{"id":"93ffa77a-f9e8-4cb3-8f01-794ad8058bd2","arxiv_id":"2412.05883","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Graph sparsification mitigates some GNN poisoning attacks, while graph coarsening tends to amplify them, though the study lacks a clean-reduction baseline to fully support this.","lead":"This paper tests how graph reduction methods, which shrink graphs for efficiency, affect how easily graph neural networks can be attacked. It finds sparsifying graphs often weakens poisoning attacks while coarsening can make attacks worse, but a missing baseline weakens the conclusions.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"No clean+reduction baseline is reported, so the claimed adversarial amplification by coarsening cannot be separated from reduction's own accuracy cost.","rationale":"The reader's weakest_assumption identifies exactly the missing clean+reduction baseline, and I agree that this is the load-bearing gap. The paper is an empirical benchmark with released code and a broad set of experiments, which are real assets. However, the central claims are quantitative comparisons that require a control condition separating the reduction's own approximation error from adversarial amplification. The paper provides a mechanism analysis that is suggestive but not sufficient as a substitute for the missing baseline. The concrete test proposed would settle whether the observed ACCr declines are indeed attack-driven. Since the reader already issued a CONDITIONAL verdict, my analysis does not change that verdict; it strengthens the conditionality by specifying the precise experiment needed. I find no other concern as load-bearing as this baseline omission, and I do not believe the paper should be rejected outright because the raw data and code could support the claims once the control is added.","tokens_in":30598,"tokens_out":3424,"duration_ms":33577,"concrete_test":"For each dataset, each of the 10 reduction methods, and reduction ratios r in {0.1, 0.2, 0.325, 0.5, 0.7, 1.0}, run the identical GCN training/evaluation pipeline on the clean graph reduced without any attack, producing ACC_clean_reduced(r). Then compute the amplification metric A(r) = ACC_clean_reduced(r) - ACC_poisoned_reduced(r) and compare it with the baseline attack impact A_orig = ACCc - ACCp. If A(r) increases substantially as r decreases beyond what reduction's own error and A_orig predict, the coarsening-amplifies claim is confirmed; otherwise the observed ACCr drop is attributable to reduction itself. Report these values in a table mirroring Table III.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that graph coarsening amplifies adversarial impact is supported only by comparing ACCr (accuracy on the reduced poisoned graph) against ACCc (clean original accuracy) and ACCp (poisoned original accuracy) in Section IV-C, Table III, and Figures 1-2. The paper never reports accuracy on a reduced clean graph, i.e., the same coarsening/sparsification applied without any attack. Without this control, a drop in ACCr as the reduction ratio r decreases could be caused by the reduction method itself, not by an adversarial amplifier. The paper's own causal analysis (merge ratios, feature distance, label difference) suggests a plausible mechanism, but it does not quantify the magnitude of amplification relative to reduction's inherent approximation error. Moreover, the claim that sparsification mitigates Mettack is not universal: on Pubmed, SCAN gives ACCr = 64.19%, substantially below ACCp = 78.07% (Table III). The most load-bearing weakness is thus the missing clean+reduction baseline, which makes the headline quantitative claims underdetermined.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper presents an extensive empirical study of how graph reduction techniques (four sparsification and six coarsening methods) affect the robustness of GNNs against global poisoning attacks (DICE, NEA, PGD, Mettack, PRBCD, STRG-Heuristic, GraD) and, secondarily, two evasion attacks (InfMax, AGIA). It compares clean accuracy (ACCc), poisoned accuracy (ACCp), and post-reduction accuracy (ACCr) across three datasets (Cora, Pubmed, CS), three standard GNN architectures, three defensive GNNs, and reduction ratios down to 0.1. The paper reports that sparsification removes many added poisoned edges and mitigates Mettack while leaving PGD largely unaffected; coarsening instead amplifies attack impact, especially at low reduction ratios; and defensive GNNs degrade under coarsening but retain effectiveness under sparsification. It also proposes a causal explanation based on merge ratios, feature distances, and label differences in supernodes.","tokens_in":30786,"tokens_out":4926,"duration_ms":48501,"significance":"If the reported claims are validated, this is a practically useful empirical contribution: it is the first systematic study (to the authors' knowledge) of the interaction between graph reduction and general adversarial attacks, and it offers concrete guidance for practitioners choosing reduction methods in security-sensitive GNN deployments. The paper covers a wide space of attacks, reduction algorithms, models, and ratios, and it provides public code, which substantially increases its utility. The main weakness is that the central quantitative claims are not supported by the reported comparisons: no accuracy on a reduced clean graph is reported, so the observed drops in ACCr cannot be separated from the reduction methods' own approximation error. This missing baseline underdetermines both headline claims and needs to be addressed before the conclusions can be accepted.","major_comments":[{"comment":"The central claim that coarsening amplifies adversarial impact and that sparsification mitigates Mettack is supported by comparing ACCr against ACCc and ACCp only; no accuracy on a reduced clean graph is reported. Without this clean+reduction baseline, the drop in ACCr at low reduction ratios could be caused by the reduction method's own degradation of clean accuracy, not by attack amplification. Please add, for every reduction method and ratio, the accuracy achieved by training and testing on the same reduction applied to the clean graph, and use that as the baseline when quantifying amplification (e.g., report (ACCr - ACC_red-clean) alongside (ACCp - ACCc)).","section":"Section IV-C, Tables III and VI, Figures 1-2"},{"comment":"The claim that sparsification mitigates Mettack is not universal: with the SCAN method, ACCr drops to 64.19% from ACCp = 78.07%, whereas RNE and LD raise accuracy to roughly 86%. The paper's text states that 'for all sparsification methods, the accuracy dramatically increased as the reduction ratio decreased,' but this is contradicted by the SCAN result on Pubmed. Please qualify the mitigation claim and, ideally, discuss why SCAN behaves differently, or provide the clean+reduction baseline that would contextualize this outlier.","section":"Table III, Pubmed Mettack row"},{"comment":"The text states that 'ACCr ≈ ACCp across every reduction method' and that graph reduction does not affect vulnerability to evasion attacks, but Table VII shows coarsening consistently increases accuracy relative to ACCp (e.g., Cora AGIA: 70.99% to 74.71-76.18%; Pubmed InfMax: 62.30% to 66.44-68.17%). This is an internal inconsistency between the reported data and the interpretation. Please correct the text or analyze why coarsening appears to improve evasion robustness, or both.","section":"Section IV-F and Table VII"},{"comment":"The paper cites its own preprint as 'Our extended version [29]' to provide full feature-distance distributions, but reference [29] is the same arXiv ID (2412.05883) as the current manuscript. Citing the paper itself as the source for supporting data is circular and should be replaced with the appendix results or a clearly distinct companion document.","section":"Section IV-D2, reference [29]"}],"minor_comments":[{"comment":"The captions state 'p = 0.05%', but Section IV-B sets the perturbation ratio to 5% and all tables use 5%. Please correct this typo.","section":"Section IV-A, Table III and VI captions"},{"comment":"The definition of ACCr states that it 'uses the reduced poisoned graph,' but the paper does not specify how the test set is constructed when coarsening merges nodes into supernodes (e.g., how original test nodes are mapped to supernodes, and how labels are handled when a supernode contains conflicting labels). Please clarify this protocol, as it is essential for reproducibility.","section":"Section IV-A, Evaluation Metrics"},{"comment":"The caption contains a duplicated sentence: 'As illustrated in Figure 6...' is immediately followed by 'As illustrated in the Figure...'. Please remove the duplicate.","section":"Figure 6 caption"},{"comment":"The paper reports averages over five random seeds but provides no standard deviations or confidence intervals. Some of the reported differences (e.g., 1-2 percentage points) may be within run-to-run noise; reporting variance would strengthen the quantitative comparisons, especially for the 'limited impact' claims.","section":"Section IV-B"}],"recommendation":"major_revision","confidential_remarks":"The missing clean+reduction baseline is the key technical issue and will require rerunning the experiments; this is not a trivial presentation fix. The self-citation of the same preprint as [29] is another concern that the editor may wish the authors to address explicitly. The breadth and code release are genuine strengths, so the paper is worth a revision rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The thing to know about this paper: it runs a genuinely broad benchmark—7 attacks, 10 reduction methods, 3 GNNs plus 3 defensive models, 3 datasets—and the resulting tables are new. No one had systematically measured how general poisoning attacks (not just backdoors) interact with coarsening and sparsification. The perturbation-edge analysis is the best part: showing that sparsification removes most added edges, and separating the poisoning from the evasion component of each attack, is a real insight. The code is public and the paper is honest about its own prior backdoor work.\n\nThe soft spot is exactly what the stress-test note says: there is no clean+reduction baseline anywhere. ACCr is always measured on a reduced poisoned graph and compared to ACCc (clean original) and ACCp (poisoned original). But coarsening and sparsification have their own approximation cost. Without ACCr on a clean reduced graph, you cannot separate \"coarsening amplifies the attack\" from \"coarsening alone drops accuracy, and the attack is a fixed additive penalty.