New recipes for graph anomaly detection: Forward diffusion dynamics and graph generation

Q3: Is it possible to extend the diffusion model to a case where A is changed over time?

R5: We appreciate the reviewer's interests in extending diffusion models to gradually corrupt the graph structure. It is worth noting that in the context of anomaly detection on static attributed graphs, the adjacency matrix contains binary/discrete values 1 and 0 to indicate the presence of edges. Different from the continuous node features, simply adding Gaussian noise to the discrete graph structure cannot meet the demand for gradually corrupting the graph structure, and from the equivalent score-based diffusion perspective [1] [2], calculating the derivative of a discrete-valued variable in the diffusion process is non-trivial. In fact, applying denoising diffusion models for discrete data remains an open problem and we recognize this as a potential research direction to detect anomalies.

Q4. Please clarify:

• In Eq. (18), should one of the $\mathbf{Z}_t$ in the concatenation of the first GCN layer be $\mathbf{\bar{Z}}_t$? R6.1: No, $\mathbf{\bar{Z}}_t$ is concatenated only in the last layer.

• In Eq. (4), specify that this is the accumulated energy ration at rank $l$ R6.2: Thanks to the constructive comment. Eq. (4) is to the measure the accumulated energy ratio at rank $l$. We have revised the description above Eq. (4) as:

  • We further delve into the overall ratios of low and high frequency signals with regard to different thresholds at each step t by measuring the accumulated energy ratio at rank l following Tang et al. (2022).

• p.2: Confronting -> Adhering to the principles, p.5: Eventual -> Eventually

• R6.3: Point taken. We have corrected both typos in the revision.

Dear Reviewer 1PRg,

We greatly appreciate your valuable time and constructive comments. We are pleased that you found our paper to be clear and of good quality. We hope our answers can fully address your concerns.

W1 and Q1: In the preliminary study setup, the attribute distribution chosen for anomalous nodes is substantially different from that of the normal nodes. When noise is incrementally added through diffusion steps, it is not surprising that the egonet dissimilarity drops faster for anomalous nodes. Is Observation I an expected result? If so, why?

R1: Yes, Observation I aligns with our expectations. In our preliminary study, we set the attribute distribution of contextual anomalies to be substantially different from normal nodes, following the definition in [1], [2], [3]. According to the definition, contextual anomalies are generated by different mechanisms, and their attributes significantly differ from those of their neighbors. Our preliminary study setup adheres to the implementation in [4]. We provided the rigorous analysis of this phenomenon through the proof of Proposition 1 in Appendix B.

W2: The authors show that this rapid egonet dissimilarity decrease holds for CORA dataset, but the anomalies in the data were synthetically injected by Liu et al., 2022. For organic anomalies, this assumption might also be true on average (Liu et al., 2022), but the fact that DiffAD does not account for structural anomalies will likely prevent it from detecting anomalies if their initial egonet dissimilarity is low. A fundamental question not addressed by the paper is: what is the anomaly detection performance on anomalous nodes whose initial ego dissimilarity is low?

R2: In this paper, we assessed DiffAD's performance on three real datasets, namely, YelpChi, Reddit, and Weibo, apart from the synthesized datasets published in [1], i.e., CORA, ACM, BlogCatalog. Furthermore, we have conducted additional experiments on another three real-world datasets: Tfinance, Tolokers, and Questions, as reported in our General Response to All Reviewers - Additional Experiments. Overall, we have validate DiffAD's efficacy on six real datasets and three synthetic datasets. From the experimental results, even though these datasets encompass different types of anomalies, including contextual and structural anomalies, DiffAD consistently achieves superior performance compared to the baselines (three new methods have been added).

We also want to emphasize that in real-scenarios, some anomalies can be categorized as both contextual anomalies and structural anomalies (such as the anomalies in Weibo dataset [3]). In addition, to detect contextual anomalies, we have explored both the graph structure and attributes. Although our proposed methods do not explicitly measure the abnormal structural patterns, some structural anomalies can also be detected due to their irregular attributes. From the results on Reddit, in which the outliers in the Reddit have similar average neighbor feature similarities for outliers and inliers [3] and the initial egonet dissimilarity is low, we can see that DiffAD achieves the best results with regard to all metrics.

