PaperlayerView exact revision on arXiv

Source-linked AI summary

RagGAD: Rationale-Aware Conditional Gaussian Mixture Normalizing Flow for Unsupervised Graph Anomaly Detection

Junxin Lu, Jing Zhao, Shiliang Sun

arXiv:2608.16018v1cs.LGcs.AI

TL;DR

Existing graph anomaly detectors can misidentify nodes when homophily is unreliable and normal behaviors are diverse. RagGAD disentangles stable rationales from spurious correlations and models heterogeneous node patterns, consistently outperforming state-of-the-art baselines across benchmark datasets.

  • Problem

    Existing graph anomaly detection methods over-rely on homophily, limiting reliable detection when affinities are weak, deceptive, or normal behaviors are diverse.

  • Method

    RagGAD disentangles stable rationales from spurious correlations, separates robust and fragile rationale components, and models node distributions with a rationale-aware conditional Gaussian mixture normalizing flow.

  • Results

    RagGAD consistently achieves the best AUROC and AUPRC across six real-world datasets and outperforms strongest baselines on four large-scale graphs.

  • Takeaways & Limitations

    RagGAD identifies anomalies through deviations in unstable or non-rationale interactions while modeling the diversity of normal patterns.

Abstract

from arXiv · show

Graph anomaly detection aims to identify nodes that deviate from normal behavioral patterns within graphs. However, existing methods largely rely on the homophily assumption, which makes it difficult to distinguish spurious affinities and to capture the diverse behaviors of normal nodes,limiting their robustness in complex real-world scenarios. To address this problem, we propose RagGAD, an unsupervised graph anomaly detection framework based on rationale-aware conditional Gaussian mixture normalizing flow. RagGAD introduces an adaptive rationale disentangler to disentangle stable rationales from spurious correlations within node interrelationships, and further decomposes stable rationales into robust and fragile components. The learned rationales capture underlying interaction patterns that characterize normal behaviors under varying conditions, while anomalies emerge as deviations associated with unstable or spurious correlations. To model the intricate distributions of normal and abnormal nodes, RagGAD integrates rationale-non-rationale Gaussian mixture modeling with a robust-fragile rationale mixture learning strategy. By mitigating spurious homophilic correlations and embracing the heterogeneity of normal patterns, RagGAD identifies anomalies as low-density regions within a structure-aware distribution space. Extensive experiments on multiple benchmark datasets demonstrate that RagGAD outperforms state-of-the-art methods.

I. INTRODUCTION … B. Normalizing Flows in Anomaly Detection

RagGAD addresses limitations of unsupervised graph anomaly detection by disentangling stable rationales from spurious correlations and modeling diverse node behaviors with a conditional Gaussian mixture normalizing flow. Across related work and normalizing-flow-based detection, the paper motivates rationale-aware density modeling for identifying anomalies in low-density regions.

  • II. RELATIVE WORKS: Existing UGAD methods mainly use data reconstruction or self-supervised objectives, including contrastive learning, proxy classification, and auxiliary tasks.Reconstruction methods flag nodes with high reconstruction errors as anomalies.
  • I. INTRODUCTION: Reliance on homophily can create a homophily trap, causing anomalies that mimic normal connections to evade detection and diverse normal nodes to be misclassified.Statistical co-occurrence, similarity, and homophily-aware metrics struggle to eliminate spurious affinities.
  • I. INTRODUCTION: RagGAD uses an adaptive rationale disentangler to separate stable rationales from spurious correlations and decompose rationales into robust and fragile components.These rationales represent underlying influence mechanisms, while unstable non-rationale correlations reveal anomalies.
  • I. INTRODUCTION: RagGAD models diverse normal behaviors and intricate normal and abnormal distributions with a rationale-aware conditional Gaussian mixture normalizing flow.The framework enables efficient detection of anomalies as low-density regions in a structure-aware distribution space.
  • I. INTRODUCTION: Unsupervised graph anomaly detection identifies abnormal nodes among predominantly normal nodes without relying on labeled data.This improves practical applicability but remains challenging in real-world graphs.
  • B. Normalizing Flows in Anomaly Detection: Normalizing flows map complex distributions to simpler ones through invertible transformations, enabling precise density estimation for anomaly detection.Normal samples are expected in high-density regions, whereas anomalies fall in low-density regions.
  • B. Normalizing Flows in Anomaly Detection: Existing normalizing-flow anomaly detectors train solely on normal data, producing ambiguous normal–abnormal decision boundaries and reduced distinguishability.RagGAD instead allows normal and abnormal data to coexist during training using disentangled representations.

