SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Kai Zhao*
Qiyu Kang*†
Yang Song*
C3 AI, Singapore
Rui She
Sijie Wang
Wee Peng Tay
Graph neural networks (GNNs) are vulnerable to adversarial perturbations, including those that affect both node features and graph topology. This paper investigates GNNs derived from diverse neural flows, concentrating on their connection to various stability notions such as BIBO stability, Lyapunov stability, structural stability, and conservative stability. We argue that Lyapunov stability, despite its common use, does not necessarily ensure adversarial robustness. Inspired by physics principles, we advocate for the use of conservative Hamiltonian neural flows to construct GNNs that are robust to adversarial attacks. The adversarial robustness of different neural flow GNNs is empirically compared on several benchmark datasets under a variety of adversarial attacks. Extensive numerical experiments demonstrate that GNNs leveraging conservative Hamiltonian flows with Lyapunov stability substantially improve robustness against adversarial perturbations. The implementation code of experiments is available at https://github.com/zknus/NeurIPS-2023-HANG-Robustness.
Graph neural networks (GNNs) [1-8] have achieved great success in inference tasks involving graph-structured data, including applications from social media networks, molecular chemistry, and mobility networks. However, GNNs are known to be vulnerable to adversarial attacks [9]. To fool a trained GNN, adversaries can either add new nodes to the graph during the inference phase or remove/add edges from/to the graph. The former is called an injection attack [10-13], and the latter is called a modification attack [14-16]. In some works [9, 17], node feature perturbations are also considered to enable stronger modification attacks.
Neural ordinary differential equation (ODE) networks [18] have recently gained popularity due to their inherent robustness [19-24]. Neural ODEs can be considered as a continuous analog of ResNet [25]. Many neural ODE networks have since been proposed, including but not limited to [19, 20, 26-28]. Using neural ODEs, we can constrain the input and output of a neural network to follow certain physics laws. Injecting physics constraints to black-box neural networks improves neural networks' explainability. More recently, neural ODEs have also been successfully applied to GNNs by modeling
*First three authors contributed equally to this work.
†Correspondence to: Qiyu Kang <kang0080@e.ntu.edu.sg>
the way nodes exchange information given the adjacency structure of the underlying graph. We call them graph neural flows which enables the interpretation of GNNs as evolutionary dynamical systems. These system equations can be learned by instantiating them using neural ODEs [29-34]. For instance, [29, 30] models the message-passing process, i.e., feature exchanges between nodes, as the heat diffusion, while [31, 32] model the message passing process as the Beltrami diffusion. The reference [35] models the graph nodes as coupled oscillators with a coupled oscillating ODE guiding the message-passing process.
Although adversarial robustness of GNNs has been investigated in various works, including [9, 13, 17], robustness study of graph neural flows is still in its fancy. To the best of our knowledge, only the recent paper [32] has started to formulate theoretical insights into why graph neural diffusion is generally more robust against topology perturbation than conventional GNNs. The concept of Lyapunov stability was used in [20, 21]. However, there are many different notions of stability in the dynamic system literature [36, 37]. In this paper, we focus on the study of different notions of stability for graph neural flows and investigate which notion is most strongly connected to adversarial robustness. We impose an energy conservation constraint on graph neural flows that lead to a Hamiltonian graph neural flow. We find that energy-conservative graph Hamiltonian flows endowed with Lyapunov stability improve the robustness the most as compared to other existing stable graph neural flows.
Main contributions. This research is centered on examining various stability notions within the realm of graph neural flows, especially as they relate to adversarial robustness. Our main contributions are summarized as follows:
1. We revisit the definitions of stability from the perspective of dynamical systems as applicable to graph neural flows. We argue that vanilla Lyapunov stability does not necessarily confer adversarial robustness and provide a rationale for this observation.
2. We propose Hamiltonian-inspired graph neural ODEs, noted for their energy-conservative nature. We perform comprehensive numerical experiments to verify their performance on standard benchmark datasets. Crucially, our results demonstrate that Hamiltonian flow GNNs present enhanced robustness against various adversarial perturbations. Moreover, it is found that the effectiveness of Lyapunov stability becomes pronounced when layered on top of Hamiltonian flow GNNs, thereby fortifying their adversarial robustness.
