Bastien Giles

Baptiste Jeudy
email: baptiste.jeudy@univ-st-etienne.fr

Christine Largeron
email: christine.largeron@univ-st-etienne.fr

Damien Saboul
email: damien.saboul@be-ys-research.com

Suspicious: a Resilient Semi-Supervised Framework for Graph Fraud Detection

Keywords: Anomaly detection, Fraud identification, Graph, Networks, Mislabeling

Graph-based fraud detection is an important task in many real-world domains such as insurance, finance, and cybersecurity. Even if existing semi-supervised models have proven to be efficient in identifying anomalous nodes, they assume that a labeled sample of the nodes is available to train the model, without taking into account the real-world problem of the unreliability of such a sample. In practice, the labeling is often done manually and contains many errors. In this paper, we study fraud detection in attributed networks, and we propose a new framework, based on two graph auto-encoders trained following a suspicion mechanism: the first auto-encoder is trained to better reconstruct the normal nodes while the second one, the fraudulent ones. The final classification is done by coupling the result of both auto-encoders. We demonstrate that our approach obtains at least equivalent performances to state of the art methods in the case of a perfectly labeled sample while being more resilient to the introduction of mistakes in this sample.

I. INTRODUCTION

Anomaly and fraud identification is an important problem that has been studied for a long time [START_REF] Aggarwal | Outlier Analysis[END_REF], [START_REF] Akoglu | Anomaly mining -past, present and future[END_REF], [START_REF] Chalapathy | Anomaly detection using oneclass neural networks[END_REF], [START_REF] Grubbs | Procedures for detecting outlying observations in samples[END_REF], [START_REF] Pang | Deep Learning for Anomaly Detection: A Review[END_REF] and, more recently, in graph data [START_REF] Kim | Graph anomaly detection with graph neural networks: Current status and challenges[END_REF], [START_REF] Ma | A Comprehensive Survey on Graph Anomaly Detection with Deep Learning[END_REF], [START_REF] Vaudaine | Detection of contextual anomalies in attributed graphs[END_REF]. It is used in different fields such as insurance [START_REF] Lu | GCAN: Graph-aware co-attention networks for explainable fake news detection on social media[END_REF], [START_REF] Zhang | Heterogeneous graph neural network[END_REF], or finance [START_REF] Wang | A Semi-supervised Graph Attentive Network for Financial Fraud Detection[END_REF]. Depending on the application, data can be represented in various forms requiring appropriate methods. Attributed graphs are one of these representations. While graphs allow the representation of relationships by links between vertices corresponding to entities, attributed graphs provide, in addition, an attribute matrix that contains characteristics or features of the nodes. For example, in the case of a social network, the interactions between the users could be represented by a graph and the profile of each user (age, gender, center of interests, etc.) is stored in an attribute matrix [START_REF] Interdonato | Feature-rich networks: going beyond complex network topologies[END_REF]. We consider that, in an attributed graph, fraudulent nodes, like anomalies, do not follow the same patterns or distributions as the normal elements. However, contrary to anomalies, frauds result from intentional illegitimate behavior or actions. For this reason, they can exhibit distinct and consistent patterns that distinguish them from the normal cases and could even constitute a smallsized class in the graph.

In practice, supervised approaches are often hard to apply in identifying frauds because they require a fully labeled dataset that is difficult and expensive to obtain. Consequently, most experimental studies implement so-called unsupervised methods that do not require any labeling and use the rarity of abnormal elements to guide the design of classification models. While these methods effectively identify outliers far from normal nodes, they frequently fail at discovering real frauds corresponding to illegitimate and intentionally generated elements that an expert can identify [START_REF] Liu | Benchmarking node outlier detection on graphs[END_REF]. Thus, the so-called semisupervised methods are also explored because they require only a subset of the dataset to be labeled. However, current semi-supervised methods do not consider the possibility of human error during the labeling of this subset. In practice, the presence of such mislabeled nodes (i.e., normal nodes labeled as frauds and conversely) within the training dataset and the small number of labeled nodes seriously degrade the quality of the classification between normal and fraudulent nodes [START_REF] Tang | Rethinking graph neural networks for anomaly detection[END_REF].

To overcome these limits, we propose a new general framework for fraud detection in attributed graphs based on stateof-the-art models. This semi-supervised framework, called Suspicious, produces an efficient anomaly detector resilient to human error. More specifically, Suspicious uses two autoencoders similar to those introduced in [START_REF] Ding | Deep anomaly detection on attributed networks[END_REF]. In [START_REF] Ding | Deep anomaly detection on attributed networks[END_REF], an autoencoder is trained to compress the attributed network into a lower dimensional graph embedding before expanding that representation into an approximation of the original graph. The motivation is that the auto-encoder will capture the distribution of normal nodes and thus, they will be correctly reconstructed, while out-of-distribution outliers will not. However, this autoencoder cannot exploit any supervised information about known frauds. This is why our framework adds a second autoencoder trained to reconstruct fraudulent nodes. This second auto-encoder cannot be used alone since there are very few labeled fraudulent nodes which, in addition, may have labeling errors. For this reason, the results of this second auto-encoder alone are generally poor. Thus, our framework, Suspicious, combines both auto-encoders, each one trained to reconstruct the normal nodes and the fraudulent nodes respectively. To our knowledge, Suspicious is the only graph-based anomaly detector designed to be resilient to the existence of labeling errors in the training sample.

