Pith. sign in

REVIEW 3 major objections 5 minor 79 references

Robust Graph Learning Against Adversarial Evasion Attacks via Prior-Free Diffusion-Based Structure Purification

T0 review · 3 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read DiffSP claims a clean-graph-trained diffusion model can purify attacked graphs with no dataset or attack priors.

desk verdict Strong empirical purification results with public code, but both theoretical pillars (LID time mapping and transfer-entropy guidance) have load-bearing errors that need correction before the method is adopted as stated. read the letter →

arxiv 2502.05000 v1 pith:Y4ARX4DC submitted 2025-02-07 cs.LG cs.AI

Jiayi Luo , Qingyun Sun , Haonan Yuan , Xingcheng Fu , Jianxin Li This is my paper · ORCID
classification cs.LGcs.AI
keywords graphneuralnetworksadversarialevasionattacksstructurepurificationdiffusionmodelslocalintrinsicdimensionalitytransferentropyrobustlearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that adversarial evasion attacks on graph structure can be defeated without relying on any prior about the clean graph or the attack strategy. The proposal, DiffSP, trains a discrete graph diffusion model on clean graphs to learn their intrinsic distribution, then treats an attacked graph as a corrupted sample and purifies it through a forward noising step and a reverse denoising step. The forward noise is non-isotropic: edges attached to nodes with high Local Intrinsic Dimensionality, a measure of how many dimensions the local neighborhood around a node occupies and a signal of adversarial modification, are assigned longer purification times so clean structure is preserved. The reverse denoising is guided by a graph transfer-entropy term that keeps the generated graph semantically close to the target while adversarial edges are removed. If the central claim is right, a single clean-data-trained purification module yields the best average accuracy across five graph-classification and four node-classification datasets under nine evasion attacks, and it transfers across datasets.

What carries the argument

The load-bearing identity is Proposition 1, which maps non-isotropic transition noise to isotropic noise with a per-edge purification time. For an edge with adversarial degree $(\Lambda_A)_{ij}$, where $\Lambda_A=\Gamma\Gamma^\top$ is the outer product of per-node LID scores estimated from the last hidden layer of the clean-trained classifier, the non-isotropic transition element equals the isotropic transition at the unique time $\hat{t}(A_{ij}) = T\left(\frac{2(1+s)}{\pi}\cos^{-1}\sqrt{\frac{\bar\alpha^{(t)}}{(\Lambda_A)_{ij}(1-\bar\alpha^{(t)})+\bar\alpha^{(t)}}} - s\right)$. This lets a standard isotropic denoiser implement non-isotropic noise injection by activating each edge for a different number of denoising steps through a binary mask $M^{(t)}_{ij} = \mathbf{1}[t \le \hat{t}(A_{ij})]$. The other half is the graph transfer entropy guidance: transfer entropy $I(\hat{G}^{(t-1)}; G_{\mathrm{adv}} | \hat{G}^{(t)})$ is estimated with matrix-based Rényi entropy from normalized Gram matrices of node representations, and the adjacency is updated along $\nabla_{\hat A^{(t-1)}} I$ with time-dependent scale $-\lambda/(1-\bar\alpha^{(t)})$ to keep the generated graph aligned with the attacked graph's semantics while removing adversarial structure.

What would settle it

Measure the LID vector $\Gamma$ from the trained classifier's last hidden layer on any dataset in the paper, form $\Lambda_A=\Gamma\Gamma^\top$, and inspect the distribution of its entries; if a material fraction of edges falls outside $[0,1]$, the unique purification time of Proposition 1 is undefined for those edges. Then compare DiffSP with $\Lambda_A$ clamped to $[0,1]$ versus unclamped to see whether the range assumption affects accuracy.

Watch

Extended reading notes

Core claim

DiffSP's central claim is that a graph diffusion model trained only on clean graphs can act as a prior-free purifier for graphs attacked at test time. The paper models a clean graph as a distribution over nodes and edges; an evasion attack shifts the attacked graph away from that distribution. During purification the forward process injects noise selectively according to a per-edge adversarial degree $\Lambda_A=\Gamma\Gamma^\top$, where $\Gamma$ is the LID of each node computed from the last hidden layer of a clean-trained GNN classifier, so adversarial edges receive longer diffusion than clean ones. Proposition 1 proves that this non-isotropic noise is equivalent to isotropic noise with a per-edge diffusion time, so a standard isotropic denoiser can remove adversarial information by denoising each edge for its own duration. The reverse process then maximizes transfer entropy $I(\hat{G}^{(t-1)}; G_{\mathrm{adv}} | \hat{G}^{(t)})$, estimated through matrix-based Rényi entropy, to keep the purified graph semantically aligned with the attacked graph. The paper reports that this scheme achieves the best average robustness across nine datasets against nine evasion attacks, including 75.33% average accuracy on IMDB-BINARY versus the best baseline's 70.53%, and that a model trained on one IMDb dataset purifies another with only a small accuracy drop.

