SlowGuess/NeurIPS_2023_OCR huggingface dataset:
The raw node features are compressed to a fixed dimension, such as 64, using a fully connected (FC) layer to generate the initial features  $q(0)$  in (10). At time  $t = 0$ ,  $p(0)$  and  $q(0)$  are initialized identically. For  $t > 0$ , both  $q(t)$  and  $p(t)$  undergo updates using a graph ODE. The ODE is solved using the solver from [18]. It is observed that different solvers deliver comparable performance in terms of clean accuracy. However, to mitigate computational expense, the Euler solver is employed in our experiments, with an ablation study on different solvers provided for further insight. The integral time  $T$  acts as a hyperparameter in our model. Interestingly, the performance of the model exhibits minimal sensitivity to this time  $T$ . For all datasets, we establish the time  $T$  as 3 and maintain a fixed step size of 1. This setup aligns with a fair comparison to three-layer GNNs.
All the baseline models presented in Table 2 and Table 3 are implemented based on the original work of [49]. The baseline model results in Table 4 are directly extracted from the paper [55]. This is done as we employ the same clean and perturbed graph datasets provided in their research [55].
Our experiment code is developed based on the following repositories:
- https://github.com/tk-rusch/GraphCON
- https://github.com/twitter-research/graph-neural-pde
- https://github.com/LFphase/GIA-HAO
- https://github.com/ChandlerBang/Pro-GNN
C.3 White-box Attack
In our main study, we utilized black-box attacks. Now, we extend our experiments to incorporate white-box, injection, and evasion attacks. In the context of white-box attacks, the adversaries have full access to the target model, enabling them to directly attack the target model to generate a perturbed graph. This represents a significantly more potent form of attack than the black-box variant. Moreover, we execute inductive learning tasks the same as Table 2, with the corresponding results reported in Table 7. We observe that, under white-box attack conditions, all other baseline models exhibit severely reduced performance, essentially collapsing across all datasets. The classification accuracy of the HANG model experiences a slight decline on the Cora, CiteSeer, and Pubmed datasets. However, its performance remains substantially superior to other graph neural flow models or GNN models. Intriguingly, our HANG-quad model remains virtually unaffected by the white-box attacks, maintaining a performance level similar to that observed under black-box attacks. Such robustness of HANG-quad underscores the pivotal contribution of Lyapunov stability when combined with our Hamiltonian-driven design.
Table 7: Node classification accuracy (%) on graph injection, evasion, non-targeted, white-box attack in inductive learning. The best and the second-best result for each criterion are highlighted in red and blue respectively.
Dataset	Attack	HANG	HANG-quad	GraphCON	GraphBel	GRAND	GAT	GraphSAGE	GCN
Cora	clean	87.13±0.86	79.68±0.62	86.27±0.51	86.13±0.51	87.53±0.59	87.58±0.64	86.65±1.51	88.31±0.48
PGD	67.69±3.84	78.04±0.91	42.09±1.74	37.16±1.69	36.02±4.09	30.95±8.22	29.79±7.56	35.83±0.71
TDGIA	64.54±3.95	77.35±0.66	19.01±1.45	15.46±1.98	14.72±1.97	4.81±1.19	17.83±6.62	33.05±1.09
CiteSeer	clean	74.11±0.62	71.85±0.48	74.84±0.49	69.62±0.56	74.98±0.45	67.87±4.97	63.22±9.14	72.63±1.14
PGD	67.54±1.52	72.21±0.71	42.78±1.54	32.24±1.21	38.57±1.94	25.87±6.69	29.65±4.11	30.69±2.33
TDGIA	63.29±3.15	70.62±0.96	33.55±1.10	16.26±1.20	30.11±1.43	17.46±3.34	17.83±1.56	21.10±2.35
CoauthorCS	clean	96.16±0.09	95.27±0.12	95.10±0.12	93.93±0.48	95.08±0.12	92.84±0.41	93.0±0.39	93.33±0.37
PGD	93.40±0.71	93.25±1.02	7.80±1.18	13.21±4.21	8.0±0.06	11.96±7.10	10.73±6.84	11.02±5.04
TDGIA	93.38±0.71	94.12±0.43	7.35±1.61	10.38±1.07	4.53±1.33	1.35±0.55	2.89±1.65	3.61±1.77
Pubmed	clean	89.93±0.27	88.10±0.33	88.78±0.46	86.97±0.37	88.44±0.34	87.41±1.73	88.71±0.37	88.46±0.20
PGD	68.62±2.82	87.64±0.39	36.86±2.63	39.34±0.77	39.52±3.35	38.04±4.91	38.76±4.58	39.03±0.10
TDGIA	69.56±3.16	87.91±0.46	31.49±1.87	30.15±1.30	36.19±7.04	24.43±4.10	38.89±0.76	42.64±1.41
C.4 Attack Strength
We assess the robustness of the HANG model and its variant under varying attack strengths, with the node classification results displayed in Table 8. Our analysis reveals that the HANG model demonstrates superior robustness as the attack budget escalates. It is noteworthy, however, that under larger attack budgets, HANG-quad may relinquish its robustness attribute in the face of PGD and Meta injection attacks. This result implies that the amalgamation of Lyapunov stability and conservative Hamiltonian system facilitates enhanced robustness only under minor graph perturbations. On the contrary, the HANG model, which solely incorporates the conservative Hamiltonian design, exhibits a consistently high-performance level regardless of the increasing attack strength.
