RINSE: Robust Target-Time Normality Estimation for Zero-Shot Graph Anomaly Detection

RINSE: Robust Target-Time Normality Estimation for Zero-Shot Graph Anomaly Detection Taufikur Rahman Fuad1 , Md Abrar Jahin2 , Amir Hussain3 1

Islamic University of Technology University of Southern California 3 King Fahd University of Petroleum & Minerals taufikur@iut-dhaka.edu, jahin@usc.edu, amir.hussain@kfupm.edu.sa

arXiv:2609.02497v1 [cs.LG] 2 Sep 2026

2

Abstract Zero-shot graph anomaly detection seeks to deploy a detector trained on source graphs to unseen, unlabeled targets, yet domain shift can make source-derived notions of normality unreliable. We introduce RINSE (Robust Iterative Normality SelfEstimation), a gradient-free target-time framework that keeps the source-trained detector fixed while sequentially estimating target normality, representation calibration, and evidence reliability from the target graph. Its core idea is to identify a reliable subset of low-residual target nodes, use them to construct a trimmed target-aware normality model, and combine complementary anomaly evidence through reliability-gated rank fusion and encoder ensembling. Across eight unseen target graphs, RINSE achieves the highest average AUPRC among the evaluated methods under two separate preprocessing protocols, while block ablations and sensitivity analyses support the combined design. These results support robust target-time estimation as a practical approach to generalist graph anomaly detection without target labels, gradients, or per-target tuning.

1

Introduction

Graph anomaly detection (GAD) identifies nodes in graphs whose attributes or connectivity deviate from normality. It supports fraud detection in financial and e-commerce networks, spam and bot detection on social platforms, and review manipulation detection (Ding et al. 2019; Tang et al. 2022; Gao et al. 2023). Because anomalies are less frequent and node-level labels are costly, the paradigm is often unsupervised, with a detector trained on each scored graph (Qiao et al. 2025b). Reconstruction methods flag nodes reconstructed poorly by graph autoencoders (Ding et al. 2019; He et al. 2024); contrastive methods detect nodes inconsistent with sampled contextual views (Liu et al. 2022; Zheng et al. 2023); and affinity methods score disagreement with local neighborhoods (Qiao and Pang 2023; Zheng et al. 2025). Per-graph training incur structural costs. Each graph requires a separate training run, yet hyperparameters and stopping criteria cannot be validated without labels; label-free model selection remains an open problem (Zhao, Rossi, and Akoglu 2021; Goswami et al. 2023; Ma et al. 2023). Unsupervised objectives are also optimized on contaminated data, allowing autoencoders to absorb the anomalies they aim to detect (He et al. 2024; Kim et al. 2024). Generalist GAD reduces these costs by training one model on labeled source

graphs and applying it to unseen targets (Liu et al. 2024; Pan et al. 2025). In the zero-shot setting, the model ranks nodes in unseen target graphs without labels, fine-tuning, or targetspecific configuration (Niu et al. 2025; Qiao et al. 2025a; Zhang et al. 2025a; Zheng et al. 2026). This is the setting we study. Zero-shot generalists encode anomaly criteria during source training as neighborhood prompts, graph-agnostic prototypes, or normal-pattern dictionaries, then apply them to unlabeled targets (Niu et al. 2025; Qiao et al. 2025a; Zheng et al. 2026). ARC uses labeled normal context at inference (Liu et al. 2024), while ARCzero extends this direction by selecting pseudo-normal target context for label-free inference (Liu et al. 2026). RINSE jointly estimates a trimmed target-normality dictionary, embedding calibration, and evidence reliability around a frozen detector. Test-time adaptation offers a related route. Existing approaches optimize entropy, self-supervised objectives, graph transformations, or graph-level aligners using unlabeled test data (Wang et al. 2021; Sun et al. 2020; Jin et al. 2023; Pan et al. 2026). RINSE instead follows a gradient-free route: it estimates target normality from low-residual nodes and excludes high-residual candidates from subsequent calibration and dictionary updates. This connects zero-shot GAD with robust estimation under contaminated target data (Diakonikolas et al. 2024; Wang and Tan 2023; Diakonikolas et al. 2025). We ask whether a frozen zero-shot detector can estimate target normality, embedding scale, and evidence reliability from a contaminated, unlabeled target graph, without gradients or per-target tuning. We hypothesize that a robust, gradient-free estimator can estimate these quantities while limiting the influence of suspected anomalies. We present RINSE (Robust Iterative Normality Self-Estimation), a testtime framework for a frozen truncated-attention detector. RINSE iteratively builds a target normality dictionary from low-residual nodes, calibrates embeddings to its statistics, and gates complementary evidence views by their agreement at the anchor ranking’s extremes. Rank averaging across independently initialized encoders improves mean AUPRC under the evaluated protocol. Our contributions are: (i) We cast zero-shot GAD around a frozen reconstruction scorer as contamination-controlled target-time normality estimation and develop a residual-

trimmed iterative estimator without target labels or targettime gradients. (ii) We combine two-pass dictionary-statistics calibration with a label-free reliability gate over complementary reconstruction-based, distance-based, and affinity-based views, followed by rank-based encoder ensembling. (iii) We evaluate one shared configuration across eight unseen target graphs under both the standard and source-referenced preprocessing protocols, block ablations under both protocols, sensitivity analysis, and estimator diagnostics.

