Bounding the Expected Robustness of Graph Neural Networks Subject to Node Feature Attacks
Yassine Abbahaddou, Sofiane Ennadir, Johannes F. Lutzeyer, Michalis Vazirgiannis, Henrik Boström
TL;DR
This work defines the concept of expected robustness for graph neural networks under node feature perturbations and derives theoretical $\gamma$-type upper bounds that link robustness to layer-weight norms and graph walk structure. Building on these insights, it introduces GCORN, a robust GCN variant that enforces approximate weight orthonormality to reduce sensitivity to feature perturbations, and it presents a model-agnostic probabilistic estimator to quantify $Adv^{\alpha,\beta}_{\epsilon}[f]$ in real-world settings. The paper extends the robustness analysis to other GNNs (e.g., GINs) and demonstrates, through extensive experiments on node and graph classification benchmarks, that GCORN achieves superior robustness compared with existing defenses while preserving accuracy. A probabilistic evaluation framework based on uniform sampling within an $\epsilon$-ball enables attack-agnostic robustness assessment and yields practical, certified robustness gains via smoothing-based certificates. Overall, the work provides theoretical guarantees, a robust architectural design, and a practical evaluation protocol for node-feature adversarial robustness in graph learning.
Abstract
Graph Neural Networks (GNNs) have demonstrated state-of-the-art performance in various graph representation learning tasks. Recently, studies revealed their vulnerability to adversarial attacks. In this work, we theoretically define the concept of expected robustness in the context of attributed graphs and relate it to the classical definition of adversarial robustness in the graph representation learning literature. Our definition allows us to derive an upper bound of the expected robustness of Graph Convolutional Networks (GCNs) and Graph Isomorphism Networks subject to node feature attacks. Building on these findings, we connect the expected robustness of GNNs to the orthonormality of their weight matrices and consequently propose an attack-independent, more robust variant of the GCN, called the Graph Convolutional Orthonormal Robust Networks (GCORNs). We further introduce a probabilistic method to estimate the expected robustness, which allows us to evaluate the effectiveness of GCORN on several real-world datasets. Experimental experiments showed that GCORN outperforms available defense methods. Our code is publicly available at: \href{https://github.com/Sennadir/GCORN}{https://github.com/Sennadir/GCORN}.