reviews: 
Comments: The paper provides some analysis of the robustness of various GNNs and present a unified perspective to understand their strengths and limitations.  The paper identifies an issue with estimation bias in $\ell_1$-based robust graph smoothing and proposes a robust and unbiased graph signal estimator to address this bias. The Quasi-Newton IRLS algorithm is introduced, which can be integrated into GNNs as feature aggregation layers.
Strengths: 1. The paper provides some analysis of the robustness of various GNNs, offering valuable insights into their performance under adversarial attacks.

2.  The introduction of the Quasi-Newton IRLS algorithm, which can be integrated into GNNs as feature aggregation layers, is both innovative and practical.
Weaknesses: 1. The paper posits that $\ell_1$-based robust estimation introduces an estimation bias, which purportedly deteriorates model performance, especially when an attacker adds heterophilic edges. This foundational claim lacks clarity and remains unproven. The assertion that the unveiled estimation bias explains the significant performance degradation under large attack budgets is inadequately substantiated.

In the numerical simulations, "clean samples" and "outlier samples" are generated using a Gaussian distribution. This illustration raises concerns.

- The designation of red dots as outliers is perplexing. There's no discernible reason to not categorize the red dots as clean samples. If we were to accept this alternate categorization, the entire example would be questionable.  Furthermore, when the third plot indicates that 80\% of the data are outliers, the persistence of the estimation at the center of the blue dots raises concerns. Such behavior might be influenced by factors not elaborated upon in the paper. Consequently, it's premature to commend this as a positive outcome of the proposed method.


- The proposed method offers only a rudimentary approximation of one step in GNN aggregation (7). Even if the example were valid, it doesn't convincingly demonstrate robustness in GNNs. Given that $W^k$ fundamentally varies for each $k$, there's no assurance that the single-step gradient descent aligns with the theorem.

2. The computation of $W$ in eq(7) remains ambiguous. How exactly is it derived?

3. The statement "which not only provides clear interpretability but also covers many classic GNNs as special cases" is misleading. The term "covers" is inappropriate. The paper doesn't truly encompass classic GNNs as special cases but rather offers an approximate perspective on them through the lens of Graph Signal processing.

4. The paper's limitations are not adequately addressed. Like other defense papers aiming to prune the influence of heterophilic edges, this method likely has restricted applicability, perhaps being best suited for datasets that inherently assume homophily.

5. A glaring omission is the lack of reported computational costs. This oversight leaves readers questioning the practical feasibility of the proposed approach.

6. The experimental section is inadequate. The range of attacks considered is also severely limited. It is imperative to incorporate evaluations against poison and evasion attacks, as well as both white-box and black-box scenarios, and to consider both injection and modification types.
Recommendation: 5: marginally below the acceptance threshold
Reviewer confidence: 4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness/correctness: 2 fair
Clarity: 3 good