The Confidence Trap: Calibration Attacks for Graph Neural Networks

• URL: http://arxiv.org/abs/2606.08467v1
• Date: Sun, 07 Jun 2026 06:16:58 GMT
• Title: The Confidence Trap: Calibration Attacks for Graph Neural Networks
• Abstract summary: We present a framework for studying calibration attacks on graphs.<n>We show that models with higher accuracy or trained on datasets with more classes are more susceptible under this threat model.<n>Our code is publicly available at https://github.com/CaptainCuong/Graph-Calibration-Attack.git.
• Score: 30.116997325760945
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: While confidence calibration is essential for trustworthy decision-making in safety-critical applications, the robustness of calibrated GNNs to adversarial structural perturbations remains largely unexplored. However, studying calibration attacks on graphs presents unique technical challenges: (1) the discrete nature of graph structures complicates gradient-based optimization, (2) existing underconfidence objectives fail to drive predictions toward uniform distributions, and (3) GNNs are highly sensitive to edge perturbations, often causing unintended label changes that violate attack constraints. To address these challenges, we propose a \textbf{Unified Graph Calibration Attack (UGCA)} framework designed for \textbf{worst-case (white-box) analysis} of GNN calibration robustness. UGCA introduces a KL-divergence loss to encourage uniform predictive distributions, a reranking mechanism to reduce label flipping, a hybrid loss to recover labels when violations occur, and beam search to explore a broader adversarial search space. We further provide theoretical insights linking model generalization, dataset complexity, and calibration vulnerability, showing that models with higher accuracy or trained on datasets with more classes are more susceptible under this threat model. Extensive experiments demonstrate that UGCA substantially increases Expected Calibration Error while preserving classification accuracy. Our code is publicly available at https://github.com/CaptainCuong/Graph-Calibration-Attack.git.

