pith. sign in

arxiv: 2605.29526 · v2 · pith:WZP72L77new · submitted 2026-05-28 · 💻 cs.CR · cs.AI· cs.LG

Temporal Motif-aware Graph Test-time Adaptation for OOD Blockchain Anomaly Detection

Pith reviewed 2026-06-29 06:39 UTC · model grok-4.3

classification 💻 cs.CR cs.AIcs.LG
keywords blockchain anomaly detectiontemporal motifsgraph test-time adaptationout-of-distribution detectioncryptocurrency transactionsgraph anomaly detectionadversarial pattern evolution
0
0 comments X

The pith

The TEMG-TTA framework uses 3-node temporal motif distributions and test-time adaptation to detect anomalies across evolving blockchain transaction patterns.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper seeks to establish that computing the 3-node temporal motif distribution for each active address and then applying a test-time adaptation step can bridge distribution shifts in blockchain graphs. This would matter because malicious actors continuously evolve their patterns and different blockchains carry distinct transaction semantics, causing conventional graph anomaly detectors to degrade. The adaptation mechanism lets the model reuse common patterns seen during training when processing new test graphs without requiring labeled retraining data.

Core claim

TEMG-TTA first captures the 3-node temporal motif distribution of each active address through an efficient computational mechanism that supports downstream temporal motif-aware graph learning. It then applies a simple test-time adaptation strategy that enables sharing of common patterns between training and testing graphs, directly addressing adversarial pattern evolution by malicious actors and the out-of-distribution problem arising from varied transaction semantics on different blockchains.

What carries the argument

The per-address 3-node temporal motif distribution paired with a test-time adaptation strategy that aligns patterns between training and test graphs.

If this is right

  • The method outperforms state-of-the-art graph anomaly detection approaches by an average of 54.88 percent on five real-world datasets.
  • A case study demonstrates that the framework explicitly characterizes complex transaction patterns belonging to anomalous addresses.
  • The motif computation step enables effective temporal motif-aware graph learning on the processed address representations.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same motif-plus-adaptation pattern could be tested on dynamic graphs from non-cryptocurrency domains that also experience label distribution shifts.
  • Extending the motif computation beyond three nodes might reveal whether higher-order structures add further separation between normal and anomalous addresses.
  • If the adaptation step succeeds with minimal additional compute, it could lower the cost of deploying detectors when new blockchains launch.

Load-bearing premise

The 3-node temporal motif distribution of each active address combined with the proposed test-time adaptation strategy is sufficient to capture and bridge the distribution shifts caused by adversarial pattern evolution and varied transaction semantics across blockchains.

What would settle it

On a new set of blockchain transaction graphs, if the motif distributions show no statistical association with anomaly labels or if the adaptation step produces no measurable lift over a non-adapted baseline model, the central claim would be falsified.

Figures

Figures reproduced from arXiv: 2605.29526 by Bingde Hu, Canghong Jin, Can Wang, Huiling Peng, Jiawei Chen, Mingli Song, Runang He, Tongya Zheng, Yuanyu Wan.

Figure 1
Figure 1. Figure 1: Radar maps of two types of blockchain transactions [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Overall framework of our proposed TEMG-TTA. 1,3 0 2 2 1 1 3 0 2 2 1 1 0 2 1 3 2 1 0 2 2 1 3 1 0 2 2,3 1 1 0 2 1 2 3 1,3 0 2 2 1 1 3 0 2 2 1 1 0 2 1 3 2 1 0 2 1 3 2 1 0 2 2,3 1 1 0 2 1 2 3 1,3 0 2 1 2 1 3 0 2 1 2 1 0 2 1 2,3 1 0 2 1 3 2 1 0 2 1 2 3 1 0 2 1 2 3 1,3 0 2 1 2 1 3 0 2 1 2 1 0 2 1 2,3 1 0 2 1 2 3 1 0 2 3 1 2 1 0 2 3 1 2 1,3 2 0 2 1 2,3 0 2 1 2 0 2 1 3 1 2 0 2 1 3 1 2 0 2 3 1 1 2 0 2 3 1 1,2,3 0 2… view at source ↗
Figure 3
Figure 3. Figure 3: All possible directed motifs with 3 nodes and 3 edges. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Common temporal motif patterns in real-world blockchain [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
read the original abstract

