arXiv CSopen access

On the Safety of Graph Representation Learning

2026 · arxiv_cs

arXiv CS · Papers · License: Open Access · 2026

machine learning, deep learning, neural networks

Xiaoguang Guo1 , Zehong Wang2 , Ziming Li1 , Shawn Spitzel1 , Soonwoo Kwon1 , Tianyi Ma2 , Yanfang Ye2 , Chuxu Zhang1∗ {xiaoguang.guo,ziming.li,shawn.spitzel,soonwoo.kwon,chuxu.zhang}@uconn.edu {zwang43,tma2,yye7}@nd.edu

arXiv:2605.06576v1 [cs.LG] 7 May 2026

University of Connecticut, 2 University of Notre Dame

Abstract Graph representation learning (GRL) has evolved from topology-only graph embeddings to task-specific supervised GNNs, and more recently to reusable representations and graph foundation models (GFMs). However, existing evaluations mainly measure clean transfer, adaptation, and task coverage. It remains unclear whether GRL methods stay reliable when deployment stresses affect graph signals, graph contexts, label support, structural groups, or predictive evidence. We introduce GRL-Safety, a multi-axis safety evaluation benchmark for GRL. GRL-Safety evaluates twelve representative methods, spanning topology-only embedding methods, supervised GNNs, self-supervised graph models, and GFMs, on twenty-five graph datasets under standardized evaluation conditions while preserving method-native adaptation. The evaluation covers five safety axes: corruption robustness, OOD generalization, class imbalance, fairness, and interpretation, with per-axis and subcondition reporting rather than a single aggregate score. Our analysis yields three cross-axis insights that can inspire future research. First, safety behavior is shaped by the interaction between representation design and the stressed graph factor, rather than by method family alone. Second, foundation-era methods show axisspecific strengths rather than broad safety dominance. Third, several deployment regimes remain difficult even for the best evaluated method, revealing capability gaps that require new robustness, adaptation, or training objectives beyond model selection. The benchmark, evaluation protocols, and code are available at: https://github.com/GXG-CS/GRL-Safety.

Introduction

Foundation models (FMs) [4] have shifted machine learning in natural language processing [8] and computer vision [37] from task-specific training toward transferable representations that can be adapted across tasks and domains. Graph learning [59], which underlies applications including molecular design [41], recommendation systems [62], and financial networks [11], is undergoing a parallel shift. In particular, graph representation learning (GRL) has progressed from topology-only graph embeddings [14, 35] and task-specific supervised graph neural networks (GNNs) [17, 24, 48] toward transferable graph representations, including self-supervised pretrained models [19, 46] and graph foundation models (GFMs) [54], that can generalize across graphs, domains, and task formats. As these representations are deployed in diverse downstream settings, deployment conditions expose safety risks that clean-setting performance does not capture [7]. These risks can enter through graph-specific channels, including corrupted attributes or edges [70], distribution shifts across graph contexts [15], skewed label support [33], structural or demographic group disparity [9], and unreliable predictive evidence [1]. In financial graphs, for example, corrupted links or rare fraud labels can affect risk prediction in ways that clean aggregate performance may hide [11]; in scientific or molecular ∗ Corresponding author.

Preprint.

graphs, unreliable attribution evidence can undermine the trustworthiness of model outputs [2]. It remains an open question how modern GRL methods behave across these representative safetyrelevant axes under comparable conditions. Existing evaluation efforts only partially answer this question. GRL and GFM benchmarks have made substantial progress in measuring clean-setting performance, transfer, adaptation, and task coverage across datasets, tasks, and domains [6, 20, 61, 64]. In parallel, trustworthy GRL evaluation has developed axis-specific benchmarks and protocols for many of these concerns [1, 9, 15, 33, 70]. However, these two lines remain disconnected: GRL benchmarks typically do not evaluate safetyrelevant axes, while safety evaluation efforts are often organized one axis at a time, under narrower method families or different protocols. What remains missing is a unified, multi-axis safety evaluation of the modern GRL spectrum under comparable conditions. Building such an evaluation requires handling several sources of heterogeneity. First, safety-relevant axes stress different parts of the GRL pipeline, so their results should be reported by axis and subcondition rather than collapsed into a single score [30, 50]. Second, GRL methods expose different input requirements and adaptation interfaces: topology-only embeddings consume only graph structure, supervised GNNs consume features and topology, self-supervised models add pretraining objectives, and GFMs introduce broader adaptation mechanisms. A comparable benchmark must therefore standardize the evaluation substrate while preserving each method’s native design [6, 61, 64]. Finally, because safety risks can manifest differently across graph domains and task formats, the benchmark must cover diverse datasets rather than a single graph family [13, 15, 20]. Guided by these requirements, we introduce GRL-Safety, a multi-axis safety benchmark for GRL. GRL-Safety evaluates twelve representative GRL methods on twenty-five graph datasets spanning diverse domains and task formats. Under standardized evaluation conditions, feature-consuming methods use shared text-attribute embeddings, topology-only embedding methods use shared graph structure on compatible task formats, and methods with a pretraining stage share a common source corpus while preserving their original pretraining objectives and native downstream adaptation pipelines. Overall, our contributions of this work are: • Benchmark scope. GRL-Safety positions safety evaluation at the level of GRL, covering topology-only graph embeddings, supervised GNNs, self-supervised GRL methods, and GFMs across diverse graph tasks and domains. • Multi-axis safety protocol and evaluation. GRL-Safety evaluates five deployment-relevant safety axes: corruption robustness, OOD generalization, class imbalance, fairness, and interpretation. It reports per-axis and subcondition results rather than collapsing graph safety into a single aggregate score. • Cross-axis empirical insights. GRL-Safety reveals that safety behavior depends on the interaction between representation design and the stressed graph factor, that foundation-era methods show axis-specific strengths rather than broad safety dominance, and that some deployment regimes expose capability gaps beyond model selection.

Related Work

Graph representation learning. Graph representation learning (GRL) has progressed from topology-only graph embeddings and task-specific message-passing models toward transferable pretrained representations and graph foundation models (GFMs) [54, 59]. Early topology-only embedding methods learn node representations directly from graph structure, through randomwalk contexts [14, 35], proximity preservation [44], or structural-role similarity [39]. Supervised GNNs learn task-specific representations by iteratively aggregating neighborhood information and training end-to-end with downstream labels [17, 24, 48, 67]. Self-supervised GRL relaxes this taskspecific training pattern through pretraining objectives such as mutual-information maximization [49], contrastive learning with augmentations [23, 63], bootstrap latent prediction [46], and masked reconstruction [19, 47, 56, 57], so that learned representations can be adapted to downstream tasks. More recently, GFMs push this transferability goal further through broader design and adaptation interfaces, including task and model unification [31, 53, 55], graph prompting [12, 42], cross-graph pretraining and domain alignment [16, 18, 36, 60, 65], in-context or zero-shot adaptation [21, 26], and graph-language interfaces [5, 43]. Existing evaluations of this spectrum mainly measure clean-setting performance, adaptation, and task-format coverage on standard datasets and splits [6, 20, 61, 64]. 2

(1) From Graph Representation Methods to Unified Safety Benchmark Standardized Method Scope

Graph Datasets & Tasks Node Classification Link Prediction

25 TextAttributed Graphs Academic Web

Corruption - Feature Noise - Structure Noise

Topology-only Embedding DeepWalk

Graph Classification

Supervised GNNs GCN GAT

Node2vec

GraphSAGE

Self-supervised Graph Models BGRL

LLaGA

9 Pretraining Graphs

Shared Text Features

GFMs GFT GIT UniGraph2 OFA

GraphMAE

E-Commerce Molecule

Five Safety Axes

Native Adaptation

OOD - Degree – Temporal – Scaffold - Entity Imbalance - Major Recall – Minor Recall Fairness

- Structural – Demographic

Interpretation - Attribution Fidelity

(2) From Safety Evaluation to Deployment-Conditioned Safety Profile

Axis-specific Stress Tests

Per-condition Metrics

ID OOD

Methods

Cross-axis Insights

Head-tail Attribution Disparity Fidelity -ΔFid⁻

Major Recall

Corruption level

ID-OOD Major / Gap Minor recall Minor Recall

Corruption Drop

Performance

Method Adaptation

Performance

Unified Input

Per-axis Safety Reports

Performance

Benchmark Procedure

Head Tail

ΔFid⁺

Stress × design matters GFMs specialize by axis

Hard regimes remain

Figure 1: Overview of GRL-Safety. We evaluate twelve GRL methods across five safety axes under standardized evaluation conditions.

Safety evaluation in GRL. Complementing evaluations of clean-setting performance, safetyoriented evaluation work [52] studies representative safety-relevant axes in GRL. For corruption robustness, GRB [70] and DeepRobust [25] provide benchmark and toolkit support for feature and topology perturbations, while NoisyGL [58] provides a unified protocol for graph learning under label noise. For out-of-distribution (OOD) generalization, GOOD [15, 51] introduces controlled covariate and concept shifts under a per-method evaluation protocol spanning node and graph classification. For class imbalance, recent surveys [33] consolidate protocols and metrics for imbalanced node classification, while works such as GraphSMOTE [69] and GraphENS [34] commonly evaluate under controlled imbalance-ratio settings. For fairness, the FairGraph benchmark [9] and the PyGDebias toolkit [10] consolidate datasets, metrics, and evaluations of demographic and structural group disparity. For interpretation, GraphXAI [1], GraphFramEx [2], and GInX-Eval [3] provide complementary evaluation frameworks for saliency, post-hoc-explainer fidelity, and in-distribution explanation quality. Broader trustworthy graph learning work also covers additional reliability concerns beyond these representative axes, including adversarial and prompt-level robustness for graph-LLM systems [7, 66, 68]. These efforts establish important axis-specific evaluation protocols, but they are usually organized one axis at a time, leaving limited evidence about how safety behavior changes across axes. Moreover, they are often developed under different task scopes, input representations, evaluation definitions, and method families, leaving open how the GRL spectrum behaves under comparable safety evaluation conditions.

GRL-Safety Benchmark and Evaluation

3.1

Setup

GRL-Safety evaluates whether graph representation methods remain reliable under graph-specific deployment stresses. It standardizes inputs, splits, stress operators, and metrics while preserving each method’s native adaptation pipeline, and reports behavior by safety axis rather than as a single aggregate leaderboard. These choices address the three design requirements outlined above. First, safety axes are evaluated separately because they stress different parts of the GRL pipeline and can induce different subcondition-level rankings. Second, evaluation conditions are standardized while method-native adaptation is preserved, so methods are compared under shared splits, stress operators, and metrics without forcing a common architecture or adaptation head. Finally, datasets span multiple domains and task formats so that safety behavior is not tied to a single graph family. 3

Method Scope. GRL-Safety covers twelve methods spanning four tiers. Topology-only baselines include DeepWalk [35] and Node2vec [14]. Supervised message-passing baselines include GCN [24], GAT [48], and GraphSAGE [17]. Self-supervised graph representation methods include BGRL [46] and GraphMAE [19]. Foundation-era graph models include GFT [53], GIT [55], UniGraph2 [18], OFA [31], and LLaGA [5], covering structured task abstraction, cross-domain alignment, promptgraph reformulation, and graph-language adaptation. Datasets and Protocol. GRL-Safety evaluates twenty-five text-attributed graphs covering node classification, link prediction, and graph classification across academic, e-commerce, web, knowledgegraph, recommendation, and molecular domains; dataset statistics are reported in Appendix A. For feature-consuming methods, each node, edge, atom, or relation text field is embedded with Sentence-BERT [38] into a shared 768-dimensional feature space. Topology-only methods use the same graph structure on compatible task formats. Pretrained methods use a common nine-graph pretraining corpus following GFT [53], while supervised and topology-only baselines are fitted directly on each downstream graph. All methods are evaluated under shared downstream splits, stress operators, and metric definitions whenever the task interface permits. Consequently, each safety axis is evaluated on the subset of datasets whose task format, label structure, split metadata, or attribution interface supports the corresponding stress operator; Appendix D summarizes this axis-specific dataset applicability. Safety Axes.

GRL-Safety evaluates five representative safety axes:

corruption robustness ,

OOD generalization , class imbalance , fairness , and interpretation . Corruption separates feature perturbation from edge deletion; OOD separates degree, temporal, scaffold, and inductive entity shifts; imbalance reports major- and minor-class recall; fairness reports structural and demographic group disparities; and interpretation measures whether attributed substructures support the prediction better than random evidence. Because these subconditions can produce different method rankings, GRL-Safety reports per-axis results rather than collapsing them into a single safety score. Capability transfer, calibration, privacy, and adaptive adversarial robustness are outside the current scope. 3.2

Per-Axis Safety Benchmark and Evaluation

The following subsections instantiate these five axes as concrete evaluation protocols, report results across compatible methods, and summarize the main empirical finding. 3.2.1

Corruption Robustness : Feature and Structure Noise

Corruption evaluates input-side stability under two noise channels: feature noise, which degrades node attributes, and structure noise, which removes observed edges. Feature noise applies to featureconsuming methods, while structure noise applies to methods relying on topology. This axis asks whether a graph representation remains useful when attribute signal or graph structure is corrupted. Benchmark. We instantiate two corruption channels following common graph robustness stress tests [32, 40]. Feature noise adds Gaussian perturbations to node features, with severity controlled by relative scale σrel ∈ {0.1, 0.25, 0.5, 1.0, 2.0}; it is inapplicable to topology-only embeddings. Structure noise randomly removes edges, with severity controlled by deletion probability p ∈ {0.05, 0.10, 0.20, 0.30, 0.50}. Table 1 reports the strongest setting for each channel, σrel =2.0 for feature noise and p=0.5 for structure noise, on the shared node-classification datasets. We report perturbed accuracy and Drop = Clean − Perturbed; lower drop indicates stronger corruption stability. Full severity sweeps are provided in Appendix E.1. Evidence. Table 1 shows that feature noise and structure noise induce different robustness profiles across method families. Feature noise is inapplicable to topology-only embeddings; under edge deletion, however, DeepWalk and Node2vec show large average drops of 9.63 and 9.84 points. In contrast, many supervised and self-supervised GNNs remain comparatively stable across both channels. Foundation-era methods do not form a uniformly robust tier: OFA drops under both channels, while LLaGA is more stable under feature noise but drops under structure noise, and UniGraph2 shows the reverse pattern. Full sweeps in Appendix E.1 confirm that corruption sensitivity depends on which graph signal is damaged. 4

Finding 1. Corruption robustness is deployment-specific, not a single aggregate property. Noisy attributes and missing links induce different failure profiles, so stability under one signal failure need not transfer to the other. Model selection should therefore depend on the expected graph signal failure rather than clean accuracy or a single corruption score.

