Attributed Subsphere in Anomaly Detection

• Attributed Subsphere is a semi-supervised anomaly detection framework that encloses normal GCN node embeddings within a minimum-volume hypersphere.
• It leverages GCN-based message passing and an AUC-style regularizer to propagate sparse labels and separate anomalies from normals.
• Empirical evaluations on benchmarks like Cora and Citeseer show significant AUC improvements over traditional anomaly detection methods.

An attributed subsphere is a semi-supervised anomaly detection framework defined on attributed graphs by enclosing normal-class node embeddings within a minimum-volume hypersphere in the latent space of a graph convolutional network (GCN), while separating embeddings of known anomalies outside this hypersphere. The approach, formalized by Kumagai et al. (2019) (Kumagai et al., 2020), combines the representational power of GCNs for attributed graphs with volume-based and AUC-driven objectives, enabling the propagation of sparse label information across connected instances in non-i.i.d. settings.

1. Graph-Convolutional Representation of Attributed Graphs

Let $G=(V,A,X)$ denote an undirected attributed graph, where $A\in\mathbb{R}^{n\times n}$ is the adjacency matrix (possibly with self-loops), and $X\in\mathbb{R}^{n\times d}$ the node-attribute matrix. Node representations are learned via L graph convolutional layers as proposed in Kipf & Welling (2017). The propagation rule at layer $\ell+1$ is:

$$H^{(\ell+1)} = \sigma \left( \tilde{D}^{-1/2} \tilde{A} \tilde{D}^{-1/2} H^{(\ell)} W^{(\ell)} \right)$$

where $\tilde{A} = A + I$, $\tilde{D} = \mathrm{diag}(\tilde{A}\mathbf{1})$, $H^{(0)}=X$, $W^{(\ell)}$ are trainable weights, and $\sigma$ is a pointwise nonlinearity. The $A\in\mathbb{R}^{n\times n}$0-dimensional embedding for node $A\in\mathbb{R}^{n\times n}$1 is $A\in\mathbb{R}^{n\times n}$2.

2. Minimum-Volume Hypersphere Objective

A center $A\in\mathbb{R}^{n\times n}$3 is selected (initialized as the mean of embeddings of labeled normals). The objective consists of two terms:

• Volume Minimization on Normals: The embeddings $A\in\mathbb{R}^{n\times n}$4 of normal nodes ($A\in\mathbb{R}^{n\times n}$5) are encouraged to cluster tightly around $A\in\mathbb{R}^{n\times n}$6 by minimizing

$A\in\mathbb{R}^{n\times n}$7

• AUC-style Regularizer: To address class imbalance and promote separation of anomalies ($A\in\mathbb{R}^{n\times n}$8) from normals, a differentiable AUC loss is used:

$A\in\mathbb{R}^{n\times n}$9

where $X\in\mathbb{R}^{n\times d}$0 and $X\in\mathbb{R}^{n\times d}$1.

The combined objective is:

$X\in\mathbb{R}^{n\times d}$2

Unlike classical SVDD, the hypersphere radius $X\in\mathbb{R}^{n\times d}$3 is not a free parameter; volume minimization absorbs this variable.

3. Optimization, Label Propagation, and Training Regimen

The center $X\in\mathbb{R}^{n\times d}$4 is fixed after initial computation ($X\in\mathbb{R}^{n\times d}$5). The objective $X\in\mathbb{R}^{n\times d}$6 is minimized with respect to GCN parameters $X\in\mathbb{R}^{n\times d}$7 using first-order optimizers such as Adam. Weight decay or additional norm constraints are not required, although $X\in\mathbb{R}^{n\times d}$8-regularization on $X\in\mathbb{R}^{n\times d}$9 may optionally be applied. Training alternates forward passes and parameter updates; $\ell+1$0 may be updated mid-training but is typically held fixed.

GCN-based message passing ensures that supervision from labeled nodes propagates throughout each node’s $\ell+1$1-hop neighborhood. Thus, limited labeled anomalies and normals can influence much of the graph structure via convolutional mixing.

4. Computational Properties and Hyperparameter Selection

The per-epoch computational complexity is $\ell+1$2 for each GCN pass, plus $\ell+1$3 for the AUC loss, with $\ell+1$4 in practice. Storage is $\ell+1$5, accounting for the adjacency, attribute, and embedding matrices and the GCN parameterization.

