IA-GGAD: Zero-shot Generalist Graph Anomaly Detection via Invariant and Affinity Learning
Authors: Xiong Zhang
Zhenli He
Changlong Fu
Cheng Xie
Venue: NeurIPS 2025 spotlight ()
Keywords: Generalist Graph Anomaly Detection;
Primary area: general_machine_learning
TL;DR: A Generalist  Graph Anomaly Detection model (one-for-all) addresses  Feature Space Shift (FSS) and the Graph Structure Shift (GSS) problems.

Abstract: Generalist Graph Anomaly Detection (GGAD) extends traditional Graph Anomaly Detection (GAD) from one-for-one to one-for-all scenarios, posing significant challenges due to Feature Space Shift (FSS) and Graph Structure Shift (GSS). This paper first formalizes these challenges and proposes quantitative metrics to measure their severity. To tackle FSS, we develop an anomaly-driven graph invariant learning module that learns domain-invariant node representations. To address GSS, a novel structure-insensitive affinity learning module is introduced, capturing cross-domain structural correspondences via affinity-based features. Our unified framework, IA-GGAD, integrates these modules, enabling anomaly prediction on unseen graphs without target-domain retraining or fine-tuning. Extensive experiments on benchmark datasets from varied domains demonstrate IA-GGAD’s superior performance, significantly outperforming state-of-the-art methods (e.g., achieving up to +12.28\% AUROC over ARC on ACM). Ablation studies further confirm the effectiveness of each proposed module. The code is available at \url{https://github.com/kg-cc/IA-GGAD/}.

IA-GGAD: Zero-shot Generalist Graph Anomaly Detection via Invariant and Affinity Learning
Xiong Zhang"
Zhenli He
School of Software, Yunnan University zhangxiong@stu, ynu. edu.
School of Software, Yunnan University eell0ynu.dd....
Changlong Fu
Cheng Xie
School of Software, Yunnan University fuchanglong@stu, ynu. edu. cn
School of Software, Yunnan University xiecheng@ynu. edu. on
Abstract
Generalist Graph Anomaly Detection (GGAD) extends traditional Graph Anomaly Detection (GAD) from one-for-one one-for-all scenarios, posing significant challenges due to Feature Space Shift (FSS) and Graph Structure Shift (GSS). This paper first formalizes these challenges and proposes quantitative metrics to mea- sure their severity. To tackle FSS, we develop an anomaly-driven graph invariant learning module that learns domain-invariant node representations. To address GSS, a novel arructure-insensttive affinity learning module is introduced, capturing cross-domain structural correspondences via affinity- based features. Our unified framework, IA-GGAD integrates these modules, enabling anomaly prediction unseen graphs without target-domain retraining or fine-tuning. Extensive ex- periments on benchmark datasets from varied domains demonstrate IA-GGAD 's superior performance, significantly outperforming state-of-the-ee thetrrrrrt methods (e.g.. achieving to +1 +12.28 8 % AUROC over ARC on ACM), Ablation studies fur- ther confirm the effectiveness of each proposed module. The code is available httpps//gittee thub. com/kg-oooo/cc cagg-cc/IAA IC/IA-GAAA
Introduction
Node-level Graph Anomaly Detection (GAD) has become essential tool for identifying suspicious entities complex relational data. Its applications span many critical domains 2 4 5
6 For
example, in finance, anomalous transaction networks reveal fraud money laundering in social media, detecting abnormal user behavior or bot accounts is essential for maintaining platform integrity 10 [1]; and in e-commerce, uncovering unusual purchase review patterns helps identify fraudulent activity 22 [3]. Modern GAD techniques, often based on graph neural 19, have achieved great success on individual tasks, but training separate detectors for each graph or domain is mane-consuming and costly, limiting the applicability GAD unseen anomaly detection environments.
8)
networks [14] 15 16] or statistical models 17
In practice, organizations often manage multiple graph data sources and seek a unified anomaly and challenging
detector. This motivates Generalist Graph Anomaly Detection (GGAD), 20) 21. Unlike setting in which a single model must detect anomalies across diverse graph domains traditional GAD, which trains a dedicated detector per dataset, generalist GAD model aims for one model for all domains. Such cross-domain detection is highly significant in real-world deployments;
"These authors contributed equally. Corresponding author.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Training Domain
Target Domain
Truining Domain
Target Domuin
Feature Space Shift
Cieeeer Graph citstion networky
Flicker Graph socual aetwork)
personal descriptions
strped uneepcoedd
leattond denal locd duscag
Structure Shift!
article citle words
jecamer effenee und mmro
bug
(eerte
Glove BEIT, cit, etc emboidinn
Node feature:
Kode festure:
anomaly node
anomaly node
informat danslty
High information darsity
equressienees
Citeseer Cmihh
Flicker Graph social network)
Assortative
Disassortative
(1 citition networlk)
(a) problem in
problem in GGAD
Figure I: The motivation of the work in the GGAD scenario. (a) A case of the FSS problem between the CiteSeer and Flickr datasets. (b) case of the GSS problem between the Citeseer and Flickr datasets.
for example, a single system could detect fraud in financial transaction network and malicious accounts in a social network using the same model, reducing maintenance burden. However, this generalization requirement introduces substantial domain-shift challenges between different graphs.
Existing GAD approaches have not fully addressed GGAD. Traditional methods typically assume that data comes from a single graph and must be retrained or fine-tuned on each new dataset. Recently, a few works have attempted develop generalist GAD models. For instance, ARC [20] employs an in-context learning strategy with feature alignment module to extract cross-dataset anomaly patterns, and Unprompt [22) uses a prompt- prompt-based based mechanism to unify node representations across graphs While these methods make strides toward generalization, they still struggle to handle fundamental cross-domain shifts. Specifically, we identify two core domain-shift challenges:
Feature Space Shift (FSS): Differences in node feature distributions semantics across domains. Nodes from different domains may differ feature scale, dimensionality, or meaning, causing models trained one domain to misinterpret features from another, as illustrated in Figure (a).
Graph Structure Shift (GSS): Variability in graph structure across different domains. Graphs can exhibit significantly different connectivity patterns (e.g., community structures, average degrees), causing structural patterns normal in one domain to appear anomalous in another, as illustrated in Figure (b).
These shifts cause existing models misinterpret node features or structural cues when applied to new graphs. To tackle these challenges, we propose IA-GGAI (Invariance and Affinity Combined Graph Anomaly Detection), a novel framework that explicitly addresses both FSS and GSS. IA- GGAD combines two key components: invariant feature learning and structure- insettuureiissssiivvee affinity learning. The invariant feature component learns node representations that capture essential anomaly- related patterns while being insensitive to domain-specifie feature shifts, effectively aligning feature spaces across domains. The graph affinity component learns cross-graph structural correspondences, enabling the model to transfer anomaly cues across heterogeneous structures. These components are trained jointly in a unified architecture. Notably, IA-GGAD requires no access to any target-doman data or labels test time for retraining fine-tuning, Once trained source graphs, the model can be directly applied to an unseen target graph without additional adaptation.
We evaluate IA-GGAD on benchmark datasets from diverse domains, including social networks, citation networks, and e-commerce graphs. Empirical results demonstrate that IA-GGAD achieves state-of-the-arr anomaly detection performance across all tasks. It consistently outperforms existing GGAD baselines, achieving substantial improvements in AUROC. For example, on the ACM citation network, IA-GGAD improves AUROC by +1 +2.28% compared with ARC [20] Importantly, these gains are obtained without any target-domain retraining or labeled data, underscoring the practical utility of zero-shot approach.

---

2
Related Work
Recent advances in anomaly detection have moved beyond task-specific models toward generalist approaches that apply diverse domains.
Graph Anomaly Detection. Graph anomaly detection (GAD) aims to identify nodes or substructures in graph that deviate from normal patterns 3 23 24). Traditional GAD methods are typically
trained on a single dataset and can be categorized by supervision level. Supervised GAD uses labeled anomalies (or normal nodes) to train classifier, but acquiring anomaly labels is often infeasible
in practice, such as BGNN [25]. BWGNN B1, GHRN [26), and CAGAD [27]. Semi-supervised
GAD[28] assumes subset of nodes are labeled as normal. For example, Qiao et al. [28] propose S-GAD, a generative semi-supervised method that synthesizes artificial outliers from known normal nodes to train one-class classifier. Unsupervised GAD operates without any labels, often using graph autoencoders or one-class objectives. DOMINANT employs GCNs [14 as an autoencoder to reconstruct graph structure and node attributes and identifies anomalies via the reconstruction error. CoLA based on contrastive learning, uses a discriminator to detect inconsistencies between the target node and neighbor subgraph embeddings. Similarly, TAM [2] and GCTAM 30 extend one-class deep learning to graphs by optimizing an affinity objective over GNN embeddings. These unsupervised methods achieve strong performance individual graphs but must be retrained for
each new graph, limiting their cross-domain generalization.
limitation, recent work proposes generalist graph anomaly detection frameworks. Although some GAD approaches [T 32 can handle cross-domain scenarios, their requirement for high correlation (e.g., aligned node features) between source and target datasets limits their generalizability. Differing from those, Liu er al. [20] introduce ARC, a "one-for-all GAD framework based on in-context learning. ARC aligns node features from different graphs using a learned feature-space projection, encodes residual neighborhood patterns via ego-neighbor graph encoder, and employs a cross-attentive scoring module that compares nodes to a few-shot set of normal examples. This design allows ARC to adapt to new graphs with minimal additional data. Niu al. [22] present UNPrompt, zero-shot generalist GAD model trained on a single source graph. UNPrompt aligns the dimensionality and semantics of node attributes across graphs through coordinate-wis normalization and learns generalized neighborhood prompts so that the predictability of latent node attributes serves as a universal anomaly score. Despite their contributions. ARC and UNPrompt have limitations. ARC still requires a few target-domain normal examples at inference, and its learned alignment may not eliminate all domain shifts. UNPrompt relies on consistent attribute semantics and single-source training setup, which can limit its applicability when graphs vary widely in feature space or structure.
Generalist Graph Anomaly Detection. To overcome the
3 Problem Statement
This section presents the formal problem definition and highlights the key challenges that our framework aims to address.
Preliminaries. Let define an attributed graph as G (V,, AV, where V = [vi,,... uN) is the set of N nodes, X E R ngxx xd = {21.-- 2N\ } is the node feature matrix, and A E {0, 1 is the adjacency matrix such that A.j = indicates an edge between i and vi. Each node ni is associated with a feature vector 2; Rdd.
Task Definition. In the GGAD setting, we aim to learn a generalist graph anomaly detection model from a collection of labeled source-domain graphs Tiain (D(1) train..... (() }. and generalize it to disjoint set of target-domain graphs Tex = { D(m))) without access to any target-domain labels retraining, where n. and n, denote the number of source-domain training datasets and target-domain testing datasets, respectively. Each D (g ())) is a labeled dataset from an arbitrary domain. Unlike traditional GAD methods that build graph-specific detectors, our goal is to develop single generalist graph anomaly detector that can effectively identify anomalies across diverse graph domains with varying semantics and structures.
Key Challenges. GGAD introduces significant challenges due to inherent discrepancies across graph domains. Through empirical investigation and prior studies, we identify two principal sources of domain shift that significantly degrade generalization performance: Feature Space Shift (FSS) and
3

---

Graph Structure Shift (GSS). To rigorously characterize and quantify the severity of these shifts, we introduce two mathematical formulations:
(I) Feature Space Shift (FSS). Given the node feature matrices X and X from source and target domains, respectively, we use Maximum Mean Diserepancy (MMD) to measure the distance between their feature distributions in a reproducing kernel Hilbert space (RKHS). Specifically,
(S x')
Σ (((2)) + No
N? (((x)))
2
NoN
where of.) is an RKHS mapping function, referring to Eq. and No. N₁ denote the number of nodes in source and target graphs, respectively. A larger FSS score reflects greater feature misalignment, leading to unreliable inference across domains.
(2) Graph Structure Shift (GSS), Similarly, we quantify structural discrepancies using degree-derived structural vectors and a Gaussian kernel f'(: y) exp( - u112/2a") Given adjacency matrices A and A' from source and target graphs, GSS is computed
GSS(A" (A A
1
Σ f([A- A A A')) +
1
Σ 1
A', A
N2
N?
(2)
E A4A
N
This metric reflects the misalignment in higher-order structural properties such connectivity profiles and neighborhood distributions. A high GSS score indicates greater structure divergence between source and target graphs.
Empirical Evidence. To further investigate the FSS and GSS challenges, we conduct a quantitative analysis of both FSS and GSS, with detailed results provided in Appendix B
4 Method
To address the twin challenges of FSS and GSS identified in Section 3 we introduce IA-GGAD, an end-to-end, zero-shot framework that learns to detect anomalies on unseen graphs after training on multiple, diverse source domains. Figure 2 gives an overview of IA-GGAD. IA-GGAD
composed of four tightly coupled modules: (1) Invariant feature pool construction (Section 4.1):
align various node representations and extract shared invariant feature pool composed of domain- invariant prototypes; (2) Graph-invariant representation learning (Sectior4.2) embeds node representations using the shared invariant feature pool ensuring that normal and abnormal patterns are consistently separated across domains; (3)
inneesstiiisessiiiveee affinity learning (Section 4.3):
learns affinity-based node representations to enable structure-insensitive cross-graph affinity scoring: (4) Joint anomaly scoring and prediction (Section 4.4): fuses semantic and structural evidence to produce a final, domain-agnon -agnostic anomaly score and predictions.
4.1 Invariant Feature Pool Construction
The first step toward cross-domain generalization is to eliminate feature divergence while retaining critical anlmaly-related and normal patterns.
Feature alignment. Empirical evidence Table 5 shows that node attributes differ widely in
scale, dimensionality, and semanties across datasets. We therefore project every raw feature matrix X E IR xd to a shared latent dimension dy:
X proj R.d...
where p.)j(.) is a learnable linear layer that can be initialized with classical dimensionality-rddeee techniques such as PCA [33], This simple yet effective step standardizes the input space for the subsequent graph encoder.
Shared graph encoder. Following alignment, we feed X into a stack of parameter-shane Graph Convolutional Networks (GCNs) [14 to obtain multihop node embeddings:
z oD ADD+AA" AAD + =xW(l).
.... z = =DD- A lz {21 - 1
(3)

---

Training Demall
BUSC
XLSI
Enonder
Equ
Calcolation
Eq. (1))
Cuff
0:7h
ALF7
Insadtent
(3)
Ety (6)
(7)
Eqg (9)
Lyes
L.4
Invoriaitt Features Poot
Lookup
Danuin Shif
Livev
Features
Socba Features
Lestiau Utemala
Recidial Anomaly Score
Encoder
RS(s)
Eq: (14)
Eq. (6)
Eq. (13)
Str.
Prodiction
GGAD
Trained
Eq. (10)
zero shoet
Encoder
Affinity
Affintty Anomaly
AS
Teiting Process
Figure 2: Overview of IA-GGAD.
where A is the adjacency matrix with self-loops, D its degree matrix, W are learnable weights, (.) is an activation function, and Z the transformed representation matrix at the f-th layer.
Invariant feature extraction. To make the representations immune to feature-space shift, adopt modified Vector curtoo--uaatizeed VAE (VQ-VAE) (34). Each source graph contributes to shared invariant features pool E' = {EI..... eM) Mxd whose entries serve The invariant features pool is initialized from sampled embeddings and refined by the standard assignment update routine:
prototypes.
(1-1)
1 N₂
Σ
140) 3
N, argmin-k (Il=) (6(0))
c (1)),
e(")
(1(11)
(4)
JE(
where ((-1) denotes the result of the i-th invariant feature prototype the 1)-th iteration. In each iteration, & is updated as the mean of its nearest node embeddings 2,- After convergence, a lightweight decoder reconstructs the aligned features x; from the selected prototype, and the entire module is trained with the composite loss:
N
N
N
Linv
x
+
Σ 2=1
|sg[Es] - eall2 +
17 N
Σ
|sg[ss] - -21l
(5)
N
X
N
A=
The composite loss comprises three intuitive terms. (i) Reconstruction. The scaled cosine error
(1
|| (y21) enforces faithful recovery of aligned attributes, encouraging the encoder to
X:k;
retain informative semantics. (ii) VQ update. The quttor-quanizzttion loss || eg pushes each invariant features pool entry e; toward its assigned encoder output 2,, progressively refining the invariant prototypes. (iii) Commimment. The commitment term sg jes] 1l2 penalizes large deviations of the encoder from the selected prototype, stabilizing training. A single hyper-paramete (empirically 0. 0.25) balances invariant features pool adaptation and encoder commitment, while the stop-gradient operator sg[-] prevents back pecckproppgationn through the detached branch.
4.2 Graph-Invariant Representation Learning
While conventional GNNs consume only the ε-layer output embeddings, IA-GGAD enriches every node representation with explicit invariant semantics extracted from the invariant features pool E.
5