Table 1: Sev5 corruption summary. Accuracy (%) and clean-to-corrupted drop on four shared NC datasets. Feature noise uses Gaussian perturbation with σ=2.0; structure noise uses random edge deletion with p=0.5. Sev5 is the strongest severity; Drop = Clean − Sev5 (↓ is more robust). Cells show mean±std over 5 seeds; aggregate std is across datasets. Bold/underline: best/second per column. “–” indicates feature noise is inapplicable. Feature Noise (σ=2.0)

Structure Noise (p=0.5)

Citeseer

DBLP

Pubmed

Wikics

Sev5

Drop ↓

– –

GCN [24] 67.1±1.6 73.3±0.2 77.4±2.1 77.9±0.7 67.3±1.4 73.7±0.4 77.2±0.9 77.6±0.6 GAT [48] GraphSAGE [17] 67.3±2.0 70.4±1.8 74.2±1.4 75.5±1.2

73.9±5.0 74.0±4.8 71.9±3.7

1.18±0.2 1.29±0.4 2.41±0.7

66.8±0.8 73.5±0.3 77.2±1.8 76.9±0.7 67.7±1.4 74.0±0.4 76.6±1.0 76.6±0.5 67.0±0.5 72.6±0.8 74.8±2.0 76.0±0.3

73.6±4.8 73.7±4.2 72.6±4.0

1.44±0.6 1.51±0.7 1.84±0.6

BGRL [46] GraphMAE [19]

63.9±0.7 69.6±0.5 72.0±2.3 78.1±0.7 63.8±0.8 68.7±1.3 76.2±0.7 77.7±0.9

70.9±5.9 71.6±6.5

1.98±1.0 2.99±1.3

64.8±0.7 70.6±0.3 73.4±2.7 78.0±0.6 65.5±0.9 71.5±0.7 76.4±0.8 77.8±0.5

71.7±5.5 72.8±5.6

1.16±1.0 1.83±0.7

GFT [53] GIT [55] UniGraph2 [18] OFA [31] LLaGA [5]

59.7±0.9 49.9±1.5 60.4±0.7 50.8±1.6 61.5±0.7

57.7±0.5 61.5±1.0 64.2±1.0 53.5±2.3 53.5±2.2

67.9±8.6 71.1±6.5 68.9±4.1 64.0±7.3 65.3±8.1

3.85±3.7 3.00±2.3 1.42±1.7 5.89±3.9 5.44±4.6

Method DeepWalk [35] Node2vec [14]

58.5±1.6 71.5±0.1 59.9±3.4 54.2±0.7 68.2±1.9

73.0±1.2 73.5±1.6 71.4±2.0 62.3±3.0 71.9±2.8

WikiCS

Citeseer

Pubmed

Wikics

Drop ↓

Sev5

31.7±1.7 50.3±0.5 52.0±1.6 66.8±1.0 50.2±14.4 9.63±7.3 31.0±1.5 48.3±1.3 52.6±1.2 66.7±0.8 49.6±14.7 9.84±6.5

67.2±1.3 64.6±6.8 7.36±3.3 63.0±2.0 64.5±10.7 9.47±8.2 70.4±2.1 65.5±6.2 5.23±1.8 64.2±1.2 57.9±6.4 11.98±0.9 73.2±0.9 68.7±5.2 2.00±1.0

WikiCS

DBLP

63.9±1.2 72.8±0.2 66.8±2.3 64.2±1.8 68.3±1.3

74.4±1.5 74.4±1.4 72.6±1.7 69.1±3.4 67.1±2.6

75.6±0.8 75.8±0.7 72.2±2.0 69.1±0.8 72.2±1.1

Cora

80 80 75 75 70 70 75 75 65 65 70 70 60 60 55 55 65 65 50 50 45 45 60Clean 0.1 0.25 0.5 1.0 2.0 60Clean 0.05 0.10 0.20 0.30 0.50 Clean 0.1 0.25 0.5 1.0 2.0 Clean 0.05 0.10 0.20 0.30 0.50 80

Accuracy (%)

Feature noise

DeepWalk

Node2vec

Feature noise

Structure noise

GCN

GAT

GraphSAGE

BGRL

GraphMAE

UniGraph2

Structure noise

GIT

GFT

OFA

LLaGA

Figure 2: Corruption severity trajectories. Test accuracy under feature- and structure-noise sweeps on WikiCS and Cora. Curves denote methods; per-dataset curves in Appendix Figures 6–7. 3.2.2

OOD Generalization : Shifts Across Graph Contexts

OOD generalization evaluates whether graph representations remain useful when the graph context changes across structure, time, molecular scaffold, or entity set. We study four OOD shift mechanisms: degree shift, temporal shift, scaffold shift, and inductive-entity shift. Benchmark. We instantiate four OOD shift mechanisms following mechanism-level evaluation protocols in graph OOD benchmarks [15]. Degree shift partitions each node-classification dataset by node-degree quantile, using the high-degree majority as the ID split and the low-degree quantile as the OOD split. Temporal shift trains on arXiv papers with publication year ≤ 2010 and evaluates on papers from ≥ 2017. Scaffold shift compares random and Bemis–Murcko scaffold splits on BACE and Tox21 [20]. Inductive-entity shift is operationalized as KG completion on WN18RR and FB15K237, where test-time candidate entities are held out from downstream KG training. We report ID-to-OOD accuracy drop for degree and temporal shifts, ∆AUC = AUCrand − AUCscaffold for scaffold shift, and MRR / Hits@10 for inductive-entity shift. Evidence. Figure 3 and Table 2 show that OOD rankings change with the evaluated shift mechanism. Under degree shift across six node-classification datasets, topology-only embeddings have the largest average drops, while GraphMAE has the smallest average drop (6.75 points across the six datasets 5

Temporal shift · arXiv · sorted by Δ

Degree shift · ID − OOD drop (pt) DeepWalk

20.3

30.5

10.0

13.7

31.6

20.8

Node2Vec

21.4

30.3

10.3

13.6

32.3

21.5

GCN

8.6

12.4

3.2

4.3

4.4

17.3

GAT

7.8

12.9

4.3

4.5

7.9

13.8

SAGE

7.0

13.7

2.0

5.1

5.2

10.3

BGRL

6.7

10.2

2.6

3.8

6.2

21.3

GraphMAE

7.2

11.2

3.7

4.8

4.5

9.1

GFT

5.0

12.3

1.4

6.1

7.4

13.9

GIT

6.2

13.1

2.8

5.4

5.5

12.0

UniGraph2

7.7

11.4

3.2

6.7

4.7

11.5

OFA

9.2

17.3

4.2

9.5

8.5

14.8

LLaGA

7.8

17.9

5.2

4.8

11.4

14.9

er se

bM Pu

LP DB

OFA

71.5 → 61.9

GAT

71.7 → 59.0

GCN

72.4 → 59.6

GraphMAE

73.0 → 59.5

UniGraph2

69.9 → 55.8

DeepWalk

63.1 → 48.8

Node2Vec

63.2 → 48.8

BGRL

73.6 → 59.0

GraphSAGE

71.4 → 56.4

GFT

69.6 → 50.8

GIT

71.5 → 51.1

LLaGA

70.7 → 48.9

30 25 20 15 10 5 0

ik W

ID − OOD drop Δ (pt)

(a) Degree shift. ID–OOD accuracy drop across 12 (b) Temporal shift. ID–OOD accuracy drop on arXiv, methods on 6 NC datasets. Full results are in Table 6. sorted by drop size.

Figure 3: Node-classification OOD shifts. Larger values indicate weaker OOD generalization; darker cells and longer bars denote larger drops.

Table 2: OOD shift mechanisms beyond node classification. (a) Scaffold shift on BACE / Tox21: ROC-AUC under random versus Bemis–Murcko scaffold splits (80/10/10, OGB convention [20]); ∆ = AUCrand − AUCscaf , where larger ∆ indicates a larger scaffold-generalization gap. (b) Inductive-entity shift on WN18RR / FB15K237, operationalized as KG completion with testtime candidate entities held out from downstream KG training; MRR / Hits@10, higher is better. Bold/underline: best/second per column. Per-cell values are mean±std over 5 seeds. (a) Mol scaffold OOD (BACE / Tox21) (b) Inductive KG (WN18RR / FB15K237) Method

rand.

BACE scaf.

∆ ↓

rand.

Tox21 scaf.

∆ ↓

Method

WN18RR MRR ↑ Hits@10 ↑

FB15K237 MRR ↑ Hits@10 ↑

GCN [24] 64.5±0.4 52.1±0.6 12.3 78.5±0.2 72.5±0.2 5.9 GAT [48] 62.9±0.3 48.1±1.1 14.7 78.6±0.4 71.2±0.3 7.4 GraphSAGE [17] 66.7±0.9 56.9±0.9 9.7 80.9±0.2 74.9±0.2 6.0

GCN [24] 0.192±.014 0.346±.015 0.098±.006 0.179±.005 0.167±.011 0.363±.021 0.039±.004 0.092±.017 GAT [48] GraphSAGE [17] 0.134±.027 0.262±.031 0.172±.011 0.378±.015

BGRL [46] 85.3±0.8 61.7±2.1 23.6 82.4±0.3 76.0±0.3 6.4 GraphMAE [19] 76.5±0.8 54.3±0.6 22.2 80.4±0.5 73.1±0.7 7.4

BGRL [46] 0.231±.009 0.443±.027 0.088±.004 0.153±.002 GraphMAE [19] 0.224±.014 0.541±.025 0.121±.009 0.256±.015

GFT [53] GIT [55] UniGraph2 [18] OFA [31] LLaGA [5]

70.0±5.8 54.3±1.4 15.7 80.8±0.6 73.4±0.8 82.8±0.6 65.2±0.6 17.5 83.0±0.4 76.0±0.4 68.5±2.1 56.7±2.8 11.7 75.5±1.6 70.2±0.9 84.0±1.3 66.6±1.6 17.3 81.8±0.5 75.5±0.8 79.0±0.7 56.0±0.9 23.0 79.8±2.2 73.6±0.9

7.5 6.9 5.4 6.3 6.2

0.157±.005 0.339±.013 0.174±.005 0.364±.009 0.094±.013 0.212±.010 0.161±.005 0.346±.010 0.148±.007 0.315±.015 0.064±.008 0.127±.012 0.075±.011 0.139±.013 0.186±.013 0.385±.019 0.152±.019 0.270±.027 0.082±.012 0.155±.019

in Figure 3a). On the arXiv temporal split, OFA shows the smallest drop (9.61 points). Across the two scaffold-shift datasets evaluated, the strongest method differs: GraphSAGE shows the smallest BACE gap (9.7 ∆AUC), while UniGraph2 shows the smallest Tox21 gap (5.4 ∆AUC). Across the two inductive-entity KG datasets evaluated, the leader also changes: BGRL leads WN18RR in MRR (0.231) but falls to 0.088 on FB15K237, whereas OFA leads FB15K237 (0.186) but drops to 0.075 on WN18RR. These results illustrate subcondition sensitivity rather than a single OOD ranking. Finding 2. OOD reliability is application-shift specific. In the evaluated settings, degree shifts in node-classification graphs, the arXiv temporal split, scaffold splits in molecules, and inductiveentity shifts in KGs expose different representation behaviors. Model selection should therefore be conditioned on the anticipated deployment shift rather than on a single aggregate OOD score. 3.2.3

Class Imbalance : Major and Minor Recall

Class imbalance evaluates whether strong average performance reflects balanced class-wise recall or is driven mainly by majority-class predictions under skewed label support. 6

Benchmark. We measure class-imbalance behavior on node classification at imbalance ratio ρ=10. Classes are sorted by their original training-set sample count; the lower half are treated as minor classes and downsampled to nmajor /ρ, where nmajor is the largest training count among the upperhalf major classes. Full protocol details are in Appendix D.3. Each method is adapted on the imbalanced training graph using its native pipeline. We report per-class recall on the test split, averaged separately across major and minor classes. Figure 4 shows four representative datasets where all twelve methods are covered; full per-dataset results for eight categorical-label NC datasets and ρ ∈ {5, 10, 20} are reported in Appendix Table 7. Evidence. Figure 4 shows that major-class and minor-class recall separate under skewed label support. This separation is most visible for topology-only graph embeddings, which have near-zero minorclass recall on Cora and CiteSeer despite much higher major-class recall. Among feature-consuming methods, the strongest minor-class method changes by dataset: LLaGA leads on Cora, GAT on CiteSeer, GraphMAE on WikiCS, and UniGraph2 on Elec-Computers. Minor-class gains also need not align with majority-class recall: on Elec-Computers, UniGraph2 has the best minor recall but lower major recall than LLaGA (75.0% vs. 81.1%), whereas OFA keeps competitive major recall while dropping to 26.2% minor recall on WikiCS. Overall, class imbalance exposes a major-minor coverage trade-off rather than a uniform accuracy degradation pattern.

Cora

Citeseer

40 90 32

80 16 75 8

15 0

DeepWalk

Node2vec

GCN

WikiCS 84 60

72 60 45 64 30 56 15

85 24

80 75

GraphSAGE

BGRL

81 45 78 30

75 15

72 0

0 GAT

Elec-Computers 84

Major-class recall (line, %)

Minor-class recall (bars, %)

Finding 3. Class imbalance creates a rare-class coverage failure in graph prediction. Under skewed label support, strong majority-class recall can hide severe minority-class collapse, while methods with better minority coverage may sacrifice majority performance. For graph tasks where rare classes carry the primary risk, model selection should prioritize minority coverage and balanced recall rather than average accuracy.

GraphMAE

GFT

GIT

UniGraph2

OFA

LLaGA

Figure 4: Major- and minor-class recall under class imbalance . At imbalance ratio ρ=10, bars show minor-class recall and lines show major-class recall on four representative node-classification datasets. High major-class recall does not necessarily imply high minor-class recall. 3.2.4

Fairness : Structural Head–Tail Disparity

Fairness evaluates whether prediction quality differs across groups. In GRL, a natural group axis is structural position: high-degree nodes receive more neighborhood evidence, while low-degree nodes have thinner local context. Benchmark. We evaluate structural fairness on node classification. For each dataset, test nodes are split into head nodes (top 20% by degree) and tail nodes (bottom 20% by degree), and we report the signed head-minus-tail accuracy gap ∆ = Acchead − Acctail . A smaller |∆| indicates more balanced head/tail performance; ∆ > 0 indicates head-favoring behavior, while ∆ < 0 indicates tail-favoring behavior. Each method is adapted with its native pipeline, and no fairness-aware training intervention is applied. Figure 5 shows four representative datasets where all twelve methods are covered. Full structural-fairness results on eight NC datasets and demographic-fairness results on Tolokers are reported in Appendix E.4. Evidence. Figure 5 shows that head–tail disparity is graph-conditioned rather than tier-conditioned. Most methods favor head nodes on Cora, PubMed, WikiCS, and ElePhoto, but the size of this advantage varies substantially across graphs and methods. The topology-only graph embeddings often show large head-favoring gaps, indicating that purely structural representations can amplify degree-position disparity. The smallest absolute gap also rotates across datasets: UniGraph2 is smallest on Cora, BGRL on PubMed, OFA on WikiCS, and LLaGA on ElePhoto. Individual methods do not carry a fixed fairness profile: for example, GFT has a large gap on WikiCS (+14.58 pp) but a 7

much smaller gap on ElePhoto (+3.62 pp). Overall, structural fairness depends on the interaction between graph degree structure and the representation interface. Finding 4. Structural fairness is a deployment-relevant degree-position risk in graph prediction. In degree-skewed graphs, high-degree and low-degree nodes can experience different error profiles, so fairness assessment should report whether a representation amplifies, reduces, or reverses head–tail disparity.

Accuracy (%)

Cora

+15.7+16.3+5.7 +5.7 +5.2 +8.3

+5.9 +3.2

+5.0 +7.2 +3.7 +6.8 80 +15.7+15.7+2.6 +4.1 +4.9

+4.8

+4.5 +5.2 +5.4 +4.1 +4.7

0.3

PubMed

WikiCS

+12.7+9.7 +9.5 +12.5+14.6 +20.1+20.9+10.8+11.0 +6.9 +9.7 +8.6

ElePhoto

+10.0+9.6

+3.6 +4.8 +2.6 +3.4 +4.4 +4.4 +2.3 +3.6 +2.5 0.8

DeepWalk

Node2vec

GCN

GAT

GraphSAGE

BGRL

GraphMAE

UniGraph2

GIT

GFT

OFA

LLaGA

Figure 5: Structural head–tail fairness. Accuracy across all 12 methods on four node-classification datasets. Each method has two bars: head nodes (solid, top-degree quintile) and tail nodes (hatched, bottom-degree quintile). Red labels report the signed gap ∆ = Acchead − Acctail in percentage points; positive values indicate head-favoring behavior and negative values indicate tail-favoring behavior. Error bars show standard deviation across 5 seeds.

3.2.5

Interpretation : Attribution Fidelity

Interpretation evaluates whether the input elements highlighted by a post-hoc attribution method are actually predictive. This axis does not ask whether a method is accurate, but whether its attributed substructures support the prediction better than a random baseline at the same sparsity. Benchmark. We evaluate node-level attribution fidelity using gradient-saliency edge attribution under subgraph ablation [1]. For each test node, we mask the top-k=10% edges in its K=2-hop receptive field and compute the GraphFramEx characterization score [2], the harmonic mean of Fid+ (confidence drop when salient edges are masked) and 1−Fid− (prediction preservation when non-salient edges are masked). We report ∆char ×100 = charsal − charrand , the lift over a randomedge baseline; a positive value means saliency identifies more predictive edges than guessing. This evaluation covers eight methods on eight NC datasets; OFA and LLaGA are not included because their adaptation paths do not expose the same per-edge gradient interface under this protocol. Evidence. Table 3 shows that node-level attribution fidelity is concentrated in a small set of methods. GFT has the highest cross-dataset mean (31.30), followed by GraphSAGE (27.23) and GIT (24.26); the remaining methods are at or below 14.00 on average. Per dataset, GFT leads six of eight columns, while GIT leads the two e-commerce graphs. Appendix Figure 8 shows that the two fidelity components move together across representative NC datasets. Overall, node-level attribution fidelity is concentrated rather than universal: only a small subset of methods consistently produces edge saliency that outperforms random-edge ablation. The evaluation is also interface-dependent, since methods without a shared per-edge gradient interface require separate attribution protocols. Finding 5. Explanation availability is not the same as attribution fidelity. For graph domains where explanations are used as scientific or molecular evidence, safety evaluation should test whether highlighted edges or subgraphs are actually predictive under the stated attribution protocol, rather than assuming that a saliency interface yields faithful explanations.

