PaperlayerView exact revision on arXiv

Source-linked AI summary

A Comprehensive Survey on Trustworthy Graph Neural Networks: Privacy, Robustness, Fairness, and Explainability

Enyan Dai, Tianxiang Zhao, Huaisheng Zhu, Junjie Xu, Zhimeng Guo, Hui Liu, Jiliang Tang, Suhang Wang

arXiv:2204.08570v2cs.LGcs.CR

TL;DR

GNNs are increasingly used in high-stakes settings, but can leak private information, suffer adversarial manipulation, magnify bias, and remain difficult to interpret. This survey synthesizes trustworthy GNN research across privacy, robustness, fairness, and explainability through taxonomies, general frameworks, applications, and future directions. It also identifies interactions among these aspects and highlights open challenges including scalability, missing sensitive attributes, and under-explored class-level explanations.

  • Problem

    GNNs face privacy, robustness, fairness, and explainability concerns that can risk harm in applications, motivating a comprehensive trustworthy-GNN synthesis.

  • Method

    The survey categorizes methods across four trustworthiness dimensions, formulates general frameworks, reviews applications, and discusses future directions and cross-dimension interactions.

  • Results

    The survey provides a comprehensive review of privacy, robustness, fairness, and explainability methods, including recent trends, numerical applications, and research directions.

  • Takeaways & Limitations

    Trustworthy GNN research must consider multiple dimensions together, including their interactions and practical application settings.

  • Takeaways & Limitations

    Scalable robust defenses remain limited, fairness methods commonly require sensitive attributes, and class-level explainability remains under-explored.

Abstract

from arXiv · show

Graph Neural Networks (GNNs) have made rapid developments in the recent years. Due to their great ability in modeling graph-structured data, GNNs are vastly used in various applications, including high-stakes scenarios such as financial analysis, traffic predictions, and drug discovery. Despite their great potential in benefiting humans in the real world, recent study shows that GNNs can leak private information, are vulnerable to adversarial attacks, can inherit and magnify societal bias from training data and lack interpretability, which have risk of causing unintentional harm to the users and society. For example, existing works demonstrate that attackers can fool the GNNs to give the outcome they desire with unnoticeable perturbation on training graph. GNNs trained on social networks may embed the discrimination in their decision process, strengthening the undesirable societal bias. Consequently, trustworthy GNNs in various aspects are emerging to prevent the harm from GNN models and increase the users' trust in GNNs. In this paper, we give a comprehensive survey of GNNs in the computational aspects of privacy, robustness, fairness, and explainability. For each aspect, we give the taxonomy of the related methods and formulate the general frameworks for the multiple categories of trustworthy GNNs. We also discuss the future research directions of each aspect and connections between these aspects to help achieve trustworthiness.

1 INTRODUCTION

GNNs model graph-structured data across domains, but their privacy, robustness, fairness, and explainability risks motivate trustworthy GNN research. This survey organizes methods across these dimensions and discusses their interactions and future directions.

  • GNNs and their applications: GNNs extend deep learning to graph-structured data and use message passing to aggregate information from neighboring nodes.They have been applied in finance, healthcare, and social analysis.
  • Trustworthiness concerns: GNNs can expose private information, be manipulated through graph attacks, magnify training-data bias, and lack interpretability.Reported risks include inferring attributes or friendships and injecting malicious nodes to induce target predictions.
  • Trustworthy AI principles: Trustworthy AI principles highlighted here include respect for human autonomy, prevention of harm, fairness, and explainability.The survey does not focus on respect for human autonomy because it generally fails in human-computer interaction.
  • Survey scope: Existing trustworthy GNN literature spans privacy-preserving, robust, fair, and explainable models, but prior surveys do not comprehensively cover these dimensions together.The survey also addresses emerging directions including scalable attacks, backdoor attacks, and self-explainable GNNs.
  • Survey contributions: The survey discusses methods, taxonomies, general frameworks, applications, future directions, and interactions among trustworthy GNN dimensions.Its coverage includes privacy attacks and defenses, adversarial robustness, fairness, and explainability.

2 PRELIMINARIES OF GRAPH NEURAL NETWORKS

The preliminaries define graph notation, describe GNN message passing and graph-level readout, and introduce node, link, and graph analysis tasks.

