GLASS: Graph-Language Alignment with Spherical Scoring for Transferable Graph-Level Anomaly Detection Xudong Wang, Chris Ding, Tongxin Li, Jicong Fan
arXiv:2609.05253v1 [cs.LG] 4 Sep 2026
School of Data Science, The Chinese University of Hong Kong, Shenzhen (CUHK-Shenzhen), China xudongwanglink.cuhk.edu.cn, {chrisding, litongxin, fanjicong}cuhk.edu.cn Abstract—We introduce GLASS, a framework for graph-level anomaly detection (GLAD) that achieves robust cross-domain transferability through graph–language alignment on the unit hypersphere. GLASS builds a unified representation space by aligning a structure-aware graph encoder with an instructionaware text embedding via a multi-slice soft cosine objective. Our framework serializes local, global, and semantic graph properties into a compact Graph Descriptor Prompt (GraphDP), creating a text bridge that enables domain-agnostic anomaly scoring. By enforcing multi-scale consistency through Matryoshka representation slices, the model captures anomalous deviations at multiple levels of granularity. For scoring, we formulate anomaly detection as density estimation on the aligned hypersphere and introduce Spherical Multi-Modal Scoring (SMS), which instantiates von Mises–Fisher kernel density estimators in both graph and text embedding spaces. This probabilistic formulation recovers angular k-nearest-neighbor scoring as a high-concentration limiting case and provides a principled fusion of structural and semantic anomaly signals. The shared text embedding space further serves as a cross-domain bridge: by encoding a target domain’s GraphDP without any target training data, GLASS performs zero-shot anomaly detection, and with only a handful of normal examples, few-shot adaptation via reference-set calibration. Across twelve benchmarks and three meta-domains, GLASS obtains the best average AUROC and rank compared with recent advanced GLAD baselines and enables effective cross-domain transfer. Index Terms—graph-level anomaly detection, graph-language alignment, cross-domain transfer, hyperspherical scoring
I. I NTRODUCTION Graphs are primary data objects in molecular screening, protein analysis, social computing, and many other data-mining applications. In graph-level anomaly detection (GLAD), a model observes normal graph instances and must rank unseen graphs by anomalousness [1–3]. Existing GLAD systems usually learn a detector for one dataset: molecules have atom and bond attributes, protein graphs have different structural attributes, and social graphs may have no node attributes at all. This dataset-specific assumption becomes restrictive when a new domain has only a few trusted normal graphs, or no target-domain training data. The central difficulty is not merely discriminative capacity; it is the absence of an interoperable representation and a common anomaly-scoring principle across heterogeneous graph families. A molecular ring, a protein contact pattern, and a social community are not directly comparable as raw node features. However, they can all be described through structural
language: graph size, density, degree profiles, clustering, motifs, connectivity, core structure, and spectral summaries. This observation suggests a scalable route toward transferable GLAD: align graph representations with an instruction-aware language embedding space that can encode the same structural evidence across domains. GLASS instantiates this idea through a coherent pipeline. First, Local Topology Descriptors (LTDs) provide stable nodelevel structural evidence even when raw attributes are missing or incomparable. Second, GraphDP serializes local, global, and spectral graph properties into a compact structured prompt. Third, a frozen instruction-aware text encoder embeds this prompt and provides stable text anchors; we use Qwen3Embedding [4], an instruction-aware embedding model with native MRL support, as the embedding function rather than a generative reasoner. Finally, a structure-aware graph encoder is trained to align with these anchors on the unit hypersphere through native Matryoshka representation slices. The hyperspherical view turns GLAD into density estimation. In the aligned graph–text space, a query graph is anomalous when it lies in a low-density region relative to normal references. We formalize this through a von Mises–Fisher (vMF) kerneldensity view and use its angular k-NN high-concentration limit as the practical scorer. This single scoring family supports three deployment regimes without changing the architecture: single-domain GLAD uses target normal references; zero-shot transfer uses source-domain normal references; and few-shot adaptation augments the reference set with a handful of trusted target normal graphs. This design addresses three impediments to transferable GLAD. First, it replaces dataset-specific raw features with a structural-language bridge. Second, it stabilizes cross-domain alignment by freezing the instruction-aware text space and learning graph-side mappings only. Third, it provides a nonparametric spherical scoring rule that is naturally compatible with reference-set calibration. Empirically, GLASS achieves strong single-domain performance across twelve benchmarks and reveals interpretable transfer regimes: molecular and protein graphs transfer well because their GraphDP descriptions share substructure semantics, while larger biological-to-social shifts require richer source weighting or target references. Our contributions are: • We propose a transferable GLAD paradigm that formulates
anomaly detection as density estimation on an aligned graph– language hypersphere. • We instantiate this paradigm in GLASS, integrating LTDs, GraphDP, frozen instruction-aware text anchors, native Matryoshka slices, and Spherical Multi-Modal Scoring. • We give a rigorous vMF KDE analysis showing why angular nearest-neighbor scoring arises as the high-concentration density limit. • Our empirical results demonstrate GLASS’s superior singledomain performance and effective zero-/few-shot crossdomain transfer across twelve widely used graph benchmarks and three meta-domains. II. R ELATED W ORK
transferable coordinate system, while spherical KDE and its nearest-neighbor limit provide the anomaly-scoring principle. III. P ROBLEM S ETUP Let G = (V, E, X) be a graph with node set V , edge set E, and optional node attributes X. In class-based GLAD 0 benchmarks [6, 7], training uses normal graphs only, Dtr = N {Gi }i=1 , while evaluation ranks held-out normal graphs against anomalous-class graphs. A detector outputs s(G), where larger scores indicate stronger anomalousness. Single-domain scoring uses target-domain training normals as references. Zero-shot transfer uses source-domain normal references and no target training data. Few-shot calibration adds k trusted target normal graphs to the reference set at inference time only; model parameters remain fixed.