2

Related Work

Graph Anomaly Detection. Most deep GAD methods train a detector on the graph it scores (Qiao et al. 2025b). Reconstruction methods flag poorly reconstructed nodes (Ding et al. 2019; He et al. 2024); contrastive methods compare nodes with sampled contexts (Liu et al. 2022; Zheng et al. 2023); affinity methods model neighborhood agreement (Qiao and Pang 2023; Zheng et al. 2025); and supervised spectral methods capture the high-frequency patterns of anomalies (Tang et al. 2022; Gao et al. 2023). This targetspecific paradigm requires label-free hyperparameter and stopping selection (Zhao, Rossi, and Akoglu 2021; Goswami et al. 2023; Ma et al. 2023) and learns from contaminated graphs, exposing reconstruction models to anomaly overfitting (He et al. 2024) and affinity models to violations of one-class homophily (Qiao and Pang 2023; Tang et al. 2022; Gao et al. 2023). RINSE performs no target training: it treats contamination as a test-time estimation problem and limits suspected anomalies’ influence on normality estimation. Generalist and Zero-Shot Cross-Domain GAD. Earlier cross-domain GAD methods adapt source knowledge to a given target through adversarial (Ding et al. 2022) or anomaly-aware contrastive alignment (Wang et al. 2023), with later transfer-based variants (Huang et al. 2025). They access the target graph during training and learn a separate model for each target. Broader graph-transfer methods use language-encoded attributes (Li et al. 2024; Wang et al. 2025) or few-shot prompt learning (Yu et al. 2024; Fu et al. 2025), and thus address different input or supervision settings. ARC established the generalist GAD setting by training once on labeled source graphs and scoring unseen targets without retraining, using a few labeled normal nodes at inference (Liu et al. 2024). ARCzero later enables label-free inference by selecting representative pseudo-normal target context (Liu et al. 2026). Other zero-shot methods learn neighborhood prompts (Niu et al. 2025), align graph-agnostic prototypes with residual features (Qiao et al. 2025a), combine invariant representations with affinity learning (Zhang et al. 2025a), or reconstruct target nodes through truncated attention over a source-trained normality dictionary (Zheng et al. 2026). RINSE differs by jointly estimating target normality, embedding calibration, and evidence reliability through a gradient-free procedure around a fixed source-trained scorer. Test-Time Adaptation and Unsupervised Model Selection. Test-time adaptation updates deployed systems using unlabeled test data. Test-time training optimizes selfsupervised losses (Sun et al. 2020; Liu et al. 2021), Tent

minimizes prediction entropy through normalization parameters (Wang et al. 2021), and GTrans adapts target features and graph structure (Jin et al. 2023). TUNE adapts pretrained graph anomaly detectors to unseen normal patterns by optimizing a graph-level aligner (Pan et al. 2026). Recent backpropagation-free approaches align target subspaces or feature statistics (Wang et al. 2024; Dong et al. 2025; Zhang et al. 2025b) or select informative tokens (Yazdanpanah et al. 2025). RINSE requires no target-time optimization and instead performs forward-only estimation for contaminated one-class ranking. Label-free model selection uses meta-learning (Zhao, Rossi, and Akoglu 2021), surrogate metrics (Goswami et al. 2023), or internal evaluation criteria (Ma et al. 2023), while uncertainty-aware view rejection has been studied for supervised multi-view classification (Liu, Chen, and Yue 2025). RINSE separates these roles: held-out source validation selects the checkpoint, while the unlabeled target graph determines view reliability at inference.

3

Preliminaries

Let G = (V, E, X) be an attributed graph with N = |V| nodes, adjacency matrix A ∈ {0, 1}N ×N , and attributes X ∈ RN ×dG . Each node P has a latent label yv ∈ {0, 1} (1 = anomalous), with v yv ≪ N . In zero-shot generalist graph anomaly detection (Liu et al. 2024; Niu et al. 2025), a model is trained once on labeled source graphs Dsrc = {G(1) , . . . , G(M ) } and applied to unlabeled target graphs from unseen domains. For each target, it produces scores s : V → R that rank anomalous nodes above normal ones, without target labels, fine-tuning, or target-specific configuration. Because feature spaces differ across domains, each graph is projected to a shared dimension d using PCA, preceded by Gaussian random projection when dG < d, and rescaled by distance-based normalization following (Liu et al. 2024; Zheng et al. 2026). We denote the processed attributes and normalized adjacency by X̃ and Ã.

4

Methodology

RINSE performs robust target-time estimation around a frozen detector. For each ensemble member e, it encodes the target graph with gθe , calibrates target and source-bank embeddings in two passes using provisional low-residual normals, iteratively augments the source bank with trimmed target normals to obtain an anchor score and admitted set, computes three complementary evidence views, and fuses their rank-normalized scores with label-free reliability weights. The final prediction averages score ranks across E independently initialized members. All target-time steps use only the unlabeled target graph, require no gradients, and share one configuration across targets. Figure 1 shows the pipeline, and Algorithm 1 summarizes inference.

4.1

Frozen Truncated-Attention Scorer

RINSE uses a source-trained scorer without target-time updates. A shared MLP gθ encodes propagated attributes, Z[l] = gθ (Ãl X̃), and forms   Z = Z[1] − Z[0] ∥ · · · ∥ Z[L] − Z[0] ∈ RN ×Lh . (1)

Figure 1: Overview of RINSE. For each ensemble member, the encoder gθe , attention projections Wq , Wk , and source bank Be are learned or constructed from source graphs and then frozen. All target-time components operate independently on the unlabeled target graph, without labels, gradients, or per-target tuning. The blue dashed path supplies provisional normals S0 to the second calibration pass; red dashed nodes denote suspected anomalies ranked highest at output. Given a normality dictionary P = [p1 ; . . . ; pm ], let √ qv = σ(Wq zv ), kj = σ(Wk pj ), and evj = ⟨qv , kj ⟩/ Lh, where σ is LeakyReLU. After masking the smallest ⌊ηm⌋ logits, X ẑv = αvj pj , αvj = softmaxj (evj /γ), (2) j

The final anchor is a(v) = r(T ) (v); its admitted set S = arg bottomρN a defines the target-aware dictionary D = [B ∥ ZS ]. Thus, ρ trims the highest-residual 1 − ρ fraction from each update. The admitted sets remain approximately 97–99% normal across targets and rounds.

