Anomaly Detection in Networked Bandits

TL;DR

This paper introduces a novel bandit algorithm that leverages network information to personalize recommendations and detect anomalies in social networks, with proven regret bounds and experimental validation.

Contribution

It presents a new network-aware bandit algorithm that simultaneously learns user preferences and detects anomalies, advancing online learning in social network analysis.

Findings

Proven upper bound on the algorithm's regret.

Effective anomaly detection demonstrated on real-world data.

Outperforms existing collaborative bandit algorithms in experiments.

Abstract

The nodes' interconnections on a social network often reflect their dependencies and information-sharing behaviors. Nevertheless, abnormal nodes, which significantly deviate from most of the network concerning patterns or behaviors, can lead to grave consequences. Therefore, it is imperative to design efficient online learning algorithms that robustly learn users' preferences while simultaneously detecting anomalies. We introduce a novel bandit algorithm to address this problem. Through network knowledge, the method characterizes the users' preferences and residuals of feature information. By learning and analyzing these preferences and residuals, it develops a personalized recommendation strategy for each user and simultaneously detects anomalies. We rigorously prove an upper bound on the regret of the proposed algorithm and experimentally compare it with several state-of-the-art collaborative contextual bandit algorithms on both synthetic and real-world datasets.

Tables

Table 1. TABLE I : Notation

Problem-specific notations
$n$	Number of users
$𝒢$	The user connected graph
$𝒰$	The set of users
$\widetilde{𝒰}$	The set of anomalies
$ℰ$	The set of edges
$𝑾$	Adjacency matrix of user connected graph
$d$	Dimension of feature vectors
$T$	Total number of rounds
${𝜽}_i$	Feature vector of user $i$
${𝒗}_i$	Residual feature vector of user $i$
${𝒜}_{i,t}$	Set of context vectors of user $i$ at time $t$
${𝒙}_{a_t,u_t}$	The action of user $u_t$ at time $t$
$r_{u_t,a_t}$	Payoff of user $u_t$ at time $t$
$𝚯$	Global feature parameter matrix
$𝑽$	Global residual feature parameter matrix
${\mathring{𝑿}}_{a_t,u_t}$	Only the column corresponding to user $u_t$ is set to ${𝒙}_{a_t,u_t}^T$, the other columns are set to zero
$𝒥$	Support of $vec\left(𝑽\right)$ (see Remark 1)
$s_0$	Sparsity index of $vec\left(𝑽\right)$ (see Remark 1)
$𝚺$	Theoretical expected $d\times d$ covariance matrix
${\hat{\Sigma }}_{i,t}$	Empirical covariance matrix for user $i$
${𝒯}_{i,t}$	Time steps that user $i$ is selected until $t$
$\overline{𝚺}$	Multi-user theoretical expected covariance matrix
$\widehat{\overline{𝚺}}$	Multi-user empirical covariance matrix
${\lambda }_t$	Regularizer for Lasso at round $t$
${\lambda }_0$	Coefficient of the regularizer for Lasso
${\widehat{𝒥}}_0^t$, ${\widehat{𝒥}}_1^t$	Estimate of the support after the first and second thresholding, respectively
${\widehat{𝑽}}_t$	Estimated vector of $𝑽$

Equations

$$r_{a_t,u_t}$$

$$=vec({\mathring{\mathbf{X}}}_{a_t,u_t}{)}^{\top }vec(\mathbf{\Theta }\mathbf{W}+\mathbf{V})+{\eta }_t.$$

$$\displaystyle R(T)=\mathbb{E}\Big{[}\sum_{t=1}^{T}R_{t}\Big{]}=\mathbb{E}\Big{[}\sum_{t=1}^{T}(r_{a_{t}^{*},u_{t}}-r_{a_{t},u_{t}})\Big{]},$$

$$\underset{\mathbf{\Theta },\mathbf{V}}{\min }\frac{1}{2}\sum _{s=1}^t$$

$$+\frac{{\lambda }_1}{2}\text{norm}{vec(\mathbf{\Theta })}_2^2+\frac{{\lambda }_2}{2}\text{norm}{vec(\mathbf{V})}_2^2,$$

$$\underset{\mathbf{\Theta },\mathbf{V}}{\min }\frac{1}{2}\sum _{s=1}^t$$

$$+\frac{{\lambda }_1}{2}\text{norm}{vec(\mathbf{\Theta })}_2^2+\frac{{\lambda }_s}{2}\text{norm}{vec(\mathbf{V})}_1.$$

$$a_t=\arg \underset{a\in {\mathcal{A}}_{u_t,t}}{\max }$$

$$\displaystyle\quad+\alpha_{t}\norm{vec(\mathring{\boldsymbol{X}}_{a,u_{t}}\boldsymbol{W}^{\top})}_{\boldsymbol{A}_{t-1}^{-1}}\Big{)},$$

$${\mathbf{A}}_t\leftarrow {\mathbf{A}}_{t-1}+vec({\mathring{\mathbf{X}}}_{a_t,u_t}{\mathbf{W}}^{\top })vec({\mathring{\mathbf{X}}}_{a_t,u_t}{\mathbf{W}}^{\top }{)}^{\top }$$

$${\mathbf{b}}_t\leftarrow {\mathbf{b}}_{t-1}+vec({\mathring{\mathbf{X}}}_{a_t,u_t}{\mathbf{W}}^{\top })\times$$

$$(r_{a_t,u_t}-vec({\mathring{\mathbf{X}}}_{a_t,u_t}{)}^{\top }vec({\hat{\mathbf{V}}}_t))$$

$$vec({\hat{\mathbf{\Theta }}}_t)={\mathbf{A}}_t^{-1}{\mathbf{b}}_t$$

$$\mathcal{X}\leftarrow (vec({\mathring{\mathbf{X}}}_{a_1,u_1}),vec({\mathring{\mathbf{X}}}_{a_2,u_2}),\dots ,vec({\mathring{\mathbf{X}}}_{a_t,u_t}){)}^{\top },$$

$$\mathcal{R}\leftarrow (r_{a_1,u_1}-vec({\mathring{\mathbf{X}}}_{a_1,u_1}{)}^{\top }vec({\hat{\mathbf{\Theta }}}_1\mathbf{W}),\dots ,$$

$$r_{a_t,u_t}-vec({\mathring{\mathbf{X}}}_{a_t,u_t}{)}^{\top }vec({\hat{\mathbf{\Theta }}}_t\mathbf{W}))$$

$${\lambda }_t\leftarrow {\lambda }_0\sqrt{\frac{2\log t\log (nd)}{t}}$$

$${\hat{\mathbf{V}}}_0^t\leftarrow \arg \underset{\mathbf{V}}{\min }\frac{1}{t}\text{norm}{\mathcal{R}-\mathcal{X}\mathbf{V}}_2^2+{\lambda }_t\text{norm}{\mathbf{V}}_1$$

$${\hat{\mathcal{J}}}_0^t\leftarrow \{j\in [nd]:|{\hat{\mathbf{V}}}_0^t(j)|>4{\lambda }_t\}$$

$${\hat{\mathcal{J}}}_1^t\leftarrow \{j\in {\hat{\mathcal{J}}}_0^t:|{\hat{\mathbf{V}}}_0^t(j)|>4{\lambda }_t\sqrt{|{\hat{\mathcal{J}}}_0^t|}\}$$

$${\mathcal{X}}_J\leftarrow (vec({\mathring{\mathbf{X}}}_{a_1,u_1})({\hat{\mathcal{J}}}_1^t),\dots ,vec({\mathring{\mathbf{X}}}_{a_t,u_t})({\hat{J}}_1^t){)}^{\top }$$

$$vec({\hat{\mathbf{V}}}_t)\leftarrow \arg \underset{vec(\mathbf{V})}{\min }\text{norm}{\mathcal{R}-{\mathcal{X}}_{J}vec(\mathbf{V})}_2^2$$

$$\mathbb{E}$$

$${\omega }_{\mathcal{X}}\mathbb{E}[({\mathbf{x}}_{a_1}{\mathbf{x}}_{a_1}^{\top }+{\mathbf{x}}_{a_M}{\mathbf{x}}_{a_M}^{\top })\mathbb{I}\{{\mathbf{x}}_{a_1}^{\top }\mathbf{v}<\dots <{\mathbf{x}}_{a_M}^{\top }\mathbf{v}\}]$$

$$\mathbf{\Sigma }=\frac{1}{M}\mathbb{E}[\sum _{m=1}^M{\mathbf{x}}_m{\mathbf{x}}_m^{\top }]=\frac{1}{M}\sum _{m=1}^M{\mathbf{\Sigma }}_m,$$

$${\hat{\mathbf{\Sigma }}}_{i,t}=\frac{1}{|{\mathcal{T}}_{i,t}|}\sum _{s\in {\mathcal{T}}_{i,t}}{\mathbf{x}}_{i,s}{\mathbf{x}}_{i,s}^{\top },$$

$$\overline{\mathbf{\Sigma }}=diag(\mathbf{\Sigma },\dots ,\mathbf{\Sigma })$$

$${\widehat{\overline{\mathbf{\Sigma }}}}_t=diag({\hat{\mathbf{\Sigma }}}_{1,t},\dots ,{\hat{\mathbf{\Sigma }}}_{n,t}).$$

$$\text{norm}{\mathbf{\Delta }(\mathcal{J})}^2\le \frac{\text{norm}{\mathbf{\Delta }}_{\overline{\mathbf{\Sigma }}}^2}{{\varphi }^2(\overline{\mathbf{\Sigma }},\mathcal{J})}.$$

$$|\mathcal{B}|\le$$

$$\to \underset{\mathbf{l}\in {\mathbb{R}}^{|B|}:\text{norm}{\mathbf{l}}_2=1}{\min }{\mathbf{l}}^{\top }{\overline{\mathbf{\Sigma }}}_B\mathbf{l}\ge \beta ,$$

$$\text{norm}{vec({\hat{\mathbf{\Theta }}}_t)-vec(\mathbf{\Theta })}_{{\mathbf{A}}_t}$$

$$\mathbb{E}[R_t]\le \frac{4\nu {\omega }_{\mathcal{X}}}{\beta }2s_x{s}_{\theta }\sqrt{\frac{2}{t}\log (2d/\delta )}$$

$$+\frac{14h_0^2\sigma s_A\nu {\omega }_{\mathcal{X}}}{\beta }\sqrt{\frac{2(s_0+\frac{4\nu {\omega }_{\mathcal{X}}}{{\varphi }_0^2})}{t-1}}$$

$$+{\alpha }_t\text{norm}{vec({\mathring{\mathbf{X}}}_{a_t,u_t}{\mathbf{W}}^{\top })}_{{\mathbf{A}}_{t-1}^{-1}}+{\alpha }_t\text{norm}{vec({\mathring{\mathbf{X}}}_{a_t^{\ast },u_t}{\mathbf{W}}^{\top })}_{{\mathbf{A}}_{t-1}^{-1}}$$

$$\displaystyle\quad+2s_{1}s_{A}\Big{(}\mathbb{P}(\mathcal{D}_{t}^{c})+\mathbb{P}((\mathcal{L}_{t}^{\frac{\beta}{4\nu\omega_{\mathcal{X}}}})^{c}|\mathcal{D}_{t})\Big{)}.$$

$$R(T)$$

$$+O(s_A{s}_1\tau +\log s_0\sqrt{s_{0}T}).$$

$$\displaystyle R(T)\geq\Omega\Big{(}\xi d\sqrt{nT}+\sqrt{s_{0}T}\Big{)},$$

$$\mathbb{P}({\lambda }_{\min }(Y)\le (1-\delta )\mu \text{ and }$$

$$\le d(\frac{e^{-\delta }}{(1-\delta {)}^{1-\delta }}{)}^{\frac{\mu }{R}}.$$

$$\mathbb{P}(|\sum _{s=1}^t{Z}_s|\ge x)\le 2\exp (-\frac{x^2}{2t{\sigma }^2}).$$

Full text

We introduce a novel bandit algorithm to address this problem. Through network knowledge, the method characterizes the users’ preferences and residuals of feature information. By learning and analyzing these preferences and residuals, it develops a personalized recommendation strategy for each user and simultaneously detects anomalies. We rigorously prove an upper bound on the regret of the proposed algorithm and experimentally compare it with several state-of-the-art collaborative contextual bandit algorithms on both synthetic and real-world datasets.

