Attacking Graph Foundation Models Through Their Shared Representation

# Attacking Graph Foundation Models Through Their Shared Representation
Source: [https://arxiv.org/html/2607.18567](https://arxiv.org/html/2607.18567)
###### Abstract

A graph foundation model generalizes across graph domains by mapping every input into one shared representation before any task reasoning\. We call this map the alignment layer, the component that separates a graph foundation model from a graph neural network, and we show it is a distinct attack surface that prior work has not studied\. We attack it at inference time, with no access to training, on six public models spanning spectral tokenizers, text embedding spaces, and a discrete codebook\. A directed representation\-space perturbation collapses every model, but at a budget comparable to the representation norm a plain graph network also needs, with one exception: OpenGraph, whose spectral tokenizer collapses at a fifth of that budget, an alignment\-specific fragility a plain network does not share and which a same\-representation control traces to the tokenizer rather than the decoder\. A realizable input\-space attack that edits edges, features, or text removes at least half the correct predictions on three of the six models at peak\. How much of this fragility an input\-access attacker realizes tracks how directly the decoder reads the representation, and not the clean accuracy a task leaves; we measure this carrier gain structurally from the decoder’s local Lipschitz sensitivity, and report clean\-accuracy headroom as a within\-model ordering heuristic that does not survive on realizable attacks\. Where the carrier is discrete we localize the effect causally by pinning the codebook assignment to its clean value\. We then study defenses\. Robustifying the representation fails against an adaptive attacker\. Attacked inputs are, however, detectable: a density test on the low\-dimensional continuous carriers separates them near perfectly, at a five percent false\-positive rate on clean hold\-out data, and holds under an adaptive attacker, so the alignment layer can be monitored even where our defenses do not harden it\.

## 1Introduction

Graph foundation models aim to serve many graph tasks and many graph domains with one pretrained model\(Liuet al\.[2025](https://arxiv.org/html/2607.18567#bib.bib1); Maoet al\.[2024](https://arxiv.org/html/2607.18567#bib.bib3)\)\. Such a model must reconcile inputs that share no nodes, no edges, and no feature space\. It does so with a component that a graph neural network does not have: an alignment layer that maps every input into one shared representation before task reasoning begins\. In structure models this layer is a spectral tokenizer built from the singular value decomposition \(SVD\) of the adjacency\(Xiaet al\.[2024](https://arxiv.org/html/2607.18567#bib.bib73); Xia and Huang[2026](https://arxiv.org/html/2607.18567#bib.bib74); Zhaoet al\.[2025](https://arxiv.org/html/2607.18567#bib.bib25)\)\. In text\-attributed models it is a frozen text embedding space or a discrete vocabulary\(Liuet al\.[2024](https://arxiv.org/html/2607.18567#bib.bib5); Wanget al\.[2024](https://arxiv.org/html/2607.18567#bib.bib8); Liet al\.[2024](https://arxiv.org/html/2607.18567#bib.bib26)\)\. Figure[1](https://arxiv.org/html/2607.18567#S1.F1)shows the common structure: every domain is mapped into one shared representation, the attack perturbs that representation, and the shared space carries the perturbation across domains and across models\.

![Refer to caption](https://arxiv.org/html/2607.18567v1/x1.png)Figure 1:Attack setup\. A graph foundation model maps inputs from any domain into one shared representation through the alignment mapΦ\\Phi, read by a decodergg\. We attackΦ\\Phiat inference time, editing a realizable input \(edges, features, or node and class text\) within a budget, with no training access, under white\-, gray\-, or black\-box knowledge\. Because every domain and model family shares this space, one perturbation transfers across domains and, through a surrogate, across models\. The carrier, the formΦ\\Phitakes, is a spectral token, text embedding, codebook, or channel logits\.Adversarial attacks on graph neural networks perturb the adjacency or features of a single graph for a single task\(Zügneret al\.[2018](https://arxiv.org/html/2607.18567#bib.bib27); Zügner and Günnemann[2019](https://arxiv.org/html/2607.18567#bib.bib28); Xuet al\.[2019](https://arxiv.org/html/2607.18567#bib.bib29); Sunet al\.[2020](https://arxiv.org/html/2607.18567#bib.bib31)\)\. None can perturb a transferable encoder, an alignment map, or a discrete vocabulary, because those exist only in a graph foundation model, to buy cross\-domain generality\. No published attack targets the six we study\.

One shared space means one shared weakness: because every domain routes throughΦ\\Phi, a single displacement of it degrades them all, so the generality that makes these models foundational is itself the vulnerability\. We carry the study from that vulnerability to a defense\. Our contributions are as follows\.

- •We formalize the alignment mapΦ\\Phishared across model families and attack it at inference time, with no training access, on six public models \(Section 3\)\.
- •We separate the layer from the input lever with a plain\-network control\. Most alignment layers collapse under a directed representation\-space perturbation at the same relative budget as an ordinary graph network, but OpenGraph’s spectral tokenizer collapses at a fifth of that budget, a fragility specific to the alignment layer, which a same\-representation control traces to the tokenizer rather than the decoder \(Section 4\)\.
- •We derive a spectral rotation attack for the singular\-value tokenizer from eigenvector perturbation theory, the first realizable attack to move OpenGraph off the noise floor where projected gradient ascent fails, and show its residual resistance is spectral basis degeneracy, not robustness \(Section 4\)\.
- •We evaluate the realizable input attack across nine datasets and four domains with multiple seeds, and find that how much of the fragility an attacker realizes tracks how directly the decoder reads the representation\. We measure this carrier gain structurally, from the decoder’s local Lipschitz sensitivity at clean representations with no attack curve, and it rank\-orders the collapse threshold as a heuristic, while clean accuracy headroom does not survive as a predictor on the realizable attacks \(Sections 3 and 4\)\. The discrete codebook admits a do\-operator that localizes the effect causally\.
- •We show that robustifying the alignment layer fails against an adaptive attacker, but that attacked inputs are detectable on the low\-dimensional continuous carrier where robustification fails \(Section 5\)\.

## 2Related Work

#### Attacks on graph neural networks\.

Structure attacks flip edges to change predictions\. Nettack crafts targeted edits\(Zügneret al\.[2018](https://arxiv.org/html/2607.18567#bib.bib27)\), Metattack poisons the graph with meta gradients\(Zügner and Günnemann[2019](https://arxiv.org/html/2607.18567#bib.bib28)\), and topology attacks solve a min\-max relaxation over edge flips\(Xuet al\.[2019](https://arxiv.org/html/2607.18567#bib.bib29)\)\. Reinforcement learning gives a black\-box variant\(Daiet al\.[2018](https://arxiv.org/html/2607.18567#bib.bib30)\), and node injection adds nodes instead of editing edges\(Sunet al\.[2020](https://arxiv.org/html/2607.18567#bib.bib31)\)\. Surveys cover the area\(Jinet al\.[2020](https://arxiv.org/html/2607.18567#bib.bib37)\)\. All of this work assumes one graph, one task, and one substrate\.

#### Graph foundation models and their robustness\.

Work on the robustness of graph foundation models is recent and does not reach the alignment layer at inference\. Benchmarks perturb the prompt, text, and structure channels of graph language models on other models\(Zhanget al\.[2025](https://arxiv.org/html/2607.18567#bib.bib13)\), and backdoor attacks require a poisoning or fine\-tuning stage\(Luoet al\.[2026](https://arxiv.org/html/2607.18567#bib.bib70)\)\. No prior attack shows a perturbation that transfers across domains through a shared interface\.

#### Representation alignment and certified robustness\.

Independent models are argued to converge toward a shared representation\(Huhet al\.[2024](https://arxiv.org/html/2607.18567#bib.bib87)\), but a representation can be decodable without being used causally\(Usama and Chang[2026](https://arxiv.org/html/2607.18567#bib.bib88)\), which is why our test intervenes rather than probes\. A representation\-space perturbation transfers across models only when representations are geometrically aligned\(Guptaet al\.[2025](https://arxiv.org/html/2607.18567#bib.bib106)\), the condition a cross\-domain alignment map creates, so this attack surface is also a transfer surface\. We identify subspaces with linear alignment measures\(Kornblithet al\.[2019](https://arxiv.org/html/2607.18567#bib.bib91)\)and remove them with erasure and activation editing\(Belroseet al\.[2023](https://arxiv.org/html/2607.18567#bib.bib89); Menget al\.[2022](https://arxiv.org/html/2607.18567#bib.bib92)\)\. Perturbing an internal representation is an established paradigm: feature adversaries match a target representation\(Sabouret al\.[2016](https://arxiv.org/html/2607.18567#bib.bib101)\), the idea reaches vision\-language and self\-supervised encoders\(Zhaoet al\.[2023](https://arxiv.org/html/2607.18567#bib.bib100); Jiaet al\.[2022](https://arxiv.org/html/2607.18567#bib.bib102)\), and matching a target in a shared embedding space transfers across encoders\(Zhanget al\.[2024](https://arxiv.org/html/2607.18567#bib.bib105)\)\. There the contribution is the target, not the optimizer, and an unrealizable representation\-space perturbation is the accepted way to show a vulnerability before asking whether an input can reach it\. We move the target to the representation a graph foundation model adds over a graph network: the cross\-domain alignment map, not one model’s private features\. Our defense adapts randomized smoothing\(Cohenet al\.[2019](https://arxiv.org/html/2607.18567#bib.bib99)\)with adaptive evaluation following standard practice\(Carlini and Wagner[2017](https://arxiv.org/html/2607.18567#bib.bib95); Athalyeet al\.[2018](https://arxiv.org/html/2607.18567#bib.bib94); Tramèret al\.[2020](https://arxiv.org/html/2607.18567#bib.bib93)\)\.

## 3The Alignment Map and the Attack

Let a graph foundation model read an inputx=\(A,X,text\)x=\(A,X,\\text\{text\}\)from any domain, whereA∈\{0,1\}n×nA\\in\\\{0,1\\\}^\{n\\times n\}is the adjacency,X∈ℝn×dX\\in\\mathbb\{R\}^\{n\\times d\}the node features, andtextthe node and class descriptions\. Define the alignment mapΦ:\(A,X,text\)→S\\Phi:\(A,X,\\text\{text\}\)\\to Sas the representation every input passes through before task reasoning, so the model isg∘Φg\\circ\\Phi, and letSSdenote this shared representation space \(the image ofΦ\\Phi\)\. Its image is shared across domains by construction\. An alignment layer is not any encoder\. It has four properties\. It is domain\-agnostic: the same map serves every input domain, not one encoder per domain\. It is a bottleneck: every input passes through it before task reasoning\. It is a low\-dimensional or discrete object: a top\-kksingular subspace, a codebook, or a fixed embedding space\. It is read by a task decodergg\. An intermediate layer of a single\-domain graph neural network is not an alignment layer, because it is not shared across domains and supports no cross\-domain transfer\. BecauseΦ\\Phiis one cross\-domain bottleneck, a single perturbation ofSSmoves every domain that routes through it, so it can express cross\-domain transfer\. An attack on an ordinary hidden layer is bound to one input distribution and cannot express such a transfer\. For a spectral model, withDDthe diagonal degree matrix,A¯=D−1/2​A​D−1/2\\bar\{A\}=D^\{\-1/2\}AD^\{\-1/2\}the symmetrically normalized adjacency, andU​Σ​V⊤U\\Sigma V^\{\\top\}its singular value decomposition \(U,VU,Vthe singular vectors,Σ\\Sigmathe diagonal of singular valuesσ1≥σ2≥⋯\\sigma\_\{1\}\\geq\\sigma\_\{2\}\\geq\\cdots\), the tokens are

E=\(∑l=1LA¯l\)​LN​\(U​Σ\+V​Σ\),E=\\Big\(\\textstyle\\sum\_\{l=1\}^\{L\}\\bar\{A\}^\{l\}\\Big\)\\,\\mathrm\{LN\}\\big\(U\\sqrt\{\\Sigma\}\+V\\sqrt\{\\Sigma\}\\big\),\(1\)whereLN​\(⋅\)\\mathrm\{LN\}\(\\cdot\)is row\-wise layer normalization, andSSis the leading singular subspace ofA¯\\bar\{A\}\. For a text modelSSis a frozen text embedding space, and predictions read the similarity between a node embedding and a class embedding\. For GFTSSis a discrete codebookCC, and a computation\-tree embeddingzzis assigned the nearest token,j=arg⁡minc⁡∥z−c∥j=\\arg\\min\_\{c\}\\lVert z\-c\\rVert\. We make two claims aboutΦ\\Phiand one hypothesis, and Section 4 tests each\.

Claim 1 \(shared surface\)\.Φ\\Phiis a bottleneck that every domain passes through\. Attacking it is therefore a different operation from attacking message passing, which is tied to one adjacency and one task, with no analogue in the GNN setting\.

Claim 2 \(cross\-domain carrier\)\.BecauseΦ\\Phimaps every domain into one geometry, a displacement insideSScan transfer to a target domain that sharesΦ\\Phi, which a structure attack on a single, non\-shared adjacency cannot express\.

Hypothesis \(concentration\)\.Φ\\Phicompresses the model into a low dimensional object: a top\-kksingular subspace, a codebook, or a routed expert, so a small displacement ofSSchanges the output through a basis rotation, a token flip, or an expert re\-route\. Whether this concentration is what makes a layer fragile is what we test, and Section 4 finds that the collapse threshold orders against it, so we report it as a hypothesis the evidence does not support\.

#### Why the alignment map is the surface\.

Write the model asg∘Φg\\circ\\Phi, whereΦ\\Phiproduces a rank\-kkrepresentation inSSandggis anLL\-Lipschitz decoder\. Two facts makeΦ\\Phifragile\. First, a bounded input budgetBBrotates the leading singular subspace ofA¯\\bar\{A\}by an amount set by the inverse singular gap1/\(σi−σj\)1/\(\\sigma\_\{i\}\-\\sigma\_\{j\}\)\(Davis\-Kahan\), so a near\-degenerate spectrum turns a small budget into a large displacement insideSS\. Second, only the part of that displacement the decoder reads changes the output, so a trained decoder with a small task\-subspace absorbs the rest\. These give a flip\-budget proposition with two factors, a margin and a carrier gain\.