4.3

Two-Pass Dictionary-Statistics Calibration

and the reconstruction residual is r(v; P) = ∥zv − ẑv ∥2 .

(3)

A query’s own dictionary entry is masked when present. RINSE freezes this scorer and estimates its target-time dictionary, calibration, and evidence weights.

4.2

Robust Iterative Normality Self-Estimation

For one ensemble member, let B be its frozen source bank, with the member index suppressed. To adapt source normality to the target while limiting anomaly influence, RINSE repeatedly admits low-residual target nodes. Starting from r(0) (v) = r(v; B), for t = 1, . . . , T it computes S (t) = arg bottom r(t−1) ρN

r

(t)

(4)

(v) = r(v; [B ∥ ZS (t) ])

Each round combines the ρN lowest-residual target embeddings with B and rescores all nodes with self-masking.

Embedding-scale shift affects attention, distance, and residual scores. For reference matrix C, let µC and σ C be its coordinate-wise moments, and define
(5) CalC (X) = c (X − µC ) ⊘ σ C + εσ̄C , where σ̄C is the mean coordinate standard deviation and c restores the source bank’s mean row norm. The same transformation is applied to Z and B. Calibration uses two passes. First, C = B yields provisional normals S0 through Section 4.2. The original embeddings are then recalibrated with C = [B ∥ ZS0 ], allowing low-residual target patterns to refine the statistics without exposing them to high-residual nodes.

4.4

Label-Free Multi-View Evidence

The anchor reflects attention-reconstruction geometry; RINSE adds three complementary label-free views. kNN distance. The mean distance to the k nearest patterns

Algorithm 1: RINSE inference. Estimate implements Eq. 4; Calibrate applies Eq. 5 to target and bank embeddings using reference C; rank01(·) maps scores to [0, 1], and [·]10 clips to this interval. Input: target graph G; frozen members {Me }E e=1 with source banks {Be }; parameters ρ, T, k, R, βn , βa , τ, ε Output: sfinal ∈ [0, 1]N 1: for e = 1 to E do 2: Z ← gθe (G); B ← Be 3: (Z′ , B′ ) ← Calibrate(Z, B; B, ε); (_, S0 ) ← Estimate(Z′ , B′ ; ρ, T ) 4: (Z, B) ← Calibrate(Z, B; [B ∥ ZS0 ], ε) 5: (a, S) ← Estimate(Z, B; ρ, T ); D ← [B ∥ ZS ] 6: N̂ ← {u : rank01(a)(u) < βn }; Â ← {u : rank01(a)(u) ≥ 1 − max(βa , 10/N )} 7: compute V = {vknn , vtd , vaff } from D, ZS , G using k, R 8: for all v ∈ " V do #1 [ 2 AUC(v; N̂ , Â) − 1 ]10 − τ 9: wv ← 1−τ 0 10: end for P rank01(a) + v∈V wv rank01(v) P 11: se ← 1 + v∈V wv 12: end for 1 PE 13: return sfinal = rank01(se ) E e=1

in the target-aware dictionary is X 1 vknn (u) = k

∥zu − p∥2 ,

(6)

p∈Nk (zu ;D)

excluding the query’s own entry when present. This view measures proximity to individual normal patterns rather than their attention-weighted combination. Target-dictionary residual. The target-only score vtd (u) = r(u; ZS ) reconstructs each node from admitted target normals, with self-masking, and removes dependence on the source bank. Raw-attribute affinity. Let X̄ be the row-normalized pro
(0) cessed attributes. Initialize vaff (u) = 1 − cos x̄u , (ÃX̄)u . (q) For q = 0, . . . , R − 1, set ω (q) = 1 − rank01(vaff ) and update
! Ã(ω (q) ⊙ X̄) u (q+1) . (7) vaff (u) = 1 − cos x̄u , (Ãω (q) )u (R)

The final view is vaff = vaff . Rank weighting reduces the influence of high-scoring neighbors, while operating outside the encoder provides complementary attribute-structural evidence.

4.5

Reliability-Gated Fusion and Encoder Ensembling

For each ensemble member, RINSE estimates view reliability from agreement with the anchor at its ranking extremes.

Suppressing the member index, define N̂ = {u : rank01(a)(u) < βn } Â = {u : rank01(a)(u) ≥ 1 − max(βa , 10/N )} For each v ∈ V = {vknn , vtd , vaff }, " #1 1 2 AUC(v; N̂ , Â) − 1 0 − τ wv = , 1−τ

(8)

0

where [·]10 clips to [0, 1]. The resulting per-member score is P rank01(a)(u) + v∈V wv rank01(v)(u) P . (9) s(u) = 1 + v∈V wv The anchor retains unit weight, so unreliable views can be suppressed without replacing the primary score. RINSE runs this pipeline independently for E members and averages their normalized ranks: E

sfinal (u) =

1 X rank01(se )(u). E e=1

(10)

Rank normalization makes member scores comparable before averaging.

4.6

Source Training and Model Selection

We train gθ , Wq , Wk on labeled source graphs using the reconstruction-separation objective of Zheng et al. (2026). Sampled normal embeddings form the reconstruction dictionary. For normal and anomalous queries zn , za , the loss is   L = 1 − cos(zn , ẑn ) + cos(za , ẑa ) +   (11) + ∥ẑn − zn ∥2 − ∥ẑn − za ∥2 + δ + , where δ is the separation margin. Checkpoint selection uses a fixed held-out source domain. For each ensemble member, we train on PubMed, Questions, and YelpChi, evaluate the full single-member inference pipeline on CiteSeer after each epoch, and retain the checkpoint with the highest AUPRC. We then freeze the scorer and rebuild its source bank from all four source graphs. No target graph enters training, checkpoint selection, or bank construction, and all targets share one configuration.

