Spectral Topology Diffusion on Memory Residuals for Anomaly Detection in Dynamic Graphs

Anomaly detection in continuous-time dynamic graphs (CTDGs) aims to identify nodes whose behavioral patterns deviate from the normal majority within an evolving edge stream. Two critical yet underexplored requirements complicate practical application: a model trained on a labeled source domain should generalize to unseen target domains without fine-tuning, and it should maintain stable discrimination across diverse temporal gaps from short-interval bursts to extended-dormancy horizons. Existing methods based on self-supervised contrastive learning or reconstruction objectives tend to overfit domain-specific distributions and couple anomaly scoring with the immediate temporal context, limiting transferability and temporal robustness. We propose TopoDiff, a topology-aware diffusion framework that models the generative distribution of memory residuals, defined as the difference between a node's posterior and prior memory representations after an interaction. For normal interactions, these residuals empirically exhibit structured, topology-conditioned patterns that remain more consistent across domains and time scales than raw embeddings, whereas anomalous events produce significant deviations. A stable topology projection built on a Chebyshev polynomial basis over the spectrum of the normalized graph Laplacian yields a positive definite spectral operator, whose inverse is efficiently solved via batched conjugate gradient on event-induced subgraphs. A denoising diffusion process conditioned on the projected topology and filtered residuals learns the normal residual distribution in a latent space. Experiments demonstrate that TopoDiff achieves strong zero-shot cross-domain generalization and stable performance across short-term and long-term horizons.