Tabular Foundation Models are Strong Graph Anomaly Detectors

AI summary

Authors: Yunhui Liu, Tieke He, Yongchao Liu, Can Yi, Hong Jin, Chuntao Hong Affiliations: State Key Laboratory for Novel Software Technology, Nanjing University; Ant Group, Hangzhou, China Venue: Proceedings of the ACM Web Conference 2026 (WWW '26), Dubai, United Arab Emirates arXiv: 2601.17301v1 [cs.LG], 24 Jan 2026 | DOI: 10.1145/3774904.3792965 Code: https://github.com/Cloudy1225/TFM4GAD

Overview

Research area: Graph anomaly detection (GAD) and tabular foundation models (TFMs), at the intersection of graph machine learning and in-context learning.

Technical level: Intermediate. The paper assumes familiarity with graph neural networks, the "one model per dataset" training paradigm for GAD, and the prior-data fitted network (PFN) idea behind tabular foundation models. Readers unfamiliar with graph Laplacians or Beta Wavelet filters will need to consult the cited references.

Scope: The paper proposes TFM4GAD, a framework that converts an attributed graph into an augmented feature table enriched with structural signals, then feeds that table to an off-the-shelf tabular foundation model for zero-training node anomaly prediction.

What This Paper Is About

Existing graph anomaly detectors are trained one per dataset, which means each new graph requires expensive training, sufficient labeled anomalies, and hyperparameter tuning. This paper asks whether a single model can detect anomalous nodes across many different graphs without any retraining, and answers by repurposing tabular foundation models — which are already designed for heterogeneous features, cross-domain generalization, and scarce labels — for the graph setting. The core obstacle is that tabular models ignore graph topology, so the paper's job is to encode topology into the table itself.

Key Contributions

1. A reframing of foundation GAD as a tabular problem. The paper observes that node features in GAD are tabular in nature (numeric or categorical attributes such as transaction statistics or temporal descriptors), and that even textual features are converted to numeric tables by TF-IDF or sentence embeddings. This makes the feature-heterogeneity challenge of GAD analogous to the challenge TFMs already solve.

2. TFM4GAD, a graph-to-tabular "flattening" framework. Each node is represented by an augmented vector concatenating four components: raw node features, Laplacian embeddings (k = 16 eigenvectors of the normalized graph Laplacian), explicit structural characteristics (Node Degree and PageRank), and an anomaly-sensitive neighborhood aggregation built from Beta Wavelet filters.

3. An anomaly-sensitive aggregation design based on Beta Wavelets. Drawing on Tang et al. (2022), the framework uses Beta Wavelet transforms as a bank of C+1 localized band-pass filters (with p + q = C) rather than the low-pass filtering of standard GCN-style neighborhoods, on the argument that low-pass smoothing over-averages away the unique signal of anomalous nodes.

4. An empirical demonstration across four datasets and four TFM backbones. TFM4GAD is evaluated on Amazon, YelpChi, T-Finance, and T-Social against eight supervised baselines that each require dataset-specific training.

Main Findings

• TFM4GAD outperforms all specialized GAD baselines on average. Averaged over the four datasets, the best variant (LimiX-16M) reaches 89.92% AUROC and 72.25% AUPRC, versus the strongest trained baseline SpaceGNN at 86.50% AUROC and 61.72% AUPRC. This is achieved in a purely in-context regime with no graph-specific training or gradient updates.

• All four TFM backbones land in a narrow band. Average AUROC/AUPRC: LimiX-2M 89.65 / 70.60, LimiX-16M 89.92 / 72.25, TabPFNv2 89.79 / 71.59, TabPFNv2.5 89.86 / 71.43. Baseline averages for comparison: GCN 73.28 / 29.52, AMNet 75.97 / 42.40, BWGNN 81.42 / 45.55, GHRN 81.68 / 46.02, RFGraph 84.42 / 56.68, XGBGraph 84.68 / 57.02, ConsisGAD 86.44 / 56.38, SpaceGNN 86.50 / 61.72.

• Gains are largest on the largest and sparsest-label datasets. On T-Social (5,781,065 nodes, 3.0% anomalies), TFM4GAD variants reach AUPRC between 83.26 (LimiX-2M) and 87.19 (TabPFNv2.5), compared with 58.99 for SpaceGNN. On YelpChi, TFM4GAD variants range from 70.54 to 71.64 AUROC versus 66.81 for SpaceGNN.

• Structure is essential, and neighborhood aggregation contributes the most. In the ablation (AUPRC, T-Finance and T-Social), raw features alone are weak — 76.23 and 75.76 on T-Finance, but only 7.41 and 7.52 on T-Social. Adding the Beta Wavelet neighborhood aggregation gives the largest single jump (to 82.87 / 82.31 on T-Finance and 77.99 / 78.11 on T-Social). Adding structural characteristics yields a further boost (82.94 / 82.22 on T-Finance; 85.85 / 87.12 on T-Social), and Laplacian embeddings provide a final refinement (83.49 / 82.75; 87.01 / 87.19).

• Label scarcity is handled by design, not by training. Each dataset provides only 100 labeled nodes, of which 20 are anomalies, and results are averaged over 10 random splits from GADBench.

• Feature block ordering is claimed to be unimportant. Because TFMs apply feature shuffling and ensembling at inference to approximate permutation invariance, the paper states that the order of the concatenated feature blocks has little effect on performance.

Methodology in Plain English

The starting observation is that a graph anomaly detector normally needs three things: enough labeled data for the specific graph, a way to handle whatever feature columns that graph happens to have, and retraining whenever the graph changes. Tabular foundation models already solve those three problems for ordinary spreadsheet-like data, because they are pretrained on vast numbers of synthetic tables and then make predictions on a brand-new table simply by being shown a few labeled examples in the prompt — no retraining. The only thing they cannot see is the graph's edges.