C.5 Nettack
We further evaluate the robustness of our model under the targeted poisoning attack, Nettack [9]. Adhering to the settings outlined in [55], we select nodes in the test set with a degree greater than 10 to be the target nodes. We then vary the number of perturbations applied to each targeted node from 1 to 5, incrementing in steps of 1. It is important to note that Nettack only involves feature perturbations. The test accuracy in Table 9 refers to the classification accuracy on the targeted nodes. As demonstrated in Table 9, our HANG-quad model exhibits exceptional resistance to Nettack, thereby underlining its superior robustness. This suggests that the combination of Lyapunov stability and conservative Hamiltonian design significantly enhances robustness in the face of graph poisoning attacks. On its own, Lyapunov stability has been recognized to defend against only slight feature perturbations in the input graph [32]. Furthermore, our HANG model also displays superior resilience compared to other graph neural flows, reinforcing the fact that the Hamiltonian principle contributes to its robustness.
Table 9: Node classification accuracy (%) under modification, poisoning targeted attack (Nettack) in transductive learning. The best and the second-best result for each criterion are highlighted in red and blue respectively.
Dataset	Ptb	HANG	HANG-quad	GraphCON	GraphBel	GRAND	GAT	GCN	RGCN	GCN-SVD	Pro-GNN
Cora	1	75.54±3.10	76.99±3.16	73.25±3.91	63.73±2.25	80.12±1.81	76.04±2.08	75.06±1.02	76.75±1.71	77.23±1.82	81.81±1.66
2	73.73±3.64	76.51±2.60	67.83±3.0	62.41±2.94	76.27±1.79	70.24±1.43	70.60±1.10	70.96±1.14	72.53±1.60	75.90±1.43
3	68.43±4.23	73.13±2.85	68.19±2.10	61.20±3.08	70.48±3.74	65.54±1.34	67.95±1.72	66.51±1.60	66.75±1.54	70.12±1.93
4	66.02±2.21	72.53±2.14	57.59±2.34	56.51±2.72	65.30±2.40	61.69±0.90	61.57±1.47	59.28±2.68	60.72±1.63	65.66±1.35
5	60.12±3.63	68.80±2.55	55.30±4.77	51.93±2.77	57.95±2.38	58.31±2.03	55.54±1.66	55.30±1.66	57.71±1.82	64.34±1.72
Citeseer	1	76.03±3.51	79.05±1.38	76.03±3.44	68.89±2.67	80.0±1.05	81.27±1.38	78.41±1.62	78.25±0.73	80.16±2.04	81.75±0.79
2	74.76±2.50	77.94±2.29	68.73±6.62	67.62±3.11	74.28±7.47	77.43±4.89	74.92±3.54	75.40±2.04	79.84±0.73	81.27±0.95
3	74.76±2.18	77.14±2.48	60.47±5.24	60.63±3.87	57.14±9.28	60.85±2.99	63.97±3.69	60.31±1.19	77.14±2.86	79.68±1.98
4	73.49±3.02	78.41±1.62	55.55±6.23	53.17±6.48	59.84±2.75	61.59±4.64	55.40±2.60	55.49±1.75	69.52±3.31	77.78±2.84
5	72.06±3.56	73.49±3.48	51.75±2.77	48.73±4.60	48.41±8.10	55.56±6.28	47.62±5.17	47.44±2.01	69.21±2.48	71.27±4.99
Polblogs	1	97.06±0.66	97.37±0.37	87.07±1.35	68.17±3.25	96.41±0.87	97.22±0.25	96.83±0.17	97.00±0.07	97.56±0.20	96.83±0.06
2	96.39±1.16	96.89±0.16	82.92±1.53	65.48±2.85	92.93±4.21	96.11±0.65	95.61±0.20	95.87±0.23	97.12±0.09	97.17±0.12
3	96.02±0.93	96.65±0.15	80.76±0.74	62.59±1.99	91.96±4.22	95.81±0.56	95.41±0.18	95.59±0.27	96.61±0.14	96.93±0.12