Our contributions are: 1) Suspicious1 , a general reconstruction-based weakly semi-supervised framework for fraud detection in attributed graphs which presents the advantage of being robust against mislabeling in the training set. 2) Extensive experiments confirming that our framework performs as well as the best current methods on perfectly labeled training sets and is resilient to mislabeling errors. After a presentation of the state of the art in Section 2, we describe Suspicious in Section 3 and its experimental evaluation in Section 4 before concluding.

II. STATE OF THE ART

When considering graph data, an anomalous element can be a subgraph, a link between two nodes, or the node itself. In this article, we focus on node anomalies and, more precisely, frauds which correspond to anomalous elements resulting from intentional illegitimate behaviors or actions2 . Among the methods designed to identify them, we can first mention the proximitybased approaches [START_REF] Antonellis | Simrank++: query rewriting through link analysis of the click graph[END_REF], [START_REF] Jeh | Simrank: A measure of structural-context similarity[END_REF] which measure the closeness of objects through the structure of the graph and consider "closeby" objects in the graph as likely to belong to the same class (anomaly or normal). Another family of methods, dedicated to networks with a community structure [START_REF] Xu | SCAN: a structural clustering algorithm for networks[END_REF] composed of groups of strongly connected nodes, considers anomalous the nodes (or edges) that connect two communities. However, we can remark that the methods belonging to these families only succeed in finding a very specific type of "structural" anomaly. In contrast, a third family of methods, designed for attributed graphs, considers only the attribute matrix and reduces the problem to anomaly detection in tabular data. The literature in this area is quite extensive [START_REF] Aggarwal | Outlier Analysis[END_REF], [7], with various models such as those based on distance, density, clustering of similar elements, depth, and many others. However, these methods ignore all the structural information given by the graph. Recently, new models based on Graph Neural Networks (GNN) have emerged such as Graph Convolutional Network (GCN) [START_REF] Kipf | Semi-Supervised Classification with Graph Convolutional Networks[END_REF], GraphSage [START_REF] Veličković | Graph Attention Networks[END_REF], Graph Isomorphism Network (GIN) [START_REF] Xu | How powerful are graph neural networks?[END_REF], Simple Graph Convolutional network (SGC) [START_REF] Wu | Simplifying graph convolutional networks[END_REF] or Beta Wavelet Graph Neural Network (BWGNN) [START_REF] Tang | Rethinking graph neural networks for anomaly detection[END_REF], especially built for anomaly detection. They have proven to outperform classical methods on most graph-specific tasks, including anomaly detection [START_REF] Liu | Benchmarking node outlier detection on graphs[END_REF]. Based on the principal of graph embeddings, they produce, thanks to an encoder, a lowdimensional vector representation of the nodes using both sets of information: the attribute matrix and the adjacency matrix. Classical tabular-based anomaly detectors can then be applied to these embeddings. For example, in the semisupervised model presented in [START_REF] Kumagai | Semi-supervised Anomaly Detection on Attributed Graphs[END_REF], the distance between the vector representation of the nodes in the embedding space and the center of a learned hypersphere is computed and used as an anomaly score. The hypersphere is trained by a GCN on labeled nodes so that it only includes normal nodes. However, the sparsity in available labeled data makes these methods even more sensitive to errors in the training set. Reconstructionbased methods also aim to exploit the graph structure and node attributes to detect anomalies [START_REF] Li | Radar: Residual Analysis for Anomaly Detection in Attributed Networks[END_REF], [START_REF] Peng | ANOMALOUS: A Joint Modeling Approach for Anomaly Detection on Attributed Networks[END_REF]. They use matrix factorization to create an approximation of the original graph, before considering the distance of each node to its reconstruction as an anomaly score. Other current approaches [START_REF] Akcay | Ganomaly: Semisupervised anomaly detection via adversarial training[END_REF], [START_REF] Ding | Deep anomaly detection on attributed networks[END_REF], [START_REF] Fan | Anomalydae: Dual Autoencoder for Anomaly Detection on Attributed Networks[END_REF] use embeddings as a base for reconstruction. In this case, a decoder is added to reconstruct the original graph and attributes from embeddings before computing an anomaly score from the reconstruction errors. Among these methods, Dominant [START_REF] Ding | Deep anomaly detection on attributed networks[END_REF] is probably the most related to our work. It uses an auto-encoder based on GCNs that compute an embedding of the graph and then two distinct decoders that approximate the adjacency and attribute matrices respectively. Finally, poorly reconstructed nodes are supposed to be anomalous. However, the anomalies detected by most of these methods are limited to synthetic anomalies. Synthetic anomalies correspond either to contextual anomalies: a node with an attribute vector different from its neighbors, or structural anomalies: a set of nodes with an atypical structure, generally a high degree clique. Our model Suspicious gets around this weakness by adding semisupervised learning, allowing the detection various types of anomalies. In addition, it is able to identify the fraudulent nodes in an attributed graph even if the training set contains mislabeled elements. By using two auto-encoders, it addresses the lack of resilience of semi-supervised models to the introduction of errors in this training sample.