I Introduction

Multi-armed bandit (MAB) is a prototypical solution for many applications, such as online advertising [1], personalized recommendation [2], etc. In the classical MAB setting, a decision-maker selects one action at each round and receives an instantaneous reward, aiming to find policies that maximize its cumulative rewards over all rounds.

We focus on a powerful MAB setting known as contextual bandits, where side information about users or items is available. In particular, each arm (action) has a feature vector known as “context”, and the expected payoff depends on the unknown bandit parameters and the given context. Contextual bandits offer significant advantages in large-scale applications [3] and have become a reference model for adaptive recommender systems [1, 4]. Recently, several researchers have studied contextual bandits in collaborative settings [5, 3, 6], where a network models the information-sharing and dependency among users. The potential affinities between pairs of users are beneficial to improving the action selection policy.

The state-of-the-art research assumes that the network structure accurately reflects users’ similarities or relationships. That assumption ignores the impact of anomalies/outliers in the network. Anomalies in a network are nodes that do not conform to the patterns of the majority [7]. Integrating the network structure information into the learning algorithm on one hand can effectively accelerate the learning process at each node. On the other hand, the existence of anomalies, if not handled properly, can easily mislead the collaborative system and significantly corrupt the algorithm’s performance. Thus, it is imperative to incorporate anomaly detection into online learning algorithms to mitigate the negative impact caused by these anomalies.

To better explain the practical relevance of anomaly detection, we offer concrete examples across various real-world scenarios. In social networks, anomalies often correspond to fake or bot users who exhibit interaction patterns that diverge significantly from typical user behavior, e.g., forming random or overly dense connections, or spreading misinformation [8]. In recommendation systems, anomalous behavior may stem from malicious users who inject biased profiles to manipulate item rankings, commonly known as shilling attacks [9]. Anomaly detection also plays a critical role in other areas, including scientific discovery [10, 11], fraud detection in financial systems [12, 13], and medical screening or diagnosis [14], where identifying rare or abnormal patterns can be crucial for decision-making.

In summary, anomaly detection aims to identify noteworthy items, events, or entities that do not conform to the expected patterns of the majority in a dataset [15, 16]. Various algorithms are proposed for anomaly detection; Nonetheless, they typically suffer from some limitations: Some do not fit sequential analysis or online learning [17]; some rely on the assumption that properties of anomalies are known in advance, which might not be true [7]; and many involve tuning several hyperparameters such as anomaly thresholds, which might lead to overfitting or poorly-calibrated alarm rates [17].

We address anomaly detection in networked contextual bandits, where anomalies refer to users whose behaviors or underlying feature vectors significantly deviate from those expected under the mutual influence structure of the network. Motivated by [7], we focus on residual analysis, where anomalies manifest as outliers in the deviation between observed and estimated collaborative user behavior. By characterizing the residuals of users’ features and leveraging the coherence between users’ features and network information, the anomalies can be detected. We further extend this idea to an online setting within the networked contextual bandit framework, enabling real-time anomaly detection and decision-making. Our main contributions are as follows.

• •

We are the first to formally formulate the networked bandits with anomalies problem, which extends traditional models by explicitly incorporating the possibility of anomalies within the networked structure. Our formulation removes the common assumption that the network structure perfectly mirrors user interactions, making it more applicable to real-world applications where anomalies exist and may interfere with collaborative learning.

• •

To address the formulated problem, we propose an algorithm called NEtworked LinUCB with Anomaly detection (NELA), which integrates two key functions: Learning users’ preferences and detecting anomalies in a networked system. This dual-function approach allows NELA to robustly estimate the bandit parameters for all users, utilizing network information to efficiently reduce the sample complexity for preference learning and minimize regret. Based on the estimated global bandit parameters, NELA accurately detects anomalies. To the best of our knowledge, NELA is the first framework to address these two problems concurrently.

• •

We rigorously prove the regret of NELA is upper bounded by $O(dn\log(1+\frac{\sum_{t=1}^{T}\sum_{j=1}^{n}\boldsymbol{W}(u_{t},j)^{2}}{dn\lambda_{1}})\sqrt{T}+s_{A}s_{1}\tau+\log s_{0}\sqrt{s_{0}T})$ and also provide an $\Omega(\xi d\sqrt{nT}+\sqrt{s_{0}T})$ regret lower bound with $\xi\in[1,\sqrt{n}]$. In addition, we prove the correctness of NELA in anomaly detection theoretically.

• •

Extensive experiments on both synthetic and real-world datasets demonstrate the effectiveness and superior performance of our proposed algorithm compared to the state-of-the-art methods.

The remainder of the paper is organized as follows. Section II reviews the related work. In Section III, we formulate the anomaly detection problem in networked bandits. Section IV presents the details of the proposed algorithm, Networked LinUCB with Anomaly Detection (NELA). Theoretical analysis is discussed in Section V. To evaluate the effectiveness of the proposed algorithm, we conduct experiments on both synthetic and real-world datasets, as described in Section VI. Finally, we conclude our work and highlight the directions of future work in Section VII.

II Related Work

Previous research actively explores exploiting users’ social relationships to accelerate bandit learning. To adaptively learn and utilize unknown user relations, [18] and [19] initially propose clustering of bandits problems, which, however, suffer from the irreversible splitting of clusters. Reference [20] introduces an improved algorithm that uses sets to represent clusters, allowing split and merge actions at each time step. In addition, authors in [21] solve the clustering of bandits problem with a game-theoretic approach.

Some researchers use social network topologies to enhance algorithm performance. Reference [5] combines contextual bandits with the social graph information, proposing the GOB algorithm that allows signal-sharing among users by exploiting the network structure. Similarly, Wu et al. [3] investigate scenarios when neighboring users’ judgments influence each other through shared information. Reference [6] improves GOB by using the random-walk graph Laplacian to model the signal smoothness among the feature vectors of users and addresses the high scaling complexity problem of GOB.

Another line of related work is anomaly/outlier detection. Several papers study outlier detection in the MAB framework; Nonetheless, they focus on either identifying arms whose expected rewards deviate significantly from the majority [22, 23, 24] or selecting a single anomalous node or link for a human expert to evaluate [16, 25, 26]. These approaches are typically limited to addressing a single task at a time. In contrast, the challenge of identifying outliers in multi-user systems during interaction through users’ action selection remains less explored. Besides, some anomaly detection research focuses on attributed networks [27, 28, 7, 29]. In [27], the authors infer user preferences. They then simultaneously form clusters and find outliers according to the inferred user preferences. Reference [7] proposes a learning framework to model the residuals of attribute information and its coherence with network information for anomaly detection.

III Problem Formulation

Notations: We denote vectors by bold lowercase letters, matrices by bold uppercase letters, and sets or events by calligraphic fonts. The notation $[\cdot]$ represents a set of integers within a specific range (e.g., $[d]$ represents $\{1,\ldots,d\}$). We represent the $i$-th row of matrix $\boldsymbol{A}$ as $\boldsymbol{A}(i,:)$, the $j$-th column as $\boldsymbol{A}(:,j)$ and the $(i,j)$-th entry as $\boldsymbol{A}(i,j)$. $\norm{\boldsymbol{x}}_{p}$ denotes the $p-$norm of a vector $\boldsymbol{x}$ and the weighted $2-$norm of vector $\boldsymbol{x}$ is defined by $\norm{\boldsymbol{x}}_{\boldsymbol{A}}=\sqrt{\boldsymbol{x}^{\top}\boldsymbol{A}\boldsymbol{x}}$. The inner product is denoted by $\langle\cdot,\cdot\rangle$. $vec(\cdot)$ denotes the vectorize operation. Table I summarizes important definitions.

We consider a known network graph, $\mathcal{G}=\{\mathcal{U},\mathcal{E}\}$, where $\mathcal{U}=\{1,2,\ldots,n\}$ denotes the set of $n$ users and $\mathcal{E}$ represents the set of edges encoding affinities between users. The set of abnormal users is denoted by $\tilde{\mathcal{U}}\subseteq\mathcal{U}$. We represent the network structure using a weighted matrix $\boldsymbol{W}\in\mathbb{R}^{n\times n}$. Similar to the settings in [3], each element $\boldsymbol{W}(i,j)$ of $\boldsymbol{W}$ is non-negative and proportional to the influence that user $i$ has on user $j$ in determining the payoffs. $\boldsymbol{W}$ is column-wise normalized such that $\sum_{i=1}^{n}\boldsymbol{W}(i,j)=1$ for $j\in\mathcal{V}$. We assume $\boldsymbol{W}$ is time-invariant and known to the learner beforehand.

Each user $i\in\mathcal{U}$ has an unknown feature vector $\boldsymbol{\theta}_{i}\in\mathbb{R}^{d}$. We collect these vectors in the global feature parameter matrix $\boldsymbol{\Theta}=(\boldsymbol{\theta}_{1},\ldots,\boldsymbol{\theta}_{n})\in\mathbb{R}^{d\times n}$. At each time step $t=1,2,\ldots,T$, a user $u_{t}\in\mathcal{U}$ appears uniformly at random. Given a set $\mathcal{A}_{t}\subset\mathbb{R}^{d}$ consisting of $M$ arms, the learner selects an arm $\boldsymbol{x}_{t}$ to recommend to $u_{t}$, and obtains a payoff $r_{t}$. If $\mathcal{F}_{t}$ is the $\sigma$-algebra generated by random variables $(\mathcal{A}_{1},\boldsymbol{x}_{1},r_{1},\ldots,\mathcal{A}_{t-1},\boldsymbol{x}_{t-1},r_{t-1},\mathcal{A}_{t})$, $\boldsymbol{x}_{t}$ is $\mathcal{F}_{t}$-measurable.

