{"id":"8d850912-9c39-4715-97aa-83cadfc7bd7a","arxiv_id":"2504.20848","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"De2GNN reduces degree bias in adversarial defenses by removing heterophilic links, adding homophilic links to tail nodes, and fusing a kNN feature view through node-wise attention, improving tail-node accuracy under Metattack.","lead":"Low-degree nodes are the weak spot of graph neural network defenses. This paper proposes De2GNN, which removes suspicious links, adds helpful links to low-degree nodes, and combines two graph views with attention, reporting better robustness under attack on three citation datasets.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"De2GNN's debiasing claim is not supported because the paper compares only against defense baselines (GCN, Jaccard, SVD, RGCN, Median) and never against degree-debiasing GNNs listed in §II-C.","rationale":"Good-faith reading: the paper's empirical core is the tail-node accuracy table (Table III) and Fig. 6 degree-stratified accuracy. The authors are honest about ablations and expose each module's contribution. The defense result is solid: De2GNN beats Jaccard by 2-3% on tail nodes across datasets. However, the conclusion uses the word 'debias' or 'mitigate structural bias' prominently, and this is a comparative claim: a structural bias is mitigated if the accuracy gap between low- and high-degree nodes shrinks relative to methods that already address that gap. The chosen baselines are all defense methods; none of them has a debiasing mechanism, so beating them on tail nodes is unsurprising and does not establish 'mitigation.' The surrogate-level concern (reliability of homophilic pseudo-edges) is secondary: the ablation shows the homophilic addition helps, and the kNN view is feature-based and attack-agnostic, so even if the surrogate is imperfect, the method still enriches neighborhoods. The missing-baseline issue is more load-bearing because it undermines the interpretation of the central result, not just an internal mechanism. The concrete test proposed is standard practice and would settle whether the debiasing contribution is real or merely a byproduct of overall robustness.","tokens_in":16867,"tokens_out":6867,"duration_ms":71190,"concrete_test":"Run the same 25% Metattack experiment on Cora, Citeseer, and Pubmed with Tail-GNN, RawlsGCN, LTE4G, and a simple non-surrogate baseline that adds kNN edges to tail nodes, under the paper's 10/10/80 split and evaluation protocol. If any of these methods reaches tail-node accuracy within 1-2% of De2GNN in Table III, or reduces the high-degree/low-degree accuracy gap comparably, then the debiasing contribution is not specific to De2GNN's design and the paper's central claim should be weakened. If De2GNN clearly outperforms all of them, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's headline claim (Section VII) is that De2GNN 'defends against possible adversarial perturbations and mitigates the structural bias on nodes with low degree simultaneously.' The evidence for the defense half is Table III, where De2GNN beats five defense baselines. But the debiasing half is only measured against GCN, Jaccard, SVD, RGCN, and Median (Section VI-B), none of which attempts to mitigate degree bias; the degree-debiasing methods reviewed in Section II-C (Tang et al. [18], Tail-GNN [19], LTE4G [20], RawlsGCN [21], Liu et al. [22]) are absent from the experiments. As a result, the tail-node accuracy gains in Table III could reflect the fact that the baselines are not optimized for tail nodes, rather than a genuine debiasing property of the hetero-homo/kNN/attention architecture. The paper also never reports the high-degree vs. low-degree accuracy gap before and after defense, so 'mitigation of structural bias' is not quantified relative to any debiasing-aware method. The ablation (Table IV) shows each module contributes, but this is internal; it does not locate De2GNN with respect to the existing debiasing literature. Without such comparisons, the central claim that De2GNN 'mitigates' structural bias is not empirically established; the claim reduces to 'achieves good tail accuracy under Metattack,' which is weaker than stated.