Pith. sign in

REVIEW 3 major objections 6 minor 40 references

Mitigating the Structural Bias in Graph Adversarial Defenses

T0 review · 3 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that graph adversarial defenses under-serve low-degree nodes, and that a two-view purified-plus-kNN architecture closes that gap while defending attacks.

desk verdict A useful heuristic defense with a real evaluation gap: it beats five defense baselines on tail nodes, but the debiasing claim is not tested against the methods that actually target degree bias. read the letter →

arxiv 2504.20848 v1 pith:KQQE3PNY submitted 2025-04-29 cs.LG cs.AIcs.CR

Junyuan Fang , Huimin Liu , Han Yang , Jiajing Wu , Zibin Zheng , Chi K. Tse This is my paper · ORCID
classification cs.LGcs.AIcs.CR
keywords graphneuralnetworksadversarialdefensestructuralbiasdegreetailnodeshetero-homoaugmentedkNNnode-wiseattention
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that existing graph adversarial defenses, while improving overall accuracy, remain structurally biased: they recover high-degree nodes much better than low-degree ones, and it proposes a single framework, De2GNN, that defends against attacks and reduces that bias at the same time. The argument is that a purified graph obtained by removing dissimilar-feature links and adding same-feature links for tail nodes, combined with a feature-only kNN graph through node-wise attention, gives low-degree nodes enough trustworthy neighborhood information to survive adversarial perturbations. The empirical claim is that under 25% Metattack, De2GNN outperforms GCN, Jaccard, SVD, RGCN, and Median on tail-node accuracy across Cora, Citeseer, and Pubmed, while staying competitive on clean graphs. A sympathetic reader would care because real-world networks are long-tailed, so a defense whose gains concentrate on high-degree nodes leaves most nodes underprotected.

What carries the argument

The load-bearing mechanism is the two-view De2GNN architecture. A hetero-homo augmented graph is produced in two steps: links whose endpoints have feature similarity below threshold $t_1$ are removed (heterophilic removal), and then each tail node whose surrogate-model prediction confidence exceeds threshold $t_2$ is connected to its top $p$ nodes predicted to share its class, per Eq. (9). A second, attack-agnostic view is built by connecting each node to its $k$ nearest feature neighbors (kNN graph). Two separate GNNs encode the two views, and a node-wise attention layer (Eqs. (13)-(15)) learns per-node weights for blending the representations; this attention lets tail nodes lean on whichever view gives them more reliable context.

What would settle it

Corrupt the surrogate's pseudo-labels for tail nodes before the homophilic-link addition (for example, flip them for a random 20% of tail nodes), rerun De2GNN under the same 25% Metattack, and check whether tail-node accuracy drops substantially; the paper's debiasing story requires a large drop, whereas a small drop would indicate the benefit comes from the kNN view or attention rather than the surrogate-guided edges.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central claim is that De2GNN can "defend against possible adversarial perturbations and mitigate the structural bias on nodes with low degree simultaneously." Concretely, under 25% Metattack perturbation, tail-node (degree $\leq 5$) accuracy reaches 0.7491 on Cora, 0.7082 on Citeseer, and 0.8487 on Pubmed, the best among all tested baselines in every dataset, exceeding Jaccard, SVD, RGCN, and Median; clean accuracy remains roughly competitive, with De2GNN best on Citeseer. The paper also demonstrates the structural-bias premise it builds on: GCN, Jaccard, and SVD all show a strong accuracy gap between high-degree and low-degree nodes under the same attack.

Load-bearing premise

The load-bearing premise is that the surrogate GNN trained on the purified graph predicts same-class neighbors for low-degree nodes accurately enough that adding those edges improves the final model, rather than contaminating it with mislabeled connections.

