CRoC: GNN Framework for Anomaly Detection

• CRoC is a plug-and-play GNN framework for graph anomaly detection that recomposes node features while preserving key relational interactions.
• It employs relation-aware joint aggregation to embed diverse interaction types, enabling robust detection even under adversarial camouflage.
• The framework integrates supervised and contrastive learning to effectively leverage scarce labels and abundant unlabeled data, achieving up to 14% AUC improvement.

Searching arXiv for the primary CRoC paper and adjacent usage of the term. Context Refactoring Contrast (CRoC) is a plug-and-play framework for Graph Neural Networks (GNNs) in Graph Anomaly Detection (GAD) under limited supervision. It combines three mechanisms: context refactoring via feature recomposition while preserving interaction patterns, Relation-aware Joint Aggregation (RJA) for heterogeneous relation encoding during message passing, and a contrastive objective that exploits abundant unlabeled nodes. In the formulation introduced for GAD, CRoC is designed to be robust to camouflage—both feature and behavior—and to bridge the gap between scarce labels and massive unlabeled data. On seven real-world GAD datasets, it achieves up to 14% AUC improvement over baseline GNNs and outperforms state-of-the-art GAD methods under limited-label settings (Xie et al., 17 Aug 2025).

1. Problem formulation and operating regime

CRoC formulates GAD as semi-supervised node classification on a multi-relation, possibly heterogeneous, graph

$$\mathcal{G} = (\mathcal{V}, \mathbf{X}, \{\mathcal{E}_r\}_{r=1}^{R}),$$

with $N = |\mathcal{V}|$ nodes, relation-specific edge sets $\mathcal{E}_r$, and node attributes

$$\mathbf{X} = [\mathbf{x}_1,\ldots,\mathbf{x}_N]^\top \in \mathbb{R}^{N\times d_0}.$$

The node set is partitioned into labeled and unlabeled subsets, $\mathcal{V} = \mathcal{V}^L \cup \mathcal{V}^U$, with $|\mathcal{V}^L| \ll N$. Labels indicate normal or anomalous status, and anomalies are rare, producing severe class imbalance. A GNN encoder $g(\mathcal{G}; \theta_G)$ generates node embeddings

$$\mathbf{H} = [\mathbf{h}_1,\ldots,\mathbf{h}_N]^\top \in \mathbb{R}^{N\times d},$$

while a classifier $f(\mathbf{H}; \theta_C)$ outputs per-node normalized class confidences $\hat{\mathbf{Y}}$ (Xie et al., 17 Aug 2025).

Within this setup, the training objective is to learn $N = |\mathcal{V}|$0 from $N = |\mathcal{V}|$1 so as to predict anomaly or non-anomaly for unlabeled nodes while exploiting both labeled and unlabeled data. The setting is motivated by a characteristic constraint of GAD: anomalies are inherently rare, costly to label, and may actively camouflage their patterns to evade detection. CRoC is therefore not framed as a purely supervised anomaly detector; it is explicitly designed for limited-label regimes in which unlabeled nodes must contribute to representation learning rather than remaining passive background data.

A central premise is that, in many GAD scenarios, anomalous behavior is encoded not only in node attributes but also in interaction patterns. This premise shapes the entire framework: attributes may be recomposed, but edges and relations are preserved; contrastive learning is applied across graph views rather than detached from the anomaly task; and multi-relation structure is encoded directly inside message passing rather than treated as an afterthought.

2. Context refactoring as controlled feature camouflage

The core contribution of CRoC is context refactoring: recomposing node attributes while preserving the graph’s interaction patterns. The operation first applies a parameter-free row permutation to the feature matrix,

$N = |\mathcal{V}|$2

where $N = |\mathcal{V}|$3 randomly permutes the rows of $N = |\mathcal{V}|$4. The augmented graph keeps the original node set and relations unchanged and mixes the original and permuted features:

$N = |\mathcal{V}|$5

At node level,

$N = |\mathcal{V}|$6

where $N = |\mathcal{V}|$7 is the permutation induced by $N = |\mathcal{V}|$8. The same operator fits the generic recomposition form

$N = |\mathcal{V}|$9

subject to $\mathcal{E}_r$0 and $\mathcal{E}_r$1, by taking $\mathcal{E}_r$2, $\mathcal{E}_r$3, and $\mathcal{E}_r$4 (Xie et al., 17 Aug 2025).

