Pith. sign in

REVIEW 4 major objections 4 minor 40 references

On the Adversarial Robustness of Graph Neural Networks with Graph Reduction

T0 review · 4 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Graph coarsening can amplify adversarial attacks on GNNs, while sparsification can neutralize some of them.

desk verdict A broad, useful empirical sweep of poisoning attacks under graph reduction, but the headline amplification claim lacks a clean-reduction control and the data contain counterexamples that the conclusions paper over. read the letter →

arxiv 2412.05883 v2 pith:WHXUJZWZ submitted 2024-12-08 cs.LG cs.CR

Kerui Wu , Ka-Ho Chow , Wenqi Wei , Lei Yu This is my paper · ORCID
classification cs.LGcs.CR
keywords graphneuralnetworksadversarialrobustnesscoarseningsparsificationpoisoningattacksMettackPGDreduction
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper empirically studies how two graph reduction techniques, coarsening and sparsification, change the vulnerability of Graph Neural Networks to adversarial poisoning attacks. It aims to show that the two reduction families have opposite effects: sparsification removes many poisoned edges during training and can largely neutralize attacks like Mettack, while coarsening merges poisoned edges into supernodes and amplifies the attack, lowering accuracy as the reduction ratio decreases. The paper also examines how existing defensive GNNs behave under reduction, finding that sparsification preserves their strength but coarsening undermines it. A sympathetic reader would care because graph reduction is a practical route to scaling GNNs, and this work maps when that route introduces hidden security costs.

What carries the argument

The central objects are graph coarsening, which partitions nodes into clusters and contracts each cluster into a supernode whose features are the weighted average of member features and whose label is the dominant label, and graph sparsification, which removes edges while keeping nodes and features unchanged. The argument is carried by analyzing what happens to poisoned edges under each reduction: sparsification removes a large fraction of added poisoned edges, while coarsening merges a smaller fraction into supernodes, where the inherited perturbation persists through noisy supernode features and label mismatches.

What would settle it

Run the same coarsening methods on a clean, unpoisoned graph at the same reduction ratios and measure accuracy against the original clean baseline; if the clean reduced accuracy drops by an amount comparable to the reported post-attack reduction, the claim that coarsening amplifies adversarial impact is not supported.

Watch

Extended reading notes

Core claim

The paper claims that graph coarsening tends to amplify the impact of general poisoning attacks, significantly reducing classification accuracy as the reduction ratio decreases, whereas graph sparsification can mitigate the effectiveness of certain poisoning attacks such as Mettack but has limited impact on others such as PGD. The mechanism offered for coarsening is that it merges dissimilar nodes connected by poisoned edges into supernodes, creating noisy representations with high feature variance and incorrect labels, while unmerged poisoned edges persist; the mechanism offered for sparsification is that it removes most newly added poisoned edges during training, although attacks that also work as evasion attacks can still degrade inference-time accuracy. The paper further claims that defensive GNNs retain or improve their defense capability when combined with sparsification, but coarsening transfers edge perturbations into supernode structures and renders these defenses less effective.

Load-bearing premise

The paper assumes that graph reduction has a negligible effect on a clean graph, so that comparing reduced poisoned accuracy against original clean accuracy isolates the amplified impact of the attack; no clean-plus-reduction accuracy is reported.

