Robustness in Text-Attributed Graph Learning: Insights, Trade-offs, and New Defenses
Authors: Runlin Lei
Lu Yi
Mingguo He
Pengyu Qiu
Zhewei Wei
Yongchao Liu
Chuntao Hong
Venue: ICLR 2026 Poster (2026)
Keywords: Graph Robustness
Graph Adversarial Attack
Text Attributed Graph
Large Language Model
Primary area: learning on graphs and other geometries & topologies
TL;DR: We propose a comprehensive evaluation of the robustness of predictors on text-attributed graphs.

Abstract: While Graph Neural Networks (GNNs) and Large Language Models (LLMs) are powerful approaches for learning on Text-Attributed Graphs (TAGs), a comprehensive understanding of their robustness remains elusive. 
Current evaluations are fragmented, failing to systematically investigate the distinct effects of textual and structural perturbations across diverse models and attack scenarios.
To address these limitations, we introduce a unified and comprehensive framework to evaluate robustness in TAG learning. 
Our framework evaluates classical GNNs, robust GNNs (RGNNs), and GraphLLMs across ten datasets from four domains, under diverse text-based, structure-based, and hybrid perturbations in both poisoning and evasion scenarios. 
Our extensive analysis reveals multiple findings, among which three are particularly noteworthy: 1) models have inherent robustness trade-offs between text and structure, 2) the performance of GNNs and RGNNs depends heavily on the text encoder and attack type, and 3) GraphLLMs are particularly vulnerable to training data corruption.
To overcome the identified trade-offs, we introduce SFT-auto, a novel framework that delivers superior and balanced robustness against both textual and structural attacks within a single model. 
Our work establishes a foundation for future research on TAG security and offers practical solutions for robust TAG learning in adversarial environments.
Our code is available at: https://github.com/Leirunlin/TGRB.

Published as a conference paper at ICLR 2026
ROBUSTNESS IN TEXT-ATTRIBUTED GRAPH LEARN- ING: INSIGHTS, TRADE-OFFS, AND NEW DEFENSES
Runlin Lei" Lu Yi!
Mingguo He
Pengyu Qiu
Zhewei Wei
Yongchao Liu
Chuntao Hong
'Remmin University China "National University of Singapore
3 Ant Group
{runlin lei, yilu, zheweiferuc. edu. en, minggucenus. edu sg (pengyu. gpy, yongchan. lyy, chuntao hot) @entggoup.ccooooo com
ABSTRACT
While Graph Neural Networks (GNNs) and Large Language Models (LLMs) are powerful approaches for learning Text-Attribueed Graphs (TAGs), compre- hensive understanding of their robustness remains elusive. Current evaluations are fragmented, failing to systematically investigate the distinct effects of textual and structural perturbations across diverse models and attack scenarios. To ad- dress these limitations, we introduce unified and comprehensive framework evaluate robustness in TAG learning. Our framework evaluates classical GNNs, robust GNNs (RGNNs), and GraphI.LMS across ten datasets from four domains, under diverse text-based, structure-based and hybrid perturbations in both poison- ing and evasion scenarios. Our extensive analysis reveals multiple findings, among which three are particularly noteworthy: 1) models have inherent robustness trade- offs between text and structure, 2) the performance of GNNs and RGNNs depends heavily on the text encoder and attack type, and 3) GraphLLMs are particularly vulnerable to training data corruption. To overcome the identified trade-off', we introduce SFT-auto, a novel framework that delivers superior and balanced robust- ness against both textual and structural attacks within a single model. Our work establishes a foundation for future research on TAG security and offers practical solutions for robust TAG learning in adversarial environments. Our code is avail- able at: https::///tthii thu.ttthub.coom com Le www.ieiiirnnnnaaam
INTRODUCTION
Text-attributed graphs (TAGs), which integrate structural links with rich text features, are founda- tional to applications from social networks to citation graphs (Wu al., 2023 Wang et al. 2025a). While Graph Neural Networks (GNNs) have long been the prevailing approach for learning on TAGs, Graph Large Language Models (GraphLLMs) are emerging as a compelling paradigm, lever- aging their advanced reasoning capabilities directly on graph-structure text. However, the robust- ness of these models remains a critical challenge. For instance, in high-stakes domains such as social and financial networks, adversaries can manipulate both graph structures and textual content, sig- nificantly degrading model performance. For example, adversaries can deploy deceptive social bots with engineered biographies and network patterns to influence public opinion (Wang et al. 2023). Similarly, in recommendation systems, attackers may craft fake user profiles with misleading textual attributes promote targeted items (Nguyen et al. 2024). This dual vulnerability makes uniquely difficult to secure TAG learning.
Despite its importance, existing robustness analyses remain fragmented. Early analyses of GNNs and Robust GNNs (RGNNs) relied on naive embeddings, largely overlooking the rich semantic information in natural language (Zheng al.) 202T). Conversely, recent attempts start explorations of the robustness of GraphLLMs, yet lack comprehensive comparisons among model families and
"Zhewei Wei and Yongchao Liu the Corresponding authors.

---

Published as a conference paper at ICLR 2026
Train
Data
X Attack Type
Strueture
Text
Hybrid
This peet and
Cors, CiteSeer, PubMed,
WiKICS
History, Instagram,
Computer
Reddit
Settings
Transductive Poisoning
Inductive Evasion
Trunsfer
Adaptixe
delenar's
deieder's wode
euedy
Tralning Inference
Training
Infeeence
Defense Model
SFT-auto (ours)
Classic GNNs
Robust
Lss
Robust GraphLLMs
O Delection
Trabiing with mudee
Stedlurkt Fllwling
Recorvery
Recmerry Fltee
Final
Fall against either structural textual attack
Work under structural attack
Figure 1: The overall framework for evaluating the robustness of TAG learning.
focus exclusively on limited attack settings (Guo al. 2024a Zhang et al. 2025a). This fragmented landscape has left the field without comprehensive analysis of robust TAG learning.
To address this critical void, we perform large-scale, systematic robustness analysis on TAGs. The overall framework is provided in Figure Our evaluation spans ten datasets across four domains and wide spectrum models, including classical GNNs, RGNNs, and GraphLLMs. By subjecting these models to unified threat model, provide unified evaluation methodology that serves foundation for understanding model vulnerabilities across diverse architectures and attack settings.
The extensive evaluation yields series of empirical insights: 1) robustness trade-off, where models excel at defending against either textual or structural attacks but not both simultaneously. 2) We find that previously underrated methods, such GNNGuard (Zhang) & Zitnik 2020), achieve surprising performance when re-evaluated in TAG settings with advanced text encoders. 3) GraphLLMs demonstrate higher vulnerability to poisoning attacks compared to GNNs. Specifically, when the training data is compromised, GraphLLMs experience a more signif- icant decline in performance than GNNs. Directly integrating existing robust GNN designs into LLM architectures fails to resolve the fundamental robustness trade-off.
We uncover crucial text-structure
Motivated by the proven effectiveness of noise-injection (Ennadir et al. 2024) and similarity- filtering strategies (Zhang & Zitnik 20200 Hou et al., (024) in RGNNs, we explore their adapta- tion GraphLLMMs to address the text-structure trade-off. While these variants show effectiveness against either textual or structural perturbations individually, they still struggle to achieve balanced robustness against both types of attacks. achieve balanced robustness against both attacks, we propose novel SFT (supervised fine-tuning) framework, SFT-auto, which employs multi task train- ing with detection preeccctionnniittionn pipeline. This approach leverages the superior reasoning capabilities of LLMs to detect anomalies and make predictions within a single model. Our experiment results show that SFT-auto exhibits superior robustness in both modalities compared to the baselines.
To summarize, main contributions
follows:
Comprehensive Evaluation Framework. We propose a systematic robustness evaluation for learning in TAGs that benchmarks a wide spectrum of models, from classical GNNs, RGNNs, to GraphLLMs, against a diverse set of textual and structural attacks.
Abundant Empirical Insights. Our large-scale analysis reveals critical vulnerabilities and trade- offs in robust TAG learning. We uncover text-structure robustness trade-off. find that simple RGNNs with advanced text encoders can be surprisingly effective, and demonstrate the vulnera- bility of GraphLLMM LLMs poisoning attacks.
2

---

Published as a conference paper at ICLR 2026
An Effective Defense Framework. To overcome the identified trade-off, we propose the SFT- auto model. It leverages the reasoning capabilities of LLMs to achieve superior and balanced robustness against both textual and structural attacks.
PRELIMINARIES: BACKGROUND AND EVALUATION PROTOCOL
2.1 BACKGROUND
We define a TAG G EV, (8:) where V is the set of nodes, & is the set of edges, and N is the number of nodes. The adjacency matrix is A E {0, 1) 1|NNN, with each node E V associated with sequential text 8;. Following prior work on graph adversarial learning (Tin et al., 2021| Zheng et al. 2 we focus on the task of node classification, where the goal is to assign each node one of C' possible class labels. Denote the label vector as y E .o..... C-1j%M the learning objective is to predict labels of target nodes Ytarget, given G and ground-truth labels Ytrain In the transductive setting, all nodes are observed during training, while the inductive setting, the model is required to generalize to previously unseen test nodes. Existing methods for TAG node classification include GNNs and GraphLLMs, denoted as model f({s;); A). For GNNs, the model f first employs text encoder to transform each 8; into a node-level feature matrix X, and then processed jointly with the adjacency matrix A. In contrast, some of the GraphL.MMs directly input the raw node texts {s: into the model f and perform classification via prompt instructions.
Graph Adversarial Attacks and Defenses. In adversarial settings, an attacker seeks to degrade the performance of the defender's model on target of nodes Varget. A typical graph attack is the Graph Modification Attack (GMA) (Zügner & Günnemann 2019 Xu et al. 2019), which perturbs either the graph structure or the node texts. The objective GMA is:
N Σ
min A Acc Aco(fo((s()) A'), Yunga), s.t.lAA - Allo I struct and
1s
si
S
lests
where A' denotes the perturbed adjacency matrix, {s]) represents the perturbed node texts, Ace(-) is the evaluation metric (e.g., accuracy) on the target nodes Virrget and Astret and A are the budget the total number of perturbations. Specifically, ||A' Allo measures the number of edge modifications (additions or deletions), and Σ {s * $t} counts the number of nodes with modified texts. Besides GMA, other paradigms targeting TAGs include Text-level Graph Injection Attacks (Text-GIAs), where new adversarial textual nodes are introduced into the graph, forming harmful connections to existing nodes (Lei al. 2024).
Attacks can be categorized by their timing: poisoning attacks modify the training data to compro- mise the learned model, while evasion attacks alter test inputs fool fixed model at inference time. For the defender, the key objective to maintain high performance even when the data may be under attack. Efforts have been made via RGNN design (Jin al. 2021) and LIM graph data purifiers (Zhang et al. 2025b).
Table 1: Comparisons between evaluations of robustness in TAG learning.
Benchmark
Data
Raselines
Fvalution
Num. Dommins
GNNs
RGNNs
GraphL.LMs
Amaack Types
Setings
Analysis
Encoder Adaptive
GRB (Zcce 2023
GIA
Evasion Inductive
Goscife
2023
GMA
Evasion Both
Cho
GMA-TTsi
Evasion Tranductive
TrunfiL
Erasios Transuctivve
Olatong
GMA-Test
Both Transluctive
GMA+Tests Text-GIA
All
2.2 EVALUATION PROTOCOL
Extensive evaluations of robustness in TAG learning have been developed. However, their analy- ses are limited, particularly with respect to data, baselines, and evaluation settings. As shown in Table T. in terms of data, previous works suffer from limited dataset diversity and narrow domain
3

---

Published as a conference paper at ICLR 2026
coverage. with some focusing exclusively on specific graph types application domains. Regarding baselines, no previous work has achieved comprehensive integration of all three major graph learn- ing paradigms (GNNs, RGNNs, and GraphLLMs), resulting in fragmented evaluation landscapes. Finally, evaluation settings in existing evaluations are often constrained by limited attack diversity.
To address these limitations, we include: (1) extensive dataset diversity spanning multiple do- mains and graph types; (2) a unified comparison supporting major baseline categories (GNNs, RGNNs, GraphLLMs): and (3) extensive evaluation settings with comprehensive metrics. The de- tailed design of the evaluation follows the principles below:
Deploy sufficiently strong attacks. We found that some attacks, such as Mettack (Zügner & Günnemann] 2019) and word-level textual attacks, don't generate sufficiently strong attacks or have poor transferability. Yet, weak perturbations fail differentiate defense models, as per- formance rankings become dominated by clean accuracy rather than adversarial resilience (see Appendix D.4). Therefore, we employ more effective attacks with sufficiently high perturbation ratio in the main paper to ensure higher degree of differentiation. Results with smaller ratios are deferred to Appendix J.4
Ensure fair baseline comparison. We restrict evaluation models with comparable clean per- formance to prevent stronger backhones from appearing artificially robust. Methods like Instruct- GLM, GPT zero-shot, and GraphPrompt in (Guo et al. [2024]] Zhang et al. [225a Olatunji al.) 2025)
significantly underperform supervised baselines, invalidating robustness comparisons. Fol- lowing established practices (Hou et al., 2024 [u al., 2025 Wang et al. (0255), we select competitive GNNs, RGNNs, and GraphL as baselines. The baselines are summarized in
Table
The details of each baseline are provided in Appendix
E
Adopt realistic evaluation protocols. Prior benchmarks employ misaligned settings that compro- mise validity. As stated in (Gosch et al. 2023), poisoning attacks naturally pair with transductive learning. while evasion attacks suit inductive evaluation. Protocol misalignments enable trivial nnemorization-basel defenses, undermining meaningful assessment. We strictly align attack types with appropriate learning paradigms across all experimental phases.
Data. We evaluate on ten datasets spanning four distinct domains following the LLMNodeBed benchmark (Wu al. 2025): academic networks (Cora (Sen al. 2008), CiteSeer (Giles et al., 1998). PubMed (Yang et al.) 2016), ArXiv (Hu et al.) (0200). web links (WikiCS (Mernyei & Cangea 2020 social networks (Instagram, Reddit (Huang et al. (0244), and e-commerce (His- lory, Photo, Computer (Yan et al.] 2023)). We adopt supervised 60/20/20 split across training/- validation/testing for the inductive setting and supervipe 10/10/80 split for the transductive setting. All datasets are undirected graphs. Details of datasets are provided in Appendix C
Threat Model. Our evaluation assesses perturbations the graph structure, node texts, and also includes results against Text-GIAs (in Appendix (F). We evaluate both poisoning attacks and evasion attacks. Our primary focus is on transfer attacks where the attacker has access to the victim's 's data but not their model directly. The perturbed graph is then transferred to test the defender's 's model, simulating a practical scenario where defenders can deploy their custom defense model. The spe- cific attack configurations are detailed in the subsequent experimental sections, with comprehensive details provided in Appendix D
We also explore adaptive attacks in Appendix
Other Setups. We employ accuracy as the evaluation metric. Hyperparameters for all GNNs and RGNNs are optimized based on validation set performance. Following LLMNodeBed (Wul et al. 2025), adopt RoBERTa (Liu al.) 2019) the text encoder for GNN-based methods and Mistral-7B (Jiang et al.) (023) as the backbone for GraphL.LMs. as these configurations yield opti- mal performance. All experiments are conducted across three independent runs with random data splits, except for ArXiv, which uses a single official split.
EVALUATION RESULTS
In this section, we present evaluation results against structural and textual attacks. Due to space lim- itations, report the average rank, which is derived for each method by averaging its ranks across
We move the evaluation of specific variants like GOOD-AT, GPR-GAF, and GPRGNN-AT to Appendix K These supplementary results serve as extended verification of core findings.
4

---

Published as a conference paper at ICLR 2026
Table 2: Categorization of selected defense models.
Taxonomy
Subcategory
Selected Defenses/ Models
Spatial Message passing Spectral
GCN (Kipf & Welling, 2017 GAT (Velickovic et al. 2018
Basic models
APPNP KKippera al, 2019). GPRGNN (Ciinn (Chen
al 2021
Improving training
Robust training
GRAND (Fnng et al. 2020 NoisyGCN (Fanadir et al. 2024
Adversarial Truining Gosch et 2023
Probabilistic
RobustGCN (Zuu al.
|010) 2019]
Similarity- Robust aggregation
GNNGuard (Zhang & 71tmi 2020
Improving architecture
ElasticGNN [Lii ct al. SottedianGDDC Geisler ct al.
2021 RUNG (Hou
2024
Others
EvenNet (Lei et [022] (Spectral). GCORN Abbahaddou et al. 2024
(Weight Regularization),
Unsupervised
Jaccard-GCN et 2019. Cosine-GCN Mujkanovic 2022
Improving structure
Supervised
ProGNN (Tin al 2020),
Stahle (Li et 2022h GOOD-AT
al 20244 GAE Lee & Park 12025
GraphI.I.Ms
Instruction Tuning & Align GraphGPT Tang all [024). SFT (w/ nei.) (Wang al.
2025b LLaGA (Chen et al. 2024
all datasets where it has valid results, with full numerical results available in Appendix P We adopt bank-based evaluation because averaging raw accuracies across datasets can misleading due to scale differences, missing results large-scale graphs, and strong dependence on clean accuracy. Ranking provides a normalized, dataset-agnostic comparison that offers a clearer comparison. Sim- ilarly, the results about hybrid and adaptive attacks deferred to Appendix Fandd
For structural attacks, in the inductive and evasion settings, we employ PGD (Xu et al. 2019) for small-scale datasets and GRBCD (Geisler al. 202T) for larger ones with perturbation ratio of 0.20. We use GCN (Kipf & Welling 2017) as the surrogate model with BoW embeddings to generate victim graphs, and use the generated graphs as the test victim graphs. For transductive structural attacks, we adopt HcuristicAttack (Li et al. (023) with perturbation ratio of 0.30, and exclude Computer and ArXiv due to scalability issues.
We evaluate performance against textual attacks using a novel LLM-based attack. For evasion at- tacks, we substitute 40% of the test set nodes with LLM-generated text that differs from the original content. For poisoning attacks, we replace 80% of the training set nodes. Attack algorithm details are provided Section [ Due to scalability concerns, we exclude the Computer and ArXiv datasets for evasion attacks, and additionally exclude the Photo dataset for poisoning attacks. We do not use gradient-based or unnoticeable word-level textual attacks, as these methods have been shown to have poor transferability across different models, as discussed in Appendix D.4
3.1 AGAINST STRUCTURAL ATTACKS
&
The results against structural attacks are shown in Figure
(Lower Left Better
[Lewer Laft Better)
NeleyGCN BetursCN PORN
16
Joccard OCN
RebuetOCy
14
Bastlig
GraphLLMs show Inherent Ro- bustness against Non-adaptive Inductive/Evasion Attacks. Even without defense mechanisms, SFT-neighbor outperforms most RGNNs. GraphGPT, which also employs instruction tuning, exhibits comparable strong performance, reflecting GraphLLM's superior robustness against structural attacks. Notably, LLaGA shows relatively weaker robustness despite being a GraphLLM. Although LLaGA surpasses GraphGPT in clean perfor-
10
12.
GRAND
Drop Pank
Drop Pank
sriggoo GCN
GRAND
APPNP
S00melonsCC cPacKN
de Dunniet
Cosine -CN
PGraphger
AFfee Crarouurd
RuNe "oveCurrd
Evmmiet
10.0 Performance
Performance
Figure Comparison of robustness against structural at- tacks. Ranks are averaged across datasets (excluding fail- ures) based on: 1) absolute accuracy under attack (lower rank is better), and 2) relative accuracy drop from the clean baseline (lower drop rank is better).
5

---

Published as a conference paper at ICLR 2026
mance, it proves more vulnerable to structural attacks. This suggests that alignment- methods, which explicitly utilize graph embeddings to align graph and text spaces, are more susceptible to structural attacks (similar to GCNs), while instruction-tunin suttinnntunnnggggn models adopt more conservative neighbor utilization strategies.
Simple Methods Can Shine in TAGs through Advanced Text Encoders. Despite their simplic- ity, RGNNS from earlier research can deliver surprisingly strong performance when re-evaluated in TAGS. For instance, GNNGuard, as an early and straightforward RGNN that leverages threshold- based filtering to defend against adversarial attacks, achieves top-tier performance against the in- ductive/evasion attacks. This contrast stems from prior works that have overlooked the importance of text embeddings and have only evaluated RGNNs on shallow embeddings, such as BoW or TF- IDF (Lei et al., 2022 Hou et al., 2024). the context of TAGs, methods like GNNGuard can be revitalized to achieve near-SOTA robustness. A detailed analysis is provided in Appendix G
In fact, by fully harnessing textual features through dataset- and gaabedding-speciinn filtering, we can do even better. In Appendix G.3 we propose Guardual, novel extension that eliminates the reliance of GNNGuard on threshold hyperparameters. The results show that Guardual's 's adaptive filtering mechanism makes it the leading RGNN in the structural evasion setting. These findings underscore that strategic text processing in TAGs fundamentally drives RGNN performance.
Spectral GNNs Show Superior Robustness against Poisoning Structural Attacks. As shown in Figure 2 (right), spectral methods, such as EvenNet, APPNP, and GPRGNN, demonstrate superior performance against poisoning attacks in the transductive setting. This phenomenon complements the findings of Gosch et al. (2023) in the evasion/raansductive setting, where the robust diffusion process in spectral methods enables flexible use of whole higher-order neighborhoods, thereby en- hancing robustness. Structure learning methods, such as ProGNN, also exhibit promising results, though their computational overhead remains a significant practical limitation. In contrast, the per- formance of GraphLLMs starts to decline. While SFT-neighhor is robust against evasion attacks, the perturbations introduced during training result in notable performance drop. Among GraphLLMs, LLaGA remains the most vulnerable due to its greater reliance on structure.
3.2 AGAINST TEXTUAL ATTACKS
Inductive & Bassion
Transductive & Paisoning
The results against textual attacks are shown in Figure 3
14
R
GPRGNN
Ua
Baselines. When confronting textual attacks in the evasion setting, the relative robustness rankings undergo a notable shift. While methods like GNNGuard and RUNG demonstrate superior performance against struc- tural attacks, as shown in Figure 2 they exhibit pronounced vulner- abilities to textual perturbations. SFT-neighbor and GraphGPT also suffer from significant performance degradation. In contrast, even naive models, such as GCN and GAT, exhibit the desired robustness against these textual attacks.
Simple GNNs Excel Advanced
Drop Pank
12
SIT-neigterr
Seit RedwnnDC
Drop Rank
14
GWV
Centest
GRAND
EasticóNn GroskarT
10
APP amagen
Jacrant-GEN
GOORN
Seaale
LLNGA
Evertie
oCORN
ReteyGeN Rosessach
4
23
5.0
10.0
12.3 15.0
10
15
Performance Rank
Performence Rank
Figure 3: Comparison of robustness against textual at- tacks. Ranks are averaged across datasets (excluding fail- ures) based on: 1) absolute accuracy under attack (lower rank is better), and 2) relative accuracy drop from the clean baseline (lower drop rank is better).
GraphLLMs Struggle Against Textual Poisoning. For poisoning attacks, both GNNs and RGNNS exhibit remarkable robustness. Even when 80% of the training nodes' text is replaced, GNNs can still benefit from the transductive learning paradigm and achieve accurate predictions by aggregating information from nodes" neighbors. Under text poisoning attacks, LLM-based methods experience a significant decline in performance. For example, on the CiteSeer dataset, SFT-neighbor's 's ac- curacy drops by 25%, while most GNNs suffer only 5%%10% decrease (sce Tables 39 and 45 for detailed accuracy). This suggests that GraphLLMs are more vulnerable to perturbations in the training set, relying heavily on high-quality training text to maintain strong performance.

