Transferring Robustness for Graph Neural Network Against Poisoning Attacks

Huaxiu Yao; Prasenjit Mitra; Suhang Wang; Xianfeng Tang; Yandong Li; Yiwei Sun

REVIEW 3 major objections 5 minor 56 references

Transferring Robustness for Graph Neural Network Against Poisoning Attacks

T0 review · 3 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read PA-GNN claims that a graph neural network can learn to penalize adversarial edges on clean graphs and transfer that defense to a poisoned target graph through meta-optimization.

desk verdict Solid transfer-based GNN defense with real experimental support, but its non-targeted robustness claim only covers metattack; worth reviewing with a request for an unseen attack evaluation. read the letter →

arxiv 1908.07558 v3 pith:4KRYGKNZ submitted 2019-08-20 cs.LG cs.CRcs.SIstat.ML

Xianfeng Tang , Yandong Li , Yiwei Sun , Huaxiu Yao , Prasenjit Mitra , Suhang Wang This is my paper · ORCID

classification cs.LGcs.CRcs.SIstat.ML

keywords graphneuralnetworksadversarialpoisoningattacksrobustnesstransfermeta-learningpenalizedaggregationattentioncoefficientsnodeclassificationdefense

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to show that a graph neural network can be made robust to poisoning attacks—where an attacker injects edges into the training graph—by first learning what adversarial edges look like on clean graphs from similar domains. It proposes PA-GNN, which uses a penalized aggregation mechanism to assign lower attention coefficients to perturbed edges, and a meta-optimization algorithm that transfers this penalization ability to the poisoned target graph. If the claim is right, robustness can be bought from auxiliary unpoisoned graphs instead of guessed from the poisoned graph alone. Experiments on citation, social, and review networks report that PA-GNN keeps higher node-classification accuracy than prior robust GNNs under non-targeted, targeted, and random poisoning attacks.

What carries the argument

The two load-bearing components are the penalized aggregation mechanism and the meta-optimization algorithm. In each layer, normalized attention coefficients $\alpha^l_{ij}$ control how much neighbor $j$'s message contributes to node $i$. A margin loss $\mathcal{L}_{\mathrm{dist}}$ compares the mean attention on known perturbed edges with the mean on normal edges and penalizes the model until the perturbed-edge mean is lower by at least $\eta$; this is added to the cross-entropy classification loss. The meta-optimization, built on model-agnostic meta-learning, treats each clean graph with its metattack-injected edges as a task: parameters are adapted on a support set, and the meta-objective sums task losses on query sets so the learned initialization adapts quickly while retaining the penalization behavior. Fine-tuning that initialization on the poisoned target graph with only the classification loss completes the transfer.

What would settle it

Train PA-GNN exactly as described, then attack the target graph with a non-targeted poisoning method that is not metattack—for instance, an optimization-based attack with a different surrogate model or a budget/degree distribution unlike metattack's. If the fine-tuned model's accuracy falls to the level of an undefended GNN, or if the measured attention coefficients on the new attack's edges are not lower than on normal edges, the claim that the penalization ability transfers would be falsified.

Watch

Extended reading notes

Core claim

PA-GNN establishes that the ability to detect and down-weight adversarial edges is transferable across graphs. Clean graphs are poisoned with metattack to create supervised knowledge of which edges are adversarial; the model is trained so that the average attention coefficient on those edges is pushed below the average on normal edges by a margin. A model-agnostic meta-learning loop then optimizes an initialization that, after a few gradient steps on a new poisoned graph, still penalizes adversarial edges while keeping classification accuracy high. On four datasets, including cross-city review graphs, PA-GNN outperforms GCN, GAT, preprocessing-based defenses, RGCN, and VPN under metattack, nettack, and random edge flips; attention-coefficient measurements show perturbed edges receive lower attention after fine-tuning than without the penalized aggregation.

Load-bearing premise

The entire transfer rests on the assumption that adversarial edges on the target poisoned graph resemble the metattack-generated perturbations used to train the clean graphs closely enough that the learned penalization still applies after fine-tuning; the paper's main non-targeted evaluation also uses metattack, so robustness under a genuinely different non-targeted poisoning attack is not demonstrated.