III. PRELIMINARIES · A. Problem Statement · B. Normalizing Flow

The preliminaries define attributed graphs and the unsupervised graph anomaly detection objective, then introduce normalizing flows and their conditional extension for tractable density estimation. These foundations support learning anomaly scores from graph structure and attributes without class labels.

  • A. Problem Statement: An attributed graph is defined as G = {V, E, X}, comprising nodes V, edges E, and node attributes X.The node-attribute matrix is X = {x_i}, with each x_i representing the attribute vector of node v_i.
  • A. Problem Statement: The node-attribute matrix has dimensions R^N×d_x, where each node attribute vector contains d_x dimensions.Graph connectivity is represented separately by the adjacency matrix A.
  • A. Problem Statement: The adjacency matrix A ∈ R^N×N uses a_ij = 1 for an edge between v_i and v_j and a_ij = 0 otherwise.This matrix encodes inter-node connectivity in the attributed graph.
  • A. Problem Statement: UGAD identifies minority abnormal nodes V_a among majority normal nodes V_n without class labels during training.The sets satisfy V_a ∪ V_n = V, V_a ∩ V_n = ∅, and |V_a| ≪ |V_n|.
  • A. Problem Statement: The UGAD objective is to learn an anomaly scoring function S : V → R that assigns every normal node a lower score than every abnormal node.Formally, S(v_n) < S(v_a) for all v_n ∈ V_n and v_a ∈ V_a.
  • B. Normalizing Flow: A normalizing flow maps an unknown data distribution p(X) to a tractable latent distribution p(Z) through invertible transformations.It uses a bijection F : x ∈ R^d_x ↔ z ∈ R^d_z and computes data log-likelihood via the change-of-variables formula.
  • B. Normalizing Flow: Flow models commonly assume p_Z(z) follows N(0, I) and optimize F_θ by maximizing training-distribution log-likelihood.The transformation’s Jacobian and learnable parameters θ determine the resulting density and loss.
  • B. Normalizing Flow: Conditional normalizing flow introduces an external condition C to estimate p_X(x|C) and its conditional log-density.The conditional density is p_X(x|C) = p_Z(F_θ(x; C)) |det∇_xF_θ(x; C)|, with log-density given by equation (3).

IV. METHODOLOGY

RagGAD is a node-level, unsupervised graph anomaly detection framework based on a rationale-aware conditional Gaussian mixture normalizing flow.

  • RagGAD performs node-level unsupervised graph anomaly detection using a rationale-aware conditional Gaussian mixture normalizing flow.

A. Adaptive Rationale Disentanglement

RagGAD adaptively disentangles stable rationale edges from unstable correlations, then further separates stable rationales into robust and fragile components. It uses these graph views to learn rationale representations and reconstruct node attributes while modeling non-rationale information separately.

  • Adaptive Rationale Disentangler: The adaptive rationale disentangler models rationale extraction as binary edge selection, separating interrelationships into stable rationales Gc and non-rationale correlations Go.A trainable mask and sigmoid threshold select rationale edges, with Gc = I ⊙ M and Go = I ⊙ (1 − M).
  • Adaptive Rationale Disentangler: RagGAD projects node attributes with a linear attribute projector before learning node interrelationships.The projector can use dimensionality reduction methods such as singular value decomposition or principal component analysis.
  • Adaptive Rationale Disentangler: RagGAD further decomposes stable rationales Gc into robust rationales Gr|c and fragile rationales Gf|c using learnable stability weights.Robust rationales capture persistent relationships, whereas fragile rationales represent less stable rationale relationships.
  • Adaptive Rationale Disentangler: Two rationale-augmented graph convolution layers encode robust and fragile rationale representations, which a reconstructor fuses to generate reconstructed node attributes.A separate graph convolution layer extracts the non-rationale representation Ho from Go and the projected attributes.

B. Rationale-Aware Node-Level Gaussian Mixture Normalizing Flow Model

RGMN combines conditional normalizing flows with rationale–non-rationale Gaussian mixture modeling to estimate structure-aware node densities. Its robust-fragile rationale mixture learning further captures fine-grained diversity among normal nodes while distinguishing rationale and non-rationale latent classes.

