A Comprehensive Survey on Trustworthy Graph Neural Networks: Privacy, Robustness, Fairness, and Explainability

• Trustworthiness concerns include attribute and friendship inference [90] [265], target-prediction attacks via malicious-node injection, amplified sensitive-attribute bias [24] [44], and opaque predictions that constrain high-stakes use.Source: §1 · p. 2
• The survey links prevention of harm to privacy and robustness, and also discusses how poisoning can harm fairness [153] [191] or mislead explainers [66], while explanations can aid debugging and bias evaluation.It identifies interactions among the four aspects as a future research direction for achieving trustworthy GNNs that address them together.Source: §1 · pp. 2–3
• Compared with prior surveys, this work covers privacy alongside fairness, emerging GNN directions, and graph-specific trustworthiness challenges that i.i.d.-focused trustworthy-AI techniques generally cannot address [136] [255].Newer topics include machine unlearning, model ownership verification, scalable adversarial attacks, fair contrastive learning, explanation-enhanced fairness, and self-explainable GNNs.Source: §1 · p. 3
• The survey covers GNN privacy attacks and defenses, datasets, adversarial attack and defense categories, and advances including scalable attacks, graph backdoors, and self-supervised defenses.Source: §1 · p. 3
• Its fairness coverage includes graph bias and fairness definitions, fair GNN models, and datasets; its explainability coverage addresses motivations, challenges, experiment settings, and a taxonomy of methods.Source: §1 · p. 3

2.1 Notations

• A graph G = (V, E) has nodes and edges and may be plain or attributed, with node attributes X and adjacency matrix A encoding connections.For attributed graphs, each node attribute x_i is d-dimensional; A_ij is 1 when nodes v_i and v_j are connected and 0 otherwise.Source: §2.1 · p. 3

2.2 Inner Working of Graph Neural Networks

• GNN layers aggregate neighborhood information, so a k-layer model captures k-hop context; node classification uses node embeddings, while graph classification pools them into a graph embedding.A linear classifier can predict from node embeddings or from the graph embedding produced by a READOUT function.Source: §2.2 · p. 4

2.3 Graph Analysis Tasks

• GNN representations support node classification, community detection, link prediction, and graph classification.Node classification is generally semi-supervised and may be transductive or inductive; link prediction can use an MLP on two node representations, and communities may be disjoint or overlapping.Source: §2.3 · pp. 4–5

Privacy of Graph Neural Networks

• Centralized training, model releases, and query services can expose sensitive data, while membership, link, and attribute inference attacks reveal information about users [58] [265].The section cites healthcare, banking [216], and bioinformatics as critical domains using sensitive data, and gives brain-disease classification as a membership-inference example.Source: §3 · p. 5
• Prior privacy surveys and defenses mainly address i.i.d. data, while graph topology and GNN message passing challenge their application to graphs [173], [99] [107] [245].The section therefore covers GNN privacy attacks and defenses, related datasets and applications, and future research directions.Source: §3 · p. 5

3.1.1 Types of Privacy Attacks on GNNs.

• Privacy attacks target training-set membership, graph structure or attributes, non-feature dataset properties, or model information through four categories: membership inference, reconstruction, property inference, and model extraction.Membership samples may be nodes, subgraphs, node attributes, or graphs [161] [91] [227]; reconstruction infers graph structure or attributes, while property inference targets unencoded facts such as gender ratios or node degrees [265]. Model extraction seeks to match target accuracy or replicate its decision boundary, threatening API security and potentially enabling further privacy or adversarial attacks.Source: §3.1.1 · p. 6

3.1.2 Threat Models of Privacy Attacks.

• White-box attackers can access model parameters or training gradients, whereas black-box attackers lack parameters but can generally query predictions or embeddings.Attacks may also require target nodes or graphs and a shadow dataset; white-box settings include publicly released pretrained GNNs [175] and federated learning [58], while a black-box example is an API service returning model outputs to user queries.Source: §3.1.2 · p. 7

The Unified Framework

• Supervised attacks train an attack model on shadow-data outputs and attack labels, then apply it to target examples; labels may represent attributes or network properties.Shadow samples can be node-centered subgraphs or sample graphs, and the attack model is trained with a loss such as cross-entropy.Source: §3.2 · p. 7

