The review, led by Ruizhan Xue and Fang He of Huazhong Agricultural University’s National Key Laboratory of Crop Genetic Improvement, together with colleagues including senior author Zeyu Zhang, tackles the question of trustworthiness in hybrid LLM–GNN systems. Its central contribution is a multi-axis taxonomy that deliberately separates two things previous surveys tended to conflate: the trust dimension a method targets, and the operational role the language model plays inside the pipeline. The authors identify five trust dimensions — reliability, robustness, privacy, fairness, and reasoning with explainability — and five operational roles: encoder, predictor, aligner, editor, and verifier or evaluator. This two-axis design matters because a single method can pursue one primary trust objective while producing secondary effects, both helpful and harmful, across the others.

Consider what each role entails. When an LLM acts as an encoder, it converts textual attributes of nodes and edges into embeddings that a graph network can consume, as in systems that harness explanations to enrich text-attributed graph representations. As a predictor, the language model itself performs graph reasoning tasks, sometimes after graph-centric instruction tuning and preference alignment, as demonstrated by the InstructGraph line of work. As an aligner, it bridges the gap between the discrete, symbolic world of graphs and the continuous vector spaces neural networks prefer. As an editor, it can propose modifications to graph structure itself — the GraphEdit framework, for instance, uses large language models for graph structure learning. And as a verifier or evaluator, it checks, explains, or benchmarks the outputs of graph models, including through Bayesian-inference-based explanation generation.

Each of these roles carries distinct risks, and the review is at its most incisive when cataloguing them. An LLM asked to edit a graph might make unsupported changes — hallucinated edges or deleted nodes that have no grounding in the underlying data, a direct extension of the hallucination problem documented extensively in natural-language generation. Prompt injection attacks can hijack a language model that sits in the middle of a graph pipeline, turning a helpful component into an attack surface. Privacy exposure arises because language models trained on web-scale corpora may memorize and leak sensitive attributes, and because graph data itself is notoriously hard to anonymize: neighborhood structure alone can re-identify individuals. Inherited social bias rounds out the list, since language models absorb the prejudices of their training text and can transmit them into graph embeddings that then drive downstream decisions about credit, hiring, or medical triage.

The taxonomy’s real analytical power lies in connecting these new hybrid systems back to the classical trustworthy-GNN literature. The authors anchor their discussion in prior comprehensive surveys of trustworthy graph neural networks covering privacy, robustness, fairness, and explainability, and then trace how each classical safeguard translates — or fails to translate — when a language model enters the loop. Adversarial training methods that regularize based on graph structure, for example, were designed for pure GNNs; whether they still protect a system whose node features come from a billion-parameter language model is an open empirical question. The review also highlights work asking directly whether large language models can improve the adversarial robustness of graph neural networks, and deep-dive analyses of model robustness when learning on graphs with LLMs, suggesting the answer is nuanced: language information can sometimes buffer against perturbations, but it can also introduce entirely new vulnerabilities.

Privacy receives particularly detailed treatment, because the technical arsenal here is unusually mature. The review surveys federated graph neural network frameworks that keep personalization data local, differentially private GNNs such as GAP with aggregation perturbation and DPAR with node-level differential privacy, distributed private aggregation schemes, homomorphically encrypted inference as in CryptoGCN, and oblivious inference protocols like OblivGNN that hide both inputs and computation patterns. Confidential computing within AI accelerators extends the envelope to hardware. Yet the review’s framing makes clear that these defenses were built for graph models, not for hybrid systems where a language model may see raw text descriptions of nodes — a channel that differential privacy on gradients alone does not obviously cover. Machine unlearning, the ability to efficiently forget learned information via projection, adds another layer to the lifecycle picture.

Fairness and explainability form the remaining trust axes, and here the review documents both promise and peril. On the promise side, recent work on disentangled graph-enhanced large language models aims explicitly at fair learning, and classical approaches for learning fair graph neural networks with limited sensitive attribute information provide baselines. On the explainability side, tools like GNNExplainer established how to generate explanations for graph neural networks, and verbalized graph representation learning now proposes fully interpretable graph models built on language models throughout the entire pipeline. But the review also flags the danger that an LLM’s fluent explanation may be persuasive without being faithful — a model can produce a plausible narrative about why it classified a node one way while the actual computation followed a different path entirely.

Evaluation is where the review identifies some of its sharpest gaps. The authors compare methods across threats, safeguards, evaluation settings, and reported evidence, and they are candid that many results cannot be compared directly: different papers use different threat models, different datasets, different perturbation budgets, and different fairness metrics, making the literature a patchwork rather than a coherent evidence base. Emerging benchmarks such as GraphArena, which evaluates large language models on graph computation, and the professional-level graph analysis benchmark with datasets and models presented at NeurIPS, begin to standardize the picture, as do graph-reasoning-enhanced language models like GREASELM for question answering. The review also connects the trust discussion to adjacent graph-learning frontiers — heterophilic graphs, where connected nodes tend to differ, hypergraph learning with higher-order relations, and few-shot node classification on incomplete graphs — because trust requirements shift in each of these regimes.

What emerges from the synthesis is a lifecycle view of trustworthiness. The authors argue that safeguards cannot be bolted on at a single stage; they must span data curation, encoding, message passing, prediction, and post-hoc auditing, with the LLM’s role at each stage determining which threats dominate. Where language information genuinely helps graph learning — injecting world knowledge, handling long-tail entities, enabling zero-shot reasoning — the review documents the evidence. Where it creates additional risk — hallucinated edits, injected prompts, leaked attributes, inherited bias — it names the failure channel and the safeguards currently available. And where evidence is thin, it says so, identifying results that cannot yet be compared and questions that remain open.

For practitioners deploying these systems in high-stakes domains — the review’s own institutional roots in agricultural genomics are a reminder that graph learning reaches well beyond web applications — the message is both cautionary and constructive. The integration of large language models with graph neural networks is not a passing fashion; it is becoming the default architecture for any task where relational structure meets rich text. The new taxonomy gives researchers a shared vocabulary for stating exactly which trust property a method improves, which role the language model plays, and which secondary effects must be measured. That discipline, the authors suggest, is what will separate systems that merely sound trustworthy from systems that actually deserve to be.

Subject of Research: Trustworthiness of integrated large language model and graph neural network systems

Article Title: Trustworthy LLM–GNN systems: a systematic review and multi-axis taxonomy

Article References: Xue, R., He, F., Deng, H., Wang, M., & Zhang, Z. (2026). Trustworthy LLM–GNN systems: a systematic review and multi-axis taxonomy. Applied Intelligence, 56(14), Article 407. https://doi.org/10.1007/s10489-026-07458-w

Image Credits: AI Generated

DOI: 10.1007/s10489-026-07458-w

Keywords: large language models, graph neural networks, trustworthy AI, reliability, robustness, privacy, fairness, explainability, prompt injection, hallucination, federated learning, graph reasoning