Pith. sign in

REVIEW 4 major objections 7 minor 47 references

On the Relationship Between Robustness and Expressivity of Graph Neural Networks

T0 review · 4 major / 7 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Few bit flips can crush a graph neural network's expressive power, and ReLU activation lowers the required count.

desk verdict First analytical BFA-expressivity bounds for GNNs, but the ReLU sign-bit reduction in Section 2.3 is invalid as written and weakens the paper's headline claim. read the letter →

arxiv 2504.13786 v1 pith:WL2NFIKV submitted 2025-04-18 cs.LG

Lorenz Kummer , Wilfried N. Gansterer , Nils M. Kriege This is my paper · ORCID
classification cs.LG
keywords bit-flipattacksGNNexpressivityWeisfeiler-LemantestneuralmultisetfunctionsmomentinjectivityhomophilyReLUactivationgraphnetworkresistance
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper asks how easily bit flips in a graph neural network's stored weights can destroy its expressive power—the ability to tell non-isomorphic graphs or distinct nodes apart. It proves upper bounds on the number of bit flips needed to make a maximally expressive GNN (one as expressive as the 1-WL graph isomorphism test) fail: $O(d_{j,i}\cdot m_{j,i}\cdot b)$ for node-level and $O(e_j\cdot d_{j,i}\cdot m_{j,i}\cdot b)$ for graph-level expressivity, where $d_{j,i}$ is the maximum number of differing coordinates between input aggregates, $m_{j,i}$ the layer width, $b$ the bit width, and $e_j$ the WL difference. The paper then shows that ReLU activation, one-hot node features, and high homophily each shrink these bounds, with sign-bit flips making ReLU models vulnerable in a way that is independent of bit width. Since these conditions are common in real-world graph learning, the result matters for safety-critical applications that depend on distinguishing molecular or network structures.

What carries the argument

The central object is the neural moment function, a layer that encodes a multiset of neighbor embeddings by the sum $\hat{f}(X)=\sum_{x\in X} f(x)$ of an MLP-transformed element map $f$; graph neural networks such as GIN stack these functions. The load-bearing criterion is moment injectivity: distinct multisets must map to distinct sums, which the paper traces to linear independence of the mapped elements (Proposition 1) and, layer by layer, to the existence of a separating weight row for every pair of distinct aggregate inputs (Lemma 2). The flip-count bounds count how many stored bits must be changed to destroy that row separation; for ReLU the separation additionally requires a positive pre-activation, so a single sign-bit flip can zero a row and remove the bit-width factor from the bound (Lemma 3).

What would settle it

Take a gradient-descent-trained ReLU GNN with one-hot node features on a highly homophilous graph dataset, flip only sign bits in the first-layer weights, and count how many flips are needed to halve the fraction of Weisfeiler-Leman-distinguishable graph pairs the model still separates. If trained models need substantially more than the $O(m_{1,1}\cdot nz_H)$ sign-bit flips the first-layer bound predicts, the random-initialization proxy is the weak link.

Watch

Extended reading notes

Core claim

On its own terms, the paper establishes that a GNN's vulnerability to expressivity loss under bit flips is governed by the injectivity of its layer-by-layer neural moment mappings. For sum-based aggregation, a layer $\sigma\circ W$ stays injective exactly when some row of the weight matrix separates any two distinct input aggregates (Lemma 2). Zeroing the weight entries at the coordinates where two aggregates differ, across all output neurons and all stored bits, guarantees that separation fails; this yields Theorem 1's node-level bound and, after multiplying by the WL difference $e_j$ of the hardest graph pair, Theorem 2's graph-level bound. The paper proves that ReLU's negative zeroing lets a sign-bit flip replace a full weight zeroing, removing the bit-width factor from the bound, and that one-hot encodings plus high homophily reduce the number of differing coordinates in the first layer (Corollaries 1 and 2). Empirical results on ten real-world datasets report statistically significant correlations between expressivity loss and the predicted factors, using randomly initialized, untrained GNNs.

