{"id":"a43ac085-8253-4f12-9e33-0cbcc8c86b25","arxiv_id":"2502.05000","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"DiffSP purifies attacked graphs by learning the clean graph distribution with a discrete diffusion model and reports consistent accuracy improvements over baselines on nine datasets and nine evasion attacks.","lead":"This paper proposes DiffSP, a defense that uses a graph diffusion model trained on clean graphs to remove adversarial edge changes from attacked graphs before classification. It reports accuracy gains over many baselines on nine datasets and nine evasion attacks, with two new mechanisms for selective noise and generation guidance.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Proposition 1's time mapping relies on an unverified and likely violated range assumption on LID-based adversarial scores; without it the non-isotropic diffusion mechanism may not behave as claimed.","rationale":"The reader's weakest assumption identifies the same LID range issue; I agree. I considered the transfer entropy derivation error in Appendix A.2, but it is less load-bearing because Eq. (10)-(11) are still a well-defined heuristic guidance whose empirical benefit is demonstrated by the ablation; the mislabeling as transfer entropy affects exposition, not the mechanism's practical operation. In contrast, Proposition 1 is the theoretical bridge that turns per-edge LID scores into a valid diffusion-time schedule; if the bridge fails, the non-isotropic mechanism is unsubstantiated and the claimed 'prior-free precise purification' is unsupported. The empirical tables are credible overall, so the appropriate disposition remains conditional on correcting/validating the theory and reporting the LID distribution.","tokens_in":30107,"tokens_out":7842,"duration_ms":84538,"concrete_test":"Run the public DiffSP code; for each dataset, compute Γ (Eq. 3) and Λ=ΓΓ^T. Report min/max/percentiles. Then for each diffusion step t used in the paper, compute Eq. (4) and count edges with t'∈[0,T] and the fraction of mask entries M(t) that differ from the isotropic mask. If a significant fraction of t' is out-of-range or the mask degenerates, Proposition 1 does not hold in practice. Also re-derive Eq. (4) with the correct direction of the cosine schedule to check the sign of the SNR comparison.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 4.2 and Appendix A.1: Proposition 1 maps per-edge non-isotropic noise to an effective isotropic diffusion time t'(A_ij) via SNR equality. The proof assumes Λ(A)_ij ∈ [0,1] and asserts that ¯α(t) is monotonically increasing, but with the stated cosine schedule ¯α(t)=cos²((t/T+s)/(1+s)·π/2), ¯α is decreasing from ≈1 at t=0 to 0 at t=T. Furthermore, LID estimates from Eq. (3) are strictly positive, typically exceed 1 (values 2–20 are common), and the edge score Λ=ΓΓ^T is their product, so it can be ≫1. For Λ·(1−¯α(t))/¯α(t) < (1−¯α(0))/¯α(0), Eq. (4) yields t'<0; for large Λ the arccos argument tends to 0 and t' saturates near T, collapsing the 'non-isotropic' mask to near-isotropic behavior. No normalization of Γ or Λ is reported in Appendix D.4. Since the LID-driven non-isotropic diffusion is a headline contribution and the ablation study attributes a clear performance drop to its removal, the central claim that DiffSP precisely removes adversarial edges while preserving clean structure rests on an uncalibrated, unvalidated mapping. This is a load-bearing correctness risk, not merely a framing issue.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes DiffSP, a framework for defending GNNs against adversarial evasion attacks by purifying graph structure with a discrete graph diffusion model. A graph diffusion model is trained on clean graphs only; at test time, the attacked graph is first subjected to an LID-driven non-isotropic forward diffusion process that injects more noise into edges deemed adversarial, then denoised with a graph transfer entropy guided reverse process intended to keep the purified graph semantically aligned with the target clean graph. Experiments cover five graph classification datasets and four node classification datasets under nine evasion attacks, with extensive baselines, ablations, cross-dataset generalization, and sensitivity studies. The reported results consistently show the highest average robustness on most datasets, and the paper releases code.","tokens_in":30395,"tokens_out":7449,"duration_ms":84457,"significance":"If the machinery is sound, this is a substantial empirical contribution: a single clean-data-trained diffusion module improves robustness across diverse datasets and attacks, and the paper provides a useful comparison with many baselines. The cross-dataset generalization experiments, ablation studies, and the explicit complexity analysis are commendable, and the clean-training/test-time-purification protocol is not circular. However, the two headline mechanisms rest on derivations in Appendices A.1 and A.2 that contain serious