Editorial extensions

If this is right

  • If coarsening amplifies poisoning attacks, then GNN acceleration systems that rely on coarsening should not assume robustness carries over from the full graph.
  • If sparsification removes most added poisoned edges, then poisoning attacks that rely on training-time edge additions become less threatening in sparsified systems, but attacks that also operate at inference time remain dangerous.
  • Defensive GNNs that filter suspicious edges will lose their protection when coarsening has already baked the perturbation into supernode structure, so defense evaluation should be repeated under reduction.
  • The sharp accuracy drop observed when the reduction ratio falls below roughly 0.3 suggests that overly aggressive reduction should be avoided in security-sensitive applications.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A missing clean-plus-reduction baseline means some of the reported accuracy drop under coarsening could be attributable to the reduction method itself rather than to amplified adversarial impact; this can be checked by running coarsening on a clean graph and measuring accuracy against the same clean baseline.
  • The attack-dependence of sparsification suggests a practical selection rule: choose sparsification when the threat model is dominated by training-time poisoning (e.g., Mettack-style attacks), but not when evasion-style perturbations such as PGD are expected.
  • The supernode label-difference analysis implies that coarsening may be especially harmful on heterophilic or class-imbalanced graphs, where supernode labels are more likely to flip; this is a testable extension the paper does not run.
  • A hybrid reduction that sparsifies first to remove poisoned edges and then coarsens for compression might preserve robustness better than coarsening alone, which is a direct testable corollary of the two mechanisms proposed.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper presents an extensive empirical study of how graph reduction techniques (four sparsification and six coarsening methods) affect the robustness of GNNs against global poisoning attacks (DICE, NEA, PGD, Mettack, PRBCD, STRG-Heuristic, GraD) and, secondarily, two evasion attacks (InfMax, AGIA). It compares clean accuracy (ACCc), poisoned accuracy (ACCp), and post-reduction accuracy (ACCr) across three datasets (Cora, Pubmed, CS), three standard GNN architectures, three defensive GNNs, and reduction ratios down to 0.1. The paper reports that sparsification removes many added poisoned edges and mitigates Mettack while leaving PGD largely unaffected; coarsening instead amplifies attack impact, especially at low reduction ratios; and defensive GNNs degrade under coarsening but retain effectiveness under sparsification. It also proposes a causal explanation based on merge ratios, feature distances, and label differences in supernodes.

Significance. If the reported claims are validated, this is a practically useful empirical contribution: it is the first systematic study (to the authors' knowledge) of the interaction between graph reduction and general adversarial attacks, and it offers concrete guidance for practitioners choosing reduction methods in security-sensitive GNN deployments. The paper covers a wide space of attacks, reduction algorithms, models, and ratios, and it provides public code, which substantially increases its utility. The main weakness is that the central quantitative claims are not supported by the reported comparisons: no accuracy on a reduced clean graph is reported, so the observed drops in ACCr cannot be separated from the reduction methods' own approximation error. This missing baseline underdetermines both headline claims and needs to be addressed before the conclusions can be accepted.

major comments (4)
  1. [Section IV-C, Tables III and VI, Figures 1-2] The central claim that coarsening amplifies adversarial impact and that sparsification mitigates Mettack is supported by comparing ACCr against ACCc and ACCp only; no accuracy on a reduced clean graph is reported. Without this clean+reduction baseline, the drop in ACCr at low reduction ratios could be caused by the reduction method's own degradation of clean accuracy, not by attack amplification. Please add, for every reduction method and ratio, the accuracy achieved by training and testing on the same reduction applied to the clean graph, and use that as the baseline when quantifying amplification (e.g., report (ACCr - ACC_red-clean) alongside (ACCp - ACCc)).
  2. [Table III, Pubmed Mettack row] The claim that sparsification mitigates Mettack is not universal: with the SCAN method, ACCr drops to 64.19% from ACCp = 78.07%, whereas RNE and LD raise accuracy to roughly 86%. The paper's text states that 'for all sparsification methods, the accuracy dramatically increased as the reduction ratio decreased,' but this is contradicted by the SCAN result on Pubmed. Please qualify the mitigation claim and, ideally, discuss why SCAN behaves differently, or provide the clean+reduction baseline that would contextualize this outlier.
  3. [Section IV-F and Table VII] The text states that 'ACCr ≈ ACCp across every reduction method' and that graph reduction does not affect vulnerability to evasion attacks, but Table VII shows coarsening consistently increases accuracy relative to ACCp (e.g., Cora AGIA: 70.99% to 74.71-76.18%; Pubmed InfMax: 62.30% to 66.44-68.17%). This is an internal inconsistency between the reported data and the interpretation. Please correct the text or analyze why coarsening appears to improve evasion robustness, or both.
  4. [Section IV-D2, reference [29]] The paper cites its own preprint as 'Our extended version [29]' to provide full feature-distance distributions, but reference [29] is the same arXiv ID (2412.05883) as the current manuscript. Citing the paper itself as the source for supporting data is circular and should be replaced with the appendix results or a clearly distinct companion document.
minor comments (4)
  1. [Section IV-A, Table III and VI captions] The captions state 'p = 0.05%', but Section IV-B sets the perturbation ratio to 5% and all tables use 5%. Please correct this typo.
  2. [Section IV-A, Evaluation Metrics] The definition of ACCr states that it 'uses the reduced poisoned graph,' but the paper does not specify how the test set is constructed when coarsening merges nodes into supernodes (e.g., how original test nodes are mapped to supernodes, and how labels are handled when a supernode contains conflicting labels). Please clarify this protocol, as it is essential for reproducibility.
  3. [Figure 6 caption] The caption contains a duplicated sentence: 'As illustrated in Figure 6...' is immediately followed by 'As illustrated in the Figure...'. Please remove the duplicate.
  4. [Section IV-B] The paper reports averages over five random seeds but provides no standard deviations or confidence intervals. Some of the reported differences (e.g., 1-2 percentage points) may be within run-to-run noise; reporting variance would strengthen the quantitative comparisons, especially for the 'limited impact' claims.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: minor self-citations are not load-bearing; the missing clean+reduction baseline is an experimental limitation, not a circular step.

