Pith. sign in

REVIEW 4 major objections 5 minor 38 references

Robustness questions the interpretability of graph neural networks: what to do?

T0 review · 4 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Most popular GNN defense methods improve explanation sparsity and stability across the benchmark.

desk verdict A useful benchmark grid undone by a mislabeled fidelity metric and no actual attack; the sparsity/stability finding survives but the headline claim about defenses improving interpretability does not. read the letter →

arxiv 2505.02566 v1 pith:JIJK2ZUJ submitted 2025-05-05 cs.LG cs.AI

Kirill Lukyanov (1 , 2 , 3) , Georgii Sazonov (2 , 4) , Serafim Boyarsky (6) , Ilya Makarov (1 v 5) ((1) ISP RAS Research Center for Trusted Artificial Intelligence , (2) Ivannikov Institute for System Programming of the Russian Academy of Sciences
show 5 more authors
(3) Moscow Institute of Physics Technology (National Research University) (4) Lomonosov Moscow State University (5) AIRI (6) Yandex School of Data Analysis)
This is my paper · ORCID
classification cs.LGcs.AI
keywords graphneuralnetworksinterpretabilityadversarialrobustnessdefensemechanismsGNNExplainerexplanationmetricspoisoningattacksevasion
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to determine whether hardening a graph neural network against adversarial attacks changes how interpretable it is, and it reports a systematic benchmark designed to answer that question. Across six GNN architectures, five datasets, and seven defense mechanisms, the authors find that most defenses improve interpretability as measured by explanation sparsity and stability, while leaving consistency and fidelity approximately unchanged. The benchmark also shows that sparsity and stability respond to model and data changes, whereas consistency and fidelity stay flat, so the paper recommends using the first pair as the sensitive diagnostics. This matters because practitioners who add robustness defenses to GNNs need to know whether the explanations they hand to users will still be meaningful.

What carries the argument

The engine of the study is a fixed benchmark pipeline: choose a dataset, an attack, and a defense; train the GNN; run a post-hoc interpreter to obtain a mask over edges and features; then score the mask with four metrics. GNNExplainer, a method that trains a differentiable mask over a node's computation graph, is the primary interpreter, with SubgraphX used as a check on Cora. The metrics that carry the central conclusion are sparsity, the fraction of nonzero mask entries, and stability, the Euclidean distance between masks on original and slightly perturbed graphs; defended models consistently fall on the good side of both relative to the undefended baseline across the result tables. Fidelity is computed as the average absolute difference between the model's output on the interpreted subgraph and on the original graph, and consistency is the cosine similarity between masks from repeated runs.

What would settle it

Recompute the defense-vs-unprotected comparisons with Fidelity interpreted literally as the Section 3.2 formula, where lower is better; Table 7's defended fidelity of 0.995 versus 0.760 for unprotected then indicates that defenses worsen fidelity, and if that reversal holds across Tables 5-8 the headline claim loses one of its four supporting metrics.

Watch

Extended reading notes

Core claim

The central claim is stated in Section 5: the addition of most popular defense methods improves model interpretability. In the benchmark, Jaccard, GNNGuard, distillation, quantization, autoencoder, gradient regularization, and most runs of adversarial training each move GNNExplainer masks toward sparser and more stable explanations relative to an undefended GNN, while consistency and fidelity change little. Adversarial training is the partial exception, improving stability less than the other defenses on some datasets. The paper further claims that consistency and fidelity are stable across architectures, domains, and defenses, making them better suited for validating an interpretation method, whereas sparsity and stability are sensitive indicators of how modifications such as defenses affect explanations.

Load-bearing premise

The conclusion presumes that the four metrics measure interpretability in the direction the tables claim, yet Fidelity is defined as an average absolute difference for which lower should be better while every table marks it as higher-is-better.