W3: It is not clear how to extend these principles to consider for structural anomalies. The paper dismisses the need to consider structural anomalies that "form more densely [connected] links with other nodes", but there could be anomalies that also keep the density somewhat unchanged.

R3: Structural anomaly detection is a significant are. In fact, the GCN classifer employed in DiffAD is capable of detecting structural anomalies - just as the conventional GCN-based anomaly detectors employed in many existing methods like [5] [6]. For anomalies that exhibit similar density, we can explore how their attributes are different from their neighbors for detecting anomalies, which is the focus of this work.

Q2: A fundamental question not addressed by the paper is: what is the anomaly detection performance on anomalous nodes whose initial ego dissimilarity is low?

R4: Good question. In fact, we have also studied this in our experiment. We specifically include Reddit, where the outliers in the Reddit have similar average neighbor feature similarities for outliers and inliers [3] and the initial egonet dissimilarity is low, to validate these questioned scenarios. From the results reported in Tables 1 and 4, we can see that DiffAD achieves the best results with regard to all metrics.

[1] Graph based anomaly detection and description: A survey (DMKD 2015).

[2] A comprehensive survey on graph anomaly detection with deep learning (TKDE 2021).

[3] BOND: Benchmarking unsupervised outlier node detection on static attributed graphs (NeurIPS 2022).

[4] Rethinking graph neural networks for anomaly detection (ICML 2022).

[5] Dagad: Data augmentation for graph anomaly detection (ICDM 2022).

[6] Deep anomaly detection on attributed networks (SIAM 2019).

Dear Reviewer 1PRg,

Regarding your concern on structural anomaly detection, we would like to revise our prior response to your R3 that the GCN classifer employed in DiffAD is capable of detecting structural anomalies following the message-passing scheme - just as the conventional GCN-based anomaly detectors employed in many existing methods, such as DAGAD [1] and other unsupervised detectors DOMINANT [2]. The experimental results on nine datasets validate the superiority of our method over the baselines. We will revise the manuscript with these details.

[1] Dagad: Data augmentation for graph anomaly detection (ICDM 2022).

[2] Deep anomaly detection on attributed networks (SIAM 2019).

We sincerely hope that our response can address all your concerns.

Dear Reviewer GBF8,

Thanks for your valuable review and the recognition of integrating graph generation for anomaly detection. We provide detailed answers to your questions as follows, and we hope that our response can address your concerns.

W1: Graph anomaly detection often includes two types: attribute anomalies and structural anomalies. The author disrupts the original distribution by continuously injecting noise, which may be useful for detecting attribute anomalies. However, is this also effective for detecting structural anomalies?

R1: Our GCN classifier employed in DiffAD is capable of detecting structural anomalies following the message-passing scheme - just as the conventional GCN-based anomaly detectors employed in many existing methods, such as DAGAD [4] and other unsupervised detectors DOMINANT [5]. The experimental results and cases studies in Section 7 demonstrate the efficacy of our proposed method.

W2: When injecting scheduled noise to node attributes as the forward diffusion process, anomalies’ egonet dissimilarities change more dramatically than normal nodes, Please provide a clear explanation for this phenomenon. To calculate egonet dissimilarities, you utilize the formula: LX, which is a graph convolution operation without learnable parameters, why LX can be egonet dissimilarities?