---

Published as a conference paper at ICLR 2026
4 THE TEXT-STRUCTURE TRADE-OFF
In Section we found that in the inductive/evasion setting, the structurally robust models fail against textual attacks (e.g.. GNNGuard, SFT-neighbor); and vice versa (e.g., NoisyGCN), Building on this, we now explore how vulnerabilities one dimension relate to the other.
Drop Rankings (1=smallest drop)
variants
100
0
Claan Parfomancc
90-
85-
79.7%
Siftine glbar
#7.55 17.5%
85
Gotme ande- Inctytter
80-
D0.
Text Drop Ranking
GRAND
Computer
Grashart
beteGlt
Structure Vulnerability
20.0%
Sesttont
Poftemmnnee motemmmoooo Drop
SFTautoo
11.2%
8.2%
GAT
1.7% 0.6%
0.4%
10 12
PubMedd
Computer
Structure Drop Ranking
Figure 4: The text-structure robustness trade-off. (Left) SFT-auto uniquely balances this trade-off, while baseline models are polarized towards either text structure robustness. (Right) On text- friendly datasets (e.g., PubMed), models are less reliant on structure and thus less vulnerable to its perturbation. The opposite holds for structure-critical datasets (e.g.. Computer, Photo).
Architecture Effect. As shown in Figure 4 (Left), models with different architectures exhibit clear text-structure robustness trade-off. Structure-orienter architectures such as LLaGA and vanilla GNNs are highly vulnerable structural perturbations yet remain comparatively stable under textual attacks. By contrast, text-oriented models like SFT-neighbor and GraphGPT, as well as RGNNs designed to enhance structural robustness, show strong resistance to structural attacks but collapse under textual ones. These comparisons highlight the inherent bias of different backbones: classifiers are generally robust to either structure or text perturbations, but rarely to both.
Dataset Effect. Dataset characteristics critically shape the text-structure trade-off. As shown in S the benefit neighbor information differs markedly across datasets, directly im- pacting vulnerability, In the top-right panel, SFT variants gain substantial accuracy from neighbors on structure-critical datasets such as Computer/Phoo PubMed. This reliance pattern explains the robustness outcomes in the bottom-right panel: mod- els relatively resistant to structural perturbations (e.g.. GPRGNN, GraphGPT, SFT-neighbor) expe- rience only minor drops text-friendly datasets, yet still suffer significantly structure-critical ones. Thus, while the trade-off is influenced by model design, its manifestation heavily depends on the nature the datasets.
but little on text-friendly datasets like
5 ADDRESSING THE TEXT-STRUCTURE ROBUSTNESS TRADE-OFF
The text-structure trade-off remains a key challenge, with no current model effectively balancing both aspects. In this section, explore methods to overcome this limitation.
5.1 ATTEMPTS BY BUILDING ROBUST GRAPHLLMS
To address the text-structure trade-off, we explore noise-injection and soaillarty-filterrm strategies inspired by existing RGNNs, adapting them for GraphLLMs.
Noise-Injection Methods. Drawing inspiration from GRAND (Fnng et al. 2020 and
NoisyGCN (Ennadir et al.) 2024), inject targeted perturbations during training to reduce the distribution gap between training and adversarial test conditions. We implement three variants: -noi se (structural noise injection), -noisetxt (textual noise injection), and -noisefull

---

Published as a conference paper at ICLR 2026
(combined noise types). All methods use 10% noise ratio. GraphGPP-noisettx and GraphGPT- noisefull are neglected due to poor clean performance.
Figure 5 demonstrates that targeted noise injection provides defense against corresponding attack types. The -noise variant helps improve structure robustness, while -noisetx helps improve textual robustness. However, when the attack type is unknown, significant trade-offs emerge. No- tably, -no se full fails to achieve simultaneous defense against both attack types. None of the variants shows better results against both attacks. This limitation restricts noise-injection methods to specialized defenses for specific types of attacks.
Similarity-Filtering Methods. Inspired by the similarity-filtrring strategy of GNNGuard, we propose two variants: -simf, which em- ploys edge filtering similar to GNNGuard, and -simp. which modifies the SFT prompt to neighbor-
Robustnass Enhancement Mathods: Performance vs Base GraphLLMa
Woree Twxt
Batter
Thatt Attack Defense Improvemeett (%)
SFFnokebd
SFT-auto
LLakkrnokefffl
guide adaptive celiance-leveragiinn hood information when text is unreliable and depending on textual content when structure is compromised. Figure reeveals that -simf ex- hibits behavior analogous to GNNGuard, pro- viding effective defense against structural at- tacks but remaining vulnerable to text-based perturbations. In contrast, s simp yields mod- est robustness improvements without signifi- cant performance gains. This suggests that sim- ple instruction modifications are insufficient for LLMs to learn effective defenses that break the identified trade-off and learn effective defenses.
SPY-simp
LLadArookatet
SPTaimi
LLa0Asimm
Better Struct
Both
Structure Attack Defense Improvement
Figure 5: Performance of robust variants against base GraphLLMs. Points represent improvements over base models against structural (X-axis) and textual (y-axis) evasion attacks.
5.2 AUTO FRAMEWORK FOR ADVERSARIAL. ATTACK DETECTION AND RECOVERY
The preliminary attempts highlight the fundamental challenge of achieving balanced robustness against both types of attacks. As solution, we propose SFT-auto, o, a novel model that leverages the reasoning abilities of LLMs to defend against both textual and structural adversarial attacks.
Training. The training phase employs principled data augmentation strategy to endow the model with attack recognition and recovery capabilities. We use an adaptive attack ratio r min(1/[C], 0.15) to ensure balanced detection across datasets with varying class distributions. Train- ing data comprises three distinct types: Normal samples (Snormat) preserve original node-neighbor pairs to maintain standard classification ability; Attack samples (Samack) contain nodes with text de- liberately replaced by content from different-class nodes, labeled as "text_attacked to teach attack recognition; and Recovery samples (Stecovery) ) remove center text entirely, compelling the model to leverage neighbor information for robust prediction. This training paradigm enables the LLM to handle (IC) + cllcss attack detection and -Cl-slass recovery tasks through specialized prompts.
The inference phase implements a three-stage adaptive pipeline that dynamically re- sponds detected attack patterns. Stage 1: Attack Detection: The LLM identifies text-attacked nodes through an extended (IC) + -)ddimensional classification space, while structure attacks are detected via embedding-basee based similarity analysis. Nodes exhibiting low cosine similarity (< 0.5) to over half their neighbors are flagged as structure-attacked. Text attack detection takes precedence to prevent redundant dual flagging. Stage Adaptive Recovery: Text-attacked nodes bypass their corrupted center text entirely, relying solely on original neighbor information for classifica- tion. Structure nodes leverage their preserved own text combined with filtered neighbors. Connections text-attacked nodes those with low similarity are removed. Normal nodes employ standard classification using their original text and neighbors, with only text-attacked neighbors filtered. The detailed pseudo-code of SFT-auto is given in Algorithm
Inference.
Complexity Analysis. The computational cost of SFT-auto is comparable to SFT-neighbor, as both methods are bottlenecked by the per-sample forward pass through the LLM. Training requires at most 1.3x x more samples due to data augmentation (with ratio r & 0.15). For inference, let Tu be the time for single forward pass. The average per-sample inference time for SFT-auto is Tang R
8

---

Published as a conference paper at ICLR 2026
(1 Panack) LLM, where Patack is the small fraction of detected nodes requiring recovery. The value of Patack is bounded above by 2. which incurs an acceptable worst-case overhead, and is typically very small in practice. Given the equivalent per-sample cost, SFT-auto 's overall runtime is comparable to its baseline, making it an efficient framework for achieving balanced robustness.
Results. SFT-auto demonstrates superior performance, visualized in Figure 4 Compared to baselines, SFT-auto has more consistent performance against both structural and textual attacks.
5.3
GNN WITH AUTO DESIGN
100
80
5,8x
6
Detectian Rate (%6
80
60-
6.9
Accuracy
70
60
50-
20
10
40
15,0x
30
Choteer
Putomed
Wincc
Instapram
Perdeit
Histary
Photo
Cova
Ceeaeer
Rubmed
Wiktes
Instagram
Histor
Photo
(a) Attack Performance Comparison
(b) Detection Rate against Texual Attacks
Figure 6: Performance comparison between SFT-auto and AutoGCN. (a) Accuracy under structural (left bars) and textual (right bars) attacks. (b) Detection efficacy against textual attacks.
Having established SFT-Auto's 's effectiveness, a natural question arises: Can similar auto-detection principles enhance the robusiness of GNNs? To explore this, we implement AutoGCN by replacing the LLM predictor with GCN, while maintaining the same detection pipeline architecture.
Figure 6 reveals that AutoGCN exhibits substantial degradation across both attack modalities, with particularly pronounced deficiencies in textual anomaly detection (Figure (b)). where SFT-Auto achieves 67.41 improvements over AutoGCN. This performance gap illuminates fundamen- tal architectural differences: LLMs possess inherent multi-modal reasoning capabilities, enabling seamless integration of detection and classification within unified frameworks. Conversely, GNNs lack the linguistic sophistication required for text anomaly detection. This suggests promising re- search directions toward hybrid architectures that combine GNNs' structural robustness with LLMs' semantic understanding through multi-stage prediction pipelines built on verified, clean data.
6 RELATED WORK
Robust GNNs and GraphLLMs. The vulnerability of GNNs adversarial attacks has been tensively studied (Jin et al. 2021 Xue et al. 2025), motivating a series of RGNNs. Robust training methods modify the learning process enhance resilience, exemplified by GRAND (Feng et al., 2020) and NoisyGCN (Ennadir et al. 2024). Robust architectural designs introduce inherently sta- ble mechanisms, such as GNNGuard (Zhang & Zitnik 2020), which filters edges based on node similarity, SoftMedian GDC (Geisler et al.) 2021). which applies median- aggregation, and RUNG (Hou et al., 2024), which adopts an unbiased aggregator for improved soft filtering. Graph structure learning methods, including ProGNN (Jin et al. 2020) and Stable (Li et al. (022b), refine the graph topology to denoise adversarial input. However, these RGNNs rely solely on shallow embeddings, neglecting the influence of raw textual information in TAGs on robustness, and focus primarily on defending against structural perturbations.
Recently, LLMs have been introduced for robust TAG learning. Representative methods include GraphEdit (Guo et al. 2024b), RLLMGNN (Zhang et al. (025b), and LangGSL (Su et al. 2024), which leverage LLMs to adjust reconstruct graph structure under adversarial settings. However, these approaches use LLMs solely as structure refiners and remain tightly coupled to GNN back- bones, limiting their capacity capture deeper interactions between text and structure.

---

Published as a conference paper at ICLR 2026
Graph Robustness Evaluation. For GNNs and RGNNs, Zheng et al. (2021)
propose GRB, which
evaluates model robustmess under GIAs. More recently, Guo et al. (2024a)
initiate the study of extends LrMphLLM
robustness for LLM-based predictors in TAGs. TrustGLM (Zhang et al. 2025a
as the evaluation target and explores defense strategies such as noise injection. Olatunji et (2025) propose deep evaluation into Graphi against text and structural attacks. However, existing evaluation frameworks lack uniformity and faimess across different model categories and attack settings. This limitation obscures the key findings presented in our study.
CONCLUSION
This paper presents comprehensive evaluation of graph learning methods on TAGs against both tex- tual and structural attacks, evaluating GNNs, RGNNs, GraphLLMMs and LLMs across ten datasets from four domains under transductive poisoning and inductive evasion settings. The experiments reveal key insights: different classifier types exhibit distinct text-structure trade-offs; simple RGNN can shine again with a proper text encoder, and GNNs and LLMs demonstrate vulnerabilities to dif- ferent attack types. The paper presents novel method, SFT-auto, to address the identified trade-off, introducing a unified LLM-based framework that is robust against both textual and structural per- turbations. The paper also includes comprehensive ablation studies and evaluations against adaptive and hybrid attacks in the appendix, establishing a foundation for future research in TAG security.
REPRODUCIBILITT STATEMENT
We provide implementation details, configurations, and model cards in Appendix B We provide de- tailed dataset descriptions in Appendix C
We provide complete specifications and hyperparameters of the attacks in Appendix D and descriptions of all defense models, hyperparameters, and variants in Appendix E
We report the full numerical results underlying the main text, including per-dataset, per-model, and enabling exact comparison and re-analysis.
per-attack breakdowns Appendix J
ACKNOWLEDGEEMENTS
The work was partially done at Gaoling School of Artificial Intelligence, Beijing Key Labo- ratory of Research on Large Models and Intelligent Governance, Engineering Research Cen- ter of Next-Generation Intelligent Search and Recommendation, MOE, and Pazhou Laboratory (Huangpu), Guangzhou, Guangdong 510555, China. This research supported in part by Na- tional Natural Science Foundation of China (No. 92470128, No. U2241212), by National Science and Technology Major Project (2022ZD01 14802), by Beijing Outstanding Young Scientist Pro- National Key Research and Development Plan of China
gram No. (2023YFB4502305), and Ant Group through CCF-Ant Research Fund. We also wish acknowl- edge the support provided by the fund for building world-class universities (disciplines) of Ren- min University of China, by Engineering Research Center of Next-Generation Intelligent Search and Recommendation, Ministry of Education, by Intelligent Social Governance Interdisciplinary Platform, Major Innovation & Planning Interdisciplinary Platform for the "Double-First Class" Ini- tiative, Public Policy and Decision-making Research Lab, and Public Computing Cloud, Renmin University of China
10

---

Published as a conference paper at ICLR 2026
REFERENCES
Yassine Abbahaddou, Sofiane Ennadir, Johannes F. Lutzeyer, Michalis Vazirgiannis, and Henrik Boström. Bounding the expected robustness of graph neural networks subject to node feature at- tacks. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. OpenReview.net, 2024.
Runjin Chen, Tong Zhao, Ajay Jaiswal, Neil Shah, and Zhangyang Wang. Llaga: Large language and graph assistant. arXiv preprint arXiv:2402.08 170, 2024.
Eli Chien, Jianhao Peng, Pan Li, and Olgica Milenkovic. Adaptive universal generalized pagerank graph neural network. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021.
Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang. Angela Fan, al. The llama 3 herd of models. arXiv e-prints, pp. arXiv-2407, 2024.
Sofiane Ennadir, Yassine Abbahaddou, Johannes Lutzeyer, Michalis Vazirgiannis, and Henrik Boström. A simple and yet fairly effective defense for graph neural networks. In Proceedings of the AAAI conference on artificial intelligence, volume 38, pp. 21063-21071, 2024.
Wenzheng Feng, Jie Zhang, Yuxiao Dong, Yu Han, Huanbo Luan, Qian Xu, Qiang Yang, Evgeny Kharlamov, and Jíe Tang. Graph random neural networks for semi-supervised learning graphs. Advances in neural information processing systems, 33:22092-22103. 2020.
Simon Geisler, Tobias Schmidt, Hakan Şirin, Daniel Zügner, Aleksandar Bojchevski, and Stephan Günnemann. Robustness of graph neural networks at scale. Advances in Neural Information Processing Systems, 34:7637-7649, 2021.
Cee Giles, Kurt Bollacker, and Steve Lawrence. Citeseer: an automatic citation indexing system. In Proceedings of the third ACM conference on Digital libraries, pp. 89-98, 1998.
Lukas Gosch, Simon Geisler, Daniel Sturm, Bertrand Charpentier, Daniel Zügner, and Stephan Günnemann. Adversarial training for graph neural networks: Pitfalls, solutions, and new direc- tions. Advances in neural information processing systems, 36:58088-588 1110888588122 12, 2023.
Kai Guo, Zewen Liu, Zhikai Chen, Hongzhi Wen, Wei Jin, Jiliang Tang, and Yi Chang. Learn- ing graphs with large language models(llms): A deep dive into model robustness. CORR, abs/2407. 12068, 2024a. doi: 1048550/ARXIV..407. 12068. URL htthhhtt/://dde org/10.
48550/arXi 2407 12068
Zirui Guo, Lianghao Xia, Yanhua Yu, Yuling Wang. Kangkang Lu, Zhiyong Huang, and Chao Huang. Graphedit: Large language models for graph structure learning. arXiv preprint 258.::2402.11183. 2024b.
Zhichao Hou, Ruiqi Feng, Tyler Dem, and Xiaorui Liu. Robust graph neural networks via unbiased aggregation. Advances in Neural Information Processing Systems, 170100971-00130,, 2024.
Weihua Hu, Matthias Fey, Marinka Zitnik, Yuxiao Dong, Hongyu Ren, Bowen Liu, Michele Catasta, and Jure Leskovec. Open graph benchmark: Datasets for machine learning on graphs. Advances in neural information processing systems, 33:221 18 22133,,, 2020.
Xuanwen Huang, Kaiqiao Han, Yang Yang. Dezheng Bao, Quanming Tao, Zixing Chai, and Qi Zhu. Can gnn be good adapter for llms? Proceedings of the ACM Web Conference 2024, pp. 2077- 2088, 2024.
Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Os- trow, Akila Welihinda, Alan Hayes, Alec Radford, et al. Gpt-40 system card. arXiv preprint arXiv:2410.21276, 2024.
11

---

Published as a conference paper at ICLR 2026
Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chap- lot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anee Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix, and William El Sayed. Mistral 7b, 2023. URL https:
//arxiv.org/abs//22 06825
Wei Jin, Yao Ma, Xiaorui Liu, Xianfeng Tang, Suhang Wang, and Jiliang Tang. Graph structure learning for robust graph neural networks. In Proceedings of the 26th ACM SIGKDD international conference on knowledge discovery & data mining, pp. 66-74, 2020.
Wei Jin, Yaxing Li. Han Xu, Yiqi Wang, Shuiwang Ji, Charu Aggarwal, and Jiliang Tang. Ad- versarial attacks and defenses on graphs. ACM SIGKDD Explorations Newsletter, 22(2))19-34, 2021.
Thomas N. Kipf and Max Welling. Semi-supervised classification with graph convolutional net- works. In 5th International Conference Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings. OpenReview.net, 2017. URL httpst::: //openzeview.oo wwtp://e/ttwoommeeeeeeeee d=sooumym
Johannes Klicpera, Aleksandar Bojchevski, and Stephan Günnemann. Predict then propagate: Graph neural networks meet personalized pagerank. In 7th International Conference on Learn- ing Representations, ICLR 2019, New Orleans, LA, USA, May 6-9, 2019. OpenReview.net, 2019.
URLLittts::/cppeeeeeeee net. 2orum wwtoorrummiiiillll--e 1d= 2A9Ym
Woohyun Lee and Hogun Park. Self-supervised adversarial purification for graph neural networks. In Proceedings of the 42nd International Conference on Machine Learning, 2025.
Runlin Lei, Zhen Wang, Yaliang Li, Bolin Ding, and Zhewei Wei. Evennet: Ignoring odd-hop neigh- bors improves robustness of graph neural networks. Advances in neural information processing systems, 35:4694-4706 2022.
Runlin Lei, Yuwei Hu, Yuchen Ren, and Zhewei Wei. Intruding with words: Towards understanding graph injection attacks at the text level. Advances Neural Information Processing Systems, 37: 49214-49251, 2024.
Jintang Li, Bingzhe Wu, Chengbin Hou, Guoji Fu, Yatao Bian, Liang Chen, Junzhou Huang, and Zibin Zheng. Recent advances in reliable deep graph learning: Inherent noise, distribution shift, and adversarial attack. arXiv preprint urXiv:2002.07144 14, 2022a.
Kuan Li, Yang Liu, Xiang Ao, Jianfeng Chi, Jinghua Feng, Hao Yang, and Qing He. Reliable representations make a stronger defender: Unsupervised structure refinement for robust gnn. In Proceedings of the 28th ACM SIGKDD conference on knowledge discovery and data mining, pp- 925-935, 2022b.
Kuan Li, Yang Liu, Xiang Ao, and Qing He. Revisiting graph adversarial attack and defense from data distribution perspective. In The Eleventh International Conference on Learning Representa- tions ICLR, 2023.
Kuan Li, YiWen Chen, Yang Liu, Jin Wang, Qing He, Minhao Cheng, and Xiang Ao. Boosting the adversarial robustness of graph neural networks: An ood perspective. In The Twelfth International Conference on Learning Representations, 2024.
Xiaorui Liu, Wei Jin, Yao Ma, Yaxin Li, Hua Liu, Yiqi Wang, Ming Yan, and Jiliang Tang. Elas- tic graph neural networks. In International Conference Machine Learning, pp. 6837-6849.
PMLR, 2021.
Yinhan Liu, Myle Out, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv:1907.11622 2019.
Péter Mernyei and Cätälina Cangea. Wiki-cs: A wikipedia-based benchmark for graph neural net- works. arXiv preprint 20Xin92007700200,, 2020.
12

---

Published as a conference paper at ICLR 2026
Mistral Team. Un ministral, des ministraux: Introducing ministral 3b and ministral 8b. https: October 2024.
//mistrall...
John Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby, Di Jin, and Yanjun Qi. Textattack: A frame- work for adversarial attacks, data augmentation. and adversarial training in nlp. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demon- strations, pp. 119-126, 2020.
Felix Mujkanovic, Simon Geisler, Stephan Günnemann, and Aleksandar Bojchevski. Are defenses for graph neural networks robust? Advances in Neural Information Processing Systems, 35: 8954-8968, 2022.
Thanh Toan Nguyen, Nguyen Quoe Viet Hung, Thanh Tam Nguyen, Thanh Trung Huynh, Thanh Thi Nguyen, Matthias Weidlich, and Hongzhi Yin. Manipulating recommender systems: survey of poisoning attacks and countermeasures. ACM Computing Surveys, 57(1):1-39, 2024.
Iyiola E Olatunji, Franziska Boenisch, Jing Xu, and Adam Dziedzic. Adversarial attacks and de- fenses on graph-aware large language models (Ilms). arXiv preprint arXiv:2508..455 2025.
Prithviraj Sen, Galileo Namata, Mustafa Bilgic, Lise Getoor, Brian Gallagher, and Tina Eliassi-Rad Collective classification in network data. Al magazine, 29(3):33-106, 2008.
Guangxin Su, Yifan Zhu, Wenjie Zhang, Hanchen Wang, and Ying Zhang. Bridging large language models and graph structure learning models for robust representation learning. arXiv preprint arXiv:2410. /2096, 2024.
Jiabin Tang. Yuhao Yang, Wei Wei, Lei Shi, Lixin Su, Suqi Cheng, Dawei Yin, and Chao Huang. Graphgpt: Graph instruction tuning for large language models. In Proceedings of the 47th ternational ACM SIGIR Conference on Research and Development in Information Retrieval, pp- 491-500, 2024.
Petar Velickovic, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Liò, and Yoshua Bengio. Graph attention networks. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018. URL httttts:/// http:///ppneeeeeeeeeeeeee wwtp:/wwwee.ttooeeeeeeeeeeeeeeee htt/://oommmmdddppppp
Lanjun Wang, Xinran Qiao, Yanwei Xie, Weizhi Nie, Yongdong Zhang, and Anan Liu. My brother helps me: Node injection based adversarial attack social bot detection. In Proceedings of the 31st ACM International Conference on Multimedia, pp. 6705-6714 14, 2023.
Shijie Wang, Jiani Huang, Zhikai Chen, Yu Song, Wenzhuo Tang, Haitao Mao, Wenqi Fan, Hui Liu, Xiaorui Liu, Dawei Yin, al. Graph machine learning in the era of large language models (Imms). ACM Transactions on Intelligent Systems and Technology, 16(5):1-40, 2025a.
Wenhui Wang, Furu Wei, Li Dong. Hangbo Bao, Nan Yang. and Ming Zhou Minilm: Deep self- attention distillation for task-agnostic compression of pre-trained transformers. Advances in neu- ral information processing systems, 33:5776-5788 2020.
Yuxiang Wang, Xinnan Dai, Wenqi Fan, and Yao Ma. Exploring graph tasks with pure 1lms: A comprehensive benchmark and investigation. arXiv preprint arXiv:2502.18777 2025b.
Huijun Wu, Chen Wang, Yuriy Tyshetskiy, Andrew Docherty, Kai Lu, and Liming Zhu. Adversarial examples for graph data: Deep insights into attack and defense. In Sarit Kraus (ed.), Proceed- ings of the Twenty-Eighth International Joint Conference Artificial Intelligence, IJCAI 2019, Macao, China, August 10-16, 2019, pp. 4816-4823, ijeai.org, 2019.
Shiwen WU, Fei Sun, Wentao Zhang, Xu Xie, and Bin Cui. Graph neural networks in recommender systems: A survey, ACM Comput. Surv., (5(5):97:1-97733)) 2023.
Xixi WU, Yifei Shen, Fangzhou Ge, Caihua Shan, Yizhu Jiao, Xiangguo Sun, and Hong Cheng. When do Ilms help with node classification? comprehensive analysis. CoRR, 188725 2025. doi: 10.48500ARRXIV2550.117777 URL /attps: wtg/10..4550/axXt
2502. 18771
13

