  End-to-end training with global optimization have popularized graph neural
networks (GNNs) for node classification, yet inadvertently introduced
vulnerabilities to adversarial edge-perturbing attacks. Adversaries can exploit
the inherent opened interfaces of GNNs' input and output, perturbing critical
edges and thus manipulating the classification results. Current defenses, due
to their persistent utilization of global-optimization-based end-to-end
training schemes, inherently encapsulate the vulnerabilities of GNNs. This is
specifically evidenced in their inability to defend against targeted secondary
attacks. In this paper, we propose the Graph Agent Network (GAgN) to address
the aforementioned vulnerabilities of GNNs. GAgN is a graph-structured agent
network in which each node is designed as an 1-hop-view agent. Through the
decentralized interactions between agents, they can learn to infer global
perceptions to perform tasks including inferring embeddings, degrees and
neighbor relationships for given nodes. This empowers nodes to filtering
adversarial edges while carrying out classification tasks. Furthermore, agents'
limited view prevents malicious messages from propagating globally in GAgN,
thereby resisting global-optimization-based secondary attacks. We prove that
single-hidden-layer multilayer perceptrons (MLPs) are theoretically sufficient
to achieve these functionalities. Experimental results show that GAgN
effectively implements all its intended capabilities and, compared to
state-of-the-art defenses, achieves optimal classification accuracy on the
perturbed datasets.