Load-bearing premise

The method assumes that the product of two nodes' local-dimensionality scores is always a number between 0 and 1 for every edge, and the paper neither enforces nor verifies that range.

Editorial extensions

If this is right

  • If DiffSP is right, robust graph learning no longer needs hand-picked priors such as homophily or low-rank structure; one clean-graph-trained diffusion model can learn the relevant distribution directly from data.
  • Because node features are kept fixed and only the adjacency is diffused, the method applies both to attributed graphs and to graphs without node features, such as IMDB-BINARY, REDDIT-BINARY, and PolBlogs.
  • The edge-specific purification schedule keeps accuracy stable as the total number of diffusion steps grows, since clean edges are not over-perturbed after their individual purification time has passed.
  • The method generalizes across datasets of the same category: training on IMDB-MULTI and purifying IMDB-BINARY loses only about one accuracy point on average compared with same-dataset training.
  • The paper's own analysis notes that DiffSP is strongest against strong structured attacks and weaker against Random and DICE perturbations, whose added edges often look plausible and lack a distinct adversarial signal.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper's experiments, the LID-derived $\Lambda_A$ can be evaluated directly as an edge-anomaly detector: if the edges assigned the longest purification times are exactly the edges the attack flipped, DiffSP's gain is largely targeted edge removal; if not, the gain comes from global re-sampling.
  • Because the transfer-entropy anchor is the attacked graph, the guidance is only as good as the attack's preservation of overall semantics; a natural untested extension is to anneal the anchor's influence or replace it with the clean-trained model's own reconstruction as denoising proceeds.
  • Since features are excluded from the diffusion process, the current formulation would likely need a second purification channel to handle feature-based attacks, which the paper lists as future work.
  • The complexity analysis places the method at $O(TN^2)$, so on graphs much larger than the tested ones the LID and Gram-matrix entropy computations would need sampling or approximation; the paper does not demonstrate scalability beyond these datasets.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes DiffSP, a framework for defending GNNs against adversarial evasion attacks by purifying graph structure with a discrete graph diffusion model. A graph diffusion model is trained on clean graphs only; at test time, the attacked graph is first subjected to an LID-driven non-isotropic forward diffusion process that injects more noise into edges deemed adversarial, then denoised with a graph transfer entropy guided reverse process intended to keep the purified graph semantically aligned with the target clean graph. Experiments cover five graph classification datasets and four node classification datasets under nine evasion attacks, with extensive baselines, ablations, cross-dataset generalization, and sensitivity studies. The reported results consistently show the highest average robustness on most datasets, and the paper releases code.

Significance. If the machinery is sound, this is a substantial empirical contribution: a single clean-data-trained diffusion module improves robustness across diverse datasets and attacks, and the paper provides a useful comparison with many baselines. The cross-dataset generalization experiments, ablation studies, and the explicit complexity analysis are commendable, and the clean-training/test-time-purification protocol is not circular. However, the two headline mechanisms rest on derivations in Appendices A.1 and A.2 that contain serious technical errors: the cosine-schedule monotonicity in the proof of Proposition 1 is reversed, the range assumption on the LID-based edge scores is unvalidated, and the conditional mutual information derivation replaces conditional entropy by ratios of joint entropies. These issues make the theoretical basis for both core contributions unreliable, so the manuscript needs substantial revision before the claims can be accepted.

