PaperlayerView exact revision on arXiv

Source-linked AI summary

Trustworthy Graph Neural Networks: Aspects, Methods and Trends

He Zhang, Bang Wu, Xingliang Yuan, Shirui Pan, Hanghang Tong, Jian Pei

arXiv:2205.07424v2cs.LGcs.AI

TL;DR

GNNs increasingly support consequential applications, but performance alone does not address risks involving robustness, discrimination, privacy, explainability, or resource use. This survey develops a roadmap across six trustworthiness aspects, reviews methods and their interactions, and identifies limitations and research directions for trustworthy GNNs.

  • Problem

    Performance-oriented GNNs can exhibit adversarial vulnerability, unexplainable discrimination, privacy risks, and excessive resource consumption, motivating trustworthy alternatives.

  • Method

    The survey defines an open framework and comprehensively reviews trustworthy-GNN methods across robustness, explainability, privacy, fairness, accountability, and environmental well-being, including cross-aspect relations.

  • Results

    The survey provides a roadmap comprising aspect-specific method categorisations, cross-aspect analysis, and an overview of trending directions for trustworthy-GNN research and industrialisation.

  • Takeaways & Limitations

    Building trustworthy GNNs requires considering multiple trustworthiness aspects together rather than treating task performance as the sole objective.

  • Takeaways & Limitations

    Gradient leakage risks in GNNs, including reconstruction of private client data from shared gradients in federated learning, remain insufficiently explored.

Abstract

from arXiv · show

Graph neural networks (GNNs) have emerged as a series of competent graph learning methods for diverse real-world scenarios, ranging from daily applications like recommendation systems and question answering to cutting-edge technologies such as drug discovery in life sciences and n-body simulation in astrophysics. However, task performance is not the only requirement for GNNs. Performance-oriented GNNs have exhibited potential adverse effects like vulnerability to adversarial attacks, unexplainable discrimination against disadvantaged groups, or excessive resource consumption in edge computing environments. To avoid these unintentional harms, it is necessary to build competent GNNs characterised by trustworthiness. To this end, we propose a comprehensive roadmap to build trustworthy GNNs from the view of the various computing technologies involved. In this survey, we introduce basic concepts and comprehensively summarise existing efforts for trustworthy GNNs from six aspects, including robustness, explainability, privacy, fairness, accountability, and environmental well-being. Additionally, we highlight the intricate cross-aspect relations between the above six aspects of trustworthy GNNs. Finally, we present a thorough overview of trending directions for facilitating the research and industrialisation of trustworthy GNNs.

I. INTRODUCTION

GNNs support diverse real-world applications, but high task performance alone does not ensure trustworthy behavior. The survey transfers trustworthiness principles to GNNs through an open framework covering core aspects, metrics, research differences, and additional trust-oriented characteristics.

  • Motivation: GNNs model interactions in applications spanning recommendation, physics simulation, and societal well-being.Their use ranges from consumer platforms to advanced scientific systems.
  • Motivation: Performance-oriented GNNs can remain vulnerable to adversarial attacks and other trustworthiness concerns in critical and sensitive domains.The introduction motivates robustness and related properties beyond accuracy.
  • From Trustworthy AI to Trustworthy GNNs: Trustworthy GNNs are defined as competent models incorporating robustness, explainability, privacy, fairness, accountability, well-being, and other trust-oriented characteristics.The framework transfers key technology-oriented aspects of trustworthy AI into the GNN context.
  • From Trustworthy AI to Trustworthy GNNs: The survey distinguishes GNN trustworthiness from general AI because graph data are non-Euclidean, discrete, irregular, and often non-IID.These characteristics affect how trustworthiness is studied and evaluated.
  • Aspects of Trustworthy GNNs: Robustness concerns stability under attacker-created perturbations, evaluated using accuracy, attack success rate, mis-classification rate, structural similarity, and attack budget.Graph perturbations such as adding or deleting edges differ fundamentally from perturbations of ordinary Euclidean samples.