R2: We explained this Observation I in Section 4.2 with a rigorous proof of Proposition 1 in Appendix B. Regarding your question on the egonet dissimilarity, since $\mathbf{L}\mathbf{X} = (\mathbf{I} - \mathbf{D}^{\frac{1}{2}}\mathbf{A}\mathbf{D}^{\frac{1}{2}})\mathbf{X}$, for each row $i$ in $\mathbf{L}\mathbf{X}$, the value of the $j$-th column denotes how node $v_i$'s attribute is different from its egonet neighbors (1-hop neighbors) regarding the $j$-th node feature. Therefore, row $i$ in $\mathbf{L}\mathbf{X}$ denotes how node $v_i$'s attributes are different from its egonet neighbors, which is the egonet dissimilarity defined in Section 2. Notably, $\mathbf{A}$ does not contain self-links.

Q1: Why are the results of the baseline methods you listed far lower than those reported in their paper? For example, GCN/GAT/GraphSage on Cora/ACM datasets.

R3: The original GCN, GAT and GraphSAGE are for node classification on pure Cora/ACM datasets. However, in graph anomaly detection, these datasets have been pre-processed by injecting anomalies [3]. We use the synthesized Cora/ACM datasets published in previous graph anomaly detection papers and the links for these datasets are also provided in our anonymous github.

Q2: Baselines are too few to demonstrate the superiority of your method, you should choose some famous GAD methods, such as COLA, SL-GAD rather than GCN GAT, etc.

R4: Thanks for the constructive comment. We have conducted additional experiments with three most recent semi-/supervised baselines and two contrastive detectors, i.e., CoLA and CONAD, and the results are reported in the General Response to All Reviewers - Additional Experiments. From the results, we can see that our method outperforms all baselines.

[1] Score-Based Generative Modeling through Stochastic Differential Equations (ICLR 2020).

[2] Understanding Diffusion Models: A Unified Perspective (arxiv 2022).

[3] BOND: Benchmarking unsupervised outlier node detection on static attributed graphs (NeurIPS 2022).

[4] Dagad: Data augmentation for graph anomaly detection (ICDM 2022).

[5] Deep anomaly detection on attributed networks (SIAM 2019).

Q4: Concerning loss function (Eq. 22), it's vital to ensure that the nodes in the graph $\mathcal{G}_a$ generated using denoising techniques align with the class of the original graph $\mathcal{G}$. Any inconsistencies could lead to conflicting optimization. Specifically, for an anomaly $v_i$ in graph $\mathcal{G}$, how to ensure the generated corresponding node $v_i$ in $\mathcal{G}_a$ is also an anomaly?

R4: We appreciate the reviewer for raising an insightful question regarding the consistency between the generated graph $\mathcal{G}_a$ and $\mathcal{G}$. Indeed, this aspect is pivotal for generating additional samples to enhance detection performance. Within the DDPM framework, this consistency subjects to the denoising neural network's ability to learn the original data distribution.

In our work, we aim to ensure this consistency by adhering to the two principles detailed on Page 5, as elaborated through our preliminary studies in Section 4. Specifically, by Principle I, we aim to ensure the prior distribution $p(\mathbf{X}_a|\mathbf{A})$ of the generated graph aligns with the original distribution $p(\mathbf{X}|\mathbf{A})$, enabling the classifier to learn a more effective decision boundary to distinguish anomalies and by Principle II, we expect to recover the low frequency energy to discriminate nodes in different classes, i.e., anomalous and normal.

Our proposed DiffAD model achieves both by employing GCN to capture the original graph $\mathcal{G}$'s local semantics and recover low frequency signals. We empirically validate the effectiveness of the generated graphs through extensive experiments in Section 7.2. The experimental results not only demonstrate the performance of DiffAD but also the efficacy of the generated graphs on boosting existing detectors, detailed in Section 7.3.

Q5: Although unsupervised methods cannot make use of label information, many of them [2] [3] also leverage local inconsistencies for anomaly detection. Providing a comparative analysis against these existing methods would help establish DIFFAD's superiority effectively.

R5: Thanks for the constructive comment. For the limited space, we have added a discussion on these methods exploring local inconsistencies for anomaly detection in the related works in Appendix A.1.

