A Robust graph attention network with dynamic adjusted Graph

Hongxia Wang; Xianchen Zhou; Yaoyun Zeng

REVIEW 4 major objections 5 minor 27 references

A Robust graph attention network with dynamic adjusted Graph

T0 review · 4 major / 5 minor · reviewed 2026-08-27 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A graph attention network can defend against adversarial rewiring by learning an extra edge score from feature smoothness and multiplying it into its attention weights.

desk verdict A fixable but load-bearing projection bug makes the published algorithm unable to perform the claimed dynamic attention adjustment; the underlying idea is a plausible ProGNN-style extension worth a revision, not a rejection. read the letter →

arxiv 2009.13038 v3 pith:DSGG7UAO submitted 2020-09-28 cs.LG stat.ML

Xianchen Zhou , Yaoyun Zeng , Hongxia Wang This is my paper · ORCID

classification cs.LGstat.ML

keywords graphneuralnetworksattentionadversarialattacksrobustnessnodeclassificationfeaturesmoothnessstructurelearningmetattack

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that a graph attention network can defend itself against adversarial rewiring by learning to revise the graph while it trains. RoGAT adds an extra per-edge attention weight, obtained from an optimization that trades closeness to the original adjacency matrix and features against a smoothness penalty that expects connected nodes to look alike. Multiplying this learned weight into the usual GAT attention score lets the model progressively shrink the attention paid to fake edges relative to real edges. On citation and blog networks poisoned by metattack, nettack, and random attacks, the authors report that RoGAT matches or improves on existing defenses, with the largest margins at high perturbation rates. The reason to care is that the defense uses a prior already common in graph learning, rather than expensive low-rank or sparsity assumptions.

What carries the argument

The load-bearing object is the modified attention coefficient $\bar{\alpha}_{uv} = \bar{A}_{uv} \alpha_{uv}$, where $\alpha_{uv}$ is the original GAT attention score and $\bar{A}_{uv}$ is a learned edge weight from the alternating optimization of Eq. (5). The optimization's key term is the feature-smoothness Laplacian regularizer $\frac{1}{2}\sum_{i,j}\bar{A}_{ij}(\bar{x}_i-\bar{x}_j)^2$, which keeps connected nodes similar and therefore penalizes adversarial edges that connect dissimilar nodes. Algorithm 1 alternates projected-gradient updates of the adjacency matrix, then of the features, then of the GAT parameters, so the extra attention score adapts throughout training instead of being a one-shot preprocessing filter.

What would settle it

Run RoGAT on a benchmark graph poisoned by adding edges that deliberately connect nodes with nearly identical features but different labels, and compare its accuracy with plain GAT's; if the advantage disappears, the defense is just exploiting the smoothness prior.

Watch

Extended reading notes

Core claim

The paper's central claim is that adversarial attacks degrade GAT mainly by shifting the ratio of same-label to different-label neighbor links, and that RoGAT restores this ratio during training. The model solves a joint optimization that revises the adjacency matrix and the feature matrix, keeping them close to the observed graph while penalizing feature differences across edges through the Laplacian regularizer $\mathrm{tr}(\bar{X}^\top \bar{L} \bar{X})$. The revised edge weight $\bar{A}_{uv}$ is then multiplied into the standard attention coefficient to define the aggregation weight $\bar{\alpha}_{uv} = \bar{A}_{uv} \alpha_{uv}$. The paper reports that under this procedure the ratio of attention weight on fake edges to real edges falls from its initial value of 1 as training proceeds, and that node-classification accuracy improves over most baselines, with reported gains of about 13 percentage points on Cora and 2 percentage points on Citeseer at 25% metattack, and of 10% and 20% over GCN under nettack on Cora and Citeseer.

Load-bearing premise

The whole defense rests on the assumption that, in the graphs being protected, most nodes have more same-label neighbors than different-label ones and connected nodes tend to share similar features; if an attack violates that assumption smoothly enough, the method's edge reweighting can harm real edges instead.

