Anomaly Detection via Contrastive Learning on Graph using Embedding

Retrieval-Augmented Contrastive Learning for Dynamic Graph Anomaly Detection

Detecting anomalous nodes in continuously evolving graphs without labeled supervision requires representations that capture both local temporal context and globally consistent normal behavior—a combination that current methods do not jointly address. Existing dynamic anomaly detectors rely on localized temporal neighborhoods and cannot leverage globally similar normal patterns elsewhere in the graph, while existing retrieval-augmented graph methods either require labels or do not enforce strict temporal causality during retrieval. We propose DGRA-CL (Dynamic Graph Retrieval-Augmented Contrastive Learning), an unsupervised framework that learns discriminative temporal node representations for anomaly detection without labeled data. DGRA-CL transforms dynamic graphs into temporal sequences, employs time- and context-aware contrastive learning to learn normal node behavior patterns, retrieves similar normal exemplars from a training pool under a strict causality constraint, and fuses them via similarity-weighted aggregation to construct baseline representations. Anomalies are detected via deviation-based scoring measuring distance from these normal baselines. On four real-world dynamic graphs, DGRA-CL achieves statistically significant AUC gains of 1–2 points over the strongest baselines on three of four benchmarks (UCI Messages, Bitcoin-Alpha, Digg) and competitive performance on Reddit, while operating without anomaly labels and generalizing to unseen nodes.

Unsupervised Anomaly Detection in Dynamic Graphs via Compatibility Modeling and Boundary Learning

TGPA: Transferable graph prompt attack with hierarchical subgraph augmentation.

A novel transferable graph prompt attack, called TGPA, is proposed, which shifts the attack paradigm by introducing a hierarchical structural decoupling mechanism, which reduces the performance of pre-trained graph models with graph prompts by up to 28.9%, while guaranteeing robustness, stealthiness, and transferability.

Generate and Filter: A GNN-Based Approach for Graph Anomaly Detection.

A novel framework, Generate and Filter graph learning for Graph Anomaly Detection (GFGAD), which generates a diverse set of synthetic anomalies with enriched feature and structural information to balance the data distribution and significantly outperforms state-of-the-art baselines.

CR-Aug: Community Risk-Guided Adaptive Augmentation for Semi-supervised Graph Anomaly Detection

Recently, semi-supervised graph anomaly detection (GAD) has garnered increasing attention under a challenging setting where only a limited number of normal nodes are labeled during training. To better exploit the limited normal supervision and compensate for the absence of real anomaly labels, existing methods often adopt a single, uniform anomaly modeling and pseudo-anomaly generation strategy applied across the entire graph, while overlooking the inherent heterogeneity among communities in graph data. Consequently, the generated pseudo-anomalies exhibit limited diversity and specificity, failing to represent the complex distributions of real-world anomalies. To address this challenge, we propose CR-Aug, a novel Community Risk-Guided Adaptive Augmentation framework, which is designed to overcome this limitation by leveraging community-specific prior knowledge more effectively. It comprises two core components: Community Risk Profiling (CRP) and Risk-Guided Synthesis (RGS). Specifically, CRP quantifies community-level risks by measuring the affinity discrepancy between the labeled normal subset and the overall community. Guided by the derived risk scores, RGS then dynamically adapts the generation process through risk-weighted sampling and adaptive mixing. This strategy facilitates the synthesis of diverse pseudo-anomalies, thereby providing the classifier with more discriminative supervisory signals. Extensive experiments on multiple benchmark datasets demonstrate that CR-Aug significantly outperforms state-of-the-art semi-supervised GAD methods, validating the effectiveness of incorporating community-level risk profiles.

Local anomaly detection via subgraph embedding on multivariate data streams

This study addresses the crucial challenge of local anomaly detection in multivariate data streams, which is essential for applications such as fault detection and damage localization in industrial contexts. Traditional approaches often neglect two critical aspects: the significance of relational features in assessing similarity and the necessity of pinpointing specific data streams that exhibit abnormal patterns. To address these gaps, we introduce a novel subgraph embedding-based method. Our approach constructs dynamic graphs to model relational features and identifies anomalies by detecting subgraphs within these graphs. The core innovation lies in an entropy-based transformer integrated with an autoencoder, which maps subgraphs into a low-dimensional space to effectively discriminate abnormal subgraphs. Experiments on EEG and industrial datasets show that the proposed model achieves average F1-score improvements of 0.07 and 0.105 over the compared baselines, respectively. The results indicate that entropy-based subgraph embedding can improve local anomaly detection performance, although the model does not achieve the best value for every metric on every dataset.