5 5.1

Experiments

Experimental Setup

Datasets. We follow the experimental and evaluation protocol of Zheng et al. (2026). RINSE and the onefor-all baselines use four source graphs and are evaluated on eight disjoint target graphs. The source set Ttrain = {PubMed, CiteSeer, Questions, YelpChi} covers citation, question-answering, and co-review networks with injected or organic anomalies. The target set Ttest = {Cora, Flickr, ACM, BlogCatalog, Facebook, Weibo, Reddit, Amazon} contains graphs not used for training or model selection.

Method BWGNN GHRN

Cora

Flickr

ACM

9.57±2.40 12.39±2.68 13.37±6.03 14.04±0.73 16.45±2.59 16.29±1.41

DOMINANT 31.77±0.34 28.76±1.52 32.49±4.97 SL-GAD 18.27±1.01 16.93±8.20 1.33±0.23 TAM 9.43±0.27 23.34±1.42 40.68±2.58 CARE 35.12±0.23 25.64±0.16 37.76±0.35

BlogCatalog

Facebook

Supervised (10-shot) 12.97±3.15 5.81±1.17 13.58±2.19 6.24±1.12

Weibo

Reddit

Amazon Average

9.55±2.12 3.21±2.32 12.40±1.86 17.51±1.52 4.44±1.15 13.84±2.63

9.91 12.80

Unsupervised 29.51±3.44 3.42±0.86 29.63±0.86 3.28±0.37 36.80±8.37 9.47±3.00 0.93±0.23 35.80±1.41 4.00±2.27 5.33±2.20 25.59±4.76 12.18±3.14 23.01±15.14 4.22±0.22 45.26±4.34 25.06±0.10 5.52±0.34 40.70±0.74 3.17±0.17 56.76±1.44

24.46 11.51 22.96 28.72

ARC UNPrompt OWLEYE

One-for-all 45.20±1.08 35.13±0.20 39.02±0.08 33.43±0.15 4.25±0.47 9.84±2.90 25.21±1.84 11.18±1.67 18.24±13.05 4.32±0.55 43.94±0.46 37.69±0.25 39.75±0.13 34.99±0.31 5.62±1.17

64.18±0.68 4.20±0.25 20.48±6.89 20.58±5.62 3.77±0.32 9.41±2.69 60.90±0.21 4.25±0.11 62.20±3.18

30.74 12.82 36.17

RINSE

50.44±0.45 38.64±0.12 48.32±0.04

63.69±0.23 4.80±0.16 59.57±7.38

39.18

38.12±0.16

9.89±1.34

Table 1: AUPRC (%) under the standard normalization protocol, reported as mean±standard deviation. The final column averages the eight target graphs. Best results are highlighted in bold and second-best results are underlined. Method

Cora

Flickr

ACM

BlogCatalog

Facebook

Weibo

Reddit

Amazon

Average

ARC UNPrompt OWLEYE

44.90±0.51 7.32±0.85 44.18±1.20

38.04±0.26 22.42±1.45 37.77±0.49

40.80±0.12 12.98±0.80 39.87±0.17

35.71±0.22 28.93±0.65 34.88±0.20

6.95±2.03 6.24±1.50 4.57±0.56

62.39±0.45 23.67±2.21 61.15±0.56

4.04±0.18 4.79±0.29 4.10±0.09

22.54±7.21 28.19±11.77 59.83±1.24

31.92 16.82 35.79

RINSE

49.87±1.72

38.62±0.05

48.28±0.30

38.29±0.37

9.21±2.29

63.23±0.34

5.04±0.31

63.89±2.48

39.55

Table 2: AUPRC (%) under the leak-free normalization protocol, reported as mean±standard deviation. The final column averages the eight target graphs. Best results are highlighted in bold and second-best results are underlined. Baselines. We compare RINSE with supervised, unsupervised, and one-for-all GAD methods. The supervised baselines, BWGNN (Tang et al. 2022) and GHRN (Gao et al. 2023), use the 10-shot protocol, with five labeled normal and five labeled anomalous nodes per target graph. The unsupervised baselines are DOMINANT (Ding et al. 2019), SL-GAD (Zheng et al. 2023), TAM (Qiao and Pang 2023), and CARE (Zheng et al. 2025); the one-for-all baselines are ARC (Liu et al. 2024), UNPrompt (Niu et al. 2025), and OWLEYE (Zheng et al. 2026).

loss margin δ = 0.2. Hyperparameters were selected using held-out source validation, without inspecting target labels or target performance, and the resulting shared configuration was fixed for all target graphs. We report five independent runs; member e in run t uses seed 100t + e. Source training is repeated for each member, while the complete target-time pipeline is gradient-free. We report AUROC and AUPRC, using AUPRC as the primary metric because anomalies are rare and it emphasizes performance on the minority class.

