Gfm4ga Achieves 2.85% Improvement in Group Anomaly Detection Accuracy

Detecting anomalous groups within complex networks presents a significant challenge, particularly given the variety of patterns these groups can exhibit. Jiujiu Chen, Weijun Zeng, and Shaofeng Hu, alongside colleagues from HKUST (GZ) and Tencent, address this problem with a novel approach inspired by the recent successes of large language models. Their research introduces GFM4GA, a graph foundation model specifically designed for group anomaly detection, extending existing models which typically focus on individual anomalies. This work is significant because it captures the holistic patterns of group anomalies, recognising that individuals within an abnormal group may not appear anomalous in isolation, and demonstrates improved performance over existing methods with an average 2.85% increase in AUROC and 2.55% in AUPRC. The pipeline utilises a dual-level contrastive pretraining strategy and adaptive finetuning to effectively identify and generalise to unseen group anomalies.

Motivated by the success of large language models, the team achieved a breakthrough by adapting graph foundation models, previously effective at detecting individual anomalies, to the more complex task of detecting anomalies occurring within groups of nodes. This research addresses a critical limitation of existing methods, which struggle to recognise patterns where individual nodes may appear normal but collectively exhibit anomalous behaviour. The pipeline leverages a dual-level contrastive learning approach during pretraining, focusing on both feature estimation and group extraction to effectively capture the underlying structure and inconsistencies indicative of group anomalies.

The study reveals a new approach to pretraining graph foundation models, employing dual-level contrastive learning to discern potential group anomaly structures and feature inconsistencies. This process allows the model to learn robust representations of both individual node characteristics and the relationships between nodes within groups. In downstream tasks, GFM4GA is finetuned using parameter-constrained and group-anomaly-proportion weighted few-shot settings, enhancing its ability to adapt to unseen anomaly types. Crucially, the model’s adaptive capacity is further expanded by incorporating group contexts derived from labeled anomaly neighbours, allowing it to generalise effectively to novel scenarios.

This innovative finetuning strategy distinguishes GFM4GA from existing methods and unlocks improved performance. Experiments demonstrate that GFM4GA surpasses both existing group anomaly detectors and graph foundation models designed for individual anomalies. The research establishes an average improvement of 2.85% in Area Under the Receiver Operating Characteristic curve (AUROC) and 2.55% in Area Under the Precision-Recall Curve (AUPRC), quantifying the model’s superior performance. The team highlights the challenges inherent in group anomaly detection, specifically the marginal feature deviations and complex structural camouflage employed by anomalous groups, which often mask individual anomalies.

GFM4GA effectively addresses these challenges through its unique pretraining and finetuning strategies. This breakthrough reveals a pathway towards more robust and adaptable graph anomaly detection systems, particularly in scenarios where labelled data is scarce. The work opens possibilities for applications across diverse domains, including social networks, financial transaction monitoring, and cybersecurity, where identifying coordinated anomalous activity is paramount. By successfully extending the capabilities of graph foundation models to group anomaly detection, scientists prove the potential of this approach to enhance network security and improve the accuracy of anomaly detection in complex graph-structured data. The adaptive ability of GFM4GA, driven by group context learning, promises to be particularly valuable in detecting emerging and previously unseen anomaly patterns.

Dual-Level Contrastive Pretraining for Group Anomaly Detection

The research team developed GFM4GA, a novel graph foundation model specifically designed for group anomaly detection, addressing limitations in existing methods that struggle with identifying anomalous groups where individual members may appear normal. This work pioneers a dual-level contrastive pretraining pipeline, leveraging both feature-based estimation and group extraction techniques to capture underlying structural patterns and feature inconsistencies indicative of group anomalies. The approach enables the model to learn potential group anomaly structures before downstream tasks, improving its ability to detect subtle deviations. Experiments employed a sophisticated pretraining phase where the model contrasted features at both the subgraph and node levels, fostering a deeper understanding of anomalous relationships within groups.

