Attacking Graph Foundation Models Through Their Shared Representation

2026-07-20

AI Summary

Graph foundation models rely on alignment layers to achieve cross-domain generalization, yet their security remains unexplored. This work is the first to expose the vulnerability of alignment layers as an independent attack surface, demonstrating that model predictions can be disrupted during inference through targeted perturbations in the representation space and feasible input manipulations—such as modifications to edges, node features, or textual attributes. We introduce a carrier gain metric grounded in the decoder’s local Lipschitz sensitivity and reveal that OpenGraph is particularly susceptible due to its spectral tokenizer design. Experiments show that representation-space attacks are broadly effective across six prominent models, with three suffering over 50% accuracy degradation under realistic attack conditions; notably, OpenGraph exhibits significant failure with only one-fifth of the typical attack budget.

Abstract

A graph foundation model generalizes across graph domains by mapping every input into one shared representation before any task reasoning. We call this map the alignment layer, the component that separates a graph foundation model from a graph neural network, and we show it is a distinct attack surface that prior work has not studied. We attack it at inference time, with no access to training, on six public models spanning spectral tokenizers, text embedding spaces, and a discrete codebook. A directed representation-space perturbation collapses every model, but at a budget comparable to the representation norm a plain graph network also needs, with one exception: OpenGraph, whose spectral tokenizer collapses at a fifth of that budget, an alignment-specific fragility a plain network does not share and which a same-representation control traces to the tokenizer rather than the decoder. A realizable input-space attack that edits edges, features, or text removes at least half the correct predictions on three of the six models at peak. How much of this fragility an input-access attacker realizes tracks how directly the decoder reads the representation, and not the clean accuracy a task leaves; we measure this carrier gain structurally from the decoder's local Lipschitz sensitivity, and report clean-accuracy headroom as a within-model ordering heuristic that does not survive on realizable attacks.

Problem

• Graph Foundation Models
• Shared Representation
• Alignment Layer
• Adversarial Attack
• Representation Fragility

Innovation

• graph foundation models
• alignment layer
• representation-space attack
• input-space perturbation
• Lipschitz sensitivity