Graph Prompt Learning (GPL): Techniques & Insights

• Graph Prompt Learning (GPL) is a method that uses lightweight, learnable prompts to adapt frozen graph models for diverse downstream tasks without full fine-tuning.
• It integrates structured prompt tokens and insertion patterns to align pre-training objectives with task-specific needs, effectively reducing negative transfer.
• GPL extends across various domains—from molecular graphs to recommendation systems—demonstrating improved efficiency, flexibility, and security considerations over traditional methods.

Graph Prompt Learning (GPL) is the adaptation of prompt learning to graph-structured data: instead of fully fine-tuning a pre-trained graph model for each downstream problem, it uses a lightweight prompt that reshapes the input graph or its representations so that the downstream task can be solved in a form closer to the model’s pre-training objective (Sun et al., 2023). In graphs, prompting is not merely the addition of content-like tokens. Because node and edge features often have disparate distributions and topological structures differ significantly across graphs, prompts must also encode structure and insertion rules, making GPL more intricate than prompt learning in NLP or CV (Sun et al., 2023, Long et al., 2024). The literature now spans node-, edge-, and graph-level transfer, with surveys describing over 100 relevant works and applications including text-attributed graphs, molecules, proteins, recommendation systems, and multimodal settings (Long et al., 2024, Sun et al., 2023).

1. Conceptual basis and motivation

GPL arose from the limitations of the traditional “pre-train and fine-tune” paradigm for graphs. Fine-tuning large graph backbones is inefficient, and there is often “a natural gap between these pretexts and downstream tasks,” which can produce negative transfer, especially in few-shot settings (Zi et al., 2024). The central GPL premise is therefore data-centric rather than model-centric: keep the pre-trained GNN frozen, and learn a small prompt module that manipulates the downstream graph so the backbone can solve the new task without wholesale parameter updates (Zi et al., 2024, Sun et al., 2023).

The graph setting makes this reformulation technically distinctive. Graphs are non-linear relational objects, so prompts must respect topology, node and edge semantics, heterogeneous types, and task-level reformulation across node-, edge-, and graph-level objectives (Sun et al., 2023). The survey literature consequently treats GPL as a response to three major generalization challenges in graph learning: cross-modality, cross-domain, and cross-task transfer (Sun et al., 2023). In this view, prompting is not only a parameter-efficient alternative to fine-tuning, but also a mechanism for narrowing the mismatch between pre-training objectives and downstream objectives.

A recurrent conceptual claim in the literature is that prompting combines flexibility and expressiveness. The prompt tokens are lightweight, trainable, and flexible, while the frozen pre-trained GNN supplies expressive structural and semantic reasoning (Sun et al., 2023). This suggests that GPL is valued not only because it reduces parameter count, but because it preserves reusable graph knowledge while reintroducing task-specific adaptability.

2. Prompt representation, structure, and insertion

A standard unified description of GPL decomposes a graph prompt into three components: prompt tokens, token structures, and inserting patterns (Sun et al., 2023). Prompt tokens are the basic learnable or fixed units, typically vectors in feature space. Token structures specify how multiple tokens are organized and related. Inserting patterns define how the prompt is combined with the original graph, for example by addition to node features, concatenation with node sets, cross-links, or construction of an auxiliary prompt graph (Sun et al., 2023).

This framework underlies the benchmark distinction between prompts as graphs and prompts as tokens (Zi et al., 2024). In the prompt-as-token regime, the prompt is a lightweight continuous object injected into features or hidden representations. If the original node-feature matrix is $$\mathbf{X}=\{x_1,\cdots,x_N\}\in\mathbb{R}^{N\times d}$$, a learnable prompt vector $p\in\mathbb{R}^{1\times d}$ can be added to every node feature, yielding $\mathbf{X}^{*}=\{x_1+p,\cdots,x_N+p\}$, as in GPF and related methods (Sun et al., 2023). In GraphPrompt, prompt tokens act in the hidden space through a readout,

$$s_t=\text{Readout}(\{p_t \otimes h_v : v\in \mathcal{V}\}),$$

where $\otimes$ denotes element-wise multiplication (Sun et al., 2023). GPPT instead uses structure tokens and task tokens to recast node classification as a link-prediction-like task (Sun et al., 2023).