Editorial extensions

If this is right

Under metattack with a 30% perturbation rate, PA-GNN keeps about 75.5% accuracy on Pubmed and 84.5% on Reddit, while GCN falls to about 67.1% and 80.9% respectively.
The defense generalizes to targeted nettack attacks and random edge flips even though training perturbations are generated by metattack.
Ablation removes the penalized aggregation (lambda=0) or the meta-optimization (joint training) and accuracy drops, so both components contribute to robustness.
Attention-coefficient measurements show that after fine-tuning on the poisoned graph, perturbed edges receive lower mean attention than normal edges, indicating the penalization survives transfer.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A testable extension not explored in the paper: an adaptive attack that knows PA-GNN's margin loss and crafts edges specifically to evade the attention penalty would likely stress the transfer claim.
Because the margin loss needs known perturbed edges, the framework could be extended to estimate edge-adversarialness on the target graph itself (e.g., from feature similarity or prediction confidence) and apply the penalty without clean graphs.
The meta-initialization idea is not tied to attention: applying the same support/query meta-loop to a GCN with learnable edge masks would test whether the transfer mechanism generalizes beyond attention coefficients.
The same-domain and similar-domain results suggest that auxiliary data sources need not come from the same distribution; an actionable implication is that organizations can pool unpoisoned graphs from neighboring markets to harden a deployed GNN.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Both the reader and stress-test are roughly right, though the stress-test overstates the problem slightly. The paper's main non-targeted robustness claim is indeed demonstrated only against metattack, which is also the attack used to create the meta-training perturbations. But the paper also evaluates against nettack and random attacks, and those results are not trivial—they show the penalization behavior transfers at least to other attack families. So the core concern is not that the model is a metattack specialist; it's that we don't know how it handles a different non-targeted poisoning attack, since none is tested.

What's actually new: using clean graphs from similar domains as supervision for adversarial-edge detection, via a penalized aggregation loss that enforces a margin between attention coefficients on normal and perturbed edges, and a MAML-style meta-optimization that transfers this penalization ability to the poisoned target graph. The combination is new, and the experiments back it up. On all four datasets, PA-GNN beats GCN, GAT, PreProcess, RGCN, and VPN at most perturbation rates, often by several points. The ablations are informative: removing the penalty (lambda=0) hurts, and replacing meta-optimization with joint training or fine-tuning also hurts, which supports the claim that both components matter. The attention-coefficient distribution plot is a nice direct check on the mechanism. I found no obvious fabrication or circular fitting; the reported numbers are consistent across runs.

The load-bearing assumption is that the target graph's adversarial-edge distribution resembles metattack-generated perturbations on clean graphs. The paper tests this only indirectly. There is no evaluation against an unseen non-targeted attack, and the metattack used at test time is computed against a plain GCN surrogate, not against PA-GNN itself. An adaptive attacker that targets the defense could likely find edges PA-GNN does not penalize. I'd also note the comparison omits a defense baseline that also uses clean graphs, which slightly weakens the 'transfer' framing—though since no prior work does this, that's a minor issue. The hyperparameters (lambda=1, eta=100) are held fixed across all datasets, and sensitivity analysis is provided, which is good. Code and data are claimed public, but I couldn't verify that from the PDF alone; the link and claimed release are a plus if real.

This is a useful paper for people working on adversarial robustness for GNNs, especially those who have access to auxiliary clean graphs. It deserves a serious referee. The experiments are extensive and the ablations are honest. For publication, I'd want to see a non-targeted attack that was not used in meta-training, ideally adaptive, and a check that the code actually runs. Those are revisions, not grounds for rejection. I'd accept it for review.

Referee Report

3 major / 5 minor

Summary. The paper proposes PA-GNN, a defense for graph neural networks against poisoning attacks that exploits additional clean graphs from domains similar to the target poisoned graph. The method introduces a penalized aggregation mechanism that lowers the attention coefficients assigned to adversarial edges, using a margin-based distribution loss Ldist, and combines it with a MAML-style meta-optimization over tasks constructed by injecting metattack perturbations into the clean graphs. The learned initialization is then fine-tuned on the poisoned target graph. Experiments on Pubmed, Reddit, Yelp-Small, and Yelp-Large compare PA-GNN with GCN, GAT, PreProcess, RGCN, and VPN under metattack, nettack, and random attacks, and include ablations and parameter sensitivity analysis.

