Zero fine tuning general graph anomaly detection method and system based on adaptive context evolution, and application in food safety risk assessment

Abstract

The invention discloses a zero-fine-tuning general graph anomaly detection method and system based on adaptive context evolution, and is applied to food safety risk assessment. A zero-fine-tuning general graph anomaly detection method based on adaptive context evolution comprises the following steps: firstly, standardizing original graph data into a unified input signal through data preprocessing, and constructing a normalized evolution operator; secondly, through a linear graph state space encoder, depth information propagation in a graph structure is reconstructed into a continuous state evolution process in a spectral domain, and depth node representation containing global context is captured with linear complexity; and finally, dynamically synthesizing normal anchor points adaptive to the current environment from a small number of samples through a self-query dot product attention mechanism, and constructing a self-adaptive metric space to accurately quantify the anomaly degree. According to the technical scheme, the problem that long-distance dependence capture and calculation efficiency are difficult to consider at the same time is solved, the limitation of a generalization island is broken through, and the method has excellent performance, efficiency and universality.

Description

Technical Field

[0001] This invention belongs to the field of graph anomaly detection technology, specifically relating to a zero-fine-tuning general graph anomaly detection method and system based on adaptive context evolution, and its application in food safety risk assessment. Background Technology

[0002] Graphs, as a powerful data structure capable of abstractly representing entities and their complex interactions, have been widely used to represent complex systems such as citation networks, social networks, and financial transaction networks. In these complex topologies, mining anomalous nodes that deviate from canonical patterns from massive amounts of data—a process known as graph anomaly detection—is crucial for maintaining system security and risk management. By fully utilizing the graph's topology and node attributes, we can more accurately identify anomalous data with behavioral patterns or connections that deviate from the norm.

[0003] Despite the excellent detection performance of existing GAD methods, the GAD field still faces two major challenges that limit its application in real-world scenarios. First, there is the inherent contradiction between capturing long-range dependencies and maintaining computational efficiency (The Depth-Efficiency Dilemma). Complex anomaly patterns often do not exist only locally, but are implicit in the nonlinear interactions between nodes and their wide-range neighbors. Using traffic emergencies to describe real-world message transmission, such as… Figure 1 As shown in (a), when a traffic accident causes congestion at an intersection, there are two propagation strategies for the congestion signal. The first is local propagation, where the congestion signal gradually weakens after passing through multiple intersections and cannot be detected by vehicles at a distance. The second is dedicated line propagation by the dispatch center, which, while ensuring high-quality signals, consumes more resources. That is, the congestion signal caused by the traffic accident gradually weakens after passing through multiple intersections, while the congestion signal propagated by the dispatch center, although faithful, is more costly. This reveals the current state of the GAD field: traditional GNNs are limited by their finite receptive field and find it difficult to capture deep dependencies by stacking layers; while the global Transformer series models, although able to capture long-distance dependencies, have limited practicality on large-scale graphs due to their high computational resource requirements.

[0004] However, adapting to multiple scenarios, GAD faces a second challenge: a lack of model generality and transferability (The Generalization Silo). Most current mainstream GAD methods follow a training paradigm of "one model, one dataset," such as... Figure 1As shown in (b), this paradigm arises from the combined effects of traditional methods fitting static distributions specific to a particular domain, relying on fixed decision boundaries, lacking mechanisms for dynamic adaptation to new environments, and the heterogeneity of graph data itself. This forces the model to be trained or fine-tuned from scratch for every new scenario. In contrast, an ideal general GAD method, such as... Figure 1 As shown in (c), it should be able to learn general patterns across diverse source domains and achieve instantaneous inference with zero fine-tuning on any new graph. Furthermore, the extreme scarcity of labeled data in real-world scenarios further compels the search for efficient solutions under the constraint of having only a small number of normal samples.

[0005] To alleviate the above problems, this invention proposes a new graph anomaly detection method and system, and its application in food safety risk assessment. It is a zero-fine-tuning general graph anomaly detection framework based on adaptive context evolution, which achieves an effective balance between depth, efficiency and versatility. Summary of the Invention

[0006] The purpose of this invention is to provide a zero-fine-tuning general graph anomaly detection method based on adaptive context evolution, which solves the dilemma of balancing long-distance dependency capture and computational efficiency, breaks through the limitation of generalization islands, and has superior performance, efficiency and versatility.

[0007] To achieve the above objectives, the technical solution adopted is as follows:

[0008] A zero-fine-tuning general graph anomaly detection method based on adaptive context evolution includes the following steps:

[0009] First, through data preprocessing, the original graph data is standardized into a unified input signal, and a normalized evolution operator is constructed;

[0010] Secondly, by using a linear graph state-space encoder, the depth information propagation in the graph structure is reconstructed into a continuous state evolution process in a spectral domain, capturing the depth node representation containing the global context with linear complexity.

[0011] Finally, by using a self-query dot product attention mechanism, normal anchor points adapted to the current environment are dynamically synthesized from a small number of samples, and an adaptive metric space is constructed to accurately quantify the degree of anomaly.

[0012] Furthermore, in the aforementioned data preprocessing:

[0013] The process of standardizing the original graph data into a unified input signal is defined as follows: ;in, It is the original input signal matrix; It is a unified target dimension that is set;

[0014] The process of the normalization evolution operator is as follows: first, in the original adjacency matrix... Introducing a self-loop, we obtain Next, calculate the normalization operator, whose formula is: , yes The degree matrix.

[0015] Furthermore, the reconstruction process of the linear graph state-space encoder is as follows:

[0016] (1) Construct an input-driven sequence containing multi-scale structural information ;

[0017] (2) From the input driving sequence through reverse causal recombination. Extract the reverse driving sequence of the current batch nodes. ;

[0018] (3) The reverse driving sequence Perform spectral domain state space evolution.

[0019] Furthermore, in step (1), the construction process is as follows:

[0020] First, use a linear mapping layer Unify input signal Map to the hidden space and initialize the 0th-order state. Its formula is: ;

[0021] Subsequently, the system executes The explicit spatial diffusion of the step generates a series of state snapshots, the formula of which is: ;in, Represents the first The physical mapping of neighborhood information in the system;

[0022] After the state snapshots are generated, all the state snapshots are stacked to construct a multi-scale structured driving tensor. That is, the input driving sequence Its formula is: .

[0023] Furthermore, in step (2), the extraction process is as follows: the input driving sequence is... The formula for performing reverse sequence recombination in the time dimension is:

[0024] ;

[0025] in, These are subsequences extracted from a global feature sequence library. Feature extraction of the sequence, It is a pre-constructed reverse-drive sequence.

[0026] Furthermore, in step (3), the evolution of the spectral domain state space uses a diagonalized linear cyclic unit as the evolution kernel, and the evolution formula is: ;in, It is a reverse-driven sequence In the Step input; It is a complex hidden state; It is a diagonal state transition matrix, Parameterization The form; This indicates element-wise multiplication.

[0027] Furthermore, the synthesis process of the normal anchor point is as follows:

[0028] First, extract the context query vector of the support set. Let it be defined as the centroid of the support set sample representation, and its formula is: ;in, Indicates inclusion Support set of known normal samples, It is a depth node representation generated by the linear graph state-space encoder;

[0029] Subsequently, each of the aforementioned support samples is calculated. With context query vector The consistency score is calculated using the following formula: , ;in, It is the unnormalized attention logarithm; (0, 1) is a learnable temperature coefficient;

[0030] Ultimately, normal anchor point It is generated through weighted aggregation, and its formula is: ;in, This is a learnable scaling factor.

[0031] Furthermore, the construction of an adaptive metric space to accurately quantify the degree of anomaly includes: adaptive metric space construction and zero-fine-tuning of anomaly measurement;

[0032] Furthermore, in the aforementioned adaptive metric space construction, the formula for the total loss is: ;

[0033] in, It is a hyperparameter used to balance the strength of various geometric constraints;

[0034] The zero-fine-tuning anomaly measurement process is as follows: first, the support set is used to generate a graph-specific anomaly measurement in real time. normal anchor point Then directly calculate the query node. The geometric drift distance relative to the anchor point is used as the anomaly score, and its formula is as follows: .