Ever-evolving transaction patterns have significantly hindered anomaly detection on emerging cryptocurrency blockchains due to the vast number of addresses and diverse anomalous behaviors. Recently, advanced Graph Anomaly Detection (GAD) approaches applied to blockchains have faced two critical challenges: \textit{adversarial pattern evolution by malicious actors} and \textit{the out-of-distribution (OOD) problem caused by varied transaction semantics on blockchains}. To address these challenges, we propose a novel framework termed \textbf{TE}mporal \textbf{M}otif-aware \textbf{G}raph \textbf{T}est-\textbf{T}ime \textbf{A}daptation (\textbf{TEMG-TTA}). First, we comprehensively capture the 3-node temporal motif distribution of each active address using an efficient computational mechanism, enabling downstream temporal motif-aware graph learning. Second, we design a simple yet effective test-time adaptation strategy to facilitate the sharing of common patterns between training and testing graphs. Extensive experiments on 5 real-world datasets demonstrate that our proposed \textbf{TEMG-TTA} outperforms \textit{state-of-the-art} GAD approaches by an average of 54.88\%. A further case study on interpretable motif patterns reveals that \textbf{TEMG-TTA} explicitly characterizes the complex transaction patterns of anomalous addresses, thereby verifying the effectiveness of our technical designs. Our code is publicly available at https://github.com/LuoXishuang0712/TEMG-TTA/.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 1 minor

Summary. The paper proposes TEMG-TTA, a framework for OOD blockchain anomaly detection that first computes 3-node temporal motif distributions for each active address to support motif-aware graph learning, then applies a test-time adaptation strategy to share patterns across training and test graphs. It claims this addresses adversarial pattern evolution and cross-blockchain semantic shifts, with extensive experiments on 5 real-world datasets showing an average 54.88% outperformance over state-of-the-art GAD methods, plus a case study on interpretable motifs; code is released publicly.

Significance. If the performance claims and the sufficiency of 3-node motifs for bridging the stated distribution shifts are substantiated, the work would offer a targeted contribution to graph anomaly detection on blockchains by combining motif-based representations with test-time adaptation. Public code release supports reproducibility.

major comments (2)
  1. [Abstract] Abstract: the central claim of 54.88% average outperformance over SOTA GAD approaches is presented with no description of the 5 datasets, baselines, metrics, statistical tests, or experimental protocol, rendering the result unevaluable and load-bearing for the paper's contribution.
  2. [Method] Method (temporal motif and TTA sections): the framework assumes that 3-node temporal motif distributions per address plus the proposed TTA strategy suffice to capture and adapt to shifts from adversarial pattern evolution and varied transaction semantics, but no ablation, analysis of higher-order motifs, or evidence addressing long-range dependencies (e.g., in laundering patterns) is provided to support this assumption.
minor comments (1)
  1. [Abstract] Abstract: the phrase 'efficient computational mechanism' for motif capture is used without further elaboration on its complexity or implementation.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We sincerely thank the referee for their valuable feedback on our manuscript. We have carefully considered each comment and provide point-by-point responses below, indicating where revisions will be made.

read point-by-point responses
  1. Referee: [Abstract] Abstract: the central claim of 54.88% average outperformance over SOTA GAD approaches is presented with no description of the 5 datasets, baselines, metrics, statistical tests, or experimental protocol, rendering the result unevaluable and load-bearing for the paper's contribution.

    Authors: We agree that the abstract should provide sufficient context for the central claim to be evaluable. We will revise the abstract to briefly specify the five real-world blockchain datasets, the SOTA GAD baselines, the evaluation metrics (AUC-ROC and F1-score), and note that results are averaged over multiple runs with standard deviations. revision: yes

  2. Referee: [Method] Method (temporal motif and TTA sections): the framework assumes that 3-node temporal motif distributions per address plus the proposed TTA strategy suffice to capture and adapt to shifts from adversarial pattern evolution and varied transaction semantics, but no ablation, analysis of higher-order motifs, or evidence addressing long-range dependencies (e.g., in laundering patterns) is provided to support this assumption.

