# Safety in Graph Machine Learning:
Threats and Safeguards

Song Wang, Yushun Dong, Binchi Zhang, Zihan Chen, Xingbo Fu, Yinhan He,
Cong Shen, Chuxu Zhang, Nitesh V. Chawla, and Jundong Li  S. Wang, Y. Dong, B.
Zhang, Z. Chen, X. Fu, Y. He, C. Shen, and J. Li are with the Department of
Electrical and Computer Engineering, University of Virginia, Charlottesville,
Virginia, USA.
E-mails: {sw3wv, yd6eb, epb6gw, brf3rx, xf3av, nee7ne, cong,
<EMAIL_ADDRESS>C. Zhang is with the Department of Computer Science,
Brandeis University, Waltham, Massachusetts, USA.
E-mail<EMAIL_ADDRESS>N. V. Chawla is with the Department of
Computer Science and Engineering, University of Notre Dame, Notre Dame,
Indiana, USA.
E-mail<EMAIL_ADDRESS>
###### Abstract

Graph Machine Learning (Graph ML) has witnessed substantial advancements in
recent years. With their remarkable ability to process graph-structured data,
Graph ML techniques have been extensively utilized across diverse
applications, including critical domains like finance, healthcare, and
transportation. Despite their societal benefits, recent research highlights
significant safety concerns associated with the widespread use of Graph ML
models. Lacking safety-focused designs, these models can produce unreliable
predictions, demonstrate poor generalizability, and compromise data
confidentiality. In high-stakes scenarios such as financial fraud detection,
these vulnerabilities could jeopardize both individuals and society at large.
Therefore, it is imperative to prioritize the development of safety-oriented
Graph ML models to mitigate these risks and enhance public confidence in their
applications. In this survey paper, we explore three critical aspects vital
for enhancing safety in Graph ML: reliability, generalizability, and
confidentiality. We categorize and analyze threats to each aspect under three
headings: model threats, data threats, and attack threats. This novel taxonomy
guides our review of effective strategies to protect against these threats.
Our systematic review lays a groundwork for future research aimed at
developing practical, safety-centered Graph ML models. Furthermore, we
highlight the significance of safe Graph ML practices and suggest promising
avenues for further investigation in this crucial area.

###### Index Terms:

Graph Machine Learning, Safety, Reliability, Generalizability, Confidentiality

##  1 Introduction

In recent years, graph-structured data has become increasingly prevalent
across a wide range of real-world applications, including drug discovery [15],
traffic forecasting [76], and disease diagnosis [96]. Within these domains,
Graph Machine Learning (Graph ML) plays a pivotal role in modeling this data
and executing graph-based predictive tasks [83, 187]. However, as the scope of
Graph ML applications expands, concerns about their underlying safety issues
intensify [37]. Inadequately addressing these issues can result in severe
implications, particularly in critical decision-making scenarios [203]. For
instance, in financial fraud detection, Graph ML models analyze transaction
networks where nodes represent users and edges depict transactions [151].
Susceptibility to shifts in data distribution could erroneously flag
legitimate transactions as fraudulent [37]. Additionally, these models may
also pose risks to user privacy [124]. Both these safety concerns
significantly erode trust in the financial system.

Despite growing societal concerns [147, 183], a comprehensive understanding of
safety within Graph Machine Learning (Graph ML) is still emerging. This lack
of understanding impedes researchers and practitioners from systematically
identifying and addressing the fundamental safety concerns associated with
Graph ML methods. To narrow this gap, our survey seeks to resolve two critical
questions: (1) What are the key aspects involved in the safety issues of Graph
ML? (2) What specific types of threats might arise within each aspect, and how
can they be effectively handled? To address the first question, we introduce a
novel taxonomy that facilitates a thorough categorization of safety issues in
Graph ML. To answer the second question, we provide a systematic review of
potential threats and their corresponding safeguards within each aspect
identified in our taxonomy.

We now delve into the first question, identifying three key aspects of safety
issues in Graph ML: _reliability_ , _generalizability_ , and
_confidentiality_. We discuss each aspect separately below. (1) Reliability:
Graph ML models often face challenges from low-quality training data, which
may stem from data noise [47, 188] or malicious attacks [49, 13]. Here, we
define reliability as the model’s ability to consistently produce high-quality
outputs even when confronted with substandard input. Reliability becomes
particularly critical when high-quality training data for Graph ML tasks is
scarce [6, 11]. For example, in drug discovery, Graph ML models predict the
chemical properties of new compounds, modeled as molecular graphs [91]. This
includes assessing toxicity to eliminate drugs with severe side effects [115].
Due to the prohibitive costs associated with experimental validations, high-
quality labels for training data are hard to come by. Therefore, maintaining
model reliability in the face of low-quality data is essential to ensure
accurate predictions [75]. (2) Generalizability: Generalizability refers to
the ability of Graph ML models to perform consistently well across various
scenarios, especially when there are changes in the underlying data
distribution [91]. This is crucial in environments where new, unseen graph
data frequently emerges [175]. For instance, in pandemic prevention, accurate
prediction of future infections is essential to allocate medical resources
effectively [198]. Graph ML is extensively used to forecast confirmed cases
using the topological data from different geographical areas (such as
counties, states, or countries) interconnected by migration paths [145].
However, pandemics typically result in asynchronous outbreaks across different
regions, leading to training and inference data for Graph ML models being
derived from diverse areas [128]. The lack of generalizability in these models
can cause the predicted infection rates to deviate significantly from actual
scenarios, potentially resulting in the misallocation of medical resources.
(3) Confidentiality: This aspect focuses on safeguarding the integrity of
Graph ML models and the privacy of the sensitive data they process [43, 35].
Confidentiality is particularly crucial in Graph ML applications that handle
personal data [203]. For instance, Graph ML is extensively utilized in
managing Electronic Health Records (EHR) for tasks such as disease diagnosis
and treatment prediction [107]. In these applications, various types of
information—such as patient names and diagnosis outcomes—are interconnected to
form heterogeneous graphs [103]. However, a significant challenge to
confidentiality in Graph ML arises from the prevalent use of message-passing
mechanisms, which facilitate the flow of information between nodes [37, 9,
140]. This process can inadvertently allow sensitive data to reach malicious
nodes, leading to potential disclosures of private information to unauthorized
entities, thereby compromising patient privacy [54].

We then address the second question by identifying three types of threats that
compromise the safety of Graph ML, applicable across all previously discussed
aspects. Specifically, the threats include (1) model threats, which stem from
the inherent learning mechanisms designed for graph structures, such as
message-passing, prevalent in most Graph ML models; (2) data threats,
originating from the complex interrelationships among nodes within the graph
topology; and (3) attack threats, which occur due to vulnerabilities in Graph
ML models when exposed to adversarial attacks. In this survey, we aim to
provide a comprehensive understanding of the origins of each threat type and
offer a systematic overview of current safeguarding techniques to mitigate
these risks.

TABLE I:  Comparison of our survey with other studies in the field, focusing
on each identified threat within the three key safety aspects.

Surveys | Scope | Reliability | Generalizability | Confidentiality
---|---|---|---|---
Safety | Graph ML | Model | Data | Attack | Model | Data | Attack | Model | Data | Attack
Li et al. [89] | ✔ |  |  | ✔ | ✔ | ✔ |  | ✔ | ✔ | ✔ | ✔
Liu et al. [98] | ✔ |  |  |  | ✔ |  |  | ✔ | ✔ | ✔ |
Jin et al. [80] | ✔ | ✔ |  |  | ✔ |  |  | ✔ |  |  |
Li et al. [91] |  | ✔ |  |  |  | ✔ | ✔ |  |  |  |
Wu et al. [167] | ✔ | ✔ |  |  | ✔ |  | ✔ | ✔ | ✔ | ✔ |
Dai et al. [37] | ✔ | ✔ |  |  | ✔ |  |  | ✔ | ✔ | ✔ | ✔
Zhang et al. [203] | ✔ | ✔ |  |  | ✔ |  |  | ✔ | ✔ | ✔ | ✔
Ours | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔

Contributions. In this survey, we conduct a comprehensive investigation of
safety issues in Graph ML and organize the key aspects of Graph ML safety in a
structured framework (as illustrated in Fig. 1). Additionally, we outline
three types of safety threats for each aspect and delve into specific
safeguard techniques designed to address these issues within the context of
Graph ML. In conclusion, our work makes three significant contributions to the
research community.

  * •

Novel Taxonomy for Graph ML Safety: We introduce a novel taxonomy to
categorize the safety issues in Graph ML, detailing three core aspects:
reliability, generalizability, and confidentiality.

  * •

Comprehensive Overview of Threats and Safeguards: We identify three distinct
types of threats common to all safety aspects. Building on this foundation, we
further explore safeguard techniques tailored to address each specific threat.

  * •

Future Research Potential in Graph ML Safety: We explore open challenges and
emerging opportunities in enhancing safety within the field of Graph ML,
aiming to inspire future research initiatives.

Comparison to other surveys. There have been a few surveys investigating
different types of safety issues and countermeasures for Graph ML [147, 182,
80, 167, 210, 91, 61]. However, these surveys often lack a comprehensive
understanding of safety in Graph ML. Other related surveys focus on a
different, yet related topic: trustworthiness [37, 203]. Most of these works
overwhelmingly focus on adversarial attacks, while the safety issues closely
tailored for Graph ML and graph data are usually neglected. Different from the
above works, in this survey, we not only provide a systematic review of a
broader notion of safety for Graph ML with the help of our newly proposed
taxonomy, but also elaborate on different types of threats, along with the
safeguard techniques to properly handle them. We provide a detailed comparison
of the differences in Table I.

##  2 Preliminaries of Graph ML

custom edge/.style= edge path=[edge, rounded corners](!u.parent anchor) –
(.child anchor)edge label straight edge/.style= edge path= [edge] (!u.parent
anchor) – (.child anchor)edge label;

for tree= edge=-, draw=connect-line, line width=1pt, edge path= [edge, rounded
corners] (!u.parent anchor) – +(-1pt,0pt) -| ([xshift=0pt].child anchor)edge
label; , grow=east, reversed=true, anchor=base west, parent anchor=east, child
anchor=west, base=middle, font=, rectangle, line width=1.2pt, draw=connect-
line, rounded corners,align=left, minimum width=2em, s sep=4pt, inner
xsep=3pt, inner ysep=0pt, , where level=1text width=4.5em, where level=2text
width=5em,font=, where level=3font=, where level=4straight edge, font=, where
level=5font=, [Safety in
Graph ML , anchor=north,edge=reliability, [Reliability, reliability-middle,
edge=reliability, text width=5.5em [Model Threat: Uncertainty, reliability-
middle, edge=reliability, text width=10em, [Aleatory Uncertainty, reliability-
middle, text width=8em, edge=reliability [Bayes-NC[42], URGE [67], Bayesian
GCN [211],
BGCN [126], GGP [120] , reliability-leaf, text width=18.0em, edge=reliability
] ] [Episdemic Uncertainty, reliability-middle, text width=8em,
edge=reliability [GCN-BBGDC [65], STZINB-GNN [226], CF-GNN [69], reliability-
leaf, text width=18.0em, edge=reliability] ] ] [Data Threat: Anomalies,
reliability-middle, edge=reliability, text width=10em, pattern=crosshatch,
pattern color=reliability [In-Graph Anomalies, reliability-middle, text
width=8em, edge=reliability,pattern=crosshatch, pattern color=reliability
[Radar [94], DOMINANT [47], CARE [49],
ANOMALOUS [131] , PC-GNN [101], CONAD [188],
GCCAD [21], CoLA [102], DONE [6], BWGNN [153],
Sub-CR [204], SL-GAD [219] , ACT [163], ,reliability-leaf, text width=18.0em,
edge=reliability,] ] [Cross-Graph Anomalies, reliability-middle, text
width=8em, edge=reliability,pattern=crosshatch, pattern color=reliability
[GAWD [86], M3FEND [224], UPFD [50],
OCGIN [215], DeepSphere [155], GLAD-PAW [160] , reliability-leaf, text
width=18.0em, edge=reliability] ] ] [Attack Threat: Poisoning, reliability-
middle, edge=reliability, text width=10em, fill=reliability!40 [Data Poisoning
Attack, reliability-middle, text width=8em,
edge=reliability,fill=reliability!40 [[13], CD-Attack [93], [186], Opt-Attack
[148],
[11], [12], [161], Nettack [227], Metattack [228],
AtkSE [105], NIPA [149], G-FairAttack [199],
FATE [81], Graph-Fraudster [25] , reliability-leaf, text width=18.0em,
edge=reliability ] ] [Data Poisoning Defense, reliability-middle, text
width=8em, edge=reliability,fill=reliability!40 [[212], NeuralSparse [218],
[51], ProGNN [80],
LRGNN [184], [154], SimPGCN [79], GAME [201],
AirGNN [100], Dragon [195], GCN-LFR [19] , reliability-leaf, text
width=18.0em, edge=reliability] ] ] ] [Generalizability, generalizability-
middle, edge=generalizability, text width=5.5em [Model Threat: Adaptation,
generalizability-middle, edge=generalizability,text width=10em, [Domain
Adaptation, generalizability-middle, text width=8em, edge=generalizability
[DANE [209], DGDA [18], GraphAE [62], GRADE [172],
SGDA [133], UDA-GCN [174], AdapterGNN [95] , generalizability-leaf, text
width=18.0em, edge=generalizability] ] [Test-Time Adaptation,
generalizability-middle, text width=8em, edge=generalizability [SOGA [112],
GAPGC [23], GT3 [165], G-GLOW [216] , generalizability-leaf, text
width=18.0em, edge=generalizability] ] ] [Data Threat: Unseen Data,
generalizability-middle, edge=generalizability, text width=10em,
pattern=crosshatch, pattern color=generalizability [Adversarial Training,
generalizability-middle, text width=8em,
edge=generalizability,pattern=crosshatch, pattern color=generalizability [ CAP
[189], GraphAT [52], DAGNN [175],
GNN-DRO [139], WT-AWP [177], generalizability-leaf, text width=18.0em,
edge=generalizability] ] [Invariant Learning, generalizability-middle, text
width=8em, edge=generalizability,pattern=crosshatch, pattern
color=generalizability [SR-GNN [221], EERM [176], DIR [178], GIL [92],
CAL [146], E-invariant GR [10], CIGA [30],
GSAT [116], IS-GIB [190], MARIO [225], LiSA [194], generalizability-leaf, text
width=18.0em, edge=generalizability] ] ] [Attack Threat: Evasion,
generalizability-middle, edge=generalizability, text width=10em,
fill=generalizability!40 [Model Evasion Attack, generalizability-middle, text
width=8em, edge=generalizability,fill=generalizability!40 [[29], FGA [26],
[97], RL-S2V [38], Q-Attack [24],
IG-JSMA [170], [202], GF-Attack [20], RWCS [108],
[117], GRABNEL [159], FA-GNN [72] , generalizability-leaf, text width=18.0em,
edge=generalizability] ] [Model Evasion Defense, generalizability-middle, text
width=8em, edge=generalizability,fill=generalizability!40 [[186], [39], LAT-
GCN [77], GraphDefense [164], [14],
[229], ELEGANT [48], GraphSAC [73], VPN [78] ,generalizability-leaf, text
width= 18.0em, edge=generalizability] ] ] ] [Confidentiality, confidentiality-
middle, edge=confidentiality, text width=5.5em [Model Threat: Privacy,
confidentiality-middle, edge=confidentiality, text width=10em [Differential
Privacy, confidentiality-middle, text width=8em, edge=confidentiality [VFGNN
[22], DP-GNN [41], LPGNN [141],
PrivGnn [122], GDP [32], PPGD [207],
DPNE [181], GAP [142], Linkteller [169], SGNN [114] , confidentiality-leaf,
text width=18.0em, edge=confidentiality] ] [Graph Unlearning, confidentiality-
middle, text width=8em, edge=confidentiality [GraphEditor [35], GraphEraser
[27], SGCunlearn[33],
GNNDelete [31], GIF [171], CEU [173], GST [127],confidentiality-leaf, text
width= 18.0em, edge=confidentiality] ] ] [Data Threat: Distributed Data,
confidentiality-middle, edge=confidentiality, text width=10em,
pattern=crosshatch, pattern color=confidentiality [Data Heterogeneity,
confidentiality-middle, text width=8em,
edge=confidentiality,pattern=crosshatch, pattern color=confidentiality [FedPub
[5], FGSSL [70], FedCog [87], FedSage [206],
GCFL [179], FedLit [180], FedStar [152], FLIT [223],
STFL [106], GraphFL [162], FedGCN [192],confidentiality-leaf, text width=
18.0em, edge=confidentiality] ] [Overlapping Instances, confidentiality-
middle, text width=8em, edge=confidentiality,pattern=crosshatch, pattern
color=confidentiality [FedE [28], FedR [205], FKGE [130],
FeSoG [104], FedPerGNN [168] ,confidentiality-leaf, text width= 18.0em,
edge=confidentiality] ] ] [Attack Threat: Stealing, confidentiality-middle,
edge=confidentiality, text width=10em, fill=confidentiality!40 [Model Stealing
Attack, confidentiality-middle, text width=8em,
edge=confidentiality,fill=confidentiality!40 [Adversarial Model Extraction
[43], Six-type
Model Extraction Attacks [166], GNNStealing [144], confidentiality-leaf, text
width=18.0em, edge=confidentiality] ] [Model Stealing Defense,
confidentiality-middle, text width=8em,
edge=confidentiality,fill=confidentiality!40 [ER Graph Watermarking [217], GNN
Watermarking [185], GrOVe [158] ,confidentiality-leaf, text width= 18.0em,
edge=confidentiality] ] ] ] ]

