Adaptive Branch Specialization in Spectral-Spatial Graph Neural Networks for Certified Robustness

Chong-kwon Kim; Jiho Choi; Yoonhyuk Choi

REVIEW 6 major objections 4 minor 54 references

Adaptive Branch Specialization in Spectral-Spatial Graph Neural Networks for Certified Robustness

T0 review · 6 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A two-branch graph network certifies predictions against edge and feature attacks.

desk verdict A plausible branch-specialization method with real-looking empirical gains, but the central certified-robustness theorem is unproven as written: a circular bound and dropped quadratic terms break the proof, so the paper needs major revision before it can be trusted. read the letter →

arxiv 2505.08320 v3 pith:PX7AXOHZ submitted 2025-05-13 cs.LG

Yoonhyuk Choi , Jiho Choi , Chong-Kwon Kim This is my paper · ORCID

classification cs.LG

keywords graphneuralnetworkscertifiedrobustnessspectral-spatialfusionadversarialtraininghomophilyheterophilyLipschitzboundsnodeclassificationgatingnetwork

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a graph neural network with two specialized branches—one tuned to homophilic structure under edge flips, one tuned to heterophilic patterns under feature noise—can be fused by a per-node gate so that each prediction carries a formal robustness certificate. This would matter because existing certified GNNs cover only a single threat model or a single branch, while real attacks combine structure and feature perturbations. The paper further claims the fusion gate is expressive enough to distinguish graphs beyond the 1-WL test while still admitting a Lipschitz-based certificate, and that the scheme improves accuracy on real homophilic and heterophilic benchmarks.

What carries the argument

The carrying object is the node-wise fusion gate $\alpha = \sigma(\mathrm{MLP}_\phi([Z_{\mathrm{spec}}\|Z_{\mathrm{spat}}\|r_A\|r_X]))$, a per-node, per-channel mask that interpolates between the two branches. Its importance is twofold: it makes the mixture strictly more expressive than any scalar convex combination (leading to the beyond-1-WL result), and it allows the robustness certificate to be composed from separate branch Lipschitz constants $B_A, B_X$ and gate Lipschitz constants $L_{\mathrm{gate}}, \tilde{L}_{\mathrm{gate}}$, giving the explicit bound of Theorem 4.

What would settle it

Take a trained SpecSphere model on a small graph, enumerate all edge flips within the certified budget $p$, and check whether any flip changes a predicted label on a node whose margin exceeded the certificate bound. Alternatively, measure the actual spectral norm of $\partial \hat{A}/\partial A$ for each attention layer after training; if any layer exceeds 1, the certificate's premise is violated and a counterexample should exist.

Watch

Extended reading notes

Core claim

The central claim is that the fused representation $Z = \alpha \odot Z_{\mathrm{spec}} + (1-\alpha) \odot Z_{\mathrm{spat}}$ is certified robust: for any perturbed graph in $S(G;p,\varepsilon)$, if the combined Lipschitz bound $(1+L_{\mathrm{gate}})B_A \sqrt{2p} + (1+\tilde{L}_{\mathrm{gate}})B_X \varepsilon$ is strictly smaller than the classification margin $\gamma$, then the predicted labels are invariant to any attack within budget. The two branches are adversarially trained against different threats—the spectral branch against $\ell_0$ edge flips, the spatial branch against $\ell_\infty$ feature perturbations—so that each specializes in one attack type and the gate routes each node to the more reliable branch.

Load-bearing premise

The certificate rests on the assertion that each spatial attention layer has a Jacobian of spectral norm at most 1 with respect to the adjacency matrix and weight spectral norm at most $\beta$; the paper states this without derivation, and if it fails the certified bound in Theorem 4 does not follow.