Previous work considers only the mutual influence among users [3, 30], resulting in a payoff $r_{t}=\boldsymbol{x}_{t}^{\top}\boldsymbol{\Theta}\boldsymbol{W}(:,u_{t})+\eta_{t}$, where $\eta_{t}\sim\mathcal{N}(0,\sigma^{2})$ is a zero mean sub-Gaussian random variable with variance $\sigma^{2}$ given $\mathcal{F}_{t}$. However, such assumptions may not hold in the presence of anomalies, since anomalous behaviors do not conform to the patterns of the majority. To measure users’ feature vectors’ deviation from network-based collaborative model $\boldsymbol{\Theta}\boldsymbol{W}$, we associate each user $i\in\mathcal{U}$ with an unknown residual feature vector $\boldsymbol{v}_{i}\in\mathbb{R}^{d}$. The global residual parameter matrix yields $\boldsymbol{V}=(\boldsymbol{v}_{1},\ldots,\boldsymbol{v}_{n})\in\mathbb{R}^{d\times n}$. We define the bandit parameter matrix as $\overline{\boldsymbol{\Theta}}=\boldsymbol{\Theta}\boldsymbol{W}+\boldsymbol{V}$, which determines the reward. This additive-deviation formulation models anomalies as unusual individual behaviors that deviate from the group-level influence pattern, following the approach in [31, 7, 29] and we extend it to the online setting. Under this assumption, the payoff for user $u_{t}$’s jointly determined by (i) mutual influences from other users through $\boldsymbol{\Theta}\boldsymbol{W}$ and and (ii) the user’s personal residual feature vector $\boldsymbol{V}$

[TABLE]

In (1), $\mathring{\boldsymbol{X}}_{a_{t},u_{t}}=(\boldsymbol{0},\ldots,\boldsymbol{x}_{a_{t},u_{t}},\ldots,\boldsymbol{0})\in\mathbb{R}^{d\times n}$ denotes the matrix, where the column corresponding to user $u_{t}$ is $\boldsymbol{x}_{a_{t},u_{t}}^{\top}$, and the rest is zero.

The learner intends to learn a selection strategy that minimizes the cumulative regret with respect to an optimal strategy. Formally, the cumulative regret yields

[TABLE]

where $u_{t}$ is the user served at $t$ and $r_{a_{t}^{*},u_{t}}$ is the corresponding optimal payoff with respect to user $u_{t}$. The user $u_{t}$ is sampled uniformly at random from the entire user set. To support the primary goal of regret minimization, accurate anomaly detection becomes a necessary secondary objective. Specifically, at each round $t$, the learner will also select a set of users $\tilde{\mathcal{U}}_{t}$ as detected anomalies, and the objective is to make $\tilde{\mathcal{U}}_{t}$ as close to the ground-truth set of anomalies $\tilde{\mathcal{U}}$ as possible. Formally, the secondary objective is two-fold: i) guarantee that all true anomalies are included, i.e., $\tilde{\mathcal{U}}\subseteq\tilde{\mathcal{U}}_{t}$; ii) minimize the number of normal users mistakenly identified as anomalies, i.e., bound $|\tilde{\mathcal{U}}_{t}\setminus\tilde{\mathcal{U}}|$.

In the following, we state some assumptions on feature and residual vectors.

Assumption 1** (Anomaly Residual Feature Vector).**

The deviation of node $i$’s behavior from the expected behavior modeled by the network-based global model $\boldsymbol{\Theta}\boldsymbol{W}$ is represented by $\boldsymbol{v}_{i}$. In the absence of anomalies, users are expected to follow the mutual influence structure encoded by the graph, and hence their residual vectors vanish, i.e. $\norm{\boldsymbol{v}_{i}}=0$. In contrast, a large residual norm indicates that the user’s actions deviate significantly from what the network would predict, indicating anomalous behavior. Therefore, we assume a user to be anomalous if $\norm{\boldsymbol{v}_{i}}>\gamma>0$. This formulation is inspired by [7], where anomalies are modeled as violations of low-rank structure in an offline matrix setting. Our model explicitly considers the residual deviation of feature vectors, making it compatible with online contextual bandit settings.

Remark 1** (Jointly Sparsity).**

Since anomalies occur less frequently than normal users, the global residual feature vector $vec(\boldsymbol{V})\in\mathbb{R}^{nd}$ is a sparse vector. Define $\mathcal{J}(\boldsymbol{v}_{i})=\{j\in[d],\boldsymbol{v}_{i}(j)\neq 0\}$ as the sparsity pattern with respect to single-user residual vector $\boldsymbol{v}_{i}$, representing the subset of $|\mathcal{J}(\boldsymbol{v}_{i})|$ non-zero components of vector $\boldsymbol{v}_{i}\in\mathbb{R}^{d}$. There is a set $\mathcal{J}\subset[nd]$ such that $\mathcal{J}(\boldsymbol{v}_{i})\subset\mathcal{J},\quad\forall i\in\mathcal{U}$.

Assumption 2**.**

Let $s_{0}=|\mathcal{J}|$ denote the joint sparsity of the global residual vector $vec(\boldsymbol{V})$, where $s_{0}\ll nd$. Under the sparsity assumption, the minimum nonzero entry satisfies $vec(\boldsymbol{V})_{\min}\geq\gamma/\sqrt{d}$. We further assume that the residual vector is bounded in both $\ell_{1}$ and $\ell_{2}$ norms: $\norm{vec(\boldsymbol{V})}_{1}\leq s_{1}$ and $\norm{vec(\boldsymbol{V})}\leq s_{v}$. In addition, we assume the context vectors are bounded in $\ell_{2}$ and $\ell_{\infty}$ norms: for all $t$ and all $\boldsymbol{x}\in\mathcal{A}_{u_{t},t}$, $\norm{\boldsymbol{x}}_{2}\leq s_{x}$, and $\norm{\boldsymbol{x}}_{\infty}\leq s_{A}$. Finally, we assume the global parameter vector is also bounded: $\norm{vec(\boldsymbol{\Theta})}\leq s_{\theta}$.

IV Algorithm

In this section, we introduce the NELA algorithm, which jointly learns users’ feature vectors while simultaneously estimating their residuals to detect anomalies. Algorithm 1 presents the pseudocode.

Accurate estimation of the global feature vector is critical for minimizing regret. Moreover, since anomalies are encoded in the residual component $\boldsymbol{V}$, accurately estimating $\boldsymbol{V}$ serves as a sufficient condition for effective anomaly detection. NELA algorithm maintains a profile $(\boldsymbol{A}_{t},\boldsymbol{b}_{t})$ for the global feature vector $\boldsymbol{\Theta}$ estimation and tracks the estimation of $\boldsymbol{V}$ for anomaly detections. With the expected payoff in (1), it is natural to deploy regularized regression to estimate the global feature matrix $\boldsymbol{\Theta}$ and residual matrix $\boldsymbol{V}$ at round $t$ as follows,

[TABLE]

where $\lambda_{1}$ and $\lambda_{2}$ is parameters of $l_{2}$ regularization in ridge regression. The closed-form solutions of (3) are easy to obtain via the alternating least square method with ridge regression. However, this can result in a term $O(\sqrt{ndT})$ in regret that scales polynomially with $vec(\boldsymbol{V})$’s dimension $nd$. In modern systems with thousands of users, this significantly increases the regret and the number of interactions required before anomalies are detected. To address the full dimensionality-dependence term in regret, we further reformulate the objective function (3) considering the sparse property of $vec(\boldsymbol{V})$ as follows

[TABLE]

Therefore, by carefully selecting parameter $\lambda_{s}$, $s\in[t]$ and applying lasso estimator, the regret term $O(\sqrt{ndT})$ can be reduced to $\mathcal{O}(\log(s_{0})\sqrt{s_{0}T})$ with $s_{0}\ll nd$. We solve the optimization problem (4) using a widely employed alternating method: fixing one parameter and solving for the other iteratively with closed-form solutions [30, 32]. The closed-form solutions are given by $vec(\widehat{\boldsymbol{\Theta}}_{t})=\boldsymbol{A}_{t}^{-1}\boldsymbol{b}_{t}$ and $vec(\widehat{\boldsymbol{V}}_{t})=\arg\min_{vec(\boldsymbol{V})}\norm{\mathcal{R}-\mathcal{X}_{J}vec(\boldsymbol{V})}_{2}^{2}$, where the detailed computation of $(\boldsymbol{A}_{t},\boldsymbol{b}_{t},\mathcal{R},\mathcal{X}_{J})$ can be found in Algorithm 1 (line 8).

At round $t$, a user $u_{t}$ appears to be severed and the arm set $\mathcal{A}_{u_{t},t}$ arrives for the learner to choose from. The learner chooses the arm for user $u_{t}$ according to the following strategy

[TABLE]

where $\alpha_{t}$ is a parameter that characterizes the upper bound for the estimation of $vec(\widehat{\boldsymbol{\Theta}}_{t})$. See Lemma 1 for more details. Specifically, the solution for $\widehat{\boldsymbol{\Theta}}_{t}$ is obtained using a ridge-regression approach with a fixed $\widehat{\boldsymbol{V}}_{t}$ and $\widehat{\boldsymbol{V}}_{t}$ is determined using a thresholded bandit algorithm [33] with a fixed $\widehat{\boldsymbol{\Theta}}_{t}$.

To reduce false alarms in anomaly detection, NELA incorporates a two-step thresholding mechanism. After obtaining an initial estimate $\widehat{\boldsymbol{V}}_{0}$ of the residual matrix $\boldsymbol{V}$, each component is compared against a predefined threshold to produce a preliminary estimate of the support of $\boldsymbol{V}$. A second thresholding step with a larger threshold is then applied to further eliminate potential false positives by filtering out remaining normal users. This two-stage process enhances both the accuracy of anomaly detection and the estimation quality of the residual vector.

In fact, anomaly detection and residual estimation in NELA are not isolated tasks, but mutually reinforcing processes. Detecting anomalies corresponds to identifying the support set of the residual vector $\boldsymbol{V}$. A more accurate estimate of this support set, denoted by $\hat{\mathcal{J}}_{1}^{t}$, leads to a sparser and more targeted estimation of the residual vector $vec(\widehat{\boldsymbol{V}}_{t})$. Conversely, a more precise estimate of $\boldsymbol{V}$ provides a clearer signal for support detection, enhancing the reliability of anomaly identification in subsequent rounds. NELA explicitly makes use of this synergy, iteratively refining both the residual estimation and the detected anomaly set $\tilde{\mathcal{U}}_{t}$, resulting in low false alarm rates and improved learning performance.

