Pith. sign in

REVIEW 2 major objections 5 minor 40 references

PriDyG: Privacy-preserving Dynamic Graph Inference with LLM-GNN Collaboration

T0 review · 2 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read PriDyG claims that repeated retraining of a privacy-preserving graph model can run at a single, constant differential-privacy cost, regardless of how many updates occur.

desk verdict Clever constant-budget dynamic GNN privacy, but two composition bugs (schedule independence and P_fus double-touching) need fixing before the claims hold; still worth refereeing. read the letter →

arxiv 2608.04255 v1 pith:5KP6RYVO submitted 2026-08-04 cs.CR cs.LG

Yuyang Xia , Ruixuan Liu , Li Xiong This is my paper · ORCID
classification cs.CRcs.LG
keywords differentialprivacydynamicgraphsedge-levelgraphneuralnetworksincrementalaggregationparallelcompositionlargelanguagemodelslinkprediction
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tackles a problem in private graph learning: when a graph grows and the model is retrained repeatedly, edge-level differential privacy costs normally add up, making updates expensive. It proposes PriDyG, a pipeline that keeps the total privacy budget constant no matter how many times the model is updated, by buffering new edges, aggregating them once, and adding their contribution to cached private features. A second branch uses an LLM on public node text, which costs no edge-level privacy budget, to compensate for the noise injected into the graph branch. If the central claim is right, frequent model updates on evolving relational data no longer carry a growing privacy price.

What carries the argument

The load-bearing object is incremental private multi-hop aggregation (incremental PMA). It caches the noisy per-hop aggregations $\tilde{Z}^{(k)}$ and normalized features $\bar{Z}^{(k)}$ of a GAP-style private GNN; at each retrain it builds a delta adjacency $\Delta A^{(m)}$ from the buffered new edges and updates $\tilde{Z}^{(k)}_{\mathrm{new}} = \tilde{Z}^{(k)}_{\mathrm{cached}} + \Delta A^{(m)} \bar{Z}^{(k-1)}_{\mathrm{new}} + \mathcal{N}(0,\sigma^2 I)$, hop by hop. Because each undirected edge is drained from the buffer exactly once, the mechanism decomposes into disjoint batches, and parallel composition plus the $\sqrt{2}$ sensitivity of undirected-edge aggregation yield the constant-budget Theorem 3.3. The captured-path analysis (Theorem 3.4) shows the approximation error is structured: a $k$-hop path survives iff its batch indices are non-decreasing in traversal order, so one-hop aggregation is exact and two-hop wedge transfers are at least half retained.

What would settle it

Take a two-edge stream with a policy that retrains immediately whenever a specific sensitive edge appears, and compare the incremental PMA transcript under two neighboring graphs that differ only in that edge; the transcripts have different numbers of released noisy deltas, so a full-transcript privacy audit (for example, computing the hockey-stick divergence over many runs) should exceed the $(\epsilon_{\mathrm{PMA}},\delta)$ predicted by Theorem 3.3 if the schedule-independence assumption is essential.

Watch

Extended reading notes

Core claim

PriDyG's central claim is that the full output of its incremental private multi-hop aggregation satisfies edge-level $(\epsilon_{\mathrm{PMA}},\delta)$-DP for any number of retrains and any retraining schedule, so the total privacy cost equals that of a single static release (Theorem 3.3). This follows because pre-normalization multi-hop aggregation is linear in the adjacency matrix: each newly arrived edge batch contributes an additive delta to cached noisy aggregations, and since every edge is accessed exactly once, parallel composition bounds the total cost by the maximum, not the sum. The cost is paid in signal: incremental aggregation is signal-exact at one hop, retains at least half of two-hop transfers, and accumulates Gaussian noise variance linearly in the number of retrains, whereas geometrically decaying budget allocation inflates noise exponentially. Experiments on four benchmarks for node classification and link prediction show PriDyG outperforming geometric-decay baselines at the same budget and matching naive per-update retraining while cutting cumulative privacy cost by up to three orders of magnitude.

Load-bearing premise

The retraining schedule must be independent of the private edge data: the proof fixes the batch in which the neighboring edge appears and requires the batch boundaries to be the same across neighboring graphs, so a policy that reacts to observed edge arrivals is not covered by the theorem as stated.

