Wildfires are among the most destructive and rapidly escalating natural disasters of our time. In 2024, approximately 64,897 wildfires burned nearly 8.9 million acres across the United States, and the January 2025 Los Angeles fires, driven by extreme Santa Ana wind conditions, burned over 57,000 acres, destroyed more than 16,000 structures, caused at least 31 deaths, and forced the evacuation of 200,000 residents. Traditional detection systems, whether satellite imagery or isolated sensor networks, operate reactively: they identify fires after ignition, not the environmental conditions that precede it. This paper presents a research vision for an AI-driven early wildfire detection system grounded in anomaly detection over dynamic environmental graph streams. We propose modeling wildfire-prone environments as heterogeneous graphs in which nodes represent physical entities (meteorological stations, vegetation zones, power infrastructure, and human activity points) whose edges encode their evolving spatial and causal dependencies. A graph stream anomaly detection pipeline continuously monitors this evolving structure and flags pre-ignition warning patterns before fire breaks out. The core insight is that wildfires are not random events: they are the measurable endpoint of a convergent process involving climate stress, infrastructure vulnerability, and human proximity, each of which produces detectable structural and temporal anomalies in the environmental graph hours before ignition. This work represents an interdisciplinary collaboration between AI research at ESI Algiers and climate adaptation engineering at the University of California, Davis, and constitutes, to our knowledge, the first application of dynamic graph stream anomaly detection to the wildfire early-warning problem. We present the vision, proposed framework, open research challenges, and a concrete experimental roadmap.

Anomaly detection in dynamic graphs underpins financial fraud analysis, intrusion detection, and platform integrity, where automated decisions require human-interpretable justifications. StrGNN, the strongest performer in recent benchmarks, produces no explanation: when an edge is flagged, the analyst receives only a score. Explanation metrics are undefined for StrGNN because no attribution vector exists. This paper closes that gap. We present X-StrGNN, a post-hoc explanation layer that wraps a trained, frozen StrGNN and emits, for every flagged edge, dual attributions: a structural attribution identifying which contextual interactions in the enclosing subgraph drove the decision, and a temporal attribution identifying which historical snapshot carried the signal. Both attributions are multiplicative masks identically one in the unexplained pass, so the layer is an exact pass-through: detection is preserved to machine precision, verified rather than asserted (Delta AUC = 0.0000, Delta AP = 0.0000, Delta P@100 = 0.0000). Attribution costs 0.66 ms per edge, making explanation of an entire alarm list feasible. We conduct the first controlled design study of attribution strategies for this architecture, comparing gradient attribution, per-instance mask optimisation, and amortised parameterisation under one protocol, one budget, and three seeds. X-StrGNN attains the highest stability (0.913) at 268x lower cost than per-instance optimisation, and its temporal attribution (1.601 against a measured random floor of 0.973) is separably better than its ablated control, while per-instance optimisation - the most expensive strategy - falls below that floor. Code, protocol, and per-seed measurements are released.

Deep learning detectors for anomalies in dynamic graphs have reached strong accuracy, yet they remain opaque: when an edge is flagged, the analyst receives a score but no reason. This opacity is untenable in the cooperative, regulated information systems where such detectors are deployed, where automated decisions must be auditable and trustworthy. We address this gap for AddGraph, the foundational GCN+GRU framework for edge-level anomaly detection in dynamic graphs, which to our knowledge has never been equipped with any form of explainability. We present a strictly post-hoc explainability framework, X-AddGraph, built on a Dual Spatial-Temporal Attribution (DSTA) mechanism whose three components are each aligned with one of AddGraph's architectural modules: a gradient-based relevance attribution over the current adjacency structure (spatial), a direct reading of the contextual attention weights already computed during inference (short-term temporal, at zero additional cost), and a gradient rollback through the recurrent hidden states (long-term temporal). Because the detector is frozen, detection performance is preserved exactly (Delta AUC = 0, verified empirically to ten decimal places). On the UCI Message benchmark, our trained AddGraph baseline reaches an average per-snapshot AUC of 0.8705, exceeding the originally published result; X-AddGraph reproduces every score identically while adding explanations where none existed. Evaluated across four edge populations - confident true positives, low-confidence true positives, false positives, and random samples - the long-term attribution identifies historical snapshots carrying significantly more counterfactual signal than random selection (0.127 vs. 0.074), a capability that no spatially-blind explainer can provide. We release our implementation for full reproducibility.

