Abstract: Graph neural networks (GNNs) have been widely applied to various complex tasks due to their capability of effectively processing non-Euclidean data. However, the strong dependence of GNNs on graph structures during data modeling makes them highly sensitive to structural variations. Even slight structural manipulations can lead to severe deviations in model predictions, thereby significantly reducing model stability and reliability. Existing adversarial defense methods mainly focus on two directions. The first direction processes and corrects perturbed graph data before model training in order to restore the statistical characteristics of the graph structure as much as possible. The second direction enhances and improves the information aggregation mechanism during the training of GNNs to strengthen the robustness of learned representations. However, these methods emphasize superficial structural repair or enhancement of the aggregation process, while overlooking the fundamental mechanism by which adversarial attacks impair GNN performance. In essence, adversarial attacks disrupt the original distribution of node representations, weaken inter-class separability, and increase intra-class confusion, which consequently limits the generalization ability of defense methods across different attack scenarios. To address this limitation, this work systematically analyzes the underlying reasons why adversarial attacks damage node representations. Based on the fundamental mechanism that adversarial perturbations destroy the discriminative structure of the representation space, we propose a dual-view decision boundary purification method, termed DV-DBP. This method explicitly models and repairs the discriminative structure in the node representation space, thereby achieving systematic suppression and mitigation of the impact of adversarial perturbations. Specifically, DV-DBP performs collaborative purification of perturbations from two complementary perspectives, namely inter-node and node-edge relationships. On the one hand, it characterizes the disordered state of node representations to identify and alleviate neighborhood confusion caused by anomalous nodes. On the other hand, it constrains abnormal edges and explicitly models potential low-quality connections between nodes, thereby mitigating the adverse effects of perturbations and spurious associations during representation propagation. On this basis, an inter-node relationships graph and a high-confidence graph are further constructed to establish a consistency-driven collaborative modeling mechanism across the structural and representation levels, enabling the model to simultaneously perceive node representation quality and structural reliability during aggregation. Through joint optimization of the dual perspectives, the method purifies the impact of perturbations while effectively improving inter-class decision boundary separability and intra-class compactness, thereby significantly enhancing robustness and generalization under various attack scenarios. Experimental results on multiple real-world graph datasets demonstrate that DV-DBP achieves superior defense performance under two representative adversarial attack scenarios, with performance improvements of up to 3.88% and 2.41% compared with state-of-the-art methods. In generalization experiments, DV-DBP maintains stable advantages under stronger adversarial attack settings, with performance gains of up to 2.33% and 3.38%, which verifies its robustness in complex attack environments. In addition, ablation studies show that the construction of the inter-node relationships graph provides effective perturbation correction capabilities, while the high-confidence graph helps to finely identify and correct potential abnormal connections. The synergy of these two components enables the proposed dual-view modeling strategy to form a systematic defense mechanism against various attack types. Furthermore, experiments on low-quality graph data containing structural noise show that DV-DBP can still effectively correct node representations, demonstrating strong robustness and good generalization ability under scenarios with large-scale perturbations and noise. In summary, this work conducts a systematic analysis of graph adversarial defense from the perspective of representation space, and verifies the necessity and effectiveness of explicitly modeling and optimizing representation space structure through a dual-view decision purification mechanism.

摘要： 图神经网络由于其能高效处理非欧式数据，被广泛应用至多种复杂任务的数据处理之中。然而由于图神经网络在数据建模过程中对图结构高度依赖的特性，导致其在模型训练的过程中对结构变化高度敏感，即使细微的结构操纵即可导致模型的决策结果严重偏移，从而显著降低模型的稳定性与可靠性。现有对抗防御方法主要集中于两个方向，其一是在模型训练之前对受扰动的图数据进行处理与修正，以尽可能恢复图结构的统计特征。其二是在图神经网络的训练过程中对信息聚合机制进行强化与改进，以增强模型表示的鲁棒性。然而，上述方法侧重于结构层面的表层修复或模型聚合过程增强，忽略了对抗攻击干扰图神经网络性能的根本机制，即对抗攻击本质上通过破坏节点表示空间的原有分布，削弱类间可分性并加剧类内混淆度，从而导致模型在跨攻击场景下的防御泛化能力受限。针对此局限性，首次系统性分析了对抗攻击对节点表示破坏的原因，并围绕对抗扰动破坏表示空间判别结构的本质原因出发，提出双视角决策净化方法DV-DBP（Dual-View Decision Boundary Purification）。该方法通过显式建模与修复节点表示空间中的判别结构，实现对对抗扰动影响的系统性抑制与缓解。具体而言，DV-DBP从点间关系与点边关系两个互补视角对扰动进行协同净化。一方面，通过刻画节点自身的表征混乱状态，识别并缓解异常节点所引发的邻域混淆问题。另一方面，通过显式建模节点间潜在的低质量连接关系对异常边施加约束，从而抑制扰动及低质量关联在表示传播过程中的同化效应。在此基础上，进一步构建点间关系图与高置信图，为结构层与表示层构建一致性的协同建模机制，使模型在聚合过程中能够同时感知节点表示质量与结构可靠性。通过双视角的联合优化，模型在净化扰动影响的同时，有效提升类间决策边界的可分性与类内结构的紧密性，从而显著增强其在多种攻击场景下的鲁棒性与泛化能力。在多个真实图数据集上的实验结果表明，DV-DBP在两类代表性的对抗攻击场景下均取得了优越的防御性能。与当前领域内最强防御性能的方法相比，其性能最高分别提升3.88%和2.41%。在泛化性实验中，DV-DBP在更强对抗攻击设置下仍保持稳定优势，性能最高分别提升2.33%和3.38%，验证了DV-DBP在复杂攻击环境中的稳健性。此外，消融实验结果表明，点间关系图的构建为DV-DBP提供了有效的抗扰动修复能力，而高置信图的构建则有助于精细化识别并修正潜在的异常连接关系。两者的协同作用使得所提出的双视角建模策略能够形成针对多种攻击形式的系统性防御机制。进一步地，在包含结构噪声的低质量图数据上实验结果表明，DV-DBP仍能够有效校正节点表示，展现出在大规模扰动与噪声叠加场景下的强鲁棒性与良好泛化能力。综上所述，本文从表示空间层面对图对抗防御问题进行了系统分析，并通过双视角决策净化机制验证了在对抗防御过程中显式建模与优化表示空间结构的必要性与有效性。