SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$$
q (t) = \left(q ^ {1} (t), \dots q ^ {r | \mathcal {V} |} (t)\right) = \left(\mathbf {q} _ {1} (t), \dots , \mathbf {q} _ {| \mathcal {V} |} (t)\right). \tag {7}
$$
This  $r|\mathcal{V}|$ -dimensional coordinate representation at each time instance provides a snapshot of the state of the graph system. Similarly, we concatenate all the "momentum" vectors at time  $t$  to construct an  $r|\mathcal{V}|$ -dimensional vector:
$$
p (t) = \left(p _ {1} (t), \dots p _ {r | \mathcal {V} |} (t)\right) = \left(\mathbf {p} _ {1} (t), \dots , \mathbf {p} _ {| \mathcal {V} |} (t)\right), \tag {8}
$$
<sup>3</sup>In multilinear algebra and tensor computation, vector components employ upper indices, while covector components use lower indices. We adhere to this convention.
which can be interpreted as a generalized momentum vector for the entire graph system.
In physics, the system evolves in accordance with fundamental physical laws, and a conserved quantity function  $H(q,p)$  remains constant along the system's evolution trajectory. This conserved quantity is typically interpreted as the "system energy". In our HANG model, instead of defining an explicit energy function  $H(p,q)$  from a fixed physical law, we utilize a learnable energy function  $H_{\mathrm{net}}: \mathcal{G} \to \mathbb{R}^{+}$  parameterized by a neural network, referred to as the Hamiltonian energy function:
$$
H _ {\text {n e t}}: \mathcal {G} \rightarrow \mathbb {R} ^ {+} \tag {9}
$$
We allow the graph features to evolve according to a learnable Hamiltonian law analogous to basic physical laws. More specifically, we model the feature evolution trajectory as the following canonical Hamilton's equations, which is a restatement of (2):
$$
\dot {q} (t) = \frac {\partial H _ {\mathrm {n e t}}}{\partial p}, \quad \dot {p} (t) = - \frac {\partial H _ {\mathrm {n e t}}}{\partial q}, \tag {10}
$$
with the initial features  $(q(0),p(0))\in \mathbb{R}^{2r|\mathcal{V}|}$  at time  $t = 0$  being the vectors after the raw node features transformation.
The neural ODE given by (10) can be trained and solved through integration to obtain the trajectory  $(q(t),p(t))$ . At the terminal time point  $t = T$ , the system's solution is represented as  $(q(T),p(T))$ . We then apply the canonical projection map  $\pi$  to extract the nodes' concatenated feature vector  $q(T)$  as follows:  $\pi ((q(T),p(T))) = q(T)$ . This concatenated feature vector  $q(T)$  is subsequently decompressed into individual node features for utilization in downstream tasks. For this study, we employ backpropagation to minimize the cross-entropy in node classification tasks. The complete model architecture is depicted in Fig. 2, while a comprehensive summary of the full algorithm can be found in the Appendix G.
4.2 Hamiltonian Energy Conservation
Referring to [45], it is known that the total Hamiltonian energy  $H_{\mathrm{net}}$  remains constant along the trajectory of its induced Hamiltonian flow. This principle is recognized as the law of energy conservation in a Hamiltonian system.
Theorem 2. If the graph system evolves in accordance with (10), the total energy  $H_{\mathrm{net}}(q(t),p(t))$  of the system remains constant. BIBO stability is achieved if  $H_{\mathrm{net}}$  remains bounded for all bounded inputs and, as  $(q,p)\to \infty$ ,  $H_{\mathrm{net}}(q,p)\to \infty$ .
In light of Theorem 2, if our system evolves following (10), it adheres to the law of energy conservation. As a result, our model guarantees conservative stability. Compared to GraphCON, which conserves Dirichlet energy over time  $t$  under specific conditions, the notion of Hamiltonian energy conservation is broader in scope. Under the settings delineated in Section 3, GraphCON can be considered as a particular instance of HANG when  $H_{\mathrm{net}}$  is set to represent Dirichlet energy  $\mathcal{E}(q)$ :
Definition 5 (Dirichlet energy [35]). The Dirichlet energy is defined on node features  $q(t)$  at time  $t$  of an undirected graph  $\mathcal{G}$  as
$$
\mathcal {E} (q (t)) = \frac {1}{| \mathcal {V} |} \sum_ {i} \sum_ {j \in \mathcal {N} (i)} \| \mathbf {q} _ {i} (t) - \mathbf {q} _ {j} (t) \| ^ {2}, \tag {11}
$$
where  $\mathcal{N}(i) = \{j : [i, j] \in \mathcal{E}\}$  is the set of neighbors adjacent to node  $i$  in the graph.
