Paper deep dive
Feature-Context Consistency: Unsupervised Adversarial Detection with Drift Stability on Attributed Graphs
Firas Bayram, Maxime Cordy
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Adversarial detection on evolving attributed graphs faces two challenges: fraud labels arrive late or not at all, and natural distributional drift erodes any trained decision boundary. Modern detectors can reach strong detection rates when labels are available and the distribution is stationary; sustaining that quality without labels and under drift is the open problem. We identify feature-context consistency -- the alignment between a node's attributes and its aggregated neighborhood attributes -- as a single structural signal that addresses both. We formalize it as the Context Boost (CB) score within a Restricted Boltzmann Machine framework (CB-RBM) and prove two complementary worst-case guarantees: a strict separation between the expected CB of legitimate and adversarial nodes, with gap growing linearly in model capacity, whenever the adversary's context stays far enough from legitimate neighborhood context; and a Wasserstein-Lipschitz bound on how far the CB distribution moves under natural drift. We validate on XBlock Ethereum phishing (~153K nodes) and Reddit banned-user detection (~11K nodes), with two further datasets in the appendix spanning diverse domains. With zero labels, CB-RBM achieves AUROC >= 0.96 on four adversarial attacks and keeps FPR close to its calibrated 5% target under drift -- outperforming supervised GNNs (hundreds of labels), unsupervised graph-anomaly baselines, and a standard RBM whose FPR collapses to 89-100%. What typically requires separate mechanisms -- label-free operation and drift stability -- here follows from a single structural regularity of the data. Code: this https URL.
Tags
Links
- Source: https://arxiv.org/abs/2610.16694v1
- Canonical: https://arxiv.org/abs/2610.16694v1
Trouble viewing inline? Open PDF directly →
Full Text
136,980 characters extracted from source content.
Expand or collapse full text
Feature-Context Consistency: Unsupervised Adversarial Detection with Drift Stability on Attributed Graphs Firas Bayram Affiliation: SnT, University of Luxembourg Affiliation: Luxembourg Email: firas.bayram@uni.lu Maxime Cordy Affiliation: SnT, University of Luxembourg Affiliation: Luxembourg Email: maxime.cordy@uni.lu Abstract Adversarial detection on evolving attributed graphs faces two challenges: fraud labels arrive late or not at all, and natural distributional drift erodes any trained decision boundary. Modern detectors can reach strong detection rates when labels are available and the distribution is stationary; sustaining that quality without labels and under drift is the open problem. We identify feature-context consistency — the alignment between a node’s attributes and its aggregated neighborhood attributes — as a single structural signal that addresses both. We formalize it as the Context Boost (CB) score within a Restricted Boltzmann Machine framework (CB-RBM) and prove two complementary worst-case guarantees: a strict separation between the expected CB of legitimate and adversarial nodes, with gap growing linearly in model capacity, whenever the adversary’s context stays far enough from legitimate neighborhood context; and a Wasserstein-Lipschitz bound on how far the CB distribution moves under natural drift. We validate on XBlock Ethereum phishing (∼ 153K nodes) and Reddit banned-user detection (∼ 11K nodes), with two further datasets in the appendix spanning diverse domains. With zero labels, CB-RBM achieves AUROC ≥0.96≥ 0.96 on four adversarial attacks and keeps FPR close to its calibrated 5%5\% target under drift — outperforming supervised GNNs (hundreds of labels), unsupervised graph-anomaly baselines, and a standard RBM whose FPR collapses to 8989–100%100\%. What typically requires separate mechanisms — label-free operation and drift stability — here follows from a single structural regularity of the data. Code: https://github.com/serval-uni-lu/CB-RBM. 1 Introduction Within networked systems, adversarial actors (e.g., scammers in cryptocurrency transaction graphs, banned users on social platforms, fake reviewers in e-commerce networks) operate at scale to bypass systems’ security and business protection measures. The stakes are substantial: cryptocurrency fraud alone reached $9.3 billion in 2024 [1, 2], with comparable damage from coordinated review rings, account abuse, and platform manipulation [3]. These systems are naturally represented as attributed graphs, where nodes carry features and edges encode relationships, and detection requires exploiting both channels together. Adversarial manipulation then consists of introducing new nodes and edges in the graph following a specific (adversarial) feature distribution. Yet deploying detectors on these graphs faces two compounding constraints. First, label scarcity: adversarial entities typically operate for days or weeks before being flagged—if they are ever reported at all—leaving no reliable supervisory signal during the critical early window when the most damage is done [4]. Second, distributional drift [5, 6]: user behavior, network topology, and feature distributions evolve continuously through organic growth and churn [7], inducing natural concept drift [8]. A detector trained on a snapshot implicitly encodes the feature distribution of that moment; as legitimate entities migrate to new regions of feature space, the learned decision boundary becomes stale—legitimate activity that was once well within the normal range now falls outside it, triggering escalating false alarms [9]. The standard remedy is periodic retraining, but this loops back to the first problem. Retraining requires fresh labels, which arrive late and incomplete. In particular, supervised fraud GNNs [10, 11, 12] depend on exactly these labels, and unsupervised graph detectors such as DOMINANT [13] and CoLA [14] carry no guarantee against drift-induced false alarms. Without a mechanism that is inherently stable under drift, practitioners are trapped in a cycle where the model is either stale or starved of supervision. We identify feature-context consistency—the alignment between an entity’s own attributes and the aggregated attributes of its neighbors—as a single structural signal that simultaneously addresses both problems. A legitimate entity develops feature patterns that are statistically coherent with those of its neighbors, because repeated interaction shapes both parties. An adversarial entity, by contrast, is injected without this history: its features may mimic legitimate patterns, but its neighborhood context is absent, random, or structurally inconsistent—and the adversary cannot unilaterally control the features of its neighbors. This enables label-free detection. The same signal is also robust to drift, because natural drift moves node features and their mean-pooled context in tandem and preserves their alignment, which gives drift stability without retraining. Both properties follow from the same structural fact: in attributed graphs with meaningful relationships, feature-context correlation is nonzero for legitimate entities and broken for early-stage adversarial injections. Operationalizing this insight requires a label-free model whose score function is analytically decomposable into feature and feature-context contributions, so the loss of coherent context for adversarial nodes is expressible in closed form. Energy-based models satisfy the label-free requirement, learning an unnormalized density from legitimate data alone [15]. Among these, the Restricted Boltzmann Machine [16], a well-studied neural-network EBM, additionally provides a closed-form free energy whose per-hidden-unit decomposition supports the separation and drift bounds in §5 — unlike GNNs or alternative EBMs (score-based, energy-GAN). RBMs carry a track record in unsupervised fraud and anomaly detection [17, 18, 19], yet remain unexplored for attributed-graph adversarial detection. A standard RBM, however, models features in isolation — capturing what an entity looks like, not whether that appearance is consistent with its surroundings [20]. We extend the Gaussian-Bernoulli RBM with a gated context pathway that conditions the energy on aggregated neighborhood features, yielding the Context-Boosted RBM (CB-RBM). The Context Boost (CB) score — the reduction in free energy from conditioning on neighborhood context — directly measures feature-context consistency and underlies both our detection mechanism and drift guarantees. Our main contributions are as follows. • Method (§4). We propose CB-RBM, an RBM with a GLU-gated context pathway conditioning the free energy on aggregated neighborhood features, and the Context Boost (CB) score—the free-energy reduction from context—as a label-free detection signal. • Theoretical framework (§5). Under five empirically verifiable assumptions, we prove a strict separation between the expected CB of legitimate and adversarial nodes (Theorem 1) and a Wasserstein-Lipschitz bound on how far the CB distribution moves under drift (Theorem 2, Corollary 2)—coupling label-free detection and drift stability through a single feature-context correlation structure. • Detection boundary analysis (§6.2, §6.5). The ρ1eff _1^eff analysis reveals that CB detects absence of legitimate network context rather than feature deviation, characterizing the detection signal and delineating its scope. • Empirical validation (§6). On XBlock Ethereum phishing [21] and Reddit banned users [22], CB-RBM (0 labels) achieves AUROC ≥0.96≥ 0.96 on all non-white-box attacks and keeps FPR close to its calibrated 5%5\% target under 20-step drift, ahead of supervised GNNs trained on hundreds of labels, unsupervised graph-anomaly baselines and a standard RBM whose FPR rises to 8989–100%100\%. 2 Related Work Graph anomaly detection. Supervised fraud detectors such as CARE-GNN [10], GraphConsis [11], PC-GNN [12] and BWGNN [23] learn from labeled adversaries, which arrive late in our setting. Unsupervised detectors exploit graph structure without labels. DOMINANT [13] and AnomalyDAE [24] score attribute and structure reconstruction errors, GAD-NR [25] reconstructs each node’s neighborhood, CoLA [14] contrasts each node with its local subgraph, CONAD [26] adds contrastive learning over augmented anomalies, and OCGNN [27] fits a one-class boundary around normal embeddings. CB-RBM uses no reconstruction target or contrastive loss. Context enters the energy of a trained model through a gated pathway, and the score is the free-energy reduction that context produces, in closed form and decomposable over hidden units (Definition 1). Distribution shift and dynamic graphs. Concept-drift methods detect a shift and then adapt or retrain [28, 8], and change detection extends to graph streams [9]. GDN [29] uses labels to counter structural distribution shift between training and test nodes, and WhENDS [30] whitens normal edge embeddings over time to track normality shift in dynamic graphs. Dynamic-graph detectors such as StrGNN [31] and TADDY [32] model temporal evolution to score anomalous edges [33]. These approaches address shift through adaptation, robustness objectives, embedding alignment or explicit temporal modeling. In our main drift evaluation, CB-RBM keeps its trained parameters and threshold frozen, and Theorem 2 bounds how far its scores move under smooth drift. Generalist detectors. ARC [34], UNPrompt [35] and AnomalyGFM [36] train one detector on some graphs and apply it to unseen graphs with few or no target labels. UNPrompt predicts latent node attributes from neighborhoods and AnomalyGFM uses node-neighbor representation residuals. Their shift is across graphs, whereas ours is temporal drift within one deployed graph. Positioning. Our contribution relative to these families is the Context Boost differential and the analysis it admits, a conditional separation of expected scores (Theorem 1) and a Wasserstein bound on how far the scores move under drift (Theorem 2). Section 6.4 and Appendix D compare representatives of the node-level families under our protocol. 3 Problem Setup Graph. Let =(,ℰ)G=(V,E) be an attributed directed graph with node features i∈ℝnvx_i ^n_v for each i∈i . Each node represents an entity (e.g., wallet, user, reviewer) and each directed edge an interaction. Our detector uses no adversarial labels. It is trained one-class on a pool of nodes assumed legitimate, in practice accounts with no abuse report after an aging window, and its threshold is set on a held-out slice of the same pool. Neighborhood context. The context of node i aggregates the features of its neighbors (i)N(i): i=⊙1|(i)|∑j∈(i)j∈ℝnv,c_i=s 1|N(i)| _j (i)x_j ^n_v, (1) where ∈−1,+1nvs∈\-1,+1\^n_v is a per-dimension sign vector that corrects for anti-homophilic dimensions, ensuring that the signed context is positively correlated with node features for legitimate nodes. The construction of s is detailed in §4. The mean-pool aggregator is ablated in Appendix G. Threat model. An adversary aiming to evade detection injects a new node i that it controls (features and edges), but not the existing nodes around it; the chosen feature distribution and neighborhood structure depend on the attack strategy. We distinguish four attack strategies of increasing sophistication: 1. Isolated Injection — adversarial features ′∼fraudx _fraud with context ′∼randc _rand, here (,)N(0,I), drawn independently of ′x , so the node has no legitimate neighborhood context. 2. Feature Camouflage — legitimate features ′∼legitx _legit with ′∼randc _rand as above, so the node still lacks genuine context. 3. Sybil attack — ′∼fraudx _fraud, and the adversary links to a fully connected clique S of 5050 decoys with near-legitimate features s=ℓs+0.05ϵsx_s=x_ _s+0.05\, ε_s (legitimate ℓs _s, ϵs∼(,) ε_s (0,I)), so its fabricated context ′c is the mean-pool (1) over (i)∪SN(i)∪ S, where (i)N(i) is the neighborhood before the attack. 