Proposition \(flip budget\)\.*Let nodeiihave clean marginmi\>0m\_\{i\}\>0\(the signed distance of nodeiito its decision boundary inSS\), and let the attack move its representation with carrier gainκi\>0\\kappa\_\{i\}\>0\(the boundary\-normal displacement per unit budget\)\. To first order the minimal budget to flip nodeiiisbi=mi/κib\_\{i\}=m\_\{i\}/\\kappa\_\{i\}, so reachability isR​\(B\)=Pr⁡\[mi≤κi​B\]R\(B\)=\\Pr\[\\,m\_\{i\}\\leq\\kappa\_\{i\}B\\,\]\.*We show in Section 4 that on realizable attacks the carrier gainκ\\kappadominates, and the margin term, which clean accuracy summarizes, does not order reachability on its own\. Proofs are in the supplement\.

Algorithm 1ALIGN attack \(task\-loss form\)Input: inputxx, modelg∘Φg\\circ\\Phi, labelsyy, budgetBB, stepsTT Output: perturbed inputx′x^\{\\prime\}

1:initialize

δ←0\\delta\\leftarrow 0
2:for

t=1t=1to

TTdo

3:

s←Φ​\(x\+δ\)s\\leftarrow\\Phi\(x\+\\delta\)\(fixed\-basis surrogate if the SVD is unstable\)

4:

ℓ←loss​\(g​\(s\),y\)\\ell\\leftarrow\\mathrm\{loss\}\(g\(s\),y\)
5:

δ←δ\+η​∇δℓ\\delta\\leftarrow\\delta\+\\eta\\,\\nabla\_\{\\delta\}\\ell
6:project

δ\\deltaonto the budget

BB
7:endfor

8:return

x′=x\+δx^\{\\prime\}=x\+\\deltaprojected to the discrete input space

#### Threat model\.

The attacker acts at inference time only, with no access to training, poisoning, or fine\-tuning, and no ability to modify model weights \(Figure[1](https://arxiv.org/html/2607.18567#S1.F1)\)\. Three axes vary\.*Goal:*untargeted evasion, with a targeted codebook variant in the ablations\.*Capability:*what is perturbed per carrier \(edges and SVD features, input features, node or class text, or the pre\-quantization embedding\), each within a stated budget\. An attack is*realizable*when its perturbation is an input the model actually accepts; a representation\-space perturbation the attacker cannot emit, such as the codebook embedding, is reported only as an upper bound\.*Knowledge:*white box, gray box \(surrogate, no victim gradients\), or black box \(scores or transfer only\)\. We report each capability separately and do not combine them\. The realizable input attacks impose no unnoticeability constraint beyond the stated budget, so their numbers upper\-bound attacker power\. Budget definitions per carrier and two fidelity caveats \(OFA’s decoder, ZeroG’s pipeline\) are in the supplement\.

#### The ALIGN attack\.

The objective is a small perturbationδ\\delta, within a budget, such thatg​\(Φ​\(x\+δ\)\)g\(\\Phi\(x\+\\delta\)\)is incorrect or takes a target label\. We instantiate it per carrier\. For a spectral tokenizer we perturb edges, and features where they enter the SVD, to rotate the leading singular subspace\. That objective has zero gradient at the clean graph, so we maximize the task loss and treat the rotation as a consequence, with a fixed\-basis surrogate where differentiating the SVD is unstable\. For a text space we perturb node text or the shared class\-description text, since one class embedding is scored against every node\. For the codebook we push a computation\-tree embedding across the boundary to a target token with a straight\-through estimator\. The general optimizer is task\-loss projected gradient ascent ong∘Φg\\circ\\Phi, and what the alignment view contributes is which component to perturb and a perturbation that transfers across domains\. In a budget\-matched comparison a generic end\-to\-end perturbation is stronger on its source domain, but one confined to the shared subspace transfers several times better across a real domain gap \(supplement\)\.

#### Align\-then\-ablate\.

To test whether the attack is carried by the alignment layer we intervene rather than probe\. We identify the alignment subspacePPby fitting an orthogonal Procrustes map between paired cross\-domain representations and taking the rank at which their similarity peaks \(supplement\), remove it by projection, and report the mediated fraction1−\(Acleanabl−Aatkabl\)/\(Aclean−Aatk\)1\-\(A^\{\\text\{abl\}\}\_\{\\text\{clean\}\}\-A^\{\\text\{abl\}\}\_\{\\text\{atk\}\}\)/\(A\_\{\\text\{clean\}\}\-A\_\{\\text\{atk\}\}\)against a random subspace of the same rank, over a range of ranks\. For the discrete codebook the intervention is a do\-operator that pins the token index to its clean value\.

## 4Experiments

We reproduce each model to its published clean number before attacking, then attack across each model’s zero\-shot suite with multiple seeds\. Table[1](https://arxiv.org/html/2607.18567#S4.T1)and Figure[2](https://arxiv.org/html/2607.18567#S4.F2)\(a\) summarize the result\. The full seeded matrix is in the supplement\.

![Refer to caption](https://arxiv.org/html/2607.18567v1/x2.png)Figure 2:Left: input\-space attack success reaches three of six models above one half, with the representation\-space peak drawn as a lighter upper bound the attacker cannot emit, and reached only at a directed budget of0\.20\.2to1\.61\.6of the representation norm, not commensurable with the input\. An equal budget random perturbation stays near zero except on the densest feature budgets\. Right: the defense follows the carrier\. Standardization and smoothing lower the attack on the continuous carrier, while smoothing atσ=0\.5\\sigma\{=\}0\.5raises it on the codebook to0\.820\.82because the added noise flips tokens\. The defense table reports the codebook atσ=0\.25\\sigma\{=\}0\.25\.Table 1:Main evasion result\. Carrier gainκ\\kappais a post\-hoc descriptor, the initial slope of the attack\-success\-versus\-budget curve in each carrier’s own unit, comparable only within a carrier; GFT has no entry, lacking a realizable input attack\. Columns then give the input\-space attack success \(peak and mean over a model’s datasets\) realizable by the stated threat model, and the representation\-space upper bound from perturbing the alignment representation directly, which the input lever cannot reach\. The saturated bound is high for every model, but a plain network collapses at a similar relative budget \(Section 4\) except on OpenGraph\. The input\-space column reaches three models at peak and two by mean \(bold\)\. Full seeded matrix in the supplement\.#### Setup\.

We evaluate two spectral tokenizer models, OpenGraph and AnyGraph, a closed\-form spectral\-filter model, GraphAny, two text\-space models, OFA and ZeroG, and one codebook model, GFT, each reproduced to its published clean number and wrapped behind one interface so the attack code is shared\. The datasets span citation, web, e\-commerce, heterophily, and social domains, together with AnyGraph’s native link\-prediction graphs on which it is evaluated in its own zero\-shot setting \(full list in the supplement\)\. Attacks run on each model’s real inference pipeline\. Where a white\-box gradient passes through a non\-differentiable step, such as the entropy\-normalized distance in GraphAny or the codebook argmax in GFT, we craft with a torch surrogate and re\-evaluate every number on the real pipeline\. Budgets are a fraction of the edges or anℓ∞\\ell\_\{\\infty\}orℓ0\\ell\_\{0\}bound on features, each cell averaging over seeds, against an equal\-budget random control\. Attack success is the relative accuracy degradation\(Aclean−Aatk\)/Aclean\(A\_\{\\rm clean\}\-A\_\{\\rm atk\}\)/A\_\{\\rm clean\}, or the relative Recall@20 drop for AnyGraph\. We report the untargeted attack unless noted, and call a model reached when its peak attack success exceeds one half\.

#### Three models are reached by a realizable input\-space attack\.

GraphAny’s feature attack, which edits the input features, succeeds across all four of its domains \(the full matrix \(supplement\)\)\. A sparse variant that changes about four feature entries per node already halves accuracy, and the random control stays near zero, so the strength is the direction, not the budget\. The realizable text attack on OFA and ZeroG edits the shared class\-description words under a semantic\-similarity constraint, and one edit moves the score of every node in that class\. It reaches attack success above one half on the citation graphs but zero on the two social graphs, where no improving edit exists \(Table[1](https://arxiv.org/html/2607.18567#S4.T1)\)\. GFT’s codebook attack succeeds and holds up to ogbn\-arxiv, but it is a representation\-space perturbation with no realized input\-space form, so we report it as an upper bound\.

#### OpenGraph’s alignment layer is fragile beyond a plain network, the others are not\.

To separate the lever from the layer we perturb the representation the decoder reads directly, at a directed budget in units of the representation norm\. Plain single\-domain GCN, GraphSAGE, and GAT collapse at a fraction0\.480\.48to0\.700\.70of the norm \(mean0\.610\.61\), and GraphAny \(0\.620\.62\) and AnyGraph \(0\.560\.56\) sit in this band, so their representation\-space collapse is generic\. OpenGraph is the exception: its spectral token collapses at0\.120\.12, five times below that band, and a same\-representation control \(a linear probe and a perceptron on its own clean token collapse at0\.040\.04and0\.090\.09, at or below the transformer’s0\.150\.15\) locates the cause in the tokenizer, not the decoder: the singular value decomposition produces a large\-norm, small\-margin token any classifier inherits \(supplement\)\.

#### A spectral rotation attack reaches OpenGraph through edges\.

Projected gradient ascent sits at the noise floor on the spectral tokenizer, since the singular basis is detached from the gradient\. An edge attack derived from first\-order eigenvector perturbation theory recovers the subspace rotation and moves OpenGraph off the noise floor, to attack success0\.150\.15at a tenth of the edges, five times a random flip; the residual resistance is spectral basis degeneracy, not robustness \(supplement\)\.

#### What governs the input lever\.

Headroom is the clean accuracy a task leaves above chance,h=Aclean−1/Ch=A\_\{\\rm clean\}\-1/CforCCclasses\. Within a single model lower headroom can order reachability, as OpenGraph does across Cora, Citeseer, and PubMed \(Figure[4](https://arxiv.org/html/2607.18567#S4.F4)\(b\)\), but pooled across the twenty\-one realizable cells it does not \(Spearman0\.010\.01,N=21N=21, supplement\)\. A decoder\-side structural predictor does better: the local Lipschitz constantLLof the decoder gives a collapse thresholdm/\(L​‖S‖\)m/\(L\\,\\\|S\\\|\)per node with no attack curve, dimensionless where the fittedκ\\kappaand the input\-side Davis\-Kahan gap are not\. It rank\-orders the measured threshold across models and datasets \(Spearman0\.650\.65,N=11N=11\) and reproduces OpenGraph’s threshold from clean representations alone, though not with OpenGraph held out \(0\.530\.53\), so we read it as a heuristic, not a law \(supplement\)\. We report the fittedκ\\kappaonly within a carrier \(Spearman0\.630\.63to0\.870\.87\)\. Figure[3](https://arxiv.org/html/2607.18567#S4.F3)plots attack success against budget for one carrier of each type\. The attack also reaches auxiliary surfaces \(node injection, router re\-routing\), and combining input channels does not beat the strongest single lever \(supplement\)\.

![Refer to caption](https://arxiv.org/html/2607.18567v1/x3.png)Figure 3:Attack success against budget for a feature carrier \(GraphAny\), a codebook carrier \(GFT\), and a spectral edge carrier \(OpenGraph\) on Cora, with matched equal\-budget random controls dashed\. Budget is normalized to a fraction of its per\-carrier maximum, since the units differ\. The carrier gainκ\\kappais the initial slope of these curves\.![Refer to caption](https://arxiv.org/html/2607.18567v1/x4.png)Figure 4:Left: removing the alignment subspace collapses the attack on GFT, while a random subspace of the same rank does not, so the alignment layer carries the attack\. Right: within OpenGraph the three datasets order by headroom, lower headroom giving higher attack success, but this within\-model pattern does not survive pooling across models, where the relation is not significant\.
#### Cross\-domain transfer is selective\.

A single perturbation along a generic axis of the shared text space, crafted on one citation graph, transfers to some targets and not others \(supplement\)\. The sharper evidence is the budget\-matched comparison in Table[8](https://arxiv.org/html/2607.18567#A4.T8): one universal vector crafted on Cora, applied unchanged to near\-domain Citeseer and far\-domain PubMed, either free in the full embedding or confined to the top sixteen shared directions\. The generic vector is stronger on the source, because about half its budget lies outside the shared subspace and does not travel\. On far\-domain PubMed it reaches attack success0\.060\.06, matching a random control, while only the shared\-subspace vector transfers above chance, to0\.220\.22\(three seeds, standard deviation below0\.0050\.005\)\. The gap is small but stable, and it is the one operation attacking an encoder cannot express: a universal adversarial perturbation\(Moosavi\-Dezfooliet al\.[2017](https://arxiv.org/html/2607.18567#bib.bib111)\)carried through the alignment layer, where confining it to the shared low\-dimensional subspace is what lets one vector fool a second domain\. Citeseer does not distinguish the two conditions, its clean accuracy \(0\.270\.27\) being at chance\.

A gray\-box variant, where an edge set crafted on one spectral model is applied to another with no gradient access to it, also transfers above a random control at larger budgets though the absolute effect stays small on the resistant spectral pair \(supplement\)\. A black\-box variant that reads only output scores, with no gradients, recovers most of the white\-box effect on the text carrier at a few hundred queries per node \(supplement\), so the threat model is evidenced at all three levels of access\.

Three factors govern transfer: \(i\) Perturbation must lie along a generic content axis; an attack\-tuned universal vector overfits the source and does not travel, \(ii\) Decoder’s normalization decides exposure: ZeroG standardizes its node embeddings before the readout, which cancels a shared additive shift and defends it, while OFA does not and is exposed, and \(iii\) Transfer weakens with domain distance\. This points to per\-domain normalization as a cheap transfer defense\.

#### Causal localization\.

Pinning GFT’s codebook index to its clean value under attack restores accuracy, a do\-operator on the discrete carrier that holds across GFT’s node suite \(Figure[4](https://arxiv.org/html/2607.18567#S4.F4)\(a\)\)\. For a continuous spectral carrier the effect does not concentrate in the leading subspace, so the discrete codebook gives the clean causal evidence\.

### Results by Model

The carrier type organizes the outcome \(Table[1](https://arxiv.org/html/2607.18567#S4.T1), per\-dataset in the full matrix \(supplement\)\)\. Where a light decoder reads the alignment representation the attack succeeds\. Where a trained network sits between the representation and the output the same move is absorbed unless the task is fragile\.

#### GraphAny\.

Its channels are closed\-form solutions read by a light fusion, so a feature perturbation that moves the solved logits changes the output\. It succeeds across all four domains at both a dense and a sparse budget of a few entries per node \(supplement\), and the random control does not move accuracy\. What is specific to the foundation model is that the solve runs over a fixed spectral basis shared across every domain with no per\-graph training, so one perturbation moves the zero\-shot path the model reuses on every dataset\.