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies the structural (degree) bias of graph adversarial defenses: defense GNNs are shown empirically to perform worse on low-degree ('tail') nodes under Metattack perturbations. The authors propose De2GNN, a framework that (i) removes heterophilic links based on feature similarity, (ii) adds homophilic links to tail nodes using predictions of a surrogate GNN, (iii) constructs a kNN-based feature graph, and (iv) fuses the two graph views with a node-wise attention mechanism. Experiments on Cora, Citeseer, and Pubmed under 25% Metattack compare De2GNN with GCN, Jaccard, SVD, RGCN, and Median, reporting all-node and tail-node (degree ≤ 5) accuracy, ablations, and parameter sensitivity. The paper concludes that De2GNN can defend against adversarial perturbations and mitigate structural bias simultaneously.","tokens_in":17121,"tokens_out":2846,"duration_ms":29089,"significance":"The paper identifies a real and underexplored problem: adversarial defense methods can inherit or even amplify the degree bias of standard GNNs. The proposed architecture is simple, modular, and the empirical gains on tail nodes are consistent across datasets: Table III shows the largest tail-node improvements on Cora (0.7491 vs. 0.7135 for Jaccard) and Pubmed (0.8487 vs. 0.8399 for SVD), with standard deviations over 10 runs. The ablation study (Table IV) demonstrates that each component contributes, and the parameter sensitivity analysis suggests robustness to p and k. The kNN view is a sensible attack-agnostic augmentation. However, the central claim that De2GNN 'mitigates structural bias' is not yet supported by the experimental design, because no degree-debiasing baseline is compared and no bias-gap metric is reported; the paper also does not fully specify how hyperparameters were selected. With additional experiments and clarifications, the contribution would be a useful step toward fairness-aware robust GNNs.","major_comments":[{"comment":"The debiasing claim is not empirically established because the evaluation includes no degree-debiasing baselines. Section VI-B compares only GCN, Jaccard, SVD, RGCN, and Median, none of which attempts to mitigate degree bias; the methods reviewed in Section II-C (Tang et al. [18], Tail-GNN [19], LTE4G [20], RawlsGCN [21], Liu et al. [22]) are absent from the experiments. As a result, the tail-node accuracy gains in Table III could reflect the fact that the baselines are not optimized for tail nodes, rather than a genuine debiasing property of De2GNN. Moreover, the paper never reports the high-degree versus low-degree accuracy gap before and after defense, so the 'mitigation of structural bias' stated in Section VII is not quantified relative to any debiasing-aware method. I recommend adding at least two or three degree-debiasing baselines from Section II-C and reporting balanced accuracy or the gap between degree groups, while keeping the adversarial setting.","section":"VI-B, VI-D, VII"},{"comment":"The hyperparameter selection procedure for t1 and t2 is under-specified. Section VI-C states that t1 and t2 are determined by grid search over [0, 0.5] and [0.5, 0.9], respectively, but it does not state which data split is used for the search. Since the test set is defined as 80% of nodes and all reported accuracies in Tables II and III are on the test set, a grid search performed on the test set would make the comparisons optimistic and would not reflect a realistically deployable procedure. Please specify that a validation split was used, report the selected t1 and t2 values for each dataset, and state whether the same split was used for all baselines.","section":"VI-C, VI-D"},{"comment":"The defense claim is overbroad because only one attack scenario is evaluated: Metattack with 25% injected links. The conclusion in Section VII says De2GNN can 'defend against possible adversarial perturbations', but no Nettack, DICE, or other attack types, and no varying perturbation rates, are tested. The method's link-removal and link-addition steps may behave very differently under remove-link attacks or feature attacks. Adding at least one more attack type or a perturbation-rate sweep would substantially strengthen the generality of the claim; without it, the paper's central defense result is limited to one global poisoning attack.","section":"VI-C, VI-D2, VII"}],"minor_comments":[{"comment":"The captions and axis labels of Figures 1-6 appear corrupted in the submitted PDF (e.g., repeated glyph sequences), making the figures unreadable. Please regenerate them with proper labels.","section":"Figures 1-6"},{"comment":"The text after Figure 7 and after Figure 8 appears to have swapped p and k: the first paragraph says 'From Fig. 8 ... different settings of p' and the second says 'For the number of added nodes ... varied k', but Figures 7 and 8 are captioned as p and