Are LLM-Enhanced Graph Neural Networks Robust against Poisoning Attacks?

Yuhang Ma; Jie Wang; Zheng Yan

cs.LGMar 27, 2026

Are LLM-Enhanced Graph Neural Networks Robust against Poisoning Attacks?

Authors: Yuhang Ma, Jie Wang, Zheng Yan

Organizations: State Key Laboratory of Integrated Services Networks, School of Cyber Engineering, Xidian University, China · Hangzhou Institute of Technology, Xidian University, China

Abstract

Large Language Models (LLMs) have advanced Graph Neural Networks (GNNs) by enriching node representations with semantic features, giving rise to LLM-enhanced GNNs that achieve notable performance gains. However, the robustness of these models against poisoning attacks, which manipulate both graph structures and textual attributes during training, remains unexplored. To bridge this gap, we propose a robustness assessment framework that systematically evaluates LLM-enhanced GNNs under poisoning attacks. Our framework enables comprehensive evaluation across multiple dimensions. Specifically, we assess 24 victim models by combining eight LLM- or Language Model (LM)-based feature enhancers with three representative GNN backbones. To ensure diversity in attack coverage, we incorporate six structural poisoning attacks (both targeted and non-targeted) and three textual poisoning attacks operating at the character, word, and sentence levels. Furthermore, we employ four real-world datasets, including one released after the emergence of LLMs, to avoid potential ground truth leakage during LLM pretraining, thereby ensuring fair evaluation. Extensive experiments show that LLM-enhanced GNNs exhibit significantly higher accuracy and lower Relative Drop in Accuracy (RDA) than a shallow embedding-based baseline across various attack settings. Our in-depth analysis identifies key factors that contribute to this robustness, such as the effective encoding of structural and label information in node representations. Based on these insights, we outline future research directions from both offensive and defensive perspectives, and propose a new combined attack along with a graph purification defense. To support future research, we release the source code of our framework at~https://github.com/CyberAlSec/LLMEGNNRP.

Figures & tables

Fig. 1 : An overview of the proposed robustness assessment framework.

Dataset	#Nodes	#Edges	#Classes	#Features	Method	Domain
Cora	2,708	5,429	7	1,433	BoW	Citation
Pubmed	19,717	44,338	3	500	TF-IDF	Citation
Ogbn-products (subset)	12,011	21,987	47	100	BoW	E-commerce
Tape-arxiv23 (subset)	13,167	23,735	40	300	Word2Vec	Citation

TABLE I : Dataset descriptions.

Model Type	LLMs/LMs	#Parameters	Vendor
API-based	GPT-3.5-Turbo	-	OpenAI
API-based	Text-embedding-3-large	-	OpenAI
Open-source	DeBERTa-base	140M	Microsoft
	E5-Large	300M	Microsoft
	ModernBert-large	400M	Answer.AI
	LLaMA-2-7b-hf	7B	Meta

TABLE II : Number of parameters and vendors of the LLMs/LMs used in our experiments.

Model	Cora						Pubmed						Ogbn-products						Tape-arxiv23
	GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE
	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$
Shallow emb.	58.15	31.96	54.03	33.35	65.46	20.24	70.93	20.74	79.39	11.18	81.65	6.96	75.12	11.28	74.66	11.02	68.96	13.28	56.39	17.67	51.77	19.44	61.26	12.11
TAPE	65.41	21.30	73.51	10.43	73.00	11.61	84.76	6.18	88.52	3.28	90.02	0.95	85.51	3.42	86.64	1.72	87.07	1.29	67.30	12.50	64.31	15.68	77.39	4.07
KEA	67.56	20.61	69.58	18.46	74.50	13.50	80.16	11.27	79.28	11.30	88.09	2.95	83.36	5.50	83.91	4.25	86.84	2.61	62.95	14.53	53.26	25.55	71.84	6.62
LLaMA	60.55	30.22	65.74	23.09	67.29	17.01	79.61	12.09	80.15	8.90	88.20	1.67	80.10	9.19	80.91	4.55	84.14	5.12	62.18	18.26	58.33	21.10	70.95	9.49

TABLE III : Robustness comparison against the Nettack attack at a high perturbation level. The highest results are highlighted with bold , while the second-best results are marked with underline (applied similarly in the following tables).