#### OpenGraph\.

A trained transformer reads the tokenizer and absorbs a generic edge perturbation where clean accuracy is ample\. It succeeds once the task is fragile, so within OpenGraph headroom orders reachability, a within\-model pattern that does not survive pooling \(Figure[4](https://arxiv.org/html/2607.18567#S4.F4)\(b\)\)\.

Table 2:One universal perturbation crafted on Cora at matched budget, attack success on each target, mean over three seeds with standard deviation below0\.0050\.005\. The generic vector wins on the source\. The shared\-subspace vector transfers to far\-domain PubMed, the differentiator of the alignment framing\.
#### AnyGraph\.

The edge attack on its joint tokenizer succeeds on several datasets, and being in\-distribution for the checkpoint gives no protection \(supplement\)\. Its feature half is inert, so the edge channel carries the attack\.

#### OFA and ZeroG\.

Both read a similarity between a node embedding and a class embedding in one text space\. Editing the shared class\-description text is the realizable attack, and one edit moves every node in that class, reaching attack success above one half on the citation graphs but zero on the two social graphs, where a two\-class decoder admits no improving edit \(Table[1](https://arxiv.org/html/2607.18567#S4.T1)\)\. Perturbing the node embedding directly is higher but an upper bound the attacker cannot emit\.

#### GFT\.

The codebook is discrete, so the attack flips token assignments, and pinning the tokens to their clean value restores accuracy\. This gives the clean causal evidence \(Figure[4](https://arxiv.org/html/2607.18567#S4.F4)\(a\)\), and the effect holds up to ogbn\-arxiv, about 170k nodes\.

#### Classical attacks cover only the structural surface\.

A classical graph attack perturbs the adjacency, so it is defined only where a model reads one, limiting the comparison to OpenGraph node classification\. There Metattack and PGD transferred from a surrogate graph convolutional network exceed our tokenizer\-targeted attack on Cora and Citeseer and beat it on fragile PubMed \(supplement\), so we claim no advantage on the structural surface\. The point is the reverse\. Nettack edits one graph for one task\(Zügneret al\.[2018](https://arxiv.org/html/2607.18567#bib.bib27)\), with no form that shifts a class embedding read against every node, flips a shared codebook token, or carries a perturbation across domains through the alignment map\. The text carrier, the codebook, and the cross\-domain transfer have no classical counterpart\.

#### Ablations\.

The attack objective matters \(A1\): the task loss and its fixed\-basis surrogate reach high success while the subspace rotation objective does not, because its gradient vanishes at the clean graph\. The causal effect is graded in the ablated rank on GFT \(A3\), while continuous carriers do not localize\. Spectral degeneracy lowers the attack cost within a graph \(A5\), and a targeted codebook flip is more damaging than an untargeted one although it flips fewer tokens \(A9\)\. Full tables are in the supplement\.

## 5Defense: Not Correctable, but Detectable

#### Robustifying the alignment layer fails\.

We derive four defenses from the causes above, standardization, smoothing, margin hardening, and an off\-the\-shelf spectral purification, and evaluate each against an adaptive attacker, which is the correct test\. None survives \(appendix\)\. Standardization is the strongest static defense but a defense\-aware attacker differentiates through it and recovers the full attack\. Smoothing gives a certified radius in carrier space that does not cover the attack budget\(Cohenet al\.[2019](https://arxiv.org/html/2607.18567#bib.bib99); Bojchevskiet al\.[2020](https://arxiv.org/html/2607.18567#bib.bib96)\), and an attacker that averages over the noise recovers most of its benefit\. On the codebook the noise these defenses add itself flips tokens, so they backfire even statically\. GCN\-SVD is unusable on the spectral carrier, because OpenGraph’s tokenizer is itself a truncated singular value decomposition of the same adjacency\(Entezariet al\.[2020](https://arxiv.org/html/2607.18567#bib.bib107)\), so the subspace it keeps is the one the attack rotates\. A decoder that resists a single token flip removes that one lever, but an adaptive attacker moves to the continuous prototype head and total attack success rises above the undefended level \(Table[3](https://arxiv.org/html/2607.18567#S5.T3)\)\.

Table 3:Attack success under each defense, static and adaptive\. None survives the adaptive attacker, on the codebook they backfire even statically, and GCN\-SVD is unusable \(the†drop is clean accuracy collapsing, undefended clean0\.610\.61\)\. Full table in the supplement\.
#### Attacked inputs are detectable\.

Flagging the attack does not require correcting it\. The attack pushes the representation off the clean manifold, so a density test fit on clean representations alone separates attacked from clean inputs, almost perfectly on the low\-dimensional continuous carriers: a Mahalanobis test on GraphAny’s fusion distances and GFT’s pre\-quantization embedding reaches AUC1\.001\.00at a five percent false\-positive rate\. It holds under an adaptive attacker adding a stay\-on\-manifold penalty \(GFT stays near AUC0\.870\.87; on GraphAny the attacker pulls it toward chance only by cutting attack success from0\.370\.37to0\.120\.12\), and flags a feature\-distribution attack\(Inkawhichet al\.[2020](https://arxiv.org/html/2607.18567#bib.bib103)\)where that attack flips the prediction \(supplement\)\. The test is fit on clean representations only, and is not uniform, falling to0\.660\.66on ZeroG’s near\-isotropic text embedding, so it tracks the carrier’s effective dimension \(Table[4](https://arxiv.org/html/2607.18567#S5.T4)\), the graph analogue of an image result that a perturbation raises the local intrinsic dimensionality\(Maet al\.[2018](https://arxiv.org/html/2607.18567#bib.bib110)\)\.

Table 4:Detection of attacked inputs by a density test fit on clean representations\. Effective dimension is the participation ratio of the clean representation, which tracks detectability, not the ambient dimension\. GFT’s768768\-dimensional embedding sits near a discrete codebook, so its effective dimension is33and it is caught, while ZeroG’s near\-isotropic text embedding has effective dimension7373and is not\.

## 6Discussion and Limitations

On the structure\-only surface of OpenGraph, classical attacks transfer better than ours; the contribution there is the alignment surfaces they cannot express and the causal localization they do not provide\. Causal localization is clean for the discrete codebook but confounded for continuous carriers, where no linear erasure \(LEACE, INLP\) both preserves clean accuracy and removes the effect, so the discrete do\-operator is the only clean handle\. The certified radius is in carrier space; an input\-space guarantee needs a Lipschitz bound onΦ\\Phi, which the codebook lacks, since nearest\-token assignment is piecewise constant, so the certificate cannot lift to the input there\. The capabilities differ in realism: text edits are realistic when the attacker supplies content and we constrain them by semantic similarity, while feature and edge perturbations assume control of attributes or links and impose none of the unnoticeability constraints standard in the graph\-attack literature\(Zügneret al\.[2018](https://arxiv.org/html/2607.18567#bib.bib27)\), so their numbers upper\-bound attacker power\.

## 7Conclusion

The alignment layer that maps every domain into one shared space is an attack surface that has not been studied\. Most alignment layers are no more fragile under a directed representation\-space perturbation than a plain graph network, but OpenGraph’s spectral tokenizer collapses at a fifth of the budget, a fragility specific to the alignment layer that a carrier\-specific edge attack partially realizes\. An input\-access attacker breaks three of the six, gated by how directly the decoder reads the representation, not by clean accuracy\. Robustifying the layer fails against an adaptive attacker, but attacked inputs are detectable on its low\-dimensional carriers\.

## 8Ethical Statement

This is robustness research on public benchmarks and released models\. All attacks are inference\-time evasion, reported so that builders can defend the alignment layer\. We target no deployed system and release code for reproducibility\.