k, respectively.","section":"Section VI-D5"},{"comment":"For Pubmed, the tail-node accuracy of De2GNN (0.8487) is slightly higher than its all-node accuracy (0.8470). This unusual inversion should be briefly explained, since it suggests the tail-node subset is not consistently harder under the augmented graph.","section":"Table III"},{"comment":"The attention mechanism's dimensions are not fully specified: it should be stated whether the sigma-activated projection produces two logits per node and how alpha_{·,0} and alpha_{·,1} are normalized.","section":"Section V-C, Eqs. (13)-(15)"},{"comment":"The description 'top p nodes which have the highest probabilities that belong to the same class as v' is ambiguous: it should be clarified whether the same-class condition is based on the surrogate model's predicted label or on the node's true label when v is a training node.","section":"Section V-A2, Eq. (9)"},{"comment":"The statement 'All defense methods are adopted from the default parameter settings' is too vague; please report the actual configurations (e.g., hidden dimensions, layers, learning rate) for all baselines and for De2GNN.","section":"Section VI-C"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses a timely intersection of robustness and fairness in GNNs, and the empirical gains are consistent, but the experimental design currently does not support the debiasing claim as stated. I would encourage the editor to request the additional debiasing baselines and the bias-gap analysis rather than rejecting, since these are feasible within the paper's scope. Also note that the manuscript formatting is not yet publication-ready: several figures are unreadable and the parameter text is inconsistent."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Let me give you the short version. De2GNN is a reasonable heuristic defense that, on three citation datasets under one Metattack setting, gets better tail-node accuracy than GCN, Jaccard, SVD, RGCN, and Median. The architecture—Jaccard-style heterophilic link removal, kNN construction, and node-wise attention—is new as a combination, and the paper's opening observation that existing defenses show a degree bias is worth taking seriously. The ablations make a plausible case that each module pulls its weight.\n\nThe load-bearing soft spot is the debiasing claim. The paper says De2GNN 'mitigates structural bias' but never compares against the degree-debiasing GNNs it cites in Section II-C: Tail-GNN, LTE4G, RawlsGCN, and the others. Those methods exist precisely to improve tail-node accuracy, and they are discussed in detail but absent from every table. Without them, the result only shows the defense is better than five methods that do not try to debias. That is a useful result, but it does not establish a debiasing advantage over the methods that actually target the bias. The conclusion outruns the evidence.\n\nThere are also smaller issues. The t1/t2 grid search is described without any validation split, so I cannot tell whether the reported numbers were selected on the test set. The homophilic-link addition relies on a surrogate GNN's confidence for tail nodes, which is exactly where surrogates are least trustworthy; the paper never reports how many edges get added or how often the pseudo-labels are wrong. Only one attack (Metattack at 25% perturbation) is used, so the generality is an open question. And the parameter analysis swaps the descriptions of p and k between the text and figures, which does not inspire confidence in the write-up.\n\nNone of this is fatal for the central empirical observation. The paper deserves a serious referee, partly because the missing-baseline problem is fixable and the question is genuinely interesting. I would ask for a revision that adds at least Tail-GNN and RawlsGCN (with and without the proposed augmentation) to the comparison, clarifies how the thresholds were chosen, and reports the surrogate's edge-addition statistics.","headline":"A useful heuristic defense with a real evaluation gap: it beats five defense baselines on tail nodes, but the debiasing claim is not tested against the methods that actually target degree bias.","tokens_in":17740,"tokens_out":3171,"would_cite":true,"duration_ms":31192,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that graph adversarial defenses under-serve low-degree nodes, and that a two-view purified-plus-kNN architecture closes that gap while defending attacks.","keywords":["graph neural networks","graph adversarial defense","structural bias","degree bias","tail