GADD: Game-Inspired Adversarial Distillation for Robust Graph Defense

Abstract

Graph neural networks (GNNs) are highly effective on relational data, yet their performance degrades sharply when graph topology is poisoned before training. Existing defenses usually assume a fixed attack pattern and a fixed graph structure, which makes them brittle when the poisoned graph changes across attacks, perturbation budgets, or deployment conditions. We propose GADD, a game-inspired adversarial distillation framework for robust graph defense. GADD first constructs multiple positive and negative graph views through a homophily-aware graph sampling scheme, allowing the model to learn from both purified and high-risk subgraphs. It then trains a heterogeneous group of student GNNs online, where each student receives global class-distribution knowledge from its peers and local structural knowledge through an adversarial cyclic distillation objective. Finally, GADD replaces uniform ensembling with an entropy-regularized adaptive aggregation rule that assigns graph-adaptive weights according to confidence and inter-model agreement. On Cora, CiteSeer, and PubMed, GADD consistently improves robustness against both Meta and Nettack attacks while preserving clean accuracy. Under the strongest Meta and Nettack settings in the main benchmark, GADD improves the best competing baseline by up to 2.99 and 3.42 percentage points, respectively. Additional ablations show that graph sampling, adversarial distillation, and adaptive aggregation all contribute materially to the final robustness gains.

1. Introduction

Graph neural networks (GNNs) have been widely applied to graph-structured data due to their strong capability to model relational dependencies and integrate node features with topological information, especially in node classification tasks [1,2]. However, recent studies have shown that their performance is sensitive to distribution shift, calibration, and uncertainty under changing graph structure [3,4,5,6]. Their reliance on topology also introduces a major security vulnerability: classic poisoning attacks demonstrate that small but carefully designed structural perturbations can significantly degrade predictive accuracy [7,8], while more recent studies have extended this concern to broader poisoning, certification, and robustness settings [9,10,11]. In poisoning attacks, the adversary manipulates the graph before training, requiring the defender to purify the corrupted structure, learn a robust model, or combine both strategies [8].

Most existing defenses are developed for a fixed poisoning setting and are typically trained or evaluated on a single poisoned graph [12,13,14]. This design is effective when the attack pattern remains fixed, but it becomes brittle when the defender faces a mixture of perturbation budgets, targeted versus global attacks, or previously unseen poisoned graphs. In practice, poisoned graphs may vary not only in attack type but also in structural severity and local perturbation patterns, making it difficult for a static defense to remain reliable across settings. Our starting point is therefore not to train one static defense on one static graph, but to train a defense that learns from multiple graph realizations, captures complementary structural evidence across them, and can adaptively reweight its components at test time according to the reliability of the current graph.

This paper develops the above intuition into GADD, a game-inspired adversarial distillation framework for robust graph defense. Unlike prior defenses that either purify a single graph, distill knowledge from a fixed teacher, or aggregate multiple models with static rules, GADD tightly couples three complementary mechanisms into one collaborative pipeline. First, we sample multiple graph views from several poisoned graphs. Positive views retain structurally plausible and feature-consistent edges, while negative views preserve suspicious edges that may encode adversarial perturbations. This design exposes the model to both purified and high-risk structural patterns. Second, instead of relying on an offline teacher, we train several lightweight GNNs online in a peer-distillation manner [15,16]. Each student learns global predictive knowledge from the remaining peers. In addition, we introduce an adversarial cyclic objective, which contrasts node representations from positive and negative graph views across students in a cyclic manner, encouraging the model to distinguish robust patterns from perturbations. Third, we avoid uniform averaging at inference time. We instead use an entropy-regularized aggregation rule, which assigns adaptive weights to students based on their prediction confidence and agreement with others, while an entropy term prevents the weights from collapsing to a single model.

Importantly, these three components are not isolated modules. The sampled graph views determine the structural discrepancies observed during distillation, while the adaptive aggregation mechanism continuously evaluates which students have successfully absorbed robust knowledge from those discrepancies. This coupling allows GADD to operate as a dynamic robustness-transfer framework rather than a conventional ensemble of independently trained defenses.

Experiments on Cora [17], CiteSeer [18], and PubMed [18] show that GADD consistently improves robustness under Meta and Nettack attacks. The advantage over the strongest baseline becomes especially clear under high attack strengths in several settings. Additional experiments on ogbn-arxiv under PGD-based topology attack and random edge perturbation further indicate that GADD remains scalable on large graphs. We also observe that the full model is materially better than removing graph sampling, adversarial distillation, or adaptive aggregation; heterogeneous students outperform homogeneous ones; and a single GCN discriminator is sufficient in practice.

Our main contributions are as follows:

• We propose GADD, a unified defense framework that combines graph sampling, online adversarial distillation, and entropy-regularized adaptive aggregation for robust graph defense.
• We formulate a positive/negative graph-view construction procedure and design an adversarial cyclic distillation loss to transfer both global class knowledge and local structural knowledge across students.
• We introduce an entropy-regularized weighting rule for ensemble aggregation that adapts to the current graph instead of using uniform averaging.

The remainder of the paper is organized as follows. Section 2 reviews graph attacks, defenses, and graph distillation. Section 3 presents GADD. Section 4 reports the empirical study. Section 5 concludes the paper.

2. Related Work

Recent studies related to robust GNNs can be broadly grouped into four directions: graph poisoning attacks, graph purification and robust learning, knowledge distillation on graphs, and calibration, uncertainty, and adaptive aggregation. These directions together motivate our design. Poisoning studies define the threat models to be handled, purification methods motivate the construction of cleaner graph views, graph distillation suggests knowledge transfer across models, and calibration- or uncertainty-aware aggregation highlights the need for graph-dependent reliability weighting.

Attacks on graph neural networks. Poisoning attacks manipulate the graph before model training and have become a standard evaluation setting for robust GNNs. Nettack is a representative targeted attack showing that only a small number of perturbations can already mislead node classification on attributed graphs [7]. Meta Attack further extends this idea to global training-time poisoning by optimizing graph perturbations through meta-gradients [8]. More recent work has expanded this line toward robustness analysis under node-feature attacks, certified robustness against adversarial perturbations, certification against label poisoning, and formal robustness verification for deep GNNs [9,19,20,21]. These studies indicate that graph poisoning is diverse in perturbation type and threat model, thereby motivating defenses that can generalize beyond a single fixed attack instance.

Graph purification and robust learning. Existing work relevant to defense mainly follows two lines. One line aims to purify or reconstruct topology before message passing. For example, Jaccard filtering removes suspicious edges according to feature similarity between connected nodes [22], while ProGNN jointly learns a cleaner graph structure and the downstream classifier to improve robustness under perturbations [23]. Another line improves robustness or reliability from the training or prediction side. Representative examples include adversarial defense via noise injection [13], calibration methods for confidence correction [3,4,24,25], and uncertainty-aware modeling [5,26]. Although these methods improve robustness or reliability under graph shift, they are still typically built around a single graph view, a single learner, or a fixed correction mechanism.

