Are LLM-Enhanced Graph Neural Networks Robust against Poisoning Attacks?

Yuhang Ma; Jie Wang; Zheng Yan

cs.LGMar 27, 2026

Are LLM-Enhanced Graph Neural Networks Robust against Poisoning Attacks?

Authors: Yuhang Ma, Jie Wang, Zheng Yan

Organizations: State Key Laboratory of Integrated Services Networks, School of Cyber Engineering, Xidian University, China · Hangzhou Institute of Technology, Xidian University, China

Abstract

Large Language Models (LLMs) have advanced Graph Neural Networks (GNNs) by enriching node representations with semantic features, giving rise to LLM-enhanced GNNs that achieve notable performance gains. However, the robustness of these models against poisoning attacks, which manipulate both graph structures and textual attributes during training, remains unexplored. To bridge this gap, we propose a robustness assessment framework that systematically evaluates LLM-enhanced GNNs under poisoning attacks. Our framework enables comprehensive evaluation across multiple dimensions. Specifically, we assess 24 victim models by combining eight LLM- or Language Model (LM)-based feature enhancers with three representative GNN backbones. To ensure diversity in attack coverage, we incorporate six structural poisoning attacks (both targeted and non-targeted) and three textual poisoning attacks operating at the character, word, and sentence levels. Furthermore, we employ four real-world datasets, including one released after the emergence of LLMs, to avoid potential ground truth leakage during LLM pretraining, thereby ensuring fair evaluation. Extensive experiments show that LLM-enhanced GNNs exhibit significantly higher accuracy and lower Relative Drop in Accuracy (RDA) than a shallow embedding-based baseline across various attack settings. Our in-depth analysis identifies key factors that contribute to this robustness, such as the effective encoding of structural and label information in node representations. Based on these insights, we outline future research directions from both offensive and defensive perspectives, and propose a new combined attack along with a graph purification defense. To support future research, we release the source code of our framework at~https://github.com/CyberAlSec/LLMEGNNRP.

Figures & tables

Fig. 1 : An overview of the proposed robustness assessment framework.

Dataset	#Nodes	#Edges	#Classes	#Features	Method	Domain
Cora	2,708	5,429	7	1,433	BoW	Citation
Pubmed	19,717	44,338	3	500	TF-IDF	Citation
Ogbn-products (subset)	12,011	21,987	47	100	BoW	E-commerce
Tape-arxiv23 (subset)	13,167	23,735	40	300	Word2Vec	Citation

TABLE I : Dataset descriptions.

Model Type	LLMs/LMs	#Parameters	Vendor
API-based	GPT-3.5-Turbo	-	OpenAI
API-based	Text-embedding-3-large	-	OpenAI
Open-source	DeBERTa-base	140M	Microsoft
	E5-Large	300M	Microsoft
	ModernBert-large	400M	Answer.AI
	LLaMA-2-7b-hf	7B	Meta

TABLE II : Number of parameters and vendors of the LLMs/LMs used in our experiments.

Model	Cora						Pubmed						Ogbn-products						Tape-arxiv23
	GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE
	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$
Shallow emb.	58.15	31.96	54.03	33.35	65.46	20.24	70.93	20.74	79.39	11.18	81.65	6.96	75.12	11.28	74.66	11.02	68.96	13.28	56.39	17.67	51.77	19.44	61.26	12.11
TAPE	65.41	21.30	73.51	10.43	73.00	11.61	84.76	6.18	88.52	3.28	90.02	0.95	85.51	3.42	86.64	1.72	87.07	1.29	67.30	12.50	64.31	15.68	77.39	4.07
KEA	67.56	20.61	69.58	18.46	74.50	13.50	80.16	11.27	79.28	11.30	88.09	2.95	83.36	5.50	83.91	4.25	86.84	2.61	62.95	14.53	53.26	25.55	71.84	6.62
LLaMA	60.55	30.22	65.74	23.09	67.29	17.01	79.61	12.09	80.15	8.90	88.20	1.67	80.10	9.19	80.91	4.55	84.14	5.12	62.18	18.26	58.33	21.10	70.95	9.49

TABLE III : Robustness comparison against the Nettack attack at a high perturbation level. The highest results are highlighted with bold , while the second-best results are marked with underline (applied similarly in the following tables).

Panel of Figure 5 — Fig. 2 : ACC and RDA under the targeted structural attacks with different perturbation levels. In each box plot, the color denotes the average score and the central line indicates the median.

