REVIEW 5 major objections 5 minor 34 references
Bit-Flip Fault Attack: Crushing Graph Neural Networks via Gradual Bit Search
T0 review · 5 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash
Pith's one-line read A single bit flip in the last layer can cut GNN accuracy by 17 percent.
desk verdict Good existence result on GNN bit-flip fragility, but the paper's own random baseline undercuts its central layer-aware claim. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing mechanism is the per-bit flip decision. For a stored weight $b$ written in binary, GBFA computes the gradient of the inference loss with respect to each bit, $\nabla_b \mathcal{L}=[\partial \mathcal{L}/\partial b_{31},\dots,\partial \mathcal{L}/\partial b_0]$, and applies the rule $\hat{b}_i = \operatorname{sign}(\partial \mathcal{L}/\partial b_i)\wedge(b_i\vee I)$ with a truth table that allows a flip only when the current bit value and the gradient sign agree that the flip will increase loss, avoiding overflow. The second mechanism is the layer sequence predictor: an HMM whose states are layers, fed by kernel features ($\mathit{Exelat}$, $\mathit{Rv}$, $\mathit{Wv}$, $\mathit{Iv/Ov}$, $\mathit{kdd}$) extracted from the memory bus, decoded with CTC beam search to output the most likely layer sequence. Together these make the attack layer-aware: the predictor supplies the target layer and the bit rule supplies the minimal set of flips.
What would settle it
Run the HMM-CTC layer predictor on real memory traces from a ReGNN-style accelerator executing GCN on Cora and compare its predicted layer sequence to the true one; if the edit distance is close to chance, or if flipping bits in the predicted layer degrades accuracy no more than flipping the same number of randomly chosen bits, then the claim that layer awareness drives GBFA's success is falsified.
Extended reading notes
Core claim
The paper's central claim is that GNNs are vulnerable to a gray-box, layer-aware bit-flip fault attack, and that the layer chosen for the flip matters as much as the number of flips. On the paper's own account, GBFA works by snooping memory patterns to identify the executing layer, then performing an in-layer search that flips the most vulnerable bit of selected weights, ranked by gradient ascent on the inference loss. The evidence offered is the accuracy collapse across architectures: for example, at BER 1e-1, GCN-Cora drops to 21% post-attack accuracy with 22 flips in layer 3, and GraphSAGE-Cora drops to 66% with a single flip in layer 2 at the minimum BER; GAT-Cora shows the largest gap over random flips (51% vs 74% at minimum BER). The authors read the strong layer-to-layer variation as showing that an attacker who ignores layer structure is much weaker, and that GNN accelerators should expect hardware fault attacks aimed at particular layers.
Load-bearing premise
The attack stands on the assumption that an attacker who does not know the model can still read the memory bus accurately enough to identify the executing layer and can also obtain the loss gradients of the stored weights; if either of those leaks fails, layer-aware targeting collapses into blind bit-flipping.
Editorial extensions
If this is right
- A GNN deployed on an accelerator with weights in DRAM can be attacked by physical fault injection even if the attacker has no software access to the model.
- The layer that is executing is discoverable from memory-access features, so an attacker can aim a fault at a particular layer rather than flipping bits blindly.
- For GCN, GAT, and GraphSAGE, deeper layers are the most damaging targets; for GIN, middle layers are the most sensitive.
- Because a single correctly placed flip can already degrade accuracy, error-correcting codes designed for random bit errors may not protect GNN inference from a deliberate, layer-aware attacker.
Reading between the lines
- If memory footprints are discriminative on other GNN accelerators as well, a similar two-stage attack could be migrated from the ReGNN-style design to any accelerator whose per-layer memory behavior is observable; the paper only demonstrates the predictor on its own design.
- The one-bit result on GraphSAGE-Cora suggests a cheap defensive experiment the paper does not run: enable error-detecting checksums on the final transformation layer's weights and measure whether the single-flip attack stops degrading accuracy.
