How does Heterophily Impact the Robustness of Graph Neural Networks? Theoretical Connections and Practical Implications

TL;DR

This paper explores how heterophily affects GNN robustness to adversarial attacks, revealing that specific architectural designs and defense mechanisms can significantly enhance GNN resilience in real-world scenarios.

Contribution

It establishes a theoretical link between heterophily and robustness, and demonstrates that separating ego- and neighbor-embeddings improves GNN defense against attacks.

Findings

Separate aggregators improve robustness in heterophilous graphs

Designing GNNs with this principle increases empirical and certifiable robustness

Combining this design with defenses boosts attack resistance by up to 18.33%

Abstract

We bridge two research directions on graph neural networks (GNNs), by formalizing the relation between heterophily of node labels (i.e., connected nodes tend to have dissimilar labels) and the robustness of GNNs to adversarial attacks. Our theoretical and empirical analyses show that for homophilous graph data, impactful structural attacks always lead to reduced homophily, while for heterophilous graph data the change in the homophily level depends on the node degrees. These insights have practical implications for defending against attacks on real-world graphs: we deduce that separate aggregators for ego- and neighbor-embeddings, a design principle which has been identified to significantly improve prediction for heterophilous graph data, can also offer increased robustness to GNNs. Our comprehensive experiments show that GNNs merely adopting this design achieve improved empirical and certifiable robustness compared to the best-performing unvaccinated model. Additionally, combining this design with explicit defense mechanisms against adversarial attacks leads to an improved robustness with up to 18.33% performance increase under attacks compared to the best-performing vaccinated model.