Pith. sign in

REVIEW 5 major objections 6 minor 41 references

PROVCREATOR: Synthesizing Complex Heterogenous Graphs with Node and Edge Attributes

T0 review · 5 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read PROVCREATOR shows that complex heterogeneous graphs with rich node and edge attributes can be generated by serializing them into token sequences and fine-tuning a transformer LLM, producing synthetic provenance and knowledge graphs that…

desk verdict ProvCreator is a solid engineering contribution with genuine downstream evidence; the weak spots are evaluation rigor (no error bars, regex validity) and an overbroad general-graph claim, not the core method. read the letter →

arxiv 2507.20967 v1 pith:4TEEWE56 submitted 2025-07-28 cs.LG

Tianhao Wang , Simon Klancher , Kunal Mukherjee , Josh Wiedemeier , Feng Chen , Murat Kantarcioglu , Kangkook Jee This is my paper
classification cs.LG
keywords heterogeneousgraphgenerationsequencelargelanguagemodelstokenizationprovenancegraphsknowledgesyntheticdataattributefidelity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

PROVCREATOR claims that generating complex heterogeneous graphs with rich node and edge attributes can be treated as a language generation problem. The framework serializes each graph into a compact sequence of special tokens and attribute text, then fine-tunes a transformer-based LLM to produce such sequences. On system provenance graphs and IntelliGraph knowledge graphs, it reports lower structural distribution distances than the GDSS diffusion baseline and far higher rates of valid graphs than benchmark baselines. The practical payoff is synthetic graphs that preserve structure-semantics dependencies, enabling privacy-aware data augmentation for security applications.

What carries the argument

The central mechanism is the graph-to-sequence encoder and its inverse decoder built on a custom token vocabulary (<bog>, <eog>, <bon>, <eon>, <boe>, <nodex>, <ntypej>, <etypek>, <bof>, <eof>). It serializes a graph by iterating edges in a fixed order—timestamps in provenance data, topological sort otherwise—and interleaving structural markers with attribute text, so the sequence losslessly determines the graph. This compact representation (35% of tokens vs plain JSON on provenance data, 22% on IntelliGraph) fits large graphs into the LLM context window and enables end-to-end learnable generation. Decoding relies on token filtering and a state-machine parser that uses anchor tokens to recover from invalid tokens.

What would settle it

Take a provenance dataset without timestamps and train PROVCREATOR twice on the same graphs: once with the topological-sort ordering and once with a fixed but random edge order. If validity and downstream classification F1 are statistically indistinguishable between the two, the edge-order assumption is not load-bearing; if the random-order model collapses, the ordering is essential. Alternatively, remove the token-filtering and parser recovery during sampling and measure validity; if validity drops sharply, the reported validity rates are a property of the constrained decoding, not of the generation model itself.

Watch

Extended reading notes

Core claim

The central claim is that a lossless graph-to-sequence encoder, combined with a pretrained transformer LLM and a constraint-aware decoder, can jointly model graph topology and high-dimensional node and edge attributes well enough to produce realistic synthetic graphs. The paper operationalizes this by encoding each edge and its attributes into tokens, interleaving node attributes when nodes first appear, using a deterministic edge order (timestamps for provenance graphs, topological sort for general graphs). The LLM is fine-tuned with LoRA on these sequences; at generation time, token filtering and a state-machine parser with anchor tokens ensure structural validity. Evaluations on firefox.exe and powershell.exe provenance graphs show lower maximum-mean-discrepancy scores than GDSS on six structural metrics, attribute validity rates above 93%, and on IntelliGraph datasets, 86–94% valid graphs compared with near zero for the benchmark baselines. A downstream GNN classification task trained on PROVCREATOR-generated graphs retains 65–70% of real-data F1, indicating preserved class signal.

Load-bearing premise

The model assumes that a fixed edge ordering (by timestamps or topological sort) encodes the semantic dependencies between structure and attributes; if the ordering is arbitrary or uninformative, the LLM must learn a convention that may not generalize, and the validity results could be an artifact of the decoding constraints rather than of the learned distribution.

