Cross-Domain Graph Anomaly Detection via Test-Time Training with Homophily-Guided Self-Supervision
Authors: Delaram Pirhayatifard
Arlei Silva
Venue: Accepted by TMLR ()

Abstract: Graph Anomaly Detection (GAD) has demonstrated great effectiveness in identifying unusual patterns within graph-structured data. However, while labeled anomalies are often scarce in emerging applications, existing supervised GAD approaches are either ineffective or not applicable when moved across graph domains due to distribution shifts and heterogeneous feature spaces. To address these challenges, we present GADT3, a novel test-time training framework for cross-domain GAD. GADT3 combines supervised and self-supervised learning during training while adapting to a new domain during test time using only self-supervised learning by leveraging a homophily-based affinity score that captures domain-invariant properties of anomalies. Our framework introduces four key innovations to cross-domain GAD: an effective self-supervision scheme, an attention-based mechanism that dynamically learns edge importance weights during message passing, domain-specific encoders for handling heterogeneous features, and class-aware regularization to address imbalance. Experiments across multiple cross-domain settings demonstrate that GADT3 significantly outperforms existing approaches, achieving average improvements of over 8.2\% in AUROC and AUPRC compared to the best competing model.

either ineffec- Published in Transactions on Machine Learning Research (09/2025)
Cross-Domain Graph Anomaly Detection via Test Time Training with Homophily-Guided Self-Supervision
Delaram Pirhayatifard
dp430rice.edu
Deportment of Electrical and Computer Engineering
Rice University
Arlei Silva
arlei&rice.edu
Department of Computer Science
Ken Kennedy Institute for Responsible Al and Computing for Global Impact
Rice University
Reviewed on OpenReview: // openeevee......... net/ forum? id= sB3Lqd0UMb
Abstract
Graph Anomaly Detection (GAD) has demonstrated great effectiveness in identifying un- usual patterns within graph-structured data. However, while labeled anomalies are often scarce in emerging applications, existing supervised GAD approaches tive or not applicable when moved across graph domains due to distribution shifts and heterogeneous feature spaces. To address these challenges, we present GADT3, a novel test-time training framework for cross-domain GAD. GADT3 combines supervised and self- supervised learning during training while adapting to a new domain during test time using only self-supervised learning by leveraging a homophily- affinity score that captures domain-invariant properties of anomalies. Our framework introduces four key innovations to cross-domain GAD: an effective self-supervision scheme, an attention mechanism that dynamically learns edge importance weights during message passing, domain-speciffe encoders for handling heterogeneous features, and class-aware regularization to address im- balance. Experiments across multiple cross-domain scttings demonstrate that GADT3 sig- nificantly outperforms existing approaches, achieving average improvements of over 8.2% in AUROC and AUPRC compared to the best competing model. The source code for GADT3 how.auu..oommeeeeeeeeeeeeeeeeeee wtt/c//o//////eeeee available at hagp:ahh..oooeeeeaaaaaaa///////0
1 Introduction
Graph Anomaly Detection (GAD) is critical task to identify unusual patterns (or outliers) in graph- structured data (a et al. 2021 Akoglu et al.] 2015). This problem has many real-world applications, such as in e-commerce (Zang et al. 2022), social networks (Venkatesan & Prabhavathy 2201)), fraud detection (Jiang et al., 2019), and cybersecurity (Lazarevic et al., 2003). A key limitation of existing GAD models is that they face unique cross-domain challenges that distinguish them from general graph learning tasks. These include inconsistent definitions of normal/anomalors patterns and hetcrogencous fcature spaces between domains (e.g., Facebook vs. Amazon datasets). These applications would benefit from GAD models capable of adapting across Out- Oft--O-Distributtio (OOD) and heterogencous graphs.
A major motivation for our work is cybersccurity. Network intrusion detection systems play a key rolc in identifying malicious nelwork activity associated with cyberattacks (Tsii et al.] [2009] Kilincer et al. 2021] Due to the volume and dynamic nature of these attacks, modern intrusion detection systems increasingly rely on large amounts of data and machine learning to assist cybersocurity experts detecting potential intrusions. However, one of the major challenges in data-driven cybersecurity is the lack of sufficient labeled data for training supervised models. This is particularly critical for emerging applications, where traces of

---

Published in Transactions on Machine Learning Research (09/2025)
labeled intrusions are scarce, and the ability to leverage attacks or other types of anomalous behavior from existing labeled datasets would be greatly beneficial.
This paper investigates the unsupervised domain adaptation problem for GAD, focusing on the transfer of knowledge from a labeled source to an unlabeled target domain. While domain adaptation for graphs has been studied by previous work (Shi et al. 2024 Wang et al., 2021 Zheng et al. 2019 Yin et al. 2023 Wang et al. 2023a; Ding et al. 2018), cross-domain graph anomaly detection is an emerging challenge (Wang al, 2023b Ding et al., 2021 We propose using Tist-Time Training (TTT) {Sun et al. 2020) to address cross- domain graph anomaly detection. Unlike traditional domain adaptation methods that require continuous access to source data, TTT allows us to distill source knowledge into model parameters and adapt to target domains using only self-supervision. This is particularly advantageous for graph anomaly detection, where source data may be sensitive or unavailable during the adaptation phase.
Our approach, Graph Anomaly Detection with Test-time Training (GADT3), has four major innovations compared lo existing work on cross-domain GAD. Finst, it leverages homophily- affinily score (Qiao & Pang 2024 Chen et al.] 2024b) for self-supervised learning based on the observation that normal nodes are more similar to their neighbors than anomalous ones, pattern that remains consistent across do- mains. We observe a clear separation in homophily scores between normal and anomalous nodes across most datasets, justifying the use of homophily-based SSL. shows the homophily score distributions for two datasets (see Appendix AA.1 for detailed plots). Second, it introduces Normal Structure- presuervdd Attention Weighting (NSAW), which dynamically learns continuous edge importance weights through the attention mechanism to suppress the effect of anomalous nodes on the representation of normal ones. Third, GADT3 applies source and target-specific encoders that are trained end-to-end to handle both distribution shifts and heterogeneous feature spaces. Fourth, to address the extreme class imbalance challenge in GAD (Ma et al., 2024), our approach employs class-aware regularization during source training- with stronger regulariza- tion to the minority class. By combining these innovations, GADT3 can effectively identify anomalous nodes across heterogencous datasets arising from multiple and diverse domains.
We compare our solution against both graph domain adaplation and graph anomaly detection approaches using multiple cross-domain datasets. For instance, we show that labeled anomalies in the Amazon dataset (source) can improve the GAD accuracy the Facebook dataset (target). The experiments show that GADT3 significantly outperforms the alternatives in most of the settings. The contributions of this paper can be summarized as:
We propose the first test-time training (TTT) framework for cross-domain graph anomaly detection (GADT3). TTT enables adaptation to new target domains without requiring direct access to source data or target labels at test time. Our approach leverages homophily- based self-supervision, which captures universal patterns, anomalous nodes typically exhibit lower homophily compared to normal nodes.
Our message-passing technique introduces homophily-based attention weights that naturally sup- press anomalous influences on normal nodes while preserving graph structure, enabling robust anomaly detection.
We propose several strategies specifically designed for cross-domain GAD, such as data-specific encoders, class-aware regularization, and an early-stopping strategy to prevent overfitting during test-time adaptation.
GADT3's performance is demonstrated through extensive experiments on cross-network tasks using multiple datasots and basclines that span both domain adaptation and anomaly detection. Our approach achieves average relative improvements of over 8.2% in AUROC and AUPRC compared to the best competing model.
2