Knowledge distillation on graphs. Knowledge distillation on graphs has evolved from conventional model compression toward denoising, selective transfer, and multi-source supervision. Adaptive denoising distillation explicitly reduces noisy teacher knowledge and structural noise during transfer [15]. Partial-knowledge distillation further shows that transferring only part of the teacher information can be beneficial, rather than enforcing uniform transfer of all teacher signals [27]. More recent graph distillation methods also explore dual-source supervision, such as robust dual knowledge distillation from LLMs and dual-teacher distillation settings [16,28]. However, these methods are generally not developed for graph poisoning defense under multiple attacked graph realizations. By contrast, GADD performs online peer distillation across sampled positive and negative graph views and couples it with adversarial local matching.

Calibration, uncertainty, and adaptive aggregation. Another related line studies graph-aware reliability estimation through calibration, uncertainty modeling, and adaptive aggregation. SimCalib and Moderate Message Passing improve confidence calibration by exploiting graph-aware similarity or message-passing behavior [3,4]. Balanced confidence calibration and ensemble temperature scaling further show that graph-aware calibration can benefit from balancing confidence bias and leveraging multiple experts [24,25]. Uncertainty-oriented methods estimate epistemic uncertainty or stochastic uncertainty in GNNs, providing a more principled basis for reliable prediction under structural shift [5,26]. In addition, unbiased aggregation methods redesign the message aggregation operator itself to improve adversarial robustness [29]. Different from these studies, GADD integrates adaptive aggregation directly into the defense pipeline, so that student weights depend on reliability on the current poisoned graph and affect both inference and training.

Although prior studies motivate individual aspects of our design, existing methods typically optimize these components independently. Multi-view purification methods mainly focus on graph reconstruction, distillation methods usually transfer knowledge under fixed graph conditions, and ensemble defenses generally rely on static fusion strategies. In contrast, GADD explicitly couples graph-view generation, adversarial robustness transfer, and graph-adaptive weighting into a unified optimization process, enabling robustness knowledge learned from one perturbation pattern to dynamically influence representation learning and aggregation under other poisoned graphs.

3. Method

3.1. Overview and Problem Setup

Let $\mathcal{G}=(\mathcal{V},\mathcal{E},\mathbf{X})$ denote an attributed graph, and let $\mathbf{A}\in {\{0,1\}}^{N\times N}$ denote its adjacency matrix. A poisoning attacker perturbs the topology before training, producing one or more poisoned adjacency matrices ${\left\{{\mathbf{A}}^{\left(k\right)}\right\}}_{k=1}^K$. These poisoned graphs may correspond to different attack families or different perturbation budgets of the same attack. During training, the defender has access to these source poisoned graphs, but the perturbation pattern of a test graph is unknown. The goal is therefore to learn a model that remains accurate on both seen and unseen poisoned graphs.

To address the above problem, we propose GADD, a game-inspired adversarial distillation framework for robust graph defense under multiple poisoned graph realizations. As shown in Figure 1, GADD comprises three tightly coupled stages. It first generates positive and negative graph views from the available poisoned graphs via a homophily-aware sampling module, thereby separating structurally plausible edges from high-risk perturbation patterns. It then trains a heterogeneous group of lightweight student GNNs on these sampled views, where global predictive knowledge is exchanged through peer distillation and local structural representations are aligned through adversarial cyclic learning. Finally, GADD employs a game-inspired adaptive aggregation module to assign reliability-aware weights based on prediction confidence and inter-model agreement, and to fuse the outputs of all students into the final prediction.

3.2. Homophily-Aware Graph Sampling

Prior graph defenses have shown that feature consistency and structural priors can help suppress suspicious edges or recover a cleaner graph structure under adversarial perturbations [22,23]. Motivated by this intuition, we design a homophily-aware graph sampling module that constructs positive and negative graph views from multiple poisoned source graphs within a single training pipeline.

For a poisoned adjacency matrix ${\mathbf{A}}^{\left(k\right)}$, we first assign each edge a score that combines node-feature similarity with local degree consistency:

$$s(u,v)={\displaystyle \frac{{\mathbf{x}}_u^{\top }{\mathbf{x}}_v}{(\parallel {\mathbf{x}}_u{\parallel }_2+ϵ\left)\right(\parallel {\mathbf{x}}_v{\parallel }_2+ϵ)}}·\log \left(1+{\displaystyle \frac{\min (d_u,d_v)}{\max (d_u,d_v)+ϵ}}\right),$$

(1)

where $d_u$ and $d_v$ are the node degrees measured on the symmetrized poisoned graph, and $ϵ>0$ is a small constant for numerical stability. The intuition behind the scoring function is that adversarial edges in citation graphs often violate two properties simultaneously: semantic consistency and local structural compatibility. Clean edges usually connect nodes with similar feature semantics and comparable local connectivity patterns, whereas poisoned edges frequently connect semantically unrelated nodes or create abnormal degree interactions. Therefore, instead of relying on feature similarity alone, we combine semantic and structural consistency into a unified edge-reliability score. Large scores indicate edges that are more compatible with homophily and local structural consistency, whereas small scores indicate potentially suspicious edges. In practice, we compute $s(u,v)$ on the symmetrized adjacency and choose ${\tau }_{+}$ and ${\tau }_{-}$ as the upper and lower score quantiles of each poisoned graph, respectively. The thresholds ${\tau }_{+}$ and ${\tau }_{-}$ control the trade-off between purification strength and structural diversity. Larger ${\tau }_{+}$ values retain only highly reliable edges and therefore produce cleaner but sparser positive graphs, whereas smaller ${\tau }_{-}$ values preserve more suspicious edges and increase the difficulty of the negative views. If the thresholds are too aggressive, useful structural information may be discarded; if they are too loose, the distinction between positive and negative views becomes weaker. In practice, quantile-based thresholds provide stable behavior across datasets with different graph densities. After sampling, each view is symmetrized and normalized in the same way as the underlying student GNN.

For each poisoned adjacency matrix ${\mathbf{A}}^{\left(k\right)}$, we then sample two graph views:

$$\begin{array}{cc}\hfill {\mathbf{A}}^{+,\left(k\right)}(u,v)& ={\mathbf{A}}^{\left(k\right)}(u,v)\mathbf{1}[s(u,v)\ge {\tau }_{+}]b_{uv}^{+},\hfill \end{array}$$

(2)

$$\begin{array}{cc}\hfill {\mathbf{A}}^{-,\left(k\right)}(u,v)& ={\mathbf{A}}^{\left(k\right)}(u,v)\mathbf{1}[s(u,v)\le {\tau }_{-}]b_{uv}^{-},\hfill \end{array}$$

(3)

where $b_{uv}^{+}\sim \mathrm{Bernoulli}\left({\rho }_{+}\right)$ and $b_{uv}^{-}\sim \mathrm{Bernoulli}\left({\rho }_{-}\right)$ control stochastic sparsification. The positive view retains plausible edges and acts as a purified graph. The negative view emphasizes risky edges and behaves like a hard negative view that exposes perturbation patterns to the students. Sampling multiple views from multiple attacks gives the students access to a richer family of graph variations than training on a single cleaned graph. We use the same sampling hyperparameters across datasets unless otherwise noted, which keeps the defense simple and avoids attack-specific tuning inside the training loop.

