PaperlayerView exact revision on arXiv

Source-linked AI summary

Tabular Foundation Models are Strong Graph Anomaly Detectors

Yunhui Liu, Tieke He, Yongchao Liu, Can Yi, Hong Jin, Chuntao Hong

arXiv:2601.17301v1cs.LG

TL;DR

Existing GAD methods require dataset-specific training and substantial labels, while graphs differ widely in structure and feature semantics. TFM4GAD enriches raw node features with Laplacian embeddings, structural characteristics, and anomaly-sensitive neighborhood aggregations before processing them with a TFM in context. TFM4GAD significantly outperforms specialized GAD baselines; LimiX-16M achieves 89.92% average AUROC and 72.25% average AUPRC, surpassing SpaceGNN (86.50% AUROC and 61.72% AUPRC).

  • Problem

    Existing GAD methods require dataset-specific training and substantial labels, while graphs differ widely in structure and feature semantics.

  • Method

    TFM4GAD enriches raw node features with Laplacian embeddings, structural characteristics, and anomaly-sensitive neighborhood aggregations before processing them with a TFM in context.

  • Results

    TFM4GAD significantly outperforms specialized GAD baselines; LimiX-16M achieves 89.92% average AUROC and 72.25% average AUPRC, surpassing SpaceGNN (86.50% AUROC and 61.72% AUPRC).

  • Takeaways & Limitations

    The framework provides an efficient paradigm for generalist graph anomaly detection without graph-specific training or gradient updates.

Abstract

from arXiv · show

Graph anomaly detection (GAD), which aims to identify abnormal nodes that deviate from the majority, has become increasingly important in high-stakes Web domains. However, existing GAD methods follow a "one model per dataset" paradigm, leading to high computational costs, substantial data demands, and poor generalization when transferred to new datasets. This calls for a foundation model that enables a "one-for-all" GAD solution capable of detecting anomalies across diverse graphs without retraining. Yet, achieving this is challenging due to the large structural and feature heterogeneity across domains. In this paper, we propose TFM4GAD, a simple yet effective framework that adapts tabular foundation models (TFMs) for graph anomaly detection. Our key insight is that the core challenges of foundation GAD, handling heterogeneous features, generalizing across domains, and operating with scarce labels, are the exact problems that modern TFMs are designed to solve via synthetic pre-training and powerful in-context learning. The primary challenge thus becomes structural: TFMs are agnostic to graph topology. TFM4GAD bridges this gap by "flattening" the graph, constructing an augmented feature table that enriches raw node features with Laplacian embeddings, local and global structural characteristics, and anomaly-sensitive neighborhood aggregations. This augmented table is processed by a TFM in a fully in-context regime. Extensive experiments on multiple datasets with various TFM backbones reveal that TFM4GAD surprisingly achieves significant performance gains over specialized GAD models trained from scratch. Our work offers a new perspective and a practical paradigm for leveraging TFMs as powerful, generalist graph anomaly detectors.

1 Introduction

Existing graph anomaly detection methods require dataset-specific training and substantial data, motivating foundation models that generalize across heterogeneous graphs. TFM4GAD adapts tabular foundation models by enriching node features with graph structure and achieves strong in-context detection performance.

  • 1 Introduction: Existing GAD methods train a separate model for each dataset, creating expensive training, high data demands, and weak transferability across graphs.These limitations motivate a foundation GAD model that can generalize across diverse domains.
  • 1 Introduction: TFMs address heterogeneous features through tokenized feature handling, in-context learning without retraining, and synthetic pre-training that reduces reliance on scarce anomaly labels.These properties align with the cross-domain and low-label requirements of foundation GAD.
  • 1 Introduction: TFM4GAD flattens each graph into an augmented table containing raw features, Laplacian embeddings, structural statistics, and anomaly-sensitive neighborhood aggregations.The resulting representation supplies graph topology to a TFM while retaining tabular compatibility.
  • 1 Introduction: TFM4GAD processes the augmented table fully in context and significantly outperforms strong GAD models trained from scratch across four datasets and four TFM backbones.The framework uses a small set of known labels as in-context examples to score unlabeled nodes.

2 Preliminary

Graph anomaly detection assigns anomaly scores or labels to nodes in attributed graphs, while foundation GAD seeks generalization across graphs without retraining. Tabular foundation models provide universal inference for heterogeneous tabular data through synthetic pre-training and in-context examples.

