From Unsupervised to Few-shot Graph Anomaly Detection: A Multi-scale Contrastive Learning Approach

TL;DR

This work tackles graph anomaly detection by introducing ANEMONE, a multi-scale contrastive learning framework that leverages both patch-level and context-level views to identify anomalous nodes. An anonymized subgraph generation strategy and two parallel contrastive networks learn node representations that reflect local and global irregularities; a statistical anomaly scorer aggregates signals across multiple evaluation rounds. The approach is extended to few-shot settings as ANEMONE-FS, which incorporates limited labeled anomalies to further guide learning. Experiments on six benchmark datasets show state-of-the-art performance in both unsupervised and few-shot scenarios, highlighting the method's robustness and practical utility for real-world graphs. The results underscore the value of integrating multi-scale information and few-shot supervision for effective graph anomaly detection.

Abstract

Anomaly detection from graph data is an important data mining task in many applications such as social networks, finance, and e-commerce. Existing efforts in graph anomaly detection typically only consider the information in a single scale (view), thus inevitably limiting their capability in capturing anomalous patterns in complex graph data. To address this limitation, we propose a novel framework, graph ANomaly dEtection framework with Multi-scale cONtrastive lEarning (ANEMONE in short). By using a graph neural network as a backbone to encode the information from multiple graph scales (views), we learn better representation for nodes in a graph. In maximizing the agreements between instances at both the patch and context levels concurrently, we estimate the anomaly score of each node with a statistical anomaly estimator according to the degree of agreement from multiple perspectives. To further exploit a handful of ground-truth anomalies (few-shot anomalies) that may be collected in real-life applications, we further propose an extended algorithm, ANEMONE-FS, to integrate valuable information in our method. We conduct extensive experiments under purely unsupervised settings and few-shot anomaly detection settings, and we demonstrate that the proposed method ANEMONE and its variant ANEMONE-FS consistently outperform state-of-the-art algorithms on six benchmark datasets.

Figures (5)

• Figure 1: The conceptual framework of ANEMONE. Given an attributed graph $\mathcal{G}$, we first sample a batch of target nodes, where their associated anonymized subgraphs are generated and fed into two contrastive networks. Then, we design a multi-scale (i.e., patch-level and context-level) contrastive network to learn agreements between node and contextual embeddings from different perspectives. During the model inference, two contrastive scores are statistically annealed to obtain the final anomaly score of each node in $\mathcal{G}$.
• Figure 2: The conceptual framework of ANEMONE-FS, which shares the similar pipeline of ANEMONE. Given an attributed graph $\mathcal{G}$, we first sample a batch of target nodes. After this, we design a different multi-scale contrastive network equipped with two contrastive routes, where the agreements between node and contextual embeddings are maximized for unlabeled node while minimized for labeled anomalies in a mini-batch. At the inference stage, it has the same graph anomaly detector to estimate the anomlay socre of each node in $\mathcal{G}$.
• Figure 3: The comparison of ROC curves on four datasets in unsupervised learning scenario.
• Figure 4: Anomaly detection performance with different selection of trade-off parameter $\alpha$ in unsupervised and few-shot learning scenarios.
• Figure 5: Parameter sensitivities of ANEMONE w.r.t. three hyper-parameters on six benchmark datasets.

Theorems & Definitions (4)

• Definition 3.1: Attributed Graphs
• Definition 3.2: Graph Neural Networks
• Definition 3.3: Unsupervised Graph Anomaly Detection
• Definition 3.4: Few-shot Graph Anomaly Detection