full rationale

This paper is an empirical benchmark study; there is no derivation chain in which a predicted quantity is constructed from its own inputs. The headline results (sparsification mitigates Mettack, coarsening amplifies poisoning impact) are direct measurements of ACCr in Section IV-C, Tables III and VI, and they are compared against independently measured ACCc and ACCp. ACCr is not defined in terms of ACCc or ACCp, and no parameter is fitted to a subset and then renamed a prediction. The self-citations are not load-bearing: [37] is cited only to contrast backdoor attacks with general poisoning attacks, and [29] merely points to the extended version for fuller feature-distance plots. Neither citation supplies the central empirical content. The unaddressed absence of a clean+reduction control (accuracy on a reduced but unpoisoned graph) is a genuine experimental limitation: without it, the 'amplification' claim cannot separate coarsening's own accuracy cost from attack amplification. That is a validity concern, not a circularity, because the reported ACCr values are new measurements rather than quantities implied by the paper's definitions. No equation in the paper reduces to another by construction, and no uniqueness theorem or ansatz is imported from the authors' prior work. Accordingly no circular step is identified; the minor self-citations warrant at most score 2 under the 'no significant circularity' band.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

No mathematical model with fitted constants. The empirical claims rest on chosen hyperparameters (p=5%, r=0.325) and on assumptions about transferability and clean baselines. The most consequential assumption is that clean+reduction accuracy is not needed, which is unflagged.

assumptions (3)
  • domain assumption The accuracy drop caused by graph reduction on clean graphs is negligible, so ACCr vs ACCc comparisons measure attack impact.
    Implicit throughout Section IV.C and IV.D; no clean+reduction accuracy is reported.
  • domain assumption Black-box attacks generated with a surrogate GCN transfer to other GNN architectures and defense models.
    Section III.A: attackers train a surrogate model; the paper evaluates attacks against GAT, SAGE, and defenses without verifying transferability.
  • ad hoc to paper Feature distance and label difference statistics capture the causal mechanism of coarsening amplification.
    Section IV-D2: these post-hoc statistics are presented as the cause, but no controlled experiment or ablation isolates the mechanism.

how reviews work

0 comments
Cite this review

Pith. "Pith review of On the Adversarial Robustness of Graph Neural Networks with Graph Reduction." pith.science (2026). https://pith.science/paper/WHXUJZWZ

