RGDM: Robust Graph Diffusion Model

Yancheng Wang; Ping Li; Dongfang Sun; Yingzhen Yang

cs.LGNov 3, 2026

RGDM: Robust Graph Diffusion Model

Authors: Yancheng Wang, Ping Li, Dongfang Sun, Yingzhen Yang

Organizations: School of Computing and Augmented Intelligence Arizona State University Tempe, AZ 85281, USA · VecML Inc. Bellevue, WA 98004, USA

Abstract

Diffusion models represent a powerful class of generative models known for their solid theoretical foundations and remarkable performance across diverse tasks and domains. Existing node level diffusion methods synthesize nodes and edges within a graph, but are not designed to learn a robust generator from adversarially corrupted graphs. In this study, we introduce the Robust Graph Diffusion Model (RGDM), designed to generate labeled synthetic graph structures consisting of nodes and edges that integrate seamlessly into a given graph. The RGDM consists of a Robust Graph Autoencoder (RGAE) and a Latent Diffusion Model (LDM). Leveraging an edge selection mechanism and an innovative low-rank regularization on the latent feature, the RGDM produces clean and high-quality synthetic graph structures, even when trained on graphs subject to adversarial attacks. Comprehensive experimental evaluations reveal that Graph Neural Networks (GNNs) trained on the augmented graph, which is formed by merging the original attacked graph with the synthetic graph structures, exhibit significantly improved robustness against various graph adversarial attacks in the context of semi-supervised node classification. The code of the RGDM is available at https://github.com/Statistical-Deep-Learning/RGDM.

Figures & tables

Figure 1: Illustration of the 2-hop neighborhood of a real node and a synthetic node in the augmented graph. Figure 5 in Section F.10 illustrates the t-SNE visualization of the augmented graph.

Figure 2: Figure (a) illustrates the synthetic node generation process in Robust Graph Diffusion Model. Figure (b) illustrates the structure of the Sparse Hierarchical Edge Decoder (SHED).

Dataset	Ptb Rate (%)	GCN	GCORNs	HANG	STABLE	Pro-GNN	SG-GSR
Cora	0 (clean)	83.5 $\pm$ 0.4	82.6 $\pm$ 0.5	80.1 $\pm$ 0.3	84.7 $\pm$ 0.5	83.0 $\pm$ 0.2	85.5 $\pm$ 1.3
	15	65.1 $\pm$ 0.7	72.6 $\pm$ 1.2	72.9 $\pm$ 1.0	74.4 $\pm$ 0.9	76.4 $\pm$ 1.3	78.5 $\pm$ 1.6
	25	47.5 $\pm$ 1.9	69.5 $\pm$ 1.9	68.7 $\pm$ 1.9	69.6 $\pm$ 0.6	69.7 $\pm$ 1.7	77.8 $\pm$ 1.3
Citeseer	0 (clean)	72.0 $\pm$ 0.6	72.6 $\pm$ 0.4	73.3 $\pm$ 0.4	74.8 $\pm$ 0.5	73.3 $\pm$ 0.7	75.8 $\pm$ 1.4
	15	64.5 $\pm$ 1.1	65.5 $\pm$ 1.0	70.8 $\pm$ 0.9	67.5 $\pm$ 0.4	72.0 $\pm$ 1.1	73.1 $\pm$ 1.4
	25	56.9 $\pm$ 1.1	65.2 $\pm$ 1.3	66.4 $\pm$ 1.6	65.6 $\pm$ 1.9	69.0 $\pm$ 1.8	72.7 $\pm$ 1.4

Table 1: Metattack accuracy

\pm

marginal SD (%). Parentheses give the augmentation gain. A further

\pm

is its SD from the separate paired evaluation (Table 26 ). A

0\%

rate is a clean graph. Bold and underline mark the best and second best results across both panels for each setting. Complete results appear in Table 10 .

Dataset	Budget	GCN	GCORNs	HANG	STABLE	Pro-GNN	SG-GSR
Cora	0 (clean)	81.4 $\pm$ 1.0	82.6 $\pm$ 0.4	80.8 $\pm$ 1.3	85.3 $\pm$ 1.8	84.8 $\pm$ 0.6	85.5 $\pm$ 1.7
	3	68.0 $\pm$ 1.7	73.2 $\pm$ 0.7	73.1 $\pm$ 1.9	73.8 $\pm$ 1.8	72.4 $\pm$ 0.5	74.9 $\pm$ 1.2
	5	55.5 $\pm$ 1.7	66.9 $\pm$ 1.1	68.8 $\pm$ 1.6	68.4 $\pm$ 1.6	66.9 $\pm$ 0.7	68.0 $\pm$ 1.5
Citeseer	0 (clean)	81.0 $\pm$ 1.4	81.9 $\pm$ 1.2	81.1 $\pm$ 1.1	82.4 $\pm$ 1.8	82.1 $\pm$ 0.8	82.8 $\pm$ 1.2
	3	64.0 $\pm$ 1.7	78.1 $\pm$ 1.1	77.1 $\pm$ 1.5	80.9 $\pm$ 1.5	79.7 $\pm$ 2.0	81.7 $\pm$ 1.2
	5	47.6 $\pm$ 1.2	71.7 $\pm$ 1.8	73.5 $\pm$ 1.5	72.5 $\pm$ 1.5	71.3 $\pm$ 2.0	73.8 $\pm$ 1.0

Table 2: Nettack accuracy

\pm

marginal SD (%), with augmentation gains in parentheses. Budget

0

is a clean graph. The highlighting convention is that of Table 1 . Complete results appear in Table 11 .