- The gradient-ranking stage presumes the attacker can compute per-bit gradients of the target model's loss; a natural stress test is to repeat the attack with gradients from a surrogate model and measure how much accuracy degradation survives the mismatch.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes GBFA, a gray-box bit-flip fault attack against GNN accelerators. The attack has two stages: first, memory-access patterns are monitored and a Hidden Markov Model with a CTC decoder predicts the GNN layer being executed; second, within the predicted layer, a gradient-guided gradual search flips bits in selected weights to degrade classification accuracy. The authors evaluate GBFA on GCN, GAT, GraphSAGE, and GIN using Cora and PubMed, reporting post-attack accuracy drops and claiming that layer-aware in-layer search is essential for an effective attack, with a headline result of a 17% accuracy drop on GraphSAGE-Cora from a single bit flip in the last layer.
Significance. If the claims were fully supported, this would be a timely contribution to hardware security for GNN accelerators. The memory-pattern-based layer inference is a fresh idea, and the systematic evaluation across multiple GNN architectures and two datasets is useful. The paper also makes a concrete falsifiable prediction about layer-dependent vulnerability. However, the current evidence is undermined by three load-bearing problems: the random-baseline comparison in Table VIII does not support the claim that layer-aware search is critical; the attack uses the test set as both search oracle and evaluation metric, making reported PAC the optimization target; and the threat model is internally inconsistent about whether the adversary knows the model. These issues must be addressed before the significance of the contribution can be assessed.
major comments (5)
- [§IV.D, Table VIII] The central claim that 'targeted in-layer search is critical' is not supported by Table VIII. At the minimum BER, the random bit-flip baseline matches or nearly matches GBFA on five of six model–dataset pairs (e.g., GCN-Cora 81% vs 80%, GCN-PubMed 78% vs 77%, GraphSAGE-PubMed 76% vs 75%, GIN-Cora 64% vs 63%, GIN-PubMed 61% vs 60%). The table does not report the number of flipped bits (nbit) used by the random baseline, nor any variance or seed information, so the differences are not established as statistically meaningful. A fair comparison requires an equal-bit-budget, seed-controlled experiment that reports nbit for both methods, with multiple random trials. Without that, the paper's distinctive contribution—gradual, gradient-ranked, layer-aware search—is indistinguishable from a model-blind random bit flip.
- [Algorithm 1 and §III.B.2] The attack evaluates itself on the same data it uses to search for bits. In Algorithm 1, the gradient of the test loss is computed (line 7), the bit with the highest gradient is flipped (lines 8–12), and then the post-flip test accuracy is evaluated to decide whether to continue (lines 14–19). This means the reported post-attack accuracy (PAC) is the direct optimization target of the search, not an independent measure of attack success. The reported degradation, including the headline one-bit result on GraphSAGE-Cora, may be an artifact of overfitting to the test set. To make the evaluation credible, the search should be guided by a separate validation set, with the test set used only for final evaluation after the attack terminates.
- [§III and Eq. (2)] The threat model is internally inconsistent. The text states that 'the adversary has no knowledge of the GNN model, training dataset, or hyperparameters' but then assumes 'access to the gradients and the test dataset.' Computing the gradient in Eq. (2), ∂L/∂b, requires the model architecture, the loss function, and the weights, which contradicts the no-knowledge assumption. Algorithm 1 also directly uses the GNN's loss and weights. The authors should either present a coherent white-box or gray-box threat model (e.g., the adversary has access to a surrogate model or knows the architecture but not the training data) or explain how the required gradients are obtained without model knowledge.
- [§III.B.1 and §IV.B] The layer-sequence predictor is evaluated only in isolation (Table IV reports LER), and it is never integrated into the end-to-end attack. All attack results in Tables V–VIII appear to assume the target layer is known exactly; the predicted layer sequence is not used in the attack experiments. To validate the two-stage attack, the authors should report PAC/ASR when the predicted layer sequence is used, compared with the ground-truth layer sequence. Without this, the practical relevance of the HMM+CTC predictor to the attack is unsupported.