Figure 1: A taxonomy of safety problems and solutions on Graph ML and the
related works.

###  2.1 Notations

Throughout this survey, we represent a graph as
$\mathcal{G}=(\mathcal{V},\mathcal{E})$, with
$\mathcal{V}=\\{v_{i}\\}_{i=1}^{N}$ and
$\mathcal{E}\subseteq\mathcal{V}\times\mathcal{V}$ being the node set and the
edge set, respectively. $N=|\mathcal{V}|$ is the number of nodes in
$\mathcal{G}$, i.e., the size of graph $\mathcal{G}$.
$e_{ij}=(v_{i},v_{j})\in\mathcal{E}$ is an edge between $v_{i}$ and $v_{j}$.
We additionally consider the (optional) node features
$\mathbf{X}\in\mathbb{R}^{N\times d}$, where $\mathbf{x}_{i}\in\mathbb{R}^{d}$
is the $i$-th row vector of $\mathbf{X}$ and also a $d$-dimensional feature
vector of node $v_{i}$. We also represent the adjacency matrix of
$\mathcal{G}$ as $\mathbf{A}\in\mathbb{R}^{N\times N}$, where
$\mathbf{A}_{ij}=1$ if there exists an edge between $v_{i}$ and $v_{j}$, and
$\mathbf{A}_{ij}=0$, otherwise. For simplicity, we focus on undirected graphs
in this survey. We use bold uppercase characters to denote matrices (e.g.,
$\mathbf{X}$) and bold lowercase characters to denote vectors (e.g.,
$\mathbf{x}$). In Table II, we provide detailed descriptions for the notations
used in this survey.

###  2.2 Graph ML Methodologies

Graph ML methodologies have been extensively explored for analyzing graph-
structured data. Recently, Graph Neural Networks (GNNs) have emerged as a
superior alternative to traditional methods such as DeepWalk [132] and
Node2Vec [60], demonstrating their effectiveness across various tasks [83,
187, 64]. GNNs primarily operate on a message-passing scheme, where the core
mechanism involves updating node representations by iteratively aggregating
and processing information from neighboring nodes. This representation
learning process within the $k$-th layer of GNNs is described as follows

$\mathbf{m}_{v}^{(k)}=\text{Aggregate}(\\{\mathbf{h}_{u}^{(k-1)}|u\in\mathcal{N}_{v}),$
(1)
$\mathbf{h}_{v}^{(k)}=\text{Update}(\mathbf{m}_{v}^{(k)},\mathbf{h}_{v}^{(k-1)}),$
(2)

where $\mathbf{h}_{v}^{(k)}$ is the representation of node $v$ after the
$k$-th GNN layer, and $\mathcal{N}_{v}$ denotes the neighboring node set of
$v$. The learned node representations can be applied to various graph-related
tasks, e.g., node classification, link prediction, and graph classification.
For instance, in node classification, a classifier is typically trained to map
node representations to specific labels [83]. In graph classification, a read-
out function, often implemented as averaging, is used to aggregate node
embeddings into a single graph-level embedding. For a more detailed discussion
on learning with graphs, refer to [214].

TABLE II:  Key notations used in this paper.

Notations | Description
---|---
$\mathcal{G}$ | A given graph.
$\mathcal{V}$ | The node set of $\mathcal{G}$.
$v\in\mathcal{V}$ | A node in $\mathcal{V}$.
$\mathcal{N}_{v}$ | The neighbor set of node $v$.
$\mathcal{E}$ | The edge set of $\mathcal{G}$.
$e\in\mathcal{E}$ | An edge in $\mathcal{E}$.
$N$ | The number of nodes in $\mathcal{G}$, i.e., $|\mathcal{V}|$.
$d$ | The dimension size of a node feature.
$\mathbf{X}\in\mathbb{R}^{N\times d}$ | The node feature matrix.
$\mathbf{A}\in\mathbb{R}^{N\times N}$ | The adjacency matrix.
$d_{h}$ | The dimension size of the hidden representations.
$\mathbf{h}_{v}\in\mathbb{R}^{d_{z}}$ | The hidden representation of node $v$.
$f(\cdot)$ | A Graph ML model.

##  3 Reliability in Graph ML

Due to the complex nature of graph data, acquiring high-quality training data
is a significant challenge [47, 49]. When models are trained on data of poor
quality, their performance can be severely compromised [188]. We define
reliability as the ability of a model to maintain consistent performance, even
when trained on lower-quality data. The lack of reliability exposes models to
the risks associated with noisy or tampered data, potentially leading to
incorrect predictions. This issue is particularly critical in decision-making
processes, where such inaccuracies could result in unacceptable outcomes [42,
67]. For example, in financial fraud detection, it is crucial to accurately
identify fraudulent transactions. A model that lacks reliability might fail to
detect fraudulent activities or falsely label legitimate transactions as
fraudulent, resulting in financial losses. Thus, enhancing reliability in
Graph ML models is vital for ensuring their safety and dependability in
critical applications, ultimately reducing the risk of erroneous outcomes
[126, 120].

Reliability in Graph ML can be compromised from several angles. First, the
model’s inherent limitations in processing uncertain data can lead to
overconfident predictions in unfamiliar situations [65]. Unlike image or text
data, graph data involves complex interactions between nodes, and
uncertainties in these connections can impact model predictions [226]. Second,
anomalies in training data, such as nodes and graphs that deviate
significantly from typical distributions, pose a significant threat to model
performance and, consequently, reliability [47, 6]. Since Graph ML models
aggregate information from neighboring nodes, anomalous nodes can influence
the representations learned across the graph, affecting overall model
reliability. Third, poisoning attacks involve the insertion of maliciously
crafted data into training sets to compromise model reliability [93]. Within
the graph topology, attackers can manipulate a few nodes to adversely affect
other distant nodes, making these attacks particularly difficult to detect
[80].

Below, we discuss a range of safeguard techniques aimed at enhancing model
reliability against these threats.

###  3.1 Model Threat: Uncertainty

Uncertainty in model predictions refers to the variance within these
predictions, highlighting the extent to which a model is unsure about its
outcomes [126, 120]. In Graph ML models, such uncertainty can significantly
undermine reliability, particularly in high-stakes applications [66]. For
instance, in drug discovery, if a Graph ML model predicts that a compound is
likely effective against a particular disease but with high uncertainty,
additional experiments are necessary to confirm the compound’s efficacy [75,
115]. Uncertainty quantification [211] serves as a crucial technique to
estimate the confidence level of each prediction in Graph ML models. This
approach enables the identification of predictions that require further
validation, thus enhancing the overall reliability of the model. Specifically,
uncertainty quantification can address two main types of uncertainty:
_Aleatory Uncertainty_ , which arises from noisy input data [67], and
_Epistemic Uncertainty_ , which results from imperfect model parameters [65].

In the following sections, we explore research efforts that utilize
uncertainty quantification to develop more reliable Graph ML models.

####  3.1.1 Aleatory Uncertainty

Aleatory uncertainty pertains to the inherent randomness in data caused by
noisy or imprecise measurements. In Graph ML, aleatory uncertainty primarily
originates from two sources: the node feature matrix $\mathbf{X}$ and the
adjacency matrix $\mathbf{A}$. For instance, in a protein-protein interaction
(PPI) network [137], each node represents a protein characterized by a feature
vector detailing its chemical properties, while each edge denotes the
interaction between two proteins. Both the chemical properties (i.e., node
features) and the interactions (i.e., edge connections) are subject to
measurement errors and inherent variability, contributing to uncertainties in
both graph node features and topology [193]. When Graph ML models employing
message-passing mechanisms, such as GCN [83], are used on these uncertain
nodes and edges, this uncertainty can propagate through the network,
significantly affecting the learning process.

Currently, most studies addressing aleatory uncertainty concentrate on the
uncertainty inherent in graph structure, typically resulting from imprecise
measurements of the graph’s configuration. The prevalent approach to modeling
this type of uncertainty is to treat the input graph as an uncertain graph
[42, 67]. In such an uncertain graph, each pair of nodes is assigned a
probability value that indicates the likelihood of an edge existing between
them. For example, Bayesian GCN [211] investigates uncertain graphs derived
from a parametric family of random graphs and estimates the prediction
distribution of a Graph ML model using the expression
$p(\mathbf{Z}|\mathbf{Y},\mathbf{X},\mathcal{G}_{obs})$, which is defined as
follows:

$\displaystyle\int
p(\mathbf{Z}|\mathbf{W},\mathcal{G},\mathbf{X})p(\mathbf{W}|\mathbf{Y},\mathbf{X},\mathcal{G})p(\mathcal{G}|\lambda)p(\lambda|\mathcal{G}_{obs})d\mathbf{W}d\mathcal{G}d\lambda.$
(3)

In this context, $\mathbf{Z}$ represents the output of the Graph ML model,
such as the predicted node label distribution matrix. $\mathbf{Y}$ refers to
the node labels from the training data. $\mathcal{G}_{obs}$ denotes the
observed input graph, while $\mathcal{G}$ represents the uncertain graph.
$\mathbf{W}$ represents the weights of a Bayesian GCN, and $\lambda$ indicates
the parameters governing the probability distribution of the uncertain graph

However, it is important to note that the Bayesian GCN relies heavily on the
probability distribution of the uncertain graph, where
$p(\lambda|\mathcal{G}_{obs})$ estimates its parameters, $\lambda$.
Subsequently, $p(\mathcal{G}|\lambda)$ describes the distribution of the
uncertain graph conditioned on its parameters $\lambda$. This model primarily
captures information about the graph structure and neglects node features. To
address this, BGCN [126] introduces a non-parametric version of the Bayesian
GCN, which integrates node feature information into the GNN predictions. Both
the Bayesian GCN and its non-parametric counterpart involve high computational
complexity due to the necessity of Monte Carlo sampling for estimating the
probability distribution of the uncertain graphs. To construct a more
efficient uncertainty-aware Graph ML model, GGP [120] utilizes a data-
efficient Gaussian process-based Bayesian approach, which speeds up the
training process while still delivering satisfactory performance.

####  3.1.2 Episdemic Uncertainty

Epistemic uncertainty, also known as systematic uncertainty, arises from
knowledge gaps in what could theoretically be known but remains unknown in
practice [44]. This type of uncertainty often stems from a model’s omission of
certain factors, leading to an incomplete representation of the underlying
process. In Graph ML, epistemic uncertainty specifically refers to the
uncertainty associated with the model parameters. To measure the epistemic
uncertainty of Graph ML models, current studies typically fix the input
graph’s adjacency matrix (to control aleatory uncertainty) and estimate the
model’s prediction error using Bayesian approaches [213, 65]. As a classic
example, GCN-BBGDC [65] quantifies GNN epistemic uncertainty through Patch
Accuracy versus Patch Uncertainty (PAvPU). PAvPU assesses the ratio of
accurate certain predictions to inaccurate uncertain predictions, with higher
PAvPU values indicating that that certain predictions are more accurate while
inaccurate predictions are more uncertain. Additionally, the Mean Prediction
Interval Width (MPIW) serves as another measure of GNN epistemic uncertainty,
calculated as $\text{MPIW}=\frac{1}{N}\sum\nolimits_{i=1}^{N}(U_{i}-L_{i})$,
where $N$ is the number of nodes in the input graph, and $L_{i}$ and $U_{i}$
are the endpoints of the confidence interval for each node’s prediction.
However, PAvPU provides an overall model uncertainty value rather than
individual node uncertainty. Addressing this, STZINB-GNN [226] calculates a
90% confidence interval for each node’s prediction, offering a more granular
view of epistemic uncertainty. Similarly, CF-GNN [69] applies conformal
prediction to estimate epistemic uncertainty at the node level.

Figure 2: Safety threats regarding reliability in Graph ML.

###  3.2 Data Threat: Anomalies

Anomalies in graph data, such as abnormal nodes and edges with noisy and
outlying patterns that significantly deviate from the normal distribution [47,
6], pose considerable challenges. For example, fake users on social networks
intended to spread misinformation represent such anomalies [220]. In Graph ML
models, the presence of these data anomalies can severely compromise model
reliability by impairing the learning process. Consider a scenario where a
Graph ML model is trained to classify news articles on social networks as
credible or not [90]. If the training dataset includes fake news articles not
identified as anomalies, the model may erroneously classify these articles as
credible. This can lead to a failure in accurately detecting new instances of
fake news, thereby undermining the model’s reliability [109].

Recently, a variety of graph anomaly detection (GAD) techniques have been
developed to mitigate the negative impact of anomalies [188, 109, 215, 50]. By
identifying and removing anomalous patterns, we can enhance the reliability of
Graph ML models. Unlike anomalies in Euclidean spaces, such as images,
anomalies in graphs present unique challenges due to the complex interactions
among nodes [209]. For example, in social networks, fake users may connect
with numerous real users to blend in and expand their influence [53].
Detecting such anomalies necessitates a deep understanding of complex graph
topologies and node relationships [101]. We will now discuss various effective
methodologies for detecting anomalies in graph data. We categorize GAD
techniques into two types based on the nature of the anomalies: techniques for
detecting in-graph anomalies and cross-graph anomalies.

