Pith. sign in

REVIEW 4 major objections 4 minor 33 references

Quantifying the Noise of Structural Perturbations on Graph Adversarial Attacks

T0 review · 4 major / 4 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that a per-link noise score derived from GNN hidden states ranks adversarial links by attack strength and enables cheap targeted attacks.

desk verdict A plausible new heuristic for candidate pruning in targeted structural attacks, but the paper's central claim that its noise metric ranks per-link attack strength is under-supported and should be tested directly. read the letter →

arxiv 2504.20869 v2 pith:FSOHXS2W submitted 2025-04-29 cs.LG cs.AIcs.CR

Junyuan Fang , Han Yang , Haixian Wen , Jiajing Wu , Zibin Zheng , Chi K. Tse This is my paper · ORCID
classification cs.LGcs.AIcs.CR
keywords graphneuralnetworksadversarialattackslinknoisetargetedpropagationcandidatepruninghomophilicgraphsentropydissimilarity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to make structural graph attacks interpretable by assigning each candidate added link a number—its noise—that measures how much that link would disturb the neighborhood aggregation of the target node. It argues that ranking candidate links by this noise, rather than searching all possible links by classification margin, finds the strongest perturbations with a much smaller candidate set. If true, targeted evasion attacks on homophilic graphs become cheaper and explainable: effective attacks connect the target to low-degree, dissimilar, confidently misclassified nodes. The paper reports that the noise-ranked strategies NMA and NMAB match or beat the full margin-based NETTACK baseline on Cora, Citeseer, and Pubmed across GCN, SGC, and GAT, with NMAB best overall.

What carries the argument

The load-bearing object is the appropriate link noise fLN in Eq. (8): a per-candidate score equal to the cross-entropy between the surrogate GCN's hidden or class-probability vectors of the target $u$ and the adversarial node $v$, divided by $\sqrt{|N_v|+1}$. The numerator is the dissimilarity term $\text{DIS}(u,v)$ proposed in Eq. (7); the denominator is the aggregation weight the new link would receive under symmetric normalized adjacency. Two propositions justify the shape: under a one-layer GCN with one-hot features and a near-diagonal optimal weight matrix, Proposition 4.1 shows low-degree targets are easier to attack and low-degree adversarial nodes have larger influence, and Proposition 4.2 shows that, degree held equal, more dissimilar adversarial nodes disturb aggregation more. The metric packages both factors into one ranking, and this ranking is what lets NGA, NMA, and NMAB prune the candidate space.

What would settle it

Train a surrogate GCN on a homophilic graph, compute $\text{fLN}$ for every candidate edge of many target nodes, then add each edge alone and record the true classification-margin drop. If the $\text{fLN}$ rank order is not strongly associated with the margin drop (for example, if the Spearman correlation is near zero or negative), the noise metric fails as the paper defines it.

Watch

Extended reading notes

Core claim

The paper's central claim is that adversarial links have measurable noise and this noise can be computed before an attack. For a target $u$ and a candidate $v$ not yet connected to it, Eq. (8) defines $$\text{fLN}(u,v)=\frac{-\sum_i ($h_u^{{(k)}}$)_i \log ($h_v^{{(k)}}$)_i}{\sqrt{|N_v|+1}},$$ where $h^{(k)}$ are surrogate GCN hidden representations interpreted as class probabilities. The numerator captures how different the candidate's information is from the target's, and the denominator captures how strongly that information would enter the aggregation. The paper claims that ranking candidate links by this score localizes the strongest perturbations, so greedy or margin-based searches can be restricted to a small candidate set without losing attack power. It also claims, via two propositions on a one-layer GCN with one-hot features, that low-degree targets are easier to attack and low-degree, dissimilar adversarial nodes are the most influential; the experiments then show NMA and NMAB matching or beating full-margin NETTACK while using far fewer candidates, with NMAB best overall.

Load-bearing premise

The results depend on the surrogate GCN's class-probability scores being a faithful stand-in for how much each candidate edge actually disturbs the targeted model's prediction, including for deep GNNs with real features.