III. SUSPICIOUS

After defining the problem to be solved and introducing the notations used in the following sections, this section presents the proposed Suspicious methodological framework for identifying anomalies in an attributed graph in a way that is resilient to the labeling errors of the training sample.

A. Problem

Let G = (V, E, X) be an attributed network defined by the set of nodes V = {v 1 , . . . , v n }, the set of edges E represented by a symmetric adjacency matrix A where a k,j = 1 if there is an edge between nodes k and j and a k,j = 0 otherwise, and the attribute matrix X ∈ R (n×d) which ith row x i represents the attribute vector of v i . In the same way, a i denotes the ith row of A. It is assumed that there is a labeled subset of nodes, V l ⊂ V. It is itself composed of two disjoint subsets, V s and V n , containing nodes identified, respectively, as fraudulent and normal, possibly with mislabeling errors: V l = V s ∪ V n and V s ∩ V n = ∅. This mislabeling, relatively frequent in practice, even when the labeling is done by experts, leads to anomalies being present in V n and normal nodes in V s . We denote V a ⊂ V the set of the nodes that are truly anomalous, i.e., the ground truth that is not available in real applications.

The problem we seek to solve can be expressed as follows: Given the attributed network G = (V, E, X) and the two labeled subsets V s and V n , the goal is to compute an anomaly score for the unlabeled nodes such that the true fraudulent nodes have a higher score than the true normal ones.

B. Model 1) Principle Behind Suspicious:

To solve this task, Suspicious uses two graph auto-encoders, Susp and Norm, as shown in Figure 2. The auto-encoder Norm tries to reconstruct G such that the normal nodes are better reconstructed than the fraudulent ones, while Susp does the opposite and tries to reconstruct G in a way that anomalies are better reconstructed than normal nodes. For each unlabeled node, we then obtain a reconstruction error (i.e., score) from Norm and another one from Susp and, finally, these errors are combined in a ranking score. The formal definition of this score is given in the following section, but, informally, these two scores categorize the nodes as follows:

• A low reconstruction error by Norm and a high one by Susp: both models agree that this is a normal node which should result in a final score among the lowest. • A high reconstruction error by Norm and a low one in Susp: both models agree that the node is fraudulent. This means that the node corresponds to a relevant fraud and, therefore, it should result in a final score among the highest.

• In other cases, the combination of the two scores allows our model to better identify the anomalies belonging to V s than each auto-encoder individually, as confirmed by the ablation study presented in Section IV-E.

2) Architecture of Suspicious: The architecture of both auto-encoders used in Suspicious is illustrated in Figure 1 in which the colors correspond to the types of nodes: green for normal nodes, red for anomalies, orange for poorly reconstructed nodes, and blue for well-reconstructed nodes. The encoder (ENC in Equation 1) is a GCN [START_REF] Kipf | Semi-Supervised Classification with Graph Convolutional Networks[END_REF] that computes an embedding Z of the nodes in G. Then the attribute decoder DEC (another GCN) and the adjacency matrix decoder are used to recreate, from Z, the approximations X and  of X and A, respectively:

Z = ENC(A, X, Θ 1 ); X = DEC(A, Z, Θ 2 ); Â = (Z t Z). (1)
Both auto-encoders, Susp and Norm, use this architecture with different learnable parameters sets: Θ s 1 and Θ s 2 for Susp and Θ n 1 and Θ n 2 for Norm. We can notice that each auto-encoder has the same architecture as Dominant [START_REF] Ding | Deep anomaly detection on attributed networks[END_REF], but our model uses two of them and does not use the same loss function as Dominant, as explained in the next section. Furthermore, our framework is not limited to GCNs and can be used with other graph embedding models: we also implemented versions3 of our framework in which ENC and DEC are GraphSAGE [START_REF] Hamilton | Inductive Representation Learning on Large Graphs[END_REF] or SGC [START_REF] Wu | Simplifying graph convolutional networks[END_REF] instead of the GCN. 1. Architecture of an auto-encoder. Green nodes are normal, red nodes are anomalies, orange nodes are poorly reconstructed, and blue nodes are well-reconstructed.

3) Calculation of Reconstruction Errors: For each node v i and each auto-encoder AE, which can be either Susp or Norm, we define the node reconstruction error as:

err AE (v i ) = (1 -α)∥a i -âi ∥ 2 F + α∥x i -xi ∥ 2 F . ( 2
)
where α is a parameter allowing to weight the importance given to each type of reconstruction error, on the structure and on the attributes.

During training, Suspicious tries to minimize the reconstruction error of each auto-encoder on one of the samples (V s or V n ) while maximizing the error on the other. This leads to the definition of two loss functions, one for Norm and one for Susp:

LNorm = v i ∈Vn errNorm(vi) v i ∈Vs errNorm(vi) , LSusp = v i ∈Vs errSusp(vi) v i ∈Vn errSusp(vi) . (3)
Thus, both auto-encoders Susp and Norm use V n and V s but in a different way: nodes that are similar to the majority of the nodes in their respective sample get lower scores, while nodes that are less represented in the sample get higher scores. The loss functions are minimized during training using gradient descent, as explained in the next section. As previously stated, the main difference between Suspicious and Dominant lies not only in its architecture, Suspicious is based on two autoencoders, as shown in Figure 2, while Dominant has only one, but also in the calculation of the loss function. While Dominant tries to reconstruct the whole graph with minimal error, in our model, each encoder tries to minimize its own reconstruction error.