D. Related Surveys

The survey differentiates itself from prior GNN and trustworthy-AI reviews through broader coverage, finer taxonomies, explicit cross-aspect analysis, and an extensible framework. It positions these elements as a roadmap for researchers and practitioners.

  • Scope of Related Surveys: Prior GNN surveys primarily emphasize performance-oriented architectures, while trustworthy-AI reviews often address only selected trustworthiness aspects.The survey compares itself with reviews spanning GNNs, trustworthy AI, and individual trustworthy-GNN aspects.
  • Differences from Existing Surveys: Compared with a concurrent four-aspect review, this survey covers six aspects and provides consolidated, fine-grained taxonomies with definitions, metrics, and research differences.Its example taxonomy categorizes robustness defences as pre-training, during-training, and post-training methods.
  • Cross-aspect Relations: The survey examines how methods from one trustworthiness aspect can address objectives in other aspects and how progress in one aspect can promote or inhibit another.These cross-aspect relations are presented as important for constructing comprehensive trustworthiness.
  • Open Framework: Its open framework is extensible to trustworthiness aspects that may become necessary in the future.The framework is intended to support both research and industrial practice.

E. Contributions and Organisation

The survey contributes an open framework, comprehensive method categorisation, cross-aspect insights, and an outlook on emerging directions. It organizes the paper from foundational GNN concepts through aspect-specific methods, cross-aspect relations, and future trends.

  • Contributions: The open framework characterizes trustworthy GNNs through trust-oriented characteristics, evaluation metrics, and differences from general AI.It provides the conceptual basis for the survey’s treatment of trustworthiness.
  • Contributions: For each trustworthiness aspect, the survey summarizes basic concepts and typical methods and discusses future research directions.This contribution provides a methodology categorisation across the framework’s aspects.
  • Contributions: The survey explains complex relations among trustworthiness aspects in terms of methodologies and achievements.These relations are presented as vital to achieving fully trustworthy GNNs.
  • Contributions: By synthesizing common limitations, the survey identifies promising avenues requiring further investigation to advance trustworthy-GNN research and industrialisation.The paper presents this as an outlook on trending directions.
  • Organisation: The paper progresses from GNN concepts to methods for robustness, explainability, privacy, fairness, accountability, and environmental well-being, then discusses cross-aspect relations and trends.This organization follows the sequence described in the conclusion and paper overview.

III. ROBUSTNESS OF GNNS

Robustness concerns GNN stability under adversarial graph perturbations, which can cause incorrect predictions in critical applications. The survey organizes attacks by timing, knowledge, perturbation operations, and objectives.

  • Overview: Robust GNNs should remain accurate under adversarial attacks and random graph errors, although current research mainly focuses on adversarial attacks.Examples include malicious edge changes, node insertions, and altered malware call graphs.
  • Threat models: Threat models specify when attacks occur, what attackers know, which graph actions they can take, and how they seek to harm GNN performance.White-box attackers access architecture, parameters, and gradients; black-box attackers query the model and may construct surrogate models.
  • Attack timing: Poisoning attacks alter training graphs to produce impaired models, whereas evasion attacks perturb inference graphs against fixed, clean models.Backdoor attacks poison training graphs and later perturb inference graphs to trigger predefined conditions.
  • Attack categories: Attack processes contrast clean training and inference with perturbations introduced during inference, training, or both, producing different misclassification outcomes.The figure distinguishes evasion, poisoning, and backdoor attacks by where perturbations enter the pipeline.
  • Perturbation operations and goals: Attackers can modify graph structure, alter node attributes, inject malicious nodes, or target specific error types and scopes.Edge perturbations are often budgeted, node-attribute perturbations are reported as less effective, and node injection can create misclassifications without modifying existing edges.
  • Attack methods: Adversarial attacks are commonly formulated as constrained optimization problems that seek perturbed graphs causing performance degradation or targeted misclassification.Nettack jointly perturbs structure and node attributes in the training graph to misclassify a specific node.