Editorial extensions

If this is right

  • Attacks can run at a fraction of the search cost: NMA restricts margin evaluation to the top $5\Delta$ noise-ranked links and still matches or beats NETTACK, which searches all valid links.
  • Because the surrogate is GCN and the attacks still transfer to SGC and GAT, the noise ranking is not tied to one model's parameters.
  • Effective adversarial links have a consistent profile—low degree, different class, high predicted confidence—so attack outcomes become explainable in structural terms.
  • Noise ranking can be used as a preprocessing plug-in for other attack methods, cutting unnecessary searches on low-noise candidates.
  • Choosing entropy as the dissimilarity measure matters: the paper's comparisons show entropy beats Euclidean and Cosine distance for every proposed strategy.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An efficiency gain the paper does not pursue: since fLN for a target only needs stored surrogate representations and a degree lookup, the score can be precomputed once per graph and reused across targets.
  • A testable premise behind NMAB's boost: the optimal-substructure observation was demonstrated on one target node; if it does not hold broadly, the boost could be replaced by a larger retain list.
  • An extension the paper explicitly leaves open: on heterophilic graphs the homophily assumption fails, so the metric would need a signed or re-oriented dissimilarity term before it transfers.
  • A possible reverse use: the same ranking identifies structurally fragile nodes, so high-fLN candidate links could be pruned or rewired to harden a GNN, not just attacked.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes a link-noise metric, fLN (Eq. 8), intended to quantify the attack strength of each candidate adversarial link in targeted structural attacks on GNNs. The metric combines the GCN aggregation weight 1/sqrt(|N_v|+1) with a cross-entropy dissimilarity between the target node and a candidate adversarial node. The authors prove two propositions in a simplified one-layer GCN with one-hot features and a diagonal-like optimal weight matrix, claiming that low-degree nodes are easier to attack and that low-degree or dissimilar adversarial nodes have larger influence. Based on this, they propose three attack strategies: NGA (greedily pick the highest-fLN links), NMA (prune candidates by fLN, then greedily select links by classification margin), and NMAB (multi-step beam search over fLN-pruned candidates). Experiments on Cora, Citeseer, and Pubmed against GCN, SGC, and GAT report that NMAB achieves the best average rank, NMA is competitive with NETTACK, and the selected adversarial nodes tend to be low-degree, class-dissimilar, and high-confidence.

Significance. The central claim is that fLN provides an interpretable and efficient ranking of adversarial link strength, so that pruning by fLN can reduce the search space of margin-based attacks without losing attack power. If validated, this would be a useful contribution: the candidate-pruning mechanism is simple, the algorithms are clearly specified, and the time-cost analysis in Section 5.5.5 is a genuine practical addition. The paper is also transparent about the toy-model nature of its theoretical propositions and about the fact that code will be released only upon acceptance. However, the key validation is currently missing: the paper never directly measures whether high-fLN links are actually the strongest perturbations. The only attack that isolates fLN ranking, NGA, performs worst in Table 3, and the property analysis in Section 5.5.4 is largely circular because low degree and dissimilarity are encoded into fLN by construction. The statistical evidence also lacks error bars or significance tests.

