Source-linked AI summary
RINSE: Robust Target-Time Normality Estimation for Zero-Shot Graph Anomaly Detection
Taufikur Rahman Fuad, Md Abrar Jahin, Amir Hussain
TL;DR
Zero-shot graph anomaly detection must transfer a source-trained detector to unseen unlabeled targets despite unreliable source-derived normality under domain shift. RINSE keeps the detector frozen and uses gradient-free target-time estimation of normality, calibration, and evidence reliability. Across eight unseen target graphs, it achieves the highest mean average precision among evaluated methods under both preprocessing protocols.
Problem
Zero-shot GAD seeks to rank nodes in unseen unlabeled target graphs, but domain shift can make source-derived normality unreliable.
Method
RINSE is a gradient-free framework that iteratively selects low-residual target nodes, builds a trimmed normality dictionary, calibrates embeddings, gates complementary evidence, and ensembles frozen-detector encoders.
Results
RINSE achieves the highest mean average precision among evaluated methods across eight unseen target graphs under both preprocessing protocols.
Takeaways & Limitations
The results support robust target-time estimation as a practical approach to generalist GAD without target labels, gradients, or per-target tuning.
Takeaways & Limitations
The study focuses on attributed node-level graphs and a truncated-attention scorer, and rankings should assist human review rather than trigger automatic punitive decisions.
Abstract
from arXiv · showhide
Zero-shot graph anomaly detection seeks to deploy a detector trained on source graphs to unseen, unlabeled targets, yet domain shift can make source-derived notions of normality unreliable. We introduce RINSE (Robust Iterative Normality Self-Estimation), a gradient-free target-time framework that keeps the source-trained detector fixed while sequentially estimating target normality, representation calibration, and evidence reliability from the target graph. Its core idea is to identify a reliable subset of low-residual target nodes, use them to construct a trimmed target-aware normality model, and combine complementary anomaly evidence through reliability-gated rank fusion and encoder ensembling. Across eight unseen target graphs, RINSE achieves the highest average AUPRC among the evaluated methods under two separate preprocessing protocols, while block ablations and sensitivity analyses support the combined design. These results support robust target-time estimation as a practical approach to generalist graph anomaly detection without target labels, gradients, or per-target tuning.
1 Introduction
Zero-shot graph anomaly detection applies a source-trained detector to unseen unlabeled graphs, but domain shift and contaminated target data can make source-derived normality unreliable. RINSE addresses this with gradient-free target-time estimation around a frozen detector.
- Motivation: Per-graph unsupervised GAD requires separate training, while label-free hyperparameter and stopping selection remains unresolved.Training on contaminated graphs can also let autoencoders absorb anomalies.
- Zero-shot setting: Zero-shot generalist GAD trains on labeled source graphs and ranks nodes in unseen targets without labels, fine-tuning, or target-specific configuration.This reduces the repeated target-specific training burden.
- Prior approaches: Existing zero-shot generalists encode anomaly criteria as neighborhood prompts, graph-agnostic prototypes, or normal-pattern dictionaries for unlabeled targets.ARC uses labeled normal context, whereas ARCzero selects pseudo-normal target context for label-free inference.
- RINSE: RINSE estimates a trimmed target-normality dictionary, embedding calibration, and evidence reliability around a frozen detector.It uses low-residual target nodes and excludes high-residual candidates from later calibration and dictionary updates.
- RINSE: RINSE combines complementary evidence through a label-free reliability gate and rank-based encoder ensembling without target labels or target-time gradients.The evaluation uses one shared configuration across eight unseen targets, both preprocessing protocols, ablations, sensitivity analysis, and estimator diagnostics.
2 Related Work
Related work spans target-specific GAD, cross-domain adaptation, zero-shot generalists, test-time adaptation, and label-free model selection. RINSE differs by keeping checkpoint selection source-held-out while estimating target view reliability at inference without target-time adaptation gradients.
- Graph Anomaly Detection: Most deep GAD methods train on the graph they score, requiring label-free hyperparameter and stopping selection.Reconstruction, contrastive, affinity, and supervised spectral methods represent distinct target-specific approaches.
- Generalist and Zero-Shot Cross-Domain GAD: Earlier cross-domain methods access the target during training and learn a separate model for each target.Generalist methods instead train once on labeled source graphs and score unseen targets.
- Generalist and Zero-Shot Cross-Domain GAD: ARC uses a few labeled normal target nodes at inference, while ARCzero selects representative pseudo-normal target context for label-free inference.Other zero-shot methods use neighborhood prompts or graph-agnostic prototypes.
- Test-Time Adaptation and Unsupervised Model Selection: Test-time adaptation optimizes objectives or updates features, graph structure, normalization parameters, or graph-level aligners using unlabeled test data.Backpropagation-free methods also align target subspaces or feature statistics or select informative tokens.
- Test-Time Adaptation and Unsupervised Model Selection: RINSE separates source-held-out checkpoint selection from target-time view-reliability estimation on the unlabeled target graph.This contrasts with label-free model-selection methods based on meta-learning, surrogate metrics, or internal evaluation criteria.
3 Preliminaries
The paper formalizes an attributed graph with binary latent node anomaly labels and defines zero-shot scoring on processed, normalized target graphs. A source-trained model ranks anomalous nodes without target labels, fine-tuning, or target-specific configuration.
- Graph formulation: An attributed graph is represented as G = (V, E, X) with N nodes, adjacency matrix A, and node attributes X.Each node also has a latent binary anomaly label.
