{"id":"a318b65a-874a-465f-9024-b8ff32f8158d","arxiv_id":"2504.13786","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Bit-flip attacks can degrade GNN expressivity with far fewer bit flips than previously analyzed, especially for ReLU-activated GNNs on homophilous graphs with low-dimensional or one-hot features.","lead":"This paper analyzes how bit-flip attacks on the weights of Graph Neural Networks destroy their ability to distinguish different graph structures. It derives new theoretical bounds showing that ReLU-based GNNs on highly homophilous graphs with low-dimensional features are the most fragile, and confirms this on ten real-world datasets.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"ReLU sign-bit bound in Section 2.3 is invalid: flipping sign bits of the d differing weights does not generally zero ReLU activations, so the claimed reduction from O(d*m*b) to O(d*m) does not follow.","rationale":"The reader's weakest assumption concerned transfer from untrained, randomly initialized GNNs to trained deployed models. That is a legitimate external-validity concern, but it is not the most load-bearing problem. The paper has a direct internal mathematical error in a central result: the ReLU sign-bit reduction in Section 2.3 is false as stated. The counterexample above shows that flipping the sign bits of the d target weights can leave the two ReLU outputs distinct, so the claimed O(d*m) upper bound does not follow from the proof strategy. This matters because the abstract and conclusions single out ReLU-activated GNNs as particularly susceptible to sign-bit flips and recommend activation changes on that basis. The empirical correlations reported later may still hold, but the theoretical bound that is advertised as the paper's central contribution is unsupported. The reader's rationale did mention that the ReLU sign-bit bound is not rigorously derived, but the weakest_assumption field identifies a different issue; hence my disagreement on that specific field. I recommend REJECT because a central theorem/corollary of the paper is contradicted by a simple example, not merely heuristic or under-validated. A revised version that corrects the ReLU bound or removes the sign-bit claim could be reconsidered.","tokens_in":20108,"tokens_out":13647,"duration_ms":140502,"concrete_test":"Run a small numerical experiment: for 10^4 random rows w and random nonnegative aggregate pairs xu,xv with a fixed L0 distance d, flip the sign bits of the d weights in the differing coordinates for every row and check whether ReLU(W*xu)=ReLU(W*xv). The explicit example xu=(2,5), xv=(0,5), w=(1,2) already refutes the universal claim; the script would quantify the failure rate. A corrected analysis should instead count the flips needed to make every row's pre-activation non-positive on both inputs, which requires controlling all n coordinates, and should report the resulting corrected bound.","verdict_should_be":"REJECT","load_bearing_attack":"The ReLU reduction claimed in Section 2.3 is not supported by the preceding argument. Theorem 1's proof zeros the d_j,i weights located in the coordinates where the chosen aggregates xu and xv differ, in each of the m_j,i rows, at a cost of b bit flips per weight. The ReLU paragraph instead proposes to flip only the sign bits of those same target weights and asserts that this lets ReLU zero out the activations. A sign flip does not zero a weight; it negates it. For a row with common-coordinate contribution C, flipping the weight in a differing coordinate s changes the pre-activations from C + w_s*xu_s and C + w_s*xv_s to C - w_s*xu_s and C - w_s*xv_s. These values are generally neither equal nor non-positive, so ReLU does not collapse them. Concretely, take xu=(2,5), xv=(0,5), and one row w=(1,2). The inputs differ only in coordinate 1, so d=1 and d*m=1. The original ReLU outputs are 12 and 10. Flipping the sign bit of the target weight w_1 gives pre-activations 8 and 10, so ReLU outputs 8 and 10, still distinct. Flipping the common-coordinate weight w_2 would collapse them, but that weight is not one of the d differing target coordinates, and allowing all n coordinates would give O(n*m), not O(d*m). Thus the claimed O(d*m) sign-flip bound is not a valid upper bound, and the paper's headline that ReLU sign-bit attacks drastically lower the bound is not established.