---

This fusion yields embeddings that are simultaneously sensitive to local graph context and robust to cross-domain feature shifts.
+nvarriant-feature guided embedding fusion. For each GCN layer f, we retrieve the k invariant
features pool vectors whose cosine similarity with 2; l is highest. Averaging these invariant features and concatenating with 2/ gives an invariant-aware embedding:
h concat(2 [
ej
T. argmax-ki JE(L....,N)
(6)
T
eey
where h/41 Rd is the output embedding matrix with invirant code emebding, T, is set of invariant feature emebding that are closest to the current node representation. 2!4
Multi-hop residual encoding. To capture how node's representation drifts across message-passing layers, we take successive differences with the 1-hop baseline n:!") and concatenate them:
Ti (h,- - (1 (4. - ,, |l (h44 ).
where || denotes vector concatenation. The resulting vector r; encodes multi-scale deviations that highly informative for anomaly assessment.
Residual similarity loss. Given source-domail labels, we encourage residuals of normal nodes to cluster while pushing those of abnormal nodes away beyond a margin
NO N Cree Σ
NT
max
E),
(8)
|rtll 115
where r,' and r denote residuals of normal and anomalous nodes, respectively.
Joint optimization. The invariant feature pool, GCN encoder, and residual module are optimized jointly with C Lim + Cress such that semantic invariance (Section[4.] (4.1) and residual discriminability reinforce each other throughout training. As result, the learned node embeddings exhibit strong generalization ability to unseen graphs, even in the presence of severe feature space shift (FSS).
4.3 Structure-Insensitive Affinity Learning
FSS-robust embeddings alone are insufficient when two graphs differ markedly in structure. To explic- itly cope with GSS, we introduce Graph Affinity Encoder (GAE) that learns a homophily-driven local affinity score. Normal nodes are expected to exhibit high affinity with their neighbours, whereas anomalous nodes break this pattern and thus receive low affinity. Optimising this contrast yields a structure-aware signal that complements the invariant semantics learned in Section 4.2
GNN-based node projection. GAE first maps each node to a latent space that captures neighbourhood context. For computational efficiency and fair comparison with prior work, we employ single Graph Convolutional Network (GCN) layer 14
(D AD -
XW)
(h1, ,r),,
where X is the feature-aligned input from Section 4.1 A the adjacency matrix with self-loops, and (--) an activation function.
Local affinity score. Given H. we quantify how well node conforms to its immediate neighbour- hood N (v;)) via the average cosine similarity:
h h
AS(v.)
[w:))))
Σ
[hs] hyl
(10)
By (e.)
high value indicates strong homophily-ttpical for normal nodes; low values signal structural irregularities, hinting anomalies.

---

Unsupervised affinity maximisation. We train GAE in an unsupervised manner by maximising each node's local affinity:
Cuff min Σ AS(o:).
(11)
Optimizing 1 encourages neighbourhood-coheee representations for the vast majority of normal nodes, implicitly relegating anomalous nodes to the low-affinity tail.
4.4 Joint Anomaly Scoring and Prediction
Having trained the three upstream modules on the domain set Tuain IA-GGAD performs inference on any unseen graph by issuing two complementary anomaly signals that mirror the twin challenges of FSS and GSS.
Residual Score RS. The residual embeddings r; defined Eq. 7 faithfully encode feature-space deviations that may arise from FSS. We measure how isolated node is within this residual space via the mean- meen-ssuared distance ng random sample residual spaces:
1 Σ lr. rryl?
RS(())
(12)
where ry residuals from the test graph obtained with the frozen encoder.
Local Affinity Score AS. Complementing RS, the affinity score in Eq. I10 probes structural homophily and is thus sensitive to GSS-induced anomalies.
Weighted Fusion. Because the two scores live on different scales, we blend them with a weighting factor X E [0, 1]:
S(u;) = (1 - Rs;;:) + A(1-A00 AS(:))
(13)
Intuitively, node is deemed suspicious if shows either a large residual dispersion (semantic oddity) weak local affinity (structural oddity).
Adaptive thresholding. data-driven rule in Eq. (14). The optimal threshold r* maximises the separation between normal and anomaly sets, after which nodes with S(v;) ((x)22+ 2T" Id are labelled as anomalies.
convert the anomaly score S(e;) into binary prediction, we adopt
Σ T(S(e)) 2T)
1 W-
Σ ((S(v)) 2 BEEN
max (E(
W+
(14)
1, if:( 2 r" ifS(w:) <T
9:
0,
Discussion. The weighted fusion couples the strengths of semantic (FSS-oriented) and structural (GSS-oriented) cues, while the adaptive threshold obviates manual calibration on each new graph. Together, these choices complete end-to-end zero-shot pipeline whose predictions remain reliable across dramatic domain shifts. Detailed algorithmic description and complexity analysis of IA- GGAD be found in Appendix
5
Experiments
5.1 Experimental Setup
Dataset configuration. Following ARC 20 we create deliberately shifted source/target split. The training set
Tanin {PubMed, Flickr, Questions, YelpChi}, while the zero-shot test set is Test {ACM, Facebook, Amazon, Cora, CiteSeer. BlogCatalog, Reddit, Weibo}. All graphs contain in-
jected or naturally occurring anomalies 35 29], providing realistic benchmark for generaliza-
tion.

---

Baselines. We compare IA- GGGGD with sixteen strong competitors: six supervised GNNs (GCN
[4]. GAT [36. BGNN 251, BWGNN B], GHRN (26). CAGAD (27)) one semi-supervised model
(S-GAD 28 D. five unsupervised methods (DOMINANT 15] CoLA [6.. HCM-A (37] TAM
29
GCTAM 30), and the two state-of-the-art generalist approaches ARC 20 and UNPrompt 22
Implementation details for all baselines are provided in Appendix F
Evaluation protocol. We report AUROC and AUPRC averaged over five random seeds, together with standard deviations (35 38 Each method, baselines and IA-GGAD alike, is trained once on Train and then evaluated on every target graph in pretrain only manner. Feature dimensions are aligned by inserting either a learnable or a random projection adapter before the input layer. Hyperparameters are selected via random search on the training split and remain fixed across target graphs, with no Sataset-specific tuning. For IA-GGAD, the sample count is set to n2 10 unless specified. Further implementation details can be found in Appendix G
Table 1: Anomaly detection performance in terms of AUROC (in percent, mean Highlighted are the results ranked first, second, and third.
Metbod
ACM
Facebook
Amazzon
Cora CAD methods
CiteSeer
BlogCatalog
Reddit
Welbo
Rank
GCN(2017)
60.4919.66 65
29.5
46.6323.47
59 59.6448.30
60.2748. 11
56. 19.6.9. 39
50.43a44.4
76.64217.69
GAT(2011)
48. 48.79+2.73
51 88+2.16
50.52=17.22 22
50 06.0642665
$1. $1.59+33.49 49
50.40+2.000 80
51 78+44+44 04
53.06+ 48
10.37
2GNN(2021)
44.0+13.69
54.74=25.22 29
52.26+3.31
42.45=11.57
42.32 82
47.67
50.2743 84
32.75+35.35
11.87
RWGNN(2223)
07.9960770 70
45 35.84+4997
55.26-16.99 95.95
54 06:3.77
52.61+2.0 88
34-1 1:21
48.9745 74
53.38+1.6
GHRN(2023)
55.6546.3
44.814800
49.48-17.13
89+6.57
57.64+3.44 44
46.2242.3
51,87=14118
9.87
70.08+2.34
51.01
48.94=2.69
66 16.5561.11
69. 69.47+2.02
74. 74.25e0.65 65
50.05+4.92
92.8840.32
6.12
Col A(2IZT)
66856444
12.99=11.4 1.668
47 47.40=7.97
63 29.29+88.. 88
62. 14.44+9.55 52
50.04+ 25
52.8 81161466000 69
16.27+5.04
10.00
HCM-A(202))
53.7064.66 64
35,44-13.97
43.99=0.72
54 S4.28+4.73
48, 12:6.000.
55.31=0.57
48.7942277
65.52+12.58
11.50
TAM(2023)
74.43:1 59
65 8818866..0 66
56 06:06:2.19 19
62 (2.002:2.30 39
12.27:00.3
49 86:68663333 73
55.4 06.43310.3 33
71.54:0.15
5.25
CAGADC2024)
39-01+9-11
45 8444447
46 06.06-0.75
50 50.11+33.1
40) 13+5.41
49.84 49.84-12:37
54.57+3 89
58. 1W.999+3.42
11:75
S-GADD2024)"
37.47122668
55.8918.99
58.11244.92
39.411541
38, 1814.21
50.70:7..34
55 39199.0444 44
65.73
10.00
GCTAMI2025)"
11.2180.13
55.74:10.00
58.78:2.11
70.31
07.6020..7
00.3321077
70.61=0010
GGAD methods
UNPrmpp(2024)
69. 10.9121.22 28
55 $5.2716.90
$6.02-11.69
$4.3111 50
49. S003..132 12
68, 68.3610.40
59.1811 .44
45. 15.56.33.75
7.12
ARC(2U24)
79 8880022
67.56e .60
N1.67=1.81
87 45
90 95.9550.35 59
74, 76:0066
60 04+0 69
88 S8.8500.14
2.38
IA-GGAD (ours)
93,4910.57
83.7822.76
68.003
913004
75.2830.21
60,291199
91.1820.22
112.28
110-46
13:11
11.23
70.88
10.52
10.25
-1.70
A represents the improvement (1) or degradation (L) compared the current best baseline method. Rank indicates the average ranking over 8 datasets. s represents reproduced results, others are reported in ARC 20
5.2
Main Results
Table | summarrsess AUROC performance across fourteen benchmarks. IA-GGAD achieves the top rank on 7/8 datasets, with especially large gains of +12.28% on ACM and +10.46 % on Facebook. These results confirm that our joint handling of FSS and GSS yields robust zero-shot generalisa- tion. Most strikingly, IA-GGAD outperforms the strongest baselines on Amazon (+3. 11%), Cora (+1.23%), and CiteSeer (+0.88%), demonstrating consistent improvements even on highly diverse graphs. Traditional supervised GAD methods (e.g. GCN. GAT, BGNN, GHRN) fall near chance without retraining, and unsupervised approaches like DOMINANT and TAM perform well only when their implicit homophily assumptions hold. The sole exception is Weibo, where DOMINANT's reconstruction-basee detector attains 92.88% versus our 91. 11.88% (-1.70% %), which remains a very high score. We attribute this to Weibo's extremely strong local homophily and low attribute vari- ance, which favour autoencoder reconstruction errors over invariant-featur aligmment. In contrast, IA-GGAD 's invariant pool and affinity encoder balance semantic and structural cues, leading to more stable performance across weaker-homophil, graphs. Finally, IA-GGAD 's mean rank of 1.12 far surpasses ARC (2.38) and GCTAM (4.37), and its low standard deviations (all <3%) underscore stable behaviour across random seeds. Full AUPRC results appear in Appendix H.I
5.3 Ablation Study
Table 2: The evaluation of invariant fea- ture(I) and graph affinity(A)
To disentangle the impact of each module, we eval-
Datasets
w/o I&AA
w/l
w/A
Ours
uate three variants: (i) w/o CRAA-backbone only;
ACM
78.59
79.86
91.78
93,49
(ii) w/l-backbone plus invariant feature pool; (iii) w/A backbone plus graph affinity encoder. Ta-
Facebook
67.73
68.02
78.94
80.03
Amazon
79.47
80.85
82.76
83.78
Cora
87.10
88.14
87.69
88.68
ble 2 shows that invariant features chiefly improve
CiteSeer
90.43
91.37
91.31
91.83
BlogCataiog
74.03
74.61
74.41
75.28
dSm-inmid graphs (c.g. CiteSeer, Cora), while affinity
Reddit
58.31
59.89
59.21
60.29
Weibo
86.35
88.63
88.93
91.18
8

---

modelling is crucial for ESS-yeevy graphs (ACM, Face- book, Amazon). Combining both yields the full model, outperforming every variant on all datasets.
5.4 Hyper-parameter Sensitivity
Facebookk
Figure studies the weighting fac- Eq. (33.. On both ACM and Facebook, performance peaks = 0.9, confirming that mod- est contribution from affinity scores complements the residual signal without amplifying noise. Beyond this point, AUROC and AUPRC de- cline, underscoring the need for bal- anced fusion. Additional sensitivity plots are provided in Appendix
AUPIIC
The Impect of
The wwmmmpateee
(a) ACM
(b) Facebook
Figure 3: Weighting Factor AUROC and AUPRC
5.5 Impact of FSS and GSS
Table 3 pairs four targets with a common source (PubMed) and reports the quan-
Table 3: Quantitative analysis of FSS and GSS
GSS Dominated
FSS Dominated
titative shift measures from Eq. ( (
Source Dutaset
Pubmed
Target Dataset
ACM
Facebook
CiteSeer
Cora
ACM and Facebook exhibit high GSS
FSS Score, Eq.
0.01
0.31
0.70
0.68
but negligible FSS; CiteSeer and Cora show the opposite pattern. GCTAM ex- cels under GSS but degrades under FSS; ARC shows the reverse. By contrast, IA- GGAD outperforms both baselines in all scenarios, confirming that the dual de- sign semantic invariance for FSS, affinity learning for GSS generalises robustly across het- erogeneous graphs.
GSS Score, Eq. 2
0.77
0.64
0.03
0.31
2CTAM(2025)
81.21
69.57
70.31
58.78
ARC(2024)
79.88
67.56
90.95
87.45
IA-GGAD (ours)
93.49
80.03
91.83
88.68
GCTAA (SOTA for GAD) is sensitive to FSS.
ARC (SOTA for GGAD) is sensitive to GSS.
5.6 Performance on Large Datasets
To evaluate the scalability of IA-GGAD, we test it on large-scale financial networks with real anomalies, including DGraph (39). T-
Table 4: Results (AUROC) large datasets.
Method
Elliptic
T-Finance
DGraph-Fin
DOMINANT (2019)
24,80
59.89
00M
CoLA (2021)
38.72
$1.34
0OM
Finance [3) and Elliptic [40] We compare
(2023)
22.31
39.42
IA-GGAD with recent state-of-the-art methods
CONSIGSAD (2014)
48.36
53.56
51.76
such CONSISGAD [41), SmoothGNN [42).
SmoothGNN (2025)
56.23
39.79
$2.71
SpaceGNN (2025)
$7.43
57.43
30.04
AnomalyGFM [3), and SpaceGNN 4.] IA-
GCTAM (2025)
24.56
40.74
00M
GGAD consistently achieves the best per-
ARC (2024)
26.40
64.10
47.46
formance. On Elliptic, it reaches an AU- ROC of 74.24, outperforming the second- best (SpaceGNN, 57.43) by 16.81 %. On T- Finance, it scores 75.41, surpassing the next- best (AnomalyGFM, 67.57) by 11.75 %. On DGraph-Fin, where many baselines fail due to memory constraints, IA-GGAD still attains 54.39. These results demonstrate its robustness and scalability large and complex financial graphs.
UNPrompt (2024)
41.76
23,86
52.69
AnomalyGFM (2025)
0OM
67.57
OOM
IA-GGAD (Ours)
74.24
75.41
$4,39
6 Limitations
Although IA-GGAD substantially advances zero-shot graph anomaly detection, several limitations remain. (1) Dependence on informative node attributes. The invariant-feature module assumes moderately descriptive features; purely structural graphs graphs with sparse noisy attributes, its FSS mestimitiattion effect can disappear and performance degrades. (2) Homogeneity assumption in affinity learning. The affinity encoder is based the homogeneity assumption, which does