Anomaly detection in dynamic graphs underpins high-stakes applications in financial fraud analysis, intrusion detection, and online platform integrity, where accountability frameworks increasingly require that automated decisions be accompanied by human-interpretable justifications. StrGNN, the strongest performer in recent unified benchmarks of the field, delivers this detection quality while producing no explanation whatsoever: when an edge is flagged, the analyst receives a score and nothing more. Explanation quality metrics are not low for StrGNN — they are undefined, because no attribution vector exists to evaluate. This paper closes that gap. We present X-StrGNN, a post-hoc explanation layer that wraps a trained, frozen StrGNN and emits, for every flagged edge, two complementary attributions: a structural attribution over the enclosing-subgraph evidence identifying which contextual interactions drove the decision, and a temporal attribution over the observation window identifying which historical snapshot carried the signal. Because both attributions are realised as multiplicative masks that are identically one in the unexplained pass, the layer is an exact pass-through: detection is preserved to machine precision, which we verify rather than assert (∆AUC = 0.0000, ∆AP = 0.0000, ∆P@100 = 0.0000). Attribution costs 0.66 ms per flagged edge, making explanation of an entire alarm list feasible rather than a hand-selected handful. We further conduct the first controlled design study of attribution strategies for this architecture, comparing gradient attribution, per-instance mask optimisation, and amortised parameterisation under one protocol, one budget, and three seeds. X-StrGNN attains the highest attribution stability in the study (0.913) at 268× lower cost than per-instance optimisation, and its temporal attribution (1.601 against a measured random floor of 0.973) is separably better than its own ablated control, while per-instance optimisation — the most expensive strategy evaluated — falls below that floor. Code, protocol, and per-seed measurements are released.

Anomaly detection in dynamic social graphs is a critical challenge across high-stakes settings including online trust and rating communities, coordinated inauthentic behaviour, social platform moderation and fraud analysis, where accountability frameworks demand that automated decisions be accompanied by human-interpretable justifications. State-of-theart Transformer-based detectors such as TADDY achieve strong detection performance but produce no explanation whatsoever for their decisions: when an edge is flagged as anomalous, the analyst receives a score and nothing more. This paper closes that gap. We present a post-hoc explainability framework that wraps a trained, frozen TADDY model and produces, for each flagged edge, two complementary attribution vectors: a spatial attribution identifying which neighbour nodes drove the anomaly, and a temporal attribution identifying which historical snapshots carried the strongest signal. This dual decomposition answers two distinct questions that no prior method addresses simultaneously. The framework adapts the GraphSVX Shapley surrogate to TADDY’s windowed token architecture through a graph-aware embedding-space perturbation strategy that avoids the pathological artefacts of naive index-space masking. We evaluate on three dynamic social graph benchmarks. Prior to this work, all explanation quality metrics are undefined for TADDY. After applying our framework, Fidelity reaches 0.9562, Sufficiency 0.9658, and positive Comprehensiveness is confirmed across all datasets, at zero cost to detection performance (∆AUC = 0.0000). An expanded evaluation covering 2,471 edges across all true positives, false positives and low-confidence detections confirms robustness at scale.

Hyperbolic geometry has recently emerged as a powerful alternative to Euclidean spaces for representing graph-structured data, particularly due to its ability to capture hierarchical and scale-free structures with low distortion. This paper presents a comprehensive survey of hyperbolic graph embedding methods, providing both a conceptual overview and a systematic taxonomy of existing approaches.Beyond a purely descriptive survey, our work is specifically designed to address key limitations of existing surveys by incorporating a unified and reproducible experimental perspective. Unlike prior surveys, which mainly focus on theoretical foundations, our work places a particular emphasis on anomaly detection in graphs as a unifying and practically relevant evaluation task. To this end, we combine theoretical analysis with a unified evaluation protocol and a practical and reproducible evaluation framework, including a publicly available open-source library that provides a common platform implementing the most representative hyperbolic embedding methods.Using this framework, we conduct extensive experiments on diverse real-world datasets to systematically assess the effectiveness of hyperbolic representations for anomaly detection and to compare them against Euclidean baselines.