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper studies the vulnerability of GNNs to weight bit-flip attacks (BFAs) from the viewpoint of expressivity. Treating a GNN layer as an injective elementwise activation applied to a linear map, the paper uses a row-based characterization of layer injectivity (Lemmas 2 and 3) to derive upper bounds on the number of bit flips needed to break node-level expressivity, O(d_{j,i}·m_{j,i}·b) (Theorem 1), and graph-level expressivity, O(e_j·d_{j,i}·m_{j,i}·b) (Theorem 2), where d is the maximum L0 distance between input aggregates, m the layer width, b the bit width, and e the WL difference between the two most different graphs in the dataset. Section 2.3 claims that ReLU activations reduce these bounds to O(d·m) because sign-bit flips let ReLU zero out activations, and it derives narrower first-layer bounds for one-hot features (Corollary 1) and high homophily (Corollary 2). The experiments (Section 3) use ten TUDatasets, three architectures (GIN, GCN, DeepSets), three activations, and 101,250 attack runs on untrained networks, finding that ReLU sign-bit flips are most damaging and that homophily and feature dimensionality have small but statistically significant correlations with expressivity loss in the first layer. The paper explicitly does not train its models, deferring training-dependent effects to future work.","tokens_in":20482,"tokens_out":36669,"duration_ms":316454,"significance":"If the results hold, the paper would provide the first analytic, parameter-free account of how architectural choices (width, activation, bit position) and dataset properties (WL color diversity, homophily, feature encoding) jointly determine GNN susceptibility to BFAs, with falsifiable predictions (RQs 1–4) that the authors test at stated significance levels. The empirical study is a genuine strength: the code is publicly released, the experiments cover 101,250 runs across ten datasets, and the qualitative direction of the findings is consistent with prior empirical BFA work on GNNs. However, the central ReLU-specific claim (the O(d·m) bound via sign-bit flips) is not established, Proposition 1 is false as stated, and Theorems 1 and 2 assert guaranteed expressivity loss while their proofs only show that a sufficient condition for maximal expressivity is violated. These problems are material but repairable within the scope of the manuscript, so the contribution should be judged after revision.","major_comments":[{"comment":"The claimed reduction of the node-level bound from O(d_{j,i}·m_{j,i}·b) to O(d_{j,i}·m_{j,i}) by flipping sign bits is not a valid upper bound as stated. The paper asserts that flipping the sign bits of the target weights — the weights in the coordinates where the chosen aggregates xu and xv differ — \"will suffice, letting ReLU zero out the activations.\" A sign flip negates a weight rather than zeroing it. For a row with common-coordinate contribution C, flipping the sign of the weight w_s in a differing coordinate s changes the pre-activations from C + w_s·xu_s and C + w_s·xv_s to C − w_s·xu_s and C − w_s·xv_s, which are equal only if xu_s = xv_s and both non-positive only if C ≤ w_s·min(xu_s, xv_s); neither condition holds in general. Concretely, for xu = (2,5), xv = (0,5) and a row w = (1,2), we have d = 1; the original pre-activations are 12 and 10, and after flipping the sign bit of the target weight w_1 they become 8 and 10, so the ReLU outputs remain distinct. Collapsing this pair requires modifying the common-coordinate weight w_2, which is not among the d target coordinates; an attack restricted to the differing coordinates therefore does not work, and allowing all coordinates gives O(n·m), not O(d·m). The O(d·m) bound in Section 2.3, the corresponding part of the abstract (\"ReLU-activated GNNs ... particularly susceptible\"), and the motivation of RQ1 should be revised: either prove the bound under explicit conditions on the aggregates and weights, or restate the ReLU finding as an empirical observation without the claimed bound.","section":"Section 2.3, paragraph after Lemma 3"},{"comment":"Proposition 1 is false as stated, and the proof in the appendix is invalid. Condition (1) requires linear independence of {f(x) : x ∈ S(A)} only for support sets with |S(A)| ≤ n, but a collision between two multisets A, B ∈ Ω_d^n can involve up to 2n distinct domain elements. Counterexample for n = 2: let f: R^3 → R^2 be f(x) = (x_1, x_2), with x_1 = (1,0,0), x_2 = (0,1,0), x_3 = (1,1,0). Every support set of size at most 2 maps to a linearly independent set, so condition (1) holds, yet f̂({{x_1, x_2}}) = (1,1) = f̂({{x_3}}) while {{x_1, x_2}} ≠ {{x_3}}, so condition (2) fails. The proof breaks at step (8): from the single equation (6), Σ_{z∈S∪}(m_A(z) − m_B(z))f(z) = 0, a two-term relation of the form (9) cannot be extracted. The correct sufficient condition is independence of all subsets of size up to 2n (equivalently, applying the argument to S(A∪B) with the right independence hypothesis); Section 2.1 relies on the proposition to justify that layer non-injectivity endangers moment injectivity and hence expressivity, so the statement must be corrected and proved before the framework can be accepted.","section":"Appendix A, Proposition 1"},{"comment":"There is a mismatch between the statements of Theorems 1 and 2 and what their proofs establish. The theorems claim that node- or graph-level expressivity \"can be compromised\" by O(d·m·b) (resp. O(e·d·m·b)) bit flips, but the proofs show only that a chosen layer (j,i) fails to satisfy the injectivity condition of Definition 1, after which maximal expressivity \"cannot be guaranteed.\" This is strictly weaker than actual expressivity loss: if the layer attacked is not the last GNN layer, later layers can re-distinguish the collapsed pair (u,v) from their different neighborhoods, and the readout of Eq. (2) pools embeddings from all layers. The paper itself concedes in Appendix C that a loss of injectivity guarantees a loss of expressivity only for the last layer. Theorems 1 and 2 should be restricted to the last layer (where the guarantee holds), or restated as bounds on the number of flips that violate the sufficient condition for maximal expressivity; as written, they overclaim.","section":"Theorems 1 and 2"},{"comment":"All experiments use untrained, randomly initialized networks. The authors justify this by noting that random GNNs are almost always maximally expressive (Amir et al., 2024) and that the bounds hold for all possible weights; that justifies the theory, but not the transfer of the empirical findings — which bit positions are dangerous, which activations are safer, which datasets are more vulnerable — to trained models. The manuscript is transparent about this (Section 4 defers training to future work), yet the \"Implications for Practitioners\" paragraph and the abstract's \"actionable results\" claim go beyond the evidence: recommendations such as switching from ReLU to SiLU or densifying one-hot features are based solely on untrained models, whose weight distribution (signs, magnitudes) can differ from trained models. A minimal empirical check on trained models (for the main effects: ReLU sign-bit susceptibility and the first-layer homophily/feature-dimension correlations) would materially strengthen the practical claims; otherwise those claims should be scoped explicitly to the untrained setting.","section":"Section 3 and 'Implications for Practitioners'"}],"minor_comments":[{"comment":"The first direction of the proof states the distinguishing condition as ⟨xu,wr⟩ ≥ 0 and ⟨xv,wr⟩ ≥ 0, while Lemma 3's statement requires ⟨xu,wr⟩ > 0 or ⟨xv,wr⟩ > 0; the two formulations should be harmonized.","section":"Lemma 3, proof"},{"comment":"The coefficients are written λ_x ∈ V, with V the domain vector space; they should be scalars (R or K). The conclusion \"λ_x = 0 for all x ∈ A\" should read \"for all x ∈ S(A)\", and the support set notation should be used consistently.","section":"Proposition 1, statement"},{"comment":"Because the aggregation in Eq. (1) includes the node's own feature, a first-layer aggregate can have up to deg(v)+1 non-zero coordinates; the bound nz = min(2·d, n_{1,1}) should either use d+1 or state that d includes the self-loop, otherwise the stated bound is off by an additive constant.","section":"Corollary 1"},{"comment":"The estimate nzH = min(2·d·(1−H_D)·(1−P_D), n_{1,1}) multiplies a degree bound by two probabilities without derivation; the appendix proof largely restates the formula. This is a heuristic estimate rather than a proven bound and should be labeled as such or given a rigorous derivation.","section":"Corollary 2"},{"comment":"The readout \"∥_{k=0}^n\" overloads n, which is also used for the number of graphs and the multiset cardinality bound, and the multiset union, intersection, and symmetric difference in Definition 2 are used without being defined explicitly.","section":"Eq. (2) and Definition 2"},{"comment":"The caption states that each bar group represents expressivity after 1% to 95% flips but does not explain how bar positions map to these percentages, which makes the quantitative content difficult to extract.","section":"Figure 3"},{"comment":"The number of runs is stated as 101,250 in the caption of Figure 3 and