---

not directly apply to heterogeneous graphs; however, by employing meta-path, IA-GGAD can be extended heterogeneous graph scenarios. (3) Static structures. Our evaluation covers only static graphs; dynamic (timevarying)) graphs remain out of scope and likely require substantive extensions. (4) Limited scale analysis. Scalability to million-scale graphs is untested, and both the k-NN prototype retrieval and global affinity objective may need approximate or mini-batch variants. sensitivity. Results depend on weighting factor X; a comprehensive robustness study is left to future work.
(5)
7 Conclusion
We presented IA- IA-GGAD, an end-to-end zero-shot framework for GGAD that detects anomalies on unseen graphs without retraining. By formalising and quantifying Feature Space Shift (FSS) and Graph Structure Shift (GSS), we pinpointed the key barriers to cross-domain generalisation. IA-GGAD counters them with two lightweight modules: an anomaly-driven invariant feature pool to mitigate FSS and graph affinity encoder to withstand GSS. Across eight real-world datasets, IA-GGAD outperforms fourteen strong baselines-includdin ARC and UNPrompt-achievinn achieving up to + +12.28% AUROC on ACM and + 10.46% AUROC on Facebook, thereby setting a new benchmark for zero-shot graph anomaly detection.
Future work. Although treating FSS and GSS separately proves effective, a unified representation that jointly normalizes feature semantics and structural patterns could further improve robustness. In addition, we plan to extend IA-GGAD to dynamic graphs and to graphs with heterogeneous node and edge types, which would broaden its applicability in real-world scenarios.
Acknowledgments and Disclosure of Funding
This paper is the result of the research project funded by the National Natural Foundation China (Grant No. 62106216, 62362068, and 62162064) and the Open Foundation of Yunnan Key Laboratory of Software Engineering under Grant No.2023SE104 and 2023033S.
References
[1] Tahereh Pourhabibi. Kok Kok-Leong Ong. Booi H Kam, and Yee Ling Boo. Fraud detection: A systematic literature review of graph based anomaly detection approaches. Decision Support Systems. 133:1 133003, 2020.
[2] Hezhe Qiao, Hanghang Tong, Bo An, Irwin King, Charu Aggarwal, and Guansong Pang. Deep graph anomaly detection: A survey and new perspectives. arXiv preprint arXiv:2409.09957 2024.
[3] Jianheng Tang, Jiajin Li, Ziqi Gao, and Jia Li. Rethinking graph neural networks for anomaly detection. In International Conference on Machine Learning, pages 21076- 21076-21089. PMLR, 2022.
[4] Ranran Li, Zhaowei Liu, Yuanqing Ma, Dong Yang, and Shuaijie Sun. Internet financial fraud detection based on graph lcarning. leee Transactions on Computational Social Systems, 2022.
[5] Guansong Pang, Chunhua Shen, Longhing Cao, and Anton Den Hengel. Deep learning for anomaly detection: A review. ACM computing surveys (CSUR). 54(2):1-38, 2021.
[6] Xiaoxiao Ma, Jia Wu, Shan Xue, Jian Yang. Chuan Zhou, Quan Z Sheng, Hui Xiong, and Leman Akoglu. A comprehensive survey on graph anomaly detection with deep leamning. IEEE Transactions on Knowledge and Data Engineering, 35(12): 200022 2021.
[7] Menghui Zhou, Xulong Wang. Tong Liu, Yun Yang, and Po Yang. Integrating visualised automatic temporal relation graph into multi-task learning for alzheimer's disease progression prediction. IEEE Transactions on Knowledge and Data Engineering, (6(10)5520-52200 2024.
[8] Jipeng Cui, Chungang Yan, and Cheng Wang. Remember: Ranking metric embedding- hased multicontex- tual bchavior profilng for online banking fraud detection. IEEE Transactions on Computational Social Systems, 8(3):643-654 2021.
[9] Tian Bian, Xi Xiao, Tingyang Xu, Peilin Zhao, Wenbing Huang. Yu Rong, and Junzhou Huang. Rumor detection on social media with bi bi-directional graph convolutional networks. In Proceedings of the AAAI conference artificial intelligence, volume 34, pages 549-556, 2020.
10

---

[10] Xingfa Shen, Wentao Lv, Jianhui Qiu, Achhardeep Kaur. Fengjun Xiao, and Feng Xia. Trust-aware detection of malicious users in dating social networks. IEEE Transactions on Computational Social Systems, 1065)2587722988, 2022.
[11] Zhang Xiong. Cheng Xie, Haoran Duan, and Beibei Yu. Noisehgun: Synthesized similarity graph- based neural network for noised heterogenenus graph representation learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 21725-21733, 2025.
[12] Wenjie Hu, Yang Yang, Jianbo Wang, Xuanwen Huang. and Ziqiang Cheng. Understanding electricity- behavior via multi-source data. In Proceedings of The Web Conference 2020, pages 2264-2274, 2020.
[13] Yang Yang. Yuhong Xu, Yizhou Sun. Yuxiao Dong, Fei Wu, and Yueting Zhuang. Mining fraudsters and fraudulent strategies in large-scale mobile social networks. IEEF Transactions on Knowledge and Data Engineering, 33(1 33(()):19-117))) 2019.
[14] Thomas N Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. In International Conference on Learning Representations, 2017.
[15] Kaize Ding, Jundong Li, Rohit Bhanushali, and Huan Liu. Deep anomaly detection on attributed networks. In Proceedings of the 2019 SIAM International Conference on Data Mining, pages 594-602. SIAM, 2019.
[16] Yixin Liu, Zhao Li, Shirui Pan, Chen Gong, Chuan Zhou, and George Karypis. Anomaly detection on attributed networks via contrastive sele-supe learning. IEEE transactions on neural networks and learning systems, 33(6):2378-2392 2021.
[17] Bryan Perozzi and Leman Akoglu, Scalable anomaly ranking of attributed neighborhoood. In Proceedings of the 2016 SIAM International Conference on Data Mining, pages 207-215. SIAM. 2016.
[18] Jundong Li. Harsh Dani, Xia Hu, and Huan Liu. Radar: Residual analysis for anomaly detection in attributed networks. In IJCAI, volume 17, pages 2152-2158, 2017.
[19] Zhen Peng. Minnan Luo, Jundong Li. Huan Liu, Qinghua Zheng, al. Anomalous: A joint modeling approach for anomaly detection on attributed networks. IJCAI, volume 18, pages 3513-3519, 2018
[20] Yixin Liu, Shiyuan Li, Yu Zheng, Qingfeng Chen, Chengqi Zhang, and Shirui Pan. Are: generalist graph anomaly detector with in context learning. In Advances in Neural Information Processing Systems, 2024.
[21] Pei Wang, Yun Yang. Yuclong Xia, Kun Wang, Xingyi Zhang, and Song Wang. Information maximizing adaptation network with label distribution priors for unsupervised domain adaptation. IEEE Transactions on Multimedia, 25:6026-6039, 2022.
[22] Chaoxi Niu, Hezhe Qiao, Changlu Chen, Ling Chen, and Guansong Pang. Zero-shot generalist graph anomaly detection with unified neighborhood prompts. arXiv preprint arXiv:2410.1488 2024.
[23] Xuexiong Luo, Jia Wu, Amin Beheshti, Jian Yang, Xiankun Zhang, Yuan Wang, and Shan Xue. Comga: Community-awee aware attributed graph anomaly detection. In Proceedings of the Fifteenth ACM International Conference on Web Search and Data Mining, pages 657-665, 2022.
[24] Yuan Gao. Xiang Wang. Xiangnan He, Zhenguang Liu, Huamin Feng, and Yongdong Zhang, Alleviating structural distribution shift in graph anomaly detection. In Proceedings of the sixteenth ACM international conference web search and data mining, pages 357-365, 2023.
[25] Sergei Ivanov and Liudmila Prokhorenkova. Boost then convolve: Gradient boosting meets graph neural networks. In International Conference on Learning Representations, 2021.
[26] Yuan Gao, Xiang Wang. Xiangnan He, Zhenguang Liu, Huamin Feng, and Yongdong Zhang, Addressing heterophily in graph anomaly detection: A perspective of graph spectrum. In Proceedings of the ACM Web Conference 2023, pages 1528-1552 1538, 2023.
[27] Chunjing Xiao, Shikang Pang. Xovee Xu, Xuan Li, Goce Trajcevski, and Fan Zhou, Counterfactual data augmentation with denoising diffusion for graph anomaly detection. IEEE Transactions on Computational Social Systems, 2024.
[28] Hezhe Qiao, Qingsong Wen, Xiaoli Li, Ee-Peng Lim, and Guansong Pang. Generative semi-supervised graph anomaly detection. arXiv preprint 100 2024.
[29] Hezhe Qiao and Guansong Pang. Truncated affinity maximization: One-class homophily modeling for graph anomaly detection. In Advances in Neural Information Processing Systems, volume 36, 2023.
11

---

[30] Xiong Zhang, Hong Peng. Zhenli He. Cheng Xie, Xin Jin, and Hua Jiang. Getam: Global and con- textual combined truncated affinity maximization model for unsupervised graph anomaly detection. In International Joint Conference on Artificial Intelligence. 2025.
[31] Kaize Ding. Kai Shu, Xuan Shan, Jundong Li, and Huan Liu. Cross-domain graph anomaly detection. IEFE Transactions on Neural Networks and Learning Systems, 3366):406-2415,, 2021.
[32] Qizhou Wang. Guansong Pang. Mahsa Salehi, Wray Buntine, and Christopher Leckie. doms-n graph anomaly detection via anomaly-aware contrastive alignment. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 4676-4684, 2023.
[33] Hervé Abdi and Lynne J Williams. Principal component analysis. Wiley interdisciplinary reviews: computational statistics, 2(4):433-459, 2010.
[34] Aaron Van Den Oord, Oriol Vinyals, et al. Neural discrete representation learning, Advances in neural information processing systems, 30, 2017.
[35] Jianheng Tang, Fengrui Hua. Ziqi Gao, Peilin Zhao, and Jia Li. Gadbench: Revisiting and benchmarking supervised graph anomaly detection. Advances Neural Information Processing Systems, 36, 2024.
[36] Petar Veličkovié, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Lio, and Yoshua Bengio. Graph attention networks. In International Conference on Learning Representations, 2018.
[37] Tianjin Huang, Yulong Pei, Vlado Menkovski, and Mykola Pechenizkiy. Hop-count based self-supervised anomaly detection attrihuted networks. In Joint European conference on machine learning and knowledge discovery in databases, pages 225-241. Springer. 2022.
[38] Guansong Pang, Anton den Hengel, Chunhua Shen, and Longbing Cao. Toward deep supervised anomaly detection: Reinforcement learning from partially labeled anomaly data. Proceedings of the 27th ACM SIGKDD conference on knowledge discovery & data mining, pages 1298-1308 2021.
[39] Xuanwen Huang, Yang Yang. Yang Wang, Chunping Wang, Zhisheng Zhang, Jiarong Xu, Lei Chen, and Michalis Vazirgiannis. Dgraph: A large-scale financial dataset for graph anomaly detection. Advances in Newral Information Processing Systems, 35:22765 227227775-22777, 2022.
[40] Ziwei Chai, Siqi You, Yang Yang, Shiliang Pu, Jiarong Xu, Haoyang Cai, and Weihao Jiang. Can abnormality be detected by graph neural networks? In IJCAI, pages 1945-1951, 2022.
[41] Nan Chen, Zemin Liu, Bryan Hooi, Bingsheng He, Rizal Fathony, Jun Hu, and Jia Chen. Consistency training with learnable data augmentation for graph anomaly detection with limited supervision. In B. Kim. Y. Yue, S. Chaudhuri. K. Fragkiadaki. M. Khan, and Y. Sun, editors, International Conference on Representation Learning, volume 2024, pages 00118003027.... 2024.
[42] Xiangyu Dong, Xingyi Zhang, Yanni Sun, Lei Chen, Mingxuan Yuan, and Sibo Wang. Smoothgnn: Smoothing-avee aware gnn for unsupervised node anomaly detection. In Proceedings of the ACM on Web Conference 2025, pages 1225 1236, 2025.
[43] Hezhe Qiao, Chaoxi Niu, Ling Chen, and Guansong Pang. Anomalygfm: Graph foundation model for zeroffew-shot anomaly detection. In Proceedings of the 31xt ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 2. pages 2326-2337, 2025.
[44] Xiangyu Dong, Xingyi Zhang. Lei Chen, Mingxuan Yuan, and Sibo Wang. Spacegnn: Multi-space graph neural network for node anomaly detection with extremely limited labels. arXiv preprint arXiv:2502.03221. 2025.
[45] Arthur Gretton, Karsten M. Borgwardt, Malte J. Rasch, Bernhard Schölkopf, and Alexander Smola. kernel two-sample test. Journal of Machine Learning Research, 13(25):723 773, 2012.
[46] Lukas Ruff, Robert Vandermeulen, Nico Goernitz, Lucas Deecke, Shoaib Ahmed Siddiqui, Alexander Binder, Emmanuel Müller, and Marius Kloft, Deep one-class classification. In International conference on machine learning, pages 4393-4402. PMLR, 2018
[47] Karsten Roth, Latha Pemula, Joaquin Zepeda, Bernhard Schölkopf, Thomas Brox, and Peter Gehler. Towards total recall in industrial anomaly detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 44388-1422,, 2022.
[48] Julian Wyatt, Adam Leach, Sebastian M Schmon, and Chris G Willcocks. Anoddpm: Anomaly detection with denoising diffusion probabilistic models using simplex noise. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 550-656, 2022.
12

