGBGraph are close, especially in the evaluation on the Yelp dataset. The author needs to present the network details more clearly and explain the differences from XGBGraph. Meanwhile, if there are parts in the CGADM model that refer to the XGBGraph, ablation experiments are required.  \n\nWe appreciate this feedback.\n\n**Network and Training Details:** The training and inference procedures are detailed in **Algorithm 2** (Appendix J) and **Algorithm 3** (Appendix K), respectively. Our topological-guided denoising network is described in **Appendix I**. We will add clearer pointers to these sections in the main text.\n\n**Fundamental Differences from XGBGraph:** We emphasize that **CGADM and XGBGraph are fundamentally different with no shared components**:\n- **Paradigm:** CGADM is a **deep generative model** learning joint anomaly distributions via diffusion. XGBGraph is a **discriminative model** using gradient-boosted trees with graph features.\n- **Architecture:** Our core is a GNN-based denoiser trained within a diffusion framework. XGBGraph uses tree ensembles. There is no architectural overlap.\n- **Performance:** XGBGraph's strong performance on YelpChi likely stems from its rich hand-crafted features that suit tree-based models. However, CGADM achieves SOTA results without such heavy domain-specific feature engineering, demonstrating superior generalization across 9 datasets.\n\n---\n\n> W5. The reverse step of the diffusion model has a significant impact. However, as can be seen from Figure 4, it seems that CGADM does not conform to this characteristic. Instead, it drops sharply when the step is from 1 to 0. Does this mean that the core of CGADM is still a GNN-based network rather than a conditional diffusion? The author also needs to explain the abnormal spikes that appear on the AUROC curve.  \n\n\nWe thank the reviewer for this insightful observation about Figure 4. We would like to clarify the interpretation of our results and explain the observed phenomena.\n\n**Regarding the sharp drop when K approaches 0:**\n\nThe sharp performance drop when K approaches 0 (i.e., when we use very few or no diffusion steps) demonstrates that **the diffusion process is indeed essential to CGADM's performance**. This behavior is exactly what we would expect from a properly functioning diffusion model:\n\n1. When K = 0-2, we essentially bypass the iterative refinement process, relying almost entirely on the initial prior $g_\\phi(\\mathcal{E}, \\mathbf{X})$. The significant performance degradation (AUPRC drops to ~60%) confirms that the diffusion process contributes approximately 16% improvement in AUPRC.\n\n2. The performance stabilizes and improves as K increases, demonstrating that the iterative denoising process progressively refines the anomaly predictions by incorporating both topological information and the prior knowledge.\n\nThis pattern actually **validates** that CGADM is a true conditional diffusion model where both components (the GNN-based denoiser and the diffusion process) work synergistically. If CGADM were merely a GNN-based network, we would expect relatively stable performance across all K values.\n\n**Regarding the AUROC spike around K=20:**\n\nThe spike in AUROC (reaching 90.11% at K=20) while AUPRC remains relatively stable is an interesting phenomenon that can be explained by the different sensitivities of these metrics:\n\n1. **AUROC vs AUPRC sensitivity**: AUROC measures the overall ability to rank anomalies higher than normal nodes across all possible thresholds, while AUPRC focuses more on precision at high recall levels. For imbalanced datasets like ours (YelpChi has 14.5% anomaly ratio), AUPRC is generally more stable and informative.\n\n2. **Optimal denoising balance**: At K=20, we hypothesize that the model achieves an optimal balance between denoising and prior preservation. With too few steps (K<20), the model under-denoises; with too many steps (K>20), it might over-smooth some discriminative features. This sweet spot particularly benefits the ranking capability measured by AUROC.\n\n3. **Theoretical justification**: According to our theoretical analysis in Appendix S, the effective receptive field is proportional to L×K. At K=20 with L=3 layers, the model captures information from 60-hop neighborhoods, which might coincide with the characteristic scale of anomaly patterns in YelpChi's dense graph structure (3.8M edges).  \n\n---\n\n> Minor weakness  \n\nWe sincerely apologize for the bold formatting error in Table 1. This was an oversight during data transcription, and we will correct it in the revised version."}, {"review_id": "ODcReNiUPI", "reviewer": "Reviewer_5DnS", "summary": "This work studies the problem of anomaly detection in graphs. The authors propose directly generating anomaly predictions using a diffusion model and conditioning this generation process on a prior. The experimental results show a noticeable gain.", "questions": "Please refer to Cons.", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Pros:\n- The proposed method is closely related to the weaknesses of current methods, as pointed out in the introduction section.\n- The authors have given enough evidence and argument to justify why a generative discrimination approach is helpful and necessary. So, I feel the integration of diffusion models is well motivated.\n\nCons:\n- The proposed method relies on a prior network, which might introduce additional risks to performance if it is not well-trained. Hence, I suggest providing the results under different pre-trained diffusion models.\n- Some closely related papers are not discussed. For example, [a] proposed an anomaly-denoised augmentation method for graph anomaly detection. It is recommended to discuss more related work and compare with them.\n- The font in Figure 1 is a little small, making it not easy to recognize.\n- Some bold and underlined fonts are missing in Table 1.\n\n[a] ADA-GAD: Anomaly-Denoised Autoencoders for Graph Anomaly Detection, AAAI 2024.", "was_revised": true, "final_justification": "The authors' response has addressed my concerns. My current rating already reflects my positive attitude towards this work, so I will keep it unchanged.", "rebuttal": "We sincerely thank the reviewer for their positive assessment and valuable feedback. We appreciate the recognition of our well-motivated integration of diffusion models and the solid experimental gains. We address each concern below.\n\n> W1. The proposed method relies on a prior network, which might introduce additional risks to performance if it is not well-trained. Hence, I suggest providing the results under different pre-trained diffusion models.  \n\n\nWe appreciate the reviewer's concern about the dependency on the prior network. We have actually addressed this important consideration in **Section 5.3 \"Comparison with Different Prior Models\"** and presented the results in **Figure 2**.  \n\nIn our analysis, we evaluated CGADM using two different lightweight models as prior estimators: Random Forest (RF) and Extreme Gradient Boosting Tree (XGBT). Our key findings demonstrate:  \n\n1. **Significant improvement over priors:** Both $CGADM_{RF}$ and $CGADM_{XGBT}$ consistently outperform their respective initial priors. For example, on the YelpChi dataset, CGADM improves AUPRC from 68.48% (XGBT prior) to 76.54%, demonstrating the effectiveness of our diffusion-based refinement process.  \n\n2. **Robustness to prior quality:** The performance gap between CGADM variants using different priors ($CGADM_{RF}$ vs. $CGADM_{XGBT}$) is significantly smaller than the gap between the priors themselves (RF vs. XGBT). This indicates that our model is robust and can achieve state-of-the-art results even when starting from a less accurate prior, as the topological-guided denoising network effectively corrects initial estimates.  \n\nThis analysis confirms that while a good prior is beneficial, our framework is not overly sensitive to the initial prior quality and reliably improves anomaly detection performance.  \n\n\n---\n\n> W2. Some closely related papers are not discussed. For example, [a] proposed an anomaly-denoised augmentation method for graph anomaly detection. It is recommended to discuss more related work and compare with them.  \n\nWe thank the reviewer for pointing out this related work. We acknowledge that ADA-GAD [AAAI 2024] presents an anomaly-denoised augmentation approach for graph anomaly detection. While ADA-GAD primarily focuses on unsupervised anomaly detection using an autoencoder-based graph reconstruction framework, we agree it deserves discussion in our related work section.  \n\nTo comprehensively address this suggestion, we conducted additional experiments comparing CGADM with ADA-GAD adapted to our supervised setting. The results are as follows:  \n\n| Dataset | Method | AUPRC | AUROC |\n|---------|---------|--------|--------|\n| Elliptic | ADA-GAD | 8.27 | 45.53 |\n|         | **CGADM** | **97.03** | **99.34** |\n| Amazon | ADA-GAD | 12.00 | 60.59 |\n|         | **CGADM** | **91.91** | **97.36** |\n\n\nThese results demonstrate that our generative approach significantly outperforms the reconstruction-based method. We will include this comparison in our revised manuscript and add a more comprehensive discussion of related diffusion-based approaches for unsupervised graph anomaly detection in the related work section.  \n\n---\n\n> W3. The font in Figure 1 is a little small, making it not easy to recognize.  \n\nWe appreciate this feedback regarding the readability of Figure 1. We will increase the font size in all figures to ensure better clarity in the revised version.  \n\n\n---\n\n\n> W4. Some bold and underlined fonts are missing in Table 1.  \n\nThank you for pointing out the formatting inconsistencies in Table 1. We acknowledge this oversight and will correct all bold and underlined formatting in the revised version. We will also conduct a thorough review of the entire manuscript to ensure consistent formatting throughout."}, {"review_id": "9bbOaJpL9z", "reviewer": "Reviewer_JBXz", "summary": "This paper presents a methodology for detecting anomalies in graphical networks using a prior to condition a diffusion process and an adaptive mechanism to determine the number of reverse de-noising steps using prior confidence.  The method addresses adversarial behavior to disguise connectivity signals that may be associated with anomalies.  The paper also includes a range of computational tests on practical datasets demonstrating improvements over existing methods.", "questions": "1) How does the performance degrade with more diffuse priors?\n2) How does performance change with different initial noise levels?  Does this affect the best final noise level \\beta_T?\n3) Given the prior, how badly can performance degrade for a given amount of manipulation from anomalous nodes?", "limitations": "The paper recognizes the overall major limitations in terms of the prior and need for supervised data.  It could have more on informed adversarial actions.", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "The strengths of the paper are in its addressing issues that arise for standard approaches that tend to homogenize graph topologies and are susceptible to feature manipulation.  The results are also well presented and indicate value in the method.  \nWeaknesses include the need for pre-trained priors which may limit its applicability.  It also depends on supervised data which may not be present.  I also wonder whether knowledge of the prior could affect adversarial behavior and subvert the process.  It would help in addition to have some overall theoretical results.", "was_revised": true, "final_justification": "I think all the points raised in the discussion were valid and that the authors responded well to them. I have not altered my score.", "rebuttal": "We thank the reviewer for their thoughtful evaluation and constructive feedback. We appreciate the recognition of our method's strengths in addressing homogenization issues and adversarial behavior. We address each concern below.  \n\n\n> Q1. How does the performance degrade with more diffuse priors?  \n\nWe directly addressed this important question in **Section 5.3 (Figure 2)** of our paper. Our ablation study compared CGADM using Random Forest (RF) as a weaker prior versus XGBoost as a stronger prior. The key findings demonstrate our model's robustness:\n\n1. While the initial performance gap between RF and XGBoost priors is substantial (e.g., on Elliptic dataset: RF achieves 83.11% AUPRC and 96.22% AUROC vs. XGBoost's 87.76% AUPRC and 97.41% AUROC), the final CGADM performance shows minimal degradation ($CGADM_{RF}$: 95.46% AUPRC and 98.36% AUROC vs. $CGADM_{XGBT}$: 97.28% AUPRC and 99.34% AUROC).\n\n2. Both variants achieve significant improvements over their respective priors, demonstrating that our guided diffusion process effectively refines and \"sharpens\" initial estimates regardless of their quality.