Table 3: Node-level subgraph-ablation fidelity . ∆char × 100 measures the lift of gradient-saliency edge attribution over a random-edge baseline under top-k=10% subgraph ablation; higher is better and 0 means no lift over random. Per-dataset cells report mean±std over 5 seeds; the Avg column reports the cross-dataset mean with between-dataset std. Bold/underline: best/second per column. Method

Cora

Citeseer

PubMed

WikiCS

Elec-Computers Elec-Photo Amazon-Ratings

Tolokers

Avg↑

GCN 11.56±2.18 GAT 11.25±1.75 GraphSAGE 30.21±0.72

5.43±5.69 12.66±2.66 23.72±2.09 3.40±1.80 18.44±3.32 25.82±4.55 11.97±7.87 33.74±4.00 51.84±1.58

16.13±5.23 8.12±3.25 25.69±5.52

16.53±2.64 9.61±3.56 24.83±4.44

3.53±2.56 2.01±3.71 16.00±5.48

22.42±0.24 14.00±7.24 0.17±0.03 9.85±8.71 23.56±0.48 27.23±12.17

BGRL GraphMAE

14.24±1.06 12.81±0.19

8.95±0.64 6.58±3.60

11.02±4.75 20.14±2.26 17.34±0.94 25.36±1.82

18.22±5.81 9.13±5.39

16.98±2.05 10.55±2.42

5.89±3.12 6.71±2.67

8.16±1.73 1.21±0.81

GFT GIT UniGraph2

30.64±3.00 19.52±21.72 40.11±5.03 63.65±1.52 21.26±18.28 13.59±3.75 30.12±5.96 53.50±2.93 5.38±1.65 2.75±2.43 10.73±7.27 24.58±4.37

24.87±4.48 26.54±4.84 7.33±4.42

24.17±1.20 25.00±2.42 6.40±2.09

17.25±0.93 14.22±2.81 5.02±1.50

30.22±1.40 31.30±14.90 9.85±0.98 24.26±13.77 14.19±3.57 9.55±7.05

3.3

12.95±5.21 11.21±7.43

Cross-Axis Discussion

The per-axis results in §3.2 show that safety failures are not isolated to a single stressor. We synthesize them into three cross-axis insights. Insight 1: Safety behavior is shaped by stressed graph factors and representation design. Across corruption, OOD generalization, and fairness, method rankings and failure modes change with the interaction between the stressed graph factor and the underlying representation design. Topology-dependent methods are fragile under edge deletion but feature noise is inapplicable to topology-only embeddings; BGRL and OFA take leadership on different KG OOD datasets; and GFT’s structural-fairness gap is much larger on WikiCS than on ElePhoto. These observations suggest that safety outcomes are governed by which graph factor a representation uses and which factor fails at deployment, rather than by supervised, self-supervised, or foundation-era status alone. Insight 2: Foundation-era methods show axis-specific strengths, not broad safety dominance. Foundation-era methods lead in some safety regimes but do not dominate across the benchmark. GFT has the strongest node-level attribution fidelity, OFA has the smallest drop on the arXiv temporal split, and UniGraph2 is competitive for minority-class recall on multiple imbalance datasets; however, each also has weaker axes or channels. Thus, adopting a foundation-era graph model is not a general safety recipe: the relevant question is which safety mechanism its interface supports or weakens. Insight 3: Some deployment regimes remain difficult for the evaluated method set. Several settings expose limitations beyond choosing the best method in the current cohort. Even the strongest method on the arXiv temporal split still drops by about ten accuracy points, and class imbalance produces a major–minor recall trade-off rather than a uniformly good operating point. These regimes point to method-capability gaps that require new robustness, adaptation, or training objectives, not only better model selection.

Limitations and Future Work

GRL-Safety covers representative graph-safety axes rather than an exhaustive taxonomy. Calibration, adaptive adversarial robustness, and privacy are outside the current scope, and method-axis coverage remains limited by adapter compatibility, such as the per-edge gradient interface required for nodelevel attribution fidelity. Future versions can add domains, adapters, and stress operators while preserving the same condition-aware reporting format. Beyond these scope and coverage limitations, GRL-Safety also exposes method-level open challenges. The current evaluation identifies safety failures through fixed stress operators and evaluation metrics. A next step is to develop methods that explicitly optimize for the expected deployment stressor, such as missing links, temporal drift, rare classes, or structurally disadvantaged nodes.

Conclusion

GRL-Safety shows that GRL safety is condition-dependent: clean accuracy or method family alone does not reliably predict behavior under deployment-relevant stress. Across corruption, OOD 9

generalization, class imbalance, fairness, and interpretation, method rankings vary with the interaction between the stressed graph factor and the underlying representation design. These results suggest that graph safety should be evaluated through per-axis and subcondition reports rather than collapsed into a single aggregate score. The main purpose of GRL-Safety is therefore not to produce a universal safety leaderboard, but to provide a diagnostic view of which methods fail under which graph conditions. This view can guide deployment-time model selection by matching methods to expected stressors, such as missing links, temporal drift, rare classes, or structurally disadvantaged nodes, while also exposing capability gaps that require future GRL methods to optimize for safety-relevant graph conditions rather than clean performance alone.

References [1] Chirag Agarwal, Owen Queen, Himabindu Lakkaraju, and Marinka Zitnik. Evaluating explainability for graph neural networks. Scientific Data, 10(1):144, 2023. [2] Kenza Amara, Rex Ying, Zitao Zhang, Zhihao Han, Yinan Shan, Ulrik Brandes, Sebastian Schemm, and Ce Zhang. GraphFramEx: Towards systematic evaluation of explainability methods for graph neural networks. In Learning on Graphs Conference (LoG), 2022. [3] Kenza Amara, Mennatallah El-Assady, and Rex Ying. GInX-Eval: Towards in-distribution evaluation of graph neural network explanations. In International Conference on Learning Representations (ICLR), 2024. [4] Rishi Bommasani, Drew A. Hudson, Ehsan Adeli, Russ Altman, Simran Arora, Sydney von Arx, Michael S. Bernstein, Jeannette Bohg, Antoine Bosselut, Emma Brunskill, et al. On the opportunities and risks of foundation models. arXiv preprint arXiv:2108.07258, 2021. [5] Runjin Chen, Tong Zhao, Ajay Jaiswal, Neil Shah, and Zhangyang Wang. LLaGA: Large language and graph assistant. In Proceedings of the 41st International Conference on Machine Learning (ICML), 2024. [6] Zhikai Chen, Haitao Mao, Jingzhe Liu, Yu Song, Bingheng Li, Wei Jin, Bahare Fatemi, Anton Tsitsulin, Bryan Perozzi, Hui Liu, and Jiliang Tang. Text-space graph foundation models: Comprehensive benchmarks and new insights. arXiv preprint arXiv:2406.10727, 2024. [7] Enyan Dai, Tianxiang Zhao, Huaisheng Zhu, Junjie Xu, Zhimeng Guo, Hui Liu, Jiliang Tang, and Suhang Wang. A comprehensive survey on trustworthy graph neural networks: Privacy, robustness, fairness, and explainability. Machine Intelligence Research, 21(6):1011–1061, 2024. [8] Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. BERT: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL-HLT), 2019. [9] Yushun Dong, Song Wang, Zhenyu Lei, Zaiyi Zheng, Jing Ma, Chen Chen, and Jundong Li. A benchmark for fairness-aware graph learning. arXiv preprint arXiv:2407.12112, 2024. [10] Yushun Dong, Zhenyu Wang, Zaiyi Liu, Han Zhao, Suhang Wang, and Jundong Li. PyGDebias: A python library for debiasing in graph learning. In Proceedings of the 17th ACM International Conference on Web Search and Data Mining (WSDM), 2024. [11] Yingtong Dou, Zhiwei Liu, Li Sun, Yutong Deng, Hao Peng, and Philip S. Yu. Enhancing graph neural network-based fraud detectors against camouflaged fraudsters. In Proceedings of the 29th ACM International Conference on Information and Knowledge Management (CIKM), 2020. [12] Taoran Fang, Yunchao Zhang, Yang Yang, Chunping Wang, and Lei Chen. Universal prompt tuning for graph neural networks. In Advances in Neural Information Processing Systems (NeurIPS), 2023. [13] Jiarui Feng, Hao Liu, Lecheng Kong, Mingfang Zhu, Yixin Chen, and Muhan Zhang. TAGLAS: An atlas of text-attributed graph datasets in the era of large graph and language models, 2024. [14] Aditya Grover and Jure Leskovec. node2vec: Scalable feature learning for networks. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), pages 855–864, 2016. [15] Shurui Gui, Xiner Li, Limei Wang, and Shuiwang Ji. GOOD: A graph out-of-distribution benchmark. In Advances in Neural Information Processing Systems (NeurIPS) Datasets and Benchmarks Track, 2022. [16] Xiaoguang Guo, Zehong Wang, Jiazheng Li, Shawn Spitzel, Qi Yang, Kaize Ding, Jundong Li, and Chuxu Zhang. Generalizing gnns with tokenized mixture of experts. arXiv preprint arXiv:2602.09258, 2026. 11

[17] William L. Hamilton, Rex Ying, and Jure Leskovec. Inductive representation learning on large graphs. In Advances in Neural Information Processing Systems (NeurIPS), 2017. [18] Yufei He, Yuan Sui, Xiaoxin He, Yue Liu, Yifei Sun, and Bryan Hooi. UniGraph2: Learning a unified embedding space to bind multimodal graphs. In Proceedings of the ACM Web Conference (WWW), 2025. [19] Zhenyu Hou, Xiao Liu, Yukuo Cen, Yuxiao Dong, Hongxia Yang, Chunjie Wang, and Jie Tang. GraphMAE: Self-supervised masked graph autoencoders. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD), 2022. [20] Weihua Hu, Matthias Fey, Marinka Zitnik, Yuxiao Dong, Hongyu Ren, Bowen Liu, Michele Catasta, and Jure Leskovec. Open graph benchmark: Datasets for machine learning on graphs. In Advances in Neural Information Processing Systems (NeurIPS), 2020. [21] Qian Huang, Hongyu Ren, Peng Chen, Gregor Kržmanc, Daniel Zeng, Percy Liang, and Jure Leskovec. PRODIGY: Enabling in-context learning over graphs. In Advances in Neural Information Processing Systems (NeurIPS), 2023. [22] Shenyang Huang, Farimah Poursafaei, Jacob Danovitch, Matthias Fey, Weihua Hu, Emanuele Rossi, Jure Leskovec, Michael Bronstein, Guillaume Rabusseau, and Reihaneh Rabbany. Temporal graph benchmark for machine learning on temporal graphs. In Advances in Neural Information Processing Systems (NeurIPS) Datasets and Benchmarks Track, 2023. [23] Mingxuan Ju, Tong Zhao, Qianlong Wen, Wenhao Yu, Neil Shah, Yanfang Ye, and Chuxu Zhang. Multi-task self-supervised graph neural networks enable stronger task generalization. In International Conference on Learning Representations (ICLR), 2023. [24] Thomas N. Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. In International Conference on Learning Representations (ICLR), 2017. [25] Yaxin Li, Wei Jin, Han Xu, and Jiliang Tang. DeepRobust: A platform for adversarial attacks and defenses. In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), Demonstration Track, 2021. [26] Yuhan Li, Peisong Wang, Zhixun Li, Jeffrey Xu Yu, and Jia Li. ZeroG: Investigating crossdataset zero-shot transferability in graphs. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD), 2024. [27] Ziming Li, Youhuan Li, Xinhuan Chen, Lei Zou, Yang Li, Xiaofeng Yang, and Hongbo Jiang. Newsp: A new search process for continuous subgraph matching over dynamic graphs. In IEEE International Conference on Data Engineering(ICDE), 2024. [28] Ziming Li, Youhuan Li, Yuyu Luo, Guoliang Li, and Chuxu Zhang. Graph neural networks for databases: A survey. In Proceedings of the Thirty-Fourth International Joint Conference on Artificial Intelligence(IJCAI), 2025. [29] Ziming Li, Xiaoming Wu, Zehong Wang, Jiazheng Li, Yijun Tian, Jinhe Bi, Yunpu Ma, Yanfang Ye, and Chuxu Zhang. Graph is a substrate across data modalities. arXiv preprint arXiv:2601.22384, 2026. [30] Percy Liang, Rishi Bommasani, Tony Lee, Dimitris Tsipras, Dilara Soylu, Michihiro Yasunaga, Yian Zhang, Deepak Narayanan, Yuhuai Wu, Ananya Kumar, Benjamin Newman, et al. Holistic evaluation of language models. Transactions on Machine Learning Research, 2023. [31] Hao Liu, Jiarui Feng, Lecheng Kong, Ningyue Liang, Dacheng Tao, Yixin Chen, and Muhan Zhang. One for all: Towards training one graph model for all classification tasks. In International Conference on Learning Representations (ICLR), 2024. [32] Xiaorui Liu, Jiayuan Ding, Wei Jin, Han Xu, Yao Ma, Zitao Liu, and Jiliang Tang. Graph neural networks with adaptive residual. In Advances in Neural Information Processing Systems (NeurIPS), 2021. 12

[33] Yihong Ma, Yijun Tian, Nuno Moniz, and Nitesh V. Chawla. Class-imbalanced learning on graphs: A survey. ACM Computing Surveys, 57(8), 2025. doi: 10.1145/3718734. [34] Joonhyung Park, Jaeyun Song, and Eunho Yang. GraphENS: Neighbor-aware ego network synthesis for class-imbalanced node classification. In International Conference on Learning Representations (ICLR), 2022. [35] Bryan Perozzi, Rami Al-Rfou, and Steven Skiena. DeepWalk: Online learning of social representations. In Proceedings of the 20th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), pages 701–710, 2014. [36] Jiezhong Qiu, Qibin Chen, Yuxiao Dong, Jing Zhang, Hongxia Yang, Ming Ding, Kuansan Wang, and Jie Tang. GCC: Graph contrastive coding for graph neural network pre-training. In Proceedings of the 26th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD), 2020. [37] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision. In Proceedings of the 38th International Conference on Machine Learning (ICML), 2021. [38] Nils Reimers and Iryna Gurevych. Sentence-BERT: Sentence embeddings using siamese BERTnetworks. In Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 3982–3992, 2019. [39] Leonardo F. R. Ribeiro, Pedro H. P. Saverese, and Daniel R. Figueiredo. struc2vec: Learning node representations from structural identity. In Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), pages 385–394, 2017. [40] Yu Rong, Wenbing Huang, Tingyang Xu, and Junzhou Huang. DropEdge: Towards deep graph convolutional networks on node classification. In International Conference on Learning Representations (ICLR), 2020. [41] Jonathan M. Stokes, Kevin Yang, Kyle Swanson, Wengong Jin, Andres Cubillos-Ruiz, Nina M. Donghia, Craig R. MacNair, Shawn French, Lindsey A. Carfrae, Zohar Bloom-Ackermann, et al. A deep learning approach to antibiotic discovery. Cell, 180(4):688–702.e13, 2020. doi: 10.1016/j.cell.2020.01.021. [42] Mingchen Sun, Kaixiong Zhou, Xin He, Ying Wang, and Xin Wang. GPPT: Graph pre-training and prompt tuning to generalize graph neural networks. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD), 2022. [43] Jiabin Tang, Yuhao Yang, Wei Wei, Lei Shi, Lixin Su, Suqi Cheng, Dawei Yin, and Chao Huang. GraphGPT: Graph instruction tuning for large language models. In Proceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR), 2024. [44] Jian Tang, Meng Qu, Mingzhe Wang, Ming Zhang, Jun Yan, and Qiaozhu Mei. LINE: Largescale information network embedding. In Proceedings of the 24th International Conference on World Wide Web (WWW), pages 1067–1077, 2015. [45] Xianfeng Tang, Huaxiu Yao, Yiwei Sun, Yiqi Wang, Jiliang Tang, Charu Aggarwal, Prasenjit Mitra, and Suhang Wang. Investigating and mitigating degree-related biases in graph convolutional networks. In Proceedings of the 29th ACM International Conference on Information and Knowledge Management (CIKM), pages 1435–1444, 2020. [46] Shantanu Thakoor, Corentin Tallec, Mohammad Gheshlaghi Azar, Mehdi Azabou, Eva L. Dyer, Rémi Munos, Petar Veličković, and Michal Valko. Large-scale representation learning on graphs via bootstrapping. In International Conference on Learning Representations (ICLR), 2022. [47] Yijun Tian, Kaiwen Dong, Chunhui Zhang, Chuxu Zhang, and Nitesh V Chawla. Heterogeneous graph masked autoencoders. In Proceedings of the AAAI conference on artificial intelligence (AAAI), volume 37, pages 9997–10005, 2023. 13

