{"id":"8478004a-cb70-412c-a77b-086b203a9034","arxiv_id":"2412.00789","paper_version":4,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Corrective unlearning for graph neural networks is achieved by alternating contrastive separation of affected neighborhoods with asymmetric gradient ascent and descent, using as little as 5 percent of the manipulated set.","lead":"Cognac is a new unlearning method that removes the effect of poisoned training data from graph neural networks, using only a small identified subset of the manipulated data. It recovers most of the performance of a model trained on clean data, often beats retraining from scratch, and is about eight times faster.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"CoGN's positive pairs are assumed clean, but at 5% identification Vpos can be dominated by unidentified manipulated nodes; the homophilic benchmarks do not test this, so the central claim is only established under an untested benign-neighborhood condition.","rationale":"Good-faith reading: the paper's contribution is primarily empirical, claiming that Cognac recovers oracle-level accuracy with only 5% of the manipulated set identified. The proof of Theorem 3.3 is not rigorous and should be corrected, but it is not the load-bearing element of that empirical claim. The load-bearing element is the construction of Vpos. CoGN's contrastive loss in Eq. (2) requires positive pairs to be clean, same-class nodes, yet the method never filters Vpos against Sm. With 5% identification, 95% of Sm remains in G' and can be adjacent to Vaff, especially if manipulations are locally concentrated or if the graph is heterophilic. In that regime, the algorithm explicitly maximizes similarity to manipulated embeddings, which could cement the entanglement it is supposed to remove. The experiments cover many datasets and three attack types, but all main datasets are homophilic and the manipulation sets are not characterized by locality; Section 7 acknowledges the homophily limitation. A clustered-manipulation test on Cora isolates this assumption within the paper's own setting without requiring new datasets. Since the reader already identified this concern and issued a CONDITIONAL verdict, my read does not change the verdict.","tokens_in":24942,"tokens_out":7240,"duration_ms":72251,"concrete_test":"On Cora, rerun the node label-flip protocol with Sm chosen as the 2-hop neighborhood around a high-degree seed node (rather than uniformly at random), and take Sf as a random 5% subset of Sm; report Cognac versus Retrain and Oracle at Sf/Sm=5%. If Cognac's Accaff does not exceed Retrain, or drops materially below its uniformly-random result, the clean-Vpos assumption is load-bearing; if Accaff stays at the original level, the concern is refuted.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing step is CoGN's choice of positive pairs Vpos = N_{Vaff} \\ Vf in Eq. (1)-(2). For the objective to separate affected nodes from manipulation, Vpos must consist of clean, same-class nodes. When only 5% of Sm is identified, the other 95% of manipulated nodes remain in the graph and are not excluded from Vpos. If the adversary concentrates the manipulation in a local cluster, or if the graph is heterophilic, a large fraction of Vpos will itself contain manipulated or wrong-label nodes. Minimizing Eq. (2) then pulls z_v toward those poisoned embeddings, potentially re-entangling the affected classes instead of restoring the oracle geometry. Section 7 explicitly concedes the reliance on homophily, and all main experiments use homophilic datasets; the manipulation sets are not characterized by locality, so Vpos purity is never measured or controlled. The headline claim 'even when only 5% is identified' therefore depends on an untested condition about the neighborhood of the affected nodes.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies corrective unlearning for GNNs: removing the influence of manipulated training data (targeted label flips or spurious edges) from a trained model, using only a subset of the manipulated entities. It proposes Cognac, which alternates between two components: (i) CoGN, a contrastive loss that identifies nodes affected by the manipulation and pushes their embeddings away from the known deletion set while pulling them toward neighboring nodes, and (ii) AC/DC, which performs gradient ascent on the deletion set and gradient descent on the remaining data. The method is evaluated on ten benchmark graphs, two architectures (GCN and GAT), three manipulation types, and varying fractions of identified manipulated entities, reporting that Cognac outperforms existing graph unlearning baselines and retraining from scratch, recovering most of the oracle accuracy even when only 5% of the manipulation set is identified. The paper also presents theoretical claims about representation entanglement under interclass confusion and about contrastive-loss convergence.","tokens_in":25213,"tokens_out":6227,"duration_ms":58373,"significance":"If the empirical claims hold, this is a practically valuable contribution to graph unlearning. The evaluation is unusually