\" This is load-bearing for the main claim, and it is a fixable omission rather than a fatal one.\n\nThe other issue is that the claims are broader than the data. On Pubmed, SCAN sparsification gives Mettack ACCr = 64.19%, well below ACCp = 78.07%—so sparsification does not uniformly mitigate Mettack. On CS, coarsening actually raises Mettack accuracy above ACCp (83–85% vs 82.25%), contradicting \"coarsening amplifies adversarial impact.\" Those counterexamples should temper the abstract and conclusion. The paper does single out Local Degree as the strong candidate, which is fair, but the blanket language about coarsening is too strong.\n\nMinor points: the paper self-cites its own preprint [29] and leans on [37], but the measurements are new and the circularity concern is not serious. The symbol for perturbation ratio is inconsistently written (p = 0.05% vs 5%), which is cosmetic.\n\nWho is this for? Researchers deploying GNN acceleration in security-sensitive settings, and anyone building robustness benchmarks. It deserves a serious referee—the question is important and the data are new—but the revision must add the clean-reduction baseline, re-state the findings with the counterexamples acknowledged, and decide whether the coarsening-amplification claim survives. I would recommend sending it to peer review, with the expectation of heavy revision.","headline":"A broad, useful empirical sweep of poisoning attacks under graph reduction, but the headline amplification claim lacks a clean-reduction control and the data contain counterexamples that the conclusions paper over.","tokens_in":31289,"tokens_out":3145,"would_cite":true,"duration_ms":30602,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Graph coarsening can amplify adversarial attacks on GNNs, while sparsification can neutralize some of them.","keywords":["graph neural networks","adversarial robustness","graph coarsening","graph sparsification","poisoning attacks","Mettack","PGD","graph reduction"],"falsifier":"Run the same coarsening methods on a clean, unpoisoned graph at the same reduction ratios and measure accuracy against the original clean baseline; if the clean reduced accuracy drops by an amount comparable to the reported post-attack reduction, the claim that coarsening amplifies adversarial impact is not supported.","tokens_in":30399,"feed_emoji":"🛡️","tokens_out":1838,"duration_ms":19418,"temperature":0.7,"pith_summary":"This paper empirically studies how two graph reduction techniques, coarsening and sparsification, change the vulnerability of Graph Neural Networks to adversarial poisoning attacks. It aims to show that the two reduction families have opposite effects: sparsification removes many poisoned edges during training and can largely neutralize attacks like Mettack, while coarsening merges poisoned edges into supernodes and amplifies the attack, lowering accuracy as the reduction ratio decreases. The paper also examines how existing defensive GNNs behave under reduction, finding that sparsification preserves their strength but coarsening undermines it. A sympathetic reader would care because graph reduction is a practical route to scaling GNNs, and this work maps when that route introduces hidden security costs.","feed_headline":"Sparsifying blocks some poison attacks; coarsening worsens them","feed_subtitle":"New experiments map how graph reduction changes GNN vulnerability, with a warning for coarsening-based acceleration.","key_machinery":"The central objects are graph coarsening, which partitions nodes into clusters and contracts each cluster into a supernode whose features are the weighted average of member features and whose label is the dominant label, and graph sparsification, which removes edges while keeping nodes and features unchanged. The argument is carried by analyzing what happens to poisoned edges under each reduction: sparsification removes a large fraction of added poisoned edges, while coarsening merges a smaller fraction into supernodes, where the inherited perturbation persists through noisy supernode features and label mismatches.","core_discovery":"The paper claims that graph coarsening tends to amplify the impact of general poisoning attacks, significantly reducing classification accuracy as the reduction ratio decreases, whereas graph sparsification can mitigate the effectiveness of certain poisoning attacks such as Mettack but has limited impact on others such as PGD. The mechanism offered for coarsening is that it merges dissimilar nodes connected by poisoned edges into supernodes, creating noisy representations with high feature variance and incorrect labels, while unmerged poisoned edges persist; the mechanism offered for sparsification is that it removes most newly added poisoned edges during training, although attacks that also work as evasion attacks can still degrade inference-time accuracy. The paper further claims that defensive GNNs retain or improve their defense capability when combined with sparsification, but coarsening transfers edge perturbations into supernode structures and renders these defenses less effective.","pith_inferences":["A missing clean-plus-reduction baseline means some of the reported accuracy drop under coarsening could be attributable to the reduction method itself rather than to amplified adversarial impact; this can be checked by running coarsening