4. Relation Camouflage — ′∼fraudx _fraud, and an adaptive adversary links to the 1010 highest-degree legitimate nodes H, so its partially genuine context ′c is the mean-pool (1) over (i)∪HN(i)∪ H. These four patterns span the canonical injected-adversary threats established in graph fraud detection and adversarial graph learning [37, 38]; attack families requiring training-time graph or label manipulation (e.g., topology poisoning [39], backdoor attacks) lie outside this scope. We separately evaluate robustness to adversarial contamination of the training pool assumed legitimate in §6.5. White-box PGD [40], which needs gradient access to the detector, is a stress test in Appendix H. 4 CB-RBM We extend the Gaussian-Bernoulli RBM [41], a Gaussian-visible, Bernoulli-hidden variant suited to real-valued features, with a context pathway that conditions hidden unit activations on neighborhood features. The model’s visible inputs are a node’s features ∈ℝnvv ^n_v and neighborhood context ∈ℝnvc ^n_v (Eq. (1)), with binary hidden units ∈0,1nhh∈\0,1\^n_h as the latent layer. Sign vector construction. The sign vector s in Eq. (1) is estimated from training data as sd=sign(Pearson(xi,d,x¯(i),d))s_d=sign(Pearson(x_i,d, x_N(i),d)), flipping anti-homophilic dimensions so that the signed context is positively correlated with node features across all dimensions. This is fitted once before training from feature statistics alone (no labels) and kept fixed. Because it needs no labels, it can be re-estimated on any new window of unlabeled nodes exactly as it was first fitted, and this refresh restores calibration after sign corruption (Appendix E.2). Energy function. The joint energy is E(,,,θ)=12∥−v∥2−∑j=1nhhj(j⊤+^j+bj),E(v,h,c;θ)= 12 -b_v ^2- _j=1^n_hh_j (w_j v+ c_j+b_j ), (2) where ^j=(j⊤)⋅σ(Gatej⊤) c_j=(U_j c)·σ(Gate_j c) is a Gated Linear Unit [42] context embedding and θ=,,Gate,v,hθ=\W,U,Gate,b_v,b_h\. When context is absent (=0c=0), the multiplicative j⊤U_j c factor vanishes and the model recovers a standard RBM. The free energy marginalizing over h is F(,,θ)=12∥−v∥2−∑j=1nhsoftplus(j⊤+^j+bj).F(v,c;θ)= 12 -b_v ^2- _j=1^n_hsoftplus (w_j v+ c_j+b_j ). (3) Context Boost score. Definition 1 (Context Boost). The Context Boost score is CB(,,θ)=∑j=1nh[softplus(j⊤+^j+bj)−softplus(j⊤+bj)].CB(v,c;θ)= _j=1^n_h [softplus (w_j v+ c_j+b_j )-softplus (w_j v+b_j ) ]. (4) CB measures how much neighborhood context reduces free energy beyond features alone. The quadratic term 12|−v|2 12|v-b_v|^2 cancels exactly in the subtraction, so CB depends only on hidden-unit activations, not on feature reconstruction cost. For a legitimate node with consistent context, the context pathway activates strongly and CB is large. For an adversarial node with absent or random context, the context contribution vanishes (algebraically when =0c=0, suppressed by the GLU gate when noisy) and CB is near zero (Theorem 1; Figure 1). Training. We train exclusively on legitimate node pairs (i,i)∼legit(x_i,c_i) _legit via Contrastive Divergence CD-1 [16]. No attack labels are used. We set the sparsity penalty λsp=0 _sp=0; nonzero sparsity drives mean hidden activations below 0.5 and weakens the context contribution. Detection. The detection score for node i is si=−CB(i,i)s_i=-CB(x_i,c_i). The threshold τ∗τ^* is set at the 95th percentile of −CB-CB over a held-out calibration slice of the pool, setting a nominal 5%5\% calibration target. Nodes with si≥τ∗s_i≥τ^* are flagged as adversarial. Figure 4 and Algorithm 1 (Appendix A) summarize the full pipeline. Complexity. Training costs O(N⋅nh⋅nv)O(N· n_h· n_v) per epoch on N training nodes and inference O(nh⋅nv)O(n_h· n_v) per node, as for a standard RBM, since the single-hop context is precomputed once and only closed-form free energies are evaluated [43]. 5 Theoretical Guarantees We establish two complementary results for the CB score. The first gives a sufficient condition under which the expected CB of legitimate nodes exceeds that of adversarial nodes. The second shows that CB remains stable under natural concept drift, explaining why a single threshold serves both detection and drift resilience. Both are worst-case certificates rather than predictions of the observed error, which Section 6 measures directly. Full proofs are deferred to Appendix B. Remarks below provide intuition and justification; constants are verified in Table 2. 5.1 Assumptions Assumption 1 (Signed Structural Correlation). The signed mean-pool context (1) satisfies i∼legit[cos(i,i)]≥ρ0>0,for some ρ0∈(0,1].E_i _legit [ (x_i,c_i) ]≥ _0>0, some _0∈(0,1]. (5) Remark 5.1. s corrects anti-homophilic dimensions [44] via sd=sign(Pearson(xi,d,x¯(i),d))s_d=sign(Pearson(x_i,d, x_N(i),d)), computed once on the training set. Per-dimension covariances are non-negative by construction, so ρ0>0 _0>0 whenever any dimension has nonzero neighbor covariance, which we measure directly (§6). Assumption 2 (Coherent Activation). After training, a fraction β0∈(0,1) _0∈(0,1) of hidden units j satisfy ℙ(,)∼legit[αjfeat≥0andαjctx≥0]≥p0>0,P_(v,c) _legit [ _j^feat≥ 0\;and\; _j^ctx≥ 0 ]\;≥\;p_0>0, (6) where αjfeat=j⊤+bj _j^feat=w_j v+b_j and αjctx=^j _j^ctx= c_j. Remark 5.2. A nontrivial fraction of hidden units jointly activate on matched (,)(x,c) pairs. Under the Gaussian-projection and symmetry assumptions of the arcsine argument in Appendix B, p0≥14+ρ0/(2π)p_0≥ 14+ _0/(2π), which predicts p0≥0.30p_0≥ 0.30 on XBlock and 0.360.36 on Reddit before training. After training, β0=0.38 _0=0.38 and 0.950.95, that is, 9797 of 256256 and 122122 of 128128 hidden units (Table 2). Assumption 3 (Bounded Moments). [‖22]≤Mx2E[\|x\|_2^2]≤ M_x^2 and [‖22]≤Mc2E[\|c\|_2^2]≤ M_c^2. Assumption 4 (Adversarial Context Gap). The adversarial context distribution satisfies, for every hidden unit j, ′∼rand[max(^j′,0)]≤ρ1∥j∥Mc,for some ρ1∈[0,ρ0).E_c _rand\! [ ( c _j,0) ]\;≤\; _1\, _j \,M_c, some _1∈[0, _0). (7) Remark 5.3. Here ρ1 _1 bounds positive gated-context activation under adversarial context, and Δρ=ρ0−ρ1>0 ρ= _0- _1>0 denotes the detection gap. Theorem 1 certifies separation when the adversarial positive-context bound lies sufficiently below the dominance margin of Assumption 5. Assumption 5 (Coherent Dominance). The expected gain G_C of the coherent units of Assumption 2 on their joint-positive events exceeds the expected negative contribution N of all units by a margin γ>0γ>0 independent of nhn_h, G−N≥γG_C-N≥γ (both normalized by nhn_h and defined in Appendix B.2). Remark 5.4. Assumption 1 captures homophily [45]. Assumption 2 formalizes the consequences of training on correlated data. Assumption 3 imposes standard boundedness conditions. Assumption 4 bounds the positive gated-context activation that adversarial context can produce—a realistic constraint, since attackers cannot fabricate authentic interaction history at scale. Assumption 5 involves only the legitimate distribution and the trained model, so it is checked without adversarial data. Before training, the arcsine bound on p0p_0 checks the coherence of Assumption 2 on which the gain G_C rests. 5.2 Separation and Stability Let Ψ=[CB∣legit]>0 =E[CB _legit]>0 denote the expected CB under the legitimate distribution, Φ(ρ1)=[CB∣fraud,rand] ( _1)=E[CB _fraud,Q_rand] the expected CB under adversarial features and context, and d(′,legit)=inf∈legit‖′−‖d(x ,P_legit)= _x _legit\|x -x\| the feature deviation of an adversarial node from the legitimate support. Theorem 1 (Separation). Under Assumptions 1–5, Ψ≥nhγ ≥ n_hγ. If, in addition, ρ1u¯Mc≤γ−ε _1 uM_c≤γ- for some ε>0 >0 independent of nhn_h, where u¯=1nh∑j‖j‖ u= 1n_h _j\|U_j\|, then Ψ−Φ≥nhε - ≥ n_h , a strict separation growing linearly in nhn_h. For any threshold τ∗∈(Φ,Ψ)τ^*∈( , ), Chebyshev’s inequality gives ℙ(,)∼legit[CB(,;θ∗)<τ∗] _(x,c) _legit[CB(x,c;θ^*)<τ^*] ≤Var[CB∣legit](Ψ−τ∗)2, ≤ Var[CB _legit]( -τ^*)^2, (8) ℙ′∼fraud,′∼rand[CB(′,′;θ∗)≥τ∗] _x _fraud,\,c _rand[CB(x ,c ;θ^*)≥τ^*] ≤Var[CB∣fraud,rand](τ∗−Φ)2. ≤ Var[CB _fraud,Q_rand](τ^*- )^2. (9) Both bounds are finite since Var[CB]≤(∑jMj)2<∞Var[CB]≤( _jM_j)^2<∞ (Lemma 2). Proof sketch. Step 1: Decomposition. Write CB(,)=∑jΔjCB(v,c)= _j _j where Δj=softplus(αjfeat+αjctx)−softplus(αjfeat) _j=softplus( _j^feat+ _j^ctx)-softplus( _j^feat). Step 2: Legitimate lower bound. On the joint-positive event (Assumption 2), Lemma 1 gives Δj≥softplus(αjctx)−log2≥0 _j ( _j^ctx)- 2≥ 0. Summing the coherent units’ gains and subtracting every unit’s expected negative contribution, Assumption 5 gives Ψ≥nh(G−N)≥nhγ>0 ≥ n_h(G_C-N)≥ n_hγ>0. Step 3: Adversarial upper bound. Whatever the features, Δj≤max(^j,0) _j≤ ( c_j,0), so Assumption 4 gives Φ≤nhρ1u¯Mc ≤ n_h _1 uM_c and hence Ψ−Φ≥nhε - ≥ n_h . Step 4: Tail bounds. Since Var[CB]≤(∑jMj)2Var[CB]≤( _jM_j)^2 (Lemma 2), both variances are finite and Chebyshev yields the bounds in (8)–(9). See Appendix B.2 for the full proof. ∎ Corollary 1 (Detection Guarantee). Under the conditions of Theorem 1, setting τ∗=(Ψ+Φ)/2τ^*=( + )/2 gives FPR≤4Var[CB∣legit](Ψ−Φ)2,1−TPR≤4Var[CB∣fraud,rand](Ψ−Φ)2.FPR\;≤\; 4\,Var[CB _legit]( - )^2, 1-TPR\;≤\; 4\,Var[CB _fraud,Q_rand]( - )^2. Remark 5.5. Separation is certified when the adversarial positive-context bound ρ1u¯Mc _1 uM_c lies below the legitimate dominance margin γ, and the certified margin shrinks as ρ1 _1 grows. The Chebyshev bounds are finite but can be vacuous, since (∑jMj)2( _jM_j)^2 exceeds the measured Var[CB]Var[CB] by 8,300×8,300× on XBlock and 237,000×237,000× on Reddit, so detection is measured on the full score distributions (Figure 1, Table 1). Theorem 2 (Drift Stability). Let (t,t)∼tt=0T\(x_t,c_t) _t\_t=0^T undergo natural drift where: (i) Correlation structure persists: [cos(t,t)]≥ρ0E[ (x_t,c_t)]≥ _0 for all t. (i) Drift is smooth in Wasserstein-1, W1(t,t−1)≤δdriftW_1(P_t,P_t-1)≤ _drift for all t, and every tP_t is supported on ∥2≤Mc\\|c\|_2≤ M_c\. Then for CB-RBM trained on 0P_0, |[CB(t,t)]−[CB(0,0)]|≤Ltδdrift, |E[CB(x_t,c_t)]-E[CB(x_0,c_0)] |≤ L\,t\, _drift, (10) where L=Lv+LcL=L_v+L_c is the Lipschitz constant of CB on that region (Lemma 3). Corollary 3 gives a worst-case horizon over which the legitimate mean remains above the midpoint threshold (Ψ+Φ)/2( + )/2. Proof sketch. CBCB is L-Lipschitz (Lemma 3); Kantorovich–Rubinstein gives |[CBt]−[CBt−1]|≤L⋅W1(t,t−1)≤Lδdrift|E[CB_t]-E[CB_t-1]|≤ L· W_1(P_t,P_t-1)≤ L _drift. Telescoping over t steps yields (10); full proofs, including Corollary 2 and the drift-horizon corollary, in Appendix B. ∎ Corollary 2 (Quantile Stability). Under condition (i) of Theorem 2, the quantile functions QtQ_t of the detection score −CB(t,t)-CB(x_t,c_t) satisfy ∫01|Qt(u)−Q0(u)|u≤Ltδdrift _0^1|Q_t(u)-Q_0(u)|\,du≤ L\,t\, _drift. Remark 5.6. Natural drift preserves feature-context correlation and causes CB to change gradually at rate LδdriftL\, _drift per step. Adversarial injection breaks this correlation and causes immediate CB suppression. This asymmetry is what enables a single threshold to simultaneously detect adversaries and tolerate drift. Corollary 2 controls the score quantiles on average but not the 95th percentile pointwise, which Appendix I.2 measures directly. General attacks. The separation condition depends on an attack only through the positive-context bound ρ1 _1 of Assumption 4, since Φ≤nhρ1u¯Mc ≤ n_h _1 uM_c holds for any adversarial features. Feature deviation acts as a bounded perturbation. At fixed context, it changes each unit’s contribution by at most ‖j‖2d\|w_j\|_2\,d (Appendix B.2). The context-interpolation sweep in Appendix J moves the attack context from its revealing to its camouflaging end. Detection falls below 50%50\% once the camouflaging share exceeds α∗≈0.56α^*≈ 0.56 on XBlock and 0.580.58 on Reddit, and the hardest camouflage is whichever context brings ρ1eff _1^eff closest to ρ0 _0. 6 Experiments 6.1 Setup Datasets. We use two attributed graphs from distinct domains: (1) XBlock (153153K Ethereum wallet nodes, 0.7%0.7\% phishing, 3838 features, ρ0=0.30 _0=0.30) and (2) Reddit (1111K social-media users, 3.3%3.3\% banned, 7373 features, ρ0=0.68 _0=0.68). Context vectors are a per-dimension sign-corrected mean-pool over graph neighbors (Eq. (1)), preserving ρ0>0 _0>0 regardless of homophily direction. Full dataset details and verified Assumption 1–3 constants in Appendix C; two further datasets — Tolokers (crowdsourcing) and YelpChi (e-commerce review fraud) — evaluated in Appendix K. Baselines. We benchmark CB-RBM against six baselines from the GADBench [46] suite. GraphSAGE [47], GAT [48] and GCN [49] represent supervised fraud GNNs, foundational variants that GADBench shows match or exceed specialized fraud-GNN refinements, and DOMINANT [13], CoLA [14] and GAE [50] represent unsupervised attributed-graph anomaly detection. A standard RBM without context (Std-RBM) is the ablation. We also compare against nine detectors from the neighborhood-aware and drift-aware classes closest to our setting. These are the supervised XGBGraph [46], BWGNN [23] and Graph Transformer [51], the shift-robust GDN [29], the generalist ARC [34], the reconstruction-based GAD-NR [25] and AnomalyDAE [24], the contrastive CONAD [26] and the one-class OCGNN [27]. Two further ablations, a parameter-free signed-cosine score and a context-conditioned MLP without the RBM and GLU (Context-MLP), isolate our formulation. The nine detectors follow their published configurations, with model selection on a held-out validation split (Appendix D). Supervised GNNs use 932 / 166 labeled adversaries on XBlock / Reddit; all other methods use zero labels. Metrics. TPR@5%FPR: true positive rate at a 5%-FPR-calibrated threshold on legitimate nodes (no adversarial labels needed). Stability: 1−FPRdrift1-FPR_drift, fraction of legitimate nodes correctly classified under drift. Combined Score: TPR@5%FPR×StabilityTPR@5\%FPR×Stability per attack; we also report the mean over the four attacks as “average Combined”. CB-RBM configuration. nh=256n_h=256 for XBlock and nh=128n_h=128 for Reddit (capacity ablation in Appendix G), 100 epochs of CD-1, sparsity cost =0=0. 6.2 Separation Gap and Theory Validation (a) XBlock (b) Reddit Figure 1: CB score distributions, with calibrated threshold τ∗τ^* (5% FPR). (a) XBlock (ρ0=0.30 _0=0.30) (b) Reddit (ρ0=0.68 _0=0.68) Figure 2: Squared separation gap [(Ψ−Φ)/Ψ]2[( - )/ ]^2 vs. ρ1eff _1^eff (Thm. 1). A clear structural divide separates legitimate from adversarial CB score distributions on both datasets (Fig. 1): legitimate and naturally drifted nodes concentrate well above the threshold τ∗τ^*, while all four attack types cluster predominantly below it — regardless of whether the adversary copies features, fabricates context, or rewires edges. On each dataset, a single threshold calibrated from the legitimate distribution generalizes across all four attacks. To understand why some attacks come closer to the threshold than others, we measure ρ1eff _1^eff, the fraction of the RBM’s learned legitimate-context activation that each attack achieves (0 = no legitimate context, 1 = indistinguishable from legitimate) — the effective adversarial correlation through the trained GLU weights, which rises when an adversary connects to legitimate hubs — and plot it against the squared separation gap (Figure 2; the squared form reflects the Chebyshev error bound of Theorem 1). The result traces a smooth, monotonically decreasing curve on both datasets, consistent with Theorem 1, whose certified margin shrinks as ρ1 _1 grows. Sybil’s fabricated context is rejected by the learned weights; Relation Camouflage, the only attack that acquires connections to real legitimate hubs, reaches the highest ρ1eff _1^eff (0.510.51–0.640.64) and the steepest gap reduction. Natural Drift preserves the legitimate correlation structure (ρ1eff≈1 _1^eff≈ 1) and sits at near-zero gap — explaining why the same threshold that catches adversaries does not trigger false alarms under drift. 