Source-linked AI summary
Recent Advances in Reliable Deep Graph Learning: Inherent Noise, Distribution Shift, and Adversarial Attack
Jintang Li, Bingzhe Wu, Chengbin Hou, Guoji Fu, Yatao Bian, Liang Chen, Junzhou Huang, Zibin Zheng
TL;DR
Deep graph learning faces reliability threats from inherent noise, distribution shift, and adversarial attacks, while prior related surveys mainly focused on adversarial attacks. This survey reviews techniques and relationships across all three threats, and identifies open problems and future research directions.
Problem
Real-world DGL faces reliability threats from inherent noise, distribution shift, and adversarial attacks, while prior surveys mainly focused on adversarial attacks.
Source: §1 · pp. 1–2Method
Results
The survey presents inherent noise as a source of aleatoric uncertainty and distribution shift and adversarial attack as sources of epistemic uncertainty.
Source: §5 · pp. 6–7Takeaways & Limitations
The survey aims to help researchers understand relationships among threats and choose appropriate techniques for applications, while highlighting challenges and future opportunities.
Source: §6 · p. 7Formal theoretical frameworks for analyzing reliable DGL methods remain lacking, including for out-of-distribution generalization bounds.
Source: §6 · p. 7
Abstract
from arXiv · showhide
Deep graph learning (DGL) has achieved remarkable progress in both business and scientific areas ranging from finance and e-commerce to drug and advanced material discovery. Despite the progress, applying DGL to real-world applications faces a series of reliability threats including inherent noise, distribution shift, and adversarial attacks. This survey aims to provide a comprehensive review of recent advances for improving the reliability of DGL algorithms against the above threats. In contrast to prior related surveys which mainly focus on adversarial attacks and defense, our survey covers more reliability-related aspects of DGL, i.e., inherent noise and distribution shift. Additionally, we discuss the relationships among above aspects and highlight some important issues to be explored in future research.
1 Introduction
Deep graph learning has advanced across business and scientific applications, yet real-world use faces reliability threats from inherent noise, distribution shift, and adversarial attacks. This survey reviews work on all three threats, their relationships, and open research problems.
1 Introduction
- DGL faces three reliability threats: inherent noise, training–testing distribution shift, and adversarial attacks that manipulate data to cause model misbehavior.Inherent noise and distribution shift can arise without deliberate human design, whereas adversarial attacks are intentionally designed after data generation.Source: §1 · p. 1
- DGL has progressed in finance, e-commerce, drug discovery, and advanced-material discovery.Examples include fraud detection [Dou et al., 2020], recommendation systems [Wu et al., 2021a], and scientific discovery.Source: §1 · p. 1
- The survey reviews reliability-enhancing techniques and limitations for each threat, then discusses how the threats relate and identifies open research problems.The review spans robust architectures, optimization policies, and uncertainty quantification.Source: §1 · p. 1
- Unlike prior surveys focused mainly on adversarial attacks, this survey covers inherent noise and distribution shift alongside adversarial attacks.Related work had only two recent surveys focused on structure noise or distribution shift, respectively [Zhang and Pei, 2021] [Li et al., 2022a].Source: §1 · p. 2
2 Reliability against Inherent Noise
Inherent noise occurs naturally in graph structures, node attributes, and labels, and can affect message passing and learned representations. The survey reviews denoising and regularization approaches while identifying challenges in handling multiple noise types.
2.1 Inherent noise on graphs
- Inherent noise spans graph structure, node attributes, and node or graph labels, and may arise from measurement, preprocessing, or graph-construction issues.These three types are represented as D = (A + ϵa, X + ϵx, Y + ϵy), where the noise terms correspond to structure, attributes, and labels.Source: §2.1 · p. 2, §2 · p. 2
- Structure noise can disrupt topology-based information propagation, while attribute noise can spread from nodes to neighbors and label noise can be overfit by DGL models.Graph labels can be costly to annotate, and node labels may be harder to annotate than image labels because of structure dependency.Source: §2.1 · p. 3
2.2 Techniques against inherent noise
- Denoising methods include learnable edge weights or task-irrelevant edge pruning, diffusion-based reconstruction of missing attributes, and label correction or reweighting.Some label-noise approaches incorporate graph structure through random walks or pseudo-labels and high-quality edges.Source: §2.2 · p. 3
- Dedicated methods for denoising attribute noise beyond reconstructing incomplete attributes are lacking, and selecting information during propagation remains less explored.The survey also highlights the potential value of using other noise-free information to denoise multiple noise types together.Source: §2.2 · p. 3
- Regularization methods reduce overfitting through dropping edges, nodes, or hidden representations, Bayesian graph learning, Mixup, constraints, and prior ensembles.The survey notes that message passing can propagate noise through graphs and that jointly diminishing multiple noise types is a promising direction.Source: §2.2 · p. 3
3 Reliability against Distribution Shift
Distribution shift occurs when graph-data distributions differ between training and testing, and the survey categorizes graph shifts and reviews methods to improve DGL reliability. It covers invariant learning, robust training, and uncertainty quantification, alongside graph test-time training as a research direction.