Editorial extensions

If this is right

  • If De2GNN's central claim holds, adversarial defense evaluation should report degree-stratified accuracy, since aggregate accuracy can hide poor protection for the low-degree majority.
  • Purification-only defenses such as Jaccard and SVD are outperformed on tail nodes by the combined purification-plus-augmentation design, suggesting that removing noise alone is insufficient for long-tailed graphs.
  • The ablation results imply that heterophilic link removal is the largest individual contributor: dropping it lowers Cora tail-node accuracy from 0.7491 to 0.6265 under attack.
  • Adding homophilic links guided by the surrogate GNN also contributes on all three datasets, since De2GNN minus this module underperforms the full model on tail nodes.
  • The kNN view and the attention module each add a smaller but consistent gain, so the benefit is architectural rather than coming from any single graph transformation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the surrogate model's pseudo-labels for tail nodes are unreliable, the homophilic edge-addition step could quietly inject mislabeled neighbors; a natural test is to corrupt those pseudo-labels during edge construction and measure the drop in tail-node accuracy.
  • Because the kNN view is built only from raw features, the same two-view principle could transfer to other defense families, such as adding a feature-only view to robust aggregators; this is an extrapolation, not a claim the paper tests.
  • The paper evaluates only global link-injection attacks (Metattack); whether De2GNN's debiasing persists under removal-based or node-injection attacks is untested, and those scenarios could interact differently with the surrogate-guided edge additions.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper studies the structural (degree) bias of graph adversarial defenses: defense GNNs are shown empirically to perform worse on low-degree ('tail') nodes under Metattack perturbations. The authors propose De2GNN, a framework that (i) removes heterophilic links based on feature similarity, (ii) adds homophilic links to tail nodes using predictions of a surrogate GNN, (iii) constructs a kNN-based feature graph, and (iv) fuses the two graph views with a node-wise attention mechanism. Experiments on Cora, Citeseer, and Pubmed under 25% Metattack compare De2GNN with GCN, Jaccard, SVD, RGCN, and Median, reporting all-node and tail-node (degree ≤ 5) accuracy, ablations, and parameter sensitivity. The paper concludes that De2GNN can defend against adversarial perturbations and mitigate structural bias simultaneously.

Significance. The paper identifies a real and underexplored problem: adversarial defense methods can inherit or even amplify the degree bias of standard GNNs. The proposed architecture is simple, modular, and the empirical gains on tail nodes are consistent across datasets: Table III shows the largest tail-node improvements on Cora (0.7491 vs. 0.7135 for Jaccard) and Pubmed (0.8487 vs. 0.8399 for SVD), with standard deviations over 10 runs. The ablation study (Table IV) demonstrates that each component contributes, and the parameter sensitivity analysis suggests robustness to p and k. The kNN view is a sensible attack-agnostic augmentation. However, the central claim that De2GNN 'mitigates structural bias' is not yet supported by the experimental design, because no degree-debiasing baseline is compared and no bias-gap metric is reported; the paper also does not fully specify how hyperparameters were selected. With additional experiments and clarifications, the contribution would be a useful step toward fairness-aware robust GNNs.