V Theoretical Analysis

In this section, we present a theoretical analysis of the proposed algorithm, NELA. We begin by outlining the key assumptions required for our analysis. Based on these assumptions, we then establish performance guarantees for NELA in terms of regret bounds and anomaly detection.

V-A Assumptions

We use the following assumptions throughout the analysis. Specially, Assumptions 3, 4, and 5 are standard assumptions for sparse linear bandits [34, 33], with adaptation to a multi-user setting. Definition 1 guarantees the compatibility conditions in a multi-user setting, similar to the RSC condition in [35].

Assumption 3** (Context Distribution).**

At round $t$, the arm set $\mathcal{A}_{u_{t},t}\subset\mathbb{R}^{d}$ consists of $M$ $d$-dimensional vectors $\boldsymbol{x}_{m}$. The tuples $\mathcal{A}_{u_{1},1},\ldots,\mathcal{A}_{u_{t},t}$ are i.i.d. and follow a fixed unknown zero mean sub-Gaussian joint distribution $p$ on $\mathbb{R}^{Md}$ [34, 33].

Assumption 4** (Arm Distribution).**

There exists a constant $\nu<\infty$, such that $p(-\bar{\boldsymbol{x}})/p(\bar{\boldsymbol{x}})\leq\nu$, $\forall\bar{\boldsymbol{x}}\in\mathbb{R}^{Md}$. Moreover, there exists a constant $\omega_{\mathcal{X}}<\infty$ such that, for any permutation $(a_{1},a_{2},\ldots,a_{M})$ of $[M]$, any integer $m\in\{2,\ldots,M-1\}$ and any fixed $\boldsymbol{v}$, it holds [34, 33]

[TABLE]

Parameter $\nu$ in Assumption 4 characterizes the skewness of the arm distribution $p$; for symmetrical distributions $\nu=1$. Assumption 4 is satisfied for a large class of distributions, e.g., Gaussian, multi-dimensional uniform, and Bernoulli [33, 35]. The value $\omega_{\mathcal{X}}$ captures dependencies between arms, the more positively correlated they are, the smaller $\omega_{\mathcal{X}}$ will be. When arms are generated i.i.d. from a multi-variate Gaussian or multi-variate uniform distribution over the sphere we have $\omega_{\mathcal{X}}=O(1)$ [33, 35].

We further define the covariance matrices for multi-user systems. First, we define the theoretical averaged $d\times d$ covariance matrix as

[TABLE]

where the expectation is over the decision set sampling distribution $p$, which is assumed to be shared between users. For every $i\in\mathcal{U}$, denote the empirical covariance matrix as

[TABLE]

where $\mathcal{T}_{i,t}$ is the set collects the rounds that user $i$ is served. We use the notation $\overline{\boldsymbol{\Sigma}}$ and $\widehat{\overline{\boldsymbol{\Sigma}}}_{t}\in\mathbb{R}^{dn\times dn}$ for the theoretical and empirical multi-user matrices respectively. They are both block diagonal and composed of the corresponding $n$ single user $d\times d$ matrices on the diagonal, that is

[TABLE]

Definition 1** (Compatibility Conditions).**

Let $\overline{\boldsymbol{\Sigma}}\in\mathbb{R}^{nd\times nd}$ be the multi-user covariance matrix and $\mathcal{J}\subset[nd]$. We say that $\mathcal{J}$ satisfies the compatibility conditions with constant $\phi(\overline{\boldsymbol{\Sigma}},\mathcal{J})>0$, if $\forall\boldsymbol{\Delta}\in\mathbb{R}^{nd}\backslash\{\boldsymbol{0}\}$ such that $\sum_{j\in\mathcal{J}^{c}}\norm{\boldsymbol{\Delta}(j)}\leq 3\sum_{j\in\mathcal{J}}\norm{\boldsymbol{\Delta}(j)}$, where $\mathcal{J}^{c}$ is the complement of $\mathcal{J}$, it holds [35]

[TABLE]

We assume that $\phi_{0}^{2}>0$ is the lower bound of $\phi^{2}(\overline{\boldsymbol{\Sigma}},\mathcal{J})$.

Assumption 5** (Sparse Positive Definiteness).**

Define for each $\mathcal{B}\subset[nd]$, $\overline{\boldsymbol{\Sigma}}_{B}=\frac{1}{M}\mathbb{E}[\sum_{m=1}^{M}\boldsymbol{X}_{m}(\mathcal{B})\boldsymbol{X}_{m}(\mathcal{B})^{\top}]$, where $\boldsymbol{X}_{m}$ is a $nd$-dimensional vector that satisfying $\overline{\boldsymbol{\Sigma}}=\frac{1}{M}\mathbb{E}[\sum_{m=1}^{M}\boldsymbol{X}_{m}\boldsymbol{X}_{m}^{\top}]$. All the expectations here are over the decision set sampling distribution $p$. $\boldsymbol{X}_{m}(\mathcal{B})$ is a $|\mathcal{B}|$-dimensional vector, which is extracted from the elements of $\boldsymbol{X}_{m}$ with indices in $\mathcal{B}$. There exists a positive constant $\beta>0$ such that $\forall\mathcal{B}\subset[nd]$ [33],

[TABLE]

where the parameters $\phi_{0}$, $\nu$, $\omega_{\mathcal{X}}$ are defined in Assumptions 3,4 and Definition 1.

Assumption 5 ensures that the context distribution is sufficiently diverse to allow reliable estimation of the residual vectors corresponding to anomalies. This assumption is specifically leveraged in analyzing the regression performance over the low-dimensional subspace defined by the active residual indices $\hat{\mathcal{J}}_{1}^{t}$. We also emphasize that Assumptions 1-5 are introduced solely to facilitate theoretical analysis and may not strictly hold in empirical settings.

V-B Performance Guarantee

First, we prove the estimation error of $\boldsymbol{\Theta}$ is bounded with high probability in the following Lemma 1.

Lemma 1**.**

With probability at least $1-\delta$, it holds

[TABLE]

We use $\alpha_{t}$ to denote the upper bound of $\norm{vec(\widehat{\boldsymbol{\Theta}}_{t})-vec(\boldsymbol{\Theta})}_{\boldsymbol{A}_{t}}$ for all $t\in[T]$.

Proof.

See Appendix -B. ∎

Then, we demonstrate the performance guarantee in terms of anomaly detection in the following Lemma 2.

Lemma 2** (Estimation of the Support & Anomaly Detection).**

Let $t\geq\frac{2\log(2n^{2}d^{2})}{C_{0}^{2}}$ such that 4\Big{(}\frac{4\nu\omega_{\mathcal{X}}s_{0}}{\phi_{0}^{2}}+\sqrt{(1+\frac{4\nu\omega_{\mathcal{X}}}{\phi_{0}^{2}})s_{0}}\Big{)}\lambda_{t}\leq\gamma/\sqrt{d}\leq vec(\boldsymbol{V})_{\min}, where $vec(\boldsymbol{V})_{\min}$ refers to the smallest non-zero entry. Under Assumptions 1-4, the detected anomaly set includes all anomalous users and the false alarm is bounded with high probability, i.e., $\mathbb{P}(\tilde{\mathcal{U}}\subset\tilde{\mathcal{U}}_{t}$ and $|\tilde{\mathcal{U}}_{t}\backslash\tilde{\mathcal{U}}|\leq\frac{4\nu\omega_{\mathcal{X}}\sqrt{s_{0}}}{\phi_{0}^{2}})\geq 1-2\exp(-\frac{t\lambda_{t}^{2}}{32\sigma^{2}s_{A}^{2}}+\log nd)-\exp(-\frac{tC_{0}^{2}}{2})$.

Proof.

See Appendix -C. ∎

Based on previous Lemmas, we can derive an upper bound on the instantaneous regret.

Lemma 3**.**

Under Assumptions 1-5, define event $\mathcal{D}_{t}=\{\mathcal{J}\subset\hat{\mathcal{J}}_{1}^{t}\quad and\quad|\hat{\mathcal{J}}_{1}^{t}\backslash\mathcal{J}|\leq\frac{4\nu\omega_{\mathcal{X}}\sqrt{s_{0}}}{\phi_{0}^{2}}\}$ and event \mathcal{L}_{t}^{\frac{\beta}{4\nu\omega_{\mathcal{X}}}}=\Big{\{}\lambda_{\min}(\widehat{\overline{\boldsymbol{\Sigma}}}_{t,\hat{\mathcal{J}}})\geq\frac{\beta}{4\nu\omega_{\mathcal{X}}}\Big{\}}, where $\widehat{\overline{\boldsymbol{\Sigma}}}_{t,\hat{J}}=\frac{1}{t}\sum_{s=1}^{t}vec(\mathring{\boldsymbol{X}}_{a_{s},u_{s}})(\hat{\mathcal{J}})vec(\mathring{\boldsymbol{X}}_{a_{s},u_{s}})(\hat{\mathcal{J}})^{\top}$ is the empirical Gram matrix on the estimated support with $\hat{\mathcal{J}}_{1}^{t}=\hat{\mathcal{J}}$ for simplicity. For any $t$, the instantaneous regret of NELA is bounded by

[TABLE]

The probability of events $\mathcal{D}_{t}$ and $\mathcal{L}_{t}^{\frac{\beta}{4\nu\omega_{\mathcal{X}}}}$ are associated with Lemma 2 and Lemma 10 and  12 in Appendix -A.

Proof.

See Appendix -D. ∎

Define \tau=\max\Big{(}\lfloor\frac{2\log(2n^{2}d^{2})}{C_{0}^{2}}(\log s_{0})(\log\log nd)\rfloor,\\ \frac{d}{16\lambda_{0}^{2}\log(nd)C_{1}^{2}\gamma^{2}}\log(\frac{d}{\lambda_{0}^{2}\log(nd)C_{1}^{2}\gamma^{2}})\Big{)} with $C_{0}=\min\{\frac{1}{2},\frac{\phi_{0}^{2}}{512s_{0}s_{A}^{2}\nu\omega_{\mathcal{X}}}\}$, $C_{1}=\frac{4\nu\omega_{\mathcal{X}}s_{0}}{\phi_{0}^{2}}+\sqrt{(1+\frac{4\nu\omega_{\mathcal{X}}}{\phi_{0}^{2}})s_{0}}$. The following theorem provides a regret upper bound for NELA algorithm.

Theorem 1**.**

Under Assumptions 1-5, for all $T\geq\tau$, with probability at least $1-\delta$, the regret of NELA algorithm satisfies

[TABLE]

Proof.