---

Published as a conference paper at ICLR 2026
Kaidi Xu, Hongge Chen, Sijia Liu, Yu Chen, Tsui-Wei Weng, Mingyi Hong, and Xue Lin. Topology attack and defense for graph neural networks: An optimization perspective. In Pro- ceedings of the Ewenty-Eightt International Joint Conference on Artificial Intelligence, IJCAI 2019, Macao, China, August 10-16, 2019, pp. 3961-3967. ijeai.org, 2019.
Ruizhan Xue, Huimin Deng, Fang He, Maojun Wang, and Zeyu Zhang. Trustworthy gnns with Ilms:
A systematic review and taxonomy. arXiv preprint arXiv:2502.08353, 2025.
Hao Yan, Chaozhuo Li, Ruosong Long, Chao Yan, Jianan Zhao, Wenwen Zhuang, Jun Yin, Peiyan Zhang, Weihao Han, Hao Sun, et al. A comprehensive study text-attributed graphs: Bench- marking and rethinking. Advances in Neural Information Processing Systems, 16:17238-17264 2023.
An Yang. Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, et al. Qwen3 technical report. arXiv preprint arXiv:2505.09388 2025.
Zhilin Yang. William Cohen, and Ruslan Salakhudinov. Revisiting semi-supervised learning with graph embeddings. In International conference on machine learning. pp. 40-48, 2016.
Qihai Zhang, Xinyue Sheng, Yuanfu Sun, and Qiaoyu Tan. Trustglm: Evaluating the robustness of graphllms against prompt, text, and structure attacks. In Proceedings of the 31st ACM SIGKDD Conference Knowledge Discovery and Data Mining 2. pp. 5912-5923, 2025a.
Xiang Zhang and Marinka Zitnik. Gnnguard: Defending graph neural networks against adversarial attacks. Advances in neural information processing systems, 33:9263-9275, 2020.
Zhongjaan Zhang, Xiao Wang, Huichi Zhou, Yue Yu, Mengmei Zhang, Cheng Yang, and Chuan Shi. Can large language models improve the adversarial robustness of graph neural networks? In Proceedings of the 3 st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 1, pp. 2008-2019, 2025b.
Qinkai Zheng, Xu Zou, Yuxiao Dong, Yukuo Cen, Da Yin, Jiarong Xu, Yang Yang, and Jie Tang. Graph robustness benchmark: Benchmarking the adversarial robustness of graph machine learn- ing. arXiv preprint arXiv:21 11.0110443 1.04314, 2021.
Dingyuan Zhu, Ziwei Zhang, Peng Cui, and Wenwu Zhu. Robust graph convolutional networks against adversarial attacks. In Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining, pp. 1399-1407, 2019.
Daniel Zügner and Stephan Günnemann. Adversarial attacks on graph neural networks via meta learning. In 7th International Conference on Learning Representations, ICLR 2019, New Or- leans. LA, USA, May 6-9, 2019. OpenReview.net, 2019. URL httpta::///penrevie..eeeee
forum? d=By nx209yX
Daniel Züggerr, Amir Akbarnejad, and Stephan Günnemann. Adversarial attacks on neural networks for graph data. In Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining, pp. 2847-288 2018.
14

---

Contents
Usage of LLMS
17
Implementation and Configurations
17
B. I Implementation
17
B.2 Configuration
17
Model Cards
17
Details of Datasets
17
D Details of Attack Methods
18
Structural Attacks
18
D.2 Text-based Attacks
19
D.3 Hybrid Text-level Graph Injection Attacks
20
D.4
Attacks Excluded in the Main Paper
20
D.4.1
Why not Mettack?
20
D.4.2 Why not TextAttack?
Details of Defense Methods
23
Introduction of Defense Model
23
E.2
Configuration and Hyperparameters
24
E.2.1
GNN and RGNNS
24
E.2.2
GraphLLMs
25
E.2.3
GraphLLMs with Noisy Training
26
1.2.4
SFT with Similarity Constraints
27
E.2.5
SFT-auto
27
Results against WTGIA
28
Why GNNGuard Excels: Understanding and Improving
30
Results of GNNGuard under different text encoders
30
G.2
Difference Between Text-encoders
30
15

---

Published as a conference paper at ICLR 2026
G.3
Guardual: Robustness Against Test- lime Structural Attacks
32
G.3.1
Dual-Threshold Design
33
G.3.2
Results of Guardual
33
Adaptive Attacks
33
Adaptive Attacks against GNNGuard
33
H.2
Adaptive Attacks on Embedding Transferability
35
Ablation Study for SFT Variants
36
Impact of Different Prompt Templates
36
Degree-based vs Random Neighbor Selection
36
I1..2
Label Information in Prompting
36
1.2
Impact of Different LLM Backbones
36
J
Full Experiment Results
38
Overview and Clarification of Rank- based Evaluation
38
J.2
GNN and RGNN Results
38
J.2.1
Clean, Inductive
38
J.2.2
Clean, Transductive
39
J.2.3
Structure Attack, Inductive
39
1,2.4
Structure Attack, Transductive
39
1.2.5
Text Attack, Inductive
39
J.2.6
Text Attack, Transductive
39
J.3
GraphLLM Results
44
Results with Different Perturb Ratios
44
Additional Baseline Evaluation
48
16

---

Published as a conference paper at ICLR 2026
A USAGE OF LLMS
In this study, Large Language Models (LLMs) were employed exclusively for the purpose of lin- guistic enhancement, including grammatical corrections and stylistic improvements. The concep- tion, development, and interpretation of all technical material, experimental designs, analytical pro- cesses, and findings were conducted without any contribution from LLMs. The authors affirm their complete accountability for the entire content of this work.
B IMPLEMENTATION AND CONFIGURATIONS
B.1 IMPLEMENTATION
We rely GreatX Li et al. (022a) for GNN and RGNN implementations, and on NodeBed Wu ct al. (2025) for GraphLLM and dataset loading.
B.2 CONHGURATION
Experiments were run on machine with an NVIDIA A100-SXM4 GPU (80 GB), an Intel Xeon CPU (2.30 GHz), and 512 GB of RAM.
B.3
MODEL. CARDS
We used the following public models (links their official model cards):
Mistral-7B
Jiang et al.
2023
Llama 3.I-8B 8B
Dubey et al.
2024
Ministral 8B
Mistral
Team
2024
Qwen3 8B
Yang et al.
2025)
GPT-4o mini
Hurst et al.
2024
RoBERTa
Liu et al.
2019
MiniLM Wang al. 2020
C DETAILS OF DATASETS
We evaluate our methods on 10 text-attributed graph datasets spanning four domains, selected from the LLMNodeBed benchmark (Wu et al. 2025) ensure comprehensive coverage of real-world scenarios.
Academic Networks
Cora (Sen et al. 2008): Computer science papers organized into seven research areas.
CiteSeer GGiles et al.
1998): CS publications spanning six categories including Al and
databases.
Pubmed YYngg et al.
2016): Biomedical literature focused on diabetes research with three
classification types.
ArXiv (Hu al. 2020): Large-scale CS paper collection covering 40 specialized subcate- gories from the arXiv repository.
Web Link Network
WikiCS Meenyei Cangea 2020):
Computer science Wikipedia articles categorized into ten technical domains, interconnected through hyperlink references.
17

---

Published as a conference paper at ICLR 2026
Social Networks
Instagram (Huang et al. [024]] User profiles differentiated between personal and business
accounts based on profile characteristics.
Reddit (Huang et al. 2024): Community users classified by engagement levels using post-
ing history and interaction patterns.
E-Commerce Networks
History Yan et al.
2023):
Historical literature products with detailed categorical organi-
zation.
Photo (Yan et al.
2023):
Photography equipment spanning professional and consumer
categories.
Computer Yan et al. accessories.
2023 Technology products including hardware components and
Table Dataset statistics for 10 evaluated datasets from LLMNodeBed (Wu al. 2025)
Domain
Dataset
Classes
Nodes
Edges
Cora
2,708
5,429
CiteSeer
6
3,186
4,277
Academic
Pubmed
3
19,717
44,338
arXiv
40
169,343
1,166,243
Web Link
WikiCS
10
11,701
215,863
Instagram Reddit
2
11,339
144,010
Social
33,434
198,448
History
12
41,551
358,574
E-Commerce
Photo
12
48,362
500,928
Computer
10
87,229
721,081
D DETAILS OF ATTACK METHODS
D.1
STRUCTURAL ATTACKS
PGD Attack etu al. 2019). white box gradient-baset discrete GMA that iteratively perturbs the graph structure via projected gradient ascent over continuous relaxation variables, followed by stochastic binarization to apply edge additions/removals under a budget constraint.
Hyperparameters:
Learning rate: 0.1.
Optimization: 200 optimization epochs + 20 sampling epochs.
Budget: Default 20% of total edges.
Target Embedding: BoW.
PGD-Guard (Threshold-based PGD) (Mujkanovic et al. 2022). An adaptive variant that con-
strains perturbations to pairs of nodes whose cosine similarity exceeds a threshold, emulating defense-aware strategies intended to bypass similarity filtering (targeting GNNGuard (Zhang & Zit-
nik 2020
Hyperparameters:
Cosine similarity thresholds: [0.0, 0.3, 0.5, 0.7].
Base settings: same standard PGD.
18

---

Published as a conference paper at ICLR 2026
Budget: 20% of edges.
Target Embedding: RoBERTa.
GRBCD Attack (Geisler et al., 2021). A white-box GMA based greedy randomized block coordinate descent over the discrete edge space. At each step, random edge blocks are scored by gradients and greedily flipped within the budget.
Hyperparameterr::
Block size: 1,000,000.
Sampling: 50 trials per iteration; 20 final samples for selection.
Early stopping: patience-based with tolerance = 10-7
Target Embedding: BoW.
HeuristicAltack (Li et al. 2023). A scalable DICE-style heuristic ("Disconnect Internally, Con- nect Externally") with training- aware constraints that prioritizes edges involving training nodes and degree-basse node selection, approaching gray-box poisoning MetaAttack (Zügner & Günnemann 2019) performance via distribution shifts maximization.
Hyperpurameters:
Add vs. remove probability: 0.5. tried from (0.7,0. 0.9, and found threshold= 0.5 yields most stable performance.
Node sampling: inverse-degree probability (lower degree + higher probability).
D.2 TEXT-BASED ATTACKS
LLM Text Attack. We generate neighborhood-aware prompts to induce LLM to rewrite node texts so that the predicted label is driven away from (i) the node's s current class and (ii) the dominant classes in its immediate neighborhood, while preserving length and fluency.
Prompt Template (instantiated per target node).
Graph node classification task
Available classes: {classes.ste .strr
Target node (node_id):
Original text: "[text}}*
Original label: "(current.label)
(neighbor.info) (e.g. "Neighbor labels: [...] (counts: {... } "No neighbors found")
Task. Rewrite the text to be different as possible from the original while keeping similar length. Requirements:
Must not belong to the original class: "ycurrent.label"
Should not belong to neighbor classes: (unique.neiigthor..eee
None.
(target.instruct ion] (e.g.. prefer class from the allowed set, or the least frequent neighbor class if all are forbidden).
Make the content maximally dissimilar from the original semantics.
Keep the word count roughly similar.
Produce content that most unlikely under node/neighbor context target class.
Goal: create text that is jointly inconsistent with the original content and its local graph context. Return only the modified text, with no explanations notes.
Modified text:
Algorithm.
Target selection: sample nodes with degree-wwiggttee probabilities. Lower degrees, higher probabilities.
19

---

Published as a conference paper at ICLR 2026
Context extraction: for each node, gather its original text, current label, neighbors' labels, and counts.
Constraint synthesis: define the forbidden set as {current label) U (neighbor labels]: compute the allowed label set over all classes. If empty, choose the least frequent neighbor label; else prefer a label maximally different from the forbidden set.
Prompting: instantiate the above template with (classes str), (node id), (text),
Saarrent_labe ), { {nei (nei gihho_hinfnnf and (ta
Generation: query the LLM to generate a response.
post-processing: clean text, validate constraints (length and class-avoidance heuristics), and embed to update node features.
Hyperparameters.
Backbone LLM: GPT-4o-mini (Hurst et al. 2024
Temperature: 0.7.
Target nodes: Training if under the poison setting, test nodes if under the evasion setting.
Budget: Poison: 80% of the training nodes; Evasion: 40% of the test nodes.
D.3 HYBRID TEXT-LEVEL GRAPH INJECTION ATTACKS
WTGIA: Word-level Text GIA (Lei et al. 2024). We follow the original WTGIA pipeline with speeset- adaptations during inductive learning.
Configuration.
Text generator: L.lama331-8BB (Dubey et al. 2024 with no-topic prompts and vocabulary masking.
Edge connectivity:
We use odgee num edges x ptb rate, so the number of total inject edges aligned to GMA rates if the budget is set the same. Specifically, we yield 17 (Cora), (CiteSeer), 22 (PubMed) at ptb ptb_rate 0.2.
Node injections: 60 (Cora), 90 (CiteSeer), 400 (PubMed) at ptb rate 0.2; scale propor- tionally for ptb_rate 0.4.
BoW sparsity: 0.15 (Best according to the original paper).
FGSM optimization: step size e = 0.01 for 100 epochs; sequential injection steps of 0.2 with ATDGIA strategy.
BBttching: 50 for PubMed; for other datasets.
D.4 ATTACKS EXCLUDED IN THE MAIN PAPER
In this paper, we focus on untargeted attacks and text-based attacks. Therefore, methods such as
Nettack (Zügner al. 2018) and feature attacks in GRB (Zheng al. (021) not employed.
Additionally, while some attacks conform to our experimental setting, we choose not to adopt them. In this subsection, provide detailed justification for these exclusions.
D.4.1 WHY NOT METTACK?
Mettack Zügner & Günnemann, 2019). Mettack (Zügner & Günnemann 2019) is gray-box structural poisoning attack that employs a surrogate GCN and bi-level optimization with meta- gradients identify vulnerable edges.
Hyperparameters.
Surrogate learning rate: 0.1; momentum: 0.9.
Meta learning rate: adaptive.
Meta epochs: 100.
20

---

Published as a conference paper at ICLR 2026
Regularization modes: {0.0 (meta-self), 0.5 (meta-both), 1.0 (meta-train)). We use À E {0.0 (meta-self) as yields the strongest attacks.
In the main paper, we opted for HeuristicAttack instead of Mettack for the following reasons:
The attack performance of Mettack is not significant when transferring to validation- defenses, demonstrated in Table 4 This phenomenon is also evidenced by the GreatX repository (Li et al. 2022a).
Mettack suffers from scalability limitations, making it applicable only to datasets of a size comparable to the PubMed level.
Table Attack performance comparison on Cora and CiteSeer datasets using a surrogate GCN with 64 hidden units. Results show mean accuracy + standard deviation across three runs.
Dataset
Attack Method
Clean
No Validation
With Validation
HetristicAttack
82,91
61,30 1.00
70.33++2.89
Cora
Mettack
82.91=0.83
75.13+1.25
77.86
HeuristicAttack
71.65=0.61 71.65=0.61
65.90 1.18
70.64
CiteSeer
Mettack
62.00=1.69
68.82:10115
In contrast, HetristicAttack, with its superior scalability and more consistent performance across validation conditions, is a more flexible and reliable choice for evaluation.
D.4.2 WHY NOT TEXTATTACK?
Introduction of Text Adversarial Attack. While our main approach employs LLM-based text generation for adversarial attacks, one may be concerned about the unnoticeability of such substi- tutions. To address this limitation, we conduct comprehensive analysis using established NLP adversarial attack methods that explicitly optimize for imperceptibility. Specifically, we employ the primary attack method, including BAE, PWWS, and
TextAttack library and select TextFooler HotFlip, in preliminary evaluations.
TextFooler operates by strategically perturbing individual words within input sentences generate semantically equivalent yet syntactically modified text. The method prioritizes semantic preserva- tion while introducing subtle lexical modifications, rendering the perturbations challenging detect for both human evaluators and automated systems. This characteristic makes TextFooler particularly suitable when imperceptibility constitutes critical requirement.
Experimental Configuration. We configure TextFooler with MiniLM embeddings and utilize default parameters from the TextAttack library (Morris al. 2020). The victim model is set GCN. Our evaluation employs a perturbation rate of 0.4 across all experiments. The experiment environment set as the inductive evasion setting.
Key Findings. Our empirical analysis reveals critical dependency between attack effectiveness and the alignment of embedding representations used in both the attack generation and target model defense mechanisms. As shown in Table when the attack embeddings (MiniLM) match those em- ployed by the target model (MiniL.), TextFooler demonstrates substantially degraded performance across all evaluated GNN architectures, with notable performance drop. However, as shown in Tables (6 and 7 when embedding misalignment occurs occurs-speciniee sprrissipeciiilllyy when target models utilize different embedding schemes such BoW RoBERTa, the attack effectiveness diminishes con- siderably.
These results provide compelling evidence that the text adversarial attack still overfits the surrogate model and the embedding type. To ensure an effective attack strength consistently, we use the LLM- based text attack that generally degrades the performance of all backbones with all encoders.
21

---

Published as a conference paper at ICLR 2026
Table TextFooler attack results, MiniLM embedding for the defender. Bold indicates best perfor- mance, underline indicates second best.
Method
Cora
CiteSeer
PubMed
WikiCS
Instagram
Reddit
History
GCN
$7.32 2,84
50.78 = 2.14
63.32 + 1.19
74.26 +: 13.51
$2.85
+ 1.89
53.80
: 0.49
84.47
0.40
GAT
64.88 7.50
41.43
2.29
66.59
5.63
51.86 +: 22.41
52.38
+:
53.07
83.82 0.60
APPNP
53.75
1.22
= 1.67
61.94 + 0.88
60.99 + 15.99
55.67
+ 0.83
46.40
0.44
84,80
0.48
GPRGNN
50.62 = 0.43
44.98 - 0.68
65.68 + 1.10
59.02
16.72
49.54
5.39
0.79 45.54
0.79
82,96 0.66
RobustGCN
76.32 3.28
68.34 0.80
72.91 +: 1.10
64.67 0.61
62.13 12.13:0.477
$7.69
84.89
0.44
NoisyGCN
59.35
1.61
53.24 + 1.09
63.78 + 0.76
64.15
50.24 + 1.82
0.79 54.03
84.55 0.34
GRAND
60.02 = 1.94
66.93 = 1.12
65.35 : 0.56
49.55
63.76 + 0.35
0.69 51.08
83.03 1 0.52
EvenNet
63,22 2,30
59.77
0.27
65.91
+ 0.97
62.95 15.51
54.29
47.83
84.73 0.56
GNNGuard
49.57 0.98
46.13
1.40
66.45 + 0.32
59.48 15.24
42.12
1.44
44.98
3.69
82.91 0.35
Table 6: TextFooler attack results, BoW embedding for the defender. Bold indicates best perfor- mance, underline indicates second best.
Method
Cora
CiteSeer
PubMed
WikiCS
Instagram
Reddit
History
GCN
85.30
72.99
86.13 0.30
81.52 0.24
63.11
0.70
60.54 0.93
81.79 0.11
GAT
86.04 1.91
73.30 + 0.94
86.12 16112+000 0.20
81.33
0.32
64,43
1.05
61.51
1.21
82.13 + 0.60
APPNP
85.73 : 2.16
70.85 1: 0.38
0.11
78 1: 1.62
63.30
1.48
56.88
: 0.95
81.35 :: 0.26
GPRGNN
84.21
79.18
1.61
63.96
0.46
59.26
78.28 0.57
RobustGCN
86,59 = 1.52
72.73
+: 0.13
0.57
82.41 1:41::00 0.37
65.86
0.40
59.81
0.39
81.48 0.67
NoisyGCN
85.55 = 1.28
72.36
:: 1.41
86.01 0.30
81.65
: 0.35
62.82
1.00
61.63 0.11
82.19 1:19-t10 0.14
GRAND
83.83 = 2.18
73.72
1.61
87.47 1
80.44 0.37
64.45 1 0.25
62.77
L,99
79.42 +
EvenNet
83,70 2.03
71.21
0.22
8253
$2.33:0.0 0.35
64,93
1.39
60.06
0.73
81.07 0.51
GNNGlarr
80.38 + 1.22
66.14 + 1.23
82.94 0.49
69.09 3.86
62.48
0.46
54.75 + 0.52
78.04 + 0.32
Table 7: TextFooler attack results, RoBerta embedding for the defender. Bold indicates best perfor- mance, underline indicates second best.
Method
Cora
CiteSeer
PubMed
WikiCS
Instagram
Reddit
History
GCN
87.39 :: 1.00
75.18
0.87
86.35 +: 0.22
84.39
0,46
66.06 0.68
66.41
0,38
85.01 +: 0.30
GAT
86.84 : 1.28
75.60
0.70
87.15 1:15::00 0.23
0.23
83.80
1:00::000 0.82
67.09 0.75
63.92
0.31
84.59 1: 0.54
APPNP
79.40
88.21
0.30
4.05
64.27
1.16
$7.39
0.16
GPRGNN
82.41 0.68
70.53 + 1.63
85.21 0.29
79.51 : 4.44
62.24 + 1.49
1.44 54.89
84.65 - 0.62
RobustGCN
86.96 = 1.99
74.03
0.33
0.00
83.28
1.28:000 0.59
67.39
0.17
59.42
0.79
84.57 - 0.44
NoisyGCN
86.90 = 0.90
75.39
0.80
0.28
83.75 4: 1.14
66.48
0.75
66.52
0.42
GRAND
86.10
77.27
0.34
0.35 89.78
1113:00 0.85
66.49
0.41
63.53
1.27
85.92
EvenNett
83.09 + 1.55
74.19
0.64
89.45 + 0.57
84,91
1,63
65.42
0.79
59,59 + 0.36
85.62 + 0.57
GNNGuurd
71.40 1: 1.74
0.46 68.65
82.27
0.82
5.68 75.48
60.58
1.71
54.14 1.26
84.64 - 0.52
22

