mlsanityData to 7 Oct 2026

Are Defenses for Graph Neural Networks Robust?

arXiv 2301.13694 ↗First posted 31 Jan 2023cs.LGcited by 38

Not on the map. Why?

Abstract (arXiv)

A cursory reading of the literature suggests that we have made a lot of progress in designing effective adversarial defenses for Graph Neural Networks (GNNs). Yet, the standard methodology has a serious flaw - virtually all of the defenses are evaluated against non-adaptive attacks leading to overly optimistic robustness estimates. We perform a thorough robustness analysis of 7 of the most popular defenses spanning the entire spectrum of strategies, i.e., aimed at improving the graph, the architecture, or the training. The results are sobering - most defenses show no or only marginal improvement compared to an undefended baseline. We advocate using custom adaptive attacks as a gold standard and we outline the lessons we learned from successfully designing such attacks. Moreover, our diverse collection of perturbed graphs forms a (black-box) unit test offering a first glance at a model's robustness.

Key facts. Cited by 38 papers in the map (data through 7 Oct 2026). Builds on 41 of its 80 references that are in the map. First posted on arXiv 31 Jan 2023.

Builds on

41 of 80 references.

References · 41

  1. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  2. 2016Semi-Supervised Classification with Graph Convolutional Networkscited by 11,282
  3. 2017Neural Message Passing for Quantum Chemistrycited by 3,460
  4. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  5. 2020Open Graph Benchmark: Datasets for Machine Learning on Graphscited by 2,148
  6. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  7. 2020Graph Contrastive Learning with Augmentationscited by 1,203
  8. 2018Robustness May Be at Odds with Accuracycited by 873
  9. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  10. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
  11. 2018Adversarial Attacks on Neural Networks for Graph Datacited by 395
  12. 2020Graph Structure Learning for Robust Graph Neural Networkscited by 368
29 more
  1. 2017Deep Gaussian Embedding of Graphs: Unsupervised Inductive Learning via Rankingcited by 332
  2. 2019Adversarial Attacks on Graph Neural Networks via Meta Learningcited by 261
  3. 2020Graph Random Neural Network for Semi-Supervised Learning on Graphscited by 213
  4. 2019Topology Attack and Defense for Graph Neural Networks: An Optimization Perspectivecited by 196
  5. 2020GNNGuard: Defending Graph Neural Networks against Adversarial Attackscited by 195
  6. 2020Graph Information Bottleneckcited by 168
  7. 2020Learning to Drop: Robust Graph Neural Network via Topological Denoisingcited by 127
  8. 2020Node Similarity Preserving Graph Convolutional Networkscited by 112
  9. 2021Robustness of Graph Neural Networks at Scalecited by 100
  10. 2019Graph Adversarial Training: Dynamically Regularizing Based on Graph Structurecited by 93
  11. 2020DeepRobust: A PyTorch Library for Adversarial Attacks and Defensescited by 78
  12. 2021Elastic Graph Neural Networkscited by 67
  13. 2019Transferring Robustness for Graph Neural Network Against Poisoning Attackscited by 58
  14. 2021Graph Robustness Benchmark: Benchmarking the Adversarial Robustness of Graph Machine Learningcited by 44
  15. 2020Reliable Graph Neural Networks via Robust Aggregationcited by 43
  16. 2020Adversarial Attack on Large Scale Graphcited by 39
  17. 2021Understanding Structural Vulnerability in Graph Convolutional Networkscited by 37
  18. 2021Generalization of Neural Combinatorial Solvers Through the Lens of Adversarial Robustnesscited by 35
  19. 2019Batch Virtual Adversarial Training for Graph Convolutional Networkscited by 33
  20. 2020Unsupervised Adversarially-Robust Representation Learning on Graphscited by 17
  21. 2022Defending Graph Convolutional Networks against Dynamic Graph Perturbations via Bayesian Self-supervisioncited by 16
  22. 2020Uncertainty-aware Attention Graph Neural Network for Defending Adversarial Attackscited by 15
  23. 2020Adversarial Immunization for Certifiable Robustness on Graphscited by 14
  24. 2019Virtual Adversarial Training on Graph Convolutional Networks in Node Classificationcited by 11
  25. 2020Tensor Graph Convolutional Networks for Multi-relational and Robust Learningcited by 9
  26. 2020Uncertainty-Matching Graph Neural Networks to Defend Against Poisoning Attackscited by 7
  27. 2020Towards an Efficient and General Framework of Robust Training for Graph Neural Networkscited by 6
  28. 2022Node Copying: A Random Graph Model for Effective Graph Samplingcited by 4
  29. 2019Edge Dithering for Robust Adaptive Graph Convolutional Networkscited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 15; 2024: 10; 2025: 9; 2026: 4.