Editorial extensions

If this is right

  • Organizations can generate synthetic provenance graphs for training security ML detectors, sidestepping privacy and sharing restrictions on real syscall traces.
  • The same serialization recipe should apply to any graph with serializable node and edge attributes and a natural edge order—event logs, knowledge graphs, temporal networks—making LLM-based generation a general graph tool.
  • Because the backbone is an LLM, users can condition generation with prompts to produce graphs matching specific contexts, such as particular command-line arguments, which diffusion baselines cannot easily do.
  • The downstream classification result suggests synthetic graphs can be used for data augmentation to mitigate class imbalance, not merely as a stand-in for real graphs.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An open question the paper leaves implicit is how much of the reported graph-validity rate comes from the constrained decoding (token filtering plus parser recovery) rather than from the generative model itself; an ablation that disables these guards would isolate the model's true capability.
  • Because the serialization depends on a total edge order, using PROVCREATOR on graphs without timestamps requires imposing a topological order; a robustness test varying the ordering convention would show whether the learned distribution depends on that choice.
  • The reported graph sizes are in the thousands of tokens, so scaling to enterprise-scale provenance graphs (millions of edges) will likely require hierarchical or chunked generation; the paper does not yet demonstrate this.
  • The embedding-fidelity comparison uses doc2vec on random walks, which is sensitive to the serialized text; a structure-aware graph embedding would provide a complementary check of whether the synthetic graphs truly match real graph topology.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper presents PROVCREATOR, a framework that casts synthetic graph generation for heterogeneous graphs with rich node and edge attributes as autoregressive sequence generation with a transformer-based LLM. It introduces a tokenization scheme with special tokens for graph structure and attributes, a state-machine parser that recovers from invalid tokens, and uses LoRA fine-tuning of LLaMA-3 on serialized graphs. The method is evaluated on provenance graphs from Firefox and PowerShell and on IntelliGraph knowledge graphs, reporting structural MMD metrics, attribute validity rates, embedding cosine similarity, and downstream classification performance. The paper argues that joint generation of structure and semantics yields better fidelity than a diffusion baseline and better validity than IntelliGraph baselines.

Significance. If the results hold, PROVCREATOR is a valuable contribution: it is among the first to apply LLM-based sequence generation to complex heterogeneous graphs with high-dimensional textual attributes, and it demonstrates that joint modeling of topology and attributes is feasible. The compact tokenization and lossless reconstruction (subject to the maximum-node limitation) are useful engineering contributions, and the downstream classification experiment suggests practical utility for data augmentation in security domains. The authors provide a reproducibility code link, which strengthens the paper. However, the significance is tempered by the evaluation gaps detailed below; the central claim of order-invariant general graph generation is not yet fully supported.

major comments (5)
  1. [3.1, Algorithm 1] The encoding requires a well-defined edge order, and for general graphs the paper proposes a topological sort. A topological sort is defined only for acyclic graphs and it orders nodes rather than edges; many knowledge graphs (including those in IntelliGraph) are cyclic and have no natural edge ordering. The tokenization algorithm therefore imposes an arbitrary, dataset-specific ordering, and the learned autoregressive distribution may reflect that ordering rather than an order-invariant graph distribution. The paper should either restrict the claim to timestamped graphs or provide an order-invariant encoding and demonstrate that generated structures are independent of the chosen order.
  2. [4.1, Table 2] The MMD values are reported without any error bars, confidence intervals, or statistical tests, and the computation of MMD is not described (e.g., the kernel, bandwidth, number of graph samples, and whether the metrics are computed on graphs of matched size). The structural-fidelity claim rests on these numbers, so the reader cannot determine whether the differences between GDSS and PROVCREATOR are significant. Please provide the full MMD estimation protocol and repeat experiments over multiple random seeds.
  3. [4.2, Table 3 and Table 6] Attribute validity is measured solely by regular-expression matching. A generated string can match a regex while being semantically incoherent (for example, an executable name that is syntactically a Windows path but does not correspond to any real binary or to the process's behavior). The paper's claim of capturing 'semantic fidelity' is therefore not substantiated by the reported metric. Consider supplementing with human evaluation or a semantic plausibility check (e.g., known program paths, embedding-based similarity to real attribute distributions).
  4. [4.3, Table 4] The comparison against the IntelliGraph baselines is confounded: the baselines generate attributes as sampled numbers, whereas PROVCREATOR generates attributes as free-form text, and only the best-performing baselines are shown. The footnote acknowledges the difference but the conclusion that PROVCREATOR 'outperforms the baseline models by a large margin' is not justified under a mismatched protocol. Moreover, PROVCREATOR receives 0.00 on syn-tipr and wd-articles; the explanation that evaluation criteria are 'strict' is not quantified. A fair evaluation would use the same attribute representation or, at minimum, report performance under identical validity criteria.
  5. [3.1] The tokenizer injects exactly N node tokens to represent 'up to N nodes,' but the paper never states what happens when a graph contains more than N nodes. If such graphs are truncated or dropped, the claimed lossless encoding (Section 1, Section 3.1) is false for a nontrivial portion of the input distribution. Please specify the value of N, the maximum graph size in the datasets, and the handling of oversized graphs.
minor comments (6)
  1. [3, 3.3] The model name is inconsistent: 'LLama3-3.2-3B' in Section 3 and 'LLaMA3-3.2B' in Section 3.3; please correct and specify the exact checkpoint.
  2. [A.1, Algorithm 1] There is a typo in the last line of the algorithm: 'Suence S' should be 'sequence S'.
  3. [Table 4] The header '% Novel & Vaild Graphs' has a typo ('Vaild' should be 'Valid').
  4. [Figure 3] The caption does not explain what the 'Baseline' bar represents beyond 'randomly sampled node attributes'; please clarify that the baseline uses real structures with random attributes and report error bars.
  5. [2.2] The relationship types are capitalized inconsistently ('READ,WRITE,CREATE andEXECUTE'); please fix the formatting.
  6. [References] The in-text citation 'Feng et al.' and some other reference entries are incomplete; ensure all references have full author lists and years.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the generation pipeline is trained on real serialized graphs and evaluated against external structural metrics and held-out real transfer tasks.

