Pith. sign in

REVIEW 4 major objections 5 minor 50 references

Perturbing every hidden embedding unifies GNN adversarial training

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Adding perturbations directly to every hidden embedding of a GNN is claimed to subsume existing feature-, edge-, and weight-perturbation defenses, but the claim rests on simplifications that the experiments do not actually test.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection The 'unification' is a linearity observation, the experiments don't test the claimed method on GCN/GAT, and the empirical wins are not established; a plausible idea with overstated claims. the 4 major comments →

arxiv 2509.00387 v1 pith:ZW2PQZJ3 submitted 2025-08-30 cs.LG cs.AI

Unifying Adversarial Perturbation for Graph Neural Networks

Jinluan Yang , Ruihao Zhang , Zhengyu Chen , Fei Wu , Kun Kuang This is my paper
classification cs.LG cs.AI
keywords Graph Neural Networksadversarial trainingadversarial perturbationhidden embeddingsnode classificationrobustnessgeneralizationunified framework
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes PerturbEmbedding, a training-time method that adds perturbations directly to the hidden embeddings of a graph neural network at every layer. It argues that the three existing families of graph adversarial training—perturbing node features, perturbing edges, and perturbing weights—are special cases of this embedding perturbation, because each acts on the network only through the hidden representations. It also argues that random (non-targeted) and adversarial (targeted) perturbations can be treated within one framework. Across seven datasets and three backbone GNNs, the method reports consistent accuracy gains over the backbone and over existing adversarial training baselines. The value of the claim, if true, is that a single cheap intervention—disturbing hidden embeddings—replaces a set of specialized defense methods.

Core claim

The paper's central claim is that perturbing hidden embeddings is not just another defense but the common substrate of existing graph perturbation defenses. For message-passing GNNs, it gives linear identities: an edge perturbation ΔA changes the first embedding H^(0) into H^(0) + ΔA X W^(0); a feature perturbation ΔX changes H^(0) into H^(0) + A ΔX W^(0); a weight perturbation ΔW at layer l changes H^(l+1) into H^(l+1) + A H^(l) ΔW. Since each of these is an additive change to an embedding, PerturbEmbedding claims to subsume them. The method then perturbs every hidden embedding, using either random noise or a learned generator that maximizes task loss, and reports that this improves node cl

What carries the argument

The load-bearing object is the hidden embedding H^(l) of a GNN and the identity H^(l) = H^(l) + ΔH under a small perturbation. Equations (1)–(3) show, for linear message-passing layers, that an edge perturbation, a node-feature perturbation, and a weight perturbation each reduce to an additive ΔH on some hidden embedding. PerturbEmbedding treats H^(l) + ΔH as the universal training-time intervention, with ΔH drawn randomly (non-targeted) or produced by a small generator trained to maximize task loss (targeted). The generator is a learnable MLP; for edge perturbations it produces a soft mask whose top entries select edges to drop.

Load-bearing premise

The argument that PerturbNode, PerturbEdge, and PerturbWeight are special cases of PerturbEmbedding assumes a GNN layer without activation; under the ReLU nonlinearities actually used, the equality no longer holds exactly.