Editorial extensions

If this is right

If the claim holds, a defense against graph poisoning can be obtained by adding an attention-level reweighting step to an existing GAT, without changing the model family or adding expensive low-rank or sparsity regularizers.
The reported gains grow with perturbation rate: at 15-25% metattack RoGAT claims its largest advantages, so the mechanism matters most when the observed graph is noisiest.
The decreasing fake-to-real attention ratio gives a practical diagnostic: tracking $\bar{\alpha}$ during training can reveal whether a graph is being poisoned.
On the featureless Polblogs dataset the advantage shrinks, suggesting the defense leans on feature smoothness more than on structure alone; feature-rich graphs should benefit most.
The per-iteration structure and feature revisions make the method a drop-in robust training loop for GAT-style models, including multi-head variants.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The authors explicitly leave heterogeneous graphs out of scope; a natural next step is to replace the smoothness prior with a label-aware or learned similarity so the same ratio-adjustment idea applies to heterophily.
An adaptive attacker that adds edges between nodes with nearly identical features but different labels would directly stress the smoothness prior; if RoGAT still wins, the defense is more than prior-matching, and if not, its scope is exactly the homogeneous case.
The runtime comparison (about 20 seconds per RoGAT run versus over 15 minutes for one low-rank defense) is not an accuracy claim, but it suggests the iterative reweighting could scale to larger graphs.
The fake-to-real attention ratio used in the paper could serve as a general monitoring statistic for other attention-based defenses, not just RoGAT.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Request a human review

A listed scientist reviews the paper for a fee and the review publishes here regardless of verdict. See the reviewers or get listed.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

The stress-test note is right, and it's the first thing to know: the projection in Eq. (10) makes the published algorithm unable to do what the paper claims. PA(Ā) returns the original A for every entry in [0,1]. Since Algorithm 1 starts from Ā=A and applies PA after every gradient step, any entry that stays in [0,1] is reset to A; only entries pushed below 0 or above 1 change (to 0 or 1). The gradient of the smoothness term is non-negative, so entries only decrease. The algorithm can delete edges, but it can never produce intermediate weights. The smooth fall in fake/real attention ratio in Fig. 5 is incompatible with this mechanism; the experiments must have used a different projection, probably a clamp. So the central claim, as written, is not reproducible.

That is a serious flaw, but it is fixable. The underlying idea—alternating structure and feature smoothing with a Laplacian penalty, then using the revised adjacency as an extra multiplicative attention score in GAT—is a reasonable extension of the ProGNN/GNNGuard family. The high-perturbation numbers on Cora and Citeseer are genuinely better than ProGNN by a wide margin, and the reported 20-second training time versus 15 minutes is a real practical advantage if it holds. The authors also state the smoothness assumption and its heterogeneous-graph limitation openly, which is more honest than typical for this literature.

Beyond the projection issue, the presentation has soft spots. The text at Cora 5% and Citeseer 0–5% contradicts Table 4; RoGAT is not uniformly best. Several cited modern defenses (GNNGuard, SimPGCN, PA-GNN) are never benchmarked, and ADA-UGNN and HSC-GAT appear with unresolved citation placeholders. The β/γ inconsistency between Eq. (5) and Eq. (12) is minor but sloppy, and key hyperparameters are not disclosed. Ablation is only on Cora.

Who is this for? Someone seeking a practical robust GAT defense would get value from the corrected version; the current manuscript cannot be used as-is. It deserves serious peer review, but only after the authors fix the algorithm description and release code that matches it.

Recommendation: send to review, but expect major revision. The core idea is worth one more round.

Referee Report

4 major / 5 minor

Summary. The paper proposes RoGAT, a robust graph attention network for node classification under adversarial attacks. RoGAT iteratively revises the adjacency matrix and node features by optimizing an objective with a Laplacian smoothness regularizer, then inserts an extra attention score per edge (defined as the product of the revised adjacency weight and the standard GAT attention coefficient) into the aggregation. The authors report experiments on Cora, Citeseer, and Polblogs under metattack, nettack, and random attacks, and claim that RoGAT outperforms most recent defensive methods, especially at higher perturbation rates. The central mechanism is the claim that the dynamic revision increases the attention ratio of real edges to adversarial edges over training.