[0035] Another objective of this invention is to provide a zero-fine-tuning general graph anomaly detection system based on adaptive context evolution, for implementing the aforementioned zero-fine-tuning general graph anomaly detection method.

[0036] To achieve the above objectives, the technical solution adopted is as follows:

[0037] A zero-fine-tuning general graph anomaly detection system based on adaptive context evolution is used to implement the above-mentioned zero-fine-tuning general graph anomaly detection method, including: a data preprocessing module, a linear graph state space encoder module, and a context-aware metric projector module;

[0038] The data preprocessing module includes: a unified input signal projection submodule and a normalization evolution operator construction submodule, used to standardize the original graph data into a unified input signal and construct a normalization evolution operator;

[0039] The linear graph state space encoder module includes: a sparse input-driven construction submodule, a reverse-order causal recombination submodule, and a spectral domain state space evolution submodule, which are used to propagate and reconstruct the depth information in the graph structure into a continuous state evolution process in a spectral domain, and capture the depth node representation containing the global context with linear complexity.

[0040] The context-aware metric projector module includes: a dynamic normal anchor point generation submodule, an adaptive metric space construction submodule, and a zero-fine-tuning anomaly metric submodule. Through a self-query dot product attention mechanism, it dynamically synthesizes normal anchor points adapted to the current environment from a small number of samples and constructs an adaptive metric space to accurately quantify the degree of anomaly.

[0041] Another objective of this invention is to provide the application of the above-mentioned zero-fine-tuning general graph anomaly detection method or zero-fine-tuning general graph anomaly detection system in food safety risk assessment.

[0042] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0043] This invention proposes a zero-fine-tuning general graph anomaly detection method and system (AceGAD) based on adaptive context evolution. AceGAD is a framework for zero-fine-tuning general graph anomaly detection based on adaptive context evolution. AceGAD achieves an effective balance between depth, efficiency, and generality through a novel information processing perspective. First, addressing the dilemma of long-distance dependencies and computational efficiency, a linear graph state-space encoder (LG-SSE) is designed. This module breaks away from the traditional paradigm of stacking layers in graph convolutions, reconstructing information propagation on the graph as a continuous linear state-space evolution process. This mechanism endows the model with the long-term memory capability of a state-space model (SSM), enabling it to accurately capture long-distance dependencies from the global background to local entities while maintaining linear time complexity. This allows the macroscopic background to effectively highlight microscopic anomalies, effectively alleviating the "depth-efficiency" dilemma and providing high-quality deep node representations for the context-aware metric projector. Second, addressing the challenges of generalization silos and label scarcity, CAM-Pro is constructed. This module abandons fixed classification boundaries specific to the dataset and instead establishes an adaptive metric space. Under the Few-Shot setting, it can dynamically synthesize normalcy anchors adapted to the current graph environment from a small number of normal samples. This mechanism essentially establishes a dynamic reference frame for each new environment, allowing AceGAD to adapt to entirely new graph data without any parameter updates, achieving efficient inference with zero-fine-tuning. The main advantages of this invention are as follows:

[0044] 1. AceGAD was proposed, introducing linear state-space evolution into generalized graph anomaly detection for the first time. It reconstructs graph propagation into a continuous state evolution process within the spectral domain, leveraging the dynamic characteristics of SSM to solve the "depth-efficiency dilemma" in the Generalist GAD field. Specifically, this invention innovatively introduces linear state-space dynamics, designing LG-SSE to construct a general framework that combines efficient long-range modeling capabilities with zero-fine-tuning generalization ability, successfully resolving the depth-efficiency dilemma and achieving accurate memorization of the global context while maintaining linear complexity.

[0045] 2. Establishing a context-aware metric projection paradigm and designing CAM-Pro for zero-fine-tuning inference. The CAM-Pro module in AceGAD is essentially a lightweight graph context learner. Unlike the fixed embedding space of traditional metric learning, CAM-Pro employs an adaptive anchor evolution mechanism. It dynamically aggregates support set information through self-querying attention, instantly constructing a dedicated metric reference frame for each new graph. This enables AceGAD to maintain linear inference efficiency while possessing a meta-ability similar to LLM—"train once, infer everywhere." This mechanism effectively breaks the generalization silo effect and establishes a new paradigm for general graph anomaly detection that is "train once, usable everywhere."

[0046] 3. Extensive experiments were conducted on public datasets across multiple different domains. The results show that the proposed AceGAD outperforms several state-of-the-art baseline models in anomaly detection (ACM improves by 6.72%, cs by 5.46%, and tfinance by 12.24%). Attached Figure Description

[0047] Figure 1 A schematic diagram illustrating the dilemma of the depth and cost of the spread of traffic emergencies (a). (b) Transductive GAD Paradigm (c) Generalist GAD Paradigm.

[0048] Figure 2 This describes the overall process of the AceGAD model.

[0049] Figure 3 The effect of the maximum evolutionary view distance max_dist.

[0050] Figure 4 The impact of a small sample size (shot).

[0051] Figure 5 For time comparison.

[0052] Figure 6-11 The visualizations of attention mechanism prototype generation from Weibo, Amazon, Tfinance, ACM, BlogCatalog, and CS are shown in order. Detailed Implementation

[0053] To further illustrate the application of the zero-fine-tuning general graph anomaly detection method and system based on adaptive context evolution in food safety risk assessment, and to achieve the intended purpose of the invention, the following detailed description, in conjunction with preferred embodiments, details the specific implementation, structure, features, and effects of the proposed method and system based on adaptive context evolution in food safety risk assessment. In the following description, different "embodiments" or "embodiments" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0054] The following will provide a detailed description of the application of the zero-fine-tuning general graph anomaly detection method and system based on adaptive context evolution in food safety risk assessment, using specific embodiments:

[0055] Related Work

[0056] 1. Graph Anomaly Detection

[0057] Graph Anomaly Detection (GAD) aims to identify nodes exhibiting significant anomalies in node attributes or graph structure, and has attracted considerable attention due to its wide application across multiple fields. Early GAD methods primarily relied on shallow statistical or matrix factorization techniques; however, their expressive power was limited when dealing with complex nonlinear dependencies. With the rise of deep learning, methods based on Graph Neural Networks (GNNs) have become the mainstream paradigm in the GAD field. Existing supervised GAD methods strive to fit specific decision boundaries by designing complex graph convolution operators, but they heavily rely on large-scale labeled data. Unsupervised GAD methods capture normal patterns through diverse learning techniques in label-free settings. Among these, data reconstruction-based methods, such as DOMINANT, learn a global representation of the data by training a graph autoencoder and consider nodes with large reconstruction errors to be more likely to be anomalies; contrastive learning-based methods, such as CoLA, identify anomalies by maximizing the consistency between node representations and their local contexts; in addition, some works utilize other auxiliary objectives, such as hop count prediction or affinity modeling, to indirectly define and identify anomalies. While the aforementioned methods perform well on specific datasets, the mainstream paradigm typically follows a "one model, one dataset" training approach. This paradigm results in models lacking cross-domain generalization ability, requiring retraining from scratch for new scenarios and leading to extremely high deployment costs. In recent years, to break down these "generalization silos," researchers have begun exploring general graph anomaly detection. Early cross-domain work achieved knowledge transfer by aligning the feature spaces of the source and target domains, but these methods rely on strong topological similarity between the two domains. ARC leverages contextual learning, enabling a single model to adapt instantly and detect anomalies in new graphs during the inference phase with only a small number of normal samples. Recent research is drawing inspiration from base models, attempting to build zero-shot general detectors. For example, IA-GGAD achieves cross-domain detection through invariance and affinity learning, while UNPrompt achieves it through unified neighborhood cue learning. Unlike these works, AceGAD innovatively introduces linear state-space dynamics, aiming to build a general framework that combines efficient long-range modeling capabilities with zero-fine-tuning generalization.

