A Survey of Graph Neural Networks in Real world: Imbalance, Noise, Privacy and OOD Challenges

• GNNs learn graph representations by iteratively aggregating and updating neighboring-node information, supporting applications across domains.Examples include e-commerce recommendations, social-media content recommendations, physical-system simulation, and drug discovery.Source: §1 · p. 1
• Real-world GNNs face imbalance, noise, privacy, and OOD challenges that can compromise performance or cause model collapse.Examples include scarce fraud cases, noisy biological data, privacy-sensitive social networks, and novel network attacks.Source: §1 · pp. 1–2
• The survey systematically reviews solutions for the four conditions and aims to support more reliable and robust GNNs in practical applications.It also identifies prospective research frontiers for future strategies.Source: §1 · p. 2
• Unlike prior trustworthy-GNN surveys, this survey starts from practical scenarios and covers imbalance and privacy alongside other real-world concerns.The closest related survey [25] covers noise, distribution shift, and adversarial attack, but its coverage stops at 2022.Source: §1 · p. 2
• For each category, the survey summarizes principles and components, examines representative algorithms, and discusses their findings.Source: §1 · p. 2
• The survey identifies limitations and challenges in current real-world GNN models and outlines potential future research directions.Source: §1 · p. 2

• The taxonomy groups real-world GNN methods into imbalance, noise, privacy, and out-of-distribution categories.Figure 2 presents an overview of this taxonomy.Source: §2 · p. 2, Figure 2 · p. 3
• Imbalance methods address uneven class labels through re-balancing, augmentation, or module enhancement.Re-balancing adjusts sample distributions or loss functions; augmentation adds data or structural information; module enhancement targets discriminative features.Source: §2 · pp. 2–3
• Noise approaches distinguish label, structural, and attribute noise, using correction, topology-focused methods, or robust representation learning.The approaches include loss and label correction, metric learning, sampling, direct optimization, adversarial training, and loss refinement.Source: §2 · p. 3
• Privacy is framed as both attack and preservation, with adversarial learning and federated training among the defense approaches.Source: §2 · p. 3
• OOD work separates detection of instances beyond the training distribution from generalization to unseen graphs.Detection commonly uses anomaly detection or uncertainty estimation; generalization targets robust prediction on new graphs.Source: §2 · p. 3

3.1 Graph

• A graph is represented as G = {X, A}, where A encodes edges and X contains node feature vectors; Y denotes labels for labeled nodes or graphs.Source: §3.1 · p. 3

3.2 Graph Neural Networks

• GNNs learn representations of nodes, edges, or whole graphs, using message passing to iteratively update node embeddings through neighboring nodes.Source: §3.2 · p. 4

3.3 Computational Tasks

• Node-level tasks include classification, ranking, clustering, and link prediction, while graph-level tasks include graph classification, graph matching, and graph generation.The section defines node classification as predicting labels for unlabeled nodes, link prediction as predicting unobserved edges, and graph classification as predicting labels for unseen test graphs.Source: §3.3 · p. 4

4 IMBALANCE

• The goal is a GNN classifier that performs well on both majority and minority classes despite long-tailed class counts.The survey groups existing methods into re-balancing, augmentation-based, and module-improvement approaches.Source: §4 · p. 4

4.1 Re-balancing Approaches

• Re-balancing methods resample or adjust class-sensitive losses, with topology-aware methods adapting node weights or margins to graph structure.Resampling can synthesize minority samples or partition majority samples; ReNode uses node influence and class-boundary position, while TAM compares connectivity patterns with class averages.Source: §4.1 · pp. 4–5

4.2 Augmentation-based Approaches

• Augmentation methods add information through transformed graph views or transfer knowledge from majority classes and other domains.Examples include GraphMixup's feature and edge mixup, G2GNN's graph-of-graphs supervision, CM-GCL's multimodal contrastive pairs, and teacher-student distillation methods.Source: §4.2 · p. 5

4.3 Module Improvement Approaches

• Module-improvement approaches target representation learning, classifier training, and model ensembles.Examples include centrality-based balanced sampling, self-supervised pretraining and pseudo-labeling, minority-focused metric learning, classifier-weight regularization, and expert aggregation with static or learned gating.Source: §4.3 · pp. 5–6

4.4 Discussion

• Most imbalanced-graph work addresses label imbalance, while structural imbalance has received less attention and still needs deeper study.Existing topology-focused approaches address under-reaching and over-squashing through position-aware structure learning or use label-aware neighbor selection.Source: §4.4 · p. 6

• Graph noise includes label, structural, and attribute noise, all of which can impair GNN performance.The survey treats these as common types of noise in graph data.Source: §5 · p. 6
• Label errors require GNNs to identify mislabeled samples, whereas fake or absent edges require reconstruction of the ground-truth adjacency.Source: Figure 4 · p. 6

5.1 Label Noise

• For node-level classification, the goal is a GNN classifier robust to noisy labels that predicts labels for unlabeled nodes.The section notes that node-level classification has been studied more extensively than graph-level classification and is its focus.Source: §5.1 · p. 6

