Pith. sign in

REVIEW 4 major objections 5 minor 50 references

EdgeRefine: Privacy-Utility Balance for Graphs via Jaccard Sampling under Edge Differential Privacy

T0 review · 4 major / 5 minor · reviewed 2026-08-02 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read EdgeRefine denoises randomized-response graphs by ranking edges with Jaccard similarity and sampling a fixed quota from observed and non-observed edges, reporting near-noise-free GNN accuracy under edge differential privacy.

desk verdict EdgeRefine has a genuinely new sampling idea, but as written the server uses the original graph to denoise — that collapses the edge-DP claim. read the letter →

arxiv 2607.08659 v2 pith:JNMN7IZB submitted 2026-07-09 cs.LG

Wenxiu Ding , Muzhi Liu , Zheng Yan , Mingjun Wang , Yifan Zhao , Qiao Liu This is my paper · ORCID
classification cs.LG
keywords privacygraphedgerefineunderedgeaccuracydifferentialedges
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The idea is to hide individual links in a social or citation graph while still allowing a graph neural network to learn useful patterns. The client applies randomized response: for each possible edge, if the edge is real it is kept with probability p = e^epsilon/(1+e^epsilon), and if it is not real it is turned into a fake edge with probability q = 1 - p. This makes the noisy graph epsilon-edge differentially private: an attacker cannot tell whether any single edge was originally present. The server receives this noisy graph, computes a Jaccard similarity score for every pair of nodes, and groups these scores into bins. Within each bin, it counts the fraction of pairs that are edges in the noisy graph, treating that fraction as the probability that an edge exists. It then selects K = k * E edges, where E is the original edge count, taking a fraction rho = e^epsilon/(1+e^epsilon) from edges present in the noisy graph and the rest from non-edges, always choosing the highest-probability candidates first. The paper tests this on ACM, DBLP, AMAP, and Cora with GCN, GAT, and GIN, reporting accuracy within a few percent of the non-private baseline and strong resistance to a graph-reconstruction attack. However, the printed algorithms appear to require the server to know the original edge count E and, in one algorithm, the true edge indicators, which would break the privacy guarantee if taken literally.
Extended reading notes

Core claim

The load-bearing assertion is that EdgeRefine achieves utility comparable to the noise-free baseline while providing formal end-to-end epsilon-edge differential privacy: 'We utilize the privacy budget to calculate the theoretical true edge ratio rho=e^epsilon/(1+e^epsilon), thereby enabling us to filter out true edges and recover erroneously deleted edges respectively' (Section 5.3.2), and the paper reports accuracy close to the noise-free baseline across datasets. If the paper is correct, a server can denoise a randomized-response adjacency matrix into a sparse graph that supports GNN training with near-baseline accuracy without violating epsilon-edge DP.

Load-bearing premise

The server can compute the denoised graph purely as a function of the privatized noisy adjacency matrix A~, without access to any private statistic such as the original edge count E or true edge indicators. Algorithm 1 line 7 sets K = floor(k * (1/2 sum A_ij)) and Algorithm 4 explicitly requires 'Original edge count E'; Algorithm 3 computes bin probabilities P_b = sum(edges)/count(pairs) where the edge indicator is taken from A. If the server actually needs A or E, the stated edge-DP guarantee collapses; if these are notation errors, the paper nowhere provides a private estimator for E.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes EdgeRefine, a client-server framework for graph learning under edge-level differential privacy. The client applies randomized response to the adjacency matrix and sends the noisy matrix A~ to the server; the server then denoises A~ via Jaccard-similarity-based probability estimation, quantile binning, and a deterministic sampling step, producing a sparse graph for downstream GNN training. The paper claims that this pipeline provides formal epsilon-edge DP end-to-end while achieving accuracy close to the noise-free baseline and outperforming prior privacy-preserving methods. The evaluation includes node classification on four datasets, graph classification on MUTAG, stability metrics, sparsity and training-time analyses, ablation studies, and a graph-reconstruction attack evaluation.