major comments (3)
  1. [VI-B, VI-D, VII] The debiasing claim is not empirically established because the evaluation includes no degree-debiasing baselines. Section VI-B compares only GCN, Jaccard, SVD, RGCN, and Median, none of which attempts to mitigate degree bias; the methods reviewed in Section II-C (Tang et al. [18], Tail-GNN [19], LTE4G [20], RawlsGCN [21], Liu et al. [22]) are absent from the experiments. As a result, the tail-node accuracy gains in Table III could reflect the fact that the baselines are not optimized for tail nodes, rather than a genuine debiasing property of De2GNN. Moreover, the paper never reports the high-degree versus low-degree accuracy gap before and after defense, so the 'mitigation of structural bias' stated in Section VII is not quantified relative to any debiasing-aware method. I recommend adding at least two or three degree-debiasing baselines from Section II-C and reporting balanced accuracy or the gap between degree groups, while keeping the adversarial setting.
  2. [VI-C, VI-D] The hyperparameter selection procedure for t1 and t2 is under-specified. Section VI-C states that t1 and t2 are determined by grid search over [0, 0.5] and [0.5, 0.9], respectively, but it does not state which data split is used for the search. Since the test set is defined as 80% of nodes and all reported accuracies in Tables II and III are on the test set, a grid search performed on the test set would make the comparisons optimistic and would not reflect a realistically deployable procedure. Please specify that a validation split was used, report the selected t1 and t2 values for each dataset, and state whether the same split was used for all baselines.
  3. [VI-C, VI-D2, VII] The defense claim is overbroad because only one attack scenario is evaluated: Metattack with 25% injected links. The conclusion in Section VII says De2GNN can 'defend against possible adversarial perturbations', but no Nettack, DICE, or other attack types, and no varying perturbation rates, are tested. The method's link-removal and link-addition steps may behave very differently under remove-link attacks or feature attacks. Adding at least one more attack type or a perturbation-rate sweep would substantially strengthen the generality of the claim; without it, the paper's central defense result is limited to one global poisoning attack.
minor comments (6)
  1. [Figures 1-6] The captions and axis labels of Figures 1-6 appear corrupted in the submitted PDF (e.g., repeated glyph sequences), making the figures unreadable. Please regenerate them with proper labels.
  2. [Section VI-D5] The text after Figure 7 and after Figure 8 appears to have swapped p and k: the first paragraph says 'From Fig. 8 ... different settings of p' and the second says 'For the number of added nodes ... varied k', but Figures 7 and 8 are captioned as p and k, respectively.
  3. [Table III] For Pubmed, the tail-node accuracy of De2GNN (0.8487) is slightly higher than its all-node accuracy (0.8470). This unusual inversion should be briefly explained, since it suggests the tail-node subset is not consistently harder under the augmented graph.
  4. [Section V-C, Eqs. (13)-(15)] The attention mechanism's dimensions are not fully specified: it should be stated whether the sigma-activated projection produces two logits per node and how alpha_{·,0} and alpha_{·,1} are normalized.
  5. [Section V-A2, Eq. (9)] The description 'top p nodes which have the highest probabilities that belong to the same class as v' is ambiguous: it should be clarified whether the same-class condition is based on the surrogate model's predicted label or on the node's true label when v is a training node.
  6. [Section VI-C] The statement 'All defense methods are adopted from the default parameter settings' is too vague; please report the actual configurations (e.g., hidden dimensions, layers, learning rate) for all baselines and for De2GNN.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: De2GNN is an empirical defense/debiasing framework whose claims are supported by external benchmark comparisons; hyperparameter tuning and surrogate-based augmentation are modeling choices, not derivation-from-input.

full rationale

The paper's central claims are empirical rather than derivational: De2GNN's architecture (Section V) is defined by graph-augmentation equations (7)-(10), kNN construction, and the multi-view attention combination (11)-(15), and its effectiveness is measured against external baselines (GCN, Jaccard, SVD, RGCN, Median) on perturbed and clean graphs in Tables II and III. No fitted parameter is renamed as a prediction, no output quantity is equal by construction to an input quantity, and no uniqueness theorem or load-bearing self-citation is invoked to force the proposed choice. The homophilic-link addition in Eq. (9) does use a surrogate GNN's pseudo-labels to add edges to tail nodes, which is a self-referential modeling step in the loose sense of self-training; however, the paper itself acknowledges this risk in Section VI-D5, noting that 'these homophilic neighbors are obtained from the surrogate GNN model which may contain some noisy predictions.' That is a stated modeling limitation, not a circular reduction of the reported accuracy to the surrogate's own outputs, because the final De2GNN is still trained with ground-truth labels and its tail-node accuracy is evaluated against independent test data under adversarial perturbations. The thresholds t1, t2 and the counts p, k are tuned via grid search, which is standard supervised model selection rather than prediction-from-fit. The absence of degree-debiasing baselines from the related-work list (Sec. II-C) in the experiments is a legitimate completeness/correctness concern, but it is not a form of circularity; the claim of debiasing superiority over the five selected baselines does not reduce to any equation or self-citation in the paper. Accordingly, no specific circular step can be exhibited, and the appropriate finding is no significant circularity.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central claim is empirical and rests on several tuned hyperparameters (t1, t2, p, k, tail-degree bound) whose defaults are partly unreported, plus domain assumptions about heterophily of attacks and reliability of surrogate pseudo-labels. No new theoretical entities are introduced.

