Adversarial Masked Graph Modeling for Robust Graph Autoencoders

1 Introduction

Graph Masked AutoEncoders (GMAEs) have emerged as a prominent self-supervised method for graph representation learning [Hou et al., 2022; Shen et al., 2025], achieving notable success in diverse scenarios such as traffic prediction and anomaly detection [Ma et al., 2024; Liu et al., 2024].

∗Corresponding Author.

Their goal is to reconstruct the masked portions of node features or edges from partial observations [Hou et al., 2023; Li et al., 2023].

Despite their satisfactory performance, most existing GMAEs rely on the assumption that input graphs are reliable and unperturbed. In practice, this assumption does not always hold, especially in adversarial attack scenarios [Dai et al., 2018; Sun et al., 2022]. As a result, GMAEs are not robust enough and are still facing the following two challenges:

(1) Overfitting to Adversarial Noises. Existing GMAEs typically rely on simple reconstruction objectives (e.g., Mean Squared Error (MSE) [Hou et al., 2022] or Binary Cross Entropy (BCE) [Jung and Park, 2025]). These methods indiscriminately treat all observed edges as ground truth [Hu et al., 2025; Hu et al., 2024]. It causes the model to fit spurious statistical correlations rather than distinguishing inherent structural signals from adversarial attacks [Z¨ugner et al., 2018; Ganin et al., 2016].

(2) Neglect of Implicit Structural Guidance. Current GMAEs are often limited to recovering masked components based solely on visible graph [Huo et al., 2023; Zheng et al., 2018]. They fail to capture latent correlations between nodes and their unconnected yet semantically similar counterparts. As a result, these models lack sufficient contextual guidance to yield robust embeddings, especially when the graph structure is subjected to adversarial attacks [Xia et al., 2025].

To address these challenges, we draw inspiration from the adversarial masking paradigm, which has proven effective in natural language processing [Fedus et al., 2018] and computer vision [Fei et al., 2023], as illustrated in Figure 1. These methods enhance model performance by reconstructing masked parts from inputs that are both partially masked and adversarially perturbed. It motivates a compelling yet unexplored question: Can the adversarial masking modeling paradigm effectively enhance the robustness of graph masked autoencoders?

To this end, we propose ArmorGAE, an Adversarial masked graph modeling method for robust Graph AutoEncoders. We establish the connection between masked autoencoders and contrastive learning, demonstrating that our strategy is theoretically equivalent to expanding the positive samples in implicit contrastive learning. Specifically, we first enrich the graph topology by adding semantically relevant edges based on feature similarity and degree constraint. We then design an adversarial masked autoencoder to alleviate the risk of overfitting to perturbed graphs. Within this adversarial framework, the generator and discriminator are jointly optimized. The former aims to recover the underlying true data distribution, while the latter distinguishes reconstructed and real edges. The contributions of this paper are as follows.

• NewMethod: We propose ArmorGAE, the first adversarial masked graph modeling method that synergizes adversarial training and graph masked autoencoders to enhance the robustness of learned representations.
• Theoretical Analysis: We present a dual-consistency augmentation method and prove its equivalence to expanding positive samples in implicit contrastive learning, which provides enriched supervisory signals.
• Superior Performance: Extensive experiments demonstrate that ArmorGAE significantly outperforms stateof-the-art baselines under various adversarial attacks, confirming its superior performance and robustness.

2 RelatedWork

Graph Masked Autoencoders. Recent advancements in GMAEs have established them as a powerful generative selfsupervised paradigm. These methods are typically categorized into feature reconstruction (FeatRec) and topology reconstruction (TopoRec). In the realm of FeatRec, GraphMAE [Hou et al., 2022] introduced scaled cosine error and remask decoding to stabilize generative training, while GraphMAE2 [Hou et al., 2023] further refined this via multi-view latent prediction. AUGMAE [Wang et al., 2024] attempted to increase task difficulty using an adversarial masking strategy. Simultaneously, TopoRec methods such as MaskGAE [Li et al., 2023] and S2GAE [Tan et al., 2023] focused on recovering missing edges to capture structural dependencies. Bandana [Zhao et al., 2024] further improved structural awareness via layer-wise bandwidth prediction. Despite their notable success, these methods assume the availability of clean graphs, leaving them vulnerable to structural noise and incomplete connectivity.