Panel of Figure 5 — Fig. 2 : ACC and RDA under the targeted structural attacks with different perturbation levels. In each box plot, the color denotes the average score and the central line indicates the median.

Model	Cora						Pubmed						Ogbn-products						Tape-arxiv23
	GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE
	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$
Shallow emb.	74.60	7.92	73.57	8.03	75.77	5.32	74.12	14.02	72.25	15.49	80.13	6.14	63.78	3.29	66.39	4.32	59.47	4.53	51.03	11.59	50.43	9.09	51.60	8.38
TAPE	78.02	4.55	76.16	5.37	78.17	4.46	84.91	8.82	83.63	6.84	94.13	0.43	84.26	1.84	84.20	1.36	85.85	0.23	71.33	4.22	69.29	6.92	73.69	0.87
KEA	77.02	8.53	76.13	9.87	82.24	3.08	77.72	12.64	75.33	12.96	84.97	4.86	81.98	2.28	80.98	2.62	83.82	0.53	62.08	9.83	60.82	12.95	64.41	7.03
LLaMA	77.36	5.24	76.64	6.08	77.65	4.41	73.05	16.87	73.94	12.98	82.84	5.84	81.80	2.27	74.81	6.98	82.85	0.70	64.79	9.40	59.03	16.20	65.33	8.12

TABLE IV : Robustness comparison against the Mettack attack at a high perturbation level.

Panel of Figure 7 — Fig. 3 : ACC and RDA under the non-targeted structural attacks with different perturbation levels. In each box plot, the color denotes the average score and the central line indicates the median.

Panel of Figure 8 — Fig. 4 : ACC and RDA under the structural attacks with different GNN models.

Fig. 5 : RDA ranking of the shallow embedding-based baseline. A lower ranking indicates that the baseline outperforms some LLM-enhanced models. The black dashed line represents the average ranking.

Fig. 6 : Impact of training-testing data overlap on model robustness.

Panel of Figure 11 — Fig. 7 : t-SNE visualizations of node embeddings on two datasets. Different colors refer to different node categories.

Model	DBI $\downarrow$	Sil $\uparrow$	Hom $\uparrow$	ELMI $\uparrow$	ESMI $\uparrow$		NCon $\uparrow$
Model	DBI $\downarrow$	Sil $\uparrow$	Hom $\uparrow$	ELMI $\uparrow$	cle	poi	cle	poi
Shallow emb.	8.29	1.37	75.73	1.14	0.28	0.25	39.87	36.02
TAPE	0.57	64.29	91.82	57.06	1.55	1.57	95.14	91.81
KEA	6.19	2.12	83.12	2.33	0.33	0.2	88.47	87.65
LLaMA	5.43	1.18	76.15	3.65	0.63	0.58	78.96	77.03
TE3L	5.52	2.55	82.29	2.80	0.47	0.45	67.51	62.74

TABLE V : Embedding quality and robustness analysis under structural attacks on the Pubmed dataset.

Model	Cora						Pubmed						Ogbn-products						Tape-arxiv23
	GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE
	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$
Shallow emb.	80.54	0.59	78.11	2.35	79.75	0.35	85.54	0.78	85.26	0.27	83.81	1.83	65.03	1.39	67.96	2.06	60.82	2.36	53.14	7.93	51.56	7.05	52.74	6.36
TAPE	82.55	-0.99	80.33	0.19	80.20	1.98	91.75	1.47	88.96	0.90	92.30	2.37	85.48	0.42	85.23	0.15	85.44	0.71	71.33	4.22	71.50	3.95	70.18	5.60
KEA	84.13	0.08	84.30	0.20	83.97	1.04	87.83	1.28	86.33	0.25	86.83	2.78	83.73	0.19	82.69	0.57	83.72	0.65	65.77	4.47	66.26	5.17	65.76	5.08
LLaMA	81.66	-0.02	80.56	1.27	79.73	1.85	87.05	0.93	84.42	0.65	86.30	1.91	82.75	1.14	80.55	-0.16	82.30	1.35	68.72	3.90	68.44	2.84	67.79	4.66

TABLE VI : Robustness comparison against the MAYA attack.