thorough: ten datasets (including a 170k-node graph), a second architecture, a trigger-poisoning extension, large deletion-set stress tests, hyperparameter robustness searches, and a public code release. The finding that established graph unlearning methods fail even with the full manipulation set is important and likely to influence future benchmarking. The main positive result—that partial identification can recover most of the oracle performance—is well supported on homophilic datasets. However, the paper's theoretical apparatus is not sound as written, and the broadest claims are conditioned on an untested benign-neighborhood assumption; these issues limit the current strength of the paper but are addressable.","major_comments":[{"comment":"The central claim \"Cognac ... can unlearn the effect of the manipulation set even when only 5% of it is identified\" is not established for graphs in which the unidentified manipulated nodes appear in the positive set Vpos = N_{Vaff} \\ Vf. Since CoGN explicitly pulls z_v toward the average of Vpos, any manipulated or mislabeled node in Vpos provides a poisoned pull; the method's success therefore depends on Vpos being clean and representative. The paper's Section 7 concedes reliance on homophily and excludes heterophilic graphs, but it does not address the more specific and more common failure mode that arises even in homophilic graphs when manipulation is locally concentrated or when the manipulation rate is high (Table 4 reports up to 38.96% of training nodes manipulated). The manuscript never reports the contamination rate of Vpos, never characterizes the spatial locality of the manipulated sets, and never varies this property. I ask the authors to (a) report Vpos purity for the existing experiments and (b) add at least one experiment with locally concentrated manipulation and one with a heterophilic dataset, or otherwise explicitly scope the 5% claim.","section":"§3.1.2 (Eq. 1–2) and §7"},{"comment":"Theorem 3.3 is not a valid proof of the claimed guarantee. The proof uses a first-order approximation ΔS ≈ −η⟨∇S, ∇L⟩ and then asserts ΔS ≥ 0 \"for sufficiently small η\" without a rigorous Lipschitz-based descent lemma; the later step \"This equality holds only if σ(−a) → 0 and σ(b) → 0\" is false as stated because equality of expectations does not force each integrand to vanish. Assumption A.2 (convexity of L) is not satisfied by trained GNNs, and the paper itself argues in Section 3.1.2 that the non-sigmoid objective has an \"uneven optimization landscape\" that motivates the log-sigmoid loss—so convexity is not a benign simplification. Moreover, because both L and S are defined in terms of the same dot products z_v^T z_p and z_v^T z_n, the claimed increase of S is essentially a restatement of the monotone effect of the sigmoid loss, rather than an independent convergence theorem. The sentence in Section 5 that Figure 5(b) is \"validating our theoretical results\" overstates the support. I recommend either replacing this with a rigorous statement under explicitly verifiable conditions or reclassifying it as an empirical observation.","section":"§3.1.2, Theorem 3.3 and Appendix A.2"},{"comment":"Theorem 3.1 is stated without specifying the probability space over which the expectations are taken, and its proof is heuristic. The proof assumes homophily-preserving message passing plus graph smoothness regularization in the training loss, but the experimental GCNs are not trained with a smoothness regularizer and the method is applied post-training. The derivation of the amplification factor η(1 − 1/L) and the final expression for Δ relies on asserted rather than derived propagation steps (Steps 4 and 5). Since the theorem is presented as a formal result and used to motivate the method, please either provide a proof under assumptions that match the experimental setup or explicitly downgrade it to an illustrative analysis.","section":"§3, Theorem 3.1 and Appendix A.3"}],"minor_comments":[{"comment":"The claim \"8x more efficient\" is ambiguous: in Table 7 the 8x refers to affected-node sampling time versus MEGU, while Figure 13 reports total unlearning time versus Retrain. Please state the baseline and the measurement condition clearly in the abstract and in the relevant section.","section":"Abstract and §F.2"},{"comment":"The caption says \"archives SOTA\" and should read \"achieves SOTA.\"","section":"Figure 4 caption"},{"comment":"The variables z_v, z_p, and z_n are used in Eq. (2) without prior definition in the main text; please define them (they appear only later in the statement of Theorem 3.3 in Appendix A.2).","section":"§3.1.2 (Eq. 2)"},{"comment":"The proof alternates between N^n(s) and N^l(v) notation without explaining that l indexes layers, and the base case statement \"z_s = h_s^(0)\" is confusing because z_s was defined as a final representation. Please use consistent notation.","section":"Lemma 3.2 proof (Appendix A.1)"},{"comment":"The heading \"EDGES ADDED (%)\" lists \"-\" for OGB-arXiv with no footnote; please specify whether no edges were added or the value is not applicable.","section":"Table 4"}],"recommendation":"major_revision","confidential_remarks":"The empirical study is strong and the code is public, but the paper overstates its theoretical support: Theorems 3.1 and 3.3 should not appear as formal results in their current form. The more consequential issue is that the 5% claim depends on the purity of the positive neighborhood Vpos, which is never measured or stress-tested; the authors should either add the missing experiments or explicitly scope the claim. The paper is within the scope of the venue and the empirical contribution is worth publishing after these revisions."