technical errors: the cosine-schedule monotonicity in the proof of Proposition 1 is reversed, the range assumption on the LID-based edge scores is unvalidated, and the conditional mutual information derivation replaces conditional entropy by ratios of joint entropies. These issues make the theoretical basis for both core contributions unreliable, so the manuscript needs substantial revision before the claims can be accepted.","major_comments":[{"comment":"The proof of Proposition 1 contains a factual error about the cosine schedule: it states α(0)=0 and α(T)=1 and claims α-bar is monotonically increasing, whereas for α-bar(t)=cos²((t/T+s)/(1+s)·π/2) we have α-bar(0)≈1, α-bar(T)=0, and α-bar is monotonically decreasing. The intermediate-value conclusion can probably be rescued by taking limits, so this error alone is not necessarily fatal. The load-bearing problem is the unexamined assumption Λ(A)_ij∈[0,1]. Since Λ=ΓΓ^T and Γ_i from Eq. (3) is a positive LID estimate that typically exceeds 1, Λ can be much larger than 1, and no normalization of Γ or Λ is reported in Appendix D.4 or Algorithm 1. For large Λ, the arccos argument in Eq. (4) tends to 0 and the purification time t-hat saturates near T for all edges, so the per-edge non-isotropic mask in Eq. (6) collapses to near-isotropic behavior. Given that the ablation in Figure 3 attributes a clear performance drop to removing this component, the authors must either provide a justified normalization of Γ/Λ to [0,1] or supply empirical evidence (e.g., the distribution of t-hat over edges and an ablation with normalized scores) that the mapping behaves as claimed.","section":"Appendix A.1, Eq. (4), Appendix D.4"},{"comment":"The derivation of graph transfer entropy is invalid. Eq. (A.15) replaces H(Ĝ(t-1)|Ĝ(t)) with H(Ĝ(t-1), Ĝ(t))/H(Ĝ(t)) and H(Ĝ(t-1)|Ĝ(t), G_adv) with a ratio of joint entropies, but the definition of conditional entropy is H(X|Y)=H(X,Y)-H(Y), not a ratio. Consequently, Eq. (A.16)-(A.18) do not compute the conditional mutual information in Eq. (7). Since the reverse guidance update in Eq. (11) uses the negative gradient of this quantity, the derivation of the second core mechanism is unsupported. The authors should either correct the derivation or explicitly reframe the ratio expression as a heuristic surrogate and validate it empirically, for example by comparing it with an alternative guidance objective or by reporting its effect on purification quality without the entropy estimator.","section":"Appendix A.2, Eq. (7), Eqs. (A.13)-(A.18)"},{"comment":"The notation around the noisy adjacency matrix in Eq. (5) is ambiguous in a way that affects reproducibility. The text says A(t) is obtained by A(t)=A·Q-bar_A^(t) in the forward process, but at test time the model is given G_adv=(X, A_adv), not a clean A. The purification procedure should specify explicitly that A(t) is computed from the attacked adjacency matrix A_adv. If instead the clean A is used somewhere in Eq. (5), the test-time protocol would be ill-defined. Please clarify this point, since the mask in Eq. (6) determines which edges are denoised at each reverse step.","section":"Section 4.2, Eq. (5)"}],"minor_comments":[{"comment":"The header of the second block repeats \"GCN (B→B)\"; it should presumably read \"GCN (M→M)\" to be consistent with the other columns.","section":"Table 4"},{"comment":"The keyword \"graph diffuison\" contains a typo and should be \"graph diffusion\".","section":"Keywords"},{"comment":"The heading \"Propostition 1\" contains a typo and should be \"Proposition 1\".","section":"Appendix A.1"},{"comment":"The claim of being \"prior-free\" is overstated: training a diffusion model on clean graphs is a generative prior over clean graph structure. The method is prior-free only in the narrower sense that it does not use attack-specific or dataset-specific hand-crafted priors. I recommend qualifying this terminology in the abstract and introduction.","section":"Abstract and Section 1"},{"comment":"The cross-dataset generalization study uses IMDB-BINARY (2 classes) and IMDB-MULTI (3 classes) across label spaces. The interpretation should mention how the classifier and diffusion model are adapted between datasets with different numbers of classes, otherwise the comparison is difficult to interpret.","section":"Section 5.3"}],"recommendation":"major_revision","confidential_remarks":"The empirical study is broad and the clean-training/test-purification setup is not circular, which makes the paper potentially salvageable. However, the theoretical apparatus behind both headline mechanisms contains errors, and the LID-to-time mapping is uncalibrated; these are load-bearing issues for the central claims. I would encourage the editor to ask for a corrected derivation or an explicit heuristic reframing, plus an empirical validation of the LID score range and the resulting purification times, before considering acceptance. I also note that several baselines (MGRL, SubGattPool, CAMA-Subgraph) were reimplemented by the authors without code release from the original authors; this is worth checking during review but is not by itself a reason to reject."