Let Prompts Bridge Defense Knowledge: Transferable Graph Purification via Vulnerability-Aware GPL

Shuomin Xue; Jingyuan Li; Ju Jia; Jingxuan Yu; Xiaojun Jia

cs.AIAug 29, 2026

Let Prompts Bridge Defense Knowledge: Transferable Graph Purification via Vulnerability-Aware GPL

Authors: Shuomin Xue, Jingyuan Li, Ju Jia, Jingxuan Yu, Xiaojun Jia

Organizations: Southeast University Nanjing, China · Nanyang Technological University Singapore, Singapore

Abstract

Graph Neural Networks (GNNs) have emerged as a cornerstone for representing complex relational dependencies in diverse multimedia tasks, particularly in cross-platform user interest modeling and cross-modal semantic alignment. In the real world, a practical defense against graph adversarial perturbations is needed. However, we observe that the prevailing adversarial purification methods are essentially domain-restricted defenses, which leads to the following shortcomings: (1) single-domain data provides insufficient structural and semantic diversity for learning robust purification criteria; (2) training of domain-specific defense strategies from scratch consumes substantial computational cost. To address the above limitations, we propose a transferable graph purification scheme, named ProGAP, to bridge adversarial defense knowledge via vulnerability-aware graph prompt learning. Firstly, to capture universal adversarial patterns, a perturbation-capture edge detector is pretrained on data-rich graphs by jointly modeling topological and semantic information. Subsequently, to achieve more knowledge transfer w.r.t. robustness, vulnerability-aware prompts are designed that inject targeted purification guidance into biased nodes, during which the pretrained detector adapts to distribution shifts in downstream graphs without parameter-laborious updates. Experimental results demonstrate that compared with state-of-the-art baselines, our ProGAP achieves 1%-9% improvement, and reduces the time consumption by up to 2.2x. The code for ProGAP is available at https://github.com/Lieyoufffff/ProGAP.

Figures & tables

Figure 1. The comparison between our scheme and other adversarial purification frameworks.

Figure 2. Our scheme consists of three modules, including universal adversarial knowledge perception, vulnerability-aware prompt generation, and prompt-guided graph purification.

Dataset	Attack Rate	GCN	GCN-SVD	JaccardGCN	GNNGuard	HANG-quad	GADC	GPR-GAE	ProGAP-Pu	ProGAP-C	ProGAP-Ph
Cora	Clean	82.48 $\pm$ 0.39	77.78 $\pm$ 0.98	80.90 $\pm$ 1.26	82.52 $\pm$ 1.09	81.06 $\pm$ 2.26	79.57 $\pm$ 0.42	66.14 $\pm$ 1.10	80.49 $\pm$ 1.43	79.78 $\pm$ 0.66	77.53 $\pm$ 0.52
	M-25	58.82 $\pm$ 4.39	63.86 $\pm$ 4.38	64.60 $\pm$ 0.61	57.99 $\pm$ 4.08	63.18 $\pm$ 1.29	73.70 $\pm$ 1.02	65.37 $\pm$ 1.03	77.41 $\pm$ 0.89	77.73 $\pm$ 0.37	74.69 $\pm$ 1.37
	M-50	35.23 $\pm$ 1.16	44.13 $\pm$ 5.39	48.32 $\pm$ 0.96	35.70 $\pm$ 4.45	62.29 $\pm$ 1.34	68.15 $\pm$ 0.76	65.20 $\pm$ 1.18	77.31 $\pm$ 1.04	75.21 $\pm$ 1.96	73.32 $\pm$ 1.10
	H-25	71.97 $\pm$ 2.27	68.95 $\pm$ 1.00	71.60 $\pm$ 2.26	71.39 $\pm$ 1.90	63.46 $\pm$ 0.93	75.57 $\pm$ 0.50	65.74 $\pm$ 1.82	77.13 $\pm$ 1.16	77.41 $\pm$ 0.60	74.72 $\pm$ 0.98
	H-50	63.53 $\pm$ 2.63	55.91 $\pm$ 2.46	68.59 $\pm$ 2.58	64.96 $\pm$ 3.01	63.76 $\pm$ 0.69	71.07 $\pm$ 1.32	66.46 $\pm$ 1.53	75.63 $\pm$ 1.24	75.52 $\pm$ 1.81	72.39 $\pm$ 0.19
	G-25	53.98 $\pm$ 4.02	66.22 $\pm$ 1.93	60.59 $\pm$ 2.58	53.97 $\pm$ 3.07	63.08 $\pm$ 0.64	72.34 $\pm$ 0.89	66.14 $\pm$ 1.25	76.94 $\pm$ 1.39	76.91 $\pm$ 0.91	73.75 $\pm$ 1.03