Editorial extensions

If this is right

For any node whose margin exceeds the certified bound, the prediction is provably unchanged under simultaneous edge flips up to $p$ and feature perturbations up to $\varepsilon$.
The certificate covers both homophilic and heterophilic graphs because the branches are specialized to different frequency regimes and the gate adapts per node.
The certification check requires only the margin and the Lipschitz constants, so it can be evaluated at inference time without enumerating attacks.
Because the gate can approximate any continuous per-node weighting, the same architecture can interpolate between low-pass and high-pass behavior, potentially handling graphs that mix homophilic and heterophilic regions.
Branch-specialized adversarial training with a joint consistency objective improves both clean accuracy and robustness compared to single-branch or naively fused models, as reported on Cora and Chameleon.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The certificate's validity hinges on the assumption that each attention layer satisfies $\|\partial \hat{A}/\partial A\|_2 \le 1$ and spectral norm $\le \beta$; if this fails on trained models, the actual robustness radius could be smaller than the certified one. This is testable by measuring Jacobian norms post-training.
The proof of Theorem 4 drops the quadratic term $L_{\mathrm{gate}} B_A \|\Delta A\|_2^2$ to obtain a linear bound; for larger budgets $p$ this term may not be negligible, so the certificate could be loose where it is needed most.
The beyond-1-WL result uses the gate to reduce to a spectral branch and requires informative node features; with constant features the construction collapses, so the expressivity advantage is conditional rather than unconditional.
The same composition-of-Lipschitz argument could be extended to other mixed threat models, such as $\ell_0$ feature perturbations or $\ell_1$ edge perturbations, giving a template for certified dual-norm robustness beyond the specific pair studied.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Two things to know. First, the empirical recipe—branch-specialized adversarial training plus node-channel gating—is reasonable and the gains on Cora and Chameleon, while modest, look real. Second, the headline certificate in Theorem 4 does not hold as written; the proof in Appendix F has a circular step and drops quadratic terms without a budget condition.

What's genuinely new: decoupling the threat model per branch (ℓ0 edge flips for the spectral branch, ℓ∞ feature perturbations for the spatial branch) and fusing via a learned gate with consistency/complementarity losses is a sensible combination I don't recall seeing in the cited dual-pass literature. The ablations and hyperparameter sweeps are standard but honest, and the code link suggests the authors want reproducibility. Credit where due.

Now the soft spots, roughly in order of severity.

1. Theorem 4's proof. Eq. 61 tries to bound the unperturbed branch gap ∥Zspec−Zspat∥ by a sum that includes ∥Zspec−Zspat∥ itself; substituting the triangle inequality gives a vacuous bound. You cannot absorb the last term into BA and BX because it's the very quantity you're trying to control. Separately, the product (Lgate∥ΔA∥+L̃gate∥ΔX∥)(BA∥ΔA∥+BX∥ΔX∥) contains quadratic terms in the budgets, which are dropped with the phrase 'dominated for small budgets.' But the theorem claims a guarantee for all budgets up to p and ε; no smallness condition is stated. So the certificate is not established.

2. Lemma 3 has a sign error. With RHP = −Σ∥L^{1/2}H∥² per Eq. 10, the term −λconsRHP is +λconsΣ∥L^{1/2}H∥². So Jspat = LCE + λconsΣ∥L^{1/2}H∥², and minimizing it suppresses high-frequency energy—the opposite of the lemma's claim. This undermines the frequency-bias story that motivates the spatial branch.

3. Eq. 31's assumption ∥∂Â/∂A∥₂ ≤ 1 for attention layers is asserted without support. For attention that renormalizes scores after edge flips, this is not obviously true, and the spatial branch Lipschitz bound depends on it.

4. The paper never computes certified accuracy. 'Certified robustness' is asserted from the broken theorem, not measured. The empirical robustness numbers are interesting but do not substantiate the certification claim.

5. Theorems 3 and 5 are near-tautological: they assume universal approximation and conclude the gate can approximate the optimal mask. That's not a meaningful trade-off result.

Who this is for: someone working on robust GNNs might find the branch-specialization training scheme worth borrowing, but only after the theory is fixed or reframed. As submitted, I would not accept; the central guarantee fails. A serious referee could still help the authors: the empirical idea is salvageable, and a corrected certificate might be provable under a small-budget assumption or with a proper bound on the branch gap. So I'd send it to review with a clear request to fix or reframe the theory, not desk-reject it.

Referee Report

6 major / 4 minor

Summary. The paper proposes SpecSphere, a dual-branch graph neural network with a spectral branch and a spatial branch, fused by a node- and channel-wise gating network. The two branches are trained with separate adversarial objectives (ℓ0 edge flips for the spectral branch, ℓ∞ feature perturbations for the spatial branch), plus consistency/complementarity losses. The manuscript makes three theoretical claims: (i) the gating mechanism strictly enlarges the hypothesis class beyond scalar mixtures and beyond 1-WL expressivity; (ii) the branch regularizers produce a spectral-spatial frequency bias; and (iii) the fused model admits a certified robustness bound against both edge flips and feature perturbations, stated as Theorem 4. Empirically, the paper reports accuracy improvements over several baselines on Cora and Chameleon, with additional results on four other datasets and three large graphs. The central certification result is Theorem 4, which is used to justify the claim of certified robustness.