The mechanism relies on class imbalance for semantic stability. Because normal nodes are the vast majority in GAD, random shuffling assigns a normal node another normal node’s features with high probability, minimally altering its contextual semantics. Undesired assignments are treated as tolerable because GNNs aggregate neighborhood context, and shuffling occurs anew each epoch, avoiding persistent mismatches. For anomalous nodes, assignment of normal-like features occurs with high probability and explicitly simulates feature camouflage. The preserved edges and relations retain interaction semantics that are often tightly correlated with anomalous behavior.

This refactoring is notable for what it does not do. It does not prune edges, decouple the graph into separate relation-specific channels, or introduce extra learned augmentation parameters beyond the mixing coefficient $\mathcal{E}_r$5. The operator

$\mathcal{E}_r$6

therefore creates label-guided variation without requiring an additional regularizer. It also actively correlates labeled and unlabeled data during supervised training, because features of unlabeled nodes can be shuffled into the context of labeled nodes.

Component	Mechanism	Role
Context refactoring	$\mathcal{E}_r$7, $\mathcal{E}_r$8	Simulates feature camouflage while preserving edges
RJA	Concatenate relation embedding with neighbor representation before aggregation	Encodes multi-relation interaction semantics
Contrastive learning	Node-wise contrast between original and refactored views on $\mathcal{E}_r$9	Exploits unlabeled nodes during joint training

The significance of this design lies in its asymmetry: the feature space is deliberately destabilized, while the interaction structure is held fixed. In the intended GAD regime, that asymmetry compels the encoder to rely more strongly on relational context and to learn robustness against adversarial camouflage rather than memorizing superficial feature signatures.

3. Relation-aware Joint Aggregation and heterogeneous message passing

CRoC introduces Relation-aware Joint Aggregation, a message-passing scheme that encodes relation type as an explicit embedding and injects it into each neighbor message before aggregation. For layer $$\mathbf{X} = [\mathbf{x}_1,\ldots,\mathbf{x}_N]^\top \in \mathbb{R}^{N\times d_0}.$$0, if $$\mathbf{X} = [\mathbf{x}_1,\ldots,\mathbf{x}_N]^\top \in \mathbb{R}^{N\times d_0}.$$1 is the representation of neighbor $$\mathbf{X} = [\mathbf{x}_1,\ldots,\mathbf{x}_N]^\top \in \mathbb{R}^{N\times d_0}.$$2 and $$\mathbf{X} = [\mathbf{x}_1,\ldots,\mathbf{x}_N]^\top \in \mathbb{R}^{N\times d_0}.$$3 is the learnable embedding of the edge type $$\mathbf{X} = [\mathbf{x}_1,\ldots,\mathbf{x}_N]^\top \in \mathbb{R}^{N\times d_0}.$$4, the layer computes

$$\mathbf{X} = [\mathbf{x}_1,\ldots,\mathbf{x}_N]^\top \in \mathbb{R}^{N\times d_0}.$$5

followed by

$$\mathbf{X} = [\mathbf{x}_1,\ldots,\mathbf{x}_N]^\top \in \mathbb{R}^{N\times d_0}.$$6

where $$\mathbf{X} = [\mathbf{x}_1,\ldots,\mathbf{x}_N]^\top \in \mathbb{R}^{N\times d_0}.$$7 denotes concatenation, $$\mathbf{X} = [\mathbf{x}_1,\ldots,\mathbf{x}_N]^\top \in \mathbb{R}^{N\times d_0}.$$8 is the neighbor set of $$\mathbf{X} = [\mathbf{x}_1,\ldots,\mathbf{x}_N]^\top \in \mathbb{R}^{N\times d_0}.$$9 across all relations, $\mathcal{V} = \mathcal{V}^L \cup \mathcal{V}^U$0 is the aggregation operator, and $\mathcal{V} = \mathcal{V}^L \cup \mathcal{V}^U$1 is the backbone update function (Xie et al., 17 Aug 2025).

