Is Real-World Training Data Necessary for Generalist Graph Anomaly Detection?

• Real-world GAD training data are difficult to collect because anomalies are rare and graph collection is costly or constrained by privacy and access.Existing generalist models are trained on only 1–7 datasets from limited domains, averaging 90k nodes.Source: §1 · p. 1
• AG-FORGE-trained existing generalist GAD methods achieve performance comparable to, or slightly better than, methods trained on real-world data.This demonstrates the viability of fully synthetic training for generalist GAD.Source: §1 · p. 2
• Scaling synthetic training to about 1M nodes yields no significant gains for existing methods, exposing model capacity as a new bottleneck.Limited model complexity and uniform training on synthetic graphs with varying difficulty may constrain performance.Source: §1 · p. 2
• TS-GGAD trained solely on AG-FORGE data achieves the best performance on all 14 datasets, with a 5.39% average AUROC improvement over the best baseline.The approach combines a stronger model architecture with large-scale synthetic data and curriculum learning.Source: §1 · p. 2

• Dataset-specific GAD learns on a particular graph and must retrain for each new graph, increasing deployment costs and limiting generalization.Training may use unsupervised reconstruction or contrastive learning, or supervised classification with labeled nodes.Source: §2 · p. 3
• Generalist GAD learns transferable anomaly patterns from source graphs and applies them to unseen target graphs without graph-specific retraining or fine-tuning.The source and target graph collections are disjoint.Source: §2 · p. 3
• Existing generalist GAD training draws on limited real-world data, with about 90k nodes, potentially constraining scaling and generalization.Examples include ARC, UNPrompt, and ReFi-GAD, which use in-context learning, prompts, and unified embeddings, respectively.Source: §2 · p. 3
• Synthetic-data foundation-model research spans tabular, time-series, and relational data, motivating the paper's exploration of synthesis for generalist GAD.TabPFN is described as pretraining on million-level synthetic tabular tasks.Source: §2 · p. 3

3.1 AG-FORGE FOR ANOMALOUS GRAPH SYNTHESIS

• AG-FORGE generates graphs through cascaded structure generation, node-feature generation, and anomaly injection, with varied generation factors producing diverse graphs.Its components flexibly combine to yield a virtually unlimited variety of anomalous graphs.Source: §3.1 · pp. 3–5
• The synthesis stages vary base topology, feature patterns, and injected anomalies to cover diverse graph environments and abnormal behaviors.Structure generation includes community, scale-free, projected bipartite, and small-world graphs; features include dense, sparse, and binary types, while anomaly injection includes several patterns and controllable difficulty.Source: §3.1 · pp. 4–5

3.2 TOPOLOGY-SEMANTIC COORDINATED GENERALIST GAD MODEL

• TS-GGAD addresses the model-capacity bottleneck with topological and semantic encoding streams and adaptive coordination of their anomaly evidence.The topological stream uses target-aware representations, while a sample-level gate balances the two branches; their relative importance can vary by node.Source: §3.2 · pp. 5–6

3.3 CURRICULUM LEARNING FROM SYNTHETIC DATA

• The curriculum starts with graphs whose anomalies are easier to distinguish, then progressively introduces harder graphs as training advances.The predefined difficulty factor organizes the staged progression.Source: §3.3 · p. 7
• Loss-aware sampling gives greater sampling probability to graphs with higher EMA anomaly losses, while focal loss emphasizes poorly detected nodes.The overall curriculum coordinates staged graph difficulty, graph-level sampling, and node-level optimization.Source: §3.3 · p. 7

4.1 EXPERIMENTAL SETUP

• Evaluation covers 14 datasets across citation, social, e-commerce, and behavioral networks, using AUROC and AUPRC averaged over five runs.TS-GGAD is trained exclusively on AG-FORGE-generated graphs; generalist baselines are trained on real-world source graphs or AG-FORGE data, with consistent hyperparameters during testing.Source: §4.1 · pp. 7–8