full rationale

PROVCREATOR's central claim is that heterogeneous graph generation can be formulated as sequence generation via a tokenization scheme and an LLM. This is an architectural design choice, not a derived result that secretly reuses its own conclusions. The evaluation anchors are external: structure fidelity is measured by MMD on standard graph statistics against a GDSS baseline; embedding fidelity uses doc2vec embeddings of random walks; downstream utility is tested by training a GNN on synthetic graphs and evaluating on held-out real traces. These metrics are not fitted parameters of the model. The attribute validity rates in Table 3 are based on author-defined regex rules, and those rules are not used during training or generation, so the measurement is weak but not circular. The IntelliGraph fallback to the first edge type for invalid generated text is a disclosed decoding repair; it affects one component of validity but does not make the overall structural validity result a tautology. The main limitation identified by a skeptical reading is the edge-ordering assumption in Section 3.1: for general graphs without timestamps, the topological sort may be non-unique or undefined on cyclic graphs, so the learned sequence distribution may be order-specific. However, this is a correctness and generalization concern about the encoding's inductive bias, not a circularity in which the prediction reduces to its input by construction. No load-bearing self-citations or imported uniqueness theorems appear; prior author works cited are domain background. Therefore, no circular step meets the bar of being quotably reducible to its own inputs.

Assumptions & free parameters 3 free parameters · 4 assumptions · 1 invented entities

No new physics-like entities are invented. The main assumptions are the modeling assumption that LLM sequence learning captures graph distributions, the domain assumption that the five chosen subprogram classes are learnable, and the ad hoc regex validation rules that define attribute fidelity. The tokenizer's maximum node count and other hyperparameters are not reported, which slightly weakens the ledger.

free parameters (3)
  • Maximum number of nodes N in the tokenizer = not reported
    The tokenizer uses 'nodei' tokens to represent up to N nodes. The choice of N bounds the graphs the model can represent and must be set to cover the training distribution, but no value is given in the paper.
  • Ordering convention for general graphs = topological sort
    For graphs without timestamps, the paper assumes a topological sort gives a well-defined edge order. The choice of order is a design decision that affects the learned sequence distribution and is not validated separately.
  • Context length and truncation behavior = not reported
    The paper reports token counts up to about 8000 for provenance graphs, so the model's maximum context length is a relevant free parameter that determines which graphs are representable, but it is not stated.
assumptions (4)
  • domain assumption An LLM fine-tuned on serialized graph token sequences will learn a distribution over graphs that approximates the training distribution of graphs.
    This is the central modeling assumption of the paper: it is invoked throughout Section 3 and is what makes the whole framework work. It is not derived from any theorem.
  • domain assumption Real provenance graphs of firefox.exe and powershell.exe contain enough per-class signal that a GNN can learn to classify command-line arguments from them.
    The downstream task in Section 4.5 relies on this assumption to interpret the F1 numbers as evidence of synthetic data utility.
  • ad hoc to paper The regex rules in Table 6 are a valid proxy for semantic correctness of generated attributes.
    These rules are introduced by the authors specifically for evaluation. They capture syntactic validity only, not semantic plausibility.
  • domain assumption The MMD between graph statistics computed on 1000 samples is a reliable measure of distributional fidelity.
    The paper follows the evaluation protocol of Jo et al. (2022) but does not report variance, so the stability of the MMD estimates is assumed.
invented entities (1)
  • Special graph token vocabulary (<bog>, <eog>, <bon>, <eon>, <boe>, <bof>, <eof>, <nodei>, <ntypej>, <etypek>) independent evidence
    purpose: Lossless and compact serialization of graph structure and attributes for the LLM.
    The vocabulary is introduced by the paper, but it is evaluated externally through structural metrics and downstream classification, giving it a falsifiable handle.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PROVCREATOR: Synthesizing Complex Heterogenous Graphs with Node and Edge Attributes." pith.science (2026). https://pith.science/paper/4TEEWE56