Editorial extensions

If this is right

  • The number of retrains $M$ stops multiplying the privacy budget: a model can be refreshed after every edge insertion at the same $(\epsilon,\delta)$ as a single static release.
  • Geometrically decaying budget allocation becomes unnecessary; incremental PMA avoids exponential noise growth while preserving exact one-hop signals and at least half of two-hop information.
  • LLM predictions from public node text can be fused with private GNN outputs at zero additional edge-level privacy cost, providing a stable semantic anchor as GNN noise accumulates.
  • Link prediction can stay in post-processing: cosine scoring on privatized representations and randomized-response calibration on a disjoint pair partition keep the end-to-end guarantee at $\max(\epsilon_{\mathrm{PMA}}, \epsilon_{\mathrm{RR}})$.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If Theorem 3.3 is read strictly, the constant-budget guarantee depends on the retraining schedule being independent of the private edge stream; an adaptive policy that retrains when a sensitive edge arrives would make batch boundaries data-dependent and could break the parallel-composition argument. The paper does not state this independence assumption explicitly.
  • A natural testable extension is to stress the claim with an adversarial retraining policy that observes edge arrivals and reacts to them, measuring whether the empirical privacy loss stays at the single-release level.
  • The same buffered once-only-access idea may extend to edge deletions by treating a deleted edge as a negative delta, though the noise accumulation and path-capture structure would need re-derivation.
  • The LLM branch's usefulness is predicted to grow as the GNN noise floor rises; a direct experiment would vary the insertion stream length and measure how often the confidence gate routes queries to fusion.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper formulates edge-level differentially private dynamic graph inference (EDG) and proposes PriDyG, a two-branch pipeline in which a DP-GNN performs structural learning through incremental private multi-hop aggregation (PMA) while an LLM supplies semantic predictions from node text alone at zero extra privacy cost. The central theoretical claim is Theorem 3.3: because incremental PMA touches each edge exactly once, parallel composition keeps the total privacy cost equal to one static PMA invocation, independent of the number of retrains and of the retraining schedule. The paper also gives a path-capture analysis (one-hop exact, at least half of two-hop transfers retained), a noise-accumulation analysis (linear rather than exponential), and experiments on four benchmarks for node classification and link prediction.

Significance. If the privacy guarantee is stated under the necessary schedule-independence assumption, the constant-budget incremental aggregation is a valuable and clearly presented contribution to continual private graph inference. The LLM branch is well motivated: under edge-level DP with public node text, semantic reasoning from text is genuinely privacy-free, and the confidence-gated fusion gives the system a stable anchor as GNN noise accumulates. The error analysis (Theorem 3.4, Corollaries 3.5 and 3.6, Proposition 3.7) is a useful characterization of the signal/noise trade-off, and the experiments support the utility claims relative to the geometric-decay baseline. However, the headline claim of schedule independence overreaches as stated: Theorem 3.3 requires the retraining schedule to be independent of the private edge stream, and the proof of Lemma 3.1 contains a false assertion about P_fus edges. These are load-bearing issues, but both appear fixable within the manuscript's scope.

major comments (2)
  1. [Section 3.5, Theorem 3.3; Section 3.4.2] The theorem claims edge-level (epsilon_PMA, delta)-DP for 'any retraining schedule,' and the abstract repeats that privacy cost is independent of the schedule. The proof fixes the batch index m* for the neighboring edge e* and requires the batch partition (B_0,...,B_M), including M itself, to be identical for the two neighboring graphs. This holds only if the retraining schedule is chosen independently of the private edge stream. Section 3.4.2 says only that retraining is 'issued by any external policy,' which does not state independence. If the policy can observe the stream and react to it (e.g., retrain exactly when a sensitive edge arrives), then m*, M, and the batch boundaries become functions of private data; the 'before m*' outputs need not be identically distributed, transcript lengths can differ, and the privacy loss is not bounded by a single static PMA. The experiments use a data-independent per-insertion coin flip, so the empirical results are consistent with the needed assumption, but the theorem and abstract must be restricted to this case unless a new adaptive-composition argument is supplied.
  2. [Appendix A, proof of Lemma 3.1; Section 3.3] The proof of Lemma 3.1 states that when e* lies in P_fus, the PMA transcript is identically distributed under the neighboring graphs because 'the pair is excluded from all adjacency matrices.' This contradicts Section 3.3, which explicitly says that a P_fus pair that becomes an edge at some t>0 is processed by incremental PMA. For such an edge, the randomized-response bit at t=0 is identically distributed (the edge is absent at t=0 in both graphs), but the edge is later touched by incremental PMA, so the PMA transcript is not identically distributed. The claimed max(epsilon_PMA, epsilon_RR) joint guarantee may still be salvageable with a case split on whether e* is present at t=0 or arrives later, but the proof as written has a false assertion and must be corrected.
minor comments (5)
  1. [Section 1] The word 'substaintial' in the second challenge paragraph should be 'substantial.'
  2. [Section 3.3, Eq. (5)] The indicator notation uses '⊮' in place of the standard blackboard-bold 1 (\mathbb{1}); the symbol appears to be a rendering error and should be fixed.
  3. [Conclusion] The sentence 'PriDyG attains utility with non-private baselines' is missing a word; it should read 'attains utility comparable to non-private baselines' or similar.
  4. [Appendix B, link prediction prompt for co-purchasing] The prompt contains the ungrammatical phrase 'are likely to are frequently co-purchased together'; it should be 'are likely to be frequently co-purchased together.'
  5. [Title page and templates] The reference format line still contains the placeholder 'Conference acronym ’XX' and the ACM copyright year 2018; these template artifacts should be cleaned before the final version.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: privacy and error analyses are first-principles; the noted schedule-independence caveat is an assumption gap, not a circular reduction.

