Pith. sign in

REVIEW 4 major objections 5 minor 45 references

TrustGLM: Evaluating the Robustness of GraphLLMs Against Prompt, Text, and Structure Attacks

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper introduces TrustGLM, a benchmark showing that GraphLLMs—LLMs that reason over node text, graph neighborhoods, and task prompts—are vulnerable to small adversarial changes in any of the three inputs, with text attacks that swap…

desk verdict A useful but uneven GraphLLM robustness benchmark: text-attack findings mostly hold, but the structure-attack pillar is unsupported until surrogate-to-GraphLLM transfer is validated. read the letter →

arxiv 2506.11844 v1 pith:RJA6TAYB submitted 2025-06-13 cs.LG cs.AI

Qihai Zhang , Xinyue Sheng , Yuanfu Sun , Qiaoyu Tan This is my paper
classification cs.LGcs.AI
keywords GraphLLMadversarialattacktext-attributedgraphsrobustnessbenchmarktextstructurepromptmanipulationtraining
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Graph large language models (GraphLLMs) combine node text, neighbor structure, and task prompts to classify nodes in text-attributed graphs. This paper asks whether that combination is robust to adversarial manipulation, and introduces TrustGLM, a benchmark that attacks all three input channels with seven attack algorithms on six datasets. The central finding is that GraphLLMs are highly susceptible: replacing a handful of words in a node's text with semantically similar synonyms drops accuracy by up to tens of points, standard graph-structure attacks also degrade performance, and randomly shuffling the candidate label set in the prompt causes substantial accuracy loss. The paper also tests defenses—data-augmented training for text attacks and adversarial training for structure and prompt attacks—and finds they improve robustness but do not fully restore clean accuracy. If these findings hold, deploying GraphLLMs in high-stakes settings requires robustness auditing of all three input surfaces, not just the graph topology.

What carries the argument

The central object is the extended token sequence $Z_i = (h_{j_1},...,h_{j_k}, x_i^1,...,x_i^m)$ formed by concatenating selected neighbor embeddings from a graph encoder with the node's text tokens; the LLM then generates the output distribution $p_\theta(Y|Z_i) = \prod_k p_\theta(y_k | Z_i, y_{1:k-1})$. The benchmark's key maneuver is to perturb exactly one of the three ingredients—adjacency matrix $A$, text description $t_i$, or the prompt's label set $L$—and measure Attack Success Rate, the fraction of originally correct predictions that change. The defenses work by injecting the same perturbations into training: text data augmentation, adversarial training on adjacency gradients, and label shuffling or noise in prompts.

What would settle it

Re-run the structure attacks but measure attack success rate directly on the GraphLLM for the same perturbed graphs the surrogate found adversarial; if transferred perturbations misclassify the GraphLLM no more often than random edge flips with the same budget, the structural-vulnerability claim fails.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is a comprehensive empirical vulnerability profile: every GraphLLM tested loses accuracy under at least one attack channel, and the most text-reliant model suffers the largest drops under synonym-substitution text attacks, while another model that projects GNN embeddings into prompts is mostly immune to structure attacks but collapses under cross-domain label noise. The benchmark operationalizes a GraphLLM's input as the token sequence formed from node text, neighbor embeddings, and the prompt's candidate label list, and treats each attack as a perturbation to one of those three components. Its headline result is that text attacks are the most consistently damaging across models, that local structure attacks can be more devastating than global ones for structure-sensitive models, and that prompt label attacks—especially cross-domain noise—can remove over half of a model's accuracy.

Load-bearing premise

The structure-attack results stand on an unvalidated transfer assumption: edge perturbations that fool a surrogate GCN are assumed to also fool the GraphLLMs.