See Appendix -E. ∎

Remark 2**.**

The regret bound consists of three main terms: O\Big{(}dn\log(1+\frac{\sum_{t=1}^{T}\sum_{j=1}^{n}\boldsymbol{W}(u_{t},j)^{2}}{dn\lambda_{1}})\sqrt{T}\Big{)}, $O(s_{A}s_{1}\tau)$ and $O(\log s_{0}\sqrt{s_{0}T})$. The first term O\Big{(}dn\log(1+\frac{\sum_{t=1}^{T}\sum_{j=1}^{n}\boldsymbol{W}(u_{t},j)^{2}}{dn\lambda_{1}})\sqrt{T}\Big{)} captures how the graph structure influences regret. When users are isolated (i.e., no influence, $\boldsymbol{W}$ is an identity matrix), this term reduces to the standard linear bandit regret, $O(dn\log(1+\frac{T}{dn\lambda_{1}})\sqrt{T})$. No collaborative benefit is possible in this case. When the graph is fully connected and uniform (i.e., each user equally influences all others, $\boldsymbol{W}(i,j)=1/n,\forall i,j\in\mathcal{U}$), the regret can improve to $O(dn\log(1+\frac{T}{n^{2}d\lambda_{1}})\sqrt{T})$ due to increased collaborative information. In general, collaboration helps when the influence weights are distributed broadly across many neighbors, i.e. low concentration in $\sum_{j=1}^{n}\boldsymbol{W}(u_{t},j)^{2}$, $\forall u_{t}\in\mathcal{U}$, as this increases the effective sample size for each user while highly skewed or low-connectivity patterns yield smaller gains.

The second term $O(s_{A}s_{1}\tau)$ characterizes the difficulty of identifying sparse anomalies. Larger $\gamma$ makes detection easier (smaller $\tau$), reducing this term. The term $O(\log s_{0}\sqrt{s_{0}T})$ accounts for the influence of anomalous deviations, with $s_{0}$ being proportional to the number of anomalies and $s_{0}\ll nd$. In the absence of anomalies, our setting degenerates to the classical collaborative networked bandit setting, as described in [3].

Remark 3**.**

The regret bound in (13) does not explicitly depend on the positions of anomalies in the network. This stems from the model formulation, where each user $i$’s feature vector is decomposed as $\boldsymbol{\theta}_{i}+\boldsymbol{v}_{i}$, with $\boldsymbol{\theta}_{i}$ governing collaborative behavior under the graph structure defined by $\boldsymbol{W}$ and $\boldsymbol{v}_{i}$ representing sparse anomalous deviations. As a result, the mutual influence and learning benefit across the graph are determined solely by the clean feature matrix $\boldsymbol{\Theta}$, not by the locations of anomalous nodes.

In the regret analysis, the contribution of anomalies is captured through global sparsity parameters such as $s_{0}$ and the incorrect detection is controlled within a bounded time window $\tau$. Any potential effect of anomaly position, if it exists, is therefore transient and bounded in the early phase of learning, and does not dominate the overall regret.

Theorem 2**.**

Under Assumptions 1-5, for all $T\geq 2$, and any learning algorithm $\pi$, there exists a networked linear bandit instance such that the regret is lower bounded by

[TABLE]

where $\xi\in[1,\sqrt{n}]$ is a problem-dependent scalar that captures how much collaborative information can be shared across users. If all users share the same parameter vector $\boldsymbol{\theta}$ and the matrix $\boldsymbol{W}$ is fully mixing (each user aggregates information uniformly from others), then $\xi=1$, while if users are completely isolated (no information sharing, $\boldsymbol{W}=\boldsymbol{I}$ ) and each user has an independent $\boldsymbol{\theta}$, then $\xi=\sqrt{n}$.

Proof.

See Appendix -F. ∎

Remark 4**.**

The computational scalability of NELA is influenced by the number of users $n$, the dimension $d$, as the matrix $\boldsymbol{A}_{t}$ in Algorithm 1 is of size $nd\times nd$, potentially limiting the scalability of NELA in very large systems. However, this behavior is consistent with that of existing graph-based contextual bandit algorithms [5, 3]. Besides, NELA leverages the sparsity in the graph structure (i.e., sparse $\boldsymbol{W}$) and the anomaly patterns (sparse $\boldsymbol{v}_{i}$), which helps reduce the effective dimensionality and computational burden in practice.

VI Experiments

We test the performance of our proposed algorithm on both synthetic and real-world datasets. Besides, we compare our algorithm with the following state-of-the-art algorithms:

• •

CoLin [3]: Each user shares their instantaneous payoff with neighbors in the graph. The users determine the payoff jointly by using a collaborative bandit algorithm;

• •

GraphUCB [6]: Each user shares their instantaneous payoff with neighbors in the graph and the feature vectors of users are smoothed along the graph;

• •

nLinUCB: The algorithm maintains $n$ independent LinUCB algorithms [36] for each user, where the bandit uses no graph information;

• •

LinUCB: The algorithm maintains a single LinUCB algorithm for $n$ users globally, equivalent to running GraphUCB with an identity Laplacian matrix or the CoLin algorithm with an identity weight matrix.

All the results are based on the average of ten independent runs. In all experiments, we set the confidence probability parameter $\delta=0.001$, noise variance $\sigma=0.01$, regularized parameter $\lambda_{0}=0.02$ and $\lambda_{1}=1$. We observed that the algorithm is not overly sensitive to moderate changes in these hyperparameters. Therefore, we select hyperparameters in consistent with [6, 33]. To ensure a controlled and fair comparison, all experimental settings are held constant across different runs within the same experiment.

VI-A Experiment on Toy Examples

We first present experiments on toy examples to better explain our algorithm. Specifically, we implemt with two types of graph structures: undirected star graphs and fully connected graphs (Figure 1), aiming to validate the effectiveness of collaboration among agents under different graph structures. We assume that the users are homogeneous, with each having an equal influence on its neighbors ($\boldsymbol{W}(i,j)=1/(1+\sum_{j=1}^{n}\mathbbm{1}(e(i,j)\in\mathcal{E}))$) and node 1 is designated as an anomaly. At each round $t$, we sample arm set $\mathcal{A}_{u_{t},t}$ from a multivariate Gaussian distribution $\mathcal{N}(\boldsymbol{0}_{M},V)$, where $M=50$, $V_{i,i}=1$ for all $i\in[M]$, and $V_{i,m}=\rho^{2}=0.7$ for all $i\neq k$. We then normalize the context vectors so that $\norm{\boldsymbol{x}}\leq 1$ for all $\boldsymbol{x}\in\mathcal{A}_{u_{t},t}$. We test various levels of $\gamma$ representing the degree to which the anomaly deviates from the majority. The results are presented in Figure 2.

In Figure 2, plots with dashed lines are results obtained from experiments on a star graph, while plots with solid lines are results obtained from experiments on a fully connected graph. According to Figure 2, NELA and GraphUCB demonstrate better performance on fully connected graphs compared to star graphs. This improvement arises because of effective use of the graph structure, which enables greater collaboration among agents as the number of connections increases. In contrast, the CoLin algorithm, although it also incorporates graph information, performs worse on fully connected graphs. This is because CoLin assumes fully cooperative scenarios, making it more vulnerable to performance degradation in the presence of anomalies. Meanwhile, the performance of nLinUCB and LinUCB shows little variation between the two graph structures and under varying $\gamma$, as these algorithms treat each node independently, disregarding the network structure.

When $\gamma$ is very small ($\gamma<0.5$), all algorithms perform similarly, with NELA and CoLin achieving the best results. At these low values of $\gamma$, the influence of the anomaly is minimal and can be even ignored, allowing collaboration among agents to significantly enhance performance. However, as $\gamma$ increases, regrets also rise, with the most significant deterioration observed in the CoLin algorithm. At larger $\gamma$, the perturbations caused by anomalies become more pronounced, disrupting the ideal assumption that all nodes adhere to the same behavior pattern. This mismatch exacerbates CoLin’s reliance on collaboration, magnifying the detrimental impact of anomalies on performance.

Under the star graph, LinUCB and nLinUCB algorithms outperform NELA when $\gamma>1$. While NELA leverages graph information to enhance performance, its advantages are less evident in extremely simple graph structures. In such cases, the additional computations required for utilizing the graph information may reduce efficiency, resulting in lower performance compared to algorithms that treat nodes independently. However, as the network size increases, even in sparsely connected scenarios, as demonstrated in experiments on synthetic and real-world datasets where NELA’s advantages become more evident.

VI-B Experiments on synthetic dataset

We generate a synthetic dataset with $n=50$ users, each assigned a $d=10$ dimensional feature vector $\boldsymbol{\theta}_{i}$. Each dimension of $\boldsymbol{\theta}_{i}$ is drawn from a normal distribution $\mathcal{N}(0,1)$ and then normalized so that $\norm{\boldsymbol{\theta}_{i}}=1$. We then construct the weight matrix $\boldsymbol{W}$ for the user graph by setting $\boldsymbol{W}(i,j)\propto\langle\boldsymbol{\theta}_{i},\boldsymbol{\theta}_{j}\rangle$ and normalizing each column of $\boldsymbol{W}$ by its $\ell_{1}$ norm. To control the connectivity of each node, we introduce a threshold that filters out the weakest 70% of the weights in the network, ensuring that only the top 30% of weights are retained. The generation of the arm set follows the same procedure as in the toy example experiments. We randomly sample three anomalies from $n=50$ users. For each anomaly, one dimension of its residual vector is sampled from the uniform distribution $U(-10,10)$, resulting in sampled residual norms of 2.095, 3.33, and 5.44, respectively. The norm of the residual feature vectors for the non-anomalous users is zero, i.e., $\norm{\boldsymbol{v}_{i}}=\boldsymbol{0}$, $i\in\mathcal{U}\backslash\tilde{\mathcal{U}}$.

Figure 3 demonstrates the performance of our proposed algorithm NELA in terms of regret and anomaly detection. According to Figure 3(a), NELA outperforms all state-of-the-art algorithms and has the lowest regret. GraphUCB, which assumes the smoothness of feature vectors along the network, is highly susceptible to anomalies. This explains its highest regret among the compared algorithms. Algorithms nLinUCB and LinUCB infer users’ feature vectors without considering mutual influence and information sharing among users, leading to higher regrets than CoLin because of underscoring the significance of incorporating users’ mutual influence in the algorithm design. Our proposed algorithm, NELA, not only considers these effects but also addresses the impact of potential anomalies, thus achieving the lowest regret.

