Research map / Adversarial robustness and security / Attacks on text and graphs

Refine then Classify: Robust Graph Neural Networks with Reliable Neighborhood Contrastive Refinement

AAAI 2025 · Adversarial robustness and security › Attacks on text and graphs · approach: Graph neural network robustness · 4 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes GRANCE, a refine-then-classify defense for GNNs that uses semantic-based graph pre-processing, dual (topological and semantic) neighborhood contrastive learning with a learned reliability estimator, and an improved GNN classifier with adaptive smoothing/sharpening to resist structural attacks.

Problem

Structural adversarial attacks (e.g., Mettack, PGD, Nettack) on graph edges mislead GNN predictions; existing GCL-based refine-then-classify defenses rely on global-local contrastive strategies that distort feature geometry and miss local attack effects.

Approach

Replace global-local mutual-information contrast with a local dual-neighborhood contrastive objective over clean and perturbed views (views built by semantic edge completion and strong/slight edge cutting), weight neighbors by a learned reliability estimator (soft clustering), and classify with a GNN whose reweighting factors allow negative messages (Laplacian sharpening).

Key results

• On Cora under Mettack poisoning at 25% perturbation, GRANCE reaches 80.30% accuracy versus 78.48% for STABLE.
• On Citeseer under Mettack poisoning at 25%, GRANCE reaches 73.79% vs 72.86% for STABLE.
• On BlogCatalog under Mettack poisoning at 25%, GRANCE reaches 88.55% vs 70.80% for STABLE.

Measured effects reported in the paper

Surprising findings

• Global-local contrastive learning (STABLE) changed 73.1% of nearest neighbors on Cora at 25% attack rate.
• The global representation from STABLE's average readout hardly changes as attack rate increases, suggesting it fails to capture structural attacks.

Limitations

• Only first-order neighbors are considered.
• Evaluated mainly on small citation and BlogCatalog graphs with a fixed set of attacks.

Experimental setup

Datasets: Cora Citeseer Cora-ML BlogCatalog

Benchmarks: Cora Citeseer Cora-ML BlogCatalog

Metrics: node classification accuracy

Baselines: GCN GAT RGCN Jaccard Pro-GNN SimPGCN ElasticGNN STABLE Mid-GCN GraphRSP

Builds on: STABLE InfoNCE GCN Jaccard defense

Closest papers by meaning

• Bounding the Expected Robustness of Graph Neural Networks Subject to Node Feature Attacks (ICLR 2024 · similarity 0.89)
• Adversarial Robust Generalization of Graph Neural Networks (ICML 2025 · similarity 0.88)
• If You Want to Be Robust, Be Wary of Initialization (NeurIPS 2024 · similarity 0.88)
• On the Stability of Graph Convolutional Neural Networks: A Probabilistic Perspective (NeurIPS 2025 · similarity 0.88)
• Adversarial Contrastive Graph Masked AutoEncoder Against Graph Structure and Feature Dual Attacks (AAAI 2025 · similarity 0.87)
• Making Classic GNNs Strong Baselines Across Varying Homophily: A Smoothness–Generalization Perspective (NeurIPS 2025 · similarity 0.87)