The Explainability–Robustness Collision in Graph Neural Network Intrusion Detection: A Critical Survey

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

Graph neural network-based intrusion detection systems (GNN-IDS) take advantage of the relational structure between network hosts, communication patterns and temporal interactions to detect complex cyberattack patterns. Their trustworthiness for operation is limited due to the lack of explanation stability and adversarial vulnerabilities, despite the promise of detection performance, especially when the outputs of the model are used to make critical cybersecurity decisions. This critical survey discusses how the structural intersection between explainable artificial intelligence (XAI) and adversarial robustness would be beneficial for GNN-IDS and the security implications of revealing model reasoning. Current literature is reviewed in three explanation families: perturbation-based; gradient- and attention-based; and surrogate/feature-attribution methods. The analysis suggests three possible ways of colliding the explanations that are related: fragility (an undesirable change of behavior being introduced because of prediction-preserving perturbations of the explanations); forgery (an undesirable change of behavior being introduced because of explanations being manipulated); leakage (attribution information that is accessible in the explanation being used for targeted adversarial attack). A method-to-attack-surface mapping takes a method-based approach to determining where vulnerabilities exist, identifies those vulnerabilities that have been demonstrated, and considers the impact of vulnerabilities on alert prioritization, threat investigation and incident response. An operational measure of explanation displacement is the top-k attribution overlap, which measures how many explanations are close to both the target and the adversarial explanation. Explanation displacement is measured in terms of top-k attribution overlap, that is, the number of explanations that are near the target explanation and the adversarial explanation. A proposed stability-gap measure compares random and adversarial perturbations. The results suggest that the robustness of a prediction cannot guarantee reliability of the explanation or trustworthy decision support. While the proposed protocol is yet to be experimented and validated, it offers a framework to assess the reliability of the GNN-IDS and priorities areas for secure, transparent, and operationally defendable AI-supported cybersecurity decision-making.