Pith. sign in

REVIEW 3 major objections 5 minor 70 references

A Cognac Shot To Forget Bad Memories: Corrective Unlearning for Graph Neural Networks

T0 review · 3 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper introduces Cognac, which removes the effect of manipulated training data from a trained GNN using only 5% of the manipulated set, recovering near-oracle accuracy and beating retraining from scratch.

desk verdict A solid, novel empirical paper on corrective unlearning for GNNs whose weak theory and untested homophily boundary are real but don't undermine the main result. read the letter →

arxiv 2412.00789 v4 pith:EBR4DY2Q submitted 2024-12-01 cs.LG cs.AIcs.CR

Varshita Kolipaka , Akshit Sinha , Debangan Mishra , Sumit Kumar , Arvindh Arun , Shashwat Goel , Ponnurangam Kumaraguru This is my paper · ORCID
classification cs.LGcs.AIcs.CR
keywords correctiveunlearninggraphneuralnetworksmachinecontrastivedatapoisoninglabelmanipulationattacksspuriousedgeadditionhomophily
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Graph neural networks do not treat training points independently: a wrong label or a forged edge spreads its influence to neighboring nodes through message passing, so a trained model can be damaged in ways that simple data deletion cannot reverse. This paper studies corrective unlearning for GNNs—removing the effect of manipulated entities using only a small identified subset of them—and claims that existing graph unlearning methods fail even when the entire manipulated set is known. It introduces Cognac, which alternates between a contrastive step that re-embeds affected neighbors away from manipulated nodes and toward clean ones, and a decoupled ascent/descent step that unlearns the wrong labels while preserving the rest. With as little as 5% of the manipulated set identified, Cognac recovers most of the accuracy of an oracle trained on fully clean data, outperforms retraining from scratch, and does so about 8x more cheaply. If the claim holds, model developers can repair poisoned or mislabeled GNNs after training without knowing the extent of the corruption.

What carries the argument

The machinery is the pairing of CoGN and AC/DC on top of the observation that manipulation damage is local. Lemma 3.2 gives the locality: in an $n$-layer GNN a node's representation can influence only nodes within its $n$-hop neighborhood, so affected nodes can be searched for cheaply. CoGN finds them by feature inversion—replacing each deletion node's features with $\mathbf{1} - X_v$, measuring the logit shift $\Delta_\chi = |M(\chi') - M(\chi)|$, and taking the top $k\%$ most shifted neighbors—and then optimizes the sigmoid contrastive loss $- \mathbb{E}[\log\sigma(z_v^\top z_p) + \log\sigma(-z_v^\top z_n)]$, which Theorem 3.3 shows monotonically increases the separation $\mathbb{E}[z_v^\top z_p - z_v^\top z_n]$ under convexity, differentiability, and bounded gradients. AC/DC then runs gradient ascent on the deletion set and gradient descent on the retain set with separate decoupled optimizers, so the wrong-label signal is weakened without reinforcing unidentified manipulations in the retain set. The two components are complementary: ablations show CoGN alone moves embeddings but does not raise affected-class accuracy, while AC/DC alone improves accuracy but falls far short of the oracle.

What would settle it

Run Cognac on a heterophilic benchmark (a graph where connected nodes mostly carry different labels) under the same label-flip and spurious-edge attacks; if it no longer beats retraining from scratch when only 5% of the manipulated set is known, the homophily assumption is doing the load-bearing work. A second check: corrupt a cluster of adjacent nodes so the identified 5% is not representative of the manipulation, and test whether affected-class accuracy still recovers.

Watch

Extended reading notes

Core claim

Cognac's central claim is that the two ways manipulation harms a GNN—propagation through the neighborhood and the learning of wrong labels—can be undone separately, and that this separation makes corrective unlearning work with almost no signal. On the propagation side, CoGN (Contrastive unlearning on Graph Neighborhoods) identifies the nodes most affected by the known deletion set by inverting the deletion nodes' features, running a forward pass, and ranking neighbors by the change in their output logits; it then applies a sigmoid contrastive loss that pushes these affected nodes' embeddings away from the manipulated nodes and toward their unaffected neighbors, restoring homophily. On the label side, AC/DC (Ascent DesCent de-coupled) performs gradient ascent on the deletion set's labels with one optimizer while a separate optimizer runs gradient descent on the remaining data, erasing the wrong learning signal without destroying the model. The paper grounds these choices in three results: manipulations only propagate within the n-hop receptive field of a poisoned node (Lemma 3.2), an Interclass Confusion attack provably entangles class embeddings (Theorem 3.1), and the contrastive objective strictly increases embedding separation at convergence under standard assumptions (Theorem 3.3). The empirical claim is that this combination beats retraining from scratch, occasionally surpasses a clean-data oracle, and performs consistently across ten datasets and three attack types with only 5% of the manipulated set known.

Load-bearing premise

The load-bearing premise is homophily: connected nodes tend to share labels, so the unaffected neighbors of a manipulated node carry a clean positive signal for the contrastive step; the paper itself (Section 7) concedes it has only been evaluated on homophilic graphs.