5.2 Implementation Details. Each ensemble member trains gθ , Wq , Wk on PubMed, Questions, and YelpChi, using CiteSeer for checkpoint selection as described in Section 4.6. After restoring the best checkpoint from 10 epochs, its source bank is rebuilt from all four source graphs. Target graphs provide neither training nor selection labels. All graphs use processed attribute dimension d = 64. The encoder is a twolayer MLP over L = 4 propagation hops, with hidden width 384, ELU activation, and dropout 0.1. Truncated attention uses a bank of 2048 labeled-normal embeddings, truncation ratio η = 0.7, temperature γ = 0.031, and up to 1024 normal dictionary embeddings per source graph during training. At inference, RINSE uses ρ = 0.54, T = 5, k = 10, and R = 2 affinity refinements. The reliability gate uses βn = 0.5, βa = 0.05, and τ = 0.1; calibration uses ε = 0.05. We rank-average E = 5 independently initialized members. Each member is optimized with Adam using learning rate 1.14 × 10−3 , weight decay 9.4 × 10−5 , and source-

Results

Main Results. Table 1 shows that RINSE achieves the highest mean average precision among the evaluated methods, reaching 39.18 and improving over the matched one-forall baseline OWLEYE by 3.01 points. RINSE ranks first on five targets and second on the remaining three. It increases performance over OWLEYE on seven of eight targets, with a median paired gain of 2.96 points, and attains the best mean rank among the ten evaluated methods (1.38 versus 2.75 for OWLEYE). Treating the eight target datasets as blocks, a Friedman test indicates significant differences across the evaluated methods (p = 3.6×10−6 ). In the matched comparison with OWLEYE, an exact two-sided Wilcoxon signedrank test gives p = 0.039. Leak-Free Evaluation. We use leak-free as shorthand for the source-referenced normalization path, in which crossgraph reference statistics are computed only from the source graphs and each target is preprocessed independently of the

Figure 2: Component ablation under the (a) standard and (b) leak-free protocols. Each cell reports the AUPRC change relative to full RINSE when a component is removed or replaced; the final column averages the eight target graphs. Both panels use the same scale.

other target graphs. Under this protocol, RINSE ranks first among the four evaluated one-for-all methods on all eight targets and achieves a mean average precision of 39.55 (Table 2). Its margin over OWLEYE increases from 3.01 points under standard normalization to 3.76 points, showing that the matched-protocol improvement persists under sourcereferenced preprocessing. Because this preprocessing comparison is defined for the one-for-all pipeline, supervised and conventional unsupervised baselines are not repeated in Table 2. Ablation Study. Figure 2 evaluates the contribution of each target-time component under both normalization protocols. The evidence views and dictionary-statistics calibration provide the largest average gain, improving AUPRC by 3.5 and 3.1 points under the standard and leak-free protocols, respectively, with particularly strong contributions on Cora, ACM, and Facebook. Ensembling and iterative normality estimation contribute up to 2.7 and 1.9 average points and yield their largest gains on Amazon. The anchor-based reliability gate improves Weibo by 15.6/14.9 points over global Spearman weighting, while the reliability floor adds 2.7/2.6 points on the same target. Together, the components provide complementary gains across target graphs and support the full RINSE configuration. Analysis of Reliability Gating. The gate estimates each view’s reliability from its pseudo-AUC on the anchor’s ranking extremes (Section 4.5). Replacing the anchored gate with global Spearman weighting reduces Weibo AUPRC by 15.6/14.9 points under the standard/leak-free protocols, while removing the reliability floor reduces it by 2.7/2.6 points (Figure 2). These results show that extreme-rank agreement can preserve aligned views while suppressing less reliable evidence. Sensitivity Analysis. Figure 3 varies six inference settings around their fixed defaults. In these one-at-a-time sweeps, mean AUPRC across the eight targets changes by less than one point for ρ ∈ [0.4, 0.8], k ∈ [5, 50], and τ ∈ [0, 0.2].

This supports using one fixed configuration across all targets without per-target tuning. Increasing the estimator rounds from T = 0 to the performance plateau adds 2.1 AUPRC points; increasing the ensemble from E = 1 to E = 5 adds 3.5 points; and using two affinity-refinement rounds adds 2.9 points over no refinement. Further increases provide smaller gains. In particular, E = 8 adds 0.4 point over E = 5, supporting E = 5 as the default compute-performance trade-off.

6

Conclusion

We presented RINSE, a robust, gradient-free target-time framework for zero-shot graph anomaly detection. Around a frozen source-trained scorer, RINSE estimates target normality through trimmed iteration, calibrates embedding statistics, weights complementary evidence by label-free reliability, and rank-averages independently trained encoders. Across eight unseen target graphs, RINSE achieves the highest mean average precision among the evaluated methods under both preprocessing protocols, while the ablation and sensitivity analyses support its individual components. The present study focuses on attributed node-level graphs and a truncated-attention scorer; extending the framework to larger graphs, alternative frozen detectors, and other anomaly settings is a natural direction. Overall, the results support robust target-time estimation as a practical approach to generalist graph anomaly detection.

Ethical Statement RINSE is evaluated on established benchmark datasets and does not collect new human-subject data. It may support the review of potentially fraudulent, spam-related, or manipulative activity without requiring target-domain labels. However, anomaly rankings can contain false positives and may affect users or groups unevenly. They should therefore assist human review rather than trigger automatic punitive decisions. Practical deployment should include domainspecific validation, appropriate threshold selection, privacy

Figure 3: Sensitivity of RINSE to six inference settings. Each panel varies one setting while fixing the others at their defaults, marked by an orange star. Curves report mean AUPRC across the eight target graphs, with shading for one standard deviation over five independent runs.

safeguards, and subgroup auditing where relevant. RINSE reduces dependence on labeled target data but provides no causal guarantees. Its use should follow applicable laws, platform policies, and data-governance requirements.