4) Final Score and Decision Criterion: The reconstruction errors of the nodes for each auto-encoder are normalized in [0, 1], where AE is either Susp or Norm:

En AE (v i ) = err AE (v i ) -M in vj ∈V (err AE (v j )) M ax vj ∈V (err AE (v j )) -M in vj ∈V (err AE (v j )) (4)
The final ranking score is then:

Ranking score (v i ) = En N orm (v i ) En Susp (v i ) . (5)
Therefore, high scores in En N orm with low scores in En Susp produce a high Ranking score corresponding to nodes classified as anomalous, which is in line with the principle behind Suspicious, described previously.

IV. EXPERIMENTS

This section details the experimental evaluation of our framework, Suspicious, and its comparison with state of the art methods. It also includes an ablation study showing the interest of combining the two auto-encoders, Norm and Susp, as well as an analysis of the impact of labeling errors in the training sample, confirming the resilience of our method.

A. Datasets

The experiments are conducted on six real-world datasets:

• Cora and PubMed are popular public network datasets [START_REF] Sen | Collective classification in network data articles[END_REF]. In these graphs, each node is a scientific publication, and the edge represents the citation of another publication. The attributes correspond to the content of the publications represented as a bag-of-words vector.

• In Photo and Computers, each node is a product, and an edge exists if two products are often purchased together.

The attributes are also bag-of-words vectors. • Reddit is a social media platform. Our dataset is an extracted graph consisting of both subreddits and user nodes, each with bag-of-words attribute vectors extracted from their respective posts. The user label "Banned" is used as our anomaly label. Since banned users are users that broke the rules of Reddit, they can be considered frauds. • Books is also an Amazon co-purchase network, like Photo and Computers, but in this dataset, the labels are obtained through an "amazon fail" tag which indicates that the product was massively flagged by users. In Reddit and Books, the label information (anomalous/normal) has been obtained through human expertise and requires no additional modification. However, as it is the result of human decisions, it can contain mislabeling. Thus, this ground truth is not fully reliable for an experimental evaluation.

The evaluation of Suspicious requires datasets including anomalous elements. We consider three types of anomalies. In addition to organic anomalies provided by humans, we follow the experimental protocols introduced in Kumagai et al. [START_REF] Kumagai | Semi-supervised Anomaly Detection on Attributed Graphs[END_REF] and Liu et al. [START_REF] Liu | Benchmarking node outlier detection on graphs[END_REF] to define, respectively, rare class anomalies and synthetic anomalies for the first four previous datasets (Cora, PubMed, Photo and Computer). Thus, two versions have been generated for each dataset data denoted respectively by dataR and dataS. The characteristics of our datasets are summarized in Table I: number of nodes (|V|), edges (|E|), attributes (d), anomalies (|V a |) and anomaly rate ( |Va| |V| ). Rare class anomalies: Each of the datasets, Cora, PubMed, Photo and Computer, contains several classes of nodes. Following the protocol of [START_REF] Kumagai | Semi-supervised Anomaly Detection on Attributed Graphs[END_REF], [START_REF] Wang | One-class graph neural networks for anomaly detection in attributed networks[END_REF] rare class anomalies can be defined by relabeling the elements of the smallest class as anomalies, while all the nodes of the other classes are considered normal. In this way, a dataset named dataR, suitable for binary classification with class imbalance, is created.

Synthetic anomalies: The same datasets, Cora, PubMed, Photo, and Computers, are also modified to obtain contextual and structural anomalies following the methodology proposed in [START_REF] Liu | Benchmarking node outlier detection on graphs[END_REF]. Specifically, contextual anomalies are created by replacing the attribute vector of a node by the most different node attribute vector out of a range of randomly selected nodes. Structural anomalies are created by adding edges to the graph to create k cliques of k nodes with k = 0.05 × |V |. The ratio of created anomalous nodes is 5% for each type of anomaly, resulting in a total of 10% of anomalous nodes of both types, contextual and structural, as indicated in Table I (Anomaly rate) and resulting in the dataset called dataS.

Organic anomalies: Books and Reddit contain organic anomalies [START_REF] Liu | Benchmarking node outlier detection on graphs[END_REF]: the label (anomalous/normal) has been obtained through human expertise and requires no additional modification.

1) Protocol: In a realistic fraud detection application, the number of available labeled nodes would be low and the labels could be erroneous. To reflect these hypotheses, we propose the following protocol: A training sample V l is randomly sampled from V according to a rate R equal to 10% by taking R × |V a | anomalous nodes and R × |V \ V a | normal nodes. The corresponding test set is equal to V \ V l . To evaluate the resilience of the methods, we then introduce errors in labels: the label of some nodes in V l is swapped. The proportion of normal nodes wrongly labeled fraudulent is denoted M is s , whereas the proportion of anomalous nodes labeled normal is M is n :

M is n = |V a ∩ V n | |V n | , and M is s = |V s \ V a | |V s | . (6)
Due to the application, the data is imbalanced: the number of normal nodes |V n | is much larger than the number of frauds |V a |. Thus, M is n (which is upper bounded by |V a |/|V n |) is always small and can be neglected. Therefore, in the experiments, it is taken as equal to 0, which also decreases the number of parameters to test. The proportion M is s takes values varying between 0 and 0.5 in the experiments. Finally, 10 training/test samples are produced for each dataset and each mislabeling rate M is s . All reported results in the following sections are averages (with standard deviation SD) over these 10 samples.

