arXiv CSopen access

Attacking Graph Foundation Models Through Their Shared Representation

Attacking Graph Foundation Models Through Their Shared Representation Pankaj Kumar1 2 , Subhankar Mishra1 2 1

National Institute of Science Education and Research 2 An OCC of Homi Bhabha National Institute

arXiv:2607.18567v1 [cs.AI] 20 Jul 2026

Abstract A graph foundation model generalizes across graph domains by mapping every input into one shared representation before any task reasoning. We call this map the alignment layer, the component that separates a graph foundation model from a graph neural network, and we show it is a distinct attack surface that prior work has not studied. We attack it at inference time, with no access to training, on six public models spanning spectral tokenizers, text embedding spaces, and a discrete codebook. A directed representation-space perturbation collapses every model, but at a budget comparable to the representation norm a plain graph network also needs, with one exception: OpenGraph, whose spectral tokenizer collapses at a fifth of that budget, an alignment-specific fragility a plain network does not share and which a same-representation control traces to the tokenizer rather than the decoder. A realizable input-space attack that edits edges, features, or text removes at least half the correct predictions on three of the six models at peak. How much of this fragility an input-access attacker realizes tracks how directly the decoder reads the representation, and not the clean accuracy a task leaves; we measure this carrier gain structurally from the decoder’s local Lipschitz sensitivity, and report clean-accuracy headroom as a within-model ordering heuristic that does not survive on realizable attacks. Where the carrier is discrete we localize the effect causally by pinning the codebook assignment to its clean value. We then study defenses. Robustifying the representation fails against an adaptive attacker. Attacked inputs are, however, detectable: a density test on the low-dimensional continuous carriers separates them near perfectly, at a five percent false-positive rate on clean hold-out data, and holds under an adaptive attacker, so the alignment layer can be monitored even where our defenses do not harden it.

1

Introduction

Graph foundation models aim to serve many graph tasks and many graph domains with one pretrained model (Liu et al. 2025; Mao et al. 2024). Such a model must reconcile inputs that share no nodes, no edges, and no feature space. It does so with a component that a graph neural network does not have: an alignment layer that maps every input into one shared representation before task reasoning begins. In structure models this layer is a spectral tokenizer built from the Copyright © 2027, Association for the Advancement of Artificial Intelligence (www.aaai.org). All rights reserved.

singular value decomposition (SVD) of the adjacency (Xia, Kao, and Huang 2024; Xia and Huang 2026; Zhao et al. 2025). In text-attributed models it is a frozen text embedding space or a discrete vocabulary (Liu et al. 2024; Wang et al. 2024; Li et al. 2024). Figure 1 shows the common structure: every domain is mapped into one shared representation, the attack perturbs that representation, and the shared space carries the perturbation across domains and across models. Adversarial attacks on graph neural networks perturb the adjacency or features of a single graph for a single task (Zügner, Akbarnejad, and Günnemann 2018; Zügner and Günnemann 2019; Xu et al. 2019; Sun et al. 2020). None can perturb a transferable encoder, an alignment map, or a discrete vocabulary, because those exist only in a graph foundation model, to buy cross-domain generality. No published attack targets the six we study. One shared space means one shared weakness: because every domain routes through Φ, a single displacement of it degrades them all, so the generality that makes these models foundational is itself the vulnerability. We carry the study from that vulnerability to a defense. Our contributions are as follows. • We formalize the alignment map Φ shared across model families and attack it at inference time, with no training access, on six public models (Section 3). • We separate the layer from the input lever with a plainnetwork control. Most alignment layers collapse under a directed representation-space perturbation at the same relative budget as an ordinary graph network, but OpenGraph’s spectral tokenizer collapses at a fifth of that budget, a fragility specific to the alignment layer, which a same-representation control traces to the tokenizer rather than the decoder (Section 4). • We derive a spectral rotation attack for the singular-value tokenizer from eigenvector perturbation theory, the first realizable attack to move OpenGraph off the noise floor where projected gradient ascent fails, and show its residual resistance is spectral basis degeneracy, not robustness (Section 4). • We evaluate the realizable input attack across nine datasets and four domains with multiple seeds, and find that how much of the fragility an attacker realizes tracks how directly the decoder reads the representation. We

Realizable Input (Any Domain) Graph Foundation Models (GFM)

Edit within a Budget Edits

Alignment Map (One shared representation space)

Shared Representation Decoder (task head)

Spectral Tokenizer

Node/Edge

Prediction (wrong)

Text Embedding Space 𝕕

Features

Discrete Codebook

argmax Aligned across domains & models

Node/Class Text

White-box / Gray-box / Black-box access (gradients / surrogate / scores) Transferability made possible by the shared alignment space Cross-domain (within the same model)

Cross-model (surrogate to victim)

Figure 1: Attack setup. A graph foundation model maps inputs from any domain into one shared representation through the alignment map Φ, read by a decoder g. We attack Φ at inference time, editing a realizable input (edges, features, or node and class text) within a budget, with no training access, under white-, gray-, or black-box knowledge. Because every domain and model family shares this space, one perturbation transfers across domains and, through a surrogate, across models. The carrier, the form Φ takes, is a spectral token, text embedding, codebook, or channel logits. measure this carrier gain structurally, from the decoder’s local Lipschitz sensitivity at clean representations with no attack curve, and it rank-orders the collapse threshold as a heuristic, while clean accuracy headroom does not survive as a predictor on the realizable attacks (Sections 3 and 4). The discrete codebook admits a do-operator that localizes the effect causally. • We show that robustifying the alignment layer fails against an adaptive attacker, but that attacked inputs are detectable on the low-dimensional continuous carrier where robustification fails (Section 5).

2

Related Work

Attacks on graph neural networks. Structure attacks flip edges to change predictions. Nettack crafts targeted edits (Zügner, Akbarnejad, and Günnemann 2018), Metattack poisons the graph with meta gradients (Zügner and Günnemann 2019), and topology attacks solve a min-max relaxation over edge flips (Xu et al. 2019). Reinforcement learning gives a black-box variant (Dai et al. 2018), and node injection adds nodes instead of editing edges (Sun et al. 2020). Surveys cover the area (Jin et al. 2020). All of this work assumes one graph, one task, and one substrate. Graph foundation models and their robustness. Work on the robustness of graph foundation models is recent and does not reach the alignment layer at inference. Benchmarks

perturb the prompt, text, and structure channels of graph language models on other models (Zhang et al. 2025), and backdoor attacks require a poisoning or fine-tuning stage (Luo et al. 2026). No prior attack shows a perturbation that transfers across domains through a shared interface. Representation alignment and certified robustness. Independent models are argued to converge toward a shared representation (Huh et al. 2024), but a representation can be decodable without being used causally (Usama and Chang 2026), which is why our test intervenes rather than probes. A representation-space perturbation transfers across models only when representations are geometrically aligned (Gupta et al. 2025), the condition a cross-domain alignment map creates, so this attack surface is also a transfer surface. We identify subspaces with linear alignment measures (Kornblith et al. 2019) and remove them with erasure and activation editing (Belrose et al. 2023; Meng et al. 2022). Perturbing an internal representation is an established paradigm: feature adversaries match a target representation (Sabour et al. 2016), the idea reaches vision-language and self-supervised encoders (Zhao et al. 2023; Jia, Liu, and Gong 2022), and matching a target in a shared embedding space transfers across encoders (Zhang et al. 2024). There the contribution is the target, not the optimizer, and an unrealizable representation-space perturbation is the accepted way to show a vulnerability before asking whether an input can reach it. We move the target to the representation a graph founda-

tion model adds over a graph network: the cross-domain alignment map, not one model’s private features. Our defense adapts randomized smoothing (Cohen, Rosenfeld, and Kolter 2019) with adaptive evaluation following standard practice (Carlini and Wagner 2017; Athalye, Carlini, and Wagner 2018; Tramèr et al. 2020).

3

The Alignment Map and the Attack

Let a graph foundation model read an input x = (A, X, text) from any domain, where A ∈ {0, 1}n×n is the adjacency, X ∈ Rn×d the node features, and text the node and class descriptions. Define the alignment map Φ : (A, X, text) → S as the representation every input passes through before task reasoning, so the model is g ◦ Φ, and let S denote this shared representation space (the image of Φ). Its image is shared across domains by construction. An alignment layer is not any encoder. It has four properties. It is domain-agnostic: the same map serves every input domain, not one encoder per domain. It is a bottleneck: every input passes through it before task reasoning. It is a low-dimensional or discrete object: a top-k singular subspace, a codebook, or a fixed embedding space. It is read by a task decoder g. An intermediate layer of a single-domain graph neural network is not an alignment layer, because it is not shared across domains and supports no cross-domain transfer. Because Φ is one cross-domain bottleneck, a single perturbation of S moves every domain that routes through it, so it can express cross-domain transfer. An attack on an ordinary hidden layer is bound to one input distribution and cannot express such a transfer. For a spectral model, with D the diagonal degree matrix, Ā = D−1/2 AD−1/2 the symmetrically normalized adjacency, and U ΣV ⊤ its singular value decomposition (U, V the singular vectors, Σ the diagonal of singular values σ1 ≥ σ2 ≥ · · · ), the tokens are P  √ √
L l E= Ā LN U Σ + V Σ , (1) l=1 where LN(·) is row-wise layer normalization, and S is the leading singular subspace of Ā. For a text model S is a frozen text embedding space, and predictions read the similarity between a node embedding and a class embedding. For GFT S is a discrete codebook C, and a computation-tree embedding z is assigned the nearest token, j = arg minc ∥z − c∥. We make two claims about Φ and one hypothesis, and Section 4 tests each. Claim 1 (shared surface). Φ is a bottleneck that every domain passes through. Attacking it is therefore a different operation from attacking message passing, which is tied to one adjacency and one task, with no analogue in the GNN setting. Claim 2 (cross-domain carrier). Because Φ maps every domain into one geometry, a displacement inside S can transfer to a target domain that shares Φ, which a structure attack on a single, non-shared adjacency cannot express. Hypothesis (concentration). Φ compresses the model into a low dimensional object: a top-k singular subspace, a codebook, or a routed expert, so a small displacement of S changes the output through a basis rotation, a token flip, or an expert re-route. Whether this concentration is what makes a layer

Algorithm 1 ALIGN attack (task-loss form) Input: input x, model g ◦ Φ, labels y, budget B, steps T Output: perturbed input x′ 1: initialize δ ← 0 2: for t = 1 to T do 3: s ← Φ(x + δ) (fixed-basis surrogate if the SVD is unstable) 4: ℓ ← loss(g(s), y) 5: δ ← δ + η ∇δ ℓ 6: project δ onto the budget B 7: end for 8: return x′ = x + δ projected to the discrete input space

fragile is what we test, and Section 4 finds that the collapse threshold orders against it, so we report it as a hypothesis the evidence does not support. Why the alignment map is the surface. Write the model as g ◦Φ, where Φ produces a rank-k representation in S and g is an L-Lipschitz decoder. Two facts make Φ fragile. First, a bounded input budget B rotates the leading singular subspace of Ā by an amount set by the inverse singular gap 1/(σi − σj ) (Davis-Kahan), so a near-degenerate spectrum turns a small budget into a large displacement inside S. Second, only the part of that displacement the decoder reads changes the output, so a trained decoder with a small task-subspace absorbs the rest. These give a flip-budget proposition with two factors, a margin and a carrier gain. Proposition (flip budget). Let node i have clean margin mi > 0 (the signed distance of node i to its decision boundary in S), and let the attack move its representation with carrier gain κi > 0 (the boundary-normal displacement per unit budget). To first order the minimal budget to flip node i is bi = mi /κi , so reachability is R(B) = Pr[ mi ≤ κi B ]. We show in Section 4 that on realizable attacks the carrier gain κ dominates, and the margin term, which clean accuracy summarizes, does not order reachability on its own. Proofs are in the supplement. Threat model. The attacker acts at inference time only, with no access to training, poisoning, or fine-tuning, and no ability to modify model weights (Figure 1). Three axes vary. Goal: untargeted evasion, with a targeted codebook variant in the ablations. Capability: what is perturbed per carrier (edges and SVD features, input features, node or class text, or the pre-quantization embedding), each within a stated budget. An attack is realizable when its perturbation is an input the model actually accepts; a representation-space perturbation the attacker cannot emit, such as the codebook embedding, is reported only as an upper bound. Knowledge: white box, gray box (surrogate, no victim gradients), or black box (scores or transfer only). We report each capability separately and do not combine them. The realizable input attacks impose no unnoticeability constraint beyond the stated budget, so their numbers upper-bound attacker power. Budget definitions per carrier and two fidelity caveats (OFA’s decoder, ZeroG’s pipeline) are in the supplement.

