Lyapunov Stable Graph Neural Flow

Haoyu Chu; Xiaotong Chen; Wei Zhou; Wenjun Cui; Kai Zhao; Shikui Wei; Qiyu Kang

cs.LGMar 13, 2026

Lyapunov Stable Graph Neural Flow

Authors: Haoyu Chu, Xiaotong Chen, Wei Zhou, Wenjun Cui, Kai Zhao, Shikui Wei, Qiyu Kang

Organizations: School of Computer Science and Technology / School of Artificial Intelligence, China University of Mining and Technology, Xuzhou 221008, China · School of Information Science and Technology, University of Science and Technology of China, Hefei 230026, China

Abstract

Graph Neural Networks (GNNs) are highly vulnerable to adversarial perturbations in both topology and features, making the learning of robust representations a critical challenge. In this work, we bridge GNNs with control theory to introduce a novel defense framework grounded in integer- and fractional-order Lyapunov stability. Unlike conventional strategies that rely on resource-heavy adversarial training or data purification, our approach fundamentally constrains the underlying feature-update dynamics of the GNN. We propose an adaptive, learnable Lyapunov function paired with a novel projection mechanism that maps the network's state into a stable space, thereby offering theoretically provable stability guarantees. Notably, this mechanism is orthogonal to existing defenses, allowing for seamless integration with techniques like adversarial training to achieve cumulative robustness. Extensive experiments demonstrate that our Lyapunov-stable graph neural flows substantially outperform base neural flows and state-of-the-art baselines across standard benchmarks and various adversarial attack scenarios.

Figures & tables

Fig. 1 : The scratch of the Lyapunov stability module. The black dashed box illustrates the dynamic evolution of the base graph neural flow over the time interval $[0,t_{n}]$ , where the fractional case captures long-range memories by incorporating historical states, unlike the integer-order’s behavior depends solely on the current state. The orange dashed box depicts the projected Lyapunov-stable system, which satisfies the conditions of the Lyapunov’s direct method, where the Lyapunov function is implemented by an input-convex neural network, a fully connected neural network with special properties.

Dataset	# Nodes	# Edges	# Features	# Classes	max # Nodes (for GIA)	max # Edges (for GIA)
Cora	2708	5429	1433	7	60	20
Citeseer	3327	4732	3703	6	90	10
Computers	18333	81894	6805	15	300	150
PubMed	19717	44338	500	3	200	100

TABLE I : Benchmarks details and the attacks’s budgets of graph injection attacks (GIA)

Dataset

Attack

GRAND

IL-GRAND

F-GRAND

FL-GRAND

GBel

IL-GBel

F-GBel

FL-GBel

GCON

IL-GCON

F-GCON

FL-GCON

HANG

Cora

clean

82.24±1.82

88.88±0.97

86.44±0.31

88.95±0.39

79.07±0.46

85.73±0.73

77.55±0.79

86.74±0.93

83.10±0.63

86.97±0.60

82.42±0.89

87.10±0.80

87.13±0.86

PGD

36.80±1.86

79.01±1.24

56.38±6.39

80.76±0.33

63.93±3.88

80.86±0.73

69.50±2.83

82.60±0.67

48.38±2.44

72.71±0.38

56.70±4.36

74.28±0.69

78.37±1.84

TDGIA

40.0±3.52

73.41±1.17

54.88±6.72

78.06±0.39

53.22±2.95

73.67±1.21

56.94±1.82

81.87±0.60

46.43±2.82

60.46 ±3.85

54.24±2.54

77.06±0.73

79.76±0.99

MetaGIA

37.89±1.56

74.64±1.64

53.36±5.31

78.69±0.36

66.74±3.23

82.20±1.66

71.98±1.32

82.84±0.56

52.21±2.71

61.56±1.51

63.97±2.09

67.74±0.92

77.48±1.02

Citeseer

clean

72.52±0.73

75.47±0.64

71.91±0.43

75.66±0.48

74.75±0.28

74.58±0.70

71.09±0.30

75.03±0.47

72.07±0.93

63.08±1.02

73.50±0.43

74.61±0.80

74.11±0.62

PGD

42.20±2.77

71.62±1.39

61.26±1.23

72.04±1.23

47.73±5.87

72.79±0.52

60.78±2.37

73.22±1.23

37.71±7.0

61.03±0.95

54.47±1.0

61.52±0.77

72.31±1.16

TABLE II : Node classification accuracy (%) on graph injection, evasion, non-targeted, black-box attack in INDUCTIVE learning. Results under adversarial attacks that surpass the competing methods are bold . Second best results are with the underline

