Jul 2026· Annual International ACM SIGIR Conference on Research and Development in Information Retrieval· 2 citations· 20 references
Computer Science
TL;DR
DGRA-CL transforms dynamic graphs into temporal sequences, employs time- and context-aware contrastive learning to learn normal node behavior patterns, retrieves similar normal exemplars from a training pool under a strict causality constraint, and fuses them via similarity-weighted aggregation to construct baseline representations.
Abstract
Detecting anomalous nodes in continuously evolving graphs without labeled supervision requires representations that capture both local temporal context and globally consistent normal behavior—a combination that current methods do not jointly address. Existing dynamic anomaly detectors rely on localized temporal neighborhoods and cannot leverage globally similar normal patterns elsewhere in the graph, while existing retrieval-augmented graph methods either require labels or do not enforce strict temporal causality during retrieval. We propose DGRA-CL (Dynamic Graph Retrieval-Augmented Contrastive Learning), an unsupervised framework that learns discriminative temporal node representations for anomaly detection without labeled data. DGRA-CL transforms dynamic graphs into temporal sequences, employs time- and context-aware contrastive learning to learn normal node behavior patterns, retrieves similar normal exemplars from a training pool under a strict causality constraint, and fuses them via similarity-weighted aggregation to construct baseline representations. Anomalies are detected via deviation-based scoring measuring distance from these normal baselines. On four real-world dynamic graphs, DGRA-CL achieves statistically significant AUC gains of 1–2 points over the strongest baselines on three of four benchmarks (UCI Messages, Bitcoin-Alpha, Digg) and competitive performance on Reddit, while operating without anomaly labels and generalizing to unseen nodes.
Generalizable dynamic graph anomaly detection (DGAD) enables pretrained detectors to identify anomalies in unseen target domains without costly retraining. However, existing methods often fail for two reasons. First, they mainly rely on domain-agnostic patterns and miss domain-specific patterns that keep evolving. Second, they assume access to the full target domain data, whereas in more practical online test-time adaptation settings, target data arrive sequentially in unlabeled chunks. To address these limitations, we formulate online test-time adaptation for generalizable DGAD and propose OTTA-DGAD. OTTA-DGAD first extracts dynamic prototypes, i.e., evolving representations of normal and anomalous patterns, from temporal ego-graphs and stores them in a memory buffer. The buffer selectively retains general patterns shared across the source domains used for pretraining while incorporating new patterns from the target domain. An anomaly scorer then compares incoming edge representations against these prototypes to identify both general and domain-specific anomalies. During adaptation, OTTA-DGAD updates the memory buffer using reliable pseudo-labels identified through confidence-based detection. It further enriches each target chunk with relevant representations retained from previous chunks, compensating for information loss resulting from the sequential arrival of data. Extensive experiments under strict test-then-adapt OTTA settings demonstrate state-of-the-art performance on ten real-world datasets from diverse domains.
Jialun Zheng, Hanchen Yang, Jiannong Cao et al.· 0 citations
BAD is proposed, an unsupervised framework for anomaly detection in continuous-time dynamic graphs that represents nodes with learnable identity embeddings and performs pairwise compatibility modeling via cross-attention between each destination node and the source’s recent neighbors, enabling direct characterization of context-dependent deviations without requiring attributes.
Jia-Chi Luo, Sha-Meng Wen, Ziyan Qiu et al.· 0 citations
Video Anomaly Detection (VAD) is a crucial computer vision task for
security monitoring and public safety. Unsupervised VAD is more suitable for
real-world scenarios with rare unknown anomalies, but existing LLM-based
methods suffer from limited temporal modeling, inconsistent video understand
ing and inaccurate fine-grained localization, leading to biased anomaly scoring.