Significance. If the central claim were correct, EdgeRefine would be a significant step toward practical privacy-preserving GNN training: it would show that a server can denoise a locally randomized graph into a sparse, usable structure without consuming additional privacy budget. The paper also ships a public repository, extensive experimental comparisons, and detailed stability/ablation analyses, which are commendable. However, the central privacy-utility claim is not supported by the manuscript as written: the server-side algorithms require the original adjacency matrix A and the original edge count E, so the end-to-end epsilon-edge-DP guarantee collapses. This is not a minor presentational flaw but a fundamental inconsistency in the system model, and the reported near-baseline accuracy may be an artifact of the server using ground-truth information during denoising.

major comments (4)
  1. [Section 5.1, Algorithm 1 line 7; Algorithm 3; Algorithm 4] The server-side pipeline is not a function of the private output A~ alone. Algorithm 1 line 7 sets K = floor(k * (1/2 sum A_ij)) using the original adjacency matrix A; Algorithm 3 takes 'Adjacency matrix A' as input and computes P_b = sum(edges)/count(pairs) from true edge indicators (lines 18-21); Algorithm 4 requires 'Original edge count E' as input and partitions candidates using A_ij (lines 8-9). The system model (Algorithm 1 line 3) says the client sends only A~. If the server literally receives A or E, it obtains private edge information and the epsilon-edge-DP guarantee of Eq. (1) is violated. If these are notation errors and A~ is intended, the paper provides no differentially private estimator for E or for the bin-specific true edge counts. The post-processing argument in Appendix A does not apply, because post-processing preserves DP only when it depends solely on the DP output
  2. [Algorithm 3, lines 16-21] The probability calibration step uses the true edge indicators A_ij to compute P_b = sum(edges)/count(pairs). This makes the estimated probabilities supervised by the ground-truth graph, so the selection of top edges is circular: the method is effectively told which edges are real during calibration. A server in the stated threat model cannot compute these probabilities from A~ alone. If the authors intended to use A~ in place of A, they would be estimating the frequency of noisy edges, not calibrated probabilities of true edge existence, and no justification is given for that substitution. Thus the empirical results are not valid evidence for a privacy-preserving denoising pipeline.
  3. [Section 5.3.2, Eq. (5), Algorithm 4] The quantity rho = e^epsilon/(1+e^epsilon) is the randomized-response retention probability of a true edge, not the 'theoretical true edge ratio.' Equation (5) shows that the expected ratio of real to fake edges in the noisy matrix A~ is p*Lambda/(q*M), which depends on graph sparsity through Lambda/M. Setting K_real = floor(rho*K) and K_fake = K - K_real is therefore not a derived optimal allocation; the paper gives no objective or theorem under which this quota is optimal. The claim that this 'enables us to filter out true edges and recover erroneously deleted edges' is unsupported and, as stated, does not follow from the DP mechanism.
  4. [Appendix A] The theoretical analysis is not rigorous enough to support the paper's formal claims. The bounds such as E[(p_hat_b - p_b)^2] = O(1/n_b + 1/B^2) and E[|p_b - p_hat_b|] <= sqrt(log B / (2n)) are asserted without proofs, without stated regularity conditions, and without accounting for the fact that n_b varies per bin. The SNR monotonicity claim for decreasing k is also asserted without derivation. Most importantly, the closing 'post-processing properties of DP' argument is invalid for the reasons given above, because the denoising function depends on the secret A/E. These are load-bearing gaps: the paper promises 'rigorous theoretical analysis' but provides only heuristic statements.
minor comments (5)
  1. [Figure 2] Algorithm numbering is inconsistent between the figure and the text. Figure 2 labels 'Algorithm 3: Deterministic Optimal Sampling' and 'Algorithm 2: Similarity Binning and Probability Calibration,' whereas the text and pseudocode use Algorithm 3 for Similarity Binning and Algorithm 4 for Deterministic Optimal Sampling.
  2. [Eq. (9)] The Relative Absolute Error definition uses A_hat to denote the reconstructed matrix, but A_hat elsewhere denotes the denoised adjacency matrix output by EdgeRefine. Please clarify whose reconstruction is being evaluated (e.g., the GRAND attack's output vs. the released graph).
  3. [Section 6.2.2, Table 5] The table is titled 'Normalized Density' but the normalization procedure is not defined. Please specify the exact density measure and why it is normalized.
  4. [Section 6.2.1, Table 3] It would help to state explicitly that the variance and CV are computed across the privacy-budget values rather than across repeated runs, since the text also reports run-to-run standard deviations in Appendix C.1.
  5. [Section 5.3.2, Algorithm 4 lines 8-9] The pseudocode partitions candidates using A_ij, while the surrounding text says the partition is based on the observed noisy adjacency matrix A~. This internal inconsistency is central; if A is indeed intended, the privacy violation is direct. Please resolve the notation unambiguously.

Circularity Check

3 steps flagged · score 8.0 of 10

Denoising is defined from secret A: Algorithm 3 fits P_b to true edge labels and Algorithm 4 partitions candidates by A_ij, so the 'recovered' graph is forced by the labels it claims to predict.