Editorial extensions

If this is right

  • Practitioners who add Jaccard, GNNGuard, distillation, quantization, autoencoder, gradient regularization, or adversarial training can expect GNNExplainer to return sparser, more stable explanations than an undefended model in most of the settings tested.
  • Because consistency and fidelity barely move across defenses and architectures, these metrics will not reveal whether a model change helped interpretability; sparsity and stability are the metrics to watch.
  • Adversarial training should be treated as the least consistently beneficial defense for explanation stability, with its gains varying by dataset and architecture.
  • Architecture and data domain set the baseline: GIN explanations are less stable and sparser than GCN or SAGE, and the higher-degree Amazon datasets show markedly different stability and sparsity numbers than the citation datasets.
  • The benchmark implies that robustness defenses and interpretability can be improved together rather than treated as competing objectives.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Read literally, the Section 3.2 fidelity formula is an error distance, so lower should mean more faithful, yet the tables mark fidelity as higher-is-better; in Table 7 defended models score 0.995 versus 0.760 for unprotected, which flips if fidelity is treated as a distance, so the four-metric conclusion may rest on three metrics or fewer.
  • The identical fidelity value of 0.995 ± 0.011 for all seven defenses in Table 7 suggests the metric is saturated at these operating points; a fidelity variant that separates keeping relevant features from removing irrelevant ones would give the benchmark more resolving power.
  • The paper's 'significant' language is not backed by statistical tests; paired significance testing across the repeated random node sets would separate real differences from noise and is the natural next step.
  • The paper's explanation that defenses act like regularizers predicts a dose-response that was not tested: increasing defense strength should move sparsity and stability monotonically, which one could check by sweeping distillation temperature or gradient-regularization strength.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper presents a benchmark study of how robustness-enhancing defenses affect the interpretability of graph neural networks. It evaluates six GNN architectures on five datasets with seven defense methods, measuring interpretability via four metrics: Fidelity, Stability, Consistency, and Sparsity. The principal empirical claim, stated in Sections 4 and 5, is that most popular defense mechanisms improve model interpretability relative to an undefended model. The paper also discusses which metrics are more or less sensitive to model modifications and calls for refinement of interpretability metrics.

Significance. If the measurements were valid, this would be a useful and timely contribution: the interaction between robustness and interpretability in GNNs is an active area, and the paper covers a broad sweep of architectures, datasets, and defenses. The open-source promise and the explicit hyperparameter listing in Appendix C are strengths. However, the central empirical conclusion is not currently supported because of a fundamental internal inconsistency in the Fidelity metric: it is defined as a distance but annotated as higher-is-better in every table, which inverts the interpretation of the headline result. A second metric, Sparsity, is defined as density rather than as the stated 'percentage of features excluded.' Because the benchmark's conclusions rest on these metrics, the reported quantitative support cannot be accepted as written; nevertheless, the errors appear correctable through re-analysis or clarification, so the work has potential after major revision.