## References

- A\. Athalye, N\. Carlini, and D\. Wagner \(2018\)Obfuscated gradients give a false sense of security: circumventing defenses to adversarial examples\.InProceedings of the 35th International Conference on Machine Learning \(ICML\),PMLR, Vol\.80,pp\. 274–283\.External Links:1802\.00420,[Link](https://arxiv.org/abs/1802.00420)Cited by:[§2](https://arxiv.org/html/2607.18567#S2.SS0.SSS0.Px3.p1.1)\.
- N\. Belrose, D\. Schneider\-Joseph, S\. Ravfogel, R\. Cotterell, E\. Raff, and S\. Biderman \(2023\)LEACE: perfect linear concept erasure in closed form\.InAdvances in Neural Information Processing Systems \(NeurIPS\),External Links:2306\.03819,[Link](https://arxiv.org/abs/2306.03819)Cited by:[§2](https://arxiv.org/html/2607.18567#S2.SS0.SSS0.Px3.p1.1)\.
- A\. Bojchevski, J\. Klicpera, and S\. Günnemann \(2020\)Efficient robustness certificates for discrete data: sparsity\-aware randomized smoothing for graphs, images and more\.InProceedings of the 37th International Conference on Machine Learning \(ICML\),PMLR, Vol\.119,pp\. 1003–1013\.External Links:2008\.12952,[Link](https://arxiv.org/abs/2008.12952)Cited by:[§5](https://arxiv.org/html/2607.18567#S5.SS0.SSS0.Px1.p1.1)\.
- N\. Carlini and D\. Wagner \(2017\)Towards evaluating the robustness of neural networks\.In2017 IEEE Symposium on Security and Privacy \(S&P\),pp\. 39–57\.External Links:1608\.04644,[Link](https://arxiv.org/abs/1608.04644)Cited by:[§2](https://arxiv.org/html/2607.18567#S2.SS0.SSS0.Px3.p1.1)\.
- J\. M\. Cohen, E\. Rosenfeld, and J\. Z\. Kolter \(2019\)Certified adversarial robustness via randomized smoothing\.InProceedings of the 36th International Conference on Machine Learning \(ICML\),PMLR, Vol\.97,pp\. 1310–1320\.External Links:1902\.02918,[Link](https://arxiv.org/abs/1902.02918)Cited by:[§2](https://arxiv.org/html/2607.18567#S2.SS0.SSS0.Px3.p1.1),[§5](https://arxiv.org/html/2607.18567#S5.SS0.SSS0.Px1.p1.1)\.
- H\. Dai, H\. Li, T\. Tian, X\. Huang, L\. Wang, J\. Zhu, and L\. Song \(2018\)Adversarial attack on graph structured data\.InProceedings of the 35th International Conference on Machine Learning \(ICML\),External Links:1806\.02371,[Link](https://arxiv.org/abs/1806.02371)Cited by:[§2](https://arxiv.org/html/2607.18567#S2.SS0.SSS0.Px1.p1.1)\.
- N\. Entezari, S\. A\. Al\-Sayouri, A\. Darvishzadeh, and E\. E\. Papalexakis \(2020\)All you need is low \(rank\): defending against adversarial attacks on graphs\.InProceedings of the 13th International Conference on Web Search and Data Mining,WSDM ’20,New York, NY, USA,pp\. 169–177\.External Links:ISBN 9781450368223,[Link](https://doi.org/10.1145/3336191.3371789),[Document](https://dx.doi.org/10.1145/3336191.3371789)Cited by:[§5](https://arxiv.org/html/2607.18567#S5.SS0.SSS0.Px1.p1.1)\.
- I\. Gupta, R\. Schaeffer, J\. Kazdan, K\. Z\. Liu, and S\. Koyejo \(2025\)Understanding adversarial transfer: why representation\-space attacks fail where data\-space attacks succeed\.External Links:2510\.01494,[Link](https://arxiv.org/abs/2510.01494)Cited by:[Appendix K](https://arxiv.org/html/2607.18567#A11.SS0.SSS0.Px3.p1.16),[Appendix E](https://arxiv.org/html/2607.18567#A5.p2.2),[§2](https://arxiv.org/html/2607.18567#S2.SS0.SSS0.Px3.p1.1)\.
- M\. Huh, B\. Cheung, T\. Wang, and P\. Isola \(2024\)The platonic representation hypothesis\.InProceedings of the 41st International Conference on Machine Learning \(ICML\),External Links:2405\.07987,[Link](https://arxiv.org/abs/2405.07987)Cited by:[§2](https://arxiv.org/html/2607.18567#S2.SS0.SSS0.Px3.p1.1)\.
- N\. Inkawhich, K\. J\. Liang, L\. Carin, and Y\. Chen \(2020\)Transferable perturbations of deep feature distributions\.InInternational Conference on Learning Representations \(ICLR\),External Links:2004\.12519,[Link](https://arxiv.org/abs/2004.12519)Cited by:[Appendix K](https://arxiv.org/html/2607.18567#A11.SS0.SSS0.Px3.p1.16),[§5](https://arxiv.org/html/2607.18567#S5.SS0.SSS0.Px2.p1.5)\.
- N\. Inkawhich, W\. Wen, H\. H\. Li, and Y\. Chen \(2019\)Feature space perturbations yield more transferable adversarial examples\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition \(CVPR\),pp\. 7066–7074\.External Links:[Document](https://dx.doi.org/10.1109/CVPR.2019.00723)Cited by:[Appendix K](https://arxiv.org/html/2607.18567#A11.SS0.SSS0.Px3.p1.16)\.
- J\. Jia, Y\. Liu, and N\. Z\. Gong \(2022\)BadEncoder: backdoor attacks to pre\-trained encoders in self\-supervised learning\.In2022 IEEE Symposium on Security and Privacy \(S&P\),pp\. 2043–2059\.External Links:2108\.00352,[Link](https://arxiv.org/abs/2108.00352)Cited by:[§2](https://arxiv.org/html/2607.18567#S2.SS0.SSS0.Px3.p1.1)\.
- W\. Jin, Y\. Li, H\. Xu, Y\. Wang, S\. Ji, C\. Aggarwal, and J\. Tang \(2020\)Adversarial attacks and defenses on graphs: a review, a tool and empirical studies\.ACM SIGKDD Explorations Newsletter22\(2\),pp\. 19–34\.Note:arXiv:2003\.00653Cited by:[§2](https://arxiv.org/html/2607.18567#S2.SS0.SSS0.Px1.p1.1)\.
- H\. Kim, G\. Papamakarios, and A\. Mnih \(2021\)The Lipschitz constant of self\-attention\.InProceedings of the 38th International Conference on Machine Learning \(ICML\),Cited by:[Appendix J](https://arxiv.org/html/2607.18567#A10.SS0.SSS0.Px5.p1.18)\.
- S\. Kornblith, M\. Norouzi, H\. Lee, and G\. Hinton \(2019\)Similarity of neural network representations revisited\.InProceedings of the 36th International Conference on Machine Learning \(ICML\),External Links:1905\.00414,[Link](https://arxiv.org/abs/1905.00414)Cited by:[§2](https://arxiv.org/html/2607.18567#S2.SS0.SSS0.Px3.p1.1)\.
- Y\. Li, P\. Wang, Z\. Li, J\. X\. Yu, and J\. Li \(2024\)ZeroG: investigating cross\-dataset zero\-shot transferability in graphs\.InProceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining \(KDD\),External Links:[Link](https://arxiv.org/abs/2402.11235)Cited by:[§1](https://arxiv.org/html/2607.18567#S1.p1.1)\.
- H\. Liu, J\. Feng, L\. Kong, N\. Liang, D\. Tao, Y\. Chen, and M\. Zhang \(2024\)One for all: towards training one graph model for all classification tasks\.InInternational Conference on Learning Representations \(ICLR\),Note:arXiv:2310\.00149External Links:[Link](https://arxiv.org/abs/2310.00149)Cited by:[§1](https://arxiv.org/html/2607.18567#S1.p1.1)\.
- J\. Liu, C\. Yang, Z\. Lu, J\. Chen, Y\. Li, M\. Zhang, T\. Bai, Y\. Fang, L\. Sun, P\. S\. Yu, and C\. Shi \(2025\)Graph foundation models: concepts, opportunities and challenges\.IEEE Transactions on Pattern Analysis and Machine Intelligence\.Note:arXiv:2310\.11829External Links:[Document](https://dx.doi.org/10.1109/TPAMI.2025.3548729),2310\.11829Cited by:[§1](https://arxiv.org/html/2607.18567#S1.p1.1)\.
- J\. Luo, Q\. Sun, L\. Lyu, Z\. Zhang, H\. Yuan, X\. Fu, and J\. Li \(2026\)Towards effective, stealthy, and persistent backdoor attacks targeting graph foundation models\.Proceedings of the AAAI Conference on Artificial Intelligence40\(29\),pp\. 24142–24150\.External Links:[Link](https://ojs.aaai.org/index.php/AAAI/article/view/39593),[Document](https://dx.doi.org/10.1609/aaai.v40i29.39593)Cited by:[§2](https://arxiv.org/html/2607.18567#S2.SS0.SSS0.Px2.p1.1)\.
- X\. Ma, B\. Li, Y\. Wang, S\. M\. Erfani, S\. Wijewickrema, G\. Schoenebeck, M\. E\. Houle, D\. Song, and J\. Bailey \(2018\)Characterizing adversarial subspaces using local intrinsic dimensionality\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=B1gJ1L2aW)Cited by:[§5](https://arxiv.org/html/2607.18567#S5.SS0.SSS0.Px2.p1.5)\.
- H\. Mao, Z\. Chen, W\. Tang, J\. Zhao, Y\. Ma, T\. Zhao, N\. Shah, M\. Galkin, and J\. Tang \(2024\)Position: graph foundation models are already here\.InProceedings of the 41st International Conference on Machine Learning \(ICML\),External Links:2402\.02216,[Link](https://arxiv.org/abs/2402.02216)Cited by:[§1](https://arxiv.org/html/2607.18567#S1.p1.1)\.
- K\. Meng, D\. Bau, A\. Andonian, and Y\. Belinkov \(2022\)Locating and editing factual associations in GPT\.InAdvances in Neural Information Processing Systems \(NeurIPS\),External Links:2202\.05262,[Link](https://arxiv.org/abs/2202.05262)Cited by:[§2](https://arxiv.org/html/2607.18567#S2.SS0.SSS0.Px3.p1.1)\.
- S\. Moosavi\-Dezfooli, A\. Fawzi, O\. Fawzi, and P\. Frossard \(2017\)Universal adversarial perturbations\.In2017 IEEE Conference on Computer Vision and Pattern Recognition \(CVPR\),Vol\.,pp\. 86–94\.External Links:[Document](https://dx.doi.org/10.1109/CVPR.2017.17)Cited by:[§4](https://arxiv.org/html/2607.18567#S4.SS0.SSS0.Px6.p1.4)\.
- S\. Sabour, Y\. Cao, F\. Faghri, and D\. J\. Fleet \(2016\)Adversarial manipulation of deep representations\.InInternational Conference on Learning Representations \(ICLR\),External Links:1511\.05122,[Link](https://arxiv.org/abs/1511.05122)Cited by:[§2](https://arxiv.org/html/2607.18567#S2.SS0.SSS0.Px3.p1.1)\.
- Y\. Sun, S\. Wang, X\. Tang, T\. Hsieh, and V\. Honavar \(2020\)Adversarial attacks on graph neural networks via node injections: a hierarchical reinforcement learning approach\.InProceedings of The Web Conference 2020,WWW ’20,New York, NY, USA,pp\. 673–683\.External Links:ISBN 9781450370233,[Link](https://doi.org/10.1145/3366423.3380149),[Document](https://dx.doi.org/10.1145/3366423.3380149)Cited by:[§1](https://arxiv.org/html/2607.18567#S1.p2.1),[§2](https://arxiv.org/html/2607.18567#S2.SS0.SSS0.Px1.p1.1)\.
- F\. Tramèr, N\. Carlini, W\. Brendel, and A\. Madry \(2020\)On adaptive attacks to adversarial example defenses\.InAdvances in Neural Information Processing Systems \(NeurIPS\),External Links:2002\.08347,[Link](https://arxiv.org/abs/2002.08347)Cited by:[§2](https://arxiv.org/html/2607.18567#S2.SS0.SSS0.Px3.p1.1)\.
- M\. Usama and D\. E\. Chang \(2026\)Convergence without understanding: when language models agree on representations but disagree on reasoning\.External Links:2605\.23315,[Link](https://arxiv.org/abs/2605.23315)Cited by:[§2](https://arxiv.org/html/2607.18567#S2.SS0.SSS0.Px3.p1.1)\.
- Z\. Wang, Z\. Zhang, N\. V\. Chawla, C\. Zhang, and Y\. Ye \(2024\)GFT: graph foundation model with transferable tree vocabulary\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Note:arXiv:2411\.06070External Links:[Link](https://arxiv.org/abs/2411.06070)Cited by:[§1](https://arxiv.org/html/2607.18567#S1.p1.1)\.
- L\. Xia and C\. Huang \(2026\)AnyGraph: graph foundation model in the wild\.InFindings of the Association for Computational Linguistics: ACL 2026,M\. Liakata, V\. P\. Moreira, J\. Zhang, and D\. Jurgens \(Eds\.\),San Diego, California, United States,pp\. 882–896\.External Links:[Link](https://aclanthology.org/2026.findings-acl.44/),[Document](https://dx.doi.org/10.18653/v1/2026.findings-acl.44),ISBN 979\-8\-89176\-395\-1Cited by:[§1](https://arxiv.org/html/2607.18567#S1.p1.1)\.
- L\. Xia, B\. Kao, and C\. Huang \(2024\)OpenGraph: towards open graph foundation models\.InFindings of the Association for Computational Linguistics: EMNLP 2024,External Links:2403\.01121,[Link](https://arxiv.org/abs/2403.01121)Cited by:[§1](https://arxiv.org/html/2607.18567#S1.p1.1)\.
- K\. Xu, H\. Chen, S\. Liu, P\. Chen, T\. Weng, M\. Hong, and X\. Lin \(2019\)Topology attack and defense for graph neural networks: an optimization perspective\.InProceedings of the 28th International Joint Conference on Artificial Intelligence \(IJCAI\),External Links:1906\.04214,[Link](https://arxiv.org/abs/1906.04214)Cited by:[§1](https://arxiv.org/html/2607.18567#S1.p2.1),[§2](https://arxiv.org/html/2607.18567#S2.SS0.SSS0.Px1.p1.1)\.
- Q\. Zhang, X\. Sheng, Y\. Sun, and Q\. Tan \(2025\)TrustGLM: evaluating the robustness of graphllms against prompt, text, and structure attacks\.InProceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining \(KDD\),Note:arXiv:2506\.11844External Links:[Link](https://arxiv.org/abs/2506.11844)Cited by:[§2](https://arxiv.org/html/2607.18567#S2.SS0.SSS0.Px2.p1.1)\.
- T\. Zhang, R\. Jha, E\. Bagdasaryan, and V\. Shmatikov \(2024\)Adversarial illusions in multi\-modal embeddings\.In33rd USENIX Security Symposium \(USENIX Security\),External Links:2308\.11804,[Link](https://arxiv.org/abs/2308.11804)Cited by:[Appendix E](https://arxiv.org/html/2607.18567#A5.p2.2),[§2](https://arxiv.org/html/2607.18567#S2.SS0.SSS0.Px3.p1.1)\.
- J\. Zhao, Z\. Zhu, M\. Galkin, H\. Mostafa, M\. Bronstein, and J\. Tang \(2025\)Fully\-inductive node classification on arbitrary graphs\.InInternational Conference on Learning Representations \(ICLR\),Note:arXiv:2405\.20445; proposes GraphAnyExternal Links:[Link](https://arxiv.org/abs/2405.20445)Cited by:[§1](https://arxiv.org/html/2607.18567#S1.p1.1)\.
- Y\. Zhao, T\. Pang, C\. Du, X\. Yang, C\. Li, N\. Cheung, and M\. Lin \(2023\)On evaluating adversarial robustness of large vision\-language models\.InAdvances in Neural Information Processing Systems \(NeurIPS\),External Links:2305\.16934,[Link](https://arxiv.org/abs/2305.16934)Cited by:[§2](https://arxiv.org/html/2607.18567#S2.SS0.SSS0.Px3.p1.1)\.
- D\. Zügner, A\. Akbarnejad, and S\. Günnemann \(2018\)Adversarial attacks on neural networks for graph data\.InProceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining \(KDD\),External Links:[Link](https://arxiv.org/abs/1805.07984)Cited by:[§1](https://arxiv.org/html/2607.18567#S1.p2.1),[§2](https://arxiv.org/html/2607.18567#S2.SS0.SSS0.Px1.p1.1),[§4](https://arxiv.org/html/2607.18567#S4.SSx1.SSS0.Px6.p1.1),[§6](https://arxiv.org/html/2607.18567#S6.p1.1)\.
- D\. Zügner and S\. Günnemann \(2019\)Adversarial attacks on graph neural networks via meta learning\.InInternational Conference on Learning Representations \(ICLR\),External Links:[Link](https://arxiv.org/abs/1902.08412)Cited by:[§1](https://arxiv.org/html/2607.18567#S1.p2.1),[§2](https://arxiv.org/html/2607.18567#S2.SS0.SSS0.Px1.p1.1)\.

This supplement contains the full seeded results matrix \(§[A](https://arxiv.org/html/2607.18567#A1)\), the classical\-attack baseline comparison \(§[B](https://arxiv.org/html/2607.18567#A2)\), cross\-domain transfer numbers \(§[E](https://arxiv.org/html/2607.18567#A5)\), the complete ablation battery \(§[F](https://arxiv.org/html/2607.18567#A6)\), the robust\-GFM tables including the certified\-robustness and joint\-retrain results \(§[G](https://arxiv.org/html/2607.18567#A7)\), and method, dataset, and reproduction details \(§[H](https://arxiv.org/html/2607.18567#A8)\)\.

## Appendix AFull Evasion Matrix

Table[5](https://arxiv.org/html/2607.18567#A1.T5)reports the peak attack success rate \(relative accuracy drop\) for each model and dataset, best over our attacks and the reported budget sweep\. Random\-perturbation baselines of equal budget are near zero throughout \(0\.00–0\.03\), except on the densest\-feature graphs \(PubMed, WikiCS\) where even random noise moves accuracy somewhat\. Cells derived from a seeded sweep report the mean\. The per\-seed rows are in the releasedresults\.json\(evasion\_seeds\)\. AnyGraph rows are flagged for thelink2\-pretrained checkpoint: Cora and CS are in\-distribution \(seen\), only Citeseer, PubMed, products, and p2p are genuine zero\-shot\.

Table 5:Full evasion matrix\. Peak ASR per model and dataset\.#### GraphAny, per dataset \(three seeds\)\.

Citation: Cora0\.87±\.000\.87\\pm\.00, Citeseer0\.92±\.000\.92\\pm\.00, PubMed0\.98±\.000\.98\\pm\.00\. Web: WikiCS0\.91±\.010\.91\\pm\.01\. E\-commerce: Amazon\-Photo0\.61±\.040\.61\\pm\.04, Amazon\-Computers0\.68±\.030\.68\\pm\.03\. Heterophily: Cornell0\.71±\.050\.71\\pm\.05, Texas0\.39±\.050\.39\\pm\.05, Wisconsin0\.55±\.050\.55\\pm\.05\. Theℓ0\\ell\_\{0\}sparse\-feature variant reaches ASR 0\.52 atk=5k\{=\}5\(∼\\sim4 entries/node\) and matches the denseℓ∞\\ell\_\{\\infty\}attack \(0\.87\) atk=25k\{=\}25, while a random\-ℓ0\\ell\_\{0\}control stays at 0\.02–0\.05\.

#### Scale\.

The attack is not limited to small citation graphs\. It is evaluated on graphs from 2\.7k to 169k nodes across citation, wiki, e\-commerce, social, and link\-prediction domains\. On ogbn\-arxiv, the largest graph, the GFT codebook\-flip reaches attack success 0\.75 and the codebook do\-operator still restores clean accuracy, so the causal localization holds at 169k nodes\. GraphAny breaks on PubMed and Amazon, and ZeroG breaks on the reddit and instagram social graphs\. Larger graphs dampen the structural edge attacks but not the feature, text, or codebook carriers, which is consistent with the alignment layer, not the topology, being the reachable surface\.

## Appendix BClassical\-Attack Baselines

A classical graph attack perturbs the adjacency, so it applies only to a model that reads an adjacency, which restricts the comparison to OpenGraph node classification\. We craft perturbed adjacencies with DeepRobust \(Metattack Meta\-Self and PGD topology attack\) against a two\-layer GCN surrogate on the model’s own citation subgraph, editing only edges between real nodes and leaving the class\-prototype nodes untouched, then feed the same perturbed adjacency into OpenGraph and score its real zero\-shotpredict\(\)as a 10\-pass average\. Table[6](https://arxiv.org/html/2607.18567#A2.T6)shows that these classical attacks are a strong baseline on this surface and exceed our tokenizer\-targeted attack, which we report rather than hide\. There is no classical counterpart for the feature, text, or codebook attacks that break the other five models, so those carriers have no baseline of this kind\.