Method	Cora	Citeseer	Polblogs	Pubmed
RGDM (GCN) w/o Sparsification Loss ( ${\cal L}^{(t)}_{\textup{S}}$ )	56.72	58.97	53.24	77.92
RGDM (GCN) w/o Low-Rank Regularization ( ${\left\\|\mathbf{K}\right\\|}_{r_{0}}$ )	60.04	60.38	54.85	80.85
RGDM (GCN, Weight Orthogonality ( Savostianova et al., 2023 ) )	59.88	61.12	55.17	80.16
RGDM (GCN, Low-Rank Adjacency Matrix ( Entezari et al., 2020 ) )	61.01	60.25	55.03	80.02
RGDM (GCN)	61.42	62.84	56.47	81.52

Table 3: Ablation study on the sparsification loss and the low-rank regularization term.

Method	Cora	Citeseer	Polblogs	Pubmed
GCN	47.53	56.94	49.23	75.50
iGraphMix (GCN) ( Jeong et al., 2024 )	53.25	57.11	51.65	76.10
ImGAGN (GCN) ( Qu et al., 2021 )	53.58	56.89	50.95	75.32
Graphsmote (GCN) ( Zhao et al., 2021a )	55.10	58.06	52.44	76.25
SNS (GCN) ( Gao et al., 2023 )	58.35	59.17	54.03	78.28
DoG (GCN) ( Wang et al., 2025 )	59.40	60.10	54.70	79.20

Table 4: Comparisons between RGDM and existing node-level graph augmentation methods. The study is performed for Metattack with a perturbation rate of

25\%

Configuration	Cora	Citeseer	Polblogs	Pubmed
SG-GSR (no augmentation)	77.8	72.7	87.8	87.2
DoG augmentation (BLND)	75.6	71.0	85.3	85.1
+ Edge selection	76.6	72.1	86.3	85.9
+ Latent TNN (RGDM with BLND)	77.4	73.1	87.2	86.6
+ SHED (full RGDM)	79.1	75.3	88.8	88.6

Table 5: Successive generator components. SG-GSR and

25\%

Metattack are fixed. Accuracy in percent.

Dataset	$0\%$ (clean)	$15\%$	$25\%$
Chameleon	72.31 / 74.02	71.87 / 72.98	70.03 / 72.41
Actor	38.87 / 41.80	36.79 / 39.01	35.37 / 37.90

Table 6: Heterophilic graphs under Metattack. Each entry is LHS / RGDM(LHS) accuracy (%).

Dataset	Final graph attack	Through edge selection
Cora	74.8 / 77.8	74.5 / 76.9
Citeseer	69.5 / 73.4	69.2 / 72.4
Polblogs	84.7 / 87.6	84.4 / 86.6
Pubmed	84.9 / 87.2	84.6 / 86.3

Table 7: Adaptive Metattack: baseline SG-GSR / RGDM(SG-GSR) accuracy (%). The budget is fixed in absolute edge flips.

Dataset	Training (min)	Generation (s/node)
Pubmed	153 / 480	0.073 / 0.080
ogbn-arxiv	452 / 2511	0.15 / 0.49

Table 8: SHED / global decoder timings: RGAE training and complete synthetic node generation.

Appendix figures & tables32 assets

Supplementary material from the paper’s appendix.

Appendix

Datasets	# Node	# Edge	Classes	Features
Cora	2,485	5,069	7	1,433
Citeseer	2,110	3,668	6	3,703
Polblogs	1,222	16,714	2	1,222
Pubmed	19,717	44,338	3	500
ogbn-arxiv	169,343	1,166,243	40	128
Reddit	232,965	11,606,919	41	602

Appendix

Table 9: Statistics of the datasets.

Figure 3: Eigen-projection (left) and concentration ratio (right) of the ground truth label and the adversarial noise on Pubmed. The study is performed for Metattack with a perturbation ratio of $25\%$ . By the rank $r=r_{0}=0.2\min\left\{N,D^{\prime}\right\}$ , the signal concentration ratio of the ground truth label is $0.784$ . Results on Cora and Citeseer are illustrated in Figure 4 in Section F.1 .

Figure 4: Eigen-projection (first row) and concentration ratio (second row) of the ground truth label and the adversarial noise on Cora, Citeseer, and Pubmed. The study in this figure is performed for Metattack with a perturbation ratio of $25\%$ . By the rank $r=r_{0}=0.2\min\left\{N,D^{\prime}\right\}$ , the signal concentration ratios of the ground truth label for Cora, Citeseer, and Pubmed are $0.844$ , $0.809$ , and $0.784$ respectively.