- [§IV.C and Table V] The definition of 'minimum BER' is unclear and appears to vary across models and layers. In Table VIII, 'Min BER' values range from 1e-4 to 1e-2, but the relation between BER and nbit is not specified. More importantly, the random baseline in Table VIII is said to use 'the minimum BER that causes a drop in accuracy,' but no nbit is reported, so it is impossible to know whether the comparison is at the same bit budget. Please define BER precisely (e.g., the fraction of weights selected for flipping versus the fraction of bits flipped), report nbit for every configuration, and match nbit between GBFA and random flips in the comparison.
minor comments (5)
- [Abstract and §I] There are numerous typographical errors, e.g., 'security challenge' should be 'security challenges', 'select a vulnerable bit' should be 'selecting a vulnerable bit', 'evalauate' should be 'evaluate', and 'in compare to' should be 'compared to'. The paper would benefit from a careful proofread.
- [§II.B] The sentence 'While the The impact of BFAs has been widely studied on DNN accelerators' contains a duplicated 'the' and is missing a comma. Also, the 'Limitation of previous works' paragraph should more clearly distinguish the prior PBS method on DNNs from the proposed method on GNNs.
- [§III.B.2, Table I and Eq. (4)] The notation in Eq. (4) is unclear: the symbol '∧' is used without an explicit definition, and the connection between the truth table and the equation is not fully explained. The condition in Algorithm 1 (line 8) also appears to be a reformulation of Table I, but this equivalence is not stated. Please clarify the boolean logic used.
- [§IV.C, Figure 5] Figure 5 is described as showing 'average post-attack test accuracy,' but no error bars or variance information are provided. Since the attack involves random weight selection within a layer, reporting results from a single run or the average without error bars makes it difficult to assess the stability of the reported PAC values.
- [§IV.D] The comparison with IBFA is described only at a high level, and the authors state that a direct comparison is impossible because different datasets are used. It would be useful to at least report IBFA's results on Cora or PubMed, or to explain why such an experiment is not feasible, so that readers can assess relative effectiveness.
Circularity Check
Reported GBFA accuracy drops are the optimized value of a test-set-guided search, so the headline single-bit-flip results are forced by construction; the layer-aware advantage over random is not established (Table VIII), though self-citations are not load-bearing.
-
fitted input called prediction
[Sec. III; Sec. III.B.2, Eq. 2, Algorithm 1 (lines 14-19)]
"it is assumed that the adversary has access to the gradients and the test dataset. ... This targeted bit-flip operation is followed by an inference phase, where GBFA evaluates the loss function and the network's test accuracy after perturbation. ... Conduct a performance evaluation of the GNN model with modified weights. if attack is successful then End procedure else set another BER or target another layer."
Eq. 2 ranks bits by ∂L/∂b, with L the inference loss; because the adversary is assumed to have test-set access, this is the test loss. Algorithm 1 flips the top-ranked bit, then re-evaluates test accuracy and stops only when 'attack is successful', otherwise raising BER or switching layers. The reported post-attack accuracy at 'minimum BER' is thus the value of the search's own stopping condition, not an independent measurement: the single-bit-flip drops and minimum-BER summaries in the abstract, Fig. 5, and Tables V-VII are selected on the same test set used for evaluation. The 'minimum BER' is by construction the first BER at which the test-accuracy criterion is met, so the headline claims reduce to the search objective and provide no out-of-sample evidence of attack strength.