Significance. If the method works as described, it would be a useful empirical defense for GATs against structural perturbations, building on a natural smoothness prior. The paper includes an explicit algorithmic procedure, ablation studies, hyperparameter analysis, and attention-ratio diagnostics, and the authors state a public code repository, which are strengths. However, the published algorithm contains a projection step that appears to prevent the very dynamic adjustment the method claims, and the reported experiments are not consistent with the text's claims at several table entries. Because the central contribution is an empirical defense whose mechanism is the dynamic edge-weight revision, the projection inconsistency is load-bearing. The paper is potentially salvageable with a corrected algorithm description and rerun experiments, but as written the main claim is not reproducible from the described method.

major comments (4)

[Section 4.2.2, Eq. (10) and Algorithm 1] The projection P_A is defined elementwise as returning 0 for entries below 0, 1 for entries above 1, and the original adjacency entry A_{ij} for every entry in [0,1]. Since Algorithm 1 initializes \bar{A}=A and applies P_A after every gradient step, any update that leaves an entry in [0,1] is overwritten by the original A; only entries pushed outside [0,1] change (to 0 or 1). Consequently \bar{A} never takes intermediate values, so the claimed dynamic adjustment of edge weights—the mechanism behind the attention-ratio change—cannot occur under the published algorithm. The smooth fake/real attention-ratio curves in Section 5.4 (Figure 5) are incompatible with this binary projection and imply that the experiments used a different projection, likely entrywise clipping to [0,1]. Please correct the projection definition and Algorithm 1 to match the actual implementation, and verify that the reported results are reproducible with the corrected procedure.
[Section 4.2.1, Eqs. (5), (11), (12)] The optimization model in Eq. (5) uses β as the coefficient of ||X−\bar{X}||^2, but the feature update subproblem in Eq. (11) and its gradient descent update in Eq. (12) use γ for the same term. The text below Eq. (5) lists α, β, γ as non-negative parameters, yet β never appears again in the algorithm or in the hyperparameter analysis of Section 5.3.1 (which sets α=γ). This ambiguity makes the actual objective being minimized unclear and needs to be resolved.
[Table 4 and Section 5.2.1] The text states that RoGAT 'performs the best under the meta attack for all the tested datasets' and 'outperforms other methods almost for all the perturbations ratios.' Table 4 contradicts this: at Cora 10% ADA-UGNN achieves 83.68±0.23 versus RoGAT's 79.53±1.60; at Citeseer 0% and 5% ADA-UGNN achieves 76.29 and 74.13 versus RoGAT's 73.49 and 73.64; and at Polblogs 5% and 10%, GCN-SVD (89.09, 81.24) exceeds RoGAT (79.18, 74.95). The claims should be revised to match the data, and the cases where RoGAT is not the best should be explicitly discussed.
[Section 5.1.2 and Tables/Figures 4-5] Several defenses cited in Section 2.1 and listed as baselines in Section 5.1.2—namely GNNGuard, SimPGCN, PA-GNN, and HSC-GAT—do not appear in any of the benchmark tables or figures. The paper's conclusion that RoGAT 'outperforms most of the recent defensive methods' is therefore not fully supported by the presented comparisons. Please either include these methods in the experiments or temper the claim to the methods actually compared.

minor comments (5)

[Abstract] The abstract repeats the phrase 'on citation data on citation data'; this should be corrected.
[Section 1] There is a typo in 'The mode defend against adversarial attacks' — presumably 'The model defends against adversarial attacks.'
[References] Several references contain unresolved '?' placeholders (e.g., the citations for HSC-GAT and ADA-UGNN), and reference [3] and the HSC-GAT citation appear as '[ ? ]'. These need to be completed.
[Section 9? (Eq. (9))] In Eq. (9), the notation 'Ls' is used in the gradient step without prior definition; the gradient expression should be written explicitly in terms of the objective from Eq. (8).
[Figure 4 caption] The caption of Figure 4 refers to 'different λ and γ', but the text in Section 5.3.1 says the analysis varies α and λ, with α=γ. The caption and text should be aligned.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: RoGAT's optimization rests on an external smoothness prior and standard supervised losses, and the attention-ratio analysis is a post-hoc diagnostic rather than an independent prediction.

