A new explanation layer finally makes StrGNN, the top dynamic graph anomaly detector, show its work.
StrGNN flags suspicious edges in constantly-changing graphs - a wire transfer, a login, a new connection - with nothing more than a numeric score, leaving analysts to trust the model on faith. A new system called X-StrGNN wraps the trained, frozen model and adds two forms of attribution to every flagged edge: which nearby interactions in the surrounding subgraph drove the decision, and which historical snapshot carried the signal. It works via masks that default to a neutral value when switched off, so it acts as an exact pass-through - the paper reports zero change in AUC, average precision, and precision at 100 compared to the unexplained model. Generating both attributions costs 0.66 milliseconds per edge, cheap enough to explain a full alarm list rather than a handful of spot-checks.
The researchers also ran a controlled comparison of attribution strategies - gradient attribution, per-instance mask optimization, and this amortized approach - under one protocol and budget. The amortized method won on stability while costing 268 times less than per-instance optimization, the most expensive strategy, which actually scored worse on temporal attribution than a random baseline. That combination, cheapest and most reliable, cuts against the usual assumption that explainability is a tax on either accuracy or compute budget.
It's still one paper's benchmark on one model, so treat exact preservation as a claim to be independently checked before any compliance team leans on these masks.