full rationale

The paper's central guarantee (Theorem 3.3) is derived rather than assumed: it decomposes the incremental PMA transcript into the retrain containing the neighboring edge and the surrounding retrains, applies the Gaussian mechanism with sensitivity sqrt(2) to the delta aggregation at that retrain, and invokes standard parallel composition and post-processing. No parameter is fitted to produce the claimed (eps_PMA, delta) bound; the GAP accountant [22] is an external, non-overlapping source, and the error analysis (Theorems 3.4-3.6, Proposition 3.7) follows by unrolling the algorithm's own recursion and is not reverse-engineered from the experiments. Fusion weights are ordinary validation-tuned hyperparameters. The only concerns are correctness or assumption gaps, not circularity: Theorem 3.3's phrase 'any retraining schedule' requires the schedule, including the batch boundaries, M, and m*, to be independent of the private edge stream for the 'before m* identical' argument to hold, and Lemma 3.1's proof that P_fus edges are 'excluded from all adjacency matrices' sits in tension with Section 3.3's statement that P_fus pairs becoming edges after t=0 are processed by incremental PMA. These gaps affect the stated universality of the guarantee but do not make any claimed result equivalent to its inputs by construction.

Assumptions & free parameters 6 free parameters · 7 assumptions · 0 invented entities

The central privacy claim rests on standard DP composition facts plus explicit threat-model assumptions. The only ad hoc, unstated premise is the data-independence of the retraining schedule. Utility claims depend on several tuned hyperparameters whose values are not reported, and the normalization assumption in the error analysis is asserted rather than quantified.

free parameters (6)
  • fusion weight alpha = not reported
    Confidence-gated fusion weight in Eq (4), tuned via grid search on validation for each dataset (Sections 3.2, 3.3).
  • confidence threshold tau = not reported
    Gate for deciding when to invoke the LLM branch; tuned on validation (Section 3.2).
  • privacy budget epsilon_PMA = 6.0
    Privacy budget used in all experiments; noise scale sigma calibrated via RDP accountant (Section 4.1).
  • number of hops K = 2
    Multi-hop depth; affects error guarantees and noise accumulation (Section 4.1).
  • geometric decay ratio q = not reported
    Hyperparameter of the geometric-decay baseline in Section 3.4.1; its value is not stated, so the baseline strength is unspecified.
  • randomized response budget epsilon_RR = 6.0 (equal to epsilon_PMA)
    Budget for link prediction calibration bits; set equal to epsilon_PMA so the end-to-end guarantee is epsilon_PMA (Section 3.3).
assumptions (7)
  • standard math Parallel composition bounds total privacy loss by the max over disjoint data partitions.
    Used to prove Theorem 3.3; standard DP fact, cited as [24].
  • standard math Post-processing immunity: any function of a DP release is also DP.
    Justifies retraining the classifier, fusion, and the LLM's use of released scores at zero extra cost (Section 2.2).
  • standard math Renyi-DP accountant calibration of Gaussian noise for K-fold composition.
    Converts noise scale sigma to epsilon_PMA for the GAP-style PMA; adopted from [22] (Section 2.2).
  • domain assumption Edge-level adjacency: neighboring graphs differ in one undirected edge, and the L2 sensitivity of a hop is sqrt(2).
    Defines the threat model and the sensitivity used in all Gaussian noise calibrations (Section 2.2).
  • domain assumption Node text and labels are public and outside the protected edge set.
    Makes the LLM branch privacy-free under edge-level DP; explicitly stated in Definition 2.1.
  • ad hoc to paper The retraining schedule is independent of the private edge stream.
    Needed for Theorem 3.3's batch-decomposition argument; the paper does not state this assumption and claims 'any retraining schedule' (Section 3.4.2, Theorem 3.3).
  • domain assumption Row-wise L2 normalization does not change which paths contribute information.
    Used in Section 3.6 to map the noiseless, pre-normalization path analysis onto the actual normalized algorithm; the magnitude of information transfer is not analyzed.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PriDyG: Privacy-preserving Dynamic Graph Inference with LLM-GNN Collaboration." pith.science (2026). https://pith.science/paper/5KP6RYVO

