Boosting Graph Robustness Against Backdoor Attacks: An Over-Similarity Perspective

Chang Liu; Hai Huang; Xingquan Zuo; Yujie Xing

REVIEW 3 major objections 6 minor 32 references

Boosting Graph Robustness Against Backdoor Attacks: An Over-Similarity Perspective

T0 review · 3 major / 6 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Existing graph backdoor attacks generate trigger nodes that are over-similar in features and structure, and SimGuard exploits this regularity to detect and remove them, restoring attacked nodes to their pre-attack predictions.

desk verdict The over-similarity observation is real and worth publishing; the paper's stronger claim that SimGuard restores pre-attack states is not supported by its own DRR metric. read the letter →

arxiv 2502.01272 v3 pith:K56KUSH5 submitted 2025-02-03 cs.LG

Chang Liu , Hai Huang , Yujie Xing , Xingquan Zuo This is my paper · ORCID

classification cs.LG

keywords graphneuralnetworksbackdoorattacksdefensetriggerdetectionover-similaritycontrastivelearningDBSCANnodeclassification

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that the triggers used by current graph backdoor attacks share a common, exploitable degeneracy: although the attacks claim to generate sample-specific subgraphs, the trigger nodes they attach to target nodes end up nearly identical to one another in features and structure. Building on that observation, the paper proposes SimGuard, a defense that finds trigger clusters by density-based clustering with a near-zero degree-variance filter, flags globally anomalous trigger features with a Canberra-distance score, and trains a contrastive-learning detector that can identify and prune triggers at inference time. The paper's main empirical result is that this pipeline detects triggers with recall and precision above 95% on six datasets across the GTA, UGBA, and DPGBA attacks, while keeping clean accuracy close to the unprotected model. Its stricter success criterion, Defense Recovery Rate, requires attacked nodes to return to their pre-attack predictions, not merely to leave the target class. A sympathetic reader would care because the argument turns a shared weakness of current attack generators into a reusable detection signal, and it exposes a blind spot in defenses that only appear to lower attack success.

What carries the argument

The load-bearing object is the Trigger-Bridge Node (TBN), the trigger node that directly connects to a target node; it is the unit whose features and degree carry the over-similarity signal, and it is what SimGuard detects and removes. The machinery has three stages. Stage one runs DBSCAN on node features and keeps only clusters whose degree variance falls below a small threshold (e.g., 0.001), which isolates triggers whose features have collapsed and whose degrees are nearly constant. Stage two computes a global anomaly score via Canberra distance between each node and a high-confidence clean set selected by autoencoder reconstruction loss, then takes the largest-gap cutoff to flag triggers that preserve local homophily yet remain globally anomalous. Stage three trains a contrastive-learning detector, an InfoNCE-style loss with an MLP binary classifier, on detected triggers and sampled clean nodes, producing embeddings that separate the two groups and letting the defense detect triggers on unseen graphs without recomputing global statistics. The contrastive detector is what makes the defense usable at inference time.

What would settle it

Train a new trigger generator whose objective maximizes attack success while explicitly penalizing trigger similarity and enforcing heterogeneous trigger degrees, then run it against SimGuard on the same six datasets; if such a generator sustains high attack success while producing diverse features and non-constant degrees, and SimGuard's recall and precision drop materially, the over-similarity premise is refuted. The paper's Appendix L is the partial version of this test and reports that the penalty mostly degrades attack success or leaves smaller over-similar clusters.

Watch

Extended reading notes

Core claim

The central discovery is empirical. Measuring pairwise cosine similarity among Trigger-Bridge Nodes (the trigger nodes directly connected to target nodes), the authors find that GTA and DPGBA triggers nearly collapse to a single feature vector, while UGBA triggers, though locally homophilic, remain globally over-similar to each other and abnormal relative to clean nodes. The same measurements show near-constant trigger degrees: GTA and DPGBA have degree variance 0.0 on Cora, CiteSeer, and PubMed, and UGBA has variance 0.45 at most on Cora. The paper's constructive claim is that this over-similarity is stable enough to power a defense: SimGuard first isolates near-collapsed clusters with DBSCAN plus a degree-variance threshold, then uses a Canberra-distance global anomaly score to catch locally homophilic but globally abnormal triggers, and finally trains a contrastive-learning trigger detector that can operate on unseen graphs. Removing detected triggers restores attacked nodes to their pre-attack predictions; the paper reports Defense Recovery Rates near 100% across datasets and attacks, and argues in its Proposition 6.1 that robust-training defenses cannot guarantee this kind of restoration.

