Let Prompts Bridge Defense Knowledge: Transferable Graph Purification via Vulnerability-Aware GPL

• GNN message propagation supports structured multimedia applications including cross-modal event extraction and personalized recommendation.Node features and hidden representations are propagated within k-ego subgraphs.Source: §1 · p. 1
• Minor graph perturbations can severely compromise GNN performance, motivating adversarial purification before message passing.Purification removes adversarial edges directly through a specialized purifier.Source: §1 · p. 1
• Single-domain defenses provide insufficient coverage of vulnerability patterns and require domain-specific retraining, limiting transferability and scalability.Perturbations exploit vulnerable structures that may appear infrequently within one domain.Source: §1 · p. 2
• ProGAP pretrains an edge detector on a data-rich upstream graph using structural and semantic information, then reuses it across downstream domains.The scheme avoids training a separate defense model for each target graph.Source: §1 · p. 2
• Vulnerability-aware prompts guide the frozen detector toward perturbation-sensitive downstream nodes under graph distribution shifts.The prompts target biased nodes vulnerable to attacks and adapt purification guidance without parameter-laborious updates.Source: §1 · p. 2

Graph Adversarial Defense

• Existing graph defenses include low-rank purification, PageRank-based purification, jointly learned graph properties, and Laplacian-distance adversarial diffusion.These methods include GCN-SVD, GPR-GAE, ProGNN, and GADC.Source: §2.1 · p. 2
• Despite their robustness mechanisms, the reviewed defense methods are limited to a single domain and cannot transfer across domains.Source: §2.1 · p. 2

Graph Knowledge Transfer

• Graph knowledge transfer adapts structural priors and representational patterns from source graphs to target domains, commonly through pretraining followed by fine-tuning.Source: §2.2 · p. 2

Graph Prompt Learning

• Full fine-tuning can be inefficient and susceptible to overfitting and catastrophic forgetting, motivating graph prompt learning to reduce resource requirements.Source: §2.2 · p. 2, §2.3 · p. 2
• Graph prompt paradigms guide downstream tasks through token pairs, feature-space parameters, prompt graphs, or multi-task dual prompts.Examples include GPPT, GPF/GPF-Plus, All-in-One, and MultiGprompt.Source: §2.3 · p. 2

3.1 Notations

• An undirected unweighted graph is represented by node and edge sets, with a binary adjacency matrix, node-feature matrix, and node labels.The notation uses G={V,E}, A∈{0,1}^n×n, X∈R^N×d, and labels Y.Source: §3.1 · p. 2
• The downstream formulation uses a pretrained GNN purifier and learnable prompt tokens that map attacked graph inputs to modified representations for task prediction.The prediction objective is represented by L_Task(·).Source: §3.1 · p. 3

3.2 Threat Models

• The threat model considers gray-box global poisoning and white-box adaptive attacks that manipulate graph edges through insertions or deletions.The gray-box attacker can access graph data and labels, while the adaptive attacker has complete defender-model information.Source: §3.2 · p. 3
• Under global poisoning, the attacker seeks a perturbed graph that maximizes downstream classifier impairment subject to a maximum perturbation rate.The attack objective uses the perturbed adjacency matrix and a perturbation budget Δ.Source: §3.2 · p. 3
• Under adaptive attacks, the attacker targets purification while maximizing classification loss after purification with access to the detector, prompts, and classifier.Source: §3.2 · p. 3

• ProGAP comprises universal adversarial knowledge perception, vulnerability-aware prompt generation, and prompt-guided graph purification.Source: §4.1 · p. 3, Figure 2 · p. 4

Universal Adversarial Knowledge Perception

• The pretrained perturbation capturer learns general vulnerability representations by decoupling structural and semantic perturbations in a source graph.Source: §4.1 · p. 3, §4.2 · p. 3
• PGD perturbs the clean graph to expose adversarial patterns, labeling inserted attacker edges as 0 and preserved clean edges as 1.Source: §4.2 · p. 3
• The edge detector fuses topology and semantic similarity with learnable attention weights, producing an adversarial-edge probability and optimizing it with cross-entropy.Source: §4.2 · p. 3

Vulnerability-Aware Prompt Generation

• Vulnerability-aware prompts target low-degree and low-similarity nodes because adversarial effects concentrate on structurally or semantically vulnerable regions.Source: §4.3 · pp. 3–4
• A connection score expands vulnerability identification to nodes connected predominantly to vulnerable nodes, accounting for message-passing propagation.Source: §4.3 · p. 4

Prompt-Guided Graph Purification

• Prompt tokens are fused according to each node’s vulnerability profile, and the prompt-enhanced graph is evaluated to remove edges below the adversarial decision threshold.Source: §4.3 · p. 5, §4.4 · p. 5
• A structure-agnostic MLP supplies pseudo-labels that provide a semantic prior, while classification gradients jointly refine prompts and purified topology.Source: §4.4 · p. 5

Robustness evaluation

• ProGAP achieves the best performance in 22 out of 28 adversarial settings, especially at higher perturbation rates.GADC and GPR-GAE are occasionally competitive but less stable across datasets.Source: §5.2 · p. 5

Cross-domain transfer

• ProGAP maintains stable performance across datasets with varying structural characteristics and retains SOTA performance after pretraining on Computers or Photo.These results support cross-domain generalization from upstream product-sales graphs.Source: §5.2 · p. 5

Impact of GPL

• ProGAP substantially improves homophily in both node features and learned embeddings after purification.The results indicate restoration of graph properties disrupted by adversarial edges.Source: §5.2 · p. 5
• GPL-migrated pretrained models generally outperform directly applied pretrained models across datasets and attack types.Embedding visualizations further associate GPL with more stable decision boundaries, improved inter-class separation, and reduced intra-class variance.Source: §5.3 · pp. 6–7
• Vulnerability-aware prompts outperform generic prompts for robust cross-domain transfer by targeting biased nodes susceptible to adversarial attacks.The comparison includes GPF and GPF-Plus as representative generic prompt baselines.Source: §5.3 · pp. 6–7

Efficiency

• Prompt learning reduces update overhead, while the transferable edge detector avoids separate perturbation-generation and classification stages on each graph.The study compares total runtime against competitive defense methods.Source: §5.4 · p. 7

Adaptive attacks

• ProGAP significantly outperforms baselines under adaptive poisoned and evasion attacks, even when attackers have complete defense information.The evaluation covers attackers with access to the model architecture and training procedures.Source: §5.5 · p. 7

Ablation studies

• Removing either semantic or topological modeling causes substantial degradation, while removing vulnerability-aware prompts lowers accuracy.Excluding pseudo labels causes only a slight drop, indicating that the detector and prompts provide the main detection capability.Source: §5.6 · pp. 7–8

• ProGAP transfers adversarial topological knowledge across multimedia domains using lightweight prompts.Source: §6 · p. 8
• The scheme outperforms state-of-the-art techniques across diverse attack scenarios while resisting adaptive attacks.Source: §6 · p. 8
• Vulnerability-aware prompts achieve stronger robust transfer than generic prompts by targeting structurally and semantically vulnerable nodes.Source: §6 · p. 8
• Freezing the pretrained edge detector and optimizing only lightweight prompts improves defense efficiency.Source: §6 · p. 8