---

Published as a conference paper at ICLR 2026
E DETAILS OF DEFENSE METHODS
E.
INTRODUCTION OF DEFENSE MODEL
For GNNs and RGNNs, we have the following methods as baselines.
Spatial/Message Passing Models
1. GCN (Kipf & Welling, 2017): Graph Convolutional Network using localized spectral con- volution with Chebyshev polynomials.
2. GAT (Velickovic al. 2018): Graph Attention Network employing multi-head attention mechanisms for adaptive neighborhood aggregation.
Spectral Models
1. APPNP (Klicpera et al.
2019): Approximate Personalized Propagation of Neural Predic-
tions, combining neural predictions with personalized PageRank.
2. GPRGNN (Chien et al. able graph filter coefficients.
2021):
Generalized PageRank Graph Neural Network with learn-
3. EvenNet (Lei et al. 2022 Spectral-based defense using even convolution networks with leleportation mechanisms.
Robust Training Methods
1. GRAND (Feng al. 2020): Graph Random Neural Networks with consistency regular- ization using random propagation and DropNode.
2. NoisyGCN (Ennadir improve robustness.
2024):
GCN with feature noise injection during training to
3. GPRGNN-TT Gosch et al. 2023): GPRGNN with adversarial training. Results are left to Appendix K
Probabilistic Methods
1. RobustGCN (Zhu et al.) 2019): Robust Graph Convolutional Network with Gaussian- based attention and variance-based message passing.
Similarity- Methods
1. GNNGuard (Zhang & Zitik 2020): Attention brased neighborhood filtering using cosine similarity thresholds detect and mitigate adversarial edges.
1. ElasticGNN (Liu et al. 2021 Elastic message passing with L,/L2 regularization for han- dling graph heterophily.
2. Sof (Geisler al. 2021): Soft median aggregation with Gaussian Diffusion Convolution and temperature control.
3. RUNG (Hou et al. 2024): Robust Graph Neural Networks with uncertainty quantification and Laplacian smoothing.
Other Architectural Improvements
1. GCORN (Abaahadoou et al. 2024): Higher-order Graph Convolutional Networks with polynomial filters and weight regularization.
23

---

Published as a conference paper at ICLR 2026
Unsupervised Structure Cleaning
1. Jaccard-GCN (Wu et al. 2019): Preprocesses graphs by removing edges with low Jaccard similarity between node features.
2. Cosine-GCN [Mujkanovic et al. 2022 Edge filtering based cosine similarity thresh- olds between node feature vectors.
Supervised Structure Learning
1. ProGNN (Jin et al.
2020g: Joint optimization of graph structure and GNN parameters with sparsity and smoothness constraints
2. Stable (Li ct al. ing edge weights using a metric function combining node feature and structure informa- tion. It employs Cosine and Jaccard similarity with learnable thresholds filter adversarial edges.
2022b): An unsupervised pipeline that optimizes graph structure by learn-
3. GOOD-AT: It trains an ensemble OOD detectors using adversarial edges as supervision signals to learn which edges are anomalous, then removes detected perturbations to recover a cleaner graph structure. Results are left to Appendix K
4. GPR-GAE: It learns reconstruct clean graph structure via self-supervised graph au- toencoder with multiple GPR filters, using the original graph's 's reconstruction loss as im- plicit supervision for structure learning. Results left Appendix K
GraphLLM Defenses
GraphGPT (Tang et al. 2024): Graph-text alignment model using contrastive learning between graph embeddings and text representations.
2. LLaGA (Chen et al., 2024): Large Language and Graph Assistant that aligns graph struc- tural information with language model representations through multi-modal learning.
3. SFT with Neighbors (Wang et al. 2022bb:: Supervised Fine- muning approach that incor- porates neighborhood information into LLM prompts for enhanced graph understanding.
E.2 CONFIGURATION AND HYPERPARAMETERS
This sub-section details configurations and hyperparameters for both GNN-based defenses and GraphLLM methods used in our evaluation framework.
E.2.1
GNN AND RGNNS
General Settings
All GNN- defense models share the following general hyperparameters:
Learning rate: 0.01 (consistent across all methods)
Weight decay: Grid search over [0.0, 0.0005]
Dropout: Grid search over [0.5, 0.7] (except model-specific variations)
Hidden dimensions: 128 for small datasets (Cora, CiteSeer, PubMed, Instagram, WikiCS); 256 for large datasets
GAT adjustment: Hidden dimension reduced by factor of 8 due to multi-head attention
Training epochs: Dataset-dependent with early stopping
-mall datasets (Cora, CiteSeer, Instagram, PubMed, WikiCS): 400 epochs
Medium datasets (Computer, Photo, History, Reddit): 600 epochs
Large datasets (ArXiv): 1000 epochs
Patience: Datasettdependent early stopping
Small datasets: 100 epochs patience
Medium datasets: 200 epochs patience
Large datasets: 400 epochs patience
24

---

Published as a conference paper at ICLR 2026
Specific Hyperparameters. The following table summarizes the model-specific hyperparameter ranges for GNN- defense methods. For the additional baselines in Appendix we use the default hyperparameters following official implementations.
Model
Parameter
Values
GCN
None
None
GAT
Num-Heade
8
APPNP
Alpha
[0.1, 0.3, 0.7, 0.9]
GPRGNN
Alpha
[0.1, 0.3, 0.7, 0.9]
RobustGCN
None
None
Lambda1
[3, 6] [3, 6]
ElasticGNN
Lambda2
GNNGuard
Threshold
[0.3, 0.4, 0.5, 0.6, 0.7]
NoisyGCN
Beta
[0.1, 0.3, 0.5]
GCORN
None
None
Alpha
[0.0005, 0.3] [1.5, 2.5]
ProGNN
Beta
Cosine Threshold
[0.3, 0.5, 0.7]
Stable
Jaccard Threshold
[0.02. 0.03]
Alpha
[0.1, 0.03, 0.6]
GCN-Jaccard
Jaccard Threshold
[0.03, 0.05, 0.1]
GCN-Cosine
Cosine Threshold
[0.3, 0.4, 0.5, 0.6, 0.7]
Dropnode
[0.5]
Order
[2, 4]
MLP Input Dropout
[0.5]
GRAND
N Samples
[4]
Reg Consistency
[0.7, 1.0]
Sharpening Temperature
[0.5]
Temperature
[0.5, 1.0]
Sof
Teleport Probability
[0.15, 0.25]
Neighbors
[64]
Lambda
[0.7, 0.9] [1,3]
RUNG
Gamma
K
[10]
EvenNet
Alpha
10.1, 0.3, 0.7, 0.9] [0.5]
DP Rate
E.2.2 GRAPHLLMS
General Configurations GraphLLM methods employ distinct training configurations optimized for large-scale language model integration:
Base LLM: Mistral-7B (4096dimmensooall output) primary backbone
Text encoding: RoBERTa for feature extraction and alignment
Batch processing: Varies by model complexity (8-64 samples per batch)
Learning rates: Lower rates (1e-4) for stable LLM fine-tuning
Weight decay: 0.05 for regularization
Gradient clipping: Applied to prevent exploding gradients
Mixed precision: Enabled for memory efficiency
25

---

Published as a conference paper at ICLR 2026
GraphGPT. For GraphGPT, adhere to the best hyperparameters in clean datasets provided by (Wu et al. 2025).
LLaGA.
For LLaGA, we adhere to the best hyperparameters in clean datasets provided by (Wu
ct al. 2025).
* Language model embedding: RoBERTa
Neighborhood template: HO (Hopfield) encoding
SFT with Neighbors.
Supervised Fine-TTuning incorporates neighborhood-awan prompting with
LoRA optimization:
Maximum neighbors: maximum 6 for context window management
Neighbor filtering strategy: Degree-based selection neighbors are ranked by node degree in descending order, and top-6 highest-degree neighbors are selected for prompt inclusion
LoRA configuration: r=8, alpha=16, dropout=0.1, target modules=(q proj. v proj]
Sequence lengths: max.txt_length=122, mxt..ooriin.txx.eenee...
aax_ans lenghh=16
Optimization: AdamW optimizer with gradient accumulation
Prompt engineering: Integrates 1-hop neighbor information with degree-based prioritiza- tion for enhanced context understanding
Neighbor-aware Prompt Template:
Node Classification Task
Question: You are doing node classification task a citation graph. Given the content of the center and its noighbor information: gneig ) each node represents
node: forigin_tewy paper and the relationship represents the citation relationship between papers, need to classify the center node into 7 classes: (classes). Please tell me which class the center node belongs to? Answer only class name without any other words.
Answer:
E.2.3 GRAPHLLMS WITH NOISY TRAINING
This subsection covers noise injection strategies across different GraphLLM architectures in Section
GraphGPT with Noise. GraphGPT incorporates noise injection through graph-level modifica- tions using the noise utils framework. Supports only the structural "noise" variant. Noise is applied globally to the entire graph structure before training. Configurations follow the clean dataset param- eters from (Wu et al. 2025) with additional noise strategies applied during contrastive learning. The perturb ratio is set to 10%.
GraphGPT-noisetxt and GraphGPT-noisefull are excluded because the noise injected hurts clean performance too much, as shown in Table
Table 9: Performance comparison of GraphGPT variants across under the inductive setting clean datasets.
Method
Cora
CiteSeer
PubMed
WikiCS
GraphGPT
81.06 + 2.33
74.35 + 2.51
94.14 + 0.23
82.31 + 1.31
GraphGPT-noise
80.63 + 2.24
74.56 + 3.07
94.09 0.33
82.32 1,97
GraphGPT-noisetxt
66.79 + 3.84
57.37 + 5.20
86.15 = 1.88
64.56 + 2.94
LLaGA with Noise. LLaGA applies noise injection through graph-level modifications using the noise utiil framework. The noise strategies modify the global graph structure or replace text content across the entire graph before multi-modal learning. Noise integration occurs with the RoBERTa language model embedding and HO (Hopfield) neighborhood template encoding. Base configura- tions identical to clean L. LaaGA training. The perturb ratio is set to 10%.
26

---

Published as a conference paper at ICLR 2026
SFT with Noise Variants. SFT implements three distinct noise injection strategies during training:
Noise (Structure): Injection strategy targets high-degree nodes with 10% probability, adding random unconnected nodes as fake neighbors.
NoiseTxt (Text): Injection strategy replaces text content 10% high-degree nodes with text from different-class nodes.
Noisefull (Both): Injection strategy combines both structural and text noise applies both neighbor injection (10% probability) and text replacement (10% of high-degree nodes) simultancously.
Injection ratio: 10% probability for structural noise, 10% of high-degree nodes for text replacement
Target selection: High-degree nodes (degree > average degree)
Replacement strategy: Random selection from unconnected nodes (structural) or different-class nodes (text)
Training augmentation: Applied only during the training phase, inference uses clean data
Base configurations: Identical to SFT with Neighbors for all other parameters
SFT Noise Training Strategy (Sample-Level); Unlike GraphGPT//LLGGA which apply graph-level noise modifications, SFT applies noise injection at the sample level during data preparation. For structural noise, 10% probability of adding random unconnected nodes fake neighbors to high- degree nodes during neighbor selection for each training sample. For text noise, 10% of high-degree nodes have their text content replaced with text from nodes of different classes during individual sample creation. NoiseFull combines both strategies with independent application both structural neighbor injection and text replacement occur simultaneously for each sample.
E.2.4 SFT WITH SIMILARITY CONSTRAINTS
SFT-simp. The similarity variant teaches the model selectively use neighbor information based on similarity constraints through prompt engineering:
Training: Standard neighbor-based training (identical to SFT with Neighbors)
Inference strategy: Prompt-based similarity awareness
Similarity criteria: Text content and label consistency
Similarity-Aware Prompt Template:
Node Classification with Similarity Constraints
Question: You are doing node classification task in citation graph. Given the content of the center node: (origin.text] and its neighbor information: (reighbor.text: each node represents paper the relationship represents center node into fnum_cl csses) classes: {classes] }. Consider neighbor information for classi- fication ONLY when: 1) neighbors are similar to the center node, or 2) neighbors are similar to each other. Similarity can be based text content label consisteney. Otherwise, ignore neighbor infor- mation. Please tell me which class the center node belongs to? Answer only the class without any other words. Answer:
citation relationship between papers, we need classify the
E.2.5 SFT-AUTO
Pipeline. The auto variant implements comprehensive attack detection and recovery through multi-stage inference with specialized prompt templates. The pseudo-code of the algorithm is pro- vided in A and the related prompts are listed below.
Antakk Detection Prompt Template:
27

---

Published as a conference paper at ICLR 2026
Node Classification with Attack Detection
Question: You are doing node classification in citation graph. Given the content of the center node: (origin.text) and its neighbor information: (neighbor_texx sotboortee, classify the center node into (pun.classes] classes: (classes) or "ttaceattacked.. The center node may be attacked. If class is unclear or differs from most its neighbors, classify as "text attackedd instead. Please tell me which class the center node belongs to? Answer only the class name without any other words. Answer:
Recovery Prompt Template (Neighbor-Only):
Recovery Using Neighbor Information Only
Question: You are doing node classification task citation graph. Based only on neighbor information: ibbor.tt..t.t ). each node represents a paper and the relationship represents the citation relationship between papers, we need to classify the center node into thmmcclasses classes: {classes} }. Please predict the class of the center node using only neighbor information, Answer only the class name without any other words. Answer:
Algorithm 1: Auto Variant Framework for Adversarial Attack Detection and Recovery
Input:
Graph data G = (V, E, X), training nodes Visain test nodes Vies, similarity threshold Output: Trained model M, final predictions Ypred Training Phase:;
min 0.15) // Adaptive attack ratio
Sattack & TREBARENORRALSAMMPLES/
Snormal
Srecovery GENERLATETERRTAAARKKKSAAAEESS Virains r);
Sall f- Snormal U Satcck U i
M (RAINMODELLSA));
Inference Phase::
Trest t- 0, Ismeet 0;
// Stage 1: Attack Detection
foreach U E Vieer do
W///2 then
11
I < Iamua Uti);
if M(;; = "text_ttteeeee attacked" then
13
14
L Trext +- Ireat (i):
// Stage 2: Recovery and Final Prediction
foreach U; E Viest do
16
i Ires then
Ypedli] +- M(neighborssooly/fff ooll:(ss).oolll,))))))
18
else i E Igmeer then
Y yprea() [i] +- M(U, filtered neighbors(vs, 7));
29
else
Y yprel[i] [i] + M(v,.NG):
21
return M. Ypred
F RESULTS AGAINST WTGIA
In this section, we present results against Text-level GIA and WTGIA attacks.
We introduced the WTGIA methodology and basic settings in Section D.3 Specifically, evaluate on three datasets: Cora, CiteSeer, and PubMed, following the original paper. We present results for two perturbation rates: ptb rate 0.2 and pth rate 0.4.
28

---

Published as a conference paper at ICLR 2026
At ptb_rate 0.2, WTGIA introduces the same number of edges structural evasion attacks. Considering that in GMA, each edge modification affects two nodes the original graph, we also conduct experiments ptb rate 0.4, where the number of affected edges approximately equals that of GMA. By aligning the attack budgets between GMA and Text-level GIA, we can study the attack strength of Text-level GIA compared GMA.
Following our other experiments, we evaluate both GNN and RGNN models using three embedding types: BoW, MiniLM, and RoBERTa. Note that WTGIA inherently uses BoW as the victim text encoder. In this experiment, we investigate how different text encoders affect defense performance against WTGIA.
Table 10: WTGIA Attacked Test Accuracy (Perturb ratio being 20%)
Cora MiniLM
CiteSeer MiniLM
PubMed MiniLM
Method
BoW
RoBERTa
BoW
RoBERTa
BoW
RoBERTa
GCN
59.29
83.46
85.36
49.22
71.73
74.03
77.49
84.65
83.95
GAT
57.56
80.87
82.60
45.61
66.30
67.29
74.02
74.99
82.21
APPNP
60.95
84.13
86.41
65.62
76.02
74.66
85.07
89.03
91.22
GCORN
53.38
83.83
81.67
47.49
73.20
72.47
61.15
79.74
80.92
GPRGNN
69.43
83.76
84.93
64.63
73.56
74.56
83.99
89.44
90.78
GRAND
59.78
84.62
86.78
56.22
75.76
76.38
80.03
86.49
89.47
EvenNet
78.78
82.53
82.60
68.86
73.77
73.41
83.64
86.66
89.19
FlasticGNN
60.02
84.50
85.42
54.49
73.88
73.30
78.25
79.68
85.86
RobustGCN
78.91
83.64
85.61
68.34
73.77
73.98
81.63
79.44
82.06
GNNGuard
82,90
83.15
65.46
73.72
82.40
So
80.87
84.87
83.70
71.79
75.24
74.71
86.32
89.54
91.20
NoisyGCN
63.78
83.15
85.06
49.63
72.10
73.30
78.26
85.24
86.03
RUNG
79.52
83.27
83.95
70.27
74.03
73.56
85.68
89.64
90.99
GraphGPT
74.97
72.83
92.84
LLaGA
83.21
72.36
89.76
SFT-neighbor
79.89
73.51
94.74
Table 11: WTGIA Attacked Test Accuracy (Perturb ratio being 40%)
Cora Minil.M
CiteSeer MiniL.
PubMed MiniL.M
Method
BoW
RoBERTa
BoW
RoBERTa
BoW
RoBERTa
GCN
47.91
82.16
84.99
33.28
70.01
72.73
75.77
79.54
79.09
GAT
47.23
76.32
80.44
27.90
60.92
62.38
66.59
63.28
72.74
APPNP
50.55
84.01
85.67
60.29
75.39
74.61
86.07
88.88
91.18
GCORN
32.10
82.23
81.00
26.12
70.32
67.08
53.20
77.50
77.49
GPRGNN
64.45
82,78
83.70
52.87
73.20
72.94
84.04
89.01
90.64
GRAND
48.03
84.44
86.10
44.36
74.97
74.29
76.36
86.16
88.90
EvenNet
73.37
81.06
81.49
66.25
73.51
73.30
77.50
81.52
86,51
ElasticGNN
46.19
83.27
83.64
37.57
72.52
71.89
75.57
70.76
80.49
RobustGCN
75.03
81.80
85.85
62.12
73.35
72.99
75.97
70.62
75.52
GNNGuard
61.32
82.78
83.76
61.86
75.34
81.11
90.24
Sof
78.97
84.38
83.95
70.79
74.92
74.61
86.17
89.77
90,99
NoisyGCN
52.46
82.16
83.76
34.12
71.26
71.89
75.22
81.03
81.67
RUNG
79.83
82.66
84.19
68.13
73.46
74.76
85.81
89.77
91.11
GraphGPT
71.16
70.22
92.29
L.LaGA
81.86
68.23
89.32
SFT-ncighbor
77.80
73.20
94.62
The experimental results are presented in Table Table [1 We have the following discoveries: Cross-Modal Attack Transferability: WTGIA exhibits significantly stronger attack performance against BoW-ba models compared to advanced text encoders like MiniLM and RoBERTa, even under a strong budget (40%). This pronounced performance gap highlights the limited transfcrability of text-level GIAs across different embeddings, suggesting that WTGIA overfits the victim's 's specific encoder (BoW). In contrast, structural attacks display slightly more consistent degradation across text representations, underscoring the mroality-speccinn nature of text-level perturbations.
Vulnerability of Text-Aware Models: Text-level perturbations disproportionately impact models reliant textual features, particularly M.L.-based approaches like SFT-neighbor. On the Cora
29

---

Published as a conference paper at ICLR 2026
Text Embedding Type
11
bow
#11
Mistral-7B
#10
MiniLM
Ranking (lower better)
roberta
#9
#8
Suboplimal
Good
#4
#3
2
Excellent
#2
#1
Cora
CiteSeer
PubMed
WikiCS
History
Photo
Computer
ArXiv
Dataset
Figure 7: GNNGuard performance ranking across different text embeddings under structure attacks. The bar chart displays ranking positions (lower is better) for each embedding type across eight benchmark datasets in the inductive setting with a perturbation rate of 0.2.
dataset, SFT-neighbor maintains competitive accuracy (82%) under structural attacks but suffers greater degradation under WTGIA.
G WHY GNNGUARD EXCELS: UNDERSTANDING AND IMPROVING
In the main text, observe that GNNGuard achieves remarkable performance improvements. This raises a fundamental question: what drives GNNGuard's 's exceptional effectiveness? In this section, provide comprehensive analysis dissect the underlying mechanisms.
G.1 RESULTS OF GNNGUARD UNDER DIFFERENT TEXT ENCODERS
In Figure plot the performance of GNNGuard against structure evasion attacks using different text encoders. We exclude the results on Instagram and Reddit because the performance differences among all methods these datasets
significant. In the ranking, remove the GraphLLM methods because they do not necessarily depend on embeddings. The results reveal substantial vari- ations in defensive effectiveness depending the embedding choice. In previous works (Zhang & Zitmik 2020 Lei et al. 2022 Mujkanovic et al. 2022 Hou et al.) 2024). GNNGuard is evaluated us- ing embeddings like BoW and TF-IDF, where ranking indeed low as shown in the table. How- ever, when switching to advanced language model embeddings like MiniL.M and RoBERTa, its rank- ing improves significantly. For instance, on Cora, when using embeddings like BoW and Mistral- 7B, its ranking falls within the suboptimal region, but when employing MiniLM and RoBERTa, it demonstrates improved ranking relative to other RGNNs and GNNs, indicating that text encoders significantly influence GNNGuard's ranking.
G.2 DIFFERENCE BETWEEN TEXT- ENCODERS
To understand why the text encoders significantly affect the performance of GNNGuard, system- atically evaluate the effectiveness different text embedding methods for similarity- based edge fil- tering, which is essential for its defense mechanism. Our analysis compares BoW, TF-ID, Mistral- 7B, RoBERTa, and MiniLM embeddings across multiple graph datasets to identify which represen- tations best distinguish intra-class from inter-class edges.
30

---

Published as a conference paper at ICLR 2026
Embedding Comparison photo
Preserve-Filter Trade Curves
Distribution Comparison
3.5
60
00
1.5
clas Traseration fatk
Soniarit
Embediding Quality Metricss (Higher is Better)
dus E4
04-
241
Threshold Effectivanass
Emboddinp
Intra pib
Inter pEo
AUC
DDW
644022024
6438:2.02
Male
TMDP
026322..8
0323
CA-
MISTRAL-TD
6.601005
6.575.3.4
0530
ROBIRTTA
6:100.0:8
0/49700.5
Threstall
Figure 8: Comprehensive embedding comparison for the Photo dataset. (a) Preserve-filter trade-off curves showing the Pareto frontier between intra-class preservation and inter-class filtering rates; (b) KDE-smoothed similarity distributions revealing the separation between intra-class (solid) and inter-class (dashed) edges; (c) Quantitative quality metrics including separation score, AUC, dis- criminability, threshold gap, and non-overlap score; (d) Threshold effectiveness curves illustrating how preservation and filtering rates vary with similarity thresholds; (e) Summary statistics table pre- senting mean similaritics and standard deviations for each embedding type.
Figure 8 presents our comprehensive analysis framework using the Photo dataset as an example. The mu multi-panel visualization reveals critical insights about embedding effectiveness:
Preserve-Filter Trade-off (Panel a): Each curve represents an embedding's s ability to simultane- ously preserve intra-class edges while filtering inter-class edges across 101 similarity thresholds. The curves are generated by computing, for each threshold т E [0. 1]. the fraction of intra-class edges with similarity 2 (x-axis) and inter-class edges with similarity < (y-axis). Embeddings with curves closer to the upper-left corner exhibit superior discriminative capacity. In the Photo dataset, RoBERTa's curve dominates, achieving 80% inter-class filtering while maintaining 40% intra-class preservation.
Similarity Distributions (Panel b): Kernel density estimation with Gaussian kernels selected via Scott's rule) visualizes the probability density functions of cosine similarities. The aggre- gation across three random seeds ensures robustness. For Photo, MiniL.,, and RoBERTa exhibit clear bimodal separation with intra-class similarities and inter-class differences, while others show substantial overlap with both distributions.
Quality Metries (Panel c): Five metries quantify embedding effectiveness:
Separation Score: Cohen's = (Finam - Miner)) / (o
intra +
1/2
AUC Score: Area under the ROC curve, treating edge classification binary prediction task Discriminability: max, (PPssiminn 2 r) + P(sim < /
Threshold Gap: Q20 (simmma) - Q msim where Qp denotes percentile
Non-ovvrrlap: Σ, min minn/rma (i), himer (i)) Ar using 50-bin histograms
31