major comments (3)
  1. [Appendix A.1, Eq. (4), Appendix D.4] The proof of Proposition 1 contains a factual error about the cosine schedule: it states α(0)=0 and α(T)=1 and claims α-bar is monotonically increasing, whereas for α-bar(t)=cos²((t/T+s)/(1+s)·π/2) we have α-bar(0)≈1, α-bar(T)=0, and α-bar is monotonically decreasing. The intermediate-value conclusion can probably be rescued by taking limits, so this error alone is not necessarily fatal. The load-bearing problem is the unexamined assumption Λ(A)_ij∈[0,1]. Since Λ=ΓΓ^T and Γ_i from Eq. (3) is a positive LID estimate that typically exceeds 1, Λ can be much larger than 1, and no normalization of Γ or Λ is reported in Appendix D.4 or Algorithm 1. For large Λ, the arccos argument in Eq. (4) tends to 0 and the purification time t-hat saturates near T for all edges, so the per-edge non-isotropic mask in Eq. (6) collapses to near-isotropic behavior. Given that the ablation in Figure 3 attributes a clear performance drop to removing this component, the authors must either provide a justified normalization of Γ/Λ to [0,1] or supply empirical evidence (e.g., the distribution of t-hat over edges and an ablation with normalized scores) that the mapping behaves as claimed.
  2. [Appendix A.2, Eq. (7), Eqs. (A.13)-(A.18)] The derivation of graph transfer entropy is invalid. Eq. (A.15) replaces H(Ĝ(t-1)|Ĝ(t)) with H(Ĝ(t-1), Ĝ(t))/H(Ĝ(t)) and H(Ĝ(t-1)|Ĝ(t), G_adv) with a ratio of joint entropies, but the definition of conditional entropy is H(X|Y)=H(X,Y)-H(Y), not a ratio. Consequently, Eq. (A.16)-(A.18) do not compute the conditional mutual information in Eq. (7). Since the reverse guidance update in Eq. (11) uses the negative gradient of this quantity, the derivation of the second core mechanism is unsupported. The authors should either correct the derivation or explicitly reframe the ratio expression as a heuristic surrogate and validate it empirically, for example by comparing it with an alternative guidance objective or by reporting its effect on purification quality without the entropy estimator.
  3. [Section 4.2, Eq. (5)] The notation around the noisy adjacency matrix in Eq. (5) is ambiguous in a way that affects reproducibility. The text says A(t) is obtained by A(t)=A·Q-bar_A^(t) in the forward process, but at test time the model is given G_adv=(X, A_adv), not a clean A. The purification procedure should specify explicitly that A(t) is computed from the attacked adjacency matrix A_adv. If instead the clean A is used somewhere in Eq. (5), the test-time protocol would be ill-defined. Please clarify this point, since the mask in Eq. (6) determines which edges are denoised at each reverse step.
minor comments (5)
  1. [Table 4] The header of the second block repeats "GCN (B→B)"; it should presumably read "GCN (M→M)" to be consistent with the other columns.
  2. [Keywords] The keyword "graph diffuison" contains a typo and should be "graph diffusion".
  3. [Appendix A.1] The heading "Propostition 1" contains a typo and should be "Proposition 1".
  4. [Abstract and Section 1] The claim of being "prior-free" is overstated: training a diffusion model on clean graphs is a generative prior over clean graph structure. The method is prior-free only in the narrower sense that it does not use attack-specific or dataset-specific hand-crafted priors. I recommend qualifying this terminology in the abstract and introduction.
  5. [Section 5.3] The cross-dataset generalization study uses IMDB-BINARY (2 classes) and IMDB-MULTI (3 classes) across label spaces. The interpretation should mention how the classifier and diffusion model are adapted between datasets with different numbers of classes, otherwise the comparison is difficult to interpret.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: DiffSP's central purification result is not forced by fitted constants or by self-citation, though the unverified Λ∈[0,1] range assumption in Proposition 1 is a correctness risk rather than a circularity.

full rationale

DiffSP's derivation chain is self-contained against external benchmarks. The diffusion model is trained on clean graphs via Eq. (13), the classifier is trained on clean labels via Eq. (12), and test-time purification is evaluated on held-out attacked graphs, so the reported robustness numbers are not fitted-to-target predictions. The LID-driven non-isotropic mechanism computes Γ from clean-trained classifier hidden features (Eq. 3) and forms ΛA = ΓΓ^T; the per-edge purification times in Eq. (4) follow from the paper's own SNR equality in Proposition 1. The proof assumes Λ(A)_ij ∈ [0,1] without normalization or empirical validation; this is an unverified modeling assumption and a legitimate correctness concern, but it is not a circular reduction because Λ is not fitted to the accuracy it is later used to explain. The transfer entropy guidance uses G_adv as a reference and a matrix-based Rényi entropy estimator; no target accuracy or test labels enter the guidance update. Self-citations [15, 47] appear only as related-work background and are not load-bearing: no uniqueness theorem, ansatz, or fitted constant is imported from the authors' prior work to force the central claim. The paper therefore exhibits no step in which a 'prediction' is equivalent, by construction, to its own input.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The method relies on several heuristic assumptions (LID validity, clean-trained embeddings, attack closeness) and five hyperparameters tuned per dataset. No new physical entities are introduced.