major comments (4)
  1. [§4.2, Table 3] The load-bearing premise that fLN ranks per-link attack strength is not directly validated, and the one experiment that isolates this premise, NGA, gives the worst average rank (5.67) among all methods in Table 3, behind NETTACK, FGA, and SGA. The paper should add a direct ranking test: for a sample of target nodes, evaluate the effect of each valid adversarial link (e.g., the classification-margin decrease after adding that link alone) and compute the correlation with fLN. An ablation of NMA that replaces the fLN-pruned candidate set with a random or lowest-fLN candidate set of the same size would also isolate whether fLN pruning, rather than the margin search, is responsible for the observed performance.
  2. [§5.5.4 and Eq. (8)] The analysis of adversarial node properties is presented as supporting evidence for the noise concept, but the preferences it reports are encoded into the metric by construction. Equation (8) divides by sqrt(|N_v|+1), so low-degree nodes are favored by the metric itself, and the cross-entropy dissimilarity in Eq. (7) directly rewards nodes whose class distribution differs from the target. Proposition 4.1 and 4.2 derive the same degree and dissimilarity tendencies from the aggregation formula. Therefore, observing that NMA/NMAB select low-degree, dissimilar nodes does not independently validate fLN; it only confirms that the algorithms follow their own scoring function. The authors should either reframe this section as a consistency check or test whether the same properties hold for the actually strongest links as measured by margin, not for the links selected by fLN.
  3. [Appendices A.1 and A.2, Propositions 4.1 and 4.2] The theoretical support for Eqs. (6)-(8) rests on strong assumptions that are not connected to the actual experimental setting: one-hot features, a one-layer GCN, a 'diagonal-like optimal W*', and equal noise for all adversarial links in Proposition 4.1. In particular, the statement in the proof of Proposition 4.1 that a well-trained GCN has a diagonal-like optimal weight matrix is asserted without proof and does not follow from the softmax cross-entropy training objective, especially with real features, ReLU activations, and multiple layers. Since the surrogate model used in Eqs. (7)-(8) is a real multi-layer GCN with bag-of-words features, the derivation of fLN as a quantitative measure is not established. The authors should either explicitly label the propositions as heuristic motivation rather than derivation, or extend the analysis to settings closer to the experiments.
  4. [§5.4, Table 3] All experimental results are reported as averages over 5 random splits with no standard deviations, confidence intervals, or significance tests. This matters because several key comparisons are close or could plausibly be within run-to-run variation; for example, NMAB versus NMA on PubMed-GCN (0.9842 vs 0.9802) and NMAB versus NETTACK on Cora-SGC (0.9166 vs 0.9278) are small differences. The authors should report per-split results or paired significance tests (e.g., Wilcoxon signed-rank over the 1000 target nodes or over splits) for the main comparisons in Table 3.
minor comments (4)
  1. [§5, first paragraph] The statement that code 'will be publicly available..., depending on the acceptance' limits reproducibility; please release the code and specify the environment and versions used for the experiments.
  2. [Figures 2-4] Figures 2, 3, and 4 contain corrupted placeholder text such as '/uni00000031/uni00000028/...' instead of proper axis labels and legends; these figures need to be regenerated.
  3. [§2.3, References] There is a citation inconsistency: 'Zügner et al. [6] first pointed out...' refers to NETTACK, but reference [6] is Dai et al.'s ICML 2018 paper; NETTACK is reference [32]. Please correct the citation.
  4. [Equation (7)] The phrase 'as if the total layer of the corresponding GNN is k' is unclear; please specify whether h^(k)_u and h^(k)_v are the softmax outputs of a k-layer GCN or intermediate hidden representations.

Circularity Check

1 steps flagged · score 6.0 of 10

The low-degree/dissimilar-node 'preference' reported as validation is encoded in the fLN definition itself; the attack-success comparisons against NETTACK/FGA/SGA remain non-circular.

  1. self definitional [Section 4.1, Eq. (8); Algorithm 1 lines 4-6; Algorithm 2 lines 4-6; Section 5.5.4, Table 7 and Fig. 3]
    "fLN(𝑢,𝑣) =− ˝𝐶−1 𝑖=0(ℎ(𝑘) 𝑢 )𝑖 log(ℎ(𝑘) 𝑣 )𝑖 √︁ |N𝑣|+ 1. ... The above finding supports our analysis in Section 4.1 that low degree nodes usually will have a larger influence on the neighborhood aggregation mechanism than high degree nodes."

    NMA and NMAB construct their candidate sets by sorting fLN and keeping only the top δ1 or δ2 links (Algorithm 1 lines 4-6; Algorithm 2 lines 4-6). By Eq. (8), fLN is monotonically decreasing in |N_v| and is larger when the cross-entropy between h_u and h_v is larger, i.e., when v's hidden distribution is dissimilar to u's and typically belongs to a different class with high confidence. Any node surviving this pruning is therefore, by construction, low-degree, class-dissimilar, and high-confidence. Section 5.5.4 then reports that selected adversarial nodes have low degree and different classes and presents this as support for the noise analysis.

full rationale

The paper's central attack-success results (Table 3) are genuine empirical comparisons against external baselines (NETTACK, FGA, SGA), and the surrogate-GCN setup is testable, so the end-to-end attack claim is not circular. The circularity is localized to the interpretability contribution: the 'preferred patterns' of effective adversarial nodes (low degree, different class, high predicted confidence) presented in Section 5.5.4 are consequences of the fLN definition used to restrict the candidate sets. Since fLN is deliberately composed of the GCN aggregation weight 1/sqrt(|N_v|+1) and a cross-entropy dissimilarity term, the observation that high-fLN links are low-degree and dissimilar is tautological rather than an emergent empirical discovery. This gives partial circularity: the candidate-pruning/efficiency claim is supported by construction, while the margin-based attack success retains independent content. The poor average rank of NGA (5.67 in Table 3) further weakens the claim that fLN alone ranks per-link attack strength, but that is an empirical weakness rather than an additional circular step.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central derivation rests on a toy-model proof and a hand-designed noise metric. The metric's two components (degree normalization and entropy dissimilarity) are borrowed from the GCN aggregation formula and cross-entropy, respectively. The attack hyperparameters are user-chosen, not fitted to data.