3.3. Online Adversarial Distillation

We train m student GNNs ${\left\{f_i\right\}}_{i=1}^m$ online. Each student may instantiate a different GNN architecture; unless otherwise stated, we use one GCN [1], one GAT [30], and one GraphSAGE [31] student in our experiments. For a sampled positive graph, student i produces logits ${\mathbf{Z}}_i$ and penultimate hidden representations ${\mathbf{H}}_i^{+}$:

$$({\mathbf{H}}_i^{+},{\mathbf{Z}}_i)=f_i({\mathbf{A}}^{+,\left(k\right)},\mathbf{X}).$$

(4)

For a sampled negative graph, the same student outputs

$${\mathbf{H}}_i^{-}=F_i({\mathbf{A}}^{-,\left(k\right)},\mathbf{X}),$$

(5)

where $F_i$ denotes the penultimate representation extractor of $f_i$. We keep this notation explicit because the adversarial loss acts on penultimate representations, whereas the supervised and distillation losses act on the logits.

Global peer distillation. Each student uses the remaining $m-1$ students as a virtual teacher. Let

$${\tilde{\mathbf{P}}}^{\left(i\right)}=\mathrm{softmax}({\mathbf{Z}}_i/T),{\overline{\tilde{\mathbf{P}}}}_i={\displaystyle \frac{1}{m-1}}\sum _{j\ne i}softmax({\mathbf{Z}}_j/T),$$

(6)

where T is the distillation temperature. The distillation temperature T is a hyperparameter used to scale logits before applying softmax. Increasing T produces a softer probability distribution, which exposes richer inter-class information and facilitates more effective knowledge transfer during distillation. We distill global class-distribution knowledge with

$${\mathcal{L}}_{\mathrm{kd}}={\displaystyle \frac{T^2}{m}}{\displaystyle \sum _{i=1}^m}\mathrm{KL}\left({\overline{\tilde{\mathbf{P}}}}_i\parallel {\tilde{\mathbf{P}}}^{\left(i\right)}\right).$$

(7)

This term transfers complementary decision boundaries without requiring a pre-trained teacher.

Adversarial cyclic local distillation. Global logits alone do not capture the local structural differences between positive and negative graph views. Following the spirit of recent denoising and robust graph distillation methods [15,32,33,34], we further align local structural knowledge through a discriminator D. Student i on a negative view is contrasted with student $i+1$ on a positive view in a cyclic manner:

$$\begin{array}{cc}\hfill {\mathcal{L}}_{\mathrm{adv}}^D& =-{\displaystyle \frac{1}{m}}{\displaystyle \sum _{i=1}^m}\left[\log D\left({\mathbf{H}}_{i+1}^{+}\right)+\log \left(1-D\left({\mathbf{H}}_i^{-}\right)\right)\right],\hfill \end{array}$$

(8)

$$\begin{array}{cc}\hfill {\mathcal{L}}_{\mathrm{adv}}^G& =-{\displaystyle \frac{1}{m}}{\displaystyle \sum _{i=1}^m}\log D\left({\mathbf{H}}_i^{-}\right).\hfill \end{array}$$

(9)

For readability, index $i+1$ is taken modulo m. The discriminator learns to separate robust positive-view embeddings from high-risk negative-view embeddings, while the students learn embeddings that are harder to distinguish and therefore more robust.

Supervised objective. Each student also minimizes standard node-classification loss on the positive graph:

$${\mathcal{L}}_{\mathrm{ce}}={\displaystyle \frac{1}{m}}{\displaystyle \sum _{i=1}^m}\mathrm{CE}\left(softmax\left({\mathbf{Z}}_i\right),\mathbf{y}\right).$$

(10)

3.4. Game-Inspired Aggregation

Uniform averaging assumes that all students are equally reliable on every graph and every node. In dynamic or adversarial settings, this assumption is often violated: a student that performs well under one perturbation pattern may perform poorly under another. We therefore compute adaptive student weights from two statistics on the current graph: prediction confidence and agreement with peers.

Reliability scoring and adaptive objective. For aggregation and inference, we use the standard-temperature predictive probabilities

$${\mathbf{P}}^{\left(i\right)}=\mathrm{softmax}\left({\mathbf{Z}}_i\right),$$

(11)

which we keep separate from the temperature-scaled distillation probabilities ${\tilde{\mathbf{P}}}^{\left(i\right)}$ to avoid ambiguity between training-time knowledge distillation (KD), which transfers softened class distributions, and test-time prediction.

For node v, we measure student confidence and disagreement by

$$q_i\left(v\right)=\underset{c}{\max }{\mathbf{P}}_{vc}^{\left(i\right)},d_i\left(v\right)={\displaystyle \frac{1}{m-1}}\sum _{j\ne i}{∥{\mathbf{P}}_v^{\left(i\right)}-{\mathbf{P}}_v^{\left(j\right)}∥}_2^2.$$

(12)

We summarize student i by

$$a_i={\displaystyle \frac{1}{\left|\mathcal{V}\right|}}\sum _{v\in \mathcal{V}}\left(d_i\left(v\right)-\lambda q_i\left(v\right)\right),$$

(13)

where $\lambda >0$ balances agreement and confidence. Students with smaller $a_i$ are more reliable, as they are both confident and compatible with the group. We then solve the simplex-constrained optimization. A direct winner-takes-all strategy would make the aggregation unstable because a single overconfident student could dominate the ensemble under noisy perturbations. To avoid this behavior, we introduce entropy regularization so that the aggregation remains adaptive while still preserving diversity among students:

$$\underset{\mathbf{w}\in {\mathsf{\Delta }}_m}{\min }{\displaystyle \sum _{i=1}^m}{w}_i{a}_i+\mu {\displaystyle \sum _{i=1}^m}{w}_i\log w_i,$$

(14)

where ${\mathsf{\Delta }}_m=\{\mathbf{w}\in {\mathbb{R}}^m\mid {\sum }_i{w}_i=1,w_i\ge 0\}$ and $\mu >0$ controls dispersion. The entropy term keeps the game from collapsing to a single student too early.

Closed-form solution and interpretation. For completeness, the closed-form solution of Equation (14) can be derived directly. Define the Lagrangian

$$\mathcal{J}(\mathbf{w},\eta )={\displaystyle \sum _{i=1}^m}{w}_i{a}_i+\mu {\displaystyle \sum _{i=1}^m}{w}_i\log w_i+\eta \left({\displaystyle \sum _{i=1}^m}{w}_i-1\right).$$

(15)

Setting the derivative with respect to $w_i$ to zero yields

$$a_i+\mu (log{w}_i+1)+\eta =0,$$

(16)

which implies

$$w_i\propto \exp (-a_i/\mu ).$$

(17)

Normalizing over all students gives the softmax-form solution

$$w_i={\displaystyle \frac{\exp (-a_i/\mu )}{{\sum }_{j=1}^m\exp (-a_j/\mu )}}.$$

(18)

The temperature-like parameter $\mu$ controls the sharpness of the aggregation weights. Small $\mu$ values produce near winner-takes-all behavior, while larger $\mu$ values lead to smoother and more uniform weighting across students. This derivation is deliberately simple: the purpose of the aggregation rule is not to solve a full strategic game with equilibrium constraints, but to obtain a stable adaptive weighting rule that rewards confidence and consensus while remaining numerically well behaved.