Load-bearing premise

The bounds and experiments are built on randomly initialized, untrained GNNs; the paper assumes these models' vulnerability profile matches deployed, trained GNNs, and that transfer is never tested.

Editorial extensions

If this is right

  • ReLU-activated GNNs with one-hot features on homophilous graphs can lose expressivity through sign-bit flips whose count is independent of bit width, making them the most exposed configuration.
  • Raising feature dimensionality or switching to a dense encoding that preserves linear independence increases the required flip count, giving practitioners a concrete hardening lever.
  • Graph-level expressivity attacks scale with the WL difference of the hardest-to-distinguish equal-order graph pair, so structurally more diverse datasets are proportionally more expensive to attack.
  • Any classification failure caused by expressivity loss occurs with no more bit flips than these worst-case bounds, so the bounds act as ceilings on practical attack cost.
  • First-layer attacks are the efficient route: one-hot encodings and homophily shrink the bound there, and the empirical correlations with expressivity loss are significant mainly for first-layer flips.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The random-initialization proxy leaves open whether trained weights, which develop correlations and magnitude structures, are easier or harder to attack; a trained-model replication of the sign-bit experiments would settle that transfer.
  • By the paper's logic, switching from ReLU to a smoother activation such as SiLU or expanding feature dimensionality should harden a deployed model, but the paper only recommends this direction; it does not demonstrate it on trained models.
  • The WL-difference factor in the graph-level bound implies that benchmark selection alone changes apparent resistance, so cross-study comparisons of GNN bit-flip vulnerability should report dataset WL diversity.
  • Attention-weighted aggregations such as GAT may not inherit the homophily and first-layer effects because attention is applied before summing; the paper flags this as open rather than claiming it.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. This paper studies the vulnerability of GNNs to weight bit-flip attacks (BFAs) from the viewpoint of expressivity. Treating a GNN layer as an injective elementwise activation applied to a linear map, the paper uses a row-based characterization of layer injectivity (Lemmas 2 and 3) to derive upper bounds on the number of bit flips needed to break node-level expressivity, O(d_{j,i}·m_{j,i}·b) (Theorem 1), and graph-level expressivity, O(e_j·d_{j,i}·m_{j,i}·b) (Theorem 2), where d is the maximum L0 distance between input aggregates, m the layer width, b the bit width, and e the WL difference between the two most different graphs in the dataset. Section 2.3 claims that ReLU activations reduce these bounds to O(d·m) because sign-bit flips let ReLU zero out activations, and it derives narrower first-layer bounds for one-hot features (Corollary 1) and high homophily (Corollary 2). The experiments (Section 3) use ten TUDatasets, three architectures (GIN, GCN, DeepSets), three activations, and 101,250 attack runs on untrained networks, finding that ReLU sign-bit flips are most damaging and that homophily and feature dimensionality have small but statistically significant correlations with expressivity loss in the first layer. The paper explicitly does not train its models, deferring training-dependent effects to future work.

Significance. If the results hold, the paper would provide the first analytic, parameter-free account of how architectural choices (width, activation, bit position) and dataset properties (WL color diversity, homophily, feature encoding) jointly determine GNN susceptibility to BFAs, with falsifiable predictions (RQs 1–4) that the authors test at stated significance levels. The empirical study is a genuine strength: the code is publicly released, the experiments cover 101,250 runs across ten datasets, and the qualitative direction of the findings is consistent with prior empirical BFA work on GNNs. However, the central ReLU-specific claim (the O(d·m) bound via sign-bit flips) is not established, Proposition 1 is false as stated, and Theorems 1 and 2 assert guaranteed expressivity loss while their proofs only show that a sufficient condition for maximal expressivity is violated. These problems are material but repairable within the scope of the manuscript, so the contribution should be judged after revision.