[0058] 2. State Space Models on Graphs

[0059] Capturing long-range dependencies is crucial for identifying anomalies hidden in complex topologies. Traditional GNNs (such as GCN and GAT) are limited by the over-smoothing problem, making it difficult to effectively capture long-range context by stacking deep networks. Although Graph Transformers introduce a global attention mechanism, its... The computational complexity of graphs limits their application on large-scale graphs. In recent years, Sequence Modules (SSMs) (such as S4, HiPPO, and Mamba) have emerged as an efficient sequence modeling paradigm, boasting a linear time complexity of O(N) and strong long-range memory capabilities, making them a strong contender for Transformers. Recently, researchers have begun to extend SSMs to graph-structured data, namely GraphMamba. For example, first-principles studies have investigated the advantages of SSMs on temporal graphs; dynamically generated graph state-space models (GG-SSMs) have been proposed to handle nonlocal dependencies; and SSM extensions to directed graphs have been further explored. Furthermore, some works have attempted to unify message passing with SSM mechanisms, even validating the effectiveness of GraphMamba in complex applications such as medical image segmentation. However, existing GraphMamba work largely focuses on node classification or graph generation tasks, with little exploration of its potential in general graph anomaly detection. This paper's LG-SSE module is the first to reconstruct graph propagation as a continuous state evolution process within the spectral domain, leveraging the dynamics of SSMs to address the "depth-efficiency dilemma" in the Generalist GAD domain.

[0060] 3. Graph In-Context Learning

[0061] To address the challenges of few samples and zero fine-tuning, contextual learning has become a hot research topic. ICL (Intermediate Context Learning) allows models to adapt to new tasks instantly, solely through contextual examples, without updating parameters. While Large Language Models (LLMs) have demonstrated powerful Graph ICL capabilities, their high inference costs and massive memory consumption make them difficult to implement in real-time anomaly detection systems. Therefore, researchers have begun exploring efficient graph contextual learning mechanisms. For example, theoretical analysis of graph-based ICL has been provided, and a pseudo-label framework based on graph structures has been proposed to optimize contextual cues. The CAM-Pro module in AceGAD is essentially a lightweight graph context learner. Unlike traditional metric learning that learns a fixed embedding space, CAM-Pro employs an adaptive anchor evolution mechanism. It dynamically aggregates support set information through self-query attention, instantly constructing a dedicated metric reference frame for each new graph. This allows AceGAD to maintain linear inference efficiency while possessing the "train once, reason everywhere" meta-ability similar to LLMs.

[0062] Graph anomaly detection, aiming to identify anomalous nodes in a graph whose behavioral patterns or structural relationships differ from the majority of nodes, has attracted widespread attention. However, building a general graph anomaly detection framework adaptable to large-scale, multi-scenario real-world applications faces the following technical bottlenecks: on the one hand, existing models struggle to balance capturing complex long-distance dependencies with maintaining high computational efficiency; on the other hand, mainstream methods are limited by generalization silos and lack cross-domain generalization capabilities to cope with data distribution drift. To alleviate these problems, this invention proposes AceGAD, a zero-fine-tuning general graph anomaly detection method and system based on adaptive context evolution. Specifically, AceGAD comprises two core components: First, to address the dilemma of balancing long-distance dependency capture with computational efficiency, a linear graph state-space encoder (LG-SSE) is designed. This component reconstructs graph propagation into a continuous linear state evolution process, achieving accurate memorization of the global context while maintaining linear time complexity. Second, to overcome the limitations of generalization silos, a context-aware metric projector (CAM-Pro) is proposed. This module constructs an adaptive metric space, enabling the model to adapt to new environments instantly with only a small number of normal samples. It achieves zero-fine-tuning inference on new graphs. Extensive experiments on eight different public benchmark datasets demonstrate that AceGAD has superior performance, efficiency, and versatility.

[0063] Example 1.

[0064] A. Materials and Methods

[0065] 1. Preliminary Knowledge

[0066] (1) Problem definition (symbol)

[0067] Graph and Node Representation: A property graph is formally defined as... .in, Representative includes A set of nodes, The set of edges. The topology of a graph is represented by an adjacency matrix. Description, in which if ,but Otherwise, it is 0. Each node Associated with a feature vector, the features of all nodes together constitute the feature matrix. ,in This represents the original feature dimension.

[0068] Exception definition: in the graph In, node set It can be divided into normal node sets With abnormal node set ,satisfy and Normally, anomalous nodes are rare, that is... Each node's label is a vector. It means that if ,but ,on the contrary .

[0069] (2) Conventional GAD Paradigm

[0070] In the traditional graph anomaly detection framework, the core objective is to detect a single, given graph dataset. Learn an anomaly scoring function This function is designed for each node in the graph. Assign an abnormal score And expect that for any and They all In this paradigm, model training, validation, and testing are all performed on a graph sampled from the same data distribution. Whether using supervised methods (utilizing partial...) ) or unsupervised method (not utilizing) The model that it ultimately produces Its applicability is usually limited to specific graphs that are highly similar to the training data.

[0071] (3) Generalist GAD Paradigm

[0072] Unlike traditional paradigms, general graph anomaly detection aims to develop a single, highly generalizable model. The model is based on the source graph dataset of the Diverse. After a one-time training, it can be directly applied to a series of new and previously unseen target graph datasets. And without any retraining or fine-tuning. In this invention, we focus on the most challenging and realistic setting: "One-class Few-shot GAD". Its formal definition is as follows: a... On a pre-trained general model And one from something never seen before, something entirely new, from Target map .from Extracted from, containing Support set of known normal nodes , It is a very small number (e.g., 10), and .Model A prototype needs to be formed using the support set S, and then quantified. All that does not belong to query set node The distance from the prototype is the anomaly score.

[0073] 2. Model Framework

[0074] This invention presents a zero-fine-tuning general graph anomaly detection method and system (AceGAD) based on adaptive context evolution, and its application in food safety risk assessment. The overall architecture of AceGAD is shown in Figure 2, primarily comprising three core components: a data preprocessing module, a linear graph state-space encoder (LG-SSE), and a context-aware metric projector (CAM-Pro). First, the data preprocessing module standardizes the original graph data into a unified input signal and constructs a normalized evolution operator. Second, to resolve the contradiction between long-distance dependencies and computational efficiency, the linear graph state-space encoder (LG-SSE) is designed. This module captures deep node representations containing global context with linear complexity through continuous state evolution processes in the spectral domain. Finally, to achieve zero-fine-tuning inference on new graphs, the context-aware metric projector (CAM-Pro) is proposed. This module constructs an adaptive metric space by dynamically synthesizing "normal anchor points" adapted to the current environment from a small number of samples to accurately quantify the degree of anomaly.

[0075] The details of each module and step are as follows:

[0076] (1) Data preprocessing

[0077] To enable the model to handle graph data from any domain, the original graph is mapped to a canonical latent space. This invention introduces a data preprocessing module into AceGAD, which primarily performs two transformations: converting node attributes of varying dimensions into a unified input signal, and reconstructing the original topology into a numerically stable normalized evolution operator. These two standardized system inputs provide the necessary mathematical foundation for subsequent state-space evolution.

[0078] ① Unified Input Signal Projection

[0079] This embodiment introduces a projection function. As a non-parametric channel adapter, to ensure maximum generalization capability with zero-fine-tuning settings, this adapter employs a statistical transformation strategy to map node features to a unified latent signal space. This process is defined as follows:

[0080]

[0081] in, It is the original input signal matrix; It is the defined unified target dimension, which is the number of channels in the potential signal space. According to the original dimension With the target dimension Relationship adaptive execution strategy, when When principal component analysis (PCA) is used to extract the main energy components; when At this time, zero-padding is used for expansion. Through this step, all graph data is converted into compatible system input drive signals. .

[0082] ② Normalized Evolution Operator Construction

[0083] From a state-space perspective, the graph's topology defines the trajectory of state information flowing between nodes. To ensure numerical stability during state evolution and prevent gradient anomalies, a standardized propagation operator needs to be constructed. A symmetric normalized adjacency matrix with self-loops is adopted as the system's evolution operator.

[0084] First, in the original adjacency matrix Introducing a self-loop, we obtain This step is crucial in dynamics, as it ensures that nodes can achieve state retention (i.e., the state at the current moment can be passed to the next moment) during discrete state evolution steps.