6.3 Attack Benchmark Table 1: Attack benchmark. Each cell: AUROC / TPR@5%FPR (%). Best per row in bold. Attack Energy-based Supervised Unsupervised CB-RBM Std-RBM SAGE GAT GCN DOM. CoLA GAE XBlock Isolated Inj. 99.9/100 86.8/51.6 97.6/90.1 91.7/75.2 95.4/80.8 96.9/78.1 56.4/17.2 98.1/89.5 Feat. Camo 99.9/100 51.3/11.0 92.6/77.8 54.6/10.2 84.0/29.7 96.4/72.5 57.3/16.2 96.7/78.7 Sybil 99.8/100 86.8/51.6 98.8/94.9 99.4/100 99.6/100 98.1/98.8 62.5/21.6 96.6/77.4 Rel. Camo 97.6/96.8 86.8/51.6 98.6/92.4 98.2/97.8 97.8/87.8 97.0/86.9 72.1/20.2 97.7/88.9 Reddit Isolated Inj. 99.4/97.2 60.0/10.7 61.9/0.5 73.5/38.3 82.2/62.8 98.0/91.3 93.7/83.8 99.1/97.3 Feat. Camo 99.6/98.2 52.4/4.3 55.1/0.0 58.4/18.2 57.3/29.5 90.6/79.7 92.7/79.0 90.5/86.5 Sybil 100/100 60.0/10.7 68.2/1.8 92.9/66.7 81.8/33.3 99.9/100 85.8/43.2 97.4/86.8 Rel. Camo 97.3/88.2 60.0/10.7 83.2/19.7 82.1/5.2 83.7/19.2 93.2/52.8 77.9/18.7 89.3/48.5 Table 1 compares per-attack detection. The four attacks span a spectrum of adversarial context quality, from uncorrelated (Isolated Injection, Feature Camouflage) through fabricated (Sybil) to partially genuine (Relation Camouflage). CB-RBM’s AUROC tracks this spectrum cleanly on both datasets: it stays above 99%99\% on three attacks and drops to ∼97% 97\% on Relation Camouflage (where the adversary acquires genuine hub connections), consistent with the Δρ ρ-dependent separation of Theorem 1. Across all four attacks on both datasets (14×14× scale, ρ0=0.30 _0=0.30 vs 0.680.68), CB-RBM maintains AUROC ≥96%≥\!96\% and TPR@5%FPR ≥88%≥\!88\% at zero labels. Over 3 seeds, the standard deviation of CB-RBM’s AUROC is at most 0.10.1 points on XBlock and 1.21.2 on Reddit, and that of its TPR at most 0.30.3 and 4.54.5 points. Supervised GNNs, despite their full label budget, remain undertrained in this regime (best Reddit supervised result: GAT at 67%67\% TPR on Sybil). Unsupervised baselines avoid labels but their signal does not transfer reliably across datasets (CoLA: 84%→17%84\%\!→\!17\% TPR). 6.4 Drift Stability (a) XBlock (b) Reddit Figure 3: Combined Score under gradual drift across 20 time steps. Following standard practice in the concept drift literature [28, 8], we model gradual drift as an incremental random walk in feature space over T steps, with neighborhood context recomputed at each step to reflect the evolving features. Figure 3 reports the Combined Score (detection × stability, §6.1) as drift accumulates, using each method’s mean TPR across the four attacks of Table 1 (FPRdrift is measured on legitimate nodes only, so we average TPR across attacks but use a single FPR curve); additional drift regimes and real temporal validation are in Appendix I. Figure 3 reveals three patterns. First, reconstruction-based detectors (GAE, DOMINANT), strong on the static benchmark (§6.3), collapse as their learned reconstruction targets become stale — DOMINANT drops to near zero on XBlock, and GAE from 0.750.75 to 0.070.07 on Reddit. Second, supervised GNNs split by label availability. On XBlock, where labels provide a strong training signal, GNNs learn robust decision boundaries that generalize under drift, achieving Combined Scores up to 0.840.84 (GraphSAGE). On Reddit, where labels are scarce, the same architectures remain undertrained (§6.3), and their Combined Score remains below 0.360.36 throughout — stable only because there is weak TPR to degrade. Third, CB-RBM is the only method that consistently leads on both datasets, maintaining average Combined ≥0.87≥ 0.87 at T=20T=20 in both the label-rich and label-scarce regimes. Theorem 2 bounds how far the scores move under smooth drift, and Figure 3 measures the resulting detection and false alarms at the frozen threshold. Across five chronological XBlock windows from 2017 through 2018, with the model, sign vector and threshold frozen on the earliest window, CB-RBM keeps the legitimate-wallet FPR at or below 5%5\%, reaching 3.1%3.1\% by late 2018, and detects 100%100\% of isolated injections built from real held-out phishing features. GAT and GraphSAGE, which score the phishing wallets in the original graph, detect 8484–89%89\% and 81%81\% (Appendix I.4). Table 1 and Figure 3 report eight methods per attack and over the full drift trajectory. We compare the other detectors of §6.1 with the same Combined Score at the last drift step, T=20T=20 (Appendix D). At that step, the strongest baselines are GraphSAGE (0.840.84) and XGBGraph (0.810.81, with TPR 0.980.98 but drift FPR 17.8%17.8\%) on XBlock and GAD-NR (0.630.63) on Reddit, against 0.940.94 and 0.880.88 for CB-RBM. Over five seeds, the Combined Scores of XGBGraph, Graph Transformer, BWGNN and GDN vary with a standard deviation below 0.050.05. GAD-NR misses the self-consistent Sybil clique on XBlock (0%0\% TPR). GDN reaches 10.4%10.4\% drift FPR on XBlock and ARC 47.2%47.2\% on Reddit. The ablations show that each ingredient fails on its own. The RBM without context collapses under drift, the signed-cosine score reaches only 0.170.17 and 0.570.57 Combined, and Context-MLP reaches a static AUROC of at least 0.950.95 on every Reddit attack yet raises 96%96\% false alarms under drift. The principle supplies detection, and the closed-form differential supplies the calibration that survives drift. 6.5 Discussion What does CB detect? The CB score fires on absence of legitimate neighborhood context rather than on feature deviation itself. The GLU gate suppresses the context pathway whenever the aggregated neighborhood correlation departs from the pattern learned during training, so a node is flagged for failing to corroborate the model’s learned correlation pattern, a stricter test than raw feature-context geometry. Controlled decomposition experiments (Appendix F) confirm this on both datasets: legitimate features paired with random or absent context are flagged as reliably as adversarial features with random context (Combined ≥0.91≥ 0.91), while legitimate features with legitimate context consistently evade detection (Combined ≤0.11≤ 0.11). An XBlock trace gives CB=1046CB=1046 for a median legitimate node, 952952 after 2020 drift steps, and 2828 for an injected adversary (Appendix F). The same mechanism also bounds what CB-RBM can catch — an adversary who acquires genuine network connections eventually restores the correlation signal and evades, consistent with the ρ1eff _1^eff trajectory in Figure 2. Why the drift bound is conservative. Theorem 2 bounds the worst case: it allows every feature coordinate to move adversarially within the drift budget. Natural drift does not look like this, because features and their aggregated context co-evolve through the mean-pool operator and preserve their legitimate correlation step-by-step; movement along this correlated direction lies in a low-sensitivity region of the softplus differences in Eq. (4). The observed CB shift at T=20T=20 is therefore smaller than the bound evaluated at the measured value of McM_c by more than two orders of magnitude — a 526×526× slack on XBlock and a 4,540×4,540× slack on Reddit (Table 12). At T=20T=20, the empirical 9595th percentile of the legitimate scores shifts by 42.742.7 on XBlock and 3.43.4 on Reddit, while mean FPR at the frozen threshold reaches 6.1%6.1\% and 7.1%7.1\% (Appendix I.2). False-positive recovery under drift. When adversarial context approaches legitimate context, supervised baselines with adequate labels can detect better. YelpChi, where the raw correlation gap is negative (Δρ=−0.013 ρ=-0.013), tests this regime (Appendix K.2). Even there, CB-RBM’s drift stability pays off as a no-cost filter stacked atop those supervised baselines — on YelpChi it eliminates 87.687.6–93.5%93.5\% of each baseline’s drift-induced false alarms with no extra labels, training, or pipeline changes (Appendix L). Ablation. The context pathway is what CB-RBM relies on; the surrounding architectural choices are largely fungible. Removing context (reducing the model to a free-energy RBM) collapses Combined Score by two to three orders of magnitude on both datasets, whereas varying hidden capacity within each dataset’s stable range or swapping the pooling operator (mean, max, or attention) leaves detection near its ceiling (Combined ≥0.87≥ 0.87 at the per-dataset optima; Appendix G). Robustness. Contaminating the training and calibration pools with up to 10%10\% fraud flips no sign dimension and keeps FPR at or below 5.0%5.0\%, although Relation Camouflage TPR on XBlock falls to 39.0%39.0\% (Appendix E.1). A stale sign vector raises FPR without hurting Isolated Injection detection, and re-estimating it without labels restores the 5%5\% target (Appendix E.2). Drift that delays, weakens or reverses the feature-context link keeps FPR at or below 6.2%6.2\% on XBlock and 13.2%13.2\% on Reddit at T=20T=20, and when all eight methods are recalibrated under co-evolving drift, CB-RBM keeps the highest Combined Score (Appendix I.3). With a Sybil clique that grows from 22 to 5050 members over 5050 steps, CB-RBM flags 100%100\% of the attackers on both datasets from step 1010, against 51.3%51.3\% on XBlock and 9.5%9.5\% on Reddit for a standard RBM (Appendix I.5). Limitations. CB-RBM relies on ρ0>0 _0>0, which can fail in random or adversarially curated topologies. Detection also degrades as Δρ ρ collapses, allowing supervised baselines with adequate labels to perform better. The method is most effective against adversaries who lack legitimate neighborhood history; as the ρ1eff _1^eff analysis shows, an attacker who successfully acquires genuine hub connections (Relation Camouflage) reduces the detection gap and, in the limit, becomes indistinguishable from legitimate users (Appendices J and L). Substantial topology change can impair calibration at the frozen threshold, and a label-free threshold refresh then restores the 5%5\% target (Appendix I.3). Finally, white-box adversaries with gradient access to the detector can lower detection (Appendix H), and our drift analysis assumes smooth drift, so abrupt or adversarial distribution shifts may need mechanisms beyond the algebraic cancellation we exploit. 7 Conclusion We presented CB-RBM, a label-free detector exploiting feature-context consistency: the same structural signal — nonzero correlation between a node’s features and its neighborhood context — simultaneously enables detection (broken for injected adversaries) and keeps calibration under drift (preserved under population-level shifts). On XBlock (153K Ethereum wallets) and Reddit (11K users), CB-RBM achieves AUROC ≥0.96≥ 0.96 on all non-white-box attacks at zero labels and maintains Combined Score ≥0.87≥ 0.87 at T=20T=20 under drift, while supervised GNNs underperform even with their full label set, unsupervised baselines collapse under drift, and Std-RBM loses calibration entirely. The ρ1eff _1^eff analysis reveals a clear detection boundary: CB-RBM detects absence of legitimate network context, not feature deviation — explaining both its strengths and its fundamental limit against adversaries who acquire genuine connections. Two extensions follow naturally: dynamic graphs with streaming edges, where the same Lipschitz structure carries over; and porting the Context Boost principle to other generative architectures (Appendix M). Acknowledgments and Disclosure of Funding This work was funded in part by the Luxembourg National Research Fund (FNR), grant reference NCER22/IS/16570468/NCER-FT, through the FutureFinTech National Centre of Excellence in Research and Innovation, co-funded by the Luxembourg Ministry of Finance. For the purpose of open access, and in fulfilment of the obligations arising from the grant agreement, the authors have applied a Creative Commons Attribution 4.0 International (C BY 4.0) license to any Author Accepted Manuscript version arising from this submission. This work was also supported by the Luxembourg AI Factory (L-AIF, grant agreement ID 1012343366). The authors declare no competing interests. References [1] Federal Bureau of Investigation (2023) 2023 internet crime report. Technical report Internet Crime Complaint Center (IC3). External Links: Link Cited by: §1. [2] Federal Bureau of Investigation (2024) 2024 internet crime report. Technical report Internet Crime Complaint Center (IC3). External Links: Link Cited by: §1. [3] I. Rosenberg, A. Shabtai, Y. Elovici, and L. Rokach (2021) Adversarial machine learning attacks and defense methods in the cyber security domain. ACM Computing Surveys (CSUR) 54 (5), p. 1–36. Cited by: §1. [4] J. Wu, Q. Yuan, D. Lin, W. You, W. Chen, C. Chen, and Z. Zheng (2020) Who are the phishers? phishing scam detection on ethereum via network embedding. IEEE Transactions on Systems, Man, and Cybernetics: Systems 52 (2), p. 1156–1166. Cited by: §1. [5] Q. Yuan, S. Guan, P. Ni, T. Luo, P. Wong, V. Chang, and K. L. Man (2026) Continual graph learning: a survey. Pattern Recognition, p. 113600. Cited by: §1. [6] M. Wu, X. Zheng, Q. Zhang, X. Shen, X. Luo, X. Zhu, and S. Pan (2024) Graph learning under distribution shifts: a comprehensive survey on domain adaptation, out-of-distribution, and continual learning. arXiv preprint arXiv:2402.16374. Cited by: §1. [7] R. Auer, B. Haslhofer, S. Kitzler, P. Saggese, and F. Victor (2024) The technology of decentralized finance (defi). Digital Finance 6 (1), p. 55–95. Cited by: §1. [8] J. Lu, A. Liu, F. Dong, F. Gu, J. Gama, and G. Zhang (2018) Learning under concept drift: a review. IEEE transactions on knowledge and data engineering 31 (12), p. 2346–2363. Cited by: Appendix I, §1, §2, §6.4. [9] D. Zambon, C. Alippi, and L. Livi (2018) Concept drift and anomaly detection in graph streams. IEEE transactions on neural networks and learning systems 29 (11), p. 5592–5605. Cited by: §1, §2. [10] Y. Dou, Z. Liu, L. Sun, Y. Deng, H. Peng, and P. S. Yu (2020) Enhancing graph neural network-based fraud detectors against camouflaged fraudsters. In Proceedings of the 29th ACM international conference on information & knowledge management, p. 315–324. Cited by: §1, §2. [11] Z. Liu, Y. Dou, P. S. Yu, Y. Deng, and H. Peng (2020) Alleviating the inconsistency problem of applying graph neural network to fraud detection. In Proceedings of the 43rd international ACM SIGIR conference on research and development in information retrieval, p. 1569–1572. Cited by: §1, §2. [12] Y. Liu, X. Ao, Z. Qin, J. Chi, J. Feng, H. Yang, and Q. He (2021) Pick and choose: a gnn-based imbalanced learning approach for fraud detection. In Proceedings of the web conference 2021, p. 3168–3177. Cited by: §1, §2. [13] K. Ding, J. Li, R. Bhanushali, and H. Liu (2019) Deep anomaly detection on attributed networks. In Proceedings of the 2019 SIAM international conference on data mining, p. 594–602. Cited by: §1, §2, §6.1. [14] Y. Liu, Z. Li, S. Pan, C. Gong, C. Zhou, and G. Karypis (2021) Anomaly detection on attributed networks via contrastive self-supervised learning. IEEE transactions on neural networks and learning systems 33 (6), p. 2378–2392. Cited by: §1, §2, §6.1. [15] Y. Du and I. Mordatch (2019) Implicit generation and modeling with energy based models. Advances in neural information processing systems 32. Cited by: §1. [16] G. E. Hinton (2002) Training products of experts by minimizing contrastive divergence. Neural computation 14 (8), p. 1771–1800. Cited by: §1, §4. [17] A. Pumsirirat (2018) Credit card fraud detection using deep learning based on auto-encoder and restricted boltzmann machine. International Journal of advanced computer science and applications. Cited by: §1. [18] U. Fiore, F. Palmieri, A. Castiglione, and A. De Santis (2013) Network anomaly detection with the restricted boltzmann machine. Neurocomputing 122, p. 13–23. Cited by: §1. [19] Ł. Korycki and B. Krawczyk (2023) Adversarial concept drift detection under poisoning attacks for robust data stream mining. Machine learning 112 (10), p. 4013–4048. Cited by: §1. [20] G. E. Hinton (2012) A practical guide to training restricted boltzmann machines. In Neural Networks: Tricks of the Trade: Second Edition, p. 599–619. Cited by: §1. [21] L. Chen, J. Peng, Y. Liu, J. Li, F. Xie, and Z. Zheng (2020) Phishing scams detection in ethereum transaction network. ACM Transactions on