Significance. If the certificate and the expressivity theorems were correct, the paper would be a significant contribution: it targets a genuinely open problem, combining dual-branch spectral-spatial architectures with formal robustness guarantees under two perturbation types, and it includes a reproducible code link and a broad experimental comparison. The branch-specialization idea is well motivated, and the attempt to compose branch-wise Lipschitz bounds through the fusion gate is a reasonable approach. However, the central proof of Theorem 4 contains circular and asymptotic steps, the spatial-branch Lipschitz bound rests on an unverified Jacobian assumption, and Lemma 3 has a sign error that reverses the stated frequency-bias conclusion. The expressivity proof also does not establish the stated K≥1 claim. These are load-bearing gaps in the paper's main advertised contributions, so the current manuscript does not support its central claims.

major comments (6)

[Appendix F, Eq. (61)-(63)] The bound on T2 is circular. Equation (61) expresses the unperturbed branch gap ||Zspec − Zspat||∞ in terms of perturbed differences and the term ||Z'spec − Z'spat||∞, and the proof then bounds that last term by again introducing ||Zspec − Zspat||∞. After substituting the triangle inequality, the unknown quantity appears on both sides of the inequality, yielding a vacuous bound. No assumption or separate proof controls the unperturbed branch gap, so ||T2||∞ in Eq. (59) is not bounded and Eq. (33) is not established.
[Appendix F, Eq. (63)] The proof drops the quadratic terms Lgate·BA·||ΔA||2², ṼLgate·BX·||ΔX||∞², and the cross terms, stating that higher-order terms are dominated for small budgets. However, Theorem 4's threat model allows every admissible (ΔA, ΔX) with ||ΔA||2 ≤ √(2p) and ||ΔX||∞ ≤ ε, and no smallness condition such as ε·BA·Lgate < 1 is stated in the theorem. A certified robustness bound must hold for every perturbation within the budget, not merely asymptotically for small perturbations. This is a second independent reason that Eq. (33) is unproven.
[Appendix E, Lemma 3 and Eq. (28)] Lemma 3 contains a sign error. Equation (10) defines RHP = −Σ_{ℓ,i} λi ||ui^T H_spat^(ℓ)||²_F, so Jspat = LCE − λcons·RHP = LCE + λcons·Σ λi ||ui^T H_spat^(ℓ)||²_F. The minimizer inequality Jspat ≤ C̃spat therefore gives Σ λi ||ui^T H_spat^(ℓ)||²_F ≤ (C̃spat − LCE)/λcons, an upper bound, not the lower bound claimed in Eq. (28). The proof line asserting that RHP equals the positive Laplacian energy contradicts Eq. (10). Consequently, the claimed high-frequency retention of the spatial branch and Corollary 1 are not supported as written.
[Eq. (31) and Theorem 4] The spatial-branch Lipschitz bound assumes ||∂Â/∂A||2 ≤ 1 and per-layer weight spectral norm ≤ β, but this assumption is stated without proof or empirical verification. For attention mechanisms that renormalize scores after an edge flip, the Jacobian norm can exceed 1, since renormalization can amplify small perturbations in sparse neighborhoods. Because Theorem 4 composes this bound into the final certificate, the certificate depends on an unverified and nontrivial assumption about the specific attention layers used in the experiments.
[Appendix D, Theorem 2] The proof of the beyond-1-WL claim does not establish the theorem as stated. The construction sets α ≡ 1 and ignores the spatial branch, so the claimed expressivity gain is attributed to the spectral branch alone rather than to the gating mechanism. Moreover, the proof requires a polynomial p(λ) of degree up to n−1 to realize the eigenspace projector, but the theorem states K ≥ 1 with no condition linking K to the graph size; for general CFI pairs, K=1 cannot express the required filter. The co-spectrality of the 10-vertex CFI pair is also assumed without argument, and non-isomorphism alone does not imply different eigenspace projectors. These gaps leave the expressivity contribution unsupported.
[Theorems 3 and 5] The adaptivity and trade-off theorems are near-tautological. Theorem 3 assumes labels are encoded in the relevant frequency band and that the gate is a universal approximator, then concludes that some gate attains the lower Bayes risk; no property of the proposed training losses RLP or RHP is used beyond existence. Theorem 5 similarly assumes MLPg is a universal approximator and concludes it can approximate any target mask. These statements do not explain why the training objective selects the desirable mask, and they do not provide an optimality or trade-off guarantee for the trained model.

minor comments (4)