Load-bearing premise

The load-bearing premise is that over-similarity is a stable property of graph backdoor triggers in general, not an artifact of the specific implementations tested, namely GTA, UGBA, and DPGBA under their default configurations.

Editorial extensions

If this is right

If over-similarity holds, a single defense can neutralize three different generative graph backdoor attacks (GTA, UGBA, DPGBA) rather than relying on one attack-specific signature.
Attacked nodes can be restored to their pre-attack predictions, not just pushed out of the target class; the Defense Recovery Rate quantifies this stricter notion of defense.
Because trigger detection operates on embeddings learned once during training, the same detector can prune triggers from unseen graphs, making the defense usable in inductive settings.
Current attack generators would need to produce genuinely diverse triggers to evade detection, and Appendix L suggests that adding a similarity penalty to the attack loss either lowers attack success or only fragments triggers into smaller over-similar clusters.
Defenders no longer have to choose between removing triggers and preserving clean nodes: the reported recall and precision above 95% imply few clean nodes are sacrificed.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial inference: The cleanest stress test for SimGuard is a trigger generator trained with an explicit diversity objective, varied trigger features, heterogeneous degrees, and adaptive inference-time sampling, since the paper only tests a similarity penalty, not a diversity-promoting generative model.
Editorial inference: If over-similarity is a general artifact of subgraph triggers, the same detection logic (dense feature clusters plus low degree variance) may transfer to other graph tasks such as link prediction or graph classification, where backdoors are also injected as attached subgraphs.
Editorial inference: The DRR philosophy, judging a defense by whether nodes return to their pre-attack predictions, could be carried to other domains; it would change how backdoor defenses are compared, since low attack success alone does not distinguish restoration from merely breaking the trigger-target association.
Editorial inference: Disentangling the two detection signals matters: a trigger generator that keeps features diverse but degrees constant would bypass the DBSCAN filter, while one that varies degrees but collapses features would test the Canberra anomaly score; measuring each component's failure mode would sharpen the defense's boundary conditions.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Read this paper for the over-similarity observation, not for the restoration claim. The empirical finding that triggers from GTA, UGBA, and DPGBA collapse into feature clusters and near-constant degree patterns is new, documented across six datasets, and likely to be useful to anyone building graph backdoor defenses. The defense itself—DBSCAN plus degree-variance screening, Canberra-distance anomaly scoring, then a contrastively trained trigger detector—is a reasonable engineering combination, and the detection results on the tested attacks are strong: near-perfect recall and precision, stable across hyperparameters, and it preserves clean accuracy. That part deserves credit.

The load-bearing problem is the DRR metric. Section 3.1 explicitly adopts the stricter goal that target nodes revert to their pre-attack states, but the formula in Appendix G.4 only checks that neither the defended prediction nor the clean prediction equals the target class. A node is counted as recovered even if the defended model predicts some third class, and a node whose clean prediction was the target class is counted as unrecovered no matter what the defense does. So near-100% DRR is consistent with merely pushing predictions off the target class—exactly the weaker criterion the paper criticizes in prior defenses. The central claim of restoration is therefore not established by the reported numbers.

The table issues are real too. SimGuard's ASR row under SBA, GTA, and UGBA on Cora and CiteSeer is identical (5.78 and 0.00), and the values are suspiciously close on PubMed and Physics. Some of that could be coincidental once triggers are removed and residual ASR becomes natural misclassification toward the target class, but the paper should explain why the residual differs across attacks on the same dataset. The CiteSeer feature dimension is given as 1,433 in the text and 3,703 in Table 5. Proposition 6.1's proof is mostly assumption followed by assertion; it is not a rigorous bound. And the code is only a link to an anonymous repo, not a citable artifact.

The adaptive-attack section is honest about one thing: the similarity penalty can reduce ASR, and the authors concede that over-similarity persists in smaller clusters. That means the paper does not prove over-similarity is a necessary property of successful triggers, so the general robustness claim is overstated. But for the current generation of attacks, the observation holds up, and the defense is not circular in the way the reader worried: it clusters first, then trains a detector on the clusters.

