Contrastive Adversarial Training for Robust Graph Neural Networks under Label Poisoning

Manshika Charvi Bissessur; Melis Ilayda Bal; Michael Muehlebach

cs.LGOct 17, 2026

Contrastive Adversarial Training for Robust Graph Neural Networks under Label Poisoning

Authors: Manshika Charvi Bissessur, Melis Ilayda Bal, Michael Muehlebach

Organizations: University of Oxford · Max Planck Institute for Intelligent Systems, Tübingen, Germany · LIONS – École Polytechnique Fédérale de Lausanne · Vienna University of Economics and Business

Abstract

Graph Neural Networks (GNNs) are effective for modeling relational data but are vulnerable to label poisoning, where a small number of corrupted training labels can propagate errors across the graph via message passing. Despite this risk, defenses against label poisoning remain underexplored: existing methods are primarily designed for label noise and often rely on robust losses or heuristic data cleaning that fail to distinguish adversarial poisoning from naturally hard examples. In this paper, we propose CoLAT (Contrastive Label-flipping for Adversarial Training), a novel contrastive adversarial training framework tailored for robust node classification on graphs. The core of our approach is a structure-aware detection model that uses contrastive learning to identify label-structure inconsistencies. Unlike prior contrastive methods that focus on representation learning, CoLAT leverages contrastive embeddings to select high-risk nodes that guide adversarial label-flipping during training. This alternating optimization not only performs structure-aware adversarial training but also implicitly sanitizes some corrupted labels, improving robustness against diverse attacks from the literature. Extensive experiments on multiple benchmarks show that CoLAT consistently outperforms existing defenses under various poisoning intensities while scaling efficiently to large graphs.

Figures & tables

Figure 1: The bilevel optimization framework underlying CoLAT, which creates a feedback loop between the outer (defender) and inner (adversary) problems.

Dataset	Training	Clean Dataset	NTK				SMulti
Dataset	Training	Clean Dataset	5%	10%	20%	30%	5%	10%	20%	30%
Cora ML	Clean	0.8270 (0.005)	0.7675 (0.030)	0.6470 (0.033)	0.5378 (0.022)	0.4626 (0.008)	0.7592 (0.021)	0.6673 (0.035)	0.4932 (0.061)	0.3561 (0.032)
	PIGNN	0.8236 (0.0045)	0.7985 (0.011)	0.6727 (0.017)	0.5163 (0.020)	0.4581 (0.087)	0.7887 (0.004)	0.7453 (0.027)	0.6912 (0.024)	0.4891 (0.081)
	RTGNN	0.6297 (0.060)	0.6057 (0.054)	0.5891 (0.040)	0.4784 (0.088)	0.3817 (0.071)	0.6600 (0.035)	0.5739 (0.110)	0.5154 (0.042)	0.4364 (0.040)
	CRGNN	0.8088 (0.014)	0.7459 (0.037)	0.6312 (0.022)	0.5429 (0.017)	0.4636 (0.010)	0.7263 (0.030)	0.6211 (0.040)	0.4927 (0.010)	0.3415 (0.028)
	CP	0.8122 (0.019)	0.7663 (0.025)	0.65587 (0.049)	0.5334 (0.02)	0.4657 (0.01)	0.7281 (0.045)	0.6972 (0.02)	0.5802 (0.056)	0.3760 (0.042)

Table 1: Test accuracy comparison of CoLAT against baselines and clean training (the undefended GCN baseline) on Cora ML, Citeseer, and PubMed under clean and poisoned labels, all using a GCN architecture. Results are reported for NTK and SMulti across various attack budgets. Red indicates the best test accuracy (stdev) in each setting. CoLAT performs best across most settings.

Figure 2: Effectiveness analysis of CoLAT under the SMulti 10% attack on Cora ML. Of the 28 initially poisoned nodes, CoLAT sanitizes 10 to their ground-truth labels and relabels 7 to non-ground-truth classes while also introducing additional adversarial labels by flipping 13 clean node labels.