Figures 3(b) and 3(c) show the anomaly detection results. As stated in section III, we evaluate anomaly detection performance using two key metrics: i) precision, which measures the accuracy of the detected anomalies by quantifying the proportion of true anomalies among all detections, and ii) recall, which measures the completeness by assessing the proportion of true anomalies that are successfully detected. In Figure 3(b), the precision quickly converges to one, indicating that the NELA algorithm rarely misclassifies normal users as anomalies. Figure 3(c) depicts the proportion of detected anomalies with respect to the ground truth. Our experiment corresponds to a particularly challenging scenario, where each anomaly has only one non-zero dimension. In Figure 5, we provide detection results under varying $\gamma$ values and different numbers of non-zero dimensions $|\mathcal{J}(\boldsymbol{v}_{i})|$, $i\in\tilde{\mathcal{U}}$, reflecting various levels of detection difficulties. Since NELA guarantees zero false detection empirically, we plot the recalls in Figure 5.

According to Figure 5, the anomaly detection performance improves with increasing $\gamma$. That aligns with the intuition that a bigger $\gamma$ makes anomalies more detectable. However, there is a trade-off in the number of non-zero dimensions. Since NELA detects anomalies by identifying the support of the global residual vector $vec(\boldsymbol{V})$, anomalies with more non-zero dimensions are simpler to detect. Detecting even one of the non-zero dimensions in one anomaly is sufficient to identify it; nevertheless, with a fixed $\gamma$, having more non-zero dimensions results in a smaller value per dimension, making detection harder. That explains the noticeable decrease in recalls concerning $\mathcal{J}(\boldsymbol{v}_{i})$ for $i\in\tilde{\mathcal{U}}$ with $\gamma=2$ while such differences in experiments with $\gamma=5$ and $\gamma=10$ are not significant.

VI-C Experiments on real-world dataset

Netflix Dataset 111Netflix Movie Rating Dataset from Netflix’s “Netflix Prize” competition on https://www.kaggle.com/datasets/rishitjavia/netflix-movie-rating-dataset?resource=download [37] contains the information of more than 16 million ratings for 1350 movies by 143458 users, which has been widely used to evaluate the effectiveness of contextual bandit algorithms [6, 21, 38]. For our experiments, we select $10^{3}$ movies with the most ratings and $n=100$ most active users to construct a sparse user–item collaborative filtering matrix, where unrated pairs are assigned a value of zero. We then apply singular value decomposition (SVD) to this matrix to compute (dimension $d=10$) user feature vectors and movie (context) vectors, following the methodology in [20, 21]. Before using the feature and context vectors in our experiments, we normalize the data in two steps. First, we apply min-max scaling to each dimension to map the values into the range $[-1,1]$. Then, we perform $\ell_{2}$-normalization on each vector to ensure unit norm.

One challenge is the absence of information about an explicit user connectivity graph or labeled anomalies, which limits the representation of realistic social network scenarios. To bridge this gap, we follow established methods in prior work [3, 6] to construct a synthetic graph based on feature proximity, treating it as ground truth.

At each step, we sample $M=50$ items from the extracted $10^{3}$ movies as the action (context) set. The weight matrix construction are the same as the synthetic dataset. While the user and item (context) features are extracted from the real dataset, the reward is generated according to our payoff model in (1). This setting allows us to simulate bandit feedback realistically while ensuring that the environment is consistent with our theoretical model and supports evaluation of both regret minimization and anomaly detection. We sample five anomalies following the same setting as the synthetic dataset, and the sampled norms of residuals are 8.46, 1.40, 6.54, 1.26, and 8.43, respectively.

Figure 4 shows the results. Similar to the experiment on the synthetic dataset, NELA exhibits superior performance over all state-of-the-art algorithms, demonstrating the effectiveness of our proposed algorithm. However, the recall of anomaly detection in Figure 4(c) is lower in the real-world dataset compared to the synthetic dataset. The reason is that in the former, the arm set represents the features of available movies. Consequently, Assumption 3 is not guaranteed to be satisfied, which affects the algorithm’s performance. On the other hand, the precision plot of NELA in Figure 4(b) shows that it guarantees zero false detection performance as the experiments on the synthetic dataset.

VII Conclusion

We studied the joint action recommendation and anomaly detection problem within an online learning networked bandits setting. Our proposed algorithm, NELA, improves the state-of-the-art by integrating one module for anomaly detection to ensure robust performance. Theoretical analysis and empirical experiments on synthetic and real-world datasets validate the effectiveness of NELA in anomaly detection and demonstrate its superiority over state-of-the-art algorithms. In future work, we plan to explore more realistic and dynamic environments. One key direction is to extend our framework to settings where the user network is unknown or evolves over time, which better reflects practical systems. Additionally, although our theoretical regret bounds do not depend on the positions of anomalies, empirical performance may still be influenced by where anomalies occur, particularly if they are situated at highly connected nodes. Understanding such effects under imperfect anomaly detection is a promising line of study. Besides, certain coordinated attacks or bot networks may alter the influence structure. Therefore, extending the framework to jointly model changes in both the influence structure and the residual deviations is also an interesting direction for future work.

-A Auxiliary Lemmas

In this section, we provide some auxiliary theorems and lemmas that are necessary for the proof of the regret bound.

Theorem 3** (Matrix Chernhoff, Theorem 3.1 of [39]).**

Let $\mathcal{F}_{1}\subset\mathcal{F}_{2}\subset\ldots\subset\mathcal{F}_{t}$ be a filtration and consider a finite sequence $\{X_{s}\}$ of positive semi-definite matrix with dimensions $d$, adapted to the filtration. Suppose $\lambda_{\max}(X_{k})\leq R$ almost surely. Define finite series $Y=\sum_{s=1}^{t}X_{s}$ and $W=\sum_{s=1}^{t}\mathbb{E}[X_{s}|\mathcal{F}_{s-1}]$. Then, for all $\mu\geq 0$, for all $\delta\in[0,1)$, we have

[TABLE]

Corollary 1** (Corollary 6.8 in [40]).**

Suppose $\boldsymbol{\Sigma}_{0}$ satisfies the compatibility condition for the set $S$ with $|S|=s_{0}$ and with the compatibility constant $\phi^{2}(\boldsymbol{\Sigma}_{0},S)>0$ and that $\norm{\boldsymbol{\Sigma}_{0}-\boldsymbol{\Sigma}_{1}}\leq\lambda$ where $\frac{32\lambda s_{0}}{\phi^{2}(\boldsymbol{\Sigma}_{0},S)}\leq 1$. Then the compatibility condition also holds for $\boldsymbol{\Sigma}_{1}$ with the compatibility constant $\frac{\phi^{2}(\boldsymbol{\Sigma}_{0},S)}{2}$, i.e. $\phi^{2}(\boldsymbol{\Sigma}_{1},S)\geq\frac{\phi^{2}(\boldsymbol{\Sigma}_{0},S)}{2}$.

Theorem 4** (Theorem 2.19 in [41]).**

Let $(Z_{t},\tilde{\mathcal{F}}_{t})_{t=1}^{\infty}$ be a martingale difference sequence, and assume that for all $\alpha\in\mathbb{R}$, $\mathbb{E}[\exp(\alpha Z_{s})|\tilde{\mathcal{F}}_{s-1}]\leq\exp(\frac{\alpha^{2}\sigma^{2}}{2})$. Then for all $x\geq 0$, we have

[TABLE]

Lemma 4** (Bernstein-like inequality for the adapted data (Lemma 8 in [34])).**

Suppose for all $t\geq 1$, for all $1\leq i\leq j\leq nd$, $\mathbb{E}[\gamma_{t}^{ij}(vec(\mathring{\boldsymbol{X}}_{a_{s},u_{s}}))|\mathcal{F}_{t-1}]=0$ and $\mathbb{E}[|\gamma_{t}^{ij}(vec(\mathring{\boldsymbol{X}}_{a_{s},u_{s}}))|^{m}|\mathcal{F}_{t-1}]\leq m!$ for all integer $m\geq 2$. Then for all $x>0$ and for all integer $t\geq 1$, we have:

[TABLE]

Define the loss function

[TABLE]

The initial LASSO estimate is given by

[TABLE]

Define $\boldsymbol{\Delta}=\widehat{\boldsymbol{V}}_{0}^{t}-vec(\boldsymbol{V})$. We analyze the performance of the initial Lasso estimate.

Lemma 5**.**

Denoting $\mathcal{E}(vec(\boldsymbol{V}^{\prime}))=\mathbb{E}[l_{t}(vec(\boldsymbol{V}^{\prime}))]-\mathbb{E}[l_{t}(vec(\boldsymbol{V}))]$, it is satisfied that

[TABLE]

Proof.

Denote $\widehat{\boldsymbol{V}}=\widehat{\boldsymbol{V}}_{0}^{t}$ for simplicity. From the definition of $\mathcal{E}(vec(\boldsymbol{V}^{\prime}))$, we have

[TABLE]

where for the inequalities we used the positive semi-definiteness of $\widehat{\overline{\boldsymbol{\Sigma}}}_{t}$. ∎

Lemma 6**.**

Denoting $\varepsilon_{t}(vec(\boldsymbol{V}))=l_{t}(vec(\boldsymbol{V}))-\mathbb{E}[l_{t}(vec(\boldsymbol{V}))]$, we have:

[TABLE]

Proof.

Denote $\widehat{\boldsymbol{V}}=\widehat{\boldsymbol{V}}_{0}^{t}$. We compute $\varepsilon_{t}(\widehat{\boldsymbol{V}})$ as

[TABLE]

Besides,

[TABLE]

Thus, we can compute

[TABLE]

Using Höder’s inequality we have

[TABLE]

where $\cdot(i)$ is an indicator of the $i-$th element. Similar to $\boldsymbol{S}_{t}$, $\eta_{s}vec(\mathring{\boldsymbol{X}}_{a_{t},u_{t}})(i)$ is also a martingale. Specially, define $\tilde{\mathcal{F}}_{t}$ as the $\sigma-$algebra generated by $(vec(\mathring{\boldsymbol{X}}_{a_{1},u_{1}}),\mathcal{A}_{1},\eta_{1},\ldots,vec(\mathring{\boldsymbol{X}}_{a_{t},u_{t}}),\mathcal{A}_{t},\eta_{t},\mathcal{A}_{t+1})$. For each dimension $i$ of $vec(\mathring{\boldsymbol{X}}_{a_{t},u_{t}})$, we have $\mathbb{E}[\eta_{s}vec(\mathring{\boldsymbol{X}}_{a_{s},u_{s}})(i)|\tilde{\mathcal{F}}_{s-1}]=vec(\mathring{\boldsymbol{X}}_{a_{s},u_{s}})(i)\mathbb{E}[\eta_{s}|\tilde{\mathcal{F}}_{s-1}]=0$. By using the assumption that $|vec(\mathring{\boldsymbol{X}}_{a_{t},u_{t}})(i)|\leq s_{A}$, we can obtain, for each $\alpha\in\mathbb{R}$,

[TABLE]

which indicates that $\eta_{s}vec(\mathring{\boldsymbol{X}}_{a_{s},u_{s}})(i)$ is also a sub-Gaussian random variable with variance proxy $(s_{A}\sigma)^{2}$.

