Research map / Graph learning / GNN architectures
Robustness, privacy, and fairness of GNNs
Defend GNNs against attacks and study their privacy and fairness.
94 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2020–2026) · an approach in GNN architectures, keyword cluster “gnn · explanations · trained”
State History Benchmarks Tried Checklist Preprints Who Export
Where it stands
Leveling off Several papers from 2025–26 still report on 3 tracked benchmarks, but the best result has barely moved since 2024.
37 papers in 2023–24 and 36 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic held steady, from 7.8% to 7.1%.
What looks settled
- Citeseer (accuracy): best up to 2024 81.61, best in 2025–26 74.8 from 2 papers, at most 0.2% better, if at all.
- Cora (accuracy): best up to 2024 91.39, best in 2025–26 80.67 from 2 papers, at most 0.2% better, if at all.
- Pubmed (accuracy): best up to 2024 89.14, best in 2025–26 88.47 from 2 papers, at most 0.2% better, if at all.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2020 · GNNGuard: Defending Graph Neural Networks against Adversarial Attacks (NeurIPS 2020 · 118 citations)
- 2021 · Be Confident! Towards Trustworthy Graph Neural Networks via Confidence Calibration (NeurIPS 2021 · 36 citations)
- 2022 · Understanding and Improving Graph Injection Attack by Promoting Unnoticeability (ICLR 2022 · 24 citations)
- 2023 · Let Graph Be the Go Board: Gradient-Free Node Injection Attack for Graph Neural Networks via Reinforcement Learning (AAAI 2023 · 39 citations)
- 2024 · FairSIN: Achieving Fairness in Graph Neural Networks through Sensitive Information Neutralization (AAAI 2024 · 25 citations)
- 2025 · Erase Then Rectify: A Training-Free Parameter Editing Approach for Cost-Effective Graph Unlearning (AAAI 2025 · 5 citations)
- 2026 · Privacy Auditing of Multi-Domain Graph Pre-Trained Model Under Membership Inference Attacks (AAAI 2026 · 2 citations)
Earliest papers here
- GNNGuard: Defending Graph Neural Networks against Adversarial Attacks (NeurIPS 2020 · 118 citations)
- Efficient Probabilistic Logic Reasoning with Graph Neural Networks (ICLR 2020 · 36 citations)
- Reliable Graph Neural Networks via Robust Aggregation (NeurIPS 2020 · 34 citations)
Benchmark records
The best number each year that beat every earlier one, among papers of this approach reporting their own method. Numbers are extracted by AI from each paper's text; check the paper before citing.
Citeseer · accuracy (higher is better)
6 papers, 2022–2025 · flat since 2024
| Year | Best so far | Set by |
|---|---|---|
| 2022 | 73.08 | You are AllSet: A Multiset Function Framework for Hypergraph Neural Networks (ICLR 2022 · 9 citations) |
| 2023 | 75.64 | Adversarial Weight Perturbation Improves Generalization in Graph Neural Networks (AAAI 2023 · 10 citations) |
| 2024 | 81.61 | Delaunay Graph: Addressing Over-Squashing and Over-Smoothing Using Delaunay Triangulation (ICML 2024) |
Cora · accuracy (higher is better)
6 papers, 2022–2025 · flat since 2024
| Year | Best so far | Set by |
|---|---|---|
| 2022 | 78.59 | You are AllSet: A Multiset Function Framework for Hypergraph Neural Networks (ICLR 2022 · 9 citations) |
| 2023 | 86.13 | Adversarial Weight Perturbation Improves Generalization in Graph Neural Networks (AAAI 2023 · 10 citations) |
| 2024 | 91.39 | Delaunay Graph: Addressing Over-Squashing and Over-Smoothing Using Delaunay Triangulation (ICML 2024) |
Pubmed · accuracy (higher is better)
5 papers, 2022–2025 · flat since 2024
| Year | Best so far | Set by |
|---|---|---|
| 2022 | 88.72 | You are AllSet: A Multiset Function Framework for Hypergraph Neural Networks (ICLR 2022 · 9 citations) |
| 2024 | 89.14 | Delaunay Graph: Addressing Over-Squashing and Over-Smoothing Using Delaunay Triangulation (ICML 2024) |
What has been tried
70 papers here report 691 measured changes (a component added, removed or swapped, compared with a baseline): helped 66%, no clear effect 6%, hurt 19%, mixed 8%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| add heterogeneous-neighbor neutralization F3 | Bail · DP | 5.93±0.04 -> 4.56±0.75 | Helped | FairSIN: Achieving Fairness in Graph Neural Networks through Sensitive Information Neutralization (AAAI 2024 · 25 citations) |
| Replace parameter editing with masking | PubMed, CiteSeer, Cora, CS · F1 | 88.91 -> 89.48; 77.00 -> 77.09; 82.51 -> 83.54; 92.44 -> 92.72 | Hurt | Erase Then Rectify: A Training-Free Parameter Editing Approach for Cost-Effective Graph Unlearning (AAAI 2025 · 5 citations) |