full rationale
The main circularity is that the claimed attack outcomes are not independent of the search procedure. Section III grants the adversary 'access to the gradients and the test dataset'; Eq. 2 ranks bits by gradient of the inference (test) loss; and Algorithm 1 flips the highest-ranked bit, re-computes test accuracy, and repeats until 'attack is successful' or changes BER/layer. The reported post-attack accuracy at 'minimum BER' is therefore the stopping value of this same test-set objective. This is fitted-input-called-prediction: the 'prediction' that GBFA crushes accuracy with one or few flips is statistically forced by selecting on the evaluation set. That alone warrants a score of 6. Other potential concerns are not circularity. The HMM/CTC layer-sequence predictor is trained and evaluated as its own supervised task (Table IV); it is never integrated into the end-to-end attack, which is a completeness gap rather than a definitional circle. The paper's self-citations (e.g., [2], [3], [4], [7], [8], [24], [26], [27]) are contextual and not used as load-bearing uniqueness theorems, so they do not raise the score. The claim that layer-aware in-layer search is essential is weakened by the paper's own Table VIII: at minimum BER, random bit-flip attack matches GBFA on five of six model-dataset pairs (e.g., GCN-Cora 81% vs 80%, GIN-PubMed 61% vs 60%), with only GAT-Cora showing a clear gap. That undercuts the central contribution, but it is an evidentiary/overclaim problem, not a circular reduction, so it is noted here rather than scored as a separate circular step. There is also an internal inconsistency between 'no knowledge of the GNN model' (Sec. III) and Eq. 2's requirement of the model's loss and weights; this is a coherence issue, not circularity.
Assumptions & free parameters
free parameters (3)
- Bit error rate (BER) per model-layer =
1e-4 to 1e-1 (e.g., GraphSAGE-Cora layer 2: 1e-2; GCN-Cora layer 3: 1e-1)
- Random weight selection within target layer =
not reported
- Minimum BER threshold definition =
varies by model and layer
assumptions (5)
- standard math Backpropagation provides the loss gradient with respect to each bit of each weight
- domain assumption Memory access patterns (Exelat, Rv, Wv, Iv/Ov, kdd) distinguish GNN layers and are observable via GDDR snooping
- domain assumption An attacker can flip one targeted bit in a specific stored weight at a chosen time
- ad hoc to paper The adversary can compute gradients without knowing the model
- ad hoc to paper The sign-flip rule of Table I and Eq. 4 maximizes loss increase
Cite this review
Pith. "Pith review of Bit-Flip Fault Attack: Crushing Graph Neural Networks via Gradual Bit Search." pith.science (2026). https://pith.science/paper/B5FRGGJO
@misc{pith2026250705531,
author = {Pith},
title = {Pith review of: Bit-Flip Fault Attack: Crushing Graph Neural Networks via Gradual Bit Search},
year = {2026},
howpublished = {\url{https://pith.science/paper/B5FRGGJO}},
note = {Machine review of arXiv:2507.05531}
}
read the original abstract
Graph Neural Networks (GNNs) have emerged as a powerful machine learning method for graph-structured data. A plethora of hardware accelerators has been introduced to meet the performance demands of GNNs in real-world applications. However, security challenges of hardware-based attacks have been generally overlooked. In this paper, we investigate the vulnerability of GNN models to hardware-based fault attack, wherein an attacker attempts to misclassify output by modifying trained weight parameters through fault injection in a memory device. Thus, we propose Gradual Bit-Flip Fault Attack (GBFA), a layer-aware bit-flip fault attack, selecting a vulnerable bit in each selected weight gradually to compromise the GNN's performance by flipping a minimal number of bits. To achieve this, GBFA operates in two steps. First, a Markov model is created to predict the execution sequence of layers based on features extracted from memory access patterns, enabling the launch of the attack within a specific layer. Subsequently, GBFA identifies vulnerable bits within the selected weights using gradient ranking through an in-layer search. We evaluate the effectiveness of the proposed GBFA attack on various GNN models for node classification tasks using the Cora and PubMed datasets. Our findings show that GBFA significantly degrades prediction accuracy, and the variation in its impact across different layers highlights the importance of adopting a layer-aware attack strategy in GNNs. For example, GBFA degrades GraphSAGE's prediction accuracy by 17% on the Cora dataset with only a single bit flip in the last layer.