Model	Cora						Pubmed						Ogbn-products						Tape-arxiv23
	GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE
	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$
Shallow emb.	74.60	7.92	73.57	8.03	75.77	5.32	74.12	14.02	72.25	15.49	80.13	6.14	63.78	3.29	66.39	4.32	59.47	4.53	51.03	11.59	50.43	9.09	51.60	8.38
TAPE	78.02	4.55	76.16	5.37	78.17	4.46	84.91	8.82	83.63	6.84	94.13	0.43	84.26	1.84	84.20	1.36	85.85	0.23	71.33	4.22	69.29	6.92	73.69	0.87
KEA	77.02	8.53	76.13	9.87	82.24	3.08	77.72	12.64	75.33	12.96	84.97	4.86	81.98	2.28	80.98	2.62	83.82	0.53	62.08	9.83	60.82	12.95	64.41	7.03
LLaMA	77.36	5.24	76.64	6.08	77.65	4.41	73.05	16.87	73.94	12.98	82.84	5.84	81.80	2.27	74.81	6.98	82.85	0.70	64.79	9.40	59.03	16.20	65.33	8.12

TABLE IV : Robustness comparison against the Mettack attack at a high perturbation level.

Panel of Figure 7 — Fig. 3 : ACC and RDA under the non-targeted structural attacks with different perturbation levels. In each box plot, the color denotes the average score and the central line indicates the median.

Panel of Figure 8 — Fig. 4 : ACC and RDA under the structural attacks with different GNN models.

Fig. 5 : RDA ranking of the shallow embedding-based baseline. A lower ranking indicates that the baseline outperforms some LLM-enhanced models. The black dashed line represents the average ranking.

Fig. 6 : Impact of training-testing data overlap on model robustness.

Panel of Figure 11 — Fig. 7 : t-SNE visualizations of node embeddings on two datasets. Different colors refer to different node categories.

Model	DBI $\downarrow$	Sil $\uparrow$	Hom $\uparrow$	ELMI $\uparrow$	ESMI $\uparrow$		NCon $\uparrow$
Model	DBI $\downarrow$	Sil $\uparrow$	Hom $\uparrow$	ELMI $\uparrow$	cle	poi	cle	poi
Shallow emb.	8.29	1.37	75.73	1.14	0.28	0.25	39.87	36.02
TAPE	0.57	64.29	91.82	57.06	1.55	1.57	95.14	91.81
KEA	6.19	2.12	83.12	2.33	0.33	0.2	88.47	87.65
LLaMA	5.43	1.18	76.15	3.65	0.63	0.58	78.96	77.03
TE3L	5.52	2.55	82.29	2.80	0.47	0.45	67.51	62.74

TABLE V : Embedding quality and robustness analysis under structural attacks on the Pubmed dataset.

Model	Cora						Pubmed						Ogbn-products						Tape-arxiv23
	GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE
	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$
Shallow emb.	80.54	0.59	78.11	2.35	79.75	0.35	85.54	0.78	85.26	0.27	83.81	1.83	65.03	1.39	67.96	2.06	60.82	2.36	53.14	7.93	51.56	7.05	52.74	6.36
TAPE	82.55	-0.99	80.33	0.19	80.20	1.98	91.75	1.47	88.96	0.90	92.30	2.37	85.48	0.42	85.23	0.15	85.44	0.71	71.33	4.22	71.50	3.95	70.18	5.60
KEA	84.13	0.08	84.30	0.20	83.97	1.04	87.83	1.28	86.33	0.25	86.83	2.78	83.73	0.19	82.69	0.57	83.72	0.65	65.77	4.47	66.26	5.17	65.76	5.08
LLaMA	81.66	-0.02	80.56	1.27	79.73	1.85	87.05	0.93	84.42	0.65	86.30	1.91	82.75	1.14	80.55	-0.16	82.30	1.35	68.72	3.90	68.44	2.84	67.79	4.66

TABLE VI : Robustness comparison against the MAYA attack.

Fig. 8 : t-SNE visualizations of node embeddings on the Pubmed dataset under textual attacks.

Fig. 9 : Robustness analysis under textual attacks on the Pubmed dataset.

Structural

Textual

Cora

Pubmed

Ogbn-products

Tape-arxiv23

Shallow emb.

TAPE

E5-Large

Shallow emb.