Editorial extensions

If this is right

  • Existing graph unlearning methods (GNNDelete, GIF, MEGU, UtU, SCRUB) fail at corrective unlearning even with the complete manipulated set known, so this setting is genuinely harder than privacy-oriented deletion and needs dedicated methods.
  • Retraining from scratch is not a gold standard for corrective unlearning: Cognac beats it on affected-class accuracy while being roughly 8x cheaper, so post-hoc repair can dominate full retraining.
  • A small representative subset suffices: with 5% of the manipulated set identified, Cognac recovers most of the oracle's accuracy, because the neighborhood-based identification surfaces affected nodes beyond the identified set.
  • The method scales: on OGB-Arxiv (~170k nodes, over 1M edges) Cognac keeps a lead of more than 10% over retraining while baselines show no gain over the poisoned model.
  • Both components are load-bearing: CoGN alone yields no improvement in affected-class accuracy and AC/DC alone falls far short of the oracle, so corrective unlearning requires fixing neighborhood propagation and label fitting together.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's linked-versus-unlinked ablation (Appendix E.4) supports a design lesson the authors state only partially: for label manipulations, keeping the corrupted node in the graph and unlearning only its features and labels can beat full node deletion, because deleted nodes stop contributing clean graph context to their neighbors; structure-preserving unlearning may be the stronger default for
  • Because the positive pairs in CoGN are drawn from the graph neighborhood, the method's reach depends on homophily; a natural extension would be to select positives by structural or feature similarity rather than adjacency, which would adapt the method to heterophilic graphs.
  • The 5% result assumes the identified subset is representative of the whole manipulation; a stress test would corrupt a tight cluster of adjacent nodes so that the identified 5% samples only one region, and check whether affected-class accuracy still recovers.
  • The efficiency claim (8x over retraining, and 8x faster affected-node sampling than MEGU's) makes corrective unlearning a practical companion to data-monitoring pipelines, but the paper's value depends on those detectors supplying a representative deletion set in the first place.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper studies corrective unlearning for GNNs: removing the influence of manipulated training data (targeted label flips or spurious edges) from a trained model, using only a subset of the manipulated entities. It proposes Cognac, which alternates between two components: (i) CoGN, a contrastive loss that identifies nodes affected by the manipulation and pushes their embeddings away from the known deletion set while pulling them toward neighboring nodes, and (ii) AC/DC, which performs gradient ascent on the deletion set and gradient descent on the remaining data. The method is evaluated on ten benchmark graphs, two architectures (GCN and GAT), three manipulation types, and varying fractions of identified manipulated entities, reporting that Cognac outperforms existing graph unlearning baselines and retraining from scratch, recovering most of the oracle accuracy even when only 5% of the manipulation set is identified. The paper also presents theoretical claims about representation entanglement under interclass confusion and about contrastive-loss convergence.

Significance. If the empirical claims hold, this is a practically valuable contribution to graph unlearning. The evaluation is unusually thorough: ten datasets (including a 170k-node graph), a second architecture, a trigger-poisoning extension, large deletion-set stress tests, hyperparameter robustness searches, and a public code release. The finding that established graph unlearning methods fail even with the full manipulation set is important and likely to influence future benchmarking. The main positive result—that partial identification can recover most of the oracle performance—is well supported on homophilic datasets. However, the paper's theoretical apparatus is not sound as written, and the broadest claims are conditioned on an untested benign-neighborhood assumption; these issues limit the current strength of the paper but are addressable.