Editorial extensions

If this is right

  • If the findings generalize, GraphLLMs cannot be trusted for classification unless text inputs are sanitized or certified, since a few synonym replacements can flip predictions.
  • Existing GNN structure attacks transfer to GraphLLMs that use sampled neighborhoods, so graph-topology defenses remain relevant even after the model becomes language-based.
  • Prompt engineering is a security surface: simply reordering label candidates or adding plausible labels can cut accuracy by dozens of percentage points, so prompt templates should be treated as untrusted inputs.
  • Adversarial augmentation improves robustness only partially, implying that robust GraphLLM training needs objectives beyond re-training on a single attack's outputs.
  • The observed tradeoff between text robustness and structure robustness suggests model selection for deployments should depend on which attack channel is most likely.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An unstated consequence: if surrogate-to-GraphLLM transfer is weak, the structure-attack results may underestimate or misattribute vulnerability; measuring attack success directly on the GraphLLM would settle this.
  • The label-shuffle results imply the models use positional or surface cues in the candidate list; a testable extension is to shuffle labels while keeping the correct label in the same position to isolate positional leakage.
  • The cross-domain noise attacks suggest a defense direction the paper does not pursue: aligning label semantics with the text encoder's embedding space, which should make unrelated labels less persuasive.
  • Because all text and structure attacks are black- or gray-box, an adaptive attacker with white-box access to the GraphLLM gradient might produce stronger perturbations; the benchmark's vulnerability estimates are therefore likely a lower bound.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. TrustGLM is an empirical benchmark paper. It evaluates three GraphLLMs (LLaGA, GraphPrompter, GraphTranslator) on six text-attributed graph datasets against attacks in three dimensions: raw text (HLBB, TextHoaxer), graph structure (Nettack, PRBCD, generated via a surrogate GCN), and prompt label manipulation (label shuffle, in-domain/cross-domain label noise). It also tests defenses: text data augmentation, FGSM/PGD adversarial training for structure, and label-shuffle/noise training for prompts. The paper reports accuracy and ASR in four main result tables and derives conclusions about model- and dataset-dependent robustness.

Significance. If the empirical claims are supported, TrustGLM would be a useful public benchmark: it ships code and a leaderboard, covers three attack surfaces in a common framework, and includes defense baselines. The paper's main assets are its breadth, the open-source artifacts, and the observation that vulnerability patterns differ sharply across models. However, the headline conclusions currently outrun the evidence because the structure-attack results rest on an unvalidated surrogate transfer step and the ASR metric is computed inconsistently. With those fixed, the benchmark could provide a standard evaluation suite for GraphLLM robustness.

