提出统一模型,无需重新训练即可在多个新数据集上检测异常节点。
From Few-Shot to Zero-Shot: Towards Generalist Graph Anomaly Detection
- 用上下文学习和少量正常样本实现少样本泛化检测
- 在17个真实数据集上表现优异,少样本/零样本下仍具强泛化能力
- 适合隐私敏感或标签稀缺场景,无需数据集定制
图异常检测(GAD)对识别来自网络安全、社交网络等领域的图结构数据中的异常节点至关重要。现有方法多采用“一模型一数据集”范式,需为每个数据集单独训练才能达到最佳性能,但面临计算与数据成本高、泛化能力弱、迁移性差及隐私敏感场景中难以获取完整数据或充足标签等问题。为此,我们提出一种新型通用型GAD范式,旨在构建一个能无需大量重训或定制化即可在多个未见数据集上检测异常的统一模型。为此,我们提出ARC方法:利用上下文学习,仅需推理时提供少量正常样本即可完成少样本检测。ARC包含三个核心模块:特征对齐模块用于统一跨数据集特征,残差图神经网络编码器捕捉与数据集无关的异常表示,交叉注意力上下文学习模块则基于少量正常样本上下文对异常进行评分。在此基础上,我们进一步提出ARC_zero,用于零样本场景,通过伪上下文机制选择代表性伪正常节点,实现完全无标签的推理。在17个真实世界图数据集上的大量实验表明,ARC与ARC_zero均能有效检测异常,在少样本与零样本设置下展现出强大泛化能力且运行高效。
原文摘要 · Abstract (English)
Graph anomaly detection (GAD) is critical for identifying abnormal nodes in graph-structured data from diverse domains, including cybersecurity and social networks. The existing GAD methods often focus on the learning paradigms of "one-model-for-one-dataset", requiring dataset-specific training for each dataset to achieve optimal performance. However, this paradigm suffers from significant limitations, such as high computational and data costs, limited generalization and transferability to new datasets, and challenges in privacy-sensitive scenarios where access to full datasets or sufficient labels is restricted. To address these limitations, we propose a novel generalist GAD paradigm that aims to develop a unified model capable of detecting anomalies on multiple unseen datasets without extensive retraining/fine-tuning or dataset-specific customization. To this end, we propose ARC, a few-shot generalist GAD method that leverages in-context learning and requires only a few labeled normal samples at inference time. Specifically, ARC consists of three core modules: a feature Alignment module to unify and align features across datasets, a Residual GNN encoder to capture dataset-agnostic anomaly representations, and a cross-attentive in-Context learning module to score anomalies using few-shot normal context. Building on ARC, we further introduce ARC_zero for the zero-shot generalist GAD setting, which selects representative pseudo-normal nodes via a pseudo-context mechanism and thus enables fully label-free inference on unseen datasets. Extensive experiments on 17 real-world graph datasets demonstrate that both ARC and ARC_zero effectively detect anomalies, exhibit strong generalization ability, and perform efficiently under few-shot and zero-shot settings.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。