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Bottom line: this is a genuinely useful empirical paper on corrective unlearning for GNNs. The new things are the combination of contrastive neighborhood unlearning with asymmetric ascent/descent, plus a cheap heuristic for identifying affected nodes by feature inversion. The evaluation is unusually thorough: ten datasets, two architectures, three attack types, five seeds, hyperparameter tuning with 100 trials per setting, ablations, and an honest limitations section. The claim that it works with 5% of the manipulation set identified is supported on these benchmarks. I'd send it to review.\n\nFirst, the good. The problem is real: existing graph unlearning methods fail even with full knowledge of the manipulation, and the paper shows this clearly. Cognac beats retraining from scratch and approaches an oracle in most settings. The 8x efficiency claim is plausible given reported times. Code is public. The ablation of CoGN versus ACDC shows both components matter. The appendix even documents a puzzling effect (Accaff dropping as more of Sm is known) and offers an explanation with an additional experiment—that's honest engineering.\n\nThe soft spots. The theory is the weakest part. Theorem 3.3's proof uses a first-order approximation and then asserts positive terms dominate cross terms 'for sufficiently small eta' without a bound; the convergence step that S(θ*) > S(θ0) relies on an equalization that doesn't follow. Theorem 3.1 is a plausibility argument, not a proof. The good news is the paper doesn't depend on these theorems—the empirical convergence plot and the method itself carry the weight. But as written, the formal claims are overstated. The circularity point is also fair: L and S are both inner products of the same embeddings, so driving up S is partly baked into the loss. That matters less for the method than for what the theorems claim to establish.\n\nThe more substantive concern is the homophily condition. The stress-test worry is real: when only 5% of manipulation is identified, Vpos is drawn from the graph neighborhood and includes the other 95% of poisoned nodes unless they are excluded. The method works on the benchmarks, but the manipulation sets aren't characterized by locality, so there's no direct evidence on how Vpos purity behaves under clustered attacks or heterophily. The paper does flag homophily as a limitation, but it doesn't test the failure mode. That's a gap, not a fatal one—the empirical results are still solid evidence for the stated setting.\n\nMinor: main tables lack error bars (appendix has some), and the Accrem drop on CS (89.8 to 82.3) deserves a clearer callout in the main text than the relative table.\n\nVerdict: deserves a serious referee. The method is new, the evaluation is strong, and the claims are mostly calibrated to the evidence, with the theory and the homophily boundary as the main things a reviewer should push on.","headline":"A solid, novel empirical paper on corrective unlearning for GNNs whose weak theory and untested homophily boundary are real but don't undermine the main result.","tokens_in":25716,"tokens_out":2623,"would_cite":true,"duration_ms":25371,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper introduces Cognac, which removes the effect of manipulated training data from a trained GNN using only 5% of the manipulated set, recovering near-oracle accuracy and beating retraining from scratch.","keywords":["corrective unlearning","graph neural networks","machine unlearning","contrastive unlearning","data poisoning","label manipulation attacks","spurious edge addition","homophily"],"falsifier":"Run Cognac on a heterophilic benchmark (a graph where connected nodes mostly carry different labels) under the same label-flip and spurious-edge attacks; if it no longer beats retraining from scratch when only 5% of the manipulated set is known, the homophily assumption is doing the load-bearing work. A second check: corrupt a cluster of adjacent nodes so the identified 5% is not representative of the manipulation, and test whether affected-class accuracy still recovers.","tokens_in":24760,"feed_emoji":"🍸","tokens_out":14560,"duration_ms":113016,"temperature":0.7,"pith_summary":"Graph neural networks do not treat training points independently: a wrong label or a forged edge spreads its influence to neighboring nodes through message passing, so a trained model can be damaged in ways that simple data deletion cannot reverse. This paper studies corrective unlearning