Pith. sign in

REVIEW 3 major objections 4 minor 111 references

The alignment layer shared by graph foundation models is itself an attack surface: one directed perturbation collapses every tested model, and real input edits break three of six at peak.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 14:59 UTC pith:EOGQ6XTX

load-bearing objection A genuinely new attack surface, honestly evaluated, with one headline exception—OpenGraph's 'fifth of budget' fragility—that is missing a same-width plain-GNN control and should be treated as provisional until that control exists. the 3 major comments →

arxiv 2607.18567 v1 pith:EOGQ6XTX submitted 2026-07-20 cs.AI cs.CRcs.LG

Attacking Graph Foundation Models Through Their Shared Representation

Pankaj Kumar , Subhankar Mishra This is my paper
classification cs.AI cs.CRcs.LG
keywords graph foundation modelsalignment layeradversarial attackrepresentation-space perturbationspectral tokenizercarrier gainattack detectionzero-shot transfer
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper argues that the component that makes a graph foundation model general—the alignment layer that maps every input from any domain into one shared representation before task reasoning—is also its shared vulnerability. The authors show that a single directed perturbation of that shared representation degrades every one of six public models at inference time, with no access to training. For five models the budget is comparable to what a plain graph neural network would need; OpenGraph is the exception, its spectral tokenizer collapsing at about a fifth of that budget, which a same-representation control traces to the tokenizer rather than the decoder. They also show that realizable input edits—changing features, edges, or class-description text—remove at least half the correct predictions on three of the six models at peak, and that how much fragility an attacker realizes tracks how directly the decoder reads the representation, not clean accuracy. Robustifying the layer fails against an adaptive attacker, but attacked inputs are detectable by a density test on low-dimensional continuous carriers.

Core claim

The paper's central claim is that the alignment map Φ—the domain-agnostic bottleneck every input passes through before the task decoder g, so the model is g∘Φ—is a distinct attack surface. Because every domain routes through the same space, a perturbation inside that space can transfer across domains and across models. A directed representation-space perturbation collapses all six models, but for five of them the required budget is close to what a plain graph network needs (about 0.48–0.70 of the representation norm); OpenGraph is the one exception, collapsing at 0.12 of that budget, about five times below the plain-network band. Same-representation linear probes trained on OpenGraph's clean

What carries the argument

The central object is the alignment map Φ, defined as the map every input (adjacency, features, text) passes through before task reasoning, so the model is g∘Φ with decoder g. Its concrete forms are a spectral tokenizer built from the leading singular subspace of the normalized adjacency (OpenGraph, AnyGraph, GraphAny), a frozen text embedding space, and a discrete codebook (OFA, ZeroG, GFT). Two structural facts carry the argument: Davis–Kahan perturbation theory gives the rotation of the leading singular subspace under a bounded input budget, amplified by the inverse singular gap 1/(σ_i − σ_j); and the flip-budget proposition b_i = m_i/κ_i separates a margin term m_i (clean confidence) fro

Load-bearing premise

The claim that OpenGraph's fragility is alignment-specific depends on treating a directed perturbation measured in units of representation norm as a fair, comparable lever across plain graph networks, spectral tokenizers, and text/codebook carriers; the paper discloses this caveat in its supplement but does not resolve it.

What would settle it

Run the same directed representation-space attack at matched relative budget on OpenGraph's spectral tokenizer but replace the transformer decoder with a linear probe trained on the same clean tokens: if the linear probe does not collapse at or below the transformer's threshold, the tokenizer-not-decoder attribution fails. Alternatively, if a plain graph network whose penultimate representation has a similarly large norm and small margin also collapses at 0.12 of its norm, OpenGraph's fragility is generic, not alignment-specific. A direct measurement of the collapse threshold under decoder-opt