B. Settings for Suspicious and Baselines

Our methodological framework, Suspicious, is evaluated in three settings depending on the version of the auto-encoder (AE) used: ENC and DEC in Equation 1 can be: GCN [START_REF] Kipf | Semi-Supervised Classification with Graph Convolutional Networks[END_REF], GraphSage [START_REF] Veličković | Graph Attention Networks[END_REF] or SGC [START_REF] Wu | Simplifying graph convolutional networks[END_REF]. This leads to three variants respectively denoted Ours-GCN, Ours-Sage, and Ours-SGC in the following sections. They are compared with the following unsupervised (u) and semi-supervised (s) state-of-the-art methods:

• Kumagai et al. (s): a semi-supervised graph embedding method that uses the AUC regularizer as part of the loss to minimize the volume of a hypersphere that encompasses labeled normal nodes [START_REF] Kumagai | Semi-supervised Anomaly Detection on Attributed Graphs[END_REF]. As Kumagai has been shown to outperform OCGNN [START_REF] Wang | One-class graph neural networks for anomaly detection in attributed networks[END_REF], OSVM [START_REF] Schölkopf | Estimating the support of a high-dimensional distribution[END_REF], Doc-N [START_REF] Ruff | Deep one-class classification[END_REF],

Deep Walk [START_REF] Perozzi | Deepwalk: Online learning of social representations[END_REF], and ImVerde [START_REF] Wu | Imverde: Vertex-diminished random walk for learning imbalanced network representation[END_REF] on these datasets, we do not consider these methods as additional baselines since by outperforming Kumagai et al., Suspicious will also outperform them.

• GNN classifiers (s): Three graph neural networks, GCN [START_REF] Kipf | Semi-Supervised Classification with Graph Convolutional Networks[END_REF], GIN [START_REF] Xu | How powerful are graph neural networks?[END_REF] and GAT [START_REF] Veličković | Graph Attention Networks[END_REF], are used as node classifiers. • BWGNN (s): BWGNN [START_REF] Tang | Rethinking graph neural networks for anomaly detection[END_REF] is a GNN designed for anomaly detection. • Dominant (u): an unsupervised method of graph reconstruction based on an auto-encoder which calculates anomaly scores as the sum of the reconstruction errors made on the attributes and the graph structure [START_REF] Ding | Deep anomaly detection on attributed networks[END_REF]. • AnomalyDAE (u): an improved version of Dominant [START_REF] Fan | Anomalydae: Dual Autoencoder for Anomaly Detection on Attributed Networks[END_REF]. It has been empirically demonstrated in [START_REF] Liu | Benchmarking node outlier detection on graphs[END_REF] that AnomalyDAE consistently outperforms LOF [START_REF] Breunig | LOF: identifying density-based local outliers[END_REF] and IF [START_REF] Liu | Isolation forest[END_REF]. For this reason, we do not integrate them in our evaluation. • Anomalous (u): a method that uses CUR decomposition and residual analysis for computing a final score defined by the norm of its reconstruction residual [START_REF] Peng | ANOMALOUS: A Joint Modeling Approach for Anomaly Detection on Attributed Networks[END_REF]. • CoLA (u): a method that produces an embedding of the graph through a GNN and then uses contrastive learning to compute an anomaly score [START_REF] Liu | Anomaly detection on attributed networks via contrastive self-supervised learning[END_REF]. Moreover, as CoLA is based on the same approach as [START_REF] Zheng | From unsupervised to few-shot graph anomaly detection: A multi-scale contrastive learning approach[END_REF] and provides equivalent results, this last one is not included.

C. Evaluation Parameters and Metrics

An implementation of the method from Kumagai 4 was used with the parameters published in the paper: an embedding of dimension 4 for Books since it has fewer attributes, and 32 for the other datasets, a maximum of 500 repetitions with an early stopping mechanism, and the center C defined as the average of the embeddings of the nodes labeled as normal after the first layer of the model.

For Dominant, AnomalyDAE, CoLA and Anomalous, the pygod implementation from BOND [START_REF] Liu | Benchmarking node outlier detection on graphs[END_REF] was used with the publication settings, a two-layer GCN as an encoder and a onelayer GCN as an attribute decoder, an embedding dimension of 32, 100 repetitions, and α = 0.5 for AnomalyDAE and Dominant. For Anomalous, the gradient descent is used instead of closed-form optimization provided in the official implementation due to fairness and efficiency concerns. For the GNN classifiers, the implementation benchmark [START_REF] Liu | Mul-gad: a semi-supervised graph anomaly detection framework via aggregating multi-view information[END_REF] was used and modified to include mislabeling errors and a training set with the same size as ours. Our framework was implemented using parts of the Dominant implementation and models from PyTorch Geometric [START_REF] Fey | Fast graph representation learning with pytorch geometric[END_REF]; the code and datasets are publicly available 5 . The implementations of Suspicious use the same parameters as our baselines: an embedding dimension of 4 for Books and 32 for the others, a dropout rate of 0.5 for both auto-encoders, 100 repetitions, and a learning rate of 0.005. As in the literature in the field, the results are evaluated with AUC (Area Under the Roc curve) scores computed on the unlabeled nodes: for each dataset and each error rate M is s ∈ {0, 0.1, 0.2, 0.3, 0.4, 0.5}, we randomly select 10 train samples V l and report the average AUC, with standard deviation, computed on the corresponding 10 test samples V \ V l .