Membership Inference Attack

• Membership inference exploits overfitting-related differences in prediction distributions, using shadow training to distinguish training members from nonmembers [227].Studies cover node-local subgraphs [161], feature-only target nodes [91], and graph classification [227].Source: §3.2 · p. 8

Reconstruction Attack

• Black-box reconstruction infers attributes or links from node embeddings [58], graph embeddings [265], or queried prediction vectors when embeddings are unavailable [90].Shadow graphs provide adjacency and sensitive-attribute supervision; attack models can use MLPs to reconstruct attributes, links, or adjacency matrices.Source: §3.2 · p. 9
• GraphMI reconstructs adjacency in a white-box setting with known model parameters, minimizing label-prediction loss while imposing feature-smoothness and sparsity constraints [267].The method uses the graph Laplacian for feature smoothness, with weights controlling smoothness and adjacency sparsity.Source: §3.2 · p. 9

Property Inference Attack

• Property inference remains early-stage: an attack model learns graph properties from target graph embeddings using shadow examples and an appropriate loss [265].The described loss may be mean squared error or cross-entropy, depending on the property type.Source: §3.2 · p. 9

Model Extraction Attack

• Model extraction trains a surrogate to mimic target predictions from shadow data [186] [226]; when shadow structures are missing, one approach initializes them with attribute-based KNN and learns structure [186] [34].The cited approaches consider different levels of knowledge about the shadow dataset and target training graph.Source: §3.2 · pp. 9–10

3.3.1 Differential Privacy for Privacy-Preserving GNNs.

• Differential privacy limits the influence of individual records through noise, with GNN methods perturbing node features, using teacher ensembles, or perturbing recommendation inputs and losses.The locally private GNN also uses a robust graph convolution layer to reduce noise effects; PrivGNN adapts PATE to graph data with subsampling and noisy labels, while reports defense against attribute inference.Source: §3.3.1 · pp. 10–11

3.3.2 Other Methods for Membership Privacy.

• Membership privacy methods perturb outputs or sampled neighborhoods, while RM-GIB [41] uses information bottlenecks to limit leakage and improve robustness.LBP and NSD [161] respectively add noise to released posteriors and randomly select queried-node neighbors; RM-GIB also integrates pseudo-labels for unlabeled nodes and bottlenecks attributes and neighborhoods to remove redundant information or adversarial perturbations.Source: §3.3.2 · p. 11

3.3.3 Federated Learning for Privacy-Preserving GNNs.

• Federated learning trains GNNs on decentralized data by aggregating local model updates, with variants addressing graph heterogeneity, recommendation, and server-free collaboration.FedAvg averages client updates; other methods use gradient-based clustering, meta-learning, vertical federated learning, local noise, or neighbor-client aggregation [89] [137] [212] [228] [274].Source: §3.3.3 · pp. 12–13, §3.3.2 · p. 12

3.3.4 Machine Unlearning.

• Machine unlearning addresses the right to be forgotten through exact retraining or approximate parameter updates, but graph partitioning and residual gradients pose challenges.SISA retrains only the shard containing a removed point, while GraphEraser uses balanced graph partitioning to preserve structure; approximate methods use influence functions, but require noise to prevent residual-gradient leakage.Source: §3.3.4 · p. 13

3.3.5 Adversarial Privacy-Preserving GNNs.

• Adversarial privacy-preserving GNNs train representations to foil an adversary inferring sensitive attributes, minimizing mutual information between representations and sensitive data.The framework balances a utility loss against an adversarial prediction loss; GAL uses WGAN-based obfuscation, and discusses both attribute and link privacy.Source: §3.3.5 · p. 14

3.3.6 Model Ownership Verification.

• GNN ownership verification distinguishes invasive watermarking from noninvasive fingerprinting [209] to identify a protected model.Watermarking uses a trigger graph as a secret key and its target class as the IP message; GROVE [209] instead compares protected- and suspect-model embeddings on secret test samples, while non-backdoor watermarking remains underexplored.Source: §3.3.6 · pp. 14–15