full rationale

The paper's derivation chain is not circular. RoGAT is an empirical defense whose optimization model in Eq. (5) minimizes a reconstruction term ||A - \bar A||^2, a feature-reconstruction term ||X - \bar X||^2, a Laplacian smoothness term tr(\bar X^T \bar L \bar X), and the standard classification loss LRoGAT. The smoothness prior is stated as an external assumption in Section 1 and Section 4.2.1, with supporting citations [24, 27]; it is not derived from the results it is used to explain. The revised attention in Eq. (8), \bar\alpha_{uv} = \bar A_{uv} \alpha_{uv}, is a design choice, not a definition that smuggles in the claimed outcome. The Section 5.4 attention-ratio analysis computes the average revised attention on fake versus real edges; because \bar A is exactly the variable being optimized, a decrease in that ratio for adversarial edges that violate smoothness is a direct consequence of the objective, not an independent prediction. The paper does not present this diagnostic as external confirmation, so it is not a fitted input renamed as a prediction. The central claims are evaluated on holdout node-classification accuracy under metattack, nettack, and random attacks, which are external benchmarks. Hyperparameters are selected on a validation set, which is standard model selection rather than circularity. There are no load-bearing self-citations: the cited support for the smoothness assumption is external, and DeepRobust is only an implementation library. The manuscript does contain an internal inconsistency: the projection in Eq. (10) returns the original adjacency A for every entry in [0,1], and Algorithm 1 initializes \bar A = A, so gradient updates that remain in [0,1] would be overwritten; there is also an \alpha/\gamma mismatch between Eq. (5) and Eq. (12). That is a reproducibility/correctness concern, not a circularity concern, and it does not change the circularity score.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central claim depends on three free hyperparameters (α, γ, λ) that are tuned but not reported, plus a domain assumption (smoothness) that is stated and a heuristic optimization schedule with no convergence guarantee. No new entities are introduced.

free parameters (4)

α = not reported, tuned on validation
Weights the feature smoothness term in Eq (5); authors say 'selected by accuracy of validation and manual test' (Section 5.1.3).
γ = not reported, tuned on validation
Weights the feature smoothness term in the feature update Eq (11); same selection procedure.
λ = not reported, tuned on validation
Weights the classification loss in the feature update Eq (11); same selection procedure.
β = not reported, unused in updates
Appears in Eq (5) as weight on ||X - \bar{X}||^2, but Algorithm 1 uses γ and never β; either a typo or an unstated setting.

assumptions (4)

domain assumption Feature smoothness assumption: connected nodes tend to share similar features and labels; most neighbors of a node are positive edges.
Invoked in Section 1 and Section 4.2.1 to justify the Laplacian regularization; if the graph is heterogeneous this prior is violated and the method may suppress useful edges.
domain assumption Adversarial attacks mainly add negative edges or delete positive edges, so reweighting edges by smoothness reduces attack impact.
Stated in Section 1 and used to design the optimization objective; if attacks also create smooth-looking adversarial edges, the defense could fail.
ad hoc to paper The alternating projected gradient descent in Algorithm 1 converges to a useful solution of the non-convex problem (5).
No convergence guarantee is given; the authors rely on T1=T2=10 iterations and report empirical success.
standard math Gradient of the Laplacian term is computed with respect to adjacency treating features as fixed.
Used in Eq (9); standard calculus, not an issue.

how reviews work

0 comments

Cite this review

Pith. "Pith review of A Robust graph attention network with dynamic adjusted Graph." pith.science (2026). https://pith.science/paper/DSGG7UAO

