Amortised Post-Hoc Explanation with Exact Preservation for Dynamic Graph Anomaly Detectors

• URL: http://arxiv.org/abs/2608.15559v1
• Date: Sun, 16 Aug 2026 06:10:40 GMT
• Title: Amortised Post-Hoc Explanation with Exact Preservation for Dynamic Graph Anomaly Detectors
• Abstract summary: Anomaly detection in dynamic graphs underpins financial fraud analysis, intrusion detection, and platform integrity.<n>StrGNN, the strongest performer in recent benchmarks, produces no explanation: when an edge is flagged, the analyst receives only a score.<n>We present X-StrGNN, a post-hoc explanation layer that wraps a trained, frozen StrGNN and emits, for every flagged edge, dual attributions.
• Score: 2.169919643934826
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Anomaly detection in dynamic graphs underpins financial fraud analysis, intrusion detection, and platform integrity, where automated decisions require human-interpretable justifications. StrGNN, the strongest performer in recent benchmarks, produces no explanation: when an edge is flagged, the analyst receives only a score. Explanation metrics are undefined for StrGNN because no attribution vector exists. This paper closes that gap. We present X-StrGNN, a post-hoc explanation layer that wraps a trained, frozen StrGNN and emits, for every flagged edge, dual attributions: a structural attribution identifying which contextual interactions in the enclosing subgraph drove the decision, and a temporal attribution identifying which historical snapshot carried the signal. Both attributions are multiplicative masks identically one in the unexplained pass, so the layer is an exact pass-through: detection is preserved to machine precision, verified rather than asserted (Delta AUC = 0.0000, Delta AP = 0.0000, Delta P@100 = 0.0000). Attribution costs 0.66 ms per edge, making explanation of an entire alarm list feasible. We conduct the first controlled design study of attribution strategies for this architecture, comparing gradient attribution, per-instance mask optimisation, and amortised parameterisation under one protocol, one budget, and three seeds. X-StrGNN attains the highest stability (0.913) at 268x lower cost than per-instance optimisation, and its temporal attribution (1.601 against a measured random floor of 0.973) is separably better than its ablated control, while per-instance optimisation - the most expensive strategy - falls below that floor. Code, protocol, and per-seed measurements are released.