Dataset

Ptb Rate (%)

GCN

GAT

RGCN

GCN-SVD

GraphBel

UAG

GCORNs

GADC

HANG

Pro-GNN

RGDM (GCN)

RGDM (HANG)

RGDM (Pro-GNN)

Cora

83.50

\pm

0.44

83.97

\pm

0.65

83.09

\pm

0.44

80.63

\pm

0.45

83.42

\pm

0.52

82.05

\pm

0.51

82.56

\pm

0.48

83.22

\pm

0.61

80.07

\pm

0.32

82.98

\pm

0.23

85.23

\pm

0.44 (

\uparrow 1.73

)

82.31

\pm

0.51 (

\uparrow 2.24

)

84.29

\pm

0.52 (

\uparrow 1.31

)

76.55

\pm

0.79

80.44

\pm

0.74

77.42

\pm

0.39

78.39

\pm

0.54

82.78

\pm

0.39

79.13

\pm

0.59

75.91

\pm

1.88

75.68

\pm

1.10

78.12

\pm

0.72

82.27

\pm

0.45

80.19

\pm

0.39 (

\uparrow 3.64

)

81.04

\pm

0.59 (

\uparrow 2.92

)

83.19

\pm

0.39 (

\uparrow 0.92

)

70.39

\pm

1.28

75.61

\pm

0.59

72.22

\pm

0.38

71.47

\pm

0.83

77.91

\pm

0.86

75.16

\pm

0.76

74.63

\pm

1.02

73.70

\pm

1.17

75.96

\pm

0.62

79.03

\pm

0.59

76.73

\pm

0.38 (

\uparrow 6.34

)

78.03

\pm

0.76 (

\uparrow 2.07

)

81.16

\pm

0.86 (

\uparrow 2.13

)

65.10

\pm

0.71

69.78

\pm

1.28

66.82

\pm

0.39

66.69

\pm

1.18

76.01

\pm

1.12

71.03

\pm

0.64

72.57

\pm

1.24

71.39

\pm

1.22

72.89

\pm

0.96

76.40

\pm

1.27

69.37

\pm

0.39 (

\uparrow 4.27

)

76.39

\pm

0.64 (

\uparrow 3.50

)

78.29

\pm

1.12 (

\uparrow 1.89

)

59.56

\pm

1.72

59.94

\pm

0.92

59.27

\pm

0.37

58.94

\pm

1.13

68.78

\pm

1.84

65.71

\pm

0.89

71.94

\pm

1.51

71.20

\pm

1.49

70.36

\pm

1.09

73.32

\pm

1.56

65.97

\pm

0.37 (

\uparrow 6.41

)

73.25

\pm

0.89 (

\uparrow 2.89

)

74.85

\pm

1.84 (

\uparrow 1.53

)

47.53

\pm

1.91

54.78

\pm

0.74

50.51

\pm

0.78

52.06

\pm

1.19

56.54

\pm

1.58

60.82

\pm

1.08

69.48

\pm

1.94

68.29

\pm

1.36

68.72

\pm

1.87

69.72

\pm

1.69

61.42

\pm

0.78 (

\uparrow 13.89

)

70.44

\pm

1.08 (

\uparrow 1.72

)

72.31

\pm

1.58 (

\uparrow 2.59

)

Appendix

Table 10: Node classification performance (Accuracy

\pm

Std) under the non-targeted poisoning attack (Metattack) [ 101 ] . The improvements of the RGDM over the corresponding baselines are attached in parentheses after the results of the RGDM.

Dataset

Attack Budget

GCN

GAT

RGCN

GCN-SVD

GraphBel

UAG

GCORNs

GADC

HANG

Pro-GNN

RGDM (GCN)

RGDM (HANG)

RGDM (Pro-GNN)

Cora

81.43

\pm

1.04

82.14

\pm

1.13

81.34

\pm

1.55

81.10

\pm

1.34

71.55

\pm

1.01

82.34

\pm

1.08

82.61

\pm

0.41

81.36

\pm

1.83

80.75

\pm

1.27

84.78

\pm

0.59

83.43

\pm

1.08 (

\uparrow 2.00

)

82.10

\pm

1.34 (

\uparrow 1.35

)

86.00

\pm

1.13 (

\uparrow 1.22

)

75.06

\pm

1.02

76.04

\pm

1.08

76.75

\pm

1.71

77.23

\pm

1.82

63.73

\pm

1.25

81.75

\pm

1.16

81.05

\pm

1.14

80.05

\pm

1.53

76.99

\pm

1.16

83.85

\pm

0.51

78.41

\pm

1.16 (

\uparrow 3.35

)

80.39

\pm

1.82 (

\uparrow 3.40

)

84.79

\pm

1.08 (

\uparrow 0.94

)

70.60

\pm

1.10

70.24

\pm

1.43

70.96

\pm

1.14

72.53

\pm

1.60

62.41

\pm

1.94

77.96

\pm

1.84

78.47

\pm

1.32

75.90

\pm

1.29

76.51

\pm

1.60

78.65

\pm

0.66

73.79

\pm

1.84 (

\uparrow 3.19

)

79.14

\pm

1.60 (

\uparrow 2.63

)

80.02

\pm

1.43 (

\uparrow 1.37

)

67.95

\pm

1.72

65.54

\pm

1.34

66.51

\pm

1.60

66.75

\pm

1.54

61.20

\pm

1.08

72.51

\pm

1.14

73.17

\pm

0.74

71.94

\pm

1.45

73.13

\pm

1.85

72.40

\pm

0.53

70.46

\pm

1.14 (

\uparrow 2.51

)

76.31

\pm

1.54 (

\uparrow 3.18

)

74.31

\pm

1.34 (

\uparrow 1.91

)

61.57

\pm

1.47

61.69

\pm

0.90

59.28

\pm

1.68

60.72

\pm

1.63

56.51

\pm

1.72

70.28

\pm

1.52

71.26

\pm

0.62

70.93

\pm

1.19

72.53

\pm

1.14

70.12

\pm

0.66

64.37

\pm

1.52 (

\uparrow 2.80

)

75.12

\pm

1.63 (

\uparrow 2.59

)

72.79

\pm

0.90 (

\uparrow 2.67

)

55.54

\pm

1.66

58.31

\pm

1.03

55.30

\pm

1.66

57.71

\pm

1.82

51.93

\pm

1.77

66.30

\pm

1.21

66.89

\pm

1.08

64.49

\pm

1.42

68.80

\pm

1.55

66.89

\pm

0.73

59.44

\pm

1.21 (

\uparrow 3.90

)

69.81

\pm

1.82 (

\uparrow 1.01

)

69.81

\pm

1.03 (

\uparrow 2.92

)

Appendix

Table 11: Node classification performance (Accuracy

\pm

Std) under targeted attack (Nettack) [ 100 ] . The improvements of RGDM over the corresponding baselines are attached in parentheses after the results of the RGDM.

