{"id":"9acf1e1f-caa0-4f5c-be85-87dc71dd7ec8","arxiv_id":"2602.20019","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":9,"one_line_summary":"SDGAD combines residual event representations, a two-hypersphere restriction loss, and a normalizing-flow boundary to detect dynamic-graph anomalies with little or no supervision.","lead":"This paper introduces SDGAD, a plug-in framework for spotting anomalies in dynamic graphs when labeled anomalies are scarce or absent. It learns a boundary around normal behavior by combining residual event representations, a two-hypersphere restriction loss, and a normalizing-flow density model.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"S3 'fully unsupervised' results may rely on label-based early stopping: Appendix C selects checkpoints by 'best validation performance' on validation sets that contain anomalies, potentially leaking labels.","rationale":"The paper's central claim rests on the empirical demonstration across three supervision settings. The weakest point is not the residual representation assumption itself—which is plausible and supported by ablations on real datasets—but the unspecified validation protocol in the fully unsupervised setting. The manuscript's own Appendix C says early stopping is based on 'best validation performance,' and the validation sets are known to contain anomalous labels. If labels drive checkpoint selection, then the S3 results are not a fair comparison with unsupervised baselines, and the claim of learning a discriminative boundary 'without any label supervision' is not established. The reader's rationale already mentions this issue, but their weakest_assumption focuses on the residual signal. I agree that the residual assumption is also important and under-verified, but the validation-leakage concern is more load-bearing because it directly determines whether the headline empirical results are valid. The reader's conditional verdict is appropriate, but the condition should explicitly include disclosure of the S3 validation protocol and a label-free early-stopping check. I did not identify a basis for a stronger verdict than CONDITIONAL because the limited-supervision results on real datasets (Table 1) still provide some support for the method, and the flaw is in the unsupervised evaluation rather than the core architecture.","tokens_in":24335,"tokens_out":5296,"duration_ms":55443,"concrete_test":"Obtain the authors' code or ask for the exact validation metric used for early stopping in S3. Then re-run the S3 experiments with an alternative protocol that selects checkpoints using only the unsupervised training loss (or a fixed epoch count) and compare SDGAD's test AUROC/AP/F1 to the reported numbers. If the performance gap over baselines shrinks materially, the S3 results are an artifact of label-based model selection.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim includes strong performance in the fully unsupervised setting S3, but the experimental protocol may not actually be label-free. Section 5.1 defines S3 as 'models are trained without any label supervision.' However, Appendix C states 'All baselines are trained for up to 200 epochs with early stopping (patience = 10) and the checkpoint achieving the best validation performance is used for testing.' The validation split contains labeled anomalies (Appendix B.2: validation set has 0.1% injected T-anomalies for synthetic datasets; real datasets also have labeled validation anomalies). If 'validation performance' is measured with an anomaly-detection metric such as AUROC/AP/F1, then labels are used for checkpoint selection, making S3 not fully unsupervised. This would explain the near-perfect S3 results on synthetic datasets (Table 2: AUROC ~99.9) versus unsupervised baselines that often collapse to chance. The paper never discloses the validation metric nor states that labels are withheld during model selection. This is a direct threat to the empirical basis of the 'fully unsupervised' claim, which is a central part of the paper's contribution.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes SDGAD, a model-agnostic framework for anomaly detection in continuous-time dynamic graphs under limited supervision. The method has three components: residual representation encoding that subtracts the historical-context embedding from the embedding computed with the current event (Eq. 3); a representation restriction loss that encourages normal residuals to lie between two co-centered hyperspheres and pushes anomalies outside (Eqs. 5-8); and a bi-boundary optimization loss that uses a normalizing-flow log-likelihood with separate boundaries Bn and Ba = Bn - τ (Eq. 11). The paper claims consistent gains over baselines on six datasets under three settings: limited supervision (S1), few-shot (S2), and fully unsupervised (S3), and reports ablations, hyperparameter studies, and an error-bound analysis. The empirical evaluation is broad, but the validity of the 'fully unsupervised' setting is compromised by the early-stopping protocol, and the theoretical bound in Appendix E.2.1 contains an impossible assumption.","tokens_in":1889,"tokens_out":1745,"duration_ms":33285,"significance":"If the empirical claims held, SDGAD would be a useful drop-in module for CTDG encoders: the framework is encoder-agnostic, the anomaly score is a calibrated complement of a flow log-likelihood, and the authors report F1/AP improvements beyond AUROC under severe class imbalance, together with ablations across multiple backbones. The paper also includes a more honest metric discussion