PaperlayerView exact revision on arXiv

Source-linked AI summary

Trustworthy Graph Neural Networks: Aspects, Methods and Trends

He Zhang, Bang Wu, Xingliang Yuan, Shirui Pan, Hanghang Tong, Jian Pei

arXiv:2205.07424v2cs.LGcs.AI

TL;DR

Applying trustworthy GNNs in real-world applications still poses challenges. This survey maps methods across six aspects and concludes that cross-aspect study is vital to achieving trustworthy GNNs.

  • Problem

    Applying trustworthy GNNs in real-world applications remains challenging across design philosophy, trustworthiness concepts, cross-aspect relations, and method practicability.

    Source: §X · p. 31

  • Method

    The survey defines trustworthy GNNs and reviews methods and future directions across six aspects, while mapping their cross-aspect relations.

    Source: §X · p. 31

  • Results

    The survey identifies cross-aspect study as vital for achieving trustworthy GNNs.

    Source: §X · p. 31

  • Takeaways & Limitations

    The survey highlights six whole-concept research directions with potential to fill research gaps and boost trustworthy GNN industrialisation.

    Source: §X · p. 31

    Gradient-based explanation methods may reflect only local GNN sensitivity and can suffer from saturation and misleading explanations.

    Source: 4) Other Limitations · p. 17

Abstract

from arXiv · show

Graph neural networks (GNNs) have emerged as a series of competent graph learning methods for diverse real-world scenarios, ranging from daily applications like recommendation systems and question answering to cutting-edge technologies such as drug discovery in life sciences and n-body simulation in astrophysics. However, task performance is not the only requirement for GNNs. Performance-oriented GNNs have exhibited potential adverse effects like vulnerability to adversarial attacks, unexplainable discrimination against disadvantaged groups, or excessive resource consumption in edge computing environments. To avoid these unintentional harms, it is necessary to build competent GNNs characterised by trustworthiness. To this end, we propose a comprehensive roadmap to build trustworthy GNNs from the view of the various computing technologies involved. In this survey, we introduce basic concepts and comprehensively summarise existing efforts for trustworthy GNNs from six aspects, including robustness, explainability, privacy, fairness, accountability, and environmental well-being. Additionally, we highlight the intricate cross-aspect relations between the above six aspects of trustworthy GNNs. Finally, we present a thorough overview of trending directions for facilitating the research and industrialisation of trustworthy GNNs.

I. INTRODUCTION … C. Aspects of Trustworthy GNNs.

The survey frames trustworthy GNNs as competent models designed to address harms beyond accuracy, and adapts six trustworthiness aspects from AI to graph-specific systems. It outlines the aspects’ evaluation metrics and differences from general AI, while allowing other trust-oriented characteristics.

I. INTRODUCTION

  • GNNs serve applications from recommendations and scientific discovery to health, but high accuracy alone is insufficient where attacks, bias, or opaque decisions can cause harm.The survey motivates trustworthy GNNs as reliable, responsible, ethical, and socially beneficial systems.Source: §I · p. 1

A. Trustworthiness

  • Trustworthiness concerns whether a GNN system is worthy of reliance: the GNN is the trustee, while owners, users, regulators, or society may be trustors.The survey defines a GNN as trustworthy when it is developed with key aspects of trustworthiness in mind.Source: A. Trustworthiness · pp. 1–2

B. From Trustworthy AI to Trustworthy GNNs

  • The survey transfers robustness, explainability, privacy, fairness, accountability, and well-being from trustworthy AI into an open framework for GNNs.It defines trustworthy GNNs as competent models incorporating these aspects and other trust-oriented characteristics; graph discreteness, irregularity, and non-IID nodes make their trustworthiness research distinct from general AI.Source: B. From Trustworthy AI to Trustworthy… · p. 2, C. Aspects of Trustworthy GNNs · pp. 2–3

C. Aspects of Trustworthy GNNs.

  • Robustness measures stability under perturbations, while explainability makes GNN predictions traceable and understandable to humans.Robustness metrics include model accuracy, attack success rate, mis-classification rate, structural similarity score, and attack budget; graph perturbations such as edge addition or deletion differ from Euclidean perturbations. Explanation metrics include accuracy, faithfulness, stability, and sparsity; graph explanations require methods for nodes, edges, or subgraphs.Source: C. Aspects of Trustworthy GNNs · pp. 3–4
  • Privacy protects graph data and model parameters from unauthorised exposure, while fairness requires comparable service across backgrounds despite disparities tied to sensitive attributes.Privacy considers both nodes and edges, and can be assessed by data leakage or privacy-attack success rates. Fairness metrics include group, individual, and counterfactual fairness; graph edges violate the IID assumption and motivate graph-specific definitions for node classification and link prediction.Source: C. Aspects of Trustworthy GNNs · p. 4
  • Accountability assesses whether GNN systems follow procedural and substantive standards, using evaluation processes and lifecycle specifications to identify responsibilities.Graph-specific evaluation may compare architectures across datasets using graph metrics such as node degrees, requiring procedures tailored to GNNs.Source: C. Aspects of Trustworthy GNNs · pp. 4–5
  • Environmental well-being focuses on GNN efficiency, evaluated through inference time, memory footprint, or nodes-per-joule.For GNNs, graph scale and data irregularity are primary efficiency bottlenecks because operations rely on graph structures; the survey focuses its well-being discussion on this technology-oriented sub-aspect.Source: C. Aspects of Trustworthy GNNs · p. 5
  • The open framework can include other trust-oriented characteristics, such as accurate predictions on unseen or distribution-shifted data; security is addressed through robustness, privacy, and accountability.Such characteristics can be evaluated with definition-related metrics, including test accuracy outside the training distribution; security includes confidentiality, integrity, and availability.Source: C. Aspects of Trustworthy GNNs · p. 5

D. Related Surveys

The survey distinguishes itself from earlier GNN and trustworthy-AI reviews by offering a methodical roadmap across six trustworthiness aspects, their complex relations, and an extensible framework.