Fig. 8 : t-SNE visualizations of node embeddings on the Pubmed dataset under textual attacks.

Fig. 9 : Robustness analysis under textual attacks on the Pubmed dataset.

Structural

Textual

Cora

Pubmed

Ogbn-products

Tape-arxiv23

Shallow emb.

TAPE

E5-Large

Shallow emb.

TAPE

E5-Large

Shallow emb.

TAPE

E5-Large

Shallow emb.

TAPE

E5-Large

Mettack

Non-textual

74.60

78.02

80.60

74.12

84.91

84.71

63.78

84.26

83.23

51.03

71.33

70.04

DWord

74.90_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 0.30\%}}

77.90_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.12\%}}

80.63_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 0.03\%}}

73.94_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.18\%}}

84.57_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.34\%}}

84.59_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.12\%}}

64.10_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 0.32\%}}

84.32_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 0.06\%}}

82.97_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.26\%}}

51.07_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 0.04\%}}

71.42_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 0.09\%}}

69.71_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.33\%}}

BertAtk

72.63_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 1.97\%}}

77.39_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.63\%}}

78.16_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 2.44\%}}

73.00_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 1.12\%}}

82.52_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 2.39\%}}

81.65_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 3.06\%}}

61.76_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 2.02\%}}

83.98_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.28\%}}

82.50_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.73\%}}

49.83_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 1.20\%}}

69.68_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 1.65\%}}

68.96_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 1.08\%}}

MAYA

74.35_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.25\%}}

78.40_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 0.38\%}}

80.32_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.28\%}}

73.39_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.73\%}}

81.24_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 3.67\%}}

77.08_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 7.63\%}}

62.24_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 1.54\%}}

84.01_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.25\%}}

82.52_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.71\%}}

49.11_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 1.92\%}}

68.71_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 2.62\%}}

65.47_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 4.57\%}}

DICE

Non-textual

68.63

70.82

76.31

74.36

85.73

85.48

55.41

81.03

79.83

50.10

67.13

65.39

TABLE VII : Accuracy (%) under a combined structural and textual attack.

Structural	Textual	Cora				Pubmed				Ogbn-products				Tape-arxiv23
Structural	Textual	RGCN	SimpGCN	TAPE	E5-Large	RGCN	SimpGCN	TAPE	E5-Large	RGCN	SimpGCN	TAPE	E5-Large	RGCN	SimpGCN	TAPE	E5-Large
	clean	81.02	81.02	81.74	84.41	86.21	86.21	93.12	87.15	65.95	65.95	85.85	84.96	57.72	57.72	74.47	73.08
Mettack	attack	74.60	74.60	78.02	80.60	74.12	74.12	84.91	84.71	63.78	63.78	84.26	83.23	51.03	51.03	71.33	70.04
Mettack	defense	$77.40_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 2.80\%}}$	$42.91_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 31.69\%}}$	$77.89_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.13\%}}$	$81.65_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 1.05\%}}$	$71.51_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 2.61\%}}$	$84.28_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 10.16\%}}$	$94.23_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 9.32\%}}$	$94.03_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 9.32\%}}$	$45.39_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 18.39\%}}$	$58.45_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 5.33\%}}$	$86.26_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 2.00\%}}$	$84.30_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 1.07\%}}$	$42.89_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 8.14\%}}$	$47.37_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 3.66\%}}$	$74.90_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 3.57\%}}$	$73.09_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 3.05\%}}$
DICE	attack	68.63	68.63	70.82	76.31	74.36	74.36	85.73	85.48	55.41	55.41	81.03	79.83	50.10	50.10	67.13	65.39
DICE	defense	$71.33_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 2.70\%}}$	$40.36_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 28.27\%}}$	$71.68_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 0.86\%}}$	$77.26_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 0.95\%}}$	$75.72_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 1.36\%}}$	$85.74_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 11.38\%}}$	$94.21_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 8.48\%}}$	$93.85_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 8.37\%}}$	$40.15_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 15.26\%}}$	$51.68_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 3.73\%}}$	$84.87_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 3.84\%}}$	$83.65_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 3.82\%}}$	$43.19_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 6.91\%}}$	$49.22_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.88\%}}$	$74.73_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 7.60\%}}$	$72.06_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 6.67\%}}$

