ProTAGAD: A Foundation Model for TAG Anomaly Detection with Decoupled Topological and Textual Prototypes

ProTAGAD: A Foundation Model for TAG Anomaly Detection with Decoupled Topological and Textual Prototypes

Abstract

Text-Attributed Graphs (TAGs), endowed with abundant textual content along with topological structures, have emerged as a versatile backbone for real-world anomaly detection spanning large language model security, social network moderation, and cyber threat identification. Unlike conventional Graph Anomaly Detection (GAD), which relies primarily on structural irregularities, TAG anomaly detection must jointly leverage both topological patterns and fine-grained textual semantics to capture nuanced anomalous behaviors. The current GNN-based anomaly detectors adopt holistic message-passing schemes that indiscriminately fuse structural proximity and textual semantics during propagation, leading to deep cross-modality coupling. This entanglement acts as a noise amplifier, obscuring subtle anomalous signals and directly giving rise to the Blurred-Anomaly-Boundary (BAB) issue by rendering normal-anomalous decision boundaries poorly separable. This challenge is further amplified for graph foundation models that require robust cross-domain generalization. To bridge this gap, we introduce a novel foundation model for TAG anomaly detection featuring decoupled topological and textual prototypes. Our framework constructs dual prototype banks to independently model structural normality and semantic consistency, effectively isolating anomaly cues that are otherwise diluted during coupled aggregation. Extensive experiments across 14 diverse benchmark datasets demonstrate that our method consistently achieves state-of-the-art performance in cross-domain settings. Notably, the ablation studies further corroborate the prevalence of the BAB issue in conventional coupled TAG anomaly detectors, and show that our decoupled prototype design effectively mitigates this challenge.

Introduction

Graph anomaly detection (GAD) aims to identify nodes that deviate from dominant graph patterns and has been widely applied to fraud detection, social network moderation, cybersecurity, and recommendation systems. In real-world graphs, nodes are often associated with rich textual content in addition to relational structures, such as paper abstracts, product descriptions, and user posts. Such data are commonly formulated as text-attributed graphs (TAGs), where anomalies may arise from irregular connections, subtle semantic inconsistencies, or both. Effective TAG anomaly detection therefore requires jointly exploiting textual semantics and graph topology.

Existing GAD methods are primarily designed for numerical attributes and structural irregularities. Although recent TAGAD methods employ language models to encode raw text, most still rely on holistic GNN message passing to jointly propagate textual and topological information. As illustrated in Figure 1, this coupled propagation progressively smooths or distorts subtle anomaly cues, reducing the distinction between normal and anomalous nodes and thereby giving rise to the Blurred-Anomaly-Boundary (BAB) issue.

Recent graph pre-training and prompt-learning methods have explored transferable graph representations across tasks and domains. However, the BAB issue becomes more severe in the generalist setting, where one model is trained on multiple source graphs and directly applied to unseen domains. Cross-domain variations in textual semantics and connectivity patterns make jointly propagated representations prone to retaining domain-specific neighborhood information, further weakening anomaly cues under distribution shifts and hindering zero-shot generalization.

To address this issue, we propose ProTAGAD, a prototype-based foundation model that decouples textual and topological representation learning. ProTAGAD separately learns transferable textual anomaly prototypes and topological normality prototypes without exchanging hidden representations, and combines their anomaly scores only at the decision level. This design avoids cross-modal interference while preserving the complementary anomaly evidence of both modalities.

We evaluate ProTAGAD on 14 TAG datasets under a source-to-target zero-shot protocol. ProTAGAD achieves the best AUROC on seven of eight unseen target graphs, with an average rank of 1.12, demonstrating strong cross-domain generalization. Additional analyses further reveal the complementary roles of textual and topological prototypes and verify that decoupled prototype modeling effectively alleviates the BAB issue.

Main Contributions

• We formally identify the Blurred-Anomaly-Boundary (BAB) issue in generalist TAG anomaly detection, attributing its root cause to entangled cross-modal fusion via holistic GNN message passing.

• We propose ProTAGAD, a foundation model for TAG anomaly detection that leverages decoupled textual anomaly prototypes and topological normality prototypes to isolate modality-specific anomaly evidence without cross-modal interference.