5.1.1 Loss Correction Approaches

• Loss correction adapts the training loss, while label correction identifies potentially incorrect labels and corrects them for reliable training.Source: §5.1.1 · p. 6, §5.1.2 · p. 7
• Loss regularization adds supplementary information to empirical risk; examples use structure reconstruction and confident pseudo-labels, pairwise interactions, or contrastive learning to improve noise tolerance.NRGNN connects unlabeled and labeled nodes using feature similarity; CR-GNN selects nodes with consistent predictions as reliable to prevent overfitting.Source: §5.1.1 · pp. 6–7
• Sample reweighting down-weights large-loss samples to strengthen supervision from clean labels, and RTGNN combines it with loss regularization and small-loss filtering.RTGNN also uses internal strengthening and coherence regularization as supplementary supervision.Source: §5.1.1 · p. 7

5.1.2 Label Correction Approaches

• Label correction uses label propagation or neighbor voting; propagation methods exploit node similarity or graph structure, while voting selects a label from neighbors.The section describes methods that filter or correct labels using agreement, reliable labels, or homophily assumptions.Source: §5.1.2 · p. 7

5.2 Structure Noise

• Structural errors can propagate through message passing, and the surveyed approaches either refine graph structure before downstream tasks or directly optimize a learnable adjacency matrix.Graph structure learning includes metric-learning and sampling-based methods; direct optimization uses tailored regularization or model and supervision changes.Source: §5.2 · p. 7

5.2.1 Metric Learning Approaches

• Metric-learning methods learn pairwise edge weights from node representations and update the noisy adjacency; kernel methods use kernels, while neural methods use more complex networks.Post-processing can sparsify the learned graph using kNN or ϵNN.Source: §5.2.1 · p. 8

5.2.2 Sampling-based Approaches

• Sampling-based methods form refined graph structures through task-independent or task-dependent edge or node sampling.DropEdge randomly removes input edges without targeted downstream-task supervision; task-dependent methods use downstream feedback to improve the graph.Source: §5.2.2 · pp. 8–9
• Task-independent sampling includes random edge removal and deformed-subgraph construction, while task-dependent approaches remove task-irrelevant edges or sample important vertices.DropEdge reduces message-passing intensity; FastGCN samples vertices by importance to mitigate recursive neighborhood expansion without sacrificing accuracy.Source: §5.2.2 · p. 9

5.2.3 Direct Optimization Approaches

• Direct optimization treats adjacency as learnable and includes smoothness regularization, adversarial defenses, and decoupling-based methods.Decoupling methods can address both structural and label noise by reweighting pseudo-labels or combining attribute similarity with structural cues.Source: §5.2.3 · p. 9

5.3 Attribute Noise

• Attribute noise consists of errors or disruptions in node or edge features that can distort feature distributions and harm model performance.The section identifies data-collection mistakes, missing values, and intentional adversarial attacks as possible sources.Source: §5.3 · p. 9

5.3.1 Adversarial Attack and Defense Approaches

• Adversarial defenses harden GNNs against malicious perturbations through min-max optimization, with methods targeting perturbation spread, sensitive feature directions, or model weights.GCORN enforces orthonormal weight matrices for robustness against node-feature attacks.Source: §5.3.1 · p. 9

5.3.2 Loss Refinement Approaches

• Loss refinement modifies the objective, often with regularization grounded in stability analysis; examples include teacher-student recovery, probabilistic noise-invariant representations, and robust prototypes.T2-GNN uses separate teachers for node features and graph structure to transfer clean patterns for recovering corrupted attributes.Source: §5.3.2 · pp. 9–10

5.4 Discussion

• Label, structure, and attribute noise all degrade real-world GNN performance and robustness.The survey notes that research has focused more on label and structural noise than on attribute noise.Source: §5.4 · p. 10
• Direct methods for attribute noise remain scarce, leaving a gap in real-world GNN research.The discussion contrasts this gap with methods for label and structure noise, including graph revision, sampling, and meta-learning.Source: §5.4 · p. 10
• Lipschitz stability quantifies sensitivity to structural perturbations and offers theoretical guidance for robust graph-model design.The discussion says sensitivity depends on perturbation magnitude and the Lipschitz constant.Source: §5.4 · p. 10

6.1 Privacy Attack

• Privacy attacks target training data, node or link attributes, graph structure, and model parameters, with four common objectives: membership, attribute inference, reconstruction, and model extraction, [127].Membership inference asks whether a sample was used for training; attribute inference targets private attributes, reconstruction targets attributes or topology, and model extraction seeks a surrogate.Source: §6.1 · pp. 10–11
• Model extraction has reported up to 90% fidelity on transductive GNNs, and inductive attacks can work through remote API access,.The passage contrasts this with up to 80% output similarity for early adversarial-framework methods [173].Source: §6.1 · p. 11