D. Related Surveys

  • General trustworthy-AI reviews may not guide trustworthy GNN construction because graph interdependence, intertwined computation, and discrete structure make GNN challenges distinctive,.Source: D. Related Surveys · p. 5
  • Compared with Dai et al.’s four-aspect review, this survey gives each aspect definitions, evaluation metrics, and fine-grained taxonomies, including phase-based robustness defenses.Source: D. Related Surveys · p. 5
  • The survey analyzes how methods transfer across trustworthiness aspects and how progress in one aspect can promote or inhibit others.Source: D. Related Surveys · pp. 5–6
  • Its extensible framework covers six key aspects and supports a methodical roadmap for researchers and industry practitioners building trustworthy GNN systems.Source: D. Related Surveys · p. 6
  • Table III compares the survey with representative GNN, trustworthy-AI, and trustworthy-GNN reviews, including architecture-focused work,, and aspect-specific studies,,.Earlier GNN surveys focus largely on performance-oriented methods, while some trustworthy-GNN surveys address only subtopics such as post-hoc explainers.Source: D. Related Surveys · pp. 5–6, Table III · p. 6

E. Contributions and Organisation · II. CONCEPTS · III. ROBUSTNESS OF GNNS

The survey defines a framework for trustworthy GNNs, reviews methods and cross-aspect relations, and identifies research directions; it introduces GNN concepts before focusing on robustness against adversarial attacks.

E. Contributions and Organisation

  • The survey proposes an open framework of trust-oriented characteristics, evaluation metrics, and distinctions between trustworthy-GNN research and general AI.Source: E. Contributions and Organisation · p. 6
  • For each trustworthiness aspect, the survey summarises basic concepts and typical methods and discusses future research directions.Source: E. Contributions and Organisation · p. 6
  • The survey examines methodological and achievement-related relations among framework aspects, which it says are vital to achieving fully trustworthy GNNs.Source: E. Contributions and Organisation · p. 6
  • It identifies promising avenues to advance trustworthy-GNN research and industrialisation, and organises the survey from concepts and aspects through cross-aspect relations to conclusions and trends.Source: E. Contributions and Organisation · p. 6

II. CONCEPTS

  • The concepts section introduces message-passing GNNs, which iteratively update node embeddings, and distinguishes node-focused from graph-focused tasks, including node and graph classification.Source: §II · pp. 6–7

III. ROBUSTNESS OF GNNS

  • Robustness means sustaining GNN accuracy under perturbations such as malicious edge additions or deletions; such changes can undermine applications including malware detection.Source: §III · p. 7
  • The robustness review focuses mainly on adversarial attacks, while noting that robustness should also cover random errors, and surveys attack methods, defences, and future directions.Source: §III · p. 7

A. Adversarial Attacks · 1) Threat Models and Attack Categories: · 2) Attack Methods:

The section organizes GNN adversarial attacks by their timing, attacker knowledge, perturbation choices, and goals, then describes how attacks are formulated and optimized. It contrasts gradient-based methods with alternatives for settings where victim-model gradients are unavailable.

1) Threat Models and Attack Categories:

  • Poisoning alters training graphs, evasion perturbs inference graphs without changing model parameters, and backdoors poison training then trigger misbehavior at inference,,,,,,.These categories distinguish attacks by when perturbations occur and how they affect the target model.Source: 1) Threat Models and Attack Categories · p. 7
  • White-box attackers access model architecture, parameters, and gradients, whereas black-box attackers query the model and may build a surrogate; black-box methods better fit real-world constraints,,,,.The section also identifies grey-box attacks as a knowledge category, without further detail in these passages.Source: 1) Threat Models and Attack Categories · pp. 7–8
  • Attacks commonly modify edges within a budget, while node-attribute perturbations are less effective and often combined with other changes; injecting malicious nodes helps when existing edges cannot be altered,,,,,.Injected nodes can connect to benign nodes and induce misclassification,,,.Source: 1) Threat Models and Attack Categories · pp. 8–9
  • Attack goals vary by error specificity and target scope: attackers may seek errors under a particular label or any misclassification, and target a few nodes or overall model performance,.GNN studies call the latter scope distinction targeted versus non-targeted, unlike usage in fields such as image attacks.Source: 1) Threat Models and Attack Categories · p. 9

2) Attack Methods:

  • Nettack illustrates formulation as constrained graph perturbation to maximize performance drop; it poisons training data, changes structure and attributes, and targets a specific node’s classification.Its formalization uses a perturbation budget and an objective measuring prediction error against the target node’s ground-truth label.Source: 2) Attack Methods · p. 9
  • Gradient-based methods use loss gradients to choose perturbations, but graph discreteness complicates optimization; iterative greedy changes or integrated-gradient edge scores can guide the final adversarial graph,,,,,.Higher integrated-gradient scores indicate edge perturbations expected to improve attack effectiveness,,.Source: 2) Attack Methods · p. 9
  • Without victim gradients, black-box methods include reinforcement learning and genetic algorithms; RL casts edge changes as actions with goal-based terminal rewards, while gradients may require costly surrogates,,,,,.The cited surrogate-based topology attack takes six to ten times as long as a simple gradient-based approach; non-gradient methods suit limited-knowledge settings,.Source: 2) Attack Methods · pp. 9–10

B. Defences … 3) Defence after GNN Training:

GNN defences are organised by when they act: before, during, or after training. The survey describes graph cleaning before training, robustness-oriented training methods, and inference-time detection after training.