Graph-level anomaly and graph OOD detection. Graph IV. M ETHOD anomaly detection has been studied at node, edge, subgraph, GLASS follows a single principle: transferable graphand graph levels [1–3, 5]. GLAD differs from node-level level anomaly detection should estimate normal density in anomaly detection because the object being ranked is an entire a representation space whose coordinates remain comparable graph and the normality signal may lie in global topology, local across graph families. To obtain such a space, as shown in motifs, node features, or their interaction. Class-based GLAD Fig. 1, GLASS constructs two coupled views of each graph. and OOD protocols emphasize consistent normal-only training The graph view maps topology and optional attributes into and held-out anomaly evaluation [6, 7]. Deep one-class methods a structure-aware graph code. The language view serializes adapt hypersphere learning to graph encoders, as in OCGIN the same structural evidence into a compact Graph Descriptor and OCGTL [8, 9]. GLocalKD uses global-local knowledge Prompt (GraphDP) and embeds it with an instruction-aware distillation [10]; GLADC and CVTGAD use contrastive or text encoder. Training aligns the graph code to Matryoshka cross-view objectives [11, 12]; SIGNET introduces a subgraph text anchors on the unit hypersphere and shapes the normal information bottleneck [13]. Recent reconstruction and unified geometry with lightweight spherical prototypes. Inference then anomaly frameworks such as MUSE and UniFORM further uses the same graph/text reference-set scorer in single-domain, improve graph-level baselines [14, 15]. These methods are zero-shot, and few-shot regimes; only the normal reference set strong single-domain detectors, but their standard protocol changes. assumes normal target-domain graphs. Structural features, graph kernels, and graph language. A. GraphDP and Dual Encoders Classical graph kernels remain competitive in GLAD bea) Local topology descriptors and canonicalized node cause structural statistics are robust when node attributes features.: Let G = (V, E, X) be an input graph, with optional are missing or incomparable. We include propagation-kernel node attributes xv for v ∈ V . For each node v, GLASS and Weisfeiler-Lehman graph kernels with one-class SVM first computes deterministic local topology descriptors (LTDs). and isolation forest detectors [16–18]. Local degree-profile Let N (v) denote the neighbor set and deg(v) the degree. and local topological-profile work shows that local statistics The default LTD vector contains a degree profile and a local can be strong graph representations [19, 20]. GLASS uses topological profile: these statistics differently: they are shared evidence for graph mean zvLTD = [dv , dmin , dmax , dstd v , dv v v , encoding and GraphDP serialization. Graph-language methods (1) b b study graph serialization, graph prompting, and alignment bec(v), kc (v), T (v), C4 (v)]. tween GNNs and language embeddings [21–24]; GraphMAE2 mean max std where dv = deg(v) and (dmin , dv , dv ) are neighborv , dv and OFA improve generalization for graph representation degree statistics over N (v). Here c(v) is the local clustering learning [25, 26]; AnomalyGFM and ARC explore zero-/fewb4 (v) decoefficient, kc (v) is the k-core index, and Tb(v) and C shot anomaly detection mainly in node-level settings [27, 28]. note triangle and 4-cycle estimates. These rooted-neighborhood GLASS instead uses frozen text embeddings as structural statistics are available even when raw attributes are missing anchors for unsupervised graph-level anomaly scoring. and provide a common structural vocabulary across molecules, Spherical and density-based scoring. Hyperspherical repproteins, and social graphs. resentations reduce sensitivity to feature norms and support The LTD vector is concatenated with raw attributes when angular density models [29–31]. Kernel density estimation and they exist. If attributes are absent, the input consists only of nearest-neighbor anomaly scoring are classical nonparametric LTDs. The concatenated vector is normalized within each graph tools. On the sphere, vMF kernels provide a natural directional and passed through a small canonicalization MLP: density family [32, 33]. GLASS connects this statistical x̃v = ϕθ znormG [zvLTD ; xv ] , (2) view to graph–language alignment: the text bridge supplies a
(b) Inference: Spherical Multi-Modal Scoring
(a) Training: Alignment + Density Shaping on Shared Unit Hypersphere Canonicalization
Graph Encoder (GIN)
: Normal Graph Projection via
: Anomalous Graph
Reference Set
: Query Graph
Molecule Graph Local Topology Descriptors (LTDs) degree clustering
Alignment
Cross-Domain Transfer via Text Bridge on the Unit Hypersphere
k-core
Protein Graph
triangles cycles
Training-time Prototype(vMF) INSTRUCT Query: [GraphDP content]
Social Graph
(Optional
SMS: vMF Density View
)
Text Encoder (LLM)
Graph Descriptor Prompt (GraphDP) : Trainable : Frozen
Matryoshka Representation Learning (MRL)
For normal references
Angular Reference-Set Score and
so the score for query graph
: Graph representation slice
:
:
: LLM representation slice
Fig. 1. Overview of GLASS. During training, Local Topology Descriptors (LTDs) and graph attributes are canonicalized and encoded by a graph encoder, while GraphDP serializes the same structural evidence for a frozen instruction-aware text encoder. Native Matryoshka text slices provide stable anchors, graph-side projections align graph codes on shared unit hyperspheres, and vMF prototypes shape the training geometry. During inference, Spherical Multi-Modal Scoring (SMS) ranks a query graph by its angular density relative to normal graph/text references; single-domain, zero-shot, and few-shot evaluation differ only in how the reference set is constructed.
where znormG denotes per-graph feature normalization over nodes. This step makes the graph encoder less sensitive to dataset-specific feature scales while preserving local structural evidence. b) Structure-aware graph encoder.: A GIN backbone [34] maps the canonicalized node features into node representations. (0) With hv = x̃v , the ℓ-th message-passing layer is X (ℓ−1) (ℓ−1) h(ℓ) = MLP (1 + ϵ )h + h . ℓ ℓ v v u (3) u∈N (v)
After L layers, GLASS concatenates mean and max graph readouts and get rg (G) ∈ R2H as, (L) rg (G) = MeanPool({h(L) v }v∈V ); MaxPool({hv }v∈V ) . (4) The graph-side global sketch ξ(G) ∈ Rdξ is intentionally lightweight and spectral rather than a duplicate of all GraphDP fields. Let Lsym = I − D−1/2 Asym D−1/2 be the symmetric normalized Laplacian of the symmetrized graph. We define ξ(G) = λ2 , . . . , λr+1 , Q0.1 ({ρj }qj=1 ), Q0.5 ({ρj }qj=1 ), Q0.9 ({ρj }qj=1 ) . (5) where λ2 , . . . , λr+1 are the first non-trivial small eigenvalues of u⊤ Lsym uj Lsym , Qp denotes the empirical p-quantile, and ρj = j u⊤ uj j are random Rayleigh quotients. With default r = 8 and q = 16, the sketch dimension is dξ = r + 3 = 11. And the final graph evidence code is hg (G) = rg (G); pξ (ξ(G)) ∈ RDg , (6) where pξ is the spectral projection layer and Dg = 2H + dξ .
c) GraphDP text anchors.: The language view serializes graph-level aggregates of structural evidence into a compact key-value prompt. A GraphDP contains fields such as graph size, density, connected components, degree quantiles and entropy, clustering statistics, triangle and 4-cycle statistics, corenumber summaries, and spectral summaries. It is deliberately short and structured; GLASS does not rely on long chain-ofthought prompting or free-form reasoning. Let GraphDP(G) denote this deterministic serialization. The default frozen text encoder is Qwen3-Embedding-0.6B [4] with Dtext = 1024. Given a fixed instruction I and the GraphDP query, the text encoder outputs e(G) = ftext I, GraphDP(G) ∈ RDtext . (7) The text encoder is used only as an embedding function, and its parameters are frozen by default. Qwen3-Embedding supports native Matryoshka Representation Learning (MRL), so GLASS obtains multi-resolution text anchors by prefix truncation. For slice dimensions D1 < · · · < DS ≤ Dtext , the s-th text slice is e(s) (G) =
e(G)1:Ds ∈ SDs −1 . ∥e(G)1:Ds ∥2
(8)
These frozen unit vectors serve as stable structural-language anchors for graph-side alignment. B. Graph-Language Alignment For each slice s, a graph-side projection W (s) ∈ RDs ×Dg maps the graph evidence code into the same spherical coordi-
nate system as the corresponding text slice: z (s) (G) =
W (s) hg (G) ∈ SDs −1 . ∥W (s) hg (G)∥2
All text embeddings in Eqs. (7)–(8) can be pre-computed or forwarded through the frozen encoder without gradient updates. (9)
(s)
Only the graph side is trained. The text slices e (G) remain fixed, which prevents the anchor space from drifting when the number of normal graphs is small. For a minibatch B of normal graphs, GLASS minimizes the multi-slice soft cosine alignment loss S D E 1 X X Lalign = 1 − z (s) (G), e(s) (G) . |B|S s=1 G∈B
D. Spherical Reference-Set Scoring After training, GLASS freezes both encoders and scores a query graph by its angular density relative to normal references. Let R be the normal reference set for the deployment regime. For each slice s, define graph and text reference embeddings (s) R(s) (Gi ) : Gi ∈ R}, g = {z (s)
(10)
Rt
= {e(s) (Gi ) : Gi ∈ R}.