free parameters (4)
  • δ1 (NMA candidate size) = 5Δ (default)
    Number of top-noise candidate links retained before margin evaluation; chosen by hand and ablated in Section 5.5.6 (G1-G3).
  • δ2 (NMAB candidate size) = 10Δ (default)
    Number of top-noise candidate links for NMAB; chosen by hand and ablated as part of G4-G6.
  • len_sin (single optimal list size) = 3Δ (default)
    Number of optimal single links retained for combination in NMAB; set by hand in Section 5.4.
  • len_re (retain list size) = 10 (default)
    Number of optimal attack sequences retained at each step of NMAB; set by hand in Section 5.4.
assumptions (5)
  • domain assumption The network is homophilic: most original neighbors of each node belong to the same class.
    Section 4.1: the paper explicitly assumes homophilic networks because traditional GNNs do not perform well on heterophilic graphs, and leaves heterophilic networks to future work.
  • ad hoc to paper A well-trained GCN has a diagonal-like optimal weight matrix W*, so softmax output concentrates on the true label.
    Appendix A.1: used in the proof of Proposition 4.1 to argue attacks affect the probability mass of the true class in a monotone way; this is not derived or tested.
  • ad hoc to paper All adversarial links have the same noise value in Proposition 4.1.
    Proposition 4.1 states this equality to isolate degree effects; Proposition 4.2 relaxes it but the proof of the basic degree claims relies on the simplification.
  • domain assumption A one-layer GCN with one-hot node features is representative for analyzing aggregation perturbation effects.
    Propositions 4.1 and 4.2 consider a single-layer GCN with one-hot features; the practical method uses a trained multi-layer GCN representation in Eq. (7), but the theory does not cover that case.
  • standard math The softmax function is monotonic in the arguments being compared.
    The proofs in Appendix A compare pre-softmax coefficients and infer order of output probabilities; this is standard but not stated explicitly.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Quantifying the Noise of Structural Perturbations on Graph Adversarial Attacks." pith.science (2026). https://pith.science/paper/FSOHXS2W

@misc{pith2026250420869,
  author       = {Pith},
  title        = {Pith review of: Quantifying the Noise of Structural Perturbations on Graph Adversarial Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FSOHXS2W}},
  note         = {Machine review of arXiv:2504.20869}
}
read the original abstract

Graph neural networks have been widely utilized to solve graph-related tasks because of their strong learning power in utilizing the local information of neighbors. However, recent studies on graph adversarial attacks have proven that current graph neural networks are not robust against malicious attacks. Yet much of the existing work has focused on the optimization objective based on attack performance to obtain (near) optimal perturbations, but paid less attention to the strength quantification of each perturbation such as the injection of a particular node/link, which makes the choice of perturbations a black-box model that lacks interpretability. In this work, we propose the concept of noise to quantify the attack strength of each adversarial link. Furthermore, we propose three attack strategies based on the defined noise and classification margins in terms of single and multiple steps optimization. Extensive experiments conducted on benchmark datasets against three representative graph neural networks demonstrate the effectiveness of the proposed attack strategies. Particularly, we also investigate the preferred patterns of effective adversarial perturbations by analyzing the corresponding properties of the selected perturbation nodes.

Figures

Figures reproduced from arXiv: 2504.20869 by the authors.

Figure 1
Figure 1. A systematic framework of targeted attacks based on the proposed three strategies. [PITH_FULL_IMAGE:figures/full_fig_p010_1.png] view at source ↗
Figure 2
Figure 2. Classification margin comparisons between different methods on three datasets. [PITH_FULL_IMAGE:figures/full_fig_p013_2.png] view at source ↗
Figure 3
Figure 3. Average homophily ratios of target nodes before and after NMA/NMAB attacks on three [PITH_FULL_IMAGE:figures/full_fig_p014_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Attack success rate of the proposed NMA and NMAB methods on three datasets under [PITH_FULL_IMAGE:figures/full_fig_p014_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

33 extracted references · 27 canonical work pages

  1. [1]