@misc{pith2026200913038,
  author       = {Pith},
  title        = {Pith review of: A Robust graph attention network with dynamic adjusted Graph},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DSGG7UAO}},
  note         = {Machine review of arXiv:2009.13038}
}

read the original abstract

Graph Attention Networks(GATs) are useful deep learning models to deal with the graph data. However, recent works show that the classical GAT is vulnerable to adversarial attacks. It degrades dramatically with slight perturbations. Therefore, how to enhance the robustness of GAT is a critical problem. Robust GAT(RoGAT) is proposed in this paper to improve the robustness of GAT based on the revision of the attention mechanism. Different from the original GAT, which uses the attention mechanism for different edges but is still sensitive to the perturbation, RoGAT adds an extra dynamic attention score progressively and improves the robustness. Firstly, RoGAT revises the edges weight based on the smoothness assumption which is quite common for ordinary graphs. Secondly, RoGAT further revises the features to suppress features' noise. Then, an extra attention score is generated by the dynamic edge's weight and can be used to reduce the impact of adversarial attacks. Different experiments against targeted and untargeted attacks on citation data on citation data demonstrate that RoGAT outperforms most of the recent defensive methods.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

27 extracted references · 26 canonical work pages

[1]

IEEE Transactions on Neural Networks 20(1), 61 (2009)

Scarselli, F., Gori, M., Tsoi, A.C., Hagenbuchner, M., Monfardini, G.: The graph neural network model. IEEE Transactions on Neural Networks 20(1), 61 (2009)

work page 2009
[2]

In: Proceedings of the 34th In- ternational Conference on Machine Learning - Volume 70

Gilmer, J., Schoenholz, S.S., Riley, P.F., Vinyals, O., Dahl, G.E.: Neural message passing for quantum chemistry. In: Proceedings of the 34th In- ternational Conference on Machine Learning - Volume 70. ICML’17, pp. 1263–1272. JMLR.org, ??? (2017)

work page 2017
[3]

In: Guyon, I., Luxburg, U.V., Bengio, S., Wallach, H., Fergus, R., Vishwanathan, S., Garnett, R

Hamilton, W., Ying, Z., Leskovec, J.: Inductive representation learning on large graphs. In: Guyon, I., Luxburg, U.V., Bengio, S., Wallach, H., Fergus, R., Vishwanathan, S., Garnett, R. (eds.) Advances in Neural In- formation Processing Systems 30, pp. 1024–1034. Curran Associates, Inc., ??? (2017)

work page 2017
[4]

In: International Conference on Learning Representations (ICLR2014), CBLS, April 2014 (2014)

Bruna, J., Zaremba, W., Szlam, A., Lecun, Y.: Spectral networks and locally connected networks on graphs. In: International Conference on Learning Representations (ICLR2014), CBLS, April 2014 (2014)

work page 2014
[5]

In: Advances in Neural Information Processing Systems, pp

Deﬀerrard, M., Bresson, X., Vandergheynst, P.: Convolutional neural net- works on graphs with fast localized spectral ﬁltering. In: Advances in Neural Information Processing Systems, pp. 3844–3852 (2016) Springer Nature 2021 LATEX template 18 A Robust graph attention network with dynamic adjusted Graph (a) (b) (c) Figure 5 : The ratio of the weight of fak...

work page 2016
[6]

In: International Conference on Learning Representa- tions (ICLR) (2017)

Kipf, T.N., Welling, M.: Semi-supervised classiﬁcation with graph convo- lutional networks. In: International Conference on Learning Representa- tions (ICLR) (2017)

work page 2017
[7]

In: International Conference on Learning Representations (2018)

Veliˇ ckovi´ c, P., Cucurull, G., Casanova, A., Romero, A., Li` o, P., Bengio, Y.: Graph attention networks. In: International Conference on Learning Representations (2018)

2018
[8]

In: Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pp

Z¨ ugner, D., Akbarnejad, A., G¨ unnemann, S.: Adversarial attacks on neu- ral networks for graph data. In: Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pp. 2847–2856 (2018)

work page 2018

Show all 27 references

[9]

In: International Conference on Machine Learning, pp

Dai, H., Li, H., Tian, T., Huang, X., Wang, L., Zhu, J., Song, L.: Adver- sarial attack on graph structured data. In: International Conference on Machine Learning, pp. 1115–1124 (2018). PMLR

2018
[10]

In: International Conference on Learning Representa- tions (ICLR) (2019)

Z¨ ugner, D., G¨ unnemann, S.: Adversarial attacks on graph neural networks via meta learning. In: International Conference on Learning Representa- tions (ICLR) (2019)

2019
[11]

In: Proceedings of the Twenty-Eighth International Joint Conference on Artiﬁcial Intelligence, IJCAI-19, pp

Wu, H., Wang, C., Tyshetskiy, Y., Docherty, A., Lu, K., Zhu, L.: Ad- versarial examples for graph data: Deep insights into attack and defense. In: Proceedings of the Twenty-Eighth International Joint Conference on Artiﬁcial Intelligence, IJCAI-19, pp. 4816–4823. International ...