4	93.81±3.86	96.26±0.53	77.46±1.59	58.68±0.40	86.83±6.28	94.80±0.66	94.24±0.24	94.37±0.26	96.17±0.19	96.89±0.16
5	91.65±4.67	95.91±0.33	75.30±2.71	59.02±3.19	83.69±5.88	93.28±1.43	93.00±0.48	93.20±0.43	95.13±0.25	96.13±0.25
C.6 ODE solvers
The results from various ODE solvers are depicted in Table 10. We consider fixed-step Euler and RK4, along with adaptive-step Dopri5, from [18], and Symplectic-Euler from [35]. The Symplectic-Euler method, being inherently energy-conserving, is particularly suited for preserving the dynamic properties of Hamiltonian systems over long times. Our observations suggest that while the choice of solver slightly influences the clean accuracy for some models, their performance under attack conditions remains fairly consistent. Consequently, there was no specific optimization for solver selection during our experiments. For computational efficiency, we opted for the Euler ODE solver in all experiments presented in the main paper.
Table 10: Node classification accuracy (%) on graph injection, evasion, non-targeted, black-box attack in inductive learning of Citeseer dataset.
Attack	Solver	HANG	HANG-quad	GraphCON	GraphBel	GRAND
clean	Euler	74.11±0.62	71.85±0.48	74.84±0.49	69.62±0.56	74.98±0.45
rk4	73.71±1.58	72.63±0.56	75.80±0.38	74.46±0.68	75.32±0.78
symplectic euler	71.35±1.91	72.80±0.64	75.43±0.62	69.87±0.78	75.70±0.71
dopri5	75.20±0.93	-	76.24±0.76	74.63±0.70	75.14±0.56
PGD	Euler	72.31±1.16	71.07±0.41	40.56±0.36	55.67±5.35	36.68±1.05
rk4	71.85±2.04	72.38±0.52	41.26±0.89	41.51±1.76	41.21±1.57
symplectic euler	70.57±1.74	72.46±0.53	40.87±2.62	49.09±7.82	39.72±1.54
dopri5	73.59±0.38	-	42.20±2.21	40.07±0.87	40.53±1.14
TDGIA	Euler	72.12±0.52	71.69±0.40	36.67±1.25	34.17±4.68	36.67±1.25
rk4	71.03±1.64	72.85±0.78	36.19±2.03	37.90±1.70	34.21±1.63
symplectic euler	71.79±2.03	73.31±0.58	35.32±1.78	28.40±0.91	35.12±1.62
dopri5	72.14±0.71	-	38.04±1.71	40.63±1.60	34.39±1.19
MetaGIA	Euler	72.92±0.66	71.60±0.48	48.36±2.12	45.60±4.31	46.23±2.01
rk4	70.25±1.45	72.39±0.61	42.57±1.09	43.38±0.88	41.01±0.92
symplectic euler	71.56±1.07	72.86±0.72	42.57±1.09	44.72±6.28	41.0±0.64
dopri5	71.83±1.26	-	42.61±0.57	42.93±0.61	41.74±0.69
C.7 Computation Time
The average inference time and model size for different models used in our study are outlined in Table 11. This analysis is performed using the Cora dataset, with all graph PDE models employing the Euler Solver, an integration time of 3, and a step size of 1. Additionally, for fair comparison, all baseline models are configured with 3 layers. Upon examination, it is observed that our HANG and HANG-quad models necessitate more inference time compared to other baseline models. This is primarily due to the requirement in these models to initially calculate the derivative. However, when compared to other defense models, such as GCNGUAD, our models are still more efficient, thus validating their practical utility.