The rest of this paper is organized as follows. We introduce various stability notions from a dynamical system perspective in Section 2. A review of existing graph neural flows is presented in Section 3 with links to the stability notions defined in Section 2. We present a new type of graph neural flow inspired by the Hamiltonian system with energy conservation in Section 4. Two different variants of this model are proposed in Section 5. Section 6 details our extensive experimental outcomes. The supplementary section provides an overview of related studies, an exhaustive outline of the algorithm, further insights into model robustness, supplementary experimental data, and the proofs for the theoretical propositions made throughout the paper.
2 Stability in Dynamical Systems
It is well known that a small perturbation at the input of an unstable dynamical system will result in a large distortion in the system's output. In this section, we first introduce various types of stability in dynamical physical systems and then relate them to graph neural flows. We consider the evolution of a dynamical system that is described as the following autonomous nonlinear differential equation:
$$
\frac {\mathrm {d} \mathbf {z} (t)}{\mathrm {d} t} = f _ {\boldsymbol {\theta}} (\mathbf {z} (t)), \tag {1}
$$
where  $f_{\theta}:\mathbb{R}^n\to \mathbb{R}^n$  denotes the system dynamics, which may be non-linear in general,  $\pmb{\theta}$  denotes the system parameters, and  $\mathbf{z}:[0,\infty)\rightarrow \mathbb{R}^n$  represents the  $n$ -dimensional system state.
We first introduce the stability notions from a dynamical systems perspective that is related to the GNN robustness against node feature perturbation.
Definition 1 (BIBO stability). The system is called BIBO (bounded input bounded output) stable if for any bounded input, there exists a constant  $M$  s.t. the output  $\| \mathbf{z}(t)\| < M,\forall t\geq 0$
Suppose  $f$  has an equilibrium at  $\mathbf{z}_e$  so that  $f_{\theta}(\mathbf{z}_e) = 0$ . We can define the stability notion for  $\mathbf{z}_e$ .
Definition 2 (Lyapunov stability and asymptotically stable [38]). The equilibrium  $\mathbf{z}_e$  is Lyapunov stable if for every  $\epsilon >0$ , there exists a  $\delta >0$  such that, if  $\| \mathbf{z}(0) - \mathbf{z}_e\| < \delta$ , then for every  $t\geq 0$  we have  $\| \mathbf{z}(t) - \mathbf{z}_e\| < \epsilon$ . Furthermore, the equilibrium point  $\mathbf{z}_e$  is said to be asymptotically stable if it is Lyapunov stable and there exists a  $\delta^{\prime} > 0$  such that if  $\| \mathbf{z}(0) - \mathbf{z}_e\| < \delta^\prime$ , then  $\lim_{t\to \infty}\| \mathbf{z}(t) - \mathbf{z}_e\| = 0$ .
Remark 1. Lyapunov stability indicates that the solutions whose initial points are near an equilibrium point  $\mathbf{z}_e$  stay near  $\mathbf{z}_e$  forever. For the special linear time-invariant system  $\mathrm{d}\mathbf{z}(t) / \mathrm{d}t = \mathbf{A}\mathbf{z}(t)$  with a constant matrix  $\mathbf{A}$ , it is Lyapunov stable if and only if all eigenvalues of  $\mathbf{A}$  have non-positive real parts and those with zero real parts are the simple roots of the minimal polynomial of  $\mathbf{A}$  [39, 40]. Asymptotically stable means that not only do trajectories stay near  $\mathbf{z}_e$  for all time (Lyapunov stability), but trajectories also converge to  $\mathbf{z}_e$  as time goes to infinity (asymptotic stability).