38 papers.

Sort:

By area:

  1. 2023Adversarial Attacks and Defenses in Large Language Models: Old and New Threatscited by 49
  2. 2023Adversarial Training for Graph Neural Networks: Pitfalls, Solutions, and New Directionscited by 28
  3. 2024Can Large Language Models Improve the Adversarial Robustness of Graph Neural Networks?cited by 22
  4. 2023Revisiting Robustness in Graph Machine Learningcited by 19
  5. 2024Robust Yet Efficient Conformal Prediction Setscited by 16
  6. 2025REINFORCE Adversarial Attacks on Large Language Models: An Adaptive, Distributional, and Semantic Objectivecited by 15
  7. 2023Spear and Shield: Adversarial Attacks and Defense Methods for Model-Based Link Prediction on Continuous-Time Dynamic Graphscited by 9
  8. 2023Hierarchical Randomized Smoothingcited by 9
  9. 2025CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisitioncited by 9
  10. 2023Simple and Efficient Partial Graph Adversarial Attack: A New Perspectivecited by 8
  11. 2023Robust Graph Neural Networks via Unbiased Aggregationcited by 8
  12. 2023Node-aware Bi-smoothing: Certified Robustness against Graph Injection Attackscited by 8
26 more
  1. 2023IDEA: Invariant Defense for Graph Adversarial Robustnesscited by 4
  2. 2025RTD-Lite: Scalable Topological Analysis for Comparing Weighted Graphs in Learning Taskscited by 4
  3. 2023On the Adversarial Robustness of Graph Contrastive Learning Methodscited by 2
  4. 2024Talos: A More Effective and Efficient Adversarial Defense for GNN Models Based on the Global Homophily of Graphscited by 2
  5. 2024Debiased Graph Poisoning Attack via Contrastive Surrogate Objectivecited by 2
  6. 2025Deterministic Certification of Graph Neural Networks against Graph Poisoning Attacks with Arbitrary Perturbationscited by 2
  7. 2023Can Directed Graph Neural Networks be Adversarially Robust?cited by 1
  8. 2023Resilient Graph Neural Networks: A Coupled Dynamical Systems Approachcited by 1
  9. 2023Sparse but Strong: Crafting Adversarially Robust Graph Lottery Ticketscited by 1
  10. 2024Understanding the Robustness of Graph Neural Networks against Adversarial Attackscited by 1
  11. 2024Adversarial Robustness of Graph Transformerscited by 1
  12. 2025On Measuring Unnoticeability of Graph Adversarial Attacks: Observations, New Measure, and Applicationscited by 1
  13. 2025AuditVotes: Elevating Provable Defense for GNNs with Efficient Augmentation and Conditional Smoothingcited by 1
  14. 2025Robustness in Text-Attributed Graph Learning: Insights, Trade-offs, and New Defensescited by 1
  15. 2026A Few Steps Further: Why Defenses Against Malicious Finetuning Erode Under Continued Trainingcited by 1
  16. 2023Promoting Fairness in GNNs: A Characterization of Stabilitycited by 0
  17. 2023Poisoning × Evasion: Symbiotic Adversarial Robustness for Graph Neural Networkscited by 0
  18. 2024Robust Subgraph Learning by Monitoring Early Training Representationscited by 0
  19. 2024Dynamic Gradient Influencing for Viral Marketing Using Graph Neural Networkscited by 0
  20. 2024Graph Adversarial Diffusion Convolutioncited by 0
  21. 2024Normalized Space Alignment: A Versatile Metric for Representation Analysiscited by 0
  22. 2025Boosting Graph Robustness Against Backdoor Attacks: An Over-Similarity Perspectivecited by 0
  23. 2025EvA: Evolutionary Attacks on Graphscited by 0
  24. 2026Adversarial Graph Neural Network Benchmarks: Towards Practical and Fair Evaluationcited by 0
  25. 2026Self-supervised Adversarial Purification for Graph Neural Networkscited by 0
  26. 2026Let Prompts Bridge Defense Knowledge: Transferable Graph Purification via Vulnerability-Aware GPLcited by 0