@misc{pith2026241205883,
  author       = {Pith},
  title        = {Pith review of: On the Adversarial Robustness of Graph Neural Networks with Graph Reduction},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WHXUJZWZ}},
  note         = {Machine review of arXiv:2412.05883}
}
read the original abstract

As Graph Neural Networks (GNNs) become increasingly popular for learning from large-scale graph data across various domains, their susceptibility to adversarial attacks when using graph reduction techniques for scalability remains underexplored. In this paper, we present an extensive empirical study to investigate the impact of graph reduction techniques, specifically graph coarsening and sparsification, on the robustness of GNNs against adversarial attacks. Through extensive experiments involving multiple datasets and GNN architectures, we examine the effects of four sparsification and six coarsening methods on the poisoning attacks. Our results indicate that, while graph sparsification can mitigate the effectiveness of certain poisoning attacks, such as Mettack, it has limited impact on others, like PGD. Conversely, graph coarsening tends to amplify the adversarial impact, significantly reducing classification accuracy as the reduction ratio decreases. Additionally, we provide a novel analysis of the causes driving these effects and examine how defensive GNN models perform under graph reduction, offering practical insights for designing robust GNNs within graph acceleration systems.

Figures

Figures reproduced from arXiv: 2412.05883 by the authors.

Figure 1
Figure 1. ACCr using four sparsification algorithms against PGD (left) and Mettack (right) with reduction ratios r in CS dataset. 0.2 0.4 0.6 0.8 1.0 Reduction Ratio 0.84 0.86 0.88 0.90 0.92 Accuracy PGD Kron VN VE VC HE JC ACC_c ACC_p 0.2 0.4 0.6 0.8 1.0 Reduction Ratio 0.750 0.775 0.800 0.825 0.850 0.875 0.900 0.925 Accuracy Mettack Kron VN VE VC HE JC ACC_c ACC_p [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. ACCr using six coarsening algorithms against PGD (left) and Mettack (right) with various r in CS dataset. against Mettack. On the other hand, as shown in [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 4
Figure 4. The merge ratio of newly-added perturbation edges generated by PGD [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figures from the paper (6 more)
Figure 6
Figure 6. Figure 6: Comparison of feature distances’ distribution on the Cora dataset [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: ACCr using six coarsening algorithms against seven attacks with various r in three datasets. Overall, ACCr sharply decreases as the reduction ratio is less than 0.3 [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 8
Figure 8. Figure 8: ACCr using four sparsification algorithms against seven attacks with various r in three datasets. Mettack and GraD are notably mitigated, as evidenced by increased ACCr with decreasing r, while other attacks exhibit relatively stable ACCr across different reduction rat…
Figure 9
Figure 9. Figure 9: Complete elimination ratios of newly-added perturbation edges by graph sparsification [PITH_FULL_IMAGE:figures/full_fig_p013_9.png]
Figure 10
Figure 10. Figure 10: Complete merge ratios of malicious perturbation edges under graph coarsening [PITH_FULL_IMAGE:figures/full_fig_p014_10.png]
Figure 11
Figure 11. Figure 11: Complete feature distance between clean coarsened graph and poisoned coarsened graph [PITH_FULL_IMAGE:figures/full_fig_p015_11.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

40 extracted references · 29 canonical work pages

  1. [29]

    On the Adversarial Robustness of Graph Neural Networks with Graph Reduction

    Wu, K., Chow, K.H., Wei, W., Yu, L.: On the adversarial robust- ness of graph neural networks with graph reduction. arXiv preprint arXiv:2412.05883 (2024)

    work page Pith review arXiv 2024

  2. [37]

    17th ACM Workshop on Artificial Intelligence and Security (2024)

    Zhu, Y ., Mandulak, M., Wu, K., Slota, G., Jeon, Y ., Chow, K.H., Yu, L.: On the robustness of graph reduction against gnn backdoor. 17th ACM Workshop on Artificial Intelligence and Security (2024)

    work page 2024

  3. [1]

