Research map / Graph learning / GNN architectures
When Witnesses Defend: A Witness Graph Topological Layer for Adversarial Graph Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Witness Graph Topological Layer (WGTL), which uses witness-complex persistent-homology local and global encodings plus a topological loss regularizer to make GNNs more robust to graph poisoning attacks, with stability guarantees.
Problem
GNNs are vulnerable to structural adversarial attacks (e.g., Mettack, Nettack, PGD), and existing defenses rely on pairwise node-level relations and ignore higher-order topology; topological features have not been used for adversarial defense on graphs.
Approach
Use landmark-based witness complexes to compute local (per-node epsilon-cover) and global persistent-homology encodings as prior features, aggregate them with GNN embeddings via attention, and regularize training with a persistence-based topological loss, with stability bounds under an attacker budget.
Key results
- On Cora-ML under 10% Mettack, GCN+GNNGuard+WGTL reaches 79.96% vs 69.13% for GCN+GNNGuard.
- GraphSAGE+WGTL reaches 81.19% vs 70.92% for GraphSAGE on Cora-ML under 10% Mettack.
- On OGBN-arXiv under 10% PRBCD, GCN+WGTL_P gets 22.89% vs 21.56% for GCN.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add WGTL to Pro-GNN | Pro-GNN · Cora-ML under mettack, 0%, 5%, and 10% perturbation | accuracy: 82.98±0.23 -> 83.85±0.38; 80.14±1.34 -> 81.90±0.73; 71.59±1.33 -> 72.51±0.76 | Helped |
| Add WGTL to GCN+GNNGuard | GCN+GNNGuard · Cora-ML under mettack, 0%, 5%, and 10% perturbation | accuracy: 83.21±0.34 -> 84.78±0.43; 76.57±0.50 -> 83.23±0.82; 69.13±0.77 -> 79.96±0.49 | Helped |
| Add WGTL to Pro-GNN | Pro-GNN · Citeseer under mettack, 0%, 5%, and 10% perturbation | accuracy: 72.34±0.99 -> 72.83±0.94; 68.96±0.67 -> 71.85±0.74; 67.36±1.12 -> 70.70±0.57 | Helped |
| Add WGTL to Pro-GNN | Pro-GNN · Pubmed under mettack, 0%, 5%, and 10% perturbation | accuracy: 87.33±0.18 -> 87.90±0.30; 87.25±0.09 -> 87.77±0.08; 87.20±0.12 -> 87.67±0.22 | Helped |
| Add WGTL to GCN+GNNGuard | GCN+GNNGuard · Polblogs under mettack, 0%, 5%, and 10% perturbation | accuracy: 95.03±0.25 -> 96.22±0.25; 73.25±0.16 -> 73.62±0.22; 72.76±0.75 -> 73.72±1.00 | Helped |
| Add WGTL to GCN | GCN · Cora-ML under mettack, 0%, 5%, and 10% perturbation | accuracy: 82.87±0.83 -> 83.83±0.55; 76.55±0.79 -> 78.63±0.76; 70.39±1.28 -> 73.41±0.82 | Helped |
| Add WGTL to GAT | GAT · Cora-ML under mettack, 0%, 5%, and 10% perturbation | accuracy: 84.25±0.67 -> 86.07±2.10; 79.88±1.09 -> 80.80±0.87; 72.63±1.56 -> 75.80±0.79 | Helped |
| Add WGTL to GCN | GCN · Polblogs under mettack, 0%, 5%, and 10% perturbation | accuracy: 94.40±1.47 -> 95.95±0.15; 71.41±2.42 -> 74.62±0.42; 69.16±1.86 -> 72.84±0.86 | Helped |
| Use WGTL features computed from the poisoned graph | GCN · OGBN-arXiv under PRBCD, 0% and 10% perturbation | accuracy: 27.33 -> 28.32; 21.56 -> 22.89 | Helped |
| Add WGTL to SimP-GCN | SimP-GCN · Cora-ML under mettack, 0%, 5%, and 10% perturbation | accuracy: 79.52±1.81 -> 81.49±0.52; 74.75±1.40 -> 76.65±0.65; 70.87±1.70 -> 72.88±0.83 | Helped |
| Use WGTL with GCN+GNNGuard on Pubmed | GCN+GNNGuard · Pubmed under mettack | accuracy | Mixed |
| Use WGTL with SimP-GCN on Pubmed | SimP-GCN · Pubmed under mettack | accuracy | Mixed |
Surprising findings
- Pro-GNN+WGTL and SimP-GCN+WGTL could not run on Pubmed (out of memory) for GNNGuard+WGTL and SimP-GCN+WGTL.
Limitations
- Global topological feature computation (BFS from landmarks) is the main cost, and GNNGuard+WGTL and SimP-GCN+WGTL run out of memory on Pubmed.
- Gains on Polblogs (no node features) and under some attacks are smaller or inconsistent, e.g., Citeseer GNNGuard+WGTL at 10% is roughly equal to baseline.
Experimental setup
Datasets: Cora-ML Citeseer Pubmed Polblogs OGBN-arXiv Snap-patents
Benchmarks: Cora-ML Citeseer Pubmed Polblogs OGBN-arXiv Snap-patents
Metrics: node classification accuracy
Baselines: Pro-GNN GNNGuard SimP-GCN GCN GAT ChebNet GraphSAGE
Builds on: Pro-GNN GNNGuard SimP-GCN Mettack Nettack
Closest papers by meaning
- The Underappreciated Power of Vision Models for Graph Structural Understanding (NeurIPS 2025 · similarity 0.87)
- Adversarial Contrastive Graph Masked AutoEncoder Against Graph Structure and Feature Dual Attacks (AAAI 2025 · similarity 0.87)
- Topological Blindspots: Understanding and Extending Topological Deep Learning Through the Lens of Expressivity (ICLR 2025 · similarity 0.86)
- Refining Latent Homophilic Structures over Heterophilic Graphs for Robust Graph Convolution Networks (AAAI 2024 · similarity 0.86)
- Robust Graph Condensation via Classification Complexity Mitigation (NeurIPS 2025 · similarity 0.86)
- Weisfeiler and Lehman Go Paths: Learning Topological Features via Path Complexes (AAAI 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.