B. Defences

GNN defences can be applied before training by identifying or removing potential adversarial perturbations from graph data. Preprocessing may also regenerate clean graphs or discard high-rank perturbations.

  • Defence phases: Defence mechanisms are classified by whether they occur before, during, or after GNN training.This classification follows the stage of the GNN system targeted by the defence.
  • Pre-training defences: Training graph preprocessing distils graph data by removing potential adversarial perturbations before GNN training begins.Defenders can identify suspicious components from perturbation characteristics or discard high-rank components using low-rank approximations.

2) Defences during GNN Training:

Defences during and after training trade off attack coverage, modularity, deployment compatibility, and computational complexity. Their effectiveness and evaluation remain constrained by attack and graph conditions.

  • During-training defences: During-training defences modify GNN learning, including architecture changes, robust training, and certification-oriented objectives.Robust training can add an objective term that drives nodes toward certification against bounded perturbations.
  • Phase of implementation: Pre-training defences target poisoning, post-training defences target evasion, and during-training strategies may address both attack phases.The suitable phase depends on whether perturbations occur before model training or during inference.
  • Modularity: Pre-training and post-training defences can be incorporated plug-and-play, whereas during-training defences may require changes to training programs.This difference reflects their modularity within an existing GNN development pipeline.
  • Deployment compatibility: Pre-training defences preserve normal deployment, while during-training and post-training defences may require specialized architectures or inference detection blocks.Examples include Gaussian hidden representations and threshold-based output-score detection.
  • Complexity: Defence complexity is driven mainly by computational demands during training or inference and can depend on graph statistics.Training preprocessing may require low-rank approximation of graph matrices.
  • Evaluation: Robustness evaluations based on attack deterioration or defence rate are specific to tested perturbations, while certification depends on GNN architecture and graph data.Consequently, robustness against other attack algorithms is not guaranteed by these metrics.

A. Concepts and Categories

GNN interpretability uses intrinsic designs, while explainability commonly provides post-hoc explanations of trained models. Methods differ by explanation scope, construction strategy, and whether they identify influential graph components.

  • Concepts and categories: Interpretability uses intrinsically interpretable GNN architectures, whereas explainability provides post-hoc explanations after training.Explanations may be instance-level, group-level, or class-level.
  • Challenges: Designing and evaluating GNN explanations is challenging because graph topology is irregular and discrete, and validation may require domain knowledge.Traditional deep-learning explanation methods cannot always be directly applied to graph data.
  • Representative explainer: GNNExplainer searches for a subgraph that explains a prediction by maximizing mutual information between the subgraph and the target label.It learns an edge mask and constructs the explanation through sigmoid transformation and element-wise multiplication.
  • Self-interpretable GNNs: Self-interpretable GNNs use contribution estimation, interpretable modules, embedding prototype learning, and rationale generation.These approaches incorporate explanation mechanisms into the model architecture or representation process.
  • Post-hoc explainers: Post-hoc explainers include gradient or feature methods, perturbation methods, surrogate and decomposition methods, and generation methods.The survey overview groups these methods separately from self-interpretable GNNs.
  • Perturbation-based methods: Perturbation-based explainers identify counterfactual or essential edges, nodes, or features by observing prediction changes after masking or modification.Removing or changing a component supports its role as an explanation when the model output changes.

C. Summary

GNN explanation methods differ in architecture dependence, model knowledge requirements, reasoning rationale, and known failure modes. Post-hoc explainers generally support broader architectures, while combining factual and counterfactual reasoning improves explanation quality and robustness.