  • Notations: A graph is represented as G = (V, E), with node attributes X and adjacency matrix A indicating connected node pairs.For attributed graphs, each node attribute is d-dimensional.
  • GNN inner working: GNN layers update node representations by aggregating neighborhood information, so a k-layer model captures k-hop local graph information.The resulting node representation can support node classification.
  • GNN inner working: Graph classification applies a READOUT function, such as max or average pooling, to node embeddings before prediction.READOUT produces a graph embedding h_G for downstream classification.
  • GCN architecture: GCN layers transform node representations using a normalized adjacency matrix, learnable layer parameters, and an activation function.The normalized adjacency incorporates self-loops through A + I.
  • Graph analysis tasks: Graph analysis tasks include node classification, link prediction, community detection, and graph classification.Applications include user-attribute prediction, friend recommendation, and drug-property prediction.

3 PRIVACY OF GRAPH NEURAL NETWORKS

GNNs rely on sensitive data and may expose learned information, while graph topology and message passing create privacy challenges not addressed by i.i.d.-focused methods. The survey reviews attacks, defenses, datasets, applications, and future directions for privacy-preserving GNNs.

  • Privacy motivation: Sensitive data support GNN applications in healthcare, banking, and bioinformatics, while query APIs and released pretrained models create exposure points.The passage cites brain-network fMRI analysis as an example of sensitive-data use.
  • Research gap: Prior machine-learning privacy surveys focus mainly on i.i.d. data such as images and text and rarely address graph privacy attacks and defenses.The survey identifies graph topology and GNN message passing as challenges for directly applying those methods.
  • Survey scope: The survey reviews privacy attacks and privacy-preserving GNNs, includes relevant datasets and applications, and identifies future research directions.Its privacy coverage is organized around graph-specific attacks and defenses.

3.1 Taxonomy of Privacy Attacks

Privacy attacks on GNNs target information from training graphs or model parameters and are categorized by target information and attacker knowledge. The survey distinguishes membership, reconstruction, white-box, and black-box settings.

  • Attack taxonomy: Privacy attacks may target training-graph membership, node attributes, graph connections, or GNN model parameters.The survey categorizes attacks according to the private information they seek.
  • Attack types: Membership inference determines whether a target node, subgraph, or graph belongs to the training data.In a healthcare social-network example, this can reveal whether a subject is in the training patient network.
  • Attack types: Reconstruction attacks infer private input-graph information, including topology through structure reconstruction and node properties through attribute reconstruction.They are also called model inversion or attribute inference attacks in the relevant cases.
  • Taxonomy tables: Table 1 organizes privacy attacks by attack type, while Table 2 categorizes methods by assumptions about attacker knowledge.The survey introduces detailed methods after presenting these categorizations.
  • Attacker knowledge: White-box attacks assume access to model parameters or training gradients, whereas black-box attacks operate without those parameters.White-box attacks may additionally require target nodes or graphs and a shadow dataset.

3.2 Methods of Privacy Attack on GNNs

Privacy attacks on GNNs use target-model outputs or embeddings to infer membership, sensitive attributes, links, graph properties, or model behavior. The survey organizes these attacks through a unified shadow-training framework and discusses black-box and white-box variants.

  • Unified framework: The unified framework trains an attack model on shadow-data outputs from a target model, then applies it to target examples.Attack labels are obtained from the shadow dataset, and the attack predicts privacy information from target-model outputs.
  • Attack settings: The survey’s privacy-attack discussion includes supervised attacks, membership inference, reconstruction, property inference, and model extraction across black-box and white-box settings.White-box reconstruction can use known trained model parameters, whereas earlier methods focus on black-box access.
  • Membership inference attack: Membership inference determines whether a sample was used to train the target GNN from differences in training and test prediction-vector distributions.Shadow training provides positive and negative examples for an attacker such as logistic regression.
  • Reconstruction attack: Reconstruction attacks infer sensitive attributes or links from node or graph embeddings, using MLP-based attribute, link, or adjacency reconstruction.Link inference can instead use pairs of node prediction vectors when embeddings are unavailable.
  • Other privacy attacks: Property inference uses graph embeddings to infer properties of a target graph, while model extraction learns a surrogate model that mimics the target model.Extraction settings vary with the attacker’s knowledge of shadow-data structure and the target training graph.

