Research map / Adversarial robustness and security / Attacks on text and graphs
Graph neural network robustness
Attack and defend graph neural networks against adversarial perturbations.
71 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2018–2026) · an approach in Attacks on text and graphs, keyword cluster “generative · purification · diffusion”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
23 papers in 2023–24 and 31 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 8.2% to 6.4%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2018 · Adversarial Attack on Graph Structured Data (ICML 2018 · 161 citations)
- 2019 · Adversarial Attacks on Graph Neural Networks via Meta Learning (ICLR 2019 · 373 citations)
- 2020 · Certified Robustness of Graph Convolution Networks for Graph Classification under Topological Attacks (NeurIPS 2020 · 16 citations)
- 2021 · UAG: Uncertainty-aware Attention Graph Neural Network for Defending Adversarial Attacks (AAAI 2021 · 25 citations)
- 2022 · Robust Heterogeneous Graph Neural Networks against Adversarial Attacks (AAAI 2022 · 64 citations)
- 2023 · Adversarially Robust Neural Architecture Search for Graph Neural Networks (CVPR 2023 · 22 citations)
- 2024 · Enhancing the Robustness of Spiking Neural Networks with Stochastic Gating Mechanisms (AAAI 2024 · 13 citations)
- 2025 · Refine then Classify: Robust Graph Neural Networks with Reliable Neighborhood Contrastive Refinement (AAAI 2025 · 4 citations)
- 2026 · Edge Self-Adversarial Augmentation Enhances Graph Contrastive Learning Against Neighborhood Inconsistency (AAAI 2026 · 1 citation)
Earliest papers here
- Adversarial Attack on Graph Structured Data (ICML 2018 · 161 citations)
- Adversarial Attacks on Graph Neural Networks via Meta Learning (ICLR 2019 · 373 citations)
- Adversarial Attacks on Node Embeddings via Graph Poisoning (ICML 2019 · 162 citations)
What has been tried
43 papers here report 408 measured changes (a component added, removed or swapped, compared with a baseline): helped 63%, no clear effect 10%, hurt 21%, mixed 6%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Increase the StoG penalty strength γ | CIFAR-10 · clean accuracy | No clear effect | Enhancing the Robustness of Spiking Neural Networks with Stochastic Gating Mechanisms (AAAI 2024 · 13 citations) | |
| add temporal smoothness to edge filtering | Wikipedia, T-Spear, p=0.3 · MRR | 75.3 ± 0.4 -> 76.1 ± 0.3 | Helped | Spear and Shield: Adversarial Attacks and Defense Methods for Model-Based Link Prediction on Continuous-Time Dynamic Graphs (AAAI 2024 · 8 citations) |
| Add semantic-based edge supplementation | Cora and Citeseer, Mettack 25% · accuracy | Helped | Refine then Classify: Robust Graph Neural Networks with Reliable Neighborhood Contrastive Refinement (AAAI 2025 · 4 citations) | |
| increase fractional order β | GIA attacks · accuracy | Hurt | Coupling Graph Neural Networks with Fractional Order Continuous Dynamics: A Robustness Study (AAAI 2024 · 4 citations) | |
| Add elite hyperedge selection (R1) | Cora, Hyper-KNN · misclassification rate (%) | 30.80 -> 59.60 | Helped | Hypergraph Attacks via Injecting Homogeneous Nodes into Elite Hyperedges (AAAI 2025 · 3 citations) |
| add C&W loss to top-k gradient selection | CIFAR10-DVS · ASR (%) | 69.0 -> 72.0 | Helped | Towards Effective and Sparse Adversarial Attack on Spiking Neural Networks via Breaking Invisible Surrogate Gradients (CVPR 2025 · 3 citations) |
| Use MCP instead of ℓ1 penalty | Cora ML adaptive local attack, 200% · accuracy | 14.0 ± 7.4 -> 69.3 ± 9.0 | Helped | Robust Graph Neural Networks via Unbiased Aggregation (NeurIPS 2024 · 3 citations) |
| Remove the bidirectional update mechanism | policy reconstruction · attack performance curve | Hurt | Enhancing Robustness of Graph Neural Networks on Social Media with Explainable Inverse Reinforcement Learning (NeurIPS 2024 · 3 citations) | |
| use exogenous reliable FTs to produce detectors instead of the standard reliable FTs | Cora, Citeseer, Pubmed, and Polblogs, p_r=20 · classification accuracy (%) | 73.49 -> 71.02; 73.84 -> 65.70; 79.51 -> 75.40; 70.76 -> 68.42; 72.42 -> 66.01; 76.91 -> 75.48; 75.10 -> 73.39; 79.30 -> | Hurt | Grimm: A Plug-and-Play Perturbation Rectifier for Graph Neural Networks Defending Against Poisoning Attacks (AAAI 2025 · 2 citations) |
| Add MS-MPPD loss with ρ=1.0 to DLIF adversarial training | CIFAR-10 · PGD^10 accuracy | 26.27 -> 27.34 | Helped | Robust Stable Spiking Neural Networks (ICML 2024 · 2 citations) |
| Use robust training that minimizes detected poisoned nodes' target-class confidence instead of removing identified nodes and training with cross-entropy | OGB-arxiv, DPGBA, two trigger edges · ASR(%) | Helped | Robustness Inspired Graph Backdoor Defense (ICLR 2025 · 1 citation) | |
| Add total variation fairness loss to the surrogate loss | Credit, FairGNN · Δdp (%) | 7.87 {± 1.31} -> 8.06 {± 1.90} | Helped | Adversarial Attacks on Fairness of Graph Neural Networks (ICLR 2024 · 1 citation) |
What reviewers will expect
Datasets and baselines named in the 21 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- Cora · 9 of 21 papers
- Citeseer · 9 of 21 papers
- Pubmed · 7 of 21 papers
- Chameleon · 3 of 21 papers
- Cora-ML · 3 of 21 papers
- Polblogs · 2 of 21 papers
- Reddit · 2 of 21 papers
- DBLP · 2 of 21 papers
Baselines
- GCN · 4 of 21 papers
- RGCN · 2 of 21 papers
- Pro-GNN · 2 of 21 papers
- Jaccard · 2 of 21 papers
- GAT · 2 of 21 papers
- APPNP · 2 of 21 papers
- GNNGuard · 2 of 21 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 54 papers; from OpenAlex and the papers' affiliations).
- Peking University · 5 papers
- Chinese Academy of Sciences · 4 papers
- Nanyang Technological University · 3 papers
- Indian Institute of Technology · 3 papers
- Pennsylvania State University · 3 papers
- Northwestern Polytechnical University · 2 papers
- University of Illinois Chicago · 2 papers
- C3 AI · 2 papers
- Fudan University · 2 papers
- Sichuan University · 2 papers
Use it
Download BibTeX of 38 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Defenses against universal perturbations (97 papers)
- Attacks and defenses in sequential settings (96 papers)
- Diffusion-based adversarial purification (78 papers)
Elsewhere in the topic
- Membership inference and inversion (118 papers)
- LLM jailbreak and injection defense (113 papers)
- Adversarial prompts for language models (98 papers)
- Vision-language model robustness (96 papers)
- Biologically inspired robust vision (77 papers)
- Adversarial perturbations beyond images (69 papers)
- Physical adversarial patches and camouflage (56 papers)
- Neural network watermarking (53 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).