{"id":"3233bbc7-f781-4440-a111-0e95a0115de4","arxiv_id":"2608.12441","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"X-AddGraph explains AddGraph's edge anomaly scores with three architecture-aligned attribution components, preserves detection exactly, and its long-term attribution beats random snapshot selection on UCI Message.","lead":"This paper adds a post-hoc explanation system, X-AddGraph, to the AddGraph dynamic graph anomaly detector, using three attribution components aligned with the model's spatial, short-term, and long-term modules. It reports that detection accuracy is unchanged and that its long-term attribution picks out historically influential snapshots better than random choice.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The long-term temporal fidelity result in Table 3 is partly self-confirming: selecting by gradient norm and then measuring counterfactual divergence makes the 0.127 vs. 0.074 advantage partly an artifact of argmax selection.","rationale":"The reader's weakest assumption identifies exactly the circularity in the long-term temporal fidelity test: ranking snapshots by BPTT gradient norm and then measuring counterfactual divergence builds part of the advantage into the selection. My read agrees and sharpens the concern with a concrete falsifiable check: directly compute the actual counterfactual effect for every lag and compare with the gradient-norm argmax. This is the single most load-bearing weakness because the paper's distinct contribution over spatially-blind explainers rests on the long-term attribution result (Table 3). The preservation claim (Delta AUC = 0) is true by construction and is not at issue. The spatial fidelity results are also not affected. The concern is addressable and does not invalidate the framework; it only means the long-term explanatory value is not yet established. Therefore the conditional verdict stands: the paper should be accepted only if the temporal fidelity evaluation is strengthened, either by the proposed oracle comparison or by an alternative that avoids selecting on the evaluation metric. No change to the reader's conditional verdict is needed.","tokens_in":8279,"tokens_out":5131,"duration_ms":47525,"concrete_test":"For each explained edge in the four populations, compute for every lag k in {1,...,K} the actual counterfactual score change under the exact perturbation used in Section 5.3 (e.g., zeroing or replacing H_{t-w-k} and re-running the forward pass). Then check whether the lag selected by Eq. (5) equals the lag with the largest actual counterfactual change; report top-1 agreement and Spearman rank correlation across all edges, and report the selected lag's actual effect relative to the maximum actual effect. If agreement is near 1/K or the selected effect is substantially below the max, the Table 3 advantage is an artifact of selection on a local sensitivity proxy.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central empirical claim for the long-term component is that the identified historical snapshot carries more counterfactual signal than a random one (Table 3: 0.127 vs. 0.074). The selection criterion in Eq. (5) is the Frobenius norm of the BPTT gradient, a local sensitivity measure. The evaluation in Section 5.3 then measures the counterfactual score divergence of the selected snapshot against a random one. Since, to first order, any perturbation of the hidden state produces a score change proportional to that same gradient norm, choosing the argmax and then measuring the effect is partially circular: the advantage partly reflects that an argmax exceeds a random draw, not that the identified snapshot is the true causal driver. The paper's own Section 7.3 concedes the metrics are only counterfactual proxies, not ground-truth causal evaluation. Without a check against the actual per-lag counterfactual effects, the headline long-term attribution result is not independently supported.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript presents X-AddGraph, a post-hoc explainability framework for the AddGraph dynamic graph anomaly detector. The framework decomposes an explanation for a flagged edge into three components aligned with AddGraph's modules: a gradient-based spatial attribution over the current adjacency, a direct reading of the contextual attention weights for short-term temporal attribution, and a backpropagation-through-time gradient rollback through the GRU hidden states for long-term temporal attribution. The central claims are that X-AddGraph is the first post-hoc explainer for AddGraph and the GCN+GRU paradigm, that it preserves detection performance exactly because the detector is frozen, and that the long-term attribution identifies historical snapshots carrying more counterfactual signal than random selection (0.127 vs. 0.074). The evaluation is conducted on the UCI Message benchmark with four edge populations, comparing against a flat-gradient baseline, and includes a qualitative walkthrough and a public code