on a clean graph and measuring accuracy against the same clean baseline.","The attack-dependence of sparsification suggests a practical selection rule: choose sparsification when the threat model is dominated by training-time poisoning (e.g., Mettack-style attacks), but not when evasion-style perturbations such as PGD are expected.","The supernode label-difference analysis implies that coarsening may be especially harmful on heterophilic or class-imbalanced graphs, where supernode labels are more likely to flip; this is a testable extension the paper does not run.","A hybrid reduction that sparsifies first to remove poisoned edges and then coarsens for compression might preserve robustness better than coarsening alone, which is a direct testable corollary of the two mechanisms proposed."],"forward_implications":["If coarsening amplifies poisoning attacks, then GNN acceleration systems that rely on coarsening should not assume robustness carries over from the full graph.","If sparsification removes most added poisoned edges, then poisoning attacks that rely on training-time edge additions become less threatening in sparsified systems, but attacks that also operate at inference time remain dangerous.","Defensive GNNs that filter suspicious edges will lose their protection when coarsening has already baked the perturbation into supernode structure, so defense evaluation should be repeated under reduction.","The sharp accuracy drop observed when the reduction ratio falls below roughly 0.3 suggests that overly aggressive reduction should be avoided in security-sensitive applications."],"supporting_citations":[{"why":"Defines Mettack, the meta-learning poisoning attack whose mitigation by sparsification is a central empirical claim.","marker":"[39]"},{"why":"Defines PGD, the optimization-based attack whose persistence under sparsification is contrasted with Mettack.","marker":"[30]"},{"why":"Provides the spectral coarsening framework (VN, VE, VC) used to construct supernodes and measure graph information loss.","marker":"[18]"},{"why":"Supplies PRBCD, a scalable poisoning attack used in the evaluation tables.","marker":"[8]"},{"why":"Supplies Robust GCN, a defensive model whose behavior under reduction is evaluated.","marker":"[36]"},{"why":"Supplies GNNGuard, a defense that eliminates suspicious edges and loses effectiveness under coarsening.","marker":"[33]"},{"why":"Prior work on graph reduction against backdoor attacks that the paper contrasts with its findings on general poisoning attacks.","marker":"[37]"}],"fun_headline_variants":["Coarsening amplifies GNN poisoning; sparsifying can stifle","Graph coarsening worsens attacks; sparsification can block","Sparsify to blunt GNN attacks; coarsen at your peril","Coarsening makes GNNs more fragile; sparsification helps"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The paper assumes that graph reduction has a negligible effect on a clean graph, so that comparing reduced poisoned accuracy against original clean accuracy isolates the amplified impact of the attack; no clean-plus-reduction accuracy is reported.","fun_headline_variants_meta":{"raw":{"variants":["Coarsening amplifies GNN poisoning; sparsifying can stifle","Graph coarsening worsens attacks; sparsification can block","Sparsify to blunt GNN attacks; coarsen at your peril","Coarsening makes GNNs more fragile; sparsification helps"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001056,"raw_usage":{"total_tokens":4406,"prompt_tokens":896,"completion_tokens":3510,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":512,"completion_tokens_details":{"reasoning_tokens":3429}},"tokens_in":512,"tokens_out":3510,"duration_ms":25828,"temperature":1.0,"reasoning_tokens":3429,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T20:14:25.590359+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same coarsening methods on a clean, unpoisoned graph at the same reduction ratios and measure accuracy against the original clean baseline; if the clean reduced accuracy drops by an amount comparable to the reported post-attack reduction, the claim that coarsening amplifies adversarial impact is not supported.","supporting_citations":[{"cited_title":"Journal of Machine Learning Research 20(116), 1–42 (2019)","cited_arxiv_id":null,"evidence_quote":"Provides the spectral coarsening framework (VN, VE, VC) used to construct supernodes and measure graph information loss."},{"cited_title":"Advances in Neural Information Processing Systems 34, 7637–7649 (2021)","cited_arxiv_id":null,"evidence_quote":"Supplies PRBCD, a scalable poisoning attack used in the evaluation tables."},{"cited_title":"In: Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining","cited_arxiv_id":null,"evidence_quote":"Supplies Robust GCN, a defensive model whose behavior under reduction is evaluated."},{"cited_title":"Advances in neural information processing systems 33, 9263–9275 (2020)","cited_arxiv_id":null,"evidence_quote":"Supplies GNNGuard, a defense that eliminates suspicious edges and loses effectiveness under coarsening."},{"cited_title":"17th ACM Workshop on Artificial Intelligence and Security (2024)","cited_arxiv_id":null,"evidence_quote":"Prior work on graph reduction against backdoor attacks that the paper contrasts with its findings on general poisoning attacks."}],"review_version":1}