3.4 Datasets for Privacy-Preserving GNNs

• Cora, CiteSeer, PubMed, and DBLP are citation networks, with papers as nodes, citations as edges, and abstract-derived node features.Cora has seven paper classes, CiteSeer has six, PubMed covers three types of medical papers, and DBLP spans four research areas.Source: §3.4 · p. 16
• Facebook and LastFM model user accounts as nodes connected by social relationships; Facebook nodes include demographic and location features.LastFM was collected through the following relationship in a social network.Source: §3.4 · p. 16
• Flickr links images through shared properties and uses user tags as node features, while Reddit links posts commented on by the same user and labels posts by community [84].Flickr nodes are submitted images; Reddit represents post-to-post interactions.Source: §3.4 · p. 16
• Coauthor connects authors who co-wrote papers, using paper keywords as features and authors’ research areas as labels [185].Source: §3.4 · p. 16
• ACM represents papers as nodes, shared authorship as edges, paper keywords as features, and publication conferences as labels.Source: §3.4 · p. 16
• PROTEIN, DD, and ENZYMES represent macromolecules with structural-element or amino-acid nodes linked by sequence adjacency or spatial proximity [156].Their node data include structural types and physical or chemical properties; ENZYMES has six reaction-based classes, PROTEINS labels enzyme status, and DD links amino acids by spatial proximity.Source: §3.4 · p. 16
• AIDS, NCI1, OVCAR-8H, and COX2 represent molecules as atom nodes and bond edges, with atom-type features and toxicity or biological-activity labels [156] [265].Source: §3.4 · p. 16

Pretraining and Model Sharing

• Differentially private GNNs [160] [176] can be used during pretraining to defend against membership inference when models embedding training data are shared.Shared pretrained models may also leak private data through attribute inference attacks.Source: §3.5 · p. 16

Distributed Learning

• Federated GNN learning processes data on local devices, and combining it with differential privacy [228] can protect client data from privacy attacks.Distributed learning addresses challenges including privacy concerns, computational cost, and memory capability.Source: §3.5 · pp. 16–17

Healthcare

• Privacy-preserving GNNs are needed for healthcare applications using sensitive data, including EHR-based diagnosis prediction and brain-activity analysis [5].Healthcare graph data include protein molecules, brain networks, and patient networks.Source: §3.5 · p. 17

Recommendation System

• GNN recommendation systems use social context and high-order neighbors but can leak user information, motivating privacy-preserving systems [137] [228].Source: §3.5 · p. 17

Defense Against Various Privacy Attacks

• Develop privacy-preserving GNNs against structure, property inference, and model extraction attacks, which are less studied than membership inference and attribute reconstruction.The section identifies these underexplored attack types as a promising direction.Source: §3.6 · p. 17

Privacy Attack and Preservation in GNN Pretraining

• Study privacy attacks and defenses for pretrained GNNs, because released model parameters may leak private information beyond the black-box settings that existing attacks mostly examine.This concern applies to GNNs pretrained with supervised or self-supervised tasks for downstream use.Source: §3.6 · p. 17

Trade off Between Privacy and Utility

• Evaluate privacy protection alongside prediction accuracy, since the privacy–utility relationship and attack-defense performance remain insufficiently discussed for differential privacy and adversarial privacy-preserving GNNs.The section notes that actual defense against various privacy attacks is generally not evaluated for differentially private GNNs [160] [176], while balancing prediction performance and privacy protection remains underexplored in adversarial privacy-preserving methods.Source: §3.6 · p. 17

4 ROBUSTNESS OF GRAPH NEURAL NETWORKS

• GNNs can be misled through perturbations to graph structure or node attributes, creating risks in safety-critical applications such as credit estimation and healthcare.Nettack poisons training graphs to induce false target-node predictions, while NIPA injects labeled fake nodes to reduce global node-classification performance.Source: §4 · p. 17
• The survey reviews graph adversarial learning while emphasizing emerging directions including scalable attacks, graph backdoor attacks, and recent defenses.It positions this overview alongside existing surveys of graph attacks and defenses [31] [104] [195] [225].Source: §4 · p. 18

