UniGAD: Unifying Multi-level Graph Anomaly Detection

Graph Anomaly Detection (GAD) aims to identify uncommon, deviated, or suspicious objects within graph-structured data. Existing methods generally focus on a single graph object type (node, edge, graph, etc.) and often overlook the inherent connections among different object types of graph anomalies. For instance, a money laundering transaction might involve an abnormal account and the broader community it interacts with. To address this, we present UniGAD, the first unified framework for detecting anomalies at node, edge, and graph levels jointly. Specifically, we develop the Maximum Rayleigh Quotient Subgraph Sampler (MRQSampler) that unifies multi-level formats by transferring objects at each level into graph-level tasks on subgraphs. We theoretically prove that MRQSampler maximizes the accumulated spectral energy of subgraphs (i.e., the Rayleigh quotient) to preserve the most significant anomaly information. To further unify multi-level training, we introduce a novel GraphStitch Network to integrate information across different levels, adjust the amount of sharing required at each level, and harmonize conflicting training goals. Comprehensive experiments show that UniGAD outperforms both existing GAD methods specialized for a single task and graph prompt-based approaches for multiple tasks, while also providing robust zero-shot task transferability. All codes can be found at https://github.com/lllyyq1121/UniGAD.

Paper

References (70)

Scroll for more · 38 remaining

Similar papers

Peer review

Reviewer ky9h7/10 · confidence 4/52024-07-10

Summary

Traditional graph anomaly detection focus on single type of graph object (e.g., node, edge, graph). To address this, this paper introduces the first unified framework (UniGAD) for detecting anomalies at the node, edge, and graph levels jointly. The authors propose two core modules, MRQSampler and GraphStitch, to address the challenge of unifying multi-level task formats and unifying multi-level task training, respectively. Moreover, the authors theoretically prove that MRQSampler maximizes the accumulated spectral energy of subgraphs (i.e., the Rayleigh quotient) to preserve the most significant anomaly information. Extensive experiments demonstrate that UniGAD surpasses existing single-task GAD methods and graph prompt-based approaches for multiple tasks, offering robust zero-shot task transferability.

Strengths

Originality: 1. This paper focus on the gap of multi-level graph neural network at the node, edge, and graph levels, which is an important problem. In many scenarios/data, the labels of these different graph objects are often relevant, but this is always overlooked. 2. The problem formulation in Definition 2.1 is novel in graph learning, which is feasible to have labels at one or more levels, which makes the framework broadly applicable and provides strong zero-shot capabilities. 3. The authors designed a theoretically guaranteed graph sampling algorithm that uses the Maximum Rayleigh Quotient to sample the most anomalous subgraphs. This approach ensures sampling nodes that contain anomalous information, preventing the anomalous information from being smoothed out. 4. The authors implement multi-level task information transfer through a module called GraphStitch. Since multi-task in graph learning research remains rare, this network design is very interesting and prospective. Quality: The paper exhibits a high level of technical quality, with theoretical proofs and rigorous dynamic programming algorithms provided for the effectiveness of the MRQSampler in maximizing the accumulated spectral energy of subgraphs. The paper proposes a robust framework that achieves the unified multi-level tasks through a pre-trained GNN encoder, MRQsampler, and GraphStitch network. The experiments look solid, including 13 datasets with single-graph datasets and multi-graph datasets and 17 SOTA model with node-level models, edge-level models, graph-level models and multi-task models. Clarity: The paper is well-written and clearly presents its contributions. Significance: The framework of UniGAD further improves the effect of graph anomaly detection and has strong zero-shot capability. Besides, it also promote the development of multi-task learning in the graph learning domain.

Weaknesses

A substantive assessment of the weaknesses of the paper. Focus on constructive and actionable insights on how the work could improve towards its stated goals. Be specific, and avoid generic remarks. For example, if you believe the contribution lacks novelty, provide references and an explanation as evidence; if you believe experiments are insufficient, explain why and exactly what is missing, etc. Please keep in mind that the rebuttal period is not necessarily enough to run new experiments. As a result, asking for new results is rather unrealistic. Overall, this paper is technically solid and novel. In Page 8, the authors mention that the other multi-task method, like GraphPrompt and All-in-One, often run out of time (OOT) and calculate redundantly. What is it that makes UniGAD avoid this? Are each node’s representations calculated only once? Please explain the difference in more detail. Minors: in Additional Experimental Results, the caption of the table 8 and table 9 should be F1-macro? Otherwise this will repeat table 1,2.