Table 6:Baseline comparison on OpenGraph\. ASR for our spectral\-edge attack vs Metattack, PGD, and random at matched edge budgets\.
## Appendix CRealizable Input\-Space Attack on the Text Models

The threat model perturbs inputs, so for the text models the realizable attack edits the actual class\-description words, not the node or class embedding\. The class\-text attack is a joint multi\-class greedy HotFlip\. For each class we tokenize its description, back\-propagate the test cross\-entropy to the input\-token embeddings, score every vocabulary swap by a first\-order estimate, re\-encode the top candidates through the real sentence encoder, and accept the single best swap that raises the loss subject to a cosine\-similarity floor of0\.700\.70to the original text, capped at eight edits per class\. Accuracy is the real decoder at every step, re\-verified by injecting the edited texts through the pipeline \(max logit deviation<2×10−7<2\\times 10^\{\-7\}\)\. Table[7](https://arxiv.org/html/2607.18567#A3.T7)gives the realizable input\-space attack success beside the representation\-space upper bound, the node or class embedding perturbation the attacker cannot emit\. On citation graphs the text edit recovers most of the upper bound\. On the two social graphs it is exactly zero, and this is not a search failure\. The unconstrained class\-embedding attack itself reaches only0\.020\.02and0\.0030\.003there, so a class\-text carrier cannot move a two\-class social decoder, and the1\.001\.00in the upper\-bound column is a node\-embedding perturbation with no realizable text form\.

Table 7:Realizable input\-space class\-text attack success versus the representation\-space upper bound for the text models\. The upper bound is a node or class embedding perturbation the stated attacker cannot produce\. Input\-space attack success is near the bound on citation graphs and zero on the two social graphs\.
## Appendix DAlignment\-Targeted vs Generic Attack, and Black\-Box Queries

We hold the optimizer, the objective, and the budget fixed and vary only the search space\. The generic end\-to\-end attack optimizes one universal decision\-space vector in the full embedding\. The alignment\-targeted attack confines the same vector to the top sixteen principal directions of the shared representation, the subspace used by align\-then\-ablate\. Both are crafted on Cora and applied unchanged to Cora, near\-domain Citeseer, and far\-domain PubMed at a matched budget \(Table[8](https://arxiv.org/html/2607.18567#A4.T8)\)\. The generic vector is stronger on the source, because about half its budget lies outside the shared subspace and overfits the source class geometry, and that part does not transfer\. On far\-domain PubMed the generic vector reaches0\.0650\.065, at the matched random control, while only the alignment\-targeted vector transfers above chance, to0\.224±0\.0020\.224\\pm 0\.002over three seeds\. This is what the alignment view buys, not a new optimizer but a perturbation that survives a domain change\. Near\-domain Citeseer is fragile at0\.270\.27clean accuracy, so both vectors flip it and the two are equal there\.

Table 8:Generic end\-to\-end vs alignment\-targeted attack, one universal vector crafted on Cora at matched budget, attack success on each target\. The generic vector wins on the source, the alignment\-targeted vector transfers to far\-domain PubMed\.A black\-box variant reads only the model’s output scores, with no gradients\. Score\-based search on ZeroG’s text carrier reaches7373to8383percent of the white\-box attack success at a few hundred queries per node \(Table[9](https://arxiv.org/html/2607.18567#A4.T9)\), so the threat model is evidenced at white box, gray box \(the cross\-model spectral transfer above\), and black box\. This black\-box result is at the embedding carrier under query access, not raw\-text queries\.

Table 9:Score\-based black\-box attack on ZeroG’s node\-embedding carrier versus the white\-box attack, at matched budget\.
## Appendix ECross\-Domain Transfer

A single perturbation is crafted on Cora in the shared text space and applied verbatim to target domains\. Within the citation family it transfers \(ZeroG Cora→\\toCiteseer 0\.72, OFA Cora→\\toPubMed 0\.43, vs random 0\.03\)\. Across the citation\-to\-social gap it fails \(ZeroG Cora→\\toreddit 0\.05≈\\approxrandom 0\.055,→\\toinstagram 0\.20\)\. A naive universal additive perturbation does not transfer at all\. Only a generic semantic axis \(top principal direction\) travels, and only through decoders that do not standardize per domain \(ZeroG standardizes and resists, OFA does not and is exposed\)\. Cross\-domain transfer rate \(mean target ASR, excluding source\): OFA pcaAxis 0\.43 \(hit rate 1\.0\), ZeroG pcaAxis 0\.36 \(near/far split: Citeseer 0\.72, PubMed 0\.01\)\.

Matching the target class prototype in the shared space, the analog of an adversarial illusion\(Zhanget al\.[2024](https://arxiv.org/html/2607.18567#bib.bib105)\), is the most budget\-efficient within\-family carrier\. Crafted on Cora it reaches Citeseer at attack success0\.650\.65at a quarter of the budget where the task\-loss vector reaches only0\.110\.11, because the prototype direction is shared across the family while the task\-loss direction overfits the source geometry\(Guptaet al\.[2025](https://arxiv.org/html/2607.18567#bib.bib106)\)\. It still does not reach the far domain, where no carrier beats a matched random baseline\. This is the same split at a finer grain, the shared direction travels within the family and no direction crosses to it\.

#### Gray\-box cross\-model transfer \(E5\)\.

The attacker has no gradient access to the victim\. It crafts an edge set on a surrogate spectral model, using the surrogate’s own white\-box attack, and applies the same edges verbatim to the victim, whose pipeline re\-runs the singular value decomposition, re\-normalizes the adjacency, and, for AnyGraph, re\-routes its experts\. The transfer is real but weak \(Table[10](https://arxiv.org/html/2607.18567#A5.T10)\): the victim drop exceeds the matched flip\-count random control at the larger budget, most clearly for OpenGraph into AnyGraph on Citeseer, yet stays small in absolute terms\. This is consistent with the spectral pair being the resistant carrier, where even the white\-box attack has little room on these high\-accuracy tasks\. The mechanism, not white\-box access, is what carries the effect, but the size of the effect is bounded by the victim task’s headroom\.

Table 10:Gray\-box cross\-model transfer between the two spectral models, attack success \(metric drop\), two seeds\. Surrogate is the attacker’s own model, victim is the target with no gradient access, random is a matched flip\-count edge control on the victim\.

## Appendix FAblation Battery

#### A1: attack objective\.

On a 4\-block SBM through the reference tokenizer, task\-loss and fixed\-basis\-surrogate objectives both reach ASR 0\.925, while subspace\-rotation reaches 0\.59 despite the largest misalignment\. A gradient probe at the clean graph: subspace\-objective gradient norm2\.4×10−62\.4\\times 10^\{\-6\}vs task\-loss0\.130\.13\. The clean graph is a minimum of subspace misalignment, so rotation is second\-order there\. We maximize task loss instead\.

#### A3: rank dose\-response\.

Ablating rank1\.\.121\.\.12of the alignment subspace on GFT gives a graded collapse of the mediated fraction \(0\.12→0\.32→0\.71→0\.740\.12\\to 0\.32\\to 0\.71\\to 0\.74\)\. GraphAny’s curve is noisy because its phi\-pathway effect is tiny \(17/1000 nodes\), consistent with the feature attack routing through the channel logits rather than the distance features\.

#### A5: spectral degeneracy\.

Within a single graph the singular\-value gap correlates with misalignment absorbed per unit budget at−0\.69\-0\.69: near\-degenerate boundaries absorb 5–15×\\timesmore rotation per edge flipped\. The naive cross\-graph proxy is confounded \(correlation\+0\.03\+0\.03\), reported as an honest negative\.

#### A9: targeted vs untargeted\.

On GFT the targeted codebook\-flip reaches higher ASR than untargeted \(0\.71 vs 0\.51\) while flipping*fewer*tokens \(88\.9% vs 100%\): coordinated redirection to a chosen token does more damage than scattering assignments\.

#### A4: ablation method\.

We compare four operators on the same alignment subspace: plain projection, LEACE closed\-form erasure, INLP, and a matched\-rank random\-subspace placebo\. On GFT’s continuous embedding, projection removes the effect \(mediated 0\.77\) but destroys clean accuracy \(clean\-ablated 0\.15\)\. LEACE reduces the confound \(mediated 0\.43\) yet still costs clean accuracy \(0\.29\)\. INLP preserves clean accuracy \(0\.78\) but no longer removes the effect \(mediated 0\.06\)\. No linear erasure both keeps clean accuracy and removes the attack, so the continuous carrier does not localize\. The discrete do\-operator does\. On GraphAny’s distance features every operator, including the random placebo, mediates 0\.65 to 0\.76 at no clean\-accuracy cost, so a rank\-6 subspace of the 20\-dimensional space is not specific\. Both cases confirm that the clean causal evidence is the discrete codebook, not a continuous subspace\.

#### Additional surfaces and scale\.

The attack also reaches auxiliary parts of the alignment layer\. Node injection perturbs the same tokenizer without editing existing edges, its effect growing with the injected count, and AnyGraph’s router can be sent to a close\-substitute expert\. Combining input channels does not beat the strongest single one: a joint edge\-and\-feature attack on AnyGraph and a joint text\-and\-edge attack on ZeroG each equal their best single lever, so the channels are redundant, reaching the same representation rather than adding independent damage\.

## Appendix GRobust GFM: Full Tables

#### C2 certified robustness \(real GFT\)\.

Randomized smoothing on the representation, certified via Cohen et al\. \(2019\)\. Radii are in carrier space \(input\-space requiresΦ\\PhiLipschitz\)\.

Table 11:Certified robustness of GFT under representation\-space smoothing\.
#### C1 joint encoder\+codebook retrain \(real GFT, Cora\)\.

Table[12](https://arxiv.org/html/2607.18567#A7.T12): the joint retrain moves the geometry offline hardening could not \(margin, mean flip budget, flip rate\), but end\-to\-end ASR gets worse, because separating tokens makes flips rarer yet each surviving flip more damaging on the fused readout\.

Table 12:Joint\-retrain R\-GFT vs vanilla GFT\. The margin objective is counterproductive on a codebook: rarer but more potent flips\.
#### Static defense \(attack success, defended vs undefended\)\.

Against a defender\-unaware attacker, GraphAny standardization gives0\.377→0\.1070\.377\\to 0\.107at a 1\.1 point clean cost and smoothing \(σ=0\.5\\sigma\{=\}0\.5\) gives0\.377→0\.1870\.377\\to 0\.187at no cost\. On GFT’s codebook both fail: smoothing rises from0\.5010\.501to0\.8240\.824asσ\\sigmagrows, and standardization gives0\.501→0\.5300\.501\\to 0\.530\. Simple training\-free defenses from prior work recover only about ten points, and some \(low\-rank projection, embedding smoothing\) backfire\.

#### Adaptive defense \(the defenses do not hold\)\.

We re\-run the GraphAny defenses against an attacker that knows them\. Standardization is a differentiable map, so an attacker that differentiates through it recovers the full attack: static0\.1070\.107becomes0\.3910\.391under the adaptive attack, at or above the undefended0\.3770\.377\. For smoothing, an attacker that averages its gradient over the noise \(expectation over transformations, 32 samples\) recovers most of the benefit: the static0\.1870\.187atσ=0\.5\\sigma\{=\}0\.5becomes0\.3050\.305, and at lowerσ\\sigmathe adaptive attacker recovers essentially all of it\. Margin hardening on the codebook already raises attack success non\-adaptively, so no adaptive attack is needed\. None of the training\-free defenses survives an adaptive attacker\.

#### GFT codebook defenses, static and adaptive \(three seeds\)\.

On the discrete codebook the picture is worse than on the continuous carrier\. The direct defenses do not lower attack success even against a static attacker, because the noise they add flips tokens, and an adaptive attacker raises it further \(Table[13](https://arxiv.org/html/2607.18567#A7.T13)\)\. There is no static gain to recover\.

Table 13:GFT codebook defenses at budget four\. The defenses raise attack success even statically, because the added noise flips tokens, and the adaptive attacker raises it further\. Standard deviation across seeds is0\.0010\.001to0\.0030\.003\.
#### Token\-flip\-insensitive decoder \(proof of concept\)\.

We change only the decoder to down\-weight the flippable code head, keeping the encoder, the codebook, and the attack fixed \(Table[14](https://arxiv.org/html/2607.18567#A7.T14)\)\. Down\-weighting cuts the codebook\-flip attack from0\.4930\.493to0\.3170\.317at budget four for a fraction of a point of clean accuracy, and to0\.1460\.146in the proto\-only limit at about one point\. At budget one the proto\-only decoder cuts a single flip from0\.1020\.102to0\.0180\.018\. It defeats the token flip specifically\. An adaptive attacker moves onto the continuous prototype head, where the number matches the vanilla decoder, so the restriction does not make the layer robust to an unrestricted perturbation\. The soft top\-mmreadout helps only under transfer and adds an easier continuous surface that an adaptive attacker exploits\.

Table 14:Token\-flip\-insensitive decoder against the codebook\-flip attack\. Down\-weighting the code head reduces the transfer attack at small clean cost\. The adaptive column shows the attacker moving onto the prototype head\.

## Appendix HMethod, Datasets, and Reproduction

#### Threat model detail\.

*Capability*per carrier: edges and the features that enter the SVD for the spectral models; input node features for GraphAny; node text or the shared class\-description text for the text models; and the pre\-quantization embedding for the codebook, which has no realized input form\. Every perturbation is bounded, stated as a fraction of the edges or injected nodes, anℓ∞\\ell\_\{\\infty\}\(per\-entry\) orℓ0\\ell\_\{0\}\(number\-of\-entries\) bound on features, or a cosine\-similarity floor on text\. Two fidelity caveats bound the efficacy numbers without changing which layer is attacked: OFA’s trained RGCN decoder is not run, so its efficacy uses a text\-space stand\-in, and ZeroG is evaluated in its baseline pipeline with LoRA and belief propagation off\.

