PaperlayerView exact revision on arXiv

Source-linked AI summary

Adversarial Attacks and Defenses on Graph-aware Large Language Models (LLMs)

Iyiola E. Olatunji, Franziska Boenisch, Jing Xu, Adam Dziedzic

arXiv:2508.04894v1cs.CRcs.AIcs.SI

TL;DR

Adversarial robustness of graph-aware LLMs remains largely unexplored, despite their growing role in graph tasks. The paper evaluates graph attacks on representative models, introduces an LLAGA node-injection attack, and proposes GALGUARD; feature perturbations prove highly effective, while the defense mitigates METAATTACK across evaluated datasets and attack settings.

  • Problem

    Graph-aware LLMs’ vulnerability to adversarial attacks remains largely unexplored, including the risk from imperceptible node-feature perturbations.

    Source: §1 · p. 1

  • Method

    The paper adapts graph poisoning and evasion attacks to LLAGA and GRAPHPROMPTER and proposes GALGUARD, combining LLM-based feature correction with adapted GNN structural defenses.

    Source: §1 · p. 2, §10 · p. 7

  • Results

    Feature perturbation attacks were highly effective, often outperforming structural attacks, and combined attacks could render graph-aware LLMs near-useless.

    Source: §11 · p. 7

  • Takeaways & Limitations

    The authors frame resilience to adversarial exploitation as important for graph-aware LLM deployment in areas including social networks, healthcare, and finance.

    Source: §11 · p. 7

    The threat model assumes black-box attackers with complete access to training or inference data, but limits their modifications by a predefined budget and unnoticeability constraints.

    Source: §3 · p. 3

Abstract

from arXiv · show

Large Language Models (LLMs) are increasingly integrated with graph-structured data for tasks like node classification, a domain traditionally dominated by Graph Neural Networks (GNNs). While this integration leverages rich relational information to improve task performance, their robustness against adversarial attacks remains unexplored. We take the first step to explore the vulnerabilities of graph-aware LLMs by leveraging existing adversarial attack methods tailored for graph-based models, including those for poisoning (training-time attacks) and evasion (test-time attacks), on two representative models, LLAGA (Chen et al. 2024) and GRAPHPROMPTER (Liu et al. 2024). Additionally, we discover a new attack surface for LLAGA where an attacker can inject malicious nodes as placeholders into the node sequence template to severely degrade its performance. Our systematic analysis reveals that certain design choices in graph encoding can enhance attack success, with specific findings that: (1) the node sequence template in LLAGA increases its vulnerability; (2) the GNN encoder used in GRAPHPROMPTER demonstrates greater robustness; and (3) both approaches remain susceptible to imperceptible feature perturbation attacks. Finally, we propose an end-to-end defense framework GALGUARD, that combines an LLM-based feature correction module to mitigate feature-level perturbations and adapted GNN defenses to protect against structural attacks.

1 Introduction

Graph-aware LLMs are increasingly used for graph tasks, but their vulnerability to adversarial attacks remains largely unexplored. This paper studies attacks on learned-projector models and introduces a new LLAGA attack surface and an integrated defense.

1 Introduction

  • Adversarial vulnerabilities of graph-aware LLMs remain largely unexplored, despite their growing use for graph-related tasks.Prior graph attacks target structure or node features, while imperceptible feature perturbations are a particular concern for models processing textual features.Source: §1 · p. 1
  • The paper asks whether GNN-designed poisoning and evasion attacks transfer to graph-aware LLMs, focusing on learned projectors in LLAGA and GRAPHPROMPTER.Both representative models use frozen pre-trained LLMs; the study excludes textual-description methods.Source: §1 · pp. 1–2
  • The study adapts NETTACK and METAATTACK, categorizes graph encodings, and assesses imperceptible node-feature attacks.These contributions examine attack transferability, encoding choices, and feature perturbations that have often been overlooked in GNN research.Source: §1 · p. 2
  • Injecting malicious placeholder nodes into LLAGA’s node sequence template creates a new attack surface that can degrade performance.The paper also proposes GALGUARD, combining LLM-based feature correction with adapted GNN structural defenses.Source: §1 · p. 2

2 Graph Encoding-Based Taxonomy of LLM Adaptations

The paper groups graph-aware LLM adaptations by how they encode graphs: textual descriptions or learned projectors. It focuses on learned projectors, represented by LLAGA and GRAPHPROMPTER.