  • Model architecture: RGMN conditionally transforms rationale and non-rationale node representations into latent embeddings for conditional density estimation.The NCNF block is one of RGMN’s three core modules.
  • Node-Level Conditional Normalizing Flows: Real-NVP affine coupling layers model robust, fragile, and non-rationale conditional densities from node attributes and their corresponding representations.Transformation coefficients are predicted by learnable MLPs, and the flow computes conditional densities for each representation type.
  • Rationale-Non-Rationale Gaussian Mixture Modeling: RRGM models rationale representations as the normal class and non-rationale representations as the abnormal class using a conditional Gaussian mixture prior.This replaces the restrictive identical standard-normal latent prior assumption and better represents distinct normal and abnormal characteristics.
  • Robust-Fragile Rationale Mixture Learning: RFRM captures diverse normal patterns with fine-grained rationale Gaussian mixtures by treating robust rationale embeddings as central components and fragile rationale embeddings as complementary components.For abnormal nodes, the model uses a two-component Gaussian mixture with a central component and learnable offset.

C. The Overall Objective and Anomaly Scoring

RagGAD trains with weighted loss components, including a rationale sparsity term that removes weak non-rationale correlations. At test time, it scores nodes by negative rationale-conditioned log-density, with higher scores indicating greater abnormality.

  • Overall Objective: The rationale sparsity loss encourages RagGAD to discard weak non-rationale correlations during optimization.The relative contributions of the loss terms are controlled by λ1, λ2, and λ3, tuned via grid search.
  • Anomaly Scoring: RagGAD computes each node’s overall log-density as the sum of densities conditioned on non-rationale, robust rationale, and fragile rationale representations.The decomposition is logpX (˜x|h)=logpX (˜x|ho)+logpX (˜x|hr|c)+logpX (˜x|hf|c).
  • Anomaly Scoring: The anomaly score is the negative log-density, S(xi) = −logpX (˜x|h), so higher scores indicate a higher likelihood that node vi is abnormal.This scoring rule follows the hypothesis that anomalies have low density relative to the majority of instances.

V. EXPERIMENTS · A. Experimental Setup

RagGAD is evaluated on ten benchmark datasets against a broad set of UGAD baselines using AUROC and AUPRC. Experiments average results across five runs and use a standardized PyTorch training setup with Adam optimization on an NVIDIA RTX 3090 GPU.

  • A. Experimental Setup: RagGAD is evaluated on ten UGAD benchmark datasets, comprising six real-world and four large-scale datasets.The real-world datasets include BlogCatalog, ACM, Amazon, Facebook, Reddit, and YelpChi; large-scale datasets include Amazon-all, YelpChi-all, T-Finance, and OGB-Proteins.
  • A. Experimental Setup: BlogCatalog, ACM, and OGB-Protein contain injected contextual and structural anomalies.
  • A. Experimental Setup: RagGAD is compared with thirteen state-of-the-art UGAD baselines, including TAM, HUGE, CoLA, ComGA, and FreeGAD.
  • A. Experimental Setup: UGAD performance is evaluated using Area Under the Receiver Operating Characteristic Curve (AUROC) and Area Under the precision recall curve (AUPRC).
  • A. Experimental Setup: Reported AUROC and AUPRC results are averaged over five independent runs with different random seeds.Baseline results come from publicly available results or reproduction using official source code.
  • A. Experimental Setup: Experiments use PyTorch on an NVIDIA GeForce RTX 3090 (24GB) GPU, with Adam optimization for 500 epochs at a learning rate of 1e-4.Hyperparameter tuning, early stopping, and model selection follow TAM and HUGE; the projector uses PCA and the graph convolution layer is a two-layer GCN.

B. Results

RagGAD achieves consistently strong anomaly-detection performance across real-world and large-scale graphs, while visualizations show separated anomaly scores and disentangled rationale representations. These results support its robustness to spurious correlations, heterogeneous graph structures, and diverse anomaly types.