The key property of RJA is joint rather than decoupled relation modeling. By concatenating relation embeddings to neighbor representations prior to aggregation, the encoder explicitly distinguishes diverse interaction patterns and can learn cross-relational correlations without splitting the graph into separate components. This is particularly relevant when behavior camouflage is distributed across multiple interaction types rather than a single suspicious edge pattern.

RJA is instantiated on standard GNN backbones. For GIN, $\mathcal{V} = \mathcal{V}^L \cup \mathcal{V}^U$2 and $\mathcal{V} = \mathcal{V}^L \cup \mathcal{V}^U$3 is an MLP-based update. For GraphSAGE, $\mathcal{V} = \mathcal{V}^L \cup \mathcal{V}^U$4 can be mean or sum, and $\mathcal{V} = \mathcal{V}^L \cup \mathcal{V}^U$5 is the linear-plus-nonlinearity update. CRoC does not fix attention weights $\mathcal{V} = \mathcal{V}^L \cup \mathcal{V}^U$6; instead, relation effects are encoded through learnable embeddings $\mathcal{V} = \mathcal{V}^L \cup \mathcal{V}^U$7 that condition neighbor messages before aggregation. This preserves compatibility with common GNN kernels while adding relation sensitivity.

In conceptual terms, RJA addresses behavior camouflage in the same way that context refactoring addresses feature camouflage. If anomalous nodes interleave malicious and benign interactions, relation-aware messages allow the encoder to represent the semantics of those interactions explicitly rather than averaging them into an undifferentiated neighborhood summary.

4. Joint learning objective, training pipeline, and inference

CRoC integrates context refactoring with contrastive learning by contrasting node embeddings from the original graph view and the refactored graph view. With a shared encoder,

$\mathcal{V} = \mathcal{V}^L \cup \mathcal{V}^U$8

positive pairs are formed for each unlabeled node $\mathcal{V} = \mathcal{V}^L \cup \mathcal{V}^U$9 as $|\mathcal{V}^L| \ll N$0, while negatives are sampled intra-view by randomly selecting $|\mathcal{V}^L| \ll N$1 other unlabeled embeddings from the original graph view. The InfoNCE-style contrastive objective is

$|\mathcal{V}^L| \ll N$2

In practice, $|\mathcal{V}^L| \ll N$3 (Xie et al., 17 Aug 2025).

Supervision is applied on labeled nodes for both graph views. If

$|\mathcal{V}^L| \ll N$4

then the two cross-entropy terms are

$|\mathcal{V}^L| \ll N$5

and

$|\mathcal{V}^L| \ll N$6

The full objective is

$|\mathcal{V}^L| \ll N$7

with $|\mathcal{V}^L| \ll N$8. No extra regularizer is required; the contrastive term is implicitly regularized by the cross-entropy losses through the shared parameters (Xie et al., 17 Aug 2025).

Training proceeds transductively on the full graph. At each epoch, a new context-refactored graph is built by shuffling and mixing features, with relations unchanged. The model then performs synchronized forward passes on $|\mathcal{V}^L| \ll N$9 and $g(\mathcal{G}; \theta_G)$0, computes supervised losses on labeled nodes, samples $g(\mathcal{G}; \theta_G)$1 intra-view negatives per unlabeled node, computes the contrastive loss, and backpropagates $g(\mathcal{G}; \theta_G)$2 to update $g(\mathcal{G}; \theta_G)$3 and $g(\mathcal{G}; \theta_G)$4. This procedure actively injects unlabeled nodes into supervised training through feature shuffling and into self-supervised training through positive and negative contrastive pairs.