In the prompt-as-graph regime, the prompt is an explicit graph object attached to the input graph. All in One inserts a prompt token set $\mathcal{P}=\{p_1,\ldots,p_{|\mathcal{P}|}\}$ using learned weights

$$w_{ik}\leftarrow \sigma(p_k\cdot x_i^T) \quad \text{if } \sigma(p_k\cdot x_i^T)>\delta,\text{ else }0,$$

and then modifies node features as

$$\tilde{s}_i \leftarrow x_i+\sum_{k=1}^{|\mathcal{P}|} w_{ik}p_k.$$

This emphasizes that prompt design is not only about token content, but about the structural mechanism by which prompt information enters graph computation (Sun et al., 2023).

Family	Representative methods	Main mechanism
Prompts as tokens	GPF, GPF-plus, GraphPrompt, GPPT	Feature-level addition, hidden-space prompting, task/structure tokens
Prompts as graphs	All in One, ProG / ProG-Meta, PRODIGY	Auxiliary prompt graph with internal links and cross-links

The literature also includes more specialized prompt parameterizations. GSPF extends universal graph prompt feature learning by integrating prompt learning on both graph nodes and edges, and by applying prompting selectively rather than uniformly (Jiang et al., 2024). IA-GPL moves from fixed task-level prompts to instance-aware prompts generated from frozen GNN embeddings and regularized through vector quantization and EMA updates (Li et al., 2024). These later developments indicate that the original token/graph distinction remains useful, but is no longer sufficient to describe the full design space.

3. Task alignment, pre-training alignment, and empirical regularities

A major organizing principle in GPL is task alignment. Surveys classify graph pre-training strategies by objective level—node-level, edge-level, graph-level, and multi-task pre-training—and then map prompting methods onto the pre-training task they are designed to align with (Sun et al., 2023). The same literature also classifies prompting methods by downstream objective—node-level, edge-level, and graph-level tasks—because many prompts work by reformulating downstream problems into the type of prediction already “understood” by the frozen model (Sun et al., 2023).

The first large benchmark, ProG, operationalizes this idea by integrating six pre-training methods and five state-of-the-art graph prompt techniques across fifteen datasets, evaluating performance, flexibility, and efficiency (Zi et al., 2024). The benchmark includes node-level pre-training methods such as DGI and GraphMAE, edge-level pre-training methods such as EdgePreGPPT and EdgePreGprompt, and graph-level pre-training methods such as GCL and SimGRACE (Zi et al., 2024). Its prompt methods cover All-in-one, GPPT, Gprompt, GPF, and GPF-plus (Zi et al., 2024).

Several empirical regularities emerge from this evaluation. First, graph prompts are usually better than both supervised baselines and classical pre-train/fine-tune (Zi et al., 2024). In the reported 1-shot node classification table, GPF-plus wins on 4 of 7 datasets, whereas on graph classification All-in-one wins on 7 of 8 datasets (Zi et al., 2024). Second, prompting substantially reduces negative transfer: for node-level tasks, GPF-plus reduces the negative transfer rate from 43% to 0%, and for graph-level tasks, All-in-one reduces it from 38% to 0% (Zi et al., 2024). Third, performance depends on compatibility between pre-training type and downstream task granularity: node-level pre-training transfers better to node-level tasks, and graph-level pre-training transfers better to graph-level tasks (Zi et al., 2024).

The benchmark also introduces a flexibility analysis through an error bound measuring how well prompts emulate graph manipulations such as dropping nodes, dropping edges, and masking features. All prompt methods reduce the original error, while All-in-one and Gprompt are reported as especially flexible; All-in-one achieves a 95.06% reduction in original error (Zi et al., 2024). Efficiency analysis further shows why prompting is attractive: the benchmark notes that All-in-One has learnable parameter complexity $O(Kd)$, whereas the backbone remains frozen (Zi et al., 2024).