  • Comparison with Baselines: RagGAD achieves the best AUROC and AUPRC across six real-world UGAD datasets containing injected or real anomalies.AUPRC results are emphasized because this metric is more sensitive to class imbalance.
  • Performance on Large-scale Graphs: 93.15% on Amazon-all, 92.98% on T-Finance, and 78.83% on OGB-Proteins show RagGAD’s strong AUROC performance on large-scale graphs.It exceeds FreeGAD by +0.85% on T-Finance and TAM by +4.34% on OGB-Proteins, with AUPRC gains of +3.34% on Amazon-all and +6.23% on OGB-Proteins.
  • Visualization of Anomaly Score: Despite YelpChi violating one-class homophily, normal and abnormal nodes retain separated anomaly-score distributions with clearly differentiated peaks.Facebook and Amazon-all instead exhibit stronger connectivity or affinity among normal nodes than abnormal nodes.
  • Visualization of Rationale Graphs: RagGAD disentangles non-rationale correlations from rationales and further decomposes rationales into robust and fragile components.Robust-fragile rationale mixture learning is used to enhance generalization for anomaly detection.
  • Visualization of Representation: t-SNE visualizations demonstrate that RagGAD separates rationale and non-rationale representations while distinguishing robust from fragile rationale representations.The representations include robust rationale, fragile rationale, and non-rationale components across four benchmark datasets.

C. Ablation Study

The ablation study shows that RagGAD’s components are complementary, with RRGM particularly important, while sensitivity analyses identify robust or dataset-dependent hyperparameter settings. The model performs best around τ = 0.85 and remains broadly robust to variations in η and projected attribute dimension.

  • Components Analysis: Integrating RRGM and RFRM progressively improves RagGAD’s accuracy, with removing RRGM causing substantial AUROC and AUPRC drops.RRGM alone remains strongly competitive, underscoring its pivotal role in the framework.
  • Sensitivity Analysis of τ: RagGAD’s performance rises, flattens, and then declines as τ increases, with the best AUROC and AUPRC occurring around τ = 0.85.The default value is therefore set to τ = 0.85 across experiments.
  • Sensitivity Analysis of γ: Changing γ balances rationale and non-rationale Gaussian mixture normalizing flow losses, with γ = 0 disabling the rationale loss and γ = 1 relying solely on it.The analysis is conducted on the Facebook dataset over γ ∈ [0,1] in increments of 0.1.
  • Sensitivity Analysis of η: RagGAD is robust to η changes, with the highest AUROC at η = 1 on small-scale graphs and η = 2 on large-scale graphs.The evaluated datasets include BlogCatalog, Facebook, YelpChi, and Amazon-all.
  • Sensitivity Analysis of d˜x: On ACM, performance improves as projected attribute dimension d˜x increases but begins declining beyond an unspecified threshold, while low-dimensional datasets use d˜x = 64.The high-dimensional sweep ranges from 4 to 1024 in powers of 2.
  • Sensitivity Analysis of λ1, λ2, and λ3: Grid searches over λ1, λ2, and λ3 use the range 0.001 to 1, with the best performance for γ1 reported at γ1 = 0.1.The passage states that λ1 performs optimally from 0.01 to 1 and that γ1 controls Lrgmn.

D. Efficiency and Complexity Analysis

RagGAD incurs quadratic complexity from global nodewise interaction and rationale disentanglement, adding computation while balancing representation robustness with parameter and runtime efficiency.

  • Model Complexity: RagGAD has complexity O(N 2d˜x) because its ARD module performs global nodewise interaction and rationale disentanglement.This places RagGAD among methods introducing quadratic terms O(N 2), such as DOMINANT, TAM, and HUGE.
  • Efficiency Trade-off: Global dependency modeling and rationale disentanglement add computation but improve representation robustness without excessive parameter or runtime overhead.Efficiency is evaluated through model complexity, parameter count, and empirical runtime, with runtimes measured on Amazon over 100 training epochs and standard inference.
  • Efficiency Trade-off: RagGAD maintains a favorable balance between effectiveness and efficiency despite its additional computation for global dependency modeling and rationale disentanglement.The analysis emphasizes the added computation alongside the absence of excessive parameter or runtime overhead.

VI. CONCLUSION

RagGAD is an unsupervised graph anomaly detection framework that disentangles robust rationales from non-rationale correlations in node interrelationships. It further decomposes rationales into robust and fragile components to capture mechanisms of normal behavior and identify anomalies through non-rationale deviations.

  • Framework: RagGAD disentangles robust rationales from non-rationale correlations in node interrelationships.The framework is presented as a novel unsupervised graph anomaly detection approach.
  • Rationale decomposition: RagGAD decomposes rationales into robust and fragile components to capture mechanisms governing normal behavior.
  • Anomaly identification: Anomalies are identified through deviations in non-rationale interactions.
Loading 2608.16018v1…