What would settle it

Take a trained one-layer GCN with ReLU, sample a random edge drop ΔA, and compute H_a = σ((A+ΔA)XW) and H_b = σ(AXW)+σ(ΔA XW). If for some ΔA the two post-activation embeddings differ by a non-negligible amount (say >1e-2), the Section 4.1 equality—and with it the exact claim that edge perturbation is a special case of additive embedding perturbation—is falsified for realistic nonlinear GNNs. The empirical claim would be settled by a held-out benchmark comparing PerturbEmbedding against FLAG and ADV_Train under identical attack budgets and random seeds.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • A single perturbation strategy, applied at hidden layers, can replace the separate design of feature-, edge-, and weight-perturbation defenses.
  • Random embedding noise, which is nearly free to compute, may offer most of the robustness benefit of targeted adversarial perturbations; the paper reports comparable results across 21 settings.
  • Because PerturbEmbedding is defined on the hidden embedding rather than on a specific input modality, it transfers across backbone architectures (GCN, GAT, LINKX) and across homophilous and heterophilous datasets.
  • Training time can be reduced: the method's reported per-epoch cost on Cora is close to plain GCN training, while gradient-based adversarial baselines are several times slower.
  • The framework turns adversarial training into a form of data augmentation that tends to produce more uniform embedding distributions, which the paper links to better generalization.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The equivalence in Section 4.1 is exact only for linear layers; in realistic GNNs with ReLU activations, an input-side perturbation and an additive embedding perturbation diverge. The practical method still makes sense as a stochastic regularizer, but the 'special case' claim should be read as an approximation.
  • If random embedding noise is indeed comparable to worst-case targeted perturbation, then the expensive generator can be dropped in many applications; a direct ablation across deeper networks would test this.
  • The latent-perturbation design suggests a transferable attack surface: defending hidden embeddings against additive noise may also bound how much influence any input-side attack can have, since all attacks must pass through the same representations.
  • Applying PerturbEmbedding at every layer, rather than only the first, may be important: first-layer-only latent adversarial training is a special case, and the paper's results suggest later layers matter; an extension could measure per-layer sensitivity.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes PerturbEmbedding, a unified adversarial/random perturbation framework for GNNs. The core idea is to inject random or adversarial perturbations directly into hidden embeddings rather than into node features, edges, or weights. The authors claim that existing PerturbNode, PerturbEdge, and PerturbWeight methods are special cases of PerturbEmbedding, and they report experiments on seven datasets using GCN, GAT, and LINKX to show that PerturbEmbedding improves robustness and generalization. The paper also presents a unified treatment of random (non-targeted) and adversarial (targeted) perturbations, along with efficiency and uniformity analyses.

Significance. If the claims were established, the paper would offer a simple, fast, and broadly applicable adversarial training method for GNNs, avoiding expensive PGD-style inner loops. The empirical breadth—seven datasets, three backbones, and both random and adversarial perturbation forms—is a genuine strength, and the efficiency comparison in Table 4 is useful. However, the central 'unification' claim is currently a linearized algebraic identity rather than a substantive theorem, and the main empirical claim is weakened by a mismatch between the described method and the evaluated method. The contribution as stated is not yet supported.

major comments (4)
  1. [Abstract/§1, Eq. (4), §5.1] The method as evaluated is not the method as described. The abstract and Eq. (4) state that PerturbEmbedding perturbs every hidden embedding, and §4.3 Eq. (14) repeats this. However, §5.1 says: 'For GCN and GAT, we apply PerturbEmbedding to the first layer output H(1) after graph convolution. For LINKX, we apply PerturbEmbedding to every hidden layer.' Thus Tables 2–3 and Figures 2–5 do not test the proposed every-layer method for GCN and GAT, the two message-passing backbones where the unification argument in §4.1 is supposed to apply. The central empirical claim of the paper is therefore untested for the main models.
  2. [§4.1, Eqs. (1)–(3), Appendix Eq. (17)] The equivalence derivations omit the nonlinear activation. The GCN forward pass in Appendix Eq. (17) is H(k)=σ(ÃH(k-1)(W(k-1))^T). Eq. (1) writes H(0)=(A+ΔA)XW(0)=AXW(0)+ΔAXW(0)=H(0)+ΔH, and Eq. (2) does the same for feature perturbations. With ReLU nonlinearity, (A+ΔA)XW(0) is not equal to AXW(0)+ΔH for the stated ΔH; the activation prevents the additive decomposition. The claimed 'special case' relationship is therefore not established for nonlinear networks. Moreover, for linear layers the reduction is definitional: any input perturbation induces a particular additive change in the embedding, so the unification claim carries limited independent content unless constraints on ΔH (norm, structure, layer index) are characterized.
  3. [Table 3 and §5.2] The comparison against baselines is not performed under a fixed protocol. The row 'GCN + PerturbEmbedding' in Table 3 is the per-dataset best of the random and adversarial variants from Table 2: Penn94 82.98 (random), Chameleon 68.51 (adversarial), Squirrel 56.52 (adversarial), Film 30.25 (random), Cora 88.13 (random), Citeseer 78.63 (adversarial), Pubmed 87.99 (random). Baselines are listed as single configurations. Selecting the better of two variants per dataset inflates the reported advantage and invalidates the claim that PerturbEmbedding 'outperforms all other methods in most datasets.'
  4. [Appendix B, Algorithm 1] Algorithm 1 updates both the generator and the GNN by 'descending its stochastic gradient,' but the generator in Eqs. (9)–(14) is supposed to maximize the task loss. The algorithm as written is inconsistent with the min-max objective and would train the generator to minimize instead of maximize the loss. This makes the adversarial variant irreproducible from the text.
minor comments (5)
  1. [§5.1, §5.2, §4.1] Typos and inconsistencies: §5.1 lists '4 heterophilous datasets Penn94, Chameleon, Squirrel and Chameleon' instead of 'Film'; §5.2 has 'adn'; §4.1 has 'PerturebNode'; §2.3 has 'to to'; §5.1 has 'different different'.
  2. [Appendix B, Eq. (20)] The citation for the PGD update is an empty bracket '[]'.
  3. [§5.3] The text says 'To answer RQ 3', but RQ3 in the introduction concerns component analysis; the robustness analysis actually addresses the robustness sub-question of RQ1/RQ2. The RQ numbering should be corrected.
  4. [§4.2/§4.3] The budgets δX, δA, δW, δH and the top-t percentage for edge dropping are not specified in the experimental setup. Without these values, the reported results cannot be reproduced.
  5. [§5.4, Table 2] Many reported differences between methods are within one standard deviation. The claim that PerturbEmbedding 'achieves optimal results in 34 settings' would be more convincing with significance tests or at least a clear statement of how ties and overlapping error bars were handled.

