Certified Defense on the Fairness of Graph Neural Networks

TL;DR

This work tackles the problem of certifying the fairness of Graph Neural Networks under adversarial perturbations to both node attributes and graph structure. It introduces ELEGANT, a plug-and-play framework that builds a bias-indicator and applies randomized smoothing across both data modalities to produce provable fairness guarantees without re-training. The approach yields high fairness certification rates (FCR ~80-90%) while preserving predictive utility across multiple GNN backbones and real-world datasets, and remains robust under fairness-targeted attacks. Overall, ELEGANT enables safe, certifiable deployment of GNNs in fairness-critical applications and offers practical guidance for parameter choices and scalability.

Abstract

Graph Neural Networks (GNNs) have emerged as a prominent graph learning model in various graph-based tasks over the years. Nevertheless, due to the vulnerabilities of GNNs, it has been empirically shown that malicious attackers could easily corrupt the fairness level of their predictions by adding perturbations to the input graph data. In this paper, we take crucial steps to study a novel problem of certifiable defense on the fairness level of GNNs. Specifically, we propose a principled framework named ELEGANT and present a detailed theoretical certification analysis for the fairness of GNNs. ELEGANT takes {\em any} GNN as its backbone, and the fairness level of such a backbone is theoretically impossible to be corrupted under certain perturbation budgets for attackers. Notably, ELEGANT does not make any assumptions over the GNN structure or parameters, and does not require re-training the GNNs to realize certification. Hence it can serve as a plug-and-play framework for any optimized GNNs ready to be deployed. We verify the satisfactory effectiveness of ELEGANT in practice through extensive experiments on real-world datasets across different backbones of GNNs and parameter settings.

Figures (5)

• Figure 1: An example of how ELEGANT functions in the input space spanned by node attributes and graph structure.
• Figure 2: The utility of GCN, E-GCN, FairGNN, and NIFTY under fairness attacks on German Credit. The shaded bar indicates that certified budget $\epsilon_{\bm{A}} \leq \|\bm{\Delta}_{\bm{A}}\|_{0}$ or $\epsilon_{\bm{X}} \leq \|\bm{\Delta}_{\bm{X}}\|_{F}$.
• Figure 3: The bias levels of GCN, E-GCN, FairGNN, and NIFTY under fairness attacks on German Credit. The shaded bar indicates that certified budget $\epsilon_{\bm{A}} \leq \|\bm{\Delta}_{\bm{A}}\|_{0}$ or $\epsilon_{\bm{X}} \leq \|\bm{\Delta}_{\bm{X}}\|_{F}$. The y-axis is in logarithmic scale for visualization purposes.
• Figure 4: Parameter study of $\sigma$ over $\epsilon_{\bm{X}}$ (a) and $\beta$ over $\epsilon_{\bm{A}}$ (b). Experimental results are presented based on GCN over German credit and Credit Defaulter for (a) and (b), respectively. Similar tendencies of FCR value w.r.t. the threshold values can also be observed based on other GNNs and datasets.
• Figure 5: An example illustrating how ELEGANT works with a different order to achieve certified defense.

Theorems & Definitions (8)

• Definition 1
• Definition 2
• Theorem 1
• Definition 3
• Theorem 2
• Proposition 1
• proof
• proof