    Authors: We selected 3-node temporal motifs due to their established utility in capturing local temporal transaction patterns with favorable computational cost on large blockchain graphs; higher-order motifs incur prohibitive overhead. The TTA strategy is intended to address the distribution shifts. To strengthen support for these choices, we will add an ablation comparing motif orders (where computationally feasible) and expand discussion in the case study on how adapted representations handle patterns with longer dependencies. revision: yes

Circularity Check

0 steps flagged

No circularity; empirical results independent of any self-referential derivation

full rationale

The paper proposes TEMG-TTA by capturing 3-node temporal motif distributions per address followed by a test-time adaptation step, then reports experimental outperformance on five datasets. No equations, parameter fits, or self-citations are shown that reduce the claimed gains to quantities defined by the method itself. The central performance numbers (54.88% average) are presented as direct experimental outcomes rather than predictions forced by construction. The approach is therefore self-contained against external benchmarks with no load-bearing circular steps.

Axiom & Free-Parameter Ledger

0 free parameters · 2 axioms · 0 invented entities

The framework rests on domain assumptions about the informativeness of 3-node temporal motifs and the effectiveness of test-time adaptation for distribution shift; no free parameters or invented entities are described in the abstract.

axioms (2)
  • domain assumption 3-node temporal motif distributions sufficiently characterize anomalous transaction behaviors across blockchains
    Invoked as the basis for the first technical component.
  • domain assumption Test-time adaptation can share common patterns between training and test graphs without labeled target data
    Core premise of the second technical component.

pith-pipeline@v0.9.1-grok · 5819 in / 1204 out tokens · 31649 ms · 2026-06-29T06:39:58.531815+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

36 extracted references · 9 canonical work pages · 2 internal anchors

  1. [1]

    Detecting ponzi schemes on ethereum: Towards healthier blockchain technology

    [Chenet al., 2018 ] Weili Chen, Zibin Zheng, Jiahui Cui, Edith Ngai, Peilin Zheng, and Yuren Zhou. Detecting ponzi schemes on ethereum: Towards healthier blockchain technology. InProceedings of the 2018 world wide web conference, pages 1409–1418,

  2. [2]

    Traveling the token world: A graph analysis of ethereum erc20 token ecosystem

    [Chenet al., 2020 ] Weili Chen, Tuo Zhang, Zhiguang Chen, Zibin Zheng, and Yutong Lu. Traveling the token world: A graph analysis of ethereum erc20 token ecosystem. In Proceedings of The Web Conference 2020, pages 1411– 1421,

  3. [3]

    Graphtta: Test time adaptation on graph neural networks.arXiv preprint arXiv:2208.09126,

    [Chenet al., 2022 ] Guanzi Chen, Jiying Zhang, Xi Xiao, and Yang Li. Graphtta: Test time adaptation on graph neural networks.arXiv preprint arXiv:2208.09126,

  4. [4]

    Consistency training with learnable data augmentation for graph anomaly detection with limited supervision

    [Chenet al., 2024 ] Nan Chen, Zemin Liu, Bryan Hooi, Bingsheng He, Rizal Fathony, Jun Hu, and Jia Chen. Consistency training with learnable data augmentation for graph anomaly detection with limited supervision. InThe twelfth international conference on learning representa- tions,

  5. [5]

    Spacegnn: Multi-space graph neural network for node anomaly detection with ex- tremely limited labels.arXiv preprint arXiv:2502.03201,

    [Donget al., 2025 ] Xiangyu Dong, Xingyi Zhang, Lei Chen, Mingxuan Yuan, and Sibo Wang. Spacegnn: Multi-space graph neural network for node anomaly detection with ex- tremely limited labels.arXiv preprint arXiv:2502.03201,