Inference is performed only on the original graph. The anomaly score for node $g(\mathcal{G}; \theta_G)$5 is

$g(\mathcal{G}; \theta_G)$6

the predicted probability of anomaly from the two-class classifier on $g(\mathcal{G}; \theta_G)$7. Threshold-based decisions may be obtained through validation, while AUC-ROC and AP avoid threshold tuning during evaluation.

5. Empirical results, baselines, and comparative positioning

CRoC is evaluated on seven real-world GAD datasets spanning review fraud, financial fraud, social anomaly, and temporal interaction anomalies: Amazon, Yelp, T-Fin, DGraph, T-Soc, Weibo, and Reddit. The reported scales include T-Soc with approximately $g(\mathcal{G}; \theta_G)$8 million nodes, approximately $g(\mathcal{G}; \theta_G)$9 million edges, and approximately $$\mathbf{H} = [\mathbf{h}_1,\ldots,\mathbf{h}_N]^\top \in \mathbb{R}^{N\times d},$$0 anomalies, and DGraph with approximately $$\mathbf{H} = [\mathbf{h}_1,\ldots,\mathbf{h}_N]^\top \in \mathbb{R}^{N\times d},$$1 million nodes, approximately $$\mathbf{H} = [\mathbf{h}_1,\ldots,\mathbf{h}_N]^\top \in \mathbb{R}^{N\times d},$$2 million edges, and approximately $$\mathbf{H} = [\mathbf{h}_1,\ldots,\mathbf{h}_N]^\top \in \mathbb{R}^{N\times d},$$3 anomalies. Label rates are typically $$\mathbf{H} = [\mathbf{h}_1,\ldots,\mathbf{h}_N]^\top \in \mathbb{R}^{N\times d},$$4 for training, with $$\mathbf{H} = [\mathbf{h}_1,\ldots,\mathbf{h}_N]^\top \in \mathbb{R}^{N\times d},$$5 for T-Soc, and the remaining nodes are split into validation and test at $$\mathbf{H} = [\mathbf{h}_1,\ldots,\mathbf{h}_N]^\top \in \mathbb{R}^{N\times d},$$6. Evaluation uses AUC and AP averaged over 10 runs with different random seeds; for fair comparison with other GAD works, additional protocols and metrics such as Macro-F1 are also adopted (Xie et al., 17 Aug 2025).

Across five main datasets—T-Soc, DGraph, Yelp, T-Fin, and Amazon—CRoC achieves up to 14% AUC improvement over GNN baselines and outperforms strong specialized GAD methods under limited-label settings. The paper highlights especially large gains on large-scale, camouflage-prone datasets such as T-Soc and Yelp, where CRoC substantially surpasses baselines and methods including CARE-GNN, GHRN, BWGNN, and ConsisGAD. CRoC(GIN) also consistently outperforms baselines across different label rates, with performance degrading only slightly as labels shrink, whereas other methods often collapse.

Ablation studies attribute performance gains to all three modules. Context refactoring through $$\mathbf{H} = [\mathbf{h}_1,\ldots,\mathbf{h}_N]^\top \in \mathbb{R}^{N\times d},$$7, contrastive learning through $$\mathbf{H} = [\mathbf{h}_1,\ldots,\mathbf{h}_N]^\top \in \mathbb{R}^{N\times d},$$8, and RJA each contribute independently, and the best performance occurs when all are combined. A specific caveat is also reported: RJA alone can overfit under extremely scarce labels, as in T-Soc, but combining it with refactoring and contrastive learning alleviates this by injecting unlabeled data into training. Robustness analysis on DGraph further shows cases where anomalous and normal nodes have identical features, with cosine similarity $$\mathbf{H} = [\mathbf{h}_1,\ldots,\mathbf{h}_N]^\top \in \mathbb{R}^{N\times d},$$9, collapsing feature-only detectors; under these conditions, CRoC’s multi-relation semantics produce distinct embeddings that help break behavior camouflage.