Training	Clean Dataset	NTK Poisoned				SMulti Poisoned
Training	Clean Dataset	5%	10%	20%	30%	5%	10%	20%	30%
Clean	0.7086(0.035)	0.7001(0.005)	0.6839(0.005)	0.5645(0.023)	0.4741(0.005)	0.6803(0.006)	0.6437(0.008)	0.3923(0.005)	0.207(0.029)
CoLAT	0.7055(0.025)	0.7037(0.014)	0.6806(0.0008)	0.6216(0.008)	0.6184(0.014)	0.6819(0.006)	0.6571(0.003)	0.4831(0.010)	0.2485(0.028)

Table 2: Scaling results of CoLAT on a larger dataset. CoLAT achieves the best performance in almost all poisoned settings on the OBGN-ArXiv dataset.

Training	Clean	NTK Poisoned				SMulti Poisoned
Training	Clean	5%	10%	20%	30%	5%	10%	20%	30%
Clean	0.2942 (0.008)	0.2849 (0.012)	0.2732 (0.009)	0.2483 (0.007)	0.2179 (0.007)	0.2312 (0.012)	0.1997 (0.016)	0.1429 (0.006)	0.1079 (0.009)
CoLAT	0.2777 (0.014)	0.2756 (0.014)	0.2688 (0.021)	0.2409 (0.006)	0.2381 (0.011)	0.2639 (0.017)	0.2435 (0.015)	0.1690 (0.005)	0.1444 (0.013)

Table 3: Test accuracy comparison of CoLAT and clean training on the heterophilic Actor dataset under NTK and SMulti adversarial label poisoning attacks.

Figure 3: Test accuracy as a function of poisoning rate under NTK and SMulti attacks for GAT and GraphSAGE, to assess CoLAT’s performance across different architectures.

Figure 4: Sensitivity analysis of CoLAT under NTK and SMulti attacks. We assess two ablations as the poisoning rate increases: replacing the contrastive detection model with a logit-based heuristic, and replacing adversarial training with one-step label filtering.

Figure 5: Sensitivity of CoLAT to the detection-model update interval on OGBN ArXiv. We consider update intervals $\delta\in\{1,5,10,20\}$ , where the detection model is updated once every $\delta$ classification-model updates. Panels (a) and (b) show test accuracy under NTK and SMulti attacks across poisoning rates, and panel (c) presents the training time-accuracy trade-off at 30% NTK poisoning.

Training	Clean Dataset	NTK Poisoned				SMulti Poisoned
Training	Clean Dataset	5%	10%	20%	30%	5%	10%	20%	30%
Clean	0.8270 (0.005)	0.7675 (0.030)	0.6470 (0.033)	0.5378 (0.022)	0.4626 (0.008)	0.7592 (0.021)	0.6673 (0.035)	0.4932 (0.061)	0.3561 (0.032)
CoLAT (select consistent nodes)	0.6871 (0.095)	0.7159 (0.025)	0.5736 (0.046)	0.4978 (0.027)	0.3806 (0.096)	0.7253 (0.014)	0.6054 (0.033)	0.4918 (0.050)	0.3757 (0.041)
CoLAT (select inconsistent nodes)	0.8377 (0.006)	0.8309 (0.007)	0.7774 (0.02)	0.6689 (0.04)	0.5342 (0.014)	0.8226 (0.017)	0.7879 (0.05)	0.7466 (0.02)	0.6739 (0.05)

Table 4: Ablation on node selection on Cora-ML. Selecting the most inconsistent nodes consistently outperforms selecting the most consistent nodes across attacks and poisoning rates.