(15)
A vMF KDE score for any unit embedding u ∈ SDs −1 and reference set A is 1 X ℓκ (u; A) = − log CDs (κ) exp(κ⟨u, r⟩) , (16) |A|
This objective aligns graph and language views at multiple resolutions: smaller slices emphasize coarse structural signals, while larger slices retain finer GraphDP evidence. To avoid a r∈A rank-impossible orthogonality target, GLASS uses a dimensionwhere κ is the concentration parameter and CDs (κ) is the adaptive Gram regularizer to stabilize angular alignment: X vMF normalizing constant. The reported scorer uses the highRorth = ∥W (s) W (s)⊤ − IDs ∥2F concentration reference-set limit of this density view. Let s:Ds ≤Dg (11) Nk (u; A) be the k nearest references under cosine distance X and define + ∥W (s)⊤ W (s) − IDg ∥2F . X s:Ds >Dg 1 dk (u, A) = (1 − ⟨u, r⟩) . (17) k For Ds ≤ Dg , this encourages orthonormal rows and stable r∈Nk (u;A) dimensionality reduction. For Ds > Dg , it encourages an approximately isometric embedding of the graph-code subspace The final graph-level anomaly score for query Gq is S into an overcomplete slice. h X s(Gq ) = ws αs dk z (s) (Gq ), R(s) g C. Training-Time Spherical Density Shaping (18) s=1 i The alignment loss brings graph embeddings close to frozen (s) (s) + (1 − αs ) dk e (Gq ), Rt . text anchors, but anomaly detection also benefits from a compact normal geometry. GLASS therefore uses spherical Here ws are slice weights and αs balances graph and text prototypes as a training-time density-shaping regularizer. For channels. In our default implementation, these weights and each slice s, let score calibration are estimated from normal references only; (s) (s) (s) (s) the appendix VII-B gives the normal-reference reliability rule M = {µ1 , . . . , µK }, ∥µj ∥2 = 1, used in the reported scorer. Single-domain GLAD uses targetbe K normal prototype directions on the unit sphere. The domain training normals as R. Zero-shot transfer replaces R by prototype distance of a graph is source-domain normals and uses no target graphs for training. D E (s) (s) (s) Eproto (G) = min 1 − z (G), µj . (12) Few-shot calibration adds a small number of trusted target 1≤j≤K normals to R, while the graph encoder, frozen text encoder, projections, and prototypes remain unchanged. (s) For normal graphs, minimizing Eproto encourages embeddings to occupy a few dense spherical modes rather than spreading V. S PHERICAL D ENSITY P RINCIPLE uniformly over the sphere. When perturbed graphs G− are Proposition 1 (vMF KDE to nearest-neighbor scoring). Let used during training, a margin term pushes them away from R ⊂ Sd−1 be finite and let u ∈ Sd−1 . For the vMF KDE score these normal modes: in Eq. (16), there exists a constant aκ independent of u such S X X that 1 (s) ℓκ (u; R) Lproto = Eproto (G) + aκ = 1 − max⟨u, r⟩. lim |B|S G∈B s=1 κ→∞ r∈R κ S h i X X 1 Thus, up to constants and positive scaling, high-concentration (s) + − mproto − Eproto (G− ) . vMF scoring ranks queries by one-minus-cosine nearest|B |S − − s=1 + G ∈B (13) neighbor distance on the sphere. The perturbation indicator is used only inside the training loss Proof. Write s = ⟨u, r⟩ and m(u) = max r r∈R sr . Since all and is never inserted into GraphDP. So the graph-side training reference terms are finite, objective is X exp(κm(u)) ≤ exp(κsr ) ≤ |R| exp(κm(u)). L = Lalign + λorth Rorth + λproto Lproto . (14) r∈R
TABLE I. Single-domain GLAD results in AUROC (%). The GLASS uses the default spherical reference-set scorer. Average AUROC and rank are computed over all twelve datasets. Best, second, and third are shown in bold, underline, and a dagger † marker. Method
MUTAG
PROTEINS
Graph Kernel + Detector PK-SVM 46.06±0.47 49.43±0.69 PK-iF 47.98±0.41 61.24±0.34 WL-SVM 62.18±0.29 53.85±0.26 WL-iF 65.71±0.38 65.75±0.35
D&D
ENZYMES
DHFR
BZR
COX2
AIDS
IMDB-B
NCI1
COLLAB
Avg. Avg. REDDIT-B AUROC Rank
47.69±0.24 75.29±0.46 47.98±0.32 70.49±0.28
52.45±0.29 49.82±0.67 53.75±0.34 51.03±0.42
48.31±0.47 52.79±0.35 50.30±0.31 51.64±0.22
46.67±0.52 59.08±0.29 51.16±0.36 51.71±0.45
52.15±0.16 52.48±0.38 53.34±0.27 49.56±0.11
50.93±0.19 52.01±0.53 52.56±0.41 61.42±0.50
51.75±0.30 52.83±0.51 52.98±0.69 51.79±0.32
51.39±0.19 50.22±0.12 54.18±0.67 50.41±0.31
49.72±0.60 51.38±0.20 54.62±1.28 51.41±0.39
48.36±0.67 46.19±0.21 49.50±0.54 49.84±0.11
49.58 54.28 53.03 55.90
12.42 11.25 10.67 11.00
GNN-based Deep Learning Methods OCGIN 79.55±0.22 76.46±0.13 79.08±0.19 62.44±0.38 61.09±0.27 69.13±0.13 57.81±0.50 96.89±0.20 61.47±0.18 69.46±0.36 60.58±0.27 82.10±0.37 71.34 7.25 GLocalKD 86.25±0.57 77.29±0.41 † 80.76±0.50 61.75±0.10 61.79±0.54 68.55±0.15 58.93±0.47 96.93±0.34 53.31±0.53 65.29±0.21 51.85±0.18 80.32±0.10 70.25 6.92 OCGTL 88.02±0.43 72.89±0.57 77.76±0.48 63.59±0.11 59.82±0.44 51.89±0.46 59.81±0.30 99.36±0.67 65.27±0.24 75.75±0.47 48.13±0.41 88.03±0.22 70.86 6.33 88.84±0.15 75.86±0.30 74.53±0.11 63.12±0.52 72.87±0.28 80.79±0.38 72.35±0.58 97.60±0.28 70.12±0.61 74.32±0.34 72.45±0.11 85.24±0.45 77.34 4.25 SIGNET GLADC 83.07±0.29 77.43±0.19 76.54±0.25 63.44±0.30 61.25±0.19 68.23±0.31 64.13±0.23 98.02±0.23 65.94±0.26 68.32±0.22 54.32±0.37 78.87±0.56 71.63 6.83 CVTGAD 86.64±0.32 76.49±0.29 78.84±0.40 68.56±0.43 63.23±0.38 77.69±0.28 64.36±0.16 99.21±0.27 † 69.82±0.13 † 69.13±0.58 71.01±0.58 † 87.43±0.60 † 76.03 4.33 MUSE 85.92±0.28 76.87±0.32 79.23±0.35 † 67.82±0.38 † 71.45±0.33 78.34±0.30 65.87±0.29 † 98.95±0.31 67.84±0.27 74.45±0.26 † 67.48±0.36 85.32±0.33 76.63† 3.92 UniFORM 88.45±0.24 † 77.15±0.27 78.56±0.31 69.34±0.41 69.78±0.36 † 79.85±0.32 † 65.12±0.31 98.52±0.22 68.42±0.29 72.93±0.31 66.23±0.38 84.67±0.35 76.58 4.08† GLASS
91.42±0.87 80.63±0.42 79.41±0.49
66.20±0.46
69.38±0.37 80.93±0.38 68.70±0.41
Taking logarithms and dividing by κ gives X 1 log |R| m(u) ≤ log exp(κsr ) ≤ m(u) + . κ κ r∈R
99.32±0.59 77.20±0.35 75.86±0.56 80.29±0.33 88.80±0.69 79.85
1.75
clustering={...}; motifs=triangles/4cycles; core={...}; spectral={...}.
