Source-linked AI summary
Let Prompts Bridge Defense Knowledge: Transferable Graph Purification via Vulnerability-Aware GPL
Shuomin Xue, Jingyuan Li, Ju Jia, Jingxuan Yu, Xiaojun Jia
TL;DR
Existing graph adversarial purification methods are restricted to single domains, limiting vulnerability coverage and requiring costly retraining. ProGAP transfers adversarial defense knowledge through a pretrained edge detector and vulnerability-aware prompts, achieving stronger robustness and generalization across diverse attack settings while reducing domain-specific updating.
Problem
Single-domain purification limits coverage of adversarial vulnerability patterns and requires computationally costly domain-specific retraining, reducing cross-domain transferability.
Method
ProGAP pretrains a perturbation-capture edge detector using structural and semantic information, then uses vulnerability-aware prompts to transfer purification guidance across downstream graphs.
Results
ProGAP achieves the best performance in 22 out of 28 adversarial settings and maintains stable performance across datasets with different structural characteristics.
Takeaways & Limitations
Lightweight vulnerability-aware prompts can transfer adversarial topological knowledge across multimedia domains, while the pretrained edge detector and prompts provide the core detection capability.
Takeaways & Limitations
The evaluation focuses on structural edge perturbations under gray-box global poisoning and white-box adaptive attack scenarios.
Abstract
from arXiv · showhide
Graph Neural Networks (GNNs) have emerged as a cornerstone for representing complex relational dependencies in diverse multimedia tasks, particularly in cross-platform user interest modeling and cross-modal semantic alignment. In the real world, a practical defense against graph adversarial perturbations is needed. However, we observe that the prevailing adversarial purification methods are essentially domain-restricted defenses, which leads to the following shortcomings: (1) single-domain data provides insufficient structural and semantic diversity for learning robust purification criteria; (2) training of domain-specific defense strategies from scratch consumes substantial computational cost. To address the above limitations, we propose a transferable graph purification scheme, named ProGAP, to bridge adversarial defense knowledge via vulnerability-aware graph prompt learning. Firstly, to capture universal adversarial patterns, a perturbation-capture edge detector is pretrained on data-rich graphs by jointly modeling topological and semantic information. Subsequently, to achieve more knowledge transfer w.r.t. robustness, vulnerability-aware prompts are designed that inject targeted purification guidance into biased nodes, during which the pretrained detector adapts to distribution shifts in downstream graphs without parameter-laborious updates. Experimental results demonstrate that compared with state-of-the-art baselines, our ProGAP achieves 1%-9% improvement, and reduces the time consumption by up to 2.2x. The code for ProGAP is available at https://github.com/Lieyoufffff/ProGAP.
1 Introduction
GNNs support structured multimedia applications but are highly vulnerable to graph perturbations, while existing purification defenses remain domain-specific. ProGAP transfers adversarial knowledge across domains using a pretrained detector and vulnerability-aware prompts.
- GNN message propagation supports structured multimedia applications including cross-modal event extraction and personalized recommendation.Node features and hidden representations are propagated within k-ego subgraphs.
- Minor graph perturbations can severely compromise GNN performance, motivating adversarial purification before message passing.Purification removes adversarial edges directly through a specialized purifier.
- Single-domain defenses provide insufficient coverage of vulnerability patterns and require domain-specific retraining, limiting transferability and scalability.Perturbations exploit vulnerable structures that may appear infrequently within one domain.
- ProGAP pretrains an edge detector on a data-rich upstream graph using structural and semantic information, then reuses it across downstream domains.The scheme avoids training a separate defense model for each target graph.
- Vulnerability-aware prompts guide the frozen detector toward perturbation-sensitive downstream nodes under graph distribution shifts.The prompts target biased nodes vulnerable to attacks and adapt purification guidance without parameter-laborious updates.
2 Related Work
Prior graph defenses improve GNN robustness through purification or robust architectures, but these approaches generally remain confined to individual domains. Graph transfer and prompt-learning research motivates more resource-efficient adaptation across domains.
- Graph Adversarial Defense: Existing graph defenses include low-rank purification, PageRank-based purification, jointly learned graph properties, and Laplacian-distance adversarial diffusion.These methods include GCN-SVD, GPR-GAE, ProGNN, and GADC.
- Graph Adversarial Defense: Despite their robustness mechanisms, the reviewed defense methods are limited to a single domain and cannot transfer across domains.
- Graph Knowledge Transfer: Graph knowledge transfer adapts structural priors and representational patterns from source graphs to target domains, commonly through pretraining followed by fine-tuning.
- Graph Prompt Learning: Full fine-tuning can be inefficient and susceptible to overfitting and catastrophic forgetting, motivating graph prompt learning to reduce resource requirements.
- Graph Prompt Learning: Graph prompt paradigms guide downstream tasks through token pairs, feature-space parameters, prompt graphs, or multi-task dual prompts.Examples include GPPT, GPF/GPF-Plus, All-in-One, and MultiGprompt.
3 Preliminary
The paper models graphs with nodes, edges, adjacency matrices, features, and labels, and formulates prompt-based purification over attacked graphs. Its threat models focus on structural edge perturbations under gray-box poisoning and white-box adaptive attacks.
