We bridge two research directions on graph neural networks (GNNs), by
formalizing the relation between heterophily of node labels (i.e., connected
nodes tend to have dissimilar labels) and the robustness of GNNs to adversarial
attacks. Our theoretical and empirical analyses show that for homophilous graph
data, impactful structural attacks always lead to reduced homophily, while for
heterophilous graph data the change in the homophily level depends on the node
degrees. These insights have practical implications for defending against
attacks on real-world graphs: we deduce that separate aggregators for ego- and
neighbor-embeddings, a design principle which has been identified to
significantly improve prediction for heterophilous graph data, can also offer
increased robustness to GNNs. Our comprehensive experiments show that GNNs
merely adopting this design achieve improved empirical and certifiable
robustness compared to the best-performing unvaccinated model. Additionally,
combining this design with explicit defense mechanisms against adversarial
attacks leads to an improved robustness with up to 18.33% performance increase
under attacks compared to the best-performing vaccinated model.

研究图神经网络中的异质性标签与 GNN 对抗性攻击鲁棒性之间的关系，并且证实采用相应设计原则可以提高 GNN 的鲁棒性，实验证明采用这种设计可以比未接种疫苗的模型实现更好的鲁棒性，并且采用防御机制可以使其鲁棒性更强，性能提高达 18.33%。