Research map / Adversarial robustness and security / Attacks on text and graphs
Grimm: A Plug-and-Play Perturbation Rectifier for Graph Neural Networks Defending Against Poisoning Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Grimm is a plug-and-play, artificial-immune-system-inspired defense that monitors feature trajectories from any GNN layer during training, detects adversarial edges via negative selection, and rectifies the graph without replacing the protected GNN.
Problem
GNNs for node classification are vulnerable to edge-perturbing poisoning attacks, but existing robust GNNs require replacing the original GNN architecture, losing its custom enhancements and generalizability (e.g., inductive GraphSAGE/GAT).
Approach
Treat node and edge feature trajectories across training epochs as detectable signals; build detectors via a negative selection algorithm (artificial immune system) from feasible trajectories generated by a cyclic self-supervised generator, and use them to detect and remove adversarial edges in parallel with GNN training, with detectors transferable across systems.
Key results
- On Cora at 20% perturbation, Grimm-protected GraphSAGE reaches 79.51% accuracy versus 63.91% for unprotected GraphSAGE and 73.24% for Jaccard.
- Grimm adds roughly 4-8% training-time overhead on large graphs (Brain, Pubmed, Reddit) for GCN/GAT/SAGE, while EGNN-style defenses increase runtime by up to ~1000-1700%.
- Detectors transferred from a GCN on Cora under Metattack raise GAT/SAGE accuracy on Cora from 59.20/62.21% to 68.71/73.94% without retraining.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| protect GCN, GAT, or GraphSAGE with Grimm | GCN, GAT, and GraphSAGE · Cora, p_r=20 | classification accuracy (%): 59.02 -> 73.49; 59.13 -> 73.84; 63.91 -> 79.51 | Helped |
| protect GCN, GAT, or GraphSAGE with Grimm | GCN, GAT, and GraphSAGE · Citeseer, p_r=20 | classification accuracy (%): 62.73 -> 70.76; 60.14 -> 72.42; 68.81 -> 76.91 | Helped |
| protect GCN or GAT with Grimm | GCN and GAT · Pubmed, p_r=20 | classification accuracy (%): 70.02 -> 75.10; 69.89 -> 79.30 | Helped |
| protect GraphSAGE with Grimm | GraphSAGE · Pubmed, p_r=20 | classification accuracy (%): 72.09 -> 74.05 | Helped |
| protect GCN, GAT, or GraphSAGE with Grimm | GCN, GAT, and GraphSAGE · Polblogs, p_r=20 | classification accuracy (%): 52.33 -> 82.11; 50.28 -> 81.02; 54.12 -> 78.62 | Helped |
| use exogenous reliable FTs to produce detectors instead of the standard reliable FTs (ablation) | Grimm · Cora, Citeseer, Pubmed, and Polblogs, p_r=20 | classification accuracy (%): 73.49 -> 71.02; 73.84 -> 65.70; 79.51 -> 75.40; 70.76 -> 68.42; 72.42 -> 66.01; 76.91 -> 75.48; 75.10 -> 73.39; 79.30 -> | Hurt |
| use detectors transferred from a Cora/GCN system without training | Grimm protecting GAT and GraphSAGE · Cora, Citeseer, and Pubmed under Metaattack and CLGA | classification accuracy (%): 59.20 -> 68.71; 62.21 -> 73.94; 61.08 -> 70.32; 68.29 -> 77.69; 69.51 -> 80.37; 71.77 -> 82.64; 66.39 -> 76.34; 68.27 -> | Helped |
| interface Grimm at deeper GNN layers | Grimm · classification experiments | classification accuracy | Helped |
| vary the MSE threshold ρ within the tested permissible range | Grimm · classification experiments | classification accuracy | No clear effect |
Surprising findings
- On Polblogs at 0% perturbation, Grimm-protected models slightly trail Pro-GNN (by 0.32%), the only reported exception among clean-graph results.
- Rolling back the trainable weights after rectification causes an initial accuracy drop during training, which recovers after several epochs.
Limitations
- Theoretical bound (Proposition on inner products) is given only for GCN; bounds for GAT and GraphSAGE are set as empirical constants.
- When no reliable subgraph exists, reliable FTs must come from an exogenous reliable graph and a surrogate GNN, requiring extra clean data.
- Reported results are limited to a few attacks (Metattack, CLGA, RL-S2V) and the attack setting uses a fixed perturbation rate.
Experimental setup
Datasets: Cora Citeseer Polblogs Pubmed Brain Reddit
Benchmarks: Cora Citeseer Polblogs Pubmed Brain Reddit
Metrics: classification accuracy training time
Baselines: RGCN GCN-SVD Pro-GNN Jaccard EGNN
Builds on: Metattack RGCN Pro-GNN EGNN GCN-SVD
Closest papers by meaning
- Deterministic Certification of Graph Neural Networks against Graph Poisoning Attacks with Arbitrary Perturbations (CVPR 2025 · similarity 0.89)
- A Simple and Yet Fairly Effective Defense for Graph Neural Networks (AAAI 2024 · similarity 0.89)
- Graph Agent Network: Empowering Nodes with Inference Capabilities for Adversarial Resilience (AAAI 2025 · similarity 0.89)
- Value at Adversarial Risk: A Graph Defense Strategy against Cost-Aware Attacks (AAAI 2024 · similarity 0.88)
- Highly Imperceptible Black-Box Graph Injection Attacks with Reinforcement Learning (AAAI 2025 · similarity 0.88)
- If You Want to Be Robust, Be Wary of Initialization (NeurIPS 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.