Appendix figures & tables15 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	Nodes	Edges	Features	Classes	Homophily	Train/Val/Test
						Train	Val	Test
Cora ML	2810	9386	2879	7	0.81	140	140	2530
Citeseer	2110	4723	3703	6	0.74	120	120	1870
Pubmed	19717	44324	500	3	0.80	60	60	19597
Amazon Photos	7640	238162	745	8	0.80	160	240	7250
OGBN-ArXiv	169343	1166243	128	40	0.63	90941	29799	48603

Appendix

Table 5: Dataset statistics for the benchmark graphs used in our experiments.

Algorithm	Hyper-parameter	Search Space
General Settings	learning rate	1e-5, 5e-5, 1e-4, 5e-4, 1e-3, 5e-3, 1e-2, 5e-2, 0.1
General Settings	weight decay	1e-5, 5e-5, 1e-4, 5e-4, 1e-3, 5e-3, 1e-2, 5e-2, 0.1
	replications	5
CP	$\lambda$	0.1, 0.2, 0.3
RTGNN	$\tau$	0, 0.05, 0.1, 0.2
	$\lambda$	0.05, 0.1, 0.2

Appendix

Table 6: Hyperparameter search space for all methods.

Figure 6: Effectiveness analysis of CoLAT under the NTK attack with a 20% poisoning rate on OBGN-ArXiv.

Figure 7: Effectiveness analysis of CoLAT under the NTK attack with a 10% poisoning rate onb Cora-ML, showing that CoLAT remains robust through adversarial training even in the absence of explicit label sanitization.

Training	Clean	NTK Poisoned			SMulti Poisoned
Training	Clean	5%	10%	20%	5%	10%	20%	30%
Clean Training	0.8853 (0.009)	0.8745 (0.01)	0.7565 (0.08)	0.4859 (0.007)	0.8643 (0.014)	0.7456 (0.017)	0.5656 (0.033)	0.4771 (0.013)
PIGNN	0.8700 (0.020)	0.8242 (0.030)	0.7372 (0.055)	0.4909 (0.007)	0.8450 (0.032)	0.7448 (0.037)	0.5904 (0.053)	0.4791 (0.005)
RTGNN	0.6713 (0.061)	0.5914 (0.034)	0.6049 (0.026)	0.4376 (0.046)	0.6087 (0.023)	0.5595 (0.095)	0.6087 (0.056)	0.4601 (0.018)
CRGNN	0.8553 (0.027)	0.7145 (0.13)	0.6337 (0.10)	0.4695 (0.075)	0.6889 (0.12)	0.5891 (0.11)	0.5728 (0.065)	0.4726 (0.053)
CP	0.8902 (0.010)	0.8798 (0.020)	0.7388 (0.047)	0.4866 (0.004)	0.8754 (0.017)	0.7926 (0.023)	0.5623 (0.046)	0.4664 (0.010)

Appendix

Table 7: Test accuracy comparison of CoLAT and baseline methods on the Amazon Photo dataset under clean training and adversarial label poisoning attacks. CoLAT consistently achieves the strongest performance at higher poisoning levels.

Dataset	Training	Clean Dataset	NTK				SMulti
Dataset	Training	Clean Dataset	5%	10%	20%	30%	5%	10%	20%	30%
Coauthor-Physics	Clean	0.9163(0.015)	0.9161 (0.014)	0.6579 (0.072)	0.4998 (0.018)	0.4397 (0.006)	0.7663 (0.031)	0.5910 (0.061)	0.4410 (0.011)	0.4030 (0.024)
	PIGNN	0.9005 (0.007)	0.9124 (0.027)	0.7614 (0.031)	0.4762 (0.039)	0.4476 (0.008)	0.8587 (0.026)	0.7594 (0.035)	0.4412 (0.009)	0.4403 (0.021)
	RTGNN	0.9206 (0.012)	0.9212 (0.009)	0.9247 (0.019)	0.4591 (0.024)	0.4250 (0.021)	0.8175 (0.051)	0.5137 (0.027)	0.4797 (0.038)	0.4208 (0.020)
	CRGNN	0.9289 (0.004)	0.9247 (0.012)	0.7130 (0.033)	0.5145 (0.026)	0.4271(0.032)	0.6579 (0.02)	0.6199 (0.033)	0.4387 (0.073)	0.3087 (0.037)
	CP	0.8962 (0.029)	0.9156 (0.014)	0.6832 (0.091)	0.5281 (0.043)	0.4533 (0.023)	0.8587 (0.029)	0.7012 (0.092)	0.4344 (0.015)	0.4021 (0.022)