major comments (4)
  1. [Section 2.3, paragraph after Lemma 3] The claimed reduction of the node-level bound from O(d_{j,i}·m_{j,i}·b) to O(d_{j,i}·m_{j,i}) by flipping sign bits is not a valid upper bound as stated. The paper asserts that flipping the sign bits of the target weights — the weights in the coordinates where the chosen aggregates xu and xv differ — "will suffice, letting ReLU zero out the activations." A sign flip negates a weight rather than zeroing it. For a row with common-coordinate contribution C, flipping the sign of the weight w_s in a differing coordinate s changes the pre-activations from C + w_s·xu_s and C + w_s·xv_s to C − w_s·xu_s and C − w_s·xv_s, which are equal only if xu_s = xv_s and both non-positive only if C ≤ w_s·min(xu_s, xv_s); neither condition holds in general. Concretely, for xu = (2,5), xv = (0,5) and a row w = (1,2), we have d = 1; the original pre-activations are 12 and 10, and after flipping the sign bit of the target weight w_1 they become 8 and 10, so the ReLU outputs remain distinct. Collapsing this pair requires modifying the common-coordinate weight w_2, which is not among the d target coordinates; an attack restricted to the differing coordinates therefore does not work, and allowing all coordinates gives O(n·m), not O(d·m). The O(d·m) bound in Section 2.3, the corresponding part of the abstract ("ReLU-activated GNNs ... particularly susceptible"), and the motivation of RQ1 should be revised: either prove the bound under explicit conditions on the aggregates and weights, or restate the ReLU finding as an empirical observation without the claimed bound.
  2. [Appendix A, Proposition 1] Proposition 1 is false as stated, and the proof in the appendix is invalid. Condition (1) requires linear independence of {f(x) : x ∈ S(A)} only for support sets with |S(A)| ≤ n, but a collision between two multisets A, B ∈ Ω_d^n can involve up to 2n distinct domain elements. Counterexample for n = 2: let f: R^3 → R^2 be f(x) = (x_1, x_2), with x_1 = (1,0,0), x_2 = (0,1,0), x_3 = (1,1,0). Every support set of size at most 2 maps to a linearly independent set, so condition (1) holds, yet f̂({{x_1, x_2}}) = (1,1) = f̂({{x_3}}) while {{x_1, x_2}} ≠ {{x_3}}, so condition (2) fails. The proof breaks at step (8): from the single equation (6), Σ_{z∈S∪}(m_A(z) − m_B(z))f(z) = 0, a two-term relation of the form (9) cannot be extracted. The correct sufficient condition is independence of all subsets of size up to 2n (equivalently, applying the argument to S(A∪B) with the right independence hypothesis); Section 2.1 relies on the proposition to justify that layer non-injectivity endangers moment injectivity and hence expressivity, so the statement must be corrected and proved before the framework can be accepted.
  3. [Theorems 1 and 2] There is a mismatch between the statements of Theorems 1 and 2 and what their proofs establish. The theorems claim that node- or graph-level expressivity "can be compromised" by O(d·m·b) (resp. O(e·d·m·b)) bit flips, but the proofs show only that a chosen layer (j,i) fails to satisfy the injectivity condition of Definition 1, after which maximal expressivity "cannot be guaranteed." This is strictly weaker than actual expressivity loss: if the layer attacked is not the last GNN layer, later layers can re-distinguish the collapsed pair (u,v) from their different neighborhoods, and the readout of Eq. (2) pools embeddings from all layers. The paper itself concedes in Appendix C that a loss of injectivity guarantees a loss of expressivity only for the last layer. Theorems 1 and 2 should be restricted to the last layer (where the guarantee holds), or restated as bounds on the number of flips that violate the sufficient condition for maximal expressivity; as written, they overclaim.
  4. [Section 3 and 'Implications for Practitioners'] All experiments use untrained, randomly initialized networks. The authors justify this by noting that random GNNs are almost always maximally expressive (Amir et al., 2024) and that the bounds hold for all possible weights; that justifies the theory, but not the transfer of the empirical findings — which bit positions are dangerous, which activations are safer, which datasets are more vulnerable — to trained models. The manuscript is transparent about this (Section 4 defers training to future work), yet the "Implications for Practitioners" paragraph and the abstract's "actionable results" claim go beyond the evidence: recommendations such as switching from ReLU to SiLU or densifying one-hot features are based solely on untrained models, whose weight distribution (signs, magnitudes) can differ from trained models. A minimal empirical check on trained models (for the main effects: ReLU sign-bit susceptibility and the first-layer homophily/feature-dimension correlations) would materially strengthen the practical claims; otherwise those claims should be scoped explicitly to the untrained setting.
minor comments (7)
  1. [Lemma 3, proof] The first direction of the proof states the distinguishing condition as ⟨xu,wr⟩ ≥ 0 and ⟨xv,wr⟩ ≥ 0, while Lemma 3's statement requires ⟨xu,wr⟩ > 0 or ⟨xv,wr⟩ > 0; the two formulations should be harmonized.
  2. [Proposition 1, statement] The coefficients are written λ_x ∈ V, with V the domain vector space; they should be scalars (R or K). The conclusion "λ_x = 0 for all x ∈ A" should read "for all x ∈ S(A)", and the support set notation should be used consistently.
  3. [Corollary 1] Because the aggregation in Eq. (1) includes the node's own feature, a first-layer aggregate can have up to deg(v)+1 non-zero coordinates; the bound nz = min(2·d, n_{1,1}) should either use d+1 or state that d includes the self-loop, otherwise the stated bound is off by an additive constant.
  4. [Corollary 2] The estimate nzH = min(2·d·(1−H_D)·(1−P_D), n_{1,1}) multiplies a degree bound by two probabilities without derivation; the appendix proof largely restates the formula. This is a heuristic estimate rather than a proven bound and should be labeled as such or given a rigorous derivation.
  5. [Eq. (2) and Definition 2] The readout "∥_{k=0}^n" overloads n, which is also used for the number of graphs and the multiset cardinality bound, and the multiset union, intersection, and symmetric difference in Definition 2 are used without being defined explicitly.
  6. [Figure 3] The caption states that each bar group represents expressivity after 1% to 95% flips but does not explain how bar positions map to these percentages, which makes the quantitative content difficult to extract.
  7. [Section 3, metrics] The number of runs is stated as 101,250 in the caption of Figure 3 and as 20,250 clean models in the caption of Figure 1; the counting should be reconciled and explained in one place.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the central bounds are derived analytically from stated injectivity conditions and graph-theoretic definitions, with no fitted parameter or self-referential prediction.