Who is this for? People working on graph backdoor attacks and defenses. It is a solid empirical paper with a flawed evaluation metric and some data-quality problems. I would send it to serious peer review, but not accept it in current form. The revision needs a corrected or honestly renamed DRR, an explanation of the repeated table entries, a real code release, and a proof or a much softer claim for Proposition 6.1.

Referee Report

3 major / 6 minor

Summary. SimGuard is a defense against graph backdoor attacks on GNNs. The paper first reports an empirical observation: triggers generated by GTA, UGBA, and DPGBA are highly similar in feature space and have near-constant degree. It then proposes SimGuard, which detects trigger-bridge nodes by DBSCAN clustering, a degree-variance criterion, and a Canberra-distance global anomaly score, and trains a contrastive-learning detector for use at inference. The defense removes detected triggers and retrains or fine-tunes a GNN. The paper introduces a Defense Recovery Rate (DRR), reports near-perfect trigger detection, low ASR, preserved ACC, and claims that target nodes revert to their pre-attack states. Experiments cover six datasets and four attacks, plus mixed and adaptive attacks, with hyperparameter sensitivity analysis.

Significance. If the over-similarity observation holds, it is a useful common weakness of current generative graph backdoor attacks, and SimGuard's contrastive detector is a reasonable design for making trigger detection efficient at inference. The paper ships an anonymous code link and includes sensitivity analyses, mixed-attack experiments, and detection recall/precision tables. The stated conceptual advance, moving from target-class deviation to restoration of pre-attack states, is important, but it is exactly the part that the current DRR metric fails to support. The central empirical claims therefore need revalidation before the significance of the contribution can be assessed.

major comments (3)

[Section 3.1 / Appendix G.4] The Defense Recovery Rate as defined in Appendix G.4, DRR = (1/|V_t|) sum_v I[f_p(v) != y_t and f_c(v) != y_t], does not measure restoration to the pre-attack state. It only requires that both the defended prediction and the clean prediction differ from the target class; a node whose clean prediction is class A is counted as recovered when the defended model predicts any class B != y_t, even if B != A. It also assigns 0 to every node with f_c(v) = y_t, although for those nodes predicting y_t is precisely the pre-attack state. Consequently the near-100% DRR values in Table 2 do not support the Section 3.1 claim that target nodes revert to their pre-attack states, and Proposition 6.1 is derived for a metric that does not express the stated objective. The authors should replace DRR with the fraction of attacked nodes for which f_p(v) = f_c(v), or f_p(v) equals the clean label, and rerun the evaluation.
[Appendix L, Table 13] The adaptive-attack evidence is internally inconsistent. For Cora with beta=25, Table 13 lists an ASR of 81.8% after SimGuard and a DRR of 94.8%; under the paper's own definitions, if 81.8% of poisoned nodes are predicted as the target class, then at most 18.2% of them can satisfy f_p(v) != y_t, so the reported DRR is impossible. Furthermore, Eq. (24) only penalizes trigger-trigger similarity; the attack does not query or adapt to the DBSCAN, Canberra-distance, or contrastive detector, so it is not an adaptive attack against SimGuard. The Section 6.3 conclusion that over-similarity is not easily addressed is therefore not supported by the presented experiment.
[Table 2] The SimGuard ASR values are identical for GTA and UGBA on all six datasets (5.78, 0.00, 3.80, 0.63, 0.00, 0.02), and ACC and DRR are identical on Cora and CiteSeer. This may be a genuine consequence of trigger removal, but the paper neither explains nor discusses it. If the duplicated rows are a copy-paste artifact, the main defense-comparison table needs to be corrected; if they are real, the authors should state why two distinct attacks lead to exactly the same defended model behavior on the attacked nodes.

minor comments (6)

[Appendix G.1 / Table 5] The CiteSeer statistics are inconsistent: Appendix G.1 states 1,433-dimensional features and 3,312 nodes with 4,732 edges, while Table 5 reports 3,703 features, 3,327 nodes, and 4,552 edges. These numbers should be reconciled.
[Sections 4, 5.2.2, 6.3, Appendix L] Several cross-references appear as unresolved 'Appendix ??' placeholders; these should be filled or deleted so the supporting analyses can actually be located.
[Section 6.4] The text says 'From Table 4, we observe...' but the detection results are presented in Figure 4 and Table 3; the cross-reference is incorrect.
[Eq. (4), Eq. (7), Algorithm 1] The symbol delta is overloaded as the degree-variance threshold in Eq. (4), the reconstruction-loss percentile in Eq. (7), and Algorithm 1 tests Var(C_i)=0 rather than Var(C_i)<delta; this should be made consistent and explicit.
[Section 4.2 / Eq. (4)] The relationship between the degree-variance criterion and the paper's own measurements should be clarified: Table 1 reports UGBA trigger-degree variance 0.45 on Cora, but Eq. (4) with delta=0.001 would not classify such a cluster as a trigger, so the reliance on the global anomaly score for UGBA should be stated explicitly.
[Tables 3 and 13] Table 3 contains malformed entries such as '100.00.' and a bare '1' for Arxiv recall, and Table 13 lacks clear column separation; as printed, both tables are difficult to read and should be reformatted.