D. Experimental Results

The results obtained by the different methods for the datasets described in Table I are presented in Tables II-III.

Table II shows the results obtained for the rare class datasets in the case of a perfectly labeled training sample i.e. when M is s equals 0. Our framework obtains the best results across all datasets. However, most semi-supervised methods accurately detect the anomalies and obtain relatively equivalent results to ours, while the unsupervised methods designed for The results obtained on the synthetic class datasets with perfectly labeled training samples (M is s = 0) are summarized in Table III. AnomalyDAE gets the best results on PhotoS, and only our framework, Suspicious, reaches equivalent results. Dominant provides the best result on CoraS while our framework arrives second, before AnomalyDAE, with significantly better performances than all the other methods. Finally, Ours-GCN obtains the best results on PubmedS and ComputerS. We can observe that semi-supervised methods struggle to reach performances equivalent to those of the unsupervised methods, specifically designed for these type of anomalies. However, Suspicious, which does not belong to this family of methods, still manages to achieve performances equivalent to the bestperforming method, AnomalyDAE.

Finally, the results obtained on the organic datasets are also presented in Table III. All of our methods obtain the best results on both Books and Reddit. While the GCN reaches equivalent performances on the Reddit dataset, all the other methods fail to find the anomalies in Books. The globally poor results on these datasets can be explained by the nature of those anomalies, as they are the result of human decisions. Indeed the ground truth itself can contain mislabeling [START_REF] Zeni | Fixing mislabeling by human annotators leveraging conflict resolution and prior knowledge[END_REF] and, the labels can be inconsistent due to the diversity of the annotators. However, since our method is able to identify a portion of those anomalies it shows to be more appropriate to reproduce human reasoning than the other state-of-the-art methods, supervised or not. Nevertheless, we exclude those datasets from the complementary studies related to the impact of the parameter α and mislabeling rate M is s , since it is not pertinent to conduct them on datasets with poor results.

E. Ablation Study

The aim of this ablation study is to check the interest of combining both auto-encoders Norm and Susp to identify the fraudulent elements. To that aim, we calculate a gain defined as the difference of performances, in terms of AUC score, obtained with Suspicious versus only one auto-encoder AE that can be Norm or Susp (Equation 7). To compute the performances of an AE, we calculate its AUC score using its reconstruction error err AE .

Gain = AU C(Suspicious) -AU C(AE) (7)
A positive difference corresponds to a gain and confirms the interest of using two auto-encoders instead of only one. Figure 3 shows these differences between the average AUC score calculated with N orm (in red) and Susp (in blue) on the different datasets for the three settings (Ours-GCN top left, Ours-Sage top right and Ours-SGC bottom).

With Ours-GCN, the use of both auto-encoders improves the detection of rare class anomalies, comparatively to Susp and Norm, but it degrades the performances of Norm for synthetic anomalies on PubMedS, CoraS and, to a lesser extent, on PhotoS. This can be explained by the GCN's tendency to discard node information that is too different from its neighbors, creating a bias that makes it unable to reconstruct contextual anomalies that are part of synthetic anomalies. By incorporating two auto-encoders, this bias can be corrected, Concerning Ours-Sage and Ours-SGC, the results show that using both auto-encoders provides almost always a consistent advantage, and when it is not the case, for CoraR and PhotoS, the loss remains low while the gain can be very significant, such as for ComputerS. In conclusion, with an improvement in 42 of 48 cases (Figure 3), this experiment confirms the interest of combining both auto-encoders as in Suspicious. This allows all our models to gain versatility and detect both kinds of anomalies on every dataset.

F. Impact of the Mislabeling Errors

This set of experiments aims to evaluate the resilience of Suspicious to mislabeling errors, frequent in practice due to the difficulty for experts to identify frauds. It consists of studying the variation of the AUC score in function of M is s , defined in Equation 6. The results obtained on rare anomaly datasets are presented in Figure 4, while the results obtained on the synthetic anomaly datasets are presented in Figure 5. Since unsupervised methods cannot be affected by labeling errors, their results are included only for information. The Kumagai method has been excluded from this study due to its extremely long execution time as well as CoLA due to its low performances. In Figure 4, we can observe that our models remain among the best-performing methods, no matter the value of M is s on rare type anomaly datasets. In Figure 5, we notice that, except for Ours-GCN, our framework remains stable no matter the value of M is s . It is important to note that Ours-GCN only seems to be affected by M is s when it outperforms the other models and never truly falls below their already satisfying results. These figures show that our model is not impacted by errors occurring in the subset V s of V l used for its training as long as the labeling error rate remains below 40%, and even for higher rates, it outperforms most semi-supervised methods.