Table 1. The accuracy (in

\%\ \pm\ \sigma

) comparison between our scheme and baselines under clean and attacked settings (25% and 50% perturbation). M, G, and H denote Metattack, GraD, and Heuristic attacks, respectively. ProGAP-Pu, ProGAP-C, and ProGAP-Ph refer to using PubMed, Computers, and Photo as upstream pre-training datasets, respectively.

Figure 4

Panel of Figure 3 — Figure 3. The accuracy (in %) comparison with and without prompt under different attacks at perturbation rates of 25%.

Panel of Figure 4 — Figure 4. The change of prompted features homology on downstream tasks.

Panel of Figure 5 — Figure 5. The change of node embedding homology on downstream tasks.

Figure 6. The visualization of node embedding distribution.

Defense	Cora	CiteSeer	CoraML	PubMed
GCN-SVD	4.20	4.96	6.05	169.53
HANG-quad	10.33	11.58	9.37	22.85
GADC	6.93	7.13	7.02	13.10
GPR-GAE	29.47	25.84	35.85	53.46
ProGAP	4.09	5.15	5.93	10.11

Table 2. Total time (in seconds) consumed by different defense methods.

Model	Evasion Attack				Poisoned Attack
	Cora	CiteSeer	PubMed	CoraML	Cora	CiteSeer	PubMed	CoraML
GCN	59.03 $\pm$ 0.64	45.35 $\pm$ 0.86	82.44 $\pm$ 0.04	64.76 $\pm$ 0.20	59.67 $\pm$ 0.62	45.64 $\pm$ 0.73	82.54 $\pm$ 0.09	64.77 $\pm$ 0.19
GCN-SVD	56.81 $\pm$ 3.41	45.71 $\pm$ 1.81	79.01 $\pm$ 0.09	65.84 $\pm$ 0.27	56.73 $\pm$ 0.73	45.88 $\pm$ 1.67	79.47 $\pm$ 0.08	67.41 $\pm$ 0.31
GNNGuard	61.47 $\pm$ 0.56	48.03 $\pm$ 0.60	OOM	66.50 $\pm$ 0.44	62.06 $\pm$ 0.34	48.84 $\pm$ 1.02	OOM	66.71 $\pm$ 0.33
GRAND	51.74 $\pm$ 1.27	47.13 $\pm$ 1.96	81.05 $\pm$ 0.19	27.80 $\pm$ 0.02	45.69 $\pm$ 3.01	49.45 $\pm$ 3.73	80.74 $\pm$ 1.03	27.80 $\pm$ 0.02
Soft-Median-GDC	63.15 $\pm$ 6.08	52.93 $\pm$ 8.31	OOM	61.16 $\pm$ 4.73	63.74 $\pm$ 3.03	59.82 $\pm$ 2.52	OOM	70.43 $\pm$ 1.85

Table 3. The accuracy (

\%\ \pm\ \sigma

) under adaptive attacks. OOM indicates out-of-memory.

