Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

From Few-Shot to Zero-Shot: Towards Generalist Graph Anomaly Detection

Yixin Liu, Shiyuan Li, Yu Zheng, Qingfeng Chen, Chengqi Zhang, Philip S. Yu, Shirui Pan

Abstract

Graph anomaly detection (GAD) is critical for identifying abnormal nodes in graph-structured data from diverse domains, including cybersecurity and social networks. The existing GAD methods often focus on the learning paradigms of "one-model-for-one-dataset", requiring dataset-specific training for each dataset to achieve optimal performance. However, this paradigm suffers from significant limitations, such as high computational and data costs, limited generalization and transferability to new datasets, and challenges in privacy-sensitive scenarios where access to full datasets or sufficient labels is restricted. To address these limitations, we propose a novel generalist GAD paradigm that aims to develop a unified model capable of detecting anomalies on multiple unseen datasets without extensive retraining/fine-tuning or dataset-specific customization. To this end, we propose ARC, a few-shot generalist GAD method that leverages in-context learning and requires only a few labeled normal samples at inference time. Specifically, ARC consists of three core modules: a feature Alignment module to unify and align features across datasets, a Residual GNN encoder to capture dataset-agnostic anomaly representations, and a cross-attentive in-Context learning module to score anomalies using few-shot normal context. Building on ARC, we further introduce ARC_zero for the zero-shot generalist GAD setting, which selects representative pseudo-normal nodes via a pseudo-context mechanism and thus enables fully label-free inference on unseen datasets. Extensive experiments on 17 real-world graph datasets demonstrate that both ARC and ARC_zero effectively detect anomalies, exhibit strong generalization ability, and perform efficiently under few-shot and zero-shot settings.

From Few-Shot to Zero-Shot: Towards Generalist Graph Anomaly Detection

Abstract

Graph anomaly detection (GAD) is critical for identifying abnormal nodes in graph-structured data from diverse domains, including cybersecurity and social networks. The existing GAD methods often focus on the learning paradigms of "one-model-for-one-dataset", requiring dataset-specific training for each dataset to achieve optimal performance. However, this paradigm suffers from significant limitations, such as high computational and data costs, limited generalization and transferability to new datasets, and challenges in privacy-sensitive scenarios where access to full datasets or sufficient labels is restricted. To address these limitations, we propose a novel generalist GAD paradigm that aims to develop a unified model capable of detecting anomalies on multiple unseen datasets without extensive retraining/fine-tuning or dataset-specific customization. To this end, we propose ARC, a few-shot generalist GAD method that leverages in-context learning and requires only a few labeled normal samples at inference time. Specifically, ARC consists of three core modules: a feature Alignment module to unify and align features across datasets, a Residual GNN encoder to capture dataset-agnostic anomaly representations, and a cross-attentive in-Context learning module to score anomalies using few-shot normal context. Building on ARC, we further introduce ARC_zero for the zero-shot generalist GAD setting, which selects representative pseudo-normal nodes via a pseudo-context mechanism and thus enables fully label-free inference on unseen datasets. Extensive experiments on 17 real-world graph datasets demonstrate that both ARC and ARC_zero effectively detect anomalies, exhibit strong generalization ability, and perform efficiently under few-shot and zero-shot settings.
Paper Structure (43 sections, 11 equations, 12 figures, 5 tables, 1 algorithm)

This paper contains 43 sections, 11 equations, 12 figures, 5 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Works
  3. Anomaly Detection
  4. Graph Anomaly Detection
  5. In-Context Learning
  6. Background and Problem Statement
  7. Notations
  8. Problem definition
  9. ARC: A Few-Shot Generalist GAD Approach
  10. Smoothness-Based Feature Alignment
  11. Linear Feature Projection
  12. Smoothness-based Feature Sorting
  13. Ego-Neighbor Residual Graph Encoder
  14. Cross-Attentive In-Context Anomaly Scoring
  15. ARCzero: Towards Zero-Shot Generalist GAD
  16. ...and 28 more sections

Figures (12)

  • Figure 1: The sketch maps of the existing data-specific GAD paradigms ((a) supervised and (b) unsupervised) and our generalist GAD paradigms ((c) few-shot and (d) zero-shot).
  • Figure 2: The overall pipeline of the proposed methods ARC, illustrating by (a)➜(b)➜(c), and ARCzero, illustrating by (a)➜(b)➜(d).
  • Figure 3: AUROC on data with 5 groups of feature subsets.
  • Figure 4: Toy examples of reconstruction-based scoring mechanism. In each case, nodes 1, 2, 3, and 4 are normal samples, while node 5 is an anomaly.
  • Figure 5: Performance with varying $n_k$ in few-shot method ARC. The shaded areas represent the standard deviation over 5 repeated runs.
  • ...and 7 more figures

Theorems & Definitions (2)

  • Definition 1: Dataset-Specific GAD Problem
  • Definition 2: Generalist GAD Problem