To solve these problems, we propose a novel unsupervised VAD framework fus
ing graph attention propagation and multimodal semantic information: first, fuse
video semantic and motion features to construct a dynamic spatiotemporal graph,
and refine node features via graph attention propagation with orthogonal con
straints; then, split videos into semantically coherent event units by a statistical
boundary detection module; finally, guide MLLMs to generate event semantic
descriptions and initial anomaly scores through a hierarchical prompting strategy,
and refine the scores via video-text semantic alignment to obtain accurate frame
level scores. Evaluated on UCF-Crime and XD-Violence datasets with frame
level AUC, the proposed framework achieves state-of-the-art performance under
unsupervised and zero-shot settings, significantly outperforming existing LLM
based VAD methods and even several weakly supervised approaches, which fully
verifies its effectiveness and robustness.
Qinghao Kong· Poster Volume 0008 The 2026...· 0 citations
The proposed AHEAD, an unsupervised anti-hallucination anomaly detection framework featuring a hallucination refinement pipeline and a temporal-structural detector, which is compatible with various T-GNN backbones for reliable anomaly detection on CTDGs.
Yingxuan Li, Yuanyuan Xu, Xuemin Lin et al.· Proceedings of the 32nd ACM...· 0 citations
Deep learning detectors for anomalies in dynamic graphs have reached strong accuracy, yet they remain opaque: when an edge is flagged, the analyst receives a score but no reason. This opacity is untenable in the cooperative, regulated information systems where such detectors are deployed, where automated decisions must be auditable and trustworthy. We address this gap for AddGraph, the foundational GCN+GRU framework for edge-level anomaly detection in dynamic graphs, which to our knowledge has never been equipped with any form of explainability. We present a strictly post-hoc explainability framework, X-AddGraph, built on a Dual Spatial-Temporal Attribution (DSTA) mechanism whose three components are each aligned with one of AddGraph's architectural modules: a gradient-based relevance attribution over the current adjacency structure (spatial), a direct reading of the contextual attention weights already computed during inference (short-term temporal, at zero additional cost), and a gradient rollback through the recurrent hidden states (long-term temporal). Because the detector is frozen, detection performance is preserved exactly (Delta AUC = 0, verified empirically to ten decimal places). On the UCI Message benchmark, our trained AddGraph baseline reaches an average per-snapshot AUC of 0.8705, exceeding the originally published result; X-AddGraph reproduces every score identically while adding explanations where none existed. Evaluated across four edge populations - confident true positives, low-confidence true positives, false positives, and random samples - the long-term attribution identifies historical snapshots carrying significantly more counterfactual signal than random selection (0.127 vs. 0.074), a capability that no spatially-blind explainer can provide. We release our implementation for full reproducibility.
Iyad Assaad Nekka, H. Seba, Khaled Walid Hidouci et al.· 0 citations
Anomaly detection is often applied to data stored in relational databases, yet most existing methods require flattening multiple tables into a single feature matrix. This flattening can obscure entity identity, schema structure, and multi-hop dependencies, limiting the detection of anomalies that depend on relational context rather than isolated feature values. Beyond preserving relational structure, relational anomaly detection raises an additional challenge: how to incorporate symbolic behavioral evidence into learned relational representations. To address these challenges, we study relational anomaly detection, where the goal is to identify anomalous entities or events in a multi-table database. We propose RAD, a rule-augmented relational anomaly detector that combines heterogeneous graph representation learning with refined symbolic rule signals. RAD derives candidate rules from random-forest paths over flattened summaries of the entities or events being scored, refines them into compact interpretable predicates, injects the resulting rule features into the graph model, and learns anomaly scores using reconstruction-based and pairwise-ranking supervision. To evaluate this setting, we introduce a relational anomaly detection benchmark spanning three settings: LANL cybersecurity event detection and two unexpected user-churn anomaly tasks derived from Amazon and H&M relational databases. Experiments show that RAD improves anomaly ranking over flattened tabular detectors and relational baselines under natural class imbalance, achieving the best average rank on AUROC and AUPRC across the benchmark. Ablations show that direct rule injection and ranking-based supervision are key contributors to performance, while edge reconstruction is not uniformly beneficial. Our code and data are available at: https://github.com/noahd15/RAD_RelationalAnomalyDetection.
Noah Dahle, Anne M. Tumlin, N. Tran et al.· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