free parameters (6)
  • t1 (heterophilic link removal threshold) = not reported; grid-searched in [0, 0.5] with step 0.05
    Controls how many links are removed as adversarial in Eq. (8); selected by grid search on the benchmark datasets, so the reported accuracy is conditional on this choice.
  • t2 (homophilic link addition confidence threshold) = not reported; grid-searched in [0.5, 0.9] with step 0.1
    Controls which tail nodes receive added homophilic links in Eq. (9); chosen by grid search, affecting the debiasing result.
  • p (number of added homophilic neighbors per tail node) = not reported; analyzed over {3, 5, 8, 10}
    The number of top-p same-class neighbors added per tail node in Eq. (9); the default used for main results is not stated.
  • k (number of kNN neighbors) = not reported; analyzed over {3, 5, 8, 10}
    Number of feature-similarity neighbors in the kNN augmented graph; the default used for main results is not stated.
  • Tail-node degree bound = 5
    Sets which nodes are 'tail' nodes for the debiasing claim; taken from prior work [17] and used to report all tail-node accuracy, so the debiasing improvement is defined relative to this cutoff.
  • GNN training hyperparameters (layers, hidden size, learning rate, epochs) = not reported
    Standard training settings are not reported, so the exact numbers in Tables II through IV are not reproducible from the paper alone.
assumptions (5)
  • domain assumption Adversarial links added by Metattack are predominantly heterophilic and detectable by low feature similarity.
    Invoked in Section V-A1; the defense removes links with similarity below t1 based on Jaccard or cosine, citing [5], [38]. If the attack creates homophilic or feature-similar links, the removal step fails.
  • domain assumption The surrogate GNN trained on the purified graph yields sufficiently reliable same-class predictions to choose beneficial homophilic neighbors for tail nodes.
    Section V-A2, Eq. (9); the whole tail-node augmentation rests on top-p predictions from Msur. Tail nodes are exactly the hard cases where surrogate confidence may be low or wrong.
  • domain assumption The kNN graph built on raw node features is attack-agnostic and complementary to the hetero-homo view.
    Section V-B; assumes raw features are not adversarially perturbed and that feature-similarity neighbors carry useful signal under attack.
  • domain assumption Metattack with 25% link perturbation is representative of graph adversarial attacks for evaluating defense and debiasing.
    Section VI-C; only one attack scenario is tested, yet conclusions in Section VII generalize to 'adversarial attacks' broadly.
  • standard math Standard GCN message passing and kNN are accepted from prior literature.
    Used throughout Sections III and V; no new mathematical machinery is introduced, so standard results are assumed.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Mitigating the Structural Bias in Graph Adversarial Defenses." pith.science (2026). https://pith.science/paper/KQQE3PNY

@misc{pith2026250420848,
  author       = {Pith},
  title        = {Pith review of: Mitigating the Structural Bias in Graph Adversarial Defenses},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KQQE3PNY}},
  note         = {Machine review of arXiv:2504.20848}
}
abstract

In recent years, graph neural networks (GNNs) have shown great potential in addressing various graph structure-related downstream tasks. However, recent studies have found that current GNNs are susceptible to malicious adversarial attacks. Given the inevitable presence of adversarial attacks in the real world, a variety of defense methods have been proposed to counter these attacks and enhance the robustness of GNNs. Despite the commendable performance of these defense methods, we have observed that they tend to exhibit a structural bias in terms of their defense capability on nodes with low degree (i.e., tail nodes), which is similar to the structural bias of traditional GNNs on nodes with low degree in the clean graph. Therefore, in this work, we propose a defense strategy by including hetero-homo augmented graph construction, $k$NN augmented graph construction, and multi-view node-wise attention modules to mitigate the structural bias of GNNs against adversarial attacks. Notably, the hetero-homo augmented graph consists of removing heterophilic links (i.e., links connecting nodes with dissimilar features) globally and adding homophilic links (i.e., links connecting nodes with similar features) for nodes with low degree. To further enhance the defense capability, an attention mechanism is adopted to adaptively combine the representations from the above two kinds of graph views. We conduct extensive experiments to demonstrate the defense and debiasing effect of the proposed strategy on benchmark datasets.

Figures

Figures reproduced from arXiv: 2504.20848 by the authors.