TABLE VIII : Accuracy (%) after purifying perturbed graph structures.

Classification	Model	Cora			Pubmed			Ogbn-products			Tape-arxiv23
Classification	Model	GCN	GAT	SAGE	GCN	GAT	SAGE	GCN	GAT	SAGE	GCN	GAT	SAGE
	Shallow emb.	85.46	81.06	82.07	89.49	89.38	87.76	84.67	83.91	79.52	68.49	64.26	69.70
LLM-Explanation	TAPE	83.11	82.07	82.59	90.34	91.52	90.88	88.06	88.07	88.12	76.91	76.27	80.67
LLM-Explanation	KEA	85.10	85.33	86.13	90.34	89.38	90.77	88.21	87.63	89.17	73.65	71.54	76.93
LLM-Embedding	LLaMA	86.77	85.48	81.08	90.56	87.98	89.70	88.21	84.77	88.68	76.07	73.93	78.39
	TE3L	89.64	82.66	86.78	90.02	90.13	91.20	88.72	88.45	90.06	74.42	76.62	75.85

TABLE IX : Accuracy (%) on clean graphs for targeted nodes.

Classification	Model	Cora			Pubmed			Ogbn-products			Tape-arxiv23
Classification	Model	GCN	GAT	SAGE	GCN	GAT	SAGE	GCN	GAT	SAGE	GCN	GAT	SAGE
	Shallow emb.	81.02	79.99	80.03	86.21	85.49	85.37	65.95	69.39	62.29	57.72	55.47	56.32
LLM-Explanation	TAPE	81.74	80.48	81.82	93.12	89.77	94.54	85.85	85.36	86.05	74.47	74.44	74.34
LLM-Explanation	KEA	84.20	84.47	84.85	88.97	86.55	89.31	83.89	83.16	84.27	68.85	69.87	69.28
LLM-Embedding	LLaMA	81.64	81.60	81.23	87.87	84.97	87.98	83.70	80.42	83.43	71.51	70.44	71.10
	TE3L	83.64	83.00	83.89	88.76	87.09	89.04	84.08	82.83	84.55	70.17	68.80	69.86

TABLE X : Accuracy (%) on clean graphs for non-targeted nodes.

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Model	Cora						Pubmed						Ogbn-products						Tape-arxiv23
	GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE
	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$
Shallow emb.	60.81	28.84	54.42	32.86	65.97	19.62	74.78	16.44	83.37	6.72	83.26	5.13	75.93	10.32	75.21	10.37	72.20	9.21	24.75	63.86	50.26	21.79	60.99	12.50
TAPE	66.79	19.64	72.70	11.42	73.54	10.96	83.04	8.08	90.45	1.17	90.77	0.12	81.77	7.65	82.89	5.98	86.03	2.47	37.40	51.37	60.93	20.11	73.64	8.71
KEA	67.28	20.94	71.95	15.68	77.33	10.22	81.22	10.10	83.91	6.12	89.48	1.42	77.94	11.64	79.44	9.35	85.96	3.60	25.26	65.70	49.51	30.79	67.97	11.65
LLaMA	64.71	25.42	68.85	19.45	69.64	14.11	79.82	11.86	81.21	7.69	88.84	0.96	76.52	13.25	75.96	10.39	83.00	6.41	24.46	67.85	50.81	31.27	70.38	10.22

Appendix

TABLE XI : Robustness comparison against the SGA attack at a high perturbation level.