Dataset

Ptb Rate (%)

GCN

GAT

RGCN

GCN-SVD

GraphBel

UAG

GCORNs

GADC

HANG

Pro-GNN

RGDM(GCN)

RGDM(HANG)

RGDM(Pro-GNN)

Cora

83.50

\pm

0.44

83.97

\pm

0.65

83.09

\pm

0.44

80.63

\pm

0.45

83.42

\pm

0.52

82.05

\pm

0.51

82.63

\pm

0.47

83.21

\pm

0.72

80.07

\pm

0.32

82.98

\pm

0.23

85.23

\pm

0.44 (

\uparrow 1.73

)

82.31

\pm

0.51 (

\uparrow 2.24

)

84.29

\pm

0.52 (

\uparrow 1.31

)

75.50

\pm

0.44

76.97

\pm

0.65

75.04

\pm

1.32

75.82

\pm

1.24

77.01

\pm

1.33

76.22

\pm

1.24

75.96

\pm

1.81

76.83

\pm

1.25

76.99

\pm

1.52

77.63

\pm

1.85

77.92

\pm

1.08 (

\uparrow 2.42

)

79.39

\pm

1.33 (

\uparrow 2.40

)

81.10

\pm

1.16 (

\uparrow 3.47

)

72.02

\pm

1.32

74.10

\pm

1.84

73.05

\pm

1.25

74.00

\pm

1.76

74.00

\pm

1.57

76.00

\pm

1.76

74.67

\pm

1.03

75.90

\pm

1.84

76.99

\pm

1.52

77.63

\pm

1.85

74.22

\pm

1.43 (

\uparrow 2.20

)

79.44

\pm

1.57 (

\uparrow 2.45

)

80.36

\pm

1.84 (

\uparrow 2.73

)

69.42

\pm

1.71

70.55

\pm

1.69

71.61

\pm

1.34

72.90

\pm

1.46

72.79

\pm

1.26

74.90

\pm

1.33

72.58

\pm

1.27

74.34

\pm

1.52

75.63

\pm

1.59

75.40

\pm

1.32

72.42

\pm

1.34 (

\uparrow 3.00

)

76.92

\pm

1.26 (

\uparrow 1.29

)

76.57

\pm

1.14 (

\uparrow 1.17

)

67.61

\pm

1.02

68.84

\pm

1.33

67.87

\pm

1.22

70.00

\pm

1.83

70.55

\pm

1.17

71.85

\pm

1.22

71.99

\pm

1.54

72.06

\pm

1.80

72.15

\pm

1.27

71.32

\pm

1.79

71.61

\pm

0.90 (

\uparrow 4.00

)

74.35

\pm

1.17 (

\uparrow 2.20

)

74.44

\pm

1.52 (

\uparrow 3.12

)

64.81

\pm

1.14

65.51

\pm

1.45

66.02

\pm

1.39

67.89

\pm

1.21

66.32

\pm

1.07

68.03

\pm

1.39

69.47

\pm

1.98

68.92

\pm

1.27

69.10

\pm

1.33

68.72

\pm

1.50

69.53

\pm

1.03 (

\uparrow 4.72

)

71.67

\pm

1.07 (

\uparrow 2.57

)

72.07

\pm

1.21 (

\uparrow 3.35

)

Appendix

Table 12: Node classification performance (Accuracy

\pm

Std) under Topology Attack [ 82 ] . The improvements of the RGDM over the corresponding baselines are attached in parentheses after the results of the RGDM.

Data	Cora	Citeseer	Polblogs	Pubmed
Original Attacked Graph	12.10 $\pm$ 0.45	7.53 $\pm$ 0.22	8.26 $\pm$ 0.37	6.11 $\pm$ 0.38
iGraphMix [ 34 ]	13.44 $\pm$ 0.33	9.02 $\pm$ 0.42	10.75 $\pm$ 0.44	7.65 $\pm$ 0.38
ImGAGN [ 55 ]	13.10 $\pm$ 0.38	7.96 $\pm$ 0.42	9.86 $\pm$ 0.43	6.95 $\pm$ 0.27
Graphsmote [ 93 ]	13.52 $\pm$ 0.42	8.95 $\pm$ 0.22	10.60 $\pm$ 0.27	7.45 $\pm$ 0.51
SNS [ 22 ]	13.35 $\pm$ 0.42	7.88 $\pm$ 0.27	9.30 $\pm$ 0.85	6.74 $\pm$ 0.41
Baseline DDPM	13.28 $\pm$ 0.40	8.82 $\pm$ 0.26	10.25 $\pm$ 0.39	7.25 $\pm$ 0.41

Appendix

Table 13: Frechet Node Distance (FND) to the nodes in the base partition of the original clean graph. The mean and standard deviation of the FND scores computed with

10

different random splits of the base partition and the test partition in the original clean graph are reported. The evaluation is performed for Metattack with a perturbation rate of

25\%

. The FND score for the original clean graph is computed between the nodes in the test partition and the nodes in the base partition of the original clean graph.