  1. self definitional [Algorithm 3 (Similarity Binning and Probability Calibration), Phase 3, lines 15–21; Section 5.3.1]
    "Algorithm 3 Require: 'Adjacency matrix A∈{0,1}^{N×N}'; Phase 3: 'Accumulate edge indicator in bin statistics', 'foreach bin b=1 to B do Compute P_b = sum(edges)/count(pairs)'; text: 'the probability P_b is estimated non-parametrically as the ratio of actually existing edges (A_ij = 1) to the total number of node pairs assigned to that bin.'"

    The calibrated probability L_ij that is later used to rank and select edges is computed by counting the true edge indicators A_ij in each Jaccard bin. Thus the 'estimator' is fitted to the exact labels the denoising is supposed to recover. Every subsequent decision that uses L is a function of A; the utility of the final graph is not an independent prediction but a re-statement of the input adjacency matrix (plus binning smoothness).

  2. self definitional [Algorithm 4 (Deterministic Optimal Sampling), lines 8–9]
    "E_real←{(i,j,L_ij)|A_ij = 1,i<j}; E_fake←{(i,j,L_ij)|A_ij = 0,i<j}"

    The 'real' and 'fake' candidate sets are partitioned using the true adjacency A, not the privatized A~. Since the algorithm then selects the top-K real edges from E_real, every selected 'real' edge is by construction a true edge of A. The denoised output is forced by the ground-truth labels; the claimed recovery of erroneously deleted edges is definitionally circular. The prose in Section 5.3.2 says the partition uses A~, but the pseudocode and the algorithm header require A, and no private estimator for these indicators is provided.

1 more flagged steps
  1. other [Algorithm 1 line 7; Algorithm 4 lines 3 and 5]
    "Algorithm 1 line 7: 'K←⌊k·(1/2 Σ A_ij)⌋'; Algorithm 4 Require: 'Original edge count E' and line 5: 'K←⌊k×E⌋'"

    The target number of edges in the denoised graph is defined from the original edge count E (or directly from A in Algorithm 1). Thus the sparsity of the output is calibrated to a private statistic of A. Even if the candidate partition were fixed to use A~, the server would need E to set K; no differentially private estimator of E is given. The output is therefore not a post-processing function of A~ alone, contradicting the paper's DP argument, and the claimed 'prediction' of graph sparsity is forced by the secret input.

full rationale

Claimed end-to-end ε-edge-DP holds only if the server's refinement depends solely on the privatized A~. The paper's own algorithms violate this. In Algorithm 3 the calibrated probability for each bin is the empirical frequency of true edges within that bin (P_b = sum(edges)/count(pairs)), where the edge indicators are accumulated from the true adjacency matrix A supplied as input. In Algorithm 4 the real/fake candidate partition is literally defined by A_ij = 1 vs A_ij = 0. The deterministic sampler then keeps the top-⌊ρK⌋ such 'real' edges; thus every retained real edge is a true edge of A by construction, and the denoised graph is a function of the secret A. The prose description in Section 5.3.2 says the partition is based on A~, but no private estimator of the bin counts or of E is given, and Algorithm 1 line 7 / Algorithm 4 line 5 require the original edge count E to set K. On the literal reading, the 'prediction' is not a prediction: it reduces to selecting a subset of the ground-truth edge set using the ground-truth edge set. Under the alternative reading, the method as specified cannot be executed by the server without additional private inputs. Either way the central privacy-utility claim is not supported; the impressive utility numbers are forced by construction, not earned by denoising.

Assumptions & free parameters 2 free parameters · 6 assumptions · 0 invented entities

EdgeRefine introduces no new physical or mathematical entities. The free parameters are the sampling rate k (hand-set to 0.01) and the histogram bin count B (unspecified). The axiomatic load is carried by the standard DP post-processing property and, problematically, by the assumption that the server may use ground-truth edge count and true edge indicators in the denoising algorithms.