major comments (4)
  1. [Section 3.2 and Tables 1–8, 11–13] The Fidelity metric is defined in Section 3.2 as (1/N) Σ |f(G_int) − f(G_i)|, which is a distance for which smaller values indicate that the explanation better reproduces the model's behavior. Yet every results table annotates FIDELITY with (↑), implying larger is better, and no transformation such as 1 − distance is stated. Under the literal definition, Table 5 shows defended models with Fidelity ≈ 0.994–0.999 versus unprotected ≈ 0.846, meaning defended explanations deviate more from the original predictions — the opposite of the claimed improvement. Table 8 shows the reverse pattern (defended ≈ 0.843–0.856 versus unprotected ≈ 0.925). Either the metric direction is inverted or the implementation differs from the stated definition. This is load-bearing because the Section 5 claim that 'the addition of most popular defense methods improves model interpretability' relies directly on Fidelity as one of four supporting measures. The authors must state precisely which quantity was computed, correct the direction or the tables, and re-evaluate the conclusions.
  2. [Table 7 and Table 13] In Table 7, the Fidelity row reports exactly 0.995 ± 0.011 for all seven defense methods, and in Table 13 (SubgraphX) the Fidelity is exactly 1.000 ± 0.000 for every defense and for the unprotected model. A metric that returns identical values under all conditions is saturated and cannot discriminate between methods. Section 5 states that Fidelity is 'less affected' by defenses, but a constant value is uninformative and does not support any comparative conclusion. The authors should diagnose why the metric collapses (for example, mask thresholds producing near-identical model outputs) and either replace it with a non-degenerate variant or explicitly report it as non-discriminative.
  3. [Section 4.2.3 and Tables 5–8] The text repeatedly uses the word 'significant' and marks 'significant improvements' and 'significant degradations' in bold/italic, but the paper reports no statistical tests. The averaging procedure in Section 4.1.5 uses a fixed set of 10 nodes per iteration and 5 iterations, and the reported standard deviations are large (e.g., Table 6 Stability: 0.622 ± 0.359 for AT versus 0.458 ± 0.312 for JD; Table 3 GIN Stability: 0.494 ± 0.098 versus SAGE 0.272 ± 0.067). Without paired tests across the fixed node sets or confidence intervals, the categorical claims that particular defenses 'significantly' improve or degrade individual metrics are not supported. This directly affects the ranking conclusions in Section 4.2.3.
  4. [Section 3.2, Sparsity definition] The Sparsity formula, Sparsity = (1/m) Σ 1{M(G)_j ≠ 0}, computes the fraction of features that are nonzero in the mask, i.e., the density of selected features, not the 'percentage of features excluded from the prediction's interpretation' as the prose states. The downward arrow (↓) is consistent with the formula (fewer selected features is better), but the verbal definition would require the complement, 1 − Sparsity. If the code implemented the complement, every Sparsity result and the associated comparisons would have the opposite direction. This ambiguity must be resolved in the text and confirmed against the released code.
minor comments (5)
  1. [Section 4.1.3] The loss function is referred to as 'NL LLoss'; this appears to be a typo for NLLLoss.
  2. [Table 12] Table 12 appears malformed: the header lists five GCN entries but only two pairs of values are shown in the body, leaving the architecture-to-value mapping unclear. This should be fixed or the table simplified.
  3. [Section 2.4] The sentence 'the evasion defense mechanism is applied during training' is confusing because evasion attacks occur at inference time; the intended meaning (e.g., adversarial training during training, or input transformation at inference) should be clarified.
  4. [Section 4.1.4 / Conclusion] The paper states the framework 'will be published as open source' but provides no repository link or availability statement; including an anonymous URL or a release note would strengthen reproducibility.
  5. [Appendix D] The claim that 'all the key conclusions are also valid' with SubgraphX is based on only 5 vertices and 5 iterations on a single dataset (Cora), and Table 12 is incomplete; this claim should be qualified as preliminary.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the benchmark is an empirical evaluation against external datasets, architectures, and defense implementations; the only author-overlapping citation is tangential and not load-bearing.

full rationale

The paper's central claim, that most defense methods improve interpretability metrics, is an empirical finding based on measurements of GNNExplainer and SubgraphX on standard datasets (Cora, CiteSeer, PubMed, Computers, Photo) with published attack and defense implementations. No quantity in the paper is derived from a fitted constant that is then renamed a prediction, no uniqueness theorem from the authors' prior work is invoked to force a choice, and no ansatz is smuggled in via self-citation. The sole author-overlapping citation (Shaikhelislamov et al., 2024) appears in Section 2.1 as one of several privacy-attack references and plays no role in supporting the interpretability-versus-defense conclusion. The identified Fidelity issue—the metric is defined as a distance (Section 3.2) while tables annotate it with an upward arrow—is a correctness/validation concern about metric direction and saturation, not a circularity: the reported 'improvement' is an observed comparison, not an equation-level reduction of the conclusion to its inputs. Because the benchmark is self-contained against external benchmarks and its conclusions do not reduce to the metric definitions by construction, the circularity score is 0.

