A Graph Foundation Model for Unified Anomaly Detection

Graph anomaly detection (GAD) identifies nodes, edges, and subgraphs that deviate from normal patterns, playing a key role in cybersecurity, finance, and web technologies. However, existing deep learning paradigms trained on fixed datasets struggle to generalize to unseen graphs, while current graph foundation models (GFMs) face inherent challenges in anomaly detection. Their generalization objectives conflict with the rarity and divergence of anomalies, and existing attempts to develop GFMs for GAD mainly fall into two directions: single-task cross-domain models and domain-specific multi-task models. The former transfers knowledge across domains but fails to capture cross-level dependencies, whereas the latter handles multiple tasks jointly but lacks cross-domain adaptability. Both rely heavily on labeled data, limiting scalability. These limitations highlight the need for a unified unsupervised graph foundation model capable of generalizing across domains and detecting anomalies at multiple levels. We propose GFM-UAD, a Graph Foundation Model for Unified Anomaly Detection. It is pretrained on a single dataset and performs multi-level anomaly detection across unlabeled domains. To address anomaly scarcity, GFM-UAD extracts high-confidence normal samples and synthesizes diverse anomalies through adversarial generation. By freezing the backbone and fine-tuning the detection head with distribution alignment and message passing, the model adapts flexibly to unseen environments without supervision. Experiments across multiple datasets demonstrate that GFM-UAD achieves superior accuracy and generalization, establishing a foundation for future unsupervised graph foundation models in anomaly detection.