B. Defences

1) Defences before GNN Training:

  • Before training, preprocessing identifies suspicious graph components and removes them, including high-rank perturbations detected through low-rank matrix approximations.Studies use characteristics of adversarial perturbations to identify suspicious components,.Source: 1) Defences before GNN Training · p. 10
  • Before training, clean graph learning reconstructs or sanitises a better graph, based on the premise that perturbations conflict with basic graph properties,,.Source: 1) Defences before GNN Training · p. 10

2) Defences during GNN Training:

  • During training, architecture optimisation improves robustness through Gaussian embeddings, GAN-based contrastive learning, meta-optimisation, or redesign of aggregation and GNN architecture.Source: 2) Defences during GNN Training · p. 10
  • During training, attention mechanisms use scores to identify and downweight adversarial edges or nodes, such as by assigning higher scores to edges between more similar nodes.Source: 2) Defences during GNN Training · p. 10
  • Adversarial training uses attack-generated perturbed graphs to improve robustness to those attacks, with low implementation effort but weaker generalisation to unknown attacks,,.Only training graphs are modified, so the GNN architecture need not change.Source: 2) Defences during GNN Training · p. 10
  • Robustness certification bounds perturbations that cannot change a node prediction, and certification-based training adds an objective term to drive nodes toward certification,,.Source: 2) Defences during GNN Training · pp. 10–11

3) Defence after GNN Training:

  • After training, inference-time defences detect evasion attacks using lower output scores for malicious-node predictions or node robustness levels,.Source: 3) Defence after GNN Training · p. 11

4) Summary: … A. Concepts and Categories

The section compares robustness defenses by when they operate and how they fit deployment, then surveys application risks and future needs. It also explains why GNN explanations matter and classifies explanation methods by their outputs, scope, and requirements.

4) Summary:

  • Pre-training defenses address poisoning but not inference-time evasion, post-training defenses detect inference perturbations but cannot fix poisoned deployed models, and during-training strategies may address both,.Source: 4) Summary · p. 11
  • Pre/post-training defenses are plug-and-play, while during-training defenses may require code changes; deployment support and graph-size-dependent computation can constrain generality and scalability.Pre-training can preserve normal deployment, whereas other approaches may need specialized architectures or detection blocks; preprocessing such as low-rank adjacency approximation adds computation tied to graph size.Source: 4) Summary · p. 11

C. Applications

  • In malware detection, graph manipulation enables poisoning and evasion, while injected dubious transactions or fake accounts can evade financial GNNs,.GNNs are used to analyze network traffic and for credit estimation and fraud detection; these attack risks motivate countermeasures in both domains.Source: C. Applications · pp. 11–12

D. Future Directions of Robust GNNs

  • Current robustness assessments use attack deterioration and defence rate, but depend on particular perturbations; certification varies with GNN architecture and graph data, motivating a uniform quantitative metric,,,,,,,,.The proposed direction is a metric that can apply across GNN architectures, graph data, and attack and defence methods.Source: D. Future Directions of Robust GNNs · p. 12
  • Most robust GNN techniques have only been evaluated on medium-sized graphs, and training or inference overhead limits scalability, motivating more efficient defences for large-scale real-world systems,,.One revised aggregation method sums distances between neighbour embeddings, increasing training effort on large graphs.Source: D. Future Directions of Robust GNNs · p. 12

IV. EXPLAINABILITY OF GNNS

  • GNN explainability makes predictions transparent and understandable, supporting trust in crucial applications and enabling causal insight, robust-system development, and fairness oversight,,,,,,,.Source: §IV · p. 12

A. Concepts and Categories

  • GNN explanations commonly highlight important edges, nodes, or features, sometimes as patterned subgraphs; methods provide sample-specific, group-prototype, or class-level accounts, with instance explanations finer-grained and class explanations higher-level,,,,,.Source: A. Concepts and Categories · pp. 12–13
  • Explanation methods vary by model dependence, task scope, and access needs: some are architecture-specific or task-limited, while black-box explainers need no internal access and white/grey-box methods may require gradients or weights,,,,,.Source: A. Concepts and Categories · p. 13

B. Methods · 1) Intrinsically Interpretable GNNs: · 2) Post-hoc Explainers for GNNs:

The section organizes GNN explanation methods into self-interpretable models and post-hoc explainers, outlining their mechanisms and noting graph-specific design and evaluation challenges.