---

Published in Transactions on Machine Learning Research (09/2025)
2 Related Work
2.1 Graph Domain Adaptation (GDA)
While graph domain adaptation (GDA) methods have shown success in transferring knowledge across differ- ent domains iShi ct al. 2024), they face fundamental limitations when applied to anomaly detection tasks. Traditional GDA methods are designed for node classification scenarios with balanced classes and consistent label semantics.
Traditional Graph Domain Adaptation (GDA) approaches, such GRADE (Wu al. 2023 AdaGCN
Dai et al. 2022,, and UDA-GCN (Wu et al., 2020), and spectral regularization methods (You et al, 2023), focus on minimizing distribution shifts across domains but require training samples during inference, limiting their real-time adaptation capabilities. Test-time training (TTT) (Sun et al. 2020 has emerged as a powerful framework for handling distribution shifts (Li et al. 2022: Wu et al.
2024 Zhang et al. 2024 Liu et al. 2021b). Methods like GTrans (Jin et al., 2022), GraphCL (You et al.
2020), and GT3
(Wang ct al., 2022) propose graph-specific TTT approaches. TENT (Wang et al., 2020) uses prediction entropy minimization, while GraphTTA (Chen et. al. 2022) leverages information theory for TTT on graphs. However, existing GDA approaches, including both traditional methods and
solutions, face key limitations for anomaly detection as they (1) don't 't account for extreme class imbalance within domains, (2) lack mechanisms to preserve momalyy-ndiccttio
patterns during transfer, and (3) don't ton't handle heterogencous feature spaces across domains. While there exists limited research on cross-lomain graph anomaly detection, prior approaches require direct access to the source dataset curing adaptation (Ding et al.) 2021 Wang et al, 2023b). Our approach offers key advantages over these methods by climinating the need to store and access the full source dataset during adaptation. This makes GADT3 both privacy-preservngg and memory-efficinn,, thus being more practical for real-world deployment where these are major concerns.
Our work addressos key challenges in deploying GDA in anomaly dctection through datasct-specific en- coders for heterogeneous feature spaces and a homophily- unsupervised learning approach that extracts domain-invariant properties of anomalies that generalize across domains. In our experiments, we show that GADT3 often outperforms multiple GDA baselines, including GRADE, AdaGCN, TENT, and GTrans.
2.2 Graph Anomaly Detection (GAD)
Graph Anomaly Detection (GAD) (Ma et al. 2021
Akoglu et al. 2015) focuses identifying abnor- mal nodes in graph-structured data. Traditional approaches like Oddball (Akoglu et al.] 2010 rely on power-law relationships between local graph fea-
Source Demain (Amazon)
Target Domain: (Reddis)
1.00-
1.00-
Honuphily Store
0.75
0.75-
tures, while more recent deep learning-bason ap- proaches are more generalizable. For instance, DOMINANT (Ding et al. 2019) employs a graph autoencoder to identify anomalies based on graph reconstruction. ComGA (Luo et al. 2022) intro- duces a tailored GCN to learn distinguishable node representations by explicitly capturing community structure. Self-supervised techniques have emerged as powerful tools for GAD, with methods like CoLA [Liu et al. 2021a), SL-GAD (Zheng et al.) 2021). HCM-A (Huang et al. 2022 and TAM (Qiao & Pang 2024) introducing various approaches to han- dle node interactions and structural patterns. While these methods have shown success in single-domain scenarios, they don't address the challenges of cross-domain knowledge transfer. Recent methods like ACT (Wang al., (023b) and COMMANDER (Ding et al., [2021] have started to explore cross-domain graph anomaly detection (CD-GAD), but this remains an evolving field. Other recent works like CDFS-GAD Chen al. 2024a) address cross-domain node anomaly detection in few-shot setting, where small set of
0.50
0.50+
0.25
0.25-
0.000
0.00
Noriaal
Anomalous
Normal
Anomalous
Normal
Anomalous
Figure Homophily score distributions across do- mains (Amazon Reddit): normal nodes (blue) show higher scores than anomalous nodes (orange), suggest- ing homophily as domain-invariant anomaly signal.
3

---

Published in Transactions on Machine Learning Research (09/2025)
labeled anomalies from the target graph is available. ARC (Liu et al., 2024 proposes an in-context learning approach for cross-domain GAD, which adapts at inference using few normal nodes from the target graph.
Anomalies behave differently across domains fraudulent users in e-commerce networks exhibit different pat- terns compared to social networks. Second, domains often have different feature spaces and graph structures. While our method motivated by the homophily assumption, recent studies such as (Gao et al. 2023 have explored anomaly detection in heterophilic graphs, highlighting the importance of developing models robust to varying structural patterns. Our approach can be extended to heterophilic graphs by replacing the current SSL loss with loss more suited for heterophily, and by using heterophily-
GNNs.
GADT3 bridges both GDA and GAD through unified approach that combines (1) test-time training with a homophily-based loss for capturing domain-invariant properties of anomalies (2) enhanced message- passing using normal saructure-presert anomalous nodes on normal nodes' representations, and (3) class-aware regularization that prevents minority class palterns from being overshadowed by the majority class during source training. In our experiments, we compare nource-free version of GADT3 against GAD baselines (e.g., TAM, ComGA, DOMINANT) to highlight the impact of its GAD-specific features.
attention weighting (NSAW) that reduces the irrelevant impact of
3 Problem Definition
We address unsupervised node-level anomaly detection with domain adaptation, aiming to identify abnormal nodes in a target graph by leveraging information from both the target and a source graph. The source dataset contains labeled information but is assumed to be out-of-distribution (OOD) relative to the target, with different feature sets and label distributions. Given source dataset D, = (G,, Xs, Ys) and target dataset D. = (G,,,,,, where Gz/G, = (V,E) represents a (source or target) underlying graph with nodes V and edges E c VV V such that uv if there is a link between nodes u and v. Here, X, = fx, Ve E V&} and Y, = {yal Vu e V.J represent the node features and their corresponding labels, respectively, and the same holds for target data (X,, Notably, Yo E {0, 1} (normal or anomaly) for nodes in both V. and V.. Our goal is to detect anomalies in the target graph. The key challenge is that target labels are completely unavailable (unsupervised setting), requiring us to leverage source labels Y. as auxiliary information, even though source and target features may have different dimensionalitics and semantic meanings (x, E TRP, for source nodes and X E IR for target nodes).
4 Graph Anomaly Detection via Test- Time Training (GADT3)
We propose GADT3 (Graph Anomaly Detection with Test-time Training), a domain adaptation mothod particularly designed for graph anomaly detection that integrates allention-based message-passing node homophily patterns, and domain-specifie encoders to handle feature shifts and heterogeneous features across domains. GADT3 addresses the challenging and novel scenario where the target data is out of distribution (OOD) relative to the source data and where source and target datasets have different feature spaces.
An overview of our approach is provided in Figure 2 GADT3 leverages the advantages of Test-time Training, especially the ability to adapt to new target datasets in the TTT phase without the need for labeled anoma- lies. Moreover, GADT3 incorporates technical innovations tailored for cross-domain GAD, including the use of domain--pecifii encoders, Normal Structure-preserved Attention Weighting (NSAW), and class-aware regularization. Unlike prior TTT mothods that rely on auxiliary dummy tasks (c.g., rotation prediction or jigsaw solving) for encoder adaptation, our self-supervised homophily loss is directly aligned with the target anomaly detection objective. By encouraging high homophily among node embeddings in the target graph, this task-relevant signal promotes local consistency, enabling the model to adapt without labels while preserving the semantic structure essential for anomaly detection.
Our framework operates in two phases. The training phase combines supervised and self-supervised losses to learn from the source dataset. The test-time training phase only uses self-supervisod learning to adapt to the target data. During training, we learn the encoder 9,, decoder 6n, and supervised predictor ppred jointly based the source dataset. During test-time training (TTT) the target domain, new encoder
4