Figures
Figures from the paper (2 more)
Reference graph
Works this paper leans on
-
[1]
Regnn: A redundancy- eliminated graph neural networks accelerator
C HEN , C., L I, K., L I, Y., AND ZOU, X. Regnn: A redundancy- eliminated graph neural networks accelerator. In 2022 IEEE Interna- tional Symposium on High-Performance Computer Architecture (HPCA) (2022), IEEE, pp. 429–443
work page 2022
-
[2]
C HEN , Z., K OLHE , G., R AFATIRAD , S., L U, C.-T., D INAKARRAO , S. M. P., H OMAYOUN , H., AND ZHAO, L. Estimating the circuit de- obfuscation runtime based on graph deep learning. In ACM/EDAA/IEEE Design Automation and Test in Europe (DATE) (2020)
work page 2020
-
[3]
M., R AFATIRAD , S., PUDUKOTAI DINAKARRAO , S
C HEN , Z., Z HANG , L., K OLHE , G., K AMALI , H. M., R AFATIRAD , S., PUDUKOTAI DINAKARRAO , S. M., H OMAYOUN , H., L U, C.-T., AND ZHAO, L. Deep graph learning for circuit deobfuscation. Frontiers in big Data 4 (2021), 608286
work page 2021
-
[4]
Global explanation supervision for graph neural networks
E TEMADYRAD , N., G AO, Y., M ANOJ PUDUKOTAI DINAKARRAO , S., AND ZHAO, L. Global explanation supervision for graph neural networks. Frontiers in big Data 7 (2024), 1410424
work page 2024
-
[5]
F EY, M., AND LENSSEN , J. E. Fast graph representation learning with pytorch geometric. arXiv preprint arXiv:1903.02428 (2019)
arXiv 2019
-
[6]
J., S HLENS , J., AND SZEGEDY , C
G OODFELLOW , I. J., S HLENS , J., AND SZEGEDY , C. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)
arXiv 2014
-
[7]
I., S ABER LATIBARI , B., S RIKANTH , A., S HEAVES , T., BEHESHTI -S HIRAZI , S
G UBBI , K. I., S ABER LATIBARI , B., S RIKANTH , A., S HEAVES , T., BEHESHTI -S HIRAZI , S. A., PD, S. M., R AFATIRAD , S., S ASAN , A., HOMAYOUN , H., AND SALEHI , S. Hardware trojan detection using ma- chine learning: A tutorial. ACM Transactions on Embedded Computing Systems 22 , 3 (2023), 1–26
work page 2023
-
[8]
H ASSAN , R., K OHLE , G., H OMAYOUN , H., AND DINAKARRAO , S. M. P. A neural network-based cognitive obfuscation towards enhanced logic locking. IEEE Transactions on Computer-Aided Design (TCAD) 41, 11 (2022), 4587–4599
work page 2022
Show all 34 references
-
[9]
Terminal brain damage: Exposing the graceless degradation in deep neural networks under hardware fault attacks
H ONG , S., F RIGO , P., K AYA, Y., G IUFFRIDA , C., AND DUMITRAS, , T. Terminal brain damage: Exposing the graceless degradation in deep neural networks under hardware fault attacks. In 28th USENIX Security Symposium (USENIX Security 19) (2019), pp. 497–514
2019
-
[10]
Deepsniffer: A dnn model extrac- tion framework based on learning architectural hints
H U, X., L IANG , L., L I, S., D ENG , L., Z UO, P., J I, Y., X IE, X., D ING , Y., LIU, C., S HERWOOD , T., ET AL . Deepsniffer: A dnn model extrac- tion framework based on learning architectural hints. In Proceedings of the Twenty-Fifth International Conference on Architectu...