B. Methods

  • Graph irregularity and discrete topology prevent direct transfer of some traditional deep-learning explainers, while validating GNN explanations may require domain knowledge.Explanation methods must be designed for graph data, and evaluation may draw on domain knowledge such as brain connectomics.Source: B. Methods · p. 13

1) Intrinsically Interpretable GNNs:

  • Self-interpretable GNNs use contribution estimation, interpretable modules, embedding prototypes, or rationale generation; contribution values can come from activations, attention weights, or designed modules.Examples include NGF, STANE, and SAN.Source: 1) Intrinsically Interpretable GNNs · p. 13, Figure 3 · p. 14
  • Interpretable modules can pair GNN encoders with KNN, prototypes can expose similar subgraphs, and rationale generators can produce subgraphs tied to labels or invariant to distribution changes.Examples include SE-GNN, PortGNN, MICRO-Graph, GIB, and DIR.Source: 1) Intrinsically Interpretable GNNs · p. 14

2) Post-hoc Explainers for GNNs:

  • Gradient methods estimate local component contributions through input gradients, while feature methods map embeddings into input space, with regularisation reported to improve CAM and Grad-CAM.CAM uses weighted summation from the final layer; the reported regularisation includes batch representation orthnormalisation and Gini regularisation.Source: 2) Post-hoc Explainers for GNNs · pp. 14–15
  • Perturbation explainers mask graph components to retain predictions, and GNNExplainer learns an edge mask to identify an explanatory subgraph by maximising mutual information.Its explanation is a subgraph of the input graph; perturbation methods differ in mask types, importance metrics, mask-generation algorithms, and explanation forms.Source: B. Methods · p. 13, 2) Post-hoc Explainers for GNNs · p. 15
  • Surrogates approximate target GNN input-output behavior locally and are generally model-agnostic, whereas decomposition methods allocate prediction scores to input components using rules such as Taylor decomposition.PGM-Explainer uses perturbed similar samples and a Bayesian network; GNN-LRP identifies explanatory walks through layer interactions.Source: 2) Post-hoc Explainers for GNNs · p. 15
  • Generation methods produce explanations directly, with XGNN using reinforcement learning to generate class-level graph patterns, while other approaches include OrphicX, DEGREE, OFS+OBS, and Gem.OrphicX uses a variational graph auto-encoder; DEGREE estimates node contributions, OFS+OBS searches for counterfactual brain-network graphs, and Gem distills training explanations using rules and GNN queries.Source: 2) Post-hoc Explainers for GNNs · p. 15
  • General model-agnostic methods such as IG, DeepLIFT, and CXPlain can be extended to graph classification, and explanation quality can be assessed with visualisation and accuracy-related metrics.The survey also points to additional explainability resources in its appendix.Source: 2) Post-hoc Explainers for GNNs · p. 15

C. Summary … D. Applications

The section compares GNN explanation methods by their interpretability, access requirements, reasoning rationale, limitations, and complexity, then describes how explainability can support trustworthy applications. It highlights trade-offs between explanation breadth, model access, and computational cost.

1) Interpretability and Explainability:

  • Post-hoc explainers generally apply across GNN architectures, while self-interpretable models’ explanations depend on their architectures; GIB combines subgraph discovery with plug-and-play flexibility.Self-interpretable GNNs explain themselves, whereas post-hoc methods can usually explain GNNs with any architecture.Source: 1) Interpretability and Explainability · pp. 15–16

C. Summary

  • Table IV compares representative methods for improving GNN interpretability and explainability across several high-level perspectives.The section uses this comparison to organize its discussion of method types, knowledge requirements, reasoning rationale, limitations, and complexity.Source: C. Summary · p. 15, Table IV · p. 16

2) White/Grey/Black-box Knowledge:

  • Surrogate and generation methods can treat target GNNs as black boxes, while gradient, perturbation, and decomposition methods generally require model-specific knowledge.Surrogates need only query the target GNN; generators mostly use black-box training, whereas decomposition methods require white-box access. Gradient and feature methods use gradients or features, and most perturbation methods need specific knowledge to learn masks.Source: 2) White/Grey/Black-box Knowledge · p. 16

3) Reasoning Rationale:

  • Considering both factual and counterfactual reasoning can improve explanation robustness and quality, addressing limitations of relying on either alone.Factual-only explanations may include unnecessary information, while counterfactual-only explanations may fail to capture the complementary graph.Source: 3) Reasoning Rationale · pp. 16–17

4) Other Limitations:

  • Explanation methods have distinct limitations spanning gradient sensitivity, mask artifacts, surrogate choices, white-box access, and omitted counterfactuals.Gradient methods may saturate or mislead; soft masks can introduce evidence, while discrete-mask methods may find local optima. Surrogates lack consensus on neighborhoods and interpretable models; decomposition can be impractical when only queries are available, and generation methods may ignore counterfactuals.Source: 4) Other Limitations · p. 17

5) Complexity:

  • PGExplainer is independent of graph size in parameter size and takes O(|E|) time once trained, while GNNExplainer’s parameter size is linear in edges and takes O(T|E|) time.This makes PGExplainer more efficient for generating explanations for new prediction instances; deployment complexity can also affect robustness and environmental well-being.Source: 5) Complexity · p. 17

D. Applications

  • Explainability supports verification in medical diagnosis and social-network policing, and also applies to cybersecurity and natural language processing.Examples include explanations for disease detection and pathological entities, and attention-weight explanations of words and users in fake-news detection; explainability can also improve GNN performance and enable knowledge discovery.Source: D. Applications · p. 17

E. Future Directions of Explainable GNNs … B. Privacy-preserving Techniques for GNNs

The section highlights practical explainability needs and outlines GNN privacy risks, attack strategies, and the need for privacy-preserving techniques.