---

Published as a conference paper at ICLR 2026
Embedding Comparison cora
Preserve-Filee Trade Curves
Distribution Comparison
2.5
6.0
00
83
1A
clas Traseration Rate
Suniarit
Embediding Quality Metrics (Higher is Better)
9.66
A22
Threshold Effectivannsss
Emboddinp
Intra pob
Inter pEe
AUC
DDW
0.1172021
646023.55
Make
TMDP
024622.24
CA-
MISTRAL-TD
6.712.0:8
6.576x3.7
0576
0:50020:5
6:420:9
ROBIRTTA
6.512.016
0/431.0.04
Threstall
Figure 9: Comprehensive embedding comparison for the Cora dataset. (a) Preserve-filter trade-off curves showing the Pareto frontier between intra-class preservation and inter-class filtering rates; (b) KDE-smoothed similarity distributions revealing the separation between intra-class (solid) and inter-class (dashed) edges; (c) Quantitative quality metrics including separation score, AUC, dis- criminability, threshold gap, and non-overlap score; (d) Threshold effectiveness curves illustrating how preservation and filtering rates vary with similarity thresholds; (e) Summary statistics table pre- senting mean similaritics and standard deviations for each embedding type.
Threshold Effectiveness (Panel d): This analysis reveals the operational characteristies of each embedding. The solid lines show Pssim 2 r) while dashed lines show P(sim < r) as functions of threshold т. The vertical separation between paired curves indicates discriminative power at each threshold.
Statistical Summary (Panel e):
This analysis framework demonstrates that contextual embeddings (RoBERTa, MiniLM) provide su- perior edge discrimination compared sparse representations. While all GNNs and RGNNs benefit from better embeddings in the classification task, GNNGuard enjoys more protection against struc- tural attacks with better representations due to the better distinguishability of better embedding. Another example on the Cora dataset is provided in Figure
G.3 GUARDUAL: ROBUSTNESS AGAINST TEST-TIME STRUCTURAL ATTACKS
Despite achieving promising results with advanced embeddings, GNNGuard exhibits several limi- tations in practice. First, the current threshold selection relies validation set performance, which leads to overly conservative thresholds due to the inherent performance-robusse validation data. Second, in real-world scenarios where training data integrity be more readily ensured, applying aggressive thresholds during training risks excessive edge filtering, thereby de- grading model performance benign graphs.
trade-off on clean
To address these limitations, we introduce Guardual, an adaptive defense mechanism that employs dual similarity thresholds to balance training stability with robust defense capabilities. This method
32

---

Published as a conference paper at ICLR 2026
uses the optimal threshold for preserving benign graph structure during training, which differs from the threshold needed for effective adversarial filtering during inference.
G.3.1 DUAL-THRESHOLD DESIGN
Guardual employs complementary thresholds optimized for different phases of model deploy- ment:
Conservative Threshold (Training): This threshold prioritizes preserving intra-class edges to maintain graph connectivity and training stability. Computed using weighted objective function: scoreconsevative = 0.7 0.7- Prreeeeee preserve +0.3- Pitee where preserve represents the fraction of intra-class edges retained and Piterr denotes the fraction of inter-class edges removed. The 70-30 weighting ensures that sufficient graph structure remains intact during the learning phase, preventing performance degradation from excessive edge pruning.
During inference, the model switches balanced threshold that equally weights preservation and filtering: scorenalanced = 0.5 preserve + 0.5 Pater- This equal weighting provides stronger defense against adversarial edges while accepting slightly reduced intra-class preservation, as gradient flow is no longer concern during evaluation.
Balanced Threshold (Testing):
Given specific embeddings, we can pre-compute all scores and obtain training/test thresholds. The thresholds for Guardual using RoBERTa embeddings are listed in Table 12
Table 12: Dual thresholds employed by Guardual across different datasets. Conservative thresholds prioritize edge preservation during training, while balanced thresholds enhance adversarial filtering during testing.
Dataset
Training Threshold
Testing Threshold (Balanced)
(Conservative)
Cora
0.250
0.503
CiteSeer
0.320
0.580
PubMed
0.360
0.633
WikiCS
0.283
0.433
Instagram
0.000
0.471
Reddit
0.000
0.177
History
0.260
0.457
Photo
0.000
0.476
Computer
0.000
0.457
ArXiv 0.320
0.540
G.3.2 RESULTS OF GUARDUAL
The results presented in Figure 10 We compared to GNNGuard, Guardual achieves general improvement. In Computer and Photo datasets (highlighted in red), Guardual demonstrates the most significant enhancements, with improvements of +8.23% and +10.74% respectively. As shown in the result performance, it becomse the most robust RGNN against structural evasion attacks, despite its simple and effective design.
that, although it removes hyperparameter
H ADAPTIVE ATTACKS
H.1 ADAPTIVE ATTACKS AGAINST GNNGUARD
Following Mujkanovic et al. (2022), we investigate adaptive attacks targeting GNNGuard, leverag- ing its robust performance against structural attacks. We employ a modified PGD attack Xu et al. 2211)) termed PGDGuard, which restricts the attack search space to edges with similarity exceed- ing a threshold e. All edge additions or removals satisfy this similarity constraint. We fix the attack embedding to RoBERTa and evaluate PGDGuard across values of 0.0, 0.3, 0.5, and 0.7, assess- ing the performance of GNN and RGNN models under these conditions. Results are presented in Figure [1
33

---

Published as a conference paper at ICLR 2026
Performance Comparison:
GuardDual vs GNNGuard Ranking Advantage: GuardDual vs GNNGuard
(RoBERTa Embedding)
(Higher Better Improvement)
Ranking Imp invrmement (GuardDual better than CNNGuard)
GNNGuard
3
+0.2%
Accuracy (%)
2
+0.7%
+10.7%
Cora
Citeseer
PobMed
Wikcs
Histey
Photo
Computar Far
Cor
CiteSoor
PubMad
Wilcs
History
Phcke
Computar
Ar30v
Dataset
Dataset
Figure 10: Comprehensive comparison between GuardDual and GNNGuard under RoBERTa em-
bedding for structure attack defense. Left subplot shows absolute accuracy performance with Guard- Dual consistently outperforming GNNGuard across most datasets. Right subplot displays ranking improvements, where positive values indicate GuardDual's superior competitive position.
Evasion Accuracy Attack Threshold, (ptb rate=0.2, emb=roberta-robertae
CiteSeer
Publec Baseline Methods
Baselline Methods
Baseline Methods
Baseline Methods
apoep
3.14
ovennct
gcom
gergen
Eonden
grand
noiey_ath
mbusiien
Throndd
Attre TanreTanetad CitaSaer Mathods
Thaeheld Publedd
Abbck Theechils
Cora
Wikics
GNNGward Methods
CNNGGaard
GNNGuard Methods
2.13
8.2
(Mlioue Cer awd
Atack Threandd
Atlacc Toraaaol
Atlack Threshuld
Attack Thrcshals
Figure 11: Evasion accuracy vs attack threshold for different defense methods with perturbation rate 0.2 and embedding types roberta.
Key observations summarized as follows:
U-Shaped Performance Curve for GNNGuard: GNNGuard exhibits a U-shaped trend in evasion accuracy with respect to PGDGuard's attack threshold e. When e significantly de- viates from GNNGuard's filtering threshold (either lower or higher), the attack's 's effective- ness diminishes. However, when e closely aligns with GNNGuard's threshold, the attack achieves optimal evasion, indicating trade-off: at lower PGDGuard's perturbations lack sufficient potency, while at higher GNNGuard's filtering mechanism effectively mitigates the attack.
Trade-Off's for Other Defense Methods: While increasing the attack threshold may am- plify PGDGuard's impact on GNNGuard, generally enhances the performance other defense methods. On datasets like Cora and WikiCS, attacks tailored to GNNGuard's threshold tend to weaken against alternative defenses, posing significant challenges for attackers aiming generalize across diverse defense strategies.
34

---

Published as a conference paper at ICLR 2026
Table 13: Performance (%) for PGD-structure on GNNs (GCN, GRAND, RUNG). Rows attacker embeddings; columns defender embeddings.
CiteSeer
PubMed
Model/ Datiset
BoW
MinLM
RoBERTa
BoW
MiniLM
RoBERTa
BeW
MiniLM
RoBERTa
BoW
MiniLM
RoBERTa
GCV
Allacker BoW RoBERTa
66.11
72.39
73.31
51.86
61.31
62.70
80.12
83.87
82.92
20.39
30.11
31.51
47.13
71.33
70.85
69.43
63.95
63.74
63.58
82.29
21.50
GRAND
Attacker BoW
71.89
78.60
79.89
64,00
70.22
70.74
82.45
83.88
86.41
48.
66,75
71,86
Attacker MiniLM
15.28
70.91
77.06
64,79
64.99
66.88
84,02
83.43
86.00
96
53.57
67.01
75.40
76.51
70.43
RUNG
Attacker BoW
78.04
83.64
84.56
67.97
73.46
73.30
85.70
89.78
90.72
00
79.95
82.73
Attacker MiniLM
73.04
83,70
83.83
67.92
13.35
73.93
85.87
89.53
90.61
76.18
80.26
82.53
Table 14: Perfomrance (%) for PGD-structure on LLaGA and SFT-Neighbor. Rows = attacker
embeddings; columns datasets.
Model Attacker
Cora
CiteSeer
PubMed
WikiCS
LLaGA
BoW
75.21 72.88
66.35 67.24
87.38
66.99
RoBERTa
86.70
60.47
SFT-Neighbor BoW
82.59
74.24
92.29
84.05
RoBERTa 81.24
71.84
94.72
86.19
Dataset-Specific Exceptions: Despite the general trade-off, notable exceptions arise, par- ticularly on PubMed at 0.5. Here, PGDGuard achieves superior attack performance across all methods. This attributed to PubMed's fine-grained classification, where em- bedding similarities (metric in subplot of Figure 8) for both intra-class and inter-class nodes cluster around 0.6. Selecting e = 0.5 effectively targets potentially harmful edges, highlighting the efficacy of dataset-specific, embedding-awee -wwrr aware attack strategies.
These findings underscore the nuanced interplay between attack thresholds and defense mechanisms, emphasizing the importance of aligning attack strategies with dataset-specific embedding character- isties maximize evasion effectiveness.
H.2 ADAPTIVE ATTACKS ON EMBEDDING TRANSFERABILITY
Setup. In the main experiments, we initially used BoW as the victim's text embedding for struc- tural evasion attacks. To model adaptive attackers and embedding aware defenders, we vary the text encoder used the victim model PGD among (BoW, MiniLM, RoBERTa) while the defender may defend with [BoW, MiniLM, RoBERTa). We evaluate GCN, GRAND, RUNG, LLaGA, and SFT-Neighbor on datasets Cora, CiteSeer, PubMed, and WikiCS.
The results are shown in Table 13 and Table 14
We have the following findings:
Embedding Match Helps the Attacker. Across models, the attack performance is highest when the attacker and defender use the same embedding. If embedding mismatched, even from advanced to BoW, the attack performance significantly degrades. In fact, when the surrogate text encoder LM, BoW as the defender's embedding can be strong.
Transfer is Stronger within LM-family. MiniLM ++ RoBERTa transfers better than BoW LMM
Transferability to GraphLLMs Varies among Datasets. LLaGA, which takes RoBERTa the text encoder, also suffers more if the attacker uses RoBERTa the surrogate. How- ever, for SFT. the results vary among datasets. This observation means that the effective text encoder for attackers could depend the dataset's characteristics and the victim model.
35

---

Published as a conference paper at ICLR 2026
I ABLATION STUDY FOR SFT VARIANTS
In this subsection, we conduct an ablation study to analyze the impact of different neighbor selection strategies and prompt templates our SFT variants. We examine the effectiveness of degree-bart based neighbor selection versus random selection, and investigate the influence of incorporating label in- formation in the prompting strategy.
1.1 IMPACT OF DIFFERENT PROMPT TEMPLATES
Due to context length limitations, currently, we feed nodes' neighbors with the top degree as repre- sentatives in the prompt. In this subsection, conduct ablation study examine the impact of randomly selecting neighbors.
1.1.1 DEGREE-BANE BARSED VS RANDOM NEIGHBOR SELECTION
Table 15: Comparison between degree-based (SFT-neighbor) and random (SFT-rand) neighbor se- lection strategies across different attack scenarios. Bolded values indicate the better performance between the two methods for each dataset and scenario.
Method
Cora
CiteSeer
PubMed
WikiCS
Instugram
Reddit
History
Clean Results Inductive Splir
SFT-neighbor
88.25 1.29
76.17
1.81
95.08 + 0,51
87.75 + 0.46
69.24 + 0.54
66.74 +: 1.06
86.81 = 0.77 86.64 = 0.45
SFT-rand
87.27 2.30
71.27 = 0.47
95.05 + 0.20
87.72 + 0.58
69.96 + 0.72
68.46 + 0.09
Structure Antck Results on Inductive Splir
SFT-neighbor SFT-rand
1.94 79.09
82.35
71,53
1.86
94.73 0.41
86.00
1.40
68.25 + 0.20 68.50
62.29 +: 3.31
85.98 0,51
71.42 0.48
94.79 0.17
85.19
0.68
0.71
65.23 1.16
Text Attack Results Inductive Split
SFT-neighhor
75.65
1.33
43.84
2.14
72.27 3.53
51.53
1.24
64.33
1.46
65.52 +: 1.24
64.84 4
0.98
SFT-rand 78.60
1.78
47.08
2.76
73.22 + 1.74
50.93 + 0.82
61.71 + 1.71
66.58 +: 0.54
68.83 6.35
As shown in Table T5] the comparison between degree-based and random neighbor selection reveals distinct performance patterns across evaluation scenarios. Under clean conditions, SFT-neighbor demonstrates marginal advantages on most datasets. Interestingly. under text attack scenarios, SFT- rand exhibits superior robustmess on several datasets, including Cora (78.60% 75.65%) and Cite- Seer (47.00 9.%0 vs 43. 13.84%). However, under structural attacks, SFT-rand is more vulnerable, exhibit- ing larger performance drops. In conclusion, trade-offs also exist between the two variants.
1.1.2 LABEL INFORMATION IN PROMPTING
In (Wang et al. 2025b), incorporating label information in the prompt can yield better results for specific scenarios. We test the performance of such prompt clean datasets and against adversar- ial attacks. As shown in Table [6 incorporating explicit label information JSFT-neighbor-labed often leads to unstable performance, particularly where severe degradation is observed across all scenarios. This lack of robustmess and dataset- specific instability indicates potential overfitting or incompatibility with certain graph structures or data distributions. Consequently, label-enhanced prompting is not adopted due to its inconsistent performance.
certain datasets like Instagram and Reddit,
1.2 IMPACT OF DIFFERENT L.LM BACKBONES
In the main paper. paper (Wu et al. 2025). In this subsection, we present the results of SET with neighbor-aware prompts using different L.M backbones.
Mistral-7B LLM backbone it shows the best performance in
We use LLMs Mistral-7B (Jiang et al.) 2023), Ministral-Bi 8B MMistral Al Team 2024), LLama3.1 8B (Dubey et al. 2024) and Qwen3-8B (Yang al. 2025). The results presented in Ta-
bles 17 18
and
The results demonstrate that:
36

---

Published as a conference paper at ICLR 2026
Table 16: Comparison between standard degree-based selection (SFT-neighhor) and label-enhanced prompting (SFT-neighbor-labe across different attack scenarios, Bolded values indicate the better performance between the two methods for each dataset and scenario. Red values indicate significant performance degradation.
Method
Cora
CiteSeer
PubMed
WikiCS
Instagram
Reddit
History
Clean Results on Inductive Splii
SFT-ncighbor
88.25 1.29
76.17
95.08 0.51
87.75
0.46
69.24
66.74 1.06
86.81
0.77
SFT-neighbor-label
87,33 2.50
77.07 + 0.72
94,80 + 0.44
87.75 0.66
35.54 3.54
14,08 + 0.59
86.81 + 0.69
Stracture Attack Results on Inductive Split
Se---niighhor
71.53
SFT-neiglboo-label
82.54 +: 1.67
73.35 # 1,03
94.41 + 0.38
86.28
0.15
45.84 1: 2.23
22.42 d: 2.01
86.00 0.78
Text Attack Results on Inductive Split
SFT neighhor
75.65 1.33
43.84 #: 2.14
72.27
3.53
51.53
1.24
64.33 :: 1.46
65.52 + 1.24
64.84
0.98
SFT-ncighbor-labll
64,51
7.10
41.80 + 0.77
74.97
4.68
50.17 0.58
34.64 2.11
13.91 + 0.59
64.58 3.41
Table 17: Clean performance of SFT with neighbor- aware prompt in the inductive setting
LLM
cora
CiteSeer
pubmed
wikics
history
Mistral-7B
88.25 + 1.29
76.17 + 1.81
95.08 + 0.51
87.75 + 0.46
86.81 + 0.77
Ministral-8B
86.29 0.91
76.70
0.55
95.50
0.08
87.28 = 0.34
86.57 = 0.85
Llama3-8B
86.10 + 0.93
77.43 1.18
95.38
+ 0.15
86.33 + 0.15
86.68 + 0.78
Qwen3-8B
85.55 0.95
77.07
1.49
95.18
0.37
86.17 0.91
86.08 + 0.82
Table 18: SFT with neighbor prompt against structure attacks in the inductive setting.
LLM
cora
CiteSeer
pubmed
wikics
history
Mistral-7B
82.35 + 1.94
71.53 - 1.86
94.73 + 0.41
86.00 + 1.40
85.98 + 0.51
Ministral-8B
79.64 1.87
74.30 0.98
95.23 0.07
85.97
0.91
86.06 + 0.72
Llama3-8B
79.15 + 1.12
74.34 0.48
95.00 0.14
84.98 + 1.01
86.08 1 0.69
Qwen3-8B
77.92 + 1.68
72.94 = 0.79
94.77 = 0.49
84.73 1.34
85.26 = 0.70
Table 19: SFT with neighbor prompt against text attacks in the inductive setting.
LLM
cora
CiteSeer
pubmed
wikics
history
Mistral-77 -B
75.65 + 1.33
43.84 + 2.14
72.27 + 3.53
51.53 + 1.24
64.84 + 0.98
Ministral-8B
68.76
1.77
42.11 1.02
71.02
1.32
49.95 + 0.44
55.15 + 3.43
Llama3-8B
69.74 + 3.81
43.37 2.81
72.19 + 1.67
49.58 - 0.42
57.82 + 3.37
Qwen3-8B
74.85
2.33
44.56 2.69
71.85 + 0.56
49.44 + 0.41
63.13 + 3.19
Mistral-7B consistently achieves the best performance across most datasets and settings, validating our choice of backbone in the main experiments
Post-attack performance generally follows the same trends as clean performance, with models maintaining their relative advantages- instance, Mistral-7B preserves its su- periority Cora across all attack scenarios
Minor variations exist in specific contexts, such Cora and History datasets under textual attacks, where both Mistral-7B and Qwen3-8B demonstrate stronger robustness, though overall differences remain modest across backbones.
37

---

Published as a conference paper at ICLR 2026
J FULL EXPERIMENT RESULTS
J.1 OVERVIEW AND CLARIFICATION OF RANK-BASED EVALUATION
The full results provided in Section J.2 and Section J33 In Section J.4 include results against
a smaller perturb ratio. We can see that compared to the main experiments, the attack effectiveness degrades.
In the main paper, we rely primarily on rank-based evaluation for the following reasons:
Per-dataset plots are dense and difficult to read within the limited space of the main paper. Lines with similar performance tend to mix up.
Averaging raw accuracies across datasets can be misleading due scale differences and missing results on large-scale datasets, whereas rank provides a normalized, dataset- agnostic comparison.
Raw accuracies are heavily influenced by clean accuracy, while rank mitigates such biases. Rank-based evaluation thus offers clearer and more balanced summary of robustness across datasets.
To recover the rank-related results in the main paper, the procedure as follows:
1. For each dataset, all methods with valid performance values are collected. A dash in the tables (-) indicates method was not applicable due to OOM or scalability issues.
2. Methods are sorted within each dataset to determine their rank.
3. The final rank is the average of method's ' ranks across all datasets where it has values.
For example, a method with ranks (1, 2,3) has final rank 2, while a method with ranks (1, 2, -) has a final rank of 1.5. Note that within each figure, only the methods included are considered during ranking.
J.2
GNN AND RGNN RESULTS
J.2.1 CLEAN, INDUCTIVE
Results are in Tables 20
23
Table 20: Clean test accuracy under the inductive setting. (emb=BoW)
PabMed
GCN
35.98
1.36
35355.55 = 1:94
56.44
0.25
51.92
1.29
63.05 = 0.49
50.22 = 0.82
51.973 =: 0.13
24.23 0:17
51.75 = 0.23
71.35 + 0.00
5.40
GAT
86.22 1.36
75.5%
0.33
56 72
0.21
82.40
1102
64.77
1.37
51.31
1.15
52.07 + 0.53
84.75
0.1
55.00 0.22
11.70 2 0.00
3.90
0.31
63.00
11.19
31.11 00.5
000
CIRIGNN
RouastEN
15.37
56.96 1136
82.85 110
66.74
0:34
61.53 0.57
67.67 0.11
08.30
0.00
5.50
OCORN
01.33 1 1.48
13.35 = 0.59
06 0.35
81.25 1:33
64.5 2 0.45
65.81
9.58
10 0:34
52.4 015
64.53 0.09
09:6622 0.00
7.10
05.35 1-21
23.25
1.36
86 0.20
81.83 0.31
63.12 0.43
51.5-1 0.31
$2.20
0.35
$4.35 0.16
$5.75 0.11
71.25 0.00
5,00
GRAND
1:75
52.05 0.45
$1.99 0.19
79.6
83.78
0.00
SolmesiiaCCC
13.35
ParaNer
84.1 1:41
22.52
0:700
67 1m
8100
0156
65.34 0.0.6
60.36
81
0.99
8461 0.0
$7.86 0.18
11.14 0.000
5.80
ReetsCNN
86.19
1.97
71.17 0.77
57
0111
KL.1 11.9
65.35
1.04
61.62
0.41
K1.71
0:40
5505 018
58.00
8.13
72344 6.80
GNNGGaa
02.29 1.23
69.55 = 0:98
56.24 0.32
75.05
0.72
0335
0364
0.33
78005
+ 0.38
77:12
75.87
- 0.35
70.40
10.00
Table 21: Clean test accuracy under the inductive setting. (emb=Mistral-79)
Method
Cors
CheSeer
PutMee
WiiCS
Rodii
Photo
Aioo
CCN
85.54
1.90
15.44
18 34
088
K141
11:W
65.49
1 0:30
58.10
5.04
54 24
1148
6164
0:51
68.35
0.16
34
0.00
6,00
1.01
0.93
61.19
0:1
55:51
GPRGGN
77.12
92
86.50
61.75 0.55
$5.50
5432
59.11 8.75
8.75
45.05
1 3:30
65.01 1 7.16
22.01 5590
64.26 a 0.33
51.8-1052 6.2
56
045
-2.14
0.1
25.89 6.15
335 110
11.0
OCORN
95.15 1.95
78.15
0.78
00:30 0.39
83,90 10.9
65.15 0.35
68.28 0.58
88.26
0.31
86.36 0.27
$7.87 - 6.25
75.02 000
4.0
NuSyOUN
1.30
75.18
65
68.33
$8.44
0.0
Sottndiusttn
1.00
13.04
91 0:18
81.05 3.1
ErcaNes
35.29:11.00
25.50:20..0 0.30
90.77 0.6
0.5
69.34 0.24
$4.91 0.300
$4.00 0.5
85
0.20
85.34 0,62
14.12.4:000
4.00
BloBoGNN
05.25 1.30 1.30
0-0
50.33 0.46
96.0
68.34 0.47
40.95 0.31
5000 1000
85 0.46
$5.96 0.44
76009 0,00
4.20
CINNEaannt
21:40-100 0.24
74.15 0.13
0030 075
69:12..00
3.90
38

