# Unifying Adversarial Perturbation for Graph Neural Networks

## TL;DR

This paper introduces PerturbEmbedding, a unified adversarial perturbation framework for GNNs that enhances robustness and generalization by applying perturbations directly to hidden embeddings, outperforming existing methods across datasets.

## Contribution

The paper proposes a novel, unified perturbation method, PerturbEmbedding, that applies adversarial and random perturbations directly to GNN embeddings, improving robustness and generalization.

## Key findings

- PerturbEmbedding significantly outperforms existing methods.
- It enhances robustness against both random and adversarial attacks.
- The method improves GNN performance across various datasets.

## Abstract

This paper studies the vulnerability of Graph Neural Networks (GNNs) to adversarial attacks on node features and graph structure. Various methods have implemented adversarial training to augment graph data, aiming to bolster the robustness and generalization of GNNs. These methods typically involve applying perturbations to the node feature, weights, or graph structure and subsequently minimizing the loss by learning more robust graph model parameters under the adversarial perturbations. Despite the effectiveness of adversarial training in enhancing GNNs' robustness and generalization abilities, its application has been largely confined to specific datasets and GNN types. In this paper, we propose a novel method, PerturbEmbedding, that integrates adversarial perturbation and training, enhancing GNNs' resilience to such attacks and improving their generalization ability. PerturbEmbedding performs perturbation operations directly on every hidden embedding of GNNs and provides a unified framework for most existing perturbation strategies/methods. We also offer a unified perspective on the forms of perturbations, namely random and adversarial perturbations. Through experiments on various datasets using different backbone models, we demonstrate that PerturbEmbedding significantly improves both the robustness and generalization abilities of GNNs, outperforming existing methods. The rejection of both random (non-targeted) and adversarial (targeted) perturbations further enhances the backbone model's performance.