####  3.2.1 In-Graph Anomalies

In-graph anomaly detection focuses on identifying anomalous components within
a graph, such as nodes, edges, and subgraphs. In this subsection, we
concentrate on node-level detection, as it is the most commonly addressed
aspect in existing research.

Reconstruction-based Methods. Typically, anomalous nodes in a network, such as
attacker accounts in commercial systems or fraudulent users in social media
networks, exhibit significant deviations compared to regular nodes [102, 220].
A common strategy for detecting these anomalies involves training a model to
reconstruct the information of each node and using the reconstruction error
for anomaly detection [46]. Intuitively, a node with a higher reconstruction
error is more likely to be anomalous. Consequently, the anomaly score $a$ of
node $v$ is estimated as follows:

$a\propto\alpha\cdot d(\mathbf{h}_{s},\hat{\mathbf{h}}_{s})+\beta\cdot
d(\mathbf{h}_{x},\hat{\mathbf{h}}_{x}),$ (4)

where $\mathbf{h}_{s}$ and $\mathbf{h}_{x}$ represent the learned
representations of node $v$ from its local structures and node features,
respectively. The function $d(\cdot,\cdot)$ measures the distance between two
inputs, while $\alpha$ and $\beta$ are hyperparameters that control the weight
of these distances. With this model, anomaly scores are calculated for each
node, identifying those with higher scores as potential anomalies [109]. Among
various methods, Radar [94] uses matrix decomposition to model the residuals
of attribute information and its coherence with network information, using
these residuals to detect anomalies. ANOMALOUS [131] mitigates the impact of
noisy and structurally irrelevant attributes via attribute selection and
detects anomalies with residual analysis while focusing on representative
attributes. More recent approaches leverage Graph Neural Networks (GNNs) to
derive comprehensive node representations for GAD. For example, DOMINANT [47]
employs Graph Convolutional Networks (GCNs) to learn and then reconstruct
graph structure and node features using separate decoders, also implemented as
GCNs. Similarly, ResGCN [129] uses GCNs along with a linear classifier to
model the node feature matrix. Like Radar, ResGCN calculates a residual matrix
during the reconstruction process and uses these residuals to compute anomaly
scores.

Contrastive Learning Methods. Recent studies have highlighted that in
reconstruction-based methods, the optimization objective of reconstruction is
not inherently linked to anomaly detection. This is because the model may
still learn to reconstruct anomalous patterns in the graph data [188]. As a
response, newer GAD methods have begun incorporating contrastive learning
[123], which differentiates between various representations of nodes (referred
to as contrastive pairs). The degree of similarity between nodes serves as an
indicator of their anomalousness [219]. CoLA [102] uses random walks to sample
two subgraphs for each node as a contrastive pair and calculates the anomaly
score based on the differences between the target node and the sampled
subgraphs. However, CoLA’s random sampling does not capitalize on prior
knowledge. Addressing this, CONAD [188] integrates anomaly types identified by
human experts to generate varied representations for the contrastive pair,
using contrastive learning to distinguish these representations and compute
anomaly scores based on their discrepancies. Still, these methods lack the
ability to adaptively generate contrastive pairs for each node. To refine this
process, Sub-CR [204] employs graph diffusion techniques to create contrastive
pairs from both local and global perspectives.

####  3.2.2 Cross-Graph Anomalies

Cross-graph anomaly detection focuses on identifying individual graphs that
display significant deviations compared to other graphs [215, 50]. Initially,
researchers approached the detection of cross-graph anomalies using
traditional graph representation techniques, such as Graph2Vec [119]. This
approach transforms the task of cross-graph anomaly detection into a
conventional anomaly detection problem with independent and identically
distributed (i.i.d.) data [85]. Typically, these representation-based methods
employ a two-stage strategy [109]: first, graphs are encoded into a shared
latent space using graph-level representation methods; then, an anomaly
detection algorithm assesses the anomalousness of each graph. Despite their
straightforward nature, these methods often suffer from suboptimal
performance, as the representations they learn may not effectively capture the
nuances necessary for detecting anomalies [86].

Recent advancements in cross-graph anomaly detection have leveraged GNNs to
develop more sophisticated graph representations [68, 224]. For instance, UPFD
[50] approaches the challenge of fake news detection by treating news articles
as tree-like propagation graphs, where the root node represents the news
article and the surrounding nodes signify users spreading the article. For
each news graph, representations derived from both the text and graph
structures are used to identify anomalies. Another notable development, OCGIN
[215], employs a one-class classification loss [138] to create an end-to-end
framework for cross-graph anomaly detection. In this model, the embedding for
each graph is generated by mean-pooling the embeddings of its nodes, with
graphs deemed anomalous if they fall outside the defined hypersphere.

###  3.3 Attack Threat: Data Poisoning

Recent studies have highlighted how adversarial attacks on training data,
often referred to as data poisoning attacks, can significantly compromise the
training phase of Graph ML models [227, 38, 80, 148]. These attacks involve
subtle yet deliberate modifications to nodes and edges within the graph data,
aimed at undermining the training process [149, 199]. Such data poisoning
attacks pose a considerable threat to the reliability of Graph ML models by
deteriorating their performance. For example, spammers on social networks can
act as adversarial samples [53]. Unlike normal users, spammers may disseminate
fake and sensitive content, hijack trending topics, and misuse mention
functions [90]. The actions of spammers can significantly disrupt the utility
of Graph ML models applied to normal users due to the extensive connections
within the graph [3]. This leads to less accurate predictions from the trained
models, posing a severe threat to their reliability.

Although defensive strategies for data types like images have been extensively
explored, the inherent complexity of graph structures significantly
complicates the task of defending against attacks [25]. In graphs,
perturbations targeting even a single node can impact a broad array of
connected nodes due to the interconnected nature of the data [105]. To address
these unique challenges, various defensive techniques have been developed
recently to protect graphs by identifying and mitigating the effects of data
poisoning attacks [78]. Below, we discuss recent advancements in attack
mechanisms and defensive strategies against data poisoning, with further
details provided in Table III.

####  3.3.1 Data Poisoning Attack

We first formulate the problem of data poisoning attacks on graphs as a
bilevel optimization task:

######  Problem 1.

Given a graph $\mathcal{G}=(\mathcal{V},\mathcal{E})$, let
$f:\mathcal{G}\rightarrow Z$ be a Graph ML model, where $Z$ denotes the node
embeddings. The data poisoning attacks on graphs can be formulated as

$\displaystyle\max_{\mathcal{G}^{\prime}\in\mathcal{F}}\mathcal{L}_{atk}(\mathcal{G}^{\prime},f^{*}),\quad\;\text{s.t.}\;\;f^{*}=\operatorname*{argmin}_{f}\mathcal{L}(\mathcal{G}^{\prime},f),$
(5)

where $\mathcal{L}_{atk}$ denotes the attacker’s objective function and
$\mathcal{F}$ denotes the feasible space of poisoned graphs.

Data poisoning attacks on graphs can be categorized based on the attacker’s
knowledge into three types: white-box attacks [186], gray-box attacks [81],
and black-box attacks [148]. In white-box attacks, the attacker has complete
access to the victim’s model and data, including model parameters, training
data, and ground truth labels [11, 12, 202]. While white-box attacks can be
highly effective on Graph ML models, meeting the conditions for such attacks
is often impractical in real-world scenarios [80]. Gray-box attacks provide
the attacker with limited knowledge of the victim’s model and data, excluding
access to the exact model parameters [199]. In these cases, attackers
typically use a surrogate Graph ML model to predict the behavior of the victim
model. Black-box attacks further reduce the attacker’s knowledge; the attacker
only accesses the input graph data and the corresponding model output [93].
Any details about model parameters, ground truth labels, or intermediate
results are inaccessible [20, 159]. These attacks can be aimed at various
graph-related tasks, such as node classification and link prediction, with the
attacker’s objectives varying across different scenarios.

TABLE III: Different categories of methods for poisoning attacks for Graph ML.

Target Task | Setting | References
---|---|---
Community Detection | Black-box | [93]
Network Embedding | Black-box | [13]
Node/Graph | White-box | [186]
Classification | Gray-box | [227, 228, 105, 161, 149]
Link Prediction | White-box | [11, 12]
Black-box | [148]
Trustworthiness | Gray-box | [199, 81]

Node Classification. For node classification tasks, [186] formulates the
white-box poisoning attack as a bilevel optimization problem, where Projected
Gradient Descent (PGD) [121] is used to approximate a solution in the discrete
graph topology space. Similarly, Nettack [227], a seminal method in the gray-
box setting, substitutes the victim model with a simpler GCN surrogate.
Nettack optimizes by greedily flipping edges to maximize the increase in loss
over the targeted node, effectively navigating the discrete topology of graph
data. However, to mount a comprehensive attack on all nodes within a target
graph, the greedy selection approach, while effective, becomes computationally
intensive. Metattack [228] addresses this by employing meta-learning [55] to
approximate the meta gradient of the loss function across all victim nodes in
terms of the adjacency matrix, flipping the edge that maximizes the loss
increment. Building on this, AtkSE [105] incorporates strategies for edge
discrete sampling and momentum gradient ensemble to mitigate the optimization
instability caused by meta gradient inaccuracies. Addressing the complexity of
bilevel optimization, Wang et al. [161] reformulate poisoning attacks against
collective classification on graphs [143] as a constrained optimization
problem, simplified through the use of Lagrange multipliers with PGD to
resolve it within the discrete graph data domain. Beyond edge flipping,
attackers may also introduce adversarial nodes into the graph to disrupt
classification outcomes, as seen in NIPA [149], where attackers add new nodes
without altering the existing graph structure. Additionally, G-FairAttack
[199] presents a gray-box approach that subtly undermines the group fairness
of GNNs without noticeably affecting model utility. In a related effort, FATE
[81] uses meta-learning to simultaneously target both group and individual
fairness [228].

Link Prediction. Opt-Attack [148] serves as a classic example of how the
quality of unsupervised graph embeddings, such as DeepWalk [132], can be
compromised in link prediction tasks. When the target is a knowledge graph,
attackers may alter links or entities to disrupt the embeddings, consequently
reducing link prediction accuracy. Bhardwaj et al. [11] employ the influence
function [84] to identify the knowledge triple that most significantly impacts
the prediction of a target triple and replace it with a distant, irrelevant
entity. Additionally, [12] targets knowledge graph embeddings by exploiting
relational inference patterns. Specifically, the authors develop different
scoring functions based on symmetry, inversion, and composition patterns to
select the most impactful relations and knowledge entities for modification.

Other Tasks on Graphs. Data poisoning attacks are also performed on community
detection [93] and network embedding [13]. For community detection, CD-Attack
[93] is a classic poisoning attack method in the black-box setting. This
approach involves generating adversarial graphs that maximize the normalized
cut while using a constrained VGAE model [82] to obscure targeted entities
from detection. In the realm of network embedding, Bojchevski et al. [13]
directly maximize the unsupervised loss function $\mathcal{L}_{atk}$ for
DeepWalk [132] in a black-box setting. Moreover, the effectiveness of these
attacks can extend to other graph embedding methods such as node2vec [60] and
GCN [83].

####  3.3.2 Defense Against Data Poisoning Attacks

We now explore defense strategies aimed at protecting Graph ML models from
data poisoning attacks.

Poisoned Data Filtering. When faced with a potentially poisoned graph as
input, various defense techniques aim to filter out the compromised elements
before training begins. Entezari et al. [51] defend against the Nettack [227]
by replacing the poisoned graph with a low-rank approximation prior to the
training process. NeuralSparse [218] counters data poisoning attacks using a
supervised graph sparsification module that removes task-irrelevant edges
while learning graph representations. This approach utilizes a deep neural
network to parameterize the edge selection process within the one-hop
neighborhood, adhering to a fixed budget. In a similar vein, ProGNN [80]
simultaneously learns a clean graph structure and a robust GNN to enhance the
utility of the target GNN on unlabeled nodes of a poisoned graph. The
defense’s learning objective preserves several graph properties, including low
rank, sparsity, and feature smoothness. Given the significant computational
demands of computing a low-rank approximation with $O(N^{3})$ time complexity
and $O(N^{2})$ space complexity (where $N$ is the number of nodes), LRGNN
[184] decouples the adjacency matrix into low-rank and sparse components,
focusing on minimizing the rank of the low-rank part while suppressing the
sparse component. Aside from directly learning a clean graph, Zhang et al.
[212] propose methods to detect adversarial attacks on graphs. Specifically,
they introduce two statistical tests to identify single-node poisoning and
node-set corruption, employing Jensen-Shannon Divergence and Maximum Mean
Discrepancy, respectively.

Robust Graph Learning. Another approach to defending against data poisoning
does not involve filtering out poisoned data; instead, it focuses on learning
graph embeddings that are inherently robust against attacks. Tang et al. [154]
explore how to train a robust Graph ML model using a set of clean graphs by
generating ground truth poisoned links on clean graphs to train an attack-
aware Graph ML model. However, such supervision signals are often scarce in
real-world scenarios. In the absence of explicit supervision signals, SimPGCN
[79] enhances robustness by maintaining feature similarity during the node
aggregation process. SimPGCN designs a new aggregation mechanism that
adaptively balances the information from the graph structure and node
features. Further developments in robust Graph ML methods are explored in
multiple studies such as [100, 19, 201, 195], each offering unique
perspectives on improving resilience.

Figure 3: Safety threats regarding generalizability in Graph ML.

##  4 Generalizability in Graph ML

Most existing Graph ML models are developed under the assumption that the data
distribution during inference mirrors that during training [91]. However, this
assumption often falls short in practice due to the complexity of graph data
structures. Consequently, generalizability—defined as the ability to maintain
consistent model performance across varying data distributions—becomes crucial
for the safe deployment of Graph ML models. For instance, in drug discovery,
Graph ML models are typically tasked with predicting the toxicity of new drugs
that may differ significantly from the training data distributions. A failure
to generalize effectively to these new drugs can result in unreliable
predictions, potentially compromising the development of medical treatments
[63, 30].

Despite the critical importance of generalizability for ensuring the safety of
Graph ML models, various threats challenge the achievement of consistent model
generalizability. First, the threat to generalizability from the model arises
due to inherent limitations in its design, where the model may not effectively
adapt to the target (unlabeled) distributions encountered during training
[222, 111]. When training involves data from various distributions, designing
models to enhance generalizability is crucial for the wide-ranging
applications of Graph ML models [110]. Second, data threats stem from
encountering unseen data distributions that were not represented during
training, potentially impairing the performance of Graph ML models in novel
scenarios [92]. Given that target distributions are not observable during
training, it becomes challenging for Graph ML models to enhance
generalizability with the limited data available. Third, evasion attacks pose
a significant threat to the generalizability of Graph ML models. These attacks
involve deliberately manipulating input data during inference to induce
prediction errors and compromise model safety [52, 98]. These threats
compromise model generalizability from various angles, necessitating tailored
safeguard techniques to address them. Below, we introduce strategies that
enhance the generalizability of Graph ML models.

TABLE IV:  Categories of methods for Graph ML out-of-distribution
generalization.