3.3 Privacy-Preserving Graph Neural Networks

Privacy-preserving GNNs organize defenses around differential privacy, federated learning, machine unlearning, adversarial privacy preservation, and model ownership verification. These methods protect graph data through noise, decentralized computation, selective retraining or updating, information bottlenecks, and ownership identifiers.

  • Privacy-preserving GNNs are categorized into differential privacy, federated learning, machine unlearning, adversarial privacy-preserving, and model ownership verification.
  • Differential Privacy: Differential privacy controls the influence of individual records by making algorithm outputs on adjacent datasets similar.Gaussian and Laplace mechanisms inject calibrated noise to achieve the privacy guarantee.
  • Other Membership-Privacy Methods: RM-GIB combines membership-privacy protection and adversarial defense through attribute and neighbor bottlenecks, information-bottleneck regularization, and pseudo-label integration.The bottlenecks remove redundant information or adversarial perturbations from node attributes and graph topology.
  • Federated Learning: Federated learning keeps data and local models on clients while a server aggregates model updates into global parameters.FedAvg is identified as the first and most commonly used federated learning algorithm.
  • Federated Learning: Federated GNN methods address non-i.i.d. graphs, recommendation, encoded private computations, local differential privacy, and decentralized aggregation.Some methods dynamically cluster clients using GNN gradients, while others aggregate with neighboring clients without a central server.
  • Model Ownership Verification: GNN ownership verification uses invasive watermarking or noninvasive fingerprinting to embed or construct detectable intellectual-property identifiers.Watermarking methods use trigger graphs as secret keys and target classes as IP messages.

3.4 Datasets for Privacy-Preserving GNNs

Privacy-preserving GNN research uses datasets representing citation networks and their paper, citation, class, and textual-feature structures. Cora, CiteSeer, PubMed, and DBLP are highlighted as citation-network datasets.

  • Cora, CiteSeer, PubMed, and DBLP are citation-network datasets used in privacy-related GNN research.
  • In these datasets, papers are nodes, citations are edges, and node features are defined by words appearing in paper abstracts.Cora has seven machine-learning-paper classes, CiteSeer has six, PubMed covers three medical-paper types, and DBLP covers four research areas.

3.5 Applications of Privacy Preserving GNNs

Privacy-preserving GNNs are applied where pretrained models or graph data may expose sensitive information, especially in distributed settings and healthcare. Federated learning keeps computations on local devices and can be combined with differential privacy.

  • Pretraining and Model Sharing: Pretrained GNNs can embed training-data information, creating privacy-leakage risks when models are shared with downstream users.
  • Pretraining and Model Sharing: Federated learning addresses distributed GNN training by processing data locally, while differential privacy can provide additional protection against privacy attacks.
  • Healthcare: Healthcare applications use GNNs on sensitive graph data such as protein molecules, brain networks, patient networks, and electronic health records.

3.6 Future Research Directions of Privacy Preserving GNNs

Future privacy research should broaden defenses beyond the attacks and settings most commonly studied. The survey highlights gaps involving diverse attack types, released pretrained models, and privacy–utility trade-offs.

  • Privacy-preserving GNNs mostly address membership inference and attribute reconstruction, while structure, property inference, and model extraction attacks receive less study.
  • Privacy Attack and Preservation in GNN Pretraining: Released pretrained GNN parameters may leak private information, but existing attacks largely focus on black-box settings rather than model-sharing scenarios.
  • Trade-off Between Privacy and Utility: Future work should investigate privacy–utility trade-offs associated with differential privacy, federated learning, and adversarial learning.

4 ROBUSTNESS OF GRAPH NEURAL NETWORKS

This section frames graph adversarial attacks as threats to GNN robustness and organizes them by attacker knowledge, attack stage, perturbation strategy, and objective. Because many graph-mining tasks are transductive, poisoning attacks are emphasized as especially practical.