Model	Cora						Pubmed						Ogbn-products						Tape-arxiv23
	GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE
	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$
Shallow emb.	70.93	17.00	60.78	25.02	73.22	10.78	83.58	6.60	87.23	2.41	85.41	2.68	77.67	8.27	76.96	8.28	70.90	10.84	48.76	28.81	58.15	9.51	68.56	1.64
TAPE	75.36	9.32	74.77	8.89	78.13	5.40	91.52	-1.31	91.31	0.23	91.09	-0.23	86.83	1.40	87.45	0.70	87.39	0.83	67.36	12.42	69.05	9.47	73.06	9.43
KEA	74.55	12.40	74.05	13.22	79.48	7.72	88.31	2.25	87.98	1.57	90.02	0.83	86.02	2.48	85.42	2.52	88.41	0.85	55.22	25.02	61.69	13.77	69.41	9.78
LLaMA	73.56	15.22	71.89	15.90	76.92	5.13	87.55	3.32	85.19	3.17	90.23	-0.59	84.63	4.06	82.95	2.15	87.07	1.82	54.61	28.21	63.27	14.42	73.21	6.61

Appendix

TABLE XII : Robustness comparison against the NAG-R attack at a high perturbation level.

Model	Cora						Pubmed						Ogbn-products						Tape-arxiv23
	GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE
	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$
Shallow emb.	68.63	15.29	65.17	18.53	67.93	15.12	74.36	13.75	74.17	13.24	82.82	2.99	55.41	15.98	55.40	20.16	50.90	18.29	50.10	13.20	49.71	10.38	53.97	4.17
TAPE	70.82	13.36	69.28	13.92	71.78	12.27	85.73	7.94	80.84	9.95	94.30	0.25	81.03	5.60	81.07	5.03	85.10	1.10	67.13	9.86	64.85	12.88	73.17	1.57
KEA	75.78	10.00	75.07	11.13	78.73	7.21	78.33	11.96	77.09	10.93	89.14	0.19	77.80	7.26	76.49	8.02	80.72	4.21	59.75	13.22	54.59	21.87	67.16	3.06
LLaMA	72.93	10.67	69.83	14.42	73.19	9.90	77.11	12.25	72.96	14.13	88.27	-0.33	77.03	7.97	71.99	10.48	80.28	3.78	63.04	11.84	56.43	19.89	69.46	2.31

Appendix

TABLE XIII : Robustness comparison against the DICE attack at a high perturbation level.

Model	Cora						Pubmed						Ogbn-products						Tape-arxiv23
	GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE
	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$
Shallow emb.	71.89	11.27	68.91	13.85	73.30	8.41	86.22	-0.01	86.10	-0.71	85.70	-0.39	65.27	1.03	67.63	2.54	59.33	4.75	56.39	2.30	52.18	5.93	56.11	0.37
TAPE	75.71	7.38	74.37	7.59	77.32	5.50	92.82	0.32	88.34	1.59	94.49	0.05	84.57	1.48	84.54	0.96	85.46	0.69	72.89	2.12	72.20	3.01	73.12	1.64
KEA	77.14	8.38	76.64	9.27	80.40	5.24	88.61	0.40	87.28	-0.84	89.32	-0.01	82.55	1.60	81.95	1.46	83.32	1.13	66.92	2.80	67.40	3.54	68.36	1.33
LLaMA	75.46	7.57	70.74	13.31	76.12	6.29	87.84	0.03	85.54	-0.67	88.45	-0.53	82.15	1.85	78.71	2.13	82.43	1.20	69.62	2.64	68.98	2.07	68.52	3.63

Appendix

TABLE XIV : Robustness comparison against the PGA attack at a high perturbation level.