than is typical for DGAD work. However, the central S3 claim—fully unsupervised performance comparable to limited-supervision—appears to rely on label-based model selection, and the theoretical support in Appendix E.2.1 is invalid as stated. The core empirical contribution needs verification under a genuinely label-free protocol before the paper's main claims can be accepted.","major_comments":[{"comment":"The 'fully unsupervised' setting S3 is defined as training 'without any label supervision,' yet Appendix C states that all models are trained with early stopping using 'the checkpoint achieving the best validation performance.' Appendix B.2 shows that the validation split contains labeled anomalies (e.g., 0.15% for Wikipedia, 0.065% for Reddit; injected T-anomalies for synthetic datasets). The paper never specifies the validation metric used for checkpoint selection, nor does it state that labels are withheld during model selection. If AUROC/AP/F1 on the validation set is used, S3 is not label-free, and the near-perfect S3 results on synthetic datasets (Table 2, AUROC ≈ 99.9) would reflect label leakage through model selection rather than unsupervised learning. Please disclose the validation criterion and either (a) use a criterion that requires no labels, or (b) relabel the setting as s","section":"§5.1 and Appendix C (S3 protocol)"},{"comment":"The proof of Proposition 1 assumes Φθ'(x)^T Φθ'(x) = -1. This is impossible for a squared norm of a real vector, which is always nonnegative. The inequality chain in Eqs. (17)-(19) therefore does not establish the claimed bound, and the statement 'we assume a worst-case initialization' is internally inconsistent. Since Proposition 1 is the paper's only theoretical justification for the bi-boundary loss, this section either needs a corrected derivation (with a valid lower bound, e.g., ≥ 0) or should be removed and the empirical argument presented on its own.","section":"Appendix E.2.1, Eq. (18)"},{"comment":"The residual representation hypothesis—anomalies induce statistically detectable changes in ΔE = Enc(S_t) − Enc(S^{t−})—is the foundation of the entire pipeline. Section 4.1 provides qualitative motivation, and the ablation w/oRes (Table 3) shows degradation, but there is no direct verification that residual norms separate normal from anomalous interactions, nor an analysis of cases where the residual is small (e.g., anomalous edges between nodes with rich, consistent histories). Please report the distribution of residual norms for normal vs. anomalous test samples, and ideally show recall at high-precision thresholds. Without such evidence, it is unclear whether failures are attributable to the boundary module or to the absence of discriminative residual signal.","section":"§4.1, Eq. (3)"},{"comment":"The S3 experiments on synthetic datasets report AUROC values of 99.86–99.88 with standard deviations of 0.01 for SDGAD, while the unsupervised baselines often collapse to chance (e.g., Table 2, JODIE/TCL). Given the early-stopping issue above, these numbers are not interpretable as unsupervised performance. Even setting aside label leakage, the extremely low variance and near-perfect scores suggest that the injected anomalies are trivially detectable from residual structure; Section A's own caveat about 'trivial cues such as rare repetition' applies to these benchmarks. Please validate S3 with a protocol that forbids any labeled validation signal and report the resulting numbers.","section":"§5.1 / Table 2"},{"comment":"The ablation table reports w/o LBO with AUROC/AP essentially unchanged on Wikipedia (80.36±1.00 vs 80.36±0.69 AUROC) and only F1 dropping. Given that the paper's motivation is an explicit, robust boundary, the absence of an AUROC/AP effect is not itself a flaw, but the claim that bi-boundary optimization is 'essential' should be supported with a statistical test or a more sensitive metric. At minimum, report the p-value or confidence interval for the F1 difference across the five runs.","section":"Table 3"}],"minor_comments":[{"comment":"Typo: 'discrete-time (DTDG) or continuous-time (DTDG)' should read 'continuous-time (CTDG)'.","section":"§2.1"},{"comment":"Typo: 'are are not generally satisfied.'","section":"§2.2"},{"comment":"'Area Under the Prevision Recall Curve' should be 'Precision–Recall'.","section":"§5.1 / Table 1"},{"comment":"The hyperparameter study for L uses L=2 on Wikipedia but L=20 on MOOC in the main results, with no explanation for the dataset-specific choice. Please state the selection rule (e.g., validation-based) and whether the selected L values are fixed across backbones.","section":"Appendix D, Table 6"},{"comment":"For synthetic datasets, the validation set contains 0.1% injected T-anomalies but test contains 0.05% of each type. It would be helpful to state explicitly whether any S-anomalies appear in the validation set, since the paper claims S-anomalies are 'unseen during training.'","section":"Appendix B.2"},{"comment":"The bound in Eq. (21) is stated as E_RR ≤ C_r log 2, but the derivation gives E_RR ≤ (C_r / log 2)(L_n + L_a). The constant/log-2 placement appears inconsistent; please fix the notation.","section":"Appendix E.2.2"}],"recommendation":"major_revision","confidential_remarks":"The S3 label-leakage issue is the most serious problem: it directly affects a headline claim, and a fix is not merely cosmetic. The error-bound appendix is also invalid and should be corrected or retracted. If the authors can rerun S3 with a label-free validation criterion (e.g., fixed checkpoints or unsupervised heuristics) and still show competitive performance, the paper would be a solid contribution to the DGAD literature. The scope is appropriate for the journal; the novelty of combining residual encoding + hypersphere restriction + flow boundary is reasonable."