Significance. If the transfer claim holds, the paper makes a useful contribution: it provides a concrete way to turn clean graphs from related domains into supervised signal for penalizing adversarial edges, and it presents evidence that the learned penalization behavior can survive fine-tuning on a poisoned graph. The paper's strengths include released code, 10-run averaged results, four datasets, ablations that isolate the penalized loss and the meta-optimization (PA-GNNnp, PA-GNNft, PA-GNNjt, PA-GNN2nd), and an attention-coefficient analysis showing that perturbed edges receive lower coefficients after fine-tuning. The main unaddressed risk is that the central generalization claim is tested primarily against the same attack used to generate meta-training perturbations.

major comments (3)

[§5.1.2, §4.2, Algorithm 1 line 3, Table 2] The primary non-targeted evaluation in Table 2 uses metattack, which is also the attack used to generate the meta-training perturbations in Algorithm 1 (line 3). This is a circularity risk for the central transfer claim: the model is trained to penalize edges selected by metattack on clean graphs and is then evaluated against metattack on the target graph. The random-attack (Figure 2) and nettack (Table 3) experiments provide some cross-attack evidence, but random flips are not an optimized non-targeted poison and nettack has a per-node targeted objective. The claim that PA-GNN transfers robustness to unseen non-targeted poisoning attacks therefore needs a direct test with a different optimization-based non-targeted attack, used only at evaluation time, such as a greedy or iterative poisoning attack or metattack run with a different surrogate.
[§5.1.2] The metattack perturbations used for evaluation appear to be computed against a plain GCN surrogate; the paper cites the recommended setting from [51] and does not state that the attack adapts to PA-GNN's parameters or to the final fine-tuned model. Under a defense-aware adversary that optimizes perturbations against PA-GNN itself, or against the fine-tuned model, the reported robustness margins could shrink substantially. Please report results under an adaptive attack, or at minimum clarify the threat model and state explicitly that robustness is not claimed against adaptive adversaries.
[§5.1.3, §5.2, Table 4] All external baselines are trained only on the poisoned graph (or, in the case of PreProcess, prune it using feature similarity), while PA-GNN receives additional clean graphs. Part of the improvement in Tables 2 and 3 could therefore reflect access to extra training data rather than the proposed transfer mechanism. The ablations PA-GNNft and PA-GNNjt in Table 4 address this internally, but an external comparison that supplies the clean graphs to a strong baseline (for example, pretraining or jointly training RGCN or VPN on the clean and adversarially perturbed graphs) is needed to support the statement that existing robust GNNs are sub-optimal because they fail to exploit clean graphs.

minor comments (5)

[§4.1, Eq. (5)] The summation index in Eq. (5) is written as j ∈ N_j; it should be j ∈ N_i, the neighbor set of node v_i.
[§4.2, after Eq. (13)] The sentence 'the above gradients are estimated using labeled nodes from query sets Si of all tasks' should refer to the query sets Qi, since Si denotes the support sets.
[§5.1.3] In the baseline list, GAT is cited as [14], which is the GraphSAGE reference, whereas Section 2.1 correctly cites GAT as [37] (Veličković et al.); this reference should be corrected.
[§5.3.1, Eq. (6), Table 5, Figure 3] The term 'attention coefficients' is ambiguous because Eqs. (3)-(4) distinguish the pre-softmax scores a_l_ij from the normalized coefficients alpha_l_ij; please state explicitly which quantity is used in Eq. (6)-(7) and which is plotted and averaged in Table 5 and Figure 3.
[§5.3.2, last paragraph] The sentence beginning 'PA-GNNnp consistently out-performs PA-GNNft ... shown advantages of the meta-optimization algorithm' is grammatically incomplete and should be reworded.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: PA-GNN's transfer is evaluated on unseen poisoned graphs; the metattack overlap limits generality but is not a circular reduction.