Model	Cora						Pubmed						Ogbn-products						Tape-arxiv23
	GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE
	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$
Shallow emb.	80.83	0.23	79.63	0.45	79.97	0.07	86.35	-0.16	85.64	-0.18	85.25	0.14	66.10	-0.23	68.70	0.99	62.05	0.39	57.68	0.07	55.65	-0.32	56.80	-0.85
TAPE	81.21	0.65	80.90	-0.52	81.62	0.24	93.03	0.10	89.82	-0.06	94.46	0.08	85.86	-0.02	85.70	-0.40	86.30	-0.29	74.41	0.08	74.30	0.19	74.36	-0.03
KEA	84.14	0.07	84.02	0.53	84.43	0.49	88.80	0.19	86.80	-0.29	89.16	0.17	83.69	0.24	83.49	-0.40	84.14	0.15	68.60	0.36	69.47	0.57	69.02	0.38
LLaMA	81.62	0.02	81.24	0.44	81.47	-0.30	87.85	0.02	84.66	0.36	87.94	0.05	83.53	0.20	79.90	0.65	83.41	0.02	71.36	0.21	70.83	-0.55	71.09	0.01

Appendix

TABLE XV : Robustness comparison against the DWord attack.

Model	Cora						Pubmed						Ogbn-products						Tape-arxiv23
	GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE
	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$
Shallow emb.	78.46	3.16	78.74	1.56	78.19	2.30	86.01	0.23	85.50	-0.01	84.78	0.69	64.37	2.40	67.75	2.36	59.83	3.95	55.97	3.03	53.78	3.05	53.58	4.87
TAPE	81.81	-0.09	80.29	0.24	80.21	1.97	92.33	0.85	89.18	0.66	93.26	1.35	85.63	0.24	85.36	0.00	85.43	0.72	73.05	1.91	73.29	1.54	73.13	1.63
KEA	84.35	-0.18	83.99	0.57	83.86	1.17	88.46	0.57	86.53	0.02	87.65	1.86	83.73	0.19	83.11	0.06	83.78	0.58	68.03	1.19	66.16	5.31	68.29	1.43
LLaMA	80.62	1.25	81.16	0.54	79.67	1.92	87.04	0.94	84.33	0.75	86.36	1.84	83.11	0.70	81.06	-0.80	82.57	1.03	69.33	3.05	69.30	1.62	69.06	2.87

Appendix

TABLE XVI : Robustness comparison against the BertAtk attack.

Panel of Figure 26 — Fig. 10 : ACC and RDA under the textual attacks.

Model	Cora		Pubmed		Ogbn-products		Tape-arxiv23
Model	CA $\uparrow$	MCR $\uparrow$	CA $\uparrow$	MCR $\uparrow$	CA $\uparrow$	MCR $\uparrow$	CA $\uparrow$	MCR $\uparrow$
Shallow emb.	51.36	1.74	34.23	0.97	34.23	0.86	28.23	0.93
TAPE	64.47	2.33	68.87	1.90	73.44	2.01	54.24	1.08
TE3L	60.08	2.05	41.74	1.07	65.39	1.97	34.36	1.01
E5-Large	63.54	2.36	68.16	2.17	70.31	2.09	46.47	1.22

Appendix

TABLE XVII : Results of certified robustness.

Explore similar work

Aug 26, 2026

Auditing Privacy Risks in LLM-Enhanced Graph Neural Networks

Large language models (LLMs) have recently advanced graph neural networks (GNNs) by enriching node representations with semantic information, giving rise to LLM-enhanced GNNs that achieve substantial performance gains. However, how such semantic enhancement affects privacy risks remains largely underexplored. To bridge this gap, we systematically audit the privacy risks of LLM-enhanced GNNs through a unified framework consisting of five stages: (1) dataset preparation, (2) victim model training, (3) privacy attack, (4) risk assessment, and (5) defense analysis. Specifically, our evaluation spans ten text-attributed graph datasets across diverse domains, six privacy attacks, 42 LLM-enhanced GNN configurations, and three more recent language-model backbones. Extensive experiments show that, despite their utility improvements, LLM-enhanced GNNs consistently exhibit greater empirical privacy vulnerability than shallow text representation baselines under the evaluated attacks across diverse models and datasets. Further analysis shows that LLM-enhanced representations exhibit more distinguishable link-, label-, and membership-related signals in the embedding space, making them more exploitable by inference attacks. Finally, we evaluate representative defenses and examine their effectiveness in mitigating these privacy risks. Overall, this work provides a systematic audit of privacy risks in LLM-enhanced GNNs and offers insights for developing more secure and trustworthy graph learning systems.