TAPE

E5-Large

Shallow emb.

TAPE

E5-Large

Shallow emb.

TAPE

E5-Large

Mettack

Non-textual

74.60

78.02

80.60

74.12

84.91

84.71

63.78

84.26

83.23

51.03

71.33

70.04

DWord

74.90_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 0.30\%}}

77.90_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.12\%}}

80.63_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 0.03\%}}

73.94_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.18\%}}

84.57_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.34\%}}

84.59_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.12\%}}

64.10_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 0.32\%}}

84.32_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 0.06\%}}

82.97_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.26\%}}

51.07_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 0.04\%}}

71.42_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 0.09\%}}

69.71_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.33\%}}

BertAtk

72.63_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 1.97\%}}

77.39_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.63\%}}

78.16_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 2.44\%}}

73.00_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 1.12\%}}

82.52_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 2.39\%}}

81.65_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 3.06\%}}

61.76_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 2.02\%}}

83.98_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.28\%}}

82.50_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.73\%}}

49.83_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 1.20\%}}

69.68_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 1.65\%}}

68.96_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 1.08\%}}

MAYA

74.35_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.25\%}}

78.40_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 0.38\%}}

80.32_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.28\%}}

73.39_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.73\%}}

81.24_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 3.67\%}}

77.08_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 7.63\%}}

62.24_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 1.54\%}}

84.01_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.25\%}}

82.52_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.71\%}}

49.11_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 1.92\%}}

68.71_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 2.62\%}}

65.47_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 4.57\%}}

DICE

Non-textual

68.63

70.82

76.31

74.36

85.73

85.48

55.41

81.03

79.83

50.10

67.13

65.39

TABLE VII : Accuracy (%) under a combined structural and textual attack.

Structural	Textual	Cora				Pubmed				Ogbn-products				Tape-arxiv23
Structural	Textual	RGCN	SimpGCN	TAPE	E5-Large	RGCN	SimpGCN	TAPE	E5-Large	RGCN	SimpGCN	TAPE	E5-Large	RGCN	SimpGCN	TAPE	E5-Large
	clean	81.02	81.02	81.74	84.41	86.21	86.21	93.12	87.15	65.95	65.95	85.85	84.96	57.72	57.72	74.47	73.08
Mettack	attack	74.60	74.60	78.02	80.60	74.12	74.12	84.91	84.71	63.78	63.78	84.26	83.23	51.03	51.03	71.33	70.04
Mettack	defense	$77.40_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 2.80\%}}$	$42.91_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 31.69\%}}$	$77.89_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.13\%}}$	$81.65_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 1.05\%}}$	$71.51_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 2.61\%}}$	$84.28_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 10.16\%}}$	$94.23_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 9.32\%}}$	$94.03_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 9.32\%}}$	$45.39_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 18.39\%}}$	$58.45_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 5.33\%}}$	$86.26_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 2.00\%}}$	$84.30_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 1.07\%}}$	$42.89_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 8.14\%}}$	$47.37_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 3.66\%}}$	$74.90_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 3.57\%}}$	$73.09_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 3.05\%}}$
DICE	attack	68.63	68.63	70.82	76.31	74.36	74.36	85.73	85.48	55.41	55.41	81.03	79.83	50.10	50.10	67.13	65.39
DICE	defense	$71.33_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 2.70\%}}$	$40.36_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 28.27\%}}$	$71.68_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 0.86\%}}$	$77.26_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 0.95\%}}$	$75.72_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 1.36\%}}$	$85.74_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 11.38\%}}$	$94.21_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 8.48\%}}$	$93.85_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 8.37\%}}$	$40.15_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 15.26\%}}$	$51.68_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 3.73\%}}$	$84.87_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 3.84\%}}$	$83.65_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 3.82\%}}$	$43.19_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 6.91\%}}$	$49.22_{\color[rgb]{0.753,0,0}\mathbf{\blacktriangledown 0.88\%}}$	$74.73_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 7.60\%}}$	$72.06_{\color[rgb]{0.117,0.447,0.999}\mathbf{\blacktriangle 6.67\%}}$

TABLE VIII : Accuracy (%) after purifying perturbed graph structures.