Adversarial Training. Adversarial training on graphs has traditionally focused on the interplay between attacks and defenses [Sun et al., 2022; Chang et al., 2020]. Attack methods like Nettack [Z¨ugner et al., 2018] and Metattack [Sun et al., 2020] have exposed the fragility of GNNs by perturbing graph spectra or poisoning training structures. To counter these, adversarial training has emerged as a powerful paradigm for learning robust representations. In computer vision, recent studies have demonstrated that integrating adversarial training into the MAE framework effectively enhances adversarial robustness [Fei et al., 2023]. In the graph domain, ARGA [Pan et al., 2018] regularized the latent space against a prior distribution to prevent representation collapse. However, the intersection of generative self-supervised learning and adversarial training on graphs remains underexplored.

3 ProposedMethod

3.1 Preliminaries

Definition 1. Attributed Graph [Zhao et al., 2022]. Let G = (V, E,X) be an attributed graph, where V = {v1, v2, . . . , vN} is the set of nodes, and E ⊆ V × V is the set of edges. The node feature matrix is denoted as X ∈ RN×D , where xv ∈ RD represents the attribute vector of node v. The structure is represented by an adjacency matrix A ∈ {0, 1}N×N , where Avu = 1 if evu ∈ E, and Avu = 0 otherwise.

Definition 2. Adversarial Training [Ganin et al., 2016]. Adversarial training aims to enhance model robustness by formulating the learning process as a min-max optimization problem. For a model fθ, the objective is defined as:

where G represents the input graph and G ′ ∈ Φ(G) denotes a perturbed graph within a feasible constraint set Φ (e.g., structural perturbations or feature noise). The inner maximization identifies the worst-case perturbation example, while the outer minimization optimizes θ to maintain performance.

Problem. Robust Representation Learning. Given an attributed graph G, the goal is to learn a graph encoder fθ(X,A) that maps nodes into the embedding space. The learned representations H = fθ(X, A) should remain effective for downstream tasks, even when the graph is subjected to perturbations. In particular, we define this robustness as the ability to resist interference from noise and missing data, which is evaluated against structure, feature, and dual attacks under both targeted and non-targeted scenarios.

3.2 Theoretical Analysis

Recent studies suggest that generative methods, such as GraphMAE, can be interpreted as performing implicit context-level graph contrastive learning [Wang et al., 2024]. Building upon this perspective, we theoretically demonstrate that our augmentation strategy is equivalent to strengthening the implicit GCL by expanding the set of positive samples.

Let the input graph be defined as G = (V, E,X). Its augmented counterpart, G ′ = (V, ˜ E,X), is generated via dualconsistency graph augmentation, where ˜ E = E ∪ E +. Assumption 1. Edge reconstruction capability. For the augmented graph G ′ and any edge decoder g, we assume there exists a pseudo-inverse encoder fg such that the resulting pseudo-autoencoder hg = g ◦ fg satisfies Eqn. (2).

where hg(xi, xj) denotes the predicted edge probability, ˜ Aij ∈ {0, 1} is the ground-truth entry in the augmented graph, and Dist(·) is a distance metric (e.g., mean squared error or cosine similarity). The parameter ε+ serves as the upper bound of the expected reconstruction error.

The edge reconstruction loss on the augmented graph is formulated as shown in Eqn. (3).

where sij = h(xi)⊤h(xj) represents the similarity score for a given node pair, and σ(·) denotes the sigmoid function.