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Worth a look if you care about adversarial robustness for GNNs. The empirical story is genuinely strong: nine datasets, nine evasion attacks, consistent gains across graph and node classification, and the code is public. The cross-dataset generalization experiment is a nice touch, and they made an effort to reproduce baselines when original code was missing. That part is solid, and the combination of a discrete graph diffusion backbone with LID-based per-edge noise scheduling and entropy-ratio guidance is new as far as I know.\n\nThe soft spots are not cosmetic. Proposition 1 is the mechanism that supposedly lets a non-isotropic forward process be replaced by per-edge diffusion times, and the proof gets the cosine schedule backwards: alpha-bar(t) decreases from about 1 to 0 as t goes from 0 to T, so the claimed monotonicity and the g(0)g(T) sign argument don't hold as written. The proof also assumes Lambda_ij in [0,1], but LID estimates from Eq. (3) are typically well above 1, and Lambda = Gamma Gamma^T makes it worse. Without normalization, the time mapping can produce negative t' or saturate near T, which would collapse the non-isotropic mask to something close to isotropic. Since the ablation shows removing the LID mechanism drops performance, this is a load-bearing flaw, not a typo.\n\nAppendix A.2 has a different but equally serious problem: the derivation replaces conditional mutual information with a ratio of joint and marginal entropies. That equality is simply not true. The guidance term may work empirically, but the paper does not provide a valid derivation for it.\n\nAlso, the \"prior-free\" framing overstates the case. Training a diffusion model on clean graphs and using a clean-trained classifier's LID scores are learned priors; they are not priors in the homophily/low-rank sense, but the label should be softened.\n\nWho is this for? Researchers working on graph structure purification or diffusion-based defenses will want to read it. The experiments are comprehensive enough that the empirical claim deserves serious engagement, and the math issues are fixable if the authors normalize Lambda, correct or remove Proposition 1, and anchor the guidance term empirically rather than via an invalid derivation. I would send this to review with the expectation of major revision. The empirical core is valuable, but the current theory is not reliable enough to cite as is.","headline":"Strong empirical purification results with public code, but both theoretical pillars (LID time mapping and transfer-entropy guidance) have load-bearing errors that need correction before the method is adopted as stated.","tokens_in":30914,"tokens_out":3200,"would_cite":true,"duration_ms":34394,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"DiffSP claims a clean-graph-trained diffusion model can purify attacked graphs with no dataset or attack priors.","keywords":["graph neural networks","adversarial evasion attacks","graph structure purification","graph diffusion models","local intrinsic dimensionality","transfer entropy","robust graph learning"],"falsifier":"Measure the LID vector $\\Gamma$ from the trained classifier's last hidden layer on any dataset in the paper, form $\\Lambda_A=\\Gamma\\Gamma^\\top$, and inspect the distribution of its entries; if a material fraction of edges falls outside $[0,1]$, the unique purification time of Proposition 1 is undefined for those edges. Then compare DiffSP with $\\Lambda_A$ clamped to $[0,1]$ versus unclamped to see whether the range assumption affects accuracy.","tokens_in":29912,"feed_emoji":"🛡️","tokens_out":16761,"duration_ms":154130,"temperature":0.7,"pith_summary":"This paper claims that adversarial evasion attacks on graph structure can be defeated without relying on any prior about the clean graph or the attack strategy. The proposal, DiffSP, trains a discrete graph diffusion model on clean graphs to learn their intrinsic distribution, then treats an attacked graph as a corrupted sample and purifies it through a forward noising step and a reverse denoising step. The forward noise is non-isotropic: edges attached to nodes with high Local Intrinsic Dimensionality, a measure of how many dimensions the local neighborhood around a node occupies and a signal of adversarial modification, are assigned longer purification times so clean structure is preserved. The reverse denoising is guided by a graph transfer-entropy term that keeps the generated graph semantically close to the target while adversarial edges are removed. If the central claim is right, a single clean-data-trained purification module yields the best average accuracy across five graph-classification and four node-classification datasets under nine evasion attacks, and it transfers across