  6. [6]

    Dga- gnn: Dynamic grouping aggregation gnn for fraud detec- tion

    [Duanet al., 2024 ] Mingjiang Duan, Tongya Zheng, Yang Gao, Gang Wang, Zunlei Feng, and Xinyu Wang. Dga- gnn: Dynamic grouping aggregation gnn for fraud detec- tion. InProceedings of the AAAI conference on artificial intelligence, volume 38, pages 11820–11828,

  7. [7]

    Inductive representation learning on large graphs.Advances in neural information processing sys- tems, 30,

    [Hamiltonet al., 2017 ] Will Hamilton, Zhitao Ying, and Jure Leskovec. Inductive representation learning on large graphs.Advances in neural information processing sys- tems, 30,

  8. [8]

    Hybrid-order anomaly detection on attributed networks.IEEE Transactions on Knowledge and Data En- gineering, 35(12):12249–12263,

    [Huanget al., 2021 ] Ling Huang, Ye Zhu, Yuefang Gao, Tuo Liu, Chao Chang, Caixing Liu, Yong Tang, and Chang- Dong Wang. Hybrid-order anomaly detection on attributed networks.IEEE Transactions on Knowledge and Data En- gineering, 35(12):12249–12263,

  9. [9]

    Empowering graph rep- resentation learning with test-time graph transformation

    [Jinet al., 2022 ] Wei Jin, Tong Zhao, Jiayuan Ding, Yozen Liu, Jiliang Tang, and Neil Shah. Empowering graph rep- resentation learning with test-time graph transformation. arXiv preprint arXiv:2210.03561,

  10. [10]

    Semi-Supervised Classification with Graph Convolutional Networks

    [Kipf, 2016] TN Kipf. Semi-supervised classification with graph convolutional networks.arXiv preprint arXiv:1609.02907,

  11. [11]

    Graph convolutional networks with motif-based attention

    [Leeet al., 2019 ] John Boaz Lee, Ryan A Rossi, Xiangnan Kong, Sungchul Kim, Eunyee Koh, and Anup Rao. Graph convolutional networks with motif-based attention. InPro- ceedings of the 28th ACM international conference on in- formation and knowledge management, pages 499–508,

  12. [12]

    Dense- flow: Spotting cryptocurrency money laundering in ethereum transaction graphs

    [Linet al., 2024 ] Dan Lin, Jiajing Wu, Yunmei Yu, Qishuang Fu, Zibin Zheng, and Changlin Yang. Dense- flow: Spotting cryptocurrency money laundering in ethereum transaction graphs. InProceedings of the ACM Web Conference 2024, pages 4429–4438,

  13. [13]

    Arc: A generalist graph anomaly detector with in-context learning.Advances in Neural Information Processing Systems, 37:50772–50804,

    [Liuet al., 2024 ] Yixin Liu, Shiyuan Li, Yu Zheng, Qingfeng Chen, Chengqi Zhang, and Shirui Pan. Arc: A generalist graph anomaly detector with in-context learning.Advances in Neural Information Processing Systems, 37:50772–50804,

  14. [14]

    Sa- lom: Structure aware temporal graph networks with long- short memory updater.Advances in Neural Information Processing Systems, 38:22843–22871,

    [Liuet al., 2026 ] Hanwen Liu, Longjiao Zhang, Rui Wang, Tongya Zheng, Sai Wu, Chang Yao, and Mingli Song. Sa- lom: Structure aware temporal graph networks with long- short memory updater.Advances in Neural Information Processing Systems, 38:22843–22871,

  15. [15]

    When crypto economics meet graph analytics and learning

    [Luo, 2024] Bingqiao Luo. When crypto economics meet graph analytics and learning. InCompanion Proceed- ings of the ACM Web Conference 2024, pages 1186–1189,

  16. [16]

    Motifnet: a motif-based graph con- volutional network for directed graphs

    [Montiet al., 2018 ] Federico Monti, Karl Otness, and Michael M Bronstein. Motifnet: a motif-based graph con- volutional network for directed graphs. In2018 IEEE data science workshop (DSW), pages 225–228. IEEE,