Circularity Check

0 steps flagged

No significant circularity: the unification is an algebraic reduction, not a fit, and the empirical claims rest on experiments.

full rationale

The paper's claimed derivation chain (Section 4.1) reduces PerturbNode/PerturbEdge/PerturbWeight to PerturbEmbedding by explicit linear algebra: for a message-passing layer without activation, an input perturbation ΔX induces hidden-embedding perturbation ΔH = AΔXW (Eq. 2), and similarly for ΔA (Eq. 1) and ΔW (Eq. 3). This is a genuine equivalence under the stated linear assumption, not a parameter fit or a renamed prediction; it does not use any fitted value to fabricate performance. The central empirical claim (PerturbEmbedding improves accuracy) is evaluated on held-out splits against external baselines (Tables 2-3), so it is independently testable. Self-citations appear only in related work/background (e.g., refs. [6,7,40,44]) and are not load-bearing for the method or its proof. No uniqueness theorem or ansatz is imported from the authors' prior work. A notable limitation exists — for GCN and GAT the experiments perturb only the first hidden layer (Section 5.1), so the 'every hidden embedding' claim is not fully tested — but this is a correctness/scope concern, not a circularity. The unification proof also assumes a linear layer (no ReLU), which limits its validity, but that is an accuracy-of-proof issue rather than circular reasoning. Overall, no equation reduces to its own input by construction in a way that manufactures the paper's conclusions.

Axiom & Free-Parameter Ledger

5 free parameters · 3 axioms · 0 invented entities

The central claims rest on the linearity of the layers being perturbed, the existence of an effective learned generator, and unspecified perturbation budgets. The paper provides no code or exact hyperparameters, so the empirical claims rest on unverifiable configuration choices.