To establish a connection with contrastive learning, we define a pretext alignment loss based on the theoretical framework in AUGMAE [Wang et al., 2024]. The pretext loss is related to the context-level alignment loss in GCL as follows:

where LGCL Align (h) is the alignment objective enforcing representation consistency between positive nodes.

Lemma 1. Properties of the augmented graph. To ensure the quality of the augmented graph, we posit that the enriched edge set based on feature similarity and degree constraints must satisfy the following properties: (i) the number of edges increases, i.e., |˜ E| > |E|; (ii) each augmented edge (vi, vj) ∈ E + exhibits high similarity, i.e., Sim(xi, xj) ≥ τ for a threshold τ, where a relatively high τ is adopted to ensure the selection of high-confidence semantic neighbors; and (iii) the expected similarity score between connected representations satisfies Eqn. (6):

where δ ≥ 0 is a small constant indicating that the reconstruction expectations of newly augmented edges are consistent with those of the original structural edges.

Theorem 1. Incorporating graph augmentation module in MAE is equivalent to introducing the high-quality positive samples in GCL. Under Assumption 1, minimizing the BCE loss for edge reconstruction on the augmented graph G ′ provides a lower bound for the pretext alignment loss:

where γ = 1 and ε′ is a function of bound ε+. Please refer to Appendix A.2 for the detailed proof of Theorem 1.

3.3 Framework

In this section, we present an adversarial masked graph modeling method for robust graph autoencoders, named ArmorGAE. As illustrated in Figure 2, ArmorGAE comprises two key components: (i) Dual-Consistency Graph Augmentation and (ii) Adversarial Masked Graph Autoencoder.

3.4 Dual-Consistency Graph Augmentation

To enhance the input graph, we propose a dual-consistency graph augmentation method that supplements G with an auxiliary edge set E +, comprising node pairs with high feature and structure similarities.

Feature Similarity Score. To quantify the attitude-level proximity between node pairs that are not directly connected, we compute the cosine similarity using sf (vi, vj) =

x⊤i xj ∥xi∥∥xj∥ , where xi denotes the feature vector of node vi.

We further apply min-max normalization to project these scores into the range [0, 1] according to Eqn. (8).

where Sf = {sf(vi, vj) | (vi, vj) /∈ E} represents the ensemble of raw similarity scores for all candidate pairs, and ϵ is a small constant for numerical stability.

Degree Constraint Score. We define a structural affinity score to capture local connectivity patterns. For each node vi, we compute its normalized degree to represent its relative importance within the topology ˜ di = deg(vi) max(d)+ϵ , where d is the vector containing degrees of all nodes in V.

To quantify the structural proximity between two nonadjacent nodes, we calculate the product of their normalized degrees, formulated as Eqn. (9).

Subsequently, we apply min-max normalization to obtain the final structural score ˜ sd(vi, vj ).

Finally, we integrate the normalized feature and structural consistency metrics into a unified augmentation score:

We then rank all non-adjacent node pairs in descending order of saug. The number of added edges is determined by an augmentation ratio p, such that |E +| = ⌊p · |E|⌋. Finally, the augmented graph is constructed as Gaug = (V, E ∪ E +, X).

3.5 Adversarial Masked Graph Autoencoder

To enhance the robustness of node representations, we design an adversarial masked graph autoencoder that engages a generator and a discriminator in a min-max game.

Generator: Masked Graph Autoencoder. The generator Gen is designed as a masked graph autoencoder aimed at reconstructing the structure of Gaug. Specifically, given Gaug = (V, ˜ E,X), we randomly mask a part of edges from ˜ E with a masking ratio me. This process partitions the edge set into a remaining set ˜ Eremain and a masked set ˜ Emask.

Subsequently, the encoder fenc maps the node features and the observed structure into latent representations.

To recover the masked structure, the edge decoder calculates the existence probability ˆ puv for any node pair as shown in Eqn. (12).

where ⊙ denotes the Hadamard product.