  17. [17]

    arXiv preprint arXiv:2410.14886 , year=

    [Niuet al., 2024 ] Chaoxi Niu, Hezhe Qiao, Changlu Chen, Ling Chen, and Guansong Pang. Zero-shot general- ist graph anomaly detection with unified neighborhood prompts.arXiv preprint arXiv:2410.14886,

  18. [18]

    Representation Learning with Contrastive Predictive Coding

    [Oordet al., 2018 ] Aaron van den Oord, Yazhe Li, and Oriol Vinyals. Representation learning with contrastive predic- tive coding.arXiv preprint arXiv:1807.03748,

  19. [19]

    Motifs in temporal networks

    [Paranjapeet al., 2017 ] Ashwin Paranjape, Austin R Ben- son, and Jure Leskovec. Motifs in temporal networks. In Proceedings of the tenth ACM international conference on web search and data mining, pages 601–610,

  20. [20]

    Tracing cryptocurrency scams: Clustering replicated advance-fee and phishing websites

    [Phillips and Wilder, 2020] Ross Phillips and Heidi Wilder. Tracing cryptocurrency scams: Clustering replicated advance-fee and phishing websites. In2020 IEEE in- ternational conference on blockchain and cryptocurrency (ICBC), pages 1–8. IEEE,

  21. [21]

    Blockchain data mining with graph learning: A survey.IEEE Transactions on Pattern Analysis and Machine Intelligence, 46(2):729–748,

    [Qiet al., 2023 ] Yuxin Qi, Jun Wu, Hansong Xu, and Mohsen Guizani. Blockchain data mining with graph learning: A survey.IEEE Transactions on Pattern Analysis and Machine Intelligence, 46(2):729–748,

  22. [22]

    Gadbench: Revisiting and bench- marking supervised graph anomaly detection.Advances in Neural Information Processing Systems, 36:29628–29653,

    [Tanget al., 2023 ] Jianheng Tang, Fengrui Hua, Ziqi Gao, Peilin Zhao, and Jia Li. Gadbench: Revisiting and bench- marking supervised graph anomaly detection.Advances in Neural Information Processing Systems, 36:29628–29653,

  23. [23]

    Cola: Cross-city mobility transformer for human trajectory simulation

    [Wanget al., 2024a ] Yu Wang, Tongya Zheng, Yuxuan Liang, Shunyu Liu, and Mingli Song. Cola: Cross-city mobility transformer for human trajectory simulation. In Proceedings of the ACM on Web Conference 2024, pages 3509–3520,

  24. [24]

    Weber, G

    [Weberet al., 2019 ] Mark Weber, Giacomo Domeniconi, Jie Chen, Daniel Karl I Weidele, Claudio Bellei, Tom Robin- son, and Charles E Leiserson. Anti-money laundering in bitcoin: Experimenting with graph convolutional networks for financial forensics.arXiv preprint arXiv:1908.02591,

  25. [25]

    Conditional negative sampling for contrastive learning of visual representations

    [Wuet al., 2020 ] Mike Wu, Milan Mosse, Chengxu Zhuang, Daniel Yamins, and Noah Goodman. Conditional negative sampling for contrastive learning of visual representations. arXiv preprint arXiv:2010.02037,

  26. [26]

    Pulling off the mask: Forensic analysis of the deceptive creator wallets behind smart contract fraud

    [Yaoet al., 2024 ] Mingxuan Yao, Runze Zhang, Haichuan Xu, Shih-Huan Chou, Varun Chowdhary Paturi, Amit Ku- mar Sikder, and Brendan Saltaformaggio. Pulling off the mask: Forensic analysis of the deceptive creator wallets behind smart contract fraud. In2024 IEEE Symposium on Security and Privacy (SP), pages 2236–2254. IEEE,

  27. [27]

    Towards better dynamic graph learning: New architec- ture and unified library.Advances in Neural Information Processing Systems, 36:67686–67700,

