PaperlayerView exact revision on arXiv

Source-linked AI summary

FoundAna: A GNN-assisted Foundation Model for Graph Anomaly Detection

Suprim Nakarmi, Chahana Dahal, Yue Zhao, Junggab Son, Zuobin Xiong

arXiv:2609.18107v1cs.LGcs.CR

TL;DR

Graph anomaly detection faces task heterogeneity, scarce labels, and domain variability, while existing models commonly remain tied to one dataset. FoundAna combines an anomaly-specific GNN with a transformer and four positional encodings, using feature and adjacency reconstruction errors as anomaly scores. Across nine GAD benchmarks, FoundAna reports better average results; in few-shot inference, its average AUROC, AUPRC, and Macro F1 are 0.647, 0.227, and 0.568, respectively.

Abstract

from arXiv · show

Graph anomaly detection aims to identify graph structures (e.g., nodes, edges, or subgraphs) that deviate significantly from expected patterns, which supports critical applications in fraud detection, spam identification, network intrusion, etc. Despite the growing methods in the field, existing approaches follow a one-model-per-dataset paradigm, limiting their transferability across diverse real-world scenarios due to task heterogeneity, label scarcity, and domain variability. In this work, we introduce FoundAna, a GNN-assisted Foundation Model for Graph Anomaly Detection - the first foundation model framework designated for generalizable, cross-graph anomaly detection by combining GNNs and transformers. FoundAna integrates an anomaly detection-specific GNN component with a standard transformer encoder augmented by four complementary positional encodings, which enable the model to capture both local and global structural information. Specifically, the positional encoding enriched node representations are passed through attribute and adjacency decoders, and the reconstruction errors serve as the anomaly score. Extensive experiments on nine benchmark datasets spanning financial, social, and citation network domains demonstrate that FoundAna consistently outperforms state-of-the-art baselines. The code implementation and Supplementary materials are here: https://github.com/FoundAna331/FoundAna.

I. INTRODUCTION

Graph anomaly detection spans different graph objects and domains, but current approaches face task heterogeneity, scarce labels, and limited cross-dataset transfer. FoundAna combines a GNN with a transformer and multi-scale positional encodings to capture local and global structure.

I. INTRODUCTION

  • Graph anomaly detection covers node, edge, and subgraph anomalies, while GNN-based methods face task heterogeneity, scarce labels, and domain variability.Examples include bot accounts, unusual financial transactions, and structurally deviant molecular rings.Source: §I · p. 1

A. Graph Anomaly Detection

  • GAD models commonly follow a one-model-per-dataset approach, so a model trained on fraud detection cannot be reused for social-network anomalies without retraining.This is associated with heavy annotation demands and poor generalization.Source: A. Graph Anomaly Detection · p. 2

B. Graph Foundation Models

  • Existing GAD foundation models use GNN or transformer backbones, but few studies investigate positional encodings specific to anomaly detection.FoundAna addresses this gap with anomaly-relevant structural encodings alongside global context.Source: B. Graph Foundation Models · pp. 2–3, §I · p. 2

I. INTRODUCTION

  • FoundAna combines a GNN for local structure with a transformer and multi-scale positional encodings for global context in cross-domain and cross-task anomaly detection.Its encodings integrate SPE, RWSE, residual distance, and node degree.Source: §I · p. 2, B. Graph Foundation Models · p. 3

III. PRELIMINARIES

The preliminaries define attributed graphs, graph anomaly scoring, and graph foundation models. They also describe graph transformers as globally attending over node tokens, with positional encodings adding structural information.

A. Graph Anomaly Detection

  • An attributed graph consists of nodes, edges, and a node-feature matrix, with its topology represented by an adjacency matrix.The feature matrix has one row per node and one column per input feature.Source: A. Graph Anomaly Detection · p. 3
  • Graph anomaly detection assigns each node an anomaly score, with the definition also allowing scoring edges or whole graphs.The score is produced by a scoring function over the graph object.Source: A. Graph Anomaly Detection · p. 3

B. Graph Foundation Models

  • A graph foundation model is a pretrained encoder that maps an attributed graph into a latent node-embedding space intended to generalize across domains and tasks with minimal adaptation.Its parameters are optimized by pretraining on a corpus of graphs.Source: B. Graph Foundation Models · p. 3
  • A graph transformer attends over all node-token pairs, giving each node a global receptive field, while positional encodings add topology before attention.The transformer operates on node tokens without assuming a canonical ordering.Source: B. Graph Foundation Models · p. 3

C. Problem Formulation

FoundAna targets anomaly detection across graph domains with heterogeneous feature spaces. It aligns features, encodes structural information, combines GNN and transformer representations, and reconstructs node features and adjacency to score anomalies.