free parameters (2)
  • sampling rate k = 0.01 (fixed in main experiments; Table 7 explores 0.005-0.5)
    Hand-set global sampling rate controlling the target edge count K = floor(k*E). The parameter analysis shows the optimal k varies by dataset and architecture (0.01-0.1), so headline results depend on this choice.
  • number of histogram bins B = not specified
    Algorithm 3 takes B as an input, but the paper never gives a default, a selection rule, or a sensitivity analysis for B, even though bin resolution drives the probability calibration.
assumptions (6)
  • standard math Randomized response with p=e^epsilon/(1+e^epsilon) and q=1/(1+e^epsilon) applied independently to each edge satisfies epsilon-edge differential privacy.
    Used in Algorithm 2; this is the standard randomized-response mechanism for binary data.
  • standard math Post-processing of an epsilon-DP output preserves epsilon-DP.
    Invoked in Appendix A to argue that denoising the noisy adjacency matrix does not weaken privacy; a standard DP property.
  • ad hoc to paper The server can use the original edge count E and true edge indicators A_ij in the denoising algorithms.
    Algorithm 1 line 7 and Algorithm 4's required input 'Original edge count E', plus Algorithm 3's P_b = sum(edges)/count(pairs), assume access to private ground-truth information that the client-server model denies; if literal, this breaks epsilon-edge DP.
  • ad hoc to paper rho = e^epsilon/(1+e^epsilon) is the 'theoretical true edge ratio' that optimally balances selected real and fake edges.
    Section 5.3.2 asserts this without derivation. rho is the RR retention probability p, not the posterior probability of a true edge given the noisy observation; treating it as an optimal ratio is an unproved modeling choice.
  • ad hoc to paper Histogram binning estimates satisfy MSE O(1/n_b + 1/B^2) and calibration error O(sqrt(log B / 2n)).
    Appendix A states these bounds without proof; they are not standard background results and are used to argue the probability estimation is reliable.
  • domain assumption The Jaccard coefficient computed on the noisy graph remains informative about true edges, with |delta J| <= 1/|N(i) union N(j)|.
    Used throughout Section 5.3.1 and Appendix A to justify Jaccard-based probability estimation from noisy data; the bound is stated informally and no complete proof is given.

how reviews work

0 comments
Cite this review

Pith. "Pith review of EdgeRefine: Privacy-Utility Balance for Graphs via Jaccard Sampling under Edge Differential Privacy." pith.science (2026). https://pith.science/paper/JNMN7IZB

@misc{pith2026260708659,
  author       = {Pith},
  title        = {Pith review of: EdgeRefine: Privacy-Utility Balance for Graphs via Jaccard Sampling under Edge Differential Privacy},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JNMN7IZB}},
  note         = {Machine review of arXiv:2607.08659}
}
abstract

Graph Neural Networks (GNNs) have shown considerable success in learning from graph-structured data, but their use in privacy-sensitive areas remains difficult because graph structure can leak sensitive link information. To satisfy edge-level differential privacy, a common approach is to inject noise into all elements of the graph's adjacency matrix, thereby obfuscating the existence of any single edge. However, stronger privacy requires more noise, and excessive noise reduces utility, making the privacy-utility balance a major barrier to practical privacy-preserving graph learning. To address this issue, we propose EdgeRefine, a local differential privacy framework that improves this trade-off through adaptive edge refinement. EdgeRefine first estimates edge-existence probabilities using Jaccard similarity and ranks edges for noisy edge removal. To ensure the sparsity and reliability of the final graph, it uses the privacy budget $\epsilon$ to determine the ratio of true to false edges, samples them separately based on this probability ranking, and controls the total number of edges with a separate sampling rate $k$. Extensive experiments show that EdgeRefine achieves accuracy comparable to the noise-free baseline and substantially outperforms other privacy-preserving methods across datasets and GNN architectures. Under privacy budget $\epsilon = 2.5$, EdgeRefine improves node classification accuracy over state-of-the-art baselines by 17.8\% on ACM under GAT and 19.7\% on Cora under GCN. In graph classification, it achieves an average accuracy degradation of around 5\% compared to the noise-free baseline. Under graph reconstruction attacks, EdgeRefine maintains relative absolute error levels above 1 across all privacy budgets, averaging 1.962 on Cora and 1.472 on AMAP, indicating strong resilience against privacy leakage.

Figures

Figures reproduced from arXiv: 2607.08659 by the authors.

Figure 1
Figure 1. System Model 5 EdgeRefine To achieve an optimal balance between privacy and utility in edge￾level differentially private graph training, we propose EdgeRefine . The core innovation involves the server estimating edge existence probabilities in the true graph by computing Jaccard similarity coefficients from the noisy data, followed by an intelligent sampling strategy that selectively retains trustworthy edges. The s… view at source ↗
Figure 2
Figure 2. In general, the server estimates the probability based on [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Performance Comparison of EdgeRefine and Baseline Methods [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Performance of Probability Estimation Error [PITH_FULL_IMAGE:figures/full_fig_p012_4.png]
Figure 5
Figure 5. Figure 5: Ablation Study The DBLP dataset results demonstrate the performance advan￾tages of our framework. EdgeRefine maintains accuracy around 0.8 across the privacy budget spectrum. In contrast, the accuracy of the ablated version remains around 0.3 for privacy budgets with 𝜖…
Figure 6
Figure 6. Figure 6: Baseline Density and Accuracy To complement the visualization above, we further quantified the correlation between density and accuracy across different schemes, as reported in [PITH_FULL_IMAGE:figures/full_fig_p018_6.png]