free parameters (5)
  • LID neighborhood size k = 4,6,6,8,8,7,8,8,8 for MUTAG, IMDB-B, IMDB-M, REDDIT-B, COLLAB, Cora, CiteSeer, PolBlogs, Photo
    Tuned per dataset (Table D.3); no validation-based selection procedure is reported.
  • guidance scale lambda = 1e1 to 1e3 depending on dataset
    Tuned per dataset (Table D.3); large values reduce accuracy and small values increase variance, per Sec 5.5.
  • purification steps T = 4,6,5,6,4,6,6,6,6 per dataset
    Tuned per dataset (Table D.3); all tested step counts work, with a mild accuracy trend.
  • kernel bandwidth sigma = 2
    Given in Sec D.4; the text says Silverman's rule is used, but the fixed value 2 is reported instead.
  • Renyi order alpha = 2
    Given in Sec D.4 as a fixed task-dependent parameter, no sensitivity analysis is provided.
assumptions (4)
  • domain assumption Manifold hypothesis: clean graph nodes lie on a low-dimensional natural manifold, and adversarial nodes deviate from it, increasing LID.
    Invoked in Sec 4.2 to justify the use of LID as the adversarial degree measure.
  • domain assumption The clean-trained classifier's last hidden layer provides a reliable embedding space for LID estimation.
    LID distances are computed from hidden features of the trained GNN, as stated in Sec 4.2.
  • domain assumption The attacked graph G_adv is semantically close to the target clean graph, so maximizing I(G_(t-1); G_adv | G_t) guides denoising toward the clean graph.
    Stated in Sec 4.3 as the basis for the transfer entropy guidance mechanism.
  • domain assumption A graph diffusion model trained on clean graphs captures the clean distribution well enough to purify perturbed structures.
    Core premise of the DiffSP framework (Sec 4.1); the paper does not provide a formal guarantee.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Robust Graph Learning Against Adversarial Evasion Attacks via Prior-Free Diffusion-Based Structure Purification." pith.science (2026). https://pith.science/paper/Y4ARX4DC

@misc{pith2026250205000,
  author       = {Pith},
  title        = {Pith review of: Robust Graph Learning Against Adversarial Evasion Attacks via Prior-Free Diffusion-Based Structure Purification},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/Y4ARX4DC}},
  note         = {Machine review of arXiv:2502.05000}
}
read the original abstract

Adversarial evasion attacks pose significant threats to graph learning, with lines of studies that have improved the robustness of Graph Neural Networks (GNNs). However, existing works rely on priors about clean graphs or attacking strategies, which are often heuristic and inconsistent. To achieve robust graph learning over different types of evasion attacks and diverse datasets, we investigate this problem from a prior-free structure purification perspective. Specifically, we propose a novel Diffusion-based Structure Purification framework named DiffSP, which creatively incorporates the graph diffusion model to learn intrinsic distributions of clean graphs and purify the perturbed structures by removing adversaries under the direction of the captured predictive patterns without relying on priors. DiffSP is divided into the forward diffusion process and the reverse denoising process, during which structure purification is achieved. To avoid valuable information loss during the forward process, we propose an LID-driven nonisotropic diffusion mechanism to selectively inject noise anisotropically. To promote semantic alignment between the clean graph and the purified graph generated during the reverse process, we reduce the generation uncertainty by the proposed graph transfer entropy guided denoising mechanism. Extensive experiments demonstrate the superior robustness of DiffSP against evasion attacks.

Figures

Figures reproduced from arXiv: 2502.05000 by the authors.

Figure 1
Figure 1. Comparison of existing robust GNNs and DiffSP. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The overall architecture of DiffSP. DiffSP first employs a diffusion model to learn the predictive patterns of clean [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Ablation Study 1 2 3 4 5 6 7 8 9 Time Steps 0 2 4 6 8 10 12 14 16 18 20 Purification Time (s) Purification Time 1 2 3 4 5 6 7 8 9 10 11 12 Time Steps 0 1 2 3 4 5 Purification Time (s) Purification Time 66 68 70 72 74 76 78 80 Accuracy (%) GradArgmax PR-BCD CAMA-Subgraph 66 68 70 72 74 76 78 80 Accuracy (%) GR-BCD PR-BCD MinMax Graph Classification (IMDB-B) Node Classification (Cora) [PITH_FULL_IMAGE:figures/full_fi… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

79 extracted references · 71 canonical work pages

  1. [1]

    Lada A Adamic and Natalie Glance. 2005. The political blogosphere and the 2004 US election: divided they blog. In LinkKDD. 36–43

    work page 2005

  2. [2]

    Laurent Amsaleg, Oussama Chelly, Teddy Furon, Stéphane Girard, Michael E Houle, Ken-ichi Kawarabayashi, and Michael Nett. 2015. Estimating local intrinsic dimensionality. In KDD. 29–38

    work page 2015

  3. [3]