E. Future Directions of Explainable GNNs

  • Practical post-hoc explainers should work with limited model access, since cloud-service users may only query predictions and cannot access gradients required by some explainers.Only a few existing explainers are strictly model-agnostic; the passage identifies GNNExplainer and PGExplainer as examples that require inner backward gradients.Source: E. Future Directions of Explainable GNNs · p. 17
  • Real-world explanation evaluation needs application-specific datasets and metrics, because synthetic benchmarks may not predict explanation accuracy on real-world graphs.The passage notes that GNNExplainer performs competently on synthetic datasets but has limited explanation accuracy on real-world scene graphs; visual analytics with interpretable GNNs is another proposed evaluation route.Source: E. Future Directions of Explainable GNNs · p. 18

V. PRIVACY OF GNNS

  • Private GNNs must protect confidential model parameters and graph data, including sensitive personal information in applications such as medical-record systems.The passage gives a graph of social connections among patients with COVID-19 as an example of sensitive data used to learn GNN models.Source: §V · p. 18

A. Privacy Attacks

  • Privacy attacks target GNN models and graph data, and may assume black-box query access or white-box model access without access to training graphs and labels.Model extraction seeks to reconstruct a GNN or create a similar-performing substitute; current attacks focus on node classification, with little work on graph classification or link prediction.Source: A. Privacy Attacks · p. 18
  • Membership inference targets training membership of nodes, links, or whole graphs, while model inversion infers graph properties or reconstructs graphs and attributes from model outputs.Link-level attacks can use distances between connected nodes’ output posteriors to infer whether an edge appeared in training.Source: A. Privacy Attacks · pp. 18–19
  • GNN privacy attacks exploit graph-specific properties: link stealing uses similarity between connected nodes’ outputs, while model extraction simulates GNN information propagation to build a surrogate graph,.These strategies leverage relationships among query inputs, outputs, and learned models, as well as GNNs’ use of graph structure.Source: A. Privacy Attacks · p. 19

B. Privacy-preserving Techniques for GNNs

1) Federated Learning: · 2) Differential Privacy: · 3) Insusceptible Training:

The sections describe privacy-preserving GNN training through federated learning, differential privacy, and defenses that reduce information leakage during training. They distinguish graph-partition settings and outline challenges that require GNN-specific federated-learning mechanisms.

1) Federated Learning:

  • Intra-graph FL supports horizontal partitions with different nodes and vertical partitions with shared nodes but distinct feature and label spaces.Inter-graph FL instead has clients train on separate local graph samples.Source: 1) Federated Learning · p. 19
  • Federated GNNs keep raw data local while clients send model parameters to a server for aggregation into a global model.Because aggregation uses model parameters inductively, local graph topology need not be shared; aggregation may use FedAvg.Source: 1) Federated Learning · pp. 19–20
  • Non-IID graph structures and features can impair SGD-based federated training; ASFGNN uses JS-divergence refinement, while GraphFL uses model-agnostic meta-learning,.The local graph distributions may diverge in both structure and node features.Source: 1) Federated Learning · p. 20
  • In horizontal intra-graph FL, isolated subgraphs limit message passing and access to information from other subgraphs; methods transmit higher-domain representations or generate missing neighbours,,.Source: 1) Federated Learning · p. 20

2) Differential Privacy:

  • Differential privacy adds noise to training gradients or GNN node features, helping prevent an attacker from deriving information about specific training data from a released model.For node classification, users can perturb private feature values before the server learns a GCN.Source: 2) Differential Privacy · p. 20
  • Noisy feature inputs can yield approximate mean-aggregation results, with λ and ϵ adjusting utility and privacy.The server can use these approximations for privacy-preserving aggregation.Source: 2) Differential Privacy · pp. 20–21

3) Insusceptible Training:

  • Defenses against private-attribute inference can add a privacy-leakage loss to the target GNN objective or filter sensitive attributes through learned GNN encoders,,.The loss combines target-task utility with the attribute-inference attack loss.Source: 3) Insusceptible Training · p. 21

4) Security Computation: … VI. FAIRNESS OF GNNS

The paper surveys GNN privacy protections and their limits and costs, then motivates application-specific safeguards, future privacy research, and fairness methods.

4) Security Computation:

  • TEE,, HE,, and MPC,, are security-computation approaches that can largely extend from DNNs to GNNs.The passage notes that GNNs and ordinary DNNs use similar underlying operations, such as matrix multiplication.Source: 4) Security Computation · p. 21

5) Summary:

  • Insusceptible training protects targeted sensitive information, whereas federated learning (FL) keeps local data with users but does not directly protect against inference-time attacks.Insusceptible training can prevent private-information leakage during inference; FL is designed for collaborative training and protects all local data rather than selected attributes.Source: 5) Summary · p. 21
  • Privacy protections trade off accuracy and efficiency: DP can reduce accuracy, FL communication rounds increase training time, and HE/MPC inference latency can be orders of magnitude higher than cleartext computation.The passage reports the HE/MPC latency comparison for privacy-preserving inference.Source: 5) Summary · p. 21
  • Privacy techniques add computational and communication complexity across DP, FL, and secure computation, affecting GNN efficiency and making complexity an environmental-well-being concern.Examples include extra hops aggregation for low-degree nodes under DP, repeated FL communication, and costly encrypted inputs and secure neighboring aggregation.Source: 5) Summary · pp. 21–22