Internet Technology (TOIT) 21 (1), p. 1–16. Cited by: Appendix C, NeurIPS Paper Checklist, NeurIPS Paper Checklist, 4th item. [22] S. Kumar, X. Zhang, and J. Leskovec (2019) Predicting dynamic embedding trajectory in temporal interaction networks. In Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining, p. 1269–1278. Cited by: Appendix C, NeurIPS Paper Checklist, NeurIPS Paper Checklist, 4th item. [23] J. Tang, J. Li, Z. Gao, and J. Li (2022) Rethinking graph neural networks for anomaly detection. In International conference on machine learning, p. 21076–21089. Cited by: §2, §6.1. [24] H. Fan, F. Zhang, and Z. Li (2020) AnomalyDAE: dual autoencoder for anomaly detection on attributed networks. In ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), p. 5685–5689. Cited by: §2, §6.1. [25] A. Roy, J. Shu, J. Li, C. Yang, O. Elshocht, J. Smeets, and P. Li (2024) GAD-NR: graph anomaly detection via neighborhood reconstruction. In Proceedings of the 17th ACM international conference on web search and data mining, p. 576–585. Cited by: §2, §6.1. [26] Z. Xu, X. Huang, Y. Zhao, Y. Dong, and J. Li (2022) Contrastive attributed network anomaly detection with data augmentation. In Pacific-Asia conference on knowledge discovery and data mining, p. 444–457. Cited by: §2, §6.1. [27] X. Wang, B. Jin, Y. Du, P. Cui, Y. Tan, and Y. Yang (2021) One-class graph neural networks for anomaly detection in attributed networks. Neural computing and applications 33 (18), p. 12073–12085. Cited by: §2, §6.1. [28] J. Gama, I. Žliobaitė, A. Bifet, M. Pechenizkiy, and A. Bouchachia (2014) A survey on concept drift adaptation. ACM computing surveys (CSUR) 46 (4), p. 1–37. Cited by: Appendix I, §2, §6.4. [29] Y. Gao, X. Wang, X. He, Z. Liu, H. Feng, and Y. Zhang (2023) Alleviating structural distribution shift in graph anomaly detection. In Proceedings of the sixteenth ACM international conference on web search and data mining, p. 357–365. Cited by: §2, §6.1. [30] X. Xu, X. Lin, K. Takeuchi, K. Atarashi, and H. Kashima (2025) Robust anomaly detection under normality distribution shift in dynamic graphs. arXiv preprint arXiv:2509.17400. Cited by: §2. [31] L. Cai, Z. Chen, C. Luo, J. Gui, J. Ni, D. Li, and H. Chen (2021) Structural temporal graph neural networks for anomaly detection in dynamic graphs. In Proceedings of the 30th ACM international conference on Information & Knowledge Management, p. 3747–3756. Cited by: §2. [32] Y. Liu, S. Pan, Y. G. Wang, F. Xiong, L. Wang, Q. Chen, and V. C. Lee (2021) Anomaly detection in dynamic graphs via transformer. IEEE Transactions on Knowledge and Data Engineering 35 (12), p. 12081–12094. Cited by: §2. [33] O. A. Ekle and W. Eberle (2024) Anomaly detection in dynamic graphs: a comprehensive survey. ACM Transactions on Knowledge Discovery from Data 18 (8), p. 1–44. Cited by: §2. [34] Y. Liu, S. Li, Y. Zheng, Q. Chen, C. Zhang, and S. Pan (2024) ARC: a generalist graph anomaly detector with in-context learning. Advances in Neural Information Processing Systems 37, p. 50772–50804. Cited by: §2, §6.1. [35] C. Niu, H. Qiao, C. Chen, L. Chen, and G. Pang (2024) Zero-shot generalist graph anomaly detection with unified neighborhood prompts. arXiv preprint arXiv:2410.14886. Cited by: §2. [36] H. Qiao, C. Niu, L. Chen, and G. Pang (2025) AnomalyGFM: graph foundation model for zero/few-shot anomaly detection. In Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 2, p. 2326–2337. Cited by: §2. [37] L. Akoglu, H. Tong, and D. Koutra (2015) Graph based anomaly detection and description: a survey. Data mining and knowledge discovery 29 (3), p. 626–688. Cited by: §3. [38] L. Sun, Y. Dou, C. Yang, K. Zhang, J. Wang, P. S. Yu, L. He, and B. Li (2022) Adversarial attack and defense on graph data: a survey. IEEE Transactions on Knowledge and Data Engineering 35 (8), p. 7693–7711. Cited by: §3. [39] D. Zügner, A. Akbarnejad, and S. Günnemann (2018) Adversarial attacks on neural networks for graph data. In Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining, p. 2847–2856. Cited by: §3. [40] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu (2017) Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083. Cited by: §3. [41] M. Welling, M. Rosen-Zvi, and G. E. Hinton (2004) Exponential family harmoniums with an application to information retrieval. Advances in neural information processing systems 17. Cited by: §4. [42] Y. N. Dauphin, A. Fan, M. Auli, and D. Grangier (2017) Language modeling with gated convolutional networks. In International conference on machine learning, p. 933–941. Cited by: §4. [43] S. Zhai, Y. Cheng, W. Lu, and Z. Zhang (2016) Deep structured energy based models for anomaly detection. In International conference on machine learning, p. 1100–1109. Cited by: §4. [44] J. Zhu, Y. Yan, L. Zhao, M. Heimann, L. Akoglu, and D. Koutra (2020) Beyond homophily in graph neural networks: current limitations and effective designs. Advances in neural information processing systems 33, p. 7793–7804. Cited by: Remark 5.1. [45] K. Z. Khanam, G. Srivastava, and V. Mago (2023) The homophily principle in social network analysis: a survey. Multimedia Tools and Applications 82 (6), p. 8811–8854. Cited by: Remark 5.4. [46] J. Tang, F. Hua, Z. Gao, P. Zhao, and J. Li (2023) GADBench: revisiting and benchmarking supervised graph anomaly detection. Advances in Neural Information Processing Systems 36, p. 29628–29653. Cited by: Appendix D, NeurIPS Paper Checklist, §6.1. [47] W. Hamilton, Z. Ying, and J. Leskovec (2017) Inductive representation learning on large graphs. Advances in neural information processing systems 30. Cited by: §6.1. [48] P. Veličković, G. Cucurull, A. Casanova, A. Romero, P. Lio, and Y. Bengio (2017) Graph attention networks. arXiv preprint arXiv:1710.10903. Cited by: §6.1. [49] T. N. Kipf and M. Welling (2016) Semi-supervised classification with graph convolutional networks. arXiv preprint arXiv:1609.02907. Cited by: §6.1. [50] T. N. Kipf and M. Welling (2016) Variational graph auto-encoders. arXiv preprint arXiv:1611.07308. Cited by: §6.1. [51] Y. Shi, Z. Huang, S. Feng, H. Zhong, W. Wang, and Y. Sun (2020) Masked label prediction: unified message passing model for semi-supervised classification. arXiv preprint arXiv:2009.03509. Cited by: §6.1. [52] M. X. Goemans and D. P. Williamson (1995) Improved approximation algorithms for maximum cut and satisfiability problems using semidefinite programming. Journal of the ACM (JACM) 42 (6), p. 1115–1145. Cited by: Remark B.3. [53] K. Liu, Y. Dou, X. Ding, X. Hu, R. Zhang, H. Peng, L. Sun, and P. S. Yu (2024) PyGOD: a python library for graph outlier detection. Journal of Machine Learning Research 25 (141), p. 1–9. Cited by: Appendix D. [54] B. Hooi, H. A. Song, A. Beutel, N. Shah, K. Shin, and C. Faloutsos (2016) FRAUDAR: bounding graph fraud in the face of camouflage. In Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, p. 895–904. Cited by: Appendix J. [55] O. Platonov, D. Kuznedelev, M. Diskin, A. Babenko, and L. Prokhorenkova (2023) A critical look at the evaluation of GNNs under heterophily: are we really making progress?. arXiv preprint arXiv:2302.11640. Cited by: §K.1, Appendix K, NeurIPS Paper Checklist, NeurIPS Paper Checklist, NeurIPS Paper Checklist. [56] S. Rayana and L. Akoglu (2015) Collective opinion spam detection: bridging review networks and metadata. In Proceedings of the 21th acm sigkdd international conference on knowledge discovery and data mining, p. 985–994. Cited by: Appendix K, NeurIPS Paper Checklist, NeurIPS Paper Checklist. [57] J. Behrmann, W. Grathwohl, R. T. Chen, D. Duvenaud, and J. Jacobsen (2019) Invertible residual networks. In International conference on machine learning, p. 573–582. Cited by: Appendix M. Appendix A Pipeline and Algorithm Figure 4 summarizes CB-RBM from its inputs to the detection decision, and Algorithm 1 gives the full procedure, including the label-free refresh. neighbor featuresjj∈(i)\x_j\_j (i)sign-corrected mean ic_i⊙¯(i)s x_N(i)GLU-gated context ^j c_j(j⊤i)σ(Gatej⊤i)(U_j c_i)\,σ(Gate_j c_i)feature pathway αjfeat _j^featj⊤+bjw_j v+b_jnode features=iv=x_iContext Boost CBCB (Def. 1)∑j[softplus(αjfeat+^j) _j [softplus( _j^feat+ c_j)−softplus(αjfeat)] _j [-softplus( _j^feat) ]quadratic feature term cancelsflag i if−CB≥τ∗-CB≥τ^*Training: CD-1 on the pool assumed legitimate, no anomaly labels.Calibration: τ∗τ^* is the 95th percentile of −CB-CB on a held-out legitimate slice.Label-free refresh: re-estimate s, recompute the contexts and re-estimate τ∗τ^* on the current unlabeled window, with the model frozen. Figure 4: CB-RBM pipeline. The sign-corrected neighbor mean ic_i enters only through the GLU-gated pathway, and the Context Boost is the free-energy reduction due to context, in which the quadratic feature term cancels. The sign vector s and the threshold τ∗τ^* are label-free statistics that can be refreshed on a current unlabeled window without retraining (dashed arrows, Algorithm 1). Algorithm 1 CB-RBM: training, calibration, scoring, and label-free refresh Input: graph G, pool LV_L assumed legitimate (no anomaly labels), calibration slice cal⊂LV_cal _L, capacity nhn_h, target FPR 5%5\%. 1: Sign vector. sd←sign(Pearsoni∈L(xi,d,x¯(i),d))s_d (Pearson_i _L(x_i,d, x_N(i),d) ) for d=1,…,nvd=1,…,n_v (features only) 2: Context. i←⊙1|(i)|∑j∈(i)jc_i 1|N(i)| _j (i)x_j for all i Eq. (1) 3: Training. Fit θ=,,Gate,v,hθ=\W,U,Gate,b_v,b_h\ by CD-1 on (i,i)i∈L∖cal\(x_i,c_i)\_i _L _cal with λsp=0 _sp=0 4: Calibration. τ∗←τ^*← 95th percentile of −CB(i,i)i∈cal\-CB(x_i,c_i)\_i _cal Eq. (4) 5: Scoring. At time t, recompute ic_i from the current neighbors of node i and flag i if −CB(i,i)≥τ∗-CB(x_i,c_i)≥τ^*, with θ frozen 6: Label-free refresh (optional, e.g., on a schedule or after substantial topology change). Re-estimate s as in line 1, recompute the contexts as in line 2 and re-estimate τ∗τ^* as in line 4 on the current unlabeled window, keeping θ frozen. No labels and no retraining. Appendix B Full Proofs We restate all results and provide complete proofs. Recall the CB score CB(,,θ)=∑j=1nh[softplus(αjfeat+αjctx)−softplus(αjfeat)]⏟Δj(,),CB(v,c;\,θ)\;=\; _j=1^n_h [softplus\! ( _j^feat+ _j^ctx )-softplus\! ( _j^feat ) ]_ _j(v,c), (11) where softplus(x)=log(1+ex)softplus(x)= (1+e^x), αjfeat=j⊤+bj _j^feat=w_j v+b_j, and αjctx=^j _j^ctx= c_j. B.1 Supporting Lemmas Lemma 1 (Softplus monotone increment). For all a,b≥0a,b≥ 0, softplus(a+b)−softplus(a)≥softplus(b)−log2.softplus(a+b)-softplus(a)\;≥\;softplus(b)- 2. Proof. Write softplus(a+b)−softplus(a)=log1+ea+b1+ea=log((1−σ(a))+σ(a)eb),softplus(a+b)-softplus(a)= \! 1+e^a+b1+e^a= \! ((1-σ(a))+σ(a)\,e^b ), where σ(a)=ea/(1+ea)σ(a)=e^a/(1+e^a) is the sigmoid. For a≥0a≥ 0, σ(a)≥12σ(a)≥ 12, and for b≥0b≥ 0, eb≥1e^b≥ 1, so (1−σ(a))+σ(a)eb=1+σ(a)(eb−1)≥ 1+12(eb−1)=1+eb2.(1-σ(a))+σ(a)\,e^b=1+σ(a)(e^b-1)\;≥\;1+ 12(e^b-1)= 1+e^b2. Therefore softplus(a+b)−softplus(a)≥log1+eb2=softplus(b)−log2softplus(a+b)-softplus(a)≥ 1+e^b2=softplus(b)- 2. ∎ Lemma 2 (Range of Δj _j). For each hidden unit j and all (,)(v,c), |Δj(,)|≤‖j‖‖| _j(v,c)|≤\|U_j\|\,\|c\|. Hence, under Assumption 3, [Δj2]≤Mj2E[ _j^2]≤ M_j^2 with Mj=‖j‖McM_j=\|U_j\|\,M_c, and Var[CB]≤(∑jMj)2Var[CB]≤( _jM_j)^2. Proof. Since softplussoftplus is monotonically increasing with softplus′=σ∈(0,1)softplus =σ∈(0,1), the mean-value theorem gives |Δj| | _j| =|softplus(αjfeat+αjctx)−softplus(αjfeat)| = |softplus ( _j^feat+ _j^ctx )-softplus ( _j^feat ) | ≤|αjctx|=|^j| ≤| _j^ctx|=| c_j| ≤‖j‖‖. ≤\|U_j\|\,\|c\|. Squaring and taking expectations under Assumption 3 gives [Δj2]≤‖j‖2Mc2=Mj2E[ _j^2]≤\|U_j\|^2M_c^2=M_j^2, and Minkowski’s inequality gives [CB2]1/2≤∑j[Δj2]1/2≤∑jMjE[CB^2]^1/2≤ _jE[ _j^2]^1/2≤ _jM_j, so Var[CB]≤(∑jMj)2Var[CB]≤( _jM_j)^2. The sign of Δj _j equals the sign of αjctx _j^ctx (by monotonicity of softplussoftplus), so both positive and negative values occur. ∎ Lemma 3 (Lipschitz continuity of CB). For any (1,1)(v_1,c_1) and (2,2)(v_2,c_2) with ‖1‖2,‖2‖2≤Mc\|c_1\|_2,\|c_2\|_2≤ M_c, |CB(1,1)−CB(2,2)|≤Lv‖1−2‖+Lc‖1−2‖, |CB(v_1,c_1)-CB(v_2,c_2) |\;≤\;L_v\,\|v_1-v_2\|+L_c\,\|c_1-c_2\|, where Lv=∑j‖j‖L_v= _j\|w_j\| and Lc=∑j‖j‖(1+14‖Gatej‖Mc)L_c= _j\|U_j\| (1+ 14\|Gate_j\|\,M_c ). In particular, CBCB is L-Lipschitz with L=Lv+LcL=L_v+L_c on (,)∈ℝ2nv:‖2≤Mc\(v,c) ^2n_v:\|c\|_2≤ M_c\. Proof. For any j, ∇Δj=j[σ(αjfeat+αjctx)−σ(αjfeat)] _v _j=w_j [σ( _j^feat+ _j^ctx)-σ( _j^feat) ]. Since each sigmoid value lies in (0,1)(0,1), the difference in brackets lies in (−1,1)(-1,1), so ‖∇Δj‖≤‖j‖\| _v _j\|≤\|w_j\|. By the triangle inequality, ‖∇CB‖=‖∑j∇Δj‖≤∑j‖j‖=Lv\| _vCB\|=\| _j _v _j\|≤ _j\|w_j\|=L_v. For the context channel, the GLU gate gives αjctx=(j⊤)σ(Gatej⊤) _j^ctx=(U_j c)\,σ(Gate_j c), so ∇αjctx=jσ(Gatej⊤)+(j⊤)σ′(Gatej⊤)Gatej. _c _j^ctx=U_j\,σ(Gate_j c)+(U_j c)\,σ (Gate_j c)\,Gate_j. Since σ≤1σ≤ 1, σ′≤14σ ≤ 14, and |j⊤|≤‖j‖Mc|U_j c|≤\|U_j\|\,M_c for ‖2≤Mc\|c\|_2≤ M_c, ‖∇αjctx‖≤‖j‖+14‖j‖Mc‖Gatej‖\| _c _j^ctx\|≤\|U_j\|+ 14\|U_j\|\,M_c\,\|Gate_j\|. Multiplying by σ(αjfeat+αjctx)≤1σ( _j^feat+ _j^ctx)≤ 1 (from softplus′=σsoftplus =σ) and summing: ‖∇CB‖≤Lc\| _cCB\|≤ L_c. Combining via the mean-value theorem on each channel yields the result. ∎ B.2 Proof of Theorem 1 (Separation) Proof. The proof proceeds in four steps: decomposition, legitimate lower bound, adversarial upper bound, and tail bounds. Step 1: Decomposition. Write CB(,)=∑j=1nhΔjCB(v,c)= _j=1^n_h _j as in (11). We will analyze the per-unit contributions Δj _j separately for the coherent units and their complement. Step 2: Lower bound for legitimate nodes (Ψ>0 >0). Let ⊂1,…,nhC⊂\1,…,n_h\ denote the set of coherent hidden units (those satisfying Assumption 2), ||≥β0nh|C|≥ _0n_h, and for each j∈j let Ej=αjfeat≥0∧αjctx≥0E_j=\ _j^feat≥ 0\; \; _j^ctx≥ 0\ be its joint-positive event. On EjE_j, Lemma 1 (with a=αjfeat≥0a= _j^feat≥ 0, b=αjctx≥0b= _j^ctx≥ 0) gives Δj≥softplus(αjctx)−log2≥softplus(0)−log2= 0. _j\;≥\;softplus( _j^ctx)- 2\;≥\;softplus(0)- 2\;=\;0. (12) Write Δj=Δj+−Δj− _j= _j^+- _j^- with Δj±=max(±Δj,0) _j^±= (± _j,0), and define the conditional gains gj=[softplus(αjctx)−log2∣Ej]g_j=E[softplus( _j^ctx)- 2 E_j] for j∈j , the normalized expected gain G=1nh∑j∈ℙ[Ej]gjG_C= 1n_h _j P[E_j]\,g_j and the normalized expected negative contribution N=1nh∑j=1nh[Δj−∣legit]N= 1n_h _j=1^n_hE[ _j^- _legit]. By (12), Δj+≥Δj 1Ej≥(softplus(αjctx)−log2) 1Ej _j^+≥ _j\,1_E_j≥(softplus( _j^ctx)- 2)\,1_E_j for j∈j , and Δj+≥0 _j^+≥ 0 for every unit, so Ψ=∑j=1nh[Δj+−Δj−∣legit]≥∑j∈ℙ[Ej]gj−∑j=1nh[Δj−∣legit]=nh(G−N). \;=\; _j=1^n_hE[ _j^+- _j^- _legit]\;≥\; _j P[E_j]\,g_j\;-\; _j=1^n_hE[ _j^- _legit]\;=\;n_h (G_C-N ). (13) Assumption 5 gives G−N≥γ>0G_C-N≥γ>0 with γ independent of nhn_h, hence Ψ=[CB∣legit]≥nhγ=Ω(nh)> 0. \;=\;E[CB _legit]\;≥\;n_h\,γ\;=\; (n_h)\;>\;0. (14) Step 3: Upper bound for adversarial nodes. For every unit and every input, Δj≤max(^j,0) _j≤ ( c_j,0). If ^j≤0 c_j≤ 0, monotonicity of softplussoftplus gives Δj≤0 _j≤ 0. If ^j>0 c_j>0, the mean-value theorem with softplus′=σ<1softplus =σ<1 gives Δj≤^j _j≤ c_j. The bound holds whatever the features, so Assumption 4 gives Φ≤∑j=1nh′∼rand[max(^j′,0)]≤ρ1Mc∑j=1nh‖j‖=nhρ1u¯Mc. \;≤\; _j=1^n_hE_c _rand [ ( c _j,0) ]\;≤\; _1M_c _j=1^n_h\|U_j\|\;=\;n_h\, _1\, u\,M_c. (15) With (14) and the condition ρ1u¯Mc≤γ−ε _1 uM_c≤γ- of Theorem 1, Ψ−Φ≥nh(γ−ρ1u¯Mc)≥nhε=Ω(nh). - \;≥\;n_h (γ- _1 uM_c )\;≥\;n_h\, \;=\; (n_h). The certified margin nh(γ−ρ1u¯Mc)n_h(γ- _1 uM_c) decreases