[48] Petar Veličković, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Liò, and Yoshua Bengio. Graph attention networks. In International Conference on Learning Representations (ICLR), 2018. [49] Petar Veličković, William Fedus, William L. Hamilton, Pietro Liò, Yoshua Bengio, and R Devon Hjelm. Deep graph infomax. In International Conference on Learning Representations (ICLR), 2019. [50] Boxin Wang, Weixin Chen, Hengzhi Pei, Chulin Xie, Mintong Kang, Chenhui Zhang, Chejian Xu, Zidi Xiong, Ritik Dutta, Rylan Schaeffer, et al. DecodingTrust: A comprehensive assessment of trustworthiness in GPT models. In Advances in Neural Information Processing Systems (NeurIPS) Datasets and Benchmarks Track, 2023. [51] Song Wang, Zhen Tan, Yaochen Zhu, Chuxu Zhang, and Jundong Li. Generative risk minimization for out-of-distribution generalization on graphs. Transactions on Machine Learning Research, 2025. arXiv:2502.07968. [52] Song Wang, Yushun Dong, Binchi Zhang, Zihan Chen, Xingbo Fu, Yinhan He, Cong Shen, Chuxu Zhang, Nitesh V Chawla, and Jundong Li. Safety in graph machine learning: Threats and safeguards. IEEE Transactions on Knowledge and Data Engineering, 2026. [53] Zehong Wang, Zheyuan Zhang, Nitesh V. Chawla, Chuxu Zhang, and Yanfang Ye. GFT: Graph foundation model with transferable tree vocabulary. In Advances in Neural Information Processing Systems (NeurIPS), 2024. [54] Zehong Wang, Zheyuan Liu, Tianyi Ma, Jiazheng Li, Zheyuan Zhang, Xingbo Fu, Yiyang Li, Zhengqing Yuan, Wei Song, Yijun Ma, Qingkai Zeng, Xiusi Chen, Jianan Zhao, Jundong Li, Meng Jiang, Pietro Lio, Nitesh Chawla, Chuxu Zhang, and Yanfang Ye. Graph foundation models: A comprehensive survey. arXiv preprint arXiv:2505.15116, 2025. [55] Zehong Wang, Zheyuan Zhang, Tianyi Ma, Nitesh V. Chawla, Chuxu Zhang, and Yanfang Ye. Towards graph foundation models: Learning generalities across graphs via task-trees. In International Conference on Machine Learning (ICML), 2025. [56] Zehong Wang, Zheyuan Zhang, Tianyi Ma, Nitesh V Chawla, Chuxu Zhang, and Yanfang Ye. Beyond message passing: Neural graph pattern machine. In International Conference on Machine Learning, pages 65496–65517. PMLR, 2025. [57] Zehong Wang, Zheyuan Zhang, Tianyi Ma, Chuxu Zhang, and Yanfang Ye. Generative graph pattern machine. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025. [58] Zhonghao Wang, Danyu Sun, Sheng Zhou, Haobo Wang, Jiapei Fan, Longtao Huang, and Jiajun Bu. NoisyGL: A comprehensive benchmark for graph neural networks under label noise. In Advances in Neural Information Processing Systems (NeurIPS) Datasets and Benchmarks Track, 2024. [59] Zonghan Wu, Shirui Pan, Fengwen Chen, Guodong Long, Chengqi Zhang, and Philip S Yu. A comprehensive survey on graph neural networks. IEEE transactions on neural networks and learning systems, 32(1):4–24, 2020. [60] Lianghao Xia and Chao Huang. AnyGraph: Graph foundation model in the wild. arXiv preprint arXiv:2408.10700, 2024. [61] Yuhao Xu, Xinqi Liu, Keyu Duan, Yi Fang, Yu-Neng Chuang, Daochen Zha, and Qiaoyu Tan. GraphFM: A comprehensive benchmark for graph foundation model. arXiv preprint arXiv:2406.08310, 2024. [62] Rex Ying, Ruining He, Kaifeng Chen, Pong Eksombatchai, William L. Hamilton, and Jure Leskovec. Graph convolutional neural networks for web-scale recommender systems. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), 2018. 14

[63] Yuning You, Tianlong Chen, Yongduo Sui, Ting Chen, Zhangyang Wang, and Yang Shen. Graph contrastive learning with augmentations. In Advances in Neural Information Processing Systems (NeurIPS), 2020. [64] Xingtong Yu, Shenghua Ye, Ruijuan Liang, Chang Zhou, Hong Cheng, Xinming Zhang, and Yuan Fang. Evaluating progress in graph foundation models: A comprehensive benchmark and new insights. arXiv preprint arXiv:2603.10033, 2026. [65] Xiangchi Yuan, Yijun Tian, Chunhui Zhang, Yanfang Ye, Nitesh V Chawla, and Chuxu Zhang. Graph cross supervised learning via generalized knowledge. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 4083–4094, 2024. doi: 10.1145/3637528.3671830. [66] Xiangchi Yuan, Chunhui Zhang, Yijun Tian, Yanfang Ye, and Chuxu Zhang. Mitigating emergent robustness degradation while scaling graph learning. In International Conference on Learning Representations, 2024. [67] Chuxu Zhang, Dongjin Song, Chao Huang, Ananthram Swami, and Nitesh V Chawla. Heterogeneous graph neural network. In Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery and data mining (KDD), pages 793–803, 2019. [68] Qihai Zhang, Xinyue Sheng, Yuanfu Sun, and Qiaoyu Tan. TrustGLM: Evaluating the robustness of graph LLMs against prompt, text, and structure attacks. arXiv preprint arXiv:2506.11844, 2025. [69] Tianxiang Zhao, Xiang Zhang, and Suhang Wang. GraphSMOTE: Imbalanced node classification on graphs with graph neural networks. In Proceedings of the 14th ACM International Conference on Web Search and Data Mining (WSDM), 2021. [70] Qinkai Zheng, Xu Zou, Yuxiao Dong, Yukuo Cen, Da Yin, Jiarong Xu, Yang Yang, and Jie Tang. Graph robustness benchmark: Benchmarking the adversarial robustness of graph machine learning. In Advances in Neural Information Processing Systems (NeurIPS) Datasets and Benchmarks Track, 2021.

Datasets

Dataset statistics. We use twenty-five text-attributed graphs spanning seven domains, sourced from TSGFM [6] and TAGLAS [13]. Per-dataset statistics (domain, task, node and edge counts, class count, source) are reported in Table 4. We use the canonical train/validation/test split provided by each source repository, and repeat each method-dataset cell with five random seeds that rerandomize model initialization. Because all datasets are text-attributed, we use Sentence-BERT [38] to encode each canonical text attribute (paper abstract, product description, item title, atom symbol, or relation phrase) into a 768-dimensional vector, yielding a single feature space shared across methods, consistent with the view of graphs as a unifying substrate across heterogeneous data modalities [29].

Table 4: Datasets used in GRL-Safety. Task: NC = node classification, LP = link prediction, GC = graph classification. For graph-classification datasets, #Nodes and #Edges are aggregated across all graphs in the dataset, and #Classes denotes the number of tasks in multi-task molecular benchmarks. Dataset

Domain

Task

#Nodes

#Edges #Classes Source

Cora CiteSeer PubMed arXiv arXiv23 arXivYear DBLP

Academic Academic Academic Academic Academic Academic Academic

NC NC NC NC NC NC NC

2,708 10,556 3,186 8,450 19,717 88,648 169,343 2,315,598 46,198 77,726 169,343 2,315,598 14,376 431,326

7 6 3 40 40 5 4

[6] [6] [6] [6] [6] [6] [6]

Elec-Computers ElePhoto SportsFit AmazonRatings

E-commerce E-commerce E-commerce E-commerce

NC NC NC NC

87,229 1,256,548 48,362 873,793 173,055 3,020,134 24,492 186,100

10 12 13 5

[6] [6] [6] [6]

BookChild BookHis

Book Book

NC NC

76,875 2,325,044 41,551 503,180

24 [6] 12 [6]

WikiCS Tolokers

Web platform Web platform

NC NC

11,701 11,758

431,726 519,000

10 [6] 2 [13]

WN18RR FB15K237

Knowledge graph Knowledge graph

LP LP

40,943 14,541

93,003 310,116

11 [13] 237 [13]

ML1M

Recommendation

9,923 2,000,418

5 [13]

BACE BBBP ChemHIV CYP450 MUV Tox21 ToxCast

Molecule Molecule Molecule Molecule Molecule Molecule Molecule

GC GC GC GC GC GC GC

51,577 111,536 49,068 105,842 1,049,163 2,259,376 414,367 895,886 2,255,846 4,892,252 145,459 302,190 161,002 330,180

1 1 1 5 17 12 588

[13] [13] [13] [13] [13] [13] [13]

Note. Pretrained methods additionally use ChemBLPre and ChemPCBA as pretraining-only molecular corpora. These corpora are excluded from downstream evaluation and therefore not counted among the 25 benchmark datasets in Table 4. Licenses and credit. All datasets are public academic graphs accessed through the TSGFM [6] and TAGLAS [13] collections and are used in accordance with the licenses of their original sources (for example, the OGB datasets [20] under their MIT-style benchmark license, WikiCS under CC-BYSA, and MoleculeNet datasets under their respective open data licenses). Method implementations (DeepWalk, Node2vec, GCN, GAT, GraphSAGE, BGRL, GraphMAE, GFT, GIT, UniGraph2, OFA, LLaGA) are cited at first mention and adapted from the authors’ public repositories under their respective open-source licenses (MIT, Apache 2.0, or BSD as released); no license terms are modified. 16

Methods

This appendix lists the twelve graph representation models evaluated in GRL-Safety, grouped by tier (§3.1). Pretraining and downstream-adaptation hyperparameters for each method are documented separately in Appendix C (Implementation details). B.1

Shallow graph embeddings

DeepWalk [35]. A shallow node embedding method that learns representations by applying Skipgram to uniform random walks over the graph. Node2vec [14]. A shallow node embedding method that extends DeepWalk with biased secondorder random walks interpolating between breadth- and depth-first neighbourhood exploration. B.2

Supervised GNNs

GCN [24]. A message-passing GNN that aggregates neighbour features through symmetric normalised graph convolutions. GAT [48]. A GNN that aggregates neighbour features through learned multi-head attention weights. GraphSAGE [17]. A GNN that generates node representations by sampling and aggregating features from a node’s local neighbourhood. B.3

Self-supervised graph models

BGRL [46]. A self-supervised graph representation method that learns by bootstrapping latent target predictions across two augmented views, without negative samples. GraphMAE [19]. A self-supervised graph representation method that uses masked-feature reconstruction with a scaled cosine error to pretrain a generative graph autoencoder. B.4

Graph foundation models

GFT [53]. A graph foundation model that converts cross-domain graph tasks into a shared computation-tree vocabulary and adapts to downstream tasks via prototype matching against learned tree codes. GIT [55]. A graph foundation model pretrained with task-tree reconstruction over node-, edge-, and graph-level tasks, learning generalities across heterogeneous graphs. UniGraph2 [18]. A multi-domain graph foundation model that aligns features from different domains through routed mixture-of-experts on top of a shared embedding space. OFA [31]. A graph foundation model that unifies node, link, and graph tasks by reformulating each query as a binary link-prediction problem over an augmented prompt graph containing class and task-of-interest nodes. LLaGA [5]. An LLM-based graph foundation model that projects a node’s local neighbourhood into a Vicuna-7B token sequence and reads predictions from the language-model head.

Implementation details

This appendix documents the pretraining and downstream-adaptation hyperparameter settings used in GRL-Safety. Method descriptions are in Appendix B; per-axis stress-operator definitions are in Appendix D. 17

C.1

Pretraining hyperparameters

The two self-supervised methods (BGRL, GraphMAE) and the five graph foundation models (GFT, GIT, UniGraph2, OFA, LLaGA) pretrain on the same nine text-attributed graphs (cora, pubmed, arxiv, wikics, WN18RR, FB15K237, ChemHIV, ChemBLPre, ChemPCBA) adopted by GFT [53] and OFA [31]. Each method optimizes its native objective on this shared corpus, with hyperparameters following its source repository. The three supervised baselines (GCN, GAT, GraphSAGE) and the two topology-only methods (DeepWalk, Node2vec) have no pretraining stage; they are trained end-to-end on each downstream graph (see Appendix C.2). Per-method settings for the pretrained methods are as follows. BGRL [46]: num_layers=2, num_hidden=768, lr=1e-4, 1. For weight_decay=1e-5, max_epoch=50, batch_size=1024, ema_tau=0.99, warmup_frac=0.1, drop_edge=0.2, drop_feat=0.2, predictor_hidden=512, optimizer=AdamW. 2. For GraphMAE [19]: num_layers=2, num_hidden=768, num_heads=4, lr=1e-3, weight_decay=2e-4, max_epoch=50, batch_size=1024, mask_rate=0.5, replace_rate=0.0, loss=sce, alpha_l=3.0, in_drop=0.2, attn_drop=0.1, optimizer=AdamW. GFT [53]: num_layers=2, hidden_dim=768, dropout=0.15, 3. For pretrain_lr=1e-4, pretrain_weight_decay=1e-5, pretrain_epochs=50, pretrain_batch_size=1024, codebook_size=128, codebook_head=4, codebook_decay=0.8, feat_p=0.2, edge_p=0.2, topo_recon_ratio=0.1, optimizer=AdamW. num_layers=2, hidden_dim=768, dropout=0.15, lr=1e-7, 4. For GIT [55]: weight_decay=1e-8, epochs=20, batch_size=4096, fanout=10, ema=0.99, feat_p=0.2, edge_p=0.2, topo_recon_ratio=0.1, optimizer=AdamW. 5. For UniGraph2 [18]: num_layers=3, num_hidden=768, num_experts=8, num_selected_experts=2, lr=1e-4, weight_decay=1e-5, max_epoch=50, batch_size=64, gamma=2.0, lambda_spd=0.5, feat_drop_rate=0.1, edge_mask_rate=0.1, fanout=10, optimizer=AdamW. 6. For OFA [31]: num_layers=7, num_hidden=768, dropout=0.15, lr=1e-3, num_epochs=50, batch_size=128, num_relations=5, JK=none, optimizer=AdamW. 7. For LLaGA [5], following the original two-stage recipe, only the projector is trained with the Vicuna-7B language model frozen: llm_backbone=Vicuna-7B (frozen), projector_type=2-layer-mlp, projector_hidden=4096, lr=5e-4, weight_decay=1e-4, epochs=10, batch_size=4, sample_size=10, use_hop=2, max_text_len=128, max_steps=5000, dtype=bfloat16, optimizer=AdamW. C.2

Downstream adaptation hyperparameters

For each method-dataset cell we apply the method’s native downstream adaptation procedure end-toend with AdamW and five random seeds. Per-method settings are as follows. 1. For DeepWalk [35], walk embeddings are fitted on the downstream graph with Skip-gram on uniform random walks (p=q=1): emb_dim=128, walk_length=20, walks_per_node=10, context_size=10, num_negative=1, walk_epochs=100, batch_size=128, lr=1e-2, optimizer=SparseAdam. Predictions use a frozenfeature ℓ2 -regularised logistic-regression head (scikit-learn, C=1.0, max_iter=1000, solver=lbfgs). 2. For Node2vec [14]: same Skip-gram and logistic-regression configuration as DeepWalk, with biased second-order walks (p=1.0, q=0.5, BFS-leaning). 3. For GCN, GAT, and GraphSAGE: num_layers=2, num_hidden=768, lr=1e-3, dropout=0.2, weight_decay=1e-4, max_epochs=500, patience=200. 18

4. For BGRL [46]: num_layers=2, num_hidden=768, lr=5e-4, dropout=0.2, weight_decay=1e-5, max_epochs=500, patience=200. GraphMAE [19]: num_layers=2, num_hidden=768, lr=1e-3, 5. For weight_decay=1e-4, dropout=0.2, max_epochs=500, patience=200. 6. For UniGraph2 [18]: num_layers=3, num_hidden=768, num_experts=8, num_selected_experts=2, lr=1e-3, weight_decay=1e-4, dropout=0.2, max_epochs=500, patience=200. 7. For GFT [53]: num_layers=2, hidden_dim=768, dropout=0.15, finetune_lr=5e-4, finetune_epochs=1000, early_stop=200, batch_size=full. 8. For GIT [55]: num_layers=2, hidden_dim=768, dropout=0.15, lr=1e-4, sft_epochs=100, weight_decay=0, batch_size=full. num_layers=7, num_hidden=768, dropout=0.15, lr=1e-3, 9. For OFA [31]: weight_decay=0, epochs=100, patience=30, prompt_graph_mode=subgraph, subgraph_hops=2. 10. For LLaGA [5]: lr=1e-3, weight_decay=1e-4, max_epochs=15, patience=3, sample_size=10, max_text_len=128, batch_size=8, dtype=bfloat16. All methods use cross-entropy loss with their native prediction head: GFM tier methods (GFT/GIT/UniGraph2) use prototype or code-based classification; OFA uses class-node link scoring with binary cross-entropy; LLaGA uses the language-model head over a verbalised class vocabulary; the remaining methods use a linear classification head. No class reweighting, focal loss, or oversampling is applied. C.3

Compute resources

All experiments were run on a shared university HPC cluster (SLURM scheduler, general-gpu partition) with single-GPU jobs. The GPU pool consists of NVIDIA L40 (48 GB VRAM) and NVIDIA A100 (40 GB VRAM) accelerators, allocated with 4–8 CPU cores and 32–192 GB of system memory per job depending on dataset size. Per method-dataset-seed cell, wall-clock time ranges from approximately 5–30 minutes on small nodeclassification graphs (Cora, CiteSeer, PubMed, ArXiv23, DBLP, AmazonRatings, WikiCS, Tolokers, and BookHis), 30 minutes to 2 hours on medium graphs and link-prediction datasets (ElePhoto, Elec-Computers, BookChild, WN18RR, FB15K237, and ML1M) and on smaller molecular graphclassification corpora (BACE, BBBP, Tox21, and ToxCast), and 2–6 hours on large node-classification graphs (arXiv, arXivYear, and SportsFit) and larger molecular graph-classification corpora (CYP450, ChemHIV, and MUV). Dataset statistics are reported in Table 4. Joint-corpus pretraining of each SSL backbone is a one-off cost on the order of 8–24 GPU-hours. The total compute for the experiments reported in this paper is approximately on the order of 104 GPU-hours, aggregating across methods, datasets, safety axes, and seeds. The full research project, including preliminary configurations and discarded intermediate runs, required additional compute beyond the final reported numbers.

