Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Expressivity of Graph Neural Networks Through the Lens of Adversarial Robustness

Francesco Campi, Lukas Gosch, Tom Wollschläger, Yan Scholten, Stephan Günnemann

TL;DR

The paper studies the empirical expressivity of provably powerful GNNs for subgraph counting through adversarial robustness. It introduces a sound adversarial framework and efficient attack strategies that expose a gap between theoretical counting capabilities (e.g., up to patterns of size four) and actual generalization under small structural perturbations and on out-of-distribution graphs. The experiments on synthetic SBM and ER graphs show that state-of-the-art architectures like PPGN and I$^2$-GNN are vulnerable to adversarial perturbations and fail to generalize counting beyond training distributions, even after retraining final prediction layers. These findings highlight the need for robustness-aware training and architecture designs to realize the theoretical expressivity of advanced GNNs in practice.

Abstract

We perform the first adversarial robustness study into Graph Neural Networks (GNNs) that are provably more powerful than traditional Message Passing Neural Networks (MPNNs). In particular, we use adversarial robustness as a tool to uncover a significant gap between their theoretically possible and empirically achieved expressive power. To do so, we focus on the ability of GNNs to count specific subgraph patterns, which is an established measure of expressivity, and extend the concept of adversarial robustness to this task. Based on this, we develop efficient adversarial attacks for subgraph counting and show that more powerful GNNs fail to generalize even to small perturbations to the graph's structure. Expanding on this, we show that such architectures also fail to count substructures on out-of-distribution graphs.

Expressivity of Graph Neural Networks Through the Lens of Adversarial Robustness

TL;DR

The paper studies the empirical expressivity of provably powerful GNNs for subgraph counting through adversarial robustness. It introduces a sound adversarial framework and efficient attack strategies that expose a gap between theoretical counting capabilities (e.g., up to patterns of size four) and actual generalization under small structural perturbations and on out-of-distribution graphs. The experiments on synthetic SBM and ER graphs show that state-of-the-art architectures like PPGN and I-GNN are vulnerable to adversarial perturbations and fail to generalize counting beyond training distributions, even after retraining final prediction layers. These findings highlight the need for robustness-aware training and architecture designs to realize the theoretical expressivity of advanced GNNs in practice.

Abstract

We perform the first adversarial robustness study into Graph Neural Networks (GNNs) that are provably more powerful than traditional Message Passing Neural Networks (MPNNs). In particular, we use adversarial robustness as a tool to uncover a significant gap between their theoretically possible and empirically achieved expressive power. To do so, we focus on the ability of GNNs to count specific subgraph patterns, which is an established measure of expressivity, and extend the concept of adversarial robustness to this task. Based on this, we develop efficient adversarial attacks for subgraph counting and show that more powerful GNNs fail to generalize even to small perturbations to the graph's structure. Expanding on this, we show that such architectures also fail to count substructures on out-of-distribution graphs.
Paper Structure (23 sections, 3 theorems, 8 equations, 10 figures, 7 tables, 3 algorithms)

This paper contains 23 sections, 3 theorems, 8 equations, 10 figures, 7 tables, 3 algorithms.

Table of Contents

  1. Introduction
  2. Background
  3. Subgraph-Counting
  4. Expressivity of Graph Neural Networks
  5. More Expressive Graph Neural Networks
  6. Related Work
  7. Robustness in Subgraph-Counting
  8. Subgraph-Counting Adversarial Examples
  9. Perturbation Spaces
  10. Subgraph-Counting Adversarial Attacks
  11. Sound Perturbations for Subgraph-Counting
  12. Construction of Adversarial Examples
  13. Experiments
  14. Adversarial Robustness
  15. Out-of-Distribution Generalization
  16. ...and 8 more sections

Key Result

Proposition 5.1

Consider a graph $G$ and a pattern $H$ with $\mathop{\mathrm{diam}}\nolimits(H) = d$. Then, for every edges $\{i,j\}$ we have that $\mathop{\mathrm{ego}}\nolimits_d(i)$ and $\mathop{\mathrm{ego}}\nolimits_d(j)$ contain all the subgraphs $G_S \subset G$ such that $G_S \simeq H$ and $i,j \in V_S$.

Figures (10)

  • Figure 1: GNN more powerful than 1-WL are not adversarially robust for subgraph-counting tasks.
  • Figure 2: Examples of graph patterns used for subgraph-counting.
  • Figure 3: Pair of undistinguishable graphs for MPNN with different triangle counts.
  • Figure 4: This Figure shows examples demonstrating that not all the count-preserving perturbations are also subgraph-preserving ones. On the left a subgraph- and count-preserving perturbation for 4-cycles where the red edge has been deleted. On the right a perturbation that leaves unchanged the count of 2-paths, but it deletes the induced substructure $\{2,3,4\}$ to generate $\{1,2,3\}$.
  • Figure 5: The plots illustrate in blue the success rate of our subgraph-counting adversarial attacks at finding perturbations that represent adversarial examples according to \ref{['def:adv example']} constrained and subgraph preserving perturbation spaces. In orange, we represent how effective the adversarial examples are when transferred to the models trained with a different initialization seed. The values are the average of the results obtained with 5 different initialization seeds with the relative standard errors.
  • ...and 5 more figures

Theorems & Definitions (5)

  • Definition 2.1
  • Definition 4.1
  • Proposition 5.1
  • Proposition 5.2
  • Proposition 1.1