@misc{pith2026250720967,
  author       = {Pith},
  title        = {Pith review of: PROVCREATOR: Synthesizing Complex Heterogenous Graphs with Node and Edge Attributes},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4TEEWE56}},
  note         = {Machine review of arXiv:2507.20967}
}
read the original abstract

The rise of graph-structured data has driven interest in graph learning and synthetic data generation. While successful in text and image domains, synthetic graph generation remains challenging -- especially for real-world graphs with complex, heterogeneous schemas. Existing research has focused mostly on homogeneous structures with simple attributes, limiting their usefulness and relevance for application domains requiring semantic fidelity. In this research, we introduce ProvCreator, a synthetic graph framework designed for complex heterogeneous graphs with high-dimensional node and edge attributes. ProvCreator formulates graph synthesis as a sequence generation task, enabling the use of transformer-based large language models. It features a versatile graph-to-sequence encoder-decoder that 1. losslessly encodes graph structure and attributes, 2. efficiently compresses large graphs for contextual modeling, and 3. supports end-to-end, learnable graph generation. To validate our research, we evaluate ProvCreator on two challenging domains: system provenance graphs in cybersecurity and knowledge graphs from IntelliGraph Benchmark Dataset. In both cases, ProvCreator captures intricate dependencies between structure and semantics, enabling the generation of realistic and privacy-aware synthetic datasets.

Figures

Figures reproduced from arXiv: 2507.20967 by the authors.

Figure 1
Figure 1. PROVCREATOR’s synthetic graph generation pipeline. related subgraphs. Notably, edges in provenance graphs are naturally ordered by the time at which syscall events occur, which synergizes with PROVCREATOR’s sequential generation approach. While synthetic data generation has been explored in other security research domains (Cordero et al., 2021), we are unaware of any previous research focusing on synthetic data gene… view at source ↗
Figure 2
Figure 2. Example of graph tokenization. The left side of the figure highlights a subgraph of a real provenance [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Embedding cosine similarity of real and synthetic datasets generated with [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Weighted macro-F1 scores for GNN-based subprogram classification using different graph types. [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Normalized confusion matrices for subprogram classification task. [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Dataset statistics for PowerShell graphs. [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]
Figure 7
Figure 7. Figure 7: Dataset statistics for Firefox graphs. A.3 Computational Cost for Training and Generation The training and generation times for PROVCREATOR are shown in [PITH_FULL_IMAGE:figures/full_fig_p014_7.png]
Figure 8
Figure 8. Figure 8: Structure Generation Model Architecture A.7 Example of Generated Graphs [PITH_FULL_IMAGE:figures/full_fig_p016_8.png]
Figure 9
Figure 9. Figure 9: Examples of generated graphs 17 [PITH_FULL_IMAGE:figures/full_fig_p017_9.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

41 extracted references · 31 canonical work pages

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    https://github.com/linux-audit/, 2015

    The linux audit framework. https://github.com/linux-audit/, 2015

    work page 2015

  3. [3]

    https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/event-tracing-for-windows--etw-, 2019

    Event tracing for windows (etw) - windows drivers | microsoft docs. https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/event-tracing-for-windows--etw-, 2019

    work page 2019

  4. [4]

    A learning-based data augmentation for network anomaly detection

    Mohammad Al Olaimat, Dongeun Lee, Youngsoo Kim, Jonghyun Kim, and Jinoh Kim. A learning-based data augmentation for network anomaly detection. In 2020 29th International Conference on Computer Communications and Networks (ICCCN), 2020

    work page 2020

  5. [5]

