DDGAD: Trajectory Dynamics for Diffusion-Based Graph Anomaly Detection

Abstract: Graph anomaly detection (GAD) aims to identify nodes or substructures whose behavior or attributes deviate significantly from the overall pattern in graph-structured data, with critical applications in financial risk control, social network analysis, and cybersecurity. However, existing GCN-based methods suffer from the fundamental problem of contamination propagation, where anomalous nodes pollute the representations of their neighbors through message passing, leading to degraded detection performance. In this paper, we propose DDGAD, a novel diffusion-based graph anomaly detection framework that leverages trajectory dynamics to distinguish normal and anomalous nodes. Our key insight is that normal nodes exhibit consistent and stable representation trajectories under the coupled effects of diffusion regularization and reliability-aware neighborhood consensus, while anomalous nodes exhibit unstable and conflicting dynamics due to the directional disagreement between the global manifold prior and locally contaminated message passing. To mitigate contamination propagation, we introduce a distributed reliability-aware consensus refinement mechanism and define three complementary anomaly signals: neighbor inconsistency, reliability weight, and dynamical conflict energy. We further provide a preliminary theoretical analysis on normal node stability under the coupled dynamics. These signals collectively characterize anomalous behaviors from the perspectives of local inconsistency, consensus reliability, and dynamical instability. Extensive experiments on five real-world datasets demonstrate the effectiveness of the proposed framework.

• The paper introduces a novel trajectory dynamics framework that leverages diffusion-based adaptation and consensus for robust graph anomaly detection.
• It employs an Adapt-Then-Combine model separating self-innovation from peer consensus, isolating anomalies via trajectory instability and signal accumulation.
• Empirical tests on diverse real-world datasets demonstrate that DDGAD outperforms baseline methods by effectively countering contamination propagation.

Diffusion-Based Trajectory Dynamics for Robust Graph Anomaly Detection

Motivation and Problem Formulation

The proliferation of graph-structured data in security, finance, and information systems has fostered interest in graph anomaly detection (GAD), which aims to identify nodes or substructures exhibiting significant behavioral or attribute deviations. Conventional GCN-based methods are inherently prone to contamination propagation: anomalies pollute their neighbors through iterative message passing, diluting the distinguishability of both normal and anomalous nodes, especially in dense or anomalously clustered graphs.

DDGAD introduces a novel dynamical perspective, positing that the temporal evolution of node representations under diffusion and reliability-aware consensus—rather than their static properties—encapsulates the essence of anomaly formation and propagation. The method reframes GAD as an ATC dynamical process, exploiting trajectory instability as the principal identifier of anomalies.

Architectural and Algorithmic Contributions

DDGAD integrates four core modules: a GCN encoder initiates node embeddings, which are subjected to iterative refinement through Adapt-Then-Combine (ATC) dynamics. Anomaly signals are accumulated throughout the process, culminating in unified anomaly scoring.

Figure 1: The DDGAD pipeline combines GCN-based initialization, ATC dynamics with distributed temporal trust, anomaly signal accumulation, and unified scoring. Dashed lines illustrate the adaptive consensus aggregation.

Adapt-Then-Combine (ATC) Dynamics

Node representations are locally adapted via a denoising diffusion operator, aligning them with a manifold learned from normal data. Subsequently, consensus is reached by aggregating neighbor states, weighted by dynamically estimated trust. The explicit split between self-innovation ($\alpha$) and trust-weighted consensus ($1-\alpha$) enables mathematical isolation of local and neighborhood effects:

$$z_i^{(k+1)} = \alpha D(z_i^{(k)}) + (1-\alpha) c_i^{(k)}$$

where $D(\cdot)$ is the diffusion operator and $c_i^{(k)}$ is the consensus from neighbors.

