, Available online , doi: 10.1109/JAS.2026.125990
Abstract:
Graph Neural Networks (GNNs) are effective in processing graph-structured data but are also known to be vulnerable to adversarial attacks. Limitations of existing defense methodologies include a suboptimal approach to edge and node weight assignment, as such methods generally focus on the graph’s topological structure or node attributes. This imbalance can lead to inaccurate assessments of the importance of neighboring nodes, especially those targeted by attacks. We posit that the model should diminish the influence of insignificant and contaminated neighboring nodes on graph representation learning, thereby mitigating the adverse effects of compromised neighbors. Hence, we propose a versatile GNN adversarial defense framework by combining a novel attribute-augmented Personalized PageRank (PPR) with an adaptive self-loop weight adjustment mechanism, coined GPROP, to defend against adversarial attacks. Specifically, the attribute-augmented PPR helps compute the node similarity more accurately based on global semantics, by considering multi-hop graph topology and node attributes. According to the similarity scores, GPROP assigns corresponding weights to edges and simultaneously prunes insignificant ones. When iteratively aggregating the neighbor information, the proposed self-loop mechanism dynamically adjusts the weight ratio of neighboring nodes and the nodes themselves based on the node’s degree. This strategy reduces the influence of neighboring nodes that may introduce unreliable or harmful information. Moreover, GPROP is model-agnostic and can be readily embedded into different GNN backbones, leading to a substantial improvement in resistance to adversarial perturbations. Experimental results across multiple benchmark datasets show that our proposal consistently outperforms existing approaches, providing enhanced resilience and accuracy.
Z. Wang, J. Li, Z. Ye, L. Lin, M. Wang, and G. Wang, “Attribute-augmented PPR meets self-loops: Simple yet effective defending graph neural networks,” IEEE/CAA J. Autom. Sinica, early access, 2026. doi: 10.1109/JAS.2026.125990.