---

[49] Choubo Ding, Guansong Pang, and Chunhua Shen. Catching both gray and black swans: Open-set supervised anomaly detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recogmition, pages 7388-7398, 2022.
[50] Abhishek Aich, Kuan-Chuan Peng, and Amit K Roy-Chowdhury. Cross-domain video anomaly detection without target domain adaptation. In Proceedings of the IEEF/CVF Winter Conference on Applications of Computer Vision, pages 2579-2591, 2023.
[51] Chaoqin Huang. Haoyan Guan, Aofan Jiang, Ya Zhang, Michael Spratling, and Yan-Feng Wang. Regis- tration based few-shot anomaly detection. In European Conference on Computer Vision, pages 503-319. Springer, 2022.
[52] Jongheon Jeong, Yang Zou, Taewan Kim, Dongqing Zhang, Avinash Ravichandran, and Onkar Dabeer. Winelip: Zero-Ifew-shot anomaly classification and segmentation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 19606-19616, 2023.
[53] Jiawen Zhu and Guansong Pang. Toward generalist anomaly detection via in-context residual learning with few-shot sample prompts. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024.
[54] Yixin Liu, Shirui Pan, Yu Guang Wang, Fei Xiong, Liang Wang, Qingfeng Chen, and Vincent CS Lee. Anomaly detection in dynamic graphs via transformer. IEEE Transactions on Knowledge and Data Engineering, (0111)))2281112099 2021.
[55] Yixin Liu, Kaize Ding, Qinghua Lu, Fuyi Li, Leo Yu Zhang, and Shirui Pan. Towards self-interpretable graph-level anomaly detection. Advances in Neural Information Processing Systems, 36, 2024.
[56] Yili Wang, Yixin Liu, Xu Shen, Chenyu Li, Kaize Ding, Rui Miao, Ying Wang, Shirui Pan, and Xin Wang. Unifying unsupervised graph-level anomaly detection and distt--iisttiuution detection: A benchmark. arXiv preprint arXiv:2406. 15523, 2024.
[57] Xin Zheng, Yixin Liu, Zhifeng Bao, Meng Fang. Xia Hu, Alan Wee-Chung Liew, and Shirui Pan. Towards data-centric graph machine learning: Review and outlook. arXiv preprint (XIv::230911979 2023.
[58] Yixin Liu, Kaize Ding, Jianling Wang, Vincent Lee, Huan Liu, and Shirui Pan. Learning strong graph neural networks with weak information. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 1559-1571, 2023.
[59] Yingtong Dou, Zhiwei Liu, Li Sun, Yutong Deng, Hao Peng, and Philip S Yu. Enhancing graph neu- ral network- based fraud detectors against camouflaged fraudsters. In Proceedings of the 29th ACM international conference information & knowledge management, pages 315-324, 2020.
[60] Prithviraj Sen, Galileo Namata, Mustafa Bilgic, Lise Getoor, Brian Galligher, and Tina Iliassi-Rad. Collective classification in network data. Al magazine, 29(3):93-93, 2008.
[61] Jie Tang, Jing Zhang, Limin Yao, Juanzi Li, Li Zhang, and Zhong Su. Ametminer: extraction and mining of academic social networks. In Proceedings of the 14th ACM SIGKDD international conference on Knowledge discovery and data mining, pages 990-998, 2008
[62] Shebuti Rayana and Leman Akoglu. Collective opinion spam detection: Bridging review networks and metadata. In Proceedings of the 21th acm sigkdd international conference on knowledge discovery and data mining, pages 985-999 02559994777 2015.
[63] Julian John McAuley and Jure Leskovec. From amateurs to connoisseurs: modeling the evolution of user expertise through online reviews. In Proceedings of the 22nd international conference on World Wide Web. pages 897-908, 2013.
[64] Arjun Mukherjee, Vivek Venkataraman, Bing Liu, and Natalie Glance. What yelp fake review filter might be doing? In Proceedings of the international AAAI conference on web and social media, volume 7, pages 409-418, 2013.
[65] Zhiming Xu, Xiao Huang, Yue Zhao, Yushun Dong, and Jundong Li. Contrastive attributed network anomaly detection with data augmentation. In Pacific-Asia Conference on Knowledge Discovery and Data Mining, pages 444-457. Springer, 2022.
[66] Srijan Kumar, Xikun Zhang, and Jure Leskovec. Predicting dynamic embedding trajectory in temporal interaction networks. In Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining, pages 229--228 2019.
13

---

[67] Oleg Platonov. Denis Kuznedelev, Michael Diskin, Artem Babenko, and Liudmila Prokhorenkova. A critical look the evaluation of gans under heterophily: Are really making progress? arXiv preprint urXiv:2302. 16400 2023.
[68] Hezhe Qiao, Qingsong Wen, Xiaoli Li, Be-Peng Lim, and Guansong Pang. Generative semi-supervised graph anomaly detection. arXiv preprint arXiv:2402. 11887, 2024.
[69] Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chaman, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high-perffrmance deep learning library. Advances in neural information processing systems, 32, 2019.
14

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The abstract and introduction clearly summarize the key contributions. These statements align with the theoretical analysis and experimental results and accurately reflect the scope of the paper.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
The limitations of this paper have been discussed in Section 6 "L.imitaioons"
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sell-speciiiitiinn asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
15

---

Answer: [Yes]
Justification: All theorems clearly state their assumptions and the full proofs are provided in Appendix A ensuring correctness and completeness.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: We include experimental instructions in the paper and provide detailed dataset configurations (Appendix [.. baseline implementations and hyperparameters (Appendix (G) and a public code repository for our framework (https: /////n/nnnouuuusm/// 4open. encence/
r/ 8FOF/), ensuring that all information needed to reproduce the main results is available.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution be necessary to either make it possible for others to replicate the model with the same dataset, provide access the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how replicate the results, access a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
specific model and empirical evaluation, may
While NeurlPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm.
(b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (c.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the partieular way they provide for reproducibiliity In the case of closed-source models, it may be that access to the model is limited in
16

---

some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification:
All the datasets are included along with the uploaded source code.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.co cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
/ https/cccppbccccceeeeeeeee
for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
All the experimental details are given in Section 5) and Appendix G
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: All the experimental results are acquired by multiple trails of experiments, and report the average and standard deviation results.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emoo bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
17

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Yes, we provide the computing infrastructures in Appendix
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics
Answer:
[Yes]
Justification: This research conforms with the Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No. they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA]
Justification: There is no societal impact of the work performed.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
18

---

Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), faireess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied partieular applications, let alone deployments. However, if there is direct path any negative applications, the authors should point it out. For example, it is legitimate point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (c.g., gated release models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility MI).
11. Safeguards
Question:
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Answer: [NA]
Justification:
The paper poses no such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We cite original publications for the baseline code packages. Note that these CC-BY 4.0 licensed. We also specify the sources of public datasets in our public repository.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
19

---

If assets are released, the license, copyright information, and terms of use in the thcode. has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
package should be provided. For popular datasets, paperswi
latasets.paperssi
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: The paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moode as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
20

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: No LLMs were used in the design, implementation, or evaluation of our framework.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to our LLM for what should or should not be described.
21

---

A Theoretical Foundations of FSS and GSS
This appendix provides a rigorous foundation for FSS and GSS as defined in the main text. We formalize the kernels underlying Eqs. 2 address well-definedness across domains of different sizes, establish an additive-kerne decomposition, and present domain -ddataatd bound under explicit assumptions.
A.1 Notation and Background
RKHS and kernels. Hilbert space (H, (:.)) )) is an RKHS for a positive-definite kernel if there exists feature map & with k(u, v) (u) ((u)).
Population and empirical MMD. For distributions P,Q over a common space Z, the (population) MMD is
MMD&(P. = (Ixx(P) - p (xx [p))]]
and T -t Q, the biased empirical estimator Given i..dd samples 8 {s: n
MMD
k(s,.8)) + m
Σ 3.3"
k(()tpp)
k(si, (j).
(A.1)
Assume throughout that the kernel is bounded, sup, (22,z) 2) I x², and that samples
drawn i.idd when invoking concentration bounds. Then MM,x((PQ) MMDx(P,Q) =
Opl/1/ns + 1/nr) 45
A.2 Formalizing the Kernels Behind Eqs.
FSS kernel consistent with Eq. [ Let denote a graph domain and let ΦG Rd - IR.h be the shared graph encoder with single set of shared parameters held fixed when computing MMD. Define a single kernel on graph-tagged inputs
k ((z, G), (d', = (z)( (c.((()))
This is positive-defintte since is inner product in common feature space via the unified feature map Φ (1r, G) (a(x) Rh. With this kernel, the empirical MMD;, ky between source and target node-feature pairs reproduces Eq.
GSS kernel consistent with Eq. 2 For each node in graph G, the vector AG] has length No- To ensure well-defined comparisons when N, F Nr, fix size-harmonization operator .... + TR (e.g., truncation/lagrreaatoo of walk-counts, heat signatures at scales, or any domain-agnoste deterministic map), applied identically across domains and independent of the data. Define
o A(Ai- E RD,
((, = exp(
|| -s -5(012))
1P).
2n
When N, = N₁ and p is the identity, Eq. is recovered verbatim; otherwise, Eq. with the implicit o for well-definedness.
2 is interpreted
A.3 Definitions of FSS and GSS (as MMDs)
Let X (x, G. and X [at,, Go) be source/target node-feature pairs; let S {(i, G. and S = {jj G.) j=1 be the node-index pairs for structure. We define
FSS = MMD R (X", x*),
(A.2)
GSS == MMD (S", (S", st).
(A.3)
By construction, A.2 reproduces Eq. U A.3) coincides with Eq. when N₂ N₂ and p identity, and otherwise implements its size-harmonizee counterpart.
22

---

A.4 Additive Kernel and Decomposition
For the joint representation U ((x, G), (i. G)) with feature part ( = (G and structure part of = p((AcAcl:), define the additive kernel
*(U, = ky ((x, G), (z', G")) +
(A.4)
Its RKHS is the orthogonal direct sum H4 Hy, @ Mkg hence the mean embeddings decompose.
Let p ,P be the joint distributions of U on source/tareet. Then
MMD ,!) = MMD (P. P!") + MMD Hy (P. P.) = FSS + GSS.
(A.5)
A.5 Key Properties
Theorem 1 NNonttegayiv and identity of indiscemibles). For positive-definis kernels ky. kg FSS 2 0 and CSS 2 0. If 2 (resp. kg) is characteristic on its input space, then FSS = 0 (resp. GSS = 0) iff the corresponding source and target distributions coincide.
Immediate from MMD as the RKHS distance between mean embeddings; characteristic kernels yield injective mean embeddings [5].
Proof.
A.6 Domain-Adappaation Bound via MMD
We bound the generalization gap using the IPM property of MMD under explicit assumptions.
Assumption (Covariate shift). P.( U u) P.(Y U u) for all u in the support of U.
Assumption 2 (RKHS capacity on conditional risk). For each hypothesis h, define gn (u) = Byju=u [y]u=)(((h()) Y)] and assume Jh Hr with || H. B. Assume also that the loss is bounded, 0 SSE M (used when relating empirical and population risks).
Theorem (Generalization gap under additive-kernel discrepancy). Under Assumptions 1-2,
(a(h) - ch) I BMMD P!!) B /FSS + GSS.
(A.6)
Moreover, with probability at least - 8 over i.i.d. draws of No source and N, target samples,
(h( S (h(h) + B BMMD .T") + CV In(2/8]
+C
(A.7)
No+N.
for a constant C = C(B, k) depending only on the RKHS radius B and the kernel bound k.
Proof sketch. Under Assumption 1, ea(h) Eumpy (gn(U) for d {s, {} with the same gh- By the IPM characterization of MMD, suPpifll, [E,((U) - E.T) MMDx p!)). Since llgh HH I B, we obtain (A.6): (A.7) follows by replacing the population MMD with its empirical counterpart and applying concentration for bounded kernels, yielding a deviation term that depends
on B and
A.7 Conclusion
This appendix formalized FSS and GSS as squared MMDs computed with well-defined kernels on shared, fixed-dimension spaces. Concretely, we: (1) specified a single positive-defiite feature kernel ky induced by the shared encoder (parameters fixed when computing MMD), yielding a valid empirical MMD?, (2) introduced a size-harmonization operator to define a structure kernel kg consistently across graphs of different sizes; and (3) established the additive-kernel identity MMD = FSS + CSS for k = ky kg. Under covariate shift and an RKHS capacity assumption on the conditional risk, we derived the domain- adaptation bound |e (h) - (h)l < B /FSS + GSS, with an empirical counterpart including a standard concentration term depending only on and k. These results justify minimizing both FSS and GSS in our algorithm design- rrespecivvv via invariant feature learning and stracture-nsensiiivve affinity learning to reduce the generalization gap on unseen graphs.
23

---

B Experimental Analysis of FSS and GSS
To further understand how IA-GGAD tackles domain shifts, analyze the quantitative behaviors of FSS and GSS as defined Eq. (I] and Eq. (2). and examine the effect of the final score fusion strategy defined in Eq. (3) As shown in Fig. 4 our anomaly scoring mechanism effectively mitigates the domain shift challenges posed by FSS and GSS. By adaptively weighting the residual-based semantic score and the affinity-baasae based structural score, IA-GGAD balances two orthogonal cues, resulting in robust performance across both ESS-dominated and GSS-dominated datasets.
B.1
FSS Scores Analysis
Table 5: FSS scores from source domains to target domains.
Target
ACM
BlogCatalog
Reddit
Facebook
Weibo
Cora
Amazon
Citeseer
Source
Flickr
0.0153
0.0100
0.0018
0.3616
0.5624
0.5082
0,0295
0.7178
CelpChi
0.0134
0.0124
0.0087
0.3601
0.5608
0.5067
0,0253
0.7163
Pubmed
0.0074
0.0137
0.0140
0,3529
0.5521
00.9975
0,0285
0.7072
Questions
0.0494
0.0523
0.0526
0.3231
0,5175
0.4623
0.0452
0.6716
Mean
0.0214
0.0221
0.0193
0.3494
0.5482
0.4937
0.0321
0.7032
Feature Space Shift (FSS). Table reportss the average FSS scores between each source and target domain, providing a quantitative measure of the distributional misalignment in the node feature space, Based on the average FSS values, we categorize the target datasets into three types of FSS domains:
Low-FSS domains (FSS < 0.05): Reddit (0.0193), ACM (0.0214), BlogCatalog (0.0221), and Amazon (0.0321) exhibit minimal feature space shift from the source domains. Their node attributes are highly compatible with those the training graphs, likely due to shared semantics such as user interactions, co-occurrence structures, or Satform-generater tags. As such, these domains allow for direct knowledge transfer with negligible adaptation cost.
Moderate-FSS domains (0.05 FSS 0.4): Facebook (0.3494) demonstrates moderate misalignment in its node feature space. While not as challenging as high-FFSS domains, the shift indicates partial semantic divergence, potentially stemming from demographie-speciffe behaviors or inconsistent attribute ontologies. Alignment strategies are still necessary to ensure effective transfer.
High-FSS domains (FSS > 0.4): Cora (0.4937), Weibo (0.5482), and Citeseer (0. (0.7032) represent severely misaligned domains with pronounced semantic drift. Such high FSS scores suggest substantial differences in feature distributions, likely caused by sparse vocab- ulary, heterogeneous encodings, or conflicting representation schemes (e.g., bag-of- of-words contextual embeddings). These domains demand robust invariant encoding mechanisms to support generalization under extreme domain shifts.
B.2
GSS Scores Analysis
Table 6: GSS scores from source domains target domains.
Target
ACM
BlogCatalog
Reddit
Facebook
Weibo
Cora
Amazon
Citeseer
Source
Flickr
0.1128
0.0372
0.1929
0.0123
0.1812
0.3711
0,0837
0.6624
YelpChi
0,5016
0.5316
0.3651
0.4404
0.4587
0.1254
0.1938
0.0270
Pubmed
0.7689
0.7173
0.6165
0.6375
0.6327
0.3162
0.3750
0.0360
Questions
0.9042
0.7938
0.8238
0.7431
0.3258
0.6303
0.5856
0.4626
Mean
0.5719
0.5200
0.4996
0.4583
0.3996
0.3608
0.3095
0.2970