The objective in Equation (14) can be interpreted as a regularized mixed-strategy selection problem. Each student is assigned a reliability score $a_i$, the weight vector $\mathbf{w}$ is a mixed strategy over students, the linear term prefers low-risk students, and the entropy term prevents premature collapse to a single student. This is the sense in which our aggregation is game-inspired: we use a regularized best response over a reliability landscape rather than uniform voting.

Proposition 1.

For any $\mu >0$, the optimization problem in Equation (14) is strictly convex over ${\mathsf{\Delta }}_m$ and therefore admits a unique minimizer given by Equation (18). Moreover, if $a_i<a_j$, then the optimal weights satisfy $w_i>w_j$.

Proof. 

The linear term is convex, and the negative entropy regularizer is strictly convex on the simplex interior; therefore, their sum is strictly convex over ${\mathsf{\Delta }}_m$, which guarantees uniqueness of the minimizer. The monotonicity statement follows directly from Equation (18): since the exponential function is strictly decreasing in $a_i$ after negation, $a_i<a_j$ implies $w_i>w_j$.    □

This proposition is intended as an optimization sanity check for the aggregation rule rather than as a robustness theorem for the whole defense.

Weighted prediction and training. The final prediction is

$$\mathbf{P}={\displaystyle \sum _{i=1}^m}{w}_i{\mathbf{P}}^{\left(i\right)}.$$

(19)

During training, we use the same weights to reweight the supervised losses,

$${\mathcal{L}}_{\mathrm{gt}}={\displaystyle \sum _{i=1}^m}{w}_i\mathrm{CE}\left(\mathrm{softmax}\left({\mathbf{Z}}_i\right),\mathbf{y}\right),$$

(20)

which emphasizes the students that currently contribute the most to robust consensus. We keep both ${\mathcal{L}}_{\mathrm{ce}}$ and ${\mathcal{L}}_{\mathrm{gt}}$: ${\mathcal{L}}_{\mathrm{ce}}$ gives each student an unconditional supervised signal, while ${\mathcal{L}}_{\mathrm{gt}}$ biases optimization toward students that are currently reliable on the sampled poisoned graph. In ablations, removing the adaptive term consistently hurts robustness, which indicates that the weighted loss does more than simply rescale ${\mathcal{L}}_{\mathrm{ce}}$.

3.5. Overall Objective and Training

The full training objective is

$$\mathcal{L}={\mathcal{L}}_{\mathrm{ce}}+\alpha {\mathcal{L}}_{\mathrm{kd}}+\beta {\mathcal{L}}_{\mathrm{adv}}^G+\gamma {\mathcal{L}}_{\mathrm{gt}},$$

(21)

where $\alpha$, $\beta$, and $\gamma$ are scalar hyperparameters. We optimize students and discriminator alternately: fix the students and update D, then fix D and update the student group. Graph views are resampled online, so students repeatedly observe new positive and negative subgraphs even when the set of poisoned source graphs stays fixed. The overall training procedure is summarized in Algorithm 1.

Algorithm 1 Training GADD.

1: Input poisoned graphs ${\left\{{\mathbf{A}}^{\left(k\right)}\right\}}_{k=1}^K$, node features $\mathbf{X}$, labels $\mathbf{y}$   2: Initialize student GNNs ${\left\{f_i\right\}}_{i=1}^m$ and discriminator D   3: for each training epoch do   4:     Sample ${\mathbf{A}}^{+,\left(k\right)}$ and ${\mathbf{A}}^{-,\left(k\right)}$ from each poisoned graph   5:     Compute positive-view logits ${\left\{{\mathbf{Z}}_i\right\}}_{i=1}^m$ and embeddings ${\left\{{\mathbf{H}}_i^{+}\right\}}_{i=1}^m$   6:     Compute negative-view embeddings ${\left\{{\mathbf{H}}_i^{-}\right\}}_{i=1}^m$   7:     Estimate weights ${\left\{w_i\right\}}_{i=1}^m$ with Equations (13), (14) and (18)   8:     Update discriminator D by minimizing ${\mathcal{L}}_{\mathrm{adv}}^D$   9:     Update all students by minimizing ${\mathcal{L}}_{\mathrm{ce}}+\alpha {\mathcal{L}}_{\mathrm{kd}}+\beta {\mathcal{L}}_{\mathrm{adv}}^G+\gamma {\mathcal{L}}_{\mathrm{gt}}$ 10: end for 11: Return ${\left\{f_i\right\}}_{i=1}^m$ and the aggregation rule in Equations (18) and (19)

3.6. Complexity Discussion

Let N be the number of nodes, E the number of edges, D the feature dimension, m the number of GNN models, and ${\mathcal{O}}_{\mathrm{GNN}}$ the cost of a one-layer GNN. The complexity of GADD has two parts: homophily-aware graph sampling and adversarial distillation. The sampling stage costs $\mathcal{O}\left(ED\right)$, or $\mathcal{O}\left(N^2\right)+\mathcal{O}\left(ED\right)$ in the worst case with dense similarity computation. The distillation stage costs approximately $4T{\mathcal{O}}_{\mathrm{GNN}}$, where T is the number of training rounds. Since we use standard one-layer GCN/GAT/GraphSAGE models, this term remains moderate in practice.

Compared with existing defenses, GADD is slightly more expensive than SimP-GCN, whose complexity is $\mathcal{O}\left(N^2\right)+6{\mathcal{O}}_{\mathrm{GNN}}$, and Jaccard, whose complexity is $\mathcal{O}\left(ED\right)+2{\mathcal{O}}_{\mathrm{GNN}}$, but it is substantially cheaper than ProGNN, whose dominant term is $\mathcal{O}\left(N^3\right)+2{\mathcal{O}}_{\mathrm{GNN}}$ [22,23,35,36]. This advantage is especially clear on large graphs such as PubMed.

For a single attack, the overall complexity of GADD can be written as $\mathcal{O}\left(N^2\right)+\mathcal{O}\left(ED\right)+16{\mathcal{O}}_{\mathrm{GNN}}$, which is higher than the cost of SimP-GCN, $\mathcal{O}\left(N^2\right)+6{\mathcal{O}}_{\mathrm{GNN}}$. However, for multiple attacks, GADD becomes more favorable because it reuses one joint training process instead of retraining a separate defense for each poisoned graph. For example, for ten attacks, its complexity is $10\mathcal{O}\left(N^2\right)+10\mathcal{O}\left(ED\right)+40{\mathcal{O}}_{\mathrm{GNN}}$, whereas SimP-GCN scales as $10\mathcal{O}\left(N^2\right)+60{\mathcal{O}}_{\mathrm{GNN}}$. Since the benchmark graphs are sparse, the additional $\mathcal{O}\left(ED\right)$ term is usually moderate. Therefore, although GADD is somewhat more expensive in the single-attack case, it offers a better complexity–robustness trade-off when multiple attack types or poisoned graphs must be handled jointly.