@misc{pith2026260804255,
  author       = {Pith},
  title        = {Pith review of: PriDyG: Privacy-preserving Dynamic Graph Inference with LLM-GNN Collaboration},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5KP6RYVO}},
  note         = {Machine review of arXiv:2608.04255}
}
read the original abstract

Graph inference over relational data can expose sensitive edge information, and this risk becomes more severe in dynamic graphs, where repeated model updates cause privacy loss to accumulate. We formulate Edge-level Differentially Private Dynamic Graph Inference (EDG) and propose PriDyG, a private inference framework that combines GNN-based structural learning with LLM-based semantic reasoning. PriDyG introduces incremental private multi-hop aggregation, which buffers newly arrived edges and processes each edge exactly once. By parallel composition, the total privacy cost equals that of a single static release, independent of the number or schedule of model updates. Compared with geometrically decaying budget allocation, incremental aggregation avoids exponentially increasing noise while preserving exact one-hop signals and at least half of two-hop information transfers. PriDyG further complements privatized GNN outputs with LLM predictions derived solely from node text, incurring no additional edge-level privacy cost. Experiments on four benchmarks for node classification and link prediction show that PriDyG consistently outperforms geometrically decaying baselines under the same privacy budget and matches the utility of naive per-update retraining while reducing cumulative privacy cost by up to three orders of magnitude.

Figures

Figures reproduced from arXiv: 2608.04255 by the authors.

Figure 1
Figure 1. Overall architecture of PriDyG. For the dynamic DP-GNN branch, we build on aggregation￾perturbation methods [22], whose privacy cost is dominated by the Private Multi-hop Aggregation (PMA) step that perturbs the multi-hop neighborhood aggregation over the entire graph. Naively, every model update re-invokes PMA on the full graph; after 𝑀 up￾dates, sequential composition yields a total cost of 𝑀 · 𝜖PMA, which grows l… view at source ↗
Figure 2
Figure 2. Example for incremental PMA. Example 3.2. As shown in [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

40 extracted references · 26 canonical work pages

  1. [1]

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. 308–318

    2016

  2. [2]

    AI@Meta. 2024. Llama 3 Model Card. (2024). https://github.com/meta-llama/ llama3/blob/main/MODEL_CARD.md

    2024

  3. [3]

    Runjin Chen, Tong Zhao, Ajay Jaiswal, Neil Shah, and Zhangyang Wang. 2024. Llaga: Large language and graph assistant.arXiv preprint arXiv:2402.08170(2024)

    arXiv 2024

  4. [4]

    Zhikai Chen, Haitao Mao, Hang Li, Wei Jin, Hongzhi Wen, Xiaochi Wei, Shuaiqiang Wang, Dawei Yin, Wenqi Fan, Hui Liu, et al . 2024. Exploring the potential of large language models (llms) in learning on graphs.ACM SIGKDD Explorations Newsletter25, 2 (2024), 42–61

    2024

  5. [5]

    Eli Chien, Wei-Ning Chen, Chao Pan, Pan Li, Ayfer Ozgur, and Olgica Milenkovic

    work page

  6. [6]

    Cynthia Dwork and Aaron Roth. 2014. The algorithmic foundations of differential privacy.Foundations and trends®in theoretical computer science9, 3-4 (2014), 211–487

    2014

  7. [7]

    Shuya Feng, Meisam Mohammady, Han Wang, Xiaochen Li, Zhan Qin, and Yuan Hong. 2024. Dpi: Ensuring strict differential privacy for infinite data streaming. In2024 IEEE Symposium on Security and Privacy (SP). IEEE, 1009–1027

    work page 2024

  8. [8]