full rationale

The central results (Theorems 1 and 2 and their corollaries) are derived from the formal definition of maximal expressivity (Definition 1), Lemma 2's row-wise condition for layer injectivity, and standard 1-WL theory. Theorem 1 constructs a concrete worst-case bit-flip strategy: zero the d_{j,i} weight elements in the coordinates where two extreme aggregates differ, in each of m_{j,i} rows, costing b flips per element. This is a direct combinatorial upper bound, not a quantity fitted from experiments. Theorem 2 composes this bound with the number e_j of WL-distinguishable node-embedding pairs in the hardest graph pair, again by construction rather than by calibration. The ReLU sign-bit reduction in Section 2.3 is a separate analytical claim; whether or not it is valid is a correctness question, not a circularity question. The paper's self-citations (Kummer et al., 2024) are used for motivation and related work, not as the proof engine; the injectivity and expressivity references (Xu et al., 2019; Amir et al., 2024; Puthawala et al., 2022) are external or independently proved lemmas. No fitted parameter is renamed as a prediction, and no uniqueness theorem from the authors' own prior work is invoked to force the chosen framework. The empirical section validates the theory via correlations (e.g., Spearman rho = 0.5209 between injectivity loss and expressivity loss) rather than determining it. Accordingly, no circular step can be exhibited, and the appropriate finding is no significant circularity (score 0).

