We perform the first adversarial robustness study into Graph Neural Networks (GNNs) that are provably more powerful than traditional Message Passing Neural Networks (MPNNs). In particular, we use adversarial robustness as a tool to uncover a significant gap between their theoretically possible and empirically achieved expressive power. To do so, we focus on the ability of GNNs to count specific subgraph patterns, which is an established measure of expressivity, and extend the concept of adversarial robustness to this task. Based on this, we develop efficient adversarial attacks for subgraph counting and show that more powerful GNNs fail to generalize even to small perturbations to the graph's structure. Expanding on this, we show that such architectures also fail to count substructures on out-of-distribution graphs.

翻译：我们首次对已被证明比传统消息传递神经网络（MPNNs）具有更强表达能力的图神经网络（GNNs）进行了对抗鲁棒性研究。具体而言，我们利用对抗鲁棒性作为工具，揭示了其理论可实现表达能力与实证达成能力之间的显著差距。为此，我们聚焦于GNNs计数特定子图模式的能力——这是衡量表达能力的既定指标，并将对抗鲁棒性概念扩展至该任务。基于此，我们开发了针对子图计数的高效对抗攻击方法，并证明即使是更强大的GNNs也无法泛化到图结构的微小扰动。进一步地，我们揭示此类架构在分布外图上也无法正确计数子结构。