2019 doi
[12]

Advances in Neural Information Processing Systems 33 (2020)

Zhang, X., Zitnik, M.: Gnnguard: Defending graph neural networks against adversarial attacks. Advances in Neural Information Processing Systems 33 (2020)

2020
[13]

In: Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining

Zhu, D., Zhang, Z., Cui, P., Zhu, W.: Robust graph convolutional networks against adversarial attacks. In: Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. KDD ’19, pp. 1399–1407. Association for Computing Machinery, New York,...

2019
[14]

In: Proceedings of the 14th ACM International Conference on Web Search and Data Mining, pp

Luo, D., Cheng, W., Yu, W., Zong, B., Ni, J., Chen, H., Zhang, X.: Learn- ing to drop: Robust graph neural network via topological denoising. In: Proceedings of the 14th ACM International Conference on Web Search and Data Mining, pp. 779–787 (2021)

2021
[15]

In: 26th ACM SIGKDD In- ternational Conference on Knowledge Discovery and Data Mining, KDD 2020, pp

Jin, W., Ma, Y., Liu, X., Tang, X., Wang, S., Tang, J.: Graph structure learning for robust graph neural networks. In: 26th ACM SIGKDD In- ternational Conference on Knowledge Discovery and Data Mining, KDD 2020, pp. 66–74 (2020). Association for Computing Machinery Springer Na...

2020
[16]

In: Pro- ceedings of the 13th International Conference on Web Search and Data Mining, pp

Tang, X., Li, Y., Sun, Y., Yao, H., Mitra, P., Wang, S.: Transferring robustness for graph neural network against poisoning attacks. In: Pro- ceedings of the 13th International Conference on Web Search and Data Mining, pp. 600–608 (2020)

2020
[17]

In: Proceedings of the 14th ACM International Conference on Web Search and Data Mining, pp

Jin, W., Derr, T., Wang, Y., Ma, Y., Liu, Z., Tang, J.: Node similarity pre- serving graph convolutional networks. In: Proceedings of the 14th ACM International Conference on Web Search and Data Mining, pp. 148–156 (2021)

2021
[18]

In: Proceedings of the 13th International Conference on Web Search and Data Mining

Entezari, N., Al-Sayouri, S.A., Darvishzadeh, A., Papalexakis, E.E.: All you need is low (rank): Defending against adversarial attacks on graphs. In: Proceedings of the 13th International Conference on Web Search and Data Mining. WSDM ’20, pp. 169–177. Association for Computin...

2020 doi
[19]

arXiv preprint arXiv:1902.08412 (2019)

Z¨ ugner, D., G¨ unnemann, S.: Adversarial attacks on graph neural networks via meta learning. arXiv preprint arXiv:1902.08412 (2019)

2019 arXiv
[20]

In: International Conference on Learning Representations (2021)

Kim, D., Oh, A.: How to ﬁnd your friendly neighborhood: Graph atten- tion design with self-supervision. In: International Conference on Learning Representations (2021)

2021
[21]

In: Advances in Neural Information Processing Systems, pp

Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, L., Polosukhin, I.: Attention is all you need. In: Advances in Neural Information Processing Systems, pp. 5998–6008 (2017)

2017
[22]

arXiv: Computation and Language (2014)

Bahdanau, D., Cho, K., Bengio, Y.: Neural machine translation by jointly learning to align and translate. arXiv: Computation and Language (2014)

2014
[23]

arXiv e-prints, 2003 (2020)

Jin, W., Li, Y., Xu, H., Wang, Y., Tang, J.: Adversarial attacks and defenses on graphs: A review and empirical study. arXiv e-prints, 2003 (2020)

2020
[24]

In: Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pp

Wang, H., Zhang, F., Zhang, M., Leskovec, J., Zhao, M., Li, W., Wang, Z.: Knowledge-aware graph neural networks with label smoothness reg- ularization for recommender systems. In: Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining,...