[Eq. (11) and Eq. (12)] The robustness signals rA and rX are written with per-node subscripts but are described as broadcast or summarized channel-wise; the exact alignment between node indices and feature channels should be clarified.
[Eq. (19) and Algorithm 1] The notation is inconsistent: Eq. (19) calls bu a binary mask but defines it as a sigmoid output, and Algorithm 1 introduces m before using bu. The distinction between the soft mask and any hard thresholding used in practice should be stated.
[Section 'Experiments'] The paper advertises 'certified robustness' but reports only empirical accuracy under attacks; no certified radii, certified test accuracy, or verification of Eq. (33) on real data is presented. A comparison with existing certified GNNs would help calibrate the claim.
[Appendix H, Table 5] The description of SpecSphere's architecture in the large-scale experiments should specify which spectral and spatial modules are used, since Table 5 lists 'SpecSphere (LSGNN+TFE-GNN)' while the main text describes GCN/GAT and APPNP/FAGCN variants.

Circularity Check

1 steps flagged · score 6.0 of 10

Theorem 4's certificate is not established: Appendix F bounds the unperturbed branch gap by itself in Eq. 61-62 and drops positive quadratic terms without the budget-independent condition the theorem requires.

other [Appendix F, Eq. 61-62 (proof of Theorem 4)]
"the last term is similarly bounded by ∥Z′spec−Z′spat∥∞≤∥Z′spec−Zspec∥∞ +∥Zspec−Zspat∥∞ +∥Z′spat−Zspat∥∞, so we can absorb it into the same constants. Thus, there exists a constant factor C≤ 1 (absorbed into BA,BX without loss of generality) such that ∥Zspec−Zspat∥∞≤BA∥∆A∥2 +BX∥∆X∥∞."

The proof needs to bound the unperturbed branch gap ∥Zspec−Zspat∥∞ to control T2. The only bound offered is Eq. 61, a triangle inequality whose right-hand side contains the very same quantity ∥Zspec−Zspat∥∞ through the term ∥Z′spec−Z′spat∥∞. Substituting the displayed bound for the perturbed gap yields D ≤ 2(a+b)+D, where D is the target unperturbed gap and a,b are the already-bounded perturbed differences; this is a tautology and supplies no bound on D. The subsequent 'absorb it into the same constants' step therefore assumes the conclusion it is trying to prove. No independent bound on the unperturbed branch gap appears anywhere in the proof, so T2 is uncontrolled and Eq. 33 does not follow from the argument as written.

full rationale

The principal circular step is in Appendix F, Eq. 61-62: to bound T2, the proof must control ∥Zspec−Zspat∥∞, but the only inequality offered re-inserts that same unperturbed gap on the right-hand side and then 'absorbs' it into the constants. This is a genuine circular reduction and it invalidates the derivation of Eq. 33. Separately, and as a correctness issue rather than a circularity, the proof discards the positive quadratic terms Lgate·BA·∥∆A∥2^2 and Ltilde_gate·BX·∥∆X∥∞^2 from Eq. 63 by appealing to 'small budgets,' even though Theorem 4 quantifies over all admissible (A+∆A,X+∆X) in S(G;p,ε) with no smallness condition. The spatial-branch Lipschitz assumption ∥∂Â/∂A∥2≤1 in Eq. 31 is also asserted without derivation; if it fails, the certificate does not hold. The expressivity and trade-off theorems (3 and 5) are weak because they follow almost immediately from the universal-approximation assumption on the gates, but they are conditional existence statements and are not the main load-bearing derivation. Self-citations in related work are not load-bearing. Because the central certificate's proof contains a circular absorption of the branch-gap term, the abstract's claim of a unified certified robustness guarantee is not established as written; the empirical comparisons remain independent evidence.

Assumptions & free parameters 4 free parameters · 6 assumptions · 0 invented entities

The central certificate depends on regularization weights chosen by grid search, an unverified Lipschitz assumption on attention, an assumption about label frequency bands, and a questionable truncation of quadratic perturbation terms. No new physical or mathematical entities are introduced; the 'entities' are the two branches and the gate, which are standard model components.

free parameters (4)

lambda_adv (adversarial loss weight) = 0.5 (Cora), 1.0 (Chameleon)
Grid-searched over {0.0, 0.1, 0.5, 1.0, 2.0}; enters Eq. 21 and affects the trade-off in Theorem 4's constants only through the trained model.
lambda_cons (consistency/complementarity weight) = 0.01 (Cora), 0.1 (Chameleon)
Grid-searched over {0.0, 1e-3, 0.01, 0.1, 1.0}; controls R_LP/R_HP in Lemmas 2 and 3 and the consistency losses.
margin gamma (hinge separation margin) = not reported
Introduced in Eq. 20 and used in the certificate condition (Theorem 4); no default or fitted value is stated.
p (edge flip budget) and epsilon (feature budget) = p = 0.1|E|, epsilon = 0.1
Part of the threat model S(G;p,eps) in Eq. 15 and directly enters the certified bound; values are chosen by the authors.