Circularity Check

1 steps flagged · score 5.0 of 10

The claimed restoration-to-pre-attack metric DRR is defined to count only 'not target class', so near-100% DRR does not measure restoration; over-similarity detection itself appears non-circular.

self definitional [Appendix G.4 (DRR formula), with the stricter restoration goal stated in Sec. 3.1 and reported DRR results in Table 2]
"The DRR formula is expressed as follows: DRR= 1 |Vt| P v∈Vt I[fp(v)̸=y t ∧f c(v)̸=y t]"

Sec. 3.1 states the stronger goal that 'target nodes revert to their pre-attack states,' and Sec. 6.1/Appendix G.4 present DRR as measuring this restoration. But the G.4 formula only counts nodes where both the defended prediction and the clean prediction differ from the target class; it never requires fp(v)=fc(v). A node whose clean prediction was class A is counted as recovered if the defense outputs any class B != yt, even B != A. Conversely, a node whose clean prediction is yt is scored 0 even though yt is its pre-attack state. Thus the near-100% DRR values in Table 2 are implied by the metric's definition plus any defense that pushes predictions off the target class; they do not certify restoration to pre-attack labels. The proof of Prop.

full rationale

The paper's trigger-detection pipeline is not circular: it bases detection on DBSCAN clustering and degree variance (Eq. 4), Canberra-distance anomaly scores (Eq. 5-6), and a contrastive detector trained on those detected triggers, with detection performance reported separately (Table 4) and sensitivity analysis in Fig. 5/Fig. 10. Those components are fit to the observed over-similarity of existing attacks, not to the final reported DRR values. However, the paper's central defensive claim of restoring attacked nodes to their pre-attack state is supported in Table 2 entirely by the DRR metric, whose Appendix G.4 formula counts a node as recovered whenever neither the defended nor the clean prediction is the attack target. That is exactly the weaker 'deviate from the target class' criterion that Sec. 3.1 explicitly rejects. Consequently, the reported near-perfect DRR is largely self-defined by the chosen metric rather than measured restoration. This warrants a mid-range circularity score; the over-similarity phenomenon itself remains an independent empirical observation.

Assumptions & free parameters 6 free parameters · 5 assumptions · 2 invented entities

SimGuard depends on several empirically tuned hyperparameters (DBSCAN eps and min_samples, autoencoder percentile, temperature, degree-variance threshold) and on the conceptual assumption that over-similarity is a stable property of generative graph backdoor attacks. No new physical or mathematical entities are introduced beyond the operational 'Trigger-Bridge Nodes' definition. The main free parameters are standard for clustering pipelines but are nonetheless hand-set on the benchmark data.

free parameters (6)

DBSCAN eps = 0.01
Appendix G.6 chooses eps=0.01; Section 6.5 varies it over {0.01, 0.02, 0.04, 0.1, 0.2} and shows precision depends on it, so it is tuned to the data rather than derived.
DBSCAN min_samples = 10
Appendix G.6 sets min_samples=10; Section 6.5 shows detection precision improves as min_samples increases, indicating the value is chosen for the benchmark data.
autoencoder clean-node selection percentile = 10% of nodes
Appendix G.6 chooses a clean node selection ratio of 10%; Appendix H shows the method is robust to this ratio, but the specific 10% is a hand-chosen value.
contrastive learning temperature t = 0.1
Appendix G.6 sets temperature to 0.1; Appendix H varies it and reports little sensitivity, but the value is empirically fixed.
degree variance threshold delta = 0.001
Section 5.1 states clusters with variance below delta (e.g., 0.001) are classified as triggers; the exact delta is a user-set threshold.
global anomaly score cutoff = derived from max gap in G_sorted
Equation 6 selects the number of anomalies by the maximum gap in sorted scores for each dataset and attack. This is an automatic heuristic rather than a hand-fitted constant, but it is an empirically chosen rule that adapts to the data.