4. Extensions across graph settings and application domains

GPL has diversified beyond the early universal and task-aligned formulations. One branch focuses on richer prompt granularity. IA-GPL argues that fixed task-specific prompts do not generalize well across heterogeneous instances, and instead generates instance-specific prompts using a PHM-based bottleneck, vector-quantized codebooks, and EMA updates (Li et al., 2024). In the reported efficiency analysis, IA-GPL uses about 20K tuning parameters, versus 1.86M for fine-tuning, while improving both in-domain and especially out-of-domain generalization (Li et al., 2024). GSPF similarly argues that effective prompting should not treat all nodes equally or ignore edges. It introduces selective node prompt coefficients $r_i$ and selective edge prompting, and reports an average ROC-AUC of 75.41%, corresponding to relative improvements of +4.23% over FT, +3.51% over GPF, and +3.66% over GPF-plus on molecular benchmarks (Jiang et al., 2024).

A second branch extends GPL to heterogeneous, federated, and dynamic settings. HGMP reformulates node-, edge-, and graph-level downstream tasks into a unified graph-level format for heterogeneous graphs, combines graph-level contrastive pre-training with type-specific feature prompts, and reports strong few-shot performance on ACM and IMDB across all three task types (Jiao et al., 10 Jul 2025). FedGPL adapts prompt learning to federated graph learning under simultaneous task heterogeneity and data heterogeneity by separating a server-side GNN from client-side prompts and task heads, and by introducing HiDTA and VPG for directed cross-task transfer and structural prompting; its reported gains range from roughly 2.37% to 16.07%, with GPU memory efficiency of about 5.3× to 6.0× (Guo et al., 2024). GraphPro redefines prompting for dynamic recommendation through a temporal prompt mechanism in message passing and a graph-structural prompt mechanism built from future interaction edges; its appendix reports about 60× faster on Taobao, 24× faster on Koubei, and 81× faster on Amazon than a full-data alternative (Yang et al., 2023).

A third branch links GPL to multimodal and domain-specific systems. MMGPL introduces concept-guided graph prompt learning for neurological disorder diagnosis: GPT-4 generates disease-related concepts, tokens are reweighted by concept similarity, a token graph is constructed, and a GCN extracts structural information before a frozen multimodal encoder performs classification (Peng et al., 2023). On ADNI-3CLS, ADNI-4CLS, and ABIDE, the reported results are ACC/AUC/F1 of 0.8230/0.8514/0.7467, 0.5159/0.6422/0.4779, and 0.7239/0.7540/0.6723, respectively (Peng et al., 2023). More generally, the survey literature identifies text-attributed graphs, molecules, proteins, recommendation systems, social networks, knowledge graphs, and biology as major application areas (Long et al., 2024, Sun et al., 2023).

5. Security, privacy, and trustworthiness

A substantial recent literature argues that GPL is not security-neutral. CrossBA is described as the first cross-context backdoor attack against GPL, manipulating only the pre-training phase and requiring no knowledge of downstream datasets, tasks, or which GPL method will be used (Lyu et al., 2024). Across 3 representative GPL methods, 5 cross-context scenarios, and 5 benchmark datasets, CrossBA generally achieves ASR above 0.85 and often above 0.90, while keeping clean accuracy close to the backdoor-free model, typically with less than about a 0.06 drop (Lyu et al., 2024). The same work concludes that current defenses are insufficient to mitigate this attack (Lyu et al., 2024).