C. Problem Formulation

  • A multi-domain graph collection comprises attributed graphs from distinct domains that may differ in feature dimensionality, graph size, and structure.The formulation allows heterogeneous feature spaces across the collection.Source: C. Problem Formulation · p. 3
  • The objective is a unified pretrained encoder and decoder that reconstruct node features and adjacency from latent node embeddings across heterogeneous graphs.The anomaly score combines feature and structural reconstruction errors, weighted by γ1 and γ2.Source: C. Problem Formulation · p. 3
  • The model is unsupervised and designed to generalize to unseen graphs from new domains with minimal adaptation, including zero-shot or few-shot settings.The problem formulation specifies shared encoder parameters across the graph collection.Source: C. Problem Formulation · p. 3

IV. METHODOLOGY: FOUNDANA

  • FoundAna has four stages: SVD-based feature alignment, multi-scale positional encoding, a GNN-assisted transformer, and a dual reconstruction decoder for anomaly scoring.The GNN-assisted transformer fuses local spectral and global attention representations.Source: §IV · p. 3

A. SVD-based Feature Alignment

  • SVD-based feature alignment projects each dataset's node features into a shared latent space for downstream training and tasks.The resulting representation approximately preserves the dominant variance structure of the original features.Source: A. SVD-based Feature Alignment · p. 4

B. Graph Positional Encoding

FoundAna augments node features with four positional encodings to represent graph structure for anomaly detection. They combine global position, local walk structure, feature deviation from neighbors, and node connectivity.

B. Graph Positional Encoding

  • SPE encodes stable, expressive global structural positions using a soft, eigenvalue-dependent partition of Laplacian eigenspaces.Its learnable functions transform eigenvalue-eigenvector information before aggregation.Source: B. Graph Positional Encoding · p. 4
  • RWSE encodes each node’s exact-t-step return probabilities, providing a local, node-label-invariant structural descriptor.It can be defined for any graph without ambiguity.Source: B. Graph Positional Encoding · p. 4
  • The residual encoding measures raw node features against the mean of neighboring features; anomalous nodes generally have larger residuals than normal nodes.The paper measures this residual in raw features rather than GNN-derived embeddings.Source: B. Graph Positional Encoding · p. 5
  • Log-degree, log(1 + deg(vi)), is appended as a scalar because normal and anomalous nodes have different degree distributions.Source: B. Graph Positional Encoding · p. 5

C. GNN-assisted Transformer

FoundAna pairs a Beta-wavelet GNN for local anomaly-relevant structure with a transformer for global graph attention. It concatenates their node-level outputs to form combined representations.

C. GNN-assisted Transformer

  • The Beta-wavelet GNN targets local structure and high-frequency spectral patterns associated with anomalous nodes, rather than relying on traditional low-pass filters.Its filters can concentrate spectral response on intervals of the normalized Laplacian spectrum while remaining localized, and projected features are filtered in parallel and aggregated.Source: C. GNN-assisted Transformer · p. 5
  • A standard transformer encoder processes feature-and-PE node tokens with self-attention and feedforward layers, capturing global long-range dependencies without explicit edge features in the attention kernel.Topological information is supplied through positional encodings.Source: C. GNN-assisted Transformer · p. 5
  • FoundAna concatenates the GNN and transformer outputs at each node to produce a combined node embedding.Source: C. GNN-assisted Transformer · p. 6

D. Reconstruction and Anomaly Score Computation

FoundAna decodes fused node representations into reconstructed node attributes and graph adjacency. Reconstruction errors provide node anomaly scores, while attention-weighted pooling yields a graph-level score.

D. Reconstruction and Anomaly Score Computation

V. EXPERIMENTS

The experiments are organized around baseline performance, transfer to unseen graphs, and the contribution of positional encodings. The supplied section states these research questions but gives no outcomes.

V. EXPERIMENTS

  • RQ1 asks whether FoundAna outperforms baselines across the evaluated datasets.Source: §V · p. 6
  • RQ2 tests generalization to unseen graph data in zero-shot and few-shot scenarios.Source: §V · p. 6
  • RQ3 tests whether concatenating positional encodings with raw features improves GAD performance over raw features alone.Source: §V · p. 6

A. Datasets

The nine benchmark datasets span social, financial and e-commerce, and academic citation networks, with anomaly definitions tailored to each domain.