-Notably, there are plenty of unsupervised anomaly detection techniques, such as CONAD [2], SL-GAD [3] and Sub-CR [4], that investigate the consistency between anomalies and their neighbors in different contrastive views to measure node irregularity. While these methods investigate the egonet dissimilarity for anomaly detection, they only focus on the original graph, and the dynamics of egonet dissimilarity in the forward diffusion process remains unexplored.

Q6: The proposed method looks a bit complicated and it would be nice to have comparisons in terms of complexity and computational efficiency.

R6: Per your suggestion, we have added the complexity analysis in Appendix I.

[1] GADBench: Revisiting and Benchmarking Supervised Graph Anomaly Detection (NeurIPS, 2023).

[2] Anomaly detection on attributed networks via contrastive self-supervised learning (TNNLS 2021).

[3] Generative and contrastive self-supervised learning for graph anomaly detection (TKDE 2021).

[4] Reconstruction Enhanced Multi-View Contrastive Learning for Anomaly Detection on Attributed Networks (IJCAI 2022).

Dear Reviewer JRWq,

We greatly appreciate your valuable time and constructive comments. We hope our answers can fully address your concerns.

Q1: The primary focus of this paper is on contextual anomalies that exhibit marked differences from their neighbors. However, it raises concerns about the representativeness of such anomalies in real-world diverse datasets. This could limit the applicability of the proposed approach. To address this, expanding the experimental evaluation to real datasets[1] would enhance the paper's contributions.

R1: We have conducted additional experiments on three more real-world datasets in [1], and the results are reported in the General Response to All Reviewers - Additional Experiments. It is worth mentioning that we already reported the results on the YelpChi, Reddit and Weibo datasets (in Tables 1 and 4), which are all collected from real-world websites.

Q2: While it is intuitive that adding noise would lead to a rapid drop in egonet dissimilarity for anomalies, it raises questions about whether complex methods in Approach I are necessary for anomaly detection. At the initial stages, the egonet dissimilarity of anomalies significantly outweighs that of normal instances as illustrated in Fig.2. Therefore, it's worth considering if exploiting this difference directly could lead to more efficient detection.

R2: Thank you for the insightful comment. In fact, the example in Fig. 2 is to illustrate our motivation of Approach I. The node feature in this preliminary study is 1-dimensional, as claimed in Section 4.1 - The node attributes are randomly drawn from two Gaussian distributions, N(1, 1) for the normal class and N(1, 5) for anomalies, following Tang et al. (2022).

Given the high dimensionality of data in real-scenarios, the egonet dissimilarity will be divergent in each dimension. Such multi-dimensional data and pattern pose significant challenges to detect anomalies based on egonet dissimilarity at the initial stage, and this is one of the pivotal reasons for employing deep learning techniques for high-dimensional data analysis and graph anomaly detection. To this end, we propose two methods in Approach I to explore such patterns. Investigating other simple, effective methods based on egonet dissimilarity for high-dimensional graph data learning is a promising direction worth exploration.

Q3: The experimental results in Table 1 highlight that Propositions 1-based methods (FSC, TRC) often fail to outperform baseline approaches on multiple datasets. This further emphasizes the need to scrutinize the necessity and validity of Approach I.

R3: From the results on Weibo dataset, we can see that FSC and TRC methods achieve better results than others and we attribute this to the significantly lower feature similarities between anomalies and normal nodes (0.004 vs. 0.993), which makes anomalies’ trajectories easier to be distinguished from normal nodes (in Section 7.2). Although their performance are not the best on other datasets, we propose FSC and TRC to explore novel clues for graph anomaly detection and our experiment demonstrate that when the egonet dissimilarity is significant, FSC and TRC are even more effective than the baselines.

Regarding your concern on structural anomaly detection, in addition to our prior response R3-C3, we would like to highlight that the GCN classier employed in DiffAD is capable of detecting structural anomalies following the message-passing scheme - just as the conventional GCN-based anomaly detectors employed in many existing methods, such as DAGAD [1] and other unsupervised detectors DOMINANT [2]. We will revise the manuscript to include these details.