Typical hyperparameter settings are:

• Two GCN layers ($\ell+1$6)
• Embedding dimension $\ell+1$7
• Learning rate $\ell+1$8 (Adam optimizer)
• AUC weight $\ell+1$9 chosen over $$H^{(\ell+1)} = \sigma \left( \tilde{D}^{-1/2} \tilde{A} \tilde{D}^{-1/2} H^{(\ell)} W^{(\ell)} \right)$$0 by validation
• Batch size: full graph (transductive training)
• Training up to 500–1000 epochs with early stopping

5. Empirical Evaluation and Benchmarking

Evaluation is performed on five attributed-graph benchmarks: Cora, Citeseer, Pubmed, Amazon-Photo, and Amazon-Computers. The task is to designate the smallest class as anomalous, randomly label 2.5–10% of nodes (both anomaly and normal), and compute the test AUC on unlabeled nodes after training.

Results indicate that the method using both anomaly and normal labels (Ours-AN) achieves average AUC $$H^{(\ell+1)} = \sigma \left( \tilde{D}^{-1/2} \tilde{A} \tilde{D}^{-1/2} H^{(\ell)} W^{(\ell)} \right)$$1 (with 2.5% labeled nodes), outperforming SLGCN (semi-supervised GCN classifier) by $$H^{(\ell+1)} = \sigma \left( \tilde{D}^{-1/2} \tilde{A} \tilde{D}^{-1/2} H^{(\ell)} W^{(\ell)} \right)$$2 points, ImVerde (imbalance-aware random-walk) by $$H^{(\ell+1)} = \sigma \left( \tilde{D}^{-1/2} \tilde{A} \tilde{D}^{-1/2} H^{(\ell)} W^{(\ell)} \right)$$3 points, and DOC-AN, DSAD (i.i.d. anomaly detectors) by $$H^{(\ell+1)} = \sigma \left( \tilde{D}^{-1/2} \tilde{A} \tilde{D}^{-1/2} H^{(\ell)} W^{(\ell)} \right)$$4–$$H^{(\ell+1)} = \sigma \left( \tilde{D}^{-1/2} \tilde{A} \tilde{D}^{-1/2} H^{(\ell)} W^{(\ell)} \right)$$5 points. Using only normal labels ($$H^{(\ell+1)} = \sigma \left( \tilde{D}^{-1/2} \tilde{A} \tilde{D}^{-1/2} H^{(\ell)} W^{(\ell)} \right)$$6, Ours-N), the approach surpasses unsupervised baselines (OSVM, DOC-N, DOM) by $$H^{(\ell+1)} = \sigma \left( \tilde{D}^{-1/2} \tilde{A} \tilde{D}^{-1/2} H^{(\ell)} W^{(\ell)} \right)$$7–$$H^{(\ell+1)} = \sigma \left( \tilde{D}^{-1/2} \tilde{A} \tilde{D}^{-1/2} H^{(\ell)} W^{(\ell)} \right)$$8 points. Performance gains are consistent across all benchmarks and label budgets.

Method	Label Usage	AUC Improvement
Ours-AN	Normal + Anomaly	+3–10 pts over others
Ours-N	Normal only	+5–10 pts (unsup baselines)

6. Relationship to Classical and Modern Anomaly Detection

The attributed subsphere approach generalizes volume-minimizing anomaly objectives known from support vector data description (SVDD) to graph-based and semi-supervised domains, integrating node attributes and connectivity via GCNs. Unlike traditional i.i.d. anomaly detection, it leverages local label propagation inherent to GCNs and addresses class imbalance explicitly with an AUC-style pairwise regularizer. The fixed-center, radius-free hypersphere ensures computational tractability and effective end-to-end optimization. A plausible implication is improved performance under label scarcity and strong structural dependencies in real-world attributed graphs.

7. Significance and Practical Considerations

The model does not require explicit specification of the hypersphere radius nor extensive parameter tuning beyond conventional GCN settings. The use of message-passing label propagation with a minimum-volume criterion and AUC-based anomaly score ranking facilitates effective semi-supervised learning on non-i.i.d. attributed graphs and demonstrates robust empirical superiority over alternative graph-centric and i.i.d. anomaly detection baselines (Kumagai et al., 2020).