Classification	Model	Cora			Pubmed			Ogbn-products			Tape-arxiv23
Classification	Model	GCN	GAT	SAGE	GCN	GAT	SAGE	GCN	GAT	SAGE	GCN	GAT	SAGE
	Shallow emb.	85.46	81.06	82.07	89.49	89.38	87.76	84.67	83.91	79.52	68.49	64.26	69.70
LLM-Explanation	TAPE	83.11	82.07	82.59	90.34	91.52	90.88	88.06	88.07	88.12	76.91	76.27	80.67
LLM-Explanation	KEA	85.10	85.33	86.13	90.34	89.38	90.77	88.21	87.63	89.17	73.65	71.54	76.93
LLM-Embedding	LLaMA	86.77	85.48	81.08	90.56	87.98	89.70	88.21	84.77	88.68	76.07	73.93	78.39
	TE3L	89.64	82.66	86.78	90.02	90.13	91.20	88.72	88.45	90.06	74.42	76.62	75.85

TABLE IX : Accuracy (%) on clean graphs for targeted nodes.

Classification	Model	Cora			Pubmed			Ogbn-products			Tape-arxiv23
Classification	Model	GCN	GAT	SAGE	GCN	GAT	SAGE	GCN	GAT	SAGE	GCN	GAT	SAGE
	Shallow emb.	81.02	79.99	80.03	86.21	85.49	85.37	65.95	69.39	62.29	57.72	55.47	56.32
LLM-Explanation	TAPE	81.74	80.48	81.82	93.12	89.77	94.54	85.85	85.36	86.05	74.47	74.44	74.34
LLM-Explanation	KEA	84.20	84.47	84.85	88.97	86.55	89.31	83.89	83.16	84.27	68.85	69.87	69.28
LLM-Embedding	LLaMA	81.64	81.60	81.23	87.87	84.97	87.98	83.70	80.42	83.43	71.51	70.44	71.10
	TE3L	83.64	83.00	83.89	88.76	87.09	89.04	84.08	82.83	84.55	70.17	68.80	69.86

TABLE X : Accuracy (%) on clean graphs for non-targeted nodes.

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Model	Cora						Pubmed						Ogbn-products						Tape-arxiv23
	GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE
	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$
Shallow emb.	60.81	28.84	54.42	32.86	65.97	19.62	74.78	16.44	83.37	6.72	83.26	5.13	75.93	10.32	75.21	10.37	72.20	9.21	24.75	63.86	50.26	21.79	60.99	12.50
TAPE	66.79	19.64	72.70	11.42	73.54	10.96	83.04	8.08	90.45	1.17	90.77	0.12	81.77	7.65	82.89	5.98	86.03	2.47	37.40	51.37	60.93	20.11	73.64	8.71
KEA	67.28	20.94	71.95	15.68	77.33	10.22	81.22	10.10	83.91	6.12	89.48	1.42	77.94	11.64	79.44	9.35	85.96	3.60	25.26	65.70	49.51	30.79	67.97	11.65
LLaMA	64.71	25.42	68.85	19.45	69.64	14.11	79.82	11.86	81.21	7.69	88.84	0.96	76.52	13.25	75.96	10.39	83.00	6.41	24.46	67.85	50.81	31.27	70.38	10.22

Appendix

TABLE XI : Robustness comparison against the SGA attack at a high perturbation level.

Model	Cora						Pubmed						Ogbn-products						Tape-arxiv23
	GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE
	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$
Shallow emb.	70.93	17.00	60.78	25.02	73.22	10.78	83.58	6.60	87.23	2.41	85.41	2.68	77.67	8.27	76.96	8.28	70.90	10.84	48.76	28.81	58.15	9.51	68.56	1.64
TAPE	75.36	9.32	74.77	8.89	78.13	5.40	91.52	-1.31	91.31	0.23	91.09	-0.23	86.83	1.40	87.45	0.70	87.39	0.83	67.36	12.42	69.05	9.47	73.06	9.43
KEA	74.55	12.40	74.05	13.22	79.48	7.72	88.31	2.25	87.98	1.57	90.02	0.83	86.02	2.48	85.42	2.52	88.41	0.85	55.22	25.02	61.69	13.77	69.41	9.78
LLaMA	73.56	15.22	71.89	15.90	76.92	5.13	87.55	3.32	85.19	3.17	90.23	-0.59	84.63	4.06	82.95	2.15	87.07	1.82	54.61	28.21	63.27	14.42	73.21	6.61

Appendix

TABLE XII : Robustness comparison against the NAG-R attack at a high perturbation level.