    In: International Conference on Machine Learning

    Bojchevski, A., G ¨unnemann, S.: Adversarial attacks on node embed- dings via graph poisoning. In: International Conference on Machine Learning. pp. 695–704. PMLR (2019)

    work page 2019

  4. [2]

    arXiv preprint arXiv:1809.02797 (2018)

    Chen, J., Wu, Y ., Xu, X., Chen, Y ., Zheng, H., Xuan, Q.: Fast gradient attack on network embedding. arXiv preprint arXiv:1809.02797 (2018)

    arXiv 2018

  5. [3]

    Understanding Structural Vulnerability in Graph Convolutional Networks

    Chen, L., Li, J., Peng, Q., Liu, Y ., Zheng, Z., Yang, C.: Understanding structural vulnerability in graph convolutional networks. arXiv preprint arXiv:2108.06280 (2021)

    work page Pith review arXiv 2021

  6. [4]

    arXiv preprint arXiv:2202.08057 (2022)

    Chen, Y ., Yang, H., Zhang, Y ., Ma, K., Liu, T., Han, B., Cheng, J.: Understanding and improving graph injection attack by promoting unnoticeability. arXiv preprint arXiv:2202.08057 (2022)

    arXiv 2022

  7. [5]

    In: Proceedings of the ACM Web Conference

    Dai, E., Lin, M., Zhang, X., Wang, S.: Unnoticeable backdoor attacks on graph neural networks. In: Proceedings of the ACM Web Conference

    work page

  8. [6]

    IEEE Transactions on Circuits and Systems I: Regular Papers 60(1), 150–163 (2012)

    Dorfler, F., Bullo, F.: Kron reduction of graphs with applications to electrical networks. IEEE Transactions on Circuits and Systems I: Regular Papers 60(1), 150–163 (2012)

    work page 2012

Show all 40 references
  1. [7]

    In: Proceedings of the 13th international conference on web search and data mining

    Entezari, N., Al-Sayouri, S.A., Darvishzadeh, A., Papalexakis, E.E.: All you need is low (rank) defending against adversarial attacks on graphs. In: Proceedings of the 13th international conference on web search and data mining. pp. 169–177 (2020)

    2020

  2. [8]

    Advances in Neural Information Processing Systems 34, 7637–7649 (2021)

    Geisler, S., Schmidt, T., S ¸irin, H., Z ¨ugner, D., Bojchevski, A., G¨unnemann, S.: Robustness of graph neural networks at scale. Advances in Neural Information Processing Systems 34, 7637–7649 (2021)

    2021

  3. [9]

    Social Network Analysis and Mining 6, 1–22 (2016)

    Hamann, M., Lindner, G., Meyerhenke, H., Staudt, C.L., Wagner, D.: Structure-preserving sparsification methods for social networks. Social Network Analysis and Mining 6, 1–22 (2016)

    2016

  4. [10]

    Advances in neural information processing systems 30 (2017)

    Hamilton, W., Ying, Z., Leskovec, J.: Inductive representation learning on large graphs. Advances in neural information processing systems 30 (2017)

    2017

  5. [11]

    ACM SIGKDD Explorations Newsletter 22(2), 19–34 (2021)

    Jin, W., Li, Y ., Xu, H., Wang, Y ., Ji, S., Aggarwal, C., Tang, J.: Adversarial attacks and defenses on graphs. ACM SIGKDD Explorations Newsletter 22(2), 19–34 (2021)

    2021

  6. [12]

    In: Proceedings of the AAAI conference on artificial intelli- gence

    Ju, M., Fan, Y ., Zhang, C., Ye, Y .: Let graph be the go board: gradient- free node injection attack for graph neural networks via reinforcement learning. In: Proceedings of the AAAI conference on artificial intelli- gence. vol. 37, pp. 4383–4390 (2023)

    2023

  7. [13]

    arXiv preprint arXiv:1609.02907 (2016)

    Kipf, T.N., Welling, M.: Semi-supervised classification with graph convolutional networks. arXiv preprint arXiv:1609.02907 (2016)