release.","tokens_in":8437,"tokens_out":5418,"duration_ms":47545,"significance":"If the claims hold, the paper makes a useful engineering contribution: it offers a way to explain a deployed AddGraph detector without retraining or modification, including a zero-cost short-term temporal signal and a long-term temporal capability that spatially-blind explainers cannot provide. The code release and the explicit architectural alignment are strengths, and the post-hoc property is genuinely valuable for operational deployment. However, the headline long-term attribution result is supported by a partly self-confirming evaluation, so the current evidence does not yet establish that the identified historical snapshot is the true causal driver. With additional controls and more careful statistical reporting, the framework could be a solid contribution to the explainability literature for dynamic graph anomaly detection.","major_comments":[{"comment":"The long-term temporal fidelity test is partly self-confirming. The selection rule in Eq. (5) ranks lags by the Frobenius norm of the BPTT gradient, and the evaluation in Section 5.3 then measures counterfactual score divergence at the argmax lag versus a random lag. To first order, any perturbation of the hidden state changes the score by an amount proportional to that same gradient norm, so the selected lag will mechanically show a larger divergence than a random lag even if the gradient ranking carries no causal information. Please add a control that removes this selection bias, for example a rank correlation between gradient norms and counterfactual divergences over all K lags, a comparison against the second-best lag, or a comparison against the maximum over a random set of lags. Without such a control, the headline advantage 0.127 vs. 0.074 is not evidence of explanatory faithfulness beyond the already-known fact that large local gradients produce larger local effects.","section":"Section 5.3 / Table 3 / Eq. (5)"},{"comment":"The paper promises mean±standard deviation over two seeds in Section 5.2, but Table 3 reports only means labeled 'mean over seeds' with no standard deviations and no significance test, and each edge population contains only 10 edges. The 0.127 vs. 0.074 difference, and especially the confident-TP comparison 0.332 vs. 0.125, should be accompanied by standard deviations and a paired significance test across edges or seeds. As reported, the '73% relative advantage' is not statistically grounded.","section":"Section 5.2 / Table 3"},{"comment":"The counterfactual operation used in the long-term temporal test is not defined precisely enough for reproducibility. The text says that the divergence between the counterfactual score at the identified lag and at a random lag is measured, but it does not state how the hidden state at a lag is perturbed, how many random lags are sampled per edge, or whether the same random lag is reused across seeds. Please specify the exact protocol, including the perturbation construction and the random-lag sampling procedure.","section":"Section 5.3"},{"comment":"Section 7.3 concedes that the fidelity metrics are only counterfactual proxies and that ground-truth causal benchmarks do not yet exist for this task. Given that concession, the results section, particularly the 'decisive comparison' language in Section 6.3, should be reworded to present the long-term result as a proxy comparison with known selection bias rather than as identification of the true historical cause. This is not a request to remove the experiment, but to align the claims with the acknowledged evidential status.","section":"Section 7.3 / Section 6.3"}],"minor_comments":[{"comment":"The statement that Delta AUC = 0 is 'verified empirically to ten decimal places' is presented as an empirical result, but because the detector is frozen by construction, the equality holds a priori; the verification is a sanity check of the implementation, and the claim should be phrased accordingly.","section":"Section 6.1 / Table 1"},{"comment":"The generalization claims to StrGNN and EvolveGCN are not tested in the paper and should be framed as hypotheses or future work rather than as established properties of DSTA.","section":"Section 7.2"},{"comment":"The evaluation uses a single benchmark dataset; while Section 7.3 acknowledges this, the discussion in Sections 6 and 7.2 should consistently avoid language that implies general effectiveness across datasets.","section":"Section 5.2 / Section 6"},{"comment":"Fidelity+ values slightly above 1 are interpreted as evidence that removed edges were suppressing the anomaly signal, but no analysis is given to distinguish this from numerical noise; a sentence describing the typical magnitude of numerical error would strengthen this interpretation.","section":"Table 2"},{"comment":"The notation in Eq. (1) uses r and Q without defining their dimensions; please define all variables used in the attention formula.","section":"Eq. (1)"}],"recommendation":"major_revision","confidential_remarks":"For the editor: I see the contribution as a solid engineering contribution with a genuinely useful deployment property, but the current evaluation of the long-term component is not yet convincing because of the selection-bias issue in the temporal fidelity test. I believe this is fixable with additional control experiments and a more cautious interpretation, so I recommend major revision rather than rejection. The authors' limitation section is transparent, and the code release is a positive feature. I have no concerns about author conduct or citation fairness."