major comments (4)
  1. [4.1.1, 5.2.2, Table 3] The structure-attack pipeline generates perturbations with a surrogate GCN and then evaluates them on GraphLLMs, but no transfer validation is reported. This is load-bearing because Table 3 is the sole evidence for the abstract claim that standard graph structure attack methods can significantly degrade model performance; entries such as GraphPrompter on Pubmed under Nettack (ASR 0.51%) and GraphTranslator on Cora under Nettack (accuracy increase +1.51%) are consistent with attack non-transfer rather than model robustness. Without a check that surrogate-optimized edge flips are also adversarial for LLaGA, GraphPrompter, and GraphTranslator, the structure-attack pillar and the defense conclusions in Section 5.4.2 cannot be interpreted. Please add a transfer experiment (e.g., run a small attack directly against each GraphLLM, or report the surrogate ASR alongside the GraphLLM ASR) and restrict the conclusions accordingly.
  2. [5.1.3, Tables 1 and 3] The ASR definition is inconsistent with the reported values. Section 5.1.3 defines ASR as the proportion of originally correctly classified nodes whose predictions change after perturbation, but in Table 1 the ASR column is numerically equal to the relative accuracy drop (original - attacked) / original; for example, Cora GraphPrompter HLBB gives (67.71 - 45.90)/67.71 = 32.2%, exactly the reported ASR. This equality only holds if every node in the accuracy computation was originally correct and all changes are flips, which contradicts the statement in Section 5.2.1 that attacks were restricted to 10% of correctly classified test nodes. Table 3 is also inconsistent with the stated definition (e.g., LLaGA Cora Nettack has a 43.07 percentage-point drop but ASR 41.33, which is neither the flip rate among attacked nodes nor the relative drop). Please state the exact numerator and denominator, recompute all ASR columns, and report standard deviations for the repeated runs.
  3. [Abstract, Section 5.2.3, Table 4] The blanket statements that GraphLLMs are highly susceptible to text attacks and that random shuffling of the candidate label set leads to substantial performance drops are not supported by the paper's own tables. In Table 4, label shuffle improves or barely affects several configurations (GraphPrompter Pubmed +0.23%, LLaGA OGB-Products +0.46%, LLaGA Cora -0.42%), and in Table 3, GraphPrompter and GraphTranslator show near-zero degradation on Pubmed and even accuracy increases on OGB-Arxiv. Please qualify the headline claims by model and dataset, for example 'some GraphLLMs are highly susceptible,' and avoid implying uniform vulnerability across all GraphLLMs.
  4. [Section 2, references [9] and [10]] The paper states that GraphLLM robustness is largely unexplored, yet it cites Guo et al. 2024 (references [9] and [10], which appear to be the same paper) as a robustness study of LLMs on graphs. The manuscript neither compares against nor differentiates TrustGLM from that existing work. Because 'novel benchmark' is a stated contribution, please add an explicit comparison in the related work, correct the duplicate reference, and adjust the 'largely unexplored' claim accordingly.
minor comments (5)
  1. [5.4.1] The text says the defense is tested 'using the same setting as in section 4.1.1,' but the raw text attack setup is in Section 4.2.1; the cross-reference should be corrected.
  2. [Table 3] Nettack results are missing for OGB-Arxiv; please state why (e.g., scalability of Nettack) or add the missing results so the table is complete.
  3. [B.2.1] The PRBCD hyperparameter report 'lr = 2000' appears implausible; please clarify the learning-rate value and units.
  4. [5.1.3] The sentence defining graph-attack ASR is incomplete and ungrammatical: 'For graph attacks, ASR is computed differently. instead of counting only successfully misclassified nodes, the numerator includes all targeted nodes.' Please rewrite the definition so the numerator and denominator are unambiguous.
  5. [5.2.1] The text attack results are based on sampling 10% of correctly classified nodes and repeating three times, but only point estimates are reported; please include standard deviations or confidence intervals, since several ASR differences between models are small.

Circularity Check

0 steps flagged · score 1.0 of 10

TrustGLM is an empirical benchmark with no derivation chain; its self-citations are contextual and no prediction is constructed from its own inputs.

full rationale

TrustGLM does not claim to derive robustness results from first principles; every headline result is an externally measured accuracy or attack-success rate of victim models under concrete perturbations, so there is no fitted parameter renamed as a prediction and no quantity defined in terms of the quantity it purports to predict. The structure-attack pipeline uses a surrogate GCN to generate perturbed adjacency matrices (Section 4.1.1), but the measured quantities in Table 3 are evaluated on the actual GraphLLMs, not on the surrogate, so the setup is an unvalidated transfer assumption rather than a circular derivation. The prompt label shuffle, in-domain noise, and cross-domain noise attacks are the authors' own constructions, but evaluating one's own attack is not circular; the vulnerability claim is an empirical observation about model outputs. Several prior works by the authors (e.g., GraphICL, UniGLM, GaugLLM, OpenGSL) are cited for background or as GraphLLM/defense context, but none is invoked as the justification for a benchmark result, a uniqueness theorem, or an ansatz, so the citations are not load-bearing. The frequently weak transfer of structure attacks (e.g., GraphPrompter ASR 0.51% on Pubmed under Nettack) suggests a correctness or validity risk, not equivalence-by-construction. Accordingly, no circular step is exhibited, and the paper receives a low score reflecting only the presence of minor contextual self-citations.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