Semi-supervised detectors for anomaly detection in dynamic graphs are deployed where accountability frameworks require that automated decisions be justified, yet they emit a score and nothing more. For SAD, a continuous-time detector that scores nodes against a time-decayed reference distribution maintained in a memory bank, explanation quality metrics are not low-they are undefined, because no attribution vector exists to evaluate. This paper closes that gap with a framework whose two axes differ in kind. The first supplies event attribution: which past interactions in the temporal neighbourhood produced the decision, learned as an amortised mask that enters the attention logits and is inactive at unity, so detection is preserved to machine precision (∆AUC = 0.0000, ∆AP = 0.0000, ∆P@100 = 0.0000). The second exploits a property unique to this detector: because its anomaly channel is a standardised deviation from an explicit reference, that deviation admits a closed-form decomposition into an instance term and a per-memory-entry baseline term which sum to the total by construction. No sampling, no surrogate, and a completeness residual of 3.8×10-6 on 6,000 real targets confirms it. The decomposition answers a question no other dynamicgraph explainer can pose-whether an alert reflects the node's own behaviour or a shift in the population baseline-and on MOOC the split is 49.9% against 50.1%. We further conduct a controlled three-seed study of event-attribution strategies, from which three findings follow: amortisation attains characterisation 0.874 against per-instance optimisation's 0.667 at 453× lower cost, separable at 5.98 standard deviations; a parameter-free gradient baseline ties both trained explainers; and signed fidelity systematically mis-scores anomaly explanations by penalising exculpatory evidence, since random ablation raises the score on 78% of alerts.

Dense connectivity in complex networks often conceals meaningful organization. Backbone extraction mitigates this by filtering edges to retain the most informative connections. Similarity-based approaches rank edges using topological similarity functions but are typically limited to pairwise graphs. This study compares pairwise and high-order similarity backbones to examine how multi-node relations influence network filtering. Both frameworks share the same similarity principle but differ in how similarity is computed and propagated: the pairwise formulation evaluates dyadic relations, whereas the high-order formulation derives edge scores from simplex-level similarity within simplicial complexes. Experiments on five real datasets show partial rank agreement between the two, with the largest deviations observed under strong filtering. Topological analysis reveals that high-order backbones preserve higher reachability and more unique simplices, while pairwise backbones maintain greater transitivity. These findings demonstrate that higher-order and pairwise similarity backbones capture complementary aspects of network structure.

Deep convolutional neural networks (CNNs) achieve strong performance across a wide range of computer vision tasks but remain computationally demanding for resource-constrained devices. Structured channel pruning reduces model complexity by removing redundant channels and filters; however, existing methods often rely on heuristic or computationally expensive strategies, lack precise control over compression, and struggle to preserve performance during training.In this work, we propose Dual-Augmented Budgeted Pruning (DABP), a differentiable channel pruning framework that formulates network compression as a budget-constrained optimization problem. The proposed method introduces continuous channel-wise gating variables and integrates an augmented Lagrangian mechanism to explicitly enforce a global resource budget during training. Additionally, a sensitivity-aware regularization term, derived from gradient-based statistics, is employed to preserve informative feature representations. Unlike sparsity-based or fixed-penalty methods that achieve the target compression level indirectly through regularization strength and threshold selection, DABP explicitly steers the optimization toward a predefined global resource budget via online dual-variable updates. Meanwhile, the sensitivity-aware regularization complements this process by discouraging the removal of highly informative channels, enabling accurate budget control while maintaining predictive performance under aggressive compression.Extensive experiments on CIFAR-10 and ImageNet demonstrate that DABP achieves superior accuracy-efficiency trade-offs, outperforming several state-of-the-art structured pruning methods. In particular, on CIFAR-10 with ResNet-56, DABP achieves 93.76% Top-1 accuracy with a significant reduction in FLOPs (54.56%). On ImageNet (ILSVRC-2012), it achieves up to 75.56% Top-1 accuracy with a 56.66% reduction in FLOPs, demonstrating its effectiveness under both moderate and high compression rates.

Anomaly detection on temporal dynamic graphs enables the identification of threats in our cyberspaces. However, finding a graph representation that offers the best trade-off between execution time and accuracy remains a major challenge. To address this, we propose a novel model based on Hyperbolic Graph Neural Networks, an emerging class of learning architectures that leverages the expressive power of hyperbolic geometry to process graph-structured data. Our results show that the proposed model outperforms the state of the art, achieving over 97