[1] Dagad: Data augmentation for graph anomaly detection (ICDM 2022).

[2] Deep anomaly detection on attributed networks (SIAM 2019).

We sincerely hope that our response can address all your concerns, and we will gladly answer any additional questions you may have.

Dear Authors,

Thanks for your reply. After carefully reading all comments and responses, I keep my rating unchanged. The proposed idea is interesting, but the method is a bit complicated and the performance improvment is limited. Moreover, the consideration about structural anomalies is also missing, limiting the applicability of the proposed approach.

Best Regards

Dear Reviewer JRWq,

Thanks very much for your response. We are delighted that you recognize our proposed idea interesting. To address your concerns, we make the following clarification.

C1. The method is a bit complicated.

R1-C1. Graph anomaly detection is naturally a complicated problem, given the high-dimensional graph attributes and complex structure. In this paper, we have proposed two novel approaches to identify novel clues for graph anomaly detection (Approach I, the implementations include FSC, TRC-MLP and TRC-TRANS), and address the shortage of labeled training data (Approach II, DiffAD). All our methods are not more complicated than the corresponding and fundamental LSTM, MLP, Transformer and GCN models.

From the results, we can see that our best method outperforms the baselines on nine widely-used datasets. We'd also like to highlight that our Approach I provides a novel view on how anomalies are different from normal nodes - anomalies' evolving patterns are different from normal nodes in the diffusion process, and our Approach II is feasible of tackling the shortage of labeled anomalies, which is a primary and significant challenge in anomaly detection, by synthesizing high-quality and auxiliary samples.

C2. The performance improvement is limited.

R2-C2. From the results in General Response to All Reviewers and Table 4 in the manuscript, we can see that our methods achieve significantly better performance, as also recognized by Reviewer Ak28. For your reference, we report the performance gap between the baselines and our method ($\text{our methods' best result} - \text{baseline's result}$) in General Response to All Reviewers - Performance gap. We also conduct pairwise t-test (with a 95% level of confidence) to demonstrate the significance of improvement and the results are provided in our General Response to All Reviewers - Statistical significance of performance improvement.

Moreover, as explained in R1-C1, our generated graphs can also significantly improve the performance of the baselines.

C3. The consideration about structural anomalies is also missing, limiting the applicability of the proposed approach.

R3-C3. Thanks for the constructive comment. It is true this our work primarily focuses on anomalies that exhibit deviating attributes compared to their egonet neighbors.

However, in addition to our R2 to Reviewer 1PRg, we want to emphasize that categorizing graph anomalies as structural or contextual is to describe how anomalies distinct to normal nodes with respect to the graph structure and attributes. An anomalous node can belong to both categories and some structural anomalies can also be detected due to their irregular attributes. Therefore, our methods are capable of detecting structural anomalies that exhibit these characters, such as those in the widely-used Weibo dataset [1]. Furthermore, the competitive results of BWGNN, which is designed only for contextual anomaly detection, align with our argument, while our best-performing method surpasses the overall performance of the baselines.

Lastly, we state that we target contextual anomaly detection to concisely formulate the problem - we explore both the graph structure and attribute to identify anomalies that exhibit deviating attributes to their neighbors (defined in Section 2).

We sincerely hope that our response can address your concerns, and we will gladly answer any additional questions you may have.

[1] BOND: Benchmarking unsupervised outlier node detection on static attributed graphs (NeurIPS 2022).

[2] Rethinking graph neural networks for anomaly detection (ICML 2022).

Dear Reviewer Ak28,

Thank you for your insightful review. We provide detailed answers to your questions as follows, and we hope that our response can address your concerns.

W1: The definition of 'ego-net dissimilarity' is actually a GNN embedding in literature, so 'dissimilarity' is an inaccurate word.

R1: Thanks for the reminder. In this paper, we employ 'egonet dissimilarity' to specifically denote how each node's attributes are different from its egonet neighbors. We have revised the footnote on Page 3 to clarify this and to remove confusion, we can change it to 'egonet proximity' for the same purpose in the final version.

