# AnomalyGFM: Graph Foundation Model for Zero/Few-shot Anomaly Detection

arXiv: https://arxiv.org/abs/2502.09254 · HTML: https://mlsanity.com/paper/2502.09254/

## Key facts

- Cited by 23 papers in the map (data through 14 Oct 2026).
- Builds on 9 of its 14 references that are in the map.
- First posted on arXiv 13 Feb 2025.

## Builds on (most cited first, 9 of 9)

- [Predicting Dynamic Embedding Trajectory in Temporal Interaction Networks](https://mlsanity.com/paper/1908.01207/) (2019)
- [Enhancing Graph Neural Network-based Fraud Detectors against Camouflaged Fraudsters](https://mlsanity.com/paper/2008.08692/) (2020)
- [Graph-based Anomaly Detection and Description: A Survey](https://mlsanity.com/paper/1404.4679/) (2014)
- [GraphPrompt: Unifying Pre-Training and Downstream Tasks for Graph Neural Networks](https://mlsanity.com/paper/2302.08043/) (2023)
- [All in One: Multi-task Prompting for Graph Neural Networks](https://mlsanity.com/paper/2307.01504/) (2023)
- [All in One and One for All: A Simple yet Effective Method towards Cross-domain Graph Pretraining](https://mlsanity.com/paper/2402.09834/) (2024)
- [ZeroG: Investigating Cross-dataset Zero-shot Transferability in Graphs](https://mlsanity.com/paper/2402.11235/) (2024)
- [GADBench: Revisiting and Benchmarking Supervised Graph Anomaly Detection](https://mlsanity.com/paper/2306.12251/) (2023)
- [Voucher Abuse Detection with Prompt-based Fine-tuning on Graph Neural Networks](https://mlsanity.com/paper/2308.10028/) (2023)

## Built on by (most cited first, 23 of 23)

- [A Survey of Generalization of Graph Anomaly Detection: From Transfer Learning to Foundation Models](https://mlsanity.com/paper/2509.06609/) (2025)
- [Tabular Foundation Models are Strong Graph Anomaly Detectors](https://mlsanity.com/paper/2601.17301/) (2026)
- [From Zero to Hero: Advancing Zero-Shot Foundation Models for Tabular Outlier Detection](https://mlsanity.com/paper/2602.03018/) (2026)
- [From Few-Shot to Zero-Shot: Towards Generalist Graph Anomaly Detection](https://mlsanity.com/paper/2602.18793/) (2026)
- [Towards One-for-All Anomaly Detection for Tabular Data](https://mlsanity.com/paper/2603.14407/) (2026)
- [DP-DGAD: A Generalist Dynamic Graph Anomaly Detector with Dynamic Prototypes](https://mlsanity.com/paper/2508.00664/) (2025)
- [OWLEYE: Zero-Shot Learner for Cross-Domain Graph Data Anomaly Detection](https://mlsanity.com/paper/2601.19102/) (2026)
- [Designing a reliable lateral movement detector using a graph foundation model](https://mlsanity.com/paper/2504.13527/) (2025)
- [Generalist Graph Anomaly Detection via Prototype-Based Distillation](https://mlsanity.com/paper/2605.26857/) (2026)
- [Temporal Motif-aware Graph Test-time Adaptation for OOD Blockchain Anomaly Detection](https://mlsanity.com/paper/2605.29526/) (2026)
- [PromptDyG: Test-Time Prompt Adaptation on Dynamic Graphs](https://mlsanity.com/paper/2606.22914/) (2026)
- [Towards Anomaly-Aware Pre-Training and Fine-Tuning for Graph Anomaly Detection](https://mlsanity.com/paper/2504.14250/) (2025)
- [Context-Based Fake News Detection using Graph Based Approach: ACOVID-19 Use-case](https://mlsanity.com/paper/2507.13382/) (2025)
- [GFM4GA: Graph Foundation Model for Group Anomaly Detection](https://mlsanity.com/paper/2601.10193/) (2026)
- [Zero-shot Generalizable Graph Anomaly Detection with Mixture of Riemannian Experts](https://mlsanity.com/paper/2602.06859/) (2026)
- [Evolutionary Router Feature Generation for Zero-Shot Graph Anomaly Detection with Mixture-of-Experts](https://mlsanity.com/paper/2602.11622/) (2026)
- [TA-GGAD: Testing-time Adaptive Graph Model for Generalist Graph Anomaly Detection](https://mlsanity.com/paper/2603.09349/) (2026)
- [When Normality Shifts: Risk-Aware Test-Time Adaptation for Unsupervised Tabular Anomaly Detection](https://mlsanity.com/paper/2605.10242/) (2026)
- [NeighborDiv: Training-free Zero-shot Generalist Graph Anomaly Detection via Neighbor Diversity](https://mlsanity.com/paper/2605.20879/) (2026)
- [Online Test-Time Adaptation for Generalizable Dynamic Graph Anomaly Detection](https://mlsanity.com/paper/2608.19858/) (2026)
- [GLASS: Graph-Language Alignment with Spherical Scoring for Transferable Graph-Level Anomaly Detection](https://mlsanity.com/paper/2609.05253/) (2026)
- [FoundAna: A GNN-assisted Foundation Model for Graph Anomaly Detection](https://mlsanity.com/paper/2609.18107/) (2026)
- [Feature-Context Consistency: Unsupervised Adversarial Detection with Drift Stability on Attributed Graphs](https://mlsanity.com/paper/2610.16694/) (2026)

## Abstract (arXiv)

Graph anomaly detection (GAD) aims to identify abnormal nodes that differ from the majority of the nodes in a graph, which has been attracting significant attention in recent years. Existing generalist graph models have achieved remarkable success in different graph tasks but struggle to generalize to the GAD task. This limitation arises from their difficulty in learning generalized knowledge for capturing the inherently infrequent, irregular and heterogeneous abnormality patterns in graphs from different domains. To address this challenge, we propose AnomalyGFM, a GAD-oriented graph foundation model that supports zero-shot inference and few-shot prompt tuning for GAD in diverse graph datasets. One key insight is that graph-agnostic representations for normal and abnormal classes are required to support effective zero/few-shot GAD across different graphs. Motivated by this, AnomalyGFM is pre-trained to align data-independent, learnable normal and abnormal class prototypes with node representation residuals (i.e., representation deviation of a node from its neighbors). The residual features essentially project the node information into a unified feature space where we can effectively measure the abnormality of nodes from different graphs in a consistent way. This provides a driving force for the learning of graph-agnostic, discriminative prototypes for the normal and abnormal classes, which can be used to enable zero-shot GAD on new graphs, including very large-scale graphs. If there are few-shot labeled normal nodes available in the new graphs, AnomalyGFM can further support prompt tuning to leverage these nodes for better adaptation. Comprehensive experiments on 11 widely-used GAD datasets with real anomalies, demonstrate that AnomalyGFM significantly outperforms state-of-the-art competing methods under both zero- and few-shot GAD settings.