The generator is optimized by minimizing the loss Lerecon .

where ˜ Eneg is a set of randomly sampled negative edges.

Discriminator: Edge-Level Discriminator. We introduce an edge-level discriminator Disc to distinguish between real edges and those reconstructed by the generator. Disc is a weight-aware GCN that operates on a synthetic graph structure ˜ E = ˜ Eremain ∪ ˜ Emask.

The discriminator learns node embeddings via H = GCN(X, ˜ E,wdisc), where wdisc is a composite confidence vector. For an observed edge e ∈ ˜ Eremain, its weight is fixed to 1; for a reconstructed edge e ∈ ˜ Emask, its weight is assigned as its predicted probability ˆ puv. It enables the discriminator to perceive generative quality with a fine-grained sensitivity. Finally, Disc computes the realism logit suv for each edge.

where ∥ is the concatenation operation, b is a learnable bias.

Generator Training. The generator Gen is optimized to produce high-fidelity reconstructions that 'fool' the discriminator while maintaining structural integrity.

where Ladv G = -Ee∈˜ Emask [log(σ(se))] represents the adversarial loss that compels the reconstructed edges to be indistinguishable from the original ones in Disc.

Discriminator Training. We assign binary labels ye = 1 for observed edges e ∈ ˜ Eremain and ye = 0 for reconstructed edges e ∈ ˜ Emask. The discriminator Disc is optimized to minimize a confidence-weighted binary cross-entropy loss:

where αe is the confidence weight associated with edge e.

4 Experiments

In this section, we conduct extensive experiments to evaluate the robustness of ArmorGAE. We aim to answer the following Research Questions (RQs):

• RQ1: How robust is ArmorGAE against structural attacks in poisoning and evasive scenarios?
• RQ2: Can ArmorGAE maintain stability under feature and dual attacks?
• RQ3: What are the contributions of different components to the performance of ArmorGAE?
• RQ4: What is the computational efficiency of ArmorGAE in terms of training time?
• RQ5: How do key hyperparameters influence the performance of ArmorGAE?

4.1 Datasets and Baselines

We evaluate the robustness of ArmorGAE on five real-world datasets, including citation networks (Cora, Citeseer, and Pubmed) [Sen et al., 2008], and Amazon co-purchase networks (Photo and Computers) [Shchur et al., 2018]. The statistical results of the datasets are shown in Table 1.

To demonstrate the superiority of ArmorGAE, we compare it with five competitive baselines: GraphMAE [Hou et al., 2022] focuses on node feature masking and reconstruction to capture node representations, while MaskGAE [Li et al., 2023] centers on edge masking and reconstruction to learn topological patterns. Bandana [Zhao et al., 2024] advances these approaches by considering the continuity and context of masked information to enhance representation coherence. For robustness, AUGMAE [Wang et al., 2024] introduces an adversarial masking strategy to generate hard-to-align pairs with a uniformity regularizer, and DGMAE [Zheng et al., 2025] employs an adaptive discrepancy selection module to preserve discriminative node information.

4.2 Implementation Details

We implement ArmorGAE using PyTorch, with training accelerated on an NVIDIA RTX 4060 GPU (12GB). All models are evaluated using classification accuracy (Acc.) under both clean and adversarial scenarios, including structural, feature, and dual attacks. For structural robustness, we employ Metattack with perturbation rates ranging from 5% to 25% and Nettack with perturbations per node varying in {1, 2, 3}. Regarding feature robustness, we introduce Gaussian noise δ ∼ N(0, I) to node features [Shen et al., 2025]. To ensure statistical significance, we report the average performance over ten independent trials with different random seeds.