---

Graph Structure Shift (GSS). Table reports the average GSS scores from each source domain to each target domain, quantifying the degree of structural distributional shift. Based on these scores, we classify the target domains into three levels of structural misalignment:
Low-GSS domains (GSS < 0.35): Amazon (0.3095) and Citeseer (0.2970) exhibit mini- mal structural deviation from the source graphs. Their graph topologies such as degree distributions, community structures, and connectivity statistics- align closely with those seen in training domains. These domains are structurally compatible and require little to no adaptation for generalization.
Moderate-GSS domains (0.35 < GSS 0.5): Cora (0.3608), Weibo (0.3996), Facebook (0.4583), and Reddit (0.4996) fall into the moderate shift category. These domains show partial topological divergence, possibly due to differences in local density, edge formation policies, or subgraph structures. Moderate adaptation via structure-an -wwere encoders remains beneficial here.
High-GSS domains (GSS 0.5): BlogCatalog (0.5200) and ACM (0.5719) exhibit strong structural misalignment. These domains likely differ in both macro-scale topology (e.g., degree skewness, small-worldness) and micro-scale motifs. As result, traditional structural priors become unreliable, necessitating robust affinity modeling or structure- invariant mechanisms for effective transfer.
B.3 Empirical Evidence
The Solution of FSS and GSS Challenges. To balance feature space shift and graph structure shift across domains, we adopt a weighted fusion scheme (Eq, 13) controlled by weighting factor [0, 1]. Our empirical study (Fig. 4 reveals clear correspondence between the optimal choice of X and the underlying FSS/GSS characteristics of cach dataset. Specifically, datasets suffering from substantial semantic shift, such as Citeseer (FSS 0. 0.7022, GSS 0.2970) and Cora (FSS achieve peak performance at lower values of X (e.g., 0.1-0.3). This indicates
0,4937, GSS = O.hiee)-achieve that the residual-base semantic score RS((;) plays a dominant role these scenarios, where invariant feature alignment is crucial for mitigating cross-domain semantic discrepancies. In contrast, structurally misaligned domains like ACM (FSS 0.0214, GSS 0.5719) and Facebook (FSS 0.3494, GSS = 0.4583) require larger À values (e.g., 0.7-0.9), reflecting stronger dependence on the affinity-based structural score AS(w)) these cases, topological deviations from the source domains dominate, making structural modeling the primary means of anomaly detection. These findings confirm that our fusion mechanism ficxibly adapts to the dominant domain shift semanicii or structural structural-theredd thereby enabling robust zero-shot generalization without manual tuning.
C Algorithm and Complexity
C.1 Algorithmic description
The algorithmic description of the training and inference process of IA-GGAD is summarized in Algorithm. [ and Algorithm. respectively.
25

---

(a) Amazon
(b) BlogCatalog
(c) Reddit
Amazon
Catallng
Roddit
ALRDC ALPRC
ALRDC ALPRC
AURO
AUFRI
AUPRI
AUROC
AUFRC
041
042
2.0
0.0
0.5
041
impoct
(d) Cora
(e) CiteSeer
(f) Weibo
Cora
CReSeer
Welbo
ALROC ALTIC
ALRIC ALTIC
AUBOC
PUROC
AULFRIC
AUPIC
AUROC
23 E2 B1
55:
(g) ACM
(h) Facebook
ACM
Parebaak - AURDC
AUROC AUFIC
AUPBC
AUROC
AUPRC
AUPRi
The
Figure 4: Impact of anomaly score weighting factor X on AUROC and AUPRC across different datasets.
Algorithm 1: The Training algorithm of IA-GGAD
Input:
Training datasets Tirain-
Parameters :Number of epoch T: GCNs layers: L.
Generate initial parameters for all learnable parameters.
2 for D E Terain do
Obtain aligned features X from X feature alignment. end
for each epoch f. = 0, 2, ..., T do
for D Terain do
Obtain X, A, V.y from D - Z GCNs transform embedding via Eq. (3
Initial and update E (e1, .eM with Z lIl via Eq.
10
for 8 -= 1 L do
7, [4] concat _ and E via Eq. 6
12
< Calculate residual of hy and h. [1]
via Eq.
13
end
14
Caleulate loss Linv and Cres via Eq. 5 and Eq.
(8
15
Obatain node affinity emebding H via Eq. 9
16
Calculate nodes affinity score AS(v; by Eq.
10
17
Maximize node affinity by Lafr Eq. 11)
18
Update model parameters via gradient descent.
19
end
20 end
26

---

Algorithm 2: The Inference algorithm of IA-GGAD
Input: Test dataset Trest
Parameters: Well-trained IA-GGAD model weight parameters.
for E Trest do
Obtain aligned features X from X via feature alignment.
3 end
4 Obtain X, A, from D
| _ .... 2 <- GCNs transform embedding via Eq.
for
do
h/ + concat z and pretrianed E via Eq. 6
[1] r, - Calculate residual of h and h via Eq.
end
10
Obatain node affinity emebding H via Eq.
Calculate residual dispersion score RS(w:) by Eg. 12
12 Calculate nodes affinity score AS by Eq. (10)
Joint anomaly scoring and predictionS(ey by Eq.
C.2 Complexity Analysis
Training Phase. The total time complexity in the training phase of IA-GGAD consists of four main components:
Feature alignment:
projecting raw node features X E Raxd into unified latent space with dimension d, via linear projection (e.g., PCA), resulting in complexity O(nddy)-
Graph representation learning: using L-layer GCNs for message passing and residual encoding. This includes feature propagation ((md,, and residual encoding O(nd,h+nlh leading an overall complexity of (L(m,, + nd,, + nh²)).
Invariant prototype updating: constructing and updating invariant features pool E of M domain-invariant features using nearest neighbor assignment: Od.Md.).
Affinity learning: calculating affinity scores between each node and its neighbors using cosine similarity: (nd h), where d is the average node degree, h is the affinity emebding.
Thus, the total training complexity is:
O (ndd., L(md, + nd,h h + nh²) nMd, + nd h)
In our experiments, the total training time across all datasets approximately 9 minutes for five independent runs (with different random seeds), conducted on an NVIDIA GeForce RTX A6000 GPU.
Testing Phase. The inference process involves feature alignment, embedding generation, and anomaly scoring:
Feature alignment: similar to training. O(nddy) for projection, smoothness computation, and feature reordering.
Embedding generation: OLL(md, + nd.h + ndh)), as in training.
Anomaly scoring:
Residual dispersion scoring via A sample in residual space: O(nkh).
Affinity scoring via neighbor cosine similarity: ((dh)).
Weighted fusion and thresholding: O(n).
Therefore, the total inference complexity is:
O (ndd,, + L(mdy + nd.h + nll?) + nkh + nd T.)
In our experiments, the total inference time across all datasets was approximately 3-5 seconds when performed on an NVIDIA GeForce RTX A6000 GPU.
27

---

D Detailing Related Work
Anomaly Defection. Anomaly detection (AD) aims to identify samples that deviate significantly from the norm [] Due to the scarcity of labeled anomalies, most AD methods operate in an unsupervised
manner. To extract anomaly patterns without supervision, existing approaches leverage techniques
such as one-class classification [46], iittance-based scoring [47], reconstruction [15], generative
modeling [48], and self-supervised learning [16). For instance, DeepSVDD [46] formulates an objective to learn compact representations within hypersphere, capturing the common modes of normal data. AnoDDPM [4 adopts a partial diffusion process with simplex noise to detect anomalies effectively, particularly in reghuresolution image settings. While effective, these methods are typically specialized for the domain on which they are trained, limiting their ability to generalize to unseen datasets or cross-domain scenarios.
Anomaly Detection. To overcome dataset-specific limitations, recent anomaly detection (AD) research has explored generalization across domains. Some methods tackle domain shifts by leveraging distribution alignment or domain adaptation [49 50), yet they often assume semantic similarity between source and target domains, which limits broader applicability. A more flexible strategy is the few-shot setting, where a small number of normal samples from the target domain are available to guide detection. Under this paradigm, RegAD [ST learns a transferable model that generalizes to new domains without retraining. WinCLIP [52 and InCTRL [53] exploit dision-languag models (VLMs) such CLIP to achieve zero- few-shot image anomaly detection. Despite their impressive performance on image data, these methods rely heavily on pre-trained vision encoders and tailored architectures, limiting their transferability to graph-based domains.
Anomaly Detection on Graph Data. Depending on the granularity of anomalies, graph- based anomaly detection (AD) methods can be broadly classified into three categories: node-level 15 [] edge-level [54), and graph-level [55] [66.. Among these, node-level AD has attracted the most attention due to its wide applicability in real-world scenarios [6] In this work, we focus specifically
on node-level anomaly detection and adopt the term Graph Anomaly Detection (GAD), in line with
common usage in prior literature
22 3 23
Graph Anomaly Detection. Early graph anomaly detection (GAD) methods primarily relied on shallow techniques. For instance, AMEN [7 detects anomalies by modeling attribute correla- tions within each node's 's ego-network. Residual analysis was also commonly employed, such as in Radar (18), which evaluates inconsistencies between node attributes and structural information. ANOMALOUS [19 further integrates attribute selection with anomaly scoring via CUR decomposi- tion. Although these methods achieved reasonable performance on low-dimensional graphs, they struggle with complex structures and high-dimensional attributes due to their limited representational To overcome the limitations of shallow methods, graph neural networks (GNNs) have become the dominant paradigm for graph anomaly detection (GAD). Existing GNN-based approaches can be broadly categorized into supervised and unsupervised settings 6 35). Supervised GAD assumes access to labeled normal and anomalous nodes, and research in this direction primar- ily focuses on improving convolutional architectures and task-specific objective functions (59 3).
capacity (7 58
For example, CARE-GNN [59] enhances fraud detection by incorporating label-aware neighbor aggregation via reinforcement learning to combat disguise attacks. Spectral methods provide another perspective, linking anomalies to freeuencygnyyy signals in the graph spectrum. BWGNN S intro- duces band-pass filters to capture localized spectral patterns, while GHRN (26) further emphasizes high-frequency components by pruning inter-class edges, isolating anomalous nodes more effec- tively. Unlike supervised methods, unsupervised graph anomaly detection (GAD) does not rely on labeled data. Inspired by unsupervised anomaly detection in images, these approaches adopt various learning paradigms-suu as reconstruction, contrastive learning, and auxiliary pretext tasks-to uncover node-level anomalies. For example, DOMINANT (15) leverages a graph autoencoder to jointly reconstruct adjacency and attribute matrices, detecting anomalies via reconstruction errors. ComGA (23 enhances detection by integrating community structure and tailored GCNs to capture local and structural anomalies. CoLA [66] introduces contrastive self-supervised learning into GAD, constructing instance pairs without labels to learn discriminative node representations. HCM-A [7 incorporates hop prediction and Bayesian learning to integrate multiscale context. More recently, TAM 29 proposes a homophily-awan affinity score, optimized end-to-end on truncated graph structure to better isolate anomalous nodes. GCTAMB0 extends one-class deep learning to graphs by optimizing an affinity objective over global GNN embeddings.
28

---

Generalist Graph Anomaly Detection. Nevertheless, all the above methods adhere to the conven- tional paradigm of "one-for-one" dataset. Recent work proposes generalist graph anomaly detection frameworks. ARC [20], "one-for-all" GAD framework based on in-context learning, which aligns node features from different graphs using learned feature-space projection, encodes residual neigh- borhood patterns via an ego-neighbor graph encoder, and employs cross-attentive scoring module that compares nodes to a few-shot set of normal examples. UNPrompl [22], a zero-shot generalist GAD model trained a single source graph, which aligns the dimensionality and semantics of node attributes across graphs through coordinate-wise normalization and learns generalized neigh- borhood prompts that the predictability of latent node attributes serves universal anomaly score. Despite their contributions, ARC and UNPrompt have limitations. ARC still requires a few target-domain normal examples at inference, and its learned alignment may not climinate all domain shifts. UNPrompt relies on consistent attribute semantics and single-source training setup, which limit its applicability when graphs vary widely in feature space structure. In contrast, IA-GGAD directly addresses these gaps. IA-GGAD zero-shot generalist GAD framework requiring target-specific data fine-tuning.
E Description of Datasets
Following ARC [00] we evaluate our model benchmark datasets, categorized into four groups: (1) citation networks with injected anomalies, (2) social networks with injected anomalies, (3) social networks with real anomalies, and (4) co-review networks with real anomalies. For each category. we designate the largest dataset as the training source, while the remaining datasets serve as testing targets. This setting enables comprehensive evaluation of the generalization capability of our proposed IA-GGAD model.
Table summarizes the statistics of all datasets. The selected datasets span diverse domains and include both synthetic and real-world anomalies, ensuring the model is exposed to a wide range of anomaly types. This diversity essential for equipping IA-GGAD with the ability generalize effectively to unseen graphs. Detailed descriptions of each dataset are provided below.
Table 7: The statistics of datasets.
Dataset
Train
Test
#Nodes
#Edges
#Features
Avg. Degree
#Anomaly
% %nnomlay
Citation network with injected anomalies
Cora
2,708
5,429
1,433
3.90
150
5.53
CiteSeer
3,327
4,732
3,703
2.77
150
4.50
ACM
16,484
71,980
8,337
8.73
597
3.62
PubMed
19,717
44,338
500
4.50
600
3.04
Social network with injected anomalies
BlogCatalog Flickr
5,196
171,743
8,189
66.11
300
5.77
7.575
239,738
12,047
63.30
450
5,94
Social network with real anomalics
Facebook
1,081
55,104
576
50.97
25
2.31
Weibo
8,405
407,963
400
48.53
868
10.30
Reddit
10,984
168,016
64
15.30
366
3.33
Questions
48,921
153,540
301
3.13
1,460
2.98
Co-review network with real anomalies
Amazon
10,244
175.608
25
17.18
693
6.76
YelpChi
23,831
49,315
32
2.07
1,217
5.10
Cora, CiteSeer, PubMed 60) and 6C are four widely-used citation network datasets. In these datasets, nodes correspond to scientific publications, and edges represent citation relationships between them. Each node is described by bag-of ofords feature vector, where the dimensionality is determined by the size of the vocabulary specific each dataset.
Catalog and Flickr [[5] are representative social network datasets, where users are connected via mutual following relationships. Each user is represented as node, and edges denote social connections. Node attributes are derived from user-generated textual content within the platform, including blog posts, photo tags, and other descriptive metadata.
29