Data	Cora	Citeseer	Polblogs	Pubmed
Original Attacked Graph	10.32 $\pm$ 0.42	7.83 $\pm$ 0.28	8.92 $\pm$ 0.39	6.53 $\pm$ 0.37
iGraphMix [ 34 ]	11.25 $\pm$ 0.28	8.42 $\pm$ 0.43	9.63 $\pm$ 0.44	7.11 $\pm$ 0.27
ImGAGN [ 55 ]	11.05 $\pm$ 0.38	8.04 $\pm$ 0.26	8.21 $\pm$ 0.51	7.16 $\pm$ 0.79
Graphsmote [ 93 ]	11.13 $\pm$ 0.29	8.16 $\pm$ 0.51	9.32 $\pm$ 0.41	7.18 $\pm$ 0.44
SNS [ 22 ]	11.05 $\pm$ 0.38	8.04 $\pm$ 0.26	8.21 $\pm$ 0.51	7.16 $\pm$ 0.79
Baseline DDPM ( $K=\lceil d_{\textup{ave}}/4\rceil$ )	12.03 $\pm$ 0.45	8.72 $\pm$ 0.31	10.77 $\pm$ 0.40	7.93 $\pm$ 0.42

Appendix

Table 14: Frechet Edge Distance (FED) to the edges in the base partition of the original clean graph. The mean and standard deviation of the FED scores computed with

10

different random splits of the base partition and the test partition in the original clean graph are reported. The evaluation is performed for Metattack with a perturbation rate of

25\%

. The FED score for the original clean graph is computed between the edges in the test partition and the edges in the base partition of the original clean graph.

	RGAE training (min)		Generation (s/node)
Dataset	SHED	Global	SHED	Global
Cora	20	29	0.066	0.089
Citeseer	23	30	0.067	0.086
Polblogs	65	88	0.069	0.090
Pubmed	153	480	0.073	0.080
ogbn-arxiv	452	2511	0.15	0.49

Appendix

Table 15: SHED versus a global decoder on one NVIDIA A100. The generation measurement includes LDM sampling and decoding.

Datasets	RGDM Training Time (minutes)		Generation Time (s/sample)
Datasets	RGAE	LDM	Generation Time (s/sample)
Cora	20	39	0.066
Citeseer	23	41	0.067
Polblogs	65	31	0.069
Pubmed	153	154	0.073

Appendix

Table 16: Time for the training of the RGDM and data generation with the RGDM on different datasets.

Datasets	Cross-validation Time (minutes)
Datasets	RGDM (GCN)	RGDM (SG-GSR)	RGDM (Pro-GNN)
Cora	1.1	3.5	43.3
Citeseer	1.0	3.4	38.5
Polblogs	1.6	3.9	26.9
Pubmed	9.4	20.5	176.5

Appendix

Table 17: Time for selecting the optimal number of synthetic nodes

N^{\prime}

with cross-validation.

Dataset	Ptb Rate (%)	RGDM (GCN)	RGDM (SG-GSR)	RGDM (Pro-GNN)
Cora	0	$2\times\left\|{\cal V}_{L}\right\|$	$1\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$
	5	$2\times\left\|{\cal V}_{L}\right\|$	$1\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$
	10	$2\times\left\|{\cal V}_{L}\right\|$	$1\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$
	15	$3\times\left\|{\cal V}_{L}\right\|$	$1\times\left\|{\cal V}_{L}\right\|$	$3\times\left\|{\cal V}_{L}\right\|$
	20	$3\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$	$3\times\left\|{\cal V}_{L}\right\|$
	25	$5\times\left\|{\cal V}_{L}\right\|$	$5\times\left\|{\cal V}_{L}\right\|$	$5\times\left\|{\cal V}_{L}\right\|$

Appendix

Table 18: The number of synthetic nodes

N^{\prime}

(

\times\left|{\cal V}_{L}\right|

) selected for Metattack, where

{\cal V}_{L}

is the labeled nodes of the original graph.

Dataset	Attack Budget	RGDM (GCN)	RGDM (SG-GSR)	RGDM (Pro-GNN)
Cora	0	$2\times\left\|{\cal V}_{L}\right\|$	$1\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$
	1	$3\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$
	2	$3\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$
	3	$3\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$	$3\times\left\|{\cal V}_{L}\right\|$
	4	$3\times\left\|{\cal V}_{L}\right\|$	$3\times\left\|{\cal V}_{L}\right\|$	$3\times\left\|{\cal V}_{L}\right\|$
	5	$4\times\left\|{\cal V}_{L}\right\|$	$3\times\left\|{\cal V}_{L}\right\|$	$3\times\left\|{\cal V}_{L}\right\|$

Appendix

Table 19: The number of synthetic nodes

N^{\prime}

(

\times\left|{\cal V}_{L}\right|

) for Nettack, where

{\cal V}_{L}

is the labeled nodes of the original graph.

