Recent studies have shown that attackers can catastrophically reduce the
performance of GNNs by maliciously modifying the graph structure or node
features on the graph. Adversarial training, which has been shown to be one of
the most effective defense mechanisms against adversarial attacks in computer
vision, holds great promise for enhancing the robustness of GNNs. There is
limited research on defending against attacks by performing adversarial
training on graphs, and it is crucial to delve deeper into this approach to
optimize its effectiveness. Therefore, based on robust adversarial training on
graphs, we propose a hierarchical constraint refinement framework (HC-Ref) that
enhances the anti-perturbation capabilities of GNNs and downstream classifiers
separately, ultimately leading to improved robustness. We propose corresponding
adversarial regularization terms that are conducive to adaptively narrowing the
domain gap between the normal part and the perturbation part according to the
characteristics of different layers, promoting the smoothness of the predicted
distribution of both parts. Moreover, existing research on graph robust
adversarial training primarily concentrates on training from the standpoint of
node feature perturbations and seldom takes into account alterations in the
graph structure. This limitation makes it challenging to prevent attacks based
on topological changes in the graph. This paper generates adversarial examples
by utilizing graph structure perturbations, offering an effective approach to
defend against attack methods that are based on topological changes. Extensive
experiments on two real-world graph benchmarks show that HC-Ref successfully
resists various attacks and has better node classification performance compared
to several baseline methods.

近期的研究表明，通过恶意修改图结构或节点特征，攻击者可以严重降低 GNN 的性能。对抗性训练被证明是计算机视觉中最有效的对抗攻击防御机制之一，对于增强 GNN 的稳健性具有巨大潜力。本文提出了一种基于鲁棒对抗训练的分层约束优化框架（HC-Ref），分别增强 GNN 和下游分类器的抗扰动能力，从而提高了稳健性。我们提出了相应的对抗正则化项，有助于根据不同层的特征，自适应缩小正常部分和扰动部分之间的领域差距，促进预测分布的平滑性。此外，现有的图鲁棒对抗训练研究主要集中在从节点特征扰动的角度进行训练，很少考虑图结构的变化。本文通过利用图结构扰动生成对抗样本，为防御基于拓扑变化的攻击方法提供了有效途径。在两个实际图数据集上的大量实验表明，HC-Ref 成功抵御了各种攻击，并相比几种基线方法具有更好的节点分类性能。