The ALIGN attack. The objective is a small perturbation δ, within a budget, such that g(Φ(x + δ)) is incorrect or takes a target label. We instantiate it per carrier. For a spectral tokenizer we perturb edges, and features where they enter the SVD, to rotate the leading singular subspace. That objective has zero gradient at the clean graph, so we maximize the task loss and treat the rotation as a consequence, with a fixed-basis surrogate where differentiating the SVD is unstable. For a text space we perturb node text or the shared class-description text, since one class embedding is scored against every node. For the codebook we push a computationtree embedding across the boundary to a target token with a straight-through estimator. The general optimizer is task-loss projected gradient ascent on g ◦ Φ, and what the alignment view contributes is which component to perturb and a perturbation that transfers across domains. In a budget-matched comparison a generic end-to-end perturbation is stronger on its source domain, but one confined to the shared subspace transfers several times better across a real domain gap (supplement). Align-then-ablate. To test whether the attack is carried by the alignment layer we intervene rather than probe. We identify the alignment subspace P by fitting an orthogonal Procrustes map between paired cross-domain representations and taking the rank at which their similarity peaks (supplement), remove it by projection, and report the mediated fracabl tion 1 − (Aabl clean − Aatk )/(Aclean − Aatk ) against a random subspace of the same rank, over a range of ranks. For the discrete codebook the intervention is a do-operator that pins the token index to its clean value.

4

Experiments

We reproduce each model to its published clean number before attacking, then attack across each model’s zero-shot suite with multiple seeds. Table 1 and Figure 2(a) summarize the result. The full seeded matrix is in the supplement. Setup. We evaluate two spectral tokenizer models, OpenGraph and AnyGraph, a closed-form spectral-filter model, GraphAny, two text-space models, OFA and ZeroG, and one codebook model, GFT, each reproduced to its published clean number and wrapped behind one interface so the attack code is shared. The datasets span citation, web, e-commerce, heterophily, and social domains, together with AnyGraph’s native link-prediction graphs on which it is evaluated in its own zero-shot setting (full list in the supplement). Attacks run on each model’s real inference pipeline. Where a white-box gradient passes through a non-differentiable step, such as the entropy-normalized distance in GraphAny or the codebook argmax in GFT, we craft with a torch surrogate and re-evaluate every number on the real pipeline. Budgets are a fraction of the edges or an ℓ∞ or ℓ0 bound on features, each cell averaging over seeds, against an equal-budget random control. Attack success is the relative accuracy degradation (Aclean − Aatk )/Aclean , or the relative Recall@20 drop for AnyGraph. We report the untargeted attack unless noted, and call a model reached when its peak attack success exceeds one half.

Model

Carrier

κ

GraphAny ZeroG OFA GFT AnyGraph OpenGraph

features text text codebook SVD edge SVD edge

7.1 5.9 5.2 – 2.5 0.3

In. peak In. mean Rep. UB 0.98 0.69 0.63 – 0.47 0.30

0.76 0.32 0.59 – 0.31 0.17

0.99 1.00 1.00 0.71 0.82 0.99

Table 1: Main evasion result. Carrier gain κ is a post-hoc descriptor, the initial slope of the attack-success-versus-budget curve in each carrier’s own unit, comparable only within a carrier; GFT has no entry, lacking a realizable input attack. Columns then give the input-space attack success (peak and mean over a model’s datasets) realizable by the stated threat model, and the representation-space upper bound from perturbing the alignment representation directly, which the input lever cannot reach. The saturated bound is high for every model, but a plain network collapses at a similar relative budget (Section 4) except on OpenGraph. The input-space column reaches three models at peak and two by mean (bold). Full seeded matrix in the supplement. Three models are reached by a realizable input-space attack. GraphAny’s feature attack, which edits the input features, succeeds across all four of its domains (the full matrix (supplement)). A sparse variant that changes about four feature entries per node already halves accuracy, and the random control stays near zero, so the strength is the direction, not the budget. The realizable text attack on OFA and ZeroG edits the shared class-description words under a semantic-similarity constraint, and one edit moves the score of every node in that class. It reaches attack success above one half on the citation graphs but zero on the two social graphs, where no improving edit exists (Table 1). GFT’s codebook attack succeeds and holds up to ogbn-arxiv, but it is a representation-space perturbation with no realized inputspace form, so we report it as an upper bound. OpenGraph’s alignment layer is fragile beyond a plain network, the others are not. To separate the lever from the layer we perturb the representation the decoder reads directly, at a directed budget in units of the representation norm. Plain single-domain GCN, GraphSAGE, and GAT collapse at a fraction 0.48 to 0.70 of the norm (mean 0.61), and GraphAny (0.62) and AnyGraph (0.56) sit in this band, so their representation-space collapse is generic. OpenGraph is the exception: its spectral token collapses at 0.12, five times below that band, and a same-representation control (a linear probe and a perceptron on its own clean token collapse at 0.04 and 0.09, at or below the transformer’s 0.15) locates the cause in the tokenizer, not the decoder: the singular value decomposition produces a large-norm, small-margin token any classifier inherits (supplement). A spectral rotation attack reaches OpenGraph through edges. Projected gradient ascent sits at the noise floor on the spectral tokenizer, since the singular basis is detached from the gradient. An edge attack derived from first-order eigenvector perturbation theory recovers the subspace ro-

(a) realizable input-space attack reaches 3 of 6

0.8 0.69 0.63

0.6

reached

0.47

0.4

0.30

0.2

0.0

0.8

defense undefended standardize smoothing

0.82 smoothing raises

0.6

0.4

0.50

defenses lower

0.38

0.53

0.19

0.2

0.11

0.0

y

Gr

attack success (ASR)

attack success (ASR)

1.0

(b) defense follows the carrier 1.0

rep-space UB (0.2-1.6x norm) input-space (realizable)

0.98

a

An ph

G ro Ze

A OF

T GF

ph

An

y

a Gr

continuous (GraphAny)

ph

a Gr

en Op

codebook (GFT)

Figure 2: Left: input-space attack success reaches three of six models above one half, with the representation-space peak drawn as a lighter upper bound the attacker cannot emit, and reached only at a directed budget of 0.2 to 1.6 of the representation norm, not commensurable with the input. An equal budget random perturbation stays near zero except on the densest feature budgets. Right: the defense follows the carrier. Standardization and smoothing lower the attack on the continuous carrier, while smoothing at σ=0.5 raises it on the codebook to 0.82 because the added noise flips tokens. The defense table reports the codebook at σ=0.25. tation and moves OpenGraph off the noise floor, to attack success 0.15 at a tenth of the edges, five times a random flip; the residual resistance is spectral basis degeneracy, not robustness (supplement).

1.0

attack success (ASR)

0.8

What governs the input lever. Headroom is the clean accuracy a task leaves above chance, h = Aclean − 1/C for C classes. Within a single model lower headroom can order reachability, as OpenGraph does across Cora, Citeseer, and PubMed (Figure 4(b)), but pooled across the twenty-one realizable cells it does not (Spearman 0.01, N = 21, supplement). A decoder-side structural predictor does better: the local Lipschitz constant L of the decoder gives a collapse threshold m/(L ∥S∥) per node with no attack curve, dimensionless where the fitted κ and the input-side DavisKahan gap are not. It rank-orders the measured threshold across models and datasets (Spearman 0.65, N = 11) and reproduces OpenGraph’s threshold from clean representations alone, though not with OpenGraph held out (0.53), so we read it as a heuristic, not a law (supplement). We report the fitted κ only within a carrier (Spearman 0.63 to 0.87). Figure 3 plots attack success against budget for one carrier of each type. The attack also reaches auxiliary surfaces (node injection, router re-routing), and combining input channels does not beat the strongest single lever (supplement).

Figure 3: Attack success against budget for a feature carrier (GraphAny), a codebook carrier (GFT), and a spectral edge carrier (OpenGraph) on Cora, with matched equal-budget random controls dashed. Budget is normalized to a fraction of its per-carrier maximum, since the units differ. The carrier gain κ is the initial slope of these curves.

Cross-domain transfer is selective. A single perturbation along a generic axis of the shared text space, crafted on one citation graph, transfers to some targets and not others (supplement). The sharper evidence is the budget-matched comparison in Table 8: one universal vector crafted on Cora, applied unchanged to near-domain Citeseer and far-domain PubMed, either free in the full embedding or confined to the top sixteen shared directions. The generic vector is stronger on the source, because about half its budget lies outside the shared subspace and does not travel. On far-domain PubMed it reaches attack success 0.06, matching a random control, while only the shared-subspace vector transfers above

chance, to 0.22 (three seeds, standard deviation below 0.005). The gap is small but stable, and it is the one operation attacking an encoder cannot express: a universal adversarial perturbation (Moosavi-Dezfooli et al. 2017) carried through the alignment layer, where confining it to the shared lowdimensional subspace is what lets one vector fool a second domain. Citeseer does not distinguish the two conditions, its clean accuracy (0.27) being at chance. A gray-box variant, where an edge set crafted on one spectral model is applied to another with no gradient access to

0.6

GraphAny feature (L∞) (ε ∈ [0.05, 0.2]) GraphAny feature (L0) (k ∈ [5, 50]/node) GFT codebook-flip (budget ∈ [1, 4]) OpenGraph spectral-edge (edge frac ∈ [. 05, . 2])

0.4

random (equal budget)

0.2

0.0 0.0

0.2

0.4

0.6

0.8

1.0

perturbation budget (fraction of max per carrier)

(a) alignment carries attack

(b) headroom orders within OpenGraph only 1.0

0.79

0.79

OpenGraph

0.6

0.4

0.2

0.39

0.39

attack success (ASR)

GFT test accuracy

0.8

other cells (pooled relation n.s.)