4.2 EXPERIMENTAL RESULTS

• AG-FORGE + TS-GGAD achieves the best performance on all 14 datasets and the highest average AUROC, surpassing ReFi-GAD by 5.39%.Existing generalist GAD methods trained on AG-FORGE data achieve performance comparable to training on real-world data.Source: Table 1 · p. 8, §4.2 · p. 8
• Removing an AG-FORGE structure, feature, or anomaly generation strategy reduces average performance by 2.33%, 1.80%, or 1.07%, respectively.All variants degrade performance, indicating that the strategies provide complementary diversity for synthetic training.Source: Figure 3 · p. 9, §4.2 · p. 9
• Removing TS-GGAD’s topological stream causes the largest performance drop, 20.48%, compared with 4.58% for the semantic stream and 5.43% for curriculum learning.All tested variants degrade performance.Source: Figure 4 · p. 9, §4.2 · p. 9
• TS-GGAD performance improves as training data increase from 5k to 1M nodes and model parameters increase from 10^4 to 1.5×10^6; AUROC exceeds 86% in the large-data, large-model region.Models with more than one million parameters require larger training sets, such as 500k nodes, to fully exploit their capacity.Source: Figure 5 · p. 9, §4.2 · p. 9
• Performance improves with larger support size K, but gains become smaller above K = 30, indicating that a moderate support set is sufficient at inference.The sensitivity experiment varies K from 10 to 60.Source: Figure 6 · p. 9, §4.2 · p. 9
• Synthetic samples form a broader, more continuous embedding distribution than real-world samples, overlapping real data while covering sparsely represented regions.The visualization samples nodes from real and generated graphs, aligns embeddings with PCA, and displays them using t-SNE.Source: Figure 7 · p. 9, §4.2 · p. 9

5 CONCLUSION

• TS-GGAD trained on AG-FORGE data achieves strong detection, cross-domain generalization, and scaling capability on 14 real-world datasets; the paper identifies synthetic-data quality evaluation as its main limitation.The authors point to developing effective criteria for data evaluation and selection as a future direction.Source: §5 · p. 10

A.1 GRAPH ANOMALY DETECTION

• Conventional GAD methods require training on each target graph, and this dataset-specific paradigm limits practical scalability through deployment and maintenance costs.Traditional approaches commonly use GNN encoders with reconstruction or classification objectives.Source: §A.1 · p. 13

A.2 GENERALIST GRAPH ANOMALY DETECTION

• Generalist GAD seeks a unified detector for unseen graphs without graph-specific retraining or fine-tuning, but existing methods remain constrained by limited training data.Prior approaches include in-context learning, neighborhood prompts, graph-agnostic prototypes, invariant representations, and relational fingerprints.Source: §A.2 · p. 13

A.3 SYNTHETIC DATA FOR FOUNDATION MODELS

• Synthetic training has been used for foundation models across tabular, time-series, and relational data, with designed synthetic data providing scalable supervision across modalities.Examples include TabPFN, TabICL, TimePFN, and RDB-PFN.Source: §A.3 · p. 13
• For graph data, synthetic training remains early, and synthetic anomalous graph generation for generalist GAD is largely unexplored.GraphPFN explores fully synthetic graph pretraining, but its generated topology and feature patterns remain relatively limited.Source: §A.3 · p. 13

B DETAILS OF AG-FORGE

• AG-FORGE decouples synthesis into graph structure generation, node feature generation, and anomaly injection, rather than approximating any particular real-world graph distribution.Structure, feature, and anomaly types are denoted τ, ϕ, and α; δ controls anomaly difficulty.Source: B DETAILS OF AG-FORGE · p. 14
• Four topology mechanisms and three node-attribute types vary graph environments before anomaly injection.Structure types include community-structured, scale-free, projected bipartite, and small-world graphs; feature types are dense continuous, sparse high-dimensional, and binary.Source: B DETAILS OF AG-FORGE · pp. 14–15
• Anomaly injection covers distinct patterns, including dense local groups, link concentration, attribute suppression, community dispersion, and mixtures.Increasing difficulty makes some patterns less conspicuous by weakening feature discrepancies or adding perturbations and cross-community rewiring.Source: B DETAILS OF AG-FORGE · pp. 15–16
• Flexible combinations of structures, features, and anomaly patterns yield a virtually unlimited variety of anomalous graphs for generalist GAD training.The paper frames this synthesis space as spanning diverse graph scenarios.Source: B DETAILS OF AG-FORGE · p. 16

C DETAILS OF TOPOLOGICAL PATTERN ENCODING

• The topological descriptor summarizes five anomaly-aware statistics spanning global consistency, neighborhood consistency, and structural connectivity, then rank-normalizes each statistic across nodes.The listed statistics include global and neighborhood similarity, neighborhood Euclidean distance, degree, and local clustering coefficient.Source: C DETAILS OF TOPOLOGICAL PATTERN… · pp. 16–17

D COMPLEXITY ANALYSIS

• 1.96 seconds is TS-GGAD's average inference time across 14 real-world datasets, comparable to ReFi-GAD and substantially faster than IA-GGAD and UNPrompt.The analysis estimates inference complexity as O(nd′2 + nkd′), where k is support-set size.Source: D COMPLEXITY ANALYSIS · p. 17, Table 2 · p. 17