The domain and phase fields describe the deployment episode, while normal/anomaly status is never serialized.
Therefore the scaled log-sum-exp converges uniformly to m(u). B. Single-Domain Results The remaining terms in Eq. (16), namely Cd (κ) and |R|, are Table I reports the full single-domain comparison against independent of u and only contribute a constant aκ after scaling. established graph-kernel and GNN baselines. GLASS obtains Hence the negative log-density is asymptotically equivalent to the best average AUROC (79.85) and the best average rank −m(u), or equivalently to 1 − m(u) = minr∈R (1 − ⟨u, r⟩) (1.75) among the listed baselines. It ranks first on seven datasets because the additive constant 1 does not change rankings. (MUTAG, PROTEINS, BZR, IMDB-B, NCI1, COLLAB, and The proposition gives the exact 1-NN angular limit. The REDDIT-B) and remains top-two on D&D, COX2, and AIDS. reported mean k-NN score with k > 1 is a finite-sample This result profile is consistent with the intended role of the robust extension of this limit: it reduces sensitivity to isolated graph-language bridge: graph neighborhoods preserve strong reference points while preserving the same density intuition. molecular and social structural signals, while frozen text anchors stabilize weakly attributed or structurally transferable VI. E XPERIMENTS datasets. A. Setup The two most difficult cases for GLASS are ENZYMES and We evaluate 12 widely used GLAD benchmarks [35]: DHFR. Both involve fine-grained biochemical semantics that MUTAG, DHFR, BZR, COX2, AIDS, and NCI1 for small are only partially covered by the compact GraphDP vocabulary. molecules; PROTEINS, D&D, and ENZYMES for proteins; and Their behavior is informative rather than contradictory: GLASS IMDB-BINARY, COLLAB, and REDDIT-BINARY for social is strongest when the serialized structural language covers graphs. Training uses normal-class graphs only, and testing the dominant normality factors, and weaker when missing ranks held-out normal graphs against anomalous-class graphs. substructure fields carry a large part of the anomaly signal. We report mean and standard deviation over five seeds, with Table II further shows that simply increasing the frozen text AUROC as the primary metric. Appendix Table V summarizes encoder does not uniformly solve this issue. Larger encoders graph counts, classes, average sizes, node-feature availability, help ENZYMES, but the compact 0.6B encoder remains the strongest or near-strongest choice on most datasets, which and domain groups. The baseline suite includes four graph-kernel detectors (PK- motivates using it as the default backbone. SVM, PK-iF, WL-SVM, WL-iF) and eight GNN-based methods C. Cross-Domain and Few-Shot Transfer (OCGIN, GLocalKD, OCGTL, SIGNET, GLADC, CVTGAD, Table III evaluates directional transfer by changing the MUSE, UniFORM). The main GLASS row uses the spherical reference-set scorer in Eq. (18) across all datasets. Unless normal reference set while keeping the scoring rule fixed. The otherwise specified, the reported configuration uses a frozen strongest regime is molecular-to-protein transfer: source molecQwen3-Embedding-0.6B text encoder and native MRL slices ular references improve PROTEINS by +2.9pp and D&D by {64, 128, 256, 512}; larger frozen encoders and text adaptation +4.6pp over their matched single-domain references, indicating that GraphDP fields such as motifs, degree profiles, density, and are evaluated as ablations. The text input is deterministic and label-free. A typical query low-frequency connectivity can carry compatible substructure semantics across these domains. Protein-to-molecule and socialis: Instruct: Encode the graph description for to-molecule transfer are also stable on AIDS and MUTAG, graph-level anomaly detection. where the target normal geometry is well covered by the source Query: domain=mol; phase=single; nodes={...}; edges={...}; density={...}; degree_q={...}; references. In contrast, transfer into REDDIT-BINARY loses
TABLE II T EXT- ENCODER SCALING (0.6B, 4B, 8B OF Q WEN 3-E MBEDDING M ODEL ) ABLATION IN SINGLE - DOMAIN AUROC (%) ACROSS ALL 12 DATASETS . T HE 0.6B COLUMN IS THE DEFAULT SETTING OF GLASS. Dataset MUTAG PROTEINS D&D ENZYMES DHFR BZR COX2 AIDS IMDB-B NCI1 COLLAB REDDIT-B
0.6B
4B
8B
91.42±0.87 80.63±0.42 79.41±0.49 66.20±0.46 69.38±0.37 80.93±0.38 68.70±0.41 99.32±0.59 77.20±0.35 75.86±0.56 80.29±0.33 88.80±0.69
90.98±1.35 80.10±0.76 80.22±1.25 70.51±0.25 69.03±0.30 79.77±0.10 67.30±0.31 99.38±0.43 76.84±0.38 75.63±0.27 79.16±0.33 88.09±0.74
90.96±1.06 79.46±0.81 78.62±1.28 68.42±0.27 68.25±0.27 80.23±0.18 68.18±0.38 99.41±0.01 75.15±0.39 76.49±0.27 80.42±0.28 87.38±0.36
Dataset
Transfer
Single
∆
IMDB-B† REDDIT-B†
74.65±0.38 69.34±1.61
77.20±0.35 88.80±0.69
−2.6 −19.5
Social → Mol
MUTAG† AIDS†
90.95±0.77 99.38±0.30
91.42±0.87 99.32±0.59
−0.5 +0.06
Mol → Protein
PROTEINS† D&D† ENZYMES†
83.55±0.30 83.99±1.08 62.84±0.21
80.63±0.42 79.41±0.49 66.20±0.46
+2.9 +4.6 −3.4
Protein → Mol
MUTAG† AIDS†
91.81±1.13 99.38±0.30
91.42±0.87 99.32±0.59
+0.4 +0.06
Protein → Social
IMDB-B† REDDIT-B†
73.62±0.48 73.43±1.67
77.20±0.35 88.80±0.69
−3.6 −15.4
All-domain
PROTEINS IMDB-B MUTAG
81.35±0.29 73.61±0.49 89.06±0.54
80.63±0.42 77.20±0.35 91.42±0.87
+0.7 −3.6 −2.4
Mol → Social
k
MUTAG†
PROTEINS†
IMDB-B†
0 1 4 8 16 32 Full Single-domain
74.35±3.68 68.15±3.03 68.96±1.88 77.12±1.47 80.05±1.39 84.54±1.18 88.90±1.13 91.42±0.87
65.59±3.56 73.33±3.04 74.95±2.01 78.24±1.37 79.69±1.11 79.81±0.93 81.95±0.73 80.63±0.42
63.47±3.68 58.97±2.93 62.09±2.47 62.82±1.60 63.50±1.61 63.99±1.34 73.94±0.56 77.20±0.35
D. Ablation Analysis
TABLE III Z ERO - SHOT CROSS - DOMAIN AUROC (%). TARGET DATASETS MARKED † ARE SCORED WITHOUT TARGET- DOMAIN TRAINING .