0.8

0.6

0.4 Citeseer h=0.44, ASR=0.17

0.2

mediated frac: true 0.75, placebo ~0

PubMed Cora h=0.33, ASR=0.30 h=0.61, ASR=0.04

0.0

0.0 clean attack attack attack +pin +placebo

0.2

0.4

0.6

0.8

clean-accuracy headroom (acc − chance)

Figure 4: Left: removing the alignment subspace collapses the attack on GFT, while a random subspace of the same rank does not, so the alignment layer carries the attack. Right: within OpenGraph the three datasets order by headroom, lower headroom giving higher attack success, but this withinmodel pattern does not survive pooling across models, where the relation is not significant. it, also transfers above a random control at larger budgets though the absolute effect stays small on the resistant spectral pair (supplement). A black-box variant that reads only output scores, with no gradients, recovers most of the whitebox effect on the text carrier at a few hundred queries per node (supplement), so the threat model is evidenced at all three levels of access. Three factors govern transfer: (i) Perturbation must lie along a generic content axis; an attack-tuned universal vector overfits the source and does not travel, (ii) Decoder’s normalization decides exposure: ZeroG standardizes its node embeddings before the readout, which cancels a shared additive shift and defends it, while OFA does not and is exposed, and (iii) Transfer weakens with domain distance. This points to per-domain normalization as a cheap transfer defense. Causal localization. Pinning GFT’s codebook index to its clean value under attack restores accuracy, a do-operator on the discrete carrier that holds across GFT’s node suite (Figure 4(a)). For a continuous spectral carrier the effect does not concentrate in the leading subspace, so the discrete codebook gives the clean causal evidence.

Results by Model The carrier type organizes the outcome (Table 1, per-dataset in the full matrix (supplement)). Where a light decoder reads the alignment representation the attack succeeds. Where a trained network sits between the representation and the output the same move is absorbed unless the task is fragile. GraphAny. Its channels are closed-form solutions read by a light fusion, so a feature perturbation that moves the solved logits changes the output. It succeeds across all four domains at both a dense and a sparse budget of a few entries per node (supplement), and the random control does not move accuracy. What is specific to the foundation model is that the solve runs over a fixed spectral basis shared across every domain

Budget (ℓ2 ) Search space

Cora Citeseer PubMed

1.34 1.34 2.68 2.68

0.56 0.34 0.76 0.51

generic (full) shared subspace generic (full) shared subspace

0.34 0.34 0.34 0.34

0.02 0.08 0.06 0.22

Table 2: One universal perturbation crafted on Cora at matched budget, attack success on each target, mean over three seeds with standard deviation below 0.005. The generic vector wins on the source. The shared-subspace vector transfers to far-domain PubMed, the differentiator of the alignment framing.

with no per-graph training, so one perturbation moves the zero-shot path the model reuses on every dataset. OpenGraph. A trained transformer reads the tokenizer and absorbs a generic edge perturbation where clean accuracy is ample. It succeeds once the task is fragile, so within OpenGraph headroom orders reachability, a within-model pattern that does not survive pooling (Figure 4(b)). AnyGraph. The edge attack on its joint tokenizer succeeds on several datasets, and being in-distribution for the checkpoint gives no protection (supplement). Its feature half is inert, so the edge channel carries the attack. OFA and ZeroG. Both read a similarity between a node embedding and a class embedding in one text space. Editing the shared class-description text is the realizable attack, and one edit moves every node in that class, reaching attack success above one half on the citation graphs but zero on the two social graphs, where a two-class decoder admits no improving edit (Table 1). Perturbing the node embedding directly is higher but an upper bound the attacker cannot emit. GFT. The codebook is discrete, so the attack flips token assignments, and pinning the tokens to their clean value restores accuracy. This gives the clean causal evidence (Figure 4(a)), and the effect holds up to ogbn-arxiv, about 170k nodes. Classical attacks cover only the structural surface. A classical graph attack perturbs the adjacency, so it is defined only where a model reads one, limiting the comparison to OpenGraph node classification. There Metattack and PGD transferred from a surrogate graph convolutional network exceed our tokenizer-targeted attack on Cora and Citeseer and beat it on fragile PubMed (supplement), so we claim no advantage on the structural surface. The point is the reverse. Nettack edits one graph for one task (Zügner, Akbarnejad, and Günnemann 2018), with no form that shifts a class embedding read against every node, flips a shared codebook token, or carries a perturbation across domains through the alignment map. The text carrier, the codebook, and the crossdomain transfer have no classical counterpart. Ablations. The attack objective matters (A1): the task loss and its fixed-basis surrogate reach high success while the subspace rotation objective does not, because its gradient vanishes at the clean graph. The causal effect is graded in the

Defense (carrier) standardize (GraphAny) smoothing (GraphAny) smoothing (GFT codebook) GCN-SVD (OpenGraph)

Cleandef Undef. Static Adapt. 0.78 0.80 0.78 0.42

0.38 0.38 0.49 0.15

0.11 0.19 0.68 0.06†

0.39 0.31 0.72 –

Table 3: Attack success under each defense, static and adaptive. None survives the adaptive attacker, on the codebook they backfire even statically, and GCN-SVD is unusable (the † drop is clean accuracy collapsing, undefended clean 0.61). Full table in the supplement. ablated rank on GFT (A3), while continuous carriers do not localize. Spectral degeneracy lowers the attack cost within a graph (A5), and a targeted codebook flip is more damaging than an untargeted one although it flips fewer tokens (A9). Full tables are in the supplement.

5

Defense: Not Correctable, but Detectable

Robustifying the alignment layer fails. We derive four defenses from the causes above, standardization, smoothing, margin hardening, and an off-the-shelf spectral purification, and evaluate each against an adaptive attacker, which is the correct test. None survives (appendix). Standardization is the strongest static defense but a defense-aware attacker differentiates through it and recovers the full attack. Smoothing gives a certified radius in carrier space that does not cover the attack budget (Cohen, Rosenfeld, and Kolter 2019; Bojchevski, Klicpera, and Günnemann 2020), and an attacker that averages over the noise recovers most of its benefit. On the codebook the noise these defenses add itself flips tokens, so they backfire even statically. GCN-SVD is unusable on the spectral carrier, because OpenGraph’s tokenizer is itself a truncated singular value decomposition of the same adjacency (Entezari et al. 2020), so the subspace it keeps is the one the attack rotates. A decoder that resists a single token flip removes that one lever, but an adaptive attacker moves to the continuous prototype head and total attack success rises above the undefended level (Table 3). Attacked inputs are detectable. Flagging the attack does not require correcting it. The attack pushes the representation off the clean manifold, so a density test fit on clean representations alone separates attacked from clean inputs, almost perfectly on the low-dimensional continuous carriers: a Mahalanobis test on GraphAny’s fusion distances and GFT’s pre-quantization embedding reaches AUC 1.00 at a five percent false-positive rate. It holds under an adaptive attacker adding a stay-on-manifold penalty (GFT stays near AUC 0.87; on GraphAny the attacker pulls it toward chance only by cutting attack success from 0.37 to 0.12), and flags a feature-distribution attack (Inkawhich et al. 2020) where that attack flips the prediction (supplement). The test is fit on clean representations only, and is not uniform, falling to 0.66 on ZeroG’s near-isotropic text embedding, so it tracks the carrier’s effective dimension (Table 4), the graph analogue of an image result that a perturbation raises the local intrinsic dimensionality (Ma et al. 2018).

Model

Carrier

Eff. dim AUC TPR@5% Adapt.

GraphAny fusion GFT codebook z ZeroG text

5 3 73

1.00 1.00 0.66

1.00 1.00 0.08

0.74 0.88 0.92

Table 4: Detection of attacked inputs by a density test fit on clean representations. Effective dimension is the participation ratio of the clean representation, which tracks detectability, not the ambient dimension. GFT’s 768-dimensional embedding sits near a discrete codebook, so its effective dimension is 3 and it is caught, while ZeroG’s near-isotropic text embedding has effective dimension 73 and is not.

6

Discussion and Limitations

On the structure-only surface of OpenGraph, classical attacks transfer better than ours; the contribution there is the alignment surfaces they cannot express and the causal localization they do not provide. Causal localization is clean for the discrete codebook but confounded for continuous carriers, where no linear erasure (LEACE, INLP) both preserves clean accuracy and removes the effect, so the discrete dooperator is the only clean handle. The certified radius is in carrier space; an input-space guarantee needs a Lipschitz bound on Φ, which the codebook lacks, since nearest-token assignment is piecewise constant, so the certificate cannot lift to the input there. The capabilities differ in realism: text edits are realistic when the attacker supplies content and we constrain them by semantic similarity, while feature and edge perturbations assume control of attributes or links and impose none of the unnoticeability constraints standard in the graph-attack literature (Zügner, Akbarnejad, and Günnemann 2018), so their numbers upper-bound attacker power.

7

Conclusion

The alignment layer that maps every domain into one shared space is an attack surface that has not been studied. Most alignment layers are no more fragile under a directed representation-space perturbation than a plain graph network, but OpenGraph’s spectral tokenizer collapses at a fifth of the budget, a fragility specific to the alignment layer that a carrier-specific edge attack partially realizes. An inputaccess attacker breaks three of the six, gated by how directly the decoder reads the representation, not by clean accuracy. Robustifying the layer fails against an adaptive attacker, but attacked inputs are detectable on its low-dimensional carriers.

8

Ethical Statement

This is robustness research on public benchmarks and released models. All attacks are inference-time evasion, reported so that builders can defend the alignment layer. We target no deployed system and release code for reproducibility.

References Athalye, A.; Carlini, N.; and Wagner, D. 2018. Obfuscated Gradients Give a False Sense of Security: Circumventing De-

fenses to Adversarial Examples. In Proceedings of the 35th International Conference on Machine Learning (ICML), volume 80 of PMLR, 274–283. Belrose, N.; Schneider-Joseph, D.; Ravfogel, S.; Cotterell, R.; Raff, E.; and Biderman, S. 2023. LEACE: Perfect Linear Concept Erasure in Closed Form. In Advances in Neural Information Processing Systems (NeurIPS). Bojchevski, A.; Klicpera, J.; and Günnemann, S. 2020. Efficient Robustness Certificates for Discrete Data: SparsityAware Randomized Smoothing for Graphs, Images and More. In Proceedings of the 37th International Conference on Machine Learning (ICML), volume 119 of PMLR, 1003– 1013. Carlini, N.; and Wagner, D. 2017. Towards Evaluating the Robustness of Neural Networks. In 2017 IEEE Symposium on Security and Privacy (S&P), 39–57. Cohen, J. M.; Rosenfeld, E.; and Kolter, J. Z. 2019. Certified Adversarial Robustness via Randomized Smoothing. In Proceedings of the 36th International Conference on Machine Learning (ICML), volume 97 of PMLR, 1310–1320. Dai, H.; Li, H.; Tian, T.; Huang, X.; Wang, L.; Zhu, J.; and Song, L. 2018. Adversarial Attack on Graph Structured Data. In Proceedings of the 35th International Conference on Machine Learning (ICML). Entezari, N.; Al-Sayouri, S. A.; Darvishzadeh, A.; and Papalexakis, E. E. 2020. All You Need Is Low (Rank): Defending Against Adversarial Attacks on Graphs. In Proceedings of the 13th International Conference on Web Search and Data Mining, WSDM ’20, 169–177. New York, NY, USA: Association for Computing Machinery. ISBN 9781450368223. Gupta, I.; Schaeffer, R.; Kazdan, J.; Liu, K. Z.; and Koyejo, S. 2025. Understanding Adversarial Transfer: Why Representation-Space Attacks Fail Where Data-Space Attacks Succeed. arXiv:2510.01494. Huh, M.; Cheung, B.; Wang, T.; and Isola, P. 2024. The Platonic Representation Hypothesis. In Proceedings of the 41st International Conference on Machine Learning (ICML). Inkawhich, N.; Liang, K. J.; Carin, L.; and Chen, Y. 2020. Transferable Perturbations of Deep Feature Distributions. In International Conference on Learning Representations (ICLR). Inkawhich, N.; Wen, W.; Li, H. H.; and Chen, Y. 2019. Feature Space Perturbations Yield More Transferable Adversarial Examples. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 7066– 7074. Jia, J.; Liu, Y.; and Gong, N. Z. 2022. BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning. In 2022 IEEE Symposium on Security and Privacy (S&P), 2043–2059. Jin, W.; Li, Y.; Xu, H.; Wang, Y.; Ji, S.; Aggarwal, C.; and Tang, J. 2020. Adversarial Attacks and Defenses on Graphs: A Review, A Tool and Empirical Studies. ACM SIGKDD Explorations Newsletter, 22(2): 19–34. ArXiv:2003.00653. Kim, H.; Papamakarios, G.; and Mnih, A. 2021. The Lipschitz Constant of Self-Attention. In Proceedings of the 38th International Conference on Machine Learning (ICML).