  • Interpretability and Explainability: Post-hoc explainers usually apply across GNN architectures, whereas self-interpretable GNN explanations depend on their specific architectures.The GIB framework also combines informational-subgraph discovery with plug-and-play compatibility with other GNN backbones.
  • Model Knowledge Requirements: Surrogate explainers are more practical because they require only queries to target GNNs, unlike methods needing internal gradients, features, or decomposition access.Gradient/feature-based, perturbation-based, and decomposition methods generally require specific knowledge of the target model.
  • Reasoning Rationale: Combining factual and counterfactual reasoning avoids explanations that are sufficient but unnecessary or necessary but insufficient.Approaches using both forms show superiority in explanation robustness and quality measures such as accuracy and precision.
  • Limitations: Gradient methods may suffer from saturation and misleading explanations, while soft-mask methods may introduce evidence that models exploit spuriously.These limitations arise from local gradient sensitivity and side effects introduced during mask learning.

5) Complexity:

Trustworthy GNN explanation deployment must account for computational complexity and practical operating constraints. Explanation methods also face application limits when users lack model internals or when real-world ground-truth datasets are unavailable.

  • Complexity: GNNExplainer uses O(T|E|) time for a graph with E edges, whereas trained PGExplainer uses O(|E|) for new prediction instances.GNNExplainer’s parameter size is linear in edge number, while PGExplainer’s is independent of graph size.
  • Complexity: Explanation deployment complexity can affect other trustworthy-GNN aspects, including robustness and environmental well-being.The paper treats explanation complexity as including its broader system-level influences, not only runtime and memory.
  • Practical Constraints: Cloud-based GNN users may only query predictions, preventing explainers that require internal backward gradients from operating in strictly model-agnostic settings.GNNExplainer and PGExplainer are cited as examples requiring gradients unavailable through prediction-only services.
  • Evaluation Constraints: The absence of real-world ground-truth datasets hampers identifying practical GNN explanation methods.Existing methods are generally evaluated on synthetic datasets using visualisation and accuracy-related metrics.

B. Privacy-preserving Techniques for GNNs

Privacy-preserving GNN techniques include federated learning and differential privacy, adapted to graph-specific data partitions and aggregation challenges. These methods retain local-data protection while addressing non-IID distributions, graph isolation, and noisy aggregation.

  • Federated Learning: Federated learning trains GNNs collaboratively while keeping each participant’s raw data local.A server aggregates parameters such as gradients or model weights until the model converges.
  • Federated Learning: GNN federated learning distinguishes inter-graph, horizontal intra-graph, and vertical intra-graph settings based on how graphs, nodes, features, and labels are distributed.Horizontal intra-graph FL partitions nodes across participants, whereas vertical intra-graph FL shares nodes and connections but partitions feature and label spaces.
  • Federated Learning Challenges: Graph federated learning must address non-IID local structures and features, which can affect training performance.Methods such as ASFGNN refine global parameters using JS-divergence to reduce bias from individual data.
  • Federated Learning Challenges: Horizontal intra-graph FL faces graph isolation because message passing cannot access private information held in other participants’ subgraphs.Existing methods address this by transmitting higher-domain representations rather than raw connections or by using related mechanisms.
  • Differential Privacy: Differential privacy perturbs private node features before transmission so aggregated results remain useful while individual data appear meaningless.The paper states that perturbed aggregation can preserve privacy while approximating results from unperturbed inputs.

3) Insusceptible Training:

Insusceptible training and related privacy-preserving techniques protect GNNs against sensitive-information leakage through training, inference, and computation. These protections involve distinct coverage boundaries and trade-offs involving privacy, accuracy, efficiency, and computational cost.