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

50 extracted references · 5 linked inside Pith

  1. [1]

    Acm digital library, 2024

    Association for Computing Machinery. Acm digital library, 2024

    2024

  2. [2]

    Grand: Graph reconstruction from potential partial adjacency and neighborhood data

    Sofiane Azogagh, Zelma Aubin Birba, Josée Desharnais, Sébastien Gambs, Marc- Olivier Killijian, and Nadia Tawbi. Grand: Graph reconstruction from potential partial adjacency and neighborhood data. InProceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 2, pages 47–58, 2025

    2025

  3. [3]

    A text and gnn based controversy detection method on social media

    Samy Benslimane, Jérôme Azé, Sandra Bringay, Maximilien Servajean, and Caro- line Mollevi. A text and gnn based controversy detection method on social media. World Wide Web, 26(2):799–825, 2023

    2023

  4. [4]

    Bias assessment approaches for addressing user-centered fairness in gnn-based recommender systems.Information, 14(2):131, 2023

    Nikzad Chizari, Keywan Tajfar, and María N Moreno-García. Bias assessment approaches for addressing user-centered fairness in gnn-based recommender systems.Information, 14(2):131, 2023

    2023

  5. [5]

    Dblp computer science bibliography, 2024

    DBLP Team. Dblp computer science bibliography, 2024

    2024

  6. [6]

    Structure-activity relationship of mutagenic aromatic and heteroaromatic nitro compounds

    Asim Kumar Debnath, Rosa L Lopez de Compadre, Gargi Debnath, Alan J Shuster- man, and Corwin Hansch. Structure-activity relationship of mutagenic aromatic and heteroaromatic nitro compounds. correlation with molecular orbital energies and hydrophobicity.Journal of medicinal chemistry, 34(2):786–797, 1991

    1991

  7. [7]

    Convolutional neural networks on graphs with fast localized spectral filtering

    Michaël Defferrard, Xavier Bresson, and Pierre Vandergheynst. Convolutional neural networks on graphs with fast localized spectral filtering. InProceedings of the 30th International Conference on Neural Information Processing Systems, NIPS’16, page 3844–3852, Red Hook, NY, USA, 2016. Curran Associates Inc

    2016

  8. [8]

    A gnn- based recommender system to assist the specification of metamodels and models

    Juri Di Rocco, Claudio Di Sipio, Davide Di Ruscio, and Phuong T Nguyen. A gnn- based recommender system to assist the specification of metamodels and models. In2021 ACM/IEEE 24th International Conference on Model Driven Engineering Languages and Systems (MODELS), pages 70–81. IEEE, 2021

    2021

Show all 50 references
  1. [9]

    Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam D. Smith. Calibrating noise to sensitivity in private data analysis.J. Priv. Confidentiality, 7:17–51, 2006

    2006

  2. [10]

    Rappor: Randomized aggregatable privacy-preserving ordinal response

    Úlfar Erlingsson, Vasyl Pihur, and Aleksandra Korolova. Rappor: Randomized aggregatable privacy-preserving ordinal response. InProceedings of the 2014 ACM SIGSAC conference on computer and communications security, pages 1054–1067, 2014

    2014

  3. [11]

    Pyg 2.0: Scalable learning on real world graphs

    Matthias Fey, Jinu Sunil, Akihiro Nitta, Rishi Puri, Manan Shah, Blaž Stojanovič, Ramona Bendias, Alexandria Barghi, Vid Kocijan, Zecheng Zhang, Xinwei He, EdgeRefine: Privacy-Utility Balance for Graphs via Jaccard Sampling under Edge Differential Privacy Conference’17, July 2...