Model	Cora						Pubmed						Ogbn-products						Tape-arxiv23
	GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE
	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$
Shallow emb.	68.63	15.29	65.17	18.53	67.93	15.12	74.36	13.75	74.17	13.24	82.82	2.99	55.41	15.98	55.40	20.16	50.90	18.29	50.10	13.20	49.71	10.38	53.97	4.17
TAPE	70.82	13.36	69.28	13.92	71.78	12.27	85.73	7.94	80.84	9.95	94.30	0.25	81.03	5.60	81.07	5.03	85.10	1.10	67.13	9.86	64.85	12.88	73.17	1.57
KEA	75.78	10.00	75.07	11.13	78.73	7.21	78.33	11.96	77.09	10.93	89.14	0.19	77.80	7.26	76.49	8.02	80.72	4.21	59.75	13.22	54.59	21.87	67.16	3.06
LLaMA	72.93	10.67	69.83	14.42	73.19	9.90	77.11	12.25	72.96	14.13	88.27	-0.33	77.03	7.97	71.99	10.48	80.28	3.78	63.04	11.84	56.43	19.89	69.46	2.31

Appendix

TABLE XIII : Robustness comparison against the DICE attack at a high perturbation level.

Model	Cora						Pubmed						Ogbn-products						Tape-arxiv23
	GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE
	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$
Shallow emb.	71.89	11.27	68.91	13.85	73.30	8.41	86.22	-0.01	86.10	-0.71	85.70	-0.39	65.27	1.03	67.63	2.54	59.33	4.75	56.39	2.30	52.18	5.93	56.11	0.37
TAPE	75.71	7.38	74.37	7.59	77.32	5.50	92.82	0.32	88.34	1.59	94.49	0.05	84.57	1.48	84.54	0.96	85.46	0.69	72.89	2.12	72.20	3.01	73.12	1.64
KEA	77.14	8.38	76.64	9.27	80.40	5.24	88.61	0.40	87.28	-0.84	89.32	-0.01	82.55	1.60	81.95	1.46	83.32	1.13	66.92	2.80	67.40	3.54	68.36	1.33
LLaMA	75.46	7.57	70.74	13.31	76.12	6.29	87.84	0.03	85.54	-0.67	88.45	-0.53	82.15	1.85	78.71	2.13	82.43	1.20	69.62	2.64	68.98	2.07	68.52	3.63

Appendix

TABLE XIV : Robustness comparison against the PGA attack at a high perturbation level.

Model	Cora						Pubmed						Ogbn-products						Tape-arxiv23
	GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE
	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$
Shallow emb.	80.83	0.23	79.63	0.45	79.97	0.07	86.35	-0.16	85.64	-0.18	85.25	0.14	66.10	-0.23	68.70	0.99	62.05	0.39	57.68	0.07	55.65	-0.32	56.80	-0.85
TAPE	81.21	0.65	80.90	-0.52	81.62	0.24	93.03	0.10	89.82	-0.06	94.46	0.08	85.86	-0.02	85.70	-0.40	86.30	-0.29	74.41	0.08	74.30	0.19	74.36	-0.03
KEA	84.14	0.07	84.02	0.53	84.43	0.49	88.80	0.19	86.80	-0.29	89.16	0.17	83.69	0.24	83.49	-0.40	84.14	0.15	68.60	0.36	69.47	0.57	69.02	0.38
LLaMA	81.62	0.02	81.24	0.44	81.47	-0.30	87.85	0.02	84.66	0.36	87.94	0.05	83.53	0.20	79.90	0.65	83.41	0.02	71.36	0.21	70.83	-0.55	71.09	0.01

Appendix

TABLE XV : Robustness comparison against the DWord attack.

Model	Cora						Pubmed						Ogbn-products						Tape-arxiv23
	GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE		GCN		GAT		SAGE
	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$	ACC $\uparrow$	RDA $\downarrow$
Shallow emb.	78.46	3.16	78.74	1.56	78.19	2.30	86.01	0.23	85.50	-0.01	84.78	0.69	64.37	2.40	67.75	2.36	59.83	3.95	55.97	3.03	53.78	3.05	53.58	4.87
TAPE	81.81	-0.09	80.29	0.24	80.21	1.97	92.33	0.85	89.18	0.66	93.26	1.35	85.63	0.24	85.36	0.00	85.43	0.72	73.05	1.91	73.29	1.54	73.13	1.63
KEA	84.35	-0.18	83.99	0.57	83.86	1.17	88.46	0.57	86.53	0.02	87.65	1.86	83.73	0.19	83.11	0.06	83.78	0.58	68.03	1.19	66.16	5.31	68.29	1.43
LLaMA	80.62	1.25	81.16	0.54	79.67	1.92	87.04	0.94	84.33	0.75	86.36	1.84	83.11	0.70	81.06	-0.80	82.57	1.03	69.33	3.05	69.30	1.62	69.06	2.87

Appendix

TABLE XVI : Robustness comparison against the BertAtk attack.