full rationale

The derivation chain in PA-GNN is not circular. The meta-optimization objective (Eqs. 10-13) and Algorithm 1 use perturbations generated by metattack on clean graphs as supervision, but the target poisoned graph G is never used to fit that supervision: the model is fine-tuned on G with only the classification loss Lc (Algorithm 1 line 13). The robustness evaluation under metattack (Table 2) measures accuracy on a different graph and on perturbation sets generated independently at test time, so the reported result is a genuine transfer test rather than an identity. The fact that the same attack algorithm generates both the meta-training perturbations and the primary non-targeted evaluation attack is a limitation on generalization to unseen non-targeted attacks, not a circular reduction: nothing in the model equations encodes the target graph's perturbation labels, and the paper's own cross-attack experiments with nettack and random flips were not used in meta-training. Self-citations (e.g., [34], [35], [44]) are background support and are not load-bearing for the central claim. No fitted parameter is renamed as a prediction, and no uniqueness theorem is imported from the authors' prior work.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The method introduces no new physical or mathematical entities. The free parameters λ and η are hand-set constants in the loss function, and the core assumptions are the availability of similar clean graphs and the transferability of metattack-based perturbations to the target poisoned graph.

free parameters (2)

lambda (λ) = 1.0
Hand-set in Section 5.1.4 to balance classification loss and penalized aggregation loss; sensitivity analysis in Section 5.4.
eta (η) = 100
Margin hyperparameter in Eq. (7), hand-set in Section 5.1.4; sensitivity analysis in Section 5.4.

assumptions (3)

domain assumption Clean graphs from similar domains exist and are accessible for the target poisoned graph.
Problem 1 and Section 5.1.1 rely on this assumption to create the supervised perturbations. If no such clean graphs exist, PA-GNN cannot be applied.
domain assumption The distribution of adversarial edges on the target graph is sufficiently similar to the metattack-generated perturbations on clean graphs for the meta-learned initialization to transfer.
This underpins the entire meta-optimization transfer in Section 4.2; if false, fine-tuning on the target graph would not retain the penalization ability.
standard math Gradient-based meta-optimization (MAML) provides a good initialization that can fast-adapt to the poisoned graph with only the classification loss Lc.
Section 4.2 adopts MAML from Finn et al. [11]; this is a standard result but still an assumption about optimization landscapes and the suitability of first-order gradients.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Transferring Robustness for Graph Neural Network Against Poisoning Attacks." pith.science (2026). https://pith.science/paper/4KRYGKNZ

@misc{pith2026190807558,
  author       = {Pith},
  title        = {Pith review of: Transferring Robustness for Graph Neural Network Against Poisoning Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4KRYGKNZ}},
  note         = {Machine review of arXiv:1908.07558}
}

read the original abstract

Graph neural networks (GNNs) are widely used in many applications. However, their robustness against adversarial attacks is criticized. Prior studies show that using unnoticeable modifications on graph topology or nodal features can significantly reduce the performances of GNNs. It is very challenging to design robust graph neural networks against poisoning attack and several efforts have been taken. Existing work aims at reducing the negative impact from adversarial edges only with the poisoned graph, which is sub-optimal since they fail to discriminate adversarial edges from normal ones. On the other hand, clean graphs from similar domains as the target poisoned graph are usually available in the real world. By perturbing these clean graphs, we create supervised knowledge to train the ability to detect adversarial edges so that the robustness of GNNs is elevated. However, such potential for clean graphs is neglected by existing work. To this end, we investigate a novel problem of improving the robustness of GNNs against poisoning attacks by exploring clean graphs. Specifically, we propose PA-GNN, which relies on a penalized aggregation mechanism that directly restrict the negative impact of adversarial edges by assigning them lower attention coefficients. To optimize PA-GNN for a poisoned graph, we design a meta-optimization algorithm that trains PA-GNN to penalize perturbations using clean graphs and their adversarial counterparts, and transfers such ability to improve the robustness of PA-GNN on the poisoned graph. Experimental results on four real-world datasets demonstrate the robustness of PA-GNN against poisoning attacks on graphs. Code and data are available here: https://github.com/tangxianfeng/PA-GNN.

Figures

Figures reproduced from arXiv: 1908.07558 by the authors.