Appendix

Table 8: Test accuracy comparison of CoLAT against baselines and clean training (the undefended GCN baseline) Coauthor-CS, and Coauthor-Physics under clean and poisoned labels, all using a GCN architecture. Results are reported for NTK and SMulti across various attack budgets. Red indicates the best test accuracy (stdev) in each setting. CoLAT performs best across most settings.

Dataset	Training	NTK		SMulti
Dataset	Training	40%	50%	40%	50%
Cora-ML	Clean	0.2295 (0.018)	0.1405 (0.023)	0.3305 (0.027)	0.2764(0.004)
Cora-ML	CoLAT	0.3471 (0.039)	0.2256 (0.049)	0.6296 (0.021)	0.6114 (0.049)
Citeseer	Clean	0.1621 (0.015)	0.1441 (0.011)	0.2195 (0.032)	0.2204(0.044)
Citeseer	CoLAT	0.1854(0.034)	0.1816 (0.034)	0.5639 (0.086)	0.5086 (0.125)
Pubmed	Clean	0.4037 (0.028)	0.3192 (0.025)	0.4145(0.062)	0.2455(0.098)

Appendix

Table 9: Performance under high poisoning rates. CoLAT consistently outperforms clean training across datasets and attacks at

40\%

and

50\%

poisoning rates.

Dataset	Method	Clean	LafAK
Dataset	Method	Clean	5%	10%	20%	30%
Cora ML	Clean Training	0.8270 (0.005)	0.8006 (0.010)	0.7368 (0.022)	0.6145 (0.030)	0.5203 (0.025)
	PIGNN	0.8236 (0.004)	0.8182 (0.015)	0.7776 (0.015)	0.5936 (0.041)	0.6099 (0.011)
	RTGNN	0.6297 (0.060)	0.5538 (0.085)	0.6141 (0.084)	0.5591 (0.039)	0.5148 (0.017)
	CRGNN	0.8088 (0.014)	0.7660 (0.015)	0.7024 (0.040)	0.6066 (0.024)	0.4909 (0.019)
	CP	0.8122 (0.019)	0.7863 (0.031)	0.7340 (0.038)	0.6100 (0.047)	0.4942 (0.022)

Appendix

Table 10: Test accuracy comparison of CoLAT and baseline methods under the LafAK attack across Cora ML, Citeseer, and PubMed. All methods use a GCN architecture. CoLAT consistently achieves the best performance across high poisoning rates.

Architecture	Method	Clean	LafAK
Architecture	Method	Clean	5%	10%	20%	30%
GAT	Clean Training	0.8277 (0.010)	0.7913 (0.014)	0.7583 (0.011)	0.6291 (0.028)	0.5298 (0.029)
	PIGNN	0.8325 (0.006)	0.8182 (0.010)	0.7801 (0.009)	0.6224 (0.028)	0.5287 (0.026)
	CRGNN	0.8145 (0.015)	0.7792 (0.009)	0.7253 (0.019)	0.6161 (0.014)	0.5044 (0.042)
	CoLAT	0.8435 (0.008)	0.8353 (0.011)	0.7853 (0.026)	0.7890 (0.022)	0.7605 (0.027)
GraphSAGE	Clean Training	0.8277 (0.010)	0.8044 (0.018)	0.7458 (0.011)	0.5958 (0.016)	0.5797 (0.016)

Appendix

Table 11: Test accuracy comparison of CoLAT and baseline methods under the Lafak attack across GAT and GraphSAGE architectures on Cora ML. CoLAT consistently achieves the best performance across high poisoning rates.