  • 2 Preliminary: GAD assigns each graph node an anomaly score or binary label, with anomalous nodes marked separately from normal nodes.The foundation-model setting further requires predicting unlabeled nodes in new graphs from a small labeled context without training or fine-tuning.
  • 2 Preliminary: A tabular dataset represents instances as rows and heterogeneous numerical or categorical attributes as columns, with labels supplying task supervision.This tabular structure motivates applying TFMs to node representations.
  • 2 Preliminary: TFMs are pre-trained models that learn universal inference for unseen tabular datasets without dataset-specific training.They learn from synthetic datasets and use in-context examples at inference time to approximate Bayesian posterior prediction.

3 Framework

TFM4GAD bridges tabular foundation models and graph anomaly detection by flattening graphs into enriched, structure-aware tables. It combines positional, structural, and anomaly-sensitive neighborhood features, then performs anomaly detection through in-context TFM inference without graph-specific training.

  • Graph-to-Tabular Flattening: TFM4GAD flattens each graph into an augmented feature table combining raw node features with Laplacian embeddings, structural characteristics, and neighborhood aggregation.The enriched representation preserves both node attributes and graph information for tabular processing.
  • Raw Features and Laplacian Embeddings: Laplacian embeddings provide low-dimensional positional encodings that preserve large-scale structural relationships among nodes.They are computed from eigenvectors of the normalized graph Laplacian.
  • Local and Global Structural Characteristics: Degree and PageRank expose local connectivity and global influence patterns that can signal anomalous nodes.The framework uses these explicit structural characteristics alongside the global positional representation.
  • Anomaly-Sensitive Neighborhood Aggregation: Beta-wavelet neighborhood aggregation preserves anomaly-sensitive high-frequency deviations instead of smoothing them with standard low-pass graph filters.The filter bank produces multi-scale representations with positive and negative responses for modeling neighborhood similarity and dissimilarity.
  • In-Context Graph Anomaly Detection: After feature construction, TFM4GAD predicts anomaly probabilities for unlabeled nodes in a single in-context inference pass using labeled nodes as evidence.The framework requires no graph-specific training, fine-tuning, or gradient updates, enabling generalization to new GAD datasets.

4 Experiments

Across four diverse GADBench datasets, TFM4GAD uses tabular foundation models with graph-derived features to outperform trained specialized baselines in a label-scarce, in-context setting.

  • 4.1 Experimental Setup: The evaluation covers Amazon, YelpChi, T-Finance, and T-Social, spanning diverse domains, feature dimensionalities, and graph scales.Baselines include eight supervised methods requiring dataset-specific training.
  • 4.1 Experimental Setup: Each dataset provides only 100 labeled nodes, including 20 anomalies, and results average 10 random GADBench splits using AUROC and AUPRC.The study evaluates TabPFNv2, TabPFNv2.5, LimiX-2M, and LimiX-16M backbones with k = 16 Laplacian eigenvectors and hop orders from {1, 2, 3}.
  • 4.2 Experimental Results: 89.92% AUROC and 72.25% AUPRC let LimiX-16M surpass SpaceGNN’s 86.50% AUROC and 61.72% AUPRC across the benchmark.The comparison covers average metrics, with the gap also reported as consistent on individual datasets including T-Social and YelpChi.
  • 4.2 Experimental Results: TFM4GAD’s purely in-context operation requires no graph-specific training or gradient updates while outperforming specialized GAD baselines.The result supports graph-to-tabular flattening as a structure-aware way to apply TFMs to anomaly detection.
  • 4.2 Experimental Results: Adding anomaly-sensitive neighborhood aggregation produces the largest ablation gain, followed by explicit structural characteristics and Laplacian embeddings.Raw node features alone perform poorly, while the full feature construction combines all components.

5 Conclusion

The conclusion presents TFM4GAD as a framework that adapts tabular foundation models to graph anomaly detection by flattening graph data into augmented tabular representations.

  • 5 Conclusion: TFM4GAD combines Laplacian embeddings, explicit structural metrics, and anomaly-sensitive neighborhood aggregations to bridge graph topology and tabular inference.The framework bypasses expensive training and reports superior in-context detection performance against specialized baselines.
Loading 2601.17301v1…