Panel of Figure 26 — Fig. 10 : ACC and RDA under the textual attacks.

Model	Cora		Pubmed		Ogbn-products		Tape-arxiv23
Model	CA $\uparrow$	MCR $\uparrow$	CA $\uparrow$	MCR $\uparrow$	CA $\uparrow$	MCR $\uparrow$	CA $\uparrow$	MCR $\uparrow$
Shallow emb.	51.36	1.74	34.23	0.97	34.23	0.86	28.23	0.93
TAPE	64.47	2.33	68.87	1.90	73.44	2.01	54.24	1.08
TE3L	60.08	2.05	41.74	1.07	65.39	1.97	34.36	1.01
E5-Large	63.54	2.36	68.16	2.17	70.31	2.09	46.47	1.22

Appendix

TABLE XVII : Results of certified robustness.

Explore similar work

Auditing Privacy Risks in LLM-Enhanced Graph Neural Networks
Aug 26, 2026Longzhu He, Zelang Wen, Chaozhuo Li +1Privacy-Preserving ML LLMs for Graph Learning
Beijing University of Posts and Telecommunications
KEPo: Knowledge Evolution Poison on Graph-based Retrieval-Augmented Generation
Mar 12, 2026Qizhi Chen, Chao Qi, Yihong Huang +5RAG Poisoning Attacks Data Poisoning Attacks
School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China · Institute of Intelligent Computing, University of Electronic Science and Technology of China, Chengdu, China · School of Information and Software Engineering, University of Electronic Science and Technology of China, Chengdu, China +1
LogicPoison: Logical Attacks on Graph Retrieval-Augmented Generation
Apr 3, 2026Yilin Xiao, Jin Chen, Qinggang Zhang +6RAG Poisoning Attacks RAG Security
The Hong Kong Polytechnic University · Southwestern University of Finance and Economics

Aug 26, 2026J/K move · Enter open · S save

Auditing Privacy Risks in LLM-Enhanced Graph Neural Networks

Longzhu He, Zelang Wen, Chaozhuo Li, Sen Su

Beijing University of Posts and Telecommunications

Privacy-Preserving ML LLMs for Graph Learning Text-Attributed Graph Learning

Open paper AskPDF arXiv

Large language models (LLMs) have recently advanced graph neural networks (GNNs) by enriching node representations with semantic information, giving rise to LLM-enhanced GNNs that achieve substantial performance gains. However, how such semantic enhancement affects privacy risks remains largely underexplored. To bridge this gap, we systematically audit the privacy risks of LLM-enhanced GNNs through a unified framework consisting of five stages: (1) dataset preparation, (2) victim model training, (3) privacy attack, (4) risk assessment, and (5) defense analysis. Specifically, our evaluation spans ten text-attributed graph datasets across diverse domains, six privacy attacks, 42 LLM-enhanced GNN configurations, and three more recent language-model backbones. Extensive experiments show that, despite their utility improvements, LLM-enhanced GNNs consistently exhibit greater empirical privacy vulnerability than shallow text representation baselines under the evaluated attacks across diverse models and datasets. Further analysis shows that LLM-enhanced representations exhibit more distinguishable link-, label-, and membership-related signals in the embedding space, making them more exploitable by inference attacks. Finally, we evaluate representative defenses and examine their effectiveness in mitigating these privacy risks. Overall, this work provides a systematic audit of privacy risks in LLM-enhanced GNNs and offers insights for developing more secure and trustworthy graph learning systems.

Abstract

Explore similar work

Auditing Privacy Risks in LLM-Enhanced Graph Neural Networks

KEPo: Knowledge Evolution Poison on Graph-based Retrieval-Augmented Generation

LogicPoison: Logical Attacks on Graph Retrieval-Augmented Generation