---

Published as a conference paper at ICLR 2026
Table 22: Clean test accuracy under the inductive setting. (emb=Minil.M)
Cora
PalMeci
Isasgram
Rodai
Hinaes
Phato
Compater
Ava
15.76
0.51
83:01
65.06
54.57
0.36
0.02
85.05
13.56 4-000
GAT
87.33 1.58
14,57 = 0.85
57.53
0.08
53.27 0.31
(7.11 0.25
35.0:: 0.55
53.54 a 0.53
56
14.4 0:4
09.10=0.11 0.13
75.31 # +:000
6.35
APPN2
0403 133
15.76 0:47
50 0.32
K3 11.5
0538 2005
58.85 0.50
54.23 + 0.59
1.16
89:29
15.71 +:000
5.0
CEMRUIN
1.87
80.06 0.35
63:00
83.12
17.5
T1 000
OCORN
16.07
0.05
K3.51
6462
56.72 8:47
0:21
55.84
14.35 0.00
5.0
NOIyGUN
65.92 1.77
76.07 x 0:45
59 0:18
54117 110
05:34 =
67.39 9-53
54.54 4
16.1
0.33
89.08 = 6.30
13.57 4-000
520
GRAND
05:41
1.24
77.48 =: 1:24
88.15 0.11
5335 0U0
65.46 0.361:00.31
$4.50 6A4
53.00 2: 0.52
$2.40
0.46
$3.49 = 0.05
72.12 1:000
2.00
SelleediarCCC
1.61
76.55
BreaNe:
73.78 2:000
06.11
17.06
0:30
08.68 0.3.4
63.55 641
6498 IU54
81.20 0.24
18.66
7582- 0.80
160
07:04 14
75.08
0.46
88.88
0:06
W173
60:05
104
56.83 0.00
12.0
0.15
74.00-11
0.2
79.01 0.04
71.35 1:0000
11.00
RUNG
64.75
1,65
73.46
= 0.47
50.78
0.14
$1.4 = 0.38
63.51
0.38
10.17
Table 23: Clean test accuracy under the inductive setting, (emb=RoBERTa)
Insogram
CCN
87.76 1:51
15.00 105
58 To
0.25
6036
11.11
06.75 x 0.76
16
0.74
65:003
4: 0:31
36-46-1
0.76
89.36 - 6.15
15.38
0:00
6.20
81:70-
76.19
0:08
M4
0.73
54.64
84 60
0.67
0.17
40.70
1-70--0023 6.74
76.00 0.00
5.70
83.79
1:000
GIRGGNN
14,29
0:45
88.25
71:332
RobsofirN
87.20
1.24
94.82 0.949
87 1132
64.57
67.87
0
53.09
0.51
64:1 845
84.70
0.50
56.78 0.14
75.15 0.00
3.40
OCDRN
07:42 1:15
76.38 0.15
8983 0.16
85.45
10.7
65.17
0.53
67.88
848
85.25
0.49
85.4
0.06 89:23 =
67.51
75.00 0.00
6.30
NossGUN
05.01
0.09
75.56 0.5.1
18.75 0.33
54.35
[.61
07.32
0:33
0.77
0.06
-.237-00222
73.35 4-000
6.50
GRAND
So
05:36 2.13
15.71
0:22
65.53
0.55
2:.9
54.7
BscaNe:
05.35 1.18
75.85 0.11
00:04 0.15
83.95
063
67.68
0.65
51.5 6.79
83
0.40
86.35 0.16
90.51 0.21
76.05 0.000
4.20
BlooKNNN
05.31 1.51
75.76
0.32
09:00 0.20
83.49
0.55
67.44
0.00
8381
3 0.57
86.19
2.1922002
98-87
0.08
76.32 6.80
3.80
GNNGRad
0534 114
74.08
0-0.3
90.1 0.11
K3
64/90
1:21
0.31
64
0.49
85107 0188
$3.35
0.06
71.16
12.10
$2.24
85.01
42:17:00000
J.2.2 CLEAN, TRANSDUCTIVE
Results are in Tables 24 25 26
Table 24: Clean test accuracy under the transductive setting. def BoW
(ptb_rate=0.3, atk.emb=Bow,
Method
Cora
CiteSeer
PubMed
WikiCS
Instagram
Reddit
History
Avg Rank
GCN
83.19
0.75
71.32 1 0.83
85.45 1 0.24
80.01 1 0.29
65,97 1 0.09
61.84
0.49
80.14 1: 0.25
6.86
GAT
82.99
1.03
72.30
1 0.56
85.38
1 0.21
79.76
1: 0.35
65.41
+ 0.06
60.73 = 0.30
80.67 :: 0.12
7,86
APPNP
83.69
0.30
72.25
1: 1.10
87.34
1 0.08
80.49
1: 0.33
65.78
1: 0.10
60.78
0.66
80.84 1 0.06
4.14
GPRONN
0.24
0.14
60..7
RobusiGCN
83,77
0.80
71.64
0.66
86.45
0.30
81.15
1: 0.14
65.94
:: 0.31
59.29
0.82
80.95
0.15
5.43
GCORN
77.40
0.60
69.77
1 0.58
84.71
0.32
78.87
1: 0.35
65.43
1: 0.45
66.34
0,08
78.36 1 0.02
11.57
NokeyGNN
83.19
0.12
72.36
0.94
85.75
0.42
79.74
66.77
61.3
GRAND
83.97
0.92
71.71
1 0.14
87.16
1: 0.30
80.71
1: 0.38
65.94
1: 0.27
61.58
1.33
80.35 1 0.27
4.43
SoftmedianGDC
82.77
1.35
71.99
85.15
0.07
74.33
0.49
68.98
0.40
59.67
0.52
78.04
+ 0.08
10.57
EvenNet
82.88
0.56
71.70
1: 0.70
86.50
1: 0.24
80.71
1. 0.31
65.77
1. 0.72
64.61
0.68
80.48 1: 0.07
5.57
ElasticGNN
83.19
0.17
73.14
+ 0.40
87.00
+ 0.17
$0.18
+ 0.27
66.41 + 0.37
60.58
0.47
80.67 + 0.07
5.43
80.31
0.37
71.20
0.28
86.13
77.08
58.79
RUNG
81.91 = 0.59
72.20
0.80
85.57
+ 0.30
78.
0.47
65.55 + 0.23
60.24
0.11
10.17
Casine-GCN
79.48
1.38
69.70
0.92
84.03
0.26
77.61
0.47
64.78
+ 0.50
59.07
0.36
78.26 0.21
14.57
Jaccard-GCN
80.60 = 1.25
69.98
0.82
84.12
+ 0.34
79.11
+ 0.29
66.66
0.13
61.77
0.26
78.44:0..9
10.86
Stable
79.97 0.45
68.29 + 0.67
84.00 + 0.43
78.94 + 0.55
64.66 + 0.51
63.32
0.31
12.83
ProGNN
77.79 0.19
0.93
J.2.3 STRUCTURE ATTACK, INDUCTIVE
Results are in Tables 27
29
28
30
J.2.4 STRUCTURE ATTACK, TRANSDUCTIVE
Results are in Tables 31
32
33
J.2.5 TEXT ATTACK, INDUCTIVE
Results are in Tables 34
35
36
J.2.6 TEXT ATTACK, TRANSDUCTIVE
Results are in Tables 37
38
39
39

---

Published as a conference paper at ICLR 2026
Table 25: Clean test accuracy under the transductive setting. def MiniLL)
(ptb_rate=00. etk_emb-BoW,
Method
Cora
CiteSeer
PubMed
WikiCS
Instagram
Reddit
History
Avg Rank
GCN
84.34 = 0.34
74.32 + 0.88
86.78 + 0.48
81.31 + 0.05
65.67 + 0.33
65.81
= 0.63
82.94 + 0.11
8.43
83.97 1.30
73.86
0.61
85.94
0.35
81.85
0.31
66.56
0.07
63.31
82.65
APPNP
84.33 = 0.79
74.43
0.36
88.36
+ 0.26
81.59
+ 0.28
65.68
+ 0.44
62,54=
= 0.09
83.44
0.10
5.14
GPRGNN
84.31 0.17
73.98+0091
88.04
0.21
81.45
+ 0.23
66.21
+.30
62.34
0.25
82.61 + 0.09
10.00
RobustGCN
84.05 0.51
75. +
86992
+ 0.12
81.82
+: 0.30
66.14
:: 0.41
64.05
0.29
83.18
0.06
5.86
GCORN
82.77 0.80
14.94:000
86.99
+ 0.14
81.07
+ 0.35
66,75
0.15
67.37
0.29
83.12 0.02
7,86
NoK
81.73 0.44
74.11 0.59
87.15 0.23
0.01
67.52
9.00
GRAND
84.35 = 0.53
75.82
+: 0.49
87.38
+: 0.16
81.69
0.22
65,51
+: 0.24
65.02
0.83
83
5.86
SoftmedianGDCC
84.42 0.25
75.47 + 0.45
88
0.30
81.04
0.38
65.88
0.28
63.72
0.29
83,54 + 0.10
4.57
EvenNer
$4.39 = 0.60
74.75
= 0.99
87.45 = 0.23
82.11
0.59
05.60
= 0.23
62.01
0.42
83.28
0.07
5,86
ElasticGNN
84,63 0.15
74.43
+ 0.36
87.69
0.05
81.47 + 0.23
66.77 + 0.31
62,54
14
83
5.43
GNNGuard
82.71 0.29
87.37
81.55
59.29
82.75
RUNG
82.19 = 0.26
73.68 0.20
87.76 + 0.26
81.37
+ 0.01
66.02 + 0.53
61.51 = 0.11
12.67
Cosine-GCN
82.02 0.81
0.33
86.30
1 0.22
81.36 0.09
65.45
0.38
59.37
0.08
82.50 1 0.08
13.45
Jaccard-GCN
83.42 0.19
73.85
0.73
86.30
+ 0.26
80.94
0.16
66.67 0.41
66 0.33
82.30 0.06
11.57
Stable
84,09 0.19
73.68
+: 1.06
86.84
1 0.23
82.53
1: 0.28
65.33 0.54
66.21
0.24
8.83
ProGNN
83.20
0.51
75.34 0.72
8.00
Table 26: Clean test accuracy under the transductive setting. def-emb emb-RoBRRTTT
(ptb_rate=0.3, atk_emb=BoW,
Method
Cora
CiteSerr
PubMed
WikiCS
Instagram
Reddit
History
Avg Rank
GCN
84.03 0.51
73.98
0.70
87.39
0.11
81 85 + 0.46
66.68 + 0.20
63.41
0.12
83.55 + 0.20
10:57
GAT
84.25 0.48
74.19 + 0.40
86.20
+ 0.20
82.05 + 0.25
66.45 + 0.24
62.91
0.19
83.33 + 0.21
12.29
APPNP
85.03 0.24
74.74
0.22
89.13
+ 0.04
82.51 + 0.55
67.48
+ 0.11
63.80
0.15
84.43
+ 0.20
3,43
GPRGNN
85.05 0.36
74.42+ 0.50
89.06
0.28
82.17
67.26
0.13
63.74
84.05
RobusiGCN
83.34 = 0.91
74.55
+ 1.12
87.27
+ 0.07
81.83
0.19
66.62
0.25
62.73
0.74
83.20
- 0.09
12.43
GCORN
84.34 0:61
74.67
1.32
87.44
0.05
82.17
66.46
+ 0.30
67.60
0.18
8381+ 0.10
7,86
NoIsyGCN
84,59 = 0.75
73.69
= 0.77
87.29
+ 0.23
82.12 4: 0.18
66.66
= 0.61
63.87
0.14
83.55
0.16
9.71
GRAND
85.16 0.61
76.06
0.62
89.
+ 0.08
84.16
+ 0.31
66,94
+ 0.47
66. 0.6
84,93 + 0.09
2,00
SofumedianGDC
83.56 0.61
74.11
0.43
0.21
0.67
66.93
EvenNet
84.06 1.02
74.94
+ 0.60
88.99
+ 0.14
83
+ 0.53
67.05
+ 0.16
63.23
0.51
0319
5.29
ElasticGNN
84.88 0.19
74.41
+ 1.05
88.28
1 0.17
82.65
1: 0.25
66.87
+ 0.20
63.17
0.13
83.99 0.18
6.57
GNNGuard
83.22 = 0.55
73.81
+ 0.50
87.98
+ 0.29
82.47
+ 0.19
67.23
0.31
59.39
= 0.39
83.87
0.15
10.14
RUNG
83.42 = 0.64
75.35
1 0.88
N8.86
1: 0.26
82.64
1: 0.35
66.82
1: 0.27
62.55
0.17
8.17
Cosine-GCN
83.25 1.08
73.43
87.05
82.
0.63
66.96
0.21
59.37
83.75 0.20
Juccard GCN
83.54
0.77
72.98
1: 0.42
87.04
1 0.15
81.47
1. 0.42
66.70
1 0.50
63.41
0.12
83.18 1 0.05
12.86
Stable
84.40
0.80
72.70
1.30
86.66
0.27
82.65
1 0.36
66.75
+ 0.26
65.33 0.58
9.00
ProGNN
83.57
0.79
74.91
0.58
Table 27: Accuracy under the inductive/evasion setting against structural attack. (ptb.rate=0.2, atk emb=BoW, def emb=BoW)
Matholi
Cora
Cisckerr
PabMiai
WiLCS
Insterram
Rodei
Hinues
Photo
Compater
Athiv
Ave Kunk
GKN
3.04
56.86 : 1/10
N1
(171
30.90
7:11
0.81
50.47
1.76
41
10:00:33
4: 11:9
24.88
2:443
15:05
6:31
12:66
10:00
11.50
GAT
67.53 2.13
57.31 : 1,07
50.11
12 0.58
39.47
1.00
45.03 2:5
53.83
3.15
40
-4
1.63
51.95
1.37
44.08
= 0.03
39.62
0.00
3.10
APPNP
69.13 2.50
64.37
2 0.99
53.53
0.14
57.37
1.22
35,61
= 2.65
$2.40
2: 2.04
0176
55.21
0.26
41,06=2
0.19
45.12 20.00
5,40
GERGNN
71311 1:23
63:49 0.60
$2:55 0.25
52.64
69/06
1.65
6:.29
0.92
0.10
58:12
SIL18 6.80
GEORN
65.17 2.52
58.52
0.97
81 0.50
54.16
0.21
32.63
1 2.54
59.11
1:33
41.51
1.77
39000
0m6
31.12 0.15
31.99 0.00
3.00
NoiyCINN
06:34 2-67
$1.49
0:73
51.27 0:37
11.57
618
0.5
55.26
= 1.17
41 0.76
39
1.26
36.61 6.33
38.50)
GRAND
125
64.00 2 0:33
24.77
1.07
64.15
0.37
18.74
1.00
47.45 4 0.66
49.11
0.74
45.00
0.16
10:00 9:000
4.00
Sulmmsiannii
24:11:201
0.25
72.65
0.34
55:25
1:11
$1.88 6:9
00,00
BrcaNo:
46:0
0.00
PaatoGNN
3.71
16.43
01 0.66
39:99
641
0000 4
55:6-6-01
40.43 00035:000 0.38
45.63 0.00
7.00
07:16-211 7.61
68.83 - 6.98
56 90 01
75,12
1171
63.17
0.55
$3.91 0.30
5370-40.35 0.38
06.16-00.33
48.9% 0.74
39.55-5
0325-4-000
580
RUNG
78004 2.22
67:07
83.0 0.35
75
07.41
0.0
55:41 0.9K
7.50
Table 28: Accuracy under the inductive/evasion setting against structural attack. (ptb rate=0.2, atk emb=BoW, def emb=Mistral-77
Cora
Cieckerr
GCN
73:05 2.00
63.66 :: 1.54
52.33
1.07
3435
1.07
62.23 1.33
$2.50 =: 9.50
64.32 d: 1.35
35.53 0.58
$1.20 = 0.30
47.70 d: 0.00
3.10
GAT
67.59 1.25
61.39 2 1.56
$1
1.16
30.35
3.51
64.23 =
$ 0.44
66 (35442 4:
1.52
5454
0.27
51.71 = 1.72
40.00 0.00
4.00
1.12
0:00
GERIGNN
45.3
51.11 7.89
41.17
2.6
44.91
5.1
25.12 3.15
64.17
2 0.42
53.30
0:30
56.18 0.42
42.14
0.11
25.89
0.15
536
0.000
11.20
OCORN
7269-223
63:06-20.11 0.41
54.22 0:78
33.55
1125
58.59 - 1.76
71.78
3.55
57.14:1116
53.32
0:54
44.45 - 0.14
43.08 0/00
NoiyGGN
7319- 1.55
63.54
0:00
0:05
54.6
1161
03:71
0.18
60.35
9.70
64 1.00
5637
114
51.36 0:90
48.30 8:000
4.20
GRAND
78.22 1:40
68.97
0.35
85 0.36
0.25 65.39
101
64.17
61.53
SolmesiiatCi
7699
PeraNe
2031 1.84
48.00 1:31
87
0.35
6104
1.29
08.34
0.27
62.92
0.50
6AI8 4 0.0
96.1 1.44
12.42
$1.30 11.30-40000 0.00
4.10
2601--711 711
61.17 0:44
K3
43 0.74
$7.24
3.2
63.01
1.46
40.95
00-55-111 6.11
6010 + 0.9
03.33 071
$1.74 - 1.04
56.01 1.001--0000 0.00
7.10
CoNNramnt
21:37 1.06
31.00 0.100
0:75
00.1
1.
67.56
14.14
3,07
RUNG
1.66
0.08
68.69
60.14
40

---

Published as a conference paper at ICLR 2026
Table 29: Accuracy under the inductive/evasion setting against structural attack. (ptb_ rath_rate=0.2,
atk Bik_emb=BoW, def.emb-MiniLMM
Marhol
Cora
Chelser
PalMed
WRICS
Teergram
Roddi
Hiever
Photo
Chengater
Arg Rark
61:34
83.2
1:40
57.38
1.80
35.90
41.35
0.00
APPNP
2.50
14.56 0.06
57.52
0:39
76.79
63.30
0:33
57.28 0.80
0:31
54.4 0.55
57.56 0.00
4.50
GPRGGNN
77:86=22:4
70.69 + 0:31
17 0:13
71.37
1177
03:41 8:0 0:77
16.05+00.1
77
0:39
6616-:00 0.5
00.50 0.45
6618440000
66
0.000
4.53
13:3122.1 2.70
62:30
2 1.63
82.55
0.52
54.20
0.96
63.36 0.30
$1.26.00.05 0.35
68.75
0.76
5032 0.0
55.38 0.64
30.41
2:050
9.10
OCORN
2/2
83.01
35.29
57.34
50.00
0.7
4656
12:42=235
61.55
0.00
GRAND
74-0- 1:54
90.32
1:33
8188
0.36
06.25
0:40
64.11
0.36
66.06 1.18
12.45
062
0.14
01.17 -.37
57.15 0.50
4.90
Sottmedtenttte
75.05-788 7381
70.48
0.11
8661
0.76
77-11
1154
99:33
0.67
56.13
0.80
72.24
0:45
4.57
BecaiNe
1341=224
68,56 2 1.29
84.00
0.17
55.20
= 1.0
64.18
0.25
57.46 +: 1.19
00.13 + 0.28
00.29 0.22
55.05 = 0.59
48.64 0,00
6.10
BlankGNN
=3:44:11
63.01
=
0.51
5633
03.10:0033
54.45
RUNG
83.4 1.05
73,46 0.57
19.8 0.34
79.95
63.33 0.34
55.34 1 0.80
3.50
Table 30: Accuracy under the inductivc/evasion setting against structural attack. (ptb rate-rat atk emb=BoW, def emb=RoBERTa)
Cieieer
CCN
23.31 2.11
62:00 1 0.59
82.92 0.52
51.54
11:1
60,00
0:89
55.16
2.30
Noh 81
D.48
50.33 0.97
55.09 L 6.23
45.28 0u00
10.50
GAT
7343 1.53
63,64 = -:000
K5
0.60
21.65
1.11
02. 06.56=2
1.37
61.50 1.18
GA 10 4: 1.30
0.30
54.77 = 1.09
56.77 1-:000
9.10
41.06
0.15
GIMIGNN
62.85
0.00
23.49 1
60.97 2 1.02
62.15 0.34
56.85
1.66
64.68
0.32
57.59
1.91
64.25 4: 0.40
56.24
0.78
51.85
2.42
51.50
0.00
10.50
OCORN
71:09-73 7:2
63.88 8 0/6
85.00 0.55
5497 -077
58.11 0.58
68.00
1,86
10 110-+11 1.56
51:00--00 0:53
46.08 6.17
41.82+:000 0.00
10.00
NOIGGEN
11:35 1:31
62.50
K3.00 0:00
17 1177
00.35
-0020
66
7.81
66.44
0.58
57.76- 1111
45.83--0.00
9/00
SolmediarCiC
9001
30.53
70.89
ErcaNee
70.03 1.30
11.47 0.64
07.53.20.45
63002 0.33
05,64
1.09
$1.68
2,69
72.6 2 0.14
61,93
0.38
59.79 0.47
53.73.00.00
6.00
24:1
1.00
61:6 100
86.22 0.76
52.7
1:0
17.30 4.9
54.11
1,66
70.01 1 0.73
60:21
8.00
54.4% 0.70
$6.40 0.00
4.90
81:4 194
34.38
1.0.1
91
0.44
51.01
61.11
1:19
6.11
6304
0.21
63.07
31.16 0.00
1,00
=
N0.2
67.13
0.56
Gusiee
74.1
$1.64
54.5
=
0.015
Table 31: Accuracy under the transductive//poisonnng setting against structural attack. (pth rate=0.2,
atk_ Lemb=BoW, def_emm)Boo)
Mothod
Cora
CiteSeer
PubMed
WikiCS
Instagram
Reddit
History
Avg Rank
GCN
64.56 1.14
71.31
0.44
77.59
0.23
79.96
0.35
63.87 + 0.17
52.28
1.42
64.39 2: 0.33
8.71
GAT
61.78 0: 2.21
70.55
1: 1.26
75.51
1: 0.28
78.55 1: 0.83
70.54
1: 1.75
53.49
2.11
71.18 1: 1.21
8.57
APPNP
70.47
1.21
72.32
0.77
83.61
+ 0.19
79.83
1 0.17
61.33
+ 0.25
54.73
0.79
74.60
1 0:07
3,71
GPRONN
71.45
2.32
71.61
0.99
81.74
0.78
79.02
69.35
69.21
73.49
4.14
RobustGCN
59.94 = 0.31
70.16
1.81
69.61
: 0.35
80.84
1: 0.20
63.56
: 0.60
$2.19 = 0.21
63.72
- 2.69
12.00
GCORN
47.92
3.14
69.75
1. 0.80
55.58
1 0.59
77.62
1: 0.41
63.77
1: 0.14
52,92
0.27
58.59
1: 0.09
13.71
NoisyGCN
63.74 = 0.44
71.87
1: 0.15
76.88
1: 0.76
79.79
1: 0.34
63.87
1: 0.17
52.21
1.42
63.14
1.66
9.86
GRAND
64.05
3.51
72.22
0.98
77:90
+ 1.65
79.98
+ 0.35
63.65
+ 0.13
55,05
0.92
63.92
- 0.06
7,57
SoftmedianGDC
69.65
0.71
71.85
0.73
80.65
73.97
63.50
53.19
72.79
8.71
Even/ot
72.28 = 1.98
69.78
+: 0.66
N5.63 + 0.23
80.79 + 0.61
79,57
+ 0.84
66.64
0.55
77.04
0.29
3.14
ElasticGNN
64.37
1.89
71.64
0.57
78.75
0.68
79.90
1 0.50
63,81
1 0.26
51.76
1.3
66.72
1 0.80
9.14
GNNGuard
65.68 0.36
70.81
1: 0.51
81.63
1 0.39
77.45
1: 0.28
64.52 1 0.62
$4.60
= 0.33
69.35 1 0.79
7.57
RUNG
68.60 2.18
71.14
1: 0.38
82.46
1 0.27
78.20
1: 0.38
63,89
1 0.14
52.37
L16
7,83
Cosine-GCN
0.98
82.03
77.07
61.36
70.11
8.71
Jaccard-GCN
61.21 0.80
69.49
+: 0.61
74.76
4 0.52
78.45
4 0.51
64.23
+ 0.64
51.89
0.65
63.40 4 2.38
12.14
Stable
60.18 4.17
67.02
1.18
2.72 72.35
77.58
1 0.58
63,89 1 0.23
55.77
0.73
11.67
ProGNN
1.96 76.57
70.22
0.54
6.00
Table 32: Accuracy under the transductive//poisoning setting against structural attack. (pth rate=0.2,
atk Bokk def_eemb=Mnil.
Method
Cora
ClteSerr
PubMed
WIRICS
Instagram
Reddit
History
Avg Rank
GCN
71.84
2.32
73.66
: 0.20
79.44
: 0.27
81.19
: 0.28
63.81 : 0.18
49,89
0.01
66.90= + 1 80
11.00
70.64
0.61
73.51
0.31
79.59
0.65
80.98
0.28
73.43
58.88
78.92
APPNP
78.39 = 0.48
74.79
0.58
86.55
: 0.11
81.04
1: 0.15
61.02
1 0.62
58.36
= 0.23
82.15
- 0.11
4.43
GPRGNN
78.10
0.74
0.77
65,80
1 0.27
81.32
1: 0.35
72.95
1 2.44
67.84
0.36
80.39
1 0.10
4.57
RobusiGCN
71.33
1.69
74.00
11 0.32
78.17
1 0.48
81.65
1: 0.20
63.80
4: 0.19
49.99
0.13
65.64
1: 1.31
10.29
GCORN
58.96
2.70
74.71
1: 0.74
57.61
4: 0.29
79.47
1: 0.44
63.87
4 0.17
49.87
0.02
56.22
1: 0.07
12.86
NoiayGCN
72.79
3.09
73.99
0.31
79.23
81.18
0.27
63.75
0.12
49.96
GRAND
74.08
1.81
75.18
+ 0.96
80.62
+ 0.66
81.55
+ 0.26
63.65
+ 0.04
50.79
0.73
68
0.50
8.00
SoftmedianGDC
78.06
0.49
75.19
1. 1,08
K5.76
0.39
80.66
1 0.60
62,83
1.24
$1.03
0.55
81.18 1 0.15
8.29
EvenNet
78.93
1.18
74.74
0.19
87.37
0.12
82.18
0.26
78.67
67.23
82.81
2,00
ElasticGNN
74.70
1.77
74.16
1: 0.68
79.21
1 0.63
81.25
1 0.38
63.83
1. 0.15
50.02
0.24
64.78 1 0.24
9.29
GNNGmarrd
80.08
0.54
73.69
1.47
86.08
0.25
81.00
0.13
64.34
+ 0.39
58.70
82.14
0.06
5,86
RUNG
78.20
0.94
73.78
1: 0.16
86
1: 0.42
80.76
1. 0.10
64.15
1. 0.36
51.70
0.90
7.50
Cosine-GCN
80.08
0.83
73.90
0.45
50
+ 0.42
80.68
+ 0,26
64.53
+ 0.73
58.59
0.95
81.98 + 0.08
6,57
Jaccard-GCy
72.07
1.57
73.47
0.22
77.08
0.35
80.45
0.51
63.74
40.96
+
Stable
75.20
0.81
72.50
0.69
78.89
1. 0.91
80.88
1 0.17
63.63
4. 0.38
49.02
0.64
13.33
ProGNN
0.51 83.20
73.78
1.51
6.00
41