C. Applications

  • Medical GNNs need protection for valuable training graphs and sensitive inference data, while recommender-system owners need safeguards against model extraction and theft.The passage cites drug-discovery data,,, COVID-19 inference, and GNN-based recommendation systems,,.Source: C. Applications · p. 22

D. Future Directions of Private GNNs

  • Gradient leakage remains underexplored in GNNs, and shared FL gradients can enable attackers to reconstruct clients’ private training data through gradient inversion [274], [275].The passage says current work mainly considers leakage through final prediction results, while gradients may also expose training or inference information.Source: D. Future Directions of Private GNNs · p. 22
  • Many privacy-preserving techniques do not stop black-box attacks on intended outputs, so FL can leave graph membership inferable from the trained model,.The passage calls for systems that defend against these indirect privacy leaks, which existing secrecy during training or inference does not formally guarantee,.Source: D. Future Directions of Private GNNs · p. 22

VI. FAIRNESS OF GNNS

  • GNN fairness excludes prediction prejudice or favouritism, but message-passing can amplify graph-data bias into discrimination; the section reviews definitions, metrics, methods, and future directions.The passage identifies sensitive attributes such as skin colour.Source: §VI · p. 22

A. Concepts and Categories · B. Methods

The section defines key forms of fairness and unfairness in GNNs, describes how bias circulates through graph data, models, and users, and surveys methods for improving fairness.

A. Concepts and Categories

  • The survey distinguishes bias sources and productive, erroneous, and discriminatory bias, focuses on unjustified discrimination, and classifies fairness methods as pre-, in-, or post-processing.It distinguishes explainable from unexplainable discrimination, with direct discrimination linked to protected attributes and indirect discrimination arising from seemingly neutral attributes; bias can flow from data to algorithms, algorithms to users, and users to data.Source: A. Concepts and Categories · pp. 22–24
  • GNN fairness includes group fairness, individual fairness, and counterfactual fairness: equal treatment across groups, similar predictions for similar individuals, and equal predictions for versions of the same candidate.Demographic parity is a group-fairness definition; the (d1, d2)-Lipschitz property describes individual fairness and can also measure stability under slight input perturbations.Source: A. Concepts and Categories · p. 23
  • Bias cycles among graph data, GNNs, and users: biased data and aggregation can perpetuate unfairness, while recommendation-driven user behaviour can feed bias back into graph data.The survey notes that stacking graph filtering operations based on 1-hop aggregation can enlarge existing data bias.Source: A. Concepts and Categories · p. 23, Figure 4 · p. 23

B. Methods

  • GNN fairness methods are categorized as fair representation learning and fair prediction enhancement; representation learning excludes sensitive information, such as gender, from learned representations to support fair downstream predictions.Adversarial learning seeks fair representations by testing whether sensitive attributes can be inferred; fair representation is achieved when adversary modules cannot infer them.Source: B. Methods · p. 24
  • Fair prediction enhancement methods use data augmentation, fair graph modifications, or regularisation to reduce bias and produce fair predictions.They can target group, individual, or counterfactual fairness.Source: B. Methods · p. 24
  • NIFTY uses counterfactual data augmentation, perturbing protected attributes and adding the resulting samples to training so node predictions remain fair across attribute values.It uses Siamese learning and augmented attribute views.Source: B. Methods · p. 24
  • Fair graph methods modify graph structure or node features before or during training; FairAdj optimises fair connections for link prediction, while FairDrop drops edges to reduce structural bias.FairAdj uses bi-level optimisation to minimise an upper bound on discrepancies between inter-group and intra-group link predictions.Source: B. Methods · p. 24
  • Regularisation methods add fairness terms to model objectives or predictions; InFoRM measures individual fairness using node similarity, while REDRESS defines a regulariser from a ranking perspective.InFoRM adds Bias(Y, S) = Tr (Y′LSY) to the training loss and can debias input graphs, models, or results across processing phases.Source: B. Methods · pp. 24–25

C. Summary · D. Applications · E. Future Directions of GNN Fairness

The section summarizes fairness methods for GNNs, their application contexts, and deployment constraints, then identifies open directions in fairness definition and evaluation, task performance, and explaining unfairness.

C. Summary

  • Fairness methods fall into preprocessing, in-processing, and post-processing, with the feasible choice depending on whether users can modify training data or models or only query a black-box GNN.Examples include InFoRM-G for preprocessing, FairAdj, FairGNN, and REDRESS for in-processing, and InFoRM-R for post-processing.Source: C. Summary · p. 25
  • Fairness methods differ in deployment cost: FairDrop directly modifies graph structure, FairAdj requires training, and adversary modules need space while regularizers such as InFoRM are plug-and-play.Implementations should also account for effects on other trustworthy-GNN aspects, including privacy.Source: C. Summary · p. 25

D. Applications

  • Fairness matters in social networks, recommenders, and other prediction tasks, including finance, recidivism, and salary prediction; biased data can also contribute to unfair predictions.Social platforms should avoid recommendations biased against users and predictions dependent on sensitive attributes. Recommenders involve user and item fairness, including individual,, group, multisided, interaction, causal, and dynamic fairness; fair data collection and preprocessing are also needed.Source: D. Applications · p. 25