    Survivalism: Systematic Analysis of Windows Malware Living-Off-The-Land

    Frederick Barr-Smith, Xabier Ugarte-Pedrero, Mariano Graziano, Riccardo Spolaor, and Ivan Martinovic. Survivalism: Systematic Analysis of Windows Malware Living-Off-The-Land . In IEEE Symposium on Security and Privacy (SP), 2021

    work page 2021

  6. [6]

    Bryan Cantrill. Dtrace. In Large Installation System Administration Conference (LISA), 2005

    work page 2005

  7. [7]

    Graph generative pre-trained transformer, 2025

    Xiaohui Chen, Yinkai Wang, Jiaxing He, Yuanqi Du, Soha Hassoun, Xiaolin Xu, and Li-Ping Liu. Graph generative pre-trained transformer, 2025. URL https://arxiv.org/abs/2501.01073

    arXiv 2025

  8. [8]

    Exploring the potential of large language models (llms) in learning on graphs

    Zhikai Chen, Haitao Mao, Hang Li, Wei Jin, Haifang Wen, Xiaochi Wei, Shuaiqiang Wang, Dawei Yin, Wenqi Fan, Hui Liu, and Jiliang Tang. Exploring the potential of large language models (llms) in learning on graphs. ArXiv, abs/2307.03393, 2023

    arXiv 2023

Show all 41 references
  1. [9]

    Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance

    Zijun Cheng, Qiujian Lv, Jinyuan Liang, Yan Wang, Degang Sun, Thomas Pasquier, and Xueyuan Han. Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance . In IEEE Symposium on Security and Privacy (SP), 2024

    2024

  2. [10]

    On generating network traffic datasets with synthetic attacks for intrusion detection

    Carlos Garcia Cordero, Emmanouil Vasilomanolakis, Aidmar Wainakh, Max M\" u hlh\" a user, and Simin Nadjm-Tehrani. On generating network traffic datasets with synthetic attacks for intrusion detection. 2021

    2021

  3. [11]

    Generation of a new ids test dataset: Time to retire the kdd collection

    Gideon Creech and Jiankun Hu. Generation of a new ids test dataset: Time to retire the kdd collection. In 2013 IEEE wireless communications and networking conference (WCNC), 2013

    2013

  4. [12]

    Cubuk, Barret Zoph, Dandelion Mané, Vijay Vasudevan, and Quoc V

    Ekin D. Cubuk, Barret Zoph, Dandelion Mané, Vijay Vasudevan, and Quoc V. Le. AutoAugment: Learning Augmentation Strategies From Data . 2019

    2019

  5. [13]

    Feng, Varun Gangal, Jason Wei, Sarath Chandar, Soroush Vosoughi, Teruko Mitamura, and Eduard Hovy

    Steven Y. Feng, Varun Gangal, Jason Wei, Sarath Chandar, Soroush Vosoughi, Teruko Mitamura, and Eduard Hovy. A Survey of Data Augmentation Approaches for NLP

  6. [14]

    Windows Based Data Sets for Evaluation of Robustness of Host Based Intrusion Detection Systems (IDS) to Zero-Day and Stealth Attacks

    Waqas Haider, Gideon Creech, Yi Xie, and Jiankun Hu. Windows Based Data Sets for Evaluation of Robustness of Host Based Intrusion Detection Systems (IDS) to Zero-Day and Stealth Attacks . 2016

    2016

  7. [15]

    UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

    Xueyuan Han, Thomas Pasquier, Adam Bates, James Mickens, and Margo Seltzer. UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats . In Network and Distributed System Security Symposium (NDSS), 2020

    2020

  8. [16]

    Sigl: Securing software installations through deep graph learning

    Xueyuan Han, Xiao Yu, Thomas Pasquier, Ding Li, Junghwan Rhee, James Mickens, Margo Seltzer, and Haifeng Chen. Sigl: Securing software installations through deep graph learning. In USENIX Security Symposium (SEC), 2021

    2021

  9. [17]

    NoDoze: Combatting Threat Alert Fatigue with Automated Provenance Triage

    Wajih Ul Hassan, Shengjian Guo, Ding Li, Zhengzhang Chen, Kangkook Jee, Zhichun Li, and Adam Bates. NoDoze: Combatting Threat Alert Fatigue with Automated Provenance Triage. In Network and Distributed System Security Symposium (NDSS), 2019