as 20,250 clean models in the caption of Figure 1; the counting should be reconciled and explained in one place.","section":"Section 3, metrics"}],"recommendation":"major_revision","confidential_remarks":"This manuscript builds substantially on the authors' own prior work (Kummer et al., 2024), which is disclosed and appropriately cited. My recommendation of major revision rests on three technical points: the unjustified ReLU sign-bit bound, the false Proposition 1, and the overclaiming theorem statements. All are correctable within the scope of the paper; I do not believe the central idea is unsound, but the abstract currently asserts stronger results than the manuscript proves. I would also ask the editor to weigh whether the \"actionable results\" framing is appropriate given the untrained-model evidence base, and to require the authors to address the Proposition 1 counterexample explicitly rather than patching the wording."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First: this is the first paper I've seen that tries to bound bit flips needed to break GNN expressivity, and the general bounds are genuinely new. Theorems 1 and 2 give O(d*m*b) and O(e*d*m*b) upper bounds for degrading node- and graph-level expressivity, and the proofs, while simple, are structured around a sound idea: to make two WL-distinguishable nodes collide, zero the weights in the coordinates where their aggregates differ. That's a clean, useful observation. Lemma 2 and the moment-injectivity discussion are mostly solid, and the empirical side is substantial — ten datasets, multiple architectures and activations, code released, and a real correlation between loss of MLP injectivity and loss of expressivity.\n\nThe soft spot is the ReLU sign-bit bound in Section 2.3, and I think it's a real one. The paper asserts that flipping only sign bits of the target weights 'lets ReLU zero out the activations', reducing the bound from O(d*m*b) to O(d*m). A sign flip doesn't zero a weight — it negates it. For a row w with common-coordinate contribution C, flipping the weight in a differing coordinate s changes the pre-activations from C + w_s*xu_s and C + w_s*xv_s to C - w_s*xu_s and C - w_s*xv_s. Those are generically neither equal nor non-positive. Concretely, xu=(2,5), xv=(0,5), w=(1,2): the differing coordinate is 1, d=1. Flipping w_1 gives pre-activations 8 and 10, both positive and distinct after ReLU. Flipping the common-coordinate weight w_2 collapses them, but that weight isn't one of the d differing coordinates. If you had to flip common-coordinate weights, you'd pay O(n*m), not O(d*m). So the claimed reduction doesn't follow from the argument given.\n\nThis matters because the ReLU sign-bit vulnerability is one of the paper's headline results, advertised in the abstract and conclusion. The empirical finding that ReLU is more susceptible to sign-bit flips might still be true as an observed phenomenon, but the paper currently offers no valid theoretical explanation for it. That's a load-bearing gap, not a cosmetic one.\n\nThe other concerns are minor by comparison. Corollary 2's nzH formula is a heuristic, not a derived bound, and the paper says so implicitly by calling it an estimate. And the experiments use untrained, randomly initialized GNNs — a reasonable choice for testing the theoretical bounds, but it limits the practical claims. The paper acknowledges this.\n\nNet: the general framework and Theorems 1/2 are a contribution that deserves serious refereeing. But the ReLU section needs either a correct proof or a significant softening of the claim before this is citable. I'd send it to review, but with a clear note that the ReLU sign-bit reduction is not established.","headline":"First analytical BFA-expressivity bounds for GNNs, but the ReLU sign-bit reduction in Section 2.3 is invalid as written and weakens the paper's headline claim.","tokens_in":20986,"tokens_out":3990,"would_cite":false,"duration_ms":34189,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Few bit flips can crush a graph neural network's expressive power, and ReLU activation lowers the required count.","keywords":["bit-flip attacks","GNN expressivity","Weisfeiler-Leman test","neural multiset functions","moment injectivity","homophily","ReLU activation","graph neural network resistance"],"falsifier":"Take a gradient-descent-trained ReLU GNN with one-hot node features on a highly homophilous graph dataset, flip only sign bits in the first-layer weights, and count how many flips are needed to halve the fraction of Weisfeiler-Leman-distinguishable