assumptions (6)

standard math MLPs with sigmoid output are universal approximators on compact domains (Lemma 1)
Used to let the gate alpha approximate any continuous mask, which is the basis of Theorems 1, 3 and 5.
ad hoc to paper Each attention layer in the spatial branch satisfies ||partial Ahat / partial A||_2 <= 1 and weight spectral norm <= beta (Eq. 31)
Needed for the spatial branch Lipschitz bound B_A^spat; no derivation or verification is provided.
domain assumption Labels are predominantly encoded in low-frequency components in homophilic neighborhoods and in high-frequency components in heterophilic neighborhoods (Theorem 3)
This assumption converts the regularizer bounds into a claim about Bayes risks; it is not proven for the benchmark datasets.
domain assumption There exist finite constants C_spec, C_spat bounding the cross-entropy over feasible parameter sets (Lemmas 2 and 3)
The bounds in Eqs. 27 and 28 are only meaningful if such constants exist and are finite.
domain assumption CFI graphs with informative node features are cospectral for the normalized Laplacian and the chosen spectral filter can project onto differing eigenspaces (Theorem 2, Appendix D)
The beyond-1-WL proof sets the gate to constant and relies on a high-degree polynomial filter separating cospectral graphs.
ad hoc to paper Higher-order terms in the product of perturbation bounds are dominated by linear terms and can be absorbed (Appendix F, Eq. 63)
This is the step that turns a quadratic product into the claimed linear certificate; it is a derivation assumption, not a proven inequality.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Adaptive Branch Specialization in Spectral-Spatial Graph Neural Networks for Certified Robustness." pith.science (2026). https://pith.science/paper/PX7AXOHZ

@misc{pith2026250508320,
  author       = {Pith},
  title        = {Pith review of: Adaptive Branch Specialization in Spectral-Spatial Graph Neural Networks for Certified Robustness},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PX7AXOHZ}},
  note         = {Machine review of arXiv:2505.08320}
}

read the original abstract

Recent Graph Neural Networks (GNNs) combine spectral-spatial architectures for enhanced representation learning. However, limited attention has been paid to certified robustness, particularly regarding training strategies and underlying rationale. In this paper, we explicitly specialize each branch: the spectral network is trained to withstand l0 edge flips and capture homophilic structures, while the spatial part is designed to resist linf feature perturbations and heterophilic patterns. A context-aware gating network adaptively fuses the two representations, dynamically routing each node's prediction to the more reliable branch. This specialized adversarial training scheme uses branch-specific inner maximization (structure vs feature attacks) and a unified alignment objective. We provide theoretical guarantees: (i) expressivity of the gating mechanism beyond 1-WL, (ii) spectral-spatial frequency bias, and (iii) certified robustness with trade-off. Empirically, SpecSphere attains state-of-the-art node classification accuracy and offers tighter certified robustness on real-world benchmarks.

Figures

Figures reproduced from arXiv: 2505.08320 by the authors.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

54 extracted references · 30 canonical work pages

[1]

, " * write output.state after.block = add.period write newline

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...
[2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...
[3]

Abu-El-Haija, S.; Perozzi, B.; Kapoor, A.; Alipourfard, N.; Lerman, K.; Harutyunyan, H.; Ver Steeg, G.; and Galstyan, A. 2019. Mixhop: Higher-order graph convolutional architectures via sparsified neighborhood mixing. In international conference on machine learning, 21--29. PMLR

2019
[4]

Bo, D.; Wang, X.; Shi, C.; and Shen, H. 2021. Beyond low-frequency information in graph convolutional networks. arXiv preprint arXiv:2101.00797

work page Pith review arXiv 2021
[5]

Bojchevski, A.; Gasteiger, J.; and G \"u nnemann, S. 2020. Efficient robustness certificates for discrete data: Sparsity-aware randomized smoothing for graphs, images and more. In International Conference on Machine Learning, 1003--1013. PMLR

work page 2020
[6]

Bruna, J.; Zaremba, W.; Szlam, A.; and LeCun, Y. 2013. Spectral networks and locally connected networks on graphs. arXiv preprint arXiv:1312.6203

arXiv 2013
[7]