#### Spectral tokenizer\.

Following OpenGraph:A¯=D−1/2​A​D−1/2\\bar\{A\}=D^\{\-1/2\}AD^\{\-1/2\};U,S,V=SVD​\(A¯\)U,S,V=\\mathrm\{SVD\}\(\\bar\{A\}\), node featuresLN​\(U​S\+V​S\)\\mathrm\{LN\}\(U\\sqrt\{S\}\+V\\sqrt\{S\}\)smoothed by∑l=1LA¯l\\sum\_\{l=1\}^\{L\}\\bar\{A\}^\{l\}\. AnyGraph adds a feature SVD and a top\-1 self\-scoring mixture\-of\-experts router\. GraphAny solves closed\-form LinearGNN channels and fuses them with an entropy\-normalized attention\. The spectral attack optimizes edge flips in a continuous relaxation projected to anℓ0\\ell\_\{0\}budget\. The fixed\-basis surrogate detaches the singular basis and differentiates the smoothing operator, avoiding SVD\-backpropagation instability at near\-degenerate spectra\.

#### Codebook\.

GFT uses a cosine, 4\-head codebook \(C∈ℝ4×128×768C\\in\\mathbb\{R\}^\{4\\times 128\\times 768\}\); assignment isarg⁡maxc⁡cos⁡\(projh​\(z\),C​\[h,c\]\)\\arg\\max\_\{c\}\\cos\(\\mathrm\{proj\}\_\{h\}\(z\),C\[h,c\]\)per head\. The token\-flip attack minimizes the boundary margin toward the second\-nearest token with a straight\-through estimator\. The do\-operator pins the discrete indices to their clean values\.

#### Align\-then\-ablate\.

We identify the alignment subspace by fitting an orthogonal Procrustes map between paired representations of the same content in two domains, then taking the rankkkat which the cross\-domain CKA between the aligned representations peaks, andPPis the span of the aligned top\-kkdirections\. We ablate it by projectionI−P​P⊤I\-PP^\{\\top\}and, for the continuous carriers, also with closed\-form linear erasure \(LEACE\) and iterated nullspace projection \(INLP\)\. We report the mediated fraction1−\(Acleanabl−Aatkabl\)/\(Aclean−Aatk\)1\-\(A^\{\\rm abl\}\_\{\\rm clean\}\-A^\{\\rm abl\}\_\{\\rm atk\}\)/\(A\_\{\\rm clean\}\-A\_\{\\rm atk\}\)against a matched random\-subspace placebo, with a dose\-response over rank\. The discrete codebook do\-operator is the only intervention that localizes cleanly\. No linear erasure on a continuous carrier both preserves clean accuracy and removes the attack\.

#### Metric and hyperparameters\.

Attack success is the relative accuracy degradationASR=\(Aclean−Aatk\)/Aclean\\mathrm\{ASR\}=\(A\_\{\\rm clean\}\-A\_\{\\rm atk\}\)/A\_\{\\rm clean\}, whereAAis node\-classification accuracy, or Recall@20 for AnyGraph’s link\-prediction task\. All attacks are untargeted unless stated\. The feature and codebook attacks use projected gradient ascent,T=60T\{=\}60steps for features andT=150T\{=\}150for edges, step sizeη=ϵ/4\\eta\{=\}\\epsilon/4under anℓ∞\\ell\_\{\\infty\}budget and top\-kkprojection under anℓ0\\ell\_\{0\}or edge budget\. Budget sweeps: edge flips at5,10,20%5,10,20\\%of the real edges, featureℓ∞∈\{0\.05,0\.1,0\.2\}\\ell\_\{\\infty\}\\in\\\{0\.05,0\.1,0\.2\\\}andℓ0∈\{5,10,25,50\}\\ell\_\{0\}\\in\\\{5,10,25,50\\\}entries per node, and codebook margin budget∈\{1,2,4\}\\in\\\{1,2,4\\\}\. Each cell averages over three seeds unless a single seed is noted\. The attacks are cheap\. The feature and codebook attacks run in seconds to a couple of minutes on one CPU or GPU, and the edge attack in a few minutes at 150 gradient steps, so crafting one attacked input costs on the order of the model’s own inference pass over the dataset\.

#### Models and datasets\.

Six public GFMs \(OpenGraph, AnyGraph, GraphAny, OFA, GFT, ZeroG\), each reproduced to its published clean number before attacking and wrapped behind one interface\. Datasets span citation \(Cora, Citeseer, PubMed, ogbn\-arxiv\), web \(WikiCS\), e\-commerce \(Amazon\-Photo/Computers, ogbn\-products\), heterophily \(Cornell, Texas, Wisconsin\), and social \(reddit, instagram\)\. Attacks are evaluated on each model’s real inference pipeline\. White\-box gradients that pass through a non\-differentiable step \(e\.g\. the entropy\-normalized distance in GraphAny\) use a torch surrogate validated to∼\\sim10−610^\{\-6\}, with every number re\-evaluated on the real pipeline\. Code and configuration will be released\.

## Appendix IHeadroom Law: Held\-Out Prediction

We turn the headroom observation into a held\-out prediction\. A cell is one model on one dataset\. Headroom is reproduced clean accuracy minus chance, where chance is one over the class count for node classification and zero for AnyGraph’s Recall@20 link task\. Reachability is the largest mean\-over\-seed attack success any attack and budget reaches in the cell, and a cell is reachable when that exceeds one half\. Over twenty\-nine cells the Spearman correlation between headroom and best attack success is−0\.53\-0\.53\(95% bootstrap CI\[−0\.80,−0\.16\]\[\-0\.80,\-0\.16\]over ten thousand cell resamples,99\.7%99\.7\\%negative,p=0\.003p=0\.003\), stable under three summaries of attack success and stronger with the chance subtraction than without it\. Scoring reachability by negative headroom gives an AUC of0\.680\.68\(Figure[5](https://arxiv.org/html/2607.18567#A9.F5)\)\. For a held\-out test we leave out one whole model, fit a line on the other five, and predict the held\-out model\. Every fold returns a negative slope between−0\.36\-0\.36and−0\.76\-0\.76, so the direction of the law does not depend on any single model, and the held\-out reachable AUC is0\.680\.68\. Out\-of\-sample point prediction is weaker: the pooled rank correlation between predicted and true attack success is0\.220\.22and the mean absolute error,0\.310\.31, does not beat predicting the global mean,0\.280\.28\. Leaving out a whole domain family instead of a model does slightly better, with a pooled predicted\-versus\-true Spearman of0\.450\.45\(p=0\.014p=0\.014\) and mean absolute error0\.260\.26just under the mean baseline\. The residual variance tracks the model, not the domain, which is what we expect if the model’s alignment carrier sets the offset while headroom sets the order\. We estimate the carrier gainκ\\kappaper cell as the through\-origin initial slope of the attack’s success\-versus\-budget curve, in that model’s budget unit\. Under the same model holdout, addingκ\\kappato headroom lowers held\-out error from0\.290\.29to0\.200\.20and raises the predicted\-versus\-true rank correlation from0\.320\.32to0\.620\.62\. Becauseκ\\kappais read from the same curve whose peak is the target, we rerun withκ\\kappataken from low budgets only and the top\-budget point dropped, on the cells with at least three budgets: the two\-factor fit still wins, error0\.290\.29to0\.260\.26and rank correlation0\.490\.49to0\.650\.65\. The literal ratio does not transfer across models, sinceκ\\kappais in model\-specific units, so we presentκ\\kappaas a measured mechanistic factor, not a cross\-model formula\. The headroom law is a robust ordering rule and a suggestive, not conclusive, quantitative predictor\.

![Refer to caption](https://arxiv.org/html/2607.18567v1/x5.png)Figure 5:Reachability against clean\-accuracy headroom across twenty\-nine cells and six models\. Each point is one model on one dataset\. Headroom is clean accuracy above chance and reachability is the strongest attack in the cell\. The trend is fit on five models and the held\-out model is ringed\. Headroom orders the cells and the attack carrier sets the vertical offset\.#### The headroom law does not survive on realizable attacks\.

The pooled−0\.53\-0\.53was computed on a set that mixed realizable and representation\-space attacks, with the unrealizable node\-embedding cells at attack success one sitting at low headroom\. Restricting to the realizable input\-space attacks, GraphAny features, spectral edges, and the text\-model class\-text edits, and excluding the codebook cells and theh=0h=0link cells, the correlation vanishes and flips sign: Spearman\+0\.01\+0\.01onN=21N=21cells \(p=0\.98p=0\.98, CI\[−0\.50,\+0\.48\]\[\-0\.50,\+0\.48\]\), or\+0\.02\+0\.02with the link cells\. A permutation test on the within\-model ranks, which is adequately powered where per\-model tests on three datasets are not, is not significant \(pooled within\-model statistic−0\.23\-0\.23,p=0\.25p=0\.25one\-sided, ten thousand permutations\)\. The per\-model correlations are mixed, negative for OpenGraph and GraphAny and positive for AnyGraph and ZeroG\. Controlling for the carrier gain the partial Spearman is\+0\.15\+0\.15with a confidence interval crossing zero\. What ranks with attack success is the carrier gain\. On realizable attacksκ\\kappaand attack success correlate at\+0\.72\+0\.72across cells \(p=0\.0003p=0\.0003\) and\+0\.90\+0\.90across the six models, while headroom is flat \(\+0\.20\+0\.20\)\. We caution thatκ\\kappais read from the attack curve, so its correlation with peak success is partly a re\-description, and its units differ across carriers, so it is a comparative descriptor and not a mechanism\. The honest state is that clean accuracy headroom does not predict reachability on realizable attacks, and the carrier gain is the better descriptor\.

## Appendix JRepresentation\-Space Upper Bound on the Spectral Models

To separate the input lever from the alignment layer, we perturb the representation the decoder reads directly, at a per\-nodeL2L\_\{2\}budget swept to saturation, and report the peak over three seeds against a matched\-norm random control \(Table[15](https://arxiv.org/html/2607.18567#A10.T15)\)\. For OpenGraph we perturb the spectral tokenEEthe transformer reads, for AnyGraph the expert\-input token, for GraphAny the pre\-fusion channel logits\. The upper bound is high for all three, and the matched random control stays below0\.030\.03, so the effect is the crafted direction\. The decisive cell is OpenGraph on Cora, the dataset that resists the edge attack: a direct token perturbation collapses accuracy from0\.750\.75to0\.010\.01\. OpenGraph and AnyGraph are therefore fragile at the alignment layer, and the edge channel is a weak lever on it, which the small carrier gain records\.

Table 15:Representation\-space upper bound for the spectral models, perturbing the decoder\-input representation directly\. High for all three, so the alignment layer is fragile even where the input\-space edge attack is weak\.#### Budget commensurability and on\-manifold distance\.

The rep\-space budget is a per\-nodeℓ2\\ell\_\{2\}radius reported as a fraction of the mean representation norm\. Collapsing a model needs a fraction of0\.20\.2to1\.61\.6, so a perturbation worth2020to160160percent of the representation’s own norm, while a matched\-norm random perturbation never exceeds0\.030\.03attack success, so the direction carries it\. This is not commensurable with the input budget\. OpenGraph’s fall from0\.750\.75to0\.010\.01needs a token perturbation of0\.40\.4to0\.80\.8of the token norm, whereas an edge edit at a fifth of the edges moves the token below the0\.050\.05threshold, because the singular value decomposition and the power\-sum smoothing attenuate edge edits\. So the rep\-space number is a large\-budget upper bound on fragility, not a small\-perturbation vulnerability\. Whether the attack leaves the clean manifold depends on carrier dimension\. GraphAny’s2121\-dimensional channel\-logit carrier moves off manifold and is caught at AUC1\.01\.0exactly when it becomes effective, while the high\-dimensional spectral tokens of OpenGraph \(10241024\) and AnyGraph \(512512\) stay largely on manifold even at collapse \(best detector AUC0\.720\.72and0\.670\.67\), because the effective direction lies inside the high\-variance clean subspace\.

#### Plain\-network control\.

A perturbation of order the representation norm collapses any classifier, so we ran the control\. We trained a plain single\-domain GCN, GraphSAGE, and GAT on Cora, Citeseer, and PubMed and applied the identical directed attack to their penultimate node embedding\. All nine collapse at a fraction0\.480\.48to0\.700\.70of the representation norm, mean0\.610\.61, with a matched\-norm random control below0\.060\.06\(Table[16](https://arxiv.org/html/2607.18567#A10.T16)\)\. GraphAny \(0\.620\.62\) and AnyGraph \(0\.560\.56\) sit in this band, so their representation\-space collapse is the generic fragility of a message\-passing network\. OpenGraph collapses at0\.120\.12, about five times below the plain\-network band, the one alignment\-specific case\. The collapse threshold correlates with carrier dimension across the three spectral models \(Pearson−0\.88\-0\.88,p=0\.02p=0\.02\), but with the sign opposite to Claim 3, higher\-dimensional carriers collapsing at a lower budget, so the collapse axis does not support fragility\-from\-concentration\. This is a consistency check on six points, not a law\.

Table 16:Representation\-space collapse threshold, the fraction of the representation norm at which a directed attack drives attack success past one half\. Only OpenGraph is below the plain\-network band\.
#### No second alignment\-specific case\.

We also test the non\-spectral carriers against the tighter same\-representation control, a plain classifier trained on the very representation the decoder reads\. None is more fragile than its own baseline\. The GFT codebook decoder collapses at frac0\.550\.55against0\.600\.60for a linear probe on the same embedding, since its prediction is dominated by a continuous nearest\-prototype head\. The text decoders of ZeroG and OFA collapse at a low frac \(0\.140\.14\), but so does a plain probe on the same sentence embedding \(0\.130\.13for OFA, lower for ZeroG\), so the low threshold is a property of the sentence\-embedding representation, not the alignment decoder, and ZeroG’s cosine read\-out is in fact more robust than the probe because it normalizes to the sphere\. So OpenGraph remains the single carrier whose alignment layer is fragile beyond a matched plain classifier, and we report it as one case, not a class property\.

#### The OpenGraph case is the tokenizer, not the decoder\.

The same\-representation control is sharpest on OpenGraph itself\. We read its clean spectral token with two plain classifiers, a linear softmax probe and a two\-layer perceptron, both trained on the clean tokens of non\-test nodes and hit with the identical directed attack\. On Cora the linear probe collapses at frac0\.040\.04and the perceptron at0\.090\.09, against the transformer decoder’s0\.150\.15\. On Citeseer the three are0\.030\.03,0\.050\.05, and0\.090\.09\. On the identical token both probes collapse at or below the decoder, so the decoder is the most robust of the three readers and does not amplify the push\. The low threshold is a property of the singular value decomposition token, which sits at a large radius with a small logit margin, and any classifier on it inherits the fragility\. The matched\-norm random control is near\-inert\. Two caveats do not reverse the direction\. The probe attack is deterministic while the decoder attack must be robust to the transformer’s random anchor sampling, so part of the decoder’s higher threshold may be attack difficulty rather than robustness, and the probes are fit to the target graph while the decoder is zero\-shot\. In both the decoder is at most as fragile as its token, never more, so the reading that the trained transformer manufactures the fragility is excluded\. Data inresults/opengraph\_probe\.json\.

