SAGA: Synthetic Agentic Graph Architecture for Temporal Benchmark Generation

arXiv:2607.17288 · cs.DB, cs.AI · Submitted 2026-07-19 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: Hi, I'm Tom.

Jane: And I'm Jane, here with Lu, Meng and our in-house large language model, Lalam.

Tom: We're looking at the paper: "SAGA: Synthetic Agentic Graph Architecture for Temporal Benchmark Generation".

Jane: Here's the gist of the paper. The gist: SAGA introduces Synthetic Agentic Graph Architecture for Temporal Benchmark Generation, a system designed to generate large-scale, semantically rich temporal graphs with ground-truth anomaly labels in a unified framework.

Tom: How it works SAGA employs a four-phase pipeline that decouples structure from semantics through its Skeleton-First, Semantics-Second architecture (S) an O(1)-per-edge skeleton generator produces power-law graphs (A) a dispatcher partitions causally ordered time blocks for parallel execution (G) LLM agents inject domain semantics using RAG-based rule bases across four domains and (A) a state alignment engine resolves conflicts via temporal replay, yielding anomaly labels as natural byproducts.

Jane: Temporal Graph Model The SAGA system generates a temporal attributed graph G = (V, E, T), where each edge carries a timestamp t i, a domain-specific attribute vector a i, and a ground-truth label l i ∈ normal ∪ Anomaly.

Tom: Time is organized in three user-configurable layers: time span Δ (e.g., 1 year) > macro-block granularity B (e.g., 1 day, yielding K = ⌈Δ/B⌉ blocks) > micro-timestamp precision δ (e.g., 1 minute).

Title and authors: Jane: The paper introduces SAGA as a system designed to generate large-scale temporal graphs with rich semantics and ground-truth anomaly labels in a unified framework. It tackles the scarcity of high quality benchmarks that have both realistic structure and real anomaly data for training graph neural networks.

Lu: They present a four-phase pipeline where the Skeleton-First, Semantics-Second architecture decouples structure from semantics, meaning you build the graph shape first before injecting the specific domain knowledge later.

Meng: The system uses an O(one) per edge skeleton generator to produce power-law graphs, which gives it that realistic network structure, and then LLM agents inject the semantics using RAG-based rule bases across four different domains.

Lalam: And finally, they have a state alignment engine that resolves conflicts via temporal replay to yield anomaly labels as natural byproducts of the process rather than something you have to manually annotate.

The paper's summary: Tom: We know SAGA is a system for generating graphs with labeled anomalies from a four-phase pipeline, so what are the specific improvements they point out in this SAGA architecture?

Jane: They focus on the improvements in three main areas. First, they have that Skeleton-First, Semantics-Second architecture which combines O(one) per edge structure generation with parallel LLM semantic injection.

Lu: That structural realism combined with embedding domain knowledge via RAG rule bases is a big improvement over purely structural generators or just using an LLM to generate everything from scratch. It gives the graph shape fidelity and the data meaning simultaneously.

Meng: I see the improvement in conflict-as-feature mechanism producing ground-truth anomaly labels without manual annotation; that’s huge because annotation costs are what keep these benchmarks scarce. That feature creates the labels automatically during replay, which saves a ton of human effort.

Lalam: They also have four pluggable RAG rule bases that let you switch domains, like Finance and AML or Network and IDS, with zero code changes, which makes it much more flexible for different kinds of data. You can just swap out the rules.

The paper's improvements: Tom: Let’s drill into those improvements a bit more. What does the paper say about how flexible this system is for users?

Jane: One big improvement is the domain flexibility, where they show you can define entirely new scenarios, like IoT networks or supply chains, just by pasting domain rules in natural language. It's not locked into the four built-in domains.

Lu: The LLM then takes that text and automatically extracts ten to twenty typed parameters with sensible defaults and valid ranges, which lowers the barrier for non-expert users to configure things. You don't need deep domain expertise to set up a benchmark; you just describe what you want.

Meng: That parameter inference feature is interesting because it means you don't need deep domain expertise to set up a benchmark; you just describe what you want. It simplifies the setup process significantly for production use cases.

Lalam: And they also have this deterministic Mock mode that bypasses all the LLM calls entirely, generating five hundred thousand edges with full structural annotations in thirty seconds for quick prototyping and testing. This is useful for fast CI testing without waiting on slow model inference.

Conclusion: Tom: So to wrap up, SAGA is a system that creates large-scale temporal graphs with ground-truth anomaly labels by separating structure generation from semantic injection using LLMs and rule bases. What’s the final word on what this means for our field?

Jane: It means we can finally generate high quality temporal benchmarks that have the semantic richness needed for training better graph neural networks without spending massive amounts of money on manual labeling. We get the structure right and the labels right at once.

Lu: The fact that it achieves exact structural targets with realistic graph properties, and precise control over anomaly rates independent of LLM variance, is what makes this system valuable for creating reproducible datasets. It moves us closer to truly reproducible benchmarks for complex systems.