Cai, J.-Y.; F \"u rer, M.; and Immerman, N. 1992. An optimal lower bound on the number of variables for graph identification. Combinatorica, 12(4): 389--410

work page 1992
[8]

Chen, M.; Wei, Z.; Huang, Z.; Ding, B.; and Li, Y. 2020. Simple and deep graph convolutional networks. In International Conference on Machine Learning, 1725--1735. PMLR

2020

Show all 54 references

[9]

Chen, Y.; Luo, Y.; Tang, J.; Yang, L.; Qiu, S.; Wang, C.; and Cao, X. 2023 a . LSGNN: Towards General Graph Neural Network in Node Classification by Local Similarity. arXiv preprint arXiv:2305.04225

2023 arXiv
[10]

Chen, Z.; Chen, F.; Zhang, L.; Ji, T.; Fu, K.; Zhao, L.; Chen, F.; Wu, L.; Aggarwal, C.; and Lu, C.-T. 2023 b . Bridging the gap between spatial and spectral domains: A unified framework for graph neural networks. ACM Computing Surveys, 56(5): 1--42

2023
[11]

Chien, E.; Peng, J.; Li, P.; and Milenkovic, O. 2020. Adaptive universal generalized pagerank graph neural network. arXiv preprint arXiv:2006.07988

2020 arXiv
[12]

Choi, Y.; Choi, J.; Ko, T.; and Kim, C.-K. 2023. Is signed message essential for graph neural networks. arXiv preprint arXiv:2301.08918

2023 arXiv
[13]

Defferrard, M.; Bresson, X.; and Vandergheynst, P. 2016. Convolutional neural networks on graphs with fast localized spectral filtering. Advances in neural information processing systems, 29

2016
[14]

Deng, C.; Li, X.; Feng, Z.; and Zhang, Z. 2022. Garnet: Reduced-rank topology learning for robust and scalable graph neural networks. In Learning on Graphs Conference, 3--1. PMLR

2022
[15]

Duan, R.; Guang, M.; Wang, J.; Yan, C.; Qi, H.; Su, W.; Tian, C.; and Yang, H. 2024. Unifying Homophily and Heterophily for Spectral Graph Neural Networks via Triple Filter Ensembles. Advances in Neural Information Processing Systems, 37: 93540--93567

2024
[16]

P.; Joshi, C

Dwivedi, V. P.; Joshi, C. K.; Luu, A. T.; Laurent, T.; Bengio, Y.; and Bresson, X. 2023. Benchmarking graph neural networks. Journal of Machine Learning Research, 24(43): 1--48

2023
[17]

M.; Kosmala, A.; Herbst, D.; and G \"u nnemann, S

Geisler, S. M.; Kosmala, A.; Herbst, D.; and G \"u nnemann, S. 2024. Spatio-spectral graph neural networks. Advances in Neural Information Processing Systems, 37: 49022--49080

2024
[18]

u gner, D.; and G \

Gosch, L.; Geisler, S.; Sturm, D.; Charpentier, B.; Z \"u gner, D.; and G \"u nnemann, S. 2023. Adversarial training for graph neural networks: Pitfalls, solutions, and new directions. Advances in neural information processing systems, 36: 58088--58112

2023
[19]

N.; and Faloutsos, C

Grover, K.; Yu, H.; Song, X.; Zhu, Q.; Xie, H.; Ioannidis, V. N.; and Faloutsos, C. 2025. Spectro-Riemannian Graph Neural Networks. arXiv preprint arXiv:2502.00401

2025 arXiv
[20]

Hamilton, W.; Ying, Z.; and Leskovec, J. 2017. Inductive representation learning on large graphs. Advances in neural information processing systems, 30

2017
[21]

Han, S.; Zhou, Z.; Chen, J.; Hao, Z.; Zhou, S.; Wang, G.; Feng, Y.; Chen, C.; and Wang, C. 2025. Uncertainty-Aware Graph Structure Learning. arXiv preprint arXiv:2502.12618

2025 arXiv
[22]

He, D.; Shan, L.; Zhao, J.; Zhang, H.; Wang, Z.; and Zhang, W. 2024. Exploitation of a Latent Mechanism in Graph Contrastive Learning: Representation Scattering. Advances in Neural Information Processing Systems, 37: 115351--115376

2024
[23]

Hou, Z.; Feng, R.; Derr, T.; and Liu, X. 2024. Robust graph neural networks via unbiased aggregation. Advances in Neural Information Processing Systems, 37: 110097--110130