E.1 DATASETS

• The 14 evaluation datasets span citation, social, e-commerce, and behavioral or interaction networks, with variation in scale, feature dimensionality, connectivity, and anomaly ratios.Dataset statistics are reported in Table 3.Source: §E.1 · p. 18, Table 3 · p. 19

E.2 BASELINES

• The baseline set includes supervised, unsupervised, and generalist GAD methods, including ARC, UNPrompt, IA-GGAD, and ReFi-GAD.The listed methods use varied approaches, including contrastive learning, spectral filters, invariant representations, and relational fingerprints.Source: §E.2 · pp. 18–20

E.3 EXPERIMENTAL DETAILS

• Experiments report mean and standard deviation over five runs using AUROC and AUPRC, which measure ranking quality and the precision-recall trade-off, respectively.Source: §E.3 · p. 20
• TS-GGAD trains exclusively on AG-FORGE-generated graphs and is evaluated directly on real-world targets; baseline training uses swapped domain-balanced dataset groups.Hyperparameters remain consistent across target datasets without test-time updates or dataset-specific tuning.Source: §E.3 · p. 20

F.1 COMPARISON EXPERIMENTS

• AG-FORGE + TS-GGAD achieves the best AUROC on all 14 real-world datasets, while AG-FORGE-trained methods broadly match their real-world-trained counterparts.The authors attribute the advantage to transferable synthetic anomaly knowledge and TS-GGAD's architecture and curriculum learning.Source: §F.1 · p. 20
• TS-GGAD achieves the best AUPRC on 10 of 14 datasets and ranks in the top three on 11, with wins across four graph domains.AG-FORGE-trained models remain competitive with their real-world-trained counterparts.Source: §F.1 · p. 20

F.2 ABLATION STUDY OF AG-FORGE.

• Removing CS, SF, PB, and SW lowers average AUROC by 3.54%, 2.34%, 2.03%, and 1.39%, respectively; CS removal has the largest structural-strategy impact.Structure ablation causes the largest average performance drop among the three generation stages.Source: §F.2 · pp. 20–21
• Removing Dense, Sparse, and Binary features lowers average performance by 1.04%, 2.05%, and 2.32%, respectively, indicating complementary semantic environments.Source: §F.2 · p. 21
• Removing LD, LC, AS, and CD lowers average AUROC by 0.95%, 1.07%, 0.96%, and 1.28%, respectively; all four anomaly mechanisms contribute.The authors link diverse structural and attribute patterns and detection difficulties to more transferable anomaly knowledge.Source: §F.2 · p. 21

F.3 ABLATION STUDY OF TS-GGAD.

• Removing the topological stream reduces average AUROC from 86.61% to 66.13%, a 20.48% drop.The authors associate this decrease with the stream's role in capturing structural evidence of anomalous behaviors.Source: §F.3 · pp. 21–22
• Removing the semantic stream decreases average AUROC by 4.58%, with particularly large drops on Amazon and Photo.Semantic encoding provides complementary anomaly evidence where topological patterns alone are insufficient.Source: §F.3 · p. 22
• Removing curriculum learning causes an average AUROC drop of 5.43%, with degradation on all 14 datasets.Progressive learning moves from stable anomaly decision boundaries to increasingly difficult anomaly patterns.Source: §F.3 · p. 22
• Replacing target-aware gating with average fusion decreases average AUROC by 0.97%.The gating mechanism coordinates topological and semantic evidence according to node-specific topological patterns.Source: §F.3 · p. 22

F.4 ADDITIONAL PARAMETER SENSITIVITY ANALYSIS

• 86.61% AUROC is reached at γ = 2; performance first rises and then declines as γ increases from 0 to 5.The authors suggest small γ underemphasizes difficult samples, while large γ may overemphasize them and overfit.Source: §F.4 · pp. 22–23, Figure 8 · p. 23

F.5 ADDITIONAL VISUALIZATIONS

• Landmark scattering produces greater overlap among datasets than PCA while preserving local structures, reducing cross-domain feature discrepancies.The comparison uses representations centered and orientation-aligned for visualization.Source: §F.5 · p. 23, Figure 9 · p. 24
• On sampled Amazon nodes, TS-GGAD's gate flexibly coordinates topology and semantic streams; a real-world-only model favors topology more often.The authors propose that diverse synthetic supervision may support more effective stream coordination.Source: §F.5 · pp. 23–24, Figure 10 · p. 24

F.6 EXAMPLES OF GENERATED SYNTHETIC GRAPHS

• The first 20 example graphs are a subset of the 108 synthetic training graphs and vary in topology, features, anomaly mechanisms, difficulty, size, dimensionality, and anomaly ratio.Source: §F.6 · p. 24, Table 8 · p. 25