Correcting False Alarms from Unseen: Adapting Graph Anomaly Detectors at Test Time

TL;DR

This paper introduces TUNE, a lightweight test-time adaptation framework that improves graph anomaly detection models' ability to handle unseen normal patterns without retraining, by aligning graph attributes and minimizing representation shifts.

Contribution

The paper proposes a novel, practical test-time adaptation method for GAD that addresses normality shifts caused by unseen data, enhancing model robustness without retraining.

Findings

TUNE significantly improves GAD performance on unseen normal patterns.

The framework effectively reduces semantic confusion and aggregation contamination.

Experiments on 10 real-world datasets validate its generalizability.

Abstract

Graph anomaly detection (GAD), which aims to detect outliers in graph-structured data, has received increasing research attention recently. However, existing GAD methods assume identical training and testing distributions, which is rarely valid in practice. In real-world scenarios, unseen but normal samples may emerge during deployment, leading to a normality shift that degrades the performance of GAD models trained on the original data. Through empirical analysis, we reveal that the degradation arises from (1) semantic confusion, where unseen normal samples are misinterpreted as anomalies due to their novel patterns, and (2) aggregation contamination, where the representations of seen normal nodes are distorted by unseen normals through message aggregation. While retraining or fine-tuning GAD models could be a potential solution to the above challenges, the high cost of model retraining and the difficulty of obtaining labeled data often render this approach impractical in real-world applications. To bridge the gap, we proposed a lightweight and plug-and-play Test-time adaptation framework for correcting Unseen Normal pattErns (TUNE) in GAD. To address semantic confusion, a graph aligner is employed to align the shifted data to the original one at the graph attribute level. Moreover, we utilize the minimization of representation-level shift as a supervision signal to train the aligner, which leverages the estimated aggregation contamination as a key indicator of normality shift. Extensive experiments on 10 real-world datasets demonstrate that TUNE significantly enhances the generalizability of pre-trained GAD models to both synthetic and real unseen normal patterns.