\n\nThis empirical evidence confirms that while better priors provide advantageous starting points, CGADM is not overly sensitive to prior quality and can effectively denoise imperfect initial estimates through its iterative refinement mechanism.\n\n\n---\n\n>Q2. How does performance change with different initial noise levels? Does this affect the best final noise level $\\beta_T$?  \n\n\nThank you for this insightful question. In our framework, we follow the standard and empirically validated practice from DDPMs by setting the initial noise level $\\beta_1 = 1e-4$ to ensure forward process stability. \n\nOur investigation of the final noise level $\\beta_T$ (**Section 5.4, Figures 3(3) and 3(4)**) reveals its critical importance. $\\beta_T$ defines the maximum scale at which our denoising network can correct the prior. As shown in our results:\n\n- Performance initially improves as $\\beta_T$ increases, allowing greater correction of prior biases\n- Beyond $\\beta_T = 0.02$, performance degrades as excessive noise overwhelms the true signal\n- The optimal $\\beta_T = 0.02$ represents a balance between correction capability and signal preservation\n\nThis parameter essentially controls the \"correction radius\" of our model, and our empirical findings demonstrate that 0.02 provides an effective balance for the ensemble tree priors we employ.\n\n\n---\n\n\n> Q3. Given the prior, how badly can performance degrade for a given amount of manipulation from anomalous nodes?  \n\n\nWe conducted comprehensive experiments to evaluate CGADM's robustness against feature manipulation, presented in **Appendix P (Figure 5)**. We systematically perturbed node features at varying proportions (10%, 20%, 30%) on the Elliptic and Tolokers datasets.\n\nKey findings demonstrate CGADM's superior robustness. This superior robustness stems from our denoising reconstruction mechanism, which leverages information from unperturbed neighbors during the reverse diffusion process to iteratively restore true anomaly signals. Even under 30% feature manipulation, CGADM maintains substantially better performance than the strongest baseline."}, {"review_id": "uqJPuh3dgF", "reviewer": "Reviewer_i9tY", "summary": "The authors propose a Conditional Graph Anomaly Diffusion Model to address over-smoothing and fraudulent nodes evading through the iterative refinement and denoising reconstruction properties of diffusion models. Experiments show the effectiveness of the framework to some extent.", "questions": "Q1. Is it possible to provide the time complexity analysis for CGADM? Although they show the experimental results of some datasets, they didn't provide the running time of large graphs, such as T-Social and DGraph. Thus, it would be better to provide both empirical and theoretical results. \n\nQ2. The results of the baselines presented in this paper are much lower than the original baseline papers, can the framework still outperform those baselines under the same settings?", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 1, "strengths_and_weaknesses": "S1. The authors propose a Conditional Graph Anomaly Diffusion Model to address over-smoothing and fraudulent nodes evading. \n\nS2. Experiments show the effectiveness of the framework to some extent. \n\nW1. The novelty is limited. To be specific, Although the authors claim this is a novel framework implementing a diffusion-based model to solve the above-mentioned problem, they fail to present major differences from original diffusion models in related areas. Instead, it seems that they only slightly change the equation of the diffusion process without explaining the connection between the process and graph, i.e., the change of the equations lies in directly replacing X with (E, X). \n\nW2. Some novel baselines in this area are ignored. For example, UnifyGAD[1] and SpaceGNN[2] are two SOTA models in related areas. They should take these frameworks into consideration.