CRoC is explicitly positioned against several prior lines of GAD work. Rather than pruning edges or selectively sampling homophilic neighbors, as in CARE-GNN, PCGNN, and GHRN, it preserves edges and refactors features, thereby training the encoder to be robust to camouflage rather than attempting to filter heterophily away. In contrast to pseudo-label-based self-training such as ConsisGAD, it uses only ground-truth labels for supervised training on both views and avoids noisy pseudo-labels. Standard graph contrastive learning often relies on general-purpose augmentations; CRoC instead tailors augmentation to GAD’s class imbalance and camouflage priors.

Trade-offs are also part of its comparative profile. RJA adds parameters through relation embeddings and therefore needs sufficient data. Where graph structure contributes limited utility, as suggested for Amazon and T-Fin in some settings, gains from relational modeling may be modest, and feature-based baselines can remain competitive.

6. Complexity, reproducibility, limitations, and terminological scope

The reported complexity preserves the backbone’s asymptotic character on sparse graphs. If $f(\mathbf{H}; \theta_C)$0 is the number of layers, $f(\mathbf{H}; \theta_C)$1 the hidden dimension, $f(\mathbf{H}; \theta_C)$2, and $f(\mathbf{H}; \theta_C)$3, then a message-passing GNN forward pass has complexity

$f(\mathbf{H}; \theta_C)$4

whereas CRoC’s two-view training with relation embeddings is approximately

$f(\mathbf{H}; \theta_C)$5

On sparse graphs where $f(\mathbf{H}; \theta_C)$6 and $f(\mathbf{H}; \theta_C)$7 are of the same order, CRoC keeps the same asymptotic order as the backbone. Empirically, CRoC(GIN) is described as scaling linearly relative to its backbone and as significantly faster than some specialized GAD methods on large graphs such as T-Soc and DGraph (Xie et al., 17 Aug 2025).

The implementation reported for reproducibility uses a 2-layer GIN or GraphSAGE encoder with hidden dimension $f(\mathbf{H}; \theta_C)$8 and a 2-layer MLP classifier. The learning rate is $f(\mathbf{H}; \theta_C)$9, the temperature is $\hat{\mathbf{Y}}$0, and $\hat{\mathbf{Y}}$1, $\hat{\mathbf{Y}}$2, and $\hat{\mathbf{Y}}$3 are searched in $\hat{\mathbf{Y}}$4. A new context-refactored graph is built every epoch, experiments run for 10 seeds, and final test results are taken from the best validation epoch per run. Code is available at the public repository https://github.com/XsLangley/CRoC_ECAI2025, and data preprocessing and splits follow BWGNN settings (Xie et al., 17 Aug 2025).

The stated limitations are tightly coupled to CRoC’s design assumptions. Because the framework relies on shuffling features, its benefit may diminish if attributes are weakly informative or heavily noisy. When graph structural signals are limited or not predictive, gains from preserving edges and adding RJA may be small. Extremely scarce labels can make relation embedding learning prone to overfitting if refactoring and contrastive components are disabled. Proposed future directions include adaptive non-random refactoring guided by relation or context statistics, integration with attention-based per-relation message passing, and principled relation-aware hard-negative sampling.

The term “CRoC” also requires disambiguation. In multi-turn dialogue, “ACR: Adaptive Context Refactoring via Context Refactoring Operators for Multi-Turn Dialogue” discusses a contrastive extension framed as CRoC, but explicitly notes that it is not explicitly defined or implemented in that work; there, the operative framework is ACR rather than the graph-anomaly method described above (Shen et al., 9 Jan 2026). In text-to-image metric evaluation, “CROC” expands to “Contrastive Robustness Checks,” not “Context Refactoring Contrast,” and denotes a distinct framework for automated meta-evaluation and training of T2I metrics (Leiter et al., 16 May 2025). Within the graph learning literature, however, CRoC specifically denotes the limited-supervision GAD framework based on context refactoring, relation-aware aggregation, and node-wise contrastive learning.