major comments (3)
  1. [§3.1.2 (Eq. 1–2) and §7] The central claim "Cognac ... can unlearn the effect of the manipulation set even when only 5% of it is identified" is not established for graphs in which the unidentified manipulated nodes appear in the positive set Vpos = N_{Vaff} \ Vf. Since CoGN explicitly pulls z_v toward the average of Vpos, any manipulated or mislabeled node in Vpos provides a poisoned pull; the method's success therefore depends on Vpos being clean and representative. The paper's Section 7 concedes reliance on homophily and excludes heterophilic graphs, but it does not address the more specific and more common failure mode that arises even in homophilic graphs when manipulation is locally concentrated or when the manipulation rate is high (Table 4 reports up to 38.96% of training nodes manipulated). The manuscript never reports the contamination rate of Vpos, never characterizes the spatial locality of the manipulated sets, and never varies this property. I ask the authors to (a) report Vpos purity for the existing experiments and (b) add at least one experiment with locally concentrated manipulation and one with a heterophilic dataset, or otherwise explicitly scope the 5% claim.
  2. [§3.1.2, Theorem 3.3 and Appendix A.2] Theorem 3.3 is not a valid proof of the claimed guarantee. The proof uses a first-order approximation ΔS ≈ −η⟨∇S, ∇L⟩ and then asserts ΔS ≥ 0 "for sufficiently small η" without a rigorous Lipschitz-based descent lemma; the later step "This equality holds only if σ(−a) → 0 and σ(b) → 0" is false as stated because equality of expectations does not force each integrand to vanish. Assumption A.2 (convexity of L) is not satisfied by trained GNNs, and the paper itself argues in Section 3.1.2 that the non-sigmoid objective has an "uneven optimization landscape" that motivates the log-sigmoid loss—so convexity is not a benign simplification. Moreover, because both L and S are defined in terms of the same dot products z_v^T z_p and z_v^T z_n, the claimed increase of S is essentially a restatement of the monotone effect of the sigmoid loss, rather than an independent convergence theorem. The sentence in Section 5 that Figure 5(b) is "validating our theoretical results" overstates the support. I recommend either replacing this with a rigorous statement under explicitly verifiable conditions or reclassifying it as an empirical observation.
  3. [§3, Theorem 3.1 and Appendix A.3] Theorem 3.1 is stated without specifying the probability space over which the expectations are taken, and its proof is heuristic. The proof assumes homophily-preserving message passing plus graph smoothness regularization in the training loss, but the experimental GCNs are not trained with a smoothness regularizer and the method is applied post-training. The derivation of the amplification factor η(1 − 1/L) and the final expression for Δ relies on asserted rather than derived propagation steps (Steps 4 and 5). Since the theorem is presented as a formal result and used to motivate the method, please either provide a proof under assumptions that match the experimental setup or explicitly downgrade it to an illustrative analysis.
minor comments (5)
  1. [Abstract and §F.2] The claim "8x more efficient" is ambiguous: in Table 7 the 8x refers to affected-node sampling time versus MEGU, while Figure 13 reports total unlearning time versus Retrain. Please state the baseline and the measurement condition clearly in the abstract and in the relevant section.
  2. [Figure 4 caption] The caption says "archives SOTA" and should read "achieves SOTA."
  3. [§3.1.2 (Eq. 2)] The variables z_v, z_p, and z_n are used in Eq. (2) without prior definition in the main text; please define them (they appear only later in the statement of Theorem 3.3 in Appendix A.2).
  4. [Lemma 3.2 proof (Appendix A.1)] The proof alternates between N^n(s) and N^l(v) notation without explaining that l indexes layers, and the base case statement "z_s = h_s^(0)" is confusing because z_s was defined as a final representation. Please use consistent notation.
  5. [Table 4] The heading "EDGES ADDED (%)" lists "-" for OGB-arXiv with no footnote; please specify whether no edges were added or the value is not applicable.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the central empirical claims are benchmarked directly against held-out test data and external baselines, and the convergence theorem is a post-hoc justification rather than an input that the predictions reduce to.

full rationale

Walking the derivation chain, the central claim that Cognac recovers most of the oracle's Accaff from only 5% of the manipulated set while beating retrain is not produced by fitting or by definitional equivalence. The positive and negative sets for CoGN are drawn from the graph neighborhood and the deletion set, not from the test-set Accaff numbers; hyperparameters are tuned on a validation objective (Appendix F.1); and the reported Accaff and Accrem are measured on held-out test splits against external baselines (GNNDelete, GIF, MEGU, UtU, SCRUB) and Retrain/Finetune/Oracle. The convergence guarantee in Theorem 3.3 relates the surrogate loss L to the separation measure S through the same dot products, and the proof is mathematically questionable, but this is a correctness risk rather than circularity because the method and its empirical evaluation do not depend on the theorem. The adoption of the corrective-unlearning formulation and metrics from Goel et al. (2024) is a self-citation by overlapping authors, but it frames the problem rather than carrying the new GNN-specific results, which are benchmarked directly. The stated reliance on homophily is an untested boundary condition, not a circular step. No prediction in the paper is equivalent to a fitted input by construction.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central method is empirical and introduces no new physical or model entities. It relies on several tuned hyperparameters (k, learning rates, epoch counts) and on domain assumptions: homophily, representativeness of S_f, and idealized conditions for the theoretical claims. These are typical for a machine learning paper but should be tracked.

free parameters (4)
  • k (top-k% affected neighbors) = varies (e.g., 4 for Cora)
    Controls how many neighbors of the deletion set are used in contrastive loss; ablated in Appendix E.2, performance drops sharply at k=0.
  • ascent learning rate = lower than descent (tuned)
    Tuned per dataset/attack; separate optimizer for ascent is central to AC/DC, with a lower learning rate found to work better.
  • descent learning rate = tuned per dataset
    Tuned with Optuna; usually higher than the ascent learning rate to balance forgetting and retention.
  • number of contrastive and ascent/descent epochs = tuned per dataset
    Outer and inner loop lengths are hyperparameters; convergence is shown empirically in Appendix E.1.
assumptions (4)
  • domain assumption The graph is homophilic (edges connect similar nodes), so unaffected neighbors provide correct supervision for contrastive unlearning.
    Used in Section 3.1.2 to define positive pairs Vpos and in the IC attack theorem; acknowledged as a limitation in Section 7.
  • domain assumption The known deletion set S_f is a representative sample of the full manipulation set S_m.
    Adopted from Goel et al. (2024), stated in Section 2: 'For unlearning to be feasible, Sf must be a representative subset of Sm.'
  • ad hoc to paper The contrastive loss L is convex, differentiable, and has bounded gradients in the GNN parameters.
    These assumptions are stated in Appendix A.2 but do not hold for deep GNNs; they are used to guarantee S(theta_t+1) >= S(theta_t).
  • ad hoc to paper The GNN uses homophily-preserving message passing, the graph is eta-homophilic, and training loss includes graph smoothness regularization.
    Assumptions A.1-A.3 in Appendix A.3; the derived bound Delta = alpha*eta*(1-1/L)*||mu_C1 - mu_C2||^2 depends on these and is not derived from standard GNN training.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Cognac Shot To Forget Bad Memories: Corrective Unlearning for Graph Neural Networks." pith.science (2026). https://pith.science/paper/EBR4DY2Q

