LLM增强的图神经网络在对抗污染攻击下表现更稳健,值得深入研究。
Are LLM-Enhanced Graph Neural Networks Robust against Poisoning Attacks?
- 构建框架系统评估LLM增强图神经网络在多种攻击下的鲁棒性
- 在6种结构攻击和3种文本攻击下,准确率更高,相对下降率更低
- 适合关注模型安全与图数据防御的研究者
大型语言模型(LLMs)通过引入语义特征增强了节点表示,推动了LLM增强型图神经网络(GNNs)的发展,性能显著提升。然而,这类模型在训练过程中面对同时操纵图结构和文本属性的污染攻击时的鲁棒性尚未被探索。为此,本文提出一个系统的鲁棒性评估框架,对24个目标模型进行综合测试:结合8种基于LLM或语言模型的特征增强方法与3种典型GNN主干网络。为覆盖多样攻击场景,引入6种结构化污染攻击(包括定向与非定向)及3种文本级攻击(字符、词、句层面)。使用4个真实数据集,其中包含1个在LLM兴起后发布的数据集,以避免预训练阶段的真值泄露,保障评估公平性。大量实验表明,相较于浅层嵌入基线,LLM增强型GNN在各类攻击设置下均表现出更高的准确率和更低的相对准确率下降(RDA)。深入分析揭示其鲁棒性的关键因素,如节点表示中有效编码了结构与标签信息。基于此,从攻防双重视角提出未来研究方向,并设计一种新型联合攻击与图净化防御策略。代码已开源,支持后续研究。
原文摘要 · Abstract (English)
Large Language Models (LLMs) have advanced Graph Neural Networks (GNNs) by enriching node representations with semantic features, giving rise to LLM-enhanced GNNs that achieve notable performance gains. However, the robustness of these models against poisoning attacks, which manipulate both graph structures and textual attributes during training, remains unexplored. To bridge this gap, we propose a robustness assessment framework that systematically evaluates LLM-enhanced GNNs under poisoning attacks. Our framework enables comprehensive evaluation across multiple dimensions. Specifically, we assess 24 victim models by combining eight LLM- or Language Model (LM)-based feature enhancers with three representative GNN backbones. To ensure diversity in attack coverage, we incorporate six structural poisoning attacks (both targeted and non-targeted) and three textual poisoning attacks operating at the character, word, and sentence levels. Furthermore, we employ four real-world datasets, including one released after the emergence of LLMs, to avoid potential ground truth leakage during LLM pretraining, thereby ensuring fair evaluation. Extensive experiments show that LLM-enhanced GNNs exhibit significantly higher accuracy and lower Relative Drop in Accuracy (RDA) than a shallow embedding-based baseline across various attack settings. Our in-depth analysis identifies key factors that contribute to this robustness, such as the effective encoding of structural and label information in node representations. Based on these insights, we outline future research directions from both offensive and defensive perspectives, and propose a new combined attack along with a graph purification defense. To support future research, we release the source code of our framework at~\url{https://github.com/CyberAlSec/LLMEGNNRP}.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。