free parameters (5)
  • δH (embedding perturbation budget)
    Bounds the random/adversarial embedding perturbation in Eq (8)/(14); value per dataset not reported.
  • δX (feature perturbation budget)
    Bounds random node perturbation in Eq (5); value not reported.
  • δA (edge perturbation budget)
    Bounds adversarial edge perturbation in Eq (10); value not reported.
  • δW (weight perturbation budget)
    Bounds weight perturbation in Eq (7)/(13); value not reported.
  • top-t percentage for edge dropping
    In Eq (12), selects the fraction of edges removed in adversarial edge perturbation; value not reported.
axioms (3)
  • domain assumption GNN layer is linear in the perturbed quantity (no activation function in the equivalence)
    Eqs (1)-(3) define H(0) = (A+ΔA)XW(0) etc. without σ, but GCN (Appendix Eq 17) uses ReLU. For nonlinear layers the additive equivalence fails.
  • standard math Aggregation is a linear function of the adjacency row
    The derivations assume H = AXW; this holds for GCN's normalized adjacency but not for attention-based aggregation in GAT, where perturbing edges or features changes attention weights.
  • domain assumption The generator MLP (Eq 11) yields effective targeted adversarial perturbations inside the norm ball
    The paper asserts that the soft mask generator provides worst-case perturbations, but gives no guarantee or analysis; effectiveness is only empirical.

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Unifying Adversarial Perturbation for Graph Neural Networks." pith.science (2026). https://pith.science/paper/ZW2PQZJ3

@misc{pith2026250900387,
  author       = {Pith},
  title        = {Pith review of: Unifying Adversarial Perturbation for Graph Neural Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZW2PQZJ3}},
  note         = {Machine review of arXiv:2509.00387}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

This paper studies the vulnerability of Graph Neural Networks (GNNs) to adversarial attacks on node features and graph structure. Various methods have implemented adversarial training to augment graph data, aiming to bolster the robustness and generalization of GNNs. These methods typically involve applying perturbations to the node feature, weights, or graph structure and subsequently minimizing the loss by learning more robust graph model parameters under the adversarial perturbations. Despite the effectiveness of adversarial training in enhancing GNNs' robustness and generalization abilities, its application has been largely confined to specific datasets and GNN types. In this paper, we propose a novel method, PerturbEmbedding, that integrates adversarial perturbation and training, enhancing GNNs' resilience to such attacks and improving their generalization ability. PerturbEmbedding performs perturbation operations directly on every hidden embedding of GNNs and provides a unified framework for most existing perturbation strategies/methods. We also offer a unified perspective on the forms of perturbations, namely random and adversarial perturbations. Through experiments on various datasets using different backbone models, we demonstrate that PerturbEmbedding significantly improves both the robustness and generalization abilities of GNNs, outperforming existing methods. The rejection of both random (non-targeted) and adversarial (targeted) perturbations further enhances the backbone model's performance.

Figures

Figures reproduced from arXiv: 2509.00387 by Fei Wu, Jinluan Yang, Kun Kuang, Ruihao Zhang, Zhengyu Chen.

Figure 1
Figure 1. Figure 1: Illustrations of PerturbEmbedding and other existing perturbation methods. Existing perturbation methods mainly [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Model performance against graph perturbations. We randomly add a certain ratio of edges into Citeseer. [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Model performance against graph perturbations. We randomly add a certain ratio of edges into Chameleon. [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Model Performances Against Meta Attacks (Perturbation rate = 5%). [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Model Performances Against PGD Attacks (Perturbation rate = 5%). [PITH_FULL_IMAGE:figures/full_fig_p008_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Distribution of node embedding distribution of [PITH_FULL_IMAGE:figures/full_fig_p008_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Distribution of node embedding distribution of [PITH_FULL_IMAGE:figures/full_fig_p008_7.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

50 extracted references · 34 canonical work pages · 4 internal anchors

  1. [1]

    Sami Abu-El-Haija, Bryan Perozzi, Amol Kapoor, Nazanin Alipourfard, Kristina Lerman, Hrayr Harutyunyan, Greg Ver Steeg, and Aram Galstyan. 2019. Mixhop: Higher-order graph convolutional architectures via sparsified neighborhood mixing. In ICML

    work page 2019

  2. [2]

    Anish Athalye, Nicholas Carlini, and David Wagner. 2018. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning . PMLR, 274–283

    work page 2018

  3. [3]

    Aleksandar Bojchevski and Stephan Günnemann. 2019. Adversarial attacks on node embeddings via graph poisoning. In International Conference on Machine Learning. PMLR, 695–704

    work page 2019

  4. [4]

