Interpretable Graph-Level Anomaly Detection via Contrast with Normal Prototypes

The task of graph-level anomaly detection (GLAD) is to identify anomalous graphs that deviate significantly from the majority of graphs in a dataset. While deep GLAD methods have shown promising performance, their black-box nature limits their reliability and deployment in real-world applications. Although some recent methods have made attempts to provide explanations for anomaly detection results, they either provide explanations without referencing normal graphs, or rely on abstract latent vectors as prototypes rather than concrete graphs from the dataset. To address these limitations, we propose Prototype-based Graph-Level Anomaly Detection (ProtoGLAD), an interpretable unsupervised framework that provides explanation for each detected anomaly by explicitly contrasting with its nearest normal prototype graph. It employs a point-set kernel to iteratively discover multiple normal prototype graphs and their associated clusters from the dataset, then identifying graphs distant from all discovered normal clusters as anomalies. Extensive experiments on multiple real-world datasets demonstrate that ProtoGLAD achieves competitive anomaly detection performance compared to state-of-the-art GLAD methods while providing better human-interpretable prototype-based explanations.

💡 Research Summary

The paper introduces ProtoGLAD, an interpretable unsupervised framework for graph‑level anomaly detection (GLAD) that grounds anomaly scores in concrete normal prototypes drawn directly from the dataset. Traditional deep GLAD methods achieve strong detection performance but operate as black boxes, producing self‑referential scores based on reconstruction error, knowledge distillation discrepancy, or self‑contrastive consistency. Consequently, they offer little insight into why a particular graph is deemed anomalous, and recent explainable GLAD work either lacks a normal reference or relies on abstract latent prototypes that are hard to interpret. ProtoGLAD addresses these gaps by explicitly discovering multiple normal prototype graphs and forming clusters around them; an anomaly is defined as a graph that is dissimilar to all discovered normal clusters.

Technical Foundations
The method builds on two kernel techniques. First, the Weisfeiler‑Lehman (WL) scheme is used to generate node embeddings that capture hierarchical sub‑tree structures. Instead of feeding raw node attributes into WL, the authors first map each node feature vector into a binary, finite‑dimensional representation using the Isolation Kernel (IK). IK is a data‑dependent kernel that creates random partitionings of the data space; the resulting feature map φ(x) indicates in which partition a point falls. This mapping makes the similarity measure sensitive to local data density and yields a tractable, finite‑dimensional embedding.

Graph Embedding
For a graph G = (V, E), each node v obtains an IK‑mapped vector φ(x_v). The WL iteration updates node embeddings as the average of the node’s current embedding and its neighbors’ embeddings. After h iterations, the graph embedding Φ(G) is defined as the mean of all node embeddings φ_h(x_v). The similarity between two graphs is simply the dot product ⟨Φ(G), Φ(G′)⟩.

Prototype Discovery via Point‑Set Kernel
ProtoGLAD introduces a point‑set kernel ˆK(x, C) = ⟨Φ(x), ˆΦ(C)⟩, where ˆΦ(C) is the mean embedding of a set of graphs C (the kernel mean map). The algorithm iteratively selects a high‑density graph g_p from the pool of unassigned graphs Π as a prototype. It then finds the most similar neighbor g_q, computes an initial similarity γ = (1‑ρ)·ˆK(g_q, {g_p}), and grows a cluster by absorbing all graphs whose similarity to the current cluster exceeds γ. After each growth step γ is reduced by factor (1‑ρ) until it falls below a user‑defined threshold τ, at which point the cluster is finalized and removed from Π. The process repeats until no graph remains with similarity above τ. The result is a set of k normal clusters {C₁,…,C_k} and their prototypes {G₁^p,…,G_k^p}.

Anomaly Scoring
For any graph G_i, the anomaly score s_i is defined as the maximum point‑set similarity to any normal cluster: s_i = max_j ˆK(G_i, C_j). Graphs with low scores are far from all normal clusters and are flagged as anomalies.

Explanation Mechanism
When an anomaly G_A is detected, the most similar prototype G*_p is identified. Each node u in G_A receives a normality score c(u) = ⟨φ_h(u), Φ(G*_p)⟩. Low c(u) indicates that the node contributes little to the similarity with the normal prototype, highlighting it as a source of anomalous behavior. Symmetrically, nodes in the prototype can be scored against G_A to reveal which parts of the normal reference are missing or altered. This node‑level scoring provides a concrete, visualizable explanation that domain experts can readily interpret.

Experimental Evaluation
The authors evaluate ProtoGLAD on eight real‑world datasets from the TUDataset benchmark, covering bio‑informatics (e.g., MUTAG, ENZYMES) and social network domains. Six unsupervised baselines are compared: WL‑iForest, OCSVM‑WL, DeepSVDD, GLocalKD, GraphAE, and a recent contrastive method. Metrics include AUC and average precision. ProtoGLAD achieves competitive or superior performance across most datasets, particularly excelling where normal graphs form well‑defined clusters. Importantly, it also supplies prototype‑based explanations, which the baselines lack.

Strengths and Limitations
Strengths:

• Direct use of actual normal graphs as prototypes enhances interpretability.
• The point‑set kernel combined with IK‑WL embeddings yields density‑aware similarity, improving detection of subtle anomalies.
• Node‑level explanation is intuitive and can be visualized.

Limitations:

• The number of clusters k must be set a priori; automatic model selection is not addressed.
• Computing IK mappings for large, high‑dimensional node feature spaces can be computationally intensive.
• The current formulation handles static graphs; extending to dynamic or temporal graphs remains future work.

Conclusion
ProtoGLAD offers a principled, interpretable approach to graph‑level anomaly detection by grounding decisions in concrete normal prototypes and providing node‑level explanations. The combination of WL graph embeddings, Isolation Kernel, and a point‑set kernel enables effective discovery of normal clusters and robust anomaly scoring. The framework bridges the gap between high detection performance and human‑understandable reasoning, making it a promising candidate for safety‑critical and regulated domains where explainability is essential. Future directions include automatic determination of cluster numbers, kernel efficiency improvements, and adaptation to evolving graph streams.