GFM4GA: Graph Foundation Model for Group Anomaly Detection

TL;DR

GFM4GA addresses the challenge of group anomaly detection in graphs by introducing a graph foundation model specifically designed for group-level patterns. It combines feature-based anomaly estimation to extract candidate groups, a light-weight GFM to learn feature-deviation patterns, and dual-level contrastive pretraining to capture group-specific structures, followed by a group-aware, few-shot finetuning stage that uses contextual neighbor information to refine anomaly probabilities. The approach yields consistent improvements over strong baselines in AUROC and AUPRC across real and synthetic datasets, particularly in severe few-shot settings, and highlights the importance of subgraph-level pretraining and group-contextualization for reliable group anomaly detection. These findings support the practical potential of specialized GFMs for group anomalies and point to future integration with large language models when textual context is available.

Abstract

Group anomaly detection is crucial in many network applications, but faces challenges due to diverse anomaly patterns. Motivated by the success of large language models (LLMs) in natural language processing, graph foundation models (GFMs) is proposed to handle few-shot learning task with fewer labeling efforts. GFMs have been successfully applied to detection of individual anomalies but cannot be generalized to group anomalies, as group anomaly patterns must be detected as a whole and individuals in an abnormal group can look rather normal. Therefore, we propose GFM4GA, a novel graph foundation model for group anomaly detection. The pipeline is pretrained via dual-level contrastive learning based on feature-based estimation and group extraction, to capture potential group anomaly structure and feature inconsistencies. In the downstream tasks, the pipeline is finetuned in parameter-constrained and group-anomaly-proportion weighted few-shot settings, and its adaptive ability to unseen group anomalies expanded via group contexts determined by labeled anomaly neighbors. Experiments show that GFM4GA surpasses group anomaly detectors and GFMs for individual anomalies, achieving average improvements of 2.85% in AUROC and 2.55% in AUPRC.

Figures (6)

• Figure 1: Challenges and difference between individual and group anomaly detections.
• Figure 2: Individual anomalies in (a) and (b) on the left can be transferable, and group anomalies in (c) and (d) on the right can be transferable as well. However, GFM for individual anomaly cannot or hardly transfer to group anomalies via few-shot adaptation or finetuning.
• Figure 3: The framework of GFM4GA for group anomaly detection.
• Figure 4: AUROC performance of k-shot on Weixin dataset, and shaded areas around lines denote standard deviations.
• Figure 5: AUROC results of ablation studies across datasets.