[0085] Then, the normalization operator is calculated, and its formula is: ;in yes The degree matrix. This spectral normalization process constrains the eigenvalues ​​of the operator to... Within the interval, the convergence and stability of the subsequent linear state evolution process are theoretically guaranteed.

[0086] Therefore, the data preprocessing module, through the above two steps, transforms any original image... Transform the system input binary into a linear state space That is, the normalized evolution operator and the unified input signal.

[0087] (2) Linear Graph State-Space Encoder (LG-SSE)

[0088] The Linear Graph State Space Encoder (LG-SSE) is the core of the AceGAD framework. Unlike traditional GNNs that passively expand the receptive field by stacking layers, LG-SSE reconstructs the propagation of depth information in the graph structure as a continuous linear state space evolution process. This module aims to actively capture long-distance dependencies from the wide-area background to local entities in the latent space with linear time complexity. It consists of three sub-modules: sparse input-driven construction, reverse-order causal recombination, and spectral domain state space evolution.

[0089] ①Sparse Input Driver Construction

[0090] To drive the evolution of the state-space model (SSM), an input driver sequence containing multi-scale structural information is first required. This embodiment utilizes the normalized evolution operator defined above. It efficiently generates sequence snapshots of graph states through sparse matrix multiplication.

[0091] This process is formalized as the driving effect of an evolutionary operator on the system's input signal. First, a linear mapping layer is used... Unify input signal Map to the hidden space and initialize the 0th-order state. Its formula is: .

[0092] Subsequently, the system executes The explicit spatial diffusion of the step generates a series of state snapshots, the formula of which is: ;in, Represents the first The physical mapping of neighborhood information in the system. After state snapshots are generated, all state snapshots are stacked. This process does not introduce nonlinear activation; essentially, it constructs a multi-scale structured driving tensor. It stores the complete information path from itself to its distant neighbors for each node, and its formula is: In this context, max_dist defines the length of the driving sequence, which is the maximum evolutionary horizon for the system to trace back its history. As a pre-computed global feature sequence library, it will be efficiently sliced ​​and called during subsequent training.

[0093] ② Reverse-Causal Driver Organization

[0094] During the batch training phase, from Extract the driving sequence of the current batch nodes. To implement the context-aware concept, the arrow of time for the sequence needs to be redefined.

[0095] Performing reverse organization on the extracted sequence along the time dimension essentially redefines the time arrow of the sequence: that is, establishing a time arrow from... Jump (farthest context) points to The causal order of jumps (local entities) is given by the following formula: ;in, These are subsequences extracted from a global feature sequence library. Further feature extraction is performed on the sequence. It is a pre-constructed reverse-driven sequence. This flip operation has profound physical significance: it forces the state-space model to start with the global context as initial conditions, and gradually focus and converge to local entities as the sequence evolves. This evolutionary perspective from far to near allows the model to highlight the anomalies in micro-behavior through the accumulation of macro-context, which is a key step in achieving context-aware measurement.

[0096] From the perspective of linear state-space dynamics, reverse sequence recombination is a necessary theoretical constraint for node-level anomaly detection tasks. In spectral state-space evolution, although the state transition matrix... It can maintain long-distance dependencies to a certain extent, but is limited by the system's inherent memory decay mechanism. Input-driven processes at the end of the evolutionary sequence will remain in the final state. It occupies a dominant position in the composition. Let... This is a forward-order sequence (from nearest to farthest). If this is used as the input driver for the system, as the evolutionary steps progress, the target node... The idiosyncratic information will undergo the greatest degree of decay, and the final state It will converge to the distant background. The characteristic distribution of this signal causes key anomalous signals to be masked by background noise. In contrast, the reverse sequence proposed in this invention... A conditional state generation process was constructed. The system first ingests the remote context. Using the accumulated global normalized distribution in the latent space as a priori background, the target node is then ingested at the end of the evolutionary trajectory. This mechanism enables the final potential representation Essentially aligned to This means that the local state is given a global context. This representation maximizes the contrast between local features and the global background, directly amplifies anomalous signals that deviate from the background norm, and thus significantly improves the detection sensitivity.

[0097] ③ Spectral State-Space Evolution

[0098] Construct the reverse driving sequence Then, it is fed into the core evolutionary unit—the spectral domain state-space evolver. A diagonalized linear loop unit (Diagonal LRU) is used as the evolutionary kernel. This component is essentially a discretized linear state-space equation, with the following formula: . In the formula, It is a driving sequence In the Step input; It is a complex hidden state, which stores accumulated information from global evolution to local; It is a diagonal state transition matrix, Parameterization In this spectral domain parameterization, the modulus is in the form of... Precise control was achieved over long-distance dependent memory decay, while phase... This captures the structural oscillation of the graph signal; This indicates element-wise multiplication.

[0099] When evolutionary steps Proceed from 1 to Hidden state A complete state integration from the global background to local entities has been completed. To transform this set of complex states containing deep dynamic information into a real-number representation usable by downstream anomaly detection tasks, a state readout and projection mechanism is introduced. The final deep node representation... The calculation formula is: . In the formula, It is the output mixing matrix, which is responsible for linearly combining the decoupled state channels; the Real(·) operation performs domain transformation, discarding the imaginary part information and mapping the signal from the abstract complex spectral domain back to the physical real feature space. It is a nonlinear output projection layer designed to enhance the expressive power of linear state-space models and adapt to complex anomaly detection boundaries. LayerNorm is used to normalize the distribution of the final embedding, ensuring the input stability of the subsequent metric projector (CAM-Pro).

[0100] This output mechanism allows LG-SSE to fully leverage the inherent long-term memory capability of the state-space model (SSM), while compensating for the fitting limitations of purely linear systems through a nonlinear readout layer.

[0101] (3) Context-Aware Metric Projector (CAM-Pro)

[0102] The ultimate goal of AceGAD is to achieve zero-fine-tuning inference across domains. Traditional GAD methods aim to fit fixed decision boundaries; however, this static partitioning paradigm is highly dependent on the specific distribution of the source domain and often fails due to distribution shift when facing new graphs with vastly different topologies. To overcome this limitation, this invention constructs an adaptive metric space. The context-aware metric projector (CAM-Pro) is responsible for mapping the deep node representations output by LG-SSE to a geometric space. Within this space, the degree of geometric shift of the query node relative to the normalcy anchor in the current environment is measured to quantify the anomaly score. This module consists of three sub-processes: dynamic normalcy anchor generation, adaptive metric space construction, and zero-fine-tuning anomaly measurement.

[0103] ① Dynamic Normalcy Anchor Synthesis

[0104] In graph anomaly detection, the "normal patterns" of different graph data exhibit significant context dependence. To establish a benchmark in the current graph environment, CAM-Pro dynamically synthesizes a normalcy anchor that can represent the current domain's canonical patterns using a small-sample support set S. To suppress the interference of edge samples or noise in the support set on the benchmark, a self-queried dot-product attention mechanism is employed to achieve robust anchor estimation.

[0105] First, extract the context query vector of the support set. Let it be defined as the centroid of the support set sample representation, and its formula is: . In the formula, Indicates inclusion The support set of known normal samples (i.e., the number of shots). It is a depth node representation generated by the LG-SSE encoder.

[0106] Then, each support sample will be calculated. With context query vector The consistency score is used to assess the representativeness of each sample to the normal pattern. This process is based on the formula: , . In the formula, It is the unnormalized attention logits, which measures... Consistent with the direction of the center of mass; (0, 1) is a learnable temperature parameter used to adjust the sharpness of the attention distribution. Smaller... It amplifies the weight of high-confidence samples, thereby suppressing the influence of edge noise.

[0107] Ultimately, normal anchor point Generates through weighted aggregation and introduces a learnable scaling factor. To optimize its modulus in the metric space, the formula is: .here, It is a learnable scalar scaling parameter that allows the model to adaptively adjust the norm of the anchor vector to obtain a better geometric representation. The anchor... It serves as the geometric origin of the current graph data in the metric space, providing a dynamic reference frame for subsequent anomaly measurements.

[0108] ② Adaptive Metric Space Construction

[0109] To ensure the generated metric space possesses good discriminative power, this invention designs a geometric constraint objective function to guide the topological evolution of the space. This objective function consists of four parts.

