Research map / Graph learning / GNN architectures
A Simple and Yet Fairly Effective Defense for Graph Neural Networks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes NoisyGNN, which injects Gaussian noise into hidden states of GCN/GIN layers as a defense against structural and feature adversarial attacks, with theoretical robustness bounds and node-classification experiments.
Problem
Graph neural networks are vulnerable to small adversarial structural and feature perturbations; existing defenses are computationally expensive, require architectural changes, or hurt clean accuracy.
Approach
Inject Gaussian noise into hidden representations of selected GNN layers during training and inference, and derive upper bounds on adversarial risk (via Rényi/KL divergence of the probabilistic output) that decrease with the noise scale beta, giving a near-zero-overhead defense.
Key results
- Under Mettack at 10% perturbation on Cora, NoisyGCN reports 74.5% vs GNNGuard 74.7% and RGCN 70.7% (comparable rather than uniformly superior).
- On OGBN-Arxiv under PGD feature attack, NoisyGCN reaches 64.9% vs RGCN 63.6% and AirGNN 55.7%.
- Adding noise injection to GINGuard on Cora under Mettack at 25% raises accuracy from 61.8% to 66.2%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Inject noise into hidden states during training and inference | GCN on OGBN-Arxiv · OGBN-Arxiv, clean and feature attacks | accuracy: 65.1$\pm$1.8 -> 66.9$\pm$0.5; 63.8$\pm$1.9 -> 65.8$\pm$2.0; 63.0$\pm$2.4 -> 64.3$\pm$1.3; 63.6$\pm$0.7 -> 64.9$\pm$1.1 | Helped |
| Inject noise into hidden states | GCN versus strongest listed baseline · Mettack, Cora, 5% | accuracy: 78.9$\pm$0.8 -> 81.2$\pm$0.7 | Helped |
| Inject noise into hidden states | GCN versus strongest listed baseline · Mettack, CiteSeer, 5% | accuracy: 70.6$\pm$0.7 -> 72.3$\pm$0.6 | Helped |
| Inject noise into hidden states | GCN versus strongest listed baseline · PGD, Cora, 5% | accuracy: 75.8$\pm$0.9 -> 76.6$\pm$0.3 | Helped |
| Inject noise into hidden states | GIN versus strongest listed baseline · Mettack, Cora, 5% | accuracy: 78.3$\pm$0.6 -> 81.1$\pm$0.5 | Helped |
| Inject noise into hidden states | GIN versus strongest listed baseline · PGD, CiteSeer, 5% | accuracy: 70.1$\pm$0.5 -> 70.7$\pm$0.5 | Helped |
| Add noise injection to GCNGuard | GCN · Mettack, Cora, $\epsilon=25\%$ | accuracy: 69.5$\pm$0.7 -> 72.4$\pm$1.2 | Helped |
| Add noise injection to GINGuard | GIN · PGD, CiteSeer, $\epsilon=25\%$ | accuracy: 67.0 $\pm$ 1.1 -> 66.2 $\pm$ 0.6 | Hurt |
Surprising findings
- Noise injection sometimes slightly improves clean accuracy over plain GCN, which the authors attribute to prior generalization findings.
- Several table entries show the proposed method is not best; GNNGuard wins on some Mettack/PGD settings, e.g., PubMed at 10% under Mettack.
Limitations
- Robustness bounds are derived for 2-layer GCN/GIN with 1-Lipschitz activations and only hold under specific assumptions; the bounds for node-feature attacks are loose for GIN.
- Evaluation limited to GCN and GIN with a few attacks (Mettack, PGD, DICE) and perturbation budgets up to 10% in main tables.
- Noise scale beta must be tuned on validation data and large noise can harm clean accuracy.
Experimental setup
Datasets: Cora CiteSeer PubMed PolBlogs OGBN-Arxiv
Benchmarks: Cora CiteSeer PubMed PolBlogs OGBN-Arxiv
Metrics: classification accuracy certified accuracy training time
Baselines: GNNGuard GNN-Jaccard GNN-SVD RGCN GCN-k AirGNN GCN-Jaccard
Builds on: Mettack RobustGCN GNNGuard sparse randomized smoothing AirGNN
Closest papers by meaning
- Value at Adversarial Risk: A Graph Defense Strategy against Cost-Aware Attacks (AAAI 2024 · similarity 0.90)
- Training Robust Graph Neural Networks by Modeling Noise Dependencies (NeurIPS 2025 · similarity 0.89)
- Bounding the Expected Robustness of Graph Neural Networks Subject to Node Feature Attacks (ICLR 2024 · similarity 0.89)
- Grimm: A Plug-and-Play Perturbation Rectifier for Graph Neural Networks Defending Against Poisoning Attacks (AAAI 2025 · similarity 0.89)
- Deterministic Certification of Graph Neural Networks against Graph Poisoning Attacks with Arbitrary Perturbations (CVPR 2025 · similarity 0.89)
- If You Want to Be Robust, Be Wary of Initialization (NeurIPS 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.