---

Published in Transactions on Machine Learning Research (09/2025)
Projection domain
Gs
8m
i pred
Ssuu (Vs, Ysi B3 8m ppred)
B
yss
B
Normal
Anomalous
L (vsi 0m)
praieingphase
Wedglts (NS/01)
sim (R Areefroz
[N())
F
0
TargetAAthationn Wilghts (NSAWA
0
Homophily soore:
0
B
L (vri 0m)
TTT plase
Figure 2: Overview of GADT3, test-time training framework for node-level cross-domain anomaly de- lection. In the training phase (lop), GADT3 learns encoder 0g, decoder 0m, and prediction Opred by jointly minimizing supervised (Leup) and self-supervised homophily- mal Streeeeee-preserveed Attention Weights to defend against the adversarial influence of anomalous nodes during message passing in the GNN training. In the test-time training (TTT) phase (bottom), GADT3 learns a target encoder 0, using only the self-supervieed loss Lwe. The decoder 6n shared across phases enable the cross-domain knowledge transfer while handling heterogeneous feature spaces. During inference, the adapted target. representations produced by On are used for anomaly scoring.
loss (Laalt). We propose using Nor-
O, is trained from scratch using the unsupervised homophily-based loss Laelf, while Om is reused from the training phase. This decoupled encoder- decoder structure enables adaptation without requiring any target labels or access to source data after training. We will detail each stage of our solution together with our key contributions in the next sections.
4.1 Backbone GNN and Projection head
The backbone architecture of GADT3 is a Graph Neural Network (GNN) that operates on source and target graph data. Our model can apply any GNN architecture, including dessage-passing Neural Networks (MPNNs). We denote the of neighbors node v as A(w)) = [ul(u, v) E E). For each layer (1.2.... I.} of the GNN the information from neighboring nodes of is aggregated via gessage-passingg as follows:
hy = M (fhC-llu (
(1)
where M-) an element-wise and permutation-invarian operator. The embedding of node at the L-th layer is derived from the aggregated neighbors' embeddings and the previous embedding of
h = [W'[th h 1+bb).
(2)
where (.) is a non-linear activation function, || denotes the concatenation operator, W 1 and be E TRP++ are trainable weight. matrices and bias vectors. Representations from the last layer (E L.)
5

---

Published in Transactions on Machine Learning Research (09/2025)
be converted to binary class probabilities using the sigmoid function. To generate initial representations h = X, for nodes with different feature sets in D, and Dr. GADT3 learns projection matrices (or encoders) P. and P where, P. E R**P, is a trainable projection for the source data and x, are node features. The same is performed for target data using the matrix Pt. These encodors enable projecting source and target data into a shared representation space; lacilitating transfer learning.
Without loss of generality, we apply GraphSAGE (Hamilton et al., 2017] as GADT3's backbone MPNN architecture. GraphSAGE applies node sampling in the aggregation phase to increase its scalability.
4.2 Homophily-based self-supe Loss
Test-time training requires sell-supervised loss Laefs applied during both training and test-time training stages. We propose the of previously introduced homophily-basee affinity score, which is tailored for unsupervised anomaly detection QQaa & Pang 2024 Chen et al. 2024b).
The local affinity score measures the similarity or connection strength between node and its neighbors. It is based on the one-class homophily phenomenon, where normal nodes tend to have a stronger affinity with their neighbors compared with anomalies. This enables these scores to be applied to unsupervised GAD. To the best of our knowledge, our work the first apply affinity scores for the GAD problem within the test-time training framework.
More formally, the local affinity score is computed by comparing a node's representation against those of its immediate neighbors in the graph using various similarity metrics such as cosine similarity. Euclidean distance, Jensen-Shannon divergence, and Wasserstein distance (Lin 1991 Chen & Liu 2020 Shen et al. 2018). By taking the avorage similarity with neighbors a node u, we obtain a single anomaly score s(v) based on how well a node is associated with its local graph structure:
Σ 5(v) [N(v)] NEN(w)
sim(h b!)
where N (w:) denotes the neighbors of v; he represents the learned embedding for and sim((, b) = a abb
T bJ describes the cosine similarity. The unsupervised task consists of maximizing the alfinity score for each node.
This test-time task is scalable, as it only requires local computations, making it efficient even for large graphs. Additionally, it can be adapted to different types of graphs and node features by choosing appropriate node representation learning techniques and similarity measures. The total self-supervised loss combines the homophily-ban based loss with a regularization term:
C Σ s(v) Areg
(4)
VEV
where Creg = =vev EmEny sim(
minimizes the similarity between non-connected nodes to maintain
W.
structural distinctiveness in the embedding space, with N,- representing the set of nodes not connected to node and controlling the regularization strength.
This homophily loss also serves as an implicit alignment mechanism, encouraging local consistency among neighboring node embeddings in the target graph. Since node labels are unavailable during training, the homophily loss is applied to all connected node pairs. This may include anomalous pairs, but under homophily assumption, most edges still connect similar (normal) nodes, making the signal reliable in practice.
By leveraging the frozen source decoder 0m, the model preserves the source-learned graph patterns, achieving alignment without requiring explicit alignment. terms or target labels.
It has been noted by previous work QQaa Pang 2024 Chen al. 2024b) that enforcing similarity across all connected nodes might inadvertently cause non non-homen homophopyh nodes to become similar. Normal Structure- preserved Graph Truncation (NSGT) attempts to preserve normal node structure by making binary decisions

---

Published in Transactions on Machine Learning Research (09/2025)
to remove edges between dissimilar nodes based on distance. However, this approach risks losing important structural information and requires setting explicit thresholds for edge removal decisions. In the next section, we introduce our enhanced message-passinng approach through attention- based NSAW, a simpler and more flexible approach to suppress the adversarial effect of non-homophily edges equation
4.3 Normal Structure-preservee Attention Weighting (NSAW)
We propose Normal Structure-presorvee Attontion Weighting (NSAW) as an alternative to Normal Structure- preserved Graph Truncation (Qiao & Pang 2024). NSAW applies robust extension to graph atiention (Veličković et al. 2017) as more flexible way to suppress the effect of anomalous nodes on the representation of normal nodes during message-passing. Specifically, by downweighting abnormallto-norraal connections, NSAW reduces the infiuence of structurally inconsistent neighbors. This preserves the structure of normal regions and encourages more distinct representations for anomalies. These attention weights are learned end-to-end as part of the GNN training process.
For each layer E, we compute attention weights between connected nodes using a learnable transformation matrix U E RPexp, where P represents the attention dimension. Given representations H' Nxp at layer l the attention scores are computed as:
A sotmaax(@(x(tU"))((()Y))) T M),
(5)
where o is ReLU activation, M is the adjacency matrix, and O is clement-wise multiplication. The use of M ensures that attention weights are only computed between connected nodes in the graph.
Robust Symmetric Attention. To defend against the adversarial influence of anomalous nodes, we enforce symmetry in the attention weights through symmetric minimum operation:
Mr min ( Af,s, for all i
(6)
NSAW's symmetric construction provides a crucial de- fensive mechanism through two complementary as- pects. First, when a normal node v connects to both normal nodes {Ui, U2, Uk} and anomalous nodes {ai, ....... amh, the attention naturally assigns high weights to normal neighbors and low weights to anoma- lous oncs due to feature similarity. As illustrated in the Figure 3 when a normal node assigns low alten- tion a(e + a) so 0 to an anomalous node (thin ar- row), oven if the anomalous node attempts to assign high attention back (thick arrow), the minimum opera- tion ensures that the reverse influence also minimized as ala + v) = min(a(a + v), a(v a)) ss 0 (dashed ar- row), regardless of the original attention weight. Second, through the learnable attention parameters & and the self-supervised loss, the architecture gradually learns to suppress the influence of anomalous patterns during training, further strengthening this defensive mechanism through the GNN's message passing structure.
a2
V
a
a1 > a2
Figure 3: Symmetric attention: node gives high attention to node (a1), while e gives lower at- tention to a (a2). The final symmetric weight is min(a1, (2))))))))))))))))))))))( = Q2-
Enhanced Message Passing. The computed attention weights modulate the message passing in the GNN architecture. For node v, the attention messages from neighbors are aggregated as follows:
h = M v| |
where M(-) combines the weighted messages using sum aggregation followed by ReLU activation.
Unlike NSGT (Qiao & Pang 2024,, which removes edges based on a binary homophily threshold, NSAW in- troduces a learnable and continuous mechanism to modulate edge importance. This makes NSAW both more flexible and more robust: preserves useful structure while suppressing anomalous influences during message passing. Instead of pruning edges, NSAW learns to softly attemuate misleading connections, especially those from anomalous nodes, making it more general and data-driven for cross-domain GAD scenarios.
7