[0110] Positive sample narrowing loss (Positive Attraction): Minimizes the distance from normal query nodes to normal anchor points. The squared distance encourages all normal samples to closely approximate the prototype in the embedding space, and the formula is: .

[0111] Negative sample push-off loss (Negative Repulsion): For anomalous query samples, a squared hinge loss is used as a penalty. The anomalous sample is only penalized if it enters a normal anchor point. safety radius A penalty is only applied when these abnormal samples are removed from the normal cluster. The formula is as follows: . In the formula, It is a context-aware dynamic boundary. It is the basic margin hyperparameter. and These are the samples within the support set and the normal anchor points. The mean and standard deviation of the distance. This design allows the safety radius to adaptively adjust according to the density of the current normal clusters, making the model more adaptable to normal clusters of different shapes.

[0112] Intraclass compactness loss (Compactness): As a regularization term, it directly constrains the distance from samples within the support set to normal anchor points, preventing normal anchor points from being too sparse and enhancing intra-class cohesion. Its formula is: .

[0113] Anchor Regularization Loss (Regularization): Constrains the magnitude of the anchor vector to prevent numerical drift. Its formula is: .

[0114] The formula for total loss is: .in, This is a hyperparameter used to balance the strength of various geometric constraints. By minimizing this objective, CAM-Pro is actually learning a general metric, namely how to map complex graph structure differences to standardized geometric distance differences.

[0115] ③ Zero-Fine-Tuning Anomaly Metric

[0116] During the inference phase, we are faced with entirely new graph data. AceGAD demonstrates its core advantage as a general-purpose framework: zero-fine-tuning capability. Firstly, it leverages the support set to generate graph-specific features on the fly. normal anchor point Then directly calculate the query node. The geometric drift distance relative to the anchor point is used as the anomaly score, and its formula is as follows: .

[0117] This distance directly quantifies the degree to which a node deviates from the current environmental norm. Since the metric is a general geometric law learned from a large number of source domains, AceGAD can adapt to the topology and distribution characteristics of any new graph in real time, establishing a general graph anomaly detection paradigm of "train once, reason everywhere".

[0118] (4) Algorithm and complexity analysis

[0119] 1) Algorithm Description

[0120] Algorithm descriptions of feature propagation, training, and inference in AceGAD are summarized in Algorithm 1, Algorithm 2, and Algorithm 3, respectively.

[0121] Table 1 Algorithm 1

[0122]

[0123] Table 2 Algorithm 2

[0124]

[0125]

[0126] Table 3 Algorithm 3

[0127]

[0128]

[0129] 2) Complexity Analysis

[0130] Design Diagram The total number of nodes is The total number of edges is The channel dimension of the potential signal space is... The maximum historical view distance for system backtracking is max_dist. In batch processing, the batch size is set to... The size of the support set is The computational complexity of the AceGAD model consists of two main stages: one-time sparse input-driven construction and batch-based online state evolution and metric inference.

[0131] Sparse Input Driver Construction Phase: This phase aims to precompute the global driver tensor using a normalized evolution operator. Its computational overhead mainly consists of two parts: the initial signal projection complexity is... ,as well as The complexity is driven by sparse matrix multiplication. Since the complexity of sparse matrix multiplication depends on the number of non-zero elements (i.e., the number of edges), this step is... Therefore, the total complexity of this stage is... · Considering that in large-scale sparse graphs, the following conditions are usually met: and Since the complexity is constant, the complexity of this stage is mainly driven by the evolution operator and can be approximated as... It is worth noting that this stage is one-off and can be reused later after the build is complete.

[0132] State Evolution & Metric Inference Phase: This phase runs in mini-batches. The first step is sequence transformation and recombination, slicing out portions of size [value missing] from the pre-computed tensor. The data, its The transformation complexity is Secondly, regarding the spectral domain state-space evolution, thanks to the diagonalization design of the Diagonal LRU, the operations on the state transition matrix only involve element-wise multiplication. Therefore, the complexity of state evolution is much lower than that of the sequence length. and number of channels They all show a linear relationship, that is Finally, there is anchor point synthesis and measurement, with a complexity of O(n log n). Compared to the previous two, this is negligible. In summary, the main computational overhead for processing a batch of data comes from sequence transformation and linear state evolution. Therefore, the total complexity is approximately... .

[0133] B. Experiments and Result Analysis

[0134] 1. Experimental Setup

[0135] ① Datasets: To train and test the general GAD model, this embodiment trains the baseline and AceGAD models on one set of graph datasets and tests them on another set of graph datasets. To ensure the comprehensiveness and challenge of the evaluation, the carefully selected datasets in this embodiment span multiple domains, including citation networks, social networks, e-commerce joint review networks, and microblog data. Each domain's dataset contains either injected anomalies or real anomalies. The training set consists of the largest dataset in each domain, while the remaining datasets are reserved as the test set. Specifically, as shown in Table 4, the training datasets... Includes PubMed, Flickr, Questions, and YelpChi. Test dataset. Includes Cora, Citeseer, ACM, BlogCatalog, Weibo, Amazon, cs, and tfinance.

[0136] Table 4. Statistics of the datasets

[0137]

[0138] Cora, CiteSeer, PubMed, and ACM are four citation networks. In a citation network, nodes represent scientific publications, and edges represent citation relationships between them. Each publication is characterized by a bag-of-words representation of its node attribute vectors, the dimension of which is determined by the size of its respective dictionary.

[0139] BlogCatalog and Flickr are social blog directories. Each user is represented as a node, and links between nodes symbolize mutual following. Node attributes contain personalized text content generated by the user within the social network, such as blog posts with tagged descriptions or shared photos.

[0140] The Weibo dataset contains graphs of users and their associated tags from the Weibo platform. Within a defined time window (e.g., 60 seconds), consecutive posts by a user are flagged as potentially suspicious behavior. Users who participate in at least a few such instances are categorized as "suspicious." The original feature vectors include the location of the Weibo posts and bag-of-words features.

[0141] The Questions dataset comes from Yandex Q, a platform specifically designed for question answering. Nodes represent users, and the connections between nodes indicate whether question-and-answer interactions occurred within a one-year timeframe. Node features are derived from the average FastText embeddings of words in user descriptions, with additional binary features representing users without descriptions.

[0142] Amazon and YelpChi are datasets about the relationships between users and reviews. Amazon aims to identify users who pay to write fake reviews, and three different graph datasets were derived from Amazon using different types of relationships to construct adjacency matrices. YelpChi aims to identify anomalous reviews on Yelp.com that unfairly promote or disparage products or businesses. Three different graph datasets were obtained from Yelp using different connections of user, product review text, and time. This work focuses on Amazon-UPU (users who have reviewed at least one product) and YelpChi-RUR (reviews posted by the same user).

[0143] The Coauthor-CS dataset, sourced from the Microsoft Academic Graph database, is an academic network describing author collaborations in the field of computer science. Nodes represent researchers, and edges indicate that two individuals have co-authored papers. Node features consist of keywords from the authors' published papers. Because academic collaborations often exhibit strong community effects, this dataset is frequently used to test models' ability to capture close connections within communities and identify anomalous connections across communities.

[0144] The tfinance dataset originates from real and complex Fintech transaction networks and is specifically designed for graph anomaly detection research in the field of financial risk control. Nodes represent financial accounts, and edges represent transfers or transactions between accounts. This dataset contains real fraud labels, primarily involving money laundering, online gambling, or fraudulent accounts. Its notable characteristics include severe spoofing and class imbalance, making it a key benchmark for validating the effectiveness of models in handling high-risk, highly concealed financial anomaly transaction scenarios.

[0145] ② Baseline: To comprehensively evaluate the performance of AceGAD, this embodiment compares it with a series of representative supervised and unsupervised GAD methods. Supervised methods include traditional GNN methods such as GCN and GAT, as well as three methods specifically designed for GAD, such as BGNN, BWGNN, and GHRN. Unsupervised methods include four different design paradigms, such as the generative method DOMINANT, the contrastive learning method CoLA, the hop count prediction method HCM-A, and the affinity-based method TAM. Few-shot methods include, for example, the context-based learning method ARC.