Anomaly detection in dynamic graphs (DGAD) sits at the intersection of graph learning and temporal modeling, yet it presents itself as a scattered collection of isolated methods: results are dispersed across dozens of venues, published numbers are mutually incomparable, and no reference delimits the field, so surveys routinely conflate dynamic-graph detectors with staticgraph and multivariate time-series methods. This paper supplies the missing reference in both of its layers, organization and measurement. We delimit the field with three explicit, checkable inclusion criteria; we present a catalog of twenty-four methods, each traced to its primary publication and its publication status stated, organized by a two-axis taxonomy of structural encoder × temporal mechanism; and we list, with reasons, the prominent methods that fail each criterion. We then benchmark representatives of all seven taxonomy families, thirteen deep detectors, a non-deep streaming baseline, and a suite of parameter-free heuristics, under one injection protocol, split, and metric set. The results concern the field’s evaluation practice as much as its methods. A degree heuristic that requires no training reaches AUC 0.811 on the canonical injected benchmark, above nine of thirteen deep detectors, and holds across a second corpus, a second injection model, and all 162 configurations of the protocol’s parameter space; on real fraud labels it falls below chance. There the ranking rearranges by time model rather than by injected rank: both snapshot-based leaders drop to chance while the continuous-time streaming detector leads. We further find that headline AUC misranks methods on injected data, and that published implementations frequently contain resultchanging evaluation defects. We distill these findings into concrete recommendations and release the full benchmark.

The backbone extraction process is pivotal in expediting analysis and enhancing visualization in network applications. This study systematically compares seven influential statistical hypothesis-testing backbone edge filtering methods (Disparity Filter (DF), Polya Urn Filter (PF), Marginal Likelihood Filter (MLF), Noise Corrected (NC), Enhanced Configuration Model Filter (ECM), Global Statistical Significance Filter (GloSS), and Locally Adaptive Network Sparsification Filter (LANS)) across diverse networks. A similarity analysis reveals that backbones extracted with the ECM and DF filters exhibit minimal overlap with backbones derived from their alternatives. Interestingly, ordering the other methods from GloSS to NC, PF, LANS, and MLF, we observe that each method’s output encapsulates the backbone of the previous one. Correlation analysis between edge features (weight, degree, betweenness) and the test significance level reveals that the DF and LANS filters favor high-weighted edges while ECM assigns them lower significance to edges with high degrees. Furthermore, the results suggest a limited influence of the edge betweenness on the filtering process. The backbones global properties analysis (edge fraction, node fraction, weight fraction, weight entropy, reachability, number of components, and transitivity) identifies three typical behavior types for each property. Notably, the LANS filter preserves all nodes and weight entropy. In contrast, DF, PF, ECM, and GloSS significantly reduce network size. The MLF, NC, and ECM filters preserve network connectivity and weight entropy. Distribution analysis highlights the PU filter’s ability to capture the original weight distribution. NC filter closely exhibits a similar capability. NC and MLF filters excel for degree distribution. These insights offer valuable guidance for selecting appropriate backbone extraction methods based on specific properties.

Recently, the emergence of Deep Learning on graphs has led to significant advancements in solving complex optimization problems. Among these, graph sparsification has attracted considerable attention, as it aims to reduce the size and complexity of graphs while preserving their essential structural and informational properties. This is particularly crucial in real-world applications, where graphs continue to grow in scale, making efficient processing increasingly challenging. In this paper, we explore the potential of Reinforcement Learning as a powerful approach for graph sparsification, leveraging its ability to learn adaptive strategies that balance the trade-off between reducing graph size and preserving key information.

Graph Convolutional Networks (GCNs) have recently gained significant attention due to the success of Convolutional Neural Networks in image and language processing, as well as the prevalence of data that can be represented as graphs. However, GCNs are limited by the size of the graphs they can handle and by the oversmoothing problem, which can be caused by the depth or the large receptive field of these networks. Existing approaches address these limitations by leveraging minibatch training paradigm. However, the strategy of selecting subgraphs to form minibatches is a challenging task because of the dependency between nodes. In this work, we propose a general framework for generating minibatches in an effective way that ensures minimal loss of node interdependence information, preserves the original graph properties, and diversifies the samples for the GCN to improve generalization. We test our training process on real-world datasets with several well-known GCN models and demonstrate the improved results compared to existing methods.

