Skip to content
Log in
Book Open access

Graph Adversarial Defense with Virtual Spectral Anchor Injection

Xiangchao Wen Zhen Liu Yunfei Liu
Aug 2026 · Proceedings of the 32nd ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.2 · 0 citations · 28 references

TL;DR

An active paradigm that repurposes the offensive tactic of node injection into a structural defense, ANIE significantly enhances GNN robustness, outperforming state-of-the-art defenses by up to 2× in classification accuracy under poisoning and evasion attacks.

Abstract

Graph Neural Networks (GNNs) have demonstrated superior performance in various graph learning tasks such as node classification and link prediction. However, recent studies have shown that GNNs are highly vulnerable to graph adversarial attacks. To enhance the robustness of GNNs, existing defense strategies have primarily focused on adversarial training on graph data, graph purification, or certifiable robustness. Different from the conventional defense paradigms, we propose Anchor Node Injection Enhancement (ANIE), an active paradigm that repurposes the offensive tactic of node injection into a structural defense. ANIE injects virtual ''auxiliary anchor nodes'' to stabilize the graph's spectral manifold through Dirichlet energy minimization. By establishing robust class prototypes, ANIE reinforces class-wise structural stability and guides perturbed nodes back to correct manifolds. As an attack-agnostic and ''plug-and-play'' framework, ANIE requires no physical modification of the original graph and generalizes to both transductive and inductive settings. Empirical results across multiple benchmarks demonstrate that ANIE significantly enhances GNN robustness, outperforming state-of-the-art defenses by up to 2× in classification accuracy under poisoning and evasion attacks.

DOI Semantic Scholar
Read PDF

Similar papers

Jul 2026

Evolutionary graph structure learning for adversarial defense in GNNs

This research introduces a new graph adversarial attack protection approach termed evolutionary algorithm integration of neighbor importance estimate to tackle this issue and attains notably superior performance in comparison to alternative defense methodologies.

Hong Pan, Jingwei Guo, Liang Cheng et al. · 0 citations
Preprint Jul 2026

Target-Aware Interaction-Guided Reinforcement Learning for Black-Box Node Injection Attacks on Graph Neural Networks

Graph Neural Networks (GNNs) have achieved remarkable performance in graph representation learning, yet their inherent vulnerability to adversarial attacks poses severe security risks. Especially, black-box node injection attacks have become a major threat to GNNs since they inject malicious nodes without altering the original graph topology. However, they typically decouple the generation of malicious node features and edge connections, thereby resulting in suboptimal attack efficacy under stringent budgets. To address this critical issue, this study proposes a novel Target-aware Interaction-guided Reinforcement learning for Black-box node injection Attacks on GNNs (TIRBA), which formulates the attack as a Markov Decision Process and jointly optimizes node feature generation and edge construction in a heterogeneous action space. Firstly, TIRBA designs a target-aware interaction encoder to fuse information of node features and edges. Further, it introduces a class-center guidance mechanism to utilize prior class distribution information, thereby guiding efficient exploration of the high-dimensional feature space. Finally, a topology difference-aware state value evaluation is adopted to explicitly capture local structural anomalies caused by injected nodes, thereby stabilizing the reinforcement learning training process. Experimental results demonstrate that the proposed TIRBA significantly outperforms state-of-the-art black-box node injection attack methods.

Yingren Lan, Ye Yuan · 0 citations
2025

LoSplit: Loss-Guided Dynamic Split for Training-Time Defense Against Graph Backdoor Attacks

LoSplit is proposed, the first training-time defense framework in graph that leverages this early-stage loss drift to accurately split target nodes, and dynamically selects epochs with maximal loss divergence, clusters target nodes via Gaussian Mixture Models, and applies a Decoupling-Forgetting strategy to break the association between target nodes and malicious label.

Di Jin, Yuxiang Zhang, Bingdao Feng et al. · 4 citations
Open access Aug 2026

TGPA: Transferable graph prompt attack with hierarchical subgraph augmentation.

A novel transferable graph prompt attack, called TGPA, is proposed, which shifts the attack paradigm by introducing a hierarchical structural decoupling mechanism, which reduces the performance of pre-trained graph models with graph prompts by up to 28.9%, while guaranteeing robustness, stealthiness, and transferability.

Ju Jia, Haonan Wang, Tian Wu et al. · 0 citations