E. Future Directions of GNN Fairness

  • Fairness definitions vary by task and method, so GNN research needs suitable definitions for diverse graph settings and unified evaluation metrics and datasets.Existing approaches variously target group or individual fairness, representation independence from sensitive attributes, or robustness to sensitive-attribute perturbations.Source: E. Future Directions of GNN Fairness · p. 26
  • The effect of fairness on task performance is unclear: reducing reliance on sensitive attributes may degrade performance, while RawlsGCN improves GCN performance on some datasets.The section calls for further study of the fairness–performance relationship in GNNs.Source: E. Future Directions of GNN Fairness · p. 26
  • Existing fairness methods detect discrimination but do not explain its sources; identifying causes such as unfair graph connections can guide fairer architectures and connect fairness with explainability.FairAdj identifies unfair graph connections as a possible source of prediction bias and learns a fair graph structure to promote group fairness.Source: E. Future Directions of GNN Fairness · p. 26

VII. ACCOUNTABILITY OF GNNS … VIII. ENVIRONMENTAL WELL-BEING OF GNNS

The survey frames trustworthy GNNs as requiring accountability across development and operation, alongside efficiency that addresses environmental and deployment constraints. It outlines accountability objectives and methods, application needs and research gaps, then reviews efficiency challenges and improvement approaches.

VII. ACCOUNTABILITY OF GNNS

  • Accountable GNNs should support lifecycle assessment that detects and attributes violations, auditable evidence for third parties, and human coordination for remediation or punishment.These objectives correspond to detection, identification and blame; evidence; and answerability and punishment.Source: §VII · p. 26

A. Methods

  • Accountability methods assess utility violations through benchmarking and security violations through security evaluation, with standardized evaluation needed across GNN development stages.Benchmarks can assess expected performance and identify impact factors; security evaluation addresses confidentiality, integrity and availability.Source: A. Methods · pp. 26–27
  • Integrity checks target models and training procedures, but may add deployment or verification costs through fingerprint preparation and training-time recording.Methods include runtime model hashes, sensitive-sample fingerprints, and verification of training by analysing initial, intermediate and final models.Source: A. Methods · p. 27

B. Applications

  • Crime-prediction GNNs call for transparent, well-referenced inference given policy implications, while chip-design GNNs need evidence pinpointing suspicious regions in Trojan detection.GNNs have been used to capture inter-regional crime patterns and forecast criminal activities,.Source: B. Applications · p. 27

C. Future Directions of GNN Accountability

  • Future accountability research should assess ethical, legal and environmental violations, verify components beyond models and training, and develop auditability and explainable-coordination mechanisms.Source: C. Future Directions of GNN… · p. 27

VIII. ENVIRONMENTAL WELL-BEING OF GNNS

  • Environmental well-being concerns arise from large graph datasets, resource-intensive deep or complex models, and graph irregularity that complicates deployment and motivates specialized software and hardware.These pressures include training and inference at scale and deployment on resource-limited edge devices.Source: §VIII · pp. 27–28
  • GNN efficiency methods include scalable architectures, efficient data communication, model compression, and specialized frameworks and accelerators, assessed with time-, energy-, or resource-related metrics.Examples include latency, throughput, nodes-per-Joule, energy consumption, memory footprint, cache access and peak memory usage.Source: §VIII · p. 28

A. Methods … IX. RELATIONS BETWEEN ASPECTS OF TRUSTWORTHY GNNS

The paper surveys efficiency methods and applications for trustworthy GNNs, then examines how trustworthiness aspects interact through adaptations, mutual benefits, and trade-offs. It highlights the need for pipeline-wide, application-aware efficiency and co-design.

1) Scalable GNN Architectures and Efficient Data Communication:

  • Sampling, scalable architectures, and industrial GNN applications address giant graphs, while PaGraph uses a GPU cache policy to reduce CPU-to-GPU data movement time.Data loading accounts for 74% of GCN training time, and the Friendster graph has 65.6 million nodes and over 1.8 billion edges,.Source: 1) Scalable GNN Architectures and… · p. 28

2) Model Compression Methods:

  • Knowledge distillation, pruning, parameter reduction, and quantisation compress GNNs to improve efficiency despite the computation challenges of deep models on irregular graphs.Examples include TinyGNN learning local structure knowledge from neighbour nodes, UGS applying the lottery ticket hypothesis, GNF reducing memory footprint, and Degree-Quant enabling quantisation-aware training.Source: 2) Model Compression Methods · p. 28

3) Efficient Frameworks and Accelerators:

  • Software frameworks support efficient GNN execution across graph types and multi-GPU settings, while hardware accelerators increase operating speed by two to three times.The survey names PyG, DGL, EnGN, and HyGCN, and notes that frameworks and accelerators face a generality-versus-specificity trade-off.Source: 3) Efficient Frameworks and Accelerators · p. 28

B. Applications

  • For giant-graph training, sampling and scalable algorithms improve efficiency; for inference, compression targets smaller, faster models that retain similar performance, alongside customised hardware accelerators.The examples include Pinterest’s 18 TB user-item graph and specialised accelerators motivated by diverse data such as dynamic graphs.Source: B. Applications · p. 29

C. Future Directions of Environmental Well-being in GNNs

  • Future efficiency work should analyse GNN bottlenecks, accelerate inference, compress models, consider efficiency during training, and study operation energy and complexity for architecture search.The paper also calls for software-hardware co-design across the full GNN pipeline, guided by application requirements such as quick response or limited edge-device memory and by bottlenecks such as CPU–GPU data flow.Source: C. Future Directions of Environmental… · p. 29

