Normality Calibration in Semi-supervised Graph Anomaly Detection

Semi-supervised graph anomaly detection (GAD), which assumes a subset of labeled normal nodes for training, is widely studied. However, existing methods learn normality only from these labeled nodes, often overfitting their patterns and causing high detection errors, such as many false positives. To overcome this limitation, we propose $GraphNC$, a graph normality calibration framework that leverages both labeled and unlabeled data to calibrate the normality from a teacher (a pre-trained semi-supervised GAD model) jointly in anomaly score and representation spaces. GraphNC includes two main components, anomaly score distribution alignment ($ScoreDA$) and perturbation-based normality regularization ($NormReg$). ScoreDA optimizes our model’s anomaly scores by aligning them with the teacher’s score distribution. Because the teacher provides accurate scores for most normal nodes and some anomalies, this alignment pulls the scores of the two classes toward opposite ends, making them more separable. To reduce the impact of inaccurate teacher scores, NormReg regularizes normality in the representation space, making normal node representations more compact via a perturbation-guided consistency loss applied only to the labeled nodes. Comprehensive experiments on six benchmarks demonstrate that GraphNC (1) consistently and substantially enhances the performance of teacher models from different GAD methods (2) achieves new state-of-the-art performance. Our code is available at https://github.com/mala-lab/GraphNC.

Many real-world systems, such as social networks and financial transaction networks, can be represented as graphs, where each item is connected to others. Detecting unusual items in these graphs is important for tasks such as finding spam accounts or fraud. However, abnormal cases are often rare and costly to label, while normal cases are easier to obtain. This paper proposes $GraphNC$, a method for improving graph anomaly detection when only a small set of normal examples is labeled. Existing methods often rely too heavily on these few labeled normal examples, which can cause them to mistake unfamiliar but normal items for anomalies. GraphNC addresses this by learning from both labeled normal data and unlabeled data. It first uses the results of an existing detector as guidance, then refines this guidance by encouraging known normal items to remain consistently represented even after small changes. Experiments on six real-world datasets show that GraphNC improves several existing methods and achieves the best overall performance. These results suggest that GraphNC can make anomaly detection more reliable in practical settings where abnormal examples are difficult to collect.