Source → Target
TABLE IV F EW- SHOT TARGET CALIBRATION (AUROC %). PARAMETERS ARE FROZEN ; k TARGET NORMAL GRAPHS ARE USED ONLY AS REFERENCES .
We have conducted extensive ablation studies on GLASS to clarify the source of the gains. Appendix Table VI shows that no single channel dominates all datasets. Text-only neighborhoods are already strong on AIDS, graph neighborhoods dominate MUTAG and DHFR, and the full scorer is strongest on PROTEINS, MUTAG, and IMDBB among the representative targets. Finite-κ vMF and SMS variants provide the density interpretation, but their performance is not uniformly better than angular reference-set scoring; this supports using the high-concentration k-NN limit as the reported detector. The text-encoder scaling ablation in Table II shows a specificity-transferability trade-off rather than monotone improvement with model size. Finally, the LoRA ablation in Appendix Table VIII shows that adapting the text encoder is highly dataset-dependent, with large degradations on PROTEINS, AIDS, IMDB-BINARY, and COLLAB; this supports freezing the instruction-aware text space and learning graph-side alignment only. E. Discussion: What Transfers?
Our experiment results on cross-domain GLAD identify the following four empirical regimes: First, related biochemical domains transfer well when the source references cover target substructure semantics; this explains the Mol→Protein gains on PROTEINS and D&D. Second, some molecular targets are already well covered by Few-shot calibration uses target normal graphs only as protein or social references, leading to near-lossless transfer additional references, with k = 0 denoting the source-reference on MUTAG and AIDS. Third, few-shot calibration is effective initialization of the same calibration protocol. Table IV shows when the target normal manifold is related but locally miscalithat PROTEINS is the clearest reference-calibration case: one brated, as seen on PROTEINS. Fourth, social targets, especially trusted target normal graph improves AUROC from 65.59 to REDDIT-BINARY, remain hard under biological sources 73.33, and 16–32 target normals bring the score within about because community and interaction semantics differ from one point of the single-domain reference without gradient biochemical substructures. These regimes are also summarized updates. MUTAG improves more gradually after the first few in Appendix Table VII. references, reaching 84.54 at 32 shots, which indicates that This interpretation also clarifies the role of training-time a single normal graph may be unrepresentative for small geometry. Prototypes encourage compact normal modes durmolecular datasets. IMDB-BINARY remains difficult in the few- ing training, but the final detector remains a nonparametric shot regime; its full target-reference row improves substantially, reference-set score. Frozen text anchors keep the structuralbut small reference sets do not cover the broader social-graph language coordinate system stable when the reference set manifold. changes.
15–20pp, confirming that social interaction graphs can assign different anomaly meaning to the same structural statistics. All-domain references improve PROTEINS slightly but dilute MUTAG and IMDB-B, suggesting that source coverage and source weighting matter in broad heterogeneous mixtures.
VII. C ONCLUSION We presented GLASS, a graph-language alignment framework for transferable graph-level anomaly detection. By serializing graphs into compact GraphDP descriptions, anchoring them with a frozen instruction-aware text encoder, aligning graph codes through native Matryoshka hyperspherical slices, and scoring by vMF-inspired reference-set density, GLASS provides a unified and principled view of single-domain, zeroshot, and few-shot GLAD. Across molecular, protein, and social graph benchmarks, the results show that this shared hyperspherical space supports strong in-domain detection and effective transfer when source and target graphs share structurallanguage evidence, particularly between molecular and protein domains. For broader deployments with larger semantic shifts, richer GraphDP vocabularies and source-reference weighting can be incorporated within the same reference-density principle, without changing the core alignment framework. R EFERENCES [1] L. Akoglu, H. Tong, and D. Koutra, “Graph based anomaly detection and description: a survey,” Data mining and knowledge discovery, vol. 29, no. 3, pp. 626–688, 2015. [2] X. Ma, J. Wu, S. Xue, J. Yang, C. Zhou, Q. Z. Sheng, H. Xiong, and L. Akoglu, “A comprehensive survey on graph anomaly detection with deep learning,” IEEE transactions on knowledge and data engineering, vol. 35, no. 12, pp. 12 012–12 038, 2021. [3] H. Qiao, H. Tong, B. An, I. King, C. Aggarwal, and G. Pang, “Deep graph anomaly detection: A survey and new perspectives,” arXiv preprint arXiv:2409.09957, 2024. [4] Y. Zhang, M. Li, D. Long, X. Zhang, H. Lin, B. Yang, P. Xie, A. Yang, D. Liu, J. Lin, F. Huang, and J. Zhou, “Qwen3 embedding: Advancing text embedding and reranking through foundation models,” arXiv preprint arXiv:2506.05176, 2025. [5] X. Wang, Z. Sun, C. Ding, and J. Fan, “Learnable kernel density estimation for graphs and its application to graph-level anomaly detection,” arXiv preprint arXiv:2505.21285, 2025. [6] Y. Liu, K. Ding, H. Liu, and S. Pan, “Good-d: On unsupervised graph out-of-distribution detection,” in Proceedings of the sixteenth ACM international conference on web search and data mining, 2023, pp. 339–347. [7] Y. Wang, Y. Liu, X. Shen, C. Li, R. Miao, K. Ding, Y. Wang, S. Pan, and X. Wang, “Unifying unsupervised graph-level anomaly detection and out-of-distribution detection: A benchmark,” in The Thirteenth International Conference on Learning Representations, 2025. [8] C. Qiu, M. Kloft, S. Mandt, and M. Rudolph, “Raising the bar in graph-level anomaly detection,” arXiv preprint arXiv:2205.13845, 2022. [9] L. Zhao and L. Akoglu, “On using classification datasets to evaluate graph outlier detection: Peculiar observations and new insights,” Big Data, vol. 11, no. 3, pp. 151–180, 2023.