    Dongqi Fu, Wenxuan Bao, Ross Maciejewski, Hanghang Tong, and Jingrui He

    work page

Show all 40 references
  1. [9]

    Weihua Hu, Matthias Fey, Marinka Zitnik, Yuxiao Dong, Hongyu Ren, Bowen Liu, Michele Catasta, and Jure Leskovec. 2020. Open graph benchmark: Datasets for machine learning on graphs.Advances in neural information processing systems 33 (2020), 22118–22133

    2020

  2. [10]

    Privacy-preserving graph machine learning from data to computation: A survey.ACM SIGKDD Explorations Newsletter25, 1 (2023), 54–72

    2023

  3. [11]

    Andrew Kachites McCallum, Kamal Nigam, Jason Rennie, and Kristie Seymore

  4. [12]

    Liya Ma, Siqi Sun, Chen Li, Lu Liu, and Lihong Wang. 2026. A novel dynamic graph generative adversarial network with edge-level differential privacy.Neu- rocomputing676 (2026), 132926

    2026

  5. [13]

    Anirban Mitra and Subrata Paul. 2025. Analyzing social networks with dynamic graphs: Unravelling the ever-evolving connections. InApplied Graph Data Science. Elsevier, 195–214

    2025

  6. [14]

    Tamara T Mueller, Dmitrii Usynin, Johannes C Paetzold, Daniel Rueckert, and Georgios Kaissis. 2022. SoK: Differential privacy on graph-structured data.arXiv preprint arXiv:2203.09205(2022)

    2022 arXiv

  7. [15]

    Ilya Mironov. 2017. Rényi differential privacy. In2017 IEEE 30th computer security foundations symposium (CSF). IEEE, 263–275

    2017

  8. [16]

    Yuxin Qi, Xi Lin, Ziyao Liu, Gaolei Li, Jingyu Wang, and Jianhua Li. 2024. Link- guard: Link locally privacy-preserving graph neural networks with integrated denoising and private learning. InCompanion Proceedings of the ACM Web Con- ference 2024. 593–596

    2024

  9. [17]

    Xun Ran, Qingqing Ye, Haibo Hu, Xin Huang, Jianliang Xu, and Jie Fu. 2024. Differentially private graph neural networks for link prediction. In2024 IEEE 40th International Conference on Data Engineering (ICDE). IEEE, 1632–1644

    2024

  10. [18]

    Sudipta Paul, Julián Salas, and Vicenç Torra. 2023. Edge local differential privacy for dynamic graphs. InInternational Symposium on Security and Privacy in Social Networks and Big Data. Springer, 224–238

    2023

  11. [19]

    Sofya Raskhodnikova and Teresa Anna Steiner. 2025. Fully dynamic algorithms for graph databases with edge differential privacy.Proceedings of the ACM on Management of Data3, 2 (2025), 1–28

    2025

  12. [20]

    Sina Sajadmanesh and Daniel Gatica-Perez. 2021. Locally private graph neural networks. InProceedings of the 2021 ACM SIGSAC conference on computer and communications security. 2130–2145

    2021

  13. [21]

    Sofya Raskhodnikova and Adam Smith. 2016. Differentially private analysis of graphs.Encyclopedia of Algorithms(2016)

    2016

  14. [22]

    2023.{GAP}: Differentially private graph neural networks with aggre- gation perturbation

    Sina Sajadmanesh, Ali Shahin Shamsabadi, Aurélien Bellet, and Daniel Gatica- Perez. 2023.{GAP}: Differentially private graph neural networks with aggre- gation perturbation. In32nd USENIX Security Symposium (USENIX Security 23). 3223–3240

    2023

  15. [23]

    Vedran Sekara, Arkadiusz Stopczynski, and Sune Lehmann. 2016. Fundamental structures of dynamic social networks.Proceedings of the national academy of sciences113, 36 (2016), 9977–9982

    2016

  16. [24]

    Sina Sajadmanesh and Daniel Gatica-Perez. 2024. Progap: Progressive graph neural networks with differential privacy guarantees. InProceedings of the 17th ACM International Conference on Web Search and Data Mining. 596–605

    2024

  17. [25]

    Li Sun, Zhongbao Zhang, Feiyang Wang, Pengxin Ji, Jian Wen, Sen Su, and Philip S Yu. 2022. Aligning dynamic social networks: An optimization over dynamic graph autoencoder.IEEE Transactions on Knowledge and Data Engineering35, 6 (2022), 5597–5611