2019
[25]

arXiv preprint arXiv:2005.06149 (2020)

Li, Y., Jin, W., Xu, H., Tang, J.: Deeprobust: A pytorch library for adversarial attacks and defenses. arXiv preprint arXiv:2005.06149 (2020)

2020 arXiv
[26]

In: International Conference on Learning Representations (2019) Springer Nature 2021 LATEX template A Robust graph attention network with dynamic adjusted Graph 21

Zhang, K., Zhu, Y., Wang, J., Zhang, J.: Adaptive structural ﬁngerprints for graph attention networks. In: International Conference on Learning Representations (2019) Springer Nature 2021 LATEX template A Robust graph attention network with dynamic adjusted Graph 21

2019
[27]

Review of Sociology 27(1), 415–444 (2001)

Mcpherson, M., Smithlovin, L., Cook, J.M.: Birds of a feather: Homophily in social networks. Review of Sociology 27(1), 415–444 (2001)

2001

Pith tools

Reviewed August 27, 2026 · model on record in the stance chip above.

[1] [1]

IEEE Transactions on Neural Networks 20(1), 61 (2009)

Scarselli, F., Gori, M., Tsoi, A.C., Hagenbuchner, M., Monfardini, G.: The graph neural network model. IEEE Transactions on Neural Networks 20(1), 61 (2009)

work page 2009

[2] [2]

In: Proceedings of the 34th In- ternational Conference on Machine Learning - Volume 70

Gilmer, J., Schoenholz, S.S., Riley, P.F., Vinyals, O., Dahl, G.E.: Neural message passing for quantum chemistry. In: Proceedings of the 34th In- ternational Conference on Machine Learning - Volume 70. ICML’17, pp. 1263–1272. JMLR.org, ??? (2017)

work page 2017

[3] [3]

In: Guyon, I., Luxburg, U.V., Bengio, S., Wallach, H., Fergus, R., Vishwanathan, S., Garnett, R

Hamilton, W., Ying, Z., Leskovec, J.: Inductive representation learning on large graphs. In: Guyon, I., Luxburg, U.V., Bengio, S., Wallach, H., Fergus, R., Vishwanathan, S., Garnett, R. (eds.) Advances in Neural In- formation Processing Systems 30, pp. 1024–1034. Curran Associates, Inc., ??? (2017)

work page 2017

[4] [4]

In: International Conference on Learning Representations (ICLR2014), CBLS, April 2014 (2014)

Bruna, J., Zaremba, W., Szlam, A., Lecun, Y.: Spectral networks and locally connected networks on graphs. In: International Conference on Learning Representations (ICLR2014), CBLS, April 2014 (2014)

work page 2014

[5] [5]

In: Advances in Neural Information Processing Systems, pp

Deﬀerrard, M., Bresson, X., Vandergheynst, P.: Convolutional neural net- works on graphs with fast localized spectral ﬁltering. In: Advances in Neural Information Processing Systems, pp. 3844–3852 (2016) Springer Nature 2021 LATEX template 18 A Robust graph attention network with dynamic adjusted Graph (a) (b) (c) Figure 5 : The ratio of the weight of fak...

work page 2016

[6] [6]

In: International Conference on Learning Representa- tions (ICLR) (2017)

Kipf, T.N., Welling, M.: Semi-supervised classiﬁcation with graph convo- lutional networks. In: International Conference on Learning Representa- tions (ICLR) (2017)

work page 2017

[7] [7]

In: International Conference on Learning Representations (2018)

Veliˇ ckovi´ c, P., Cucurull, G., Casanova, A., Romero, A., Li` o, P., Bengio, Y.: Graph attention networks. In: International Conference on Learning Representations (2018)

2018

[8] [8]

In: Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pp

Z¨ ugner, D., Akbarnejad, A., G¨ unnemann, S.: Adversarial attacks on neu- ral networks for graph data. In: Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pp. 2847–2856 (2018)

work page 2018