Variants	Cora		CiteSeer		CoraML		PubMed
	G-25	M-25	G-25	M-25	G-25	M-25	G-25	M-25
ProGAP	76.94 $\pm$ 1.39	77.41 $\pm$ 0.89	70.05 $\pm$ 1.49	70.92 $\pm$ 1.22	79.12 $\pm$ 0.51	78.62 $\pm$ 1.21	82.22 $\pm$ 0.70	83.64 $\pm$ 0.51
w/o $D_{t}$	60.50 $\pm$ 3.57	62.83 $\pm$ 3.30	62.86 $\pm$ 0.95	62.91 $\pm$ 0.44	59.80 $\pm$ 3.44	67.74 $\pm$ 3.48	78.50 $\pm$ 0.77	78.45 $\pm$ 0.73
w/o $D_{s}$	65.66 $\pm$ 0.50	65.71 $\pm$ 1.08	64.09 $\pm$ 0.73	64.72 $\pm$ 2.14	57.07 $\pm$ 2.56	65.92 $\pm$ 3.75	80.70 $\pm$ 0.58	79.39 $\pm$ 0.47
w/o attn.	75.40 $\pm$ 1.27	75.57 $\pm$ 1.11	69.90 $\pm$ 0.86	70.50 $\pm$ 1.30	78.59 $\pm$ 0.45	77.40 $\pm$ 1.18	82.72 $\pm$ 0.75	83.77 $\pm$ 0.38
w/o pl	76.13 $\pm$ 1.74	77.08 $\pm$ 1.23	70.09 $\pm$ 1.09	70.23 $\pm$ 1.03	78.90 $\pm$ 0.41	78.08 $\pm$ 1.35	81.95 $\pm$ 0.77	83.26 $\pm$ 0.33

Table 4. The accuracy (

\%\ \pm\ \sigma

) of ablation study on

D_{t}

D_{s}

, attention mechanism, pseudo labels and prompts (

p_{d}

p_{s}

Panel of Figure 7 — Figure 7. The accuracy comparison between our scheme and baselines on heterophily graphs under clean and Mettack settings.

Graph Prompt Learning

See all 9 papers

Self-supervised Adversarial Purification for Graph Neural Networks
May 22, 2026Woohyun Lee, Hogun ParkGraph Neural Networks Adversarial Robustness
Department of Computer Science and Engineering, Sungkyunkwan University, Suwon, South Korea.
Defending against Model Extraction for GNNs with Model Reprogramming
Aug 11, 2026Yan Wen, Zhenyi Wang, Heng HuangGraph Neural Networks Model Extraction Attacks
University of Maryland, College Park Department of Computer Science College Park, MD, USA · University of Central Florida Department of Computer Science and Institute of Artificial Intelligence Orlando, FL, USA
ZeroGAR: Benchmarking the Adversarial Robustness of Zero-Shot Graph Models
Sep 27, 2026Zhongjian Zhang, Xiao Wang, Busheng Zhang +5Graph Representation Learning Adversarial Attacks
Beijing University of Posts and Telecommunications · Beihang University · Tsinghua University +2

May 22, 2026J/K move · Enter open · S save

Self-supervised Adversarial Purification for Graph Neural Networks

Woohyun Lee, Hogun Park

Department of Computer Science and Engineering, Sungkyunkwan University, Suwon, South Korea.

Graph Neural Networks Adversarial Robustness Adversarial Purification

Open paper AskPDF arXiv

Defending Graph Neural Networks (GNNs) against adversarial attacks requires balancing accuracy and robustness, a trade-off often mishandled by traditional methods like adversarial training that intertwine these conflicting objectives within a single classifier. To overcome this limitation, we propose a self-supervised adversarial purification framework. We separate robustness from the classifier by introducing a dedicated purifier, which cleanses the input data before classification. In contrast to prior adversarial purification methods, we propose GPR-GAE, a novel graph auto-encoder (GAE), as a specialized purifier trained with a self-supervised strategy, adapting to diverse graph structures in a data-driven manner. Utilizing multiple Generalized PageRank (GPR) filters, GPR-GAE captures diverse structural representations for robust and effective purification. Our multi-step purification process further facilitates GPR-GAE to achieve precise graph recovery and robust defense against structural perturbations. Experiments across diverse datasets and attack scenarios demonstrate the state-of-the-art robustness of GPR-GAE, showcasing it as an independent plug-and-play purifier for GNN classifiers.

Abstract

Graph Prompt Learning

Explore similar work

Self-supervised Adversarial Purification for Graph Neural Networks

Defending against Model Extraction for GNNs with Model Reprogramming

ZeroGAR: Benchmarking the Adversarial Robustness of Zero-Shot Graph Models