4.1 Threat Models of Graph Adversarial Attacks

• White-box attackers know model parameters and training-graph information, whereas black-box attackers lack parameter access but may access graph data, labels, or model outputs.White-box attacks are less practical but can show worst-case model performance; black-box attackers may use labels or queried outputs to mimic the target model.Source: §4.1 · p. 18
• Evasion attacks perturb test-stage graphs without changing trained model parameters, while poisoning attacks alter training graphs to induce designed behaviors.Poisoning is treated as black-box because it occurs before training; attackers may poison a surrogate model, relying on transferability to affect the target GNN.Source: §4.1 · p. 18
• Most existing graph-mining attack work targets poisoning, which is often more practical because transductive tasks include test samples during training.The passage gives semi-supervised node classification and link prediction as examples of transductive tasks.Source: §4.1 · p. 19
• Graph attacks manipulate existing structure or node features, inject malicious nodes, or poison training data with backdoor triggers that steer triggered samples to a target label.Node injection is described as more practical than modifying the original graph, while GNN backdoor attacks remain at an early stage.Source: §4.1 · p. 19
• Targeted attacks seek misclassification of selected nodes while potentially preserving other predictions, whereas untargeted attacks reduce overall model performance.The passage notes that untargeted attacks require training-stage poisoning because evasion attacks cannot alter model parameters.Source: §4.1 · p. 19

4.2.1 A Unified Formulation of Adversarial Attack.

• The unified formulation seeks an unnoticeable perturbed graph that minimizes attack loss under a perturbation budget; using the clean or perturbed graph distinguishes evasion from poisoning.For non-targeted attacks, the objective covers unlabeled nodes and uses their predictions on the clean graph as labels.Source: §4.2.1 · pp. 19–20

4.2.2 Evasion Attacks.

• Evasion attacks use white-box gradient methods, black-box PageRank or surrogate-model attacks, and reinforcement learning when the target model can be queried.FGA and GradMax greedily modify edges, while ReWatt uses edge rewiring; RL-S2V uses Q-learning for targeted attacks [30] [46].Source: §4.2.2 · pp. 20–21

4.2.3 Poisoning Attacks by Graph Manipulation.

• For poisoning by graph manipulation, static and dynamic surrogate models support greedy or gradient-based perturbations, while generalized attack losses target transferability.Nettack uses a tractable surrogate and greedy search; dynamic approaches include min-max topology attacks [243] and Metattack’s meta-learning [281]. DeepWalk-based attacks [20] and GF-Attack address transferability across GNNs.Source: §4.2.3 · pp. 21–22

4.2.4 Node Injection Attacks.

• Node injection adds malicious nodes without altering existing links or attributes; its low search cost supports scalable attacks, while homophily regularization improves unnoticeability.NIPA uses reinforcement learning to select fake nodes, connections, and labels; later methods include AFGSM, G-NIA, and TDGIA. Extensive results on massive graphs indicate the effectiveness of homophily regularization [35].Source: §4.2.4 · pp. 22–23

4.2.5 Graph Backdoor Attacks.

• Graph backdoor attacks associate a trigger with a target class during poisoning so that attaching the trigger at test time induces that class prediction.SBA uses generated subgraph triggers, GTA targets pretrained models for downstream tasks, and UGBA uses selected poisoned nodes and adaptive triggers to address unnoticeability and limited budgets [43].Source: §4.2.5 · pp. 23–24, Figure 5 · p. 23

4.2.6 Scalable Attack Methods.

• Scalable attacks reduce manipulation costs through PR-BCD perturbation sampling and SGA candidate reduction, which achieves time complexity linear in graph size.PR-BCD was effective in experiments on graphs with over 100 million nodes [75]; SGA limits candidates to perturbations likely to affect the target node.Source: §4.2.6 · pp. 24–25

4.3.1 Adversarial Training.

• Adversarial training on GNN was first explored in [243], with graph-topology perturbations generated by PGD; virtual graph adversarial training [50] [68] considers only node-feature perturbations.Its KL regularizer enforces similar predictions with and without feature perturbations on unlabeled nodes.Source: §4.3.1 · pp. 25–26

4.3.2 Certifiable Robustness.

• Certificates measure worst-case robustness over allowed perturbations, while randomized smoothing yields tight guarantees and robust hinge-loss training [21] encourages larger margins.A positive certificate margin means no perturbation in the considered space can change the node’s prediction; methods address feature and topology attacks.Source: §4.3.2 · p. 26