@misc{pith2026241200789,
  author       = {Pith},
  title        = {Pith review of: A Cognac Shot To Forget Bad Memories: Corrective Unlearning for Graph Neural Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EBR4DY2Q}},
  note         = {Machine review of arXiv:2412.00789}
}
read the original abstract

Graph Neural Networks (GNNs) are increasingly being used for a variety of ML applications on graph data. Because graph data does not follow the independently and identically distributed (i.i.d.) assumption, adversarial manipulations or incorrect data can propagate to other data points through message passing, which deteriorates the model's performance. To allow model developers to remove the adverse effects of manipulated entities from a trained GNN, we study the recently formulated problem of Corrective Unlearning. We find that current graph unlearning methods fail to unlearn the effect of manipulations even when the whole manipulated set is known. We introduce a new graph unlearning method, Cognac, which can unlearn the effect of the manipulation set even when only 5% of it is identified. It recovers most of the performance of a strong oracle with fully corrected training data, even beating retraining from scratch without the deletion set while being 8x more efficient. We hope our work assists GNN developers in mitigating harmful effects caused by issues in real-world data, post-training. Our code is publicly available at https://github.com/cognac-gnn-unlearning/corrective-unlearning-for-gnns

Figures

Figures reproduced from arXiv: 2412.00789 by the authors.

Figure 1
Figure 1. Illustration of our method Cognac. Initially (Left), the model is trained on manipulated data (Devils), out of which only a subset is identified for deletion (Dark-red-devils). Our method alternates between two steps. (1) Identifying neighbors by the deletion set, which can include both nodes from the remaining data (light red) and unidentified manipulated nodes (Purple), and pushes their representation away from th… view at source ↗
Figure 2
Figure 2. Appendix E.2 varies our design choices, confirm￾ing that we retain the same performance as using the entire n-hop neighborhood while being more efficient ( [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Empirical convergence of CoGN. The average positive and negative dot products across samples increase and decrease, respectively, over epochs, resulting in overall convergence. leads to better results. Thus, we call this component Ascent Descent de coupled. Convergence of this formulation has been shown in previous works (Kurmanji et al., 2023). We show the empirical convergence of AC DC in [PITH_FULL_IMAGE:figures… view at source ↗
Figures from the paper (10 more)
Figure 4
Figure 4. Figure 4: Corrective Unlearning Results. We report the accuracy on the affected classes Accaff across different fractions of the manipulation set known for deletion (Sf /Sm). Baseline methods perform poorly, except for GNNDelete, which achieves reasonable unlearning performance …
Figure 5
Figure 5. Figure 5: (a) Results on a larger dataset, OGB-Arxiv, and (b) Visualization of hidden layer embeddings after unlearning on CS dataset for node unlearning. (a) On the OGB-Arxiv dataset, Cognac outperforms retraining from scratch by more than 10%, while most baselines fail to achi…
Figure 6
Figure 6. Figure 6: Node Unlearning results for Cora with GAT backbone. Comparison of Accaff for the unlearning methods on GAT trained on Cora for different values of (Sf /Sm). We see that Cognac outperforms all baselines. their corresponding positive and negative samples, and then altern…
Figure 7
Figure 7. Figure 7: Convergence of the losses across unlearning steps. The ascent loss on Sm continually increases as expected, the descent loss on S \ Sm converges, and the contrastive loss exhibits a low plateau after an initial overshoot, implying it may have learned discriminative fea…
Figure 8
Figure 8. Figure 8: Effect of how well-trained the GNN is on top-k% affected neighbor identification. Here k = 4. The x-axis represents the epoch at which we used GNN representations to identify the most affected neighbors for Cognac. The y-axis reports the unlearning performance after co…
Figure 9
Figure 9. Figure 9: Effect of k on unlearning (Accaff ), utility (Accrem) and efficiency when identifying top-k% affected nodes for contrastive unlearning. (Left) Cognac effectiveness sharply improves beyond k = 0%, suggesting that performing contrastive unlearning on even a small percent…
Figure 10
Figure 10. Figure 10: Hyperparameter runs for Sf = 1.0 on Amazon. Scores of various hyperparameter trial runs. The best hyperparameters are selected according to the run achieving the best value for the average of Accrem and Accaff . F.2. Unlearning Times To ensure the practicality of inex…
Figure 11
Figure 11. Figure 11: Hyperparameter runs for Sf = 1.0 on CS. Scores of various hyperparameter trial runs. The best hyperparameters are selected according to the run achieving the best value for the average of Accrem and Accaff [PITH_FULL_IMAGE:figures/full_fig_p025_11.png]
Figure 12
Figure 12. Figure 12: Hyperparameter runs for Sf = 1.0 on Cora. Scores of various hyperparameter trial runs. The best hyperparameters are selected according to the run achieving the best value for the average of Accrem and Accaff . 25 [PITH_FULL_IMAGE:figures/full_fig_p025_12.png]
Figure 13
Figure 13. Figure 13: Time taken to unlearn. We report the time taken by each unlearning method for all datasets, in the setting where all manipulated samples are known for deletion. Cognac provides significant speedups over Retrain and has performance similar to other unlearning methods. …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