for GNNs—removing the effect of manipulated entities using only a small identified subset of them—and claims that existing graph unlearning methods fail even when the entire manipulated set is known. It introduces Cognac, which alternates between a contrastive step that re-embeds affected neighbors away from manipulated nodes and toward clean ones, and a decoupled ascent/descent step that unlearns the wrong labels while preserving the rest. With as little as 5% of the manipulated set identified, Cognac recovers most of the accuracy of an oracle trained on fully clean data, outperforms retraining from scratch, and does so about 8x more cheaply. If the claim holds, model developers can repair poisoned or mislabeled GNNs after training without knowing the extent of the corruption.","feed_headline":"With 5% of the poisoned data, GNNs can unlearn the damage","feed_subtitle":"Cognac beats retraining from scratch, nearly matches a clean-data oracle, and cuts repair cost by 8x.","key_machinery":"The machinery is the pairing of CoGN and AC/DC on top of the observation that manipulation damage is local. Lemma 3.2 gives the locality: in an $n$-layer GNN a node's representation can influence only nodes within its $n$-hop neighborhood, so affected nodes can be searched for cheaply. CoGN finds them by feature inversion—replacing each deletion node's features with $\\mathbf{1} - X_v$, measuring the logit shift $\\Delta_\\chi = |M(\\chi') - M(\\chi)|$, and taking the top $k\\%$ most shifted neighbors—and then optimizes the sigmoid contrastive loss $- \\mathbb{E}[\\log\\sigma(z_v^\\top z_p) + \\log\\sigma(-z_v^\\top z_n)]$, which Theorem 3.3 shows monotonically increases the separation $\\mathbb{E}[z_v^\\top z_p - z_v^\\top z_n]$ under convexity, differentiability, and bounded gradients. AC/DC then runs gradient ascent on the deletion set and gradient descent on the retain set with separate decoupled optimizers, so the wrong-label signal is weakened without reinforcing unidentified manipulations in the retain set. The two components are complementary: ablations show CoGN alone moves embeddings but does not raise affected-class accuracy, while AC/DC alone improves accuracy but falls far short of the oracle.","core_discovery":"Cognac's central claim is that the two ways manipulation harms a GNN—propagation through the neighborhood and the learning of wrong labels—can be undone separately, and that this separation makes corrective unlearning work with almost no signal. On the propagation side, CoGN (Contrastive unlearning on Graph Neighborhoods) identifies the nodes most affected by the known deletion set by inverting the deletion nodes' features, running a forward pass, and ranking neighbors by the change in their output logits; it then applies a sigmoid contrastive loss that pushes these affected nodes' embeddings away from the manipulated nodes and toward their unaffected neighbors, restoring homophily. On the label side, AC/DC (Ascent DesCent de-coupled) performs gradient ascent on the deletion set's labels with one optimizer while a separate optimizer runs gradient descent on the remaining data, erasing the wrong learning signal without destroying the model. The paper grounds these choices in three results: manipulations only propagate within the n-hop receptive field of a poisoned node (Lemma 3.2), an Interclass Confusion attack provably entangles class embeddings (Theorem 3.1), and the contrastive objective strictly increases embedding separation at convergence under standard assumptions (Theorem 3.3). The empirical claim is that this combination beats retraining from scratch, occasionally surpasses a clean-data oracle, and performs consistently across ten datasets and three attack types with only 5% of the manipulated set known.","pith_inferences":["The paper's linked-versus-unlinked ablation (Appendix E.4) supports a design lesson the authors state only partially: for label manipulations, keeping the corrupted node in the graph and unlearning only its features and labels can beat full node deletion, because deleted nodes stop contributing clean graph context to their neighbors; structure-preserving unlearning may be the stronger default for ","Because the positive pairs in CoGN are drawn from the graph neighborhood, the method's reach depends on homophily; a natural extension would be to select positives by structural or feature similarity rather than adjacency, which would adapt the method to heterophilic graphs.","The 5% result assumes the identified subset is representative of the whole manipulation; a stress test would corrupt a tight cluster of adjacent nodes so that the identified 5% samples only one region, and check whether affected-class accuracy still recovers.","The efficiency claim (8x over retraining, and 8x faster affected-node sampling than MEGU's) makes corrective unlearning a practical companion to data-monitoring pipelines, but the paper's value depends on those detectors supplying a representative deletion set in the first place."],"forward_implications":["Existing graph unlearning methods (GNNDelete, GIF, MEGU, UtU, SCRUB) fail at corrective unlearning