---

Published in Transactions on Machine Learning Research (09/2025)
4.4 Class aware Regularization
Class imbalance poses major challenge in GAD. As shown in Table 5 the abnormality rate of all dalasets we're using is less than 7%. Our class-aware regularization enhances the model's ability to handle class imbalance during the source training phase by applying stronger regularization to the minority class (i.c., anomalous nodes). When minimizing similarity between non-connected nodes, assigns higher weights to anomalous nodes, ensuring they maintain their distinctive patterns rather than being overshadowed by the majority class representations. Here's the mathematical formulation:
EiEN, w/ -sim (h,, hy)
Σ NV
(8)
W
where Mf represents the set of nodes not connected to node i, sim(h; hy) is the cosine similarity between node embeddings, and Wy is the class-based weight defined as:
Wi =1111 { node j is anomalous
(9)
otherwise
where a > the weighting factor for anomalous nodes. We set inversely proportional to the class ratio This regularization can only be applied during source training, where have access to node labels, while larget training relies solely on the homophily-based loss due to its unsupervised nature.
4.5 Test- Time Training
We can now describe our framework for anomaly detection with domain adaptation (GADT3), summarized in Figure 2 Following the test-time training paradigm, GADT3 is based two tasks, the main (supervised) task and the auriliary self-superoised learning (SSL) task: In the training phase, GADT3 is trained based on both tasks using a joint loss minimized based on the source dataset. Subsequently, the test-tine time training phase leverages only the SSL task using the target dataset, which is assumed to be unlabeled.
Training phase. During training, GADT3 applies the source graph G, to learn an encoder 0,, a decoder supervised loss Coup:
On, and predictor Opred by minimizing a loss function Ltrain that combination for which we apply cross-entropy, and self-supervised loss Leelf, for which we apply the homophily-baae based affinity scores (sce Sec. 4.2
Ssup =
Σ rEV.
Yo log Du + NoCo,
(10)
Sellf =
Σ
Σ
sim bit) + Aven
(11)
[N(w)]
nEN())
Ltrain
Σ NEV.
(Vu ys 0m. Oz, Opred) + XCmott(;; Om, 0s))
(12)
where ÿ is the predicted label (normal or anomaly) and X, X,s and A weight hyperparameters.
We describe the source encoder 6, (projection) and decoder 6m (GNN) in Section 4.1 The predictor O 0pee
is a multi-layer perceptron that maps node embeddings to label predictions.
Test-time training phase. During the test-time training (TTT) phase, we apply the target graph G, to optimize a target encoder 0, by minimizing the TTT loss LTTT:
ErTr = Σ Luat(v: 0e, 6m),
(13)
NEV.
8

---

Published in Transactions on Machine Learning Research (09/2025)
where Leelf is from Eqn. 11 and the decoder fm is reused from the training phase to embed target nodes.
Inference: Anomaly detection in the target domain is performed using the adapted encoder 0, optimized during test-time training (TTT) based solely on the target graph. The decoder 0m, trained on the source domain, is reused without modification. The encoder 0g maps target node features into a shared embedding space, and 6n further refines these representations using the target graph. We do not use the prediction head ppeed at inference time. Instead, we compute homophily scores in the embedding space generated by 8m rank the nodes based on these scores, and directly evaluate performance using AUROC and AUPRC.
Although pred is not applied during inference, we observe the embeddings learned by the adapted target encoder O, remain well-aligned with the source decision boundary learned during training, This is shown in Figure 4 where we show that source and larget embeddings share similar separation patterns, indicating that the shared representation space preserves discriminative structure even without explicit prediction. While pree trained using source labels, can technically be reused during inference. However, GADT3 relies on homophily-basee node ranking. See Appendix A.6 for an alternative approach.
Stopping criteria. We propose an adaptive early-stopping strategy based distance ratios between source and target domains. Our method computes the distance between target features and the average embeddings of two distinct source classes-normal and anomalous. The ratio of maximum to minimum distance serves as the stopping criterion, where a higher ratio indicates better domain adaptation as it reflects stronger alignment between target samples and their corresponding source class features. The training stops when no improvement in this ratio is observed for a predefined number of epochs. Our relative alignment between target samples and source class distributions, rather than just overall domain similarity. See Appendix A.1 for details.
approach measures
4.6 Theoretical Guarantee for TTT in GADT3
We propose a formal guarantee for the case of homogencous feature spaces across domains. Under the Test- Time Training (TTT) update in GADT3, the separation margin between normal and anomalous nodes in the target graph monotonically increases. This establishes that our homophily-basee based self-supervised objective provably improves anomaly separability during adaptation.
We begin by introducing the notation used in the proof. Let 8 denote the source encoder learned during the supervised pre-training phase, and let 0!*)) be the target encoder parameter learned during step & of TTT. Recall that the decoder 6m is kept fixed throughout TTT. For a target node v, we denote by sı 62) its homophily score computed with encoder Or. The anomaly separation margin at step & is defined as the difference between expected values of homophily scores for normal and anomalous nodes in the graph:
(k) (e o(())] E. ( {(a))
where N and A denote the sets of normal and anomalous nodes in the target graph, respectively. We further define the class-cone conditional gradient for class C E (W, as:
(e) = V, (v;
In particular, we denote IN (0;) and 9 = (0:) as the class-conditional gradients at 0z. Moreover, (k) (t!*) and g
(N) = _. (0(x)) the target gradients at step k of TTT.
we denote IN
We assume that 0₂ and 0, share the same feature dimension size (p. = pt). Morcover, for the optimal source encoder 9 we have the following assumptions:
Assumption 1. (Gradient dominance at source optimuum) |لا 11 i.e., the magnitude of the gradient induced by normal nodes is stricily greater than that induced by anomalous nodes.
Assumption 2. (Lipschitz continuity and boundedness) The class-conditional gradients are L- Lipschitz continuous and wniformly bounded: ((9c(0,) - (02)l) < T 02 and [[)c(()]l S G for all 0g o2, O and for C' E A).
Assumption 3. (Inátialization prozimity) The target encoder initialization 0000 sufficiently close to the optimal source encoder 0z.
9

---

Published in Transactions on Machine Learning Research (09/2025)
The above assumptions are reasonable given that the source encoder 0 is trained with labeled data, which naturally yields stronger gradient signals from normal nodes in the homophily-based objective. Tt does, however, require 0g and Or to share the same feature dimension size (p. = pt). Moreover, at the source optimum, normal nodes are more homophilic and consistent, so their gradients align in direction and yield a larger ll |I than scaltered anomalous gradients.
Proposition (Monotonic Margin Increase). Under the above assumplions, for all k 0, starling from an initial parameter 0 sufficiently close to the optimal 0ü, the TTT updote satisfies:
((++1) !
4
That is, each step of test-time training strictly increases the anomaly separation margin between normal and anomalous nodes.
5
Experiments
We evaluate the proposed approach (GADT3) against multiple baselincs across six graph datasets, including methods from both cross-domain adaptation and anomaly detection. Our analysis is complemented with ablation studies on key components of the model, such as source training, NSAW, and class-aware regulariza- tion. To assess scalability, we further test GADT3 on three large-scale graphs. Additionally, we investigate the model's sensitivity to the homophily assumption by synthetically varying homophily levels to identify the threshold at which performance begins to degrade.
5.1
Experimental Setup
Datasets. We apply six datasets from diverse domains, such as online shopping reviews, including Amazon (AMZ) MMAAuley & Leskovec 2013), YelpChi (Rayana & Akoglu 2015), YelpHotel (HTL), and YelpRes (RES) Ding et al.] 2021). and social networks, including Reddit (RDT) (Kumar et al. 2018 and Facebook (FB) Leskovec & Mcauley ).12). For our cross-domain analysis, we examine scenarios where feature spaces are homogencous (same features) and heterogencous (different features) across domains. To demonstrate the scalability of our model, we additionally report results on three large-scale graphs: Amazon-all (AMZ-all), YelpChi-all (YC-all) (Hamilton et al., 2017). and T-Finance (TF) (Tang et al. 2022) in Table 3 A detailed description of each dataset is provided in Appendix A.2
Baselines and Evaluation Criteria. We evaluate our method against state-of-the-ard baselines both for cross- coos--doman domain adaptation and säingle-graph) unsupervised anomaly detection. Cross-domain baselines
include GRADE (Wu et al. 2023). AdaGCN (Dai et al. 2022), UDA-GCN (Wu et al. 2020). and ACT (Wang
ct al. 2023b Test-time training basclines include TENT (Wang et al., 2020). GraphCL YYou et al.
2020).
and GTrans Jin et al. 2022). As GAD baselines, we consider sell-superviser learning-based met hods CooA
[Liu et al.]
2021ah and SL-GAD (Zheng et al.) 2021)), reconstruction- baaedd methods (DOMINANT
(Ding
ct al. 2019) and ComGA [Luo et al. 2022) and a local fffinity-based method (TAM (Qiao & Pang
2024
While GADT3 assumes that normal nodes are more homophilic than anomalies, most baselines (e.g., DOM- INANT, CoLA, SL-GAD, GTTaan)) are homophily-agnosticc Yet, GADT3 outperforms them, indicating that homophily-based self-supervision provides a useful inductive bias for cross-domain anomaly detection.
We utilize two metrics to evaluate anomaly detection models: the Area Under the Receiver Operating Characteristic Curve (AUROC) and the Arca Under the Precision-Recal Curve (AUPRC). Higher values of AUROC and AUPRC indicate superior model performance. We report average results for 10 repetitions.
Implementation details. We developed GADT3 using Python 3.11.9 and PyTorch 2.1.0. All the experi- ments were conducted on an NVIDIA A40 GPU with 48GB. The core model is 2-layer GraphSAGE GNN with weight parameters optimized via the Adam optimizer (Kingma & Ba 2014] with a dropout rate of 0.7. The source model underwent training for 100 epochs with early stopping employed to determine the target epochs. Both the source and target models were trained with a learning rate of 0.001. We set À 0.001, X 0.1, X, = 0.001, p = 40, and 20. Baselines were trained using the hyperparameters recommended
in their respective papers. For hyperparameter sensitivity analysis, please refer to Appendices A.3 and A.8
10