4.3.3 Graph Denoising.

• For poisoned training graphs, preprocessing and graph-structure learning denoise edges, using similarity filtering, low-rank constraints, or scalable link prediction [42].Truncated SVD [63] is another preprocessing method; Pro-GNN learns a low-rank graph that supports classification and feature smoothness, while RS-GNN [42] predicts edge weights.Source: §4.3.3 · pp. 26–27
• GDPNet uses reinforcement learning to select each node’s one-hop neighbors sequentially, rewarding choices by downstream task prediction scores.Its state combines representations of the target node and the candidate neighbor.Source: §4.3.3 · p. 27
• Attention defenses down-weight adversarial edges, while robust aggregation [32] [75] and self-supervised tasks [45] offer additional defenses.PA-GNN learns edge penalties from auxiliary clean graphs; GNNGuard uses representation similarity. Median aggregation [32] tolerates perturbations when clean neighbors are the majority, and similarity-preserving or contrastive tasks can retain robust representations.Source: §4.3.3 · p. 28

• Bioinformatics graph applications, including protein-protein and brain networks, require robust GNNs to defend against bioinformatics attacks [201].Source: §4.4 · p. 28
• Knowledge-graph GNNs are vulnerable and support downstream tasks such as recommendation systems, motivating robust models for these applications.Source: §4.4 · pp. 28–29
• Financial GNN applications such as credit estimation and fraud detection [216] urgently need robustness to secure real-world use.Source: §4.4 · p. 29

Scalable Robust GNNs

• Scalable robust GNNs remain promising because efficient defenses such as GCN-Jaccard perform poorly, while advanced methods such as Pro-GNN are unaffordable on large graphs [75].Initial efforts show adversarial attacks can succeed on extremely large graphs, but scalable defenses remain limited.Source: §4.5 · p. 29

Robust GNNs on Heterogeneous Graphs

• Robust HGNNs remain an open problem: existing robust methods target homogeneous graphs, while attacks harm metapath-based HGNNs more than general GNNs.Many real-world graphs, including product-user networks, contain diverse object and relation types.Source: §4.5 · p. 29

Robust GNNs Against Label Noises

• Label-noise defenses need further investigation; NRGNN links unlabeled nodes to feature-similar (pseudo) labeled nodes to resist label noise and label-flipping attacks [40].Existing work mainly addresses graph-structure and node-feature attacks; several initial efforts [45] target label noise.Source: §4.5 · p. 29

Robust Pre-training GNNs

• Robust pre-training GNNs are necessary because a backdoor attack can steer a self-supervised model toward target predictions even after fine-tuning.Since pre-trained GNNs serve multiple datasets and downstream tasks, a successful attack could cause huge losses; pre-training frameworks have been investigated [92].Source: §4.5 · p. 29

5.1 Bias Issues in Graph-Structured Data and Graph Neural Networks

• Graph data exhibit historical, representation, temporal, attribute, structural, and linking biases, while message passing can magnify sensitive-attribute correlations in GNN predictions relative to MLP [44].Source: §5.1 · pp. 30–31

5.2.1 Group Fairness.

• Statistical parity requires prediction independence from sensitive attributes [59], equalized odds requires conditional independence [85], equal opportunity equalizes positive-class true-positive rates [85], and dyadic fairness makes link scores independent of whether nodes share attributes.Source: §5.2.1 · pp. 31–32

5.2.2 Individual Fairness.

• Fairness through awareness requires similar individuals to receive similar algorithmic outcomes [59], while counterfactual fairness requires predictions unchanged if protected attributes differ [120]; evaluating individual fairness remains under-explored.Source: §5.2.2 · pp. 32–33

5.3 Fairness-Aware Graph Neural Networks

• Fair GNN methods are categorized by intervention stage as pre-processing, in-processing, or post-processing, and by technique as adversarial debiasing, fairness constraints, or other methods.Source: §5.3 · p. 33

5.3.1 Adversarial Debiasing.

• Adversarial debiasing trains an encoder to hide sensitive information from an adversary while preserving task utility; FairGNN [44] estimates missing sensitive attributes, while EDITS [53] revises attributes and adjacency.Source: §5.3.1 · pp. 33–34