assumptions (5)

domain assumption Trigger-bridge nodes (TBN), the direct neighbors of target nodes, are the right unit of detection and removal.
Section 4.1 defines TBN and says 'all subsequent discussions on trigger detection and removal refer to TBN'; the defense assumes that removing TBN restores target nodes without harming them.
domain assumption Over-similarity in triggers is a persistent property of generative graph backdoor attacks.
Section 4 claims this based on measurements of three attack methods on default settings; no proof is given that future attacks will retain this property.
domain assumption Disjoint train/test splits and inductive setting continue to hold for the defense.
Section 3.1 defines the inductive threat model; the contrastive detector is trained on the training graph and applied to unseen graphs, assuming the trigger distribution shifts little.
ad hoc to paper Clusters with near-zero degree variance are trigger clusters, not natural clean-node clusters.
Equation 4 equates low degree variance with triggers; on regular graphs clean nodes could also have constant degree, and the paper does not analyze this failure case beyond noting homogeneity issues in OGB-arxiv.
domain assumption The Canberra distance global anomaly score captures trigger over-similarity better than cosine similarity.
Section 5.1 asserts this without a comparative derivation; Appendix M compares only against OD and K-means, not against other distance functions.

invented entities (2)

Over-similarity as an attack property
purpose: Conceptual handle that all tested generative triggers are claimed to share clusters of near-identical features and constant degrees.
The over-similarity is measured on the three attack implementations the paper chose; there is no external oracle or falsifiable prediction outside the paper's own experiments to confirm the phenomenon is a general law of graph backdoor attacks.
Trigger-Bridge Nodes (TBN)
purpose: Operational definition of what gets detected and removed, namely the trigger subgraph nodes directly adjacent to target nodes.
TBN is defined by the paper and used throughout; the paper itself notes that subgraph triggers not connected to target nodes are counted as neither triggers nor clean nodes, making the metric dependent on this definition.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Boosting Graph Robustness Against Backdoor Attacks: An Over-Similarity Perspective." pith.science (2026). https://pith.science/paper/K56KUSH5

@misc{pith2026250201272,
  author       = {Pith},
  title        = {Pith review of: Boosting Graph Robustness Against Backdoor Attacks: An Over-Similarity Perspective},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/K56KUSH5}},
  note         = {Machine review of arXiv:2502.01272}
}

read the original abstract

Graph Neural Networks (GNNs) have achieved notable success in tasks such as social and transportation networks. However, recent studies have highlighted the vulnerability of GNNs to backdoor attacks, raising significant concerns about their reliability in real-world applications. Despite initial efforts to defend against specific graph backdoor attacks, existing defense methods face two main challenges: either the inability to establish a clear distinction between triggers and clean nodes, resulting in the removal of many clean nodes, or the failure to eliminate the impact of triggers, making it challenging to restore the target nodes to their pre-attack state. Through empirical analysis of various existing graph backdoor attacks, we observe that the triggers generated by these methods exhibit over-similarity in both features and structure. Based on this observation, we propose a novel graph backdoor defense method SimGuard. We first utilizes a similarity-based metric to detect triggers and then employs contrastive learning to train a backdoor detector that generates embeddings capable of separating triggers from clean nodes, thereby improving detection efficiency. Extensive experiments conducted on real-world datasets demonstrate that our proposed method effectively defends against various graph backdoor attacks while preserving performance on clean nodes. The code will be released upon acceptance.

Figures

Figures reproduced from arXiv: 2502.01272 by the authors.