• To eliminate confusion, we use 'egonet dissimilarity' to specifically denote how each node's attributes differ from its egonet neighbors, distinct from the embedding method used in previous works.

W2: The time complexity should be very high due to the nature of the transformer and DDPM.

R2: For the transformer model (TRC-Trans), its complexity is the same as other graph transformer models. In the meanwhile, we present a skip-step algorithm in Section 5.1 to reduce the computational cost and the impact of this skip-step algorithm is also validated in Appendix J.6. For the generative method (DiffAD), it is true that our sampling process also needs to reverse the diffusion step by step, the same as the DDPM models.

In fact, reducing the computational cost of the Transformer model and accelerating the DDPM sampling process are currently hot research areas. These topics remain under investigation, and since this work primarily focuses on anomaly detection, we defer further enhancements to these methods to our future research efforts. In addition, with regard to your concern on the complexity, we have presented the complexity analysis in Appendix I.

W3: The motivation is to learn to classify anomalies and normal nodes by not explicitly learning the data distribution, therefore you propose to learn from the trajectories produced by the forward process. I don't see a strong motivation for data generation for detectors.

R3: Thanks for your recognition of our Approach I, which focuses on learning the diffusion dynamics for anomaly detection. In our generative Approach II, we address the challenge of limited knowledge and labeled anomalies in real scenarios by augmenting the number of labeled training data. This augmentation enables the classifier to learn a more effective decision boundary. The experimental results in Table 2 (Section 7.3) demonstrate that the generated graphs significantly enhance the detection performance of all existing anomaly detectors.

W4 and Q1: The training process for the whole is not clear. How do you train the overall DDPM model?

R4: As summarized in Lines 1-9 in Algorithm 1 in Appendix I, the DDPM model is trained following the objective formulated in Eqs. (20) and (70). Specifically, we take an arbitrary time step $t$ and train the SDN and DEN to predict the added noise $\boldsymbol{\epsilon}_t$ with regard to $\mathbf{X}_t, \mathbf{A}$ and $t$ until the model converges. For clarity, we add a paragraph in Appendix I to summarized the whole training process.

• For training the generative model, we take an arbitrary time step $t$ from $\{0,\dots, T\}$ and train the SDN and DEN to predict the added noise $\boldsymbol{\epsilon}_t$ with regard to $\mathbf{X}_t, \mathbf{A}$ and $t$. All the parameters in the generative model are fine-tuned until the training objective, as formulated in Eq. (20), converges...

W5: DiffAD still needs sufficient data in order to train the model while anomalous nodes are usually very few.

R5: It is true that (semi-)supervised anomaly detectors need sufficient data to learn a robust decision boundary. In this work, we mitigate the shortage of labeled anomalies by designing DiffAD to generate additional samples that align with the original graph data distribution without using labeled data. We then take advantage of the few labeled anomalies and the generated auxiliary node features to boost the detection performance. In our experiment, we simulate the real-scenario by setting the training ratio to 20%. For more extreme cases, where only one or two nodes are labeled, these remain open problems that we will devote more effort to in the future.

Q2: Why does the forward process need a separate loss function that utilizes the label information?

R6: We propose three methods, namely FSC, TRC and DIFFAD, for graph anomaly detection. In FSC and TRC, we train classifiers to identify anomalies with regard to the dynamics of the egonet dissimilarity. Therefore, label information is utilized. However, in DiffAD, the forward and reverse process involves no label information for graph generation, as formulated in Eqs. (20) and (70).

Dear Reviewer o8nC,

Thanks for your valuable time and review. We have conducted additional experiments and analyzed the algorithm complexity in the revision. Below, we provide detailed answers to your questions, and we hope that our response can address your concerns.

W1: Limited experimental evaluation. No discussion of ablation or hyperparameter turning.

R1: For space limitation, we reported the additional ablation study and hyperparameter sensitivity analysis in Appendix J. These case studies are also referred to in Section 7:

• We report additional experiments on exploring the impact of the generated graphs, key parameters and the skip-step algorithm, as well as an ablation study in Appendix J.