**Figure 2.** Node classification accuracy under random attack. [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗

**Figure 3.** We further report their mean values in Table 5. Without [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗

Figures from the paper (1 more)

**Figure 4.** Figure 4: Parameter sensitivity analysis [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

56 extracted references · 32 canonical work pages

[51]

Jiani Zhang, Xingjian Shi, Junyuan Xie, Hao Ma, Irwin King, and Dit-Yan Yeung

work page
[1]

Leman Akoglu, Hanghang Tong, and Danai Koutra. 2015. Graph based anomaly detection and description: a survey. Data mining and knowledge discovery 29, 3 (2015), 626–688

work page 2015
[2]

Aleksandar Bojchevski and Stephan Günnemann. 2019. Adversarial Attacks on Node Embeddings via Graph Poisoning. In ICML

2019
[3]

Joan Bruna, Wojciech Zaremba, Arthur Szlam, and Yann LeCun. 2013. Spectral net- works and locally connected networks on graphs. arXiv preprint arXiv:1312.6203 (2013)

arXiv 2013
[4]

Jinyin Chen, Yangyang Wu, Xuanheng Xu, Yixian Chen, Haibin Zheng, and Qi Xuan. 2018. Fast gradient attack on network embedding. arXiv preprint arXiv:1809.02797 (2018)

arXiv 2018
[5]

Minhao Cheng, Thong Le, Pin-Yu Chen, Jinfeng Yi, Huan Zhang, and Cho-Jui Hsieh. 2018. Query-efficient hard-label black-box attack: An optimization-based approach. arXiv preprint arXiv:1807.04457 (2018)

arXiv 2018
[6]

Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, and Le Song. 2018. Adversarial attack on graph structured data. ICML (2018)

work page 2018
[7]

Michaël Defferrard, Xavier Bresson, and Pierre Vandergheynst. 2016. Convolu- tional neural networks on graphs with fast localized spectral filtering. InAdvances in neural information processing systems . 3844–3852

work page 2016

Show all 56 references

[8]

Kaize Ding, Jundong Li, Rohit Bhanushali, and Huan Liu. 2019. Deep Anomaly Detection on Attributed Networks. In SDM

2019
[9]

Kaize Ding, Yichuan Li, Jundong Li, Chenghao Liu, and Huan Liu. 2019. Graph Neural Networks with High-order Feature Interactions. arXiv preprint arXiv:1908.07110 (2019)

2019 arXiv
[10]

Wenqi Fan, Yao Ma, Qing Li, Yuan He, Eric Zhao, Jiliang Tang, and Dawei Yin
[11]

Chelsea Finn, Pieter Abbeel, and Sergey Levine. 2017. Model-agnostic meta- learning for fast adaptation of deep networks. In ICML

2017
[12]

Hongyang Gao, Zhengyang Wang, and Shuiwang Ji. 2018. Large-scale learnable graph convolutional networks. In KDD

2018
[13]

Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)

2014 arXiv
[14]

Will Hamilton, Zhitao Ying, and Jure Leskovec. 2017. Inductive representation learning on large graphs. In NeurIPS

2017
[15]

Mikael Henaff, Joan Bruna, and Yann LeCun. 2015. Deep convolutional networks on graph-structured data. arXiv preprint arXiv:1506.05163 (2015)

2015 arXiv
[16]

Sepp Hochreiter, A Steven Younger, and Peter R Conwell. 2001. Learning to learn using gradient descent. In ICANN. Springer, 87–94

2001
[17]

Chao Huang, Xian Wu, Xuchao Zhang, Chuxu Zhang, Jiashu Zhao, Dawei Yin, and Nitesh V Chawla. 2019. Online Purchase Prediction via Multi-Scale Modeling of Behavior Dynamics. In KDD. ACM, 2613–2622

2019
[18]

Ming Jin, Heng Chang, Wenwu Zhu, and Somayeh Sojoudi. 2019. Power up! Robust Graph Convolutional Network against Evasion Attacks based on Graph Powering. arXiv preprint arXiv:1905.10029 (2019)

2019 arXiv
[19]

Thomas N Kipf and Max Welling. 2016. Semi-Supervised Classification with Graph Convolutional Networks. arXiv preprint arXiv:1609.02907 (2016)

2016 arXiv
[20]

Jaekoo Lee, Hyunjae Kim, Jongsun Lee, and Sungroh Yoon. 2017. Transfer learning for deep learning on graph-structured data. In AAAI

2017
[21]

Ruirui Li, Liangda Li, Xian Wu, Yunhong Zhou, and Wei Wang. 2019. Click Feedback-Aware Query Recommendation Using Adversarial Examples. In The World Wide Web Conference. ACM, 2978–2984

2019
[22]

Ruoyu Li, Sheng Wang, Feiyun Zhu, and Junzhou Huang. 2018. Adaptive graph convolutional neural networks. In AAAI

2018
[23]