linearly as ρ1 _1 grows. Degenerate context paths. A unit with j=U_j=0 has ^j≡0 c_j≡ 0, hence Δj≡0 _j≡ 0, and contributes nothing to G_C, N or (15). Units with small ‖j‖\|U_j\| contribute proportionally little to the adversarial bound. Feature channel. Feature deviation enters only as a bounded perturbation. At fixed context, the gradient bound ‖∇Δj‖≤‖j‖\| _v _j\|≤\|w_j\| from the proof of Lemma 3 gives |Δj(′,)−Δj(,)|≤‖j‖2‖′−‖| _j(v ,c)- _j(v,c)|≤\|w_j\|_2\,\|v -v\|, so replacing legitimate features by adversarial features at distance d moves each unit by at most ‖j‖2d\|w_j\|_2\,d and the score by at most LvdL_v\,d. The bound (15) does not rely on this channel. Step 4: Tail bounds. Steps 2–3 establish Ψ−Φ>0 - >0. For τ∗∈(Φ,Ψ)τ^*∈( , ), Chebyshev’s inequality gives ℙ[CB<τ∗∣legit]≤Var[CB∣legit](Ψ−τ∗)2.P[CB<τ^* _legit]\;≤\; Var[CB _legit]( -τ^*)^2. (16) By Lemma 2, Var[CB∣legit]≤(∑jMj)2<∞Var[CB _legit]≤( _jM_j)^2<∞. Setting τ∗=(Ψ+Φ)/2τ^*=( + )/2: FPR≤4Var[CB∣legit](Ψ−Φ)2.FPR\;≤\; 4\,Var[CB _legit]( - )^2. (17) The adversarial tail follows identically: 1−TPR≤4Var[CB∣fraud,rand]/(Ψ−Φ)21-TPR≤ 4\,Var[CB _fraud,Q_rand]\,/\,( - )^2. Since Ψ−Φ≥nhε - ≥ n_h (Steps 2–3) and the variances are bounded above by (∑jMj)2=O(nh2)( _jM_j)^2=O(n_h^2), the bounds are finite for any τ∗∈(Φ,Ψ)τ^*∈( , ) but need not fall below one. They certify finiteness and do not predict the observed error rates. ∎ Remark B.1 (Rate under uncorrelated units). If the per-unit contributions Δj\ _j\ are pairwise uncorrelated under legitP_legit (which holds approximately when the weight vectors span diverse directions), then Var[CB]≤∑jVar[Δj]≤nhM¯2Var[CB]≤ _jVar[ _j]≤ n_h M^2 with M¯=maxjMj M= _jM_j, and the right-hand side of (17) becomes O(1/nh)O(1/n_h). This refinement requires assumptions beyond Assumptions 1–5, and no bound in this paper relies on it. B.3 Proof of Corollary 1 (Detection Guarantee) Proof. Set τ∗=(Ψ+Φ)/2τ^*=( + )/2, so Ψ−τ∗=τ∗−Φ=(Ψ−Φ)/2>0 -τ^*=τ^*- =( - )/2>0. Applying (16): FPR ≤4Var[CB∣legit](Ψ−Φ)2, \;≤\; 4\,Var[CB _legit]( - )^2, 1−TPR 1-TPR ≤4Var[CB∣fraud,rand](Ψ−Φ)2. \;≤\; 4\,Var[CB _fraud,Q_rand]( - )^2. Both variances are finite by Lemma 2, and Ψ−Φ>0 - >0 by Theorem 1, so both bounds are finite. ∎ B.4 Proof of Theorem 2 (Drift Stability) Proof. Step 1: Per-step Wasserstein–Lipschitz bound. By Lemma 3, CBCB is L-Lipschitz with L=Lv+LcL=L_v+L_c on the region ∥2≤Mc\\|c\|_2≤ M_c\ that carries every tP_t (condition (i)). Kantorovich–Rubinstein duality gives |t[CB]−t−1[CB]|≤L⋅W1(t,t−1)≤Lδdrift, |E_P_t[CB]-E_P_t-1[CB] |\;≤\;L· W_1(P_t,P_t-1)\;≤\;L\, _drift, where the first inequality is the dual characterization of W1W_1 for L-Lipschitz observables and the second is condition (i). Step 2: Telescoping. By the triangle inequality, |[CBt]−[CB0]| |E[CB_t]-E[CB_0] | ≤∑s=1t|[CBs]−[CBs−1]|≤Ltδdrift, \;≤\; _s=1^t |E[CB_s]-E[CB_s-1] |\;≤\;L\,t\, _drift, which establishes (10). Step 3: Drift horizon for the legitimate mean. Combining Step 2 with the legitimate baseline [CB∣0]=ΨE[CB _0]= gives [CB∣t]≥Ψ−Ltδdrift.E[CB _t]\;≥\; -L\,t\, _drift. Condition (i) preserves the assumed feature-context correlation, and Ψ=0[CB] =E_P_0[CB] is the initial legitimate baseline. With τ∗=(Ψ+Φ)/2τ^*=( + )/2, the threshold remains strictly below [CB∣t]E[CB _t] whenever Ltδdrift<12(Ψ−Φ)⟺t<Ψ−Φ2Lδdrift,L\,t\, _drift\;<\; 12( - ) t\;<\; - 2L\, _drift, the drift horizon (18). Within this horizon, the variance argument of Corollary 1 applies at time t with gap [CB∣t]−τ∗E[CB _t]-τ^* (variances remain bounded by Lemma 2). ∎ Corollary 3 (Drift Horizon). Under the conditions of Theorem 2, with τ∗=(Ψ+Φ)/2τ^*=( + )/2 as in Corollary 1, the legitimate mean stays above the threshold, [CB∣t]>τ∗E[CB _t]>τ^*, for any t in the worst-case drift horizon t<Ψ−Φ2Lδdrift.t\;<\; - 2L\, _drift. (18) Proof. Step 3 of the proof of Theorem 2 establishes [CB∣t]≥Ψ−LtδdriftE[CB _t]≥ -Lt _drift. This exceeds τ∗=(Ψ+Φ)/2τ^*=( + )/2 exactly when Ltδdrift<(Ψ−Φ)/2Lt _drift<( - )/2, i.e., t<(Ψ−Φ)/(2Lδdrift)t<( - )/(2L _drift). The variances remain bounded by Lemma 2, so Chebyshev’s inequality still applies at time t, with gap [CB∣t]−τ∗E[CB _t]-τ^* in place of (Ψ−Φ)/2( - )/2. ∎ B.5 Proof of Corollary 2 (Quantile Stability) Proof. Let μt _t be the law of the detection score −CB(t,t)-CB(x_t,c_t) under tP_t. Any coupling of tP_t and 0P_0 maps through −CB-CB to a coupling of μt _t and μ0 _0, and −CB-CB is L-Lipschitz (Lemma 3), so W1(μt,μ0)≤LW1(t,0)W_1( _t, _0)≤ L\,W_1(P_t,P_0). The triangle inequality for W1W_1 and condition (i) give W1(t,0)≤tδdriftW_1(P_t,P_0)≤ t\, _drift. On the real line the monotone quantile coupling is optimal, so W1(μt,μ0)=∫01|Qt(u)−Q0(u)|uW_1( _t, _0)= _0^1|Q_t(u)-Q_0(u)|\,du, which proves the claim. The bound controls the average displacement of the quantiles, not any single quantile such as the 95th percentile that sets τ∗τ^*. ∎ Remark B.2 (Tightness). The Wasserstein bound is a worst-case upper bound, loose for natural drift, since real drift moves x and c jointly along directions where the softplus difference (4) is nearly flat. We discuss this slack quantitatively in §6.5. Remark B.3 (Coherent Activation justification). Assumption 2 (joint-positive activation for a fraction β0 _0 of hidden units with probability ≥p0≥ p_0) follows qualitatively from contrastive-divergence training on the correlated (,)(x,c) pairs of Assumption 1: matched pairs raise both αjfeat=j⊤+bj _j^feat=w_j x+b_j and αjctx=^j _j^ctx= c_j on the same training events, since the model is rewarded for assigning low free energy when both channels fire coherently. In the Gaussian-projection regime, the arcsine law [52] relates Assumption 1’s correlation ρ0 _0 to a sign-correlation lower bound 2πarcsin(ρ0)≥2πρ0 2π ( _0)≥ 2π _0, which under symmetric pre-activation marginals translates to p0≥14+ρ02πp_0≥ 14+ _02π. The constant β0 _0 is measured after model convergence and p0p_0 is bounded by the arcsine argument above. Appendix C Datasets XBlock [21] is an Ethereum transaction graph with 153,477153,477 wallet nodes (1,127 labeled phishing, 0.7%) and 715,573715,573 directed transaction edges. Node features are 3838 per-wallet transaction statistics (counts, incoming/outgoing volumes, gas usage, temporal spread). The label-graph correlation is anti-homophilic. The sign-corrected feature-context correlation is ρ0=0.30 _0=0.30 (Eq. (1)). Reddit [22] is a social-media graph with 10,98410,984 user nodes (366 banned users, 3.3%) and 168,016168,016 edges between users who co-participate in subreddits. Features are 7373-dimensional, combining 6464 LIWC linguistic categories computed over each user’s posts with 99 graph-structural signals (degree, clustering, centrality variants). Labels correlate homophilically with the graph. The sign-corrected feature-context correlation is ρ0=0.68 _0=0.68. Features are globally normalized. A 10%10\% held-out split of the pool assumed legitimate, which the datasets’ benign labels define in our experiments, is used for threshold calibration and drift-induced FPR measurement, and a fixed attack-generation reserve of ∼ 200 labeled adversaries is held out per dataset, so the supervised baselines see the remaining 932932 / 166166 adversary labels; all other nodes are used for training. Without drift, the Reddit threshold is stable down to small calibration samples, with FPR 5.9±0.6%5.9± 0.6\% at 530530 calibration nodes and 6.0±0.2%6.0± 0.2\% at 1,0611,061 over three sampling seeds, and Isolated Injection TPR 93.7±0.2%93.7± 0.2\% in that run. Verified theorem assumptions. The constants entering Theorems 1–2 are measured on training data: ρ0=1N∑icos(i,i) _0= 1N _i (x_i,c_i) on the pool assumed legitimate before training; β0 _0, MxM_x, McM_c after model convergence (Table 2). MxM_x and McM_c are root-mean-square (RMS) norms over that pool, and the drift budgets of Table 12 evaluate L at this value of McM_c rather than at a verified support radius. Assumption 5 holds for the trained models on both datasets. Table 2: Verified Assumption 1–3 constants on training data. Dataset ρ0 _0 (A1) β0 _0 (A2) MxM_x (A3) McM_c (A3) XBlock 0.300.30 0.380.38 6.66.6 23.523.5 Reddit 0.680.68 0.950.95 8.68.6 7.87.8 The asymmetry Mc>MxM_c>M_x on XBlock reflects sign-corrected aggregation of positive-mean transaction features under a heavy-tailed degree distribution; Reddit’s centered LIWC features yield a balanced pair. Appendix D Additional Baselines Protocol. Every detector in Tables 3 and 4 is scored on the same legitimate evaluation nodes and the same attack reserve, with the attacks of §3. Under drift, models and thresholds stay frozen at t=0t=0, with the single exception of ARC described below, and the Combined Score follows §6.1. Implementations. The nine detectors of §6.1 follow their published configurations, and model selection uses a held-out validation split of the training pool. XGBGraph, BWGNN and Graph Transformer are the GADBench models [46], and GAD-NR, CONAD, AnomalyDAE and OCGNN run through PyGOD [53]. CONAD and AnomalyDAE exhausted memory on XBlock’s 153K nodes under this configuration and are reported on Reddit only. GDN and ARC run from their official repositories. ARC is a pretrained generalist detector applied without fine-tuning, with 300300 legitimate nodes as its in-context normal set. It re-runs its per-graph preprocessing on every evaluated graph, which is its intended usage, while its threshold stays frozen at t=0t=0. Fixing that preprocessing at t=0t=0 as well gives Combined Scores of 0.270.27 on XBlock and 0.460.46 on Reddit. Ablations. The signed-cosine score is −cos(i,i)- (x_i,c_i) with the sign-corrected context, the feature-context principle with no learning. Context-MLP is a two-layer MLP trained on legitimate pairs to predict x from c and scored by ‖−^()‖2\|x- x(c)\|_2, which keeps context conditioning without the free-energy differential or the GLU gate. Table 3: All detectors at the last drift step, T=20T=20. XBlock Reddit Family Method TPR FPRdrift Combined TPR FPRdrift Combined Ours CB-RBM 0.990.99 5.25.2 0.940.94 0.960.96 8.48.4 0.880.88 Supervised GraphSAGE 0.890.89 5.65.6 0.840.84 0.060.06 5.05.0 0.050.05 GAT 0.710.71 11.611.6 0.630.63 0.320.32 4.64.6 0.310.31 GCN 0.750.75 5.45.4 0.710.71 0.360.36 4.64.6 0.350.35 XGBGraph 0.980.98 17.817.8 0.810.81 0.010.01 0.00.0 0.010.01 Graph Transformer 0.870.87 11.111.1 0.770.77 0.070.07 3.83.8 0.070.07 BWGNN 0.540.54 5.75.7 0.510.51 0.170.17 8.28.2 0.160.16 Shift-robust GDN 0.770.77 10.410.4 0.690.69 0.240.24 1.81.8 0.230.23 Generalist ARC 0.400.40 7.07.0 0.370.37 0.860.86 47.247.2 0.450.45 Reconstruction DOMINANT 0.840.84 99.099.0 0.010.01 0.810.81 43.243.2 0.460.46 GAE 0.840.84 66.666.6 0.280.28 0.800.80 91.891.8 0.070.07 GAD-NR 0.530.53 3.43.4 0.510.51 0.670.67 5.45.4 0.630.63 AnomalyDAE – – – 0.600.60 82.082.0 0.110.11 Contrastive CoLA 0.190.19 15.415.4 0.160.16 0.560.56 8.68.6 0.510.51 CONAD – – – 0.790.79 36.436.4 0.500.50 One-class OCGNN 0.200.20 7.07.0 0.180.18 0.460.46 7.07.0 0.430.43 Ablation Std-RBM (no context) 0.410.41 99.899.8 0.0010.001 0.090.09 89.489.4 0.0100.010 Signed cosine (no learning) 0.180.18 7.77.7 0.170.17 0.860.86 33.433.4 0.570.57 Context-MLP (no RBM/GLU) 0.760.76 29.929.9 0.530.53 0.920.92 95.795.7 0.040.04 Table 4: Per-attack AUROC / TPR@5%FPR (%). Method Isolated Inj. Feat. Camo Sybil Rel. Camo XBlock XGBGraph 99.999.9 / 99.399.3 98.998.9 / 93.293.2 99.999.9 / 99.799.7 99.799.7 / 99.999.9 Graph Transformer 98.598.5 / 94.294.2 92.792.7 / 71.671.6 98.798.7 / 95.295.2 97.197.1 / 86.286.2 BWGNN 83.483.4 / 28.528.5 65.165.1 / 3.03.0 99.199.1 / 97.197.1 97.897.8 / 88.088.0 GDN 95.895.8 / 90.390.3 90.290.2 / 79.079.0 99.199.1 / 96.296.2 65.465.4 / 44.344.3 ARC 94.894.8 / 40.040.0 94.994.9 / 40.040.0 92.392.3 / 40.040.0 91.091.0 / 39.539.5 GAD-NR 99.799.7 / 100.0100.0 99.499.4 / 100.0100.0 60.160.1 / 0.00.0 82.082.0 / 12.312.3 OCGNN 77.377.3 / 34.934.9 68.968.9 / 38.038.0 55.555.5 / 5.15.1 61.961.9 / 0.50.5 Signed cosine 83.083.0 / 19.519.5 84.184.1 / 23.123.1 67.267.2 / 15.915.9 70.970.9 / 13.313.3 Context-MLP 97.197.1 / 81.581.5 96.196.1 / 77.477.4 97.697.6 / 90.390.3 93.493.4 / 54.954.9 AnomalyDAE – – – – CONAD – – – – Reddit XGBGraph 59.359.3 / 0.00.0 59.359.3 / 0.00.0 61.861.8 / 0.00.0 64.164.1 / 2.52.5 Graph Transformer 67.067.0 / 0.70.7 60.760.7 / 0.00.0 66.766.7 / 0.20.2 82.882.8 / 28.328.3 BWGNN 62.062.0 / 7.77.7 58.058.0 / 7.97.9 57.257.2 / 11.011.0 87.587.5 / 42.342.3 GDN 67.567.5 / 18.818.8 56.156.1 / 9.59.5 88.388.3 / 53.353.3 67.467.4 / 14.014.0 ARC 100.0100.0 / 100.0100.0 100.0100.0 / 100.0100.0 97.997.9 / 92.192.1 89.789.7 / 50.150.1 GAD-NR 100.0100.0 / 100.0100.0 100.0100.0 / 100.0100.0 91.091.0 / 55.555.5 77.377.3 / 11.511.5 AnomalyDAE 95.295.2 / 88.588.5 97.097.0 / 90.590.5 81.881.8 / 46.546.5 65.065.0 / 15.515.5 CONAD 97.797.7 / 93.093.0 88.288.2 / 77.577.5 99.899.8 / 100.0100.0 92.092.0 / 43.543.5 OCGNN 94.594.5 / 75.575.5 96.396.3 / 87.087.0 67.667.6 / 0.00.0 78.378.3 / 23.023.0 Signed cosine 100.0100.0 / 100.0100.0 100.0100.0 / 100.0100.0 90.590.5 / 71.571.5 88.988.9 / 71.571.5 Context-MLP 99.599.5 / 100.0100.0 99.399.3 / 100.0100.0 98.198.1 / 97.097.0 95.495.4 / 69.069.0 Appendix E Robustness Experiments E.1 Contaminated training pool We mix fraud into the pool assumed legitimate and refit the sign vector, the model and the threshold on that pool, so the whole pipeline stays label-free. The legitimate nodes are split into training (80%80\%), calibration (10%10\%) and held-out (10%10\%) sets. The natural level adds every non-reserve fraud node once, which is 0.8%0.8\% of the training pool on XBlock and 1.9%1.9\% on Reddit, and contaminates the calibration set at the same rate. The 5%5\% and 10%10\% levels oversample fraud to that share of both sets. The clean row is this protocol’s own reference, refit on the 80%80\% split, and is not the Table 1 model. FPR is measured on the held-out legitimate nodes at the threshold calibrated on the contaminated set, and the attacks follow §3. No sign dimension flips at any level on either dataset, and Isolated Injection, Feature Camouflage and Sybil stay at 100%100\% TPR on XBlock and at least 92%92\% on Reddit. Table 5: Fraud in the training and calibration pools (FPR and TPR in %). XBlock Reddit Fraud in pool FPR AUROC Rel. Camo TPR FPR AUROC Rel. Camo TPR 0%0\% (clean) 4.64.6 0.990.99 80.580.5 4.04.0 0.980.98 65.565.5 Natural 4.34.3 0.990.99 85.685.6 4.54.5 0.980.98 63.563.5 5%5\% 3.43.4 0.990.99 68.268.2 4.64.6 0.980.98 70.070.0 10%10\% 2.72.7 0.990.99 39.039.0 5.05.0 0.980.98 66.066.0 E.2 Sign vector We test a stale sign vector by flipping a random 10%10\%, 25%25\% or 50%50\% of its dimensions while the model and the threshold stay fixed at their clean values, and then re-estimate s from feature statistics on the current unlabeled nodes, exactly as it was first fitted (Table 6). The refresh recovers all 3838 XBlock and all 7373 Reddit dimensions and restores Isolated Injection TPR to 100%100\% and 97.5%97.5\%. We also estimate s from random samples of unlabeled legitimate nodes, with the model and the threshold again fixed (Table 7). Isolated Injection TPR stays at 100%100\% on XBlock and at least 97.5%97.5\% on Reddit at every sample size. On Reddit, samples of 5353 or 106106 nodes still get some signs wrong in some seeds, so FPR varies widely across seeds, while from 1,0611,061 nodes every seed recovers all signs. Table 6: Sign vector with a share of its dimensions