nodes","hetero-homo augmented graph","kNN augmented graph","node-wise attention"],"falsifier":"Corrupt the surrogate's pseudo-labels for tail nodes before the homophilic-link addition (for example, flip them for a random 20% of tail nodes), rerun De2GNN under the same 25% Metattack, and check whether tail-node accuracy drops substantially; the paper's debiasing story requires a large drop, whereas a small drop would indicate the benefit comes from the kNN view or attention rather than the surrogate-guided edges.","tokens_in":16588,"feed_emoji":"🛡️","tokens_out":8880,"duration_ms":79404,"temperature":0.7,"pith_summary":"The paper tries to establish that existing graph adversarial defenses, while improving overall accuracy, remain structurally biased: they recover high-degree nodes much better than low-degree ones, and it proposes a single framework, De2GNN, that defends against attacks and reduces that bias at the same time. The argument is that a purified graph obtained by removing dissimilar-feature links and adding same-feature links for tail nodes, combined with a feature-only kNN graph through node-wise attention, gives low-degree nodes enough trustworthy neighborhood information to survive adversarial perturbations. The empirical claim is that under 25% Metattack, De2GNN outperforms GCN, Jaccard, SVD, RGCN, and Median on tail-node accuracy across Cora, Citeseer, and Pubmed, while staying competitive on clean graphs. A sympathetic reader would care because real-world networks are long-tailed, so a defense whose gains concentrate on high-degree nodes leaves most nodes underprotected.","feed_headline":"Graph defense model lifts low-degree node accuracy under attack","feed_subtitle":"De2GNN pairs cleaned topology with a feature-only graph, beating Jaccard, SVD, RGCN, and Median on tail nodes.","key_machinery":"The load-bearing mechanism is the two-view De2GNN architecture. A hetero-homo augmented graph is produced in two steps: links whose endpoints have feature similarity below threshold $t_1$ are removed (heterophilic removal), and then each tail node whose surrogate-model prediction confidence exceeds threshold $t_2$ is connected to its top $p$ nodes predicted to share its class, per Eq. (9). A second, attack-agnostic view is built by connecting each node to its $k$ nearest feature neighbors (kNN graph). Two separate GNNs encode the two views, and a node-wise attention layer (Eqs. (13)-(15)) learns per-node weights for blending the representations; this attention lets tail nodes lean on whichever view gives them more reliable context.","core_discovery":"On its own terms, the paper's central claim is that De2GNN can \"defend against possible adversarial perturbations and mitigate the structural bias on nodes with low degree simultaneously.\" Concretely, under 25% Metattack perturbation, tail-node (degree $\\leq 5$) accuracy reaches 0.7491 on Cora, 0.7082 on Citeseer, and 0.8487 on Pubmed, the best among all tested baselines in every dataset, exceeding Jaccard, SVD, RGCN, and Median; clean accuracy remains roughly competitive, with De2GNN best on Citeseer. The paper also demonstrates the structural-bias premise it builds on: GCN, Jaccard, and SVD all show a strong accuracy gap between high-degree and low-degree nodes under the same attack.","pith_inferences":["If the surrogate model's pseudo-labels for tail nodes are unreliable, the homophilic edge-addition step could quietly inject mislabeled neighbors; a natural test is to corrupt those pseudo-labels during edge construction and measure the drop in tail-node accuracy.","Because the kNN view is built only from raw features, the same two-view principle could transfer to other defense families, such as adding a feature-only view to robust aggregators; this is an extrapolation, not a claim the paper tests.","The paper evaluates only global link-injection attacks (Metattack); whether De2GNN's debiasing persists under removal-based or node-injection attacks is untested, and those scenarios could interact differently with the surrogate-guided edge additions."],"forward_implications":["If De2GNN's central claim holds, adversarial defense evaluation should report degree-stratified accuracy, since aggregate accuracy can hide poor protection for the low-degree majority.","Purification-only defenses such as Jaccard and SVD are outperformed on tail nodes by the combined purification-plus-augmentation design, suggesting that removing noise alone is insufficient for long-tailed graphs.","The ablation results imply that heterophilic link