Questions

Refer to weaknesses, please explain the difference in more detail and check the typos.

Rating

7

Confidence

4

Soundness

4

Presentation

4

Contribution

3

Limitations

The authors addressed limitations and societal impacts in the conclusion and appendices.

Reviewer ymWJ7/10 · confidence 4/52024-07-11

Summary

The paper introduces UniGAD, a unified framework for multi-level graph anomaly detection, capable of identifying anomalies at the node, edge, and graph levels. Key contributions include the Maximum Rayleigh Quotient Subgraph Sampler (MRQSampler), which optimizes subgraphs to maximize significant anomaly information, and the GraphStitch Network, which facilitates information sharing across different levels while maintaining effectiveness. Experiments on 13 datasets show that UniGAD outperforms existing methods and demonstrates strong zero-shot transferability. Overall, UniGAD leverages spectral properties and multi-task learning to achieve state-of-the-art performance in graph anomaly detection.

Strengths

1.Innovative Unified Framework: UniGAD is the first framework to jointly detect anomalies at the node, edge, and graph levels, addressing a significant gap in current GAD research. The integration of multiple anomaly detection tasks into a single model enhances its versatility and applicability across various scenarios. 2.Advanced Methodologies: The Maximum Rayleigh Quotient Subgraph Sampler (MRQSampler) and the GraphStitch Network are key innovations. MRQSampler maximizes spectral energy to preserve critical anomaly information, while the GraphStitch Network facilitates information sharing across different levels, harmonizing conflicting training goals and maintaining the effectiveness of individual tasks. 3.Robust Performance and Transferability: UniGAD is comprehensively evaluated on 13 diverse datasets, consistently outperforming existing methods. It demonstrates robust zero-shot transferability, effectively transferring knowledge across different GAD tasks without prior exposure to specific anomalies, showcasing its robustness and generalizability. 4.Strong Theoretical and Practical Foundations: The approach is supported by solid theoretical foundations, with proofs provided for the optimal conditions of MRQSampler. Additionally, the dynamic programming algorithm ensures computational efficiency, making the method scalable to large datasets. The availability of the implementation code promotes transparency and reproducibility of the results, facilitating further research and application.

Weaknesses

1.The paper modifies existing methods like All-in-One and GraphPrompt into multi-task versions for comparison. However, All-in-One already supports node, edge, and graph tasks, and GraphPrompt supports node and graph tasks. A more straightforward approach would have been to directly apply these methods to the relevant anomaly detection tasks without modifications to see their effectiveness. 2.The paper mentions that All-in-One and GraphPrompt often run out of time (OOT), but it is unclear whether this refers to the prompt tuning stage or the pre-training stage. Since both methods are known for their relatively fast prompt tuning, clarifying this distinction is crucial for understanding their performance limitations. 3.The paper lacks comparisons of temporal and spatial performance metrics. Including an analysis of the time and space efficiency of UniGAD compared to other methods would provide a more comprehensive evaluation of its practicality for large-scale and real-time applications.

Questions

Is it possible to provide All-in-One and GraphPrompt code for multi-task versions?

Rating

7

Confidence

4

Soundness

4

Presentation

4

Contribution

4

Limitations

None

Reviewer ji276/10 · confidence 4/52024-07-12

Summary

This article presents an anomaly detection model, UniGAD, designed to be applicable across different levels including nodes, edges, and whole graphs. Leveraging the relationship between the Rayleigh quotient and anomaly degree, as described in Lemma 1, the authors have developed a novel subgraph sampling algorithm, MRQSampler. This algorithm recursively adds nodes that maximize the Rayleigh quotient, ensuring the subgraph contains the most anomalous information. Consequently, node-level and edge-level tasks are converted into graph-level tasks for unified processing. Additionally, the authors introduce the innovative GraphStitch Network, which jointly considers multi-level representations. Extensive experimental results substantiate the effectiveness of UniGAD.