No fitted constants or invented entities; the benchmark's assumptions are its attack transferability, sampling choices, and metric comparability. The unspecified attack budgets and query limits are the main reproducibility gaps.

free parameters (5)
  • Graph attack perturbation budget = not specified
    Nettack and PRBCD budgets determine the strength of the attack, yet no budget values are provided in the paper or appendix.
  • Text attack query budget = not specified
    HLBB and TextHoaxer are query-based; the number of queries is not reported.
  • FGSM/PGD epsilon = 1e-3 to 1e-2 (Cora 1e-2, others 1e-3)
    Appendix B.2.2; hand-chosen per dataset, controls defense strength.
  • FGSM/PGD alpha = 0.8
    Appendix B.2.2; balance between clean and adversarial loss.
  • PRBCD block size = 250000
    Appendix B.2.1; attack efficiency parameter.
assumptions (4)
  • domain assumption Structural perturbations generated by surrogate GCN transfer to frozen GraphLLMs
    Section 4.1.1: 'we generate structural perturbations before inference using a surrogate model (e.g., GCN)'. No transferability check is reported.
  • domain assumption Sampling 10% of correctly classified test nodes yields representative attack success rates
    Section 5.2.1: 'we sampled 10% of these correctly classified test nodes and repeated the attack process three times'. No variance is reported.
  • domain assumption ASR definitions are comparable across attack types
    Section 5.1.3 defines ASR differently for graph attacks than for text/prompt attacks, yet the paper compares them in Figure 4.
  • domain assumption The three victim GraphLLMs fairly represent the GraphLLM family
    Only LLaGA, GraphPrompter, and GraphTranslator are used; the paper generalizes to GraphLLMs as a class.

how reviews work

0 comments
Cite this review

Pith. "Pith review of TrustGLM: Evaluating the Robustness of GraphLLMs Against Prompt, Text, and Structure Attacks." pith.science (2026). https://pith.science/paper/RJA6TAYB

@misc{pith2026250611844,
  author       = {Pith},
  title        = {Pith review of: TrustGLM: Evaluating the Robustness of GraphLLMs Against Prompt, Text, and Structure Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RJA6TAYB}},
  note         = {Machine review of arXiv:2506.11844}
}
read the original abstract

Inspired by the success of large language models (LLMs), there is a significant research shift from traditional graph learning methods to LLM-based graph frameworks, formally known as GraphLLMs. GraphLLMs leverage the reasoning power of LLMs by integrating three key components: the textual attributes of input nodes, the structural information of node neighborhoods, and task-specific prompts that guide decision-making. Despite their promise, the robustness of GraphLLMs against adversarial perturbations remains largely unexplored-a critical concern for deploying these models in high-stakes scenarios. To bridge the gap, we introduce TrustGLM, a comprehensive study evaluating the vulnerability of GraphLLMs to adversarial attacks across three dimensions: text, graph structure, and prompt manipulations. We implement state-of-the-art attack algorithms from each perspective to rigorously assess model resilience. Through extensive experiments on six benchmark datasets from diverse domains, our findings reveal that GraphLLMs are highly susceptible to text attacks that merely replace a few semantically similar words in a node's textual attribute. We also find that standard graph structure attack methods can significantly degrade model performance, while random shuffling of the candidate label set in prompt templates leads to substantial performance drops. Beyond characterizing these vulnerabilities, we investigate defense techniques tailored to each attack vector through data-augmented training and adversarial training, which show promising potential to enhance the robustness of GraphLLMs. We hope that our open-sourced library will facilitate rapid, equitable evaluation and inspire further innovative research in this field.

Figures

Figures reproduced from arXiv: 2506.11844 by the authors.