Backbone extraction simplifies complex networks while retaining essential features. It reduces complexity without losing critical structural information. However, selecting the most suitable method remains challenging due to the diverse behaviors of existing techniques. This study evaluates eight structural backbone extraction methods designed for weighted networks. These methods leverage network topology rather than statistical weight distributions. A dataset of 33 real-world networks is analyzed, covering diverse sizes, topologies, and domains. Key metrics, such as Jaccard similarity and Overlap Coefficient, reveal distinct method behaviors. A hierarchical relationship emerges among methods. Primary Linkage Analysis (PLAM) captures the most substantial edges, forming the simplest backbone. Minimum Spanning Tree (MSP), Ultrametric Backbone (UMB), and Metric Backbone (MB) build on this structure, progressively adding connectivity and detail. The Doubly Stochastic Filter excels at preserving weight and degree distributions, connectivity, and transitivity. By contrast, the H-Backbone prioritizes high-weight edges but disrupts connectivity. Metric Backbone and Planar Maximally Filtered Graph ensure complete node preservation and maintain high reachability. These insights advance the understanding of structural backbone extraction techniques for weighted networks. They benefit applications in fields like biology, social networks, and transportation. Practitioners can better achieve goals like network simplification for visualization or property preservation for analysis.

Network backbone extraction is essential for simplifying complex systems while preserving key structural characteristics. Traditional methods often compromise important properties like edge weight distribution. This study introduces an innovative approach by applying global similarity-based link prediction techniques to extract network backbones. Through a comparative analysis using the world air transportation network, we reveal how different methods reflect various aspects of the hub-and-spoke model employed by airlines. Specifically, the Katz backbone method effectively combines local and global connections, while the High Salience Skeleton method excels in maintaining network nodes and reachability. Based on three real-world networks, our results show that the Katz backbone preserves weight distribution most effectively, whereas the SP and Disparity backbones maintain degree distribution more accurately. These findings suggest that the backbone extraction technique should be tailored to the specific network property of interest.

Graph kernels have become a cornerstone in the analysis of graph-structured data, offering powerful tools for similarity assessment in various domains. However, existing graph kernel methods often grapple with efficiently capturing both the structural complexity and attribute diversity inherent in graphs. This paper introduces the "Hybrid Entropy-Attribute Diversity Sampling Graph Kernel" (HEADS), a novel approach that synergizes entropy-based analysis with attribute-diversity-driven sampling to address these challenges. Our method leverages the Von Neumann entropy to quantify the informational content and complexity of graph structures, enhancing the expressiveness of the kernel. Additionally, we introduce an innovative attribute- diversity-driven snowball sampling technique, which ensures a comprehensive and representative selection of graph features. The integration of entropy measures with attribute diversity in our kernel computation marks a significant advancement in graph kernel analysis, paving the way for its application in large-scale, real-world graph data scenarios. This paper details the formulation of the HEADS approach, its algorithmic implementation, and an extensive evaluation demonstrating its efficacy in both computational performance and classification accuracy.

The proliferation of online code repositories, such as GitHub and GitLab, has increased security risks related to the spread of malware through source code, including compromised libraries and obfuscated code. Traditional detection methods, such as static and dynamic analysis, have shown limitations when faced with advanced threats. To address this issue, we propose an approach based on Graph Neural Networks (GNN) to enhance malware detection in code repositories. Graphs provide an effective way to model the complex relationships within a program, such as interactions between functions, classes, modules, and external dependencies. This is particularly useful for identifying specific patterns of complex malicious behavior. Our model detects anomalies by analyzing the program internal interactions in addition to the exact code content. Our method extracts call graphs and metadata (such as descriptions and README files) from code repositories. The metadata is converted into vectors using a natural language embedding model, then merged with the embeddings of call graphs generated by GNNs. This combined representation is used by a supervised classifier to detect malicious repositories. The results show strong performance in precision, recall, and F1-score, validating the effectiveness of our approach.

Graph-related applications, including classification, regression, and clustering, have seen significant advancements with the development of graph neural networks (GNNs). However, a gap remains in effectively using these models for heterogeneous graphs, as current methods primarily focus on homogeneous graphs, often overlooking potentially valuable semantic information. To address this issue, our work introduces a novel approach, G-HIN2VEC (Graph-level heterogeneous information network to vector), specifically designed to generate heterogeneous graph representations. This method uniquely leverages a single graph to learn its own embeddings without relying on a graph dataset by sharing model parameters across the dataset. Inspired by recent developments in unsupervised learning in natural language processing, G-HIN2VEC employs a negative sampling technique to learn graph-level embedding matrices from a variety of metapaths. This approach has been applied to real-world credit card data, facilitating the analysis of cardholder transactions through three downstream applications: graph-level regression and classification tasks, including age and income prediction and gender classification. G-HIN2VEC outperforms traditional methods, demonstrating improvements in gender classification accuracy by 2.45