    2017

  4. [12]

    Graph neural networks: a survey on the links between privacy and security

    Faqian Guan, Tianqing Zhu, Wanlei Zhou, and Kim-Kwang Raymond Choo. Graph neural networks: a survey on the links between privacy and security. Artificial Intelligence Review, 57(2):40, 2024

    2024

  5. [13]

    A deep graph neural network-based mechanism for social recommendations.IEEE Transactions on Industrial Informatics, 17(4):2776– 2783, 2020

    Zhiwei Guo and Heng Wang. A deep graph neural network-based mechanism for social recommendations.IEEE Transactions on Industrial Informatics, 17(4):2776– 2783, 2020

    2020

  6. [14]

    Hagberg, Daniel A

    Aric A. Hagberg, Daniel A. Schult, and Pieter J. Swart. Exploring network structure, dynamics, and function using networkx. In Gaël Varoquaux, Travis Vaught, and Jarrod Millman, editors,Proceedings of the 7th Python in Science Conference, pages 11 – 15, Pasadena, CA USA, 2008

    2008

  7. [15]

    Harris, K

    Charles R. Harris, K. Jarrod Millman, Stéfan J. van der Walt, Ralf Gommers, Pauli Virtanen, David Cournapeau, Eric Wieser, Julian Taylor, Sebastian Berg, Nathaniel J. Smith, Robert Kern, Matti Picus, Stephan Hoyer, Marten H. van Kerkwijk, Matthew Brett, Allan Haldane, Jaime Fe...

    2020

  8. [16]

    Accurate estimation of the degree distribution of private networks

    Michael Hay, Chao Li, Gerome Miklau, and David Jensen. Accurate estimation of the degree distribution of private networks. InProceedings of the 2009 Ninth IEEE International Conference on Data Mining, ICDM ’09, page 169–178, USA, 2009. IEEE Computer Society

    2009

  9. [17]

    Degree-preserving randomized response for graph neural networks under local differential privacy.ArXiv, abs/2202.10209, 2022

    Seira Hidano and Takao Murakami. Degree-preserving randomized response for graph neural networks under local differential privacy.ArXiv, abs/2202.10209, 2022

    2022 arXiv

  10. [18]

    The distribution of the flora in the alpine zone

    Paul Jaccard. The distribution of the flora in the alpine zone. 1.New phytologist, 11(2):37–50, 1912

    1912

  11. [19]

    Semi-supervised learning with graph learning-convolutional networks

    Bo Jiang, Ziyan Zhang, Doudou Lin, Jin Tang, and Bin Luo. Semi-supervised learning with graph learning-convolutional networks. In2019 IEEE/CVF Con- ference on Computer Vision and Pattern Recognition (CVPR), pages 11305–11312, 2019

    2019

  12. [20]

    Gnn-suite: a graph neural network benchmarking framework for biomedical informatics

    Sebestyén Kamp, Giovanni Stracquadanio, and T Ian Simpson. Gnn-suite: a graph neural network benchmarking framework for biomedical informatics. arXiv preprint arXiv:2505.10711, 2025

    2025 arXiv

  13. [21]

    Eflec: Efficient feature-leakage correction in gnn based recommendation systems

    Ishaan Kumar, Yaochen Hu, and Yingxue Zhang. Eflec: Efficient feature-leakage correction in gnn based recommendation systems. InProceedings of the 45th International ACM SIGIR conference on research and development in information retrieval, pages 1885–1889, 2022

    2022

  14. [22]

    Graph-based privacy-preserving data publication

    Xiang-Yang Li, Chunhong Zhang, Taeho Jung, Jianwei Qian, and Linlin Chen. Graph-based privacy-preserving data publication. InIEEE INFOCOM 2016 - The 35th Annual IEEE International Conference on Computer Communications, pages 1–9, 2016

    2016

  15. [23]

    Private graph data release: A survey.ACM Computing Surveys, 55(11):1–39, 2023

    Yang Li, Michael Purcell, Thierry Rakotoarivelo, David Smith, Thilina Ranbaduge, and Kee Siong Ng. Private graph data release: A survey.ACM Computing Surveys, 55(11):1–39, 2023

    2023

  16. [24]

    The link prediction problem for social networks

    David Liben-Nowell and Jon Kleinberg. The link prediction problem for social networks. InProceedings of the twelfth international conference on Information and knowledge management, pages 556–559, 2003

    2003

  17. [25]

    Towards private learning on decen- tralized graphs with local differential privacy.IEEE Transactions on Information Forensics and Security, 17:2936–2946, 2022

    Wanyu Lin, Baochun Li, and Cong Wang. Towards private learning on decen- tralized graphs with local differential privacy.IEEE Transactions on Information Forensics and Security, 17:2936–2946, 2022

    2022

  18. [26]

    Muse-gnn: Learning unified gene representation from multimodal biological graph data.Advances in neural information processing systems, 36:24661–24677, 2023

    Tianyu Liu, Yuge Wang, Rex Ying, and Hongyu Zhao. Muse-gnn: Learning unified gene representation from multimodal biological graph data.Advances in neural information processing systems, 36:24661–24677, 2023