Figure 1
Figure 1. Degree distributions of Cora and Citeseer datasets. [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Accuracy of GCN with regard to node degree on Cora and Citeseer [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Accuracy of Jaccard with regard to node degree on Cora and Citeseer [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Accuracy of SVD with regard to node degree on Cora and Citeseer [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: Systematic framework of De2GNN. Red links in the input graph indicate corresponding adversarial noises. [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Accuracy of baselines with regard to node degree on perturbed datasets by injecting 25% of noisy links via Metattack. [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Parameter analysis for the number of added nodes during the addition [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 8
Figure 8. Figure 8: Parameter analysis for the number of neighbors during the [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

40 extracted references · 32 canonical work pages

  1. [18]

    Investigating and mitigating degree-related biases in graph convoltuional networks,

    X. Tang, H. Yao, Y . Sun, Y . Wang, J. Tang, C. Aggarwal, P. Mitra, and S. Wang, “Investigating and mitigating degree-related biases in graph convoltuional networks,” in Proc. CIKM, 2020, pp. 1435–1444

    work page 2020

  2. [19]

    Tail-gnn: Tail-node graph neural networks,

    Z. Liu, T.-K. Nguyen, and Y . Fang, “Tail-gnn: Tail-node graph neural networks,” in Proc. KDD, 2021, pp. 1109–1119

    work page 2021

  3. [20]

    Lte4g: Long-tail experts for graph neural networks,

    S. Yun, K. Kim, K. Yoon, and C. Park, “Lte4g: Long-tail experts for graph neural networks,” in Proc. CIKM, 2022, pp. 2434–2443

    work page 2022

  4. [21]

    Rawlsgcn: Towards rawlsian difference principle on graph convolutional network,

    J. Kang, Y . Zhu, Y . Xia, J. Luo, and H. Tong, “Rawlsgcn: Towards rawlsian difference principle on graph convolutional network,” in Proc. WWW, 2022, pp. 1214–1225

    work page 2022

  5. [22]

    On generalized degree fairness in graph neural networks,

    Z. Liu, T.-K. Nguyen, and Y . Fang, “On generalized degree fairness in graph neural networks,” in Proc. AAAI, vol. 37, no. 4, 2023, pp. 4525– 4533

    work page 2023

  6. [1]

    A comprehensive survey on graph neural networks,

    Z. Wu, S. Pan, F. Chen, G. Long, C. Zhang, and S. Y . Philip, “A comprehensive survey on graph neural networks,” IEEE Trans. Neural Netw. Learn Syst. , vol. 32, no. 1, pp. 4–24, 2020

    work page 2020

  7. [2]

    Graph neural networks: A review of methods and applications,

    J. Zhou, G. Cui, S. Hu, Z. Zhang, C. Yang, Z. Liu, L. Wang, C. Li, and M. Sun, “Graph neural networks: A review of methods and applications,” AI Open , vol. 1, pp. 57–81, 2020

    work page 2020

  8. [3]

    Deep learning on graphs: A survey,

    Z. Zhang, P. Cui, and W. Zhu, “Deep learning on graphs: A survey,” IEEE Trans. Knowl. Data Eng. , 2020

    work page 2020

Show all 40 references
  1. [4]

    Graph neural network for traffic forecasting: A survey,

    W. Jiang and J. Luo, “Graph neural network for traffic forecasting: A survey,” arXiv preprint arXiv:2101.11174 , 2021

    2021 arXiv

  2. [5]

    Adversarial attacks and defenses on graphs: A review, a tool and empirical studies,

    W. Jin, Y . Li, H. Xu, Y . Wang, S. Ji, C. Aggarwal, and J. Tang, “Adversarial attacks and defenses on graphs: A review, a tool and empirical studies,” arXiv preprint arXiv:2003.00653 , 2020

    2003 arXiv

  3. [6]

    Adversarial attacks and defenses in images, graphs and text: A review,

    H. Xu, Y . Ma, H.-C. Liu, D. Deb, H. Liu, J.-L. Tang, and A. K. Jain, “Adversarial attacks and defenses in images, graphs and text: A review,” Int. J. Autom. Comput. , vol. 17, no. 2, pp. 151–178, 2020

    2020

  4. [7]