70 extracted references · 39 canonical work pages

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    Optuna: A next-generation hyperparameter optimization framework

    Takuya Akiba, Shotaro Sano, Toshihiko Yanase, Takeru Ohta, and Masanori Koyama. Optuna: A next-generation hyperparameter optimization framework. In Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining, pp.\ 2623--2631, 2019

    2019

  3. [3]

    LEACE : Perfect linear concept erasure in closed form

    Nora Belrose, David Schneider-Joseph, Shauli Ravfogel, Ryan Cotterell, Edward Raff, and Stella Biderman. LEACE : Perfect linear concept erasure in closed form. In Thirty-seventh Conference on Neural Information Processing Systems, 2023. URL https://openreview.net/forum?id=awIpKpwTwF

    2023

  4. [4]

    Deep gaussian embedding of graphs: Unsupervised inductive learning via ranking

    Aleksandar Bojchevski and Stephan G \"u nnemann. Deep gaussian embedding of graphs: Unsupervised inductive learning via ranking. arXiv preprint arXiv:1707.03815, 2017

    arXiv 2017

  5. [5]

    Adversarial attacks on node embeddings via graph poisoning

    Aleksandar Bojchevski and Stephan G \"u nnemann. Adversarial attacks on node embeddings via graph poisoning. In International Conference on Machine Learning, pp.\ 695--704. PMLR, 2019 a

    work page 2019

  6. [6]

    Certifiable robustness to graph perturbations

    Aleksandar Bojchevski and Stephan G \"u nnemann. Certifiable robustness to graph perturbations. Advances in Neural Information Processing Systems, 32, 2019 b

    work page 2019

  7. [7]

    Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot

    Lucas Bourtoule, Varun Chandrasekaran, Christopher A. Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In IEEE S&P, 2021

    work page 2021

  8. [8]

    Identifying mislabeled training data

    Carla E Brodley and Mark A Friedl. Identifying mislabeled training data. Journal of artificial intelligence research, 11: 0 131--167, 1999

    work page 1999

Show all 70 references
  1. [9]

    Recommendation unlearning

    Chong Chen, Fei Sun, Min Zhang, and Bolin Ding. Recommendation unlearning. In Proceedings of the ACM Web Conference 2022, pp.\ 2768--2777, 2022 a

    2022

  2. [10]

    Graph unlearning

    Min Chen, Zhikun Zhang, Tianhao Wang, Michael Backes, Mathias Humbert, and Yang Zhang. Graph unlearning. In Proceedings of the 2022 ACM SIGSAC conference on computer and communications security, pp.\ 499--513, 2022 b

    2022

  3. [11]

    Characterizing the influence of graph elements

    Zizhang Chen, Peizhao Li, Hongfu Liu, and Pengyu Hong. Characterizing the influence of graph elements. In The Eleventh International Conference on Learning Representations, 2023. URL https://openreview.net/forum?id=51GXyzOKOp

    2023

  4. [12]

    GNND elete: A general unlearning strategy for graph neural networks

    Jiali Cheng, George Dasoulas, Huan He, Chirag Agarwal, and Marinka Zitnik. GNND elete: A general unlearning strategy for graph neural networks. In International Conference on Learning Representations, 2023. URL https://openreview.net/forum?id=X9yCkmT5Qrl

    2023

  5. [13]

    Efficient model updates for approximate unlearning of graph-structured data

    Eli Chien, Chao Pan, and Olgica Milenkovic. Efficient model updates for approximate unlearning of graph-structured data. In The Eleventh International Conference on Learning Representations, 2022

    2022

  6. [14]

    Adversarial attack on graph structured data

    Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, and Le Song. Adversarial attack on graph structured data. In Jennifer Dy and Andreas Krause (eds.), Proceedings of the 35th International Conference on Machine Learning, volume 80 of Proceedings of Machine Learning R...

    2018

  7. [15]

    When, why and how much? adaptive learning rate scheduling by refinement, 2023

    Aaron Defazio, Ashok Cutkosky, Harsh Mehta, and Konstantin Mishchenko. When, why and how much? adaptive learning rate scheduling by refinement, 2023. URL https://arxiv.org/abs/2310.07831

    2023 arXiv

  8. [16]

    The sybil attack

    John R Douceur. The sybil attack. In International workshop on peer-to-peer systems, pp.\ 251--260. Springer, 2002

    2002

  9. [17]

    Debiasing graph neural networks via learning disentangled causal substructure

    Shaohua Fan, Xiao Wang, Yanhu Mo, Chuan Shi, and Jian Tang. Debiasing graph neural networks via learning disentangled causal substructure. In Proceedings of the 36th International Conference on Neural Information Processing Systems, NIPS '22, Red Hook, NY, USA, 2024. Curran As...

    2024

  10. [18]

    u gner, Aleksandar Bojchevski, and Stephan G\

    Simon Geisler, Tobias Schmidt, Hakan S irin, Daniel Z\" u gner, Aleksandar Bojchevski, and Stephan G\" u nnemann. Robustness of graph neural networks at scale. In Proceedings of the 35th International Conference on Neural Information Processing Systems, NIPS '21, Red Hook, NY,...