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague — this one is worth a look if you care about explainability for dynamic graph detectors, but the headline temporal result needs a grain of salt.\n\nWhat's genuinely new: X-AddGraph is, as far as I can tell, the first post-hoc explainability framework for AddGraph, the 2019 GCN+GRU model that still defines a lot of the edge-level anomaly detection space. The design is clean: one attribution component per architectural module—input-weighted gradients for the spatial GAT, a direct read of the CAB attention weights for the short-term window (free, since the weights are already computed), and BPTT gradient rollback for the long-term hidden state. The decomposition is natural, and the paper gives a plausible argument for why a generic static explainer would miss the temporal components. They also release code, which is good.\n\nThe strictly post-hoc guarantee is true by construction: the detector is frozen, so performance is preserved. The 'Delta AUC = 0 verified to ten decimal places' is a bit of theater, but harmless. On the UCI Message benchmark, their trained AddGraph reaches 0.8705 AUC, which is better than the original 0.8083—that's a useful datapoint.\n\nNow the soft spot. The central empirical claim for long-term attribution is that the identified historical snapshot carries more counterfactual signal than a random one (0.127 vs. 0.074, Table 3). The problem is that the selection criterion in Eq. (5) is the Frobenius norm of the BPTT gradient—a local sensitivity measure—and the evaluation then measures the counterfactual score divergence of that same chosen snapshot against a random pick. That's partly circular: to first order, a perturbation's effect scales with exactly that gradient norm, so an argmax will beat a random draw even if the snapshot isn't the true causal driver. The authors themselves concede in Section 7.3 that the fidelity metrics are only counterfactual proxies. To make the result convincing, they'd need to compare against per-lag counterfactual effects across all lags, or at least report the full distribution. Also, the evaluation is thin: a single dataset, ten edges per population, two seeds, and no variance reported in Table 3. The AUC mismatch between Table 1 (0.8705) and Section 6.1 (0.8491) is explained but looks sloppy at first glance.\n\nThat said, the method itself is sound as a post-hoc explanation toolbox. The qualitative walkthrough gives some independent plausibility, and the limitations are honestly stated. This is a conditional accept—the long-term attribution result needs a sharper test, but the rest of the framework stands.\n\nWho benefits: anyone working on explainability for temporal graphs, or deploying AddGraph-family models in regulated settings. It's not a landmark, but it's a legitimate contribution. A serious referee should engage with it, provided they push on the circularity issue.\n\nRecommendation: send to peer review; expect a revision that either fixes the temporal validation or softens the claim.","headline":"A clean, architecture-aligned post-hoc explainer for AddGraph with a true-by-construction preservation guarantee, but the headline long-term attribution result is partly self-confirming and needs a sharper test.","tokens_in":8980,"tokens_out":2342,"would_cite":false,"duration_ms":18883,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"X-AddGraph gives AddGraph's anomaly alarms a three-part post-hoc explanation while preserving every detection score exactly.","keywords":["dynamic graph anomaly detection","post-hoc explainability","dual spatial-temporal attribution","gradient attribution","backpropagation through time","graph attention network","recurrent graph neural networks","AddGraph"],"falsifier":"Inject anomalies into a synthetic dynamic graph with known causal lag, such as an edge that becomes anomalous because of a specific snapshot five steps earlier, then compare the lag picked by maximizing Eq. (5) with the true lag across many trials; if the match rate does not exceed random, the long-term explanation is not causally faithful.","tokens_in":8055,"feed_emoji":"🔍","tokens_out":5624,"duration_ms":46301,"temperature":0.7,"pith_summary":"This paper claims that AddGraph, a widely used GCN+GRU anomaly detector for dynamic graphs, can be explained after the fact without any change to its behavior. The authors build X-AddGraph, whose Dual Spatial-Temporal Attribution (DSTA) mechanism produces, for