References Diakonikolas, I.; Iakovidis, G.; Kane, D.; and Pittas, T. 2025. Efficient Multivariate Robust Mean Estimation Under MeanShift Contamination. In Singh, A.; Fazel, M.; Hsu, D.; Lacoste-Julien, S.; Berkenkamp, F.; Maharaj, T.; Wagstaff, K.; and Zhu, J., eds., Forty-second International Conference on Machine Learning, ICML 2025, Vancouver, BC, Canada, July 13-19, 2025, volume 267 of Proceedings of Machine Learning Research. PMLR / OpenReview.net. Diakonikolas, I.; Kane, D.; Karmalkar, S.; Pensia, A.; and Pittas, T. 2024. Robust Sparse Estimation for Gaussians with Optimal Error under Huber Contamination. In Salakhutdinov, R.; Kolter, Z.; Heller, K. A.; Weller, A.; Oliver, N.; Scarlett, J.; and Berkenkamp, F., eds., Forty-first International Conference on Machine Learning, ICML 2024, Vienna, Austria, July 21-27, 2024, volume 235 of Proceedings of Machine Learning Research, 10811–10840. PMLR / OpenReview.net. Ding, K.; Li, J.; Bhanushali, R.; and Liu, H. 2019. Deep anomaly detection on attributed networks. In Berger-Wolf, T. Y.; and Chawla, N. V., eds., Proceedings of the 2019

SIAM international conference on data mining, SDM 2019, calgary, alberta, canada, may 2-4, 2019, 594–602. SIAM. Ding, K.; Shu, K.; Shan, X.; Li, J.; and Liu, H. 2022. CrossDomain Graph Anomaly Detection. IEEE Trans. Neural Networks Learn. Syst., 33(6): 2406–2415. Dong, J.; Jia, H.; Chatterjee, S.; Ghosh, A.; Bailey, J.; and Dang, T. 2025. E-BATS: Efficient Backpropagation-Free Test-Time Adaptation for Speech Foundation Models. In Belgrave, D.; Zhang, C.; Montoya, L. N.; Lin, H.-T.; Pascanu, R.; Koniusz, P.; Ghassemi, M.; Chen, N.; Ruíz, I. V. M.; and Loaiza-Bonilla, A., eds., Advances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing Systems 2025, NeurIPS 2025, San Diego, CA, USA, December 2-7, 2025 / Mexico City, Mexico, November 30 - December 5, 2025. Fu, X.; Wang, Z.; Chen, Z.; Li, J.; Zhu, Y.; Lei, Z.; Shen, C.; Ye, Y.; Zhang, C.; and Li, J. 2025. Graph Prompting for Graph Learning Models: Recent Advances and Future Directions. In Antonie, L.; Pei, J.; Yu, X.; Chierichetti, F.; Lauw, H. W.; Sun, Y.; and Parthasarathy, S., eds., Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining, V.2, KDD 2025, Toronto ON, Canada, August 3-7, 2025, 6010–6020. ACM. Gao, Y.; Wang, X.; He, X.; Liu, Z.; Feng, H.; and Zhang, Y. 2023. Addressing heterophily in graph anomaly detection: A perspective of graph spectrum. In Ding, Y.; Tang, J.;

Sequeda, J. F.; Aroyo, L.; Castillo, C.; and Houben, G.-J., eds., Proceedings of the ACM web conference 2023, WWW 2023, austin, TX, USA, 30 april 2023 - 4 may 2023, 1528– 1538. ACM. Goswami, M.; Challu, C. I.; Callot, L.; Minorics, L.; and Kan, A. 2023. Unsupervised Model Selection for Time Series Anomaly Detection. In The Eleventh International Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023. OpenReview.net. He, J.; Xu, Q.; Jiang, Y.; Wang, Z.; and Huang, Q. 2024. ADA-GAD: Anomaly-Denoised Autoencoders for Graph Anomaly Detection. In Wooldridge, M. J.; Dy, J. G.; and Natarajan, S., eds., Thirty-Eighth AAAI Conference on Artificial Intelligence, AAAI 2024, Thirty-Sixth Conference on Innovative Applications of Artificial Intelligence, IAAI 2024, Fourteenth Symposium on Educational Advances in Artificial Intelligence, EAAI 2024, February 20-27, 2024, Vancouver, Canada, 8481–8489. AAAI Press. Huang, C.; Shi, X.; Gao, C.; Hu, Q.; Huang, X.; Huang, Q.; and Anaissi, A. 2025. Cross-Domain Graph Anomaly Detection via Graph Transfer and Graph Decouple. CAAI Trans. Intell. Technol., 10(4): 1089–1103. Jin, W.; Zhao, T.; Ding, J.; Liu, Y.; Tang, J.; and Shah, N. 2023. Empowering Graph Representation Learning with Test-Time Graph Transformation. In The Eleventh International Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023. OpenReview.net. Kim, S.; Lee, S. Y.; Bu, F.; Kang, S.; Kim, K.; Yoo, J.; and Shin, K. 2024. Rethinking Reconstruction-based GraphLevel Anomaly Detection: Limitations and a Simple Remedy. In Globerson, A.; Mackey, L.; Belgrave, D.; Fan, A.; Paquet, U.; Tomczak, J. M.; and Zhang, C., eds., Advances in Neural Information Processing Systems 37: Annual Conference on Neural Information Processing Systems 2024, NeurIPS 2024, Vancouver, BC, Canada, December 10 - 15, 2024. Li, Y.; Wang, P.; Li, Z.; Yu, J. X.; and Li, J. 2024. ZeroG: Investigating Cross-dataset Zero-shot Transferability in Graphs. In Baeza-Yates, R.; and Bonchi, F., eds., Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, KDD 2024, Barcelona, Spain, August 25-29, 2024, 1725–1735. ACM. Liu, W.; Chen, Y.; and Yue, X. 2025. Enhancing multi-view classification reliability with adaptive rejection. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, 18969–18977. Number: 18. Liu, Y.; Kothari, P.; Delft, B. v.; Bellot-Gurlet, B.; Mordan, T.; and Alahi, A. 2021. TTT++: When Does Self-Supervised Test-Time Training Fail or Thrive? In Ranzato, M.; Beygelzimer, A.; Dauphin, Y. N.; Liang, P.; and Vaughan, J. W., eds., Advances in Neural Information Processing Systems 34: Annual Conference on Neural Information Processing Systems 2021, NeurIPS 2021, December 6-14, 2021, virtual, 21808–21820. Liu, Y.; Li, S.; Zheng, Y.; Chen, Q.; Zhang, C.; and Pan, S. 2024. ARC: A generalist graph anomaly detector with in-context learning. In Globerson, A.; Mackey, L.; Belgrave,

