Normality Calibration in Semi-supervised Graph Anomaly Detection

Graph anomaly detection (GAD) has attracted growing interest for its crucial ability to uncover irregular patterns in broad applications. Semi-supervised GAD, which assumes a subset of annotated normal nodes available during training, is among the most widely explored application settings. However, the normality learned by existing semi-supervised GAD methods is limited to the labeled normal nodes, often inclining to overfitting the given patterns. These can lead to high detection errors, such as high false positives. To overcome this limitation, we propose GraphNC , a graph normality calibration framework that leverages both labeled and unlabeled data to calibrate the normality from a teacher model (a pre-trained semi-supervised GAD model) jointly in anomaly score and node representation spaces. GraphNC includes two main components, anomaly score distribution alignment (ScoreDA) and perturbation-based normality regularization (NormReg). ScoreDA optimizes the anomaly scores of our model by aligning them with the score distribution yielded by the teacher model. Due to accurate scores in most of the normal nodes and part of the anomaly nodes in the teacher model, the score alignment effectively pulls the anomaly scores of the normal and abnormal classes toward the two ends, resulting in more separable anomaly scores. Nevertheless, there are inaccurate scores from the teacher model. To mitigate the misleading by these scores, NormReg is designed to regularize the graph normality in the representation space, making the representations of normal nodes more compact by minimizing a perturbation-guided consistency loss solely on the labeled nodes.

💡 Research Summary

The paper addresses a critical limitation of existing semi‑supervised graph anomaly detection (GAD) methods: they rely exclusively on a small set of labeled normal nodes, which often leads to over‑fitting of the observed normal patterns and consequently high false‑positive (FP) rates when unlabeled normal nodes deviate from the labeled examples. To overcome this, the authors propose GraphNC, a teacher‑student framework that calibrates normality using both labeled and unlabeled data. A pre‑trained semi‑supervised GAD model serves as the “teacher”, while a lightweight student model (a 2‑layer GNN followed by an MLP) is trained to align with the teacher in two complementary spaces: the anomaly‑score space and the node‑representation space.

The first component, Score Distribution Alignment (ScoreDA), minimizes the mean‑squared error between the student’s predicted anomaly scores and the teacher’s scores for all nodes. Because the teacher’s score distribution is generally accurate for most normal nodes and a subset of anomalies, aligning to it pushes the student’s scores for normal and anomalous classes toward opposite extremes, thereby increasing separability and reducing both FP and false‑negative (FN) rates. However, the teacher inevitably produces some inaccurate scores due to limited supervision.

To mitigate the influence of noisy teacher scores, the second component, Perturbation‑guided Normality Regularization (NormReg), operates solely on the labeled normal nodes. It randomly masks a proportion ω of node attributes to generate multiple augmented versions of each labeled normal node, forming an augmented graph ˜G. The student’s embeddings for the original and masked nodes (H_S and ˜H_S) are then forced to be consistent via a L2‑based consistency loss. This regularization compacts the representation of normal nodes, making them more robust to variations and reducing the reliance on potentially erroneous teacher scores.

The overall training objective combines the two losses: L = λ₁·L_ScoreDA + λ₂·L_NormReg. During inference, only the student’s anomaly scores are used. The framework is model‑agnostic: any pre‑trained semi‑supervised GAD method (reconstruction‑based, one‑class, or anomaly‑generation based) can be plugged in as the teacher.

Extensive experiments on six benchmark datasets (including Amazon, Tolokers, Cora, Pubmed, etc.) demonstrate that GraphNC consistently improves the AUC of three distinct teacher models by 5–12% on average, achieving new state‑of‑the‑art performance. Ablation studies show that ScoreDA alone already yields notable gains, while adding NormReg further reduces the average deviation of normal node embeddings (as visualized by t‑SNE) and especially benefits scenarios with extremely few labeled normals (e.g., 1% of nodes). Moreover, the authors observe a “teacher‑strength” effect: stronger teachers lead to larger performance boosts, confirming that GraphNC effectively amplifies the teacher’s knowledge.

In summary, GraphNC introduces a novel dual‑space normality calibration strategy that jointly refines anomaly scores and node representations. By leveraging both labeled and unlabeled data, it mitigates over‑fitting, lowers false positives, and delivers robust anomaly detection even when labeled normal data are scarce. The proposed method is flexible, scalable, and poised for broad application in graph‑based security, fraud detection, and other domains where anomalies are rare but costly.