4.3 Experimental Results and Analysis under Structural Attacks (RQ1)

Robustness against Metattack. Table 2 presents the node classification performance under Metattack in poisoning and evasive settings. We obtain the following findings: (i) ArmorGAE achieves the highest performance on all datasets in both clean and attacked scenarios. This superiority demonstrates that the dual-consistency graph augmentation module and adversarial learning mechanism effectively defend against structural noise and learn more robust latent representations. (ii) ArmorGAE exhibits superior robustness against increasing perturbation rates, incurring the minimal performance drop among all evaluated models. ArmorGAE achieves an accuracy of 52.28% on Cora dataset under the poisoning rate of 25%, outperforming state-of-the-art baselines such as GraphMAE and AUGMAE. Moreover, ArmorGAE demonstrates near-immunity to structural perturbations on the Computers dataset, with a marginal 1.1% performance decline as the attack rate escalates from 5% to 25%. (iii) In contrast to representative generative baselines like GraphMAE and MaskGAE, which suffer from performance degradation under high-intensity attacks (20%-25% perturbation), ArmorGAE demonstrates superior robustness. Even when compared to competitive baselines like AUGMAE and DGMAE, ArmorGAE delivers superior consistency across graphs with varying homophily and sparsity. This robustness is attributed to ArmorGAE's capability to effectively mitigate the distributional shift caused by perturbations, aligning the learned representations with the underlying clean data distribution.

Robustness against Nettack. We further evaluate the robustness of ArmorGAE against targeted attacks (Nettack) in Table 3, from which we draw the following observations: (i) ArmorGAE achieves the best average ranking on Cora and Citeseer datasets, significantly surpassing traditional generative self-supervised methods. It validates the efficacy of our adversarial masking mechanism in neutralizing malicious edge perturbations. (ii) In poisoning attacks, most baselines suffer from sharp performance drops as intensity increases, as the corrupted training topology misguides the representation learning process. In evasive attacks, ArmorGAE achieves 83.98% on Cora dataset at intensity 1, outperforming AUGMAE by approximately 2.5%. (iii) On the Pubmed dataset, ArmorGAE achieves superior performance in both clean settings and low-to-medium intensity attacks (ratios 1 and 2). While AUGMAE and DGMAE exhibit slightly better resilience at the highest perturbation ratio, ArmorGAE remains highly competitive, maintaining a comparable performance with only a marginal gap to the optimal results.

4.4 Experimental Results and Analysis under Feature and Dual Attacks (RQ2)

Robustness against Feature Attacks. As illustrated in Figure 3, all models suffer performance degradation under feature attack, yet ArmorGAE incurs the minimal performance degradation. Taking the Cora dataset as an example, while the accuracy of GraphMAE plummets from 81.21% to 74.26%, ArmorGAE maintains a superior accuracy of 82.23%, markedly outperforming the runner-up (MaskGAE at 81.55%). This robustness is attributed to the adversarial game, which recovers the underlying true data distribution and distinguishes between reconstructed and real edges.

Robustness against Dual Attacks. In most dual-attack scenarios, the defensive advantages of ArmorGAE become even more pronounced. On Citeseer dataset, while the accuracies of representative baselines such as Bandana and GraphMAE drop below the 60% threshold, ArmorGAE sustains a robust performance of 68.41%, maintaining a significant margin over MaskGAE (66.30%). As depicted in the performance trends, the degradation curve of ArmorGAE remains significantly flatter compared to the competing baselines as attack intensity escalates. By formulating an adversarial game to establish a defensive barrier within the latent feature space, ArmorGAE effectively mitigates the impact of highly uncertain joint perturbations on feature and structure.