    Zulfikar Alom, Tran Gia Bao Ngo, Murat Kantarcioglu, and Cuneyt Gurcan Akcora. 2025. GOttack: Universal Adversarial Attacks on Graph Neural Networks via Graph Orbits Learning. In Proc. ICLR

    work page 2025

  2. [2]

    Aleksandar Bojchevski and Stephan Günnemann. 2019. Certifiable robustness to graph perturbations. Proc. NeurIPS 32 (2019)

    work page 2019

  3. [3]

    Jinyin Chen, Lihong Chen, Yixian Chen, Minghao Zhao, Shanqing Yu, Qi Xuan, and Xiaoniu Yang. 2019. GA-based q-attack on community detection. IEEE Trans. Comput. Soc. Syst. 6, 3 (2019), 491–503

    work page 2019

  4. [4]

    Jinyin Chen, Yangyang Wu, Xuanheng Xu, Yixian Chen, Haibin Zheng, and Qi Xuan. 2018. Fast gradient attack on network embedding. arXiv preprint arXiv:1809.02797 (2018)

    arXiv 2018

  5. [5]

    Liang Chen, Jintang Li, Jiaying Peng, Tao Xie, Zengxu Cao, Kun Xu, Xiangnan He, and Zibin Zheng. 2020. A survey of adversarial learning on graphs. arXiv preprint arXiv:2003.05730 (2020)

    arXiv 2020

  6. [6]

    Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, and Le Song. 2018. Adversarial attack on graph structured data. In Proc. ICML. PMLR, 1115–1124. J. ACM, V ol. 37, No. 4, Article 111. Publication date: August 2018. 111:18 Fang et al

    work page 2018

  7. [7]

    Junyuan Fang, Haixian Wen, Jiajing Wu, Qi Xuan, Zibin Zheng, and Chi K Tse. 2024. Gani: Global attacks on graph neural networks via imperceptible node injections. IEEE Trans. Comput. Soc. Syst. 11, 4 (2024), 5374–5387

    work page 2024

  8. [8]

    Junyuan Fang, Han Yang, Jiajing Wu, Zibin Zheng, and Chi K Tse. 2025. What Contributes More to the Robustness of Heterophilic Graph Neural Networks? IEEE Trans. Syst. Man Cybern.: Syst. (2025)

    work page 2025

Show all 33 references
  1. [9]

    Simon Geisler, Tobias Schmidt, Hakan ¸ Sirin, Daniel Zügner, Aleksandar Bojchevski, and Stephan Günnemann. 2021. Robustness of graph neural networks at scale. Proc. NeurIPS 34 (2021), 7637–7649

    2021

  2. [10]

    Will Hamilton, Zhitao Ying, and Jure Leskovec. 2017. Inductive representation learning on large graphs. Proc. NeurIPS 30 (2017)

    2017

  3. [11]

    Weiwei Jiang and Jiayun Luo. 2021. Graph neural network for traffic forecasting: A survey. arXiv preprint arXiv:2101.11174 (2021)

    2021 arXiv

  4. [12]

    Wei Jin, Yaxin Li, Han Xu, Yiqi Wang, Shuiwang Ji, Charu Aggarwal, and Jiliang Tang. 2020. Adversarial attacks and defenses on graphs: A review, a tool and empirical studies. arXiv preprint arXiv:2003.00653 (2020)

    2020 arXiv

  5. [13]

    Kipf and Max Welling

    Thomas N. Kipf and Max Welling. 2017. Semi-supervised classification with graph convolutional networks. In Proc. ICLR. OpenReview.net

    2017

  6. [14]

    Jintang Li, Zishan Gu, Qibiao Peng, Kun Xu, Liang Chen, and Zibin Zheng. 2021. Deep insights into graph adversarial learning: An empirical study perspective. In Proc. IJCAI-HBAI. Springer, 87–101

    2021

  7. [15]

    Jintang Li, Tao Xie, Chen Liang, Fenfang Xie, Xiangnan He, and Zibin Zheng. 2021. Adversarial attack on large scale graph. IEEE Trans. Knowl. Data Eng. (2021)

    2021

  8. [16]

    Hongbin Pei, Bingzhe Wei, Kevin Chen-Chuan Chang, Yu Lei, and Bo Yang. 2020. Geom-GCN: Geometric graph convolutional networks. In Proc. ICLR

    2020

  9. [17]

    Prithviraj Sen, Galileo Namata, Mustafa Bilgic, Lise Getoor, Brian Galligher, and Tina Eliassi-Rad. 2008. Collective classification in network data. AI Mag. 29, 3 (2008), 93–93

