Metraipolis › archive › dc_477bfadd2f02

A Separation Principle for Adversarial Attacks and Defense of Graph Neural Networks — arXiv:2610.38127

Source: arXiv (en)
Original: https://arxiv.org/abs/2610.38127
License (as archived): CC0-1.0
Archived: 2026-11-01T02:23:24.049Z
SHA-256 of the archived text: a314b01d5d2cdd58f70b0137640759797788161f7e19dc3dceb32aeb0da99545
Stable URL of this page: https://metraipolis.com/documento/dc_477bfadd2f02

How to cite

A Separation Principle for Adversarial Attacks and Defense of Graph Neural Networks — arXiv:2610.38127 — arXiv (en), https://arxiv.org/abs/2610.38127 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_477bfadd2f02 (Metraipolis archive dc_477bfadd2f02, sha256 a314b01d5d2cdd58f70b0137640759797788161f7e19dc3dceb32aeb0da99545)

BibTeX

@misc{dc477bfadd2f02,
  title = {A Separation Principle for Adversarial Attacks and Defense of Graph Neural Networks — arXiv:2610.38127},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2610.38127},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_477bfadd2f02; sha256 a314b01d5d2cdd58f70b0137640759797788161f7e19dc3dceb32aeb0da99545},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2610.38127. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Adversarial attacks on graph neural networks (GNNs) have been studied as a model-centric optimization problem driven by gradients, learned policies, or meta-learning, with the graph treated as a passive substrate. This view overlooks a defining feature of GNNs: their predictions are produced by structured message passing along the graph, so their adversarial vulnerabilities are encoded as much in the geometry of the graph as in the learned weights. We develop a structure-driven framework for feature attacks in which the attack is derived from the spectral properties of the normalized adjacency operator. Its central result is a separation principle: under a natural relaxation of the attack objective, the optimal feature perturbation is rank one and factorizes into a graph-dependent component (degree-proportional spatial allocation, depending only on the graph) and a weight-dependent component (top singular vector of the composed weights, depending only on the weights). Node degree thus emerges as the fundamental graph quantity governing adversarial vulnerability to feature perturbations. The resulting attack, which we call SepAttack, requires no gradient computation, carries analytical guarantees, achieves competitive or superior performance against established baselines such as Nettack and IG-Attack with up to ${\sim}70\times$ speedup in the targeted setting, and transfers near-perfectly across architectures on continuous-feature graphs because its graph-dependent component is architecture-invariant by construction. We further derive a separation-principle adversarial training procedure (SepAT) directly from the closed-form worst-case attack and report robustness gains on binary-feature benchmarks.

Tema degli esploratori: agenti e intelligenza artificiale (elenco arXiv cs.LG, nuovi lavori del giorno).
Categorie arXiv: Machine Learning (cs.LG).
Pagina del lavoro: https://arxiv.org/abs/2610.38127 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-11-01T02:12:44.102Z dalla pagina https://arxiv.org/list/cs.LG/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).