[0146] As a pioneering model in the field of GNN, GCN is known for its ability to process graph-structured data using neighborhood aggregation, which facilitates efficient node feature extraction and representation learning.

[0147] GAT incorporates an attention mechanism into the GNN framework, enabling dynamic weighting of node contributions. It optimizes its attention based on different downstream tasks to achieve high-quality node representations.

[0148] BGNN is a GNN that combines Gradient Boosting Decision Tree (GBDT) and GNN for graphs with tabular node features. It leverages GBDT to handle heterogeneous features, while GNN considers the graph's structure, significantly improving performance on a wide variety of graphs with tabular features.

[0149] BWGNN features spectral and spatially localized bandpass filters, which can better handle the "right shift" phenomenon in anomalies, where the distribution of spectral energy is concentrated at high frequencies rather than low frequencies.

[0150] GHRN is a graph-based heterogeneous sensing supervised anomaly detection method. By emphasizing the high-frequency components of the graph, this method can effectively reduce inter-class edges, thereby improving the overall performance of anomaly detection.

[0151] DOMINANT combines GCN and deep autoencoders, with the learning objective of jointly reconstructing the adjacency matrix and node features. Its goal is to identify structural and attribute anomalies based on reconstruction errors.

[0152] CoLA is a contrastive self-supervised learning approach for anomaly detection in graphs with node attributes. This framework captures the relationships between each node and its neighboring substructures in an unsupervised manner by sampling new contrastive pairs and leveraging local information from the graph.

[0153] HCM-A b uses hop count prediction as a self-supervised task, improving anomaly identification by modeling local and global contextual information. Furthermore, HCM-A introduces two novel anomaly scores and incorporates Bayesian learning to train the model for anomaly capture.

[0154] TAM is designed based on a class of homogeneity and local affinity. The learning objective of TAM is to perform end-to-end optimization of the proposed outlier metric (i.e. affinity) on a truncated adjacency matrix.

[0155] ARC is a context-based learning-based general graph anomaly detection framework designed to detect anomalies across different datasets using a single model without specific fine-tuning. It utilizes a cross-attention mechanism to reconstruct the embeddings of query nodes based on a small number of normal context samples, and then instantaneously quantifies the anomaly level of nodes in the new graph by calculating the drift distance between the original and reconstructed embeddings.

[0156] ③ Evaluation Metrics and Implementation: AUROC and AUPRC were used as evaluation metrics for GAD. All reported results are the mean ± standard deviation of 5 independent randomized trials. The AceGAD model of this invention was trained on four training sets and evaluated on 8 test sets using metric learning. For supervised baselines, the same training and testing process was followed (denoted as "pre-training only"), as unlabeled anomalies were available for fine-tuning. For unsupervised baselines, two settings were considered: "pre-training only" and "pre-training & fine-tuning". In the latter case, the model was allowed to undergo additional fine-tuning on each test graph using its own unsupervised objective for several epochs. To normalize the feature space in the baseline method, learnable projections or random projections were used as adapters between the original features and the model input layers. Optimal hyperparameters for the baseline and AceGAD were determined using a random search. Since the goal is to train a general GAD model, dataset-specific hyperparameter searches were not performed; instead, the same set of hyperparameters was used for all test datasets.

[0157] 2. Main Experiments: Performance of AceGAD on 8 Datasets

[0158] Table 5: Anomaly detection performance as a percentage (mean ± std). First-ranked anomaly is in bold, second-ranked anomaly is underlined.

[0159]

[0160] AceGAD was comprehensively compared with a series of state-of-the-art baseline models on eight test datasets covering different domains. Table 5 shows the performance of each model on the AUROC metric (mean ± standard deviation). The experimental results clearly and strongly demonstrate the superior performance and generalization ability of the proposed AceGAD framework on general graph anomaly detection tasks. AceGAD achieved state-of-the-art performance on six datasets and also showed highly competitive performance on two other datasets. The performance improvement was also extremely significant on some datasets (e.g., a 6.72% improvement over the fine-tuned baseline TAM on the ACM dataset; a 5.46% improvement over ARC on the cs dataset; and a 12.24% improvement over ARC on the tfinance dataset).

[0161] Under the "pre-trained only" setting, all traditional supervised and unsupervised baseline models generally performed poorly when faced with unfamiliar test graphs, even exhibiting significant negative transfer learning. While unsupervised baselines achieved significant performance improvements through additional fine-tuning on each test set (e.g., TAM improved from 74.43% to 86.29% on ACM), AceGAD outperformed these finely tuned baseline models across the board without any fine-tuning. Baseline models rely on the traditional transfer learning path of "pre-training + downstream task fine-tuning," which not only requires additional computational overhead but also contradicts the initial goal of rapidly adapting to new graphs. AceGAD, through its unique context-aware metric projection paradigm, can learn representations of normal anchor points from the target graph on the fly during the inference phase, thus achieving zero-fine-tuning inference. AceGAD achieves superior performance compared to traditional paradigms with lower deployment costs.

[0162] As the first advanced model to explore a general GAD paradigm, ARC significantly outperformed traditional baselines, validating the enormous potential of this research direction. AceGAD, however, demonstrated even greater competitiveness in performance comparisons with ARC.

[0163] Table 6: Anomaly detection performance as a percentage (mean ± std). First-ranked items are bolded, second-ranked items are underlined.

[0164]

[0165] Regarding AUPRC, Table 6 presents a comprehensive comparison consistent with the AUROC results. Specifically, the following observations are made: Without any fine-tuning, AceGAD still demonstrates excellent anomaly detection performance in general GAD scenarios. Specifically, AceGAD achieves state-of-the-art performance on four of the eight datasets and exhibits highly competitive performance on the remaining datasets. On some datasets, AceGAD achieves a 109.4% improvement over the best baseline on the tfinance dataset. Traditional GAD methods, pre-trained only on specific datasets, often suffer from poor generalization to new datasets. Specifically, the performance of these existing methods (such as DOMINANT, CoLA, etc.) is highly inconsistent across different datasets, which can be attributed to their capture of only specific anomaly patterns in the training graph. Although baseline methods can achieve better performance in most cases using dataset-specific fine-tuning, the performance improvement is often accompanied by high computational and cost, and the improvement is small on some complex datasets (e.g., the fine-tuned DOMINANT in tfinance only achieves 22.76%), with the final performance still far lower than AceGAD, further highlighting the limitations of the traditional paradigm.

[0166] 3. Ablation experiment:

[0167] ① LG-SSE analysis:

[0168] 1) AceGAD w / o Sequential Processing

[0169] The spectral domain state-space evolver was replaced with attention-based weighted pooling to verify the necessity of the evolution mechanism in the linear graph state-space encoder.

[0170] To verify the effectiveness of the proposed linear state-space evolution mechanism in capturing deep structural information, a robust baseline variant, named 'AceGAD w / o Sequential Processing', was designed. This variant replaces the original spectral domain state-space evolver with an attention-weighted pooling layer. While the attention mechanism can adaptively filter out high-contribution neighborhood snapshots, it essentially treats multi-hop structures as discrete and independent feature views, ignoring the continuous dynamic trajectory of the graph signal as it propagates.

[0171] Table 7 AceGAD and its variants

[0172]

[0173] Experimental results (see Table 7) show that the performance of this variant is significantly lower than that of the full AceGAD model of this invention on all eight datasets. This clearly demonstrates that while the attention mechanism can adaptively filter key neighborhood snapshots, it degenerates the ordered driving sequence into a discrete and independent feature set, disrupting the continuous dynamic trajectory of the graph signal as it changes with the propagation depth.

[0174] 2) AceGAD w / o Flip

[0175] Remove reverse order recombination to verify the anomaly detection mechanism based on the conditional state generation process.

[0176] To verify the key role of the reverse evolution perspective of the conditional state generation process in the LG-SSE module in combating system memory decay and strengthening local anomalous signals, a variant 'AceGAD w / o Flip' was constructed. This variant removes the sequence inversion operation and retains only the sequence from near to far.