5.3.2 Fairness Constraints.

• Fairness constraints trade utility against parity, dyadic, individual, and counterfactual fairness, using covariance, link, similarity-ranking, and counterfactual-view consistency regularizers.Examples include FairGNN [44], UGE [218], FairAdj, InFoRM, REDRESS, and NIFTY [4].Source: §5.3.2 · pp. 35–36
• Other approaches use unbiased random-walk sampling [111], drop same-group edges with FairDrop [192], learn debiased embeddings with Debayes [24], or diversify message passing with GMMD [277].Source: §5.3.3 · p. 36

5.3.3 Fairness-aware GNNs in Other Categories.

• Fair augmentation enforces agreement between original and counterfactual views for node classification [4] and extends such views to contrastive representation learning [117].Recent work improves fair-view generation [82]; GEAR uses GraphVAE to model latent sensitive information and potential neighboring-node biases.Source: §5.3.4 · p. 36

5.3.4 Recent Advances.

• Recent methods use counterfactual views and explanations to improve fairness by locating biased edges or influential training nodes.CAF-GNN [82] uses matching to find realistic views with different sensitive attributes and labels; REFEREE identifies edges accounting for prediction disparity, while BIND [56] estimates a training node’s contribution to bias.Source: §5.3.4 · p. 37

5.4 Datasets for Fair GNNs

• Fair-GNN benchmarks span social, credit, recommender, blog, and school graphs, with task-specific sensitive attributes such as region, nationality, gender, race, age, and political affiliation.The survey describes datasets for node classification and link prediction, including Pokec, NBA, German Credit, Recidivism, Credit Defaulter, MovieLens, and Reddit.Source: §5.4 · pp. 37–38

5.5 Applications of Fair GNNs

• Fair-GNN applications address social recommendation and profile classification, book recommendation, and finance, where reported biases include minority exclusion, preference for male-authored books, and gender or age bias.The survey cites financial uses including loan-default prediction and fraud detection.Source: §5.5 · p. 39

5.6 Future Research Directions of Fair GNNs

• Research should test fair GNNs against attacks and build models robust in both accuracy and fairness, since existing fairness attacks [153] [191] [205] target i.i.d. data and graph vulnerability studies remain limited.The survey notes that an attacker can manipulate sensitive-attribute and outcome covariance, potentially making a severely biased model appear fair.Source: §5.6 · p. 39
• Fairness methods are needed for heterogeneous GNNs: learned representations can encode discrimination [254], while existing fair algorithms generally target homogeneous graphs and miss heterogeneity-specific bias.The survey highlights biases associated with meta-path neighbors and heterogeneous message passing, including social biases in knowledge graphs.Source: §5.6 · p. 39
• Fair GNNs that do not require sensitive attributes are a key research direction because privacy concerns and legal or regulatory restrictions can make those attributes unavailable for training.The survey says most existing fair GNNs are challenged by missing sensitive attributes, while work without them has so far been limited to initial efforts on i.i.d. data [121] [269].Source: §5.6 · p. 40

6.1.1 Aspects of Explanation.

• Local explanations justify individual predictions, while global explanations describe model inference independently of a particular input; methods also differ in whether they are intrinsic or post-hoc.Explanations may be presented as edges, feature importance, or subgraphs and derived by perturbing inputs, analyzing inference, or designing interpretable models.Source: §6.1.1 · pp. 40–41

6.2 Desired Qualities of Explanations

• Good explanations should be correct, complete, consistent, contrastive, user-friendly, and causal, while plausibility to humans should not be conflated with correctness.Causal explanations can help distinguish spurious correlations from actual causal influences.Source: §6.2 · pp. 41–42

6.2.2 Challenges of Explainability of GNNs

• Explaining GNNs is challenging because discrete edges and message passing complicate contribution estimates, while graph-form explanations can be difficult to interpret without domain knowledge.A common instance-level objective is to identify discriminative substructures, including important edges and node attributes [141] [253].Source: §6.2.2 · p. 42, §6.2.1 · p. 42, Figure 7 · p. 42