    A survey of adversarial learning on graphs,

    L. Chen, J. Li, J. Peng, T. Xie, Z. Cao, K. Xu, X. He, and Z. Zheng, “A survey of adversarial learning on graphs,” arXiv preprint arXiv:2003.05730, 2020

    2003 arXiv

  5. [8]

    Adversarial attacks on neural networks for graph data,

    D. Z ¨ugner, A. Akbarnejad, and S. G ¨unnemann, “Adversarial attacks on neural networks for graph data,” in Proc. KDD, 2018, pp. 2847–2856

    2018

  6. [9]

    Adversarial examples for graph data: Deep insights into attack and defense,

    H. Wu, C. Wang, Y . Tyshetskiy, A. Docherty, K. Lu, and L. Zhu, “Adversarial examples for graph data: Deep insights into attack and defense,” in Proc. IJCAI, 2019, pp. 4816–4823

    2019

  7. [10]

    Adversarial attack on graph structured data,

    H. Dai, H. Li, T. Tian, X. Huang, L. Wang, J. Zhu, and L. Song, “Adversarial attack on graph structured data,” in Proc. ICML. PMLR, 2018, pp. 1115–1124

    2018

  8. [11]

    Fast gradient attack on network embedding,

    J. Chen, Y . Wu, X. Xu, Y . Chen, H. Zheng, and Q. Xuan, “Fast gradient attack on network embedding,” arXiv preprint arXiv:1809.02797 , 2018

    2018 arXiv

  9. [12]

    Single node injection attack against graph neural networks,

    S. Tao, Q. Cao, H. Shen, J. Huang, Y . Wu, and X. Cheng, “Single node injection attack against graph neural networks,” in Proc. CIKM , 2021, pp. 1794–1803

    2021

  10. [13]

    All you need is low (rank) defending against adversarial attacks on graphs,

    N. Entezari, S. A. Al-Sayouri, A. Darvishzadeh, and E. E. Papalexakis, “All you need is low (rank) defending against adversarial attacks on graphs,” in Proceedings of the 13th International Conference on Web Search and Data Mining , 2020, pp. 169–177

    2020

  11. [14]

    Robust graph convolutional networks against adversarial attacks,

    D. Zhu, Z. Zhang, P. Cui, and W. Zhu, “Robust graph convolutional networks against adversarial attacks,” in Proc. KDD , 2019, pp. 1399– 1407

    2019

  12. [15]

    Understanding structural vulnerability in graph convolutional networks,

    L. Chen, J. Li, Q. Peng, Y . Liu, Z. Zheng, and C. Yang, “Understanding structural vulnerability in graph convolutional networks,” inProc. IJCAI, 2021, pp. 2249–2255

    2021

  13. [16]

    Batch virtual adversarial training for graph convolutional networks,

    Z. Deng, Y . Dong, and J. Zhu, “Batch virtual adversarial training for graph convolutional networks,” AI Open , vol. 4, pp. 73–79, 2023

    2023

  14. [17]

    Towards locality- aware meta-learning of tail node embeddings on networks,

    Z. Liu, W. Zhang, Y . Fang, X. Zhang, and S. C. Hoi, “Towards locality- aware meta-learning of tail node embeddings on networks,” in Proc. CIKM, 2020, pp. 975–984

    2020

  15. [23]

    Semi-supervised classification with graph convolutional networks,

    T. N. Kipf and M. Welling, “Semi-supervised classification with graph convolutional networks,” in Proc. ICLR, 2017. 10 IEEE TRANSACTIONS ON XXX, VOL. XX, NO. XX, XX 2024

    2017

  16. [24]

    Inductive representation learning on large graphs,

    W. Hamilton, Z. Ying, and J. Leskovec, “Inductive representation learning on large graphs,” Proc. NeurIPS, vol. 30, 2017

    2017

  17. [25]

    Graph attention networks,

    P. Veli ˇckovi´c, G. Cucurull, A. Casanova, A. Romero, P. Lio, and Y . Bengio, “Graph attention networks,” in Proc. ICLR, 2018

    2018

  18. [26]

    Simplifying graph convolutional networks,

    F. Wu, A. Souza, T. Zhang, C. Fifty, T. Yu, and K. Weinberger, “Simplifying graph convolutional networks,” in Proc. ICML . PMLR, 2019, pp. 6861–6871