  • Graph adversarial attacks perturb graph structures or node attributes to degrade GNN performance or induce attacker-chosen outputs.
  • Attackers’ Knowledge: Attackers are classified by knowledge into white-box settings with full model and graph access and black-box settings without model parameters.White-box attacks often represent worst-case vulnerability, whereas black-box attacks better reflect practical access constraints.
  • Attackers’ Capability: By timing, evasion attacks modify test-stage graphs after training, while poisoning attacks modify training graphs before model fitting.
  • Poisoning attacks are often more practical for graph mining because transductive tasks include test samples during training.
  • Perturbation Strategy: By perturbation type, attacks include graph manipulation, malicious-node injection, and backdoor triggers.
  • Attackers’ Goal: Targeted attacks misclassify selected nodes, whereas untargeted attacks reduce overall model performance.

4.2 Graph Adversarial Attack Methods

The survey formulates graph attacks as constrained optimization problems and reviews evasion, poisoning, node-injection, and emerging attack methods. It highlights practical attack settings while noting transferability and unnoticeability limitations.

  • 4.2.1 A Unified Formulation of Adversarial Attack: The unified attack formulation searches for a minimally perturbed graph that maximizes attack loss while accounting for target-model training and an unnoticeability budget.The budget commonly constrains changes to adjacency and feature matrices through ∥Â−A∥+∥X̂−X∥≤Δ.
  • 4.2.2 Evasion Attacks: Evasion attacks alter graphs at test time and use gradient-based or reinforcement-learning methods to modify edges or attributes within a budget.Gradient-based methods include greedy connectivity changes, projected gradient descent, and integrated gradients; reinforcement learning selects sequential graph modifications.
  • 4.2.3 Poisoning Attacks by Graph Manipulation: Poisoning attacks optimize training-graph perturbations, commonly using static or dynamic surrogate models to approximate effects on the target GNN.Dynamic surrogates update on partially modified graphs, while static surrogates may poorly reflect target performance after poisoning.
  • 4.2.3 Poisoning Attacks by Graph Manipulation: Surrogate-based poisoning can fail to transfer when the target architecture differs substantially from the surrogate architecture.
  • 4.2.4 Node Injection Attacks: Node injection attacks add malicious nodes without changing existing links or attributes, making them more practical to execute than manipulation attacks.Their objective optimizes injected-node edges and attributes, and NIPA can also add malicious-node labels to the training set.
  • 4.2.4 Node Injection Attacks: Homophily regularization improves the unnoticeability of injected nodes and edges, with extensive experiments on massive graphs indicating its effectiveness.

4.3 Robust Graph Neural Networks

Robust GNN defenses address adversarial attacks through adversarial training, graph denoising, certifiable robustness, robust aggregation, and attention mechanisms. These methods target evasion attacks, poisoned graphs, or perturbed edges using training constraints, certificates, denoising, or adaptive aggregation.

  • Robust GNN defenses are categorized into adversarial training, graph denoising, and certifiable robustness.
  • Adversarial Training: Adversarial training generates adversarial graph samples and encourages similar predictions for clean and perturbed inputs.Graph topology and node attributes can be perturbed within an attack budget, while virtual adversarial training regularizes predictions on unlabeled nodes.
  • Certifiable Robustness: Certifiable robustness evaluates worst-case prediction margins across allowable perturbed graphs and can train models to enlarge those margins.A positive worst-case margin certifies that considered adversarial samples cannot change the node prediction; robust hinge loss encourages the margin to exceed M.
  • Graph Denoising: Adversarial training and certification address evasion attacks but not poisoned training graphs, motivating graph-structure denoising defenses.Denoising methods include preprocessing, graph structure learning, and attention-based approaches; GCN-Jaccard removes edges connecting nodes with low feature similarity.
  • Graph Structure Learning and Attention: Structure-learning defenses use low-rank or similarity-based constraints, while reinforcement learning and attention mechanisms select or down-weight suspicious edges.GDPNet sequentially selects one-hop neighbors using downstream-task scores as rewards, and methods such as PA-GNN and GNNGuard penalize adversarial edges.
  • Other Defenses: Robust aggregation methods reduce perturbation effects by modeling uncertain node representations or assigning smaller weights to dissimilar connections.RGCN uses Gaussian hidden representations, while similarity-based attention makes adversarially linked nodes less influential.

4.4 Applications of Robust GNNs

Robust GNNs are relevant to safety-critical graph applications, including bioinformatics, knowledge graphs, recommendation, and financial analysis. The survey highlights robustness as important for protecting downstream predictions in these domains.