2020
-
[11]
A survey on convolutional neural network accelerators: Gpu, fpga and asic
H U, Y., L IU, Y., AND LIU, Z. A survey on convolutional neural network accelerators: Gpu, fpga and asic. In 2022 14th International Conference on Computer Research and Development (ICCRD) (2022), IEEE, pp. 100–107
2022
-
[12]
Adversarial attacks and defenses on graphs
J IN, W., L I, Y., X U, H., W ANG , Y., J I, S., A GGARWAL , C., AND TANG , J. Adversarial attacks and defenses on graphs. ACM SIGKDD Explorations Newsletter 22 , 2 (2021), 19–34
2021
-
[13]
H., L EE, D., WILKERSON , C., L AI, K., AND MUTLU , O
K IM, Y., D ALY, R., K IM, J., F ALLIN , C., L EE, J. H., L EE, D., WILKERSON , C., L AI, K., AND MUTLU , O. Flipping bits in memory without accessing them: An experimental study of dram disturbance errors. ACM SIGARCH Computer Architecture News 42 , 3 (2014), 361– 372
2014
-
[14]
N., AND WELLING , M
K IPF, T. N., AND WELLING , M. Semi-supervised classification with graph convolutional networks. arXiv preprint arXiv:1609.02907 (2016)
2016 arXiv
-
[15]
T., N UNEZ -YANEZ , J., P IECHOCKI , R., AND POPE , J
K OSE , H. T., N UNEZ -YANEZ , J., P IECHOCKI , R., AND POPE , J. A survey of computationally efficient graph neural networks for reconfig- urable systems. Information 15 , 7 (2024), 377
2024
-
[16]
Attacking graph neural networks with bit flips: Weisfeiler and leman go indifferent
K UMMER , L., M OUSTAFA , S., S CHRITTWIESER , S., G ANSTERER , W., AND KRIEGE , N. Attacking graph neural networks with bit flips: Weisfeiler and leman go indifferent. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (2024), pp. 1428–1439
2024
-
[17]
L I, G., H ARI , S. K. S., S ULLIVAN , M., T SAI , T., P ATTABIRAMAN , K., E MER , J., AND KECKLER , S. W. Understanding error propagation in deep learning neural network (dnn) accelerators and applications. In Proceedings of the international conference for high performance c...
2017
-
[18]
Towards deeper graph neural networks
L IU, M., G AO, H., AND JI, S. Towards deeper graph neural networks. In Proceedings of the 26th ACM SIGKDD international conference on knowledge discovery & data mining (2020), pp. 338–348
2020
-
[19]
Fault injection attack on deep neural network
L IU, Y., W EI, L., L UO, B., AND XU, Q. Fault injection attack on deep neural network. In 2017 IEEE/ACM International Conference on Computer-Aided Design (ICCAD) (2017), IEEE, pp. 131–138
2017
-
[20]
The impact of faults on dnns: A case study
M ALEKZADEH , E., R OHBANI , N., L U, Z., AND EBRAHIMI , M. The impact of faults on dnns: A case study. In 2021 IEEE International Symposium on Defect and Fault Tolerance in VLSI and Nanotechnology Systems (DFT) (2021), IEEE, pp. 1–6
2021
-
[21]
A survey on modeling and improving reliability of dnn algorithms and accelerators
M ITTAL , S. A survey on modeling and improving reliability of dnn algorithms and accelerators. Journal of Systems Architecture 104 (2020), 101689
2020
-
[22]
A survey on hardware security of dnn models and accelerators
M ITTAL , S., G UPTA, H., AND SRIVASTAVA, S. A survey on hardware security of dnn models and accelerators. Journal of Systems Architecture 117 (2021), 102163
2021
-
[23]
Pytorch: An imperative style, high-performance deep learning library