6.2 Privacy Preservation

• Differential privacy limits individual data influence through noise, but DPNE reports an approximately 30% accuracy drop at ϵ = 1,.Other surveyed methods apply DP to gradients, features, or teacher-student training.Source: §6.2 · p. 11
• Latent Factor Disentangling decomposes node embeddings into private and task-related components, while adversarial training minimizes attack success while preserving downstream task performance, typically via min-max optimization,.LFD requires prior knowledge, and adversarial training can be unstable.Source: §6.2 · p. 11, §6.3 · p. 12
• Federated learning aggregates local client updates without sharing raw data, but graph FL faces partial-label challenges in decentralized settings,.Graph FL includes inter-graph, intra-graph, and decentralized forms; cited approaches use differential-privacy techniques for partial labels.Source: §6.2 · pp. 11–12

6.3 Discussion

• Privacy defenses involve trade-offs: DP offers strong guarantees but may reduce utility, FL avoids data sharing but can remain vulnerable without enhancements, and adversarial training can be unstable [184].The discussion also notes that latent-factor disentangling requires prior knowledge; the methods can complement one another according to threat model and use case.Source: §6.3 · p. 12

7 OUT-OF-DISTRIBUTION

• Graph OOD research addresses two common scenarios when test-sample distributions significantly deviate from training distributions: OOD detection, distinguishing test samples from major in-distribution training data, and OOD generalization.Source: §7 · p. 12, §7.1 · p. 12

7.1 Out-of-distribution Detection

• Graph OOD detection methods are grouped by scoring design into propagation-based, classification-based, and self-supervised approaches.The detector scores a node or graph to distinguish samples from the major training distribution from OOD samples.Source: §7.1 · p. 12

7.1.1 Propagation-based Approaches

• Propagation-based detection adapts label propagation or GNN message passing to transfer uncertainty estimates between connected ID and OOD nodes.Examples propagate uncertainty or energy scores, model ID-OOD interactions, or mix neighbors; Bayesian approaches can have high computational complexity.Source: §7.1.1 · p. 12

7.1.2 Classification-based Approaches

• Classification-based approaches use indicators such as maximum softmax probability, while methods also address graph-level OOD and node or graph anomaly detection.AAGOD is a post-hoc graph-level method that enlarges the indicator-score gap between OOD and ID graphs.Source: §7.1.2 · pp. 12–13

7.1.3 Self-supervised Learning-based Approaches

• Self-supervised detection responds to scarce graph labels and OOD samples, using unlabeled ID data in methods focused mainly on graph-level OOD or anomaly detection.Approaches include contrastive learning across views, reconstruction-based inference, and one-class classification.Source: §7.1.3 · p. 13

7.2 Out-of-distribution Generalization

• Graph OOD generalization targets distribution shifts between training and test data in node- and graph-level tasks, with graph-level tasks more studied, [199].The shifts include attribute changes across environments and structural changes in connectivity or graph size.Source: §7.2 · p. 13

7.2.1 Subgraph-based Approaches

• Subgraph-based approaches seek semantically crucial graph parts while separating them from non-crucial environmental information.Methods use causal inference or invariant theory; examples include learnable masking, causal selection, and differentiable graph pooling.Source: §7.2.1 · p. 14

7.2.2 Adversarial Learning Approaches

• Adversarial approaches perturb graphs, parameters, or attributes, or align representations across domains to reduce distribution discrepancy.These approaches usually require prior knowledge of domain or environment labels.Source: §7.2.2 · p. 14

7.2.3 Discussion

• The discussion also covers explainable graph-level OOD detection, adapted contrastive-learning and decorrelation methods, OOD link-prediction theory, and large-scale benchmarks, [192],,,,.Applications include molecular property prediction and drug discovery.Source: §7.2.3 · p. 14

Enhancing Scalability

• Most studies address these challenges on small graphs, while pairwise computations limit G2GNN’s scalability; pre-training on small graphs and transfer to larger challenging graphs is a promising direction.The paper calls for greater efficiency and robustness as these problems become more complex at scale.Source: §8 · p. 14

Improving Interpretability

• Interpretability remains underexplored despite its importance in applications such as drug discovery, healthcare, and traffic planning.The survey points to built-in explanations, post-hoc methods, and counterfactual reasoning as promising approaches.Source: §8 · p. 15

More Theoretical Guarantees

• Theoretical insights into GNN generalization under noise, distribution shifts, and adversarial conditions remain limited, motivating unified analytical frameworks.GraphGuard is cited as providing provable robustness to structural and feature perturbations in graph classification.Source: §8 · p. 15

Comprehensive Benchmarks and Universal Models

• Because existing models are often tailored to isolated settings, the paper calls for comprehensive benchmarks and integrated scores across diverse real-world challenges.UDA-GCN, designed for domain adaptation, fails under more complex noisy-label transfer learning tasks.Source: §8 · p. 15

Towards More Realistic Applications

• Realistic deployment requires GNNs that handle imbalance and OOD data and use online learning in evolving domains such as biology, finance, and transportation.Protein interaction networks can be imbalanced and OOD on new organisms, while transportation applications face dynamic conditions.Source: §8 · p. 15