Figure 1
Figure 1. Overview of the TrustGLM benchmark. We evaluate the robustness of LLM-based graph learning models (a.k.a. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Three different kinds of Prompt Attacks. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Comparison of model performance before and after [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Comparative evaluation of different attack approaches on Cora and OGB-Products. [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

45 extracted references · 23 canonical work pages

  1. [10]

    Kai Guo, Zewen Liu, Zhikai Chen, Hongzhi Wen, Wei Jin, Jiliang Tang, and Yi Chang. 2024. Learning on Graphs with Large Language Models(LLMs): A Deep Dive into Model Robustness. arXiv:2407.12068 [cs.LG] https://arxiv.org/abs/ 2407.12068

    arXiv 2024

  2. [1]

    Runjin Chen, Tong Zhao, Ajay Jaiswal, Neil Shah, and Zhangyang Wang. 2024. Llaga: Large language and graph assistant.arXiv preprint arXiv:2402.08170 (2024)

    arXiv 2024

  3. [2]

    Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, and Le Song

  4. [3]

    Laura Dietz, Alexander Kotov, and Edgar Meij. 2018. Utilizing knowledge graphs for text-centric information retrieval. In The 41st international ACM SIGIR confer- ence on research & development in information retrieval . 1387–1390

    work page 2018

  5. [4]

    Yi Fang, Dongzhe Fan, Sirui Ding, Ninghao Liu, and Qiaoyu Tan. 2025. UniGLM: Training One Unified Language Model for Text-Attributed Graphs Embedding. In Proceedings of the Eighteenth ACM International Conference on Web Search and Data Mining. 973–981

    work page 2025

  6. [5]

    Yi Fang, Dongzhe Fan, Daochen Zha, and Qiaoyu Tan. 2024. Gaugllm: Improving graph contrastive learning for text-attributed graphs with large language models. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 747–758

    work page 2024

  7. [6]

    Simon Geisler, Tobias Schmidt, Hakan Şirin, Daniel Zügner, Aleksandar Bo- jchevski, and Stephan Günnemann. 2021. Robustness of graph neural networks at scale. Advances in Neural Information Processing Systems 34 (2021), 7637–7649

    work page 2021

  8. [7]

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)

    arXiv 2014

Show all 45 references
  1. [8]

    Chuan Guo, Alexandre Sablayrolles, Hervé Jégou, and Douwe Kiela. 2021. Gradient-based Adversarial Attacks against Text Transformers. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing , Marie- Francine Moens, Xuanjing Huang, Lucia Specia,...

    2021

  2. [11]

    Will Hamilton, Zhitao Ying, and Jure Leskovec. 2017. Inductive representation learning on large graphs. Advances in neural information processing systems 30 (2017)

    2017

  3. [12]

    Yufei He and Bryan Hooi. 2024. Unigraph: Learning a cross-domain graph foundation model from natural language. arXiv e-prints (2024), arXiv–2402

    2024

  4. [13]

    Weihua Hu, Matthias Fey, Marinka Zitnik, Yuxiao Dong, Hongyu Ren, Bowen Liu, Michele Catasta, and Jure Leskovec. 2020. Open graph benchmark: Datasets for machine learning on graphs. Advances in neural information processing systems 33 (2020), 22118–22133

    2020

  5. [14]

    Bowen Jin, Gang Liu, Chi Han, Meng Jiang, Heng Ji, and Jiawei Han. 2024. Large language models on graphs: A comprehensive survey. IEEE Transactions on Knowledge and Data Engineering (2024)

    2024

  6. [15]

    Thomas N Kipf and Max Welling. 2016. Semi-supervised classification with graph convolutional networks. arXiv preprint arXiv:1609.02907 (2016)

    2016 arXiv

  7. [16]

    Yuhan Li, Zhixun Li, Peisong Wang, Jia Li, Xiangguo Sun, Hong Cheng, and Jeffrey Xu Yu. 2023. A survey of graph meets large language model: Progress and future directions. arXiv preprint arXiv:2311.12399 (2023)

    2023 arXiv

  8. [17]

