Mitigating the Structural Bias in Graph Adversarial Defenses

TL;DR

This work addresses the dual challenges of graph adversarial robustness and structural bias favoring high-degree nodes. It introduces De2GNN, a defense framework that combines a hetero-homo augmented graph (removing heterophilic edges and adding homophilic edges for tail nodes) with a $k$NN-based augmentation, and fuses information from two graph views via a node-wise attention mechanism. Empirical results on Cora, Citeseer, and Pubmed show that De2GNN achieves strong defense against Metattack while significantly reducing prediction bias toward tail nodes, outperforming baselines in both clean and attacked scenarios. The proposed approach offers a practical and scalable solution to robust graph learning with fairer performance across node degrees, enhancing applicability in real-world networks.

Abstract

In recent years, graph neural networks (GNNs) have shown great potential in addressing various graph structure-related downstream tasks. However, recent studies have found that current GNNs are susceptible to malicious adversarial attacks. Given the inevitable presence of adversarial attacks in the real world, a variety of defense methods have been proposed to counter these attacks and enhance the robustness of GNNs. Despite the commendable performance of these defense methods, we have observed that they tend to exhibit a structural bias in terms of their defense capability on nodes with low degree (i.e., tail nodes), which is similar to the structural bias of traditional GNNs on nodes with low degree in the clean graph. Therefore, in this work, we propose a defense strategy by including hetero-homo augmented graph construction, $k$NN augmented graph construction, and multi-view node-wise attention modules to mitigate the structural bias of GNNs against adversarial attacks. Notably, the hetero-homo augmented graph consists of removing heterophilic links (i.e., links connecting nodes with dissimilar features) globally and adding homophilic links (i.e., links connecting nodes with similar features) for nodes with low degree. To further enhance the defense capability, an attention mechanism is adopted to adaptively combine the representations from the above two kinds of graph views. We conduct extensive experiments to demonstrate the defense and debiasing effect of the proposed strategy on benchmark datasets.

Figures (8)

• Figure 1: Degree distributions of Cora and Citeseer datasets.
• Figure 2: Accuracy of GCN with regard to node degree on Cora and Citeseer datasets without attacks.
• Figure 3: Accuracy of Jaccard with regard to node degree on Cora and Citeseer datasets by injecting 25% of noisy links via Metattack.
• Figure 4: Accuracy of SVD with regard to node degree on Cora and Citeseer datasets by injecting 25% of noisy links via Metattack.
• Figure 5: Systematic framework of De2GNN. Red links in the input graph indicate corresponding adversarial noises.