- Zero-shot setting: In zero-shot GAD, a model trains once on labeled source graphs and produces target scores that rank anomalous nodes above normal ones.Targets provide no labels, fine-tuning, or target-specific configuration.
- Preprocessing: Because feature spaces differ across domains, each graph is projected to shared dimension d and rescaled by distance-based normalization.Gaussian random projection precedes PCA when the original feature dimension is smaller than d.
4 Methodology
RINSE keeps source-trained ensemble members frozen while estimating target normality, calibrating embeddings, and combining complementary evidence on an unlabeled target graph. Its iterative trimming, two-pass calibration, reliability-gated fusion, and rank-averaged ensembling form the target-time inference pipeline.
- Frozen Truncated-Attention Scorer: RINSE independently processes each unlabeled target graph with frozen source-trained encoders, attention projections, and source banks.The pipeline uses no target labels, gradients, or per-target tuning.
- Frozen Truncated-Attention Scorer: The source-trained scorer encodes propagated attributes and reconstructs nodes against a masked attention-based normality dictionary.The encoder, attention projections, and source bank are trained or constructed from source graphs before inference.
- Robust Iterative Normality Self-Estimation: Each iteration admits the ρN lowest-residual target embeddings, combines them with the frozen source bank, and rescores all nodes.The final admitted set defines a target-aware dictionary, while trimming excludes the highest-residual 1 −ρ fraction from each update.
- Two-Pass Dictionary-Statistics Calibration: The two-pass calibration uses provisional low-residual normals to refine target and source-bank statistics while excluding high-residual nodes from calibration.Calibration standardizes coordinate-wise moments and restores the source bank’s mean row norm.
- Label-Free Multi-View Evidence: RINSE adds kNN distance, target-dictionary residual, and raw-attribute affinity as complementary evidence views alongside the attention-reconstruction anchor.The kNN view measures proximity to individual normal patterns, while the target-dictionary residual removes dependence on the source bank.
- Reliability-Gated Fusion and Encoder Ensembling: Reliability weights fuse rank-normalized evidence with the anchor retaining unit weight, and normalized member ranks are averaged across ensemble members.View reliability is estimated from agreement with the anchor at ranking extremes, allowing unreliable views to be suppressed.
5 Experiments
RINSE is evaluated on eight unseen target graphs using a shared source-selected configuration, two preprocessing protocols, component ablations, and sensitivity analyses. It achieves the strongest reported average performance and benefits from its combined target-time components.
- Experimental setup: RINSE and one-for-all baselines are evaluated on eight disjoint target graphs after training on four source graphs.The target graphs are Cora, Flickr, ACM, BlogCatalog, Facebook, Weibo, Reddit, and Amazon; target labels are not used for training or model selection.
- Experimental setup: The shared configuration is selected using held-out source validation and fixed across all target graphs, with five independent runs reported.The target-time pipeline remains gradient-free, while ensemble members are independently initialized.
- Main results: 39.18 mean average precision is RINSE’s best reported result under standard normalization, improving over OWLEYE by 3.01 points.RINSE ranks first on five targets and second on the remaining three, with a median paired gain of 2.96 points on seven of eight targets.
- Leak-free evaluation: 39.55 mean average precision is achieved under leak-free preprocessing, where RINSE ranks first among four one-for-all methods on all eight targets.Its margin over OWLEYE rises from 3.01 points under standard normalization to 3.76 points under source-referenced preprocessing.
- Ablation study: 3.5 and 3.1 AUPRC points are the largest average ablation gains, supplied by evidence views and dictionary-statistics calibration under standard and leak-free protocols.Ensembling and iterative normality estimation contribute up to 2.7 and 1.9 average points, respectively.
- Sensitivity analysis: Mean AUPRC changes by less than one point across broad ranges of ρ, k, and τ, supporting one fixed configuration without per-target tuning.Increasing the ensemble from E = 1 to E = 5 adds 3.5 points, while further increasing it to E = 8 adds 0.4 point.
6 Conclusion
RINSE is a robust, gradient-free target-time framework for zero-shot graph anomaly detection. Across eight unseen target graphs, it achieved the highest mean average precision under both preprocessing protocols, with ablations and sensitivity analyses supporting its components.
- RINSE estimates target normality through trimmed iteration, calibrates embedding statistics, weights complementary evidence by label-free reliability, and rank-averages independently trained encoders.
- RINSE achieved the highest mean average precision among evaluated methods across eight unseen target graphs under both preprocessing protocols.
- Ablation and sensitivity analyses supported the contribution of RINSE’s individual components.
- The study focuses on attributed node-level graphs and a truncated-attention scorer.The authors identify larger graphs, alternative frozen detectors, and other anomaly settings as directions for extension.
Ethical Statement
RINSE is evaluated on established benchmark datasets without collecting new human-subject data. Its anomaly rankings may produce false positives or affect groups unevenly, so deployment should support human review with validation, safeguards, and auditing.
- RINSE uses established benchmark datasets and does not collect new human-subject data.
- Anomaly rankings can contain false positives and affect users or groups unevenly, so they should assist human review rather than trigger automatic punitive decisions.
- Practical deployment should include domain-specific validation, appropriate safeguards, and subgroup auditing where relevant.
- RINSE reduces dependence on labeled target data but provides no causal guarantees, and use should follow applicable laws, platform policies, and data-governance requirements.