Safety dimension details

This appendix gives, for each of the five safety dimensions of GRL-Safety, the per-axis stress operator referenced in §3.2. Method-side hyperparameters are in Appendix C; per-dimension extended numerical results are in Appendix E. Dataset coverage is axis-specific. Degree-shift OOD is evaluated on the node-classification datasets covered in this subcondition, with the main text showing six representative datasets and the appendix reporting the complete degree-shift results for this evaluated set. Class imbalance is evaluated on eight categorical-label node-classification datasets, while structural fairness is evaluated on eight node-classification datasets with degree-based head-tail groups. Interpretation is evaluated on eight node-classification datasets for methods whose adaptation interface exposes edge-level attribution. 19

Temporal, scaffold, and inductive-entity shifts are defined on datasets that provide the corresponding time, molecular scaffold, or entity split. Table 5 summarises which (method, dimension) cells are evaluated. All twelve methods are evaluated on the corruption, OOD, imbalance, and fairness dimensions, with sub-condition restrictions for the topology-only methods: DeepWalk and Node2vec consume only graph structure, so under corruption they are evaluated on the structure-noise channel only (feature noise is inapplicable), and under OOD they are evaluated on the node-classification shifts (degree and temporal) but not on the graph-classification scaffold shift or the link-prediction inductive-entity shift, which require task-format adaptations they do not provide. The interpretation dimension is restricted to the eight feature-consuming non-LLM methods: OFA’s prompt-graph reformulation reframes each query as binary link prediction over an augmented prompt graph, which is not directly compatible with the edge-saliency operator on the original graph; LLaGA’s frozen Vicuna-7B language-model head precludes meaningful gradient saliency through the LLM; and DeepWalk/Node2vec’s inference path does not condition on individual edges (random walks fold the graph into static node embeddings before downstream prediction). Table 5: Coverage of (method, safety dimension) cells in GRL-Safety. ✓ = evaluated; − = not evaluated (adaptation interface incompatible with the per-axis stress operator; see paragraph above).

D.1

Method

Corruption

OOD

Imbalance

Fairness

Interpretation

DeepWalk Node2vec

✓ ✓

− −

GCN GAT GraphSAGE

✓ ✓ ✓

BGRL GraphMAE

✓ ✓

GFT GIT UniGraph2 OFA LLaGA

✓ ✓ ✓ ✓ ✓

✓ ✓ ✓ − −

Corruption

We evaluate robustness to two complementary input-corruption operationalizations applied at inference time: feature noise, which perturbs node attributes [32], and structure noise, which perturbs graph topology [40]. In both cases the model is trained on the clean graph, its parameters are frozen, and it is then evaluated under six severity levels (severity 0 = clean and five non-zero severities) with a deterministic per-(split, severity) random seed for reproducibility. Performance is measured with classification accuracy on node-classification datasets, AUC-ROC on link-prediction datasets, and AUC on graph-classification datasets. Feature noise. At inference time, independent zero-mean Gaussian noise is added to every node’s feature vector, with the noise scaled per feature dimension by the training-set per-dimension standard deviation: xnoisy = x + σrel · std(Xtrain ) ⊙ ε, ε ∼ N (0, I). The relative noise scale takes five values σrel ∈ {0.1, 0.25, 0.5, 1.0, 2.0}. Edges, labels, train/validation/test splits, and the trained model parameters are not modified. Per-dataset severity curves across all ten feature-consuming methods are reported in Figure 6 (DeepWalk and Node2vec do not consume node features and are therefore excluded from feature-noise evaluation). Structure noise. At inference time, a fraction p of undirected edges is removed uniformly at random; both directions of each selected edge are dropped jointly so that the perturbed graph remains symmetric, and self-loops (when present) are preserved. The drop rate takes five values p ∈ {0.05, 0.10, 0.20, 0.30, 0.50}. Node features, labels, train/validation/test splits, and the trained 20

model parameters are not modified. Per-dataset severity curves across all twelve methods are reported in Figure 7. D.2

Out-of-distribution generalization

We evaluate four complementary graph-context shifts that target different aspects of the input distribution: degree shift on node attributes’ structural neighbourhood, temporal shift on publication time, scaffold shift on molecular substructure, and inductive KG shift on the entity vocabulary visible at test time. Following the spirit of mechanism-level evaluation in graph OOD benchmarks [15], in every case the model is trained on the in-distribution (ID) training partition and evaluated on a held-out out-of-distribution (OOD) partition that shares the task definition but differs in the targeted distribution. Degree shift. For each node-classification dataset, labelled nodes are sorted by node degree in descending order; the top 60% form the training pool, the next 20% form the OOD validation set, and the bottom 20% form the OOD test set. The protocol matches GOOD’s covariate-shift setup [15]. We report the ID-to-OOD accuracy drop ∆ = accID − accOOD per (method, dataset) cell. Per-dataset heatmaps for the representative six-dataset subset are reported in Figure 3a (main text), with full per-dataset results in Appendix E.2. Temporal shift. On the arXiv citation network, training uses papers with publication year ≤ 2010 and OOD evaluation uses papers from ≥ 2017, with intermediate years 2011–2016 reserved as OOD validation. The thirteen-year gap follows the aggressive temporal-shift design of Huang et al. [22] and reflects the kind of evolving-graph context studied in continuous subgraph search over dynamic graphs [27] and, more broadly, in graph neural networks for database systems [28]. We report the ID-to-OOD accuracy drop sorted across the twelve methods in Figure 3b. Scaffold shift. On the molecular graph-classification datasets BACE and Tox21, we compare random splits against Bemis–Murcko scaffold splits [20]: molecules are grouped by their Bemis– Murcko scaffold (computed from the canonical SMILES) and the train, validation, and test sets receive disjoint scaffold groups in an 80 : 10 : 10 ratio. We report the AUC drop ∆AUC = AUCrand − AUCscaffold , so a smaller ∆AUC indicates better generalization to unseen scaffolds. Inductive KG shift. On the knowledge-graph link-prediction datasets WN18RR and FB15K237, we construct an inductive split by randomly partitioning the entity set into a training pool and a test pool (75 : 25). All facts whose head and tail are both in the training pool are kept for downstream KG training; queries whose candidate entity is in the test pool form the inductive test queries. We report MRR and Hits@10, both standard ranking metrics in inductive KG evaluation. Specifically, MRR is the mean reciprocal rank of the correct entity over test queries, and Hits@10 is the fraction of test queries where the correct entity is ranked in the top 10 candidates. Test entities are unseen during downstream training and require the method to generalize beyond the entity vocabulary observed at training time. D.3

Class imbalance

We follow a step-imbalance protocol on each node-classification dataset. Classes are sorted in ascending order of their original training-set sample count; the lower half are designated as minor classes and the upper half as major classes. Let nmajor = maxc∈major nc denote the maximum training count among major classes. Each minor class is then randomly downsampled to nminor = max 1, ⌊nmajor /ρ⌋ training instances at imbalance ratio ρ ∈ {5, 10, 20}, with the major-class training samples, the validation set, and the test set left untouched. The per-cell sampling is deterministic given the seed. We report balanced accuracy (bAcc), macro-F1, and per-class recall on the test split, averaged separately across major and minor classes. Per-dataset per-class recall at all three imbalance ratios is reported in Appendix E.3. 21

D.4

Fairness

We evaluate two complementary fairness operationalizations: structural fairness, which measures the disparity in prediction quality between high- and low-degree nodes, and demographic fairness, which measures the disparity between groups defined by a protected demographic attribute. In both cases the model is trained without any fairness-aware modification (no group reweighting, no constrained loss), so the measurements isolate each method’s intrinsic group disparity under our unified fine-tuning protocol. Structural fairness. Following the head/tail degree-disparity formulation of Tang et al. [45], on each node-classification dataset test nodes are partitioned by degree quantile: with q = 0.2, the highest-degree 20% of test nodes form the head group, and the lowest-degree 20% form the tail group; the middle 60% is not assigned to either group for the gap measurement. We report per-group test accuracy (acchead , acctail ) and the head−tail accuracy gap ∆HT = acchead − acctail . A larger positive gap indicates a more pronounced low-degree disadvantage. Per-dataset results across the eight node-classification datasets are reported in Appendix E.4. Demographic fairness. Demographic fairness is evaluated on the Tolokers banned-user-prediction dataset, with the user education attribute as a binary sensitive attribute (s=1 for users with higher education, s=0 otherwise) following the protocol of Dong et al. [10]. We report three group-disparity quantities at test time: ∆SP = |P (ŷ=1 | s=0) − P (ŷ=1 | s=1)|, ∆EO = |P (ŷ=1 | s=0, y=1) − P (ŷ=1 | s=1, y=1)|, ∆Util = |AUC(s=0) − AUC(s=1)|. ∆SP measures statistical-parity disparity, ∆EO measures equalized-odds disparity, and ∆Util measures the per-group AUC gap. Smaller values indicate smaller group disparity. Full per-method results are reported in Appendix E.4. D.5

Interpretation

We evaluate post-hoc explanation fidelity at two task levels: node-level interpretation on nodeclassification datasets via edge-saliency subgraph ablation, and graph-level interpretation on molecular graph-classification datasets via atom-saliency node ablation. Both follow the GraphFramEx characterization-score protocol of Amara et al. [2]. Node-level interpretation. For each test node we restrict the receptive field to the K-hop computational subgraph (K=2) and compute per-edge saliency by aggregating the gradient-based input attribution at its two endpoints: S(u,v) = ∂ logitŷ /∂xu + ∂ logitŷ /∂xv . Edges are then ranked by S(u,v) and we evaluate at four sparsity levels k ∈ {5, 10, 20, 50}%. With p0 the clean predicted-class probability and p+k , p−k the probabilities after masking the top-k and the complementary edges respectively, we report Fid+ = p0 − p+k −

Fid = p0 − p−k

(higher better), (lower better),

2 · Fid · (1 − Fid− ) Fid+ + (1 − Fid− ) + ϵ +

char =

(higher better),

where char is the GraphFramEx characterization score, a harmonic-style combination of Fid+ and (1 − Fid− ) with values in [0, 1]. To control for saliency-method specificity, every metric is reported for both gradient saliency and a uniform-random baseline, and the headline lift is ∆char = chargrad − charrandom . The full per-dataset sparsity sweep and the per-dataset Fid+ /Fid− decomposition at k=10% are reported in Appendix E.5. 22

Graph-level interpretation. For each test molecule we compute per-atom saliency as the L1 -norm gradient of the predicted-class logit with respect to that atom’s input features. Atoms are then ranked by saliency and the same Fidelity quantities are computed by ablating the top-k or the complementary atoms (atom removal also drops the incident bonds and pool entries). Edge saliency, when needed for the subgraph ablation, is derived as the sum of the two endpoint atom saliencies. Per-method graph-level interpretation results on the molecular datasets are reported in Appendix E.5.

Extended Experimental Results

E.1

Corruption

E.1.1

Feature Noise Cora

CiteSeer

PubMed

ArXiv23

ArXivYear

60 50 40

ElePhoto

70 65 60

BookHis

SportsFit

90 80 70 60 50 40

Protein-HS

WikiCS

100 95 90 85 80 75

ML1M

70 82.5

ChemHIV

77.5

75.0

72.5

AmazonRatings

40 30

WN18RR

MUV

77.5 75.0 72.5 70.0 67.5 65.0

ToxCast

.0 =2

GCN GAT SAGE =.

.0 =2

25 =.

Cle

BACE

Cle

FB15K237

72.5 70.0 67.5 65.0 62.5 60.0

100.0 97.5 95.0 92.5 90.0 87.5

Tox21

BookChild 50

CYP450

80.0

ML1M-cls

BBBP

ElecComp 70

90 85 80 75 70 65

DBLP

ArXiv 70

BGRL GraphMAE UniGraph2

GIT GFT

OFA LLaGA

Figure 6: Per-dataset feature-noise severity curves on GRL-Safety datasets. Each panel reports test accuracy (NC) or AUC (LP, GC) at clean and the five relative noise scales (σrel ∈{0.1, 0.25, 0.5, 1.0, 2.0}).

E.1.2 80

Edge Deletion Cora

ArXiv23 70

ArXivYear

ElePhoto

75 70

90 89 88 87 86

SportsFit

80.0 77.5 75.0 72.5 70.0 67.5

Protein-HS

72 70 68 66

ElecComp

50.0

75 70 65

AmazonRatings

47.5 45.0

50 45

40.0 37.5

WikiCS

BookChild 55

42.5

BookHis

ArXiv

DBLP

PubMed

74 72 70 68 66 64

85.0 82.5 80.0 77.5 75.0 72.5

80 75 70 65 60 55

CiteSeer

100.0 97.5 95.0 92.5 90.0 87.5

ML1M

WN18RR

94 92 90

ML1M-cls

BACE

BBBP 80 75 70 65 60

ChemHIV

MUV 75 70 65 60

ToxCast 70

GCN GAT SAGE

Cle an p= .0 5 p= .1 0 p= .2 0 p= .3 0 p= .5 0

CYP450

Tox21 80

FB15K237

BGRL GraphMAE UniGraph2

GIT GFT OFA

LLaGA DeepWalk Node2Vec

Figure 7: Per-dataset edge-deletion severity curves on GRL-Safety datasets. Each panel reports test accuracy (NC) or AUC (LP, GC) at clean and the five edge-drop probabilities (p∈{0.05, 0.10, 0.20, 0.30, 0.50}).

E.2

Out-of-Distribution Generalization — full results

Table 6: Full per-dataset OOD degree-shift results across all 13 datasets (mean±std over 5 seeds). Each block shows up to four datasets side by side; per (dataset, column), bold = best; underline = second. Gap = ID − OOD, smaller |Gap| more robust. “–” indicates the method was not evaluated on that dataset. Method

cora ID

OOD

citeseer Gap

pubmed

OOD

Gap

OOD

arxiv Gap

OOD

Gap

DeepWalk Node2Vec

86.79±1.57 66.49±1.04 +20.30 71.22±1.12 40.75±1.98 +30.47 83.13±0.36 73.14±0.55 +9.99 73.67±0.24 49.14±0.16 +24.53 87.23±1.66 65.83±1.69 +21.40 71.35±1.75 41.07±1.31 +30.28 83.67±0.39 73.35±0.56 +10.33 73.53±0.35 49.07±0.12 +24.46

GCN GAT SAGE

88.94±1.98 80.37±1.90 +8.58 80.69±0.96 68.30±1.51 +12.39 88.99±0.57 85.79±0.58 +3.20 78.63±0.21 62.75±0.13 +15.88 89.00±1.90 81.20±1.15 +7.80 80.65±1.26 67.72±1.77 +12.93 88.60±0.44 84.27±0.21 +4.33 78.61±0.16 61.88±0.13 +16.72 87.13±2.20 80.16±0.96 +6.97 81.05±0.60 67.39±1.86 +13.66 90.27±0.58 88.23±0.37 +2.04 79.10±0.29 61.86±0.23 +17.24

BGRL 88.87±1.79 82.21±0.91 GraphMAE 88.92±2.06 81.67±0.95 UniGraph2 85.80±2.57 78.07±1.63 87.56±1.39 81.31±1.31 GIT GFT 86.92±1.76 81.90±1.33 OFA 87.08±2.81 77.93±1.32 84.35±3.80 76.57±1.40 LLaGA Method

+6.66 +7.25 +7.73 +6.24 +5.03 +9.15 +7.78

80.34±0.89 70.16±0.99 +10.18 89.42±0.55 86.80±0.55 80.74±1.47 69.51±1.01 +11.23 88.80±0.44 85.07±0.31 78.19±1.59 66.83±1.47 +11.37 87.72±0.63 84.51±0.47 81.47±0.65 68.40±1.20 +13.07 89.62±0.31 86.84±0.17 80.60±1.69 68.32±1.25 +12.28 90.26±0.74 88.82±0.48 78.18±2.13 60.88±2.06 +17.30 85.29±0.93 81.06±1.09 78.37±1.85 60.47±2.36 +17.90 86.86±1.74 81.66±0.73

arxiv23 ID

OOD

dblp Gap

+2.62 +3.73 +3.21 +2.78 +1.44 +4.24 +5.20

79.36±0.21 64.58±0.85 +14.78 79.40±0.20 63.58±0.44 +15.82 77.68±0.26 60.53±0.25 +17.16 78.79±0.24 62.47±0.13 +16.32 75.91±0.38 58.01±0.44 +17.91 74.06±0.51 59.70±0.23 +14.36 –

wikics

OOD

Gap

OOD

elecomp Gap

OOD

Gap

DeepWalk Node2Vec

32.83±0.84 19.08±0.45 +13.74 76.08±0.64 44.45±1.11 +31.63 82.41±1.25 61.64±0.55 +20.77 78.86±0.42 62.95±0.15 +15.91 32.61±0.94 19.01±0.15 +13.60 76.23±0.54 43.93±1.15 +32.30 83.16±0.82 61.63±1.62 +21.53 79.01±0.47 62.72±0.14 +16.29

