Frozen-Reference Graph Context for Inductive Network-Flow Anomaly Detection

We study inductive network-flow anomaly detection using a frozen training-only graph reference rather than edges among future observations. Category-conditioned random-projection retrieval yields 12 neighbors per query; cosine-weighted context and elementwise disagreement are inherited from the DAS-GNN disagreement-aware graph framework. We compare all-record and label-vetted benign reference banks, prototype shrinkage, and compact uniform-mean residual features. A fully executable study uses two independently generated realizations of 48,000 synthetic flows each, three neural seeds, validation-selected thresholds, LightGBM, and saved per-record predictions. On the first synthetic test set, uniform graph averaging obtains 0.9052 ROC-AUC, 0.8243 average precision and 0.7330 F1, versus 0.8737, 0.7683 and 0.6787 for a matched MLP. On the independent generator realization, its average precision is 0.8153 versus 0.7645 for the MLP. More elaborate disagreement and prototype variants do not consistently improve on simple averaging. The result is an auditable, strict-inductive method comparison rather than a claim of optimality or accuracy on recorded production traffic.