    2016 arXiv

  8. [14]

    In: The Eleventh International Conference on Learning Representations (2022)

    Li, K., Liu, Y ., Ao, X., He, Q.: Revisiting graph adversarial attack and defense from a data distribution perspective. In: The Eleventh International Conference on Learning Representations (2022)

    2022

  9. [15]

    arXiv preprint arXiv:2005.06149 (2020)

    Li, Y ., Jin, W., Xu, H., Tang, J.: Deeprobust: A pytorch library for ad- versarial attacks and defenses. arXiv preprint arXiv:2005.06149 (2020)

    2020 arXiv

  10. [16]

    In: Proceedings of the web conference 2021

    Liu, Y ., Ao, X., Qin, Z., Chi, J., Feng, J., Yang, H., He, Q.: Pick and choose: a gnn-based imbalanced learning approach for fraud detection. In: Proceedings of the web conference 2021. pp. 3168–3177 (2021)

    2021

  11. [17]

    arXiv preprint arXiv:2304.00010 (2023)

    Liu, Z., Luo, Y ., Wu, L., Liu, Z., Li, S.Z.: Towards reasonable budget allocation in untargeted graph structure attacks via gradient debias. arXiv preprint arXiv:2304.00010 (2023)

    2023 arXiv

  12. [18]

    Journal of Machine Learning Research 20(116), 1–42 (2019)

    Loukas, A.: Graph reduction with spectral and cut guarantees. Journal of Machine Learning Research 20(116), 1–42 (2019)

    2019

  13. [19]

    In: International conference on machine learning

    Loukas, A., Vandergheynst, P.: Spectrally approximating large graphs with smaller graphs. In: International conference on machine learning. pp. 3237–3246. PMLR (2018)

    2018

  14. [20]

    In: Proceedings of the fifteenth ACM international conference on web search and data mining

    Ma, J., Deng, J., Mei, Q.: Adversarial attack on graph neural networks as an influence maximization problem. In: Proceedings of the fifteenth ACM international conference on web search and data mining. pp. 675– 685 (2022)

    2022

  15. [21]

    In: 32nd USENIX Security Symposium

    Mirsky, Y ., Macon, G., Brown, M., Yagemann, C., Pruett, M., Downing, E., Mertoguno, S., Lee, W.: {VulChecker}: Graph-based vulnerability localization in source code. In: 32nd USENIX Security Symposium. pp. 6557–6574 (2023)

    2023

  16. [22]

    Multiscale Modeling & Simulation 9(1), 407– 423 (2011)

    Ron, D., Safro, I., Brandt, A.: Relaxation-based coarsening and multi- scale graph organization. Multiscale Modeling & Simulation 9(1), 407– 423 (2011)

    2011

  17. [23]

    In: Proceedings of the 2011 ACM SIGMOD International Conference on Management of data

    Satuluri, V ., Parthasarathy, S., Ruan, Y .: Local graph sparsification for scalable clustering. In: Proceedings of the 2011 ACM SIGMOD International Conference on Management of data. pp. 721–732 (2011)

    2011

  18. [24]

    Network Science 4(4), 508–530 (2016)

    Staudt, C.L., Sazonovs, A., Meyerhenke, H.: Networkit: A tool suite for large-scale complex network analysis. Network Science 4(4), 508–530 (2016)

    2016

  19. [25]

    Briefings in bioinformatics 21(3), 919–935 (2020)

    Sun, M., Zhao, S., Gilvary, C., Elemento, O., Zhou, J., Wang, F.: Graph convolutional networks for computational drug development and discovery. Briefings in bioinformatics 21(3), 919–935 (2020)

    2020

  20. [26]

    arXiv preprint arXiv:1710.10903 (2017)

    Veli ˇckovi´c, P., Cucurull, G., Casanova, A., Romero, A., Lio, P., Bengio, Y .: Graph attention networks. arXiv preprint arXiv:1710.10903 (2017)