    Yuyan Liu, Sirui Ding, Sheng Zhou, Wenqi Fan, and Qiaoyu Tan. 2024. Molecu- largpt: Open large language model (llm) for few-shot molecular property predic- tion. arXiv preprint arXiv:2406.12950 (2024)

    2024 arXiv

  9. [18]

    Yong Liu, Susen Yang, Yonghui Xu, Chunyan Miao, Min Wu, and Juyong Zhang

  10. [19]

    Zheyuan Liu, Xiaoxin He, Yijun Tian, and Nitesh V Chawla. 2024. Can we soft prompt LLMs for graph learning tasks?. In Companion Proceedings of the ACM Web Conference 2024. 481–484

    2024

  11. [20]

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017)

    2017 arXiv

  12. [21]

    Rishabh Maheshwary, Saket Maheshwary, and Vikram Pudi. 2021. Gen- erating Natural Language Attacks in a Hard Label Black Box Setting. arXiv:2012.14956 [cs.CL] https://arxiv.org/abs/2012.14956

    2021 arXiv

  13. [22]

    Andrew Kachites McCallum, Kamal Nigam, Jason Rennie, and Kristie Seymore

  14. [23]

    Xubin Ren, Jiabin Tang, Dawei Yin, Nitesh Chawla, and Chao Huang. 2024. A survey of large language models for graphs. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . 6616–6626

    2024

  15. [24]

    Prithviraj Sen, Galileo Namata, Mustafa Bilgic, Lise Getoor, Brian Galligher, and Tina Eliassi-Rad. 2008. Collective classification in network data. AI magazine 29, 3 (2008), 93–93

    2008

  16. [25]

    Oleksandr Shchur, Maximilian Mumme, Aleksandar Bojchevski, and Stephan Günnemann. 2018. Pitfalls of graph neural network evaluation. arXiv preprint arXiv:1811.05868 (2018)

    2018 arXiv

  17. [26]

    Yucheng Shi, Qiaoyu Tan, Xuansheng Wu, Shaochen Zhong, Kaixiong Zhou, and Ninghao Liu. 2024. Retrieval-enhanced knowledge editing for multi-hop question answering in language models. arXiv e-prints (2024), arXiv–2403

    2024

  18. [27]

    Yuanfu Sun, Zhengnan Ma, Yi Fang, Jing Ma, and Qiaoyu Tan. 2025. GraphICL: Unlocking Graph Learning Potential in LLMs through Structured Prompt Design. In Findings of the Association for Computational Linguistics . 2440–2459

    2025

  19. [28]

    Yiwei Sun, Suhang Wang, Xianfeng Tang, Tsung-Yu Hsieh, and Vasant Honavar

  20. [29]

    Jiabin Tang, Yuhao Yang, Wei Wei, Lei Shi, Lixin Su, Suqi Cheng, Dawei Yin, and Chao Huang. 2024. Graphgpt: Graph instruction tuning for large language models. In Proceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval . 491–500

    2024

  21. [30]

    Ce Wang, Hongzhi Yu, and Fucheng Wan. 2018. Information retrieval technology based on knowledge graph. In 2018 3rd International Conference on Advances in Materials, Mechatronics and Civil Engineering (ICAMMCE 2018) . Atlantis Press, 291–296

    2018

  22. [31]

    Duo Wang, Yuan Zuo, Fengzhi Li, and Junjie Wu. 2024. LLMs as Zero-shot Graph Learners: Alignment of GNN Representations with LLM Token Embeddings. arXiv:2408.14512 [cs.LG] https://arxiv.org/abs/2408.14512

    2024 arXiv

  23. [32]

    Jihong Wang, Minnan Luo, Fnu Suya, Jundong Li, Zijiang Yang, and Qinghua Zheng. 2020. Scalable attack on graph data by injecting vicious nodes. Data Mining and Knowledge Discovery 34 (2020), 1363–1389

    2020

  24. [33]