    Jacob Austin, Daniel D Johnson, Jonathan Ho, Daniel Tarlow, and Rianne Van Den Berg. 2021. Structured denoising diffusion models in discrete state-spaces. NeurIPS 34 (2021), 17981–17993

    work page 2021

  4. [4]

    Sambaran Bandyopadhyay, Manasvi Aggarwal, and M Narasimha Murty. 2020. Hierarchically Attentive Graph Pooling with Subgraph Attention. In ICML

    work page 2020

  5. [5]

    Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Šrndić, Pavel Laskov, Giorgio Giacinto, and Fabio Roli. 2013. Evasion attacks against machine learning at test time. In ECML. Springer, Springer, 387–402

    work page 2013

  6. [6]

    Liang Chen, Jintang Li, Qibiao Peng, Yang Liu, Zibin Zheng, and Carl Yang

    work page

  7. [7]

    Tianyi Chen and Charalampos Tsourakakis. 2022. Antibenford subgraphs: Unsu- pervised anomaly detection in financial networks. In KDD. 2762–2770

    work page 2022

  8. [8]

    Xiaohui Chen, Jiaxing He, Xu Han, and Li-Ping Liu. 2023. Efficient and degree- guided graph generation via discrete diffusion modeling. In ICML. 4585–4610

    work page 2023

Show all 79 references
  1. [9]

    Yu Chen, Lingfei Wu, and Mohammed Zaki. 2020. Iterative deep graph learning for graph neural networks: Better and robust node embeddings. NeurIPS 33 (2020), 19314–19326

    2020

  2. [10]

    Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, and Le Song. 2018. Adversarial attack on graph structured data. In ICML. PMLR, 1115–1124

    2018

  3. [11]

    Chenhui Deng, Xiuyu Li, Zhuo Feng, and Zhiru Zhang. 2022. Garnet: Reduced- rank topology learning for robust and scalable graph neural networks. In LoG. PMLR, 3–1

    2022

  4. [12]

    Ivan Dokmanic, Reza Parhizkar, Juri Ranieri, and Martin Vetterli. 2015. Euclidean distance matrices: essential theory, algorithms, and applications. IEEE Signal Processing Magazine 32, 6 (2015), 12–30

    2015

  5. [13]

    Negin Entezari, Saba A Al-Sayouri, Amirali Darvishzadeh, and Evangelos E Papalexakis. 2020. All you need is low (rank) defending against adversarial attacks on graphs. In WSDM. 169–177

    2020

  6. [14]

    Reuben Feinman, Ryan R Curtin, Saurabh Shintre, and Andrew B Gardner. 2017. Detecting adversarial samples from artifacts. arXiv preprint arXiv:1703.00410 (2017)

    2017 arXiv

  7. [15]

    Xingcheng Fu, Yisen Gao, Yuecen Wei, Qingyun Sun, Hao Peng, Jianxin Li, and Xianxian Li. 2024. Hyperbolic Geometric Latent Diffusion Model for Graph Generation. In ICML

    2024

  8. [16]

    Yarin Gal and Zoubin Ghahramani. 2016. Dropout as a bayesian approximation: Representing model uncertainty in deep learning. In ICML. PMLR, 1050–1059

    2016

  9. [17]

    Simon Geisler, Tobias Schmidt, Hakan Şirin, Daniel Zügner, Aleksandar Bo- jchevski, and Stephan Günnemann. 2021. Robustness of graph neural networks at scale. NeurIPS 34 (2021), 7637–7649

    2021

  10. [18]

    Kilian Konstantin Haefeli, Karolis Martinkus, Nathanaël Perraudin, and Roger Wattenhofer. 2022. Diffusion models for graphs benefit from discrete state spaces. In NeurIPS

    2022

  11. [19]

    2008.Exploring network structure, dynamics, and function using NetworkX

    Aric Hagberg, Pieter Swart, and Daniel S Chult. 2008.Exploring network structure, dynamics, and function using NetworkX . Technical Report. Los Alamos National Lab.(LANL), Los Alamos, NM (United States)

    2008

  12. [20]

    Xiaotian Han, Zhimeng Jiang, Ninghao Liu, and Xia Hu. 2022. G-mixup: Graph data augmentation for graph classification. In ICML. PMLR, 8230–8248

    2022

  13. [21]

    Michael E Houle. 2017. Local intrinsic dimensionality I: an extreme-value- theoretic foundation for similarity applications. In SISAP. Springer, 64–79

    2017

  14. [22]

    Yeonjun In, Kanghoon Yoon, Kibum Kim, Kijung Shin, and Chanyoung Park

  15. [23]