Strengths

1. The task of unifying different levels of anomaly detection on graphs is challenging and very novel. 2. Complete theoretical proof, explaining the motivation of MRQSampler. 3. Complete experiment proves the effectiveness of UniGAD

Weaknesses

1. The graph signal $x$ in all proofs is treated as a vector, which implies that the node feature is a scalar. However, in practice, graph node features are often vectors. This discrepancy is not clearly addressed by the authors. 2. The MRQSampler appears to be a recursive algorithm rather than a dynamic programming (DP) algorithm, as suggested by Algorithm 1 in the appendix. This distinction impacts the efficiency of the proposed method. 3. UniGAD is a supervised algorithm, yet the baseline comparisons in the experiment include unsupervised algorithms (OCGIN,OCGTL). This raises concerns about the fairness and validity of the experimental comparisons.

Questions

1. How efficient is MRQSampler? (execution time and memory requirements), can it be processed in parallel on Gpus 2. Can UniGAD be unsupervised? I think this is more realistic (collecting abnormal samples during the training phase is difficult)

Rating

6

Confidence

4

Soundness

3

Presentation

3

Contribution

2

Limitations

No limitations need to discuss

Reviewer NHz65/10 · confidence 4/52024-07-13

Summary

This paper presents a novel framework for detecting anomalies at node, edge, and graph levels within graph-structured data. The authors introduce the Maximum Rayleigh Quotient Subgraph Sampler (MRQSampler) to transform multi-level tasks into graph-level tasks by sampling subgraphs with high spectral energy, thus preserving significant anomaly information. Additionally, the GraphStitch Network integrates information across different levels and balances multi-level training objectives. Experimental results demonstrate the promising results on different GAD tasks.

Strengths

1. The paper studies an interesting and underexplored problem that unifies multiple-level GAD tasks in a single framework. The proposed unification strategy is interesting. The paper is overall nicely presented and easy to follow. A comprehensive set of baseline methods are considered in the evaluation.

Weaknesses

1. AUPR is a popular complementary metric to AUROC, commonly used by the majority of recent GAD papers. It is important for readers to understand the performance of the model with a focus on the anomaly class. Considering that the improvement on some datasets is marginal, discussing the model's performance under AUPR would be beneficial. 2. It seems that on the edge prediction task for some datasets, the baselines achieve the top performance. I am wondering how this method would perform on datasets with a very high degree, like the T-Finance dataset. In addition, it would be interesting to see how this method performs on large-scale datasets to understand its robustness better. 3. Some of the experiments are marked as OOM) and OOT, especially for those prompt-based methods on larger graphs. While I understand these methods can be resource-intensive, a limit of 24GB max GPU RAM or 1 day wall time might be insufficient for adequately evaluating such methods.

Questions

Please refer to weakness.

Rating

5

Confidence

4

Soundness

2

Presentation

2

Contribution

2

Limitations

N/A

Reviewer ymWJ2024-08-10

Thanks for the authors' reply. I will keep positive score.

Authorsrebuttal2024-08-12

Acknowledgement from the Authors

Thank you for your continued engagement and positive feedback on our work! We will carefully incorporate your comments into our manuscript.

Reviewer ji272024-08-11

The author's response basically convinced me and I will keep my postive score

Authorsrebuttal2024-08-12

Acknowledgement from the Authors

Thank you for your insightful feedback and for recognizing our contributions. We greatly appreciate your engagement throughout the review process. We'll carefully incorporate your comments into our manuscript.

Reviewer NHz62024-08-12

Thank you to the authors for addressing my concerns. I will maintain my current rating for now. I look forward to discussions with the other reviewers and the area chair, and I am open to adjusting my rating if necessary after the discussion.

Authorsrebuttal2024-08-12

Acknowledgement from the Authors

Thank you for your continued engagement and thoughtful consideration of our work. We'll carefully incorporate your comments into our manuscript. We’re glad that our responses have addressed the concerns you raised. We’ll be available until the end of the rebuttal if you have any follow-up questions or further points of discussion.

Reviewer ky9h2024-08-12

Thanks for the reply

I have no further questions.

Program Chairsdecision2024-09-25

Decision

Accept (poster)

© 2026 NYSGPT2525 LLC