Graph Foundation Models Vulnerable to Representation Attacks.

Graph foundation models, which generalize across various graph domains by mapping all inputs into a single shared representation, possess a unique vulnerability. This study identifies the "alignment layer"—the component responsible for creating this shared representation—as a distinct attack surface previously unexplored. Unlike traditional graph neural networks, foundation models can be attacked specifically at this layer during inference, without needing access to their training data. The researchers demonstrated that directed perturbations within this representation space could cause multiple models to collapse. While the budget for these attacks was comparable to what a standard graph network might require, one model, OpenGraph, showed particular fragility in its spectral tokenizer, collapsing at a significantly lower budget. This specific vulnerability was traced directly to the tokenizer rather than the decoder, indicating an alignment-specific weakness. Furthermore, the study explored "realizable" input-space attacks, involving edits to edges, features, or text. These attacks successfully removed at least half of correct predictions on several models. The degree of fragility realized by an attacker with input access was found to correlate with how directly the decoder reads the representation, rather than the model's clean accuracy. This suggests that structural properties, like the decoder's local Lipschitz sensitivity, are better indicators of vulnerability than simple performance metrics.