Dataset	Ptb Rate (%)	RGDM (GCN)	RGDM (SG-GSR)	RGDM (Pro-GNN)
Cora	0	$1\times\left\|{\cal V}_{L}\right\|$	$1\times\left\|{\cal V}_{L}\right\|$	$1\times\left\|{\cal V}_{L}\right\|$
	5	$1\times\left\|{\cal V}_{L}\right\|$	$1\times\left\|{\cal V}_{L}\right\|$	$1\times\left\|{\cal V}_{L}\right\|$
	10	$2\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$
	15	$2\times\left\|{\cal V}_{L}\right\|$	$1\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$
	20	$2\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$	$3\times\left\|{\cal V}_{L}\right\|$
	25	$2\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$

Appendix

Table 20: The number of synthetic nodes

N^{\prime}

(

\times\left|{\cal V}_{L}\right|

) for Topology Attack, where

{\cal V}_{L}

is the labeled nodes of the original graph.

Dataset	Ptb Rate (%)	GCN	RGDM (GCN)
ogbn-arxiv	0	72.82 $\pm$ 1.32	74.48 $\pm$ 1.15 ( $\uparrow 1.66$ )
	10	62.25 $\pm$ 1.23	64.50 $\pm$ 1.35 ( $\uparrow 2.25$ )
	20	54.95 $\pm$ 1.44	56.17 $\pm$ 1.66 ( $\uparrow 1.22$ )
Reddit	0	93.52 $\pm$ 1.17	95.44 $\pm$ 1.42 ( $\uparrow 1.92$ )
	10	82.62 $\pm$ 1.32	84.73 $\pm$ 1.12 ( $\uparrow 2.11$ )
	20	74.53 $\pm$ 1.57	75.99 $\pm$ 1.22 ( $\uparrow 1.46$ )

Appendix

Table 21: Node classification performance (Accuracy

\pm

Std) under the adversarial attack by the improved DICE [ 44 ] . The improvements of the RGDM over the baseline are attached in parentheses.

Method	ogbn-arxiv	Reddit
GCN	54.95	74.53
RGDM without edge selection	55.30	75.00
RGDM (full)	56.17	75.99

Appendix

Table 22: Edge selection ablation on large graphs under

20\%

improved DICE, with GCN fixed. Accuracy (%).

$\tau$	0.1	0.2	0.3	0.4	0.5	0.6	0.7	0.8	0.9
Accuracy	72.12	72.16	72.30	72.29	72.31	72.28	72.24	72.22	72.25

Appendix

Table 23: Sensitivity analysis on the temperature for edge selection

\tau

. The study is performed by using RGDM (Pro-GNN) on Cora with

25\%

of Metattack.

$K$	20	40	60	80	100	120	150	200
$M=\lceil N/K\rceil$	125	63	42	32	25	21	17	13
Generation Time (s/sample)	0.075	0.070	0.068	0.067	0.066	0.067	0.068	0.071
Accuracy	72.12	72.20	72.26	72.29	72.31	72.28	72.24	72.20

Appendix

Table 24: Sensitivity analysis on the number of clusters

K

in SHED. The study is performed by using RGDM (Pro-GNN) on Cora with

25\%

of Metattack.

Dataset	Ptb Rate (%)	LHS	RGDM (LHS)
Chameleon	0	72.31 $\pm$ 1.32	74.02 $\pm$ 1.13 ( $\uparrow 1.71$ )
	15	71.87 $\pm$ 1.61	72.98 $\pm$ 1.11 ( $\uparrow 1.11$ )
	25	70.03 $\pm$ 1.85	72.41 $\pm$ 1.66 ( $\uparrow 2.38$ )
Actor	0	38.87 $\pm$ 1.43	41.80 $\pm$ 1.42 ( $\uparrow 2.93$ )
	15	36.79 $\pm$ 1.11	39.01 $\pm$ 1.12 ( $\uparrow 2.22$ )
	25	35.37 $\pm$ 1.12	37.90 $\pm$ 1.01 ( $\uparrow 2.53$ )

Appendix

Table 25: Node classification performance (Accuracy

\pm

Std) under the non-targeted poisoning attack (Metattack) [ 101 ] . The improvements of the RGDM over the baseline are attached in parentheses.

Figure 5: Illustration of the augmented graph after adding the synthetic graph structures into the original graph on Cora. The RGDM is trained on Cora under Metattack with a perturbation rate of $25\%$ . The figure on the right illustrates the t-SNE visualization of the node features for both the real nodes in the original clean graph and the synthetic nodes. The figure on the left illustrates the 2-hop neighborhood of a real node and a synthetic node that have similar node features, evidenced by the t-SNE visualization in the augmented graph. It is observed that the synthetic node shares the same neighbors as the real node.

Dataset	Ptb (%)	GCN	Pro-GNN	SG-GSR
Cora	0	$1.7\pm 0.3$	$1.3\pm 0.3$	$0.4\pm 0.1$
Cora	15	$4.3\pm 0.5$	$1.9\pm 0.4$	$1.5\pm 0.3$
Cora	25	$13.9\pm 0.7$	$2.6\pm 0.4$	$1.3\pm 0.3$
Citeseer	15	$4.2\pm 0.5$	$1.7\pm 0.4$	$2.9\pm 0.4$
Citeseer	25	$5.9\pm 0.5$	$1.2\pm 0.3$	$2.6\pm 0.4$
Polblogs	15	$4.9\pm 0.5$	$2.0\pm 0.4$	$1.1\pm 0.3$

Appendix

Table 26: Reported Metattack mean gain

\pm

paired SD over

10

shared attack seeds (percentage points). Only rows with reported paired SD are included.