4. Experiments

4.1. Experimental Setup

Datasets. We evaluate GADD on three citation-network benchmarks: Cora [17], CiteSeer [18], and PubMed [18]. Following the standard benchmark protocol, the dataset statistics are reported in

Table 1. Dataset statistics used in our experiments.

Dataset	Nodes	Edges	Classes	Features
Cora	2485	5069	7	1433
CiteSeer	2110	3668	6	3703
PubMed	19,717	31,396	3	500

. Nodes represent documents, edges represent citation links, and node attributes are bag-of-words features.

Attacks and evaluation protocol. We consider two representative poisoning attacks, namely Meta Attack [8] and Nettack [7]. Meta Attack uses perturbation ratios in $\{0,0.05,0.10,0.15,0.20,0.25\}$, while Nettack uses perturbation budgets in $\{0,1,2,3,4,5\}$. These settings cover both global and targeted poisoning scenarios. For Nettack, we follow the standard targeted-attack evaluation protocol adopted in prior graph-attack and graph-defense studies [7,22,23,37]. Specifically, the attack is applied to selected target nodes, and we report post-attack node-classification accuracy averaged over the attacked targets and repeated runs. Mean ± standard deviation values therefore summarize both attack-target variation and run-to-run training variation.

Additional large-scale graph evaluation. We further report an additional large-scale graph evaluation on ogbn-arxiv [38] in Section 4.9, where GADD is tested under a PGD-based topology attack [39] and random edge perturbation. This experiment complements the main Meta/Nettack evaluation by assessing scalability under large-scale structural perturbations and is therefore reported separately from

Table 2. Full defense performance against Meta (mean ± standard deviation accuracy in %). Best results are in bold, and second-best results are underlined. OOM indicates that ProGNN exceeds GPU memory due to its high computational cost.

Dataset	Ptb.	GCN	Jaccard	ProGNN	SimP-GCN	GARNET	RCNLip	NoisyGNN	GADD
Cora	0.00	83.83 ± 0.71	78.86 ± 0.57	83.82 ± 0.31	81.83 ± 0.68	81.83 ± 0.35	83.61 ± 0.71	78.73 ± 1.03	83.89 ± 0.77
	0.05	78.93 ± 0.51	78.20 ± 0.49	79.44 ± 0.59	78.01 ± 1.06	79.45 ± 0.74	78.95 ± 0.38	77.77 ± 1.13	79.77 ± 0.78
	0.10	72.88 ± 0.96	77.49 ± 0.91	69.56 ± 1.80	74.38 ± 2.86	79.48 ± 0.61	72.80 ± 0.52	76.24 ± 1.08	79.49 ± 0.69
	0.15	67.99 ± 0.90	77.07 ± 0.91	64.19 ± 1.85	72.32 ± 3.51	78.59 ± 0.98	68.49 ± 0.62	76.15 ± 0.88	79.10 ± 0.67
	0.20	58.11 ± 0.66	75.87 ± 1.10	54.58 ± 2.75	70.09 ± 4.62	76.29 ± 0.92	58.22 ± 0.55	76.28 ± 0.67	78.76 ± 0.41
	0.25	52.98 ± 1.31	75.18 ± 0.46	49.30 ± 2.72	67.62 ± 6.13	74.47 ± 1.28	52.76 ± 0.53	73.63 ± 0.90	78.17 ± 0.69
CiteSeer	0.00	73.21 ± 0.37	71.42 ± 0.34	72.71 ± 0.57	73.58 ± 0.90	72.58 ± 0.47	72.87 ± 0.24	72.31 ± 0.32	75.28 ± 0.65
	0.05	71.40 ± 1.63	71.39 ± 0.77	71.16 ± 1.25	72.95 ± 0.85	71.51 ± 0.33	72.07 ± 0.28	71.74 ± 0.38	74.22 ± 0.28
	0.10	69.40 ± 1.01	71.45 ± 0.94	67.90 ± 0.69	72.81 ± 1.19	72.52 ± 0.76	68.97 ± 0.31	72.32 ± 0.25	73.39 ± 0.68
	0.15	65.59 ± 0.96	69.73 ± 1.39	64.88 ± 1.30	72.39 ± 1.68	72.16 ± 0.39	65.47 ± 0.36	70.60 ± 1.51	73.43 ± 0.46
	0.20	57.23 ± 1.22	69.98 ± 0.86	55.30 ± 1.31	71.28 ± 1.57	63.58 ± 0.76	56.23 ± 0.62	71.26 ± 0.52	72.94 ± 0.97
	0.25	57.16 ± 1.49	69.34 ± 0.75	55.70 ± 1.50	72.75 ± 0.62	66.07 ± 0.75	58.33 ± 0.58	69.90 ± 1.15	73.62 ± 0.30
PubMed	0.00	86.26 ± 0.09	85.74 ± 0.05	OOM	86.50 ± 0.08	84.83 ± 0.21	85.78 ± 0.15	84.67 ± 0.07	86.60 ± 0.19
	0.05	81.32 ± 0.16	85.53 ± 0.05	OOM	86.22 ± 0.11	82.83 ± 0.16	81.07 ± 0.14	84.47 ± 0.13	86.29 ± 0.17
	0.10	78.16 ± 0.10	85.33 ± 0.03	OOM	85.65 ± 0.23	82.72 ± 0.31	77.74 ± 0.27	84.13 ± 0.08	86.11 ± 0.26
	0.15	74.31 ± 0.18	84.81 ± 0.03	OOM	85.24 ± 0.22	82.95 ± 0.20	73.91 ± 0.17	83.63 ± 0.16	86.07 ± 0.26
	0.20	71.11 ± 0.31	84.73 ± 0.05	OOM	84.74 ± 0.20	82.89 ± 0.14	71.17 ± 0.16	83.52 ± 0.09	86.03 ± 0.24
	0.25	68.43 ± 0.19	84.55 ± 0.04	OOM	84.62 ± 0.40	82.87 ± 0.18	67.71 ± 0.13	83.19 ± 0.16	85.57 ± 0.19

and

Table 3. Full defense performance against Nettack (mean ± standard deviation accuracy in %). Best results are in bold, and second-best results are underlined. OOM indicates that ProGNN exceeds GPU memory due to its high computational cost.