  • Privacy-preserving GNN methods modify training objectives, architectures, or encoders to reduce sensitive-attribute leakage.Approaches include privacy-preserving loss regularisation, dedicated architectural modules, and encoders that filter sensitive attributes.
  • Security computation protects privacy using trusted execution environments, homomorphic encryption, and multi-party secure computation.These techniques are applicable because GNN operations resemble those used in ordinary deep neural networks.
  • Insusceptible training targets specific sensitive information, whereas federated learning protects local data but does not directly address inference-time attacks.Federated learning supports collaborative training while local users retain their personal data; model extraction and membership inference remain outside its direct protection scope.
  • Privacy-preserving techniques trade privacy gains against accuracy, efficiency, latency, and computational or communication costs.Differential privacy can reduce accuracy, federated learning increases training time through communication rounds, and homomorphic encryption or multi-party computation can greatly increase inference latency.
  • Privacy risks remain important in sensitive-data applications, while gradient leakage can enable reconstruction of local clients’ private training data.The survey identifies gradient inversion in federated learning as a serious privacy issue requiring further analysis for GNNs.
  • Many privacy-preserving GNN techniques do not provide formal guarantees against black-box attacks that infer sensitive information from intended outputs.Keeping graphs or models secret during training or inference does not necessarily prevent leakage through trained models or prediction results.

VI. FAIRNESS OF GNNS

Fairness in GNNs concerns excluding prejudice or favouritism from predictions, with unfairness arising across graph data, GNN operations, and user interactions. Existing methods define fairness through group, individual, or counterfactual criteria and address it through representation learning, prediction enhancement, and processing-stage interventions.

  • Concepts and Categories: Fairness excludes prejudice or favouritism toward individuals or groups from GNN predictions.
  • Concepts and Categories: Bias can enter through data collection and interactions, while graph structure and message passing can propagate it through GNN systems.
  • Definitions and Metrics: Group fairness compares prediction probabilities across protected groups, whereas individual fairness requires similar individuals to receive similar predictions.
  • Definitions and Metrics: Counterfactual fairness requires identical predictions for different versions of a candidate that vary in a sensitive attribute.
  • Processing Stages: Methods can operate before training, during training, or after prediction by modifying data, models or losses, or outputs, respectively.
  • Methods: Fairness methods include fair representation learning, which removes inferable sensitive information, and fair prediction enhancement, which modifies the GNN pipeline for fairer outputs.

C. Summary

Fairness methods differ in where they intervene, what system access they require, and the deployment resources they consume. Their practical choice therefore depends on permissions to modify data or models, computational and space costs, and effects on other trustworthiness aspects.

  • Method Access: Preprocessing modifies training graphs, in-processing changes model operations or losses, and post-processing supports fairness when GNNs are accessible only as black boxes.
  • Deployment Complexity: FairDrop modifies graph structure directly, whereas FairAdj requires additional training with gradient backpropagation and sort-based projections.
  • Deployment Complexity: Adversary modules require additional deployment and training space, while regularisation methods can generally be added to losses without additional space.
  • Cross-Aspect Considerations: Fairness deployment choices should also account for impacts on other trustworthy GNN aspects, including privacy.
  • Applications: Fair recommendations are important in social networks because biased recommendations can generate user complaints.

E. Future Directions of GNN Fairness

Future fairness research must address inconsistent task-dependent definitions and broaden accountability beyond current utility and security checks. The survey also identifies assessment, certification, benchmarking, and integrity verification as important directions for trustworthy GNN development.

  • Future Directions of GNN Fairness: Fairness definitions vary across tasks and methods, spanning group or individual fairness, representation independence, and robustness to sensitive-attribute perturbations.
  • Accountability: Accountability is needed because complex or cloud-based GNN systems can obscure operations and make responsibility for errors difficult to assign.
  • Accountability: Accountable GNN objectives include detecting violations, associating them with identities, assigning blame, and providing auditable assurance across development.
  • Accountability: Current accountability technologies mainly detect utility and security violations through benchmarking and security evaluation.
  • Assessment and Verification: Benchmarking spans architecture design, training, and validation, while integrity methods verify models, data, and development procedures.
  • Limitations: Verification methods introduce deployment or checking costs, such as preparing sensitive samples or recording training information.
  • Future Directions: Future work should detect and associate ethical, legal, and environmental violations in addition to utility and security violations.

VIII. ENVIRONMENTAL WELL-BEING OF GNNS

Environmental well-being treats GNN efficiency as a trustworthiness concern, addressing the computational, energy, and resource demands of large graphs and complex models. The survey reviews efficiency methods and highlights interactions between environmental well-being and other trustworthiness aspects.