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • OpenGraph's spectral tokenizer collapses at about one-fifth the representation-norm budget plain graph networks need, so deploying that tokenizer without monitoring incurs an alignment-specific risk.
  • Realizable input edits—a few feature entries per node, or edits to shared class-description text—can remove at least half the correct predictions on three of the six models, so input-access attackers do not need to reach the representation directly.
  • Predicting which model is attackable should use how directly the decoder reads the representation (carrier gain) rather than clean accuracy; clean-accuracy headroom does not survive on realizable attacks.
  • Attacked inputs are detectable near perfectly on low-dimensional continuous carriers by a density test fit on clean representations, at a five percent false-positive rate, and detection holds under an adaptive attacker on the codebook carrier.
  • Robustifying the alignment layer by standardization, smoothing, or margin hardening fails against an adaptive attacker; on the codebook, additive noise backfires by flipping tokens.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If this framing generalizes, any future graph foundation model that adds a new shared carrier—a learned graph tokenizer or continuous prototype head—inherits this attack surface by construction, since the surface is defined by the architecture, not by one model.
  • The density-test detector suggests a deployment pattern the paper only sketches: monitor the shared representation as a channel, flagging inputs whose representation leaves the clean manifold, even when the model itself cannot be hardened.
  • The cross-domain universal perturbation confined to the shared subspace transfers to far-domain PubMed where a generic vector fails; the same test could be applied to other encoder pairs to reveal when two models share usable geometry.
  • A testable extension: constrain a decoder's Lipschitz constant (for example, by spectral norm control) and measure whether reachability drops as the flip-budget proposition predicts, which would separate decoder sensitivity from token fragility.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper introduces the 'alignment layer' of a graph foundation model (GFM) — the map Φ that every input passes through before task reasoning, so that a GFM is g∘Φ — and argues that this shared representation is a distinct, previously unstudied attack surface. It instantiates inference-time attacks on six public GFMs spanning spectral tokenizers (OpenGraph, AnyGraph), closed-form spectral models (GraphAny), text spaces (OFA, ZeroG), and a discrete codebook (GFT). The main empirical claims are: (i) a directed representation-space perturbation collapses every model, but at a budget comparable to what a plain GNN needs, with the exception of OpenGraph, whose spectral tokenizer collapses at about a fifth of that budget; (ii) a realizable input-space attack removes at least half of correct predictions on three of the six models at peak; (iii) how much fragility an input-access attacker realizes tracks the carrier gain—how directly the decoder reads the representation—rather than clean-accuracy headroom; and (iv) robustifying the alignment layer fails against an adaptive attacker, but attacked inputs are detectable by a density test on low-dimensional continuous carriers. The paper includes multiple controls (equal-budget random perturbations, plain-network baselines, same-representation probes, multiple seeds, real-pipeline re-evaluation) and reports honest negatives: the headroom law fails on realizable attacks, classical graph attacks beat the spectral attack on OpenGraph's str

Significance. If the central claims hold, the paper identifies a genuinely new attack surface for graph foundation models, with a plausible mechanism for cross-domain transfer through the shared alignment space and a monitoring approach that works where hardening fails. The strengths are the unusually thorough experimental hygiene: equal-budget random controls, reproduction of each model to published clean numbers, re-evaluation on the real inference pipeline, multiple seeds, and the explicit falsification of the paper's own 'headroom law.' The spectral-rotation attack formula and the discrete do-operator experiment on GFT are credible, and the detection results on low-dimensional carriers are a useful step. However, the cleanest evidence for the paper's central distinctness claim—the OpenGraph 'fifth-of-budget' fragility—depends on a control comparison that is not yet commensurable, and the 'carrier gain' descriptor has a partial circularity. These are fixable with additional experiments and sharper framing, but they are load-bearing for the paper's headline conclusions.