Related papers

• Dual Spatial-Temporal Attribution: Architecture-Aligned Post-Hoc Explainability for Recurrent Graph Anomaly Detection [1.8899300124593645]
  We present X-AddGraph, a post-hoc explainability framework for anomaly detection in dynamic graphs.<n>Because the detector is frozen, detection performance is preserved exactly.<n>X-AddGraph reproduces every score identically while adding explanations where none existed.
  arXiv  Detail & Related papers  (2026-08-12T15:58:27Z)
• Located but Not Releasable: Silent Gate Inversion and Bounded Linear Release [0.0]
  We submit the complete pipeline -- detect, localize, and release -- to a fully preregistered stress test on a 25.7M transformer.<n> Interventions at observation-evidence channels of mid layers restore target behavior on otherwise-suppressed worlds.<n>Gating fails out of distribution: a detector calibrated to trigger on zero out-of-distribution calibration worlds triggers on 6.9-7.3% of held-out in-distribution generations and on zero of the 2,400 held-out generations that actually need it.
  arXiv  Detail & Related papers  (2026-08-12T09:04:54Z)
• Behavioral Grammar: Detecting Adaptive Malware via Tiny Language Model Priors and Second-Order Temporal Analysis [1.560152792366037]
  This paper presents Behavioral Grammar, a detection architecture that treats host runtime behavior as a structured language.<n>Each system event is discretized into an 8-token representation spanning event type, process, argument skeleton, path category, parent process, user, destination, and inter-event timing.<n>We frame these findings within a coevolutionary economics model, arguing that behavior-grammar detection shifts the evasion cost from rule circumvention to distribution matching.
  arXiv  Detail & Related papers  (2026-08-01T16:28:38Z)
• Real-Time Source-Free Object Detection [40.10658212485104]
  Real-world detectors for autonomous driving, surveillance, and robotics must handle domain-shifts under strict latency and memory constraints.<n>We show that building on YOLOv10, an NMS-free dual-head detector, we achieve state-of-the-art adaptation accuracy while being faster and more compact.
  arXiv  Detail & Related papers  (2026-06-30T15:38:56Z)
• GAMBIT: A Three-Mode Benchmark for Adversarial Robustness in Multi-Agent LLM Collectives [48.545980031973556]
  GAMBIT is a benchmark with three evaluation modes and two independent scores for evaluating imposter detectors.<n>The benchmark comes with a dataset of 27,804 labeled instances spanning 240 co-evolved imposter strategies.
  arXiv  Detail & Related papers  (2026-05-09T16:07:23Z)
• Phionyx: A Deterministic AI Runtime Architecture with Structured State Management and Pre-Response Governance [0.0]
  We present Phionyx, a deterministic AI runtime architecture derived from the broader Echoism interaction framework.<n>Unlike probabilistic agents, Phionyx enforces deterministic state evolution via a structured state vector governed by deterministic state-evolution equations.<n>The architecture integrates three layers: (1) a deterministic evaluation kernel processing noisy sensor measurements through a canonical 46-block pipeline, (2) a unified safety layer providing pre-response control and architectural privacy enforcement, and (3) a semantic time-based memory system implementing impact-weighted cache eviction.
  arXiv  Detail & Related papers  (2026-05-04T18:35:31Z)
• VeriX-Anon: A Multi-Layered Framework for Mathematically Verifiable Outsourced Target-Driven Data Anonymization [0.0]
  VeriX-Anon is a multi-layered verification framework for outsourced Target-Driven k-anonymization.<n>It combines deterministic verification via Merkle-style hashing of an Authenticated Decision Tree, probabilistic verification via Boundary Sentinels near the Random Forest decision boundary and exact-duplicate Twins with cryptographic identifiers.<n>It correctly detected deviations in 11 of 12 scenarios.
  arXiv  Detail & Related papers  (2026-04-14T08:22:18Z)
• AnomalyGen: Enhancing Log-Based Anomaly Detection with Code-Guided Data Augmentation [42.87177529900358]
  AnomalyGen is a novel framework that augments training data by synthesizing labeled log sequences from source code.<n> Evaluations on HDFS and Zookeeper across 12 diverse anomaly detection models show AnomalyGen consistently improves performance.
  arXiv  Detail & Related papers  (2026-04-13T07:24:43Z)
• Dynamic analysis enhances issue resolution [53.50448142467294]
  DAIRA (Dynamic Analysis-enhanced Issue Resolution Agent) is an automated repair framework that embeds dynamic analysis into the agent's reasoning cycle.<n> Driven by a Test Tracing-Driven methodology, DAIRA utilizes lightweight monitors to extract critical runtime data.<n>When powered by Gemini 3 Flash Preview, DAIRA establishes a new state-of-the-art (SOTA) performance, achieving a 79.4% resolution rate on the SWE-bench Verified dataset.
  arXiv  Detail & Related papers  (2026-03-23T14:48:54Z)
• End-to-End Convolutional Activation Anomaly Analysis for Anomaly Detection [41.94295877935867]
  End-to-end Convolutional Activation Anomaly Analysis (E2E-CA$3$) We propose an End-to-end Convolutional Activation Anomaly Analysis (E2E-CA$3$) It is a significant extension of A$3$ anomaly detection approach proposed by Sperl, Schulze and B"ottinger.
  arXiv  Detail & Related papers  (2024-11-21T10:22:50Z)
• SADet: Learning An Efficient and Accurate Pedestrian Detector [68.66857832440897]
  This paper proposes a series of systematic optimization strategies for the detection pipeline of one-stage detector. It forms a single shot anchor-based detector (SADet) for efficient and accurate pedestrian detection. Though structurally simple, it presents state-of-the-art result and real-time speed of $20$ FPS for VGA-resolution images.
  arXiv  Detail & Related papers  (2020-07-26T12:32:38Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.