2 Graph Encoding-Based Taxonomy of LLM Adaptations

  • Graph-aware LLMs encode graphs either as natural-language descriptions or through learned projectors that map graph data into forms LLMs can process.The taxonomy distinguishes direct textual presentation from learned graph-to-LLM representations.Source: §2 · p. 2
  • Textual-description methods offer a straightforward route but can struggle to capture structural intricacies, especially for large graphs, and depend heavily on prompt engineering.They explain graph information in natural language, often with instructions for querying LLMs.Source: §2 · p. 2
  • Learned projectors encode graph data as embeddings or graph vectors; LLAGA uses node-level templates and a linear projector, while other methods incorporate GNN layers.The category also includes graph neural prompts, GNN-adapted feature extractors, and graph-transformer prefixes.Source: §2 · p. 2
  • The study selects frozen-LLM projector methods for computational efficiency and examines LLAGA’s node templates and GRAPHPROMPTER’s GNN encoder.Textual-description methods are excluded because they often struggle with scalability and do not present the graph-specific vulnerabilities targeted here.Source: §2 · p. 2

3 Threat Model

The threat model adapts graph-attack assumptions to graph-aware LLMs. It gives attackers black-box access and bounded ability to alter or inject data to degrade classification performance.

3 Threat Model

  • The attacker operates in a black-box setting, without knowledge of the target model’s architecture or parameters.Influence is limited to indirect interaction with training or test data.Source: §3 · p. 3
  • Within a predefined budget and unnoticeability constraints, attackers may modify or inject data using feature or structure manipulation.The stated strategies include altering node features and adding or removing edges.Source: §3 · p. 3
  • The attacker aims to compromise model integrity by increasing the classification model’s misclassification rate.The threat-model examples include controlling a few bot accounts or sparsely connecting hoax articles to legitimate ones.Source: §3 · pp. 2–3

4 Experimental Setup

Experiments evaluate node classification on standard text-attributed graph benchmarks using LLAGA, GRAPHPROMPTER, and adapted NETTACK and METAATTACK attacks. The setup limits edge perturbations to maintain unnoticeability.

4 Experimental Setup

  • Experiments use Cora, Citeseer, and PubMed, with ArXiv added in an appendix experiment to assess scalability.The three main datasets are small-to-medium text-attributed graphs; standard train/validation/test splits are 6:2:2 for them and 5:2:3 for ArXiv.Source: §4 · p. 3, Table 1 · p. 3
  • Node classification is the primary task, and accuracy is the evaluation metric; experiments are repeated three times with mean and standard deviation reported.The experiments were conducted on an NVIDIA A40 GPU with 48GB of memory.Source: §4 · p. 3
  • LLAGA uses node-level templates and a linear projector, whereas GRAPHPROMPTER uses a GNN-based encoder and linear projector; both use a two-layer MLP projector.Their foundational LLMs are Vicuna-7B for LLAGA and LLAMA2-7B for GRAPHPROMPTER.Source: §4 · p. 3
  • The study adapts poisoning and evasion attacks from NETTACK and METAATTACK, perturbing only 10% of edges to maintain unnoticeability.NETTACK targets nodes for misclassification, while METAATTACK treats graph structure as a hyperparameter to optimize.Source: §4 · pp. 3–4

5 Results

Poisoning and evasion attacks adapted from graph attacks affect LLAGA and GRAPHPROMPTER differently: evasion is more damaging, and LLAGA is more vulnerable to structural perturbations. LLAGA encodes graph structure in node sequences, while GRAPHPROMPTER’s unchanged textual embeddings can augment perturbed structure.

5.1 Poisoning and Evasion Attacks on Graph-aware LLMs

  • Evasion attacks caused performance degradation of up to 51%, versus a maximum 11% for poisoning; METAATTACK generally outperformed NETTACK, and denser datasets were more vulnerable.LLAGA’s evasion performance decreased 51% on Cora and 19% on PubMed.Source: §5.1 · p. 4

5.2 Which Graph-aware Paradigm is More Susceptible to Graph Adversarial Attacks and Why?

  • LLAGA was more susceptible to attacks than GRAPHPROMPTER because its node sequences and Laplacian embeddings directly reflect perturbed graph structure.GRAPHPROMPTER’s textual node embeddings remain unchanged under structural perturbations and augment the perturbed graph structure.Source: §5.2 · p. 4

6 Node Sequence Template Injection Attacks

LLAGA’s fixed-shape neighborhood template creates placeholder slots that can be exploited to inject malicious nodes. These attacks substantially reduce evasion accuracy on Cora and Citeseer, while the reported drops are smaller on PubMed.