major comments (3)
  1. [Section 4 / Supplement J / Table 16] The central claim that OpenGraph's fragility is 'alignment-specific' rests on comparing OpenGraph's 1024-dimensional spectral token (collapse at 0.12 of representation norm) with plain GCN/SAGE/GAT penultimate layers (0.48–0.70). The plain networks' hidden dimensions and norm scales are not reported, and the paper's own observation of a −0.88 correlation between carrier dimension and collapse threshold is exactly the confound. A width/norm-matched plain GNN control (e.g., a plain GCN with a 1024-dimensional penultimate layer, trained on the same datasets and perturbed with the same directed attack) is needed before the 'fifth of budget' can be attributed to the alignment layer rather than to representation scale. As written, the comparison cannot rule out that any sufficiently high-dimensional representation—alignment layer or not—collapses at a smaller fraction of its norm.
  2. [Supplement I / Table 1 / Section 3] The paper's claim that 'how much fragility an input-access attacker realizes tracks how directly the decoder reads the representation' is operationalized in Table 1 with κ, fitted as the initial slope of the attack-success-versus-budget curve. Since κ is read from the same curve whose peak is the target, the reported correlation with peak attack success is partly a re-description, as the supplement concedes. The structural measure m/(L‖S‖) is attack-curve-free, but it predicts representation-space collapse thresholds, not the input-space attack success of Table 1. To make the 'tracks the decoder' claim non-circular, the paper should either report the structural predictor's correlation with the realizable input-space results, or clearly label the Table 1 κ relationship as a fitted descriptor that is not independent evidence.
  3. [Supplement J / 'The OpenGraph case is the tokenizer, not the decoder'] The same-representation control for OpenGraph compares a linear probe and a perceptron, both trained on clean tokens of the target graph and attacked deterministically, against a zero-shot transformer decoder whose attack must survive random anchor sampling. The paper discloses this caveat but does not resolve it; the direction of the bias is exactly the direction of the reported difference (probes collapse at 0.04/0.09, decoder at 0.15). This does not establish that the token is intrinsically more fragile than the decoder—it may only be easier to attack deterministically. A matched control (e.g., attacking the probes with anchor-sampling noise, or training the probe zero-shot) is needed to support the 'tokenizer not decoder' attribution.
minor comments (4)
  1. [Supplement J, Table 16] The text reports 'Pearson −0.88, p=0.02' for the correlation between carrier dimension and collapse threshold 'across the three spectral models,' but a p-value cannot be computed meaningfully for N=3. If the correlation is over a larger set (the 'six points' mentioned in the next sentence), state N=6 and clarify which points are included. Also report the hidden dimensions and norm scales of the plain GNN control.
  2. [Abstract / Table 1] The abstract says the carrier gain is 'measured structurally from the decoder's local Lipschitz sensitivity,' but Table 1 defines κ as a post-hoc descriptor: the initial slope of the attack-success-versus-budget curve in each carrier's own unit. The structural m/(L‖S‖) measure appears only in the supplement and for representation-space thresholds. Harmonize the terminology so the abstract does not overstate what Table 1 contains.
  3. [Section 4 / Figure 4(b) / Supplement I] The main text reports the pooled headroom correlation as Spearman +0.01 on N=21 realizable cells, while the supplement reports Spearman −0.53 on N=29 cells that mix realizable and representation-space attacks. The distinction is explained, but the main text should state explicitly that the two numbers refer to different subsets to avoid the appearance of an internal contradiction.
  4. [Supplement J, structural predictor] The structural predictor m/(L‖S‖) relies on a local Lipschitz constant computed by autograd power iteration. Please specify the number of power iterations, the matrix norm convention, and whether L is computed per node or per layer; this will help reproducibility.

Circularity Check

0 steps flagged

No significant circularity: the main empirical claims are self-contained, and the one fitted quantity (carrier gain κ) is explicitly disclosed as a descriptor and supplemented by an attack-curve-free structural measure.

full rationale

The paper's derivation chain is empirical rather than self-referential. The central claims—that realizable input-space attacks reach three of six graph foundation models and that OpenGraph's spectral token collapses at a smaller normalized representation budget than plain GNNs—are measured on public models, reproduced to published clean numbers, and compared against matched random controls. They are not obtained by fitting the outcome into the argument. The only place where the paper itself flags a partial re-description is the fitted carrier gain κ: 'Because κ is read from the same curve whose peak is the target, we rerun with κ taken from low budgets only...' and 'We caution that κ is read from the attack curve, so its correlation with peak success is partly a re-description.' This is disclosed, and it is not load-bearing for the central claim because the paper also constructs a structural, attack-curve-free predictor m/(L||S||) from clean margins, representation norms, and decoder Lipschitz constants, and honestly reports its limitations ('not a quantitative law,' and without OpenGraph the correlation drops to 0.53). The OpenGraph 'alignment-specific fragility' comparison raises a possible control-commensurability concern—no same-width plain GNN is run—but that is a confound/external-validity issue, not a reduction of the observed threshold to an input of the calculation. There are no load-bearing self-citations: the cited model papers are external works by other groups, and no uniqueness theorem by the present authors is invoked to force a conclusion. The headroom law is explicitly falsified on realizable attacks (Spearman +0.01, N=21), which is the opposite of circular reasoning. On the stated criteria, no circular step meets the evidentiary bar.

Axiom & Free-Parameter Ledger

4 free parameters · 5 axioms · 0 invented entities

No new physical entities are introduced. The 'alignment layer' is a definitional abstraction over existing GFM architectures, not a new mechanism proposed to explain an effect. The main fitted quantities are the per-cell carrier gain κ and the data-chosen Procrustes rank k; the analysis explicitly labels κ as a partly re-descriptive descriptor. The load-bearing assumptions are the g∘Φ decomposition, Davis-Kahan perturbation theory, Lipschitz/decoder-factorization structure, and carrier-specific manifold structure for detection.