Training	Clean Dataset	LafAK
Training	Clean Dataset	5%	10%	20%	30%
Clean Training	0.8270 (0.005)	0.8006 (0.010)	0.7368 (0.022)	0.6145 (0.030)	0.5203 (0.025)
CoLAT (filtering)	0.8264 (0.008)	0.7966 (0.006)	0.7669 (0.009)	0.6638 (0.008)	0.5413 (0.022)
CoLAT (adversarial training)	0.8377 (0.006)	0.8213 (0.016)	0.7898 (0.02)	0.7008 (0.06)	0.6221 (0.012)

Appendix

Table 12: Sensitivity to adversarial training under the LafAK attack on the Cora ML dataset. We compare CoLAT with full adversarial training against a variant that replaces it with one-step filtering based on the detection model. Results are reported for clean data and poisoning rates of 5%, 10%, 20%, and 30%. Adversarial training consistently yields stronger robustness.

Training	Clean Dataset	LafAK
Training	Clean Dataset	5%	10%	20%	30%
Clean Training	0.8270 (0.005)	0.8006 (0.010)	0.7368 (0.022)	0.6145 (0.030)	0.5203 (0.025)
CoLAT (using logits)	0.8164 (0.012)	0.8002 (0.014)	0.7258 (0.015)	0.5934 (0.027)	0.5213 (0.023)
CoLAT (using det. model)	0.8377 (0.006)	0.8213 (0.016)	0.7898 (0.02)	0.7008 (0.06)	0.6221 (0.012)

Appendix

Table 13: Sensitivity to the contrastive detection model under the LafAK attack on the Cora ML dataset. We compare CoLAT using a logit-based heuristic for node selection with the full contrastive detection model. Results show that the contrastive detection model provides superior robustness across poisoning rates.

Training	Clean	NTK Poisoned						SMulti Poisoned
Training	Clean	5%	10%	20%	30%	40%	50%	5%	10%	20%	30%	40%	50%
Clean	0.4411 (0.005)	0.4336 (0.005)	0.4215 (0.007)	0.3683 (0.003)	0.3213 (0.006)	0.2927(0.055)	0.2806(0.014)	0.4113(0.002)	0.3736(0.006)	0.2391 (0.018)	0.1660(0.008)	0.1110(0.011)	0.071(0.008)
CoLAT	0.3891 (0.015)	0.3760 (0.008)	0.3832 (0.018)	0.3621 (0.018)	0.3371 (0.014)	0.3090(0.032)	0.2903(0.012)	0.3854 (0.006)	0.3527 (0.026)	0.2586(0.026)	0.1413 (0.050)	0.069(0.016)	0.050(0.009)

Appendix

Table 14: Test accuracy comparison of CoLAT and clean training on the heterophilic Amazon-ratings dataset under NTK and SMulti adversarial label poisoning attacks.

Training	Clean	NTK Poisoned				SMulti Poisoned
Training	Clean	5%	10%	20%	30%	5%	10%	20%	30%
MLP(logits)	0.2853 (0.017)	0.2770 (0.019)	0.2856 (0.007)	0.2477 (0.015)	0.2246 (0.011)	0.2533 (0.020)	0.2511 (0.017)	0.2274 (0.019)	0.1618 (0.041)
CoLAT(logits)	0.2783 (0.017)	0.2579 (0.006)	0.2719 (0.003)	0.2460 (0.007)	0.2244 (0.020)	0.2472 (0.015)	0.2384 (0.017)	0.2079 (0.011)	0.1724 (0.047)

Appendix

Table 15: Ablation study on the Actor dataset highlighting the impact of graph structure in heterophilic settings. We compare CoLAT variants using a GCN-based detection model with an MLP-based detection model under NTK and SMulti attacks. Results show that when graph structure provides weak or noisy signals, leveraging non-graph-based detection (MLP) can be more effective.