graph pairs the model still separates. If trained models need substantially more than the $O(m_{1,1}\\cdot nz_H)$ sign-bit flips the first-layer bound predicts, the random-initialization proxy is the weak link.","tokens_in":19947,"feed_emoji":"🧠","tokens_out":12489,"duration_ms":101849,"temperature":0.7,"pith_summary":"The paper asks how easily bit flips in a graph neural network's stored weights can destroy its expressive power—the ability to tell non-isomorphic graphs or distinct nodes apart. It proves upper bounds on the number of bit flips needed to make a maximally expressive GNN (one as expressive as the 1-WL graph isomorphism test) fail: $O(d_{j,i}\\cdot m_{j,i}\\cdot b)$ for node-level and $O(e_j\\cdot d_{j,i}\\cdot m_{j,i}\\cdot b)$ for graph-level expressivity, where $d_{j,i}$ is the maximum number of differing coordinates between input aggregates, $m_{j,i}$ the layer width, $b$ the bit width, and $e_j$ the WL difference. The paper then shows that ReLU activation, one-hot node features, and high homophily each shrink these bounds, with sign-bit flips making ReLU models vulnerable in a way that is independent of bit width. Since these conditions are common in real-world graph learning, the result matters for safety-critical applications that depend on distinguishing molecular or network structures.","feed_headline":"Few bit flips break graph neural networks; ReLU makes it cheaper","feed_subtitle":"New bounds tie GNN resistance to activation, feature encoding, and graph homophily; ReLU models need the fewest flips.","key_machinery":"The central object is the neural moment function, a layer that encodes a multiset of neighbor embeddings by the sum $\\hat{f}(X)=\\sum_{x\\in X} f(x)$ of an MLP-transformed element map $f$; graph neural networks such as GIN stack these functions. The load-bearing criterion is moment injectivity: distinct multisets must map to distinct sums, which the paper traces to linear independence of the mapped elements (Proposition 1) and, layer by layer, to the existence of a separating weight row for every pair of distinct aggregate inputs (Lemma 2). The flip-count bounds count how many stored bits must be changed to destroy that row separation; for ReLU the separation additionally requires a positive pre-activation, so a single sign-bit flip can zero a row and remove the bit-width factor from the bound (Lemma 3).","core_discovery":"On its own terms, the paper establishes that a GNN's vulnerability to expressivity loss under bit flips is governed by the injectivity of its layer-by-layer neural moment mappings. For sum-based aggregation, a layer $\\sigma\\circ W$ stays injective exactly when some row of the weight matrix separates any two distinct input aggregates (Lemma 2). Zeroing the weight entries at the coordinates where two aggregates differ, across all output neurons and all stored bits, guarantees that separation fails; this yields Theorem 1's node-level bound and, after multiplying by the WL difference $e_j$ of the hardest graph pair, Theorem 2's graph-level bound. The paper proves that ReLU's negative zeroing lets a sign-bit flip replace a full weight zeroing, removing the bit-width factor from the bound, and that one-hot encodings plus high homophily reduce the number of differing coordinates in the first layer (Corollaries 1 and 2). Empirical results on ten real-world datasets report statistically significant correlations between expressivity loss and the predicted factors, using randomly initialized, untrained GNNs.","pith_inferences":["The random-initialization proxy leaves open whether trained weights, which develop correlations and magnitude structures, are easier or harder to attack; a trained-model replication of the sign-bit experiments would settle that transfer.","By the paper's logic, switching from ReLU to a smoother activation such as SiLU or expanding feature dimensionality should harden a deployed model, but the paper only recommends this direction; it does not demonstrate it on trained models.","The WL-difference factor in the graph-level bound implies that benchmark selection alone changes apparent resistance, so cross-study comparisons of GNN bit-flip vulnerability should report dataset WL diversity.","Attention-weighted aggregations such as GAT may not inherit the homophily and first-layer effects because attention is applied before summing; the paper flags this as open rather than claiming it."],"forward_implications":["ReLU-activated GNNs with one-hot features on homophilous graphs can lose expressivity through