[10] R. Ma, G. Pang, L. Chen, and A. Van Den Hengel, “Deep graph-level anomaly detection by glocal knowledge distillation,” in Proceedings of the fifteenth ACM international conference on web search and data mining, 2022, pp. 704–714. [11] X. Luo, J. Wu, J. Yang, S. Xue, H. Peng, C. Zhou, H. Chen, Z. Li, and Q. Z. Sheng, “Deep graph level anomaly detection with contrastive learning,” Scientific Reports, vol. 12, no. 1, p. 19867, 2022. [12] J. Li, Q. Xing, Q. Wang, and Y. Chang, “Cvtgad: Simplified transformer with cross-view attention for unsupervised graph-level anomaly detection,” in Joint European conference on machine learning and knowledge discovery in databases. Springer, 2023, pp. 185–200. [13] Y. Liu, K. Ding, Q. Lu, F. Li, L. Y. Zhang, and S. Pan, “Towards self-interpretable graph-level anomaly detection,” Advances in Neural Information Processing Systems, vol. 36, 2023. [14] Y. Kim, J. Oh, H. Kim, S. Lim, and C. Park, “Rethinking reconstruction-based graph-level anomaly detection: Limitations and a simple remedy,” in Advances in Neural Information Processing Systems, 2024. [15] Q. Song, X. Gao, W. Zhang, H. Li, Z. Chen, Y. Zhang, Z. Liu, X. Luo, Y. Li, and Y. Ye, “UniFORM: Towards unified framework for anomaly detection on graphs,” in Proceedings of the AAAI Conference on Artificial Intelligence, 2025. [16] M. Neumann, R. Garnett, C. Bauckhage, and K. Kersting, “Propagation kernels: Efficient graph kernels from propagated information,” Machine Learning, vol. 102, no. 2, pp. 209–245, 2016. [17] N. Shervashidze, P. Schweitzer, E. J. Van Leeuwen, K. Mehlhorn, and K. M. Borgwardt, “Weisfeiler-lehman graph kernels,” Journal of Machine Learning Research, vol. 12, no. Sep, pp. 2539–2561, 2011. [18] F. T. Liu, K. M. Ting, and Z.-H. Zhou, “Isolation forest,” in 2008 eighth ieee international conference on data mining. IEEE, 2008, pp. 413–422. [19] C. Cai and Y. Wang, “A simple yet effective baseline for non-attributed graph classification,” arXiv preprint arXiv:1811.03508, 2018. [Online]. Available: https://arxiv.org/abs/1811.03508 [20] J. Adamczyk and W. Czech, “Strengthening structural baselines for graph classification using local topological profile,” in Proceedings of the Northern European Conference on Machine Learning, NEUML 2023, ser. Proceedings of Machine Learning Research, vol. 215. PMLR, 2023, pp. 1–16. [21] B. Fatemi, J. Halcrow, and B. Perozzi, “Talk like a graph: Encoding graphs for large language models,” in International Conference on Learning Representations, 2024. [22] B. Perozzi, B. Fatemi, D. Zelle, A. Tsitsulin, M. Kazemi, R. Al-Rfou, and J. Halcrow, “Let your graph do the talking: Encoding structured data for llms,” arXiv preprint arXiv:2402.05862, 2024.
[23] D. Wang, Y. Zuo, F. Li, and J. Wu, “Llms as zero-shot A PPENDIX : DATASET D ETAILS FOR GLASS B ENCHMARK graph learners: Alignment of gnn representations with In Table V, we give detailed descriptions of the 12 graph llm token embeddings,” Advances in Neural Information datasets used in our study. The datasets span small-molecule Processing Systems, vol. 37, pp. 5950–5973, 2024. graphs, protein graphs, and social networks. For each dataset [24] R. Ye, C. Zhang, R. Wang, S. Xu, and Y. Zhang, we describe the domain background, the classes used for “Language is all a graph needs,” in Findings of the anomaly detection, and the available node features. We reAssociation for Computational Linguistics: EACL 2024. port node features assuming use_node_attr=True when Association for Computational Linguistics, 2024, pp. loading from TUDataset, which includes both discrete node 1909–1923. labels and continuous attributes when available. [25] Z. Hou, Y. He, Y. Cen, X. Liu, Y. Dong, E. Kharlamov, a) Node Feature Implementation Notes: and J. Tang, “Graphmae2: A decoding-enhanced masked self-supervised graph learner,” in Proceedings of the ACM • The use_node_attr=True flag in PyTorch Geometric’s TUDataset loader determines whether continuous node web conference 2023, 2023, pp. 737–746. attributes are concatenated with discrete node labels. [26] H. Liu, J. Feng, L. Kong, N. Liang, D. Tao, Y. Chen, and M. Zhang, “One for all: Towards training one graph model • For small-molecule datasets (DHFR, BZR, COX2, AIDS), the additional attributes typically represent 3D coordinates for all classification tasks,” in International Conference or physicochemical properties. on Learning Representations, 2024. [27] Y. Liu, S. Li, Y. Zheng, Q. Chen, C. Zhang, and S. Pan, • For ENZYMES, the 18 additional attributes capture various “Arc: A generalist graph anomaly detector with in-context amino acid properties including length, hydrophobicity, and learning,” Advances in Neural Information Processing secondary structure characteristics. Systems, vol. 37, pp. 50 772–50 804, 2024. • PROTEINS includes a single continuous attribute repre[28] H. Qiao, C. Niu, L. Chen, and G. Pang, “Anomalygfm: senting physicochemical properties of secondary structure Graph foundation model for zero/few-shot anomaly elements. detection,” in Proceedings of the 31st ACM SIGKDD • Social network datasets lack intrinsic node features; practiConference on Knowledge Discovery and Data Mining V. tioners often compute structural features externally. 2, 2025, pp. 2326–2337. [29] A. Banerjee, I. S. Dhillon, J. Ghosh, S. Sra, and G. RidgeA PPENDIX : P ROTOCOL AND A BLATION D ETAILS way, “Clustering on the unit hypersphere using von mises-fisher distributions.” Journal of Machine Learning A. Evaluation protocol. Research, vol. 6, no. 9, 2005. The evaluation protocol separates representation learning, [30] Y. Ming, Y. Sun, O. Dia, and Y. Li, “How to exploit hyperreference construction, and score evaluation. Single-domain spherical embeddings for out-of-distribution detection?” experiments train on target-domain normal graphs; zero-shot arXiv preprint arXiv:2203.04450, 2022. transfer replaces the reference set by source-domain normals; [31] H. Bai, Y. Ming, J. Katz-Samuels, and Y. Li, “Hypo: few-shot calibration appends trusted target normals at inference. Hyperspherical out-of-distribution generalization,” in InIn all cases, test anomaly labels are used only for metric ternational Conference on Learning Representations, computation. 