    Joan Bruna, Wojciech Zaremba, Arthur Szlam, and Yann LeCun. 2013. Spectral net- works and locally connected networks on graphs. arXiv preprint arXiv:1312.6203 (2013)

    Pith/arXiv arXiv 2013

  5. [5]

    Zhengyu Chen, Sibo Gai, and Donglin Wang. 2019. Deep tensor factorization for multi-criteria recommender systems. In 2019 IEEE International Conference on Big Data (Big Data) . IEEE, 1046–1051

    work page 2019

  6. [6]

    Zhengyu Chen, Teng Xiao, and Kun Kuang. 2022. Ba-gnn: On learning bias- aware graph neural network. In 2022 IEEE 38th International Conference on Data Engineering (ICDE). IEEE, 3012–3024

    work page 2022

  7. [7]

    Zhengyu Chen, Teng Xiao, Kun Kuang, Zheqi Lv, Min Zhang, Jinluan Yang, Chengqiang Lu, Hongxia Yang, and Fei Wu. 2024. Learning to reweight for generalizable graph neural network. In Proceedings of the AAAI conference on artificial intelligence, Vol. 38. 8320–8328

    work page 2024

  8. [8]

    Zhengyu Chen, Ziqing Xu, and Donglin Wang. 2021. Deep transfer tensor decom- position with orthogonal constraint for recommender systems. In Proceedings of the AAAI Conference on Artificial Intelligence , Vol. 35. 4010–4018

    work page 2021

  9. [9]

    Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, and Le Song

  10. [10]

    Quanyu Dai, Xiao Shen, Liang Zhang, Qiang Li, and Dan Wang. 2019. Adversarial training methods for network embedding. In The World Wide Web Conference. 329–339

    work page 2019

  11. [11]

    Michaël Defferrard, Xavier Bresson, and Pierre Vandergheynst. 2016. Convolu- tional neural networks on graphs with fast localized spectral filtering. Advances in neural information processing systems 29 (2016)

    2016

  12. [12]

    Zhijie Deng, Yinpeng Dong, and Jun Zhu. 2019. Batch virtual adversarial training for graph convolutional networks. arXiv preprint arXiv:1902.09192 (2019)

    work page internal anchor Pith review Pith/arXiv arXiv 2019

  13. [13]

    Fuli Feng, Xiangnan He, Jie Tang, and Tat-Seng Chua. 2019. Graph adversarial training: Dynamically regularizing based on graph structure. IEEE Transactions on Knowledge and Data Engineering 33, 6 (2019), 2493–2504

    work page 2019

  14. [14]

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)

    Pith/arXiv arXiv 2014

  15. [15]

    Hongwei Jin and Xinhua Zhang. 2019. Latent adversarial training of graph convolution networks. In ICML workshop on learning and reasoning with graph- structured representations, Vol. 2

    work page 2019

  16. [16]

    Wei Jin, Yao Ma, Xiaorui Liu, Xianfeng Tang, Suhang Wang, and Jiliang Tang

  17. [17]

    Thomas N Kipf and Max Welling. 2016. Semi-supervised classification with graph convolutional networks. arXiv preprint arXiv:1609.02907 (2016)

    Pith/arXiv arXiv 2016

  18. [18]

    Kezhi Kong, Guohao Li, Mucong Ding, Zuxuan Wu, Chen Zhu, Bernard Ghanem, Gavin Taylor, and Tom Goldstein. 2020. Flag: Adversarial data augmentation for graph neural networks. (2020)

    work page 2020

  19. [19]

    Derek Lim, Felix Hohne, Xiuyu Li, Sijia Linda Huang, Vaishnavi Gupta, Omkar Bhalerao, and Ser Nam Lim. 2021. Large scale learning on non-homophilous graphs: New benchmarks and strong simple methods. Advances in Neural Infor- mation Processing Systems 34 (2021), 20887–20902

    work page 2021

  20. [20]