3 Reliability against Distribution Shift
- Distribution shift is a challenge for DGL because graph-data distributions differ between training and testing, and graph-specific discussions have been inadequate.The survey reviews graph-structured data and categorizes its typical shifts.Source: §3 · pp. 3–4
3.1 Distribution shift on graphs
- Graph distribution shift includes domain generalization, such as covariate shift and open-set recognition, and sub-population shift, such as fairness-related bias and label shift.Class imbalance on graphs is a special case of label shift.Source: §3.1 · p. 4
3.2 Techniques against distribution shift
- Methods address distribution shift through invariant graph representations, robust training with augmentation or adversarial perturbations, and uncertainty estimation or calibration.Uncertainty estimates can support rejection of decisions with high predictive uncertainty; graph test-time training adapts models using test samples, and a recent graph-transformation approach reports state-of-the-art performance in challenging settings including distribution shift.Source: §3.2 · pp. 4–5
4 Reliability against Adversarial Attack
Adversarial attacks seek to maximize DGL model loss using imperceptible graph perturbations, and current DGL algorithms remain vulnerable. The survey reviews attack forms and defenses, noting that adaptive-attack evaluation remains rare and many defenses are heuristic and attack-specific.
4.1 Adversarial attack on graphs
- Manipulation attacks alter graph edges or node attributes, with methods including greedy search, gradient-based perturbation, unsupervised contrastive-loss gradients, and black-box spectral approximation.The survey also categorizes attacks by training or inference phase and by whether they target specific instances or overall model performance.Source: §4.1 · p. 5
- Injection attacks add malicious nodes to spread information, but their success has been linked to severe damage to graph homophily.A proposed harmonious adversarial objective seeks to preserve homophily.Source: §4.1 · p. 5
- Universal attacks use one perturbation against any target node, reducing attack-generation cost, while graph-domain research remains open.Examples flip edges around anchor nodes or connect a small number of malicious nodes to them.Source: §4.1 · p. 5
- Backdoor attacks poison training with triggers that cause attacker-chosen behavior on trigger-bearing inputs while leaving other inputs normal.Backdoor attacks are relatively unexplored; the survey also notes an approach that generates a trigger node without modifying model parameters.Source: §4.1 · pp. 5–6
4.2 Techniques against adversarial attack
- Graph processing removes perturbations, while model robustification changes architecture or aggregation; data-processing methods are cheap but may fail against unseen attacks.Examples include pruning edges by feature similarity and using a robust median rather than a mean for neighborhood aggregation.Source: §4.2 · p. 6
- Adversarial training augments training data with handcrafted graph-structure or node-attribute perturbations, improving robustness to unseen attacks but adding training overhead and risking overfitting.The cited perturbations modify graph structure [Li et al., 2022b] or node attributes.Source: §4.2 · p. 6
- Robustness certification gives a lower bound on actual robustness and can guide architecture design, but remains relatively underexplored.Certificates have been studied for node attributes and graph structure, including collective guarantees for multiple predictions.Source: §4.2 · p. 6
- Current defenses are often heuristic and attack-specific, while evaluation against adaptive attacks remains rare.The survey reports that adaptive attacks can break defenses whose adversarial robustness was overestimated.Source: §4.2 · p. 6
5 Overall Discussion
The survey relates inherent noise, distribution shift, and adversarial attacks through uncertainty modeling while distinguishing their sources and reducibility. It also highlights that graph message passing can transmit these threats between nodes.
A unified view
- Inherent noise is treated as aleatoric uncertainty, while distribution shift and adversarial attacks are epistemic uncertainties that can be reduced with samples from other domains or subpopulations.The survey proposes that uncertainty estimation can help detect outliers, out-of-distribution samples, and adversarial samples.Source: §5 · p. 7
Difference among above threats
- All three threats can mismatch training and testing samples, but noise and shift arise during data generation, whereas attacks are deliberately designed afterward.The survey characterizes inherent noise as typically irreducible, unlike the other two threats, which can be alleviated with expert sampling.Source: §5 · p. 7
Difference to general reliable machine learning
- Message passing can transmit a node’s perturbation, noise, or shift to its neighbors, creating graph-specific reliability challenges.The survey says general reliable-ML methods need modification to account for relationships between nodes.Source: §5 · p. 7
6 Conclusion and Future Directions
The survey reviews reliability research across inherent noise, distribution shift, and adversarial attacks, and identifies future challenges spanning theory, unified methods, scalability, fairness, interpretability, and benchmarks.
Future directions
- A formal theoretical framework for analyzing reliable DGL methods is lacking, and out-of-distribution generalization bounds in DGL remain open.The survey identifies this as a theoretical-framework challenge.Source: §6 · p. 7
- Because multiple threats may occur simultaneously in real-world settings, the survey calls for unified solutions to mitigate their effects.Source: §6 · p. 7
- Reliability against adversarial attacks has mainly been studied on small graphs, leaving scalable methods for large, dynamically evolving graphs largely unexplored.The survey notes one recent attempt to address this challenge [Geisler et al., 2021].Source: §6 · p. 7
- Accuracy alone cannot assess overall reliability because performance and robustness may differ across attribute groups; the survey calls for fair, robust methods and broader metrics.Source: §6 · p. 7
- The relationship between counterfactual explanations and adversarial samples remains little studied in DGL, despite their reported connection in vision research.Source: §6 · p. 7
- Real-world reliability benchmarks are desired, but building a general platform across the survey’s reliability aspects remains challenging.An early OOD dataset curator and benchmark addresses distribution shift with data noise in AI-aided drug discovery.Source: §6 · p. 7