5 Different Hamiltonian Energy Functions
In physical systems, the system is often depicted as a graph where two neighboring vertices with mass are connected by a spring of given stiffness and length [44]. The system's energy is thus related to the graph's topology. Similarly, in our graph system, the energy function  $H_{\mathrm{net}}$  involves interactions between neighboring nodes, signifying the importance of the graph's topology. There exist multiple ways to learn the energy function, and we present two examples below.
Table 1: The stability summary for different graph neural flows where the  $\checkmark$  denotes that stability is affirmed under additional conditions.
Graph Neural Flows	BIBO stabiity	Lyapunov stabiity	Structural stabiity	Conservative stabiity
GRAND	✓	✓	✓	✓
BLEND	✓	✓	✓	✓
GraphCON	✓	✗	✗	✓
GraphBel	✓	✓	✓	✓
HANG	✗	✗	✗	✓
HANG-quad	✗	✓	✗	✓
5.1 Vanilla HANG
We define  $H_{\mathrm{net}}$  as a composition of two graph convolutional layers:
$$
H _ {\text {n e t}} = \left\| \left(g _ {\mathrm {g c n} _ {2}} \circ \tanh  \circ g _ {\mathrm {g c n} _ {1}}\right) (q, p) \right\| _ {2}, \tag {12}
$$
where  $g_{\mathrm{gen}_1}:\mathbb{R}^{2r\times |\mathcal{V}|}\to \mathbb{R}^{d\times |\mathcal{V}|}$  and  $g_{\mathrm{gen}_2}:\mathbb{R}^{d\times |\mathcal{V}|}\to \mathbb{R}^{|V|}$  are two GCN [3] layers with different hidden dimensions. A tanh activation function is applied between the two GCN layers, and  $\| \cdot \| _2$  denotes the  $\ell_2$  norm. We concatenate  $\mathbf{q}_k$  and  $\mathbf{p}_k$  for each node  $k$  at the input of the above composite function, resulting in an input dimension of  $2r$  per node. From Theorem 2, it follows that HANG exhibits BIBO stability. If  $(q(t),p(t))$  were unbounded, the value of  $H_{\mathrm{net}}$  would also become unbounded, contradicting the energy conservation principle. In subsequent discussions, this invariant is referred to as HANG.
5.2 Quadratic HANG (HANG-quad)
The general vanilla HANG with conservative stability does not possess Lyapunov stability. Other additional conditions may be required for Lyapunov stability. The following Lagrange-Dirichlet Theorem provides a sufficient condition.
Theorem 3 (Lagrange-Dirichlet Theorem [46]). Let  $\mathbf{z}_e$  be a locally quadratic equilibrium of the natural Hamiltonian (2) with
$$
H = T (q, p) + U (q), \tag {13}
$$
where  $T$  is a positive definite, quadratic function of  $p$ . Then  $\mathbf{z}_e$  is Lyapunov stable if the position of it is a strict local minimum of  $U(q)$ .
Theorem 3 implies that we can design an energy function  $H_{\mathrm{net}}$  such that the induced graph neural flow is both Lyapunov stable and energy conservative. For instance, we can define  $T$  as
$$
T (q, p) = \sum_ {i} \mathbf {h} _ {i} ^ {\intercal} \mathbf {h} _ {i} + \lambda \mathbf {p} _ {i} ^ {\intercal} \mathbf {p} _ {i}, \tag {14}
$$
where  $\mathbf{h}_i = \sum_{j\in \mathcal{N}(i)}a_G(\mathbf{q}_i,\mathbf{q}_j)\mathbf{p}_j$  is the aggregation of  $\mathbf{p}_j$  through the attention mechanism  $a_{G}(\mathbf{q}_{i},\mathbf{q}_{j})$  calculated based on  $q$  (or we directly use adjacency matrix with  $a_{G}(\mathbf{q}_{i},\mathbf{q}_{j})\equiv \mathbf{W}[i,j]$ ). The term  $\lambda$  is a small positive number included to ensure the positive definiteness. If  $U(q)$  has only a single global minimum, such as  $U(q) = \| q\|$  with an  $\ell_2$  norm, this stability may not ensure adversarial robustness as discussed in Section 3.1. An alternative is setting  $U(q) = \| \sin (q)\|$ , which fosters Lyapunov stability across multiple local equilibrium points. However, this choice considerably restricts the form that  $U$  can take and may consequently limit the model's capacity. In the implementation, we set the function  $U(q)$  in  $H$  to be a single GAT [6] layer  $g_{\mathrm{gat}}:\mathbb{R}^{r\times |\mathcal{V}|}\to \mathbb{R}^{r\times \mathcal{V}}$  with a sin activation function followed by an  $\ell_2$  norm, i.e.,  $U(q) = \| g_{\mathrm{gat}}(q)\| _2$ . The stability of HANG and HANG-quad is summarized in Table 1.