GCN GAT SAGE

71.17±0.56 66.88±0.21 +4.29 79.66±1.13 75.24±1.81 +4.42 85.74±0.86 68.41±3.01 +17.33 86.91±0.40 68.37±0.42 +18.54 71.05±0.36 66.50±0.54 +4.55 79.64±0.82 71.77±3.33 +7.88 85.99±0.63 72.24±1.77 +13.75 86.66±0.29 67.19±0.24 +19.47 72.86±0.48 67.75±0.22 +5.11 81.76±0.85 76.54±1.70 +5.22 86.49±0.47 76.15±1.00 +10.34 87.35±0.35 68.82±0.35 +18.53

BGRL 72.57±0.54 68.76±0.25 GraphMAE 72.96±0.36 68.13±0.18 UniGraph2 67.12±0.69 60.45±0.49 71.73±0.50 66.31±0.14 GIT GFT 70.56±0.65 64.47±0.44 OFA 65.44±0.70 55.97±0.43 LLaGA 69.90±2.89 65.13±1.18 Method

+3.81 +4.83 +6.67 +5.42 +6.09 +9.47 +4.77

79.50±1.12 73.25±4.08 +6.25 87.10±0.82 65.79±3.48 +21.31 87.34±0.43 68.84±0.56 +18.51 79.99±1.05 75.54±0.68 +4.46 85.64±0.70 76.51±0.84 +9.13 88.34±0.33 70.12±0.18 +18.22 79.22±1.07 74.52±0.89 +4.70 83.35±0.61 71.80±0.89 +11.55 85.68±0.32 64.38±0.62 +21.29 81.78±1.11 76.24±1.19 +5.54 85.87±0.49 73.84±0.83 +12.03 87.46±0.40 69.15±0.38 +18.30 81.81±0.81 74.43±0.62 +7.38 86.75±0.84 72.81±2.02 +13.94 85.94±0.18 67.92±0.55 +18.02 79.03±0.77 70.55±2.16 +8.48 83.42±1.23 68.65±0.61 +14.77 87.02±0.66 74.51±0.40 +12.51 76.92±0.61 65.50±1.88 +11.42 82.54±1.52 67.68±1.64 +14.86 –

elephoto ID

OOD

sportsfit Gap

amazonratings

OOD

Gap

OOD

bookchild Gap

OOD

Gap

DeepWalk Node2Vec

74.93±0.71 60.20±0.23 +14.72 88.84±0.17 63.61±0.23 +25.23 38.39±0.50 37.29±0.28 +1.10 47.97±0.40 32.20±0.44 +15.77 75.14±0.37 60.71±0.30 +14.43 88.97±0.18 63.69±0.13 +25.28 38.31±0.63 36.99±0.46 +1.32 47.96±0.28 32.26±0.47 +15.70

GCN GAT SAGE

84.03±0.34 70.28±0.76 +13.76 92.33±0.20 77.77±0.22 +14.56 43.11±0.85 43.59±0.59 -0.47 57.33±0.39 43.41±0.46 +13.92 83.87±0.51 68.29±0.94 +15.59 91.54±0.16 75.17±0.12 +16.37 40.21±0.90 41.08±1.29 -0.87 57.75±0.34 43.59±0.22 +14.16 84.76±0.46 71.50±0.76 +13.26 92.91±0.14 77.47±0.20 +15.44 41.27±1.13 44.15±2.97 -2.89 60.85±0.33 45.47±0.53 +15.38

BGRL 84.84±0.23 71.49±0.53 +13.35 92.95±0.15 78.25±0.24 +14.70 42.59±0.96 43.34±0.68 -0.75 58.66±0.41 45.49±0.76 +13.17 GraphMAE 85.72±0.24 71.88±0.28 +13.84 93.48±0.15 80.51±0.21 +12.97 42.74±0.72 43.70±0.87 -0.96 59.52±0.32 45.21±0.32 +14.31 UniGraph2 82.96±0.47 67.86±0.78 +15.10 91.63±0.21 74.27±0.31 +17.36 41.54±0.71 41.98±0.87 -0.43 56.25±0.45 43.28±0.42 +12.97 GIT 84.58±0.57 70.89±0.80 +13.68 92.91±0.15 77.12±0.18 +15.80 40.14±0.91 45.24±1.32 -5.10 60.63±0.18 45.86±0.37 +14.76 GFT 83.32±0.45 68.26±0.65 +15.05 92.35±0.21 75.68±0.40 +16.66 40.86±1.00 41.82±1.58 -0.96 55.23±0.47 40.19±0.54 +15.04 OFA 84.18±0.48 72.08±0.58 +12.11 87.14±0.34 68.65±0.64 +18.49 37.10±0.64 36.16±1.01 +0.94 41.95±0.87 32.46±1.31 +9.49 LLaGA – – 39.60±1.95 39.93±2.27 -0.33 – Method

bookhis ID

OOD

Gap

DeepWalk Node2Vec

79.18±0.59 69.43±0.25 +9.75 78.96±0.52 69.10±0.50 +9.85

GCN GAT SAGE

83.61±0.51 81.51±0.57 +2.09 83.67±0.34 80.60±0.98 +3.07 84.79±0.45 82.64±0.24 +2.15

BGRL 84.17±0.66 82.26±0.38 +1.91 GraphMAE 84.40±0.59 82.31±0.24 +2.08 UniGraph2 83.04±0.63 80.10±0.43 +2.94 GIT 84.29±0.43 82.25±0.31 +2.04 GFT 83.33±0.49 80.48±0.46 +2.85 OFA 79.91±0.83 75.89±0.76 +4.02 LLaGA 82.40±1.95 80.26±0.40 +2.14

E.3

Class imbalance — full results

Table 7: Per-class recall on 8 NC datasets (%): major / minor at imbalance ratios ρ ∈ {5, 10, 20}, mean±std over 5 seeds. Major and minor groups are ranked independently; bold / underline mark the best and second-best methods in each column. Cells marked ‘–’ indicate the method collapsed to majority-class predictions and minor recall is uninformative. Method

cora

DeepWalk Node2vec

citeseer

ρ=5

ρ=10

ρ=20

ρ=5

ρ=10

ρ=20

84.0±0.6 /24.4±4.2 84.7±0.6 /23.4±4.1

84.9±1.0 /7.1±2.6 85.7±0.6 /7.0±2.1

85.0±0.9 /1.9±1.7 85.8±0.8 /1.9±1.5

53.2±1.1 /9.9±3.5 53.5±1.9 /9.9±3.4

53.7±1.5 /1.6±0.7 54.4±2.1 /1.6±0.7

54.1±1.3 /0.2±0.1 54.3±2.0 /0.3±0.2

GCN 85.8±2.0 /58.3±4.4 87.9±1.3 /41.3±8.2 89.9±1.0 /24.7±10.2 73.7±1.8 /41.1±4.9 75.4±2.3 /28.3±8.6 76.9±1.2 /17.5±6.6 GAT 83.8±1.6 /62.3±5.0 85.1±2.9 /47.4±9.4 88.2±2.0 /27.6±12.6 72.5±2.1 /45.0±5.8 73.5±2.0 /34.2±8.2 76.3±1.8 /18.2±9.1 GraphSAGE 86.8±1.3 /49.4±4.5 86.7±1.2 /38.3±5.3 87.9±0.8 /24.2±6.6 74.6±1.1 /38.9±3.0 73.9±1.5 /33.5±4.4 75.2±1.3 /23.8±5.3 BGRL 88.2±0.9 /50.5±4.2 89.8±0.8 /35.4±4.9 91.0±0.8 /20.6±9.0 73.9±1.7 /36.4±3.7 75.8±1.0 /23.4±6.4 77.6±1.0 /11.4±4.3 GraphMAE 88.4±1.2 /56.8±6.0 90.3±0.7 /40.7±7.8 91.0±0.8 /19.7±11.9 77.2±1.4 /36.4±4.2 79.0±1.3 /21.8±7.6 80.6±0.9 /9.2±4.9 UniGraph2 GIT GFT

77.8±4.4 /55.5±7.5 76.9±7.0 /42.3±5.5 87.8±1.2 /44.3±5.5 88.8±1.5 /29.4±5.2 84.6±1.6 /53.6±5.5 87.6±1.6 /36.1±6.6

OFA LLaGA

83.0±0.2 /47.3±8.2 84.2±0.8 /34.7±8.0 85.5±0.5 /18.0±6.6 83.6±2.0 /63.9±7.9 85.4±1.1 /54.1±10.0 87.8±1.3 /37.1±8.0

Method

81.2±3.3 /23.1±9.2 63.9±5.8 /45.6±10.8 69.0±4.1 /32.1±5.7 68.3±4.3 /24.9±5.0 89.1±0.5 /17.6±5.1 75.3±1.0 /36.3±2.9 75.3±1.4 /29.4±5.9 77.1±1.0 /19.1±5.2 88.1±1.8 /20.7±6.2 73.6±2.1 /39.7±5.5 75.6±1.8 /28.9±5.3 77.1±1.5 /18.4±3.9 68.1±8.2 /36.7±8.0 69.3±3.1 /25.5±4.1 73.7±2.5 /10.5±7.5 74.0±2.8 /29.2±8.2 77.4±2.1 /10.8±9.5 75.3±3.2 /8.3±5.7

pubmed

dblp

ρ=5

ρ=10

ρ=20

ρ=5

ρ=10

ρ=20

DeepWalk Node2vec

– –

65.6±1.0 /3.8±1.5 65.3±1.3 /4.1±2.3

66.0±1.1 /0.6±0.2 65.7±1.4 /0.7±0.3

66.0±1.0 /0.0±0.1 65.7±1.2 /0.1±0.1

GCN GAT GraphSAGE

91.4±4.4 /50.2±7.5 86.0±9.1 /56.5±6.8 92.0±4.0 /44.7±7.3

96.8±2.2 /32.1±7.5 99.2±0.5 /12.4±9.7 93.2±7.0 /39.6±13.4 97.5±3.4 /19.6±16.6 96.7±1.9 /31.1±9.5 99.4±0.6 /10.1±5.7

83.8±1.5 /20.0±6.0 84.1±1.7 /24.9±8.5 83.4±1.7 /22.4±5.8

85.5±2.3 /8.3±7.8 86.4±2.2 /4.8±6.8 84.7±3.4 /12.5±11.5 86.5±1.9 /5.9±9.0 84.1±1.8 /14.2±5.5 84.1±1.4 /10.9±4.5

BGRL GraphMAE

89.0±4.3 /50.6±5.4 93.4±3.4 /39.3±9.2

93.2±3.1 /42.0±8.5 98.3±1.4 /21.1±7.0

83.3±1.9 /27.4±6.5 84.7±1.4 /19.6±7.2

85.2±1.7 /17.1±9.2 86.5±1.4 /7.7±8.3

UniGraph2 GIT GFT

79.3±6.3 /59.3±3.6 92.8±3.4 /43.8±7.3 90.0±5.2 /53.4±8.6

84.2±4.3 /52.9±5.1 80.0±7.6 /49.5±8.2 67.7±11.3 /40.0±13.6 71.3±5.4 /30.4±13.3 76.1±6.7 /14.9±11.5 96.6±2.2 /30.7±10.4 99.1±0.8 /12.3±7.4 84.0±1.8 /17.6±5.9 85.3±1.7 /8.7±4.6 86.6±0.7 /3.6±2.4 96.7±1.8 /36.2±8.3 99.1±0.4 /16.5±9.9 81.4±2.0 /31.1±8.0 82.9±2.2 /15.2±6.4 84.6±1.1 /8.3±3.5

OFA LLaGA

73.3±1.6 /66.2±7.7 72.9±2.2 /57.6±8.5 75.4±2.2 /29.6±21.9 86.7±12.9 /50.5±11.5 94.3±4.7 /34.3±13.5 98.5±1.6 /21.4±9.9

Method

69.7±7.0 /31.2±6.9 80.9±1.0 /22.3±9.0

elecomp ρ=5

DeepWalk Node2vec

94.2±3.9 /33.0±9.4 98.9±2.7 /8.3±6.8

ρ=10

79.6±5.3 /12.5±8.5 85.8±2.5 /4.1±7.1

83.9±6.1 /11.6±8.7 87.2±1.2 /3.1±5.9

82.3±3.5 /3.6±7.9 86.7±1.6 /0.0±0.0

elephoto ρ=20

ρ=5

ρ=10

ρ=20

73.1±0.5 /54.0±3.5 73.9±0.5 /49.0±3.1 74.3±0.5 /44.3±2.8 65.4±0.2 /55.1±1.1 65.5±0.3 /52.9±1.4 65.9±0.4 /46.0±0.7 73.1±0.4 /52.2±2.1 73.9±0.4 /48.6±1.6 74.2±0.4 /43.3±1.9 65.2±0.4 /55.8±1.5 65.4±0.3 /54.1±1.5 65.7±0.4 /47.4±1.5

GCN 77.6±0.3 /55.0±1.3 78.0±0.2 /51.1±0.9 78.2±0.3 /46.8±0.8 77.0±0.5 /57.7±1.3 76.8±0.4 /56.7±0.6 77.4±0.5 /54.0±1.2 GAT 76.3±0.1 /54.6±0.3 76.9±0.2 /51.8±1.0 77.2±0.1 /48.3±0.5 76.1±0.5 /55.3±0.9 76.2±0.4 /54.0±1.0 76.8±0.5 /50.3±1.4 GraphSAGE 76.7±0.4 /54.3±1.1 77.4±0.2 /51.5±0.7 77.6±0.5 /47.7±0.9 76.3±0.7 /56.9±1.2 76.0±0.5 /55.2±1.0 76.7±0.4 /50.9±1.1 BGRL 75.4±0.4 /56.0±1.6 75.9±0.6 /54.8±1.5 76.3±0.6 /50.3±2.3 75.8±0.5 /56.1±1.5 76.0±0.3 /53.9±1.3 76.7±0.6 /50.6±1.4 GraphMAE 78.8±0.2 /58.9±0.8 79.1±0.4 /56.6±1.1 79.5±0.3 /53.4±0.9 77.2±0.2 /57.8±0.4 77.5±0.2 /56.6±0.5 78.0±0.2 /53.4±0.5 UniGraph2 GIT GFT

75.1±0.7 /59.2±2.5 75.0±1.1 /58.7±3.2 75.6±1.4 /57.3±2.5 75.1±1.3 /60.1±2.1 75.1±1.3 /59.0±1.5 75.9±1.3 /56.0±2.4 77.0±0.3 /54.2±0.9 77.7±0.4 /51.7±1.2 77.9±0.4 /48.5±1.2 76.4±0.7 /57.7±1.0 76.5±0.9 /56.4±0.9 77.0±0.8 /50.9±0.9 77.4±0.3 /56.9±1.5 77.8±0.2 /54.6±1.4 78.0±0.3 /51.5±1.5 77.8±0.6 /59.3±0.9 77.9±0.4 /58.5±1.6 78.1±0.5 /53.4±1.3

OFA LLaGA

77.0±0.1 /36.3±0.5 77.5±0.1 /29.2±0.7 77.5±0.1 /20.5±1.0 75.1±0.1 /28.3±0.2 75.2±0.4 /18.4±1.3 75.2±0.3 /8.3±0.8 81.1±2.8 /46.9±4.5 81.1±2.8 /41.2±8.4 81.8±2.2 /41.8±8.3 75.4±6.6 /55.2±8.5 75.3±6.5 /56.3±12.2 74.5±6.9 /46.6±7.7

Method

sportsfit

wikics

ρ=5

ρ=10

ρ=20

82.1±0.2 /45.0±0.2 82.1±0.1 /45.5±0.3

82.2±0.2 /44.9±0.2 82.2±0.1 /45.4±0.3

83.0±0.2 /42.0±0.2 83.0±0.1 /42.6±0.3

76.0±0.3 /58.0±1.9 77.3±0.5 /44.0±1.2 78.0±0.5 /20.9±2.0 75.3±0.5 /60.2±1.8 76.6±0.6 /44.3±3.8 77.3±0.6 /20.6±2.4

GCN 89.7±0.2 /72.8±0.7 GAT 87.4±0.2 /67.8±0.4 GraphSAGE 88.9±0.1 /72.8±0.4

89.6±0.2 /73.3±1.3 87.4±0.2 /67.9±0.7 89.0±0.1 /72.4±0.5

90.1±0.2 /70.1±1.3 87.9±0.2 /65.0±0.5 89.4±0.1 /69.5±0.5

79.9±0.3 /69.7±1.4 81.3±0.8 /62.2±2.9 81.1±0.7 /49.3±2.9 79.6±0.4 /72.3±1.3 80.3±0.6 /65.2±2.4 81.0±0.7 /53.0±3.3 78.9±0.3 /70.2±0.8 80.2±0.4 /63.3±2.0 81.3±0.3 /48.0±1.6