Dataset	Ptb.	GCN	Jaccard	ProGNN	SimP-GCN	GARNET	RCNLip	NoisyGNN	GADD
Cora	0.0	80.96 ± 2.59	75.18 ± 1.81	84.15 ± 1.57	80.60 ± 3.33	84.10 ± 0.91	81.20 ± 1.81	73.86 ± 1.28	86.39 ± 2.54
	1.0	75.42 ± 1.72	73.01 ± 2.29	81.69 ± 1.57	77.23 ± 2.44	81.29 ± 1.43	77.11 ± 1.70	72.77 ± 1.16	81.81 ± 1.65
	2.0	68.80 ± 2.23	70.96 ± 2.23	74.70 ± 1.90	73.01 ± 3.42	80.72 ± 1.20	71.69 ± 1.73	70.24 ± 1.40	81.69 ± 2.03
	3.0	66.75 ± 2.42	72.89 ± 2.14	70.12 ± 1.32	69.16 ± 4.14	79.04 ± 1.72	66.39 ± 1.75	72.29 ± 0.80	81.33 ± 1.42
	4.0	58.19 ± 2.61	67.23 ± 1.11	64.34 ± 1.83	65.42 ± 4.10	75.54 ± 1.87	61.93 ± 1.98	67.11 ± 1.14	80.12 ± 2.14
	5.0	52.53 ± 3.22	67.71 ± 1.48	60.72 ± 2.64	58.31 ± 4.59	76.27 ± 1.21	55.90 ± 1.02	65.78 ± 2.79	79.69 ± 2.11
CiteSeer	0.0	80.48 ± 2.12	79.84 ± 1.99	80.63 ± 0.71	79.52 ± 2.04	83.02 ± 0.73	80.79 ± 0.50	84.13 ± 1.06	85.24 ± 1.07
	1.0	77.62 ± 2.04	79.37 ± 0.75	78.41 ± 0.87	79.05 ± 1.46	81.75 ± 1.63	79.21 ± 0.50	82.22 ± 1.25	84.92 ± 0.84
	2.0	72.54 ± 4.85	77.78 ± 2.59	74.92 ± 2.61	77.14 ± 1.34	81.27 ± 0.95	77.62 ± 2.04	83.33 ± 0.84	84.44 ± 0.67
	3.0	66.98 ± 2.09	77.62 ± 3.03	55.56 ± 2.97	75.08 ± 3.51	80.48 ± 0.73	61.27 ± 1.86	83.97 ± 1.17	84.10 ± 1.01
	4.0	57.78 ± 3.90	75.24 ± 4.44	61.59 ± 6.19	70.32 ± 4.49	81.59 ± 1.62	57.62 ± 1.31	83.02 ± 1.07	84.08 ± 0.82
	5.0	51.43 ± 2.01	77.94 ± 3.21	48.57 ± 0.87	65.24 ± 5.42	80.01 ± 1.27	50.02 ± 2.62	83.17 ± 1.11	83.92 ± 0.84
PubMed	0.0	87.90 ± 0.58	87.80 ± 0.44	OOM	89.25 ± 0.25	88.12 ± 0.45	87.42 ± 0.58	86.24 ± 0.28	89.89 ± 0.71
	1.0	84.78 ± 0.26	87.04 ± 0.17	OOM	84.73 ± 0.96	87.96 ± 0.55	83.66 ± 0.58	85.32 ± 0.51	89.09 ± 0.62
	2.0	81.61 ± 0.42	87.47 ± 0.51	OOM	80.54 ± 1.01	87.58 ± 0.51	80.81 ± 0.36	85.22 ± 0.63	88.92 ± 0.52
	3.0	74.95 ± 0.96	86.61 ± 0.17	OOM	74.73 ± 1.10	87.80 ± 0.59	78.01 ± 0.64	85.00 ± 0.82	88.25 ± 0.25
	4.0	68.23 ± 1.23	85.59 ± 0.94	OOM	66.67 ± 1.04	85.43 ± 0.85	74.84 ± 0.42	83.98 ± 0.83	87.66 ± 0.31
	5.0	62.85 ± 0.64	86.56 ± 0.01	OOM	67.63 ± 0.83	85.32 ± 0.64	69.14 ± 0.58	83.44 ± 0.79	87.21 ± 0.36

.

Baselines. We compare with GCN [1], Jaccard [22], ProGNN [23], SimP-GCN [36], GARNET [40], RCNLip [37], and NoisyGNN [13]. These baselines cover vanilla GNN training, graph purification, robust graph structure learning, similarity-preserving defense, spectral topology recovery, Lipschitz-regularized robust training, and noise-injection-based defense. All baselines use the hyperparameters recommended by their original papers or by the original evaluation protocols from which the compared results were reproduced.

GADD configuration. Unless otherwise specified, GADD uses three student GNNs, namely GCN, GAT, and GraphSAGE, and a one-layer GCN discriminator. The optimizer settings are learning rate $5\times {10}^{-3}$, weight decay $5\times {10}^{-4}$, dropout 0.5, hidden dimension 64, and at most 150 training epochs.

Protocol and reporting. All reported results are means over repeated runs, and the full tables with standard deviations are reported in Table 2 and Table 3. We use the standard public poisoned-graph settings for Meta and Nettack [7,8] together with the canonical node-classification splits commonly used in prior work [41]. Because the present paper focuses on graph-modification poisoning, we do not make claims about backdoor or mixed-attack robustness beyond the evidence shown here.

4.2. Main Results on Adversarial Graph Poisoning

Meta attack. GADD performs consistently well under Meta across all three datasets. The full numerical comparison in Table 2 and the trend visualization in Figure 2 make this especially clear: as the perturbation ratio increases, GADD generally degrades more slowly than both the undefended GCN and the strongest competing baseline. On Cora, the advantage becomes pronounced under stronger perturbations: although the gain is marginal at low perturbation, GADD exceeds the best baseline by 2.47 points at 20% perturbation and by 2.99 points at 25% perturbation. CiteSeer shows stable gains across all attack budgets, ranging from 0.58 to 1.70 points over the strongest baseline. PubMed shows a clear robustness trend: the gain is 0.10 on the clean graph and remains 0.95 at Meta-0.25, with the largest margin of 1.29 achieved at Meta-0.20. These results indicate that graph sampling and dynamic aggregation are most useful when the poisoned graph departs strongly from the clean topology.

Nettack. The same pattern holds for Nettack. The full results in Table 3 and the trends in Figure 3 show that GADD preserves higher attacked-node accuracy as the targeted perturbation budget grows, with especially clear separation on Cora and PubMed. Quantitatively, GADD improves over the strongest baseline by 0.12–4.58 points on Cora, 0.13–2.70 points on CiteSeer, and 0.45–2.07 points on PubMed. The improvement is especially large on Cora and PubMed under high targeted perturbation budgets, suggesting that the adversarial cyclic distillation objective helps students specialize on different local failure modes instead of collapsing to the same vulnerable representation.

Clean performance. An important property of a defense is that it should not sacrifice too much accuracy in the absence of attacks. GADD preserves clean performance well. Under the clean setting, it is competitive with or slightly better than the strongest baselines on all three datasets, as shown by the clean rows in Table 2 and Table 3. This shows that the gains under attack are not obtained by over-regularizing the classifier.