    2023

  19. [27]

    Cora dataset, 2016

    Andrew McCallum. Cora dataset, 2016. Originally prepared by Andrew McCallum. Hosted at University of Massachusetts Amherst and various other repositories

    2016

  20. [28]

    Sgnn: A graph neural network based federated learning approach by hiding structure

    Guangxu Mei, Ziyu Guo, Shijun Liu, and Li Pan. Sgnn: A graph neural network based federated learning approach by hiding structure. In2019 IEEE International Conference on Big Data (Big Data), pages 2560–2568, 2019

    2019

  21. [29]

    Sok: Differential privacy on graph-structured data.arXiv preprint arXiv:2203.09205, 2022

    Tamara T Mueller, Dmitrii Usynin, Johannes C Paetzold, Daniel Rueckert, and Georgios Kaissis. Sok: Differential privacy on graph-structured data.arXiv preprint arXiv:2203.09205, 2022

    2022 arXiv

  22. [30]

    Automatic differentiation in pytorch

    Adam Paszke, Sam Gross, Soumith Chintala, Gregory Chanan, Edward Yang, Zachary DeVito, Zeming Lin, Alban Desmaison, Luca Antiga, and Adam Lerer. Automatic differentiation in pytorch. 2017

    2017

  23. [31]

    Pedregosa, G

    F. Pedregosa, G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel, M. Blon- del, P. Prettenhofer, R. Weiss, V. Dubourg, J. Vanderplas, A. Passos, D. Courna- peau, M. Brucher, M. Perrot, and E. Duchesnay. Scikit-learn: Machine learning in Python.Journal of Machine Learn...

    2011

  24. [32]

    Generating synthetic decentralized social graphs with local differential privacy

    Zhan Qin, Ting Yu, Yin Yang, Issa Khalil, Xiaokui Xiao, and Kui Ren. Generating synthetic decentralized social graphs with local differential privacy. InProceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS ’17, page 425–438, New York, NY, ...

    2017

  25. [33]

    Deeprank- gnn: a graph neural network framework to learn patterns in protein–protein interfaces.Bioinformatics, 39(1):btac759, 2023

    Manon Réau, Nicolas Renaud, Li C Xue, and Alexandre MJJ Bonvin. Deeprank- gnn: a graph neural network framework to learn patterns in protein–protein interfaces.Bioinformatics, 39(1):btac759, 2023

    2023

  26. [34]

    Pitfalls of graph neural network evaluation.ArXiv, abs/1811.05868, 2018

    Oleksandr Shchur, Maximilian Mumme, Aleksandar Bojchevski, and Stephan Günnemann. Pitfalls of graph neural network evaluation.ArXiv, abs/1811.05868, 2018

    2018 arXiv

  27. [35]

    Graph attention networks

    Petar Velickovic, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Liò, and Yoshua Bengio. Graph attention networks. In6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings. Op...

    2018

  28. [36]

    Oliphant, Matt Haberland, Tyler Reddy, David Cournapeau, Evgeni Burovski, Pearu Peterson, Warren Weckesser, Jonathan Bright, Stéfan J

    Pauli Virtanen, Ralf Gommers, Travis E. Oliphant, Matt Haberland, Tyler Reddy, David Cournapeau, Evgeni Burovski, Pearu Peterson, Warren Weckesser, Jonathan Bright, Stéfan J. van der Walt, Matthew Brett, Joshua Wilson, K. Jar- rod Millman, Nikolay Mayorov, Andrew R. J. Nelson,...

    2020

  29. [37]

    Distributionally robust graph-based recommendation system

    Bohao Wang, Jiawei Chen, Changdong Li, Sheng Zhou, Qihao Shi, Yang Gao, Yan Feng, Chun Chen, and Can Wang. Distributionally robust graph-based recommendation system. InProceedings of the ACM web conference 2024, pages 3777–3788, 2024

    2024

  30. [38]

    Linkteller: Recovering private edges from graph neural networks via influence analysis

    Fan Wu, Yunhui Long, Ce Zhang, and Bo Li. Linkteller: Recovering private edges from graph neural networks via influence analysis. In2022 IEEE Symposium on Security and Privacy (SP), pages 2005–2024, 2022

    2005

  31. [39]

    Zonghan Wu, Shirui Pan, Fengwen Chen, Guodong Long, Chengqi Zhang, and Philip S. Yu. A comprehensive survey on graph neural networks.IEEE Transac- tions on Neural Networks and Learning Systems, 32(1):4–24, 2021