    2019

  10. [18]

    Magic: Detecting advanced persistent threats via masked graph representation learning

    Zian Jia, Yun Xiong, Yuhong Nan, Yao Zhang, Jinjing Zhao, and Mi Wen. Magic: Detecting advanced persistent threats via masked graph representation learning. In USENIX Security Symposium (SEC), 2024

    2024

  11. [19]

    Score-based generative modeling of graphs via the system of stochastic differential equations

    Jaehyeong Jo, Seul Lee, and Sung Ju Hwang. Score-based generative modeling of graphs via the system of stochastic differential equations. In International Conference on Machine Learning, 2022. URL https://api.semanticscholar.org/CorpusID:246634850

    2022

  12. [20]

    Backtracking intrusions

    Samuel T King and Peter M Chen. Backtracking intrusions . In Proceedings of the nineteenth ACM symposium on Operating systems principles, 2003

    2003

  13. [21]

    Distributed representations of sentences and documents

    Quoc Le and Tomas Mikolov. Distributed representations of sentences and documents. In International conference on machine learning, pp.\ 1188--1196. PMLR, 2014 a

    2014

  14. [22]

    Le and Tomas Mikolov

    Quoc V. Le and Tomas Mikolov. Distributed representations of sentences and documents. 2014 b

    2014

  15. [23]

    SNAP Datasets : Stanford large network dataset collection

    Jure Leskovec and Andrej Krevl. SNAP Datasets : Stanford large network dataset collection. http://snap.stanford.edu/data, June 2014

    2014

  16. [24]

    Efficient dynamic attributed graph generation, 2024 a

    Fan Li, Xiaoyang Wang, Dawei Cheng, Cong Chen, Ying Zhang, and Xuemin Lin. Efficient dynamic attributed graph generation, 2024 a . URL https://arxiv.org/abs/2412.08810

    2024 arXiv

  17. [25]

    Potluru, and Pan Li

    Mufei Li, Eleonora Kreačić, Vamsi K. Potluru, and Pan Li. Graphmaker: Can diffusion models generate large attributed graphs?, 2024 b . URL https://arxiv.org/abs/2310.13833

    2024 arXiv

  18. [26]

    Towards a Timely Causality Analysis for Enterprise Security

    Yushan Liu, Mu Zhang, Ding Li, Kangkook Jee, Zhichun Li, Zhenyu Wu, Junghwan Rhee, and Prateek Mittal. Towards a Timely Causality Analysis for Enterprise Security . In Network and Distributed System Security Symposium (NDSS), 2018

    2018

  19. [27]

    Evading provenance-based ml detectors with adversarial system actions

    Kunal Mukherjee, Josh Wiedemeier, Tianhao Wang, James Wei, Feng Chen, Muhyun Kim, Murat Kantarcioglu, and Kangkook Jee. Evading provenance-based ml detectors with adversarial system actions. In USENIX Security Symposium (SEC), 2023

    2023

  20. [28]

    Proviot: Detecting stealthy attacks in iot through federated edge-cloud security

    Kunal Mukherjee, Joshua Wiedemeier, Qi Wang, Junpei Kamimura, John Junghwan Rhee, James Wei, Zhichun Li, Xiao Yu, Lu-An Tang, Jiaping Gui, et al. Proviot: Detecting stealthy attacks in iot through federated edge-cloud security. In International Conference on Applied Cryptograp...

    2024

  21. [29]

    Cosmos world foundation model platform for physical ai, 2025

    NVIDIA, :, Niket Agarwal, Arslan Ali, Maciej Bala, Yogesh Balaji, Erik Barker, Tiffany Cai, Prithvijit Chattopadhyay, Yongxin Chen, Yin Cui, Yifan Ding, Daniel Dworakowski, Jiaojiao Fan, Michele Fenzi, Francesco Ferroni, Sanja Fidler, Dieter Fox, Songwei Ge, Yunhao Ge, Jinwei ...

