Adding perturbations directly to every hidden embedding of a GNN is claimed to subsume existing feature-, edge-, and weight-perturbation defenses, but the claim rests on simplifications that the experiments do not actually test.
Adversarial Cooperative Rationalization: The Risk of Spurious Correlations in Even Clean Datasets
1 Pith paper cite this work. Polarity classification is still indexing.
abstract
This study investigates the self-rationalization framework constructed with a cooperative game, where a generator initially extracts the most informative segment from raw input, and a subsequent predictor utilizes the selected subset for its input. The generator and predictor are trained collaboratively to maximize prediction accuracy. In this paper, we first uncover a potential caveat: such a cooperative game could unintentionally introduce a sampling bias during rationale extraction. Specifically, the generator might inadvertently create an incorrect correlation between the selected rationale candidate and the label, even when they are semantically unrelated in the original dataset. Subsequently, we elucidate the origins of this bias using both detailed theoretical analysis and empirical evidence. Our findings suggest a direction for inspecting these correlations through attacks, based on which we further introduce an instruction to prevent the predictor from learning the correlations. Through experiments on six text classification datasets and two graph classification datasets using three network architectures (GRUs, BERT, and GCN), we show that our method not only significantly outperforms recent rationalization methods, but also achieves comparable or even better results than a representative LLM (llama3.1-8b-instruct).
citation-role summary
citation-polarity summary
fields
cs.LG 1years
2025 1verdicts
REJECT 1roles
background 1polarities
unclear 1representative citing papers
citing papers explorer
-
Unifying Adversarial Perturbation for Graph Neural Networks
Adding perturbations directly to every hidden embedding of a GNN is claimed to subsume existing feature-, edge-, and weight-perturbation defenses, but the claim rests on simplifications that the experiments do not actually test.