2024
[24]

Jin, W.; Li, Y.; Xu, H.; Wang, Y.; Ji, S.; Aggarwal, C.; and Tang, J. 2021. Adversarial attacks and defenses on graphs. ACM SIGKDD Explorations Newsletter, 22(2): 19--34

2021
[25]

N.; and Welling, M

Kipf, T. N.; and Welling, M. 2016. Semi-supervised classification with graph convolutional networks. arXiv preprint arXiv:1609.02907

2016 arXiv
[26]

Klicpera, J.; Bojchevski, A.; and G \"u nnemann, S. 2018. Predict then propagate: Graph neural networks meet personalized pagerank. arXiv preprint arXiv:1810.05997

2018 arXiv
[27]

Ko, T.; Choi, Y.; and Kim, C.-K. 2023. Signed directed graph contrastive learning with laplacian augmentation. arXiv preprint arXiv:2301.05163

2023 arXiv
[28]

Lee, J.; Lee, I.; and Kang, J. 2019. Self-attention graph pooling. In International conference on machine learning, 3734--3743. pmlr

2019
[29]

Lei, R.; Wang, Z.; Li, Y.; Ding, B.; and Wei, Z. 2022. EvenNet: Ignoring Odd-Hop Neighbors Improves Robustness of Graph Neural Networks. arXiv preprint arXiv:2205.13892

2022 arXiv
[30]

Li, B.; Pan, E.; and Kang, Z. 2024. Pc-conv: Unifying homophily and heterophily with two-fold filtering. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, 13437--13445

2024
[31]

Li, B.; Xie, X.; Lei, H.; Fang, R.; and Kang, Z. 2025. Simplified pcnet with robustness. Neural Networks, 184: 107099

2025
[32]

L.; Gupta, V.; Bhalerao, O.; and Lim, S

Lim, D.; Hohne, F.; Li, X.; Huang, S. L.; Gupta, V.; Bhalerao, O.; and Lim, S. N. 2021. Large scale learning on non-homophilous graphs: New benchmarks and strong simple methods. Advances in Neural Information Processing Systems, 34: 20887--20902

2021
[33]

Lin, M.; Xiao, T.; Dai, E.; Zhang, X.; and Wang, S. 2023. Certifiably robust graph contrastive learning. Advances in Neural Information Processing Systems, 36: 17008--17037

2023
[34]

Luan, S.; Hua, C.; Lu, Q.; Zhu, J.; Zhao, M.; Zhang, S.; Chang, X.-W.; and Precup, D. 2022. Revisiting heterophily for graph neural networks. arXiv preprint arXiv:2210.07606

2022 arXiv
[35]

Ma, J.; Ding, S.; and Mei, Q. 2020. Towards more practical adversarial attacks on graph neural networks. Advances in neural information processing systems, 33: 4756--4766

2020
[36]

Nt, H.; and Maehara, T. 2019. Revisiting graph neural networks: All we have is low-pass filters. arXiv preprint arXiv:1905.09550

2019 arXiv
[37]

C.-C.; Lei, Y.; and Yang, B

Pei, H.; Wei, B.; Chang, K. C.-C.; Lei, Y.; and Yang, B. 2020. Geom-gcn: Geometric graph convolutional networks. arXiv preprint arXiv:2002.05287

2020 arXiv
[38]

Rozemberczki, B.; Davies, R.; Sarkar, R.; and Sutton, C. 2019. Gemsec: Graph embedding with self clustering. In Proceedings of the 2019 IEEE/ACM international conference on advances in social networks analysis and mining, 65--72

2019
[39]

Scholten, Y.; Schuchardt, J.; Bojchevski, A.; and G \"u nnemann, S. 2023. Hierarchical randomized smoothing. Advances in Neural Information Processing Systems, 36: 49783--49813

2023
[40]

Shen, X.; Choi, K.-S.; and Zhou, X. 2024. Dual separated attention-based graph neural network. Neurocomputing, 599: 128106

2024
[41]

Tang, J.; Sun, J.; Wang, C.; and Yang, Z. 2009. Social influence analysis in large-scale networks. In Proceedings of the 15th ACM SIGKDD international conference on Knowledge discovery and data mining, 807--816

2009
[42]

Velickovic, P.; Cucurull, G.; Casanova, A.; Romero, A.; Lio, P.; and Bengio, Y. 2017. Graph attention networks. stat, 1050: 20

2017
[43]

Wang, B.; Jia, J.; Cao, X.; and Gong, N. Z. 2021. Certified robustness of graph neural networks against adversarial structural perturbation. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, 1645--1653

2021
[44]

Wang, J.; Guo, Y.; Yang, L.; and Wang, Y. 2024. Understanding heterophily for graph neural networks. arXiv preprint arXiv:2401.09125

2024 arXiv
[45]

how graph neural networks go beyond weisfeiler-lehman?

