ARC: A Generalist Graph Anomaly Detector with In-Context Learning

TL;DR

This work tackles the problem of generalizing graph anomaly detection (GAD) across diverse graphs without target-domain retraining. It introduces ARC, a generalist GAD framework that leverages in-context learning with few-shot normal samples at inference, comprising (i) smoothness-based feature alignment to unify heterogeneous features in a common space, (ii) an ego-neighbor residual graph encoder to capture high-order affinity for anomaly-relevant embeddings, and (iii) a cross-attentive in-context anomaly scoring mechanism that reconstructs query embeddings from context with anomaly measured by the drift. Trained on multiple graph datasets and evaluated on unseen domains, ARC achieves state-of-the-art or competitive AUROC/AUPRC without dataset-specific fine-tuning, and ablations confirm the necessity of each component. The approach offers a practical path toward domain-agnostic GAD with improved efficiency and reduced data requirements, though it currently relies on normal context samples at test time. Future work could extend ARC to exploit abnormal context or mixed-context scenarios for even richer anomaly patterns.

Abstract

Graph anomaly detection (GAD), which aims to identify abnormal nodes that differ from the majority within a graph, has garnered significant attention. However, current GAD methods necessitate training specific to each dataset, resulting in high training costs, substantial data requirements, and limited generalizability when being applied to new datasets and domains. To address these limitations, this paper proposes ARC, a generalist GAD approach that enables a ``one-for-all'' GAD model to detect anomalies across various graph datasets on-the-fly. Equipped with in-context learning, ARC can directly extract dataset-specific patterns from the target dataset using few-shot normal samples at the inference stage, without the need for retraining or fine-tuning on the target dataset. ARC comprises three components that are well-crafted for capturing universal graph anomaly patterns: 1) smoothness-based feature Alignment module that unifies the features of different datasets into a common and anomaly-sensitive space; 2) ego-neighbor Residual graph encoder that learns abnormality-related node embeddings; and 3) cross-attentive in-Context anomaly scoring module that predicts node abnormality by leveraging few-shot normal samples. Extensive experiments on multiple benchmark datasets from various domains demonstrate the superior anomaly detection performance, efficiency, and generalizability of ARC.

Figures (10)

• Figure 1: Sketch maps of (a) supervised, (b) unsupervised, and (c) generalist GAD paradigms.
• Figure 2: The overall pipeline of ARC, the proposed generalist GAD approach.
• Figure 3: AUROC on data with 5 groups of features.
• Figure 4: Toy examples of query embeddings ($\bullet$), reconstructed query embeddings ($\bullet$), and context embeddings ($\blacksquare$).
• Figure 5: Performance with varying $n_k$.