    2021

  32. [40]

    How powerful are graph neural networks? In7th International Conference on Learning Rep- resentations, ICLR 2019, New Orleans, LA, USA, May 6-9, 2019

    Keyulu Xu, Weihua Hu, Jure Leskovec, and Stefanie Jegelka. How powerful are graph neural networks? In7th International Conference on Learning Rep- resentations, ICLR 2019, New Orleans, LA, USA, May 6-9, 2019. OpenReview.net, 2019

    2019

  33. [41]

    Graphpub: Generation of differential privacy graph with high availability.ArXiv, abs/2403.00030, 2024

    Wanghan Xu, Bin Shi, Ao Liu, Jiqiang Zhang, and Bo Dong. Graphpub: Generation of differential privacy graph with high availability.ArXiv, abs/2403.00030, 2024

    2024 arXiv

  34. [42]

    Consisrec: Enhancing gnn for social recommendation via consistent neighbor aggregation

    Liangwei Yang, Zhiwei Liu, Yingtong Dou, Jing Ma, and Philip S Yu. Consisrec: Enhancing gnn for social recommendation via consistent neighbor aggregation. InProceedings of the 44th international ACM SIGIR conference on Research and development in information retrieval, pages 2...

    2021

  35. [43]

    A 2 s 2-gnn: Rigging gnn-based social status by adversarial attacks in signed social networks

    Xiaoyan Yin, Wanyu Lin, Kexin Sun, Chun Wei, and Yanjiao Chen. A 2 s 2-gnn: Rigging gnn-based social status by adversarial attacks in signed social networks. IEEE Transactions on Information Forensics and Security, 18:206–220, 2022

    2022

  36. [44]

    PrivGraph: Differentially private graph data publication by exploiting community information

    Quan Yuan, Zhikun Zhang, Linkang Du, Min Chen, Peng Cheng, and Mingyang Sun. PrivGraph: Differentially private graph data publication by exploiting community information. In32nd USENIX Security Symposium (USENIX Security 23), pages 3241–3258, Anaheim, CA, August 2023. USENIX A...

    2023

  37. [45]

    Psgraph: Differentially private streaming graph synthesis by considering temporal dynamics.arXiv e-prints, pages arXiv–2412, 2024

    Quan Yuan, Zhikun Zhang, Linkang Du, Min Chen, Mingyang Sun, Yunjun Gao, Michael Backes, Shibo He, and Jiming Chen. Psgraph: Differentially private streaming graph synthesis by considering temporal dynamics.arXiv e-prints, pages arXiv–2412, 2024

    2024

  38. [46]

    Pri-pgd: Forging privacy-preserving graph towards spectral-based graph neural network

    Yong Zeng, Yixin Li, Jiale Liu, Jianfeng Ma, and Zhihong Liu. Pri-pgd: Forging privacy-preserving graph towards spectral-based graph neural network. In2021 IEEE Global Communications Conference (GLOBECOM), pages 01–06, 2021

    2021

  39. [47]

    Privdpr: Synthetic graph publishing with deep pagerank under differential privacy

    Sen Zhang, Haibo Hu, Qingqing Ye, and Jianliang Xu. Privdpr: Synthetic graph publishing with deep pagerank under differential privacy. InProceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 1, pages 1936–1947, 2025

    1936

  40. [48]

    A survey on privacy in graph neural networks: Attacks, preservation, and applications.IEEE Transactions on Knowledge and Data Engineering, 2024

    Yi Zhang, Yuying Zhao, Zhaoqing Li, Xueqi Cheng, Yu Wang, Olivera Kotevska, Philip S Yu, and Tyler Derr. A survey on privacy in graph neural networks: Attacks, preservation, and applications.IEEE Transactions on Knowledge and Data Engineering, 2024

    2024

  41. [49]

    Artificial in- telligence in bioinformatics and drug repurposing: methods and applications, 2022

    Pan Zheng, Shudong Wang, Xun Wang, and Xiangxiang Zeng. Artificial in- telligence in bioinformatics and drug repurposing: methods and applications, 2022

    2022

  42. [50]

    Xiaochen Zhu, Vincent Y. F. Tan, and Xiaokui Xiao. Blink: Link local differential privacy in graph neural networks via bayesian estimation. In Weizhi Meng, Christian Damsgaard Jensen, Cas Cremers, and Engin Kirda, editors,Proceedings of the 2023 ACM SIGSAC Conference on Comput...

    2023

Pith tools

Reviewed August 2, 2026 · model on record in the stance chip above.