A. Datasets

  • Social benchmarks cover malicious users, bots, outlier engagement, and ego-network connections across Question, Weibo, Facebook, and Reddit.Question is a bipartite user–question graph; Reddit anomalies are outlier engagement patterns.Source: A. Datasets · p. 6
  • Financial and e-commerce benchmarks include fraudulent reviews, loan applications, and illicit transactions across YelpChi, Amazon, T-Finance, DGraph, and Elliptic.DGraph contains millions of user nodes; Elliptic labels illicit transactions through association with known criminal entities.Source: A. Datasets · p. 6
  • Ogbn-arxiv is a directed Computer Science citation graph, where anomalies are structural outliers or misclassified papers in the citation hierarchy.Source: A. Datasets · p. 6

1) Node and Edge Duality Assumption:

The evaluation treats node and edge anomaly detection within a shared representation framework and compares FoundAna with GNN- and GFM-based baselines using complementary metrics.

1) Node and Edge Duality Assumption:

  • Line-graph transformation maps each original edge to a node, making edge-anomaly detection equivalent to node-anomaly detection in the transformed graph.Nodes in the line graph connect when their corresponding original edges share an endpoint.Source: 1) Node and Edge Duality Assumption · pp. 6–7
  • Table I identifies T-Finance as the primary training dataset and the remaining datasets as testing data.Source: Table I · p. 7

B. Baselines and Metrics

  • FoundAna is evaluated against two categories of state-of-the-art methods: five GNN-based GAD baselines—GCN [38], BWGNN, DOMINANT, AnomalyDAE, and CoLA —and three GFM-based GAD baselines.The GFM baselines are ARC, AnomalyGFM, and UNPrompt [25].Source: B. Baselines and Metrics · p. 7
  • AUROC, AUPRC, and Macro F1 assess ranking, minority-class performance, and per-class balance, respectively; paired differences are tested with Wilcoxon at p < 0.05.The Wilcoxon signed-rank test is non-parametric and does not assume normally distributed data.Source: B. Baselines and Metrics · p. 7

C. Implementation Details

FoundAna is trained on T-Finance and evaluated across nine datasets in zero-shot and few-shot settings; few-shot averages lead across all three metrics, while positional encodings contribute unevenly.

C. Implementation Details

  • Training uses T-Finance, with frozen weights for zero-shot inference and fine-tuning for few-shot inference; the few-shot procedure uses 20 samples for 30 epochs.Feature alignment maps node attributes to dimension 32; the loss weights feature and adjacency reconstruction equally (γ1 = γ2 = 0.5).Source: C. Implementation Details · p. 7

D. Results of FoundAna

  • Zero-shot FoundAna averages AUROC 0.525, AUPRC 0.176, and Macro F1 0.511, often surpassing fully supervised GNN baselines without labeled test data.Significance holds against all GNN baselines except BWGNN for AUPRC (p = 0.300); among GFMs, only ARC Macro F1 is significant.Source: D. Results of FoundAna · pp. 7–8
  • Few-shot FoundAna averages AUROC 0.647, AUPRC 0.227, and Macro F1 0.568 across nine datasets, exceeding the best GNN-baseline values reported for each metric.The compared GNN values are DOMINANT AUROC 0.569 and Macro F1 0.494, and BWGNN AUPRC 0.150.Source: D. Results of FoundAna · p. 7, Table II · p. 8

1) Effect of PEs:

  • On YelpChi, all positional encodings together achieve AUROC 0.804, AUPRC 0.165, and Macro F1 0.581; removing RD or ND causes the sharpest AUROC drops.AUROC falls to 0.612 without RD and 0.660 without ND; removing RWSE produces the smallest drop.Source: 1) Effect of PEs · p. 8

2) Effect of GNN Backbone Selection:

On Ogbn-arxiv, BWGNN leads the tested backbones on AUROC and Macro F1, while PE-augmented features show dataset-dependent gains. The conclusion reports better average results across nine GAD benchmarks and leaves knowledge-graph applicability open.

2) Effect of GNN Backbone Selection:

  • BWGNN achieves the best AUROC (0.546) and Macro F1 (0.496), while removing the GNN backbone yields the best AUPRC (0.039) on Ogbn-arxiv.GCN and GIN perform comparably but fall short of BWGNN; the reported comparison is for Ogbn-arxiv.Source: 2) Effect of GNN Backbone Selection · p. 9, Table IV · p. 9

3) Effect of PE-Augmented Input Features on GAD:

  • AUROC gains from concatenating PE with raw features are 0.103 on YelpChi and 0.085 on Ogbn-arxiv, whereas raw features slightly outperform the combination on Weibo.The authors report that PE-augmented features generally improve anomaly detection, but the magnitude depends on the dataset.Source: 3) Effect of PE-Augmented Input… · p. 9, Table V · p. 9

VI. CONCLUSION

  • FoundAna achieves better average results across nine GAD benchmarks, while its applicability to knowledge graphs remains an open challenge.The conclusion also reports ablations on PE combinations and GNN backbone selection, finding PE important for capturing anomalous patterns across heterogeneous graph domains.Source: §VI · pp. 9–10
Loading 2609.18107v1…