arXiv Machine Learning

Can Subgraph Explanations Be Weaponized to Steal Graph Neural Networks?

Graph Machine Learning as a Service platforms now offer explainability interfaces to satisfy regulatory transparency, but this transparency can be exploited. The paper introduces a novel model extraction attack for graph classification that operates under strict black‑box constraints, using only discrete class labels and binary explanation masks. The method guides Monte Carlo edge sensitivity estimation toward decision boundaries with Hoeffding guarantees and narrows the search space using explanation subgraphs, outperforming comparable baselines on benchmark datasets.

arXiv Machine Learning
Sep 7

A Comparative Study of Counterfactual Explainers for Graph Neural Networks Enabling Multiple Types of Graph Edit

The paper presents a comparative analysis of six state‑of‑the‑art counterfactual explainers for graph neural networks, focusing on methods that can both add and remove edges to alter model predictions. It evaluates these explainers across diverse real‑world and synthetic datasets, covering binary and multi‑class graph and node classification tasks, using a range of quantitative and qualitative metrics. The study highlights the trade‑offs between explanation size, coverage, and quality, aiming to pinpoint each method’s strengths and weaknesses to inform future research.

By Maria Myrto Villia, Filippos Gouidis, Theodore Patkos, Panos Trahanias
arXiv AI
Sep 11

Kernel-Complexity Edge Sanitization for Training-Free Defense against Structural Graph Attacks

Kernel-Complexity Edge Sanitization (KCES) is a training‑free, model‑agnostic defense for Graph Neural Networks that identifies and removes edges with high Kernel‑Complexity (KC) scores, which are indicative of structural influence on the graph kernel complexity metric. KCES leverages a theoretical upper bound on GNN test error derived from the graph Gram matrix to compute edge‑specific KC scores, pruning edges that are empirically enriched with adversarial perturbations. The method is computationally efficient, scalable to large graphs, and consistently outperforms representative robust baselines across diverse attack settings without requiring retraining.

By Yaning Jia, Shenyang Deng, Yaoqing Yang, Chiyu Ma, Wenxuan Xu, Soroush Vosoughi
arXiv AI
Oct 19

Harnessing Trust in Directed Graphs: Redefining Robustness of Graph Learning

The paper reexamines robustness in Graph Neural Networks (GNNs) by focusing on directed graphs, which have been largely ignored in prior work. It introduces a more realistic attack setting for directed graphs and proposes a simple message‑passing defense that can be added as a plug‑in layer. The authors demonstrate that leveraging the trust signals inherent in link directions can significantly enhance GNN robustness, achieving state‑of‑the‑art performance while maintaining strong clean accuracy against both transfer and adaptive attacks.

By Zhichao Hou, Xitong Zhang, Wei Wang, Charu C. Aggarwal, Xiaorui Liu