6 Node Sequence Template Injection Attacks

  • LLAGA’s fixed-shape computational tree uses placeholders when a node lacks enough neighbors, creating slots for malicious-node injection.The template samples each node’s neighbors at successive levels and preserves a fixed number of children, such as k = 10.Source: §6 · p. 4
  • Evasion accuracies under NI, SI, and MSI were 0.42, 0.36, and 0.30 on Cora, and 0.36, 0.30, and 0.24 on Citeseer.The table reports node-sequence injection results across datasets and methods, with clean performance as the baseline.Source: §6 · p. 5, Table 3 · p. 5
  • PubMed evasion accuracies under NI, SI, and MSI were 0.85, 0.82, and 0.76; the authors attribute the smaller impact to attack effects being diluted in the larger graph.They contrast this with more concentrated effects in the smaller, tightly connected Cora and Citeseer graphs.Source: §6 · p. 5
  • MSI evasion accuracies were 0.30, 0.24, and 0.76 on Cora, CiteSeer, and PubMed, respectively, versus METAATTACK’s 0.44, 0.50, and 0.73.The authors report node injection as more effective than traditional graph adversarial methods.Source: §6 · p. 5

7 Poisoning and Evasion Attack via Feature Perturbation

The paper tests imperceptible textual feature attacks alongside structural attacks on graph-aware LLMs. Reordering attacks are generally stronger than Homoglyph attacks, and feature-based Reordering outperforms structural METAATTACK on both models.

7 Poisoning and Evasion Attack via Feature Perturbation

  • Homoglyph attacks replace characters with visually similar ones, while Reordering attacks use direction-control characters to alter rendering order.The task-agnostic English-to-French translation objective generates perturbations intended to look identical while producing an incorrect translation.Source: §7 · p. 5
  • Reordering attacks caused LLAGA poisoning accuracy drops of 35% on Cora and 25% on CiteSeer, compared with Homoglyph drops of 27% and 23%.GRAPHPROMPTER was more resilient, and the overall impact on PubMed was less pronounced than on the smaller datasets.Source: §7 · p. 5
  • Differential evolution optimized the perturbations to maximize output Levenshtein distance, with a budget set to 10% of average textual-feature length.This procedure follows Boucher et al. (2022).Source: §7 · p. 5
  • Feature perturbation attacks, specifically Reordering, outperformed structural METAATTACK by a large margin on both LLAGA and GRAPHPROMPTER.The authors interpret this as evidence that these models are more vulnerable to feature perturbations than structural attacks.Source: §7 · p. 5

8 A Unified Imperceptible Attack on Graph-aware LLMs

The unified attack combines structural and feature perturbations to target graph-aware LLMs. Across datasets, it is reported to degrade performance significantly more than either perturbation method alone.

8 A Unified Imperceptible Attack on Graph-aware LLMs

  • The attack combines METAATTACK’s subtle edge adjustments with Homoglyph and Reordering feature perturbations to target relational and textual information together.The paper hypothesizes that combining the perturbation types will degrade accuracy more than either alone while keeping changes imperceptible.Source: §8 · pp. 5–6
  • The unified attack was significantly more effective than either structural or feature perturbation alone in degrading model performance across datasets.The authors connect its effectiveness to the models’ reliance on consistency between graph structure and node features.Source: §8 · p. 6, Table 5 · p. 6

9 Ablation Study

Lower feature-perturbation rates weaken attacks and bring poisoning and evasion success rates closer together. Swapping the foundation LLM has minimal impact on adversarial robustness.

9.1 Varying Feature Perturbation

  • As feature perturbation falls from 10% toward 1%, attacks become less successful and poisoning and evasion success rates tend to converge across models and datasets.The adversarial signal becomes too weak to significantly affect performance regardless of whether perturbations occur during training or inference.Source: §9.1 · p. 6

9.2 Does the Choice of LLM Affect Attack Performance?

  • Vicuna: 0.89 ± 0.07 and Llama2: 0.90 ± 0.03 on Cora, with backbone swaps showing comparable vulnerability under poisoning and evasion attacks.The trend also holds when swapping LLMs in GRAPHPROMPTER.Source: §9.2 · p. 6

10 Defense: GALGUARD

GALGUARD combines LLM-based feature correction with adapted GNN structural defenses to address graph-aware LLMs’ dual vulnerability. Across Cora, CiteSeer, and PubMed, the full defense improves robustness over GALGUARDp under METAATTACK poisoning and evasion.

10 Defense: GALGUARD

  • Existing GNN defenses can fail when feature perturbations violate their clean-feature assumptions or when attacks coordinate structure and features.Feature-similarity defenses may fail on perturbed features, while defenses decoupling structure and features and OCR-based sanitization break down under coordinated attacks.Source: §10 · pp. 6–7
  • GALGUARD uses an LLM to correct anomalous node features, then applies graph purification and adapted GNN defenses to address structural perturbations.For LLAGA, purification is incorporated into its node-sequence computational tree, alongside a learnable global structural context embedding.Source: §10 · p. 7, Figure 4 · p. 7

10.1 Results

  • Across Cora, CiteSeer, and PubMed, full GALGUARD improves robustness more than GALGUARDp under METAATTACK poisoning and evasion.Both defenses mitigate attack impact; GALGUARDp combines feature correction and graph purification, while full GALGUARD adds GNNGuard or its adaptation.Source: Table 6 · p. 7, §10.1 · p. 7

11 Conclusion

The paper identifies vulnerabilities in graph-aware LLMs, including increased susceptibility from LLAGA’s node-sequence template and strong effects from feature perturbations. It proposes GALGUARD, combining LLM-based feature correction with adapted GNN structural defenses.