• Extensive experiments on 14 diverse TAG benchmarks achieve state-of-the-art zero-shot cross-domain performance; ablations further verify dual prototype complementarity and empirically confirm both the prevalence of the BAB issue and the efficacy of our decoupled design.

Related Work

Graph Anomaly Detection: GAD aims to identify nodes that deviate from the dominant attribute or structural patterns. Existing methods mainly include reconstruction-, self-supervised-, spectral-, affinity-, and augmentation-based approaches. Reconstruction-based methods detect anomalies through the reconstruction of attributes or structures (DOMINANT, AnomalyDAE, ComGA). Self-supervised methods learn anomaly-sensitive node-context or neighborhood patterns (CoLA, HCM-A). Spectral methods exploit high-frequency graph signals (BWGNN, GHRN), while affinity-based methods model one-class normality and suppress suspicious connections (TAM, GCTAM). Augmentation-based methods synthesize anomalies to enhance model robustness (Semi-GGAD, CAGAD). However, these methods generally follow a one-for-one paradigm with fixed numerical attributes, requiring retraining on new graphs and overlooking the fine-grained semantics of raw text.

Generalist Graph Anomaly Detection: GGAD extends conventional GAD from graph-specific learning toward cross-domain generalization, aiming to train a unified detector that can be transferred to unseen graphs. ARC introduces in-context learning for transferable anomaly detection, while UNPrompt and AnomalyGFM explore zero/few-shot detection through unified prompts and graph foundation models. Recent studies further investigate domain shifts through invariant representation learning and prototype-based knowledge transfer, such as IA-GGAD, DR-GGAD, OWLEYE, and ProMoS. However, existing GGAD methods generally focus on numerical node representations and structural distribution shifts. The semantic information contained in raw texts is not explicitly modeled, and the interaction between textual and topological anomaly evidence remains unexplored, limiting their applicability to text-attributed graphs.

Text-Attributed Graph Anomaly Detection: TAGAD identifies anomalous nodes by jointly modeling textual attributes and graph topology. Conventional methods typically encode texts into fixed-dimensional representations, which may miss subtle anomaly cues. Recent approaches improve textual modeling through contrastive learning or large language model reasoning. CMUCL captures textual and structural inconsistencies through multi-scale contrastive learning, CoLL extracts textual anomaly evidence through collaborative LLM reasoning, and TAGAD studies realistic anomaly construction and retrieval-augmented zero-shot detection. However, existing methods often entangle textual and topological information, causing semantic anomalies to be smoothed by neighborhood aggregation, while LLM-based approaches rarely model transferable structural normality. Most are also tailored to individual graphs. Instead, ProTAGAD learns decoupled textual and topological prototype banks and combines their scores for cross-domain detection on unseen graphs.

Preliminaries

Notations: Let G = (V, A, T, X) denote a text-attributed graph, where V = v1,..., vN is the node set, A ∈ 0, 1 N×N is the adjacency matrix, and T = ti N i=1 contains the raw textual attributes associated with the nodes. An entry Aij = 1 indicates an edge between vi and vj. The matrix X ∈ RN×d denotes the initial node feature matrix, whose i-th row xi ∈ Rd is the d-dimensional feature vector associated with node vi.

For each node vi, we denote its one-hop neighborhood by Ni and construct a local textual subgraph containing the text of the target node and its neighbors: Git = ti ∪ tj j ∈ Ni. The local textual subgraph enables the agent to assess both the semantic content of the target node and its consistency with neighboring texts.

Generalist TAG Anomaly Detection: Given a collection of source-domain TAGs Ttrain = G(1) train,..., G(ns) train and a disjoint collection of unseen target-domain TAGs Ttest = G(1) test,..., G(nt) test, where ns and nt denote the numbers of source and target graphs, respectively, our goal is to learn a unified anomaly detector from Ttrain and directly generalize it to Ttest. During inference, the model parameters are frozen, and no target-domain labels or additional fine-tuning are available. For each node vi in a target graph, the detector outputs an anomaly score S(vi) ∈ R, where a larger value indicates a higher likelihood of being anomalous.