Kornblith, S.; Norouzi, M.; Lee, H.; and Hinton, G. 2019. Similarity of Neural Network Representations Revisited. In Proceedings of the 36th International Conference on Machine Learning (ICML). Li, Y.; Wang, P.; Li, Z.; Yu, J. X.; and Li, J. 2024. ZeroG: Investigating Cross-dataset Zero-shot Transferability in Graphs. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD). Liu, H.; Feng, J.; Kong, L.; Liang, N.; Tao, D.; Chen, Y.; and Zhang, M. 2024. One for All: Towards Training One Graph Model for All Classification Tasks. In International Conference on Learning Representations (ICLR). ArXiv:2310.00149. Liu, J.; Yang, C.; Lu, Z.; Chen, J.; Li, Y.; Zhang, M.; Bai, T.; Fang, Y.; Sun, L.; Yu, P. S.; and Shi, C. 2025. Graph Foundation Models: Concepts, Opportunities and Challenges. IEEE Transactions on Pattern Analysis and Machine Intelligence. ArXiv:2310.11829. Luo, J.; Sun, Q.; Lyu, L.; Zhang, Z.; Yuan, H.; Fu, X.; and Li, J. 2026. Towards Effective, Stealthy, and Persistent Backdoor Attacks Targeting Graph Foundation Models. Proceedings of the AAAI Conference on Artificial Intelligence, 40(29): 24142–24150. Ma, X.; Li, B.; Wang, Y.; Erfani, S. M.; Wijewickrema, S.; Schoenebeck, G.; Houle, M. E.; Song, D.; and Bailey, J. 2018. Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality. In International Conference on Learning Representations. Mao, H.; Chen, Z.; Tang, W.; Zhao, J.; Ma, Y.; Zhao, T.; Shah, N.; Galkin, M.; and Tang, J. 2024. Position: Graph Foundation Models Are Already Here. In Proceedings of the 41st International Conference on Machine Learning (ICML). Meng, K.; Bau, D.; Andonian, A.; and Belinkov, Y. 2022. Locating and Editing Factual Associations in GPT. In Advances in Neural Information Processing Systems (NeurIPS). Moosavi-Dezfooli, S.-M.; Fawzi, A.; Fawzi, O.; and Frossard, P. 2017. Universal Adversarial Perturbations. In 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 86–94. Sabour, S.; Cao, Y.; Faghri, F.; and Fleet, D. J. 2016. Adversarial Manipulation of Deep Representations. In International Conference on Learning Representations (ICLR). Sun, Y.; Wang, S.; Tang, X.; Hsieh, T.-Y.; and Honavar, V. 2020. Adversarial Attacks on Graph Neural Networks via Node Injections: A Hierarchical Reinforcement Learning Approach. In Proceedings of The Web Conference 2020, WWW ’20, 673–683. New York, NY, USA: Association for Computing Machinery. ISBN 9781450370233. Tramèr, F.; Carlini, N.; Brendel, W.; and Madry, A. 2020. On Adaptive Attacks to Adversarial Example Defenses. In Advances in Neural Information Processing Systems (NeurIPS). Usama, M.; and Chang, D. E. 2026. Convergence Without Understanding: When Language Models Agree on Representations but Disagree on Reasoning. arXiv:2605.23315. Wang, Z.; Zhang, Z.; Chawla, N. V.; Zhang, C.; and Ye, Y. 2024. GFT: Graph Foundation Model with Transferable Tree

Vocabulary. In Advances in Neural Information Processing Systems (NeurIPS). ArXiv:2411.06070. Xia, L.; and Huang, C. 2026. AnyGraph: Graph Foundation Model in the Wild. In Liakata, M.; Moreira, V. P.; Zhang, J.; and Jurgens, D., eds., Findings of the Association for Computational Linguistics: ACL 2026, 882–896. San Diego, California, United States: Association for Computational Linguistics. ISBN 979-8-89176-395-1. Xia, L.; Kao, B.; and Huang, C. 2024. OpenGraph: Towards Open Graph Foundation Models. In Findings of the Association for Computational Linguistics: EMNLP 2024. Xu, K.; Chen, H.; Liu, S.; Chen, P.-Y.; Weng, T.-W.; Hong, M.; and Lin, X. 2019. Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective. In Proceedings of the 28th International Joint Conference on Artificial Intelligence (IJCAI). Zhang, Q.; Sheng, X.; Sun, Y.; and Tan, Q. 2025. TrustGLM: Evaluating the Robustness of GraphLLMs Against Prompt, Text, and Structure Attacks. In Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD). ArXiv:2506.11844. Zhang, T.; Jha, R.; Bagdasaryan, E.; and Shmatikov, V. 2024. Adversarial Illusions in Multi-Modal Embeddings. In 33rd USENIX Security Symposium (USENIX Security). Zhao, J.; Zhu, Z.; Galkin, M.; Mostafa, H.; Bronstein, M.; and Tang, J. 2025. Fully-inductive Node Classification on Arbitrary Graphs. In International Conference on Learning Representations (ICLR). ArXiv:2405.20445; proposes GraphAny. Zhao, Y.; Pang, T.; Du, C.; Yang, X.; Li, C.; Cheung, N.-M.; and Lin, M. 2023. On Evaluating Adversarial Robustness of Large Vision-Language Models. In Advances in Neural Information Processing Systems (NeurIPS). Zügner, D.; Akbarnejad, A.; and Günnemann, S. 2018. Adversarial Attacks on Neural Networks for Graph Data. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD). Zügner, D.; and Günnemann, S. 2019. Adversarial Attacks on Graph Neural Networks via Meta Learning. In International Conference on Learning Representations (ICLR). This supplement contains the full seeded results matrix (§A), the classical-attack baseline comparison (§B), crossdomain transfer numbers (§E), the complete ablation battery (§F), the robust-GFM tables including the certifiedrobustness and joint-retrain results (§G), and method, dataset, and reproduction details (§H).

A

Full Evasion Matrix

Table 5 reports the peak attack success rate (relative accuracy drop) for each model and dataset, best over our attacks and the reported budget sweep. Random-perturbation baselines of equal budget are near zero throughout (0.00–0.03), except on the densest-feature graphs (PubMed, WikiCS) where even random noise moves accuracy somewhat. Cells derived from a seeded sweep report the mean. The per-seed rows are in the released results.json (evasion_seeds). AnyGraph rows are flagged for the link2-pretrained checkpoint: Cora

and CS are in-distribution (seen), only Citeseer, PubMed, products, and p2p are genuine zero-shot. GraphAny, per dataset (three seeds). Citation: Cora 0.87 ± .00, Citeseer 0.92 ± .00, PubMed 0.98 ± .00. Web: WikiCS 0.91±.01. E-commerce: Amazon-Photo 0.61±.04, Amazon-Computers 0.68 ± .03. Heterophily: Cornell 0.71 ± .05, Texas 0.39 ± .05, Wisconsin 0.55 ± .05. The ℓ0 sparsefeature variant reaches ASR 0.52 at k=5 (∼4 entries/node) and matches the dense ℓ∞ attack (0.87) at k=25, while a random-ℓ0 control stays at 0.02–0.05. Scale. The attack is not limited to small citation graphs. It is evaluated on graphs from 2.7k to 169k nodes across citation, wiki, e-commerce, social, and link-prediction domains. On ogbn-arxiv, the largest graph, the GFT codebookflip reaches attack success 0.75 and the codebook do-operator still restores clean accuracy, so the causal localization holds at 169k nodes. GraphAny breaks on PubMed and Amazon, and ZeroG breaks on the reddit and instagram social graphs. Larger graphs dampen the structural edge attacks but not the feature, text, or codebook carriers, which is consistent with the alignment layer, not the topology, being the reachable surface.

B

Classical-Attack Baselines

A classical graph attack perturbs the adjacency, so it applies only to a model that reads an adjacency, which restricts the comparison to OpenGraph node classification. We craft perturbed adjacencies with DeepRobust (Metattack Meta-Self and PGD topology attack) against a two-layer GCN surrogate on the model’s own citation subgraph, editing only edges between real nodes and leaving the class-prototype nodes untouched, then feed the same perturbed adjacency into OpenGraph and score its real zero-shot predict() as a 10-pass average. Table 6 shows that these classical attacks are a strong baseline on this surface and exceed our tokenizertargeted attack, which we report rather than hide. There is no classical counterpart for the feature, text, or codebook attacks that break the other five models, so those carriers have no baseline of this kind.

C

Realizable Input-Space Attack on the Text Models

The threat model perturbs inputs, so for the text models the realizable attack edits the actual class-description words, not the node or class embedding. The class-text attack is a joint multi-class greedy HotFlip. For each class we tokenize its description, back-propagate the test cross-entropy to the input-token embeddings, score every vocabulary swap by a first-order estimate, re-encode the top candidates through the real sentence encoder, and accept the single best swap that raises the loss subject to a cosine-similarity floor of 0.70 to the original text, capped at eight edits per class. Accuracy is the real decoder at every step, re-verified by injecting the edited texts through the pipeline (max logit deviation < 2 × 10−7 ). Table 7 gives the realizable input-space attack success beside the representation-space upper bound, the node or class embedding perturbation the attacker cannot

Model

Dataset

Peak ASR

n

Best attack

Space

AnyGraph

CS Citeseer Cora PubMed p2p-Gnutella06 products_home Cora PubMed WikiCS ogbn-arxiv Amazon-Computers Amazon-Photo Citeseer Cora Cornell PubMed Texas WikiCS Wisconsin Cora Pubmed Citeseer Cora PubMed Citeseer Cora Pubmed instagram reddit

0.11±0.04 0.26±0.05 0.40±0.02 0.17±0.01 0.43±0.08 0.47±0.00 0.49±0.03∗ 0.04±0.03∗ 0.16±0.04∗ 0.71±0.03∗ 0.69±0.02 0.61±0.02 0.92±0.00 0.87±0.00 0.71±0.05 0.98±0.00 0.43±0.05 0.98±0.00 0.64±0.09 0.96±0.00∗ 1.00±0.00∗ 0.17±0.02 0.04±0.01 0.30±0.02 1.00±0.00∗ 0.75±0.02∗ 1.00±0.00∗ 1.00±0.00∗ 1.00±0.00∗

3 3 3 3 3 3 3 3 3 3 3 3 3 4 3 3 3 3 3 4 3 3 3 3 3 4 3 3 3

spectral-edge spectral-edge spectral-edge spectral-edge spectral-edge spectral-edge codebook codebook codebook codebook feature-L0 feature-L0 feature-Linf feature-L0 feature-Linf feature-Linf feature-L0 feature-L0 feature-L0 node-emb node-emb spectral-edge spectral-edge spectral-edge node-emb class-emb node-emb node-emb node-emb

input input input input input input rep rep rep rep input input input input input input input input input rep rep input input input rep rep rep rep rep

GFT

GraphAny

OFA OpenGraph ZeroG

Table 5: Full evasion matrix. Peak ASR per model and dataset.