In this section, we conduct a comprehensive evaluation of our theoretical findings and assess the robustness of two conservative stable models: HANG and HANG-Quad. We compare their performance against various benchmark GNN models, including GAT [47], GraphSAGE [48], GCN [3] and other prevalent graph neural flows. We incorporate different types of graph adversarial attacks as described in Section 6.1 and Section 6.3. These attacks are conducted in a black-box setting, where a surrogate model is trained to generate perturbed graphs or features. For more experiments, we direct readers to Appendix C.
Table 2: Node classification accuracy (%) on graph injection, evasion, non-targeted attack in inductive learning. The best and the second-best result for each criterion are highlighted in red and blue respectively.
Dataset	Attack	HANG	HANG-quad	GraphCON	GraphBel	GRAND	GAT	GraphSAGE	GCN
Cora	clean	87.13±0.86	79.68±0.62	86.27±0.51	86.13±0.51	87.53±0.59	87.58±0.64	86.65±1.51	88.31±0.48
PGD	78.37±1.84	79.05±0.42	42.81±0.30	40.04±0.68	39.65±1.32	38.27±2.73	35.43±5.05	35.83±0.71
TDGIA	79.76±0.99	79.54±0.65	43.0±0.24	39.10±0.80	41.77±2.70	39.39±7.57	34.38±2.25	33.05±1.09
MetaGIA	77.48±1.02	78.28±0.56	42.30±0.33	39.93±0.59	39.36±1.26	39.49±4.19	38.14±2.23	35.84±0.73
CiteSeer	clean	74.11±0.62	71.85±0.48	74.84±0.49	69.62±0.56	74.98±0.45	67.87±4.97	63.22±9.14	72.63±1.14
PGD	72.31±1.16	71.07±0.41	40.56±0.36	55.67±5.35	36.68±1.05	32.65±3.80	32.70±5.11	30.69±2.33
TDGIA	72.12±0.52	71.69±0.40	36.67±1.25	34.17±4.68	36.67±1.25	30.53±3.57	26.11±2.94	21.10±2.35
MetaGIA	72.92±0.66	71.60±0.48	48.36±2.12	45.60±4.31	46.23±2.01	37.68±4.0	35.75±5.50	35.86±0.68
CoauthorCS	clean	96.16±0.09	95.27±0.12	95.10±0.12	93.93±0.48	95.08±0.12	92.84±0.41	93.0±0.39	93.33±0.37
PGD	94.80±0.33	95.08±0.23	42.68±10.13	71.35±7.29	74.69±12.42	34.22±32.58	7.29±2.58	11.02±5.04
TDGIA	95.40±0.13	95.09±0.09	7.92±4.11	43.13±3.58	5.05±1.43	18.08±15.74	6.47±4.25	3.61±1.77
MetaGIA	94.85±0.31	94.83±0.28	67.79±4.04	73.98±8.26	84.31±4.26	52.01±24.21	7.82±2.69	15.70±3.95
Pubmed	clean	89.93±0.27	88.10±0.33	88.78±0.46	86.97±0.37	88.44±0.34	87.41±1.73	88.71±0.37	88.46±0.20
PGD	81.81±1.94	87.69±0.57	45.06±1.51	46.06±0.97	44.61±2.78	48.94±12.99	44.62±6.49	39.03±0.10
TDGIA	86.62±1.05	87.55±0.60	46.30±1.56	52.24±0.68	44.99±1.10	47.56±3.11	47.61±0.91	42.64±1.41
MetaGIA	87.58±0.75	87.40±0.62	45.55±1.18	50.04±0.64	44.36±1.20	44.75±2.53	42.39±0.53	40.42±0.17
Table 3: Node classification accuracy (%) on graph injection, evasion, targeted attack in inductive learning.