4.5 Ablation Studies (RQ3)

To investigate the contribution of each component in ArmorGAE, we conduct ablation studies on four datasets in both clean and attacked scenarios (ptb=0.15), as illustrated in Figure 4. We compare ArmorGAE with four variants: (1) '- r/p-rand': replaces our augmentation methods with random edge selection; (2) '-w/o-aug': removes the dual-consistency augmentation; (3) '-w/o-adv': removes the adversarial learning mechanism; (4) '-w/o-er': eliminates the edge maskingreconstruction module. We obtain the following insights: (i) '-w/o-er' suffers the most performance degradation in all scenarios. It confirms that structural reconstruction is the cornerstone of our model to recover the intrinsic graph topology. (ii) ArmorGAE outperforms the variant '-w/o-adv'. This gap is particularly evident in attack scenarios (e.g., a drop of nearly

3.5% on Computers dataset). It validates that the adversarial mechanism effectively strengthens the model's defensive barrier. (iii) The performance decline observed in the variant '-w/o-aug' underscores the importance of our designed augmentation strategy. (iv) The variant '-r/p-rand' consistently underperforms ArmorGAE, especially in perturbed environments. It demonstrates that our augmentation strategy enriches the graph with semantically relevant edges, whereas random perturbations tend to introduce noise.

4.6 Training Efficiency (RQ4)

Figure 5 presents the performance-efficiency trade-off of five methods on Cora and Photo datasets. To ensure a fair comparison, we report the total training time under a fixed budget of 500 epochs for all models. ArmorGAE achieves state-of-theart accuracy of 85.53% with a training time of 25.15s on Cora dataset. It outperforms the best baseline (Bandana, 85.37%) in terms of both accuracy and efficiency. Similarly, ArmorGAE reaches the highest accuracy of 93.53% with a training duration of 43.14s on Photo dataset. It is significantly more efficient than the competitive baseline Bandana. These results validate that the integration of the adversarial masked autoencoder and augmentation modules does not introduce excessive computational overhead.

4.7 Parameter Sensitivity Analysis (RQ5)

We conduct a sensitivity analysis to evaluate the stability of ArmorGAE. The results are summarized in Figure 6.

Edge Addition Ratio (p): As shown in Figure 6(a), the performance remains relatively stable on different edge addition ratios. The optimal accuracy is achieved when the ratio is in the range of 0.3-0.5. It indicates that moderate structural augmentation provides sufficient signals, while excessively high ratios may introduce detrimental structural noise.

Adversarial Weight (λadv): As illustrated in Figure 6(b), ArmorGAE exhibits consistently robust performance on a range of adversarial weights (λadv ∈ [0.01, 10]). However, a significant performance drop occurs on the Pubmed dataset when λadv increases to 100. It suggests that an excessive adversarial penalty may dominate the total loss, which hinders the model from learning effective node features.

Edge Masking Ratio (me): In Figure 6(c), the accuracy peaks at a masking ratio of 0.7 on most datasets. Higher masking rates compel the model to recover more complex structural information. It enhances the robustness of the learned representations in both clean and attacked scenarios. Embedding Dimension (hd): Figure 6(d) shows that ArmorGAE is relatively insensitive to the hidden dimension size. While a dimension of 256 offers the best balance, further increasing it to 512 leads to marginal performance drops, likely due to slight overfitting on smaller datasets like Cora.

5 Conclusion

In this paper, we propose ArmorGAE, a robust graph masked autoencoder tailored to mitigate the vulnerability of existing GMAEs against adversarial attacks. ArmorGAE synergizes a dual-consistency graph augmentation with an adversarial masked modeling paradigm to counteract structural perturbations while enriching topological semantics. Theoretically, we provide an analysis revealing that our augmentation strategy is equivalent to expanding high-quality positive samples in contrastive learning. Extensive experiments demonstrate that ArmorGAE achieves state-of-the-art performance in clean scenarios and exhibits superior robustness against diverse adversarial attacks.

Acknowledgments

This research is supported by the National Natural Science Foundation of China (Grant No. 62472263, 62502288, 62506216), the Natural Science Foundation of Shandong Province (Grant No. ZR2024MF034), the Ministry of Education in China Foundation for Humanities and Social Sciences (Grant No. 24YJAZH058, 24YJCZH461, 24YJCZH149).