    2025 arXiv

  22. [30]

    FLASH: A Comprehensive Approach to Intrusion Detection via Provenance Graph Representation Learning

    Mati Ur Rehman, Hadi Ahmadi, and Wajih Ul Hassan. FLASH: A Comprehensive Approach to Intrusion Detection via Provenance Graph Representation Learning . In IEEE Symposium on Security and Privacy (SP), 2024

    2024

  23. [31]

    Intelligraphs: Datasets for benchmarking knowledge graph generation

    Thiviyan Thanapalasingam, Emile van Krieken, Peter Bloem, and Paul Groth. Intelligraphs: Datasets for benchmarking knowledge graph generation. arXiv preprint arXiv:2307.06698, 2023

    2023 arXiv

  24. [32]

    Digress: Discrete denoising diffusion for graph generation

    Clement Vignac, Igor Krawczuk, Antoine Siraudin, Bohan Wang, Volkan Cevher, and Pascal Frossard. Digress: Discrete denoising diffusion for graph generation. In The Eleventh International Conference on Learning Representations, 2023. URL https://openreview.net/forum?id=UaAD-Nu86WX

    2023

  25. [33]

    Can language models solve graph problems in natural language? In Thirty-seventh Conference on Neural Information Processing Systems, 2023

    Heng Wang, Shangbin Feng, Tianxing He, Zhaoxuan Tan, Xiaochuang Han, and Yulia Tsvetkov. Can language models solve graph problems in natural language? In Thirty-seventh Conference on Neural Information Processing Systems, 2023. URL https://openreview.net/forum?id=UDqHhbqYJV

    2023

  26. [34]

    You Are What You Do: Hunting Stealthy Malware via Data Provenance Analysis

    Qi Wang, Wajih Ul Hassan, Ding Li, Kangkook Jee, Xiao Yu, Kexuan Zou, Junghwan Rhee, Zhengzhang Chen, Wei Cheng, Carl A Gunter, and Haifeng Chen. You Are What You Do: Hunting Stealthy Malware via Data Provenance Analysis . In Network and Distributed System Security Symposium (...

    2020

  27. [35]

    A survey on knowledge distillation of large language models, 2024

    Xiaohan Xu, Ming Li, Chongyang Tao, Tao Shen, Reynold Cheng, Jinyang Li, Can Xu, Dacheng Tao, and Tianyi Zhou. A survey on knowledge distillation of large language models, 2024. URL https://arxiv.org/abs/2402.13116

    2024 arXiv

  28. [36]

    Mooney, and Bradley A

    Chao Yan, Yao Yan, Zhiyu Wan, Ziqi Zhang, Larsson Omberg, Justin Guinney, Sean D. Mooney, and Bradley A. Malin. A Multifaceted benchmarking of synthetic electronic health record generation models . 2022

    2022

  29. [37]

    Data Augmentation for Graph Neural Networks

    Tong Zhao, Yozen Liu, Leonardo Neves, Oliver Woodford, Meng Jiang, and Neil Shah. Data Augmentation for Graph Neural Networks

  30. [38]

    Graph Data Augmentation for Graph Machine Learning: A Survey

    Tong Zhao, Wei Jin, Yozen Liu, Yingheng Wang, Gang Liu, Stephan Günnemann, Neil Shah, and Meng Jiang. Graph Data Augmentation for Graph Machine Learning: A Survey . 2022

    2022

  31. [39]

    @esa (Ref

    \@ifxundefined[1] #1\@undefined \@firstoftwo \@secondoftwo \@ifnum[1] #1 \@firstoftwo \@secondoftwo \@ifx[1] #1 \@firstoftwo \@secondoftwo [2] @ #1 \@temptokena #2 #1 @ \@temptokena \@ifclassloaded agu2001 natbib The agu2001 class already includes natbib coding, so you should ...

  32. [40]

    \@lbibitem[] @bibitem@first@sw\@secondoftwo \@lbibitem[#1]#2 \@extra@b@citeb \@ifundefined br@#2\@extra@b@citeb \@namedef br@#2 \@nameuse br@#2\@extra@b@citeb \@ifundefined b@#2\@extra@b@citeb @num @parse #2 @tmp #1 NAT@b@open@#2 NAT@b@shut@#2 \@ifnum @merge>\@ne @bibitem@firs...

  33. [41]

    <>| ]+\\)*[^\\/:*?\

    @open @close @open @close and [1] URL: #1 \@ifundefined chapter * \@mkboth \@ifxundefined @sectionbib * \@mkboth * \@mkboth\@gobbletwo \@ifclassloaded amsart * \@ifclassloaded amsbook * \@ifxundefined @heading @heading NAT@ctr thebibliography [1] @ \@biblabel @NAT@ctr \@bibset...

    2025

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.