Dataset

Budget Ours (spectral) Metattack PGD Random

Citeseer 0.05 Citeseer 0.1 Citeseer 0.2 Cora 0.05 Cora 0.1 Cora 0.2 PubMed 0.05 PubMed 0.1 PubMed 0.2

0.030 0.065 0.171 0.015 0.021 0.037 -0.059 -0.006 0.304

0.090 0.052 0.176 0.128 0.260 0.232 0.088 0.092 0.159 0.125 0.231 0.247 – 0.254 – 0.483 – 0.632

0.057 0.079 0.104 0.017 0.053 0.086 0.029 -0.008 0.059

Table 6: Baseline comparison on OpenGraph. ASR for our spectral-edge attack vs Metattack, PGD, and random at matched edge budgets.

Model Dataset ZeroG Cora Citeseer PubMed instagram reddit OFA Cora PubMed

0.32 0.69 0.57 0.00 0.00 0.54 0.63

0.78 1.00 1.00 1.00 1.00 0.96 1.00

Table 7: Realizable input-space class-text attack success versus the representation-space upper bound for the text models. The upper bound is a node or class embedding perturbation the stated attacker cannot produce. Input-space attack success is near the bound on citation graphs and zero on the two social graphs.

D emit. On citation graphs the text edit recovers most of the upper bound. On the two social graphs it is exactly zero, and this is not a search failure. The unconstrained classembedding attack itself reaches only 0.02 and 0.003 there, so a class-text carrier cannot move a two-class social decoder, and the 1.00 in the upper-bound column is a node-embedding perturbation with no realizable text form.

Input-space Rep. upper bound

Alignment-Targeted vs Generic Attack, and Black-Box Queries

We hold the optimizer, the objective, and the budget fixed and vary only the search space. The generic end-to-end attack optimizes one universal decision-space vector in the full embedding. The alignment-targeted attack confines the same vector to the top sixteen principal directions of the shared representation, the subspace used by align-then-ablate. Both are crafted on Cora and applied unchanged to Cora, near-

Budget (ℓ2 ) Search space

Cora Citeseer PubMed

Direction

1.34 1.34 2.68 2.68

0.563 0.335 0.762 0.511

Any→Open Citeseer Citeseer Cora Cora Open→Any Citeseer Citeseer Cora Cora

generic (full) alignment-targeted generic (full) alignment-targeted

0.344 0.341 0.344 0.344

0.022 0.080 0.060 0.222

Table 8: Generic end-to-end vs alignment-targeted attack, one universal vector crafted on Cora at matched budget, attack success on each target. The generic vector wins on the source, the alignment-targeted vector transfers to far-domain PubMed. Budget frac. White-box Black-box Mean queries 0.1 0.2 0.4

0.203 0.385 0.645

0.148 0.307 0.534

343 305 237

Table 9: Score-based black-box attack on ZeroG’s nodeembedding carrier versus the white-box attack, at matched budget. domain Citeseer, and far-domain PubMed at a matched budget (Table 8). The generic vector is stronger on the source, because about half its budget lies outside the shared subspace and overfits the source class geometry, and that part does not transfer. On far-domain PubMed the generic vector reaches 0.065, at the matched random control, while only the alignment-targeted vector transfers above chance, to 0.224 ± 0.002 over three seeds. This is what the alignment view buys, not a new optimizer but a perturbation that survives a domain change. Near-domain Citeseer is fragile at 0.27 clean accuracy, so both vectors flip it and the two are equal there. A black-box variant reads only the model’s output scores, with no gradients. Score-based search on ZeroG’s text carrier reaches 73 to 83 percent of the white-box attack success at a few hundred queries per node (Table 9), so the threat model is evidenced at white box, gray box (the cross-model spectral transfer above), and black box. This black-box result is at the embedding carrier under query access, not raw-text queries.

E

Cross-Domain Transfer

A single perturbation is crafted on Cora in the shared text space and applied verbatim to target domains. Within the citation family it transfers (ZeroG Cora→Citeseer 0.72, OFA Cora→PubMed 0.43, vs random 0.03). Across the citationto-social gap it fails (ZeroG Cora→reddit 0.05 ≈ random 0.055, →instagram 0.20). A naive universal additive perturbation does not transfer at all. Only a generic semantic axis (top principal direction) travels, and only through decoders that do not standardize per domain (ZeroG standardizes and resists, OFA does not and is exposed). Cross-domain transfer rate (mean target ASR, excluding source): OFA pcaAxis 0.43 (hit rate 1.0), ZeroG pcaAxis 0.36 (near/far split: Citeseer 0.72, PubMed 0.01). Matching the target class prototype in the shared space, the analog of an adversarial illusion (Zhang et al. 2024), is the

Data

Budget Surrog. Victim Random 10% 20% 10% 20% 10% 20% 10% 20%

0.137 0.207 0.248 0.343 0.062 0.159 0.020 0.045

0.044 0.095 0.028 0.086 0.014 0.095 0.015 0.049

0.034 0.075 0.029 0.058 −.00 0.001 −.00 0.008

Table 10: Gray-box cross-model transfer between the two spectral models, attack success (metric drop), two seeds. Surrogate is the attacker’s own model, victim is the target with no gradient access, random is a matched flip-count edge control on the victim.

most budget-efficient within-family carrier. Crafted on Cora it reaches Citeseer at attack success 0.65 at a quarter of the budget where the task-loss vector reaches only 0.11, because the prototype direction is shared across the family while the task-loss direction overfits the source geometry (Gupta et al. 2025). It still does not reach the far domain, where no carrier beats a matched random baseline. This is the same split at a finer grain, the shared direction travels within the family and no direction crosses to it. Gray-box cross-model transfer (E5). The attacker has no gradient access to the victim. It crafts an edge set on a surrogate spectral model, using the surrogate’s own white-box attack, and applies the same edges verbatim to the victim, whose pipeline re-runs the singular value decomposition, renormalizes the adjacency, and, for AnyGraph, re-routes its experts. The transfer is real but weak (Table 10): the victim drop exceeds the matched flip-count random control at the larger budget, most clearly for OpenGraph into AnyGraph on Citeseer, yet stays small in absolute terms. This is consistent with the spectral pair being the resistant carrier, where even the white-box attack has little room on these high-accuracy tasks. The mechanism, not white-box access, is what carries the effect, but the size of the effect is bounded by the victim task’s headroom.

F

Ablation Battery

A1: attack objective. On a 4-block SBM through the reference tokenizer, task-loss and fixed-basis-surrogate objectives both reach ASR 0.925, while subspace-rotation reaches 0.59 despite the largest misalignment. A gradient probe at the clean graph: subspace-objective gradient norm 2.4 × 10−6 vs task-loss 0.13. The clean graph is a minimum of subspace misalignment, so rotation is second-order there. We maximize task loss instead. A3: rank dose-response. Ablating rank 1..12 of the alignment subspace on GFT gives a graded collapse of the mediated fraction (0.12 → 0.32 → 0.71 → 0.74). GraphAny’s curve is noisy because its phi-pathway effect is tiny (17/1000 nodes), consistent with the feature attack routing through the channel logits rather than the distance features.

σ 0.10 0.25 0.50

% certified

certified acc

median radius

96.5 88.6 73.2

0.772 0.739 0.651

0.270 0.577 0.630

Table 11: Certified robustness of GFT under representationspace smoothing. A5: spectral degeneracy. Within a single graph the singular-value gap correlates with misalignment absorbed per unit budget at −0.69: near-degenerate boundaries absorb 5–15× more rotation per edge flipped. The naive cross-graph proxy is confounded (correlation +0.03), reported as an honest negative. A9: targeted vs untargeted. On GFT the targeted codebook-flip reaches higher ASR than untargeted (0.71 vs 0.51) while flipping fewer tokens (88.9% vs 100%): coordinated redirection to a chosen token does more damage than scattering assignments. A4: ablation method. We compare four operators on the same alignment subspace: plain projection, LEACE closedform erasure, INLP, and a matched-rank random-subspace placebo. On GFT’s continuous embedding, projection removes the effect (mediated 0.77) but destroys clean accuracy (clean-ablated 0.15). LEACE reduces the confound (mediated 0.43) yet still costs clean accuracy (0.29). INLP preserves clean accuracy (0.78) but no longer removes the effect (mediated 0.06). No linear erasure both keeps clean accuracy and removes the attack, so the continuous carrier does not localize. The discrete do-operator does. On GraphAny’s distance features every operator, including the random placebo, mediates 0.65 to 0.76 at no clean-accuracy cost, so a rank-6 subspace of the 20-dimensional space is not specific. Both cases confirm that the clean causal evidence is the discrete codebook, not a continuous subspace. Additional surfaces and scale. The attack also reaches auxiliary parts of the alignment layer. Node injection perturbs the same tokenizer without editing existing edges, its effect growing with the injected count, and AnyGraph’s router can be sent to a close-substitute expert. Combining input channels does not beat the strongest single one: a joint edge-andfeature attack on AnyGraph and a joint text-and-edge attack on ZeroG each equal their best single lever, so the channels are redundant, reaching the same representation rather than adding independent damage.

G

Robust GFM: Full Tables

C2 certified robustness (real GFT). Randomized smoothing on the representation, certified via Cohen et al. (2019). Radii are in carrier space (input-space requires Φ Lipschitz). C1 joint encoder+codebook retrain (real GFT, Cora). Table 12: the joint retrain moves the geometry offline hardening could not (margin, mean flip budget, flip rate), but end-toend ASR gets worse, because separating tokens makes flips

metric

vanilla R-GFT

clean acc mean margin flip budget (median ℓ2 ) flip budget (mean ℓ2 ) ASR @ℓ2 =4 flip% @ℓ2 =4

0.782 0.521 1.380 1.456 0.461 100.0

0.781 0.771 1.383 2.044 0.589 98.8

∆ −0.002 +0.250 +0.003 +0.588 +0.128 −1.2

Table 12: Joint-retrain R-GFT vs vanilla GFT. The margin objective is counterproductive on a codebook: rarer but more potent flips. Defense standardize smoothing σ=0.25 smoothing σ=0.5

Clean acc Undef. Static Adapt. 0.756 0.784 0.783

0.493 0.513 0.493 0.675 0.493 0.809

0.666 0.722 0.868

Table 13: GFT codebook defenses at budget four. The defenses raise attack success even statically, because the added noise flips tokens, and the adaptive attacker raises it further. Standard deviation across seeds is 0.001 to 0.003. rarer yet each surviving flip more damaging on the fused readout. Static defense (attack success, defended vs undefended). Against a defender-unaware attacker, GraphAny standardization gives 0.377 → 0.107 at a 1.1 point clean cost and smoothing (σ=0.5) gives 0.377 → 0.187 at no cost. On GFT’s codebook both fail: smoothing rises from 0.501 to 0.824 as σ grows, and standardization gives 0.501 → 0.530. Simple training-free defenses from prior work recover only about ten points, and some (low-rank projection, embedding smoothing) backfire. Adaptive defense (the defenses do not hold). We re-run the GraphAny defenses against an attacker that knows them. Standardization is a differentiable map, so an attacker that differentiates through it recovers the full attack: static 0.107 becomes 0.391 under the adaptive attack, at or above the undefended 0.377. For smoothing, an attacker that averages its gradient over the noise (expectation over transformations, 32 samples) recovers most of the benefit: the static 0.187 at σ=0.5 becomes 0.305, and at lower σ the adaptive attacker recovers essentially all of it. Margin hardening on the codebook already raises attack success non-adaptively, so no adaptive attack is needed. None of the training-free defenses survives an adaptive attacker. GFT codebook defenses, static and adaptive (three seeds). On the discrete codebook the picture is worse than on the continuous carrier. The direct defenses do not lower attack success even against a static attacker, because the noise they add flips tokens, and an adaptive attacker raises it further (Table 13). There is no static gain to recover. Token-flip-insensitive decoder (proof of concept). We change only the decoder to down-weight the flippable code head, keeping the encoder, the codebook, and the attack fixed

Budget Decoder

Clean Transfer Adaptive

1 1 4 4 4

0.785 0.773 0.785 0.784 0.773

vanilla proto-only vanilla down-wt t=.05 proto-only

0.102 0.018 0.493 0.317 0.146

0.231 0.235 0.766 0.772 0.766

Table 14: Token-flip-insensitive decoder against the codebook-flip attack. Down-weighting the code head reduces the transfer attack at small clean cost. The adaptive column shows the attacker moving onto the prototype head.