#### A structural, attack\-curve\-free carrier gain\.

The fittedκ\\kappais read from the attack curve and is not comparable across carriers\. A decoder\-side structural form is\. We take the local Lipschitz constantL=‖∂g/∂S‖2L=\\\|\\partial g/\\partial S\\\|\_\{2\}of each decoder, the top singular value of its Jacobian at clean test representations, by autograd power iteration\. The flip\-budget proposition then predicts a per\-node collapse thresholdm/\(L​‖S‖\)m/\(L\\,\\\|S\\\|\), a margin of logit change divided by the decoder sensitivity and the clean representation norm\. This structural prediction tracks the measured collapse threshold across the classification decoders and the plain networks \(Figure[6](https://arxiv.org/html/2607.18567#A10.F6), Spearman0\.650\.65,N=11N=11, mean absolute error0\.100\.10in the frac unit\) and reproduces OpenGraph’s0\.120\.12from clean representations alone\. OpenGraph sits at the extreme low corner, a predicted and an observed threshold both far below the plain\-network cluster on the diagonal\. Nine of the eleven cells are plain networks and OpenGraph is a leverage point, so the correlation is not significant with OpenGraph held out \(Spearman0\.530\.53,N=10N=10,p=0\.12p=0\.12\), and only two cells are graph foundation models\. We therefore reportm/\(L​‖S‖\)m/\(L\\,\\\|S\\\|\)as a rank\-ordering heuristic for where a carrier sits, not a quantitative law\. It is dimensionless, so it is invariant to the per\-carrier unit that made the fittedκ\\kappaswing under rescaling, which is why it succeeds where the input\-side Davis\-Kahan gap was degenerate\. The mechanism is representation geometry, not decoder amplification\. Although dot\-product self\-attention is not globally Lipschitz\(Kimet al\.[2021](https://arxiv.org/html/2607.18567#bib.bib109)\), the per\-node local Lipschitz constant of OpenGraph’s trained transformer is0\.810\.81, below a linear probe on the same token \(15\.515\.5\) and below the plain\-network head band \(1\.51\.5to5\.75\.7\), so the LayerNorm leaves the decoder near\-isometric per node\. OpenGraph is fragile becauseL​‖S‖L\\,\\\|S\\\|is large through a large token radius and a small margin, not because attention amplifies the push\. Link\-prediction AnyGraph is excluded from the law because its decoder outputs candidate scores, not class logits, soLLis not in comparable units\. Data inresults/lipschitz\_kappa\.json\.

![Refer to caption](https://arxiv.org/html/2607.18567v1/x6.png)Figure 6:Predicted against observed representation\-space collapse threshold\. The predicted value is the structural, attack\-curve\-free flip budgetm/\(L​‖S‖\)m/\(L\\,\\\|S\\\|\)from the decoder’s local Lipschitz constant and the clean margin and representation norm, with no attack curve\. Nine plain\-network cells and GraphAny fall near the diagonal, and OpenGraph is the extreme low point, its threshold predicted from clean representations alone\.
#### Spectral rotation edge attack\.

On the spectral tokenizerE=\(∑lA¯l\)​LN​\(U​Σ\+V​Σ\)E=\(\\sum\_\{l\}\\bar\{A\}^\{l\}\)\\,\\mathrm\{LN\}\(U\\sqrt\{\\Sigma\}\+V\\sqrt\{\\Sigma\}\), projected gradient ascent on edges is inert\. The singular basisU,VU,Vis detached from the gradient, since a differentiable full singular value decomposition backward is numerically unstable at OpenGraph’s near\-degenerate spectrum, so the gradient carries only the smoothing term and its edge attack sits at the noise floor, with a negative attack success \(−0\.01\-0\.01to−0\.02\-0\.02\) that helps the model\. We instead compute the per\-edge score⟨gE,d​E/d​Aa​b⟩\\langle g\_\{E\},\\,dE/dA\_\{ab\}\\rangleanalytically, wheregEg\_\{E\}is the decoder gradient with respect to the token \(one backward pass, no decomposition\) andd​E/d​Aa​bdE/dA\_\{ab\}includes the eigenvector\-rotation term the gradient drops\. For a symmetricA¯=Q​Λ​Q⊤\\bar\{A\}=Q\\Lambda Q^\{\\top\}, flipping edge\(a,b\)\(a,b\)givesd​qk=∑m≠k\(qm⊤​d​A¯​qk\)/\(λk−λm\)​qmdq\_\{k\}=\\sum\_\{m\\neq k\}\(q\_\{m\}^\{\\top\}d\\bar\{A\}\\,q\_\{k\}\)/\(\\lambda\_\{k\}\-\\lambda\_\{m\}\)\\,q\_\{m\}, and we clamp the near\-degenerate denominators\. This rotation term is seven times the norm of the smoothing term\. On a well\-separated synthetic spectrum the analytic gradient matches a finite\-difference derivative to relative error3×10−73\\times 10^\{\-7\}and converges ash→0h\\to 0, so the perturbation theory is correct, and the token reconstruction matches the real tokenizer to1\.4×10−71\.4\\times 10^\{\-7\}\. On OpenGraph’s realA¯\\bar\{A\}the median singular gap is near4×10−44\\times 10^\{\-4\}, the derivative is ill\-defined \(the finite\-difference error does not converge\), and the low\-rank solver returns a different basis on each draw with the decoder invariant to that rotation\. The regularized attack, evaluated on the real pipeline over three basis draws, still moves OpenGraph off the noise floor, to attack success0\.150\.15at a tenth of the edges and0\.160\.16at a fifth, against a matched random flip of0\.030\.03and0\.090\.09and the negative gradient attack\. So OpenGraph’s edge resistance is a property of the degenerate spectrum, not intrinsic robustness, and the same degeneracy caps the attack below the alignment and text carriers of the other models\. Data inresults/spectral\_rotation\_attack\.json\.

## Appendix KDefenses: Full Table and Detection

Table[17](https://arxiv.org/html/2607.18567#A11.T17)is the full defense evaluation under a static and an adaptive attacker\. None of the robustification defenses survives, on the codebook they backfire even statically, and the off\-the\-shelf GCN\-SVD baseline is unusable on the spectral carrier\.

Table 17:Attack success \(lower is better\) with and without each defense\. Cleandef\{\}\_\{\\text\{def\}\}is accuracy under the defense, against undefended clean accuracy0\.7940\.794,0\.7850\.785,0\.607/0\.6670\.607/0\.667\. Budgets differ by carrier, stated per block\. The GraphAny fusion\-dist budget is smaller than its headline feature budget\. GCN\-SVD costs nineteen points of clean accuracy on Citeseer, so the†value is a clean\-accuracy collapse, not a defense\.#### Detection\.

We fit a density test on clean representations of an evaluation split and score held\-out clean versus attacked representations, reporting AUC and the true\-positive rate at a five percent false\-positive rate \(Table[18](https://arxiv.org/html/2607.18567#A11.T18)\)\. On the low\-dimensional continuous carriers detection is near perfect and holds under an adaptive attacker that adds a stay\-on\-manifold penalty, read as a two\-sided density test since the penalty can overshoot into an anomalously typical region\. On GraphAny the adaptive two\-sided AUC stays at0\.740\.74while the evasion drives attack success from0\.370\.37to0\.010\.01, so evasion and attack are in tension\. On GFT the continuous pre\-quantization embedding holds at0\.880\.88even where the discrete codebook\-native scores are evadable\. The high\-dimensional text embedding of ZeroG is the weak case, where a low\-budget perturbation hides in a near\-isotropic space\.

Table 18:Detection of attacked inputs by a density test fit on clean representations\. Near perfect on the low\-dimensional continuous carriers and holding under an adaptive attacker, weak on the high\-dimensional text embedding\.
#### Adaptive detection pareto\.

We sweep the stay\-on\-manifold penalty weightλ\\lambdaand report at each value both the attack success and the two\-sided detection AUC \(Table[19](https://arxiv.org/html/2607.18567#A11.T19), two seeds\)\. On GraphAny the two are traded off\. Raisingλ\\lambdadrives attack success down and lets the attacker approach chance detection, but the strongest evasion that reaches AUC0\.540\.54already costs two thirds of the attack, and the full\-strength attack is fully detected\. On GFT the two\-sided test holds near AUC0\.870\.87at everyλ\\lambda, so there is no penalty that keeps the codebook attack strong and hides it\. No setting on either carrier gives a strong attack that also escapes the monitor\.

Table 19:Adaptive detection pareto\. Attack success and two\-sided detection AUC as the stay\-on\-manifold penaltyλ\\lambdasweeps\. GraphAny trades attack strength for evasion, while GFT’s two\-sided detector does not drop\.
#### A feature\-distribution attack does not beat task loss on this surface\.

A reader may ask whether a stronger attack than projected gradient ascent on task loss exists for the alignment layer\. The natural candidate is the feature\-distribution attack\(Inkawhichet al\.[2020](https://arxiv.org/html/2607.18567#bib.bib103),[2019](https://arxiv.org/html/2607.18567#bib.bib104)\), which in vision moves a representation into a target class’s feature density rather than across the decision boundary and transfers better than a task\-loss attack\. We adapt it to the alignment layer and call it Aligned\-FDA\. We fit a class\-conditional Gaussian in the shared subspace and push a node toward a wrong\-class density and away from its own, with a Mahalanobis objective in place of cross\-entropy\. A pre\-check confirms this is not a relabeling of targeted gradient ascent\. The class covariances in the subspace are anisotropic \(condition number17\.617\.6at rank2020\), the classes overlap \(linear separability0\.750\.75\), and the Mahalanobis attack direction differs from the centroid direction for most nodes\. The attack is nonetheless weaker\. In\-domain on ZeroG Cora it reaches attack success0\.230\.23,0\.560\.56, and0\.780\.78across three budgets, against0\.750\.75,0\.970\.97, and1\.001\.00for task\-loss ascent, because a class\-conditional target is a harder objective than crossing the nearest boundary\. Its cross\-domain transfer to Pubmed is no better than the task\-loss universal vector or a centroid push\. This is consistent with the result that representation\-space perturbations transfer poorly because they target model\-specific geometry rather than shared input structure\(Guptaet al\.[2025](https://arxiv.org/html/2607.18567#bib.bib106)\), and a class\-conditional direction is the most model\-specific of the three we try, while the plainer centroid direction transfers best\. Against the detector it is the sharpest form of the no\-free\-evasion property, and the two carriers tell it in two ways\. On GraphAny the Aligned\-FDA attack drives the class\-conditional detector below chance, since it makes the representation more typical of a wrong class than a clean input, but it lands in a cluster the decoder does not read as that class, so its attack success is0\.0150\.015while a task\-loss attack at the same budget reaches0\.380\.38and is fully detected\. The codebook carrier is the harder test, since GFT’s prototype head reads the representation directly\. There the attack does flip the prediction, at attack success0\.660\.66against0\.460\.46for the task\-loss attack, and it evades both the class\-conditional detector and the codebook\-specific residual and margin tests, which fall to0\.600\.60and0\.540\.54\. A global two\-sided density test on the representation still flags it, at AUC0\.850\.85across budgets\. So a class\-conditional or codebook detector alone is not enough against a feature\-distribution attack, which is why we monitor with the global two\-sided density test, and on that test no attack both fools the model and evades the monitor\. Data inresults/aligned\_fda\_\*\.json\.

## Appendix LTheory: Fragility, Headroom, and Absorption

We formalize the three empirical rules of Section 3\. Throughout, the model isg∘Φg\\circ\\Phi\. The alignment mapΦ\\Phisends an inputx=\(A,X,text\)x=\(A,X,\\text\{text\}\)to a representationr∈Sr\\in S\. For a spectral modelSSis the leading rank\-kksingular subspace of the normalized adjacencyA¯=D−1/2​A​D−1/2\\bar\{A\}=D^\{\-1/2\}AD^\{\-1/2\}, with singular valuesσ1≥σ2≥⋯\\sigma\_\{1\}\\geq\\sigma\_\{2\}\\geq\\cdotsand token featuresE=\(∑l=1LA¯l\)​LN​\(U​Σ\+V​Σ\)E=\\big\(\\sum\_\{l=1\}^\{L\}\\bar\{A\}^\{l\}\\big\)\\,\\mathrm\{LN\}\(U\\sqrt\{\\Sigma\}\+V\\sqrt\{\\Sigma\}\)\. The graph is undirected, soA¯\\bar\{A\}is symmetric and its SVD is its eigendecomposition withU=VU=V\. The decoderggreadsrrand isLL\-Lipschitz onSS\. The attacker perturbs the input byδ\\deltawithin a budgetBB, measured by‖δ‖\\\|\\delta\\\|for features and by the edit count for edges\. We writePkP\_\{k\}for the orthogonal projector onto the retained subspace andΘ​\(Pk,Pk′\)\\Theta\(P\_\{k\},P\_\{k\}^\{\\prime\}\)for the principal angles between the clean and perturbed subspaces\.

### P1: Fragility of a Low\-Dimensional Shared Bottleneck

#### Assumptions\.

- \(A1\)A¯\\bar\{A\}is symmetric with a spectral gapγk=σk−σk\+1\>0\\gamma\_\{k\}=\\sigma\_\{k\}\-\\sigma\_\{k\+1\}\>0at the boundary of the retained subspace\.
- \(A2\)The input\-to\-operator map is Lipschitz\. A perturbation of budgetBBproduces a symmetricE=A¯​\(x\+δ\)−A¯​\(x\)E=\\bar\{A\}\(x\+\\delta\)\-\\bar\{A\}\(x\)with‖E‖F≤cA​B\\\|E\\\|\_\{F\}\\leq c\_\{A\}Bfor a constantcAc\_\{A\}fixed by the normalization\.
- \(A3\)The decoder reads the boundary direction\. The runner\-up singular directionuk\+1u\_\{k\+1\}has nonzero image undergg, with directional gainμ=‖∂uk\+1g‖\>0\\mu=\\\|\\partial\_\{u\_\{k\+1\}\}g\\\|\>0\.