D.; Fan, A.; Paquet, U.; Tomczak, J. M.; and Zhang, C., eds., Advances in neural information processing systems 37: Annual conference on neural information processing systems 2024, NeurIPS 2024, vancouver, BC, canada, december 10 15, 2024. Liu, Y.; Li, S.; Zheng, Y.; Chen, Q.; Zhang, C.; Yu, P. S.; and Pan, S. 2026. From Few-Shot to Zero-Shot: Towards Generalist Graph Anomaly Detection. IEEE Trans. Knowl. Data Eng., 38(7): 4357–4372. Liu, Y.; Li, Z.; Pan, S.; Gong, C.; Zhou, C.; and Karypis, G. 2022. Anomaly detection on attributed networks via contrastive self-supervised learning. IEEE Trans. Neural Networks Learn. Syst., 33(6): 2378–2392. Ma, M. Q.; Zhao, Y.; Zhang, X.; and Akoglu, L. 2023. The Need for Unsupervised Outlier Model Selection: A Review and Evaluation of Internal Evaluation Strategies. SIGKDD Explor., 25(1): 19–35. Niu, C.; Qiao, H.; Chen, C.; Chen, L.; and Pang, G. 2025. Zero-shot generalist graph anomaly detection with unified neighborhood prompts. In Proceedings of the thirty-fourth international joint conference on artificial intelligence, IJCAI 2025, montreal, canada, august 16-22, 2025, 3226– 3234. ijcai.org. Pan, J.; Liu, Y.; Zhou, C.; Xiong, F.; Liew, A. W.; and Pan, S. 2026. Correcting False Alarms from Unseen: Adapting Graph Anomaly Detectors at Test Time. In Koenig, S.; Jenkins, C.; and Taylor, M. E., eds., Fortieth AAAI Conference on Artificial Intelligence, Thirty-Eighth Conference on Innovative Applications of Artificial Intelligence, Sixteenth Symposium on Educational Advances in Artificial Intelligence, AAAI 2026, Singapore, January 20-27, 2026, 24691–24699. AAAI Press. Pan, J.; Zheng, Y.; Tan, Y.; and Liu, Y. 2025. A Survey of Generalization of Graph Anomaly Detection: From Transfer Learning to Foundation Models. In 2025 IEEE International Conference on Knowledge Graph (ICKG), Limassol, Cyprus, November 13-14, 2025, 316–323. IEEE. Qiao, H.; Niu, C.; Chen, L.; and Pang, G. 2025a. AnomalyGFM: Graph Foundation Model for Zero/Fewshot Anomaly Detection. In Antonie, L.; Pei, J.; Yu, X.; Chierichetti, F.; Lauw, H. W.; Sun, Y.; and Parthasarathy, S., eds., Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining, V.2, KDD 2025, Toronto ON, Canada, August 3-7, 2025, 2326–2337. ACM. Qiao, H.; and Pang, G. 2023. Truncated affinity maximization: One-class homophily modeling for graph anomaly detection. In Oh, A.; Naumann, T.; Globerson, A.; Saenko, K.; Hardt, M.; and Levine, S., eds., Advances in neural information processing systems 36: Annual conference on neural information processing systems 2023, NeurIPS 2023, new orleans, LA, USA, december 10 - 16, 2023. Qiao, H.; Tong, H.; An, B.; King, I.; Aggarwal, C.; and Pang, G. 2025b. Deep Graph Anomaly Detection: A Survey and New Perspectives. IEEE Transactions on Knowledge and Data Engineering, 37(9): 5106–5126. Sun, Y.; Wang, X.; Liu, Z.; Miller, J.; Efros, A. A.; and Hardt, M. 2020. Test-Time Training with Self-Supervision