Reliability-Aware Consensus and Temporal Trust

Trust between nodes is quantified as a temporally evolving memory of spatial alignment. Instantaneous alignment $\tau_{ij}^{(k)}$ is calculated via Gaussian kernel on adapted states, and accumulated trust $T_{ij}^{(k)}$ decays or reinforces based on iterative consistency:

$$T_{ij}^{(k)} = \gamma T_{ij}^{(k-1)} + (1-\gamma) \tau_{ij}^{(k)}$$

Anomalous nodes, persistently misaligned with neighbors, rapidly experience trust attenuation and subsequent isolation in aggregation steps.

Dynamical Signal Accumulation

The scoring system consists of trajectory energy, dynamical conflict energy, neighbor inconsistency, and reliability weighting—each capturing distinct aspects of anomalous dynamics:

• Trajectory Energy ($E_i$): Accumulates adaptation-consensus discrepancies across iterations.
• Dynamical Conflict Energy ($\mathcal{T}_i$): Quantifies directional disagreement between diffusion innovations and consensus projections.
• Neighbor Inconsistency ($1-\alpha$0): Measures deviation from local neighbor consensus.
• Reliability Weight ($1-\alpha$1): Reflects sustained trust from neighbors; decays sharply for anomalies.

The final anomaly score fuses these signals:

$1-\alpha$2

Latent Trajectory Dynamics and Anomaly Separation

DDGAD’s dynamical trajectory interpretation reveals that normal nodes converge rapidly onto the latent manifold, guided by consistent adaptation and consensus forces, yielding bounded and stable trajectories. In contrast, anomalous nodes oscillate or diverge due to persistent conflict between diffusion-driven regularization and contaminated neighborhood consensus—their trajectories remain unstable and are segregated in latent space.

Figure 2: Trajectory dynamics: normal nodes converge stably under diffusion/consensus forces, while anomalous nodes show unstable, conflicting dynamics and latent separation.

Theoretical Foundations

A theoretical guarantee on normal node stability is presented, leveraging the contractivity of the diffusion operator and bounded consensus perturbations under the ATC dynamics. Nodes consistently aligned with global and neighborhood priors maintain error boundedness throughout iterations, while anomalies, experiencing large directional conflicts, manifest elevated trajectory and conflict energies and diverge from consensus.

Experimental Evaluation

DDGAD is empirically validated on diverse real-world datasets, including Enron, Disney, Books, Reddit, and Weibo, each encompassing distinct anomaly types. While full results are deferred, the architecture demonstrates performance improvements versus representative baselines (DOMINANT, AnomalyDAE, CoLA, GraphMAE, DiffGAD) in preliminary evaluation, especially in scenarios where contamination propagation is pronounced.

Practical and Theoretical Implications

DDGAD introduces a dynamical-systems perspective to GAD, moving away from static message-passing models toward trajectory-centric detection. The distributed trust mechanism inherently suppresses contamination, even in high-connectivity or clustered anomaly graphs, via adaptive consensus exclusion. Practically, this enhances robustness in operational environments such as fraud detection, spam filtration, and cyber-defense.

Theoretically, the dynamical decomposition establishes a foundation for further study of coupled diffusion-consensus algorithms on graphs, potentially extending to anomalous substructure detection and distributed adversarial resistance. The interplay of trajectory statistics and adaptive aggregation may inspire new graph learning paradigms where stability and alignment are core objectives.

Future Directions

Anticipated research avenues include systematic sensitivity analyses for $1-\alpha$3 and kernel parameters, scalability enhancements for ultra-large graphs, and characterization of diffusion operator properties under varying representational regimes. Extensions to dynamic graphs, attributed edges, and hierarchical anomaly detection warrant exploration.

Conclusion

DDGAD advances graph anomaly detection by coupling diffusion-based local adaptation with reliability-aware distributed consensus, capturing latent trajectory instabilities as principal anomaly signatures. The convergence properties of normal nodes, contrasted with anomalous trajectory divergence quantified by conflict and trajectory energies, underpin an adaptive, contamination-resilient anomaly scoring mechanism. The dynamical methodology provides a scalable, theoretically sound foundation for robust GAD in complex, heterogeneous networked systems (2605.26446).