Table 11: Average inference time and model size
Model	HANG	HANG-quad	GraphCON	GraphBel	GRAND	GAT	GraphSAGE	GCN	GCNGUARD	RGCN
Inference Time (ms)	17.16	14.41	2.60	6.18	2.25	4.13	3.85	3.93	95.90	2.50
Model Size(MB)	0.895	0.936	0.732	0.734	0.732	0.381	0.380	0.380	0.380	0.735
C.8 Combination with Adversarial Training(AT)
Adversarial training (AT) [60] is a technique employed to improve the robustness of machine learning models by exposing them to adversarial examples during the training phase. These adversarial examples are maliciously crafted inputs designed to mislead the model, thereby helping it to learn more robust and generalized features.
In this context, we conducted additional experiments applying PGD-AT [60] to both GAT and HANG models, evaluating their robust accuracy under PGD, TDGIA, and METAGIA attacks in both white-box and black-box scenarios. As illustrated in Table 12 and Table 13, while PGD-AT enhances the robustness of all models, its effect on GAT's resilience to the unique white-box METAGIA attack is notably restrained, highlighting the limitations of PGD-AT's efficacy, particularly when faced with non-AT tactics. Conversely, HANG consistently displays remarkable performance across a variety of attacks, showing significant improvement when combined with PGD-AT. Both HANG-AT and HANG-quad-AT exhibit substantial resistance to these attacks, underscoring HANG's inherent robustness.
Furthermore, we explored adversarial training from a graph spectral perspective, incorporating Spectral Adversarial Training (SAT) [81] into our HANG framework, thus creating the HANG-SAT variant. The integration of SAT, as depicted in Table 12 and Table 13, significantly boosts HANG's robustness against various attacks, with minimal reduction in post-attack accuracy, further exemplifying HANG's intrinsic resilience.
Table 12: Node classification accuracy (%) on graph injection, evasion, non-targeted, black-box attack in inductive learning.
Dataset	Attack	HANG	HANG-AT	GAT	GAT-AT	HANG-SAT
Pubmed	clean	89.93±0.27	89.45±0.33	87.41±1.73	85.88±0.47	88.38±0.48
PGD	81.81±1.94	89.03±0.19	48.94±12.99	77.78±8.39	87.65±1.77
TDGIA	86.62±1.05	87.16±3.89	47.56±3.11	79.56±5.76	87.55±2.11
MetaGIA	87.58±0.75	88.93±0.18	44.75±2.53	81.86±3.44	88.22±0.22
Table 13: Node classification accuracy (%) on graph injection, evasion, non-targeted, white-box attack in inductive learning.
Dataset	Attack	HANG	HANG-AT	GAT	GAT-AT	HANG-SAT
Pubmed	clean	89.93±0.27	89.42±0.22	87.41±1.73	85.90±0.44	88.38±0.48
PGD	68.62±2.82	88.86±0.15	38.04±4.91	80.85±4.51	88.19±0.28
TDGIA	69.56±3.16	88.98±0.20	24.43±4.10	82.16±4.10	88.28±0.34
MetaGIA	84.64±1.20	88.61±0.20	40.02±1.34	44.37±6.48	85.76±4.12
C.9 Combination with GNN defense mechanisms
We acknowledge the potential advantages of integrating defense mechanisms that operate through diverse strategies. In this context, we combine HANG with GNNGuard [61], a preprocessing-based defense renowned for its effectiveness in enhancing GNN robustness, and GARNET [82], another noteworthy defense mechanism.
We conduct experiments to assess the performance of HANG when amalgamated with GNNGuard and GARNET. The results in Table 14 and Table 15 clearly indicate that such integration effectively enhances the model's robustness. This outcome highlights the adaptability of our methodology with current defense strategies and sheds light on the potential for cooperative improvements in model defense.