    Wenqi Wang, Run Wang, Lina Wang, Zhibo Wang, and Aoshuang Ye. 2021. To- wards a Robust Deep Neural Network in Texts: A Survey. arXiv:1902.07285 [cs.CL] https://arxiv.org/abs/1902.07285

    2021 arXiv

  25. [34]

    Xiang Wang, Xiangnan He, Yixin Cao, Meng Liu, and Tat-Seng Chua. 2019. Kgat: Knowledge graph attention network for recommendation. In Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining . 950–958

    2019

  26. [35]

    Zonghan Wu, Shirui Pan, Fengwen Chen, Guodong Long, Chengqi Zhang, and S Yu Philip. 2020. A comprehensive survey on graph neural networks. IEEE transactions on neural networks and learning systems 32, 1 (2020), 4–24

    2020

  27. [36]

    Keyulu Xu, Weihua Hu, Jure Leskovec, and Stefanie Jegelka. 2018. How powerful are graph neural networks? arXiv preprint arXiv:1810.00826 (2018)

    2018 arXiv

  28. [37]

    Muchao Ye, Chenglin Miao, Ting Wang, and Fenglong Ma. 2022. TextHoaxer: Budgeted Hard-Label Adversarial Attacks on Text. Proceedings of the AAAI Conference on Artificial Intelligence 36, 4 (Jun. 2022), 3877–3884. https://doi.org/ 10.1609/aaai.v36i4.20303

    2022 doi

  29. [38]

    Ruosong Ye, Caiqi Zhang, Runhui Wang, Shuyuan Xu, and Yongfeng Zhang. 2024. Language is All a Graph Needs. arXiv:2308.07134 [cs.CL] https://arxiv.org/abs/ 2308.07134

    2024 arXiv

  30. [39]

    Mengmei Zhang, Mingwei Sun, Peng Wang, Shen Fan, Yanhu Mo, Xiaoxiao Xu, Hong Liu, Cheng Yang, and Chuan Shi. 2024. Graphtranslator: Aligning graph model to large language model for open-ended tasks. In Proceedings of the ACM Web Conference 2024. 1003–1014

    2024

  31. [40]

    Sheng, Ahoud Alhazmi, and Chenliang Li

    Wei Emma Zhang, Quan Z. Sheng, Ahoud Alhazmi, and Chenliang Li. 2019. Adversarial Attacks on Deep Learning Models in Natural Language Processing: A Survey. arXiv:1901.06796 [cs.CL] https://arxiv.org/abs/1901.06796

    2019 arXiv

  32. [41]

    Zhiyao Zhou, Sheng Zhou, Bochao Mao, Xuanyi Zhou, Jiawei Chen, Qiaoyu Tan, Daochen Zha, Yan Feng, Chun Chen, and Can Wang. 2023. Opengsl: A comprehensive benchmark for graph structure learning. Advances in Neural Information Processing Systems 36 (2023), 17904–17928

    2023

  33. [42]

    Daniel Zügner, Amir Akbarnejad, and Stephan Günnemann. 2018. Adversarial attacks on neural networks for graph data. InProceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining . 2847–2856. TrustGLM: Evaluating the Robustness of GraphLLMs ...

    2018

  34. [2000]

    Information Retrieval 3 (2000), 127–163

    Automating the construction of internet portals with machine learning. Information Retrieval 3 (2000), 127–163

    2000

  35. [2018]

    In International conference on machine learning

    Adversarial attack on graph structured data. In International conference on machine learning. PMLR, 1115–1124

  36. [2020]

    In Proceedings of the Web Conference

    Adversarial attacks on graph neural networks via node injections: A hier- archical reinforcement learning approach. In Proceedings of the Web Conference

  37. [2021]

    IEEE Transactions on knowledge and data engineering 35, 1 (2021), 181–195

    Contextualized graph attention network for recommendation with item knowledge graph. IEEE Transactions on knowledge and data engineering 35, 1 (2021), 181–195

    2021

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.