even with the complete manipulated set known, so this setting is genuinely harder than privacy-oriented deletion and needs dedicated methods.","Retraining from scratch is not a gold standard for corrective unlearning: Cognac beats it on affected-class accuracy while being roughly 8x cheaper, so post-hoc repair can dominate full retraining.","A small representative subset suffices: with 5% of the manipulated set identified, Cognac recovers most of the oracle's accuracy, because the neighborhood-based identification surfaces affected nodes beyond the identified set.","The method scales: on OGB-Arxiv (~170k nodes, over 1M edges) Cognac keeps a lead of more than 10% over retraining while baselines show no gain over the poisoned model.","Both components are load-bearing: CoGN alone yields no improvement in affected-class accuracy and AC/DC alone falls far short of the oracle, so corrective unlearning requires fixing neighborhood propagation and label fitting together."],"supporting_citations":[{"why":"Formulates corrective unlearning, defines the corrected/retain accuracy metrics, and shows retraining is not a gold standard when the manipulation set is partly unknown; the problem statement directly inherits from it.","marker":"Goel et al. (2024)"},{"why":"Supplies the binary label-flip manipulation attack and its theory, the main attack class used for node unlearning evaluations.","marker":"Lingam et al. (2024)"},{"why":"Defines the Interclass Confusion test that Theorem 3.1 formalizes as representation entanglement.","marker":"Goel et al. (2022)"},{"why":"Provides the GCN architecture whose message-passing receptive field underlies Lemma 3.2 and all main experiments.","marker":"Kipf & Welling (2017)"},{"why":"GNNDelete is a primary baseline that the paper shows fails on corrective unlearning even with full manipulation knowledge.","marker":"Cheng et al. (2023)"},{"why":"MEGU is the strongest graph-unlearning baseline and supplies the HIN sampling technique that Cognac's affected-node identification is ablated against.","marker":"Li et al. (2024c)"},{"why":"SCRUB is a baseline and the source of the ascent/descent unlearning idea that AC/DC adapts with decoupled optimizers.","marker":"Kurmanji et al. (2023)"},{"why":"GIF is a graph-unlearning baseline based on influence functions that the evaluation shows cannot recover from targeted manipulation.","marker":"Wu et al. (2023a)"},{"why":"Provides the sigmoid-based contrastive loss (with log-sigma terms) that CoGN optimizes for positive/negative separation.","marker":"Hamilton et al. (2017)"}],"fun_headline_variants":["GNNs unlearn poisoning with just 5% of bad data","Cognac repairs GNNs 8x faster than retraining","Corrective unlearning: 5% data, near-perfect GNN","Forget graph attacks: Cognac needs only 5%","GNN corrective unlearning beats retraining with 5%"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is homophily: connected nodes tend to share labels, so the unaffected neighbors of a manipulated node carry a clean positive signal for the contrastive step; the paper itself (Section 7) concedes it has only been evaluated on homophilic graphs.","fun_headline_variants_meta":{"raw":{"variants":["GNNs unlearn poisoning with just 5% of bad data","Cognac repairs GNNs 8x faster than retraining","Corrective unlearning: 5% data, near-perfect GNN","Forget graph attacks: Cognac needs only 5%","GNN corrective unlearning beats retraining with 5%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000966,"raw_usage":{"total_tokens":4166,"prompt_tokens":1056,"completion_tokens":3110,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":672,"completion_tokens_details":{"reasoning_tokens":3017}},"tokens_in":672,"tokens_out":3110,"duration_ms":20105,"temperature":1.0,"reasoning_tokens":3017,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T05:00:05.692931+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run Cognac on a heterophilic benchmark (a graph where connected nodes mostly carry different labels) under the same label-flip and spurious-edge attacks; if it no longer beats retraining from scratch when only 5% of the manipulated set is known, the homophily assumption is doing the load-bearing work. A second check: corrupt a cluster of adjacent nodes so the identified 5% is not representative of the manipulation, and test whether affected-class accuracy still recovers.","supporting_citations":[{"cited_title":"Rethinking label poisoning for GNN s: Pitfalls and attacks","cited_arxiv_id":null,"evidence_quote":"Supplies the binary label-flip manipulation attack and its theory, the main attack class used for node unlearning evaluations."},{"cited_title":"GNND elete: A general unlearning strategy for graph neural networks","cited_arxiv_id":null,"evidence_quote":"GNNDelete is a primary baseline that the paper shows fails on corrective unlearning even with full manipulation knowledge."},{"cited_title":"Towards unbounded machine unlearning","cited_arxiv_id":null,"evidence_quote":"SCRUB is a baseline and the source of the ascent/descent unlearning idea that AC/DC adapts with decoupled optimizers."}],"review_version":1}