Dataset

Ptb(%)

GRAND

IL-GRAND

F-GRAND

FL-GRAND

GBel

IL-GBel

F-GBel

FL-GBel

GCON

IL-GCON

F-GCON

FL-GCON

HANG

Cora

82.24±1.82

78.56±0.39

81.25±0.89

81.75±0.75

80.28±0.87

79.32±0.49

79.05±0.73

78.40 ±0.18

83.10±0.79

80.67±0.09

80.91±0.54

80.00±0.06

78.97±0.49

77.04±0.49

78.84±0.57

81.04±0.12

77.70±0.66

77.53±0.47

76.10±0.74

76.26±0.55

77.90±1.14

77.11±0.21

77.80±0.44

76.20±0.33

75.02±1.25

76.58±0.15

76.61±0.15

80.08±0.29

74.30±0.88

74.19±0.21

74.03±0.47

75.15±0.29

72.53±1.08

75.55±0.20

74.63±1.42

75.20±0.52

71.43±1.09

76.48±0.17

73.42±0.97

79.83±0.27

72.14±0.69

72.35±0.70

73.01±0.75

74.31±0.63

69.83±0.68

73.99±0.27

73.01±0.78

73.22±0.55

60.53±1.99

76.48±0.20

69.27±2.10

78.20±0.43

65.41±0.99

72.91±0.48

69.35±1.23

73.64±0.09

57.28±1.62

72.48±0.22

69.23±1.35

72.99±0.39

55.26±2.14

75.99±0.20

64.47±1.83

76.70±0.60

62.31±1.13

71.72±0.33

67.63±0.93

72.72±0.22

53.17±1.52

70.02±0.73

65.27±1.33

72.17±0.61

TABLE III : Classification accuracy (%) under modification, poisoning, non-targeted attack (Metattack) in TRANSDUCTIVE learning

Dataset

Attack

GRAND

IL-GRAND

FL-GRAND

FL-GRAND+AT

GBel

IL-GBel

FL-GBel

FL-GBel+AT

GCON

IL-GCON

FL-GCON

FL-GCON+AT

HANG

Cora

clean

87.53±0.59

89.12±0.23

89.58±0.60

89.24±0.84

86.13±0.51

86.47±0.58

87.03±1.06

85.79±0.84

84.69±1.10

87.97±0.23

85.53±0.96

87.13±0.86

88.31±0.48

PGD

36.02±4.09

70.01±0.88

72.22±0.64

72.75±0.91

37.16±1.69

59.87±2.26

59.43±2.43

61.35±1.96

35.83±0.71

53.45±1.01

52.96±1.19

53.90±1.24

67.69±3.84

TDGIA

14.72±1.97

58.55±1.34

56.65±2.91

59.32±1.84

15.46±1.98

66.98±2.14

67.54±2.01

69.12±2.46

33.05±1.09

55.14±1.96

54.44±1.40

55.90±2.95

64.54±3.95

Citeseer

clean

74.98±0.45

74.66±0.63

75.03±0.66

74.88±0.59

69.62±0.56

74.56±1.17

74.69±1.19

73.04±0.51

74.84±0.49

64.09±2.48

74.36±1.04

73.51±2.00

74.11±0.62

PGD

38.57±1.94

66.58±0.77

66.79±0.98

67.97±1.16

32.24±1.21

67.02±1.25

66.21±1.50

70.46±2.13

42.78±1.54

52.00±4.27

58.23±4.69

65.23±1.19

67.54±1.52

TDGIA

30.11±1.43

54.91±0.66

54.31±0.86

55.37±0.45

16.26±1.20

75.35±0.58

75.63±0.77

76.09±0.79

33.55±1.10

66.14±1.38

66.46±0.99

67.01±2.04

63.29±3.15

TABLE IV : Node classification accuracy (%) on graph injection, evasion, non-targeted, white-box attack in inductive learning. AT is the abbreviation for adversarial training.