flipped, and after re-estimating it without labels (FPR and TPR in %). XBlock Reddit Flipped FPR Iso. TPR FPR after refresh FPR Iso. TPR FPR after refresh 0%0\% 5.05.0 100.0100.0 5.05.0 5.05.0 97.597.5 5.05.0 10%10\% 19.119.1 100.0100.0 5.05.0 11.611.6 99.099.0 5.05.0 25%25\% 94.494.4 100.0100.0 5.05.0 93.493.4 98.098.0 5.05.0 50%50\% 99.999.9 100.0100.0 5.05.0 97.597.5 97.597.5 5.05.0 Table 7: Sign vector estimated from n unlabeled legitimate nodes (FPR in %). ± is the standard deviation over 5 seeds. XBlock (3838 dimensions) Reddit (7373 dimensions) n Wrong dimensions FPR n Wrong dimensions FPR 763763 1.4±0.81.4± 0.8 6.9±1.76.9± 1.7 5353 1.0±0.91.0± 0.9 28.7±33.828.7± 33.8 1,5261,526 0.8±0.80.8± 0.8 6.5±2.86.5± 2.8 106106 1.0±0.91.0± 0.9 28.7±33.828.7± 33.8 7,6307,630 0.6±0.50.6± 0.5 5.1±0.15.1± 0.1 530530 0.2±0.40.2± 0.4 6.0±2.06.0± 2.0 15,26015,260 0.4±0.50.4± 0.5 5.1±0.15.1± 0.1 1,0611,061 0.0±0.00.0± 0.0 5.0±0.05.0± 0.0 152,600152,600 0.0±0.00.0± 0.0 5.0±0.05.0± 0.0 10,61810,618 0.0±0.00.0± 0.0 5.0±0.05.0± 0.0 Appendix F Feature-Context Decomposition To identify which signal CB-RBM relies on, we score each test node under four controlled conditions that independently swap features and context between legitimate and adversarial/random sources. Condition A pairs adversarial features with random context; Condition B pairs legitimate features with the same random context; Condition C uses legitimate features with legitimate context (the null condition); Condition D pairs adversarial features with legitimate context. Results are summarized in Table 8. Table 8: Feature-context decomposition, Combined Score. Condition Features Context XBlock Reddit A adversarial random 0.9420.942 0.9210.921 B legitimate random 0.9420.942 0.9290.929 C legitimate legitimate 0.0780.078 0.0950.095 D adversarial legitimate 0.1110.111 0.6320.632 Two regularities appear on both datasets. First, A≈ : random context triggers detection regardless of whether the features are adversarial or legitimate, confirming that CB primarily flags absent context rather than feature deviation. Second, Condition C is near zero, so legitimate features paired with legitimate context evade detection. The datasets diverge on Condition D. On XBlock, D≈ : legitimate context alone suppresses the score, and the feature channel contributes nothing measurable. On Reddit, D is substantially above C, so adversarial features with legitimate context are partially flagged. This residual feature sensitivity is consistent with Reddit’s richer feature space (73 LIWC and structural features versus XBlock’s 38 transaction statistics): the learned weights carry more discriminative feature signal, which surfaces when the context channel is inactive. The main-body interpretation (Section 6.5) still holds — CB-RBM is fundamentally a network-context-presence detector, with feature sensitivity acting only as a secondary channel when the feature space is informative on its own. Unit-level trace. Table 9 follows single nodes through the trained models. A coherent unit has positive feature and gated context pre-activations, so it adds a positive increment to CB, and the last column averages the gated context pre-activation over these units. The legitimate node retains many coherent units and its gated context contribution after 2020 drift steps, so its CB stays high. The injected adversary has random context, the gate shrinks its context contribution, and its CB drops to 28.428.4 on XBlock and 33.833.8 on Reddit. Table 9: Unit-level trace through the trained models. Dataset Node CB Coherent units Mean gated context XBlock Legitimate (median CB) 1046.01046.0 111/256111/256 +7.36+7.36 Same node after 2020 drift steps 952.0952.0 88/25688/256 +6.51+6.51 Injected adversary 28.428.4 97/25697/256 +0.55+0.55 Reddit Legitimate (median CB) 116.2116.2 57/12857/128 +2.41+2.41 Same node after 2020 drift steps 115.5115.5 52/12852/128 +2.45+2.45 Injected adversary 33.833.8 34/12834/128 +1.39+1.39 Appendix G Ablation This appendix examines three design choices: the context module itself, the hidden-layer capacity nhn_h, and the neighborhood-pooling operator used to construct the raw context vector c. Context module. Removing the context pathway reduces CB-RBM to Std-RBM, a standard RBM scored by free energy alone. Combining the attack-benchmark TPR (Table 1) with the T=20T=20 drift FPR of Table 3 yields a mean Combined Score of ≈0.001≈ 0.001 on XBlock and ≈0.010≈ 0.010 on Reddit for Std-RBM, compared with 0.940.94 and 0.880.88 for CB-RBM. The collapse spans two to three orders of magnitude on both datasets and localizes the entire empirical benefit to the context channel. Hidden-layer capacity. Figure 5 shades the min–max envelope of Combined Score across all four attacks as nhn_h varies from 3232 to 10241024. A tight band at high Combined Score indicates a capacity where every attack is simultaneously well-detected; a wide or low band indicates a regime where at least one attack slips through. The lower boundary of the envelope is essentially Relation Camouflage — the attack with the largest ρ1eff _1^eff and the smallest measured separation gap (Figure 2). The envelope rises with nhn_h until the effective coherent-unit count β0nh _0n_h (Assumption 2, measured on training data) saturates, and beyond saturation further capacity only over-fits the legitimate distribution. The two datasets diverge at this saturation point: XBlock’s envelope keeps rising through nh=256n_h=256 as the larger pool (∼152 152K legitimate nodes) absorbs additional capacity, while Reddit’s envelope peaks at nh=128n_h=128 and degrades sharply for nh≥256n_h≥ 256 as Relation Camouflage Combined Score collapses from 0.810.81 to 0.330.33. The main body accordingly uses nh=256n_h=256 for XBlock and nh=128n_h=128 for Reddit. Figure 5: Capacity ablation. Shaded band shows min–max Combined Score across all four attacks at each nhn_h. Dashed vertical lines mark the optimal values: nh=256n_h=256 for XBlock, nh=128n_h=128 for Reddit. Table 10: Pooling operator on XBlock, Combined Score. Attack Mean Max Weighted-deg. Attention Isolated Injection 0.9500.950 0.9140.914 0.9300.930 0.9500.950 PGD 0.3260.326 0.1450.145 0.2240.224 0.2630.263 Neighborhood pooling. The raw context vector =Poolu:u∈(v)c=Pool\x_u:u (v)\ is constructed by pooling neighbor features. Table 10 compares four operators on XBlock under two attacks chosen to bracket the attack-difficulty spectrum: Isolated Injection (random, unstructured context — the easiest case for CB-RBM) and PGD (white-box gradient attack perturbing v and c jointly — the hardest). We report only this pair because the remaining static attacks in Table 1 (Feature Camouflage, Sybil, Relation Camouflage) also rely on unstructured, Sybil-generated or hub-borrowed context and track Isolated Injection closely, adding no new information about the pooling operator; the contrast with PGD is what stress-tests the choice. We run this ablation only on XBlock because XBlock uses raw transaction statistics as features, so the pooling operator is the sole mechanism by which neighborhood information enters the model. Reddit features already include engineered graph-derived structural signals (9 of its 73 dimensions), so some neighborhood information is available to the model independently of how c is constructed, making the pooling operator less decisive on that dataset. Mean and attention pooling tie at Combined =0.95=0.95 on Isolated Injection; max and weighted-degree trail slightly. Under PGD, mean and attention retain a meaningful score while max collapses to 0.150.15. All four operators preserve per-dimension alignment (they return a vector in the original feature space rather than a learned embedding), which is what the sign vector sign(Pearson(d,d))sign(Pearson(x_d,c_d)) requires to identify the legitimate correlation pattern. Appendix H PGD Budget Sweep This appendix evaluates CB-RBM under a white-box threat model: the adversary has gradient access to the detector’s weights w, U, and the gate, and jointly optimizes v and c under an ℓ∞ _∞-budget. Starting from real adversarial nodes at their natural graph positions, we sweep the perturbation budget ϵ∈0.01,0.05,0.1,0.2,0.3,0.5ε∈\0.01,0.05,0.1,0.2,0.3,0.5\ with 50 projected-gradient steps. Figure 6 plots detection AUROC on both datasets. Figure 6: White-box PGD budget sweep. Detection AUROC vs. perturbation budget ϵε. Detection degrades monotonically with ϵε on both datasets. On XBlock, AUROC falls from 0.900.90 at ϵ=0.01ε=0.01 to 0.660.66 at ϵ=0.5ε=0.5, staying above random-chance across the full range. On Reddit, AUROC drops to 0.420.42 already at ϵ=0.1ε=0.1 and continues to 0.070.07 at ϵ=0.5ε=0.5; the starting AUROC is lower here because in-graph adversaries reach CB-RBM through the feature channel rather than the context-absence channel. Two factors explain the faster Reddit collapse. First, Reddit’s 7373-dimensional feature space gives the PGD optimizer more independent directions in which to move v under a fixed ℓ∞ _∞ budget than XBlock’s 3838-dimensional space. Second, Reddit’s higher base correlation ρ0=0.68 _0=0.68 means the learned GLU gate is tuned to strong context–feature agreement, so small coordinated perturbations to v and c move the CB score further per unit of perturbation than on XBlock. These results are consistent with the Limitations (§6.5): CB-RBM is designed as a low-cost first-line detector for the common operational case of an adversary without white-box gradient access; combining it with an adversarially trained or certified-robustness second stage would be the natural defense under the PGD threat model. Appendix I Drift Stability Extensions The main body reports Combined Score under a random-walk drift simulation, following standard practice in the concept-drift literature [28, 8]. This appendix extends that analysis with alternative drift regimes that vary tails and correlation structure, threshold-level and correlation-weakening drift, real temporal evolution on the XBlock 2017–2018 transaction data, and adversarial-trajectory detection latency (§I.1–§I.5). I.1 Alternative drift regimes At each step t, a drift increment t η_t is added to every node’s features and the context vector is recomputed on the updated graph, so drift propagates jointly through node attributes and their aggregated neighborhood — matching how real distributional shift unfolds on evolving graphs such as the wallet-turnover and user-behavior patterns of the main-body domains. We compare five increment distributions chosen to cover the natural-drift regimes a detector is likely to encounter in deployment: Gaussian — isotropic bounded-variance drift in the same family as the main-body simulation; correlated ρ=0.3ρ=0.3 and correlated ρ=0.6ρ=0.6 — coordinated population shifts where subsets of features co-move, modeled with equicorrelated Gaussian increments; and heavy-tail df=10df=10 / heavy-tail df=3df=3 — bursty, outlier-driven drift modeled with Student-t increments, smaller dfdf yielding heavier tails. Table 11 reports the drift-induced false-positive rate at T=20T=20 for CB-RBM and Std-RBM on both datasets. The per-step variance budget here is calibrated for cross-regime comparison and differs from the headline drift simulation; the qualitative pattern — Std-RBM collapse, CB-RBM stability — is unchanged. Table 11: Drift-induced FPR at T=20T=20 under five drift regimes (%). XBlock Reddit Regime CB-RBM Std-RBM CB-RBM Std-RBM Gaussian 8.48.4 96.496.4 9.09.0 73.873.8 Correlated ρ=0.3ρ=0.3 12.812.8 95.895.8 2.82.8 74.074.0 Correlated ρ=0.6ρ=0.6 15.415.4 97.297.2 0.20.2 69.069.0 Heavy-tail df=10df=10 10.810.8 95.295.2 9.09.0 71.271.2 Heavy-tail df=3df=3 7.67.6 73.873.8 6.66.6 55.255.2 CB-RBM stays at ≤16%≤ 16\% FPR across every regime and dataset, while Std-RBM exceeds 55%55\% in every regime and >95%>95\% in four of the five XBlock regimes. Two observations are consistent with Theorem 2. First, the Wasserstein–Lipschitz bound is distribution-agnostic: it depends only on W1(t,t−1)≤δdriftW_1(P_t,P_t-1)≤ _drift, not on the tails or correlation structure of the drift increment, consistent with CB-RBM behaving similarly across all five variants (the slightly lower df=3 row reflects Student-t’s variance-matched mass concentrating near zero, so most nodes drift less than under Gaussian rather than more). Second, the two datasets respond oppositely to correlated drift by the same mechanism. Drift aligned with the learned (,)(v,c) correlation lies in a near-flat valley of the CB surface — the softplus differences in Eq. (4) nearly cancel — so FPR drops; drift off this axis avoids the valley and FPR rises. Reddit’s strong ρ0=0.68 _0=0.68 aligns closely with the equicorrelated ρ=0.6ρ=0.6 increment, driving FPR toward zero (→0.2%9.0\!→\!0.2\%); XBlock’s weaker ρ0=0.30 _0=0.30 lies further off-axis, raising FPR modestly (→15.4%8.4\!→\!15.4\%, still far below Std-RBM at every regime). This is consistent with the “conservative bound” discussion of Section 6.5: real drift’s CB-impact depends on alignment with the learned correlation, while the worst-case Theorem 2 bound holds in either direction. RMS-based numerical comparison. Table 12 grounds the slack-factor numbers reported in §6.5. L is the Lipschitz expression of Lemma 3 evaluated at the RMS value of McM_c (Appendix C); δdrift _drift is the per-step Wasserstein-1 budget; observed |ΔCB|| | is the realized mean-CB shift on legitimate nodes after T Gaussian-drift steps. The slack factor (bound//observed) grows with T on both datasets and is consistent with the conservative-bound argument: the worst-case L⋅T⋅δdriftL· T· _drift allows every coordinate to move adversarially, while real drift moves (,)(v,c) jointly along the legitimate-correlation axis where the softplus differences nearly cancel. Table 12: Wasserstein–Lipschitz bound vs. observed CB shift on legitimate nodes (Gaussian drift). L is the Lipschitz constant of CBCB evaluated at the RMS value of McM_c (Appendix C); δdrift _drift is the per-step W1W_1 budget; the RMS-based budget is L⋅T⋅δdriftL· T· _drift; slack is budget//observed. Dataset L δdrift _drift T RMS-based budget Observed |ΔCB|| | Slack XBlock 1189.51189.5 1.231.23 55 7,2887,288 23.323.3 312×312× 1010 14,57514,575 35.735.7 408×408× 1515 21,86321,863 46.146.1 474×474× 2020 29,15129,151 55.455.4 ×526× Reddit 154.0154.0 1.701.70 55 1,3131,313 0.680.68 1,921×1,921× 1010 2,6252,625 1.031.03 2,549×2,549× 1515 3,9383,938 1.171.17 3,373×3,373× 2020 5,2505,250 1.161.16 4,540×4,540× I.2 Threshold-level drift Evaluating LTδdriftL\,T\, _drift with the RMS-based L gives 29,15129,151 on XBlock and 5,2505,250 on Reddit at T=20T=20 (Table 12). The threshold is instead set by the 9595th percentile of the legitimate scores, which we track in a separate three-seed run with the model and the threshold frozen at t=0t=0 (Table 13). At T=20T=20 this percentile shifts by 42.742.7 on XBlock and 3.43.4 on Reddit, about a thousandth of that budget, and mean FPR at the frozen threshold rises from 5%5\% to 6.1%6.1\% and 7.1%7.1\%. Using the same RMS-based value of L, the horizon expression of Corollary 3 evaluates to 0.320.32 steps on XBlock and 0.120.12 on Reddit, while mean FPR at the frozen 9595th-percentile threshold stays within 2.12.1 points of the target at every reported step through T=20T=20. Table 13: Shift of the 9595th-percentile threshold and FPR (%) at the threshold frozen at t=0t=0. ± is the standard deviation over 3 drift seeds. XBlock Reddit T Threshold shift FPR Threshold shift FPR 11 5.6±1.95.6± 1.9 5.1±0.15.1± 0.1 0.18±0.010.18± 0.01 5.1±0.05.1± 0.0 55 14.1±4.214.1± 4.2 5.4±0.15.4± 0.1 0.84±0.230.84± 0.23 5.5±0.15.5± 0.1 1010 27.3±5.827.3± 5.8 5.6±0.15.6± 0.1 1.67±0.311.67± 0.31 6.0±0.16.0± 0.1 1515 34.2±6.634.2± 6.6 5.8±0.15.8± 0.1 2.55±0.272.55± 0.27 6.4±0.26.4± 0.2 2020 42.7±5.942.7± 5.9 6.1±0.16.1± 0.1 3.41±0.273.41± 0.27 7.1±0.37.1± 0.3 I.3 Correlation-weakening drift The drift of Figure 3 moves features and context together. We weaken that link in three ways at T=20T=20, with the model and the threshold frozen at t=0t=0. Context lag recomputes each node’s context from features L steps behind its own. Private drift adds to each node an independent drift that its neighbors’ context does not include, scaled by p relative to the shared drift. Reversal negates each node’s drift relative to its neighborhood on a fraction of the dimensions, so features and context anti-align there (Table 14). Recalibrating the threshold at the 9595th percentile of the drifted pool’s scores, the label-free refresh of Algorithm 1, returns FPR to 5%5\% by construction, and under reversal it keeps Isolated Injection TPR at 100%100\% on XBlock and at least 95.5%95.5\% on Reddit. Table 15 applies the same recalibration to the eight methods of Table 1 under the co-evolving drift of Figure 3 and scores the four attacks against the recalibrated threshold. Table 14: Correlation-weakening drift at T=20T=20, measured ρ and legitimate FPR (%) at the frozen threshold. Each block has its own co-evolving reference run. XBlock Reddit Regime ρ FPR ρ FPR Co-evolving (reference) 0.1410.141 5.45.4 0.6150.615 7.57.5 Context lag, L=5L=5 0.1410.141 5.35.3 0.5880.588 8.28.2 Context lag, L=10L=10 0.1420.142 5.35.3 0.5670.567 9.49.4 Context lag, L=20L=20 0.1440.144 5.65.6 0.5090.509 10.610.6 Private drift, p=0.3p=0.3 0.1380.138 5.45.4 0.6020.602 8.08.0 Private drift, p=0.6p=0.6 0.1250.125 5.75.7 0.5680.568 9.49.4 Private drift, p=1.0p=1.0 0.1130.113 6.26.2 0.5060.506 13.213.2 Co-evolving (reference) 0.1460.146 6.16.1 0.6130.613 7.87.8 Reversed, 10%10\% of dims 0.1450.145 6.16.1 0.5810.581 8.18.1 Reversed, 25%25\% of dims 0.1440.144 6.26.2 0.5340.534 8.58.5 Reversed, 50%50\% of dims 0.1410.141 6.16.1 0.4640.464 10.110.1 Table 15: Threshold recalibration for the eight methods of Table 1 under the co-evolving drift at T=20T=20, Combined Score before and after, from this experiment’s run. Best refreshed score in bold. XBlock Reddit Method Frozen Refreshed Frozen Refreshed CB-RBM 0.920.92 0.900.90 0.880.88 0.900.90 Std-RBM 0.0030.003 0.0040.004 0.0160.016 0.0140.014 GraphSAGE 0.820.82 0.820.82 0.060.06 0.060.06 GAT 0.600.60 0.610.61 0.110.11 0.110.11 GCN 0.740.74 0.720.72 0.150.15 0.150.15 DOMINANT 0.010.01 0.020.02 0.530.53 0.640.64 CoLA 0.190.19 0.070.07 0.160.16 0.130.13 GAE 0.320.32 0.010.01 0.050.05 0.480.48 Topology change. We also change the edges at T=20T=20, on top of the feature drift, with the model and the threshold frozen at t=0t=0. Growth keeps every edge and adds 10%10\%, 30%30\% or 50%50\% new triadic edges, the pattern of cumulative interaction graphs such as ours, where on-chain edges are permanent and Reddit interactions accumulate. It raises the legitimate FPR to 12.612.6, 24.724.7 and 37.3%37.3\% on XBlock and 12.912.9, 24.624.6 and 34.6%34.6\% on Reddit. The label-free threshold refresh restores 5.0%5.0\% on both, with Isolated Injection TPR at 100%100\% on XBlock and 95.595.5, 93.093.0 and 91.0%91.0\% on Reddit. Random rewiring of 10%10\% of edges, evaluated as a topology stress test, raises the FPR to 20.4%20.4\% and 31.7%31.7\%, and the refresh restores 5.0%5.0\% with Isolated Injection TPR at 76.4%76.4\% and 89.5%89.5\%. I.4 Real temporal validation (XBlock) To check that synthetic drift is not the only regime where CB-RBM holds up, we train on XBlock data through 2017 (a dataset with natively timestamped edges) and evaluate on five cumulative windows, the 2017 training window and 2018-Q1 through Q4. Between windows the Ethereum ecosystem evolves organically — new wallets appear, transaction patterns shift, and each window adds roughly 200200K–500500K new edges over the preceding one — producing real natural drift rather than a simulated increment. Figure 7 plots FPR and TPR at the calibrated 5%5\%-FPR operating point for all eight methods across the five windows. Node features in each window use transactions up to its cutoff only, and the scaler, sign vector and threshold are fitted on the training window and then frozen. Rebuilding each window’s context from pre-cutoff edges only gives FPR 5.05.0, 3.83.8, 3.43.4, 3.23.2 and 3.1%3.1\% across the five windows, against 5.05.0, 3.53.5, 3.23.2, 3.23.2 and 3.1%3.1\% for the construction used in Figure 7. Figure 7: XBlock real-temporal validation. (Left) FPR and (right) TPR at the calibrated 5%5\%-FPR operating point across five windows (trained and calibrated on the 2017 window, evaluated on 2017–2018 windows). CB-RBM holds at TPR=100%=100\% across all five windows; the runner-up (GAT) holds around 84%84\%–89%89\%. The feature distribution drifts monotonically — ‖t−0‖\| μ_t- μ_0\| grows from 00 to ≈73≈ 73 over the windows — without translating into an FPR increase or TPR drop for CB-RBM. The supervised GNN baselines are also stable at lower absolute levels (≈70%≈ 70\%–89%89\%), while Std-RBM and GAE hold flat in the 4545–55%55\% band, DOMINANT trends slightly higher (up to ≈60%≈ 60\%), and CoLA stays below 16%16\%. Real temporal evolution therefore reproduces the pattern of the synthetic drift simulation. CB-RBM and the supervised GNNs remain near the calibration target, while the reconstruction and density baselines show increased false alarms. I.5 Detection latency To complement the aggregate FPR view, Table 16 reports the trajectory step T at which each detector first fires on a five-scenario suite: one benign control (natural drift, which should not trigger an alarm) and the four adversarial scenarios of Table 1. The setup evolves 200200 target nodes over T=0,…,50T=0,…,50 under each scenario; the first-fire step is the earliest T at which at least 90%90\% of those nodes exceed the detection threshold. “Never” means the 90%90\% condition is not triggered within T=50T=50 steps. Table 16: First-fire step T (first T with ≥90%≥\!90\% of 200200 target nodes flagged). Lower is better for adversarial rows; “never” is correct for natural drift. XBlock Reddit Scenario CB-RBM Std-RBM CB-RBM Std-RBM Natural drift (benign) never 1515 never 2323 Sybil 00 never 00 never Relation Camouflage 00 never 00 never Isolated Injection 1818 never 2424 never Feature Camouflage 2424 never 2626 never The pattern is the dual of the drift-stability view. Std-RBM false-alarms on natural drift at T=15T=15 (XBlock) / T=23T=23 (Reddit) and is blind to every adversarial trajectory: the free-energy channel alone cannot distinguish the attacks from legitimate drift once context is excluded. CB-RBM shows the opposite pattern, staying silent under natural drift and firing on every adversarial trajectory. Sybil and Relation Camouflage are fixed-state attacks (the clique injection or hub rewire is present from T=0T=0), and CB-RBM fires immediately. Isolated Injection and Feature Camouflage are evolving trajectories: context interpolates from legitimate at T=0T=0 toward random by T=50T=50, so CB-RBM (correctly) does not fire while the context still resembles legitimate input, and the T=18T=18–2626 first-fire step marks the crossing where the context has decayed enough to become distinguishable. Two-channel latency therefore separates cleanly: the feature-only model fires on the wrong trajectory, while the context-aware model fires on the right ones. Growing Sybil. The Sybil attack of Table 1 uses a clique of fixed size from the start. Here the clique size grows from 22 to 5050 over 5050 steps. At each step the clique is rebuilt at its current size and the context of the 195195 XBlock and 200200 Reddit attack nodes connected to it is recomputed, while each detector keeps the threshold calibrated at t=0t=0 (Table 17). With two members CB-RBM already flags 92.3%92.3\% of the attack nodes on XBlock and 61.0%61.0\% on Reddit, crosses 90%90\% on Reddit by step 44 (between the rows of the table) and flags 100%100\% on both datasets by step 1010. Std-RBM stays at 51.3%51.3\% and 9.5%9.5\% throughout. Table 17: Fraction of attack nodes flagged (%) as the Sybil clique grows from 22 to 5050 members. XBlock Reddit Step Clique size CB-RBM Std-RBM CB-RBM Std-RBM 00 22 92.392.3 51.351.3 61.061.0 9.59.5 1010 1212 100.0100.0 51.351.3 100.0100.0 9.59.5 2020 2121 100.0100.0 51.351.3 100.0100.0 9.59.5 3030 3131 100.0100.0 51.351.3 100.0100.0 9.59.5 4040 4040 100.0100.0 51.351.3 100.0100.0 9.59.5 5050 5050 100.0100.0 51.351.3 100.0100.0 9.59.5 Appendix J Context Interpolation Sweep We complement Table 1’s discrete attacks with a context interpolation sweep: a continuous-intensity extension of the camouflage concept introduced in the fraud-detection literature [54]. An attacker parameter α∈[0,1]α∈[0,1] interpolates between the more revealing and the more camouflaging context for the dataset: cα=(1−α)crevealed+αccamo,α∈[0,1],c_α\;=\;(1-α)\,c_revealed+α\,c_camo, α∈[0,1], (19) where ccamoc_camo is whichever of catk,c¯legit\c_atk,\, c_legit\ has ρ1eff _1^eff closer to ρ0 _0 on that dataset (the harder camouflage), and crevealedc_revealed is the other. On XBlock ρ1natural=0.22<ρ0 _1^natural=0.22< _0, so ccamo=c¯legitc_camo= c_legit and crevealed=catkc_revealed=c_atk; on Reddit ρ1natural=0.71>ρ0 _1^natural=0.71> _0, so the roles swap — ccamo=catkc_camo=c_atk and crevealed=c¯legitc_revealed= c_legit. The sweep varies the attacker’s effective correlation ρ1eff(α) _1^eff(α) continuously, and with it the measured gap |Δρeff(α)|=|ρ0−ρ1eff(α)|| ρ^eff(α)|=| _0- _1^eff(α)|, letting us read off the boundary at which the CB-RBM detection margin closes. (a) XBlock: detection degrades as α→1α→ 1. (b) Reddit: detection degrades as α→1α→ 1. Figure 8: Context interpolation sweep, detection view. TPR at the calibrated 5%5\%-FPR operating point vs α; the 50%50\% crossing marks α∗α^*. (a) XBlock: Φ^→Ψ → as α→1α→ 1. (b) Reddit: Φ^→Ψ → as α→1α→ 1. Figure 9: Context interpolation sweep, separation view. Tail-band quantities Ψ (legit 5th5 th-pctile), Φ (attack 95th95 th-pctile), and empirical tail-band midpoint τ^=(Ψ^+Φ^)/2 τ=( + )/2; shaded band is |Φ^−Ψ^|| - |, with magnitudes at α=0,1α=0,1 annotated. In Figures 8 and 9, α=1α=1 denotes the hardest camouflage for that dataset (legit-mean context on XBlock, natural attack context on Reddit). This works because Relation Camouflage is a mirror operation in which the attacker picks whichever context distribution has ρ1eff _1^eff closest to ρ0 _0, minimizing |Δρeff|| ρ^eff|. XBlock (ρ0=0.30 _0=0.30, ρ1natural=0.22 _1^natural=0.22). Legit context is more coherent than the attacker’s own neighborhood, so injecting legit-mean context is the camouflage move. At α=0α=0 TPR is 66%66\% with |Φ^−Ψ^|≈320| - |≈ 320; at α=0.5α=0.5 TPR is 56%56\%; at α=1α=1 TPR collapses to 4%4\% with |Φ^−Ψ^|≈181| - |≈ 181; crossing at α∗≈0.56α^*≈ 0.56. Reddit (ρ0=0.68 _0=0.68, ρ1natural=0.71 _1^natural=0.71). The attacker’s own context is already as coherent as the legit one, so the camouflage move is to keep attack context and not mix in legit-mean. At α=0α=0 (pure legit-mean context) TPR is 100%100\% with Φ well below Ψ ; α=0.5α=0.5 gives TPR 63%63\%; at α=1α=1 (pure attack context) TPR is 11%11\% with Φ crossing above Ψ ; crossing at α∗≈0.58α^*≈ 0.58. Consequence. The “hardest” camouflage is not a fixed recipe but the context distribution that minimizes |Δρeff|| ρ^eff| for the given dataset. For XBlock, legit-mean substitution minimizes |Δρeff|| ρ^eff|; for Reddit, the attacker’s own natural context already achieves this. In both regimes, CB-RBM’s failure point is tied to a single scalar condition: the collapse of |Δρeff|| ρ^eff|, consistent with the ρ1 _1-dependence of the Theorem 1 margin. Appendix K Generalization across Domains CB-RBM’s two main-body datasets cover finance (XBlock) and social media (Reddit). This appendix tests whether the feature-context consistency principle transfers to further domains with different graph properties, label distributions, and fraud mechanics. Two additional organic datasets are reported: crowdsourcing (Tolokers) [55] and e-commerce review fraud (YelpChi) [56]. K.1 Tolokers (Crowdsourcing) Tolokers [55] is a crowdsourcing graph with 11,75811,758 worker nodes, 1,038,0001,038,000 edges, 1010 base features augmented to 1919 with the same graph-structural signals used for Reddit (Appendix C), and a 21.8%21.8\% unreliable-worker rate (organic labels). After sign correction ρ0=0.215 _0=0.215, placing it below XBlock (0.300.30) at the lower end of the homophily range we test, with a positive raw correlation gap. Tolokers is substantially denser than the main-body graphs (average degree 8888 vs. Reddit’s 1515). Table 18: Attack benchmark on Tolokers. Each cell: AUROC / TPR@5%FPR (%). Best per row in bold. Attack Energy-based Supervised Unsupervised CB-RBM Std-RBM SAGE GAT GCN DOM. CoLA GAE Isolated Inj. 96.4/89.3 51.2/4.2 88.4/52.5 72.0/34.0 92.8/58.7 73.3/23.7 55.0/26.2 92.7/77.8 Feat. Camo 97.5/87.8 51.2/6.0 66.7/28.0 54.4/18.7 70.0/34.3 77.9/33.5 57.6/38.5 95.4/86.5 Sybil 98.9/96.7 51.2/4.2 97.1/86.7 98.9/100 99.1/100 97.3/96.7 68.1/40.5 99.8/100 Rel. Camo 97.2/79.0 51.2/4.2 79.4/13.7 80.1/22.3 77.6/15.7 68.6/15.5 63.8/11.7 57.6/12.7 Table 19: Tolokers drift evaluation at T=20T=20: mean TPR (across the 4 attacks), drift stability, and Combined Score. Energy-based Supervised Unsupervised CB-RBM Std-RBM SAGE GAT GCN DOM. CoLA GAE Mean TPR 0.882 0.047 0.452 0.438 0.522 0.424 0.292 0.693 Stability 0.936 0.676 0.890 0.934 0.944 0.940 0.782 0.686 Combined Score 0.826 0.031 0.403 0.409 0.493 0.398 0.229 0.475 CB-RBM leads the attack benchmark on three of four attacks and places within 0.90.9 points of the top on Sybil (Table 18). Under 20-step Gaussian drift it retains a stability of 0.9360.936 (FPR of 6.4%6.4\%, near the calibrated 5%5\% target), yielding a Combined Score of 0.8260.826 — more than 0.330.33 above the best baseline (GCN at 0.4930.493) and ≈27×≈\!27× the Std-RBM ablation (Table 19). The detector’s behavior on this denser, lower-ρ0 _0 domain is consistent with the feature-context consistency mechanism generalizing across feature modalities and homophily strengths where the raw correlation gap is positive. K.2 YelpChi (E-commerce Review Fraud) YelpChi is a review-fraud graph with 45,95445,954 review nodes, 14.5%14.5\% labeled fraudulent reviews (organic), and three review-relationship edge types. We use the net_rtr edge subset (review-time-review, 1,147,2321,147,232 edges, average degree 2525), which links reviews of the same product posted in the same month, the channel through which coordinated review rings surface. The other two edge types are either too sparse (net_rur: 42%42\% of legitimate nodes have degree zero) or too dense for PyGOD baselines to finish in reasonable time (net_rsr: 6.86.8M edges). The 3232 base features are augmented to 4141 with the same nine graph-structural signals used for Reddit and Tolokers. After sign correction ρ0=0.293 _0=0.293; the natural