Research map / Graph learning / Graph self-supervised learning
Adversarial Contrastive Graph Masked AutoEncoder Against Graph Structure and Feature Dual Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes ACGMAE, an unsupervised graph representation learner that combines adversarial feature-masked autoencoding with positive-expansion contrastive learning to defend against joint structure (metattack/nettack) and feature attacks.
Problem
Robust unsupervised graph representation learning under joint graph structure and node feature adversarial attacks, which existing robust GRL methods (designed mainly for structure attacks) fail to handle.
Approach
Adversarial feature masking (masking small-gradient features to simulate feature attacks) inside a GraphMAE-style masked autoencoder, plus contrastive learning on a kNN feature graph and the attacked graph in which neighbors are treated as soft positives weighted by a GMM-style cluster-based probability of being true positives.
Key results
- On node classification under dual attacks (metattack 25% + 50% feature noise), ACGMAE reaches 74.55% on Cora, 72.61% on Citeseer and 65.74% on Pubmed, outperforming the best baseline by 8.8, 2.6 and 2.8 points on Cora, Citeseer and Pubmed respectively.
- On node clustering under 15% metattack and 50% feature attack, ACGMAE achieves NMI 48.10 / ARI 43.59 on Cora and NMI 40.99 / ARI 43.19 on Citeseer, far above the best baseline (STABLE, 32.61 NMI on Cora).
- Ablation on Cora dual attacks shows PE contributes the largest gain (about 5.1 points average on attacked graphs), with AM adding about 3.1 points.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add adversarial feature masking (ablation) | ACGMAE · Cora, Dual Attacks | accuracy: 65.74±0.1 -> 67.71±0.1 | Helped |
| add topology reconstruction (ablation) | ACGMAE with adversarial feature masking · Cora, Dual Attacks | accuracy: 67.71±0.1 -> 68.11±0.1 | Helped |
| add positive-expansion contrastive learning (ablation) | ACGMAE with adversarial masking and topology reconstruction · Cora, Dual Attacks | accuracy: 68.11±0.1 -> 74.55±0.3 | Helped |
| add adversarial feature masking (ablation) | ACGMAE · Citeseer, Dual Attacks | accuracy: 59.89±0.1 -> 66.84±0.0 | Helped |
| add topology reconstruction (ablation) | ACGMAE with adversarial feature masking · Citeseer, Dual Attacks | accuracy: 66.84±0.0 -> 68.29±0.0 | Helped |
| add positive-expansion contrastive learning (ablation) | ACGMAE with adversarial masking and topology reconstruction · Citeseer, Dual Attacks | accuracy: 68.29±0.0 -> 72.61±0.0 | Helped |
| add adversarial feature masking (ablation) | ACGMAE · Cora, Clean | accuracy: 84.23±0.7 -> 84.07±0.9 | No clear effect |
| add topology reconstruction (ablation) | ACGMAE with adversarial feature masking · Cora, Clean | accuracy: 84.07±0.9 -> 84.26±0.9 | No clear effect |
| add positive-expansion contrastive learning (ablation) | ACGMAE with adversarial masking and topology reconstruction · Cora, Clean | accuracy: 84.26±0.9 -> 84.97±0.6 | Helped |
| add adversarial feature masking (ablation) | ACGMAE · Citeseer, Clean | accuracy: 73.20±0.8 -> 73.71±0.4 | No clear effect |
| add topology reconstruction (ablation) | ACGMAE with adversarial feature masking · Citeseer, Clean | accuracy: 73.71±0.4 -> 73.97±0.1 | No clear effect |
| add positive-expansion contrastive learning (ablation) | ACGMAE with adversarial masking and topology reconstruction · Citeseer, Clean | accuracy: 73.97±0.1 -> 74.95±0.6 | Helped |
Surprising findings
- Robust structure-defense baselines such as STABLE and SP-AGCL degrade substantially under feature attacks, with STABLE dropping to 48.07% under dual attacks on Cora.
Limitations
- Evaluated only on three small citation benchmarks (Cora, Citeseer, Pubmed) with GCN encoders.
- Feature attacks are limited to Gaussian noise; the paper does not evaluate adaptive or learned feature attacks.
- Hyperparameters (alpha, beta, gamma, k, c, perturbation ratio) are tuned by grid search, with some sensitivity to alpha and gamma.
Experimental setup
Datasets: Cora Citeseer Pubmed
Benchmarks: Cora Citeseer Pubmed
Metrics: accuracy NMI ARI
Baselines: GCN GRACE DGI GraphMAE DGI-Jaccard STABLE ARIEL SP-AGCL
Builds on: GraphMAE GRACE SP-AGCL ARIEL STABLE
Closest papers by meaning
- Rethinking Graph Masked Autoencoders through Alignment and Uniformity (AAAI 2024 · similarity 0.88)
- Refine then Classify: Robust Graph Neural Networks with Reliable Neighborhood Contrastive Refinement (AAAI 2025 · similarity 0.87)
- Adversarial Contrastive Graph Augmentation with Counterfactual Regularization (AAAI 2025 · similarity 0.87)
- Value at Adversarial Risk: A Graph Defense Strategy against Cost-Aware Attacks (AAAI 2024 · similarity 0.87)
- Bounding the Expected Robustness of Graph Neural Networks Subject to Node Feature Attacks (ICLR 2024 · similarity 0.87)
- Adversarial Robust Generalization of Graph Neural Networks (ICML 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.