4.3. Ablation Study

Figure 4 shows that all components contribute to robustness, although their effects are different. Removing adversarial distillation leads to the largest performance drop, indicating that graph sampling alone cannot effectively transfer robustness across different poisoned graphs. The cyclic adversarial objective helps suppress perturbation-specific patterns and encourages the students to learn more transferable representations. Removing graph sampling also noticeably degrades performance. By separating reliable and suspicious edges, the sampling strategy exposes the students to both stable structures and hard perturbation cases, which improves structural robustness and reduces overfitting to a single attacked graph. Replacing adaptive aggregation with uniform averaging further decreases accuracy, especially under stronger attacks. This suggests that disagreement among students increases with perturbation strength, making dynamic weighting necessary to suppress unreliable predictions. Overall, the three modules work collaboratively rather than independently.

4.4. Effect of the Number and Type of Students

The student-number and student-type study in

Table 4. Student-number and student-type analysis (node classification accuracy in %).

Setting	Attack	Accuracy
1 model	Nettack-5.0 (PubMed)	69.52
2 models	Nettack-5.0 (PubMed)	75.38
3 models	Nettack-5.0 (PubMed)	87.21
5 models	Nettack-5.0 (PubMed)	87.96
10 models	Nettack-5.0 (PubMed)	88.22
3 GCNs	Meta-0.25 (PubMed)	84.02
3 GATs	Meta-0.25 (PubMed)	84.56
3 GraphSAGE	Meta-0.25 (PubMed)	85.07
3 mixed students	Meta-0.25 (PubMed)	85.57

further clarifies the design of GADD. First, increasing the number of students substantially improves robustness from one to three models, after which the additional gains become relatively limited compared with the increased model complexity. For example, under Nettack-5.0 on PubMed, the accuracy increases from 69.52% with one model to 87.21% with three models, and further increases to 88.22% with ten models. Second, heterogeneous students outperform homogeneous groups. Under Meta-0.25 on PubMed, three mixed students (GCN + GAT + GraphSAGE) achieve 85.57%, compared with 84.02% for three GCNs, 84.56% for three GATs, and 85.07% for three GraphSAGE models. These observations support the default choice of three heterogeneous students as a favorable trade-off between robustness and complexity.

4.5. Effect of the Discriminator

The discriminator study in

Table 5. Discriminator study on CiteSeer (node classification accuracy in %).

Discriminator	Meta-0.25	Nettack-5.0	Runtime (s)
MLP	73.58	83.27	9.68
GCN	73.62	83.92	10.17
GAT	73.61	82.54	12.15
GraphSAGE	73.59	82.49	11.74
1 MLP	73.58	83.27	9.68
3 MLPs	73.60	83.89	10.17
1 GCN	73.62	83.92	10.15
3 GCNs	73.63	83.92	10.31

shows that a single discriminator is already sufficient when it is well matched to the students. Among different discriminator architectures, GCN achieves the best overall robustness on both Meta-0.25 and Nettack-5.0, with accuracies of 73.62 and 83.92, respectively, while maintaining competitive runtime. Although MLP is slightly faster, its robustness is weaker, whereas GAT and GraphSAGE incur higher runtime without improving performance. Increasing the number of discriminators from one to three yields only marginal gains. For example, using three GCN discriminators improves the Meta-0.25 accuracy only from 73.62 to 73.63, while leaving the Nettack-5.0 accuracy unchanged at 83.92 and slightly increasing runtime. This result aligns with the intended role of the discriminator in GADD: it should be strong enough to expose discrepancies between positive and negative embeddings, but not so strong or redundant that it increases cost without bringing meaningful robustness gains.

4.6. Multi-Attack Training and Inductive Generalization

We also compare two training setups on PubMed in

Table 6. Joint multi-attack training versus per-attack training on PubMed.

Category	Metric	Per-Attack Training	Joint Multi-Attack Training
Accuracy (%)	Meta-0.15	86.01	86.07
	Meta-0.25	85.64	85.57
	Nettack-1.0	89.12	89.09
	Nettack-2.0	88.89	88.92
	Nettack-4.0	87.64	87.66
Runtime (s)	Data processing	$22.39\times 5$	88.42
	Model execution	$19.96\times 5$	20.11
	Total runtime	211.76	108.53

: training one model per attack versus training once on five attacks jointly. The final accuracies are nearly identical, with a maximum absolute difference of only 0.07 across all reported attack settings, while the total runtime decreases from 211.76 s to 108.53 s when training jointly. This supports one of the central motivations for GADD: if the defender expects multiple attack types, it is more efficient to amortize the training cost across them instead of retraining a fresh defense each time.

Finally, the inductive study in

Table 7. Inductive generalization to unseen attacked graphs on PubMed (node classification accuracy in %).

Graph	Transductive	Inductive
Clean	86.60	86.47
Meta-0.10	86.11	86.16
Meta-0.20	86.03	85.23
Nettack-3.0	88.25	87.44
Nettack-5.0	87.21	86.52

evaluates a model trained under the multi-attack setup on previously unseen graphs. Overall, the performance remains close to the non-inductive setting: for example, accuracy changes from 86.60 to 86.47 on the clean PubMed graph and from 88.25 to 87.44 under Nettack-3.0, while it even increases slightly from 86.11 to 86.16 under Meta-0.10. Although larger degradations appear on some stronger attacked graphs, the model remains robust within this citation-benchmark setting. We therefore interpret the result as evidence of transfer across unseen poisoned graphs, rather than as a blanket claim of universal attack generalization.

4.7. Hyperparameter Sensitivity Analysis

To examine the sensitivity of GADD to the trade-off parameters in Equation (21), we evaluate three representative configurations: Setup 1: a balanced setting with $\alpha =\beta =\gamma =0.33$; Setup 2: a distillation-dominant setting with $\alpha =0.4,\beta =0.4,\gamma =0.2$; Setup 3: a knowledge-transfer-focused setting with $\alpha =0.5,\beta =0.3,\gamma =0.2$. The evaluation is conducted under three representative dataset–attack scenarios, namely Cora under the clean setting, CiteSeer under Meta-0.2, and PubMed under Nettack-3.0.

The results in

Table 8. Hyperparameter sensitivity analysis under different dataset–attack settings.

Setup	Cora/Clean	CiteSeer/Meta-0.2	PubMed/Nettack-3.0
Setup 1	$83.65$	$69.03$	$85.31$
Setup 2	$82.28$	$72.94$	$87.60$
Setup 3	$81.75$	$70.12$	$88.34$

show that the preferred hyperparameter configuration varies across the different dataset–attack scenarios. The balanced setting performs best on Cora, suggesting that a uniform contribution of supervision, distillation, and adaptive guidance is sufficient for relatively stable graphs. In contrast, CiteSeer and PubMed benefit from larger $\alpha$, indicating that strengthening global knowledge distillation helps mitigate noisy structural signals. Interestingly, increasing $\beta$ does not consistently improve performance, which implies that excessive adversarial alignment may introduce instability. Overall, the results suggest that $\alpha$ plays a more critical role in challenging settings, while $\gamma$ should remain moderate to avoid overemphasizing adaptive weighting early in training.