Category | Strategy | Task | Require | References
---|---|---|---|---
Node-level | Graph-level | Size-shift | Domain Labels
Adversarial | Adversarial | ✔ |  |  |  | [189, 52, 139]
Training |  | ✔ |  | ✔ | [175]
✔ | ✔ |  |  | [177]
Invariant | Optimization | ✔ |  |  | ✔ | [176, 221, 225]
| ✔ |  | ✔ | [178, 92, 116]
✔ | ✔ |  |  | [190, 194]
Causality-based |  | ✔ |  |  | [30]
| ✔ | ✔ |  | [146, 10]

###  4.1 Model Threat: Adaptation

A crucial aspect of adaptation involves transferring the knowledge acquired
from labeled data (i.e., the source distributions) during training to
unlabeled data (i.e., the target distributions) [95, 40]. For instance, in
tumor classification, X-ray images are often represented as graphs by
connecting regions of pixels. Given that these graphs may come from multiple
medical centers using different devices, significant variations in data
distribution can occur [110]. In these scenarios, it is crucial for the model
to effectively learn from labeled data at one center and then apply this
knowledge to classify unlabeled graphs from another center, ensuring
diagnostic accuracy across data from diverse devices.

Below, we discuss safeguard techniques designed to enhance generalizability
through adaptation. Specifically, we explore two approaches that extend the
models’ learned knowledge and provide flexibility in handling various data
distributions: graph domain adaptation and test-time adaptation.

####  4.1.1 Graph Domain Adaptation

In graph domain adaptation, the objective is to utilize the abundant labeled
information from a source graph distribution and transfer the learned
knowledge to an unlabeled target graph distribution. This process aims to
bridge the gap between the two distinct distributions, allowing for effective
application across different data settings [174].

Distribution Alignment. A common approach to graph domain adaptation involves
aligning the source distribution with the target distribution. This strategy
has led to a series of studies focused on various methods for measuring
distribution discrepancies [91]. SR-GNN [221] utilizes central moment
discrepancy as a metric, serving as a regularization term during model
optimization. It specifically focuses on node representations learned by the
last activated hidden layers of GNN models to maximize the effectiveness of
distribution alignment regularization. Building on similar concepts, GraphAE
[62] also aims to minimize distribution discrepancies. However, GraphAE
employs message routing alignment and message aggregating alignment to address
differences in structures and node features, respectively, between the source
and target distributions. These alignments are incorporated into model
optimization through a proposed distance loss using a multiple kernel variant
of maximum mean discrepancy (MK-MMD). Furthermore, leveraging the message-
passing mechanism typical of GNNs [64], GRADE [172] introduces a novel
discrepancy metric called Graph Subtree Discrepancy, which assesses the
similarity of subtree representations generated by GNNs. This approach allows
the discrepancy measurement to benefit from the expressive power of GNNs.

Adversral Training. Another approach in domain adaptation employs adversarial
training techniques. Typically, this involves integrating a distribution
discriminator designed to differentiate between source and target
distributions. By training Graph ML models to produce representations that can
confuse this discriminator, the resulting representations become more robust
and less sensitive to variations across different distributions. DAGNN [175]
aims to develop generalizable graph representations that are indistinguishable
by a distribution discriminator, while still retaining crucial information for
prediction tasks as determined by the label classifier. However, the
optimization in DAGNN, which iteratively alternates between tuning the
distribution discriminator and the label classifier, can be suboptimal. To
address this issue, DANE [209] introduces an adversarial loss as a
regularization term to align representations learned from different
distributions. This allows for simultaneous optimization of both the
distribution discriminator and the label classifier. Furthermore, to encompass
a global perspective of both source and target distributions, UDA-GCN [174]
learns representations while ensuring global consistency across distributions.
Uniquely, UDA-GCN utilizes separate classifiers for the source and target
distributions to facilitate adaptation to both. More recently, in response to
potential label scarcity in the source distribution, SGDA [133] incorporates
pseudo-labeling for unlabeled nodes by assessing their distances to nodes in
each class, enhancing the model’s effectiveness under limited label
availability.

####  4.1.2 Test-Time Adaptation

Test-time adaptation aims to generalize a pre-trained model (developed on the
source distribution) to the target distribution, without requiring access to
the source distribution during adaptation. This method overcomes the
constraints of traditional domain adaptation, which typically necessitates the
presence of both source and target distributions for effective adaptation
[99].

Full Fine-tuning. Given a model pre-trained on the source distribution, a
straightforward strategy for test-time adaptation is to fine-tune the entire
model on the target distribution. It is essential to utilize the learned
information from the pre-trained model for predictions on data in the target
distribution. To achieve this, SOGA [112] focuses on preserving the knowledge
within the pre-trained model by maximizing the mutual information between the
inputs and outputs of the model. This approach helps retain and utilize the
discriminative ability of the pre-trained models during fine-tuning on the
target distribution. However, direct fine-tuning presents a risk of
overfitting to irrelevant features in the target distribution’s data [150]. To
mitigate this, GAPGC [23] adopts contrastive learning as a self-supervised
task to prevent overfitting. Furthermore, GAPGC introduces a trainable GNN-
based augmentation module that generates additional samples for contrastive
learning, thereby reducing the irrelevant information absorbed by the model.

Partial Fine-tuning. Existing strategies often propose dividing the model into
two components to reduce the costs associated with fine-tuning: an invariant
part and a specific part. During adaptation, only the specific part is fine-
tuned, while the invariant part remains unchanged. This approach not only
preserves the essential information from the pre-trained model but also
facilitates adaptation to the target distribution. In GT3 [165], the model is
split into two modules: a classification module and a self-supervised module.
During adaptation, the self-supervised module is fine-tuned on the target
distribution, while the classification module remains fixed. More recently,
GraphGLOW [216] uses a structural module that is consistent across
distributions, complemented by additional GNN layers that are specific to each
distribution. By fine-tuning only these additional layers, GraphGLOW achieves
adaptation to the target distribution without the need to fine-tune the entire
model.

###  4.2 Data Threat: Distribution Shifts

The data threat to generalizability, caused by distribution shifts,
underscores a core challenge in safe Graph ML: the ability of a model to adapt
to data that significantly deviates from the training distribution [91, 92].
This type of threat arises when a model trained on a specific dataset is
subsequently applied to new data following a different distribution. To
address distribution shifts, out-of-distribution (OOD) generalization has
emerged as a critical area of research in Graph ML, particularly in high-
stakes fields such as medicine, finance, and criminal justice [116, 190, 194].
Existing techniques for OOD generalization fall into two main categories: (1)
Adversarial Training methods aim to enhance the consistency of Graph ML model
performance across distributions by intentionally introducing larger
distribution shifts during training [175, 91]. (2) Invariant Learning methods
utilize the principle of invariant learning, which posits that there is a
consistent, invariant component across distributions for each sample. These
methods aim to identify and extract this component to facilitate out-of-
distribution (OOD) generalization [146, 190, 225]. Table IV shows
representative works in OOD generation for Graph ML.

####  4.2.1 Adversarial Training

GNN-DRO [139] employs distributionally robust optimization [135] to address
out-of-distribution (OOD) generalization challenges in node classification.
Specifically, it minimizes the worst-case loss under the assumption that the
data distribution fits within a Wasserstein ball centered around the empirical
data distribution. For graph-level tasks, various adversarial methods aim to
stabilize model performance across different domains. For instance, DAGNN
[175] seeks to learn generalizable graph representations inspired by the DANN
architecture [58]. In particular, it achieves this by performing adversarial
learning between a domain classifier and an encoder, thus enhancing model
generalizability. However, DAGNN necessitates domain labels for each sample,
which may not always be practical [176]. To overcome this limitation, GraphAT
[52] introduces perturbations to specific graphs to create augmented domains.
It generates adversarial perturbations for a sample by amplifying the
differences between the predictions of the target sample and its neighbors.
These perturbations are designed to significantly alter the graph smoothness
of the sample, thereby creating new domains for optimization.

####  4.2.2 Invariant Learning

Invariant learning methods focus on exploiting the stable relationships
between graphs and labels that persist across different data distributions
while disregarding inconsistent or spurious correlations [2]. At its core,
invariant learning assumes that each sample is composed of two elements: (1)
an invariant component, which maintains consistent feature-label relationships
across various distributions, and (2) a variant component, where these
relationships might change with shifts in the data distribution. By relying
solely on the invariant component for making predictions, models are better
equipped to handle significant distribution shifts, thereby enhancing out-of-
distribution (OOD) generalization capabilities [118, 4, 36].

For example, DIR [178] uses a GNN-based generator to identify invariant
subgraphs from graphs under interpolated data distributions to isolate stable
graph-label relationships across distributions by eliminating the variant
part. DIR does not require separating training data based on their
distributions, as it utilizes interpolated distributions. In contrast, GIL
[92] leverages the separation information of training data. It identifies
invariant subgraphs by clustering variant subgraphs according to how the
training data is divided, and it employs an invariant learning module to
generate invariant graph representations for classification. Differently, CIGA
[30] delves into the causality behind invariant subgraphs. By focusing on the
direct causal factors of the labels, CIGA enhances OOD generalization by
extracting and utilizing these critical, invariant components across different
distributions. More recent works propose to exploit invariant information from
perspectives like the information bottleneck [190] or contrastive learning
[225].

###  4.3 Attack Threat: Model Evasion

Model evasion attacks significantly challenge the generalizability of safe
Graph ML during inference by deliberately perturbing the input or corrupting
the utility of model predictions [78, 52]. This threat is particularly severe
in critical applications such as drug discovery [107] and financial analysis
[191], where incorrect predictions could have far-reaching consequences.
Below, we outline two key aspects of addressing model evasion attacks on Graph
ML: attack mechanisms and defense strategies. A more detailed categorization
can be found in Table V.

####  4.3.1 Model Evasion Attacks

In model evasion attacks, attackers aim to maximize an objective of a trained
Graph ML model $f^{*}$. We formulate the problem of model evasion attacks on
graphs as below.

######  Problem 2.

Given a graph $\mathcal{G}=(\mathcal{V},\mathcal{E})$, let
$f:\mathcal{G}\rightarrow Z$ be a graph machine learning model, where $Z$
denotes the node embedding. The model evasion attacks on graphs can be
formulated as

$\displaystyle\max_{\mathcal{G}^{\prime}\in\mathcal{F}}\mathcal{L}_{atk}(\mathcal{G}^{\prime},f^{*}),\quad\;\text{s.t.}$
$\displaystyle f^{*}=\operatorname*{argmin}_{f}\mathcal{L}(\mathcal{G},f),$
(6)

where $\mathcal{L}_{atk}$ denotes the attacker’s objective function and
$\mathcal{F}$ denotes the feasible space of poisoned graphs.

Below, we introduce attacks on node classification, link prediction, and other
tasks on graphs.

TABLE V: Different categories of methods for evasion attacks on Graph ML.

Target Task | Setting | References
---|---|---
Community Detection | White-box | [26]
Black-box | [29, 24, 26]
Network Embedding | White-box | [26]
Black-box | [26, 38]
Node/Graph | White-box | [170, 202]
Classification | Gray-box | [227]
Black-box | [20, 159, 117, 108]
Link Prediction | Gray-box | [97]
Trustworthiness | Black-box | [72]

Node Classification. IG-JSMA [170] is a white-box attack that utilizes
integrated gradients to estimate the impact of flipping an edge on the
attacker’s objective, identifying the edge that maximizes this objective
within the discrete graph structure domain. In Projective Ranking [202], the
perturbed edge is selected based on the mutual information between the
attacker’s objective and the input graph. In a more applicable black-box
setting, GF-Attack [20] aims to disrupt the spectral properties of the graph
filter. The attack’s objective has been demonstrated to be transferrable
across various types of graph learning models. This approach has been adopted
by other recent studies [159, 117, 108, 208].

Link Prediction. Lin et al. [97] propose two heuristic gray-box attacks, GGSP
and OGSP. GGSP employs a greedy strategy to perturb the edge that results in
the largest decrease in link prediction performance, while OGSP selects edges
based on an analysis of common neighbors. Additionally, preliminary studies
have highlighted vulnerabilities related to fairness [197, 113],
interpretation [59, 74], and privacy [156] in tabular, image, or text data.
However, the unique interdependencies between graph components and the
specific mechanisms of Graph ML models mean that attacks on the
trustworthiness of graph data remain relatively unexplored. FA-GNN [72]
specifically targets the algorithmic fairness of graph learning models by
injecting adversarial links. This method categorizes nodes into four groups
based on the label and sensitive attribute information and introduces random
cross-group links, thereby highlighting the susceptibility of fairness in
Graph ML models.

Other Tasks. We introduce evasion attacks on additional tasks such as
community detection [29, 24] and network embedding [26, 38]. In the context of
community detection, Chen et al. [29] present the first unsupervised evasion
attack with two distinct strategies. The first strategy involves injecting new
nodes that mimic target nodes to mislead the clustering process. The second
strategy randomly removes nodes and edges from a graph extended from the
original nodes. Q-Attack [24] employs heuristic algorithms to rewire edges in
the original graph in a black-box setting, optimizing the attack to disrupt
community structures. For network embedding, FGA [26] alters graph connections
by selecting the largest gradient component of the attacker’s objective, using
cross-entropy loss on target nodes as the loss function. FGA is capable of
attacking both community detection and network embedding models. Beyond using
gradient information, reinforcement learning is utilized to develop an
effective attack strategy. RL-S2V [38] is a black-box model evasion attack
that uses the Markov Decision Process to model sequences of graph
perturbations, with Q-learning employed to optimize the attack’s reward
function.

####  4.3.2 Model Evasion Defense

In this part, we introduce various strategies proposed for defense against
model evasion attacks on Graph ML.

Adversarial Training. The rationale behind adversarial training is to simulate
an attacker by maximizing the task-oriented loss during the training process
[147]. As a result, this approach empirically enhances the robustness of Graph
ML models against model evasion attacks during inference. The corresponding
objective is given as

$\displaystyle\theta^{*}=\operatorname*{argmin}_{\theta}\
\max_{\mathcal{G}}\mathcal{L}(f_{\theta}(\mathcal{G}),\mathcal{Y}).$ (7)

Here $f$ is a Graph ML model parameterized by $\theta$; $\mathcal{G}$ is the
graph used for training; $\mathcal{L}$ denotes the loss function;
$\mathcal{Y}$ represents the ground truth. Numerous existing studies have
proposed effective defense strategies based on the rationale of adversarial
training. For instance, in [38], the authors suggest randomly dropping edges
during training, a method that introduces topological noise and may improve
the objective function. This straightforward strategy has been empirically
shown to enhance the robustness of GNNs in both graph and node classification
tasks. Additionally, topological perturbations can be further optimized using
projected gradient descent [186], which has been demonstrated to fortify GNNs
without compromising model utility. Other studies have similarly employed
perturbations to either graph topology [39] or node attributes [77, 164] to
improve defense mechanisms.

Robustness Certification. While adversarial training has shown empirical
success in defense, it lacks formal robustness certification, leaving the
model potentially vulnerable to newly developed attack methods [80]. In
response to this limitation, several recent studies have focused on achieving
robustness certification for Graph ML models. For instance, Bojchevski et al.
[14] introduced a certified defense strategy for GNNs against structural
perturbations, and Zugner et al. [229] developed methods for certified defense
against node feature perturbations. Subsequent advancements have led to
certified defenses capable of addressing both types of perturbations [48].

Data & Model Refinement. Defense against model evasion attacks can be
strengthened either by modifying the input graph data or by adapting the Graph
ML model itself. For data manipulation, techniques such as preprocessing [73]
and augmentation [80] are employed to protect against attacks. On the model
front, replacing the traditional graph Laplacian in GCNs with a graph powering
operator [78] has proven to enhance the robustness of GNNs against evasion
attacks.