---

Amazon and YelpChi 62 63 are datasets that capture user-review interactions to identify opinion fraud. The Amazon dataset constructed to detect users who were incentivized to post fake product reviews. Following prior work three graph variants are derived from Amazon using different relational schemes to form adjacency matrices. YelpChi, on the other hand, focuses on detecting deceptive reviews on Yelp.com that unfairly promote or defame businesses, Based on [62 64], three graph variants are also constructed for YelpChi, incorporating relationships among users, review content, and timestamps. In this study, we specifically adopt the Amazon-UPU variant (where edges connect users who reviewed at least one common product) and the YelpChi-RU CelpChi-RUR variant (where edges connect reviews posted by the same user).
Facebook 665] is a social network in which users can build relationships with others and share their friends.
Reddit (66] is forum-based social network dataset collected from the Reddit platform. In this dataset, users who have been banned are labeled as anomalies. Each node represents a user, and edges reflect interactions such as replies shared threads. The textual content of user posts is encoded into vector representations and used as node attributes.
Weibo [66] is a social media dataset derived from the Tencent Weibo platform, comprising graph of users and their associated hashtags. Within defined temporal window (e.g., 60 seconds), if a user posts consecutively, the behavior is considered potentially suspicious. Users who exhibit least five such instances are labeled as "suspicious" and treated as anomalies. Node features include geolocation data of microblog posts and bag-of oo-words representations of the textual content.
Questions 67 dataset originates from Yandex Q. a platform dedicated to question- answering. Users represent the nodes, while the connections between them signify the presence or absence
question-and-ansver interaction within a one-year timeframe. Node features are constructed by averaging the FastText embeddings of the words in each user's profile description. An additional binary feature is included to denote users with missing descriptions.
Anomaly Injection. For datasets with injected anomalies, follow the injection strategy introduced in [6]. Specifically, we directly adopt the publicly available datasets from ARC [20]. in which anomalies have already been injected using standardized procedures. In summary, the injection process perturbs both graph structure and node attributes. Structurally, anomalous cliques are created by densely connecting randomly selected nodes, simulating unnatural substructures. For attribute perturbations, features of selected nodes are replaced with those from the most dissimilar nodes to ensure significant semantic shift. The total number of anomalies controlled proportionally the dataset size. More detailed statistics of all datasets are summarized in Table 7
F Description of Baselines
In our evaluation, we present a comprehensive comparison of IA-GGAD against variety of graph anomaly detection (GAD) methods, including supervised, -upirvupee and unsupervised paradigms. We also include comparisons with recent SOTA generalist GAD (GGAD) approaches, which aim to perform anomaly detection across diverse datasets using a single unified model.
Supervised Method. For the supervised setting, we consider two classical GNN architectures as well as four state-of-the-art (SOTA) models specifically developed for the GAD task. These methods assume access to labels for both normal and anomalous nodes during training. Accordingly, the problem is framed as a binary node classification task, where the goal is accurately distinguish anomalous nodes from normal ones.
GCN 44 is seminal model in the development of graph neural networks (GNNs). It leverages neighborhood aggregation effectively capture local graph structure, enabling efficient node feature extraction and representation learning for graph-structured data.
GAT 36 introduces an attention mechanism into the GNN framework, allowing the model to dynamically assign weights to neighboring nodes. This enhances its adaptability across downstream tasks by producing context-aware node representations.
30

---

integrates gradient boosted decision trees (GBDTs) with GNNs to effectively handle graphs with tabular node features. While GBDTs manage feature heterogeneity, the GNN component captures structural dependencies, leading to superior performance on mixed-type data.
BGNN 25
BWGNN 3 utilizes spectrally and spatially localized band-pass filters to address the "right- shift" phenomenon in graph anomalies, where abnormal nodes tend to exhibit high-freyuency spectral energy concentrations.
GHRN 26 is heterophily-awee supervised GAD model based on spectral analysis. By enhancing high-frequency signals and pruning inter-class edges, GHRN effectively isolates anomalous nodes and improves detection performance.
CAGAD 27 employs a graph pointer network to identify heterophilic momaliis--odde embedded in neighborhoods dominated by normal nodes. It generates counterfactual representations by aggregating information from unseen neighbors, enhancing anomaly detection in an unsupervised manner.
Semi-supervised Method. For the semi-supervised method, S-GAD 28 a recently proposed method specifically designed for graph anomaly detection with access only small subset of labeled normal nodes.
S-GAD 688] a semi-supervised GAD method that uses a few labeled normal nodes to train one-class classifier. It generates learnable aneoal-nnoaalies based asymmetric local affinity and egocentric closeness, which serve as negative samples to enhance anomaly detection without requiring labeled anomalies.
Unsupervised Methods.For the unsupervised methods, we consider 5 representative SOTA GAD methods, each of them belonging to a sub-type: data reconstruction, contrastive learning, hop-based auxiliary goal, or affinity-basse -based auxiliary goal:
DOMINANT [15] combines GCN and deep auto-encoder, and its learning objective is to
reconstruct the adjacency matrix and node features jointly. It aims to identify structural and attribute anomalies based on reconstruction errors.
contrastive self-supervised learning for anomaly detection on graphs with node attributes. The framework captures the relationship between each node and its neigh- borhood substructure in an unsupervised manner by sampling novel pairs of contrasting instances and leveraging the local information of the graph.
CoLA [6
uses hop-count prediction as a self-supervised task to better identify anomalies by modeling both local and global context information. In addition, HCM-A designs new anomaly scores and introduces Bayesian learning to train the model to capture anomalies.
HCM-A 37
designed based on one-class homophily and local affinity. The learning target of TAM is to optimize the proposed anomaly metric (i.e., affinity) end-to-end on the truncated adjacency matrix.
'TAM
29
GGTAM 30 is unsupervised GAD method that enhances truncated affinity maximiza- tion by combining contextual and global affinity truncation. introduces two key modules: contextual affinity truncation (CAT), which reduces the influence of anomalous nodes by cutting weak contextual links, and global affinity truncation (GAT), which enhances affin- ity among normal nodes. By integrating both modules through shared GCNs, GCTAM generates node representations that better reflect homophily and irregularity. significantly boosting anomaly detection performance across real-world datasets.
Generalist GAD methods. For the generalist setting, we consider 2 state-of-the-ar GGAD methods that aim to detect anomalies across diverse domains using a unified model. These methods do not rely on dataset-specific training or adaptation and are designed to generalize to unseen graphs via in-context learning, prototype alignment:
'TAM: htwaa//prr//sttab....///aaaaaaa/ 2GCTAM: httppp////gggiabbbcoo//////////p 3 ARCC httpppps/gghaab....ooaaaaaaa///p
UNPrompt http:::/github.cco./////
31

---

is few-shot generalist GAD method based on in-context learning. It uses residual graph encoder to extract anomaly-aware node features and a cross-attention module to reconstruct query nodes from few labeled normal context nodes. Anomaly scores are computed by measuring residual distance between original and reconstructed embeddings, allowing ARC to detect anomalies across unseen graphs without fine-tuning.
A AARC 20
'UNPrompt 22 is zero-shot generalist GAD method that unifies node attributes across graphs via coordinate-win wise normalization and learns transferable normal/abnorral patterns through neighborhood prompt learning. It performs anomaly detection by measuring latent attribute predictability without any training or labels on the target graphs.
G Details of Implementation
Hyper-parameters. We select some key hyperparameters of IA-GGAD through random search within specified grids. Specifically, the random search was performed within the following search space:
Hidden layer dimension: {64, 128, 256, 512, 1024]
Number of invariant and affinity encoder layers: {1, 2, 3]
Dropout rate: {0, 0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8)
Learning rate: floats between 10-5 and 10-2
Weight decay: floats between 10 and 10-3
Number of invariant features: (1024, 2048, 4096, 8192)
Baseline Implementation. We adopt unified set of hyperparameters to construct generalist GAD model applicable across all datasets. All methods, including the proposed IA-GGAD and baseline models, are first trained on the source training set Ttrain using full anomaly labels. Subsequently, each model is evaluated independently on every dataset in the target test datasets T Teest, without any retraining fine-tuning. For feature projection, apply Principal Component Analysis (PCA) to map the raw node attributes into a fixed-dimensional latent space with da 64. In cases where the original feature dimension is smaller than du,, we first apply random projection (e.g., Gaussian random projection) to upscale the features, followed by PCA to ensure uniform dimensionality alignment du. For CAGAD(27) S-GAD(28), GCTAM 30), and UNPrompt [22), we reproduce their results using their official implementations and conduct optimal hyperparameter tuming. For all other baselines, we follow the reproduction settings reported in ARC (0) worth noting that all methods are trained and evaluated under the same standardized experimental pipeline to ensure fair comparison.
38), we employ two popular and complementary evaluation metrics for evaluation, including under the receiver operating characteristic Curve (AUROC) and area under the precision-recall curve (AUPRC). A higher AUROC/AUPRC value indicates better performance. We report the average AUROC/AUPRC with standard deviations across 5 runs.
Metrics. Following 35 29
Implementation Details. The experiments in this study were conducted on Linux server running Ubuntu 20.04. The server was equipped with 13th Gen Intel(R) Core(TM) 17-12700 CPU, 64GB of RAM, and an NVIDIA GeForce RTX A6000 GPU (48GB memory). For software, we used Anaconda3 to manage the Python environment and PyCharm the development IDE. The specific software versions were Python 3,8.14, CUDA 11.7, DGL 0.9.1, and Py Porch 2.0.1 69].
H Supplementary Experiments
H.1 Performance Comparison of AUPRC
Table 8 presents the anomaly detection performance in terms of AUPRC across eight target datasets.
IA- IA-GGAD achieves the best overall ranking (1.87), consistently outperforming both conventional GAD baselines and recent generalist methods. It ranks first on five datasets (ACM, Amazon, Cora, CiteSeer, weibo) and second on two (BlogCatalog, Reddit), demonstrating strong adaptability to diverse semantic and structural shifts. Notable gains over the strongest baseline, ARC, include
32

---

+ on ACM, +12.29% on Amazon, and +6.77% % on Weibo. On Facebook ARC's strongest domain-IA-GGAD remains competitive (6.55% vs. 8.38%. -1.83% gap). While ARC ranks second overall, its performance varies across datasets. GCTAM performs well on ACM and Facehook but fails to generalize under structural shift. Traditional models like GCN, GAT, and BGNN perform poorly, particularly on complex graphs such as Reddit and Weibo, highlighting their limited transferability. These results validate the effectiveness of IA-GGAD's ' fusion of invariant semantic features and structure-aware affinity encoding, enabling robust zero-shot anomaly detection across heterogeneous domains.
Table 8: Anomaly detection performance in terms of AUPRC (in percent, meansstd), Highlighted are the results ranked first, second, and third. "Rank" indicates the average ranking over 8 datasets. Methods with representes reproduce results, others are report results in ARC[20],
Mathod
ACM
Facehook
Amazon
Cora
CiteSeer
BlogCaraing
Keddit
Weiho
Runk
methods
GUN(20T2)
3.2721.12
1.5920111
6:9662204
141+1135
6.40 20
7,44+ 17
3,3940
6721415 20
16:25
GAT(2018)
4.70=0.75
3.14
15.74+17.85
6.4920.84
5.58+0.62
12.81 08
3.73+0.54
33.34a9.88 80
8.0
BGNN22021)
3.8-1133
181+2.12
7.51+0558
4.001.277
3.1+1.01
47
3.52+0.50
30,26429
BWGNN(2022)
7.1420.20
2.5410.63
13.12:11.82
7.2510.8 80
6.3510.73
8.9911
3.6910
12.1340.71
9.75
GHRN(2023)
56120.71
241
7.54+2.01
9.5642.40
7.79&2.01
10.94 56
3.24
28.53+7.38 38
9.37
DOMINANTI 2019)
15.59+2.69
2.95+0.06
6.11+0.29
12.75+0.71
13,85+2.4 34
35,2240
3,4940.44
81.47+0.22
CoLA(2021)
7.312145
190020.6 68
11,061:445
11.41:3.11
8.3343.73
6.0410.55
5.7110667
7,5913
9.62
HCM-A(2022)
4.0120.61
2 1.0860.60
5.8740.07
5.7810.76
4.18.0.75
6.8910.34
3.1840.23
21.91
12.62
TAM(2023)
23.20+2.36
40:00.97
10.75+3.10
11,18+0.75
11,55+0
10:57+1.17
3.94+0.13
16.46+0.09
6.37
CAGADD2024)
797=4.67
2.61:0.76
3.49
5.31+3.20
385+1
06
13.56:18.91
20.9518834
2-24D)2024)
9.7242.18
3.4411.05
7.3710.98
1.6510.50
3.72+0.30
22.9516.51
4.2510.21
$2.4214.13
8,57
GCTAM(2025)*
48.09:0.25 28
9.61
13.71
9.52+0.69
10.29+0.26
27.47+0.54
4.34M0.17
16.87+1.31
methods
UNPrompt(2024)
50
2.6110.4
10:2717.01
6.0210.2
4,4710.32
24.8913 25
5.1510.65
18.6714.38 3.3
7.87
ARC(2024)
40.62:0.00 10
3.382.29
44 25 7.41
49 33tl
45,77+1.22
36.66:0.15
4.4840.26
64.1840.55
2.62
52.47 16.54
35.5240.11
4.74
33