#### Proposition P1\.

*Under \(A1\)\-\(A3\) there is a perturbation of budgetBBwhose induced output change obeys*

‖g​\(Φ​\(x\+δ\)\)−g​\(Φ​\(x\)\)‖≥μ​c​σk​Bγk\+o​\(B\),\\big\\\|g\(\\Phi\(x\{\+\}\\delta\)\)\-g\(\\Phi\(x\)\)\\big\\\|\\;\\geq\\;\\mu\\,c\\,\\sigma\_\{k\}\\,\\frac\{B\}\{\\gamma\_\{k\}\}\\;\+\\;o\(B\),*for a constantc\>0c\>0, and every perturbation of budgetBBobeys the matching upper boundL​cA′​σ1​B/γkL\\,c\_\{A\}^\{\\prime\}\\,\\sigma\_\{1\}\\,B/\\gamma\_\{k\}\. The amplification factor is1/γk1/\\gamma\_\{k\}\.*

#### Proof sketch\.

By Davis\-Kahan \(sin\-Θ\\Theta\), for any symmetric perturbationEE,‖sin⁡Θ​\(Pk,Pk′\)‖F≤‖E‖F/γk\\\|\\sin\\Theta\(P\_\{k\},P\_\{k\}^\{\\prime\}\)\\\|\_\{F\}\\leq\\\|E\\\|\_\{F\}/\\gamma\_\{k\}, which gives the stated upper bound after composing with the Lipschitz decoder and the token mapE​\(⋅\)E\(\\cdot\), whose sensitivity to a rotation ofUUisO​\(σ1\)O\(\\sigma\_\{1\}\)\. For the lower bound take the extremal rank\-two perturbationE=t​\(uk​uk\+1⊤\+uk\+1​uk⊤\)E=t\\,\(u\_\{k\}u\_\{k\+1\}^\{\\top\}\+u\_\{k\+1\}u\_\{k\}^\{\\top\}\), which respects the budget with‖E‖F=2​t≤cA​B\\\|E\\\|\_\{F\}=\\sqrt\{2\}\\,t\\leq c\_\{A\}B\. First\-order eigenvector perturbation gives

δ​uk=∑j≠kuj⊤​E​ukσk−σj​uj=tγk​uk\+1\+O​\(t2\),\\delta u\_\{k\}=\\sum\_\{j\\neq k\}\\frac\{u\_\{j\}^\{\\top\}E\\,u\_\{k\}\}\{\\sigma\_\{k\}\-\\sigma\_\{j\}\}\\,u\_\{j\}=\\frac\{t\}\{\\gamma\_\{k\}\}\\,u\_\{k\+1\}\+O\(t^\{2\}\),so the retained subspace rotates by angleθ≈t/γk=‖E‖F/\(2​γk\)\\theta\\approx t/\\gamma\_\{k\}=\\\|E\\\|\_\{F\}/\(\\sqrt\{2\}\\,\\gamma\_\{k\}\)\. This is the classic1/\(σi−σj\)1/\(\\sigma\_\{i\}\-\\sigma\_\{j\}\)coupling\. The token blockLN​\(2​U​Σ\)\\mathrm\{LN\}\(2U\\sqrt\{\\Sigma\}\)moves byΩ​\(σk​θ\)\\Omega\(\\sigma\_\{k\}\\theta\)alonguk\+1u\_\{k\+1\}, so the displacement insideSSis at leastc′​σk​B/γkc^\{\\prime\}\\sigma\_\{k\}B/\\gamma\_\{k\}\. Multiplying by the decoder gainμ\\mufrom \(A3\) gives the claim\.□\\square

#### Honesty\.

The lower bound needs a white\-box attacker who alignsEEto the gap directions and a decoder that readsuk\+1u\_\{k\+1\}\. When the spectrum is well separated \(γk\\gamma\_\{k\}large\) the bound is weak, and when the decoder does not read the rotated direction the gainμ\\muis small\. Both escape hatches are real, and P3 formalizes the second\. This matches ablation A5, where the singular gap correlates with rotation absorbed per unit budget at−0\.69\-0\.69\.

### P2: The Clean\-Accuracy\-Headroom Law

#### Assumptions\.

- \(B1\)The decoder classifies nodeiiby the sign of a marginmi=⟨ni,ri⟩−τim\_\{i\}=\\langle n\_\{i\},r\_\{i\}\\rangle\-\\tau\_\{i\}to a local decision boundary with unit normalnin\_\{i\}inSS\. Correctly classified nodes havemi\>0m\_\{i\}\>0\.
- \(B2\)Near the clean inputΦ\\Phiis differentiable at nodeiiwith JacobianJiJ\_\{i\}, so a perturbationδ\\deltamoves the representation byΔ​ri=Ji​δ\+o​\(‖δ‖\)\\Delta r\_\{i\}=J\_\{i\}\\delta\+o\(\\\|\\delta\\\|\)\.
- \(B3\)The budget is small enough that the boundary andJiJ\_\{i\}are locally constant \(first\-order regime\)\.

#### Proposition P2 \(headroom law\)\.

*Define the carrier gainκi=‖Ji⊤​ni‖\\kappa\_\{i\}=\\\|J\_\{i\}^\{\\top\}n\_\{i\}\\\|\. Under \(B1\)\-\(B3\) the minimal budget to flip nodeiiis*

bi=miκi,R​\(B\)=Pr⁡\[mi≤κi​B\]\.b\_\{i\}=\\frac\{m\_\{i\}\}\{\\kappa\_\{i\}\},\\qquad R\(B\)=\\Pr\\\!\\big\[\\,m\_\{i\}\\leq\\kappa\_\{i\}B\\,\\big\]\.*R​\(B\)R\(B\)is nondecreasing inBB\. If two tasks share the gain law and the margins of task𝒜\\mathcal\{A\}first\-order stochastically dominate those of taskℬ\\mathcal\{B\}, that isF𝒜​\(m\)≤Fℬ​\(m\)F\_\{\\mathcal\{A\}\}\(m\)\\leq F\_\{\\mathcal\{B\}\}\(m\)for allmmwhereFFis the margin CDF, thenR𝒜​\(B\)≤Rℬ​\(B\)R\_\{\\mathcal\{A\}\}\(B\)\\leq R\_\{\\mathcal\{B\}\}\(B\)at every budget\.*

#### Proof\.

The attacker maximizes the boundary\-normal displacement under the budget,max‖δ‖≤B⁡⟨ni,Δ​ri⟩=max‖δ‖≤B⁡⟨Ji⊤​ni,δ⟩=B​‖Ji⊤​ni‖=κi​B\\max\_\{\\\|\\delta\\\|\\leq B\}\\langle n\_\{i\},\\Delta r\_\{i\}\\rangle=\\max\_\{\\\|\\delta\\\|\\leq B\}\\langle J\_\{i\}^\{\\top\}n\_\{i\},\\delta\\rangle=B\\,\\\|J\_\{i\}^\{\\top\}n\_\{i\}\\\|=\\kappa\_\{i\}B, attained atδ⋆=B​Ji⊤​ni/‖Ji⊤​ni‖\\delta^\{\\star\}=B\\,J\_\{i\}^\{\\top\}n\_\{i\}/\\\|J\_\{i\}^\{\\top\}n\_\{i\}\\\|\. The node flips when this reaches the margin,κi​B≥mi\\kappa\_\{i\}B\\geq m\_\{i\}, givingbi=mi/κib\_\{i\}=m\_\{i\}/\\kappa\_\{i\}\. Summing the flip indicator givesR​\(B\)R\(B\), which is a nondecreasing step function ofBBbecause each𝟏​\[bi≤B\]\\mathbf\{1\}\[b\_\{i\}\\leq B\]is\. When gains match,R​\(B\)=Pr⁡\[m≤κ​B\]=F​\(κ​B\)R\(B\)=\\Pr\[m\\leq\\kappa B\]=F\(\\kappa B\), and stochastic dominanceF𝒜≤FℬF\_\{\\mathcal\{A\}\}\\leq F\_\{\\mathcal\{B\}\}givesR𝒜≤RℬR\_\{\\mathcal\{A\}\}\\leq R\_\{\\mathcal\{B\}\}pointwise\.□\\square

#### Honesty\.

This proposition is a first\-order account, and the empirical result in the main text supersedes its scalar reading: on the realizable attacks the margin term, which clean accuracy summarizes, does not order reachability \(Spearman\+0\.01\+0\.01,N=21N=21\), so we do not claim the scalar headroom law\. We keep the proposition as the mechanism that motivates the carrier gain and state its limits\.

1. 1\.The clean statement is about the*margin distribution*, not scalar clean accuracy\. Clean accuracy is the observable summary1−F​\(0\+\)1\-F\(0^\{\+\}\)of that distribution\. Two tasks with equal clean accuracy but different margin spread need not be equally reachable, so the scalar version holds only when clean accuracy tracks the margin CDF, which it does on the tasks we test\. This is why the causal figure in the main paper shows the logit margin as a*weaker*single separator than the accuracy headroom\.
2. 2\.The gainκi=‖Ji⊤​ni‖\\kappa\_\{i\}=\\\|J\_\{i\}^\{\\top\}n\_\{i\}\\\|is the second factor, how directly the carrier is read\. The honest law is the two\-factorR​\(B\)=Pr⁡\[m/κ≤B\]R\(B\)=\\Pr\[m/\\kappa\\leq B\]\. Clean\-accuracy headroom orders reachability becausemmandκ\\kappaco\-vary with the task on these models, not because accuracy is causal on its own\.
3. 3\.First order only\. It ignores multi\-node coupling and, for structure attacks, the discrete edge budget, which we treat by continuous relaxation\.

### P3: Decoder Absorption

#### Assumptions\.

- \(C1\)The decoder factors asg​\(r\)=h​\(W​r\)g\(r\)=h\(Wr\)withW:S→ℝdTW:S\\to\\mathbb\{R\}^\{d\_\{T\}\}of rankdT≤kd\_\{T\}\\leq k\. Its row spaceT=row​\(W\)T=\\mathrm\{row\}\(W\)is the task\-subspace andN=ker⁡WN=\\ker Wis the null subspace\.
- \(C2\)The achievable representation displacementΔ​r\\Delta rfrom P1 has orientation relative toTTthat the attacker cannot fully control, modeled as uniform over the retained rank\-kksubspace in the gray\-box or geometry\-constrained regime\.

#### Proposition P3\.

*Under \(C1\) any component ofΔ​r\\Delta rinNNleaves the output unchanged, and*

‖g​\(r\+Δ​r\)−g​\(r\)‖≤Lh​‖W‖​‖PT​Δ​r‖,\\displaystyle\\big\\\|g\(r\{\+\}\\Delta r\)\-g\(r\)\\big\\\|\\leq L\_\{h\}\\\|W\\\|\\,\\\|P\_\{T\}\\Delta r\\\|,𝔼​‖PT​Δ​r‖=dTk​‖Δ​r‖\\displaystyle\\mathbb\{E\}\\,\\\|P\_\{T\}\\Delta r\\\|=\\sqrt\{\\tfrac\{d\_\{T\}\}\{k\}\}\\,\\\|\\Delta r\\\|*under \(C2\)\. So reachability falls as the task\-subspace fractiondT/k→0d\_\{T\}/k\\to 0\.*

#### Proof\.

Sinceg​\(r\)=h​\(W​r\)g\(r\)=h\(Wr\)andW​PN=0WP\_\{N\}=0, we haveg​\(r\+Δ​r\)−g​\(r\)=h​\(W​r\+W​PT​Δ​r\)−h​\(W​r\)g\(r\+\\Delta r\)\-g\(r\)=h\(Wr\+WP\_\{T\}\\Delta r\)\-h\(Wr\), which is bounded byLh​‖W​PT​Δ​r‖≤Lh​‖W‖​‖PT​Δ​r‖L\_\{h\}\\\|WP\_\{T\}\\Delta r\\\|\\leq L\_\{h\}\\\|W\\\|\\\|P\_\{T\}\\Delta r\\\|by the Lipschitz constant ofhh\. The null component is absorbed exactly\. Under \(C2\) the expected squared task\-projection of a displacement uniform on the rank\-kksubspace is\(dT/k\)​‖Δ​r‖2\(d\_\{T\}/k\)\\\|\\Delta r\\\|^\{2\}, and Jensen gives the stated scaledT/k\\sqrt\{d\_\{T\}/k\}\.□\\square

#### Consequence, and how it unifies P2 and P3\.

Absorption reduces the effective carrier gain toκi=‖Ji⊤​ni‖\\kappa\_\{i\}=\\\|J\_\{i\}^\{\\top\}n\_\{i\}\\\|withnin\_\{i\}read throughWW, soκi\\kappa\_\{i\}shrinks with the task\-projection ofnin\_\{i\}\. The flip budget of P2 then factors as

bi=miκi∝mi⏟headroom×1‖PT​ni‖⏟absorption\.b\_\{i\}=\\frac\{m\_\{i\}\}\{\\kappa\_\{i\}\}\\;\\propto\\;\\underbrace\{m\_\{i\}\}\_\{\\text\{headroom\}\}\\times\\underbrace\{\\frac\{1\}\{\\\|P\_\{T\}n\_\{i\}\\\|\}\}\_\{\\text\{absorption\}\}\.Resistance is a large margin times a small task\-projection\.

- •*GraphAny\.*Its channels are a closed\-form solve read by a light fusion, soWWis near identity on the channel logits,dT≈kd\_\{T\}\\approx k, and there is no null subspace to absorb the feature attack\. Both factors are small, so it is reachable\. This matches the high feature\-attack success\.
- •*OpenGraph\.*A trained transformer learns a small task\-subspace \(dT≪kd\_\{T\}\\ll k\), and on a high\-headroom task the margins are large\. Both factors are large, so it resists\. On a low\-headroom task the margin is small, so the leaked task\-projection suffices and even the trained transformer is reachable\. This is exactly the observed reversal across Cora, Citeseer, and PubMed\.

#### Honesty\.

P3 governs the gray\-box and geometry\-constrained regimes\. A white\-box attacker with gradients throughggperforms steepest ascent, and the gradientW⊤​h′W^\{\\top\}h^\{\\prime\}lies inTTby construction, which removes the attenuation\. So P3 does not claim a trained decoder is unreachable in white box\. It claims the attenuation when alignment toTTis imperfect, which is the case for the spectral carrier because the fixed\-basis surrogate cannot rotate the detached singular basis and the smoothing operator∑lA¯l\\sum\_\{l\}\\bar\{A\}^\{l\}shrinks the perturbation that reachesUU\. OpenGraph’s residual white\-box resistance is this attenuation plus the headroom factor of P2, not a claim that its task\-subspace is unreachable in principle\.