each flagged edge, a spatial explanation (which neighboring nodes drove the score), a short-term temporal explanation (which recent snapshot within the attention window mattered), and a long-term temporal explanation (which historical snapshot before the window contributed through the recurrent memory). They report that the detector's AUC is preserved exactly (ΔAUC = 0 to ten decimal places) and that the long-term attribution picks historical snapshots whose removal changes the score substantially more than a random snapshot (0.127 vs. 0.074 counterfactual divergence). If correct, this gives deployment environments a way to audit alarm decisions without retraining or altering an already validated detector.","feed_headline":"Explaining graph anomaly alarms without touching detection scores","feed_subtitle":"Architecture-aligned attribution answers which neighbors, which recent step, and which past snapshot caused each alarm.","key_machinery":"The Dual Spatial-Temporal Attribution (DSTA) mechanism is the framework's core object: for each flagged edge it outputs the triplet (top-k neighbor set N*, most suspicious window step s*, most responsible pre-window lag k*), read as the structural, short-term, and long-term causes. It is carried by three aligned attribution formulas: Eq. (3), an input-weighted gradient $\\phi^\\mathrm{sp}_{uv} = |A^t_{uv} \\cdot \\partial f/\\partial A^t_{uv}|$ for the spatial part; Eq. (4), the endpoint-averaged CAB attention $\\phi^\\mathrm{sh}_s = \\tfrac{1}{2}(a^{t*}_{i*}[s] + a^{t*}_{j*}[s])$ for the short-term part; and Eq. (5), the normalized Frobenius norm of the BPTT gradient $\\phi^\\mathrm{lo}_k = g_k / \\sum_{k'} g_{k'}$ with $g_k = \\|\\partial f/\\partial H^{t*-\\omega-k}\\|_F$ for the long-term part. The key machinery is the coupling of these three formulas to the frozen detector's own computation: no retraining, no modified weights, and the short-term component is literally read from the cached attention distribution.","core_discovery":"The central claim is that X-AddGraph is the first post-hoc explainability framework for AddGraph and the GCN+GRU paradigm, and that it achieves exact preservation of detection behavior while adding explanations that no spatially-blind method can provide. Each of its three attribution components is aligned with one architectural module: a gradient-times-input relevance map over the current adjacency for the spatial module, a direct reading of the contextual attention weights already computed during inference for the short-term module (at zero extra cost), and a backpropagation-through-time gradient rollback through the GRU hidden states for the long-term module. The paper argues this decomposition is necessary because AddGraph's score couples a graph attention convolution, a contextual attention block, and a GRU in a single pipeline. The empirical support is the exact score reproduction and the counterfactual temporal tests: the identified historical lag carries a mean counterfactual divergence of 0.127 versus 0.074 for a random lag, and confident true positives show 0.332 versus 0.125.","pith_inferences":["A natural extension the paper leaves implicit is that the same architecture-aligned recipe, matching each attribution component to one module and exploiting cached endogenous signals, should apply to other recurrent graph architectures whose scoring fuses structural and temporal streams; a testable prediction is that any detector exposing an attention-like distribution will admit a near-free and f","The temporal fidelity test could be sharpened into a direct causal benchmark: if datasets with annotated culprit snapshots existed, one could compare the identified lag against ground truth rather than against random selection; the paper itself notes such benchmarks do not yet exist, and synthetic dynamic graphs with injected anomalies of known lag would supply one.","From the reported per-population numbers, a reasonable inference is that confident true positives concentrate their historical signal strongly (0.332 versus 0.125), so in practice the long-term explanation is most useful for high-scoring alarms, while near-threshold and false-positive alarms have more distributed temporal causes; one could test whether thresholding explanations by alarm confidence","The sparsity pattern, rising from 0.000 for confident true positives to 0.750 for random edges, suggests that confidently flagged anomalies are structurally isolated and their entire local neighborhood is explanation-relevant; this could be turned into a confidence heuristic that flags maximally non-sparse explanations as probable alarms even before consulting the detector score."],"forward_implications":["Deployed AddGraph detectors can be retrofitted with explanations at zero behavioral risk: every anomaly score and every alarm is identical before and after explanation, since the explainer never modifies the frozen model.","Analysts get a concrete answer to three questions per alarm: which neighbors, which recent step, and which