We next introduce the concept of structural stability from dynamical systems theory, which is related to the robustness of GNNs against graph topological perturbation. It describes the sensitivity of the qualitative features of a solution to changes in parameters  $\theta$ . The definition of structural stability requires the introduction of a topology on the space of  $\mathbf{z}$  in (1), which we do not however present here rigorously due to space constraints and not to distract the reader with too much mathematical details. Instead, we provide a qualitative description of structural stability to elucidate how it can indicate the robustness of a graph neural flow against topology perturbations.
Definition 3 (Structural stability). Unlike Lyapunov stability, which considers perturbations of initial conditions for a fixed  $f_{\theta}$ , structural stability deals with perturbations of the dynamic function  $f_{\theta}$  by perturbing the parameter  $\theta$ . The qualitative behavior of the solution is unaffected by small perturbations of  $f_{\theta}$  in the sense that there is a homeomorphism that globally maps the original solution to the solution under perturbation.
Remark 2. In the graph neural flows to be detailed in Section 3 and Section 4, the parameter  $\theta$  includes the graph topology (i.e., the adjacency matrix) and learnable neural network weights. Unlike adversarial attacks on other deep learning neural networks where the attacker targets only the input  $\mathbf{z}$ , it is worth noting that adversaries for GNNs can also attack the graph topology, which forms part of  $\theta$ . If there are different Lyapunov stable equilibrium points, one for each class of nodes, one intuitive example of breaking structural stability in graph neural flows is by perturbing the graph topology in such a way that there are strictly fewer equilibrium points than the number of classes.
In this study, we will propose GNNs drawing inspiration from Hamiltonian mechanics. In a Hamiltonian system,  $\mathbf{z} = (q,p)\in \mathbb{R}^{2n}$  refers to the generalized coordinates, with  $q$  and  $p$  corresponding to the generalized position and momentum, respectively. The dynamical system is characterized by the following nonlinear differential equation:
$$
\frac {\mathrm {d} \mathbf {z} (t)}{\mathrm {d} t} = J \nabla H (\mathbf {z} (t)), \tag {2}
$$
where  $\nabla H(\mathbf{z})$  is the gradient of a scalar function  $H$  at  $\mathbf{z}$  and  $J = \left( \begin{array}{cc}0 & I\\ -I & 0 \end{array} \right)$  is the  $2n\times 2n$  skew-symmetric matrix with  $I$  being the  $n\times n$  identity matrix.
We now turn our attention to the notion of conservative stability in dynamical systems. It is worth noting that a general dynamical system, as characterized in (1), might not consistently resonate with traditional perspectives on energy and conservation, especially when compared to physics-inspired neural networks, like (2).
Definition 4 (Conservative stability). In a dynamical system inspired by physical principles, such as (2), a conserved quantity might be present. This quantity, which frequently embodies the notion of the system's energy, remains invariant along the system's evolution trajectory  $\mathbf{z}(t)$ .
Our focus in this work is on graph neural flows that can be described by either (1) or (2). Chamberlain et al. [29] postulate that many GNN architectures such as GAT can be construed as discrete versions of (1) via different choices of the function  $f_{\theta}$  and discretization schemes. Therefore, the stability definitions provided above can offer additional insights into many popular GNNs. Most existing graph neural flows only scrutinize the BIBO/Lyapunov stability of their system. For instance, GRAND [29] proposes BIBO/Lyapunov stability against node feature perturbation over  $\mathbf{z}$ . However, the more fundamental structural stability in graph neural flows, which is related to the robustness against graph topological changes, remains largely unexplored. Some models, such as GraphCON [29,35], exhibit conservative stability under certain conditions. We direct the reader to Section 3 and Table 1 for a comprehensive discussion of the stability properties of each model.