A distinct attack surface appears when the prompt itself is the backdoor carrier. TGPA is a backdoor attack framework designed specifically for GPL with frozen encoders: it injects backdoors into graph prompts without modifying the pre-trained GNN encoder, and adds a finetuning-resistant poisoning objective so the attack survives downstream clean fine-tuning (Lin et al., 2024). On GraphPrompt, the reported ASR/clean accuracy figures are 91.3%/73.2% on Cora, 94.2%/62.7% on Citeseer, and 88.3%/70.4% on Pubmed (Lin et al., 2024). A central implication is that a frozen encoder is not automatically trustworthy if prompts or task heads are obtained from untrusted sources.

Privacy studies identify a parallel set of risks. GraphTheft evaluates attribute inference attacks and link inference attacks under black-box posteriors, node-embedding access, and prompt access, reporting inference success rates as high as 98%, and in some tables even higher (Zhu et al., 2024). At the same time, that study concludes that prompt tuning itself does not significantly increase privacy risk compared with traditional GNNs, suggesting that much of the leakage originates in graph representation learning more generally (Zhu et al., 2024). DP-GPL strengthens this line by showing that graph prompts can leak membership information at high rates and that DP-SGD is not a practical fix in few-shot prompting. In a 5-shot Cora setting, accuracy drops from 48.70% to 18.47% under DP-SGD even with $p\in\mathbb{R}^{1\times d}$0, whereas the proposed PATE-based DP-GPL maintains high utility at strong privacy, with $p\in\mathbb{R}^{1\times d}$1 and MIA curves moving close to random guessing (Xu et al., 13 Mar 2025).

Taken together, these studies establish a consensus point: parameter efficiency and frozen backbones do not eliminate risks. They relocate them into pre-training pipelines, prompt parameters, released embeddings, and prompt-sharing workflows.

6. Theoretical disputes, terminology, and open problems

Theoretical understanding of GPL remains unsettled. One major debate concerns what counts as a genuinely universal graph prompt. LEAP argues that universal graph prompting is only truly universal if every node receives a prompt, and proves an “if and only if” statement that prompts must be added to all nodes to simulate arbitrary graph transformations (Xu et al., 9 Dec 2025). Its proposed paradigm preserves an all-node universal prompt and then edits it with actor-critic reinforcement learning, rather than starting from selective node prompting (Xu et al., 9 Dec 2025). By contrast, UniPrompt argues that representation-level prompts are functionally and optimization-wise equivalent to a simple downstream linear classifier, and therefore that GPL should focus on input-level prompts that preserve graph structure while allowing the classifier to handle downstream adaptation (Huang et al., 26 Sep 2025). GP2F offers a third perspective for cross-domain transfer: it shows that a fused estimator combining a frozen branch and an adapted branch has smaller mean-squared error than either branch alone, and operationalizes this via adaptive fusion under contrastive and topology-consistent losses (He et al., 12 Feb 2026).

The field also has a terminological ambiguity. The acronym “GPL” is sometimes used for Graph structure Prompt Learning, a training-time method that adds task-independent graph structure losses rather than adapting a frozen pre-trained model with prompts (Huang et al., 2024). That method reports improvements up to 10.28% for node classification, 16.5% for graph classification, and 24.15% for edge prediction (Huang et al., 2024). This suggests that “GPL” now labels at least two partially overlapping research programs: one centered on prompt-based downstream adaptation of frozen graph models, and another centered on prompt-like structural supervision during GNN training.

The surveys and benchmarks identify several open problems. Graph models are often much smaller and less capable than LLMs, which may limit the strength of prompt effects (Sun et al., 2023). Evaluation and interpretability remain difficult because graph prompts are usually latent vectors or augmented graphs rather than human-readable instructions (Sun et al., 2023). Much of the current literature is benchmark-oriented and concentrated on node or graph classification, whereas transferable prompt design across tasks, domains, and modalities remains unresolved (Sun et al., 2023, Long et al., 2024). A plausible implication is that the next phase of GPL research will depend less on inventing isolated prompt modules and more on clarifying mechanism, standardizing evaluation, and integrating privacy, robustness, and cross-domain theory into the core design of graph-adaptive systems.