**Figure 2.** Visualization of the similarity between trigger nodes and clean nodes generated by UGBA on the Cora dataset. Under the above settings, we studied Ck on Cora. In [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 3.** Framework of SimGuard. SimGuard detects triggers using DBSCAN and a global anomaly [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Figures from the paper (8 more)

**Figure 4.** Figure 4: Results of backdoor defense across selected [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]

**Figure 5.** Figure 5: Hyperparameter sensitivity analysis. To answer Q3, we conduct experiments to evaluate the impact of different DBSCAN parameters— the neighborhood radius in clustering, eps, and the minimum cluster size, min_samples—on the performance of SimGuard. Specifically, we var…

**Figure 6.** Figure 6: Visualization of over-similarity among triggers generated by GTA. [PITH_FULL_IMAGE:figures/full_fig_p017_6.png]

**Figure 7.** Figure 7: Visualization of over-similarity among triggers generated by UGBA. [PITH_FULL_IMAGE:figures/full_fig_p017_7.png]

**Figure 8.** Figure 8: Visualization of over-similarity among triggers generated by DPGBA. [PITH_FULL_IMAGE:figures/full_fig_p018_8.png]

**Figure 9.** Figure 9: Visualization of global anomaly scores for triggers generated by UGBA. [PITH_FULL_IMAGE:figures/full_fig_p018_9.png]

**Figure 10.** Figure 10: Hyperparameter sensitivity analysis. 0.01 0.02 0.04 0.1 0.2 Clean Node Selection Ratio 0.1 0.2 0.4 0.6 0.8 Temperature 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0…

**Figure 11.** Figure 11: Hyperparameter sensitivity analysis. I Different Numbers of Triggers In this section, we present experiments to evaluate how a different number of triggers affects the performance of SimGuard in terms of backdoor defense and poisoned node detection. Specifically, for …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

32 extracted references · 14 canonical work pages

[1]

Outlier aware network embed- ding for attributed networks

Sambaran Bandyopadhyay, N Lokesh, and M Narasimha Murty. Outlier aware network embed- ding for attributed networks. InProceedings of the AAAI conference on artificial intelligence, pages 12–19, 2019

work page 2019
[2]

A simple framework for contrastive learning of visual representations

Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. InInternational conference on machine learning, pages 1597–1607. PMLR, 2020

2020
[3]

Generative adversarial attributed network anomaly detection

Zhenxing Chen, Bo Liu, Meiqing Wang, Peng Dai, Jun Lv, and Liefeng Bo. Generative adversarial attributed network anomaly detection. InProceedings of the 29th ACM International Conference on Information & Knowledge Management, pages 1989–1992, 2020

work page 1989
[4]

Unnoticeable backdoor attacks on graph neural networks

Enyan Dai, Minhua Lin, Xiang Zhang, and Suhang Wang. Unnoticeable backdoor attacks on graph neural networks. InProceedings of the ACM Web Conference 2023, pages 2263–2273, 2023

2023
[5]

Deep anomaly detection on attributed networks

Kaize Ding, Jundong Li, Rohit Bhanushali, and Huan Liu. Deep anomaly detection on attributed networks. InProceedings of the 2019 SIAM international conference on data mining, pages 594–602. SIAM, 2019

2019
[6]

A density-based algorithm for discovering clusters in large spatial databases with noise

Martin Ester, Hans-Peter Kriegel, Jörg Sander, Xiaowei Xu, et al. A density-based algorithm for discovering clusters in large spatial databases with noise. Inkdd, volume 96, pages 226–231, 1996

1996
[7]

Graph neural networks for social recommendation

Wenqi Fan, Yao Ma, Qing Li, Yuan He, Eric Zhao, Jiliang Tang, and Dawei Yin. Graph neural networks for social recommendation. InThe world wide web conference, 2019

work page 2019
[8]

Fast graph representation learning with pytorch geometric

Matthias Fey and Jan Eric Lenssen. Fast graph representation learning with pytorch geometric. arXiv preprint arXiv:1903.02428, 2019

arXiv 1903

Show all 32 references

[9]

Bootstrap your own latent-a new approach to self-supervised learning.Advances in neural information processing systems, 33:21271–21284, 2020

Jean-Bastien Grill, Florian Strub, Florent Altché, Corentin Tallec, Pierre Richemond, Elena Buchatskaya, Carl Doersch, Bernardo Avila Pires, Zhaohan Guo, Mohammad Gheshlaghi Azar, et al. Bootstrap your own latent-a new approach to self-supervised learning.Advances in neural in...