Wijesinghe, A.; and Wang, Q. 2022. A new perspective on" how graph neural networks go beyond weisfeiler-lehman?". In International conference on learning representations

2022
[46]

Yan, Y.; Chen, Y.; Chen, H.; Xu, M.; Das, M.; Yang, H.; and Tong, H. 2024. From trainable negative depth to edge heterophily in graphs. Advances in Neural Information Processing Systems, 36

2024
[47]

Yan, Y.; Hashemi, M.; Swersky, K.; Yang, Y.; and Koutra, D. 2021. Two sides of the same coin: Heterophily and oversmoothing in graph convolutional neural networks. arXiv preprint arXiv:2102.06462

2021 arXiv
[48]

Zhang, J.; Zhou, X.; Jia, R.; Pei, D.; and Song, L. 2020. GNNGuard : Defending Graph Neural Networks against Adversarial Attacks. Advances in Neural Information Processing Systems (NeurIPS)

2020
[49]

Zhang, M.; and Chen, Y. 2018. Link prediction based on graph neural networks. Advances in neural information processing systems, 31

2018
[50]

Zhou, L.; Chen, W.; Zeng, D.; Cheng, S.; Liu, W.; Zhang, M.; and Qu, H. 2023. DPGNN: Dual-perception graph neural network for representation learning. Knowledge-Based Systems, 268: 110377

2023
[51]

T.; and Koutra, D

Zhu, J.; Jin, J.; Loveland, D.; Schaub, M. T.; and Koutra, D. 2022. How does heterophily impact the robustness of graph neural networks? theoretical connections and practical implications. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining,...

2022
[52]

Zhu, J.; Yan, Y.; Zhao, L.; Heimann, M.; Akoglu, L.; and Koutra, D. 2020. Beyond homophily in graph neural networks: Current limitations and effective designs. Advances in Neural Information Processing Systems, 33: 7793--7804

2020
[53]

u gner, D.; Borchert, O.; Akbarnejad, A.; and G \

Z \"u gner, D.; Borchert, O.; Akbarnejad, A.; and G \"u nnemann, S. 2020. Adversarial attacks on graph neural networks: Perturbations and their patterns. ACM Transactions on Knowledge Discovery from Data (TKDD), 14(5): 1--31

2020
[54]

u gner, D.; and G \

Z \"u gner, D.; and G \"u nnemann, S. 2019. Adversarial Attacks on Graph Neural Networks via Meta Learning. International Conference on Learning Representations (ICLR)

2019

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [1]

, " * write output.state after.block = add.period write newline

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

[2] [2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

[3] [3]

Abu-El-Haija, S.; Perozzi, B.; Kapoor, A.; Alipourfard, N.; Lerman, K.; Harutyunyan, H.; Ver Steeg, G.; and Galstyan, A. 2019. Mixhop: Higher-order graph convolutional architectures via sparsified neighborhood mixing. In international conference on machine learning, 21--29. PMLR

2019

[4] [4]

Bo, D.; Wang, X.; Shi, C.; and Shen, H. 2021. Beyond low-frequency information in graph convolutional networks. arXiv preprint arXiv:2101.00797

work page Pith review arXiv 2021

[5] [5]

Bojchevski, A.; Gasteiger, J.; and G \"u nnemann, S. 2020. Efficient robustness certificates for discrete data: Sparsity-aware randomized smoothing for graphs, images and more. In International Conference on Machine Learning, 1003--1013. PMLR

work page 2020

[6] [6]

Bruna, J.; Zaremba, W.; Szlam, A.; and LeCun, Y. 2013. Spectral networks and locally connected networks on graphs. arXiv preprint arXiv:1312.6203

arXiv 2013

[7] [7]

Cai, J.-Y.; F \"u rer, M.; and Immerman, N. 1992. An optimal lower bound on the number of variables for graph identification. Combinatorica, 12(4): 389--410

work page 1992

[8] [8]

Chen, M.; Wei, Z.; Huang, Z.; Ding, B.; and Li, Y. 2020. Simple and deep graph convolutional networks. In International Conference on Machine Learning, 1725--1735. PMLR

2020