[0177] Experimental results (see Table 7) show that the performance of this variant is significantly lower than that of the complete AceGAD model of this invention on all eight datasets. This clearly demonstrates that, constrained by the inherent memory decay mechanism of state-space models, forward-order input causes the idiosyncratic information of the target node to be diluted by background noise when evolving over long distances to the endpoint. In contrast, the reverse-order strategy proposed in this invention successfully constructs a robust conditional state generation process (P(Entity|Context)) by placing the target node at the evolutionary end where the system memory is clearest, thereby ensuring the maximum preservation of local anomalous signals against the global background.

[0178] ② CAM-Pro Analysis

[0179] AceGAD w / o Attention: Replace the self-query dot product attention mechanism in normal anchor point generation with average generation to verify the effectiveness of the self-query dot product attention mechanism.

[0180] In few-shot metric learning paradigms, the normal samples in the support set are not inherently equal. Some samples may be at the core of the normal data distribution, serving as exemplary normal points; while others may be at the edge of the distribution, serving as marginal normal points. The core question is: is constructing a more robust and representative normal anchor point by adaptively assigning different weights to these support set samples through a self-query dot product attention mechanism significantly better than a simple averaging strategy that treats all support set samples equally? To answer this question, an ablation variant called "AceGAD w / o Attention" is designed. It replaces the self-query dot product attention mechanism in normal anchor point generation with a simple, parameter-free arithmetic averaging operation that aggregates the embedding vectors of all support set samples with equal weights into a normal anchor point.

[0181] Experimental results (see Table 7) show that this variant exhibits performance degradation on all eight datasets. This result strongly demonstrates that simple average aggregation cannot effectively resist distribution bias and noise interference within the support set; on the contrary, AceGAD's self-query dot product attention mechanism constructs a more robust, compact, and accurate metric benchmark that can characterize the current data manifold by dynamically suppressing the weights of marginal samples and focusing on high-confidence core samples.

[0182] 4. Parameter sensitivity analysis:

[0183] ① The effect of maximum evolutionary distance (max_dist)

[0184] To investigate the dependence of the AceGAD model on the range of neighborhood information and to verify the effectiveness of the linear graph state-space encoder in capturing long-range dependencies, a detailed sensitivity analysis was conducted on the key hyperparameter—maximum evolutionary lookout distance (max_dist). max_dist directly determines the maximum neighborhood range that the model can reach when constructing driving sequences, i.e., the depth of the evolutionary lookout distance. On a series of representative test datasets with different characteristics, the value of max_dist was varied from 2 to 12, and the corresponding AUROC performance was recorded. Experimental results are as follows: Figure 3 As shown.

[0185] Analysis of the maximum evolutionary view distance `max_dist` reveals several key aspects of the model's working mechanism. For example... Figure 3As shown, a significant trend is that performance improves significantly across almost all datasets as max_dist increases from a small value (e.g., 2) to a medium value (e.g., 8). This strongly confirms the universal importance of long-distance dependencies in identifying complex anomalous patterns and validates the effectiveness of the linear graph state-space encoder in capturing this crucial information. However, when the evolutionary distance increases further (e.g., max_dist > 10), the performance gain generally saturates, and even shows slight decay in some cases. While larger receptivities can introduce richer context, excessively distant nodes may also introduce noise, indicating the existence of an optimal depth range that maximizes the signal-to-noise ratio. Crucially, despite the optimal depth exhibiting some data dependence—reflecting the intrinsic differences in anomalous patterns across different graph data—AceGAD's performance shows high stability over a wide max_dist range.

[0186] ② The impact of a small sample size (shot)

[0187] To evaluate the performance of the AceGAD framework in a single-class few-shot setting and to explore its sensitivity to the support set size, a detailed analysis of the key hyperparameter—the few-shot number (shot, or K)—was conducted. In the general inference framework, the model dynamically constructs normal anchor points for new graphs using only these K known normal context nodes. On a series of representative test datasets, the shot value was varied from 5 to 50, and the corresponding AUROC performance was recorded. Experimental results are as follows: Figure 4 As shown.

[0188] On the vast majority of datasets, near-optimal performance is achieved with only a very small number of normal samples (shot=10), strongly demonstrating the ability of the context-aware metric projector of this invention to efficiently extract "normal" patterns from limited information. Furthermore, the performance curve exhibits a non-monotonic trend; as the number of shots increases further (shot>10), performance either tends to saturate or shows a significant decline on some datasets (such as Amazon). The latter reveals an inherent challenge of single-class learning: a larger support set increases the probability of sampling boundary normal samples that may contaminate normal anchors, exceeding the information gain they provide, causing the synthesized normal anchors to drift and blurring the fine boundary with anomalies. In summary, this invention can determine K=10 as the optimal geometrical equilibrium between information integrity and sampling purity, verifying its robustness as a general inference default configuration.

[0189] 5. Efficiency Analysis

[0190] To evaluate the runtime efficiency of AceGAD, inference and fine-tuning times were compared on the ACM dataset. The results are as follows: Figure 5 As shown, firstly, thanks to the linear time complexity of the linear graph state-space encoder, the model's inference speed is extremely fast, demonstrating performance comparable to the fastest GNNs (such as GCN and BWGNN) and significantly outperforming unsupervised methods in terms of efficiency. Furthermore, dataset-specific fine-tuning consumes more time than inference. The advantage of the AceGAD model in this invention lies in completely eliminating the need for time-consuming fine-tuning on new graphs.

[0191] 6. Visualization

[0192] ① To further explore the underlying working principle and interpretability of the self-query dot product attention mechanism proposed in this invention, its decision-making process on multiple benchmark datasets was visualized. For example... Figure 6-11 As shown, this mechanism is not a fixed weight calculator, but an adaptive weighting strategy that can dynamically switch between multiple core strategies based on the geometric distribution of the support set samples in the embedding space.

[0193] The following findings were made: In the Weibo and Amazon datasets, where the support set samples are highly discrete, the mechanism adopts a single-point dominance strategy, assigning almost all weights to a relatively central anchor point to combat noise interference from edge points; in tfinance, where there are clear core clusters, it switches to a core subset consensus strategy, primarily weighting among members within the cluster; and in the ACM and BlogCatalog datasets, where the support set samples are extremely homogeneous, the model adaptively converges to the optimal average weighting strategy, as it determines that fine-grained weight differentiation is unnecessary in this scenario. Particularly noteworthy is that when facing the more complex CS dataset, while the mechanism exhibits its average weighting strategy, the presence of local "weight counterexamples" (i.e., samples closer together have lower weights) more profoundly reveals the nonlinear characteristics of the high-dimensional embedding space.

[0194] Traditional GNNs treat neighborhood aggregation as discrete matrix multiplication steps, while the LG-SSE of this invention reconstructs this process as a continuous dynamic evolution by constructing a normalized evolutionary operator. As defined in the formula, the iteration of sparse matrix multiplication essentially simulates the physical diffusion of information on a graph. The unique aspect of this mechanism is that it transforms the depth of the graph into the length of the sequence, allowing the model to construct a complete information path from local entities to the global context while maintaining linear time complexity, thus avoiding the oversmoothing problem of deep GNNs. Furthermore, this invention finds that continuous evolution alone is insufficient. The reverse causal recombination mechanism of LG-SSE establishes a conditional generation process with the global context as a priori by reversing the time arrow of the information flow. This mechanism cleverly avoids the information decay of target nodes caused by long-distance evolution in sequence models, ensuring that the local specific information required for anomaly detection is not overwhelmed by the macroscopic background. The spectral domain state-space evolver further enhances this capture capability. By parameterizing the state transition matrix as magnitude (decay) and phase (rotation), the model can not only control the memory decay of long-range information through magnitude (solving the gradient vanishing problem), but also capture structural oscillations of the graph signal during propagation using phase. This mechanism ensures that the model can distinguish between effective signals and background noise when dealing with deep graph structures.