Assumptions & free parameters 8 free parameters · 5 assumptions · 0 invented entities

The conclusions rest on assumptions the paper does not test: the four metrics are valid directional measures of interpretability (the Fidelity contradiction in Section 3.2 suggests this is at least partly false), the selected defenses are genuinely robust even though no attack is run, the 'significant' labels do not depend on statistical tests, GNNExplainer attribute masks are the operational definition of interpretability (Table 10 sets edge mask type to none), and ten fixed nodes per dataset are representative. No new theoretical entities are introduced.

free parameters (8)
  • Jaccard threshold = 0.4
    Chosen by hand (Table 10); determines how many edges are removed, which directly drives the Sparsity and Stability effects attributed to the Jaccard defense.
  • Gradient regularization strength = 50
    Hand-picked lambda (Table 10); a strong smoothness penalty that could itself explain the sparsity and stability improvements the paper credits to defenses in general.
  • Adversarial training epsilon = 0.01
    Hand-picked attack budget (Table 10); the paper attributes a stability penalty to adversarial training, and the magnitude of that penalty depends on this epsilon.
  • Distillation temperature = 5
    Hand-picked temperature (Table 10); shapes the soft labels and therefore the defended model's explanation geometry.
  • Quantization levels = 8
    Hand-picked grid size (Table 10); quantization is a preprocessing that changes feature distributions, so explanation metrics are affected by this choice.
  • Autoencoder bottleneck dimension = 5
    Hand-picked (Table 10); reconstruction fidelity, and therefore the behavior of the autoencoder defense, depends on this capacity.
  • GNNExplainer edge size threshold = 0.005
    Mask pruning threshold (Table 10); Sparsity values are a direct function of this threshold, and no sensitivity analysis is reported.
  • Stability perturbation budget = 5%
    Hand-picked 5% feature noise and 5% node removal budget (Section 4.1.5); Stability magnitudes and rankings can depend on this budget.
assumptions (5)
  • domain assumption The four metrics (Fidelity, Stability, Consistency, Sparsity) are valid directional measures of interpretability.
    Section 2.3 and Section 3.2 adopt them on the authority of Doshi-Velez & Kim (2017) and others; the paper's own results then question exactly these metrics, so the conclusions inherit the metrics' validity.
  • domain assumption The defense methods, applied without any actual attack, preserve the robustness properties claimed in their source papers.
    Section 4.1.4 applies defenses during training or preprocessing; no poisoning or evasion attack is ever launched, so the paper assumes the defended models are genuinely robust.
  • domain assumption Averaged metric differences are meaningful absent statistical tests.
    Section 4.2 and Tables 3-8 label improvements 'significant' with overlapping standard deviations and no test statistic.
  • domain assumption GNNExplainer attribute masks represent GNN interpretability.
    Section 2.2 selects GNNExplainer as the primary method; Table 10 sets node mask type to attributes and edge mask type to none, so 'interpretability' means one scalar mask per node, a narrow operationalization used for all conclusions.
  • domain assumption The 10-node per dataset evaluation sample is representative.
    Section 4.1.5 fixes a random set of 10 nodes per iteration, shared across architectures and defenses; no coverage or variance analysis is given.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Robustness questions the interpretability of graph neural networks: what to do?." pith.science (2026). https://pith.science/paper/JIJK2ZUJ

@misc{pith2026250502566,
  author       = {Pith},
  title        = {Pith review of: Robustness questions the interpretability of graph neural networks: what to do?},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JIJK2ZUJ}},
  note         = {Machine review of arXiv:2505.02566}
}
read the original abstract