IX. RELATIONS BETWEEN ASPECTS OF TRUSTWORTHY GNNS

  • Cross-aspect research studies both adapting methods from one trustworthiness aspect to another and how advancing one aspect can promote or inhibit others.Explainability methods can guide attacks and defences, including backdoor-trigger placement and malicious-edge detection; GIB uses an information bottleneck to improve noisy-graph classification. Adversarial-training-like perturbations of sensitive attributes support fairness in NIFTY, while fair representations can reduce sensitive-attribute leakage,, although greater individual fairness may increase edge privacy risks.Source: §IX · p. 29
  • Environmental-efficiency methods can benefit other aspects: compression can support explainability, quantisation can improve robustness, and accountability can reduce energy use by identifying futile training.CPF distillation can help build surrogate models for explanations; quantisation can reduce overfitting and improve robustness in GNNs; Lacombe et al.’s framework provides training knowledge that helps developers stop training that is not proceeding as expected.Source: §IX · pp. 29–30
  • Robustness and privacy measures can hinder environmental well-being because extra graph-learning modules, specialised operations, or privacy designs increase development, implementation, training, or energy costs.Privacy-preserving architectures can reduce sensitive-attribute leakage while increasing training costs; the survey also notes related AI work on robustness and explanations and privacy-fairness architectures.Source: §IX · pp. 30–31

X. CONCLUSION AND TRENDING RESEARCH DIRECTIONS

The survey defines trustworthy GNNs, reviews six trustworthiness aspects, and maps their interrelations. It identifies six broader research directions to address remaining challenges and support practical implementation.

Conclusion

  • The survey consolidates methods and future directions across robustness, explainability, privacy, fairness, accountability, and environmental well-being, and emphasizes relations among these aspects.It aims to advance future research and implementation of trustworthy GNNs.Source: §X · p. 31

Shift to Trustworthy GNNs

  • Trustworthy-GNN design should move beyond performance alone, incorporating principles such as GIB explanations and RawlsGCN’s Rawlsian fairness principle.Applications may require balancing aspects such as robustness and environmental well-being, as in autonomous vehicles.Source: §X · p. 31

Other Aspects of Trustworthy GNNs

  • Trustworthy GNN research should extend beyond six aspects to generalisation and principles such as safety and controllability, while keeping its framework open to new aspects.GNN extrapolation research examines relationships between tasks and aggregation functions.Source: §X · p. 31

Diversified Relations

  • Research should explore cross-aspect relations at multiple levels, including robustness methods for counterfactual fairness and links between fairness and privacy.The survey particularly identifies explainability and privacy as a relation needing further study.Source: §X · p. 31

Model-agnostic Methods

  • Model-agnostic methods are a promising direction because they can plug into any pipeline phase without modifying target architectures and combine as building blocks.The phases include pre-processing, in-processing, and post-processing.Source: §X · pp. 31–32

Technology Ecosystem for Trustworthy GNNs

  • A trustworthy-GNN ecosystem needs graph-suitable tools, datasets, metrics, evaluation pipelines, and software platforms to support research and industrialisation.Graph edges link node embeddings, violating the independent and identically distributed assumption and complicating individual fairness assessment.Source: §X · p. 32

Opportunities in the Era of New Technologies

  • New graph-learning technologies create trustworthiness challenges, including graph transformers’ quadratic running time, lack of explainability, and vulnerability to adversarial attacks.Biased graph structure also motivates data-centric graph-learning approaches.Source: §X · p. 32

APPENDIX A DATASETS FOR TRUSTWORTHY GNNS

Robustness, privacy, accountability, and environmental well-being can be evaluated on common graph datasets, but explainability and fairness require datasets with ground-truth explanations or sensitive attributes. The section reviews synthetic and real-world explanation datasets and datasets used for fairness evaluation.

Datasets for Trustworthy GNNs

  • Common graph datasets such as TUDataset and OGB support evaluations of robustness, privacy, accountability, and environmental well-being, whereas explainability and fairness require specialized datasets.General graph datasets lack ground-truth explanations and sensitive attributes, respectively.Source: Appendix A · p. 32

Explainability

  • Synthetic motif datasets address the lack of ground-truth explanations; widely used examples include BA-shapes, BA-Community, Tree-Cycle, Tree-Grids, BA-2Motifs, and Syn-Cora.Motifs are attached to base graphs, with node and graph labels defined by node roles and motif types, respectively.Source: Appendix A · p. 32
  • Real-world explanation evaluation uses molecule datasets MUTAG, BBBP, and Tox21, and sentiment graph datasets Graph-SST2, Graph-SST5, and Graph-Twitter.Synthetic datasets are human-intelligible but do not provide adequate benchmarks for complex and varied real-world applications.Source: Appendix A · p. 32

Fairness

  • Fairness evaluations use node-classification and link-prediction datasets for similarity-based fairness, and datasets containing protected information for sensitive-attribute fairness,.Examples include Freebase 15k-237, MovieLens-1M, Reddit, Pokec, NBA, German Credit, Recidivism, Credit Defaulter, Oklahoma97, UNC28, Dutch School, Facebook, and Google+ [395].Source: Appendix A · p. 32

Related papers

Loading 2205.07424v2…