[0195] Based on this, this invention proposes a novel "train once, use everywhere" solution to address the cutting-edge challenge of Generalist Graph Anomaly Detection (GAD). The core of AceGAD lies in two major design features: First, LG-SSE is designed, which, under the generalist GAD framework, reconstructs long-range dependency capture into a continuous state evolution process within the spectral domain. This achieves accurate memorization of the global context while maintaining linear time complexity, effectively solving the "depth-efficiency" dilemma. Second, CAM-Pro is established, which dynamically synthesizes "normal anchors" through a self-query dot product attention mechanism, realizing a zero-fine-tuning inference paradigm based on metric learning. Extensive experiments on real-world datasets across multiple domains fully demonstrate the performance, computational efficiency, and versatility of AceGAD.

[0196] This invention not only proposes a novel method and model, but also provides important theoretical insights into the research paradigm of Graph Anomaly Detection (GAD): existing mainstream GAD research typically follows the premise of "one model for one dataset," meaning that specific anomaly detectors are trained for specific datasets. Experimental evidence shows that although graph data varies significantly across different domains, the deep geometric rules determining whether nodes are anomalous are universal. That is, regardless of the domain, "normal" often implies local consistency and compactness on the underlying manifold, while "anomaly" implies geometric deviation and divergence. AceGAD captures this universal metric, thus successfully achieving zero-fine-tuning inference for new graphs. This discovery provides solid theoretical support for building universal graph foundation models.

[0197] This invention introduces the concept of metrics from few-shot learning into the field of GAD and extends it with context-awareness. Unlike learning fixed classification boundaries, AceGAD establishes a dynamic frame of reference. By dynamically synthesizing "normal anchors" through a self-query attention mechanism, it is demonstrated that the model can adapt to data distribution drift by possessing a "meta-ability," that is, adjusting the discrimination criteria in real time according to the current environment. This demonstrates how to handle complex distribution drift problems with simple geometric constraints.

[0198] AceGAD's features offer practical value for system management in high-risk areas such as financial risk control, cybersecurity, and food safety risk assessment. In real-world fraud prevention and social governance, abnormal patterns and business scenarios emerge frequently. Traditional GAD models often face severe fine-tuning issues, requiring data re-collection and model retraining, leading to time lags in risk response. AceGAD's zero-fine-tuning capability allows models to be deployed instantly to new scenarios with only a small number of normal samples, without retraining. This not only reduces enterprises' computing power and data labeling costs but also enhances organizational strategic agility in responding to anomalies, achieving a shift from passive defense to immediate response.

[0199] In high-risk decision-making, the lack of interpretability (black-box nature) of algorithms is often a major bottleneck hindering their practical application. This invention's attention visualization experiment ( Figure 6-11 This demonstrates that AceGAD can enhance the transparency of a system by showcasing the rationale behind decisions. By identifying which support set samples play a key role in constructing the "normal anchor," the model provides an interpretable reference point.

[0200] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Any simple modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of the present invention shall still fall within the scope of the technical solution of the present invention.

Claims

1. A zero-fine-tuning general graph anomaly detection method based on adaptive context evolution, characterized in that, Includes the following steps: First, through data preprocessing, the original graph data is standardized into a unified input signal, and a normalized evolution operator is constructed; Secondly, by using a linear graph state-space encoder, the depth information propagation in the graph structure is reconstructed into a continuous state evolution process in a spectral domain, capturing the depth node representation containing the global context with linear complexity. Finally, by using a self-query dot product attention mechanism, normal anchor points adapted to the current environment are dynamically synthesized from a small number of samples, and an adaptive metric space is constructed to accurately quantify the degree of anomaly.

2. The zero-fine-tuning general graph anomaly detection method according to claim 1, characterized in that, In the aforementioned data preprocessing, the original graph data is standardized into a unified input signal. This process is defined as follows: ;in, It is the original input signal matrix; It is a unified target dimension that is set; The process of the normalization evolution operator is as follows: first, in the original adjacency matrix... Introducing a self-loop, we obtain Next, calculate the normalization operator, whose formula is: , yes The degree matrix.

3. The zero-fine-tuning general graph anomaly detection method according to claim 1, characterized in that, The reconstruction process of the linear graph state-space encoder is as follows: (1) Construct an input-driven sequence containing multi-scale structural information ; (2) From the input driving sequence through reverse causal recombination. Extract the reverse driving sequence of the current batch nodes. ; (3) The reverse driving sequence Perform spectral domain state space evolution.

4. The zero-fine-tuning general graph anomaly detection method according to claim 3, characterized in that, In step (1), the construction process is as follows: First, use a linear mapping layer Unify input signal Map to the hidden space and initialize the 0th-order state. Its formula is: ; Subsequently, the system executes The explicit spatial diffusion of the step generates a series of state snapshots, the formula of which is: ;in, Represents the first The physical mapping of neighborhood information in the system; After the state snapshots are generated, all the state snapshots are stacked to construct a multi-scale structured driving tensor. That is, the input driving sequence Its formula is: .

5. The zero-fine-tuning general graph anomaly detection method according to claim 4, characterized in that, In step (2), the extraction process is as follows: the input driving sequence is... The formula for performing reverse sequence recombination in the time dimension is: ； in, These are subsequences extracted from a global feature sequence library. Feature extraction of the sequence, It is a pre-constructed reverse-drive sequence.

6. The zero-fine-tuning general graph anomaly detection method according to claim 5, characterized in that, In step (3), the evolution of the spectral domain state space uses a diagonalized linear cyclic unit as the evolution kernel, and the evolution formula is: ;in, It is a reverse-driven sequence In the Step input; It is a complex hidden state; It is a diagonal state transition matrix, Parameterization The form; This indicates element-wise multiplication.

7. The zero-fine-tuning general graph anomaly detection method according to claim 1, characterized in that, The synthesis process of the normal anchor point is as follows: First, extract the context query vector of the support set. Let it be defined as the centroid of the support set sample representation, and its formula is: ;in, Indicates inclusion Support set of known normal samples, It is a depth node representation generated by the linear graph state-space encoder; Subsequently, each of the aforementioned support samples is calculated. With context query vector The consistency score is calculated using the following formula: , ;in, It is the unnormalized attention logarithm; (0, 1) is a learnable temperature coefficient; Ultimately, normal anchor point It is generated through weighted aggregation, and its formula is: ;in, This is a learnable scaling factor.

8. The zero-fine-tuning general graph anomaly detection method according to claim 1, characterized in that, The construction of an adaptive metric space to accurately quantify the degree of anomaly includes: adaptive metric space construction and zero-fine-tuning anomaly measurement; In the aforementioned adaptive metric space construction, the formula for the total loss is: ; in, It is a hyperparameter used to balance the strength of various geometric constraints; The formula for the loss to bring positive samples closer together is: ; The negative sample deflection loss is calculated using the following formula: ; The intra-class compactness loss is calculated as follows: ; The anchor point regularization loss is calculated using the following formula: ; The zero-fine-tuning anomaly measurement process is as follows: first, the support set is used to generate a graph-specific anomaly measurement in real time. normal anchor point Then directly calculate the query node. The geometric drift distance relative to the anchor point is used as the anomaly score, and its formula is as follows: .

9. A zero-fine-tuning general graph anomaly detection system based on adaptive context evolution, characterized in that, The method for implementing the zero-fine-tuning general graph anomaly detection method according to any one of claims 1-8 includes: a data preprocessing module, a linear graph state-space encoder module, and a context-aware metric projector module; The data preprocessing module includes: a unified input signal projection submodule and a normalization evolution operator construction submodule, used to standardize the original graph data into a unified input signal and construct a normalization evolution operator; The linear graph state space encoder module includes: a sparse input-driven construction submodule, a reverse-order causal recombination submodule, and a spectral domain state space evolution submodule, which are used to propagate and reconstruct the depth information in the graph structure into a continuous state evolution process in a spectral domain, and capture the depth node representation containing the global context with linear complexity. The context-aware metric projector module includes: a dynamic normal anchor point generation submodule, an adaptive metric space construction submodule, and a zero-fine-tuning anomaly metric submodule. Through a self-query dot product attention mechanism, it dynamically synthesizes normal anchor points adapted to the current environment from a small number of samples and constructs an adaptive metric space to accurately quantify the degree of anomaly.

10. The application of the zero-fine-tuning general graph anomaly detection method according to any one of claims 1-8, or the zero-fine-tuning general graph anomaly detection system according to claim 9, in food safety risk assessment.

Images