Graph Neural Networks (GNNs) have become a cornerstone in graph-based data analysis, with applications in diverse domains such as bioinformatics, social networks, and recommendation systems. However, the interplay between model interpretability and robustness remains poorly understood, especially under adversarial scenarios like poisoning and evasion attacks. This paper presents a comprehensive benchmark to systematically analyze the impact of various factors on the interpretability of GNNs, including the influence of robustness-enhancing defense mechanisms. We evaluate six GNN architectures based on GCN, SAGE, GIN, and GAT across five datasets from two distinct domains, employing four interpretability metrics: Fidelity, Stability, Consistency, and Sparsity. Our study examines how defenses against poisoning and evasion attacks, applied before and during model training, affect interpretability and highlights critical trade-offs between robustness and interpretability. The framework will be published as open source. The results reveal significant variations in interpretability depending on the chosen defense methods and model architecture characteristics. By establishing a standardized benchmark, this work provides a foundation for developing GNNs that are both robust to adversarial threats and interpretable, facilitating trust in their deployment in sensitive applications.

Figures

Figures reproduced from arXiv: 2505.02566 by the authors.

Figure 1
Figure 1. Overall Benchmark Pipeline. One of the available datasets Gi can be selected, along with an attack method Att and a defense method D. The next stage involves training a GNN f on the selected graph Gi while applying the chosen attack and defense methods. The trained model f trained and the dataset Gi are then passed to the interpretation module, where one of the available interpretation methods can be applied to gene… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

38 extracted references · 26 canonical work pages

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    A comprehensive survey on trustworthy graph neural networks: Privacy, robustness, fairness, and explainability

    Dai, E., Zhao, T., Zhu, H., Xu, J., Guo, Z., Liu, H., Tang, J., and Wang, S. A comprehensive survey on trustworthy graph neural networks: Privacy, robustness, fairness, and explainability. Mach. Intell. Res., 21: 0 1011--1061, 2022. URL https://api.semanticscholar.org/CorpusID:248239981

    work page 2022

  3. [3]

    Explanations can be manipulated and geometry is to blame

    Dombrowski, A.-K., Alber, M., Anders, C., Ackermann, M., M \"u ller, K.-R., and Kessel, P. Explanations can be manipulated and geometry is to blame. Advances in neural information processing systems, 32, 2019

    work page 2019

  4. [4]

    and Kim, B

    Doshi-Velez, F. and Kim, B. Towards a rigorous science of interpretable machine learning. arXiv preprint arXiv:1702.08608, 2017

    arXiv 2017

  5. [5]

    and Lenssen, J

    Fey, M. and Lenssen, J. E. Fast graph representation learning with pytorch geometric. ArXiv, abs/1903.02428, 2019. URL https://api.semanticscholar.org/CorpusID:70349949

    arXiv 1903

  6. [6]

    and Oberman, A

    Finlay, C. and Oberman, A. M. Scaleable input gradient regularization for adversarial robustness. Machine Learning with Applications, 3: 0 100017, 2021

    work page 2021

  7. [7]

    Hard masking for explaining graph neural networks

    Funke, T., Khosla, M., and Anand, A. Hard masking for explaining graph neural networks. 2020

    work page 2020

  8. [8]

    J., Shlens, J., and Szegedy, C

    Goodfellow, I. J., Shlens, J., and Szegedy, C. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014

    arXiv 2014

Show all 38 references
  1. [9]

    A survey of methods for explaining black box models

    Guidotti, R., Monreale, A., Ruggieri, S., Turini, F., Giannotti, F., and Pedreschi, D. A survey of methods for explaining black box models. ACM Computing Surveys (CSUR), 51 0 (5): 0 1--42, 2018

    2018

  2. [10]

    Countering adversarial images using input transformations

    Guo, C., Rana, M., Cisse, M., and Van Der Maaten, L. Countering adversarial images using input transformations. arXiv preprint arXiv:1711.00117, 2017

    2017 arXiv

  3. [11]

    C., and Li'o, P

    Han, X., Barbiero, P., Georgiev, D., Magister, L. C., and Li'o, P. Global concept-based interpretability for graph neural networks via neuron analysis. In AAAI Conference on Artificial Intelligence, 2022. URL https://api.semanticscholar.org/CorpusID:251741343