Meng: From a deployment standpoint, the linear scalability to hundreds of thousands of edges on a single GPU shows this isn't just a proof-of-concept that dies when you try to scale up. It actually stays scalable for large production tasks.

Lalam: It really demonstrates that treating logical conflicts between independent LLM agents as features naturally produces ground-truth anomaly labels, which is a very clean way to get the hard data we need for training models. This whole SAGA architecture is a lot of interesting stuff.

Jiacheng Ding, Xiaofei Zhang

University of Memphis

cs.DB, cs.AI

Submitted: 2026-07-19

Updated: 2026-07-19

Journal ref: Proceedings of the VLDB Endowment, 19(12): 4834-4837, 2026

DOI: 10.14778/3827998.3828134

Code: https://github.com/graphuofm/SAGA

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Importance score: 92/100

The gist: The gist: SAGA introduces Synthetic Agentic Graph Architecture for Temporal Benchmark Generation, a system designed to generate large-scale, semantically rich temporal graphs with ground-truth

Key concepts

Skeleton-First, Semantics-Second architecture: This approach separates the creation of the graph's basic structure (skeleton) from adding meaningful context (semantics). The skeleton generator creates a power-law graph shape efficiently, while LLM agents later inject domain knowledge and rules onto these structures.
Conflict-Driven Anomaly Labeling: Instead of manually labeling data, SAGA generates labels by checking if generated edges violate defined domain rules during a temporal replay. When an edge violates a rule (e.g., a transaction is illegal), it triggers an anomaly label, creating ground truth automatically.
RAG-based Rule Bases: These are pluggable knowledge bases that provide domain-specific constraints for the graph generation process. They contain attribute distributions, temporal density functions, and validation predicates that define what constitutes 'normal' or 'anomalous' behavior for specific fields like finance or network traffic.
Temporal Graph Model: The system models time explicitly in the graph by organizing it into three layers: a large time span ($\Delta$), macro-blocks ($B$), and micro-timestamps ($\delta$). Edges carry timestamps, domain attributes, and ground-truth labels, allowing for precise temporal analysis.

Terminology

Benchmark — 2× in this paper · explained in 2 episodes
Generator — 2× in this paper · explained in 2 episodes
Synthetic Agentic Graph Architecture — 2× in this paper
Clustering — 1× in this paper · explained in 2 episodes
RAG — 1× in this paper · explained in 3 episodes
Unified Framework — 1× in this paper · explained in 6 episodes

Summary

The gist: SAGA introduces Synthetic Agentic Graph Architecture for Temporal Benchmark Generation, a system designed to generate large-scale, semantically rich temporal graphs with ground-truth anomaly labels in a unified framework.

How it works

SAGA employs a four-phase pipeline that decouples structure from semantics through its Skeleton-First, Semantics-Second architecture (S) an O(1)-per-edge skeleton generator produces power-law graphs (A) a dispatcher partitions causally ordered time blocks for parallel execution (G) LLM agents inject domain semantics using RAG-based rule bases across four domains and (A) a state alignment engine resolves conflicts via temporal replay, yielding anomaly labels as natural byproducts.

Temporal Graph Model

The SAGA system generates a temporal attributed graph G = (V, E, T), where each edge carries a timestamp t i, a domain-specific attribute vector a i, and a ground-truth label l i ∈ normal ∪ Anomaly. Time is organized in three user-configurable layers: time span Δ (e.g., 1 year) > macro-block granularity B (e.g., 1 day, yielding K = ⌈Δ/B⌉ blocks) > micro-timestamp precision δ (e.g., 1 minute). The graph topology follows a power-law degree distribution via Barabási-Albert preferential attachment with configurable exponent γ ∈ [1.5, 3.5], implemented through igraph’s C-core at O(1) per edge.

Domain Semantics & Rule Bases

Domain knowledge enters SAGA through pluggable RAG rule bases. Each rule base RD specifies three components: (i) attribute distributions (e.g., log-normal amounts for finance [7], bimodal packet sizes for network traffic [2]); (ii) temporal density functions that shape micro-timestamps within each block (e.g., 70% business-hour weight for finance); and (iii) validation predicates Φ = Σphi1,..., phir defining legal transactions. Four built-in rule bases cover Finance/AML [7, 10] (12 anomaly triggers), Network/IDS [2] (8 attack categories), Cyber/APT [18] (14 ATT&CK phases), and Traffic [14] (Krauss car-following model). Users can also define new domains by pasting rules in natural language; the LLM infers 10–25 typed parameters with defaults.

Conflict-Driven Anomaly Labeling

Ground-truth labels arise from validating generated edges against the domain rules during replay, rather than from manual annotation. When an agent processes a task in block k, its view of node v is ˆS k (v) = (f settled edges in blocks 1…k−1 if settled, UNKNOWN otherwise). The alignment engine replays all micro-edges in global timestamp order and evaluates each against the true state S t i: l i = (normal if ∀phij ∈Φ: phij (e i, S t i) = 1 anomaly typej if ∃phij: phij (e i, S t i) = 0). Repeated violations escalate risk; exceeding θfreeze freezes the account, causing all downstream edges to fail—producing cascading anomaly chains that mirror real-world fraud propagation [10].