- 3.1 Notations: An undirected unweighted graph is represented by node and edge sets, with a binary adjacency matrix, node-feature matrix, and node labels.The notation uses G={V,E}, A∈{0,1}^n×n, X∈R^N×d, and labels Y.
- 3.1 Notations: The downstream formulation uses a pretrained GNN purifier and learnable prompt tokens that map attacked graph inputs to modified representations for task prediction.The prediction objective is represented by L_Task(·).
- 3.2 Threat Models: The threat model considers gray-box global poisoning and white-box adaptive attacks that manipulate graph edges through insertions or deletions.The gray-box attacker can access graph data and labels, while the adaptive attacker has complete defender-model information.
- 3.2 Threat Models: Under global poisoning, the attacker seeks a perturbed graph that maximizes downstream classifier impairment subject to a maximum perturbation rate.The attack objective uses the perturbed adjacency matrix and a perturbation budget Δ.
- 3.2 Threat Models: Under adaptive attacks, the attacker targets purification while maximizing classification loss after purification with access to the detector, prompts, and classifier.
4 Method
ProGAP transfers adversarial purification knowledge across graphs by pretraining a detector that combines structural and semantic signals, then adapting it with vulnerability-aware prompts. The prompts target vulnerable nodes and guide edge removal, while semantic pseudo-labels support joint refinement of node features and purified topology.
- ProGAP comprises universal adversarial knowledge perception, vulnerability-aware prompt generation, and prompt-guided graph purification.
- Universal Adversarial Knowledge Perception: The pretrained perturbation capturer learns general vulnerability representations by decoupling structural and semantic perturbations in a source graph.
- Universal Adversarial Knowledge Perception: PGD perturbs the clean graph to expose adversarial patterns, labeling inserted attacker edges as 0 and preserved clean edges as 1.
- Universal Adversarial Knowledge Perception: The edge detector fuses topology and semantic similarity with learnable attention weights, producing an adversarial-edge probability and optimizing it with cross-entropy.
- Vulnerability-Aware Prompt Generation: Vulnerability-aware prompts target low-degree and low-similarity nodes because adversarial effects concentrate on structurally or semantically vulnerable regions.
- Vulnerability-Aware Prompt Generation: A connection score expands vulnerability identification to nodes connected predominantly to vulnerable nodes, accounting for message-passing propagation.
- Prompt-Guided Graph Purification: Prompt tokens are fused according to each node’s vulnerability profile, and the prompt-enhanced graph is evaluated to remove edges below the adversarial decision threshold.
- Prompt-Guided Graph Purification: A structure-agnostic MLP supplies pseudo-labels that provide a semantic prior, while classification gradients jointly refine prompts and purified topology.
5 Experiment
Experiments evaluate ProGAP across standard and adaptive attacks, cross-domain transfer, efficiency, ablations, and homophily shifts. ProGAP generally provides robust, stable defense performance while transferring adversarial knowledge across graph domains.
- Robustness evaluation: ProGAP achieves the best performance in 22 out of 28 adversarial settings, especially at higher perturbation rates.GADC and GPR-GAE are occasionally competitive but less stable across datasets.
- Cross-domain transfer: ProGAP maintains stable performance across datasets with varying structural characteristics and retains SOTA performance after pretraining on Computers or Photo.These results support cross-domain generalization from upstream product-sales graphs.
- Impact of GPL: ProGAP substantially improves homophily in both node features and learned embeddings after purification.The results indicate restoration of graph properties disrupted by adversarial edges.
- Impact of GPL: GPL-migrated pretrained models generally outperform directly applied pretrained models across datasets and attack types.Embedding visualizations further associate GPL with more stable decision boundaries, improved inter-class separation, and reduced intra-class variance.
- Impact of GPL: Vulnerability-aware prompts outperform generic prompts for robust cross-domain transfer by targeting biased nodes susceptible to adversarial attacks.The comparison includes GPF and GPF-Plus as representative generic prompt baselines.
- Efficiency: Prompt learning reduces update overhead, while the transferable edge detector avoids separate perturbation-generation and classification stages on each graph.The study compares total runtime against competitive defense methods.
- Adaptive attacks: ProGAP significantly outperforms baselines under adaptive poisoned and evasion attacks, even when attackers have complete defense information.The evaluation covers attackers with access to the model architecture and training procedures.
- Ablation studies: Removing either semantic or topological modeling causes substantial degradation, while removing vulnerability-aware prompts lowers accuracy.Excluding pseudo labels causes only a slight drop, indicating that the detector and prompts provide the main detection capability.
6 Conclusion
ProGAP addresses the single-domain limitation of adversarial graph purification by transferring adversarial topological knowledge through lightweight, vulnerability-aware prompts. Experiments report robust performance across attack scenarios and improved defense efficiency by freezing the pretrained edge detector.
- ProGAP transfers adversarial topological knowledge across multimedia domains using lightweight prompts.
- The scheme outperforms state-of-the-art techniques across diverse attack scenarios while resisting adaptive attacks.
- Vulnerability-aware prompts achieve stronger robust transfer than generic prompts by targeting structurally and semantically vulnerable nodes.
- Freezing the pretrained edge detector and optimizing only lightweight prompts improves defense efficiency.