Related papers

• Defending against Model Extraction for GNNs with Model Reprogramming [57.82196268649236]
  Graph Neural Networks (GNNs) serve as the backbone for high-stakes applications in Machine-Learning-as-a-Service (ML)<n>Still, their black-box deployment exposes them to Model Extraction (ME) attacks.<n>Existing defenses suffer from a critical ''Euclidean bias''<n>We propose GraphRP, a proactive defense framework that repurposes Model Reprogramming for security.
  arXiv  Detail & Related papers  (2026-08-11T23:20:15Z)
• When does distribution shift break graph neural networks calibration? [0.0]
  Graph neural networks (GNNs) are increasingly deployed in real-world applications where distribution shift is un-avoidable.<n>I present the first closed-form theoretical characterization of GNN calibration under distribution shift.<n>I propose STAC, a source-free, label-free calibration method.
  arXiv  Detail & Related papers  (2026-07-12T15:23:38Z)
• Beyond Homophily: Towards Generalized Graph Reconstruction Attack and Defense [80.28330585803133]
  Graph neural networks (GNNs) are widely deployed on computation data, yet they can leak sensitive or proprietary information about the training graph adjacency.<n>This work studies graph reconstruction attacks (GRA), a form of model inversion that reconstructs the training adjacency from a trained GNN.<n>We propose MC-GRA (+), which reconstructs the adjacency by optimizing a surrogate adjacency whose GNN-induced representations align with those of the target model.<n>On the defense side, we propose MC-GPB (+), which suppresses adjacency-dependent information throughout the representation chain
  arXiv  Detail & Related papers  (2026-06-06T09:29:27Z)
• FedCIGAR: A Personalized Reconstruction Approach for Federated Graph-level Anomaly Detection [51.473064583839296]
  We propose a novel Federated graph-level anomaly detection approach with Cluster-adaptIve GAted Reconstruction (FedCIGAR)<n>Specifically, we design a reconstruction-based paradigm trained on normal graphs to avoid synthetic data. Furthermore, we introduce a client-side node contribution gating mechanism and a server-side sliding window-based clustering strategy to tackle data heterogeneity.
  arXiv  Detail & Related papers  (2026-05-10T09:03:54Z)
• Margin and Consistency Supervision for Calibrated and Robust Vision Models [1.0152838128195467]
  Margin and Consistency Supervision (MaCS) is a simple, architecture-agnostic regularization framework.<n>MaCS jointly enforces logit-space separation and local prediction stability.<n>We show that increasing classification margin while reducing local sensitivity formalized via a Lipschitz-type stability proxy yields improved generalization guarantees.
  arXiv  Detail & Related papers  (2026-03-06T01:54:28Z)
• Generalizing GNNs with Tokenized Mixture of Experts [75.8310720413187]
  We show that improving stability requires reducing reliance on shift-sensitive features, leaving an irreducible worst-case generalization floor.<n>We propose STEM-GNN, a pretrain-then-finetune framework with a mixture-of-experts encoder for diverse computation paths.<n>Across nine node, link, and graph benchmarks, STEM-GNN achieves a stronger three-way balance, improving robustness to degree/homophily shifts and to feature/edge corruptions while remaining competitive on clean graphs.
  arXiv  Detail & Related papers  (2026-02-09T22:48:30Z)
• The Final Layer Holds the Key: A Unified and Efficient GNN Calibration Framework [31.107286245419044]
  Graph Neural Networks (GNNs) have demonstrated remarkable effectiveness on graph-based tasks.<n>However, their predictive confidence is often miscalibrated, typically exhibiting under-confidence.<n>We propose a simple yet efficient graph calibration method to address this issue.
  arXiv  Detail & Related papers  (2025-05-16T15:02:17Z)
• CRC-SGAD: Conformal Risk Control for Supervised Graph Anomaly Detection [2.290229842388034]
  We propose a framework integrating statistical risk control into Graph Anomaly Detection (GAD)<n>A Dual-Threshold Conformal Risk Control mechanism provides theoretically guaranteed bounds for both False Negative Rate (FNR) and False Positive Rate (FPR)<n>Experiments on four datasets and five GAD models demonstrate statistically significant improvements in FNR and FPR control and prediction set size.
  arXiv  Detail & Related papers  (2025-04-03T03:27:49Z)
• Exact Certification of (Graph) Neural Networks Against Label Poisoning [50.87615167799367]
  We introduce an exact certification method for label flipping in Graph Neural Networks (GNNs)<n>We apply our method to certify a broad range of GNN architectures in node classification tasks.<n>Our work presents the first exact certificate to a poisoning attack ever derived for neural networks.
  arXiv  Detail & Related papers  (2024-11-30T17:05:12Z)
• Typicalness-Aware Learning for Failure Detection [26.23185979968123]
  Deep neural networks (DNNs) often suffer from the overconfidence issue, where incorrect predictions are made with high confidence scores. We propose a novel approach called Typicalness-Aware Learning (TAL) to address this issue and improve failure detection performance.
  arXiv  Detail & Related papers  (2024-11-04T11:09:47Z)
• Provable Robustness of (Graph) Neural Networks Against Data Poisoning and Backdoor Attacks [50.87615167799367]
  We certify Graph Neural Networks (GNNs) against poisoning attacks, including backdoors, targeting the node features of a given graph.<n>Our framework provides fundamental insights into the role of graph structure and its connectivity on the worst-case behavior of convolution-based and PageRank-based GNNs.
  arXiv  Detail & Related papers  (2024-07-15T16:12:51Z)
• Data-Agnostic Model Poisoning against Federated Learning: A Graph Autoencoder Approach [65.2993866461477]
  This paper proposes a data-agnostic, model poisoning attack on Federated Learning (FL) The attack requires no knowledge of FL training data and achieves both effectiveness and undetectability. Experiments show that the FL accuracy drops gradually under the proposed attack and existing defense mechanisms fail to detect it.
  arXiv  Detail & Related papers  (2023-11-30T12:19:10Z)
• CAP: Co-Adversarial Perturbation on Weights and Features for Improving Generalization of Graph Neural Networks [59.692017490560275]
  Adversarial training has been widely demonstrated to improve model's robustness against adversarial attacks. It remains unclear how the adversarial training could improve the generalization abilities of GNNs in the graph analytics problem. We construct the co-adversarial perturbation (CAP) optimization problem in terms of weights and features, and design the alternating adversarial perturbation algorithm to flatten the weight and feature loss landscapes alternately.
  arXiv  Detail & Related papers  (2021-10-28T02:28:13Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.