---

Published in Transactions on Machine Learning Research (09/2025)
Table Cross-domain (Source -> Target) node-level graph anomaly detection performance of GADT3
compared to statc-of-tho-art basclines. We have shown the results for domain pairs with both homogencous
and heterogeneous feature spaces. Results show GADT3 significantly outperforms baselines in most seltings.
Heterogenemus Features
Homogeneous Features
Metrie (%) Type Method
JMMZ-RDT
AMZ-FBB RDT-AAM RDT-FP FB-AMM FB FB-RDT
HTL-RES
RES -HTL
Avg.
GRADE
61. 80
81.9
70.38+12
85.53+os
72.06+0a
61.27++1.
75.51+o.s
73.80+o.s
a3.16+a.4
AdaGCN
88.86+0.7
+2.35++o.s
70.43+o.
75.89+1a
64.86+1a
61.62+0.9
79.50+0.7
81.18+0.5
CDA UDA-GCN
60.37
80.801o.
67.3611.2
84.98.0.6
67.55.1.
61.95.0.4
85.36.5.a
78.2 78.24.0.6
13
ACT
59.21+1a
$1.97
71.16+o.
75.74+1.
71.98+10
60.32+1.2
89.20 29.24
80. 40.1s
73.78+a.
AUROC
TENT
59.01
76.15
71.51
66.88 23.43
58. 38.20
15.11
79. 20.27
21.20
TTT
GraphCL
60.37=o.7
88 46
68.71+0.
88 88.81
61.91+10
61.6140v
79. 79.05
74 74.20=o.s
GTTran
60.61+0.
89 +9.35+
73.93+0.
90.18-044
68.08 68.03++.7
61.90+o.s
79.86+
83.19+..5
7..
Ours
GADT3
61.95=..
91.03
79.87
94.84
82.57
61.93au.7
94.14
90.71
82.13
GRADE
4.92+
18. 18.1
11.87+0.s
16. 10=04
13.00+0.a
1.31=..2
18.81+o.r
22. +3.54++
13.75
AdaGCK
4.5
9.04+a.2
12.15+0.4
5.72
10.23+0.4
4.64+0.3
22.15+0.4
95.15++o.5
12.95+a.
CDA
UDA-GCN
4.65
6.731..a
10.8510.
22.04.0.4
10.8910.4
1.
26.0210.5
27.31 10.4
14.261n.a
ACT
4.2210.4
8.161
13.20
2
12:26
4.88
33.0019.a
28.7010.5
16.37.9.4
AUPRC
TENT
4.60
11.69:o.4
12.49:0.
18.81
12.32::04
4.79g0.3
13.12:5.
28.31
13.27
TTT
GraphCL
4.6910.9
21.091o.3
14.361o.4
30.8610.3
11.1210.5
5.44
21.27
25.55.0.a
16.80
G'Trans
4.78+n.3
25.95+0.4
17,02+0.s
29.11-o.2
11.91+0.4
5.15+0.3
21,03+a.4
36.20+o.s
18,8
Ours
GADT3
5.19
27.06
19.10s0.
34.76a0a
25.73am.
6.122u2
39.7520.1
25.08 42.90
5.2 Cross-domain Graph Anomaly Detection
We present the results comparing our approach against various domain adaptation baselines in Table D We use different datasets as source and target domains. We incorporated a projection head into all baseline models to address mismatches in feature sets between source and target domains. This ensures a fair comparison by allowing each method to handle discrepancies in input feature spaces. In homogeneous scttings, where source and target graphs share the same feature space, no projection head was used.
Our proposed method (GADT3) out performme the baselines in most scenarios. GADT3 achieved the highest AUROC and AUPRC scores in 5 out of 6 tasks. For instance, in terms of AUROC, in the Amadon task, GADT3 surpassed the next best mothod (GTrans) by 5.9%. In the Baddit-xFacebook task, GADT3 outperformed the closest competitor (GTrans) by 4.7%. The only lask where GADT3 did not lead in terms of AUROC and AUPRC was Bireboook-Reddii where it performed competitively but slightly below UDA- GCN. On average, our method outperformed the second-best baseline by at least 6.2 points in both AUROC and AUPRC. In Appendix A.5 provide further insights into the performance of GADT3. We have found that high target performance is often correlated with high source homophily. This can be explained by our use of a homophily-basee self-supervised loss for test-time training.
5.3 Representation Embedding
The effectiveness of our TTT approach is demonstrated in Figure 4 which presents the twoodimensionaal T-SNE embeddings of the GNN outputs for both source and target models. On the left side, we observe a clear separation between normal and anomalous samples in the source domain (Amazon), indicating that the source model has effectively learned to distinguish between classes. The right figure shows the transforability of our approach to the target domain (Facebook). Despite the inherent differences between source and target datasets, the adapted embeddings in the target domain preserve meaningful structure, demonstrating that our TTT strategy successfully refines the target representations using the pre-trained source model. We provide additional visualizations of source and target embeddings for other datasets in Appendix A.12
5.4 Early-Stopping Mechanism
This section evaluates our early-stopping strategy across different domain adaptation scenarios. Figure 5 illustrates how the distance ratio evolves together with the Arca Under the Procision-Recct Curve (AUPRC) during training. We marked the specific epoch when the model was selected. The results show that the ratio effectively captures the convergence of domain adaptation without the need for labeled validation data.
11

---

Published in Transactions on Machine Learning Research (09/2025)
Source Domain (Amazon)
Target Domain (Facebook)
Normal
Anomalous
Figure 4: T-SNE embeddings of node representations for source domain (Amazon) the left and target domain (Facebook) the right. The source model clearly separates adaptation, the pro-trained model maintains this separation in the target domain, indicating successful transfer.
nodes. After
RDT AMZ
AMZ FB
Adaptation Score
Adaptation Score
AUPRC (%)
Model Selcction
AUPRC (%)
Model Selection
-00
10
10
30
10
Epoch
Epoch
AUPRC
Adaptation Score
Figure 5: Relationship between target anomaly detection accuracy (AUPRC) and our ratio-based adaptation We use the adaptation score label-free early
score for Reddit->Amazon and stopping criterion, which is triggered at epochs 37 (left) and 24 (right).
6 Ablation Studies
We perform four ablation studies evaluate different aspects of GADT3. The results support the design of our model and demonstrate the relevance of each of its components.
GAD Results (Source-free). We evaluate single-domain version of GADT3 against six state-of-the-ar GAD baselines using four datasets. Our goal is to isolate the impact of GADT3's self-supervisol learning from its cross-domain adaptation. The results are shown in Table 2 We follow the same protocol and use the same datasets as Qiao & Pang (2024), so we report their results for the baselines. GADT3 outperforms baselines even the source-free seiting, as the NSAW edge weighting effectively leverages structural context enhance anomaly scparation without relying on source data.
NSAW as learnable and flexible edge weighting approach. We proposed NSAW learnable weig-weighting mechanism to suppress the adverse effect of non- hompholyyy edges in anomaly detection. Table compares our method against TAM (Qiao & Pang 2024) (using NSGT). The results show that GADT3 out oulperfomms TAM using most datasets. This is evidence that NSAW is a more flexible alternative to NSGT by allowing GADT3 to learn continuous attention weights. To validate its effectiveness, we compare GADT3 with and without NSAW under our cross-domain tasks. Introducing NSAW improves AUROC from 90.83% 91.04% on AMZ->FB and from 81.63% to 82.57% on FB FB-AMMZ. These gains confirm that learnable, strueture-preservve edge weighting is more effective than static edge removal strategies.
12