Yingwei Li, Song Bai, Cihang Xie, Zhenyu Liao, Xiaohui Shen, and Alan L Yuille
[24]

Yingwei Li, Song Bai, Yuyin Zhou, Cihang Xie, Zhishuai Zhang, and Alan Yuille
[25]

arXiv preprint arXiv:1904.00979 (2019)

Regional Homogeneity: Towards Learning Transferable Universal Adver- sarial Perturbations Against Defenses. arXiv preprint arXiv:1904.00979 (2019)

2019 arXiv
[26]

Aggarwal, and Jiliang Tang

Yao Ma, Suhang Wang, Charu C. Aggarwal, and Jiliang Tang. 2019. Graph Convolutional Networks with EigenPooling. In KDD

2019
[27]

Aggarwal, Dawei Yin, and Jiliang Tang

Yao Ma, Suhang Wang, Charu C. Aggarwal, Dawei Yin, and Jiliang Tang. 2019. Multi-dimensional Graph Convolutional Networks. In SDM

2019
[28]

Yandong Li, Lijun Li, Liqiang Wang, Tong Zhang, and Boqing Gong. 2019. NAT- TACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks. ICML (2019)

2019
[29]

Federico Monti, Davide Boscaini, Jonathan Masci, Emanuele Rodola, Jan Svoboda, and Michael M Bronstein. 2017. Geometric deep learning on graphs and manifolds using mixture model cnns. In CVPR

2017
[30]

Mathias Niepert, Mohamed Ahmed, and Konstantin Kutzkov. 2016. Learning convolutional neural networks for graphs. In ICML

2016
[31]

Yao Ma, Suhang Wang, Lingfei Wu, and Jiliang Tang. 2019. Attacking Graph Convolutional Networks via Rewiring. arXiv preprint:1906.03750 (2019)

2019 arXiv
[32]

Adam Santoro, Sergey Bartunov, Matthew Botvinick, Daan Wierstra, and Timothy Lillicrap. 2016. Meta-learning with memory-augmented neural networks. In ICML

2016
[33]

Prithviraj Sen, Galileo Namata, Mustafa Bilgic, Lise Getoor, Brian Galligher, and Tina Eliassi-Rad. 2008. Collective classification in network data. AI magazine 29, 3 (2008), 93–93

2008
[34]

Jeffrey Pennington, Richard Socher, and Christopher Manning. 2014. Glove: Global vectors for word representation. In EMNLP

2014
[35]

Yiwei Sun, Suhang Wang, Xianfeng Tang, Tsung-Yu Hsieh, and Vasant Honavar
[36]

Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. In Advances in neural information processing systems . 5998–6008

2017
[37]

Kai Shu, Suhang Wang, Jiliang Tang, Yilin Wang, and Huan Liu. 2018. Crossfire: Cross media joint friend and item recommendations. In WSDM

2018
[38]

Oriol Vinyals, Charles Blundell, Timothy Lillicrap, Daan Wierstra, et al . 2016. Matching networks for one shot learning. In Advances in neural information processing systems. 3630–3638

2016
[39]

arXiv preprint arXiv:1909.06543 (2019)

Node Injection Attacks on Graphs via Reinforcement Learning. arXiv preprint arXiv:1909.06543 (2019)

2019 arXiv
[40]

Huijun Wu, Chen Wang, Yuriy Tyshetskiy, Andrew Docherty, Kai Lu, and Liming Zhu. 2019. Adversarial Examples on Graph Data: Deep Insights into Attack and Defense. In IJCAI

2019
[41]

Petar Veličković, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Lio, and Yoshua Bengio. 2017. Graph attention networks. arXiv preprint arXiv:1710.10903 (2017)

2017 arXiv
[42]

Han Xu, Yao Ma, Haochen Liu, Debayan Deb, Hui Liu, Jiliang Tang, and Anil Jain. 2019. Adversarial attacks and defenses in images, graphs and text: A review. arXiv preprint arXiv:1909.08072 (2019)

2019 arXiv
[43]

Felix Wu, Tianyi Zhang, Amauri Holanda de Souza Jr, Christopher Fifty, Tao Yu, and Kilian Q Weinberger. 2019. Simplifying graph convolutional networks.arXiv preprint arXiv:1902.07153 (2019)

2019 arXiv
[44]