G. Impact of a Varying R

These experiments aim to understand the impact of R, the size of the labeled sample used for training, on the performances of our framework. Figure 6 shows the variation in the average AUC-score, with standard deviation, in function of R. A lower R generally results in a lower performance but, most datasets reach a competitive average AUC-score with a fairly low value for R. However a higher value is needed to stabilize the standard deviation. Thus, it seems that R mainly impacts the stability of the results but, it should be noted that a value of 3% for R is sufficient to make our framework one of the best-performing method on all datasets.

H. Impact of a Varying α

Finally, we also studied the impact of α on the results. This parameter allows the weighting of the importance given to each type of reconstruction error done either on the structure or on the attributes. Figure 7 presents the average AUC score of Ours-GCN for all non-organic datasets in function of α. For rare class anomalies (DataR), α has a very low impact unless it is equal to 0 or 1. For synthetic anomalies (DataS), there are lower AUC and more variations both in value and in SD (especially ComputersS and PhotoS). All in all, a value around 0.5 generally achieves good results and low SD. The stability of the results on DataR is another advantage of Suspicious over other methods, as this parameter α has an important impact on the final results of Dominant [START_REF] Ding | Deep anomaly detection on attributed networks[END_REF] and AnomalyDAE [START_REF] Fan | Anomalydae: Dual Autoencoder for Anomaly Detection on Attributed Networks[END_REF].

V. CONCLUSION

We proposed a semi-supervised general framework for fraud detection in attributed graphs, compatible with all types of GNN, that is versatile while still being resilient to human error in the labeling of the training set. When there is no mislabeling, our model obtains better or equivalent results compared to the current state of the art on all types of anomalies, whereas the other methods are mainly efficient for a certain type of anomaly. Moreover, our models still provide good results with a small sized training set even if it contains labeling errors. As a next step, we plan to add a module to provide an explanation of the final score that can be understood by the experts who provided the original information.

  Fig.

Fig. 2 .

 2 Fig. 2. Architecture of Suspicious. Norm and Susp are auto-encoders similar to those shown in Figure 1. Green nodes are normal, red nodes are anomalous, orange nodes are poorly reconstructed and blue nodes are well-reconstructed.

  PhotoR ComputersR CoraR PubMedR Ours-GCN(s) 93.9 ± 0.2 99.6±0.1 98.1±0.5 95.2 ± 0.2 Ours-Sage(s) 97.1±0.9 99.5 ± 0.1 95.6 ± 0.9 95.3±0.2 Ours-SGC(s) 97.3±0.6 99.6±0.2 95.7 ± 1.4 95.5±0.3 BWGNN(s) 92.1 ± 4.6 72.5 ± 10.5 48.4 ± 12.4 88.8 ± 0.3 GIN(s) 68.0 ± 18.9 93.1 ± 1.2 88.3 ± 0.1 89.0 ± 0.1 GAT(s) 96.8 ± 0.2 98.4 ± 0.2 97.0 ± 0.5 91.7 ± 0.4 GCN(s) 95.6 ± 0.2 98.5 ± 0.0 98.0±0.0 92.5 ± 0.0 Kumagai(s) 94.4 ± 1.8 97.2 ± 5.5 94.5 ± 1.8 94.3 ± 0.3 AnomalyDAE(u) 51.8 ± 0.1 56.4 ± 0.1 47.9 ± 0.4 61.8 ± 0.2 Dominant(u) 51.5 ± 0.0 46.3 ± 0.0 48.7 ± 0.4 51.0 ± 0.0 Anomalous(u) 54.1 ± 6.8 49.1 ± 3.4 53.0 ± 1.2 58.9 ± 1.9 CoLA(u) 55.8 ± 3.1 66.2 ± 1.2 38.3 ± 7.3 39.2 ± 3.3

Fig. 3 .

 3 Fig. 3. Average gain using Suspicious versus using only Norm (red) or Susp (blue) on the different datasets for the settings Ours-GCN (top left), Ours-Sage (top right) and Ours-SGC(bottom).

Fig. 4 .

 4 PhotoR

Fig. 5 .Fig. 6 .

 56 PhotoS

TABLE II AVERAGE

 II AUC±SD(%) ON RARE CLASS DATASETS. ± 10.5 48.4 ± 12.4 88.8 ± 0.3 GIN(s) 68.0 ± 18.

		PhotoR	ComputersR	CoraR	PubMedR
	Ours-GCN(s)	93.9 ± 0.2	99.6±0.1	98.1±0.5	95.2 ± 0.2
	Ours-Sage(s)	97.1±0.9	99.5 ± 0.1	95.6 ± 0.9	95.3±0.2
	Ours-SGC(s)	97.3±0.6	99.6±0.2	95.7 ± 1.4	95.5±0.3
	BWGNN(s)	92.1 ± 4.6	72.5

TABLE III AVERAGE

 III AUC±SD(%) ON SYNTHETIC AND ORGANIC DATASETS. allowing for better detection of rare class anomalies at the expense of reduced performance for contextual anomalies. It should be noted, however, that this results in an efficient and versatile model with good performance in both scenarios.

