Generalist Graph Anomaly Detection via Prototype-Based Distillation

Driven by the pressing demand for graph anomaly detection (GAD) in high-stakes domains, the generalist GAD paradigm, which trains a single detector transferable across new graphs, has recently gained growing attention. However, existing methods often rely on scarce and costly annotations for training and sometimes even require few-shot support at inference, which limits their robustness to diverse and unseen anomaly patterns. To address this limitation, we introduce ProMoS, the first unsupervised generalist GAD framework, which detects anomalies by modeling the abundant normality in unlabeled data. ProMoS adopts a knowledge-distillation paradigm to distill normality priors from a frozen self-supervised graph neural network (GNN) teacher to a mixture-of-students model with shared global and lightweight personalized branches, enabling efficient and expressive normality modeling without learning from scratch. We further propose prototype-guided soft-label distillation to align teacher and student in a shared prototype space, enhancing cross-graph generalizability. During inference, ProMoS performs zero-shot anomaly detection on unseen graphs via distillation bias and prototype geometric deviation. Extensive experiments show the effectiveness and efficiency of ProMoS, charting a practical path toward label-free, zero-shot generalist GAD.

Many real-world systems, such as financial transactions, and social networks, are interconnected networks where spotting unusual behavior is critical to catching fraud or security threats. However, reliable examples of these anomalies are rare and costly to collect, making traditional AI models blind to newly evolving attack patterns. We introduce ProMoS, a universal framework that requires no human-labeled data. It works like a senior teacher passing down broad concepts of "normal behavior" to a team of diverse students: one student captures patterns shared across all networks, while specialized students focus on unique, local behaviors. ProMoS then flags suspicious activities by measuring how strongly they deviate from these learned normal concepts. Experiments show that ProMoS instantly detects anomalies in entirely unseen networks without needing any labels. This provides a highly scalable, plug-and-play solution that slashes the cost of building separate detectors for every new network.