Table 14: Node classification accuracy (%) on graph injection, evasion, non-targeted attack in inductive learning.
Dataset	Attack	HANG	HANG-GUARD	HANG-quad	HANG-quad-GUARD
Cora	clean	87.13±0.86	86.54±0.57	79.68±0.62	81.23±0.70
PGD	78.37±1.84	86.23±0.55	79.05±0.42	80.91±0.67
TDGIA	79.76±0.99	85.56±0.34	79.54±0.65	81.11±0.76
MetaGIA	77.48±1.02	86.0±0.60	78.28±0.56	80.10±0.53
CiteSeer	clean	74.11±0.62	75.95±0.66	71.85±0.48	73.15±0.61
PGD	72.31±1.16	75.38±0.82	71.07±0.41	73.07±0.63
TDGIA	72.12±0.52	74.54±0.69	71.69±0.40	73.04±0.52
MetaGIA	72.92±0.66	75.22±0.66	71.60±0.48	73.11±0.45
Pubmed	clean	89.93±0.27	89.96±0.25	88.10±0.33	88.93±0.18
PGD	81.81±1.94	87.72±0.89	87.69±0.57	88.99±0.11
TDGIA	86.62±1.05	88.86±0.40	87.55±0.60	88.80±0.12
MetaGIA	87.58±0.75	88.23±0.93	87.40±0.62	88.78±0.16
Table 15: Node classification accuracy (%) on graph Nettack targeted attack in transductive learning.
Dataset	Pb-rate	HANG	HANG-GARNET	HANG-quad	HANG-quad-GARNET	GCN	GCN-GARNET
Cora	1	75.54±3.10	82.41±0.80	76.99±3.16	83.01±0.84	70.06±0.81	79.75±2.35
2	73.73±3.64	80.84±1.57	76.51±2.60	79.88±0.55	68.60±1.81	79.60±1.50
3	68.43±4.23	80.48±1.69	73.13±2.85	79.76±0.72	65.04±3.31	74.42±2.06
4	66.02±2.21	70.0±1.47	72.53±2.14	75.90±0.54	61.69±1.48	69.60±2.67
5	60.12±3.63	67.83±1.87	68.80±2.55	69.28±1.34	55.66±1.95	67.04±2.05
D More Insights about Model Robustness
For a clearer insight into the energy concept within HANG, consider the "time" in graph neural flows as analogous to the "layers" in standard GNNs (note that ODE solvers basically discretize the "time", which indeed approximately turns the model into a layered one). Here, the feature vector  $\mathbf{q}(t)$  and the momentum vector  $\mathbf{p}(t)$  evolve with time, bound tightly by equation (10). Given that  $\mathbf{q}(t)$  mirrors the node features at layer  $t$ ,  $\mathbf{p}(t)$  can be understood as the variation in node features over time - essentially, the evolution of node features between successive layers. Thus, our defined energy interweaves both the node feature and its rate of change across adjacent layers. The constant  $H_{\mathrm{net}}$  implies inherent constraints on the node features and their alteration pace over layers. Because  $H_{\mathrm{net}}$  processes the whole graph data and yields a scalar, it serves as a constraint on the global graph feature and its variation, which we opine to be crucial in countering adversarial attacks.
From an adversarial perspective, the attacker modifies either the node features or the underlying graph topology. These modifications are propagated through multiple aggregation steps, such as layers in conventional GNNs or integrals in graph ODEs. While the Hamiltonian considers the energy of the entire graph, adversarial attacks often target localized regions of the graph. The inherent global energy perspective of the Hamiltonian system makes it resilient to such localized attacks, as local perturbations often get "absorbed" or "mitigated" when viewed from the perspective of the entire system. When adversarial perturbations are introduced, they might indeed tweak the instantaneous features of certain nodes. However, the challenge lies in modifying the trajectory (or evolution) of these nodes (positions  $p(t)$  and the variations  $q(t)$ ) in the phase space in a manner that is aligned with the rest of the graph, all while upholding the energy conservation constraints. This feat is arduous,
if not impossible, without creating detectable inconsistencies elsewhere. This property ensures that the energy of each node feature is preserved over time and multiple aggregation steps. As a result, the distances between features of different nodes are preserved if their norms differ initially before the adversarial attack. The robustness of HANG against topology perturbation may stem from the fact that adversarial topology perturbation has small influence on the node feature energy. This can be seen from Fig. 1. When using HANG, the node feature before and after adversarial attack are relatively stable and well separated between nodes from different classes.
