Unveiling the Vulnerability of Graph-LLMs: An Interpretable Multi-Dimensional Adversarial Attack on TAGs

TL;DR

The paper tackles the vulnerability of Graph-LLMs operating on text-attributed graphs by presenting IMDGA, a black-box, interpretable multi-dimensional attack framework that jointly perturbs textual content and graph structure. IMDGA integrates three modules—Topological SHAP for topology-aware word attribution, Semantic Perturbation using a masked language model for contextually plausible substitutions, and Edge Pruning guided by Shapley-inspired edge attributions to target critical connections—yielding high attack effectiveness and stealth. The authors provide theoretical analysis and extensive experiments on Cora, Citeseer, PubMed, and ogbn-arxiv across multiple backbones and Graph-LLMs, showing superior ASR and robustness relative to text-only and graph-only baselines. They demonstrate that vulnerabilities in TAG representations arise from the non-decoupled text encoding and message passing in Graph-LLMs, and emphasize the need for defense mechanisms. The work offers practical insights into attack design and interpretability, and releases code to facilitate defense-oriented research in Graph-LLMs against sophisticated adversarial threats.

Abstract

Graph Neural Networks (GNNs) have become a pivotal framework for modeling graph-structured data, enabling a wide range of applications from social network analysis to molecular chemistry. By integrating large language models (LLMs), text-attributed graphs (TAGs) enhance node representations with rich textual semantics, significantly boosting the expressive power of graph-based learning. However, this sophisticated synergy introduces critical vulnerabilities, as Graph-LLMs are susceptible to adversarial attacks on both their structural topology and textual attributes. Although specialized attack methods have been designed for each of these aspects, no work has yet unified them into a comprehensive approach. In this work, we propose the Interpretable Multi-Dimensional Graph Attack (IMDGA), a novel human-centric adversarial attack framework designed to orchestrate multi-level perturbations across both graph structure and textual features. IMDGA utilizes three tightly integrated modules to craft attacks that balance interpretability and impact, enabling a deeper understanding of Graph-LLM vulnerabilities. Through rigorous theoretical analysis and comprehensive empirical evaluations on diverse datasets and architectures, IMDGA demonstrates superior interpretability, attack effectiveness, stealthiness, and robustness compared to existing methods. By exposing critical weaknesses in TAG representation learning, this work uncovers a previously underexplored semantic dimension of vulnerability in Graph-LLMs, offering valuable insights for improving their resilience. Our code and resources are publicly available at https://anonymous.4open.science/r/IMDGA-7289.

Figures (5)

• Figure 1: Illustration of different adversarial attack spaces
• Figure 2: An overview of IMDGA framework, illustrating the key components and methodologies.
• Figure 3: Feature-cosine homophily (before and after attack).
• Figure 4: Degree distributions (before and after attack).
• Figure 5: Sensitivity of IMDGA (① represents the full IMDGA and ② denotes text-only perturbations).