Unblackboxing the Foundational GCN-GRU Detector: Topology, Short-Term Patterns, and Long-Term History

AddGraph [1] is the foundational method for anomaly detection in dynamic graphs that combines a Graph Convolutional Network (GCN) for structural encoding with a contextual attention-based GRU for temporal integration. Despite its significance as the first and most widely cited GCN+GRU anomaly detection framework, AddGraph has not been equipped with any form of explainability. When AddGraph flags an edge as anomalous, it produces a score but no rationale: an analyst cannot determine whether the anomaly is driven by the current structural neighborhood, by a specific short-term temporal window, or by long-term historical memory encoded in the GRU. This opacity makes AddGraph operationally unusable in regulated environments where decisions must be justified. We present X-AddGraph, a post-hoc explainability framework for AddGraph, and to our knowledge the first for any GCN+GRU dynamic graph anomaly detection method. X-AddGraph introduces a three-component Dual Spatial-Temporal Attribution (DSTA) mechanism that simultaneously answers three distinct questions about every flagged anomaly: (1) Which structural neighbors in the current snapshot drove the anomaly score, via Integrated Gradients on the GCN adjacency mask? (2) Which short-term timestep in the attention window was most suspicious, via the CAB attention weights already computed during inference? (3) Which long-term historical snapshot contributed most to the GRU memory, via gradient backpropagation through GRU hidden states? The three attributions are combined into a unified anomaly explanation triplet per flagged edge. X-AddGraph is strictly posthoc: it requires no modification to AddGraph’s training, weights, or inference pipeline, adding only two targeted backward passes per flagged anomaly. We evaluate X-AddGraph on the UCI Message and Digg benchmark datasets, demonstrating that the spatial attribution is sufficient to reproduce anomaly decisions (Fidelity+ = 1.00) and that detection AUC is preserved exactly by post-hoc construction.