(Table 14). Down-weighting cuts the codebook-flip attack from 0.493 to 0.317 at budget four for a fraction of a point of clean accuracy, and to 0.146 in the proto-only limit at about one point. At budget one the proto-only decoder cuts a single flip from 0.102 to 0.018. It defeats the token flip specifically. An adaptive attacker moves onto the continuous prototype head, where the number matches the vanilla decoder, so the restriction does not make the layer robust to an unrestricted perturbation. The soft top-m readout helps only under transfer and adds an easier continuous surface that an adaptive attacker exploits.

H

Method, Datasets, and Reproduction

Threat model detail. Capability per carrier: edges and the features that enter the SVD for the spectral models; input node features for GraphAny; node text or the shared classdescription text for the text models; and the pre-quantization embedding for the codebook, which has no realized input form. Every perturbation is bounded, stated as a fraction of the edges or injected nodes, an ℓ∞ (per-entry) or ℓ0 (numberof-entries) bound on features, or a cosine-similarity floor on text. Two fidelity caveats bound the efficacy numbers without changing which layer is attacked: OFA’s trained RGCN decoder is not run, so its efficacy uses a text-space stand-in, and ZeroG is evaluated in its baseline pipeline with LoRA and belief propagation off. Spectral tokenizer. Following OpenGraph: Ā = D−1/2√ AD−1/2√ ; U, S, V = SVD(Ā), node features PL LN(U S + V S) smoothed by l=1 Āl . AnyGraph adds a feature SVD and a top-1 self-scoring mixture-of-experts router. GraphAny solves closed-form LinearGNN channels and fuses them with an entropy-normalized attention. The spectral attack optimizes edge flips in a continuous relaxation projected to an ℓ0 budget. The fixed-basis surrogate detaches the singular basis and differentiates the smoothing operator, avoiding SVD-backpropagation instability at neardegenerate spectra. Codebook. GFT uses a cosine, 4-head codebook (C ∈ R4×128×768 ); assignment is arg maxc cos(projh (z), C[h, c]) per head. The tokenflip attack minimizes the boundary margin toward the second-nearest token with a straight-through estimator. The do-operator pins the discrete indices to their clean values.

Align-then-ablate. We identify the alignment subspace by fitting an orthogonal Procrustes map between paired representations of the same content in two domains, then taking the rank k at which the cross-domain CKA between the aligned representations peaks, and P is the span of the aligned topk directions. We ablate it by projection I − P P ⊤ and, for the continuous carriers, also with closed-form linear erasure (LEACE) and iterated nullspace projection (INLP). We reabl port the mediated fraction 1 − (Aabl clean − Aatk )/(Aclean − Aatk ) against a matched random-subspace placebo, with a dose-response over rank. The discrete codebook do-operator is the only intervention that localizes cleanly. No linear erasure on a continuous carrier both preserves clean accuracy and removes the attack. Metric and hyperparameters. Attack success is the relative accuracy degradation ASR = (Aclean − Aatk )/Aclean , where A is node-classification accuracy, or Recall@20 for AnyGraph’s link-prediction task. All attacks are untargeted unless stated. The feature and codebook attacks use projected gradient ascent, T =60 steps for features and T =150 for edges, step size η=ϵ/4 under an ℓ∞ budget and top-k projection under an ℓ0 or edge budget. Budget sweeps: edge flips at 5, 10, 20% of the real edges, feature ℓ∞ ∈ {0.05, 0.1, 0.2} and ℓ0 ∈ {5, 10, 25, 50} entries per node, and codebook margin budget ∈ {1, 2, 4}. Each cell averages over three seeds unless a single seed is noted. The attacks are cheap. The feature and codebook attacks run in seconds to a couple of minutes on one CPU or GPU, and the edge attack in a few minutes at 150 gradient steps, so crafting one attacked input costs on the order of the model’s own inference pass over the dataset. Models and datasets. Six public GFMs (OpenGraph, AnyGraph, GraphAny, OFA, GFT, ZeroG), each reproduced to its published clean number before attacking and wrapped behind one interface. Datasets span citation (Cora, Citeseer, PubMed, ogbn-arxiv), web (WikiCS), ecommerce (Amazon-Photo/Computers, ogbn-products), heterophily (Cornell, Texas, Wisconsin), and social (reddit, instagram). Attacks are evaluated on each model’s real inference pipeline. White-box gradients that pass through a nondifferentiable step (e.g. the entropy-normalized distance in GraphAny) use a torch surrogate validated to ∼10−6 , with every number re-evaluated on the real pipeline. Code and configuration will be released.

I

Headroom Law: Held-Out Prediction

We turn the headroom observation into a held-out prediction. A cell is one model on one dataset. Headroom is reproduced clean accuracy minus chance, where chance is one over the class count for node classification and zero for AnyGraph’s Recall@20 link task. Reachability is the largest mean-overseed attack success any attack and budget reaches in the cell, and a cell is reachable when that exceeds one half. Over twenty-nine cells the Spearman correlation between headroom and best attack success is −0.53 (95% bootstrap CI [−0.80, −0.16] over ten thousand cell resamples, 99.7% negative, p = 0.003), stable under three summaries of attack success and stronger with the chance subtraction than

Model

ringed = held-out model

1.0

best-attack ASR

0.8

0.4

0.0

Rep. UB Random Input peak 0.99 0.99 0.82

0.27 0.03 0.02

0.98 0.30 0.47

Table 15: Representation-space upper bound for the spectral models, perturbing the decoder-input representation directly. High for all three, so the alignment layer is fragile even where the input-space edge attack is weak.

= 0.53

0.6

0.2

Rep. perturbed

GraphAny channel logits OpenGraph spectral token E AnyGraph expert-input token

AnyGraph GFT GraphAny OFA

OpenGraph ZeroG trend (5 models)

0.0

0.2

0.4

0.6

0.8

clean-accuracy headroom (acc chance)

Figure 5: Reachability against clean-accuracy headroom across twenty-nine cells and six models. Each point is one model on one dataset. Headroom is clean accuracy above chance and reachability is the strongest attack in the cell. The trend is fit on five models and the held-out model is ringed. Headroom orders the cells and the attack carrier sets the vertical offset.

without it. Scoring reachability by negative headroom gives an AUC of 0.68 (Figure 5). For a held-out test we leave out one whole model, fit a line on the other five, and predict the held-out model. Every fold returns a negative slope between −0.36 and −0.76, so the direction of the law does not depend on any single model, and the held-out reachable AUC is 0.68. Out-of-sample point prediction is weaker: the pooled rank correlation between predicted and true attack success is 0.22 and the mean absolute error, 0.31, does not beat predicting the global mean, 0.28. Leaving out a whole domain family instead of a model does slightly better, with a pooled predicted-versus-true Spearman of 0.45 (p = 0.014) and mean absolute error 0.26 just under the mean baseline. The residual variance tracks the model, not the domain, which is what we expect if the model’s alignment carrier sets the offset while headroom sets the order. We estimate the carrier gain κ per cell as the through-origin initial slope of the attack’s success-versus-budget curve, in that model’s budget unit. Under the same model holdout, adding κ to headroom lowers held-out error from 0.29 to 0.20 and raises the predictedversus-true rank correlation from 0.32 to 0.62. Because κ is read from the same curve whose peak is the target, we rerun with κ taken from low budgets only and the top-budget point dropped, on the cells with at least three budgets: the two-factor fit still wins, error 0.29 to 0.26 and rank correlation 0.49 to 0.65. The literal ratio does not transfer across models, since κ is in model-specific units, so we present κ as a measured mechanistic factor, not a cross-model formula. The headroom law is a robust ordering rule and a suggestive, not conclusive, quantitative predictor.

The headroom law does not survive on realizable attacks. The pooled −0.53 was computed on a set that mixed realizable and representation-space attacks, with the unrealizable node-embedding cells at attack success one sitting at low headroom. Restricting to the realizable input-space attacks, GraphAny features, spectral edges, and the text-model classtext edits, and excluding the codebook cells and the h = 0 link cells, the correlation vanishes and flips sign: Spearman +0.01 on N = 21 cells (p = 0.98, CI [−0.50, +0.48]), or +0.02 with the link cells. A permutation test on the withinmodel ranks, which is adequately powered where per-model tests on three datasets are not, is not significant (pooled within-model statistic −0.23, p = 0.25 one-sided, ten thousand permutations). The per-model correlations are mixed, negative for OpenGraph and GraphAny and positive for AnyGraph and ZeroG. Controlling for the carrier gain the partial Spearman is +0.15 with a confidence interval crossing zero. What ranks with attack success is the carrier gain. On realizable attacks κ and attack success correlate at +0.72 across cells (p = 0.0003) and +0.90 across the six models, while headroom is flat (+0.20). We caution that κ is read from the attack curve, so its correlation with peak success is partly a re-description, and its units differ across carriers, so it is a comparative descriptor and not a mechanism. The honest state is that clean accuracy headroom does not predict reachability on realizable attacks, and the carrier gain is the better descriptor.