Key Contributions and Evaluation

The main contributions include (1) A SkeletonFirst, Semantics-Second architecture combining O(1)-per-edge structure generation with parallel LLM semantic injection, (2) A conflict-as-feature mechanism producing ground-truth anomaly labels without manual annotation, (3) Four pluggable RAG rule bases enabling domain-switching with zero code changes, and (4) An interactive demo with real-time pipeline visualization, multi-domain parameter tuning, and runtime event injection. Evaluation showed that SAGA achieves exact structural targets with realistic graph properties, precise and deterministic control over anomaly rates independent of LLM variance, and linear scalability to hundreds of thousands of edges on a single GPU.

Scalability and Control

Generation time scales linearly with edge count; on a single H100 with vLLM continuous batching at 256 concurrency, SAGA generates 500,000 edges in 89 minutes. The bottleneck is LLM inference in Phase G, which accounts for over 99% of wall time at scales above 1K nodes. SAGA achieves exact anomaly-rate control by decoupling anomaly selection from edge generation, matching the target exactly across six target rates regardless of LLM output variance. A deterministic Mock mode bypasses LLM calls entirely, generating 500K edges with full structural annotations in 30 seconds for rapid prototyping and CI testing.

Conclusion

SAGA demonstrates that treating logical conflicts between independent LLM agents as features naturally produces ground-truth anomaly labels. The pluggable RAG architecture enables domain-switching with zero engine changes, and LLM-driven parameter inference lowers the barrier for non-expert users. In the future, we will enable the support of adaptive feedback loops where settlement results inform subsequent agent prompts, and temporal graph learning along generation.

Reference

PVLDB Reference Format: Jiacheng Ding and Xiaofei Zhang. SAGA: Synthetic Agentic Graph Architecture for Temporal Benchmark Generation. PVLDB, 19(12): XXX-XXX, 2026. doi:XX.XX/XXX.XX

PVLDB Artifact Availability: The source code, data, and other artifacts have been made available at https://github.com/graphuofm/SAGA.

--- Page 1 ---

SAGA: Synthetic Agentic Graph Architecture for Temporal Benchmark Generation Jiacheng Ding jding2@memphis.edu University of Memphis Memphis, Tennessee, USA Xiaofei Zhang xiaofei.zhang@memphis.edu University of Memphis Memphis, Tennessee, USA Abstract High quality temporal graph benchmarks with rich semantics and ground-truth anomaly labels are essential for training graph neural networks, yet remain scarce due to privacy constraints and annotation costs We present SAGA (Synthetic Agentic Graph Architecture), a system for generating large-scale, semantically rich temporal graphs via a four-phase pipeline. Our Skeleton-First, Semantics-Second architecture decouples structure from semantics: (S) an O(1)-per-edge skeleton generator produces power-law graphs; (A) a dispatcher partitions causally ordered time blocks for parallel execution; (G) LLM agents inject domain semantics using RAG-based rule bases across four domains; and (A) a state alignment engine resolves conflicts via temporal replay, yielding anomaly labels as natural byproducts. Unlike structural generators (e.g., LDBC SNB, Kronecker/R-MAT) or purely LLM-based approaches, SAGA achieves structural realism, semantic richness, and automatic anomaly labeling in a unified framework. On a single H100 GPU with vLLM batching, SAGA generates 500,000 temporal edges with controlled anomalies in under 90 minutes, scaling to 100,000 nodes while maintaining clustering coefficients above 2.99. The system supports real-time pipeline visualization, interactive multi-domain tuning (Finance/AML, Network/IDS, Cyber/APT, Transportation), and a CLI for large-scale GPU-based experiments.

Improvements for AI systems

Improve temporal graph generation by using a Skeleton-First, Semantics-Second architecture that decouples structure from semantics, which allows for structural realism, semantic richness, and automatic anomaly labeling in a unified framework. This enables the creation of large-scale graphs with power-law degree distributions while simultaneously embedding domain knowledge via RAG rule bases.
Enhance anomaly detection capabilities by implementing a conflict-as-feature mechanism producing ground-truth anomaly labels without manual annotation. The system can automatically generate labels like overdrafts, frozen-account attempts, structuring patterns by validating generated edges against domain rules during replay, thus providing ground truth annotations without manual effort.
Increase domain flexibility by utilizing Four pluggable RAG rule bases enabling domain-switching with zero code changes. This means the system can switch between domains like Finance/AML and Network/IDS simply by selecting a new rule base, which allows users to define new scenarios in natural language and have the LLM automatically infer parameters.
Improve user accessibility by leveraging LLM-driven parameter inference so that users do not need domain expertise to configure the system. The system can generate 10–25 typed parameters with defaults when a user pastes natural language rules, lowering the barrier for non-expert users to create complex benchmarks.
Increase scalability and speed by using a deterministic Mock mode that bypasses LLM calls entirely, producing 500K edges with full structural annotations in 30 seconds. This allows for rapid prototyping and CI testing of large graph generation tasks without the latency associated with live LLM inference.