\n\nW3. The authors should pay more attention to their writing. For example, in Table 1, for the AUROC of Quest and Reddit, and the AUPRC of Reddit, they mark the wrong data as the best results, which may mislead reviewers. \n\nReference: \n\n1. Yiqing Lin, Jianheng Tang, Chenyi Zi, H. Vicky Zhao, Yuan Yao, Jia Li. UniGAD: Unifying Multi-level Graph Anomaly Detection. NeurIPS 2024. \n\n2. Xiangyu Dong, Xingyi Zhang, Lei Chen, Mingxuan Yuan, Sibo Wang. SpaceGNN: Multi-Space Graph Neural Network for Node Anomaly Detection with Extremely Limited Labels. ICLR 2025.", "was_revised": true, "final_justification": "Although my major concerns still lie in the novelty, and I am still curious about the semi-supervised setting in XGBGraph, I tend to increase my rating to thank the effort the authors made in the rebuttal.", "rebuttal": "We thank the reviewer for their thoughtful comments and constructive feedback. We address each concern below.\n\n> W1. The novelty is limited. To be specific, Although the authors claim this is a novel framework implementing a diffusion-based model to solve the above-mentioned problem, they fail to present major differences from original diffusion models in related areas. Instead, it seems that they only slightly change the equation of the diffusion process without explaining the connection between the process and graph, i.e., the change of the equations lies in directly replacing X with (E, X). \n\nWe respectfully disagree with the reviewer's assessment and would like to clarify the substantial innovations in our work:\n\n**1. Paradigm Shift from Discriminative to Generative Modeling:** Unlike existing GAD methods that learn decision boundaries, CGADM fundamentally reformulates graph anomaly detection as modeling the joint conditional distribution $p(\\mathbf{y}_0|\\mathcal{E}, \\mathbf{X})$ over the entire graph. This is not a trivial extension but a novel model-centric approach that directly generates anomaly probabilities through iterative refinement.\n\n**2. Graph-Specific Diffusion Process:** Our modifications are far from \"directly replacing X with (E, X)\". We introduce:\n- **Prior-guided diffusion** (Eq. 4-6): Instead of diffusing to standard Gaussian noise, we diffuse to a graph-conditioned prior $\\mathcal{N}(g_{\\phi}(\\mathcal{E}, \\mathbf{X}), I)$, which provides crucial inductive bias for anomaly detection.\n- **Topological-guided denoising network** (Section 4.2): Our denoiser incorporates a residual propagation mechanism (Eq. 9) that preserves high-frequency anomaly signals while leveraging graph structure, addressing the over-smoothing issue inherent in GNNs.\n- **Prior-aware strided sampling** (Section 4.4): We adaptively adjust sampling steps based on prior confidence, significantly improving efficiency without sacrificing accuracy.\n\n**3. Theoretical Foundation:** We provide rigorous theoretical analysis (Appendix S) showing how our approach captures $(L \\times T)$-hop neighborhood information without over-smoothing, which is impossible for traditional $(L \\times T)$-layer GNNs.\n\nThe effectiveness of these innovations is evidenced by our substantial performance improvements: +6.15% AUPRC and +4.53% AUROC over the best baselines on average.\n\n---\n\n\n> W2. Some novel baselines in this area are ignored. For example, UnifyGAD[1] and SpaceGNN[2] are two SOTA models in related areas. They should take these frameworks into consideration.  \n\n\nWe appreciate the reviewer pointing out these recent works. However:\n\n- **UniGAD** addresses **graph-level** anomaly detection, while our work focuses on **node-level** anomaly detection. These are fundamentally different problems and cannot be directly compared.\n- **SpaceGNN (ICLR 2025)** was published concurrently with our submission and thus could not be included in our original manuscript.\n\nTo address this concern, we have conducted additional experiments comparing CGADM with the concurrent work:\n\n| **Model** | **AUPRC (Elliptic)** | **AUROC (Elliptic)** | **AUPRC (YelpChi)** | **AUROC (YelpChi)** |\n|-----------|---------------------|---------------------|-------------------|-------------------|\n| SpaceGNN | 94.82 | 98.56 | 73.21 | 91.38 |\n| **CGADM** | **97.03** | **99.34** | **76.54** | **92.69** |\n\n\nOur method consistently outperforms these strong baselines, demonstrating the effectiveness of our generative approach even against the most recent advances in the field.\n\n\n---\n\n> W3. The authors should pay more attention to their writing. For example, in Table 1, for the AUROC of Quest and Reddit, and the AUPRC of Reddit, they mark the wrong data as the best results, which may mislead reviewers.  \n\n\nWe sincerely apologize for these marking errors in Table 1. The reviewer is correct—we mistakenly highlighted incorrect values for AUROC of Quest and Reddit, and AUPRC of Reddit. These were transcription errors during table preparation. We will correct these markings in the revised version to ensure clarity and accuracy.  \n\n\n---\n\n> Q1. Is it possible to provide the time complexity analysis for CGADM? Although they show the experimental results of some datasets, they didn't provide the running time of large graphs, such as T-Social and DGraph. Thus, it would be better to provide both empirical and theoretical results. \n\n\nThank you for this excellent question. We provide both theoretical and empirical analyses below.  \n\n**Theoretical Time Complexity:**\n- **Training:** The main cost lies in the denoising network $\\epsilon_{\\theta}$. For each batch, this involves an $L$-layer GNN and MLP. The GNN complexity is $O(L \\cdot |\\mathcal{E}| \\cdot d + L \\cdot N \\cdot d^2)$, where $N$ is the number of nodes, $|\\mathcal{E}|$ is the number of edges, and $d$ is the feature dimension.\n- **Inference:** The complexity is $O(K \\cdot (L \\cdot |\\mathcal{E}| \\cdot d + L \\cdot N \\cdot d^2))$, where $K$ is the number of denoising steps. Our **prior-aware strided sampling** (Section 4.4) adaptively reduces $K$ from 1000 to ~583 on average, providing significant efficiency gains.  \n\n**Empirical Results on Large Graphs:**\nWe conducted experiments on the T-Social dataset (5,781,065 nodes, 73,105,508 edges):\n\n| **Model** | **Memory (GB)** | **Training Time (s/epoch)** | **Inference Time (s)** |\n|-----------|-----------------|----------------------------|----------------------|\n| BWGNN     | 38.31          | 1.52                       | 0.821                |\n| GHRN      | 38.48          | 2.89                       | 0.912                |\n| **CGADM** | **38.55**      | **4.34**                   | **3.124**            |\n\nOur observations on this large-scale graph are consistent with our analysis in Appendix N. The memory bottleneck is primarily determined by storing the node feature matrix and sparse edge matrix, which explains the comparable memory usage across methods. From a temporal perspective, training times remain within the same order of magnitude for competitive methods.  \n\nWhile inference time is higher, this is justified by our novel generative paradigm that achieves substantial performance improvements. As noted in Appendix N, the additional overhead is acceptable given the critical performance gains in anomaly detection scenarios.  \n\n\n---\n\n>Q2. The results of the baselines presented in this paper are much lower than the original baseline papers, can the framework still outperform those baselines under the same settings?  \n\n\nAll methods, including CGADM and baselines, were evaluated under **identical experimental conditions** to ensure fair comparison. We intentionally used a more challenging setting with only 20% training data (vs. higher percentages in some original papers) to better reflect real-world anomaly detection scenarios where labeled data is scarce. This setting particularly highlights the advantages of our generative approach, which can better leverage the graph structure and prior knowledge when training data is limited.  \n\nUnder these consistent conditions, CGADM demonstrates clear superiority, validating the effectiveness of our approach in practical scenarios with limited supervision."}]

Author rebuttal:

Meta-review: This paper proposes CGADM, a conditional graph anomaly diffusion model that reformulates graph anomaly detection as a generative modeling task. The method integrates prior-guided diffusion, a residual propagation denoising network to mitigate over-smoothing, and a confidence-aware sampling strategy for efficiency. Reviewers generally found the work novel, technically solid, and empirically strong, with consistent improvements over strong baselines across diverse datasets, as well as additional validation provided in the rebuttal. While some concerns were raised regarding novelty, evaluation settings, and semi-supervised scenarios, these were largely addressed, and multiple reviewers raised their scores after discussions. Overall, the contribution represents a meaningful methodological advancement for graph anomaly detection, with broad empirical support.
Decision: Accept (poster)