2024. [32] B. Pelletier, “Kernel density estimation on riemannian Setting in reported experiments manifolds,” Statistics & Probability Letters, vol. 73, no. 3, Item Main score GLASS angular k-NN reference scorer pp. 297–304, 2005. graph-only, text-only, fusion, vMF, and SMS variants [33] E. Garcı́a-Portugués, “Exact risk improvement of band- Ablation scores Target anomaly labels never serialized in GraphDP prompts width selectors for kernel density estimation with direc- Domain/phase information allowed as episode-level context tional data,” Electronic Journal of Statistics, vol. 7, pp. Synthetic-negative status used by training loss; not serialized as text label Zero-shot target data evaluated only; not inserted into references 1655–1685, 2013. Few-shot target normals inserted as references; no gradient updates [34] K. Xu, W. Hu, J. Leskovec, and S. Jegelka, “How powerful are graph neural networks?” in 7th International B. Normal-reference reliability weights Conference on Learning Representations, ICLR 2019, 2019. The main scorer in Eq. (18) uses weights computed from [35] C. Morris, N. M. Kriege, F. Bause, K. Kersting, P. Mutzel, normal references P before evaluation. A fixed ablation sets and M. Neumann, “TUDataset: A collection of benchmark ws = log Ds / Su=1 log Du and αs = 1/2. The default rule datasets for learning with graphs,” in ICML Workshop estimates reliability from normal-reference compactness and on Graph Representation Learning and Beyond (GRL+), cross-view consistency. Let ug,s (G) = z (s) (G), ut,s (G) = 2020. e(s) (G), and let m̄ denote the other modality for m ∈ {g, t}. For each normal reference Gi ∈ R, am,s,i = dk um,s (Gi ), R(s) (19) m \ {um,s (Gi )}
TABLE V S TATISTICS OF THE DATASETS [35] USED IN OUR EXPERIMENTS . E ACH GRAPH - LEVEL DATASET IS CHARACTERIZED BY THE NUMBER OF GRAPHS , CLASSES , AVERAGE NUMBER OF NODES AND EDGES , AND NODE FEATURE DIMENSIONS . T HE “N ODE L ABELS ” COLUMN INDICATES DISCRETE NODE TYPES ( E . G ., ATOM OR AMINO - ACID TYPES ), “N ODE ATTRIBUTES ” INDICATES ADDITIONAL CONTINUOUS ATTRIBUTES , AND “N ODE F EATURES ” SHOWS THE FINAL DIMENSIONALITY WHEN LOADING WITH U S E _ N O D E _ A T T R =T R U E . VALUES IN PARENTHESES SHOW DIMENSIONS WITHOUT ATTRIBUTE LOADING . Dataset PROTEINS D&D ENZYMES MUTAG DHFR BZR COX2 AIDS NCI1 IMDB-B COLLAB REDDIT-B
# Graphs
# Classes
Avg. Nodes
Avg. Edges
Node Labels
Node Attributes
Node Features (w/o attributes)
Domain
1 113 1 178 600 188 756 405 467 2 000 4 110 1 000 5 000 2 000
2 2 6 2 2 2 2 2 2 2 3 2
39.1 284.3 32.6 17.9 42.4 35.8 41.2 25.7 29.8 19.8 74.5 429.6
72.8 715.7 62.1 19.8 44.5 38.4 43.5 27.9 32.3 96.5 2 457.8 497.8
3 SSE types 89 AA types 3 SSE types 7 atom types Atom types Atom types Atom types Atom types 37 atom types – – –
1 – 18 – 3 3 3 4 – – – –
4 (3) 89 (89) 21 (3) 7 (7) 56 (53) 56 (53) 38 (35) 42 (38) 37 (37) 0 (0) 0 (0) 0 (0)
Protein Protein Protein Molecule Molecule Molecule Molecule Molecule Molecule Social network Social network Social network
TABLE VI S CORING ABLATIONS (AUROC %, MEAN±STD OVER FIVE SEEDS ). G RAPH /T EXT /F USION USE INDIVIDUAL OR FUSED ANGULAR k-NN CHANNELS ; V MF AND SMS INSTANTIATE THE DENSITY VIEW; F IXED USES EQUAL GRAPH / TEXT WEIGHTS WITH NORMAL - REFERENCE CALIBRATION ; GLASS USES THE NORMAL - REFERENCE RELIABILITY WEIGHTS HERE . Dataset AIDS IMDB-B PROTEINS MUTAG ENZYMES DHFR
Graph
Text
Fusion
vMF
SMS
Fixed
GLASS
95.52±3.29 68.64±0.39 74.83±0.91 91.07±1.10 69.12±0.40 70.18±0.39
99.79±0.01 74.12±0.51 71.31±1.25 74.20±1.90 62.65±0.26 59.09±0.25
97.09±2.02 74.13±0.40 77.08±0.98 83.19±1.42 69.91±0.64 68.25±0.44
90.67±5.86 68.88±2.39 69.19±1.65 68.96±0.71 64.41±0.89 61.33±0.66
93.92±3.32 65.74±1.11 79.70±0.58 82.30±2.13 62.58±1.09 58.26±0.58
99.77±0.03 77.29±0.35 80.63±0.42 88.77±0.74 66.20±0.46 67.80±0.38
99.32±0.59 77.20±0.35 80.63±0.42 91.42±0.87 66.20±0.46 69.38±0.37
measures leave-one-out compactness. Let µm,s , σm,s , and IQRm,s be the mean, standard deviation, and interquartile range of these scores. Cross-view neighborhood consistency is X 1 bm,s,i = 1 − ⟨um̄,s (Gi ), um̄,s (Gj )⟩ , (20) k j∈NNk (um,s (Gi ))
where neighbors are selected among normal references in modality m. The graph-text alignment residual is D E qs,i = 1 − z (s) (Gi ), e(s) (Gi ) . (21) The reliability penalty and channel reliability are 1 1 πm,s = µm,s + σm,s + IQRm,s 2 2 1 1 1 + b̄m,s + σ(bm,s ) + q̄s + σ(qs ) , (22) 2 2 4 log Ds ρm,s = clip10,90 . max(πm,s , ε)
0 Input: normal training graphs Dtr , optional source references, query graph G. 1. Structural language. Compute LTDs, graph-level aggregates, motif/spectral summaries, and deterministic GraphDP strings. 2. Frozen anchors. Encode GraphDP with the instruction-aware text encoder and obtain native MRL slices by prefix truncation. 3. Graph alignment. Train the GIN encoder and graph-side projections on normal graphs using soft cosine alignment, Gram stabilization, and prototype shaping. 4. Reference construction. Use target normals for single-domain, source normals for zero-shot, or source plus k target normals for few-shot. 5. Spherical scoring. Rank each query by the weighted angular k-NN reference-set score in Eq. (18).
Observed transfer regimes. The same GraphDP fields can be transferable or insufficient depending on target semantics. Table VII summarizes the regimes reflected by Tables III and IV. TABLE VII O BSERVED TRANSFER REGIMES AND EMPIRICAL EVIDENCE . Regime
Evidence
Interpretation
Related-domain gain Near-lossless coverage Few-shot calibration Source dilution Hard target shift Fine-grained gaps
Mol→PROTEINS (+2.9), Mol→D&D (+4.6) Protein→MUTAG (+0.4), Social/Protein→AIDS (+0.06) PROTEINS 65.59 → 79.81 from 0 → 32 shots All-domain helps PROTEINS but lowers MUTAG/IMDB-B REDDIT-B loses 15–20pp under transfer ENZYMES and DHFR remain below the best baselines
shared substructure vocabulary compatible normal geometry target references repair local density heterogeneous references broaden density different social semantics missing biochemical substructure fields
Frozen text anchors versus LoRA. The text-adaptation ablation starts from the same native-MRL graph encoder and tunes only LoRA adapters in the 0.6B text encoder. Table VIII shows that text adaptation is not a stable replacement for frozen anchors: it improves several graph-dominant datasets such as Here clip10,90 denotes percentile clipping across slice/modality BZR, COX2, NCI1, and REDDIT-B, but degrades PROTEINS, reliability values. The final slice and modality weights are D&D, AIDS, IMDB-BINARY, and COLLAB, sometimes by a large margin. The warm-up column separates initialization (ρg,s + ρt,s ) log Ds ρg,s ws = PS , αs = . quality from the tuned adaptation. The main method therefore ρg,s + ρt,s u=1 (ρg,u + ρt,u ) log Du (23) keeps the instruction-aware text space fixed and trains graphAll statistics in Eqs. (19)–(23) use normal references only. side alignment only. GraphDP and implementation summary. GraphDP is a Appendix Table VI shows that this rule adapts to different deterministic key-value serialization. The compact field set modality regimes without using anomaly labels. Algorithmic summary. The following pseudocode high- is deliberately domain-neutral: it captures structural evidence lights that GLASS uses one representation pipeline and one that can be shared across molecular, protein, and social graphs scoring family; deployment changes only the reference set. without inserting class labels or anomaly status.