3 Existing Graph Neural Flows and Stability
Consider an undirected, weighted graph  $\mathcal{G} = (\mathcal{V},\mathcal{E})$  where  $\mathcal{V}$  is a finite set of vertices and  $\mathcal{E}\subset \mathcal{V}\times \mathcal{V}$  denotes the set of edges. The adjacency matrix of the graph is denoted as  $(\mathbf{W}[u,v]) = \mathbf{W}([v,u])$  for all  $[u,v]\in \mathcal{E}$ . Let  $\mathbf{X}(t)\in \mathbb{R}^{|\mathcal{V}|\times r}$  represent the features associated with the vertices at time  $t$ . The feature vector for the  $i$ -th node in  $\mathcal{V}$  at time  $t$  can be represented as the  $i$ -th row of  $\mathbf{X}(t)$ , indicated by  $\mathbf{x}_i^\top (t)$ . In this section, we introduce several graph neural flows on  $\mathcal{G}$ , categorizing them according to the stability concepts outlined in Section 2.
GRAND: Inspired by the heat diffusion equation, GRAND [29] employs the following dynamical system:
$$
\frac {\mathrm {d} \mathbf {X} (t)}{\mathrm {d} t} = \overline {{\mathbf {A}}} _ {G} (\mathbf {X} (t)) \mathbf {X} (t) := \left(\mathbf {A} _ {G} (\mathbf {X} (t)) - \alpha \mathbf {I}\right) \mathbf {X} (t), \tag {3}
$$
with the initial condition  $\mathbf{X}(0)$ . Within this model,  $\mathbf{A}_G(\mathbf{X}(t))$  is either a time-invariant static matrix, represented as GRAND-l, or a trainable time-variant attention matrix ( $a_G(\mathbf{x}_i(t),\mathbf{x}_j(t))$ ), labeled as GRAND-nl, reflecting the graph's evolutionary features. The function  $a_{G}(\cdot)$  calculates similarity for pairs of vertices, and  $\mathbf{I}$  is an identity matrix with dimensions that fit the context. In [29],  $\alpha$  is set to be 1. Let  $\mathbf{D}$  be the diagonal node degree matrix where  $\mathbf{D}[u,u] = \sum_{v\in \mathcal{V}}\mathbf{W}[u,v]$ .
Theorem 1. We can prove the following stability:
1). For GRAND-nl, if the attention matrix  $\mathbf{A}_G(\mathbf{X}(t))$  is set as a doubly stochastic attention [41], we have BIBO stability and Lyapunov stability for any  $\alpha \geq 1$ . When  $\alpha > 1$ , it reaches global asymptotic stability under any perturbation.
2). Within the GRAND-l setting, if  $\mathbf{A}_G$  is set as a constant column- or row-stochastic matrix, such as the normalized adjacency matrices  $\mathbf{W}\mathbf{D}^{-1}$  or  $\mathbf{D}^{-1}\mathbf{W}$ , global asymptotic stability is achieved for  $\alpha > 1$  under any perturbation. If the graph is additionally assumed to be strongly connected [42][Sec.6.3], BIBO and Lyapunov stability are realized for  $\alpha = 1$ .
3). Furthermore, when  $\mathbf{A}_G$  is specifically a constant column-stochastic matrix like  $\mathbf{W}\mathbf{D}^{-1}$  and  $\alpha = 1$ , GRAND conserves a quantity that can be interpreted as energy. Furthermore, in this setting, asymptotic stability is attained when the graph is aperiodic and strongly connected and the perturbations on  $\mathbf{X}(0)$  ensure unaltered column summations.
BLEND: In comparison to GRAND, BLEND [31] introduces the use of positional encodings. Following a similar line of reasoning to that used for GRAND, BLEND also exhibits BIBO/Lyapunov stability as stated in Theorem 1. Moreover, it is noteworthy that if positional features  $\mathbf{U}(t)$  are eliminated, for instance by setting them as a constant, BLEND simplifies to the GRAND model.
GraphCON: Inspired by oscillator dynamical systems, GraphCON is a graph neural flow proposed in [35] and defined as
$$
\left\{ \begin{array}{l} \frac {\mathrm {d} \mathbf {Y} (t)}{\mathrm {d} t} = \sigma \left(\mathbf {F} _ {\theta} (\mathbf {X} (t), t)\right) - \gamma \mathbf {X} (t) - \alpha \mathbf {Y} (t), \\ \frac {\mathrm {d} \mathbf {X} (t)}{\mathrm {d} t} = \mathbf {Y} (t), \end{array} \right. \tag {4}
$$
where  $\mathbf{F}_{\theta}(\cdot)$  is a learnable 1-neighborhood coupling function,  $\mathbf{Y}(t)$  is an auxiliary velocity variable,  $\sigma$  denotes an activation function, and  $\gamma$  and  $\alpha$  are tunable parameters.