datasets.","feed_headline":"DiffSP beats nine graph attacks using no attack priors","feed_subtitle":"A clean-graph-trained diffusion model repairs perturbed structures and beats every baseline across nine datasets.","key_machinery":"The load-bearing identity is Proposition 1, which maps non-isotropic transition noise to isotropic noise with a per-edge purification time. For an edge with adversarial degree $(\\Lambda_A)_{ij}$, where $\\Lambda_A=\\Gamma\\Gamma^\\top$ is the outer product of per-node LID scores estimated from the last hidden layer of the clean-trained classifier, the non-isotropic transition element equals the isotropic transition at the unique time $\\hat{t}(A_{ij}) = T\\left(\\frac{2(1+s)}{\\pi}\\cos^{-1}\\sqrt{\\frac{\\bar\\alpha^{(t)}}{(\\Lambda_A)_{ij}(1-\\bar\\alpha^{(t)})+\\bar\\alpha^{(t)}}} - s\\right)$. This lets a standard isotropic denoiser implement non-isotropic noise injection by activating each edge for a different number of denoising steps through a binary mask $M^{(t)}_{ij} = \\mathbf{1}[t \\le \\hat{t}(A_{ij})]$. The other half is the graph transfer entropy guidance: transfer entropy $I(\\hat{G}^{(t-1)}; G_{\\mathrm{adv}} | \\hat{G}^{(t)})$ is estimated with matrix-based Rényi entropy from normalized Gram matrices of node representations, and the adjacency is updated along $\\nabla_{\\hat A^{(t-1)}} I$ with time-dependent scale $-\\lambda/(1-\\bar\\alpha^{(t)})$ to keep the generated graph aligned with the attacked graph's semantics while removing adversarial structure.","core_discovery":"DiffSP's central claim is that a graph diffusion model trained only on clean graphs can act as a prior-free purifier for graphs attacked at test time. The paper models a clean graph as a distribution over nodes and edges; an evasion attack shifts the attacked graph away from that distribution. During purification the forward process injects noise selectively according to a per-edge adversarial degree $\\Lambda_A=\\Gamma\\Gamma^\\top$, where $\\Gamma$ is the LID of each node computed from the last hidden layer of a clean-trained GNN classifier, so adversarial edges receive longer diffusion than clean ones. Proposition 1 proves that this non-isotropic noise is equivalent to isotropic noise with a per-edge diffusion time, so a standard isotropic denoiser can remove adversarial information by denoising each edge for its own duration. The reverse process then maximizes transfer entropy $I(\\hat{G}^{(t-1)}; G_{\\mathrm{adv}} | \\hat{G}^{(t)})$, estimated through matrix-based Rényi entropy, to keep the purified graph semantically aligned with the attacked graph. The paper reports that this scheme achieves the best average robustness across nine datasets against nine evasion attacks, including 75.33% average accuracy on IMDB-BINARY versus the best baseline's 70.53%, and that a model trained on one IMDb dataset purifies another with only a small accuracy drop.","pith_inferences":["Beyond the paper's experiments, the LID-derived $\\Lambda_A$ can be evaluated directly as an edge-anomaly detector: if the edges assigned the longest purification times are exactly the edges the attack flipped, DiffSP's gain is largely targeted edge removal; if not, the gain comes from global re-sampling.","Because the transfer-entropy anchor is the attacked graph, the guidance is only as good as the attack's preservation of overall semantics; a natural untested extension is to anneal the anchor's influence or replace it with the clean-trained model's own reconstruction as denoising proceeds.","Since features are excluded from the diffusion process, the current formulation would likely need a second purification channel to handle feature-based attacks, which the paper lists as future work.","The complexity analysis places the method at $O(TN^2)$, so on graphs much larger than the tested ones the LID and Gram-matrix entropy computations would need sampling or approximation; the paper does not demonstrate scalability beyond these datasets."],"forward_implications":["If DiffSP is right, robust graph learning no longer needs hand-picked priors such as homophily or low-rank structure; one clean-graph-trained diffusion model can learn the relevant distribution directly from data.","Because node features are kept fixed and only the adjacency is diffused, the method applies both to attributed graphs and to graphs without node features, such as IMDB-BINARY, REDDIT-BINARY, and PolBlogs.","The edge-specific purification schedule keeps accuracy stable as the total number of diffusion steps grows, since clean edges are not over-perturbed after their individual purification time has passed.","The method generalizes across datasets of the same category: training on IMDB-MULTI and purifying IMDB-BINARY loses only about one accuracy point on average compared with same-dataset training.","The paper's own analysis notes that DiffSP is strongest against strong structured attacks and weaker against Random and DICE perturbations, whose added edges often