2020
[10]

Inductive representation learning on large graphs.Advances in neural information processing systems, 30, 2017

Will Hamilton, Zhitao Ying, and Jure Leskovec. Inductive representation learning on large graphs.Advances in neural information processing systems, 30, 2017

2017
[11]

Algorithm as 136: A k-means clustering algorithm

John A Hartigan and Manchek A Wong. Algorithm as 136: A k-means clustering algorithm. Journal of the royal statistical society. series c (applied statistics), 28(1):100–108, 1979. 10

1979
[12]

Open graph benchmark: Datasets for machine learning on graphs

Weihua Hu, Matthias Fey, Marinka Zitnik, Yuxiao Dong, Hongyu Ren, Bowen Liu, Michele Catasta, and Jure Leskovec. Open graph benchmark: Datasets for machine learning on graphs. Advances in neural information processing systems, 33:22118–22133, 2020

2020
[13]

Semi-supervised classification with graph convolutional networks.arXiv preprint arXiv:1609.02907, 2016

Thomas N Kipf and Max Welling. Semi-supervised classification with graph convolutional networks.arXiv preprint arXiv:1609.02907, 2016

2016 arXiv
[14]

Universal litmus patterns: Revealing backdoor attacks in cnns

Soheil Kolouri, Aniruddha Saha, Hamed Pirsiavash, and Heiko Hoffmann. Universal litmus patterns: Revealing backdoor attacks in cnns. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 301–310, 2020

2020
[15]

Anti-backdoor learning: Training clean models on poisoned data.Advances in Neural Information Processing Systems, 34:14900–14912, 2021

Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-backdoor learning: Training clean models on poisoned data.Advances in Neural Information Processing Systems, 34:14900–14912, 2021

2021
[16]

Are defenses for graph neural networks robust?Advances in Neural Information Processing Systems, 35:8954–8968, 2022

Felix Mujkanovic, Simon Geisler, Stephan Günnemann, and Aleksandar Bojchevski. Are defenses for graph neural networks robust?Advances in Neural Information Processing Systems, 35:8954–8968, 2022

2022
[17]

Representation learning with contrastive predictive coding.arXiv preprint arXiv:1807.03748, 2018

Aaron van den Oord, Yazhe Li, and Oriol Vinyals. Representation learning with contrastive predictive coding.arXiv preprint arXiv:1807.03748, 2018

2018 arXiv
[18]

Graph neural networks for intelligent transportation systems: A survey.IEEE Transactions on Intelligent Transportation Systems, 24(8):8846–8885, 2023

Saeed Rahmani, Asiye Baghbani, Nizar Bouguila, and Zachary Patterson. Graph neural networks for intelligent transportation systems: A survey.IEEE Transactions on Intelligent Transportation Systems, 24(8):8846–8885, 2023

2023
[19]

Collective classification in network data.AI magazine, 29(3):93–93, 2008

Prithviraj Sen, Galileo Namata, Mustafa Bilgic, Lise Getoor, Brian Galligher, and Tina Eliassi- Rad. Collective classification in network data.AI magazine, 29(3):93–93, 2008

2008
[20]

An overview of microsoft academic service (mas) and applications

Arnab Sinha, Zhihong Shen, Yang Song, Hao Ma, Darrin Eide, Bo-June Hsu, and Kuansan Wang. An overview of microsoft academic service (mas) and applications. InProceedings of the 24th international conference on world wide web, pages 243–246, 2015

2015
[21]

Graph attention networks.stat, 1050(20):10–48550, 2017

Petar Velickovic, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Lio, Yoshua Bengio, et al. Graph attention networks.stat, 1050(20):10–48550, 2017

2017
[22]

Neural cleanse: Identifying and mitigating backdoor attacks in neural networks

Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In2019 IEEE symposium on security and privacy (SP), pages 707–723. IEEE, 2019

2019
[23]

Rab: Provable robustness against backdoor attacks

Maurice Weber, Xiaojun Xu, Bojan Karlaš, Ce Zhang, and Bo Li. Rab: Provable robustness against backdoor attacks. In2023 IEEE Symposium on Security and Privacy (SP), pages 1311–1328. IEEE, 2023

2023
[24]

Graph backdoor

Zhaohan Xi, Ren Pang, Shouling Ji, and Ting Wang. Graph backdoor. In30th USENIX Security Symposium (USENIX Security 21), pages 1523–1540, 2021

2021
[25]

Contrastive attributed network anomaly detection with data augmentation

Zhiming Xu, Xiao Huang, Yue Zhao, Yushun Dong, and Jundong Li. Contrastive attributed network anomaly detection with data augmentation. InPacific-Asia conference on knowledge discovery and data mining, pages 444–457. Springer, 2022

2022
[26]

Graphsaint: Graph sampling based inductive learning method.arXiv preprint arXiv:1907.04931, 2019