BGRL GraphMAE

88.5±0.5 /74.0±0.8 90.7±0.1 /73.5±0.4

88.5±0.5 /73.9±0.6 90.7±0.1 /73.4±0.4

89.1±0.3 /70.9±0.6 91.1±0.1 /70.8±0.5

81.8±0.3 /68.8±1.3 82.9±0.3 /59.1±1.6 83.0±0.6 /43.5±3.4 80.8±0.5 /73.6±1.0 81.7±0.4 /67.9±1.5 82.7±0.2 /52.7±2.1

UniGraph2 GIT GFT

84.5±1.6 /73.3±2.1 89.3±0.2 /73.4±0.4 89.6±0.1 /73.9±0.7

84.8±1.2 /71.3±3.0 89.3±0.2 /73.2±0.3 89.5±0.2 /74.0±0.8

85.7±0.6 /69.5±1.9 89.6±0.2 /70.2±0.7 89.9±0.3 /71.4±1.3

74.0±1.3 /67.6±2.2 76.3±1.3 /59.9±3.8 76.1±1.7 /47.7±2.7 78.8±0.6 /70.5±1.1 79.9±0.4 /62.8±1.5 81.3±0.2 /46.5±2.1 78.4±0.5 /71.5±0.7 79.4±0.7 /64.2±1.6 80.8±0.2 /49.9±3.1

OFA LLaGA

– – – 78.5±0.6 /49.3±3.1 79.1±0.3 /36.4±4.4 79.7±0.3 /20.2±6.5 84.8±2.6 /41.9±12.0 85.7±2.4 /43.7±13.4 84.3±1.8 /35.0±10.6 76.0±1.8 /62.7±10.0 77.6±2.2 /51.5±7.4 78.8±1.7 /40.8±9.0

DeepWalk Node2vec

ρ=5

ρ=10

ρ=20

E.4

Fairness — full per-dataset results

The main-text fairness section reports structural fairness. Full per-dataset structural-fairness results are reported below for eight NC datasets, including the four representative datasets shown in Figure 5. Demographic fairness is evaluated on tolokers (banned-user prediction; sensitive attribute: education) and reported in Table 8. Table 8: Demographic fairness. Test AUC and the three fairness gaps for each method on tolokers (banned-user prediction; sensitive attribute: education). Higher AUC is better; lower ∆ is more fair. All values in % (∆ values ×100). Mean±std over 5 seeds. Bold / underline = best / second per column. ∆SP =|P (Ŷ =1|S=0)−P (Ŷ =1|S=1)|, ∆EO =|TPRS=0 −TPRS=1 |, ∆Util =|AUCS=0 −AUCS=1 |. Method

AUC↑

∆SP ↓

∆EO ↓

∆Util ↓

GCN GAT SAGE

74.78±0.31 70.01±2.27 75.59±0.45

9.02±0.73 1.24±1.53 6.59±2.52

11.80±0.81 2.31±1.76 9.21±2.59

10.16±0.41 7.78±1.69 13.65±0.34

BGRL GraphMAE

80.41±0.36 68.90±3.46

9.65±1.74 1.12±1.48

13.33±1.88 1.89±2.44

8.30±0.80 11.73±4.45

GFT GIT UniGraph2

72.42±0.61 76.66±0.44 69.34±5.20

1.24±0.74 6.86±1.88 2.14±3.40

2.03±1.15 9.77±2.48 3.53±5.52

11.43±0.77 14.06±0.31 9.12±4.01

Table 9: Full structural-fairness per-dataset results, one block per dataset. Columns: overall accuracy, accuracy on head (high-degree) nodes, accuracy on tail (low-degree) nodes, and head−tail gap. Within each dataset block, bold = method with smallest |gap|; underline = second. Cells report mean±std over 5 seeds. Cora Method

Acc

Acc(h)

CiteSeer Acc(t)

Gap↓

Method

Acc

Acc(h)

Acc(t)

Gap↓

DeepWalk Node2vec

71.47±1.60 78.83±0.72 63.12±3.05 +15.71±3.28 71.45±1.39 79.14±1.26 62.84±2.21 +16.30±2.29

DeepWalk Node2vec

47.04±0.66 68.79±0.80 33.36±0.71 +35.43±0.23 46.56±0.74 68.07±0.66 33.30±1.36 +34.76±0.96

GCN GAT SAGE

79.34±0.66 81.73±1.58 76.02±0.62 +5.71±2.08 79.20±0.96 81.75±1.24 76.06±1.02 +5.68±0.97 78.60±1.22 80.63±2.45 75.42±0.88 +5.21±2.16

GCN GAT SAGE

68.51±0.64 77.35±1.26 62.74±0.75 +14.60±1.48 69.62±0.58 77.54±0.53 64.28±0.61 +13.26±0.51 69.16±0.40 77.35±0.35 63.90±0.51 +13.45±0.59

BGRL 76.68±1.04 80.14±2.02 71.81±1.36 +8.34±3.05 GraphMAE 79.89±1.49 82.33±2.32 76.40±1.51 +5.93±2.52

BGRL 66.31±0.55 76.93±0.84 58.95±0.88 +17.98±0.79 GraphMAE 67.92±0.46 78.52±0.49 61.23±1.04 +17.30±0.97

UniGraph2 75.93±1.52 76.14±2.33 72.92±1.99 +3.22±3.25 GIT 78.59±1.13 80.36±1.56 75.39±0.91 +4.97±1.39 GFT 79.16±0.53 82.00±1.37 74.83±0.59 +7.17±1.80

UniGraph2 68.08±1.10 75.64±3.32 63.16±1.30 +12.49±3.88 GIT 69.31±0.54 77.12±0.47 64.19±0.54 +12.93±0.49 GFT 66.77±0.45 78.48±0.89 59.57±1.19 +18.92±1.98

OFA LLaGA

75.17±1.64 77.44±2.87 73.70±1.10 +3.74±2.33 76.31±1.38 79.19±2.58 72.35±1.37 +6.84±3.02

63.83±1.01 70.02±1.43 60.79±0.93 +9.23±0.99 64.12±1.04 74.37±2.14 56.42±2.05 +17.95±3.72

PubMed Method

Acc

Acc(h)

WikiCS Acc(t)

Gap↓

Method

Acc

Acc(h)

Acc(t)

Gap↓

DeepWalk Node2vec

67.73±2.18 76.82±1.73 61.12±2.44 +15.71±1.23 67.42±2.60 76.47±3.03 60.79±2.56 +15.68±1.14

DeepWalk Node2vec

73.49±0.96 81.81±1.17 61.72±0.94 +20.09±1.00 73.31±0.54 82.25±1.09 61.36±0.98 +20.89±0.85

GCN GAT SAGE

78.45±1.75 79.49±2.08 76.92±1.64 +2.56±0.73 78.49±0.87 80.51±0.81 76.43±1.05 +4.08±0.64 76.20±0.99 78.46±1.21 73.55±1.00 +4.91±0.90

GCN GAT SAGE

78.81±0.73 84.14±1.42 73.29±0.74 +10.85±1.62 78.93±0.48 84.18±1.56 73.15±0.45 +11.03±1.54 78.46±0.34 84.83±1.19 72.13±0.51 +12.70±1.23

BGRL 73.10±2.83 72.22±4.11 72.51±2.56 −0.28±2.07 GraphMAE 77.92±1.75 80.39±2.23 75.54±1.85 +4.85±0.92

BGRL 79.25±0.53 83.97±1.47 74.26±1.07 +9.70±1.26 GraphMAE 79.82±0.55 84.59±1.18 75.07±0.94 +9.51±1.28

UniGraph2 75.43±1.37 77.66±2.24 73.19±1.38 +4.47±2.43 GIT 76.29±0.76 78.80±0.97 73.57±1.05 +5.23±1.31 GFT 78.03±0.56 80.55±1.30 75.19±0.70 +5.36±1.46

UniGraph2 74.94±1.09 78.70±2.19 70.09±1.19 +8.61±2.13 GIT 78.74±0.42 84.85±1.01 72.36±0.59 +12.49±1.00 GFT 78.51±0.58 84.74±0.78 70.16±1.44 +14.58±1.25

OFA LLaGA

73.41±2.56 75.99±3.22 71.89±2.20 +4.10±1.41 73.56±2.63 75.67±3.64 70.94±2.38 +4.73±1.47

76.55±0.68 80.16±0.88 73.23±0.67 +6.93±0.52 72.84±1.01 78.03±1.64 68.33±3.59 +9.70±4.45

ElecComp Method

Acc

Acc(h)

ElePhoto Acc(t)

Method

Gap↓

Acc

Acc(h)

Acc(t)

Gap↓

DeepWalk Node2vec

71.10±0.39 78.70±0.83 57.74±0.82 +20.96±1.46 71.00±0.09 78.27±0.33 57.55±0.65 +20.72±0.84

DeepWalk Node2vec

71.56±0.14 74.75±0.39 64.80±0.46 +9.95±0.33 71.71±0.22 74.93±0.58 65.31±0.56 +9.62±1.03

GCN GAT SAGE

76.79±0.13 86.78±0.20 66.47±0.37 +20.31±0.46 75.20±0.17 85.75±0.32 64.30±0.36 +21.45±0.30 76.37±0.16 86.35±0.33 65.74±0.24 +20.61±0.32

GCN GAT SAGE

78.42±0.13 80.52±0.26 76.89±0.33 +3.63±0.52 77.75±0.14 80.12±0.38 75.33±0.17 +4.79±0.44 78.64±0.07 80.37±0.20 77.74±0.19 +2.63±0.26

BGRL 76.32±0.12 86.22±0.22 65.41±0.25 +20.81±0.41 GraphMAE 78.06±0.16 87.38±0.26 67.64±0.46 +19.75±0.37

BGRL 78.90±0.19 80.96±0.39 77.59±0.20 +3.37±0.43 GraphMAE 79.89±0.16 82.53±0.19 78.12±0.33 +4.42±0.30

UniGraph2 75.47±0.26 85.93±0.11 64.18±0.71 +21.75±0.72 GIT 76.54±0.17 86.48±0.23 66.20±0.29 +20.28±0.35 GFT 77.36±0.15 87.03±0.29 66.86±0.48 +20.17±0.55

UniGraph2 77.42±0.12 80.07±0.62 75.64±0.31 +4.43±0.68 GIT 78.70±0.12 80.13±0.25 77.79±0.16 +2.34±0.24 GFT 79.11±0.11 81.54±0.38 77.92±0.22 +3.62±0.58

OFA LLaGA

78.08±1.11 83.23±1.00 73.32±1.17 +9.91±0.50 77.31±2.53 81.20±3.51 68.78±3.96 +12.42±5.56

79.24±1.41 80.64±1.83 78.13±1.22 +2.51±0.90 79.03±1.18 76.35±1.58 77.19±2.68 −0.83±2.94

AmazonRatings Method

Acc

Acc(h)

Tolokers Acc(t)

Method

Gap↓

Acc

Acc(h)

Acc(t)

Gap↓

DeepWalk Node2vec

38.63±0.44 38.91±0.31 39.36±0.65 −0.45±0.81 38.62±0.23 39.16±0.70 39.47±0.42 −0.31±0.75

DeepWalk Node2vec

80.41±0.29 75.78±0.57 83.55±0.32 −7.77±0.62 80.19±0.15 75.07±1.24 83.64±0.39 −8.58±1.52

GCN GAT SAGE

46.17±0.31 43.10±0.49 47.43±0.44 −4.33±0.42 43.34±0.40 39.56±0.68 45.67±0.28 −6.11±0.62 49.16±0.34 44.58±0.46 51.91±0.64 −7.33±0.78

GCN GAT SAGE

78.66±0.09 74.66±0.49 83.42±0.10 −8.77±0.54 78.14±0.04 72.13±0.00 83.40±0.18 −11.27±0.18 78.60±0.33 72.32±0.45 83.25±0.68 −10.92±0.62

BGRL 46.43±0.07 40.07±0.09 48.63±0.05 −8.55±0.10 GraphMAE 46.63±0.00 41.19±0.00 49.22±0.00 −8.03±0.00

BGRL 80.42±0.33 76.16±0.85 82.63±1.02 −6.47±1.26 GraphMAE 78.16±0.00 72.13±0.00 83.49±0.00 −11.36±0.00

UniGraph2 45.16±0.00 41.24±0.00 47.50±0.00 −6.26±0.00 GIT 48.78±0.04 43.62±0.52 51.77±0.28 −8.14±0.59 GFT 47.43±0.22 40.77±0.24 50.94±0.47 −10.17±0.51

UniGraph2 78.14±0.45 72.26±1.47 83.08±0.74 −10.82±1.86 GIT 78.33±0.33 72.21±0.18 83.24±0.52 −11.03±0.69 GFT 78.16±0.01 72.13±0.00 83.49±0.04 −11.36±0.04

OFA LLaGA

36.56±0.94 35.70±1.08 37.27±1.20 −1.58±1.38 37.04±2.14 36.70±4.30 38.19±1.29 −1.49±4.70

78.60±0.57 77.22±0.24 79.85±0.50 −2.63±0.61 78.16±0.39 72.62±0.77 83.84±0.27 −11.21±0.73

E.5

Interpretation — full per-dataset results

The main-text interpretation section reports node-level subgraph-ablation attribution fidelity at topk=10% edges. Here we provide the complementary details: a sparsity sweep over multiple top-k levels, a per-dataset decomposition of Fid+ / Fid− / characterization score at top-10%, and atom-level graph-classification results on molecular datasets.

Table 10: Subgraph-ablation sparsity sweep (∆char ×100, higher is better). ∆char = chargrad − charrand at four edge sparsity levels in each q test node’s K=2-hop receptive field. Cells: mean±std 2 2 . Bold / underline = best / second per dataset across 5 seeds; std for ∆ is propagated as σgrad + σrand and sparsity. Cora

CiteSeer

Method

k=5%

k=10%

k=20%

k=50%

Method

k=5%

k=10%

k=20%

GCN GAT SAGE

+9.7±1.2 +9.0±2.2 +18.9±5.4

+11.6±2.4 +11.2±2.0 +30.2±1.7

+13.0±2.3 +14.7±1.5 +39.1±3.5

+9.5±3.2 +13.0±3.9 +40.0±4.7

GCN GAT SAGE

+4.5±5.3 +3.0±1.8 +8.7±6.9

+5.4±6.4 +3.4±1.9 +12.0±8.6

+5.3±7.1 +4.5±9.0 +4.2±2.5 +3.7±2.9 +15.0±9.5 +17.8±12.1

BGRL +12.3±1.6 GraphMAE +9.0±1.9

+14.2±1.7 +12.8±0.6

+16.0±2.6 +15.7±1.2

+11.6±3.2 +12.5±2.5

BGRL GraphMAE

+8.0±1.2 +5.1±4.4

+8.9±0.7 +6.6±4.5

+10.0±1.6 +7.6±5.4

UniGraph2 +4.3±4.0 +5.4±2.5 +5.4±2.3 +8.1±1.4 GFT +20.3±5.3 +30.6±3.5 +40.5±2.8 +40.9±4.8 GIT +14.5±13.8 +21.3±18.6 +27.1±23.6 +28.1±28.7

GCN GAT SAGE

k=5%

k=10%

+7.3±1.0 +7.5±7.3

UniGraph2 +1.0±3.3 +2.7±3.4 +5.4±3.2 +4.4±3.0 GFT +13.9±20.5 +19.5±23.9 +22.9±26.0 +27.6±35.2 GIT +10.3±3.7 +13.6±4.0 +16.8±2.9 +19.6±3.0

PubMed Method

k=50%

WikiCS k=20%

k=50%

Method

+12.8±3.4 +12.7±2.9 +12.7±2.3 +8.3±2.6 +17.9±5.4 +18.4±3.6 +17.4±2.0 +12.2±3.8 +31.0±3.5 +33.7±4.1 +34.0±3.7 +25.8±3.7

GCN GAT SAGE

k=5%

k=10%

k=20%

k=50%

+26.1±1.3 +23.7±2.2 +21.7±2.2 +18.6±2.2 +26.8±3.5 +25.8±4.6 +24.4±4.8 +19.7±4.8 +52.5±1.2 +51.8±1.6 +49.9±1.8 +43.1±4.2

BGRL +11.8±4.9 +11.0±4.8 +10.4±4.6 +6.2±5.4 GraphMAE +17.3±2.0 +17.3±1.2 +17.2±0.4 +12.5±1.6

BGRL +23.4±0.4 +20.1±2.3 +18.8±2.4 +16.3±2.4 GraphMAE +25.3±2.7 +25.4±2.2 +23.2±2.6 +16.5±2.2

UniGraph2 +7.7±6.4 +10.7±7.5 +14.3±5.7 +12.9±6.5 GFT +36.4±4.7 +40.1±5.2 +40.1±4.7 +31.7±5.2 GIT +27.8±5.8 +30.1±6.0 +30.1±5.8 +22.4±6.0