As described in [35, Proposition 3.1], under specific settings where  $\sigma$  is the identity function and  $\mathbf{F}_{\theta}(\mathbf{X}(t), t) = \mathbf{A}\mathbf{X}(t)$  with  $\mathbf{A}$  being a constant matrix, GraphCON conserves Dirichlet energy (11), thereby demonstrating conservative stability.
GraphBel: Generalizing the Beltrami flow, mean curvature flow and heat flow, a stable graph neural flow [32] is designed as
$$
\frac {\mathrm {d} \mathbf {X} (t)}{\mathrm {d} t} = \left(\mathbf {A} _ {\mathbf {S}} (\mathbf {X} (t)) \odot \mathbf {B} _ {\mathbf {S}} (\mathbf {X} (t)) - \Psi (\mathbf {X} (t))\right) \mathbf {X} (t), \tag {5}
$$
where  $\odot$  is the element-wise multiplication.  $\mathbf{A}_{\mathbf{S}}(\cdot)$  and  $\mathbf{B}_{\mathbf{S}}(\cdot)$  are learnable attention function and normalized vector map, respectively.  $\Psi (\mathbf{X}(t))$  is a diagonal matrix in which  $\Psi (\mathbf{x}_i,\mathbf{x}_i) = \sum_{\mathbf{x}_j}(\mathbf{A}\odot \mathbf{B})(\mathbf{x}_i,\mathbf{x}_j)$ .
Analogous to BLEND, under certain conditions with  $\Psi (\mathbf{X}(t)) = \mathbf{B}_{\mathbf{S}}(\mathbf{X}(t)) = \mathbf{I}$ , GraphBel simplifies to the GRAND model. Consequently, it exhibits BIBO/Lyapunov stability in certain scenarios.
(a) Example 1.
(b) Before GIA attack
Figure 1: (a): We plot the vector field and the system solution trajectories of Example 1. (b) and (c): In GRAND, the node features' energy tends to converge towards each other. In HANG, we observe the node features' energy remains relatively stable over time. Two nodes are from different classes.
(c) After GIA attack
The incorporation of ODEs via graph neural flows may enhance the stability of graph feature representations. A summarized relationship between model stability and these graph neural flows can be found in Table 1.
3.1 Lyapunov Stability vs. Node Classification Robustness:
At first glance, Lyapunov stability has a strong correlation with node classification robustness against feature perturbations. However, before diving into experimental evidence, we point out an important conclusion: Lyapunov stability by itself does not necessarily imply adversarial robustness. Consider a scenario where a graph neural flow has only one equilibrium point  $\mathbf{z}_e$ , while the node features are derived from more than one class. In a Lyapunov asymptotically stable graph neural flow, such as GRAND (as shown in Theorem 1), all node features across different classes would inevitably converge to a single point  $\mathbf{z}_e$  due to global contraction. We note that this is why the model in [20] requires a diversity-promoting layer to ensure that different classes converge to different Lyapunov-stable equilibrium points.
Example 1. We provide an example to demonstrate our claim. Consider the following Lyapunov stable ODE
$$
\dot {\mathbf {x}} (t) = \left( \begin{array}{c c} - 1 & 0 \\ 0 & - 5 \end{array} \right) \mathbf {x} (t) \tag {6}
$$
with initial condition  $\mathbf{x}(0) = [x_1(0), x_2(0)]^\top$ . The solution to this ODE is given by  $\mathbf{x}(t) = x_1(0)e^{-t}[1,0]^\top + x_2(0)e^{-5t}[0,1]^\top$ . For all initial points in  $\mathbb{R}^2$ , we have  $\mathbf{x}(t) \to \mathbf{0}$  as  $t \to \infty$ . Furthermore, as  $t \to \infty$ , the trajectory  $\mathbf{x}(t)$  for any initial point is approximately parallel to the  $x$ -axis. We draw the phase plane in Fig. 1a.