Dataset	Attack	HANG	HANG-quad	GraphCON	GraphBel	GRAND	GAT	GraphSAGE	GCN
Computers	PGD	90.83±0.53	87.53±0.99	74.01±4.87	89.33±0.56	65.75±5.00	35.72±10.71	18.33±0.57	17.80±0.06
TDGIA	90.88±0.50	87.75±0.53	80.11±3.21	88.21±0.63	77.18±7.60	66.09±17.07	50.89±1.30	66.51±3.90
MetaGIA	90.73±0.64	89.32±0.48	87.95±2.65	89.27±0.57	81.85±4.66	60.28±11.11	37.51±4.49	36.19±0.10
ogbn-arxiv	PGD	58.32±1.53	52.95±0.33	53.48±6.60	OOM	45.07±3.87	52.75±4.55	25.48±5.65	29.76±2.56
TDGIA	66.36±2.50	61.93±0.94	29.77±8.01	OOM	22.69±5.96	17.76±13.0	4.78±2.76	28.43±5.60
MetaGIA	64.69±1.77	64.83±1.21	57.91±4.99	OOM	50.75±3.51	57.07±4.87	33.84±2.51	37.36±0.83
Table 4: Node classification accuracy (%) under modification, poisoning, non-targeted attack (Metattack) in transductive learning.
Dataset	Ptb Rate(%)	HANG	HANG-quad	GraphCON	GraphBel	GRAND	GAT	GCN	RGCN	GCN-SVD	Pro-GNN
Polblogs	0	94.77±1.07	94.63±1.06	93.14±0.84	85.13±2.22	95.57±0.44	95.35±0.20	95.69±0.38	95.22±0.14	95.31±0.18	93.20±0.64
5	80.19±2.52	94.38±0.82	70.24±2.71	51.84±3.38	77.58±3.46	83.69±1.45	73.07±0.80	74.34±0.19	89.09±0.22	93.29±0.18
10	74.92±4.32	92.46±1.56	71.87±1.71	56.54±2.30	77.99±1.35	76.32±0.85	70.72±1.13	71.04±0.34	81.24±0.49	89.42±1.09
15	71.65±1.34	90.85±2.43	69.0±0.90	53.41±3.08	73.84±1.46	68.80±1.14	64.96±1.91	67.28±0.38	68.10±3.73	86.04±2.21
20	66.27±3.39	89.19±3.72	60.46±2.31	52.18±0.54	69.14±1.32	51.50±1.63	51.27±1.23	59.89±0.34	57.33±3.15	79.56±5.68
25	65.80±2.33	86.89±8.90	58.67±1.87	51.39±1.36	67.65±1.65	51.19±1.49	49.23±1.36	56.02±0.56	48.66±9.93	63.18±4.40
Pubmed	0	85.08±0.20	85.23±0.14	86.65±0.17	84.02±0.26	85.06±0.26	83.73±0.40	87.19±0.09	86.16±0.18	83.44±0.21	87.33±0.18
5	85.08±0.18	85.12±0.18	86.52±0.14	83.91±0.26	84.11±0.30	78.00±0.44	83.09±0.13	81.08±0.20	83.41±0.15	87.25±0.09
10	85.17±0.23	85.05±0.19	86.41±0.13	84.62±0.26	84.24±0.18	74.93±0.38	81.21±0.09	77.51±0.27	83.27±0.21	87.25±0.09
15	85.0±0.22	85.15±0.17	86.21±0.15	84.83±0.20	83.74±0.34	71.13±0.51	78.66±0.12	73.91±0.25	83.10±0.18	87.20±0.09
20	85.20±0.19	85.03±0.19	86.20±0.18	84.89±0.45	83.58±0.20	68.21±0.96	77.35±0.19	71.18±0.31	83.01±0.22	87.09±0.10
25	85.06±0.17	84.99±0.16	86.04±0.14	85.07±0.15	83.66±0.25	65.41±0.77	75.50±0.17	67.95±0.15	82.72±0.18	86.71±0.09
6.1 Graph Injection Attacks (GIA)
We implement various GIA algorithms following the methodology in [49]. This framework consists of node injection and feature update procedures. Node injection involves generating new edges for injected nodes using gradient information or heuristics. We use the PGD-GIA method [49] to randomly inject nodes and determine their features with the PGD algorithm [50]. TDGIA [12] identifies topological vulnerabilities to guide edge generation and optimize a smooth loss function for feature generation. MetaGIA [49] performs iterative updates of the adjacency matrix and node features using gradient information. Our datasets include citation networks (Cora, Citeseer, Pubmed) [51], the Coauthor academic network [52], an Amazon co-purchase network (Computers) [52], and the Ogbn-Arxiv dataset [53]. For inductive learning, we follow the data splitting method in the GRB framework [54], with  $60\%$  for training,  $10\%$  for validation, and  $20\%$  for testing. Details on data statistics and attack budgets can be found in Appendix C.1. Targeted attacks are applied to the Ogbn-Arxiv and Computers datasets [49]. Additional results for various attack strengths and white-box attacks can be found in Appendix C.4 and Appendix C.3, respectively.