P ASZKE , A., G ROSS , S., M ASSA , F., L ERER , A., B RADBURY , J., CHANAN , G., K ILLEEN , T., L IN, Z., G IMELSHEIN , N., A NTIGA , L., ET AL . Pytorch: An imperative style, high-performance deep learning library. Advances in neural information processing systems 32 (2019)
2019
-
[24]
R AFATIRAD , S., H OMAYOUN , H., C HEN , Z., AND PUDUKOTAI DI- NAKARRAO , S. M. Graph learning. In Machine Learning for Computer Scientists and Data Analysts: From an Applied Perspective . Springer, 2022, pp. 277–304
2022
-
[25]
S., H E, Z., AND FAN, D
R AKIN , A. S., H E, Z., AND FAN, D. Bit-flip attack: Crushing neural network with progressive bit search. In Proceedings of the IEEE/CVF International Conference on Computer Vision (2019), pp. 1211–1220
2019
-
[26]
S ARAVANAN , R., K ASARAPU , S., AND DINAKARRAO , S. M. P. Graph- fuzz: Accelerating hardware testing with graph models. arXiv preprint arXiv:2412.13374 (2024)
2024 arXiv
-
[27]
S HUKLA , S., R AFATIRAD , S., H OMAYOUN , H., AND DINAKARRAO , S. M. P. Federated learning with heterogeneous models for on-device malware detection in iot networks. In Design Automation and Test in Europe (DATE) (2023)
2023
-
[28]
Fp-gnn: Adaptive fpga accelerator for graph neural networks
T IAN , T., Z HAO, L., W ANG , X., W U, Q., Y UAN, W., AND JIN, X. Fp-gnn: Adaptive fpga accelerator for graph neural networks. Future Generation Computer Systems 136 (2022), 294–310
2022
-
[29]
Pygfi: Analyzing and enhancing robustness of graph neural networks against hardware errors
W ANG , R., L IN, F., M OORE , D., S ANKAR , S., AND JIAO, X. Pygfi: Analyzing and enhancing robustness of graph neural networks against hardware errors. arXiv preprint arXiv:2212.03475 (2022)
2022 arXiv
-
[30]
Graph neural networks in recommender systems: a survey
W U, S., S UN, F., Z HANG , W., X IE, X., AND CUI, B. Graph neural networks in recommender systems: a survey. ACM Computing Surveys 55, 5 (2022), 1–37
2022
-
[31]
Accel-gcn: High- performance gpu accelerator design for graph convolution networks
X IE, X., P ENG , H., H ASAN , A., H UANG , S., Z HAO, J., F ANG , H., ZHANG , W., G ENG , T., K HAN , O., AND DING , C. Accel-gcn: High- performance gpu accelerator design for graph convolution networks. In 2023 IEEE/ACM International Conference on Computer Aided Design (ICCA...
2023
-
[32]
Hygcn: A gcn accelerator with hybrid archi- tecture
Y AN, M., D ENG , L., H U, X., L IANG , L., F ENG , Y., Y E, X., Z HANG , Z., F AN, D., AND XIE, Y. Hygcn: A gcn accelerator with hybrid archi- tecture. In 2020 IEEE International Symposium on High Performance Computer Architecture (HPCA) (2020), IEEE, pp. 15–29
2020
-
[33]
Low-latency mini-batch gnn inference on cpu-fpga heterogeneous platform
Z HANG , B., Z ENG , H., AND PRASANNA , V. Low-latency mini-batch gnn inference on cpu-fpga heterogeneous platform. In 2022 IEEE 29th International Conference on High Performance Computing, Data, and Analytics (HiPC) (2022), IEEE, pp. 11–21
2022
-
[34]
A survey on graph neural network acceleration: Algorithms, systems, and customized hardware
Z HANG , S., S OHRABIZADEH , A., W AN, C., H UANG , Z., H U, Z., WANG , Y., C ONG , J., S UN, Y., ET AL . A survey on graph neural network acceleration: Algorithms, systems, and customized hardware. arXiv preprint arXiv:2306.14052 (2023)
2023
Reviewed August 6, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.