Dataset	Ptb (%)	RGDM (GCN)	RGDM (Pro-GNN)	RGDM (SG-GSR)
Cora	0	$\leq 0.042$	$\leq 0.027$	$\leq 0.016$
	5	0.038	0.024	0.013
	10	0.033	0.021	0.012
	15	$\leq 0.029$	$\leq 0.017$	$\leq 0.010$
	20	0.025	0.015	0.009
	25	$\leq 0.021$	$\leq 0.012$	$\leq 0.008$

Appendix

Table 27: Reported significance levels with each backbone fixed: Metattack. For rows with paired summaries in Table 26 ,

\leq

denotes a conservative upper threshold, not an exact p value reconstructed from rounded moments. Remaining entries are reported p values.

Dataset	Budget	RGDM (GCN)	RGDM (Pro-GNN)	RGDM (SG-GSR)
Cora	0	0.041	0.025	0.015
	1	0.036	0.023	0.011
	2	0.032	0.019	0.010
	3	0.027	0.016	0.008
	4	0.022	0.013	0.007
	5	0.019	0.011	0.006

Appendix

Table 28: Reported significance levels with each backbone fixed: Nettack. Continued from the preceding panel. Entries are the reported p values.

Dataset	Ptb (%)	RGDM (GCN)	RGDM (Pro-GNN)	RGDM (SG-GSR)
Cora	0	0.043	0.029	0.017
	5	0.039	0.025	0.012
	10	0.035	0.020	0.011
	15	0.030	0.018	0.009
	20	0.026	0.014	0.008
	25	0.022	0.012	0.007

Appendix

Table 29: Reported significance levels with each backbone fixed: Topology Attack. Continued from the preceding panel. Entries are the reported p values.

Method	Accuracy ( $\%$ )
Pro-GNN	69.7
RGDM (Purification)	71.0
RGDM (GDA)	72.3
RGDM (GDA + Purification)	72.9

Appendix

Table 30: Study on the effectiveness of graph purification and GDA by RGDM. The evaluation is conducted on Cora under Metattack with

25\%

perturbation rate.

Datasets	GDDM [ 27 ]	DiffSP [ 49 ]	RGDM (SG-GSR)	p-value
Cora	$77.2\pm 0.3$	$76.8\pm 0.5$	$\textbf{79.1}\pm\textbf{1.6}$	$0.0022$
Citeseer	$71.6\pm 0.5$	$71.8\pm 0.2$	$\textbf{75.3}\pm\textbf{1.0}$	$0.0012$
Polblogs	$84.8\pm 0.8$	$85.6\pm 0.5$	$\textbf{88.8}\pm\textbf{1.8}$	$0.0004$
Pubmed	$85.9\pm 0.6$	$86.8\pm 0.4$	$\textbf{88.6}\pm\textbf{1.3}$	$0.0017$

Appendix

Table 31: Comparison of classification accuracy (

\pm

Std) and p-values across different datasets between RGDM and diffusion-based graph purification methods.

$\#$ Synthetic Nodes ( $\times\left\|{\cal V}_{L}\right\|$ )	1	2	3	4	5	6	7	8	9	10
Accuracy (%)	70.5	71.0	71.9	72.2	72.3	72.1	72.0	71.7	71.4	71.2

Appendix

Table 32: Performance of RGDM (Pro-GNN) under Metattack with varying numbers of synthetic nodes. The perturbation rate is

25\%

Method	Accuracy ( $\%$ )
Pro-GNN	69.7
DDPM (Pro-GNN)	68.2
RGDM (Pro-GNN)	72.3

Appendix

Table 33: Performance comparison of Pro-GNN on augmented graph with synthetic graph structures generated by DDPM and RGDM. The study is performed on Cora under Metattack with a perturbation rate of

25\%

Label Ratio	2.5%	5%	7.5%	10%	20%	40%	60%
Pro-GNN	62.5	65.6	67.5	69.7	73.8	75.2	76.6
RGDM (Pro-GNN)	64.8	68.0	69.3	72.3	75.9	77.6	78.4

Appendix

Table 34: Performance comparison of Pro-GNN and RGDM (Pro-GNN) under different label ratios on Cora under

25\%

Metattack.

Dataset	Cora	Citeseer	Polblogs	Pubmed
RGDM (HGAE from LR-FGDM)	76.8	72.5	86.7	86.0
RGDM (BLND)	77.4	73.1	87.2	86.6
RGDM	79.1	75.3	88.8	88.6

Appendix

Table 35: Hierarchical reconstruction comparison: SHED, BLND from DoG [ 74 ] , and the HGAE variant from LR-FGDM [ 75 ] . SG-GSR is used as the base GNN under Metattack with

25\%

perturbation.

Dataset	SG-GSR	RGDM (SG-GSR)	$p$ -value
Cora	$74.8\pm 2.4$	$\textbf{77.8}\pm\textbf{1.8}$	$0.006$
Citeseer	$69.5\pm 2.6$	$\textbf{73.4}\pm\textbf{2.1}$	$0.003$
Polblogs	$84.7\pm 2.5$	$\textbf{87.6}\pm\textbf{2.2}$	$0.008$
Pubmed	$84.9\pm 2.7$	$\textbf{87.2}\pm\textbf{2.4}$	$0.012$

Appendix

Table 36: Adaptive attack evaluation under Metattack [ 101 ] with

25\%

perturbation rate. The adaptive attacker is aware of the defense and attacks the final augmented graph used for training SG-GSR. The

p

-values are computed between SG-GSR and RGDM (SG-GSR).

Dataset	SG-GSR	RGDM (SG-GSR)	Gain (points)
Cora	74.5	76.9	2.4
Citeseer	69.2	72.4	3.2
Polblogs	84.4	86.6	2.2
Pubmed	84.6	86.3	1.7

Appendix

Table 37: Adaptive Metattack differentiating through the relaxed edge selection mask with the same absolute edge flip budget and

\tau=0.5

. Mean accuracy (%).