removal is the largest individual contributor: dropping it lowers Cora tail-node accuracy from 0.7491 to 0.6265 under attack.","Adding homophilic links guided by the surrogate GNN also contributes on all three datasets, since De2GNN minus this module underperforms the full model on tail nodes.","The kNN view and the attention module each add a smaller but consistent gain, so the benefit is architectural rather than coming from any single graph transformation."],"supporting_citations":[{"why":"Generates the Metattack global poisoning perturbations used in all attacked experiments, defining the threat model De2GNN defends against.","marker":"[32]"},{"why":"Provides the Jaccard feature-similarity defense on which the heterophilic-link removal step is based.","marker":"[9]"},{"why":"Supplies the tail-node concept and the degree threshold (degree ≤ 5) used to define the low-degree group.","marker":"[17]"},{"why":"SVD low-rank preprocessing is a baseline the paper must beat on tail-node accuracy.","marker":"[13]"},{"why":"RGCN robust aggregator with variance-based weighting is a baseline compared on all-node and tail-node accuracy.","marker":"[14]"},{"why":"Median aggregation defense is a baseline compared on all-node and tail-node accuracy.","marker":"[15]"},{"why":"GCN is the backbone layer of De2GNN's two GNNs and the standard non-defense baseline.","marker":"[23]"}],"fun_headline_variants":["De2GNN cuts structural bias in graph defense","Tail-node defense: De2GNN lifts low-degree accuracy","Graph defense debiased for low-degree nodes","De2GNN: stronger GNN defense for tail nodes","Bias-aware graph defense boosts tail node robustness"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the surrogate GNN trained on the purified graph predicts same-class neighbors for low-degree nodes accurately enough that adding those edges improves the final model, rather than contaminating it with mislabeled connections.","fun_headline_variants_meta":{"raw":{"variants":["De2GNN cuts structural bias in graph defense","Tail-node defense: De2GNN lifts low-degree accuracy","Graph defense debiased for low-degree nodes","De2GNN: stronger GNN defense for tail nodes","Bias-aware graph defense boosts tail node robustness"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000126,"raw_usage":{"total_tokens":1122,"prompt_tokens":969,"completion_tokens":153,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":585,"completion_tokens_details":{"reasoning_tokens":75}},"tokens_in":585,"tokens_out":153,"duration_ms":2281,"temperature":1.0,"reasoning_tokens":75,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T05:17:29.302252+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Corrupt the surrogate's pseudo-labels for tail nodes before the homophilic-link addition (for example, flip them for a random 20% of tail nodes), rerun De2GNN under the same 25% Metattack, and check whether tail-node accuracy drops substantially; the paper's debiasing story requires a large drop, whereas a small drop would indicate the benefit comes from the kNN view or attention rather than the surrogate-guided edges.","supporting_citations":[{"cited_title":"Adversarial attacks on graph neural networks via meta learning,","cited_arxiv_id":null,"evidence_quote":"Generates the Metattack global poisoning perturbations used in all attacked experiments, defining the threat model De2GNN defends against."},{"cited_title":"Adversarial examples for graph data: Deep insights into attack and defense,","cited_arxiv_id":null,"evidence_quote":"Provides the Jaccard feature-similarity defense on which the heterophilic-link removal step is based."},{"cited_title":"Towards locality- aware meta-learning of tail node embeddings on networks,","cited_arxiv_id":null,"evidence_quote":"Supplies the tail-node concept and the degree threshold (degree ≤ 5) used to define the low-degree group."},{"cited_title":"Robust graph convolutional networks against adversarial attacks,","cited_arxiv_id":null,"evidence_quote":"RGCN robust aggregator with variance-based weighting is a baseline compared on all-node and tail-node accuracy."},{"cited_title":"Understanding structural vulnerability in graph convolutional networks,","cited_arxiv_id":null,"evidence_quote":"Median aggregation defense is a baseline compared on all-node and tail-node accuracy."},{"cited_title":"Semi-supervised classification with graph convolutional networks,","cited_arxiv_id":null,"evidence_quote":"GCN is the backbone layer of De2GNN's two GNNs and the standard non-defense baseline."}],"review_version":1}