    2024

  11. [19]

    Towards adversarial evaluations for inexact machine unlearning

    Shashwat Goel, Ameya Prabhu, Amartya Sanyal, Ser-Nam Lim, Philip Torr, and Ponnurangam Kumaraguru. Towards adversarial evaluations for inexact machine unlearning. arXiv preprint arXiv:2201.06640, 2022

    2022 arXiv

  12. [20]

    Corrective machine unlearning

    Shashwat Goel, Ameya Prabhu, Philip Torr, Ponnurangam Kumaraguru, and Amartya Sanyal. Corrective machine unlearning. Data-centric Machine Learning Research (DMLR) Workshop, ICLR, 2024

    2024

  13. [21]

    Graph neural networks: Adversarial robustness

    Stephan G \"u nnemann. Graph neural networks: Adversarial robustness. Graph neural networks: foundations, frontiers, and applications, pp.\ 149--176, 2022

    2022

  14. [22]

    Link spam alliances

    Zoltan Gyongyi and Hector Garcia-Molina. Link spam alliances. Technical report, Stanford, 2005

    2005

  15. [23]

    Inductive representation learning on large graphs

    Will Hamilton, Zhitao Ying, and Jure Leskovec. Inductive representation learning on large graphs. Advances in neural information processing systems, 30, 2017

    2017

  16. [24]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems, 30, 2017

    2017

  17. [25]

    Datamodels: Predicting predictions from training data

    Andrew Ilyas, Sung Min Park, Logan Engstrom, Guillaume Leclerc, and Aleksander Madry. Datamodels: Predicting predictions from training data. arXiv preprint arXiv:2202.00622, 2022

    2022 arXiv

  18. [26]

    Graph structure learning for robust graph neural networks

    Wei Jin, Yao Ma, Xiaorui Liu, Xianfeng Tang, Suhang Wang, and Jiliang Tang. Graph structure learning for robust graph neural networks. In Proceedings of the 26th ACM SIGKDD international conference on knowledge discovery & data mining, pp.\ 66--74, 2020

    2020

  19. [27]

    Kingma and Jimmy Ba

    Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization, 2017. URL https://arxiv.org/abs/1412.6980

    2017 arXiv

  20. [28]

    Kipf and Max Welling

    Thomas N. Kipf and Max Welling. Semi-supervised classification with graph convolutional networks, 2017

    2017

  21. [29]

    Fairness-aware pac learning from corrupted data

    Nikola H Konstantinov and Christoph Lampert. Fairness-aware pac learning from corrupted data. JMLR, 2022

    2022

  22. [30]

    Towards unbounded machine unlearning

    Meghdad Kurmanji, Peter Triantafillou, and Eleni Triantafillou. Towards unbounded machine unlearning. NeurIPS, 2023

    2023

  23. [31]

    The wmdp benchmark: Measuring and reducing malicious use with unlearning

    Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin D Li, Ann-Kathrin Dombrowski, Shashwat Goel, Long Phan, et al. The wmdp benchmark: Measuring and reducing malicious use with unlearning. arXiv preprint arXiv:2403.03218, 2024 a

    2024 arXiv

  24. [32]

    Delta-influence: Unlearning poisons via influence functions, 2024 b

    Wenjie Li, Jiawei Li, Christian Schroeder de Witt, Ameya Prabhu, and Amartya Sanyal. Delta-influence: Unlearning poisons via influence functions, 2024 b . URL https://arxiv.org/abs/2411.13731

    2024

  25. [33]

    Towards effective and general graph unlearning via mutual evolution

    Xunkai Li, Yulin Zhao, Zhengyu Wu, Wentao Zhang, Rong-Hua Li, and Guoren Wang. Towards effective and general graph unlearning via mutual evolution. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pp.\ 13682--13690, 2024 c

    2024

  26. [34]

    Rethinking label poisoning for GNN s: Pitfalls and attacks

    Vijay Lingam, Mohammad Sadegh Akhondzadeh, and Aleksandar Bojchevski. Rethinking label poisoning for GNN s: Pitfalls and attacks. In The Twelfth International Conference on Learning Representations, 2024. URL https://openreview.net/forum?id=J7ioefqDPw

    2024

  27. [35]

    TOFU : A task of fictitious unlearning for LLM s

    Pratyush Maini, Zhili Feng, Avi Schwarzschild, Zachary Chase Lipton, and J Zico Kolter. TOFU : A task of fictitious unlearning for LLM s. In First Conference on Language Modeling, 2024. URL https://openreview.net/forum?id=B41hNBoWLo

    2024

  28. [36]

    Position: Graph foundation models are already here

    Haitao Mao, Zhikai Chen, Wenzhuo Tang, Jianan Zhao, Yao Ma, Tong Zhao, Neil Shah, Mikhail Galkin, and Jiliang Tang. Position: Graph foundation models are already here. In Forty-first International Conference on Machine Learning, 2024

    2024

  29. [37]

    Image-based recommendations on styles and substitutes, 2015

    Julian McAuley, Christopher Targett, Qinfeng Shi, and Anton van den Hengel. Image-based recommendations on styles and substitutes, 2015. URL https://arxiv.org/abs/1506.04757

    2015 arXiv

  30. [38]

    A survey of machine unlearning

    Thanh Tam Nguyen, Thanh Trung Huynh, Phi Le Nguyen, Alan Wee-Chung Liew, Hongzhi Yin, and Quoc Viet Hung Nguyen. A survey of machine unlearning. arXiv preprint arXiv:2209.02299, 2022

    2022 arXiv

  31. [39]

    Northcutt, Anish Athalye, and Jonas Mueller

    Curtis G. Northcutt, Anish Athalye, and Jonas Mueller. Pervasive label errors in test sets destabilize machine learning benchmarks. In NeurIPS, 2021

    2021

  32. [40]

    Training language models to follow instructions with human feedback

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. Advances in neural information processing systems, 35: 0 2...

