Research map / Graph learning / GNN architectures
Towards Inductive Robustness: Distilling and Fostering Wave-Induced Resonance in Transductive GCNs against Graph Adversarial Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that a 3-layer GCN's message passing equals an edge-based Laplacian wave that induces resonance with local subgraphs, and proposes GRN, an inductive node-wise model that embeds node and edge-transmitted signals from each node's local resonance subgraph to gain robustness on unseen nodes.
Problem
Robust graph defenses against structural adversarial attacks (e.g., Metattack) are built on transductive GCNs and cannot generalize to unseen nodes or structures.
Approach
Interprets GCN message passing as an edge-based wave; a 3-layer GCN induces a resonance between nodes and their local subgraph (local resonance subgraph, LRS), and GRN distills this LRS and fosters it by embedding node signals and edge-transmitted signals per node, enabling inductive robust learning.
Key results
- On Cora at 20% Metattack perturbation, GRN with seen rate 60% reaches 74.81% accuracy versus 64.68% for Pro-GNN and 69.82% for EGNN.
- On Citeseer clean graph, GRN (s_r=60%) reaches 83.26% versus 74.94% for Pro-GNN.
- GRN is not uniformly best: on Pubmed at 10% perturbation EGNN (82.13%) beats GRN (80.99%), and on Polblogs clean EGNN leads by about 0.28 points.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use GRN with the reported seen-rate variants instead of defense baselines | GRN · Cora, Citeseer, Pubmed, and Polblogs; Metattack perturbation rates 0%, 5%, 10%, and 20% | accuracy | Mixed |
| Use GRN at s_r=60% rather than the strongest defense baseline | GRN · Cora, p_r=20% | accuracy: 73.54 -> 74.81 | Helped |
| Use GRN at s_r=60% rather than the strongest defense baseline | GRN · Citeseer, p_r=20% | accuracy: 67.22 -> 77.21 | Helped |
| Use GRN at s_r=60% rather than the strongest defense baseline | GRN · Pubmed, p_r=10% | accuracy: 82.13 -> 80.99 | Hurt |
| Use GRN at s_r=20% rather than the strongest defense baseline | GRN · Polblogs, p_r=0% | accuracy: 95.70 -> 95.42 | Hurt |
| Add edge-transmitted signals alongside node signals instead of using node signals alone (ablation) | GRN · Cora, p_r=20% | accuracy: 63.54 -> 74.81 | Helped |
| Add edge-transmitted signals alongside node signals instead of using node signals alone (ablation) | GRN · Citeseer, p_r=20% | accuracy: 69.05 -> 77.21 | Helped |
| Reverse the order of node and edge signals (ablation) | GRN · Cora and Citeseer, p_r=0% and 20% | accuracy | No clear effect |
| Shuffle rows in the edge/node signal combination (ablation) | GRN · Cora and Citeseer, p_r=0% and 20% | accuracy | No clear effect |
| Increase the GCN depth from 2 to 3 layers | GCN · Four datasets under three attacks at 20% perturbation | attack success rate | Helped |
| Use the LRS-weighted graph rather than the original graph | standard 2-layer GCN · Cora under increasing Metattack perturbation rates | accuracy | Helped |
Surprising findings
- Merely deepening a standard GCN to 3 layers yields a steep drop in attack success rate, suggesting an intrinsic robustness.
- GRN with reversed or shuffled signal order performs comparably, suggesting insensitivity to order.
Limitations
- Several theoretical steps rely on approximations (truncated SVD, Taylor expansion, neglected error terms), so the equivalence is not exact.
- Polblogs results show non-monotonic dependence on seen rate and GRN underperforms EGNN in some settings.
Experimental setup
Datasets: Cora Citeseer Pubmed Polblogs
Benchmarks: Cora Citeseer Pubmed Polblogs
Metrics: classification accuracy (%)
Baselines: RGCN GNN-SVD Pro-GNN Jaccard EGNN
Builds on: GCN Pro-GNN EGNN
Closest papers by meaning
- Not All Low-Pass Filters are Robust in Graph Convolutional Networks (NeurIPS 2021 · similarity 0.90)
- Bounding the Expected Robustness of Graph Neural Networks Subject to Node Feature Attacks (ICLR 2024 · similarity 0.88)
- Beyond Oversquashing: Understanding Signal Propagation in GNNs Via Observables (NeurIPS 2026 · similarity 0.87)
- A Simple and Yet Fairly Effective Defense for Graph Neural Networks (AAAI 2024 · similarity 0.87)
- Refining Latent Homophilic Structures over Heterophilic Graphs for Robust Graph Convolution Networks (AAAI 2024 · similarity 0.86)
- Higher-Order Graphon Neural Networks: Approximation and Cut Distance (ICLR 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.