Using Theorem 4, we can obtain

[TABLE]

Denote $\lambda=\frac{1}{2}\lambda_{t}$, the inequality becomes

[TABLE]

That completes the proof. ∎

Lemma 7**.**

Let $\widehat{\overline{\boldsymbol{\Sigma}}}_{t}$ be the empirical covariance matrix of the selected context. Suppose $\widehat{\overline{\boldsymbol{\Sigma}}}_{t}$ satisfies the compatibility condition with the support $J(vec(\boldsymbol{V}))$ with the compatibility constant $\phi_{t}$. Then we have

[TABLE]

Proof.

From the definition of loss function in (-A) and the update step in Algorithm 1, we have

[TABLE]

By taking the expectation over $r_{a_{t},u_{t}}-vec(\mathring{\boldsymbol{X}}_{a_{t},u_{t}})^{T}vec(\widehat{\boldsymbol{\Theta}}_{t}\boldsymbol{W})$, we obtain

[TABLE]

Denoting $\varepsilon_{t}(vec(\boldsymbol{V}))=l_{t}(vec(\boldsymbol{V}))-\mathbb{E}[l_{t}(vec(\boldsymbol{V}))]$ and $\mathcal{E}(vec(\boldsymbol{V}^{\prime}))=\mathbb{E}[l_{t}(vec(\boldsymbol{V}^{\prime}))]-\mathbb{E}[l_{t}(vec(\boldsymbol{V}))]$, the previous inequality becomes

[TABLE]

Define the event $\xi_{t}$ as

[TABLE]

We condition on this event in the rest of the proof.

Given the event $\xi_{t}$ and inequality (21), we have

[TABLE]

According to the triangle inequality,

[TABLE]

where $\mathcal{J}^{c}$ is the complement of $\mathcal{J}$. In addition, we have

[TABLE]

Combining inequalities (22), (23) and (24), we can obtain

[TABLE]

According to the compatibility condition in Definition 1, we can obtain

[TABLE]

Thus, with (25), we arrive at

[TABLE]

where the first inequality is based on (24), the second inequality is based on the compatibility condition, the third inequality uses $4uv\leq u^{2}+4v^{2}$, and the last inequality is due to the following Lemma 5.

Thus, using Lemma 6 yields

[TABLE]

with probability at least 1-2\exp\Big(-\frac{t\lambda_{t}^{2}}{32\sigma^{2}s_{A}^{2}}+\log nd\Big{missing}). That completes the proof of Lemma 7. ∎

Lemma 8**.**

Let $C_{0}=\min\{\frac{1}{2},\frac{\phi_{0}^{2}}{512s_{0}s_{A}^{2}\nu\omega_{\mathcal{X}}}\}$. We have, for all $t\geq\frac{2\log(2d^{2})}{C_{0}^{2}}$,

[TABLE]

Proof.

Let us define $\gamma_{t}^{ij}(vec(\mathring{\boldsymbol{X}}_{a_{s},u_{s}}))$ as

[TABLE]

where $\mathcal{F}^{\prime}_{t}$ is the $\sigma$-algebra generated by random variables $(\mathcal{A}_{u_{1},1},vec(\mathring{\boldsymbol{X}}_{a_{1},u_{1}}),r_{a_{1},u_{1}},\ldots,\mathcal{A}_{t-1},vec(\mathring{\boldsymbol{X}}_{a_{t-1},u_{t-1}}),\\ r_{a_{t-1},u_{t-1}},\mathcal{A}_{u_{t},t})$. We have

[TABLE]

$\mathbb{E}[\gamma_{t}^{ij}(vec(\mathring{\boldsymbol{X}}_{a_{s},u_{s}}))|\mathcal{F}^{\prime}_{t-1}]=0$ and $\mathbb{E}[|\gamma_{t}^{ij}(vec(\mathring{\boldsymbol{X}}_{a_{s},u_{s}}))|^{m}|\mathcal{F}^{\prime}_{t-1}]\leq 1$ for all integer $m\geq 2$. Therefore, we can apply Lemma 4:

[TABLE]

For all $t\geq\frac{2\log(2n^{2}d^{2})}{C_{0}^{2}}$ with $C_{0}=\min\{\frac{1}{2},\frac{\phi_{0}^{2}}{256s_{0}s_{A}^{2}\nu\omega_{\mathcal{X}}}\}$, taking $x=C_{0}^{2}$,

[TABLE]

In summary, for all $t\geq\frac{2\log(2n^{2}d^{2})}{C_{0}^{2}}$, we have

[TABLE]

That completes the proof. ∎

Lemma 9**.**

Let $C_{0}=\min\{\frac{1}{2},\frac{\phi_{0}^{2}}{512s_{0}s_{A}^{2}\nu\omega_{\mathcal{X}}}\}$. For all $t\geq\frac{2\log(2n^{2}d^{2})}{C_{0}^{2}}$, we have

[TABLE]

Proof.

In Definition 1, the considered covariance matrix $\overline{\boldsymbol{\Sigma}}\in\mathbb{R}^{nd\times nd}$ is block-diagonal consisting of $n$ blocks, one for each different user. Define the filtration $(\overline{\mathcal{F}}_{t})_{t\geq 0}$ as $\overline{\mathcal{F}}_{t}=\sigma(\mathring{\boldsymbol{X}}_{a_{1},u_{1}},\eta_{1},\ldots,\mathring{\boldsymbol{X}}_{a_{t},u_{t}})$. First, consider the single-user adapted matrix

[TABLE]

where $\mathcal{T}_{i,t}$ collects the round that user $i$ is selected. The multi-user matrix is then $\overline{\boldsymbol{\Sigma}}_{t}=diag(\boldsymbol{\Sigma}_{1,t},\ldots,\boldsymbol{\Sigma}_{n,t})\in\mathbb{R}^{nd\times nd}$. According to Lemma 10 of [34] and Assumption 4, we have

[TABLE]

where $vec(\mathring{\boldsymbol{X}}_{a_{s},u_{s}})\in\mathbb{R}^{nd}$. According to Definition 1,

[TABLE]

Hence, $\overline{\boldsymbol{\Sigma}}_{t}$ satisfies the compatibility condition with $\phi^{2}(\overline{\boldsymbol{\Sigma}}_{t},\mathcal{J})=\frac{\phi_{0}^{2}}{2\nu\omega_{\mathcal{X}}}$. Furthermore, we have the following adaptive matrix concentration results for $\widehat{\overline{\boldsymbol{\Sigma}}}_{t}$:

By using Lemma 8 and Corollary 1, for all $t\geq\frac{2\log(2n^{2}d^{2})}{C_{0}^{2}}$,

[TABLE]

with probability at least $1-\exp(-\frac{tC_{0}^{2}}{2})$. That completes the proof. ∎

Lemma 10** (Minimal Eigenvalue of the Empirical Gram Matrix).**

Under Assumption 5, we have $\mathbb{P}(\lambda_{\min}(\widehat{\overline{\boldsymbol{\Sigma}}}_{t,\hat{J}})\geq\frac{\beta}{4\nu\omega_{\mathcal{X}}}|\mathcal{D}_{t})\geq 1-\exp(\log(s_{0}+\frac{4\nu\omega_{\mathcal{X}}\sqrt{s_{0}}}{\phi_{0}^{2}})-\frac{t\beta}{20s_{A}^{2}\nu\omega_{\mathcal{X}}(s_{0}+(4\nu\omega_{\mathcal{X}}\sqrt{s_{0}})/\phi_{0}^{2})})$.

Proof.

For a fixed set $\hat{\mathcal{J}}$, we first define the adapted Gram matrix on the estimated support as

[TABLE]

The following Lemma characterizes the expected Gram matrix generated by the algorithm.

Lemma 11**.**

Fix $\hat{\mathcal{J}}$ such that $\mathcal{J}\subset\hat{\mathcal{J}}$ and $|\hat{\mathcal{J}}|\leq s_{0}+(4\nu\omega_{\mathcal{X}}\sqrt{s_{0}})/\phi_{0}^{2}$. Under Assumption 4 and Definition 1, we have

[TABLE]

The proof of Lemma 11 is almost the same as the proof of (33) in Lemma 9, thus we omit the proof here.

By Assumption 5 and the construction of our algorithm, under the event $\mathcal{D}_{t}$

[TABLE]

where the first inequality uses the concavity of $\lambda_{\min}(\cdot)$ over the positive semi-definite matrices. Next, we prove the upper bound on the largest eigenvalue of $(vec(\mathring{\boldsymbol{X}}_{a_{s},u_{s}})(\hat{\mathcal{J}}))(vec(\mathring{\boldsymbol{X}}_{a_{s},u_{s}})(\hat{\mathcal{J}}))^{\top}$

[TABLE]

where the first inequality uses Hölder’s inequality.

Using Theorem 3 with $R=(s_{0}+(4\nu\omega_{\mathcal{X}}\sqrt{s_{0}})/\phi_{0}^{2})s_{A}^{2}$, $X_{s}=(vec(\mathring{\boldsymbol{X}}_{a_{s},u_{s}})(\hat{\mathcal{J}}))(vec(\mathring{\boldsymbol{X}}_{a_{s},u_{s}})(\hat{\mathcal{J}}))^{\top}$, $Y=t\widehat{\overline{\boldsymbol{\Sigma}}}_{t,\hat{J}}$, $W=t\overline{\boldsymbol{\Sigma}}_{t,\hat{J}}$, $\delta=\frac{1}{2}$ and $\mu=t\frac{\beta}{2\nu\omega_{\mathcal{X}}}$.

[TABLE]

where the last inequality uses $-0.5-0.5\log(0.5)\leq-\frac{1}{10}$. That completes the proof. ∎

Lemma 12** (Estimation after Thresholding).**

Let $s^{\prime}=s_{0}+\frac{4\nu\omega_{\mathcal{X}}\sqrt{s_{0}}}{\phi_{0}^{2}}$. Under Assumption 1 and Remark 1, we have, for all $x,\lambda>0$: \mathbb{P}\Big{(}\frac{1}{\lambda t}\norm{\mathcal{X}(\hat{\mathcal{J}})^{\top}\eta}_{2}\geq x\text{ and }\lambda_{\min}(\widehat{\overline{\boldsymbol{\Sigma}}}_{t,\hat{J}})\geq\lambda|\mathcal{D}_{t}\Big{)}\leq 2s^{\prime}\exp(-\frac{\lambda^{2}tx^{2}}{2\sigma^{2}s_{A}^{2}s^{\prime}}).

Proof.