##  5 Confidentiality in Graph ML

Confidentiality in Graph ML encompasses the protection of sensitive
information within the data, the model predictions, and the model itself
[122]. This protection is crucial for ensuring user privacy and meeting legal
compliance requirements [183]. For instance, when employing Graph ML models
for user categorization on social networks, it is imperative to prevent the
inadvertent leakage of user information during both training and inference
stages [22].

Here, we introduce three types of threats to confidentiality as depicted in
Fig. 4. First, the model threat arises from inherent design flaws in the model
that could potentially leak sensitive information through its predictions or
architecture, thus raising privacy concerns [169]. This issue is particularly
acute in graph-based models, where the message-passing mechanism may
inadvertently expose sensitive information from neighboring nodes [22, 41,
141]. Second, the data threat emerges when training data is distributed across
multiple sources, potentially leading to the unintentional exposure of
sensitive information [70]. Given the structural nature of graph data,
ensuring data confidentiality across each source presents a significant
challenge [5, 87]. Third, the attack threat directly endangers model
confidentiality through unauthorized cloning of the model or its functionality
[185]. This not only breaches privacy but also violates intellectual property
rights, as the replicated model could be used or sold without permission [43,
166]. Below, we will explore protective strategies designed to mitigate these
confidentiality threats in Graph ML.

Figure 4: Safety threats regarding confidentiality in Graph ML.

###  5.1 Model Threat: Privacy

The model threat to confidentiality arises from designs that could
inadvertently expose private information through the architecture [114] and
learning mechanisms of the model [35]. For instance, the message-passing
mechanism in GNNs might unintentionally share a node’s sensitive information
with neighboring nodes, leading to potential privacy breaches [37, 220]. In
this discussion, we focus on two prominent categories of privacy-preserving
technologies: Differential Privacy and Graph Unlearning. A detailed
categorization of these methods is provided in Table VI.

TABLE VI: Different categories of privacy-preserving Graph ML methods.

Category | Unlearning Strategy | Graph Type | Task | References
---|---|---|---|---
Graph Unlearning | Exact Unlearning | Undirected | Node-level | [27, 35]
Approximate Unlearning | Undirected | Node-level | [33, 31, 171]
Edge-level | [173, 33]
Graph-level | [127]
Differential Privacy |  | Undirected | Node-level | [114, 141, 122, 22, 142, 181]
Directed | [32, 41]
Undirected | Edge-level | [169, 142, 207, 181]

####  5.1.1 Differential Privacy

Differential Privacy (DP) is a framework designed to protect the privacy of
data within datasets by ensuring that the inclusion or exclusion of any single
individual’s data does not significantly affect the output of the model [32,
167]. Generally, a randomized algorithm $\mathcal{M}$ is
$(\epsilon,\delta)$-DP if for any sample $\mathbf{z}$ in the training dataset
$\mathcal{D}$ and for all $\mathcal{S}\subseteq Range(\mathcal{M})$, it holds
that $Pr(\mathcal{M}(\mathcal{D})\in\mathcal{S})\leq
e^{\epsilon}Pr(\mathcal{M}(\mathcal{D}\setminus\mathbf{z})\in\mathcal{S})+\delta$.
Differential Privacy (DP) enhances privacy by adding controlled noise to model
updates. For example, DP-SGD [1] involves clipping gradient norms and
introducing noise to the gradients. Traditional DP methods, however, are less
suited to graph data due to the structural intricacies of graphs. Addressing
this challenge, DPNE [181] and PPGD [207] apply DP in learning graph
representations. More recent methods have focused on integrating DP with Graph
Neural Networks (GNNs). For instance, DP-GNN [41] utilizes a variation of DP-
SGD [7] and a novel subgraph sampling technique to safeguard privacy in
single-layer GNNs. For multi-layer GNNs, LPGNN [141] employs a Local
Differential Privacy (LDP) framework that perturbs node features and includes
a denoising layer to maintain accuracy. Conversely, PrivGnn [122] focuses on
global DP for the entire graph. However, these methods may not be suitable for
scenarios where edge privacy is a concern. To address this, LinkTeller [169]
uses edge-level DP algorithms to infer private edge information. To ensure
both edge-level and node-level DP, GAP [142] integrates stochastic noise into
the GNN’s aggregation function, aiming to statistically obscure the presence
of individual edges or nodes and their connections. Additionally, there have
been efforts to integrate Differential Privacy (DP) into federated learning.
SGNN [114] and VFGNN [22] each take a novel approach by partitioning the
entire graph and the computation graph of a GNN across multiple data holders,
respectively.

####  5.1.2 Graph Unlearning

To eliminate specific knowledge encoded in a model, an approach known as
machine unlearning is employed. This method seeks to eradicate the influence
of particular training data without the need to retrain the model from scratch
[16]. Machine unlearning is especially pertinent in situations where
individuals request the deletion of their data [8]. In this discussion, we
focus primarily on machine unlearning algorithms designed for graph data,
termed graph unlearning [27]. This can be further divided into two categories:
_exact graph unlearning_ and _approximate graph unlearning_.

Exact Graph Unlearning. Using a randomized learning algorithm $\mathcal{M}$,
we denote the models trained on the original graph dataset $\mathcal{D}$ and
on the dataset after removing specific data as $\mathcal{M}(\mathcal{D})$ and
$\mathcal{M}(\mathcal{D}\setminus\mathcal{D}_{f})$, respectively. Here,
$\mathcal{D}_{f}$ represents the dataset to be forgotten. A randomized
unlearning mechanism $\mathnormal{U}$ is considered an exact unlearning
process if, for all subsets $\mathcal{S}$ within the range of $\mathcal{M}$,
the equality
$Pr(\mathnormal{U}(\mathcal{D},\mathcal{D}_{f},\mathcal{M}(\mathcal{D}))\in\mathcal{S})=Pr(\mathcal{M}(\mathcal{D}\setminus\mathcal{D}_{f})\in\mathcal{S})$
holds. GraphEraser [27] is one of the first frameworks in graph unlearning. It
segments the training graph data into subgraphs and aggregates models trained
on these subgraphs for inference. When data needs to be forgotten, GraphEraser
re-trains only the models associated with subgraphs containing the deleted
data. GraphEditor [35], on the other hand, proposes an exact unlearning
mechanism for linear GNNs that avoids extensive retraining. It reframes the
training of GNNs into a problem with a closed-form solution, allowing for the
direct modification of model parameters to negate the influence of specific
nodes.

Approximate Graph Unlearning. "Unlike exact unlearning, approximate graph
unlearning seeks to update the original model with an approximation of the
retrained model, rather than retraining from scratch [140, 33]. Consequently,
while approximate graph unlearning may not completely eliminate the
information of the target samples as exact unlearning does, it offers a more
efficient solution for large-scale graphs. To assess the approximation error
of the retrained model, two parameters, $\varepsilon$ and $\delta$, are used
to quantify the proximity between the retrained model and the unlearned model
within the probability space, for all $\mathcal{S}\subseteq
Range(\mathcal{M})$

$\displaystyle
Pr(\mathnormal{U}(\mathcal{D},\mathcal{D}_{f},\mathcal{M}(\mathcal{D}))\in\mathcal{S})\leq
e^{\varepsilon}Pr(\mathcal{M}(\mathcal{D}\setminus\mathcal{D}_{f})\in\mathcal{S})+\delta,$
(8) $\displaystyle
Pr(\mathcal{M}(\mathcal{D}\setminus\mathcal{D}_{f})\in\mathcal{S})\leq
e^{\varepsilon}Pr(\mathnormal{U}(\mathcal{D},\mathcal{D}_{f},\mathcal{M}(\mathcal{D}))\in\mathcal{S})+\delta.$

Approximate graph unlearning can be categorized into three specific tasks:
node feature unlearning, edge unlearning, and node unlearning, each with
theoretical guarantees. These guarantees involve calculating an upper bound
for the influence of removing a node feature, an edge, and a node along with
all its associated edges. GST-unlearn [127] introduces a nonlinear learning
pipeline and incorporates an approximate unlearning algorithm based on [33],
providing theoretical assurances for its effectiveness. GIF [171] adapts the
traditional influence function to the graph domain, introducing the Graph
Influence Function to efficiently estimate the retrained model. Other recent
works also conducted explorations on utilizing influence functions [173] or
layer-wise analysis of GNNs [31] for graph unlearning.

TABLE VII: The category of federated learning methods.

Category | Task | Data on Each Client | References
---|---|---|---
Data Heterogeneity | Graph Classification/Regression | Multiple graphs | [179, 152, 223, 106]
Node Classification | A subgraph | [206, 5, 87, 162, 192, 200]
A graph | [180, 70]
Overlapping Node Alignment | Knowledge Graph Completion | A knowledge graph | [28, 205, 130]
Rating Prediction | A user-item graph | [104, 168]

###  5.2 Data Threat: Distributed Data

In many real-world applications, privacy concerns necessitate decentralized
graph data, often spanning multiple clients [57]. This distributed arrangement
poses significant risks of unauthorized data exposure through the message-
passing mechanism during training [206]. Recently, Federated Graph Learning
(FGL) has emerged as a key approach to learning from distributed graph data
while maintaining privacy [223, 192]. Below, we outline the general framework
for FGL.

Assume there are $K$ clients, each possessing a private graph dataset
$\mathcal{D}_{k}$. Let $N_{k}$ represent the number of samples in client $k$
and $N$ the total number of training samples across all clients. The
optimization objective for Federated Graph Learning (FGL) can be expressed as:

$\min\limits_{(\theta_{1},\theta_{2},\cdots,\theta_{K})}\sum_{k=1}^{K}\frac{N_{k}}{N}\mathcal{L}_{k}(\mathcal{D}_{k};\theta_{k}),$
(9)

where $\mathcal{L}_{k}$ and $\theta_{k}$ denote the local objective function
and model parameters for client $k$, respectively. Standard Federated Learning
(FL) aims to develop a global model where
$\overline{\theta}=\theta_{1}=\theta_{2}=\cdots=\theta_{K}$. Within the scope
of FGL, challenges mainly revolve around managing data heterogeneity and
ensuring node alignment across different clients. Representative studies in
FGL are summarized in Table VII.

####  5.2.1 Data Heterogeneity

Previous efforts to address data heterogeneity in Federated Graph Learning can
be divided into two categories: subgraph-level and graph-level methods. This
classification is based on the types of data possessed by the clients and the
specific target tasks they aim to accomplish.

Subgraph-Level Methods. In subgraph-level Federated Graph Learning (FGL), each
client holds a subgraph of the entire graph. This framework is tailored for
tasks such as neighbor generation [206] and community discovery [5]. FedSage
[206], for example, addresses the challenge of missing links in supervised
learning tasks. It involves a collaborative effort to train neighbor
generators, $\theta^{eg}_{k}$, for each client. These generators are then used
by clients to reconstruct their subgraphs, which are subsequently used to
train a GraphSage model [64]. However, FedSage can be sensitive to the initial
settings of the generative model and prone to node mismatches. To overcome
these issues, FedCog [87] decouples local subgraph computations and
differentiates propagation across inter and intra-edges. Recent developments
in subgraph-level FGL have also delved into semi-supervised optimization [162,
192] and structural heterogeneity [180, 5], expanding the applications and
capabilities of FGL.

Graph-Level Methods. These methods operate under the assumption that clients
each possess distinct graphs and generally seek to leverage shared properties
across these graphs [88, 134, 152, 179]. For example, GCFL [179] dynamically
groups clients into clusters based on gradients in GNNs, allowing clients
within the same cluster to share and update a common cluster model rather than
a single global model. Unlike approaches that share the entire GNN among
clients, FedStar [152] focuses on the structural properties common across
different domains. It divides the model into a structure encoder,
$\theta^{s}$, and a feature encoder, $\theta^{f}$, with
$\theta=(\theta^{s},\theta^{f})$. FedStar exclusively shares $\theta^{s}$
among clients and redefines the optimization problem as follows:

$\min\limits_{(\overline{\theta}^{s},\theta^{f}_{1},\theta^{f}_{2},\cdots,\theta^{f}_{K})}\sum_{k=1}^{K}\frac{N_{k}}{N}\mathcal{L}_{k}(\mathcal{D}_{k};(\overline{\theta}^{s},\theta^{f}_{k})).$
(10)

There are also domain-specific methods, e.g., those for molecular learning
[223] and spatial-temporal predictions [106].

####  5.2.2 Overlapping Node Alignment

In federated settings, a node in a client may also appear in other clients,
known as an overlapping node. Taking a recommendation system as an example, a
user may possess items that it has interactions with. In the meantime, these
items can also interact with other users. In this case, the embedding of a
specific item should be consistent across users. Prevalent FGL techniques
attempt to achieve this by aligning the embeddings of these overlapping nodes
across clients [28, 130, 205]. A common approach involves a central server
that maintains a global node embedding matrix [28]. The server updates the
matrix using local embedding matrices received from each client and then
broadcasts these global embeddings back to the clients for further local
training. In such scenarios, it is crucial to preserve edge information on the
client side. Simply aligning the embeddings of overlapping nodes on the server
can lead to privacy risks since the server could potentially infer edge
information by observing nodes associated with non-zero-gradient embeddings,
especially in recommendation systems. This occurs because an item embedding is
only updated when there is a link to the user [168]. To address this issue, a
widely adopted technique is pseudo-interacted item sampling [104]. Typically,
before sending gradients to the central server, each client samples some items
with which they have not interacted (i.e., pseudo-interacted items).
Subsequently, users generate embedding gradients for these sampled items
(e.g., using a Gaussian distribution) and merge them with the gradients of the
real interactions.

###  5.3 Attack Threat: Model Stealing

Optimized Graph ML models represent significant intellectual property (IP) for
model owners, given the substantial investments required in constructing
training datasets, tuning hyperparameters, and optimizing learnable parameters
[56, 158]. However, these models are vulnerable to theft, as malicious
entities might replicate the model or misappropriate its functionalities [124,
157]. Consequently, establishing verifiable ownership of Graph ML models is a
pressing necessity, drawing considerable research interest. In this section,
we explore (1) attack methods for stealing Graph ML models, and (2) defense
strategies to prevent such theft.

####  5.3.1 Model Stealing Attack

Model stealing attacks are designed to replicate the functionalities of a
target model, originally trained by the model owner, by training a surrogate
model through interactions with the target model [43]. Often, such a surrogate
model can appropriate certain functionalities of the target model, such as
achieving comparable node classification accuracy or mimicking the predictive
behavior of the target model, allowing the attacker to obtain a similar model
with minimal effort [43, 166, 144]. This section will primarily focus on node
classification, which is the most common task targeted by these attacks. We
first present a formal problem definition.

######  Problem 3.

Given certain knowledge regarding the graph data $\mathcal{G}$, the goal of
the attacker is to train a surrogate model $f_{\text{G}}^{*}$ to match certain
characteristics (e.g., similar prediction accuracy or similar predictive
behaviors) of a target model $f_{\text{G}}$ by collecting certain query
results from $f_{\text{G}}$.

