Research map / Graph learning / Graph self-supervised learning
Graph Adversarial Diffusion Convolution
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Graph Adversarial Diffusion Convolution (GADC), derived from a min-max (adversarial) reformulation of graph signal denoising with a Laplacian-distance perturbation, yielding a diffusion matrix with an extra feature-similarity term for robustness to structure attacks, feature noise, and heterophily.
Problem
Graph diffusion convolution architectures depend on the graph structure, so they are vulnerable to structure adversarial attacks, large node-feature noise on sparse graphs, and inconsistent edges on heterophilic graphs.
Approach
Formulate graph signal denoising as a min-max problem where an adversary perturbs the Laplacian within a Frobenius-norm ball; the inner maximization has a closed form, giving an extra feature-inner-product term added to the GDC transition matrix, which reweights or adds edges based on feature similarity.
Key results
- Under Mettack structure attacks at 75% perturbation on Citeseer, GADC (IV) reaches 65.25% vs 52.03% for STABLE, and on Pubmed at 25% it reaches 86.74% vs 83.98% for EvenNet.
- On Coauthor-CS with noise level 1, GADC (II) achieves 87.8% vs 81.7% for APPNP.
- On ogbn-products with noise level 1, GADC (III) achieves 73.66% vs 72.76% for GCN.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use GADC (IV) instead of the strongest listed baseline | graph classification under non-adaptive structural attacks · Citeseer and Pubmed, perturbation rates 25%, 50%, and 75% | test accuracy (%): 71.55 ± 0.89 vs 70.89 ± 0.71; 66.47 ± 0.99 vs 66.20 ± 0.87; 65.25 ± 0.69 vs 63.60 ± 1.71; 86.74 ± 0.21 vs 85.14 ± 0.34; | Helped |
| Use GADC (IV) instead of the strongest listed baseline | Cora under non-adaptive structural attacks · Cora, perturbation rates 25%, 50%, and 75% | test accuracy (%): 76.00 ± 0.61 vs 78.69 ± 0.50; 70.29 ± 0.82 vs 71.94 ± 0.69; 66.06 ± 0.66 vs 67.49 ± 1.06 | Hurt |
| Use GADC (IV) instead of the strongest listed baseline | adaptive structural attacks · Cora and Citeseer, evasion and poisoned test | test accuracy (%): 72.03 vs 67.05; 72.94 vs 66.50; 70.73 vs 56.81; 68.36 vs 58.18 | Helped |
| Use GADC (II) instead of the strongest listed baseline | feature denoising · Citeseer Gaussian noise 0.5 and Pubmed Gaussian noise 0.05 | test accuracy (%): 47.8 ± 2.4 vs 41.3 ± 6.8; 66.3 ± 2.9 vs 58.9 ± 14.3 | Helped |
| Use GADC (II) instead of APPNP | feature denoising · Coauthor-CS, Gaussian noise 1 | test accuracy (%): 87.8{$\pm$}1.5 vs 81.7{$\pm$2.0} | Helped |
| Use GADC (III) instead of GCN | feature denoising · ogbn-products, Gaussian noise 1 | test accuracy (%): 73.66{$\pm$}0.13 vs 72.76{$\pm$0.20} | Helped |
| Add the additional term by using ε≠0 instead of setting ε=0 (ablation) | GADC (II/III) · Cora, Gaussian noise 0.5 | test accuracy (%): 66.5 ± 5.1 -> 67.6 ± 3.3 | Helped |
| Add the additional term by using ε≠0 instead of setting ε=0 (ablation) | GADC (II/III) · Coauthor-CS, Gaussian noise 1.0 | test accuracy (%): 87.1 ± 3.1 -> 87.8 ± 1.5 | Helped |
| Add the feature-similarity term with ε=1.0 instead of ε=0 (ablation) | GADC (I) · Cornell, Texas, Wisconsin, and Actor heterophilic graphs | test accuracy (%): 74.8 ± 7.0 -> 76.9 ± 7.6; 74.9 {$\pm$ 6.1} -> 77.8 {$\pm$ 6.9}; 73.2 {$\pm$ 5.9} -> 78.2 {$\pm$ 6.5}; 34.35 {$\pm$ 1.35} | Mixed |
| Increase ε from 1.0 to 2.0 (ablation) | GADC (I) · Actor heterophilic graph | test accuracy (%): 34.51 {$\pm$ 1.41} -> 25.42 {$\pm$ 1.07} | Hurt |
Surprising findings
- Reassigning edge weights via the feature-similarity term improves denoising on large graphs even without adding new edges.
- The paper reports that GADC (IV) underperforms GNNGuard-style methods only in some settings, e.g. being slightly below GCN-Jaccard/STABLE at low attack rates on Cora (76.00 vs 78.69 for STABLE at 25%).
Limitations
- Replaces F with X in the closed-form solution as an approximation; the error analysis is on a single dataset (Cora).
- Several GADC variants are chosen per scenario (options I-IV), so the best variant depends on the task and is selected on validation data.
- Experiments on heterophilic graphs are only in the appendix and are small datasets.
Experimental setup
Datasets: Cora Citeseer Pubmed Coauthor-CS Coauthor-Phy ogbn-products Cornell Texas Wisconsin Actor
Benchmarks: Cora Citeseer Pubmed Coauthor-CS Coauthor-Phy ogbn-products Cornell Texas Wisconsin Actor
Metrics: test accuracy
Baselines: GCN GAT APPNP S2GC NAGphormer Pro-GNN GNNGuard STABLE EvenNet GCN-Jaccard GCN-SVD GLP
Builds on: APPNP S2GC GNNGuard adversarial training AirGNN
Closest papers by meaning
- Adaptive Diffusion in Graph Neural Networks (NeurIPS 2021 · similarity 0.90)
- Diffusion Improves Graph Learning (NeurIPS 2019 · similarity 0.89)
- Optimization-Induced Graph Implicit Nonlinear Diffusion (ICML 2022 · similarity 0.86)
- Adversarial Training for Graph Neural Networks: Pitfalls, Solutions, and New Directions (NeurIPS 2023 · similarity 0.86)
- Dissecting the Diffusion Process in Linear Graph Convolutional Networks (NeurIPS 2021 · similarity 0.86)
- On the Stability of Graph Convolutional Neural Networks: A Probabilistic Perspective (NeurIPS 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.