Following pretraining, the pipeline underwent finetuning using parameter constraints and a weighted strategy based on group anomaly proportion, allowing the model to adapt to varying group sizes and patterns. Crucially, the team harnessed labeled anomaly neighbors, combining high degrees and anomaly probabilities to construct contextual information that mitigates the effects of structural camouflage within anomalous groups. This innovative methodology directly addresses three key challenges in group anomaly detection: marginal feature deviation, complex structural camouflage, and differing detection objectives. Unlike individual anomaly detection, where focus is on single nodes, GFM4GA targets entire subgraphs, necessitating a unique optimization strategy.

The researchers overcame the issue of variable group sizes by implementing a parameter-constrained finetuning process, preserving learned knowledge while adapting to new data. The study demonstrates that GFM4GA surpasses existing group anomaly detectors and GFMs designed for individual anomalies, achieving average improvements of 2.85% in Area Under the Receiver Operating Characteristic curve (AUROC) and 2.55% in Area Under the Precision-Recall curve (AUPRC). These performance gains highlight the effectiveness of the proposed methodology in capturing complex group dynamics and accurately identifying anomalous clusters within graph data, paving the way for more robust network analysis and security applications.

GFM4GA Excels at Group Anomaly Detection

Scientists have developed a novel graph foundation model, GFM4GA, specifically for group anomaly detection, overcoming limitations in existing models that struggle to identify anomalies requiring holistic pattern recognition. The research team achieved an average improvement of 2.85% in AUROC (Area Under the Receiver Operating Characteristic curve) and 2.55% in AUPRC (Area Under the Precision-Recall Curve) when comparing GFM4GA against other group anomaly detectors and graph foundation models designed for individual anomalies. These gains demonstrate the effectiveness of the dual-level contrastive learning approach, which focuses on both feature estimation and group extraction to better capture underlying group anomaly structures. Experiments revealed that GFM4GA excels at identifying dense abnormal connections within subgraphs, facilitating more accurate localization of group anomalies.

The pipeline was pretrained using a dual-level contrastive method, incorporating feature-based estimation and group extraction, to discern potential group anomaly structures and feature inconsistencies. Subsequent finetuning, conducted with parameter constraints and weighted by group anomaly proportion, further enhanced the model’s adaptive ability to detect previously unseen group anomalies, leveraging contextual information from labeled anomaly neighbors. Tests prove that finetuning the pretrained pipeline in few-shot scenarios significantly outperforms prompt tuning strategies, highlighting the limitations of graph prompt tuning for this specific task. Data shows that the Weixin dataset, characterized by larger average group sizes and richer contextual information, benefited particularly from the ComGA algorithm, achieving second-best performance.

Conversely, graph foundation models designed for individual anomalies performed best on synthetic group anomaly datasets with smaller group sizes. Varying the number of finetuning shots from 10 to 100 on the Weixin dataset, scientists recorded that GFM4GA consistently outperformed baseline methods when using fewer than 50 shots, demonstrating its strength in severe few-shot scenarios. Measurements confirm that GFM4GA exhibits a narrower standard deviation range compared to other methods, indicating more consistent and stable results. Ablation studies demonstrated the critical importance of subgraph-level contrastive learning during pretraining, with its removal causing the largest performance decline. Parameter sensitivity analysis revealed that a subgraph-level contrastive weight of 0.7 and utilizing 10 neighbors to construct group contexts yielded optimal performance on the Weixin and Weibo datasets.

GFM4GA Detects Anomalous Groups Effectively

This research introduces GFM4GA, a novel graph foundation model specifically designed to address the challenges of group anomaly detection. The authors demonstrate that existing graph foundation models, successful in identifying individual anomalies, struggle with group anomalies due to the need to recognise patterns across entire groups rather than isolated instances. GFM4GA overcomes this limitation through a dual-level contrastive pretraining process, capturing both group structure and feature inconsistencies, followed by finetuning with parameter constraints and weighted anomaly proportions. Experimental results across multiple datasets indicate that GFM4GA outperforms existing group anomaly detectors and models designed for individual anomalies, achieving improvements of 2.85% in AUROC and 2.55% in AUPRC. The model’s adaptive ability to unseen group anomalies is enhanced by utilising group contexts derived from labelled anomaly neighbours. The authors acknowledge that the computational complexity of the pretraining phase is a consideration, and future work will explore the integration of large language models to further improve performance, particularly when textual information is available, and investigate zero-shot group anomaly detection utilising LLM reasoning capabilities.