6.2 Performance Results Under GIAs
Upon examining the results in Table 2 and Table 3 pertaining to experiments conducted under GIA conditions, the robustness of our proposed HANG and HANG-quad, is notably prominent across different GIA scenarios. Interestingly, GRAND, despite its Lyapunov stability as analyzed in Theorem 1, does not significantly outperform GAT under certain attacks. In contrast, HANG consistently displays robustness against attacks. Notably, HANG-quad exhibits superior performance to HANG on the Pubmed dataset under GIA perturbations, underscoring the effectiveness of integrating both Lyapunov stability and Hamiltonian mechanics to boost robustness. Although other graph neural flows might demonstrate a range of improved performance compared to conventional GNN models under GIA, the degree of improvement is not consistently distinct. Despite the pronounced association between conservative stability in Hamiltonian systems and adversarial robustness, a clear relationship between adversarial robustness with the other stability of the graph neural flows outlined in Table 1 is not immediately discernible. The performance differential between HANG variants and other graph neural flows further underscores the potential of our proposed Hamiltonian models in enhancing robustness against GIA attacks.
6.3 Graph Modification Attacks
To evaluate the robustness of our proposed conservative models, we conducted graph modification adversarial attacks using the Metattack method [17]. We followed the attack setting described in the Pro-GNN [55] and utilized the perturbed graph provided by the library [56] to ensure a fair comparison. The perturbation rate, which indicates the proportion of altered edges, was incrementally varied in  $5\%$  increments from  $0\%$  to  $25\%$ . For comparison, we also considered other defense models for GNNs, namely Pro-GNN [55], RGCN [57], and GCN-SVD [58]. We report the results of baseline models from [55].
6.4 Performance Results Under Modification/Poisoning/Transductive Attacks
In the case of the Polblogs dataset [59], as shown in Table 4, our proposed HANG-quad model demonstrates superior performance compared to other methods, including existing defense models. This result indicates that incorporating Lyapunov stability indeed enhances HANG's robustness against graph modification and poisoning attacks. For the Pubmed dataset, we note that the impact of Meta-attacks of varying strengths on all graph neural flows, including our proposed ones, is negligible. Conversely, traditional GNN models such as GAT, GCN, and RGCN are marginally affected as the attack strength escalates. This observation underlines the robustness of graph neural flows, including our proposed models, against Meta-attacks on this dataset.
6.5 Combination with other defense mechanisms
It merits noting that our models, HANG and HANG-quad, can be readily integrated with additional defense mechanisms against adversarial attacks. These include Adversarial Training (AT) [60] and other preprocessing methods such as GNNGUARD [61]. This integration can further bolster the robustness of the HANG model. To validate this enhancement, extensive experiments are conducted, with results detailed in Appendix C.8 and Appendix C.9.
In this paper, we conducted a comprehensive study on stability notions in the context of graph neural flows and made significant findings. While Lyapunov stability is frequently employed, it alone may not suffice in guaranteeing robustness against adversarial attacks. With a grounding in foundational physics principles, we proposed a shift towards conservative Hamiltonian neural flows for crafting GNNs resilient against adversarial attacks. Our empirical comparisons across diverse neural flow GNNs, as tested on multiple benchmark datasets subjected to a range of adversarial attacks, have further corroborated this proposition. Notably, GNNs that amalgamate conservative Hamiltonian flows with Lyapunov stability exhibited marked enhancement in their robustness metrics. We are optimistic that our work will inspire further research into marrying physics principles with machine learning paradigms for enhanced security.
8 Acknowledgments and Disclosure of Funding
This research is supported by the Singapore Ministry of Education Academic Research Fund Tier 2 grant MOE-T2EP20220-0002, and the National Research Foundation, Singapore and Infocomm Media Development Authority under its Future Communications Research and Development Programme. To improve the readability, parts of this paper have been grammatically revised using ChatGPT [62].