UniGraph2 +22.4±4.5 +24.6±4.5 +22.3±4.0 +20.5±3.6 GFT +64.8±1.6 +63.7±1.8 +62.2±2.0 +55.7±3.1 GIT +54.1±2.5 +53.5±3.1 +51.7±3.0 +45.9±4.7

ElecComp Method GCN GAT SAGE

k=5%

k=10%

ElePhoto k=20%

Method

k=50%

GCN GAT SAGE

+13.3±5.0 +16.1±6.1 +17.6±6.9 +18.9±7.6 +6.8±5.4 +8.1±5.4 +12.6±5.0 +17.8±4.8 +23.1±7.6 +25.7±7.1 +30.0±5.6 +27.3±7.0

k=5%

k=10%

k=20%

k=50%

+12.2±4.3 +16.5±4.9 +18.6±4.6 +16.9±4.8 +7.8±3.7 +9.6±4.4 +15.1±1.8 +19.6±3.8 +23.1±6.2 +24.8±6.6 +24.9±6.1 +24.1±6.5

BGRL +14.4±7.0 +18.2±7.4 +20.4±7.7 +21.6±7.2 GraphMAE +7.1±7.3 +9.1±6.4 +14.7±7.3 +18.2±7.2

BGRL +13.9±3.9 +17.0±4.3 +18.1±4.6 +16.3±5.7 GraphMAE +8.0±3.7 +10.6±4.5 +14.2±3.3 +19.8±3.6

UniGraph2 +4.5±6.7 +7.3±6.1 +8.5±8.2 +10.1±7.8 GFT +23.0±6.7 +24.9±5.9 +28.6±5.1 +26.6±5.2 GIT +24.3±6.6 +26.5±6.3 +30.3±4.5 +27.7±5.6

UniGraph2 +5.8±1.6 +6.4±2.6 +10.3±3.6 +11.4±3.1 GFT +22.2±4.1 +24.2±4.6 +24.9±4.5 +23.3±5.0 GIT +22.7±5.0 +25.0±4.8 +25.6±4.4 +23.9±5.4

AmazonRatings Method GCN GAT SAGE

k=5%

k=10%

Tolokers k=20%

Method

k=50%

GCN GAT SAGE

+3.4±2.7 +3.5±3.6 +3.6±4.5 +2.9±5.9 +1.9±3.4 +2.0±4.0 +2.1±6.4 +2.2±10.1 +12.4±5.6 +16.0±5.7 +20.4±4.8 +26.2±6.0

BGRL +6.4±5.3 GraphMAE +5.8±2.9

+5.9±5.6 +6.7±3.4

+7.8±6.6 +6.6±4.8

k=5%

BGRL +8.5±1.7 GraphMAE +1.2±0.8

+6.4±6.7 +7.0±5.9

k=10%

k=20%

k=50%

+22.4±0.3 +22.4±0.3 +22.3±0.3 +21.1±0.3 +0.2±0.0 +0.2±0.0 +0.2±0.0 +0.1±0.0 +23.6±0.6 +23.6±0.6 +23.7±0.6 +23.2±0.8 +8.2±1.8 +1.2±0.8

+7.5±1.9 +1.2±0.8

+3.7±2.0 +1.2±0.8

UniGraph2 +11.4±4.6 +14.2±3.9 +17.2±4.6 +16.1±5.7 GFT +30.2±1.5 +30.2±1.5 +30.3±1.4 +29.8±1.4 GIT +9.9±1.0 +9.8±1.0 +9.8±1.1 +9.3±1.3

UniGraph2 +2.6±5.5 +5.0±3.7 +6.2±4.8 +8.2±2.4 GFT +15.8±2.6 +17.3±2.3 +24.3±1.4 +29.8±3.2 GIT +10.3±5.3 +14.2±3.1 +19.2±5.2 +20.6±6.1

Table 11: Subgraph-ablation Fid+ / Fid− / char decomposition at k = 10% edges (×100). For each dataset/method, columns report the gradient-saliency value (G) and the random-edge baseline (R) for Fid+ (drop in confidence when salient edges are masked; higher is better) and Fid− (preservation when non-salient edges are masked; lower is better). char = harmonic mean of Fid+ and 1−Fid− . ∆ = char(G) − char(R), the quantity reported in the main-text table; all cells report mean±std over 5 seeds (∆ uses propagated std). Bold / underline = best / second per dataset on ∆. Cora Method GCN GAT SAGE

CiteSeer

Fid−

Fid+ G

char

∆

UniGraph2 7.4±2.4 3.5±2.4 GFT 30.3±3.7 5.4±1.7 GIT 17.2±13.1 2.2±2.0

0.2±0.1 −2.1±2.0 3.5±1.1 1.2±2.8 1.9±1.7 3.9±3.3

5.3±0.4 5.0±2.6

+9.0±0.7 +6.6±4.5

GCN GAT SAGE

14.2±0.6 11.6±3.6

6.4±3.9 9.2±5.9 12.7±2.4 9.9±2.4 +2.8±3.4 2.6±2.7 23.0±16.3 32.6±21.7 13.0±10.0 +19.5±23.9 0.5±0.2 12.4±0.7 22.2±3.8 8.6±1.4 +13.6±4.0

WikiCS

Fid−

Fid+

∆

+5.4±6.4 +3.4±1.9 +12.0±8.6

PubMed Method

4.1±2.8 2.3±0.7 7.8±3.4

UniGraph2 5.3±4.9 4.2±4.3 GFT 27.4±21.1 10.2±9.2 GIT 13.7±2.6 4.9±1.2

13.2±0.5 14.6±2.2 12.9±1.7 7.5±1.8 +5.4±2.5 6.3±2.4 34.8±3.5 38.5±3.0 7.8±1.8 +30.6±3.5 0.9±2.5 18.5±14.5 25.4±18.3 4.2±3.4 +21.3±18.6

char R

4.0±6.7 1.4±2.9 −0.8±2.6 2.6±4.9 9.5±5.7 0.9±0.4 −0.0±0.4 0.5±0.5 1.5±0.9 5.7±1.8 12.1±5.7 4.5±2.4 0.5±0.4 10.8±4.1 19.8±7.9

BGRL 4.9±0.8 GraphMAE 4.9±4.4

0.5±1.2 −1.6±3.3 7.6±2.9 18.7±1.1 4.5±1.4 +14.2±1.7 0.3±0.5 5.1±3.2 11.6±2.8 15.9±0.2 3.1±0.6 +12.8±0.6

BGRL 7.8±1.5 GraphMAE 9.0±0.9

GCN GAT SAGE

5.4±2.4 −0.0±0.6 −0.9±0.4 5.2±2.3 14.8±2.2 3.2±1.1 +11.6±2.4 11.0±3.7 2.1±1.1 4.9±2.4 12.9±3.7 16.2±1.8 5.0±0.9 +11.2±2.0 24.8±1.2 3.2±1.1 1.8±1.9 27.6±3.4 36.2±0.7 5.9±1.5 +30.2±1.7

Fid−

Fid+

Method

char R

Method

∆

char

∆

16.2±2.6 0.3±0.3 −2.7±0.3 7.3±3.5 26.2±2.1 2.5±0.8 +23.7±2.2 18.4±5.7 −0.1±0.5 −0.1±1.0 14.3±4.7 28.0±4.5 2.2±0.4 +25.8±4.6 41.8±1.5 0.7±0.7 0.1±0.1 20.3±2.6 54.2±1.6 2.4±0.5 +51.8±1.6

GCN GAT SAGE

8.2±3.4 0.9±1.0 0.2±2.0 9.5±1.8 15.1±2.7 2.4±1.0 +12.7±2.9 18.8±2.8 1.9±1.4 3.9±0.9 17.0±0.8 21.6±3.3 3.2±1.5 +18.4±3.6 25.3±2.6 1.9±1.0 1.6±0.8 20.7±2.4 37.2±4.0 3.4±1.0 +33.7±4.1

Fid−

Fid+

BGRL 3.8±4.7 −0.0±0.7 0.2±0.9 2.7±3.7 13.2±4.8 2.1±0.8 +11.0±4.8 GraphMAE 13.1±2.0 0.5±0.8 3.9±0.4 11.5±0.9 19.4±0.9 2.1±0.7 +17.3±1.2

BGRL 11.0±3.8 0.4±0.4 −0.9±0.4 6.4±1.9 22.8±2.3 2.6±0.6 +20.1±2.3 GraphMAE 19.1±2.6 0.9±1.3 −0.1±0.2 10.6±3.2 28.1±1.8 2.7±1.3 +25.4±2.2

UniGraph2 12.3±7.1 0.4±2.0 8.5±3.1 21.1±2.4 15.5±7.3 4.7±1.8 +10.7±7.5 GFT 31.9±3.2 1.6±1.0 1.4±1.5 23.5±0.4 43.2±5.0 3.1±1.3 +40.1±5.2 GIT 23.3±4.0 1.8±0.6 1.0±0.9 19.2±2.4 33.0±6.0 2.9±0.2 +30.1±6.0

UniGraph2 26.6±4.2 3.1±0.7 GFT 58.3±1.7 1.6±0.7 GIT 42.9±2.4 0.6±0.8

ElecComp Method GCN GAT SAGE

ElePhoto

Fid−

Fid+ R

char R

2.9±2.5 18.6±2.8 31.2±4.4 6.6±1.0 +24.6±4.5 0.1±0.2 24.6±2.2 66.8±1.5 3.2±0.9 +63.7±1.8 0.0±0.1 20.7±3.2 55.9±2.9 2.4±0.9 +53.5±3.1

Method

∆

GCN GAT SAGE

18.1±5.2 5.7±2.7 3.2±1.5 18.8±6.8 26.0±5.2 9.9±3.0 +16.1±6.1 10.8±1.6 5.9±3.3 11.4±4.1 20.9±0.9 16.8±3.2 8.7±4.3 +8.1±5.4 27.9±4.2 7.3±4.1 5.2±2.3 23.4±1.7 36.4±5.5 10.7±4.5 +25.7±7.1

Fid−

Fid+ G

char R

∆

16.2±3.7 5.2±3.3 4.0±0.9 14.5±2.2 25.2±2.6 8.7±4.2 +16.5±4.9 11.0±4.0 5.2±2.3 8.5±3.2 15.6±3.0 17.6±3.6 8.0±2.5 +9.6±4.4 23.3±3.8 4.5±4.0 2.1±0.9 14.0±0.2 32.1±4.4 7.2±4.9 +24.8±6.6

BGRL 20.2±4.9 6.3±3.9 4.5±1.2 20.5±4.7 29.0±5.8 10.8±4.5 +18.2±7.4 GraphMAE 12.5±4.6 6.0±2.9 14.1±4.8 25.4±2.1 17.6±5.4 8.5±3.5 +9.1±6.4

BGRL 16.2±2.1 5.1±2.5 5.4±2.4 15.9±0.7 25.4±2.1 8.4±3.7 +17.0±4.3 GraphMAE 13.1±2.8 6.0±3.9 10.0±3.7 18.4±0.8 18.8±2.4 8.2±3.8 +10.6±4.5

UniGraph2 12.5±3.8 5.1±3.8 16.8±2.4 27.7±1.6 16.9±4.4 9.6±4.2 +7.3±6.1 GFT 28.1±3.4 7.7±3.2 4.4±1.9 22.7±0.5 35.6±4.5 10.7±3.9 +24.9±5.9 GIT 28.5±3.7 7.3±3.7 4.1±1.6 23.2±1.4 37.1±4.8 10.6±4.0 +26.5±6.3

UniGraph2 9.5±2.2 3.8±2.4 15.6±3.5 21.4±2.9 14.8±2.1 8.4±1.5 +6.4±2.6 GFT 22.5±1.2 4.5±3.1 2.5±0.6 13.7±1.4 31.0±1.2 6.8±4.4 +24.2±4.6 GIT 22.4±2.7 4.0±3.1 2.1±0.7 14.1±2.4 31.6±2.4 6.6±4.1 +25.0±4.8

AmazonRatings Method GCN GAT SAGE

Tolokers

Fid−

Fid+ R

char R

Method

∆

GCN GAT SAGE

3.9±3.4 3.5±2.1 17.7±4.3 15.0±4.0 12.0±2.6 8.5±2.5 +3.5±3.6 1.9±2.3 1.1±1.0 5.3±6.4 4.8±5.7 5.6±3.7 3.6±1.6 +2.0±4.0 18.6±5.2 6.3±1.3 15.2±1.5 29.2±6.9 25.8±5.5 9.8±1.6 +16.0±5.7

Fid ( necessity lift)

11.5±0.2 0.1±0.0 13.6±0.3

0.1±0.1 0.0±0.0 0.2±0.2

3.0±0.6 0.0±0.0 0.0±0.0

PubMed

Fid + ( sufficiency lift) GCN

UniGraph2 11.0±2.8 GFT 18.1±1.0 GIT 4.5±2.0

UniGraph2 8.1±1.6 4.6±4.2 22.7±5.3 24.4±7.1 17.3±1.5 12.2±3.4 +5.0±3.7 GFT 22.0±0.9 6.7±2.7 16.4±1.7 37.1±2.1 26.6±0.9 9.3±2.1 +17.3±2.3 GIT 16.9±2.0 6.3±1.6 14.0±2.6 27.4±1.6 24.2±2.8 10.0±1.2 +14.2±3.1

30 25 20 15 10 5 0

GAT

Fid + ( sufficiency lift)

GraphSAGE

0.9±2.2 0.2±0.3 0.1±0.1

∆

4.5±0.2 22.9±0.2 0.4±0.2 +22.4±0.3 0.0±0.0 0.2±0.0 0.0±0.0 +0.2±0.0 3.3±0.2 23.9±0.5 0.3±0.4 +23.6±0.6

12.4±0.6 13.7±4.3 20.1±3.6 5.9±1.7 +14.2±3.9 0.0±0.0 4.3±0.3 30.6±1.4 0.4±0.5 +30.2±1.5 0.1±0.1 0.4±1.6 10.1±1.0 0.3±0.2 +9.9±1.0

WikiCS

char R

BGRL −4.1±3.9 −0.1±0.1 −2.3±0.9 1.1±3.5 9.5±1.7 1.4±0.4 +8.2±1.8 GraphMAE 0.3±0.5 0.0±0.0 0.0±0.1 0.1±0.2 1.2±0.8 0.0±0.0 +1.2±0.8

BGRL 8.4±2.2 4.9±3.3 22.8±0.8 22.7±5.0 17.3±3.1 11.4±4.6 +5.9±5.6 GraphMAE 9.2±2.8 4.2±2.2 15.7±0.9 17.1±2.0 16.4±2.7 9.7±2.2 +6.7±3.4

Cora

Fid−

Fid+

BGRL

Elec-Computers

Fid + ( sufficiency lift)

GraphMAE

UniGraph2

Fid + ( sufficiency lift)

GIT

GFT

Figure 8: Node-level saliency lift in fidelity space. Each marker denotes one method on a representative NC dataset, plotted as the improvement of gradient saliency over a random-edge baseline: (∆Fid+ , −∆Fid− ). The dashed line marks equal lift on the two fidelity components. Full per-dataset decomposition is in Table 11.

Table 12: Graph-level interpretation: ∆char × 100 at top-k=20% atom removal. ∆char = charsal − charrand , where char is the GraphFramEx [2] harmonic mean of Fid+ and 1−Fid−, computed via gradient saliency on FT’d model and node ablation (atom removal with incident edges dropped, atom excluded from pool; not feature zeroing). Random baseline is mandatory per GInX-Eval [3]. Higher is better; positive ∆char indicates saliency identifies more predictive atoms than random. Eval set: clean-correct positives (fallback to all y=1 when ncorrect <10). Mean±std over 5 seeds. “—” indicates the axis is incompatible with the method’s native adaptation pipeline. Bold / underline = best / second per column. Method

Tox21

ChemHIV

GCN GAT GraphSAGE

59.9±7.2 48.5±8.6 57.0±11.5

2.6±1.0 9.7±9.0 2.4±2.1

BGRL GraphMAE

37.4±6.9 41.0±9.7

33.9±5.7 33.7±3.3

UniGraph2 GFT GIT

30.9±8.0 45.4±16.9 54.7±6.9

2.7±1.1 16.1±19.2 4.9±1.7

Broader impacts

GRL-Safety is intended to inform model selection and risk assessment when graph representation methods are deployed in domains such as citation triage, recommendation, fraud detection, and molecular screening. By making per-axis safety failures visible alongside clean accuracy, the benchmark can help practitioners avoid overestimating robustness from leaderboard accuracy alone, and can surface capability gaps that motivate new robustness, adaptation, and training objectives. We do not anticipate direct negative societal impacts. The benchmark relies on publicly available academic datasets, the stress operators are standard noise and distribution-shift constructions rather than novel attacks, and no new pretrained model that meaningfully expands capabilities is released. A residual risk is that practitioners over-interpret aggregate rankings as evidence that any single method is uniformly safe; the paper emphasizes throughout that safety behavior is condition-dependent and cross-axis comparison is required.

Record · ID 168329 · SHA-256 bda4d6b97c71192e
Retrieved via Conceptio — every document is proof-bundled with source, license, and retrieval metadata.