    2017 arXiv

  21. [27]

    IEEE Transactions on Knowledge and Data Engineering (2024)

    Wen, L., Liang, J., Yao, K., Wang, Z.: Black-box adversarial attack on graph neural networks with node voting mechanism. IEEE Transactions on Knowledge and Data Engineering (2024)

    2024

  22. [28]

    arXiv preprint arXiv:1903.01610 (2019)

    Wu, H., Wang, C., Tyshetskiy, Y ., Docherty, A., Lu, K., Zhu, L.: Adversarial examples on graph data: Deep insights into attack and defense. arXiv preprint arXiv:1903.01610 (2019)

    2019 arXiv

  23. [30]

    arXiv preprint arXiv:1906.04214 (2019)

    Xu, K., Chen, H., Liu, S., Chen, P.Y ., Weng, T.W., Hong, M., Lin, X.: Topology attack and defense for graph neural networks: An optimization perspective. arXiv preprint arXiv:1906.04214 (2019)

    2019 arXiv

  24. [31]

    In: Proceedings of the 13th ACM SIGKDD international conference on Knowledge discovery and data mining

    Xu, X., Yuruk, N., Feng, Z., Schweiger, T.A.: Scan: a structural clustering algorithm for networks. In: Proceedings of the 13th ACM SIGKDD international conference on Knowledge discovery and data mining. pp. 824–833 (2007)

    2007

  25. [32]

    arXiv preprint arXiv:2306.14052 (2023)

    Zhang, S., Sohrabizadeh, A., Wan, C., Huang, Z., Hu, Z., Wang, Y ., Cong, J., Sun, Y ., et al.: A survey on graph neural network acceler- ation: Algorithms, systems, and customized hardware. arXiv preprint arXiv:2306.14052 (2023)

    2023

  26. [33]

    Advances in neural information processing systems 33, 9263–9275 (2020)

    Zhang, X., Zitnik, M.: Gnnguard: Defending graph neural networks against adversarial attacks. Advances in neural information processing systems 33, 9263–9275 (2020)

    2020

  27. [34]

    In: Proceedings of the 26th ACM symposium on access control models and technologies

    Zhang, Z., Jia, J., Wang, B., Gong, N.Z.: Backdoor attacks to graph neural networks. In: Proceedings of the 26th ACM symposium on access control models and technologies. pp. 15–26 (2021)

    2021

  28. [35]

    arXiv preprint arXiv:2111.04314 (2021)

    Zheng, Q., Zou, X., Dong, Y ., Cen, Y ., Yin, D., Xu, J., Yang, Y ., Tang, J.: Graph robustness benchmark: Benchmarking the adversarial robustness of graph machine learning. arXiv preprint arXiv:2111.04314 (2021)

    2021 arXiv

  29. [36]

    In: Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining

    Zhu, D., Zhang, Z., Cui, P., Zhu, W.: Robust graph convolutional networks against adversarial attacks. In: Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining. pp. 1399–1407 (2019)

    2019

  30. [38]

    ACM Transactions on Knowledge Discovery from Data (TKDD) 14(5), 1–31 (2020)

    Z ¨ugner, D., Borchert, O., Akbarnejad, A., G ¨unnemann, S.: Adversarial attacks on graph neural networks: Perturbations and their patterns. ACM Transactions on Knowledge Discovery from Data (TKDD) 14(5), 1–31 (2020)

    2020

  31. [39]

    CoRR abs/1902.08412 (2019), http://arxiv.org/ abs/1902.08412 APPENDIX A

    Z ¨ugner, D., G ¨unnemann, S.: Adversarial attacks on graph neural net- works via meta learning. CoRR abs/1902.08412 (2019), http://arxiv.org/ abs/1902.08412 APPENDIX A. Descriptions of Graph Reduction Methods Graph Coarsening. Six methods for graph coarsening are listed as fo...

    2019 arXiv

  32. [2023]

    2263–2273 (2023)

    pp. 2263–2273 (2023)

    2023

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.