So the researchers turn the graph into a table. Every node becomes one row. The row is built by stapling four things together:

1. The node's original feature values.
2. Laplacian embeddings — 16 numbers per node derived from the eigenvectors of the normalized graph Laplacian, which act like a positional code telling the model roughly where in the graph a node sits.
3. Simple structural metrics: the node's degree and its PageRank score, giving explicit high-level and local connectivity signals.
4. Neighborhood aggregations computed with Beta Wavelet filters. Instead of averaging a node's neighbors together (which blurs anomalies into their surroundings), these filters act like a bank of band-pass filters that produce positive and negative responses, so a node that looks unlike its neighbors stands out rather than disappearing.

That single wide table is then handed to a pretrained tabular foundation model together with the labels of 100 known nodes as in-context examples. The model predicts an anomaly probability for every remaining node in one forward pass. There is no gradient descent, no fine-tuning, and no graph-specific parameters.

Why This Matters

Impact on research. The paper challenges the assumption that foundation models for graphs must be graph-native. It suggests that a large part of what makes graph anomaly detection hard — heterogeneous feature spaces, domain shift, and scarce labels — can be outsourced to a general-purpose tabular model, leaving only the structural encoding as a graph-specific design choice. If this holds up, it redirects effort from building ever-larger graph pretraining pipelines toward better graph-to-table representations.

Real-world applications:

• Financial fraud detection — the T-Finance dataset (39,357 nodes, 21,222,543 edges, 4.6% anomalies) models transaction networks, where flagged anomalies are expensive to obtain and label scarcity is the norm.
• Social network abuse detection — T-Social (5,781,065 nodes, 73,105,508 edges, 3.0% anomalies) reflects bot, spam, and fake-account detection at scale.
• E-commerce review fraud — Amazon (11,944 nodes, 25 features, 9.5% anomalies) and YelpChi (45,954 nodes, 32 features, 14.5% anomalies) are co-review networks where fraudulent reviewers collude.
• Cybersecurity and general Web integrity — any platform with attributed interaction graphs and a small set of confirmed incidents.

Industry relevance. The work is co-authored with Ant Group and partially supported by the Ant Group Research Intern Program, and the practical pitch is a single deployed detector that works across heterogeneous graphs without per-dataset retraining, hyperparameter tuning, or architectural changes. That directly targets the three deployment costs the paper names: expensive training, high data requirements, and limited generalizability.

Future Directions

• Scaling behavior on very large graphs is not reported. The paper evaluates on T-Social with 5,781,065 nodes and 73,105,508 edges, but gives no computation time, memory, or throughput figures, and no analysis of how in-context prediction cost grows with the number of nodes. Quantifying this is a natural next step.

• Sensitivity of the structural hyperparameters is unexplored. The Laplacian embedding size is fixed at k = 16 and the neighborhood aggregation hop order is selected from {1, 2, 3}; the paper does not report how results vary with k, with the wavelet order C, or with the number of in-context labeled nodes beyond the fixed 100.

• Ablations are reported only on two of the four datasets. The feature-component ablation in Table 3 covers T-Finance and T-Social only, leaving open whether the same component ranking holds on Amazon and YelpChi.

• Whether learned structural encodings can replace the handcrafted ones. The flattening pipeline currently relies on specific engineered features (degree, PageRank, Beta Wavelet filters). An open question is whether a model could learn the graph-to-table mapping itself, and whether TFM-based detection extends to edge-level or graph-level anomalies rather than node-level ones.

Target Audience

This paper is most useful to machine learning researchers and practitioners working on graph anomaly detection, Web-scale integrity and fraud detection, or foundation models for structured data. It is particularly relevant to engineers at platforms with many heterogeneous graphs who are tired of maintaining one trained model per dataset, and to researchers interested in whether tabular foundation models can substitute for graph-native pretraining. Readers should already be comfortable with graph neural networks, the GADBench evaluation setup (AUROC and AUPRC), and the in-context learning paradigm of prior-data fitted networks.

Authors’ abstract

Graph anomaly detection (GAD), which aims to identify abnormal nodes that deviate from the majority, has become increasingly important in high-stakes Web domains. However, existing GAD methods follow a "one model per dataset" paradigm, leading to high computational costs, substantial data demands, and poor generalization when transferred to new datasets. This calls for a foundation model that enables a "one-for-all" GAD solution capable of detecting anomalies across diverse graphs without retraining. Yet, achieving this is challenging due to the large structural and feature heterogeneity across domains. In this paper, we propose TFM4GAD, a simple yet effective framework that adapts tabular foundation models (TFMs) for graph anomaly detection. Our key insight is that the core challenges of foundation GAD, handling heterogeneous features, generalizing across domains, and operating with scarce labels, are the exact problems that modern TFMs are designed to solve via synthetic pre-training and powerful in-context learning. The primary challenge thus becomes structural: TFMs are agnostic to graph topology. TFM4GAD bridges this gap by "flattening" the graph, constructing an augmented feature table that enriches raw node features with Laplacian embeddings, local and global structural characteristics, and anomaly-sensitive neighborhood aggregations. This augmented table is processed by a TFM in a fully in-context regime. Extensive experiments on multiple datasets with various TFM backbones reveal that TFM4GAD surprisingly achieves significant performance gains over specialized GAD models trained from scratch. Our work offers a new perspective and a practical paradigm for leveraging TFMs as powerful, generalist graph anomaly detectors.