Dataset	Attack	IL-GRAND (w/o ES layer)	IL-GBel (w/o ES layer)	IL-GCON (w/o ES layer)	FL-GRAND (w/o ES layer)	FL-GBel (w/o ES layer)	FL-GCON (w/o ES layer)
Cora	clean	87.77±1.01	86.29±1.07	85.47±0.75	88.18±1.38	85.98±1.53	84.33±0.46
	PGD	78.88±0.92	79.75±0.46	70.27±0.72	78.84±1.24	78.00±0.87	70.18±0.89
	TDGIA	72.40±0.83	74.06±1.27	69.62±0.96	74.76±1.18	74.78±0.99	76.43±1.31
	MetaGIA	76.44±0.89	76.20±0.87	61.50±1.51	76.98±0.58	83.02±1.54	64.08±1.55
Citeseer	clean	73.39±0.85	72.93±0.63	66.70±1.68	73.26±1.08	73.52±1.13	63.47±1.18
	PGD	70.79±0.80	71.98±1.41	60.84±0.94	71.21±0.65	72.29±1.37	61.12±0.36

TABLE V: Classification accuracy (%) of the IL- and FL-GNNs without equilibrium-separating (ES) layer on graph injection, evasion, non-targeted attack in inductive learning

Fig. 2 : Training time (s/epoch) and inference time (s) on the Cora dataset with

t\in[0,10]

and step size of 1.

Attack	# N./E.	FL-GRAND	FL-GBel	FL-GCON
PGD	80/40	73.76±0.52	81.67±0.82	68.14±0.76
	120/80	65.39±1.06	77.18±0.99	61.44±1.79
	160/120	55.63±2.49	73.56±0.94	56.49±1.37
	200/160	52.02±4.91	66.41±0.74	55.23±2.09
TDGIA	80/40	75.20±1.25	79.66±0.85	72.71±0.66
	120/80	68.54±0.66	73.58±0.95	59.34±3.99

TABLE VI: Node classification accuracy (%) on graph injection, evasion, non-targeted attack in inductive learning under different attack amplitudes on the Cora dataset. # N./E. means the number of nodes and edges injected.

Panel of Figure 9 — Fig. 3 : Influence of $\beta$ on the robust test accuracy on Cora dataset.

Xiaotong Chen received the B.E. degree from Henan University at Kaifeng and M.S. degree from Beijing Jiaotong University(BJTU), China, in 2020 and 2022. She is currently a Ph.D. candidate at the Institute of Information Science, Beijing Jiaotong University, Beijing, China. Her research interests include cross-modal retrieval and multi-modal learning.

Table 11

Explore similar work

Self-supervised Adversarial Purification for Graph Neural Networks
May 22, 2026Woohyun Lee, Hogun ParkGraph Neural Networks Adversarial Robustness
Department of Computer Science and Engineering, Sungkyunkwan University, Suwon, South Korea.
Adversarial Attacks on Locally Private Graph Neural Networks
Mar 21, 2026Matta Varun, Ajay Kumar Dhakar, Yuan Hong +1Adversarial Attacks Graph Neural Networks
Indian Institute of Technology Kharagpur, India · University of Connecticut, USA
GJDNet: Robust Graph Neural Networks via Joint Disentangled Learning Against Adversarial Attacks
Jun 1, 2026Canyixing Cui, Tao Wu, Xingping Xian +3Disentangled Representation Learning Graph Neural Networks
School of Computer Science and Technology, Chongqing University of Posts and Telecommunications, Chongqing, China · School of Cyber Security and Information Law, Chongqing University of Posts and Telecommunications, Chongqing, China · Computational Communication Research Center, Beijing Normal University, Zhuhai, China +2

May 22, 2026J/K move · Enter open · S save

Self-supervised Adversarial Purification for Graph Neural Networks

Woohyun Lee, Hogun Park

Department of Computer Science and Engineering, Sungkyunkwan University, Suwon, South Korea.

Graph Neural Networks Adversarial Robustness

Open paper AskPDF arXiv

Defending Graph Neural Networks (GNNs) against adversarial attacks requires balancing accuracy and robustness, a trade-off often mishandled by traditional methods like adversarial training that intertwine these conflicting objectives within a single classifier. To overcome this limitation, we propose a self-supervised adversarial purification framework. We separate robustness from the classifier by introducing a dedicated purifier, which cleanses the input data before classification. In contrast to prior adversarial purification methods, we propose GPR-GAE, a novel graph auto-encoder (GAE), as a specialized purifier trained with a self-supervised strategy, adapting to diverse graph structures in a data-driven manner. Utilizing multiple Generalized PageRank (GPR) filters, GPR-GAE captures diverse structural representations for robust and effective purification. Our multi-step purification process further facilitates GPR-GAE to achieve precise graph recovery and robust defense against structural perturbations. Experiments across diverse datasets and attack scenarios demonstrate the state-of-the-art robustness of GPR-GAE, showcasing it as an independent plug-and-play purifier for GNN classifiers.

Abstract

Explore similar work

Self-supervised Adversarial Purification for Graph Neural Networks

Adversarial Attacks on Locally Private Graph Neural Networks

GJDNet: Robust Graph Neural Networks via Joint Disentangled Learning Against Adversarial Attacks