E Proof of Theorem 1
Recall that
$$
\frac {\mathrm {d} \mathbf {X} (t)}{\mathrm {d} t} = \overline {{\mathbf {A}}} _ {G} (\mathbf {X} (t)) \mathbf {X} (t) = \left(\mathbf {A} _ {G} (\mathbf {X} (t)) - \alpha \mathbf {I}\right) \mathbf {X} (t), \tag {15}
$$
Without loss of generality, we assume  $\mathbf{X} \in \mathbb{R}^{|\mathcal{V}| \times 1}$  since the results can be generalized to  $\mathbf{X} \in \mathbb{R}^{|\mathcal{V}| \times r}$  on a component-wise basis.
Proof of 1).
Given our assumptions where  $\mathbf{A}_G(\mathbf{X}(t))$  is either column- or row-stochastic, the spectral radius of  $\mathbf{A}_G(\mathbf{X}(t))$  is 1, as established by [42][Theorem 8.1.22]. This implies that the modulus of its eigenvalues is as most 1.
We define a Lyapunov function as  $V(\mathbf{X}(t)) = \mathbf{X}(t)^{\top}\mathbf{X}(t) = \| \mathbf{X}(t)\| _2^2$  where  $\| \cdot \| _2$  is the  $\ell_2$  euclidean norm. Take the derivative of  $V$  with respect to time, we have
$$
\dot {V} (\mathbf {X} (t)) = \mathbf {X} ^ {\intercal} (t) \dot {\mathbf {X}} (t) + \dot {\mathbf {X}} ^ {\intercal} (t) \mathbf {X} (t) = \mathbf {X} ^ {\intercal} (t) \left(\overline {{\mathbf {A}}} _ {G} (\mathbf {X} (t)) + \overline {{\mathbf {A}}} _ {G} ^ {\intercal} (\mathbf {X} (t))\right) \mathbf {X} (t) \tag {16}
$$
We next prove that  $\dot{V} (\mathbf{X}(t))\leq 0$  when  $\mathbf{A}_G(\mathbf{X}(t))$  is a doubly stochastic attention matrix under the GRAND-nl setting.
$$
\begin{array}{l} \dot {V} (\mathbf {X} (t)) = \mathbf {X} ^ {\intercal} (t) \left(\overline {{\mathbf {A}}} _ {G} (\mathbf {X} (t)) + \overline {{\mathbf {A}}} _ {G} ^ {\intercal} (\mathbf {X} (t))\right) \mathbf {X} (t) \\ = 2 \mathbf {X} ^ {\intercal} (t) \overline {{\mathbf {A}}} _ {G} (\mathbf {X} (t)) \mathbf {X} (t) \tag {17} \\ = 2 \mathbf {X} ^ {\intercal} (t) \mathbf {A} _ {G} (\mathbf {X} (t)) \mathbf {X} (t) - 2 \alpha \mathbf {X} ^ {\intercal} (t) \mathbf {X} (t) \\ \end{array}
$$
$$
\left| \mathbf {X} ^ {\mathsf {T}} (t) \mathbf {A} _ {G} (\mathbf {X} (t)) \mathbf {X} (t) \right| \leq \| \mathbf {X} \| _ {2} \| \mathbf {A} _ {G} (\mathbf {X} (t) \| _ {2} \| \mathbf {X} \| _ {2} \tag {18}
$$
where  $\| \cdot \| _2$  is the spectral matrix norm induced by  $\ell_2$  vector norm. The given inequality is a direct result of the Cauchy-Schwarz inequality and the properties of the induced norm. Drawing from [42][Theorem 5.6.9], we can currently establish that  $\| \mathbf{A}_G(\mathbf{X}(t))\| _2\geq 1$ . Nevertheless, we intend to assert that this inequality is indeed an equality when  $\mathbf{A}_G(\mathbf{X}(t))$  is doubly stochastic, i.e.,  $\| \mathbf{A}_G(\mathbf{X}(t))\| _2 = 1$ . To see this, from Schur's bounds on the largest singular value [83][eq.(1)], we have
$$
\| \mathbf {A} _ {G} (\mathbf {X} (t) \| _ {2} \leq \sqrt {\| \mathbf {A} _ {G} (\mathbf {X} (t) \| _ {\infty} \| \mathbf {A} _ {G} (\mathbf {X} (t) \| _ {1}}
$$