    2022

  33. [41]

    A law of adversarial risk, interpolation, and label noise

    Daniel Paleka and Amartya Sanyal. A law of adversarial risk, interpolation, and label noise. In ICLR, 2023

    2023

  34. [42]

    Machine unlearning fails to remove data poisoning attacks

    Martin Pawelczyk, Jimmy Z Di, Yiwei Lu, Gautam Kamath, Ayush Sekhari, and Seth Neel. Machine unlearning fails to remove data poisoning attacks. arXiv preprint arXiv:2406.17216, 2024

    2024

  35. [43]

    A survey of graph unlearning

    Anwar Said, Tyler Derr, Mudassir Shabbir, Waseem Abbas, and Xenofon Koutsoukos. A survey of graph unlearning. arXiv preprint arXiv:2310.02164, 2023

    2023

  36. [44]

    Dokania, Varun Kanade, and Philip Torr

    Amartya Sanyal, Puneet K. Dokania, Varun Kanade, and Philip Torr. How benign is benign overfitting? In ICLR, 2021

    2021

  37. [45]

    How unfair is private learning? In Uncertainty in Artificial Intelligence, 2022

    Amartya Sanyal, Yaxi Hu, and Fanny Yang. How unfair is private learning? In Uncertainty in Artificial Intelligence, 2022

    2022

  38. [46]

    Potion: Towards poison unlearning

    Stefan Schoepf, Jack Foster, and Alexandra Brintrup. Potion: Towards poison unlearning. arXiv preprint arXiv:2406.09173, 2024

    2024 arXiv

  39. [47]

    Pitfalls of graph neural network evaluation, 2019

    Oleksandr Shchur, Maximilian Mumme, Aleksandar Bojchevski, and Stephan Günnemann. Pitfalls of graph neural network evaluation, 2019. URL https://arxiv.org/abs/1811.05868

    2019 arXiv

  40. [48]

    Node injection attacks on graphs via reinforcement learning

    Yiwei Sun, Suhang Wang, Xianfeng Tang, Tsung-Yu Hsieh, and Vasant Honavar. Node injection attacks on graphs via reinforcement learning. arXiv preprint arXiv:1909.06543, 2019

    1909 arXiv

  41. [49]

    Unlink to unlearn: Simplifying edge unlearning in gnns

    Jiajun Tan, Fei Sun, Ruichen Qiu, Du Su, and Huawei Shen. Unlink to unlearn: Simplifying edge unlearning in gnns. In Companion Proceedings of the ACM on Web Conference 2024, pp.\ 489--492, 2024

    2024

  42. [50]

    Arnetminer: extraction and mining of academic social networks

    Jie Tang, Jing Zhang, Limin Yao, Juanzi Li, Li Zhang, and Zhong Su. Arnetminer: extraction and mining of academic social networks. In Proceedings of the 14th ACM SIGKDD international conference on Knowledge discovery and data mining, pp.\ 990--998, 2008

    2008

  43. [51]

    Graph attention networks, 2018

    Petar Veličković, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Liò, and Yoshua Bengio. Graph attention networks, 2018

    2018

  44. [52]

    Microsoft academic graph: When experts are not enough

    Kuansan Wang, Zhihong Shen, Chiyuan Huang, Chieh-Han Wu, Yuxiao Dong, and Anshul Kanakia. Microsoft academic graph: When experts are not enough. Quantitative Science Studies, 1 0 (1): 0 396--413, 2020

    2020

  45. [53]

    The heterophilic snowflake hypothesis: Training and empowering gnns for heterophilic graphs, 2024

    Kun Wang, Guibin Zhang, Xinnan Zhang, Junfeng Fang, Xun Wu, Guohao Li, Shirui Pan, Wei Huang, and Yuxuan Liang. The heterophilic snowflake hypothesis: Training and empowering gnns for heterophilic graphs, 2024. URL https://arxiv.org/abs/2406.12539

    2024 arXiv

  46. [54]

    Machine unlearning of features and labels

    Alexander Warnecke, Lukas Pirch, Christian Wressnegger, and Konrad Rieck. Machine unlearning of features and labels. In Proc. of the 30th Network and Distributed System Security (NDSS), 2023

    2023

  47. [55]

    Baoning Wu and Brian D. Davison. Identifying link farm spam pages. In Special Interest Tracks and Posters of the 14th International Conference on World Wide Web, WWW '05, pp.\ 820–829, New York, NY, USA, 2005. Association for Computing Machinery. ISBN 1595930515. doi:10.1145/1...