sign-bit flips whose count is independent of bit width, making them the most exposed configuration.","Raising feature dimensionality or switching to a dense encoding that preserves linear independence increases the required flip count, giving practitioners a concrete hardening lever.","Graph-level expressivity attacks scale with the WL difference of the hardest-to-distinguish equal-order graph pair, so structurally more diverse datasets are proportionally more expensive to attack.","Any classification failure caused by expressivity loss occurs with no more bit flips than these worst-case bounds, so the bounds act as ceilings on practical attack cost.","First-layer attacks are the efficient route: one-hot encodings and homophily shrink the bound there, and the empirical correlations with expressivity loss are significant mainly for first-layer flips."],"supporting_citations":[{"why":"provides GIN and the lemma tying layer injectivity to 1-WL expressivity, the target property the bounds attack.","marker":"Xu et al., 2019"},{"why":"supplies the neural-moment framework and the result that randomly initialized GNNs are almost always maximally expressive, justifying the untrained empirical setup.","marker":"Amir et al., 2024"},{"why":"gives the injectivity conditions for ReLU networks that the paper adapts into Lemma 3.","marker":"Puthawala et al., 2022"},{"why":"establishes DeepSets sum-based set functions, the architectural basis the paper generalizes to graph neighborhoods.","marker":"Zaheer et al., 2017"},{"why":"prior bit-flip attack on GNN expressivity via injectivity loss, the starting point the theory formalizes.","marker":"Kummer et al., 2024"},{"why":"supplies the real-world benchmark graph datasets used in the empirical validation.","marker":"Morris et al., 2020"}],"fun_headline_variants":["Bit flips erase GNN expressivity; ReLU graphs hit hardest","GNN expressivity dies fast under bit flips, especially with ReLU","New bounds: ReLU GNNs on homophilous graphs need fewest flips","Expressivity loss under bit flips: ReLU and homophily are key","Why ReLU GNNs are easiest to break with bit flips"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The bounds and experiments are built on randomly initialized, untrained GNNs; the paper assumes these models' vulnerability profile matches deployed, trained GNNs, and that transfer is never tested.","fun_headline_variants_meta":{"raw":{"variants":["Bit flips erase GNN expressivity; ReLU graphs hit hardest","GNN expressivity dies fast under bit flips, especially with ReLU","New bounds: ReLU GNNs on homophilous graphs need fewest flips","Expressivity loss under bit flips: ReLU and homophily are key","Why ReLU GNNs are easiest to break with bit flips"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000552,"raw_usage":{"total_tokens":2638,"prompt_tokens":954,"completion_tokens":1684,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":570,"completion_tokens_details":{"reasoning_tokens":1581}},"tokens_in":570,"tokens_out":1684,"duration_ms":9271,"temperature":1.0,"reasoning_tokens":1581,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T12:01:50.862006+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a gradient-descent-trained ReLU GNN with one-hot node features on a highly homophilous graph dataset, flip only sign bits in the first-layer weights, and count how many flips are needed to halve the fraction of Weisfeiler-Leman-distinguishable graph pairs the model still separates. If trained models need substantially more than the $O(m_{1,1}\\cdot nz_H)$ sign-bit flips the first-layer bound predicts, the random-initialization proxy is the weak link.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"supplies the neural-moment framework and the result that randomly initialized GNNs are almost always maximally expressive, justifying the untrained empirical setup."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"gives the injectivity conditions for ReLU networks that the paper adapts into Lemma 3."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"establishes DeepSets sum-based set functions, the architectural basis the paper generalizes to graph neighborhoods."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"prior bit-flip attack on GNN expressivity via injectivity loss, the starting point the theory formalizes."},{"cited_title":"M., Bause, F., Kersting, K., Mutzel, P., and Neumann, M","cited_arxiv_id":null,"evidence_quote":"supplies the real-world benchmark graph datasets used in the empirical validation."}],"review_version":1}