where  $\| \cdot \| _1$  is the induced  $\ell_1$  norm and  $\| \cdot \|_{\infty}$  is the induced  $\ell_{\infty}$  norm. Given that  $\mathbf{A}_G(\mathbf{X}(t)$  is doubly stochastic, we observe that  $\| \mathbf{A}_G(\mathbf{X}(t)\|_{\infty} = \| \mathbf{A}_G(\mathbf{X}(t)\| _1 = 1$ . It now follows that  $\| \mathbf{A}_G(\mathbf{X}(t)\| _2\leq 1$ , the equality is consequently confirmed. It follows from (18) that
$$
\left| \mathbf {X} ^ {\intercal} (t) \mathbf {A} _ {G} (\mathbf {X} (t)) \mathbf {X} (t) \right| \leq \| \mathbf {X} \| _ {2} ^ {2} = \mathbf {X} ^ {\intercal} (t) \mathbf {X} (t) \tag {19}
$$
From (17) and (19), it follows that
$$
\dot {V} (\mathbf {X} (t)) \leq 2 (1 - \alpha) \| \mathbf {X} \| _ {2} ^ {2} \leq 0 \tag {20}
$$
when  $\alpha \geq 1$ . The observation that  $V(\mathbf{X}(t))$  does not increase over time ensures that  $\mathbf{X}(t)$  stays bounded. In effect, we also have proved Lyapunov stability concerning the equilibrium point 0.
To prove asymptotic stability for the equilibrium point 0 when  $\alpha > 1$ , we need to show that the system not only remains bounded but also approaches 0 as  $t \to \infty$ . This is indicated by the fact that
when  $\alpha > 1$ ,  $\dot{V}(\mathbf{X}(t)) < 0$  unless  $\mathbf{X}(t) = 0$ . This signifies that  $V(\mathbf{X}(t))$  strictly declines over time unless  $\mathbf{X}(t) = 0$ , thereby showing that the system will converge to 0 as  $t \to \infty$ . Notably, we can infer global asymptotic stability since  $V$  is radially unbounded [84].
The proof for the GRAND-nl case is complete.
Proof of 2).
We next prove the claims under GRAND-1 setting.
When  $\mathbf{A}_G$  is either column- or row-stochastic, the spectral radius of  $\mathbf{A}_G(\mathbf{X}(t))$  is 1, as established by [42][Theorem 8.1.22]. The modulus of its eigenvalues is as most 1. Consider the Jordan canonical form of  $\mathbf{A}_G$  represented as  $\mathbf{SJS}^{-1}$  where  $\mathbf{J}$  stands as the Jordan form.
Given that our equation system now represents a linear time-invariant ODE, the solution to (15) can be expressed as:
$$
\begin{array}{l} \mathbf {X} (t) = e ^ {\overline {{\mathbf {A}}} _ {G} t} \mathbf {X} (0) \\ = \mathbf {S} e ^ {\mathbf {J} t} \mathbf {S} ^ {- 1} \mathbf {X} (0) \tag {21} \\ \end{array}
$$
where  $\bar{\mathbf{J}} = \mathbf{J} - \alpha \mathbf{I}$ . Citing [42][3.2.2. page 177, 4-th equation], for  $\alpha > 1$ , BIBO and Lyapunov stabilities are attained. Notably, for  $\alpha > 1$ , the system achieves global asymptotic stability around the equilibrium point 0 under any disturbances.
Further, by considering strong connectedness and referencing the Perron-Frobenius theorem [42][Theorem 8.4.4], it is deduced that 1 serves as the simple eigenvalue for  $\mathbf{A}_G$ . In this case, when  $\alpha = 1$ , we still have BIBO stability and Lyapunov stability according to [42][3.2.2. page 177, 4-th equation].
Proof of 3).