J

Representation-Space Upper Bound on the Spectral Models

To separate the input lever from the alignment layer, we perturb the representation the decoder reads directly, at a per-node L2 budget swept to saturation, and report the peak over three seeds against a matched-norm random control (Table 15). For OpenGraph we perturb the spectral token E the transformer reads, for AnyGraph the expert-input token, for GraphAny the pre-fusion channel logits. The upper bound is high for all three, and the matched random control stays below 0.03, so the effect is the crafted direction. The decisive cell is OpenGraph on Cora, the dataset that resists the edge attack: a direct token perturbation collapses accuracy from 0.75 to 0.01. OpenGraph and AnyGraph are therefore fragile at the alignment layer, and the edge channel is a weak lever on it, which the small carrier gain records. Budget commensurability and on-manifold distance. The rep-space budget is a per-node ℓ2 radius reported as a fraction of the mean representation norm. Collapsing a

Model

Carrier (dim)

plain GNN (GCN/SAGE/GAT) OpenGraph AnyGraph GraphAny

penultimate spectral tok. (1024) joint-SVD tok. (512) channel logits (21)

Collapse frac 0.61 0.12 0.56 0.62

Table 16: Representation-space collapse threshold, the fraction of the representation norm at which a directed attack drives attack success past one half. Only OpenGraph is below the plain-network band. model needs a fraction of 0.2 to 1.6, so a perturbation worth 20 to 160 percent of the representation’s own norm, while a matched-norm random perturbation never exceeds 0.03 attack success, so the direction carries it. This is not commensurable with the input budget. OpenGraph’s fall from 0.75 to 0.01 needs a token perturbation of 0.4 to 0.8 of the token norm, whereas an edge edit at a fifth of the edges moves the token below the 0.05 threshold, because the singular value decomposition and the power-sum smoothing attenuate edge edits. So the rep-space number is a large-budget upper bound on fragility, not a small-perturbation vulnerability. Whether the attack leaves the clean manifold depends on carrier dimension. GraphAny’s 21-dimensional channel-logit carrier moves off manifold and is caught at AUC 1.0 exactly when it becomes effective, while the high-dimensional spectral tokens of OpenGraph (1024) and AnyGraph (512) stay largely on manifold even at collapse (best detector AUC 0.72 and 0.67), because the effective direction lies inside the highvariance clean subspace. Plain-network control. A perturbation of order the representation norm collapses any classifier, so we ran the control. We trained a plain single-domain GCN, GraphSAGE, and GAT on Cora, Citeseer, and PubMed and applied the identical directed attack to their penultimate node embedding. All nine collapse at a fraction 0.48 to 0.70 of the representation norm, mean 0.61, with a matched-norm random control below 0.06 (Table 16). GraphAny (0.62) and AnyGraph (0.56) sit in this band, so their representation-space collapse is the generic fragility of a message-passing network. OpenGraph collapses at 0.12, about five times below the plain-network band, the one alignment-specific case. The collapse threshold correlates with carrier dimension across the three spectral models (Pearson −0.88, p = 0.02), but with the sign opposite to Claim 3, higher-dimensional carriers collapsing at a lower budget, so the collapse axis does not support fragility-fromconcentration. This is a consistency check on six points, not a law. No second alignment-specific case. We also test the nonspectral carriers against the tighter same-representation control, a plain classifier trained on the very representation the decoder reads. None is more fragile than its own baseline. The GFT codebook decoder collapses at frac 0.55 against 0.60 for a linear probe on the same embedding, since its prediction is dominated by a continuous nearest-prototype head. The text decoders of ZeroG and OFA collapse at a low frac (0.14), but so does a plain probe on the same sentence embedding (0.13

for OFA, lower for ZeroG), so the low threshold is a property of the sentence-embedding representation, not the alignment decoder, and ZeroG’s cosine read-out is in fact more robust than the probe because it normalizes to the sphere. So OpenGraph remains the single carrier whose alignment layer is fragile beyond a matched plain classifier, and we report it as one case, not a class property. The OpenGraph case is the tokenizer, not the decoder. The same-representation control is sharpest on OpenGraph itself. We read its clean spectral token with two plain classifiers, a linear softmax probe and a two-layer perceptron, both trained on the clean tokens of non-test nodes and hit with the identical directed attack. On Cora the linear probe collapses at frac 0.04 and the perceptron at 0.09, against the transformer decoder’s 0.15. On Citeseer the three are 0.03, 0.05, and 0.09. On the identical token both probes collapse at or below the decoder, so the decoder is the most robust of the three readers and does not amplify the push. The low threshold is a property of the singular value decomposition token, which sits at a large radius with a small logit margin, and any classifier on it inherits the fragility. The matched-norm random control is near-inert. Two caveats do not reverse the direction. The probe attack is deterministic while the decoder attack must be robust to the transformer’s random anchor sampling, so part of the decoder’s higher threshold may be attack difficulty rather than robustness, and the probes are fit to the target graph while the decoder is zero-shot. In both the decoder is at most as fragile as its token, never more, so the reading that the trained transformer manufactures the fragility is excluded. Data in results/opengraph_probe.json. A structural, attack-curve-free carrier gain. The fitted κ is read from the attack curve and is not comparable across carriers. A decoder-side structural form is. We take the local Lipschitz constant L = ∥∂g/∂S∥2 of each decoder, the top singular value of its Jacobian at clean test representations, by autograd power iteration. The flip-budget proposition then predicts a per-node collapse threshold m/(L ∥S∥), a margin of logit change divided by the decoder sensitivity and the clean representation norm. This structural prediction tracks the measured collapse threshold across the classification decoders and the plain networks (Figure 6, Spearman 0.65, N = 11, mean absolute error 0.10 in the frac unit) and reproduces OpenGraph’s 0.12 from clean representations alone. OpenGraph sits at the extreme low corner, a predicted and an observed threshold both far below the plain-network cluster on the diagonal. Nine of the eleven cells are plain networks and OpenGraph is a leverage point, so the correlation is not significant with OpenGraph held out (Spearman 0.53, N = 10, p = 0.12), and only two cells are graph foundation models. We therefore report m/(L ∥S∥) as a rank-ordering heuristic for where a carrier sits, not a quantitative law. It is dimensionless, so it is invariant to the per-carrier unit that made the fitted κ swing under rescaling, which is why it succeeds where the input-side Davis-Kahan gap was degenerate. The mechanism is representation geometry, not decoder amplification. Although dot-product selfattention is not globally Lipschitz (Kim, Papamakarios, and Mnih 2021), the per-node local Lipschitz constant of Open-

0.8

Carrier / defense

Spearman 0.65, N = 11

observed collapse threshold

0.7 0.6 0.5 0.4 0.3 0.2 predicted = observed plain GNN (9 cells) GraphAny OpenGraph

OpenGraph 0.1 0.0 0.0

0.2

0.4

0.6

0.8

1.0

predicted threshold m/(L ‖S‖)

Figure 6: Predicted against observed representation-space collapse threshold. The predicted value is the structural, attack-curve-free flip budget m/(L ∥S∥) from the decoder’s local Lipschitz constant and the clean margin and representation norm, with no attack curve. Nine plain-network cells and GraphAny fall near the diagonal, and OpenGraph is the extreme low point, its threshold predicted from clean representations alone.

Graph’s trained transformer is 0.81, below a linear probe on the same token (15.5) and below the plain-network head band (1.5 to 5.7), so the LayerNorm leaves the decoder nearisometric per node. OpenGraph is fragile because L ∥S∥ is large through a large token radius and a small margin, not because attention amplifies the push. Link-prediction AnyGraph is excluded from the law because its decoder outputs candidate scores, not class logits, so L is not in comparable units. Data in results/lipschitz_kappa.json. Spectral √ attack. √ On the spectral tokenizer P rotation edge E = ( l Āl ) LN(U Σ + V Σ), projected gradient ascent on edges is inert. The singular basis U, V is detached from the gradient, since a differentiable full singular value decomposition backward is numerically unstable at OpenGraph’s neardegenerate spectrum, so the gradient carries only the smoothing term and its edge attack sits at the noise floor, with a negative attack success (−0.01 to −0.02) that helps the model. We instead compute the per-edge score ⟨gE , dE/dAab ⟩ analytically, where gE is the decoder gradient with respect to the token (one backward pass, no decomposition) and dE/dAab includes the eigenvector-rotation term the gradient drops. For a symmetric Ā = QΛQ⊤ , flipping edge (a, b) gives P ⊤ dqk = m̸=k (qm dĀ qk )/(λk − λm ) qm , and we clamp the near-degenerate denominators. This rotation term is seven times the norm of the smoothing term. On a well-separated synthetic spectrum the analytic gradient matches a finitedifference derivative to relative error 3×10−7 and converges as h → 0, so the perturbation theory is correct, and the token reconstruction matches the real tokenizer to 1.4 × 10−7 . On OpenGraph’s real Ā the median singular gap is near 4×10−4 , the derivative is ill-defined (the finite-difference error does not converge), and the low-rank solver returns a different basis on each draw with the decoder invariant to that rotation. The regularized attack, evaluated on the real pipeline over three basis draws, still moves OpenGraph off the noise

Cleandef Undef. Static Adaptive

Continuous, GraphAny, fusion-dist PGD, L2 =2.0 standardize (C3) 0.783 0.377 0.107 smoothing σ=0.5 (C2) 0.797 0.377 0.186

0.391 0.306

Codebook, GFT, codebook-flip L2 =4.0 standardize (C3) 0.756 0.493 smoothing σ=0.25 (C2) 0.784 0.493 robust decoder (ours) 0.784 0.493

0.666 0.722 0.772

0.513 0.675 0.317

Spectral, OpenGraph, edge 20%, GCN-SVD r=50 Citeseer 0.417 0.146 0.063† PubMed 0.399 0.170 0.364

– –

Table 17: Attack success (lower is better) with and without each defense. Cleandef is accuracy under the defense, against undefended clean accuracy 0.794, 0.785, 0.607/0.667. Budgets differ by carrier, stated per block. The GraphAny fusiondist budget is smaller than its headline feature budget. GCNSVD costs nineteen points of clean accuracy on Citeseer, so the † value is a clean-accuracy collapse, not a defense.

floor, to attack success 0.15 at a tenth of the edges and 0.16 at a fifth, against a matched random flip of 0.03 and 0.09 and the negative gradient attack. So OpenGraph’s edge resistance is a property of the degenerate spectrum, not intrinsic robustness, and the same degeneracy caps the attack below the alignment and text carriers of the other models. Data in results/spectral_rotation_attack.json.

K

Defenses: Full Table and Detection

Table 17 is the full defense evaluation under a static and an adaptive attacker. None of the robustification defenses survives, on the codebook they backfire even statically, and the off-the-shelf GCN-SVD baseline is unusable on the spectral carrier. Detection. We fit a density test on clean representations of an evaluation split and score held-out clean versus attacked representations, reporting AUC and the true-positive rate at a five percent false-positive rate (Table 18). On the lowdimensional continuous carriers detection is near perfect and holds under an adaptive attacker that adds a stay-on-manifold penalty, read as a two-sided density test since the penalty can overshoot into an anomalously typical region. On GraphAny the adaptive two-sided AUC stays at 0.74 while the evasion drives attack success from 0.37 to 0.01, so evasion and attack are in tension. On GFT the continuous pre-quantization embedding holds at 0.88 even where the discrete codebooknative scores are evadable. The high-dimensional text embedding of ZeroG is the weak case, where a low-budget perturbation hides in a near-isotropic space. Adaptive detection pareto. We sweep the stay-onmanifold penalty weight λ and report at each value both the attack success and the two-sided detection AUC (Table 19, two seeds). On GraphAny the two are traded off. Raising λ drives attack success down and lets the attacker approach chance detection, but the strongest evasion that reaches AUC

Model

Detector

AUC TPR@5% Adapt. 2-sided

GraphAny Mahalanobis GFT Mahalanobis-z ZeroG class Mahalanobis

1.00 1.00 0.66

1.00 1.00 0.08

0.74 0.88 0.92

Table 18: Detection of attacked inputs by a density test fit on clean representations. Near perfect on the low-dimensional continuous carriers and holding under an adaptive attacker, weak on the high-dimensional text embedding.

