Balanced Anomaly-guided Ego-graph Diffusion Model for Inductive Graph Anomaly Detection

Graph anomaly detection (GAD) is crucial in applications like fraud detection and cybersecurity. Despite recent advancements using graph neural networks (GNNs), two major challenges persist. At the model level, most methods adopt a transductive learning paradigm, which assumes static graph structures, making them unsuitable for dynamic, evolving networks. At the data level, the extreme class imbalance, where anomalous nodes are rare, leads to biased models that fail to generalize to unseen anomalies. These challenges are interdependent: static transductive frameworks limit effective data augmentation, while imbalance exacerbates model distortion in inductive learning settings. To address these challenges, we propose a novel data-centric framework that integrates dynamic graph modeling with balanced anomaly synthesis. Our framework features: (1) a discrete ego-graph diffusion model, which captures the local topology of anomalies to generate ego-graphs aligned with anomalous structural distribution, and (2) a curriculum anomaly augmentation mechanism, which dynamically adjusts synthetic data generation during training, focusing on underrepresented anomaly patterns to improve detection and generalization. Experiments on five datasets demonstrate that the effectiveness of our framework.

💡 Research Summary

The paper tackles two intertwined challenges that have limited progress in graph anomaly detection (GAD): the reliance on transductive learning, which assumes a static graph structure, and the extreme class imbalance where anomalous nodes constitute only a tiny fraction of the graph. Both issues hinder the deployment of GAD models in real‑world dynamic networks such as financial transaction graphs, social media platforms, or cybersecurity logs. To jointly address these problems, the authors propose a data‑centric framework called Balanced Anomaly‑guided Ego‑graph Diffusion (BAED).

BAED consists of three tightly coupled components. First, a discrete ego‑graph diffusion model operates directly on local subgraphs (ego‑graphs) rather than on the whole graph. In the forward diffusion step, random edge additions, deletions, and attribute perturbations are applied to an ego‑graph, injecting discrete noise. The reverse process, parameterized by θ, learns to denoise and reconstruct ego‑graphs that follow the distribution of real anomalies. By training with a loss that jointly penalizes structural mismatches (e.g., clustering coefficient, average path length) and attribute differences, the model generates synthetic ego‑graphs that faithfully reflect anomalous topologies.

Second, a curriculum anomaly augmentation mechanism dynamically adjusts the composition of training batches. After each training iteration the current model’s loss distribution is examined; anomaly types that incur higher loss receive larger sampling weights. A Guidance Embedding Generator (GIN) encodes the selected synthetic ego‑graphs into “guidance vectors.” These vectors are combined with the loss weights to bias the next augmentation step toward under‑represented or hard‑to‑detect anomaly patterns. The process maintains a predefined overall normal‑to‑anomaly ratio (e.g., 1:1) while ensuring each anomaly subtype is adequately represented throughout training.

Third, the framework is model‑agnostic: any inductive GNN (GraphSAGE, GCN, GAT, etc.) can be plugged in. During inference only the K‑hop ego‑graph of a target node is fed to the GNN, producing node embeddings across L layers. The final anomaly score is computed as a deviation: the embedding of the target node minus the mean embedding of all nodes in its ego‑graph. This deviation accentuates how far a node deviates from its local neighborhood, a natural signal for anomaly detection.

The authors provide a theoretical analysis showing that the forward‑backward diffusion forms a Markov chain under a Bernoulli noise model, guaranteeing convergence. They also prove that the curriculum‑driven weighting smooths the optimization landscape, reducing the risk of getting trapped in poor local minima.

Empirical evaluation on five public benchmarks (including DGraph, ACM, Reddit, Amazon, and Yelp) demonstrates that BAED consistently outperforms state‑of‑the‑art inductive GAD methods such as ANOMALOUS, CARE‑GNN, and PC‑GNN. Average AUC improves from 0.842 to 0.884, a gain of 4.2 percentage points, with especially large gains (6–8 pp) on datasets where anomalies constitute less than 0.5 % of nodes. Ablation studies confirm that removing either the diffusion model, the curriculum schedule, or the guidance embeddings leads to notable performance drops, underscoring the necessity of each component. The additional computational overhead of the augmentation step is modest (≈0.03 s per batch), making the approach viable for near‑real‑time streaming scenarios.

In summary, BAED introduces a novel combination of discrete ego‑graph diffusion and curriculum‑driven, guided data augmentation to enable inductive, balanced graph anomaly detection in dynamic environments. The paper’s contributions lie in (1) redefining diffusion at the ego‑graph level to preserve local structural cues, (2) integrating a loss‑aware curriculum that adaptively focuses on hard anomaly patterns, and (3) demonstrating that these ideas together yield significant empirical gains while remaining computationally efficient. Future work is outlined to extend the diffusion model to continuous‑time graphs, incorporate multimodal node attributes, and explore reinforcement‑learning‑based curriculum policies.