Generalizable Graph-level Anomaly Detection via Prompted Anomaly Expansion and Normality Extraction

Anomalous graphs, representing rare but critical deviations from normal graphs, frequently arise in high-stakes domains such as malicious website detection. Detecting them is highly challenging due to two key issues: (i) labeled anomalous graphs are extremely limited and fail to capture the diversity of real-world abnormality, restricting detection models from generalizing to unseen anomalies encountered in the open world, and (ii) normal graphs often contain spurious or atypical substructures that do not indicate anomalies but may induce models to misclassify normal variations as anomalies. To tackle these challenges, we propose G-GLAD, a generalizable graph-level anomaly detection framework. G-GLAD introduces two key innovations: (1) prompt-based anomaly space expansion, which injects learnable prompts into the graph representation process of known anomalies to simulate diverse unseen anomalous variants. This allows the model to learn a richer and more generalizable anomaly space; and (2) subgraph-based normality extraction, guided by the Information Bottleneck Principle, which isolates essential substructures for normality prediction while filtering out spurious motifs, improving robustness against structural noise. We conduct extensive experiments on ten real-world graph datasets under different empirical settings. The results demonstrate that G-GLAD achieves superior performance and generalizability in identifying anomalous graphs.