---

Published in Transactions on Machine Learning Research (09/2025)
Table 2: GADT3, trained on target only, outper-
Table AUROC and AUPRC (%) on large-scale
forms specialized baselines most datascts.
graphs Bold indicates best.
Metric (%) Method
AMZ RDT
FB
YC
Avg.
Metric (%) Method
AMZ-all YC-all
TF
CoLA
58.98
60.28
84.34
46.36
62.49
CoLA
26.14
48.01
48.29
SI-GAD
59.37
56.77
79.36
33.12
57.16
SL-GAD
27.28
55.51
16.48
DOMINANT
59.96
55.55
56.77
41.33
53.40
AUROC DOMINANT
69.37
53.90
53.80
AUROC
ComGA
58.95
54.53
60.55
43.91
54.48
ComGA
71.54
53.52
55.42
TAM
60.23 70.64
91.44
56.43
69.69
TAM
84.76
58.18
61.75
GADT3
84.76
61.54
91.74
48.67
71.68
GADT3
86.23
55.31
62.91
CoLA
6.77
4.49
21.06
4.48
9.20
CoLA
5.16
13.61
4.10
SL-GAD
6.34
4.06
13.16
3.50
6.76
SL-GAD
4.44
17.11
3.86
DOMINANT
14.24
3.56
3.14
3.95
6.22
DOMINANT
10.15
16.38
4.74
AUPRC
AUPRC
ComGA
11.53
3.74
3.54
4.23
5.76
ComGA
18.54
16.58
4.81
TAM
26.34
1.46
22.33
7.78
15.23
TAM
13.46
18.86
5.47
GADT3
27.53
6.01
26.13
6.14
16.45
GADT3
44.98
17.77
6.23
Performance on Large-Scale Graphs. We evaluate GADT3 on three large-scale datasets and compare it against strong GAD baselines in Table 3 GADT3 outperforms all basclincs on Amazon-all and T-Finance, and performs compelitively on YelpChi-all.
Robustness Under Low Homophily Settings. Our self-supervised loss for anomaly detection is based homophily, i.e., the tendency of similar nodes to connect. To assess the generalization of GADT3 in settings where this assumption weakens and beyond homophilic graphs, we syuthetically rewired a portion of edges to reduce homophily the AMZ and RDT datasots. As shown Table 4 GADT3 remained robust when the larget domain's average homophily score was 2 0.5, with only gradual degradation in per- formance below that threshold. These results show the robustness of our method while acknowledging its reliance on moderate levels of homophily.
Table 4: AUROC (%) under decreasing target-
domain homophily.
Homophily
AMZ RDD
RDT-AMM
62.3
81.3
0.7
62.7
79.6
0.5
60.9
79.1
0.3
58.3
63.1
0.1
58.8
63.7
7 Conclusion
In this paper, we have introduced GADT3, novel TTT framework for GAD when the testing data is out- of-distribution and from heterogeneous application domains. Specifically, our approach addresses scenarios where the distributions and feature spaces differ between the source and target datasets using dataset-specific encoders. GADT3 combines the advantages of TTT with multiple innovations focused on graph anomaly detection. For instance, by leveraging the distinctive distríbution pattern of node homophily between normal and anomalous nodes, we have presented a tailored SSL task along with a robust attention-based edge- weighting mechanism (NSAW) to enhance the generalization of the learned representations. Moreover, GADT3 performs model selection using distance ratio-based early-stopping criterion. Our experiments have illustrated that GADT3 outperforms state-of-tho-art graph domain adaptation basclines.
Limitations:
One current limitation of our approach is its reliance on the assumption that normal nodes exhibit higher homophily compared to anomalous ones. While this pattern holds across many real-world datasots, relaxing the homophily assumption remains an important direction for future work further enhance gencralization to highly heterophilic graphs. Moreover, we will study theoretical guarantees for cross-domain GAD based the similarity between source and target datasets in future work.
13

---

Published in Transactions on Machine Learning Research (09/2025)
8 Acknowledgments
We gratefully acknowledge the support of the US Department of Transportation (USDOT) Tier-1 University Transportation Center (UTC) Transportation Cybersecurity Center for Advanced Research and Education (CYBER-CARE) (Grant No. 69A3552348332) and the Rice University Ken Kennedy Institute.
14

---

Published in Transactions on Machine Learning Research (09/2025)
References
Leman Akoglu, Mary McClohon, and Christos Faloutsos. Oddball: Spotting anomalies in weighted graphs. In Advances in Knowledge Discovery and Data Mining: 14th Pacific-Asia Conference, PAKDD 2010, Hyderabad, India, June 21-24, 2010. Proceedings. Part II 14, pp. 410-421. Springer, 2010.
Leman Akoglu, Hanghang Tong, and Danai Koutra. Graph based anomaly detection and description: a survey. Dala mining and knowledge discovery, 29:626- 688, 2015.
Guanzi Chen, Jiying Zhang, Xi Xiao, and Yang Li. Graphtta: Test time adaptation on graph neural networks. arXiv preprint arXin:2208.00 09126, 2022.
Jiazhen Chen, Sichao Fu, Zhibin Zhang, Zheng Ma, Mingbin Feng, Tony S Wirjaato, and Qinmu Peng. Towards cross-domain few-shot graph anomaly detection. In 2024 IEEE International Conference Data Mining (ICDM), pp. 51-60 60. IEEE, 2024a.
Nan Chen, Zemin Liu, Bryan Hooi, Bingsheng He, Rizal Fathony, Jun Hu, and Jia Chen. Consistency training with learnable data augmentation for graph anomaly detection with limited supervision. In The Twelfth International Conference on Learning Representations, 2024b.
Qingchao Chen and Yang Liu. Structure-awar feature fusion for unsupervised domain adaptation. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pp. 10567-10574, 2020.
Quanyn Dai, Xiao-Ming Wu, Jiaren Xiao, Xiao Shen, and Dan Wang. Graph transfer learning via adversarial domain adaptation with graph convolution. IEEE Transactions on Knowledgge and Data Engineering, 35 (5):4908-44) 4922, 2022.
Kaize Ding, Jundong Li, Rohit Bhanushali, and Huan Liu. Deep anomaly detection attributed networks. In Proceedings of the 2019 STAM international conference on data mining, pp. 594-602. STAM, 2019.
Kaize Ding, Kai Shu, Xuan Shan, Jundong Li, and Huan Liu. Cross-domain graph anomaly detection. /EEE Transactions on Neural Networks and Learning Systems, 33(6):2406 2415,, 2021.
Zhengming Ding, Sheng Li, Ming Shao, and Yun Fu. Graph adaptive knowledge transfer for unsupervised domain adaptation. In Proceedings of the European Conference on Computer Vision (ECCV), pp. 37-52, 2018.
Yuan Gao, Xiang Wang, Xiangnan He, Zhenguang Liu, Huamin Feng, and Yongdong Zhang, Addressing heterophily in graph anomaly detection: A perspective of graph spectrum. In Proceedings of the ACM web conference 2023, pp. 1528-1538, 2023.
Will Hamilton, Zhitao Ying, and Jure Leskovec. Inductive representation learning on large graphs. Advances in neural information processing systems, 30, 2017.
Tianjin Huang, Yulong Pei, Vlado Menkovski, and Mykola Pochenizkiy. Hop-count basod sule-supervised anomaly detection attributed nelworks. In Joint European conference on machine learning and knowl- edge discovery in databases, pp. 225 241. Springer, 2022.
Jianguo Jiang, Jiuming Chen, Tianbo Gu, Swang Raymond Choo, Chao Liu, Min Yu, Weiqing Huang, and Prasant Mohapatra. Anomaly detection with graph convolutional networks for insider threat and fraud detection. In MILCOM 2019-2019 IEEE Military Communications Conference (MILCOM). IEEE, 2019.
Wei Jin, Tong Zhao, Jiayuan Ding, Yozen Liu, Jiliang Tang, and Neil Shah. Empowering graph representation learning with test-time graph transformation. arXie preprinl arXiv:221 0. 0.03561, 2022.
Ilhan Firat Kilincer, Fatih Ertam, and Abdulkadir Sengur. Machine learning methods for cyber security intrusion detection: Datasets and comparative study. Computer Networks, 188:107840, 2021.
Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. 1rXiv:1412.6000 2014.
arXiv preprint
15