Panel of Figure 8 — Figure 8: Training time versus test accuracy for CoLAT and baseline methods under different hardware settings and attack scenarios. CoLAT achieves the best trade-off, requiring among the least training time while attaining the highest test accuracy across both CPU and GPU configurations.

	Training Time (s)	Memory Used (GB)
Clean GCN	4.23	2.76
PiGNN	N/A (638.16)	OOM (69.22)
RTGNN	858.62	9.10
CRGNN	24.8	18.2
CP	173.6	3.82
CoLAT	7.67	2.77

Appendix

Table 16: Training time and memory consumption of different baselines on the Coauthor-physics dataset Numbers reported on NVIDIA A100-SXM4-40GB. Lower is better.

Graph Neural Networks

Graph Neural Networks learn from graph-structured data by combining information across connected nodes, edges, and larger structures.

See all 701 papers

Are LLM-Enhanced Graph Neural Networks Robust against Poisoning Attacks?
Mar 27, 2026Yuhang Ma, Jie Wang, Zheng YanGraph Neural Networks Adversarial Robustness
State Key Laboratory of Integrated Services Networks, School of Cyber Engineering, Xidian University, China · Hangzhou Institute of Technology, Xidian University, China
Self-supervised Adversarial Purification for Graph Neural Networks
May 22, 2026Woohyun Lee, Hogun ParkGraph Neural Networks Adversarial Robustness
Department of Computer Science and Engineering, Sungkyunkwan University, Suwon, South Korea.
Particle Competition and Cooperation for Robust Graph Convolutional Network Learning Under Label Noise
Sep 18, 2026Fabricio BreveLearning with Noisy Labels Graph Neural Networks
São Paulo State University - UNESP, Rio Claro - SP, Brazil

Mar 27, 2026J/K move · Enter open · S save

Are LLM-Enhanced Graph Neural Networks Robust against Poisoning Attacks?

Yuhang Ma, Jie Wang, Zheng Yan

State Key Laboratory of Integrated Services Networks, School of Cyber Engineering, Xidian University, China · Hangzhou Institute of Technology, Xidian University, China

Graph Neural Networks Adversarial Robustness Data Poisoning Attacks LLMs for Graph Learning

Open paper AskPDF arXiv

Large Language Models (LLMs) have advanced Graph Neural Networks (GNNs) by enriching node representations with semantic features, giving rise to LLM-enhanced GNNs that achieve notable performance gains. However, the robustness of these models against poisoning attacks, which manipulate both graph structures and textual attributes during training, remains unexplored. To bridge this gap, we propose a robustness assessment framework that systematically evaluates LLM-enhanced GNNs under poisoning attacks. Our framework enables comprehensive evaluation across multiple dimensions. Specifically, we assess 24 victim models by combining eight LLM- or Language Model (LM)-based feature enhancers with three representative GNN backbones. To ensure diversity in attack coverage, we incorporate six structural poisoning attacks (both targeted and non-targeted) and three textual poisoning attacks operating at the character, word, and sentence levels. Furthermore, we employ four real-world datasets, including one released after the emergence of LLMs, to avoid potential ground truth leakage during LLM pretraining, thereby ensuring fair evaluation. Extensive experiments show that LLM-enhanced GNNs exhibit significantly higher accuracy and lower Relative Drop in Accuracy (RDA) than a shallow embedding-based baseline across various attack settings. Our in-depth analysis identifies key factors that contribute to this robustness, such as the effective encoding of structural and label information in node representations. Based on these insights, we outline future research directions from both offensive and defensive perspectives, and propose a new combined attack along with a graph purification defense. To support future research, we release the source code of our framework at~https://github.com/CyberAlSec/LLMEGNNRP.

Abstract

Graph Neural Networks

Explore similar work

Are LLM-Enhanced Graph Neural Networks Robust against Poisoning Attacks?

Self-supervised Adversarial Purification for Graph Neural Networks

Particle Competition and Cooperation for Robust Graph Convolutional Network Learning Under Label Noise