Before revision:  In this paper, we formulate the problem of graph adversarial immunization as a bilevel optimization problem, i.e., vaccinating a fraction of node pairs, connected or unconnected, to improve the certifiable robustness of  graph against any admissible adversarial attack.
After revision:  In this paper, we formulate the problem of graph adversarial immunization as a bilevel optimization problem, i.e., vaccinating a fraction of node pairs, connected or unconnected, to improve the certifiable robustness of the graph against any admissible adversarial attack.