free parameters (4)
  • per-cell carrier gain κ = GraphAny 7.1, ZeroG 5.9, OFA 5.2, AnyGraph 2.5, OpenGraph 0.3 (carrier-specific units)
    Fitted as the initial slope of the attack-success-versus-budget curve in each carrier's own unit; the authors caution its correlation with peak success is partly a re-description and its units differ across carriers (Table 1, Supplement I).
  • Procrustes alignment rank k = rank maximizing cross-domain CKA per domain pair
    The alignment subspace P used in align-then-ablate and in the alignment-targeted transfer attack is chosen by fitting an orthogonal Procrustes map and selecting the rank where aligned CKA peaks; it is data-dependent, not predicted.
  • text-attack semantic floor and edit cap = cosine floor 0.70, cap 8 edits/class
    Hyperparameters of the realizable class-text attack; they bound the text-edit attack and affect the reported text-model attack success (Supplement C).
  • spectral-rotation denominator clamp = near-degenerate denominators clamped
    The eigenvector-perturbation edge attack clamps 1/(λ_k - λ_m) denominators because OpenGraph's median singular gap is near 4e-4; the clamping is a hand-chosen stability parameter that shapes the reported spectral attack (Supplement J).
axioms (5)
  • domain assumption A graph foundation model decomposes as g∘Φ with a single domain-agnostic bottleneck Φ before task reasoning
    This is the paper's central definition (Section 3, Claim 1). If actual GFMs do not share such an alignment map, the attack surface is not distinct from ordinary hidden-layer attacks.
  • standard math Davis-Kahan sin-theta theorem and first-order eigenvector perturbation
    Used in Proposition P1 and in the spectral rotation edge attack to relate a bounded input perturbation to rotation of the leading singular subspace by 1/(σ_i - σ_j) (Section L, Supplement J).
  • domain assumption Decoder g is L-Lipschitz and, in P3, factors as g(r)=h(Wr) with task subspace rank d_T ≤ k
    Used to derive the flip budget m_i/κ_i and decoder absorption. The paper notes global self-attention is not Lipschitz and therefore uses per-node local Lipschitz estimates (Section L, Supplement J).
  • domain assumption Clean representations lie on a low-dimensional manifold detectable by a density test
    The detection defense fits Mahalanobis tests on clean representations; the paper shows this fails on ZeroG's near-isotropic text embedding (AUC 0.66), so the assumption is carrier-dependent.
  • domain assumption Threat-model perturbations within stated budgets are accepted by the real inference pipeline
    The attack definition assumes edge/feature/text edits are realizable inputs. The paper discloses fidelity caveats for OFA and ZeroG where the real decoder or full pipeline is not used (Supplement H).

pith-pipeline@v1.3.0-alltime-deepseek · 26960 in / 14406 out tokens · 172604 ms · 2026-08-01T14:59:30.684623+00:00 · methodology

0 comments
read the original abstract

A graph foundation model generalizes across graph domains by mapping every input into one shared representation before any task reasoning. We call this map the alignment layer, the component that separates a graph foundation model from a graph neural network, and we show it is a distinct attack surface that prior work has not studied. We attack it at inference time, with no access to training, on six public models spanning spectral tokenizers, text embedding spaces, and a discrete codebook. A directed representation-space perturbation collapses every model, but at a budget comparable to the representation norm a plain graph network also needs, with one exception: OpenGraph, whose spectral tokenizer collapses at a fifth of that budget, an alignment-specific fragility a plain network does not share and which a same-representation control traces to the tokenizer rather than the decoder. A realizable input-space attack that edits edges, features, or text removes at least half the correct predictions on three of the six models at peak. How much of this fragility an input-access attacker realizes tracks how directly the decoder reads the representation, and not the clean accuracy a task leaves; we measure this carrier gain structurally from the decoder's local Lipschitz sensitivity, and report clean-accuracy headroom as a within-model ordering heuristic that does not survive on realizable attacks.

Figures

Figures reproduced from arXiv: 2607.18567 by Pankaj Kumar, Subhankar Mishra.

Figure 1
Figure 1. Figure 1: Attack setup. A graph foundation model maps inputs from any domain into one shared representation through the [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Left: input-space attack success reaches three of six models above one half, with the representation-space peak drawn [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Attack success against budget for a feature carrier [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Left: removing the alignment subspace collapses [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Reachability against clean-accuracy headroom [PITH_FULL_IMAGE:figures/full_fig_p014_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Predicted against observed representation-space [PITH_FULL_IMAGE:figures/full_fig_p016_6.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

111 extracted references · 2 canonical work pages

  1. [1]

    IEEE Transactions on Pattern Analysis and Machine Intelligence , year =

    Graph Foundation Models: Concepts, Opportunities and Challenges , author =. IEEE Transactions on Pattern Analysis and Machine Intelligence , year =. doi:10.1109/TPAMI.2025.3548729 , note =. 2310.11829 , archivePrefix =

    arXiv 2025

  2. [2]

