New Defense Method Achieves Both High Accuracy and Certified Robustness for Graph Neural Networks

Graph Neural Networks (GNNs) remain vulnerable to adversarial attacks, but a new framework called AuditVotes promises to deliver strong certified robustness without sacrificing model accuracy—a breakthrough in an area previously plagued by difficult trade-offs.

The Core Problem#

Randomized smoothing has long offered a theoretically sound way to certify that GNNs can withstand attacks. However, this defense mechanism comes at a steep cost: models achieve strong robustness guarantees only by accepting substantial drops in accuracy on clean, unattacked data. This accuracy-robustness trade-off has limited practical deployment of certified defenses in real-world applications.

How AuditVotes Works#

The framework introduces two complementary innovations into the randomized smoothing pipeline:

• Graph rewiring augmentation rebuilds noisy graphs by recovering structural quality, restoring information lost during the randomization process
• Conditional smoothing intelligently filters low-confidence predictions, allowing only high-conviction votes to contribute to the final decision, which improves consistency

A key theoretical contribution proves that certified robustness remains mathematically guaranteed even when arbitrary filtering functions are applied, validating this hybrid approach.

Significant Performance Gains#

Testing on the Cora-ML benchmark under strong 20-edge attacks demonstrates dramatic improvements. AuditVotes boosts clean accuracy by 437.1% and certified accuracy by 409.3% compared to vanilla randomized smoothing, while maintaining similar computational overhead. The method generalizes to unseen nodes and extends beyond GNNs to other smoothing techniques, including image-based Gaussian smoothing.

Broader Implications#

By achieving high accuracy and certified robustness simultaneously, AuditVotes removes a major barrier to deploying GNNs in security-sensitive domains such as financial networks, healthcare systems, and critical infrastructure.