Guarding Graph Neural Networks for Unsupervised Graph Anomaly Detection

TL;DR

This work tackles unsupervised graph anomaly detection by addressing how unknown anomalies can degrade GNN representations. It introduces G3AD, a guarded framework with two auxiliary encoders enforced by correlation constraints and an adaptive caching module to prevent learning from anomalous graph reconstructions. The approach jointly optimizes local attribute/topology reconstruction and global consistency alignment, achieving state-of-the-art performance across six datasets and demonstrating strong generalization across GNN backbones. The results show that explicit guarding of representation learning and reconstruction objectives yields more discriminative node representations and robust anomaly scoring with practical impact for real-world graph data analyses.

Abstract

Unsupervised graph anomaly detection aims at identifying rare patterns that deviate from the majority in a graph without the aid of labels, which is important for a variety of real-world applications. Recent advances have utilized Graph Neural Networks (GNNs) to learn effective node representations by aggregating information from neighborhoods. This is motivated by the hypothesis that nodes in the graph tend to exhibit consistent behaviors with their neighborhoods. However, such consistency can be disrupted by graph anomalies in multiple ways. Most existing methods directly employ GNNs to learn representations, disregarding the negative impact of graph anomalies on GNNs, resulting in sub-optimal node representations and anomaly detection performance. While a few recent approaches have redesigned GNNs for graph anomaly detection under semi-supervised label guidance, how to address the adverse effects of graph anomalies on GNNs in unsupervised scenarios and learn effective representations for anomaly detection are still under-explored. To bridge this gap, in this paper, we propose a simple yet effective framework for Guarding Graph Neural Networks for Unsupervised Graph Anomaly Detection (G3AD). Specifically, G3AD first introduces two auxiliary networks along with correlation constraints to guard the GNNs against inconsistent information encoding. Furthermore, G3AD introduces an adaptive caching module to guard the GNNs from directly reconstructing the observed graph data that contains anomalies. Extensive experiments demonstrate that our G3AD can outperform twenty state-of-the-art methods on both synthetic and real-world graph anomaly datasets, with flexible generalization ability in different GNN backbones.

Figures (10)

• Figure 1: Toy examples of GNN message passing on clear graphs and the graphs under three types of anomaly impacts.
• Figure 2: Concept maps between (a) existing GNN-based unsupervised graph anomaly detection paradigm and (b) our proposed GNN-guarded unsupervised graph anomaly detection paradigm.
• Figure 3: The overall architecture of G3AD guarding framework contains two major novel parts: (i) Guarding GNNs against encoding inconsistent information with two auxiliary encoders with correlation constraints; (ii) Guarding GNNs against reconstructing abnormal graphs with adaptive information caching. Under the two guards, we comprehensively consider both local reconstruction and global alignment to detect different types of anomalies.
• Figure 4: Architecture ablation study results on G3AD.
• Figure 5: Generalization study results of G3AD in different GNN backbones.

Theorems & Definitions (3)

• Definition 1
• Definition 2
• Definition 3