Assumptions & free parameters 0 free parameters · 6 assumptions · 0 invented entities

The bounds rely on standard expressivity theory plus attacker-model and maximal-expressivity assumptions. No free parameters are fitted; the homophily ratio and connection probability in Corollary 2 are dataset statistics used as inputs, although their use inside a worst-case bound is heuristic.

assumptions (6)
  • domain assumption The GNN under attack is maximally expressive before the bit flips, meaning every layer sigma∘W is injective on the dataset's aggregate domain (Definition 1).
    Theorems 1 and 2, and the corollaries, are stated only for GNNs satisfying Definition 1. The experimental setup relies on the cited claim (Amir et al., 2024) that random initialization yields this property.
  • domain assumption The activation function is analytic and injective in Lemma 2; ReLU is treated separately in Lemma 3.
    The proof of Lemma 2 uses injectivity of sigma; the special-case analysis for ReLU is needed because ReLU is not injective.
  • domain assumption The input domain Q^{n_{j,i}} of each MLP layer is finite and bounded by the set of aggregates that actually occur on the dataset D.
    The bounds depend on the worst-case pair of aggregates in this finite set; without boundedness, the injectivity conditions and the exponent of the bounds would not hold.
  • domain assumption An attacker can flip arbitrary individual bits in chosen weight elements of the floating-point representation.
    The bit-flip counting assumes a strong adversary who can select specific bits (sign, exponent, or mantissa); the experiments approximate this with semi-random flips.
  • standard math 1-WL colors encode the isomorphism type of unfolding trees, so a GNN whose layers are injective and whose aggregation distinguishes a node from its neighbors is as expressive as 1-WL (Lemma 1).
    Background result from Xu et al. (2019), used to connect layer injectivity to expressivity.
  • domain assumption Randomly initialized GNNs are maximally expressive with high probability, so untrained networks are valid experimental proxies for the theory.
    Cited to Amir et al. (2024); the experiments do not train the models and thus presuppose this transfer.

how reviews work

0 comments
Cite this review

Pith. "Pith review of On the Relationship Between Robustness and Expressivity of Graph Neural Networks." pith.science (2026). https://pith.science/paper/WL2NFIKV

@misc{pith2026250413786,
  author       = {Pith},
  title        = {Pith review of: On the Relationship Between Robustness and Expressivity of Graph Neural Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WL2NFIKV}},
  note         = {Machine review of arXiv:2504.13786}
}
read the original abstract

We investigate the vulnerability of Graph Neural Networks (GNNs) to bit-flip attacks (BFAs) by introducing an analytical framework to study the influence of architectural features, graph properties, and their interaction. The expressivity of GNNs refers to their ability to distinguish non-isomorphic graphs and depends on the encoding of node neighborhoods. We examine the vulnerability of neural multiset functions commonly used for this purpose and establish formal criteria to characterize a GNN's susceptibility to losing expressivity due to BFAs. This enables an analysis of the impact of homophily, graph structural variety, feature encoding, and activation functions on GNN robustness. We derive theoretical bounds for the number of bit flips required to degrade GNN expressivity on a dataset, identifying ReLU-activated GNNs operating on highly homophilous graphs with low-dimensional or one-hot encoded features as particularly susceptible. Empirical results using ten real-world datasets confirm the statistical significance of our key theoretical insights and offer actionable results to mitigate BFA risks in expressivity-critical applications.

Figures

Figures reproduced from arXiv: 2504.13786 by the authors.

Figure 1
Figure 1. Visualization of µ ± σ of the metric M Π k 1 GNN,D (bottom) computed from the 20250 unperturbed (clean) models used in the attack runs for ReLU, Sigmoid, SiLU (top), aggregated across 3-layer GIN/GCN and DS. Note that the preceding formal analysis of the impact of homophily and attacks on the first layer might not extend to GAT, as the pre-transformation application of attention parameters and nonlinear transformati… view at source ↗
Figure 2
Figure 2. Significance levels of Spearman correlation of dataset properties [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Flips in exponent, sign and mantissa bits of Sigmoid, ReLU and SiLU activated 3-layer GIN/GCNs and [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

47 extracted references · 37 canonical work pages

  1. [1]