    2025 , eprint =

    Graph Foundation Models: A Comprehensive Survey , author =. 2025 , eprint =

    2025

  3. [3]

    Proceedings of the 41st International Conference on Machine Learning (ICML) , year =

    Position: Graph Foundation Models Are Already Here , author =. Proceedings of the 41st International Conference on Machine Learning (ICML) , year =. 2402.02216 , archivePrefix =

    Pith/arXiv arXiv

  4. [4]

    IEEE Transactions on Knowledge and Data Engineering , year =

    A Survey on Self-Supervised Graph Foundation Models: Knowledge-Based Perspective , author =. IEEE Transactions on Knowledge and Data Engineering , year =. 2403.16137 , archivePrefix =

    Pith/arXiv arXiv

  5. [5]

    International Conference on Learning Representations (ICLR) , year=

    One for All: Towards Training One Graph Model for All Classification Tasks , author=. International Conference on Learning Representations (ICLR) , year=

  6. [6]

    Proceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR) , year=

    GraphGPT: Graph Instruction Tuning for Large Language Models , author=. Proceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR) , year=

  7. [7]

    International Conference on Machine Learning (ICML) , year=

    LLaGA: Large Language and Graph Assistant , author=. International Conference on Machine Learning (ICML) , year=

  8. [8]

    Advances in Neural Information Processing Systems (NeurIPS) , year=

    GFT: Graph Foundation Model with Transferable Tree Vocabulary , author=. Advances in Neural Information Processing Systems (NeurIPS) , year=

  9. [9]

    Advances in Neural Information Processing Systems (NeurIPS) , year=

    PRODIGY: Enabling In-context Learning Over Graphs , author=. Advances in Neural Information Processing Systems (NeurIPS) , year=. 2305.12600 , archivePrefix=

    Pith/arXiv arXiv

  10. [10]

    Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) , year=

    UniGraph: Learning a Unified Cross-Domain Foundation Model for Text-Attributed Graphs , author=. Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) , year=. 2402.13630 , archivePrefix=

    Pith/arXiv arXiv

  11. [11]

    2025 , eprint=

    LLM as GNN: Graph Vocabulary Learning for Text-Attributed Graph Foundation Models , author=. 2025 , eprint=

    2025

  12. [12]

    Advances in Neural Information Processing Systems (NeurIPS) , year=

    LLMs as Zero-shot Graph Learners: Alignment of GNN Representations with LLM Token Embeddings , author=. Advances in Neural Information Processing Systems (NeurIPS) , year=. 2408.14512 , archivePrefix=

    Pith/arXiv arXiv

  13. [13]

    Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) , year=

    TrustGLM: Evaluating the Robustness of GraphLLMs Against Prompt, Text, and Structure Attacks , author=. Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) , year=

  14. [14]

    IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) , year=

    Krait: A Backdoor Attack Against Graph Prompt Tuning , author=. IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) , year=

  15. [15]

    2025 , eprint=

    Stealthy Dual-Trigger Backdoors: Attacking Prompt Tuning in LM-Empowered Graph Foundation Models , author=. 2025 , eprint=

    2025

  16. [16]

    Advances in Neural Information Processing Systems (NeurIPS) , year=

    Intruding with Words: Towards Understanding Graph Injection Attacks at the Text Level , author=. Advances in Neural Information Processing Systems (NeurIPS) , year=

  17. [17]

    2023 , eprint=

    GraphText: Graph Reasoning in Text Space , author=. 2023 , eprint=

    2023

  18. [18]

    International Conference on Learning Representations (ICLR) , year=

    Harnessing Explanations: LLM-to-LM Interpreter for Enhanced Text-Attributed Graph Representation Learning , author=. International Conference on Learning Representations (ICLR) , year=

  19. [19]

    International Conference on Learning Representations (ICLR) , year=

    Learning on Large-scale Text-attributed Graphs via Variational Inference , author=. International Conference on Learning Representations (ICLR) , year=

  20. [20]

    Findings of the Association for Computational Linguistics: EACL 2024 , year=

    Language is All a Graph Needs , author=. Findings of the Association for Computational Linguistics: EACL 2024 , year=

    2024

  21. [21]

    Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) , year=

    HiGPT: Heterogeneous Graph Language Model , author=. Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) , year=. 2402.16024 , archivePrefix=

    Pith/arXiv arXiv

  22. [22]

    Advances in Neural Information Processing Systems (NeurIPS) , year=

    GITA: Graph to Visual and Textual Integration for Vision-Language Graph Reasoning , author=. Advances in Neural Information Processing Systems (NeurIPS) , year=. 2402.02130 , archivePrefix=