look plausible and lack a distinct adversarial signal."],"supporting_citations":[{"why":"Supplies the discrete-state Markov diffusion formulation, transition matrices, and denoising objective used to train DiffSP.","marker":"[3]"},{"why":"Provides the graph discrete diffusion model with edge-state marginal transition matrices used in the forward noising process.","marker":"[49]"},{"why":"Supplies the asynchronous denoising training objective in which the denoiser predicts A(0) and uses the closed-form posterior.","marker":"[31]"},{"why":"Defines local intrinsic dimensionality, the statistic DiffSP uses to score how far a node has deviated from the clean data manifold.","marker":"[21]"},{"why":"Shows that adversarial points exhibit elevated LID relative to natural data, motivating the use of LID as a per-node adversarial degree.","marker":"[37]"},{"why":"Provides the maximum-likelihood estimator used to compute each node's LID value from its k nearest-neighbor distances.","marker":"[2]"},{"why":"Inspires Proposition 1, the mapping from non-isotropic noise to isotropic noise with a per-edge adjusted diffusion time.","marker":"[63]"},{"why":"Supplies the matrix-based Rényi entropy and joint-entropy estimators that make transfer-entropy guidance computable.","marker":"[62]"},{"why":"Defines PR-BCD and GR-BCD, two of the evasion attacks used in the evaluation, as well as the robustness-at-scale comparison setting.","marker":"[17]"},{"why":"Defines Nettack, the degree-preserving targeted evasion attack used in the node classification evaluation.","marker":"[71]"}],"fun_headline_variants":["DiffSP purifies attacked graphs without attack priors","Prior-free diffusion purifier beats nine graph attacks","DiffSP: LID-driven diffusion purification bests nine attacks","DiffSP beats nine attacks with zero priors"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method assumes that the product of two nodes' local-dimensionality scores is always a number between 0 and 1 for every edge, and the paper neither enforces nor verifies that range.","fun_headline_variants_meta":{"raw":{"variants":["DiffSP purifies attacked graphs without attack priors","Prior-free diffusion purifier beats nine graph attacks","DiffSP: LID-driven diffusion purification bests nine attacks","DiffSP beats nine attacks with zero priors"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000888,"raw_usage":{"total_tokens":3872,"prompt_tokens":1023,"completion_tokens":2849,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":639,"completion_tokens_details":{"reasoning_tokens":2786}},"tokens_in":639,"tokens_out":2849,"duration_ms":21542,"temperature":1.0,"reasoning_tokens":2786,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-08T20:39:01.194244+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Measure the LID vector $\\Gamma$ from the trained classifier's last hidden layer on any dataset in the paper, form $\\Lambda_A=\\Gamma\\Gamma^\\top$, and inspect the distribution of its entries; if a material fraction of edges falls outside $[0,1]$, the unique purification time of Proposition 1 is undefined for those edges. Then compare DiffSP with $\\Lambda_A$ clamped to $[0,1]$ versus unclamped to see whether the range assumption affects accuracy.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the discrete-state Markov diffusion formulation, transition matrices, and denoising objective used to train DiffSP."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the graph discrete diffusion model with edge-state marginal transition matrices used in the forward noising process."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the asynchronous denoising training objective in which the denoiser predicts A(0) and uses the closed-form posterior."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines local intrinsic dimensionality, the statistic DiffSP uses to score how far a node has deviated from the clean data manifold."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Shows that adversarial points exhibit elevated LID relative to natural data, motivating the use of LID as a per-node adversarial degree."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the maximum-likelihood estimator used to compute each node's LID value from its k nearest-neighbor distances."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Inspires Proposition 1, the mapping from non-isotropic noise to isotropic noise with a per-edge adjusted diffusion time."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the matrix-based Rényi entropy and joint-entropy estimators that make transfer-entropy guidance computable."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines PR-BCD and GR-BCD, two of the evasion attacks used in the evaluation, as well as the robustness-at-scale comparison setting."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines Nettack, the degree-preserving targeted evasion attack used in the node classification evaluation."}],"review_version":1}