    Alvarez-Gonzalez, N., Kaltenbrunner, A., and G \'o mez, V. (2022). Beyond 1- WL with local ego-network encodings. In The First Learning on Graphs Conference

    work page 2022

  2. [2]

    Amir, T., Gortler, S., Avni, I., Ravina, R., and Dym, N. (2024). Neural injective functions for multisets, measures and graphs via a finite witness theorem. Advances in Neural Information Processing Systems , 36

    work page 2024

  3. [3]

    Apicella, A., Donnarumma, F., Isgr \`o , F., and Prevete, R. (2021). A survey on modern trainable activation functions. Neural Networks , 138:14--32

    2021

  4. [4]

    M., Ong, C

    Borgwardt, K. M., Ong, C. S., Sch \"o nauer, S., Vishwanathan, S., Smola, A. J., and Kriegel, H.-P. (2005). Protein function prediction via graph kernels. Bioinformatics , 21(suppl\_1):i47--i56

    work page 2005

  5. [5]

    Breier, J., Hou, X., Jap, D., Ma, L., Bhasin, S., and Liu, Y. (2018). Practical fault attack on deep neural networks. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security , page 2204–2206. Association for Computing Machinery

    work page 2018

  6. [6]

    and Wang, Y

    Cai, C. and Wang, Y. (2019). A simple yet effective baseline for non-attributed graph classification. ICLR 2019 workshop on Representation learning

    work page 2019

  7. [7]

    A., Bianchini, M., Sampoli, M

    D’Inverno, G. A., Bianchini, M., Sampoli, M. L., and Scarselli, F. (2021). A unifying point of view on expressive power of gnns. CoRR , abs/2106.08992

    arXiv 2021

  8. [8]

    Gao, J., Lyu, T., Xiong, F., Wang, J., Ke, W., and Li, Z. (2022). Predicting the survival of cancer patients with multimodal graph neural network. IEEE/ACM Transactions on Computational Biology and Bioinformatics , 19(2):699--709

    work page 2022

Show all 47 references
  1. [9]

    and Bengio, Y

    Glorot, X. and Bengio, Y. (2010). Understanding the difficulty of training deep feedforward neural networks. In Proceedings of the thirteenth international conference on artificial intelligence and statistics , pages 249--256. JMLR Workshop and Conference Proceedings

    2010

  2. [10]

    He, K., Zhang, X., Ren, S., and Sun, J. (2015). Delving deep into rectifiers: Surpassing human-level performance on imagenet classification. In Proceedings of the IEEE international conference on computer vision , pages 1026--1034

    2015

  3. [11]

    Hector, K., Moëllic, P.-A., Dumont, M., and Dutertre, J.-M. (2022). A closer look at evaluating the bit-flip attack against deep neural networks. In 2022 IEEE 28th International Symposium on On-Line Testing and Robust System Design , pages 1--5

    2022

  4. [12]

    Hu, W., Fey, M., Zitnik, M., Dong, Y., Ren, H., Liu, B., Catasta, M., and Leskovec, J. (2020). Open graph benchmark: Datasets for machine learning on graphs. Advances in neural information processing systems , 33:22118--22133

    2020

  5. [13]

    Jegelka, S. (2022). Theory of graph neural networks: Representation and learning. CoRR , abs/2204.07697

    2022 arXiv

  6. [14]

    Jiao, X., Wang, R., Lin, F., Moore, D., and Sankar, S. (2022). Assessing and analyzing the resilience of graph neural networks against hardware faults. CoRR , abs/2212.03475

    2022 arXiv

  7. [15]

    Jin, W., Li, Y., Xu, H., Wang, Y., Ji, S., Aggarwal, C., and Tang, J. (2021). Adversarial attacks and defenses on graphs. ACM SIGKDD Explorations Newsletter , 22(2):19--34

    2021

  8. [16]

    S., Mittal, S., Chandra, M., and Kaushik, A

    Khare, Y., Lakara, K., Inukonda, M. S., Mittal, S., Chandra, M., and Kaushik, A. (2022). Design and analysis of novel bit-flip attacks and defense strategies for dnns. In 2022 IEEE Conference on Dependable and Secure Computing , pages 1--8