Adversarial Model Extraction [43] presents a framework for model stealing
attacks in Graph ML. In this framework, attackers gain access to a small
subgraph from the training data of the target model. They then query the
target model (e.g., through API access) to gather information about its
predictions, denoted as $f_{\text{G}}$, and use this data to train a surrogate
model $f_{\text{G}}^{*}$. In this scenario, the strategy involves initially
generating additional nodes to enhance the accessible subgraph. Subsequently,
a GCN model [83] is trained using the augmented subgraph. In real-world
applications, attackers often face incomplete information, such as missing
node attributes or incomplete graph topology. A recent taxonomy [166]
categorizes attacker knowledge based on the accessibility of partial node
attributes, partial graph topology, and a shadow graph—an auxiliary subgraph
from the same domain as the training graph of the target model. Depending on
the information available, attackers may need to infer missing attributes or
topology before querying the target model $f_{\text{G}}$. GNNStealing [144]
notes that the aforementioned studies primarily focus on transductive learning
tasks, where the knowledge accessible to attackers comes from the graph data
used to train the target model. Given that this assumption may not always be
realistic in practice, GNNStealing introduces a new strategy for model
stealing within inductive learning settings.

####  5.3.2 Model Stealing Defense

The rationale behind defending against model stealing is to embed ownership
information into the original model—that is, the target model susceptible to
model stealing attacks. This approach enables the model owner to determine
whether any suspicious models are unauthorized copies or have been trained
using knowledge derived from the original model. Below, we formally present
the problem definition.

######  Problem 4.

Given the training graph data $\mathcal{G}$, model stealing defense for Graph
ML aims to achieve an optimized original model $f_{\text{G}}$ trained on
$\mathcal{G}$, such that for any model $f_{\text{G}}^{*}$ trained relying on
$f_{\text{G}}$ and $\tilde{f}_{\text{G}}^{*}$ trained without relying on
$f_{\text{G}}$, we are able to find a function $h$ where
$h(f_{\text{G}}^{*})=1$ and $h(\tilde{f}_{\text{G}}^{*})=0$.

To address this issue, existing solutions can be primarily categorized into
two types: watermarking and fingerprinting. We elaborate on more details
below.

Watermarking. Watermarking involves embedding secret generated keys into a
model during training, allowing the model owner to check for theft by
verifying the presence of these keys in suspicious models. For instance, ER
Graph Watermarking [217] embeds watermarks into GNNs by creating an
Erdős–Rényi random graph with random node features and labels. Ownership is
confirmed if a suspicious model can correctly classify nodes in this graph.
Besides node classification tasks, GNN Watermarking [185] expands this
approach to graph classification tasks by developing a strategy to embed
ownership information directly into the training data.

Fingerprinting. In a recent study, GrOVe [158], researchers demonstrate that
the output node embedding distributions of two independently trained Graph ML
models differ significantly. However, when one model is trained based on
another original model (effectively producing a stolen model), there will be a
substantial overlap in their output distributions. This highlights the
underlying principle of fingerprinting for Graph ML models: distinguishing
between independently trained models and stolen models by analyzing
differences in their output distributions. However, conventional distribution
distance metrics may not effectively characterize these differences because
the output distributions of an independently trained model and a stolen model
could also overlap, potentially leading to high error rates [158]. To address
this issue, GrOVe takes a preliminary step by first training a set of
independently trained models and stolen models. Subsequently, a classifier is
developed based on these models to discern stolen models by examining their
output distributions.

##  6 Applications

Finance. Graph ML models are widely used in financial analysis like financial
crime detection [151]. These networks often process sensitive information,
including transaction histories and account details [191]. To protect this
data, financial institutions implement privacy-preserving measures like
differential privacy, which help prevent unauthorized access [206].
Additionally, the financial sector is frequently targeted for various
fraudulent activities, including money laundering and identity theft [124].
Therefore, it is essential to develop robust Graph ML models capable of
detecting and flagging unusual patterns that may indicate fraudulent activity,
thus aiding in crime prevention [66, 37]. Moreover, the real-time detection of
anomalies within transaction networks is crucial for the timely prevention of
financial crimes [80].

Malware Detection. The widespread use of Internet of Things (IoT) devices has
generated vast amounts of graph data, where nodes typically represent IoT
devices and edges depict their interactions [196]. Malware attacks through
smartphone applications, for instance, pose significant safety risks in these
networks, including unauthorized access to sensitive health information [17].
Utilizing Graph ML for malware detection can significantly bolster the
security and reliability of IoT systems.

Healthcare. Graph ML methods are extensively used in healthcare, where
connections among patients, based on shared attributes or medical histories,
are represented as graph structures [125, 103]. However, maintaining
confidentiality is a critical issue in healthcare, requiring robust privacy
protections for patient data that is often spread across multiple institutions
[136, 107]. Federated graph learning provides a solution by allowing model
training on distributed datasets without compromising individual privacy [106,
9]. Furthermore, graph unlearning techniques enable the removal of data
influences from models, ensuring compliance with ethical standards and
regulations [34, 140]. On the other hand, the generalizability of graph ML
models is crucial for applications like cancer classification based on graphs
of chest X-ray data [110]. In this case, variations in data distribution due
to different devices necessitate consistent performance across distributions.

Social Networks. On social media platforms such as Reddit and Instagram, data
can be modeled as graphs where nodes represent users and edges denote their
interactions [90]. Graph ML models, often used for tasks like content
recommendation, are susceptible to significant safety threats. One major
concern is the model threat, which involves the potential leakage of users’
sensitive information due to inherent message-passing mechanisms that expose
data from neighboring nodes [22, 122]. Implementing differential privacy
techniques [142, 169] can help safeguard privacy by introducing noise to data
or model outputs. Additionally, data threats arise from the dynamic and varied
nature of social networks, posing challenges to the models’ generalizability
[176]. Employing out-of-distribution (OOD) generalization methods can enhance
robustness across diverse social network environments [91].

Transportation. Graph structures are commonly utilized to model dynamic
traffic data across transportation networks, leading to the widespread
adoption of Graph ML models for tasks like traffic flow prediction [45].
Despite their effectiveness, the generalizability of these models is a
critical concern due to the significant variability in traffic conditions and
patterns under different circumstances. Thus, developing Graph ML models that
perform well across diverse scenarios is crucial for their safe application in
predicting traffic flow and congestion [71]. To improve generalizability,
domain adaptation techniques are employed to train models that can adapt
across various transportation networks [111]. Additionally, out-of-
distribution (OOD) generalization can enhance predictions under unusual
circumstances not well represented in the training data, such as during major
events or changes in infrastructure [76].

##  7 Future Work

In this section, we discuss the potential directions for future work of safe
Graph ML.

Reliability. Regarding the enhancement of reliability in safety Graph ML, the
efficiency of uncertainty quantification is significant yet underexplored.
When enhancing reliability in safety-oriented Graph ML, the effectiveness of
uncertainty quantification remains significant but underexplored. For
instance, the non-parametric Bayesian GCN [126] is notably time-consuming due
to the Monte Carlo sampling required, making it impractical for high-stakes
applications involving large-scale graphs. Additionally, anomaly detection on
graphs presents unique challenges; detecting anomalous subgraphs is
particularly difficult because the nodes and edges within these subgraphs may
appear normal individually, and their structures can vary widely. This
complexity has led to a scarcity of research in this specific area [109].

Generalizability. Numerous challenges persist in enhancing the
generalizability of safe Graph ML. For instance, traditional OOD
generalization algorithms typically require specific environmental (i.e.,
domain) splits during training. However, due to the complex structures
inherent in graph data, obtaining such environmental splits can be difficult.
It is essential to explore methods that can either manage OOD generalization
within a single environment or explicitly divide training environments.
Additionally, the approach of test-time training during inference is
beneficial for generalizability, as it allows for more flexible use of
(unlabeled) data. Developing test-time training tasks that improve model
generalizability across various inference scenarios is crucial.

Confidentiality. The challenges of safeguarding graph data span multiple
dimensions. For instance, there is a need for innovative solutions to
facilitate secure collaborative model training across multiple entities while
ensuring the confidentiality of node and edge information. Furthermore,
existing graph unlearning approaches often lack universality. It is crucial to
develop methods capable of addressing all types of unlearning tasks, given the
diverse range of applications managed by graph-based models. Additionally,
there is a significant gap in evaluating the practicality and scalability of
existing methodologies, underscoring the necessity for comprehensive
assessments to validate their effectiveness in real-world scenarios.

##  8 Conclusion

In this survey, we conducted a comprehensive review of safety within the
rapidly evolving field of graph machine learning (Graph ML), a topic gaining
increasing attention due to escalating safety concerns. We provided a
structured analysis of three critical safety aspects in Graph ML applications:
reliability, generalizability, and confidentiality. To enhance safety, we
categorized the threats within each aspect into three main types: data
threats, model threats, and attack threats, each presenting unique challenges
to Graph ML model safety. For each identified threat, we detailed specific
solutions, offering an exhaustive compilation of research efforts addressing
these safety challenges. Our discussion synthesized these insights into a
unified framework, aimed at deepening the understanding of safety
considerations in Graph ML and steering future research in this essential
field. Additionally, we highlighted practical applications and suggested
directions for future studies. Through this survey, our goal was not only to
summarize existing safety research in Graph ML but also to encourage further
investigation to ensure that Graph ML techniques are developed and implemented
safely.

