[65] X. Wan, H. Kenlay, B. Ru, A. Blaas, M. A. Osborne, and X. Dong, "Adversarial attacks on graph classification via bayesian optimisation," arXiv preprint arXiv:2111.02842, 2021.
[66] S. Geisler, T. Schmidt, H. Širin, D. Zügner, A. Bojchevski, and S. Gunnemann, “Robustness of graph neural networks at scale,” Advances Neural Inf. Process. Syst., vol. 34, pp. 7637–7649, 2021.
[67] J. Ma, J. Deng, and Q. Mei, "Adversarial attack on graph neural networks as an influence maximization problem," in Prof. Int. Conf. Web Search Data Mining, 2022, pp. 675-685.
[68] B. Finkelshtein, C. Baskin, E. Zheltonozhskii, and U. Alon, "Single-node attacks for fooling graph neural networks," Neurocomputing, vol. 513, pp. 1-12, 2022.
[69] D. Zhu, Z. Zhang, P. Cui, and W. Zhu, "Robust graph convolutional networks against adversarial attacks," in Proc. Int. Conf. Knowl. Discovery Data Mining, 2019, p. 1399-1407.
[70] W. Feng, J. Zhang, Y. Dong, Y. Han, H. Luan, Q. Xu, Q. Yang, E. Kharlamov, and J. Tang, "Graph random neural networks for semi-supervised learning on graphs," in Proc. Advances Neural Inf. Process. Syst., 2020.
[71] W. Jin, Y. Ma, X. Liu, X. Tang, S. Wang, and J. Tang, "Graph structure learning for robust graph neural networks," in Proc. Int. Conf. Knowl. Discovery Data Mining, 2020, p. 66-74.
[72] X. Gao, W. Hu, and Z. Guo, "Exploring structure-adaptive graph learning for robust semi-supervised classification," in 2020 IEEE International Conference on Multimedia and Expo (ICME). IEEE, 2020, pp. 1-6.
[73] T. Zhao, Y. Liu, L. Neves, O. Woodford, M. Jiang, and N. Shah, "Data augmentation for graph neural networks," in Proc. AAAI Conference on Artificial Intelligence, vol. 35, no. 12, 2021, pp. 11015-11023.
[74] K. Li, Y. Liu, X. Ao, J. Chi, J. Feng, H. Yang, and Q. He, "Reliable representations make a stronger defender: Unsupervised structure refinement for robust gnn," in Proc. Int. Conf. Knowl. Discovery Data Mining, 2022, pp. 925-935.
[75] B. Runwal, S. Kumar et al., "Robust graph neural networks using weighted graph laplacian," arXiv preprint arXiv:2208.01853, 2022.
[76] X. Zhang and M. Zitnik, "Gnnguard: Defending graph neural networks against adversarial attacks," in Proc. Advances Neural Inf. Process. Syst., 2020.
[77] S. Greydanus, M. Dzamba, and J. Yosinski, "Hamiltonian neural networks," in Advances Neural Inf. Process. Syst., 2019.
[78] Z. Chen, J. Zhang, M. Arjovsky, and L. Bottou, “Symplectic recurrent neural networks,” in Proc. Int. Conf. Learn. Representations, 2020.
[79] A. Choudhary, J. F. Lindner, E. G. Holliday, S. T. Miller, S. Sinha, and W. L. Ditto, "Physics-enhanced neural networks learn order and chaos," Physical Review  $E$ , vol. 101, no. 6, p. 062207, 2020.
[80] E. Haber and L. Ruthotto, “Stable architectures for deep neural networks,” Inverse Problems, vol. 34, no. 1, pp. 1–23, Dec. 2017.
[81] J. Li, J. Peng, L. Chen, Z. Zheng, T. Liang, and Q. Ling, "Spectral adversarial training for robust graph neural network," IEEE Transactions on Knowledge and Data Engineering, 2022.
[82] C. Deng, X. Li, Z. Feng, and Z. Zhang, "Garnet: Reduced-rank topology learning for robust and scalable graph neural networks," in Learning on Graphs Conference. PMLR, 2022, pp. 3-1.
[83] V. Nikiforov, “Revisiting schur's bound on the largest singular value,” arXiv preprint math/0702722, 2007.
[84] H. K. Khalil, “Nonlinear control,” 2015, available at: https://www.egr.msu.edu/~khalil/ NonlinearControl/Slides-Short/Lecture_2.pdf (Accessed: 26 September 2023).
[85] R. Durrett, Probability: theory and examples. Cambridge university press, 2019, vol. 49.