    Pith/arXiv arXiv

  23. [23]

    Proceedings of the 33rd International Joint Conference on Artificial Intelligence (IJCAI) , year=

    Efficient Tuning and Inference for Large Language Models on Textual Graphs , author=. Proceedings of the 33rd International Joint Conference on Artificial Intelligence (IJCAI) , year=. 2401.15569 , archivePrefix=

    Pith/arXiv arXiv

  24. [24]

    Proceedings of the ACM Web Conference (WWW) , year=

    Can GNN be Good Adapter for LLMs? , author=. Proceedings of the ACM Web Conference (WWW) , year=. 2402.12984 , archivePrefix=

    Pith/arXiv arXiv

  25. [25]

    International Conference on Learning Representations (ICLR) , year=

    Fully-inductive Node Classification on Arbitrary Graphs , author=. International Conference on Learning Representations (ICLR) , year=

  26. [26]

    Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) , year=

    ZeroG: Investigating Cross-dataset Zero-shot Transferability in Graphs , author=. Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) , year=

  27. [27]

    Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD) , year=

    Adversarial Attacks on Neural Networks for Graph Data , author=. Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD) , year=

  28. [28]

    International Conference on Learning Representations (ICLR) , year=

    Adversarial Attacks on Graph Neural Networks via Meta Learning , author=. International Conference on Learning Representations (ICLR) , year=

  29. [29]

    Proceedings of the 28th International Joint Conference on Artificial Intelligence (IJCAI) , year =

    Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective , author =. Proceedings of the 28th International Joint Conference on Artificial Intelligence (IJCAI) , year =. 1906.04214 , archivePrefix =

    Pith/arXiv arXiv 1906

  30. [30]

    Proceedings of the 35th International Conference on Machine Learning (ICML) , year =

    Adversarial Attack on Graph Structured Data , author =. Proceedings of the 35th International Conference on Machine Learning (ICML) , year =. 1806.02371 , archivePrefix =

    Pith/arXiv arXiv

  31. [31]

    Proceedings of The Web Conference 2020 , pages =

    Sun, Yiwei and Wang, Suhang and Tang, Xianfeng and Hsieh, Tsung-Yu and Honavar, Vasant , title =. Proceedings of The Web Conference 2020 , pages =. 2020 , isbn =. doi:10.1145/3366423.3380149 , abstract =

    arXiv 2020

  32. [32]

    Data Mining and Knowledge Discovery (ECML-PKDD) , year =

    Scalable Attack on Graph Data by Injecting Vicious Nodes , author =. Data Mining and Knowledge Discovery (ECML-PKDD) , year =. 2004.13825 , archivePrefix =

    Pith/arXiv arXiv 2004

  33. [33]

    Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) , year=

    TDGIA: Effective Injection Attacks on Graph Neural Networks , author=. Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) , year=. 2106.06663 , archivePrefix=

    Pith/arXiv arXiv

  34. [34]

    Proceedings of the 30th ACM International Conference on Information and Knowledge Management (CIKM) , year=

    Single Node Injection Attack against Graph Neural Networks , author=. Proceedings of the 30th ACM International Conference on Information and Knowledge Management (CIKM) , year=. 2108.13049 , archivePrefix=

    Pith/arXiv arXiv

  35. [35]

    Proceedings of the 26th ACM Symposium on Access Control Models and Technologies (SACMAT) , year=

    Backdoor Attacks to Graph Neural Networks , author=. Proceedings of the 26th ACM Symposium on Access Control Models and Technologies (SACMAT) , year=. 2006.11165 , archivePrefix=

    Pith/arXiv arXiv 2006

  36. [36]

    Proceedings of the 36th International Conference on Machine Learning (ICML) , series=

    Adversarial Attacks on Node Embeddings via Graph Poisoning , author=. Proceedings of the 36th International Conference on Machine Learning (ICML) , series=. 2019 , eprint=

    2019

  37. [37]

    ACM SIGKDD Explorations Newsletter , volume=

    Adversarial Attacks and Defenses on Graphs: A Review, A Tool and Empirical Studies , author=. ACM SIGKDD Explorations Newsletter , volume=. 2020 , note=

    2020

  38. [38]

    IEEE Transactions on Knowledge and Data Engineering , year=

    Adversarial Attack and Defense on Graph Data: A Survey , author=. IEEE Transactions on Knowledge and Data Engineering , year=

  39. [39]

    2026 , note=

    Ma, Jiaji and Trivedi, Puja and Koutra, Danai , booktitle=. 2026 , note=

    2026

  40. [40]