    Yeonjun In, Kanghoon Yoon, and Chanyoung Park. 2023. Similarity preserving adversarial graph contrastive learning. In KDD. 867–878

    2023

  16. [24]

    Sergei Ivanov, Sergei Sviridov, and Evgeny Burnaev. 2019. Understanding iso- morphism bias in graph data sets. arXiv preprint arXiv:1910.12091 (2019)

    2019 arXiv

  17. [25]

    Wei Jin, Tyler Derr, Yiqi Wang, Yao Ma, Zitao Liu, and Jiliang Tang. 2021. Node similarity preserving graph convolutional networks. In WWW. 148–156

    2021

  18. [26]

    Wei Jin, Yao Ma, Xiaorui Liu, Xianfeng Tang, Suhang Wang, and Jiliang Tang

  19. [27]

    Jaehyeong Jo, Seul Lee, and Sung Ju Hwang. 2022. Score-based generative modeling of graphs via the system of stochastic differential equations. In ICML. PMLR, 10362–10383

    2022

  20. [28]

    Thomas N Kipf and Max Welling. 2016. Semi-supervised classification with graph convolutional networks. In ICLR

    2016

  21. [29]

    Jintang Li, Jie Liao, Ruofan Wu, Liang Chen, Zibin Zheng, Jiawang Dan, Changhua Meng, and Weiqiang Wang. 2023. GUARD: Graph universal adversarial defense. In CIKM. 1198–1207

    2023

  22. [30]

    Kuan Li, Yang Liu, Xiang Ao, and Qing He. 2023. Revisiting graph adversarial attack and defense from a data distribution perspective. In ICLR

    2023

  23. [31]

    Mufei Li, Eleonora Kreačić, Vamsi K Potluru, and Pan Li. 2023. Graphmaker: Can diffusion models generate large attributed graphs? arXiv (2023)

    2023

  24. [32]

    Yaxin Li, Wei Jin, Han Xu, and Jiliang Tang. 2020. Deeprobust: A pytorch library for adversarial attacks and defenses. arXiv (2020)

    2020

  25. [33]

    Yujia Li, Oriol Vinyals, Chris Dyer, Razvan Pascanu, and Peter Battaglia. 2018. Learning deep generative models of graphs. ICLR (2018)

    2018

  26. [34]

    Xiaorui Liu, Wei Jin, Yao Ma, Yaxin Li, Hua Liu, Yiqi Wang, Ming Yan, and Jiliang Tang. 2021. Elastic graph neural networks. In ICML. PMLR, 6837–6849

    2021

  27. [35]

    Gui-Fu Lu, Yong Wang, and Ganyi Tang. 2022. Robust low-rank representation with adaptive graph regularization from clean data. Applied Intelligence 52, 5 (2022), 5830–5840

    2022

  28. [36]

    Guanghui Ma, Chunming Hu, Ling Ge, and Hong Zhang. 2023. Multi-View Robust Graph Representation Learning for Graph Classification.. In IJCAI. 4037–4045

    2023

  29. [37]

    Xingjun Ma, Bo Li, Yisen Wang, Sarah M Erfani, Sudanthi Wijewickrema, Grant Schoenebeck, Dawn Song, Michael E Houle, and James Bailey. 2018. Characteriz- ing adversarial subspaces using local intrinsic dimensionality. In ICLR

    2018

  30. [38]

    Alexander Quinn Nichol and Prafulla Dhariwal. 2021. Improved denoising diffu- sion probabilistic models. In ICML. PMLR, 8162–8171

    2021

  31. [39]

    Chenhao Niu, Yang Song, Jiaming Song, Shengjia Zhao, Aditya Grover, and Stefano Ermon. 2020. Permutation invariant graph generation via score-based generative modeling. In AISTATS. PMLR, 4474–4484

    2020

  32. [40]

    Thomas Schreiber. 2000. Measuring information transfer. Physical review letters 85, 2 (2000), 461

    2000

  33. [41]

    Oleksandr Shchur, Maximilian Mumme, Aleksandar Bojchevski, and Stephan Günnemann. 2018. Pitfalls of graph neural network evaluation. arXiv (2018)

    2018

  34. [42]

    Yunsheng Shi, Zhengjie Huang, Shikun Feng, Hui Zhong, Wenjin Wang, and Yu Sun. 2020. Masked label prediction: Unified message passing model for semi- supervised classification. In IJCAI

    2020

  35. [43]

    Bernard W Silverman. 2018. Density estimation for statistics and data analysis . Routledge

    2018

  36. [44]

    Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli

  37. [45]

    Yang Song and Stefano Ermon. 2019. Generative modeling by estimating gradients of the data distribution. NeurIPS 32 (2019)