W2 and Q1: No comparison to recently-proposed methods for graph anomaly detection, such as CoLA [1] or CONAD [2]. The justification is that such methods are not classifiers and the just assign an "anomaly score" to nodes. However, one could try a simple baseline of thresholding this anomaly score. Would it be possible to compare the proposed method to contrastive detectors by applying a threshold?

R2: To address your concern about baselines, we have compared DiffAD with three up-to-date semi-/supervised methods and two contrastive detectors, i.e., CoLA and CONAD, on three additional datasets, as reported in the General Response to All Reviewers - Additional Experiments. From the results, we can see that our method outperforms all baselines on all datasets.

W3 and Q3: No discussion of running time. What is the computational complexity of the proposed method as a whole?

R3: Thanks for the constructive comment. We have added the complexity analysis in Appendix I.

W4 and Q2: No discussion of inference for the DDPM. How is the inference for the DDPM performed?

R4: We provided the discussion on the reverse process (inference) in Section 3.2 and Appendix A.2. Our inference algorithm (formulated in Eq. (21)) was explained in Section 6.2 and Appendix H.

[1] Anomaly detection on attributed networks via contrastive self-supervised learning (TNNLS 2021).

[2] Contrastive attributed network anomaly detection with data augmentation (PAKDD 2022).

W3: The principle derived from the first observation is not surprising, i.e., "The denoising neural network should be capable of capturing the local information in egonets". In fact, I would argue that this principle is the bedrock of nearly all graph anomaly detection models.

R3: The denoising neural network is not for distinguishing anomalies; rather, it is proposed to reverse the diffusion process for graph generation, as explained in Section 3.2 and Section 6.1 - Our goal is to learn the original graph data distribution through the reverse process, which can be practically described as to learn a denoising network and we train a two-layered GCN classifier with the generated graphs (detailed in Section 6.3) for detecting anomalies.

W4: The baselines used in the experiments are relatively inadequate, particularly in the second group. I would suggest the authors to add more baselines in the comparisons, such as: GHRN [1], GDN [2], H2-FDetector [3], GAGA [4] etc.

R4: Thanks for the constructive comment. We have conducted additional experiments with three recent baselines and the results are reported in the General Response to All Reviewers - Additional Experiments. Notably, we exclude GDN [2], H2-FDetector [3] and GAGA [4] because these methods are designed for fraud detection in heterogeneous graphs with more than two types of edges, which is beyond the scope of this paper. Meanwhile, we have cited them in the revision to acknowledge their significance.

[1] Yuan Gao, Xiang Wang, Xiangnan He, Zhenguang Liu, Huamin Feng, and Yongdong Zhang. Addressing heterophily in graph anomaly detection: A perspective of graph spectrum. In Proceedings of the ACM Web Conference 2023, pp. 1528–1538, 2023a.

[2] Yuan Gao, Xiang Wang, Xiangnan He, Zhenguang Liu, Huamin Feng, and Yongdong Zhang. Alleviating structural distribution shift in graph anomaly detection. In Proceedings of the Sixteenth ACM International Conference on Web Search and Data Mining, pp. 357–365, 2023b.

[3] Fengzhao Shi, Yanan Cao, Yanmin Shang, Yuchen Zhou, Chuan Zhou, and Jia Wu. H2-fdetector: A gnn-based fraud detector with homophilic and heterophilic connections. In Proceedings of the ACM Web Conference 2022, pp. 1486–1494, 2022.

[4] Yuchen Wang, Jinghui Zhang, Zhengjie Huang, Weibin Li, Shikun Feng, Ziheng Ma, Yu Sun, Dianhai Yu, Fang Dong, Jiahui Jin, et al. Label information enhanced fraud detection against low homophily in graphs. In Proceedings of the ACM Web Conference 2023, pp. 406–416, 2023.