fraud context has ρ1natural=0.306 _1^natural=0.306, giving a raw correlation gap Δρ=−0.013 ρ=-0.013. This unfavorable gap indicates that coordinated fraud rings can retain neighborhood context slightly more coherent than that of typical legitimate reviews, so a compressed margin is expected, and the experiments below measure detection in this regime. Table 20: Attack benchmark on YelpChi (net_rtr). Each cell: AUROC / TPR@5%FPR (%). Best per row in bold. Attack Energy-based Supervised Unsupervised CB-RBM Std-RBM SAGE GAT GCN DOM. CoLA GAE Isolated Inj. 76.6/34.5 50.3/10.5 98.6/93.3 79.0/53.0 87.2/74.3 82.7/26.5 80.3/35.0 73.6/20.5 Feat. Camo 78.9/41.5 62.9/14.5 89.6/62.7 56.8/27.0 64.4/35.8 80.3/15.0 85.5/48.5 70.0/12.5 Sybil 74.9/15.0 50.3/10.5 98.9/94.2 99.5/100.0 99.8/100.0 73.1/15.5 60.0/5.5 61.7/12.0 Rel. Camo 98.2/86.5 50.3/10.5 97.5/83.8 82.7/41.7 79.2/11.0 72.8/15.5 61.8/11.5 61.5/11.5 Table 21: YelpChi (net_rtr) drift evaluation at T=20T=20: mean TPR (across the 4 attacks), drift stability, and Combined Score. Energy-based Supervised Unsupervised CB-RBM Std-RBM SAGE GAT GCN DOM. CoLA GAE Mean TPR 0.444 0.115 0.835 0.554 0.553 0.181 0.251 0.141 Stability 0.933 0.006 0.861 0.885 0.930 0.598 0.879 0.443 Combined Score 0.414 0.001 0.718 0.490 0.514 0.108 0.221 0.062 Table 20 shows the expected margin compression: CB-RBM’s AUROC drops from the ≥96%≥ 96\% it holds on XBlock, Reddit, and Tolokers to the 7474–79%79\% range on three of the four attacks, and all three supervised GNNs — trained on YelpChi’s abundant labels — overtake it on Combined Score (Table 21: SAGE 0.720.72, GCN 0.510.51, GAT 0.490.49 vs CB-RBM 0.410.41). Here the raw correlation gap is negative, and supervised baselines achieve higher Combined Scores. Two details confirm the mechanism rather than a generic performance loss. First, Relation Camouflage — the attack that most directly tests whether the context channel can distinguish rewired-to-legitimate-hubs adversaries from real legitimate nodes — is the only attack on which CB-RBM still leads on every metric: AUROC (98.298.2 vs SAGE’s 97.597.5), TPR@5%5\%FPR (86.586.5 vs 83.883.8), and Combined Score (0.810.81 vs 0.720.72); message-passing GNNs without the gated-context mechanism (GCN at 0.100.10 Combined, GAT at 0.370.37) suffer most, because the rewired context produces a coherence signature their attention or convolution cannot resolve. The feature-level and fabricated-context attacks (Iso, Feat, Sybil) rely on distinctions the compressed Δρ ρ renders harder to separate, and supervised label access closes that gap. Second, CB-RBM remains the highest in drift stability of any method (0.9330.933, narrowly above GCN’s 0.9300.930 and well above every other supervised and unsupervised baseline at ≤0.89≤ 0.89) while Std-RBM collapses to near-chance everywhere and loses stability entirely (0.0060.006 at T=20T=20), confirming that context remains the essential signal even in this compressed-margin regime. YelpChi is therefore an empirical boundary case. When the raw correlation gap is unfavorable, the supervised methods’ label-access advantage catches up, though only on the attacks that do not specifically exercise the context-coherence signal. Appendix L CB-RBM as a Drift-Filter Defense Theorem 1 certifies separation only when the positive gated-context activation that adversarial context can produce stays below the legitimate dominance margin (Assumptions 4 and 5). On YelpChi the raw correlation gap is unfavorable (Δρ=−0.013 ρ=-0.013), and supervised baselines accordingly outperform CB-RBM standalone (Appendix K.2). This appendix tests whether CB-RBM still adds operational value in this regime. The setting we evaluate: an operator runs a deployed primary detector — typically a supervised model trained on labeled adversaries, or one pinned by operational constraints — whose false-alarm rate inflates under drift but which cannot easily be retrained. Layered downstream, CB-RBM suppresses alarms whose flagged nodes remain within the legitimate distribution learned at calibration, recovering precision without retraining or new labels. The rescue rate measures the fraction of drift-induced false positives that CB-RBM correctly suppresses. Table 22: YelpChi rescue rates (%) at T=20T=20. Unsupervised Supervised Std-RBM DOMINANT GAE CoLA SAGE GAT GCN YelpChi 93.5 89.9 93.2 87.6 91.0 90.9 92.9 Across all seven baselines, CB-RBM rescues 87.687.6–93.5%93.5\% of drift-induced false positives (Table 22). Even where the raw correlation gap is unfavorable and CB-RBM is not the top standalone detector, layering it as a downstream filter preserves the method’s operational value in this empirical regime. CB-RBM is an additive layer with no retraining cost, no label cost, and no architectural integration — a drop-in complement in such scenarios, not a replacement. Established adversaries. Scoring naturally occurring adversaries with their accrued neighborhood context gives AUROC 0.840.84 on XBlock and 0.540.54 on Reddit. At T=20T=20 on XBlock, using CB-RBM as a downstream filter reduces DOMINANT’s drift FPR from 98.3%98.3\% to 6.5%6.5\%. Appendix M Transferability of the Context Boost Principle The Context Boost principle — score a node by the differential of a learned density under the presence vs absence of its neighborhood context — is not specific to the RBM. CB-RBM’s algebraic cancellation in Eq. (4) (the quadratic feature term drops out of the subtraction) makes the construction particularly clean, but any generative model whose likelihood decomposes additively between a context-free and a context-conditional branch admits an analogous score. This appendix outlines the structural requirements for porting the principle to other architectures and discusses what transfers automatically vs what needs re-derivation. Structural requisites. To instantiate the Context Boost principle on a host model, three properties must hold. (i) Decomposable scalar score. A function S(,)S(v,c) on the joint input that can also be evaluated with context ablated, so that CB(,)=S(,)−S(,∅)CB(v,c)=S(v,c)-S(v, ) is well-defined and captures the incremental information content of c. (i) Gated context pathway. A mechanism that selectively suppresses uninformative or noisy context dimensions, so that random or absent context produces near-zero CB; CB-RBM uses a GLU gate, but attention, gating units, or learnable context masking all serve. (i) Lipschitz continuity of S. A bounded Lipschitz constant in both channels is necessary for Theorem 2’s Wasserstein drift-stability argument to port. Candidate instantiations. Several generative families satisfy these requisites and admit a natural Context Boost analogue. A variational autoencoder with a context-conditional encoder yields CBVAE=ELBO(,)−ELBO(,∅)CB_VAE=ELBO(v,c)-ELBO(v, ), with context-attention playing the gating role. A normalizing flow gives CBNF=logp(∣)CB_NF= p(c ) directly from invertibility, and Lipschitz-constrained flows [57] make Theorem 2 immediately applicable. A masked-modeling transformer over concatenated (,)(v,c) tokens produces CBTCB_T as the gap between context-present and context-dropout NLL, with cross-attention weights on context tokens supplying the gate. In each case the operational payoff is the same: feature-context consistency is captured by a single decomposable score that supports detection and inherits drift stability via Lipschitz continuity — both from within a single model. What transfers automatically, what does not. Assumptions 1 (signed structural correlation) and 3 (bounded moments) are properties of the data, independent of host architecture — any model inherits them. Assumptions 2 (coherent activation), 4 (adversarial context gap) and 5 (coherent dominance) are stated on the trained context pathway, so they and the constants that appear in the separation and drift bounds (β0,p0,γ,Lv,Lc _0,p_0,γ,L_v,L_c) must be re-verified or reformulated for the host model. The per-unit decomposition Δj _j used in the proof of Theorem 1 is also CB-RBM–specific; an analogous decomposition into architecture-native primitives (latent units for VAE, flow layers for normalizing flows, attention heads for transformers) is required to recover the Ω(nh) (n_h)-style separation scaling. What universally carries over is the framework: feature-context consistency as a drift-stable detection signal, operationalized as a decomposable score on a gated context pathway. CB-RBM is one convenient instantiation; the principle itself is broader. NeurIPS Paper Checklist 1. Claims Question: Do the main claims made in the abstract and introduction accurately reflect the paper’s contributions and scope? Answer: [Yes] Justification: All numerical claims (AUROC ≥0.96≥ 0.96 on four attacks, Combined Score ≥0.87≥ 0.87 at T=20T=20, calibrated 5%5\% FPR, Std-RBM FPR collapse to 8989–100%100\%) are directly supported by Tables 1, 3 and Figures 1, 3. The zero-label claim is enforced by construction (threshold set from legitimate data only). The theory (Assumptions 1–5, Theorems 1–2) gives conditional worst-case results, with numerical comparisons of the bounds at root-mean-square constants in Appendix I; detection and drift performance are measured directly in §6. 2. Limitations Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes] Justification: §6.5 (“Limitations”) identifies six scope boundaries: detection relies on ρ0>0 _0>0, which can fail in random or adversarially curated topologies; detection degrades as Δρ ρ collapses, where supervised baselines with adequate labels can perform better; adversaries who acquire genuine hub connections (Relation Camouflage) reduce the detection gap and can become indistinguishable from legitimate users in the limit; substantial topology change can impair calibration at the frozen threshold and needs the label-free threshold refresh; white-box adversaries with gradient access can lower detection; and the drift analysis assumes smooth drift, so abrupt or adversarial shifts may need additional mechanisms. Transferability across architectures is discussed in Appendix M; boundary-regime generalization in Appendix K. 3. Theory assumptions and proofs Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof? Answer: [Yes] Justification: Assumptions 1–5 are stated in §5 with informal justifications, empirical verifiability conditions, and remarks on how s-correction ensures ρ0>0 _0>0. Measured values: ρ0=0.30 _0=0.30 (XBlock) and ρ0=0.68 _0=0.68 (Reddit); coherent-activation fraction β0 _0 and bounded-moment constants Mx,McM_x,M_c verified after training on both datasets. Proof sketches appear in §5; complete proofs with supporting lemmas in Appendix B. 4. Experimental result reproducibility Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)? Answer: [Yes] Justification: §6.1 specifies all hyperparameters (nh=256n_h=256 for XBlock, nh=128n_h=128 for Reddit, CD-1, λsp=0 _sp=0, 100 epochs) and evaluation protocol (95th-percentile of −CB-CB over legitimate nodes, TPR@5%FPR metric). Dataset details: XBlock (153153K nodes, 3838 features, ρ0=0.30 _0=0.30) and Reddit (1111K nodes, 7373 features, ρ0=0.68 _0=0.68), both publicly available. Attack constructions are defined in §3, with the context-interpolation sweep in Appendix J. The six GADBench baselines use GADBench defaults [46], and the nine further detectors follow their published configurations with model selection on a held-out validation split (Appendix D). 5. Open access to data and code Answer: [Yes] Justification: The reference implementation of CB-RBM, the four attacks and the drift simulation is available at https://github.com/serval-uni-lu/CB-RBM under the MIT license. All four datasets used in this work (XBlock [21], Reddit [22], Tolokers [55], YelpChi [56]) are publicly available, and the feature construction is described in Appendix C. 6. Experimental setting/details Answer: [Yes] Justification: §6.1 specifies all training details. Appendix C provides feature categories and counts for each dataset, sign-vector construction, normalization, and context computation; full feature definitions are in the released code. Appendix G reports hyperparameter sensitivity (nhn_h, pooling operator). 7. Experiment statistical significance Answer: [Yes] Justification: The attack benchmark reports means over 3 random seeds with standard deviations in §6.3; XGBGraph, Graph Transformer, BWGNN and GDN use 5 seeds (§6.4, Appendix D); the sign-vector experiment reports standard deviations over 5 seeds (Appendix E.2) and the threshold-drift experiment over 3 seeds (Appendix I.2). 8. Experiments compute resources Answer: [Yes] Justification: All experiments run on a single GPU. CB-RBM training takes under 10 minutes per dataset, and the full benchmark, drift and ablation suite completes within a standard single-GPU budget. CONAD and AnomalyDAE exceeded memory on XBlock and are reported on Reddit only (Appendix D). 9. Code of ethics Answer: [Yes] Justification: All datasets used are publicly available and anonymized: XBlock (anonymized Ethereum wallet addresses), Reddit (anonymized user identifiers), Tolokers (anonymous worker IDs), YelpChi (anonymized reviewer identifiers). The work aims to improve fraud detection, a socially beneficial application. False-positive rates on legitimate users under drift are reported in §6.4 and Appendix I. 10. Broader impacts Answer: [Yes] Justification: §1 motivates the work by the scale of fraud losses. §6.5 (“Limitations”) states where the detector fails, namely graphs without feature-context correlation, adversaries with genuine connections, topology change and white-box adversaries. False alarms on legitimate accounts are the main negative consideration, and the paper reports them under drift at the calibrated threshold (§6.4). In deployment, τ∗τ^* is an operator-set false-positive budget (5%5\% here), the flagged share of legitimate nodes stays at or below 16%16\% under the five drift regimes of Table 11, and the score should rank cases for human review rather than block accounts automatically, since new or sparsely connected legitimate accounts can lack neighborhood context. 11. Safeguards Answer: [N/A] Justification: The paper proposes a fraud detection method, not a generative model or dataset release with misuse potential. The attack constructions described are standard synthetic evaluation tools, not deployable attack tooling. 12. Licenses for existing assets Answer: [Yes] Justification: XBlock [21], Reddit [22], Tolokers [55], and YelpChi [56] are all publicly available and properly cited. All are standard academic benchmarks used under their published terms. 13. New assets Answer: [N/A] Justification: No new datasets are released. The code is released under the MIT license at https://github.com/serval-uni-lu/CB-RBM. 14. Crowdsourcing and research with human subjects Answer: [N/A] Justification: No crowdsourcing or human subjects research. The Tolokers dataset consists of pre-existing, anonymized crowdsourcing graph data from prior work [55]. 15. Institutional review board (IRB) approvals or equivalent for research with human subjects Answer: [N/A] Justification: No human subjects research. 16. Declaration of LLM usage Answer: [N/A] Justification: LLMs are not used as a component of the core method or experiments. Any use for writing assistance does not impact the scientific content or experimental results.