TABLE VIII F ROZEN TEXT ANCHORS VERSUS L O RA TEXT ADAPTATION UNDER THE DEFAULT 0.6B SETTING (AUROC %). T HE FROZEN COLUMN IS THE SINGLE - DOMAIN GLASS. Dataset MUTAG PROTEINS D&D ENZYMES DHFR BZR COX2 AIDS IMDB-B NCI1 COLLAB REDDIT-B
Frozen
LoRA warm-up
LoRA tuned
∆Warm-up
∆Frozen
91.42±0.87 80.63±0.42 79.41±0.49 66.20±0.46 69.38±0.37 80.93±0.38 68.70±0.41 99.32±0.59 77.20±0.35 75.86±0.56 80.29±0.33 88.80±0.69
90.02±1.41 80.05±0.47 76.23±1.56 65.05±0.73 68.25±0.29 81.33±0.20 69.78±0.42 99.67±0.06 77.91±0.29 78.35±0.44 79.03±0.10 93.50±0.33
90.31±1.22 75.36±0.86 76.24±1.84 67.96±0.63 68.42±0.26 83.51±0.22 70.61±0.32 89.13±2.40 69.47±0.39 78.39±0.43 49.49±0.20 93.74±0.31
+0.29 −4.68 +0.01 +2.91 +0.17 +2.19 +0.82 −10.54 −8.44 +0.04 −29.54 +0.24
−1.11 −5.27 −3.17 +1.76 −0.96 +2.58 +1.91 −10.19 −7.73 +2.53 −30.80 +4.94
fourcycles:77; core=max:4; spectral=gap:0.09, rayleigh_q:0.05/0.27/0.59. Few-shot calibration reference Instruct: Encode this graph description for graph-level anomaly detection. Query: domain=protein; phase=few-shot-reference; trusted_normal=true; nodes=69; edges=152; density=0.065; components=1; degree_q=2/4/6; clustering=0.17/0.06; motifs=triangles:33, fourcycles:84; core=max:5; spectral=gap:0.11, rayleigh_q:0.07/0.30/0.63.
Anomaly status is never included. The field values above are illustrative; the actual prompts are generated deterministically from graph statistics. Complexity analysis. For a graph with n nodes and m edges, LTD extraction is O(m) for degree and clustering-style statistics plus the cost of small-motif estimators; the lightweight Group Fields Purpose spectral sketch with r Lanczos/Chebyshev probes is approxiIdentity graph domain and episode mode scenario context mately O(rm). GraphDP serialization is linear in the number Size nodes, edges, density, components global scale and coverage of retained fields and does not list nodes. Text encoding is a Degree mean, std, entropy, quantiles local connectivity profile one-time cached cost per graph. With N normal training graphs, Clustering local mean/std, transitivity closure/community signal S slices, graph dimension Motifs triangles, 4-cycles, motif density local substructure signal P Dg , and slice dimensions P Ds , graphCore maximum core number centrality/robustness side training costs O( G LGNN · mG · H + N s Ds Dg ) per Spectral gap, Rayleigh quantiles low-frequency connectivity epoch, plus small prototype updates O(N SKDs ). Inference for one query requires exact reference scoring O(S|R|Ds ) Component Reported setting after the graph/text forward pass; approximate cosine nearestGraph encoder 3-layer GIN, mean/max readout, spectral sketch Graph code/slices Dg = 2H + r + 3 = 267 (H = 128, r = 8), Ds ∈ {64, 128, 256, 512} neighbor indexing can replace exact search for large reference Text encoder default Qwen3-Embedding-0.6B, 28 layers, 32K context, 1024-d output sets. Zero-shot and few-shot deployment add no gradient-based Text slices native MRL prefix truncation + ℓ2 normalization Alignment loss soft cosine over paired graph/text slices adaptation: they only change |R|. Projection regularizer dimension-adaptive Gram stabilization in Eq. (11) Runtime and memory considerations. All experiments Prototype phase K = 8 vMF directions, EMA updates, compactness ramp Primary scorer GLASS angular k-NN-limit reference scorer were conducted on a server with 8 × NVIDIA RTX 5090 Few-shot adaptation reference-set update only, no gradient updates GPUs, dual Intel Xeon Gold 6530 CPUs (128 logical cores), Qwen3 embedding backbone. The default text encoder and 512 GiB RAM. The main computational cost is separated is Qwen3-Embedding-0.6B [4]. It is a dense Qwen3-based into an offline text-embedding stage and an ordinary graphcausal Transformer embedding model with 0.6B parameters, side training stage. Let T be the GraphDP token length, Ltxt 28 layers, a 32K-token context window, 1024-dimensional and dtxt the number of Transformer layers and hidden size embeddings, MRL support for flexible prefix dimensions, and of the text encoder, LGNN the number of GNN layers, H instruction-aware inputs. In GLASS, the model is frozen and the GNN hidden size, S the number of slices, and Ds the evaluated once per deterministic GraphDP string; only the slice dimensions. The text encoder forward pass costs approxgraph encoder, graph-side projections, and prototype directions imately O(Ltxt (T + dtxt )T dtxt ) per graph, but all GraphDP are trained. We follow the Qwen3 embedding query convention: embeddings are pre-computed and cached before graph-side an instruction is concatenated with the GraphDP query, and training. Thus the per-epoch training cost is dominated by GNN the final embedding is extracted from the last hidden state at message passing and graph-side projection/alignment. The final the end-of-sequence token. reference-set score is linear in the number of normal references Phase-aware GraphDP prompt examples. All text inputs and can be accelerated by approximate cosine nearest-neighbor share the same instruction and deterministic key-value fields. indices in large deployments. What’s more, during inference, The phase token describes how the embedding will be used, increasing the zero-/few-shot reference set changes nearestnot the graph label. Representative prompts are: neighbor storage and lookup but introduces no additional Single-domain/reference anchor Instruct: Encode trainable parameters and negligible computational complexity. this graph description for graph-level anomaly detection. Query: domain=protein; phase=single-reference; nodes=62; edges=145; density=0.076; components=1; degree_q=2/4/6; degree_entropy=1.71; clustering=0.18/0.07; motifs=triangles:38, fourcycles:91; core=max:5; spectral=gap:0.12, rayleigh_q:0.08/0.31/0.66. Zero-shot target query Instruct: Encode this graph description for graph-level anomaly detection. Query: domain=protein; phase=zero-shot-query; source_domain=mol; nodes=74; edges=161; density=0.060; components=1; degree_q=2/4/5; clustering=0.14/0.05; motifs=triangles:21,
Step
Complexity
Comment
LTD extraction Spectral sketch GraphDP text encoding Graph-side training Prototype shaping Reference scoring
O(m) + motif estimator O(rm) O(L Ptxt (T + dtxt )T dtxt ) P O( G LGNN mG H + N s Ds Dg ) O(N SKDs ) O(S|R|Ds )
deterministic structural evidence r Lanczos/Chebyshev probes one-time cached cost per epoch small K and S exact cosine k-NN