Dear Reviewer nduN,

Thanks very much for your valuable comments. Regarding your concerns on the presentation, diffusion process and baselines, we have carefully revised the manuscript and conducted additional experiments. We hope our answers can fully address your concerns.

W1: One of my biggest concerns about this paper is its clarity of presentation. The paper is hard to understand. One factor is that the authors did not describe enough about how the diffusion process works on graphs. Section 3.2 only explains the generic diffusion process on regular data (x). How it applies in the context of graphs, which contain structure and attributes, is not clearly explained. After explaining Section 3.2, the authors directly jump to the graph observations without explaining how the diffusion process on graphs works.

R1: We provided preliminaries on the forward graph diffusion process in Section 2 - The forward graph diffusion is referred to as injecting $T$ scales of scheduled noise to node attributes with the fixed graph structure, which is to gradually add scheduled Gaussian noise to the original data $\mathbf{x}_0$ through a $T$-step Markov chain such that the eventual distribution at the last step q($\mathbf{x}_T$ |$\mathbf{x}_0$) ∼ $\mathcal{N}(0, \mathbf{I})$, formulated in Eq. (1) in Section 3.2. Per your comment and for space limitation, we have added another paragraph at the end of A.2 in Appendix A to better explain the forward graph diffusion process.

• In this work, we investigate the DDPM framework specifically for graph anomaly detection and following our definition in Section 2, our forward graph diffusion process is to inject scheduled noise to the node attributes, $\mathbf{X}$, and the graph structure is fixed at all diffusion steps.

W2.1: How does the structure of the graph (A) contribute to the next node feature representation $\mathbf{X}_{t+1}$?

R2.1: In the forward diffusion process (as explained in Section 2), we fix the graph structure $\mathbf{A}$ and it does not affect the corrupted node features $\mathbf{X}_{t+1}$ at the next diffusion step.

W2.2: Any effect of the neighboring node on a particular node representation in the next step?

R2.2: In addition to R2.1 and following the DDPM framework, for a specific node $v_i$, its neighbors do not affect the corrupted node features $\mathbf{x}_{t+1}$ at $t+1$ in the forward diffusion process. However, it is worth noting that when measuring the egonet dissimilarity and graph energy distribution in the forward process, we can observe divergent evolving patterns between anomalies and normal nodes (our observation I), as well as the graph energy shifts (observation II).

In the reverse process, to obtain $\mathbf{X_t}$ from $\mathbf{X_{t+1}}$ and ensure that the generated graph adheres to the original graph semantics, we investigate GCN as a low-pass filter to recover low-frequency signals, following our devised design principles I and II in Section 4. From the spatial view, GCN is aggregating neighboring nodes' information to the target node; thus, neighbors will affect the target node in the reverse process. This can be considered as to generate node attributes conditioned on their neighbors and graph structure, which meets our expectation on synthesizing graphs that adhere to the original graph semantics.

W2.3: The diffusion process itself tries to model the data distribution, i.e., for graph cases, it models the data distribution of G={A, X}. As the first approach utilizes the diffusion information, why do the authors claim that the approach does not need to learn P(A, X)?

R2.3: We appreciate the reviewer's insightful comment. By claiming we first explore a novel paradigm to detect anomalies on a static graph without the need to explicitly learn its data distribution, we want to state that in distinction to the conventional GNN methods, which employ neural networks to explicitly model the data distribution $p(\mathbf{A}, \mathbf{X})$ for downstream tasks, our Approach I alternatively involves neural networks to learn the egonet dissimilarity changes in the forward diffusion process. Instead of classifying nodes by learning the distribution $p(\mathbf{A}, \mathbf{X})$, our Approach I is proposed to learn the evolving patterns from $\lbrace \boldsymbol{\Omega_t} \rbrace_{t=0}^T$. In other words, our proposed methods, namely forward sequence classification (Section 5.2) and trajectory representation learning (Section 5.3), learn the evolving patterns rather than $p(\mathbf{A}, \mathbf{X})$ to detect anomalies.