Reviews:
[{"review_id": "Em7BlyuKK3", "reviewer": "Reviewer_HvJR", "summary": "This paper aims to tackle Feature Space Shift (FSS) and Graph Structure Shift (GSS) problems. The authors proposes a Generalist Graph Anomaly Detection framework called IA-GGAD, enabling anomaly prediction on unseen graphs without target-domain retraining or fine-tuning. To tackle FSS, they develop an anomaly-driven graph invariant learning module that learns domain-invariant node representations. To address GSS, a novel structure-insensitive affinity learning module is introduced, capturing cross-domain structural correspondences via affinity-based features.", "questions": "Do we really need FSS?", "limitations": "Yes", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 3, "strengths_and_weaknesses": "S1: IA-GGAD doesn't require target-domain samples at inference, which is a limitation of ARC.\n\nS2: IA-GGAD outperforms SOTA models including ARC and UNPrompt by a large margin, around 10%.\n\nS3: FSS and GSS Problems are clearly defined and theoretically supported, hence easy to understand.\n\nW1: In Table 2, the performance gap between \"w/A—backbone plus graph affinity encoder\" and \"ours\" is trivial. Also observed in Table 3, the performance improvement is limited on FSS dominated datasets. As graph algorithms are always heavy and hard to deploy on large-scale graph, do we really need FSS?\n\nW2: Reference for a related FSS paper [1] is missing.\n\n[1] Gao et al. Alleviating Structural Distribution Shift in Graph Anomaly Detection. WSDM'23.", "was_revised": false, "final_justification": "", "rebuttal": "We appreciate Reviewer  HvJR for the positive review and constructive comments. We provide our responses as follows.\n\n\n**Q1: Do we really need FSS?**\n\n**A1:**  We appreciate the reviewer's valuable suggestion.  We provide a detailed explanation of why FSS is truly necessary from the following five perspectives.\n\n **1. Mechanistic argument** \n\nFeature Space Shift (FSS) measures how far the source and target feature distributions drift in a reproducing-kernel Hilbert space. When FSS is large, residual embeddings that appear “normal” in the source domain may overlap with anomalous ones in the target domain. Theoretical analysis (see Appendix A.2, Eq. (1)) bounds the cross-domain error:\n\n$$\\[ \\varepsilon_t(h) - \\varepsilon_s(h) \\leq \\alpha \\sqrt{\\text{FSS}} + \\beta \\sqrt{\\text{GSS}} + \\gamma \\sqrt{\\frac{\\ln(1/\\delta)}{N_o + N_t}} \\]$$\n\nSo, an unchecked FSS term linearly inflates the target error. The invariant\u001efeature module explicitly minimizes this term by aligning node semantics across graphs.\n\n**2. Quantitative evidence**\n\nTable 1 lists the average FSS score of every target graph and the AUROC gain obtained when the invariant-feature module is enabled (“Backbone → Backbone + I”). The Spearman correlation between FSS and the AUROC gain is 0.93 (p < 0.01), showing that the benefit grows with the severity of FSS.\n\nTable 1: FSS versus AUROC improvement\n\n| Dataset     | FSS   | Δ AUROC |\n|-------------|-------|---------|\n| ACM         | 0.021 | +0.18   |\n| BlogCatalog | 0.022 | +0.58   |\n| Reddit      | 0.019 | +1.58   |\n| Amazon      | 0.032 | +1.02   |\n| Facebook    | 0.349 | +0.29   |\n| Cora        | **0.494** | **+1.23**   |\n| Weibo       | **0.548** | **+2.33**   |\n| CiteSeer    | **0.703** | **+0.94**   |\n\nAverage gain on high-FSS graphs (FSS ≥ 0.5) is +1.50 AUROC, confirming that the module is most useful where FSS is indeed a problem.\n\n**3. Computational overhead and large-scale viability**\n\nTable 2: Cost of adding the invariant-feature module\n| Model            | Train time | Inference time | GPU memory |\n|------------------|------------|----------------|------------|\n| Backbone only    | 14.27 s    | 0.22 s         | 4.78 GB    |\n| Backbone + I     | 17.41 s    | 0.31 s         | 6.90 GB    |\n\n\nThe extra 3 seconds of training, 0.09 seconds of inference, and 2 GB of memory are negligible in practice. The same configuration fits into 48 GB on a single RTX A6000 and succeeds on two large-scale finance graphs (results below, AUROC):\n\n| Method         | DGraph-Fin | T-Finance |\n|----------------|------------|-----------|\n| ARC (2024)     | 0.4746     | 0.6410    |\n| IA-GGAD (ours) | **0.5439**     | **0.7541**   |\n\nMany baselines run out of memory on these graphs. IA-GGAD does not.\n\n**4.  Anticipated follow-up questions and concise clarifications**\n\n| Concern from Reviewer                               | Clarification                                                                                                                                                          |\n|------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| FSS is small on some graphs: will the module hurt?   | No. On the four graphs with FSS < 0.05, the average gain is still +0.79 AUROC and never negative. The vector-quantised pool learns to ignore trivial shifts.          |\n| Could simple normalisation replace the module?       | Linear scaling aligns ranges but not anomaly semantics. Our module couples vector quantisation with residual contrast, enforcing semantic consistency.               |\n| Does it work for very high-dimensional sparse text?  | Yes. CiteSeer has 3703-D bag-of-words features, and Weibo has 400-D geo-text features. Both see clear gains (+0.94 and +2.33 AUROC).                                   |\n| Could the GSS branch alone be enough?                | No. CiteSeer and Cora have graph structures similar to PubMe,  yet very different word distributions; they need semantic alignment. ACM and Facebook need structural alignment. |\n\n**5. Summary**\n\nThe invariant-feature branch that mitigates Feature Space Shift is theoretically motivated, statistically correlated with performance, cheap to run, and effective even on million-scale graphs. Without it, IA-GGAD loses up to 2.3 AUROC on the large target graphs. We therefore conclude that FSS mitigation is not optional but essential for reliable zero-shot generalization.\n\n\n**Q2: Missing reference for an FSS-related paper.** \n\n**A2:** Thank you for the suggestion!   A  related FSS paper, **GDN[1]**, has been cited in the revised manuscript.  \n\n[1] Gao et al. Alleviating Structural Distribution Shift in Graph Anomaly Detection. WSDM'23."}, {"review_id": "nUnT8JwSLq", "reviewer": "Reviewer_cw3e", "summary": "This paper proposes IA-GGAD, a unified framework for zero-shot generalist graph anomaly detection that tackles feature space shift (FSS) via anomaly-driven invariant feature learning and graph structure shift (GSS) via structure-insensitive affinity learning, enabling anomaly detection on unseen graphs without retraining and achieving state-of-the-art performance across various benchmark datasets.", "questions": "See Weaknesses.", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths\n\n1. Novelty and Significance:\n\nThe work pioneers multi-domain pre-training and domain generalization for graph anomaly detection (GAD), addressing a critical real-world gap: deploying a single model on unseen graphs without labels or adaptation. The formalization of FSS/GSS and empirical study provide a foundation for future GGAD research. The integration of invariant feature learning (via domain-invariant prototypes) and affinity learning (via structural homophily) offers a principled solution to cross-domain shifts. The unified framework is both innovative and practical.\n\n2. Rigorous Evaluation:\n\nExperiments span diverse domains with both synthetic and real anomalies. IA-GGAD consistently outperforms SOTA methods, validating its generalizability. Ablation studies and sensitivity analyses conclusively demonstrate the contribution of each module. The method excels on both FSS-dominated and GSS-dominated graphs.\n\n3. Practical Utility:\n\nThe zero-shot inference pipeline eliminates target-domain retraining, reducing computational costs and enabling real-world deployment. Publicly released code enhances reproducibility.\n\nWeaknesses：\n\n1. Theoretical Grounding:\n\nWhile the empirical results are compelling, the paper lacks formal theoretical analysis for domain generalization. A theoretical guarantee (e.g., generalization bounds for multi-domain pre-training) could strengthen the invariance claims and provide deeper insights into the method's robustness.\n\n2. Scalability Validation:\n\nExperiments focus on moderate-sized graphs. Testing on large-scale datasets (e.g., DGraph[1]) would better validate scalability. \n\n[1] Huang X, Yang Y, Wang Y, et al. Dgraph: A large-scale financial dataset for graph anomaly detection[J]. Advances in Neural Information Processing Systems, 2022, 35: 22765-22777.", "was_revised": true, "final_justification": "My concerns have been addressed, thus I vote for acceptance.", "rebuttal": "We are grateful to Reviewer cw3e for providing insightful feedback. The detailed responses are provided below.\n\n**Q1: Theoretical Grounding**\n\n\n\n\n**A1:**   Thank you for your valuable suggestion. We provide a theoretical generalization bound in Appendix A (Theorem 2), which quantifies the domain shift between source and target graphs:\n\n**1. Position of Theorem 2 within the paper.**\n\nTheorem 2, presented in Appendix A, provides a data-dependent generalization bound that explicitly decomposes the risk gap between the source and target graphs into Feature‑Space Shift (FSS) and Graph‑Structure Shift (GSS) terms.  It belongs naturally in Appendix A together with the RKHS and MMD preliminaries, so we keep the current chapter ordering intact.\n\n**2. Bound statement (for convenience, reproduced here)**\n\nFor any hypothesis **h** and confidence δ∈(0,1):\n\n$$\\[ \\varepsilon_t(h) - \\varepsilon_s(h) \\leq \\alpha \\sqrt{\\text{FSS}} + \\beta \\sqrt{\\text{GSS}} + \\gamma \\sqrt{\\frac{\\ln(1/\\delta)}{N_o + N_t}}\\]$$\n\nFSS and GSS are squared maximum‑mean discrepancies of node features and structural vectors, respectively.  The last term is the usual concentration factor.\n\n**3. How IA‑GGAD minimizes the bound.**\n\n- **Invariant feature pool** to reduce $\\sqrt{FSS}$\n- **Affinity encoder** to mitigate $\\sqrt{GSS }$\n- **Joint training with losses**  $\\mathcal{L_inv}$   + $\\mathcal{L_res}$  +  $\\mathcal{L_aff}$ keeps both terms small simultaneously.\nBecause the third term depends only on sample size, once the two MMD terms are controlled, the overall gap remains bounded, explaining IA‑GGAD’s zero‑shot robustness.\n\n**4. Empirical alignment with the theory**\n\nTable 6 (Appendix C) shows that IA‑GGAD achieves the lowest combined ($\\sqrt{FSS}$ + $\\sqrt{GSS}$) on every target graph, mirroring its AUROC/AUPRC gains.  This tight empirical‑theoretical match further validates Theorem 2.\nWe hope this addresses the reviewer’s concern and strengthens the paper’s theoretical contribution.\n\n\n**Q2: Scalability Validation**\n\n**A2:** Thank you for the constructive suggestion. We have conducted additional experiments on two large-scale real-world financial graphs: **DGraph-Fin [1] (3.7M nodes, 4.3M edges)** and **T-Finance (39K nodes, 21M edges)**, both containing real anomalies. The results are summarized in the following table:\n\n| Name       | Nodes     | Edges       | Dim  | Anomaly | Anomaly Type | Size| Domain         |\n|------------|-----------|-------------|------|---------|---------------|----------------|----------------|\n| DGraph-Fin [1] | 3,700,550 | 4,300,999   | 17  | 1.3%    | Real          |Large| Finance network |\n| T-Finance  | 39,357    | 21,222,543  | 10   | 4.60%   | Real          | Large|Finance network|\n\n| Method           | DGraph-Fin | T-Finance |\n|------------------|------------|-----------|\n| DOMINANT (2019)  | OOM        | OOM       |\n| CoLA (2021)      | OOM        | 0.5134    |\n| TAM (2023)       | OOM        | OOM       |\n| CONSISGAD (2024) | 0.5176     | 0.5356    |\n| SmoothGNN (2025) [2] | 0.5271     | 0.3979    |\n| ARC (2024)       | 0.4746     | 0.6410    |\n| UNPrompt (2024)  | 0.5269     | 0.2386    |\n| AnomalyGFM (2025) [3]| OOM        | 0.6757    |\n| **IA-GGAD (Ours)**| **0.5439** | **0.7541** |\n\n**As seen above:**\n\n- **IA-GGAD achieves the highest AUROC** on both datasets, surpassing the best baseline by **+1.68% AUROC** on DGraph-Fin and **+7.84% AUROC** on T-Finance.\n- Many baselines failed with **OOM** on DGraph-Fin, but IA-GGAD remains **efficient and stable**.\n- These results demonstrate that IA-GGAD is not only accurate but also **scalable to million-scale real-world graphs**, validating its practical applicability.\n\n\n\n\n\n\n\nReference:\n\n[1] Huang X, Yang Y, Wang Y, et al. Dgraph: A large-scale financial dataset for graph anomaly detection[J]. Advances in Neural Information Processing Systems, 2022, 35: 22765-22777.\n\n[2] Xiangyu Dong, Xingyi Zhang, Yanni Sun, Lei Chen, Mingxuan Yuan, Sibo Wang. SmoothGNN: Smoothing-aware GNN for Unsupervised Node Anomaly Detection. WWW 2025.\n\n[3] Qiao H, Niu C, Chen L, et al. AnomalyGFM: Graph foundation model for zero/few-shot anomaly detection. KDD 2025."}, {"review_id": "aqUtV7YPoR", "reviewer": "Reviewer_dCzF", "summary": "This paper presents IA-GGAD, a zero-shot generalist graph anomaly detection framework addressing both feature and structure shifts via invariant feature learning and structure-insensitive affinity learning. The method is well-motivated, technically sound, and achieves strong empirical results across diverse benchmarks. The results demonstrate consistent and significant improvements over 14 competitive baselines. The model achieves up to +12.28% AUROC improvement over ARC on ACM and maintains strong performance across both FSS- and GSS-dominant settings.", "questions": "See weakness", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths：\n1. The proposed IA-GGAD framework effectively addresses both feature and structure shifts, enabling robust zero-shot anomaly detection across diverse and unseen graph domains.\n2. Extensive experiments on eight benchmark datasets show significant performance gains over strong baselines, highlighting the model’s generalization and practical utility.\n3. The paper provides clear ablation studies and quantitative shift analyses, demonstrating the effectiveness and complementarity of the invariant feature and affinity learning modules.\n\nWeakness：\n1. The anomaly scoring process involves multiple hyperparameters, including a test-set-derived threshold $\\tau$, raising concerns about fairness, stability, and comparability across different test-set, e.g. without a unified $\\tau$.\n2. While FSS and GSS are insightful, the formulation remains abstract. It’s unclear whether other domain shifts like class imbalance, multi-view, or fine-grained shifts are relevant.\n3. Although proposed as a zero-shot method, the model's generalization advantage is not strongly distinguished or deeply analyzed.", "was_revised": true, "final_justification": "My concerns are basically addressed so I'd like to keep my score. Generally speaking this work is interesting and can shed some light on the related research field.", "rebuttal": "We appreciate Reviewer dCzF for the perception of our contributions and thank the reviewer for the insightful feedback. The detailed responses are provided below.\n\n**Q1: Concerns about fairness, stability, and comparability.** \n \n**A1:**  Thank you for your thoughtful feedback. We clarify that the threshold $\\tau$ used in our anomaly scoring (Eq. 14) is **not selected based on test labels**. Instead, it is computed in an **unsupervised, data-driven manner**, using only the distribution of model-predicted scores within each test graph. This makes $\\tau$ applicable across all test graphs **without any information leakage** or dataset-specific tuning.\nMoreover, we emphasize that our main evaluation metrics—**AUROC and AUPRC**—are **threshold-independent**. They assess the quality of anomaly ranking, not binary classification. This ensures **fair comparability across test sets**, regardless of the absolute threshold used.\nThe adaptive thresholding is used **only for auxiliary binary label generation**, such as in ablation or visualizations, and does not affect reported performance metrics.\nWe will revise the paper to explicitly clarify this point and avoid potential confusion.\n \n**Q2: Other domain shifts** \n\n**A2:**  Thank you for this insightful observation. We agree that domain shifts in real-world graphs can manifest in diverse forms. Our current formulation of **Feature Space Shift (FSS)** and **Graph Structure Shift (GSS)** aims to capture two primary and orthogonal dimensions of domain discrepancy:\n- **FSS** (Eq. 1) quantifies distributional divergence in node features, covering shifts in feature dimensionality, encoding (e.g., BOW vs. embeddings), and semantic alignment.\n- **GSS** (Eq. 2) measures high-order structural misalignments, including graph sparsity, community structures, and local connectivity patterns.