---

Published as a conference paper at ICLR 2026
Table 33: Accuracy under the transdueciiv//poisonnng setting against structural attack. (ptb_ ratb-rate=0.2,
atk_ emb=BoW, (BBBETa
Method
Cora
CiteSeer
PubMed
WikiCS
Instagram
Reddit
History
Avg Runk
GCN
69.57 3.44
74.68
0.41
78.44 1: 1.30
81.69
0.37
63.86
0.18
52.77
68.51
GAT
67.64 = 2.71
73.86
1: 0.43
78.80
+ 1.09
81.44
1: 0.13
72.22
+ 1.78
56.14
= 3:40
78.09 4: 0.41
9.86
APPNP
80.62 0.26
75.01
1 0.50
88.23 1 0.27
82.87
1: 0.50
66.24
1: 0.09
59.39
0.21
83.73
1 0.12
3.57
GPRGNN
79.93 1.21
75.11
0.59
87.36
+ 0.55
82.32
1: 0.38
73.19
+ 6.80
68.58 = 0.59
82.70
0.13
3.71
RobustGCN
66.44 3.26
74.19
0:288
64.78
1: 1.59
81.96
1: 0.26
63.64
1: 0.20
51.28 0.46
64,55
4: 2.99
12.86
GCORN
67.65 0.86
74.68
61.51
80.77
0.40
62.32
NoCsyGCN
71.57
1.42
74.57
+: 0.94
77.73
+: 0.92
81.61
+: 0.47
63.75
+: 0.21
53.08
3.68
70.33
+ 1.22
11.29
GRAND
80.05
0.76
75.81
0.74
83.73
0.50
83.23
1: 0.45
63.93
1: 0.20
57.16
0.40
77.99 1 0.55
5.43
SoftmedianGDC
78.00
0.44
73.
0.42
85.85
0.43
79.78
0.56
64.38
57.77
82.63
9.43
EvenNet
80.82
1.22
75.02
1: 0.16
88.86
1: 0.10
83.34
1: 0.81
81,09
1: 0.20
68.71
0.46
84,10
1 0.05
1.57
FlasticGNN
75.02
0.48
73.87
0.19
82.05
0.74
82.28
0.17
63.84
0.14
52.56
1.83
70.57
+ 1.78
10.43
GNNGuurd
79.93
1.52
73.99
1: 0.62
86.95
1: 0.06
82.45
1: 0.75
66.80
1: 0.29
60.06
0.46
83.48 1: 0.13
5.14
RUNG
79.23
1.25
75.45
+ 0.88
87.55
+ 0.45
81 80
0.23
63.90
+ 0.23
$4.61
1.40
6.83
Cosine
79.88
0.66
73.10
1.19
86.25
0.27
81.91
0.71
66.65
58.18
Jaccar--GCN
69.82 = 1.49
72.47
0.45
75.94
+ 1.4
81.05
+ 0.47
63,50
+ 0.49
49.56
= 2.21
63.00 + 4.95
14.29
Stable
78.28
1.45
72.46
0.66
77.66
1.31
80.25
0.96
63.93
0.20
53.32
2.22
12.00
ProGNN
83.57
0.79
74.98
0.38
3,50
Table 34: Accuracy under the inductive/evasion setting against textual attack. rate-rate=0.4. def emb=BoW)
Mathod
Com
CiteSoer
PuhMed
WIKICS
Instagram
Rodiit
History
Aug Ronk
GCN
82.72 = 1.05
00.66 1: 0.77
82.00
78.50
0.21
61.16 1: 0.92
59.70
1.08
78.01
0.45
78.65 d: 0.25
4.38
GAT
82.00
2.20
61.76
+ 2.50
83.05
0.69
71:54-
1.13
63.21 + 1.40
60.60
+ 1.30
79.55
1.09
82.05
+ 0.30
3.25
APPNP
5007
0.94
38.35
+ 1.45
67.82
= 0.30
50.23
0.54
60.42
+ 0.46
55.08
0.21
74.79
0.41
73.52
+ 0.54
9.88
GPRONN
74.11 : 2.38
40.39
1: 1.58
73.55
: 2.15
54.80
0:44
59.80 1: 1.14
58.65
0.39
67.48
0.93
71.34 4: 1.77
10.12
RobaaGGCN
84.01
2.26
2.22
82.16
74:00
56,33
0:31
3.88
77.09
76.35
GCN
83.27 1.35
59.93
0.45
81.68
78.39
0.09
60.52
0.61
61.32 0:64
78.
0.31
79.03 0.16
3.75
GRAND
75.77
2.22
47.96
1: 1.48
78.54
1.72
73:77
= 0.24
64.64
1 0.38
62.69
1 2:23
75.00
0.91
74.99
0.10
6.25
SefimedianDDC
70.54 2.01
47.23
0.27
70.63
1: 1.01
47.05
0.39
59.16
1 0.56
$9.10
0.36
61.46
0.46
10.71
EvenNet
79.95 +: 0.74
52.72
0:90
81.17
1.09
74.94
0.61
62.45
+ 1.25
59.61
0.40
75.90
= 0.49
82.24 + 0.26
5.50
ElsnKGNN
8296 2.05
1.53
83,07
0,87
1.24
59.96
71.40 0.29
0.57
4.25
GNNGGand
76.81 1.51
66.37
43.70
$1.93
0.65
0.63
11:75
RUNG
65.50=
0:90
64.24
48.90
0.38
61,20
0.67
55.69
10.83
Table 35: Accuracy under the inductive/evasion setting against textual attack. (ptb_rate=0.4,
def doo_.mm=-MinnMM)
Metbod
Cora
CiteSeer
PubMed
WikiCS
Reddit
Hustory
Photo
Roak
OCN
78.25
67
64.33
76.45
3.38
GAT
08
1.81
78.66
61:65
1.15
1.19
62.65
77.01
00755
72.78
3.41
3,00
APPNP
38.3
0.23
10:23
1:11 1.55
66.51
0.61
66.63
0.30
58.83
1 1.19
53.07
0.32
06.07
1.03
54.01
1: 0.25
10.25
GPRONN
71.77
1 2.13
43.16.1
1.53
69.84
0.66
46.53
0.28
57.88
1 1.54
$3.98
0.31
65.12
0.85
54.71
1: 0.35
9.25
RobasGCN
82.29
1.29
60.61
2: 1.97
78.15
0.22
69.33
1.37
63.67
4: 0.51
55.63
03.63:2000 0.22
77.73
2: 0.41
73.08
2: 0.87
2.88
GCORN
79.21
0.53
54.70
1: 0.84
72.06
62.45
1.18
57.51
1: 0.45
66.15
0.47
74.47
0.50
63.62
0.48
6.00
NoisyGCN
79.46
1.43
1.03
78.50
1.22
1.30
64.67
76.24
0.48
74.12 0.75
3.38
GRAND
68.08
2.39
1.41
69.79:0.41
0.37
0.98
60.92 0.21
7.38
SoftmodEanCICC
68.57
0.67
51.15
0.30
60.32-00744
$4.46
1.76
$1.94
0.42
63.31
3.21
9.17
EvenNet
25.46
1.34
48.33
1.85
74.37 0.68
$1.86
1.37
59.58
0.73
56.55 0.36
72.73
0.44
75.15 1.57
5.00
ElaiicGNN
76.75 1 1.96
56.11
1.89
78.57
0.61
50
0.97
61.15
1.02
60.19
1 0.60
75.86
0.73
60.90 1. 1.07
5.38
GNNGland
52:34 014::000 0.57
39.66
+ 0.56
65.82
0.30
25
0.34
51.53
2.12
51.53-+-0.77
56.90
0.51
43.72 ::
12.50
RUNG
55.78
0.63
39.76
1.03
66.60
46.45
0.39
57.72
1.00
53.22
11.17
Table 36: Accuracy under the inductive/evasion setting against textual attack. (ptb_rate=0.4 def. RBRRR))
Mothoo
Cora
CiteSeer
PubMed
WikiCS
Instagram
Reddit
History
Photo
Avg Ronk
CCN
81J12 1.61
59.14 1 0.96
80.13
0.39
73.27
0.93
63.57 1 1.47
65.42
1 0.3
78.65
0.22
74.01 1 0.33
2.50
GAT
81.49 1.58
4 3.32
81.94
54
7.56
64.29
1.30
63.29
0.12
79.10
1.36
79.17
0.80
2.62
59.29
67.57
45:21
0.37
1.25
0.51
10:25
GPRGNN
66.30
0.27
0.79
1.75
54.69
62.54
1.09
2.28
10.25
RobasGCC
83.03
2.11
60.24
+ 1.07
1.133
6931
2.56
64.51
+ 0.57
60.51
0.00
73.51
0.10
68.58 +: 1.45
3:25
DOORN
79.21 -: 1.28
56.06
+ 0.74
74.51 0.58
66.75
1.32
58.00
1: 1.18
64.97
1 0.43
76.91
:: 0.67
64.1
+: 0.94
5.50
No
80.75 + 1:43
59.72
1.91
73.97+0044
73.25
0.07
62.55
+ 1.84
65.60
0.63
78.74 0.300
73.90
0.53
2.85
GRAND
69.13 2.72
16.08
1.55
72.62.00
5T.44
0.30
66.05
1.24
1.38 63.42
7101 L 0.77
57.19
6.38
SoltmedinCDCC
1.00
9.50
Evenlet
65.52
0.75
1.07
73.50
$4.32
0.72
$6.70
72.50
1.18
ElssicGNN
7891 3.48
52
0.56
78.19 022
$6.07
1.37
63.32
2.08
60.48
1 0.30
76.95
0.37
59.24
2.94
5.88
GNNGsard
51.91 = 1.14
38,82
0.65
65.75
0.52
42.12
0.13
54.32
+ 0.65
53.94
1.22
61.09 + L.77
$4.98 + 0.08
12:25
RUNG
3.112
38.56 4 2.11
66.49
0.56
48.07
0.42
58.80 4: 1.09
54.07
0.30
11.17
42

---

Published as a conference paper at ICLR 2026
Table 37: Accuracy under the transductive/poisonnig setting against textual attack. (ptb rate=0.8,
def_ (ef_eebBBWW)
Methed
Cora
CiteSeer
PubMed
WikICS
Instagram
Reddit
History
Avg Rank
83.63
0.61
65.20
1.19
85.16
0.09
79.85
0.25
65.81
61.18
GAT
83.74
0.12
65.54 1: 0.90
84.98
0.05
79.05
1: 0.97
65.55 1: 0.34
60.92
0.30
80.52 1: 0.16
6.86
APPNP
84.59
0.69
66.58
1.11
86.48
0.28
79.88
1: 0.49
65.65
1: 0.38
60.60
0.17
80.72
1 0.13
3.57
GPRGNN
84.43
0.45
66.93
85.75
0.07
78.83
65.56
59.83
RobusiGCN
83.65 = 0.48
64.60
1: 1.05
K5.53
1: 0.16
N0.39
1: 0.37
65,59
1: 0.12
59.26
0.31
80.62
:: 0.10
6.00
GCORN
74.71
1.80
64.35
1.03
83.32
0.19
77.63
0.41
64.79
0.51
65.M0
0.16
77.94
0.17
10.86
NoC
83.13 0.70
65.36
1: 0.83
N5.26
1: 0.12
79.77
1. 0.26
65.81
0.35
63.27
0.65
80.09
1: 0.09
6.00
GRAND
83.93
0.30
67.70
+ 0.68
86.58
0.25
79.46 + 0.46
65.53 + 0:25
62.91
0.08
80.28
+ 0.15
4.43
SoftmedianGDC
82.23 0.88
60.27
83.70
70.02
0.11
77.21
EvenNet
83.39
1.02
59.98
0.16
85.98
0.17
80.07
+ 0.59
65,30 + 0.46
64.56
0.53
80.19 0.13
6.71
ElassicGNN
83.62
0.53
68.37
0.93
86.39
0.21
79.78
0.14
65,53
0.27
60.59
0.38
80.52 1: 0.05
5.43
GNNGuard
79.23
0.36
0.47 17.98
85.
0.19
72.
0.55
64.37
0.14
58.73
13:29
RUNG
82,88
0.59
1.49 61.48
85.01
+ 0.24
77 69
0.51
66,28 + 0.25
60.49
0.11
10.67
Cosine-GCN
78.59
59.74
82.06
0.30
0.11
Jaccad-GGCN
79.17
1.96
60.25
0.58
82.36
0.22
77 0.36
64.94 + 0.59
61.16
0.27
21.72
0.03
12.14
Stable
77.86
0.62
61.11 1: 0.40
82.22
0.24
77.51
0.16
64.59
0.22
62,95
0.34
74,80 1: 0.35
12.57
ProGNN
76.08
0.34
66.07
0.84
10.50
Table 38: Accuracy under the transductive/poissoning setting against textual attack. -0t def emb=MiniLMM
Method
PubMed
Instagram
History
Avg
GCN
83.65
1:28
69.52 : 0.53
86.01
+: 0.31
80.65 + 0.28
65.16 :: 0.58
65.36
0.38
82.46 + 0.07
8.14
0.67
70.46
85.38
81.47
0.53
65.29
63.69
82.45
APPNP
84.17 0.90
70:94
+ 0.62
87.35
0.05
81.13
+ 0.16
65.70
+ 0.69
61.86
0.27
83.13
0.06
4.57
GPRGNN
84.23
0.56
70.35
1 0.40
87.47
1 0.40
80.76
1 0.25
64.76
1 0.47
61.40
0.48
82.31
1 0.08
7,86
RobustGCN
84.00
0.61
69:77
0.28
86.04
0.21
81.41
0.13
64.06
82.81
4.57
GCORN
82.66
1.20
71.26 1: 0.77
85.30
1: 0.22
78.91
1: 0.10
65.72
1: 0.25
67.37
0.13
82.41
1: 0.10
7.14
NoisyGCN
83.53
0.75
68.
86.04
0.38
80.35
0.40
68,87
0.63
67.86
0.28
82.69
+
6.57
GRAND
84.85 0.55
71.60 1: 0.90
85.17 4: 0.24
78.54 1: 0.65
65.48
1: 0.19
65.24
0.34
82.07
1 0.07
7.14
SoftnedianGDC
0.37 84,22
65.87
1.06
85.78
+ 0.60
77 + 0.43
66.45 + 0.41
82.99 : 0.10
9.33
EvenNer
84.09
86.90
82.00
ElasticGNN
84.37 0.70
69.94 + 0.80
87.28
+ 0.16
81.36
0.11
68.17 + 0.75
62.62
0.17
83.05 0.18
5.71
GNNGuard
79.70 0.25
17.98
0.47
83.85
0.35
76.18
0.36
68.39
58.95
0.32
80.99 0.15
14.29
RUNG
81.96 = 0.79
67.09
0.48
86445
0.13
80
+ 0.56
64,93
61.32
0.16
11.33
Cosine-GCN
79.45 1.23
1.22 67.50
82.62
0.11
76.23
+ 0.31
68.10
0.68
58.91
0.29
80.64 0.14
14,86
Jaccard-GCN
0.25
80.11
Stable
81.62 = 0.95
70.35 0.66
84.06 + 0.32
80.54 + 0.58
65.35 + 0.56
64.67 0.22
9.67
ProGNN
81.88 0.89
69.30
11.50
Table 39: Accuracy under the transductive//poisonin setting against textual attack. (ptb_rate=0.8. def RoBRRa
Method
Cora
CiteSeer
PubMed
WikiCS
Instagram
Reddit
History
Avg Runk
GCN
84,29
0.68
68.67
1 0.21
86.38 1 0.15
81.70
1 0.11
66.56 1 0.22
63.80
0.27
83.21 1: 0.13
8.14
GAT
84.97
0.51
67.58 + 1.60
85.54
+ 0.24
81.81
+ 0.30
66.37 + 0.49
63.84
-048
83.31
+ 0.100
8.57
APPNP
0.31
70.97
87,83
0.27
81.39
66.86
83.57
GPRGNN
85.00
0.59
70.00
1.38
87.82
+ 0.47
81.65
+ 0.07
66.76
+ 0.18
62.64
0.46
83.53
+ 0.22
6.43
RobustGCN
84.28 0.24
68.05
0.23
86.28
1 0.08
81.48
0.16
65,89
0.51
63.47
0.12
83.00
0.13
10.57
GCORN
83.40 0.44
71.00
1.12
85.69
0.05
81.09
0.37
66.58
0.20
67.71
0.11
83.67
+ 0.03
7,29
NoisyGCN
84.29 0.23
1.19 68.35
86.41
+ 0.08
$1.47 + 0.21
66.40
+ 0.33
63.65
D.26
83331
+ 0.03
8.71
GRAND
85.54 0.35
71.40
87.15
82.89
0.20
67.29
0.20
67.02
84,31
2.14
SoftmedianGDC
83.33 0.56
0.98 64.50
86.25
+ 0.18
76.51
+ 0.37
60.00
0.27
81.41 + 0.08
12.67
EvenNet
84.96
0.15
67.87
0.59
87.64
+ 0.31
82.77
+ 0.27
66.78
+ 0.58
63.28 1.04
83.63 : 0.02
6.29
ElasticGNN
85.25 0.81
72.02
0.50
87.62
0.09
82.33
0.29
66.75
63.88
83.99
0.05
GNNGuard
80.25 = 0.77
17.98
1: 0.47
84.35
1: 0.30
77.26 0.38
66.88 + 0.36
58.95 0.69
82.19
0.17
13.00
RUNG
83.37 0.56
68.71
87.37
0.28
81.56
65.95
63.01
0.08
9,83
Cosie-GGC
77.33 = 0.56
0.66 66.41
83
1 0.23
0.54 77.03
66.58 1 0.70
57.61
= 1.8
81.77 1 0.18
14.43
Jacsard-GCN
82.36 0.85
66.92
0.91
84.95
0.22
81
0.27
66,87 + 0.31
63.22
0.19
82.50 0.18
10.86
Stable
83.83
71.31
0.67
84.87
0.12
7.67
PoGGNN
82.48 1.08
71.61 2.06
8.00
43

---

Published as a conference paper at ICLR 2026
J.3
GRAPHLLM RESULTS
Results are in Tables 40
45
Table 40: GraphLLM's clean results in the inductive/evasion setting.
Methed
Coca
Clicher
PalMal
Wiki's
Iasagrm
Reldi
Hissory
Puuto
Computer
Arkiv
GrgbGGPT
81.06 2.33
74.35
2.51
94.14
0.23
82.31
a: 1.31
66.93
1.44
61.87 2: 0.52
85.34
1.07
54.77
0.34
85.80 1 0.00
74.78
GrpboPPT zoise
80.63
2.24
72.56
3
94.09
0:33
82.32
1: 1.97
67.59
0.67
60.89 1: 1.01
35.70
0.72
53.55
0.58
CoppGPT noisetst
66.79 1: 3.64
57.37
5.20
15.15
1.88
64.55
2:94
8629
86.96
90.00
LLaGiA-nose
86.14
00.55
0.57
68.62
86.57
0.500
LLaGiA-ndsefilll
89.13
85.15
noisect
83.64
56.37
1.78
sim
neighhor)
SFT-arighor
SFT-aniefflll
SFT-nietal
86.29
SFT-imp
0.7.1
0.32
SFT-imf
51.75
0.18
Table 41: GraphLLM's clean results in the transductive//piisonnng setting.
Method
Com
CiteSeer
PahMed
WikiCS
Instagram
Reddit
History
Photo
GraphGPT
68.97
2.30
67.28
1.56
92.13
1: 0.69
75.35
1: 0,16
63.21
1,83
59.92
0.06
83.46 1: 0.15
80.86 0.55
GruphGPT-noise
69.71
0.79
75.66
LLaGA
78.94 1 0.47
70.51
2.98
85.60
1: 3.83
79.65
1.15
61.56
4.71
68.44
1.39
83.55 :: 0.30
LlaiGA-noiee
79.53 + 2.37
71.40
+
1.76
84.71
+ 3:98
77.08
+ 1.59
66.5 - 0.15
68.59
0.37
82.94 + 0.34
82.72 0.52
LLaGA-mosscfll
1.20
LLaGA-noisettt
80.11 1: 3.95
71.26
0.70
86.39 1: 1.17
79.60
0.93
65.28
= 2.14
67,31
1.06
83.71 1: 0.22
84.38
0.67
SPT (woo neighhor)
75.45 + 2.03
93.93 + 0.35
82.31 + 0.49
66.53
1.03
60.49
1.02
84.78 + 0.50
SPT-nnighbor
79.40
1.97
72.03
2.00
91.80
1: 0.31
62.65
66.85
0.96
66.01
0.57
85.72 4: 0.09
85.05 0.57
SPT-noise
2.39
71.88
94.14
0.35
83.12
1.18
0.42
SFT-noiscflll
80.34 1 1.32
70.79
2 3.08
93.53 1: 0.49
82.86
0,51
66.09
1.83
66.17
0.17
85,38 1: 0.15
SFT-moisetxt
76.92
2.00
72.31
93.46 1: 0.26
82.48
0.12
66.23
0.40
65.96
0.74
85.07
0.58
SFT-simp
1.46
63.52
Table 42: GraphLLM's results under the inductive/evasion setting against structural attacks (ptb_rate=0.20).
Methodl
CluSSer
Instagaam
Reddit
History
Compater
77.47
moise
LLaGA-anise
68.03 1.57
58.29
M2.34
1.26
71.88
anisefull
0.59
2.24
75.16
73:41
2.06
noisenst
05:41 1.24
52.67
4.75
26.32
SPT-neighbor
71.53
94.73
$6,00
62:29
95.95
N1.72
noise
73.14 0.36
94.51 0.31
M5.31
N1.75
0.86
91.33 0.55
79.52
simp
94.11
J.4 RESULTS WITH DIFFERENT PERTURB RATIOS
In Tables 46 and 49
present results against different attack ratios. In Figures and 13
we further visualize ize the accuracy- perturaaptttttraationn curves across different datasets under structural and textual attacks in the inductive setting. The trends align with observations in the main paper.
44