Methodology

To mitigate the BAB problem, we propose ProTAGAD, which decouples textual and topological representation learning by avoiding shared cross-modal message propagation. ProTAGAD separately learns textual and topological prototypes and fuses their anomaly scores for zero-shot inference on unseen graphs.

Textual Prototype Learning

The textual module aims to extract transferable semantic anomaly patterns from raw node texts. We first employ a text encoder fΘ txt to map the textual attributes into a continuous representation space: Xt = fΘ txt(T) = [xt1,..., xtN]⊤ ∈ RN×dt, where xti denotes the textual representation of node vi.

Based on these textual representations, we employ a lightweight text anomaly probability estimator to estimate the textual anomaly probability of each node: Ŷ = fΘ prob(Xt) = [ŷ1,..., ŷN]⊤, where ŷi ∈ [0, 1] denotes the estimated textual anomaly probability of node vi.

Existing text encoders often emphasize general semantics, making fine-grained anomaly cues difficult to capture. To address this issue, we introduce the Agents-Skills-Review-Confidence mechanism. Given a local textual subgraph Git, the anomaly agent first performs a coarse assessment. The Skill Router then identifies the graph domain, activates the corresponding domain-specific skill, and conducts fine-grained analysis of whether the target text is semantically consistent with its topic or content. The reviewer further verifies the decision consistency, supporting textual evidence, and confidence reliability. After reviewing all nodes, we identify an elbow point in the anomaly confidence distribution as the threshold. Nodes with confidence scores above the threshold are assigned a pseudo-label of 1, while the remaining nodes are assigned 0. The resulting binary indicator for node vi is defined as ci = Agents-Skills-Review-Confidence(Git), where C = [c1,..., cN]⊤, with ci = 1 indicating a high-confidence textual anomaly and ci = 0 indicating low textual anomaly confidence.

These agent-derived binary indicators are used only as pseudo-labels to supervise the text anomaly probability estimator through binary cross-entropy loss: Lprob = −(1/N) Σ [ci log(ŷi) + (1 − ci) log(1 − ŷi)].

We further use these pseudo-labels to partition the node representations into anomalous and normal groups, which are then aggregated to construct the corresponding textual prototypes: pt− = (1/∥C∥1) Σ ci·xti, pt+ = (1/∥1 − C∥1) Σ (1−ci)·xti, where pt− and pt+ are obtained by averaging the textual representations of the inferred anomalous and normal nodes, respectively, thereby capturing the representative semantic patterns of the two groups.

However, constructing the prototypes alone does not explicitly constrain the positions of individual nodes in the representation space. To further enhance the separation between anomalous and normal textual patterns, we introduce a prototype alignment objective: Lalign = (1/N) Σ [ci log(1 + exp(ϕ(xti, pt+) − ϕ(xti, pt−))) + (1 − ci) log(1 + exp(ϕ(xti, pt−) − ϕ(xti, pt+)))], where ϕ(·, ·) denotes cosine similarity. For ci = 1, the objective pulls xti toward pt− and pushes it away from pt+, while for ci = 0, it pulls xti toward pt+ and pushes it away from pt−. This objective yields a more discriminative textual representation space with a clearer normal-anomalous boundary.

The probability estimation and prototype alignment objectives optimize different components of the textual module: Lprob optimizes the text anomaly probability estimator to estimate textual anomaly probabilities, while Lalign optimizes the text encoder to learn discriminative semantic representations of anomalies.

After training, the textual anomaly score of node vi is defined as S t(vi) = fΘ prob(xti) + ϕ(xti, pt−) + ∥xti − (1/N(i)) Σj∈N(i) xtj∥2 2, where the first term is the textual anomaly probability estimated by fΘ prob, the second measures the semantic affinity between the node representation and the textual anomaly prototype learned from the source graphs, and the third term captures the deviation between a node's textual representation and its local textual neighborhood. Before summation, all score terms are standardized using Z-score normalization to eliminate their scale differences.

Topological Prototype Learning

Following ProMoS, we learn two node representations to model transferable structural normality. A Graph Transformer is first trained with self-supervised contrastive learning to obtain topology-aware node representations: H = fΘ GNN(X, A) = Graph Transformer(X, A), where H = [h1,..., hN]⊤ encodes the node attributes together with their topological contexts.