\nTogether, these offer a practical yet general abstraction for zero-shot generalization across graphs.\nWe acknowledge that **other domain shift types** such as class imbalance, multi-view features, and fine-grained (local) shifts are also important:\n- **Class imbalance** can be interpreted as a label distribution shift and may affect the residual space. Our current residual embedding loss could be extended with re-weighting strategies to address this.\n- **Multi-view settings** can be viewed as a composite form of FSS. Future extensions may incorporate view-specific encoders or attention mechanisms within our invariant learning module.\n- **Fine-grained shifts** (e.g., local structural anomalies) are partly captured by our residual deviation modeling and affinity-based scoring, though more granular metrics could enhance this.\n\n**Q3: Model's generalization advantage** \n\n**A3:** Thank you for pointing this out. We respectfully clarify that IA-GGAD is designed and evaluated under a **strict zero-shot setting**: the model is trained on multiple source graphs and applied directly to **unseen target graphs without access to any target-domain data or labels**, neither for training nor adaptation.\n\n**Strong Distinction from Prior GGAD Methods**\n- Unlike **ARC [18]**, which requires a few normal target samples at inference, and **UNPrompt [19]**, which is trained on a single source graph, **IA-GGAD is trained on multi-source data and performs zero-shot transfer across diverse domains**.\n- Our method achieves **state-of-the-art AUROC** on 7 out of 8 test graphs (e.g., +12.28% on ACM, +10.46% on Facebook compared to ARC), demonstrating both effectiveness and robustness.\n- Additionally, IA-GGAD exhibits **low standard deviations (<3%)**, indicating strong generalization stability under large domain shifts.\n**Theoretical Support and Architectural Design**\nTo further support the generalization behavior, we provide a formal **domain shift decomposition bound** in Appendix A (Theorem 2):\n$$\\[\n\\varepsilon_t(h) - \\varepsilon_s(h) \\leq \\alpha \\sqrt{\\text{FSS}} + \\beta \\sqrt{\\text{GSS}} + \\gamma \\sqrt{\\frac{\\ln(1/\\delta)}{N_o + N_t}}\n\\]$$\nThis bound shows how domain shift (FSS and GSS) inflates the generalization gap. Our model is specifically designed to minimize these two terms:\n- **Invariant Feature Pool**: mitigates Feature Space Shift (FSS)\n- **Affinity Encoder**: handles Graph Structure Shift (GSS)\nThis **dual alignment design** directly targets the theoretical drivers of domain generalization."}, {"review_id": "xlo329Yb4E", "reviewer": "Reviewer_5Jb1", "summary": "By tackling Feature Space Shift and Graph Structure Shift, this paper proposes a unified framework, IA-GGAD, enabling anomaly prediction on unseen graphs without target-domain retraining or fine-tuning. Experiments show the improvements on given datasets to some extend.", "questions": "Q1. Can this framework be applied to larger datasets, such as T-Social and DGraph-Fin? \n\nQ2. Can this framework be applied to cross-domain data? For example, will the performance drop a lot if it is trained on financial dataset and tested on social network? or reversely?", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 1, "strengths_and_weaknesses": "S1. This paper proposes a unified framework, IA-GGAD, enabling anomaly prediction on unseen graphs without target-domain retraining or fine-tuning.\n\nS2. Experiments show the improvements on given datasets to some extend. \n\n\nW1. The paper is hard to understand due to confused variables. For example, in Equation (4), $z_j^{[l]\\(l\\)}$ is not defined; in Equation (5), $\\hat{x}_i$ is not defined; in Equation (6), the subscript of argmax-k ranges from 1 to N while the subscript of e in this equation should range from 1 to M, and the different expressions of similar operation (argmin and argmax) in Equation (4) and (6), i.e., the $N_i$ in (4) is used as both a number and a set, while the $T_i$ is only used as a set. The authors should pay more attention to the writing style. \n\nW2. Experiments are not comprehensive enough. For baselines, there are several SOTA models without being compared, such as XGBGraph[1], CONSISGAD[2], UnifyGAD[3], SpaceGNN[4], and SmoothGNN[5]. For datasets, there are several more real GAD datasets from XGBGraph, such as T-Finance, DGraph-Fin, T-Social, and Elliptic, which can be better benchmarks than synthetic ones. \n\nW3. Some parts need furhter explanations. For example, in Equation (2), the authors utilize A·A as the input instead of A, which can be questioned, since such a input might cause a loss of information. \n\nW4. The novelty is limited. Such a framework is more like combining existing useful techniques. For example, in Structure-Insensitive Affinity Learning, the design is similar to the one in TAM[6]. The authors need to further explain the difference. \n\nReference: \n\n1. Jianheng Tang, Fengrui Hua, Ziqi Gao, Peilin Zhao, Jia Li. GADBench: Revisiting and Benchmarking Supervised Graph Anomaly Detection. NeurIPS 2023. \n\n2. Nan Chen, Zemin Liu, Bryan Hooi, Bingsheng He, Rizal Fathony, Jun Hu, Jia Chen. Consistency Training with Learnable Data Augmentation for Graph Anomaly Detection with Limited Supervision. ICLR 2024. \n\n3. Yiqing Lin, Jianheng Tang, Chenyi Zi, H. Vicky Zhao, Yuan Yao, Jia Li. UniGAD: Unifying Multi-level Graph Anomaly Detection. NeurIPS 2024. \n\n4. Xiangyu Dong, Xingyi Zhang, Lei Chen, Mingxuan Yuan, Sibo Wang. SpaceGNN: Multi-Space Graph Neural Network for Node Anomaly Detection with Extremely Limited Labels. ICLR 2025. \n\n5. Xiangyu Dong, Xingyi Zhang, Yanni Sun, Lei Chen, Mingxuan Yuan, Sibo Wang. SmoothGNN: Smoothing-aware GNN for Unsupervised Node Anomaly Detection. WWW 2025.\n\n6. Hezhe Qiao, Guansong Pang. Truncated Affinity Maximization: One-class Homophily Modeling for Graph Anomaly Detection. NeurIPS 2023.", "was_revised": true, "final_justification": "Although I still have concerns about the novelty, I have decided to increase my score to thank the authors.", "rebuttal": "We are grateful to Reviewer 5Jb1 for providing insightful feedback. The detailed responses are provided below.\n\n**Q1: Applied to larger datasets.** \n\n**A1:**\nThanks for your valuable suggestion. To verify the scalability and effectiveness of IA-GGAD, we conducted new experiments on the larger and real datasets as follows:\n\n|Name|Nodes|Edges|Dim|Anomaly|Anomaly Type|Size|Domain|\n|--|--|--|--|--|--|--|--|\n|DGraph-Fin|3,700,550|4,300,999|17|1.3%|Real|Large|Finance network|\n|T-Finance|39,357|21,222,543|10|4.60%|Real|Large|Finance network|\n|CS|6,805|18,333|8|22.69%|Real|Small|Co-purchase|\n|Photo|7,535|119,043|745|9.2%|Real|Small|Co-purchase|\n\nThe following table reports AUROC results on four new datasets, including two large-scale financial graphs and two co-purchase graphs. We additionally compare with recent state-of-the-art methods, CONSISGAD [1] and SmoothGNN [2], for a more comprehensive evaluation. As shown, IA-GGAD consistently achieves the best performance, demonstrating strong generalization to unseen domains. It also exhibits excellent scalability on large graphs such as T-Finance and DGraph-Fin, where several baselines fail due to out-of-memory or performance drop. These results further validate the robustness of IA-GGAD, and we believe they sufficiently address concerns about scalability to large and diverse graphs.\n\n| Method           | DGraph-Fin   | T-Finance   | CS           | Photo        |\n|------------------|--------------|-------------|--------------|--------------|\n| DOMINANT(2019)   | OOM          | OOM         | 0.6214       | 0.5010       |\n| CoLA(2021)       | OOM          | 0.5134      | 0.7241       | 0.5618       |\n| TAM(2023)        | OOM          | OOM         | 0.6995       | 0.5724       |\n| CONSISGAD(2024)      | 0.5176         | 0.5356         | 0.6648       | 0.5172      |\n| GCTAM(2025)      | OOM          | OOM         | 0.7133       | 0.6042       |\n| SmoothGNN(2025)  | _0.5271_     | 0.3979      | 0.4520       | 0.4791       |\n| ARC(2024)        | 0.4746       | 0.6410      | _0.8273_     | _0.7555_     |\n| UNPrompt(2024)   | 0.5269       | 0.2386      | 0.7108       | 0.5193       |\n| AnomalyGFM(2025)[3] | OOM          | _0.6757_    | 0.5676       | 0.5157       |\n| **IA-GGAD**      | **0.5439**   | **0.7541**  | **0.9535**   | **0.8540**   |\n\n**Q2:  applied to cross-domain data.** \n\n**A2:** Thank you for the insightful question. IA-GGAD is inherently designed for cross-domain anomaly detection. It is pre-trained on four diverse source domains and can directly predict on unseen target datasets without any re-training or fine-tuning.\n\nTo further assess generalization, we conducted cross-domain evaluations where training and test datasets originate from entirely different domains, including finance (e.g., T-Finance), social (e.g., Facebook, BlogCatalog), and citation networks (e.g., Cora).\n\nResults Summary:\nIA-GGAD consistently outperforms all baselines across cross-domain scenarios, including both finance-to-social and social-to-finance transfers. For example, when trained on T-Finance and tested on Facebook, it achieves AUROC = 80.82, surpassing ARC (68.96) and AnomalyGFM (65.84); in the reverse (Facebook → T-Finance), it still leads with AUROC = 71.51. These results will be included in the final version to highlight the cross-domain generalization of IA-GGAD.\n\n| **Cross-Domain** | **Facebook → TFinance** | | **TFinance → Facebook** | | **BlogCatalog → TFinance** | | **TFinance → BlogCatalog** | | **Cora → TFinance** | | **TFinance → Cora** | |\n|--|--|--|--|--|--|--|--|--|--|--|--|--|\n| | AUROC | AUPRC | AUROC | AUPRC | AUROC | AUPRC | AUROC | AUPRC | AUROC | AUPRC | AUROC | AUPRC |\n| SmoothGNN (2025) | 41.78 ± 27.74 | 13.98 ± 11.58 | 51.09 ± 10.59 | 3.63 ± 2.17 | 48.41 ± 20.96 | 14.54 ± 10.00 | 56.59 ± 6.71 | 21.99 ± 5.97 | 55.29 ± 28.99 | 16.52 ± 25.08 | 51.16 ± 11.69 | 7.71 ± 3.02 |\n| ARC (2024) | 68.49 ± 4.62 | 18.54 ± 5.31 | 68.96 ± 1.95 | 4.31 ± 1.05 | 68.47 ± 4.58 | 18.66 ± 5.29 | 74.57 ± 0.10 | 36.12 ± 0.35 | 68.82 ± 4.60 | 18.71 ± 5.67 | 86.33 ± 0.59 | 49.62 ± 1.00 |\n| UNPrompt (2024) | 38.76 ± 0.61 | 0.95 ± 0.01 | 40.10 ± 2.31 | 0.99 ± 1.14 | 41.85 ± 4.10 | 1.03 ± 0.11 | 39.83 ± 3.29 | 17.34 ± 1.68 | 62.60 ± 0.65 | 2.14 ± 0.12 | 38.82 ± 5.48 | 4.96 ± 2.95 |\n| AnomalyGFM (2025) | 57.31 ± 6.69 | 5.27 ± 0.77 | 65.84 ± 8.99 | 4.05 ± 1.19 | 65.08 ± 5.29 | 10.58 ± 4.18 | 72.11 ± 0.03 | 25.03 ± 2.21 | 57.67 ± 4.05 | 5.50 ± 1.08 | 55.74 ± 1.68 | 6.41 ± 0.26 |\n| **IA-GGAD (Ours)** | **71.51 ± 3.68** | **21.87 ± 2.91** | **80.82 ± 1.08** | **5.97 ± 0.41** | **70.12 ± 3.15** | **21.04 ± 2.88** | **74.91 ± 0.37** |**36.32 ± 0.29**| **70.34 ± 3.49** | **20.07 ± 3.18** | **88.08 ± 0.46** | **51.95 ± 1.18** |\n\n**Q3: confused variables.** \n\n**A3:** We thank the reviewer for their careful reading and detailed feedback regarding the clarity of our mathematical notation. We provide the following clarifications:\n\n- **Regarding $z_j^{\\[\\ell\\]\\(l\\)}$  in Eq. (4):** We appreciate the reviewer’s attention to this notation. In fact, this is not a typo, but a deliberate design: $z_j^{\\[\\ell\\]\\(l\\)}$ denotes the embedding of node $j$ produced by the $\\ell$-th layer of the **shared graph encoder**, during the $l$-th iteration of the **invariant prototype inference process**. Here, the superscript $[\\ell]$ refers to the GCN layer depth, while the superscript $(l)$ (in parentheses) reflects the iteration index in learning invariant representations $e^{(l)}$. This formulation allows the prototype learning process to access layer-wise structural features across multiple inference steps. To avoid ambiguity, we will revise the manuscript to explicitly explain this two-level indexing convention.\n\n- **Regarding $\\hat{x}_i$ in Eq. (5):** $\\hat{x}_i$ represents the reconstructed aligned feature vector decoded from the selected invariant prototype for node $i$. It is implicitly defined by the lightweight decoder applied to the codebook entry $e_i$ assigned to node $i$. We will make this relationship explicit in the revised version for improved clarity.\n\n- **Regarding subscript ranges in Eq. (6):** We agree that the notation can be more precise. In this equation, the argmax-$k$ operation selects the top-$k$ invariant prototypes (from $M$ total) most similar to $z_i^{[\\ell]}$. Thus, $j \\in \\{1, \\dots, M\\}$, not $N$. We thank the reviewer for catching this and will correct the subscript range accordingly.\n\n- **Regarding the distinction between $N_i$ in Eq. (4) and $T_i$ in Eq. (6):** The difference in usage is intentional. In Eq. (4), $N_i$ denotes the **set of nearest nodes** assigned to prototype $e_i$, and $|N_i|$ is used explicitly when updating the codebook. In contrast, $T_i$ in Eq. (6) is only used as a **set of top-k codebook entries** retrieved for fusion with node $i$'s embedding. We will disambiguate notation (e.g., avoid overloading symbols like $N_i$) in the final version to avoid confusion.\n\nWe appreciate the reviewer’s attention to notation clarity. While the mathematical logic remains sound, we will refine the notation and indexing for improved readability in the final version.\n\n**Q4: Experiments are not comprehensive enough.** \n\n**A4:** \nWe thank the reviewer for highlighting the need for broader comparisons. In response, we include additional SOTA baselines such as CONSISGAD [1] and SmoothGNN [2], and evaluate on real-world GAD benchmarks including T-Finance and DGraph-Fin, as suggested.\n\nIA-GGAD consistently outperforms all baselines across diverse domains, including citation, social, co-purchase, and financial networks. It shows clear advantages on challenging datasets like T-Finance (+21.9% over CONSISGAD) and Facebook (+27.7% over SmoothGNN), demonstrating strong performance and generalizability.\n\n|Method|DGraph-Fin|T-Finance|ACM|Facebook|Amazon|Cora|CiteSeer|BlogCatalog|Reddit|Weibo|CS|Photo|\n|--|--|--|--|--|--|--|--|--|--|--|--|--|\n|CONSISGAD(2024)|51.76±4.87|53.56±5.85|67.26±7.47|32.32±11.35|76.42±9.98|52.94±3.82|57.56±3.02|67.41±5.73|52.34±3.56|44.38±13.81|66.48±6.45|51.72±8.51|\n|SmoothGNN(2025)|52.71±7.59|31.66±27.47|47.06±8.23|52.69±9.60|62.25±21.10|51.50±5.38|48.04±5.79|47.96±6.01|51.31±2.73|24.55±15.81|45.19±10.47|41.93±15.27|\n|AnomalyGFM(2025)|OOM|67.57±3.72|60.79±1.48|58.64±7.14|60.65±9.07|54.17±3.08|54.71±2.30|57.77±3.31|59.99±1.69|69.48±11.11|67.86±4.95|66.66±1.36|\n|**IA-GGAD(Ours)**|**54.39±2.96**|**75.41±2.49**|**93.49±0.57**|**80.03±1.09**|**83.78±2.76**|**88.68±0.53**|**91.83±0.43**|**75.28±0.21**|**60.29±1.91**|**91.18±0.22**|**95.35±0.38**|**85.40±1.63**|\n\nThese extended experiments cover all key datasets and baselines noted by the reviewer, including those from XGBGraph[4]. While we also considered UniGAD[5] and SpaceGNN[6], incomplete public implementations prevented reliable reproduction.\n\n**Q5: A·A causes a loss of information.** \n\n**A5:** \nWe thank the reviewer for the comment. In Equation (2), the use of $A \\cdot A$ is intended to capture second-order neighborhood interactions, analogous to message passing like $X \\cdot A$. It enhances structural context rather than discarding information, and we will clarify this in the revision.\n\n**Q6: The novelty is limited.** \n\n**A6:** We appreciate the reviewer’s observation. While our Structure-Insensitive Affinity Learning draws inspiration from prior work, it differs significantly from TAM [ in both design and objective. Specifically, our method avoids TAM’s use of redundant multi-layer GCNs and costly edge truncation procedures, making it more efficient and scalable. Moreover, our learning objective is more explicit—enhancing the model’s sensitivity to anomalous local neighbors, rather than relying on implicit affinity constraints. We will clarify these distinctions in the revised version.\n\nReferences :\n\n[1] Chen et al., CONSISGAD, ICLR'24\n\n[2] Dong et al., SmoothGNN, WWW'25\n\n[3] Qiao et al., AnomalyGFM, KDD'25\n\n[4] Tang et al., GADBench, NeurIPS'23\n\n[5] Lin et al., UniGAD, NeurIPS'24\n\n[6] Dong et al., SpaceGNN, ICLR'25"}]

Author rebuttal:

Meta-review: (a)  The task is anomaly prediction on unseen graphs without target-domain retraining or fine-tuning.  The paper addresses Feature Space Shift and Graph Structure Shift which happens in this task.  Extensive experiments are done including ablations.
(b)  Presents unified framework for the task.  Good experiments with ablations and good performance.
(c)  More datasets and comparative algorithms needed.   The authors did some in rebuttal.  Explanations could be better.  Better comparative discussion with state of the art needed, and authors did some in rebuttal.
(d)  Strong rebuttal which was appreciated by all reviewers.  Many minor issues cleared up, some mentioned in (c).  Better theoretical grounding and clarification of hyperparameters done.
(e)  One reviewer went from borderline accept to accept.  Rest stayed same.
Decision: Accept (spotlight)