  • Environmental well-being: Environmental well-being focuses on improving GNN efficiency across practical challenges involving large-scale graphs, deep architectures, and deployment.The survey frames efficiency as alignment with societal values and environmental well-being.
  • Efficiency evaluation: Efficiency is evaluated using time-related, energy-related, and resource-related metrics.Examples include latency, speedup, throughput, communication time, nodes-per-Joule, energy consumption, and memory usage.
  • Scalable architectures: Scalable GNNs address giant graphs through sampling, scalable architectures, and industrial applications.Friendster is cited as containing 65.6 million nodes and over 1.8 billion edges.
  • Model compression: Knowledge distillation, pruning, parameter reduction, and quantisation compress GNNs to balance efficiency with competence.Knowledge distillation trains lightweight GNNs from competent deep models, while TinyGNN and UGS illustrate distillation and pruning approaches.
  • Computing systems: Software frameworks and hardware accelerators target GNNs’ graph-dependent, dense-sparse, and application-diverse computation.Representative software frameworks include PyTorch Geometric and Deep Graph Library.
  • Cross-aspect relations: Cross-aspect relations create both synergies and trade-offs: quantisation may improve robustness, whereas robustness and privacy techniques can increase development effort and environmental costs.Accountability methods may also promote environmental well-being by assessing systems efficiently.

X. CONCLUSION AND TRENDING RESEARCH DIRECTIONS

The survey concludes that trustworthy GNN research requires a comprehensive roadmap spanning six aspects, their interactions, and practical deployment challenges. It identifies future directions involving trade-offs, additional trustworthiness properties, model-agnostic methods, and a supporting technology ecosystem.

  • Conclusion: The survey synthesises current advancements and trends to facilitate future research and implementation of trustworthy GNNs.It presents trustworthy GNNs as a thriving field with diverse methodologies and applications.
  • Conclusion: The roadmap reviews robustness, explainability, privacy, fairness, accountability, and environmental well-being, while analysing methodology transfer and agreement or conflict between aspects.Each aspect receives basic concepts, existing methods, and potential future research directions.
  • Challenges: Real-world adoption remains challenging across GNN design, trustworthiness concepts, cross-aspect relations, and the practicality of methods in specific applications.The conclusion identifies these challenges as spanning both conceptual and deployment concerns.
  • Future directions: Future work should address application-specific trade-offs, including balancing robustness and environmental well-being in autonomous vehicles.The survey also notes that trustworthy GNNs extend beyond the six reviewed aspects, including generalisation ability.
  • Future directions: Model-agnostic methods could serve as reusable building blocks, while graph-specific datasets, metrics, evaluation pipelines, tools, and platforms remain needed.Graph dependencies challenge direct transfer of general machine-learning tools and fairness assumptions.

APPENDIX A DATASETS FOR TRUSTWORTHY GNNS

The appendix reviews datasets used to evaluate trustworthy GNNs and distinguishes requirements across trustworthiness aspects. Robustness, privacy, accountability, and environmental well-being can use common graph datasets, whereas explainability and fairness require more specialised data.

  • Dataset scope: Robustness, privacy, accountability, and environmental well-being can be evaluated on common graph datasets such as TUDataset and OGB.These aspects do not require the specialised annotations discussed for explainability and fairness.
  • Explainability: Explainability evaluation is constrained by the lack of ground-truth datasets identifying prediction-relevant graph components.Synthetic datasets attach graph motifs to base graphs, enabling controlled explanation evaluation.
  • Explainability: Synthetic explanation datasets are human-intelligible but cannot adequately benchmark complex and diverse real-world applications.Real-world examples include molecular datasets such as MUTAG, BBBP, and Tox21.
  • Fairness: Fairness evaluations use node-classification and link-prediction datasets for similarity-based fairness and datasets containing protected information for group fairness.Protected attributes may include nationality or region.
Loading 2205.07424v2…