Hanqing Zeng, Hongkuan Zhou, Ajitesh Srivastava, Rajgopal Kannan, and Viktor Prasanna. Graphsaint: Graph sampling based inductive learning method.arXiv preprint arXiv:1907.04931, 2019

1907 arXiv
[27]

Gnnguard: Defending graph neural networks against adversarial attacks.Advances in neural information processing systems, 33:9263–9275, 2020

Xiang Zhang and Marinka Zitnik. Gnnguard: Defending graph neural networks against adversarial attacks.Advances in neural information processing systems, 33:9263–9275, 2020

2020
[28]

Backdoor attacks to graph neural networks

Zaixi Zhang, Jinyuan Jia, Binghui Wang, and Neil Zhenqiang Gong. Backdoor attacks to graph neural networks. InProceedings of the 26th ACM Symposium on Access Control Models and Technologies, pages 15–26, 2021

2021
[29]

Rethinking graph backdoor attacks: A distribution-preserving perspective

Zhiwei Zhang, Minhua Lin, Enyan Dai, and Suhang Wang. Rethinking graph backdoor attacks: A distribution-preserving perspective. InProceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 4386–4397, 2024. 11

2024
[30]

Robustness-inspired defense against backdoor attacks on graph neural networks.arXiv preprint arXiv:2406.09836, 2024

Zhiwei Zhang, Minhua Lin, Junjie Xu, Zongyu Wu, Enyan Dai, and Suhang Wang. Robustness-inspired defense against backdoor attacks on graph neural networks.arXiv preprint arXiv:2406.09836, 2024

2024 arXiv
[31]

Robust graph convolutional networks against adversarial attacks

Dingyuan Zhu, Ziwei Zhang, Peng Cui, and Wenwu Zhu. Robust graph convolutional networks against adversarial attacks. InProceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining, pages 1399–1407, 2019. 12 A Details of Related Works A.1 Gra...

2019
[32]

successful defense

clustering phase, pairwise distances between node features are computed, leading to a worst-case complexity of O(|VT |2). However, when a high clustering threshold is applied, the process can be approximated on a sparse graph, reducing the complexity to O(k|VT |), where k is t...

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.

[1] [1]

Outlier aware network embed- ding for attributed networks

Sambaran Bandyopadhyay, N Lokesh, and M Narasimha Murty. Outlier aware network embed- ding for attributed networks. InProceedings of the AAAI conference on artificial intelligence, pages 12–19, 2019

work page 2019

[2] [2]

A simple framework for contrastive learning of visual representations

Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. InInternational conference on machine learning, pages 1597–1607. PMLR, 2020

2020

[3] [3]

Generative adversarial attributed network anomaly detection

Zhenxing Chen, Bo Liu, Meiqing Wang, Peng Dai, Jun Lv, and Liefeng Bo. Generative adversarial attributed network anomaly detection. InProceedings of the 29th ACM International Conference on Information & Knowledge Management, pages 1989–1992, 2020

work page 1989

[4] [4]

Unnoticeable backdoor attacks on graph neural networks

Enyan Dai, Minhua Lin, Xiang Zhang, and Suhang Wang. Unnoticeable backdoor attacks on graph neural networks. InProceedings of the ACM Web Conference 2023, pages 2263–2273, 2023

2023

[5] [5]

Deep anomaly detection on attributed networks

Kaize Ding, Jundong Li, Rohit Bhanushali, and Huan Liu. Deep anomaly detection on attributed networks. InProceedings of the 2019 SIAM international conference on data mining, pages 594–602. SIAM, 2019

2019

[6] [6]

A density-based algorithm for discovering clusters in large spatial databases with noise

Martin Ester, Hans-Peter Kriegel, Jörg Sander, Xiaowei Xu, et al. A density-based algorithm for discovering clusters in large spatial databases with noise. Inkdd, volume 96, pages 226–231, 1996

1996

[7] [7]

Graph neural networks for social recommendation

Wenqi Fan, Yao Ma, Qing Li, Yuan He, Eric Zhao, Jiliang Tang, and Dawei Yin. Graph neural networks for social recommendation. InThe world wide web conference, 2019

work page 2019

[8] [8]

Fast graph representation learning with pytorch geometric

Matthias Fey and Jan Eric Lenssen. Fast graph representation learning with pytorch geometric. arXiv preprint arXiv:1903.02428, 2019

arXiv 1903