Research map / Adversarial robustness and security / Attacks on text and graphs
Self-supervised Adversarial Purification for Graph Neural Networks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes GPR-GAE, a self-supervised graph auto-encoder purifier using multiple GPR filters and multi-step purification to defend GNN classifiers against structural adversarial attacks.
Problem
Adversarial training couples accuracy and robustness in one classifier, limiting both; existing purification methods rely on heuristics or classifier-dependent edge detection and are vulnerable to adaptive attacks.
Approach
Decouple robustness into a separate self-supervised graph auto-encoder purifier (GPR-GAE) trained to reconstruct clean graphs from randomly perturbed graphs, using multiple GPR filters with learnable coefficients for multi-scale structure, and apply iterative multi-step purification before a standard GNN classifier.
Key results
- On Cora under adaptive PRBCD attack with epsilon 0.5, GPR-GAE on vanilla GPRGNN reaches 64.2% vs 48.5% for adversarially trained GPRGNN.
- Under non-adaptive PRBCD transfer attack on Pubmed (eps 0.5), GPR-GAE_GCN_Vanilla gets 72.0% vs 68.9% for GOOD-AT and 68.5%-ish range for other baselines.
- Empirical local Lipschitz constants across six datasets are all below 1 (0.2788 to 0.4587), supporting the convergence claim.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add GPR-GAE purification to GPRGNN instead of using adversarial training (PRBCD) | GPRGNN on Cora · Cora, PRBCD ε=0.5 | accuracy: 48.5% -> 64.2% (+15.7 percentage points) | Helped |
| Add GPR-GAE purification to vanilla GCN | GCN on Citeseer · Citeseer, PRBCD ε=0.5 transfer attack | accuracy | Helped |
| Add GPR-GAE purification to vanilla GCN | GCN on Pubmed · Pubmed, PRBCD ε=0.5 transfer attack | accuracy | Helped |
| Add GPR-GAE purification to vanilla GCN | GCN on OGB-arXiv · OGB-arXiv, PRBCD ε=0.5 transfer attack | accuracy | Helped |
| Remove multi-step purification and discretize edges at threshold 0.1 (ablation) | GPR-GAE with vanilla GCN · Citeseer, clean and PRBCD ε=0.5 transfer attack | accuracy | Mixed |
| Replace GPR filters with a two-layer GCN node encoder (ablation) | GPR-GAE with vanilla GCN · Citeseer, clean and PRBCD ε=0.5 transfer attack | accuracy | Hurt |
| Add self-loops to the normalized adjacency matrix (ablation) | GPR-GAE with vanilla GCN · Citeseer, clean and PRBCD ε=0.5 transfer attack | accuracy | Hurt |
| Remove edge reweighting from purifier training perturbations (ablation) | GPR-GAE with vanilla GCN · Citeseer, clean and PRBCD ε=0.5 transfer attack | accuracy | Hurt |
| Reduce edge injection ratio p from 1.5 to 0.5 (ablation) | GPR-GAE with vanilla GCN · Citeseer, clean and PRBCD ε=0.5 transfer attack | accuracy | Hurt |
| Reduce GPR filter order K from 7 to 2 (ablation) | GPR-GAE with vanilla GCN · Citeseer, clean and PRBCD ε=0.5 transfer attack | accuracy | Hurt |
| Use multi-step purification instead of single-step purification (ablation) | GPR-GAE on Cora · Cora, attacked graph | accuracy | Helped |
Surprising findings
- Adaptive-attack results show GPR-GAE robustness correlates more with the base classifier's clean accuracy than with GNN architecture or self-training.
- The Margin attack loss was more effective than the tanhMargin loss used in prior work when attacking GPR-GAE.
Limitations
- Adaptive gradient-based attacks on GPR-GAE are memory-intensive and unscalable, so OGB-arXiv is evaluated only under transfer attacks.
- Convergence guarantee relies on an assumed local Lipschitz condition that is only empirically checked.
- Robust GNNs such as EvenNet and SoftMedianGDC achieve higher clean accuracy than GPR-GAE-based models in some settings.
Experimental setup
Datasets: Cora Cora-ML Citeseer Pubmed OGB-arXiv Chameleon
Benchmarks: Cora Cora-ML Citeseer Pubmed OGB-arXiv Chameleon
Metrics: test accuracy empirical Lipschitz constant
Baselines: GCN GAT GPRGNN APPNP EvenNet SoftMedianGDC Jaccard-GCN SVD-GCN GOOD-AT
Builds on: GPRGNN adversarial training GOOD-AT APPNP PRBCD
Closest papers by meaning
- Graph Adversarial Self-Supervised Learning (NeurIPS 2021 · similarity 0.88)
- Adversarial Contrastive Graph Masked AutoEncoder Against Graph Structure and Feature Dual Attacks (AAAI 2025 · similarity 0.86)
- Adversarial Training on Purification (AToP): Advancing Both Robustness and Generalization (ICLR 2024 · similarity 0.86)
- If You Want to Be Robust, Be Wary of Initialization (NeurIPS 2024 · similarity 0.86)
- Value at Adversarial Risk: A Graph Defense Strategy against Cost-Aware Attacks (AAAI 2024 · similarity 0.86)
- Adversarial Robust Generalization of Graph Neural Networks (ICML 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.