    2005

  48. [56]

    Gif: A general graph unlearning strategy via influence function

    Jiancan Wu, Yi Yang, Yuchun Qian, Yongduo Sui, Xiang Wang, and Xiangnan He. Gif: A general graph unlearning strategy via influence function. In Proceedings of the ACM Web Conference 2023, pp.\ 651--661, 2023 a

    2023

  49. [57]

    Certified edge unlearning for graph neural networks

    Kun Wu, Jie Shen, Yue Ning, Ting Wang, and Wendy Hui Wang. Certified edge unlearning for graph neural networks. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp.\ 2606--2617, 2023 b

    2023

  50. [58]

    Graph neural networks in recommender systems: A survey

    Shiwen Wu, Fei Sun, Wentao Zhang, Xu Xie, and Bin Cui. Graph neural networks in recommender systems: A survey. ACM Comput. Surv., 55 0 (5), December 2022. ISSN 0360-0300. doi:10.1145/3535101. URL https://doi.org/10.1145/3535101

    2022 doi

  51. [59]

    On the security risks of knowledge graph reasoning

    Zhaohan Xi, Tianyu Du, Changjiang Li, Ren Pang, Shouling Ji, Xiapu Luo, Xusheng Xiao, Fenglong Ma, and Ting Wang. On the security risks of knowledge graph reasoning. In Proceedings of the 32nd USENIX Conference on Security Symposium, SEC '23, USA, 2023. USENIX Association. ISB...

    2023

  52. [60]

    Large language model unlearning

    Yuanshun Yao, Xiaojun Xu, and Yang Liu. Large language model unlearning. arXiv preprint arXiv:2310.10683, 2023

    2023 arXiv

  53. [61]

    Mitigating emergent robustness degradation while scaling graph learning

    Xiangchi Yuan, Chunhui Zhang, Yijun Tian, Yanfang Ye, and Chuxu Zhang. Mitigating emergent robustness degradation while scaling graph learning. In The Twelfth International Conference on Learning Representations, 2024. URL https://openreview.net/forum?id=Koh0i2u8qX

    2024

  54. [62]

    Chasing all-round graph representation robustness: Model, training, and optimization

    Chunhui Zhang, Yijun Tian, Mingxuan Ju, Zheyuan Liu, Yanfang Ye, Nitesh Chawla, and Chuxu Zhang. Chasing all-round graph representation robustness: Model, training, and optimization. In The Eleventh International Conference on Learning Representations, 2023. URL https://openre...

    2023

  55. [63]

    Data poisoning attack against knowledge graph embedding

    Hengtong Zhang, Tianhang Zheng, Jing Gao, Chenglin Miao, Lu Su, Yaliang Li, and Kui Ren. Data poisoning attack against knowledge graph embedding. In Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence, IJCAI-19 , pp.\ 4853--4859. Internat...

    2019 doi

  56. [64]

    Graph neural network approaches for drug-target interactions

    Zehong Zhang, Lifan Chen, Feisheng Zhong, Dingyan Wang, Jiaxin Jiang, Sulin Zhang, Hualiang Jiang, Mingyue Zheng, and Xutong Li. Graph neural network approaches for drug-target interactions. Current Opinion in Structural Biology, 73: 0 102327, 2022. ISSN 0959-440X. doi:https:/...

    2022

  57. [65]

    Untargeted adversarial attack on knowledge graph embeddings, 2024

    Tianzhe Zhao, Jiaoyan Chen, Yanchi Ru, Qika Lin, Yuxia Geng, and Jun Liu. Untargeted adversarial attack on knowledge graph embeddings, 2024. URL https://arxiv.org/abs/2405.10970

    2024 arXiv

  58. [66]

    u gner and Stephan G \

    Daniel Z \"u gner and Stephan G \"u nnemann. Adversarial attacks on graph neural networks via meta learning. In International Conference on Learning Representations (ICLR), 2019

    2019

  59. [67]

    u gner, Amir Akbarnejad, and Stephan G\

    Daniel Z\" u gner, Amir Akbarnejad, and Stephan G\" u nnemann. Adversarial attacks on neural networks for graph data. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, KDD '18, pp.\ 2847–2856, New York, NY, USA, 2018. Associat...

    2018

  60. [68]

    @esa (Ref

    \@ifxundefined[1] #1\@undefined \@firstoftwo \@secondoftwo \@ifnum[1] #1 \@firstoftwo \@secondoftwo \@ifx[1] #1 \@firstoftwo \@secondoftwo [2] @ #1 \@temptokena #2 #1 @ \@temptokena \@ifclassloaded agu2001 natbib The agu2001 class already includes natbib coding, so you should ...

  61. [69]

    \@lbibitem[] @bibitem@first@sw\@secondoftwo \@lbibitem[#1]#2 \@extra@b@citeb \@ifundefined br@#2\@extra@b@citeb \@namedef br@#2 \@nameuse br@#2\@extra@b@citeb \@ifundefined b@#2\@extra@b@citeb @num @parse #2 @tmp #1 NAT@b@open@#2 NAT@b@shut@#2 \@ifnum @merge>\@ne @bibitem@firs...

  62. [70]

    @open @close @open @close and [1] URL: #1 \@ifundefined chapter * \@mkboth \@ifxundefined @sectionbib * \@mkboth * \@mkboth\@gobbletwo \@ifclassloaded amsart * \@ifclassloaded amsbook * \@ifxundefined @heading @heading NAT@ctr thebibliography [1] @ \@biblabel @NAT@ctr \@bibset...

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.