A Summary of Supplement
In this supplement, we expand on material from the main paper, addressing each point as follows:
1. An in-depth comparison with related work is covered in Appendix B.
2. Appendix C presents the datasets and details of the attackers, and includes additional experimental results, inference time, and model size to reinforce our model's effectiveness.
3. Theoretical proofs supporting assertions made in the main paper are presented in Appendix E.
4. Further discussions on the robustness insights of our model are covered in Appendix D.
5. The complete summary of the algorithm can be found in Appendix G.
6. Lastly, we address the limitations of our work and discuss its broader impact.
B Related Work
In what follows, we briefly review a few concepts closely related to our work.
Graph Adversarial Attacks and Defenses. In modification attacks, adversaries can perturb a graph's topology by adding or removing edges [9, 14-17, 63-66]. To improve the modification attack performance, adversaries are also permitted to perturb node attributes [9, 17, 63, 64, 67, 68]. In injection attacks, adversaries can only inject malicious nodes into the original graph [10-13] while the edges and nodes inside the original graph are not allowed to be perturbed. For defense methods against adversarial attacks, multiple robust GNN models have been proposed. Examples include RobustGCN [69], GRAND [70], ProGNN [71], GLNN [72], GAUGM [73], STABLE [74] and RWL-GNN [75]. In addition, preprocessing-based defenders including GNN-SVD [58] and GNNGuard [76] may help to improve GNN robustness.
In this paper, we use different attacks to test GNNs robustness. We compare graph neural flows with different stability settings with the above-mentioned defense methods as robustness benchmarks.
Stable Graph Neural Flow Networks. While traditional GNNs perform message passing on a simple, discrete and flat space, graph neural flows model the message passing as a continuous diffusion process that occurs on a smooth manifold. GRAND [29] and GRAND++ [30] use heat diffusion to achieve feature information exchange. BLEND [31] exploits the Beltrami diffusion where the nodes' positional information is updated along with their features. GraphCON [35] adopts the coupled oscillator model that preserves the graph's Dirichlet energy over time and thus mitigates the oversmoothing problem. In general, [32] shows that graph neural PDEs are Lyapunov stable and exhibit stronger robustness against graph topology perturbation than traditional GNNs.
While most of the above-mentioned graph neural flows are Lyapunov stable, whether the notion of Lyapunov stability leads to better adversarial robustness is an open question. In this paper, we argue that Lyapunov stability does not necessarily imply adversarial robustness.
Hamiltonian Neural Networks. Hamiltonian equations have been applied to conserve an energy-like quantity in (graph) neural networks. The references [26, 27, 77] train a neural network to infer the Hamiltonian dynamics of a physical system, where Hamiltonian equations are solved using neural ODE solvers. In [78], the authors propose to learn a Hamiltonian function of the system by a neural network to capture the dynamics of physical systems from observed trajectories. They show that the network performs well on noisy and complex systems such as a spring-chain system. To forecast dynamics, the work [79] use neural networks that incorporate Hamiltonian dynamics to efficiently learn phase space orbits and demonstrate the effectiveness of Hamiltonian neural networks on several dynamics benchmarks. The paper [80] builds a Hamiltonian-inspired neural ODE to stabilize the gradients so as to avoid gradient vanishing and gradient exploding.
In this paper, inspired by existing Hamiltonian neural networks, we introduce several energy-conservative graph neural flows. We are neither simulating a physical system nor forecasting a forecast the dynamics for a physical problem. Instead, we combine the Hamiltonian mechanics concept with graph neural networks to develop a new robust GNN.
C More Experiments
C.1 Data and Attackers
The datasets and attack budgets utilized in Table 2 and Table 3 are outlined in Table 5 and Table 6, respectively. These datasets span various domains and scales, thereby providing a diverse base for our study. The adopted attack budget aligns consistently with the specifications set out in the paper [49].
Table 5: Dataset Details
Dataset	# Nodes	#Edges	#Features	#Classes
Cora	2708	5429	1433	7
Citeseer	3327	4732	3703	6
PubMed	19717	44338	500	3
Coauthor	18,333	81,894	6,805	15
Computers	13,752	245,861	767	10
Ogbn-Arxiv	169343	1166243	128	40
Table 6: Attacks' budgets for GIA. * refers to targeted GIA.
Dataset	max # Nodes	max # Edges
Cora	60	20
Citeseer	90	10
PubMed	200	100
Coauthor	300	150
Ogbn-Arxiv*	120	100
Computers*	100	150
C.2 Implementation Details