| Replace class-prototype similarity input with pretrained logits | Cora, GCN · ECE (%) | 3.32±0.99 -> 3.58±0.97 | Hurt | SimCalib: Graph Neural Network Calibration Based on Similarity between Nodes (AAAI 2024 · 5 citations) |
| Replace rank conformity scores with THR scores | Cora, CiteSeer, Photo · prediction set size | 1.92 -> 1.65; 1.26 -> 1.57; 1.23 -> 1.26 | Mixed | Enhancing Trustworthiness of Graph Neural Networks with Rank-Based Conformal Training (AAAI 2025 · 4 citations) |
| Expand node aggregation from Kv=1 to Kv=6 (with Ke=2 and relative degree encoding) | Peptides-func · AP | 0.5965 -> 0.7011 | Helped | K-hop Hypergraph Neural Network: A Comprehensive Aggregation Approach (AAAI 2025 · 4 citations) |
| Generate 1024 self-play games per iteration instead of 256 with a 1M frame window | Chess training, frame-window experiment · learning performance | Helped | Enhancing Chess Reinforcement Learning with Graph Representation (NeurIPS 2024 · 4 citations) | |
| Replace Louvain-OSLOM community partitioning with balanced K-means (BEKM) | Four datasets · Macro F1 | Hurt | Community-Centric Graph Unlearning (AAAI 2025 · 2 citations) | |
| Add physical influence weighting rather than balancing only the number of edges | Delaware River Basin, income discrete · Fairness | 0.196 -> 0.134 | Helped | Physics-Guided Fair Graph Sampling for Water Temperature Prediction in River Networks (AAAI 2025 · 2 citations) |
| Increase the number of subgraphs S | Node and graph classification datasets · certified perturbation size | Helped | Deterministic Certification of Graph Neural Networks against Graph Poisoning Attacks with Arbitrary Perturbations (CVPR 2025 · 2 citations) | |
| Replace GRE's single whole-training-set constraint with constraints on multiple disjoint training subsets | A-photo, single edit · test drawdown | 58.12±2.26 -> 43.87±1.36 | Helped | Gradient Rewiring for Editable Graph Neural Network Training (NeurIPS 2024 · 2 citations) |
| Start denoising from a one-shot ticket rather than a randomly initialized ticket | Citeseer · weight sparsity | 94.22 -> 99.27; 89.38 -> 98.33; 70.26 -> 99.20 | Helped | Fast Track to Winning Tickets: Repowering One-Shot Pruning for Graph Neural Networks (AAAI 2025 · 1 citation) |
| Add degree inference and neighboring confidence to attention-based detection | Cora, Metattack · TP | 928 -> 901 | Hurt | Graph Agent Network: Empowering Nodes with Inference Capabilities for Adversarial Resilience (AAAI 2025 · 1 citation) |
What reviewers will expect
Datasets and baselines named in the 22 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- Cora · 15 of 22 papers
- Citeseer · 14 of 22 papers
- PubMed · 13 of 22 papers
- ogbn-arxiv · 6 of 22 papers
- Coauthor-CS · 4 of 22 papers
- Coauthor-Physics · 4 of 22 papers
- CoraFull · 4 of 22 papers
- CS · 3 of 22 papers
Baselines
- GIF · 4 of 22 papers
- CaGCN · 3 of 22 papers
- GATS · 3 of 22 papers
- Retrain · 3 of 22 papers
- GNNDelete · 3 of 22 papers
- MEGU · 2 of 22 papers
- Pro-GNN · 2 of 22 papers
- GTA · 2 of 22 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 73 papers; from OpenAlex and the papers' affiliations).
- Zhejiang University · 4 papers
- National University of Singapore · 4 papers
- Rice University · 4 papers
- Hong Kong University of Science and Technology · 4 papers
- Huazhong University of Science and Technology · 4 papers
- Texas A&M University · 3 papers
- Tongji University · 3 papers
- University of Science and Technology of China · 3 papers
- University of Pittsburgh · 2 papers
- Case Western Reserve University · 2 papers
Use it
Download BibTeX of 36 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- GNN generalization theory (187 papers)
- Simple and scalable GNNs (131 papers)
- Physics-inspired GNNs (81 papers)
- GNN explainability (64 papers)
- Graph structure learning (201 papers)
Elsewhere in the topic
- Expressive equivariant message passing (109 papers)
- Theory of graph convolutional networks (83 papers)
- Deep graph convolution and simplification (82 papers)
- Graph rewiring and scalable message passing (72 papers)
- Weisfeiler-Leman expressivity hierarchies (66 papers)
- Structural GNN variants (65 papers)
- Oversmoothing and heterophily (60 papers)
- Substructure-aware GNN expressivity (50 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).