Research map / Graph learning / GNN architectures
Graph Agent Network: Empowering Nodes with Inference Capabilities for Adversarial Resilience
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Graph Agent Network (GAgN), a decentralized network where each node is a 1-hop-view agent with small MLP-style functions that learn to infer embeddings, degrees, and neighbor relations, enabling adversarial edge filtering and resistance to secondary attacks.
Problem
GNN node classification is vulnerable to adversarial edge-perturbing attacks, and existing global-optimization-based defenses remain vulnerable to secondary attacks that use the defense as a surrogate.
Approach
Replace global end-to-end training with decentralized agents that each see only their 1-hop neighborhood, communicate learned functions (embedding, degree inference, neighbor confidence) and attention weights, and use these to filter adversarial edges; theoretically, single-hidden-layer MLPs suffice for these functions.
Key results
- Under Metattack primary attack at 20% perturbation on Cora, GAgN reaches 77.01% accuracy versus 72.51% for the best baseline (Jaccard).
- Under G-EPA secondary attack on Cora, GAgN attains 74.91% versus 63.11% for Jaccard.
- Degree inference accuracy on Cora reaches 95.31% for the high-degree test set (S-N row is the top value) and neighbor-confidence accuracy is reported as high across four constructed graphs.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use GAgN instead of Jaccard | Node classification defense · Cora, primary Metattack (r_p=20) | accuracy (%): 72.51 -> 77.01 | Helped |
| Use GAgN instead of Jaccard | Node classification defense · Cora, secondary G-EPA (r_p=20) | accuracy (%): 63.11 -> 74.91 | Helped |
| Use GAgN instead of Jaccard | Node classification defense · Citeseer, primary Metattack (r_p=20) | accuracy (%): 66.21 -> 70.49 | Helped |
| Use GAgN instead of Jaccard | Node classification defense · Citeseer, secondary G-EPA (r_p=20) | accuracy (%): 57.71 -> 69.19 | Helped |
| Use GAgN instead of EGNN | Node classification defense · Polblogs, primary Metattack (r_p=20) | accuracy (%): 75.42 -> 80.92 | Helped |
| Use GAgN instead of EGNN | Node classification defense · Polblogs, secondary G-EPA (r_p=20) | accuracy (%): 66.92 -> 78.42 | Helped |
| Use GAgN instead of Pro-GNN | Node classification defense · Pubmed, primary Metattack (r_p=20) | accuracy (%): 82.82 -> 82.98 | Helped |
| Use GAgN instead of Pro-GNN | Node classification defense · Pubmed, secondary G-EPA (r_p=20) | accuracy (%): 74.07 -> 78.29 | Helped |
| Add degree inference and neighboring confidence to attention-based detection (ablation) | GAgN edge detection · Cora, Metattack | TP: 928 -> 901 | Hurt |
| Add degree inference and neighboring confidence to attention-based detection (ablation) | GAgN edge detection · Cora, Metattack | FP: 302 -> 47 | Helped |
| Add degree inference and neighboring confidence to attention-based detection (ablation) | GAgN edge detection · Citeseer, Metattack | TP: 782 -> 753 | Hurt |
| Add degree inference and neighboring confidence to attention-based detection (ablation) | GAgN edge detection · Citeseer, Metattack | FP: 341 -> 55 | Helped |
Surprising findings
- The paper claims the agent-based design is nearly impervious to secondary attacks because GAgN closes global input-output interfaces, so it cannot be used as a surrogate; secondary attacks were transferred from baselines instead.
Limitations
- GAgN cannot directly serve as a surrogate, so secondary attacks were evaluated by transferring perturbed graphs from baselines, an indirect protocol.
- Proofs rely on strong assumptions (e.g., Turing-completeness arguments, pseudoinverse approximations) and some theorem arguments are informal.
- Evaluation is limited to four datasets and two attacks at a fixed 20% perturbation rate.
Experimental setup
Datasets: Cora Citeseer Polblogs Pubmed
Benchmarks: Cora Citeseer Polblogs Pubmed
Metrics: classification accuracy degree inference accuracy TP FP
Baselines: RGCN GCN-SVD Pro-GNN Jaccard EGNN
Builds on: GraphSAGE GAT Metattack Pro-GNN
Closest papers by meaning
- Grimm: A Plug-and-Play Perturbation Rectifier for Graph Neural Networks Defending Against Poisoning Attacks (AAAI 2025 · similarity 0.89)
- A Simple and Yet Fairly Effective Defense for Graph Neural Networks (AAAI 2024 · similarity 0.88)
- Graph Neural Networks Gone Hogwild (ICLR 2025 · similarity 0.87)
- Value at Adversarial Risk: A Graph Defense Strategy against Cost-Aware Attacks (AAAI 2024 · similarity 0.87)
- Deterministic Certification of Graph Neural Networks against Graph Poisoning Attacks with Arbitrary Perturbations (CVPR 2025 · similarity 0.87)
- Highly Imperceptible Black-Box Graph Injection Attacks with Reinforcement Learning (AAAI 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.