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know two things upfront. First, the core method is a reasonable and well-tested combination of existing ideas: residual representations, a two-hypersphere restriction loss, and a normalizing-flow boundary. Second, the headline claim of strong performance in the fully unsupervised (S3) setting is currently undermined by the experimental protocol: Appendix C says all models are selected by the checkpoint with best validation performance, and the validation splits contain labeled anomalies (Appendix B.2). That means labels are used for model selection, so S3 is not actually label-free. The near-perfect AUROC on synthetic data (Table 2) is consistent with this leak. The paper never states the validation metric or says labels were withheld during early stopping. This is the main thing to fix.\n\nWhat the paper does well: the residual encoding idea is simple and effective — subtracting the history-only embedding from the full embedding gives a direct anomaly signal, and the ablation shows it is the most important component. The two-hypersphere restriction is a sensible answer to the soap-bubble problem in Deep SVDD, and the bi-boundary loss is a clean way to get a margin in likelihood space. The empirical work is otherwise thorough: six datasets, three supervision settings, three encoder backbones, ablations, standard deviations over five runs. As a plug-in for CTDG encoders it is clearly useful for the subfield.\n\nSoft spots, in proportion: the S3 leak is serious because it directly threatens a central contribution. The proof in Appendix E.2.1 is invalid — Eq. 18 asserts Φθ'(x)^T Φθ'(x) = -1, which is impossible for a squared norm. The error-bound proposition is therefore unsupported; it should be removed or fixed. The circularity concern is real but weaker: the decision boundary is a percentile of the flow's outputs on a batch, and the model is trained to respect that same boundary, which creates a self-referential dependence. In low-label settings this could make the boundary unstable. Worth discussing, not fatal. Missing code and data also hurt reproducibility.\n\nWho should read it: anyone working on temporal or dynamic graph anomaly detection, especially if they want a model-agnostic detector. It deserves a serious referee — not a desk reject — but the referee should insist on a corrected or clarified S3 protocol, a fixed proof, and ideally code release before the claims are accepted.\n\nMy recommendation: send to peer review, conditional on those revisions.","headline":"A solid modular detector for dynamic-graph anomaly detection, but the 'fully unsupervised' claim is undercut by label-based early stopping, and the appendix proof has a real math error.","tokens_in":25117,"tokens_out":2212,"would_cite":false,"duration_ms":23375,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Detect dynamic-graph anomalies under label scarcity by learning the boundary from residual embedding shifts, not from the few labels.","keywords":["dynamic graph anomaly detection","limited supervision","residual representation","normalizing flow","decision boundary","continuous-time dynamic graph","hypersphere restriction","few-shot anomaly detection"],"falsifier":"Construct a benchmark where anomalies are deliberately camouflaged to keep embedding residuals small: e.g., precede each anomalous event with several normal filler interactions between the same node pair so the encoder's memory already incorporates the change. If SDGAD's AUROC and F1 fall to baseline levels while the residual norms of anomalies become indistinguishable from normal residuals, the residual representation is the bottleneck; if separation persists, the boundary objective is doing more than the residual encoding.","tokens_in":24258,"feed_emoji":"🔍","tokens_out":10796,"duration_ms":85302,"temperature":0.7,"pith_summary":"The paper claims that dynamic-graph anomaly detection under limited supervision fails not for lack of representation power but for lack of an explicit, discriminative decision boundary: unsupervised methods produce scores that collapse into a narrow ambiguous band, and semi-supervised methods skew the boundary toward the few anomaly patterns they have seen. The proposed framework, SDGAD, is a model-agnostic wrapper for continuous-time dynamic graph encoders. It represents each interaction by the residual change it causes in node embeddings (the encoding with the event minus the encoding without it), restricts normal residuals to a compact shell between two concentric hyperspheres, and then learns a two-sided margin between normal and anomalous log-likelihoods estimated by a normalizing flow. The paper reports that this yields well-separated, threshold-able anomaly scores and consistent improvements over diverse baselines in unsupervised, few-shot, and limited-supervision settings. A reader should care because the method is a drop-in module that addresses the practical operating condition of rare labels without sacrificing generalization to unseen anomaly types.","feed_headline":"Residual embeddings make dynamic-graph anomaly scores thresholdable","feed_subtitle":"Leverages a few labeled anomalies without overfitting: scores stay well-separated and threshold-able.","key_machinery":"The central object is the residual representation