AnomalyGFM: Graph Foundation Model for Zero/Few-shot Anomaly Detection

2025-02-13

AI Summary

Existing general-purpose graph models exhibit poor generalization in Graph Anomaly Detection (GAD), primarily due to their inability to model sparse, irregular, and heterogeneous anomaly patterns across domains. To address this, we propose AnomalyGFM—the first graph foundation model supporting zero-shot inference and few-shot prompt tuning for GAD. Its core innovation lies in a graph-agnostic normal/anomalous class prototype mechanism, where learnable prototypes are constructed via residual alignment of node representations. AnomalyGFM integrates contrastive alignment pretraining with prompt-based fine-tuning, enabling both cross-graph zero-shot detection and rapid adaptation to novel scenarios. Evaluated on 11 real-world anomalous graph datasets, AnomalyGFM consistently outperforms state-of-the-art methods under both zero-shot and few-shot settings, while also supporting real-time inference on ultra-large-scale graphs.

Technology Category

• Machine Learning: Graph-based Machine Learning
• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Reasoning under Uncertainty: Graphical Models

Application Category

• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Web Mining and Content Analysis: Large pretrained models with web data

Abstract

Graph anomaly detection (GAD) aims to identify abnormal nodes that differ from the majority of the nodes in a graph, which has been attracting significant attention in recent years. Existing generalist graph models have achieved remarkable success in different graph tasks but struggle to generalize to the GAD task. This limitation arises from their difficulty in learning generalized knowledge for capturing the inherently infrequent, irregular and heterogeneous abnormality patterns in graphs from different domains. To address this challenge, we propose AnomalyGFM, a GAD-oriented graph foundation model that supports zero-shot inference and few-shot prompt tuning for GAD in diverse graph datasets. One key insight is that graph-agnostic representations for normal and abnormal classes are required to support effective zero/few-shot GAD across different graphs. Motivated by this, AnomalyGFM is pre-trained to align data-independent, learnable normal and abnormal class prototypes with node representation residuals (i.e., representation deviation of a node from its neighbors). The residual features essentially project the node information into a unified feature space where we can effectively measure the abnormality of nodes from different graphs in a consistent way. This provides a driving force for the learning of graph-agnostic, discriminative prototypes for the normal and abnormal classes, which can be used to enable zero-shot GAD on new graphs, including very large-scale graphs. If there are few-shot labeled normal nodes available in the new graphs, AnomalyGFM can further support prompt tuning to leverage these nodes for better adaptation. Comprehensive experiments on 11 widely-used GAD datasets with real anomalies, demonstrate that AnomalyGFM significantly outperforms state-of-the-art competing methods under both zero- and few-shot GAD settings.

Problem

• Generalize graph anomaly detection across domains
• Enable zero-shot and few-shot anomaly detection
• Develop graph-agnostic representations for abnormality patterns

Innovation

• Graph foundation model
• Zero-shot anomaly detection
• Few-shot prompt tuning