11 Conclusion

  • Feature perturbations often outperform traditional structural attacks, while combining both perturbation types can render graph-aware LLMs near-useless.The node-sequence template in LLAGA is also identified as increasing susceptibility.Source: §11 · p. 7
  • GALGUARD integrates an LLM-based feature corrector with adapted GNN-based structural defenses to provide robust protection.The paper presents this as an end-to-end defense.Source: §11 · p. 7

A Appendix

The appendix motivates the study’s focus on frozen graph-projector LLMs and describes its attacks, LLAGA’s template-injection attack, ablations, and dataset-dependent results. It discusses vulnerabilities from graph encodings and feature perturbations, why GNN defenses may not transfer, and the need to balance performance with robustness.

Graph Representation as a Learned Projector

A.3 How NETTACK and METAATTACK Work

  • NETTACK (Z¨ugner, Akbarnejad, and G¨unnemann 2018) greedily perturbs edges using a linearized two-layer GCN surrogate, while METAATTACK (Z¨ugner and G¨unnemann 2019) uses bi-level optimization and meta-gradients.The study adapts NETTACK to untargeted attacks, limits both methods to perturbing 10% of edges, and uses structural perturbations for poisoning or test-time evasion.Source: §A.2 · p. 13, §A.3 · p. 14

A.4 Algorithm for Node Sequence Template Injection Attacks

  • LLAGA’s fixed-depth, fixed-branching node template creates placeholders when a node has too few neighbors, which attackers exploit with non-adjacent or high-degree nodes.The three strategies are Non-Adjacent Injection (NI), Supernode Injection (SI), and Multiple Supernode Injection (MSI); injected uninformative nodes corrupt the target sequence and impair projection-layer training.Source: §A.4 · p. 15

Feature Attack Examples

Impact of Graph Encoding on Adversarial Vulnerability

  • LLAGA’s node-sequence template introduces an attack surface, while GRAPHPROMPTER’s GNN-based projector is comparatively more resilient to adversarial attacks.The authors frame this as a tradeoff: node-level templates incorporate graph structure but enable vulnerabilities not present in traditional GNNs.Source: Impact of Graph Encoding on… · p. 15, §A.8 · p. 15

Sensitivity of Graph-aware LLMs to Feature Perturbations

Ablation Results: Does the Choice of LLM Affect Attack Performance?

  • Under METAATTACK evasion on Cora, LLAGA accuracy is 0.44 ± 0.06 with Vicuna-7B and 0.43 ± 0.08 with Llama2-7B, with differences within standard deviation.The appendix reports that base-LLM choice has minimal impact on clean performance and adversarial vulnerability across Cora, Citeseer, and PubMed.Source: Ablation Results: Does the Choice of… · p. 15, Table 8 · p. 16

A.6 Results on the ArXiv Dataset

  • On ArXiv, with 169,343 nodes, 1,166,243 edges, and 0.81 sparsity, poisoning outperforms evasion across all three injection strategies, unlike on Cora, Citeseer, and PubMed.The authors suggest ArXiv’s structural characteristics may make it more vulnerable to poisoning but more robust to evasion.Source: §A.6 · p. 15, Table 9 · p. 16, Data-dependent Variability of… · p. 18

Implications for Graph-aware LLM Development

  • Graph-aware LLM development requires weighing performance against vulnerability and advancing robust encodings and defenses against adversarial manipulation, especially feature perturbations.Understanding how attacks transfer from GNNs to graph-aware LLMs is another research direction for protecting these models.Source: Implications for Graph-aware LLM… · p. 18

Difficulty in Applying Existing GNN defenses Against Adversarial Attacks on Graph-aware LLMs

  • Feature perturbation attacks can manipulate graph-aware LLMs; imperfect OCR handling of homoglyphs motivates an LLM-based self-correcting defense (Boucher et al. 2022).The passage notes that OCR can misinterpret homoglyphs more often than unperturbed text.Source: Difficulty in Applying Existing GNN… · p. 19
  • GNN structural defenses often fail when graph-aware LLM attacks also perturb features, because clean-feature assumptions can reconstruct incorrect edges instead of preserving original connections.For a Cora node, edges reconstructed from perturbed features failed to preserve any original connections (Figure 8).Source: Difficulty in Applying Existing GNN… · p. 19, Figure 8 · p. 20
Loading 2508.04894v1…