    Unveiling the Vulnerability of Graph-

    Fan, Bowen and Guo, Zhilin and Li, Xunkai and Zhou, Yihan and Zhou, Bing and Li, Zhenjun and Li, Rong-Hua and Wang, Guoren , booktitle=. Unveiling the Vulnerability of Graph-. 2026 , note=

    2026

  41. [41]

    Proceedings of the ACM Web Conference (WWW) , year =

    Can LLMs Fool Graph Learning? Exploring Universal Adversarial Attacks on Text-Attributed Graphs , author =. Proceedings of the ACM Web Conference (WWW) , year =

  42. [42]

    IEEE Symposium on Security and Privacy (S&P) , year =

    Are LLM-Enhanced Graph Neural Networks Robust against Poisoning Attacks? , author =. IEEE Symposium on Security and Privacy (S&P) , year =

  43. [43]

    2025 , eprint =

    Adversarial Attacks and Defenses on Graph-aware Large Language Models (LLMs) , author =. 2025 , eprint =

    2025

  44. [44]

    2026 , eprint =

    Graph-Aware Stealthy Poison-Text Backdoors for Text-Attributed Graphs , author =. 2026 , eprint =

    2026

  45. [45]

    2025 , eprint =

    BadGraph: A Backdoor Attack Against Latent Diffusion Model for Text-Guided Graph Generation , author =. 2025 , eprint =

    2025

  46. [46]

    2024 , booktitle =

    Attacks on Node Attributes in Graph Neural Networks , author =. 2024 , booktitle =. 2402.12426 , archivePrefix=

    Pith/arXiv arXiv 2024

  47. [47]

    2022 , booktitle =

    Ignore Previous Prompt: Attack Techniques For Language Models , author =. 2022 , booktitle =. 2211.09527 , archivePrefix=

    Pith/arXiv arXiv 2022

  48. [48]

    Not What You've Signed Up For: Compromising Real-World

    Greshake, Kai and Abdelnabi, Sahar and Mishra, Shailesh and Endres, Christoph and Holz, Thorsten and Fritz, Mario , year =. Not What You've Signed Up For: Compromising Real-World. Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec '23) , eprint =

  49. [49]

    2023 , eprint =

    Universal and Transferable Adversarial Attacks on Aligned Language Models , author =. 2023 , eprint =

    2023

  50. [50]

    International Conference on Learning Representations (ICLR) , year =

    AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models , author =. International Conference on Learning Representations (ICLR) , year =. 2310.04451 , archivePrefix =

    Pith/arXiv arXiv

  51. [51]

    2023 , eprint =

    Adversarial Demonstration Attacks on Large Language Models , author =. 2023 , eprint =

    2023

  52. [52]

    2023 , eprint =

    Hijacking Large Language Models via Adversarial In-Context Learning , author =. 2023 , eprint =

    2023

  53. [53]

    2023 , eprint =

    Backdoor Attacks for In-Context Learning with Language Models , author =. 2023 , eprint =

    2023

  54. [54]

    Findings of the Association for Computational Linguistics: ACL 2024 , year =

    Universal Vulnerabilities in Large Language Models: Backdoor Attacks for In-context Learning , author =. Findings of the Association for Computational Linguistics: ACL 2024 , year =

    2024

  55. [55]

    Proceedings of the 2025 Conference of the North American Chapter of the Association for Computational Linguistics (NAACL) , year =

    Data Poisoning for In-context Learning , author =. Proceedings of the 2025 Conference of the North American Chapter of the Association for Computational Linguistics (NAACL) , year =

    2025

  56. [56]

    Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics (NAACL) , year =

    Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection , author =. Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics (NAACL) , year =

    2024

  57. [57]

    2024 , eprint =

    Learning to Poison Large Language Models for Downstream Manipulation , author =. 2024 , eprint =

    2024

  58. [58]

    Findings of the Association for Computational Linguistics: ACL 2024 , year =

    InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents , author =. Findings of the Association for Computational Linguistics: ACL 2024 , year =

    2024

  59. [59]

    2025 , eprint =

    Navigating the Black Box: Leveraging LLMs for Effective Text-Level Graph Injection Attacks , author =. 2025 , eprint =

    2025

  60. [60]

    Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) , year =

    Cross-Context Backdoor Attacks against Graph Prompt Learning , author =. Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) , year =

  61. [61]

    2025 , eprint =

    A Systematic Study of Model Extraction Attacks on Graph Foundation Models , author =. 2025 , eprint =

    2025

  62. [62]

    Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) , year =

    Are You Using Reliable Graph Prompts? Trojan Prompt Attacks on Graph Neural Networks , author =. Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) , year =. 2410.13974 , archivePrefix =

    Pith/arXiv arXiv

  63. [63]