    2019

  19. [27]

    Towards deeper graph neural networks,

    M. Liu, H. Gao, and S. Ji, “Towards deeper graph neural networks,” in Proc. KDD, 2020, pp. 338–348

    2020

  20. [28]

    Deepergcn: All you need to train deeper gcns,

    G. Li, C. Xiong, A. Thabet, and B. Ghanem, “Deepergcn: All you need to train deeper gcns,” arXiv preprint arXiv:2006.07739 , 2020

    2006 arXiv

  21. [29]

    Scalable graph neural network training: The case for sampling,

    M. Serafini and H. Guan, “Scalable graph neural network training: The case for sampling,” ACM SIGOPS Operating Systems Review , vol. 55, no. 1, pp. 68–76, 2021

    2021

  22. [30]

    Distgnn: Scalable distributed training for large-scale graph neural networks,

    V . Md, S. Misra, G. Ma, R. Mohanty, E. Georganas, A. Heinecke, D. Kalamkar, N. K. Ahmed, and S. Avancha, “Distgnn: Scalable distributed training for large-scale graph neural networks,” in Proc. SC, 2021, pp. 1–14

    2021

  23. [31]

    Scalable and efficient full-graph gnn training for large graphs,

    X. Wan, K. Xu, X. Liao, Y . Jin, K. Chen, and X. Jin, “Scalable and efficient full-graph gnn training for large graphs,” vol. 1, no. 2. ACM New York, NY , USA, 2023, pp. 1–23

    2023

  24. [32]

    Adversarial attacks on graph neural networks via meta learning,

    D. Z ¨ugner and S. G ¨unnemann, “Adversarial attacks on graph neural networks via meta learning,” in Proc. ICLR, 2018

    2018

  25. [33]

    Adversarial attack on large scale graph,

    J. Li, T. Xie, L. Chen, F. Xie, X. He, and Z. Zheng, “Adversarial attack on large scale graph,” IEEE Trans. Knowl. Data Eng. , 2021, to be published, doi: 10.1109/TKDE.2021.3078755

    2021

  26. [34]

    Adversarial attacks on graph neural networks via node injections: A hierarchical reinforcement learning approach,

    Y . Sun, S. Wang, X. Tang, T.-Y . Hsieh, and V . Honavar, “Adversarial attacks on graph neural networks via node injections: A hierarchical reinforcement learning approach,” in Proc. WWW, 2020, p. 673–683

    2020

  27. [35]

    Gani: Global attacks on graph neural networks via imperceptible node injections,

    J. Fang, H. Wen, J. Wu, Q. Xuan, Z. Zheng, and C. K. Tse, “Gani: Global attacks on graph neural networks via imperceptible node injections,” IEEE Trans. Comput. Soc. Syst. , pp. 1–14, 2024

    2024

  28. [36]

    Robust training of graph convolutional networks via latent perturbation,

    H. Jin and X. Zhang, “Robust training of graph convolutional networks via latent perturbation,” in Proc. ECML-PKDD . Springer, 2021, pp. 394–411

    2021

  29. [37]

    Topology attack and defense for graph neural networks: An optimization perspective,

    K. Xu, H. Chen, S. Liu, P.-Y . Chen, T.-W. Weng, M. Hong, and X. Lin, “Topology attack and defense for graph neural networks: An optimization perspective,” arXiv preprint arXiv:1906.04214 , 2019

    1906 arXiv

  30. [38]

    Certifiable robustness to graph perturbations,

    A. Bojchevski and S. G ¨unnemann, “Certifiable robustness to graph perturbations,” Proc. NeurIPS, vol. 32, 2019

    2019

  31. [39]

    K-nearest neighbor,

    L. E. Peterson, “K-nearest neighbor,” Scholarpedia, vol. 4, no. 2, p. 1883, 2009

    2009

  32. [40]

    Collective classification in network data,

    P. Sen, G. Namata, M. Bilgic, L. Getoor, B. Galligher, and T. Eliassi- Rad, “Collective classification in network data,” AI Mag., vol. 29, no. 3, pp. 93–93, 2008

    2008

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.