Denote $\hat{\mathcal{J}}=\hat{\mathcal{J}}_{1}^{t}$ and $\eta=(\eta_{1},\eta_{2},\ldots,\eta_{t})$, $\mathcal{X}(\hat{\mathcal{J}})$ denotes the $t\times|\hat{\mathcal{J}}|$ submatrix of $\mathcal{X}\in\mathbb{R}^{t\times nd}$. Conditioning on a fixed $\hat{\mathcal{J}}$, based on Theorem 4, we can derive

[TABLE]

That completes the proof. ∎

Lemma 13**.**

When the ALS step is properly initialized, $\epsilon_{v}=vec(\mathring{\boldsymbol{X}}_{a_{s},u_{s}})^{\top}(vec(\widehat{\boldsymbol{V}}_{s})-vec(\boldsymbol{V}))$ is zero mean $2s_{x}s_{v}$-sub-Gaussian, conditioned on $\mathcal{F}_{t}$. Similarly, $\epsilon_{\theta}=vec(\mathring{\boldsymbol{X}}_{a_{s},u_{s}}\boldsymbol{W}^{\top})^{\top}(vec(\widehat{\boldsymbol{\Theta}}_{s})-vec(\boldsymbol{\Theta}))$ is zero-mean $2s_{x}s_{\theta}$-sub-Gaussian, conditioned on $\mathcal{F}_{t}$.

Proof.

Lemma 13 is adapted from Lemma F.1 in [42]. Here we summarize the proof with variables in NELA briefly.

When conditioning on $\mathcal{F}_{t}$, $\epsilon_{v}$ is a random variable bounded by $[-2s_{x}s_{v},2s_{x}s_{v}]$. Therefore, $\epsilon_{v}$ is sub-Gaussian. For $\epsilon_{\theta}$, the proof follows the same procedure. ∎

-B Proof of Lemma 1

Proof.

Define

[TABLE]

then we can obtain

[TABLE]

where $\boldsymbol{Q}_{v,t}=\sum_{s=1}^{t}vec(\mathring{\boldsymbol{X}}_{a_{s},u_{s}}\boldsymbol{W}^{\top})vec(\mathring{\boldsymbol{X}}_{a_{s},u_{s}})^{\top}(vec(\widehat{\boldsymbol{V}}_{s})-vec(\boldsymbol{V}))$.

We first bound the first term. Because $\boldsymbol{S}_{t}$ is a martingale, according to Theorem 1 and Theorem 2 in [36], we have

[TABLE]

with probability at least $1-\delta$, for any $\delta>0$. Besides, we have $\det(\boldsymbol{A}_{0})=\det(\lambda_{1}\boldsymbol{I})\leq\lambda_{1}^{dn}$.

Now it remains to bound the term $\norm{\boldsymbol{Q}_{v,t}}_{\boldsymbol{A}_{t}^{-1}}$, according to Lemma 13, we can bound

[TABLE]

Putting all these together, we have

[TABLE]

In addition, we have $\Tr(\boldsymbol{A}_{t})\leq\lambda_{1}dn+\sum_{\tau=1}^{t}\sum_{j=1}^{n}W(u_{\tau},j)^{2}s_{A}^{2}d^{2}$, we have $\det(\boldsymbol{A}_{t})\leq(\frac{\Tr(\boldsymbol{A}_{t})}{dn})^{dn}\leq(\lambda_{1}+\frac{\sum_{\tau=1}^{t}\sum_{j=1}^{n}W(u_{\tau},j)^{2}s_{A}^{2}d^{2}}{dn})^{dn}$. Therefore, (41) can further bounded by

[TABLE]

∎

-C Proof of Lemma 2

Proof.

Define $\boldsymbol{\Delta}_{t}=\widehat{\boldsymbol{V}}_{0}^{t}-vec(\boldsymbol{V})$ and define the event $\mathcal{H}_{t}$ as

[TABLE]

where $\phi_{t}$ is the compatibility constant of $\widehat{\overline{\boldsymbol{\Sigma}}}_{t}$ defined in Lemma 7.

For the rest of the proof, we assume that the event $\mathcal{H}_{t}$ holds. Besides, we have

[TABLE]

where in the last inequality we use the construction of $\hat{\mathcal{J}}_{0}^{t}$ in the algorithm. We have

[TABLE]

where in the last inequality we used the definition of $\mathcal{H}_{t}$. We have $\forall j\in J$,

[TABLE]

Therefore, when $t$ is large enough so that $4\lambda_{t}\leq V_{\min}-\frac{4s_{0}\lambda_{t}}{\phi_{t}^{2}}$, we have $\mathcal{J}\subset\hat{\mathcal{J}}_{0}^{t}$. Similarly, when $t$ is large enough so that $4\lambda_{t}\sqrt{(1+\frac{1}{\phi_{t}^{2}})s_{0}}\leq V_{\min}-\frac{4s_{0}\lambda_{t}}{\phi_{t}^{2}}$, it holds that $\mathcal{J}\subset\hat{\mathcal{J}}_{0}^{t}$. From the construction of $\hat{\mathcal{J}}_{1}^{t}$ in the algorithm, it also holds that $\hat{\mathcal{J}}_{1}^{t}\subset\hat{\mathcal{J}}_{0}^{t}$. Therefore,

[TABLE]

and

[TABLE]

The condition that $4\lambda_{t}\sqrt{(1+\frac{1}{\phi_{t}^{2}})s_{0}}\leq vec(\boldsymbol{V})_{\min}-\frac{4s_{0}\lambda_{t}}{\phi_{t}^{2}}$ is equivalent to $4\lambda_{t}(\sqrt{(1+\frac{1}{\phi_{t}^{2}})s_{0}}+\frac{s_{0}}{\phi_{t}^{2}})\leq vec(\boldsymbol{V})_{\min}$. Based on the auxiliary Lemmas 7 and 9, we can guarantee the estimation of the support by substituting $\phi_{t}^{2}=\frac{\phi_{0}^{2}}{4\nu\omega_{\mathcal{X}}}$. In the worst case, each anomaly in $\mathcal{U}_{t}$ contains at least one non-zero dimension, which indicates $\mathbb{P}(\tilde{\mathcal{U}}\subset\tilde{\mathcal{U}}_{t}$ and $|\tilde{\mathcal{U}}_{t}\backslash\tilde{\mathcal{U}}|\leq\frac{4\nu\omega_{\mathcal{X}}\sqrt{s_{0}}}{\phi_{0}^{2}})\geq 1-2\exp(-\frac{t\lambda_{t}^{2}}{32\sigma^{2}s_{A}^{2}}+\log nd)-\exp(-\frac{tC_{0}^{2}}{2})$. ∎

-D Proof of Lemma 3

Proof.

[TABLE]

where the inequality is obtained according to our action selection strategy.

Next, we have

[TABLE]

To bound term (c) of (47), we first define the event \mathcal{L}_{t}^{\frac{\beta}{4\nu\omega_{\mathcal{X}}}}=\Big{\{}\lambda_{\min}(\widehat{\overline{\boldsymbol{\Sigma}}}_{t,\hat{J}})\geq\frac{\beta}{4\nu\omega_{\mathcal{X}}}\Big{\}}, we have

[TABLE]

Specially, use $\hat{\mathcal{J}}=\hat{\mathcal{J}}_{1}^{t}$ and $\eta=(\eta_{1},\eta_{2},\ldots,\eta_{t})$. Assume $\lambda_{\min}(\widehat{\overline{\boldsymbol{\Sigma}}}_{t,\hat{J}})\geq\lambda$. We have

[TABLE]

where the last inequality is because $\lambda_{\min}(\widehat{\overline{\boldsymbol{\Sigma}}}_{t,\hat{J}})\geq\lambda$ and $\boldsymbol{Q}_{\theta,t}=\sum_{s=1}^{t}vec(\mathring{\boldsymbol{X}}_{a_{s},u_{s}})vec(\mathring{\boldsymbol{X}}_{a_{s},u_{s}}\boldsymbol{W}^{\top})(vec(\widehat{\boldsymbol{\Theta}}_{s})-vec(\boldsymbol{\Theta}))$.

Similarly, according to Lemma 13 and Hoeffding’s inequality, with probability at least $1-\delta$,

[TABLE]

Putting all these together, we have

[TABLE]

where $\lambda=\lambda_{\min}(\widehat{\overline{\boldsymbol{\Sigma}}}_{t,\hat{\mathcal{J}}})\geq\frac{\beta}{4\nu\omega_{\mathcal{X}}}$.

For the first term, denote the event \mathcal{I}_{h}=\Big{\{}\frac{1}{t}\norm{\mathcal{X}(\hat{J})^{\top}\eta}_{2}\in(2h\delta,2\delta(h+1)]\Big{\}}, where

[TABLE]

then

[TABLE]

Denote $s^{\prime}=s_{0}+\frac{4\nu\omega_{\mathcal{X}}\sqrt{s_{0}}}{\phi_{0}^{2}}$. Then, using Lemma 12, we get

[TABLE]

We also trivially have that:

[TABLE]

Thus, we have

[TABLE]

where we set $h_{0}=\lfloor\sqrt{\log 4s^{\prime}}+1\rfloor$. Based on the proof of Lemma 5.9 in [33], we can obtain

[TABLE]

Then we have

[TABLE]

In summary, we can bound the instantaneous regret

[TABLE]

∎

-E Proof of Theorem 1

Proof.

[TABLE]

where

[TABLE]

[TABLE]

According to Lemma 11 in [36],

[TABLE]

Then we can derive

[TABLE]

Then we bound term (b) of (56),

[TABLE]

According to the proof in [33], with $vec(\boldsymbol{V})$’s dimension $nd$ and $\tau=\lfloor\frac{2\log(2n^{2}d^{2})}{C_{0}^{2}(\log s_{0})(\log\log nd)}\rfloor$, we have

[TABLE]

Thus, we can bound term (c) of (56)

[TABLE]

Putting all of these together, we can bound the regret

[TABLE]

with $\alpha_{T}$ defined in Lemma 1. ∎

-F Proof of Theorem 2

Proof.

The proof combines two known lower bounds from the literature: Collaborative linear bandit regret and sparse anomaly component. In the following, we analyze these two parts separately.

In the best-case scenario (all users are identical and fully connected), the regret of collaborative linear bandit is lower bounded by $\Omega(d\sqrt{nT})$, while in the worst-case scenario (all users are completely isolated and different), it is lower bounded by $\Omega(dn\sqrt{T})$. Therefore, the regret of network learning is lower bounded by $\Omega(\xi d\sqrt{nT})$, where $\xi\in[1,\sqrt{n}]$ where $\xi$ serves as a scaling factor jointly determined by the connectivity of the user graph and the similarity among users’ parameters.

In the sparse linear bandit setting (where an unknown sparse corruption vector affects the rewards), previous work [43] has proven that regret is lower bounded by $\Omega(\sqrt{s_{0}T})$.

By combining these two challenges, i.e. learning across a network and handling sparse anomalies, we conclude that any algorithm must suffer at least $\Omega(\xi d\sqrt{nT}+\sqrt{s_{0}T})$ regret. ∎