    2022

  18. [26]

    Yuanfu Sun, Zhengnan Ma, Yi Fang, Jing Ma, and Qiaoyu Tan. 2025. Graphicl: Unlocking graph learning potential in llms through structured prompt design. In Findings of the Association for Computational Linguistics: NAACL 2025. 2440–2459

    2025

  19. [27]

    Josh Smith, Hassan Jameel Asghar, Gianpaolo Gioiosa, Sirine Mrabet, Serge Gaspers, and Paul Tyler. 2021. Making the most of parallel composition in differential privacy.arXiv preprint arXiv:2109.09078(2021)

    2021 arXiv

  20. [28]

    Jean-Philippe Vert and Yoshihiro Yamanishi. 2004. Supervised graph inference. Advances in neural information processing systems17 (2004)

    2004

  21. [29]

    Duo Wang, Yuan Zuo, Fengzhi Li, and Junjie Wu. 2024. Llms as zero-shot graph learners: Alignment of gnn representations with llm token embeddings.Advances in neural information processing systems37 (2024), 5950–5973

    2024

  22. [30]

    Jiabin Tang, Yuhao Yang, Wei Wei, Lei Shi, Lixin Su, Suqi Cheng, Dawei Yin, and Chao Huang. 2024. Graphgpt: Graph instruction tuning for large language models. InProceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval. 491–500

    2024

  23. [31]

    Ruofan Wu, Mingyang Zhang, Lingjuan Lyu, Xiaolong Xu, Xiuquan Hao, Xinyi Fu, Tengfei Liu, Tianyi Zhang, and Weiqiang Wang. 2023. Privacy-preserving design of graph neural networks with applications to vertical federated learning. arXiv preprint arXiv:2310.20552(2023)

    2023 arXiv

  24. [32]

    Shitao Xiao, Zheng Liu, Peitian Zhang, and Niklas Muennighoff. 2023. C-Pack: Packaged Resources To Advance General Chinese Embedding. arXiv:2309.07597 [cs.CL]

    2023 arXiv

  25. [33]

    Yue Wang, Xintao Wu, and Donghui Hu. 2016. Using randomized response for differential privacy preserving data collection.. InEDBT/ICDT Workshops, Vol. 1558. 0090–6778

    2016

  26. [34]

    Keyulu Xu, Weihua Hu, Jure Leskovec, and Stefanie Jegelka. 2018. How powerful are graph neural networks?arXiv preprint arXiv:1810.00826(2018)

    2018 arXiv

  27. [35]

    Yuanyuan Zeng, Yixiang Fang, Kun Chen, Yangfan Li, and Chenhao Ma. 2025. Efficient Maintenance of 2-Hop Labeling Index on Dynamic Small-World Graphs. Proceedings of the VLDB Endowment18, 7 (2025), 2005–2017

    2025

  28. [36]

    Jian Xu, Chao Yu, Jiawei Xu, Vetle I Torvik, Jaewoo Kang, Mujeen Sung, Min Song, Yi Bu, and Ying Ding. 2025. PubMed knowledge graph 2.0: Connecting papers, patents, and clinical trials in biomedical science.Scientific data12, 1 (2025), 1018

    2025

  29. [37]

    Yes”/“No

    Qiuchen Zhang, Hong kyu Lee, Jing Ma, Jian Lou, Carl Yang, and Li Xiong. 2024. Dpar: Decoupled graph neural networks with node-level differential privacy. In Proceedings of the ACM Web Conference 2024. 1170–1181. A Proofs Proof for Lemma 3.1. Neighboring graphs differ in one u...

    2024

  30. [39]

    Dalong Zhang, Xianzheng Song, Zhiyang Hu, Yang Li, Miao Tao, Binbin Hu, Lin Wang, Zhiqiang Zhang, and Jun Zhou. 2023. InferTurbo: A scalable system for boosting full-graph inference of graph neural network over huge graphs. In2023 IEEE 39th International Conference on Data Eng...

    2023

  31. [2000]

    Information Retrieval3, 2 (2000), 127–163

    Automating the construction of internet portals with machine learning. Information Retrieval3, 2 (2000), 127–163

    2000

  32. [2023]

    Differentially private decoupled graph convolutions for multigranular topology protection.Advances in Neural Information Processing Systems36 (2023), 45381–45401

    2023

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.