    2022

  9. [17]

    Kummer, L., Moustafa, S., Schrittwieser, S., Gansterer, W., and Kriege, N. (2024). Attacking graph neural networks with bit flips: W eisfeiler and L eman go indifferent. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , pages 1428--1439

    2024

  10. [18]

    and Uddin, S

    Lu, H. and Uddin, S. (2021). A weighted patient network-based framework for predicting chronic diseases using graph neural networks. Scientific reports , 11(1):22607

    2021

  11. [19]

    Ma, J., Ding, S., and Mei, Q. (2020). Towards more practical adversarial attacks on graph neural networks. In Advances in Neural Information Processing Systems , volume 33, pages 4756--4766. Curran Associates, Inc

    2020

  12. [20]

    Morris, C., Fey, M., and Kriege, N. (2021). The power of the W eisfeiler- L eman algorithm for machine learning with graphs. In Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence, IJCAI-21 , pages 4543--4550. International Joint Conferences ...

    2021

  13. [21]

    M., Bause, F., Kersting, K., Mutzel, P., and Neumann, M

    Morris, C., Kriege, N. M., Bause, F., Kersting, K., Mutzel, P., and Neumann, M. (2020). TUD ataset: A collection of benchmark datasets for learning with graphs. In ICML 2020 Workshop on Graph Representation Learning and Beyond (GRL+ 2020)

    2020

  14. [22]

    M., Grohe, M., Fey, M., and Borgwardt, K

    Morris, C., Lipman, Y., Maron, H., Rieck, B., Kriege, N. M., Grohe, M., Fey, M., and Borgwardt, K. (2023). W eisfeiler and L eman go machine learning: The story so far. Journal of Machine Learning Research , 24(333):1--59

    2023

  15. [23]

    and Kim, J

    Mutlu, O. and Kim, J. S. (2019). Rowhammer: A retrospective. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems , 39(8):1555--1571

    2019

  16. [24]

    Neumann, M., Garnett, R., Bauckhage, C., and Kersting, K. (2016). Propagation kernels: efficient graph kernels from propagated information. Machine learning , 102:209--245

    2016

  17. [25]

    Puthawala, M., Kothari, K., Lassas, M., Dokmani \'c , I., and De Hoop, M. (2022). Globally injective relu networks. The Journal of Machine Learning Research , 23(1):4544--4598

    2022

  18. [26]

    Qian, C., Zhang, M., Nie, Y., Lu, S., and Cao, H. (2023). A survey of bit-flip attacks on deep neural network and corresponding defense methods. Electronics , 12(4):853

    2023

  19. [27]

    S., He, Z., and Fan, D

    Rakin, A. S., He, Z., and Fan, D. (2019). Bit-flip attack: Crushing neural network with progressive bit search. In 2019 IEEE/CVF International Conference on Computer Vision , pages 1211--1220

    2019

  20. [28]

    Rossi, R. A. and Ahmed, N. K. (2015). The network data repository with interactive graph analytics and visualization. In AAAI

    2015

  21. [29]

    A., Jin, D., Kim, S., Ahmed, N

    Rossi, R. A., Jin, D., Kim, S., Ahmed, N. K., Koutra, D., and Lee, J. B. (2020). On proximity and structural role-based embeddings in networks: Misconceptions, techniques, and applications. ACM Transactions on Knowledge Discovery from Data , 14(5):1--37

    2020

  22. [30]

    and Liebig, T

    Roth, A. and Liebig, T. (2024). Rank collapse causes over-smoothing and over-correlation in graph neural networks. In Villar, S. and Chamberlain, B., editors, Proceedings of the Second Learning on Graphs Conference , volume 231 of Proceedings of Machine Learning Research , pag...