  • Robust GNNs can benefit bioinformatics applications such as protein-protein and brain networks by defending against attacks.
  • Knowledge-graph recommendation and financial tasks such as credit estimation and fraud detection require robust GNNs because their graph models are vulnerable to attacks.

4.5 Future Research Directions of Robust GNNs

Future robust-GNN research should address scalability, heterogeneous graphs, and label noise. Existing methods are limited by computation costs, graph-type assumptions, and incomplete coverage of attack settings.

  • Scalable Robust GNNs: Scalable robust GNNs remain needed because efficient defenses may perform poorly, whereas stronger methods can be unaffordable on large graphs.
  • Robust GNNs on Heterogeneous Graphs: Robust GNN research largely targets homogeneous graphs, leaving adversarial defense for heterogeneous graphs as an open problem.
  • Robust GNNs Against Label Noises: Robust GNNs against label noises are identified as another future research direction.

5 FAIRNESS OF GRAPH NEURAL NETWORKS

Fairness in GNNs concerns discrimination arising from biased graph data and topology, with message passing potentially magnifying those biases. The survey reviews fairness definitions, graph-specific biases, applications, datasets, methods, and unresolved challenges.

  • GNNs can produce unfair predictions because societal bias in data may be magnified by graph topology and message passing.
  • Biases in Graph Data: Graph-specific bias includes structural bias from information propagation and linking bias from connections that misrepresent user behavior.
  • Fairness Definitions: Fairness criteria are commonly divided into group fairness and individual fairness, with group fairness requiring statistically comparable treatment across protected groups.
  • Group Fairness: Statistical parity requires predictions to be independent of sensitive attributes, while equalized odds requires conditional independence given the class label.
  • Group Fairness: Equal opportunity relaxes equalized odds by requiring equal positive-outcome probabilities for subgroup members within the positive class.
  • Applications: Fair GNNs are applied to recommendation and financial analysis, where reported concerns include male-author recommendation bias and bias toward protected attributes.
  • Future Directions: Future work must study attacks on fair GNNs because poisoned data may worsen bias, while existing attack studies largely focus on i.i.d. data.

6 EXPLAINABILITY OF GRAPH NEURAL NETWORKS

Explainability research for GNNs addresses how graph models reach predictions, what users should expect from decisions, and when models may fail. The survey organizes methods into instance-level post-hoc, model-level post-hoc, and intrinsically interpretable approaches, while highlighting evaluation and scalability challenges.

  • GNN explainability aims to help users understand predictions, anticipate decisions, and identify when trained models might break.
  • Explanation Scope: The survey distinguishes local explanations for specific instances from global explanations that describe inference independently of particular inputs.
  • Explanation Timing: Self-explainable GNNs produce predictions and explanations intrinsically, whereas post-hoc methods explain trained models using an additional explainer.
  • Evaluation: Explanation evaluation lacks an agreed strategy because human plausibility and convincingness differ from correctness and faithfulness to the predictive model.
  • Instance-level Post-hoc Explanation: Instance-level explanations seek discriminative substructures, such as edges and node attributes, that account for a target GNN prediction.
  • Challenges: Graph explanations are particularly difficult because GNNs combine node attributes with discrete topology and reuse edges across message-passing layers.
  • Method Taxonomy: The survey categorizes methods into instance-level post-hoc, model-level post-hoc, and intrinsically interpretable approaches, with most existing work targeting instance-level post-hoc explanations.
  • Model-level Post-hoc Explanation: Model-level explanations provide input-independent insights through representative instances, class patterns, or logic rules, but remain challenging because graph topology and semantics are diverse.

7 CONCLUSION

The survey reviews trustworthy GNNs across privacy, robustness, fairness, and explainability, organizing methods, frameworks, datasets, applications, and future directions. It also discusses interactions among trustworthiness aspects to support practical development.

  • The survey comprehensively reviews trustworthy GNNs across privacy, robustness, fairness, and explainability.
  • It fills a gap in systematic summaries of privacy-preserving and fairness-aware GNNs while detailing recent robustness and explainability trends.
  • Methods are categorized from multiple perspectives, with general frameworks, representative implementations, and relevant datasets presented for each aspect.
  • The survey provides numerical real-world applications and discusses future directions within individual aspects and across their interactions.
Loading 2204.08570v2…