    2022

  4. [12]

    Lipton, Z. C. The mythos of model interpretability: In machine learning, the concept of interpretability is both important and slippery. In Queue, volume 16, pp.\ 31--57, 2018

    2018

  5. [13]

    Interpretability in graph neural networks

    Liu, N., Feng, Q., and Hu, X. Interpretability in graph neural networks. Graph neural networks: foundations, frontiers, and applications, pp.\ 121--147, 2022

    2022

  6. [14]

    Cf-gnnexplainer: Counterfactual explanations for graph neural networks

    Lucic, A., ter Hoeve, M., Tolomei, G., de Rijke, M., and Silvestri, F. Cf-gnnexplainer: Counterfactual explanations for graph neural networks. In International Conference on Artificial Intelligence and Statistics, 2021. URL https://api.semanticscholar.org/CorpusID:231839528

    2021

  7. [15]

    Towards deep learning models resistant to adversarial attacks

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  8. [16]

    Image-based recommendations on styles and substitutes

    McAuley, J., Targett, C., Shi, Q., and Van Den Hengel, A. Image-based recommendations on styles and substitutes. In Proceedings of the 38th international ACM SIGIR conference on research and development in information retrieval, pp.\ 43--52, 2015

    2015

  9. [17]

    and Chen, H

    Meng, D. and Chen, H. Magnet: a two-pronged defense against adversarial examples. In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, pp.\ 135--147, 2017

    2017

  10. [18]

    Explanation in artificial intelligence: Insights from the social sciences

    Miller, T. Explanation in artificial intelligence: Insights from the social sciences. Artificial Intelligence, 267: 0 1--38, 2019

    2019

  11. [19]

    Connecting interpretability and robustness in decision trees through separation

    Moshkovitz, M., Yang, Y.-Y., and Chaudhuri, K. Connecting interpretability and robustness in decision trees through separation. ArXiv, abs/2102.07048, 2021. URL https://api.semanticscholar.org/CorpusID:231924539

    2021 arXiv

  12. [20]

    E., Nejdl, W., and Khosla, M

    Olatunji, I. E., Nejdl, W., and Khosla, M. Membership inference attack on graph neural networks. 2021 Third IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA), pp.\ 11--20, 2021. URL https://api.semanticscholar.org/Co...

    2021

  13. [21]

    K., and Ganapathy, V

    Pal, S., Gupta, Y., Shukla, A., Kanade, A., Shevade, S. K., and Ganapathy, V. Activethief: Model extraction using active learning and unannotated public data. In AAAI Conference on Artificial Intelligence, 2020. URL https://api.semanticscholar.org/CorpusID:213157375

    2020

  14. [22]

    Distillation as a defense to adversarial perturbations against deep neural networks

    Papernot, N., McDaniel, P., Wu, X., Jha, S., and Swami, A. Distillation as a defense to adversarial perturbations against deep neural networks. In 2016 IEEE symposium on security and privacy (SP), pp.\ 582--597. IEEE, 2016

    2016

  15. [23]

    why should i trust you?

    Ribeiro, M. T., Singh, S., and Guestrin, C. “why should i trust you?”: Explaining the predictions of any classifier. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), pp.\ 1135--1144, 2016

    2016

  16. [24]

    S., De Cao, N., and Titov, I

    Schlichtkrull, M. S., De Cao, N., and Titov, I. Interpreting graph neural networks for nlp with differentiable edge masking. arXiv preprint arXiv:2010.00577, 2020

    2010 arXiv

  17. [25]

    Collective classification in network data

    Sen, P., Namata, G., Bilgic, M., Getoor, L., Galligher, B., and Eliassi-Rad, T. Collective classification in network data. AI magazine, 29 0 (3): 0 93--93, 2008

    2008

  18. [26]

    A study of graph neural networks for link prediction on vulnerability to membership attacks

