KCES: Training-Free Defense for Robust Graph Neural Networks via Kernel Complexity

TL;DR

KCES introduces a training-free, model-agnostic method for defending GNNs against adversarial attacks by pruning edges with high kernel complexity scores, improving robustness without retraining.

Contribution

The paper proposes Kernel Complexity-Based Edge Sanitization (KCES), a novel, training-free defense framework utilizing graph kernel complexity to identify and remove adversarial edges.

Findings

KCES improves GNN robustness against attacks.

KCES outperforms existing defense methods.

KCES enhances other defenses when combined.

Abstract

Graph Neural Networks (GNNs) have achieved impressive success across a wide range of graph-based tasks, yet they remain highly vulnerable to small, imperceptible perturbations and adversarial attacks. Although numerous defense methods have been proposed to address these vulnerabilities, many rely on heuristic metrics, overfit to specific attack patterns, and suffer from high computational complexity. In this paper, we propose Kernel Complexity-Based Edge Sanitization (KCES), a training-free, model-agnostic defense framework. KCES leverages Graph Kernel Complexity (GKC), a novel metric derived from the graph's Gram matrix that characterizes GNN generalization via its test error bound. Building on GKC, we define a KC score for each edge, measuring the change in GKC when the edge is removed. Edges with high KC scores, typically introduced by adversarial perturbations, are pruned to mitigate their harmful effects, thereby enhancing GNNs' robustness. KCES can also be seamlessly integrated with existing defense strategies as a plug-and-play module without requiring training. Theoretical analysis and extensive experiments demonstrate that KCES consistently enhances GNN robustness, outperforms state-of-the-art baselines, and amplifies the effectiveness of existing defenses, offering a principled and efficient solution for securing GNNs.