Assume that the points on the upper half  $y$ -axis belong to class 1 while we have a linear classifier that separates class 1 and class 2 as shown in Fig. 1a. We observe that for the initial point  $A$  belonging to class 1, the solution from a small perturbed initial point  $A + \epsilon$  is misclassified as class 2 for a large enough  $t$  for any linear classifier. We see from this example that Lyapunov stability itself does not imply adversarial robustness in graph neural flow models.
This example indicates that Lyapunov stability does not guarantee node classification robustness. Additionally, for a system exhibiting global contraction to a single equilibrium point, structural stability may also be ensured. For instance, in the case of GRAND, even if the edges are perturbed, the system maintains the same number of equilibrium points with global contraction. We conclude that even an amalgamation of both Lyapunov stability and structural stability may not help the graph's adversarial robustness for node classification.
In the example shown in Fig. 1, we observe that in the case of GRAND when  $\alpha > 1$ , the node features from different classes tend to become closer to each other as time progresses. This phenomenon can potentially create more vulnerability to adversarial attacks.
Figure 2: The model architecture: each node is assigned a learnable "momentum" vector at time  $t = 0$  which initializes the evolution of the system together with node features. The graph features evolve on following a learnable law (10) derived from the  $H_{\mathrm{net}}$ . At the time  $t = T$ , we use  $q(T)$  as the final node feature.  $H_{\mathrm{net}}(q(t), p(t))$  is a learnable graph energy function.
4 Hamiltonian-Inspired Graph Neural Flow
Drawing inspiration from the principles of Hamiltonian classical mechanics, we introduce a novel graph neural flow paradigm, namely Hamiltonian Graph diffusion (HANG). In Hamiltonian mechanics, the notation  $(q,p)$  is traditionally used to represent the properties of nodes (position and momentum). Hence, in this section, we adopt this notation instead of  $\mathbf{X}$  (as used in Section 3) to denote node features.
4.1 Physics Philosophy Behind HANG
In Hamiltonian mechanics, the state evolution of a multi-object physical system, such as an electromagnetic field, double pendulum, or spring network [43, 44], adheres to well-established physical laws. For instance, in a system of charged particles, each particle generates an electromagnetic field that influences other particles. The Hamiltonian for such a system includes terms representing the kinetic and potential energy of each particle, along with terms representing the interactions between particles via their electromagnetic fields. In this paper, we propose a novel concept of information propagation between graph nodes, where interactions follow a similar Hamiltonian style.
In a Hamiltonian system, the position  $q$  and momentum  $p$  together constitute the phase space  $(q,p)$ , which comprehensively characterizes the system's evolution. In our HANG model, we process the raw node features of the graph using a linear input layer, yielding  $2r$ -dimensional vectors. Following the methodologies introduced in the GNN work [31,35], we split the  $2r$  dimensions into two equal halves, with the first half serving as the feature (position) vector and the second half as "momentum" vector that guides the system evolution. Concretely, each node  $k$  is associated with an  $r$ -dimensional feature vector  $\mathbf{q}_k(0) = (q_k^1,\dots,q_k^r)$  and an  $r$ -dimensional momentum vector  $\mathbf{p}_k(0) = (p_k^1,\dots,p_k^r)$ . Subsequently,  $\mathbf{q}_k(t)$  and  $\mathbf{p}_k(t)$  will evolve along with the propagation of information between graph nodes, with  $\mathbf{q}_k(0)$  and  $\mathbf{p}_k(0)$  serving as the initial conditions.
Following the modeling conventions in physical systems, we concatenate the feature positions of all  $|\mathcal{V}|$  vertices into a single vector, treating it as the system's generalized coordinate within a  $r|\mathcal{V}|$ -dimensional manifold, a process that involves index relabeling<sup>3</sup>.