    Shaikhelislamov, D., Lukyanov, K., Severin, N., Drobyshevskiy, M., Makarov, I., and Turdakov, D. A study of graph neural networks for link prediction on vulnerability to membership attacks. Journal of Mathematical Sciences, pp.\ 1--11, 2024

    2024

  19. [27]

    and Asokan, N

    Szyller, S. and Asokan, N. Conflicting interactions among protection mechanisms for machine learning models. In AAAI Conference on Artificial Intelligence, 2022. URL https://api.semanticscholar.org/CorpusID:250279708

    2022

  20. [28]

    E., Dickerson, J

    Verma, S., Boonsanong, V., Hoang, M., Hines, K. E., Dickerson, J. P., and Shah, C. Counterfactual explanations and algorithmic recourses for machine learning: A review. ACM Comput. Surv., 56: 0 312:1--312:42, 2020. URL https://api.semanticscholar.org/CorpusID:253510293

    2020

  21. [29]

    Adversarial examples on graph data: Deep insights into attack and defense

    Wu, H., Wang, C., Tyshetskiy, Y., Docherty, A., Lu, K., and Zhu, L. Adversarial examples on graph data: Deep insights into attack and defense. arXiv preprint arXiv:1903.01610, 2019

    1903 arXiv

  22. [30]

    Gnnexplainer: Generating explanations for graph neural networks

    Ying, Z., Bourgeois, D., You, J., Zitnik, M., and Leskovec, J. Gnnexplainer: Generating explanations for graph neural networks. Advances in neural information processing systems, 32, 2019

    2019

  23. [31]

    On explainability of graph neural networks via subgraph explorations

    Yuan, H., Yu, H., Wang, J., Li, K., and Ji, S. On explainability of graph neural networks via subgraph explorations. In International Conference on Machine Learning, pp.\ 12241--12252. PMLR, 2021

    2021

  24. [32]

    Unsupervised graph poisoning attack via contrastive loss back-propagation

    Zhang, S., Chen, H., Sun, X., Li, Y., and Xu, G. Unsupervised graph poisoning attack via contrastive loss back-propagation. Proceedings of the ACM Web Conference 2022, 2022 a . URL https://api.semanticscholar.org/CorpusID:246064056

    2022

  25. [33]

    and Zitnik, M

    Zhang, X. and Zitnik, M. Gnnguard: Defending graph neural networks against adversarial attacks. Advances in neural information processing systems, 33: 0 9263--9275, 2020

    2020

  26. [34]

    Protgnn: Towards self-explaining graph neural networks

    Zhang, Z., Liu, Q., Wang, H., Lu, C., and Lee, C. Protgnn: Towards self-explaining graph neural networks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pp.\ 9127--9135, 2022 b

    2022

  27. [35]

    Motif-backdoor: Rethinking the backdoor attack on graph neural networks via motifs

    Zheng, H., Xiong, H., Chen, J., Ma, H.-S., and Huang, G. Motif-backdoor: Rethinking the backdoor attack on graph neural networks via motifs. IEEE Transactions on Computational Social Systems, 11: 0 2479--2493, 2022. URL https://api.semanticscholar.org/CorpusID:253107750

    2022

  28. [36]

    Graph neural networks: A review of methods and applications

    Zhou, J., Cui, G., Hu, S., Zhang, Z., Yang, C., Liu, Z., Wang, L., Li, C., and Sun, M. Graph neural networks: A review of methods and applications. AI open, 1: 0 57--81, 2020

    2020

  29. [37]

    Robust graph convolutional networks against adversarial attacks

    Zhu, D., Zhang, Z., Cui, P., and Zhu, W. Robust graph convolutional networks against adversarial attacks. In Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining, pp.\ 1399--1407, 2019

    2019

  30. [38]

    u gner, D., Akbarnejad, A., and G \

    Z \"u gner, D., Akbarnejad, A., and G \"u nnemann, S. Adversarial attacks on neural networks for graph data. Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 2018. URL https://api.semanticscholar.org/CorpusID:29169801

    2018

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.