    2019

  38. [46]

    Lichao Sun, Yingtong Dou, Carl Yang, Kai Zhang, Ji Wang, S Yu Philip, Lifang He, and Bo Li. 2022. Adversarial attack and defense on graph data: A survey. TKDE 35, 8 (2022), 7693–7711

    2022

  39. [47]

    Qingyun Sun, Jianxin Li, Hao Peng, Jia Wu, Xingcheng Fu, Cheng Ji, and S Yu Philip. 2022. Graph structure learning with variational information bottleneck. In AAAI, Vol. 36. 4165–4174

    2022

  40. [48]

    Xianfeng Tang, Yandong Li, Yiwei Sun, Huaxiu Yao, Prasenjit Mitra, and Suhang Wang. 2020. Transferring robustness for graph neural network against poisoning attacks. In WWW. 600–608

    2020

  41. [49]

    Clement Vignac, Igor Krawczuk, Antoine Siraudin, Bohan Wang, Volkan Cevher, and Pascal Frossard. 2022. Digress: Discrete denoising diffusion for graph gener- ation. In ICLR

    2022

  42. [50]

    Vikram Voleti, Christopher Pal, and Adam Oberman. 2022. Score-based de- noising diffusion with non-isotropic gaussian noise models. arXiv preprint arXiv:2210.12254 (2022)

    2022 arXiv

  43. [51]

    Xin Wang, Heng Chang, Beini Xie, Tian Bian, Shiji Zhou, Daixin Wang, Zhiqiang Zhang, and Wenwu Zhu. 2023. Revisiting adversarial attacks on graph neural networks for graph classification. TKDE (2023)

    2023

  44. [52]

    Huijun Wu, Chen Wang, Yuriy Tyshetskiy, Andrew Docherty, Kai Lu, and Liming Zhu. 2019. Adversarial examples on graph data: Deep insights into attack and defense. In IJCAI

    2019

  45. [53]

    Junran Wu, Xueyuan Chen, Ke Xu, and Shangzhe Li. 2022. Structural entropy guided graph hierarchical pooling. In ICML. PMLR, 24017–24030

    2022

  46. [54]

    Shiwen Wu, Fei Sun, Wentao Zhang, Xu Xie, and Bin Cui. 2022. Graph neural networks in recommender systems: a survey. Comput. Surveys 55, 5 (2022), 1–37

    2022

  47. [55]

    Ying-Xin Wu, Xiang Wang, An Zhang, Xiangnan He, and Tat-Seng Chua. 2022. Discovering invariant rationales for graph neural networks. In ICLR

    2022

  48. [56]

    Aaron D Wyner. 1978. A definition of conditional mutual information for arbitrary ensembles. Information and Control 38, 1 (1978), 51–59

    1978

  49. [57]

    Hui Xu, Liyao Xiang, Jiahao Yu, Anqi Cao, and Xinbing Wang. 2021. Speedup robust graph structure learning with low-rank information. InCIKM. 2241–2250

    2021

  50. [58]

    Kaidi Xu, Hongge Chen, Sijia Liu, Pin-Yu Chen, Tsui Wei Weng, Mingyi Hong, and Xue Lin. 2019. Topology attack and defense for graph neural networks: An optimization perspective. In IJCAI

    2019

  51. [59]

    Zhilin Yang, William Cohen, and Ruslan Salakhudinov. 2016. Revisiting semi- supervised learning with graph embeddings. In ICML. PMLR, 40–48

    2016

  52. [60]

    Yuning You, Tianlong Chen, Yongduo Sui, Ting Chen, Zhangyang Wang, and Yang Shen. 2020. Graph contrastive learning with augmentations. NeurIPS 33 (2020), 5812–5823

    2020

  53. [61]

    Junchi Yu, Jie Cao, and Ran He. 2022. Improving subgraph recognition with variational graph information bottleneck. In CVPR. 19396–19405. WWW ’25, April 28-May 2, 2025, Sydney, NSW, Australia Jiayi Luo et al., Jiayi Luo, Qingyun Sun, Haonan Yuan, Xingcheng Fu, and Jianxin Li

    2022

  54. [62]

    Shujian Yu, Luis Gonzalo Sanchez Giraldo, Robert Jenssen, and Jose C Principe

  55. [63]

    Xi Yu, Xiang Gu, Haozhi Liu, and Jian Sun. 2024. Constructing non-isotropic Gaussian diffusion model using isotropic Gaussian diffusion model for image editing. NeurIPS 36 (2024)

    2024

  56. [64]

    Xiang Zhang and Marinka Zitnik. 2020. Gnnguard: Defending graph neural networks against adversarial attacks. NeurIPS 33 (2020), 9263–9275