---

Published in Transactions on Machine Learning Research (09/2025)
Srijan Kumar, William L Hamilton, Jure Leskovec, and Dan Jurafsky, Community interaction and conflict on the web. In Proceedings of the 2018 world wide web conference, pp. 933-943, 2018.
Aleksandar Lazarevic, Levent Ertoz, Vipin Kumar, Aysel Ozgur, and Jaideep Srivastava. A comparative study of anomaly detection schemes in network intrusion detection. Tn Proceedings of the 2003 STAM international conference on data mining, pp. 25 36. SIAM, 2003.
Jure Leskovec and Julian Mcauley. Learning to discover social circles in ego networks. Advances in neural information processing systems, 25, 2012.
Haoyang Li, Xin Wang, Ziwei Zhang, and Wenwu Zhu. Out-of-distribution generalization on graphs: A survey. aixee preprint or urXiv:2002.074 079877, 2022.
Peiwen Li, Xin Wang, Zeyang Zhang, Ziwci Zhang, Fang Shen, Jialong Wang, Yang Li, and Wenwu Zhu, Causal-aware graph neural architecture search under distribution shifts. In Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 2, pp. 1458 10-9,446,,- 2025.
Jianhua Lin. Divergence measures based on the shannon entropy. IEEE Transactions on Information theory, 37(1):145-155) 1991.
Yixin Liu, Zhao Li, Shirui Pan, Chen Gong, Chuan Zhou, and George Karypis. Anomaly detection on attributed networks via contrastive self-supervised learning, IEEE transactions neural networks and learning systems, 33(6))2378-2399 2021a.
Yixin Liu, Shiyuan Li, Yu Zheng, Qingfeng Chen, Chengqi Zhang, and Shirui Pan. Are: A generalist graph anomaly detector with in-context learning. Advances in Neural Information Processing Systems, 37:50772-50885 2024.
Yuejiang Liu, Parth Kothari, Bastien Van Delft, Baptiste Bellot- Gurlet, Taylor Mordan, and Alexandre Alahi. Ttt++: When does self-supervised test-time training fail or thrive? Advances in Neural Information Processing Systems, 34:21808 21820, 2021b.
Xuexiong Luo, Jia Wu, Amin Beheshti, Jian Yang, Xiankun Zhang, Yuan Wang, and Shan Xue. Comga: Community-aware attributed graph anomaly detection. In Proceedings of the Fifleenth ACM International Conference Web Search and Data Mining, pp. 657-665, 2022.
Xiaoxiao Ma, Jia Wu, Shan Xue, Jian Yang, Chuan Zhou, Quan Sheng, Hui Xiong, and Leman Akoglu. A comprehensive survey on graph anomaly detection with deep learning. IEEE Transactions on Knowledge and Data Engineering, (51)):1220 12038, 2021.
Xiaoxiao Ma, Ruikun Li, Fanzhen Liu, Kaize Ding, Jian Yang, and Jia Wu. Graph anomaly detection with few labels: A data-centric approach. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 2153 1153-2164, 2024.
Julian John McAuley and Jure Leskovec. From amateurs to connoisseurs: modeling the evolution of user expertise through online reviews. In Proceedings of the 22nd international conference on World Wide Web, pp. 897-908, 2013.
Hezhe Qiao and Guansong Pang. Truncated affinity maximization: One-class homophily modeling for graph anomaly detection. Advances in Neural Information Processing Systems, 36, 2024.
Shebuti Rayana and Leman Akoglu. Collective opinion spam detection: Bridging review networks and metadata. In Proceedings of the 21th acm sigkdd international conference on knowledge discovery and dala mining, pp. 985 994, 2015.
Jian Shen, Yanru Qu, Weinan Zhang, and Yong Yu. Wasserstein distance guided representation learning for domain adaptation. In Proceedings of the AAAI conference artificial intelligence, volume 32, 2018.
Boshen Shi, Yongqing Wang, Fangda Guo, Bingbing Xu, Huawei Shen, and Xueqi Cheng. Graph domain adaptation: Challenges, progress and prospects. Xixiv preprint arXiu:4402.0000 2024.
16

---

Published in Transactions on Machine Learning Research (09/2025)
Yu Sun, Xiaolong Wang, Zhuang Liu, John Miller, Alexei Efros, and Moritz Hardt. Test-time training with self-supervision for generalization under distribution shifts. In International conference machine learning, pp. 9229 9248. PMLR, 2020.
Jianheng Tang, Jiajin Li, Ziqi Gao, and Jia Li. Rethinking graph noural networks for anomaly detection. In International conference on machine learning, pp. 21076 21089. PMLR, 2022.
Chih-Fong Tsai, Yu-Feng Hsu, Chia- Ying Lin, and Wei-Yang Lin. Intrusion detection by machine learning: A review. expert systems with opplications, 36(10):11994-22 12000, 2009.
Petar Veličković, Guillem Cueurull, Arantxa Casanova, Adriana Romero, Pietro Lio, and Yoshua Bengio. 2017.
Graph attention networks. arXiv preprint
M Venkatesan and P Prabhavathy. Graph based unsupervised learning methods for edge and node anomaly detection in social network. In 2019 IEEE 1st International Conference on Energy, Systems and Infor- mation Processing (ICESIP), pp. 1-5, IEEE, 2019.
Dequan Wang, Evan Shelhamer, Shaoteng Liu, Bruno Olshausen, and Trevor Darrell. Tent: Fully test-time adaptation by entropy minimization. Xi preprinl orXiv:2006.0722 2020.
Huan Wang. Guoquan Liu, and Po Hu. Tdan: transferable domain adversarial network for link prediction in heterogeneous social networks. ACM Transactions on Knowledge Discovery from Dala, 18(1):1 2023a.
Qizhou Wang, Guansong Pang, Mahsa Salehi, Wray Buntine, and Christopher Leckie. Cross-domain graph anomaly detection via anomaly-aware contrastive alignment. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pp. 4676 4684, 2023b.
Xuhong Wang, Baihong Jin, Ying Du, Ping Cui, Yingshui Tan, and Yupu Yang. One-class graph neural networks for anomaly detection in attributed networks. Neural computing and applications, 33:12073- 12085, 2021.
Yiqi Wang, Chaozhuo Li, Wei Jin, Rui Li, Jianan Zhao, Jiliang Tang, and Xing Xic. Test-time training for graph neural networks. XrXiv preprinl ar xrx::22200 00.0813, 2022.
Jun Wu, Jingrui He, and Elizabeth Ainsworth. Non-iid transfer learning on graphs. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pp. 10342 10350, 2023.
Man Wu, Shirui Pan, Chuan Zhou, Xiaojun Chang, and Xingquan Zhu. Unsupervised domain adaptive graph convolutional networks. In Proceedings of the web conference 2020, pp. 1457 1467, 2020.
Man Wu, Xin Zheng, Qin Zhang, Xiao Shen, Xiong Luo, Xingquan Zhu, and Shirui Pan. Graph learning un- der distribution shifts: A comprehensive survey on domain adaptation, out-of-distribution, and continual learning. Xi preprint arXiv:2402. 16374 2024.
Nan Yin, Li Shen, Mengzhu Wang, Long Lan, Zeyu Ma, Chong Chen, Xian-Shong Hua, and Xiao Luo. Coco: A coupled contrastive framework for unsupervised domain adaptive graph classification. In International Conference on Machine Learning, pp. 40040-40053. PMLR, 2023.
Yuning You, Tianlong Chen, Yongduo Sui, Ting Chen, Zhangyang Wang, and Yang Shen. Graph contrastive learning with augmentations. Advances in neural information processing systems, 33:5812 5823, 2020.
Yuning You, Tianlong Chen, Zhangyang Wang, and Yang Shen. Graph domain adaptation via theory- grounded spectral regularization. In The eleventh international conference on learning representations, 2023.
Ge Zhang, Zhao Li, Jiaming Huang, Jia. Wu, Chuan Zhou, Jian Yang, and Jianliang Gao. efraudcom: An e-commeree fraud dotection system via competitive graph neural networks. ACM Transactions on Information Systems (TOIS), 40(3):1-20) 2022.
17

