[Paper Review] Truncated Affinity Maximization: One-class Homophily Modeling for Graph Anomaly Detection

Qiao Hezhe, Guansong Pang|arXiv (Cornell University)|May 29, 2023

Complex Network Analysis Techniques4 citations

TL;DR

This paper introduces Truncated Affinity Maximization (TAM), a novel unsupervised graph anomaly detection method that leverages one-class homophily—where normal nodes exhibit strong local affinity among themselves—by learning tailored node representations through affinity maximization on iteratively truncated graphs. TAM achieves state-of-the-art performance, improving AUROC and AUPRC by over 10% on challenging real-world datasets compared to existing methods.

ABSTRACT

We reveal a one-class homophily phenomenon, which is one prevalent property we find empirically in real-world graph anomaly detection (GAD) datasets, i.e., normal nodes tend to have strong connection/affinity with each other, while the homophily in abnormal nodes is significantly weaker than normal nodes. However, this anomaly-discriminative property is ignored by existing GAD methods that are typically built using a conventional anomaly detection objective, such as data reconstruction. In this work, we explore this property to introduce a novel unsupervised anomaly scoring measure for GAD, local node affinity, that assigns a larger anomaly score to nodes that are less affiliated with their neighbors, with the affinity defined as similarity on node attributes/representations. We further propose Truncated Affinity Maximization (TAM) that learns tailored node representations for our anomaly measure by maximizing the local affinity of nodes to their neighbors. Optimizing on the original graph structure can be biased by nonhomophily edges (i.e., edges connecting normal and abnormal nodes). Thus, TAM is instead optimized on truncated graphs where non-homophily edges are removed iteratively to mitigate this bias. The learned representations result in significantly stronger local affinity for normal nodes than abnormal nodes. Extensive empirical results on 10 real-world GAD datasets show that TAM substantially outperforms seven competing models, achieving over 10% increase in AUROC/AUPRC compared to the best contenders on challenging datasets. Our code is available at https://github.com/mala-lab/TAM-master/.

Motivation & Objective

• To identify a previously overlooked anomaly-discriminative property in real-world graph anomaly detection (GAD) datasets: one-class homophily, where normal nodes are highly affiliated with each other, while abnormal nodes show weak internal homophily.
• To develop a new unsupervised anomaly scoring measure, local node affinity, that assigns higher scores to nodes with weaker similarity to their neighbors in terms of attributes or representations.
• To address the bias from non-homophily edges (connecting normal and abnormal nodes) that degrade representation quality in standard GNNs by proposing a graph truncation strategy to remove such edges during training.
• To optimize node representations end-to-end using a novel objective that maximizes local node affinity on truncated graphs, leading to better separation between normal and abnormal nodes.
• To demonstrate the robustness and scalability of the proposed method on large-scale and camouflaged attribute settings.

Proposed method

• Proposes local node affinity as an anomaly score based on cosine similarity between a node and its neighbors in the representation space, with lower affinity indicating higher anomaly likelihood.
• Introduces Truncated Affinity Maximization (TAM), a training objective that maximizes the average similarity of each node to its neighbors in the representation space.
• Applies iterative graph truncation to remove edges connecting normal and abnormal nodes (non-homophily edges) to prevent representation homogenization and reduce optimization bias.
• Uses a GNN encoder to learn node representations that are optimized end-to-end via the TAM objective on the truncated graph, enhancing normal node affinity while suppressing abnormal node affinity.
• Employs a multi-scale aggregation strategy for anomaly scores across different truncation depths to improve robustness and performance.
• Leverages a self-supervised contrastive objective (DGI) as a baseline for comparison, but shows TAM’s superiority through better representation learning grounded in one-class homophily.

Experimental results

Research questions

• RQ1 Does one-class homophily—where normal nodes are strongly affiliated with each other while abnormal nodes are not—exist in real-world graph anomaly detection datasets?
• RQ2 Can local node affinity, defined as similarity to neighbors in representation space, serve as an effective unsupervised anomaly scoring measure?
• RQ3 Can iterative graph truncation to remove non-homophily edges improve the quality of node representations for anomaly detection?
• RQ4 Does optimizing for local affinity on truncated graphs lead to better separation between normal and abnormal nodes compared to standard reconstruction or self-supervised objectives?
• RQ5 How robust is the proposed method to attribute camouflaging, where malicious nodes mimic normal node features?

Key findings

• TAM achieves a 10.5% average improvement in AUROC and a 12.5% average improvement in AUPRC over the best baseline methods on 10 real-world GAD datasets.
• On the OGB-Proteins dataset, TAM achieves an AUROC of 0.7449 and AUPRC of 0.2173, outperforming the second-best method (SL-GAD) by 1.8% AUROC and 4.2% AUPRC.
• On large-scale graphs (e.g., Amazon-all, YelpChi-all), TAM maintains strong performance with AUROC of 0.8476 and 0.5818, respectively, significantly outperforming all baselines.
• Under 30% attribute camouflaging, TAM maintains AUROC of 0.7831 on BlogCatalog and 0.8650 on Facebook, demonstrating robustness to feature-level adversarial manipulation.
• The ablation study confirms that graph truncation is essential: removing it leads to a 15% drop in AUROC on average, indicating that non-homophily edges severely degrade performance.
• Multi-scale score aggregation improves detection performance by up to 8% in AUROC, showing that combining results from different truncation depths enhances robustness.