4.8. Empirical Interpretability of Adaptive Aggregation

To empirically interpret the adaptive aggregation mechanism, we analyze the learned graph-level aggregation weights on Cora under Meta attack with perturbation ratio 0.25, which is one of the strongest settings in our main experiments. This analysis complements the closed-form derivation of the aggregation rule by directly examining how the learned weights are distributed among different student branches in practice. Since the aggregation weights are computed according to prediction confidence and inter-model agreement, their distributions can directly reflect how GADD evaluates the reliability of different student branches under a poisoned graph.

As shown in Figure 5, the adaptive aggregation mechanism produces a clear and stable preference ordering among the three student branches across 10 independent runs. GraphSAGE receives the highest average test-time graph-level weight (0.3933), followed by GCN (0.3517), while GAT receives the lowest average weight (0.2551). The learned weights also exhibit limited variation across runs; for example, the standard deviation of the GraphSAGE weight is only 0.0030. These results indicate that the proposed aggregation rule does not perform uniform or random fusion, but consistently assigns larger weights to student branches estimated to be more reliable under the current poisoned-graph condition. Therefore, the learned weight distribution provides empirical evidence that the closed-form aggregation rule behaves as a reliability-sensitive selector, improving the interpretability and trustworthiness of the ensemble prediction.

4.9. Additional Large-Scale Graph Evaluation

To further examine the scalability of GADD, we conduct additional experiments on the ogbn-arxiv dataset under two types of structural perturbations: a PGD-based topology attack and random edge perturbation. The ogbn-arxiv dataset contains 169,343 nodes, 1,166,243 edges, 128-dimensional node features, and 40 classes. The perturbation ratios are set to 30% and 50%, indicating the proportion of perturbed edges in the graph. For the attacked settings, all methods are trained on the corresponding perturbed graphs and evaluated by node classification accuracy.

The results in

Table 9. Defense performance on ogbn-arxiv in terms of node classification accuracy (%). Bold values indicate the best performance in each column.

Method	Clean	PGD Attack		Random Perturbation
		30%	50%	30%	50%
GCN	$\mathbf{65}.\mathbf{10}\pm \mathbf{1}.\mathbf{85}$	$41.12\pm 0.09$	$35.95\pm 0.33$	$39.19\pm 1.68$	$34.25\pm 1.36$
Jaccard	$63.31\pm 1.35$	$46.28\pm 2.71$	$38.00\pm 0.49$	$43.32\pm 1.45$	$33.15\pm 2.08$
ProGNN	OOM	OOM	OOM	OOM	OOM
SimP-GCN	$64.98\pm 1.50$	$49.88\pm 2.72$	$46.69\pm 2.33$	$52.62\pm 1.23$	$50.93\pm 2.61$
GARNET	$61.91\pm 1.18$	$49.81\pm 2.13$	$46.07\pm 1.75$	$55.08\pm 1.28$	$53.18\pm 1.21$
RCNLip	$64.75\pm 0.66$	$47.53\pm 1.47$	$39.12\pm 1.78$	$55.48\pm 1.95$	$47.59\pm 2.83$
NoisyGNN	$61.89\pm 0.89$	$36.94\pm 2.12$	$32.01\pm 0.92$	$44.62\pm 0.58$	$38.29\pm 0.15$
GADD	$64.85\pm 0.12$	$\mathbf{52}.\mathbf{62}\pm \mathbf{0}.\mathbf{56}$	$\mathbf{50}.\mathbf{33}\pm \mathbf{0}.\mathbf{60}$	$\mathbf{57}.\mathbf{44}\pm \mathbf{0}.\mathbf{49}$	$\mathbf{53}.\mathbf{80}\pm \mathbf{0}.\mathbf{19}$

reveal that most baselines struggle to maintain performance as the graph becomes increasingly corrupted. In particular, NoisyGNN and GCN exhibit sharp declines, suggesting limited robustness in large-scale settings. SimP-GCN and GARNET perform better, but their gains diminish under stronger attacks. GADD, however, shows a much slower degradation rate. Even at 50% perturbation, it preserves competitive accuracy under both PGD and random attacks. This indicates that the model effectively captures stable structural patterns while mitigating the impact of noisy edges. The consistent advantage across both attack types highlights its robustness and adaptability.

To further assess practical efficiency, we report the GPU memory usage on ogbn-arxiv under the 50% random structural perturbations in

Table 10. GPU memory usage on ogbn-arxiv.

Method	GPU Memory (MB)
GCN	$1772.11$
Jaccard	$2818.86$
ProGNN	OOM
SimP-GCN	$3737.45$
GARNET	$2828.28$
RCNLip	$2654.64$
NoisyGNN	$2452.70$
GADD	$2805.32$

. Although GADD employs multiple collaborative students and adversarial distillation, its memory consumption remains comparable to most robust GNN baselines. Specifically, GADD requires 2805.32 MB of GPU memory, which is close to Jaccard and GARNET and lower than SimP-GCN. In contrast, ProGNN encounters out-of-memory (OOM) issues on ogbn-arxiv due to its costly graph structure optimization process. Together with the accuracy results in Table 9, these results indicate that GADD provides a favorable robustness–efficiency trade-off on large-scale perturbed graphs.

4.10. Discussion

The empirical evidence supports three conclusions within the evaluated scope. First, positive/negative graph sampling is an effective way to expose the model to multiple perturbation patterns without requiring repeated end-to-end retraining. Second, online adversarial distillation is the strongest robustness component in the ablation study: it accounts for the largest performance drop when removed and is especially helpful under strong targeted attacks. Third, adaptive aggregation matters whenever students disagree, which is exactly the setting expected in multi-attack defense. The main limitation lies in the evaluation scope: the current paper studies graph-modification poisoning on citation benchmarks, so broader robustness claims should be interpreted accordingly.

5. Conclusions

This paper presents GADD, a teacher-free defense framework that combines graph sampling, online adversarial distillation, and entropy-regularized adaptive aggregation for robust graph defense. The method is motivated directly by the limitations of static defenses: they usually train on one graph, assume one attack pattern, and aggregate multiple models uniformly. GADD replaces these assumptions with multi-view sampled graphs, online peer distillation, and adaptive weighting.

Across the Meta and Nettack benchmarks, GADD consistently improves robustness while maintaining clean accuracy. Additional experiments on ogbn-arxiv under PGD-based topology attack and random edge perturbation further suggest that GADD maintains a favorable robustness–efficiency trade-off on large-scale graphs. Ablation studies show that graph sampling, adversarial distillation, and adaptive aggregation all contribute substantially to the final robustness, and the parameter studies suggest that three heterogeneous students and a single GCN discriminator provide a strong accuracy-efficiency trade-off.

The main limitation of the current study is its scope. Although we include an additional large-scale evaluation on ogbn-arxiv, the main experiments are still centered on graph-modification poisoning in citation-style benchmarks, which provides empirical validation of the core design but is not sufficient to claim robustness across all graph domains or attack families. A natural next step is to extend the evaluation to more structurally diverse benchmarks, heterophilous graphs, dynamic graphs, and other poisoning settings such as backdoor attacks.