for Generalization under Distribution Shifts. In Proceedings of the 37th International Conference on Machine Learning, ICML 2020, 13-18 July 2020, Virtual Event, volume 119 of Proceedings of Machine Learning Research, 9229–9248. PMLR. Tang, J.; Li, J.; Gao, Z.; and Li, J. 2022. Rethinking graph neural networks for anomaly detection. In Chaudhuri, K.; Jegelka, S.; Song, L.; Szepesvári, C.; Niu, G.; and Sabato, S., eds., International conference on machine learning, ICML 2022, 17-23 july 2022, baltimore, maryland, USA, volume 162 of Proceedings of machine learning research, 21076– 21089. PMLR. Wang, D.; Shelhamer, E.; Liu, S.; Olshausen, B. A.; and Darrell, T. 2021. Tent: Fully Test-Time Adaptation by Entropy Minimization. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net. Wang, D.; Zuo, Y.; Lu, G.; and Wu, J. 2025. UniGTE: Unified Graph-Text Encoding for Zero-Shot Generalization across Graph Tasks and Domains. In Belgrave, D.; Zhang, C.; Montoya, L. N.; Lin, H.-T.; Pascanu, R.; Koniusz, P.; Ghassemi, M.; Chen, N.; Ruíz, I. V. M.; and Loaiza-Bonilla, A., eds., Advances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing Systems 2025, NeurIPS 2025, San Diego, CA, USA, December 2-7, 2025 / Mexico City, Mexico, November 30 - December 5, 2025. Wang, Q.; Pang, G.; Salehi, M.; Buntine, W. L.; and Leckie, C. 2023. Cross-Domain Graph Anomaly Detection via Anomaly-Aware Contrastive Alignment. In Williams, B.; Chen, Y.; and Neville, J., eds., Thirty-Seventh AAAI Conference on Artificial Intelligence, AAAI 2023, Thirty-Fifth Conference on Innovative Applications of Artificial Intelligence, IAAI 2023, Thirteenth Symposium on Educational Advances in Artificial Intelligence, EAAI 2023, Washington, DC, USA, February 7-14, 2023, 4676–4684. AAAI Press. Wang, Y.; Cheraghian, A.; Hayder, Z.; Hong, J.; Ramasinghe, S.; Rahman, S.; Ahmedt-Aristizabal, D.; Li, X.; Petersson, L.; and Harandi, M. 2024. Backpropagation-free Network for 3D Test-time Adaptation. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2024, Seattle, WA, USA, June 16-22, 2024, 23231–23241. IEEE. Wang, Z.; and Tan, Z. 2023. Tractable and Near-Optimal Adversarial Algorithms for Robust Estimation in Contaminated Gaussian Models. Journal of Machine Learning Research, 24: 235:1–235:112. Yazdanpanah, M.; Bahri, A.; Noori, M.; Dastani, S.; Hakim, G. A. V.; Osowiechi, D.; Ayed, I. B.; and Desrosiers, C. 2025. Purge-Gate: Backpropagation-Free Test-Time Adaptation for Point Clouds Classification via Token Purging. In IEEE/CVF International Conference on Computer Vision, ICCV 2025, Honolulu, HI, USA, October 19-25, 2025, 27640–27649. IEEE. Yu, X.; Fang, Y.; Liu, Z.; and Zhang, X. 2024. HGPrompt: Bridging Homogeneous and Heterogeneous Graphs for FewShot Prompt Learning. In Wooldridge, M. J.; Dy, J. G.; and Natarajan, S., eds., Thirty-Eighth AAAI Conference on

Artificial Intelligence, AAAI 2024, Thirty-Sixth Conference on Innovative Applications of Artificial Intelligence, IAAI 2024, Fourteenth Symposium on Educational Advances in Artificial Intelligence, EAAI 2024, February 20-27, 2024, Vancouver, Canada, 16578–16586. AAAI Press. Zhang, X.; He, Z.; Fu, C.; and Xie, C. 2025a. IA-GGAD: Zero-shot Generalist Graph Anomaly Detection via Invariant and Affinity Learning. In Belgrave, D.; Zhang, C.; Montoya, L. N.; Lin, H.-T.; Pascanu, R.; Koniusz, P.; Ghassemi, M.; Chen, N.; Ruíz, I. V. M.; and Loaiza-Bonilla, A., eds., Advances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing Systems 2025, NeurIPS 2025, San Diego, CA, USA, December 2-7, 2025 / Mexico City, Mexico, November 30 - December 5, 2025. Zhang, Y.; Kim, Y.; Choi, Y.-G.; Kim, H.; Liu, H.; and Hong, S. 2025b. Backpropagation-Free Test-Time Adaptation via Probabilistic Gaussian Alignment. In Belgrave, D.; Zhang, C.; Montoya, L. N.; Lin, H.-T.; Pascanu, R.; Koniusz, P.; Ghassemi, M.; Chen, N.; Ruíz, I. V. M.; and Loaiza-Bonilla, A., eds., Advances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing Systems 2025, NeurIPS 2025, San Diego, CA, USA, December 2-7, 2025 / Mexico City, Mexico, November 30 December 5, 2025. Zhao, Y.; Rossi, R. A.; and Akoglu, L. 2021. Automatic Unsupervised Outlier Model Selection. In Ranzato, M.; Beygelzimer, A.; Dauphin, Y. N.; Liang, P.; and Vaughan, J. W., eds., Advances in Neural Information Processing Systems 34: Annual Conference on Neural Information Processing Systems 2021, NeurIPS 2021, December 6-14, 2021, virtual, 4489–4502. Zheng, L.; Birge, J. R.; Wu, H.; Zhang, Y.; and He, J. 2025. Cluster aware graph anomaly detection. In Long, G.; Blumestein, M.; Chang, Y.; Lewin-Eytan, L.; Huang, Z. H.; and Yom-Tov, E., eds., Proceedings of the ACM on web conference 2025, WWW 2025, sydney, NSW, australia, 28 april 2025- 2 may 2025, 1771–1782. ACM. Zheng, L.; Fu, D.; Li, Z.; and He, J. 2026. OwlEye: Zero-shot learner for cross-domain graph data anomaly detection. In The fourteenth international conference on learning representations. Zheng, Y.; Jin, M.; Liu, Y.; Chi, L.; Phan, K. T.; and Chen, Y.-P. P. 2023. Generative and contrastive self-supervised learning for graph anomaly detection. IEEE Transactions on Knowledge and Data Engineering, 35(12): 12220–12233.

Related documents

• PRA-TAM: prototype-regularised residual affinity maximisation for unsupervised graph anomaly detection#425890
• RINSE: Robust Target-Time Normality Estimation for Zero-Shot Graph Anomaly Detection#924374
• RINSE: Robust Target-Time Normality Estimation for Zero-Shot Graph Anomaly Detection#920143
• RagGAD: Rationale-Aware Conditional Gaussian Mixture Normalizing Flow for Unsupervised Graph Anomaly Detection#617691
• RagGAD: Rationale-Aware Conditional Gaussian Mixture Normalizing Flow for Unsupervised Graph Anomaly Detection#617191