    2024

  23. [31]

    Schomburg, I., Chang, A., and Schomburg, D. (2002). Brenda, enzyme data and metabolic information. Nucleic acids research , 30(1):47--49

    2002

  24. [32]

    H., Horv\' a th, T., Welke, P., and Wrobel, S

    Schulz, T. H., Horv\' a th, T., Welke, P., and Wrobel, S. (2022). A generalized W eisfeiler- L ehman graph kernel. Machine Learning , 111(7):2601–2629

    2022

  25. [33]

    J., Mehlhorn, K., and Borgwardt, K

    Shervashidze, N., Schweitzer, P., Van Leeuwen, E. J., Mehlhorn, K., and Borgwardt, K. M. (2011). W eisfeiler- L ehman graph kernels. Journal of Machine Learning Research , 12(9)

    2011

  26. [34]

    Sun, Y., Wang, S., Tang, X., Hsieh, T.-Y., and Honavar, V. (2020). Adversarial attacks on graph neural networks via node injections: A hierarchical reinforcement learning approach. page 673–683

    2020

  27. [35]

    Sun, Z., Yin, H., Chen, H., Chen, T., Cui, L., and Yang, F. (2021). Disease prediction via graph neural networks. IEEE Journal of Biomedical and Health Informatics , 25(3):818--826

    2021

  28. [36]

    Veličković, P., Cucurull, G., Casanova, A., Romero, A., Liò, P., and Bengio, Y. (2018). Graph attention networks. In International Conference on Learning Representations

    2018

  29. [37]

    B., Engelcke, M., Osborne, M

    Wagstaff, E., Fuchs, F. B., Engelcke, M., Osborne, M. A., and Posner, I. (2022). Universal approximation of functions on sets. J. Mach. Learn. Res. , 23:151:1--151:56

    2022

  30. [38]

    and Kipf, T

    Welling, M. and Kipf, T. N. (2016). Semi-supervised classification with graph convolutional networks. In International Conference on Learning Representations

    2016

  31. [39]

    Wu, B., Yuan, X., Wang, S., Li, Q., Xue, M., and Pan, S. (2023). Securing graph neural networks in mlaas: A comprehensive realization of query-based integrity verification. arXiv preprint arXiv:2312.07870

    2023 arXiv

  32. [40]

    Wu, L., Cui, P., Pei, J., Zhao, L., and Song, L. (2022). Graph Neural Networks: Foundations, Frontiers, and Applications . Springer

    2022

  33. [41]

    N., Gomes, J., Geniesse, C., Pappu, A

    Wu, Z., Ramsundar, B., Feinberg, E. N., Gomes, J., Geniesse, C., Pappu, A. S., Leswing, K., and Pande, V. (2018). Moleculenet: a benchmark for molecular machine learning. Chemical science , 9(2):513--530

    2018

  34. [42]

    Xiong, J., Xiong, Z., Chen, K., Jiang, H., and Zheng, M. (2021). Graph neural networks for automated de novo drug design. Drug Discovery Today , 26(6):1382--1393

    2021

  35. [43]

    Xu, K., Hu, W., Leskovec, J., and Jegelka, S. (2019). How powerful are graph neural networks? In 7th International Conference on Learning Representations

    2019

  36. [44]

    and Vishwanathan, S

    Yanardag, P. and Vishwanathan, S. (2015). Deep graph kernels. In Proceedings of the 21th ACM SIGKDD international conference on knowledge discovery and data mining , pages 1365--1374

    2015

  37. [45]

    S., and Fan, D

    Yao, F., Rakin, A. S., and Fan, D. (2020). Deephammer: Depleting the intelligence of deep neural networks through targeted chain of bit flips. In USENIX Security Symposium

    2020

  38. [46]

    Zaheer, M., Kottur, S., Ravanbakhsh, S., P \' o czos, B., Salakhutdinov, R., and Smola, A. J. (2017). Deep sets. In Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems , pages 3391--3401

    2017

  39. [47]

    Zopf, M. (2022). 1-wl expressiveness is (almost) all you need. In International Joint Conference on Neural Networks, IJCNN , pages 1--8. IEEE

    2022

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.