## References

  * [1] Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang.  Deep learning with differential privacy.  In SIGSAC, 2016.
  * [2] Kartik Ahuja, Karthikeyan Shanmugam, Kush Varshney, and Amit Dhurandhar.  Invariant risk minimization games.  In ICML, 2020.
  * [3] Leman Akoglu, Hanghang Tong, and Danai Koutra.  Graph based anomaly detection and description: a survey.  DMKD, 2015.
  * [4] Martin Arjovsky, Léon Bottou, Ishaan Gulrajani, and David Lopez-Paz.  Invariant risk minimization.  arXiv, 2019.
  * [5] Jinheon Baek, Wonyong Jeong, Jiongdao Jin, Jaehong Yoon, and Sung Ju Hwang.  Personalized subgraph federated learning.  In ICML, 2023.
  * [6] Sambaran Bandyopadhyay, Lokesh N, Saley Vishal Vivek, and M Narasimha Murty.  Outlier resistant unsupervised deep architectures for attributed network embedding.  In WSDM, 2020.
  * [7] Raef Bassily, Adam Smith, and Abhradeep Thakurta.  Private empirical risk minimization: Efficient algorithms and tight error bounds.  In IEEE FOCS, 2014.
  * [8] Thomas Baumhauer, Pascal Schöttle, and Matthias Zeppelzauer.  Machine unlearning: Linear filtration for logit-based classifiers.  Machine Learning, 2022.
  * [9] Hızır Can Bayram and Islem Rekik.  A federated multigraph integration approach for connectional brain template learning.  In ML-CDS, 2021.
  * [10] Beatrice Bevilacqua, Yangze Zhou, and Bruno Ribeiro.  Size-invariant graph representations for graph classification extrapolations.  In ICML, 2021.
  * [11] Peru Bhardwaj, John Kelleher, Luca Costabello, and Declan O’Sullivan.  Adversarial attacks on knowledge graph embeddings via instance attribution methods.  In EMNLP, 2021.
  * [12] Peru Bhardwaj, John Kelleher, Luca Costabello, and Declan O’Sullivan.  Poisoning knowledge graph embeddings via relation inference patterns.  In ACL, 2021.
  * [13] Aleksandar Bojchevski and Stephan Günnemann.  Adversarial attacks on node embeddings via graph poisoning.  In ICML, 2019.
  * [14] Aleksandar Bojchevski and Stephan Günnemann.  Certifiable robustness to graph perturbations.  NeurIPS, 2019.
  * [15] Pietro Bongini, Monica Bianchini, and Franco Scarselli.  Molecular generative graph neural networks for drug discovery.  Neurocomputing, 2021.
  * [16] Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot.  Machine unlearning.  In IEEE SP, 2021.
  * [17] Julian Busch, Anton Kocheturov, Volker Tresp, and Thomas Seidl.  Nf-gnn: network flow graph neural networks for malware detection and classification.  In SSDBM, 2021.
  * [18] Ruichu Cai, Fengzhu Wu, Zijian Li, Pengfei Wei, Lingling Yi, and Kun Zhang.  Graph domain adaptation: A generative view.  arXiv, 2021.
  * [19] Heng Chang, Yu Rong, Tingyang Xu, Yatao Bian, Shiji Zhou, Xin Wang, Junzhou Huang, and Wenwu Zhu.  Not all low-pass filters are robust in graph convolutional networks.  NeurIPS, 2021.
  * [20] Heng Chang, Yu Rong, Tingyang Xu, Wenbing Huang, Honglei Zhang, Peng Cui, Wenwu Zhu, and Junzhou Huang.  A restricted black-box adversarial framework towards attacking graph embedding models.  In AAAI, 2020.
  * [21] Bo Chen, Jing Zhang, Xiaokang Zhang, Yuxiao Dong, Jian Song, Peng Zhang, Kaibo Xu, Evgeny Kharlamov, and Jie Tang.  Gccad: Graph contrastive learning for anomaly detection.  TKDE, 2022.
  * [22] Chaochao Chen, Jun Zhou, Longfei Zheng, Huiwen Wu, Lingjuan Lyu, Jia Wu, Bingzhe Wu, Ziqi Liu, Li Wang, and Xiaolin Zheng.  Vertically federated graph neural network for privacy-preserving node classification.  arXiv, 2020.
  * [23] Guanzi Chen, Jiying Zhang, Xi Xiao, and Yang Li.  Graphtta: Test time adaptation on graph neural networks.  ICML, 2022.
  * [24] Jinyin Chen, Lihong Chen, Yixian Chen, Minghao Zhao, Shanqing Yu, Qi Xuan, and Xiaoniu Yang.  Ga-based q-attack on community detection.  IEEE Trans. Comput. Soc, 2019.
  * [25] Jinyin Chen, Guohan Huang, Haibin Zheng, Shanqing Yu, Wenrong Jiang, and Chen Cui.  Graph-fraudster: Adversarial attacks on graph neural network-based vertical federated learning.  IEEE Trans. Comput. Soc., 2022.
  * [26] Jinyin Chen, Yangyang Wu, Xuanheng Xu, Yixian Chen, Haibin Zheng, and Qi Xuan.  Fast gradient attack on network embedding.  arXiv, 2018.
  * [27] Min Chen, Zhikun Zhang, Tianhao Wang, Michael Backes, Mathias Humbert, and Yang Zhang.  Graph unlearning.  In SIGSAC, 2022.
  * [28] Mingyang Chen, Wen Zhang, Zonggang Yuan, Yantao Jia, and Huajun Chen.  Fede: Embedding knowledge graphs in federated setting.  In IJCKG, 2021.
  * [29] Yizheng Chen, Yacin Nadji, Athanasios Kountouras, Fabian Monrose, Roberto Perdisci, Manos Antonakakis, and Nikolaos Vasiloglou.  Practical attacks against graph-based clustering.  In SIGSAC, 2017.
  * [30] Yongqiang Chen, Yonggang Zhang, Yatao Bian, Han Yang, MA Kaili, Binghui Xie, Tongliang Liu, Bo Han, and James Cheng.  Learning causally invariant representations for out-of-distribution generalization on graphs.  NeurIPS, 2022.
  * [31] Jiali Cheng, George Dasoulas, Huan He, Chirag Agarwal, and Marinka Zitnik.  Gnndelete: A general strategy for unlearning in graph neural networks.  In ICLR, 2023.
  * [32] Eli Chien, Wei-Ning Chen, Chao Pan, Pan Li, Ayfer Özgür, and Olgica Milenkovic.  Differentially private decoupled graph convolutions for multigranular topology protection.  arXiv, 2023.
  * [33] Eli Chien, Chao Pan, and Olgica Milenkovic.  Efficient model updates for approximate unlearning of graph-structured data.  In ICLR, 2023.
  * [34] Vikram S Chundawat, Ayush K Tarun, Murari Mandal, and Mohan Kankanhalli.  Zero-shot machine unlearning.  IEEE Trans. Inf. Forensics Secur., 2023.
  * [35] Weilin Cong and Mehrdad Mahdavi.  Grapheditor: An efficient graph representation learning and unlearning approach.  OpenReview, 2022.
  * [36] Elliot Creager, Jörn-Henrik Jacobsen, and Richard Zemel.  Environment inference for invariant learning.  In ICML, 2021.
  * [37] Enyan Dai, Tianxiang Zhao, Huaisheng Zhu, Junjie Xu, Zhimeng Guo, Hui Liu, Jiliang Tang, and Suhang Wang.  A comprehensive survey on trustworthy graph neural networks: Privacy, robustness, fairness, and explainability.  arXiv, 2022.
  * [38] Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, and Le Song.  Adversarial attack on graph structured data.  In ICML, 2018.
  * [39] Quanyu Dai, Xiao Shen, Liang Zhang, Qiang Li, and Dan Wang.  Adversarial training methods for network embedding.  In WWW, 2019.
  * [40] Quanyu Dai, Xiao-Ming Wu, Jiaren Xiao, Xiao Shen, and Dan Wang.  Graph transfer learning via adversarial domain adaptation with graph convolution.  IEEE TKDE, 2022.
  * [41] Ameya Daigavane, Gagan Madan, Aditya Sinha, Abhradeep Guha Thakurta, Gaurav Aggarwal, and Prateek Jain.  Node-level differentially private graph neural networks.  arXiv, 2021.
  * [42] Michele Dallachiesa, Charu Aggarwal, and Themis Palpanas.  Node classification in uncertain graphs.  In SSDBM, 2014.
  * [43] David DeFazio and Arti Ramesh.  Adversarial model extraction on graph neural networks.  arXiv, 2019.
  * [44] Armen Der Kiureghian and Ove Ditlevsen.  Aleatory or epistemic? does it matter?  Structural safety, 2009.
  * [45] Austin Derrow-Pinion, Jennifer She, David Wong, Oliver Lange, Todd Hester, Luis Perez, Marc Nunkesser, Seongjae Lee, Xueying Guo, Brett Wiltshire, et al.  Eta prediction with graph neural networks in google maps.  In CIKM, 2021.
  * [46] Kaize Ding, Jundong Li, Nitin Agarwal, and Huan Liu.  Inductive anomaly detection on attributed networks.  In IJCAI, 2021.
  * [47] Kaize Ding, Jundong Li, Rohit Bhanushali, and Huan Liu.  Deep anomaly detection on attributed networks.  In SDM, 2019.
  * [48] Yushun Dong, Binchi Zhang, Hanghang Tong, and Jundong Li.  Elegant: Certified defense on the fairness of graph neural networks.  arXiv, 2023.
  * [49] Yingtong Dou, Zhiwei Liu, Li Sun, Yutong Deng, Hao Peng, and Philip S Yu.  Enhancing graph neural network-based fraud detectors against camouflaged fraudsters.  In CIKM, 2020.
  * [50] Yingtong Dou, Kai Shu, Congying Xia, Philip S Yu, and Lichao Sun.  User preference-aware fake news detection.  In SIGIR, 2021.
  * [51] Negin Entezari, Saba A Al-Sayouri, Amirali Darvishzadeh, and Evangelos E Papalexakis.  All you need is low (rank) defending against adversarial attacks on graphs.  In WSDM, 2020.
  * [52] Fuli Feng, Xiangnan He, Jie Tang, and Tat-Seng Chua.  Graph adversarial training: Dynamically regularizing based on graph structure.  IEEE TKDE, 2019.
  * [53] Shangbin Feng, Zhaoxuan Tan, Herun Wan, Ningnan Wang, Zilong Chen, Binchi Zhang, Qinghua Zheng, Wenqian Zhang, Zhenyu Lei, Shujie Yang, et al.  Twibot-22: Towards graph-based twitter bot detection.  NeurIPS, 2022.
  * [54] José Luis Fernández-Alemán, Inmaculada Carrión Señor, Pedro Ángel Oliver Lozoya, and Ambrosio Toval.  Security and privacy in electronic health records: A systematic literature review.  J. Biomed. Inform., 2013.
  * [55] Chelsea Finn, Pieter Abbeel, and Sergey Levine.  Model-agnostic meta-learning for fast adaptation of deep networks.  In ICML, 2017.
  * [56] Fabrizio Frasca, Emanuele Rossi, Davide Eynard, Ben Chamberlain, Michael Bronstein, and Federico Monti.  Sign: Scalable inception graph neural networks.  arXiv, 2020.
  * [57] Xingbo Fu, Binchi Zhang, Yushun Dong, Chen Chen, and Jundong Li.  Federated graph machine learning: A survey of concepts, techniques, and applications.  ACM SIGKDD Explor. Newsl., 2022.
  * [58] Yaroslav Ganin, Evgeniya Ustinova, Hana Ajakan, Pascal Germain, Hugo Larochelle, François Laviolette, Mario Marchand, and Victor Lempitsky.  Domain-adversarial training of neural networks.  JMLR, 2016.
  * [59] Amirata Ghorbani, Abubakar Abid, and James Zou.  Interpretation of neural networks is fragile.  In AAAI, 2019.
  * [60] Aditya Grover and Jure Leskovec.  node2vec: Scalable feature learning for networks.  In SIGKDD, 2016.
  * [61] Shurui Gui, Xiner Li, Limei Wang, and Shuiwang Ji.  Good: A graph out-of-distribution benchmark.  In NeurIPS, 2022.
  * [62] Gaoyang Guo, Chaokun Wang, Bencheng Yan, Yunkai Lou, Hao Feng, Junchao Zhu, Jun Chen, Fei He, and Philip Yu.  Learning adaptive node embeddings across graphs.  IEEE TKDE, 2022.
  * [63] Zhichun Guo, Chuxu Zhang, Wenhao Yu, John Herr, Olaf Wiest, Meng Jiang, and Nitesh V Chawla.  Few-shot graph learning for molecular property prediction.  In WWW, 2021.
  * [64] William L Hamilton, Rex Ying, and Jure Leskovec.  Inductive representation learning on large graphs.  In NeurIPS, 2017.
  * [65] Arman Hasanzadeh, Ehsan Hajiramezanali, Shahin Boluki, Mingyuan Zhou, Nick Duffield, Krishna Narayanan, and Xiaoning Qian.  Bayesian graph neural networks with adaptive connection sampling.  In ICML, 2020.
  * [66] Dan Hendrycks, Nicholas Carlini, John Schulman, and Jacob Steinhardt.  Unsolved problems in ml safety.  arXiv, 2021.
  * [67] Jiafeng Hu, Reynold Cheng, Zhipeng Huang, Yixang Fang, and Siqiang Luo.  On embedding uncertain graphs.  In CIKM, 2017.
  * [68] LinMei Hu, SiQi Wei, Ziwang Zhao, and Bin Wu.  Deep learning for fake news detection: A comprehensive survey.  AI Open, 2022.
  * [69] Kexin Huang, Ying Jin, Emmanuel Candes, and Jure Leskovec.  Uncertainty quantification over graph with conformalized graph neural networks.  arXiv, 2023.
  * [70] Wenke Huang, Guancheng Wan, Mang Ye, and Bo Du.  Federated graph semantic and structural learning.  In IJCAI, 2023.
  * [71] Yunjie Huang, Xiaozhuang Song, Shiyao Zhang, and JQ James.  Transfer learning in traffic prediction with graph neural networks.  In IEEE ITSC, 2021.
  * [72] Hussain Hussain, Meng Cao, Sandipan Sikdar, Denis Helic, Elisabeth Lex, Markus Strohmaier, and Roman Kern.  Adversarial inter-group link injection degrades the fairness of graph neural networks.  In ICDM, 2022.
  * [73] Vassilis N Ioannidis, Dimitris Berberidis, and Georgios B Giannakis.  Graphsac: Detecting anomalies in large-scale graphs.  arXiv, 2019.
  * [74] Sarthak Jain and Byron C Wallace.  Attention is not explanation.  In NAACL-HLT, 2019.
  * [75] Dejun Jiang, Zhenxing Wu, Chang-Yu Hsieh, Guangyong Chen, Ben Liao, Zhe Wang, Chao Shen, Dongsheng Cao, Jian Wu, and Tingjun Hou.  Could graph neural networks learn better molecular representation for drug discovery? a comparison study of descriptor-based and graph-based models.  J. Cheminform., 2021.
  * [76] Weiwei Jiang and Jiayun Luo.  Graph neural network for traffic forecasting: A survey.  Expert Syst. Appl., 2022.
  * [77] Hongwei Jin and Xinhua Zhang.  Latent adversarial training of graph convolution networks.  In ICML Workshop, 2019.
  * [78] Ming Jin, Heng Chang, Wenwu Zhu, and Somayeh Sojoudi.  Power up! robust graph convolutional network against evasion attacks based on graph powering.  arXiv, 2019.
  * [79] Wei Jin, Tyler Derr, Yiqi Wang, Yao Ma, Zitao Liu, and Jiliang Tang.  Node similarity preserving graph convolutional networks.  In WSDM, 2021.
  * [80] Wei Jin, Yaxing Li, Han Xu, Yiqi Wang, Shuiwang Ji, Charu Aggarwal, and Jiliang Tang.  Adversarial attacks and defenses on graphs.  SIGKDD Explor. Newsl., 2021.
  * [81] Jian Kang, Yinglong Xia, Ross Maciejewski, Jiebo Luo, and Hanghang Tong.  Deceptive fairness attacks on graphs via meta learning.  In ICLR, 2024.
  * [82] Thomas N Kipf and Max Welling.  Variational graph auto-encoders.  arXiv, 2016.
  * [83] Thomas N Kipf and Max Welling.  Semi-supervised classification with graph convolutional networks.  In ICLR, 2017.
  * [84] Pang Wei Koh and Percy Liang.  Understanding black-box predictions via influence functions.  In ICML, 2017.
  * [85] Jaekoo Lee, Ho Bae, and Sungroh Yoon.  Anomaly detection by learning dynamics from a graph.  IEEE Access, 2020.
  * [86] Meng-Chieh Lee, Hung T Nguyen, Dimitris Berberidis, Vincent S Tseng, and Leman Akoglu.  Gawd: graph anomaly detection in weighted directed graph databases.  In ASONAM, 2021.
  * [87] Runze Lei, Pinghui Wang, Junzhou Zhao, Lin Lan, Jing Tao, Chao Deng, Junlan Feng, Xidian Wang, and Xiaohong Guan.  Federated learning over coupled graphs.  TPDS, 2023.
  * [88] Jurij Leskovec, Deepayan Chakrabarti, Jon Kleinberg, and Christos Faloutsos.  Realistic, mathematically tractable graph generation and evolution, using kronecker multiplication.  In PKDD, 2005.
  * [89] Bo Li, Peng Qi, Bo Liu, Shuai Di, Jingen Liu, Jiquan Pei, Jinfeng Yi, and Bowen Zhou.  Trustworthy ai: From principles to practices.  ACM Comput. Surv., 2023.
  * [90] Chaozhuo Li, Senzhang Wang, Lifang He, S Yu Philip, Yanbo Liang, and Zhoujun Li.  Ssdmv: Semi-supervised deep social spammer detection by multi-view data fusion.  In ICDM, 2018.
  * [91] Haoyang Li, Xin Wang, Ziwei Zhang, and Wenwu Zhu.  Out-of-distribution generalization on graphs: A survey.  arXiv, 2022.
  * [92] Haoyang Li, Ziwei Zhang, Xin Wang, and Wenwu Zhu.  Learning invariant graph representations for out-of-distribution generalization.  In NeurIPS, 2022.
  * [93] Jia Li, Honglei Zhang, Zhichao Han, Yu Rong, Hong Cheng, and Junzhou Huang.  Adversarial attack on community detection by hiding individuals.  In WWW, 2020.
