FANFOLD: Graph Normalizing Flows-driven Asymmetric Network for Unsupervised Graph-Level Anomaly Detection

TL;DR

FANFOLD tackles unsupervised graph-level anomaly detection by addressing the limitations of symmetric teacher–student architectures and feature-centric approaches. It introduces an asymmetric framework that applies normalizing flows to the source network, transforming the distribution of normal-graph embeddings toward a standard normal to enable density-aware anomaly discrimination. The method comprises four stages: data processing, source encoder pre-training with reconstruction losses, density transformation via normalizing flows, and a GIN-based target network trained to imitate the source, enabling anomaly scoring from source–target discrepancies. Experiments on 15 datasets across diverse domains show FANFOLD achieving state-of-the-art or competitive AUC performance, underscoring the value of distribution-centric, asymmetric architectures for robust graph-level anomaly detection.

Abstract

Unsupervised graph-level anomaly detection (UGAD) has attracted increasing interest due to its widespread application. In recent studies, knowledge distillation-based methods have been widely used in unsupervised anomaly detection to improve model efficiency and generalization. However, the inherent symmetry between the source (teacher) and target (student) networks typically results in consistent outputs across both architectures, making it difficult to distinguish abnormal graphs from normal graphs. Also, existing methods mainly rely on graph features to distinguish anomalies, which may be unstable with complex and diverse data and fail to capture the essence that differentiates normal graphs from abnormal ones. In this work, we propose a Graph Normalizing Flows-driven Asymmetric Network For Unsupervised Graph-Level Anomaly Detection (FANFOLD in short). We introduce normalizing flows to unsupervised graph-level anomaly detection due to their successful application and superior quality in learning the underlying distribution of samples. Specifically, we adopt the knowledge distillation technique and apply normalizing flows on the source network, achieving the asymmetric network. In the training stage, FANFOLD transforms the original distribution of normal graphs to a standard normal distribution. During inference, FANFOLD computes the anomaly score using the source-target loss to discriminate between normal and anomalous graphs. We conduct extensive experiments on 15 datasets of different fields with 9 baseline methods to validate the superiority of FANFOLD.

Figures (8)

• Figure 1: Toy examples of (a) the challenge caused by symmetric architecture and (b) the mapping of normalizing flows for both normal graphs and anomalous graphs.
• Figure 2: The overall framework of FANFOLD.
• Figure 3: AUC results of different network architectures.
• Figure 4: AUC w.r.t. MPs.
• Figure 5: Hyper-parameter Analysis: $\alpha$ and $\beta$.