Graph Diffusion

Graph diffusion studies how information or probability spreads over graph structure for learning, analysis, and generation.

See all 77 papers

Contrastive Adversarial Training for Robust Graph Neural Networks under Label Poisoning
Oct 17, 2026Manshika Charvi Bissessur, Melis Ilayda Bal, Michael MuehlebachGraph Neural Networks Robust Classification
University of Oxford · Max Planck Institute for Intelligent Systems, Tübingen, Germany · LIONS – École Polytechnique Fédérale de Lausanne +1
Self-supervised Adversarial Purification for Graph Neural Networks
May 22, 2026Woohyun Lee, Hogun ParkGraph Neural Networks Adversarial Robustness
Department of Computer Science and Engineering, Sungkyunkwan University, Suwon, South Korea.
AdvSynGNN: Structure-Adaptive Graph Neural Nets via Adversarial Synthesis and Self-Corrective Propagation
Feb 19, 2026Rong Fu, Chunlei Meng, Shuo Yin +2Graph Neural Networks Graph Structure Learning
Independent Researcher

Oct 17, 2026J/K move · Enter open · S save

Contrastive Adversarial Training for Robust Graph Neural Networks under Label Poisoning

Manshika Charvi Bissessur, Melis Ilayda Bal, Michael Muehlebach

University of Oxford · Max Planck Institute for Intelligent Systems, Tübingen, Germany · LIONS – École Polytechnique Fédérale de Lausanne+1

Graph Neural Networks Robust Classification Adversarial Training

Open paper AskPDF arXiv

Graph Neural Networks (GNNs) are effective for modeling relational data but are vulnerable to label poisoning, where a small number of corrupted training labels can propagate errors across the graph via message passing. Despite this risk, defenses against label poisoning remain underexplored: existing methods are primarily designed for label noise and often rely on robust losses or heuristic data cleaning that fail to distinguish adversarial poisoning from naturally hard examples. In this paper, we propose CoLAT (Contrastive Label-flipping for Adversarial Training), a novel contrastive adversarial training framework tailored for robust node classification on graphs. The core of our approach is a structure-aware detection model that uses contrastive learning to identify label-structure inconsistencies. Unlike prior contrastive methods that focus on representation learning, CoLAT leverages contrastive embeddings to select high-risk nodes that guide adversarial label-flipping during training. This alternating optimization not only performs structure-aware adversarial training but also implicitly sanitizes some corrupted labels, improving robustness against diverse attacks from the literature. Extensive experiments on multiple benchmarks show that CoLAT consistently outperforms existing defenses under various poisoning intensities while scaling efficiently to large graphs.

Dataset	Ptb Rate (%)	RGDM (GCN)	RGDM (SG-GSR)	RGDM (Pro-GNN)
Cora	0	$2\times\left\|{\cal V}_{L}\right\|$	$1\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$
	5	$2\times\left\|{\cal V}_{L}\right\|$	$1\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$
	10	$2\times\left\|{\cal V}_{L}\right\|$	$1\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$
	15	$3\times\left\|{\cal V}_{L}\right\|$	$1\times\left\|{\cal V}_{L}\right\|$	$3\times\left\|{\cal V}_{L}\right\|$
	20	$3\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$	$3\times\left\|{\cal V}_{L}\right\|$
	25	$5\times\left\|{\cal V}_{L}\right\|$	$5\times\left\|{\cal V}_{L}\right\|$	$5\times\left\|{\cal V}_{L}\right\|$

Dataset	Attack Budget	RGDM (GCN)	RGDM (SG-GSR)	RGDM (Pro-GNN)
Cora	0	$2\times\left\|{\cal V}_{L}\right\|$	$1\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$
	1	$3\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$
	2	$3\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$
	3	$3\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$	$3\times\left\|{\cal V}_{L}\right\|$
	4	$3\times\left\|{\cal V}_{L}\right\|$	$3\times\left\|{\cal V}_{L}\right\|$	$3\times\left\|{\cal V}_{L}\right\|$
	5	$4\times\left\|{\cal V}_{L}\right\|$	$3\times\left\|{\cal V}_{L}\right\|$	$3\times\left\|{\cal V}_{L}\right\|$

Dataset	Ptb Rate (%)	RGDM (GCN)	RGDM (SG-GSR)	RGDM (Pro-GNN)
Cora	0	$1\times\left\|{\cal V}_{L}\right\|$	$1\times\left\|{\cal V}_{L}\right\|$	$1\times\left\|{\cal V}_{L}\right\|$
	5	$1\times\left\|{\cal V}_{L}\right\|$	$1\times\left\|{\cal V}_{L}\right\|$	$1\times\left\|{\cal V}_{L}\right\|$
	10	$2\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$
	15	$2\times\left\|{\cal V}_{L}\right\|$	$1\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$
	20	$2\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$	$3\times\left\|{\cal V}_{L}\right\|$
	25	$2\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$	$2\times\left\|{\cal V}_{L}\right\|$

Abstract

Graph Diffusion

Explore similar work

Contrastive Adversarial Training for Robust Graph Neural Networks under Label Poisoning

Self-supervised Adversarial Purification for Graph Neural Networks

AdvSynGNN: Structure-Adaptive Graph Neural Nets via Adversarial Synthesis and Self-Corrective Propagation