historical snapshot drove the score, enabling audit and triage of individual flags.","The long-term component fills a gap that static explainers cannot fill: they have no mechanism for ranking historical snapshots, so on temporal questions they are reduced to random selection (0.074), while the rollback reaches 0.127 counterfactual divergence.","The architecture-aligned design transfers to the wider GCN+GRU family: any model whose convolution consumes the previous hidden state admits the same spatial and long-term components, and any model exposing an internal attention distribution can reuse the short-term reading.","The zero-cost short-term component shows that faithful explanations can be free when a model already computes a normalized attention distribution during inference."],"supporting_citations":[{"why":"Supplies the AddGraph architecture, the original detection formulation, and the benchmark protocol whose published AUC (0.8083) the paper's baseline exceeds.","marker":"[1]"},{"why":"Provides the message-exchange dataset used for all training and evaluation, including its edge stream and snapshot construction.","marker":"[14]"},{"why":"Establishes the relevance backpropagation rules for GCN-to-GRU pipelines that the spatial component aligns with, while leaving the interposed softmax attention unexplained, which motivates the new CAB component.","marker":"[10]"},{"why":"Represents the intrinsic, self-explainable approach that requires retraining, serving as the contrast that motivates the strictly post-hoc design.","marker":"[12]"},{"why":"Shares the same GCN+GRU backbone at the subgraph level, supporting the paper's claim that the spatial and long-term components transfer directly.","marker":"[2]"},{"why":"An instance of the GCN+GRU family with recurrent weight evolution, used to argue that the gradient rollback component generalizes beyond the specific AddGraph wiring.","marker":"[3]"}],"fun_headline_variants":["Post-hoc graph anomaly explanations with zero detection cost","First explainer for AddGraph: spatial and temporal attributions","Explain graph alerts exactly: no score change, full reasons","Zero-cost explanations for GCN+GRU anomaly detectors","Why this edge? New post-hoc attributions for dynamic graphs"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that counterfactual score divergence is a faithful measure of how much a historical snapshot actually caused the anomaly score; since the long-term component selects snapshots by gradient magnitude and then evaluates them by score divergence, the test could partly reward the selection criterion rather than reveal true causal influence.","fun_headline_variants_meta":{"raw":{"variants":["Post-hoc graph anomaly explanations with zero detection cost","First explainer for AddGraph: spatial and temporal attributions","Explain graph alerts exactly: no score change, full reasons","Zero-cost explanations for GCN+GRU anomaly detectors","Why this edge? New post-hoc attributions for dynamic graphs"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000829,"raw_usage":{"total_tokens":3684,"prompt_tokens":1069,"completion_tokens":2615,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":685,"completion_tokens_details":{"reasoning_tokens":2534}},"tokens_in":685,"tokens_out":2615,"duration_ms":17668,"temperature":1.0,"reasoning_tokens":2534,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T00:12:41.375000+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Inject anomalies into a synthetic dynamic graph with known causal lag, such as an edge that becomes anomalous because of a specific snapshot five steps earlier, then compare the lag picked by maximizing Eq. (5) with the true lag across many trials; if the match rate does not exceed random, the long-term explanation is not causally faithful.","supporting_citations":[{"cited_title":"In: Proc","cited_arxiv_id":null,"evidence_quote":"Supplies the AddGraph architecture, the original detection formulation, and the benchmark protocol whose published AUC (0.8083) the paper's baseline exceeds."},{"cited_title":"Social Networks31(2), 155–163 (2009)","cited_arxiv_id":null,"evidence_quote":"Provides the message-exchange dataset used for all training and evaluation, including its edge stream and snapshot construction."},{"cited_title":"In: Proc","cited_arxiv_id":null,"evidence_quote":"Establishes the relevance backpropagation rules for GCN-to-GRU pipelines that the spatial component aligns with, while leaving the interposed softmax attention unexplained, which motivates the new CAB component."},{"cited_title":"3747–3756 (2021)","cited_arxiv_id":null,"evidence_quote":"Shares the same GCN+GRU backbone at the subgraph level, supporting the paper's claim that the spatial and long-term components transfer directly."},{"cited_title":"In: Proc","cited_arxiv_id":null,"evidence_quote":"An instance of the GCN+GRU family with recurrent weight evolution, used to argue that the gradient rollback component generalizes beyond the specific AddGraph wiring."}],"review_version":1}