λ 0.000 0.005 0.010 0.020 0.050

GraphAny ASR AUC2 0.37 0.12 0.06 0.03 0.01

1.00 0.54 0.60 0.72 0.75

λ

GFT ASR AUC2

0.00 0.05 0.20 1.00 5.00

0.48 0.58 0.38 0.23 0.18

1.00 0.87 0.88 0.88 0.88

Table 19: Adaptive detection pareto. Attack success and two-sided detection AUC as the stay-on-manifold penalty λ sweeps. GraphAny trades attack strength for evasion, while GFT’s two-sided detector does not drop. 0.54 already costs two thirds of the attack, and the fullstrength attack is fully detected. On GFT the two-sided test holds near AUC 0.87 at every λ, so there is no penalty that keeps the codebook attack strong and hides it. No setting on either carrier gives a strong attack that also escapes the monitor. A feature-distribution attack does not beat task loss on this surface. A reader may ask whether a stronger attack than projected gradient ascent on task loss exists for the alignment layer. The natural candidate is the feature-distribution attack (Inkawhich et al. 2020, 2019), which in vision moves a representation into a target class’s feature density rather than across the decision boundary and transfers better than a task-loss attack. We adapt it to the alignment layer and call it Aligned-FDA. We fit a class-conditional Gaussian in the shared subspace and push a node toward a wrong-class density and away from its own, with a Mahalanobis objective in place of cross-entropy. A pre-check confirms this is not a relabeling of targeted gradient ascent. The class covariances in the subspace are anisotropic (condition number 17.6 at rank 20), the classes overlap (linear separability 0.75), and the Mahalanobis attack direction differs from the centroid direction for most nodes. The attack is nonetheless weaker. In-domain on ZeroG Cora it reaches attack success 0.23, 0.56, and 0.78 across three budgets, against 0.75, 0.97, and 1.00 for task-loss ascent, because a class-conditional target is a harder objective than crossing the nearest boundary. Its cross-domain transfer to Pubmed is no better than the task-loss universal vector or a centroid push. This is consistent with the result that representation-space perturbations transfer poorly because they target model-specific geometry rather than shared input structure (Gupta et al. 2025), and a class-conditional direction is the most model-specific of the three we try, while the plainer centroid direction trans-

fers best. Against the detector it is the sharpest form of the no-free-evasion property, and the two carriers tell it in two ways. On GraphAny the Aligned-FDA attack drives the classconditional detector below chance, since it makes the representation more typical of a wrong class than a clean input, but it lands in a cluster the decoder does not read as that class, so its attack success is 0.015 while a task-loss attack at the same budget reaches 0.38 and is fully detected. The codebook carrier is the harder test, since GFT’s prototype head reads the representation directly. There the attack does flip the prediction, at attack success 0.66 against 0.46 for the task-loss attack, and it evades both the class-conditional detector and the codebook-specific residual and margin tests, which fall to 0.60 and 0.54. A global two-sided density test on the representation still flags it, at AUC 0.85 across budgets. So a class-conditional or codebook detector alone is not enough against a feature-distribution attack, which is why we monitor with the global two-sided density test, and on that test no attack both fools the model and evades the monitor. Data in results/aligned_fda_*.json.

L

Theory: Fragility, Headroom, and Absorption

We formalize the three empirical rules of Section 3. Throughout, the model is g ◦ Φ. The alignment map Φ sends an input x = (A, X, text) to a representation r ∈ S. For a spectral model S is the leading rank-k singular subspace of the normalized adjacency Ā = D−1/2 AD−1/2 , with singular values σ1 √≥ σ2 ≥√ · · · and token features
PL l Ā LN(U E = Σ + V Σ). The graph is undil=1 rected, so Ā is symmetric and its SVD is its eigendecomposition with U = V . The decoder g reads r and is L-Lipschitz on S. The attacker perturbs the input by δ within a budget B, measured by ∥δ∥ for features and by the edit count for edges. We write Pk for the orthogonal projector onto the retained subspace and Θ(Pk , Pk′ ) for the principal angles between the clean and perturbed subspaces.

P1: Fragility of a Low-Dimensional Shared Bottleneck Assumptions. (A1) Ā is symmetric with a spectral gap γk = σk − σk+1 > 0 at the boundary of the retained subspace. (A2) The input-to-operator map is Lipschitz. A perturbation of budget B produces a symmetric E = Ā(x + δ) − Ā(x) with ∥E∥F ≤ cA B for a constant cA fixed by the normalization. (A3) The decoder reads the boundary direction. The runner-up singular direction uk+1 has nonzero image under g, with directional gain µ = ∥∂uk+1 g∥ > 0. Proposition P1. Under (A1)-(A3) there is a perturbation of budget B whose induced output change obeys g(Φ(x+δ)) − g(Φ(x))

≥ µ c σk

B + o(B), γk

for a constant c > 0, and every perturbation of budget B obeys the matching upper bound L c′A σ1 B/γk . The amplification factor is 1/γk .

function of B because each 1[bi ≤ B] is. When gains match, R(B) = Pr[m ≤ κB] = F (κB), and stochastic dominance FA ≤ FB gives RA ≤ RB pointwise. □

Proof sketch. By Davis-Kahan (sin-Θ), for any symmetric perturbation E, ∥ sin Θ(Pk , Pk′ )∥F ≤ ∥E∥F /γk , which gives the stated upper bound after composing with the Lipschitz decoder and the token map E(·), whose sensitivity to a rotation of U is O(σ1 ). For the lower bound take the extremal rank-two perturbation E = t (uk u⊤ + uk+1 u⊤ k+1 k ), which re√ spects the budget with ∥E∥F = 2 t ≤ cA B. First-order eigenvector perturbation gives

Honesty. This proposition is a first-order account, and the empirical result in the main text supersedes its scalar reading: on the realizable attacks the margin term, which clean accuracy summarizes, does not order reachability (Spearman +0.01, N = 21), so we do not claim the scalar headroom law. We keep the proposition as the mechanism that motivates the carrier gain and state its limits.

δuk =

X u⊤ j E uk j̸=k

t uj = uk+1 + O(t2 ), σk − σ j γk

so the retained subspace rotates by angle θ ≈ t/γk = √ ∥E∥F /( 2 γk ). This is√the classic 1/(σi − σj ) coupling. The token block LN(2U Σ) moves by Ω(σk θ) along uk+1 , so the displacement inside S is at least c′ σk B/γk . Multiplying by the decoder gain µ from (A3) gives the claim. □ Honesty. The lower bound needs a white-box attacker who aligns E to the gap directions and a decoder that reads uk+1 . When the spectrum is well separated (γk large) the bound is weak, and when the decoder does not read the rotated direction the gain µ is small. Both escape hatches are real, and P3 formalizes the second. This matches ablation A5, where the singular gap correlates with rotation absorbed per unit budget at −0.69.

P2: The Clean-Accuracy-Headroom Law Assumptions. (B1) The decoder classifies node i by the sign of a margin mi = ⟨ni , ri ⟩ − τi to a local decision boundary with unit normal ni in S. Correctly classified nodes have mi > 0. (B2) Near the clean input Φ is differentiable at node i with Jacobian Ji , so a perturbation δ moves the representation by ∆ri = Ji δ + o(∥δ∥). (B3) The budget is small enough that the boundary and Ji are locally constant (first-order regime). Proposition P2 (headroom law). Define the carrier gain κi = ∥Ji⊤ ni ∥. Under (B1)-(B3) the minimal budget to flip node i is   mi , R(B) = Pr mi ≤ κi B . bi = κi R(B) is nondecreasing in B. If two tasks share the gain law and the margins of task A first-order stochastically dominate those of task B, that is FA (m) ≤ FB (m) for all m where F is the margin CDF, then RA (B) ≤ RB (B) at every budget. Proof. The attacker maximizes the boundary-normal displacement under the budget, max∥δ∥≤B ⟨ni , ∆ri ⟩ = max∥δ∥≤B ⟨Ji⊤ ni , δ⟩ = B ∥Ji⊤ ni ∥ = κi B, attained at δ ⋆ = B Ji⊤ ni /∥Ji⊤ ni ∥. The node flips when this reaches the margin, κi B ≥ mi , giving bi = mi /κi . Summing the flip indicator gives R(B), which is a nondecreasing step

1. The clean statement is about the margin distribution, not scalar clean accuracy. Clean accuracy is the observable summary 1 − F (0+ ) of that distribution. Two tasks with equal clean accuracy but different margin spread need not be equally reachable, so the scalar version holds only when clean accuracy tracks the margin CDF, which it does on the tasks we test. This is why the causal figure in the main paper shows the logit margin as a weaker single separator than the accuracy headroom. 2. The gain κi = ∥Ji⊤ ni ∥ is the second factor, how directly the carrier is read. The honest law is the two-factor R(B) = Pr[m/κ ≤ B]. Clean-accuracy headroom orders reachability because m and κ co-vary with the task on these models, not because accuracy is causal on its own. 3. First order only. It ignores multi-node coupling and, for structure attacks, the discrete edge budget, which we treat by continuous relaxation.

P3: Decoder Absorption Assumptions. (C1) The decoder factors as g(r) = h(W r) with W : S → RdT of rank dT ≤ k. Its row space T = row(W ) is the task-subspace and N = ker W is the null subspace. (C2) The achievable representation displacement ∆r from P1 has orientation relative to T that the attacker cannot fully control, modeled as uniform over the retained rank-k subspace in the gray-box or geometry-constrained regime. Proposition P3. Under (C1) any component of ∆r in N leaves the output unchanged, and g(r+∆r) − g(r) ≤ Lh ∥W ∥ ∥PT ∆r∥, q E ∥PT ∆r∥ = dkT ∥∆r∥ under (C2). So reachability falls as the task-subspace fraction dT /k → 0. Proof. Since g(r) = h(W r) and W PN = 0, we have g(r + ∆r) − g(r) = h(W r + W PT ∆r) − h(W r), which is bounded by Lh ∥W PT ∆r∥ ≤ Lh ∥W ∥∥PT ∆r∥ by the Lipschitz constant of h. The null component is absorbed exactly. Under (C2) the expected squared task-projection of a displacement uniform on the rank-k p subspace is (dT /k)∥∆r∥2 , and Jensen gives the stated scale dT /k. □

Consequence, and how it unifies P2 and P3. Absorption reduces the effective carrier gain to κi = ∥Ji⊤ ni ∥ with ni read through W , so κi shrinks with the task-projection of ni . The flip budget of P2 then factors as bi =

mi ∝ κi

1 mi × . |{z} ∥PT ni ∥ | {z } headroom absorption

Resistance is a large margin times a small task-projection. • GraphAny. Its channels are a closed-form solve read by a light fusion, so W is near identity on the channel logits, dT ≈ k, and there is no null subspace to absorb the feature attack. Both factors are small, so it is reachable. This matches the high feature-attack success. • OpenGraph. A trained transformer learns a small tasksubspace (dT ≪ k), and on a high-headroom task the margins are large. Both factors are large, so it resists. On a low-headroom task the margin is small, so the leaked task-projection suffices and even the trained transformer is reachable. This is exactly the observed reversal across Cora, Citeseer, and PubMed. Honesty. P3 governs the gray-box and geometryconstrained regimes. A white-box attacker with gradients through g performs steepest ascent, and the gradient W ⊤ h′ lies in T by construction, which removes the attenuation. So P3 does not claim a trained decoder is unreachable in white box. It claims the attenuation when alignment to T is imperfect, which is the case for the spectral carrier because the fixed-basis surrogate cannot rotate Pthe detached singular basis and the smoothing operator l Āl shrinks the perturbation that reaches U . OpenGraph’s residual white-box resistance is this attenuation plus the headroom factor of P2, not a claim that its task-subspace is unreachable in principle.