    Proceedings of the 35th International Joint Conference on Artificial Intelligence (IJCAI) , year =

    Cross-Paradigm Graph Backdoor Attacks with Promptable Subgraph Triggers , author =. Proceedings of the 35th International Joint Conference on Artificial Intelligence (IJCAI) , year =. 2510.22555 , archivePrefix =

    Pith/arXiv arXiv

  64. [64]

    Proceedings of the 34th International Joint Conference on Artificial Intelligence (IJCAI) , year =

    HeTa: Relation-wise Heterogeneous Graph Foundation Attack Model , author =. Proceedings of the 34th International Joint Conference on Artificial Intelligence (IJCAI) , year =. 2506.07428 , archivePrefix =

    Pith/arXiv arXiv

  65. [65]

    2024 , eprint=

    Learning on Graphs with Large Language Models (LLMs): A Deep Dive into Model Robustness , author=. 2024 , eprint=

    2024

  66. [66]

    Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) , pages=

    GPPT: Graph Pre-training and Prompt Tuning to Generalize Graph Neural Networks , author=. Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) , pages=. 2022 , doi=

    2022

  67. [67]

    Proceedings of the ACM Web Conference 2023 (WWW) , year=

    GraphPrompt: Unifying Pre-Training and Downstream Tasks for Graph Neural Networks , author=. Proceedings of the ACM Web Conference 2023 (WWW) , year=. 2302.08043 , archivePrefix=

    Pith/arXiv arXiv 2023

  68. [68]

    Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) , year=

    All in One: Multi-Task Prompting for Graph Neural Networks , author=. Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) , year=. 2307.01504 , archivePrefix=

    Pith/arXiv arXiv

  69. [69]

    Advances in Neural Information Processing Systems (NeurIPS), Datasets and Benchmarks Track , year=

    ProG: A Graph Prompt Learning Benchmark , author=. Advances in Neural Information Processing Systems (NeurIPS), Datasets and Benchmarks Track , year=

  70. [70]

    Proceedings of the AAAI Conference on Artificial Intelligence , author=

    Towards Effective, Stealthy, and Persistent Backdoor Attacks Targeting Graph Foundation Models , volume=. Proceedings of the AAAI Conference on Artificial Intelligence , author=. 2026 , month=. doi:10.1609/aaai.v40i29.39593 , abstractNote=

    work page doi:10.1609/aaai.v40i29.39593 2026

  71. [71]

    2026 , eprint=

    Robust Graph Fine-Tuning with Adversarial Graph Prompting , author=. 2026 , eprint=

    2026

  72. [72]

    Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) , year=

    All in One and One for All: A Simple yet Effective Method towards Cross-domain Graph Pretraining , author=. Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) , year=

  73. [73]

    Findings of the Association for Computational Linguistics: EMNLP 2024 , year=

    OpenGraph: Towards Open Graph Foundation Models , author=. Findings of the Association for Computational Linguistics: EMNLP 2024 , year=. 2403.01121 , archivePrefix=

    Pith/arXiv arXiv 2024

  74. [74]

    A ny G raph: Graph Foundation Model in the Wild

    Xia, Lianghao and Huang, Chao. A ny G raph: Graph Foundation Model in the Wild. Findings of the A ssociation for C omputational L inguistics: ACL 2026. 2026. doi:10.18653/v1/2026.findings-acl.44

    work page doi:10.18653/v1/2026.findings-acl.44 2026

  75. [75]

    2025 , eprint=

    Multi-Domain Graph Foundation Models: Robust Knowledge Transfer via Topology Alignment , author=. 2025 , eprint=

    2025

  76. [76]

    2025 , eprint=

    Towards Graph Foundation Models: A Transferability Perspective , author=. 2025 , eprint=

    2025

  77. [77]

    2024 , eprint =

    HGAttack: Transferable Heterogeneous Graph Adversarial Attack , author =. 2024 , eprint =

    2024

  78. [78]

    2025 , eprint =

    Robustness in Text-Attributed Graph Learning: Insights, Trade-offs, and New Defenses , author =. 2025 , eprint =

    2025

  79. [79]

    2025 , eprint =

    SA2GFM: Enhancing Robust Graph Foundation Models with Structure-Aware Semantic Augmentation , author =. 2025 , eprint =

    2025

  80. [80]

    Advances in Neural Information Processing Systems (NeurIPS) , year =

    GRAVER: Generative Graph Vocabularies for Robust Graph Foundation Models Fine-tuning , author =. Advances in Neural Information Processing Systems (NeurIPS) , year =. 2511.05592 , archivePrefix=

    arXiv

Showing first 80 references.