    Wei Liu, Zhiying Deng, Zhongyu Niu, Jun Wang, Haozhao Wang, YuanKai Zhang, and Ruixuan Li. 2024. Is the mmi criterion necessary for interpretability? degen- erating non-causal features to plain noise for self-rationalization. Advances in Neural Information Processing Systems 37 (2024), 117636–117656

    work page 2024

  21. [21]

    Wei Liu, Zhongyu Niu, Lang Gao, Zhiying Deng, Jun Wang, Haozhao Wang, and Ruixuan Li. 2025. Adversarial cooperative rationalization: The risk of spurious correlations in even clean datasets. arXiv preprint arXiv:2505.02118 (2025)

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  22. [22]

    Xiangwei Lv, Jingyuan Chen, Mengze Li, Yongduo Sui, Zemin Liu, and Beishui Liao. 2025. Grasp the Key Takeaways from Source Domain for Few Shot Graph Domain Adaptation. In Proceedings of the ACM on Web Conference 2025 . 2330– 2340

    work page 2025

  23. [23]

    Xiangwei Lv, Mengze Li, Jingyuan Chen, Zhiang Dong, Sirui Han, and Beishui Liao. 2025. Out-of-Distribution Detection via LLM-Guided Outlier Generation for Text-attributed Graph. InFindings of the Association for Computational Linguistics: ACL 2025. 19544–19555

    work page 2025

  24. [24]

    Xiangwei Lv, Guifeng Wang, Jingyuan Chen, Hejian Su, Zhiang Dong, Yumeng Zhu, Beishui Liao, and Fei Wu. 2025. Debiased Cognition Representation Learning for Knowledge Tracing. ACM Transactions on Information Systems (2025)

    work page 2025

  25. [25]

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017)

    Pith/arXiv arXiv 2017

  26. [26]

    Takeru Miyato, Andrew M Dai, and Ian Goodfellow. 2016. Adversarial training methods for semi-supervised text classification. arXiv preprint arXiv:1605.07725 (2016)

    Pith/arXiv arXiv 2016

  27. [27]

    Hongbin Pei, Bingzhe Wei, Kevin Chen-Chuan Chang, Yu Lei, and Bo Yang

  28. [28]

    Hao Peng, Ruitong Zhang, Shaoning Li, Yuwei Cao, Shirui Pan, and S Yu Philip

    work page

  29. [29]

    Benedek Rozemberczki, Carl Allen, and Rik Sarkar. 2021. Multi-scale attributed node embedding. Journal of Complex Networks 9, 2 (2021), cnab014

    2021

  30. [30]

    arXiv preprint arXiv:2002.05287 (2020)

    Geom-gcn: Geometric graph convolutional networks. arXiv preprint arXiv:2002.05287 (2020)

    Pith/arXiv arXiv 2002

  31. [31]

    Lichao Sun, Yingtong Dou, Carl Yang, Kai Zhang, Ji Wang, S Yu Philip, Lifang He, and Bo Li. 2022. Adversarial attack and defense on graph data: A survey. IEEE Transactions on Knowledge and Data Engineering (2022)

    work page 2022

  32. [32]

    Jie Tang, Jimeng Sun, Chi Wang, and Zi Yang. 2009. Social influence analysis in large-scale networks. In Proceedings of the 15th ACM SIGKDD international conference on Knowledge discovery and data mining . 807–816

    work page 2009

  33. [33]

    Amanda L Traud, Peter J Mucha, and Mason A Porter. 2012. Social structure of facebook networks. Physica A: Statistical Mechanics and its Applications 391, 16 (2012), 4165–4180

    work page 2012

  34. [34]

    Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dicker- son, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. 2019. Adversarial training for free! Advances in Neural Information Processing Systems 32 (2019)

    work page 2019

  35. [35]

    Petar Velickovic, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Lio, Yoshua Bengio, et al. 2017. Graph attention networks. stat 1050, 20 (2017), 10–48550

    2017

  36. [36]

    Tongzhou Wang and Phillip Isola. 2020. Understanding contrastive representation learning through alignment and uniformity on the hypersphere. In International Conference on Machine Learning . PMLR, 9929–9939

    work page 2020

  37. [37]

