Dual Spatial-Temporal Attribution: Architecture-Aligned Post-Hoc Explainability for Recurrent Graph Anomaly Detection

• URL: http://arxiv.org/abs/2608.12441v1
• Date: Wed, 12 Aug 2026 15:58:27 GMT
• Title: Dual Spatial-Temporal Attribution: Architecture-Aligned Post-Hoc Explainability for Recurrent Graph Anomaly Detection
• Abstract summary: We present X-AddGraph, a post-hoc explainability framework for anomaly detection in dynamic graphs.<n>Because the detector is frozen, detection performance is preserved exactly.<n>X-AddGraph reproduces every score identically while adding explanations where none existed.
• Score: 1.8899300124593645
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Deep learning detectors for anomalies in dynamic graphs have reached strong accuracy, yet they remain opaque: when an edge is flagged, the analyst receives a score but no reason. This opacity is untenable in the cooperative, regulated information systems where such detectors are deployed, where automated decisions must be auditable and trustworthy. We address this gap for AddGraph, the foundational GCN+GRU framework for edge-level anomaly detection in dynamic graphs, which to our knowledge has never been equipped with any form of explainability. We present a strictly post-hoc explainability framework, X-AddGraph, built on a Dual Spatial-Temporal Attribution (DSTA) mechanism whose three components are each aligned with one of AddGraph's architectural modules: a gradient-based relevance attribution over the current adjacency structure (spatial), a direct reading of the contextual attention weights already computed during inference (short-term temporal, at zero additional cost), and a gradient rollback through the recurrent hidden states (long-term temporal). Because the detector is frozen, detection performance is preserved exactly (Delta AUC = 0, verified empirically to ten decimal places). On the UCI Message benchmark, our trained AddGraph baseline reaches an average per-snapshot AUC of 0.8705, exceeding the originally published result; X-AddGraph reproduces every score identically while adding explanations where none existed. Evaluated across four edge populations - confident true positives, low-confidence true positives, false positives, and random samples - the long-term attribution identifies historical snapshots carrying significantly more counterfactual signal than random selection (0.127 vs. 0.074), a capability that no spatially-blind explainer can provide. We release our implementation for full reproducibility.

