Rethinking Generative Reconstruction Attacks against Graph Neural Network Models

Evolutionary graph structure learning for adversarial defense in GNNs

Graph Adversarial Defense with Virtual Spectral Anchor Injection

Graph Neural Networks (GNNs) have demonstrated superior performance in various graph learning tasks such as node classification and link prediction. However, recent studies have shown that GNNs are highly vulnerable to graph adversarial attacks. To enhance the robustness of GNNs, existing defense strategies have primarily focused on adversarial training on graph data, graph purification, or certifiable robustness. Different from the conventional defense paradigms, we propose Anchor Node Injection Enhancement (ANIE), an active paradigm that repurposes the offensive tactic of node injection into a structural defense. ANIE injects virtual ''auxiliary anchor nodes'' to stabilize the graph's spectral manifold through Dirichlet energy minimization. By establishing robust class prototypes, ANIE reinforces class-wise structural stability and guides perturbed nodes back to correct manifolds. As an attack-agnostic and ''plug-and-play'' framework, ANIE requires no physical modification of the original graph and generalizes to both transductive and inductive settings. Empirical results across multiple benchmarks demonstrate that ANIE significantly enhances GNN robustness, outperforming state-of-the-art defenses by up to 2× in classification accuracy under poisoning and evasion attacks.

Defending against Model Extraction for GNNs with Model Reprogramming

Graph Neural Networks (GNNs) serve as the backbone for high-stakes applications in Machine-Learning-as-a-Service (MLaaS). Still, their black-box deployment exposes them to Model Extraction (ME) attacks, in which adversaries steal intellectual property by querying APIs. Existing defenses suffer from a critical ''Euclidean bias'': they transfer image-based strategies (e.g., random noise) to graphs, ignoring the complex topological dependencies between nodes, which often results in severe utility degradation. Passive methods like watermarking also fail to prevent theft in real time. To bridge this gap, we propose GraphRP (Graph Reprogramming Protection), a proactive defense framework that repurposes Model Reprogramming for security. Unlike static perturbations, GraphRP introduces a Structure-Aware Gating Mechanism driven by learnable topological prototypes. This creates a dynamic ''structural firewall'' that selectively modulates the model's decision boundary: it preserves fidelity for benign queries residing on the training manifold, while maximizing the Fisher Information along the perturbation direction for adversarial queries. Under standard assumptions (bounded loss, optimal attacker, and local second-order approximation), we prove a lower bound on the attacker's estimation error that increases with the structural sensitivity of the reprogramming noise. Extensive experiments on both hard-label and soft-label ME attacks demonstrate that GraphRP significantly degrades attack effectiveness while preserving benign utility.

Cognitive Graph Intelligence for Adaptive and Robust DDoS Attack Detection in Next Generation Networks

By integrating temporal graph construction, adversarial augmentation, and GCN classification, GraphGAN effectively models coordinated attack behaviors and mitigates class imbalance, providing a robust and topology-aware solution for intrusion detection in data-constrained environments.

Generate and Filter: A GNN-Based Approach for Graph Anomaly Detection.

Graph anomaly detection (GAD) aims to distinguish anomalies from the majority of normal nodes in graph-structured data. Due to its extensive real-world applications, GAD has garnered increasing attention from both academia and industry. Recently, Graph Neural Networks (GNNs) have been integrated into GAD frameworks, yielding promising results by effectively characterizing structural information. However, existing GNN based methods suffer from several critical limitations: (I) the difficulty of learning discriminative representations for anomalies in the feature space; (II) the structural sparsity caused by the lack of essential connections between anomalies; and (III) the camouflage effect resulting from redundant edges between anomalies and normal nodes. To address these challenges, we propose a novel framework, Generate and Filter graph learning for Graph Anomaly Detection (GFGAD). Specifically, GFGAD first generates a diverse set of synthetic anomalies with enriched feature and structural information to balance the data distribution. Subsequently, these generated anomalies are strategically connected to original ones to compensate for missing structural patterns, while a filtering mechanism is employed to eliminate redundant connections and mitigate camouflage. Extensive experiments on several benchmark datasets demonstrate that GFGAD significantly outperforms state-of-the-art baselines.

TGPA: Transferable graph prompt attack with hierarchical subgraph augmentation.

Graph prompt learning effectively mitigates the challenges associated with complex tuning processes, which can address the inherent inconsistency between downstream tasks and pre-training objectives. As graph prompts play a pivotal role in the inference of graph pre-trained models, the malicious attacks on graph prompts can substantially compromise the predictive accuracy of model. Unfortunately, existing graph adversarial attacks largely rely on single-scale topological perturbations, which overlook the multi-granular structural dependencies that graph prompts use to transfer knowledge. Consequently, they fail to maintain transferability across different downstream tasks. To alleviate this issue, we propose a novel transferable graph prompt attack, called TGPA, which shifts the attack paradigm by introducing a hierarchical structural decoupling mechanism. Specifically, the hierarchical subgraph information extraction is first employed to obtain the global information and local information. Subsequently, the corresponding node selection based on local and global knowledge is utilized to identify the target nodes. Finally, the perturbations between features and structures are applied to generate malicious samples through the selection of target nodes, which can be utilized to mislead the graph prompt learning. Large-scale experiments across multiple popular graph datasets demonstrate that TGPA successfully reduces the performance of pre-trained graph models with graph prompts by up to 28.9%, while guaranteeing robustness, stealthiness, and transferability.