To obtain a complementary representation, we further employ an MLP that takes only the node features as input and learns to approximate the topology-aware representations through knowledge distillation: H′ = fΘ MLP(X) = σ((σ(XW + b))W′ + b′). Although the MLP does not directly use the adjacency matrix, the distillation process transfers topology-related knowledge from H to H′. The two representations therefore provide complementary views for subsequent topological prototype construction.

To capture diverse structural normality patterns, we apply K-means clustering to the topology-aware representations H and use the resulting cluster centers as topological prototypes: Ps = K-means(H, K) = ps1,..., psK, where each psk represents a typical structural normality pattern in the topology-aware representation space. To ensure that the projected representation h′i preserves the structural patterns encoded in hi, we align their similarity distributions over the shared topological prototypes. Specifically, the structural consistency objective is defined as Lstr = (1/N) Σ KL(softmax(hi·(Ps)⊤) ∥ softmax(h′i·(Ps)⊤)), where KL(· ∥ ·) denotes the Kullback–Leibler divergence. This objective encourages h′i to retain the relative affinities of hi to different topological prototypes, thereby preserving its topology-aware structural semantics.

Based on these prototypes and the two complementary node representations, we define the topological anomaly score of node vi as S s(vi) = KL(softmax(hi·(Ps)⊤) ∥ softmax(h′i·(Ps)⊤)) + ∥hi − psm∥2 2, m = arg mink ∥hi − psk∥2. Specifically, the two terms measure the discrepancy between the similarity distributions of the two node representations over the topological prototypes and the deviation from the nearest topological prototype, respectively. Before summation, both score terms are standardized using Z-score normalization to eliminate scale differences.

Decoupled Dual-Prototype Anomaly Scoring

The…

Improvements to AI systems based on this paper:

1. Decoupled multi-modal representation learning: Replace holistic message-passing that fuses textual and topological features during propagation with separate modality-specific prototype banks. This prevents cross-modal noise amplification and preserves subtle anomaly cues that are otherwise diluted. The improved system can detect anomalies that are only visible in one modality without interference from the other.

2. Dual prototype architecture for normality/anomaly modeling: Maintain separate textual prototypes (anomalous vs. normal semantic patterns) and topological prototypes (multiple structural normality clusters). The improved system can independently assess semantic consistency and structural regularity, then combine scores only at the decision level, yielding clearer decision boundaries.

3. Agent-based pseudo-labeling for text anomaly estimation: Use an Agents-Skills-Review-Confidence mechanism where an LLM agent performs coarse assessment, a skill router activates domain-specific skills for fine-grained analysis, and a reviewer verifies consistency and confidence. This produces high-quality pseudo-labels for training the text anomaly estimator without requiring manual annotation.

4. Prototype alignment objective with contrastive separation: Apply a loss function that pulls node representations toward their correct prototype (anomalous or normal) while pushing them away from the incorrect one, using cosine similarity margins. The improved system learns a more discriminative representation space with sharper normal-anomalous boundaries.

5. Knowledge distillation for topology-aware representations: Train an MLP to approximate Graph Transformer outputs via KL-divergence alignment over shared topological prototypes. This creates complementary views (one topology-aware, one feature-only) that expose structural anomalies through distributional discrepancy, enabling detection of nodes whose structure deviates from learned normality patterns.

6. Cross-domain zero-shot generalization via transferable prototypes: Learn prototypes from multiple source graphs that capture domain-invariant normality and anomaly patterns. The improved system can be directly applied to unseen target graphs without fine-tuning, achieving state-of-the-art performance across citation, e-commerce, web, and encyclopedia domains.

7. Multi-term anomaly scoring with Z-score standardization: Combine probability estimates, prototype affinity, local neighborhood deviation, and prototype-distribution divergence, with each term independently standardized. The improved system produces calibrated anomaly scores that are robust to scale differences across modalities and domains.

8. Quantitative boundary separability metric (ABS): Introduce a Kullback-Leibler divergence-based metric between normal and anomalous score distributions to measure decision boundary clarity. The improved system can evaluate and optimize for this metric, ensuring well-separated anomaly scores rather than just ranking accuracy.