    2008

  10. [18]

    Lichao Sun, Yingtong Dou, Carl Yang, Ji Wang, Philip S Yu, Lifang He, and Bo Li. 2018. Adversarial attack and defense on graph data: A survey. arXiv preprint arXiv:1812.10528 (2018)

    2018 arXiv

  11. [19]

    Yiwei Sun, Suhang Wang, Xianfeng Tang, Tsung-Yu Hsieh, and Vasant Honavar. 2020. Adversarial attacks on graph neural networks via node injections: A hierarchical reinforcement learning approach. In Proc. WWW. 673–683

    2020

  12. [20]

    Shuchang Tao, Qi Cao, Huawei Shen, Junjie Huang, Yunfan Wu, and Xueqi Cheng. 2021. Single node injection attack against graph neural networks. In Proc. CIKM. 1794–1803

    2021

  13. [21]

    Petar Veliˇckovi´c, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Lio, and Yoshua Bengio. 2018. Graph attention networks. In Proc. ICLR

    2018

  14. [22]

    Marcin Waniek, Tomasz P Michalak, Michael J Wooldridge, and Talal Rahwan. 2018. Hiding individuals and communi- ties in a social network. Nat. Hum. Behav. 2, 2 (2018), 139–147

    2018

  15. [23]

    Felix Wu, Amauri Souza, Tianyi Zhang, Christopher Fifty, Tao Yu, and Kilian Weinberger. 2019. Simplifying graph convolutional networks. In Proc. ICML. PMLR, 6861–6871

    2019

  16. [24]

    Huijun Wu, Chen Wang, Yuriy Tyshetskiy, Andrew Docherty, Kai Lu, and Liming Zhu. 2019. Adversarial examples for graph data: Deep insights into attack and defense. In Proc. IJCAI. 4816–4823

    2019

  17. [25]

    Shiwen Wu, Fei Sun, Wentao Zhang, Xu Xie, and Bin Cui. 2020. Graph neural networks in recommender systems: a survey. ACM Comput. Surv. (2020)

    2020

  18. [26]

    Zonghan Wu, Shirui Pan, Fengwen Chen, Guodong Long, Chengqi Zhang, and S Yu Philip. 2020. A comprehensive survey on graph neural networks. IEEE Trans. Neural Netw. Learn. Syst.32, 1 (2020), 4–24

    2020

  19. [27]

    Qifan Zhang, Junyuan Fang, Jie Zhang, Jiajing Wu, Yongxiang Xia, and Zibin Zheng. 2020. Cross entropy attack on deep graph infomax. In Proc. ISCAS. IEEE, 1–5

    2020

  20. [28]

    Jie Zhou, Ganqu Cui, Shengding Hu, Zhengyan Zhang, Cheng Yang, Zhiyuan Liu, Lifeng Wang, Changcheng Li, and Maosong Sun. 2020. Graph neural networks: A review of methods and applications. AI Open 1 (2020), 57–81

    2020

  21. [29]

    Guanghui Zhu, Mengyu Chen, Chunfeng Yuan, and Yihua Huang. 2024. Simple and efficient partial graph adversarial attack: A new perspective. IEEE Trans. Knowl. Data Eng. (2024)

    2024

  22. [30]

    Jiong Zhu, Yujun Yan, Lingxiao Zhao, Mark Heimann, Leman Akoglu, and Danai Koutra. 2020. Beyond homophily in graph neural networks: Current limitations and effective designs. In Proc. NeurIPS

    2020

  23. [31]

    Yihai Zhu, Jun Yan, Yan Sun, and Haibo He. 2014. Revealing cascading failure vulnerability in power grids using risk-graph. IEEE Trans. Parallel Distrib. Syst.25, 12 (2014), 3274–3284

    2014

  24. [32]

    Daniel Zügner, Amir Akbarnejad, and Stephan Günnemann. 2018. Adversarial attacks on neural networks for graph data. In Proc. KDD. 2847–2856

    2018

  25. [33]

    Daniel Zügner and Stephan Günnemann. 2019. Adversarial attacks on graph neural networks via meta learning. In Proc. ICLR. J. ACM, V ol. 37, No. 4, Article 111. Publication date: August 2018. Quantifying the Noise of Structural Perturbations on Graph Adversarial Attacks 111:19 ...

    2019

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.