---

Published as a conference paper at ICLR 2026
Table 43: GraphLLM's results under the transductive//pisooning setting against structural attacks.
(ptb rate=0.30)
Method
Cora
CiteSeer
PubMed
WikiCS
Instagram
Reddit
History
Photo
GruphGPP
64.53 1.81
64.91
1.55
90.02
76.28
0.95
45.73
79.
0.38
73.58
1.47
GraphGPPRoise
65.70 2: 0.76
64.16
2.67
90.50
1.77
75.06 1: 0.70
58.13 - 0.94
15.78
0.35
80.82 1: 0.30
74,02
0.37
LLaGA
71.02 2: 4.70
69.41
1.42
81.63
1.58
76.70
+: 1.25
58,94
1.72
45.07
0.76
79.00
4 0.72
72.54 1: 2.15
ELaCAA-noise
72.39 1.59
71.41
X2.91
1.36
79.07
1.79
55.43
4690
80.
73.43
LLaGA--oviscull
64.22 +:
68.69
2.53
81.11
0.64
74.85
+ 3.57
59.83 0.96
45.29
0.57
73.68
1.58
73.14
LLaGsA-moistttt
61.92 9.72
68.12
1.98
81.05 1165=10 1111
76.37
4: 1.81
57.36 5.04
45.63
1.36
72.64 1 2.52
73.04 0.93
SFT-neighhor
69.65
71.99
92.33
82.00
1,18
62.48 + 2.60
$1.90
82.82
1.61
80.51
0.51
SFT-noisc
70.56
71.56
1.82
92.8=0077
82.73
0.61
60.95
4.73
51.25
0.86
83.38
81.25
0.82
SFT-noisefall
71.48 1: 4.09
71.78
1 0.71
92.35 = 0.86
81.92
1: 0.56
63.90
0.24
51.39 = 0.47
83.71
0.29
81.16
0.52
SPT-noisetxt
1.19
70.52
3.10
92.02
0.71 81.35
60.77 + 5.23
53.60
0.32
83.69 4 0.67
80.74 0.63
SPT-simp
70.89
1.16
0.83
80.76
Table 44: GraphLLM's results under the inductive/evasion setting against textual attacks.
(ptb_rate=0...
WikiCS
Instagram
History
GraphGPT
66.48 + 15.39
59.51
13.47
71.21
14.22
66.45 : 17.17
63.38 + 3.93
57.27
3.57
70.53
14.86
54.23 # 2.63
GraphGPT-moise
51.66 2: 4.54
59.87 à 13.78
70.36 à 15.72
65.91
:: 18.43
62.99 1 4.04
57.56
2.34
70.26
15,90
LLaGA
81.73 1.76
61.65 1 2.30
73.84
1.08
61.14
111.1.1 3.87
63:40
3.54
68.83
1.61
72.55
1: 1.70
77.58
1.62
LLaGA-noise
3,46
1.53
1.28
LLaGA noisefull
79.89 4: 2.13
61,85 1: 1.04
77.12
4: 0.21
63.40
1.99
62.14 4: 2.41
68.59
0.56
78.06 2: 0.94
74,93
1.80
LLaGA-noisett
78.51 1: 0.95
59.19 1191:00 0.50
79.51
1 1.73
67.92
1: 1.9
61.70
1.35
69.10
1.38
78.15 1 0.69
77.00
1: 1.73
LLaGA-sim
52.21 1.66
39.08 4 0.77
65.68
0.42
47.10
0.36
55.12 2.67
52.03
60.24 + 4.61
47.08
0.58
77.83
77.96
1.76
SFT-ncighboe
75.65 1: 1.33
43.84 2.14
72.27
3.53
51.53 1.24
61.33 1.16
1.24 66.00
65.52
61.81
0.98
63.76
1.87
SFT-nose
71.71 8.20
43.00 3.42
72.10 : 0.98
50.63 0.50
1.112
1. 0.86
$9.50
4.01
62.88
1.47
SFT-nciscfull
77,06 5.97
52.46 5.80
74.72
1.06
66.16.16.66
64.20 1 L.13
65.64
0.81
67.22 1 3.19
72.36
0.70
68.27
1.30
SFT-simp
75.03 4.71
43.57
3.46
74.66
2.67
51.16 0.86
63.54
1.87
64.49
1.37
66.37
3.40
64.79
0.70
Sim-simf
53.38 1.29
40.28 1 1.8
71.66 1: 3.38
$1.52 1.24
63.70 1 2.10
65.92 1 0.86
59.42 1 1.24
$1.24
1.35
Table 45: GraphLLM's results in the transductivv//poisonin setting against textual attacks. rptb_rate00.80)
Method
Cora
Citeseer
PuhMed
WikiCS
Instagram
Reddit
History
GrophGPT
63.54 +: 2.39
40.82 = 11.87
84.52 + 1.46
61.96 = 3.44
42.13 + 3.52
46.42 + 2.04
73.18 = 1.88
GraphCiiT-noisee
62.94
1.39
41.01 5.32
86.25
62.19
1.42
38.71
46.83
2.65
70.51
0.98
LLaGA
78.96
2.60
52.52 1 1.31
72.16 1 8.62
75.60
= 3.10
36.33
1: 0.26
50.67
1 6.62
75.57
1 4.36
L.aGA-nnoise
3.07
51.87
10.89
78.33
5.89
71.42
36.82
3.08
71.54
LLaGA-noiscfull
77.66 + 2.19
50.24 + 5.85
80.16 1.53
70.41 7.15
42.64
= 4,51
62.39 + 2.86
75.22
- 5.33
LLaGA-nnissext
76.27 1: 4.31
51.96
- 4.09
81.46
241
73.94 2 3.49
41.82
+ 2.11
63.95 + 1.00
76.16
3.77
SFT-ncighbor
72.40 1 4.62
46.44
1.44:.40 4.32
93.07
1 0.55
79.33
1.10
62.11
1: 2.91
59.12 6.06
79,88
3.15
SFT-noise
73.99 + 3.44
47.89
4.41
93.49
0.26
80.04
0.41
61.86 + 3.34
60.59 + 2.97
82.07
0.86
SFT-noisefull
74.59
1.40
47.33
10.74
92.94
79.1 1.12
63,88
+ 0.22
63.26
0.57
81,46
1.58
noisexit
72.73
4 4.19
43.87
+ 4.94
93.07
+ 0.47
79.21
1.17
63.35 4: 0.64
61.62 + 1.54
80.24
0.88
SFT-simp
1.70 76.64
46.92
+ 6.90
93.04 + 0.22
1.76 79.51
55.40
14.53
2.40
Table 46: Accuracy under the inductive/evasion setting against structural attack. (ptb_rate=0.1) atk emb=BoW, def Rebeeemb=RRBRTT
Mahhed
Con
Cliceer
PabMed
WiLLE
Risddi
Photo
Chmmgsee
Achin
Arg Rank
OCN
2.29
64.00 2 1.31
$4.
0.38
45.55
0.54
59.41 : 0,51
$2,50 1.72
70.56 a: 0.50
66.13 0.85
64.30 = 0,02
52.21 0.00
10.00
0.78
APPSP
12.15
0.18
$0.54
64.35
62.73 0.00
GERGNN
N1.00
3.51
12.15
0.70
19
0:30
78.24
0.96
6888
0.0.8
1999
1.01
82.40
01
0:51
66.11 6.63
66.001 0.00
4.30
76.15
3.20
65.17
100
73 0:36
11
1:23
64.70
0.70
$1.30
1.36
06
0140
6410 11
60011 0.99
$1:30 0.00
10000
OCORN
77:86 1,05
66.46
0.66
15.38:0000
46:33
11.30
59,59
1.00
66.91 = 1.50
66.15
1.09
62.61
0.11
56.15 = 0.22
49.74 0.00
9.70
51,40 0:00
Selmediantii
5180-:20 2.70
11.47 3
6780 006
81.57 0.75
62.15
00.99
0.30
5.0
BeeeNN:
0075 1:06
72:18
1:22
88.44 0.26
70.94
0.00
68.90
0.18
$2.01 1,06
76.00
0.122
69.54 0.30
68.87 : 0.20
59488 0.00
4.00
BlstoGNN
75:23 1.34
65.66 =
85 02----33 0.37
61
60/05 =:
36.00-0000 0.77
74.11 + 0.99
20:20-1:115
63 0.56
60 0/00
4.30
73.67
0.35
45

---

Published as a conference paper at ICLR 2026
Performance under Structural Attack (Inductive, def, Romb=RRBBRTTT)
Cheteer
Publee
hrutaalo Redde
Intagran
Hittory
Photo
LAS AETOO
Figure 12: Performance under structural attacks (inductive setting). Accuracy trends on eight datasets as the perturbation rate increases. Each curve corresponds to different GNN/RGNN/- GraphILMM method.
P Performance under Textual Attack (Inductive, def, Ref_embRRoBRRT
2019
Figure 13: Performance under textual attacks (inductive setting). Accuracy trends on eight datasets as the perturbation rate increases. Each curve corresponds to a different GNN/RGNN/GrahLLLMM method.
Table 47: Accuracy under the inductive/evasion setting against textual attack. (ptb rate=0.2, def emb=RoBERTa)
Method
Cora
CiteSeer
PubSMed
WilsCS
Inssagram
Reddit
History
Photo
Avg Rank
77.50
GAT
86.16 :: 1.83
67.55
1.34
85.76
0.74
75.98
2.19
64.67
1.06
64.13
0.20
81.76 2: 0.93
82.44
0.33
2.50
APPNP
71.22 1.20
58.78
0.66
79.51
1 0.75
66.75
0.56
61.30
1.0.1100 0:12
55.89
0.67
77.11 00::1..:0 0.26
70.07
0.05
8.62
GPRGNN
76.63 06632:0.7
$7.99
0.46
79668
0.60
66.62
0.67
59.05
1.2.22200 2.20
$6.62
0.84
73.74 1: 1.08
69.65
0.68
8.88
RobustGiNN
84.50-
75.17
65.33
K1.44
76.13
GCORN
0.57
0.05
0.55
61.63+0.55
66.86
81.26
73.37
5.00
NaisyGCN
84.50 0.40
68.03 :: 1.48
84.84
0.48
77
0.49
64.23
66.39
1.07
82.08
0.38
78.86
0.12
2.62
GRAND
78.72 0.38
61.56 1 1.10
$133
0.53
68.86
1 0.82
0.67
65.30 2: 1.00
$0.21
0.43
71.11 0.11
5.75
EvenNet
80.01
1.48
60.19
82.69
0.78
7041
1.53
62.82
0.22111 1.36
59.07
0.90
79.32
0.63
79.61
0.21
5.75
GNNGward
68.14:1:
73.32
RUNG
7005 1.26
56.84 0.53
78.76
0.38
66.47 4: 0.50
61.16 0:57
56.00 1: 0.77
9.67
46

---

Published as a conference paper at ICLR 2026
Table 48: GraphL.LM's results under the inductive/evasion setting against structural attacks. (ptb_rate=0.) 10)
Method
Com
CiteSeer
PubMed
Instagram
History
LLaGA
78.41 0.64
68.49 a 150
87.97 1: 1.28
71.46 à 3.37
66.87 # 1.03
71.26 +: 5,87
81.93 a 1.56
70.53 4: 2.44
SFT-neighbor
83.21 1.21
72.78
Table 49: GraphLLM's results under the inductive/evasion setting against textual attacks.
(ptb_rate= rate=0.20)
Method
CiteSeer
PubMed
WikiCS
Instugrum
Reddit
History
LLaGA
82.41 1: 1,86
64.63 a 181
81.94 1 1.12
69.86 1: 2.27
64.99 +: 1.35
68.84 +: 1.97
79.29 +: 1.14
78.40 1 0.64
SFT-ncighbor
2.28
47

---

Published as a conference paper at ICLR 2026
K ADDITIONAL BASELINE EVALUATION
To further validate the persistence of the text-structure robustness trade-off, we evaluate three recent methods: GPRGNN-AR Gosch et al. (2023) (with PR-BCD training), GOOD-AT Li et al.) (2024),
and GPR-GAE Lee & (2rk( Tables 50 and 51 present results under inductive structural and textual attacks, respectively.
Table 50: Performance under inductive structural attacks (PGD 20%).
Format: Clean/ (%).
Method
Cora
CiteSeer
PubMed
WikiCS
GCN
87.76/73.31
76.07/62.77 70
88.76/82.92
84.86/31.55
GPRGNN
86.29/79.27
74.19/69.90
91.05/89.47
84.38/74.38
GPRGNN-AT
86.10/81.92
74.03/71.32
90.61/90.49
83.11/81.43
GOOD-AT
88.44/73.68
16.18/63.27
88 88.83/82.99
84.85/32.09
GPR-GAE
87.82/79.03
76.44/74.71
88.48/88.39
84.19/41.73
SFT-Auto
83,27/82.59
74.56/74.24
94.74/92.29
86.40/84.05
Table 51: Performance under inductive textual attacks (GPT 40%).
Format: Clean/Attacked (%).
Method
Cora
CiteSeer
PubMed
WikiCS
GCN
87.76/81.12
76.07/59.14 14
88. 38.76/80.11 13
84.86/73.2
GPRGNN
86.29/66.30
74.19/41.80
91.05/67.45
84.38/48.44
GPRGNN-AT
86.10/65.68
74.03/39.71
90.61/66.78
83. 83.11/47.20
GOOD-AT
88.44/83.03
16.18/59.93
88.83/80.35
84.85/75.35
GPR-GAE
87.82/67.10
76.44/40.07
88.48/70.86
19/66/66
SFT-Auto
83.27/76.75
74.56/65.36
94.74/77.86
86.40/77.83
The results confirm that the text-structure trade-off persists in adversarial train- ing methods. GPR-GAE and GPRGNN-AT significantly improve structural robustness but degrade textual robustness. Conversely, GOOD-AT excels under textual attacks (83.03% on Cora) but col- lapses under structural attacks (32.09% on WikiCS). This validates our finding that existing defenses exhibit inherent trade-offs, while SFT-Auto achieves balanced robustness across both modalities.
Key Observations:
48


Reviews:
[{"review_id": "ZhdU33nL9G", "reviewer": "Reviewer_UTSY", "summary": "This paper investigates the robustness of text-attributed graph (TAG) learning models against textual, structural, and hybrid adversarial attacks. It conducts a large-scale empirical study comparing GNNs, RGNNs, and GraphLLMs, and introduces SFT-auto, an LLM-based defense that automatically detects and recovers perturbed nodes. The results show that SFT-auto achieves more balanced robustness across attack types than prior methods, though the approach is primarily heuristic and lacks strong theoretical grounding.", "questions": "1. How is the perturbation for textual attacks defined within a single node? The proportion of perturbed nodes (40%–80%) seems quite large. My central question is: how do the authors justify that these perturbations are not noticeable?\n2. Could the authors show the performance degradation of several representative models under varying perturbation rates for textual and combined textual–structural attacks?\n3. Could the authors provide more detailed ablations on the inference process of SFT-auto to verify the contribution of each stage?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "1. The paper includes extensive baselines and experiments.\n2. It offers novel insights into robustness in text-attributed graph learning.\n3. The topic is highly relevant and timely.", "weaknesses": "1. The experiments use a fixed perturbation rate; it would be more informative to select a few representative models and show robustness across different perturbation rates.\n2. Although effective, the strategies in the SFT-auto pipeline are not very novel.\n3. The study mainly reports average ranks across datasets rather than raw accuracy or significance tests. This approach may obscure real performance gaps and overstate the robustness of SFT-auto.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "93sN91z97J", "reviewer": "Reviewer_Bb1t", "summary": "The paper presents a comprehensive empirical study of GNNs, robust GNNs and Graph LLMs under a unified adversarial setup allowing fair comparions. In particular, the dimensions of perturbing structure vs perturbing text have been investigated. Several insights have been derived such as a text-structure robustnes tradeoff. Further, a method is proposed that has a superior text-structure tradeoff compared to other methods.", "questions": "1. Why did the authors focus on transfer attacks and not adaptive attacks?\n2. Line 272: I would say the results are well \"complementing the findings in Gosch et al. (2023)\" (or something similar) and not \"aligning with\" as Gosch et al. (2023) investigated evasion and not poisoning. Or alternatively, make explicit that Gosch et al. (2023) shows high robustness of these models for evasion, e.g. through stating \"aligning with findings in (Gosch et al., 2023) that show strong performance of these models against evasion attacks\".\n3. How would SFT-Auto perform in Figure 5?\n4. Given many investigated datasets (e.g., the citation networks) are usually distributed with classic BoW embedding, how have the original texts been obtained for computing the rankings against textual attacks such as in Figure 3?\n\n*Minor:*\n* Adjust Line 124 (e.g. through reducing spaces) to fit the margins of the text.\n* Line 161: Mettack -> Metaattack\n* Provide References in line 80/81 for \"proven effectivenss\" of noise-injection & similarity-filterings", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 3, "strengths": "* Investigating the disting effect of textual perturbations (compared to small-epsilon perturbations) for node features is interesting and more realistic compared to pervious studies.\n* The text-structure tradeoff is an interesting insight and the proposed method a good remedy against. \n* There are many empirical results and insights. However, given its a purely empirical paper, this is also in a way a necessity.\n* Code provided.\n* Comparing robust GNNs with Graph LLMs in a (unified) adversarial setting is interesting and important.", "weaknesses": "1. Comparison Table 1 feels outdates and slightly misleading. On GNNs & RGNNs, the table only mentions the quite old graph robustness benchmark, while they don't mention recent works on GNNs & RGNNs. Exemplary, the cited work by Gosch et al. 2023 in the paper includes 8 datasets, GMA, evasion & inductive & adaptive attacks but is not mentioned, instead the 5 datsets of the GRB highlighted. I do think that the breath of experiments in submitted work is quite good, but I don't think for metrics such as num. datasets or num. domains the work did a comprehensive and fair survey of existing works, which would be necessary if one quantitavely compares these numbers to previous works.\n2. Lines 160-183 mentions sufficiently strong attacks to study model robustness but does not mention adaptive attacks, which are the gold-standard \"sufficiently strong attacks\" to evaluate methods [1, 2]. I also do not understand the focus in the threat model on transfer attacks, as they have been shown to lead to misleading robustness evaluations in prior work. \n3. Regarding robust training, I'm missing a comparison to adversarially training. In particular, the in the paper chosen GNN model GPR-GNN was shown to be particularly strong against structure perturbations after adversarial training with PR-BCD (Gosch et al. 2023). Thus, a comparison would be interesting.\n4. Evasion textual attacks replaced 40% of test set nodes with LLM-text and poisoning textual attacks 80% fo the training nodes. These chooses seem quite strong and I think a gradual investigation (e.g., against 1%, 5%, 10%, 20%, ...) would be more interesting then setting one fixed attack budget.\n5. Confusing Paper Structure. Results are presented before the method. E.g., the first results paragraph presents findings on \"SFT-neighbor\", though the method is not introduced. Even though the findings motivate the development of \"SFT-neighbor\", I do think that a more classic structure Intro -> Method -> Results would be sufficient with some motivating results for the method mentioned in the intro / beginning of methods, or at least introducing the method in some way more than just a short mention in the introduction.\n6. I'm unsure how representative the results of comparing structure attacks for GNNs with an applied adaptive attack (PGD/GRBCD) is compared to a GraphLLM without an adaptive attack and thus, don't know if the statement \"GraphLLMs demonstrate inehrent robustnes against evasion attacks.\" truly holds under an adaptive attack setting.\n7. I think the main draft would benefit from a figure that doesn't only compare \"rankings\" but also some classic \"Accuracy vs Attack Budget\" plot, one for evasion and one for poisoning. \n\n[1] Tramèr et al. \"On adaptive attacks to adversarial example defenses\", NeurIPS 2020    \n[2] Mujkanovic et al. \"Are defenses for graph neural networks robust?\", NeurIPS 2022", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "le1u2jSywH", "reviewer": "Reviewer_jx3n", "summary": "This paper provides a comprehensive evaluation framework to assess the adversarial robustness of various models on Text-Attributed Graphs. Their large-scale analysis reveals the text-structure robustness trade-off in RGNNs and GraphLLMs, showing that models are typically strong against either structural or textual attacks, but not both. To overcome the trade-off and achieve a balanced robustness, the authors propose SFT-auto, a 2-staged framework that first detect the structural and textual attacks, then proceeds to an adaptive recovery.", "questions": "* Could the authors clarify on how SFT-auto leverages the LLM's reasoning to defend against structural attacks? The paper describes the detection mechanism for structure attacks as using embedding-based cosine similarity, which seems separate from the LLM's reasoning as it would have to use another text encoding model. This appears to contradict the claim that the LLM's capabilities are used to defend against both attack types within a single model.", "limitations": "", "rating": 2, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "* Authors provide a comprehensive, large-scale empirical evaluation across a wide range of models, datasets, and attack settings.\n* The writing and the figures are well-structured and easy to follow.\n* Various experiments provided in appendix.", "weaknesses": "* Some of the statements are wrongly addressed: \n\n     * In Section 3.1, it says that the spectral methods demonstrate superior performance against poisoning attacks while referencing [1]. However, [1] does not include any experiments or analysis on poisoning setting. \n     * In Section 3.2, GNNGuard and RUNG are marked as spectral methods, while both are spatial methods. \n\n* More recent work such as [2,3] could be included for the \"improving structure\" category for a more reliable empirical evaluation Also, while the authors reference [1] within the paper, it is not included as a baseline. \n\n\n* My primary concern is the novelty of SFT-auto. While the authors state that it overcomes the trade-off, it seems more like an incremental mergence of two simple defense methods against structure and text attacks. Moreover, while the authors provide a comprehensive evaluation framework for both poisoning and evasion setting, their suggested method to overcome the trade-off, SFT-auto, is only applicable to the evasion setting.\n\n\n\n\n[1] Adversarial Training for Graph Neural Networks: Pitfalls, Solutions, and New Directions \\\n[2] Boosting the Adversarial Robustness of Graph Neural Networks: An OOD Perspective \\\n[3] Self-supervised Adversarial Purification for Graph Neural Networks", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)