		PhotoS	ComputersS	CoraS	PubmedS	Reddit	Books
	Ours-GCN(s)	76.5 ± 2.3	80.1±4.0	78.85±3.7	84.3±2.6	64.3±1.7	58.0 ± 8.0
	Ours-Sage(s)	72.3 ± 1.0	73.7 ± 0.4	75.8 ± 2.5 71.1 ± 1.0	63.5±2.8	60.9±5.1
	Ours-SGC(s)	70.7 ± 1.8	71.8 ± 1.1	76.4 ± 2.7 69.1 ± 0.6	62.5±4.8	58.1±7.3
	BWGNN(s)	55.3±8.3	64.0 ± 1.9	66.3 ± 1.2 69.5 ± 0.5	55.8 ± 2.1	54.2 ± 3.6
	GIN(s)	51.2 ± 3.9	59.1 ± 3.6	32.3 ± 0.0 70.9 ± 6.4	48.9 ± 7.3	50.0 ± 0.0
	GAT(s)	53.6 ± 0.8	70.3 ± 3.3	66.7 ± 0.9 72.0 ± 4.5	59.7 ± 3.7	50.0 ± 0.0
	GCN(s)	57.0 ± 0.3	65.3 ± 0.3	40.0 ± 0.2 73.9 ± 0.7	62.0 ± 0.1	50.0 ± 0.0
	Kumagai(s)	50.2 ± 2.3	53.2 ± 1.9	67.9 ± 2.8 57.0 ± 1.3	52.7 ± 0.7	43.4 ± 1.8
	AnomalyDAE(u)	77.5±0.0	75.5 ± 0.0	77.5 ± 0.0 75.7 ± 0.1	48.6 ± 3.7	55.2 ± 6.7
	Dominant(u)	63.6 ± 0.0	65.3 ± 0.0	83.9±0.0	81.2 ± 0.0	56.1 ± 0.0	38.9 ± 1.2
	Anomalous(u)	48.5 ± 2.7	49.3 ± 0.08 33.6 ± 0.9 37.0 ± 0.02	53.0 ± 0.0	47.3 ± 3.1
	CoLA(u)	58.5 ± 1.6	56.6 ± 0.08 67.0 ± 1.8 73.6 ± 2.3	53.0 ± 1.3	50.0 ± 0.0

Code and datasets available https://src.koda.cnrs.fr/labhc/code4publications/2023-ICTAI-suspicious

[START_REF] Akcay | Ganomaly: Semisupervised anomaly detection via adversarial training[END_REF] In the following, both terms will nevertheless be used to designate the elements to be identified

Codes available on https://src.koda.cnrs.fr/labhc/code4publications/2023-ICTAI-suspicious

https://github.com/tuananh0305/GCN ANOMALY DETECTION

https://src.koda.cnrs.fr/labhc/code4publications/2023-ICTAI-suspicious


Ines Lakbar
email: ines.lakbar@chu-montpellier.fr.

Mervyn Singer

Marc Leone

The need for microbiologists and antimicrobial stewardship teams will still remain paramount

published or not. The documents may come

*Correspondence:

ines.lakbar@chu-montpellier.fr 1 Anesthesiology and Intensive Care, Anesthesia and Critical Care Departmen B, Saint Eloi Teaching Hospital, PhyMedExp, University of Montpellier, INSERM U1046, 1, 80 Avenue Augustin Fliche, Montpellier Cedex 5, France

We thank Luque-Paz and colleagues [START_REF] Luque-Paz | the need for microbiologists and antimicrobial stewardship teams will still remain paramount[END_REF] for their interest in our editorial [START_REF] Lakbar | will we still need our microbiologist?[END_REF]. We respectfully differ from their overly conservative perspective. We certainly are not advocating for microbiologist redundancy but we would encourage the infectious disease community to rapidly embrace new technologies that will enhance their speciality and patient care, albeit with the necessary caveats regarding validation and safety. Only a decade or so ago, echocardiography was the sole domain of cardiologists and a limited and often delayed resource. It is now ubiquitous in critical care units and available around the clock, yet input from the specialist cardiologist remains integral for complex cases. AI and rapid or even point-of-care diagnostics should be similarly viewed as opportunity for the microbiologist rather than threat. Most hospitals around Europe only offer Matrix Assisted Laser Desorption Ionization-Time of Flight (MALDI-TOF) technology in conventional working hours and it is often employed only once standard cultures yielded positive results, a process that usually spans a day or more. Would not the critically ill patient benefit from rapid pathogen identification in the middle of the night with, perhaps more importantly, identification of antimicrobial susceptibility patterns that allow focused treatment and immediate antimicrobial stewardship augmented by AI? Such technologies are arriving that will give results within hours rather than days [START_REF] Banerjee | Rapid antimicrobial susceptibility testing methods for blood cultures and their clinical impact[END_REF]. Carpe diem! Funding None.

Data availability

Not applicable.

Declarations

Conflicts of interest

ML reports receiving consulting fees from LFB, Viatris, AOP. MS reports receiving consulting fees from DeepUll, Aptarion, Pfizer, Roche Diagnostics and Safeguard Biosystems. No conflict of interest is reported for IL.