6.3 Taxonomy of Explainability of Graph Neural Networks

• GNN explanation methods fall into instance-level post-hoc, model-level post-hoc, and intrinsically interpretable self-explainable approaches; most existing work is instance-level post-hoc.Instance-level methods are further grouped by technique, including attribution, decomposition, and surrogate methods.Source: §6.3 · p. 42, §6.3.1 · pp. 42, 43, 45

6.3.1 Instance-level Post-hoc Explanation.

• Instance-level post-hoc methods identify input elements important to a prediction through attribution, decomposition, or local surrogate models.Attribution methods use gradients or perturbations; perturbation-mask approaches preserve predictions while removing redundant elements, and learned masks can be obtained by search, attention, or auxiliary models.Source: §6.3.1 · pp. 42–44

6.3.2 Model-level Post-hoc Explanation.

• Model-level post-hoc methods provide input-independent insights through representative examples or rules, but few have been developed for GNNs; XGNN generates class prototypes and GCFExplainer summarizes counterfactual graphs.XGNN trains a graph generator to maximize target predictions, while GCFExplainer uses vertex-reinforced random walks and greedy summarization.Source: §6.3.2 · p. 46

6.3.3 Self-explainable Approaches.

• Self-explainable GNNs produce predictions and explanations together, but their architectural constraints can limit modeling flexibility and cross-task generalization [45].Examples include SE-GNN’s interpretable nearest labeled nodes, ProtGNN’s class prototypes, and causal methods that identify invariant or causal substructures [65] [36].Source: §6.3.3 · pp. 46–47

6.4.1 Synthetic Data.

• Synthetic explanation benchmarks encode ground-truth causal structures, enabling evaluation against known rationales; examples include BA-Shapes, Tree-Cycles, BA-2motifs, Infection, and Syn-Cora [45].These datasets use attached motifs, unique paths, or sampled Cora neighborhoods as explanatory ground truth.Source: §6.4 · p. 47, §6.4.1 · p. 47
• Complex patterns and possible noise make human-understandable rationales from node features and graph topology challenging to obtain.Source: §6.4.2 · p. 47

6.4.2 Real-world Data.

• Molecule Data uses domain-identified NH2 and NO2 groups as ground-truth explanations, while Sentiment Graphs lacks ground truth and uses heuristic evaluation [252].Sentiment Graphs comprises Graph-SST3, Graph-SST5, and Graph-Twitter; its graphs represent text documents with word nodes and BERT embeddings [51].Source: §6.4.2 · p. 48

6.5 Evaluation Metrics

• Explanation evaluation uses accuracy, fidelity, sparsity, and stability metrics, but input-sensitive GNN predictions make stability evaluation and perturbation selection difficult.Accuracy compares explanations with known rationales [141]; fidelity measures how explanatory substructures affect predictions [252], while sparsity favors minimal explanations [72].Source: §6.5 · pp. 48–49

6.6 Future Research Directions on Explainability of GNNs

• Class-level explanations could reveal global model behavior and class-specific knowledge, addressing the anecdotal and poorly scaling nature of instance-level explanations.Source: §6.6 · p. 49
• Principled proxy measurements and benchmark datasets are needed because correct explanations generally lack gold labels and current evaluation relies on heuristics and approximations.Source: §6.6 · p. 49
• Researchers should evaluate explanations in real-world user cases and develop flexible, fine-grained levels that end-users can select to suit their needs.Source: §6.6 · p. 49
• GNN explainability research should develop reliable causal and counterfactual methods to identify prediction drivers and show how predictions could change under altered inputs.Source: §6.6 · p. 49

7 CONCLUSION

• The survey systematically covers privacy, robustness, fairness, and explainability, adding detail on recent robustness and explainability trends and addressing gaps in privacy-preserving and fairness-aware GNN surveys.It introduces core definitions and concepts, categorizes methods from multiple perspectives, and presents unified frameworks with representative implementations.Source: §7 · p. 49
• It lists datasets used in privacy, fairness, and explainability research and provides numerical real-world applications to encourage practical trustworthy GNN development.Source: §7 · pp. 49–50
• The survey identifies future research directions for each aspect, including promising directions within individual aspects and interactions between aspects.Source: §7 · p. 50