Huaxiu Yao, Yiding Liu, Ying Wei, Xianfeng Tang, and Zhenhui Li. 2019. Learning from Multiple Cities: A Meta-Learning Approach for Spatial-Temporal Prediction. In The World Wide Web Conference. ACM, 2181–2191

2019
[45]

Zonghan Wu, Shirui Pan, Fengwen Chen, Guodong Long, Chengqi Zhang, and Philip S Yu. 2019. A comprehensive survey on graph neural networks. arXiv preprint arXiv:1901.00596 (2019)

2019 arXiv
[46]

Huaxiu Yao, Chuxu Zhang, Ying Wei, Meng Jiang, Suhang Wang, Junzhou Huang, Nitesh V Chawla, and Zhenhui Li. 2019. Graph Few-shot Learning via Knowledge Transfer. arXiv preprint arXiv:1910.03053 (2019)

2019 arXiv
[47]

Kaidi Xu, Hongge Chen, Sijia Liu, Pin-Yu Chen, Tsui-Wei Weng, Mingyi Hong, and Xue Lin. 2019. Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective. arXiv preprint arXiv:1906.04214 (2019)

2019 arXiv
[48]

Dingyuan Zhu, Ziwei Zhang, Peng Cui, and Wenwu Zhu. 2019. Robust Graph Convolutional Networks Against Adversarial Attacks. In KDD

2019
[49]

Huaxiu Yao, Ying Wei, Junzhou Huang, and Zhenhui Li. 2019. Hierarchically Structured Meta-learning. In ICML. 7045–7054

2019
[50]

Daniel Zügner and Stephan Günnemann. 2019. Certifiable robustness and robust training for graph convolutional networks. In KDD

2019
[52]

arXiv preprint arXiv:1803.07294 (2018)

Gaan: Gated attention networks for learning on large and spatiotemporal graphs. arXiv preprint arXiv:1803.07294 (2018)

2018 arXiv
[54]

Daniel Zügner, Amir Akbarnejad, and Stephan Günnemann. 2018. Adversarial attacks on neural networks for graph data. In KDD

2018
[56]

Daniel Zügner and Stephan Günnemann. 2019. Adversarial Attacks on Graph Neural Networks via Meta Learning. In ICLR

2019
[2018]

arXiv preprint arXiv:1812.03413 (2018)

Learning Transferable Adversarial Examples via Ghost Networks. arXiv preprint arXiv:1812.03413 (2018)

2018 arXiv
[2019]

In The World Wide Web Conference

Graph Neural Networks for Social Recommendation. In The World Wide Web Conference. ACM, 417–426

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [51]

Jiani Zhang, Xingjian Shi, Junyuan Xie, Hao Ma, Irwin King, and Dit-Yan Yeung

work page

[2] [1]

Leman Akoglu, Hanghang Tong, and Danai Koutra. 2015. Graph based anomaly detection and description: a survey. Data mining and knowledge discovery 29, 3 (2015), 626–688

work page 2015

[3] [2]

Aleksandar Bojchevski and Stephan Günnemann. 2019. Adversarial Attacks on Node Embeddings via Graph Poisoning. In ICML

2019

[4] [3]

Joan Bruna, Wojciech Zaremba, Arthur Szlam, and Yann LeCun. 2013. Spectral net- works and locally connected networks on graphs. arXiv preprint arXiv:1312.6203 (2013)

arXiv 2013

[5] [4]

Jinyin Chen, Yangyang Wu, Xuanheng Xu, Yixian Chen, Haibin Zheng, and Qi Xuan. 2018. Fast gradient attack on network embedding. arXiv preprint arXiv:1809.02797 (2018)

arXiv 2018

[6] [5]

Minhao Cheng, Thong Le, Pin-Yu Chen, Jinfeng Yi, Huan Zhang, and Cho-Jui Hsieh. 2018. Query-efficient hard-label black-box attack: An optimization-based approach. arXiv preprint arXiv:1807.04457 (2018)

arXiv 2018

[7] [6]

Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, and Le Song. 2018. Adversarial attack on graph structured data. ICML (2018)

work page 2018

[8] [7]

Michaël Defferrard, Xavier Bresson, and Pierre Vandergheynst. 2016. Convolu- tional neural networks on graphs with fast localized spectral filtering. InAdvances in neural information processing systems . 3844–3852

work page 2016