---

Published in Transactions on Machine Learning Research (09/2025)
Jiaxin Zhang, Yiqi Wang, Xihong Yang, and En Zhu. A fully test-time training framework for semi-supervised node classification on out-of-distribution graphs. ACM Transactions on Knowledge Discovery from Dala, 2024.
Li Zheng, Zhenpeng Li, Jian Lá, Zhao Li, and Jun Gao. Addgraph: Anomaly detection in dynamic graph using attention-based temporal gen. In IJCAI, volume 3, pp. 7, 2019.
Yu Zheng, Ming Jin, Yixin Liu, Lianhua Chi, Khoa T Phan, and Yi-Ping Phoebe Chen. Generative and contrastive self-supervieed learning for graph anomaly detection. IEEE Transactions on Knowledge and Dala Engineering, 35(12), 2021.
18


Reviews:
[{"review_id": "1QgZJDeFsn", "reviewer": "Reviewer_yEmE", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths：\n1. GADT3 is the first to apply test-time training to cross-domain GAD, enabling adaptation to target domains without requiring source data or target labels at test time, which enhances practicality for real-world scenarios with privacy constraints.\n2.  By leveraging the domain-invariant pattern that normal nodes exhibit higher homophily than anomalous ones, the self-supervised loss aligns closely with the anomaly detection objective, improving cross-domain generalization.\n3. NSAW (learnable attention weights to suppress anomalous influences) and class-aware regularization (addressing extreme imbalance) are tailored to GAD challenges, demonstrating strong design choices supported by ablation studies.\n\nWeaknesses：\n1. Performance degrades in low-homophily target domains (homophily < 0.5), limiting generalization to highly heterophilic graphs where normal and anomalous nodes show similar connectivity patterns.\n2. While tested on large-scale graphs, the paper provides little analysis on computational efficiency or scalability trade-offs, which is critical for deployment on extremely large real-world graphs.\n3.  Although compared to several methods, GADT3 is not evaluated against the latest cross-domain GAD techniques beyond 2023, potentially limiting the completeness of its superiority claims.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper introduces GADT3, a novel test-time training (TTT) framework for cross-domain graph anomaly detection (GAD) to address challenges like distribution shifts and heterogeneous feature spaces between source and target domains. GADT3 combines supervised and self-supervised learning during training, leveraging a homophily-based affinity score (capturing domain-invariant anomaly patterns) for self-supervision, and adapts to target domains at test time using only self-supervised learning. Key innovations include Normal Structure-preserved Attention Weighting (NSAW) to suppress anomalous node influences, domain-specific encoders for heterogeneous features, and class-aware regularization for class imbalance. Extensive experiments across multiple cross-domain datasets show GADT3 outperforms baselines, with average improvements over 8.2% in AUROC and AUPRC.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Expand baseline comparisons with state-of-the-art post-2023 methods: The current baselines do not include the latest cross-domain GAD techniques published after 2023, which may undermine the claim of \"state-of-the-art\" performance.", "broader_impact_concerns": "None", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "9QNbpqnD2c", "reviewer": "Reviewer_Ga9t", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n* S1: Proposes the first test-time training (TTT) framework specifically tailored for cross-domain graph anomaly detection, addressing an underexplored problem.\n* S2: Introduces several well-motivated innovations (homophily-based self-supervision, NSAW, domain-specific encoders, and class-aware regularization), each targeting a specific challenge in cross-domain GAD.\n* S3: The experiments are extensive, covering multiple cross-domain scenarios (heterogeneous and homogeneous features), large-scale graphs, ablations, and sensitivity analyses to homophily.\n* S4: GADT3 consistently outperforms state-of-the-art baselines, demonstrating clear and substantial improvements in AUROC and AUPRC.\n* S5:  The paper is generally well-structured, with an intuitive overview figure (Fig. 2) and consistent notation.\n\nWeaknesses:\n\n* W1: The method relies heavily on the assumption that normal nodes have higher homophily, which may not hold in heterophilic or less structured graphs; although this is acknowledged, it remains a limitation.\n* W2: The paper lacks formal analysis or guarantees about adaptation performance (e.g., bounds relating source-target similarity to generalization).\n* W3: Since homophily is a core assumption, it would have been informative to compare against methods that do not assume homophily.\n* W4: While the ablations are useful, the analysis could be more granular—for example, quantifying the contribution of each component across varying homophily levels or feature-space shifts separately.\n* W5: Although large graphs are tested, the computational cost (e.g., runtime, memory) of test-time adaptation and NSAW isn’t thoroughly discussed.\n* W6: All baselines use a projection head (to match features) by the authors; it is unclear how this impacts their performance. \n* W7: Lacking discussion about how hyperparameters were chosen. You list them directly under Table 1 without discussing how you obtained those particular values.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper introduces **GADT3**, the first *test-time training (TTT)* framework specifically designed for *cross-domain graph anomaly detection*. GADT3 combines supervised learning on source graphs and homophily-guided self-supervision at test time to adapt to out-of-distribution and heterogeneous target graphs without requiring target labels or source data access during adaptation. Key innovations include a *homophily-based affinity score* to capture domain-invariant anomaly signals, *Normal Structure-preserved Attention Weighting (NSAW)* to dynamically suppress anomalous influence during message passing, *domain-specific encoders* to handle differing feature spaces, and *class-aware regularization* to address class imbalance. Extensive experiments across diverse datasets demonstrate that GADT3 consistently outperforms existing domain adaptation and anomaly detection baselines.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "See weaknesses above.", "broader_impact_concerns": "None.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "rcCn2gv7so", "reviewer": "Reviewer_iFaJ", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**Strengths:**\n1. The proposed method shows strong empirical gains over previous methods.\n2. The considered problem setting — unsupervised domain adaptation — is a very realistic setting that has high real-world applicability.\n\n**Weakness:**\n\nAlthough the empirical improvements are significant, however, the motivations for some of the algorithmic design are unclear for me. \n    (1) **The homophily loss.**  According to your observation that \"normal nodes are more similar to their neighbors than anomalous ones\", shouldn't the homophily loss be only applied to normal nodes to better separate the normal nodes from the anomalous ones (further emphasize the homophily feature of the normal nodes to differentiate them from the anomalous nodes)? In Eq.5, the loss seems to be imposed on all nodes.\n    (2) **The robust symmetric attention.** Why does reducing the information from abnormal neighbors help anomaly detection? Is it because we need to encourage the difference between the learned representations for normal nodes and anomalous ones?", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper tackles the Graph Anomaly Detection (GAD) problem under the setting of unsupervised domain adaptation. The authors propose: 1) an unsupervised loss based on the empirical observation that normal nodes are more likely to be homophilic than anomalous ones. Specifically, the representations of adjacent nodes are aligned while the representations of disconnected nodes are pushed farther; \n2) a symmetric attention technique to reduce the impact of anomalous nodes on the representations of the normal ones;\n3) a class-aware regularization to handle the class imbalance issue. Experiments demonstrate the effectiveness of the method.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. Could you further clarify the motivation behind the design of the homophily loss and the robust symmetric attention?", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)