    [Yuet al., 2023 ] Le Yu, Leilei Sun, Bowen Du, and Weifeng Lv. Towards better dynamic graph learning: New architec- ture and unified library.Advances in Neural Information Processing Systems, 36:67686–67700,

  28. [28]

    Phishing detection on ethereum via learning representa- tion of transaction subgraphs

    [Yuanet al., 2020 ] Zihao Yuan, Qi Yuan, and Jiajing Wu. Phishing detection on ethereum via learning representa- tion of transaction subgraphs. InInternational conference on blockchain and trustworthy systems, pages 178–191. Springer,

  29. [29]

    A fully test-time training framework for semi-supervised node classification on out-of-distribution graphs.ACM Transactions on Knowledge Discovery from Data, 18(7):1–19,

    [Zhanget al., 2024 ] Jiaxin Zhang, Yiqi Wang, Xihong Yang, and En Zhu. A fully test-time training framework for semi-supervised node classification on out-of-distribution graphs.ACM Transactions on Knowledge Discovery from Data, 18(7):1–19,

  30. [30]

    Test- time adaptation on graphs via adaptive subgraph-based se- lection and regularized prototypes

    [Zhaoet al., 2025 ] Yusheng Zhao, Qixin Zhang, Xiao Luo, Junyu Luo, Wei Ju, Zhiping Xiao, and Ming Zhang. Test- time adaptation on graphs via adaptive subgraph-based se- lection and regularized prototypes. InForty-second Inter- national Conference on Machine Learning,

  31. [31]

    Real- time intelligent big data processing: technology, platform, and applications.Science China Information Sciences, 62(8):82101,

    [Zhenget al., 2019 ] Tongya Zheng, Gang Chen, Xinyu Wang, Chun Chen, Xingen Wang, and Sihui Luo. Real- time intelligent big data processing: technology, platform, and applications.Science China Information Sciences, 62(8):82101,

  32. [32]

    Temporal aggregation and propagation graph neural networks for dynamic represen- tation.IEEE Transactions on Knowledge and Data Engi- neering, 35(10):10151–10165,

    [Zhenget al., 2023 ] Tongya Zheng, Xinchao Wang, Zunlei Feng, Jie Song, Yunzhi Hao, Mingli Song, Xingen Wang, Xinyu Wang, and Chun Chen. Temporal aggregation and propagation graph neural networks for dynamic represen- tation.IEEE Transactions on Knowledge and Data Engi- neering, 35(10):10151–10165,

  33. [33]

    Test-time graph neural dataset search with generative projection

    [Zhenget al., 2025 ] Xin Zheng, Wei Huang, Chuan Zhou, Ming Li, and Shirui Pan. Test-time graph neural dataset search with generative projection. InForty-second Inter- national Conference on Machine Learning,

  34. [34]

    Behavior-aware account de-anonymization on ethereum interaction graph

    [Zhouet al., 2022 ] Jiajun Zhou, Chenkai Hu, Jianlei Chi, Ji- ajing Wu, Meng Shen, and Qi Xuan. Behavior-aware account de-anonymization on ethereum interaction graph. IEEE Transactions on Information Forensics and Security, 17:3433–3448,

  35. [35]

    Be- yond homophily in graph neural networks: Current limita- tions and effective designs.Advances in neural informa- tion processing systems, 33:7793–7804,

    [Zhuet al., 2020 ] Jiong Zhu, Yujun Yan, Lingxiao Zhao, Mark Heimann, Leman Akoglu, and Danai Koutra. Be- yond homophily in graph neural networks: Current limita- tions and effective designs.Advances in neural informa- tion processing systems, 33:7793–7804,

  36. [36]

    arXiv preprint arXiv:2412.00020 , year=

    [Zhuoet al., 2024 ] Wei Zhuo, Zemin Liu, Bryan Hooi, Bing- sheng He, Guang Tan, Rizal Fathony, and Jia Chen. Parti- tioning message passing for graph fraud detection.arXiv preprint arXiv:2412.00020, 2024