  * [94] Jundong Li, Harsh Dani, Xia Hu, and Huan Liu.  Radar: Residual analysis for anomaly detection in attributed networks.  In IJCAI, 2017.
  * [95] Shengrui Li, Xueting Han, and Jing Bai.  Adaptergnn: Efficient delta tuning improves generalization ability in graph neural networks.  arXiv, 2023.
  * [96] Yang Li, Buyue Qian, Xianli Zhang, and Hui Liu.  Graph neural network-based diagnosis prediction.  Big Data, 2020.
  * [97] Wanyu Lin, Shengxiang Ji, and Baochun Li.  Adversarial attacks on link prediction algorithms based on graph neural networks.  In AsiaCCS, 2020.
  * [98] Haochen Liu, Yiqi Wang, Wenqi Fan, Xiaorui Liu, Yaxin Li, Shaili Jain, Yunhao Liu, Anil Jain, and Jiliang Tang.  Trustworthy ai: A computational perspective.  ACM TIST, 2022.
  * [99] Shuhan Liu and Kaize Ding.  Beyond generalization: A survey of out-of-distribution adaptation on graphs.  arXiv, 2024.
  * [100] Xiaorui Liu, Jiayuan Ding, Wei Jin, Han Xu, Yao Ma, Zitao Liu, and Jiliang Tang.  Graph neural networks with adaptive residual.  NeurIPS, 2021.
  * [101] Yang Liu, Xiang Ao, Zidi Qin, Jianfeng Chi, Jinghua Feng, Hao Yang, and Qing He.  Pick and choose: a gnn-based imbalanced learning approach for fraud detection.  In WWW, 2021.
  * [102] Yixin Liu, Zhao Li, Shirui Pan, Chen Gong, Chuan Zhou, and George Karypis.  Anomaly detection on attributed networks via contrastive self-supervised learning.  IEEE TNNLS, 2021.
  * [103] Zheng Liu, Xiaohan Li, Hao Peng, Lifang He, and S Yu Philip.  Heterogeneous similarity graph neural network on electronic health records.  In IEEE BigData, 2020.
  * [104] Zhiwei Liu, Liangwei Yang, Ziwei Fan, Hao Peng, and Philip S Yu.  Federated social recommendation with graph neural network.  ACM TIST, 2021.
  * [105] Zihan Liu, Yun Luo, Lirong Wu, Siyuan Li, Zicheng Liu, and Stan Z Li.  Are gradients on graph structure reliable in gray-box attacks?  In CIKM, 2022.
  * [106] Guannan Lou, Yuze Liu, Tiehua Zhang, and Xi Zheng.  Stfl: A temporal-spatial federated learning framework for graph neural networks.  arXiv, 2021.
  * [107] Songtao Lu, Yawen Zhang, and Yunlong Wang.  Decentralized federated learning for electronic health records.  In CISS, 2020.
  * [108] Jiaqi Ma, Shuangrui Ding, and Qiaozhu Mei.  Towards more practical adversarial attacks on graph neural networks.  In NeurIPS, 2020.
  * [109] Xiaoxiao Ma, Jia Wu, Shan Xue, Jian Yang, Chuan Zhou, Quan Z Sheng, Hui Xiong, and Leman Akoglu.  A comprehensive survey on graph anomaly detection with deep learning.  IEEE TKDE, 2021.
  * [110] Dwarikanath Mahapatra, Steven Korevaar, Behzad Bozorgtabar, and Ruwan Tennakoon.  Unsupervised domain adaptation using feature disentanglement and gcns for medical image classification.  In ECCV, 2022.
  * [111] Tanwi Mallick, Prasanna Balaprakash, Eric Rask, and Jane Macfarlane.  Transfer learning with graph neural networks for short-term highway traffic forecasting.  In ICPR, 2021.
  * [112] Haitao Mao, Lun Du, Yujia Zheng, Qiang Fu, Zelin Li, Xu Chen, Shi Han, and Dongmei Zhang.  Source free unsupervised graph domain adaptation.  WSDM, 2024.
  * [113] Ninareh Mehrabi, Muhammad Naveed, Fred Morstatter, and Aram Galstyan.  Exacerbating algorithmic bias through fairness attacks.  In AAAI, 2021.
  * [114] Guangxu Mei, Ziyu Guo, Shijun Liu, and Li Pan.  Sgnn: A graph neural network based federated learning approach by hiding structure.  In Big Data, 2019.
  * [115] Lewis H Mervin, Simon Johansson, Elizaveta Semenova, Kathryn A Giblin, and Ola Engkvist.  Uncertainty quantification in drug design.  Drug Discov. Today, 2021.
  * [116] Siqi Miao, Mia Liu, and Pan Li.  Interpretable and generalizable graph learning via stochastic attention mechanism.  In ICML, 2022.
  * [117] Jiaming Mu, Binghui Wang, Qi Li, Kun Sun, Mingwei Xu, and Zhuotao Liu.  A hard label black-box adversarial attack against graph neural networks.  In ACM CCS, 2021.
  * [118] Krikamol Muandet, David Balduzzi, and Bernhard Schölkopf.  Domain generalization via invariant feature representation.  In ICML, 2013.
  * [119] Annamalai Narayanan, Mahinthan Chandramohan, Rajasekar Venkatesan, Lihui Chen, Yang Liu, and Shantanu Jaiswal.  graph2vec: Learning distributed representations of graphs.  arXiv, 2017.
  * [120] Yin Cheng Ng, Nicolò Colombo, and Ricardo Silva.  Bayesian semi-supervised learning with graph gaussian processes.  NeurIPS, 2018.
  * [121] Jorge Nocedal and Stephen J Wright.  Numerical optimization.  1999\.
  * [122] Iyiola Emmanuel Olatunji, Thorben Funke, and Megha Khosla.  Releasing graph neural networks with differential privacy guarantees.  TMLR, 2023.
  * [123] Aaron van den Oord, Yazhe Li, and Oriol Vinyals.  Representation learning with contrastive predictive coding.  arXiv, 2018.
  * [124] Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz.  Knockoff nets: Stealing functionality of black-box models.  In CVPR, 2019.
  * [125] Shraddha Pai and Gary D Bader.  Patient similarity networks for precision medicine.  J. Mol. Biol., 2018.
  * [126] Soumyasundar Pal, Florence Regol, and Mark Coates.  Bayesian graph convolutional neural networks using non-parametric graph learning.  arXiv, 2019.
  * [127] Chao Pan, Eli Chien, and Olgica Milenkovic.  Unlearning graph classifiers with limited data resources.  In WWW, 2023.
  * [128] George Panagopoulos, Giannis Nikolentzos, and Michalis Vazirgiannis.  Transfer graph neural networks for pandemic forecasting.  In AAAI, 2021.
  * [129] Yulong Pei, Tianjin Huang, Werner van Ipenburg, and Mykola Pechenizkiy.  Resgcn: Attention-based deep residual modeling for anomaly detection on attributed networks.  DSAA, 2022.
  * [130] Hao Peng, Haoran Li, Yangqiu Song, Vincent Zheng, and Jianxin Li.  Differentially private federated knowledge graphs embedding.  In CIKM, 2021.
  * [131] Zhen Peng, Minnan Luo, Jundong Li, Huan Liu, Qinghua Zheng, et al.  Anomalous: A joint modeling approach for anomaly detection on attributed networks.  In IJCAI, 2018.
  * [132] Bryan Perozzi, Rami Al-Rfou, and Steven Skiena.  Deepwalk: Online learning of social representations.  In SIGKDD, 2014.
  * [133] Ziyue Qiao, Xiao Luo, Meng Xiao, Hao Dong, Yuanchun Zhou, and Hui Xiong.  Semi-supervised domain adaptation in graph transfer learning.  IJCAI, 2023.
  * [134] Jiezhong Qiu, Qibin Chen, Yuxiao Dong, Jing Zhang, Hongxia Yang, Ming Ding, Kuansan Wang, and Jie Tang.  Gcc: Graph contrastive coding for graph neural network pre-training.  In SIGKDD, 2020.
  * [135] Hamed Rahimian and Sanjay Mehrotra.  Distributionally robust optimization: A review.  arXiv, 2019.
  * [136] Alvin Rajkomar, Eyal Oren, Kai Chen, Andrew M Dai, Nissan Hajaj, Michaela Hardt, Peter J Liu, Xiaobing Liu, Jake Marcus, Mimi Sun, et al.  Scalable and accurate deep learning with electronic health records.  NPJ Digit. Med., 2018.
  * [137] Karthik Raman.  Construction and analysis of protein–protein interaction networks.  Autom. Exp., 2010.
  * [138] Lukas Ruff, Robert Vandermeulen, Nico Goernitz, Lucas Deecke, Shoaib Ahmed Siddiqui, Alexander Binder, Emmanuel Müller, and Marius Kloft.  Deep one-class classification.  In ICML, 2018.
  * [139] Alireza Sadeghi, Meng Ma, Bingcong Li, and Georgios B Giannakis.  Distributionally robust semi-supervised learning over graphs.  arXiv, 2021.
  * [140] Anwar Said, Tyler Derr, Mudassir Shabbir, Waseem Abbas, and Xenofon Koutsoukos.  A survey of graph unlearning.  arXiv, 2023.
  * [141] Sina Sajadmanesh and Daniel Gatica-Perez.  Locally private graph neural networks.  In CCS, 2021.
  * [142] Sina Sajadmanesh, Ali Shahin Shamsabadi, Aurélien Bellet, and Daniel Gatica-Perez.  Gap: Differentially private graph neural networks with aggregation perturbation.  In USENIX Security, 2023.
  * [143] Prithviraj Sen, Galileo Namata, Mustafa Bilgic, Lise Getoor, Brian Galligher, and Tina Eliassi-Rad.  Collective classification in network data.  AI magazine, 2008.
  * [144] Yun Shen, Xinlei He, Yufei Han, and Yang Zhang.  Model stealing attacks against inductive graph neural networks.  In IEEE SP, 2022.
  * [145] David Soriano-Panos, Gourab Ghoshal, Alex Arenas, and Jesús Gómez-Gardeñes.  Impact of temporal scales and recurrent mobility patterns on the unfolding of epidemics.  JSTAT, 2020.
  * [146] Yongduo Sui, Xiang Wang, Jiancan Wu, Min Lin, Xiangnan He, and Tat-Seng Chua.  Causal attention for interpretable and generalizable graph classification.  In SIGKDD, 2022.
  * [147] Lichao Sun, Yingtong Dou, Carl Yang, Kai Zhang, Ji Wang, S Yu Philip, Lifang He, and Bo Li.  Adversarial attack and defense on graph data: A survey.  IEEE TKDE, 2022.
  * [148] Mingjie Sun, Jian Tang, Huichen Li, Bo Li, Chaowei Xiao, Yao Chen, and Dawn Song.  Data poisoning attack against unsupervised node embedding methods.  arXiv, 2018.
  * [149] Yiwei Sun, Suhang Wang, Xianfeng Tang, Tsung-Yu Hsieh, and Vasant Honavar.  Node injection attacks on graphs via reinforcement learning.  arXiv, 2019.
  * [150] Susheel Suresh, Pan Li, Cong Hao, and Jennifer Neville.  Adversarial graph augmentation to improve graph contrastive learning.  NeurIPS, 2021.
  * [151] Toyotaro Suzumura, Yi Zhou, Natahalie Baracaldo, Guangnan Ye, Keith Houck, Ryo Kawahara, Ali Anwar, Lucia Larise Stavarache, Yuji Watanabe, Pablo Loyola, et al.  Towards federated graph learning for collaborative financial crimes detection.  arXiv, 2019.
  * [152] Yue Tan, Yixin Liu, Guodong Long, Jing Jiang, Qinghua Lu, and Chengqi Zhang.  Federated learning on non-iid graphs via structural knowledge sharing.  In AAAI, 2023.
  * [153] Jianheng Tang, Jiajin Li, Ziqi Gao, and Jia Li.  Rethinking graph neural networks for anomaly detection.  In ICML, 2022.
  * [154] Xianfeng Tang, Yandong Li, Yiwei Sun, Huaxiu Yao, Prasenjit Mitra, and Suhang Wang.  Transferring robustness for graph neural network against poisoning attacks.  In WSDM, 2020.
  * [155] Xian Teng, Muheng Yan, Ali Mert Ertugrul, and Yu-Ru Lin.  Deep into hypersphere: Robust and unsupervised anomaly discovery in dynamic networks.  In IJCAI, 2018.
  * [156] Florian Tramèr, Reza Shokri, Ayrton San Joaquin, Hoang Le, Matthew Jagielski, Sanghyun Hong, and Nicholas Carlini.  Truth serum: Poisoning machine learning models to reveal their secrets.  In ACM CCS, 2022.
  * [157] Florian Tramèr, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart.  Stealing machine learning models via prediction APIs.  In USENIX Security, 2016.
  * [158] Asim Waheed, Vasisht Duddu, and N Asokan.  Grove: Ownership verification of graph neural networks using embeddings.  arXiv, 2023.
  * [159] Xingchen Wan, Henry Kenlay, Binxin Ru, Arno Blaas, Michael A Osborne, and Xiaowen Dong.  Adversarial attacks on graph classification via bayesian optimisation.  In NeurIPS, 2021.
  * [160] Yi Wan, Yilin Liu, Dong Wang, and Yujin Wen.  Glad-paw: Graph-based log anomaly detection by position aware weighted graph attention network.  In PAKDD, 2021.
  * [161] Binghui Wang and Neil Zhenqiang Gong.  Attacking graph-based classification via manipulating the graph structure.  In CCS, 2019.
  * [162] Binghui Wang, Ang Li, Meng Pang, Hai Li, and Yiran Chen.  Graphfl: A federated learning framework for semi-supervised node classification on graphs.  In IEEE ICDM, 2022.
  * [163] Qizhou Wang, Guansong Pang, Mahsa Salehi, Wray Buntine, and Christopher Leckie.  Cross-domain graph anomaly detection via anomaly-aware contrastive alignment.  In AAAI, 2023.
  * [164] Xiaoyun Wang, Xuanqing Liu, and Cho-Jui Hsieh.  Graphdefense: Towards robust graph convolutional networks.  arXiv, 2019.
  * [165] Yiqi Wang, Chaozhuo Li, Wei Jin, Rui Li, Jianan Zhao, Jiliang Tang, and Xing Xie.  Test-time training for graph neural networks.  arXiv, 2022.
  * [166] Bang Wu, Xiangwen Yang, Shirui Pan, and Xingliang Yuan.  Model extraction attacks on graph neural networks: Taxonomy and realisation.  In Proc. ACM Conf. Comput., 2022.
  * [167] Bingzhe Wu, Jintang Li, Junchi Yu, Yatao Bian, Hengtong Zhang, CHaochao Chen, Chengbin Hou, Guoji Fu, Liang Chen, Tingyang Xu, et al.  A survey of trustworthy graph learning: Reliability, explainability, and privacy protection.  arXiv, 2022.
  * [168] Chuhan Wu, Fangzhao Wu, Lingjuan Lyu, Tao Qi, Yongfeng Huang, and Xing Xie.  A federated graph neural network framework for privacy-preserving personalization.  Nat. Commun., 2022.
  * [169] Fan Wu, Yunhui Long, Ce Zhang, and Bo Li.  Linkteller: Recovering private edges from graph neural networks via influence analysis.  In IEEE SP, 2022.
  * [170] Huijun Wu, Chen Wang, Yuriy Tyshetskiy, Andrew Docherty, Kai Lu, and Liming Zhu.  Adversarial examples for graph data: deep insights into attack and defense.  In IJCAI, 2019.
  * [171] Jiancan Wu, Yi Yang, Yuchun Qian, Yongduo Sui, Xiang Wang, and Xiangnan He.  Gif: A general graph unlearning strategy via influence function.  In WWW, 2023.
  * [172] Jun Wu, Jingrui He, and Elizabeth Ainsworth.  Non-iid transfer learning on graphs.  In AAAI, 2023.
  * [173] Kun Wu, Jie Shen, Yue Ning, Ting Wang, and Wendy Hui Wang.  Certified edge unlearning for graph neural networks.  In SIGKDD, 2023.
  * [174] Man Wu, Shirui Pan, Chuan Zhou, Xiaojun Chang, and Xingquan Zhu.  Unsupervised domain adaptive graph convolutional networks.  In WWW, 2020.
  * [175] Man Wu, Shirui Pan, Xingquan Zhu, Chuan Zhou, and Lei Pan.  Domain-adversarial graph neural networks for text classification.  In ICDM, 2019.
  * [176] Qitian Wu, Hengrui Zhang, Junchi Yan, and David Wipf.  Handling distribution shifts on graphs: An invariance perspective.  In ICLR, 2022.
  * [177] Yihan Wu, Aleksandar Bojchevski, and Heng Huang.  Adversarial weight perturbation improves generalization in graph neural networks.  In AAAI, 2023.
  * [178] Yingxin Wu, Xiang Wang, An Zhang, Xiangnan He, and Tat-Seng Chua.  Discovering invariant rationales for graph neural networks.  In ICLR, 2022.
  * [179] Han Xie, Jing Ma, Li Xiong, and Carl Yang.  Federated graph classification over non-iid graphs.  NeurIPS, 2021.
  * [180] Han Xie, Li Xiong, and Carl Yang.  Federated node classification over graphs with latent link-type heterogeneity.  In WWW, 2023.
  * [181] Depeng Xu, Shuhan Yuan, Xintao Wu, and HaiNhat Phan.  Dpne: Differentially private network embedding.  In PAKDD, 2018.
  * [182] Han Xu, Yao Ma, Hao-Chen Liu, Debayan Deb, Hui Liu, Ji-Liang Tang, and Anil K Jain.  Adversarial attacks and defenses in images, graphs and text: A review.  Int. J. Autom. Comput., 2020.
  * [183] Heng Xu, Tianqing Zhu, Lefeng Zhang, Wanlei Zhou, and Philip S Yu.  Machine unlearning: A survey.  ACM Comput. Surv., 2023.
  * [184] Hui Xu, Liyao Xiang, Jiahao Yu, Anqi Cao, and Xinbing Wang.  Speedup robust graph structure learning with low-rank information.  In CIKM, 2021.
  * [185] Jing Xu, Stefanos Koffas, Oğuzhan Ersoy, and Stjepan Picek.  Watermarking graph neural networks based on backdoor attacks.  In EuroS&P, 2023.
  * [186] Kaidi Xu, Hongge Chen, Sijia Liu, Pin-Yu Chen, Tsui-Wei Weng, Mingyi Hong, and Xue Lin.  Topology attack and defense for graph neural networks: an optimization perspective.  In IJCAI, 2019.