    2020

  57. [65]

    Zhen Zhang, Jiajun Bu, Martin Ester, Jianfeng Zhang, Chengwei Yao, Zhi Yu, and Can Wang. 2019. Hierarchical graph pooling with structure learning. arXiv (2019)

    2019

  58. [66]

    Zhongjian Zhang, Xiao Wang, Huichi Zhou, Yue Yu, Mengmei Zhang, Cheng Yang, and Chuan Shi. 2024. Can Large Language Models Improve the Adversarial Robustness of Graph Neural Networks? arXiv (2024)

    2024

  59. [67]

    Jianan Zhao, Qianlong Wen, Mingxuan Ju, Chuxu Zhang, and Yanfang Ye. 2023. Self-supervised graph structure refinement for graph neural networks. In WSDM. 159–167

    2023

  60. [68]

    Zhe Zhao, Pengkun Wang, Haibin Wen, Yudong Zhang, Binwu Wang, and Yang Wang. 2024. Graph Networks Stand Strong: Enhancing Robustness via Stability Constraints. In ICASSP. IEEE, 7315–7319

    2024

  61. [69]

    Zhilun Zhou, Yu Liu, Jingtao Ding, Depeng Jin, and Yong Li. 2023. Hierarchi- cal knowledge graph learning enabled socioeconomic indicator prediction in location-based social network. In WWW. 122–132

    2023

  62. [70]

    Dingyuan Zhu, Ziwei Zhang, Peng Cui, and Wenwu Zhu. 2019. Robust graph convolutional networks against adversarial attacks. In KDD. 1399–1407

    2019

  63. [71]

    Daniel Zügner, Amir Akbarnejad, and Stephan Günnemann. 2018. Adversarial attacks on neural networks for graph data. In KDD. 2847–2856

    2018

  64. [72]

    Daniel Zügner and Stephan Günnemann. 2019. Adversarial Attacks on Graph Neural Networks via Meta Learning. In ICLR. A Proof and Derivation A.1 Proof of Proposition 1 We first restate Propostition 1. Proposition 1. For each edge at time 𝑡, the adjacency matrix is updated as A(𝑡...

    2019

  65. [78]

    It is known that(1− ¯𝛼) monotonically decreasing over the domain, while ¯𝛼 monotonically increasing, with 1− ¯𝛼 > 0 and ¯𝛼 > 0

    = 1. It is known that(1− ¯𝛼) monotonically decreasing over the domain, while ¯𝛼 monotonically increasing, with 1− ¯𝛼 > 0 and ¯𝛼 > 0. Therefore,𝑔(𝑡′) is a monotonic function over the domain. So we achieve: 𝑔(0) =(ΛA)𝑖𝑗(1− ¯𝛼(𝑡)) ¯𝛼(𝑡) − 0 > 0. (A.5) Having Λ(A)𝑖𝑗 ∈[ 0, 1] indic...

  66. [79]

    = 0. By setting 𝑔(𝑡′) = 0, we obtain: Λ(A)𝑖𝑗 ¯𝛼(𝑡′) 1− ¯𝛼(𝑡) = ¯𝛼(𝑡) 1− ¯𝛼(𝑡′) (A.9) ⇒ ¯𝛼(𝑡′) Λ(A)𝑖𝑗(1− ¯𝛼(𝑡))+ ¯𝛼(𝑡) = ¯𝛼(𝑡) (A.10) ⇒ ¯𝛼(𝑡′) = ¯𝛼(𝑡) Λ(A)𝑖𝑗(1− ¯𝛼(𝑡))+ ¯𝛼(𝑡) (A.11) ⇒𝑡′ =𝑇 2(1+𝑠) 𝜋 cos−1 √︄ ¯𝛼(𝑡) Λ(A)𝑖𝑗(1− ¯𝛼(𝑡))+ ¯𝛼(𝑡) ! −𝑠 ! . (A.12) This concludes the proof ...

    2025

  67. [2015]

    Deep unsupervised learning using nonequilibrium thermodynamics. In ICML. PMLR, 2256–2265

  68. [2019]

    TPAMI 42, 11 (2019), 2960–2966

    Multivariate Extension of Matrix-Based Rényi’s 𝛼-Order Entropy Func- tional. TPAMI 42, 11 (2019), 2960–2966

    2019

  69. [2020]

    Graph structure learning for robust graph neural networks. InKDD. 66–74

  70. [2021]

    In IJCAI

    Understanding structural vulnerability in graph convolutional networks. In IJCAI

  71. [2024]

    Self-Guided Robust Graph Structure Refinement. In WWW. 697–708

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.