    Dongxian Wu, Shu-Tao Xia, and Yisen Wang. 2020. Adversarial weight pertur- bation helps robust generalization. Advances in Neural Information Processing Systems 33 (2020), 2958–2969

    work page 2020

  38. [38]

    Shikhar Vashishth, Soumya Sanyal, Vikram Nitin, and Partha Talukdar. 2019. Composition-based multi-relational graph convolutional networks.arXiv preprint arXiv:1911.03082 (2019)

    Pith/arXiv arXiv 2019

  39. [39]

    Haotian Xue, Kaixiong Zhou, Tianlong Chen, Kai Guo, Xia Hu, Yi Chang, and Xin Wang. 2021. CAP: Co-Adversarial Perturbation on Weights and Fea- tures for Improving Generalization of Graph Neural Networks. arXiv preprint arXiv:2110.14855 (2021)

    work page internal anchor Pith review Pith/arXiv arXiv 2021

  40. [40]

    Jinluan Yang, Zhengyu Chen, Teng Xiao, Yong Lin, Wenqiao Zhang, and Kun Kuang. 2025. Leveraging invariant principle for heterophilic graph structure distribution shifts. In Proceedings of the ACM on Web Conference 2025. 1196–1204

    work page 2025

  41. [41]

    Jinluan Yang, Anke Tang, Didi Zhu, Zhengyu Chen, Li Shen, and Fei Wu. 2024. Mitigating the backdoor effect for multi-task model merging via safety-aware subspace. arXiv preprint arXiv:2410.13910 (2024)

    Pith/arXiv arXiv 2024

  42. [42]

    Kaidi Xu, Hongge Chen, Sijia Liu, Pin-Yu Chen, Tsui-Wei Weng, Mingyi Hong, and Xue Lin. 2019. Topology attack and defense for graph neural networks: An optimization perspective. arXiv preprint arXiv:1906.04214 (2019)

    Pith/arXiv arXiv 2019

  43. [43]

    Junliang Yu, Hongzhi Yin, Xin Xia, Tong Chen, Lizhen Cui, and Quoc Viet Hung Nguyen. 2022. Are graph augmentations necessary? simple graph contrastive learning for recommendation. In Proceedings of the 45th international ACM SIGIR conference on research and development in information retrieval . 1294–1303

    work page 2022

  44. [44]

    Ruihao Zhang, Zhengyu Chen, Teng Xiao, Yueyang Wang, and Kun Kuang. 2024. Discovering invariant neighborhood patterns for heterophilic graphs. arXiv preprint arXiv:2403.10572 (2024)

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  45. [45]

    Dingyuan Zhu, Ziwei Zhang, Peng Cui, and Wenwu Zhu. 2019. Robust graph convolutional networks against adversarial attacks. In Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining . 1399–1407

    work page 2019

  46. [46]

    Zhilin Yang, William Cohen, and Ruslan Salakhudinov. 2016. Revisiting semi- supervised learning with graph embeddings. In ICML

    work page 2016

  47. [50]

    Unifying Adversarial Perturbation for Graph Neural Networks

    Daniel Zügner and Stephan Günnemann. 2019. Certifiable robustness and ro- bust training for graph convolutional networks. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining . 246– 256. Conference’17, July 2017, Washington, DC, USA Yang et al. This is the Appendix for “Unifying Adversarial Perturbation for G...

    work page 2019

  48. [2018]

    In International conference on machine learning

    Adversarial attack on graph structured data. In International conference on machine learning. PMLR, 1115–1124

    work page

  49. [2020]

    In Proceedings of the 26th ACM SIGKDD international conference on knowledge discovery & data mining

    Graph structure learning for robust graph neural networks. In Proceedings of the 26th ACM SIGKDD international conference on knowledge discovery & data mining. 66–74

  50. [2022]

    IEEE Transactions on Pattern Analysis and Machine Intelligence 45, 1 (2022), 980–998

    Reinforced, incremental and cross-lingual event detection from social messages. IEEE Transactions on Pattern Analysis and Machine Intelligence 45, 1 (2022), 980–998

    work page 2022

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.