ΔE^i_t = Enc(S^i_t) − Enc(S^{i,t-}), the change in a node embedding caused by the current interaction, computed by encoding the event once with and once without the current interaction. It carries the anomaly-relevant signal: normal interactions barely move the embedding, anomalous ones shift it. The second mechanism is the two co-centered hypersphere restriction: residuals are projected and measured with the pseudo-Huber norm n(x) = sqrt(||x||^2 + 1) − 1, and normal samples are constrained to n(x) ∈ [r_min, r_max] with r_min = γ r_max, while labeled anomalies are pushed outside r' = r_max + Δr. The third is the bi-boundary optimization: a no","core_discovery":"Normal/unlabeled data alone can support a discriminative boundary if the representation is built at the right granularity. SDGAD represents each event by the residual ΔE = Enc(S) − Enc(S⁻), the change in a node's embedding caused by the current interaction. A restriction loss pulls these residuals into an interval bounded by two co-centered hyperspheres (r_min, r_max) so all normals share a consistent scale, while labeled anomalies are pushed outside r' = r_max + Δr. A normalizing flow models normal log-likelihood, and bi-boundary optimization enforces a margin between B_n and B_a = B_n − τ. The anomaly score is s(x) = 1 − exp(log p(x)); across six datasets and three supervision settings, th","pith_inferences":["The residual ΔE is effectively the first-order effect of the current event on the node embedding; this suggests SDGAD's sensitivity is bounded by how much an event can move an embedding, so harder anomalies (e.g., links between high-degree nodes with rich histories) could be where the advantage shrinks.","Because the decision boundary lives in likelihood space rather than in a label-conditioned classifier, the same pipeline could be adapted to anomaly type identification by training separate flows per type, though the paper only treats binary detection.","A natural stress test is to generate synthetic anomalies that interpolate between normal and anomalous residuals (e.g., by mixing historical patterns); the paper's own critique of trivial synthetic anomalies on low-repeat-rate datasets suggests such benchmarks are needed to separate representation quality from boundary learning.","The bi-boundary margin τ is a fixed hyperparameter, but the loss-sensitivity analysis shows the optimal weight of the boundary loss is dataset-dependent; an adaptive τ (tuned per validation set) might improve robustness further."],"forward_implications":["Integrated with any of three continuous-time dynamic graph encoders, the framework improves F1 and average precision on real-anomaly datasets while keeping AUROC high.","The framework degrades gracefully from limited supervision to few-shot (1, 2, or 3 labels) to fully unsupervised; on synthetic-anomaly benchmarks it keeps near-perfect AUROC even with no labels.","Ablations show the residual encoding is the most critical component: removing it causes the largest performance drop and larger variance, corroborating that the residual is the primary anomaly signal.","The two-hypersphere restriction and the bi-boundary margin mainly improve F1 and threshold stability rather than ranking metrics, indicating they reduce boundary ambiguity rather than re-rank anomalies.","The method generalizes to unseen anomaly types: training on only temporal synthetic anomalies while testing on structural anomalies yields stable high scores."],"fun_headline_variants":["Residual embeddings turn dynamic graphs into thresholdable anomaly scores","Bounded normals let few labels catch unseen dynamic-graph anomalies","Dynamic-graph anomaly scores stay separable with sparse labels","Residual encoding plus bi-boundary training generalizes anomaly detection"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The load-bearing premise is that anomalous interactions produce a statistically detectable shift in the node embedding residual ΔE; if an anomaly is subtle enough not to move the embedding (e.g., an odd link between nodes with long, consistent histories), the residual signal collapses and neither the hypersphere restriction nor the bi-boundary can recover it.","fun_headline_variants_meta":{"raw":{"variants":["Residual embeddings turn dynamic graphs into thresholdable anomaly scores","Bounded normals let few labels catch unseen dynamic-graph anomalies","Dynamic-graph anomaly scores stay separable with sparse labels","Residual encoding plus bi-boundary training generalizes anomaly detection"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000583,"raw_usage":{"total_tokens":2585,"prompt_tokens":754,"completion_tokens":1831,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":498,"completion_tokens_details":{"reasoning_tokens":1762}},"tokens_in":498,"tokens_out":1831,"duration_ms":14629,"temperature":1.0,"reasoning_tokens":1762,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-02T21:24:41.358666+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Construct a benchmark where anomalies are deliberately camouflaged to keep embedding residuals small: e.g., precede each anomalous event with several normal filler interactions between the same node pair so the encoder's memory already incorporates the change. If SDGAD's AUROC and F1 fall to baseline levels while the residual norms of anomalies become indistinguishable from normal residuals, the residual representation is the bottleneck; if separation persists, the boundary objective is doing more than the residual encoding.","supporting_citations":[],"review_version":1}