GFM4GA: Graph Foundation Model for Group Anomaly Detection

2026-01-15

AI Summary

This work addresses the challenge of detecting group anomalies—scenarios where individual entities appear normal, yet the collective exhibits anomalous behavior. To this end, we propose GFM4GA, the first graph foundation model tailored for group anomaly detection. Our approach employs a two-level contrastive pretraining strategy to capture inconsistencies in both structural and feature-level patterns across groups. Furthermore, we introduce a few-shot fine-tuning mechanism specifically designed for group-level characteristics, incorporating parameter constraints, anomaly ratio weighting, and neighbor-based anomaly context to enhance generalization to unseen group anomalies. Experimental results demonstrate that GFM4GA achieves average improvements of 2.85% and 2.55% in AUROC and AUPRC, respectively, significantly outperforming existing group anomaly detection methods and individual-level graph foundation models.

Technology Category

• Machine Learning: Graph-based Machine Learning
• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Multiagent Systems: Other Foundations of Multi Agent Systems

Application Category

• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs

Abstract

Group anomaly detection is crucial in many network applications, but faces challenges due to diverse anomaly patterns. Motivated by the success of large language models (LLMs) in natural language processing, graph foundation models (GFMs) is proposed to handle few-shot learning task with fewer labeling efforts. GFMs have been successfully applied to detection of individual anomalies but cannot be generalized to group anomalies, as group anomaly patterns must be detected as a whole and individuals in an abnormal group can look rather normal. Therefore, we propose GFM4GA, a novel graph foundation model for group anomaly detection. The pipeline is pretrained via dual-level contrastive learning based on feature-based estimation and group extraction, to capture potential group anomaly structure and feature inconsistencies. In the downstream tasks, the pipeline is finetuned in parameter-constrained and group-anomaly-proportion weighted few-shot settings, and its adaptive ability to unseen group anomalies expanded via group contexts determined by labeled anomaly neighbors. Experiments show that GFM4GA surpasses group anomaly detectors and GFMs for individual anomalies, achieving average improvements of 2.85% in AUROC and 2.55% in AUPRC.

Problem

• group anomaly detection
• graph foundation model
• few-shot learning
• anomaly patterns
• graph neural networks

Innovation

• Graph Foundation Model
• Group Anomaly Detection
• Few-shot Learning
• Contrastive Learning
• Anomaly Context Adaptation