Longzhu He, Zelang Wen, Chaozhuo Li +1

Beijing University of Posts and Telecommunications

Privacy-Preserving ML LLMs for Graph Learning Text-Attributed Graph Learning

Ask PDF

Mar 12, 2026

KEPo: Knowledge Evolution Poison on Graph-based Retrieval-Augmented Generation

Graph-based Retrieval-Augmented Generation (GraphRAG) constructs the Knowledge Graph (KG) from external databases to enhance the timeliness and accuracy of Large Language Model (LLM) generations. However, this reliance on external data introduces new attack surfaces. Attackers can inject poisoned texts into databases to manipulate LLMs into producing harmful target responses for attacker-chosen queries. Existing research primarily focuses on attacking conventional RAG systems. However, such methods are ineffective against GraphRAG. This robustness derives from the KG abstraction of GraphRAG, which reorganizes injected text into a graph before retrieval, thereby enabling the LLM to reason based on the restructured context instead of raw poisoned passages. To expose latent security vulnerabilities in GraphRAG, we propose Knowledge Evolution Poison (KEPo), a novel poisoning attack method specifically designed for GraphRAG. For each target query, KEPo first generates a toxic event containing poisoned knowledge based on the target answer. By fabricating event backgrounds and forging knowledge evolution paths from original facts to the toxic event, it then poisons the KG and misleads the LLM into treating the poisoned knowledge as the final result. In multi-target attack scenarios, KEPo further connects multiple attack corpora, enabling their poisoned knowledge to mutually reinforce while expanding the scale of poisoned communities, thereby amplifying attack effectiveness. Experimental results across multiple datasets demonstrate that KEPo achieves state-of-the-art attack success rates for both single-target and multi-target attacks, significantly outperforming previous methods.

Qizhi Chen, Chao Qi, Yihong Huang +5

School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China · Institute of Intelligent Computing, University of Electronic Science and Technology of China, Chengdu, China · School of Information and Software Engineering, University of Electronic Science and Technology of China, Chengdu, China +1

RAG Poisoning Attacks Data Poisoning Attacks Graph Retrieval-Augmented Generation

Ask PDF

Apr 3, 2026

LogicPoison: Logical Attacks on Graph Retrieval-Augmented Generation

Graph-based Retrieval-Augmented Generation (GraphRAG) enhances the reasoning capabilities of Large Language Models (LLMs) by grounding their responses in structured knowledge graphs. Leveraging community detection and relation filtering techniques, GraphRAG systems demonstrate inherent resistance to traditional RAG attacks, such as text poisoning and prompt injection. However, in this paper, we find that the security of GraphRAG systems fundamentally relies on the topological integrity of the underlying graph, which can be undermined by implicitly corrupting the logical connections, without altering surface-level text semantics. To exploit this vulnerability, we propose LogicPoison, a novel attack framework that targets logical reasoning rather than injecting false contents. Specifically, LogicPoison employs a type-preserving entity swapping mechanism to perturb both global logic hubs for disrupting overall graph connectivity and query-specific reasoning bridges for severing essential multi-hop inference paths. This approach effectively reroutes valid reasoning into dead ends while maintaining surface-level textual plausibility. Comprehensive experiments across multiple benchmarks demonstrate that LogicPoison successfully bypasses GraphRAG's defenses, significantly degrading performance and outperforming state-of-the-art baselines in both effectiveness and stealth. Our code is available at \textcolor{blue}https://github.com/Jord8061/logicPoison.

Yilin Xiao, Jin Chen, Qinggang Zhang +6

The Hong Kong Polytechnic University · Southwestern University of Finance and Economics

RAG Poisoning Attacks RAG Security Graph Retrieval-Augmented Generation

Ask PDF