Related papers

• RINSE: Robust Target-Time Normality Estimation for Zero-Shot Graph Anomaly Detection [9.187714394723931]
  RINSE (Robust Iterative Normality Self-Estimation) is a gradient-free target-time framework.<n>It estimates target normality, representation calibration, and evidence reliability from the target graph.<n>These results support robust target-time estimation as a practical approach to generalist graph anomaly detection.
  arXiv  Detail & Related papers  (2026-09-02T12:03:58Z)
• Amortised Post-Hoc Explanation with Exact Preservation for Dynamic Graph Anomaly Detectors [2.169919643934826]
  Anomaly detection in dynamic graphs underpins financial fraud analysis, intrusion detection, and platform integrity.<n>StrGNN, the strongest performer in recent benchmarks, produces no explanation: when an edge is flagged, the analyst receives only a score.<n>We present X-StrGNN, a post-hoc explanation layer that wraps a trained, frozen StrGNN and emits, for every flagged edge, dual attributions.
  arXiv  Detail & Related papers  (2026-08-16T06:10:40Z)
• When Graph Structure Becomes a Liability: A Critical Re-Evaluation of Graph Neural Networks for Bitcoin Fraud Detection under Temporal Distribution Shift [0.0]
  Random Forest on raw features achieves F1 = 0.821 and outperforms all evaluated GNNs, while GraphSAGE reaches F1 = 0.689 +/- 0.017.<n>We release code, checkpoints, and a strict-inductive protocol to enable reproducible, leakage-free evaluation.
  arXiv  Detail & Related papers  (2026-04-21T14:32:20Z)
• H-RINS: Hierarchical Tightly-coupled Radar-Inertial Navigation via Smoothing and Mapping [2.3821762993135507]
  Millimeter-wave radar provides robust perception in visually degraded environments.<n>Radar-inertial state estimation is inherently susceptible to drift.<n>We propose a tightly coupled, hierarchical radar-inertial factor graph framework.
  arXiv  Detail & Related papers  (2026-03-14T20:30:49Z)
• Learning to Explore: Policy-Guided Outlier Synthesis for Graph Out-of-Distribution Detection [51.93878677594561]
  In unsupervised graph-level OOD detection, models are typically trained using only in-distribution (ID) data.<n>We propose a Policy-Guided Outlier Synthesis framework that replaces statics with a learned exploration strategy.
  arXiv  Detail & Related papers  (2026-02-28T11:40:18Z)
• Insider Threat Detection Using GCN and Bi-LSTM with Explicit and Implicit Graph Representations [3.294619412118624]
  Insider threat detection (ITD) is challenging due to the subtle and concealed nature of malicious activities performed by trusted users.<n>This paper proposes a post-hoc ITD framework that integrates explicit and implicit graph representations with temporal modelling to capture complex user behaviour patterns.
  arXiv  Detail & Related papers  (2025-12-20T19:48:35Z)
• PROVEX: Enhancing SOC Analyst Trust with Explainable Provenance-Based IDS [1.9336815376402718]
  This paper presents a comprehensive XAI framework designed to bridge the trust gap in Security Operations Centers (SOCs) by making graph-based detection transparent.<n>We implement this framework on top of KAIROS, a state-of-the-art temporal graph-based IDS, though our design is applicable to any temporal graph-based detector with minimal adaptation.
  arXiv  Detail & Related papers  (2025-12-20T03:45:21Z)
• ADA-GAD: Anomaly-Denoised Autoencoders for Graph Anomaly Detection [84.0718034981805]
  We introduce a novel framework called Anomaly-Denoised Autoencoders for Graph Anomaly Detection (ADA-GAD) In the first stage, we design a learning-free anomaly-denoised augmentation method to generate graphs with reduced anomaly levels. In the next stage, the decoders are retrained for detection on the original graph.
  arXiv  Detail & Related papers  (2023-12-22T09:02:01Z)
• Towards Self-Interpretable Graph-Level Anomaly Detection [73.1152604947837]
  Graph-level anomaly detection (GLAD) aims to identify graphs that exhibit notable dissimilarity compared to the majority in a collection. We propose a Self-Interpretable Graph aNomaly dETection model ( SIGNET) that detects anomalous graphs as well as generates informative explanations simultaneously.
  arXiv  Detail & Related papers  (2023-10-25T10:10:07Z)
• BOURNE: Bootstrapped Self-supervised Learning Framework for Unified Graph Anomaly Detection [50.26074811655596]
  We propose a novel unified graph anomaly detection framework based on bootstrapped self-supervised learning (named BOURNE) By swapping the context embeddings between nodes and edges, we enable the mutual detection of node and edge anomalies. BOURNE can eliminate the need for negative sampling, thereby enhancing its efficiency in handling large graphs.
  arXiv  Detail & Related papers  (2023-07-28T00:44:57Z)
• Graph Signal Sampling for Inductive One-Bit Matrix Completion: a Closed-form Solution [112.3443939502313]
  We propose a unified graph signal sampling framework which enjoys the benefits of graph signal analysis and processing. The key idea is to transform each user's ratings on the items to a function (signal) on the vertices of an item-item graph. For the online setting, we develop a Bayesian extension, i.e., BGS-IMC which considers continuous random Gaussian noise in the graph Fourier domain.
  arXiv  Detail & Related papers  (2023-02-08T08:17:43Z)
• Structural Temporal Graph Neural Networks for Anomaly Detection in Dynamic Graphs [54.13919050090926]
  We propose an end-to-end structural temporal Graph Neural Network model for detecting anomalous edges in dynamic graphs. In particular, we first extract the $h$-hop enclosing subgraph centered on the target edge and propose the node labeling function to identify the role of each node in the subgraph. Based on the extracted features, we utilize Gated recurrent units (GRUs) to capture the temporal information for anomaly detection.
  arXiv  Detail & Related papers  (2020-05-15T09:17:08Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.