Many works show that node-level predictions of Graph Neural Networks (GNNs) are unrobust to small, often termed adversarial, changes to the graph structure. However, because manual inspection of a graph is difficult, it is unclear if the studied perturbations always preserve a core assumption of adversarial examples: that of unchanged semantic content. To address this problem, we introduce a more principled notion of an adversarial graph, which is aware of semantic content change. Using Contextual Stochastic Block Models (CSBMs) and real-world graphs, our results uncover: $i)$ for a majority of nodes the prevalent perturbation models include a large fraction of perturbed graphs violating the unchanged semantics assumption; $ii)$ surprisingly, all assessed GNNs show over-robustness - that is robustness beyond the point of semantic change. We find this to be a complementary phenomenon to adversarial examples and show that including the label-structure of the training graph into the inference process of GNNs significantly reduces over-robustness, while having a positive effect on test accuracy and adversarial robustness. Theoretically, leveraging our new semantics-aware notion of robustness, we prove that there is no robustness-accuracy tradeoff for inductively classifying a newly added node.

翻译：许多研究表明，图神经网络（GNNs）的节点级预测对图结构的微小变化（通常称为对抗性变化）不具有鲁棒性。然而，由于手工检查图结构较为困难，目前尚不清楚所研究的扰动是否始终能保持对抗性样本的一个核心假设：即语义内容不变。为解决这一问题，我们引入了一种更具原则性的对抗性图概念，该概念能够感知语义内容的变化。利用上下文随机块模型（CSBMs）和真实世界图数据，我们的研究结果揭示了：$i)$ 对于大多数节点，常见的扰动模型中包含大量违反语义不变假设的扰动图；$ii)$ 令人惊讶的是，所有被评估的GNN都表现出过度鲁棒性——即超越了语义变化点的鲁棒性。我们发现这是一种与对抗性样本互补的现象，并表明将训练图的标签结构纳入GNN的推理过程能显著降低过度鲁棒性，同时对测试准确率和对抗鲁棒性产生积极影响。在理论上，利用我们基于语义感知的鲁棒性新概念，我们证明了在对新添加节点进行归纳分类时，不存在鲁棒性与准确率之间的权衡。