How do you evaluate the robustness of a GNN model?

Example Answer

I would define the threat model before calling a GNN robust. Can the attacker change node features, add or delete edges, or poison training labels? How many changes are allowed, what does the attacker know, and is the goal a targeted error or overall degradation?

I would report clean-task performance alongside attacked performance under that stated budget. The evaluation should match the task and split, include strong adaptive attacks where applicable, and examine important slices such as low-degree nodes. A defense that defeats one attack may fail against a different attacker or merely make gradients less useful to that attack.

I would distinguish empirical resistance from a certificate. A certified method provides a guarantee only under its stated perturbation model and assumptions; ordinary smoothing, regularization, or attention does not imply invariance to arbitrary graph changes. I would also test natural graph shift separately from adversarial changes, because they answer different questions.

Concrete Example

For a two-edge attack budget, specify whether that means two additions, two deletions, or either, and whether self-loops and label-revealing edges are forbidden. Otherwise two reported robustness scores may describe different tests.

Adversarial attacks on graph neural networks · Certified robustness for GNNs